71 files changed, 4090 insertions, 1154 deletions
diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
index eb93711d474b..fdc56f821b5a 100644
--- a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
+++ b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
@@ -6,7 +6,7 @@
 * GPL LICENSE SUMMARY
 *
 * Copyright(c) 2015-2017 Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018-2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -20,7 +20,7 @@
 * BSD LICENSE
 *
 * Copyright(c) 2015-2017 Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018-2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -56,7 +56,7 @@
 #include "iwl-config.h"
 /* Highest firmware API version supported */
-#define IWL_22000_UCODE_API_MAX 43
+#define IWL_22000_UCODE_API_MAX 46
 /* Lowest firmware API version supported */
 #define IWL_22000_UCODE_API_MIN 39
@@ -79,11 +79,15 @@
 #define IWL_22000_HR_B_F0_FW_PRE        "iwlwifi-Qu-b0-hr-b0-"
 #define IWL_22000_QU_B_HR_B_FW_PRE      "iwlwifi-Qu-b0-hr-b0-"
 #define IWL_22000_HR_B_FW_PRE           "iwlwifi-QuQnj-b0-hr-b0-"
-#define IWL_22000_JF_B0_FW_PRE          "iwlwifi-QuQnj-a0-jf-b0-"
 #define IWL_22000_HR_A0_FW_PRE          "iwlwifi-QuQnj-a0-hr-a0-"
 #define IWL_22000_SU_Z0_FW_PRE          "iwlwifi-su-z0-"
 #define IWL_QU_B_JF_B_FW_PRE            "iwlwifi-Qu-b0-jf-b0-"
+#define IWL_QNJ_B_JF_B_FW_PRE           "iwlwifi-QuQnj-b0-jf-b0-"
 #define IWL_CC_A_FW_PRE                 "iwlwifi-cc-a0-"
+#define IWL_22000_SO_A_JF_B_FW_PRE      "iwlwifi-so-a0-jf-b0-"
+#define IWL_22000_SO_A_HR_B_FW_PRE      "iwlwifi-so-a0-hr-b0-"
+#define IWL_22000_SO_A_GF_A_FW_PRE      "iwlwifi-so-a0-gf-a0-"
+#define IWL_22000_TY_A_GF_A_FW_PRE      "iwlwifi-ty-a0-gf-a0-"
 #define IWL_22000_HR_MODULE_FIRMWARE(api) \
        IWL_22000_HR_FW_PRE __stringify(api) ".ucode"
@@ -97,16 +101,26 @@
        IWL_22000_QU_B_HR_B_FW_PRE __stringify(api) ".ucode"
 #define IWL_22000_HR_B_QNJ_MODULE_FIRMWARE(api) \
        IWL_22000_HR_B_FW_PRE __stringify(api) ".ucode"
-#define IWL_22000_JF_B0_QNJ_MODULE_FIRMWARE(api) \
-        IWL_22000_JF_B0_FW_PRE __stringify(api) ".ucode"
 #define IWL_22000_HR_A0_QNJ_MODULE_FIRMWARE(api) \
        IWL_22000_HR_A0_FW_PRE __stringify(api) ".ucode"
 #define IWL_22000_SU_Z0_MODULE_FIRMWARE(api) \
        IWL_22000_SU_Z0_FW_PRE __stringify(api) ".ucode"
 #define IWL_QU_B_JF_B_MODULE_FIRMWARE(api) \
        IWL_QU_B_JF_B_FW_PRE __stringify(api) ".ucode"
-#define IWL_CC_A_MODULE_FIRMWARE(api) \
+#define IWL_QU_B_JF_B_MODULE_FIRMWARE(api) \
+        IWL_QU_B_JF_B_FW_PRE __stringify(api) ".ucode"
+#define IWL_QNJ_B_JF_B_MODULE_FIRMWARE(api)             \
+        IWL_QNJ_B_JF_B_FW_PRE __stringify(api) ".ucode"
+#define IWL_CC_A_MODULE_FIRMWARE(api)                   \
        IWL_CC_A_FW_PRE __stringify(api) ".ucode"
+#define IWL_22000_SO_A_JF_B_MODULE_FIRMWARE(api) \
+        IWL_22000_SO_A_JF_B_FW_PRE __stringify(api) ".ucode"
+#define IWL_22000_SO_A_HR_B_MODULE_FIRMWARE(api) \
+        IWL_22000_SO_A_HR_B_FW_PRE __stringify(api) ".ucode"
+#define IWL_22000_SO_A_GF_A_MODULE_FIRMWARE(api) \
+        IWL_22000_SO_A_GF_A_FW_PRE __stringify(api) ".ucode"
+#define IWL_22000_TY_A_GF_A_MODULE_FIRMWARE(api) \
+        IWL_22000_TY_A_GF_A_FW_PRE __stringify(api) ".ucode"
 static const struct iwl_base_params iwl_22000_base_params = {
        .eeprom_size = OTP_LOW_IMAGE_SIZE_32K,
@@ -167,6 +181,10 @@ static const struct iwl_ht_params iwl_22000_ht_params = {
        .d3_debug_data_base_addr = 0x401000,                            \
        .d3_debug_data_length = 60 * 1024
+#define IWL_DEVICE_AX200_COMMON                                         \
+        IWL_DEVICE_22000_COMMON,                                        \
+        .umac_prph_offset = 0x300000
 #define IWL_DEVICE_22500                                                \
        IWL_DEVICE_22000_COMMON,                                        \
        .device_family = IWL_DEVICE_FAMILY_22000,                       \
@@ -179,6 +197,13 @@ static const struct iwl_ht_params iwl_22000_ht_params = {
        .base_params = &iwl_22560_base_params,                          \
        .csr = &iwl_csr_v2
+#define IWL_DEVICE_AX210                                                \
+        IWL_DEVICE_AX200_COMMON,                                        \
+        .device_family = IWL_DEVICE_FAMILY_AX210,                       \
+        .base_params = &iwl_22000_base_params,                          \
+        .csr = &iwl_csr_v1,                                             \
+        .min_txq_size = 128
 const struct iwl_cfg iwl22000_2ac_cfg_hr = {
        .name = "Intel(R) Dual Band Wireless AC 22000",
        .fw_name_pre = IWL_22000_HR_FW_PRE,
@@ -198,8 +223,8 @@ const struct iwl_cfg iwl22000_2ac_cfg_jf = {
        IWL_DEVICE_22500,
 };
-const struct iwl_cfg iwl22560_2ax_cfg_hr = {
+const struct iwl_cfg iwl_ax101_cfg_qu_hr = {
-        .name = "Intel(R) Wireless-AX 22560",
+        .name = "Intel(R) Wi-Fi 6 AX101",
        .fw_name_pre = IWL_22000_QU_B_HR_B_FW_PRE,
        IWL_DEVICE_22500,
        /*
@@ -220,10 +245,11 @@ const struct iwl_cfg iwl22260_2ax_cfg = {
         * HT size; mac80211 would otherwise pick the HE max (256) by default.
         */
        .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
+        .bisr_workaround = 1,
 };
 const struct iwl_cfg killer1650x_2ax_cfg = {
-        .name = "Killer(R) Wireless-AX 1650x Wireless Network Adapter (22260NGW)",
+        .name = "Killer(R) Wireless-AX 1650x Wireless Network Adapter (200NGW)",
        .fw_name_pre = IWL_CC_A_FW_PRE,
        IWL_DEVICE_22500,
        /*
@@ -232,10 +258,11 @@ const struct iwl_cfg killer1650x_2ax_cfg = {
         * HT size; mac80211 would otherwise pick the HE max (256) by default.
         */
        .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
+        .bisr_workaround = 1,
 };
 const struct iwl_cfg killer1650w_2ax_cfg = {
-        .name = "Killer(R) Wireless-AX 1650w Wireless Network Adapter (22260D2W)",
+        .name = "Killer(R) Wireless-AX 1650w Wireless Network Adapter (200D2W)",
        .fw_name_pre = IWL_CC_A_FW_PRE,
        IWL_DEVICE_22500,
        /*
@@ -244,6 +271,7 @@ const struct iwl_cfg killer1650w_2ax_cfg = {
         * HT size; mac80211 would otherwise pick the HE max (256) by default.
         */
        .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
+        .bisr_workaround = 1,
 };
 /*
@@ -275,6 +303,18 @@ const struct iwl_cfg iwl9560_2ac_160_cfg_qu_b0_jf_b0 = {
        IWL_DEVICE_22500,
 };
+const struct iwl_cfg iwl9560_2ac_cfg_qnj_jf_b0 = {
+        .name = "Intel(R) Wireless-AC 9560 160MHz",
+        .fw_name_pre = IWL_QNJ_B_JF_B_FW_PRE,
+        IWL_DEVICE_22500,
+        /*
+         * This device doesn't support receiving BlockAck with a large bitmap
+         * so we need to restrict the size of transmitted aggregation to the
+         * HT size; mac80211 would otherwise pick the HE max (256) by default.
+         */
+        .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
+};
 const struct iwl_cfg killer1550i_2ac_cfg_qu_b0_jf_b0 = {
        .name = "Killer (R) Wireless-AC 1550i Wireless Network Adapter (9560NGW)",
        .fw_name_pre = IWL_QU_B_JF_B_FW_PRE,
@@ -347,18 +387,6 @@ const struct iwl_cfg iwl22000_2ax_cfg_qnj_hr_b0 = {
        .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
 };
-const struct iwl_cfg iwl22000_2ax_cfg_qnj_jf_b0 = {
-        .name = "Intel(R) Dual Band Wireless AX 22000",
-        .fw_name_pre = IWL_22000_JF_B0_FW_PRE,
-        IWL_DEVICE_22500,
-        /*
-         * This device doesn't support receiving BlockAck with a large bitmap
-         * so we need to restrict the size of transmitted aggregation to the
-         * HT size; mac80211 would otherwise pick the HE max (256) by default.
-         */
-        .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
-};
 const struct iwl_cfg iwl22000_2ax_cfg_qnj_hr_a0 = {
        .name = "Intel(R) Dual Band Wireless AX 22000",
        .fw_name_pre = IWL_22000_HR_A0_FW_PRE,
@@ -384,13 +412,41 @@ const struct iwl_cfg iwl22560_2ax_cfg_su_cdb = {
        .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
 };
+const struct iwl_cfg iwlax210_2ax_cfg_so_jf_a0 = {
+        .name = "Intel(R) Wireless-AC 9560 160MHz",
+        .fw_name_pre = IWL_22000_SO_A_JF_B_FW_PRE,
+        IWL_DEVICE_AX210,
+};
+const struct iwl_cfg iwlax210_2ax_cfg_so_hr_a0 = {
+        .name = "Intel(R) Wi-Fi 6 AX201 160MHz",
+        .fw_name_pre = IWL_22000_SO_A_HR_B_FW_PRE,
+        IWL_DEVICE_AX210,
+};
+const struct iwl_cfg iwlax210_2ax_cfg_so_gf_a0 = {
+        .name = "Intel(R) Wi-Fi 7 AX211 160MHz",
+        .fw_name_pre = IWL_22000_SO_A_GF_A_FW_PRE,
+        IWL_DEVICE_AX210,
+};
+const struct iwl_cfg iwlax210_2ax_cfg_ty_gf_a0 = {
+        .name = "Intel(R) Wi-Fi 7 AX210 160MHz",
+        .fw_name_pre = IWL_22000_TY_A_GF_A_FW_PRE,
+        IWL_DEVICE_AX210,
+};
 MODULE_FIRMWARE(IWL_22000_HR_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_22000_JF_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_22000_HR_A_F0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_22000_HR_B_F0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_22000_HR_B_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
-MODULE_FIRMWARE(IWL_22000_JF_B0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_22000_HR_A0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_22000_SU_Z0_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_QU_B_JF_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL_QNJ_B_JF_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_CC_A_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL_22000_SO_A_JF_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL_22000_SO_A_HR_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL_22000_SO_A_GF_A_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL_22000_TY_A_GF_A_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
index 113bcf7735a0..3225b64eb845 100644
--- a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
+++ b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
@@ -57,7 +57,7 @@
 #include "fw/file.h"
 /* Highest firmware API version supported */
-#define IWL9000_UCODE_API_MAX   43
+#define IWL9000_UCODE_API_MAX   46
 /* Lowest firmware API version supported */
 #define IWL9000_UCODE_API_MIN   30
diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/agn.h b/drivers/net/wireless/intel/iwlwifi/dvm/agn.h
index 431e13c6ee35..254a5ce52456 100644
--- a/drivers/net/wireless/intel/iwlwifi/dvm/agn.h
+++ b/drivers/net/wireless/intel/iwlwifi/dvm/agn.h
@@ -439,13 +439,10 @@ static inline void iwl_dvm_set_pmi(struct iwl_priv *priv, bool state)
 }
 #ifdef CONFIG_IWLWIFI_DEBUGFS
-int iwl_dbgfs_register(struct iwl_priv *priv, struct dentry *dbgfs_dir);
+void iwl_dbgfs_register(struct iwl_priv *priv, struct dentry *dbgfs_dir);
 #else
-static inline int iwl_dbgfs_register(struct iwl_priv *priv,
+static inline void iwl_dbgfs_register(struct iwl_priv *priv,
-                                     struct dentry *dbgfs_dir)
+                                      struct dentry *dbgfs_dir) { }
-{
-        return 0;
-}
 #endif /* CONFIG_IWLWIFI_DEBUGFS */
 #ifdef CONFIG_IWLWIFI_DEBUG
diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/debugfs.c b/drivers/net/wireless/intel/iwlwifi/dvm/debugfs.c
index 3d2e44a642de..d4b19673b06a 100644
--- a/drivers/net/wireless/intel/iwlwifi/dvm/debugfs.c
+++ b/drivers/net/wireless/intel/iwlwifi/dvm/debugfs.c
@@ -3,6 +3,7 @@
 * GPL LICENSE SUMMARY
 *
 * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
+ * Copyright (C) 2018 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -36,31 +37,8 @@
 /* create and remove of files */
 #define DEBUGFS_ADD_FILE(name, parent, mode) do {                       \
-        if (!debugfs_create_file(#name, mode, parent, priv,             \
+        debugfs_create_file(#name, mode, parent, priv,                  \
-                                 &iwl_dbgfs_##name##_ops))              \
+                            &iwl_dbgfs_##name##_ops);                   \
-                goto err;                                               \
-} while (0)
-#define DEBUGFS_ADD_BOOL(name, parent, ptr) do {                        \
-        struct dentry *__tmp;                                           \
-        __tmp = debugfs_create_bool(#name, 0600, parent, ptr);          \
-        if (IS_ERR(__tmp) || !__tmp)                                    \
-                goto err;                                               \
-} while (0)
-#define DEBUGFS_ADD_X32(name, parent, ptr) do {                         \
-        struct dentry *__tmp;                                           \
-        __tmp = debugfs_create_x32(#name, 0600, parent, ptr);           \
-        if (IS_ERR(__tmp) || !__tmp)                                    \
-                goto err;                                               \
-} while (0)
-#define DEBUGFS_ADD_U32(name, parent, ptr, mode) do {                   \
-        struct dentry *__tmp;                                           \
-        __tmp = debugfs_create_u32(#name, mode,                         \
-                                   parent, ptr);                        \
-        if (IS_ERR(__tmp) || !__tmp)                                    \
-                goto err;                                               \
 } while (0)
 /* file operation */
@@ -2238,7 +2216,7 @@ static ssize_t iwl_dbgfs_log_event_write(struct file *file,
        buf_size = min(count, sizeof(buf) -  1);
        if (copy_from_user(buf, user_buf, buf_size))
                return -EFAULT;
-        if (sscanf(buf, "%d", &event_log_flag) != 1)
+        if (sscanf(buf, "%u", &event_log_flag) != 1)
                return -EFAULT;
        if (event_log_flag == 1)
                iwl_dump_nic_event_log(priv, true, NULL);
@@ -2347,21 +2325,15 @@ DEBUGFS_READ_WRITE_FILE_OPS(calib_disabled);
 * Create the debugfs files and directories
 *
 */
-int iwl_dbgfs_register(struct iwl_priv *priv, struct dentry *dbgfs_dir)
+void iwl_dbgfs_register(struct iwl_priv *priv, struct dentry *dbgfs_dir)
 {
        struct dentry *dir_data, *dir_rf, *dir_debug;
        priv->debugfs_dir = dbgfs_dir;
        dir_data = debugfs_create_dir("data", dbgfs_dir);
-        if (!dir_data)
-                goto err;
        dir_rf = debugfs_create_dir("rf", dbgfs_dir);
-        if (!dir_rf)
-                goto err;
        dir_debug = debugfs_create_dir("debug", dbgfs_dir);
-        if (!dir_debug)
-                goto err;
        DEBUGFS_ADD_FILE(nvm, dir_data, 0400);
        DEBUGFS_ADD_FILE(sram, dir_data, 0600);
@@ -2421,13 +2393,6 @@ int iwl_dbgfs_register(struct iwl_priv *priv, struct dentry *dbgfs_dir)
                snprintf(buf, 100, "../../%pd2", dev_dir);
-                if (!debugfs_create_symlink("iwlwifi", mac80211_dir, buf))
+                debugfs_create_symlink("iwlwifi", mac80211_dir, buf);
-                        goto err;
        }
-        return 0;
-err:
-        IWL_ERR(priv, "failed to create the dvm debugfs entries\n");
-        return -ENOMEM;
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/main.c b/drivers/net/wireless/intel/iwlwifi/dvm/main.c
index bd3c3b921d4c..7c68a86ed9e1 100644
--- a/drivers/net/wireless/intel/iwlwifi/dvm/main.c
+++ b/drivers/net/wireless/intel/iwlwifi/dvm/main.c
@@ -1509,13 +1509,10 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
        if (iwlagn_mac_setup_register(priv, &fw->ucode_capa))
                goto out_destroy_workqueue;
-        if (iwl_dbgfs_register(priv, dbgfs_dir))
+        iwl_dbgfs_register(priv, dbgfs_dir);
-                goto out_mac80211_unregister;
        return op_mode;
-out_mac80211_unregister:
-        iwlagn_mac_unregister(priv);
 out_destroy_workqueue:
        iwl_tt_exit(priv);
        iwl_cancel_deferred_work(priv);
@@ -1881,7 +1878,7 @@ int iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log,
                return pos;
        }
-        if (!(iwl_have_debug_level(IWL_DL_FW_ERRORS)) && !full_log)
+        if (!(iwl_have_debug_level(IWL_DL_FW)) && !full_log)
                size = (size > DEFAULT_DUMP_EVENT_LOG_ENTRIES)
                        ? DEFAULT_DUMP_EVENT_LOG_ENTRIES : size;
        IWL_ERR(priv, "Start IWL Event Log Dump: display last %u entries\n",
@@ -1897,7 +1894,7 @@ int iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log,
                if (!*buf)
                        return -ENOMEM;
        }
-        if (iwl_have_debug_level(IWL_DL_FW_ERRORS) || full_log) {
+        if (iwl_have_debug_level(IWL_DL_FW) || full_log) {
                /*
                 * if uCode has wrapped back to top of log,
                 * start at the oldest entry,
@@ -1927,7 +1924,7 @@ static void iwlagn_fw_error(struct iwl_priv *priv, bool ondemand)
        unsigned int reload_msec;
        unsigned long reload_jiffies;
-        if (iwl_have_debug_level(IWL_DL_FW_ERRORS))
+        if (iwl_have_debug_level(IWL_DL_FW))
                iwl_print_rx_config_cmd(priv, IWL_RXON_CTX_BSS);
        /* uCode is no longer loaded. */
@@ -1965,12 +1962,12 @@ static void iwlagn_fw_error(struct iwl_priv *priv, bool ondemand)
        if (!test_bit(STATUS_EXIT_PENDING, &priv->status)) {
                if (iwlwifi_mod_params.fw_restart) {
-                        IWL_DEBUG_FW_ERRORS(priv,
+                        IWL_DEBUG_FW(priv,
-                                  "Restarting adapter due to uCode error.\n");
+                                     "Restarting adapter due to uCode error.\n");
                        queue_work(priv->workqueue, &priv->restart);
                } else
-                        IWL_DEBUG_FW_ERRORS(priv,
+                        IWL_DEBUG_FW(priv,
-                                  "Detected FW error, but not restarting\n");
+                                     "Detected FW error, but not restarting\n");
        }
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/rx.c b/drivers/net/wireless/intel/iwlwifi/dvm/rx.c
index 6f17a5e24e82..e224b23f0ba8 100644
--- a/drivers/net/wireless/intel/iwlwifi/dvm/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/dvm/rx.c
@@ -2,6 +2,7 @@
 *
 * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2015 Intel Deutschland GmbH
+ * Copyright(c) 2018 Intel Corporation
 *
 * Portions of this file are derived from the ipw3945 project, as well
 * as portionhelp of the ieee80211 subsystem header files.
@@ -592,7 +593,7 @@ static int iwlagn_set_decrypted_flag(struct iwl_priv *priv,
                if ((decrypt_res & RX_RES_STATUS_DECRYPT_TYPE_MSK) ==
                    RX_RES_STATUS_BAD_KEY_TTAK)
                        break;
+                /* fall through */
        case RX_RES_STATUS_SEC_TYPE_WEP:
                if ((decrypt_res & RX_RES_STATUS_DECRYPT_TYPE_MSK) ==
                    RX_RES_STATUS_BAD_ICV_MIC) {
@@ -601,6 +602,7 @@ static int iwlagn_set_decrypted_flag(struct iwl_priv *priv,
                        IWL_DEBUG_RX(priv, "Packet destroyed\n");
                        return -1;
                }
+                /* fall through */
        case RX_RES_STATUS_SEC_TYPE_CCMP:
                if ((decrypt_res & RX_RES_STATUS_DECRYPT_TYPE_MSK) ==
                    RX_RES_STATUS_DECRYPT_OK) {
@@ -729,7 +731,7 @@ static u32 iwlagn_translate_rx_status(struct iwl_priv *priv, u32 decrypt_in)
                        decrypt_out |= RX_RES_STATUS_BAD_KEY_TTAK;
                        break;
                }
-                /* fall through if TTAK OK */
+                /* fall through */
        default:
                if (!(decrypt_in & RX_MPDU_RES_STATUS_ICV_OK))
                        decrypt_out |= RX_RES_STATUS_BAD_ICV_MIC;
diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/scan.c b/drivers/net/wireless/intel/iwlwifi/dvm/scan.c
index 8d7aafb4d9e9..f190f7beb3a8 100644
--- a/drivers/net/wireless/intel/iwlwifi/dvm/scan.c
+++ b/drivers/net/wireless/intel/iwlwifi/dvm/scan.c
@@ -3,6 +3,7 @@
 * GPL LICENSE SUMMARY
 *
 * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2018        Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -418,7 +419,7 @@ static u16 iwl_limit_dwell(struct iwl_priv *priv, u16 dwell_time)
                limit = (limits[1] * 98) / 100 - IWL_CHANNEL_TUNE_TIME * 2;
                limit /= 2;
                dwell_time = min(limit, dwell_time);
-                /* fall through to limit further */
+                /* fall through */
        case 1:
                limit = (limits[0] * 98) / 100 - IWL_CHANNEL_TUNE_TIME * 2;
                limit /= n_active;
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
index 32d000cffe9f..405038ce98d6 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
@@ -6,6 +6,7 @@
 * GPL LICENSE SUMMARY
 *
 * Copyright(c) 2017        Intel Deutschland GmbH
+ * Copyright (C) 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -26,6 +27,7 @@
 * BSD LICENSE
 *
 * Copyright(c) 2017        Intel Deutschland GmbH
+ * Copyright (C) 2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -205,3 +207,33 @@ out:
        return dflt_pwr_limit;
 }
 IWL_EXPORT_SYMBOL(iwl_acpi_get_pwr_limit);
+int iwl_acpi_get_eckv(struct device *dev, u32 *extl_clk)
+{
+        union acpi_object *wifi_pkg, *data;
+        int ret;
+        data = iwl_acpi_get_object(dev, ACPI_ECKV_METHOD);
+        if (IS_ERR(data))
+                return PTR_ERR(data);
+        wifi_pkg = iwl_acpi_get_wifi_pkg(dev, data, ACPI_ECKV_WIFI_DATA_SIZE);
+        if (IS_ERR(wifi_pkg)) {
+                ret = PTR_ERR(wifi_pkg);
+                goto out_free;
+        }
+        if (wifi_pkg->package.elements[1].type != ACPI_TYPE_INTEGER) {
+                ret = -EINVAL;
+                goto out_free;
+        }
+        *extl_clk = wifi_pkg->package.elements[1].integer.value;
+        ret = 0;
+out_free:
+        kfree(data);
+        return ret;
+}
+IWL_EXPORT_SYMBOL(iwl_acpi_get_eckv);
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.h b/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
index 7492dfb6729b..f5704e16643f 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
@@ -6,7 +6,7 @@
 * GPL LICENSE SUMMARY
 *
 * Copyright(c) 2017        Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019        Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -27,7 +27,7 @@
 * BSD LICENSE
 *
 * Copyright(c) 2017        Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019       Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -67,6 +67,7 @@
 #define ACPI_WGDS_METHOD        "WGDS"
 #define ACPI_WRDD_METHOD        "WRDD"
 #define ACPI_SPLC_METHOD        "SPLC"
+#define ACPI_ECKV_METHOD        "ECKV"
 #define ACPI_WIFI_DOMAIN        (0x07)
@@ -86,6 +87,7 @@
 #define ACPI_WGDS_WIFI_DATA_SIZE        19
 #define ACPI_WRDD_WIFI_DATA_SIZE        2
 #define ACPI_SPLC_WIFI_DATA_SIZE        2
+#define ACPI_ECKV_WIFI_DATA_SIZE        2
 #define ACPI_WGDS_NUM_BANDS             2
 #define ACPI_WGDS_TABLE_SIZE            3
@@ -109,6 +111,17 @@ int iwl_acpi_get_mcc(struct device *dev, char *mcc);
 u64 iwl_acpi_get_pwr_limit(struct device *dev);
+/*
+ * iwl_acpi_get_eckv - read external clock validation from ACPI, if available
+ *
+ * @dev: the struct device
+ * @extl_clk: output var (2 bytes) that will get the clk indication.
