Merge tag 'wireless-drivers-next-for-davem-2019-02-22' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next

Kalle Valo says:

====================
wireless-drivers-next patches for 5.1

Most likely the last set of patches for 5.1. WPA3 support to ath10k
and qtnfmac. FTM support to iwlwifi and ath10k. And of course other
new features and bugfixes.

wireless-drivers was merged due to dependency in mt76.

Major changes:

iwlwifi

* HE radiotap

* FTM (Fine Timing Measurement) initiator and responder implementation

* bump supported firmware API to 46

* VHT extended NSS support

* new PCI IDs for 9260 and 22000 series

ath10k

* change QMI interface to support the new (and backwards incompatible)
  interface from HL3.1 and used in recent HL2.0 branch firmware
  releases

* support WPA3 with WCN3990

* support for mac80211 airtime fairness based on transmit rate
  estimation, the firmware needs to support WMI_SERVICE_PEER_STATS to
  enable this

* report transmit airtime to mac80211 with firmwares having
  WMI_SERVICE_REPORT_AIRTIME feature, this to have more accurate
  airtime fairness based on real transmit time (instead of just
  estimated from transmit rate)

* support Fine Timing Measurement (FTM) responder role

* add dynamic VLAN support with firmware having WMI_SERVICE_PER_PACKET_SW_ENCRYPT

* switch to use SPDX license identifiers

ath

* add new country codes for US

brcmfmac

* support monitor frames with the hardware/ucode header

qtnfmac

* enable WPA3 SAE and OWE support

mt76

* beacon support for USB devices (mesh+ad-hoc only)

rtlwifi

* convert to use SPDX license identifiers

libertas_tf

* get the MAC address before registering the device
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

71 files changed, 4090 insertions, 1154 deletions

diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
index eb93711d474b..fdc56f821b5a 100644
--- a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
+++ b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
@@ -6,7 +6,7 @@
  * GPL LICENSE SUMMARY
  *
  * Copyright(c) 2015-2017 Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018-2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -20,7 +20,7 @@
  * BSD LICENSE
  *
  * Copyright(c) 2015-2017 Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018-2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -56,7 +56,7 @@
 #include "iwl-config.h"
 
 /* Highest firmware API version supported */
-#define IWL_22000_UCODE_API_MAX 43
+#define IWL_22000_UCODE_API_MAX 46
 
 /* Lowest firmware API version supported */
 #define IWL_22000_UCODE_API_MIN 39
@@ -79,11 +79,15 @@
 #define IWL_22000_HR_B_F0_FW_PRE        "iwlwifi-Qu-b0-hr-b0-"
 #define IWL_22000_QU_B_HR_B_FW_PRE      "iwlwifi-Qu-b0-hr-b0-"
 #define IWL_22000_HR_B_FW_PRE           "iwlwifi-QuQnj-b0-hr-b0-"
-#define IWL_22000_JF_B0_FW_PRE          "iwlwifi-QuQnj-a0-jf-b0-"
 #define IWL_22000_HR_A0_FW_PRE          "iwlwifi-QuQnj-a0-hr-a0-"
 #define IWL_22000_SU_Z0_FW_PRE          "iwlwifi-su-z0-"
 #define IWL_QU_B_JF_B_FW_PRE            "iwlwifi-Qu-b0-jf-b0-"
+#define IWL_QNJ_B_JF_B_FW_PRE           "iwlwifi-QuQnj-b0-jf-b0-"
 #define IWL_CC_A_FW_PRE                 "iwlwifi-cc-a0-"
+#define IWL_22000_SO_A_JF_B_FW_PRE      "iwlwifi-so-a0-jf-b0-"
+#define IWL_22000_SO_A_HR_B_FW_PRE      "iwlwifi-so-a0-hr-b0-"
+#define IWL_22000_SO_A_GF_A_FW_PRE      "iwlwifi-so-a0-gf-a0-"
+#define IWL_22000_TY_A_GF_A_FW_PRE      "iwlwifi-ty-a0-gf-a0-"
 
 #define IWL_22000_HR_MODULE_FIRMWARE(api) \
         IWL_22000_HR_FW_PRE __stringify(api) ".ucode"
@@ -97,16 +101,26 @@
         IWL_22000_QU_B_HR_B_FW_PRE __stringify(api) ".ucode"
 #define IWL_22000_HR_B_QNJ_MODULE_FIRMWARE(api) \
         IWL_22000_HR_B_FW_PRE __stringify(api) ".ucode"
-#define IWL_22000_JF_B0_QNJ_MODULE_FIRMWARE(api) \
-        IWL_22000_JF_B0_FW_PRE __stringify(api) ".ucode"
 #define IWL_22000_HR_A0_QNJ_MODULE_FIRMWARE(api) \
         IWL_22000_HR_A0_FW_PRE __stringify(api) ".ucode"
 #define IWL_22000_SU_Z0_MODULE_FIRMWARE(api) \
         IWL_22000_SU_Z0_FW_PRE __stringify(api) ".ucode"
 #define IWL_QU_B_JF_B_MODULE_FIRMWARE(api) \
         IWL_QU_B_JF_B_FW_PRE __stringify(api) ".ucode"
-#define IWL_CC_A_MODULE_FIRMWARE(api) \
+#define IWL_QU_B_JF_B_MODULE_FIRMWARE(api) \
+        IWL_QU_B_JF_B_FW_PRE __stringify(api) ".ucode"
+#define IWL_QNJ_B_JF_B_MODULE_FIRMWARE(api)             \
+        IWL_QNJ_B_JF_B_FW_PRE __stringify(api) ".ucode"
+#define IWL_CC_A_MODULE_FIRMWARE(api)                   \
         IWL_CC_A_FW_PRE __stringify(api) ".ucode"
+#define IWL_22000_SO_A_JF_B_MODULE_FIRMWARE(api) \
+        IWL_22000_SO_A_JF_B_FW_PRE __stringify(api) ".ucode"
+#define IWL_22000_SO_A_HR_B_MODULE_FIRMWARE(api) \
+        IWL_22000_SO_A_HR_B_FW_PRE __stringify(api) ".ucode"
+#define IWL_22000_SO_A_GF_A_MODULE_FIRMWARE(api) \
+        IWL_22000_SO_A_GF_A_FW_PRE __stringify(api) ".ucode"
+#define IWL_22000_TY_A_GF_A_MODULE_FIRMWARE(api) \
+        IWL_22000_TY_A_GF_A_FW_PRE __stringify(api) ".ucode"
 
 static const struct iwl_base_params iwl_22000_base_params = {
         .eeprom_size = OTP_LOW_IMAGE_SIZE_32K,
@@ -167,6 +181,10 @@ static const struct iwl_ht_params iwl_22000_ht_params = {
         .d3_debug_data_base_addr = 0x401000,                            \
         .d3_debug_data_length = 60 * 1024
 
+#define IWL_DEVICE_AX200_COMMON                                         \
+        IWL_DEVICE_22000_COMMON,                                        \
+        .umac_prph_offset = 0x300000
+
 #define IWL_DEVICE_22500                                                \
         IWL_DEVICE_22000_COMMON,                                        \
         .device_family = IWL_DEVICE_FAMILY_22000,                       \
@@ -179,6 +197,13 @@ static const struct iwl_ht_params iwl_22000_ht_params = {
         .base_params = &iwl_22560_base_params,                          \
         .csr = &iwl_csr_v2
 
+#define IWL_DEVICE_AX210                                                \
+        IWL_DEVICE_AX200_COMMON,                                        \
+        .device_family = IWL_DEVICE_FAMILY_AX210,                       \
+        .base_params = &iwl_22000_base_params,                          \
+        .csr = &iwl_csr_v1,                                             \
+        .min_txq_size = 128
+
 const struct iwl_cfg iwl22000_2ac_cfg_hr = {
         .name = "Intel(R) Dual Band Wireless AC 22000",
         .fw_name_pre = IWL_22000_HR_FW_PRE,
@@ -198,8 +223,8 @@ const struct iwl_cfg iwl22000_2ac_cfg_jf = {
         IWL_DEVICE_22500,
 };
 
-const struct iwl_cfg iwl22560_2ax_cfg_hr = {
-        .name = "Intel(R) Wireless-AX 22560",
+const struct iwl_cfg iwl_ax101_cfg_qu_hr = {
+        .name = "Intel(R) Wi-Fi 6 AX101",
         .fw_name_pre = IWL_22000_QU_B_HR_B_FW_PRE,
         IWL_DEVICE_22500,
         /*
@@ -220,10 +245,11 @@ const struct iwl_cfg iwl22260_2ax_cfg = {
          * HT size; mac80211 would otherwise pick the HE max (256) by default.
          */
         .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
+        .bisr_workaround = 1,
 };
 
 const struct iwl_cfg killer1650x_2ax_cfg = {
-        .name = "Killer(R) Wireless-AX 1650x Wireless Network Adapter (22260NGW)",
+        .name = "Killer(R) Wireless-AX 1650x Wireless Network Adapter (200NGW)",
         .fw_name_pre = IWL_CC_A_FW_PRE,
         IWL_DEVICE_22500,
         /*
@@ -232,10 +258,11 @@ const struct iwl_cfg killer1650x_2ax_cfg = {
          * HT size; mac80211 would otherwise pick the HE max (256) by default.
          */
         .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
+        .bisr_workaround = 1,
 };
 
 const struct iwl_cfg killer1650w_2ax_cfg = {
-        .name = "Killer(R) Wireless-AX 1650w Wireless Network Adapter (22260D2W)",
+        .name = "Killer(R) Wireless-AX 1650w Wireless Network Adapter (200D2W)",
         .fw_name_pre = IWL_CC_A_FW_PRE,
         IWL_DEVICE_22500,
         /*
@@ -244,6 +271,7 @@ const struct iwl_cfg killer1650w_2ax_cfg = {
          * HT size; mac80211 would otherwise pick the HE max (256) by default.
          */
         .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
+        .bisr_workaround = 1,
 };
 
 /*
@@ -275,6 +303,18 @@ const struct iwl_cfg iwl9560_2ac_160_cfg_qu_b0_jf_b0 = {
         IWL_DEVICE_22500,
 };
 
+const struct iwl_cfg iwl9560_2ac_cfg_qnj_jf_b0 = {
+        .name = "Intel(R) Wireless-AC 9560 160MHz",
+        .fw_name_pre = IWL_QNJ_B_JF_B_FW_PRE,
+        IWL_DEVICE_22500,
+        /*
+         * This device doesn't support receiving BlockAck with a large bitmap
+         * so we need to restrict the size of transmitted aggregation to the
+         * HT size; mac80211 would otherwise pick the HE max (256) by default.
+         */
+        .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
+};
+
 const struct iwl_cfg killer1550i_2ac_cfg_qu_b0_jf_b0 = {
         .name = "Killer (R) Wireless-AC 1550i Wireless Network Adapter (9560NGW)",
         .fw_name_pre = IWL_QU_B_JF_B_FW_PRE,
@@ -347,18 +387,6 @@ const struct iwl_cfg iwl22000_2ax_cfg_qnj_hr_b0 = {
         .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
 };
 
-const struct iwl_cfg iwl22000_2ax_cfg_qnj_jf_b0 = {
-        .name = "Intel(R) Dual Band Wireless AX 22000",
-        .fw_name_pre = IWL_22000_JF_B0_FW_PRE,
-        IWL_DEVICE_22500,
-        /*
-         * This device doesn't support receiving BlockAck with a large bitmap
-         * so we need to restrict the size of transmitted aggregation to the
-         * HT size; mac80211 would otherwise pick the HE max (256) by default.
-         */
-        .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
-};
-
 const struct iwl_cfg iwl22000_2ax_cfg_qnj_hr_a0 = {
         .name = "Intel(R) Dual Band Wireless AX 22000",
         .fw_name_pre = IWL_22000_HR_A0_FW_PRE,
@@ -384,13 +412,41 @@ const struct iwl_cfg iwl22560_2ax_cfg_su_cdb = {
         .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
 };
 
+const struct iwl_cfg iwlax210_2ax_cfg_so_jf_a0 = {
+        .name = "Intel(R) Wireless-AC 9560 160MHz",
+        .fw_name_pre = IWL_22000_SO_A_JF_B_FW_PRE,
+        IWL_DEVICE_AX210,
+};
+
+const struct iwl_cfg iwlax210_2ax_cfg_so_hr_a0 = {
+        .name = "Intel(R) Wi-Fi 6 AX201 160MHz",
+        .fw_name_pre = IWL_22000_SO_A_HR_B_FW_PRE,
+        IWL_DEVICE_AX210,
+};
+
+const struct iwl_cfg iwlax210_2ax_cfg_so_gf_a0 = {
+        .name = "Intel(R) Wi-Fi 7 AX211 160MHz",
+        .fw_name_pre = IWL_22000_SO_A_GF_A_FW_PRE,
+        IWL_DEVICE_AX210,
+};
+
+const struct iwl_cfg iwlax210_2ax_cfg_ty_gf_a0 = {
+        .name = "Intel(R) Wi-Fi 7 AX210 160MHz",
+        .fw_name_pre = IWL_22000_TY_A_GF_A_FW_PRE,
+        IWL_DEVICE_AX210,
+};
+
 MODULE_FIRMWARE(IWL_22000_HR_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_22000_JF_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_22000_HR_A_F0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_22000_HR_B_F0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_22000_HR_B_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
-MODULE_FIRMWARE(IWL_22000_JF_B0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_22000_HR_A0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_22000_SU_Z0_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_QU_B_JF_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL_QNJ_B_JF_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_CC_A_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL_22000_SO_A_JF_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL_22000_SO_A_HR_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL_22000_SO_A_GF_A_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL_22000_TY_A_GF_A_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
index 113bcf7735a0..3225b64eb845 100644
--- a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
+++ b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
@@ -57,7 +57,7 @@
 #include "fw/file.h"
 
 /* Highest firmware API version supported */
-#define IWL9000_UCODE_API_MAX   43
+#define IWL9000_UCODE_API_MAX   46
 
 /* Lowest firmware API version supported */
 #define IWL9000_UCODE_API_MIN   30
diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/agn.h b/drivers/net/wireless/intel/iwlwifi/dvm/agn.h
index 431e13c6ee35..254a5ce52456 100644
--- a/drivers/net/wireless/intel/iwlwifi/dvm/agn.h
+++ b/drivers/net/wireless/intel/iwlwifi/dvm/agn.h
@@ -439,13 +439,10 @@ static inline void iwl_dvm_set_pmi(struct iwl_priv *priv, bool state)
 }
 
 #ifdef CONFIG_IWLWIFI_DEBUGFS
-int iwl_dbgfs_register(struct iwl_priv *priv, struct dentry *dbgfs_dir);
+void iwl_dbgfs_register(struct iwl_priv *priv, struct dentry *dbgfs_dir);
 #else
-static inline int iwl_dbgfs_register(struct iwl_priv *priv,
-                                     struct dentry *dbgfs_dir)
-{
-        return 0;
-}
+static inline void iwl_dbgfs_register(struct iwl_priv *priv,
+                                      struct dentry *dbgfs_dir) { }
 #endif /* CONFIG_IWLWIFI_DEBUGFS */
 
 #ifdef CONFIG_IWLWIFI_DEBUG
diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/debugfs.c b/drivers/net/wireless/intel/iwlwifi/dvm/debugfs.c
index 3d2e44a642de..d4b19673b06a 100644
--- a/drivers/net/wireless/intel/iwlwifi/dvm/debugfs.c
+++ b/drivers/net/wireless/intel/iwlwifi/dvm/debugfs.c
@@ -3,6 +3,7 @@
  * GPL LICENSE SUMMARY
  *
  * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
+ * Copyright (C) 2018 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -36,31 +37,8 @@
 
 /* create and remove of files */
 #define DEBUGFS_ADD_FILE(name, parent, mode) do {                       \
-        if (!debugfs_create_file(#name, mode, parent, priv,             \
-                                 &iwl_dbgfs_##name##_ops))              \
-                goto err;                                               \
-} while (0)
-
-#define DEBUGFS_ADD_BOOL(name, parent, ptr) do {                        \
-        struct dentry *__tmp;                                           \
-        __tmp = debugfs_create_bool(#name, 0600, parent, ptr);          \
-        if (IS_ERR(__tmp) || !__tmp)                                    \
-                goto err;                                               \
-} while (0)
-
-#define DEBUGFS_ADD_X32(name, parent, ptr) do {                         \
-        struct dentry *__tmp;                                           \
-        __tmp = debugfs_create_x32(#name, 0600, parent, ptr);           \
-        if (IS_ERR(__tmp) || !__tmp)                                    \
-                goto err;                                               \
-} while (0)
-
-#define DEBUGFS_ADD_U32(name, parent, ptr, mode) do {                   \
-        struct dentry *__tmp;                                           \
-        __tmp = debugfs_create_u32(#name, mode,                         \
-                                   parent, ptr);                        \
-        if (IS_ERR(__tmp) || !__tmp)                                    \
-                goto err;                                               \
+        debugfs_create_file(#name, mode, parent, priv,                  \
+                            &iwl_dbgfs_##name##_ops);                   \
 } while (0)
 
 /* file operation */
@@ -2238,7 +2216,7 @@ static ssize_t iwl_dbgfs_log_event_write(struct file *file,
         buf_size = min(count, sizeof(buf) -  1);
         if (copy_from_user(buf, user_buf, buf_size))
                 return -EFAULT;
-        if (sscanf(buf, "%d", &event_log_flag) != 1)
+        if (sscanf(buf, "%u", &event_log_flag) != 1)
                 return -EFAULT;
         if (event_log_flag == 1)
                 iwl_dump_nic_event_log(priv, true, NULL);
@@ -2347,21 +2325,15 @@ DEBUGFS_READ_WRITE_FILE_OPS(calib_disabled);
  * Create the debugfs files and directories
  *
  */
-int iwl_dbgfs_register(struct iwl_priv *priv, struct dentry *dbgfs_dir)
+void iwl_dbgfs_register(struct iwl_priv *priv, struct dentry *dbgfs_dir)
 {
         struct dentry *dir_data, *dir_rf, *dir_debug;
 
         priv->debugfs_dir = dbgfs_dir;
 
         dir_data = debugfs_create_dir("data", dbgfs_dir);
-        if (!dir_data)
-                goto err;
         dir_rf = debugfs_create_dir("rf", dbgfs_dir);
-        if (!dir_rf)
-                goto err;
         dir_debug = debugfs_create_dir("debug", dbgfs_dir);
-        if (!dir_debug)
-                goto err;
 
         DEBUGFS_ADD_FILE(nvm, dir_data, 0400);
         DEBUGFS_ADD_FILE(sram, dir_data, 0600);
@@ -2421,13 +2393,6 @@ int iwl_dbgfs_register(struct iwl_priv *priv, struct dentry *dbgfs_dir)
 
                 snprintf(buf, 100, "../../%pd2", dev_dir);
 
-                if (!debugfs_create_symlink("iwlwifi", mac80211_dir, buf))
-                        goto err;
+                debugfs_create_symlink("iwlwifi", mac80211_dir, buf);
         }
-
-        return 0;
-
-err:
-        IWL_ERR(priv, "failed to create the dvm debugfs entries\n");
-        return -ENOMEM;
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/main.c b/drivers/net/wireless/intel/iwlwifi/dvm/main.c
index bd3c3b921d4c..7c68a86ed9e1 100644
--- a/drivers/net/wireless/intel/iwlwifi/dvm/main.c
+++ b/drivers/net/wireless/intel/iwlwifi/dvm/main.c
@@ -1509,13 +1509,10 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
         if (iwlagn_mac_setup_register(priv, &fw->ucode_capa))
                 goto out_destroy_workqueue;
 
-        if (iwl_dbgfs_register(priv, dbgfs_dir))
-                goto out_mac80211_unregister;
+        iwl_dbgfs_register(priv, dbgfs_dir);
 
         return op_mode;
 
-out_mac80211_unregister:
-        iwlagn_mac_unregister(priv);
 out_destroy_workqueue:
         iwl_tt_exit(priv);
         iwl_cancel_deferred_work(priv);
@@ -1881,7 +1878,7 @@ int iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log,
                 return pos;
         }
 
-        if (!(iwl_have_debug_level(IWL_DL_FW_ERRORS)) && !full_log)
+        if (!(iwl_have_debug_level(IWL_DL_FW)) && !full_log)
                 size = (size > DEFAULT_DUMP_EVENT_LOG_ENTRIES)
                         ? DEFAULT_DUMP_EVENT_LOG_ENTRIES : size;
         IWL_ERR(priv, "Start IWL Event Log Dump: display last %u entries\n",
@@ -1897,7 +1894,7 @@ int iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log,
                 if (!*buf)
                         return -ENOMEM;
         }
-        if (iwl_have_debug_level(IWL_DL_FW_ERRORS) || full_log) {
+        if (iwl_have_debug_level(IWL_DL_FW) || full_log) {
                 /*
                  * if uCode has wrapped back to top of log,
                  * start at the oldest entry,
@@ -1927,7 +1924,7 @@ static void iwlagn_fw_error(struct iwl_priv *priv, bool ondemand)
         unsigned int reload_msec;
         unsigned long reload_jiffies;
 
-        if (iwl_have_debug_level(IWL_DL_FW_ERRORS))
+        if (iwl_have_debug_level(IWL_DL_FW))
                 iwl_print_rx_config_cmd(priv, IWL_RXON_CTX_BSS);
 
         /* uCode is no longer loaded. */
@@ -1965,12 +1962,12 @@ static void iwlagn_fw_error(struct iwl_priv *priv, bool ondemand)
 
         if (!test_bit(STATUS_EXIT_PENDING, &priv->status)) {
                 if (iwlwifi_mod_params.fw_restart) {
-                        IWL_DEBUG_FW_ERRORS(priv,
-                                  "Restarting adapter due to uCode error.\n");
+                        IWL_DEBUG_FW(priv,
+                                     "Restarting adapter due to uCode error.\n");
                         queue_work(priv->workqueue, &priv->restart);
                 } else
-                        IWL_DEBUG_FW_ERRORS(priv,
-                                  "Detected FW error, but not restarting\n");
+                        IWL_DEBUG_FW(priv,
+                                     "Detected FW error, but not restarting\n");
         }
 }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/rx.c b/drivers/net/wireless/intel/iwlwifi/dvm/rx.c
index 6f17a5e24e82..e224b23f0ba8 100644
--- a/drivers/net/wireless/intel/iwlwifi/dvm/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/dvm/rx.c
@@ -2,6 +2,7 @@
  *
  * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2015 Intel Deutschland GmbH
+ * Copyright(c) 2018 Intel Corporation
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portionhelp of the ieee80211 subsystem header files.
@@ -592,7 +593,7 @@ static int iwlagn_set_decrypted_flag(struct iwl_priv *priv,
                 if ((decrypt_res & RX_RES_STATUS_DECRYPT_TYPE_MSK) ==
                     RX_RES_STATUS_BAD_KEY_TTAK)
                         break;
-
+                /* fall through */
         case RX_RES_STATUS_SEC_TYPE_WEP:
                 if ((decrypt_res & RX_RES_STATUS_DECRYPT_TYPE_MSK) ==
                     RX_RES_STATUS_BAD_ICV_MIC) {
@@ -601,6 +602,7 @@ static int iwlagn_set_decrypted_flag(struct iwl_priv *priv,
                         IWL_DEBUG_RX(priv, "Packet destroyed\n");
                         return -1;
                 }
+                /* fall through */
         case RX_RES_STATUS_SEC_TYPE_CCMP:
                 if ((decrypt_res & RX_RES_STATUS_DECRYPT_TYPE_MSK) ==
                     RX_RES_STATUS_DECRYPT_OK) {
@@ -729,7 +731,7 @@ static u32 iwlagn_translate_rx_status(struct iwl_priv *priv, u32 decrypt_in)
                         decrypt_out |= RX_RES_STATUS_BAD_KEY_TTAK;
                         break;
                 }
-                /* fall through if TTAK OK */
+                /* fall through */
         default:
                 if (!(decrypt_in & RX_MPDU_RES_STATUS_ICV_OK))
                         decrypt_out |= RX_RES_STATUS_BAD_ICV_MIC;
diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/scan.c b/drivers/net/wireless/intel/iwlwifi/dvm/scan.c
index 8d7aafb4d9e9..f190f7beb3a8 100644
--- a/drivers/net/wireless/intel/iwlwifi/dvm/scan.c
+++ b/drivers/net/wireless/intel/iwlwifi/dvm/scan.c
@@ -3,6 +3,7 @@
  * GPL LICENSE SUMMARY
  *
  * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2018        Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -418,7 +419,7 @@ static u16 iwl_limit_dwell(struct iwl_priv *priv, u16 dwell_time)
                 limit = (limits[1] * 98) / 100 - IWL_CHANNEL_TUNE_TIME * 2;
                 limit /= 2;
                 dwell_time = min(limit, dwell_time);
-                /* fall through to limit further */
+                /* fall through */
         case 1:
                 limit = (limits[0] * 98) / 100 - IWL_CHANNEL_TUNE_TIME * 2;
                 limit /= n_active;
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
index 32d000cffe9f..405038ce98d6 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
@@ -6,6 +6,7 @@
  * GPL LICENSE SUMMARY
  *
  * Copyright(c) 2017        Intel Deutschland GmbH
+ * Copyright (C) 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -26,6 +27,7 @@
  * BSD LICENSE
  *
  * Copyright(c) 2017        Intel Deutschland GmbH
+ * Copyright (C) 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -205,3 +207,33 @@ out:
         return dflt_pwr_limit;
 }
 IWL_EXPORT_SYMBOL(iwl_acpi_get_pwr_limit);
+
+int iwl_acpi_get_eckv(struct device *dev, u32 *extl_clk)
+{
+        union acpi_object *wifi_pkg, *data;
+        int ret;
+
+        data = iwl_acpi_get_object(dev, ACPI_ECKV_METHOD);
+        if (IS_ERR(data))
+                return PTR_ERR(data);
+
+        wifi_pkg = iwl_acpi_get_wifi_pkg(dev, data, ACPI_ECKV_WIFI_DATA_SIZE);
+        if (IS_ERR(wifi_pkg)) {
+                ret = PTR_ERR(wifi_pkg);
+                goto out_free;
+        }
+
+        if (wifi_pkg->package.elements[1].type != ACPI_TYPE_INTEGER) {
+                ret = -EINVAL;
+                goto out_free;
+        }
+
+        *extl_clk = wifi_pkg->package.elements[1].integer.value;
+
+        ret = 0;
+
+out_free:
+        kfree(data);
+        return ret;
+}
+IWL_EXPORT_SYMBOL(iwl_acpi_get_eckv);
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.h b/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
index 7492dfb6729b..f5704e16643f 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
@@ -6,7 +6,7 @@
  * GPL LICENSE SUMMARY
  *
  * Copyright(c) 2017        Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019        Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -27,7 +27,7 @@
  * BSD LICENSE
  *
  * Copyright(c) 2017        Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019       Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -67,6 +67,7 @@
 #define ACPI_WGDS_METHOD        "WGDS"
 #define ACPI_WRDD_METHOD        "WRDD"
 #define ACPI_SPLC_METHOD        "SPLC"
+#define ACPI_ECKV_METHOD        "ECKV"
 
 #define ACPI_WIFI_DOMAIN        (0x07)
 
@@ -86,6 +87,7 @@
 #define ACPI_WGDS_WIFI_DATA_SIZE        19
 #define ACPI_WRDD_WIFI_DATA_SIZE        2
 #define ACPI_SPLC_WIFI_DATA_SIZE        2
+#define ACPI_ECKV_WIFI_DATA_SIZE        2
 
 #define ACPI_WGDS_NUM_BANDS             2
 #define ACPI_WGDS_TABLE_SIZE            3
@@ -109,6 +111,17 @@ int iwl_acpi_get_mcc(struct device *dev, char *mcc);
 
 u64 iwl_acpi_get_pwr_limit(struct device *dev);
 
+/*
+ * iwl_acpi_get_eckv - read external clock validation from ACPI, if available
+ *
+ * @dev: the struct device
+ * @extl_clk: output var (2 bytes) that will get the clk indication.
+ *
+ * This function tries to read the external clock indication
+ * from ACPI if available.
+ */
+int iwl_acpi_get_eckv(struct device *dev, u32 *extl_clk);
+
 #else /* CONFIG_ACPI */
 
 static inline void *iwl_acpi_get_object(struct device *dev, acpi_string method)
@@ -133,5 +146,10 @@ static inline u64 iwl_acpi_get_pwr_limit(struct device *dev)
         return 0;
 }
 
+static inline int iwl_acpi_get_eckv(struct device *dev, u32 *extl_clk)
+{
+        return -ENOENT;
+}
+
 #endif /* CONFIG_ACPI */
 #endif /* __iwl_fw_acpi__ */
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/alive.h b/drivers/net/wireless/intel/iwlwifi/fw/api/alive.h
index 08d3d8a190f6..df1bd0d2450e 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/alive.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/alive.h
@@ -96,14 +96,7 @@ enum {
 
 #define IWL_ALIVE_FLG_RFKILL    BIT(0)
 
-struct iwl_lmac_alive {
-        __le32 ucode_major;
-        __le32 ucode_minor;
-        u8 ver_subtype;
-        u8 ver_type;
-        u8 mac;
-        u8 opt;
-        __le32 timestamp;
+struct iwl_lmac_debug_addrs {
         __le32 error_event_table_ptr;   /* SRAM address for error log */
         __le32 log_event_table_ptr;     /* SRAM address for LMAC event log */
         __le32 cpu_register_ptr;
@@ -112,13 +105,28 @@ struct iwl_lmac_alive {
         __le32 scd_base_ptr;            /* SRAM address for SCD */
         __le32 st_fwrd_addr;            /* pointer to Store and forward */
         __le32 st_fwrd_size;
+} __packed; /* UCODE_DEBUG_ADDRS_API_S_VER_2 */
+
+struct iwl_lmac_alive {
+        __le32 ucode_major;
+        __le32 ucode_minor;
+        u8 ver_subtype;
+        u8 ver_type;
+        u8 mac;
+        u8 opt;
+        __le32 timestamp;
+        struct iwl_lmac_debug_addrs dbg_ptrs;
 } __packed; /* UCODE_ALIVE_NTFY_API_S_VER_3 */
 
+struct iwl_umac_debug_addrs {
+        __le32 error_info_addr;         /* SRAM address for UMAC error log */
+        __le32 dbg_print_buff_addr;
+} __packed; /* UMAC_DEBUG_ADDRS_API_S_VER_1 */
+
 struct iwl_umac_alive {
         __le32 umac_major;              /* UMAC version: major */
         __le32 umac_minor;              /* UMAC version: minor */
-        __le32 error_info_addr;         /* SRAM address for UMAC error log */
-        __le32 dbg_print_buff_addr;
+        struct iwl_umac_debug_addrs dbg_ptrs;
 } __packed; /* UMAC_ALIVE_DATA_API_S_VER_2 */
 
 struct mvm_alive_resp_v3 {
@@ -189,4 +197,24 @@ struct iwl_card_state_notif {
         __le32 flags;
 } __packed; /* CARD_STATE_NTFY_API_S_VER_1 */
 
+/**
+ * enum iwl_error_recovery_flags - flags for error recovery cmd
+ * @ERROR_RECOVERY_UPDATE_DB: update db from blob sent
+ * @ERROR_RECOVERY_END_OF_RECOVERY: end of recovery
+ */
+enum iwl_error_recovery_flags {
+        ERROR_RECOVERY_UPDATE_DB = BIT(0),
+        ERROR_RECOVERY_END_OF_RECOVERY = BIT(1),
+};
+
+/**
+ * struct iwl_fw_error_recovery_cmd - recovery cmd sent upon assert
+ * @flags: &enum iwl_error_recovery_flags
+ * @buf_size: db buffer size in bytes
+ */
+struct iwl_fw_error_recovery_cmd {
+        __le32 flags;
+        __le32 buf_size;
+} __packed; /* ERROR_RECOVERY_CMD_HDR_API_S_VER_1 */
+
 #endif /* __iwl_fw_api_alive_h__ */
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/commands.h b/drivers/net/wireless/intel/iwlwifi/fw/api/commands.h
index 0290b333d860..4d2274bcc0b5 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/commands.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/commands.h
@@ -643,6 +643,11 @@ enum iwl_system_subcmd_ids {
          * @INIT_EXTENDED_CFG_CMD: &struct iwl_init_extended_cfg_cmd
          */
         INIT_EXTENDED_CFG_CMD = 0x03,
+
+        /**
+         * @FW_ERROR_RECOVERY_CMD: &struct iwl_fw_error_recovery_cmd
+         */
+        FW_ERROR_RECOVERY_CMD = 0x7,
 };
 
 #endif /* __iwl_fw_api_commands_h__ */
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/dbg-tlv.h b/drivers/net/wireless/intel/iwlwifi/fw/api/dbg-tlv.h
index ab82b7a67967..33858787817b 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/dbg-tlv.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/dbg-tlv.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -25,7 +25,7 @@
  *
  * BSD LICENSE
  *
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -70,7 +70,7 @@ struct iwl_fw_ini_header {
         __le32 tlv_version;
         __le32 apply_point;
         u8 data[];
-} __packed; /* FW_INI_HEADER_TLV_S */
+} __packed; /* FW_DEBUG_TLV_HEADER_S */
 
 /**
  * struct iwl_fw_ini_allocation_tlv - (IWL_FW_INI_TLV_TYPE_BUFFER_ALLOCATION)
@@ -92,7 +92,7 @@ struct iwl_fw_ini_allocation_tlv {
         __le32 size;
         __le32 max_fragments;
         __le32 min_frag_size;
-} __packed; /* FW_INI_BUFFER_ALLOCATION_TLV_S_VER_1 */
+} __packed; /* FW_DEBUG_TLV_BUFFER_ALLOCATION_TLV_S_VER_1 */
 
 /**
  * struct iwl_fw_ini_hcmd (IWL_FW_INI_TLV_TYPE_HCMD)
@@ -108,7 +108,7 @@ struct iwl_fw_ini_hcmd {
         u8 group;
         __le16 padding;
         u8 data[0];
-} __packed; /* FW_INI_HCMD_S */
+} __packed; /* FW_DEBUG_TLV_HCMD_DATA_S */
 
 /**
  * struct iwl_fw_ini_hcmd_tlv
@@ -118,7 +118,7 @@ struct iwl_fw_ini_hcmd {
 struct iwl_fw_ini_hcmd_tlv {
         struct iwl_fw_ini_header header;
         struct iwl_fw_ini_hcmd hcmd;
-} __packed; /* FW_INI_HCMD_TLV_S_VER_1 */
+} __packed; /* FW_DEBUG_TLV_HCMD_S_VER_1 */
 
 /*
  * struct iwl_fw_ini_debug_flow_tlv (IWL_FW_INI_TLV_TYPE_DEBUG_FLOW)
@@ -129,20 +129,50 @@ struct iwl_fw_ini_hcmd_tlv {
 struct iwl_fw_ini_debug_flow_tlv {
         struct iwl_fw_ini_header header;
         __le32 debug_flow_cfg;
-} __packed; /* FW_INI_DEBUG_FLOW_TLV_S_VER_1 */
+} __packed; /* FW_DEBUG_TLV_FLOW_TLV_S_VER_1 */
 
-#define IWL_FW_INI_MAX_REGION_ID        20
+#define IWL_FW_INI_MAX_REGION_ID        64
 #define IWL_FW_INI_MAX_NAME             32
+
+/**
+ * struct iwl_fw_ini_region_cfg_internal - meta data of internal memory region
+ * @num_of_range: the amount of ranges in the region
+ * @range_data_size: size of the data to read per range, in bytes.
+ */
+struct iwl_fw_ini_region_cfg_internal {
+        __le32 num_of_ranges;
+        __le32 range_data_size;
+} __packed; /* FW_DEBUG_TLV_REGION_NIC_INTERNAL_RANGES_S */
+
+/**
+ * struct iwl_fw_ini_region_cfg_fifos - meta data of fifos region
+ * @fid1: fifo id 1 - bitmap of lmac tx/rx fifos to include in the region
+ * @fid2: fifo id 2 - bitmap of umac rx fifos to include in the region.
+ *      It is unused for tx.
+ * @num_of_registers: number of prph registers in the region, each register is
+ *      4 bytes size.
+ * @header_only: none zero value indicates that this region does not include
+ *      fifo data and includes only the given registers.
+ */
+struct iwl_fw_ini_region_cfg_fifos {
+        __le32 fid1;
+        __le32 fid2;
+        __le32 num_of_registers;
+        __le32 header_only;
+} __packed; /* FW_DEBUG_TLV_REGION_FIFOS_S */
+
 /**
  * struct iwl_fw_ini_region_cfg
  * @region_id: ID of this dump configuration
  * @region_type: &enum iwl_fw_ini_region_type
  * @num_regions: amount of regions in the address array.
- * @allocation_id: For DRAM type field substitutes for allocation_id.
  * @name_len: name length
  * @name: file name to use for this region
- * @size: size of the data, in bytes.(unused for IWL_FW_INI_REGION_DRAM_BUFFER)
- * @start_addr: array of addresses. (unused for IWL_FW_INI_REGION_DRAM_BUFFER)
+ * @internal: used in case the region uses internal memory.
+ * @allocation_id: For DRAM type field substitutes for allocation_id
+ * @fifos: used in case of fifos region.
+ * @offset: offset to use for each memory base address
+ * @start_addr: array of addresses.
  */
 struct iwl_fw_ini_region_cfg {
         __le32 region_id;
@@ -150,32 +180,38 @@ struct iwl_fw_ini_region_cfg {
         __le32 name_len;
         u8 name[IWL_FW_INI_MAX_NAME];
         union {
-                __le32 num_regions;
+                struct iwl_fw_ini_region_cfg_internal internal;
                 __le32 allocation_id;
+                struct iwl_fw_ini_region_cfg_fifos fifos;
         };
-        __le32 size;
+        __le32 offset;
         __le32 start_addr[];
-} __packed; /* FW_INI_REGION_CONFIG_S */
+} __packed; /* FW_DEBUG_TLV_REGION_CONFIG_S */
 
 /**
  * struct iwl_fw_ini_region_tlv - (IWL_FW_INI_TLV_TYPE_REGION_CFG)
  * DUMP sections define IDs and triggers that use those IDs TLV
  * @header: header
  * @num_regions: how many different region section and IDs are coming next
- * @iwl_fw_ini_dump dump_config: list of dump configurations
+ * @region_config: list of dump configurations
  */
 struct iwl_fw_ini_region_tlv {
         struct iwl_fw_ini_header header;
         __le32 num_regions;
         struct iwl_fw_ini_region_cfg region_config[];
-} __packed; /* FW_INI_REGION_CFG_S */
+} __packed; /* FW_DEBUG_TLV_REGIONS_S_VER_1 */
 
 /**
  * struct iwl_fw_ini_trigger - (IWL_FW_INI_TLV_TYPE_DUMP_CFG)
  * Region sections define IDs and triggers that use those IDs TLV
  *
  * @trigger_id: enum &iwl_fw_ini_tigger_id
- * @ignore_default: override FW TLV with binary TLV
+ * @override_trig: determines how apply trigger in case a trigger with the
+ *      same id is already in use. Using the first 2 bytes:
+ *      Byte 0: if 0, override trigger configuration, otherwise use the
+ *      existing configuration.
+ *      Byte 1: if 0, override trigger regions, otherwise append regions to
+ *      existing trigger.
  * @dump_delay: delay from trigger fire to dump, in usec
  * @occurrences: max amount of times to be fired
  * @ignore_consec: ignore consecutive triggers, in usec
@@ -187,7 +223,7 @@ struct iwl_fw_ini_region_tlv {
  */
 struct iwl_fw_ini_trigger {
         __le32 trigger_id;
-        __le32 ignore_default;
+        __le32 override_trig;
         __le32 dump_delay;
         __le32 occurrences;
         __le32 ignore_consec;
@@ -196,7 +232,7 @@ struct iwl_fw_ini_trigger {
         __le32 trigger_data;
         __le32 num_regions;
         __le32 data[];
-} __packed; /* FW_INI_TRIGGER_CONFIG_S */
+} __packed; /* FW_TLV_DEBUG_TRIGGER_CONFIG_S */
 
 /**
  * struct iwl_fw_ini_trigger_tlv - (IWL_FW_INI_TLV_TYPE_TRIGGERS_CFG)
@@ -210,20 +246,17 @@ struct iwl_fw_ini_trigger_tlv {
         struct iwl_fw_ini_header header;
         __le32 num_triggers;
         struct iwl_fw_ini_trigger trigger_config[];
-} __packed; /* FW_INI_TRIGGER_CFG_S */
+} __packed; /* FW_TLV_DEBUG_TRIGGERS_S_VER_1 */
 
 /**
  * enum iwl_fw_ini_trigger_id
  * @IWL_FW_TRIGGER_ID_FW_ASSERT: FW assert
- * @IWL_FW_TRIGGER_ID_FW_TFD_Q_HANG: TFD queue hang
  * @IWL_FW_TRIGGER_ID_FW_HW_ERROR: HW assert
- * @IWL_FW_TRIGGER_ID_FW_TRIGGER_ERROR: FW error notification
- * @IWL_FW_TRIGGER_ID_FW_TRIGGER_WARNING: FW warning notification
- * @IWL_FW_TRIGGER_ID_FW_TRIGGER_INFO: FW info notification
- * @IWL_FW_TRIGGER_ID_FW_TRIGGER_DEBUG: FW debug notification
+ * @IWL_FW_TRIGGER_ID_FW_TFD_Q_HANG: TFD queue hang
+ * @IWL_FW_TRIGGER_ID_FW_DEBUG_HOST_TRIGGER: FW debug notification
+ * @IWL_FW_TRIGGER_ID_FW_GENERIC_NOTIFOCATION: FW generic notification
  * @IWL_FW_TRIGGER_ID_USER_TRIGGER: User trigger
  * @IWL_FW_TRIGGER_ID_HOST_PEER_CLIENT_INACTIVITY: peer inactivity
- * @FW_DEBUG_TLV_TRIGGER_ID_HOST_DID_INITIATED_EVENT: undefined
  * @IWL_FW_TRIGGER_ID_HOST_TX_LATENCY_THRESHOLD_CROSSED: TX latency
  *      threshold was crossed
  * @IWL_FW_TRIGGER_ID_HOST_TX_RESPONSE_STATUS_FAILED: TX failed
@@ -257,50 +290,53 @@ struct iwl_fw_ini_trigger_tlv {
  * @IWL_FW_TRIGGER_ID_NUM: number of trigger IDs
  */
 enum iwl_fw_ini_trigger_id {
+        IWL_FW_TRIGGER_ID_INVALID                               = 0,
+
         /* Errors triggers */
         IWL_FW_TRIGGER_ID_FW_ASSERT                             = 1,
-        IWL_FW_TRIGGER_ID_FW_TFD_Q_HANG                         = 2,
-        IWL_FW_TRIGGER_ID_FW_HW_ERROR                           = 3,
-        /* Generic triggers */
-        IWL_FW_TRIGGER_ID_FW_TRIGGER_ERROR                      = 4,
-        IWL_FW_TRIGGER_ID_FW_TRIGGER_WARNING                    = 5,
-        IWL_FW_TRIGGER_ID_FW_TRIGGER_INFO                       = 6,
-        IWL_FW_TRIGGER_ID_FW_TRIGGER_DEBUG                      = 7,
-        /* User Trigger */
-        IWL_FW_TRIGGER_ID_USER_TRIGGER                          = 8,
+        IWL_FW_TRIGGER_ID_FW_HW_ERROR                           = 2,
+        IWL_FW_TRIGGER_ID_FW_TFD_Q_HANG                         = 3,
+
+        /* FW triggers */
+        IWL_FW_TRIGGER_ID_FW_DEBUG_HOST_TRIGGER                 = 4,
+        IWL_FW_TRIGGER_ID_FW_GENERIC_NOTIFOCATION               = 5,
+
+        /* User trigger */
+        IWL_FW_TRIGGER_ID_USER_TRIGGER                          = 6,
+
         /* Host triggers */
-        IWL_FW_TRIGGER_ID_HOST_PEER_CLIENT_INACTIVITY           = 9,
-        IWL_FW_TRIGGER_ID_HOST_DID_INITIATED_EVENT              = 10,
-        IWL_FW_TRIGGER_ID_HOST_TX_LATENCY_THRESHOLD_CROSSED     = 11,
-        IWL_FW_TRIGGER_ID_HOST_TX_RESPONSE_STATUS_FAILED        = 12,
-        IWL_FW_TRIGGER_ID_HOST_OS_REQ_DEAUTH_PEER               = 13,
-        IWL_FW_TRIGGER_ID_HOST_STOP_GO_REQUEST                  = 14,
-        IWL_FW_TRIGGER_ID_HOST_START_GO_REQUEST                 = 15,
-        IWL_FW_TRIGGER_ID_HOST_JOIN_GROUP_REQUEST               = 16,
-        IWL_FW_TRIGGER_ID_HOST_SCAN_START                       = 17,
-        IWL_FW_TRIGGER_ID_HOST_SCAN_SUBITTED                    = 18,
-        IWL_FW_TRIGGER_ID_HOST_SCAN_PARAMS                      = 19,
-        IWL_FW_TRIGGER_ID_HOST_CHECK_FOR_HANG                   = 20,
-        IWL_FW_TRIGGER_ID_HOST_BAR_RECEIVED                     = 21,
-        IWL_FW_TRIGGER_ID_HOST_AGG_TX_RESPONSE_STATUS_FAILED    = 22,
-        IWL_FW_TRIGGER_ID_HOST_EAPOL_TX_RESPONSE_FAILED         = 23,
-        IWL_FW_TRIGGER_ID_HOST_FAKE_TX_RESPONSE_SUSPECTED       = 24,
-        IWL_FW_TRIGGER_ID_HOST_AUTH_REQ_FROM_ASSOC_CLIENT       = 25,
-        IWL_FW_TRIGGER_ID_HOST_ROAM_COMPLETE                    = 26,
-        IWL_FW_TRIGGER_ID_HOST_AUTH_ASSOC_FAST_FAILED           = 27,
-        IWL_FW_TRIGGER_ID_HOST_D3_START                         = 28,
-        IWL_FW_TRIGGER_ID_HOST_D3_END                           = 29,
-        IWL_FW_TRIGGER_ID_HOST_BSS_MISSED_BEACONS               = 30,
-        IWL_FW_TRIGGER_ID_HOST_P2P_CLIENT_MISSED_BEACONS        = 31,
-        IWL_FW_TRIGGER_ID_HOST_PEER_CLIENT_TX_FAILURES          = 32,
-        IWL_FW_TRIGGER_ID_HOST_TX_WFD_ACTION_FRAME_FAILED       = 33,
-        IWL_FW_TRIGGER_ID_HOST_AUTH_ASSOC_FAILED                = 34,
-        IWL_FW_TRIGGER_ID_HOST_SCAN_COMPLETE                    = 35,
-        IWL_FW_TRIGGER_ID_HOST_SCAN_ABORT                       = 36,
-        IWL_FW_TRIGGER_ID_HOST_NIC_ALIVE                        = 37,
-        IWL_FW_TRIGGER_ID_HOST_CHANNEL_SWITCH_COMPLETE          = 38,
+        IWL_FW_TRIGGER_ID_HOST_PEER_CLIENT_INACTIVITY           = 7,
+        IWL_FW_TRIGGER_ID_HOST_TX_LATENCY_THRESHOLD_CROSSED     = 8,
+        IWL_FW_TRIGGER_ID_HOST_TX_RESPONSE_STATUS_FAILED        = 9,
+        IWL_FW_TRIGGER_ID_HOST_OS_REQ_DEAUTH_PEER               = 10,
+        IWL_FW_TRIGGER_ID_HOST_STOP_GO_REQUEST                  = 11,
+        IWL_FW_TRIGGER_ID_HOST_START_GO_REQUEST                 = 12,
+        IWL_FW_TRIGGER_ID_HOST_JOIN_GROUP_REQUEST               = 13,
+        IWL_FW_TRIGGER_ID_HOST_SCAN_START                       = 14,
+        IWL_FW_TRIGGER_ID_HOST_SCAN_SUBMITTED                   = 15,
+        IWL_FW_TRIGGER_ID_HOST_SCAN_PARAMS                      = 16,
+        IWL_FW_TRIGGER_ID_HOST_CHECK_FOR_HANG                   = 17,
+        IWL_FW_TRIGGER_ID_HOST_BAR_RECEIVED                     = 18,
+        IWL_FW_TRIGGER_ID_HOST_AGG_TX_RESPONSE_STATUS_FAILED    = 19,
+        IWL_FW_TRIGGER_ID_HOST_EAPOL_TX_RESPONSE_FAILED         = 20,
+        IWL_FW_TRIGGER_ID_HOST_FAKE_TX_RESPONSE_SUSPECTED       = 21,
+        IWL_FW_TRIGGER_ID_HOST_AUTH_REQ_FROM_ASSOC_CLIENT       = 22,
+        IWL_FW_TRIGGER_ID_HOST_ROAM_COMPLETE                    = 23,
+        IWL_FW_TRIGGER_ID_HOST_AUTH_ASSOC_FAST_FAILED           = 24,
+        IWL_FW_TRIGGER_ID_HOST_D3_START                         = 25,
+        IWL_FW_TRIGGER_ID_HOST_D3_END                           = 26,
+        IWL_FW_TRIGGER_ID_HOST_BSS_MISSED_BEACONS               = 27,
+        IWL_FW_TRIGGER_ID_HOST_P2P_CLIENT_MISSED_BEACONS        = 28,
+        IWL_FW_TRIGGER_ID_HOST_PEER_CLIENT_TX_FAILURES          = 29,
+        IWL_FW_TRIGGER_ID_HOST_TX_WFD_ACTION_FRAME_FAILED       = 30,
+        IWL_FW_TRIGGER_ID_HOST_AUTH_ASSOC_FAILED                = 31,
+        IWL_FW_TRIGGER_ID_HOST_SCAN_COMPLETE                    = 32,
+        IWL_FW_TRIGGER_ID_HOST_SCAN_ABORT                       = 33,
+        IWL_FW_TRIGGER_ID_HOST_NIC_ALIVE                        = 34,
+        IWL_FW_TRIGGER_ID_HOST_CHANNEL_SWITCH_COMPLETE          = 35,
+
         IWL_FW_TRIGGER_ID_NUM,
-}; /* FW_INI_TRIGGER_ID_E_VER_1 */
+}; /* FW_DEBUG_TLV_TRIGGER_ID_E_VER_1 */
 
 /**
  * enum iwl_fw_ini_apply_point
@@ -320,7 +356,7 @@ enum iwl_fw_ini_apply_point {
         IWL_FW_INI_APPLY_MISSED_BEACONS,
         IWL_FW_INI_APPLY_SCAN_COMPLETE,
         IWL_FW_INI_APPLY_NUM,
-}; /* FW_INI_APPLY_POINT_E_VER_1 */
+}; /* FW_DEBUG_TLV_APPLY_POINT_E_VER_1 */
 
 /**
  * enum iwl_fw_ini_allocation_id
@@ -340,7 +376,7 @@ enum iwl_fw_ini_allocation_id {
         IWL_FW_INI_ALLOCATION_ID_SDFX,
         IWL_FW_INI_ALLOCATION_ID_FW_DUMP,
         IWL_FW_INI_ALLOCATION_ID_USER_DEFINED,
-}; /* FW_INI_ALLOCATION_ID_E_VER_1 */
+}; /* FW_DEBUG_TLV_ALLOCATION_ID_E_VER_1 */
 
 /**
  * enum iwl_fw_ini_buffer_location
@@ -349,10 +385,10 @@ enum iwl_fw_ini_allocation_id {
  * @IWL_FW_INI_LOCATION_DRAM_PATH: DRAM location
  */
 enum iwl_fw_ini_buffer_location {
-        IWL_FW_INI_LOCATION_SRAM_INVALID,
+        IWL_FW_INI_LOCATION_INVALID,
         IWL_FW_INI_LOCATION_SRAM_PATH,
         IWL_FW_INI_LOCATION_DRAM_PATH,
-}; /* FW_INI_BUFFER_LOCATION_E_VER_1 */
+}; /* FW_DEBUG_TLV_BUFFER_LOCATION_E_VER_1 */
 
