72 files changed, 3270 insertions, 622 deletions

diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
index a889fd66fc63..fd9e5305e77f 100644
--- a/drivers/net/wireless/ath/ath.h
+++ b/drivers/net/wireless/ath/ath.h
@@ -63,6 +63,7 @@ enum ath_op_flags {
         ATH_OP_PRIM_STA_VIF,
         ATH_OP_HW_RESET,
         ATH_OP_SCANNING,
+        ATH_OP_MULTI_CHANNEL,
 };
 
 enum ath_bus_type {
diff --git a/drivers/net/wireless/ath/ath10k/ce.c b/drivers/net/wireless/ath/ath10k/ce.c
index d185dc0cd12b..4333107ecf37 100644
--- a/drivers/net/wireless/ath/ath10k/ce.c
+++ b/drivers/net/wireless/ath/ath10k/ce.c
@@ -603,16 +603,19 @@ static int ath10k_ce_completed_send_next_nolock(struct ath10k_ce_pipe *ce_state,
                 if (ret)
                         return ret;
 
-                src_ring->hw_index =
-                        ath10k_ce_src_ring_read_index_get(ar, ctrl_addr);
-                src_ring->hw_index &= nentries_mask;
+                read_index = ath10k_ce_src_ring_read_index_get(ar, ctrl_addr);
+                if (read_index == 0xffffffff)
+                        return -ENODEV;
+
+                read_index &= nentries_mask;
+                src_ring->hw_index = read_index;
 
                 ath10k_pci_sleep(ar);
         }
 
         read_index = src_ring->hw_index;
 
-        if ((read_index == sw_index) || (read_index == 0xffffffff))
+        if (read_index == sw_index)
                 return -EIO;
 
         sbase = src_ring->shadow_base;
diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
index e6c56c5bb0f6..93adb8c58969 100644
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -802,7 +802,7 @@ int ath10k_core_start(struct ath10k *ar)
 
         INIT_LIST_HEAD(&ar->arvifs);
 
-        if (!test_bit(ATH10K_FLAG_FIRST_BOOT_DONE, &ar->dev_flags))
+        if (!test_bit(ATH10K_FLAG_FIRST_BOOT_DONE, &ar->dev_flags)) {
                 ath10k_info("%s (0x%08x, 0x%08x) fw %s api %d htt %d.%d\n",
                             ar->hw_params.name,
                             ar->target_version,
@@ -811,6 +811,12 @@ int ath10k_core_start(struct ath10k *ar)
                             ar->fw_api,
                             ar->htt.target_version_major,
                             ar->htt.target_version_minor);
+                ath10k_info("debug %d debugfs %d tracing %d dfs %d\n",
+                            config_enabled(CONFIG_ATH10K_DEBUG),
+                            config_enabled(CONFIG_ATH10K_DEBUGFS),
+                            config_enabled(CONFIG_ATH10K_TRACING),
+                            config_enabled(CONFIG_ATH10K_DFS_CERTIFIED));
+        }
 
         __set_bit(ATH10K_FLAG_FIRST_BOOT_DONE, &ar->dev_flags);
 
@@ -988,7 +994,9 @@ err_unregister_mac:
 err_release_fw:
         ath10k_core_free_firmware_files(ar);
 err:
-        device_release_driver(ar->dev);
+        /* TODO: It's probably a good idea to release device from the driver
+         * but calling device_release_driver() here will cause a deadlock.
+         */
         return;
 }
 
diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h
index 68ceef61933d..83a5fa91531d 100644
--- a/drivers/net/wireless/ath/ath10k/core.h
+++ b/drivers/net/wireless/ath/ath10k/core.h
@@ -290,6 +290,9 @@ struct ath10k_debug {
         struct ath_dfs_pool_stats dfs_pool_stats;
 
         u32 fw_dbglog_mask;
+
+        u8 htt_max_amsdu;
+        u8 htt_max_ampdu;
 };
 
 enum ath10k_state {
diff --git a/drivers/net/wireless/ath/ath10k/debug.c b/drivers/net/wireless/ath/ath10k/debug.c
index 1b7ff4ba122c..3030158c478e 100644
--- a/drivers/net/wireless/ath/ath10k/debug.c
+++ b/drivers/net/wireless/ath/ath10k/debug.c
@@ -671,6 +671,72 @@ static const struct file_operations fops_htt_stats_mask = {
         .llseek = default_llseek,
 };
 
+static ssize_t ath10k_read_htt_max_amsdu_ampdu(struct file *file,
+                                               char __user *user_buf,
+                                               size_t count, loff_t *ppos)
+{
+        struct ath10k *ar = file->private_data;
+        char buf[64];
+        u8 amsdu = 3, ampdu = 64;
+        unsigned int len;
+
+        mutex_lock(&ar->conf_mutex);
+
+        if (ar->debug.htt_max_amsdu)
+                amsdu = ar->debug.htt_max_amsdu;
+
+        if (ar->debug.htt_max_ampdu)
+                ampdu = ar->debug.htt_max_ampdu;
+
+        mutex_unlock(&ar->conf_mutex);
+
+        len = scnprintf(buf, sizeof(buf), "%u %u\n", amsdu, ampdu);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t ath10k_write_htt_max_amsdu_ampdu(struct file *file,
+                                                const char __user *user_buf,
+                                                size_t count, loff_t *ppos)
+{
+        struct ath10k *ar = file->private_data;
+        int res;
+        char buf[64];
+        unsigned int amsdu, ampdu;
+
+        simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf, count);
+
+        /* make sure that buf is null terminated */
+        buf[sizeof(buf) - 1] = 0;
+
+        res = sscanf(buf, "%u %u", &amsdu, &ampdu);
+
+        if (res != 2)
+                return -EINVAL;
+
+        mutex_lock(&ar->conf_mutex);
+
+        res = ath10k_htt_h2t_aggr_cfg_msg(&ar->htt, ampdu, amsdu);
+        if (res)
+                goto out;
+
+        res = count;
+        ar->debug.htt_max_amsdu = amsdu;
+        ar->debug.htt_max_ampdu = ampdu;
+
+out:
+        mutex_unlock(&ar->conf_mutex);
+        return res;
+}
+
+static const struct file_operations fops_htt_max_amsdu_ampdu = {
+        .read = ath10k_read_htt_max_amsdu_ampdu,
+        .write = ath10k_write_htt_max_amsdu_ampdu,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
 static ssize_t ath10k_read_fw_dbglog(struct file *file,
                                             char __user *user_buf,
                                             size_t count, loff_t *ppos)
@@ -757,6 +823,9 @@ void ath10k_debug_stop(struct ath10k *ar)
          * warning from del_timer(). */
         if (ar->debug.htt_stats_mask != 0)
                 cancel_delayed_work(&ar->debug.htt_stats_dwork);
+
+        ar->debug.htt_max_amsdu = 0;
+        ar->debug.htt_max_ampdu = 0;
 }
 
 static ssize_t ath10k_write_simulate_radar(struct file *file,
@@ -867,6 +936,10 @@ int ath10k_debug_create(struct ath10k *ar)
         debugfs_create_file("htt_stats_mask", S_IRUSR, ar->debug.debugfs_phy,
                             ar, &fops_htt_stats_mask);
 
+        debugfs_create_file("htt_max_amsdu_ampdu", S_IRUSR | S_IWUSR,
+                            ar->debug.debugfs_phy, ar,
+                            &fops_htt_max_amsdu_ampdu);
+
         debugfs_create_file("fw_dbglog", S_IRUSR, ar->debug.debugfs_phy,
                             ar, &fops_fw_dbglog);
 
diff --git a/drivers/net/wireless/ath/ath10k/htc.c b/drivers/net/wireless/ath/ath10k/htc.c
index e493db4b4a41..5fdc40d3b378 100644
--- a/drivers/net/wireless/ath/ath10k/htc.c
+++ b/drivers/net/wireless/ath/ath10k/htc.c
@@ -546,7 +546,7 @@ static u8 ath10k_htc_get_credit_allocation(struct ath10k_htc *htc,
 
 int ath10k_htc_wait_target(struct ath10k_htc *htc)
 {
-        int status = 0;
+        int i, status = 0;
         struct ath10k_htc_svc_conn_req conn_req;
         struct ath10k_htc_svc_conn_resp conn_resp;
         struct ath10k_htc_msg *msg;
@@ -556,10 +556,26 @@ int ath10k_htc_wait_target(struct ath10k_htc *htc)
 
         status = wait_for_completion_timeout(&htc->ctl_resp,
                                              ATH10K_HTC_WAIT_TIMEOUT_HZ);
-        if (status <= 0) {
+        if (status == 0) {
+                /* Workaround: In some cases the PCI HIF doesn't
+                 * receive interrupt for the control response message
+                 * even if the buffer was completed. It is suspected
+                 * iomap writes unmasking PCI CE irqs aren't propagated
+                 * properly in KVM PCI-passthrough sometimes.
+                 */
+                ath10k_warn("failed to receive control response completion, polling..\n");
+
+                for (i = 0; i < CE_COUNT; i++)
+                        ath10k_hif_send_complete_check(htc->ar, i, 1);
+
+                status = wait_for_completion_timeout(&htc->ctl_resp,
+                                        ATH10K_HTC_WAIT_TIMEOUT_HZ);
+
                 if (status == 0)
                         status = -ETIMEDOUT;
+        }
 
+        if (status < 0) {
                 ath10k_err("ctl_resp never came in (%d)\n", status);
                 return status;
         }
diff --git a/drivers/net/wireless/ath/ath10k/htt.h b/drivers/net/wireless/ath/ath10k/htt.h
index 9a263462c793..6c93f3885ee5 100644
--- a/drivers/net/wireless/ath/ath10k/htt.h
+++ b/drivers/net/wireless/ath/ath10k/htt.h
@@ -240,16 +240,10 @@ struct htt_oob_sync_req {
         __le16 rsvd0;
 } __packed;
 
-#define HTT_AGGR_CONF_MAX_NUM_AMSDU_SUBFRAMES_MASK 0x1F
-#define HTT_AGGR_CONF_MAX_NUM_AMSDU_SUBFRAMES_LSB  0
-
 struct htt_aggr_conf {
         u8 max_num_ampdu_subframes;
-        union {
-                /* dont use bitfields; undefined behaviour */
-                u8 flags; /* see %HTT_AGGR_CONF_MAX_NUM_AMSDU_SUBFRAMES_ */
-                u8 max_num_amsdu_subframes:5;
-        } __packed;
+        /* amsdu_subframes is limited by 0x1F mask */
+        u8 max_num_amsdu_subframes;
 } __packed;
 
 #define HTT_MGMT_FRM_HDR_DOWNLOAD_LEN 32
@@ -1343,6 +1337,9 @@ void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb);
 int ath10k_htt_h2t_ver_req_msg(struct ath10k_htt *htt);
 int ath10k_htt_h2t_stats_req(struct ath10k_htt *htt, u8 mask, u64 cookie);
 int ath10k_htt_send_rx_ring_cfg_ll(struct ath10k_htt *htt);
+int ath10k_htt_h2t_aggr_cfg_msg(struct ath10k_htt *htt,
+                                u8 max_subfrms_ampdu,
+                                u8 max_subfrms_amsdu);
 
 void __ath10k_htt_tx_dec_pending(struct ath10k_htt *htt);
 int ath10k_htt_tx_alloc_msdu_id(struct ath10k_htt *htt);
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index eebc860c3655..80cdac15588a 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -21,6 +21,7 @@
 #include "txrx.h"
 #include "debug.h"
 #include "trace.h"
+#include "mac.h"
 
 #include <linux/log2.h>
 
@@ -307,7 +308,8 @@ static void ath10k_htt_rx_free_msdu_chain(struct sk_buff *skb)
 static int ath10k_htt_rx_amsdu_pop(struct ath10k_htt *htt,
                                    u8 **fw_desc, int *fw_desc_len,
                                    struct sk_buff **head_msdu,
-                                   struct sk_buff **tail_msdu)
+                                   struct sk_buff **tail_msdu,
+                                   u32 *attention)
 {
         int msdu_len, msdu_chaining = 0;
         struct sk_buff *msdu;
@@ -357,6 +359,11 @@ static int ath10k_htt_rx_amsdu_pop(struct ath10k_htt *htt,
                         break;
                 }
 
+                *attention |= __le32_to_cpu(rx_desc->attention.flags) &
+                                            (RX_ATTENTION_FLAGS_TKIP_MIC_ERR |
+                                             RX_ATTENTION_FLAGS_DECRYPT_ERR |
+                                             RX_ATTENTION_FLAGS_FCS_ERR |
+                                             RX_ATTENTION_FLAGS_MGMT_TYPE);
                 /*
                  * Copy the FW rx descriptor for this MSDU from the rx
                  * indication message into the MSDU's netbuf. HL uses the
@@ -1215,13 +1222,15 @@ static void ath10k_htt_rx_handler(struct ath10k_htt *htt,
                 for (j = 0; j < mpdu_ranges[i].mpdu_count; j++) {
                         struct sk_buff *msdu_head, *msdu_tail;
 
+                        attention = 0;
                         msdu_head = NULL;
                         msdu_tail = NULL;
                         ret = ath10k_htt_rx_amsdu_pop(htt,
                                                       &fw_desc,
                                                       &fw_desc_len,
                                                       &msdu_head,
-                                                      &msdu_tail);
+                                                      &msdu_tail,
+                                                      &attention);
 
                         if (ret < 0) {
                                 ath10k_warn("failed to pop amsdu from htt rx ring %d\n",
@@ -1233,7 +1242,6 @@ static void ath10k_htt_rx_handler(struct ath10k_htt *htt,
                         rxd = container_of((void *)msdu_head->data,
                                            struct htt_rx_desc,
                                            msdu_payload);
-                        attention = __le32_to_cpu(rxd->attention.flags);
 
                         if (!ath10k_htt_rx_amsdu_allowed(htt, msdu_head,
                                                          status,
@@ -1286,6 +1294,7 @@ static void ath10k_htt_rx_frag_handler(struct ath10k_htt *htt,
         u8 *fw_desc;
         int fw_desc_len, hdrlen, paramlen;
         int trim;
+        u32 attention = 0;
 
         fw_desc_len = __le16_to_cpu(frag->fw_rx_desc_bytes);
         fw_desc = (u8 *)frag->fw_msdu_rx_desc;
@@ -1295,7 +1304,8 @@ static void ath10k_htt_rx_frag_handler(struct ath10k_htt *htt,
 
         spin_lock_bh(&htt->rx_ring.lock);
         ret = ath10k_htt_rx_amsdu_pop(htt, &fw_desc, &fw_desc_len,
-                                      &msdu_head, &msdu_tail);
+                                      &msdu_head, &msdu_tail,
+                                      &attention);
         spin_unlock_bh(&htt->rx_ring.lock);
 
         ath10k_dbg(ATH10K_DBG_HTT_DUMP, "htt rx frag ahead\n");
@@ -1312,10 +1322,8 @@ static void ath10k_htt_rx_frag_handler(struct ath10k_htt *htt,
 
         hdr = (struct ieee80211_hdr *)msdu_head->data;
         rxd = (void *)msdu_head->data - sizeof(*rxd);
-        tkip_mic_err = !!(__le32_to_cpu(rxd->attention.flags) &
-                                RX_ATTENTION_FLAGS_TKIP_MIC_ERR);
-        decrypt_err = !!(__le32_to_cpu(rxd->attention.flags) &
-                                RX_ATTENTION_FLAGS_DECRYPT_ERR);
+        tkip_mic_err = !!(attention & RX_ATTENTION_FLAGS_TKIP_MIC_ERR);
+        decrypt_err = !!(attention & RX_ATTENTION_FLAGS_DECRYPT_ERR);
         fmt = MS(__le32_to_cpu(rxd->msdu_start.info1),
                         RX_MSDU_START_INFO1_DECAP_FORMAT);
 
@@ -1422,6 +1430,86 @@ static void ath10k_htt_rx_frm_tx_compl(struct ath10k *ar,
         }
 }
 
+static void ath10k_htt_rx_addba(struct ath10k *ar, struct htt_resp *resp)
+{
+        struct htt_rx_addba *ev = &resp->rx_addba;
+        struct ath10k_peer *peer;
+        struct ath10k_vif *arvif;
+        u16 info0, tid, peer_id;
+
+        info0 = __le16_to_cpu(ev->info0);
+        tid = MS(info0, HTT_RX_BA_INFO0_TID);
+        peer_id = MS(info0, HTT_RX_BA_INFO0_PEER_ID);
+
+        ath10k_dbg(ATH10K_DBG_HTT,
+                   "htt rx addba tid %hu peer_id %hu size %hhu\n",
+                   tid, peer_id, ev->window_size);
+
+        spin_lock_bh(&ar->data_lock);
+        peer = ath10k_peer_find_by_id(ar, peer_id);
+        if (!peer) {
+                ath10k_warn("received addba event for invalid peer_id: %hu\n",
+                            peer_id);
+                spin_unlock_bh(&ar->data_lock);
+                return;
+        }
+
+        arvif = ath10k_get_arvif(ar, peer->vdev_id);
+        if (!arvif) {
+                ath10k_warn("received addba event for invalid vdev_id: %u\n",
+                            peer->vdev_id);
+                spin_unlock_bh(&ar->data_lock);
+                return;
+        }
+
+        ath10k_dbg(ATH10K_DBG_HTT,
+                   "htt rx start rx ba session sta %pM tid %hu size %hhu\n",
+                   peer->addr, tid, ev->window_size);
+
+        ieee80211_start_rx_ba_session_offl(arvif->vif, peer->addr, tid);
+        spin_unlock_bh(&ar->data_lock);
+}
+
+static void ath10k_htt_rx_delba(struct ath10k *ar, struct htt_resp *resp)
+{
+        struct htt_rx_delba *ev = &resp->rx_delba;
+        struct ath10k_peer *peer;
+        struct ath10k_vif *arvif;
+        u16 info0, tid, peer_id;
+
+        info0 = __le16_to_cpu(ev->info0);
+        tid = MS(info0, HTT_RX_BA_INFO0_TID);
+        peer_id = MS(info0, HTT_RX_BA_INFO0_PEER_ID);
+
+        ath10k_dbg(ATH10K_DBG_HTT,
+                   "htt rx delba tid %hu peer_id %hu\n",
+                   tid, peer_id);
+
+        spin_lock_bh(&ar->data_lock);
+        peer = ath10k_peer_find_by_id(ar, peer_id);
+        if (!peer) {
+                ath10k_warn("received addba event for invalid peer_id: %hu\n",
+                            peer_id);
+                spin_unlock_bh(&ar->data_lock);
+                return;
+        }
+
+        arvif = ath10k_get_arvif(ar, peer->vdev_id);
+        if (!arvif) {
+                ath10k_warn("received addba event for invalid vdev_id: %u\n",
+                            peer->vdev_id);
+                spin_unlock_bh(&ar->data_lock);
+                return;
+        }
+
+        ath10k_dbg(ATH10K_DBG_HTT,
+                   "htt rx stop rx ba session sta %pM tid %hu\n",
+                   peer->addr, tid);
+
+        ieee80211_stop_rx_ba_session_offl(arvif->vif, peer->addr, tid);
+        spin_unlock_bh(&ar->data_lock);
+}
+
 void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb)
 {
         struct ath10k_htt *htt = &ar->htt;
@@ -1516,9 +1604,25 @@ void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb)
                 trace_ath10k_htt_stats(skb->data, skb->len);
                 break;
         case HTT_T2H_MSG_TYPE_TX_INSPECT_IND:
+                /* Firmware can return tx frames if it's unable to fully
+                 * process them and suspects host may be able to fix it. ath10k
+                 * sends all tx frames as already inspected so this shouldn't
+                 * happen unless fw has a bug.
+                 */
+                ath10k_warn("received an unexpected htt tx inspect event\n");
+                break;
         case HTT_T2H_MSG_TYPE_RX_ADDBA:
+                ath10k_htt_rx_addba(ar, resp);
+                break;
         case HTT_T2H_MSG_TYPE_RX_DELBA:
-        case HTT_T2H_MSG_TYPE_RX_FLUSH:
+                ath10k_htt_rx_delba(ar, resp);
+                break;
+        case HTT_T2H_MSG_TYPE_RX_FLUSH: {
+                /* Ignore this event because mac80211 takes care of Rx
+                 * aggregation reordering.
+                 */
+                break;
+        }
         default:
                 ath10k_dbg(ATH10K_DBG_HTT, "htt event (%d) not handled\n",
                            resp->hdr.msg_type);
diff --git a/drivers/net/wireless/ath/ath10k/htt_tx.c b/drivers/net/wireless/ath/ath10k/htt_tx.c
index 7064354d1f4f..8b27bfcc1de3 100644
--- a/drivers/net/wireless/ath/ath10k/htt_tx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_tx.c
@@ -307,6 +307,52 @@ int ath10k_htt_send_rx_ring_cfg_ll(struct ath10k_htt *htt)
         return 0;
 }
 
+int ath10k_htt_h2t_aggr_cfg_msg(struct ath10k_htt *htt,
+                                u8 max_subfrms_ampdu,
+                                u8 max_subfrms_amsdu)
+{
+        struct htt_aggr_conf *aggr_conf;
+        struct sk_buff *skb;
+        struct htt_cmd *cmd;
+        int len;
+        int ret;
+
+        /* Firmware defaults are: amsdu = 3 and ampdu = 64 */
+
+        if (max_subfrms_ampdu == 0 || max_subfrms_ampdu > 64)
+                return -EINVAL;
+
+        if (max_subfrms_amsdu == 0 || max_subfrms_amsdu > 31)
+                return -EINVAL;
+
+        len = sizeof(cmd->hdr);
+        len += sizeof(cmd->aggr_conf);
+
+        skb = ath10k_htc_alloc_skb(len);
+        if (!skb)
+                return -ENOMEM;
+
+        skb_put(skb, len);
+        cmd = (struct htt_cmd *)skb->data;
+        cmd->hdr.msg_type = HTT_H2T_MSG_TYPE_AGGR_CFG;
+
+        aggr_conf = &cmd->aggr_conf;
+        aggr_conf->max_num_ampdu_subframes = max_subfrms_ampdu;
+        aggr_conf->max_num_amsdu_subframes = max_subfrms_amsdu;
+
+        ath10k_dbg(ATH10K_DBG_HTT, "htt h2t aggr cfg msg amsdu %d ampdu %d",
+                   aggr_conf->max_num_amsdu_subframes,
+                   aggr_conf->max_num_ampdu_subframes);
+
+        ret = ath10k_htc_send(&htt->ar->htc, htt->eid, skb);
+        if (ret) {
+                dev_kfree_skb_any(skb);
+                return ret;
+        }
+
+        return 0;
+}
+
 int ath10k_htt_mgmt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
 {
         struct device *dev = htt->ar->dev;
@@ -485,6 +531,12 @@ int ath10k_htt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
         flags1 |= HTT_DATA_TX_DESC_FLAGS1_CKSUM_L3_OFFLOAD;
         flags1 |= HTT_DATA_TX_DESC_FLAGS1_CKSUM_L4_OFFLOAD;
 
+        /* Prevent firmware from sending up tx inspection requests. There's
+         * nothing ath10k can do with frames requested for inspection so force
+         * it to simply rely a regular tx completion with discard status.
+         */
+        flags1 |= HTT_DATA_TX_DESC_FLAGS1_POSTPONED;
+
         skb_cb->htt.txbuf->cmd_hdr.msg_type = HTT_H2T_MSG_TYPE_TX_FRM;
         skb_cb->htt.txbuf->cmd_tx.flags0 = flags0;
         skb_cb->htt.txbuf->cmd_tx.flags1 = __cpu_to_le16(flags1);
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index a21080028c54..9d61bb157189 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -1865,15 +1865,13 @@ static u8 ath10k_tx_h_get_vdev_id(struct ath10k *ar,
         return 0;
 }
 
-/*
- * Frames sent to the FW have to be in "Native Wifi" format.
- * Strip the QoS field from the 802.11 header.
+/* HTT Tx uses Native Wifi tx mode which expects 802.11 frames without QoS
+ * Control in the header.
  */
-static void ath10k_tx_h_qos_workaround(struct ieee80211_hw *hw,
-                                       struct ieee80211_tx_control *control,
-                                       struct sk_buff *skb)
+static void ath10k_tx_h_nwifi(struct ieee80211_hw *hw, struct sk_buff *skb)
 {
         struct ieee80211_hdr *hdr = (void *)skb->data;
+        struct ath10k_skb_cb *cb = ATH10K_SKB_CB(skb);
         u8 *qos_ctl;
 
         if (!ieee80211_is_data_qos(hdr->frame_control))
@@ -1883,6 +1881,16 @@ static void ath10k_tx_h_qos_workaround(struct ieee80211_hw *hw,
         memmove(skb->data + IEEE80211_QOS_CTL_LEN,
                 skb->data, (void *)qos_ctl - (void *)skb->data);
         skb_pull(skb, IEEE80211_QOS_CTL_LEN);
+
+        /* Fw/Hw generates a corrupted QoS Control Field for QoS NullFunc
+         * frames. Powersave is handled by the fw/hw so QoS NyllFunc frames are
+         * used only for CQM purposes (e.g. hostapd station keepalive ping) so
+         * it is safe to downgrade to NullFunc.
+         */
+        if (ieee80211_is_qos_nullfunc(hdr->frame_control)) {
+                hdr->frame_control &= ~__cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
+                cb->htt.tid = HTT_DATA_TX_EXT_TID_NON_QOS_MCAST_BCAST;
+        }
 }
 
 static void ath10k_tx_wep_key_work(struct work_struct *work)
@@ -1919,14 +1927,13 @@ unlock:
         mutex_unlock(&arvif->ar->conf_mutex);
 }
 
-static void ath10k_tx_h_update_wep_key(struct sk_buff *skb)
+static void ath10k_tx_h_update_wep_key(struct ieee80211_vif *vif,
+                                       struct ieee80211_key_conf *key,
+                                       struct sk_buff *skb)
 {
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        struct ieee80211_vif *vif = info->control.vif;
         struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
         struct ath10k *ar = arvif->ar;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-        struct ieee80211_key_conf *key = info->control.hw_key;
 
         if (!ieee80211_has_protected(hdr->frame_control))
                 return;
@@ -1948,11 +1955,11 @@ static void ath10k_tx_h_update_wep_key(struct sk_buff *skb)
         ieee80211_queue_work(ar->hw, &arvif->wep_key_work);
 }
 
-static void ath10k_tx_h_add_p2p_noa_ie(struct ath10k *ar, struct sk_buff *skb)
+static void ath10k_tx_h_add_p2p_noa_ie(struct ath10k *ar,
+                                       struct ieee80211_vif *vif,
+                                       struct sk_buff *skb)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        struct ieee80211_vif *vif = info->control.vif;
         struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
 
         /* This is case only for P2P_GO */
@@ -2254,33 +2261,28 @@ static void ath10k_tx(struct ieee80211_hw *hw,
                       struct ieee80211_tx_control *control,
                       struct sk_buff *skb)
 {
+        struct ath10k *ar = hw->priv;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_vif *vif = info->control.vif;
+        struct ieee80211_key_conf *key = info->control.hw_key;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-        struct ath10k *ar = hw->priv;
-        u8 tid, vdev_id;
 
         /* We should disable CCK RATE due to P2P */
         if (info->flags & IEEE80211_TX_CTL_NO_CCK_RATE)
                 ath10k_dbg(ATH10K_DBG_MAC, "IEEE80211_TX_CTL_NO_CCK_RATE\n");
 
-        /* we must calculate tid before we apply qos workaround
-         * as we'd lose the qos control field */
-        tid = ath10k_tx_h_get_tid(hdr);
-        vdev_id = ath10k_tx_h_get_vdev_id(ar, info);
+        ATH10K_SKB_CB(skb)->htt.is_offchan = false;
+        ATH10K_SKB_CB(skb)->htt.tid = ath10k_tx_h_get_tid(hdr);
+        ATH10K_SKB_CB(skb)->vdev_id = ath10k_tx_h_get_vdev_id(ar, info);
 
         /* it makes no sense to process injected frames like that */
-        if (info->control.vif &&
-            info->control.vif->type != NL80211_IFTYPE_MONITOR) {
-                ath10k_tx_h_qos_workaround(hw, control, skb);
-                ath10k_tx_h_update_wep_key(skb);
-                ath10k_tx_h_add_p2p_noa_ie(ar, skb);
-                ath10k_tx_h_seq_no(skb);
+        if (vif && vif->type != NL80211_IFTYPE_MONITOR) {
+                ath10k_tx_h_nwifi(hw, skb);
+                ath10k_tx_h_update_wep_key(vif, key, skb);
+                ath10k_tx_h_add_p2p_noa_ie(ar, vif, skb);
+                ath10k_tx_h_seq_no(vif, skb);
         }
 
-        ATH10K_SKB_CB(skb)->vdev_id = vdev_id;
-        ATH10K_SKB_CB(skb)->htt.is_offchan = false;
-        ATH10K_SKB_CB(skb)->htt.tid = tid;
-
         if (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) {
                 spin_lock_bh(&ar->data_lock);
                 ATH10K_SKB_CB(skb)->htt.is_offchan = true;
@@ -3137,10 +3139,11 @@ exit:
 
 static int ath10k_hw_scan(struct ieee80211_hw *hw,
                           struct ieee80211_vif *vif,
-                          struct cfg80211_scan_request *req)
+                          struct ieee80211_scan_request *hw_req)
 {
         struct ath10k *ar = hw->priv;
         struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
+        struct cfg80211_scan_request *req = &hw_req->req;
         struct wmi_start_scan_arg arg;
         int ret = 0;
         int i;
@@ -4330,6 +4333,38 @@ static u64 ath10k_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
         return 0;
 }
 
+static int ath10k_ampdu_action(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif,
+                               enum ieee80211_ampdu_mlme_action action,
+                               struct ieee80211_sta *sta, u16 tid, u16 *ssn,
+                               u8 buf_size)
+{
+        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
+
+        ath10k_dbg(ATH10K_DBG_MAC, "mac ampdu vdev_id %i sta %pM tid %hu action %d\n",
+                   arvif->vdev_id, sta->addr, tid, action);
+
+        switch (action) {
+        case IEEE80211_AMPDU_RX_START:
+        case IEEE80211_AMPDU_RX_STOP:
+                /* HTT AddBa/DelBa events trigger mac80211 Rx BA session
+                 * creation/removal. Do we need to verify this?
+                 */
+                return 0;
+        case IEEE80211_AMPDU_TX_START:
+        case IEEE80211_AMPDU_TX_STOP_CONT:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
+        case IEEE80211_AMPDU_TX_OPERATIONAL:
+                /* Firmware offloads Tx aggregation entirely so deny mac80211
+                 * Tx aggregation requests.
+                 */
+                return -EOPNOTSUPP;
+        }
+
+        return -EINVAL;
+}
+
 static const struct ieee80211_ops ath10k_ops = {
         .tx                             = ath10k_tx,
         .start                          = ath10k_start,
@@ -4357,6 +4392,7 @@ static const struct ieee80211_ops ath10k_ops = {
         .set_bitrate_mask               = ath10k_set_bitrate_mask,
         .sta_rc_update                  = ath10k_sta_rc_update,
         .get_tsf                        = ath10k_get_tsf,
+        .ampdu_action                   = ath10k_ampdu_action,
 #ifdef CONFIG_PM
         .suspend                        = ath10k_suspend,
         .resume                         = ath10k_resume,
@@ -4697,7 +4733,6 @@ int ath10k_mac_register(struct ath10k *ar)
 
         ar->hw->wiphy->interface_modes =
                 BIT(NL80211_IFTYPE_STATION) |
-                BIT(NL80211_IFTYPE_ADHOC) |
                 BIT(NL80211_IFTYPE_AP);
 
         if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
@@ -4767,6 +4802,8 @@ int ath10k_mac_register(struct ath10k *ar)
                 ar->hw->wiphy->iface_combinations = ath10k_if_comb;
                 ar->hw->wiphy->n_iface_combinations =
                         ARRAY_SIZE(ath10k_if_comb);
+
+                ar->hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC);
         }
 
         ar->hw->netdev_features = NETIF_F_HW_CSUM;
diff --git a/drivers/net/wireless/ath/ath10k/mac.h b/drivers/net/wireless/ath/ath10k/mac.h
index ba1021997b8f..ef4f84376d7c 100644
--- a/drivers/net/wireless/ath/ath10k/mac.h
+++ b/drivers/net/wireless/ath/ath10k/mac.h
@@ -43,11 +43,11 @@ static inline struct ath10k_vif *ath10k_vif_to_arvif(struct ieee80211_vif *vif)
         return (struct ath10k_vif *)vif->drv_priv;
 }
 
-static inline void ath10k_tx_h_seq_no(struct sk_buff *skb)
+static inline void ath10k_tx_h_seq_no(struct ieee80211_vif *vif,
+                                      struct sk_buff *skb)
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-        struct ieee80211_vif *vif = info->control.vif;
         struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
 
         if (info->flags  & IEEE80211_TX_CTL_ASSIGN_SEQ) {
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index d0004d59c97e..3376963a4862 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -63,7 +63,7 @@ MODULE_PARM_DESC(reset_mode, "0: auto, 1: warm only (default: 0)");
 
 #define QCA988X_2_0_DEVICE_ID   (0x003c)
 
-static DEFINE_PCI_DEVICE_TABLE(ath10k_pci_id_table) = {
+static const struct pci_device_id ath10k_pci_id_table[] = {
         { PCI_VDEVICE(ATHEROS, QCA988X_2_0_DEVICE_ID) }, /* PCI-E QCA988X V2 */
         {0}
 };
@@ -726,18 +726,12 @@ static void ath10k_pci_ce_recv_data(struct ath10k_ce_pipe *ce_state)
         unsigned int nbytes, max_nbytes;
         unsigned int transfer_id;
         unsigned int flags;
-        int err;
+        int err, num_replenish = 0;
 
         while (ath10k_ce_completed_recv_next(ce_state, &transfer_context,
                                              &ce_data, &nbytes, &transfer_id,
                                              &flags) == 0) {
-                err = ath10k_pci_post_rx_pipe(pipe_info, 1);
-                if (unlikely(err)) {
-                        /* FIXME: retry */
-                        ath10k_warn("failed to replenish CE rx ring %d: %d\n",
-                                    pipe_info->pipe_num, err);
-                }
-
+                num_replenish++;
                 skb = transfer_context;
                 max_nbytes = skb->len + skb_tailroom(skb);
                 dma_unmap_single(ar->dev, ATH10K_SKB_CB(skb)->paddr,
@@ -753,6 +747,13 @@ static void ath10k_pci_ce_recv_data(struct ath10k_ce_pipe *ce_state)
                 skb_put(skb, nbytes);
                 cb->rx_completion(ar, skb, pipe_info->pipe_num);
         }
+
+        err = ath10k_pci_post_rx_pipe(pipe_info, num_replenish);
+        if (unlikely(err)) {
+                /* FIXME: retry */
+                ath10k_warn("failed to replenish CE rx ring %d (%d bufs): %d\n",
+                            pipe_info->pipe_num, num_replenish, err);
+        }
 }
 
 static int ath10k_pci_hif_tx_sg(struct ath10k *ar, u8 pipe_id,
@@ -1362,8 +1363,6 @@ static int ath10k_pci_hif_exchange_bmi_msg(struct ath10k *ar,
                 ath10k_ce_recv_buf_enqueue(ce_rx, &xfer, resp_paddr);
         }
 
-        init_completion(&xfer.done);
-
         ret = ath10k_ce_send(ce_tx, &xfer, req_paddr, req_len, -1, 0);
         if (ret)
                 goto err_resp;
@@ -1414,10 +1413,7 @@ static void ath10k_pci_bmi_send_done(struct ath10k_ce_pipe *ce_state)
                                           &nbytes, &transfer_id))
                 return;
 