+ *
+ * This function tries to read the external clock indication
+ * from ACPI if available.
+ */
+int iwl_acpi_get_eckv(struct device *dev, u32 *extl_clk);
 #else /* CONFIG_ACPI */
 static inline void *iwl_acpi_get_object(struct device *dev, acpi_string method)
@@ -133,5 +146,10 @@ static inline u64 iwl_acpi_get_pwr_limit(struct device *dev)
        return 0;
 }
+static inline int iwl_acpi_get_eckv(struct device *dev, u32 *extl_clk)
+{
+        return -ENOENT;
+}
 #endif /* CONFIG_ACPI */
 #endif /* __iwl_fw_acpi__ */
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/alive.h b/drivers/net/wireless/intel/iwlwifi/fw/api/alive.h
index 08d3d8a190f6..df1bd0d2450e 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/alive.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/alive.h
@@ -96,14 +96,7 @@ enum {
 #define IWL_ALIVE_FLG_RFKILL    BIT(0)
-struct iwl_lmac_alive {
+struct iwl_lmac_debug_addrs {
-        __le32 ucode_major;
-        __le32 ucode_minor;
-        u8 ver_subtype;
-        u8 ver_type;
-        u8 mac;
-        u8 opt;
-        __le32 timestamp;
        __le32 error_event_table_ptr;   /* SRAM address for error log */
        __le32 log_event_table_ptr;     /* SRAM address for LMAC event log */
        __le32 cpu_register_ptr;
@@ -112,13 +105,28 @@ struct iwl_lmac_alive {
        __le32 scd_base_ptr;            /* SRAM address for SCD */
        __le32 st_fwrd_addr;            /* pointer to Store and forward */
        __le32 st_fwrd_size;
+} __packed; /* UCODE_DEBUG_ADDRS_API_S_VER_2 */
+struct iwl_lmac_alive {
+        __le32 ucode_major;
+        __le32 ucode_minor;
+        u8 ver_subtype;
+        u8 ver_type;
+        u8 mac;
+        u8 opt;
+        __le32 timestamp;
+        struct iwl_lmac_debug_addrs dbg_ptrs;
 } __packed; /* UCODE_ALIVE_NTFY_API_S_VER_3 */
+struct iwl_umac_debug_addrs {
+        __le32 error_info_addr;         /* SRAM address for UMAC error log */
+        __le32 dbg_print_buff_addr;
+} __packed; /* UMAC_DEBUG_ADDRS_API_S_VER_1 */
 struct iwl_umac_alive {
        __le32 umac_major;              /* UMAC version: major */
        __le32 umac_minor;              /* UMAC version: minor */
-        __le32 error_info_addr;         /* SRAM address for UMAC error log */
+        struct iwl_umac_debug_addrs dbg_ptrs;
-        __le32 dbg_print_buff_addr;
 } __packed; /* UMAC_ALIVE_DATA_API_S_VER_2 */
 struct mvm_alive_resp_v3 {
@@ -189,4 +197,24 @@ struct iwl_card_state_notif {
        __le32 flags;
 } __packed; /* CARD_STATE_NTFY_API_S_VER_1 */
+/**
+ * enum iwl_error_recovery_flags - flags for error recovery cmd
+ * @ERROR_RECOVERY_UPDATE_DB: update db from blob sent
+ * @ERROR_RECOVERY_END_OF_RECOVERY: end of recovery
+ */
+enum iwl_error_recovery_flags {
+        ERROR_RECOVERY_UPDATE_DB = BIT(0),
+        ERROR_RECOVERY_END_OF_RECOVERY = BIT(1),
+};
+/**
+ * struct iwl_fw_error_recovery_cmd - recovery cmd sent upon assert
+ * @flags: &enum iwl_error_recovery_flags
+ * @buf_size: db buffer size in bytes
+ */
+struct iwl_fw_error_recovery_cmd {
+        __le32 flags;
+        __le32 buf_size;
+} __packed; /* ERROR_RECOVERY_CMD_HDR_API_S_VER_1 */
 #endif /* __iwl_fw_api_alive_h__ */
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/commands.h b/drivers/net/wireless/intel/iwlwifi/fw/api/commands.h
index 0290b333d860..4d2274bcc0b5 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/commands.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/commands.h
@@ -643,6 +643,11 @@ enum iwl_system_subcmd_ids {
         * @INIT_EXTENDED_CFG_CMD: &struct iwl_init_extended_cfg_cmd
         */
        INIT_EXTENDED_CFG_CMD = 0x03,
+        /**
+         * @FW_ERROR_RECOVERY_CMD: &struct iwl_fw_error_recovery_cmd
+         */
+        FW_ERROR_RECOVERY_CMD = 0x7,
 };
 #endif /* __iwl_fw_api_commands_h__ */
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/dbg-tlv.h b/drivers/net/wireless/intel/iwlwifi/fw/api/dbg-tlv.h
index ab82b7a67967..33858787817b 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/dbg-tlv.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/dbg-tlv.h
@@ -5,7 +5,7 @@
 *
 * GPL LICENSE SUMMARY
 *
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018 - 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -25,7 +25,7 @@
 *
 * BSD LICENSE
 *
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018 - 2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -70,7 +70,7 @@ struct iwl_fw_ini_header {
        __le32 tlv_version;
        __le32 apply_point;
        u8 data[];
-} __packed; /* FW_INI_HEADER_TLV_S */
+} __packed; /* FW_DEBUG_TLV_HEADER_S */
 /**
 * struct iwl_fw_ini_allocation_tlv - (IWL_FW_INI_TLV_TYPE_BUFFER_ALLOCATION)
@@ -92,7 +92,7 @@ struct iwl_fw_ini_allocation_tlv {
        __le32 size;
        __le32 max_fragments;
        __le32 min_frag_size;
-} __packed; /* FW_INI_BUFFER_ALLOCATION_TLV_S_VER_1 */
+} __packed; /* FW_DEBUG_TLV_BUFFER_ALLOCATION_TLV_S_VER_1 */
 /**
 * struct iwl_fw_ini_hcmd (IWL_FW_INI_TLV_TYPE_HCMD)
@@ -108,7 +108,7 @@ struct iwl_fw_ini_hcmd {
        u8 group;
        __le16 padding;
        u8 data[0];
-} __packed; /* FW_INI_HCMD_S */
+} __packed; /* FW_DEBUG_TLV_HCMD_DATA_S */
 /**
 * struct iwl_fw_ini_hcmd_tlv
@@ -118,7 +118,7 @@ struct iwl_fw_ini_hcmd {
 struct iwl_fw_ini_hcmd_tlv {
        struct iwl_fw_ini_header header;
        struct iwl_fw_ini_hcmd hcmd;
-} __packed; /* FW_INI_HCMD_TLV_S_VER_1 */
+} __packed; /* FW_DEBUG_TLV_HCMD_S_VER_1 */
 /*
 * struct iwl_fw_ini_debug_flow_tlv (IWL_FW_INI_TLV_TYPE_DEBUG_FLOW)
@@ -129,20 +129,50 @@ struct iwl_fw_ini_hcmd_tlv {
 struct iwl_fw_ini_debug_flow_tlv {
        struct iwl_fw_ini_header header;
        __le32 debug_flow_cfg;
-} __packed; /* FW_INI_DEBUG_FLOW_TLV_S_VER_1 */
+} __packed; /* FW_DEBUG_TLV_FLOW_TLV_S_VER_1 */
-#define IWL_FW_INI_MAX_REGION_ID        20
+#define IWL_FW_INI_MAX_REGION_ID        64
 #define IWL_FW_INI_MAX_NAME             32
+/**
+ * struct iwl_fw_ini_region_cfg_internal - meta data of internal memory region
+ * @num_of_range: the amount of ranges in the region
+ * @range_data_size: size of the data to read per range, in bytes.
+ */
+struct iwl_fw_ini_region_cfg_internal {
+        __le32 num_of_ranges;
+        __le32 range_data_size;
+} __packed; /* FW_DEBUG_TLV_REGION_NIC_INTERNAL_RANGES_S */
+/**
+ * struct iwl_fw_ini_region_cfg_fifos - meta data of fifos region
+ * @fid1: fifo id 1 - bitmap of lmac tx/rx fifos to include in the region
+ * @fid2: fifo id 2 - bitmap of umac rx fifos to include in the region.
+ *      It is unused for tx.
+ * @num_of_registers: number of prph registers in the region, each register is
+ *      4 bytes size.
+ * @header_only: none zero value indicates that this region does not include
+ *      fifo data and includes only the given registers.
+ */
+struct iwl_fw_ini_region_cfg_fifos {
+        __le32 fid1;
+        __le32 fid2;
+        __le32 num_of_registers;
+        __le32 header_only;
+} __packed; /* FW_DEBUG_TLV_REGION_FIFOS_S */
 /**
 * struct iwl_fw_ini_region_cfg
 * @region_id: ID of this dump configuration
 * @region_type: &enum iwl_fw_ini_region_type
 * @num_regions: amount of regions in the address array.
- * @allocation_id: For DRAM type field substitutes for allocation_id.
 * @name_len: name length
 * @name: file name to use for this region
- * @size: size of the data, in bytes.(unused for IWL_FW_INI_REGION_DRAM_BUFFER)
+ * @internal: used in case the region uses internal memory.
- * @start_addr: array of addresses. (unused for IWL_FW_INI_REGION_DRAM_BUFFER)
+ * @allocation_id: For DRAM type field substitutes for allocation_id
+ * @fifos: used in case of fifos region.
+ * @offset: offset to use for each memory base address
+ * @start_addr: array of addresses.
 */
 struct iwl_fw_ini_region_cfg {
        __le32 region_id;
@@ -150,32 +180,38 @@ struct iwl_fw_ini_region_cfg {
        __le32 name_len;
        u8 name[IWL_FW_INI_MAX_NAME];
        union {
-                __le32 num_regions;
+                struct iwl_fw_ini_region_cfg_internal internal;
                __le32 allocation_id;
+                struct iwl_fw_ini_region_cfg_fifos fifos;
        };
-        __le32 size;
+        __le32 offset;
        __le32 start_addr[];
-} __packed; /* FW_INI_REGION_CONFIG_S */
+} __packed; /* FW_DEBUG_TLV_REGION_CONFIG_S */
 /**
 * struct iwl_fw_ini_region_tlv - (IWL_FW_INI_TLV_TYPE_REGION_CFG)
 * DUMP sections define IDs and triggers that use those IDs TLV
 * @header: header
 * @num_regions: how many different region section and IDs are coming next
- * @iwl_fw_ini_dump dump_config: list of dump configurations
+ * @region_config: list of dump configurations
 */
 struct iwl_fw_ini_region_tlv {
        struct iwl_fw_ini_header header;
        __le32 num_regions;
        struct iwl_fw_ini_region_cfg region_config[];
-} __packed; /* FW_INI_REGION_CFG_S */
+} __packed; /* FW_DEBUG_TLV_REGIONS_S_VER_1 */
 /**
 * struct iwl_fw_ini_trigger - (IWL_FW_INI_TLV_TYPE_DUMP_CFG)
 * Region sections define IDs and triggers that use those IDs TLV
 *
 * @trigger_id: enum &iwl_fw_ini_tigger_id
- * @ignore_default: override FW TLV with binary TLV
+ * @override_trig: determines how apply trigger in case a trigger with the
+ *      same id is already in use. Using the first 2 bytes:
+ *      Byte 0: if 0, override trigger configuration, otherwise use the
+ *      existing configuration.
+ *      Byte 1: if 0, override trigger regions, otherwise append regions to
+ *      existing trigger.
 * @dump_delay: delay from trigger fire to dump, in usec
 * @occurrences: max amount of times to be fired
 * @ignore_consec: ignore consecutive triggers, in usec
@@ -187,7 +223,7 @@ struct iwl_fw_ini_region_tlv {
 */
 struct iwl_fw_ini_trigger {
        __le32 trigger_id;
-        __le32 ignore_default;
+        __le32 override_trig;
        __le32 dump_delay;
        __le32 occurrences;
        __le32 ignore_consec;
@@ -196,7 +232,7 @@ struct iwl_fw_ini_trigger {
        __le32 trigger_data;
        __le32 num_regions;
        __le32 data[];
-} __packed; /* FW_INI_TRIGGER_CONFIG_S */
+} __packed; /* FW_TLV_DEBUG_TRIGGER_CONFIG_S */
 /**
 * struct iwl_fw_ini_trigger_tlv - (IWL_FW_INI_TLV_TYPE_TRIGGERS_CFG)
@@ -210,20 +246,17 @@ struct iwl_fw_ini_trigger_tlv {
        struct iwl_fw_ini_header header;
        __le32 num_triggers;
        struct iwl_fw_ini_trigger trigger_config[];
-} __packed; /* FW_INI_TRIGGER_CFG_S */
+} __packed; /* FW_TLV_DEBUG_TRIGGERS_S_VER_1 */
 /**
 * enum iwl_fw_ini_trigger_id
 * @IWL_FW_TRIGGER_ID_FW_ASSERT: FW assert
- * @IWL_FW_TRIGGER_ID_FW_TFD_Q_HANG: TFD queue hang
 * @IWL_FW_TRIGGER_ID_FW_HW_ERROR: HW assert
- * @IWL_FW_TRIGGER_ID_FW_TRIGGER_ERROR: FW error notification
+ * @IWL_FW_TRIGGER_ID_FW_TFD_Q_HANG: TFD queue hang
- * @IWL_FW_TRIGGER_ID_FW_TRIGGER_WARNING: FW warning notification
+ * @IWL_FW_TRIGGER_ID_FW_DEBUG_HOST_TRIGGER: FW debug notification
- * @IWL_FW_TRIGGER_ID_FW_TRIGGER_INFO: FW info notification
+ * @IWL_FW_TRIGGER_ID_FW_GENERIC_NOTIFOCATION: FW generic notification
- * @IWL_FW_TRIGGER_ID_FW_TRIGGER_DEBUG: FW debug notification
 * @IWL_FW_TRIGGER_ID_USER_TRIGGER: User trigger
 * @IWL_FW_TRIGGER_ID_HOST_PEER_CLIENT_INACTIVITY: peer inactivity
- * @FW_DEBUG_TLV_TRIGGER_ID_HOST_DID_INITIATED_EVENT: undefined
 * @IWL_FW_TRIGGER_ID_HOST_TX_LATENCY_THRESHOLD_CROSSED: TX latency
 *      threshold was crossed
 * @IWL_FW_TRIGGER_ID_HOST_TX_RESPONSE_STATUS_FAILED: TX failed
@@ -257,50 +290,53 @@ struct iwl_fw_ini_trigger_tlv {
 * @IWL_FW_TRIGGER_ID_NUM: number of trigger IDs
 */
 enum iwl_fw_ini_trigger_id {
+        IWL_FW_TRIGGER_ID_INVALID                               = 0,
        /* Errors triggers */
        IWL_FW_TRIGGER_ID_FW_ASSERT                             = 1,
-        IWL_FW_TRIGGER_ID_FW_TFD_Q_HANG                         = 2,
+        IWL_FW_TRIGGER_ID_FW_HW_ERROR                           = 2,
-        IWL_FW_TRIGGER_ID_FW_HW_ERROR                           = 3,
+        IWL_FW_TRIGGER_ID_FW_TFD_Q_HANG                         = 3,
-        /* Generic triggers */
-        IWL_FW_TRIGGER_ID_FW_TRIGGER_ERROR                      = 4,
+        /* FW triggers */
-        IWL_FW_TRIGGER_ID_FW_TRIGGER_WARNING                    = 5,
+        IWL_FW_TRIGGER_ID_FW_DEBUG_HOST_TRIGGER                 = 4,
-        IWL_FW_TRIGGER_ID_FW_TRIGGER_INFO                       = 6,
+        IWL_FW_TRIGGER_ID_FW_GENERIC_NOTIFOCATION               = 5,
-        IWL_FW_TRIGGER_ID_FW_TRIGGER_DEBUG                      = 7,
-        /* User Trigger */
+        /* User trigger */
-        IWL_FW_TRIGGER_ID_USER_TRIGGER                          = 8,
+        IWL_FW_TRIGGER_ID_USER_TRIGGER                          = 6,
        /* Host triggers */
-        IWL_FW_TRIGGER_ID_HOST_PEER_CLIENT_INACTIVITY           = 9,
+        IWL_FW_TRIGGER_ID_HOST_PEER_CLIENT_INACTIVITY           = 7,
-        IWL_FW_TRIGGER_ID_HOST_DID_INITIATED_EVENT              = 10,
+        IWL_FW_TRIGGER_ID_HOST_TX_LATENCY_THRESHOLD_CROSSED     = 8,
-        IWL_FW_TRIGGER_ID_HOST_TX_LATENCY_THRESHOLD_CROSSED     = 11,
+        IWL_FW_TRIGGER_ID_HOST_TX_RESPONSE_STATUS_FAILED        = 9,
-        IWL_FW_TRIGGER_ID_HOST_TX_RESPONSE_STATUS_FAILED        = 12,
+        IWL_FW_TRIGGER_ID_HOST_OS_REQ_DEAUTH_PEER               = 10,
-        IWL_FW_TRIGGER_ID_HOST_OS_REQ_DEAUTH_PEER               = 13,
+        IWL_FW_TRIGGER_ID_HOST_STOP_GO_REQUEST                  = 11,
-        IWL_FW_TRIGGER_ID_HOST_STOP_GO_REQUEST                  = 14,
+        IWL_FW_TRIGGER_ID_HOST_START_GO_REQUEST                 = 12,
-        IWL_FW_TRIGGER_ID_HOST_START_GO_REQUEST                 = 15,
+        IWL_FW_TRIGGER_ID_HOST_JOIN_GROUP_REQUEST               = 13,
-        IWL_FW_TRIGGER_ID_HOST_JOIN_GROUP_REQUEST               = 16,
+        IWL_FW_TRIGGER_ID_HOST_SCAN_START                       = 14,
-        IWL_FW_TRIGGER_ID_HOST_SCAN_START                       = 17,
+        IWL_FW_TRIGGER_ID_HOST_SCAN_SUBMITTED                   = 15,
-        IWL_FW_TRIGGER_ID_HOST_SCAN_SUBITTED                    = 18,
+        IWL_FW_TRIGGER_ID_HOST_SCAN_PARAMS                      = 16,
-        IWL_FW_TRIGGER_ID_HOST_SCAN_PARAMS                      = 19,
+        IWL_FW_TRIGGER_ID_HOST_CHECK_FOR_HANG                   = 17,
-        IWL_FW_TRIGGER_ID_HOST_CHECK_FOR_HANG                   = 20,
+        IWL_FW_TRIGGER_ID_HOST_BAR_RECEIVED                     = 18,
-        IWL_FW_TRIGGER_ID_HOST_BAR_RECEIVED                     = 21,
+        IWL_FW_TRIGGER_ID_HOST_AGG_TX_RESPONSE_STATUS_FAILED    = 19,
-        IWL_FW_TRIGGER_ID_HOST_AGG_TX_RESPONSE_STATUS_FAILED    = 22,
+        IWL_FW_TRIGGER_ID_HOST_EAPOL_TX_RESPONSE_FAILED         = 20,
-        IWL_FW_TRIGGER_ID_HOST_EAPOL_TX_RESPONSE_FAILED         = 23,
+        IWL_FW_TRIGGER_ID_HOST_FAKE_TX_RESPONSE_SUSPECTED       = 21,
-        IWL_FW_TRIGGER_ID_HOST_FAKE_TX_RESPONSE_SUSPECTED       = 24,
+        IWL_FW_TRIGGER_ID_HOST_AUTH_REQ_FROM_ASSOC_CLIENT       = 22,
-        IWL_FW_TRIGGER_ID_HOST_AUTH_REQ_FROM_ASSOC_CLIENT       = 25,
+        IWL_FW_TRIGGER_ID_HOST_ROAM_COMPLETE                    = 23,
-        IWL_FW_TRIGGER_ID_HOST_ROAM_COMPLETE                    = 26,
+        IWL_FW_TRIGGER_ID_HOST_AUTH_ASSOC_FAST_FAILED           = 24,
-        IWL_FW_TRIGGER_ID_HOST_AUTH_ASSOC_FAST_FAILED           = 27,
+        IWL_FW_TRIGGER_ID_HOST_D3_START                         = 25,
-        IWL_FW_TRIGGER_ID_HOST_D3_START                         = 28,
+        IWL_FW_TRIGGER_ID_HOST_D3_END                           = 26,
-        IWL_FW_TRIGGER_ID_HOST_D3_END                           = 29,
+        IWL_FW_TRIGGER_ID_HOST_BSS_MISSED_BEACONS               = 27,
-        IWL_FW_TRIGGER_ID_HOST_BSS_MISSED_BEACONS               = 30,
+        IWL_FW_TRIGGER_ID_HOST_P2P_CLIENT_MISSED_BEACONS        = 28,
-        IWL_FW_TRIGGER_ID_HOST_P2P_CLIENT_MISSED_BEACONS        = 31,
+        IWL_FW_TRIGGER_ID_HOST_PEER_CLIENT_TX_FAILURES          = 29,
-        IWL_FW_TRIGGER_ID_HOST_PEER_CLIENT_TX_FAILURES          = 32,
+        IWL_FW_TRIGGER_ID_HOST_TX_WFD_ACTION_FRAME_FAILED       = 30,
-        IWL_FW_TRIGGER_ID_HOST_TX_WFD_ACTION_FRAME_FAILED       = 33,
+        IWL_FW_TRIGGER_ID_HOST_AUTH_ASSOC_FAILED                = 31,
-        IWL_FW_TRIGGER_ID_HOST_AUTH_ASSOC_FAILED                = 34,
+        IWL_FW_TRIGGER_ID_HOST_SCAN_COMPLETE                    = 32,
-        IWL_FW_TRIGGER_ID_HOST_SCAN_COMPLETE                    = 35,
+        IWL_FW_TRIGGER_ID_HOST_SCAN_ABORT                       = 33,
-        IWL_FW_TRIGGER_ID_HOST_SCAN_ABORT                       = 36,
+        IWL_FW_TRIGGER_ID_HOST_NIC_ALIVE                        = 34,
-        IWL_FW_TRIGGER_ID_HOST_NIC_ALIVE                        = 37,
+        IWL_FW_TRIGGER_ID_HOST_CHANNEL_SWITCH_COMPLETE          = 35,
-        IWL_FW_TRIGGER_ID_HOST_CHANNEL_SWITCH_COMPLETE          = 38,
        IWL_FW_TRIGGER_ID_NUM,
-}; /* FW_INI_TRIGGER_ID_E_VER_1 */
+}; /* FW_DEBUG_TLV_TRIGGER_ID_E_VER_1 */
 /**
 * enum iwl_fw_ini_apply_point
@@ -320,7 +356,7 @@ enum iwl_fw_ini_apply_point {
        IWL_FW_INI_APPLY_MISSED_BEACONS,
        IWL_FW_INI_APPLY_SCAN_COMPLETE,
        IWL_FW_INI_APPLY_NUM,
-}; /* FW_INI_APPLY_POINT_E_VER_1 */
+}; /* FW_DEBUG_TLV_APPLY_POINT_E_VER_1 */
 /**
 * enum iwl_fw_ini_allocation_id
@@ -340,7 +376,7 @@ enum iwl_fw_ini_allocation_id {
        IWL_FW_INI_ALLOCATION_ID_SDFX,
        IWL_FW_INI_ALLOCATION_ID_FW_DUMP,
        IWL_FW_INI_ALLOCATION_ID_USER_DEFINED,
-}; /* FW_INI_ALLOCATION_ID_E_VER_1 */
+}; /* FW_DEBUG_TLV_ALLOCATION_ID_E_VER_1 */
 /**
 * enum iwl_fw_ini_buffer_location
@@ -349,10 +385,10 @@ enum iwl_fw_ini_allocation_id {
 * @IWL_FW_INI_LOCATION_DRAM_PATH: DRAM location
 */
 enum iwl_fw_ini_buffer_location {
-        IWL_FW_INI_LOCATION_SRAM_INVALID,
+        IWL_FW_INI_LOCATION_INVALID,
        IWL_FW_INI_LOCATION_SRAM_PATH,
        IWL_FW_INI_LOCATION_DRAM_PATH,
-}; /* FW_INI_BUFFER_LOCATION_E_VER_1 */
+}; /* FW_DEBUG_TLV_BUFFER_LOCATION_E_VER_1 */
 /**
 * enum iwl_fw_ini_debug_flow
@@ -364,7 +400,7 @@ enum iwl_fw_ini_debug_flow {
        IWL_FW_INI_DEBUG_INVALID,
        IWL_FW_INI_DEBUG_DBTR_FLOW,
        IWL_FW_INI_DEBUG_TB2DTF_FLOW,
-}; /* FW_INI_DEBUG_FLOW_E_VER_1 */
+}; /* FW_DEBUG_TLV_FLOW_E_VER_1 */
 /**
 * enum iwl_fw_ini_region_type
@@ -396,6 +432,6 @@ enum iwl_fw_ini_region_type {
        IWL_FW_INI_REGION_PAGING,
        IWL_FW_INI_REGION_CSR,
        IWL_FW_INI_REGION_NUM
-}; /* FW_INI_REGION_TYPE_E_VER_1*/
+}; /* FW_DEBUG_TLV_REGION_TYPE_E_VER_1 */
 #endif
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/location.h b/drivers/net/wireless/intel/iwlwifi/fw/api/location.h
index 6da91ec0df55..5dddb21c1c4d 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/location.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/location.h
@@ -7,6 +7,7 @@
 *
 * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
 * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -28,6 +29,7 @@
 *
 * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
 * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -322,7 +324,7 @@ enum iwl_tof_location_query {
 };
 /**
- * struct iwl_tof_range_req_ap_entry - AP configuration parameters
+ * struct iwl_tof_range_req_ap_entry_v2 - AP configuration parameters
 * @channel_num: Current AP Channel
 * @bandwidth: Current AP Bandwidth. One of iwl_tof_bandwidth.