 /**
  * enum iwl_fw_ini_debug_flow
@@ -364,7 +400,7 @@ enum iwl_fw_ini_debug_flow {
         IWL_FW_INI_DEBUG_INVALID,
         IWL_FW_INI_DEBUG_DBTR_FLOW,
         IWL_FW_INI_DEBUG_TB2DTF_FLOW,
-}; /* FW_INI_DEBUG_FLOW_E_VER_1 */
+}; /* FW_DEBUG_TLV_FLOW_E_VER_1 */
 
 /**
  * enum iwl_fw_ini_region_type
@@ -396,6 +432,6 @@ enum iwl_fw_ini_region_type {
         IWL_FW_INI_REGION_PAGING,
         IWL_FW_INI_REGION_CSR,
         IWL_FW_INI_REGION_NUM
-}; /* FW_INI_REGION_TYPE_E_VER_1*/
+}; /* FW_DEBUG_TLV_REGION_TYPE_E_VER_1 */
 
 #endif
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/location.h b/drivers/net/wireless/intel/iwlwifi/fw/api/location.h
index 6da91ec0df55..5dddb21c1c4d 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/location.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/location.h
@@ -7,6 +7,7 @@
  *
  * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
  * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -28,6 +29,7 @@
  *
  * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
  * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -322,7 +324,7 @@ enum iwl_tof_location_query {
 };
 
  /**
- * struct iwl_tof_range_req_ap_entry - AP configuration parameters
+ * struct iwl_tof_range_req_ap_entry_v2 - AP configuration parameters
  * @channel_num: Current AP Channel
  * @bandwidth: Current AP Bandwidth. One of iwl_tof_bandwidth.
  * @tsf_delta_direction: TSF relatively to the subject AP
@@ -355,7 +357,7 @@ enum iwl_tof_location_query {
  * @notify_mcsi: &enum iwl_tof_mcsi_ntfy.
  * @reserved: For alignment and future use
  */
-struct iwl_tof_range_req_ap_entry {
+struct iwl_tof_range_req_ap_entry_v2 {
         u8 channel_num;
         u8 bandwidth;
         u8 tsf_delta_direction;
@@ -374,6 +376,62 @@ struct iwl_tof_range_req_ap_entry {
         u8 algo_type;
         u8 notify_mcsi;
         __le16 reserved;
+} __packed; /* LOCATION_RANGE_REQ_AP_ENTRY_CMD_API_S_VER_2 */
+
+/**
+ * enum iwl_initiator_ap_flags - per responder FTM configuration flags
+ * @IWL_INITIATOR_AP_FLAGS_ASAP: Request for ASAP measurement.
+ * @IWL_INITIATOR_AP_FLAGS_LCI_REQUEST: Request for LCI information
+ * @IWL_INITIATOR_AP_FLAGS_CIVIC_REQUEST: Request for CIVIC information
+ * @IWL_INITIATOR_AP_FLAGS_DYN_ACK: Send HT/VHT ack for FTM frames. If not set,
+ *      20Mhz dup acks will be sent.
+ * @IWL_INITIATOR_AP_FLAGS_ALGO_LR: Use LR algo type for rtt calculation.
+ *      Default algo type is ML.
+ * @IWL_INITIATOR_AP_FLAGS_ALGO_FFT: Use FFT algo type for rtt calculation.
+ *      Default algo type is ML.
+ * @IWL_INITIATOR_AP_FLAGS_MCSI_REPORT: Send the MCSI for each FTM frame to the
+ *      driver.
+ */
+enum iwl_initiator_ap_flags {
+        IWL_INITIATOR_AP_FLAGS_ASAP = BIT(1),
+        IWL_INITIATOR_AP_FLAGS_LCI_REQUEST = BIT(2),
+        IWL_INITIATOR_AP_FLAGS_CIVIC_REQUEST = BIT(3),
+        IWL_INITIATOR_AP_FLAGS_DYN_ACK = BIT(4),
+        IWL_INITIATOR_AP_FLAGS_ALGO_LR = BIT(5),
+        IWL_INITIATOR_AP_FLAGS_ALGO_FFT = BIT(6),
+        IWL_INITIATOR_AP_FLAGS_MCSI_REPORT = BIT(8),
+};
+
+/**
+ * struct iwl_tof_range_req_ap_entry - AP configuration parameters
+ * @initiator_ap_flags: see &enum iwl_initiator_ap_flags.
+ * @channel_num: AP Channel number
+ * @bandwidth: AP bandwidth. One of iwl_tof_bandwidth.
+ * @ctrl_ch_position: Coding of the control channel position relative to the
+ *      center frequency, see iwl_mvm_get_ctrl_pos().
+ * @ftmr_max_retries: Max number of retries to send the FTMR in case of no
+ *      reply from the AP.
+ * @bssid: AP's BSSID
+ * @burst_period: Recommended value to be sent to the AP. Measurement
+ *      periodicity In units of 100ms. ignored if num_of_bursts_exp = 0
+ * @samples_per_burst: the number of FTMs pairs in single Burst (1-31);
+ * @num_of_bursts: Recommended value to be sent to the AP. 2s Exponent of
+ *      the number of measurement iterations (min 2^0 = 1, max 2^14)
+ * @reserved: For alignment and future use
+ * @tsf_delta: not in use
+ */
+struct iwl_tof_range_req_ap_entry {
+        __le32 initiator_ap_flags;
+        u8 channel_num;
+        u8 bandwidth;
+        u8 ctrl_ch_position;
+        u8 ftmr_max_retries;
+        u8 bssid[ETH_ALEN];
+        __le16 burst_period;
+        u8 samples_per_burst;
+        u8 num_of_bursts;
+        __le16 reserved;
+        __le32 tsf_delta;
 } __packed; /* LOCATION_RANGE_REQ_AP_ENTRY_CMD_API_S_VER_3 */
 
 /**
@@ -403,7 +461,12 @@ enum iwl_tof_response_mode {
  * @IWL_TOF_INITIATOR_FLAGS_TX_CHAIN_SEL_A: use antenna A fo TX ACKs during FTM
  * @IWL_TOF_INITIATOR_FLAGS_TX_CHAIN_SEL_B: use antenna B fo TX ACKs during FTM
  * @IWL_TOF_INITIATOR_FLAGS_TX_CHAIN_SEL_C: use antenna C fo TX ACKs during FTM
- * @IWL_TOF_INITIATOR_FLAGS_MINDELTA_NO_PREF: no preference for minDeltaFTM
+ * @IWL_TOF_INITIATOR_FLAGS_MACADDR_RANDOM: use random mac address for FTM
+ * @IWL_TOF_INITIATOR_FLAGS_SPECIFIC_CALIB: use the specific calib value from
+ *      the range request command
+ * @IWL_TOF_INITIATOR_FLAGS_COMMON_CALIB: use the common calib value from the
+ *      ragne request command
+ * @IWL_TOF_INITIATOR_FLAGS_NON_ASAP_SUPPORT: support non-asap measurements
  */
 enum iwl_tof_initiator_flags {
         IWL_TOF_INITIATOR_FLAGS_FAST_ALGO_DISABLED = BIT(0),
@@ -413,14 +476,17 @@ enum iwl_tof_initiator_flags {
         IWL_TOF_INITIATOR_FLAGS_TX_CHAIN_SEL_A = BIT(4),
         IWL_TOF_INITIATOR_FLAGS_TX_CHAIN_SEL_B = BIT(5),
         IWL_TOF_INITIATOR_FLAGS_TX_CHAIN_SEL_C = BIT(6),
-        IWL_TOF_INITIATOR_FLAGS_MINDELTA_NO_PREF = BIT(7),
+        IWL_TOF_INITIATOR_FLAGS_MACADDR_RANDOM = BIT(7),
+        IWL_TOF_INITIATOR_FLAGS_SPECIFIC_CALIB = BIT(15),
+        IWL_TOF_INITIATOR_FLAGS_COMMON_CALIB   = BIT(16),
+        IWL_TOF_INITIATOR_FLAGS_NON_ASAP_SUPPORT = BIT(20),
 }; /* LOCATION_RANGE_REQ_CMD_API_S_VER_5 */
 
 #define IWL_MVM_TOF_MAX_APS 5
 #define IWL_MVM_TOF_MAX_TWO_SIDED_APS 5
 
 /**
- * struct iwl_tof_range_req_cmd - start measurement cmd
+ * struct iwl_tof_range_req_cmd_v5 - start measurement cmd
  * @initiator_flags: see flags @ iwl_tof_initiator_flags
  * @request_id: A Token incremented per request. The same Token will be
  *              sent back in the range response
@@ -448,7 +514,7 @@ enum iwl_tof_initiator_flags {
  * @specific_calib: The specific calib value to inject to this measurement calc
  * @ap: per-AP request data
  */
-struct iwl_tof_range_req_cmd {
+struct iwl_tof_range_req_cmd_v5 {
         __le32 initiator_flags;
         u8 request_id;
         u8 initiator;
@@ -465,10 +531,42 @@ struct iwl_tof_range_req_cmd {
         u8 ftm_tx_chains;
         __le16 common_calib;
         __le16 specific_calib;
-        struct iwl_tof_range_req_ap_entry ap[IWL_MVM_TOF_MAX_APS];
+        struct iwl_tof_range_req_ap_entry_v2 ap[IWL_MVM_TOF_MAX_APS];
 } __packed;
 /* LOCATION_RANGE_REQ_CMD_API_S_VER_5 */
 
+/**
+ * struct iwl_tof_range_req_cmd - start measurement cmd
+ * @initiator_flags: see flags @ iwl_tof_initiator_flags
+ * @request_id: A Token incremented per request. The same Token will be
+ *              sent back in the range response
+ * @num_of_ap: Number of APs to measure (error if > IWL_MVM_TOF_MAX_APS)
+ * @range_req_bssid: ranging request BSSID
+ * @macaddr_mask: Bits set to 0 shall be copied from the MAC address template.
+ *                Bits set to 1 shall be randomized by the UMAC
+ * @macaddr_template: MAC address template to use for non-randomized bits
+ * @req_timeout_ms: Requested timeout of the response in units of milliseconds.
+ *      This is the session time for completing the measurement.
+ * @tsf_mac_id: report the measurement start time for each ap in terms of the
+ *      TSF of this mac id. 0xff to disable TSF reporting.
+ * @common_calib: The common calib value to inject to this measurement calc
+ * @specific_calib: The specific calib value to inject to this measurement calc
+ * @ap: per-AP request data, see &struct iwl_tof_range_req_ap_entry_v2.
+ */
+struct iwl_tof_range_req_cmd {
+        __le32 initiator_flags;
+        u8 request_id;
+        u8 num_of_ap;
+        u8 range_req_bssid[ETH_ALEN];
+        u8 macaddr_mask[ETH_ALEN];
+        u8 macaddr_template[ETH_ALEN];
+        __le32 req_timeout_ms;
+        __le32 tsf_mac_id;
+        __le16 common_calib;
+        __le16 specific_calib;
+        struct iwl_tof_range_req_ap_entry ap[IWL_MVM_TOF_MAX_APS];
+} __packed; /* LOCATION_RANGE_REQ_CMD_API_S_VER_7 */
+
 /*
  * enum iwl_tof_range_request_status - status of the sent request
  * @IWL_TOF_RANGE_REQUEST_STATUS_SUCCESSFUL - FW successfully received the
@@ -528,7 +626,7 @@ enum iwl_tof_entry_status {
 }; /* LOCATION_RANGE_RSP_AP_ENTRY_NTFY_API_S_VER_2 */
 
 /**
- * struct iwl_tof_range_rsp_ap_entry_ntfy - AP parameters (response)
+ * struct iwl_tof_range_rsp_ap_entry_ntfy_v3 - AP parameters (response)
  * @bssid: BSSID of the AP
  * @measure_status: current APs measurement status, one of
  *      &enum iwl_tof_entry_status.
@@ -555,7 +653,7 @@ enum iwl_tof_entry_status {
  * @papd_calib_output: The result of the tof papd calibration that was injected
  *      into the algorithm.
  */
-struct iwl_tof_range_rsp_ap_entry_ntfy {
+struct iwl_tof_range_rsp_ap_entry_ntfy_v3 {
         u8 bssid[ETH_ALEN];
         u8 measure_status;
         u8 measure_bw;
@@ -577,6 +675,59 @@ struct iwl_tof_range_rsp_ap_entry_ntfy {
 } __packed; /* LOCATION_RANGE_RSP_AP_ETRY_NTFY_API_S_VER_3 */
 
 /**
+ * struct iwl_tof_range_rsp_ap_entry_ntfy - AP parameters (response)
+ * @bssid: BSSID of the AP
+ * @measure_status: current APs measurement status, one of
+ *      &enum iwl_tof_entry_status.
+ * @measure_bw: Current AP Bandwidth: 0  20MHz, 1  40MHz, 2  80MHz
+ * @rtt: The Round Trip Time that took for the last measurement for
+ *      current AP [pSec]
+ * @rtt_variance: The Variance of the RTT values measured for current AP
+ * @rtt_spread: The Difference between the maximum and the minimum RTT
+ *      values measured for current AP in the current session [pSec]
+ * @rssi: RSSI as uploaded in the Channel Estimation notification
+ * @rssi_spread: The Difference between the maximum and the minimum RSSI values
+ *      measured for current AP in the current session
+ * @last_burst: 1 if no more FTM sessions are scheduled for this responder
+ * @refusal_period: refusal period in case of
+ *      @IWL_TOF_ENTRY_RESPONDER_CANNOT_COLABORATE [sec]
+ * @timestamp: The GP2 Clock [usec] where Channel Estimation notification was
+ *      uploaded by the LMAC
+ * @start_tsf: measurement start time in TSF of the mac specified in the range
+ *      request
+ * @rx_rate_n_flags: rate and flags of the last FTM frame received from this
+ *      responder
+ * @tx_rate_n_flags: rate and flags of the last ack sent to this responder
+ * @t2t3_initiator: as calculated from the algo in the initiator
+ * @t1t4_responder: as calculated from the algo in the responder
+ * @common_calib: Calib val that was used in for this AP measurement
+ * @specific_calib: val that was used in for this AP measurement
+ * @papd_calib_output: The result of the tof papd calibration that was injected
+ *      into the algorithm.
+ */
+struct iwl_tof_range_rsp_ap_entry_ntfy {
+        u8 bssid[ETH_ALEN];
+        u8 measure_status;
+        u8 measure_bw;
+        __le32 rtt;
+        __le32 rtt_variance;
+        __le32 rtt_spread;
+        s8 rssi;
+        u8 rssi_spread;
+        u8 last_burst;
+        u8 refusal_period;
+        __le32 timestamp;
+        __le32 start_tsf;
+        __le32 rx_rate_n_flags;
+        __le32 tx_rate_n_flags;
+        __le32 t2t3_initiator;
+        __le32 t1t4_responder;
+        __le16 common_calib;
+        __le16 specific_calib;
+        __le32 papd_calib_output;
+} __packed; /* LOCATION_RANGE_RSP_AP_ETRY_NTFY_API_S_VER_4 */
+
+/**
  * enum iwl_tof_response_status - tof response status
  *
  * @IWL_TOF_RESPONSE_SUCCESS: successful range.
@@ -593,7 +744,7 @@ enum iwl_tof_response_status {
 }; /* LOCATION_RNG_RSP_STATUS */
 
 /**
- * struct iwl_tof_range_rsp_ntfy - ranging response notification
+ * struct iwl_tof_range_rsp_ntfy_v5 - ranging response notification
  * @request_id: A Token ID of the corresponding Range request
  * @request_status: status of current measurement session, one of
  *      &enum iwl_tof_response_status.
@@ -601,13 +752,29 @@ enum iwl_tof_response_status {
  * @num_of_aps: Number of APs to measure (error if > IWL_MVM_TOF_MAX_APS)
  * @ap: per-AP data
  */
-struct iwl_tof_range_rsp_ntfy {
+struct iwl_tof_range_rsp_ntfy_v5 {
         u8 request_id;
         u8 request_status;
         u8 last_in_batch;
         u8 num_of_aps;
+        struct iwl_tof_range_rsp_ap_entry_ntfy_v3 ap[IWL_MVM_TOF_MAX_APS];
+} __packed; /* LOCATION_RANGE_RSP_NTFY_API_S_VER_5 */
+
+/**
+ * struct iwl_tof_range_rsp_ntfy - ranging response notification
+ * @request_id: A Token ID of the corresponding Range request
+ * @num_of_aps: Number of APs results
+ * @last_report: 1 if no more FTM sessions are scheduled, 0 otherwise.
+ * @reserved: reserved
+ * @ap: per-AP data
+ */
+struct iwl_tof_range_rsp_ntfy {
+        u8 request_id;
+        u8 num_of_aps;
+        u8 last_report;
+        u8 reserved;
         struct iwl_tof_range_rsp_ap_entry_ntfy ap[IWL_MVM_TOF_MAX_APS];
-} __packed;
+} __packed; /* LOCATION_RANGE_RSP_NTFY_API_S_VER_6 */
 
 #define IWL_MVM_TOF_MCSI_BUF_SIZE  (245)
 /**
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/mac-cfg.h b/drivers/net/wireless/intel/iwlwifi/fw/api/mac-cfg.h
index ca49db786ed6..6b4d59daacd6 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/mac-cfg.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/mac-cfg.h
@@ -74,6 +74,10 @@ enum iwl_mac_conf_subcmd_ids {
          */
         LOW_LATENCY_CMD = 0x3,
         /**
+         * @CHANNEL_SWITCH_TIME_EVENT_CMD: &struct iwl_chan_switch_te_cmd
+         */
+        CHANNEL_SWITCH_TIME_EVENT_CMD = 0x4,
+        /**
          * @PROBE_RESPONSE_DATA_NOTIF: &struct iwl_probe_resp_data_notif
          */
         PROBE_RESPONSE_DATA_NOTIF = 0xFC,
@@ -136,6 +140,29 @@ struct iwl_channel_switch_noa_notif {
 } __packed; /* CHANNEL_SWITCH_START_NTFY_API_S_VER_1 */
 
 /**
+ * struct iwl_chan_switch_te_cmd - Channel Switch Time Event command
+ *
+ * @mac_id: MAC ID for channel switch
+ * @action: action to perform, one of FW_CTXT_ACTION_*
+ * @tsf: beacon tsf
+ * @cs_count: channel switch count from CSA/eCSA IE
+ * @cs_delayed_bcn_count: if set to N (!= 0) GO/AP can delay N beacon intervals
+ *      at the new channel after the channel switch, otherwise (N == 0) expect
+ *      beacon right after the channel switch.
+ * @cs_mode: 1 - quiet, 0 - otherwise
+ * @reserved: reserved for alignment purposes
+ */
+struct iwl_chan_switch_te_cmd {
+        __le32 mac_id;
+        __le32 action;
+        __le32 tsf;
+        u8 cs_count;
+        u8 cs_delayed_bcn_count;
+        u8 cs_mode;
+        u8 reserved;
+} __packed; /* MAC_CHANNEL_SWITCH_TIME_EVENT_S_VER_2 */
+
+/**
  * struct iwl_mac_low_latency_cmd - set/clear mac to 'low-latency mode'
  *
  * @mac_id: MAC ID to whom to apply the low-latency configurations
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/power.h b/drivers/net/wireless/intel/iwlwifi/fw/api/power.h
index 286a22da232d..01f003c6cff9 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/power.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/power.h
@@ -8,7 +8,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
  * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
  * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -200,9 +200,16 @@ struct iwl_powertable_cmd {
  * @DEVICE_POWER_FLAGS_POWER_SAVE_ENA_MSK:
  *      '1' Allow to save power by turning off
  *      receiver and transmitter. '0' - does not allow.
+ * @DEVICE_POWER_FLAGS_ALLOW_MEM_RETENTION_MSK:
+ *      Device Retention indication, '1' indicate retention is enabled.
+ * @DEVICE_POWER_FLAGS_32K_CLK_VALID_MSK:
+ *      32Khz external slow clock valid indication, '1' indicate cloack is
+ *      valid.
 */
 enum iwl_device_power_flags {
-        DEVICE_POWER_FLAGS_POWER_SAVE_ENA_MSK   = BIT(0),
+        DEVICE_POWER_FLAGS_POWER_SAVE_ENA_MSK           = BIT(0),
+        DEVICE_POWER_FLAGS_ALLOW_MEM_RETENTION_MSK      = BIT(1),
+        DEVICE_POWER_FLAGS_32K_CLK_VALID_MSK            = BIT(12),
 };
 
 /**
@@ -470,6 +477,13 @@ struct iwl_geo_tx_power_profiles_resp {
  * @ba_escape_timer: Fully receive and parse beacon if no beacons were passed
  *      for a longer period of time then this escape-timeout. Units: Beacons.
  * @ba_enable_beacon_abort: 1, beacon abort is enabled; 0, disabled.
+ * @bf_threshold_absolute_low: See below.
+ * @bf_threshold_absolute_high: Send Beacon to driver if Energy value calculated
+ *      for this beacon crossed this absolute threshold. For the 'Increase'
+ *      direction the bf_energy_absolute_low[i] is used. For the 'Decrease'
+ *      direction the bf_energy_absolute_high[i] is used. Zero value means
+ *      that this specific threshold is ignored for beacon filtering, and
+ *      beacon will not be forced to be sent to driver due to this setting.
  */
 struct iwl_beacon_filter_cmd {
         __le32 bf_energy_delta;
@@ -483,7 +497,9 @@ struct iwl_beacon_filter_cmd {
         __le32 bf_escape_timer;
         __le32 ba_escape_timer;
         __le32 ba_enable_beacon_abort;
-} __packed;
+        __le32 bf_threshold_absolute_low[2];
+        __le32 bf_threshold_absolute_high[2];
+} __packed; /* BEACON_FILTER_CONFIG_API_S_VER_4 */
 
 /* Beacon filtering and beacon abort */
 #define IWL_BF_ENERGY_DELTA_DEFAULT 5
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h b/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
index 18741889ec30..890a939c463d 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
@@ -8,7 +8,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -434,7 +434,7 @@ struct iwl_periodic_scan_complete {
 /* The maximum of either of these cannot exceed 8, because we use an
  * 8-bit mask (see IWL_MVM_SCAN_MASK in mvm.h).
  */
-#define IWL_MVM_MAX_UMAC_SCANS 8
+#define IWL_MVM_MAX_UMAC_SCANS 4
 #define IWL_MVM_MAX_LMAC_SCANS 1
 
 enum scan_config_flags {
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/tx.h b/drivers/net/wireless/intel/iwlwifi/fw/api/tx.h
index 358bdf051e83..8511e735c374 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/tx.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/tx.h
@@ -847,13 +847,13 @@ struct iwl_beacon_notif {
 } __packed;
 
 /**
- * struct iwl_extended_beacon_notif - notifies about beacon transmission
+ * struct iwl_extended_beacon_notif_v5 - notifies about beacon transmission
  * @beacon_notify_hdr: tx response command associated with the beacon
  * @tsf: last beacon tsf
  * @ibss_mgr_status: whether IBSS is manager
  * @gp2: last beacon time in gp2
  */
-struct iwl_extended_beacon_notif {
+struct iwl_extended_beacon_notif_v5 {
         struct iwl_mvm_tx_resp beacon_notify_hdr;
         __le64 tsf;
         __le32 ibss_mgr_status;
@@ -861,6 +861,20 @@ struct iwl_extended_beacon_notif {
 } __packed; /* BEACON_NTFY_API_S_VER_5 */
 
 /**
+ * struct iwl_extended_beacon_notif - notifies about beacon transmission
+ * @status: the status of the Tx response of the beacon
+ * @tsf: last beacon tsf
+ * @ibss_mgr_status: whether IBSS is manager
+ * @gp2: last beacon time in gp2
+ */
+struct iwl_extended_beacon_notif {
+        __le32 status;
+        __le64 tsf;
+        __le32 ibss_mgr_status;
+        __le32 gp2;
+} __packed; /* BEACON_NTFY_API_S_VER_6_ */
+
+/**
  * enum iwl_dump_control - dump (flush) control flags
  * @DUMP_TX_FIFO_FLUSH: Dump MSDUs until the the FIFO is empty
  *      and the TFD queues are empty.
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
index 22efd94da6d3..f119c49cd39c 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
@@ -8,7 +8,7 @@
  * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
  * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -242,7 +242,8 @@ static void iwl_fw_dump_rxf(struct iwl_fw_runtime *fwrt,
                                   cfg->lmac[0].rxfifo1_size, 0, 0);
                 /* Pull RXF2 */
                 iwl_fwrt_dump_rxf(fwrt, dump_data, cfg->rxfifo2_size,
-                                  RXF_DIFF_FROM_PREV, 1);
+                                  RXF_DIFF_FROM_PREV +
+                                  fwrt->trans->cfg->umac_prph_offset, 1);
                 /* Pull LMAC2 RXF1 */
                 if (fwrt->smem_cfg.num_lmacs > 1)
                         iwl_fwrt_dump_rxf(fwrt, dump_data,
@@ -673,7 +674,9 @@ static void iwl_fw_prph_handler(struct iwl_fw_runtime *fwrt, void *ptr,
 {
         u32 range_len;
 
-        if (fwrt->trans->cfg->device_family >= IWL_DEVICE_FAMILY_22000) {
+        if (fwrt->trans->cfg->device_family >= IWL_DEVICE_FAMILY_AX210) {
+                /* TODO */
+        } else if (fwrt->trans->cfg->device_family >= IWL_DEVICE_FAMILY_22000) {
                 range_len = ARRAY_SIZE(iwl_prph_dump_addr_22000);
                 handler(fwrt, iwl_prph_dump_addr_22000, range_len, ptr);
         } else {
@@ -707,28 +710,6 @@ static void iwl_fw_dump_mem(struct iwl_fw_runtime *fwrt,
         IWL_DEBUG_INFO(fwrt, "WRT memory dump. Type=%u\n", dump_mem->type);
 }
 
-static void iwl_fw_dump_named_mem(struct iwl_fw_runtime *fwrt,
-                                  struct iwl_fw_error_dump_data **dump_data,
-                                  u32 len, u32 ofs, u8 *name, u8 name_len)
-{
-        struct iwl_fw_error_dump_named_mem *dump_mem;
-
-        if (!len)
-                return;
-
-        (*dump_data)->type = cpu_to_le32(IWL_FW_ERROR_DUMP_MEM);
-        (*dump_data)->len = cpu_to_le32(len + sizeof(*dump_mem));
-        dump_mem = (void *)(*dump_data)->data;
-        dump_mem->type = cpu_to_le32(IWL_FW_ERROR_DUMP_MEM_NAMED_MEM);
-        dump_mem->offset = cpu_to_le32(ofs);
-        dump_mem->name_len = name_len;
-        memcpy(dump_mem->name, name, name_len);
-        iwl_trans_read_mem_bytes(fwrt->trans, ofs, dump_mem->data, len);
-        *dump_data = iwl_fw_error_next_data(*dump_data);
-
-        IWL_DEBUG_INFO(fwrt, "WRT memory dump. Type=%u\n", dump_mem->type);
-}
-
 #define ADD_LEN(len, item_len, const_len) \
         do {size_t item = item_len; len += (!!item) * const_len + item; } \
         while (0)
@@ -815,6 +796,9 @@ static void iwl_dump_paging(struct iwl_fw_runtime *fwrt,
                                         DMA_BIDIRECTIONAL);
                 memcpy(paging->data, page_address(pages),
                        PAGING_BLOCK_SIZE);
+                dma_sync_single_for_device(fwrt->trans->dev, addr,
+                                           PAGING_BLOCK_SIZE,
+                                           DMA_BIDIRECTIONAL);
                 (*data) = iwl_fw_error_next_data(*data);
         }
 }
@@ -1059,117 +1043,645 @@ out:
         return dump_file;
 }
 
-static void iwl_dump_prph_ini(struct iwl_trans *trans,
-                              struct iwl_fw_error_dump_data **data,
-                              struct iwl_fw_ini_region_cfg *reg)
+static int iwl_dump_ini_prph_iter(struct iwl_fw_runtime *fwrt,
+                                  struct iwl_fw_ini_region_cfg *reg,
+                                  void *range_ptr, int idx)
 {
-        struct iwl_fw_error_dump_prph *prph;
+        struct iwl_fw_ini_error_dump_range *range = range_ptr;
+        __le32 *val = range->data;
+        u32 addr, prph_val, offset = le32_to_cpu(reg->offset);
+        int i;
+
+        range->start_addr = reg->start_addr[idx];
+        range->range_data_size = reg->internal.range_data_size;
+        for (i = 0; i < le32_to_cpu(reg->internal.range_data_size); i += 4) {
+                addr = le32_to_cpu(range->start_addr) + i;
+                prph_val = iwl_read_prph(fwrt->trans, addr + offset);
+                if (prph_val == 0x5a5a5a5a)
+                        return -EBUSY;
+                *val++ = cpu_to_le32(prph_val);
+        }
+
+        return sizeof(*range) + le32_to_cpu(range->range_data_size);
+}
+
+static int iwl_dump_ini_csr_iter(struct iwl_fw_runtime *fwrt,
+                                 struct iwl_fw_ini_region_cfg *reg,
+                                 void *range_ptr, int idx)
+{
+        struct iwl_fw_ini_error_dump_range *range = range_ptr;
+        __le32 *val = range->data;
+        u32 addr, offset = le32_to_cpu(reg->offset);
+        int i;
+
+        range->start_addr = reg->start_addr[idx];
+        range->range_data_size = reg->internal.range_data_size;
+        for (i = 0; i < le32_to_cpu(reg->internal.range_data_size); i += 4) {
+                addr = le32_to_cpu(range->start_addr) + i;
+                *val++ = cpu_to_le32(iwl_trans_read32(fwrt->trans,
+                                                      addr + offset));
+        }
+
+        return sizeof(*range) + le32_to_cpu(range->range_data_size);
+}
+
+static int iwl_dump_ini_dev_mem_iter(struct iwl_fw_runtime *fwrt,
+                                     struct iwl_fw_ini_region_cfg *reg,
+                                     void *range_ptr, int idx)
+{
+        struct iwl_fw_ini_error_dump_range *range = range_ptr;
+        u32 addr = le32_to_cpu(range->start_addr);
+        u32 offset = le32_to_cpu(reg->offset);
+
+        range->start_addr = reg->start_addr[idx];
+        range->range_data_size = reg->internal.range_data_size;
+        iwl_trans_read_mem_bytes(fwrt->trans, addr + offset, range->data,
+                                 le32_to_cpu(reg->internal.range_data_size));
+
+        return sizeof(*range) + le32_to_cpu(range->range_data_size);
+}
+
+static int
+iwl_dump_ini_paging_gen2_iter(struct iwl_fw_runtime *fwrt,
+                              struct iwl_fw_ini_region_cfg *reg,
+                              void *range_ptr, int idx)
+{
+        struct iwl_fw_ini_error_dump_range *range = range_ptr;
+        u32 page_size = fwrt->trans->init_dram.paging[idx].size;
+
+        range->start_addr = cpu_to_le32(idx);
+        range->range_data_size = cpu_to_le32(page_size);
+        memcpy(range->data, fwrt->trans->init_dram.paging[idx].block,
+               page_size);
+
+        return sizeof(*range) + le32_to_cpu(range->range_data_size);
+}
+
+static int iwl_dump_ini_paging_iter(struct iwl_fw_runtime *fwrt,
+                                    struct iwl_fw_ini_region_cfg *reg,
+                                    void *range_ptr, int idx)
+{
+        /* increase idx by 1 since the pages are from 1 to
+         * fwrt->num_of_paging_blk + 1
+         */
+        struct page *page = fwrt->fw_paging_db[++idx].fw_paging_block;
+        struct iwl_fw_ini_error_dump_range *range = range_ptr;
+        dma_addr_t addr = fwrt->fw_paging_db[idx].fw_paging_phys;
+        u32 page_size = fwrt->fw_paging_db[idx].fw_paging_size;
+
+        range->start_addr = cpu_to_le32(idx);
+        range->range_data_size = cpu_to_le32(page_size);
+        dma_sync_single_for_cpu(fwrt->trans->dev, addr, page_size,
+                                DMA_BIDIRECTIONAL);
+        memcpy(range->data, page_address(page), page_size);
+        dma_sync_single_for_device(fwrt->trans->dev, addr, page_size,
+                                   DMA_BIDIRECTIONAL);
+
+        return sizeof(*range) + le32_to_cpu(range->range_data_size);
+}
+
+static int
+iwl_dump_ini_mon_dram_iter(struct iwl_fw_runtime *fwrt,
+                           struct iwl_fw_ini_region_cfg *reg, void *range_ptr,
+                           int idx)
+{
+        struct iwl_fw_ini_error_dump_range *range = range_ptr;
+        u32 start_addr = iwl_read_umac_prph(fwrt->trans,
+                                            MON_BUFF_BASE_ADDR_VER2);
+
+        if (start_addr == 0x5a5a5a5a)
+                return -EBUSY;
+
+        range->start_addr = cpu_to_le32(start_addr);
+        range->range_data_size = cpu_to_le32(fwrt->trans->fw_mon[idx].size);
+
+        memcpy(range->data, fwrt->trans->fw_mon[idx].block,
+               fwrt->trans->fw_mon[idx].size);
+
+        return sizeof(*range) + le32_to_cpu(range->range_data_size);
+}
+
+struct iwl_ini_txf_iter_data {
+        int fifo;
+        int lmac;
+        u32 fifo_size;
+        bool internal_txf;
+        bool init;
+};
+
+static bool iwl_ini_txf_iter(struct iwl_fw_runtime *fwrt,
+                             struct iwl_fw_ini_region_cfg *reg)
+{
+        struct iwl_ini_txf_iter_data *iter = fwrt->dump.fifo_iter;
+        struct iwl_fwrt_shared_mem_cfg *cfg = &fwrt->smem_cfg;
+        int txf_num = cfg->num_txfifo_entries;
+        int int_txf_num = ARRAY_SIZE(cfg->internal_txfifo_size);
+        u32 lmac_bitmap = le32_to_cpu(reg->fifos.fid1);
+
+        if (!iter)
+                return false;
+
+        if (iter->init) {
+                if (le32_to_cpu(reg->offset) &&
+                    WARN_ONCE(cfg->num_lmacs == 1,
+                              "Invalid lmac offset: 0x%x\n",
+                              le32_to_cpu(reg->offset)))
+                        return false;
+
+                iter->init = false;
+                iter->internal_txf = false;
+                iter->fifo_size = 0;
+                iter->fifo = -1;
+                if (le32_to_cpu(reg->offset))
+                        iter->lmac = 1;
+                else
+                        iter->lmac = 0;
+        }
+
+        if (!iter->internal_txf)
+                for (iter->fifo++; iter->fifo < txf_num; iter->fifo++) {
+                        iter->fifo_size =
+                                cfg->lmac[iter->lmac].txfifo_size[iter->fifo];
+                        if (iter->fifo_size && (lmac_bitmap & BIT(iter->fifo)))
+                                return true;
+                }
+
+        iter->internal_txf = true;
+
+        if (!fw_has_capa(&fwrt->fw->ucode_capa,
+                         IWL_UCODE_TLV_CAPA_EXTEND_SHARED_MEM_CFG))
+                return false;
+
+        for (iter->fifo++; iter->fifo < int_txf_num + txf_num; iter->fifo++) {
+                iter->fifo_size =
+                        cfg->internal_txfifo_size[iter->fifo - txf_num];
+                if (iter->fifo_size && (lmac_bitmap & BIT(iter->fifo)))
+                        return true;
+        }
+
+        return false;
+}
+
+static int iwl_dump_ini_txf_iter(struct iwl_fw_runtime *fwrt,
+                                 struct iwl_fw_ini_region_cfg *reg,
+                                 void *range_ptr, int idx)
+{
+        struct iwl_fw_ini_fifo_error_dump_range *range = range_ptr;
+        struct iwl_ini_txf_iter_data *iter;
+        u32 offs = le32_to_cpu(reg->offset), addr;
+        u32 registers_size =
+                le32_to_cpu(reg->fifos.num_of_registers) * sizeof(__le32);
+        __le32 *val = range->data;
         unsigned long flags;
-        u32 i, size = le32_to_cpu(reg->num_regions);
+        int i;
 
-        IWL_DEBUG_INFO(trans, "WRT PRPH dump\n");
+        if (!iwl_ini_txf_iter(fwrt, reg))
+                return -EIO;
 
-        if (!iwl_trans_grab_nic_access(trans, &flags))
+        if (!iwl_trans_grab_nic_access(fwrt->trans, &flags))
+                return -EBUSY;
+
+        iter = fwrt->dump.fifo_iter;
+
+        range->fifo_num = cpu_to_le32(iter->fifo);
+        range->num_of_registers = reg->fifos.num_of_registers;
+        range->range_data_size = cpu_to_le32(iter->fifo_size + registers_size);
+
+        iwl_write_prph_no_grab(fwrt->trans, TXF_LARC_NUM + offs, iter->fifo);
+
+        /* read txf registers */
+        for (i = 0; i < le32_to_cpu(reg->fifos.num_of_registers); i++) {
+                addr = le32_to_cpu(reg->start_addr[i]) + offs;
+
+                *val++ = cpu_to_le32(iwl_read_prph_no_grab(fwrt->trans, addr));
+        }
+
+        if (reg->fifos.header_only) {
+                range->range_data_size = cpu_to_le32(registers_size);
+                goto out;
+        }
+
+        /* Set the TXF_READ_MODIFY_ADDR to TXF_WR_PTR */
+        iwl_write_prph_no_grab(fwrt->trans, TXF_READ_MODIFY_ADDR + offs,
+                               TXF_WR_PTR + offs);
+
+        /* Dummy-read to advance the read pointer to the head */
+        iwl_read_prph_no_grab(fwrt->trans, TXF_READ_MODIFY_DATA + offs);
+
+        /* Read FIFO */
+        addr = TXF_READ_MODIFY_DATA + offs;
+        for (i = 0; i < iter->fifo_size; i += sizeof(__le32))
+                *val++ = cpu_to_le32(iwl_read_prph_no_grab(fwrt->trans, addr));
+
+out:
+        iwl_trans_release_nic_access(fwrt->trans, &flags);
+
+        return sizeof(*range) + le32_to_cpu(range->range_data_size);
+}
+
+struct iwl_ini_rxf_data {
+        u32 fifo_num;
+        u32 size;
+        u32 offset;
+};
+
+static void iwl_ini_get_rxf_data(struct iwl_fw_runtime *fwrt,
+                                 struct iwl_fw_ini_region_cfg *reg,
+                                 struct iwl_ini_rxf_data *data)
+{
+        u32 fid1 = le32_to_cpu(reg->fifos.fid1);
+        u32 fid2 = le32_to_cpu(reg->fifos.fid2);
+        u32 fifo_idx;
+
+        if (!data)
                 return;
 
-        for (i = 0; i < size; i++) {
-                (*data)->type = cpu_to_le32(IWL_FW_ERROR_DUMP_PRPH);
-                (*data)->len = cpu_to_le32(le32_to_cpu(reg->size) +
-                                           sizeof(*prph));
-                prph = (void *)(*data)->data;
-                prph->prph_start = reg->start_addr[i];
-                prph->data[0] = cpu_to_le32(iwl_read_prph_no_grab(trans,
-                                                                  le32_to_cpu(prph->prph_start)));
-                *data = iwl_fw_error_next_data(*data);
+        memset(data, 0, sizeof(*data));
+
+        if (WARN_ON_ONCE((fid1 && fid2) || (!fid1 && !fid2)))
+                return;
+
+        fifo_idx = ffs(fid1) - 1;
+        if (fid1 && !WARN_ON_ONCE((~BIT(fifo_idx) & fid1) ||
+                                  fifo_idx >= MAX_NUM_LMAC)) {
+                data->size = fwrt->smem_cfg.lmac[fifo_idx].rxfifo1_size;
+                data->fifo_num = fifo_idx;
+                return;
+        }
+
+        fifo_idx = ffs(fid2) - 1;
+        if (fid2 && !WARN_ON_ONCE(fifo_idx != 0)) {
+                data->size = fwrt->smem_cfg.rxfifo2_size;
+                data->offset = RXF_DIFF_FROM_PREV;
+                /* use bit 31 to distinguish between umac and lmac rxf while
+                 * parsing the dump
+                 */
+                data->fifo_num = fifo_idx | IWL_RXF_UMAC_BIT;
+                return;
         }
-        iwl_trans_release_nic_access(trans, &flags);
 }
 
-static void iwl_dump_csr_ini(struct iwl_trans *trans,
-                             struct iwl_fw_error_dump_data **data,
-                             struct iwl_fw_ini_region_cfg *reg)
+static int iwl_dump_ini_rxf_iter(struct iwl_fw_runtime *fwrt,
+                                 struct iwl_fw_ini_region_cfg *reg,
+                                 void *range_ptr, int idx)
 {
-        int i, num = le32_to_cpu(reg->num_regions);
-        u32 size = le32_to_cpu(reg->size);
+        struct iwl_fw_ini_fifo_error_dump_range *range = range_ptr;
+        struct iwl_ini_rxf_data rxf_data;
+        u32 offs = le32_to_cpu(reg->offset), addr;
+        u32 registers_size =
+                le32_to_cpu(reg->fifos.num_of_registers) * sizeof(__le32);
+        __le32 *val = range->data;
+        unsigned long flags;
+        int i;
+
+        iwl_ini_get_rxf_data(fwrt, reg, &rxf_data);
+        if (!rxf_data.size)
+                return -EIO;
 
-        IWL_DEBUG_INFO(trans, "WRT CSR dump\n");
+        if (!iwl_trans_grab_nic_access(fwrt->trans, &flags))
+                return -EBUSY;
 
-        for (i = 0; i < num; i++) {
-                u32 add = le32_to_cpu(reg->start_addr[i]);
-                __le32 *val;
-                int j;
+        offs += rxf_data.offset;
 
-                (*data)->type = cpu_to_le32(IWL_FW_ERROR_DUMP_CSR);
-                (*data)->len = cpu_to_le32(size);
-                val = (void *)(*data)->data;
+        range->fifo_num = cpu_to_le32(rxf_data.fifo_num);
+        range->num_of_registers = reg->fifos.num_of_registers;
+        range->range_data_size = cpu_to_le32(rxf_data.size + registers_size);
 
-                for (j = 0; j < size; j += 4)
-                        *val++ = cpu_to_le32(iwl_trans_read32(trans, j + add));
+        /* read rxf registers */
+        for (i = 0; i < le32_to_cpu(reg->fifos.num_of_registers); i++) {
+                addr = le32_to_cpu(reg->start_addr[i]) + offs;
 
-                *data = iwl_fw_error_next_data(*data);
+                *val++ = cpu_to_le32(iwl_read_prph_no_grab(fwrt->trans, addr));
+        }
+
+        if (reg->fifos.header_only) {
+                range->range_data_size = cpu_to_le32(registers_size);
+                goto out;
+        }
+
+        /* Lock fence */
+        iwl_write_prph_no_grab(fwrt->trans, RXF_SET_FENCE_MODE + offs, 0x1);
+        /* Set fence pointer to the same place like WR pointer */
+        iwl_write_prph_no_grab(fwrt->trans, RXF_LD_WR2FENCE + offs, 0x1);
+        /* Set fence offset */
+        iwl_write_prph_no_grab(fwrt->trans, RXF_LD_FENCE_OFFSET_ADDR + offs,
+                               0x0);
+
+        /* Read FIFO */
+        addr =  RXF_FIFO_RD_FENCE_INC + offs;
+        for (i = 0; i < rxf_data.size; i += sizeof(__le32))
+                *val++ = cpu_to_le32(iwl_read_prph_no_grab(fwrt->trans, addr));
+
+out:
+        iwl_trans_release_nic_access(fwrt->trans, &flags);
+
+        return sizeof(*range) + le32_to_cpu(range->range_data_size);
+}
+
+static void *iwl_dump_ini_mem_fill_header(struct iwl_fw_runtime *fwrt,
+                                          struct iwl_fw_ini_region_cfg *reg,
+                                          void *data)
+{
+        struct iwl_fw_ini_error_dump *dump = data;
+
+        return dump->ranges;
+}
+
+static void
+*iwl_dump_ini_mon_dram_fill_header(struct iwl_fw_runtime *fwrt,
+                                   struct iwl_fw_ini_region_cfg *reg,
+                                   void *data)
+{
+        struct iwl_fw_ini_monitor_dram_dump *mon_dump = (void *)data;
+        u32 write_ptr, cycle_cnt;
+        unsigned long flags;
+
+        if (!iwl_trans_grab_nic_access(fwrt->trans, &flags)) {
+                IWL_ERR(fwrt, "Failed to get DRAM monitor header\n");
+                return NULL;
         }
+        write_ptr = iwl_read_umac_prph_no_grab(fwrt->trans,
+                                               MON_BUFF_WRPTR_VER2);
+        cycle_cnt = iwl_read_umac_prph_no_grab(fwrt->trans,
+                                               MON_BUFF_CYCLE_CNT_VER2);
+        iwl_trans_release_nic_access(fwrt->trans, &flags);
+
+        mon_dump->write_ptr = cpu_to_le32(write_ptr);
+        mon_dump->cycle_cnt = cpu_to_le32(cycle_cnt);
+
+        return mon_dump->ranges;
+}
+
+static void *iwl_dump_ini_fifo_fill_header(struct iwl_fw_runtime *fwrt,
+                                           struct iwl_fw_ini_region_cfg *reg,
+                                           void *data)
+{
+        struct iwl_fw_ini_fifo_error_dump *dump = data;
+
+        return dump->ranges;
+}
+
+static u32 iwl_dump_ini_mem_ranges(struct iwl_fw_runtime *fwrt,
+                                   struct iwl_fw_ini_region_cfg *reg)
+{
+        return le32_to_cpu(reg->internal.num_of_ranges);
+}
+
+static u32 iwl_dump_ini_paging_gen2_ranges(struct iwl_fw_runtime *fwrt,
+                                           struct iwl_fw_ini_region_cfg *reg)
+{
+        return fwrt->trans->init_dram.paging_cnt;
+}
+
+static u32 iwl_dump_ini_paging_ranges(struct iwl_fw_runtime *fwrt,
+                                      struct iwl_fw_ini_region_cfg *reg)
+{
+        return fwrt->num_of_paging_blk;
+}
+
+static u32 iwl_dump_ini_mon_dram_ranges(struct iwl_fw_runtime *fwrt,
+                                        struct iwl_fw_ini_region_cfg *reg)
+{
+        return 1;
+}
+
+static u32 iwl_dump_ini_txf_ranges(struct iwl_fw_runtime *fwrt,
+                                   struct iwl_fw_ini_region_cfg *reg)
+{
+        struct iwl_ini_txf_iter_data iter = { .init = true };
+        void *fifo_iter = fwrt->dump.fifo_iter;
+        u32 num_of_fifos = 0;
+
+        fwrt->dump.fifo_iter = &iter;
+        while (iwl_ini_txf_iter(fwrt, reg))
+                num_of_fifos++;
+
+        fwrt->dump.fifo_iter = fifo_iter;
+
+        return num_of_fifos;
+}
+
+static u32 iwl_dump_ini_rxf_ranges(struct iwl_fw_runtime *fwrt,
+                                   struct iwl_fw_ini_region_cfg *reg)
+{
+        /* Each Rx fifo needs a different offset and therefore, it's
+         * region can contain only one fifo, i.e. 1 memory range.
+         */
+        return 1;
+}
+
+static u32 iwl_dump_ini_mem_get_size(struct iwl_fw_runtime *fwrt,
+                                     struct iwl_fw_ini_region_cfg *reg)
+{
+        return sizeof(struct iwl_fw_ini_error_dump) +
+                iwl_dump_ini_mem_ranges(fwrt, reg) *
+                (sizeof(struct iwl_fw_ini_error_dump_range) +
+                 le32_to_cpu(reg->internal.range_data_size));
+}
+
+static u32 iwl_dump_ini_paging_gen2_get_size(struct iwl_fw_runtime *fwrt,
+                                             struct iwl_fw_ini_region_cfg *reg)
+{
+        int i;
+        u32 range_header_len = sizeof(struct iwl_fw_ini_error_dump_range);
+        u32 size = sizeof(struct iwl_fw_ini_error_dump);
+
+        for (i = 0; i < iwl_dump_ini_paging_gen2_ranges(fwrt, reg); i++)
+                size += range_header_len +
+                        fwrt->trans->init_dram.paging[i].size;
+
+        return size;
+}
+
+static u32 iwl_dump_ini_paging_get_size(struct iwl_fw_runtime *fwrt,
+                                        struct iwl_fw_ini_region_cfg *reg)
+{
+        int i;
+        u32 range_header_len = sizeof(struct iwl_fw_ini_error_dump_range);
+        u32 size = sizeof(struct iwl_fw_ini_error_dump);
+
+        for (i = 1; i <= iwl_dump_ini_paging_ranges(fwrt, reg); i++)
+                size += range_header_len + fwrt->fw_paging_db[i].fw_paging_size;
+
+        return size;
+}
+
+static u32 iwl_dump_ini_mon_dram_get_size(struct iwl_fw_runtime *fwrt,
+                                          struct iwl_fw_ini_region_cfg *reg)
+{
+        u32 size = sizeof(struct iwl_fw_ini_monitor_dram_dump);
+
+        if (fwrt->trans->num_blocks)
+                size += fwrt->trans->fw_mon[0].size;
+
+        return size;
+}
+
+static u32 iwl_dump_ini_txf_get_size(struct iwl_fw_runtime *fwrt,
+                                     struct iwl_fw_ini_region_cfg *reg)
+{
+        struct iwl_ini_txf_iter_data iter = { .init = true };
+        void *fifo_iter = fwrt->dump.fifo_iter;
+        u32 size = 0;
+        u32 fifo_hdr = sizeof(struct iwl_fw_ini_fifo_error_dump_range) +
+                le32_to_cpu(reg->fifos.num_of_registers) * sizeof(__le32);
+
+        fwrt->dump.fifo_iter = &iter;
+        while (iwl_ini_txf_iter(fwrt, reg)) {
+                size += fifo_hdr;
+                if (!reg->fifos.header_only)
+                        size += iter.fifo_size;
+        }
+
+        if (size)
+                size += sizeof(struct iwl_fw_ini_fifo_error_dump);
+
+        fwrt->dump.fifo_iter = fifo_iter;
+
+        return size;
+}
+
+static u32 iwl_dump_ini_rxf_get_size(struct iwl_fw_runtime *fwrt,
+                                     struct iwl_fw_ini_region_cfg *reg)
+{
+        struct iwl_ini_rxf_data rx_data;
+        u32 size = sizeof(struct iwl_fw_ini_fifo_error_dump) +
+                sizeof(struct iwl_fw_ini_fifo_error_dump_range) +
+                le32_to_cpu(reg->fifos.num_of_registers) * sizeof(__le32);
+
+        if (reg->fifos.header_only)
+                return size;
+
+        iwl_ini_get_rxf_data(fwrt, reg, &rx_data);
+        size += rx_data.size;
+
+        return size;
+}
+
+/**
+ * struct iwl_dump_ini_mem_ops - ini memory dump operations
+ * @get_num_of_ranges: returns the number of memory ranges in the region.
+ * @get_size: returns the total size of the region.
+ * @fill_mem_hdr: fills region type specific headers and returns pointer to
+ *      the first range or NULL if failed to fill headers.
+ * @fill_range: copies a given memory range into the dump.
+ *      Returns the size of the range or negative error value otherwise.
+ */
+struct iwl_dump_ini_mem_ops {
+        u32 (*get_num_of_ranges)(struct iwl_fw_runtime *fwrt,
+                                 struct iwl_fw_ini_region_cfg *reg);
+        u32 (*get_size)(struct iwl_fw_runtime *fwrt,
+                        struct iwl_fw_ini_region_cfg *reg);
+        void *(*fill_mem_hdr)(struct iwl_fw_runtime *fwrt,
+                              struct iwl_fw_ini_region_cfg *reg, void *data);
+        int (*fill_range)(struct iwl_fw_runtime *fwrt,
+                          struct iwl_fw_ini_region_cfg *reg, void *range,
+                          int idx);
+};
+
+/**
+ * iwl_dump_ini_mem - copy a memory region into the dump
+ * @fwrt: fw runtime struct.
+ * @data: dump memory data.
+ * @reg: region to copy to the dump.
+ */
+static void
+iwl_dump_ini_mem(struct iwl_fw_runtime *fwrt,
+                 enum iwl_fw_ini_region_type type,
+                 struct iwl_fw_error_dump_data **data,
+                 struct iwl_fw_ini_region_cfg *reg,
+                 struct iwl_dump_ini_mem_ops *ops)
+{
+        struct iwl_fw_ini_error_dump_header *header = (void *)(*data)->data;
+        void *range;
+        u32 num_of_ranges, i;
+
+        if (WARN_ON(!ops || !ops->get_num_of_ranges || !ops->get_size ||
+                    !ops->fill_mem_hdr || !ops->fill_range))
+                return;
+
+        num_of_ranges = ops->get_num_of_ranges(fwrt, reg);
+
+        (*data)->type = cpu_to_le32(type | INI_DUMP_BIT);
+        (*data)->len = cpu_to_le32(ops->get_size(fwrt, reg));
+
+        header->num_of_ranges = cpu_to_le32(num_of_ranges);
+        header->name_len = cpu_to_le32(min_t(int, IWL_FW_INI_MAX_NAME,
+                                             le32_to_cpu(reg->name_len)));
+        memcpy(header->name, reg->name, le32_to_cpu(header->name_len));
+
+        range = ops->fill_mem_hdr(fwrt, reg, header);
+        if (!range) {
+                IWL_ERR(fwrt, "Failed to fill region header: id=%d, type=%d\n",
+                        le32_to_cpu(reg->region_id), type);
+                return;
+        }
+
+        for (i = 0; i < num_of_ranges; i++) {
+                int range_size = ops->fill_range(fwrt, reg, range, i);
+
+                if (range_size < 0) {
+                        IWL_ERR(fwrt, "Failed to dump region: id=%d, type=%d\n",
+                                le32_to_cpu(reg->region_id), type);
+                        return;
+                }
+                range = range + range_size;
+        }
+        *data = iwl_fw_error_next_data(*data);
 }
 
 static int iwl_fw_ini_get_trigger_len(struct iwl_fw_runtime *fwrt,
                                       struct iwl_fw_ini_trigger *trigger)
 {
-        int i, num, size = 0, hdr_len = sizeof(struct iwl_fw_error_dump_data);
+        int i, size = 0, hdr_len = sizeof(struct iwl_fw_error_dump_data);
 
         if (!trigger || !trigger->num_regions)
                 return 0;
 