-        if (xfer->wait_for_resp)
-                return;
-
-        complete(&xfer->done);
+        xfer->tx_done = true;
 }
 
 static void ath10k_pci_bmi_recv_data(struct ath10k_ce_pipe *ce_state)
@@ -1438,7 +1434,7 @@ static void ath10k_pci_bmi_recv_data(struct ath10k_ce_pipe *ce_state)
         }
 
         xfer->resp_len = nbytes;
-        complete(&xfer->done);
+        xfer->rx_done = true;
 }
 
 static int ath10k_pci_bmi_wait(struct ath10k_ce_pipe *tx_pipe,
@@ -1451,7 +1447,7 @@ static int ath10k_pci_bmi_wait(struct ath10k_ce_pipe *tx_pipe,
                 ath10k_pci_bmi_send_done(tx_pipe);
                 ath10k_pci_bmi_recv_data(rx_pipe);
 
-                if (completion_done(&xfer->done))
+                if (xfer->tx_done && (xfer->rx_done == xfer->wait_for_resp))
                         return 0;
 
                 schedule();
diff --git a/drivers/net/wireless/ath/ath10k/pci.h b/drivers/net/wireless/ath/ath10k/pci.h
index dfdebb4157aa..940129209990 100644
--- a/drivers/net/wireless/ath/ath10k/pci.h
+++ b/drivers/net/wireless/ath/ath10k/pci.h
@@ -38,7 +38,8 @@
 #define DIAG_TRANSFER_LIMIT 2048
 
 struct bmi_xfer {
-        struct completion done;
+        bool tx_done;
+        bool rx_done;
         bool wait_for_resp;
         u32 resp_len;
 };
diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c
index 82669a77e553..f4fa22d1d591 100644
--- a/drivers/net/wireless/ath/ath10k/txrx.c
+++ b/drivers/net/wireless/ath/ath10k/txrx.c
@@ -119,8 +119,7 @@ struct ath10k_peer *ath10k_peer_find(struct ath10k *ar, int vdev_id,
         return NULL;
 }
 
-static struct ath10k_peer *ath10k_peer_find_by_id(struct ath10k *ar,
-                                                  int peer_id)
+struct ath10k_peer *ath10k_peer_find_by_id(struct ath10k *ar, int peer_id)
 {
         struct ath10k_peer *peer;
 
diff --git a/drivers/net/wireless/ath/ath10k/txrx.h b/drivers/net/wireless/ath/ath10k/txrx.h
index aee3e20058f8..a90e09f5c7f2 100644
--- a/drivers/net/wireless/ath/ath10k/txrx.h
+++ b/drivers/net/wireless/ath/ath10k/txrx.h
@@ -24,6 +24,7 @@ void ath10k_txrx_tx_unref(struct ath10k_htt *htt,
 
 struct ath10k_peer *ath10k_peer_find(struct ath10k *ar, int vdev_id,
                                      const u8 *addr);
+struct ath10k_peer *ath10k_peer_find_by_id(struct ath10k *ar, int peer_id);
 int ath10k_wait_for_peer_created(struct ath10k *ar, int vdev_id,
                                  const u8 *addr);
 int ath10k_wait_for_peer_deleted(struct ath10k *ar, int vdev_id,
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index 4b7782a529ac..c2c87c916b5a 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -1432,7 +1432,7 @@ static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
                         continue;
                 }
 
-                ath10k_tx_h_seq_no(bcn);
+                ath10k_tx_h_seq_no(arvif->vif, bcn);
                 ath10k_wmi_update_tim(ar, arvif, bcn, bcn_info);
                 ath10k_wmi_update_noa(ar, arvif, bcn, bcn_info);
 
@@ -2106,7 +2106,6 @@ static void ath10k_wmi_main_process_rx(struct ath10k *ar, struct sk_buff *skb)
 {
         struct wmi_cmd_hdr *cmd_hdr;
         enum wmi_event_id id;
-        u16 len;
 
         cmd_hdr = (struct wmi_cmd_hdr *)skb->data;
         id = MS(__le32_to_cpu(cmd_hdr->cmd_id), WMI_CMD_HDR_CMD_ID);
@@ -2114,8 +2113,6 @@ static void ath10k_wmi_main_process_rx(struct ath10k *ar, struct sk_buff *skb)
         if (skb_pull(skb, sizeof(struct wmi_cmd_hdr)) == NULL)
                 return;
 
-        len = skb->len;
-
         trace_ath10k_wmi_event(id, skb->data, skb->len);
 
         switch (id) {
@@ -2225,7 +2222,6 @@ static void ath10k_wmi_10x_process_rx(struct ath10k *ar, struct sk_buff *skb)
 {
         struct wmi_cmd_hdr *cmd_hdr;
         enum wmi_10x_event_id id;
-        u16 len;
 
         cmd_hdr = (struct wmi_cmd_hdr *)skb->data;
         id = MS(__le32_to_cpu(cmd_hdr->cmd_id), WMI_CMD_HDR_CMD_ID);
@@ -2233,8 +2229,6 @@ static void ath10k_wmi_10x_process_rx(struct ath10k *ar, struct sk_buff *skb)
         if (skb_pull(skb, sizeof(struct wmi_cmd_hdr)) == NULL)
                 return;
 
-        len = skb->len;
-
         trace_ath10k_wmi_event(id, skb->data, skb->len);
 
         switch (id) {
diff --git a/drivers/net/wireless/ath/ath5k/ath5k.h b/drivers/net/wireless/ath/ath5k/ath5k.h
index 74bd54d6aceb..85316bb3f8c6 100644
--- a/drivers/net/wireless/ath/ath5k/ath5k.h
+++ b/drivers/net/wireless/ath/ath5k/ath5k.h
@@ -1285,6 +1285,7 @@ struct ath5k_hw {
 #define ATH_STAT_STARTED        3               /* opened & irqs enabled */
 
         unsigned int            filter_flags;   /* HW flags, AR5K_RX_FILTER_* */
+        unsigned int            fif_filter_flags; /* Current FIF_* filter flags */
         struct ieee80211_channel *curchan;      /* current h/w channel */
 
         u16                     nvifs;
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 4b18434ba697..8ad2550bce7f 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -1382,6 +1382,9 @@ ath5k_receive_frame(struct ath5k_hw *ah, struct sk_buff *skb,
         rxs->flag = 0;
         if (unlikely(rs->rs_status & AR5K_RXERR_MIC))
                 rxs->flag |= RX_FLAG_MMIC_ERROR;
+        if (unlikely(rs->rs_status & AR5K_RXERR_CRC))
+                rxs->flag |= RX_FLAG_FAILED_FCS_CRC;
+
 
         /*
          * always extend the mac timestamp, since this information is
@@ -1449,6 +1452,8 @@ ath5k_receive_frame_ok(struct ath5k_hw *ah, struct ath5k_rx_status *rs)
         ah->stats.rx_bytes_count += rs->rs_datalen;
 
         if (unlikely(rs->rs_status)) {
+                unsigned int filters;
+
                 if (rs->rs_status & AR5K_RXERR_CRC)
                         ah->stats.rxerr_crc++;
                 if (rs->rs_status & AR5K_RXERR_FIFO)
@@ -1457,7 +1462,20 @@ ath5k_receive_frame_ok(struct ath5k_hw *ah, struct ath5k_rx_status *rs)
                         ah->stats.rxerr_phy++;
                         if (rs->rs_phyerr > 0 && rs->rs_phyerr < 32)
                                 ah->stats.rxerr_phy_code[rs->rs_phyerr]++;
-                        return false;
+
+                        /*
+                         * Treat packets that underwent a CCK or OFDM reset as having a bad CRC.
+                         * These restarts happen when the radio resynchronizes to a stronger frame
+                         * while receiving a weaker frame. Here we receive the prefix of the weak
+                         * frame. Since these are incomplete packets, mark their CRC as invalid.
+                         */
+                        if (rs->rs_phyerr == AR5K_RX_PHY_ERROR_OFDM_RESTART ||
+                            rs->rs_phyerr == AR5K_RX_PHY_ERROR_CCK_RESTART) {
+                                rs->rs_status |= AR5K_RXERR_CRC;
+                                rs->rs_status &= ~AR5K_RXERR_PHY;
+                        } else {
+                                return false;
+                        }
                 }
                 if (rs->rs_status & AR5K_RXERR_DECRYPT) {
                         /*
@@ -1480,8 +1498,15 @@ ath5k_receive_frame_ok(struct ath5k_hw *ah, struct ath5k_rx_status *rs)
                         return true;
                 }
 
-                /* reject any frames with non-crypto errors */
-                if (rs->rs_status & ~(AR5K_RXERR_DECRYPT))
+                /*
+                 * Reject any frames with non-crypto errors, and take into account the
+                 * current FIF_* filters.
+                 */
+                filters = AR5K_RXERR_DECRYPT;
+                if (ah->fif_filter_flags & FIF_FCSFAIL)
+                        filters |= AR5K_RXERR_CRC;
+
+                if (rs->rs_status & ~filters)
                         return false;
         }
 
diff --git a/drivers/net/wireless/ath/ath5k/led.c b/drivers/net/wireless/ath/ath5k/led.c
index f77ef36acf87..48a6a69b57bc 100644
--- a/drivers/net/wireless/ath/ath5k/led.c
+++ b/drivers/net/wireless/ath/ath5k/led.c
@@ -53,7 +53,7 @@
 #define ATH_POLARITY(data) ((data) & 0xff)
 
 /* Devices we match on for LED config info (typically laptops) */
-static DEFINE_PCI_DEVICE_TABLE(ath5k_led_devices) = {
+static const struct pci_device_id ath5k_led_devices[] = {
         /* AR5211 */
         { PCI_VDEVICE(ATHEROS, PCI_DEVICE_ID_ATHEROS_AR5211), ATH_LED(0, 0) },
         /* HP Compaq nc6xx, nc4000, nx6000 */
diff --git a/drivers/net/wireless/ath/ath5k/mac80211-ops.c b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
index afb23b3cc7be..b65c38fdaa4b 100644
--- a/drivers/net/wireless/ath/ath5k/mac80211-ops.c
+++ b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
@@ -473,6 +473,8 @@ ath5k_configure_filter(struct ieee80211_hw *hw, unsigned int changed_flags,
         /* Set the cached hw filter flags, this will later actually
          * be set in HW */
         ah->filter_flags = rfilt;
+        /* Store current FIF filter flags */
+        ah->fif_filter_flags = *new_flags;
 
         mutex_unlock(&ah->lock);
 }
diff --git a/drivers/net/wireless/ath/ath5k/pci.c b/drivers/net/wireless/ath/ath5k/pci.c
index 859db7c34f87..c6156cc38940 100644
--- a/drivers/net/wireless/ath/ath5k/pci.c
+++ b/drivers/net/wireless/ath/ath5k/pci.c
@@ -28,7 +28,7 @@
 #include "reg.h"
 
 /* Known PCI ids */
-static DEFINE_PCI_DEVICE_TABLE(ath5k_pci_id_table) = {
+static const struct pci_device_id ath5k_pci_id_table[] = {
         { PCI_VDEVICE(ATHEROS, 0x0207) }, /* 5210 early */
         { PCI_VDEVICE(ATHEROS, 0x0007) }, /* 5210 */
         { PCI_VDEVICE(ATHEROS, 0x0011) }, /* 5311 - this is on AHB bus !*/
diff --git a/drivers/net/wireless/ath/ath6kl/bmi.h b/drivers/net/wireless/ath/ath6kl/bmi.h
index 18fdd69e1f71..397a52f2628b 100644
--- a/drivers/net/wireless/ath/ath6kl/bmi.h
+++ b/drivers/net/wireless/ath/ath6kl/bmi.h
@@ -242,7 +242,8 @@ struct ath6kl_bmi_target_info {
                 (void) (check_type == val);                             \
                 addr = ath6kl_get_hi_item_addr(ar, HI_ITEM(item));      \
                 ret = ath6kl_bmi_read(ar, addr, (u8 *) &tmp, 4);        \
-                *val = le32_to_cpu(tmp);                                \
+                if (!ret)                                               \
+                        *val = le32_to_cpu(tmp);                        \
                 ret;                                                    \
         })
 
diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
index 0e26f4a34fda..e535807c3d89 100644
--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
@@ -2899,7 +2899,8 @@ static int ath6kl_start_ap(struct wiphy *wiphy, struct net_device *dev,
         if (info->inactivity_timeout) {
                 inactivity_timeout = info->inactivity_timeout;
 
-                if (ar->hw.flags & ATH6KL_HW_AP_INACTIVITY_MINS)
+                if (test_bit(ATH6KL_FW_CAPABILITY_AP_INACTIVITY_MINS,
+                             ar->fw_capabilities))
                         inactivity_timeout = DIV_ROUND_UP(inactivity_timeout,
                                                           60);
 
@@ -3636,7 +3637,7 @@ struct wireless_dev *ath6kl_interface_add(struct ath6kl *ar, const char *name,
         struct net_device *ndev;
         struct ath6kl_vif *vif;
 
-        ndev = alloc_netdev(sizeof(*vif), name, ether_setup);
+        ndev = alloc_netdev(sizeof(*vif), name, NET_NAME_UNKNOWN, ether_setup);
         if (!ndev)
                 return NULL;
 
@@ -3782,7 +3783,8 @@ int ath6kl_cfg80211_init(struct ath6kl *ar)
                 ath6kl_band_5ghz.ht_cap.ht_supported = false;
         }
 
-        if (ar->hw.flags & ATH6KL_HW_64BIT_RATES) {
+        if (test_bit(ATH6KL_FW_CAPABILITY_64BIT_RATES,
+                     ar->fw_capabilities)) {
                 ath6kl_band_2ghz.ht_cap.mcs.rx_mask[0] = 0xff;
                 ath6kl_band_5ghz.ht_cap.mcs.rx_mask[0] = 0xff;
                 ath6kl_band_2ghz.ht_cap.mcs.rx_mask[1] = 0xff;
diff --git a/drivers/net/wireless/ath/ath6kl/core.c b/drivers/net/wireless/ath/ath6kl/core.c
index b0b652042760..0df74b245af4 100644
--- a/drivers/net/wireless/ath/ath6kl/core.c
+++ b/drivers/net/wireless/ath/ath6kl/core.c
@@ -123,6 +123,22 @@ int ath6kl_core_init(struct ath6kl *ar, enum ath6kl_htc_type htc_type)
 
         /* FIXME: we should free all firmwares in the error cases below */
 
+        /*
+         * Backwards compatibility support for older ar6004 firmware images
+         * which do not set these feature flags.
+         */
+        if (ar->target_type == TARGET_TYPE_AR6004 &&
+            ar->fw_api <= 4) {
+                __set_bit(ATH6KL_FW_CAPABILITY_64BIT_RATES,
+                          ar->fw_capabilities);
+                __set_bit(ATH6KL_FW_CAPABILITY_AP_INACTIVITY_MINS,
+                          ar->fw_capabilities);
+
+                if (ar->hw.id == AR6004_HW_1_3_VERSION)
+                        __set_bit(ATH6KL_FW_CAPABILITY_MAP_LP_ENDPOINT,
+                                  ar->fw_capabilities);
+        }
+
         /* Indicate that WMI is enabled (although not ready yet) */
         set_bit(WMI_ENABLED, &ar->flag);
         ar->wmi = ath6kl_wmi_init(ar);
diff --git a/drivers/net/wireless/ath/ath6kl/core.h b/drivers/net/wireless/ath/ath6kl/core.h
index 26b0f92424e1..2b78c863d030 100644
--- a/drivers/net/wireless/ath/ath6kl/core.h
+++ b/drivers/net/wireless/ath/ath6kl/core.h
@@ -136,6 +136,21 @@ enum ath6kl_fw_capability {
          */
         ATH6KL_FW_CAPABILITY_HEART_BEAT_POLL,
 
+        /* WMI_SET_TX_SELECT_RATES_CMDID uses 64 bit size rate table */
+        ATH6KL_FW_CAPABILITY_64BIT_RATES,
+
+        /* WMI_AP_CONN_INACT_CMDID uses minutes as units */
+        ATH6KL_FW_CAPABILITY_AP_INACTIVITY_MINS,
+
+        /* use low priority endpoint for all data */
+        ATH6KL_FW_CAPABILITY_MAP_LP_ENDPOINT,
+
+        /* ratetable is the 2 stream version (max MCS15) */
+        ATH6KL_FW_CAPABILITY_RATETABLE_MCS15,
+
+        /* firmare doesn't support IP checksumming */
+        ATH6KL_FW_CAPABILITY_NO_IP_CHECKSUM,
+
         /* this needs to be last */
         ATH6KL_FW_CAPABILITY_MAX,
 };
@@ -149,15 +164,13 @@ struct ath6kl_fw_ie {
 };
 
 enum ath6kl_hw_flags {
-        ATH6KL_HW_64BIT_RATES           = BIT(0),
-        ATH6KL_HW_AP_INACTIVITY_MINS    = BIT(1),
-        ATH6KL_HW_MAP_LP_ENDPOINT       = BIT(2),
         ATH6KL_HW_SDIO_CRC_ERROR_WAR    = BIT(3),
 };
 
 #define ATH6KL_FW_API2_FILE "fw-2.bin"
 #define ATH6KL_FW_API3_FILE "fw-3.bin"
 #define ATH6KL_FW_API4_FILE "fw-4.bin"
+#define ATH6KL_FW_API5_FILE "fw-5.bin"
 
 /* AR6003 1.0 definitions */
 #define AR6003_HW_1_0_VERSION                 0x300002ba
@@ -215,8 +228,21 @@ enum ath6kl_hw_flags {
 #define AR6004_HW_1_3_VERSION                   0x31c8088a
 #define AR6004_HW_1_3_FW_DIR                    "ath6k/AR6004/hw1.3"
 #define AR6004_HW_1_3_FIRMWARE_FILE             "fw.ram.bin"
-#define AR6004_HW_1_3_BOARD_DATA_FILE           "ath6k/AR6004/hw1.3/bdata.bin"
-#define AR6004_HW_1_3_DEFAULT_BOARD_DATA_FILE   "ath6k/AR6004/hw1.3/bdata.bin"
+#define AR6004_HW_1_3_TCMD_FIRMWARE_FILE        "utf.bin"
+#define AR6004_HW_1_3_UTF_FIRMWARE_FILE         "utf.bin"
+#define AR6004_HW_1_3_TESTSCRIPT_FILE           "nullTestFlow.bin"
+#define AR6004_HW_1_3_BOARD_DATA_FILE         AR6004_HW_1_3_FW_DIR "/bdata.bin"
+#define AR6004_HW_1_3_DEFAULT_BOARD_DATA_FILE AR6004_HW_1_3_FW_DIR "/bdata.bin"
+
+/* AR6004 3.0 definitions */
+#define AR6004_HW_3_0_VERSION                   0x31C809F8
+#define AR6004_HW_3_0_FW_DIR                    "ath6k/AR6004/hw3.0"
+#define AR6004_HW_3_0_FIRMWARE_FILE             "fw.ram.bin"
+#define AR6004_HW_3_0_TCMD_FIRMWARE_FILE        "utf.bin"
+#define AR6004_HW_3_0_UTF_FIRMWARE_FILE         "utf.bin"
+#define AR6004_HW_3_0_TESTSCRIPT_FILE           "nullTestFlow.bin"
+#define AR6004_HW_3_0_BOARD_DATA_FILE         AR6004_HW_3_0_FW_DIR "/bdata.bin"
+#define AR6004_HW_3_0_DEFAULT_BOARD_DATA_FILE AR6004_HW_3_0_FW_DIR "/bdata.bin"
 
 /* Per STA data, used in AP mode */
 #define STA_PS_AWAKE            BIT(0)
diff --git a/drivers/net/wireless/ath/ath6kl/htc_pipe.c b/drivers/net/wireless/ath/ath6kl/htc_pipe.c
index 756fe52a12c8..ca1a18c86c0d 100644
--- a/drivers/net/wireless/ath/ath6kl/htc_pipe.c
+++ b/drivers/net/wireless/ath/ath6kl/htc_pipe.c
@@ -1170,8 +1170,12 @@ static int htc_wait_recv_ctrl_message(struct htc_target *target)
 static void htc_rxctrl_complete(struct htc_target *context,
                                 struct htc_packet *packet)
 {
-        /* TODO, can't really receive HTC control messages yet.... */
-        ath6kl_dbg(ATH6KL_DBG_HTC, "%s: invalid call function\n", __func__);
+        struct sk_buff *skb = packet->skb;
+
+        if (packet->endpoint == ENDPOINT_0 &&
+            packet->status == -ECANCELED &&
+            skb != NULL)
+                dev_kfree_skb(skb);
 }
 
 /* htc pipe initialization */
@@ -1678,7 +1682,29 @@ static void ath6kl_htc_pipe_activity_changed(struct htc_target *target,
 
 static void ath6kl_htc_pipe_flush_rx_buf(struct htc_target *target)
 {
-        /* TODO */
+        struct htc_endpoint *endpoint;
+        struct htc_packet *packet, *tmp_pkt;
+        int i;
+
+        for (i = ENDPOINT_0; i < ENDPOINT_MAX; i++) {
+                endpoint = &target->endpoint[i];
+
+                spin_lock_bh(&target->rx_lock);
+
+                list_for_each_entry_safe(packet, tmp_pkt,
+                                         &endpoint->rx_bufq, list) {
+                        list_del(&packet->list);
+                        spin_unlock_bh(&target->rx_lock);
+                        ath6kl_dbg(ATH6KL_DBG_HTC,
+                                   "htc rx flush pkt 0x%p len %d ep %d\n",
+                                   packet, packet->buf_len,
+                                   packet->endpoint);
+                        dev_kfree_skb(packet->pkt_cntxt);
+                        spin_lock_bh(&target->rx_lock);
+                }
+
+                spin_unlock_bh(&target->rx_lock);
+        }
 }
 
 static int ath6kl_htc_pipe_credit_setup(struct htc_target *target,
diff --git a/drivers/net/wireless/ath/ath6kl/init.c b/drivers/net/wireless/ath/ath6kl/init.c
index d5ef211f261c..fffd52355123 100644
--- a/drivers/net/wireless/ath/ath6kl/init.c
+++ b/drivers/net/wireless/ath/ath6kl/init.c
@@ -93,8 +93,7 @@ static const struct ath6kl_hw hw_list[] = {
                 .board_addr                     = 0x433900,
                 .refclk_hz                      = 26000000,
                 .uarttx_pin                     = 11,
-                .flags                          = ATH6KL_HW_64BIT_RATES |
-                                                  ATH6KL_HW_AP_INACTIVITY_MINS,
+                .flags                          = 0,
 
                 .fw = {
                         .dir            = AR6004_HW_1_0_FW_DIR,
@@ -114,8 +113,7 @@ static const struct ath6kl_hw hw_list[] = {
                 .board_addr                     = 0x43d400,
                 .refclk_hz                      = 40000000,
                 .uarttx_pin                     = 11,
-                .flags                          = ATH6KL_HW_64BIT_RATES |
-                                                  ATH6KL_HW_AP_INACTIVITY_MINS,
+                .flags                          = 0,
                 .fw = {
                         .dir            = AR6004_HW_1_1_FW_DIR,
                         .fw             = AR6004_HW_1_1_FIRMWARE_FILE,
@@ -134,8 +132,7 @@ static const struct ath6kl_hw hw_list[] = {
                 .board_addr                     = 0x435c00,
                 .refclk_hz                      = 40000000,
                 .uarttx_pin                     = 11,
-                .flags                          = ATH6KL_HW_64BIT_RATES |
-                                                  ATH6KL_HW_AP_INACTIVITY_MINS,
+                .flags                          = 0,
 
                 .fw = {
                         .dir            = AR6004_HW_1_2_FW_DIR,
@@ -152,20 +149,43 @@ static const struct ath6kl_hw hw_list[] = {
                 .board_ext_data_addr            = 0x437000,
                 .reserved_ram_size              = 7168,
                 .board_addr                     = 0x436400,
-                .refclk_hz                      = 40000000,
+                .refclk_hz                      = 0,
                 .uarttx_pin                     = 11,
-                .flags                          = ATH6KL_HW_64BIT_RATES |
-                                                  ATH6KL_HW_AP_INACTIVITY_MINS |
-                                                  ATH6KL_HW_MAP_LP_ENDPOINT,
+                .flags                          = 0,
 
                 .fw = {
                         .dir            = AR6004_HW_1_3_FW_DIR,
                         .fw             = AR6004_HW_1_3_FIRMWARE_FILE,
+                        .tcmd           = AR6004_HW_1_3_TCMD_FIRMWARE_FILE,
+                        .utf            = AR6004_HW_1_3_UTF_FIRMWARE_FILE,
+                        .testscript     = AR6004_HW_1_3_TESTSCRIPT_FILE,
                 },
 
                 .fw_board               = AR6004_HW_1_3_BOARD_DATA_FILE,
                 .fw_default_board       = AR6004_HW_1_3_DEFAULT_BOARD_DATA_FILE,
         },
+        {
+                .id                             = AR6004_HW_3_0_VERSION,
+                .name                           = "ar6004 hw 3.0",
+                .dataset_patch_addr             = 0,
+                .app_load_addr                  = 0x1234,
+                .board_ext_data_addr            = 0,
+                .reserved_ram_size              = 7168,
+                .board_addr                     = 0x436400,
+                .testscript_addr                = 0,
+                .flags                          = 0,
+
+                .fw = {
+                        .dir            = AR6004_HW_3_0_FW_DIR,
+                        .fw             = AR6004_HW_3_0_FIRMWARE_FILE,
+                        .tcmd           = AR6004_HW_3_0_TCMD_FIRMWARE_FILE,
+                        .utf            = AR6004_HW_3_0_UTF_FIRMWARE_FILE,
+                        .testscript     = AR6004_HW_3_0_TESTSCRIPT_FILE,
+                },
+
+                .fw_board               = AR6004_HW_3_0_BOARD_DATA_FILE,
+                .fw_default_board       = AR6004_HW_3_0_DEFAULT_BOARD_DATA_FILE,
+        },
 };
 
 /*
@@ -601,7 +621,9 @@ int ath6kl_configure_target(struct ath6kl *ar)
          * but possible in theory.
          */
 
-        if (ar->target_type == TARGET_TYPE_AR6003) {
+        if ((ar->target_type == TARGET_TYPE_AR6003) ||
+            (ar->version.target_ver == AR6004_HW_1_3_VERSION) ||
+            (ar->version.target_ver == AR6004_HW_3_0_VERSION)) {
                 param = ar->hw.board_ext_data_addr;
                 ram_reserved_size = ar->hw.reserved_ram_size;
 
@@ -629,9 +651,12 @@ int ath6kl_configure_target(struct ath6kl *ar)
                 return status;
 
         /* Configure target refclk_hz */
-        status = ath6kl_bmi_write_hi32(ar, hi_refclk_hz, ar->hw.refclk_hz);
-        if (status)
-                return status;
+        if (ar->hw.refclk_hz != 0) {
+                status = ath6kl_bmi_write_hi32(ar, hi_refclk_hz,
+                                               ar->hw.refclk_hz);
+                if (status)
+                        return status;
+        }
 
         return 0;
 }
@@ -1112,6 +1137,12 @@ int ath6kl_init_fetch_firmwares(struct ath6kl *ar)
         if (ret)
                 return ret;
 
+        ret = ath6kl_fetch_fw_apin(ar, ATH6KL_FW_API5_FILE);
+        if (ret == 0) {
+                ar->fw_api = 5;
+                goto out;
+        }
+
         ret = ath6kl_fetch_fw_apin(ar, ATH6KL_FW_API4_FILE);
         if (ret == 0) {
                 ar->fw_api = 4;
@@ -1161,11 +1192,19 @@ static int ath6kl_upload_board_file(struct ath6kl *ar)
                 ath6kl_bmi_write_hi32(ar, hi_board_data,
                                       board_address);
         } else {
-                ath6kl_bmi_read_hi32(ar, hi_board_data, &board_address);
+                ret = ath6kl_bmi_read_hi32(ar, hi_board_data, &board_address);
+                if (ret) {
+                        ath6kl_err("Failed to get board file target address.\n");
+                        return ret;
+                }
         }
 
         /* determine where in target ram to write extended board data */
-        ath6kl_bmi_read_hi32(ar, hi_board_ext_data, &board_ext_address);
+        ret = ath6kl_bmi_read_hi32(ar, hi_board_ext_data, &board_ext_address);
+        if (ret) {
+                ath6kl_err("Failed to get extended board file target address.\n");
+                return ret;
+        }
 
         if (ar->target_type == TARGET_TYPE_AR6003 &&
             board_ext_address == 0) {
@@ -1187,7 +1226,6 @@ static int ath6kl_upload_board_file(struct ath6kl *ar)
         default:
                 WARN_ON(1);
                 return -EINVAL;
-                break;
         }
 
         if (board_ext_address &&
@@ -1230,7 +1268,13 @@ static int ath6kl_upload_board_file(struct ath6kl *ar)
         }
 
         /* record the fact that Board Data IS initialized */
-        ath6kl_bmi_write_hi32(ar, hi_board_data_initialized, 1);
+        if ((ar->version.target_ver == AR6004_HW_1_3_VERSION) ||
+            (ar->version.target_ver == AR6004_HW_3_0_VERSION))
+                param = board_data_size;
+        else
+                param = 1;
+
+        ath6kl_bmi_write_hi32(ar, hi_board_data_initialized, param);
 
         return ret;
 }
@@ -1361,7 +1405,11 @@ static int ath6kl_upload_testscript(struct ath6kl *ar)
         }
 
         ath6kl_bmi_write_hi32(ar, hi_ota_testscript, address);
-        ath6kl_bmi_write_hi32(ar, hi_end_ram_reserve_sz, 4096);
+
+        if ((ar->version.target_ver != AR6004_HW_1_3_VERSION) &&
+            (ar->version.target_ver != AR6004_HW_3_0_VERSION))
+                ath6kl_bmi_write_hi32(ar, hi_end_ram_reserve_sz, 4096);
+
         ath6kl_bmi_write_hi32(ar, hi_test_apps_related, 1);
 
         return 0;
@@ -1567,6 +1615,11 @@ static const struct fw_capa_str_map {
         { ATH6KL_FW_CAPABILITY_REGDOMAIN, "regdomain" },
         { ATH6KL_FW_CAPABILITY_SCHED_SCAN_V2, "sched-scan-v2" },
         { ATH6KL_FW_CAPABILITY_HEART_BEAT_POLL, "hb-poll" },
+        { ATH6KL_FW_CAPABILITY_64BIT_RATES, "64bit-rates" },
+        { ATH6KL_FW_CAPABILITY_AP_INACTIVITY_MINS, "ap-inactivity-mins" },
+        { ATH6KL_FW_CAPABILITY_MAP_LP_ENDPOINT, "map-lp-endpoint" },
+        { ATH6KL_FW_CAPABILITY_RATETABLE_MCS15, "ratetable-mcs15" },
+        { ATH6KL_FW_CAPABILITY_NO_IP_CHECKSUM, "no-ip-checksum" },
 };
 
 static const char *ath6kl_init_get_fw_capa_name(unsigned int id)
diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c
index d56554674da4..21516bc65785 100644
--- a/drivers/net/wireless/ath/ath6kl/main.c
+++ b/drivers/net/wireless/ath/ath6kl/main.c
@@ -702,6 +702,7 @@ static void ath6kl_update_target_stats(struct ath6kl_vif *vif, u8 *ptr, u32 len)
         struct ath6kl *ar = vif->ar;
         struct target_stats *stats = &vif->target_stats;
         struct tkip_ccmp_stats *ccmp_stats;
+        s32 rate;
         u8 ac;
 
         if (len < sizeof(*tgt_stats))
@@ -731,8 +732,9 @@ static void ath6kl_update_target_stats(struct ath6kl_vif *vif, u8 *ptr, u32 len)
                 le32_to_cpu(tgt_stats->stats.tx.mult_retry_cnt);
         stats->tx_rts_fail_cnt +=
                 le32_to_cpu(tgt_stats->stats.tx.rts_fail_cnt);
-        stats->tx_ucast_rate =
-            ath6kl_wmi_get_rate(a_sle32_to_cpu(tgt_stats->stats.tx.ucast_rate));
+
+        rate = a_sle32_to_cpu(tgt_stats->stats.tx.ucast_rate);
+        stats->tx_ucast_rate = ath6kl_wmi_get_rate(ar->wmi, rate);
 
         stats->rx_pkt += le32_to_cpu(tgt_stats->stats.rx.pkt);
         stats->rx_byte += le32_to_cpu(tgt_stats->stats.rx.byte);
@@ -749,8 +751,9 @@ static void ath6kl_update_target_stats(struct ath6kl_vif *vif, u8 *ptr, u32 len)
                 le32_to_cpu(tgt_stats->stats.rx.key_cache_miss);
         stats->rx_decrypt_err += le32_to_cpu(tgt_stats->stats.rx.decrypt_err);
         stats->rx_dupl_frame += le32_to_cpu(tgt_stats->stats.rx.dupl_frame);
-        stats->rx_ucast_rate =
-            ath6kl_wmi_get_rate(a_sle32_to_cpu(tgt_stats->stats.rx.ucast_rate));
+
+        rate = a_sle32_to_cpu(tgt_stats->stats.rx.ucast_rate);
+        stats->rx_ucast_rate = ath6kl_wmi_get_rate(ar->wmi, rate);
 
         ccmp_stats = &tgt_stats->stats.tkip_ccmp_stats;
 
@@ -1290,6 +1293,8 @@ static const struct net_device_ops ath6kl_netdev_ops = {
 
 void init_netdev(struct net_device *dev)
 {
+        struct ath6kl *ar = ath6kl_priv(dev);
+
         dev->netdev_ops = &ath6kl_netdev_ops;
         dev->destructor = free_netdev;
         dev->watchdog_timeo = ATH6KL_TX_TIMEOUT;
@@ -1301,7 +1306,9 @@ void init_netdev(struct net_device *dev)
                                         WMI_MAX_TX_META_SZ +
                                         ATH6KL_HTC_ALIGN_BYTES, 4);
 
-        dev->hw_features |= NETIF_F_IP_CSUM | NETIF_F_RXCSUM;
+        if (!test_bit(ATH6KL_FW_CAPABILITY_NO_IP_CHECKSUM,
+                      ar->fw_capabilities))
+                dev->hw_features |= NETIF_F_IP_CSUM | NETIF_F_RXCSUM;
 
         return;
 }
diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c
index 3afc5a463d06..c44325856b81 100644
--- a/drivers/net/wireless/ath/ath6kl/usb.c
+++ b/drivers/net/wireless/ath/ath6kl/usb.c
@@ -802,7 +802,8 @@ static int ath6kl_usb_map_service_pipe(struct ath6kl *ar, u16 svc_id,
                 break;
         case WMI_DATA_VI_SVC:
 
-                if (ar->hw.flags & ATH6KL_HW_MAP_LP_ENDPOINT)
+                if (test_bit(ATH6KL_FW_CAPABILITY_MAP_LP_ENDPOINT,
+                             ar->fw_capabilities))
                         *ul_pipe = ATH6KL_USB_PIPE_TX_DATA_LP;
                 else
                         *ul_pipe = ATH6KL_USB_PIPE_TX_DATA_MP;
@@ -814,7 +815,8 @@ static int ath6kl_usb_map_service_pipe(struct ath6kl *ar, u16 svc_id,
                 break;
         case WMI_DATA_VO_SVC:
 
-                if (ar->hw.flags & ATH6KL_HW_MAP_LP_ENDPOINT)
+                if (test_bit(ATH6KL_FW_CAPABILITY_MAP_LP_ENDPOINT,
+                             ar->fw_capabilities))
                         *ul_pipe = ATH6KL_USB_PIPE_TX_DATA_LP;
                 else
                         *ul_pipe = ATH6KL_USB_PIPE_TX_DATA_MP;
@@ -1208,6 +1210,7 @@ static int ath6kl_usb_pm_reset_resume(struct usb_interface *intf)
 