 * @tsf_delta_direction: TSF relatively to the subject AP
@@ -355,7 +357,7 @@ enum iwl_tof_location_query {
 * @notify_mcsi: &enum iwl_tof_mcsi_ntfy.
 * @reserved: For alignment and future use
 */
-struct iwl_tof_range_req_ap_entry {
+struct iwl_tof_range_req_ap_entry_v2 {
        u8 channel_num;
        u8 bandwidth;
        u8 tsf_delta_direction;
@@ -374,6 +376,62 @@ struct iwl_tof_range_req_ap_entry {
        u8 algo_type;
        u8 notify_mcsi;
        __le16 reserved;
+} __packed; /* LOCATION_RANGE_REQ_AP_ENTRY_CMD_API_S_VER_2 */
+/**
+ * enum iwl_initiator_ap_flags - per responder FTM configuration flags
+ * @IWL_INITIATOR_AP_FLAGS_ASAP: Request for ASAP measurement.
+ * @IWL_INITIATOR_AP_FLAGS_LCI_REQUEST: Request for LCI information
+ * @IWL_INITIATOR_AP_FLAGS_CIVIC_REQUEST: Request for CIVIC information
+ * @IWL_INITIATOR_AP_FLAGS_DYN_ACK: Send HT/VHT ack for FTM frames. If not set,
+ *      20Mhz dup acks will be sent.
+ * @IWL_INITIATOR_AP_FLAGS_ALGO_LR: Use LR algo type for rtt calculation.
+ *      Default algo type is ML.
+ * @IWL_INITIATOR_AP_FLAGS_ALGO_FFT: Use FFT algo type for rtt calculation.
+ *      Default algo type is ML.
+ * @IWL_INITIATOR_AP_FLAGS_MCSI_REPORT: Send the MCSI for each FTM frame to the
+ *      driver.
+ */
+enum iwl_initiator_ap_flags {
+        IWL_INITIATOR_AP_FLAGS_ASAP = BIT(1),
+        IWL_INITIATOR_AP_FLAGS_LCI_REQUEST = BIT(2),
+        IWL_INITIATOR_AP_FLAGS_CIVIC_REQUEST = BIT(3),
+        IWL_INITIATOR_AP_FLAGS_DYN_ACK = BIT(4),
+        IWL_INITIATOR_AP_FLAGS_ALGO_LR = BIT(5),
+        IWL_INITIATOR_AP_FLAGS_ALGO_FFT = BIT(6),
+        IWL_INITIATOR_AP_FLAGS_MCSI_REPORT = BIT(8),
+};
+/**
+ * struct iwl_tof_range_req_ap_entry - AP configuration parameters
+ * @initiator_ap_flags: see &enum iwl_initiator_ap_flags.
+ * @channel_num: AP Channel number
+ * @bandwidth: AP bandwidth. One of iwl_tof_bandwidth.
+ * @ctrl_ch_position: Coding of the control channel position relative to the
+ *      center frequency, see iwl_mvm_get_ctrl_pos().
+ * @ftmr_max_retries: Max number of retries to send the FTMR in case of no
+ *      reply from the AP.
+ * @bssid: AP's BSSID
+ * @burst_period: Recommended value to be sent to the AP. Measurement
+ *      periodicity In units of 100ms. ignored if num_of_bursts_exp = 0
+ * @samples_per_burst: the number of FTMs pairs in single Burst (1-31);
+ * @num_of_bursts: Recommended value to be sent to the AP. 2s Exponent of
+ *      the number of measurement iterations (min 2^0 = 1, max 2^14)
+ * @reserved: For alignment and future use
+ * @tsf_delta: not in use
+ */
+struct iwl_tof_range_req_ap_entry {
+        __le32 initiator_ap_flags;
+        u8 channel_num;
+        u8 bandwidth;
+        u8 ctrl_ch_position;
+        u8 ftmr_max_retries;
+        u8 bssid[ETH_ALEN];
+        __le16 burst_period;
+        u8 samples_per_burst;
+        u8 num_of_bursts;
+        __le16 reserved;
+        __le32 tsf_delta;
 } __packed; /* LOCATION_RANGE_REQ_AP_ENTRY_CMD_API_S_VER_3 */
 /**
@@ -403,7 +461,12 @@ enum iwl_tof_response_mode {
 * @IWL_TOF_INITIATOR_FLAGS_TX_CHAIN_SEL_A: use antenna A fo TX ACKs during FTM
 * @IWL_TOF_INITIATOR_FLAGS_TX_CHAIN_SEL_B: use antenna B fo TX ACKs during FTM
 * @IWL_TOF_INITIATOR_FLAGS_TX_CHAIN_SEL_C: use antenna C fo TX ACKs during FTM
- * @IWL_TOF_INITIATOR_FLAGS_MINDELTA_NO_PREF: no preference for minDeltaFTM
+ * @IWL_TOF_INITIATOR_FLAGS_MACADDR_RANDOM: use random mac address for FTM
+ * @IWL_TOF_INITIATOR_FLAGS_SPECIFIC_CALIB: use the specific calib value from
+ *      the range request command
+ * @IWL_TOF_INITIATOR_FLAGS_COMMON_CALIB: use the common calib value from the
+ *      ragne request command
+ * @IWL_TOF_INITIATOR_FLAGS_NON_ASAP_SUPPORT: support non-asap measurements
 */
 enum iwl_tof_initiator_flags {
        IWL_TOF_INITIATOR_FLAGS_FAST_ALGO_DISABLED = BIT(0),
@@ -413,14 +476,17 @@ enum iwl_tof_initiator_flags {
        IWL_TOF_INITIATOR_FLAGS_TX_CHAIN_SEL_A = BIT(4),
        IWL_TOF_INITIATOR_FLAGS_TX_CHAIN_SEL_B = BIT(5),
        IWL_TOF_INITIATOR_FLAGS_TX_CHAIN_SEL_C = BIT(6),
-        IWL_TOF_INITIATOR_FLAGS_MINDELTA_NO_PREF = BIT(7),
+        IWL_TOF_INITIATOR_FLAGS_MACADDR_RANDOM = BIT(7),
+        IWL_TOF_INITIATOR_FLAGS_SPECIFIC_CALIB = BIT(15),
+        IWL_TOF_INITIATOR_FLAGS_COMMON_CALIB   = BIT(16),
+        IWL_TOF_INITIATOR_FLAGS_NON_ASAP_SUPPORT = BIT(20),
 }; /* LOCATION_RANGE_REQ_CMD_API_S_VER_5 */
 #define IWL_MVM_TOF_MAX_APS 5
 #define IWL_MVM_TOF_MAX_TWO_SIDED_APS 5
 /**
- * struct iwl_tof_range_req_cmd - start measurement cmd
+ * struct iwl_tof_range_req_cmd_v5 - start measurement cmd
 * @initiator_flags: see flags @ iwl_tof_initiator_flags
 * @request_id: A Token incremented per request. The same Token will be
 *              sent back in the range response
@@ -448,7 +514,7 @@ enum iwl_tof_initiator_flags {
 * @specific_calib: The specific calib value to inject to this measurement calc
 * @ap: per-AP request data
 */
-struct iwl_tof_range_req_cmd {
+struct iwl_tof_range_req_cmd_v5 {
        __le32 initiator_flags;
        u8 request_id;
        u8 initiator;
@@ -465,10 +531,42 @@ struct iwl_tof_range_req_cmd {
        u8 ftm_tx_chains;
        __le16 common_calib;
        __le16 specific_calib;
-        struct iwl_tof_range_req_ap_entry ap[IWL_MVM_TOF_MAX_APS];
+        struct iwl_tof_range_req_ap_entry_v2 ap[IWL_MVM_TOF_MAX_APS];
 } __packed;
 /* LOCATION_RANGE_REQ_CMD_API_S_VER_5 */
+/**
+ * struct iwl_tof_range_req_cmd - start measurement cmd
+ * @initiator_flags: see flags @ iwl_tof_initiator_flags
+ * @request_id: A Token incremented per request. The same Token will be
+ *              sent back in the range response
+ * @num_of_ap: Number of APs to measure (error if > IWL_MVM_TOF_MAX_APS)
+ * @range_req_bssid: ranging request BSSID
+ * @macaddr_mask: Bits set to 0 shall be copied from the MAC address template.
+ *                Bits set to 1 shall be randomized by the UMAC
+ * @macaddr_template: MAC address template to use for non-randomized bits
+ * @req_timeout_ms: Requested timeout of the response in units of milliseconds.
+ *      This is the session time for completing the measurement.
+ * @tsf_mac_id: report the measurement start time for each ap in terms of the
+ *      TSF of this mac id. 0xff to disable TSF reporting.
+ * @common_calib: The common calib value to inject to this measurement calc
+ * @specific_calib: The specific calib value to inject to this measurement calc
+ * @ap: per-AP request data, see &struct iwl_tof_range_req_ap_entry_v2.
+ */
+struct iwl_tof_range_req_cmd {
+        __le32 initiator_flags;
+        u8 request_id;
+        u8 num_of_ap;
+        u8 range_req_bssid[ETH_ALEN];
+        u8 macaddr_mask[ETH_ALEN];
+        u8 macaddr_template[ETH_ALEN];
+        __le32 req_timeout_ms;
+        __le32 tsf_mac_id;
+        __le16 common_calib;
+        __le16 specific_calib;
+        struct iwl_tof_range_req_ap_entry ap[IWL_MVM_TOF_MAX_APS];
+} __packed; /* LOCATION_RANGE_REQ_CMD_API_S_VER_7 */
 /*
 * enum iwl_tof_range_request_status - status of the sent request
 * @IWL_TOF_RANGE_REQUEST_STATUS_SUCCESSFUL - FW successfully received the
@@ -528,7 +626,7 @@ enum iwl_tof_entry_status {
 }; /* LOCATION_RANGE_RSP_AP_ENTRY_NTFY_API_S_VER_2 */
 /**
- * struct iwl_tof_range_rsp_ap_entry_ntfy - AP parameters (response)
+ * struct iwl_tof_range_rsp_ap_entry_ntfy_v3 - AP parameters (response)
 * @bssid: BSSID of the AP
 * @measure_status: current APs measurement status, one of
 *      &enum iwl_tof_entry_status.
@@ -555,7 +653,7 @@ enum iwl_tof_entry_status {
 * @papd_calib_output: The result of the tof papd calibration that was injected
 *      into the algorithm.
 */
-struct iwl_tof_range_rsp_ap_entry_ntfy {
+struct iwl_tof_range_rsp_ap_entry_ntfy_v3 {
        u8 bssid[ETH_ALEN];
        u8 measure_status;
        u8 measure_bw;
@@ -577,6 +675,59 @@ struct iwl_tof_range_rsp_ap_entry_ntfy {
 } __packed; /* LOCATION_RANGE_RSP_AP_ETRY_NTFY_API_S_VER_3 */
 /**
+ * struct iwl_tof_range_rsp_ap_entry_ntfy - AP parameters (response)
+ * @bssid: BSSID of the AP
+ * @measure_status: current APs measurement status, one of
+ *      &enum iwl_tof_entry_status.
+ * @measure_bw: Current AP Bandwidth: 0  20MHz, 1  40MHz, 2  80MHz
+ * @rtt: The Round Trip Time that took for the last measurement for
+ *      current AP [pSec]
+ * @rtt_variance: The Variance of the RTT values measured for current AP
+ * @rtt_spread: The Difference between the maximum and the minimum RTT
+ *      values measured for current AP in the current session [pSec]
+ * @rssi: RSSI as uploaded in the Channel Estimation notification
+ * @rssi_spread: The Difference between the maximum and the minimum RSSI values
+ *      measured for current AP in the current session
+ * @last_burst: 1 if no more FTM sessions are scheduled for this responder
+ * @refusal_period: refusal period in case of
+ *      @IWL_TOF_ENTRY_RESPONDER_CANNOT_COLABORATE [sec]
+ * @timestamp: The GP2 Clock [usec] where Channel Estimation notification was
+ *      uploaded by the LMAC
+ * @start_tsf: measurement start time in TSF of the mac specified in the range
+ *      request
+ * @rx_rate_n_flags: rate and flags of the last FTM frame received from this
+ *      responder
+ * @tx_rate_n_flags: rate and flags of the last ack sent to this responder
+ * @t2t3_initiator: as calculated from the algo in the initiator
+ * @t1t4_responder: as calculated from the algo in the responder
+ * @common_calib: Calib val that was used in for this AP measurement
+ * @specific_calib: val that was used in for this AP measurement
+ * @papd_calib_output: The result of the tof papd calibration that was injected
+ *      into the algorithm.
+ */
+struct iwl_tof_range_rsp_ap_entry_ntfy {
+        u8 bssid[ETH_ALEN];
+        u8 measure_status;
+        u8 measure_bw;
+        __le32 rtt;
+        __le32 rtt_variance;
+        __le32 rtt_spread;
+        s8 rssi;
+        u8 rssi_spread;
+        u8 last_burst;
+        u8 refusal_period;
+        __le32 timestamp;
+        __le32 start_tsf;
+        __le32 rx_rate_n_flags;
+        __le32 tx_rate_n_flags;
+        __le32 t2t3_initiator;
+        __le32 t1t4_responder;
+        __le16 common_calib;
+        __le16 specific_calib;
+        __le32 papd_calib_output;
+} __packed; /* LOCATION_RANGE_RSP_AP_ETRY_NTFY_API_S_VER_4 */
+/**
 * enum iwl_tof_response_status - tof response status
 *
 * @IWL_TOF_RESPONSE_SUCCESS: successful range.
@@ -593,7 +744,7 @@ enum iwl_tof_response_status {
 }; /* LOCATION_RNG_RSP_STATUS */
 /**
- * struct iwl_tof_range_rsp_ntfy - ranging response notification
+ * struct iwl_tof_range_rsp_ntfy_v5 - ranging response notification
 * @request_id: A Token ID of the corresponding Range request
 * @request_status: status of current measurement session, one of
 *      &enum iwl_tof_response_status.
@@ -601,13 +752,29 @@ enum iwl_tof_response_status {
 * @num_of_aps: Number of APs to measure (error if > IWL_MVM_TOF_MAX_APS)
 * @ap: per-AP data
 */
-struct iwl_tof_range_rsp_ntfy {
+struct iwl_tof_range_rsp_ntfy_v5 {
        u8 request_id;
        u8 request_status;
        u8 last_in_batch;
        u8 num_of_aps;
+        struct iwl_tof_range_rsp_ap_entry_ntfy_v3 ap[IWL_MVM_TOF_MAX_APS];
+} __packed; /* LOCATION_RANGE_RSP_NTFY_API_S_VER_5 */
+/**
+ * struct iwl_tof_range_rsp_ntfy - ranging response notification
+ * @request_id: A Token ID of the corresponding Range request
+ * @num_of_aps: Number of APs results
+ * @last_report: 1 if no more FTM sessions are scheduled, 0 otherwise.
+ * @reserved: reserved
+ * @ap: per-AP data
+ */
+struct iwl_tof_range_rsp_ntfy {
+        u8 request_id;
+        u8 num_of_aps;
+        u8 last_report;
+        u8 reserved;
        struct iwl_tof_range_rsp_ap_entry_ntfy ap[IWL_MVM_TOF_MAX_APS];
-} __packed;
+} __packed; /* LOCATION_RANGE_RSP_NTFY_API_S_VER_6 */
 #define IWL_MVM_TOF_MCSI_BUF_SIZE  (245)
 /**
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/mac-cfg.h b/drivers/net/wireless/intel/iwlwifi/fw/api/mac-cfg.h
index ca49db786ed6..6b4d59daacd6 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/mac-cfg.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/mac-cfg.h
@@ -74,6 +74,10 @@ enum iwl_mac_conf_subcmd_ids {
         */
        LOW_LATENCY_CMD = 0x3,
        /**
+         * @CHANNEL_SWITCH_TIME_EVENT_CMD: &struct iwl_chan_switch_te_cmd
+         */
+        CHANNEL_SWITCH_TIME_EVENT_CMD = 0x4,
+        /**
         * @PROBE_RESPONSE_DATA_NOTIF: &struct iwl_probe_resp_data_notif
         */
        PROBE_RESPONSE_DATA_NOTIF = 0xFC,
@@ -136,6 +140,29 @@ struct iwl_channel_switch_noa_notif {
 } __packed; /* CHANNEL_SWITCH_START_NTFY_API_S_VER_1 */
 /**
+ * struct iwl_chan_switch_te_cmd - Channel Switch Time Event command
+ *
+ * @mac_id: MAC ID for channel switch
+ * @action: action to perform, one of FW_CTXT_ACTION_*
+ * @tsf: beacon tsf
+ * @cs_count: channel switch count from CSA/eCSA IE
+ * @cs_delayed_bcn_count: if set to N (!= 0) GO/AP can delay N beacon intervals
+ *      at the new channel after the channel switch, otherwise (N == 0) expect
+ *      beacon right after the channel switch.
+ * @cs_mode: 1 - quiet, 0 - otherwise
+ * @reserved: reserved for alignment purposes
+ */
+struct iwl_chan_switch_te_cmd {
+        __le32 mac_id;
+        __le32 action;
+        __le32 tsf;
+        u8 cs_count;
+        u8 cs_delayed_bcn_count;
+        u8 cs_mode;
+        u8 reserved;
+} __packed; /* MAC_CHANNEL_SWITCH_TIME_EVENT_S_VER_2 */
+/**
 * struct iwl_mac_low_latency_cmd - set/clear mac to 'low-latency mode'
 *
 * @mac_id: MAC ID to whom to apply the low-latency configurations
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/power.h b/drivers/net/wireless/intel/iwlwifi/fw/api/power.h
index 286a22da232d..01f003c6cff9 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/power.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/power.h
@@ -8,7 +8,7 @@
 * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
 * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018 - 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
 * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
 * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018 - 2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -200,9 +200,16 @@ struct iwl_powertable_cmd {
 * @DEVICE_POWER_FLAGS_POWER_SAVE_ENA_MSK:
 *      '1' Allow to save power by turning off
 *      receiver and transmitter. '0' - does not allow.
+ * @DEVICE_POWER_FLAGS_ALLOW_MEM_RETENTION_MSK:
+ *      Device Retention indication, '1' indicate retention is enabled.
+ * @DEVICE_POWER_FLAGS_32K_CLK_VALID_MSK:
+ *      32Khz external slow clock valid indication, '1' indicate cloack is
+ *      valid.
 */
 enum iwl_device_power_flags {
-        DEVICE_POWER_FLAGS_POWER_SAVE_ENA_MSK   = BIT(0),
+        DEVICE_POWER_FLAGS_POWER_SAVE_ENA_MSK           = BIT(0),
+        DEVICE_POWER_FLAGS_ALLOW_MEM_RETENTION_MSK      = BIT(1),
+        DEVICE_POWER_FLAGS_32K_CLK_VALID_MSK            = BIT(12),
 };
 /**
@@ -470,6 +477,13 @@ struct iwl_geo_tx_power_profiles_resp {
 * @ba_escape_timer: Fully receive and parse beacon if no beacons were passed
 *      for a longer period of time then this escape-timeout. Units: Beacons.
 * @ba_enable_beacon_abort: 1, beacon abort is enabled; 0, disabled.
+ * @bf_threshold_absolute_low: See below.
+ * @bf_threshold_absolute_high: Send Beacon to driver if Energy value calculated
+ *      for this beacon crossed this absolute threshold. For the 'Increase'
+ *      direction the bf_energy_absolute_low[i] is used. For the 'Decrease'
+ *      direction the bf_energy_absolute_high[i] is used. Zero value means
+ *      that this specific threshold is ignored for beacon filtering, and
+ *      beacon will not be forced to be sent to driver due to this setting.
 */
 struct iwl_beacon_filter_cmd {
        __le32 bf_energy_delta;
@@ -483,7 +497,9 @@ struct iwl_beacon_filter_cmd {
        __le32 bf_escape_timer;
        __le32 ba_escape_timer;
        __le32 ba_enable_beacon_abort;
-} __packed;
+        __le32 bf_threshold_absolute_low[2];
+        __le32 bf_threshold_absolute_high[2];
+} __packed; /* BEACON_FILTER_CONFIG_API_S_VER_4 */
 /* Beacon filtering and beacon abort */
 #define IWL_BF_ENERGY_DELTA_DEFAULT 5
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h b/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
index 18741889ec30..890a939c463d 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
@@ -8,7 +8,7 @@
 * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
 * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -434,7 +434,7 @@ struct iwl_periodic_scan_complete {
 /* The maximum of either of these cannot exceed 8, because we use an
 * 8-bit mask (see IWL_MVM_SCAN_MASK in mvm.h).
 */
-#define IWL_MVM_MAX_UMAC_SCANS 8
+#define IWL_MVM_MAX_UMAC_SCANS 4
 #define IWL_MVM_MAX_LMAC_SCANS 1
 enum scan_config_flags {
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/tx.h b/drivers/net/wireless/intel/iwlwifi/fw/api/tx.h
index 358bdf051e83..8511e735c374 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/tx.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/tx.h
@@ -847,13 +847,13 @@ struct iwl_beacon_notif {
 } __packed;
 /**
- * struct iwl_extended_beacon_notif - notifies about beacon transmission
+ * struct iwl_extended_beacon_notif_v5 - notifies about beacon transmission
 * @beacon_notify_hdr: tx response command associated with the beacon
 * @tsf: last beacon tsf
 * @ibss_mgr_status: whether IBSS is manager
 * @gp2: last beacon time in gp2
 */
-struct iwl_extended_beacon_notif {
+struct iwl_extended_beacon_notif_v5 {
        struct iwl_mvm_tx_resp beacon_notify_hdr;
        __le64 tsf;
        __le32 ibss_mgr_status;
@@ -861,6 +861,20 @@ struct iwl_extended_beacon_notif {
 } __packed; /* BEACON_NTFY_API_S_VER_5 */
 /**
+ * struct iwl_extended_beacon_notif - notifies about beacon transmission
+ * @status: the status of the Tx response of the beacon
+ * @tsf: last beacon tsf
+ * @ibss_mgr_status: whether IBSS is manager
+ * @gp2: last beacon time in gp2
+ */
+struct iwl_extended_beacon_notif {
+        __le32 status;
+        __le64 tsf;
+        __le32 ibss_mgr_status;
+        __le32 gp2;
+} __packed; /* BEACON_NTFY_API_S_VER_6_ */
+/**
 * enum iwl_dump_control - dump (flush) control flags
 * @DUMP_TX_FIFO_FLUSH: Dump MSDUs until the the FIFO is empty
 *      and the TFD queues are empty.