-        num = le32_to_cpu(trigger->num_regions);
-        for (i = 0; i < num; i++) {
+        for (i = 0; i < le32_to_cpu(trigger->num_regions); i++) {
                 u32 reg_id = le32_to_cpu(trigger->data[i]);
                 struct iwl_fw_ini_region_cfg *reg;
                 enum iwl_fw_ini_region_type type;
-                u32 num_entries;
 
                 if (WARN_ON(reg_id >= ARRAY_SIZE(fwrt->dump.active_regs)))
                         continue;
 
-                reg = fwrt->dump.active_regs[reg_id].reg;
+                reg = fwrt->dump.active_regs[reg_id];
                 if (WARN(!reg, "Unassigned region %d\n", reg_id))
                         continue;
 
                 type = le32_to_cpu(reg->region_type);
-                num_entries = le32_to_cpu(reg->num_regions);
-
                 switch (type) {
                 case IWL_FW_INI_REGION_DEVICE_MEMORY:
-                        size += hdr_len +
-                                sizeof(struct iwl_fw_error_dump_named_mem) +
-                                le32_to_cpu(reg->size);
-                        break;
                 case IWL_FW_INI_REGION_PERIPHERY_MAC:
                 case IWL_FW_INI_REGION_PERIPHERY_PHY:
                 case IWL_FW_INI_REGION_PERIPHERY_AUX:
-                        size += num_entries *
-                                (hdr_len +
-                                 sizeof(struct iwl_fw_error_dump_prph) +
-                                 sizeof(u32));
+                case IWL_FW_INI_REGION_INTERNAL_BUFFER:
+                case IWL_FW_INI_REGION_CSR:
+                        size += hdr_len + iwl_dump_ini_mem_get_size(fwrt, reg);
                         break;
                 case IWL_FW_INI_REGION_TXF:
-                        size += iwl_fw_txf_len(fwrt, &fwrt->smem_cfg);
+                        size += hdr_len + iwl_dump_ini_txf_get_size(fwrt, reg);
                         break;
                 case IWL_FW_INI_REGION_RXF:
-                        size += iwl_fw_rxf_len(fwrt, &fwrt->smem_cfg);
+                        size += hdr_len + iwl_dump_ini_rxf_get_size(fwrt, reg);
                         break;
-                case IWL_FW_INI_REGION_PAGING:
-                        if (!iwl_fw_dbg_is_paging_enabled(fwrt))
-                                break;
-                        size += fwrt->num_of_paging_blk *
-                                (hdr_len +
-                                 sizeof(struct iwl_fw_error_dump_paging) +
-                                 PAGING_BLOCK_SIZE);
-                        break;
-                case IWL_FW_INI_REGION_CSR:
-                        size += num_entries *
-                                (hdr_len + le32_to_cpu(reg->size));
+                case IWL_FW_INI_REGION_PAGING: {
+                        size += hdr_len;
+                        if (iwl_fw_dbg_is_paging_enabled(fwrt)) {
+                                size += iwl_dump_ini_paging_get_size(fwrt, reg);
+                        } else {
+                                size += iwl_dump_ini_paging_gen2_get_size(fwrt,
+                                                                          reg);
+                        }
                         break;
+                }
                 case IWL_FW_INI_REGION_DRAM_BUFFER:
-                        /* Transport takes care of DRAM dumping */
-                case IWL_FW_INI_REGION_INTERNAL_BUFFER:
+                        if (!fwrt->trans->num_blocks)
+                                break;
+                        size += hdr_len +
+                                iwl_dump_ini_mon_dram_get_size(fwrt, reg);
+                        break;
                 case IWL_FW_INI_REGION_DRAM_IMR:
                         /* Undefined yet */
                 default:
@@ -1181,8 +1693,7 @@ static int iwl_fw_ini_get_trigger_len(struct iwl_fw_runtime *fwrt,
 
 static void iwl_fw_ini_dump_trigger(struct iwl_fw_runtime *fwrt,
                                     struct iwl_fw_ini_trigger *trigger,
-                                    struct iwl_fw_error_dump_data **data,
-                                    u32 *dump_mask)
+                                    struct iwl_fw_error_dump_data **data)
 {
         int i, num = le32_to_cpu(trigger->num_regions);
 
@@ -1190,11 +1701,12 @@ static void iwl_fw_ini_dump_trigger(struct iwl_fw_runtime *fwrt,
                 u32 reg_id = le32_to_cpu(trigger->data[i]);
                 enum iwl_fw_ini_region_type type;
                 struct iwl_fw_ini_region_cfg *reg;
+                struct iwl_dump_ini_mem_ops ops;
 
                 if (reg_id >= ARRAY_SIZE(fwrt->dump.active_regs))
                         continue;
 
-                reg = fwrt->dump.active_regs[reg_id].reg;
+                reg = fwrt->dump.active_regs[reg_id];
                 /* Don't warn, get_trigger_len already warned */
                 if (!reg)
                         continue;
@@ -1202,39 +1714,75 @@ static void iwl_fw_ini_dump_trigger(struct iwl_fw_runtime *fwrt,
                 type = le32_to_cpu(reg->region_type);
                 switch (type) {
                 case IWL_FW_INI_REGION_DEVICE_MEMORY:
-                        if (WARN_ON(le32_to_cpu(reg->num_regions) > 1))
-                                continue;
-                        iwl_fw_dump_named_mem(fwrt, data,
-                                              le32_to_cpu(reg->size),
-                                              le32_to_cpu(reg->start_addr[0]),
-                                              reg->name,
-                                              le32_to_cpu(reg->name_len));
+                case IWL_FW_INI_REGION_INTERNAL_BUFFER:
+                        ops.get_num_of_ranges = iwl_dump_ini_mem_ranges;
+                        ops.get_size = iwl_dump_ini_mem_get_size;
+                        ops.fill_mem_hdr = iwl_dump_ini_mem_fill_header;
+                        ops.fill_range = iwl_dump_ini_dev_mem_iter;
+                        iwl_dump_ini_mem(fwrt, type, data, reg, &ops);
                         break;
                 case IWL_FW_INI_REGION_PERIPHERY_MAC:
                 case IWL_FW_INI_REGION_PERIPHERY_PHY:
                 case IWL_FW_INI_REGION_PERIPHERY_AUX:
-                        iwl_dump_prph_ini(fwrt->trans, data, reg);
+                        ops.get_num_of_ranges = iwl_dump_ini_mem_ranges;
+                        ops.get_size = iwl_dump_ini_mem_get_size;
+                        ops.fill_mem_hdr = iwl_dump_ini_mem_fill_header;
+                        ops.fill_range = iwl_dump_ini_prph_iter;
+                        iwl_dump_ini_mem(fwrt, type, data, reg, &ops);
                         break;
                 case IWL_FW_INI_REGION_DRAM_BUFFER:
-                        *dump_mask |= BIT(IWL_FW_ERROR_DUMP_FW_MONITOR);
+                        ops.get_num_of_ranges = iwl_dump_ini_mon_dram_ranges;
+                        ops.get_size = iwl_dump_ini_mon_dram_get_size;
+                        ops.fill_mem_hdr = iwl_dump_ini_mon_dram_fill_header;
+                        ops.fill_range = iwl_dump_ini_mon_dram_iter;
+                        iwl_dump_ini_mem(fwrt, type, data, reg, &ops);
                         break;
-                case IWL_FW_INI_REGION_PAGING:
-                        if (iwl_fw_dbg_is_paging_enabled(fwrt))
-                                iwl_dump_paging(fwrt, data);
-                        else
-                                *dump_mask |= BIT(IWL_FW_ERROR_DUMP_PAGING);
+                case IWL_FW_INI_REGION_PAGING: {
+                        ops.fill_mem_hdr = iwl_dump_ini_mem_fill_header;
+                        if (iwl_fw_dbg_is_paging_enabled(fwrt)) {
+                                ops.get_num_of_ranges =
+                                        iwl_dump_ini_paging_ranges;
+                                ops.get_size = iwl_dump_ini_paging_get_size;
+                                ops.fill_range = iwl_dump_ini_paging_iter;
+                        } else {
+                                ops.get_num_of_ranges =
+                                        iwl_dump_ini_paging_gen2_ranges;
+                                ops.get_size =
+                                        iwl_dump_ini_paging_gen2_get_size;
+                                ops.fill_range = iwl_dump_ini_paging_gen2_iter;
+                        }
+
+                        iwl_dump_ini_mem(fwrt, type, data, reg, &ops);
                         break;
-                case IWL_FW_INI_REGION_TXF:
-                        iwl_fw_dump_txf(fwrt, data);
+                }
+                case IWL_FW_INI_REGION_TXF: {
+                        struct iwl_ini_txf_iter_data iter = { .init = true };
+                        void *fifo_iter = fwrt->dump.fifo_iter;
+
+                        fwrt->dump.fifo_iter = &iter;
+                        ops.get_num_of_ranges = iwl_dump_ini_txf_ranges;
+                        ops.get_size = iwl_dump_ini_txf_get_size;
+                        ops.fill_mem_hdr = iwl_dump_ini_fifo_fill_header;
+                        ops.fill_range = iwl_dump_ini_txf_iter;
+                        iwl_dump_ini_mem(fwrt, type, data, reg, &ops);
+                        fwrt->dump.fifo_iter = fifo_iter;
                         break;
+                }
                 case IWL_FW_INI_REGION_RXF:
-                        iwl_fw_dump_rxf(fwrt, data);
+                        ops.get_num_of_ranges = iwl_dump_ini_rxf_ranges;
+                        ops.get_size = iwl_dump_ini_rxf_get_size;
+                        ops.fill_mem_hdr = iwl_dump_ini_fifo_fill_header;
+                        ops.fill_range = iwl_dump_ini_rxf_iter;
+                        iwl_dump_ini_mem(fwrt, type, data, reg, &ops);
                         break;
                 case IWL_FW_INI_REGION_CSR:
-                        iwl_dump_csr_ini(fwrt->trans, data, reg);
+                        ops.get_num_of_ranges = iwl_dump_ini_mem_ranges;
+                        ops.get_size = iwl_dump_ini_mem_get_size;
+                        ops.fill_mem_hdr = iwl_dump_ini_mem_fill_header;
+                        ops.fill_range = iwl_dump_ini_csr_iter;
+                        iwl_dump_ini_mem(fwrt, type, data, reg, &ops);
                         break;
                 case IWL_FW_INI_REGION_DRAM_IMR:
-                case IWL_FW_INI_REGION_INTERNAL_BUFFER:
                         /* This is undefined yet */
                 default:
                         break;
@@ -1244,26 +1792,23 @@ static void iwl_fw_ini_dump_trigger(struct iwl_fw_runtime *fwrt,
 
 static struct iwl_fw_error_dump_file *
 _iwl_fw_error_ini_dump(struct iwl_fw_runtime *fwrt,
-                       struct iwl_fw_dump_ptrs *fw_error_dump,
-                       u32 *dump_mask)
+                       struct iwl_fw_dump_ptrs *fw_error_dump)
 {
         int size, id = le32_to_cpu(fwrt->dump.desc->trig_desc.type);
         struct iwl_fw_error_dump_data *dump_data;
         struct iwl_fw_error_dump_file *dump_file;
-        struct iwl_fw_ini_trigger *trigger, *ext;
+        struct iwl_fw_ini_trigger *trigger;
 
         if (id == FW_DBG_TRIGGER_FW_ASSERT)
                 id = IWL_FW_TRIGGER_ID_FW_ASSERT;
 
-        if (WARN_ON(id >= ARRAY_SIZE(fwrt->dump.active_trigs)))
+        if (!iwl_fw_ini_trigger_on(fwrt, id))
                 return NULL;
 
-        trigger = fwrt->dump.active_trigs[id].conf;
-        ext = fwrt->dump.active_trigs[id].conf_ext;
+        trigger = fwrt->dump.active_trigs[id].trig;
 
         size = sizeof(*dump_file);
         size += iwl_fw_ini_get_trigger_len(fwrt, trigger);
-        size += iwl_fw_ini_get_trigger_len(fwrt, ext);
 
         if (!size)
                 return NULL;
@@ -1278,11 +1823,7 @@ _iwl_fw_error_ini_dump(struct iwl_fw_runtime *fwrt,
         dump_data = (void *)dump_file->data;
         dump_file->file_len = cpu_to_le32(size);
 
-        *dump_mask = 0;
-        if (trigger)
-                iwl_fw_ini_dump_trigger(fwrt, trigger, &dump_data, dump_mask);
-        if (ext)
-                iwl_fw_ini_dump_trigger(fwrt, ext, &dump_data, dump_mask);
+        iwl_fw_ini_dump_trigger(fwrt, trigger, &dump_data);
 
         return dump_file;
 }
@@ -1308,8 +1849,7 @@ void iwl_fw_error_dump(struct iwl_fw_runtime *fwrt)
                 goto out;
 
         if (fwrt->trans->ini_valid)
-                dump_file = _iwl_fw_error_ini_dump(fwrt, fw_error_dump,
-                                                   &dump_mask);
+                dump_file = _iwl_fw_error_ini_dump(fwrt, fw_error_dump);
         else
                 dump_file = _iwl_fw_error_dump(fwrt, fw_error_dump);
 
@@ -1321,7 +1861,10 @@ void iwl_fw_error_dump(struct iwl_fw_runtime *fwrt)
         if (!fwrt->trans->ini_valid && fwrt->dump.monitor_only)
                 dump_mask &= IWL_FW_ERROR_DUMP_FW_MONITOR;
 
-        fw_error_dump->trans_ptr = iwl_trans_dump_data(fwrt->trans, dump_mask);
+        if (!fwrt->trans->ini_valid)
+                fw_error_dump->trans_ptr =
+                        iwl_trans_dump_data(fwrt->trans, dump_mask);
+
         file_len = le32_to_cpu(dump_file->file_len);
         fw_error_dump->fwrt_len = file_len;
         if (fw_error_dump->trans_ptr) {
@@ -1362,61 +1905,12 @@ const struct iwl_fw_dump_desc iwl_dump_desc_assert = {
 };
 IWL_EXPORT_SYMBOL(iwl_dump_desc_assert);
 
-void iwl_fw_assert_error_dump(struct iwl_fw_runtime *fwrt)
-{
-        IWL_INFO(fwrt, "error dump due to fw assert\n");
-        fwrt->dump.desc = &iwl_dump_desc_assert;
-        iwl_fw_error_dump(fwrt);
-}
-IWL_EXPORT_SYMBOL(iwl_fw_assert_error_dump);
-
-void iwl_fw_alive_error_dump(struct iwl_fw_runtime *fwrt)
-{
-        struct iwl_fw_dump_desc *iwl_dump_desc_no_alive =
-                kmalloc(sizeof(*iwl_dump_desc_no_alive), GFP_KERNEL);
-
-        if (!iwl_dump_desc_no_alive)
-                return;
-
-        iwl_dump_desc_no_alive->trig_desc.type =
-                cpu_to_le32(FW_DBG_TRIGGER_NO_ALIVE);
-        iwl_dump_desc_no_alive->len = 0;
-
-        if (WARN_ON(fwrt->dump.desc))
-                iwl_fw_free_dump_desc(fwrt);
-
-        IWL_WARN(fwrt, "Collecting data: trigger %d fired.\n",
-                 FW_DBG_TRIGGER_NO_ALIVE);
-
-        fwrt->dump.desc = iwl_dump_desc_no_alive;
-        iwl_fw_error_dump(fwrt);
-        clear_bit(IWL_FWRT_STATUS_WAIT_ALIVE, &fwrt->status);
-}
-IWL_EXPORT_SYMBOL(iwl_fw_alive_error_dump);
-
 int iwl_fw_dbg_collect_desc(struct iwl_fw_runtime *fwrt,
                             const struct iwl_fw_dump_desc *desc,
                             bool monitor_only,
                             unsigned int delay)
 {
-        /*
-         * If the loading of the FW completed successfully, the next step is to
-         * get the SMEM config data. Thus, if fwrt->smem_cfg.num_lmacs is non
-         * zero, the FW was already loaded successully. If the state is "NO_FW"
-         * in such a case - exit, since FW may be dead. Otherwise, we
-         * can try to collect the data, since FW might just not be fully
-         * loaded (no "ALIVE" yet), and the debug data is accessible.
-         *
-         * Corner case: got the FW alive but crashed before getting the SMEM
-         *      config. In such a case, due to HW access problems, we might
-         *      collect garbage.
-         */
-        if (fwrt->trans->state == IWL_TRANS_NO_FW &&
-            fwrt->smem_cfg.num_lmacs)
-                return -EIO;
-
-        if (test_and_set_bit(IWL_FWRT_STATUS_DUMPING, &fwrt->status) ||
-            test_bit(IWL_FWRT_STATUS_WAIT_ALIVE, &fwrt->status))
+        if (test_and_set_bit(IWL_FWRT_STATUS_DUMPING, &fwrt->status))
                 return -EBUSY;
 
         if (WARN_ON(fwrt->dump.desc))
@@ -1428,12 +1922,39 @@ int iwl_fw_dbg_collect_desc(struct iwl_fw_runtime *fwrt,
         fwrt->dump.desc = desc;
         fwrt->dump.monitor_only = monitor_only;
 
-        schedule_delayed_work(&fwrt->dump.wk, delay);
+        schedule_delayed_work(&fwrt->dump.wk, usecs_to_jiffies(delay));
 
         return 0;
 }
 IWL_EXPORT_SYMBOL(iwl_fw_dbg_collect_desc);
 
+int iwl_fw_dbg_error_collect(struct iwl_fw_runtime *fwrt,
+                             enum iwl_fw_dbg_trigger trig_type)
+{
+        int ret;
+        struct iwl_fw_dump_desc *iwl_dump_error_desc =
+                kmalloc(sizeof(*iwl_dump_error_desc), GFP_KERNEL);
+
+        if (!iwl_dump_error_desc)
+                return -ENOMEM;
+
+        iwl_dump_error_desc->trig_desc.type = cpu_to_le32(trig_type);
+        iwl_dump_error_desc->len = 0;
+
+        ret = iwl_fw_dbg_collect_desc(fwrt, iwl_dump_error_desc, false, 0);
+        if (ret) {
+                kfree(iwl_dump_error_desc);
+        } else {
+                set_bit(STATUS_FW_WAIT_DUMP, &fwrt->trans->status);
+
+                /* trigger nmi to halt the fw */
+                iwl_force_nmi(fwrt->trans);
+        }
+
+        return ret;
+}
+IWL_EXPORT_SYMBOL(iwl_fw_dbg_error_collect);
+
 int _iwl_fw_dbg_collect(struct iwl_fw_runtime *fwrt,
                         enum iwl_fw_dbg_trigger trig,
                         const char *str, size_t len,
@@ -1457,8 +1978,10 @@ int _iwl_fw_dbg_collect(struct iwl_fw_runtime *fwrt,
                 }
 
                 trigger->occurrences = cpu_to_le16(occurrences);
-                delay = le16_to_cpu(trigger->trig_dis_ms);
                 monitor_only = trigger->mode & IWL_FW_DBG_TRIGGER_MONITOR_ONLY;
+
+                /* convert msec to usec */
+                delay = le32_to_cpu(trigger->stop_delay) * USEC_PER_MSEC;
         }
 
         desc = kzalloc(sizeof(*desc) + len, GFP_ATOMIC);
@@ -1478,6 +2001,7 @@ int iwl_fw_dbg_collect(struct iwl_fw_runtime *fwrt,
                        u32 id, const char *str, size_t len)
 {
         struct iwl_fw_dump_desc *desc;
+        struct iwl_fw_ini_active_triggers *active;
         u32 occur, delay;
 
         if (!fwrt->trans->ini_valid)
@@ -1486,15 +2010,17 @@ int iwl_fw_dbg_collect(struct iwl_fw_runtime *fwrt,
         if (id == FW_DBG_TRIGGER_USER)
                 id = IWL_FW_TRIGGER_ID_USER_TRIGGER;
 
-        if (WARN_ON(!fwrt->dump.active_trigs[id].active))
+        active = &fwrt->dump.active_trigs[id];
+
+        if (WARN_ON(!active->active))
                 return -EINVAL;
 
-        delay = le32_to_cpu(fwrt->dump.active_trigs[id].conf->dump_delay);
-        occur = le32_to_cpu(fwrt->dump.active_trigs[id].conf->occurrences);
+        delay = le32_to_cpu(active->trig->dump_delay);
+        occur = le32_to_cpu(active->trig->occurrences);
         if (!occur)
                 return 0;
 
-        if (le32_to_cpu(fwrt->dump.active_trigs[id].conf->force_restart)) {
+        if (le32_to_cpu(active->trig->force_restart)) {
                 IWL_WARN(fwrt, "Force restart: trigger %d fired.\n", id);
                 iwl_force_nmi(fwrt->trans);
                 return 0;
@@ -1504,8 +2030,7 @@ int iwl_fw_dbg_collect(struct iwl_fw_runtime *fwrt,
         if (!desc)
                 return -ENOMEM;
 
-        occur--;
-        fwrt->dump.active_trigs[id].conf->occurrences = cpu_to_le32(occur);
+        active->trig->occurrences = cpu_to_le32(--occur);
 
         desc->len = len;
         desc->trig_desc.type = cpu_to_le32(id);
@@ -1670,27 +2195,13 @@ void iwl_fw_dbg_read_d3_debug_data(struct iwl_fw_runtime *fwrt)
 IWL_EXPORT_SYMBOL(iwl_fw_dbg_read_d3_debug_data);
 
 static void
-iwl_fw_dbg_buffer_allocation(struct iwl_fw_runtime *fwrt,
-                             struct iwl_fw_ini_allocation_tlv *alloc)
+iwl_fw_dbg_buffer_allocation(struct iwl_fw_runtime *fwrt, u32 size)
 {
         struct iwl_trans *trans = fwrt->trans;
-        struct iwl_ldbg_config_cmd ldbg_cmd = {
-                .type = cpu_to_le32(BUFFER_ALLOCATION),
-        };
-        struct iwl_buffer_allocation_cmd *cmd = &ldbg_cmd.buffer_allocation;
-        struct iwl_host_cmd hcmd = {
-                .id = LDBG_CONFIG_CMD,
-                .flags = CMD_ASYNC,
-                .data[0] = &ldbg_cmd,
-                .len[0] = sizeof(ldbg_cmd),
-        };
         void *virtual_addr = NULL;
-        u32 size = le32_to_cpu(alloc->size);
         dma_addr_t phys_addr;
 
-        if (!trans->num_blocks &&
-            le32_to_cpu(alloc->buffer_location) !=
-            IWL_FW_INI_LOCATION_DRAM_PATH)
+        if (WARN_ON_ONCE(trans->num_blocks == ARRAY_SIZE(trans->fw_mon)))
                 return;
 
         virtual_addr =
@@ -1702,25 +2213,63 @@ iwl_fw_dbg_buffer_allocation(struct iwl_fw_runtime *fwrt,
         if (!virtual_addr)
                 IWL_ERR(fwrt, "Failed to allocate debug memory\n");
 
-        if (WARN_ON_ONCE(trans->num_blocks == ARRAY_SIZE(trans->fw_mon)))
-                return;
-
         trans->fw_mon[trans->num_blocks].block = virtual_addr;
         trans->fw_mon[trans->num_blocks].physical = phys_addr;
         trans->fw_mon[trans->num_blocks].size = size;
         trans->num_blocks++;
 
         IWL_DEBUG_FW(trans, "Allocated debug block of size %d\n", size);
+}
+
+static void iwl_fw_dbg_buffer_apply(struct iwl_fw_runtime *fwrt,
+                                    struct iwl_fw_ini_allocation_data *alloc,
+                                    enum iwl_fw_ini_apply_point pnt)
+{
+        struct iwl_trans *trans = fwrt->trans;
+        struct iwl_ldbg_config_cmd ldbg_cmd = {
+                .type = cpu_to_le32(BUFFER_ALLOCATION),
+        };
+        struct iwl_buffer_allocation_cmd *cmd = &ldbg_cmd.buffer_allocation;
+        struct iwl_host_cmd hcmd = {
+                .id = LDBG_CONFIG_CMD,
+                .flags = CMD_ASYNC,
+                .data[0] = &ldbg_cmd,
+                .len[0] = sizeof(ldbg_cmd),
+        };
+        int block_idx = trans->num_blocks;
+        u32 buf_location = le32_to_cpu(alloc->tlv.buffer_location);
+
+        if (buf_location == IWL_FW_INI_LOCATION_SRAM_PATH) {
+                if (!WARN(pnt != IWL_FW_INI_APPLY_EARLY,
+                          "Invalid apply point %d for SMEM buffer allocation",
+                          pnt))
+                        /* set sram monitor by enabling bit 7 */
+                        iwl_set_bit(fwrt->trans, CSR_HW_IF_CONFIG_REG,
+                                    CSR_HW_IF_CONFIG_REG_BIT_MONITOR_SRAM);
+                return;
+        }
+
+        if (buf_location != IWL_FW_INI_LOCATION_DRAM_PATH)
+                return;
+
+        if (!alloc->is_alloc) {
+                iwl_fw_dbg_buffer_allocation(fwrt,
+                                             le32_to_cpu(alloc->tlv.size));
+                if (block_idx == trans->num_blocks)
+                        return;
+                alloc->is_alloc = 1;
+        }
 
         /* First block is assigned via registers / context info */
         if (trans->num_blocks == 1)
                 return;
 
         cmd->num_frags = cpu_to_le32(1);
-        cmd->fragments[0].address = cpu_to_le64(phys_addr);
-        cmd->fragments[0].size = alloc->size;
-        cmd->allocation_id = alloc->allocation_id;
-        cmd->buffer_location = alloc->buffer_location;
+        cmd->fragments[0].address =
+                cpu_to_le64(trans->fw_mon[block_idx].physical);
+        cmd->fragments[0].size = alloc->tlv.size;
+        cmd->allocation_id = alloc->tlv.allocation_id;
+        cmd->buffer_location = alloc->tlv.buffer_location;
 
         iwl_trans_send_cmd(trans, &hcmd);
 }
@@ -1749,9 +2298,9 @@ static void iwl_fw_dbg_update_regions(struct iwl_fw_runtime *fwrt,
         int i, size = le32_to_cpu(tlv->num_regions);
 
         for (i = 0; i < size; i++) {
-                struct iwl_fw_ini_region_cfg *reg = iter;
+                struct iwl_fw_ini_region_cfg *reg = iter, **active;
                 int id = le32_to_cpu(reg->region_id);
-                struct iwl_fw_ini_active_regs *active;
+                u32 type = le32_to_cpu(reg->region_type);
 
                 if (WARN(id >= ARRAY_SIZE(fwrt->dump.active_regs),
                          "Invalid region id %d for apply point %d\n", id, pnt))
@@ -1759,26 +2308,47 @@ static void iwl_fw_dbg_update_regions(struct iwl_fw_runtime *fwrt,
 
                 active = &fwrt->dump.active_regs[id];
 
-                if (ext && active->apply_point == pnt)
-                        IWL_WARN(fwrt->trans,
-                                 "External region TLV overrides FW default %x\n",
-                                 id);
+                if (*active)
+                        IWL_WARN(fwrt->trans, "region TLV %d override\n", id);
 
                 IWL_DEBUG_FW(fwrt,
                              "%s: apply point %d, activating region ID %d\n",
                              __func__, pnt, id);
 
-                active->reg = reg;
-                active->apply_point = pnt;
+                *active = reg;
 
-                if (le32_to_cpu(reg->region_type) !=
-                    IWL_FW_INI_REGION_DRAM_BUFFER)
-                        iter += le32_to_cpu(reg->num_regions) * sizeof(__le32);
+                if (type == IWL_FW_INI_REGION_TXF ||
+                    type == IWL_FW_INI_REGION_RXF)
+                        iter += le32_to_cpu(reg->fifos.num_of_registers) *
+                                sizeof(__le32);
+                else if (type != IWL_FW_INI_REGION_DRAM_BUFFER)
+                        iter += le32_to_cpu(reg->internal.num_of_ranges) *
+                                sizeof(__le32);
 
                 iter += sizeof(*reg);
         }
 }
 
+static int iwl_fw_dbg_trig_realloc(struct iwl_fw_runtime *fwrt,
+                                   struct iwl_fw_ini_active_triggers *active,
+                                   u32 id, int size)
+{
+        void *ptr;
+
+        if (size <= active->size)
+                return 0;
+
+        ptr = krealloc(active->trig, size, GFP_KERNEL);
+        if (!ptr) {
+                IWL_ERR(fwrt, "Failed to allocate memory for trigger %d\n", id);
+                return -ENOMEM;
+        }
+        active->trig = ptr;
+        active->size = size;
+
+        return 0;
+}
+
 static void iwl_fw_dbg_update_triggers(struct iwl_fw_runtime *fwrt,
                                        struct iwl_fw_ini_trigger_tlv *tlv,
                                        bool ext,
@@ -1791,43 +2361,61 @@ static void iwl_fw_dbg_update_triggers(struct iwl_fw_runtime *fwrt,
                 struct iwl_fw_ini_trigger *trig = iter;
                 struct iwl_fw_ini_active_triggers *active;
                 int id = le32_to_cpu(trig->trigger_id);
-                u32 num;
+                u32 trig_regs_size = le32_to_cpu(trig->num_regions) *
+                        sizeof(__le32);
 
                 if (WARN_ON(id >= ARRAY_SIZE(fwrt->dump.active_trigs)))
                         break;
 
                 active = &fwrt->dump.active_trigs[id];
 
-                if (active->apply_point != apply_point) {
-                        active->conf = NULL;
-                        active->conf_ext = NULL;
-                }
+                if (!active->active) {
+                        size_t trig_size = sizeof(*trig) + trig_regs_size;
 
-                num = le32_to_cpu(trig->num_regions);
+                        if (iwl_fw_dbg_trig_realloc(fwrt, active, id,
+                                                    trig_size))
+                                goto next;
 
-                if (ext && active->apply_point == apply_point) {
-                        num += le32_to_cpu(active->conf->num_regions);
-                        if (trig->ignore_default) {
-                                active->conf_ext = active->conf;
-                                active->conf = trig;
+                        memcpy(active->trig, trig, trig_size);
+
+                } else {
+                        u32 conf_override =
+                                !(le32_to_cpu(trig->override_trig) & 0xff);
+                        u32 region_override =
+                                !(le32_to_cpu(trig->override_trig) & 0xff00);
+                        u32 offset = 0;
+                        u32 active_regs =
+                                le32_to_cpu(active->trig->num_regions);
+                        u32 new_regs = le32_to_cpu(trig->num_regions);
+                        int mem_to_add = trig_regs_size;
+
+                        if (region_override) {
+                                mem_to_add -= active_regs * sizeof(__le32);
                         } else {
-                                active->conf_ext = trig;
+                                offset += active_regs;
+                                new_regs += active_regs;
                         }
-                } else {
-                        active->conf = trig;
+
+                        if (iwl_fw_dbg_trig_realloc(fwrt, active, id,
+                                                    active->size + mem_to_add))
+                                goto next;
+
+                        if (conf_override)
+                                memcpy(active->trig, trig, sizeof(*trig));
+
+                        memcpy(active->trig->data + offset, trig->data,
+                               trig_regs_size);
+                        active->trig->num_regions = cpu_to_le32(new_regs);
                 }
 
                 /* Since zero means infinity - just set to -1 */
-                if (!le32_to_cpu(trig->occurrences))
-                        trig->occurrences = cpu_to_le32(-1);
-                if (!le32_to_cpu(trig->ignore_consec))
-                        trig->ignore_consec = cpu_to_le32(-1);
+                if (!le32_to_cpu(active->trig->occurrences))
+                        active->trig->occurrences = cpu_to_le32(-1);
 
-                iter += sizeof(*trig) +
-                        le32_to_cpu(trig->num_regions) * sizeof(__le32);
+                active->active = true;
+next:
+                iter += sizeof(*trig) + trig_regs_size;
 
-                active->active = num;
-                active->apply_point = apply_point;
         }
 }
 
@@ -1844,9 +2432,13 @@ static void _iwl_fw_dbg_apply_point(struct iwl_fw_runtime *fwrt,
                 u32 type = le32_to_cpu(tlv->type);
 
                 switch (type) {
-                case IWL_UCODE_TLV_TYPE_BUFFER_ALLOCATION:
-                        iwl_fw_dbg_buffer_allocation(fwrt, ini_tlv);
+                case IWL_UCODE_TLV_TYPE_BUFFER_ALLOCATION: {
+                        struct iwl_fw_ini_allocation_data *buf_alloc = ini_tlv;
+
+                        iwl_fw_dbg_buffer_apply(fwrt, ini_tlv, pnt);
+                        iter += sizeof(buf_alloc->is_alloc);
                         break;
+                }
                 case IWL_UCODE_TLV_TYPE_HCMD:
                         if (pnt < IWL_FW_INI_APPLY_AFTER_ALIVE) {
                                 IWL_ERR(fwrt,
@@ -1877,6 +2469,16 @@ void iwl_fw_dbg_apply_point(struct iwl_fw_runtime *fwrt,
                             enum iwl_fw_ini_apply_point apply_point)
 {
         void *data = &fwrt->trans->apply_points[apply_point];
+        int i;
+
+        if (apply_point == IWL_FW_INI_APPLY_EARLY) {
+                for (i = 0; i < IWL_FW_INI_MAX_REGION_ID; i++)
+                        fwrt->dump.active_regs[i] = NULL;
+
+                /* disable the triggers, used in recovery flow */
+                for (i = 0; i < IWL_FW_TRIGGER_ID_NUM; i++)
+                        fwrt->dump.active_trigs[i].active = false;
+        }
 
         _iwl_fw_dbg_apply_point(fwrt, data, apply_point, false);
 
@@ -1884,3 +2486,27 @@ void iwl_fw_dbg_apply_point(struct iwl_fw_runtime *fwrt,
         _iwl_fw_dbg_apply_point(fwrt, data, apply_point, true);
 }
 IWL_EXPORT_SYMBOL(iwl_fw_dbg_apply_point);
+
+void iwl_fwrt_stop_device(struct iwl_fw_runtime *fwrt)
+{
+        /* if the wait event timeout elapses instead of wake up then
+         * the driver did not receive NMI interrupt and can not assume the FW
+         * is halted
+         */
+        int ret = wait_event_timeout(fwrt->trans->fw_halt_waitq,
+                                     !test_bit(STATUS_FW_WAIT_DUMP,
+                                               &fwrt->trans->status),
+                                     msecs_to_jiffies(2000));
+        if (!ret) {
+                /* failed to receive NMI interrupt, assuming the FW is stuck */
+                set_bit(STATUS_FW_ERROR, &fwrt->trans->status);
+
+                clear_bit(STATUS_FW_WAIT_DUMP, &fwrt->trans->status);
+        }
+
+        /* Assuming the op mode mutex is held at this point */
+        iwl_fw_dbg_collect_sync(fwrt);
+
+        iwl_trans_stop_device(fwrt->trans);
+}
+IWL_EXPORT_SYMBOL(iwl_fwrt_stop_device);
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.h b/drivers/net/wireless/intel/iwlwifi/fw/dbg.h
index 330229d2a61d..a199056234d3 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.h
@@ -8,7 +8,7 @@
  * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
  * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -112,6 +112,8 @@ void iwl_fw_error_dump(struct iwl_fw_runtime *fwrt);
 int iwl_fw_dbg_collect_desc(struct iwl_fw_runtime *fwrt,
                             const struct iwl_fw_dump_desc *desc,
                             bool monitor_only, unsigned int delay);
+int iwl_fw_dbg_error_collect(struct iwl_fw_runtime *fwrt,
+                             enum iwl_fw_dbg_trigger trig_type);
 int _iwl_fw_dbg_collect(struct iwl_fw_runtime *fwrt,
                         enum iwl_fw_dbg_trigger trig,
                         const char *str, size_t len,
@@ -160,9 +162,9 @@ iwl_fw_dbg_trigger_stop_conf_match(struct iwl_fw_runtime *fwrt,
 }
 
 static inline bool
-iwl_fw_dbg_no_trig_window(struct iwl_fw_runtime *fwrt, u32 id, u32 dis_ms)
+iwl_fw_dbg_no_trig_window(struct iwl_fw_runtime *fwrt, u32 id, u32 dis_usec)
 {
-        unsigned long wind_jiff = msecs_to_jiffies(dis_ms);
+        unsigned long wind_jiff = usecs_to_jiffies(dis_usec);
 
         /* If this is the first event checked, jump to update start ts */
         if (fwrt->dump.non_collect_ts_start[id] &&
@@ -179,11 +181,12 @@ iwl_fw_dbg_trigger_check_stop(struct iwl_fw_runtime *fwrt,
                               struct wireless_dev *wdev,
                               struct iwl_fw_dbg_trigger_tlv *trig)
 {
+        u32 usec = le16_to_cpu(trig->trig_dis_ms) * USEC_PER_MSEC;
+
         if (wdev && !iwl_fw_dbg_trigger_vif_match(trig, wdev))
                 return false;
 
-        if (iwl_fw_dbg_no_trig_window(fwrt, le32_to_cpu(trig->id),
-                                      le16_to_cpu(trig->trig_dis_ms))) {
+        if (iwl_fw_dbg_no_trig_window(fwrt, le32_to_cpu(trig->id), usec)) {
                 IWL_WARN(fwrt, "Trigger %d occurred while no-collect window.\n",
                          trig->id);
                 return false;
@@ -220,23 +223,22 @@ _iwl_fw_dbg_trigger_on(struct iwl_fw_runtime *fwrt,
 })
 
 static inline bool
-_iwl_fw_ini_trigger_on(struct iwl_fw_runtime *fwrt,
-                       const enum iwl_fw_dbg_trigger id)
+iwl_fw_ini_trigger_on(struct iwl_fw_runtime *fwrt,
+                      enum iwl_fw_ini_trigger_id id)
 {
-        struct iwl_fw_ini_active_triggers *trig = &fwrt->dump.active_trigs[id];
-        u32 ms;
+        struct iwl_fw_ini_trigger *trig;
+        u32 usec;
+
 
-        if (!fwrt->trans->ini_valid)
-                return false;
 
-        if (!trig || !trig->active)
+        if (!fwrt->trans->ini_valid || id >= IWL_FW_TRIGGER_ID_NUM ||
+            !fwrt->dump.active_trigs[id].active)
                 return false;
 
-        ms = le32_to_cpu(trig->conf->ignore_consec);
-        if (ms)
-                ms /= USEC_PER_MSEC;
+        trig = fwrt->dump.active_trigs[id].trig;
+        usec = le32_to_cpu(trig->ignore_consec);
 
-        if (iwl_fw_dbg_no_trig_window(fwrt, id, ms)) {
+        if (iwl_fw_dbg_no_trig_window(fwrt, id, usec)) {
                 IWL_WARN(fwrt, "Trigger %d fired in no-collect window\n", id);
                 return false;
         }
@@ -244,12 +246,6 @@ _iwl_fw_ini_trigger_on(struct iwl_fw_runtime *fwrt,
         return true;
 }
 
-#define iwl_fw_ini_trigger_on(fwrt, wdev, id) ({                \
-        BUILD_BUG_ON(!__builtin_constant_p(id));                \
-        BUILD_BUG_ON((id) >= IWL_FW_TRIGGER_ID_NUM);            \
-        _iwl_fw_ini_trigger_on((fwrt), (wdev), (id));           \
-})
-
 static inline void
 _iwl_fw_dbg_trigger_simple_stop(struct iwl_fw_runtime *fwrt,
                                 struct wireless_dev *wdev,
@@ -296,13 +292,13 @@ _iwl_fw_dbg_stop_recording(struct iwl_trans *trans,
         }
 
         if (params) {
-                params->in_sample = iwl_read_prph(trans, DBGC_IN_SAMPLE);
-                params->out_ctrl = iwl_read_prph(trans, DBGC_OUT_CTRL);
+                params->in_sample = iwl_read_umac_prph(trans, DBGC_IN_SAMPLE);
+                params->out_ctrl = iwl_read_umac_prph(trans, DBGC_OUT_CTRL);
         }
 
-        iwl_write_prph(trans, DBGC_IN_SAMPLE, 0);
+        iwl_write_umac_prph(trans, DBGC_IN_SAMPLE, 0);
         udelay(100);
-        iwl_write_prph(trans, DBGC_OUT_CTRL, 0);
+        iwl_write_umac_prph(trans, DBGC_OUT_CTRL, 0);
 #ifdef CONFIG_IWLWIFI_DEBUGFS
         trans->dbg_rec_on = false;
 #endif
@@ -330,9 +326,9 @@ _iwl_fw_dbg_restart_recording(struct iwl_trans *trans,
                 iwl_clear_bits_prph(trans, MON_BUFF_SAMPLE_CTL, 0x1);
                 iwl_set_bits_prph(trans, MON_BUFF_SAMPLE_CTL, 0x1);
         } else {
-                iwl_write_prph(trans, DBGC_IN_SAMPLE, params->in_sample);
+                iwl_write_umac_prph(trans, DBGC_IN_SAMPLE, params->in_sample);
                 udelay(100);
-                iwl_write_prph(trans, DBGC_OUT_CTRL, params->out_ctrl);
+                iwl_write_umac_prph(trans, DBGC_OUT_CTRL, params->out_ctrl);
         }
 }
 
@@ -373,7 +369,9 @@ static inline bool iwl_fw_dbg_is_d3_debug_enabled(struct iwl_fw_runtime *fwrt)
 {
         return fw_has_capa(&fwrt->fw->ucode_capa,
                            IWL_UCODE_TLV_CAPA_D3_DEBUG) &&
-                fwrt->trans->cfg->d3_debug_data_length &&
+                fwrt->trans->cfg->d3_debug_data_length && fwrt->ops &&
+                fwrt->ops->d3_debug_enable &&
+                fwrt->ops->d3_debug_enable(fwrt->ops_ctx) &&
                 iwl_fw_dbg_type_on(fwrt, IWL_FW_ERROR_DUMP_D3_DEBUG_DATA);
 }
 
@@ -434,10 +432,33 @@ static inline void iwl_fw_resume_timestamp(struct iwl_fw_runtime *fwrt) {}
 
 #endif /* CONFIG_IWLWIFI_DEBUGFS */
 
-void iwl_fw_assert_error_dump(struct iwl_fw_runtime *fwrt);
-void iwl_fw_alive_error_dump(struct iwl_fw_runtime *fwrt);
 void iwl_fw_dbg_collect_sync(struct iwl_fw_runtime *fwrt);
 void iwl_fw_dbg_apply_point(struct iwl_fw_runtime *fwrt,
                             enum iwl_fw_ini_apply_point apply_point);
 
+void iwl_fwrt_stop_device(struct iwl_fw_runtime *fwrt);
+
+static inline void iwl_fw_lmac1_set_alive_err_table(struct iwl_trans *trans,
+                                                    u32 lmac_error_event_table)
+{
+        if (!(trans->error_event_table_tlv_status &
+              IWL_ERROR_EVENT_TABLE_LMAC1) ||
+            WARN_ON(trans->lmac_error_event_table[0] !=
+                    lmac_error_event_table))
+                trans->lmac_error_event_table[0] = lmac_error_event_table;
+}
+
+static inline void iwl_fw_umac_set_alive_err_table(struct iwl_trans *trans,
+                                                   u32 umac_error_event_table)
+{
+        if (!(trans->error_event_table_tlv_status &
+              IWL_ERROR_EVENT_TABLE_UMAC) ||
+            WARN_ON(trans->umac_error_event_table !=
+                    umac_error_event_table))
+                trans->umac_error_event_table = umac_error_event_table;
+}
+
+/* This bit is used to differentiate the legacy dump from the ini dump */
+#define INI_DUMP_BIT BIT(31)
+
 #endif  /* __iwl_fw_dbg_h__ */
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c b/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c
index 3e120dd47305..c1aa4360736b 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c
@@ -173,9 +173,8 @@ static const struct file_operations iwl_dbgfs_##name##_ops = {		\
         _FWRT_DEBUGFS_READ_WRITE_FILE_OPS(name, bufsz, struct iwl_fw_runtime)
 
 #define FWRT_DEBUGFS_ADD_FILE_ALIAS(alias, name, parent, mode) do {     \
-        if (!debugfs_create_file(alias, mode, parent, fwrt,             \
-                                 &iwl_dbgfs_##name##_ops))              \
-                goto err;                                               \
+        debugfs_create_file(alias, mode, parent, fwrt,                  \
+                            &iwl_dbgfs_##name##_ops);                   \
         } while (0)
 #define FWRT_DEBUGFS_ADD_FILE(name, parent, mode) \
         FWRT_DEBUGFS_ADD_FILE_ALIAS(#name, name, parent, mode)
@@ -321,14 +320,10 @@ out:
 
 FWRT_DEBUGFS_WRITE_FILE_OPS(send_hcmd, 512);
 
-int iwl_fwrt_dbgfs_register(struct iwl_fw_runtime *fwrt,
+void iwl_fwrt_dbgfs_register(struct iwl_fw_runtime *fwrt,
                             struct dentry *dbgfs_dir)
 {
         INIT_DELAYED_WORK(&fwrt->timestamp.wk, iwl_fw_timestamp_marker_wk);
         FWRT_DEBUGFS_ADD_FILE(timestamp_marker, dbgfs_dir, 0200);
         FWRT_DEBUGFS_ADD_FILE(send_hcmd, dbgfs_dir, 0200);
-        return 0;
-err:
-        IWL_ERR(fwrt, "Can't create the fwrt debugfs directory\n");
-        return -ENOMEM;
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/debugfs.h b/drivers/net/wireless/intel/iwlwifi/fw/debugfs.h
index 88255035e8ef..fde40ff88451 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/debugfs.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/debugfs.h
@@ -63,14 +63,11 @@
 #include "runtime.h"
 
 #ifdef CONFIG_IWLWIFI_DEBUGFS
-int iwl_fwrt_dbgfs_register(struct iwl_fw_runtime *fwrt,
+void iwl_fwrt_dbgfs_register(struct iwl_fw_runtime *fwrt,
                             struct dentry *dbgfs_dir);
 
 #else
-static inline int iwl_fwrt_dbgfs_register(struct iwl_fw_runtime *fwrt,
-                                          struct dentry *dbgfs_dir)
-{
-        return 0;
-}
+static inline void iwl_fwrt_dbgfs_register(struct iwl_fw_runtime *fwrt,
+                                           struct dentry *dbgfs_dir) { }
 
 #endif /* CONFIG_IWLWIFI_DEBUGFS */
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/error-dump.h b/drivers/net/wireless/intel/iwlwifi/fw/error-dump.h
index c02425a1e64f..9b5077bd46c3 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/error-dump.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/error-dump.h
@@ -8,7 +8,7 @@
  * Copyright(c) 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2014 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
  * Copyright(c) 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2014 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -275,22 +275,68 @@ struct iwl_fw_error_dump_mem {
 };
 
 /**
- * struct iwl_fw_error_dump_named_mem - chunk of memory
- * @type: &enum iwl_fw_error_dump_mem_type
- * @offset: the offset from which the memory was read
- * @name_len: name length
- * @name: file name
- * @data: the content of the memory
+ * struct iwl_fw_ini_error_dump_range - range of memory
+ * @start_addr: the start address of this range
+ * @range_data_size: the size of this range, in bytes
+ * @data: the actual memory
  */
-struct iwl_fw_error_dump_named_mem {
-        __le32 type;
-        __le32 offset;
-        u8 name_len;
-        u8 name[32];
-        u8 data[];
+struct iwl_fw_ini_error_dump_range {
+        __le32 start_addr;
+        __le32 range_data_size;
+        __le32 data[];
+} __packed;
+
+/**
+ * struct iwl_fw_ini_error_dump_header - ini region dump header
+ * @num_of_ranges: number of ranges in this region
+ * @name_len: number of bytes allocated to the name string of this region
+ * @name: name of the region
+ */
+struct iwl_fw_ini_error_dump_header {
+        __le32 num_of_ranges;
+        __le32 name_len;
+        u8 name[IWL_FW_INI_MAX_NAME];
 };
 
 /**
+ * struct iwl_fw_ini_error_dump - ini region dump
+ * @header: the header of this region
+ * @ranges: the memory ranges of this region
+ */
+struct iwl_fw_ini_error_dump {
+        struct iwl_fw_ini_error_dump_header header;
+        struct iwl_fw_ini_error_dump_range ranges[];
+} __packed;
+
+/* This bit is used to differentiate between lmac and umac rxf */
+#define IWL_RXF_UMAC_BIT BIT(31)
+
+/**
+ * struct iwl_fw_ini_fifo_error_dump_range - ini fifo range dump
+ * @fifo_num: the fifo num. In case of rxf and umac rxf, set BIT(31) to
+ *      distinguish between lmac and umac
+ * @num_of_registers: num of registers to dump, dword size each
+ * @range_data_size: the size of the registers and fifo data
+ * @data: fifo data
+ */
+struct iwl_fw_ini_fifo_error_dump_range {
+        __le32 fifo_num;
+        __le32 num_of_registers;
+        __le32 range_data_size;
+        __le32 data[];
+} __packed;
+
+/**
+ * struct iwl_fw_ini_fifo_error_dump - ini fifo region dump
+ * @header: the header of this region
+ * @ranges: the memory ranges of this region
+ */
+struct iwl_fw_ini_fifo_error_dump {
+        struct iwl_fw_ini_error_dump_header header;
+        struct iwl_fw_ini_fifo_error_dump_range ranges[];
+} __packed;
+
+/**
  * struct iwl_fw_error_dump_rb - content of an Receive Buffer
  * @index: the index of the Receive Buffer in the Rx queue
  * @rxq: the RB's Rx queue
@@ -305,6 +351,20 @@ struct iwl_fw_error_dump_rb {
 };
 