 /* table of devices that work with this driver */
 static struct usb_device_id ath6kl_usb_ids[] = {
+        {USB_DEVICE(0x0cf3, 0x9375)},
         {USB_DEVICE(0x0cf3, 0x9374)},
         { /* Terminating entry */ },
 };
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
index 4d7f9e4712e9..94df345d08c2 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.c
+++ b/drivers/net/wireless/ath/ath6kl/wmi.c
@@ -59,6 +59,55 @@ static const s32 wmi_rate_tbl[][2] = {
         {0, 0}
 };
 
+static const s32 wmi_rate_tbl_mcs15[][2] = {
+        /* {W/O SGI, with SGI} */
+        {1000, 1000},
+        {2000, 2000},
+        {5500, 5500},
+        {11000, 11000},
+        {6000, 6000},
+        {9000, 9000},
+        {12000, 12000},
+        {18000, 18000},
+        {24000, 24000},
+        {36000, 36000},
+        {48000, 48000},
+        {54000, 54000},
+        {6500, 7200},     /* HT 20, MCS 0 */
+        {13000, 14400},
+        {19500, 21700},
+        {26000, 28900},
+        {39000, 43300},
+        {52000, 57800},
+        {58500, 65000},
+        {65000, 72200},
+        {13000, 14400},   /* HT 20, MCS 8 */
+        {26000, 28900},
+        {39000, 43300},
+        {52000, 57800},
+        {78000, 86700},
+        {104000, 115600},
+        {117000, 130000},
+        {130000, 144400}, /* HT 20, MCS 15 */
+        {13500, 15000},   /*HT 40, MCS 0 */
+        {27000, 30000},
+        {40500, 45000},
+        {54000, 60000},
+        {81000, 90000},
+        {108000, 120000},
+        {121500, 135000},
+        {135000, 150000},
+        {27000, 30000},   /*HT 40, MCS 8 */
+        {54000, 60000},
+        {81000, 90000},
+        {108000, 120000},
+        {162000, 180000},
+        {216000, 240000},
+        {243000, 270000},
+        {270000, 300000}, /*HT 40, MCS 15 */
+        {0, 0}
+};
+
 /* 802.1d to AC mapping. Refer pg 57 of WMM-test-plan-v1.2 */
 static const u8 up_to_ac[] = {
         WMM_AC_BE,
@@ -2838,7 +2887,8 @@ int ath6kl_wmi_set_bitrate_mask(struct wmi *wmi, u8 if_idx,
 {
         struct ath6kl *ar = wmi->parent_dev;
 
-        if (ar->hw.flags & ATH6KL_HW_64BIT_RATES)
+        if (test_bit(ATH6KL_FW_CAPABILITY_64BIT_RATES,
+                     ar->fw_capabilities))
                 return ath6kl_set_bitrate_mask64(wmi, if_idx, mask);
         else
                 return ath6kl_set_bitrate_mask32(wmi, if_idx, mask);
@@ -3279,9 +3329,11 @@ int ath6kl_wmi_set_regdomain_cmd(struct wmi *wmi, const char *alpha2)
                                    NO_SYNC_WMIFLAG);
 }
 
-s32 ath6kl_wmi_get_rate(s8 rate_index)
+s32 ath6kl_wmi_get_rate(struct wmi *wmi, s8 rate_index)
 {
+        struct ath6kl *ar = wmi->parent_dev;
         u8 sgi = 0;
+        s32 ret;
 
         if (rate_index == RATE_AUTO)
                 return 0;
@@ -3292,10 +3344,20 @@ s32 ath6kl_wmi_get_rate(s8 rate_index)
                 sgi = 1;
         }
 
-        if (WARN_ON(rate_index > RATE_MCS_7_40))
-                rate_index = RATE_MCS_7_40;
+        if (test_bit(ATH6KL_FW_CAPABILITY_RATETABLE_MCS15,
+                     ar->fw_capabilities)) {
+                if (WARN_ON(rate_index >= ARRAY_SIZE(wmi_rate_tbl_mcs15)))
+                        return 0;
+
+                ret = wmi_rate_tbl_mcs15[(u32) rate_index][sgi];
+        } else {
+                if (WARN_ON(rate_index >= ARRAY_SIZE(wmi_rate_tbl)))
+                        return 0;
 
-        return wmi_rate_tbl[(u32) rate_index][sgi];
+                ret = wmi_rate_tbl[(u32) rate_index][sgi];
+        }
+
+        return ret;
 }
 
 static int ath6kl_wmi_get_pmkid_list_event_rx(struct wmi *wmi, u8 *datap,
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.h b/drivers/net/wireless/ath/ath6kl/wmi.h
index bb23fc00111d..19f88b4a24fb 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.h
+++ b/drivers/net/wireless/ath/ath6kl/wmi.h
@@ -2632,7 +2632,7 @@ int ath6kl_wmi_set_htcap_cmd(struct wmi *wmi, u8 if_idx,
                              struct ath6kl_htcap *htcap);
 int ath6kl_wmi_test_cmd(struct wmi *wmi, void *buf, size_t len);
 
-s32 ath6kl_wmi_get_rate(s8 rate_index);
+s32 ath6kl_wmi_get_rate(struct wmi *wmi, s8 rate_index);
 
 int ath6kl_wmi_set_ip_cmd(struct wmi *wmi, u8 if_idx,
                           __be32 ips0, __be32 ips1);
diff --git a/drivers/net/wireless/ath/ath9k/Makefile b/drivers/net/wireless/ath/ath9k/Makefile
index 8fcd586d1c39..6b4020a57984 100644
--- a/drivers/net/wireless/ath/ath9k/Makefile
+++ b/drivers/net/wireless/ath/ath9k/Makefile
@@ -5,7 +5,8 @@ ath9k-y +=	beacon.o \
                 recv.o \
                 xmit.o \
                 link.o \
-                antenna.o
+                antenna.o \
+                channel.o
 
 ath9k-$(CONFIG_ATH9K_BTCOEX_SUPPORT) += mci.o
 ath9k-$(CONFIG_ATH9K_PCI) += pci.o
diff --git a/drivers/net/wireless/ath/ath9k/ahb.c b/drivers/net/wireless/ath/ath9k/ahb.c
index be3eb2a8d602..4173838f4684 100644
--- a/drivers/net/wireless/ath/ath9k/ahb.c
+++ b/drivers/net/wireless/ath/ath9k/ahb.c
@@ -113,6 +113,7 @@ static int ath_ahb_probe(struct platform_device *pdev)
 
         irq = res->start;
 
+        ath9k_fill_chanctx_ops();
         hw = ieee80211_alloc_hw(sizeof(struct ath_softc), &ath9k_ops);
         if (hw == NULL) {
                 dev_err(&pdev->dev, "no memory for ieee80211_hw\n");
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_mac.c b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
index 741b38ddcb37..59af9f9712da 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_mac.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
@@ -281,7 +281,7 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
 
         ACCESS_ONCE(ads->ds_ctl0) = (i->pkt_len & AR_FrameLen)
                 | (i->flags & ATH9K_TXDESC_VMF ? AR_VirtMoreFrag : 0)
-                | SM(i->txpower, AR_XmitPower)
+                | SM(i->txpower, AR_XmitPower0)
                 | (i->flags & ATH9K_TXDESC_VEOL ? AR_VEOL : 0)
                 | (i->flags & ATH9K_TXDESC_INTREQ ? AR_TxIntrReq : 0)
                 | (i->keyix != ATH9K_TXKEYIX_INVALID ? AR_DestIdxValid : 0)
@@ -306,6 +306,10 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
                 | set11nRateFlags(i->rates, 2)
                 | set11nRateFlags(i->rates, 3)
                 | SM(i->rtscts_rate, AR_RTSCTSRate);
+
+        ACCESS_ONCE(ads->ds_ctl9) = SM(i->txpower, AR_XmitPower1);
+        ACCESS_ONCE(ads->ds_ctl10) = SM(i->txpower, AR_XmitPower2);
+        ACCESS_ONCE(ads->ds_ctl11) = SM(i->txpower, AR_XmitPower3);
 }
 
 static int ar9002_hw_proc_txdesc(struct ath_hw *ah, void *ds,
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 235053ba7737..80c6eacbda53 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -3535,7 +3535,8 @@ static void ar9003_hw_xpa_bias_level_apply(struct ath_hw *ah, bool is2ghz)
 {
         int bias = ar9003_modal_header(ah, is2ghz)->xpaBiasLvl;
 
-        if (AR_SREV_9485(ah) || AR_SREV_9330(ah) || AR_SREV_9340(ah))
+        if (AR_SREV_9485(ah) || AR_SREV_9330(ah) || AR_SREV_9340(ah) ||
+            AR_SREV_9531(ah))
                 REG_RMW_FIELD(ah, AR_CH0_TOP2, AR_CH0_TOP2_XPABIASLVL, bias);
         else if (AR_SREV_9462(ah) || AR_SREV_9550(ah) || AR_SREV_9565(ah))
                 REG_RMW_FIELD(ah, AR_CH0_TOP, AR_CH0_TOP_XPABIASLVL, bias);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_hw.c b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
index ec1da0cc25f5..ddef9eedbac6 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
@@ -314,10 +314,17 @@ static void ar9003_hw_init_mode_regs(struct ath_hw *ah)
                                qca953x_1p0_mac_core);
                 INIT_INI_ARRAY(&ah->iniMac[ATH_INI_POST],
                                qca953x_1p0_mac_postamble);
-                INIT_INI_ARRAY(&ah->iniBB[ATH_INI_CORE],
-                               qca953x_1p0_baseband_core);
-                INIT_INI_ARRAY(&ah->iniBB[ATH_INI_POST],
-                               qca953x_1p0_baseband_postamble);
+                if (AR_SREV_9531_20(ah)) {
+                        INIT_INI_ARRAY(&ah->iniBB[ATH_INI_CORE],
+                                       qca953x_2p0_baseband_core);
+                        INIT_INI_ARRAY(&ah->iniBB[ATH_INI_POST],
+                                       qca953x_2p0_baseband_postamble);
+                } else {
+                        INIT_INI_ARRAY(&ah->iniBB[ATH_INI_CORE],
+                                       qca953x_1p0_baseband_core);
+                        INIT_INI_ARRAY(&ah->iniBB[ATH_INI_POST],
+                                       qca953x_1p0_baseband_postamble);
+                }
                 INIT_INI_ARRAY(&ah->iniRadio[ATH_INI_CORE],
                                qca953x_1p0_radio_core);
                 INIT_INI_ARRAY(&ah->iniRadio[ATH_INI_POST],
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mac.c b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
index 729ffbf07343..71e38e85aa99 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
@@ -101,7 +101,7 @@ ar9003_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
 
         ACCESS_ONCE(ads->ctl11) = (i->pkt_len & AR_FrameLen)
                 | (i->flags & ATH9K_TXDESC_VMF ? AR_VirtMoreFrag : 0)
-                | SM(i->txpower, AR_XmitPower)
+                | SM(i->txpower, AR_XmitPower0)
                 | (i->flags & ATH9K_TXDESC_VEOL ? AR_VEOL : 0)
                 | (i->keyix != ATH9K_TXKEYIX_INVALID ? AR_DestIdxValid : 0)
                 | (i->flags & ATH9K_TXDESC_LOWRXCHAIN ? AR_LowRxChain : 0)
@@ -151,6 +151,10 @@ ar9003_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
                 | SM(i->rtscts_rate, AR_RTSCTSRate);
 
         ACCESS_ONCE(ads->ctl19) = AR_Not_Sounding;
+
+        ACCESS_ONCE(ads->ctl20) = SM(i->txpower, AR_XmitPower1);
+        ACCESS_ONCE(ads->ctl21) = SM(i->txpower, AR_XmitPower2);
+        ACCESS_ONCE(ads->ctl22) = SM(i->txpower, AR_XmitPower3);
 }
 
 static u16 ar9003_calc_ptr_chksum(struct ar9003_txc *ads)
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index 8927fc34d84c..542a8d51d3b0 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -1552,13 +1552,15 @@ static int ar9003_hw_fast_chan_change(struct ath_hw *ah,
                                       u8 *ini_reloaded)
 {
         unsigned int regWrites = 0;
-        u32 modesIndex;
+        u32 modesIndex, txgain_index;
 
         if (IS_CHAN_5GHZ(chan))
                 modesIndex = IS_CHAN_HT40(chan) ? 2 : 1;
         else
                 modesIndex = IS_CHAN_HT40(chan) ? 3 : 4;
 
+        txgain_index = AR_SREV_9531(ah) ? 1 : modesIndex;
+
         if (modesIndex == ah->modes_index) {
                 *ini_reloaded = false;
                 goto set_rfmode;
@@ -1573,7 +1575,7 @@ static int ar9003_hw_fast_chan_change(struct ath_hw *ah,
                 ar9003_hw_prog_ini(ah, &ah->ini_radio_post_sys2ant,
                                    modesIndex);
 
-        REG_WRITE_ARRAY(&ah->iniModesTxGain, modesIndex, regWrites);
+        REG_WRITE_ARRAY(&ah->iniModesTxGain, txgain_index, regWrites);
 
         if (AR_SREV_9462_20_OR_LATER(ah)) {
                 /*
diff --git a/drivers/net/wireless/ath/ath9k/ar953x_initvals.h b/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
index 8e5c3b9786e3..812a9d787bf3 100644
--- a/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
@@ -219,7 +219,7 @@ static const u32 qca953x_1p0_baseband_core[][2] = {
         {0x00009d04, 0x40206c10},
         {0x00009d08, 0x009c4060},
         {0x00009d0c, 0x9883800a},
-        {0x00009d10, 0x01884061},
+        {0x00009d10, 0x018848c6},
         {0x00009d14, 0x00c0040b},
         {0x00009d18, 0x00000000},
         {0x00009e08, 0x0038230c},
@@ -715,4 +715,203 @@ static const u32 qca953x_1p1_modes_no_xpa_tx_gain_table[][2] = {
         {0x00016448, 0x6c927a70},
 };
 
+static const u32 qca953x_2p0_baseband_core[][2] = {
+        /* Addr      allmodes */
+        {0x00009800, 0xafe68e30},
+        {0x00009804, 0xfd14e000},
+        {0x00009808, 0x9c0a9f6b},
+        {0x0000980c, 0x04900000},
+        {0x00009814, 0x0280c00a},
+        {0x00009818, 0x00000000},
+        {0x0000981c, 0x00020028},
+        {0x00009834, 0x6400a190},
+        {0x00009838, 0x0108ecff},
+        {0x0000983c, 0x14000600},
+        {0x00009880, 0x201fff00},
+        {0x00009884, 0x00001042},
+        {0x000098a4, 0x00200400},
+        {0x000098b0, 0x32840bbe},
+        {0x000098bc, 0x00000002},
+        {0x000098d0, 0x004b6a8e},
+        {0x000098d4, 0x00000820},
+        {0x000098dc, 0x00000000},
+        {0x000098f0, 0x00000000},
+        {0x000098f4, 0x00000000},
+        {0x00009c04, 0xff55ff55},
+        {0x00009c08, 0x0320ff55},
+        {0x00009c0c, 0x00000000},
+        {0x00009c10, 0x00000000},
+        {0x00009c14, 0x00046384},
+        {0x00009c18, 0x05b6b440},
+        {0x00009c1c, 0x00b6b440},
+        {0x00009d00, 0xc080a333},
+        {0x00009d04, 0x40206c10},
+        {0x00009d08, 0x009c4060},
+        {0x00009d0c, 0x9883800a},
+        {0x00009d10, 0x018848c6},
+        {0x00009d14, 0x00c0040b},
+        {0x00009d18, 0x00000000},
+        {0x00009e08, 0x0038230c},
+        {0x00009e24, 0x990bb515},
+        {0x00009e28, 0x0c6f0000},
+        {0x00009e30, 0x06336f77},
+        {0x00009e34, 0x6af6532f},
+        {0x00009e38, 0x0cc80c00},
+        {0x00009e40, 0x0d261820},
+        {0x00009e4c, 0x00001004},
+        {0x00009e50, 0x00ff03f1},
+        {0x00009fc0, 0x813e4788},
+        {0x00009fc4, 0x0001efb5},
+        {0x00009fcc, 0x40000014},
+        {0x00009fd0, 0x02993b93},
+        {0x0000a20c, 0x00000000},
+        {0x0000a220, 0x00000000},
+        {0x0000a224, 0x00000000},
+        {0x0000a228, 0x10002310},
+        {0x0000a23c, 0x00000000},
+        {0x0000a244, 0x0c000000},
+        {0x0000a248, 0x00000140},
+        {0x0000a2a0, 0x00000007},
+        {0x0000a2c0, 0x00000007},
+        {0x0000a2c8, 0x00000000},
+        {0x0000a2d4, 0x00000000},
+        {0x0000a2ec, 0x00000000},
+        {0x0000a2f0, 0x00000000},
+        {0x0000a2f4, 0x00000000},
+        {0x0000a2f8, 0x00000000},
+        {0x0000a344, 0x00000000},
+        {0x0000a34c, 0x00000000},
+        {0x0000a350, 0x0000a000},
+        {0x0000a364, 0x00000000},
+        {0x0000a370, 0x00000000},
+        {0x0000a390, 0x00000001},
+        {0x0000a394, 0x00000444},
+        {0x0000a398, 0x001f0e0f},
+        {0x0000a39c, 0x0075393f},
+        {0x0000a3a0, 0xb79f6427},
+        {0x0000a3a4, 0x000400ff},
+        {0x0000a3a8, 0x6a6a6a6a},
+        {0x0000a3ac, 0x6a6a6a6a},
+        {0x0000a3b0, 0x00c8641a},
+        {0x0000a3b4, 0x0000001a},
+        {0x0000a3b8, 0x0088642a},
+        {0x0000a3bc, 0x000001fa},
+        {0x0000a3c0, 0x20202020},
+        {0x0000a3c4, 0x22222220},
+        {0x0000a3c8, 0x20200020},
+        {0x0000a3cc, 0x20202020},
+        {0x0000a3d0, 0x20202020},
+        {0x0000a3d4, 0x20202020},
+        {0x0000a3d8, 0x20202020},
+        {0x0000a3dc, 0x20202020},
+        {0x0000a3e0, 0x20202020},
+        {0x0000a3e4, 0x20202020},
+        {0x0000a3e8, 0x20202020},
+        {0x0000a3ec, 0x20202020},
+        {0x0000a3f0, 0x00000000},
+        {0x0000a3f4, 0x00000000},
+        {0x0000a3f8, 0x0c9bd380},
+        {0x0000a3fc, 0x000f0f01},
+        {0x0000a400, 0x8fa91f01},
+        {0x0000a404, 0x00000000},
+        {0x0000a408, 0x0e79e5c6},
+        {0x0000a40c, 0x00820820},
+        {0x0000a414, 0x1ce42108},
+        {0x0000a418, 0x2d001dce},
+        {0x0000a41c, 0x1ce73908},
+        {0x0000a420, 0x000001ce},
+        {0x0000a424, 0x1ce738e7},
+        {0x0000a428, 0x000001ce},
+        {0x0000a42c, 0x1ce739ce},
+        {0x0000a430, 0x1ce739ce},
+        {0x0000a434, 0x00000000},
+        {0x0000a438, 0x00001801},
+        {0x0000a43c, 0x00100000},
+        {0x0000a444, 0x00000000},
+        {0x0000a448, 0x05000080},
+        {0x0000a44c, 0x00000001},
+        {0x0000a450, 0x00010000},
+        {0x0000a458, 0x00000000},
+        {0x0000a644, 0xbfad9d74},
+        {0x0000a648, 0x0048060a},
+        {0x0000a64c, 0x00003c37},
+        {0x0000a670, 0x03020100},
+        {0x0000a674, 0x09080504},
+        {0x0000a678, 0x0d0c0b0a},
+        {0x0000a67c, 0x13121110},
+        {0x0000a680, 0x31301514},
+        {0x0000a684, 0x35343332},
+        {0x0000a688, 0x00000036},
+        {0x0000a690, 0x08000838},
+        {0x0000a7cc, 0x00000000},
+        {0x0000a7d0, 0x00000000},
+        {0x0000a7d4, 0x00000004},
+        {0x0000a7dc, 0x00000000},
+        {0x0000a8d0, 0x004b6a8e},
+        {0x0000a8d4, 0x00000820},
+        {0x0000a8dc, 0x00000000},
+        {0x0000a8f0, 0x00000000},
+        {0x0000a8f4, 0x00000000},
+        {0x0000b2d0, 0x00000080},
+        {0x0000b2d4, 0x00000000},
+        {0x0000b2ec, 0x00000000},
+        {0x0000b2f0, 0x00000000},
+        {0x0000b2f4, 0x00000000},
+        {0x0000b2f8, 0x00000000},
+        {0x0000b408, 0x0e79e5c0},
+        {0x0000b40c, 0x00820820},
+        {0x0000b420, 0x00000000},
+};
+
+static const u32 qca953x_2p0_baseband_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00009810, 0xd00a8005, 0xd00a8005, 0xd00a8011, 0xd00a8011},
+        {0x00009820, 0x206a022e, 0x206a022e, 0x206a012e, 0x206a012e},
+        {0x00009824, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0},
+        {0x00009828, 0x06903081, 0x06903081, 0x06903881, 0x06903881},
+        {0x0000982c, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4},
+        {0x00009830, 0x0000059c, 0x0000059c, 0x0000119c, 0x0000119c},
+        {0x00009c00, 0x000000c4, 0x000000c4, 0x000000c4, 0x000000c4},
+        {0x00009e00, 0x0372111a, 0x0372111a, 0x037216a0, 0x037216a0},
+        {0x00009e04, 0x001c2020, 0x001c2020, 0x001c2020, 0x001c2020},
+        {0x00009e0c, 0x6c4000e2, 0x6d4000e2, 0x6d4000e2, 0x6c4000e2},
+        {0x00009e10, 0x7ec88d2e, 0x7ec88d2e, 0x7ec84d2e, 0x7ec84d2e},
+        {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3379605e, 0x33795d5e},
+        {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
+        {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
+        {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
+        {0x00009e3c, 0xcfa10820, 0xcfa10820, 0xcf946222, 0xcf946222},
+        {0x00009e44, 0xfe321e27, 0xfe321e27, 0xfe291e27, 0xfe291e27},
+        {0x00009e48, 0x5030201a, 0x5030201a, 0x50302012, 0x50302012},
+        {0x00009fc8, 0x0003f000, 0x0003f000, 0x0001a000, 0x0001a000},
+        {0x0000a204, 0x005c0ec0, 0x005c0ec4, 0x005c0ec4, 0x005c0ec0},
+        {0x0000a208, 0x00000104, 0x00000104, 0x00000004, 0x00000004},
+        {0x0000a22c, 0x07e26a2f, 0x07e26a2f, 0x01026a2f, 0x01026a2f},
+        {0x0000a230, 0x0000000a, 0x00000014, 0x00000016, 0x0000000b},
+        {0x0000a234, 0x00000fff, 0x10000fff, 0x10000fff, 0x00000fff},
+        {0x0000a238, 0xffb01018, 0xffb01018, 0xffb01018, 0xffb01018},
+        {0x0000a250, 0x00000000, 0x00000000, 0x00000210, 0x00000108},
+        {0x0000a254, 0x000007d0, 0x00000fa0, 0x00001130, 0x00000898},
+        {0x0000a258, 0x02020002, 0x02020002, 0x02020002, 0x02020002},
+        {0x0000a25c, 0x01000e0e, 0x01000e0e, 0x01010e0e, 0x01010e0e},
+        {0x0000a260, 0x0a021501, 0x0a021501, 0x3a021501, 0x3a021501},
+        {0x0000a264, 0x00000e0e, 0x00000e0e, 0x01000e0e, 0x01000e0e},
+        {0x0000a280, 0x00000007, 0x00000007, 0x0000000b, 0x0000000b},
+        {0x0000a284, 0x00000000, 0x00000000, 0x00000010, 0x00000010},
+        {0x0000a288, 0x00000110, 0x00000110, 0x00000110, 0x00000110},
+        {0x0000a28c, 0x00022222, 0x00022222, 0x00022222, 0x00022222},
+        {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00158d18, 0x00158d18},
+        {0x0000a2cc, 0x18c50033, 0x18c43433, 0x18c41033, 0x18c44c33},
+        {0x0000a2d0, 0x00041982, 0x00041982, 0x00041982, 0x00041982},
+        {0x0000a2d8, 0x7999a83b, 0x7999a83b, 0x7999a83b, 0x7999a83b},
+        {0x0000a358, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a830, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000ae04, 0x001c0000, 0x001c0000, 0x001c0000, 0x001c0000},
+        {0x0000ae18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000ae1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000ae20, 0x000001b5, 0x000001b5, 0x000001ce, 0x000001ce},
+        {0x0000b284, 0x00000000, 0x00000000, 0x00000010, 0x00000010},
+};
+
 #endif /* INITVALS_953X_H */
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 2ca8f7e06174..7fc13a8da675 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -22,6 +22,7 @@
 #include <linux/interrupt.h>
 #include <linux/leds.h>
 #include <linux/completion.h>
+#include <linux/time.h>
 
 #include "common.h"
 #include "debug.h"
@@ -35,10 +36,7 @@ extern struct ieee80211_ops ath9k_ops;
 extern int ath9k_modparam_nohwcrypt;
 extern int led_blink;
 extern bool is_ath9k_unloaded;
-
-struct ath_config {
-        u16 txpowlimit;
-};
+extern int ath9k_use_chanctx;
 
 /*************************/
 /* Descriptor Management */
@@ -167,7 +165,6 @@ struct ath_txq {
         u32 axq_ampdu_depth;
         bool stopped;
         bool axq_tx_inprogress;
-        struct list_head axq_acq;
         struct list_head txq_fifo[ATH_TXFIFO_DEPTH];
         u8 txq_headidx;
         u8 txq_tailidx;
@@ -185,7 +182,8 @@ struct ath_atx_ac {
 
 struct ath_frame_info {
         struct ath_buf *bf;
-        int framelen;
+        u16 framelen;
+        s8 txq;
         enum ath9k_key_type keytype;
         u8 keyix;
         u8 rtscts_rate;
@@ -280,8 +278,9 @@ struct ath_node {
 struct ath_tx_control {
         struct ath_txq *txq;
         struct ath_node *an;
-        u8 paprd;
         struct ieee80211_sta *sta;
+        u8 paprd;
+        bool force_channel;
 };
 
 
@@ -325,6 +324,116 @@ struct ath_rx {
         u32 ampdu_ref;
 };
 
+struct ath_chanctx {
+        struct cfg80211_chan_def chandef;
+        struct list_head vifs;
+        struct list_head acq[IEEE80211_NUM_ACS];
+        int hw_queue_base;
+
+        /* do not dereference, use for comparison only */
+        struct ieee80211_vif *primary_sta;
+
+        struct ath_beacon_config beacon;
+        struct ath9k_hw_cal_data caldata;
+        struct timespec tsf_ts;
+        u64 tsf_val;
+        u32 last_beacon;
+
+        u16 txpower;
+        bool offchannel;
+        bool stopped;
+        bool active;
+        bool assigned;
+        bool switch_after_beacon;
+};
+
+enum ath_chanctx_event {
+        ATH_CHANCTX_EVENT_BEACON_PREPARE,
+        ATH_CHANCTX_EVENT_BEACON_SENT,
+        ATH_CHANCTX_EVENT_TSF_TIMER,
+        ATH_CHANCTX_EVENT_BEACON_RECEIVED,
+        ATH_CHANCTX_EVENT_ASSOC,
+        ATH_CHANCTX_EVENT_SWITCH,
+        ATH_CHANCTX_EVENT_UNASSIGN,
+        ATH_CHANCTX_EVENT_ENABLE_MULTICHANNEL,
+};
+
+enum ath_chanctx_state {
+        ATH_CHANCTX_STATE_IDLE,
+        ATH_CHANCTX_STATE_WAIT_FOR_BEACON,
+        ATH_CHANCTX_STATE_WAIT_FOR_TIMER,
+        ATH_CHANCTX_STATE_SWITCH,
+        ATH_CHANCTX_STATE_FORCE_ACTIVE,
+};
+
+struct ath_chanctx_sched {
+        bool beacon_pending;
+        bool offchannel_pending;
+        enum ath_chanctx_state state;
+        u8 beacon_miss;
+
+        u32 next_tbtt;
+        u32 switch_start_time;
+        unsigned int offchannel_duration;
+        unsigned int channel_switch_time;
+
+        /* backup, in case the hardware timer fails */
+        struct timer_list timer;
+};
+
+enum ath_offchannel_state {
+        ATH_OFFCHANNEL_IDLE,
+        ATH_OFFCHANNEL_PROBE_SEND,
+        ATH_OFFCHANNEL_PROBE_WAIT,
+        ATH_OFFCHANNEL_SUSPEND,
+        ATH_OFFCHANNEL_ROC_START,
+        ATH_OFFCHANNEL_ROC_WAIT,
+        ATH_OFFCHANNEL_ROC_DONE,
+};
+
+struct ath_offchannel {
+        struct ath_chanctx chan;
+        struct timer_list timer;
+        struct cfg80211_scan_request *scan_req;
+        struct ieee80211_vif *scan_vif;
+        int scan_idx;
+        enum ath_offchannel_state state;
+        struct ieee80211_channel *roc_chan;
+        struct ieee80211_vif *roc_vif;
+        int roc_duration;
+        int duration;
+};
+#define ath_for_each_chanctx(_sc, _ctx)                             \
+        for (ctx = &sc->chanctx[0];                                 \
+             ctx <= &sc->chanctx[ARRAY_SIZE(sc->chanctx) - 1];      \
+             ctx++)
+
+void ath9k_fill_chanctx_ops(void);
+void ath9k_chanctx_force_active(struct ieee80211_hw *hw,
+                                struct ieee80211_vif *vif);
+static inline struct ath_chanctx *
+ath_chanctx_get(struct ieee80211_chanctx_conf *ctx)
+{
+        struct ath_chanctx **ptr = (void *) ctx->drv_priv;
+        return *ptr;
+}
+void ath_chanctx_init(struct ath_softc *sc);
+void ath_chanctx_set_channel(struct ath_softc *sc, struct ath_chanctx *ctx,
+                             struct cfg80211_chan_def *chandef);
+void ath_chanctx_switch(struct ath_softc *sc, struct ath_chanctx *ctx,
+                        struct cfg80211_chan_def *chandef);
+void ath_chanctx_check_active(struct ath_softc *sc, struct ath_chanctx *ctx);
+void ath_offchannel_timer(unsigned long data);
+void ath_offchannel_channel_change(struct ath_softc *sc);
+void ath_chanctx_offchan_switch(struct ath_softc *sc,
+                                struct ieee80211_channel *chan);
+struct ath_chanctx *ath_chanctx_get_oper_chan(struct ath_softc *sc,
+                                              bool active);
+void ath_chanctx_event(struct ath_softc *sc, struct ieee80211_vif *vif,
+                       enum ath_chanctx_event ev);
+void ath_chanctx_timer(unsigned long data);
+
+int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan);
 int ath_startrecv(struct ath_softc *sc);
 bool ath_stoprecv(struct ath_softc *sc);
 u32 ath_calcrxfilter(struct ath_softc *sc);
@@ -341,6 +450,7 @@ void ath_draintxq(struct ath_softc *sc, struct ath_txq *txq);
 void ath_tx_node_init(struct ath_softc *sc, struct ath_node *an);
 void ath_tx_node_cleanup(struct ath_softc *sc, struct ath_node *an);
 void ath_txq_schedule(struct ath_softc *sc, struct ath_txq *txq);
+void ath_txq_schedule_all(struct ath_softc *sc);
 int ath_tx_init(struct ath_softc *sc, int nbufs);
 int ath_txq_update(struct ath_softc *sc, int qnum,
                    struct ath9k_tx_queue_info *q);
@@ -370,32 +480,47 @@ void ath9k_release_buffered_frames(struct ieee80211_hw *hw,
 /********/
 
 struct ath_vif {
+        struct list_head list;
+
         struct ieee80211_vif *vif;
         struct ath_node mcast_node;
         int av_bslot;
-        bool primary_sta_vif;
         __le64 tsf_adjust; /* TSF adjustment for staggered beacons */
         struct ath_buf *av_bcbuf;
+        struct ath_chanctx *chanctx;
 
         /* P2P Client */
         struct ieee80211_noa_data noa;
+
+        /* P2P GO */
+        u8 noa_index;
+        u32 offchannel_start;
+        u32 offchannel_duration;
+
+        u32 periodic_noa_start;
+        u32 periodic_noa_duration;
 };
 
 struct ath9k_vif_iter_data {
         u8 hw_macaddr[ETH_ALEN]; /* address of the first vif */
         u8 mask[ETH_ALEN]; /* bssid mask */
         bool has_hw_macaddr;
+        u8 slottime;
+        bool beacons;
 
         int naps;      /* number of AP vifs */
         int nmeshes;   /* number of mesh vifs */
         int nstations; /* number of station vifs */
         int nwds;      /* number of WDS vifs */
         int nadhocs;   /* number of adhoc vifs */
+        struct ieee80211_vif *primary_sta;
 };
 
-void ath9k_calculate_iter_data(struct ieee80211_hw *hw,
-                               struct ieee80211_vif *vif,
+void ath9k_calculate_iter_data(struct ath_softc *sc,
+                               struct ath_chanctx *ctx,
                                struct ath9k_vif_iter_data *iter_data);
+void ath9k_calculate_summary_state(struct ath_softc *sc,
+                                   struct ath_chanctx *ctx);
 
 /*******************/
 /* Beacon Handling */
@@ -458,6 +583,7 @@ void ath9k_csa_update(struct ath_softc *sc);
 #define ATH_PAPRD_TIMEOUT         100 /* msecs */
 #define ATH_PLL_WORK_INTERVAL     100
 
+void ath_chanctx_work(struct work_struct *work);
 void ath_tx_complete_poll_work(struct work_struct *work);
 void ath_reset_work(struct work_struct *work);
 bool ath_hw_check(struct ath_softc *sc);
@@ -473,6 +599,7 @@ void ath9k_queue_reset(struct ath_softc *sc, enum ath_reset_type type);
 void ath_ps_full_sleep(unsigned long data);
 void ath9k_p2p_ps_timer(void *priv);
 void ath9k_update_p2p_ps(struct ath_softc *sc, struct ieee80211_vif *vif);
+void __ath9k_flush(struct ieee80211_hw *hw, u32 queues, bool drop);
 
 /**********/
 /* BTCOEX */
@@ -702,6 +829,8 @@ void ath_ant_comb_scan(struct ath_softc *sc, struct ath_rx_status *rs);
 #define PS_BEACON_SYNC            BIT(4)
 #define PS_WAIT_FOR_ANI           BIT(5)
 
+#define ATH9K_NUM_CHANCTX  2 /* supports 2 operating channels */
+
 struct ath_softc {
         struct ieee80211_hw *hw;
         struct device *dev;
@@ -720,6 +849,7 @@ struct ath_softc {
         struct mutex mutex;
         struct work_struct paprd_work;
         struct work_struct hw_reset_work;
+        struct work_struct chanctx_work;
         struct completion paprd_complete;
         wait_queue_head_t tx_wait;
 
@@ -738,23 +868,27 @@ struct ath_softc {
         short nvifs;
         unsigned long ps_usecount;
 
-        struct ath_config config;
         struct ath_rx rx;
         struct ath_tx tx;
         struct ath_beacon beacon;
 
+        struct cfg80211_chan_def cur_chandef;
+        struct ath_chanctx chanctx[ATH9K_NUM_CHANCTX];
+        struct ath_chanctx *cur_chan;
+        struct ath_chanctx *next_chan;
+        spinlock_t chan_lock;
+        struct ath_offchannel offchannel;
+        struct ath_chanctx_sched sched;
+
 #ifdef CONFIG_MAC80211_LEDS
         bool led_registered;
         char led_name[32];
         struct led_classdev led_cdev;
 #endif
 