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
index 22efd94da6d3..f119c49cd39c 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
@@ -8,7 +8,7 @@
 * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
 * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -242,7 +242,8 @@ static void iwl_fw_dump_rxf(struct iwl_fw_runtime *fwrt,
                                  cfg->lmac[0].rxfifo1_size, 0, 0);
                /* Pull RXF2 */
                iwl_fwrt_dump_rxf(fwrt, dump_data, cfg->rxfifo2_size,
-                                  RXF_DIFF_FROM_PREV, 1);
+                                  RXF_DIFF_FROM_PREV +
+                                  fwrt->trans->cfg->umac_prph_offset, 1);
                /* Pull LMAC2 RXF1 */
                if (fwrt->smem_cfg.num_lmacs > 1)
                        iwl_fwrt_dump_rxf(fwrt, dump_data,
@@ -673,7 +674,9 @@ static void iwl_fw_prph_handler(struct iwl_fw_runtime *fwrt, void *ptr,
 {
        u32 range_len;
-        if (fwrt->trans->cfg->device_family >= IWL_DEVICE_FAMILY_22000) {
+        if (fwrt->trans->cfg->device_family >= IWL_DEVICE_FAMILY_AX210) {
+                /* TODO */
+        } else if (fwrt->trans->cfg->device_family >= IWL_DEVICE_FAMILY_22000) {
                range_len = ARRAY_SIZE(iwl_prph_dump_addr_22000);
                handler(fwrt, iwl_prph_dump_addr_22000, range_len, ptr);
        } else {
@@ -707,28 +710,6 @@ static void iwl_fw_dump_mem(struct iwl_fw_runtime *fwrt,
        IWL_DEBUG_INFO(fwrt, "WRT memory dump. Type=%u\n", dump_mem->type);
 }
-static void iwl_fw_dump_named_mem(struct iwl_fw_runtime *fwrt,
-                                  struct iwl_fw_error_dump_data **dump_data,
-                                  u32 len, u32 ofs, u8 *name, u8 name_len)
-{
-        struct iwl_fw_error_dump_named_mem *dump_mem;
-        if (!len)
-                return;
-        (*dump_data)->type = cpu_to_le32(IWL_FW_ERROR_DUMP_MEM);
-        (*dump_data)->len = cpu_to_le32(len + sizeof(*dump_mem));
-        dump_mem = (void *)(*dump_data)->data;
-        dump_mem->type = cpu_to_le32(IWL_FW_ERROR_DUMP_MEM_NAMED_MEM);
-        dump_mem->offset = cpu_to_le32(ofs);
-        dump_mem->name_len = name_len;
-        memcpy(dump_mem->name, name, name_len);
-        iwl_trans_read_mem_bytes(fwrt->trans, ofs, dump_mem->data, len);
-        *dump_data = iwl_fw_error_next_data(*dump_data);
-        IWL_DEBUG_INFO(fwrt, "WRT memory dump. Type=%u\n", dump_mem->type);
-}
 #define ADD_LEN(len, item_len, const_len) \
        do {size_t item = item_len; len += (!!item) * const_len + item; } \
        while (0)
@@ -815,6 +796,9 @@ static void iwl_dump_paging(struct iwl_fw_runtime *fwrt,
                                        DMA_BIDIRECTIONAL);
                memcpy(paging->data, page_address(pages),
                       PAGING_BLOCK_SIZE);
+                dma_sync_single_for_device(fwrt->trans->dev, addr,
+                                           PAGING_BLOCK_SIZE,
+                                           DMA_BIDIRECTIONAL);
                (*data) = iwl_fw_error_next_data(*data);
        }
 }
@@ -1059,117 +1043,645 @@ out:
        return dump_file;
 }
-static void iwl_dump_prph_ini(struct iwl_trans *trans,
+static int iwl_dump_ini_prph_iter(struct iwl_fw_runtime *fwrt,
-                              struct iwl_fw_error_dump_data **data,
+                                  struct iwl_fw_ini_region_cfg *reg,
-                              struct iwl_fw_ini_region_cfg *reg)
+                                  void *range_ptr, int idx)
 {
-        struct iwl_fw_error_dump_prph *prph;
+        struct iwl_fw_ini_error_dump_range *range = range_ptr;
+        __le32 *val = range->data;
+        u32 addr, prph_val, offset = le32_to_cpu(reg->offset);
+        int i;
+        range->start_addr = reg->start_addr[idx];
+        range->range_data_size = reg->internal.range_data_size;
+        for (i = 0; i < le32_to_cpu(reg->internal.range_data_size); i += 4) {
+                addr = le32_to_cpu(range->start_addr) + i;
+                prph_val = iwl_read_prph(fwrt->trans, addr + offset);
+                if (prph_val == 0x5a5a5a5a)
+                        return -EBUSY;
+                *val++ = cpu_to_le32(prph_val);
+        }
+        return sizeof(*range) + le32_to_cpu(range->range_data_size);
+}
+static int iwl_dump_ini_csr_iter(struct iwl_fw_runtime *fwrt,
+                                 struct iwl_fw_ini_region_cfg *reg,
+                                 void *range_ptr, int idx)
+{
+        struct iwl_fw_ini_error_dump_range *range = range_ptr;
+        __le32 *val = range->data;
+        u32 addr, offset = le32_to_cpu(reg->offset);
+        int i;
+        range->start_addr = reg->start_addr[idx];
+        range->range_data_size = reg->internal.range_data_size;
+        for (i = 0; i < le32_to_cpu(reg->internal.range_data_size); i += 4) {
+                addr = le32_to_cpu(range->start_addr) + i;
+                *val++ = cpu_to_le32(iwl_trans_read32(fwrt->trans,
+                                                      addr + offset));
+        }
+        return sizeof(*range) + le32_to_cpu(range->range_data_size);
+}
+static int iwl_dump_ini_dev_mem_iter(struct iwl_fw_runtime *fwrt,
+                                     struct iwl_fw_ini_region_cfg *reg,
+                                     void *range_ptr, int idx)
+{
+        struct iwl_fw_ini_error_dump_range *range = range_ptr;
+        u32 addr = le32_to_cpu(range->start_addr);
+        u32 offset = le32_to_cpu(reg->offset);
+        range->start_addr = reg->start_addr[idx];
+        range->range_data_size = reg->internal.range_data_size;
+        iwl_trans_read_mem_bytes(fwrt->trans, addr + offset, range->data,
+                                 le32_to_cpu(reg->internal.range_data_size));
+        return sizeof(*range) + le32_to_cpu(range->range_data_size);
+}
+static int
+iwl_dump_ini_paging_gen2_iter(struct iwl_fw_runtime *fwrt,
+                              struct iwl_fw_ini_region_cfg *reg,
+                              void *range_ptr, int idx)
+{
+        struct iwl_fw_ini_error_dump_range *range = range_ptr;
+        u32 page_size = fwrt->trans->init_dram.paging[idx].size;
+        range->start_addr = cpu_to_le32(idx);
+        range->range_data_size = cpu_to_le32(page_size);
+        memcpy(range->data, fwrt->trans->init_dram.paging[idx].block,
+               page_size);
+        return sizeof(*range) + le32_to_cpu(range->range_data_size);
+}
+static int iwl_dump_ini_paging_iter(struct iwl_fw_runtime *fwrt,
+                                    struct iwl_fw_ini_region_cfg *reg,
+                                    void *range_ptr, int idx)
+{
+        /* increase idx by 1 since the pages are from 1 to
+         * fwrt->num_of_paging_blk + 1
+         */
+        struct page *page = fwrt->fw_paging_db[++idx].fw_paging_block;
+        struct iwl_fw_ini_error_dump_range *range = range_ptr;
+        dma_addr_t addr = fwrt->fw_paging_db[idx].fw_paging_phys;
+        u32 page_size = fwrt->fw_paging_db[idx].fw_paging_size;
+        range->start_addr = cpu_to_le32(idx);
+        range->range_data_size = cpu_to_le32(page_size);
+        dma_sync_single_for_cpu(fwrt->trans->dev, addr, page_size,
+                                DMA_BIDIRECTIONAL);
+        memcpy(range->data, page_address(page), page_size);
+        dma_sync_single_for_device(fwrt->trans->dev, addr, page_size,
+                                   DMA_BIDIRECTIONAL);
+        return sizeof(*range) + le32_to_cpu(range->range_data_size);
+}
+static int
+iwl_dump_ini_mon_dram_iter(struct iwl_fw_runtime *fwrt,
+                           struct iwl_fw_ini_region_cfg *reg, void *range_ptr,
+                           int idx)
+{
+        struct iwl_fw_ini_error_dump_range *range = range_ptr;
+        u32 start_addr = iwl_read_umac_prph(fwrt->trans,
+                                            MON_BUFF_BASE_ADDR_VER2);
+        if (start_addr == 0x5a5a5a5a)
+                return -EBUSY;
+        range->start_addr = cpu_to_le32(start_addr);
+        range->range_data_size = cpu_to_le32(fwrt->trans->fw_mon[idx].size);
+        memcpy(range->data, fwrt->trans->fw_mon[idx].block,
+               fwrt->trans->fw_mon[idx].size);
+        return sizeof(*range) + le32_to_cpu(range->range_data_size);
+}
+struct iwl_ini_txf_iter_data {
+        int fifo;
+        int lmac;
+        u32 fifo_size;
+        bool internal_txf;
+        bool init;
+};
+static bool iwl_ini_txf_iter(struct iwl_fw_runtime *fwrt,
+                             struct iwl_fw_ini_region_cfg *reg)
+{
+        struct iwl_ini_txf_iter_data *iter = fwrt->dump.fifo_iter;
+        struct iwl_fwrt_shared_mem_cfg *cfg = &fwrt->smem_cfg;
+        int txf_num = cfg->num_txfifo_entries;
+        int int_txf_num = ARRAY_SIZE(cfg->internal_txfifo_size);
+        u32 lmac_bitmap = le32_to_cpu(reg->fifos.fid1);
+        if (!iter)
+                return false;
+        if (iter->init) {
+                if (le32_to_cpu(reg->offset) &&
+                    WARN_ONCE(cfg->num_lmacs == 1,
+                              "Invalid lmac offset: 0x%x\n",
+                              le32_to_cpu(reg->offset)))
+                        return false;
+                iter->init = false;
+                iter->internal_txf = false;
+                iter->fifo_size = 0;
+                iter->fifo = -1;
+                if (le32_to_cpu(reg->offset))
+                        iter->lmac = 1;
+                else
+                        iter->lmac = 0;
+        }
+        if (!iter->internal_txf)
+                for (iter->fifo++; iter->fifo < txf_num; iter->fifo++) {
+                        iter->fifo_size =
+                                cfg->lmac[iter->lmac].txfifo_size[iter->fifo];
+                        if (iter->fifo_size && (lmac_bitmap & BIT(iter->fifo)))
+                                return true;
+                }
+        iter->internal_txf = true;
+        if (!fw_has_capa(&fwrt->fw->ucode_capa,
+                         IWL_UCODE_TLV_CAPA_EXTEND_SHARED_MEM_CFG))
+                return false;
+        for (iter->fifo++; iter->fifo < int_txf_num + txf_num; iter->fifo++) {
+                iter->fifo_size =
+                        cfg->internal_txfifo_size[iter->fifo - txf_num];
+                if (iter->fifo_size && (lmac_bitmap & BIT(iter->fifo)))
+                        return true;
+        }
+        return false;
+}
+static int iwl_dump_ini_txf_iter(struct iwl_fw_runtime *fwrt,
+                                 struct iwl_fw_ini_region_cfg *reg,
+                                 void *range_ptr, int idx)
+{
+        struct iwl_fw_ini_fifo_error_dump_range *range = range_ptr;
+        struct iwl_ini_txf_iter_data *iter;
+        u32 offs = le32_to_cpu(reg->offset), addr;
+        u32 registers_size =
+                le32_to_cpu(reg->fifos.num_of_registers) * sizeof(__le32);
+        __le32 *val = range->data;
        unsigned long flags;
-        u32 i, size = le32_to_cpu(reg->num_regions);
+        int i;
-        IWL_DEBUG_INFO(trans, "WRT PRPH dump\n");
+        if (!iwl_ini_txf_iter(fwrt, reg))
+                return -EIO;
-        if (!iwl_trans_grab_nic_access(trans, &flags))
+        if (!iwl_trans_grab_nic_access(fwrt->trans, &flags))
+                return -EBUSY;
+        iter = fwrt->dump.fifo_iter;
+        range->fifo_num = cpu_to_le32(iter->fifo);
+        range->num_of_registers = reg->fifos.num_of_registers;
+        range->range_data_size = cpu_to_le32(iter->fifo_size + registers_size);
+        iwl_write_prph_no_grab(fwrt->trans, TXF_LARC_NUM + offs, iter->fifo);
+        /* read txf registers */
+        for (i = 0; i < le32_to_cpu(reg->fifos.num_of_registers); i++) {
+                addr = le32_to_cpu(reg->start_addr[i]) + offs;
+                *val++ = cpu_to_le32(iwl_read_prph_no_grab(fwrt->trans, addr));
+        }
+        if (reg->fifos.header_only) {
+                range->range_data_size = cpu_to_le32(registers_size);
+                goto out;
+        }
+        /* Set the TXF_READ_MODIFY_ADDR to TXF_WR_PTR */
+        iwl_write_prph_no_grab(fwrt->trans, TXF_READ_MODIFY_ADDR + offs,
+                               TXF_WR_PTR + offs);
+        /* Dummy-read to advance the read pointer to the head */
+        iwl_read_prph_no_grab(fwrt->trans, TXF_READ_MODIFY_DATA + offs);
+        /* Read FIFO */
+        addr = TXF_READ_MODIFY_DATA + offs;
+        for (i = 0; i < iter->fifo_size; i += sizeof(__le32))
+                *val++ = cpu_to_le32(iwl_read_prph_no_grab(fwrt->trans, addr));
+out:
+        iwl_trans_release_nic_access(fwrt->trans, &flags);
+        return sizeof(*range) + le32_to_cpu(range->range_data_size);
+}
+struct iwl_ini_rxf_data {
+        u32 fifo_num;
+        u32 size;
+        u32 offset;
+};
+static void iwl_ini_get_rxf_data(struct iwl_fw_runtime *fwrt,
+                                 struct iwl_fw_ini_region_cfg *reg,
+                                 struct iwl_ini_rxf_data *data)
+{
+        u32 fid1 = le32_to_cpu(reg->fifos.fid1);
+        u32 fid2 = le32_to_cpu(reg->fifos.fid2);
+        u32 fifo_idx;
+        if (!data)
                return;
-        for (i = 0; i < size; i++) {
+        memset(data, 0, sizeof(*data));
-                (*data)->type = cpu_to_le32(IWL_FW_ERROR_DUMP_PRPH);
-                (*data)->len = cpu_to_le32(le32_to_cpu(reg->size) +
+        if (WARN_ON_ONCE((fid1 && fid2) || (!fid1 && !fid2)))
-                                           sizeof(*prph));
+                return;
-                prph = (void *)(*data)->data;
-                prph->prph_start = reg->start_addr[i];
+        fifo_idx = ffs(fid1) - 1;
-                prph->data[0] = cpu_to_le32(iwl_read_prph_no_grab(trans,
+        if (fid1 && !WARN_ON_ONCE((~BIT(fifo_idx) & fid1) ||
-                                                                  le32_to_cpu(prph->prph_start)));
+                                  fifo_idx >= MAX_NUM_LMAC)) {
-                *data = iwl_fw_error_next_data(*data);
+                data->size = fwrt->smem_cfg.lmac[fifo_idx].rxfifo1_size;
+                data->fifo_num = fifo_idx;
+                return;
+        }
+        fifo_idx = ffs(fid2) - 1;
+        if (fid2 && !WARN_ON_ONCE(fifo_idx != 0)) {
+                data->size = fwrt->smem_cfg.rxfifo2_size;
+                data->offset = RXF_DIFF_FROM_PREV;
+                /* use bit 31 to distinguish between umac and lmac rxf while
+                 * parsing the dump
+                 */
+                data->fifo_num = fifo_idx | IWL_RXF_UMAC_BIT;
+                return;
        }
-        iwl_trans_release_nic_access(trans, &flags);
 }
-static void iwl_dump_csr_ini(struct iwl_trans *trans,
+static int iwl_dump_ini_rxf_iter(struct iwl_fw_runtime *fwrt,
-                             struct iwl_fw_error_dump_data **data,
+                                 struct iwl_fw_ini_region_cfg *reg,
-                             struct iwl_fw_ini_region_cfg *reg)
+                                 void *range_ptr, int idx)
 {
-        int i, num = le32_to_cpu(reg->num_regions);
+        struct iwl_fw_ini_fifo_error_dump_range *range = range_ptr;
-        u32 size = le32_to_cpu(reg->size);
+        struct iwl_ini_rxf_data rxf_data;
+        u32 offs = le32_to_cpu(reg->offset), addr;
+        u32 registers_size =
+                le32_to_cpu(reg->fifos.num_of_registers) * sizeof(__le32);
+        __le32 *val = range->data;
+        unsigned long flags;
+        int i;
+        iwl_ini_get_rxf_data(fwrt, reg, &rxf_data);
+        if (!rxf_data.size)
+                return -EIO;
-        IWL_DEBUG_INFO(trans, "WRT CSR dump\n");
+        if (!iwl_trans_grab_nic_access(fwrt->trans, &flags))
+                return -EBUSY;
-        for (i = 0; i < num; i++) {
+        offs += rxf_data.offset;
-                u32 add = le32_to_cpu(reg->start_addr[i]);
-                __le32 *val;
-                int j;
-                (*data)->type = cpu_to_le32(IWL_FW_ERROR_DUMP_CSR);
+        range->fifo_num = cpu_to_le32(rxf_data.fifo_num);
-                (*data)->len = cpu_to_le32(size);
+        range->num_of_registers = reg->fifos.num_of_registers;
-                val = (void *)(*data)->data;
+        range->range_data_size = cpu_to_le32(rxf_data.size + registers_size);
-                for (j = 0; j < size; j += 4)
+        /* read rxf registers */
-                        *val++ = cpu_to_le32(iwl_trans_read32(trans, j + add));
+        for (i = 0; i < le32_to_cpu(reg->fifos.num_of_registers); i++) {
+                addr = le32_to_cpu(reg->start_addr[i]) + offs;
-                *data = iwl_fw_error_next_data(*data);
+                *val++ = cpu_to_le32(iwl_read_prph_no_grab(fwrt->trans, addr));
+        }
+        if (reg->fifos.header_only) {
+                range->range_data_size = cpu_to_le32(registers_size);
+                goto out;
+        }
+        /* Lock fence */
+        iwl_write_prph_no_grab(fwrt->trans, RXF_SET_FENCE_MODE + offs, 0x1);
+        /* Set fence pointer to the same place like WR pointer */
+        iwl_write_prph_no_grab(fwrt->trans, RXF_LD_WR2FENCE + offs, 0x1);
+        /* Set fence offset */
+        iwl_write_prph_no_grab(fwrt->trans, RXF_LD_FENCE_OFFSET_ADDR + offs,
+                               0x0);
+        /* Read FIFO */
+        addr =  RXF_FIFO_RD_FENCE_INC + offs;
+        for (i = 0; i < rxf_data.size; i += sizeof(__le32))
+                *val++ = cpu_to_le32(iwl_read_prph_no_grab(fwrt->trans, addr));
+out:
+        iwl_trans_release_nic_access(fwrt->trans, &flags);
+        return sizeof(*range) + le32_to_cpu(range->range_data_size);
+}
+static void *iwl_dump_ini_mem_fill_header(struct iwl_fw_runtime *fwrt,
+                                          struct iwl_fw_ini_region_cfg *reg,
+                                          void *data)
+{
+        struct iwl_fw_ini_error_dump *dump = data;
+        return dump->ranges;
+}
+static void
+*iwl_dump_ini_mon_dram_fill_header(struct iwl_fw_runtime *fwrt,
+                                   struct iwl_fw_ini_region_cfg *reg,
+                                   void *data)
+{
+        struct iwl_fw_ini_monitor_dram_dump *mon_dump = (void *)data;
+        u32 write_ptr, cycle_cnt;
+        unsigned long flags;
+        if (!iwl_trans_grab_nic_access(fwrt->trans, &flags)) {
+                IWL_ERR(fwrt, "Failed to get DRAM monitor header\n");
+                return NULL;
        }
+        write_ptr = iwl_read_umac_prph_no_grab(fwrt->trans,
+                                               MON_BUFF_WRPTR_VER2);
+        cycle_cnt = iwl_read_umac_prph_no_grab(fwrt->trans,
+                                               MON_BUFF_CYCLE_CNT_VER2);
+        iwl_trans_release_nic_access(fwrt->trans, &flags);
+        mon_dump->write_ptr = cpu_to_le32(write_ptr);
+        mon_dump->cycle_cnt = cpu_to_le32(cycle_cnt);
+        return mon_dump->ranges;
+}
+static void *iwl_dump_ini_fifo_fill_header(struct iwl_fw_runtime *fwrt,
+                                           struct iwl_fw_ini_region_cfg *reg,
+                                           void *data)
+{
+        struct iwl_fw_ini_fifo_error_dump *dump = data;
+        return dump->ranges;
+}
+static u32 iwl_dump_ini_mem_ranges(struct iwl_fw_runtime *fwrt,
+                                   struct iwl_fw_ini_region_cfg *reg)
+{
+        return le32_to_cpu(reg->internal.num_of_ranges);
+}
+static u32 iwl_dump_ini_paging_gen2_ranges(struct iwl_fw_runtime *fwrt,
+                                           struct iwl_fw_ini_region_cfg *reg)
+{
+        return fwrt->trans->init_dram.paging_cnt;
+}
+static u32 iwl_dump_ini_paging_ranges(struct iwl_fw_runtime *fwrt,
+                                      struct iwl_fw_ini_region_cfg *reg)
+{
+        return fwrt->num_of_paging_blk;
+}
+static u32 iwl_dump_ini_mon_dram_ranges(struct iwl_fw_runtime *fwrt,
+                                        struct iwl_fw_ini_region_cfg *reg)
+{
+        return 1;
+}
+static u32 iwl_dump_ini_txf_ranges(struct iwl_fw_runtime *fwrt,
+                                   struct iwl_fw_ini_region_cfg *reg)
+{
+        struct iwl_ini_txf_iter_data iter = { .init = true };
+        void *fifo_iter = fwrt->dump.fifo_iter;
+        u32 num_of_fifos = 0;
+        fwrt->dump.fifo_iter = &iter;
+        while (iwl_ini_txf_iter(fwrt, reg))
+                num_of_fifos++;
+        fwrt->dump.fifo_iter = fifo_iter;
+        return num_of_fifos;
+}
+static u32 iwl_dump_ini_rxf_ranges(struct iwl_fw_runtime *fwrt,
+                                   struct iwl_fw_ini_region_cfg *reg)
+{
+        /* Each Rx fifo needs a different offset and therefore, it's
+         * region can contain only one fifo, i.e. 1 memory range.