 /**
+ * struct iwl_fw_ini_monitor_dram_dump - ini dram monitor dump
+ * @header - header of the region
+ * @write_ptr - write pointer position in the dram
+ * @cycle_cnt - cycles count
+ * @ranges - the memory ranges of this this region
+ */
+struct iwl_fw_ini_monitor_dram_dump {
+        struct iwl_fw_ini_error_dump_header header;
+        __le32 write_ptr;
+        __le32 cycle_cnt;
+        struct iwl_fw_ini_error_dump_range ranges[];
+} __packed;
+
+/**
  * struct iwl_fw_error_dump_paging - content of the UMAC's image page
  *      block on DRAM
  * @index: the index of the page block
@@ -355,7 +415,9 @@ iwl_fw_error_next_data(struct iwl_fw_error_dump_data *data)
  * @FW_DBG_TDLS: trigger log collection upon TDLS related events.
  * @FW_DBG_TRIGGER_TX_STATUS: trigger log collection upon tx status when
  *  the firmware sends a tx reply.
- * @FW_DBG_TRIGGER_NO_ALIVE: trigger log collection if alive flow fails
+ * @FW_DBG_TRIGGER_ALIVE_TIMEOUT: trigger log collection if alive flow timeouts
+ * @FW_DBG_TRIGGER_DRIVER: trigger log collection upon a flow failure
+ *      in the driver.
  */
 enum iwl_fw_dbg_trigger {
         FW_DBG_TRIGGER_INVALID = 0,
@@ -373,7 +435,8 @@ enum iwl_fw_dbg_trigger {
         FW_DBG_TRIGGER_TX_LATENCY,
         FW_DBG_TRIGGER_TDLS,
         FW_DBG_TRIGGER_TX_STATUS,
-        FW_DBG_TRIGGER_NO_ALIVE,
+        FW_DBG_TRIGGER_ALIVE_TIMEOUT,
+        FW_DBG_TRIGGER_DRIVER,
 
         /* must be last */
         FW_DBG_TRIGGER_MAX,
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/file.h b/drivers/net/wireless/intel/iwlwifi/fw/file.h
index e8b00b795cbb..641c95d03b15 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/file.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/file.h
@@ -9,6 +9,7 @@
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
  * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -32,6 +33,7 @@
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
  * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -143,6 +145,9 @@ enum iwl_ucode_tlv_type {
         IWL_UCODE_TLV_FW_GSCAN_CAPA     = 50,
         IWL_UCODE_TLV_FW_MEM_SEG        = 51,
         IWL_UCODE_TLV_IML               = 52,
+        IWL_UCODE_TLV_UMAC_DEBUG_ADDRS  = 54,
+        IWL_UCODE_TLV_LMAC_DEBUG_ADDRS  = 55,
+        IWL_UCODE_TLV_FW_RECOVERY_INFO  = 57,
         IWL_UCODE_TLV_TYPE_BUFFER_ALLOCATION    = IWL_UCODE_INI_TLV_GROUP | 0x1,
         IWL_UCODE_TLV_TYPE_HCMD                 = IWL_UCODE_INI_TLV_GROUP | 0x2,
         IWL_UCODE_TLV_TYPE_REGIONS              = IWL_UCODE_INI_TLV_GROUP | 0x3,
@@ -263,6 +268,12 @@ typedef unsigned int __bitwise iwl_ucode_tlv_api_t;
  * @IWL_UCODE_TLV_API_FRAG_EBS: This ucode supports fragmented EBS
  * @IWL_UCODE_TLV_API_REDUCE_TX_POWER: This ucode supports v5 of
  *      the REDUCE_TX_POWER_CMD.
+ * @IWL_UCODE_TLV_API_SHORT_BEACON_NOTIF: This ucode supports the short
+ *      version of the beacon notification.
+ * @IWL_UCODE_TLV_API_BEACON_FILTER_V4: This ucode supports v4 of
+ *      BEACON_FILTER_CONFIG_API_S_VER_4.
+ * @IWL_UCODE_TLV_API_FTM_NEW_RANGE_REQ: This ucode supports v7 of
+ *      LOCATION_RANGE_REQ_CMD_API_S and v6 of LOCATION_RANGE_RESP_NTFY_API_S.
  *
  * @NUM_IWL_UCODE_TLV_API: number of bits used
  */
@@ -287,6 +298,9 @@ enum iwl_ucode_tlv_api {
         IWL_UCODE_TLV_API_ADAPTIVE_DWELL_V2     = (__force iwl_ucode_tlv_api_t)42,
         IWL_UCODE_TLV_API_FRAG_EBS              = (__force iwl_ucode_tlv_api_t)44,
         IWL_UCODE_TLV_API_REDUCE_TX_POWER       = (__force iwl_ucode_tlv_api_t)45,
+        IWL_UCODE_TLV_API_SHORT_BEACON_NOTIF    = (__force iwl_ucode_tlv_api_t)46,
+        IWL_UCODE_TLV_API_BEACON_FILTER_V4      = (__force iwl_ucode_tlv_api_t)47,
+        IWL_UCODE_TLV_API_FTM_NEW_RANGE_REQ     = (__force iwl_ucode_tlv_api_t)49,
 
         NUM_IWL_UCODE_TLV_API
 #ifdef __CHECKER__
@@ -333,6 +347,7 @@ typedef unsigned int __bitwise iwl_ucode_tlv_capa_t;
  * @IWL_UCODE_TLV_CAPA_TLC_OFFLOAD: firmware implements rate scaling algorithm
  * @IWL_UCODE_TLV_CAPA_DYNAMIC_QUOTA: firmware implements quota related
  * @IWL_UCODE_TLV_CAPA_COEX_SCHEMA_2: firmware implements Coex Schema 2
+ * IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD: firmware supports CSA command
  * @IWL_UCODE_TLV_CAPA_ULTRA_HB_CHANNELS: firmware supports ultra high band
  *      (6 GHz).
  * @IWL_UCODE_TLV_CAPA_EXTENDED_DTS_MEASURE: extended DTS measurement
@@ -363,12 +378,15 @@ typedef unsigned int __bitwise iwl_ucode_tlv_capa_t;
  *      capability.
  * @IWL_UCODE_TLV_CAPA_CSI_REPORTING: firmware is capable of being configured
  *      to report the CSI information with (certain) RX frames
+ * @IWL_UCODE_TLV_CAPA_FTM_CALIBRATED: has FTM calibrated and thus supports both
+ *      initiator and responder
  *
  * @IWL_UCODE_TLV_CAPA_MLME_OFFLOAD: supports MLME offload
  *
  * @NUM_IWL_UCODE_TLV_CAPA: number of bits used
  */
 enum iwl_ucode_tlv_capa {
+        /* set 0 */
         IWL_UCODE_TLV_CAPA_D0I3_SUPPORT                 = (__force iwl_ucode_tlv_capa_t)0,
         IWL_UCODE_TLV_CAPA_LAR_SUPPORT                  = (__force iwl_ucode_tlv_capa_t)1,
         IWL_UCODE_TLV_CAPA_UMAC_SCAN                    = (__force iwl_ucode_tlv_capa_t)2,
@@ -390,6 +408,8 @@ enum iwl_ucode_tlv_capa {
         IWL_UCODE_TLV_CAPA_LAR_MULTI_MCC                = (__force iwl_ucode_tlv_capa_t)29,
         IWL_UCODE_TLV_CAPA_BT_COEX_RRC                  = (__force iwl_ucode_tlv_capa_t)30,
         IWL_UCODE_TLV_CAPA_GSCAN_SUPPORT                = (__force iwl_ucode_tlv_capa_t)31,
+
+        /* set 1 */
         IWL_UCODE_TLV_CAPA_STA_PM_NOTIF                 = (__force iwl_ucode_tlv_capa_t)38,
         IWL_UCODE_TLV_CAPA_BINDING_CDB_SUPPORT          = (__force iwl_ucode_tlv_capa_t)39,
         IWL_UCODE_TLV_CAPA_CDB_SUPPORT                  = (__force iwl_ucode_tlv_capa_t)40,
@@ -397,7 +417,11 @@ enum iwl_ucode_tlv_capa {
         IWL_UCODE_TLV_CAPA_TLC_OFFLOAD                  = (__force iwl_ucode_tlv_capa_t)43,
         IWL_UCODE_TLV_CAPA_DYNAMIC_QUOTA                = (__force iwl_ucode_tlv_capa_t)44,
         IWL_UCODE_TLV_CAPA_COEX_SCHEMA_2                = (__force iwl_ucode_tlv_capa_t)45,
+        IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD           = (__force iwl_ucode_tlv_capa_t)46,
         IWL_UCODE_TLV_CAPA_ULTRA_HB_CHANNELS            = (__force iwl_ucode_tlv_capa_t)48,
+        IWL_UCODE_TLV_CAPA_FTM_CALIBRATED               = (__force iwl_ucode_tlv_capa_t)47,
+
+        /* set 2 */
         IWL_UCODE_TLV_CAPA_EXTENDED_DTS_MEASURE         = (__force iwl_ucode_tlv_capa_t)64,
         IWL_UCODE_TLV_CAPA_SHORT_PM_TIMEOUTS            = (__force iwl_ucode_tlv_capa_t)65,
         IWL_UCODE_TLV_CAPA_BT_MPLUT_SUPPORT             = (__force iwl_ucode_tlv_capa_t)67,
@@ -418,6 +442,7 @@ enum iwl_ucode_tlv_capa {
         IWL_UCODE_TLV_CAPA_MCC_UPDATE_11AX_SUPPORT      = (__force iwl_ucode_tlv_capa_t)89,
         IWL_UCODE_TLV_CAPA_CSI_REPORTING                = (__force iwl_ucode_tlv_capa_t)90,
 
+        /* set 3 */
         IWL_UCODE_TLV_CAPA_MLME_OFFLOAD                 = (__force iwl_ucode_tlv_capa_t)96,
 
         NUM_IWL_UCODE_TLV_CAPA
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/img.h b/drivers/net/wireless/intel/iwlwifi/fw/img.h
index 12333167ea23..f4c5a4d73206 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/img.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/img.h
@@ -105,6 +105,8 @@ struct iwl_ucode_capabilities {
         u32 n_scan_channels;
         u32 standard_phy_calibration_size;
         u32 flags;
+        u32 error_log_addr;
+        u32 error_log_size;
         unsigned long _api[BITS_TO_LONGS(NUM_IWL_UCODE_TLV_API)];
         unsigned long _capa[BITS_TO_LONGS(NUM_IWL_UCODE_TLV_CAPA)];
 };
@@ -223,27 +225,24 @@ struct iwl_fw_dbg {
 };
 
 /**
+ * @tlv: the buffer allocation tlv
+ * @is_alloc: indicates if the buffer was already allocated
+ */
+struct iwl_fw_ini_allocation_data {
+        struct iwl_fw_ini_allocation_tlv tlv;
+        u32 is_alloc;
+} __packed;
+
+/**
  * struct iwl_fw_ini_active_triggers
  * @active: is this trigger active
- * @apply_point: last apply point that updated this trigger
- * @conf: active trigger
- * @conf_ext: second trigger, contains extra regions to dump
+ * @size: allocated memory size of the trigger
+ * @trig: trigger
  */
 struct iwl_fw_ini_active_triggers {
         bool active;
-        enum iwl_fw_ini_apply_point apply_point;
-        struct iwl_fw_ini_trigger *conf;
-        struct iwl_fw_ini_trigger *conf_ext;
-};
-
-/**
- * struct iwl_fw_ini_active_regs
- * @reg: active region from TLV
- * @apply_point: apply point where it became active
- */
-struct iwl_fw_ini_active_regs {
-        struct iwl_fw_ini_region_cfg *reg;
-        enum iwl_fw_ini_apply_point apply_point;
+        size_t size;
+        struct iwl_fw_ini_trigger *trig;
 };
 
 /**
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/init.c b/drivers/net/wireless/intel/iwlwifi/fw/init.c
index 2efac307909e..7adf4e4e841a 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/init.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/init.c
@@ -6,6 +6,7 @@
  * GPL LICENSE SUMMARY
  *
  * Copyright(c) 2017 Intel Deutschland GmbH
+ * Copyright(c) 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -26,6 +27,7 @@
  * BSD LICENSE
  *
  * Copyright(c) 2017 Intel Deutschland GmbH
+ * Copyright(c) 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -74,6 +76,7 @@ void iwl_fw_runtime_init(struct iwl_fw_runtime *fwrt, struct iwl_trans *trans,
         fwrt->ops_ctx = ops_ctx;
         INIT_DELAYED_WORK(&fwrt->dump.wk, iwl_fw_error_dump_wk);
         iwl_fwrt_dbgfs_register(fwrt, dbgfs_dir);
+        init_waitqueue_head(&fwrt->trans->fw_halt_waitq);
 }
 IWL_EXPORT_SYMBOL(iwl_fw_runtime_init);
 
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/runtime.h b/drivers/net/wireless/intel/iwlwifi/fw/runtime.h
index a0fcbb28114b..a5fe1a8ca426 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/runtime.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/runtime.h
@@ -6,7 +6,7 @@
  * GPL LICENSE SUMMARY
  *
  * Copyright(c) 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright (C) 2018-2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -27,7 +27,7 @@
  * BSD LICENSE
  *
  * Copyright(c) 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright (C) 2018-2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -73,6 +73,7 @@ struct iwl_fw_runtime_ops {
         void (*dump_end)(void *ctx);
         bool (*fw_running)(void *ctx);
         int (*send_hcmd)(void *ctx, struct iwl_host_cmd *host_cmd);
+        bool (*d3_debug_enable)(void *ctx);
 };
 
 #define MAX_NUM_LMAC 2
@@ -90,7 +91,6 @@ struct iwl_fwrt_shared_mem_cfg {
 
 enum iwl_fw_runtime_status {
         IWL_FWRT_STATUS_DUMPING = 0,
-        IWL_FWRT_STATUS_WAIT_ALIVE,
 };
 
 /**
@@ -138,12 +138,13 @@ struct iwl_fw_runtime {
                 u8 conf;
 
                 /* ts of the beginning of a non-collect fw dbg data period */
-                unsigned long non_collect_ts_start[IWL_FW_TRIGGER_ID_NUM - 1];
+                unsigned long non_collect_ts_start[IWL_FW_TRIGGER_ID_NUM];
                 u32 *d3_debug_data;
-                struct iwl_fw_ini_active_regs active_regs[IWL_FW_INI_MAX_REGION_ID];
+                struct iwl_fw_ini_region_cfg *active_regs[IWL_FW_INI_MAX_REGION_ID];
                 struct iwl_fw_ini_active_triggers active_trigs[IWL_FW_TRIGGER_ID_NUM];
                 u32 lmac_err_id[MAX_NUM_LMAC];
                 u32 umac_err_id;
+                void *fifo_iter;
         } dump;
 #ifdef CONFIG_IWLWIFI_DEBUGFS
         struct {
@@ -161,8 +162,20 @@ void iwl_fw_runtime_init(struct iwl_fw_runtime *fwrt, struct iwl_trans *trans,
 
 static inline void iwl_fw_runtime_free(struct iwl_fw_runtime *fwrt)
 {
+        int i;
+
         kfree(fwrt->dump.d3_debug_data);
         fwrt->dump.d3_debug_data = NULL;
+
+        for (i = 0; i < IWL_FW_TRIGGER_ID_NUM; i++) {
+                struct iwl_fw_ini_active_triggers *active =
+                        &fwrt->dump.active_trigs[i];
+
+                active->active = false;
+                active->size = 0;
+                kfree(active->trig);
+                active->trig = NULL;
+        }
 }
 
 void iwl_fw_runtime_suspend(struct iwl_fw_runtime *fwrt);
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
index ff942532fac3..f5f87773667b 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
@@ -7,7 +7,7 @@
  *
  * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  * Copyright (C) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -29,7 +29,7 @@
  *
  * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * Copyright (C) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -89,6 +89,7 @@ enum iwl_device_family {
         IWL_DEVICE_FAMILY_9000,
         IWL_DEVICE_FAMILY_22000,
         IWL_DEVICE_FAMILY_22560,
+        IWL_DEVICE_FAMILY_AX210,
 };
 
 /*
@@ -379,6 +380,9 @@ struct iwl_csr_params {
  * @nvm_type: see &enum iwl_nvm_type
  * @d3_debug_data_base_addr: base address where D3 debug data is stored
  * @d3_debug_data_length: length of the D3 debug data
+ * @bisr_workaround: BISR hardware workaround (for 22260 series devices)
+ * @min_txq_size: minimum number of slots required in a TX queue
+ * @umac_prph_offset: offset to add to UMAC periphery address
  *
  * We enable the driver to be backward compatible wrt. hardware features.
  * API differences in uCode shouldn't be handled here but through TLVs
@@ -428,7 +432,8 @@ struct iwl_cfg {
             use_tfh:1,
             gen2:1,
             cdb:1,
-            dbgc_supported:1;
+            dbgc_supported:1,
+            bisr_workaround:1;
         u8 valid_tx_ant;
         u8 valid_rx_ant;
         u8 non_shared_ant;
@@ -443,37 +448,12 @@ struct iwl_cfg {
         u32 extra_phy_cfg_flags;
         u32 d3_debug_data_base_addr;
         u32 d3_debug_data_length;
+        u32 min_txq_size;
+        u32 umac_prph_offset;
 };
 
-static const struct iwl_csr_params iwl_csr_v1 = {
-        .flag_mac_clock_ready = 0,
-        .flag_val_mac_access_en = 0,
-        .flag_init_done = 2,
-        .flag_mac_access_req = 3,
-        .flag_sw_reset = 7,
-        .flag_master_dis = 8,
-        .flag_stop_master = 9,
-        .addr_sw_reset = (CSR_BASE + 0x020),
-        .mac_addr0_otp = 0x380,
-        .mac_addr1_otp = 0x384,
-        .mac_addr0_strap = 0x388,
-        .mac_addr1_strap = 0x38C
-};
-
-static const struct iwl_csr_params iwl_csr_v2 = {
-        .flag_init_done = 6,
-        .flag_mac_clock_ready = 20,
-        .flag_val_mac_access_en = 20,
-        .flag_mac_access_req = 21,
-        .flag_master_dis = 28,
-        .flag_stop_master = 29,
-        .flag_sw_reset = 31,
-        .addr_sw_reset = (CSR_BASE + 0x024),
-        .mac_addr0_otp = 0x30,
-        .mac_addr1_otp = 0x34,
-        .mac_addr0_strap = 0x38,
-        .mac_addr1_strap = 0x3C
-};
+extern const struct iwl_csr_params iwl_csr_v1;
+extern const struct iwl_csr_params iwl_csr_v2;
 
 /*
  * This list declares the config structures for all devices.
@@ -568,7 +548,7 @@ extern const struct iwl_cfg iwl9560_killer_s_2ac_cfg_shared_clk;
 extern const struct iwl_cfg iwl22000_2ac_cfg_hr;
 extern const struct iwl_cfg iwl22000_2ac_cfg_hr_cdb;
 extern const struct iwl_cfg iwl22000_2ac_cfg_jf;
-extern const struct iwl_cfg iwl22560_2ax_cfg_hr;
+extern const struct iwl_cfg iwl_ax101_cfg_qu_hr;
 extern const struct iwl_cfg iwl22000_2ax_cfg_hr;
 extern const struct iwl_cfg iwl22260_2ax_cfg;
 extern const struct iwl_cfg killer1650s_2ax_cfg_qu_b0_hr_b0;
@@ -585,9 +565,13 @@ extern const struct iwl_cfg iwl22000_2ax_cfg_jf;
 extern const struct iwl_cfg iwl22000_2ax_cfg_qnj_hr_a0_f0;
 extern const struct iwl_cfg iwl22000_2ax_cfg_qnj_hr_b0_f0;
 extern const struct iwl_cfg iwl22000_2ax_cfg_qnj_hr_b0;
-extern const struct iwl_cfg iwl22000_2ax_cfg_qnj_jf_b0;
+extern const struct iwl_cfg iwl9560_2ac_cfg_qnj_jf_b0;
 extern const struct iwl_cfg iwl22000_2ax_cfg_qnj_hr_a0;
 extern const struct iwl_cfg iwl22560_2ax_cfg_su_cdb;
+extern const struct iwl_cfg iwlax210_2ax_cfg_so_jf_a0;
+extern const struct iwl_cfg iwlax210_2ax_cfg_so_hr_a0;
+extern const struct iwl_cfg iwlax210_2ax_cfg_so_gf_a0;
+extern const struct iwl_cfg iwlax210_2ax_cfg_ty_gf_a0;
 #endif /* CPTCFG_IWLMVM || CPTCFG_IWLFMAC */
 
 #endif /* __IWL_CONFIG_H__ */
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-csr.h b/drivers/net/wireless/intel/iwlwifi/iwl-csr.h
index 42af421bbc3c..aea6d03e545a 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-csr.h
@@ -180,6 +180,7 @@
 /* Bits for CSR_HW_IF_CONFIG_REG */
 #define CSR_HW_IF_CONFIG_REG_MSK_MAC_DASH       (0x00000003)
 #define CSR_HW_IF_CONFIG_REG_MSK_MAC_STEP       (0x0000000C)
+#define CSR_HW_IF_CONFIG_REG_BIT_MONITOR_SRAM   (0x00000080)
 #define CSR_HW_IF_CONFIG_REG_MSK_BOARD_VER      (0x000000C0)
 #define CSR_HW_IF_CONFIG_REG_BIT_MAC_SI         (0x00000100)
 #define CSR_HW_IF_CONFIG_REG_BIT_RADIO_SI       (0x00000200)
@@ -327,11 +328,14 @@ enum {
 #define CSR_HW_REV_TYPE_QNJ             (0x0000360)
 #define CSR_HW_REV_TYPE_QNJ_B0          (0x0000364)
 #define CSR_HW_REV_TYPE_HR_CDB          (0x0000340)
+#define CSR_HW_REV_TYPE_SO              (0x0000370)
+#define CSR_HW_REV_TYPE_TY              (0x0000420)
 
 /* RF_ID value */
 #define CSR_HW_RF_ID_TYPE_JF            (0x00105100)
 #define CSR_HW_RF_ID_TYPE_HR            (0x0010A000)
 #define CSR_HW_RF_ID_TYPE_HRCDB         (0x00109F00)
+#define CSR_HW_RF_ID_TYPE_GF            (0x0010D000)
 
 /* HW_RF CHIP ID  */
 #define CSR_HW_RF_ID_TYPE_CHIP_ID(_val) (((_val) >> 12) & 0xFFF)
@@ -593,6 +597,7 @@ enum msix_hw_int_causes {
         MSIX_HW_INT_CAUSES_REG_ALIVE            = BIT(0),
         MSIX_HW_INT_CAUSES_REG_WAKEUP           = BIT(1),
         MSIX_HW_INT_CAUSES_REG_IPC              = BIT(1),
+        MSIX_HW_INT_CAUSES_REG_IML              = BIT(2),
         MSIX_HW_INT_CAUSES_REG_SW_ERR_V2        = BIT(5),
         MSIX_HW_INT_CAUSES_REG_CT_KILL          = BIT(6),
         MSIX_HW_INT_CAUSES_REG_RF_KILL          = BIT(7),
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
index 43d815cb3ce9..5798f434f68f 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
@@ -71,6 +71,7 @@ void iwl_fw_dbg_copy_tlv(struct iwl_trans *trans, struct iwl_ucode_tlv *tlv,
         u32 apply_point = le32_to_cpu(header->apply_point);
 
         int copy_size = le32_to_cpu(tlv->length) + sizeof(*tlv);
+        int offset_size = copy_size;
 
         if (WARN_ONCE(apply_point >= IWL_FW_INI_APPLY_NUM,
                       "Invalid apply point id %d\n", apply_point))
@@ -81,17 +82,25 @@ void iwl_fw_dbg_copy_tlv(struct iwl_trans *trans, struct iwl_ucode_tlv *tlv,
         else
                 data = &trans->apply_points[apply_point];
 
+        /* add room for is_alloc field in &iwl_fw_ini_allocation_data struct */
+        if (le32_to_cpu(tlv->type) == IWL_UCODE_TLV_TYPE_BUFFER_ALLOCATION) {
+                struct iwl_fw_ini_allocation_data *buf_alloc =
+                        (void *)tlv->data;
+
+                offset_size += sizeof(buf_alloc->is_alloc);
+        }
+
         /*
          * Make sure we still have room to copy this TLV. Offset points to the
          * location the last copy ended.
          */
-        if (WARN_ONCE(data->offset + copy_size > data->size,
+        if (WARN_ONCE(data->offset + offset_size > data->size,
                       "Not enough memory for apply point %d\n",
                       apply_point))
                 return;
 
         memcpy(data->data + data->offset, (void *)tlv, copy_size);
-        data->offset += copy_size;
+        data->offset += offset_size;
 }
 
 void iwl_alloc_dbg_tlv(struct iwl_trans *trans, size_t len, const u8 *data,
@@ -129,6 +138,16 @@ void iwl_alloc_dbg_tlv(struct iwl_trans *trans, size_t len, const u8 *data,
                 if (WARN_ON(apply >= IWL_FW_INI_APPLY_NUM))
                         continue;
 
+                /* add room for is_alloc field in &iwl_fw_ini_allocation_data
+                 * struct
+                 */
+                if (tlv_type == IWL_UCODE_TLV_TYPE_BUFFER_ALLOCATION) {
+                        struct iwl_fw_ini_allocation_data *buf_alloc =
+                                (void *)tlv->data;
+
+                        size[apply] += sizeof(buf_alloc->is_alloc);
+                }
+
                 size[apply] += sizeof(*tlv) + tlv_len;
         }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-debug.h b/drivers/net/wireless/intel/iwlwifi/iwl-debug.h
index a2af68a0d34b..655ff5694560 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-debug.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-debug.h
@@ -1,6 +1,7 @@
 /******************************************************************************
  *
  * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
+ * Copyright (C) 2018 Intel Corporation
  *
  * Portions of this file are derived from the ipw3945 project.
  *
@@ -159,7 +160,7 @@ do {                                            			\
 /* 0x000F0000 - 0x00010000 */
 #define IWL_DL_FW               0x00010000
 #define IWL_DL_RF_KILL          0x00020000
-#define IWL_DL_FW_ERRORS        0x00040000
+#define IWL_DL_TPT              0x00040000
 /* 0x00F00000 - 0x00100000 */
 #define IWL_DL_RATE             0x00100000
 #define IWL_DL_CALIB            0x00200000
@@ -193,7 +194,6 @@ do {                                            			\
 #define IWL_DEBUG_CALIB(p, f, a...)     IWL_DEBUG(p, IWL_DL_CALIB, f, ## a)
 #define IWL_DEBUG_FW(p, f, a...)        IWL_DEBUG(p, IWL_DL_FW, f, ## a)
 #define IWL_DEBUG_RF_KILL(p, f, a...)   IWL_DEBUG(p, IWL_DL_RF_KILL, f, ## a)
-#define IWL_DEBUG_FW_ERRORS(p, f, a...) IWL_DEBUG(p, IWL_DL_FW_ERRORS, f, ## a)
 #define IWL_DEBUG_DROP(p, f, a...)      IWL_DEBUG(p, IWL_DL_DROP, f, ## a)
 #define IWL_DEBUG_DROP_LIMIT(p, f, a...)        \
                 IWL_DEBUG_LIMIT(p, IWL_DL_DROP, f, ## a)
@@ -215,6 +215,7 @@ do {                                            			\
 #define IWL_DEBUG_DEV_RADIO(p, f, a...) IWL_DEBUG_DEV(p, IWL_DL_RADIO, f, ## a)
 #define IWL_DEBUG_POWER(p, f, a...)     IWL_DEBUG(p, IWL_DL_POWER, f, ## a)
 #define IWL_DEBUG_11H(p, f, a...)       IWL_DEBUG(p, IWL_DL_11H, f, ## a)
+#define IWL_DEBUG_TPT(p, f, a...)       IWL_DEBUG(p, IWL_DL_TPT, f, ## a)
 #define IWL_DEBUG_RPM(p, f, a...)       IWL_DEBUG(p, IWL_DL_RPM, f, ## a)
 #define IWL_DEBUG_LAR(p, f, a...)       IWL_DEBUG(p, IWL_DL_LAR, f, ## a)
 
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
index 2efa1dfe9b4c..689a65b11cc3 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
@@ -8,6 +8,7 @@
  * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,6 +31,7 @@
  * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -75,6 +77,7 @@
 #include "iwl-dbg-tlv.h"
 #include "iwl-config.h"
 #include "iwl-modparams.h"
+#include "fw/api/alive.h"
 
 /******************************************************************************
  *
@@ -588,6 +591,8 @@ static int iwl_parse_v1_v2_firmware(struct iwl_drv *drv,
         return 0;
 }
 
+#define FW_ADDR_CACHE_CONTROL 0xC0000000
+
 static int iwl_parse_tlv_firmware(struct iwl_drv *drv,
                                 const struct firmware *ucode_raw,
                                 struct iwl_firmware_pieces *pieces,
@@ -1085,6 +1090,52 @@ static int iwl_parse_tlv_firmware(struct iwl_drv *drv,
                                 return -ENOMEM;
                         break;
                         }
+                case IWL_UCODE_TLV_FW_RECOVERY_INFO: {
+                        struct {
+                                __le32 buf_addr;
+                                __le32 buf_size;
+                        } *recov_info = (void *)tlv_data;
+
+                        if (tlv_len != sizeof(*recov_info))
+                                goto invalid_tlv_len;
+                        capa->error_log_addr =
+                                le32_to_cpu(recov_info->buf_addr);
+                        capa->error_log_size =
+                                le32_to_cpu(recov_info->buf_size);
+                        }
+                        break;
+                case IWL_UCODE_TLV_UMAC_DEBUG_ADDRS: {
+                        struct iwl_umac_debug_addrs *dbg_ptrs =
+                                (void *)tlv_data;
+
+                        if (tlv_len != sizeof(*dbg_ptrs))
+                                goto invalid_tlv_len;
+                        if (drv->trans->cfg->device_family <
+                            IWL_DEVICE_FAMILY_22000)
+                                break;
+                        drv->trans->umac_error_event_table =
+                                le32_to_cpu(dbg_ptrs->error_info_addr) &
+                                ~FW_ADDR_CACHE_CONTROL;
+                        drv->trans->error_event_table_tlv_status |=
+                                IWL_ERROR_EVENT_TABLE_UMAC;
+                        break;
+                        }
+                case IWL_UCODE_TLV_LMAC_DEBUG_ADDRS: {
+                        struct iwl_lmac_debug_addrs *dbg_ptrs =
+                                (void *)tlv_data;
+
+                        if (tlv_len != sizeof(*dbg_ptrs))
+                                goto invalid_tlv_len;
+                        if (drv->trans->cfg->device_family <
+                            IWL_DEVICE_FAMILY_22000)
+                                break;
+                        drv->trans->lmac_error_event_table[0] =
+                                le32_to_cpu(dbg_ptrs->error_event_table_ptr) &
+                                ~FW_ADDR_CACHE_CONTROL;
+                        drv->trans->error_event_table_tlv_status |=
+                                IWL_ERROR_EVENT_TABLE_LMAC1;
+                        break;
+                        }
                 case IWL_UCODE_TLV_TYPE_BUFFER_ALLOCATION:
                 case IWL_UCODE_TLV_TYPE_HCMD:
                 case IWL_UCODE_TLV_TYPE_REGIONS:
@@ -1202,11 +1253,6 @@ _iwl_op_mode_start(struct iwl_drv *drv, struct iwlwifi_opmode_table *op)
 #ifdef CONFIG_IWLWIFI_DEBUGFS
         drv->dbgfs_op_mode = debugfs_create_dir(op->name,
                                                 drv->dbgfs_drv);
-        if (!drv->dbgfs_op_mode) {
-                IWL_ERR(drv,
-                        "failed to create opmode debugfs directory\n");
-                return op_mode;
-        }
         dbgfs_dir = drv->dbgfs_op_mode;
 #endif
 
@@ -1262,8 +1308,8 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context)
         fw->ucode_capa.standard_phy_calibration_size =
                         IWL_DEFAULT_STANDARD_PHY_CALIBRATE_TBL_SIZE;
         fw->ucode_capa.n_scan_channels = IWL_DEFAULT_SCAN_CHANNELS;
-        /* dump all fw memory areas by default except d3 debug data */
-        fw->dbg.dump_mask = 0xfffdffff;
+        /* dump all fw memory areas by default */
+        fw->dbg.dump_mask = 0xffffffff;
 
         pieces = kzalloc(sizeof(*pieces), GFP_KERNEL);
         if (!pieces)
@@ -1569,20 +1615,8 @@ struct iwl_drv *iwl_drv_start(struct iwl_trans *trans)
         drv->dbgfs_drv = debugfs_create_dir(dev_name(trans->dev),
                                             iwl_dbgfs_root);
 
-        if (!drv->dbgfs_drv) {
-                IWL_ERR(drv, "failed to create debugfs directory\n");
-                ret = -ENOMEM;
-                goto err_free_tlv;
-        }
-
         /* Create transport layer debugfs dir */
         drv->trans->dbgfs_dir = debugfs_create_dir("trans", drv->dbgfs_drv);
-
-        if (!drv->trans->dbgfs_dir) {
-                IWL_ERR(drv, "failed to create transport debugfs directory\n");
-                ret = -ENOMEM;
-                goto err_free_dbgfs;
-        }
 #endif
 
         ret = iwl_request_firmware(drv, true);
@@ -1595,9 +1629,7 @@ struct iwl_drv *iwl_drv_start(struct iwl_trans *trans)
 
 err_fw:
 #ifdef CONFIG_IWLWIFI_DEBUGFS
-err_free_dbgfs:
         debugfs_remove_recursive(drv->dbgfs_drv);
-err_free_tlv:
         iwl_fw_dbg_free(drv->trans);
 #endif
         kfree(drv);
@@ -1708,9 +1740,6 @@ static int __init iwl_drv_init(void)
 #ifdef CONFIG_IWLWIFI_DEBUGFS
         /* Create the root of iwlwifi debugfs subsystem. */
         iwl_dbgfs_root = debugfs_create_dir(DRV_NAME, NULL);
-
-        if (!iwl_dbgfs_root)
-                return -EFAULT;
 #endif
 
         return iwl_pci_register_driver();
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c
index 75940ac406b9..04338c3a6205 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c
@@ -850,8 +850,7 @@ iwl_parse_eeprom_data(struct device *dev, const struct iwl_cfg *cfg,
         if (WARN_ON(!cfg || !cfg->eeprom_params))
                 return NULL;
 
-        data = kzalloc(sizeof(*data) +
-                       sizeof(struct ieee80211_channel) * IWL_NUM_CHANNELS,
+        data = kzalloc(struct_size(data, channels, IWL_NUM_CHANNELS),
                        GFP_KERNEL);
         if (!data)
                 return NULL;
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-read.c b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-read.c
index a6db6a814257..82e87192119e 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-read.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-read.c
@@ -193,34 +193,25 @@ static int iwl_init_otp_access(struct iwl_trans *trans)
 {
         int ret;
 
-        /* Enable 40MHz radio clock */
-        iwl_write32(trans, CSR_GP_CNTRL,
-                    iwl_read32(trans, CSR_GP_CNTRL) |
-                    BIT(trans->cfg->csr->flag_init_done));
-
-        /* wait for clock to be ready */
-        ret = iwl_poll_bit(trans, CSR_GP_CNTRL,
-                           BIT(trans->cfg->csr->flag_mac_clock_ready),
-                           BIT(trans->cfg->csr->flag_mac_clock_ready),
-                           25000);
-        if (ret < 0) {
-                IWL_ERR(trans, "Time out access OTP\n");
-        } else {
-                iwl_set_bits_prph(trans, APMG_PS_CTRL_REG,
-                                  APMG_PS_CTRL_VAL_RESET_REQ);
-                udelay(5);
-                iwl_clear_bits_prph(trans, APMG_PS_CTRL_REG,
-                                    APMG_PS_CTRL_VAL_RESET_REQ);
-
-                /*
-                 * CSR auto clock gate disable bit -
-                 * this is only applicable for HW with OTP shadow RAM
-                 */
-                if (trans->cfg->base_params->shadow_ram_support)
-                        iwl_set_bit(trans, CSR_DBG_LINK_PWR_MGMT_REG,
-                                    CSR_RESET_LINK_PWR_MGMT_DISABLED);
-        }
-        return ret;
+        ret = iwl_finish_nic_init(trans);
+        if (ret)
+                return ret;
+
+        iwl_set_bits_prph(trans, APMG_PS_CTRL_REG,
+                          APMG_PS_CTRL_VAL_RESET_REQ);
+        udelay(5);
+        iwl_clear_bits_prph(trans, APMG_PS_CTRL_REG,
+                            APMG_PS_CTRL_VAL_RESET_REQ);
+
+        /*
+         * CSR auto clock gate disable bit -
+         * this is only applicable for HW with OTP shadow RAM
+         */
+        if (trans->cfg->base_params->shadow_ram_support)
+                iwl_set_bit(trans, CSR_DBG_LINK_PWR_MGMT_REG,
+                            CSR_RESET_LINK_PWR_MGMT_DISABLED);
+
+        return 0;
 }
 
 static int iwl_read_otp_word(struct iwl_trans *trans, u16 addr,
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-io.c b/drivers/net/wireless/intel/iwlwifi/iwl-io.c
index ffd1e649bfa0..a704e25af810 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-io.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-io.c
@@ -7,6 +7,7 @@
  *
  * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2015 - 2016 Intel Deutschland GmbH
+ * Copyright(C) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -28,6 +29,7 @@
  *
  * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2015 - 2016 Intel Deutschland GmbH
+ * Copyright (C) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -68,6 +70,36 @@
 #include "iwl-prph.h"
 #include "iwl-fh.h"
 
+const struct iwl_csr_params iwl_csr_v1 = {
+        .flag_mac_clock_ready = 0,
+        .flag_val_mac_access_en = 0,
+        .flag_init_done = 2,
+        .flag_mac_access_req = 3,
+        .flag_sw_reset = 7,
+        .flag_master_dis = 8,
+        .flag_stop_master = 9,
+        .addr_sw_reset = CSR_BASE + 0x020,
+        .mac_addr0_otp = 0x380,
+        .mac_addr1_otp = 0x384,
+        .mac_addr0_strap = 0x388,
+        .mac_addr1_strap = 0x38C
+};
+
+const struct iwl_csr_params iwl_csr_v2 = {
+        .flag_init_done = 6,
+        .flag_mac_clock_ready = 20,
+        .flag_val_mac_access_en = 20,
+        .flag_mac_access_req = 21,
+        .flag_master_dis = 28,
+        .flag_stop_master = 29,
+        .flag_sw_reset = 31,
+        .addr_sw_reset = CSR_BASE + 0x024,
+        .mac_addr0_otp = 0x30,
+        .mac_addr1_otp = 0x34,
+        .mac_addr0_strap = 0x38,
+        .mac_addr1_strap = 0x3C
+};
+
 void iwl_write8(struct iwl_trans *trans, u32 ofs, u8 val)
 {
         trace_iwlwifi_dev_iowrite8(trans->dev, ofs, val);
@@ -275,9 +307,12 @@ void iwl_force_nmi(struct iwl_trans *trans)
         if (trans->cfg->device_family < IWL_DEVICE_FAMILY_9000)
                 iwl_write_prph(trans, DEVICE_SET_NMI_REG,
                                DEVICE_SET_NMI_VAL_DRV);
+        else if (trans->cfg->device_family < IWL_DEVICE_FAMILY_AX210)
+                iwl_write_umac_prph(trans, UREG_NIC_SET_NMI_DRIVER,
+                                UREG_NIC_SET_NMI_DRIVER_NMI_FROM_DRIVER_MSK);
         else
-                iwl_write_prph(trans, UREG_NIC_SET_NMI_DRIVER,
-                               UREG_NIC_SET_NMI_DRIVER_NMI_FROM_DRIVER_MSK);
+                iwl_write_umac_prph(trans, UREG_DOORBELL_TO_ISR6,
+                                    UREG_DOORBELL_TO_ISR6_NMI_BIT);
 }
 IWL_EXPORT_SYMBOL(iwl_force_nmi);
 
@@ -456,3 +491,43 @@ int iwl_dump_fh(struct iwl_trans *trans, char **buf)
 
         return 0;
 }
+
+int iwl_finish_nic_init(struct iwl_trans *trans)
+{
+        int err;
+
+        if (trans->cfg->bisr_workaround) {
+                /* ensure the TOP FSM isn't still in previous reset */
+                mdelay(2);
+        }
+
+        /*
+         * Set "initialization complete" bit to move adapter from
+         * D0U* --> D0A* (powered-up active) state.
+         */
+        iwl_set_bit(trans, CSR_GP_CNTRL,
+                    BIT(trans->cfg->csr->flag_init_done));
+
+        if (trans->cfg->device_family == IWL_DEVICE_FAMILY_8000)
+                udelay(2);
+
+        /*
+         * Wait for clock stabilization; once stabilized, access to
+         * device-internal resources is supported, e.g. iwl_write_prph()
+         * and accesses to uCode SRAM.
+         */
+        err = iwl_poll_bit(trans, CSR_GP_CNTRL,
+                           BIT(trans->cfg->csr->flag_mac_clock_ready),
+                           BIT(trans->cfg->csr->flag_mac_clock_ready),
+                           25000);
+        if (err < 0)
+                IWL_DEBUG_INFO(trans, "Failed to wake NIC\n");
+
+        if (trans->cfg->bisr_workaround) {
+                /* ensure BISR shift has finished */
+                udelay(200);
+        }
+
+        return err < 0 ? err : 0;
+}
+IWL_EXPORT_SYMBOL(iwl_finish_nic_init);
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-io.h b/drivers/net/wireless/intel/iwlwifi/iwl-io.h
index 61477e58352d..920e2146ea3f 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-io.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-io.h
@@ -5,6 +5,8 @@
  *
  * GPL LICENSE SUMMARY
  *
+ * Copyright (C) 2018 - 2019 Intel Corporation
+ *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
  * published by the Free Software Foundation.
@@ -23,6 +25,7 @@
  *
  * BSD LICENSE
  *
+ * Copyright (C) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -96,7 +99,48 @@ void iwl_set_bits_mask_prph(struct iwl_trans *trans, u32 ofs,
 void iwl_clear_bits_prph(struct iwl_trans *trans, u32 ofs, u32 mask);
 void iwl_force_nmi(struct iwl_trans *trans);
 
+int iwl_finish_nic_init(struct iwl_trans *trans);
+
 /* Error handling */
 int iwl_dump_fh(struct iwl_trans *trans, char **buf);
 
+/*
+ * UMAC periphery address space changed from 0xA00000 to 0xD00000 starting from
+ * device family AX200. So peripheries used in families above and below AX200
+ * should go through iwl_..._umac_..._prph.
+ */
+static inline u32 iwl_umac_prph(struct iwl_trans *trans, u32 ofs)
+{
+        return ofs + trans->cfg->umac_prph_offset;
+}
+
+static inline u32 iwl_read_umac_prph_no_grab(struct iwl_trans *trans, u32 ofs)
+{
+        return iwl_read_prph_no_grab(trans, ofs + trans->cfg->umac_prph_offset);
+}
+
+static inline u32 iwl_read_umac_prph(struct iwl_trans *trans, u32 ofs)
+{
+        return iwl_read_prph(trans, ofs + trans->cfg->umac_prph_offset);
+}
+
+static inline void iwl_write_umac_prph_no_grab(struct iwl_trans *trans, u32 ofs,
+                                               u32 val)
+{
+        iwl_write_prph_no_grab(trans,  ofs + trans->cfg->umac_prph_offset, val);
+}
+
+static inline void iwl_write_umac_prph(struct iwl_trans *trans, u32 ofs,
+                                       u32 val)
+{
+        iwl_write_prph(trans,  ofs + trans->cfg->umac_prph_offset, val);
+}
+
+static inline int iwl_poll_umac_prph_bit(struct iwl_trans *trans, u32 addr,
+                                         u32 bits, u32 mask, int timeout)
+{
+        return iwl_poll_prph_bit(trans, addr + trans->cfg->umac_prph_offset,
+                                 bits, mask, timeout);
+}
+
 #endif
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
index 63c081e5c63a..87d6de7efdd2 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
@@ -8,7 +8,7 @@
  * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
  * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -463,6 +463,9 @@ static void iwl_init_vht_hw_capab(const struct iwl_cfg *cfg,
         }
 
         vht_cap->vht_mcs.tx_mcs_map = vht_cap->vht_mcs.rx_mcs_map;
+
+        vht_cap->vht_mcs.tx_highest |=
+                cpu_to_le16(IEEE80211_VHT_EXT_NSS_BW_CAPABLE);
 }
 
 static struct ieee80211_sband_iftype_data iwl_he_capa[] = {
@@ -930,15 +933,13 @@ iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         const __le16 *ch_section;
 
         if (cfg->nvm_type != IWL_NVM_EXT)
-                data = kzalloc(sizeof(*data) +
-                               sizeof(struct ieee80211_channel) *
-                               IWL_NVM_NUM_CHANNELS,
-                               GFP_KERNEL);
+                data = kzalloc(struct_size(data, channels,
+                                           IWL_NVM_NUM_CHANNELS),
+                                           GFP_KERNEL);
         else
-                data = kzalloc(sizeof(*data) +
-                               sizeof(struct ieee80211_channel) *
-                               IWL_NVM_NUM_CHANNELS_EXT,
-                               GFP_KERNEL);
+                data = kzalloc(struct_size(data, channels,
+                                           IWL_NVM_NUM_CHANNELS_EXT),
+                                           GFP_KERNEL);
         if (!data)
                 return NULL;
 
@@ -1086,12 +1087,12 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
         int max_num_ch = cfg->nvm_type == IWL_NVM_EXT ?
                          IWL_NVM_NUM_CHANNELS_EXT : IWL_NVM_NUM_CHANNELS;
 
-        if (WARN_ON_ONCE(num_of_ch > NL80211_MAX_SUPP_REG_RULES))
-                return ERR_PTR(-EINVAL);
-
         if (WARN_ON(num_of_ch > max_num_ch))
                 num_of_ch = max_num_ch;
 
+        if (WARN_ON_ONCE(num_of_ch > NL80211_MAX_SUPP_REG_RULES))
+                return ERR_PTR(-EINVAL);
+
         IWL_DEBUG_DEV(dev, IWL_DL_LAR, "building regdom for %d channels\n",
                       num_of_ch);
 
@@ -1425,9 +1426,7 @@ struct iwl_nvm_data *iwl_get_nvm(struct iwl_trans *trans,
         if (empty_otp)
                 IWL_INFO(trans, "OTP is empty\n");
 
-        nvm = kzalloc(sizeof(*nvm) +
-                      sizeof(struct ieee80211_channel) * IWL_NUM_CHANNELS,
-                      GFP_KERNEL);
+        nvm = kzalloc(struct_size(nvm, channels, IWL_NUM_CHANNELS), GFP_KERNEL);
         if (!nvm) {
                 ret = -ENOMEM;
                 goto out;
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
index 3aaa5f06461c..1af9f9e1ecd4 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
@@ -8,7 +8,7 @@
  * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
  * Copyright(c) 2016        Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
  * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
  * Copyright(c) 2016        Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -433,4 +433,7 @@ enum {
 #define HPM_DEBUG                       0xA03440
 #define PERSISTENCE_BIT                 BIT(12)
 #define PREG_WFPM_ACCESS                BIT(12)
+
+#define UREG_DOORBELL_TO_ISR6           0xA05C04
+#define UREG_DOORBELL_TO_ISR6_NMI_BIT   BIT(0)
 #endif                          /* __iwl_prph_h__ */
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
index a7009cd4232d..bbebbf3efd57 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
@@ -8,6 +8,7 @@
  * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,6 +31,7 @@
  * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -230,6 +232,12 @@ enum iwl_hcmd_dataflag {
         IWL_HCMD_DFL_DUP        = BIT(1),
 };
 
+enum iwl_error_event_table_status {
+        IWL_ERROR_EVENT_TABLE_LMAC1 = BIT(0),
+        IWL_ERROR_EVENT_TABLE_LMAC2 = BIT(1),
+        IWL_ERROR_EVENT_TABLE_UMAC = BIT(2),
+};
+
 /**
  * struct iwl_host_cmd - Host command to the uCode
  *
@@ -330,6 +338,7 @@ enum iwl_d3_status {
  *      are sent
  * @STATUS_TRANS_IDLE: the trans is idle - general commands are not to be sent
  * @STATUS_TRANS_DEAD: trans is dead - avoid any read/write operation
+ * @STATUS_FW_WAIT_DUMP: if set, wait until cleared before collecting dump
  */
 enum iwl_trans_status {
         STATUS_SYNC_HCMD_ACTIVE,
@@ -342,6 +351,7 @@ enum iwl_trans_status {
         STATUS_TRANS_GOING_IDLE,
         STATUS_TRANS_IDLE,
         STATUS_TRANS_DEAD,
+        STATUS_FW_WAIT_DUMP,
 };
 
 static inline int
@@ -684,6 +694,9 @@ enum iwl_plat_pm_mode {
  */
 #define IWL_TRANS_IDLE_TIMEOUT 2000
 
+/* Max time to wait for nmi interrupt */
+#define IWL_TRANS_NMI_TIMEOUT (HZ / 4)
+
 /**
  * struct iwl_dram_data
  * @physical: page phy pointer
@@ -697,6 +710,20 @@ struct iwl_dram_data {
 };
 
 /**
+ * struct iwl_self_init_dram - dram data used by self init process
+ * @fw: lmac and umac dram data
+ * @fw_cnt: total number of items in array
+ * @paging: paging dram data
+ * @paging_cnt: total number of items in array
+ */
+struct iwl_self_init_dram {
+        struct iwl_dram_data *fw;
+        int fw_cnt;
+        struct iwl_dram_data *paging;
+        int paging_cnt;
+};
+
+/**
  * struct iwl_trans - transport common data
  *
  * @ops - pointer to iwl_trans_ops
@@ -738,6 +765,10 @@ struct iwl_dram_data {
  *      mode is set during the initialization phase and is not
  *      supposed to change during runtime.
  * @dbg_rec_on: true iff there is a fw debug recording currently active
+ * @lmac_error_event_table: addrs of lmacs error tables
+ * @umac_error_event_table: addr of umac error table
+ * @error_event_table_tlv_status: bitmap that indicates what error table
+ *      pointers was recevied via TLV. use enum &iwl_error_event_table_status
  */
 struct iwl_trans {
         const struct iwl_trans_ops *ops;
@@ -790,12 +821,18 @@ struct iwl_trans {
         u8 dbg_n_dest_reg;
         int num_blocks;
         struct iwl_dram_data fw_mon[IWL_FW_INI_APPLY_NUM];
+        struct iwl_self_init_dram init_dram;
 
         enum iwl_plat_pm_mode system_pm_mode;
         enum iwl_plat_pm_mode runtime_pm_mode;
         bool suspending;
         bool dbg_rec_on;
 