-        struct ath9k_hw_cal_data caldata;
-
 #ifdef CONFIG_ATH9K_DEBUGFS
         struct ath9k_debug debug;
 #endif
-        struct ath_beacon_config cur_beacon_conf;
         struct delayed_work tx_complete_work;
         struct delayed_work hw_pll_work;
         struct timer_list sleep_timer;
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index e387f0b2954a..eaf8f058c151 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -80,7 +80,7 @@ static void ath9k_beacon_setup(struct ath_softc *sc, struct ieee80211_vif *vif,
         u8 chainmask = ah->txchainmask;
         u8 rate = 0;
 
-        sband = &common->sbands[common->hw->conf.chandef.chan->band];
+        sband = &common->sbands[sc->cur_chandef.chan->band];
         rate = sband->bitrates[rateidx].hw_value;
         if (vif->bss_conf.use_short_preamble)
                 rate |= sband->bitrates[rateidx].hw_value_short;
@@ -108,6 +108,55 @@ static void ath9k_beacon_setup(struct ath_softc *sc, struct ieee80211_vif *vif,
         ath9k_hw_set_txdesc(ah, bf->bf_desc, &info);
 }
 
+static void ath9k_beacon_add_noa(struct ath_softc *sc, struct ath_vif *avp,
+                                 struct sk_buff *skb)
+{
+        static const u8 noa_ie_hdr[] = {
+                WLAN_EID_VENDOR_SPECIFIC,       /* type */
+                0,                              /* length */
+                0x50, 0x6f, 0x9a,               /* WFA OUI */
+                0x09,                           /* P2P subtype */
+                0x0c,                           /* Notice of Absence */
+                0x00,                           /* LSB of little-endian len */
+                0x00,                           /* MSB of little-endian len */
+        };
+
+        struct ieee80211_p2p_noa_attr *noa;
+        int noa_len, noa_desc, i = 0;
+        u8 *hdr;
+
+        if (!avp->offchannel_duration && !avp->periodic_noa_duration)
+                return;
+
+        noa_desc = !!avp->offchannel_duration + !!avp->periodic_noa_duration;
+        noa_len = 2 + sizeof(struct ieee80211_p2p_noa_desc) * noa_desc;
+
+        hdr = skb_put(skb, sizeof(noa_ie_hdr));
+        memcpy(hdr, noa_ie_hdr, sizeof(noa_ie_hdr));
+        hdr[1] = sizeof(noa_ie_hdr) + noa_len - 2;
+        hdr[7] = noa_len;
+
+        noa = (void *) skb_put(skb, noa_len);
+        memset(noa, 0, noa_len);
+
+        noa->index = avp->noa_index;
+        if (avp->periodic_noa_duration) {
+                u32 interval = TU_TO_USEC(sc->cur_chan->beacon.beacon_interval);
+
+                noa->desc[i].count = 255;
+                noa->desc[i].start_time = cpu_to_le32(avp->periodic_noa_start);
+                noa->desc[i].duration = cpu_to_le32(avp->periodic_noa_duration);
+                noa->desc[i].interval = cpu_to_le32(interval);
+                i++;
+        }
+
+        if (avp->offchannel_duration) {
+                noa->desc[i].count = 1;
+                noa->desc[i].start_time = cpu_to_le32(avp->offchannel_start);
+                noa->desc[i].duration = cpu_to_le32(avp->offchannel_duration);
+        }
+}
+
 static struct ath_buf *ath9k_beacon_generate(struct ieee80211_hw *hw,
                                              struct ieee80211_vif *vif)
 {
@@ -155,6 +204,9 @@ static struct ath_buf *ath9k_beacon_generate(struct ieee80211_hw *hw,
                 hdr->seq_ctrl |= cpu_to_le16(sc->tx.seq_no);
         }
 
+        if (vif->p2p)
+                ath9k_beacon_add_noa(sc, avp, skb);
+
         bf->bf_buf_addr = dma_map_single(sc->dev, skb->data,
                                          skb->len, DMA_TO_DEVICE);
         if (unlikely(dma_mapping_error(sc->dev, bf->bf_buf_addr))) {
@@ -249,7 +301,7 @@ void ath9k_beacon_remove_slot(struct ath_softc *sc, struct ieee80211_vif *vif)
 static int ath9k_beacon_choose_slot(struct ath_softc *sc)
 {
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        struct ath_beacon_config *cur_conf = &sc->cur_beacon_conf;
+        struct ath_beacon_config *cur_conf = &sc->cur_chan->beacon;
         u16 intval;
         u32 tsftu;
         u64 tsf;
@@ -277,8 +329,8 @@ static int ath9k_beacon_choose_slot(struct ath_softc *sc)
 static void ath9k_set_tsfadjust(struct ath_softc *sc, struct ieee80211_vif *vif)
 {
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        struct ath_beacon_config *cur_conf = &sc->cur_beacon_conf;
         struct ath_vif *avp = (void *)vif->drv_priv;
+        struct ath_beacon_config *cur_conf = &avp->chanctx->beacon;
         u32 tsfadjust;
 
         if (avp->av_bslot == 0)
@@ -374,12 +426,19 @@ void ath9k_beacon_tasklet(unsigned long data)
         vif = sc->beacon.bslot[slot];
 
         /* EDMA devices check that in the tx completion function. */
-        if (!edma && ath9k_csa_is_finished(sc, vif))
-                return;
+        if (!edma) {
+                if (sc->sched.beacon_pending)
+                        ath_chanctx_event(sc, NULL,
+                                          ATH_CHANCTX_EVENT_BEACON_SENT);
+
+                if (ath9k_csa_is_finished(sc, vif))
+                        return;
+        }
 
         if (!vif || !vif->bss_conf.enable_beacon)
                 return;
 
+        ath_chanctx_event(sc, vif, ATH_CHANCTX_EVENT_BEACON_PREPARE);
         bf = ath9k_beacon_generate(sc->hw, vif);
 
         if (sc->beacon.bmisscnt != 0) {
@@ -500,7 +559,6 @@ static bool ath9k_allow_beacon_config(struct ath_softc *sc,
                                       struct ieee80211_vif *vif)
 {
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        struct ath_vif *avp = (void *)vif->drv_priv;
 
         if (sc->sc_ah->opmode == NL80211_IFTYPE_AP) {
                 if ((vif->type != NL80211_IFTYPE_AP) ||
@@ -514,7 +572,7 @@ static bool ath9k_allow_beacon_config(struct ath_softc *sc,
         if (sc->sc_ah->opmode == NL80211_IFTYPE_STATION) {
                 if ((vif->type == NL80211_IFTYPE_STATION) &&
                     test_bit(ATH_OP_BEACONS, &common->op_flags) &&
-                    !avp->primary_sta_vif) {
+                    vif != sc->cur_chan->primary_sta) {
                         ath_dbg(common, CONFIG,
                                 "Beacon already configured for a station interface\n");
                         return false;
@@ -525,10 +583,11 @@ static bool ath9k_allow_beacon_config(struct ath_softc *sc,
 }
 
 static void ath9k_cache_beacon_config(struct ath_softc *sc,
+                                      struct ath_chanctx *ctx,
                                       struct ieee80211_bss_conf *bss_conf)
 {
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        struct ath_beacon_config *cur_conf = &sc->cur_beacon_conf;
+        struct ath_beacon_config *cur_conf = &ctx->beacon;
 
         ath_dbg(common, BEACON,
                 "Caching beacon data for BSS: %pM\n", bss_conf->bssid);
@@ -564,20 +623,29 @@ void ath9k_beacon_config(struct ath_softc *sc, struct ieee80211_vif *vif,
                          u32 changed)
 {
         struct ieee80211_bss_conf *bss_conf = &vif->bss_conf;
-        struct ath_beacon_config *cur_conf = &sc->cur_beacon_conf;
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
+        struct ath_vif *avp = (void *)vif->drv_priv;
+        struct ath_chanctx *ctx = avp->chanctx;
+        struct ath_beacon_config *cur_conf;
         unsigned long flags;
         bool skip_beacon = false;
 
+        if (!ctx)
+                return;
+
+        cur_conf = &avp->chanctx->beacon;
         if (vif->type == NL80211_IFTYPE_AP)
                 ath9k_set_tsfadjust(sc, vif);
 
         if (!ath9k_allow_beacon_config(sc, vif))
                 return;
 
-        if (sc->sc_ah->opmode == NL80211_IFTYPE_STATION) {
-                ath9k_cache_beacon_config(sc, bss_conf);
+        if (vif->type == NL80211_IFTYPE_STATION) {
+                ath9k_cache_beacon_config(sc, ctx, bss_conf);
+                if (ctx != sc->cur_chan)
+                        return;
+
                 ath9k_set_beacon(sc);
                 set_bit(ATH_OP_BEACONS, &common->op_flags);
                 return;
@@ -593,10 +661,13 @@ void ath9k_beacon_config(struct ath_softc *sc, struct ieee80211_vif *vif,
                         cur_conf->enable_beacon = false;
                 } else if (bss_conf->enable_beacon) {
                         cur_conf->enable_beacon = true;
-                        ath9k_cache_beacon_config(sc, bss_conf);
+                        ath9k_cache_beacon_config(sc, ctx, bss_conf);
                 }
         }
 
+        if (ctx != sc->cur_chan)
+                return;
+
         /*
          * Configure the HW beacon registers only when we have a valid
          * beacon interval.
@@ -631,7 +702,7 @@ void ath9k_beacon_config(struct ath_softc *sc, struct ieee80211_vif *vif,
 void ath9k_set_beacon(struct ath_softc *sc)
 {
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        struct ath_beacon_config *cur_conf = &sc->cur_beacon_conf;
+        struct ath_beacon_config *cur_conf = &sc->cur_chan->beacon;
 
         switch (sc->sc_ah->opmode) {
         case NL80211_IFTYPE_AP:
diff --git a/drivers/net/wireless/ath/ath9k/channel.c b/drivers/net/wireless/ath/ath9k/channel.c
new file mode 100644
index 000000000000..ba214ebdcd16
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/channel.c
@@ -0,0 +1,685 @@
+/*
+ * Copyright (c) 2014 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "ath9k.h"
+
+/* Set/change channels.  If the channel is really being changed, it's done
+ * by reseting the chip.  To accomplish this we must first cleanup any pending
+ * DMA, then restart stuff.
+ */
+static int ath_set_channel(struct ath_softc *sc)
+{
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ieee80211_hw *hw = sc->hw;
+        struct ath9k_channel *hchan;
+        struct cfg80211_chan_def *chandef = &sc->cur_chan->chandef;
+        struct ieee80211_channel *chan = chandef->chan;
+        int pos = chan->hw_value;
+        int old_pos = -1;
+        int r;
+
+        if (test_bit(ATH_OP_INVALID, &common->op_flags))
+                return -EIO;
+
+        if (ah->curchan)
+                old_pos = ah->curchan - &ah->channels[0];
+
+        ath_dbg(common, CONFIG, "Set channel: %d MHz width: %d\n",
+                chan->center_freq, chandef->width);
+
+        /* update survey stats for the old channel before switching */
+        spin_lock_bh(&common->cc_lock);
+        ath_update_survey_stats(sc);
+        spin_unlock_bh(&common->cc_lock);
+
+        ath9k_cmn_get_channel(hw, ah, chandef);
+
+        /* If the operating channel changes, change the survey in-use flags
+         * along with it.
+         * Reset the survey data for the new channel, unless we're switching
+         * back to the operating channel from an off-channel operation.
+         */
+        if (!sc->cur_chan->offchannel && sc->cur_survey != &sc->survey[pos]) {
+                if (sc->cur_survey)
+                        sc->cur_survey->filled &= ~SURVEY_INFO_IN_USE;
+
+                sc->cur_survey = &sc->survey[pos];
+
+                memset(sc->cur_survey, 0, sizeof(struct survey_info));
+                sc->cur_survey->filled |= SURVEY_INFO_IN_USE;
+        } else if (!(sc->survey[pos].filled & SURVEY_INFO_IN_USE)) {
+                memset(&sc->survey[pos], 0, sizeof(struct survey_info));
+        }
+
+        hchan = &sc->sc_ah->channels[pos];
+        r = ath_reset_internal(sc, hchan);
+        if (r)
+                return r;
+
+        /* The most recent snapshot of channel->noisefloor for the old
+         * channel is only available after the hardware reset. Copy it to
+         * the survey stats now.
+         */
+        if (old_pos >= 0)
+                ath_update_survey_nf(sc, old_pos);
+
+        /* Enable radar pulse detection if on a DFS channel. Spectral
+         * scanning and radar detection can not be used concurrently.
+         */
+        if (hw->conf.radar_enabled) {
+                u32 rxfilter;
+
+                /* set HW specific DFS configuration */
+                ath9k_hw_set_radar_params(ah);
+                rxfilter = ath9k_hw_getrxfilter(ah);
+                rxfilter |= ATH9K_RX_FILTER_PHYRADAR |
+                                ATH9K_RX_FILTER_PHYERR;
+                ath9k_hw_setrxfilter(ah, rxfilter);
+                ath_dbg(common, DFS, "DFS enabled at freq %d\n",
+                        chan->center_freq);
+        } else {
+                /* perform spectral scan if requested. */
+                if (test_bit(ATH_OP_SCANNING, &common->op_flags) &&
+                        sc->spectral_mode == SPECTRAL_CHANSCAN)
+                        ath9k_spectral_scan_trigger(hw);
+        }
+
+        return 0;
+}
+
+static bool
+ath_chanctx_send_vif_ps_frame(struct ath_softc *sc, struct ath_vif *avp,
+                              bool powersave)
+{
+        struct ieee80211_vif *vif = avp->vif;
+        struct ieee80211_sta *sta = NULL;
+        struct ieee80211_hdr_3addr *nullfunc;
+        struct ath_tx_control txctl;
+        struct sk_buff *skb;
+        int band = sc->cur_chan->chandef.chan->band;
+
+        switch (vif->type) {
+        case NL80211_IFTYPE_STATION:
+                if (!vif->bss_conf.assoc)
+                        return false;
+
+                skb = ieee80211_nullfunc_get(sc->hw, vif);
+                if (!skb)
+                        return false;
+
+                nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
+                if (powersave)
+                        nullfunc->frame_control |=
+                                cpu_to_le16(IEEE80211_FCTL_PM);
+
+                skb_set_queue_mapping(skb, IEEE80211_AC_VO);
+                if (!ieee80211_tx_prepare_skb(sc->hw, vif, skb, band, &sta)) {
+                        dev_kfree_skb_any(skb);
+                        return false;
+                }
+                break;
+        default:
+                return false;
+        }
+
+        memset(&txctl, 0, sizeof(txctl));
+        txctl.txq = sc->tx.txq_map[IEEE80211_AC_VO];
+        txctl.sta = sta;
+        txctl.force_channel = true;
+        if (ath_tx_start(sc->hw, skb, &txctl)) {
+                ieee80211_free_txskb(sc->hw, skb);
+                return false;
+        }
+
+        return true;
+}
+
+void ath_chanctx_check_active(struct ath_softc *sc, struct ath_chanctx *ctx)
+{
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        struct ath_vif *avp;
+        bool active = false;
+        u8 n_active = 0;
+
+        if (!ctx)
+                return;
+
+        list_for_each_entry(avp, &ctx->vifs, list) {
+                struct ieee80211_vif *vif = avp->vif;
+
+                switch (vif->type) {
+                case NL80211_IFTYPE_P2P_CLIENT:
+                case NL80211_IFTYPE_STATION:
+                        if (vif->bss_conf.assoc)
+                                active = true;
+                        break;
+                default:
+                        active = true;
+                        break;
+                }
+        }
+        ctx->active = active;
+
+        ath_for_each_chanctx(sc, ctx) {
+                if (!ctx->assigned || list_empty(&ctx->vifs))
+                        continue;
+                n_active++;
+        }
+
+        if (n_active <= 1) {
+                clear_bit(ATH_OP_MULTI_CHANNEL, &common->op_flags);
+                return;
+        }
+        if (test_and_set_bit(ATH_OP_MULTI_CHANNEL, &common->op_flags))
+                return;
+        ath_chanctx_event(sc, NULL, ATH_CHANCTX_EVENT_ENABLE_MULTICHANNEL);
+}
+
+static bool
+ath_chanctx_send_ps_frame(struct ath_softc *sc, bool powersave)
+{
+        struct ath_vif *avp;
+        bool sent = false;
+
+        rcu_read_lock();
+        list_for_each_entry(avp, &sc->cur_chan->vifs, list) {
+                if (ath_chanctx_send_vif_ps_frame(sc, avp, powersave))
+                        sent = true;
+        }
+        rcu_read_unlock();
+
+        return sent;
+}
+
+static bool ath_chanctx_defer_switch(struct ath_softc *sc)
+{
+        if (sc->cur_chan == &sc->offchannel.chan)
+                return false;
+
+        switch (sc->sched.state) {
+        case ATH_CHANCTX_STATE_SWITCH:
+                return false;
+        case ATH_CHANCTX_STATE_IDLE:
+                if (!sc->cur_chan->switch_after_beacon)
+                        return false;
+
+                sc->sched.state = ATH_CHANCTX_STATE_WAIT_FOR_BEACON;
+                break;
+        default:
+                break;
+        }
+
+        return true;
+}
+
+static void ath_chanctx_set_next(struct ath_softc *sc, bool force)
+{
+        struct timespec ts;
+        bool measure_time = false;
+        bool send_ps = false;
+
+        spin_lock_bh(&sc->chan_lock);
+        if (!sc->next_chan) {
+                spin_unlock_bh(&sc->chan_lock);
+                return;
+        }
+
+        if (!force && ath_chanctx_defer_switch(sc)) {
+                spin_unlock_bh(&sc->chan_lock);
+                return;
+        }
+
+        if (sc->cur_chan != sc->next_chan) {
+                sc->cur_chan->stopped = true;
+                spin_unlock_bh(&sc->chan_lock);
+
+                if (sc->next_chan == &sc->offchannel.chan) {
+                        getrawmonotonic(&ts);
+                        measure_time = true;
+                }
+                __ath9k_flush(sc->hw, ~0, true);
+
+                if (ath_chanctx_send_ps_frame(sc, true))
+                        __ath9k_flush(sc->hw, BIT(IEEE80211_AC_VO), false);
+
+                send_ps = true;
+                spin_lock_bh(&sc->chan_lock);
+
+                if (sc->cur_chan != &sc->offchannel.chan) {
+                        getrawmonotonic(&sc->cur_chan->tsf_ts);
+                        sc->cur_chan->tsf_val = ath9k_hw_gettsf64(sc->sc_ah);
+                }
+        }
+        sc->cur_chan = sc->next_chan;
+        sc->cur_chan->stopped = false;
+        sc->next_chan = NULL;
+        sc->sched.offchannel_duration = 0;
+        if (sc->sched.state != ATH_CHANCTX_STATE_FORCE_ACTIVE)
+                sc->sched.state = ATH_CHANCTX_STATE_IDLE;
+
+        spin_unlock_bh(&sc->chan_lock);
+
+        if (sc->sc_ah->chip_fullsleep ||
+            memcmp(&sc->cur_chandef, &sc->cur_chan->chandef,
+                   sizeof(sc->cur_chandef))) {
+                ath_set_channel(sc);
+                if (measure_time)
+                        sc->sched.channel_switch_time =
+                                ath9k_hw_get_tsf_offset(&ts, NULL);
+        }
+        if (send_ps)
+                ath_chanctx_send_ps_frame(sc, false);
+
+        ath_offchannel_channel_change(sc);
+        ath_chanctx_event(sc, NULL, ATH_CHANCTX_EVENT_SWITCH);
+}
+
+void ath_chanctx_work(struct work_struct *work)
+{
+        struct ath_softc *sc = container_of(work, struct ath_softc,
+                                            chanctx_work);
+        mutex_lock(&sc->mutex);
+        ath_chanctx_set_next(sc, false);
+        mutex_unlock(&sc->mutex);
+}
+
+void ath_chanctx_init(struct ath_softc *sc)
+{
+        struct ath_chanctx *ctx;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_channel *chan;
+        int i, j;
+
+        sband = &common->sbands[IEEE80211_BAND_2GHZ];
+        if (!sband->n_channels)
+                sband = &common->sbands[IEEE80211_BAND_5GHZ];
+
+        chan = &sband->channels[0];
+        for (i = 0; i < ATH9K_NUM_CHANCTX; i++) {
+                ctx = &sc->chanctx[i];
+                cfg80211_chandef_create(&ctx->chandef, chan, NL80211_CHAN_HT20);
+                INIT_LIST_HEAD(&ctx->vifs);
+                ctx->txpower = ATH_TXPOWER_MAX;
+                for (j = 0; j < ARRAY_SIZE(ctx->acq); j++)
+                        INIT_LIST_HEAD(&ctx->acq[j]);
+        }
+        ctx = &sc->offchannel.chan;
+        cfg80211_chandef_create(&ctx->chandef, chan, NL80211_CHAN_HT20);
+        INIT_LIST_HEAD(&ctx->vifs);
+        ctx->txpower = ATH_TXPOWER_MAX;
+        for (j = 0; j < ARRAY_SIZE(ctx->acq); j++)
+                INIT_LIST_HEAD(&ctx->acq[j]);
+        sc->offchannel.chan.offchannel = true;
+
+}
+
+void ath9k_chanctx_force_active(struct ieee80211_hw *hw,
+                                struct ieee80211_vif *vif)
+{
+        struct ath_softc *sc = hw->priv;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        struct ath_vif *avp = (struct ath_vif *) vif->drv_priv;
+        bool changed = false;
+
+        if (!test_bit(ATH_OP_MULTI_CHANNEL, &common->op_flags))
+                return;
+
+        if (!avp->chanctx)
+                return;
+
+        mutex_lock(&sc->mutex);
+
+        spin_lock_bh(&sc->chan_lock);
+        if (sc->next_chan || (sc->cur_chan != avp->chanctx)) {
+                sc->next_chan = avp->chanctx;
+                changed = true;
+        }
+        sc->sched.state = ATH_CHANCTX_STATE_FORCE_ACTIVE;
+        spin_unlock_bh(&sc->chan_lock);
+
+        if (changed)
+                ath_chanctx_set_next(sc, true);
+
+        mutex_unlock(&sc->mutex);
+}
+
+void ath_chanctx_switch(struct ath_softc *sc, struct ath_chanctx *ctx,
+                        struct cfg80211_chan_def *chandef)
+{
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+
+        spin_lock_bh(&sc->chan_lock);
+
+        if (test_bit(ATH_OP_MULTI_CHANNEL, &common->op_flags) &&
+            (sc->cur_chan != ctx) && (ctx == &sc->offchannel.chan)) {
+                sc->sched.offchannel_pending = true;
+                spin_unlock_bh(&sc->chan_lock);
+                return;
+        }
+
+        sc->next_chan = ctx;
+        if (chandef)
+                ctx->chandef = *chandef;
+
+        if (sc->next_chan == &sc->offchannel.chan) {
+                sc->sched.offchannel_duration =
+                        TU_TO_USEC(sc->offchannel.duration) +
+                        sc->sched.channel_switch_time;
+        }
+        spin_unlock_bh(&sc->chan_lock);
+        ieee80211_queue_work(sc->hw, &sc->chanctx_work);
+}
+
+void ath_chanctx_set_channel(struct ath_softc *sc, struct ath_chanctx *ctx,
+                             struct cfg80211_chan_def *chandef)
+{
+        bool cur_chan;
+
+        spin_lock_bh(&sc->chan_lock);
+        if (chandef)
+                memcpy(&ctx->chandef, chandef, sizeof(*chandef));
+        cur_chan = sc->cur_chan == ctx;
+        spin_unlock_bh(&sc->chan_lock);
+
+        if (!cur_chan)
+                return;
+
+        ath_set_channel(sc);
+}
+
+struct ath_chanctx *ath_chanctx_get_oper_chan(struct ath_softc *sc, bool active)
+{
+        struct ath_chanctx *ctx;
+
+        ath_for_each_chanctx(sc, ctx) {
+                if (!ctx->assigned || list_empty(&ctx->vifs))
+                        continue;
+                if (active && !ctx->active)
+                        continue;
+
+                if (ctx->switch_after_beacon)
+                        return ctx;
+        }
+
+        return &sc->chanctx[0];
+}
+
+void ath_chanctx_offchan_switch(struct ath_softc *sc,
+                                struct ieee80211_channel *chan)
+{
+        struct cfg80211_chan_def chandef;
+
+        cfg80211_chandef_create(&chandef, chan, NL80211_CHAN_NO_HT);
+
+        ath_chanctx_switch(sc, &sc->offchannel.chan, &chandef);
+}
+
+static struct ath_chanctx *
+ath_chanctx_get_next(struct ath_softc *sc, struct ath_chanctx *ctx)
+{
+        int idx = ctx - &sc->chanctx[0];
+
+        return &sc->chanctx[!idx];
+}
+
+static void ath_chanctx_adjust_tbtt_delta(struct ath_softc *sc)
+{
+        struct ath_chanctx *prev, *cur;
+        struct timespec ts;
+        u32 cur_tsf, prev_tsf, beacon_int;
+        s32 offset;
+
+        beacon_int = TU_TO_USEC(sc->cur_chan->beacon.beacon_interval);
+
+        cur = sc->cur_chan;
+        prev = ath_chanctx_get_next(sc, cur);
+
+        getrawmonotonic(&ts);
+        cur_tsf = (u32) cur->tsf_val +
+                  ath9k_hw_get_tsf_offset(&cur->tsf_ts, &ts);
+
+        prev_tsf = prev->last_beacon - (u32) prev->tsf_val + cur_tsf;
+        prev_tsf -= ath9k_hw_get_tsf_offset(&prev->tsf_ts, &ts);
+
+        /* Adjust the TSF time of the AP chanctx to keep its beacons
+         * at half beacon interval offset relative to the STA chanctx.
+         */
+        offset = cur_tsf - prev_tsf;
+
+        /* Ignore stale data or spurious timestamps */
+        if (offset < 0 || offset > 3 * beacon_int)
+                return;
+
+        offset = beacon_int / 2 - (offset % beacon_int);
+        prev->tsf_val += offset;
+}
+
+void ath_chanctx_timer(unsigned long data)
+{
+        struct ath_softc *sc = (struct ath_softc *) data;
+
+        ath_chanctx_event(sc, NULL, ATH_CHANCTX_EVENT_TSF_TIMER);
+}
+
+/* Configure the TSF based hardware timer for a channel switch.
+ * Also set up backup software timer, in case the gen timer fails.
+ * This could be caused by a hardware reset.
+ */
+static void ath_chanctx_setup_timer(struct ath_softc *sc, u32 tsf_time)
+{
+        struct ath_hw *ah = sc->sc_ah;
+
+        ath9k_hw_gen_timer_start(ah, sc->p2p_ps_timer, tsf_time, 1000000);
+        tsf_time -= ath9k_hw_gettsf32(ah);
+        tsf_time = msecs_to_jiffies(tsf_time / 1000) + 1;
+        mod_timer(&sc->sched.timer, tsf_time);
+}
+
+void ath_chanctx_event(struct ath_softc *sc, struct ieee80211_vif *vif,
+                       enum ath_chanctx_event ev)
+{
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath_beacon_config *cur_conf;
+        struct ath_vif *avp = NULL;
+        struct ath_chanctx *ctx;
+        u32 tsf_time;
+        u32 beacon_int;
+        bool noa_changed = false;
+
+        if (vif)
+                avp = (struct ath_vif *) vif->drv_priv;
+
+        spin_lock_bh(&sc->chan_lock);
+
+        switch (ev) {
+        case ATH_CHANCTX_EVENT_BEACON_PREPARE:
+                if (avp->offchannel_duration)
+                        avp->offchannel_duration = 0;
+
+                if (avp->chanctx != sc->cur_chan)
+                        break;
+
+                if (sc->sched.offchannel_pending) {
+                        sc->sched.offchannel_pending = false;
+                        sc->next_chan = &sc->offchannel.chan;
+                        sc->sched.state = ATH_CHANCTX_STATE_WAIT_FOR_BEACON;
+                }
+
+                ctx = ath_chanctx_get_next(sc, sc->cur_chan);
+                if (ctx->active && sc->sched.state == ATH_CHANCTX_STATE_IDLE) {
+                        sc->next_chan = ctx;
+                        sc->sched.state = ATH_CHANCTX_STATE_WAIT_FOR_BEACON;
+                }
+
+                /* if the timer missed its window, use the next interval */
+                if (sc->sched.state == ATH_CHANCTX_STATE_WAIT_FOR_TIMER)
+                        sc->sched.state = ATH_CHANCTX_STATE_WAIT_FOR_BEACON;
+
+                if (sc->sched.state != ATH_CHANCTX_STATE_WAIT_FOR_BEACON)
+                        break;
+
+                sc->sched.beacon_pending = true;
+                sc->sched.next_tbtt = REG_READ(ah, AR_NEXT_TBTT_TIMER);
+
+                cur_conf = &sc->cur_chan->beacon;
+                beacon_int = TU_TO_USEC(cur_conf->beacon_interval);
+
+                /* defer channel switch by a quarter beacon interval */
+                tsf_time = sc->sched.next_tbtt + beacon_int / 4;
+                sc->sched.switch_start_time = tsf_time;
+                sc->cur_chan->last_beacon = sc->sched.next_tbtt;
+
+                /* Prevent wrap-around issues */
+                if (avp->periodic_noa_duration &&
+                    tsf_time - avp->periodic_noa_start > BIT(30))
+                        avp->periodic_noa_duration = 0;
+
+                if (ctx->active && !avp->periodic_noa_duration) {
+                        avp->periodic_noa_start = tsf_time;
+                        avp->periodic_noa_duration =
+                                TU_TO_USEC(cur_conf->beacon_interval) / 2 -
+                                sc->sched.channel_switch_time;
+                        noa_changed = true;
+                } else if (!ctx->active && avp->periodic_noa_duration) {
+                        avp->periodic_noa_duration = 0;
+                        noa_changed = true;
+                }
+
+                /* If at least two consecutive beacons were missed on the STA
+                 * chanctx, stay on the STA channel for one extra beacon period,
+                 * to resync the timer properly.
+                 */
+                if (ctx->active && sc->sched.beacon_miss >= 2)
+                        sc->sched.offchannel_duration = 3 * beacon_int / 2;
+
+                if (sc->sched.offchannel_duration) {
+                        noa_changed = true;
+                        avp->offchannel_start = tsf_time;
+                        avp->offchannel_duration =
+                                sc->sched.offchannel_duration;
+                }
+
+                if (noa_changed)
+                        avp->noa_index++;
+                break;
+        case ATH_CHANCTX_EVENT_BEACON_SENT:
+                if (!sc->sched.beacon_pending)
+                        break;
+
+                sc->sched.beacon_pending = false;
+                if (sc->sched.state != ATH_CHANCTX_STATE_WAIT_FOR_BEACON)
+                        break;
+
+                sc->sched.state = ATH_CHANCTX_STATE_WAIT_FOR_TIMER;
+                ath_chanctx_setup_timer(sc, sc->sched.switch_start_time);
+                break;
+        case ATH_CHANCTX_EVENT_TSF_TIMER:
+                if (sc->sched.state != ATH_CHANCTX_STATE_WAIT_FOR_TIMER)
+                        break;
+
+                if (!sc->cur_chan->switch_after_beacon &&
+                    sc->sched.beacon_pending)
+                        sc->sched.beacon_miss++;
+
+                sc->sched.state = ATH_CHANCTX_STATE_SWITCH;
+                ieee80211_queue_work(sc->hw, &sc->chanctx_work);
+                break;
+        case ATH_CHANCTX_EVENT_BEACON_RECEIVED:
+                if (!test_bit(ATH_OP_MULTI_CHANNEL, &common->op_flags) ||
+                    sc->cur_chan == &sc->offchannel.chan)
+                        break;
+
+                ath_chanctx_adjust_tbtt_delta(sc);
+                sc->sched.beacon_pending = false;
+                sc->sched.beacon_miss = 0;
+
+                /* TSF time might have been updated by the incoming beacon,
+                 * need update the channel switch timer to reflect the change.
+                 */
+                tsf_time = sc->sched.switch_start_time;
+                tsf_time -= (u32) sc->cur_chan->tsf_val +
+                        ath9k_hw_get_tsf_offset(&sc->cur_chan->tsf_ts, NULL);
+                tsf_time += ath9k_hw_gettsf32(ah);
+
+
+                ath_chanctx_setup_timer(sc, tsf_time);
+                break;
+        case ATH_CHANCTX_EVENT_ASSOC:
+                if (sc->sched.state != ATH_CHANCTX_STATE_FORCE_ACTIVE ||
+                    avp->chanctx != sc->cur_chan)
+                        break;
+
+                sc->sched.state = ATH_CHANCTX_STATE_IDLE;
+                /* fall through */
+        case ATH_CHANCTX_EVENT_SWITCH:
+                if (!test_bit(ATH_OP_MULTI_CHANNEL, &common->op_flags) ||
+                    sc->sched.state == ATH_CHANCTX_STATE_FORCE_ACTIVE ||
+                    sc->cur_chan->switch_after_beacon ||
+                    sc->cur_chan == &sc->offchannel.chan)
+                        break;
+
+                /* If this is a station chanctx, stay active for a half
+                 * beacon period (minus channel switch time)
+                 */
+                sc->next_chan = ath_chanctx_get_next(sc, sc->cur_chan);
+                cur_conf = &sc->cur_chan->beacon;
+
+                sc->sched.state = ATH_CHANCTX_STATE_WAIT_FOR_TIMER;
+
+                tsf_time = TU_TO_USEC(cur_conf->beacon_interval) / 2;
+                if (sc->sched.beacon_miss >= 2) {
+                        sc->sched.beacon_miss = 0;
+                        tsf_time *= 3;
+                }
+
+                tsf_time -= sc->sched.channel_switch_time;
+                tsf_time += ath9k_hw_gettsf32(sc->sc_ah);
+                sc->sched.switch_start_time = tsf_time;
+
+                ath_chanctx_setup_timer(sc, tsf_time);
+                sc->sched.beacon_pending = true;
+                break;
+        case ATH_CHANCTX_EVENT_ENABLE_MULTICHANNEL:
+                if (sc->cur_chan == &sc->offchannel.chan ||
+                    sc->cur_chan->switch_after_beacon)
+                        break;
+
+                sc->next_chan = ath_chanctx_get_next(sc, sc->cur_chan);
+                ieee80211_queue_work(sc->hw, &sc->chanctx_work);
+                break;
+        case ATH_CHANCTX_EVENT_UNASSIGN:
+                if (sc->cur_chan->assigned) {
+                        if (sc->next_chan && !sc->next_chan->assigned &&
+                            sc->next_chan != &sc->offchannel.chan)
+                                sc->sched.state = ATH_CHANCTX_STATE_IDLE;
+                        break;
+                }
+
+                ctx = ath_chanctx_get_next(sc, sc->cur_chan);
+                sc->sched.state = ATH_CHANCTX_STATE_IDLE;
+                if (!ctx->assigned)
+                        break;
+
+                sc->next_chan = ctx;
+                ieee80211_queue_work(sc->hw, &sc->chanctx_work);
+                break;
+        }
+
+        spin_unlock_bh(&sc->chan_lock);
+}
diff --git a/drivers/net/wireless/ath/ath9k/common-beacon.c b/drivers/net/wireless/ath/ath9k/common-beacon.c
index 775d1d20ce0b..733be5178481 100644
--- a/drivers/net/wireless/ath/ath9k/common-beacon.c
+++ b/drivers/net/wireless/ath/ath9k/common-beacon.c
@@ -57,7 +57,7 @@ int ath9k_cmn_beacon_config_sta(struct ath_hw *ah,
                                  struct ath9k_beacon_state *bs)
 {
         struct ath_common *common = ath9k_hw_common(ah);
-        int dtim_intval;
+        int dtim_intval, sleepduration;
         u64 tsf;
 
         /* No need to configure beacon if we are not associated */
@@ -75,6 +75,7 @@ int ath9k_cmn_beacon_config_sta(struct ath_hw *ah,
          * last beacon we received (which may be none).
          */
         dtim_intval = conf->intval * conf->dtim_period;
+        sleepduration = ah->hw->conf.listen_interval * conf->intval;
 