+         */
+        return 1;
+}
+static u32 iwl_dump_ini_mem_get_size(struct iwl_fw_runtime *fwrt,
+                                     struct iwl_fw_ini_region_cfg *reg)
+{
+        return sizeof(struct iwl_fw_ini_error_dump) +
+                iwl_dump_ini_mem_ranges(fwrt, reg) *
+                (sizeof(struct iwl_fw_ini_error_dump_range) +
+                 le32_to_cpu(reg->internal.range_data_size));
+}
+static u32 iwl_dump_ini_paging_gen2_get_size(struct iwl_fw_runtime *fwrt,
+                                             struct iwl_fw_ini_region_cfg *reg)
+{
+        int i;
+        u32 range_header_len = sizeof(struct iwl_fw_ini_error_dump_range);
+        u32 size = sizeof(struct iwl_fw_ini_error_dump);
+        for (i = 0; i < iwl_dump_ini_paging_gen2_ranges(fwrt, reg); i++)
+                size += range_header_len +
+                        fwrt->trans->init_dram.paging[i].size;
+        return size;
+}
+static u32 iwl_dump_ini_paging_get_size(struct iwl_fw_runtime *fwrt,
+                                        struct iwl_fw_ini_region_cfg *reg)
+{
+        int i;
+        u32 range_header_len = sizeof(struct iwl_fw_ini_error_dump_range);
+        u32 size = sizeof(struct iwl_fw_ini_error_dump);
+        for (i = 1; i <= iwl_dump_ini_paging_ranges(fwrt, reg); i++)
+                size += range_header_len + fwrt->fw_paging_db[i].fw_paging_size;
+        return size;
+}
+static u32 iwl_dump_ini_mon_dram_get_size(struct iwl_fw_runtime *fwrt,
+                                          struct iwl_fw_ini_region_cfg *reg)
+{
+        u32 size = sizeof(struct iwl_fw_ini_monitor_dram_dump);
+        if (fwrt->trans->num_blocks)
+                size += fwrt->trans->fw_mon[0].size;
+        return size;
+}
+static u32 iwl_dump_ini_txf_get_size(struct iwl_fw_runtime *fwrt,
+                                     struct iwl_fw_ini_region_cfg *reg)
+{
+        struct iwl_ini_txf_iter_data iter = { .init = true };
+        void *fifo_iter = fwrt->dump.fifo_iter;
+        u32 size = 0;
+        u32 fifo_hdr = sizeof(struct iwl_fw_ini_fifo_error_dump_range) +
+                le32_to_cpu(reg->fifos.num_of_registers) * sizeof(__le32);
+        fwrt->dump.fifo_iter = &iter;
+        while (iwl_ini_txf_iter(fwrt, reg)) {
+                size += fifo_hdr;
+                if (!reg->fifos.header_only)
+                        size += iter.fifo_size;
+        }
+        if (size)
+                size += sizeof(struct iwl_fw_ini_fifo_error_dump);
+        fwrt->dump.fifo_iter = fifo_iter;
+        return size;
+}
+static u32 iwl_dump_ini_rxf_get_size(struct iwl_fw_runtime *fwrt,
+                                     struct iwl_fw_ini_region_cfg *reg)
+{
+        struct iwl_ini_rxf_data rx_data;
+        u32 size = sizeof(struct iwl_fw_ini_fifo_error_dump) +
+                sizeof(struct iwl_fw_ini_fifo_error_dump_range) +
+                le32_to_cpu(reg->fifos.num_of_registers) * sizeof(__le32);
+        if (reg->fifos.header_only)
+                return size;
+        iwl_ini_get_rxf_data(fwrt, reg, &rx_data);
+        size += rx_data.size;
+        return size;
+}
+/**
+ * struct iwl_dump_ini_mem_ops - ini memory dump operations
+ * @get_num_of_ranges: returns the number of memory ranges in the region.
+ * @get_size: returns the total size of the region.
+ * @fill_mem_hdr: fills region type specific headers and returns pointer to
+ *      the first range or NULL if failed to fill headers.
+ * @fill_range: copies a given memory range into the dump.
+ *      Returns the size of the range or negative error value otherwise.
+ */
+struct iwl_dump_ini_mem_ops {
+        u32 (*get_num_of_ranges)(struct iwl_fw_runtime *fwrt,
+                                 struct iwl_fw_ini_region_cfg *reg);
+        u32 (*get_size)(struct iwl_fw_runtime *fwrt,
+                        struct iwl_fw_ini_region_cfg *reg);
+        void *(*fill_mem_hdr)(struct iwl_fw_runtime *fwrt,
+                              struct iwl_fw_ini_region_cfg *reg, void *data);
+        int (*fill_range)(struct iwl_fw_runtime *fwrt,
+                          struct iwl_fw_ini_region_cfg *reg, void *range,
+                          int idx);
+};
+/**
+ * iwl_dump_ini_mem - copy a memory region into the dump
+ * @fwrt: fw runtime struct.
+ * @data: dump memory data.
+ * @reg: region to copy to the dump.
+ */
+static void
+iwl_dump_ini_mem(struct iwl_fw_runtime *fwrt,
+                 enum iwl_fw_ini_region_type type,
+                 struct iwl_fw_error_dump_data **data,
+                 struct iwl_fw_ini_region_cfg *reg,
+                 struct iwl_dump_ini_mem_ops *ops)
+{
+        struct iwl_fw_ini_error_dump_header *header = (void *)(*data)->data;
+        void *range;
+        u32 num_of_ranges, i;
+        if (WARN_ON(!ops || !ops->get_num_of_ranges || !ops->get_size ||
+                    !ops->fill_mem_hdr || !ops->fill_range))
+                return;
+        num_of_ranges = ops->get_num_of_ranges(fwrt, reg);
+        (*data)->type = cpu_to_le32(type | INI_DUMP_BIT);
+        (*data)->len = cpu_to_le32(ops->get_size(fwrt, reg));
+        header->num_of_ranges = cpu_to_le32(num_of_ranges);
+        header->name_len = cpu_to_le32(min_t(int, IWL_FW_INI_MAX_NAME,
+                                             le32_to_cpu(reg->name_len)));
+        memcpy(header->name, reg->name, le32_to_cpu(header->name_len));
+        range = ops->fill_mem_hdr(fwrt, reg, header);
+        if (!range) {
+                IWL_ERR(fwrt, "Failed to fill region header: id=%d, type=%d\n",
+                        le32_to_cpu(reg->region_id), type);
+                return;
+        }
+        for (i = 0; i < num_of_ranges; i++) {
+                int range_size = ops->fill_range(fwrt, reg, range, i);
+                if (range_size < 0) {
+                        IWL_ERR(fwrt, "Failed to dump region: id=%d, type=%d\n",
+                                le32_to_cpu(reg->region_id), type);
+                        return;
+                }
+                range = range + range_size;
+        }
+        *data = iwl_fw_error_next_data(*data);
 }
 static int iwl_fw_ini_get_trigger_len(struct iwl_fw_runtime *fwrt,
                                      struct iwl_fw_ini_trigger *trigger)
 {
-        int i, num, size = 0, hdr_len = sizeof(struct iwl_fw_error_dump_data);
+        int i, size = 0, hdr_len = sizeof(struct iwl_fw_error_dump_data);
        if (!trigger || !trigger->num_regions)
                return 0;
-        num = le32_to_cpu(trigger->num_regions);
+        for (i = 0; i < le32_to_cpu(trigger->num_regions); i++) {
-        for (i = 0; i < num; i++) {
                u32 reg_id = le32_to_cpu(trigger->data[i]);
                struct iwl_fw_ini_region_cfg *reg;
                enum iwl_fw_ini_region_type type;
-                u32 num_entries;
                if (WARN_ON(reg_id >= ARRAY_SIZE(fwrt->dump.active_regs)))
                        continue;
-                reg = fwrt->dump.active_regs[reg_id].reg;
+                reg = fwrt->dump.active_regs[reg_id];
                if (WARN(!reg, "Unassigned region %d\n", reg_id))
                        continue;
                type = le32_to_cpu(reg->region_type);
-                num_entries = le32_to_cpu(reg->num_regions);
                switch (type) {
                case IWL_FW_INI_REGION_DEVICE_MEMORY:
-                        size += hdr_len +
-                                sizeof(struct iwl_fw_error_dump_named_mem) +
-                                le32_to_cpu(reg->size);
-                        break;
                case IWL_FW_INI_REGION_PERIPHERY_MAC:
                case IWL_FW_INI_REGION_PERIPHERY_PHY:
                case IWL_FW_INI_REGION_PERIPHERY_AUX:
-                        size += num_entries *
+                case IWL_FW_INI_REGION_INTERNAL_BUFFER:
-                                (hdr_len +
+                case IWL_FW_INI_REGION_CSR:
-                                 sizeof(struct iwl_fw_error_dump_prph) +
+                        size += hdr_len + iwl_dump_ini_mem_get_size(fwrt, reg);
-                                 sizeof(u32));
                        break;
                case IWL_FW_INI_REGION_TXF:
-                        size += iwl_fw_txf_len(fwrt, &fwrt->smem_cfg);
+                        size += hdr_len + iwl_dump_ini_txf_get_size(fwrt, reg);
                        break;
                case IWL_FW_INI_REGION_RXF:
-                        size += iwl_fw_rxf_len(fwrt, &fwrt->smem_cfg);
+                        size += hdr_len + iwl_dump_ini_rxf_get_size(fwrt, reg);
                        break;
-                case IWL_FW_INI_REGION_PAGING:
+                case IWL_FW_INI_REGION_PAGING: {
-                        if (!iwl_fw_dbg_is_paging_enabled(fwrt))
+                        size += hdr_len;
-                                break;
+                        if (iwl_fw_dbg_is_paging_enabled(fwrt)) {
-                        size += fwrt->num_of_paging_blk *
+                                size += iwl_dump_ini_paging_get_size(fwrt, reg);
-                                (hdr_len +
+                        } else {
-                                 sizeof(struct iwl_fw_error_dump_paging) +
+                                size += iwl_dump_ini_paging_gen2_get_size(fwrt,
-                                 PAGING_BLOCK_SIZE);
+                                                                          reg);
-                        break;
+                        }
-                case IWL_FW_INI_REGION_CSR:
-                        size += num_entries *
-                                (hdr_len + le32_to_cpu(reg->size));
                        break;
+                }
                case IWL_FW_INI_REGION_DRAM_BUFFER:
-                        /* Transport takes care of DRAM dumping */
+                        if (!fwrt->trans->num_blocks)
-                case IWL_FW_INI_REGION_INTERNAL_BUFFER:
+                                break;
+                        size += hdr_len +
+                                iwl_dump_ini_mon_dram_get_size(fwrt, reg);
+                        break;
                case IWL_FW_INI_REGION_DRAM_IMR:
                        /* Undefined yet */
                default:
@@ -1181,8 +1693,7 @@ static int iwl_fw_ini_get_trigger_len(struct iwl_fw_runtime *fwrt,
 static void iwl_fw_ini_dump_trigger(struct iwl_fw_runtime *fwrt,
                                    struct iwl_fw_ini_trigger *trigger,
-                                    struct iwl_fw_error_dump_data **data,
+                                    struct iwl_fw_error_dump_data **data)
-                                    u32 *dump_mask)
 {
        int i, num = le32_to_cpu(trigger->num_regions);
@@ -1190,11 +1701,12 @@ static void iwl_fw_ini_dump_trigger(struct iwl_fw_runtime *fwrt,
                u32 reg_id = le32_to_cpu(trigger->data[i]);
                enum iwl_fw_ini_region_type type;
                struct iwl_fw_ini_region_cfg *reg;
+                struct iwl_dump_ini_mem_ops ops;
                if (reg_id >= ARRAY_SIZE(fwrt->dump.active_regs))
                        continue;
-                reg = fwrt->dump.active_regs[reg_id].reg;
+                reg = fwrt->dump.active_regs[reg_id];
                /* Don't warn, get_trigger_len already warned */
                if (!reg)
                        continue;
@@ -1202,39 +1714,75 @@ static void iwl_fw_ini_dump_trigger(struct iwl_fw_runtime *fwrt,
                type = le32_to_cpu(reg->region_type);
                switch (type) {
                case IWL_FW_INI_REGION_DEVICE_MEMORY:
-                        if (WARN_ON(le32_to_cpu(reg->num_regions) > 1))
+                case IWL_FW_INI_REGION_INTERNAL_BUFFER:
-                                continue;
+                        ops.get_num_of_ranges = iwl_dump_ini_mem_ranges;
-                        iwl_fw_dump_named_mem(fwrt, data,
+                        ops.get_size = iwl_dump_ini_mem_get_size;
-                                              le32_to_cpu(reg->size),
+                        ops.fill_mem_hdr = iwl_dump_ini_mem_fill_header;
-                                              le32_to_cpu(reg->start_addr[0]),
+                        ops.fill_range = iwl_dump_ini_dev_mem_iter;
-                                              reg->name,
+                        iwl_dump_ini_mem(fwrt, type, data, reg, &ops);
-                                              le32_to_cpu(reg->name_len));
                        break;
                case IWL_FW_INI_REGION_PERIPHERY_MAC:
                case IWL_FW_INI_REGION_PERIPHERY_PHY:
                case IWL_FW_INI_REGION_PERIPHERY_AUX:
-                        iwl_dump_prph_ini(fwrt->trans, data, reg);
+                        ops.get_num_of_ranges = iwl_dump_ini_mem_ranges;
+                        ops.get_size = iwl_dump_ini_mem_get_size;
+                        ops.fill_mem_hdr = iwl_dump_ini_mem_fill_header;
+                        ops.fill_range = iwl_dump_ini_prph_iter;
+                        iwl_dump_ini_mem(fwrt, type, data, reg, &ops);
                        break;
                case IWL_FW_INI_REGION_DRAM_BUFFER:
-                        *dump_mask |= BIT(IWL_FW_ERROR_DUMP_FW_MONITOR);
+                        ops.get_num_of_ranges = iwl_dump_ini_mon_dram_ranges;
+                        ops.get_size = iwl_dump_ini_mon_dram_get_size;
+                        ops.fill_mem_hdr = iwl_dump_ini_mon_dram_fill_header;
+                        ops.fill_range = iwl_dump_ini_mon_dram_iter;
+                        iwl_dump_ini_mem(fwrt, type, data, reg, &ops);
                        break;
-                case IWL_FW_INI_REGION_PAGING:
+                case IWL_FW_INI_REGION_PAGING: {
-                        if (iwl_fw_dbg_is_paging_enabled(fwrt))
+                        ops.fill_mem_hdr = iwl_dump_ini_mem_fill_header;
-                                iwl_dump_paging(fwrt, data);
+                        if (iwl_fw_dbg_is_paging_enabled(fwrt)) {
-                        else
+                                ops.get_num_of_ranges =
-                                *dump_mask |= BIT(IWL_FW_ERROR_DUMP_PAGING);
+                                        iwl_dump_ini_paging_ranges;
+                                ops.get_size = iwl_dump_ini_paging_get_size;
+                                ops.fill_range = iwl_dump_ini_paging_iter;
+                        } else {
+                                ops.get_num_of_ranges =
+                                        iwl_dump_ini_paging_gen2_ranges;
+                                ops.get_size =
+                                        iwl_dump_ini_paging_gen2_get_size;
+                                ops.fill_range = iwl_dump_ini_paging_gen2_iter;
+                        }
+                        iwl_dump_ini_mem(fwrt, type, data, reg, &ops);
                        break;
-                case IWL_FW_INI_REGION_TXF:
+                }
-                        iwl_fw_dump_txf(fwrt, data);
+                case IWL_FW_INI_REGION_TXF: {
+                        struct iwl_ini_txf_iter_data iter = { .init = true };
+                        void *fifo_iter = fwrt->dump.fifo_iter;
+                        fwrt->dump.fifo_iter = &iter;
+                        ops.get_num_of_ranges = iwl_dump_ini_txf_ranges;
+                        ops.get_size = iwl_dump_ini_txf_get_size;
+                        ops.fill_mem_hdr = iwl_dump_ini_fifo_fill_header;
+                        ops.fill_range = iwl_dump_ini_txf_iter;
+                        iwl_dump_ini_mem(fwrt, type, data, reg, &ops);
+                        fwrt->dump.fifo_iter = fifo_iter;
                        break;
+                }
                case IWL_FW_INI_REGION_RXF:
-                        iwl_fw_dump_rxf(fwrt, data);
+                        ops.get_num_of_ranges = iwl_dump_ini_rxf_ranges;
+                        ops.get_size = iwl_dump_ini_rxf_get_size;
+                        ops.fill_mem_hdr = iwl_dump_ini_fifo_fill_header;
+                        ops.fill_range = iwl_dump_ini_rxf_iter;
+                        iwl_dump_ini_mem(fwrt, type, data, reg, &ops);
                        break;
                case IWL_FW_INI_REGION_CSR:
-                        iwl_dump_csr_ini(fwrt->trans, data, reg);
+                        ops.get_num_of_ranges = iwl_dump_ini_mem_ranges;
+                        ops.get_size = iwl_dump_ini_mem_get_size;
+                        ops.fill_mem_hdr = iwl_dump_ini_mem_fill_header;
+                        ops.fill_range = iwl_dump_ini_csr_iter;
+                        iwl_dump_ini_mem(fwrt, type, data, reg, &ops);
                        break;
                case IWL_FW_INI_REGION_DRAM_IMR:
-                case IWL_FW_INI_REGION_INTERNAL_BUFFER:
                        /* This is undefined yet */
                default:
                        break;
@@ -1244,26 +1792,23 @@ static void iwl_fw_ini_dump_trigger(struct iwl_fw_runtime *fwrt,
 static struct iwl_fw_error_dump_file *
 _iwl_fw_error_ini_dump(struct iwl_fw_runtime *fwrt,
-                       struct iwl_fw_dump_ptrs *fw_error_dump,
+                       struct iwl_fw_dump_ptrs *fw_error_dump)
-                       u32 *dump_mask)
 {
        int size, id = le32_to_cpu(fwrt->dump.desc->trig_desc.type);
        struct iwl_fw_error_dump_data *dump_data;
        struct iwl_fw_error_dump_file *dump_file;
-        struct iwl_fw_ini_trigger *trigger, *ext;
+        struct iwl_fw_ini_trigger *trigger;
        if (id == FW_DBG_TRIGGER_FW_ASSERT)
                id = IWL_FW_TRIGGER_ID_FW_ASSERT;
-        if (WARN_ON(id >= ARRAY_SIZE(fwrt->dump.active_trigs)))
+        if (!iwl_fw_ini_trigger_on(fwrt, id))
                return NULL;
-        trigger = fwrt->dump.active_trigs[id].conf;
+        trigger = fwrt->dump.active_trigs[id].trig;
-        ext = fwrt->dump.active_trigs[id].conf_ext;
        size = sizeof(*dump_file);
        size += iwl_fw_ini_get_trigger_len(fwrt, trigger);
-        size += iwl_fw_ini_get_trigger_len(fwrt, ext);
        if (!size)
                return NULL;
@@ -1278,11 +1823,7 @@ _iwl_fw_error_ini_dump(struct iwl_fw_runtime *fwrt,
        dump_data = (void *)dump_file->data;
        dump_file->file_len = cpu_to_le32(size);
-        *dump_mask = 0;
+        iwl_fw_ini_dump_trigger(fwrt, trigger, &dump_data);
-        if (trigger)
-                iwl_fw_ini_dump_trigger(fwrt, trigger, &dump_data, dump_mask);
-        if (ext)
-                iwl_fw_ini_dump_trigger(fwrt, ext, &dump_data, dump_mask);
        return dump_file;
 }
@@ -1308,8 +1849,7 @@ void iwl_fw_error_dump(struct iwl_fw_runtime *fwrt)
                goto out;
        if (fwrt->trans->ini_valid)
-                dump_file = _iwl_fw_error_ini_dump(fwrt, fw_error_dump,
+                dump_file = _iwl_fw_error_ini_dump(fwrt, fw_error_dump);
-                                                   &dump_mask);
        else
                dump_file = _iwl_fw_error_dump(fwrt, fw_error_dump);
@@ -1321,7 +1861,10 @@ void iwl_fw_error_dump(struct iwl_fw_runtime *fwrt)
        if (!fwrt->trans->ini_valid && fwrt->dump.monitor_only)
                dump_mask &= IWL_FW_ERROR_DUMP_FW_MONITOR;
-        fw_error_dump->trans_ptr = iwl_trans_dump_data(fwrt->trans, dump_mask);
+        if (!fwrt->trans->ini_valid)
+                fw_error_dump->trans_ptr =
+                        iwl_trans_dump_data(fwrt->trans, dump_mask);
        file_len = le32_to_cpu(dump_file->file_len);
        fw_error_dump->fwrt_len = file_len;
        if (fw_error_dump->trans_ptr) {
@@ -1362,61 +1905,12 @@ const struct iwl_fw_dump_desc iwl_dump_desc_assert = {
 };
 IWL_EXPORT_SYMBOL(iwl_dump_desc_assert);
-void iwl_fw_assert_error_dump(struct iwl_fw_runtime *fwrt)
-{
-        IWL_INFO(fwrt, "error dump due to fw assert\n");
-        fwrt->dump.desc = &iwl_dump_desc_assert;
-        iwl_fw_error_dump(fwrt);
-}
-IWL_EXPORT_SYMBOL(iwl_fw_assert_error_dump);
-void iwl_fw_alive_error_dump(struct iwl_fw_runtime *fwrt)
-{
-        struct iwl_fw_dump_desc *iwl_dump_desc_no_alive =
-                kmalloc(sizeof(*iwl_dump_desc_no_alive), GFP_KERNEL);
-        if (!iwl_dump_desc_no_alive)
-                return;
-        iwl_dump_desc_no_alive->trig_desc.type =
-                cpu_to_le32(FW_DBG_TRIGGER_NO_ALIVE);
-        iwl_dump_desc_no_alive->len = 0;
-        if (WARN_ON(fwrt->dump.desc))
-                iwl_fw_free_dump_desc(fwrt);
-        IWL_WARN(fwrt, "Collecting data: trigger %d fired.\n",
-                 FW_DBG_TRIGGER_NO_ALIVE);
-        fwrt->dump.desc = iwl_dump_desc_no_alive;
-        iwl_fw_error_dump(fwrt);
-        clear_bit(IWL_FWRT_STATUS_WAIT_ALIVE, &fwrt->status);
-}
-IWL_EXPORT_SYMBOL(iwl_fw_alive_error_dump);
 int iwl_fw_dbg_collect_desc(struct iwl_fw_runtime *fwrt,
                            const struct iwl_fw_dump_desc *desc,
                            bool monitor_only,
                            unsigned int delay)
 {
-        /*
+        if (test_and_set_bit(IWL_FWRT_STATUS_DUMPING, &fwrt->status))
-         * If the loading of the FW completed successfully, the next step is to
-         * get the SMEM config data. Thus, if fwrt->smem_cfg.num_lmacs is non
-         * zero, the FW was already loaded successully. If the state is "NO_FW"
-         * in such a case - exit, since FW may be dead. Otherwise, we
-         * can try to collect the data, since FW might just not be fully
-         * loaded (no "ALIVE" yet), and the debug data is accessible.
-         *
-         * Corner case: got the FW alive but crashed before getting the SMEM
-         *      config. In such a case, due to HW access problems, we might
-         *      collect garbage.