+        u32 lmac_error_event_table[2];
+        u32 umac_error_event_table;
+        unsigned int error_event_table_tlv_status;
+        wait_queue_head_t fw_halt_waitq;
+
         /* pointer to trans specific struct */
         /*Ensure that this pointer will always be aligned to sizeof pointer */
         char trans_specific[0] __aligned(sizeof(void *));
@@ -1202,6 +1239,10 @@ static inline void iwl_trans_fw_error(struct iwl_trans *trans)
         /* prevent double restarts due to the same erroneous FW */
         if (!test_and_set_bit(STATUS_FW_ERROR, &trans->status))
                 iwl_op_mode_nic_error(trans->op_mode);
+
+        if (test_and_clear_bit(STATUS_FW_WAIT_DUMP, &trans->status))
+                wake_up(&trans->fw_halt_waitq);
+
 }
 
 /*****************************************************
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/Makefile b/drivers/net/wireless/intel/iwlwifi/mvm/Makefile
index 30cbd981efbd..dd268c4bd371 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/Makefile
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/Makefile
@@ -5,6 +5,7 @@ iwlmvm-y += utils.o rx.o rxmq.o tx.o binding.o quota.o sta.o sf.o
 iwlmvm-y += scan.o time-event.o rs.o rs-fw.o
 iwlmvm-y += power.o coex.o
 iwlmvm-y += tt.o offloading.o tdls.o
+iwlmvm-y += ftm-responder.o ftm-initiator.o
 iwlmvm-$(CONFIG_IWLWIFI_DEBUGFS) += debugfs.o debugfs-vif.o
 iwlmvm-$(CONFIG_IWLWIFI_LEDS) += led.o
 iwlmvm-$(CONFIG_PM) += d3.o
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/coex.c b/drivers/net/wireless/intel/iwlwifi/mvm/coex.c
index 730e37744dc0..3d2abbc5c76c 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/coex.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/coex.c
@@ -241,7 +241,6 @@ static int iwl_mvm_bt_coex_reduced_txp(struct iwl_mvm *mvm, u8 sta_id,
         struct iwl_bt_coex_reduced_txp_update_cmd cmd = {};
         struct iwl_mvm_sta *mvmsta;
         u32 value;
-        int ret;
 
         mvmsta = iwl_mvm_sta_from_staid_protected(mvm, sta_id);
         if (!mvmsta)
@@ -262,10 +261,8 @@ static int iwl_mvm_bt_coex_reduced_txp(struct iwl_mvm *mvm, u8 sta_id,
         cmd.reduced_txp = cpu_to_le32(value);
         mvmsta->bt_reduced_txpower = enable;
 
-        ret = iwl_mvm_send_cmd_pdu(mvm, BT_COEX_UPDATE_REDUCED_TXP, CMD_ASYNC,
-                                   sizeof(cmd), &cmd);
-
-        return ret;
+        return iwl_mvm_send_cmd_pdu(mvm, BT_COEX_UPDATE_REDUCED_TXP,
+                                    CMD_ASYNC, sizeof(cmd), &cmd);
 }
 
 struct iwl_bt_iterator_data {
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/constants.h b/drivers/net/wireless/intel/iwlwifi/mvm/constants.h
index d96ada3c06fc..dff14f1ec55f 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/constants.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/constants.h
@@ -8,6 +8,7 @@
  * Copyright(c) 2013 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2015        Intel Deutschland GmbH
+ * Copyright(c) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,6 +31,7 @@
  * Copyright(c) 2013 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2015        Intel Deutschland GmbH
+ * Copyright(c) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -63,6 +65,7 @@
 #define __MVM_CONSTANTS_H
 
 #include <linux/ieee80211.h>
+#include "fw-api.h"
 
 #define IWL_MVM_UAPSD_NOAGG_BSSIDS_NUM          20
 
@@ -114,6 +117,7 @@
 #define IWL_MVM_TCM_LOWLAT_ENABLE_THRESH        100 /* packets/10 seconds */
 #define IWL_MVM_UAPSD_NONAGG_PERIOD             5000 /* msecs */
 #define IWL_MVM_UAPSD_NOAGG_LIST_LEN            IWL_MVM_UAPSD_NOAGG_BSSIDS_NUM
+#define IWL_MVM_NON_TRANSMITTING_AP             0
 #define IWL_MVM_RS_NUM_TRY_BEFORE_ANT_TOGGLE    1
 #define IWL_MVM_RS_HT_VHT_RETRIES_PER_RATE      2
 #define IWL_MVM_RS_HT_VHT_RETRIES_PER_RATE_TW   1
@@ -145,5 +149,8 @@
 #define IWL_MVM_RS_TPC_SR_NO_INCREASE           85      /* percent */
 #define IWL_MVM_RS_TPC_TX_POWER_STEP            3
 #define IWL_MVM_ENABLE_EBS                      1
+#define IWL_MVM_FTM_INITIATOR_ALGO              IWL_TOF_ALGO_TYPE_MAX_LIKE
+#define IWL_MVM_FTM_INITIATOR_DYNACK            true
+#define IWL_MVM_D3_DEBUG                        false
 
 #endif /* __MVM_CONSTANTS_H */
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
index 36ed7d6fc971..808bc6f363d0 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
@@ -1899,7 +1899,7 @@ static void iwl_mvm_d3_disconnect_iter(void *data, u8 *mac,
 static int iwl_mvm_check_rt_status(struct iwl_mvm *mvm,
                                    struct ieee80211_vif *vif)
 {
-        u32 base = mvm->error_event_table[0];
+        u32 base = mvm->trans->lmac_error_event_table[0];
         struct error_table_start {
                 /* cf. struct iwl_error_event_table */
                 u32 valid;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
index e136475a34f6..776b24f54200 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
@@ -8,7 +8,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -1188,6 +1188,111 @@ out:
         return ret ?: count;
 }
 
+static int _iwl_dbgfs_inject_beacon_ie(struct iwl_mvm *mvm, char *bin, int len)
+{
+        struct ieee80211_vif *vif;
+        struct iwl_mvm_vif *mvmvif;
+        struct sk_buff *beacon;
+        struct ieee80211_tx_info *info;
+        struct iwl_mac_beacon_cmd beacon_cmd = {};
+        u8 rate;
+        u16 flags;
+        int i;
+
+        len /= 2;
+
+        /* Element len should be represented by u8 */
+        if (len >= U8_MAX)
+                return -EINVAL;
+
+        if (!iwl_mvm_firmware_running(mvm))
+                return -EIO;
+
+        if (!iwl_mvm_has_new_tx_api(mvm) &&
+            !fw_has_api(&mvm->fw->ucode_capa,
+                        IWL_UCODE_TLV_API_NEW_BEACON_TEMPLATE))
+                return -EINVAL;
+
+        rcu_read_lock();
+
+        for (i = 0; i < NUM_MAC_INDEX_DRIVER; i++) {
+                vif = iwl_mvm_rcu_dereference_vif_id(mvm, i, true);
+                if (!vif)
+                        continue;
+
+                if (vif->type == NL80211_IFTYPE_AP)
+                        break;
+        }
+
+        if (i == NUM_MAC_INDEX_DRIVER || !vif)
+                goto out_err;
+
+        mvm->hw->extra_beacon_tailroom = len;
+
+        beacon = ieee80211_beacon_get_template(mvm->hw, vif, NULL);
+        if (!beacon)
+                goto out_err;
+
+        if (len && hex2bin(skb_put_zero(beacon, len), bin, len)) {
+                dev_kfree_skb(beacon);
+                goto out_err;
+        }
+
+        mvm->beacon_inject_active = true;
+
+        mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        info = IEEE80211_SKB_CB(beacon);
+        rate = iwl_mvm_mac_ctxt_get_lowest_rate(info, vif);
+        flags = iwl_mvm_mac80211_idx_to_hwrate(rate);
+
+        if (rate == IWL_FIRST_CCK_RATE)
+                flags |= IWL_MAC_BEACON_CCK;
+
+        beacon_cmd.flags = cpu_to_le16(flags);
+        beacon_cmd.byte_cnt = cpu_to_le16((u16)beacon->len);
+        beacon_cmd.template_id = cpu_to_le32((u32)mvmvif->id);
+
+        iwl_mvm_mac_ctxt_set_tim(mvm, &beacon_cmd.tim_idx,
+                                 &beacon_cmd.tim_size,
+                                 beacon->data, beacon->len);
+
+        mutex_lock(&mvm->mutex);
+        iwl_mvm_mac_ctxt_send_beacon_cmd(mvm, beacon, &beacon_cmd,
+                                         sizeof(beacon_cmd));
+        mutex_unlock(&mvm->mutex);
+
+        dev_kfree_skb(beacon);
+
+        rcu_read_unlock();
+        return 0;
+
+out_err:
+        rcu_read_unlock();
+        return -EINVAL;
+}
+
+static ssize_t iwl_dbgfs_inject_beacon_ie_write(struct iwl_mvm *mvm,
+                                                char *buf, size_t count,
+                                                loff_t *ppos)
+{
+        int ret = _iwl_dbgfs_inject_beacon_ie(mvm, buf, count);
+
+        mvm->hw->extra_beacon_tailroom = 0;
+        return ret ?: count;
+}
+
+static ssize_t iwl_dbgfs_inject_beacon_ie_restore_write(struct iwl_mvm *mvm,
+                                                        char *buf,
+                                                        size_t count,
+                                                        loff_t *ppos)
+{
+        int ret = _iwl_dbgfs_inject_beacon_ie(mvm, NULL, 0);
+
+        mvm->hw->extra_beacon_tailroom = 0;
+        mvm->beacon_inject_active = false;
+        return ret ?: count;
+}
+
 static ssize_t iwl_dbgfs_fw_dbg_conf_read(struct file *file,
                                           char __user *user_buf,
                                           size_t count, loff_t *ppos)
@@ -1684,6 +1789,7 @@ iwl_dbgfs_send_echo_cmd_write(struct iwl_mvm *mvm, char *buf,
 
 struct iwl_mvm_sniffer_apply {
         struct iwl_mvm *mvm;
+        u8 *bssid;
         u16 aid;
 };
 
@@ -1693,6 +1799,8 @@ static bool iwl_mvm_sniffer_apply(struct iwl_notif_wait_data *notif_data,
         struct iwl_mvm_sniffer_apply *apply = data;
 
         apply->mvm->cur_aid = cpu_to_le16(apply->aid);
+        memcpy(apply->mvm->cur_bssid, apply->bssid,
+               sizeof(apply->mvm->cur_bssid));
 
         return true;
 }
@@ -1725,6 +1833,7 @@ iwl_dbgfs_he_sniffer_params_write(struct iwl_mvm *mvm, char *buf,
         he_mon_cmd.aid = cpu_to_le16(aid);
 
         apply.aid = aid;
+        apply.bssid = (void *)he_mon_cmd.bssid;
 
         mutex_lock(&mvm->mutex);
 
@@ -1754,6 +1863,23 @@ iwl_dbgfs_he_sniffer_params_write(struct iwl_mvm *mvm, char *buf,
 }
 
 static ssize_t
+iwl_dbgfs_he_sniffer_params_read(struct file *file, char __user *user_buf,
+                                 size_t count, loff_t *ppos)
+{
+        struct iwl_mvm *mvm = file->private_data;
+        u8 buf[32];
+        int len;
+
+        len = scnprintf(buf, sizeof(buf),
+                        "%d %02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx\n",
+                        le16_to_cpu(mvm->cur_aid), mvm->cur_bssid[0],
+                        mvm->cur_bssid[1], mvm->cur_bssid[2], mvm->cur_bssid[3],
+                        mvm->cur_bssid[4], mvm->cur_bssid[5]);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t
 iwl_dbgfs_uapsd_noagg_bssids_read(struct file *file, char __user *user_buf,
                                   size_t count, loff_t *ppos)
 {
@@ -1806,6 +1932,8 @@ MVM_DEBUGFS_WRITE_FILE_OPS(max_amsdu_len, 8);
 MVM_DEBUGFS_WRITE_FILE_OPS(indirection_tbl,
                            (IWL_RSS_INDIRECTION_TABLE_SIZE * 2));
 MVM_DEBUGFS_WRITE_FILE_OPS(inject_packet, 512);
+MVM_DEBUGFS_WRITE_FILE_OPS(inject_beacon_ie, 512);
+MVM_DEBUGFS_WRITE_FILE_OPS(inject_beacon_ie_restore, 512);
 
 MVM_DEBUGFS_READ_FILE_OPS(uapsd_noagg_bssids);
 
@@ -1821,7 +1949,7 @@ MVM_DEBUGFS_READ_WRITE_FILE_OPS(d3_sram, 8);
 MVM_DEBUGFS_READ_FILE_OPS(sar_geo_profile);
 #endif
 
-MVM_DEBUGFS_WRITE_FILE_OPS(he_sniffer_params, 32);
+MVM_DEBUGFS_READ_WRITE_FILE_OPS(he_sniffer_params, 32);
 
 static ssize_t iwl_dbgfs_mem_read(struct file *file, char __user *user_buf,
                                   size_t count, loff_t *ppos)
@@ -2007,10 +2135,12 @@ int iwl_mvm_dbgfs_register(struct iwl_mvm *mvm, struct dentry *dbgfs_dir)
         MVM_DEBUGFS_ADD_FILE(send_echo_cmd, mvm->debugfs_dir, 0200);
         MVM_DEBUGFS_ADD_FILE(indirection_tbl, mvm->debugfs_dir, 0200);
         MVM_DEBUGFS_ADD_FILE(inject_packet, mvm->debugfs_dir, 0200);
+        MVM_DEBUGFS_ADD_FILE(inject_beacon_ie, mvm->debugfs_dir, 0200);
+        MVM_DEBUGFS_ADD_FILE(inject_beacon_ie_restore, mvm->debugfs_dir, 0200);
 #ifdef CONFIG_ACPI
         MVM_DEBUGFS_ADD_FILE(sar_geo_profile, dbgfs_dir, 0400);
 #endif
-        MVM_DEBUGFS_ADD_FILE(he_sniffer_params, mvm->debugfs_dir, 0200);
+        MVM_DEBUGFS_ADD_FILE(he_sniffer_params, mvm->debugfs_dir, 0600);
 
         if (!debugfs_create_bool("enable_scan_iteration_notif",
                                  0600,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c b/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c
new file mode 100644
index 000000000000..e9822a3ec373
--- /dev/null
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c
@@ -0,0 +1,654 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
+ * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2019 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called COPYING.
+ *
+ * Contact Information:
+ * Intel Linux Wireless <linuxwifi@intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
+ * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2019 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+#include <linux/etherdevice.h>
+#include <linux/math64.h>
+#include <net/cfg80211.h>
+#include "mvm.h"
+#include "iwl-io.h"
+#include "iwl-prph.h"
+#include "constants.h"
+
+struct iwl_mvm_loc_entry {
+        struct list_head list;
+        u8 addr[ETH_ALEN];
+        u8 lci_len, civic_len;
+        u8 buf[];
+};
+
+static void iwl_mvm_ftm_reset(struct iwl_mvm *mvm)
+{
+        struct iwl_mvm_loc_entry *e, *t;
+
+        mvm->ftm_initiator.req = NULL;
+        mvm->ftm_initiator.req_wdev = NULL;
+        memset(mvm->ftm_initiator.responses, 0,
+               sizeof(mvm->ftm_initiator.responses));
+        list_for_each_entry_safe(e, t, &mvm->ftm_initiator.loc_list, list) {
+                list_del(&e->list);
+                kfree(e);
+        }
+}
+
+void iwl_mvm_ftm_restart(struct iwl_mvm *mvm)
+{
+        struct cfg80211_pmsr_result result = {
+                .status = NL80211_PMSR_STATUS_FAILURE,
+                .final = 1,
+                .host_time = ktime_get_boot_ns(),
+                .type = NL80211_PMSR_TYPE_FTM,
+        };
+        int i;
+
+        lockdep_assert_held(&mvm->mutex);
+
+        if (!mvm->ftm_initiator.req)
+                return;
+
+        for (i = 0; i < mvm->ftm_initiator.req->n_peers; i++) {
+                memcpy(result.addr, mvm->ftm_initiator.req->peers[i].addr,
+                       ETH_ALEN);
+                result.ftm.burst_index = mvm->ftm_initiator.responses[i];
+
+                cfg80211_pmsr_report(mvm->ftm_initiator.req_wdev,
+                                     mvm->ftm_initiator.req,
+                                     &result, GFP_KERNEL);
+        }
+
+        cfg80211_pmsr_complete(mvm->ftm_initiator.req_wdev,
+                               mvm->ftm_initiator.req, GFP_KERNEL);
+        iwl_mvm_ftm_reset(mvm);
+}
+
+static int
+iwl_ftm_range_request_status_to_err(enum iwl_tof_range_request_status s)
+{
+        switch (s) {
+        case IWL_TOF_RANGE_REQUEST_STATUS_SUCCESS:
+                return 0;
+        case IWL_TOF_RANGE_REQUEST_STATUS_BUSY:
+                return -EBUSY;
+        default:
+                WARN_ON_ONCE(1);
+                return -EIO;
+        }
+}
+
+static void iwl_mvm_ftm_cmd_v5(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                               struct iwl_tof_range_req_cmd_v5 *cmd,
+                               struct cfg80211_pmsr_request *req)
+{
+        int i;
+
+        cmd->request_id = req->cookie;
+        cmd->num_of_ap = req->n_peers;
+
+        /* use maximum for "no timeout" or bigger than what we can do */
+        if (!req->timeout || req->timeout > 255 * 100)
+                cmd->req_timeout = 255;
+        else
+                cmd->req_timeout = DIV_ROUND_UP(req->timeout, 100);
+
+        /*
+         * We treat it always as random, since if not we'll
+         * have filled our local address there instead.
+         */
+        cmd->macaddr_random = 1;
+        memcpy(cmd->macaddr_template, req->mac_addr, ETH_ALEN);
+        for (i = 0; i < ETH_ALEN; i++)
+                cmd->macaddr_mask[i] = ~req->mac_addr_mask[i];
+
+        if (vif->bss_conf.assoc)
+                memcpy(cmd->range_req_bssid, vif->bss_conf.bssid, ETH_ALEN);
+        else
+                eth_broadcast_addr(cmd->range_req_bssid);
+}
+
+static void iwl_mvm_ftm_cmd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                            struct iwl_tof_range_req_cmd *cmd,
+                            struct cfg80211_pmsr_request *req)
+{
+        int i;
+
+        cmd->initiator_flags =
+                cpu_to_le32(IWL_TOF_INITIATOR_FLAGS_MACADDR_RANDOM |
+                            IWL_TOF_INITIATOR_FLAGS_NON_ASAP_SUPPORT);
+        cmd->request_id = req->cookie;
+        cmd->num_of_ap = req->n_peers;
+
+        /*
+         * Use a large value for "no timeout". Don't use the maximum value
+         * because of fw limitations.
+         */
+        if (req->timeout)
+                cmd->req_timeout_ms = cpu_to_le32(req->timeout);
+        else
+                cmd->req_timeout_ms = cpu_to_le32(0xfffff);
+
+        memcpy(cmd->macaddr_template, req->mac_addr, ETH_ALEN);
+        for (i = 0; i < ETH_ALEN; i++)
+                cmd->macaddr_mask[i] = ~req->mac_addr_mask[i];
+
+        if (vif->bss_conf.assoc)
+                memcpy(cmd->range_req_bssid, vif->bss_conf.bssid, ETH_ALEN);
+        else
+                eth_broadcast_addr(cmd->range_req_bssid);
+
+        /* TODO: fill in tsf_mac_id if needed */
+        cmd->tsf_mac_id = cpu_to_le32(0xff);
+}
+
+static int iwl_mvm_ftm_target_chandef(struct iwl_mvm *mvm,
+                                      struct cfg80211_pmsr_request_peer *peer,
+                                      u8 *channel, u8 *bandwidth,
+                                      u8 *ctrl_ch_position)
+{
+        u32 freq = peer->chandef.chan->center_freq;
+
+        *channel = ieee80211_frequency_to_channel(freq);
+
+        switch (peer->chandef.width) {
+        case NL80211_CHAN_WIDTH_20_NOHT:
+                *bandwidth = IWL_TOF_BW_20_LEGACY;
+                break;
+        case NL80211_CHAN_WIDTH_20:
+                *bandwidth = IWL_TOF_BW_20_HT;
+                break;
+        case NL80211_CHAN_WIDTH_40:
+                *bandwidth = IWL_TOF_BW_40;
+                break;
+        case NL80211_CHAN_WIDTH_80:
+                *bandwidth = IWL_TOF_BW_80;
+                break;
+        default:
+                IWL_ERR(mvm, "Unsupported BW in FTM request (%d)\n",
+                        peer->chandef.width);
+                return -EINVAL;
+        }
+
+        *ctrl_ch_position = (peer->chandef.width > NL80211_CHAN_WIDTH_20) ?
+                iwl_mvm_get_ctrl_pos(&peer->chandef) : 0;
+
+        return 0;
+}
+
+static int
+iwl_mvm_ftm_put_target_v2(struct iwl_mvm *mvm,
+                          struct cfg80211_pmsr_request_peer *peer,
+                          struct iwl_tof_range_req_ap_entry_v2 *target)
+{
+        int ret;
+
+        ret = iwl_mvm_ftm_target_chandef(mvm, peer, &target->channel_num,
+                                         &target->bandwidth,
+                                         &target->ctrl_ch_position);
+        if (ret)
+                return ret;
+
+        memcpy(target->bssid, peer->addr, ETH_ALEN);
+        target->burst_period =
+                cpu_to_le16(peer->ftm.burst_period);
+        target->samples_per_burst = peer->ftm.ftms_per_burst;
+        target->num_of_bursts = peer->ftm.num_bursts_exp;
+        target->measure_type = 0; /* regular two-sided FTM */
+        target->retries_per_sample = peer->ftm.ftmr_retries;
+        target->asap_mode = peer->ftm.asap;
+        target->enable_dyn_ack = IWL_MVM_FTM_INITIATOR_DYNACK;
+
+        if (peer->ftm.request_lci)
+                target->location_req |= IWL_TOF_LOC_LCI;
+        if (peer->ftm.request_civicloc)
+                target->location_req |= IWL_TOF_LOC_CIVIC;
+
+        target->algo_type = IWL_MVM_FTM_INITIATOR_ALGO;
+
+        return 0;
+}
+
+#define FTM_PUT_FLAG(flag)      (target->initiator_ap_flags |= \
+                                 cpu_to_le32(IWL_INITIATOR_AP_FLAGS_##flag))
+
+static int iwl_mvm_ftm_put_target(struct iwl_mvm *mvm,
+                                  struct cfg80211_pmsr_request_peer *peer,
+                                  struct iwl_tof_range_req_ap_entry *target)
+{
+        int ret;
+
+        ret = iwl_mvm_ftm_target_chandef(mvm, peer, &target->channel_num,
+                                         &target->bandwidth,
+                                         &target->ctrl_ch_position);
+        if (ret)
+                return ret;
+
+        memcpy(target->bssid, peer->addr, ETH_ALEN);
+        target->burst_period =
+                cpu_to_le16(peer->ftm.burst_period);
+        target->samples_per_burst = peer->ftm.ftms_per_burst;
+        target->num_of_bursts = peer->ftm.num_bursts_exp;
+        target->ftmr_max_retries = peer->ftm.ftmr_retries;
+        target->initiator_ap_flags = cpu_to_le32(0);
+
+        if (peer->ftm.asap)
+                FTM_PUT_FLAG(ASAP);
+
+        if (peer->ftm.request_lci)
+                FTM_PUT_FLAG(LCI_REQUEST);
+
+        if (peer->ftm.request_civicloc)
+                FTM_PUT_FLAG(CIVIC_REQUEST);
+
+        if (IWL_MVM_FTM_INITIATOR_DYNACK)
+                FTM_PUT_FLAG(DYN_ACK);
+
+        if (IWL_MVM_FTM_INITIATOR_ALGO == IWL_TOF_ALGO_TYPE_LINEAR_REG)
+                FTM_PUT_FLAG(ALGO_LR);
+        else if (IWL_MVM_FTM_INITIATOR_ALGO == IWL_TOF_ALGO_TYPE_FFT)
+                FTM_PUT_FLAG(ALGO_FFT);
+
+        return 0;
+}
+
+int iwl_mvm_ftm_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                      struct cfg80211_pmsr_request *req)
+{
+        struct iwl_tof_range_req_cmd_v5 cmd_v5;
+        struct iwl_tof_range_req_cmd cmd;
+        bool new_api = fw_has_api(&mvm->fw->ucode_capa,
+                                  IWL_UCODE_TLV_API_FTM_NEW_RANGE_REQ);
+        u8 num_of_ap;
+        struct iwl_host_cmd hcmd = {
+                .id = iwl_cmd_id(TOF_RANGE_REQ_CMD, LOCATION_GROUP, 0),
+                .dataflags[0] = IWL_HCMD_DFL_DUP,
+        };
+        u32 status = 0;
+        int err, i;
+
+        lockdep_assert_held(&mvm->mutex);
+
+        if (mvm->ftm_initiator.req)
+                return -EBUSY;
+
+        if (new_api) {
+                iwl_mvm_ftm_cmd(mvm, vif, &cmd, req);
+                hcmd.data[0] = &cmd;
+                hcmd.len[0] = sizeof(cmd);
+                num_of_ap = cmd.num_of_ap;
+        } else {
+                iwl_mvm_ftm_cmd_v5(mvm, vif, &cmd_v5, req);
+                hcmd.data[0] = &cmd_v5;
+                hcmd.len[0] = sizeof(cmd_v5);
+                num_of_ap = cmd_v5.num_of_ap;
+        }
+
+        for (i = 0; i < num_of_ap; i++) {
+                struct cfg80211_pmsr_request_peer *peer = &req->peers[i];
+
+                if (new_api)
+                        err = iwl_mvm_ftm_put_target(mvm, peer, &cmd.ap[i]);
+                else
+                        err = iwl_mvm_ftm_put_target_v2(mvm, peer,
+                                                        &cmd_v5.ap[i]);
+
+                if (err)
+                        return err;
+        }
+
+        err = iwl_mvm_send_cmd_status(mvm, &hcmd, &status);
+        if (!err && status) {
+                IWL_ERR(mvm, "FTM range request command failure, status: %u\n",
+                        status);
+                err = iwl_ftm_range_request_status_to_err(status);
+        }
+
+        if (!err) {
+                mvm->ftm_initiator.req = req;
+                mvm->ftm_initiator.req_wdev = ieee80211_vif_to_wdev(vif);
+        }
+
+        return err;
+}
+
+void iwl_mvm_ftm_abort(struct iwl_mvm *mvm, struct cfg80211_pmsr_request *req)
+{
+        struct iwl_tof_range_abort_cmd cmd = {
+                .request_id = req->cookie,
+        };
+
+        lockdep_assert_held(&mvm->mutex);
+
+        if (req != mvm->ftm_initiator.req)
+                return;
+
+        if (iwl_mvm_send_cmd_pdu(mvm, iwl_cmd_id(TOF_RANGE_ABORT_CMD,
+                                                 LOCATION_GROUP, 0),
+                                 0, sizeof(cmd), &cmd))
+                IWL_ERR(mvm, "failed to abort FTM process\n");
+}
+
+static int iwl_mvm_ftm_find_peer(struct cfg80211_pmsr_request *req,
+                                 const u8 *addr)
+{
+        int i;
+
+        for (i = 0; i < req->n_peers; i++) {
+                struct cfg80211_pmsr_request_peer *peer = &req->peers[i];
+
+                if (ether_addr_equal_unaligned(peer->addr, addr))
+                        return i;
+        }
+
+        return -ENOENT;
+}
+
+static u64 iwl_mvm_ftm_get_host_time(struct iwl_mvm *mvm, __le32 fw_gp2_ts)
+{
+        u32 gp2_ts = le32_to_cpu(fw_gp2_ts);
+        u32 curr_gp2, diff;
+        u64 now_from_boot_ns;
+
+        iwl_mvm_get_sync_time(mvm, &curr_gp2, &now_from_boot_ns);
+
+        if (curr_gp2 >= gp2_ts)
+                diff = curr_gp2 - gp2_ts;
+        else
+                diff = curr_gp2 + (U32_MAX - gp2_ts + 1);
+
+        return now_from_boot_ns - (u64)diff * 1000;
+}
+
+static void iwl_mvm_ftm_get_lci_civic(struct iwl_mvm *mvm,
+                                      struct cfg80211_pmsr_result *res)
+{
+        struct iwl_mvm_loc_entry *entry;
+
+        list_for_each_entry(entry, &mvm->ftm_initiator.loc_list, list) {
+                if (!ether_addr_equal_unaligned(res->addr, entry->addr))
+                        continue;
+
+                if (entry->lci_len) {
+                        res->ftm.lci_len = entry->lci_len;
+                        res->ftm.lci = entry->buf;
+                }
+
+                if (entry->civic_len) {
+                        res->ftm.civicloc_len = entry->civic_len;
+                        res->ftm.civicloc = entry->buf + entry->lci_len;
+                }
+
+                /* we found the entry we needed */
+                break;
+        }
+}
+
+static int iwl_mvm_ftm_range_resp_valid(struct iwl_mvm *mvm, u8 request_id,
+                                        u8 num_of_aps)
+{
+        lockdep_assert_held(&mvm->mutex);
+
+        if (request_id != (u8)mvm->ftm_initiator.req->cookie) {
+                IWL_ERR(mvm, "Request ID mismatch, got %u, active %u\n",
+                        request_id, (u8)mvm->ftm_initiator.req->cookie);
+                return -EINVAL;
+        }
+
+        if (num_of_aps > mvm->ftm_initiator.req->n_peers) {
+                IWL_ERR(mvm, "FTM range response invalid\n");
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static void iwl_mvm_debug_range_resp(struct iwl_mvm *mvm, u8 index,
+                                     struct cfg80211_pmsr_result *res)
+{
+        s64 rtt_avg = res->ftm.rtt_avg * 100;
+
+        do_div(rtt_avg, 6666);
+
+        IWL_DEBUG_INFO(mvm, "entry %d\n", index);
+        IWL_DEBUG_INFO(mvm, "\tstatus: %d\n", res->status);
+        IWL_DEBUG_INFO(mvm, "\tBSSID: %pM\n", res->addr);
+        IWL_DEBUG_INFO(mvm, "\thost time: %llu\n", res->host_time);
+        IWL_DEBUG_INFO(mvm, "\tburst index: %hhu\n", res->ftm.burst_index);
+        IWL_DEBUG_INFO(mvm, "\tsuccess num: %u\n", res->ftm.num_ftmr_successes);
+        IWL_DEBUG_INFO(mvm, "\trssi: %d\n", res->ftm.rssi_avg);
+        IWL_DEBUG_INFO(mvm, "\trssi spread: %hhu\n", res->ftm.rssi_spread);
+        IWL_DEBUG_INFO(mvm, "\trtt: %lld\n", res->ftm.rtt_avg);
+        IWL_DEBUG_INFO(mvm, "\trtt var: %llu\n", res->ftm.rtt_variance);
+        IWL_DEBUG_INFO(mvm, "\trtt spread: %llu\n", res->ftm.rtt_spread);
+        IWL_DEBUG_INFO(mvm, "\tdistance: %lld\n", rtt_avg);
+}
+
+void iwl_mvm_ftm_range_resp(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        struct iwl_tof_range_rsp_ntfy_v5 *fw_resp_v5 = (void *)pkt->data;
+        struct iwl_tof_range_rsp_ntfy *fw_resp = (void *)pkt->data;
+        int i;
+        bool new_api = fw_has_api(&mvm->fw->ucode_capa,
+                                  IWL_UCODE_TLV_API_FTM_NEW_RANGE_REQ);
+        u8 num_of_aps, last_in_batch;
+
+        lockdep_assert_held(&mvm->mutex);
+
+        if (!mvm->ftm_initiator.req) {
+                IWL_ERR(mvm, "Got FTM response but have no request?\n");
+                return;
+        }
+
+        if (new_api) {
+                if (iwl_mvm_ftm_range_resp_valid(mvm, fw_resp->request_id,
+                                                 fw_resp->num_of_aps))
+                        return;
+
+                num_of_aps = fw_resp->num_of_aps;
+                last_in_batch = fw_resp->last_report;
+        } else {
+                if (iwl_mvm_ftm_range_resp_valid(mvm, fw_resp_v5->request_id,
+                                                 fw_resp_v5->num_of_aps))
+                        return;
+
+                num_of_aps = fw_resp_v5->num_of_aps;
+                last_in_batch = fw_resp_v5->last_in_batch;
+        }
+
+        IWL_DEBUG_INFO(mvm, "Range response received\n");
+        IWL_DEBUG_INFO(mvm, "request id: %lld, num of entries: %hhu\n",
+                       mvm->ftm_initiator.req->cookie, num_of_aps);
+
+        for (i = 0; i < num_of_aps && i < IWL_MVM_TOF_MAX_APS; i++) {
+                struct cfg80211_pmsr_result result = {};
+                struct iwl_tof_range_rsp_ap_entry_ntfy *fw_ap;
+                int peer_idx;
+
+                if (new_api) {
+                        fw_ap = &fw_resp->ap[i];
+                        result.final = fw_resp->ap[i].last_burst;
+                } else {
+                        /* the first part is the same for old and new APIs */
+                        fw_ap = (void *)&fw_resp_v5->ap[i];
+                        /*
+                         * FIXME: the firmware needs to report this, we don't
+                         * even know the number of bursts the responder picked
+                         * (if we asked it to)
+                         */
+                        result.final = 0;
+                }
+
+                peer_idx = iwl_mvm_ftm_find_peer(mvm->ftm_initiator.req,
+                                                 fw_ap->bssid);
+                if (peer_idx < 0) {
+                        IWL_WARN(mvm,
+                                 "Unknown address (%pM, target #%d) in FTM response\n",
+                                 fw_ap->bssid, i);
+                        continue;
+                }
+
+                switch (fw_ap->measure_status) {
+                case IWL_TOF_ENTRY_SUCCESS:
+                        result.status = NL80211_PMSR_STATUS_SUCCESS;
+                        break;
+                case IWL_TOF_ENTRY_TIMING_MEASURE_TIMEOUT:
+                        result.status = NL80211_PMSR_STATUS_TIMEOUT;
+                        break;
+                case IWL_TOF_ENTRY_NO_RESPONSE:
+                        result.status = NL80211_PMSR_STATUS_FAILURE;
+                        result.ftm.failure_reason =
+                                NL80211_PMSR_FTM_FAILURE_NO_RESPONSE;
+                        break;
+                case IWL_TOF_ENTRY_REQUEST_REJECTED:
+                        result.status = NL80211_PMSR_STATUS_FAILURE;
+                        result.ftm.failure_reason =
+                                NL80211_PMSR_FTM_FAILURE_PEER_BUSY;
+                        result.ftm.busy_retry_time = fw_ap->refusal_period;
+                        break;
+                default:
+                        result.status = NL80211_PMSR_STATUS_FAILURE;
+                        result.ftm.failure_reason =
+                                NL80211_PMSR_FTM_FAILURE_UNSPECIFIED;
+                        break;
+                }
+                memcpy(result.addr, fw_ap->bssid, ETH_ALEN);
+                result.host_time = iwl_mvm_ftm_get_host_time(mvm,
+                                                             fw_ap->timestamp);
+                result.type = NL80211_PMSR_TYPE_FTM;
+                result.ftm.burst_index = mvm->ftm_initiator.responses[peer_idx];
+                mvm->ftm_initiator.responses[peer_idx]++;
+                result.ftm.rssi_avg = fw_ap->rssi;
+                result.ftm.rssi_avg_valid = 1;
+                result.ftm.rssi_spread = fw_ap->rssi_spread;
+                result.ftm.rssi_spread_valid = 1;
+                result.ftm.rtt_avg = (s32)le32_to_cpu(fw_ap->rtt);
+                result.ftm.rtt_avg_valid = 1;
+                result.ftm.rtt_variance = le32_to_cpu(fw_ap->rtt_variance);
+                result.ftm.rtt_variance_valid = 1;
+                result.ftm.rtt_spread = le32_to_cpu(fw_ap->rtt_spread);
+                result.ftm.rtt_spread_valid = 1;
+
+                iwl_mvm_ftm_get_lci_civic(mvm, &result);
+
+                cfg80211_pmsr_report(mvm->ftm_initiator.req_wdev,
+                                     mvm->ftm_initiator.req,
+                                     &result, GFP_KERNEL);
+
+                iwl_mvm_debug_range_resp(mvm, i, &result);
+        }
+
+        if (last_in_batch) {
+                cfg80211_pmsr_complete(mvm->ftm_initiator.req_wdev,
+                                       mvm->ftm_initiator.req,
+                                       GFP_KERNEL);
+                iwl_mvm_ftm_reset(mvm);
+        }
+}
+
+void iwl_mvm_ftm_lc_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        const struct ieee80211_mgmt *mgmt = (void *)pkt->data;
+        size_t len = iwl_rx_packet_payload_len(pkt);
+        struct iwl_mvm_loc_entry *entry;
+        const u8 *ies, *lci, *civic, *msr_ie;
+        size_t ies_len, lci_len = 0, civic_len = 0;
+        size_t baselen = IEEE80211_MIN_ACTION_SIZE +
+                         sizeof(mgmt->u.action.u.ftm);
+        static const u8 rprt_type_lci = IEEE80211_SPCT_MSR_RPRT_TYPE_LCI;
+        static const u8 rprt_type_civic = IEEE80211_SPCT_MSR_RPRT_TYPE_CIVIC;
+
+        if (len <= baselen)
+                return;
+
+        lockdep_assert_held(&mvm->mutex);
+
+        ies = mgmt->u.action.u.ftm.variable;
+        ies_len = len - baselen;
+
+        msr_ie = cfg80211_find_ie_match(WLAN_EID_MEASURE_REPORT, ies, ies_len,
+                                        &rprt_type_lci, 1, 4);
+        if (msr_ie) {
+                lci = msr_ie + 2;
+                lci_len = msr_ie[1];
+        }
+
+        msr_ie = cfg80211_find_ie_match(WLAN_EID_MEASURE_REPORT, ies, ies_len,
+                                        &rprt_type_civic, 1, 4);
+        if (msr_ie) {
+                civic = msr_ie + 2;
+                civic_len = msr_ie[1];
+        }
+
+        entry = kmalloc(sizeof(*entry) + lci_len + civic_len, GFP_KERNEL);
+        if (!entry)
+                return;
+
+        memcpy(entry->addr, mgmt->bssid, ETH_ALEN);
+
+        entry->lci_len = lci_len;
+        if (lci_len)
+                memcpy(entry->buf, lci, lci_len);
+
+        entry->civic_len = civic_len;
+        if (civic_len)
+                memcpy(entry->buf + lci_len, civic, civic_len);
+
+        list_add_tail(&entry->list, &mvm->ftm_initiator.loc_list);
+}
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ftm-responder.c b/drivers/net/wireless/intel/iwlwifi/mvm/ftm-responder.c
new file mode 100644
index 000000000000..1513b8b4062f
--- /dev/null
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ftm-responder.c
@@ -0,0 +1,244 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
+ * Copyright (C) 2018 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called COPYING.
+ *
+ * Contact Information:
+ * Intel Linux Wireless <linuxwifi@intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
+ * Copyright (C) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+#include <net/cfg80211.h>
+#include <linux/etherdevice.h>
+#include "mvm.h"
+#include "constants.h"
+
+static int
+iwl_mvm_ftm_responder_cmd(struct iwl_mvm *mvm,
+                          struct ieee80211_vif *vif,
+                          struct cfg80211_chan_def *chandef)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct iwl_tof_responder_config_cmd cmd = {
+                .channel_num = chandef->chan->hw_value,
+                .cmd_valid_fields =
+                        cpu_to_le32(IWL_TOF_RESPONDER_CMD_VALID_CHAN_INFO |
+                                    IWL_TOF_RESPONDER_CMD_VALID_BSSID |
+                                    IWL_TOF_RESPONDER_CMD_VALID_STA_ID),
+                .sta_id = mvmvif->bcast_sta.sta_id,
+        };
+
+        lockdep_assert_held(&mvm->mutex);
+
+        switch (chandef->width) {
+        case NL80211_CHAN_WIDTH_20_NOHT:
+                cmd.bandwidth = IWL_TOF_BW_20_LEGACY;
+                break;
+        case NL80211_CHAN_WIDTH_20:
+                cmd.bandwidth = IWL_TOF_BW_20_HT;
+                break;
+        case NL80211_CHAN_WIDTH_40:
+                cmd.bandwidth = IWL_TOF_BW_40;
+                cmd.ctrl_ch_position = iwl_mvm_get_ctrl_pos(chandef);
+                break;
+        case NL80211_CHAN_WIDTH_80:
+                cmd.bandwidth = IWL_TOF_BW_80;
+                cmd.ctrl_ch_position = iwl_mvm_get_ctrl_pos(chandef);
+                break;
+        default:
+                WARN_ON(1);
+                return -EINVAL;
+        }
+
+        memcpy(cmd.bssid, vif->addr, ETH_ALEN);
+
+        return iwl_mvm_send_cmd_pdu(mvm, iwl_cmd_id(TOF_RESPONDER_CONFIG_CMD,
+                                                    LOCATION_GROUP, 0),
+                                    0, sizeof(cmd), &cmd);
+}
+
+static int
+iwl_mvm_ftm_responder_dyn_cfg_cmd(struct iwl_mvm *mvm,
+                                  struct ieee80211_vif *vif,
+                                  struct ieee80211_ftm_responder_params *params)
+{
+        struct iwl_tof_responder_dyn_config_cmd cmd = {
+                .lci_len = cpu_to_le32(params->lci_len + 2),
+                .civic_len = cpu_to_le32(params->civicloc_len + 2),
+        };
+        u8 data[IWL_LCI_CIVIC_IE_MAX_SIZE] = {0};
+        struct iwl_host_cmd hcmd = {
+                .id = iwl_cmd_id(TOF_RESPONDER_DYN_CONFIG_CMD,
+                                 LOCATION_GROUP, 0),
+                .data[0] = &cmd,
+                .len[0] = sizeof(cmd),
+                .data[1] = &data,
+                /* .len[1] set later */
+                /* may not be able to DMA from stack */
+                .dataflags[1] = IWL_HCMD_DFL_DUP,
+        };
+        u32 aligned_lci_len = ALIGN(params->lci_len + 2, 4);
+        u32 aligned_civicloc_len = ALIGN(params->civicloc_len + 2, 4);
+        u8 *pos = data;
+
+        lockdep_assert_held(&mvm->mutex);
+
+        if (aligned_lci_len + aligned_civicloc_len > sizeof(data)) {
+                IWL_ERR(mvm, "LCI/civicloc data too big (%zd + %zd)\n",
+                        params->lci_len, params->civicloc_len);
+                return -ENOBUFS;
+        }
+
+        pos[0] = WLAN_EID_MEASURE_REPORT;
+        pos[1] = params->lci_len;
+        memcpy(pos + 2, params->lci, params->lci_len);
+
+        pos += aligned_lci_len;
+        pos[0] = WLAN_EID_MEASURE_REPORT;
+        pos[1] = params->civicloc_len;
+        memcpy(pos + 2, params->civicloc, params->civicloc_len);
+
+        hcmd.len[1] = aligned_lci_len + aligned_civicloc_len;
+
+        return iwl_mvm_send_cmd(mvm, &hcmd);
+}
+
+int iwl_mvm_ftm_start_responder(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct ieee80211_ftm_responder_params *params;
+        struct ieee80211_chanctx_conf ctx, *pctx;
+        u16 *phy_ctxt_id;
+        struct iwl_mvm_phy_ctxt *phy_ctxt;
+        int ret;
+
+        params = vif->bss_conf.ftmr_params;
+
+        lockdep_assert_held(&mvm->mutex);
+
+        if (WARN_ON_ONCE(!vif->bss_conf.ftm_responder))
+                return -EINVAL;
+
+        if (vif->p2p || vif->type != NL80211_IFTYPE_AP ||
+            !mvmvif->ap_ibss_active) {
+                IWL_ERR(mvm, "Cannot start responder, not in AP mode\n");
+                return -EIO;
+        }
+
+        rcu_read_lock();
+        pctx = rcu_dereference(vif->chanctx_conf);
+        /* Copy the ctx to unlock the rcu and send the phy ctxt. We don't care
+         * about changes in the ctx after releasing the lock because the driver
+         * is still protected by the mutex. */
+        ctx = *pctx;
+        phy_ctxt_id  = (u16 *)pctx->drv_priv;
+        rcu_read_unlock();
+
+        phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
+        ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &ctx.def,
+                                       ctx.rx_chains_static,
+                                       ctx.rx_chains_dynamic);
+        if (ret)
+                return ret;
+
+        ret = iwl_mvm_ftm_responder_cmd(mvm, vif, &ctx.def);
+        if (ret)
+                return ret;
+
+        if (params)
+                ret = iwl_mvm_ftm_responder_dyn_cfg_cmd(mvm, vif, params);
+
+        return ret;
+}
+
+void iwl_mvm_ftm_restart_responder(struct iwl_mvm *mvm,
+                                   struct ieee80211_vif *vif)
+{
+        if (!vif->bss_conf.ftm_responder)
+                return;
+
+        iwl_mvm_ftm_start_responder(mvm, vif);
+}
+
+void iwl_mvm_ftm_responder_stats(struct iwl_mvm *mvm,
+                                 struct iwl_rx_cmd_buffer *rxb)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        struct iwl_ftm_responder_stats *resp = (void *)pkt->data;
+        struct cfg80211_ftm_responder_stats *stats = &mvm->ftm_resp_stats;
+        u32 flags = le32_to_cpu(resp->flags);
+
+        if (resp->success_ftm == resp->ftm_per_burst)
+                stats->success_num++;
+        else if (resp->success_ftm >= 2)
+                stats->partial_num++;
+        else
+                stats->failed_num++;
+
+        if ((flags & FTM_RESP_STAT_ASAP_REQ) &&
+            (flags & FTM_RESP_STAT_ASAP_RESP))
+                stats->asap_num++;
+
+        if (flags & FTM_RESP_STAT_NON_ASAP_RESP)
+                stats->non_asap_num++;
+
+        stats->total_duration_ms += le32_to_cpu(resp->duration) / USEC_PER_MSEC;
+
+        if (flags & FTM_RESP_STAT_TRIGGER_UNKNOWN)
+                stats->unknown_triggers_num++;
+
+        if (flags & FTM_RESP_STAT_DUP)
+                stats->reschedule_requests_num++;
+
+        if (flags & FTM_RESP_STAT_NON_ASAP_OUT_WIN)
+                stats->out_of_window_triggers_num++;
+}
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index d3dc9d276e0f..00a47f6f1d81 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -8,7 +8,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019        Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019       Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -105,12 +105,12 @@ static int iwl_send_rss_cfg_cmd(struct iwl_mvm *mvm)
         int i;
         struct iwl_rss_config_cmd cmd = {
                 .flags = cpu_to_le32(IWL_RSS_ENABLE),
-                .hash_mask = IWL_RSS_HASH_TYPE_IPV4_TCP |
-                             IWL_RSS_HASH_TYPE_IPV4_UDP |
-                             IWL_RSS_HASH_TYPE_IPV4_PAYLOAD |
-                             IWL_RSS_HASH_TYPE_IPV6_TCP |
-                             IWL_RSS_HASH_TYPE_IPV6_UDP |
-                             IWL_RSS_HASH_TYPE_IPV6_PAYLOAD,
+                .hash_mask = BIT(IWL_RSS_HASH_TYPE_IPV4_TCP) |
+                             BIT(IWL_RSS_HASH_TYPE_IPV4_UDP) |
+                             BIT(IWL_RSS_HASH_TYPE_IPV4_PAYLOAD) |
+                             BIT(IWL_RSS_HASH_TYPE_IPV6_TCP) |
+                             BIT(IWL_RSS_HASH_TYPE_IPV6_UDP) |
+                             BIT(IWL_RSS_HASH_TYPE_IPV6_PAYLOAD),
         };
 
         if (mvm->trans->num_rx_queues == 1)
@@ -127,13 +127,17 @@ static int iwl_send_rss_cfg_cmd(struct iwl_mvm *mvm)
 
 static int iwl_configure_rxq(struct iwl_mvm *mvm)
 {
-        int i, num_queues, size;
+        int i, num_queues, size, ret;
         struct iwl_rfh_queue_config *cmd;
+        struct iwl_host_cmd hcmd = {
+                .id = WIDE_ID(DATA_PATH_GROUP, RFH_QUEUE_CONFIG_CMD),
+                .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
+        };
 
         /* Do not configure default queue, it is configured via context info */
         num_queues = mvm->trans->num_rx_queues - 1;
 
-        size = sizeof(*cmd) + num_queues * sizeof(struct iwl_rfh_queue_data);
+        size = struct_size(cmd, data, num_queues);
 
         cmd = kzalloc(size, GFP_KERNEL);
         if (!cmd)
@@ -154,10 +158,14 @@ static int iwl_configure_rxq(struct iwl_mvm *mvm)
                 cmd->data[i].fr_bd_wid = cpu_to_le32(data.fr_bd_wid);
         }
 
-        return iwl_mvm_send_cmd_pdu(mvm,
-                                    WIDE_ID(DATA_PATH_GROUP,
-                                            RFH_QUEUE_CONFIG_CMD),
-                                    0, size, cmd);
+        hcmd.data[0] = cmd;
+        hcmd.len[0] = size;
+
+        ret = iwl_mvm_send_cmd(mvm, &hcmd);
+
+        kfree(cmd);
+
+        return ret;
 }
 
 static int iwl_mvm_send_dqa_cmd(struct iwl_mvm *mvm)
@@ -210,7 +218,7 @@ static bool iwl_alive_fn(struct iwl_notif_wait_data *notif_wait,
         struct iwl_lmac_alive *lmac1;
         struct iwl_lmac_alive *lmac2 = NULL;
         u16 status;
-        u32 umac_error_event_table;
+        u32 lmac_error_event_table, umac_error_event_table;
 
         if (iwl_rx_packet_payload_len(pkt) == sizeof(*palive)) {
                 palive = (void *)pkt->data;
@@ -225,30 +233,35 @@ static bool iwl_alive_fn(struct iwl_notif_wait_data *notif_wait,
                 status = le16_to_cpu(palive3->status);
         }
 
-        mvm->error_event_table[0] = le32_to_cpu(lmac1->error_event_table_ptr);
+        lmac_error_event_table =
+                le32_to_cpu(lmac1->dbg_ptrs.error_event_table_ptr);
+        iwl_fw_lmac1_set_alive_err_table(mvm->trans, lmac_error_event_table);
+
         if (lmac2)
-                mvm->error_event_table[1] =
-                        le32_to_cpu(lmac2->error_event_table_ptr);
-        mvm->log_event_table = le32_to_cpu(lmac1->log_event_table_ptr);
+                mvm->trans->lmac_error_event_table[1] =
+                        le32_to_cpu(lmac2->dbg_ptrs.error_event_table_ptr);
 
-        umac_error_event_table = le32_to_cpu(umac->error_info_addr);
+        umac_error_event_table = le32_to_cpu(umac->dbg_ptrs.error_info_addr);
 
         if (!umac_error_event_table) {
                 mvm->support_umac_log = false;
         } else if (umac_error_event_table >=
                    mvm->trans->cfg->min_umac_error_event_table) {
                 mvm->support_umac_log = true;
-                mvm->umac_error_event_table = umac_error_event_table;
         } else {
                 IWL_ERR(mvm,
                         "Not valid error log pointer 0x%08X for %s uCode\n",
-                        mvm->umac_error_event_table,
+                        umac_error_event_table,
                         (mvm->fwrt.cur_fw_img == IWL_UCODE_INIT) ?
                         "Init" : "RT");
                 mvm->support_umac_log = false;
         }
 
-        alive_data->scd_base_addr = le32_to_cpu(lmac1->scd_base_ptr);
+        if (mvm->support_umac_log)
+                iwl_fw_umac_set_alive_err_table(mvm->trans,
+                                                umac_error_event_table);
+
+        alive_data->scd_base_addr = le32_to_cpu(lmac1->dbg_ptrs.scd_base_ptr);
         alive_data->valid = status == IWL_ALIVE_STATUS_OK;
 