         /*
          * Pull nexttbtt forward to reflect the current
@@ -112,7 +113,7 @@ int ath9k_cmn_beacon_config_sta(struct ath_hw *ah,
          */
 
         bs->bs_sleepduration = TU_TO_USEC(roundup(IEEE80211_MS_TO_TU(100),
-                                                 conf->intval));
+                                                  sleepduration));
         if (bs->bs_sleepduration > bs->bs_dtimperiod)
                 bs->bs_sleepduration = bs->bs_dtimperiod;
 
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 6cc42be48d4e..d2279365be6f 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -202,7 +202,7 @@ static ssize_t write_file_ani(struct file *file,
         if (kstrtoul(buf, 0, &ani))
                 return -EINVAL;
 
-        if (ani < 0 || ani > 1)
+        if (ani > 1)
                 return -EINVAL;
 
         common->disable_ani = !ani;
@@ -750,13 +750,13 @@ static ssize_t read_file_misc(struct file *file, char __user *user_buf,
 {
         struct ath_softc *sc = file->private_data;
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        struct ieee80211_hw *hw = sc->hw;
         struct ath9k_vif_iter_data iter_data;
+        struct ath_chanctx *ctx;
         char buf[512];
         unsigned int len = 0;
         ssize_t retval = 0;
         unsigned int reg;
-        u32 rxfilter;
+        u32 rxfilter, i;
 
         len += scnprintf(buf + len, sizeof(buf) - len,
                          "BSSID: %pM\n", common->curbssid);
@@ -826,14 +826,20 @@ static ssize_t read_file_misc(struct file *file, char __user *user_buf,
 
         len += scnprintf(buf + len, sizeof(buf) - len, "\n");
 
-        ath9k_calculate_iter_data(hw, NULL, &iter_data);
-
-        len += scnprintf(buf + len, sizeof(buf) - len,
-                         "VIF-COUNTS: AP: %i STA: %i MESH: %i WDS: %i"
-                         " ADHOC: %i TOTAL: %hi BEACON-VIF: %hi\n",
-                         iter_data.naps, iter_data.nstations, iter_data.nmeshes,
-                         iter_data.nwds, iter_data.nadhocs,
-                         sc->nvifs, sc->nbcnvifs);
+        i = 0;
+        ath_for_each_chanctx(sc, ctx) {
+                if (!ctx->assigned || list_empty(&ctx->vifs))
+                        continue;
+                ath9k_calculate_iter_data(sc, ctx, &iter_data);
+
+                len += scnprintf(buf + len, sizeof(buf) - len,
+                        "VIF-COUNTS: CTX %i AP: %i STA: %i MESH: %i WDS: %i",
+                        i++, iter_data.naps, iter_data.nstations,
+                        iter_data.nmeshes, iter_data.nwds);
+                len += scnprintf(buf + len, sizeof(buf) - len,
+                        " ADHOC: %i TOTAL: %hi BEACON-VIF: %hi\n",
+                        iter_data.nadhocs, sc->nvifs, sc->nbcnvifs);
+        }
 
         if (len > sizeof(buf))
                 len = sizeof(buf);
@@ -1080,7 +1086,7 @@ static ssize_t read_file_dump_nfcal(struct file *file, char __user *user_buf,
 {
         struct ath_softc *sc = file->private_data;
         struct ath_hw *ah = sc->sc_ah;
-        struct ath9k_nfcal_hist *h = sc->caldata.nfCalHist;
+        struct ath9k_nfcal_hist *h = sc->cur_chan->caldata.nfCalHist;
         struct ath_common *common = ath9k_hw_common(ah);
         struct ieee80211_conf *conf = &common->hw->conf;
         u32 len = 0, size = 1500;
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 2a8ed8375ec0..69bbea1184d2 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -791,7 +791,8 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
                                 refdiv = 5;
                         } else {
                                 pll2_divint = 0x11;
-                                pll2_divfrac = 0x26666;
+                                pll2_divfrac =
+                                        AR_SREV_9531(ah) ? 0x26665 : 0x26666;
                                 refdiv = 1;
                         }
                 }
@@ -1730,11 +1731,27 @@ fail:
         return -EINVAL;
 }
 
+u32 ath9k_hw_get_tsf_offset(struct timespec *last, struct timespec *cur)
+{
+        struct timespec ts;
+        s64 usec;
+
+        if (!cur) {
+                getrawmonotonic(&ts);
+                cur = &ts;
+        }
+
+        usec = cur->tv_sec * 1000000ULL + cur->tv_nsec / 1000;
+        usec -= last->tv_sec * 1000000ULL + last->tv_nsec / 1000;
+
+        return (u32) usec;
+}
+EXPORT_SYMBOL(ath9k_hw_get_tsf_offset);
+
 int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
                    struct ath9k_hw_cal_data *caldata, bool fastcc)
 {
         struct ath_common *common = ath9k_hw_common(ah);
-        struct timespec ts;
         u32 saveLedState;
         u32 saveDefAntenna;
         u32 macStaId1;
@@ -1784,8 +1801,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
 
         /* Save TSF before chip reset, a cold reset clears it */
         tsf = ath9k_hw_gettsf64(ah);
-        getrawmonotonic(&ts);
-        usec = ts.tv_sec * 1000000ULL + ts.tv_nsec / 1000;
+        usec = ktime_to_us(ktime_get_raw());
 
         saveLedState = REG_READ(ah, AR_CFG_LED) &
                 (AR_CFG_LED_ASSOC_CTL | AR_CFG_LED_MODE_SEL |
@@ -1818,8 +1834,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         }
 
         /* Restore TSF */
-        getrawmonotonic(&ts);
-        usec = ts.tv_sec * 1000000ULL + ts.tv_nsec / 1000 - usec;
+        usec = ktime_to_us(ktime_get_raw()) - usec;
         ath9k_hw_settsf64(ah, tsf + usec);
 
         if (AR_SREV_9280_20_OR_LATER(ah))
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 0acd4b5a4892..51b4ebe04c04 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -1000,6 +1000,7 @@ u32 ath9k_hw_gettsf32(struct ath_hw *ah);
 u64 ath9k_hw_gettsf64(struct ath_hw *ah);
 void ath9k_hw_settsf64(struct ath_hw *ah, u64 tsf64);
 void ath9k_hw_reset_tsf(struct ath_hw *ah);
+u32 ath9k_hw_get_tsf_offset(struct timespec *last, struct timespec *cur);
 void ath9k_hw_set_tsfadjust(struct ath_hw *ah, bool set);
 void ath9k_hw_init_global_settings(struct ath_hw *ah);
 u32 ar9003_get_pll_sqsum_dvc(struct ath_hw *ah);
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 0246b990fe87..39419ea845cc 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -61,7 +61,7 @@ static int ath9k_ps_enable;
 module_param_named(ps_enable, ath9k_ps_enable, int, 0444);
 MODULE_PARM_DESC(ps_enable, "Enable WLAN PowerSave");
 
-static int ath9k_use_chanctx;
+int ath9k_use_chanctx;
 module_param_named(use_chanctx, ath9k_use_chanctx, int, 0444);
 MODULE_PARM_DESC(use_chanctx, "Enable channel context for concurrency");
 
@@ -169,9 +169,9 @@ static void ath9k_reg_notifier(struct wiphy *wiphy,
 
         /* Set tx power */
         if (ah->curchan) {
-                sc->config.txpowlimit = 2 * ah->curchan->chan->max_power;
+                sc->cur_chan->txpower = 2 * ah->curchan->chan->max_power;
                 ath9k_ps_wakeup(sc);
-                ath9k_hw_set_txpowerlimit(ah, sc->config.txpowlimit, false);
+                ath9k_hw_set_txpowerlimit(ah, sc->cur_chan->txpower, false);
                 sc->curtxpow = ath9k_hw_regulatory(ah)->power_limit;
                 /* synchronize DFS detector if regulatory domain changed */
                 if (sc->dfs_detector != NULL)
@@ -335,7 +335,6 @@ static void ath9k_init_misc(struct ath_softc *sc)
         setup_timer(&common->ani.timer, ath_ani_calibrate, (unsigned long)sc);
 
         common->last_rssi = ATH_RSSI_DUMMY_MARKER;
-        sc->config.txpowlimit = ATH_TXPOWER_MAX;
         memcpy(common->bssidmask, ath_bcast_mac, ETH_ALEN);
         sc->beacon.slottime = ATH9K_SLOT_TIME_9;
 
@@ -511,6 +510,9 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc,
         sc->dfs_detector = dfs_pattern_detector_init(common, NL80211_DFS_UNSET);
         sc->tx99_power = MAX_RATE_POWER + 1;
         init_waitqueue_head(&sc->tx_wait);
+        sc->cur_chan = &sc->chanctx[0];
+        if (!ath9k_use_chanctx)
+                sc->cur_chan->hw_queue_base = 0;
 
         if (!pdata || pdata->use_eeprom) {
                 ah->ah_flags |= AH_USE_EEPROM;
@@ -556,6 +558,7 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc,
         spin_lock_init(&common->cc_lock);
         spin_lock_init(&sc->sc_serial_rw);
         spin_lock_init(&sc->sc_pm_lock);
+        spin_lock_init(&sc->chan_lock);
         mutex_init(&sc->mutex);
         tasklet_init(&sc->intr_tq, ath9k_tasklet, (unsigned long)sc);
         tasklet_init(&sc->bcon_tasklet, ath9k_beacon_tasklet,
@@ -564,7 +567,11 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc,
         setup_timer(&sc->sleep_timer, ath_ps_full_sleep, (unsigned long)sc);
         INIT_WORK(&sc->hw_reset_work, ath_reset_work);
         INIT_WORK(&sc->paprd_work, ath_paprd_calibrate);
+        INIT_WORK(&sc->chanctx_work, ath_chanctx_work);
         INIT_DELAYED_WORK(&sc->hw_pll_work, ath_hw_pll_work);
+        setup_timer(&sc->offchannel.timer, ath_offchannel_timer,
+                    (unsigned long)sc);
+        setup_timer(&sc->sched.timer, ath_chanctx_timer, (unsigned long)sc);
 
         /*
          * Cache line size is used to size and align various
@@ -599,6 +606,7 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc,
         ath9k_cmn_init_crypto(sc->sc_ah);
         ath9k_init_misc(sc);
         ath_fill_led_pin(sc);
+        ath_chanctx_init(sc);
 
         if (common->bus_ops->aspm_init)
                 common->bus_ops->aspm_init(common);
@@ -664,6 +672,12 @@ static const struct ieee80211_iface_limit wds_limits[] = {
         { .max = 2048,  .types = BIT(NL80211_IFTYPE_WDS) },
 };
 
+static const struct ieee80211_iface_limit if_limits_multi[] = {
+        { .max = 1,     .types = BIT(NL80211_IFTYPE_STATION) },
+        { .max = 1,     .types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
+                                 BIT(NL80211_IFTYPE_P2P_GO) },
+};
+
 static const struct ieee80211_iface_limit if_dfs_limits[] = {
         { .max = 1,     .types = BIT(NL80211_IFTYPE_AP) |
 #ifdef CONFIG_MAC80211_MESH
@@ -672,6 +686,16 @@ static const struct ieee80211_iface_limit if_dfs_limits[] = {
                                  BIT(NL80211_IFTYPE_ADHOC) },
 };
 
+static const struct ieee80211_iface_combination if_comb_multi[] = {
+        {
+                .limits = if_limits_multi,
+                .n_limits = ARRAY_SIZE(if_limits_multi),
+                .max_interfaces = 2,
+                .num_different_channels = 2,
+                .beacon_int_infra_match = true,
+        },
+};
+
 static const struct ieee80211_iface_combination if_comb[] = {
         {
                 .limits = if_limits,
@@ -712,6 +736,7 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
                 IEEE80211_HW_SPECTRUM_MGMT |
                 IEEE80211_HW_REPORTS_TX_ACK_STATUS |
                 IEEE80211_HW_SUPPORTS_RC_TABLE |
+                IEEE80211_HW_QUEUE_CONTROL |
                 IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
 
         if (ath9k_ps_enable)
@@ -739,12 +764,21 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
                         BIT(NL80211_IFTYPE_STATION) |
                         BIT(NL80211_IFTYPE_ADHOC) |
                         BIT(NL80211_IFTYPE_MESH_POINT);
-                hw->wiphy->iface_combinations = if_comb;
                 if (!ath9k_use_chanctx) {
+                        hw->wiphy->iface_combinations = if_comb;
                         hw->wiphy->n_iface_combinations = ARRAY_SIZE(if_comb);
                         hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_WDS);
-                } else
-                        hw->wiphy->n_iface_combinations = 1;
+                } else {
+                        hw->wiphy->iface_combinations = if_comb_multi;
+                        hw->wiphy->n_iface_combinations =
+                                ARRAY_SIZE(if_comb_multi);
+                        hw->wiphy->max_scan_ssids = 255;
+                        hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
+                        hw->wiphy->max_remain_on_channel_duration = 10000;
+                        hw->chanctx_data_size = sizeof(void *);
+                        hw->extra_beacon_tailroom =
+                                sizeof(struct ieee80211_p2p_noa_attr) + 9;
+                }
         }
 
         hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
@@ -756,9 +790,14 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
         hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
         hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
 
-        hw->queues = 4;
+        /* allow 4 queues per channel context +
+         * 1 cab queue + 1 offchannel tx queue
+         */
+        hw->queues = 10;
+        /* last queue for offchannel */
+        hw->offchannel_tx_hw_queue = hw->queues - 1;
         hw->max_rates = 4;
-        hw->max_listen_interval = 1;
+        hw->max_listen_interval = 10;
         hw->max_rate_tries = 10;
         hw->sta_data_size = sizeof(struct ath_node);
         hw->vif_data_size = sizeof(struct ath_vif);
diff --git a/drivers/net/wireless/ath/ath9k/link.c b/drivers/net/wireless/ath/ath9k/link.c
index 72a715fe8f24..2343f56e6498 100644
--- a/drivers/net/wireless/ath/ath9k/link.c
+++ b/drivers/net/wireless/ath/ath9k/link.c
@@ -178,7 +178,7 @@ static bool ath_paprd_send_frame(struct ath_softc *sc, struct sk_buff *skb, int
         txctl.txq = sc->tx.txq_map[IEEE80211_AC_BE];
 
         memset(tx_info, 0, sizeof(*tx_info));
-        tx_info->band = hw->conf.chandef.chan->band;
+        tx_info->band = sc->cur_chandef.chan->band;
         tx_info->flags |= IEEE80211_TX_CTL_NO_ACK;
         tx_info->control.rates[0].idx = 0;
         tx_info->control.rates[0].count = 1;
@@ -416,7 +416,7 @@ void ath_start_ani(struct ath_softc *sc)
 
         if (common->disable_ani ||
             !test_bit(ATH_OP_ANI_RUN, &common->op_flags) ||
-            (sc->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL))
+            sc->cur_chan->offchannel)
                 return;
 
         common->ani.longcal_timer = timestamp;
@@ -440,7 +440,7 @@ void ath_check_ani(struct ath_softc *sc)
 {
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        struct ath_beacon_config *cur_conf = &sc->cur_beacon_conf;
+        struct ath_beacon_config *cur_conf = &sc->cur_chan->beacon;
 
         /*
          * Check for the various conditions in which ANI has to
diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h
index da7686757535..6c56cafa5ca4 100644
--- a/drivers/net/wireless/ath/ath9k/mac.h
+++ b/drivers/net/wireless/ath/ath9k/mac.h
@@ -346,8 +346,14 @@ struct ar5416_desc {
 #define AR_FrameLen         0x00000fff
 #define AR_VirtMoreFrag     0x00001000
 #define AR_TxCtlRsvd00      0x0000e000
-#define AR_XmitPower        0x003f0000
-#define AR_XmitPower_S      16
+#define AR_XmitPower0       0x003f0000
+#define AR_XmitPower0_S     16
+#define AR_XmitPower1       0x3f000000
+#define AR_XmitPower1_S     24
+#define AR_XmitPower2       0x3f000000
+#define AR_XmitPower2_S     24
+#define AR_XmitPower3       0x3f000000
+#define AR_XmitPower3_S     24
 #define AR_RTSEnable        0x00400000
 #define AR_VEOL             0x00800000
 #define AR_ClrDestMask      0x01000000
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 62ac95d6bb9d..e6ac8d2e610c 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -19,9 +19,6 @@
 #include "ath9k.h"
 #include "btcoex.h"
 
-static void ath9k_set_assoc_state(struct ath_softc *sc,
-                                  struct ieee80211_vif *vif);
-
 u8 ath9k_parse_mpdudensity(u8 mpdudensity)
 {
         /*
@@ -63,9 +60,16 @@ static bool ath9k_has_pending_frames(struct ath_softc *sc, struct ath_txq *txq)
 
         spin_lock_bh(&txq->axq_lock);
 
-        if (txq->axq_depth || !list_empty(&txq->axq_acq))
+        if (txq->axq_depth)
                 pending = true;
 
+        if (txq->mac80211_qnum >= 0) {
+                struct list_head *list;
+
+                list = &sc->cur_chan->acq[txq->mac80211_qnum];
+                if (!list_empty(list))
+                        pending = true;
+        }
         spin_unlock_bh(&txq->axq_lock);
         return pending;
 }
@@ -227,13 +231,22 @@ static bool ath_complete_reset(struct ath_softc *sc, bool start)
         }
 
         ath9k_cmn_update_txpow(ah, sc->curtxpow,
-                               sc->config.txpowlimit, &sc->curtxpow);
+                               sc->cur_chan->txpower, &sc->curtxpow);
 
         clear_bit(ATH_OP_HW_RESET, &common->op_flags);
-        ath9k_hw_set_interrupts(ah);
-        ath9k_hw_enable_interrupts(ah);
+        ath9k_calculate_summary_state(sc, sc->cur_chan);
+
+        if (!sc->cur_chan->offchannel && start) {
+                /* restore per chanctx TSF timer */
+                if (sc->cur_chan->tsf_val) {
+                        u32 offset;
+
+                        offset = ath9k_hw_get_tsf_offset(&sc->cur_chan->tsf_ts,
+                                                         NULL);
+                        ath9k_hw_settsf64(ah, sc->cur_chan->tsf_val + offset);
+                }
+
 
-        if (!(sc->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL) && start) {
                 if (!test_bit(ATH_OP_BEACONS, &common->op_flags))
                         goto work;
 
@@ -247,26 +260,35 @@ static bool ath_complete_reset(struct ath_softc *sc, bool start)
                 }
         work:
                 ath_restart_work(sc);
+                ath_txq_schedule_all(sc);
+        }
 
-                for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
-                        if (!ATH_TXQ_SETUP(sc, i))
-                                continue;
+        sc->gtt_cnt = 0;
 
-                        spin_lock_bh(&sc->tx.txq[i].axq_lock);
-                        ath_txq_schedule(sc, &sc->tx.txq[i]);
-                        spin_unlock_bh(&sc->tx.txq[i].axq_lock);
+        ath9k_hw_set_interrupts(ah);
+        ath9k_hw_enable_interrupts(ah);
+
+        if (!ath9k_use_chanctx)
+                ieee80211_wake_queues(sc->hw);
+        else {
+                if (sc->cur_chan == &sc->offchannel.chan)
+                        ieee80211_wake_queue(sc->hw,
+                                        sc->hw->offchannel_tx_hw_queue);
+                else {
+                        for (i = 0; i < IEEE80211_NUM_ACS; i++)
+                                ieee80211_wake_queue(sc->hw,
+                                        sc->cur_chan->hw_queue_base + i);
                 }
+                if (ah->opmode == NL80211_IFTYPE_AP)
+                        ieee80211_wake_queue(sc->hw, sc->hw->queues - 2);
         }
 
-        sc->gtt_cnt = 0;
-        ieee80211_wake_queues(sc->hw);
-
         ath9k_p2p_ps_timer(sc);
 
         return true;
 }
 
-static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan)
+int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan)
 {
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
@@ -279,9 +301,9 @@ static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan)
         tasklet_disable(&sc->intr_tq);
         spin_lock_bh(&sc->sc_pcu_lock);
 
-        if (!(sc->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)) {
+        if (!sc->cur_chan->offchannel) {
                 fastcc = false;
-                caldata = &sc->caldata;
+                caldata = &sc->cur_chan->caldata;
         }
 
         if (!hchan) {
@@ -292,6 +314,10 @@ static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan)
         if (!ath_prepare_reset(sc))
                 fastcc = false;
 
+        spin_lock_bh(&sc->chan_lock);
+        sc->cur_chandef = sc->cur_chan->chandef;
+        spin_unlock_bh(&sc->chan_lock);
+
         ath_dbg(common, CONFIG, "Reset to %u MHz, HT40: %d fastcc: %d\n",
                 hchan->channel, IS_CHAN_HT40(hchan), fastcc);
 
@@ -307,7 +333,7 @@ static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan)
         }
 
         if (ath9k_hw_mci_is_enabled(sc->sc_ah) &&
-            (sc->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL))
+            sc->cur_chan->offchannel)
                 ath9k_mci_set_txpower(sc, true, false);
 
         if (!ath_complete_reset(sc, true))
@@ -320,98 +346,6 @@ out:
         return r;
 }
 
-
-/*
- * Set/change channels.  If the channel is really being changed, it's done
- * by reseting the chip.  To accomplish this we must first cleanup any pending
- * DMA, then restart stuff.
-*/
-static int ath_set_channel(struct ath_softc *sc, struct cfg80211_chan_def *chandef)
-{
-        struct ath_hw *ah = sc->sc_ah;
-        struct ath_common *common = ath9k_hw_common(ah);
-        struct ieee80211_hw *hw = sc->hw;
-        struct ath9k_channel *hchan;
-        struct ieee80211_channel *chan = chandef->chan;
-        bool offchannel;
-        int pos = chan->hw_value;
-        int old_pos = -1;
-        int r;
-
-        if (test_bit(ATH_OP_INVALID, &common->op_flags))
-                return -EIO;
-
-        offchannel = !!(hw->conf.flags & IEEE80211_CONF_OFFCHANNEL);
-
-        if (ah->curchan)
-                old_pos = ah->curchan - &ah->channels[0];
-
-        ath_dbg(common, CONFIG, "Set channel: %d MHz width: %d\n",
-                chan->center_freq, chandef->width);
-
-        /* update survey stats for the old channel before switching */
-        spin_lock_bh(&common->cc_lock);
-        ath_update_survey_stats(sc);
-        spin_unlock_bh(&common->cc_lock);
-
-        ath9k_cmn_get_channel(hw, ah, chandef);
-
-        /*
-         * If the operating channel changes, change the survey in-use flags
-         * along with it.
-         * Reset the survey data for the new channel, unless we're switching
-         * back to the operating channel from an off-channel operation.
-         */
-        if (!offchannel && sc->cur_survey != &sc->survey[pos]) {
-                if (sc->cur_survey)
-                        sc->cur_survey->filled &= ~SURVEY_INFO_IN_USE;
-
-                sc->cur_survey = &sc->survey[pos];
-
-                memset(sc->cur_survey, 0, sizeof(struct survey_info));
-                sc->cur_survey->filled |= SURVEY_INFO_IN_USE;
-        } else if (!(sc->survey[pos].filled & SURVEY_INFO_IN_USE)) {
-                memset(&sc->survey[pos], 0, sizeof(struct survey_info));
-        }
-
-        hchan = &sc->sc_ah->channels[pos];
-        r = ath_reset_internal(sc, hchan);
-        if (r)
-                return r;
-
-        /*
-         * The most recent snapshot of channel->noisefloor for the old
-         * channel is only available after the hardware reset. Copy it to
-         * the survey stats now.
-         */
-        if (old_pos >= 0)
-                ath_update_survey_nf(sc, old_pos);
-
-        /*
-         * Enable radar pulse detection if on a DFS channel. Spectral
-         * scanning and radar detection can not be used concurrently.
-         */
-        if (hw->conf.radar_enabled) {
-                u32 rxfilter;
-
-                /* set HW specific DFS configuration */
-                ath9k_hw_set_radar_params(ah);
-                rxfilter = ath9k_hw_getrxfilter(ah);
-                rxfilter |= ATH9K_RX_FILTER_PHYRADAR |
-                                ATH9K_RX_FILTER_PHYERR;
-                ath9k_hw_setrxfilter(ah, rxfilter);
-                ath_dbg(common, DFS, "DFS enabled at freq %d\n",
-                        chan->center_freq);
-        } else {
-                /* perform spectral scan if requested. */
-                if (test_bit(ATH_OP_SCANNING, &common->op_flags) &&
-                        sc->spectral_mode == SPECTRAL_CHANSCAN)
-                        ath9k_spectral_scan_trigger(hw);
-        }
-
-        return 0;
-}
-
 static void ath_node_attach(struct ath_softc *sc, struct ieee80211_sta *sta,
                             struct ieee80211_vif *vif)
 {
@@ -712,7 +646,8 @@ static int ath9k_start(struct ieee80211_hw *hw)
         struct ath_softc *sc = hw->priv;
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
-        struct ieee80211_channel *curchan = hw->conf.chandef.chan;
+        struct ieee80211_channel *curchan = sc->cur_chan->chandef.chan;
+        struct ath_chanctx *ctx = sc->cur_chan;
         struct ath9k_channel *init_channel;
         int r;
 
@@ -723,7 +658,8 @@ static int ath9k_start(struct ieee80211_hw *hw)
         ath9k_ps_wakeup(sc);
         mutex_lock(&sc->mutex);
 
-        init_channel = ath9k_cmn_get_channel(hw, ah, &hw->conf.chandef);
+        init_channel = ath9k_cmn_get_channel(hw, ah, &ctx->chandef);
+        sc->cur_chandef = hw->conf.chandef;
 
         /* Reset SERDES registers */
         ath9k_hw_configpcipowersave(ah, false);
@@ -886,6 +822,7 @@ static void ath9k_stop(struct ieee80211_hw *hw)
         struct ath_common *common = ath9k_hw_common(ah);
         bool prev_idle;
 
+        cancel_work_sync(&sc->chanctx_work);
         mutex_lock(&sc->mutex);
 
         ath_cancel_work(sc);
@@ -934,7 +871,8 @@ static void ath9k_stop(struct ieee80211_hw *hw)
         }
 
         if (!ah->curchan)
-                ah->curchan = ath9k_cmn_get_channel(hw, ah, &hw->conf.chandef);
+                ah->curchan = ath9k_cmn_get_channel(hw, ah,
+                                                    &sc->cur_chan->chandef);
 
         ath9k_hw_reset(ah, ah->curchan, ah->caldata, false);
         ath9k_hw_phy_disable(ah);
@@ -979,18 +917,29 @@ static void ath9k_vif_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
                 iter_data->has_hw_macaddr = true;
         }
 
+        if (!vif->bss_conf.use_short_slot)
+                iter_data->slottime = ATH9K_SLOT_TIME_20;
+
         switch (vif->type) {
         case NL80211_IFTYPE_AP:
                 iter_data->naps++;
+                if (vif->bss_conf.enable_beacon)
+                        iter_data->beacons = true;
                 break;
         case NL80211_IFTYPE_STATION:
                 iter_data->nstations++;
+                if (vif->bss_conf.assoc && !iter_data->primary_sta)
+                        iter_data->primary_sta = vif;
                 break;
         case NL80211_IFTYPE_ADHOC:
                 iter_data->nadhocs++;
+                if (vif->bss_conf.enable_beacon)
+                        iter_data->beacons = true;
                 break;
         case NL80211_IFTYPE_MESH_POINT:
                 iter_data->nmeshes++;
+                if (vif->bss_conf.enable_beacon)
+                        iter_data->beacons = true;
                 break;
         case NL80211_IFTYPE_WDS:
                 iter_data->nwds++;
@@ -1000,26 +949,12 @@ static void ath9k_vif_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
         }
 }
 
-static void ath9k_sta_vif_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
-{
-        struct ath_softc *sc = data;
-        struct ath_vif *avp = (void *)vif->drv_priv;
-
-        if (vif->type != NL80211_IFTYPE_STATION)
-                return;
-
-        if (avp->primary_sta_vif)
-                ath9k_set_assoc_state(sc, vif);
-}
-
 /* Called with sc->mutex held. */
-void ath9k_calculate_iter_data(struct ieee80211_hw *hw,
-                               struct ieee80211_vif *vif,
+void ath9k_calculate_iter_data(struct ath_softc *sc,
+                               struct ath_chanctx *ctx,
                                struct ath9k_vif_iter_data *iter_data)
 {
-        struct ath_softc *sc = hw->priv;
-        struct ath_hw *ah = sc->sc_ah;
-        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath_vif *avp;
 
         /*
          * Pick the MAC address of the first interface as the new hardware
@@ -1028,29 +963,80 @@ void ath9k_calculate_iter_data(struct ieee80211_hw *hw,
          */
         memset(iter_data, 0, sizeof(*iter_data));
         memset(&iter_data->mask, 0xff, ETH_ALEN);
+        iter_data->slottime = ATH9K_SLOT_TIME_9;
+
+        list_for_each_entry(avp, &ctx->vifs, list)
+                ath9k_vif_iter(iter_data, avp->vif->addr, avp->vif);
+
+        if (ctx == &sc->offchannel.chan) {
+                struct ieee80211_vif *vif;
+
+                if (sc->offchannel.state < ATH_OFFCHANNEL_ROC_START)
+                        vif = sc->offchannel.scan_vif;
+                else
+                        vif = sc->offchannel.roc_vif;
+
+                if (vif)
+                        ath9k_vif_iter(iter_data, vif->addr, vif);
+                iter_data->beacons = false;
+        }
+}
+
+static void ath9k_set_assoc_state(struct ath_softc *sc,
+                                  struct ieee80211_vif *vif, bool changed)
+{
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        struct ieee80211_bss_conf *bss_conf = &vif->bss_conf;
+        unsigned long flags;
 
-        if (vif)
-                ath9k_vif_iter(iter_data, vif->addr, vif);
+        set_bit(ATH_OP_PRIM_STA_VIF, &common->op_flags);
+        /* Set the AID, BSSID and do beacon-sync only when
+         * the HW opmode is STATION.
+         *
+         * But the primary bit is set above in any case.
+         */
+        if (sc->sc_ah->opmode != NL80211_IFTYPE_STATION)
+                return;
+
+        ether_addr_copy(common->curbssid, bss_conf->bssid);
+        common->curaid = bss_conf->aid;
+        ath9k_hw_write_associd(sc->sc_ah);
 
-        /* Get list of all active MAC addresses */
-        ieee80211_iterate_active_interfaces_atomic(
-                sc->hw, IEEE80211_IFACE_ITER_RESUME_ALL,
-                ath9k_vif_iter, iter_data);
+        if (changed) {
+                common->last_rssi = ATH_RSSI_DUMMY_MARKER;
+                sc->sc_ah->stats.avgbrssi = ATH_RSSI_DUMMY_MARKER;
 
-        memcpy(common->macaddr, iter_data->hw_macaddr, ETH_ALEN);
+                spin_lock_irqsave(&sc->sc_pm_lock, flags);
+                sc->ps_flags |= PS_BEACON_SYNC | PS_WAIT_FOR_BEACON;
+                spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
+        }
+
+        if (ath9k_hw_mci_is_enabled(sc->sc_ah))
+                ath9k_mci_update_wlan_channels(sc, false);
+
+        ath_dbg(common, CONFIG,
+                "Primary Station interface: %pM, BSSID: %pM\n",
+                vif->addr, common->curbssid);
 }
 
 /* Called with sc->mutex held. */
-static void ath9k_calculate_summary_state(struct ieee80211_hw *hw,
-                                          struct ieee80211_vif *vif)
+void ath9k_calculate_summary_state(struct ath_softc *sc,
+                                   struct ath_chanctx *ctx)
 {
-        struct ath_softc *sc = hw->priv;
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_vif_iter_data iter_data;
-        enum nl80211_iftype old_opmode = ah->opmode;
 
-        ath9k_calculate_iter_data(hw, vif, &iter_data);
+        ath_chanctx_check_active(sc, ctx);
+
+        if (ctx != sc->cur_chan)
+                return;
+
+        ath9k_ps_wakeup(sc);
+        ath9k_calculate_iter_data(sc, ctx, &iter_data);
+
+        if (iter_data.has_hw_macaddr)
+                ether_addr_copy(common->macaddr, iter_data.hw_macaddr);
 
         memcpy(common->bssidmask, iter_data.mask, ETH_ALEN);
         ath_hw_setbssidmask(common);
@@ -1073,24 +1059,57 @@ static void ath9k_calculate_summary_state(struct ieee80211_hw *hw,
 
         ath9k_hw_setopmode(ah);
 
+        ctx->switch_after_beacon = false;
         if ((iter_data.nstations + iter_data.nadhocs + iter_data.nmeshes) > 0)
                 ah->imask |= ATH9K_INT_TSFOOR;
-        else
+        else {
                 ah->imask &= ~ATH9K_INT_TSFOOR;
+                if (iter_data.naps == 1 && iter_data.beacons)
+                        ctx->switch_after_beacon = true;
+        }
+
+        ah->imask &= ~ATH9K_INT_SWBA;
+        if (ah->opmode == NL80211_IFTYPE_STATION) {
+                bool changed = (iter_data.primary_sta != ctx->primary_sta);
 
+                iter_data.beacons = true;
+                if (iter_data.primary_sta) {
+                        ath9k_set_assoc_state(sc, iter_data.primary_sta,
+                                              changed);
+                        if (!ctx->primary_sta ||
+                            !ctx->primary_sta->bss_conf.assoc)
+                                ctx->primary_sta = iter_data.primary_sta;
+                } else {
+                        ctx->primary_sta = NULL;
+                        memset(common->curbssid, 0, ETH_ALEN);
+                        common->curaid = 0;
+                        ath9k_hw_write_associd(sc->sc_ah);
+                        if (ath9k_hw_mci_is_enabled(sc->sc_ah))
+                                ath9k_mci_update_wlan_channels(sc, true);
+                }
+        } else if (iter_data.beacons) {
+                ah->imask |= ATH9K_INT_SWBA;
+        }
         ath9k_hw_set_interrupts(ah);
 
-        /*
-         * If we are changing the opmode to STATION,
-         * a beacon sync needs to be done.
-         */
-        if (ah->opmode == NL80211_IFTYPE_STATION &&
-            old_opmode == NL80211_IFTYPE_AP &&
-            test_bit(ATH_OP_PRIM_STA_VIF, &common->op_flags)) {
-                ieee80211_iterate_active_interfaces_atomic(
-                        sc->hw, IEEE80211_IFACE_ITER_RESUME_ALL,
-                        ath9k_sta_vif_iter, sc);
+        if (iter_data.beacons)
+                set_bit(ATH_OP_BEACONS, &common->op_flags);
+        else
+                clear_bit(ATH_OP_BEACONS, &common->op_flags);
+
+        if (ah->slottime != iter_data.slottime) {
+                ah->slottime = iter_data.slottime;
+                ath9k_hw_init_global_settings(ah);
         }
+
+        if (iter_data.primary_sta)
+                set_bit(ATH_OP_PRIM_STA_VIF, &common->op_flags);
+        else
+                clear_bit(ATH_OP_PRIM_STA_VIF, &common->op_flags);
+
+        ctx->primary_sta = iter_data.primary_sta;
+
+        ath9k_ps_restore(sc);
 }
 
 static int ath9k_add_interface(struct ieee80211_hw *hw,
@@ -1101,6 +1120,7 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
         struct ath_common *common = ath9k_hw_common(ah);
         struct ath_vif *avp = (void *)vif->drv_priv;
         struct ath_node *an = &avp->mcast_node;
+        int i;
 
         mutex_lock(&sc->mutex);
 
@@ -1115,14 +1135,20 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
         ath_dbg(common, CONFIG, "Attach a VIF of type: %d\n", vif->type);
         sc->nvifs++;
 