-         */
-        if (fwrt->trans->state == IWL_TRANS_NO_FW &&
-            fwrt->smem_cfg.num_lmacs)
-                return -EIO;
-        if (test_and_set_bit(IWL_FWRT_STATUS_DUMPING, &fwrt->status) ||
-            test_bit(IWL_FWRT_STATUS_WAIT_ALIVE, &fwrt->status))
                return -EBUSY;
        if (WARN_ON(fwrt->dump.desc))
@@ -1428,12 +1922,39 @@ int iwl_fw_dbg_collect_desc(struct iwl_fw_runtime *fwrt,
        fwrt->dump.desc = desc;
        fwrt->dump.monitor_only = monitor_only;
-        schedule_delayed_work(&fwrt->dump.wk, delay);
+        schedule_delayed_work(&fwrt->dump.wk, usecs_to_jiffies(delay));
        return 0;
 }
 IWL_EXPORT_SYMBOL(iwl_fw_dbg_collect_desc);
+int iwl_fw_dbg_error_collect(struct iwl_fw_runtime *fwrt,
+                             enum iwl_fw_dbg_trigger trig_type)
+{
+        int ret;
+        struct iwl_fw_dump_desc *iwl_dump_error_desc =
+                kmalloc(sizeof(*iwl_dump_error_desc), GFP_KERNEL);
+        if (!iwl_dump_error_desc)
+                return -ENOMEM;
+        iwl_dump_error_desc->trig_desc.type = cpu_to_le32(trig_type);
+        iwl_dump_error_desc->len = 0;
+        ret = iwl_fw_dbg_collect_desc(fwrt, iwl_dump_error_desc, false, 0);
+        if (ret) {
+                kfree(iwl_dump_error_desc);
+        } else {
+                set_bit(STATUS_FW_WAIT_DUMP, &fwrt->trans->status);
+                /* trigger nmi to halt the fw */
+                iwl_force_nmi(fwrt->trans);
+        }
+        return ret;
+}
+IWL_EXPORT_SYMBOL(iwl_fw_dbg_error_collect);
 int _iwl_fw_dbg_collect(struct iwl_fw_runtime *fwrt,
                        enum iwl_fw_dbg_trigger trig,
                        const char *str, size_t len,
@@ -1457,8 +1978,10 @@ int _iwl_fw_dbg_collect(struct iwl_fw_runtime *fwrt,
                }
                trigger->occurrences = cpu_to_le16(occurrences);
-                delay = le16_to_cpu(trigger->trig_dis_ms);
                monitor_only = trigger->mode & IWL_FW_DBG_TRIGGER_MONITOR_ONLY;
+                /* convert msec to usec */
+                delay = le32_to_cpu(trigger->stop_delay) * USEC_PER_MSEC;
        }
        desc = kzalloc(sizeof(*desc) + len, GFP_ATOMIC);
@@ -1478,6 +2001,7 @@ int iwl_fw_dbg_collect(struct iwl_fw_runtime *fwrt,
                       u32 id, const char *str, size_t len)
 {
        struct iwl_fw_dump_desc *desc;
+        struct iwl_fw_ini_active_triggers *active;
        u32 occur, delay;
        if (!fwrt->trans->ini_valid)
@@ -1486,15 +2010,17 @@ int iwl_fw_dbg_collect(struct iwl_fw_runtime *fwrt,
        if (id == FW_DBG_TRIGGER_USER)
                id = IWL_FW_TRIGGER_ID_USER_TRIGGER;
-        if (WARN_ON(!fwrt->dump.active_trigs[id].active))
+        active = &fwrt->dump.active_trigs[id];
+        if (WARN_ON(!active->active))
                return -EINVAL;
-        delay = le32_to_cpu(fwrt->dump.active_trigs[id].conf->dump_delay);
+        delay = le32_to_cpu(active->trig->dump_delay);
-        occur = le32_to_cpu(fwrt->dump.active_trigs[id].conf->occurrences);
+        occur = le32_to_cpu(active->trig->occurrences);
        if (!occur)
                return 0;
-        if (le32_to_cpu(fwrt->dump.active_trigs[id].conf->force_restart)) {
+        if (le32_to_cpu(active->trig->force_restart)) {
                IWL_WARN(fwrt, "Force restart: trigger %d fired.\n", id);
                iwl_force_nmi(fwrt->trans);
                return 0;
@@ -1504,8 +2030,7 @@ int iwl_fw_dbg_collect(struct iwl_fw_runtime *fwrt,
        if (!desc)
                return -ENOMEM;
-        occur--;
+        active->trig->occurrences = cpu_to_le32(--occur);
-        fwrt->dump.active_trigs[id].conf->occurrences = cpu_to_le32(occur);
        desc->len = len;
        desc->trig_desc.type = cpu_to_le32(id);
@@ -1670,27 +2195,13 @@ void iwl_fw_dbg_read_d3_debug_data(struct iwl_fw_runtime *fwrt)
 IWL_EXPORT_SYMBOL(iwl_fw_dbg_read_d3_debug_data);
 static void
-iwl_fw_dbg_buffer_allocation(struct iwl_fw_runtime *fwrt,
+iwl_fw_dbg_buffer_allocation(struct iwl_fw_runtime *fwrt, u32 size)
-                             struct iwl_fw_ini_allocation_tlv *alloc)
 {
        struct iwl_trans *trans = fwrt->trans;
-        struct iwl_ldbg_config_cmd ldbg_cmd = {
-                .type = cpu_to_le32(BUFFER_ALLOCATION),
-        };
-        struct iwl_buffer_allocation_cmd *cmd = &ldbg_cmd.buffer_allocation;
-        struct iwl_host_cmd hcmd = {
-                .id = LDBG_CONFIG_CMD,
-                .flags = CMD_ASYNC,
-                .data[0] = &ldbg_cmd,
-                .len[0] = sizeof(ldbg_cmd),
-        };
        void *virtual_addr = NULL;
-        u32 size = le32_to_cpu(alloc->size);
        dma_addr_t phys_addr;
-        if (!trans->num_blocks &&
+        if (WARN_ON_ONCE(trans->num_blocks == ARRAY_SIZE(trans->fw_mon)))
-            le32_to_cpu(alloc->buffer_location) !=
-            IWL_FW_INI_LOCATION_DRAM_PATH)
                return;
        virtual_addr =
@@ -1702,25 +2213,63 @@ iwl_fw_dbg_buffer_allocation(struct iwl_fw_runtime *fwrt,
        if (!virtual_addr)
                IWL_ERR(fwrt, "Failed to allocate debug memory\n");
-        if (WARN_ON_ONCE(trans->num_blocks == ARRAY_SIZE(trans->fw_mon)))
-                return;
        trans->fw_mon[trans->num_blocks].block = virtual_addr;
        trans->fw_mon[trans->num_blocks].physical = phys_addr;
        trans->fw_mon[trans->num_blocks].size = size;
        trans->num_blocks++;
        IWL_DEBUG_FW(trans, "Allocated debug block of size %d\n", size);
+}
+static void iwl_fw_dbg_buffer_apply(struct iwl_fw_runtime *fwrt,
+                                    struct iwl_fw_ini_allocation_data *alloc,
+                                    enum iwl_fw_ini_apply_point pnt)
+{
+        struct iwl_trans *trans = fwrt->trans;
+        struct iwl_ldbg_config_cmd ldbg_cmd = {
+                .type = cpu_to_le32(BUFFER_ALLOCATION),
+        };
+        struct iwl_buffer_allocation_cmd *cmd = &ldbg_cmd.buffer_allocation;
+        struct iwl_host_cmd hcmd = {
+                .id = LDBG_CONFIG_CMD,
+                .flags = CMD_ASYNC,
+                .data[0] = &ldbg_cmd,
+                .len[0] = sizeof(ldbg_cmd),
+        };
+        int block_idx = trans->num_blocks;
+        u32 buf_location = le32_to_cpu(alloc->tlv.buffer_location);
+        if (buf_location == IWL_FW_INI_LOCATION_SRAM_PATH) {
+                if (!WARN(pnt != IWL_FW_INI_APPLY_EARLY,
+                          "Invalid apply point %d for SMEM buffer allocation",
+                          pnt))
+                        /* set sram monitor by enabling bit 7 */
+                        iwl_set_bit(fwrt->trans, CSR_HW_IF_CONFIG_REG,
+                                    CSR_HW_IF_CONFIG_REG_BIT_MONITOR_SRAM);
+                return;
+        }
+        if (buf_location != IWL_FW_INI_LOCATION_DRAM_PATH)
+                return;
+        if (!alloc->is_alloc) {
+                iwl_fw_dbg_buffer_allocation(fwrt,
+                                             le32_to_cpu(alloc->tlv.size));
+                if (block_idx == trans->num_blocks)
+                        return;
+                alloc->is_alloc = 1;
+        }
        /* First block is assigned via registers / context info */
        if (trans->num_blocks == 1)
                return;
        cmd->num_frags = cpu_to_le32(1);
-        cmd->fragments[0].address = cpu_to_le64(phys_addr);
+        cmd->fragments[0].address =
-        cmd->fragments[0].size = alloc->size;
+                cpu_to_le64(trans->fw_mon[block_idx].physical);
-        cmd->allocation_id = alloc->allocation_id;
+        cmd->fragments[0].size = alloc->tlv.size;
-        cmd->buffer_location = alloc->buffer_location;
+        cmd->allocation_id = alloc->tlv.allocation_id;
+        cmd->buffer_location = alloc->tlv.buffer_location;
        iwl_trans_send_cmd(trans, &hcmd);
 }
@@ -1749,9 +2298,9 @@ static void iwl_fw_dbg_update_regions(struct iwl_fw_runtime *fwrt,
        int i, size = le32_to_cpu(tlv->num_regions);
        for (i = 0; i < size; i++) {
-                struct iwl_fw_ini_region_cfg *reg = iter;
+                struct iwl_fw_ini_region_cfg *reg = iter, **active;
                int id = le32_to_cpu(reg->region_id);
-                struct iwl_fw_ini_active_regs *active;
+                u32 type = le32_to_cpu(reg->region_type);
                if (WARN(id >= ARRAY_SIZE(fwrt->dump.active_regs),
                         "Invalid region id %d for apply point %d\n", id, pnt))
@@ -1759,26 +2308,47 @@ static void iwl_fw_dbg_update_regions(struct iwl_fw_runtime *fwrt,
                active = &fwrt->dump.active_regs[id];
-                if (ext && active->apply_point == pnt)
+                if (*active)
-                        IWL_WARN(fwrt->trans,
+                        IWL_WARN(fwrt->trans, "region TLV %d override\n", id);
-                                 "External region TLV overrides FW default %x\n",
-                                 id);
                IWL_DEBUG_FW(fwrt,
                             "%s: apply point %d, activating region ID %d\n",
                             __func__, pnt, id);
-                active->reg = reg;
+                *active = reg;
-                active->apply_point = pnt;
-                if (le32_to_cpu(reg->region_type) !=
+                if (type == IWL_FW_INI_REGION_TXF ||
-                    IWL_FW_INI_REGION_DRAM_BUFFER)
+                    type == IWL_FW_INI_REGION_RXF)
-                        iter += le32_to_cpu(reg->num_regions) * sizeof(__le32);
+                        iter += le32_to_cpu(reg->fifos.num_of_registers) *
+                                sizeof(__le32);
+                else if (type != IWL_FW_INI_REGION_DRAM_BUFFER)
+                        iter += le32_to_cpu(reg->internal.num_of_ranges) *
+                                sizeof(__le32);
                iter += sizeof(*reg);
        }
 }
+static int iwl_fw_dbg_trig_realloc(struct iwl_fw_runtime *fwrt,
+                                   struct iwl_fw_ini_active_triggers *active,
+                                   u32 id, int size)
+{
+        void *ptr;
+        if (size <= active->size)
+                return 0;
+        ptr = krealloc(active->trig, size, GFP_KERNEL);
+        if (!ptr) {
+                IWL_ERR(fwrt, "Failed to allocate memory for trigger %d\n", id);
+                return -ENOMEM;
+        }
+        active->trig = ptr;
+        active->size = size;
+        return 0;
+}
 static void iwl_fw_dbg_update_triggers(struct iwl_fw_runtime *fwrt,
                                       struct iwl_fw_ini_trigger_tlv *tlv,
                                       bool ext,
@@ -1791,43 +2361,61 @@ static void iwl_fw_dbg_update_triggers(struct iwl_fw_runtime *fwrt,
                struct iwl_fw_ini_trigger *trig = iter;
                struct iwl_fw_ini_active_triggers *active;
                int id = le32_to_cpu(trig->trigger_id);
-                u32 num;
+                u32 trig_regs_size = le32_to_cpu(trig->num_regions) *
+                        sizeof(__le32);
                if (WARN_ON(id >= ARRAY_SIZE(fwrt->dump.active_trigs)))
                        break;
                active = &fwrt->dump.active_trigs[id];
-                if (active->apply_point != apply_point) {
+                if (!active->active) {
-                        active->conf = NULL;
+                        size_t trig_size = sizeof(*trig) + trig_regs_size;
-                        active->conf_ext = NULL;
-                }
-                num = le32_to_cpu(trig->num_regions);
+                        if (iwl_fw_dbg_trig_realloc(fwrt, active, id,
+                                                    trig_size))
+                                goto next;
-                if (ext && active->apply_point == apply_point) {
+                        memcpy(active->trig, trig, trig_size);
-                        num += le32_to_cpu(active->conf->num_regions);
-                        if (trig->ignore_default) {
+                } else {
-                                active->conf_ext = active->conf;
+                        u32 conf_override =
-                                active->conf = trig;
+                                !(le32_to_cpu(trig->override_trig) & 0xff);
+                        u32 region_override =
+                                !(le32_to_cpu(trig->override_trig) & 0xff00);
+                        u32 offset = 0;
+                        u32 active_regs =
+                                le32_to_cpu(active->trig->num_regions);
+                        u32 new_regs = le32_to_cpu(trig->num_regions);
+                        int mem_to_add = trig_regs_size;
+                        if (region_override) {
+                                mem_to_add -= active_regs * sizeof(__le32);
                        } else {
-                                active->conf_ext = trig;
+                                offset += active_regs;
+                                new_regs += active_regs;
                        }
-                } else {
-                        active->conf = trig;
+                        if (iwl_fw_dbg_trig_realloc(fwrt, active, id,
+                                                    active->size + mem_to_add))
+                                goto next;
+                        if (conf_override)
+                                memcpy(active->trig, trig, sizeof(*trig));
+                        memcpy(active->trig->data + offset, trig->data,
+                               trig_regs_size);
+                        active->trig->num_regions = cpu_to_le32(new_regs);
                }
                /* Since zero means infinity - just set to -1 */
-                if (!le32_to_cpu(trig->occurrences))
+                if (!le32_to_cpu(active->trig->occurrences))
-                        trig->occurrences = cpu_to_le32(-1);
+                        active->trig->occurrences = cpu_to_le32(-1);
-                if (!le32_to_cpu(trig->ignore_consec))
-                        trig->ignore_consec = cpu_to_le32(-1);
-                iter += sizeof(*trig) +
+                active->active = true;
-                        le32_to_cpu(trig->num_regions) * sizeof(__le32);
+next:
+                iter += sizeof(*trig) + trig_regs_size;
-                active->active = num;
-                active->apply_point = apply_point;
        }
 }
@@ -1844,9 +2432,13 @@ static void _iwl_fw_dbg_apply_point(struct iwl_fw_runtime *fwrt,
                u32 type = le32_to_cpu(tlv->type);
                switch (type) {
-                case IWL_UCODE_TLV_TYPE_BUFFER_ALLOCATION:
+                case IWL_UCODE_TLV_TYPE_BUFFER_ALLOCATION: {
-                        iwl_fw_dbg_buffer_allocation(fwrt, ini_tlv);
+                        struct iwl_fw_ini_allocation_data *buf_alloc = ini_tlv;
+                        iwl_fw_dbg_buffer_apply(fwrt, ini_tlv, pnt);
+                        iter += sizeof(buf_alloc->is_alloc);
                        break;
+                }
                case IWL_UCODE_TLV_TYPE_HCMD:
                        if (pnt < IWL_FW_INI_APPLY_AFTER_ALIVE) {
                                IWL_ERR(fwrt,
@@ -1877,6 +2469,16 @@ void iwl_fw_dbg_apply_point(struct iwl_fw_runtime *fwrt,
                            enum iwl_fw_ini_apply_point apply_point)
 {
        void *data = &fwrt->trans->apply_points[apply_point];
+        int i;
+        if (apply_point == IWL_FW_INI_APPLY_EARLY) {
+                for (i = 0; i < IWL_FW_INI_MAX_REGION_ID; i++)
+                        fwrt->dump.active_regs[i] = NULL;
+                /* disable the triggers, used in recovery flow */
+                for (i = 0; i < IWL_FW_TRIGGER_ID_NUM; i++)
+                        fwrt->dump.active_trigs[i].active = false;
+        }
        _iwl_fw_dbg_apply_point(fwrt, data, apply_point, false);
@@ -1884,3 +2486,27 @@ void iwl_fw_dbg_apply_point(struct iwl_fw_runtime *fwrt,
        _iwl_fw_dbg_apply_point(fwrt, data, apply_point, true);
 }
 IWL_EXPORT_SYMBOL(iwl_fw_dbg_apply_point);
+void iwl_fwrt_stop_device(struct iwl_fw_runtime *fwrt)
+{
+        /* if the wait event timeout elapses instead of wake up then
+         * the driver did not receive NMI interrupt and can not assume the FW
+         * is halted
+         */
+        int ret = wait_event_timeout(fwrt->trans->fw_halt_waitq,
+                                     !test_bit(STATUS_FW_WAIT_DUMP,
+                                               &fwrt->trans->status),
+                                     msecs_to_jiffies(2000));
+        if (!ret) {
+                /* failed to receive NMI interrupt, assuming the FW is stuck */
+                set_bit(STATUS_FW_ERROR, &fwrt->trans->status);
+                clear_bit(STATUS_FW_WAIT_DUMP, &fwrt->trans->status);
+        }
+        /* Assuming the op mode mutex is held at this point */
+        iwl_fw_dbg_collect_sync(fwrt);
+        iwl_trans_stop_device(fwrt->trans);
+}
+IWL_EXPORT_SYMBOL(iwl_fwrt_stop_device);
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.h b/drivers/net/wireless/intel/iwlwifi/fw/dbg.h
index 330229d2a61d..a199056234d3 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.h
@@ -8,7 +8,7 @@
 * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
 * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -112,6 +112,8 @@ void iwl_fw_error_dump(struct iwl_fw_runtime *fwrt);
 int iwl_fw_dbg_collect_desc(struct iwl_fw_runtime *fwrt,
                            const struct iwl_fw_dump_desc *desc,
                            bool monitor_only, unsigned int delay);
+int iwl_fw_dbg_error_collect(struct iwl_fw_runtime *fwrt,
+                             enum iwl_fw_dbg_trigger trig_type);
 int _iwl_fw_dbg_collect(struct iwl_fw_runtime *fwrt,
                        enum iwl_fw_dbg_trigger trig,
                        const char *str, size_t len,
@@ -160,9 +162,9 @@ iwl_fw_dbg_trigger_stop_conf_match(struct iwl_fw_runtime *fwrt,
 }
 static inline bool
-iwl_fw_dbg_no_trig_window(struct iwl_fw_runtime *fwrt, u32 id, u32 dis_ms)
+iwl_fw_dbg_no_trig_window(struct iwl_fw_runtime *fwrt, u32 id, u32 dis_usec)
 {
-        unsigned long wind_jiff = msecs_to_jiffies(dis_ms);
+        unsigned long wind_jiff = usecs_to_jiffies(dis_usec);
        /* If this is the first event checked, jump to update start ts */
        if (fwrt->dump.non_collect_ts_start[id] &&
@@ -179,11 +181,12 @@ iwl_fw_dbg_trigger_check_stop(struct iwl_fw_runtime *fwrt,
                              struct wireless_dev *wdev,
                              struct iwl_fw_dbg_trigger_tlv *trig)
 {
+        u32 usec = le16_to_cpu(trig->trig_dis_ms) * USEC_PER_MSEC;
        if (wdev && !iwl_fw_dbg_trigger_vif_match(trig, wdev))
                return false;
-        if (iwl_fw_dbg_no_trig_window(fwrt, le32_to_cpu(trig->id),
+        if (iwl_fw_dbg_no_trig_window(fwrt, le32_to_cpu(trig->id), usec)) {
-                                      le16_to_cpu(trig->trig_dis_ms))) {
                IWL_WARN(fwrt, "Trigger %d occurred while no-collect window.\n",
                         trig->id);
                return false;
@@ -220,23 +223,22 @@ _iwl_fw_dbg_trigger_on(struct iwl_fw_runtime *fwrt,
 })
 static inline bool
-_iwl_fw_ini_trigger_on(struct iwl_fw_runtime *fwrt,
+iwl_fw_ini_trigger_on(struct iwl_fw_runtime *fwrt,
-                       const enum iwl_fw_dbg_trigger id)
+                      enum iwl_fw_ini_trigger_id id)
 {
-        struct iwl_fw_ini_active_triggers *trig = &fwrt->dump.active_trigs[id];
+        struct iwl_fw_ini_trigger *trig;
-        u32 ms;
+        u32 usec;
-        if (!fwrt->trans->ini_valid)
-                return false;
-        if (!trig || !trig->active)
+        if (!fwrt->trans->ini_valid || id >= IWL_FW_TRIGGER_ID_NUM ||
+            !fwrt->dump.active_trigs[id].active)
                return false;
-        ms = le32_to_cpu(trig->conf->ignore_consec);
+        trig = fwrt->dump.active_trigs[id].trig;
-        if (ms)
+        usec = le32_to_cpu(trig->ignore_consec);
-                ms /= USEC_PER_MSEC;
-        if (iwl_fw_dbg_no_trig_window(fwrt, id, ms)) {
+        if (iwl_fw_dbg_no_trig_window(fwrt, id, usec)) {
                IWL_WARN(fwrt, "Trigger %d fired in no-collect window\n", id);
                return false;
        }
@@ -244,12 +246,6 @@ _iwl_fw_ini_trigger_on(struct iwl_fw_runtime *fwrt,
        return true;
 }
-#define iwl_fw_ini_trigger_on(fwrt, wdev, id) ({                \
-        BUILD_BUG_ON(!__builtin_constant_p(id));                \
-        BUILD_BUG_ON((id) >= IWL_FW_TRIGGER_ID_NUM);            \
-        _iwl_fw_ini_trigger_on((fwrt), (wdev), (id));           \
-})
 static inline void
 _iwl_fw_dbg_trigger_simple_stop(struct iwl_fw_runtime *fwrt,
                                struct wireless_dev *wdev,
@@ -296,13 +292,13 @@ _iwl_fw_dbg_stop_recording(struct iwl_trans *trans,
        }
        if (params) {
-                params->in_sample = iwl_read_prph(trans, DBGC_IN_SAMPLE);
+                params->in_sample = iwl_read_umac_prph(trans, DBGC_IN_SAMPLE);
-                params->out_ctrl = iwl_read_prph(trans, DBGC_OUT_CTRL);
+                params->out_ctrl = iwl_read_umac_prph(trans, DBGC_OUT_CTRL);
        }
-        iwl_write_prph(trans, DBGC_IN_SAMPLE, 0);
+        iwl_write_umac_prph(trans, DBGC_IN_SAMPLE, 0);
        udelay(100);
-        iwl_write_prph(trans, DBGC_OUT_CTRL, 0);
+        iwl_write_umac_prph(trans, DBGC_OUT_CTRL, 0);
 #ifdef CONFIG_IWLWIFI_DEBUGFS
        trans->dbg_rec_on = false;
 #endif
@@ -330,9 +326,9 @@ _iwl_fw_dbg_restart_recording(struct iwl_trans *trans,
                iwl_clear_bits_prph(trans, MON_BUFF_SAMPLE_CTL, 0x1);
                iwl_set_bits_prph(trans, MON_BUFF_SAMPLE_CTL, 0x1);
        } else {
-                iwl_write_prph(trans, DBGC_IN_SAMPLE, params->in_sample);
+                iwl_write_umac_prph(trans, DBGC_IN_SAMPLE, params->in_sample);
                udelay(100);
-                iwl_write_prph(trans, DBGC_OUT_CTRL, params->out_ctrl);
+                iwl_write_umac_prph(trans, DBGC_OUT_CTRL, params->out_ctrl);
        }
 }
@@ -373,7 +369,9 @@ static inline bool iwl_fw_dbg_is_d3_debug_enabled(struct iwl_fw_runtime *fwrt)
 {
        return fw_has_capa(&fwrt->fw->ucode_capa,
                           IWL_UCODE_TLV_CAPA_D3_DEBUG) &&
-                fwrt->trans->cfg->d3_debug_data_length &&
+                fwrt->trans->cfg->d3_debug_data_length && fwrt->ops &&
+                fwrt->ops->d3_debug_enable &&
+                fwrt->ops->d3_debug_enable(fwrt->ops_ctx) &&
                iwl_fw_dbg_type_on(fwrt, IWL_FW_ERROR_DUMP_D3_DEBUG_DATA);
 }
@@ -434,10 +432,33 @@ static inline void iwl_fw_resume_timestamp(struct iwl_fw_runtime *fwrt) {}
 #endif /* CONFIG_IWLWIFI_DEBUGFS */
-void iwl_fw_assert_error_dump(struct iwl_fw_runtime *fwrt);
-void iwl_fw_alive_error_dump(struct iwl_fw_runtime *fwrt);
 void iwl_fw_dbg_collect_sync(struct iwl_fw_runtime *fwrt);
 void iwl_fw_dbg_apply_point(struct iwl_fw_runtime *fwrt,
                            enum iwl_fw_ini_apply_point apply_point);
+void iwl_fwrt_stop_device(struct iwl_fw_runtime *fwrt);
+static inline void iwl_fw_lmac1_set_alive_err_table(struct iwl_trans *trans,
+                                                    u32 lmac_error_event_table)
+{
+        if (!(trans->error_event_table_tlv_status &
+              IWL_ERROR_EVENT_TABLE_LMAC1) ||
+            WARN_ON(trans->lmac_error_event_table[0] !=
+                    lmac_error_event_table))
+                trans->lmac_error_event_table[0] = lmac_error_event_table;
+}
+static inline void iwl_fw_umac_set_alive_err_table(struct iwl_trans *trans,
+                                                   u32 umac_error_event_table)
+{
+        if (!(trans->error_event_table_tlv_status &
+              IWL_ERROR_EVENT_TABLE_UMAC) ||
+            WARN_ON(trans->umac_error_event_table !=
+                    umac_error_event_table))
+                trans->umac_error_event_table = umac_error_event_table;
+}
+/* This bit is used to differentiate the legacy dump from the ini dump */
+#define INI_DUMP_BIT BIT(31)
 #endif  /* __iwl_fw_dbg_h__ */
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c b/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c
index 3e120dd47305..c1aa4360736b 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/debugfs.c
@@ -173,9 +173,8 @@ static const struct file_operations iwl_dbgfs_##name##_ops = {		\
        _FWRT_DEBUGFS_READ_WRITE_FILE_OPS(name, bufsz, struct iwl_fw_runtime)
 #define FWRT_DEBUGFS_ADD_FILE_ALIAS(alias, name, parent, mode) do {     \
-        if (!debugfs_create_file(alias, mode, parent, fwrt,             \
+        debugfs_create_file(alias, mode, parent, fwrt,                  \
-                                 &iwl_dbgfs_##name##_ops))              \
+                            &iwl_dbgfs_##name##_ops);                   \
-                goto err;                                               \
        } while (0)
 #define FWRT_DEBUGFS_ADD_FILE(name, parent, mode) \
        FWRT_DEBUGFS_ADD_FILE_ALIAS(#name, name, parent, mode)
@@ -321,14 +320,10 @@ out:
 FWRT_DEBUGFS_WRITE_FILE_OPS(send_hcmd, 512);
-int iwl_fwrt_dbgfs_register(struct iwl_fw_runtime *fwrt,
+void iwl_fwrt_dbgfs_register(struct iwl_fw_runtime *fwrt,
                            struct dentry *dbgfs_dir)
 {
        INIT_DELAYED_WORK(&fwrt->timestamp.wk, iwl_fw_timestamp_marker_wk);
        FWRT_DEBUGFS_ADD_FILE(timestamp_marker, dbgfs_dir, 0200);
        FWRT_DEBUGFS_ADD_FILE(send_hcmd, dbgfs_dir, 0200);
-        return 0;
-err:
-        IWL_ERR(fwrt, "Can't create the fwrt debugfs directory\n");
-        return -ENOMEM;
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/debugfs.h b/drivers/net/wireless/intel/iwlwifi/fw/debugfs.h
index 88255035e8ef..fde40ff88451 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/debugfs.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/debugfs.h
@@ -63,14 +63,11 @@
 #include "runtime.h"
 #ifdef CONFIG_IWLWIFI_DEBUGFS
-int iwl_fwrt_dbgfs_register(struct iwl_fw_runtime *fwrt,
+void iwl_fwrt_dbgfs_register(struct iwl_fw_runtime *fwrt,
                            struct dentry *dbgfs_dir);
 #else
-static inline int iwl_fwrt_dbgfs_register(struct iwl_fw_runtime *fwrt,
+static inline void iwl_fwrt_dbgfs_register(struct iwl_fw_runtime *fwrt,
-                                          struct dentry *dbgfs_dir)
+                                           struct dentry *dbgfs_dir) { }
-{
-        return 0;
-}
 #endif /* CONFIG_IWLWIFI_DEBUGFS */
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/error-dump.h b/drivers/net/wireless/intel/iwlwifi/fw/error-dump.h
index c02425a1e64f..9b5077bd46c3 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/error-dump.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/error-dump.h
@@ -8,7 +8,7 @@
 * Copyright(c) 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2014 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018 - 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
 * Copyright(c) 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2014 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018 - 2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -275,22 +275,68 @@ struct iwl_fw_error_dump_mem {
 };
 /**
- * struct iwl_fw_error_dump_named_mem - chunk of memory
+ * struct iwl_fw_ini_error_dump_range - range of memory
- * @type: &enum iwl_fw_error_dump_mem_type
+ * @start_addr: the start address of this range
- * @offset: the offset from which the memory was read
+ * @range_data_size: the size of this range, in bytes
- * @name_len: name length
+ * @data: the actual memory
- * @name: file name
- * @data: the content of the memory
 */
-struct iwl_fw_error_dump_named_mem {
+struct iwl_fw_ini_error_dump_range {
-        __le32 type;
+        __le32 start_addr;
-        __le32 offset;
+        __le32 range_data_size;
-        u8 name_len;
+        __le32 data[];
-        u8 name[32];
+} __packed;
-        u8 data[];
+/**
+ * struct iwl_fw_ini_error_dump_header - ini region dump header
+ * @num_of_ranges: number of ranges in this region
+ * @name_len: number of bytes allocated to the name string of this region
+ * @name: name of the region
+ */
+struct iwl_fw_ini_error_dump_header {
+        __le32 num_of_ranges;
+        __le32 name_len;
+        u8 name[IWL_FW_INI_MAX_NAME];
 };
 /**
+ * struct iwl_fw_ini_error_dump - ini region dump
+ * @header: the header of this region
+ * @ranges: the memory ranges of this region
+ */
+struct iwl_fw_ini_error_dump {
+        struct iwl_fw_ini_error_dump_header header;
+        struct iwl_fw_ini_error_dump_range ranges[];
+} __packed;
+/* This bit is used to differentiate between lmac and umac rxf */
+#define IWL_RXF_UMAC_BIT BIT(31)
+/**
+ * struct iwl_fw_ini_fifo_error_dump_range - ini fifo range dump
+ * @fifo_num: the fifo num. In case of rxf and umac rxf, set BIT(31) to
+ *      distinguish between lmac and umac
+ * @num_of_registers: num of registers to dump, dword size each
+ * @range_data_size: the size of the registers and fifo data
+ * @data: fifo data
+ */
+struct iwl_fw_ini_fifo_error_dump_range {
+        __le32 fifo_num;
+        __le32 num_of_registers;
+        __le32 range_data_size;
+        __le32 data[];
+} __packed;
+/**
+ * struct iwl_fw_ini_fifo_error_dump - ini fifo region dump
+ * @header: the header of this region
+ * @ranges: the memory ranges of this region
+ */
+struct iwl_fw_ini_fifo_error_dump {
+        struct iwl_fw_ini_error_dump_header header;
+        struct iwl_fw_ini_fifo_error_dump_range ranges[];
+} __packed;
+/**
 * struct iwl_fw_error_dump_rb - content of an Receive Buffer
 * @index: the index of the Receive Buffer in the Rx queue
 * @rxq: the RB's Rx queue
@@ -305,6 +351,20 @@ struct iwl_fw_error_dump_rb {
 };
 /**
+ * struct iwl_fw_ini_monitor_dram_dump - ini dram monitor dump
+ * @header - header of the region
+ * @write_ptr - write pointer position in the dram
+ * @cycle_cnt - cycles count
+ * @ranges - the memory ranges of this this region
+ */
+struct iwl_fw_ini_monitor_dram_dump {
+        struct iwl_fw_ini_error_dump_header header;
+        __le32 write_ptr;
+        __le32 cycle_cnt;
+        struct iwl_fw_ini_error_dump_range ranges[];
+} __packed;
+/**
 * struct iwl_fw_error_dump_paging - content of the UMAC's image page
 *      block on DRAM
 * @index: the index of the page block
@@ -355,7 +415,9 @@ iwl_fw_error_next_data(struct iwl_fw_error_dump_data *data)
 * @FW_DBG_TDLS: trigger log collection upon TDLS related events.