         IWL_DEBUG_FW(mvm,
@@ -299,7 +312,6 @@ static int iwl_mvm_load_ucode_wait_alive(struct iwl_mvm *mvm,
         enum iwl_ucode_type old_type = mvm->fwrt.cur_fw_img;
         static const u16 alive_cmd[] = { MVM_ALIVE };
 
-        set_bit(IWL_FWRT_STATUS_WAIT_ALIVE, &mvm->fwrt.status);
         if (ucode_type == IWL_UCODE_REGULAR &&
             iwl_fw_dbg_conf_usniffer(mvm->fw, FW_DBG_START_FROM_ALIVE) &&
             !(fw_has_capa(&mvm->fw->ucode_capa,
@@ -332,11 +344,16 @@ static int iwl_mvm_load_ucode_wait_alive(struct iwl_mvm *mvm,
         if (ret) {
                 struct iwl_trans *trans = mvm->trans;
 
+                if (ret == -ETIMEDOUT)
+                        iwl_fw_dbg_error_collect(&mvm->fwrt,
+                                                 FW_DBG_TRIGGER_ALIVE_TIMEOUT);
+
                 if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_22000)
                         IWL_ERR(mvm,
                                 "SecBoot CPU1 Status: 0x%x, CPU2 Status: 0x%x\n",
-                                iwl_read_prph(trans, UMAG_SB_CPU_1_STATUS),
-                                iwl_read_prph(trans, UMAG_SB_CPU_2_STATUS));
+                                iwl_read_umac_prph(trans, UMAG_SB_CPU_1_STATUS),
+                                iwl_read_umac_prph(trans,
+                                                   UMAG_SB_CPU_2_STATUS));
                 else if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_8000)
                         IWL_ERR(mvm,
                                 "SecBoot CPU1 Status: 0x%x, CPU2 Status: 0x%x\n",
@@ -377,7 +394,6 @@ static int iwl_mvm_load_ucode_wait_alive(struct iwl_mvm *mvm,
 #ifdef CONFIG_IWLWIFI_DEBUGFS
         iwl_fw_set_dbg_rec_on(&mvm->fwrt);
 #endif
-        clear_bit(IWL_FWRT_STATUS_WAIT_ALIVE, &mvm->fwrt.status);
 
         return 0;
 }
@@ -403,13 +419,15 @@ static int iwl_run_unified_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
                                    iwl_wait_init_complete,
                                    NULL);
 
+        iwl_fw_dbg_apply_point(&mvm->fwrt, IWL_FW_INI_APPLY_EARLY);
+
         /* Will also start the device */
         ret = iwl_mvm_load_ucode_wait_alive(mvm, IWL_UCODE_REGULAR);
         if (ret) {
                 IWL_ERR(mvm, "Failed to start RT ucode: %d\n", ret);
-                iwl_fw_assert_error_dump(&mvm->fwrt);
                 goto error;
         }
+        iwl_fw_dbg_apply_point(&mvm->fwrt, IWL_FW_INI_APPLY_AFTER_ALIVE);
 
         /* Send init config command to mark that we are sending NVM access
          * commands
@@ -628,10 +646,10 @@ static int iwl_mvm_config_ltr(struct iwl_mvm *mvm)
 }
 
 #ifdef CONFIG_ACPI
-static int iwl_mvm_sar_set_profile(struct iwl_mvm *mvm,
-                                   union acpi_object *table,
-                                   struct iwl_mvm_sar_profile *profile,
-                                   bool enabled)
+static inline int iwl_mvm_sar_set_profile(struct iwl_mvm *mvm,
+                                          union acpi_object *table,
+                                          struct iwl_mvm_sar_profile *profile,
+                                          bool enabled)
 {
         int i;
 
@@ -962,6 +980,57 @@ int iwl_mvm_get_sar_geo_profile(struct iwl_mvm *mvm)
 }
 #endif /* CONFIG_ACPI */
 
+void iwl_mvm_send_recovery_cmd(struct iwl_mvm *mvm, u32 flags)
+{
+        u32 error_log_size = mvm->fw->ucode_capa.error_log_size;
+        int ret;
+        u32 resp;
+
+        struct iwl_fw_error_recovery_cmd recovery_cmd = {
+                .flags = cpu_to_le32(flags),
+                .buf_size = 0,
+        };
+        struct iwl_host_cmd host_cmd = {
+                .id = WIDE_ID(SYSTEM_GROUP, FW_ERROR_RECOVERY_CMD),
+                .flags = CMD_WANT_SKB,
+                .data = {&recovery_cmd, },
+                .len = {sizeof(recovery_cmd), },
+        };
+
+        /* no error log was defined in TLV */
+        if (!error_log_size)
+                return;
+
+        if (flags & ERROR_RECOVERY_UPDATE_DB) {
+                /* no buf was allocated while HW reset */
+                if (!mvm->error_recovery_buf)
+                        return;
+
+                host_cmd.data[1] = mvm->error_recovery_buf;
+                host_cmd.len[1] =  error_log_size;
+                host_cmd.dataflags[1] = IWL_HCMD_DFL_NOCOPY;
+                recovery_cmd.buf_size = cpu_to_le32(error_log_size);
+        }
+
+        ret = iwl_mvm_send_cmd(mvm, &host_cmd);
+        kfree(mvm->error_recovery_buf);
+        mvm->error_recovery_buf = NULL;
+
+        if (ret) {
+                IWL_ERR(mvm, "Failed to send recovery cmd %d\n", ret);
+                return;
+        }
+
+        /* skb respond is only relevant in ERROR_RECOVERY_UPDATE_DB */
+        if (flags & ERROR_RECOVERY_UPDATE_DB) {
+                resp = le32_to_cpu(*(__le32 *)host_cmd.resp_pkt->data);
+                if (resp)
+                        IWL_ERR(mvm,
+                                "Failed to send recovery cmd blob was invalid %d\n",
+                                resp);
+        }
+}
+
 static int iwl_mvm_sar_init(struct iwl_mvm *mvm)
 {
         int ret;
@@ -1052,7 +1121,7 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
         ret = iwl_mvm_load_rt_fw(mvm);
         if (ret) {
                 IWL_ERR(mvm, "Failed to start RT ucode: %d\n", ret);
-                iwl_fw_assert_error_dump(&mvm->fwrt);
+                iwl_fw_dbg_error_collect(&mvm->fwrt, FW_DBG_TRIGGER_DRIVER);
                 goto error;
         }
 
@@ -1198,6 +1267,12 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
         if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
                 iwl_mvm_unref(mvm, IWL_MVM_REF_UCODE_DOWN);
 
+        if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
+                iwl_mvm_send_recovery_cmd(mvm, ERROR_RECOVERY_UPDATE_DB);
+
+        if (iwl_acpi_get_eckv(mvm->dev, &mvm->ext_clock_valid))
+                IWL_DEBUG_INFO(mvm, "ECKV table doesn't exist in BIOS\n");
+
         ret = iwl_mvm_sar_init(mvm);
         if (ret == 0) {
                 ret = iwl_mvm_sar_geo_init(mvm);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/led.c b/drivers/net/wireless/intel/iwlwifi/mvm/led.c
index 9bb1de1cad64..4348bb00e761 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/led.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/led.c
@@ -7,6 +7,7 @@
  *
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2017        Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -28,6 +29,7 @@
  *
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2017        Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -113,6 +115,7 @@ int iwl_mvm_leds_init(struct iwl_mvm *mvm)
         switch (mode) {
         case IWL_LED_BLINK:
                 IWL_ERR(mvm, "Blink led mode not supported, used default\n");
+                /* fall through */
         case IWL_LED_DEFAULT:
         case IWL_LED_RF_STATE:
                 mode = IWL_LED_RF_STATE;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
index 7cfdd07d8736..6a70dece447d 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
@@ -706,8 +706,7 @@ static int iwl_mvm_mac_ctxt_cmd_sta(struct iwl_mvm *mvm,
         if (vif->probe_req_reg && vif->bss_conf.assoc && vif->p2p)
                 cmd.filter_flags |= cpu_to_le32(MAC_FILTER_IN_PROBE_REQUEST);
 
-        if (vif->bss_conf.assoc && vif->bss_conf.he_support &&
-            !iwlwifi_mod_params.disable_11ax) {
+        if (vif->bss_conf.he_support && !iwlwifi_mod_params.disable_11ax) {
                 cmd.filter_flags |= cpu_to_le32(MAC_FILTER_IN_11AX);
                 if (vif->bss_conf.twt_requester)
                         ctxt_sta->data_policy |= cpu_to_le32(TWT_SUPPORTED);
@@ -812,9 +811,9 @@ static int iwl_mvm_mac_ctxt_cmd_p2p_device(struct iwl_mvm *mvm,
         return iwl_mvm_mac_ctxt_send_cmd(mvm, &cmd);
 }
 
-static void iwl_mvm_mac_ctxt_set_tim(struct iwl_mvm *mvm,
-                                     __le32 *tim_index, __le32 *tim_size,
-                                     u8 *beacon, u32 frame_size)
+void iwl_mvm_mac_ctxt_set_tim(struct iwl_mvm *mvm,
+                              __le32 *tim_index, __le32 *tim_size,
+                              u8 *beacon, u32 frame_size)
 {
         u32 tim_idx;
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)beacon;
@@ -854,8 +853,8 @@ static u32 iwl_mvm_find_ie_offset(u8 *beacon, u8 eid, u32 frame_size)
         return ie - beacon;
 }
 
-static u8 iwl_mvm_mac_ctxt_get_lowest_rate(struct ieee80211_tx_info *info,
-                                           struct ieee80211_vif *vif)
+u8 iwl_mvm_mac_ctxt_get_lowest_rate(struct ieee80211_tx_info *info,
+                                    struct ieee80211_vif *vif)
 {
         u8 rate;
 
@@ -905,9 +904,9 @@ static void iwl_mvm_mac_ctxt_set_tx(struct iwl_mvm *mvm,
 
 }
 
-static int iwl_mvm_mac_ctxt_send_beacon_cmd(struct iwl_mvm *mvm,
-                                            struct sk_buff *beacon,
-                                            void *data, int len)
+int iwl_mvm_mac_ctxt_send_beacon_cmd(struct iwl_mvm *mvm,
+                                     struct sk_buff *beacon,
+                                     void *data, int len)
 {
         struct iwl_host_cmd cmd = {
                 .id = BEACON_TEMPLATE_CMD,
@@ -1010,13 +1009,16 @@ static int iwl_mvm_mac_ctxt_send_beacon_v9(struct iwl_mvm *mvm,
                                                 sizeof(beacon_cmd));
 }
 
-static int iwl_mvm_mac_ctxt_send_beacon(struct iwl_mvm *mvm,
-                                        struct ieee80211_vif *vif,
-                                        struct sk_buff *beacon)
+int iwl_mvm_mac_ctxt_send_beacon(struct iwl_mvm *mvm,
+                                 struct ieee80211_vif *vif,
+                                 struct sk_buff *beacon)
 {
         if (WARN_ON(!beacon))
                 return -EINVAL;
 
+        if (IWL_MVM_NON_TRANSMITTING_AP)
+                return 0;
+
         if (!fw_has_capa(&mvm->fw->ucode_capa,
                          IWL_UCODE_TLV_CAPA_CSA_AND_TBTT_OFFLOAD))
                 return iwl_mvm_mac_ctxt_send_beacon_v6(mvm, vif, beacon);
@@ -1042,6 +1044,11 @@ int iwl_mvm_mac_ctxt_beacon_changed(struct iwl_mvm *mvm,
         if (!beacon)
                 return -ENOMEM;
 
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        if (mvm->beacon_inject_active)
+                return -EBUSY;
+#endif
+
         ret = iwl_mvm_mac_ctxt_send_beacon(mvm, vif, beacon);
         dev_kfree_skb(beacon);
         return ret;
@@ -1330,7 +1337,7 @@ void iwl_mvm_rx_beacon_notif(struct iwl_mvm *mvm,
 {
         struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_extended_beacon_notif *beacon = (void *)pkt->data;
-        struct iwl_mvm_tx_resp *beacon_notify_hdr;
+        struct iwl_extended_beacon_notif_v5 *beacon_v5 = (void *)pkt->data;
         struct ieee80211_vif *csa_vif;
         struct ieee80211_vif *tx_blocked_vif;
         struct agg_tx_status *agg_status;
@@ -1338,18 +1345,29 @@ void iwl_mvm_rx_beacon_notif(struct iwl_mvm *mvm,
 
         lockdep_assert_held(&mvm->mutex);
 
-        beacon_notify_hdr = &beacon->beacon_notify_hdr;
         mvm->ap_last_beacon_gp2 = le32_to_cpu(beacon->gp2);
-        mvm->ibss_manager = beacon->ibss_mgr_status != 0;
 
-        agg_status = iwl_mvm_get_agg_status(mvm, beacon_notify_hdr);
-        status = le16_to_cpu(agg_status->status) & TX_STATUS_MSK;
-        IWL_DEBUG_RX(mvm,
-                     "beacon status %#x retries:%d tsf:0x%016llX gp2:0x%X rate:%d\n",
-                     status, beacon_notify_hdr->failure_frame,
-                     le64_to_cpu(beacon->tsf),
-                     mvm->ap_last_beacon_gp2,
-                     le32_to_cpu(beacon_notify_hdr->initial_rate));
+        if (!iwl_mvm_is_short_beacon_notif_supported(mvm)) {
+                struct iwl_mvm_tx_resp *beacon_notify_hdr =
+                        &beacon_v5->beacon_notify_hdr;
+
+                mvm->ibss_manager = beacon_v5->ibss_mgr_status != 0;
+                agg_status = iwl_mvm_get_agg_status(mvm, beacon_notify_hdr);
+                status = le16_to_cpu(agg_status->status) & TX_STATUS_MSK;
+                IWL_DEBUG_RX(mvm,
+                             "beacon status %#x retries:%d tsf:0x%016llX gp2:0x%X rate:%d\n",
+                             status, beacon_notify_hdr->failure_frame,
+                             le64_to_cpu(beacon->tsf),
+                             mvm->ap_last_beacon_gp2,
+                             le32_to_cpu(beacon_notify_hdr->initial_rate));
+        } else {
+                mvm->ibss_manager = beacon->ibss_mgr_status != 0;
+                status = le32_to_cpu(beacon->status) & TX_STATUS_MSK;
+                IWL_DEBUG_RX(mvm,
+                             "beacon status %#x tsf:0x%016llX gp2:0x%X\n",
+                             status, le64_to_cpu(beacon->tsf),
+                             mvm->ap_last_beacon_gp2);
+        }
 
         csa_vif = rcu_dereference_protected(mvm->csa_vif,
                                             lockdep_is_held(&mvm->mutex));
@@ -1539,42 +1557,58 @@ void iwl_mvm_channel_switch_noa_notif(struct iwl_mvm *mvm,
 {
         struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_channel_switch_noa_notif *notif = (void *)pkt->data;
-        struct ieee80211_vif *csa_vif;
+        struct ieee80211_vif *csa_vif, *vif;
         struct iwl_mvm_vif *mvmvif;
         int len = iwl_rx_packet_payload_len(pkt);
-        u32 id_n_color;
+        u32 id_n_color, csa_id, mac_id;
 
         if (WARN_ON_ONCE(len < sizeof(*notif)))
                 return;
 
-        rcu_read_lock();
-
-        csa_vif = rcu_dereference(mvm->csa_vif);
-        if (WARN_ON(!csa_vif || !csa_vif->csa_active))
-                goto out_unlock;
-
         id_n_color = le32_to_cpu(notif->id_and_color);
+        mac_id = id_n_color & FW_CTXT_ID_MSK;
 
-        mvmvif = iwl_mvm_vif_from_mac80211(csa_vif);
-        if (WARN(FW_CMD_ID_AND_COLOR(mvmvif->id, mvmvif->color) != id_n_color,
-                 "channel switch noa notification on unexpected vif (csa_vif=%d, notif=%d)",
-                 FW_CMD_ID_AND_COLOR(mvmvif->id, mvmvif->color), id_n_color))
-                goto out_unlock;
+        if (WARN_ON_ONCE(mac_id >= NUM_MAC_INDEX_DRIVER))
+                return;
 
-        IWL_DEBUG_INFO(mvm, "Channel Switch Started Notification\n");
+        rcu_read_lock();
+        vif = rcu_dereference(mvm->vif_id_to_mac[mac_id]);
 
-        schedule_delayed_work(&mvm->cs_tx_unblock_dwork,
-                              msecs_to_jiffies(IWL_MVM_CS_UNBLOCK_TX_TIMEOUT *
-                                               csa_vif->bss_conf.beacon_int));
+        switch (vif->type) {
+        case NL80211_IFTYPE_AP:
+                csa_vif = rcu_dereference(mvm->csa_vif);
+                if (WARN_ON(!csa_vif || !csa_vif->csa_active ||
+                            csa_vif != vif))
+                        goto out_unlock;
 
-        ieee80211_csa_finish(csa_vif);
+                mvmvif = iwl_mvm_vif_from_mac80211(csa_vif);
+                csa_id = FW_CMD_ID_AND_COLOR(mvmvif->id, mvmvif->color);
+                if (WARN(csa_id != id_n_color,
+                         "channel switch noa notification on unexpected vif (csa_vif=%d, notif=%d)",
+                         csa_id, id_n_color))
+                        goto out_unlock;
 
-        rcu_read_unlock();
+                IWL_DEBUG_INFO(mvm, "Channel Switch Started Notification\n");
 
-        RCU_INIT_POINTER(mvm->csa_vif, NULL);
+                schedule_delayed_work(&mvm->cs_tx_unblock_dwork,
+                                      msecs_to_jiffies(IWL_MVM_CS_UNBLOCK_TX_TIMEOUT *
+                                                       csa_vif->bss_conf.beacon_int));
 
-        return;
+                ieee80211_csa_finish(csa_vif);
 
+                rcu_read_unlock();
+
+                RCU_INIT_POINTER(mvm->csa_vif, NULL);
+                return;
+        case NL80211_IFTYPE_STATION:
+                iwl_mvm_csa_client_absent(mvm, vif);
+                ieee80211_chswitch_done(vif, true);
+                break;
+        default:
+                /* should never happen */
+                WARN_ON_ONCE(1);
+                break;
+        }
 out_unlock:
         rcu_read_unlock();
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index e098884dd915..3a92c09d4692 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -184,6 +184,29 @@ static const struct iwl_fw_bcast_filter iwl_mvm_default_bcast_filters[] = {
 };
 #endif
 
+static const struct cfg80211_pmsr_capabilities iwl_mvm_pmsr_capa = {
+        .max_peers = IWL_MVM_TOF_MAX_APS,
+        .report_ap_tsf = 1,
+        .randomize_mac_addr = 1,
+
+        .ftm = {
+                .supported = 1,
+                .asap = 1,
+                .non_asap = 1,
+                .request_lci = 1,
+                .request_civicloc = 1,
+                .max_bursts_exponent = -1, /* all supported */
+                .max_ftms_per_burst = 0, /* no limits */
+                .bandwidths = BIT(NL80211_CHAN_WIDTH_20_NOHT) |
+                              BIT(NL80211_CHAN_WIDTH_20) |
+                              BIT(NL80211_CHAN_WIDTH_40) |
+                              BIT(NL80211_CHAN_WIDTH_80),
+                .preambles = BIT(NL80211_PREAMBLE_LEGACY) |
+                             BIT(NL80211_PREAMBLE_HT) |
+                             BIT(NL80211_PREAMBLE_VHT),
+        },
+};
+
 void iwl_mvm_ref(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type)
 {
         if (!iwl_mvm_is_d0i3_supported(mvm))
@@ -420,6 +443,10 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
                 WLAN_CIPHER_SUITE_TKIP,
                 WLAN_CIPHER_SUITE_CCMP,
         };
+#ifdef CONFIG_PM_SLEEP
+        bool unified = fw_has_capa(&mvm->fw->ucode_capa,
+                                   IWL_UCODE_TLV_CAPA_CNSLDTD_D3_D0_IMG);
+#endif
 
         /* Tell mac80211 our characteristics */
         ieee80211_hw_set(hw, SIGNAL_DBM);
@@ -544,6 +571,13 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
                 hw->wiphy->n_cipher_suites++;
         }
 
+        if (fw_has_capa(&mvm->fw->ucode_capa,
+                        IWL_UCODE_TLV_CAPA_FTM_CALIBRATED)) {
+                wiphy_ext_feature_set(hw->wiphy,
+                                      NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER);
+                hw->wiphy->pmsr_capa = &iwl_mvm_pmsr_capa;
+        }
+
         ieee80211_hw_set(hw, SINGLE_SCAN_ON_ALL_BANDS);
         hw->wiphy->features |=
                 NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR |
@@ -709,7 +743,7 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
                 hw->wiphy->wowlan = &mvm->wowlan;
         }
 
-        if (mvm->fw->img[IWL_UCODE_WOWLAN].num_sec &&
+        if ((unified || mvm->fw->img[IWL_UCODE_WOWLAN].num_sec) &&
             mvm->trans->ops->d3_suspend &&
             mvm->trans->ops->d3_resume &&
             device_can_wakeup(mvm->trans->dev)) {
@@ -762,15 +796,15 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
                         hw->netdev_features |= IWL_TX_CSUM_NETIF_FLAGS;
         }
 
-        ret = ieee80211_register_hw(mvm->hw);
-        if (ret)
-                iwl_mvm_leds_exit(mvm);
-        mvm->init_status |= IWL_MVM_INIT_STATUS_REG_HW_INIT_COMPLETE;
-
         if (mvm->cfg->vht_mu_mimo_supported)
                 wiphy_ext_feature_set(hw->wiphy,
                                       NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER);
 
+        ret = ieee80211_register_hw(mvm->hw);
+        if (ret) {
+                iwl_mvm_leds_exit(mvm);
+        }
+
         return ret;
 }
 
@@ -907,8 +941,14 @@ void iwl_mvm_mac_itxq_xmit(struct ieee80211_hw *hw, struct ieee80211_txq *txq)
                                IWL_PLAT_PM_MODE_DISABLED))) {
                         skb = ieee80211_tx_dequeue(hw, txq);
 
-                        if (!skb)
+                        if (!skb) {
+                                if (txq->sta)
+                                        IWL_DEBUG_TX(mvm,
+                                                     "TXQ of sta %pM tid %d is now empty\n",
+                                                     txq->sta->addr,
+                                                     txq->tid);
                                 break;
+                        }
 
                         if (!txq->sta)
                                 iwl_mvm_tx_skb_non_sta(mvm, skb);
@@ -1177,6 +1217,8 @@ static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
         iwl_mvm_cleanup_roc_te(mvm);
         ieee80211_remain_on_channel_expired(mvm->hw);
 
+        iwl_mvm_ftm_restart(mvm);
+
         /*
          * cleanup all interfaces, even inactive ones, as some might have
          * gone down during the HW restart
@@ -1290,6 +1332,8 @@ static void iwl_mvm_restart_complete(struct iwl_mvm *mvm)
         /* allow transport/FW low power modes */
         iwl_mvm_unref(mvm, IWL_MVM_REF_UCODE_DOWN);
 
+        iwl_mvm_send_recovery_cmd(mvm, ERROR_RECOVERY_END_OF_RECOVERY);
+
         /*
          * If we have TDLS peers, remove them. We don't know the last seqno/PN
          * of packets the FW sent out, so we must reconnect.
@@ -1653,6 +1697,9 @@ static void iwl_mvm_mac_remove_interface(struct ieee80211_hw *hw,
                                        IEEE80211_VIF_SUPPORTS_CQM_RSSI);
         }
 
+        if (vif->bss_conf.ftm_responder)
+                memset(&mvm->ftm_resp_stats, 0, sizeof(mvm->ftm_resp_stats));
+
         iwl_mvm_vif_dbgfs_clean(mvm, vif);
 
         /*
@@ -2363,7 +2410,10 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
                          * If update fails - SF might be running in associated
                          * mode while disassociated - which is forbidden.
                          */
-                        WARN_ONCE(iwl_mvm_sf_update(mvm, vif, false),
+                        ret = iwl_mvm_sf_update(mvm, vif, false);
+                        WARN_ONCE(ret &&
+                                  !test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
+                                            &mvm->status),
                                   "Failed to update SF upon disassociation\n");
 
                         /*
@@ -2584,6 +2634,8 @@ static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
         if (iwl_mvm_phy_ctx_count(mvm) > 1)
                 iwl_mvm_teardown_tdls_peers(mvm);
 
+        iwl_mvm_ftm_restart_responder(mvm, vif);
+
         goto out_unlock;
 
 out_quota_failed:
@@ -2695,6 +2747,15 @@ iwl_mvm_bss_info_changed_ap_ibss(struct iwl_mvm *mvm,
                                 bss_conf->txpower);
                 iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
         }
+
+        if (changes & BSS_CHANGED_FTM_RESPONDER) {
+                int ret = iwl_mvm_ftm_start_responder(mvm, vif);
+
+                if (ret)
+                        IWL_WARN(mvm, "Failed to enable FTM responder (%d)\n",
+                                 ret);
+        }
+
 }
 
 static void iwl_mvm_bss_info_changed(struct ieee80211_hw *hw,
@@ -3106,11 +3167,15 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
         } else if (old_state == IEEE80211_STA_AUTH &&
                    new_state == IEEE80211_STA_ASSOC) {
                 if (vif->type == NL80211_IFTYPE_AP) {
+                        vif->bss_conf.he_support = sta->he_cap.has_he;
                         mvmvif->ap_assoc_sta_count++;
                         iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
                         if (vif->bss_conf.he_support &&
                             !iwlwifi_mod_params.disable_11ax)
                                 iwl_mvm_cfg_he_sta(mvm, vif, mvm_sta->sta_id);
+                } else if (vif->type == NL80211_IFTYPE_STATION) {
+                        vif->bss_conf.he_support = sta->he_cap.has_he;
+                        iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
                 }
 
                 iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
@@ -3118,6 +3183,24 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
                 ret = iwl_mvm_update_sta(mvm, vif, sta);
         } else if (old_state == IEEE80211_STA_ASSOC &&
                    new_state == IEEE80211_STA_AUTHORIZED) {
+                /* if wep is used, need to set the key for the station now */
+                if (vif->type == NL80211_IFTYPE_AP && mvmvif->ap_wep_key) {
+                        mvm_sta->wep_key =
+                                kmemdup(mvmvif->ap_wep_key,
+                                        sizeof(*mvmvif->ap_wep_key) +
+                                        mvmvif->ap_wep_key->keylen,
+                                        GFP_KERNEL);
+                        if (!mvm_sta->wep_key) {
+                                ret = -ENOMEM;
+                                goto out_unlock;
+                        }
+
+                        ret = iwl_mvm_set_sta_key(mvm, vif, sta,
+                                                  mvm_sta->wep_key,
+                                                  STA_KEY_IDX_INVALID);
+                } else {
+                        ret = 0;
+                }
 
                 /* we don't support TDLS during DCM */
                 if (iwl_mvm_phy_ctx_count(mvm) > 1)
@@ -3132,18 +3215,13 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
 
                 iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
                                      true);
-
-                /* if wep is used, need to set the key for the station now */
-                if (vif->type == NL80211_IFTYPE_AP && mvmvif->ap_wep_key)
-                        ret = iwl_mvm_set_sta_key(mvm, vif, sta,
-                                                  mvmvif->ap_wep_key,
-                                                  STA_KEY_IDX_INVALID);
-                else
-                        ret = 0;
         } else if (old_state == IEEE80211_STA_AUTHORIZED &&
                    new_state == IEEE80211_STA_ASSOC) {
                 /* disable beacon filtering */
-                WARN_ON(iwl_mvm_disable_beacon_filter(mvm, vif, 0));
+                ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
+                WARN_ON(ret &&
+                        !test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
+                                  &mvm->status));
                 ret = 0;
         } else if (old_state == IEEE80211_STA_ASSOC &&
                    new_state == IEEE80211_STA_AUTH) {
@@ -3167,12 +3245,18 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
                 /* Remove STA key if this is an AP using WEP */
                 if (vif->type == NL80211_IFTYPE_AP && mvmvif->ap_wep_key) {
                         int rm_ret = iwl_mvm_remove_sta_key(mvm, vif, sta,
-                                                            mvmvif->ap_wep_key);
+                                                            mvm_sta->wep_key);
 
                         if (!ret)
                                 ret = rm_ret;
+                        kfree(mvm_sta->wep_key);
+                        mvm_sta->wep_key = NULL;
                 }
 
+                if (unlikely(ret &&
+                             test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
+                                      &mvm->status)))
+                        ret = 0;
         } else {
                 ret = -EIO;
         }
@@ -3816,11 +3900,43 @@ static int iwl_mvm_cancel_roc(struct ieee80211_hw *hw)
         return 0;
 }
 
+struct iwl_mvm_ftm_responder_iter_data {
+        bool responder;
+        struct ieee80211_chanctx_conf *ctx;
+};
+
+static void iwl_mvm_ftm_responder_chanctx_iter(void *_data, u8 *mac,
+                                               struct ieee80211_vif *vif)
+{
+        struct iwl_mvm_ftm_responder_iter_data *data = _data;
+
+        if (rcu_access_pointer(vif->chanctx_conf) == data->ctx &&
+            vif->type == NL80211_IFTYPE_AP && vif->bss_conf.ftmr_params)
+                data->responder = true;
+}
+
+static bool iwl_mvm_is_ftm_responder_chanctx(struct iwl_mvm *mvm,
+                                             struct ieee80211_chanctx_conf *ctx)
+{
+        struct iwl_mvm_ftm_responder_iter_data data = {
+                .responder = false,
+                .ctx = ctx,
+        };
+
+        ieee80211_iterate_active_interfaces_atomic(mvm->hw,
+                                        IEEE80211_IFACE_ITER_NORMAL,
+                                        iwl_mvm_ftm_responder_chanctx_iter,
+                                        &data);
+        return data.responder;
+}
+
 static int __iwl_mvm_add_chanctx(struct iwl_mvm *mvm,
                                  struct ieee80211_chanctx_conf *ctx)
 {
         u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
         struct iwl_mvm_phy_ctxt *phy_ctxt;
+        bool responder = iwl_mvm_is_ftm_responder_chanctx(mvm, ctx);
+        struct cfg80211_chan_def *def = responder ? &ctx->def : &ctx->min_def;
         int ret;
 
         lockdep_assert_held(&mvm->mutex);
@@ -3833,7 +3949,7 @@ static int __iwl_mvm_add_chanctx(struct iwl_mvm *mvm,
                 goto out;
         }
 
-        ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &ctx->min_def,
+        ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, def,
                                        ctx->rx_chains_static,
                                        ctx->rx_chains_dynamic);
         if (ret) {
@@ -3888,6 +4004,8 @@ static void iwl_mvm_change_chanctx(struct ieee80211_hw *hw,
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
         u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
         struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
+        bool responder = iwl_mvm_is_ftm_responder_chanctx(mvm, ctx);
+        struct cfg80211_chan_def *def = responder ? &ctx->def : &ctx->min_def;
 
         if (WARN_ONCE((phy_ctxt->ref > 1) &&
                       (changed & ~(IEEE80211_CHANCTX_CHANGE_WIDTH |
@@ -3902,17 +4020,17 @@ static void iwl_mvm_change_chanctx(struct ieee80211_hw *hw,
 
         /* we are only changing the min_width, may be a noop */
         if (changed == IEEE80211_CHANCTX_CHANGE_MIN_WIDTH) {
-                if (phy_ctxt->width == ctx->min_def.width)
+                if (phy_ctxt->width == def->width)
                         goto out_unlock;
 
                 /* we are just toggling between 20_NOHT and 20 */
                 if (phy_ctxt->width <= NL80211_CHAN_WIDTH_20 &&
-                    ctx->min_def.width <= NL80211_CHAN_WIDTH_20)
+                    def->width <= NL80211_CHAN_WIDTH_20)
                         goto out_unlock;
         }
 
         iwl_mvm_bt_coex_vif_change(mvm);
-        iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &ctx->min_def,
+        iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, def,
                                  ctx->rx_chains_static,
                                  ctx->rx_chains_dynamic);
 
@@ -3941,6 +4059,7 @@ static int __iwl_mvm_assign_vif_chanctx(struct iwl_mvm *mvm,
                         mvmvif->ap_ibss_active = true;
                         break;
                 }
+                /* fall through */
         case NL80211_IFTYPE_ADHOC:
                 /*
                  * The AP binding flow is handled as part of the start_ap flow
@@ -3993,25 +4112,30 @@ static int __iwl_mvm_assign_vif_chanctx(struct iwl_mvm *mvm,
         }
 
         if (switching_chanctx && vif->type == NL80211_IFTYPE_STATION) {
-                u32 duration = 3 * vif->bss_conf.beacon_int;
+                mvmvif->csa_bcn_pending = true;
 
-                /* iwl_mvm_protect_session() reads directly from the
-                 * device (the system time), so make sure it is
-                 * available.
-                 */
-                ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_PROTECT_CSA);
-                if (ret)
-                        goto out_remove_binding;
+                if (!fw_has_capa(&mvm->fw->ucode_capa,
+                                 IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD)) {
+                        u32 duration = 3 * vif->bss_conf.beacon_int;
 
-                /* Protect the session to make sure we hear the first
-                 * beacon on the new channel.
-                 */
-                mvmvif->csa_bcn_pending = true;
-                iwl_mvm_protect_session(mvm, vif, duration, duration,
-                                        vif->bss_conf.beacon_int / 2,
-                                        true);
 
-                iwl_mvm_unref(mvm, IWL_MVM_REF_PROTECT_CSA);
+                        /* iwl_mvm_protect_session() reads directly from the
+                         * device (the system time), so make sure it is
+                         * available.
+                         */
+                        ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_PROTECT_CSA);
+                        if (ret)
+                                goto out_remove_binding;
+
+                        /* Protect the session to make sure we hear the first
+                         * beacon on the new channel.
+                         */
+                        iwl_mvm_protect_session(mvm, vif, duration, duration,
+                                                vif->bss_conf.beacon_int / 2,
+                                                true);
+
+                        iwl_mvm_unref(mvm, IWL_MVM_REF_PROTECT_CSA);
+                }
 
                 iwl_mvm_update_quotas(mvm, false, NULL);
         }
@@ -4081,7 +4205,9 @@ static void __iwl_mvm_unassign_vif_chanctx(struct iwl_mvm *mvm,
 
                 disabled_vif = vif;
 
-                iwl_mvm_mac_ctxt_changed(mvm, vif, true, NULL);
+                if (!fw_has_capa(&mvm->fw->ucode_capa,
+                                 IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD))
+                        iwl_mvm_mac_ctxt_changed(mvm, vif, true, NULL);
                 break;
         default:
                 break;
@@ -4332,6 +4458,27 @@ static void iwl_mvm_channel_switch(struct ieee80211_hw *hw,
                            "dummy channel switch op\n");
 }
 
+static int iwl_mvm_schedule_client_csa(struct iwl_mvm *mvm,
+                                       struct ieee80211_vif *vif,
+                                       struct ieee80211_channel_switch *chsw)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct iwl_chan_switch_te_cmd cmd = {
+                .mac_id = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
+                                                          mvmvif->color)),
+                .action = cpu_to_le32(FW_CTXT_ACTION_ADD),
+                .tsf = cpu_to_le32(chsw->timestamp),
+                .cs_count = chsw->count,
+        };
+
+        lockdep_assert_held(&mvm->mutex);
+
+        return iwl_mvm_send_cmd_pdu(mvm,
+                                    WIDE_ID(MAC_CONF_GROUP,
+                                            CHANNEL_SWITCH_TIME_EVENT_CMD),
+                                    0, sizeof(cmd), &cmd);
+}
+
 static int iwl_mvm_pre_channel_switch(struct ieee80211_hw *hw,
                                       struct ieee80211_vif *vif,
                                       struct ieee80211_channel_switch *chsw)
@@ -4399,14 +4546,19 @@ static int iwl_mvm_pre_channel_switch(struct ieee80211_hw *hw,
                 if (chsw->block_tx)
                         iwl_mvm_csa_client_absent(mvm, vif);
 
-                iwl_mvm_schedule_csa_period(mvm, vif, vif->bss_conf.beacon_int,
-                                            apply_time);
                 if (mvmvif->bf_data.bf_enabled) {
                         ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
                         if (ret)
                                 goto out_unlock;
                 }
 
+                if (fw_has_capa(&mvm->fw->ucode_capa,
+                                IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD))
+                        iwl_mvm_schedule_client_csa(mvm, vif, chsw);
+                else
+                        iwl_mvm_schedule_csa_period(mvm, vif,
+                                                    vif->bss_conf.beacon_int,
+                                                    apply_time);
                 break;
         default:
                 break;
@@ -4799,6 +4951,60 @@ static void iwl_mvm_sync_rx_queues(struct ieee80211_hw *hw)
         mutex_unlock(&mvm->mutex);
 }
 
+static int
+iwl_mvm_mac_get_ftm_responder_stats(struct ieee80211_hw *hw,
+                                    struct ieee80211_vif *vif,
+                                    struct cfg80211_ftm_responder_stats *stats)
+{
+        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+
+        if (vif->p2p || vif->type != NL80211_IFTYPE_AP ||
+            !mvmvif->ap_ibss_active || !vif->bss_conf.ftm_responder)
+                return -EINVAL;
+
+        mutex_lock(&mvm->mutex);
+        *stats = mvm->ftm_resp_stats;
+        mutex_unlock(&mvm->mutex);
+
+        stats->filled = BIT(NL80211_FTM_STATS_SUCCESS_NUM) |
+                        BIT(NL80211_FTM_STATS_PARTIAL_NUM) |
+                        BIT(NL80211_FTM_STATS_FAILED_NUM) |
+                        BIT(NL80211_FTM_STATS_ASAP_NUM) |
+                        BIT(NL80211_FTM_STATS_NON_ASAP_NUM) |
+                        BIT(NL80211_FTM_STATS_TOTAL_DURATION_MSEC) |
+                        BIT(NL80211_FTM_STATS_UNKNOWN_TRIGGERS_NUM) |
+                        BIT(NL80211_FTM_STATS_RESCHEDULE_REQUESTS_NUM) |
+                        BIT(NL80211_FTM_STATS_OUT_OF_WINDOW_TRIGGERS_NUM);
+
+        return 0;
+}
+
+static int iwl_mvm_start_pmsr(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif,
+                              struct cfg80211_pmsr_request *request)
+{
+        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+        int ret;
+
+        mutex_lock(&mvm->mutex);
+        ret = iwl_mvm_ftm_start(mvm, vif, request);
+        mutex_unlock(&mvm->mutex);
+
+        return ret;
+}
+
+static void iwl_mvm_abort_pmsr(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif,
+                               struct cfg80211_pmsr_request *request)
+{
+        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+
+        mutex_lock(&mvm->mutex);
+        iwl_mvm_ftm_abort(mvm, request);
+        mutex_unlock(&mvm->mutex);
+}
+
 static bool iwl_mvm_can_hw_csum(struct sk_buff *skb)
 {
         u8 protocol = ip_hdr(skb)->protocol;
@@ -4901,6 +5107,10 @@ const struct ieee80211_ops iwl_mvm_hw_ops = {
 #endif
         .get_survey = iwl_mvm_mac_get_survey,
         .sta_statistics = iwl_mvm_mac_sta_statistics,
+        .get_ftm_responder_stats = iwl_mvm_mac_get_ftm_responder_stats,
+        .start_pmsr = iwl_mvm_start_pmsr,
+        .abort_pmsr = iwl_mvm_abort_pmsr,
+
         .can_aggregate_in_amsdu = iwl_mvm_mac_can_aggregate,
 #ifdef CONFIG_IWLWIFI_DEBUGFS
         .sta_add_debugfs = iwl_mvm_sta_add_debugfs,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index 12e9ecc3ee27..bca6f6b536d9 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -879,9 +879,6 @@ struct iwl_mvm {
 
         bool hw_registered;
         bool calibrating;
-        u32 error_event_table[2];
-        u32 log_event_table;
-        u32 umac_error_event_table;
         bool support_umac_log;
 
         u32 ampdu_ref;
@@ -981,6 +978,7 @@ struct iwl_mvm {
         u32 dbgfs_prph_reg_addr;
         bool disable_power_off;
         bool disable_power_off_d3;
+        bool beacon_inject_active;
 
         bool scan_iter_notif_enabled;
 
@@ -1017,6 +1015,7 @@ struct iwl_mvm {
 
         /* -1 for always, 0 for never, >0 for that many times */
         s8 fw_restart;
+        u8 *error_recovery_buf;
 
 #ifdef CONFIG_IWLWIFI_LEDS
         struct led_classdev led;
@@ -1106,6 +1105,8 @@ struct iwl_mvm {
 
         /* Indicate if device power save is allowed */
         u8 ps_disabled; /* u8 instead of bool to ease debugfs_create_* usage */
+        /* Indicate if 32Khz external clock is valid */
+        u32 ext_clock_valid;
         unsigned int max_amsdu_len; /* used for debugfs only */
 
         struct ieee80211_vif __rcu *csa_vif;
@@ -1150,6 +1151,14 @@ struct iwl_mvm {
         u32 ciphers[IWL_MVM_NUM_CIPHERS];
         struct ieee80211_cipher_scheme cs[IWL_UCODE_MAX_CS];
 
+        struct cfg80211_ftm_responder_stats ftm_resp_stats;
+        struct {
+                struct cfg80211_pmsr_request *req;
+                struct wireless_dev *req_wdev;
+                struct list_head loc_list;
+                int responses[IWL_MVM_TOF_MAX_APS];
+        } ftm_initiator;
+
         struct ieee80211_vif *nan_vif;
 #define IWL_MAX_BAID    32
         struct iwl_mvm_baid_data __rcu *baid_map[IWL_MAX_BAID];
@@ -1167,6 +1176,7 @@ struct iwl_mvm {
 
         /* sniffer data to include in radiotap */
         __le16 cur_aid;
+        u8 cur_bssid[ETH_ALEN];
 
 #ifdef CONFIG_ACPI
         struct iwl_mvm_sar_profile sar_profiles[ACPI_SAR_PROFILE_NUM];
@@ -1211,7 +1221,6 @@ enum iwl_mvm_status {
 enum iwl_mvm_init_status {
         IWL_MVM_INIT_STATUS_THERMAL_INIT_COMPLETE = BIT(0),
         IWL_MVM_INIT_STATUS_LEDS_INIT_COMPLETE = BIT(1),
-        IWL_MVM_INIT_STATUS_REG_HW_INIT_COMPLETE = BIT(2),
 };
 
 static inline bool iwl_mvm_is_radio_killed(struct iwl_mvm *mvm)
@@ -1311,6 +1320,12 @@ static inline bool iwl_mvm_is_frag_ebs_supported(struct iwl_mvm *mvm)
         return fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_FRAG_EBS);
 }
 
+static inline bool iwl_mvm_is_short_beacon_notif_supported(struct iwl_mvm *mvm)
+{
+        return fw_has_api(&mvm->fw->ucode_capa,
+                          IWL_UCODE_TLV_API_SHORT_BEACON_NOTIF);
+}
+
 static inline bool iwl_mvm_enter_d0i3_on_suspend(struct iwl_mvm *mvm)
 {
         /* For now we only use this mode to differentiate between
@@ -1646,6 +1661,7 @@ void iwl_mvm_rx_queue_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
 void iwl_mvm_rx_tx_cmd(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb);
 void iwl_mvm_mfu_assert_dump_notif(struct iwl_mvm *mvm,
                                    struct iwl_rx_cmd_buffer *rxb);
+void iwl_mvm_send_recovery_cmd(struct iwl_mvm *mvm, u32 flags);
 void iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb);
 void iwl_mvm_rx_ant_coupling_notif(struct iwl_mvm *mvm,
                                    struct iwl_rx_cmd_buffer *rxb);
@@ -1680,6 +1696,17 @@ int iwl_mvm_mac_ctxt_changed(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 int iwl_mvm_mac_ctxt_remove(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
 int iwl_mvm_mac_ctxt_beacon_changed(struct iwl_mvm *mvm,
                                     struct ieee80211_vif *vif);
+int iwl_mvm_mac_ctxt_send_beacon(struct iwl_mvm *mvm,
+                                 struct ieee80211_vif *vif,
+                                 struct sk_buff *beacon);
+int iwl_mvm_mac_ctxt_send_beacon_cmd(struct iwl_mvm *mvm,
+                                     struct sk_buff *beacon,
+                                     void *data, int len);
+u8 iwl_mvm_mac_ctxt_get_lowest_rate(struct ieee80211_tx_info *info,
+                                    struct ieee80211_vif *vif);
+void iwl_mvm_mac_ctxt_set_tim(struct iwl_mvm *mvm,
+                              __le32 *tim_index, __le32 *tim_size,
+                              u8 *beacon, u32 frame_size);
 void iwl_mvm_rx_beacon_notif(struct iwl_mvm *mvm,
                              struct iwl_rx_cmd_buffer *rxb);
 void iwl_mvm_rx_missed_beacons_notif(struct iwl_mvm *mvm,
@@ -2007,15 +2034,12 @@ static inline void iwl_mvm_stop_device(struct iwl_mvm *mvm)
                                &mvm->status))
                 iwl_fw_dbg_collect_desc(&mvm->fwrt, &iwl_dump_desc_assert,
                                         false, 0);
-        /* calling this function without using dump_start/end since at this
-         * point we already hold the op mode mutex
-         */
-        iwl_fw_dbg_collect_sync(&mvm->fwrt);
+
         iwl_fw_cancel_timestamp(&mvm->fwrt);
-        iwl_free_fw_paging(&mvm->fwrt);
         clear_bit(IWL_MVM_STATUS_FIRMWARE_RUNNING, &mvm->status);
+        iwl_fwrt_stop_device(&mvm->fwrt);
+        iwl_free_fw_paging(&mvm->fwrt);
         iwl_fw_dump_conf_clear(&mvm->fwrt);
-        iwl_trans_stop_device(mvm->trans);
 }
 
 /* Re-configure the SCD for a queue that has already been configured */
@@ -2057,6 +2081,23 @@ void iwl_mvm_update_changed_regdom(struct iwl_mvm *mvm);
 int iwl_mvm_sf_update(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                       bool added_vif);
 
+/* FTM responder */
+int iwl_mvm_ftm_start_responder(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
+void iwl_mvm_ftm_restart_responder(struct iwl_mvm *mvm,
+                                   struct ieee80211_vif *vif);
+void iwl_mvm_ftm_responder_stats(struct iwl_mvm *mvm,
+                                 struct iwl_rx_cmd_buffer *rxb);
+
+/* FTM initiator */
+void iwl_mvm_ftm_restart(struct iwl_mvm *mvm);
+void iwl_mvm_ftm_range_resp(struct iwl_mvm *mvm,
+                            struct iwl_rx_cmd_buffer *rxb);
+void iwl_mvm_ftm_lc_notif(struct iwl_mvm *mvm,
+                          struct iwl_rx_cmd_buffer *rxb);
+int iwl_mvm_ftm_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                      struct cfg80211_pmsr_request *request);
+void iwl_mvm_ftm_abort(struct iwl_mvm *mvm, struct cfg80211_pmsr_request *req);
+
 /* TDLS */
 
 /*
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index 5e4f8b767d10..ba27dce4c2bb 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -82,7 +82,6 @@
 #include "fw/api/scan.h"
 #include "time-event.h"
 #include "fw-api.h"
-#include "fw/api/scan.h"
 #include "fw/acpi.h"
 
 #define DRV_DESCRIPTION "The new Intel(R) wireless AGN driver for Linux"
@@ -301,6 +300,14 @@ static const struct iwl_rx_handlers iwl_mvm_rx_handlers[] = {
                    RX_HANDLER_ASYNC_LOCKED),
         RX_HANDLER(MFUART_LOAD_NOTIFICATION, iwl_mvm_rx_mfuart_notif,
                    RX_HANDLER_SYNC),
+        RX_HANDLER_GRP(LOCATION_GROUP, TOF_RESPONDER_STATS,
+                       iwl_mvm_ftm_responder_stats, RX_HANDLER_ASYNC_LOCKED),
+
+        RX_HANDLER_GRP(LOCATION_GROUP, TOF_RANGE_RESPONSE_NOTIF,
+                       iwl_mvm_ftm_range_resp, RX_HANDLER_ASYNC_LOCKED),
+        RX_HANDLER_GRP(LOCATION_GROUP, TOF_LC_NOTIF,
+                       iwl_mvm_ftm_lc_notif, RX_HANDLER_ASYNC_LOCKED),
+
         RX_HANDLER_GRP(DEBUG_GROUP, MFU_ASSERT_DUMP_NTF,
                        iwl_mvm_mfu_assert_dump_notif, RX_HANDLER_SYNC),
         RX_HANDLER_GRP(PROT_OFFLOAD_GROUP, STORED_BEACON_NTF,
@@ -415,12 +422,14 @@ static const struct iwl_hcmd_names iwl_mvm_legacy_names[] = {
 static const struct iwl_hcmd_names iwl_mvm_system_names[] = {
         HCMD_NAME(SHARED_MEM_CFG_CMD),
         HCMD_NAME(INIT_EXTENDED_CFG_CMD),
+        HCMD_NAME(FW_ERROR_RECOVERY_CMD),
 };
 
 /* Please keep this array *SORTED* by hex value.
  * Access is done through binary search
  */
 static const struct iwl_hcmd_names iwl_mvm_mac_conf_names[] = {
+        HCMD_NAME(CHANNEL_SWITCH_TIME_EVENT_CMD),
         HCMD_NAME(CHANNEL_SWITCH_NOA_NOTIF),
 };
 
@@ -445,6 +454,7 @@ static const struct iwl_hcmd_names iwl_mvm_data_path_names[] = {
         HCMD_NAME(TRIGGER_RX_QUEUES_NOTIF_CMD),
         HCMD_NAME(STA_HE_CTXT_CMD),
         HCMD_NAME(RFH_QUEUE_CONFIG_CMD),
+        HCMD_NAME(TLC_MNG_CONFIG_CMD),
         HCMD_NAME(CHEST_COLLECTOR_FILTER_CONFIG_CMD),
         HCMD_NAME(STA_PM_NOTIF),
         HCMD_NAME(MU_GROUP_MGMT_NOTIF),
@@ -591,11 +601,17 @@ static int iwl_mvm_fwrt_send_hcmd(void *ctx, struct iwl_host_cmd *host_cmd)
         return ret;
 }
 
+static bool iwl_mvm_d3_debug_enable(void *ctx)
+{
+        return IWL_MVM_D3_DEBUG;
+}
+
 static const struct iwl_fw_runtime_ops iwl_mvm_fwrt_ops = {
         .dump_start = iwl_mvm_fwrt_dump_start,
         .dump_end = iwl_mvm_fwrt_dump_end,
         .fw_running = iwl_mvm_fwrt_fw_running,
         .send_hcmd = iwl_mvm_fwrt_send_hcmd,
+        .d3_debug_enable = iwl_mvm_d3_debug_enable,
 };
 
 static struct iwl_op_mode *
@@ -690,6 +706,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         INIT_LIST_HEAD(&mvm->aux_roc_te_list);
         INIT_LIST_HEAD(&mvm->async_handlers_list);
         spin_lock_init(&mvm->time_event_lock);
+        INIT_LIST_HEAD(&mvm->ftm_initiator.loc_list);
 