-        ath9k_ps_wakeup(sc);
-        ath9k_calculate_summary_state(hw, vif);
-        ath9k_ps_restore(sc);
-
         if (ath9k_uses_beacons(vif->type))
                 ath9k_beacon_assign_slot(sc, vif);
 
         avp->vif = vif;
+        if (!ath9k_use_chanctx) {
+                avp->chanctx = sc->cur_chan;
+                list_add_tail(&avp->list, &avp->chanctx->vifs);
+        }
+        for (i = 0; i < IEEE80211_NUM_ACS; i++)
+                vif->hw_queue[i] = i;
+        if (vif->type == NL80211_IFTYPE_AP)
+                vif->cab_queue = hw->queues - 2;
+        else
+                vif->cab_queue = IEEE80211_INVAL_HW_QUEUE;
 
         an->sc = sc;
         an->sta = NULL;
@@ -1141,6 +1167,8 @@ static int ath9k_change_interface(struct ieee80211_hw *hw,
 {
         struct ath_softc *sc = hw->priv;
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        struct ath_vif *avp = (void *)vif->drv_priv;
+        int i;
 
         mutex_lock(&sc->mutex);
 
@@ -1157,13 +1185,19 @@ static int ath9k_change_interface(struct ieee80211_hw *hw,
         vif->type = new_type;
         vif->p2p = p2p;
 
-        ath9k_ps_wakeup(sc);
-        ath9k_calculate_summary_state(hw, vif);
-        ath9k_ps_restore(sc);
-
         if (ath9k_uses_beacons(vif->type))
                 ath9k_beacon_assign_slot(sc, vif);
 
+        for (i = 0; i < IEEE80211_NUM_ACS; i++)
+                vif->hw_queue[i] = i;
+
+        if (vif->type == NL80211_IFTYPE_AP)
+                vif->cab_queue = hw->queues - 2;
+        else
+                vif->cab_queue = IEEE80211_INVAL_HW_QUEUE;
+
+        ath9k_calculate_summary_state(sc, avp->chanctx);
+
         mutex_unlock(&sc->mutex);
         return 0;
 }
@@ -1211,14 +1245,12 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
 
         sc->nvifs--;
         sc->tx99_vif = NULL;
+        if (!ath9k_use_chanctx)
+                list_del(&avp->list);
 
         if (ath9k_uses_beacons(vif->type))
                 ath9k_beacon_remove_slot(sc, vif);
 
-        ath9k_ps_wakeup(sc);
-        ath9k_calculate_summary_state(hw, NULL);
-        ath9k_ps_restore(sc);
-
         ath_tx_node_cleanup(sc, &avp->mcast_node);
 
         mutex_unlock(&sc->mutex);
@@ -1345,7 +1377,7 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
         struct ieee80211_conf *conf = &hw->conf;
-        bool reset_channel = false;
+        struct ath_chanctx *ctx = sc->cur_chan;
 
         ath9k_ps_wakeup(sc);
         mutex_lock(&sc->mutex);
@@ -1361,7 +1393,7 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
                          * The chip needs a reset to properly wake up from
                          * full sleep
                          */
-                        reset_channel = ah->chip_fullsleep;
+                        ath_chanctx_set_channel(sc, ctx, &ctx->chandef);
                 }
         }
 
@@ -1391,20 +1423,16 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
                 }
         }
 
-        if ((changed & IEEE80211_CONF_CHANGE_CHANNEL) || reset_channel) {
-                if (ath_set_channel(sc, &hw->conf.chandef) < 0) {
-                        ath_err(common, "Unable to set channel\n");
-                        mutex_unlock(&sc->mutex);
-                        ath9k_ps_restore(sc);
-                        return -EINVAL;
-                }
+        if (!ath9k_use_chanctx && (changed & IEEE80211_CONF_CHANGE_CHANNEL)) {
+                ctx->offchannel = !!(conf->flags & IEEE80211_CONF_OFFCHANNEL);
+                ath_chanctx_set_channel(sc, ctx, &hw->conf.chandef);
         }
 
         if (changed & IEEE80211_CONF_CHANGE_POWER) {
                 ath_dbg(common, CONFIG, "Set power: %d\n", conf->power_level);
-                sc->config.txpowlimit = 2 * conf->power_level;
+                sc->cur_chan->txpower = 2 * conf->power_level;
                 ath9k_cmn_update_txpow(ah, sc->curtxpow,
-                                       sc->config.txpowlimit, &sc->curtxpow);
+                                       sc->cur_chan->txpower, &sc->curtxpow);
         }
 
         mutex_unlock(&sc->mutex);
@@ -1659,58 +1687,6 @@ static int ath9k_set_key(struct ieee80211_hw *hw,
         return ret;
 }
 
-static void ath9k_set_assoc_state(struct ath_softc *sc,
-                                  struct ieee80211_vif *vif)
-{
-        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        struct ath_vif *avp = (void *)vif->drv_priv;
-        struct ieee80211_bss_conf *bss_conf = &vif->bss_conf;
-        unsigned long flags;
-
-        set_bit(ATH_OP_PRIM_STA_VIF, &common->op_flags);
-        avp->primary_sta_vif = true;
-
-        /*
-         * Set the AID, BSSID and do beacon-sync only when
-         * the HW opmode is STATION.
-         *
-         * But the primary bit is set above in any case.
-         */
-        if (sc->sc_ah->opmode != NL80211_IFTYPE_STATION)
-                return;
-
-        memcpy(common->curbssid, bss_conf->bssid, ETH_ALEN);
-        common->curaid = bss_conf->aid;
-        ath9k_hw_write_associd(sc->sc_ah);
-
-        common->last_rssi = ATH_RSSI_DUMMY_MARKER;
-        sc->sc_ah->stats.avgbrssi = ATH_RSSI_DUMMY_MARKER;
-
-        spin_lock_irqsave(&sc->sc_pm_lock, flags);
-        sc->ps_flags |= PS_BEACON_SYNC | PS_WAIT_FOR_BEACON;
-        spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
-
-        if (ath9k_hw_mci_is_enabled(sc->sc_ah))
-                ath9k_mci_update_wlan_channels(sc, false);
-
-        ath_dbg(common, CONFIG,
-                "Primary Station interface: %pM, BSSID: %pM\n",
-                vif->addr, common->curbssid);
-}
-
-static void ath9k_bss_assoc_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
-{
-        struct ath_softc *sc = data;
-        struct ieee80211_bss_conf *bss_conf = &vif->bss_conf;
-        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-
-        if (test_bit(ATH_OP_PRIM_STA_VIF, &common->op_flags))
-                return;
-
-        if (bss_conf->assoc)
-                ath9k_set_assoc_state(sc, vif);
-}
-
 void ath9k_p2p_ps_timer(void *priv)
 {
         struct ath_softc *sc = priv;
@@ -1720,7 +1696,11 @@ void ath9k_p2p_ps_timer(void *priv)
         struct ath_node *an;
         u32 tsf;
 
-        if (!avp)
+        del_timer_sync(&sc->sched.timer);
+        ath9k_hw_gen_timer_stop(sc->sc_ah, sc->p2p_ps_timer);
+        ath_chanctx_event(sc, NULL, ATH_CHANCTX_EVENT_TSF_TIMER);
+
+        if (!avp || avp->chanctx != sc->cur_chan)
                 return;
 
         tsf = ath9k_hw_gettsf32(sc->sc_ah);
@@ -1795,26 +1775,9 @@ static void ath9k_bss_info_changed(struct ieee80211_hw *hw,
                 ath_dbg(common, CONFIG, "BSSID %pM Changed ASSOC %d\n",
                         bss_conf->bssid, bss_conf->assoc);
 
-                if (avp->primary_sta_vif && !bss_conf->assoc) {
-                        clear_bit(ATH_OP_PRIM_STA_VIF, &common->op_flags);
-                        avp->primary_sta_vif = false;
-
-                        if (ah->opmode == NL80211_IFTYPE_STATION)
-                                clear_bit(ATH_OP_BEACONS, &common->op_flags);
-                }
-
-                ieee80211_iterate_active_interfaces_atomic(
-                        sc->hw, IEEE80211_IFACE_ITER_RESUME_ALL,
-                        ath9k_bss_assoc_iter, sc);
-
-                if (!test_bit(ATH_OP_PRIM_STA_VIF, &common->op_flags) &&
-                    ah->opmode == NL80211_IFTYPE_STATION) {
-                        memset(common->curbssid, 0, ETH_ALEN);
-                        common->curaid = 0;
-                        ath9k_hw_write_associd(sc->sc_ah);
-                        if (ath9k_hw_mci_is_enabled(sc->sc_ah))
-                                ath9k_mci_update_wlan_channels(sc, true);
-                }
+                ath9k_calculate_summary_state(sc, avp->chanctx);
+                if (bss_conf->assoc)
+                        ath_chanctx_event(sc, vif, ATH_CHANCTX_EVENT_ASSOC);
         }
 
         if (changed & BSS_CHANGED_IBSS) {
@@ -1824,10 +1787,15 @@ static void ath9k_bss_info_changed(struct ieee80211_hw *hw,
         }
 
         if ((changed & BSS_CHANGED_BEACON_ENABLED) ||
-            (changed & BSS_CHANGED_BEACON_INT))
+            (changed & BSS_CHANGED_BEACON_INT) ||
+            (changed & BSS_CHANGED_BEACON_INFO)) {
+                if (changed & BSS_CHANGED_BEACON_ENABLED)
+                        ath9k_calculate_summary_state(sc, avp->chanctx);
                 ath9k_beacon_config(sc, vif, changed);
+        }
 
-        if (changed & BSS_CHANGED_ERP_SLOT) {
+        if ((avp->chanctx == sc->cur_chan) &&
+            (changed & BSS_CHANGED_ERP_SLOT)) {
                 if (bss_conf->use_short_slot)
                         slottime = 9;
                 else
@@ -2032,23 +2000,30 @@ static void ath9k_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                         u32 queues, bool drop)
 {
         struct ath_softc *sc = hw->priv;
+
+        mutex_lock(&sc->mutex);
+        __ath9k_flush(hw, queues, drop);
+        mutex_unlock(&sc->mutex);
+}
+
+void __ath9k_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+{
+        struct ath_softc *sc = hw->priv;
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
         int timeout = HZ / 5; /* 200 ms */
         bool drain_txq;
+        int i;
 
-        mutex_lock(&sc->mutex);
         cancel_delayed_work_sync(&sc->tx_complete_work);
 
         if (ah->ah_flags & AH_UNPLUGGED) {
                 ath_dbg(common, ANY, "Device has been unplugged!\n");
-                mutex_unlock(&sc->mutex);
                 return;
         }
 
         if (test_bit(ATH_OP_INVALID, &common->op_flags)) {
                 ath_dbg(common, ANY, "Device not present\n");
-                mutex_unlock(&sc->mutex);
                 return;
         }
 
@@ -2066,11 +2041,13 @@ static void ath9k_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                         ath_reset(sc);
 
                 ath9k_ps_restore(sc);
-                ieee80211_wake_queues(hw);
+                for (i = 0; i < IEEE80211_NUM_ACS; i++) {
+                        ieee80211_wake_queue(sc->hw,
+                                             sc->cur_chan->hw_queue_base + i);
+                }
         }
 
         ieee80211_queue_delayed_work(hw, &sc->tx_complete_work, 0);
-        mutex_unlock(&sc->mutex);
 }
 
 static bool ath9k_tx_frames_pending(struct ieee80211_hw *hw)
@@ -2230,6 +2207,403 @@ static void ath9k_sw_scan_complete(struct ieee80211_hw *hw)
         clear_bit(ATH_OP_SCANNING, &common->op_flags);
 }
 
+static int ath_scan_channel_duration(struct ath_softc *sc,
+                                     struct ieee80211_channel *chan)
+{
+        struct cfg80211_scan_request *req = sc->offchannel.scan_req;
+
+        if (!req->n_ssids || (chan->flags & IEEE80211_CHAN_NO_IR))
+                return (HZ / 9); /* ~110 ms */
+
+        return (HZ / 16); /* ~60 ms */
+}
+
+static void
+ath_scan_next_channel(struct ath_softc *sc)
+{
+        struct cfg80211_scan_request *req = sc->offchannel.scan_req;
+        struct ieee80211_channel *chan;
+
+        if (sc->offchannel.scan_idx >= req->n_channels) {
+                sc->offchannel.state = ATH_OFFCHANNEL_IDLE;
+                ath_chanctx_switch(sc, ath_chanctx_get_oper_chan(sc, false),
+                                   NULL);
+                return;
+        }
+
+        chan = req->channels[sc->offchannel.scan_idx++];
+        sc->offchannel.duration = ath_scan_channel_duration(sc, chan);
+        sc->offchannel.state = ATH_OFFCHANNEL_PROBE_SEND;
+        ath_chanctx_offchan_switch(sc, chan);
+}
+
+static void ath_offchannel_next(struct ath_softc *sc)
+{
+        struct ieee80211_vif *vif;
+
+        if (sc->offchannel.scan_req) {
+                vif = sc->offchannel.scan_vif;
+                sc->offchannel.chan.txpower = vif->bss_conf.txpower;
+                ath_scan_next_channel(sc);
+        } else if (sc->offchannel.roc_vif) {
+                vif = sc->offchannel.roc_vif;
+                sc->offchannel.chan.txpower = vif->bss_conf.txpower;
+                sc->offchannel.duration = sc->offchannel.roc_duration;
+                sc->offchannel.state = ATH_OFFCHANNEL_ROC_START;
+                ath_chanctx_offchan_switch(sc, sc->offchannel.roc_chan);
+        } else {
+                ath_chanctx_switch(sc, ath_chanctx_get_oper_chan(sc, false),
+                                   NULL);
+                sc->offchannel.state = ATH_OFFCHANNEL_IDLE;
+                if (sc->ps_idle)
+                        ath_cancel_work(sc);
+        }
+}
+
+static void ath_roc_complete(struct ath_softc *sc, bool abort)
+{
+        sc->offchannel.roc_vif = NULL;
+        sc->offchannel.roc_chan = NULL;
+        if (!abort)
+                ieee80211_remain_on_channel_expired(sc->hw);
+        ath_offchannel_next(sc);
+        ath9k_ps_restore(sc);
+}
+
+static void ath_scan_complete(struct ath_softc *sc, bool abort)
+{
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+
+        sc->offchannel.scan_req = NULL;
+        sc->offchannel.scan_vif = NULL;
+        sc->offchannel.state = ATH_OFFCHANNEL_IDLE;
+        ieee80211_scan_completed(sc->hw, abort);
+        clear_bit(ATH_OP_SCANNING, &common->op_flags);
+        ath_offchannel_next(sc);
+        ath9k_ps_restore(sc);
+}
+
+static void ath_scan_send_probe(struct ath_softc *sc,
+                                struct cfg80211_ssid *ssid)
+{
+        struct cfg80211_scan_request *req = sc->offchannel.scan_req;
+        struct ieee80211_vif *vif = sc->offchannel.scan_vif;
+        struct ath_tx_control txctl = {};
+        struct sk_buff *skb;
+        struct ieee80211_tx_info *info;
+        int band = sc->offchannel.chan.chandef.chan->band;
+
+        skb = ieee80211_probereq_get(sc->hw, vif,
+                        ssid->ssid, ssid->ssid_len, req->ie_len);
+        if (!skb)
+                return;
+
+        info = IEEE80211_SKB_CB(skb);
+        if (req->no_cck)
+                info->flags |= IEEE80211_TX_CTL_NO_CCK_RATE;
+
+        if (req->ie_len)
+                memcpy(skb_put(skb, req->ie_len), req->ie, req->ie_len);
+
+        skb_set_queue_mapping(skb, IEEE80211_AC_VO);
+
+        if (!ieee80211_tx_prepare_skb(sc->hw, vif, skb, band, NULL))
+                goto error;
+
+        txctl.txq = sc->tx.txq_map[IEEE80211_AC_VO];
+        txctl.force_channel = true;
+        if (ath_tx_start(sc->hw, skb, &txctl))
+                goto error;
+
+        return;
+
+error:
+        ieee80211_free_txskb(sc->hw, skb);
+}
+
+static void ath_scan_channel_start(struct ath_softc *sc)
+{
+        struct cfg80211_scan_request *req = sc->offchannel.scan_req;
+        int i;
+
+        if (!(sc->cur_chan->chandef.chan->flags & IEEE80211_CHAN_NO_IR) &&
+            req->n_ssids) {
+                for (i = 0; i < req->n_ssids; i++)
+                        ath_scan_send_probe(sc, &req->ssids[i]);
+
+        }
+
+        sc->offchannel.state = ATH_OFFCHANNEL_PROBE_WAIT;
+        mod_timer(&sc->offchannel.timer, jiffies + sc->offchannel.duration);
+}
+
+void ath_offchannel_channel_change(struct ath_softc *sc)
+{
+        switch (sc->offchannel.state) {
+        case ATH_OFFCHANNEL_PROBE_SEND:
+                if (!sc->offchannel.scan_req)
+                        return;
+
+                if (sc->cur_chan->chandef.chan !=
+                    sc->offchannel.chan.chandef.chan)
+                        return;
+
+                ath_scan_channel_start(sc);
+                break;
+        case ATH_OFFCHANNEL_IDLE:
+                if (!sc->offchannel.scan_req)
+                        return;
+
+                ath_scan_complete(sc, false);
+                break;
+        case ATH_OFFCHANNEL_ROC_START:
+                if (sc->cur_chan != &sc->offchannel.chan)
+                        break;
+
+                sc->offchannel.state = ATH_OFFCHANNEL_ROC_WAIT;
+                mod_timer(&sc->offchannel.timer, jiffies +
+                          msecs_to_jiffies(sc->offchannel.duration));
+                ieee80211_ready_on_channel(sc->hw);
+                break;
+        case ATH_OFFCHANNEL_ROC_DONE:
+                ath_roc_complete(sc, false);
+                break;
+        default:
+                break;
+        }
+}
+
+void ath_offchannel_timer(unsigned long data)
+{
+        struct ath_softc *sc = (struct ath_softc *)data;
+        struct ath_chanctx *ctx;
+
+        switch (sc->offchannel.state) {
+        case ATH_OFFCHANNEL_PROBE_WAIT:
+                if (!sc->offchannel.scan_req)
+                        return;
+
+                /* get first active channel context */
+                ctx = ath_chanctx_get_oper_chan(sc, true);
+                if (ctx->active) {
+                        sc->offchannel.state = ATH_OFFCHANNEL_SUSPEND;
+                        ath_chanctx_switch(sc, ctx, NULL);
+                        mod_timer(&sc->offchannel.timer, jiffies + HZ / 10);
+                        break;
+                }
+                /* fall through */
+        case ATH_OFFCHANNEL_SUSPEND:
+                if (!sc->offchannel.scan_req)
+                        return;
+
+                ath_scan_next_channel(sc);
+                break;
+        case ATH_OFFCHANNEL_ROC_START:
+        case ATH_OFFCHANNEL_ROC_WAIT:
+                ctx = ath_chanctx_get_oper_chan(sc, false);
+                sc->offchannel.state = ATH_OFFCHANNEL_ROC_DONE;
+                ath_chanctx_switch(sc, ctx, NULL);
+                break;
+        default:
+                break;
+        }
+}
+
+static int ath9k_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                         struct ieee80211_scan_request *hw_req)
+{
+        struct cfg80211_scan_request *req = &hw_req->req;
+        struct ath_softc *sc = hw->priv;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        int ret = 0;
+
+        mutex_lock(&sc->mutex);
+
+        if (WARN_ON(sc->offchannel.scan_req)) {
+                ret = -EBUSY;
+                goto out;
+        }
+
+        ath9k_ps_wakeup(sc);
+        set_bit(ATH_OP_SCANNING, &common->op_flags);
+        sc->offchannel.scan_vif = vif;
+        sc->offchannel.scan_req = req;
+        sc->offchannel.scan_idx = 0;
+
+        if (sc->offchannel.state == ATH_OFFCHANNEL_IDLE)
+                ath_offchannel_next(sc);
+
+out:
+        mutex_unlock(&sc->mutex);
+
+        return ret;
+}
+
+static void ath9k_cancel_hw_scan(struct ieee80211_hw *hw,
+                                 struct ieee80211_vif *vif)
+{
+        struct ath_softc *sc = hw->priv;
+
+        mutex_lock(&sc->mutex);
+        del_timer_sync(&sc->offchannel.timer);
+        ath_scan_complete(sc, true);
+        mutex_unlock(&sc->mutex);
+}
+
+static int ath9k_remain_on_channel(struct ieee80211_hw *hw,
+                                   struct ieee80211_vif *vif,
+                                   struct ieee80211_channel *chan, int duration,
+                                   enum ieee80211_roc_type type)
+{
+        struct ath_softc *sc = hw->priv;
+        int ret = 0;
+
+        mutex_lock(&sc->mutex);
+
+        if (WARN_ON(sc->offchannel.roc_vif)) {
+                ret = -EBUSY;
+                goto out;
+        }
+
+        ath9k_ps_wakeup(sc);
+        sc->offchannel.roc_vif = vif;
+        sc->offchannel.roc_chan = chan;
+        sc->offchannel.roc_duration = duration;
+
+        if (sc->offchannel.state == ATH_OFFCHANNEL_IDLE)
+                ath_offchannel_next(sc);
+
+out:
+        mutex_unlock(&sc->mutex);
+
+        return ret;
+}
+
+static int ath9k_cancel_remain_on_channel(struct ieee80211_hw *hw)
+{
+        struct ath_softc *sc = hw->priv;
+
+        mutex_lock(&sc->mutex);
+
+        del_timer_sync(&sc->offchannel.timer);
+
+        if (sc->offchannel.roc_vif) {
+                if (sc->offchannel.state >= ATH_OFFCHANNEL_ROC_START)
+                        ath_roc_complete(sc, true);
+        }
+
+        mutex_unlock(&sc->mutex);
+
+        return 0;
+}
+
+static int ath9k_add_chanctx(struct ieee80211_hw *hw,
+                             struct ieee80211_chanctx_conf *conf)
+{
+        struct ath_softc *sc = hw->priv;
+        struct ath_chanctx *ctx, **ptr;
+        int pos;
+
+        mutex_lock(&sc->mutex);
+
+        ath_for_each_chanctx(sc, ctx) {
+                if (ctx->assigned)
+                        continue;
+
+                ptr = (void *) conf->drv_priv;
+                *ptr = ctx;
+                ctx->assigned = true;
+                pos = ctx - &sc->chanctx[0];
+                ctx->hw_queue_base = pos * IEEE80211_NUM_ACS;
+                ath_chanctx_set_channel(sc, ctx, &conf->def);
+                mutex_unlock(&sc->mutex);
+                return 0;
+        }
+        mutex_unlock(&sc->mutex);
+        return -ENOSPC;
+}
+
+
+static void ath9k_remove_chanctx(struct ieee80211_hw *hw,
+                                 struct ieee80211_chanctx_conf *conf)
+{
+        struct ath_softc *sc = hw->priv;
+        struct ath_chanctx *ctx = ath_chanctx_get(conf);
+
+        mutex_lock(&sc->mutex);
+        ctx->assigned = false;
+        ctx->hw_queue_base = -1;
+        ath_chanctx_event(sc, NULL, ATH_CHANCTX_EVENT_UNASSIGN);
+        mutex_unlock(&sc->mutex);
+}
+
+static void ath9k_change_chanctx(struct ieee80211_hw *hw,
+                                 struct ieee80211_chanctx_conf *conf,
+                                 u32 changed)
+{
+        struct ath_softc *sc = hw->priv;
+        struct ath_chanctx *ctx = ath_chanctx_get(conf);
+
+        mutex_lock(&sc->mutex);
+        ath_chanctx_set_channel(sc, ctx, &conf->def);
+        mutex_unlock(&sc->mutex);
+}
+
+static int ath9k_assign_vif_chanctx(struct ieee80211_hw *hw,
+                                    struct ieee80211_vif *vif,
+                                    struct ieee80211_chanctx_conf *conf)
+{
+        struct ath_softc *sc = hw->priv;
+        struct ath_vif *avp = (void *)vif->drv_priv;
+        struct ath_chanctx *ctx = ath_chanctx_get(conf);
+        int i;
+
+        mutex_lock(&sc->mutex);
+        avp->chanctx = ctx;
+        list_add_tail(&avp->list, &ctx->vifs);
+        ath9k_calculate_summary_state(sc, ctx);
+        for (i = 0; i < IEEE80211_NUM_ACS; i++)
+                vif->hw_queue[i] = ctx->hw_queue_base + i;
+        mutex_unlock(&sc->mutex);
+
+        return 0;
+}
+
+static void ath9k_unassign_vif_chanctx(struct ieee80211_hw *hw,
+                                       struct ieee80211_vif *vif,
+                                       struct ieee80211_chanctx_conf *conf)
+{
+        struct ath_softc *sc = hw->priv;
+        struct ath_vif *avp = (void *)vif->drv_priv;
+        struct ath_chanctx *ctx = ath_chanctx_get(conf);
+        int ac;
+
+        mutex_lock(&sc->mutex);
+        avp->chanctx = NULL;
+        list_del(&avp->list);
+        ath9k_calculate_summary_state(sc, ctx);
+        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
+                vif->hw_queue[ac] = IEEE80211_INVAL_HW_QUEUE;
+        mutex_unlock(&sc->mutex);
+}
+
+void ath9k_fill_chanctx_ops(void)
+{
+        if (!ath9k_use_chanctx)
+                return;
+
+        ath9k_ops.hw_scan = ath9k_hw_scan;
+        ath9k_ops.cancel_hw_scan = ath9k_cancel_hw_scan;
+        ath9k_ops.remain_on_channel  = ath9k_remain_on_channel;
+        ath9k_ops.cancel_remain_on_channel = ath9k_cancel_remain_on_channel;
+        ath9k_ops.add_chanctx        = ath9k_add_chanctx;
+        ath9k_ops.remove_chanctx     = ath9k_remove_chanctx;
+        ath9k_ops.change_chanctx     = ath9k_change_chanctx;
+        ath9k_ops.assign_vif_chanctx = ath9k_assign_vif_chanctx;
+        ath9k_ops.unassign_vif_chanctx = ath9k_unassign_vif_chanctx;
+        ath9k_ops.mgd_prepare_tx = ath9k_chanctx_force_active;
+}
+
 struct ieee80211_ops ath9k_ops = {
         .tx                 = ath9k_tx,
         .start              = ath9k_start,
diff --git a/drivers/net/wireless/ath/ath9k/mci.c b/drivers/net/wireless/ath/ath9k/mci.c
index a0dbcc412384..3f7a11edb82a 100644
--- a/drivers/net/wireless/ath/ath9k/mci.c
+++ b/drivers/net/wireless/ath/ath9k/mci.c
@@ -706,7 +706,7 @@ void ath9k_mci_set_txpower(struct ath_softc *sc, bool setchannel,
                 return;
 
         if (setchannel) {
-                struct ath9k_hw_cal_data *caldata = &sc->caldata;
+                struct ath9k_hw_cal_data *caldata = &sc->cur_chan->caldata;
                 if (IS_CHAN_HT40PLUS(ah->curchan) &&
                     (ah->curchan->channel > caldata->channel) &&
                     (ah->curchan->channel <= caldata->channel + 20))
@@ -720,7 +720,7 @@ void ath9k_mci_set_txpower(struct ath_softc *sc, bool setchannel,
                 mci_hw->concur_tx = concur_tx;
 
         if (old_concur_tx != mci_hw->concur_tx)
-                ath9k_hw_set_txpowerlimit(ah, sc->config.txpowlimit, false);
+                ath9k_hw_set_txpowerlimit(ah, sc->cur_chan->txpower, false);
 }
 
 static void ath9k_mci_stomp_audio(struct ath_softc *sc)
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index 4dec09e565ed..c018dea0b2e8 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -23,7 +23,7 @@
 #include <linux/module.h>
 #include "ath9k.h"
 
-static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
+static const struct pci_device_id ath_pci_id_table[] = {
         { PCI_VDEVICE(ATHEROS, 0x0023) }, /* PCI   */
         { PCI_VDEVICE(ATHEROS, 0x0024) }, /* PCI-E */
         { PCI_VDEVICE(ATHEROS, 0x0027) }, /* PCI   */
@@ -843,6 +843,7 @@ static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
                 return -ENODEV;
         }
 
+        ath9k_fill_chanctx_ops();
         hw = ieee80211_alloc_hw(sizeof(struct ath_softc), &ath9k_ops);
         if (!hw) {
                 dev_err(&pdev->dev, "No memory for ieee80211_hw\n");
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 9105a92364f7..74ab1d02013b 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -259,7 +259,7 @@ static void ath_edma_start_recv(struct ath_softc *sc)
         ath_rx_addbuffer_edma(sc, ATH9K_RX_QUEUE_HP);
         ath_rx_addbuffer_edma(sc, ATH9K_RX_QUEUE_LP);
         ath_opmode_init(sc);
-        ath9k_hw_startpcureceive(sc->sc_ah, !!(sc->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL));
+        ath9k_hw_startpcureceive(sc->sc_ah, sc->cur_chan->offchannel);
 }
 
 static void ath_edma_stop_recv(struct ath_softc *sc)
@@ -374,6 +374,7 @@ void ath_rx_cleanup(struct ath_softc *sc)
 
 u32 ath_calcrxfilter(struct ath_softc *sc)
 {
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         u32 rfilt;
 
         if (config_enabled(CONFIG_ATH9K_TX99))
@@ -424,6 +425,10 @@ u32 ath_calcrxfilter(struct ath_softc *sc)
         if (AR_SREV_9550(sc->sc_ah) || AR_SREV_9531(sc->sc_ah))
                 rfilt |= ATH9K_RX_FILTER_4ADDRESS;
 
+        if (ath9k_use_chanctx &&
+            test_bit(ATH_OP_SCANNING, &common->op_flags))
+                rfilt |= ATH9K_RX_FILTER_BEACON;
+
         return rfilt;
 
 }
@@ -457,7 +462,7 @@ int ath_startrecv(struct ath_softc *sc)
 
 start_recv:
         ath_opmode_init(sc);
-        ath9k_hw_startpcureceive(ah, !!(sc->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL));
+        ath9k_hw_startpcureceive(ah, sc->cur_chan->offchannel);
 
         return 0;
 }
@@ -540,7 +545,7 @@ static void ath_rx_ps_beacon(struct ath_softc *sc, struct sk_buff *skb)
                 sc->ps_flags &= ~PS_BEACON_SYNC;
                 ath_dbg(common, PS,
                         "Reconfigure beacon timers based on synchronized timestamp\n");
-                if (!(WARN_ON_ONCE(sc->cur_beacon_conf.beacon_interval == 0)))
+                if (!(WARN_ON_ONCE(sc->cur_chan->beacon.beacon_interval == 0)))
                         ath9k_set_beacon(sc);
                 if (sc->p2p_ps_vif)
                         ath9k_update_p2p_ps(sc, sc->p2p_ps_vif->vif);
@@ -887,6 +892,11 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
                 return -EINVAL;
         }
 
+        if (rx_stats->is_mybeacon) {
+                sc->sched.next_tbtt = rx_stats->rs_tstamp;
+                ath_chanctx_event(sc, NULL, ATH_CHANCTX_EVENT_BEACON_RECEIVED);
+        }
+
         ath9k_cmn_process_rssi(common, hw, rx_stats, rx_status);
 
         rx_status->band = ah->curchan->chan->band;
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index f1bbce3f7774..a1499700bcf2 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -813,6 +813,7 @@
 #define AR_SREV_VERSION_9531            0x500
 #define AR_SREV_REVISION_9531_10        0
 #define AR_SREV_REVISION_9531_11        1
+#define AR_SREV_REVISION_9531_20        2
 
 #define AR_SREV_5416(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_5416_PCI) || \
@@ -958,6 +959,9 @@
 #define AR_SREV_9531_11(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9531) && \
          ((_ah)->hw_version.macRev == AR_SREV_REVISION_9531_11))
+#define AR_SREV_9531_20(_ah) \
+        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9531) && \
+         ((_ah)->hw_version.macRev == AR_SREV_REVISION_9531_20))
 
 /* NOTE: When adding chips newer than Peacock, add chip check here */
 #define AR_SREV_9580_10_OR_LATER(_ah) \
diff --git a/drivers/net/wireless/ath/ath9k/spectral.c b/drivers/net/wireless/ath/ath9k/spectral.c
index 99f4de95c264..5fe29b9f8fa2 100644
--- a/drivers/net/wireless/ath/ath9k/spectral.c
+++ b/drivers/net/wireless/ath/ath9k/spectral.c
@@ -313,7 +313,7 @@ static ssize_t write_file_spectral_short_repeat(struct file *file,
         if (kstrtoul(buf, 0, &val))
                 return -EINVAL;
 
-        if (val < 0 || val > 1)
+        if (val > 1)
                 return -EINVAL;
 
         sc->spec_config.short_repeat = val;
@@ -361,7 +361,7 @@ static ssize_t write_file_spectral_count(struct file *file,
         if (kstrtoul(buf, 0, &val))
                 return -EINVAL;
 
-        if (val < 0 || val > 255)
+        if (val > 255)
                 return -EINVAL;
 
         sc->spec_config.count = val;
@@ -409,7 +409,7 @@ static ssize_t write_file_spectral_period(struct file *file,
         if (kstrtoul(buf, 0, &val))
                 return -EINVAL;
 
-        if (val < 0 || val > 255)
+        if (val > 255)
                 return -EINVAL;
 
         sc->spec_config.period = val;
@@ -457,7 +457,7 @@ static ssize_t write_file_spectral_fft_period(struct file *file,
         if (kstrtoul(buf, 0, &val))
                 return -EINVAL;
 
-        if (val < 0 || val > 15)
+        if (val > 15)
                 return -EINVAL;
 
         sc->spec_config.fft_period = val;
diff --git a/drivers/net/wireless/ath/ath9k/tx99.c b/drivers/net/wireless/ath/ath9k/tx99.c
index a65cfb91adca..23972924c774 100644
--- a/drivers/net/wireless/ath/ath9k/tx99.c
+++ b/drivers/net/wireless/ath/ath9k/tx99.c
@@ -76,7 +76,7 @@ static struct sk_buff *ath9k_build_tx99_skb(struct ath_softc *sc)
         tx_info = IEEE80211_SKB_CB(skb);
         memset(tx_info, 0, sizeof(*tx_info));
         rate = &tx_info->control.rates[0];
-        tx_info->band = hw->conf.chandef.chan->band;
+        tx_info->band = sc->cur_chan->chandef.chan->band;
         tx_info->flags = IEEE80211_TX_CTL_NO_ACK;
         tx_info->control.vif = sc->tx99_vif;
         rate->count = 1;
diff --git a/drivers/net/wireless/ath/ath9k/wow.c b/drivers/net/wireless/ath/ath9k/wow.c
index 2879887f5691..a4f4f0da81f6 100644
--- a/drivers/net/wireless/ath/ath9k/wow.c
+++ b/drivers/net/wireless/ath/ath9k/wow.c
@@ -193,6 +193,7 @@ int ath9k_suspend(struct ieee80211_hw *hw,
         u32 wow_triggers_enabled = 0;
         int ret = 0;
 
+        cancel_work_sync(&sc->chanctx_work);
         mutex_lock(&sc->mutex);
 
         ath_cancel_work(sc);
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 66acb2cbd9df..704fcbcbe20b 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -103,9 +103,16 @@ void ath_txq_unlock_complete(struct ath_softc *sc, struct ath_txq *txq)
                 ieee80211_tx_status(sc->hw, skb);
 }
 