 * @FW_DBG_TRIGGER_TX_STATUS: trigger log collection upon tx status when
 *  the firmware sends a tx reply.
- * @FW_DBG_TRIGGER_NO_ALIVE: trigger log collection if alive flow fails
+ * @FW_DBG_TRIGGER_ALIVE_TIMEOUT: trigger log collection if alive flow timeouts
+ * @FW_DBG_TRIGGER_DRIVER: trigger log collection upon a flow failure
+ *      in the driver.
 */
 enum iwl_fw_dbg_trigger {
        FW_DBG_TRIGGER_INVALID = 0,
@@ -373,7 +435,8 @@ enum iwl_fw_dbg_trigger {
        FW_DBG_TRIGGER_TX_LATENCY,
        FW_DBG_TRIGGER_TDLS,
        FW_DBG_TRIGGER_TX_STATUS,
-        FW_DBG_TRIGGER_NO_ALIVE,
+        FW_DBG_TRIGGER_ALIVE_TIMEOUT,
+        FW_DBG_TRIGGER_DRIVER,
        /* must be last */
        FW_DBG_TRIGGER_MAX,
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/file.h b/drivers/net/wireless/intel/iwlwifi/fw/file.h
index e8b00b795cbb..641c95d03b15 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/file.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/file.h
@@ -9,6 +9,7 @@
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
 * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -32,6 +33,7 @@
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
 * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -143,6 +145,9 @@ enum iwl_ucode_tlv_type {
        IWL_UCODE_TLV_FW_GSCAN_CAPA     = 50,
        IWL_UCODE_TLV_FW_MEM_SEG        = 51,
        IWL_UCODE_TLV_IML               = 52,
+        IWL_UCODE_TLV_UMAC_DEBUG_ADDRS  = 54,
+        IWL_UCODE_TLV_LMAC_DEBUG_ADDRS  = 55,
+        IWL_UCODE_TLV_FW_RECOVERY_INFO  = 57,
        IWL_UCODE_TLV_TYPE_BUFFER_ALLOCATION    = IWL_UCODE_INI_TLV_GROUP | 0x1,
        IWL_UCODE_TLV_TYPE_HCMD                 = IWL_UCODE_INI_TLV_GROUP | 0x2,
        IWL_UCODE_TLV_TYPE_REGIONS              = IWL_UCODE_INI_TLV_GROUP | 0x3,
@@ -263,6 +268,12 @@ typedef unsigned int __bitwise iwl_ucode_tlv_api_t;
 * @IWL_UCODE_TLV_API_FRAG_EBS: This ucode supports fragmented EBS
 * @IWL_UCODE_TLV_API_REDUCE_TX_POWER: This ucode supports v5 of
 *      the REDUCE_TX_POWER_CMD.
+ * @IWL_UCODE_TLV_API_SHORT_BEACON_NOTIF: This ucode supports the short
+ *      version of the beacon notification.
+ * @IWL_UCODE_TLV_API_BEACON_FILTER_V4: This ucode supports v4 of
+ *      BEACON_FILTER_CONFIG_API_S_VER_4.
+ * @IWL_UCODE_TLV_API_FTM_NEW_RANGE_REQ: This ucode supports v7 of
+ *      LOCATION_RANGE_REQ_CMD_API_S and v6 of LOCATION_RANGE_RESP_NTFY_API_S.
 *
 * @NUM_IWL_UCODE_TLV_API: number of bits used
 */
@@ -287,6 +298,9 @@ enum iwl_ucode_tlv_api {
        IWL_UCODE_TLV_API_ADAPTIVE_DWELL_V2     = (__force iwl_ucode_tlv_api_t)42,
        IWL_UCODE_TLV_API_FRAG_EBS              = (__force iwl_ucode_tlv_api_t)44,
        IWL_UCODE_TLV_API_REDUCE_TX_POWER       = (__force iwl_ucode_tlv_api_t)45,
+        IWL_UCODE_TLV_API_SHORT_BEACON_NOTIF    = (__force iwl_ucode_tlv_api_t)46,
+        IWL_UCODE_TLV_API_BEACON_FILTER_V4      = (__force iwl_ucode_tlv_api_t)47,
+        IWL_UCODE_TLV_API_FTM_NEW_RANGE_REQ     = (__force iwl_ucode_tlv_api_t)49,
        NUM_IWL_UCODE_TLV_API
 #ifdef __CHECKER__
@@ -333,6 +347,7 @@ typedef unsigned int __bitwise iwl_ucode_tlv_capa_t;
 * @IWL_UCODE_TLV_CAPA_TLC_OFFLOAD: firmware implements rate scaling algorithm
 * @IWL_UCODE_TLV_CAPA_DYNAMIC_QUOTA: firmware implements quota related
 * @IWL_UCODE_TLV_CAPA_COEX_SCHEMA_2: firmware implements Coex Schema 2
+ * IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD: firmware supports CSA command
 * @IWL_UCODE_TLV_CAPA_ULTRA_HB_CHANNELS: firmware supports ultra high band
 *      (6 GHz).
 * @IWL_UCODE_TLV_CAPA_EXTENDED_DTS_MEASURE: extended DTS measurement
@@ -363,12 +378,15 @@ typedef unsigned int __bitwise iwl_ucode_tlv_capa_t;
 *      capability.
 * @IWL_UCODE_TLV_CAPA_CSI_REPORTING: firmware is capable of being configured
 *      to report the CSI information with (certain) RX frames
+ * @IWL_UCODE_TLV_CAPA_FTM_CALIBRATED: has FTM calibrated and thus supports both
+ *      initiator and responder
 *
 * @IWL_UCODE_TLV_CAPA_MLME_OFFLOAD: supports MLME offload
 *
 * @NUM_IWL_UCODE_TLV_CAPA: number of bits used
 */
 enum iwl_ucode_tlv_capa {
+        /* set 0 */
        IWL_UCODE_TLV_CAPA_D0I3_SUPPORT                 = (__force iwl_ucode_tlv_capa_t)0,
        IWL_UCODE_TLV_CAPA_LAR_SUPPORT                  = (__force iwl_ucode_tlv_capa_t)1,
        IWL_UCODE_TLV_CAPA_UMAC_SCAN                    = (__force iwl_ucode_tlv_capa_t)2,
@@ -390,6 +408,8 @@ enum iwl_ucode_tlv_capa {
        IWL_UCODE_TLV_CAPA_LAR_MULTI_MCC                = (__force iwl_ucode_tlv_capa_t)29,
        IWL_UCODE_TLV_CAPA_BT_COEX_RRC                  = (__force iwl_ucode_tlv_capa_t)30,
        IWL_UCODE_TLV_CAPA_GSCAN_SUPPORT                = (__force iwl_ucode_tlv_capa_t)31,
+        /* set 1 */
        IWL_UCODE_TLV_CAPA_STA_PM_NOTIF                 = (__force iwl_ucode_tlv_capa_t)38,
        IWL_UCODE_TLV_CAPA_BINDING_CDB_SUPPORT          = (__force iwl_ucode_tlv_capa_t)39,
        IWL_UCODE_TLV_CAPA_CDB_SUPPORT                  = (__force iwl_ucode_tlv_capa_t)40,
@@ -397,7 +417,11 @@ enum iwl_ucode_tlv_capa {
        IWL_UCODE_TLV_CAPA_TLC_OFFLOAD                  = (__force iwl_ucode_tlv_capa_t)43,
        IWL_UCODE_TLV_CAPA_DYNAMIC_QUOTA                = (__force iwl_ucode_tlv_capa_t)44,
        IWL_UCODE_TLV_CAPA_COEX_SCHEMA_2                = (__force iwl_ucode_tlv_capa_t)45,
+        IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD           = (__force iwl_ucode_tlv_capa_t)46,
        IWL_UCODE_TLV_CAPA_ULTRA_HB_CHANNELS            = (__force iwl_ucode_tlv_capa_t)48,
+        IWL_UCODE_TLV_CAPA_FTM_CALIBRATED               = (__force iwl_ucode_tlv_capa_t)47,
+        /* set 2 */
        IWL_UCODE_TLV_CAPA_EXTENDED_DTS_MEASURE         = (__force iwl_ucode_tlv_capa_t)64,
        IWL_UCODE_TLV_CAPA_SHORT_PM_TIMEOUTS            = (__force iwl_ucode_tlv_capa_t)65,
        IWL_UCODE_TLV_CAPA_BT_MPLUT_SUPPORT             = (__force iwl_ucode_tlv_capa_t)67,
@@ -418,6 +442,7 @@ enum iwl_ucode_tlv_capa {
        IWL_UCODE_TLV_CAPA_MCC_UPDATE_11AX_SUPPORT      = (__force iwl_ucode_tlv_capa_t)89,
        IWL_UCODE_TLV_CAPA_CSI_REPORTING                = (__force iwl_ucode_tlv_capa_t)90,
+        /* set 3 */
        IWL_UCODE_TLV_CAPA_MLME_OFFLOAD                 = (__force iwl_ucode_tlv_capa_t)96,
        NUM_IWL_UCODE_TLV_CAPA
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/img.h b/drivers/net/wireless/intel/iwlwifi/fw/img.h
index 12333167ea23..f4c5a4d73206 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/img.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/img.h
@@ -105,6 +105,8 @@ struct iwl_ucode_capabilities {
        u32 n_scan_channels;
        u32 standard_phy_calibration_size;
        u32 flags;
+        u32 error_log_addr;
+        u32 error_log_size;
        unsigned long _api[BITS_TO_LONGS(NUM_IWL_UCODE_TLV_API)];
        unsigned long _capa[BITS_TO_LONGS(NUM_IWL_UCODE_TLV_CAPA)];
 };
@@ -223,27 +225,24 @@ struct iwl_fw_dbg {
 };
 /**
+ * @tlv: the buffer allocation tlv
+ * @is_alloc: indicates if the buffer was already allocated
+ */
+struct iwl_fw_ini_allocation_data {
+        struct iwl_fw_ini_allocation_tlv tlv;
+        u32 is_alloc;
+} __packed;
+/**
 * struct iwl_fw_ini_active_triggers
 * @active: is this trigger active
- * @apply_point: last apply point that updated this trigger
+ * @size: allocated memory size of the trigger
- * @conf: active trigger
+ * @trig: trigger
- * @conf_ext: second trigger, contains extra regions to dump
 */
 struct iwl_fw_ini_active_triggers {
        bool active;
-        enum iwl_fw_ini_apply_point apply_point;
+        size_t size;
-        struct iwl_fw_ini_trigger *conf;
+        struct iwl_fw_ini_trigger *trig;
-        struct iwl_fw_ini_trigger *conf_ext;
-};
-/**
- * struct iwl_fw_ini_active_regs
- * @reg: active region from TLV
- * @apply_point: apply point where it became active
- */
-struct iwl_fw_ini_active_regs {
-        struct iwl_fw_ini_region_cfg *reg;
-        enum iwl_fw_ini_apply_point apply_point;
 };
 /**
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/init.c b/drivers/net/wireless/intel/iwlwifi/fw/init.c
index 2efac307909e..7adf4e4e841a 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/init.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/init.c
@@ -6,6 +6,7 @@
 * GPL LICENSE SUMMARY
 *
 * Copyright(c) 2017 Intel Deutschland GmbH
+ * Copyright(c) 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -26,6 +27,7 @@
 * BSD LICENSE
 *
 * Copyright(c) 2017 Intel Deutschland GmbH
+ * Copyright(c) 2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -74,6 +76,7 @@ void iwl_fw_runtime_init(struct iwl_fw_runtime *fwrt, struct iwl_trans *trans,
        fwrt->ops_ctx = ops_ctx;
        INIT_DELAYED_WORK(&fwrt->dump.wk, iwl_fw_error_dump_wk);
        iwl_fwrt_dbgfs_register(fwrt, dbgfs_dir);
+        init_waitqueue_head(&fwrt->trans->fw_halt_waitq);
 }
 IWL_EXPORT_SYMBOL(iwl_fw_runtime_init);
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/runtime.h b/drivers/net/wireless/intel/iwlwifi/fw/runtime.h
index a0fcbb28114b..a5fe1a8ca426 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/runtime.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/runtime.h
@@ -6,7 +6,7 @@
 * GPL LICENSE SUMMARY
 *
 * Copyright(c) 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright (C) 2018-2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -27,7 +27,7 @@
 * BSD LICENSE
 *
 * Copyright(c) 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright (C) 2018-2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -73,6 +73,7 @@ struct iwl_fw_runtime_ops {
        void (*dump_end)(void *ctx);
        bool (*fw_running)(void *ctx);
        int (*send_hcmd)(void *ctx, struct iwl_host_cmd *host_cmd);
+        bool (*d3_debug_enable)(void *ctx);
 };
 #define MAX_NUM_LMAC 2
@@ -90,7 +91,6 @@ struct iwl_fwrt_shared_mem_cfg {
 enum iwl_fw_runtime_status {
        IWL_FWRT_STATUS_DUMPING = 0,
-        IWL_FWRT_STATUS_WAIT_ALIVE,
 };
 /**
@@ -138,12 +138,13 @@ struct iwl_fw_runtime {
                u8 conf;
                /* ts of the beginning of a non-collect fw dbg data period */
-                unsigned long non_collect_ts_start[IWL_FW_TRIGGER_ID_NUM - 1];
+                unsigned long non_collect_ts_start[IWL_FW_TRIGGER_ID_NUM];
                u32 *d3_debug_data;
-                struct iwl_fw_ini_active_regs active_regs[IWL_FW_INI_MAX_REGION_ID];
+                struct iwl_fw_ini_region_cfg *active_regs[IWL_FW_INI_MAX_REGION_ID];
                struct iwl_fw_ini_active_triggers active_trigs[IWL_FW_TRIGGER_ID_NUM];
                u32 lmac_err_id[MAX_NUM_LMAC];
                u32 umac_err_id;
+                void *fifo_iter;
        } dump;
 #ifdef CONFIG_IWLWIFI_DEBUGFS
        struct {
@@ -161,8 +162,20 @@ void iwl_fw_runtime_init(struct iwl_fw_runtime *fwrt, struct iwl_trans *trans,
 static inline void iwl_fw_runtime_free(struct iwl_fw_runtime *fwrt)
 {
+        int i;
        kfree(fwrt->dump.d3_debug_data);
        fwrt->dump.d3_debug_data = NULL;
+        for (i = 0; i < IWL_FW_TRIGGER_ID_NUM; i++) {
+                struct iwl_fw_ini_active_triggers *active =
+                        &fwrt->dump.active_trigs[i];
+                active->active = false;
+                active->size = 0;
+                kfree(active->trig);
+                active->trig = NULL;
+        }
 }
 void iwl_fw_runtime_suspend(struct iwl_fw_runtime *fwrt);
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
index ff942532fac3..f5f87773667b 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
@@ -7,7 +7,7 @@
 *
 * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
 * Copyright (C) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -29,7 +29,7 @@
 *
 * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
 * Copyright (C) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -89,6 +89,7 @@ enum iwl_device_family {
        IWL_DEVICE_FAMILY_9000,
        IWL_DEVICE_FAMILY_22000,
        IWL_DEVICE_FAMILY_22560,
+        IWL_DEVICE_FAMILY_AX210,
 };
 /*
@@ -379,6 +380,9 @@ struct iwl_csr_params {
 * @nvm_type: see &enum iwl_nvm_type
 * @d3_debug_data_base_addr: base address where D3 debug data is stored
 * @d3_debug_data_length: length of the D3 debug data
+ * @bisr_workaround: BISR hardware workaround (for 22260 series devices)
+ * @min_txq_size: minimum number of slots required in a TX queue
+ * @umac_prph_offset: offset to add to UMAC periphery address
 *
 * We enable the driver to be backward compatible wrt. hardware features.
 * API differences in uCode shouldn't be handled here but through TLVs
@@ -428,7 +432,8 @@ struct iwl_cfg {
            use_tfh:1,
            gen2:1,
            cdb:1,
-            dbgc_supported:1;
+            dbgc_supported:1,
+            bisr_workaround:1;
        u8 valid_tx_ant;
        u8 valid_rx_ant;
        u8 non_shared_ant;
@@ -443,37 +448,12 @@ struct iwl_cfg {
        u32 extra_phy_cfg_flags;
        u32 d3_debug_data_base_addr;
        u32 d3_debug_data_length;
+        u32 min_txq_size;
+        u32 umac_prph_offset;
 };
-static const struct iwl_csr_params iwl_csr_v1 = {
+extern const struct iwl_csr_params iwl_csr_v1;
-        .flag_mac_clock_ready = 0,
+extern const struct iwl_csr_params iwl_csr_v2;
-        .flag_val_mac_access_en = 0,
-        .flag_init_done = 2,
-        .flag_mac_access_req = 3,
-        .flag_sw_reset = 7,
-        .flag_master_dis = 8,
-        .flag_stop_master = 9,
-        .addr_sw_reset = (CSR_BASE + 0x020),
-        .mac_addr0_otp = 0x380,
-        .mac_addr1_otp = 0x384,
-        .mac_addr0_strap = 0x388,
-        .mac_addr1_strap = 0x38C
-};
-static const struct iwl_csr_params iwl_csr_v2 = {
-        .flag_init_done = 6,
-        .flag_mac_clock_ready = 20,
-        .flag_val_mac_access_en = 20,
-        .flag_mac_access_req = 21,
-        .flag_master_dis = 28,
-        .flag_stop_master = 29,
-        .flag_sw_reset = 31,
-        .addr_sw_reset = (CSR_BASE + 0x024),
-        .mac_addr0_otp = 0x30,
-        .mac_addr1_otp = 0x34,
-        .mac_addr0_strap = 0x38,
-        .mac_addr1_strap = 0x3C
-};
 /*
 * This list declares the config structures for all devices.