         INIT_WORK(&mvm->async_handlers_wk, iwl_mvm_async_handlers_wk);
         INIT_WORK(&mvm->roc_done_wk, iwl_mvm_roc_done_wk);
@@ -817,8 +834,8 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         mutex_lock(&mvm->mutex);
         iwl_mvm_ref(mvm, IWL_MVM_REF_INIT_UCODE);
         err = iwl_run_init_mvm_ucode(mvm, true);
-        if (test_bit(IWL_FWRT_STATUS_WAIT_ALIVE, &mvm->fwrt.status))
-                iwl_fw_alive_error_dump(&mvm->fwrt);
+        if (err)
+                iwl_fw_dbg_error_collect(&mvm->fwrt, FW_DBG_TRIGGER_DRIVER);
         if (!iwlmvm_mod_params.init_dbg || !err)
                 iwl_mvm_stop_device(mvm);
         iwl_mvm_unref(mvm, IWL_MVM_REF_INIT_UCODE);
@@ -902,15 +919,15 @@ static void iwl_op_mode_mvm_stop(struct iwl_op_mode *op_mode)
 
         iwl_mvm_thermal_exit(mvm);
 
-        if (mvm->init_status & IWL_MVM_INIT_STATUS_REG_HW_INIT_COMPLETE) {
-                ieee80211_unregister_hw(mvm->hw);
-                mvm->init_status &= ~IWL_MVM_INIT_STATUS_REG_HW_INIT_COMPLETE;
-        }
+        ieee80211_unregister_hw(mvm->hw);
 
         kfree(mvm->scan_cmd);
         kfree(mvm->mcast_filter_cmd);
         mvm->mcast_filter_cmd = NULL;
 
+        kfree(mvm->error_recovery_buf);
+        mvm->error_recovery_buf = NULL;
+
 #if defined(CONFIG_PM_SLEEP) && defined(CONFIG_IWLWIFI_DEBUGFS)
         kfree(mvm->d3_resume_sram);
 #endif
@@ -1105,6 +1122,12 @@ static void iwl_mvm_async_cb(struct iwl_op_mode *op_mode,
         iwl_trans_block_txq_ptrs(mvm->trans, false);
 }
 
+static int iwl_mvm_is_static_queue(struct iwl_mvm *mvm, int queue)
+{
+        return queue == mvm->aux_queue || queue == mvm->probe_queue ||
+                queue == mvm->p2p_dev_queue || queue == mvm->snif_queue;
+}
+
 static void iwl_mvm_queue_state_change(struct iwl_op_mode *op_mode,
                                        int hw_queue, bool start)
 {
@@ -1131,6 +1154,15 @@ static void iwl_mvm_queue_state_change(struct iwl_op_mode *op_mode,
                 goto out;
         mvmsta = iwl_mvm_sta_from_mac80211(sta);
 
+        if (iwl_mvm_is_static_queue(mvm, hw_queue)) {
+                if (!start)
+                        ieee80211_stop_queues(mvm->hw);
+                else if (mvmsta->sta_state != IEEE80211_STA_NOTEXIST)
+                        ieee80211_wake_queues(mvm->hw);
+
+                goto out;
+        }
+
         if (iwl_mvm_has_new_tx_api(mvm)) {
                 int tid = mvm->tvqm_info[hw_queue].txq_tid;
 
@@ -1285,12 +1317,29 @@ void iwl_mvm_nic_restart(struct iwl_mvm *mvm, bool fw_error)
                 reprobe->dev = mvm->trans->dev;
                 INIT_WORK(&reprobe->work, iwl_mvm_reprobe_wk);
                 schedule_work(&reprobe->work);
+        } else if (test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
+                            &mvm->status)) {
+                IWL_ERR(mvm, "HW restart already requested, but not started\n");
         } else if (mvm->fwrt.cur_fw_img == IWL_UCODE_REGULAR &&
                    mvm->hw_registered &&
                    !test_bit(STATUS_TRANS_DEAD, &mvm->trans->status)) {
                 /* don't let the transport/FW power down */
                 iwl_mvm_ref(mvm, IWL_MVM_REF_UCODE_DOWN);
 
+                if (mvm->fw->ucode_capa.error_log_size) {
+                        u32 src_size = mvm->fw->ucode_capa.error_log_size;
+                        u32 src_addr = mvm->fw->ucode_capa.error_log_addr;
+                        u8 *recover_buf = kzalloc(src_size, GFP_ATOMIC);
+
+                        if (recover_buf) {
+                                mvm->error_recovery_buf = recover_buf;
+                                iwl_trans_read_mem_bytes(mvm->trans,
+                                                         src_addr,
+                                                         recover_buf,
+                                                         src_size);
+                        }
+                }
+
                 if (fw_error && mvm->fw_restart > 0)
                         mvm->fw_restart--;
                 set_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c
index f369173db11c..86e40bae57e3 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c
@@ -109,6 +109,7 @@ u8 iwl_mvm_get_ctrl_pos(struct cfg80211_chan_def *chandef)
                 return PHY_VHT_CTRL_POS_4_ABOVE;
         default:
                 WARN(1, "Invalid channel definition");
+                /* fall through */
         case 0:
                 /*
                  * The FW is expected to check the control channel position only
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/power.c b/drivers/net/wireless/intel/iwlwifi/mvm/power.c
index 5a0a28fd762d..36f5fa1ee793 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/power.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/power.c
@@ -8,6 +8,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
  * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
+ * Copyright (C) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,6 +31,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
  * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
+ * Copyright (C) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -79,6 +81,8 @@ int iwl_mvm_beacon_filter_send_cmd(struct iwl_mvm *mvm,
                                    struct iwl_beacon_filter_cmd *cmd,
                                    u32 flags)
 {
+        u16 len;
+
         IWL_DEBUG_POWER(mvm, "ba_enable_beacon_abort is: %d\n",
                         le32_to_cpu(cmd->ba_enable_beacon_abort));
         IWL_DEBUG_POWER(mvm, "ba_escape_timer is: %d\n",
@@ -101,9 +105,23 @@ int iwl_mvm_beacon_filter_send_cmd(struct iwl_mvm *mvm,
                         le32_to_cpu(cmd->bf_temp_fast_filter));
         IWL_DEBUG_POWER(mvm, "bf_temp_slow_filter is: %d\n",
                         le32_to_cpu(cmd->bf_temp_slow_filter));
+        IWL_DEBUG_POWER(mvm, "bf_threshold_absolute_low is: %d, %d\n",
+                        le32_to_cpu(cmd->bf_threshold_absolute_low[0]),
+                        le32_to_cpu(cmd->bf_threshold_absolute_low[1]));
+
+        IWL_DEBUG_POWER(mvm, "bf_threshold_absolute_high is: %d, %d\n",
+                        le32_to_cpu(cmd->bf_threshold_absolute_high[0]),
+                        le32_to_cpu(cmd->bf_threshold_absolute_high[1]));
+
+        if (fw_has_api(&mvm->fw->ucode_capa,
+                       IWL_UCODE_TLV_API_BEACON_FILTER_V4))
+                len = sizeof(struct iwl_beacon_filter_cmd);
+        else
+                len = offsetof(struct iwl_beacon_filter_cmd,
+                               bf_threshold_absolute_low);
 
         return iwl_mvm_send_cmd_pdu(mvm, REPLY_BEACON_FILTERING_CMD, flags,
-                                    sizeof(struct iwl_beacon_filter_cmd), cmd);
+                                    len, cmd);
 }
 
 static
@@ -526,6 +544,9 @@ int iwl_mvm_power_update_device(struct iwl_mvm *mvm)
                 cmd.flags &=
                         cpu_to_le16(~DEVICE_POWER_FLAGS_POWER_SAVE_ENA_MSK);
 #endif
+        if (mvm->ext_clock_valid)
+                cmd.flags |= cpu_to_le16(DEVICE_POWER_FLAGS_32K_CLK_VALID_MSK);
+
         IWL_DEBUG_POWER(mvm,
                         "Sending device power command with flags = 0x%X\n",
                         cmd.flags);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
index 09866f50857a..e231a44d2423 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
@@ -3,7 +3,7 @@
  * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -1643,8 +1643,26 @@ static s32 rs_get_best_rate(struct iwl_mvm *mvm,
 
 static u32 rs_bw_from_sta_bw(struct ieee80211_sta *sta)
 {
+        struct ieee80211_sta_vht_cap *sta_vht_cap = &sta->vht_cap;
+        struct ieee80211_vht_cap vht_cap = {
+                .vht_cap_info = cpu_to_le32(sta_vht_cap->cap),
+                .supp_mcs = sta_vht_cap->vht_mcs,
+        };
+
         switch (sta->bandwidth) {
         case IEEE80211_STA_RX_BW_160:
+                /*
+                 * Don't use 160 MHz if VHT extended NSS support
+                 * says we cannot use 2 streams, we don't want to
+                 * deal with this.
+                 * We only check MCS 0 - they will support that if
+                 * we got here at all and we don't care which MCS,
+                 * we want to determine a more global state.
+                 */
+                if (ieee80211_get_vht_max_nss(&vht_cap,
+                                              IEEE80211_VHT_CHANWIDTH_160MHZ,
+                                              0, true) < sta->rx_nss)
+                        return RATE_MCS_CHAN_WIDTH_80;
                 return RATE_MCS_CHAN_WIDTH_160;
         case IEEE80211_STA_RX_BW_80:
                 return RATE_MCS_CHAN_WIDTH_80;
@@ -1757,7 +1775,12 @@ static void rs_set_amsdu_len(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         else
                 mvmsta->amsdu_enabled = 0xFFFF;
 
-        mvmsta->max_amsdu_len = sta->max_amsdu_len;
+        if (mvmsta->vif->bss_conf.he_support &&
+            !iwlwifi_mod_params.disable_11ax)
+                mvmsta->max_amsdu_len = sta->max_amsdu_len;
+        else
+                mvmsta->max_amsdu_len = min_t(int, sta->max_amsdu_len, 8500);
+
         sta->max_rc_amsdu_len = mvmsta->max_amsdu_len;
 
         for (i = 0; i < IWL_MAX_TID_COUNT; i++) {
@@ -1791,7 +1814,7 @@ static bool rs_tweak_rate_tbl(struct iwl_mvm *mvm,
                               struct iwl_scale_tbl_info *tbl,
                               enum rs_action scale_action)
 {
-        if (sta->bandwidth != IEEE80211_STA_RX_BW_80)
+        if (rs_bw_from_sta_bw(sta) != RATE_MCS_CHAN_WIDTH_80)
                 return false;
 
         if (!is_vht_siso(&tbl->rate))
@@ -4122,6 +4145,7 @@ static const struct rate_control_ops rs_mvm_ops_drv = {
         .add_sta_debugfs = rs_drv_add_sta_debugfs,
         .remove_sta_debugfs = rs_remove_sta_debugfs,
 #endif
+        .capa = RATE_CTRL_CAPA_VHT_EXT_NSS_BW,
 };
 
 void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
index 235ab26ca429..fbd3014e8b82 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
@@ -222,7 +222,7 @@ static u32 iwl_mvm_set_mac80211_rx_flag(struct iwl_mvm *mvm,
                     !(rx_pkt_status & RX_MPDU_RES_STATUS_TTAK_OK))
                         return 0;
                 *crypt_len = IEEE80211_TKIP_IV_LEN;
-                /* fall through if TTAK OK */
+                /* fall through */
 
         case RX_MPDU_RES_STATUS_SEC_WEP_ENC:
                 if (!(rx_pkt_status & RX_MPDU_RES_STATUS_ICV_OK))
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index 2c56f73d688e..1e03acf30762 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -66,11 +66,37 @@
 #include "mvm.h"
 #include "fw-api.h"
 
+static void *iwl_mvm_skb_get_hdr(struct sk_buff *skb)
+{
+        struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
+        u8 *data = skb->data;
+
+        /* Alignment concerns */
+        BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_he) % 4);
+        BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_he_mu) % 4);
+        BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_lsig) % 4);
+        BUILD_BUG_ON(sizeof(struct ieee80211_vendor_radiotap) % 4);
+
+        if (rx_status->flag & RX_FLAG_RADIOTAP_HE)
+                data += sizeof(struct ieee80211_radiotap_he);
+        if (rx_status->flag & RX_FLAG_RADIOTAP_HE_MU)
+                data += sizeof(struct ieee80211_radiotap_he_mu);
+        if (rx_status->flag & RX_FLAG_RADIOTAP_LSIG)
+                data += sizeof(struct ieee80211_radiotap_lsig);
+        if (rx_status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
+                struct ieee80211_vendor_radiotap *radiotap = (void *)data;
+
+                data += sizeof(*radiotap) + radiotap->len + radiotap->pad;
+        }
+
+        return data;
+}
+
 static inline int iwl_mvm_check_pn(struct iwl_mvm *mvm, struct sk_buff *skb,
                                    int queue, struct ieee80211_sta *sta)
 {
         struct iwl_mvm_sta *mvmsta;
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        struct ieee80211_hdr *hdr = iwl_mvm_skb_get_hdr(skb);
         struct ieee80211_rx_status *stats = IEEE80211_SKB_RXCB(skb);
         struct iwl_mvm_key_pn *ptk_pn;
         int res;
@@ -197,12 +223,15 @@ static void iwl_mvm_add_rtap_sniffer_config(struct iwl_mvm *mvm,
 {
         struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_vendor_radiotap *radiotap;
-        int size = sizeof(*radiotap) + sizeof(__le16);
+        const int size = sizeof(*radiotap) + sizeof(__le16);
 
         if (!mvm->cur_aid)
                 return;
 
-        radiotap = skb_put(skb, size);
+        /* ensure alignment */
+        BUILD_BUG_ON((size + 2) % 4);
+
+        radiotap = skb_put(skb, size + 2);
         radiotap->align = 1;
         /* Intel OUI */
         radiotap->oui[0] = 0xf6;
@@ -212,10 +241,12 @@ static void iwl_mvm_add_rtap_sniffer_config(struct iwl_mvm *mvm,
         radiotap->subns = 1;
         radiotap->present = 0x1;
         radiotap->len = size - sizeof(*radiotap);
-        radiotap->pad = 0;
+        radiotap->pad = 2;
 
         /* fill the data now */
         memcpy(radiotap->data, &mvm->cur_aid, sizeof(mvm->cur_aid));
+        /* and clear the padding */
+        memset(radiotap->data + sizeof(__le16), 0, radiotap->pad);
 
         rx_status->flag |= RX_FLAG_RADIOTAP_VENDOR_DATA;
 }
@@ -227,10 +258,7 @@ static void iwl_mvm_pass_packet_to_mac80211(struct iwl_mvm *mvm,
                                             struct ieee80211_sta *sta,
                                             bool csi)
 {
-        struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
-
-        if (!(rx_status->flag & RX_FLAG_NO_PSDU) &&
-            iwl_mvm_check_pn(mvm, skb, queue, sta))
+        if (iwl_mvm_check_pn(mvm, skb, queue, sta))
                 kfree_skb(skb);
         else
                 ieee80211_rx_napi(mvm->hw, sta, skb, napi);
@@ -310,7 +338,7 @@ static int iwl_mvm_rx_crypto(struct iwl_mvm *mvm, struct ieee80211_hdr *hdr,
                         stats->flag |= RX_FLAG_MMIC_ERROR;
 
                 *crypt_len = IEEE80211_TKIP_IV_LEN;
-                /* fall through if TTAK OK */
+                /* fall through */
         case IWL_RX_MPDU_STATUS_SEC_WEP:
                 if (!(status & IWL_RX_MPDU_STATUS_ICV_OK))
                         return -1;
@@ -663,7 +691,7 @@ static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
                             struct sk_buff *skb,
                             struct iwl_rx_mpdu_desc *desc)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        struct ieee80211_hdr *hdr = iwl_mvm_skb_get_hdr(skb);
         struct iwl_mvm_sta *mvm_sta;
         struct iwl_mvm_baid_data *baid_data;
         struct iwl_mvm_reorder_buffer *buffer;
@@ -960,6 +988,7 @@ iwl_mvm_decode_he_phy_ru_alloc(struct iwl_mvm_rx_phy_data *phy_data,
          * the TSF/timers are not be transmitted in HE-MU.
          */
         u8 ru = le32_get_bits(phy_data->d1, IWL_RX_PHY_DATA1_HE_RU_ALLOC_MASK);
+        u32 he_type = rate_n_flags & RATE_MCS_HE_TYPE_MSK;
         u8 offs = 0;
 
         rx_status->bw = RATE_INFO_BW_HE_RU;
@@ -1002,19 +1031,27 @@ iwl_mvm_decode_he_phy_ru_alloc(struct iwl_mvm_rx_phy_data *phy_data,
                 he->data2 |=
                         cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA2_PRISEC_80_SEC);
 
-        if (he_mu) {
 #define CHECK_BW(bw) \
         BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_MU_FLAGS2_BW_FROM_SIG_A_BW_ ## bw ## MHZ != \
+                     RATE_MCS_CHAN_WIDTH_##bw >> RATE_MCS_CHAN_WIDTH_POS); \
+        BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA6_TB_PPDU_BW_ ## bw ## MHZ != \
                      RATE_MCS_CHAN_WIDTH_##bw >> RATE_MCS_CHAN_WIDTH_POS)
-                CHECK_BW(20);
-                CHECK_BW(40);
-                CHECK_BW(80);
-                CHECK_BW(160);
+        CHECK_BW(20);
+        CHECK_BW(40);
+        CHECK_BW(80);
+        CHECK_BW(160);
+
+        if (he_mu)
                 he_mu->flags2 |=
                         le16_encode_bits(FIELD_GET(RATE_MCS_CHAN_WIDTH_MSK,
                                                    rate_n_flags),
                                          IEEE80211_RADIOTAP_HE_MU_FLAGS2_BW_FROM_SIG_A_BW);
-        }
+        else if (he_type == RATE_MCS_HE_TYPE_TRIG)
+                he->data6 |=
+                        cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA6_TB_PPDU_BW_KNOWN) |
+                        le16_encode_bits(FIELD_GET(RATE_MCS_CHAN_WIDTH_MSK,
+                                                   rate_n_flags),
+                                         IEEE80211_RADIOTAP_HE_DATA6_TB_PPDU_BW);
 }
 
 static void iwl_mvm_decode_he_phy_data(struct iwl_mvm *mvm,
@@ -1037,16 +1074,16 @@ static void iwl_mvm_decode_he_phy_data(struct iwl_mvm *mvm,
                                          IEEE80211_RADIOTAP_HE_DATA1_SPTL_REUSE2_KNOWN |
                                          IEEE80211_RADIOTAP_HE_DATA1_SPTL_REUSE3_KNOWN |
                                          IEEE80211_RADIOTAP_HE_DATA1_SPTL_REUSE4_KNOWN);
-                he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d0,
+                he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d2,
                                                             IWL_RX_PHY_DATA2_HE_TB_EXT_SPTL_REUSE1),
                                               IEEE80211_RADIOTAP_HE_DATA4_TB_SPTL_REUSE1);
-                he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d0,
+                he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d2,
                                                             IWL_RX_PHY_DATA2_HE_TB_EXT_SPTL_REUSE2),
                                               IEEE80211_RADIOTAP_HE_DATA4_TB_SPTL_REUSE2);
-                he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d0,
+                he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d2,
                                                             IWL_RX_PHY_DATA2_HE_TB_EXT_SPTL_REUSE3),
                                               IEEE80211_RADIOTAP_HE_DATA4_TB_SPTL_REUSE3);
-                he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d0,
+                he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d2,
                                                             IWL_RX_PHY_DATA2_HE_TB_EXT_SPTL_REUSE4),
                                               IEEE80211_RADIOTAP_HE_DATA4_TB_SPTL_REUSE4);
                 /* fall through */
@@ -1056,7 +1093,6 @@ static void iwl_mvm_decode_he_phy_data(struct iwl_mvm *mvm,
         case IWL_RX_PHY_INFO_TYPE_HE_TB:
                 /* HE common */
                 he->data1 |= cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA1_LDPC_XSYMSEG_KNOWN |
-                                         IEEE80211_RADIOTAP_HE_DATA1_SPTL_REUSE_KNOWN |
                                          IEEE80211_RADIOTAP_HE_DATA1_DOPPLER_KNOWN |
                                          IEEE80211_RADIOTAP_HE_DATA1_BSS_COLOR_KNOWN);
                 he->data2 |= cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA2_PRE_FEC_PAD_KNOWN |
@@ -1076,9 +1112,6 @@ static void iwl_mvm_decode_he_phy_data(struct iwl_mvm *mvm,
                 he->data3 |= le16_encode_bits(le32_get_bits(phy_data->d0,
                                                             IWL_RX_PHY_DATA0_HE_LDPC_EXT_SYM),
                                               IEEE80211_RADIOTAP_HE_DATA3_LDPC_XSYMSEG);
-                he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d0,
-                                                            IWL_RX_PHY_DATA0_HE_SPATIAL_REUSE_MASK),
-                                              IEEE80211_RADIOTAP_HE_DATA4_SU_MU_SPTL_REUSE);
                 he->data5 |= le16_encode_bits(le32_get_bits(phy_data->d0,
                                                             IWL_RX_PHY_DATA0_HE_PRE_FEC_PAD_MASK),
                                               IEEE80211_RADIOTAP_HE_DATA5_PRE_FEC_PAD);
@@ -1099,6 +1132,20 @@ static void iwl_mvm_decode_he_phy_data(struct iwl_mvm *mvm,
 
         switch (phy_data->info_type) {
         case IWL_RX_PHY_INFO_TYPE_HE_MU_EXT:
+        case IWL_RX_PHY_INFO_TYPE_HE_MU:
+        case IWL_RX_PHY_INFO_TYPE_HE_SU:
+                he->data1 |= cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA1_SPTL_REUSE_KNOWN);
+                he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d0,
+                                                            IWL_RX_PHY_DATA0_HE_SPATIAL_REUSE_MASK),
+                                              IEEE80211_RADIOTAP_HE_DATA4_SU_MU_SPTL_REUSE);
+                break;
+        default:
+                /* nothing here */
+                break;
+        }
+
+        switch (phy_data->info_type) {
+        case IWL_RX_PHY_INFO_TYPE_HE_MU_EXT:
                 he_mu->flags1 |=
                         le16_encode_bits(le16_get_bits(phy_data->d4,
                                                        IWL_RX_PHY_DATA4_HE_MU_EXT_SIGB_DCM),
@@ -1165,22 +1212,16 @@ static void iwl_mvm_rx_he(struct iwl_mvm *mvm, struct sk_buff *skb,
                 .flags2 = cpu_to_le16(IEEE80211_RADIOTAP_HE_MU_FLAGS2_PUNC_FROM_SIG_A_BW_KNOWN |
                                       IEEE80211_RADIOTAP_HE_MU_FLAGS2_BW_FROM_SIG_A_BW_KNOWN),
         };
-        unsigned int radiotap_len = 0;
 
         he = skb_put_data(skb, &known, sizeof(known));
-        radiotap_len += sizeof(known);
         rx_status->flag |= RX_FLAG_RADIOTAP_HE;
 
         if (phy_data->info_type == IWL_RX_PHY_INFO_TYPE_HE_MU ||
             phy_data->info_type == IWL_RX_PHY_INFO_TYPE_HE_MU_EXT) {
                 he_mu = skb_put_data(skb, &mu_known, sizeof(mu_known));
-                radiotap_len += sizeof(mu_known);
                 rx_status->flag |= RX_FLAG_RADIOTAP_HE_MU;
         }
 
-        /* temporarily hide the radiotap data */
-        __skb_pull(skb, radiotap_len);
-
         /* report the AMPDU-EOF bit on single frames */
         if (!queue && !(phy_info & IWL_RX_MPDU_PHY_AMPDU)) {
                 rx_status->flag |= RX_FLAG_AMPDU_DETAILS;
@@ -1766,7 +1807,7 @@ void iwl_mvm_rx_monitor_ndp(struct iwl_mvm *mvm, struct napi_struct *napi,
                 rx_status->rate_idx = rate;
         }
 
-        iwl_mvm_pass_packet_to_mac80211(mvm, napi, skb, queue, sta, false);
+        ieee80211_rx_napi(mvm->hw, sta, skb, napi);
 out:
         rcu_read_unlock();
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
index 86d598d5b68f..78694bc38e76 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
@@ -8,7 +8,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -1580,6 +1580,11 @@ static int iwl_mvm_check_running_scans(struct iwl_mvm *mvm, int type)
          * scheduled scan before starting a normal scan.
          */
 
+        /* FW supports only a single periodic scan */
+        if ((type == IWL_MVM_SCAN_SCHED || type == IWL_MVM_SCAN_NETDETECT) &&
+            mvm->scan_status & (IWL_MVM_SCAN_SCHED | IWL_MVM_SCAN_NETDETECT))
+                return -EBUSY;
+
         if (iwl_mvm_num_scans(mvm) < mvm->max_scans)
                 return 0;
 
@@ -1616,10 +1621,10 @@ static int iwl_mvm_check_running_scans(struct iwl_mvm *mvm, int type)
                 if (mvm->scan_status & IWL_MVM_SCAN_SCHED_MASK)
                         return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED,
                                                  true);
-
-                /* fall through, something is wrong if no scan was
-                 * running but we ran out of scans.
+                /* Something is wrong if no scan was running but we
+                 * ran out of scans.
                  */
+                /* fall through */
         default:
                 WARN_ON(1);
                 break;
@@ -1976,9 +1981,8 @@ static int iwl_mvm_scan_stop_wait(struct iwl_mvm *mvm, int type)
                 return ret;
         }
 
-        ret = iwl_wait_notification(&mvm->notif_wait, &wait_scan_done, 1 * HZ);
-
-        return ret;
+        return iwl_wait_notification(&mvm->notif_wait, &wait_scan_done,
+                                     1 * HZ);
 }
 
 int iwl_mvm_scan_size(struct iwl_mvm *mvm)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index c5a01470a3bc..498c315291cf 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -314,7 +314,6 @@ static int iwl_mvm_invalidate_sta_queue(struct iwl_mvm *mvm, int queue,
         struct iwl_mvm_sta *mvmsta;
         u32 status;
         u8 sta_id;
-        int ret;
 
         if (WARN_ON(iwl_mvm_has_new_tx_api(mvm)))
                 return -EINVAL;
@@ -349,11 +348,9 @@ static int iwl_mvm_invalidate_sta_queue(struct iwl_mvm *mvm, int queue,
 
         /* Notify FW of queue removal from the STA queues */
         status = ADD_STA_SUCCESS;
-        ret = iwl_mvm_send_cmd_pdu_status(mvm, ADD_STA,
-                                          iwl_mvm_add_sta_cmd_size(mvm),
-                                          &cmd, &status);
-
-        return ret;
+        return iwl_mvm_send_cmd_pdu_status(mvm, ADD_STA,
+                                           iwl_mvm_add_sta_cmd_size(mvm),
+                                           &cmd, &status);
 }
 
 static int iwl_mvm_disable_txq(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
@@ -753,7 +750,8 @@ static int iwl_mvm_tvqm_enable_txq(struct iwl_mvm *mvm,
 
         if (tid == IWL_MAX_TID_COUNT) {
                 tid = IWL_MGMT_TID;
-                size = IWL_MGMT_QUEUE_SIZE;
+                size = max_t(u32, IWL_MGMT_QUEUE_SIZE,
+                             mvm->trans->cfg->min_txq_size);
         }
         queue = iwl_trans_txq_alloc(mvm->trans,
                                     cpu_to_le16(TX_QUEUE_CFG_ENABLE_QUEUE),
@@ -794,11 +792,9 @@ static int iwl_mvm_sta_alloc_queue_tvqm(struct iwl_mvm *mvm,
         if (queue < 0)
                 return queue;
 
-        if (sta) {
-                mvmtxq->txq_id = queue;
-                mvm->tvqm_info[queue].txq_tid = tid;
-                mvm->tvqm_info[queue].sta_id = mvmsta->sta_id;
-        }
+        mvmtxq->txq_id = queue;
+        mvm->tvqm_info[queue].txq_tid = tid;
+        mvm->tvqm_info[queue].sta_id = mvmsta->sta_id;
 
         IWL_DEBUG_TX_QUEUES(mvm, "Allocated queue is %d\n", queue);
 
@@ -2340,11 +2336,13 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
         if (mvmvif->ap_wep_key) {
                 u8 key_offset = iwl_mvm_set_fw_key_idx(mvm);
 
+                __set_bit(key_offset, mvm->fw_key_table);
+
                 if (key_offset == STA_KEY_IDX_INVALID)
                         return -ENOSPC;
 
                 ret = iwl_mvm_send_sta_key(mvm, mvmvif->mcast_sta.sta_id,
-                                           mvmvif->ap_wep_key, 1, 0, NULL, 0,
+                                           mvmvif->ap_wep_key, true, 0, NULL, 0,
                                            key_offset, 0);
                 if (ret)
                         return ret;
@@ -2353,6 +2351,59 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
         return 0;
 }
 
+static int __iwl_mvm_remove_sta_key(struct iwl_mvm *mvm, u8 sta_id,
+                                    struct ieee80211_key_conf *keyconf,
+                                    bool mcast)
+{
+        union {
+                struct iwl_mvm_add_sta_key_cmd_v1 cmd_v1;
+                struct iwl_mvm_add_sta_key_cmd cmd;
+        } u = {};
+        bool new_api = fw_has_api(&mvm->fw->ucode_capa,
+                                  IWL_UCODE_TLV_API_TKIP_MIC_KEYS);
+        __le16 key_flags;
+        int ret, size;
+        u32 status;
+
+        /* This is a valid situation for GTK removal */
+        if (sta_id == IWL_MVM_INVALID_STA)
+                return 0;
+
+        key_flags = cpu_to_le16((keyconf->keyidx << STA_KEY_FLG_KEYID_POS) &
+                                 STA_KEY_FLG_KEYID_MSK);
+        key_flags |= cpu_to_le16(STA_KEY_FLG_NO_ENC | STA_KEY_FLG_WEP_KEY_MAP);
+        key_flags |= cpu_to_le16(STA_KEY_NOT_VALID);
+
+        if (mcast)
+                key_flags |= cpu_to_le16(STA_KEY_MULTICAST);
+
+        /*
+         * The fields assigned here are in the same location at the start
+         * of the command, so we can do this union trick.
+         */
+        u.cmd.common.key_flags = key_flags;
+        u.cmd.common.key_offset = keyconf->hw_key_idx;
+        u.cmd.common.sta_id = sta_id;
+
+        size = new_api ? sizeof(u.cmd) : sizeof(u.cmd_v1);
+
+        status = ADD_STA_SUCCESS;
+        ret = iwl_mvm_send_cmd_pdu_status(mvm, ADD_STA_KEY, size, &u.cmd,
+                                          &status);
+
+        switch (status) {
+        case ADD_STA_SUCCESS:
+                IWL_DEBUG_WEP(mvm, "MODIFY_STA: remove sta key passed\n");
+                break;
+        default:
+                ret = -EIO;
+                IWL_ERR(mvm, "MODIFY_STA: remove sta key failed\n");
+                break;
+        }
+
+        return ret;
+}
+
 /*
  * Send the FW a request to remove the station from it's internal data
  * structures, and in addition remove it from the local data structure.
@@ -2368,6 +2419,28 @@ int iwl_mvm_rm_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 
         iwl_mvm_disable_txq(mvm, NULL, mvmvif->cab_queue, 0, 0);
 
+        if (mvmvif->ap_wep_key) {
+                int i;
+
+                if (!__test_and_clear_bit(mvmvif->ap_wep_key->hw_key_idx,
+                                          mvm->fw_key_table)) {
+                        IWL_ERR(mvm, "offset %d not used in fw key table.\n",
+                                mvmvif->ap_wep_key->hw_key_idx);
+                        return -ENOENT;
+                }
+
+                /* track which key was deleted last */
+                for (i = 0; i < STA_KEY_MAX_NUM; i++) {
+                        if (mvm->fw_key_deleted[i] < U8_MAX)
+                                mvm->fw_key_deleted[i]++;
+                }
+                mvm->fw_key_deleted[mvmvif->ap_wep_key->hw_key_idx] = 0;
+                ret = __iwl_mvm_remove_sta_key(mvm, mvmvif->mcast_sta.sta_id,
+                                               mvmvif->ap_wep_key, true);
+                if (ret)
+                        return ret;
+        }
+
         ret = iwl_mvm_rm_sta_common(mvm, mvmvif->mcast_sta.sta_id);
         if (ret)
                 IWL_WARN(mvm, "Failed sending remove station\n");
@@ -3399,59 +3472,6 @@ static int __iwl_mvm_set_sta_key(struct iwl_mvm *mvm,
         return ret;
 }
 
-static int __iwl_mvm_remove_sta_key(struct iwl_mvm *mvm, u8 sta_id,
-                                    struct ieee80211_key_conf *keyconf,
-                                    bool mcast)
-{
-        union {
-                struct iwl_mvm_add_sta_key_cmd_v1 cmd_v1;
-                struct iwl_mvm_add_sta_key_cmd cmd;
-        } u = {};
-        bool new_api = fw_has_api(&mvm->fw->ucode_capa,
-                                  IWL_UCODE_TLV_API_TKIP_MIC_KEYS);
-        __le16 key_flags;
-        int ret, size;
-        u32 status;
-
-        /* This is a valid situation for GTK removal */
-        if (sta_id == IWL_MVM_INVALID_STA)
-                return 0;
-
-        key_flags = cpu_to_le16((keyconf->keyidx << STA_KEY_FLG_KEYID_POS) &
-                                 STA_KEY_FLG_KEYID_MSK);
-        key_flags |= cpu_to_le16(STA_KEY_FLG_NO_ENC | STA_KEY_FLG_WEP_KEY_MAP);
-        key_flags |= cpu_to_le16(STA_KEY_NOT_VALID);
-
-        if (mcast)
-                key_flags |= cpu_to_le16(STA_KEY_MULTICAST);
-
-        /*
-         * The fields assigned here are in the same location at the start
-         * of the command, so we can do this union trick.
-         */
-        u.cmd.common.key_flags = key_flags;
-        u.cmd.common.key_offset = keyconf->hw_key_idx;
-        u.cmd.common.sta_id = sta_id;
-
-        size = new_api ? sizeof(u.cmd) : sizeof(u.cmd_v1);
-
-        status = ADD_STA_SUCCESS;
-        ret = iwl_mvm_send_cmd_pdu_status(mvm, ADD_STA_KEY, size, &u.cmd,
-                                          &status);
-
-        switch (status) {
-        case ADD_STA_SUCCESS:
-                IWL_DEBUG_WEP(mvm, "MODIFY_STA: remove sta key passed\n");
-                break;
-        default:
-                ret = -EIO;
-                IWL_ERR(mvm, "MODIFY_STA: remove sta key failed\n");
-                break;
-        }
-
-        return ret;
-}
-
 int iwl_mvm_set_sta_key(struct iwl_mvm *mvm,
                         struct ieee80211_vif *vif,
                         struct ieee80211_sta *sta,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
index 0614296244b3..79700c7310a1 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
@@ -394,6 +394,7 @@ struct iwl_mvm_rxq_dup_data {
  *      the BA window. To be used for UAPSD only.
  * @ptk_pn: per-queue PTK PN data structures
  * @dup_data: per queue duplicate packet detection data
+ * @wep_key: used in AP mode. Is a duplicate of the WEP key.
  * @deferred_traffic_tid_map: indication bitmap of deferred traffic per-TID
  * @tx_ant: the index of the antenna to use for data tx to this station. Only
  *      used during connection establishment (e.g. for the 4 way handshake
@@ -425,6 +426,8 @@ struct iwl_mvm_sta {
         struct iwl_mvm_key_pn __rcu *ptk_pn[4];
         struct iwl_mvm_rxq_dup_data *dup_data;
 
+        struct ieee80211_key_conf *wep_key;
+
         u8 reserved_queue;
 
         /* Temporary, until the new TLC will control the Tx protection */
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
index 5b34100e9099..9693fa4cdc39 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
@@ -85,7 +85,7 @@ void iwl_mvm_te_clear_data(struct iwl_mvm *mvm,
 {
         lockdep_assert_held(&mvm->time_event_lock);
 
-        if (!te_data->vif)
+        if (!te_data || !te_data->vif)
                 return;
 
         list_del(&te_data->list);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index ac62eb8c4b36..0c2aabc842f9 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -8,7 +8,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -209,7 +209,9 @@ void iwl_mvm_set_tx_cmd(struct iwl_mvm *mvm, struct sk_buff *skb,
         u16 offload_assist = 0;
         u8 ac;
 
-        if (!(info->flags & IEEE80211_TX_CTL_NO_ACK))
+        if (!(info->flags & IEEE80211_TX_CTL_NO_ACK) ||
+            (ieee80211_is_probe_resp(fc) &&
+             !is_multicast_ether_addr(hdr->addr1)))
                 tx_flags |= TX_CMD_FLG_ACK;
         else
                 tx_flags &= ~TX_CMD_FLG_ACK;
@@ -278,7 +280,7 @@ void iwl_mvm_set_tx_cmd(struct iwl_mvm *mvm, struct sk_buff *skb,
         }
 
         if (ieee80211_is_data(fc) && len > mvm->rts_threshold &&
-            !is_multicast_ether_addr(ieee80211_get_DA(hdr)))
+            !is_multicast_ether_addr(hdr->addr1))
                 tx_flags |= TX_CMD_FLG_PROT_REQUIRE;
 
         if (fw_has_capa(&mvm->fw->ucode_capa,
@@ -719,6 +721,9 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
                 IEEE80211_TX_CTL_TX_OFFCHAN;
         int queue = -1;
 
+        if (IWL_MVM_NON_TRANSMITTING_AP && ieee80211_is_probe_resp(fc))
+                return -1;
+
         memcpy(&info, skb->cb, sizeof(info));
 
         if (WARN_ON_ONCE(info.flags & IEEE80211_TX_CTL_AMPDU))
@@ -1078,6 +1083,9 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb,
         fc = hdr->frame_control;
         hdrlen = ieee80211_hdrlen(fc);
 
+        if (IWL_MVM_NON_TRANSMITTING_AP && ieee80211_is_probe_resp(fc))
+                return -1;
+
         if (WARN_ON_ONCE(!mvmsta))
                 return -1;
 
@@ -1107,12 +1115,14 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb,
          */
         if (ieee80211_is_data_qos(fc) && !ieee80211_is_qos_nullfunc(fc)) {
                 tid = ieee80211_get_tid(hdr);
-                if (WARN_ON_ONCE(tid >= IWL_MAX_TID_COUNT))
+                if (WARN_ONCE(tid >= IWL_MAX_TID_COUNT, "Invalid TID %d", tid))
                         goto drop_unlock_sta;
 
                 is_ampdu = info->flags & IEEE80211_TX_CTL_AMPDU;
-                if (WARN_ON_ONCE(is_ampdu &&
-                                 mvmsta->tid_data[tid].state != IWL_AGG_ON))
+                if (WARN_ONCE(is_ampdu &&
+                              mvmsta->tid_data[tid].state != IWL_AGG_ON,
+                              "Invalid internal agg state %d for TID %d",
+                               mvmsta->tid_data[tid].state, tid))
                         goto drop_unlock_sta;
 
                 seq_number = mvmsta->tid_data[tid].seq_number;
@@ -1134,7 +1144,7 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb,
 
         WARN_ON_ONCE(info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM);
 
-        if (WARN_ON_ONCE(txq_id == IWL_MVM_INVALID_QUEUE)) {
+        if (WARN_ONCE(txq_id == IWL_MVM_INVALID_QUEUE, "Invalid TXQ id")) {
                 iwl_trans_free_tx_cmd(mvm->trans, dev_cmd);
                 spin_unlock(&mvmsta->lock);
                 return 0;
@@ -1184,6 +1194,7 @@ drop_unlock_sta:
         iwl_trans_free_tx_cmd(mvm->trans, dev_cmd);
         spin_unlock(&mvmsta->lock);
 drop:
+        IWL_DEBUG_TX(mvm, "TX to [%d|%d] dropped\n", mvmsta->sta_id, tid);
         return -1;
 }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
index 211c4638d690..4649327abb45 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
@@ -294,6 +294,7 @@ static const struct {
         { "SYSASSERT", 0x35 },
         { "UCODE_VERSION_MISMATCH", 0x37 },
         { "BAD_COMMAND", 0x38 },
+        { "BAD_COMMAND", 0x39 },
         { "NMI_INTERRUPT_DATA_ACTION_PT", 0x3C },
         { "FATAL_ERROR", 0x3D },
         { "NMI_TRM_HW_ERR", 0x46 },
@@ -456,12 +457,14 @@ static void iwl_mvm_dump_umac_error_log(struct iwl_mvm *mvm)
 {
         struct iwl_trans *trans = mvm->trans;
         struct iwl_umac_error_event_table table;
+        u32 base = mvm->trans->umac_error_event_table;
 
-        if (!mvm->support_umac_log)
+        if (!mvm->support_umac_log &&
+            !(mvm->trans->error_event_table_tlv_status &
+              IWL_ERROR_EVENT_TABLE_UMAC))
                 return;
 
-        iwl_trans_read_mem_bytes(trans, mvm->umac_error_event_table, &table,
-                                 sizeof(table));
+        iwl_trans_read_mem_bytes(trans, base, &table, sizeof(table));
 
         if (table.valid)
                 mvm->fwrt.dump.umac_err_id = table.error_id;
@@ -493,7 +496,7 @@ static void iwl_mvm_dump_lmac_error_log(struct iwl_mvm *mvm, u8 lmac_num)
 {
         struct iwl_trans *trans = mvm->trans;
         struct iwl_error_event_table table;
-        u32 val, base = mvm->error_event_table[lmac_num];
+        u32 val, base = mvm->trans->lmac_error_event_table[lmac_num];
 
         if (mvm->fwrt.cur_fw_img == IWL_UCODE_INIT) {
                 if (!base)
@@ -522,23 +525,9 @@ static void iwl_mvm_dump_lmac_error_log(struct iwl_mvm *mvm, u8 lmac_num)
                 /* reset the device */
                 iwl_trans_sw_reset(trans);
 
-                /* set INIT_DONE flag */
-                iwl_set_bit(trans, CSR_GP_CNTRL,
-                            BIT(trans->cfg->csr->flag_init_done));
-
-                /* and wait for clock stabilization */
-                if (trans->cfg->device_family == IWL_DEVICE_FAMILY_8000)
-                        udelay(2);
-
-                err = iwl_poll_bit(trans, CSR_GP_CNTRL,
-                                   BIT(trans->cfg->csr->flag_mac_clock_ready),
-                                   BIT(trans->cfg->csr->flag_mac_clock_ready),
-                                   25000);
-                if (err < 0) {
-                        IWL_DEBUG_INFO(trans,
-                                       "Failed to reset the card for the dump\n");
+                err = iwl_finish_nic_init(trans);
+                if (err)
                         return;
-                }
         }
 
         iwl_trans_read_mem_bytes(trans, base, &table, sizeof(table));
@@ -603,7 +592,7 @@ void iwl_mvm_dump_nic_error_log(struct iwl_mvm *mvm)
 
         iwl_mvm_dump_lmac_error_log(mvm, 0);
 
-        if (mvm->error_event_table[1])
+        if (mvm->trans->lmac_error_event_table[1])
                 iwl_mvm_dump_lmac_error_log(mvm, 1);
 
         iwl_mvm_dump_umac_error_log(mvm);
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
index ceb3aa03d561..1e36459948db 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -18,7 +18,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -66,6 +66,7 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans,
         void *iml_img;
         u32 control_flags = 0;
         int ret;
+        int cmdq_size = max_t(u32, TFD_CMD_SLOTS, trans->cfg->min_txq_size);
 
         /* Allocate prph scratch */
         prph_scratch = dma_alloc_coherent(trans->dev, sizeof(*prph_scratch),
@@ -151,7 +152,7 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans,
         ctxt_info_gen3->mcr_base_addr =
                 cpu_to_le64(trans_pcie->rxq->used_bd_dma);
         ctxt_info_gen3->mtr_size =
-                cpu_to_le16(TFD_QUEUE_CB_SIZE(TFD_CMD_SLOTS));
+                cpu_to_le16(TFD_QUEUE_CB_SIZE(cmdq_size));
         ctxt_info_gen3->mcr_size =
                 cpu_to_le16(RX_QUEUE_CB_SIZE(MQ_RX_TABLE_SIZE));
 
@@ -175,8 +176,13 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans,
         iwl_write64(trans, CSR_IML_DATA_ADDR,
                     trans_pcie->iml_dma_addr);
         iwl_write32(trans, CSR_IML_SIZE_ADDR, trans->iml_len);
-        iwl_set_bit(trans, CSR_CTXT_INFO_BOOT_CTRL, CSR_AUTO_FUNC_BOOT_ENA);
-        iwl_set_bit(trans, CSR_GP_CNTRL, CSR_AUTO_FUNC_INIT);
+
+        iwl_set_bit(trans, CSR_CTXT_INFO_BOOT_CTRL,
+                    CSR_AUTO_FUNC_BOOT_ENA);
+        if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_AX210)
+                iwl_write_umac_prph(trans, UREG_CPU_INIT_RUN, 1);
+        else
+                iwl_set_bit(trans, CSR_GP_CNTRL, CSR_AUTO_FUNC_INIT);
 
         return 0;
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c
index 7f4aaa810ea1..9274e317cc77 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c
@@ -59,8 +59,7 @@
 
 void iwl_pcie_ctxt_info_free_paging(struct iwl_trans *trans)
 {
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        struct iwl_self_init_dram *dram = &trans_pcie->init_dram;
+        struct iwl_self_init_dram *dram = &trans->init_dram;
         int i;
 
         if (!dram->paging) {
@@ -83,8 +82,7 @@ int iwl_pcie_init_fw_sec(struct iwl_trans *trans,
                          const struct fw_img *fw,
                          struct iwl_context_info_dram *ctxt_dram)
 {
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        struct iwl_self_init_dram *dram = &trans_pcie->init_dram;
+        struct iwl_self_init_dram *dram = &trans->init_dram;
         int i, ret, lmac_cnt, umac_cnt, paging_cnt;
 
         if (WARN(dram->paging,
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index a22e47639a4e..2b94e4cef56c 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -8,7 +8,7 @@
  * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016-2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -32,7 +32,7 @@
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * All rights reserved.
  * Copyright(c) 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -517,6 +517,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x02F0, 0x0034, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x02F0, 0x0038, iwl9560_2ac_160_cfg_soc)},
         {IWL_PCI_DEVICE(0x02F0, 0x003C, iwl9560_2ac_160_cfg_soc)},
+        {IWL_PCI_DEVICE(0x02F0, 0x0040, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0x02F0, 0x0044, iwl_ax101_cfg_qu_hr)},
         {IWL_PCI_DEVICE(0x02F0, 0x0060, iwl9461_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x02F0, 0x0064, iwl9461_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x02F0, 0x00A0, iwl9462_2ac_cfg_soc)},
@@ -525,6 +527,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x02F0, 0x0234, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x02F0, 0x0238, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x02F0, 0x023C, iwl9560_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x02F0, 0x0244, iwl_ax101_cfg_qu_hr)},
         {IWL_PCI_DEVICE(0x02F0, 0x0260, iwl9461_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x02F0, 0x0264, iwl9461_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x02F0, 0x02A0, iwl9462_2ac_cfg_soc)},
@@ -542,6 +545,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x06F0, 0x0034, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x06F0, 0x0038, iwl9560_2ac_160_cfg_soc)},
         {IWL_PCI_DEVICE(0x06F0, 0x003C, iwl9560_2ac_160_cfg_soc)},
+        {IWL_PCI_DEVICE(0x06F0, 0x0040, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0x06F0, 0x0044, iwl_ax101_cfg_qu_hr)},
         {IWL_PCI_DEVICE(0x06F0, 0x0060, iwl9461_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x06F0, 0x0064, iwl9461_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x06F0, 0x00A0, iwl9462_2ac_cfg_soc)},
@@ -550,6 +555,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x06F0, 0x0234, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x06F0, 0x0238, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x06F0, 0x023C, iwl9560_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x06F0, 0x0244, iwl_ax101_cfg_qu_hr)},
         {IWL_PCI_DEVICE(0x06F0, 0x0260, iwl9461_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x06F0, 0x0264, iwl9461_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x06F0, 0x02A0, iwl9462_2ac_cfg_soc)},
@@ -597,6 +603,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x2526, 0x2030, iwl9560_2ac_160_cfg_soc)},
         {IWL_PCI_DEVICE(0x2526, 0x2034, iwl9560_2ac_160_cfg_soc)},
         {IWL_PCI_DEVICE(0x2526, 0x4010, iwl9260_2ac_160_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x4018, iwl9260_2ac_160_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x401C, iwl9260_2ac_160_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x4030, iwl9560_2ac_160_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x4034, iwl9560_2ac_160_cfg_soc)},
@@ -614,6 +621,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x2720, 0x0034, iwl9560_2ac_160_cfg)},
         {IWL_PCI_DEVICE(0x2720, 0x0038, iwl9560_2ac_160_cfg)},
         {IWL_PCI_DEVICE(0x2720, 0x003C, iwl9560_2ac_160_cfg)},
+        {IWL_PCI_DEVICE(0x2720, 0x0044, iwl_ax101_cfg_qu_hr)},
         {IWL_PCI_DEVICE(0x2720, 0x0060, iwl9461_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2720, 0x0064, iwl9461_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2720, 0x00A0, iwl9462_2ac_cfg_soc)},
@@ -622,6 +630,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x2720, 0x0234, iwl9560_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2720, 0x0238, iwl9560_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2720, 0x023C, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2720, 0x0244, iwl_ax101_cfg_qu_hr)},
         {IWL_PCI_DEVICE(0x2720, 0x0260, iwl9461_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2720, 0x0264, iwl9461_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2720, 0x02A0, iwl9462_2ac_cfg_soc)},
@@ -699,6 +708,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x34F0, 0x0034, iwl9560_2ac_cfg_qu_b0_jf_b0)},
         {IWL_PCI_DEVICE(0x34F0, 0x0038, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
         {IWL_PCI_DEVICE(0x34F0, 0x003C, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x34F0, 0x0044, iwl_ax101_cfg_qu_hr)},
         {IWL_PCI_DEVICE(0x34F0, 0x0060, iwl9461_2ac_cfg_qu_b0_jf_b0)},
         {IWL_PCI_DEVICE(0x34F0, 0x0064, iwl9461_2ac_cfg_qu_b0_jf_b0)},
         {IWL_PCI_DEVICE(0x34F0, 0x00A0, iwl9462_2ac_cfg_qu_b0_jf_b0)},
@@ -707,6 +717,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x34F0, 0x0234, iwl9560_2ac_cfg_qu_b0_jf_b0)},
         {IWL_PCI_DEVICE(0x34F0, 0x0238, iwl9560_2ac_cfg_qu_b0_jf_b0)},
         {IWL_PCI_DEVICE(0x34F0, 0x023C, iwl9560_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x34F0, 0x0244, iwl_ax101_cfg_qu_hr)},
         {IWL_PCI_DEVICE(0x34F0, 0x0260, iwl9461_2ac_cfg_qu_b0_jf_b0)},
         {IWL_PCI_DEVICE(0x34F0, 0x0264, iwl9461_2ac_cfg_qu_b0_jf_b0)},
         {IWL_PCI_DEVICE(0x34F0, 0x02A0, iwl9462_2ac_cfg_qu_b0_jf_b0)},
@@ -753,6 +764,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x43F0, 0x0034, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x43F0, 0x0038, iwl9560_2ac_160_cfg_soc)},
         {IWL_PCI_DEVICE(0x43F0, 0x003C, iwl9560_2ac_160_cfg_soc)},
+        {IWL_PCI_DEVICE(0x43F0, 0x0044, iwl_ax101_cfg_qu_hr)},
         {IWL_PCI_DEVICE(0x43F0, 0x0060, iwl9461_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x43F0, 0x0064, iwl9461_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x43F0, 0x00A0, iwl9462_2ac_cfg_soc)},
@@ -761,6 +773,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x43F0, 0x0234, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x43F0, 0x0238, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x43F0, 0x023C, iwl9560_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x43F0, 0x0244, iwl_ax101_cfg_qu_hr)},
         {IWL_PCI_DEVICE(0x43F0, 0x0260, iwl9461_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x43F0, 0x0264, iwl9461_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x43F0, 0x02A0, iwl9462_2ac_cfg_soc)},
@@ -820,6 +833,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0xA0F0, 0x0034, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA0F0, 0x0038, iwl9560_2ac_160_cfg_soc)},
         {IWL_PCI_DEVICE(0xA0F0, 0x003C, iwl9560_2ac_160_cfg_soc)},
+        {IWL_PCI_DEVICE(0xA0F0, 0x0044, iwl_ax101_cfg_qu_hr)},
         {IWL_PCI_DEVICE(0xA0F0, 0x0060, iwl9461_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA0F0, 0x0064, iwl9461_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA0F0, 0x00A0, iwl9462_2ac_cfg_soc)},
@@ -828,6 +842,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0xA0F0, 0x0234, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA0F0, 0x0238, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA0F0, 0x023C, iwl9560_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0xA0F0, 0x0244, iwl_ax101_cfg_qu_hr)},
         {IWL_PCI_DEVICE(0xA0F0, 0x0260, iwl9461_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA0F0, 0x0264, iwl9461_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA0F0, 0x02A0, iwl9462_2ac_cfg_soc)},
@@ -872,82 +887,92 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0xA370, 0x40A4, iwl9462_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA370, 0x4234, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA370, 0x42A4, iwl9462_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2720, 0x0030, iwl9560_2ac_cfg_qnj_jf_b0)},
 