-static void ath_tx_queue_tid(struct ath_txq *txq, struct ath_atx_tid *tid)
+static void ath_tx_queue_tid(struct ath_softc *sc, struct ath_txq *txq,
+                             struct ath_atx_tid *tid)
 {
         struct ath_atx_ac *ac = tid->ac;
+        struct list_head *list;
+        struct ath_vif *avp = (struct ath_vif *) tid->an->vif->drv_priv;
+        struct ath_chanctx *ctx = avp->chanctx;
+
+        if (!ctx)
+                return;
 
         if (tid->sched)
                 return;
@@ -117,7 +124,9 @@ static void ath_tx_queue_tid(struct ath_txq *txq, struct ath_atx_tid *tid)
                 return;
 
         ac->sched = true;
-        list_add_tail(&ac->list, &txq->axq_acq);
+
+        list = &ctx->acq[TID_TO_WME_AC(tid->tidno)];
+        list_add_tail(&ac->list, list);
 }
 
 static struct ath_frame_info *get_frame_info(struct sk_buff *skb)
@@ -147,21 +156,22 @@ static void ath_set_rates(struct ieee80211_vif *vif, struct ieee80211_sta *sta,
 static void ath_txq_skb_done(struct ath_softc *sc, struct ath_txq *txq,
                              struct sk_buff *skb)
 {
-        int q;
-
-        q = skb_get_queue_mapping(skb);
-        if (txq == sc->tx.uapsdq)
-                txq = sc->tx.txq_map[q];
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ath_frame_info *fi = get_frame_info(skb);
+        int hw_queue;
+        int q = fi->txq;
 
-        if (txq != sc->tx.txq_map[q])
+        if (q < 0)
                 return;
 
+        txq = sc->tx.txq_map[q];
         if (WARN_ON(--txq->pending_frames < 0))
                 txq->pending_frames = 0;
 
+        hw_queue = (info->hw_queue >= sc->hw->queues - 2) ? q : info->hw_queue;
         if (txq->stopped &&
             txq->pending_frames < sc->tx.txq_max_pending[q]) {
-                ieee80211_wake_queue(sc->hw, q);
+                ieee80211_wake_queue(sc->hw, hw_queue);
                 txq->stopped = false;
         }
 }
@@ -626,7 +636,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
 
                 skb_queue_splice_tail(&bf_pending, &tid->retry_q);
                 if (!an->sleeping) {
-                        ath_tx_queue_tid(txq, tid);
+                        ath_tx_queue_tid(sc, txq, tid);
 
                         if (ts->ts_status & (ATH9K_TXERR_FILT | ATH9K_TXERR_XRETRY))
                                 tid->ac->clear_ps_filter = true;
@@ -887,6 +897,15 @@ ath_tx_get_tid_subframe(struct ath_softc *sc, struct ath_txq *txq,
 
                 tx_info = IEEE80211_SKB_CB(skb);
                 tx_info->flags &= ~IEEE80211_TX_CTL_CLEAR_PS_FILT;
+
+                /*
+                 * No aggregation session is running, but there may be frames
+                 * from a previous session or a failed attempt in the queue.
+                 * Send them out as normal data frames
+                 */
+                if (!tid->active)
+                        tx_info->flags &= ~IEEE80211_TX_CTL_AMPDU;
+
                 if (!(tx_info->flags & IEEE80211_TX_CTL_AMPDU)) {
                         bf->bf_state.bf_type = 0;
                         return bf;
@@ -1483,7 +1502,7 @@ void ath_tx_aggr_wakeup(struct ath_softc *sc, struct ath_node *an)
                 ac->clear_ps_filter = true;
 
                 if (ath_tid_has_buffered(tid)) {
-                        ath_tx_queue_tid(txq, tid);
+                        ath_tx_queue_tid(sc, txq, tid);
                         ath_txq_schedule(sc, txq);
                 }
 
@@ -1507,7 +1526,7 @@ void ath_tx_aggr_resume(struct ath_softc *sc, struct ieee80211_sta *sta,
         tid->baw_size = IEEE80211_MIN_AMPDU_BUF << sta->ht_cap.ampdu_factor;
 
         if (ath_tid_has_buffered(tid)) {
-                ath_tx_queue_tid(txq, tid);
+                ath_tx_queue_tid(sc, txq, tid);
                 ath_txq_schedule(sc, txq);
         }
 
@@ -1642,7 +1661,6 @@ struct ath_txq *ath_txq_setup(struct ath_softc *sc, int qtype, int subtype)
                 txq->axq_link = NULL;
                 __skb_queue_head_init(&txq->complete_q);
                 INIT_LIST_HEAD(&txq->axq_q);
-                INIT_LIST_HEAD(&txq->axq_acq);
                 spin_lock_init(&txq->axq_lock);
                 txq->axq_depth = 0;
                 txq->axq_ampdu_depth = 0;
@@ -1686,7 +1704,7 @@ int ath_txq_update(struct ath_softc *sc, int qnum,
 int ath_cabq_update(struct ath_softc *sc)
 {
         struct ath9k_tx_queue_info qi;
-        struct ath_beacon_config *cur_conf = &sc->cur_beacon_conf;
+        struct ath_beacon_config *cur_conf = &sc->cur_chan->beacon;
         int qnum = sc->beacon.cabq->axq_qnum;
 
         ath9k_hw_get_txq_props(sc->sc_ah, qnum, &qi);
@@ -1804,7 +1822,7 @@ void ath_tx_cleanupq(struct ath_softc *sc, struct ath_txq *txq)
         sc->tx.txqsetup &= ~(1<<txq->axq_qnum);
 }
 
-/* For each axq_acq entry, for each tid, try to schedule packets
+/* For each acq entry, for each tid, try to schedule packets
  * for transmit until ampdu_depth has reached min Q depth.
  */
 void ath_txq_schedule(struct ath_softc *sc, struct ath_txq *txq)
@@ -1812,19 +1830,31 @@ void ath_txq_schedule(struct ath_softc *sc, struct ath_txq *txq)
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath_atx_ac *ac, *last_ac;
         struct ath_atx_tid *tid, *last_tid;
+        struct list_head *ac_list;
         bool sent = false;
 
+        if (txq->mac80211_qnum < 0)
+                return;
+
+        spin_lock_bh(&sc->chan_lock);
+        ac_list = &sc->cur_chan->acq[txq->mac80211_qnum];
+        spin_unlock_bh(&sc->chan_lock);
+
         if (test_bit(ATH_OP_HW_RESET, &common->op_flags) ||
-            list_empty(&txq->axq_acq))
+            list_empty(ac_list))
                 return;
 
+        spin_lock_bh(&sc->chan_lock);
         rcu_read_lock();
 
-        last_ac = list_entry(txq->axq_acq.prev, struct ath_atx_ac, list);
-        while (!list_empty(&txq->axq_acq)) {
+        last_ac = list_entry(ac_list->prev, struct ath_atx_ac, list);
+        while (!list_empty(ac_list)) {
                 bool stop = false;
 
-                ac = list_first_entry(&txq->axq_acq, struct ath_atx_ac, list);
+                if (sc->cur_chan->stopped)
+                        break;
+
+                ac = list_first_entry(ac_list, struct ath_atx_ac, list);
                 last_tid = list_entry(ac->tid_q.prev, struct ath_atx_tid, list);
                 list_del(&ac->list);
                 ac->sched = false;
@@ -1844,7 +1874,7 @@ void ath_txq_schedule(struct ath_softc *sc, struct ath_txq *txq)
                          * are pending for the tid
                          */
                         if (ath_tid_has_buffered(tid))
-                                ath_tx_queue_tid(txq, tid);
+                                ath_tx_queue_tid(sc, txq, tid);
 
                         if (stop || tid == last_tid)
                                 break;
@@ -1852,7 +1882,7 @@ void ath_txq_schedule(struct ath_softc *sc, struct ath_txq *txq)
 
                 if (!list_empty(&ac->tid_q) && !ac->sched) {
                         ac->sched = true;
-                        list_add_tail(&ac->list, &txq->axq_acq);
+                        list_add_tail(&ac->list, ac_list);
                 }
 
                 if (stop)
@@ -1863,12 +1893,27 @@ void ath_txq_schedule(struct ath_softc *sc, struct ath_txq *txq)
                                 break;
 
                         sent = false;
-                        last_ac = list_entry(txq->axq_acq.prev,
+                        last_ac = list_entry(ac_list->prev,
                                              struct ath_atx_ac, list);
                 }
         }
 
         rcu_read_unlock();
+        spin_unlock_bh(&sc->chan_lock);
+}
+
+void ath_txq_schedule_all(struct ath_softc *sc)
+{
+        struct ath_txq *txq;
+        int i;
+
+        for (i = 0; i < IEEE80211_NUM_ACS; i++) {
+                txq = sc->tx.txq_map[i];
+
+                spin_lock_bh(&txq->axq_lock);
+                ath_txq_schedule(sc, txq);
+                spin_unlock_bh(&txq->axq_lock);
+        }
 }
 
 /***********/
@@ -1999,6 +2044,7 @@ static void setup_frame_info(struct ieee80211_hw *hw,
                 an = (struct ath_node *) sta->drv_priv;
 
         memset(fi, 0, sizeof(*fi));
+        fi->txq = -1;
         if (hw_key)
                 fi->keyix = hw_key->hw_key_idx;
         else if (an && ieee80211_is_data(hdr->frame_control) && an->ps_key > 0)
@@ -2150,13 +2196,22 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_sta *sta = txctl->sta;
         struct ieee80211_vif *vif = info->control.vif;
+        struct ath_frame_info *fi = get_frame_info(skb);
+        struct ath_vif *avp = NULL;
         struct ath_softc *sc = hw->priv;
         struct ath_txq *txq = txctl->txq;
         struct ath_atx_tid *tid = NULL;
         struct ath_buf *bf;
-        int q;
+        bool queue;
+        int q, hw_queue;
         int ret;
 
+        if (vif)
+                avp = (void *)vif->drv_priv;
+
+        if (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN)
+                txctl->force_channel = true;
+
         ret = ath_tx_prepare(hw, skb, txctl);
         if (ret)
             return ret;
@@ -2168,24 +2223,41 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
          */
 
         q = skb_get_queue_mapping(skb);
+        hw_queue = (info->hw_queue >= sc->hw->queues - 2) ? q : info->hw_queue;
 
         ath_txq_lock(sc, txq);
-        if (txq == sc->tx.txq_map[q] &&
-            ++txq->pending_frames > sc->tx.txq_max_pending[q] &&
-            !txq->stopped) {
-                ieee80211_stop_queue(sc->hw, q);
-                txq->stopped = true;
+        if (txq == sc->tx.txq_map[q]) {
+                fi->txq = q;
+                if (++txq->pending_frames > sc->tx.txq_max_pending[q] &&
+                    !txq->stopped) {
+                        ieee80211_stop_queue(sc->hw, hw_queue);
+                        txq->stopped = true;
+                }
+        }
+
+        queue = ieee80211_is_data_present(hdr->frame_control);
+
+        /* Force queueing of all frames that belong to a virtual interface on
+         * a different channel context, to ensure that they are sent on the
+         * correct channel.
+         */
+        if (((avp && avp->chanctx != sc->cur_chan) ||
+             sc->cur_chan->stopped) && !txctl->force_channel) {
+                if (!txctl->an)
+                        txctl->an = &avp->mcast_node;
+                info->flags &= ~IEEE80211_TX_CTL_PS_RESPONSE;
+                queue = true;
         }
 
-        if (txctl->an && ieee80211_is_data_present(hdr->frame_control))
+        if (txctl->an && queue)
                 tid = ath_get_skb_tid(sc, txctl->an, skb);
 
-        if (info->flags & IEEE80211_TX_CTL_PS_RESPONSE) {
+        if (info->flags & (IEEE80211_TX_CTL_PS_RESPONSE |
+                           IEEE80211_TX_CTL_TX_OFFCHAN)) {
                 ath_txq_unlock(sc, txq);
                 txq = sc->tx.uapsdq;
                 ath_txq_lock(sc, txq);
-        } else if (txctl->an &&
-                   ieee80211_is_data_present(hdr->frame_control)) {
+        } else if (txctl->an && queue) {
                 WARN_ON(tid->ac->txq != txctl->txq);
 
                 if (info->flags & IEEE80211_TX_CTL_CLEAR_PS_FILT)
@@ -2198,7 +2270,7 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
                 TX_STAT_INC(txq->axq_qnum, a_queued_sw);
                 __skb_queue_tail(&tid->buf_q, skb);
                 if (!txctl->an->sleeping)
-                        ath_tx_queue_tid(txq, tid);
+                        ath_tx_queue_tid(sc, txq, tid);
 
                 ath_txq_schedule(sc, txq);
                 goto out;
@@ -2244,8 +2316,8 @@ void ath_tx_cabq(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
         int max_duration;
 
         max_duration =
-                sc->cur_beacon_conf.beacon_interval * 1000 *
-                sc->cur_beacon_conf.dtim_period / ATH_BCBUF;
+                sc->cur_chan->beacon.beacon_interval * 1000 *
+                sc->cur_chan->beacon.dtim_period / ATH_BCBUF;
 
         do {
                 struct ath_frame_info *fi = get_frame_info(skb);
@@ -2560,6 +2632,8 @@ void ath_tx_edma_tasklet(struct ath_softc *sc)
                         sc->beacon.tx_processed = true;
                         sc->beacon.tx_last = !(ts.ts_status & ATH9K_TXERR_MASK);
 
+                        ath_chanctx_event(sc, NULL,
+                                          ATH_CHANCTX_EVENT_BEACON_SENT);
                         ath9k_csa_update(sc);
                         continue;
                 }
diff --git a/drivers/net/wireless/ath/carl9170/carl9170.h b/drivers/net/wireless/ath/carl9170/carl9170.h
index 8596aba34f96..237d0cda1bcb 100644
--- a/drivers/net/wireless/ath/carl9170/carl9170.h
+++ b/drivers/net/wireless/ath/carl9170/carl9170.h
@@ -256,6 +256,7 @@ struct ar9170 {
         atomic_t rx_work_urbs;
         atomic_t rx_pool_urbs;
         kernel_ulong_t features;
+        bool usb_ep_cmd_is_bulk;
 
         /* firmware settings */
         struct completion fw_load_wait;
diff --git a/drivers/net/wireless/ath/carl9170/phy.c b/drivers/net/wireless/ath/carl9170/phy.c
index ab4ee7d39ad3..b80b2138ce3c 100644
--- a/drivers/net/wireless/ath/carl9170/phy.c
+++ b/drivers/net/wireless/ath/carl9170/phy.c
@@ -1139,7 +1139,6 @@ static int carl9170_set_freq_cal_data(struct ar9170 *ar,
 
         default:
                 return -EINVAL;
-                break;
         }
 
         for (; i >= 0; i--) {
diff --git a/drivers/net/wireless/ath/carl9170/usb.c b/drivers/net/wireless/ath/carl9170/usb.c
index f35c7f30f9a6..c9f93310c0d6 100644
--- a/drivers/net/wireless/ath/carl9170/usb.c
+++ b/drivers/net/wireless/ath/carl9170/usb.c
@@ -621,9 +621,16 @@ int __carl9170_exec_cmd(struct ar9170 *ar, struct carl9170_cmd *cmd,
                 goto err_free;
         }
 
-        usb_fill_int_urb(urb, ar->udev, usb_sndintpipe(ar->udev,
-                AR9170_USB_EP_CMD), cmd, cmd->hdr.len + 4,
-                carl9170_usb_cmd_complete, ar, 1);
+        if (ar->usb_ep_cmd_is_bulk)
+                usb_fill_bulk_urb(urb, ar->udev,
+                                  usb_sndbulkpipe(ar->udev, AR9170_USB_EP_CMD),
+                                  cmd, cmd->hdr.len + 4,
+                                  carl9170_usb_cmd_complete, ar);
+        else
+                usb_fill_int_urb(urb, ar->udev,
+                                 usb_sndintpipe(ar->udev, AR9170_USB_EP_CMD),
+                                 cmd, cmd->hdr.len + 4,
+                                 carl9170_usb_cmd_complete, ar, 1);
 
         if (free_buf)
                 urb->transfer_flags |= URB_FREE_BUFFER;
@@ -1032,9 +1039,10 @@ static void carl9170_usb_firmware_step2(const struct firmware *fw,
 static int carl9170_usb_probe(struct usb_interface *intf,
                               const struct usb_device_id *id)
 {
+        struct usb_endpoint_descriptor *ep;
         struct ar9170 *ar;
         struct usb_device *udev;
-        int err;
+        int i, err;
 
         err = usb_reset_device(interface_to_usbdev(intf));
         if (err)
@@ -1050,6 +1058,21 @@ static int carl9170_usb_probe(struct usb_interface *intf,
         ar->intf = intf;
         ar->features = id->driver_info;
 
+        /* We need to remember the type of endpoint 4 because it differs
+         * between high- and full-speed configuration. The high-speed
+         * configuration specifies it as interrupt and the full-speed
+         * configuration as bulk endpoint. This information is required
+         * later when sending urbs to that endpoint.
+         */
+        for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; ++i) {
+                ep = &intf->cur_altsetting->endpoint[i].desc;
+
+                if (usb_endpoint_num(ep) == AR9170_USB_EP_CMD &&
+                    usb_endpoint_dir_out(ep) &&
+                    usb_endpoint_type(ep) == USB_ENDPOINT_XFER_BULK)
+                        ar->usb_ep_cmd_is_bulk = true;
+        }
+
         usb_set_intfdata(intf, ar);
         SET_IEEE80211_DEV(ar->hw, &intf->dev);
 
diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
index 4ab5370ab7a6..b71d2b33532d 100644
--- a/drivers/net/wireless/ath/wcn36xx/main.c
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -488,7 +488,6 @@ static int wcn36xx_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 wcn36xx_err("Unsupported key cmd 0x%x\n", cmd);
                 ret = -EOPNOTSUPP;
                 goto out;
-                break;
         }
 
 out:
diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c
index 820d4ebd9322..4ac2c208c9ba 100644
--- a/drivers/net/wireless/ath/wil6210/cfg80211.c
+++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
@@ -104,8 +104,8 @@ int wil_iftype_nl2wmi(enum nl80211_iftype type)
         return -EOPNOTSUPP;
 }
 
-static int wil_cid_fill_sinfo(struct wil6210_priv *wil, int cid,
-                              struct station_info *sinfo)
+int wil_cid_fill_sinfo(struct wil6210_priv *wil, int cid,
+                       struct station_info *sinfo)
 {
         struct wmi_notify_req_cmd cmd = {
                 .cid = cid,
@@ -287,6 +287,7 @@ static int wil_cfg80211_scan(struct wiphy *wiphy,
                 return -EBUSY;
         }
 
+        wil_dbg_misc(wil, "Start scan_request 0x%p\n", request);
         wil->scan_request = request;
         mod_timer(&wil->scan_timer, jiffies + WIL6210_SCAN_TO);
 
@@ -443,15 +444,15 @@ static int wil_cfg80211_disconnect(struct wiphy *wiphy,
         return rc;
 }
 
-static int wil_cfg80211_mgmt_tx(struct wiphy *wiphy,
-                                struct wireless_dev *wdev,
-                                struct cfg80211_mgmt_tx_params *params,
-                                u64 *cookie)
+int wil_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
+                         struct cfg80211_mgmt_tx_params *params,
+                         u64 *cookie)
 {
         const u8 *buf = params->buf;
         size_t len = params->len;
         struct wil6210_priv *wil = wiphy_to_wil(wiphy);
         int rc;
+        bool tx_status = false;
         struct ieee80211_mgmt *mgmt_frame = (void *)buf;
         struct wmi_sw_tx_req_cmd *cmd;
         struct {
@@ -460,8 +461,10 @@ static int wil_cfg80211_mgmt_tx(struct wiphy *wiphy,
         } __packed evt;
 
         cmd = kmalloc(sizeof(*cmd) + len, GFP_KERNEL);
-        if (!cmd)
-                return -ENOMEM;
+        if (!cmd) {
+                rc = -ENOMEM;
+                goto out;
+        }
 
         memcpy(cmd->dst_mac, mgmt_frame->da, WMI_MAC_LEN);
         cmd->len = cpu_to_le16(len);
@@ -470,10 +473,12 @@ static int wil_cfg80211_mgmt_tx(struct wiphy *wiphy,
         rc = wmi_call(wil, WMI_SW_TX_REQ_CMDID, cmd, sizeof(*cmd) + len,
                       WMI_SW_TX_COMPLETE_EVENTID, &evt, sizeof(evt), 2000);
         if (rc == 0)
-                rc = evt.evt.status;
+                tx_status = !evt.evt.status;
 
         kfree(cmd);
-
+ out:
+        cfg80211_mgmt_tx_status(wdev, cookie ? *cookie : 0, buf, len,
+                                tx_status, GFP_KERNEL);
         return rc;
 }
 
@@ -562,6 +567,34 @@ static int wil_cancel_remain_on_channel(struct wiphy *wiphy,
         return rc;
 }
 
+static void wil_print_bcon_data(struct cfg80211_beacon_data *b)
+{
+        print_hex_dump_bytes("head     ", DUMP_PREFIX_OFFSET,
+                             b->head, b->head_len);
+        print_hex_dump_bytes("tail     ", DUMP_PREFIX_OFFSET,
+                             b->tail, b->tail_len);
+        print_hex_dump_bytes("BCON IE  ", DUMP_PREFIX_OFFSET,
+                             b->beacon_ies, b->beacon_ies_len);
+        print_hex_dump_bytes("PROBE    ", DUMP_PREFIX_OFFSET,
+                             b->probe_resp, b->probe_resp_len);
+        print_hex_dump_bytes("PROBE IE ", DUMP_PREFIX_OFFSET,
+                             b->proberesp_ies, b->proberesp_ies_len);
+        print_hex_dump_bytes("ASSOC IE ", DUMP_PREFIX_OFFSET,
+                             b->assocresp_ies, b->assocresp_ies_len);
+}
+
+static void wil_print_crypto(struct wil6210_priv *wil,
+                             struct cfg80211_crypto_settings *c)
+{
+        wil_dbg_misc(wil, "WPA versions: 0x%08x cipher group 0x%08x\n",
+                     c->wpa_versions, c->cipher_group);
+        wil_dbg_misc(wil, "Pairwise ciphers [%d]\n", c->n_ciphers_pairwise);
+        wil_dbg_misc(wil, "AKM suites [%d]\n", c->n_akm_suites);
+        wil_dbg_misc(wil, "Control port : %d, eth_type 0x%04x no_encrypt %d\n",
+                     c->control_port, be16_to_cpu(c->control_port_ethertype),
+                     c->control_port_no_encrypt);
+}
+
 static int wil_fix_bcon(struct wil6210_priv *wil,
                         struct cfg80211_beacon_data *bcon)
 {
@@ -595,8 +628,11 @@ static int wil_cfg80211_start_ap(struct wiphy *wiphy,
         struct wireless_dev *wdev = ndev->ieee80211_ptr;
         struct ieee80211_channel *channel = info->chandef.chan;
         struct cfg80211_beacon_data *bcon = &info->beacon;
+        struct cfg80211_crypto_settings *crypto = &info->crypto;
         u8 wmi_nettype = wil_iftype_nl2wmi(wdev->iftype);
 
+        wil_dbg_misc(wil, "%s()\n", __func__);
+
         if (!channel) {
                 wil_err(wil, "AP: No channel???\n");
                 return -EINVAL;
@@ -604,11 +640,19 @@ static int wil_cfg80211_start_ap(struct wiphy *wiphy,
 
         wil_dbg_misc(wil, "AP on Channel %d %d MHz, %s\n", channel->hw_value,
                      channel->center_freq, info->privacy ? "secure" : "open");
+        wil_dbg_misc(wil, "Privacy: %d auth_type %d\n",
+                     info->privacy, info->auth_type);
+        wil_dbg_misc(wil, "BI %d DTIM %d\n", info->beacon_interval,
+                     info->dtim_period);
         print_hex_dump_bytes("SSID ", DUMP_PREFIX_OFFSET,
                              info->ssid, info->ssid_len);
+        wil_print_bcon_data(bcon);
+        wil_print_crypto(wil, crypto);
 
-        if (wil_fix_bcon(wil, bcon))
+        if (wil_fix_bcon(wil, bcon)) {
                 wil_dbg_misc(wil, "Fixed bcon\n");
+                wil_print_bcon_data(bcon);
+        }
 
         mutex_lock(&wil->mutex);
 
@@ -663,6 +707,8 @@ static int wil_cfg80211_stop_ap(struct wiphy *wiphy,
         int rc = 0;
         struct wil6210_priv *wil = wiphy_to_wil(wiphy);
 
+        wil_dbg_misc(wil, "%s()\n", __func__);
+
         mutex_lock(&wil->mutex);
 
         rc = wmi_pcp_stop(wil);
diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
index 8d4bc4bfb664..8f66186adb8c 100644
--- a/drivers/net/wireless/ath/wil6210/debugfs.c
+++ b/drivers/net/wireless/ath/wil6210/debugfs.c
@@ -19,6 +19,7 @@
 #include <linux/seq_file.h>
 #include <linux/pci.h>
 #include <linux/rtnetlink.h>
+#include <linux/power_supply.h>
 
 #include "wil6210.h"
 #include "txrx.h"
@@ -69,14 +70,32 @@ static int wil_vring_debugfs_show(struct seq_file *s, void *data)
 
         for (i = 0; i < ARRAY_SIZE(wil->vring_tx); i++) {
                 struct vring *vring = &(wil->vring_tx[i]);
+                struct vring_tx_data *txdata = &wil->vring_tx_data[i];
+
                 if (vring->va) {
                         int cid = wil->vring2cid_tid[i][0];
                         int tid = wil->vring2cid_tid[i][1];
+                        u32 swhead = vring->swhead;
+                        u32 swtail = vring->swtail;
+                        int used = (vring->size + swhead - swtail)
+                                   % vring->size;
+                        int avail = vring->size - used - 1;
                         char name[10];
+                        /* performance monitoring */
+                        cycles_t now = get_cycles();
+                        cycles_t idle = txdata->idle * 100;
+                        cycles_t total = now - txdata->begin;
+
+                        do_div(idle, total);
+                        txdata->begin = now;
+                        txdata->idle = 0ULL;
+
                         snprintf(name, sizeof(name), "tx_%2d", i);
 
-                        seq_printf(s, "\n%pM CID %d TID %d\n",
-                                   wil->sta[cid].addr, cid, tid);
+                        seq_printf(s, "\n%pM CID %d TID %d [%3d|%3d] idle %3d%%\n",
+                                   wil->sta[cid].addr, cid, tid, used, avail,
+                                   (int)idle);
+
                         wil_print_vring(s, wil, name, vring, '_', 'H');
                 }
         }
@@ -231,6 +250,26 @@ static struct dentry *wil_debugfs_create_iomem_x32(const char *name,
                                    &fops_iomem_x32);
 }
 
+static int wil_debugfs_ulong_set(void *data, u64 val)
+{
+        *(ulong *)data = val;
+        return 0;
+}
+static int wil_debugfs_ulong_get(void *data, u64 *val)
+{
+        *val = *(ulong *)data;
+        return 0;
+}
+DEFINE_SIMPLE_ATTRIBUTE(wil_fops_ulong, wil_debugfs_ulong_get,
+                        wil_debugfs_ulong_set, "%llu\n");
+
+static struct dentry *wil_debugfs_create_ulong(const char *name, umode_t mode,
+                                               struct dentry *parent,
+                                               ulong *value)
+{
+        return debugfs_create_file(name, mode, parent, value, &wil_fops_ulong);
+}
+
 static int wil6210_debugfs_create_ISR(struct wil6210_priv *wil,
                                       const char *name,
                                       struct dentry *parent, u32 off)
@@ -284,11 +323,11 @@ static int wil6210_debugfs_create_ITR_CNT(struct wil6210_priv *wil,
         if (IS_ERR_OR_NULL(d))
                 return -ENODEV;
 
-        wil_debugfs_create_iomem_x32("TRSH", S_IRUGO, d, wil->csr +
+        wil_debugfs_create_iomem_x32("TRSH", S_IRUGO | S_IWUSR, d, wil->csr +
                                      HOSTADDR(RGF_DMA_ITR_CNT_TRSH));
-        wil_debugfs_create_iomem_x32("DATA", S_IRUGO, d, wil->csr +
+        wil_debugfs_create_iomem_x32("DATA", S_IRUGO | S_IWUSR, d, wil->csr +
                                      HOSTADDR(RGF_DMA_ITR_CNT_DATA));
-        wil_debugfs_create_iomem_x32("CTL", S_IRUGO, d, wil->csr +
+        wil_debugfs_create_iomem_x32("CTL", S_IRUGO | S_IWUSR, d, wil->csr +
                                      HOSTADDR(RGF_DMA_ITR_CNT_CRL));
 
         return 0;
@@ -397,6 +436,126 @@ static const struct file_operations fops_reset = {
         .write = wil_write_file_reset,
         .open  = simple_open,
 };
+/*---write channel 1..4 to rxon for it, 0 to rxoff---*/
+static ssize_t wil_write_file_rxon(struct file *file, const char __user *buf,
+                                   size_t len, loff_t *ppos)
+{
+        struct wil6210_priv *wil = file->private_data;
+        int rc;
+        long channel;
+        bool on;
+
+        char *kbuf = kmalloc(len + 1, GFP_KERNEL);
+        if (!kbuf)
+                return -ENOMEM;
+        if (copy_from_user(kbuf, buf, len)) {
+                kfree(kbuf);
+                return -EIO;
+        }
+
+        kbuf[len] = '\0';
+        rc = kstrtol(kbuf, 0, &channel);
+        kfree(kbuf);
+        if (rc)
+                return rc;
+
+        if ((channel < 0) || (channel > 4)) {
+                wil_err(wil, "Invalid channel %ld\n", channel);
+                return -EINVAL;
+        }
+        on = !!channel;
+
+        if (on) {
+                rc = wmi_set_channel(wil, (int)channel);
+                if (rc)
+                        return rc;
+        }
+
+        rc = wmi_rxon(wil, on);
+        if (rc)
+                return rc;
+
+        return len;
+}
+
+static const struct file_operations fops_rxon = {
+        .write = wil_write_file_rxon,
+        .open  = simple_open,
+};
+/*---tx_mgmt---*/
+/* Write mgmt frame to this file to send it */
+static ssize_t wil_write_file_txmgmt(struct file *file, const char __user *buf,
+                                     size_t len, loff_t *ppos)
+{
+        struct wil6210_priv *wil = file->private_data;
+        struct wiphy *wiphy = wil_to_wiphy(wil);
+        struct wireless_dev *wdev = wil_to_wdev(wil);
+        struct cfg80211_mgmt_tx_params params;
+        int rc;
+
+        void *frame = kmalloc(len, GFP_KERNEL);
+        if (!frame)
+                return -ENOMEM;
+
+        if (copy_from_user(frame, buf, len))
+                return -EIO;
+
+        params.buf = frame;
+        params.len = len;
+        params.chan = wdev->preset_chandef.chan;
+
+        rc = wil_cfg80211_mgmt_tx(wiphy, wdev, &params, NULL);
+
+        kfree(frame);
+        wil_info(wil, "%s() -> %d\n", __func__, rc);
+
+        return len;
+}
+
+static const struct file_operations fops_txmgmt = {
+        .write = wil_write_file_txmgmt,
+        .open  = simple_open,
+};
+
+/* Write WMI command (w/o mbox header) to this file to send it
+ * WMI starts from wil6210_mbox_hdr_wmi header
+ */
+static ssize_t wil_write_file_wmi(struct file *file, const char __user *buf,
+                                  size_t len, loff_t *ppos)
+{
+        struct wil6210_priv *wil = file->private_data;
+        struct wil6210_mbox_hdr_wmi *wmi;
+        void *cmd;
+        int cmdlen = len - sizeof(struct wil6210_mbox_hdr_wmi);
+        u16 cmdid;
+        int rc, rc1;
+
+        if (cmdlen <= 0)
+                return -EINVAL;
+
+        wmi = kmalloc(len, GFP_KERNEL);
+        if (!wmi)
+                return -ENOMEM;
+
+        rc = simple_write_to_buffer(wmi, len, ppos, buf, len);
+        if (rc < 0)
+                return rc;
+
+        cmd = &wmi[1];
+        cmdid = le16_to_cpu(wmi->id);
+
+        rc1 = wmi_send(wil, cmdid, cmd, cmdlen);
+        kfree(wmi);
+
+        wil_info(wil, "%s(0x%04x[%d]) -> %d\n", __func__, cmdid, cmdlen, rc1);
+
+        return rc;
+}
+
+static const struct file_operations fops_wmi = {
+        .write = wil_write_file_wmi,
+        .open  = simple_open,
+};
 
 static void wil_seq_hexdump(struct seq_file *s, void *p, int len,
                             const char *prefix)
@@ -600,8 +759,8 @@ static int wil_temp_debugfs_show(struct seq_file *s, void *data)
                 return 0;
         }
 
-        print_temp(s, "MAC temperature   :", t_m);
-        print_temp(s, "Radio temperature :", t_r);
+        print_temp(s, "T_mac   =", t_m);
+        print_temp(s, "T_radio =", t_r);
 
         return 0;
 }
@@ -618,6 +777,130 @@ static const struct file_operations fops_temp = {
         .llseek         = seq_lseek,
 };
 
+/*---------freq------------*/
+static int wil_freq_debugfs_show(struct seq_file *s, void *data)
+{
+        struct wil6210_priv *wil = s->private;
+        struct wireless_dev *wdev = wil_to_wdev(wil);
+        u16 freq = wdev->chandef.chan ? wdev->chandef.chan->center_freq : 0;
+
+        seq_printf(s, "Freq = %d\n", freq);
+
+        return 0;
+}
+
+static int wil_freq_seq_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, wil_freq_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations fops_freq = {
+        .open           = wil_freq_seq_open,
+        .release        = single_release,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+};
+
+/*---------link------------*/
+static int wil_link_debugfs_show(struct seq_file *s, void *data)
+{
+        struct wil6210_priv *wil = s->private;
+        struct station_info sinfo;
+        int i, rc;
+
+        for (i = 0; i < ARRAY_SIZE(wil->sta); i++) {
+                struct wil_sta_info *p = &wil->sta[i];
+                char *status = "unknown";
+                switch (p->status) {
+                case wil_sta_unused:
+                        status = "unused   ";
+                        break;
+                case wil_sta_conn_pending:
+                        status = "pending  ";
+                        break;
+                case wil_sta_connected:
+                        status = "connected";
+                        break;
+                }
+                seq_printf(s, "[%d] %pM %s%s\n", i, p->addr, status,
+                           (p->data_port_open ? " data_port_open" : ""));
+
+                if (p->status == wil_sta_connected) {
+                        rc = wil_cid_fill_sinfo(wil, i, &sinfo);
+                        if (rc)
+                                return rc;
+
+                        seq_printf(s, "  Tx_mcs = %d\n", sinfo.txrate.mcs);
+                        seq_printf(s, "  Rx_mcs = %d\n", sinfo.rxrate.mcs);
+                        seq_printf(s, "  SQ     = %d\n", sinfo.signal);
+                }
+        }
+
+        return 0;
+}
+
+static int wil_link_seq_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, wil_link_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations fops_link = {
+        .open           = wil_link_seq_open,
+        .release        = single_release,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+};
+
+/*---------info------------*/
+static int wil_info_debugfs_show(struct seq_file *s, void *data)
+{
+        struct wil6210_priv *wil = s->private;
+        struct net_device *ndev = wil_to_ndev(wil);
+        int is_ac = power_supply_is_system_supplied();
+        int rx = atomic_xchg(&wil->isr_count_rx, 0);
+        int tx = atomic_xchg(&wil->isr_count_tx, 0);
+        static ulong rxf_old, txf_old;
+        ulong rxf = ndev->stats.rx_packets;
+        ulong txf = ndev->stats.tx_packets;
+        unsigned int i;
+
+        /* >0 : AC; 0 : battery; <0 : error */
+        seq_printf(s, "AC powered : %d\n", is_ac);
+        seq_printf(s, "Rx irqs:packets : %8d : %8ld\n", rx, rxf - rxf_old);
+        seq_printf(s, "Tx irqs:packets : %8d : %8ld\n", tx, txf - txf_old);
+        rxf_old = rxf;
+        txf_old = txf;
+
+
+#define CHECK_QSTATE(x) (state & BIT(__QUEUE_STATE_ ## x)) ? \
+        " " __stringify(x) : ""
+
+        for (i = 0; i < ndev->num_tx_queues; i++) {
+                struct netdev_queue *txq = netdev_get_tx_queue(ndev, i);
+                unsigned long state = txq->state;
+
+                seq_printf(s, "Tx queue[%i] state : 0x%lx%s%s%s\n", i, state,
+                           CHECK_QSTATE(DRV_XOFF),
+                           CHECK_QSTATE(STACK_XOFF),
+                           CHECK_QSTATE(FROZEN)
+                          );
+        }
+#undef CHECK_QSTATE
+        return 0;
+}
+
+static int wil_info_seq_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, wil_info_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations fops_info = {
+        .open           = wil_info_seq_open,
+        .release        = single_release,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+};
+
 /*---------Station matrix------------*/
 static void wil_print_rxtid(struct seq_file *s, struct wil_tid_ampdu_rx *r)
 {
@@ -630,7 +913,7 @@ static void wil_print_rxtid(struct seq_file *s, struct wil_tid_ampdu_rx *r)
                 else
                         seq_printf(s, "%c", r->reorder_buf[i] ? '*' : '_');
         }
-        seq_puts(s, "]\n");
+        seq_printf(s, "] last drop 0x%03x\n", r->ssn_last_drop);
 }
 
 static int wil_sta_debugfs_show(struct seq_file *s, void *data)
@@ -682,6 +965,26 @@ static const struct file_operations fops_sta = {
 };
 
 /*----------------*/
+static void wil6210_debugfs_init_blobs(struct wil6210_priv *wil,
+                                       struct dentry *dbg)
+{
+        int i;
+        char name[32];
+
+        for (i = 0; i < ARRAY_SIZE(fw_mapping); i++) {
+                struct debugfs_blob_wrapper *blob = &wil->blobs[i];
+                const struct fw_map *map = &fw_mapping[i];
+
+                if (!map->name)
+                        continue;
+
+                blob->data = (void * __force)wil->csr + HOSTADDR(map->host);
+                blob->size = map->to - map->from;
+                snprintf(name, sizeof(name), "blob_%s", map->name);
+                wil_debugfs_create_ioblob(name, S_IRUGO, dbg, blob);
+        }
+}
+
 int wil6210_debugfs_init(struct wil6210_priv *wil)
 {
         struct dentry *dbg = wil->debug = debugfs_create_dir(WIL_NAME,
@@ -703,6 +1006,10 @@ int wil6210_debugfs_init(struct wil6210_priv *wil)
         debugfs_create_file("ssid", S_IRUGO | S_IWUSR, dbg, wil, &fops_ssid);
         debugfs_create_u32("secure_pcp", S_IRUGO | S_IWUSR, dbg,
                            &wil->secure_pcp);
+        wil_debugfs_create_ulong("status", S_IRUGO | S_IWUSR, dbg,
+                                 &wil->status);
+        debugfs_create_u32("fw_version", S_IRUGO, dbg, &wil->fw_version);
+        debugfs_create_x32("hw_version", S_IRUGO, dbg, &wil->hw_version);
 
         wil6210_debugfs_create_ISR(wil, "USER_ICR", dbg,
                                    HOSTADDR(RGF_USER_USER_ICR));
@@ -715,40 +1022,22 @@ int wil6210_debugfs_init(struct wil6210_priv *wil)
         wil6210_debugfs_create_pseudo_ISR(wil, dbg);
         wil6210_debugfs_create_ITR_CNT(wil, dbg);
 
+        wil_debugfs_create_iomem_x32("RGF_USER_USAGE_1", S_IRUGO, dbg,
+                                     wil->csr +
+                                     HOSTADDR(RGF_USER_USAGE_1));
         debugfs_create_u32("mem_addr", S_IRUGO | S_IWUSR, dbg, &mem_addr);
         debugfs_create_file("mem_val", S_IRUGO, dbg, wil, &fops_memread);
 
         debugfs_create_file("reset", S_IWUSR, dbg, wil, &fops_reset);
+        debugfs_create_file("rxon", S_IWUSR, dbg, wil, &fops_rxon);
+        debugfs_create_file("tx_mgmt", S_IWUSR, dbg, wil, &fops_txmgmt);
+        debugfs_create_file("wmi_send", S_IWUSR, dbg, wil, &fops_wmi);
         debugfs_create_file("temp", S_IRUGO, dbg, wil, &fops_temp);
+        debugfs_create_file("freq", S_IRUGO, dbg, wil, &fops_freq);
+        debugfs_create_file("link", S_IRUGO, dbg, wil, &fops_link);
+        debugfs_create_file("info", S_IRUGO, dbg, wil, &fops_info);
 
-        wil->rgf_blob.data = (void * __force)wil->csr + 0;
-        wil->rgf_blob.size = 0xa000;
-        wil_debugfs_create_ioblob("blob_rgf", S_IRUGO, dbg, &wil->rgf_blob);
-
-        wil->fw_code_blob.data = (void * __force)wil->csr + 0x40000;
-        wil->fw_code_blob.size = 0x40000;
-        wil_debugfs_create_ioblob("blob_fw_code", S_IRUGO, dbg,
-                                  &wil->fw_code_blob);
-
-        wil->fw_data_blob.data = (void * __force)wil->csr + 0x80000;
-        wil->fw_data_blob.size = 0x8000;
-        wil_debugfs_create_ioblob("blob_fw_data", S_IRUGO, dbg,
-                                  &wil->fw_data_blob);
-
-        wil->fw_peri_blob.data = (void * __force)wil->csr + 0x88000;
-        wil->fw_peri_blob.size = 0x18000;
-        wil_debugfs_create_ioblob("blob_fw_peri", S_IRUGO, dbg,
-                                  &wil->fw_peri_blob);
-
-        wil->uc_code_blob.data = (void * __force)wil->csr + 0xa0000;
-        wil->uc_code_blob.size = 0x10000;
-        wil_debugfs_create_ioblob("blob_uc_code", S_IRUGO, dbg,
-                                  &wil->uc_code_blob);
-
-        wil->uc_data_blob.data = (void * __force)wil->csr + 0xb0000;
-        wil->uc_data_blob.size = 0x4000;
-        wil_debugfs_create_ioblob("blob_uc_data", S_IRUGO, dbg,
-                                  &wil->uc_data_blob);
+        wil6210_debugfs_init_blobs(wil, dbg);
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath/wil6210/interrupt.c b/drivers/net/wireless/ath/wil6210/interrupt.c
index 73593aa3cd98..67f1002a03a1 100644
--- a/drivers/net/wireless/ath/wil6210/interrupt.c
+++ b/drivers/net/wireless/ath/wil6210/interrupt.c
@@ -208,6 +208,7 @@ static irqreturn_t wil6210_irq_rx(int irq, void *cookie)
 
         /* Rx IRQ will be enabled when NAPI processing finished */
 
+        atomic_inc(&wil->isr_count_rx);
         return IRQ_HANDLED;
 }
 
@@ -246,6 +247,7 @@ static irqreturn_t wil6210_irq_tx(int irq, void *cookie)
 
         /* Tx IRQ will be enabled when NAPI processing finished */
 
+        atomic_inc(&wil->isr_count_tx);
         return IRQ_HANDLED;
 }
 
@@ -257,6 +259,7 @@ static void wil_notify_fw_error(struct wil6210_priv *wil)
                 [1] = "EVENT=FW_ERROR",
                 [2] = NULL,
         };
+        wil_err(wil, "Notify about firmware error\n");
         kobject_uevent_env(&dev->kobj, KOBJ_CHANGE, envp);
 }
 
diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c
index 11e6d9d22eae..3704d2a434f3 100644
--- a/drivers/net/wireless/ath/wil6210/main.c
+++ b/drivers/net/wireless/ath/wil6210/main.c
@@ -61,11 +61,24 @@ void wil_memcpy_toio_32(volatile void __iomem *dst, const void *src,
 static void wil_disconnect_cid(struct wil6210_priv *wil, int cid)
 {
         uint i;
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct wireless_dev *wdev = wil->wdev;
         struct wil_sta_info *sta = &wil->sta[cid];
+        wil_dbg_misc(wil, "%s(CID %d, status %d)\n", __func__, cid,
+                     sta->status);
 
         sta->data_port_open = false;
         if (sta->status != wil_sta_unused) {
                 wmi_disconnect_sta(wil, sta->addr, WLAN_REASON_DEAUTH_LEAVING);
+                switch (wdev->iftype) {
+                case NL80211_IFTYPE_AP:
+                case NL80211_IFTYPE_P2P_GO:
+                        /* AP-like interface */
+                        cfg80211_del_sta(ndev, sta->addr, GFP_KERNEL);
+                        break;
+                default:
+                        break;
+                }
                 sta->status = wil_sta_unused;
         }
 
@@ -119,11 +132,6 @@ static void _wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid)
                 clear_bit(wil_status_fwconnecting, &wil->status);
                 break;
         default:
-                /* AP-like interface and monitor:
-                 * never scan, always connected
-                 */
-                if (bssid)
-                        cfg80211_del_sta(ndev, bssid, GFP_KERNEL);
                 break;
         }
 }
@@ -306,8 +314,9 @@ static void wil_target_reset(struct wil6210_priv *wil)
         int delay = 0;
         u32 hw_state;
         u32 rev_id;
+        bool is_sparrow = (wil->board->board == WIL_BOARD_SPARROW);
 
-        wil_dbg_misc(wil, "Resetting...\n");
+        wil_dbg_misc(wil, "Resetting \"%s\"...\n", wil->board->name);
 
         /* register read */
 #define R(a) ioread32(wil->csr + HOSTADDR(a))
@@ -320,35 +329,59 @@ static void wil_target_reset(struct wil6210_priv *wil)
 
         wil->hw_version = R(RGF_USER_FW_REV_ID);
         rev_id = wil->hw_version & 0xff;
+
+        /* Clear MAC link up */
+        S(RGF_HP_CTRL, BIT(15));
         /* hpal_perst_from_pad_src_n_mask */
         S(RGF_USER_CLKS_CTL_SW_RST_MASK_0, BIT(6));
         /* car_perst_rst_src_n_mask */
         S(RGF_USER_CLKS_CTL_SW_RST_MASK_0, BIT(7));
         wmb(); /* order is important here */
 
+        if (is_sparrow) {
+                W(RGF_USER_CLKS_CTL_EXT_SW_RST_VEC_0, 0x3ff81f);
+                wmb(); /* order is important here */
+        }
+
         W(RGF_USER_MAC_CPU_0,  BIT(1)); /* mac_cpu_man_rst */
         W(RGF_USER_USER_CPU_0, BIT(1)); /* user_cpu_man_rst */
         wmb(); /* order is important here */
 
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0xFE000000);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_1, 0x0000003F);
-        W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0x00000170);
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, is_sparrow ? 0x000000B0 : 0x00000170);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_0, 0xFFE7FC00);
         wmb(); /* order is important here */
 
+        if (is_sparrow) {
+                W(RGF_USER_CLKS_CTL_EXT_SW_RST_VEC_0, 0x0);
+                wmb(); /* order is important here */
+        }
+
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_1, 0);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_0, 0);
         wmb(); /* order is important here */
 
-        W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0x00000001);
-        if (rev_id == 1) {
-                W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0x00000080);
-        } else {
-                W(RGF_PCIE_LOS_COUNTER_CTL, BIT(6) | BIT(8));
+        if (is_sparrow) {
+                W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0x00000003);
+                /* reset A2 PCIE AHB */
                 W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0x00008000);
+
+        } else {
+                W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0x00000001);
+                if (rev_id == 1) {
+                        /* reset A1 BOTH PCIE AHB & PCIE RGF */
+                        W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0x00000080);
+                } else {
+                        W(RGF_PCIE_LOS_COUNTER_CTL, BIT(6) | BIT(8));
+                        W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0x00008000);
+                }
+
         }
+
+        /* TODO: check order here!!! Erez code is different */
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_0, 0);
         wmb(); /* order is important here */
 
@@ -363,7 +396,8 @@ static void wil_target_reset(struct wil6210_priv *wil)
                 }
         } while (hw_state != HW_MACHINE_BOOT_DONE);
 
-        if (rev_id == 2)
+        /* TODO: Erez check rev_id != 1 */
+        if (!is_sparrow && (rev_id != 1))
                 W(RGF_PCIE_LOS_COUNTER_CTL, BIT(8));
 
         C(RGF_USER_CLKS_CTL_0, BIT_USER_CLKS_RST_PWGD);
@@ -465,6 +499,7 @@ void wil_link_on(struct wil6210_priv *wil)
         wil_dbg_misc(wil, "%s()\n", __func__);
 
         netif_carrier_on(ndev);
+        wil_dbg_misc(wil, "netif_tx_wake : link on\n");
         netif_tx_wake_all_queues(ndev);
 }
 
@@ -475,6 +510,7 @@ void wil_link_off(struct wil6210_priv *wil)
         wil_dbg_misc(wil, "%s()\n", __func__);
 
         netif_tx_stop_all_queues(ndev);
+        wil_dbg_misc(wil, "netif_tx_stop : link off\n");
         netif_carrier_off(ndev);
 }
 
@@ -552,6 +588,8 @@ static int __wil_down(struct wil6210_priv *wil)
         napi_disable(&wil->napi_tx);
 
         if (wil->scan_request) {
+                wil_dbg_misc(wil, "Abort scan_request 0x%p\n",
+                             wil->scan_request);
                 del_timer_sync(&wil->scan_timer);
                 cfg80211_scan_done(wil->scan_request, true);
                 wil->scan_request = NULL;
diff --git a/drivers/net/wireless/ath/wil6210/netdev.c b/drivers/net/wireless/ath/wil6210/netdev.c
index 106b6dcb773a..7afce6e8c507 100644
--- a/drivers/net/wireless/ath/wil6210/netdev.c
+++ b/drivers/net/wireless/ath/wil6210/netdev.c
@@ -132,7 +132,7 @@ void *wil_if_alloc(struct device *dev, void __iomem *csr)
         ch = wdev->wiphy->bands[IEEE80211_BAND_60GHZ]->channels;
         cfg80211_chandef_create(&wdev->preset_chandef, ch, NL80211_CHAN_NO_HT);
 
-        ndev = alloc_netdev(0, "wlan%d", ether_setup);
+        ndev = alloc_netdev(0, "wlan%d", NET_NAME_UNKNOWN, ether_setup);
         if (!ndev) {
                 dev_err(dev, "alloc_netdev_mqs failed\n");
                 rc = -ENOMEM;
diff --git a/drivers/net/wireless/ath/wil6210/pcie_bus.c b/drivers/net/wireless/ath/wil6210/pcie_bus.c
index 1e2e07b9d13d..d3fbfa28db62 100644
--- a/drivers/net/wireless/ath/wil6210/pcie_bus.c
+++ b/drivers/net/wireless/ath/wil6210/pcie_bus.c
@@ -15,7 +15,6 @@
  */
 
 #include <linux/module.h>
-#include <linux/debugfs.h>
 #include <linux/pci.h>
 #include <linux/moduleparam.h>
 
@@ -27,11 +26,22 @@ MODULE_PARM_DESC(use_msi,
                  " Use MSI interrupt: "
                  "0 - don't, 1 - (default) - single, or 3");
 
+static bool debug_fw; /* = false; */
+module_param(debug_fw, bool, S_IRUGO);
+MODULE_PARM_DESC(debug_fw, " load driver if FW not ready. For FW debug");
+
 /* Bus ops */
 static int wil_if_pcie_enable(struct wil6210_priv *wil)
 {
         struct pci_dev *pdev = wil->pdev;
         int rc;
+        /* on platforms with buggy ACPI, pdev->msi_enabled may be set to
+         * allow pci_enable_device to work. This indicates INTx was not routed
+         * and only MSI should be used
+         */
+        int msi_only = pdev->msi_enabled;
+
+        pdev->msi_enabled = 0;
 
         pci_set_master(pdev);
 
@@ -63,6 +73,12 @@ static int wil_if_pcie_enable(struct wil6210_priv *wil)
 
         wil->n_msi = use_msi;
 
+        if ((wil->n_msi == 0) && msi_only) {
+                wil_err(wil, "Interrupt pin not routed, unable to use INTx\n");
+                rc = -ENODEV;
+                goto stop_master;
+        }
+
         rc = wil6210_init_irq(wil, pdev->irq);
         if (rc)
                 goto stop_master;
@@ -71,6 +87,8 @@ static int wil_if_pcie_enable(struct wil6210_priv *wil)
         mutex_lock(&wil->mutex);
         rc = wil_reset(wil);
         mutex_unlock(&wil->mutex);
+        if (debug_fw)
+                rc = 0;
         if (rc)
                 goto release_irq;
 
@@ -104,10 +122,12 @@ static int wil_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         struct wil6210_priv *wil;
         struct device *dev = &pdev->dev;
         void __iomem *csr;
+        struct wil_board *board = (struct wil_board *)id->driver_data;
         int rc;
 
         /* check HW */
-        dev_info(&pdev->dev, WIL_NAME " device found [%04x:%04x] (rev %x)\n",
+        dev_info(&pdev->dev, WIL_NAME
+                 " \"%s\" device found [%04x:%04x] (rev %x)\n", board->name,
                  (int)pdev->vendor, (int)pdev->device, (int)pdev->revision);
 
         if (pci_resource_len(pdev, 0) != WIL6210_MEM_SIZE) {
@@ -119,9 +139,16 @@ static int wil_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 
         rc = pci_enable_device(pdev);
         if (rc) {
-                dev_err(&pdev->dev, "pci_enable_device failed\n");
-                return -ENODEV;
+                dev_err(&pdev->dev,
+                        "pci_enable_device failed, retry with MSI only\n");
+                /* Work around for platforms that can't allocate IRQ:
+                 * retry with MSI only
+                 */
+                pdev->msi_enabled = 1;
+                rc = pci_enable_device(pdev);
         }
+        if (rc)
+                return -ENODEV;
         /* rollback to err_disable_pdev */
 
         rc = pci_request_region(pdev, 0, WIL_NAME);
@@ -150,6 +177,7 @@ static int wil_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 
         pci_set_drvdata(pdev, wil);
         wil->pdev = pdev;
+        wil->board = board;
 
         wil6210_clear_irq(wil);
         /* FW should raise IRQ when ready */
@@ -200,8 +228,21 @@ static void wil_pcie_remove(struct pci_dev *pdev)
         pci_disable_device(pdev);
 }
 
-static DEFINE_PCI_DEVICE_TABLE(wil6210_pcie_ids) = {
-        { PCI_DEVICE(0x1ae9, 0x0301) },
+static const struct wil_board wil_board_marlon = {
+        .board = WIL_BOARD_MARLON,
+        .name = "marlon",
+};
+
+static const struct wil_board wil_board_sparrow = {
+        .board = WIL_BOARD_SPARROW,
+        .name = "sparrow",
+};
+
+static const struct pci_device_id wil6210_pcie_ids[] = {
+        { PCI_DEVICE(0x1ae9, 0x0301),
+          .driver_data = (kernel_ulong_t)&wil_board_marlon },
+        { PCI_DEVICE(0x1ae9, 0x0310),
+          .driver_data = (kernel_ulong_t)&wil_board_sparrow },
         { /* end: all zeroes */ },
 };
 MODULE_DEVICE_TABLE(pci, wil6210_pcie_ids);
diff --git a/drivers/net/wireless/ath/wil6210/rx_reorder.c b/drivers/net/wireless/ath/wil6210/rx_reorder.c
index 747ae1275877..180ca4793904 100644
--- a/drivers/net/wireless/ath/wil6210/rx_reorder.c
+++ b/drivers/net/wireless/ath/wil6210/rx_reorder.c
@@ -116,6 +116,7 @@ void wil_rx_reorder(struct wil6210_priv *wil, struct sk_buff *skb)
 
         /* frame with out of date sequence number */
         if (seq_less(seq, r->head_seq_num)) {
+                r->ssn_last_drop = seq;
                 dev_kfree_skb(skb);
                 goto out;
         }
diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
index 0784ef3d4ce2..d3467943d39d 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.c
+++ b/drivers/net/wireless/ath/wil6210/txrx.c
@@ -525,6 +525,17 @@ void wil_netif_rx_any(struct sk_buff *skb, struct net_device *ndev)
                 ndev->stats.rx_bytes += len;
                 stats->rx_bytes += len;
         }
+        {
+                static const char * const gro_res_str[] = {
+                        [GRO_MERGED]            = "GRO_MERGED",
+                        [GRO_MERGED_FREE]       = "GRO_MERGED_FREE",
+                        [GRO_HELD]              = "GRO_HELD",
+                        [GRO_NORMAL]            = "GRO_NORMAL",
+                        [GRO_DROP]              = "GRO_DROP",
+                };
+                wil_dbg_txrx(wil, "Rx complete %d bytes => %s,\n",
+                             len, gro_res_str[rc]);
+        }
 }
 
 /**
@@ -760,7 +771,7 @@ static struct vring *wil_tx_bcast(struct wil6210_priv *wil,
                 goto found;
         }
 
-        wil_err(wil, "Tx while no vrings active?\n");
+        wil_dbg_txrx(wil, "Tx while no vrings active?\n");
 
         return NULL;
 
@@ -881,6 +892,7 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
         int nr_frags = skb_shinfo(skb)->nr_frags;
         uint f = 0;
         int vring_index = vring - wil->vring_tx;
+        struct vring_tx_data *txdata = &wil->vring_tx_data[vring_index];
         uint i = swhead;
         dma_addr_t pa;
 
@@ -953,6 +965,9 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
         wil_hex_dump_txrx("Tx ", DUMP_PREFIX_NONE, 32, 4,
                           (const void *)d, sizeof(*d), false);
 
+        if (wil_vring_is_empty(vring)) /* performance monitoring */
+                txdata->idle += get_cycles() - txdata->last_idle;
+
         /* advance swhead */
         wil_vring_advance_head(vring, nr_frags + 1);
         wil_dbg_txrx(wil, "Tx swhead %d -> %d\n", swhead, vring->swhead);
@@ -1016,15 +1031,17 @@ netdev_tx_t wil_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                 vring = wil_tx_bcast(wil, skb);
         }
         if (!vring) {
-                wil_err(wil, "No Tx VRING found for %pM\n", eth->h_dest);
+                wil_dbg_txrx(wil, "No Tx VRING found for %pM\n", eth->h_dest);
                 goto drop;
         }
         /* set up vring entry */
         rc = wil_tx_vring(wil, vring, skb);
 
         /* do we still have enough room in the vring? */
-        if (wil_vring_avail_tx(vring) < wil_vring_wmark_low(vring))
+        if (wil_vring_avail_tx(vring) < wil_vring_wmark_low(vring)) {
                 netif_tx_stop_all_queues(wil_to_ndev(wil));
+                wil_dbg_txrx(wil, "netif_tx_stop : ring full\n");
+        }
 
         switch (rc) {
         case 0:
@@ -1091,8 +1108,10 @@ int wil_tx_complete(struct wil6210_priv *wil, int ringid)
                 while (vring->swtail != new_swtail) {
                         struct vring_tx_desc dd, *d = &dd;
                         u16 dmalen;
-                        struct wil_ctx *ctx = &vring->ctx[vring->swtail];
-                        struct sk_buff *skb = ctx->skb;
+                        struct sk_buff *skb;
+
+                        ctx = &vring->ctx[vring->swtail];
+                        skb = ctx->skb;
                         _d = &vring->va[vring->swtail].tx;
 
                         *d = *_d;
@@ -1132,8 +1151,16 @@ int wil_tx_complete(struct wil6210_priv *wil, int ringid)
                         done++;
                 }
         }
-        if (wil_vring_avail_tx(vring) > wil_vring_wmark_high(vring))
+
+        if (wil_vring_is_empty(vring)) { /* performance monitoring */
+                wil_dbg_txrx(wil, "Ring[%2d] empty\n", ringid);
+                txdata->last_idle = get_cycles();
+        }
+
+        if (wil_vring_avail_tx(vring) > wil_vring_wmark_high(vring)) {
+                wil_dbg_txrx(wil, "netif_tx_wake : ring not full\n");
                 netif_tx_wake_all_queues(wil_to_ndev(wil));
+        }
 
         return done;
 }
diff --git a/drivers/net/wireless/ath/wil6210/wil6210.h b/drivers/net/wireless/ath/wil6210/wil6210.h
index e25edc52398f..67e9624f7111 100644
--- a/drivers/net/wireless/ath/wil6210/wil6210.h
+++ b/drivers/net/wireless/ath/wil6210/wil6210.h
@@ -20,9 +20,17 @@
 #include <linux/netdevice.h>
 #include <linux/wireless.h>
 #include <net/cfg80211.h>
+#include <linux/timex.h>
 
 #define WIL_NAME "wil6210"
 
+struct wil_board {
+        int board;
+#define WIL_BOARD_MARLON        (1)
+#define WIL_BOARD_SPARROW       (2)
+        const char * const name;
+};
+
 /**
  * extract bits [@b0:@b1] (inclusive) from the value @x
  * it should be @b0 <= @b1, or result is incorrect
@@ -77,6 +85,7 @@ struct RGF_ICR {
 } __packed;
 
 /* registers - FW addresses */
+#define RGF_USER_USAGE_1                (0x880004)
 #define RGF_USER_HW_MACHINE_STATE       (0x8801dc)
         #define HW_MACHINE_BOOT_DONE    (0x3fffffd)
 #define RGF_USER_USER_CPU_0             (0x8801e0)
@@ -92,6 +101,7 @@ struct RGF_ICR {
 #define RGF_USER_CLKS_CTL_SW_RST_MASK_0 (0x880b14)
 #define RGF_USER_USER_ICR               (0x880b4c) /* struct RGF_ICR */
         #define BIT_USER_USER_ICR_SW_INT_2      BIT(18)
+#define RGF_USER_CLKS_CTL_EXT_SW_RST_VEC_0      (0x880c18)
 
 #define RGF_DMA_EP_TX_ICR               (0x881bb4) /* struct RGF_ICR */
         #define BIT_DMA_EP_TX_ICR_TX_DONE       BIT(0)
@@ -120,6 +130,7 @@ struct RGF_ICR {
         #define BIT_DMA_PSEUDO_CAUSE_TX         BIT(1)
         #define BIT_DMA_PSEUDO_CAUSE_MISC       BIT(2)
 
+#define RGF_HP_CTRL                     (0x88265c)
 #define RGF_PCIE_LOS_COUNTER_CTL        (0x882dc4)
 
 /* popular locations */
@@ -134,6 +145,14 @@ struct RGF_ICR {
 #define ISR_MISC_FW_ERROR       BIT_DMA_EP_MISC_ICR_FW_INT(3)
 
 /* Hardware definitions end */
+struct fw_map {
+        u32 from; /* linker address - from, inclusive */
+        u32 to;   /* linker address - to, exclusive */
+        u32 host; /* PCI/Host address - BAR0 + 0x880000 */
+        const char *name; /* for debugfs */
+};
+/* array size should be in sync with actual definition in the wmi.c */
+extern const struct fw_map fw_mapping[7];
 
 /**
  * mk_cidxtid - construct @cidxtid field
@@ -251,7 +270,7 @@ struct vring {
  */
 struct vring_tx_data {
         int enabled;
-
+        cycles_t idle, last_idle, begin;
 };
 
 enum { /* for wil6210_priv.status */
@@ -303,6 +322,7 @@ struct wil_tid_ampdu_rx {
         u16 ssn;
         u16 buf_size;
         u16 timeout;
+        u16 ssn_last_drop;
         u8 dialog_token;
         bool first_time; /* is it 1-st time this buffer used? */
 };
@@ -363,6 +383,7 @@ struct wil6210_priv {
         ulong status;
         u32 fw_version;
         u32 hw_version;
+        struct wil_board *board;
         u8 n_mids; /* number of additional MIDs as reported by FW */
         int recovery_count; /* num of FW recovery attempts in a short time */
         unsigned long last_fw_recovery; /* jiffies of last fw recovery */
@@ -410,14 +431,10 @@ struct wil6210_priv {
         struct mutex mutex; /* for wil6210_priv access in wil_{up|down} */
         /* statistics */
         struct wil6210_stats stats;
+        atomic_t isr_count_rx, isr_count_tx;
         /* debugfs */
         struct dentry *debug;
-        struct debugfs_blob_wrapper fw_code_blob;
-        struct debugfs_blob_wrapper fw_data_blob;
-        struct debugfs_blob_wrapper fw_peri_blob;
-        struct debugfs_blob_wrapper uc_code_blob;
-        struct debugfs_blob_wrapper uc_data_blob;
-        struct debugfs_blob_wrapper rgf_blob;
+        struct debugfs_blob_wrapper blobs[ARRAY_SIZE(fw_mapping)];
 };
 
 #define wil_to_wiphy(i) (i->wdev->wiphy)
@@ -504,9 +521,14 @@ int wil6210_init_irq(struct wil6210_priv *wil, int irq);
 void wil6210_fini_irq(struct wil6210_priv *wil, int irq);
 void wil6210_disable_irq(struct wil6210_priv *wil);
 void wil6210_enable_irq(struct wil6210_priv *wil);
+int wil_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
+                         struct cfg80211_mgmt_tx_params *params,
+                         u64 *cookie);
 
 int wil6210_debugfs_init(struct wil6210_priv *wil);
 void wil6210_debugfs_remove(struct wil6210_priv *wil);
+int wil_cid_fill_sinfo(struct wil6210_priv *wil, int cid,
+                       struct station_info *sinfo);
 
 struct wireless_dev *wil_cfg80211_init(struct device *dev);
 void wil_wdev_free(struct wil6210_priv *wil);
diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
index 6cc0e182cc70..1d1d0afdd2e1 100644
--- a/drivers/net/wireless/ath/wil6210/wmi.c
+++ b/drivers/net/wireless/ath/wil6210/wmi.c
@@ -65,17 +65,17 @@
 
 /**
  * @fw_mapping provides memory remapping table
+ *
+ * array size should be in sync with the declaration in the wil6210.h
  */
-static const struct {
-        u32 from; /* linker address - from, inclusive */
-        u32 to;   /* linker address - to, exclusive */
-        u32 host; /* PCI/Host address - BAR0 + 0x880000 */
-} fw_mapping[] = {
-        {0x000000, 0x040000, 0x8c0000}, /* FW code RAM 256k */
-        {0x800000, 0x808000, 0x900000}, /* FW data RAM 32k */
-        {0x840000, 0x860000, 0x908000}, /* peripheral data RAM 128k/96k used */
-        {0x880000, 0x88a000, 0x880000}, /* various RGF */
-        {0x8c0000, 0x949000, 0x8c0000}, /* trivial mapping for upper area */
+const struct fw_map fw_mapping[] = {
+        {0x000000, 0x040000, 0x8c0000, "fw_code"}, /* FW code RAM      256k */
+        {0x800000, 0x808000, 0x900000, "fw_data"}, /* FW data RAM       32k */
+        {0x840000, 0x860000, 0x908000, "fw_peri"}, /* periph. data RAM 128k */
+        {0x880000, 0x88a000, 0x880000, "rgf"},     /* various RGF       40k */
+        {0x88a000, 0x88b000, 0x88a000, "AGC_tbl"}, /* AGC table          4k */
+        {0x88b000, 0x88c000, 0x88b000, "rgf_ext"}, /* Pcie_ext_rgf       4k */
+        {0x8c0000, 0x949000, 0x8c0000, "upper"},   /* upper area       548k */
         /*
          * 920000..930000 ucode code RAM
          * 930000..932000 ucode data RAM
@@ -327,6 +327,17 @@ static void wmi_evt_rx_mgmt(struct wil6210_priv *wil, int id, void *d, int len)
 
         if (ieee80211_is_beacon(fc) || ieee80211_is_probe_resp(fc)) {
                 struct cfg80211_bss *bss;
+                u64 tsf = le64_to_cpu(rx_mgmt_frame->u.beacon.timestamp);
+                u16 cap = le16_to_cpu(rx_mgmt_frame->u.beacon.capab_info);
+                u16 bi = le16_to_cpu(rx_mgmt_frame->u.beacon.beacon_int);
+                const u8 *ie_buf = rx_mgmt_frame->u.beacon.variable;
+                size_t ie_len = d_len - offsetof(struct ieee80211_mgmt,
+                                                 u.beacon.variable);
+                wil_dbg_wmi(wil, "Capability info : 0x%04x\n", cap);
+                wil_dbg_wmi(wil, "TSF : 0x%016llx\n", tsf);
+                wil_dbg_wmi(wil, "Beacon interval : %d\n", bi);
+                wil_hex_dump_wmi("IE ", DUMP_PREFIX_OFFSET, 16, 1, ie_buf,
+                                 ie_len, true);
 
                 bss = cfg80211_inform_bss_frame(wiphy, channel, rx_mgmt_frame,
                                                 d_len, signal, GFP_KERNEL);
@@ -351,6 +362,9 @@ static void wmi_evt_scan_complete(struct wil6210_priv *wil, int id,
                 bool aborted = (data->status != WMI_SCAN_SUCCESS);
 
                 wil_dbg_wmi(wil, "SCAN_COMPLETE(0x%08x)\n", data->status);
+                wil_dbg_misc(wil, "Complete scan_request 0x%p aborted %d\n",
+                             wil->scan_request, aborted);
+
                 del_timer_sync(&wil->scan_timer);
                 cfg80211_scan_done(wil->scan_request, aborted);
                 wil->scan_request = NULL;
@@ -668,14 +682,12 @@ void wmi_recv_cmd(struct wil6210_priv *wil)
 
         for (n = 0;; n++) {
                 u16 len;
+                bool q;
 
                 r->head = ioread32(wil->csr + HOST_MBOX +
                                    offsetof(struct wil6210_mbox_ctl, rx.head));
-                if (r->tail == r->head) {
-                        if (n == 0)
-                                wil_dbg_wmi(wil, "No events?\n");
-                        return;
-                }
+                if (r->tail == r->head)
+                        break;
 
                 wil_dbg_wmi(wil, "Mbox head %08x tail %08x\n",
                             r->head, r->tail);
@@ -684,14 +696,14 @@ void wmi_recv_cmd(struct wil6210_priv *wil)
                                      sizeof(struct wil6210_mbox_ring_desc));
                 if (d_tail.sync == 0) {
                         wil_err(wil, "Mbox evt not owned by FW?\n");
-                        return;
+                        break;
                 }
 
                 /* read cmd header from descriptor */
                 if (0 != wmi_read_hdr(wil, d_tail.addr, &hdr)) {
                         wil_err(wil, "Mbox evt at 0x%08x?\n",
                                 le32_to_cpu(d_tail.addr));
-                        return;
+                        break;
                 }
                 len = le16_to_cpu(hdr.len);
                 wil_dbg_wmi(wil, "Mbox evt %04x %04x %04x %02x\n",
@@ -705,7 +717,7 @@ void wmi_recv_cmd(struct wil6210_priv *wil)
                                              event.wmi) + len, 4),
                               GFP_KERNEL);
                 if (!evt)
-                        return;
+                        break;
 
                 evt->event.hdr = hdr;
                 cmd = (void *)&evt->event.wmi;
@@ -737,14 +749,11 @@ void wmi_recv_cmd(struct wil6210_priv *wil)
                 spin_lock_irqsave(&wil->wmi_ev_lock, flags);
                 list_add_tail(&evt->list, &wil->pending_wmi_ev);
                 spin_unlock_irqrestore(&wil->wmi_ev_lock, flags);
-                {
-                        int q = queue_work(wil->wmi_wq,
-                                           &wil->wmi_event_worker);
-                        wil_dbg_wmi(wil, "queue_work -> %d\n", q);
-                }
+                q = queue_work(wil->wmi_wq, &wil->wmi_event_worker);
+                wil_dbg_wmi(wil, "queue_work -> %d\n", q);
         }
-        if (n > 1)
-                wil_dbg_wmi(wil, "%s -> %d events processed\n", __func__, n);
+        /* normally, 1 event per IRQ should be processed */
+        wil_dbg_wmi(wil, "%s -> %d events queued\n", __func__, n);
 }
 
 int wmi_call(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len,