 /* 22000 Series */
-        {IWL_PCI_DEVICE(0x02F0, 0x0070, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0x02F0, 0x0074, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0x02F0, 0x0078, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0x02F0, 0x007C, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0x02F0, 0x0310, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x02F0, 0x0070, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0x02F0, 0x0074, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0x02F0, 0x0078, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0x02F0, 0x007C, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0x02F0, 0x0310, iwl_ax101_cfg_qu_hr)},
         {IWL_PCI_DEVICE(0x02F0, 0x1651, killer1650s_2ax_cfg_qu_b0_hr_b0)},
         {IWL_PCI_DEVICE(0x02F0, 0x1652, killer1650i_2ax_cfg_qu_b0_hr_b0)},
-        {IWL_PCI_DEVICE(0x02F0, 0x4070, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0x06F0, 0x0070, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0x06F0, 0x0074, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0x06F0, 0x0078, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0x06F0, 0x007C, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0x06F0, 0x0310, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x02F0, 0x4070, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0x06F0, 0x0070, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0x06F0, 0x0074, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0x06F0, 0x0078, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0x06F0, 0x007C, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0x06F0, 0x0310, iwl_ax101_cfg_qu_hr)},
         {IWL_PCI_DEVICE(0x06F0, 0x1651, killer1650s_2ax_cfg_qu_b0_hr_b0)},
         {IWL_PCI_DEVICE(0x06F0, 0x1652, killer1650i_2ax_cfg_qu_b0_hr_b0)},
-        {IWL_PCI_DEVICE(0x06F0, 0x4070, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0x2720, 0x0000, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0x2720, 0x0030, iwl9560_2ac_160_cfg_soc)},
-        {IWL_PCI_DEVICE(0x2720, 0x0040, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x06F0, 0x4070, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0x2720, 0x0000, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0x2720, 0x0040, iwl_ax101_cfg_qu_hr)},
         {IWL_PCI_DEVICE(0x2720, 0x0070, iwl22000_2ac_cfg_hr_cdb)},
-        {IWL_PCI_DEVICE(0x2720, 0x0074, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0x2720, 0x0078, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0x2720, 0x007C, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x2720, 0x0074, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0x2720, 0x0078, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0x2720, 0x007C, iwl_ax101_cfg_qu_hr)},
         {IWL_PCI_DEVICE(0x2720, 0x0090, iwl22000_2ac_cfg_hr_cdb)},
         {IWL_PCI_DEVICE(0x2720, 0x0310, iwl22000_2ac_cfg_hr_cdb)},
         {IWL_PCI_DEVICE(0x2720, 0x0A10, iwl22000_2ac_cfg_hr_cdb)},
-        {IWL_PCI_DEVICE(0x2720, 0x1080, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x2720, 0x1080, iwl_ax101_cfg_qu_hr)},
         {IWL_PCI_DEVICE(0x2720, 0x1651, killer1650s_2ax_cfg_qu_b0_hr_b0)},
         {IWL_PCI_DEVICE(0x2720, 0x1652, killer1650i_2ax_cfg_qu_b0_hr_b0)},
-        {IWL_PCI_DEVICE(0x2720, 0x4070, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0x34F0, 0x0040, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0x34F0, 0x0070, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0x34F0, 0x0074, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0x34F0, 0x0078, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0x34F0, 0x007C, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0x34F0, 0x0310, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x2720, 0x4070, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0x34F0, 0x0040, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0x34F0, 0x0070, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0x34F0, 0x0074, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0x34F0, 0x0078, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0x34F0, 0x007C, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0x34F0, 0x0310, iwl_ax101_cfg_qu_hr)},
         {IWL_PCI_DEVICE(0x34F0, 0x1651, killer1650s_2ax_cfg_qu_b0_hr_b0)},
         {IWL_PCI_DEVICE(0x34F0, 0x1652, killer1650i_2ax_cfg_qu_b0_hr_b0)},
-        {IWL_PCI_DEVICE(0x34F0, 0x4070, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x34F0, 0x4070, iwl_ax101_cfg_qu_hr)},
         {IWL_PCI_DEVICE(0x40C0, 0x0000, iwl22560_2ax_cfg_su_cdb)},
         {IWL_PCI_DEVICE(0x40C0, 0x0010, iwl22560_2ax_cfg_su_cdb)},
         {IWL_PCI_DEVICE(0x40c0, 0x0090, iwl22560_2ax_cfg_su_cdb)},
         {IWL_PCI_DEVICE(0x40C0, 0x0310, iwl22560_2ax_cfg_su_cdb)},
         {IWL_PCI_DEVICE(0x40C0, 0x0A10, iwl22560_2ax_cfg_su_cdb)},
-        {IWL_PCI_DEVICE(0x43F0, 0x0040, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0x43F0, 0x0070, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0x43F0, 0x0074, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0x43F0, 0x0078, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0x43F0, 0x007C, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x43F0, 0x0040, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0x43F0, 0x0070, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0x43F0, 0x0074, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0x43F0, 0x0078, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0x43F0, 0x007C, iwl_ax101_cfg_qu_hr)},
         {IWL_PCI_DEVICE(0x43F0, 0x1651, killer1650s_2ax_cfg_qu_b0_hr_b0)},
         {IWL_PCI_DEVICE(0x43F0, 0x1652, killer1650i_2ax_cfg_qu_b0_hr_b0)},
-        {IWL_PCI_DEVICE(0x43F0, 0x4070, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0xA0F0, 0x0000, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0xA0F0, 0x0040, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0xA0F0, 0x0070, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0xA0F0, 0x0074, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0xA0F0, 0x0078, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0xA0F0, 0x007C, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0xA0F0, 0x00B0, iwl22560_2ax_cfg_hr)},
-        {IWL_PCI_DEVICE(0xA0F0, 0x0A10, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x43F0, 0x4070, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0xA0F0, 0x0000, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0xA0F0, 0x0040, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0xA0F0, 0x0070, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0xA0F0, 0x0074, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0xA0F0, 0x0078, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0xA0F0, 0x007C, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0xA0F0, 0x00B0, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0xA0F0, 0x0A10, iwl_ax101_cfg_qu_hr)},
         {IWL_PCI_DEVICE(0xA0F0, 0x1651, killer1650s_2ax_cfg_qu_b0_hr_b0)},
         {IWL_PCI_DEVICE(0xA0F0, 0x1652, killer1650i_2ax_cfg_qu_b0_hr_b0)},
-        {IWL_PCI_DEVICE(0xA0F0, 0x4070, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0xA0F0, 0x4070, iwl_ax101_cfg_qu_hr)},
 
         {IWL_PCI_DEVICE(0x2723, 0x0080, iwl22260_2ax_cfg)},
         {IWL_PCI_DEVICE(0x2723, 0x0084, iwl22260_2ax_cfg)},
         {IWL_PCI_DEVICE(0x2723, 0x0088, iwl22260_2ax_cfg)},
         {IWL_PCI_DEVICE(0x2723, 0x008C, iwl22260_2ax_cfg)},
+        {IWL_PCI_DEVICE(0x2723, 0x1653, killer1650w_2ax_cfg)},
+        {IWL_PCI_DEVICE(0x2723, 0x1654, killer1650x_2ax_cfg)},
         {IWL_PCI_DEVICE(0x2723, 0x4080, iwl22260_2ax_cfg)},
         {IWL_PCI_DEVICE(0x2723, 0x4088, iwl22260_2ax_cfg)},
 
         {IWL_PCI_DEVICE(0x1a56, 0x1653, killer1650w_2ax_cfg)},
         {IWL_PCI_DEVICE(0x1a56, 0x1654, killer1650x_2ax_cfg)},
 
+        {IWL_PCI_DEVICE(0x2725, 0x0090, iwlax210_2ax_cfg_so_hr_a0)},
+        {IWL_PCI_DEVICE(0x7A70, 0x0090, iwlax210_2ax_cfg_so_hr_a0)},
+        {IWL_PCI_DEVICE(0x7A70, 0x0310, iwlax210_2ax_cfg_so_hr_a0)},
+        {IWL_PCI_DEVICE(0x2725, 0x0020, iwlax210_2ax_cfg_so_hr_a0)},
+        {IWL_PCI_DEVICE(0x2725, 0x0310, iwlax210_2ax_cfg_so_hr_a0)},
+        {IWL_PCI_DEVICE(0x2725, 0x0A10, iwlax210_2ax_cfg_so_hr_a0)},
+        {IWL_PCI_DEVICE(0x2725, 0x00B0, iwlax210_2ax_cfg_so_hr_a0)},
+
 #endif /* CONFIG_IWLMVM */
 
         {0}
@@ -999,7 +1024,7 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
                 if (rf_id_chp == jf_chp_id) {
                         if (iwl_trans->hw_rev == CSR_HW_REV_TYPE_QNJ)
-                                cfg = &iwl22000_2ax_cfg_qnj_jf_b0;
+                                cfg = &iwl9560_2ac_cfg_qnj_jf_b0;
                         else
                                 cfg = &iwl22000_2ac_cfg_jf;
                 } else if (rf_id_chp == hr_chp_id) {
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
index 0d16bcc3141f..bf8b61a476c5 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
@@ -8,7 +8,7 @@
  * Copyright(c) 2003 - 2015 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
  * Copyright(c) 2003 - 2015 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -400,6 +400,8 @@ struct iwl_txq {
         u32 id;
         int low_mark;
         int high_mark;
+
+        bool overflow_tx;
 };
 
 static inline dma_addr_t
@@ -454,20 +456,6 @@ enum iwl_image_response_code {
 };
 
 /**
- * struct iwl_self_init_dram - dram data used by self init process
- * @fw: lmac and umac dram data
- * @fw_cnt: total number of items in array
- * @paging: paging dram data
- * @paging_cnt: total number of items in array
- */
-struct iwl_self_init_dram {
-        struct iwl_dram_data *fw;
-        int fw_cnt;
-        struct iwl_dram_data *paging;
-        int paging_cnt;
-};
-
-/**
  * struct cont_rec: continuous recording data structure
  * @prev_wr_ptr: the last address that was read in monitor_data
  *      debugfs file
@@ -538,6 +526,8 @@ struct cont_rec {
  * @fh_mask: current unmasked fh causes
  * @hw_mask: current unmasked hw causes
  * @in_rescan: true if we have triggered a device rescan
+ * @base_rb_stts: base virtual address of receive buffer status for all queues
+ * @base_rb_stts_dma: base physical address of receive buffer status
  */
 struct iwl_trans_pcie {
         struct iwl_rxq *rxq;
@@ -554,7 +544,6 @@ struct iwl_trans_pcie {
         dma_addr_t prph_info_dma_addr;
         dma_addr_t prph_scratch_dma_addr;
         dma_addr_t iml_dma_addr;
-        struct iwl_self_init_dram init_dram;
         struct iwl_trans *trans;
 
         struct net_device napi_dev;
@@ -630,6 +619,9 @@ struct iwl_trans_pcie {
         cpumask_t affinity_mask[IWL_MAX_RX_HW_QUEUES];
         u16 tx_cmd_queue_size;
         bool in_rescan;
+
+        void *base_rb_stts;
+        dma_addr_t base_rb_stts_dma;
 };
 
 static inline struct iwl_trans_pcie *
@@ -813,8 +805,7 @@ static inline int iwl_pcie_ctxt_info_alloc_dma(struct iwl_trans *trans,
 
 static inline void iwl_pcie_ctxt_info_free_fw_img(struct iwl_trans *trans)
 {
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        struct iwl_self_init_dram *dram = &trans_pcie->init_dram;
+        struct iwl_self_init_dram *dram = &trans->init_dram;
         int i;
 
         if (!dram->fw) {
@@ -1052,6 +1043,7 @@ static inline bool iwl_pcie_dbg_on(struct iwl_trans *trans)
 
 void iwl_trans_pcie_rf_kill(struct iwl_trans *trans, bool state);
 void iwl_trans_pcie_dump_regs(struct iwl_trans *trans);
+void iwl_trans_sync_nmi(struct iwl_trans *trans);
 
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 int iwl_trans_pcie_dbgfs_register(struct iwl_trans *trans);
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
index c260d1251b5f..8d4f0628622b 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
@@ -8,7 +8,7 @@
  * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
  * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -202,9 +202,9 @@ int iwl_pcie_rx_stop(struct iwl_trans *trans)
 {
         if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_22560) {
                 /* TODO: remove this for 22560 once fw does it */
-                iwl_write_prph(trans, RFH_RXF_DMA_CFG_GEN3, 0);
-                return iwl_poll_prph_bit(trans, RFH_GEN_STATUS_GEN3,
-                                         RXF_DMA_IDLE, RXF_DMA_IDLE, 1000);
+                iwl_write_umac_prph(trans, RFH_RXF_DMA_CFG_GEN3, 0);
+                return iwl_poll_umac_prph_bit(trans, RFH_GEN_STATUS_GEN3,
+                                              RXF_DMA_IDLE, RXF_DMA_IDLE, 1000);
         } else if (trans->cfg->mq_rx_supported) {
                 iwl_write_prph(trans, RFH_RXF_DMA_CFG, 0);
                 return iwl_poll_prph_bit(trans, RFH_GEN_STATUS,
@@ -247,7 +247,7 @@ static void iwl_pcie_rxq_inc_wr_ptr(struct iwl_trans *trans,
         }
 
         rxq->write_actual = round_down(rxq->write, 8);
-        if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_22560)
+        if (trans->cfg->device_family == IWL_DEVICE_FAMILY_22560)
                 iwl_write32(trans, HBUS_TARG_WRPTR,
                             (rxq->write_actual |
                              ((FIRST_RX_QUEUE + rxq->id) << 16)));
@@ -538,9 +538,9 @@ static void iwl_pcie_rx_allocator(struct iwl_trans *trans)
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_rb_allocator *rba = &trans_pcie->rba;
         struct list_head local_empty;
-        int pending = atomic_xchg(&rba->req_pending, 0);
+        int pending = atomic_read(&rba->req_pending);
 
-        IWL_DEBUG_RX(trans, "Pending allocation requests = %d\n", pending);
+        IWL_DEBUG_TPT(trans, "Pending allocation requests = %d\n", pending);
 
         /* If we were scheduled - there is at least one request */
         spin_lock(&rba->lock);
@@ -593,12 +593,15 @@ static void iwl_pcie_rx_allocator(struct iwl_trans *trans)
                         i++;
                 }
 
+                atomic_dec(&rba->req_pending);
                 pending--;
+
                 if (!pending) {
-                        pending = atomic_xchg(&rba->req_pending, 0);
-                        IWL_DEBUG_RX(trans,
-                                     "Pending allocation requests = %d\n",
-                                     pending);
+                        pending = atomic_read(&rba->req_pending);
+                        if (pending)
+                                IWL_DEBUG_TPT(trans,
+                                              "Got more pending allocation requests = %d\n",
+                                              pending);
                 }
 
                 spin_lock(&rba->lock);
@@ -609,12 +612,15 @@ static void iwl_pcie_rx_allocator(struct iwl_trans *trans)
                 spin_unlock(&rba->lock);
 
                 atomic_inc(&rba->req_ready);
+
         }
 
         spin_lock(&rba->lock);
         /* return unused rbds to the allocator empty list */
         list_splice_tail(&local_empty, &rba->rbd_empty);
         spin_unlock(&rba->lock);
+
+        IWL_DEBUG_TPT(trans, "%s, exit.\n", __func__);
 }
 
 /*
@@ -696,11 +702,6 @@ static void iwl_pcie_free_rxq_dma(struct iwl_trans *trans,
         rxq->bd_dma = 0;
         rxq->bd = NULL;
 
-        if (rxq->rb_stts)
-                dma_free_coherent(trans->dev,
-                                  use_rx_td ? sizeof(__le16) :
-                                  sizeof(struct iwl_rb_status),
-                                  rxq->rb_stts, rxq->rb_stts_dma);
         rxq->rb_stts_dma = 0;
         rxq->rb_stts = NULL;
 
@@ -737,6 +738,8 @@ static int iwl_pcie_alloc_rxq_dma(struct iwl_trans *trans,
         int free_size;
         bool use_rx_td = (trans->cfg->device_family >=
                           IWL_DEVICE_FAMILY_22560);
+        size_t rb_stts_size = use_rx_td ? sizeof(__le16) :
+                              sizeof(struct iwl_rb_status);
 
         spin_lock_init(&rxq->lock);
         if (trans->cfg->mq_rx_supported)
@@ -764,12 +767,9 @@ static int iwl_pcie_alloc_rxq_dma(struct iwl_trans *trans,
                         goto err;
         }
 
-        /* Allocate the driver's pointer to receive buffer status */
-        rxq->rb_stts = dma_alloc_coherent(dev,
-                                          use_rx_td ? sizeof(__le16) : sizeof(struct iwl_rb_status),
-                                          &rxq->rb_stts_dma, GFP_KERNEL);
-        if (!rxq->rb_stts)
-                goto err;
+        rxq->rb_stts = trans_pcie->base_rb_stts + rxq->id * rb_stts_size;
+        rxq->rb_stts_dma =
+                trans_pcie->base_rb_stts_dma + rxq->id * rb_stts_size;
 
         if (!use_rx_td)
                 return 0;
@@ -799,7 +799,6 @@ err:
 
                 iwl_pcie_free_rxq_dma(trans, rxq);
         }
-        kfree(trans_pcie->rxq);
 
         return -ENOMEM;
 }
@@ -809,6 +808,9 @@ int iwl_pcie_rx_alloc(struct iwl_trans *trans)
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_rb_allocator *rba = &trans_pcie->rba;
         int i, ret;
+        size_t rb_stts_size = trans->cfg->device_family >=
+                              IWL_DEVICE_FAMILY_22560 ?
+                              sizeof(__le16) : sizeof(struct iwl_rb_status);
 
         if (WARN_ON(trans_pcie->rxq))
                 return -EINVAL;
@@ -816,18 +818,46 @@ int iwl_pcie_rx_alloc(struct iwl_trans *trans)
         trans_pcie->rxq = kcalloc(trans->num_rx_queues, sizeof(struct iwl_rxq),
                                   GFP_KERNEL);
         if (!trans_pcie->rxq)
-                return -EINVAL;
+                return -ENOMEM;
 
         spin_lock_init(&rba->lock);
 
+        /*
+         * Allocate the driver's pointer to receive buffer status.
+         * Allocate for all queues continuously (HW requirement).
+         */
+        trans_pcie->base_rb_stts =
+                        dma_alloc_coherent(trans->dev,
+                                           rb_stts_size * trans->num_rx_queues,
+                                           &trans_pcie->base_rb_stts_dma,
+                                           GFP_KERNEL);
+        if (!trans_pcie->base_rb_stts) {
+                ret = -ENOMEM;
+                goto err;
+        }
+
         for (i = 0; i < trans->num_rx_queues; i++) {
                 struct iwl_rxq *rxq = &trans_pcie->rxq[i];
 
+                rxq->id = i;
                 ret = iwl_pcie_alloc_rxq_dma(trans, rxq);
                 if (ret)
-                        return ret;
+                        goto err;
         }
         return 0;
+
+err:
+        if (trans_pcie->base_rb_stts) {
+                dma_free_coherent(trans->dev,
+                                  rb_stts_size * trans->num_rx_queues,
+                                  trans_pcie->base_rb_stts,
+                                  trans_pcie->base_rb_stts_dma);
+                trans_pcie->base_rb_stts = NULL;
+                trans_pcie->base_rb_stts_dma = 0;
+        }
+        kfree(trans_pcie->rxq);
+
+        return ret;
 }
 
 static void iwl_pcie_rx_hw_init(struct iwl_trans *trans, struct iwl_rxq *rxq)
@@ -1036,8 +1066,6 @@ int _iwl_pcie_rx_init(struct iwl_trans *trans)
         for (i = 0; i < trans->num_rx_queues; i++) {
                 struct iwl_rxq *rxq = &trans_pcie->rxq[i];
 
-                rxq->id = i;
-
                 spin_lock(&rxq->lock);
                 /*
                  * Set read write pointer to reflect that we have processed
@@ -1124,6 +1152,9 @@ void iwl_pcie_rx_free(struct iwl_trans *trans)
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_rb_allocator *rba = &trans_pcie->rba;
         int i;
+        size_t rb_stts_size = trans->cfg->device_family >=
+                              IWL_DEVICE_FAMILY_22560 ?
+                              sizeof(__le16) : sizeof(struct iwl_rb_status);
 
         /*
          * if rxq is NULL, it means that nothing has been allocated,
@@ -1138,6 +1169,15 @@ void iwl_pcie_rx_free(struct iwl_trans *trans)
 
         iwl_pcie_free_rbs_pool(trans);
 
+        if (trans_pcie->base_rb_stts) {
+                dma_free_coherent(trans->dev,
+                                  rb_stts_size * trans->num_rx_queues,
+                                  trans_pcie->base_rb_stts,
+                                  trans_pcie->base_rb_stts_dma);
+                trans_pcie->base_rb_stts = NULL;
+                trans_pcie->base_rb_stts_dma = 0;
+        }
+
         for (i = 0; i < trans->num_rx_queues; i++) {
                 struct iwl_rxq *rxq = &trans_pcie->rxq[i];
 
@@ -1424,6 +1464,9 @@ restart:
                              !emergency)) {
                         iwl_pcie_rx_move_to_allocator(rxq, rba);
                         emergency = true;
+                        IWL_DEBUG_TPT(trans,
+                                      "RX path is in emergency. Pending allocations %d\n",
+                                      rb_pending_alloc);
                 }
 
                 IWL_DEBUG_RX(trans, "Q %d: HW = %d, SW = %d\n", rxq->id, r, i);
@@ -1453,8 +1496,12 @@ restart:
                         count++;
                         if (count == 8) {
                                 count = 0;
-                                if (rb_pending_alloc < rxq->queue_size / 3)
+                                if (rb_pending_alloc < rxq->queue_size / 3) {
+                                        IWL_DEBUG_TPT(trans,
+                                                      "RX path exited emergency. Pending allocations %d\n",
+                                                      rb_pending_alloc);
                                         emergency = false;
+                                }
 
                                 rxq->read = i;
                                 spin_unlock(&rxq->lock);
@@ -2120,7 +2167,7 @@ irqreturn_t iwl_pcie_irq_msix_handler(int irq, void *dev_id)
                 }
         }
 
-        if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_22560 &&
+        if (trans->cfg->device_family == IWL_DEVICE_FAMILY_22560 &&
             inta_hw & MSIX_HW_INT_CAUSES_REG_IPC) {
                 /* Reflect IML transfer status */
                 int res = iwl_read32(trans, CSR_IML_RESP_ADDR);
@@ -2139,6 +2186,17 @@ irqreturn_t iwl_pcie_irq_msix_handler(int irq, void *dev_id)
                 isr_stats->wakeup++;
         }
 
+        if (inta_hw & MSIX_HW_INT_CAUSES_REG_IML) {
+                /* Reflect IML transfer status */
+                int res = iwl_read32(trans, CSR_IML_RESP_ADDR);
+
+                IWL_DEBUG_ISR(trans, "IML transfer status: %d\n", res);
+                if (res == IWL_IMAGE_RESP_FAIL) {
+                        isr_stats->sw++;
+                        iwl_pcie_irq_handle_error(trans);
+                }
+        }
+
         /* Chip got too hot and stopped itself */
         if (inta_hw & MSIX_HW_INT_CAUSES_REG_CT_KILL) {
                 IWL_ERR(trans, "Microcode CT kill error detected.\n");
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
index 77f3610e5ca9..9c203ca75de9 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
@@ -92,26 +92,9 @@ int iwl_pcie_gen2_apm_init(struct iwl_trans *trans)
 
         iwl_pcie_apm_config(trans);
 
-        /*
-         * Set "initialization complete" bit to move adapter from
-         * D0U* --> D0A* (powered-up active) state.
-         */
-        iwl_set_bit(trans, CSR_GP_CNTRL,
-                    BIT(trans->cfg->csr->flag_init_done));
-
-        /*
-         * Wait for clock stabilization; once stabilized, access to
-         * device-internal resources is supported, e.g. iwl_write_prph()
-         * and accesses to uCode SRAM.
-         */
-        ret = iwl_poll_bit(trans, CSR_GP_CNTRL,
-                           BIT(trans->cfg->csr->flag_mac_clock_ready),
-                           BIT(trans->cfg->csr->flag_mac_clock_ready),
-                           25000);
-        if (ret < 0) {
-                IWL_DEBUG_INFO(trans, "Failed to init the card\n");
+        ret = iwl_finish_nic_init(trans);
+        if (ret)
                 return ret;
-        }
 
         set_bit(STATUS_DEVICE_ENABLED, &trans->status);
 
@@ -188,7 +171,7 @@ void _iwl_trans_pcie_gen2_stop_device(struct iwl_trans *trans, bool low_power)
         }
 
         iwl_pcie_ctxt_info_free_paging(trans);
-        if (trans->cfg->device_family == IWL_DEVICE_FAMILY_22560)
+        if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_22560)
                 iwl_pcie_ctxt_info_gen3_free(trans);
         else
                 iwl_pcie_ctxt_info_free(trans);
@@ -251,6 +234,7 @@ void iwl_trans_pcie_gen2_stop_device(struct iwl_trans *trans, bool low_power)
 static int iwl_pcie_gen2_nic_init(struct iwl_trans *trans)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        int queue_size = max_t(u32, TFD_CMD_SLOTS, trans->cfg->min_txq_size);
 
         /* TODO: most of the logic can be removed in A0 - but not in Z0 */
         spin_lock(&trans_pcie->irq_lock);
@@ -264,7 +248,7 @@ static int iwl_pcie_gen2_nic_init(struct iwl_trans *trans)
                 return -ENOMEM;
 
         /* Allocate or reset and init all Tx and Command queues */
-        if (iwl_pcie_gen2_tx_init(trans, trans_pcie->cmd_queue, TFD_CMD_SLOTS))
+        if (iwl_pcie_gen2_tx_init(trans, trans_pcie->cmd_queue, queue_size))
                 return -ENOMEM;
 
         /* enable shadow regs in HW */
@@ -349,7 +333,7 @@ int iwl_trans_pcie_gen2_start_fw(struct iwl_trans *trans,
                 goto out;
         }
 
-        if (trans->cfg->device_family == IWL_DEVICE_FAMILY_22560)
+        if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_22560)
                 ret = iwl_pcie_ctxt_info_gen3_init(trans, fw);
         else
                 ret = iwl_pcie_ctxt_info_init(trans, fw);
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
index f74281508197..fe8269d023de 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -8,7 +8,7 @@
  * Copyright(c) 2007 - 2015 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
  * Copyright(c) 2005 - 2015 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -364,26 +364,9 @@ static int iwl_pcie_apm_init(struct iwl_trans *trans)
         if (trans->cfg->base_params->pll_cfg)
                 iwl_set_bit(trans, CSR_ANA_PLL_CFG, CSR50_ANA_PLL_CFG_VAL);
 
-        /*
-         * Set "initialization complete" bit to move adapter from
-         * D0U* --> D0A* (powered-up active) state.
-         */
-        iwl_set_bit(trans, CSR_GP_CNTRL,
-                    BIT(trans->cfg->csr->flag_init_done));
-
-        /*
-         * Wait for clock stabilization; once stabilized, access to
-         * device-internal resources is supported, e.g. iwl_write_prph()
-         * and accesses to uCode SRAM.
-         */
-        ret = iwl_poll_bit(trans, CSR_GP_CNTRL,
-                           BIT(trans->cfg->csr->flag_mac_clock_ready),
-                           BIT(trans->cfg->csr->flag_mac_clock_ready),
-                           25000);
-        if (ret < 0) {
-                IWL_ERR(trans, "Failed to init the card\n");
+        ret = iwl_finish_nic_init(trans);
+        if (ret)
                 return ret;
-        }
 
         if (trans->cfg->host_interrupt_operation_mode) {
                 /*
@@ -453,23 +436,8 @@ static void iwl_pcie_apm_lp_xtal_enable(struct iwl_trans *trans)
 
         iwl_trans_pcie_sw_reset(trans);
 
-        /*
-         * Set "initialization complete" bit to move adapter from
-         * D0U* --> D0A* (powered-up active) state.
-         */
-        iwl_set_bit(trans, CSR_GP_CNTRL,
-                    BIT(trans->cfg->csr->flag_init_done));
-
-        /*
-         * Wait for clock stabilization; once stabilized, access to
-         * device-internal resources is possible.
-         */
-        ret = iwl_poll_bit(trans, CSR_GP_CNTRL,
-                           BIT(trans->cfg->csr->flag_mac_clock_ready),
-                           BIT(trans->cfg->csr->flag_mac_clock_ready),
-                           25000);
-        if (WARN_ON(ret < 0)) {
-                IWL_ERR(trans, "Access time out - failed to enable LP XTAL\n");
+        ret = iwl_finish_nic_init(trans);
+        if (WARN_ON(ret)) {
                 /* Release XTAL ON request */
                 __iwl_trans_pcie_clear_bit(trans, CSR_GP_CNTRL,
                                            CSR_GP_CNTRL_REG_FLAG_XTAL_ON);
@@ -928,13 +896,13 @@ void iwl_pcie_apply_destination(struct iwl_trans *trans)
                 if (!trans->num_blocks)
                         return;
 
-                iwl_write_prph(trans, MON_BUFF_BASE_ADDR_VER2,
-                               trans->fw_mon[0].physical >>
-                               MON_BUFF_SHIFT_VER2);
-                iwl_write_prph(trans, MON_BUFF_END_ADDR_VER2,
-                               (trans->fw_mon[0].physical +
-                                trans->fw_mon[0].size - 256) >>
-                               MON_BUFF_SHIFT_VER2);
+                iwl_write_umac_prph(trans, MON_BUFF_BASE_ADDR_VER2,
+                                    trans->fw_mon[0].physical >>
+                                    MON_BUFF_SHIFT_VER2);
+                iwl_write_umac_prph(trans, MON_BUFF_END_ADDR_VER2,
+                                    (trans->fw_mon[0].physical +
+                                     trans->fw_mon[0].size - 256) >>
+                                    MON_BUFF_SHIFT_VER2);
                 return;
         }
 
@@ -1126,6 +1094,7 @@ static struct iwl_causes_list causes_list[] = {
         {MSIX_FH_INT_CAUSES_FH_ERR,             CSR_MSIX_FH_INT_MASK_AD, 0x5},
         {MSIX_HW_INT_CAUSES_REG_ALIVE,          CSR_MSIX_HW_INT_MASK_AD, 0x10},
         {MSIX_HW_INT_CAUSES_REG_WAKEUP,         CSR_MSIX_HW_INT_MASK_AD, 0x11},
+        {MSIX_HW_INT_CAUSES_REG_IML,            CSR_MSIX_HW_INT_MASK_AD, 0x12},
         {MSIX_HW_INT_CAUSES_REG_CT_KILL,        CSR_MSIX_HW_INT_MASK_AD, 0x16},
         {MSIX_HW_INT_CAUSES_REG_RF_KILL,        CSR_MSIX_HW_INT_MASK_AD, 0x17},
         {MSIX_HW_INT_CAUSES_REG_PERIODIC,       CSR_MSIX_HW_INT_MASK_AD, 0x18},
@@ -1158,7 +1127,7 @@ static void iwl_pcie_map_non_rx_causes(struct iwl_trans *trans)
         struct iwl_trans_pcie *trans_pcie =  IWL_TRANS_GET_PCIE_TRANS(trans);
         int val = trans_pcie->def_irq | MSIX_NON_AUTO_CLEAR_CAUSE;
         int i, arr_size =
-                (trans->cfg->device_family < IWL_DEVICE_FAMILY_22560) ?
+                (trans->cfg->device_family != IWL_DEVICE_FAMILY_22560) ?
                 ARRAY_SIZE(causes_list) : ARRAY_SIZE(causes_list_v2);
 
         /*
@@ -1168,7 +1137,7 @@ static void iwl_pcie_map_non_rx_causes(struct iwl_trans *trans)
          */
         for (i = 0; i < arr_size; i++) {
                 struct iwl_causes_list *causes =
-                        (trans->cfg->device_family < IWL_DEVICE_FAMILY_22560) ?
+                        (trans->cfg->device_family != IWL_DEVICE_FAMILY_22560) ?
                         causes_list : causes_list_v2;
 
                 iwl_write8(trans, CSR_MSIX_IVAR(causes[i].addr), val);
@@ -1214,8 +1183,8 @@ void iwl_pcie_conf_msix_hw(struct iwl_trans_pcie *trans_pcie)
         if (!trans_pcie->msix_enabled) {
                 if (trans->cfg->mq_rx_supported &&
                     test_bit(STATUS_DEVICE_ENABLED, &trans->status))
-                        iwl_write_prph(trans, UREG_CHICK,
-                                       UREG_CHICK_MSI_ENABLE);
+                        iwl_write_umac_prph(trans, UREG_CHICK,
+                                            UREG_CHICK_MSI_ENABLE);
                 return;
         }
         /*
@@ -1224,7 +1193,7 @@ void iwl_pcie_conf_msix_hw(struct iwl_trans_pcie *trans_pcie)
          * prph.
          */
         if (test_bit(STATUS_DEVICE_ENABLED, &trans->status))
-                iwl_write_prph(trans, UREG_CHICK, UREG_CHICK_MSIX_ENABLE);
+                iwl_write_umac_prph(trans, UREG_CHICK, UREG_CHICK_MSIX_ENABLE);
 
         /*
          * Each cause from the causes list above and the RX causes is
@@ -1558,20 +1527,10 @@ static int iwl_trans_pcie_d3_resume(struct iwl_trans *trans,
 
         iwl_set_bit(trans, CSR_GP_CNTRL,
                     BIT(trans->cfg->csr->flag_mac_access_req));
-        iwl_set_bit(trans, CSR_GP_CNTRL,
-                    BIT(trans->cfg->csr->flag_init_done));
-
-        if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_8000)
-                udelay(2);
 
-        ret = iwl_poll_bit(trans, CSR_GP_CNTRL,
-                           BIT(trans->cfg->csr->flag_mac_clock_ready),
-                           BIT(trans->cfg->csr->flag_mac_clock_ready),
-                           25000);
-        if (ret < 0) {
-                IWL_ERR(trans, "Failed to resume the device (mac ready)\n");
+        ret = iwl_finish_nic_init(trans);
+        if (ret)
                 return ret;
-        }
 
         /*
          * Reconfigure IVAR table in case of MSIX or reset ict table in
@@ -1602,7 +1561,7 @@ static int iwl_trans_pcie_d3_resume(struct iwl_trans *trans,
         }
 
         IWL_DEBUG_POWER(trans, "WFPM value upon resume = 0x%08X\n",
-                        iwl_read_prph(trans, WFPM_GP2));
+                        iwl_read_umac_prph(trans, WFPM_GP2));
 
         val = iwl_read32(trans, CSR_RESET);
         if (val & CSR_RESET_REG_FLAG_NEVO_RESET)
@@ -1751,15 +1710,18 @@ static int _iwl_trans_pcie_start_hw(struct iwl_trans *trans, bool low_power)
                 return err;
         }
 
-        hpm = iwl_trans_read_prph(trans, HPM_DEBUG);
+        hpm = iwl_read_umac_prph_no_grab(trans, HPM_DEBUG);
         if (hpm != 0xa5a5a5a0 && (hpm & PERSISTENCE_BIT)) {
-                if (iwl_trans_read_prph(trans, PREG_PRPH_WPROT_0) &
-                    PREG_WFPM_ACCESS) {
+                int wfpm_val = iwl_read_umac_prph_no_grab(trans,
+                                                          PREG_PRPH_WPROT_0);
+
+                if (wfpm_val & PREG_WFPM_ACCESS) {
                         IWL_ERR(trans,
                                 "Error, can not clear persistence bit\n");
                         return -EPERM;
                 }
-                iwl_trans_write_prph(trans, HPM_DEBUG, hpm & ~PERSISTENCE_BIT);
+                iwl_write_umac_prph_no_grab(trans, HPM_DEBUG,
+                                            hpm & ~PERSISTENCE_BIT);
         }
 
         iwl_trans_pcie_sw_reset(trans);
@@ -2281,6 +2243,7 @@ static int iwl_trans_pcie_wait_txq_empty(struct iwl_trans *trans, int txq_idx)
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_txq *txq;
         unsigned long now = jiffies;
+        bool overflow_tx;
         u8 wr_ptr;
 
         /* Make sure the NIC is still alive in the bus */
@@ -2292,18 +2255,37 @@ static int iwl_trans_pcie_wait_txq_empty(struct iwl_trans *trans, int txq_idx)
 
         IWL_DEBUG_TX_QUEUES(trans, "Emptying queue %d...\n", txq_idx);
         txq = trans_pcie->txq[txq_idx];
+
+        spin_lock_bh(&txq->lock);
+        overflow_tx = txq->overflow_tx ||
+                      !skb_queue_empty(&txq->overflow_q);
+        spin_unlock_bh(&txq->lock);
+
         wr_ptr = READ_ONCE(txq->write_ptr);
 
-        while (txq->read_ptr != READ_ONCE(txq->write_ptr) &&
+        while ((txq->read_ptr != READ_ONCE(txq->write_ptr) ||
+                overflow_tx) &&
                !time_after(jiffies,
                            now + msecs_to_jiffies(IWL_FLUSH_WAIT_MS))) {
                 u8 write_ptr = READ_ONCE(txq->write_ptr);
 
-                if (WARN_ONCE(wr_ptr != write_ptr,
+                /*
+                 * If write pointer moved during the wait, warn only
+                 * if the TX came from op mode. In case TX came from
+                 * trans layer (overflow TX) don't warn.
+                 */
+                if (WARN_ONCE(wr_ptr != write_ptr && !overflow_tx,
                               "WR pointer moved while flushing %d -> %d\n",
                               wr_ptr, write_ptr))
                         return -ETIMEDOUT;
+                wr_ptr = write_ptr;
+
                 usleep_range(1000, 2000);
+
+                spin_lock_bh(&txq->lock);
+                overflow_tx = txq->overflow_tx ||
+                              !skb_queue_empty(&txq->overflow_q);
+                spin_unlock_bh(&txq->lock);
         }
 
         if (txq->read_ptr != txq->write_ptr) {
@@ -2989,7 +2971,8 @@ static u32 iwl_trans_pcie_fh_regs_dump(struct iwl_trans *trans,
                      i += sizeof(u32))
                         *val++ = cpu_to_le32(iwl_trans_pcie_read32(trans, i));
         else
-                for (i = FH_MEM_LOWER_BOUND_GEN2; i < FH_MEM_UPPER_BOUND_GEN2;
+                for (i = iwl_umac_prph(trans, FH_MEM_LOWER_BOUND_GEN2);
+                     i < iwl_umac_prph(trans, FH_MEM_UPPER_BOUND_GEN2);
                      i += sizeof(u32))
                         *val++ = cpu_to_le32(iwl_trans_pcie_read_prph(trans,
                                                                       i));
@@ -3014,11 +2997,11 @@ iwl_trans_pci_dump_marbh_monitor(struct iwl_trans *trans,
         if (!iwl_trans_grab_nic_access(trans, &flags))
                 return 0;
 
-        iwl_write_prph_no_grab(trans, MON_DMARB_RD_CTL_ADDR, 0x1);
+        iwl_write_umac_prph_no_grab(trans, MON_DMARB_RD_CTL_ADDR, 0x1);
         for (i = 0; i < buf_size_in_dwords; i++)
-                buffer[i] = iwl_read_prph_no_grab(trans,
-                                MON_DMARB_RD_DATA_ADDR);
-        iwl_write_prph_no_grab(trans, MON_DMARB_RD_CTL_ADDR, 0x0);
+                buffer[i] = iwl_read_umac_prph_no_grab(trans,
+                                                       MON_DMARB_RD_DATA_ADDR);
+        iwl_write_umac_prph_no_grab(trans, MON_DMARB_RD_CTL_ADDR, 0x0);
 
         iwl_trans_release_nic_access(trans, &flags);
 
@@ -3033,9 +3016,9 @@ iwl_trans_pcie_dump_pointers(struct iwl_trans *trans,
 
         /* If there was a dest TLV - use the values from there */
         if (trans->ini_valid) {
-                base = MON_BUFF_BASE_ADDR_VER2;
-                write_ptr = MON_BUFF_WRPTR_VER2;
-                wrap_cnt = MON_BUFF_CYCLE_CNT_VER2;
+                base = iwl_umac_prph(trans, MON_BUFF_BASE_ADDR_VER2);
+                write_ptr = iwl_umac_prph(trans, MON_BUFF_WRPTR_VER2);
+                wrap_cnt = iwl_umac_prph(trans, MON_BUFF_CYCLE_CNT_VER2);
         } else if (trans->dbg_dest_tlv) {
                 write_ptr = le32_to_cpu(trans->dbg_dest_tlv->write_ptr_reg);
                 wrap_cnt = le32_to_cpu(trans->dbg_dest_tlv->wrap_count);
@@ -3197,8 +3180,8 @@ static struct iwl_trans_dump_data
         if (dump_mask & BIT(IWL_FW_ERROR_DUMP_FH_REGS)) {
                 if (trans->cfg->gen2)
                         len += sizeof(*data) +
-                               (FH_MEM_UPPER_BOUND_GEN2 -
-                                FH_MEM_LOWER_BOUND_GEN2);
+                               (iwl_umac_prph(trans, FH_MEM_UPPER_BOUND_GEN2) -
+                                iwl_umac_prph(trans, FH_MEM_LOWER_BOUND_GEN2));
                 else
                         len += sizeof(*data) +
                                (FH_MEM_UPPER_BOUND -
@@ -3220,10 +3203,10 @@ static struct iwl_trans_dump_data
 
         /* Paged memory for gen2 HW */
         if (trans->cfg->gen2 && dump_mask & BIT(IWL_FW_ERROR_DUMP_PAGING))
-                for (i = 0; i < trans_pcie->init_dram.paging_cnt; i++)
+                for (i = 0; i < trans->init_dram.paging_cnt; i++)
                         len += sizeof(*data) +
                                sizeof(struct iwl_fw_error_dump_paging) +
-                               trans_pcie->init_dram.paging[i].size;
+                               trans->init_dram.paging[i].size;
 
         dump_data = vzalloc(len);
         if (!dump_data)
@@ -3275,20 +3258,16 @@ static struct iwl_trans_dump_data
 
         /* Paged memory for gen2 HW */
         if (trans->cfg->gen2 && dump_mask & BIT(IWL_FW_ERROR_DUMP_PAGING)) {
-                for (i = 0; i < trans_pcie->init_dram.paging_cnt; i++) {
+                for (i = 0; i < trans->init_dram.paging_cnt; i++) {
                         struct iwl_fw_error_dump_paging *paging;
-                        dma_addr_t addr =
-                                trans_pcie->init_dram.paging[i].physical;
-                        u32 page_len = trans_pcie->init_dram.paging[i].size;
+                        u32 page_len = trans->init_dram.paging[i].size;
 
                         data->type = cpu_to_le32(IWL_FW_ERROR_DUMP_PAGING);
                         data->len = cpu_to_le32(sizeof(*paging) + page_len);
                         paging = (void *)data->data;
                         paging->index = cpu_to_le32(i);
-                        dma_sync_single_for_cpu(trans->dev, addr, page_len,
-                                                DMA_BIDIRECTIONAL);
                         memcpy(paging->data,
-                               trans_pcie->init_dram.paging[i].block, page_len);
+                               trans->init_dram.paging[i].block, page_len);
                         data = iwl_fw_error_next_data(data);
 
                         len += sizeof(*data) + sizeof(*paging) + page_len;
@@ -3525,25 +3504,18 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
                  * in-order to recognize C step driver should read chip version
                  * id located at the AUX bus MISC address space.
                  */
-                iwl_set_bit(trans, CSR_GP_CNTRL,
-                            BIT(trans->cfg->csr->flag_init_done));
-                udelay(2);
-
-                ret = iwl_poll_bit(trans, CSR_GP_CNTRL,
-                                   BIT(trans->cfg->csr->flag_mac_clock_ready),
-                                   BIT(trans->cfg->csr->flag_mac_clock_ready),
-                                   25000);
-                if (ret < 0) {
-                        IWL_DEBUG_INFO(trans, "Failed to wake up the nic\n");
+                ret = iwl_finish_nic_init(trans);
+                if (ret)
                         goto out_no_pci;
-                }
 
                 if (iwl_trans_grab_nic_access(trans, &flags)) {
                         u32 hw_step;
 
-                        hw_step = iwl_read_prph_no_grab(trans, WFPM_CTRL_REG);
+                        hw_step = iwl_read_umac_prph_no_grab(trans,
+                                                             WFPM_CTRL_REG);
                         hw_step |= ENABLE_WFPM;
-                        iwl_write_prph_no_grab(trans, WFPM_CTRL_REG, hw_step);
+                        iwl_write_umac_prph_no_grab(trans, WFPM_CTRL_REG,
+                                                    hw_step);
                         hw_step = iwl_read_prph_no_grab(trans, AUX_MISC_REG);
                         hw_step = (hw_step >> HW_STEP_LOCATION_BITS) & 0xF;
                         if (hw_step == 0x3)
@@ -3558,10 +3530,20 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
 #if IS_ENABLED(CONFIG_IWLMVM)
         trans->hw_rf_id = iwl_read32(trans, CSR_HW_RF_ID);
 
-        if (cfg == &iwl22560_2ax_cfg_hr) {
+        if (cfg == &iwlax210_2ax_cfg_so_hr_a0) {
+                if (trans->hw_rev == CSR_HW_REV_TYPE_TY) {
+                        trans->cfg = &iwlax210_2ax_cfg_ty_gf_a0;
+                } else if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
+                           CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_JF)) {
+                        trans->cfg = &iwlax210_2ax_cfg_so_jf_a0;
+                } else if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
+                           CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_GF)) {
+                        trans->cfg = &iwlax210_2ax_cfg_so_gf_a0;
+                }
+        } else if (cfg == &iwl_ax101_cfg_qu_hr) {
                 if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
                     CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HR)) {
-                        trans->cfg = &iwl22560_2ax_cfg_hr;
+                        trans->cfg = &iwl_ax101_cfg_qu_hr;
                 } else if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
                            CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_JF)) {
                         trans->cfg = &iwl22000_2ax_cfg_jf;
@@ -3654,3 +3636,28 @@ out_no_pci:
         iwl_trans_free(trans);
         return ERR_PTR(ret);
 }
+
+void iwl_trans_sync_nmi(struct iwl_trans *trans)
+{
+        unsigned long timeout = jiffies + IWL_TRANS_NMI_TIMEOUT;
+
+        iwl_disable_interrupts(trans);
+        iwl_force_nmi(trans);
+        while (time_after(timeout, jiffies)) {
+                u32 inta_hw = iwl_read32(trans,
+                                         CSR_MSIX_HW_INT_CAUSES_AD);
+
+                /* Error detected by uCode */
+                if (inta_hw & MSIX_HW_INT_CAUSES_REG_SW_ERR) {
+                        /* Clear causes register */
+                        iwl_write32(trans, CSR_MSIX_HW_INT_CAUSES_AD,
+                                    inta_hw &
+                                    MSIX_HW_INT_CAUSES_REG_SW_ERR);
+                        break;
+                }
+
+                mdelay(1);
+        }
+        iwl_enable_interrupts(trans);
+        iwl_trans_fw_error(trans);
+}
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
index f3d2e8fe920b..88530d9f4a54 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
@@ -6,7 +6,7 @@
  * GPL LICENSE SUMMARY
  *
  * Copyright(c) 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -20,7 +20,7 @@
  * BSD LICENSE
  *
  * Copyright(c) 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -965,9 +965,7 @@ static int iwl_pcie_gen2_send_hcmd_sync(struct iwl_trans *trans,
                                cmd_str);
                 ret = -ETIMEDOUT;
 
-                iwl_force_nmi(trans);
-                iwl_trans_fw_error(trans);
-
+                iwl_trans_sync_nmi(trans);
                 goto cancel;
         }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
index 07395502f419..9fbd37d23e85 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
@@ -8,7 +8,7 @@
  * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
  * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -995,7 +995,11 @@ static int iwl_pcie_tx_alloc(struct iwl_trans *trans)
              txq_id++) {
                 bool cmd_queue = (txq_id == trans_pcie->cmd_queue);
 
-                slots_num = cmd_queue ? TFD_CMD_SLOTS : TFD_TX_CMD_SLOTS;
+                if (cmd_queue)
+                        slots_num = max_t(u32, TFD_CMD_SLOTS,
+                                          trans->cfg->min_txq_size);
+                else
+                        slots_num = TFD_TX_CMD_SLOTS;
                 trans_pcie->txq[txq_id] = &trans_pcie->txq_memory[txq_id];
                 ret = iwl_pcie_txq_alloc(trans, trans_pcie->txq[txq_id],
                                          slots_num, cmd_queue);
@@ -1044,7 +1048,11 @@ int iwl_pcie_tx_init(struct iwl_trans *trans)
              txq_id++) {
                 bool cmd_queue = (txq_id == trans_pcie->cmd_queue);
 
-                slots_num = cmd_queue ? TFD_CMD_SLOTS : TFD_TX_CMD_SLOTS;
+                if (cmd_queue)
+                        slots_num = max_t(u32, TFD_CMD_SLOTS,
+                                          trans->cfg->min_txq_size);
+                else
+                        slots_num = TFD_TX_CMD_SLOTS;
                 ret = iwl_pcie_txq_init(trans, trans_pcie->txq[txq_id],
                                         slots_num, cmd_queue);
                 if (ret) {
@@ -1174,6 +1182,15 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
                 skb_queue_splice_init(&txq->overflow_q, &overflow_skbs);
 
                 /*
+                 * We are going to transmit from the overflow queue.
+                 * Remember this state so that wait_for_txq_empty will know we
+                 * are adding more packets to the TFD queue. It cannot rely on
+                 * the state of &txq->overflow_q, as we just emptied it, but
+                 * haven't TXed the content yet.
+                 */
+                txq->overflow_tx = true;
+
+                /*
                  * This is tricky: we are in reclaim path which is non
                  * re-entrant, so noone will try to take the access the
                  * txq data from that path. We stopped tx, so we can't
@@ -1201,6 +1218,7 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
                         iwl_wake_queue(trans, txq);
 
                 spin_lock_bh(&txq->lock);
+                txq->overflow_tx = false;
         }
 
         if (txq->read_ptr == txq->write_ptr) {
@@ -1942,9 +1960,7 @@ static int iwl_pcie_send_hcmd_sync(struct iwl_trans *trans,
                                iwl_get_cmd_string(trans, cmd->id));
                 ret = -ETIMEDOUT;
 
-                iwl_force_nmi(trans);
-                iwl_trans_fw_error(trans);
-
+                iwl_trans_sync_nmi(trans);
                 goto cancel;
         }