@@ -568,7 +548,7 @@ extern const struct iwl_cfg iwl9560_killer_s_2ac_cfg_shared_clk;
 extern const struct iwl_cfg iwl22000_2ac_cfg_hr;
 extern const struct iwl_cfg iwl22000_2ac_cfg_hr_cdb;
 extern const struct iwl_cfg iwl22000_2ac_cfg_jf;
-extern const struct iwl_cfg iwl22560_2ax_cfg_hr;
+extern const struct iwl_cfg iwl_ax101_cfg_qu_hr;
 extern const struct iwl_cfg iwl22000_2ax_cfg_hr;
 extern const struct iwl_cfg iwl22260_2ax_cfg;
 extern const struct iwl_cfg killer1650s_2ax_cfg_qu_b0_hr_b0;
@@ -585,9 +565,13 @@ extern const struct iwl_cfg iwl22000_2ax_cfg_jf;
 extern const struct iwl_cfg iwl22000_2ax_cfg_qnj_hr_a0_f0;
 extern const struct iwl_cfg iwl22000_2ax_cfg_qnj_hr_b0_f0;
 extern const struct iwl_cfg iwl22000_2ax_cfg_qnj_hr_b0;
-extern const struct iwl_cfg iwl22000_2ax_cfg_qnj_jf_b0;
+extern const struct iwl_cfg iwl9560_2ac_cfg_qnj_jf_b0;
 extern const struct iwl_cfg iwl22000_2ax_cfg_qnj_hr_a0;
 extern const struct iwl_cfg iwl22560_2ax_cfg_su_cdb;
+extern const struct iwl_cfg iwlax210_2ax_cfg_so_jf_a0;
+extern const struct iwl_cfg iwlax210_2ax_cfg_so_hr_a0;
+extern const struct iwl_cfg iwlax210_2ax_cfg_so_gf_a0;
+extern const struct iwl_cfg iwlax210_2ax_cfg_ty_gf_a0;
 #endif /* CPTCFG_IWLMVM || CPTCFG_IWLFMAC */
 #endif /* __IWL_CONFIG_H__ */
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-csr.h b/drivers/net/wireless/intel/iwlwifi/iwl-csr.h
index 42af421bbc3c..aea6d03e545a 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-csr.h
@@ -180,6 +180,7 @@
 /* Bits for CSR_HW_IF_CONFIG_REG */
 #define CSR_HW_IF_CONFIG_REG_MSK_MAC_DASH       (0x00000003)
 #define CSR_HW_IF_CONFIG_REG_MSK_MAC_STEP       (0x0000000C)
+#define CSR_HW_IF_CONFIG_REG_BIT_MONITOR_SRAM   (0x00000080)
 #define CSR_HW_IF_CONFIG_REG_MSK_BOARD_VER      (0x000000C0)
 #define CSR_HW_IF_CONFIG_REG_BIT_MAC_SI         (0x00000100)
 #define CSR_HW_IF_CONFIG_REG_BIT_RADIO_SI       (0x00000200)
@@ -327,11 +328,14 @@ enum {
 #define CSR_HW_REV_TYPE_QNJ             (0x0000360)
 #define CSR_HW_REV_TYPE_QNJ_B0          (0x0000364)
 #define CSR_HW_REV_TYPE_HR_CDB          (0x0000340)
+#define CSR_HW_REV_TYPE_SO              (0x0000370)
+#define CSR_HW_REV_TYPE_TY              (0x0000420)
 /* RF_ID value */
 #define CSR_HW_RF_ID_TYPE_JF            (0x00105100)
 #define CSR_HW_RF_ID_TYPE_HR            (0x0010A000)
 #define CSR_HW_RF_ID_TYPE_HRCDB         (0x00109F00)
+#define CSR_HW_RF_ID_TYPE_GF            (0x0010D000)
 /* HW_RF CHIP ID  */
 #define CSR_HW_RF_ID_TYPE_CHIP_ID(_val) (((_val) >> 12) & 0xFFF)
@@ -593,6 +597,7 @@ enum msix_hw_int_causes {
        MSIX_HW_INT_CAUSES_REG_ALIVE            = BIT(0),
        MSIX_HW_INT_CAUSES_REG_WAKEUP           = BIT(1),
        MSIX_HW_INT_CAUSES_REG_IPC              = BIT(1),
+        MSIX_HW_INT_CAUSES_REG_IML              = BIT(2),
        MSIX_HW_INT_CAUSES_REG_SW_ERR_V2        = BIT(5),
        MSIX_HW_INT_CAUSES_REG_CT_KILL          = BIT(6),
        MSIX_HW_INT_CAUSES_REG_RF_KILL          = BIT(7),
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
index 43d815cb3ce9..5798f434f68f 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
@@ -71,6 +71,7 @@ void iwl_fw_dbg_copy_tlv(struct iwl_trans *trans, struct iwl_ucode_tlv *tlv,
        u32 apply_point = le32_to_cpu(header->apply_point);
        int copy_size = le32_to_cpu(tlv->length) + sizeof(*tlv);
+        int offset_size = copy_size;
        if (WARN_ONCE(apply_point >= IWL_FW_INI_APPLY_NUM,
                      "Invalid apply point id %d\n", apply_point))
@@ -81,17 +82,25 @@ void iwl_fw_dbg_copy_tlv(struct iwl_trans *trans, struct iwl_ucode_tlv *tlv,
        else
                data = &trans->apply_points[apply_point];
+        /* add room for is_alloc field in &iwl_fw_ini_allocation_data struct */
+        if (le32_to_cpu(tlv->type) == IWL_UCODE_TLV_TYPE_BUFFER_ALLOCATION) {
+                struct iwl_fw_ini_allocation_data *buf_alloc =
+                        (void *)tlv->data;
+                offset_size += sizeof(buf_alloc->is_alloc);
+        }
        /*
         * Make sure we still have room to copy this TLV. Offset points to the
         * location the last copy ended.
         */
-        if (WARN_ONCE(data->offset + copy_size > data->size,
+        if (WARN_ONCE(data->offset + offset_size > data->size,
                      "Not enough memory for apply point %d\n",
                      apply_point))
                return;
        memcpy(data->data + data->offset, (void *)tlv, copy_size);
-        data->offset += copy_size;
+        data->offset += offset_size;
 }
 void iwl_alloc_dbg_tlv(struct iwl_trans *trans, size_t len, const u8 *data,
@@ -129,6 +138,16 @@ void iwl_alloc_dbg_tlv(struct iwl_trans *trans, size_t len, const u8 *data,
                if (WARN_ON(apply >= IWL_FW_INI_APPLY_NUM))
                        continue;
+                /* add room for is_alloc field in &iwl_fw_ini_allocation_data
+                 * struct
+                 */
+                if (tlv_type == IWL_UCODE_TLV_TYPE_BUFFER_ALLOCATION) {
+                        struct iwl_fw_ini_allocation_data *buf_alloc =
+                                (void *)tlv->data;
+                        size[apply] += sizeof(buf_alloc->is_alloc);
+                }
                size[apply] += sizeof(*tlv) + tlv_len;
        }
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-debug.h b/drivers/net/wireless/intel/iwlwifi/iwl-debug.h
index a2af68a0d34b..655ff5694560 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-debug.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-debug.h
@@ -1,6 +1,7 @@
 /******************************************************************************
 *
 * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
+ * Copyright (C) 2018 Intel Corporation
 *
 * Portions of this file are derived from the ipw3945 project.
 *
@@ -159,7 +160,7 @@ do {                                            			\
 /* 0x000F0000 - 0x00010000 */
 #define IWL_DL_FW               0x00010000
 #define IWL_DL_RF_KILL          0x00020000
-#define IWL_DL_FW_ERRORS        0x00040000
+#define IWL_DL_TPT              0x00040000
 /* 0x00F00000 - 0x00100000 */
 #define IWL_DL_RATE             0x00100000
 #define IWL_DL_CALIB            0x00200000
@@ -193,7 +194,6 @@ do {                                            			\
 #define IWL_DEBUG_CALIB(p, f, a...)     IWL_DEBUG(p, IWL_DL_CALIB, f, ## a)
 #define IWL_DEBUG_FW(p, f, a...)        IWL_DEBUG(p, IWL_DL_FW, f, ## a)
 #define IWL_DEBUG_RF_KILL(p, f, a...)   IWL_DEBUG(p, IWL_DL_RF_KILL, f, ## a)
-#define IWL_DEBUG_FW_ERRORS(p, f, a...) IWL_DEBUG(p, IWL_DL_FW_ERRORS, f, ## a)
 #define IWL_DEBUG_DROP(p, f, a...)      IWL_DEBUG(p, IWL_DL_DROP, f, ## a)
 #define IWL_DEBUG_DROP_LIMIT(p, f, a...)        \
                IWL_DEBUG_LIMIT(p, IWL_DL_DROP, f, ## a)
@@ -215,6 +215,7 @@ do {                                            			\
 #define IWL_DEBUG_DEV_RADIO(p, f, a...) IWL_DEBUG_DEV(p, IWL_DL_RADIO, f, ## a)
 #define IWL_DEBUG_POWER(p, f, a...)     IWL_DEBUG(p, IWL_DL_POWER, f, ## a)
 #define IWL_DEBUG_11H(p, f, a...)       IWL_DEBUG(p, IWL_DL_11H, f, ## a)
+#define IWL_DEBUG_TPT(p, f, a...)       IWL_DEBUG(p, IWL_DL_TPT, f, ## a)
 #define IWL_DEBUG_RPM(p, f, a...)       IWL_DEBUG(p, IWL_DL_RPM, f, ## a)
 #define IWL_DEBUG_LAR(p, f, a...)       IWL_DEBUG(p, IWL_DL_LAR, f, ## a)
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
index 2efa1dfe9b4c..689a65b11cc3 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
@@ -8,6 +8,7 @@
 * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018 - 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -30,6 +31,7 @@
 * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018 - 2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -75,6 +77,7 @@
 #include "iwl-dbg-tlv.h"
 #include "iwl-config.h"
 #include "iwl-modparams.h"
+#include "fw/api/alive.h"
 /******************************************************************************
 *
@@ -588,6 +591,8 @@ static int iwl_parse_v1_v2_firmware(struct iwl_drv *drv,
        return 0;
 }
+#define FW_ADDR_CACHE_CONTROL 0xC0000000
 static int iwl_parse_tlv_firmware(struct iwl_drv *drv,
                                const struct firmware *ucode_raw,
                                struct iwl_firmware_pieces *pieces,
@@ -1085,6 +1090,52 @@ static int iwl_parse_tlv_firmware(struct iwl_drv *drv,
                                return -ENOMEM;
                        break;
                        }
+                case IWL_UCODE_TLV_FW_RECOVERY_INFO: {
+                        struct {
+                                __le32 buf_addr;
+                                __le32 buf_size;
+                        } *recov_info = (void *)tlv_data;
+                        if (tlv_len != sizeof(*recov_info))
+                                goto invalid_tlv_len;
+                        capa->error_log_addr =
+                                le32_to_cpu(recov_info->buf_addr);
+                        capa->error_log_size =
+                                le32_to_cpu(recov_info->buf_size);
+                        }
+                        break;
+                case IWL_UCODE_TLV_UMAC_DEBUG_ADDRS: {
+                        struct iwl_umac_debug_addrs *dbg_ptrs =
+                                (void *)tlv_data;
+                        if (tlv_len != sizeof(*dbg_ptrs))
+                                goto invalid_tlv_len;
+                        if (drv->trans->cfg->device_family <
+                            IWL_DEVICE_FAMILY_22000)
+                                break;
+                        drv->trans->umac_error_event_table =
+                                le32_to_cpu(dbg_ptrs->error_info_addr) &
+                                ~FW_ADDR_CACHE_CONTROL;
+                        drv->trans->error_event_table_tlv_status |=
+                                IWL_ERROR_EVENT_TABLE_UMAC;
+                        break;
+                        }
+                case IWL_UCODE_TLV_LMAC_DEBUG_ADDRS: {
+                        struct iwl_lmac_debug_addrs *dbg_ptrs =
+                                (void *)tlv_data;
+                        if (tlv_len != sizeof(*dbg_ptrs))
+                                goto invalid_tlv_len;
+                        if (drv->trans->cfg->device_family <
+                            IWL_DEVICE_FAMILY_22000)
+                                break;
+                        drv->trans->lmac_error_event_table[0] =
+                                le32_to_cpu(dbg_ptrs->error_event_table_ptr) &
+                                ~FW_ADDR_CACHE_CONTROL;
+                        drv->trans->error_event_table_tlv_status |=
+                                IWL_ERROR_EVENT_TABLE_LMAC1;
+                        break;
+                        }
                case IWL_UCODE_TLV_TYPE_BUFFER_ALLOCATION:
                case IWL_UCODE_TLV_TYPE_HCMD:
                case IWL_UCODE_TLV_TYPE_REGIONS:
@@ -1202,11 +1253,6 @@ _iwl_op_mode_start(struct iwl_drv *drv, struct iwlwifi_opmode_table *op)
 #ifdef CONFIG_IWLWIFI_DEBUGFS
        drv->dbgfs_op_mode = debugfs_create_dir(op->name,
                                                drv->dbgfs_drv);
-        if (!drv->dbgfs_op_mode) {
-                IWL_ERR(drv,
-                        "failed to create opmode debugfs directory\n");
-                return op_mode;
-        }
        dbgfs_dir = drv->dbgfs_op_mode;
 #endif
@@ -1262,8 +1308,8 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context)
        fw->ucode_capa.standard_phy_calibration_size =
                        IWL_DEFAULT_STANDARD_PHY_CALIBRATE_TBL_SIZE;
        fw->ucode_capa.n_scan_channels = IWL_DEFAULT_SCAN_CHANNELS;
-        /* dump all fw memory areas by default except d3 debug data */
+        /* dump all fw memory areas by default */
-        fw->dbg.dump_mask = 0xfffdffff;
+        fw->dbg.dump_mask = 0xffffffff;
        pieces = kzalloc(sizeof(*pieces), GFP_KERNEL);
        if (!pieces)
@@ -1569,20 +1615,8 @@ struct iwl_drv *iwl_drv_start(struct iwl_trans *trans)
        drv->dbgfs_drv = debugfs_create_dir(dev_name(trans->dev),
                                            iwl_dbgfs_root);
-        if (!drv->dbgfs_drv) {
-                IWL_ERR(drv, "failed to create debugfs directory\n");
-                ret = -ENOMEM;
-                goto err_free_tlv;
-        }
        /* Create transport layer debugfs dir */
        drv->trans->dbgfs_dir = debugfs_create_dir("trans", drv->dbgfs_drv);
-        if (!drv->trans->dbgfs_dir) {
-                IWL_ERR(drv, "failed to create transport debugfs directory\n");
-                ret = -ENOMEM;
-                goto err_free_dbgfs;
-        }
 #endif
        ret = iwl_request_firmware(drv, true);
@@ -1595,9 +1629,7 @@ struct iwl_drv *iwl_drv_start(struct iwl_trans *trans)
 err_fw:
 #ifdef CONFIG_IWLWIFI_DEBUGFS
-err_free_dbgfs:
        debugfs_remove_recursive(drv->dbgfs_drv);
-err_free_tlv:
        iwl_fw_dbg_free(drv->trans);
 #endif
        kfree(drv);
@@ -1708,9 +1740,6 @@ static int __init iwl_drv_init(void)
 #ifdef CONFIG_IWLWIFI_DEBUGFS
        /* Create the root of iwlwifi debugfs subsystem. */
        iwl_dbgfs_root = debugfs_create_dir(DRV_NAME, NULL);
-        if (!iwl_dbgfs_root)
-                return -EFAULT;
 #endif
        return iwl_pci_register_driver();
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c
index 75940ac406b9..04338c3a6205 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c
@@ -850,8 +850,7 @@ iwl_parse_eeprom_data(struct device *dev, const struct iwl_cfg *cfg,
        if (WARN_ON(!cfg || !cfg->eeprom_params))
                return NULL;
-        data = kzalloc(sizeof(*data) +
+        data = kzalloc(struct_size(data, channels, IWL_NUM_CHANNELS),
-                       sizeof(struct ieee80211_channel) * IWL_NUM_CHANNELS,
                       GFP_KERNEL);
        if (!data)
                return NULL;
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-read.c b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-read.c
index a6db6a814257..82e87192119e 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-read.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-read.c
@@ -193,34 +193,25 @@ static int iwl_init_otp_access(struct iwl_trans *trans)
 {
        int ret;
-        /* Enable 40MHz radio clock */
+        ret = iwl_finish_nic_init(trans);
-        iwl_write32(trans, CSR_GP_CNTRL,
+        if (ret)
-                    iwl_read32(trans, CSR_GP_CNTRL) |
+                return ret;
-                    BIT(trans->cfg->csr->flag_init_done));
+        iwl_set_bits_prph(trans, APMG_PS_CTRL_REG,
-        /* wait for clock to be ready */
+                          APMG_PS_CTRL_VAL_RESET_REQ);
-        ret = iwl_poll_bit(trans, CSR_GP_CNTRL,
+        udelay(5);
-                           BIT(trans->cfg->csr->flag_mac_clock_ready),
+        iwl_clear_bits_prph(trans, APMG_PS_CTRL_REG,
-                           BIT(trans->cfg->csr->flag_mac_clock_ready),
+                            APMG_PS_CTRL_VAL_RESET_REQ);
-                           25000);
-        if (ret < 0) {
+        /*
-                IWL_ERR(trans, "Time out access OTP\n");
+         * CSR auto clock gate disable bit -
-        } else {
+         * this is only applicable for HW with OTP shadow RAM
-                iwl_set_bits_prph(trans, APMG_PS_CTRL_REG,
+         */
-                                  APMG_PS_CTRL_VAL_RESET_REQ);
+        if (trans->cfg->base_params->shadow_ram_support)
-                udelay(5);
+                iwl_set_bit(trans, CSR_DBG_LINK_PWR_MGMT_REG,
-                iwl_clear_bits_prph(trans, APMG_PS_CTRL_REG,
+                            CSR_RESET_LINK_PWR_MGMT_DISABLED);
-                                    APMG_PS_CTRL_VAL_RESET_REQ);
+        return 0;
-                /*
-                 * CSR auto clock gate disable bit -
-                 * this is only applicable for HW with OTP shadow RAM
-                 */
-                if (trans->cfg->base_params->shadow_ram_support)
-                        iwl_set_bit(trans, CSR_DBG_LINK_PWR_MGMT_REG,
-                                    CSR_RESET_LINK_PWR_MGMT_DISABLED);
-        }
-        return ret;
 }
 static int iwl_read_otp_word(struct iwl_trans *trans, u16 addr,
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-io.c b/drivers/net/wireless/intel/iwlwifi/iwl-io.c
index ffd1e649bfa0..a704e25af810 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-io.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-io.c
@@ -7,6 +7,7 @@
 *
 * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2015 - 2016 Intel Deutschland GmbH
+ * Copyright(C) 2018 - 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of version 2 of the GNU General Public License as
@@ -28,6 +29,7 @@
 *
 * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2015 - 2016 Intel Deutschland GmbH
+ * Copyright (C) 2018 - 2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -68,6 +70,36 @@
 #include "iwl-prph.h"
 #include "iwl-fh.h"
+const struct iwl_csr_params iwl_csr_v1 = {
+        .flag_mac_clock_ready = 0,
+        .flag_val_mac_access_en = 0,
+        .flag_init_done = 2,
+        .flag_mac_access_req = 3,
+        .flag_sw_reset = 7,
+        .flag_master_dis = 8,
+        .flag_stop_master = 9,
+        .addr_sw_reset = CSR_BASE + 0x020,
+        .mac_addr0_otp = 0x380,
+        .mac_addr1_otp = 0x384,
+        .mac_addr0_strap = 0x388,
+        .mac_addr1_strap = 0x38C
+};
+const struct iwl_csr_params iwl_csr_v2 = {
+        .flag_init_done = 6,
+        .flag_mac_clock_ready = 20,
+        .flag_val_mac_access_en = 20,
+        .flag_mac_access_req = 21,
+        .flag_master_dis = 28,
+        .flag_stop_master = 29,
+        .flag_sw_reset = 31,
+        .addr_sw_reset = CSR_BASE + 0x024,
+        .mac_addr0_otp = 0x30,
+        .mac_addr1_otp = 0x34,
+        .mac_addr0_strap = 0x38,
+        .mac_addr1_strap = 0x3C
+};
 void iwl_write8(struct iwl_trans *trans, u32 ofs, u8 val)
 {
        trace_iwlwifi_dev_iowrite8(trans->dev, ofs, val);
@@ -275,9 +307,12 @@ void iwl_force_nmi(struct iwl_trans *trans)
        if (trans->cfg->device_family < IWL_DEVICE_FAMILY_9000)
                iwl_write_prph(trans, DEVICE_SET_NMI_REG,
                               DEVICE_SET_NMI_VAL_DRV);
+        else if (trans->cfg->device_family < IWL_DEVICE_FAMILY_AX210)
+                iwl_write_umac_prph(trans, UREG_NIC_SET_NMI_DRIVER,
+                                UREG_NIC_SET_NMI_DRIVER_NMI_FROM_DRIVER_MSK);
        else
-                iwl_write_prph(trans, UREG_NIC_SET_NMI_DRIVER,
+                iwl_write_umac_prph(trans, UREG_DOORBELL_TO_ISR6,
-                               UREG_NIC_SET_NMI_DRIVER_NMI_FROM_DRIVER_MSK);
+                                    UREG_DOORBELL_TO_ISR6_NMI_BIT);
 }
 IWL_EXPORT_SYMBOL(iwl_force_nmi);
@@ -456,3 +491,43 @@ int iwl_dump_fh(struct iwl_trans *trans, char **buf)
        return 0;
 }
+int iwl_finish_nic_init(struct iwl_trans *trans)
+{
+        int err;
+        if (trans->cfg->bisr_workaround) {
+                /* ensure the TOP FSM isn't still in previous reset */
+                mdelay(2);
+        }
+        /*
+         * Set "initialization complete" bit to move adapter from
+         * D0U* --> D0A* (powered-up active) state.
+         */
+        iwl_set_bit(trans, CSR_GP_CNTRL,
+                    BIT(trans->cfg->csr->flag_init_done));
+        if (trans->cfg->device_family == IWL_DEVICE_FAMILY_8000)
+                udelay(2);
+        /*
+         * Wait for clock stabilization; once stabilized, access to
+         * device-internal resources is supported, e.g. iwl_write_prph()
+         * and accesses to uCode SRAM.
+         */
+        err = iwl_poll_bit(trans, CSR_GP_CNTRL,
+                           BIT(trans->cfg->csr->flag_mac_clock_ready),
+                           BIT(trans->cfg->csr->flag_mac_clock_ready),
+                           25000);
+        if (err < 0)
+                IWL_DEBUG_INFO(trans, "Failed to wake NIC\n");
+        if (trans->cfg->bisr_workaround) {
+                /* ensure BISR shift has finished */
+                udelay(200);
+        }
+        return err < 0 ? err : 0;
+}
+IWL_EXPORT_SYMBOL(iwl_finish_nic_init);
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-io.h b/drivers/net/wireless/intel/iwlwifi/iwl-io.h
index 61477e58352d..920e2146ea3f 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-io.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-io.h
@@ -5,6 +5,8 @@
 *
 * GPL LICENSE SUMMARY
 *
+ * Copyright (C) 2018 - 2019 Intel Corporation
+ *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of version 2 of the GNU General Public License as
 * published by the Free Software Foundation.
@@ -23,6 +25,7 @@
 *
 * BSD LICENSE
 *
+ * Copyright (C) 2018 - 2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -96,7 +99,48 @@ void iwl_set_bits_mask_prph(struct iwl_trans *trans, u32 ofs,
 void iwl_clear_bits_prph(struct iwl_trans *trans, u32 ofs, u32 mask);
 void iwl_force_nmi(struct iwl_trans *trans);
+int iwl_finish_nic_init(struct iwl_trans *trans);
 /* Error handling */
 int iwl_dump_fh(struct iwl_trans *trans, char **buf);
+/*
+ * UMAC periphery address space changed from 0xA00000 to 0xD00000 starting from
+ * device family AX200. So peripheries used in families above and below AX200
+ * should go through iwl_..._umac_..._prph.
+ */
+static inline u32 iwl_umac_prph(struct iwl_trans *trans, u32 ofs)
+{
+        return ofs + trans->cfg->umac_prph_offset;
+}
+static inline u32 iwl_read_umac_prph_no_grab(struct iwl_trans *trans, u32 ofs)
+{
+        return iwl_read_prph_no_grab(trans, ofs + trans->cfg->umac_prph_offset);
+}
+static inline u32 iwl_read_umac_prph(struct iwl_trans *trans, u32 ofs)
+{
+        return iwl_read_prph(trans, ofs + trans->cfg->umac_prph_offset);
+}
+static inline void iwl_write_umac_prph_no_grab(struct iwl_trans *trans, u32 ofs,
+                                               u32 val)
+{
+        iwl_write_prph_no_grab(trans,  ofs + trans->cfg->umac_prph_offset, val);
+}
+static inline void iwl_write_umac_prph(struct iwl_trans *trans, u32 ofs,
+                                       u32 val)
+{
+        iwl_write_prph(trans,  ofs + trans->cfg->umac_prph_offset, val);
+}
+static inline int iwl_poll_umac_prph_bit(struct iwl_trans *trans, u32 addr,
+                                         u32 bits, u32 mask, int timeout)
+{
+        return iwl_poll_prph_bit(trans, addr + trans->cfg->umac_prph_offset,
+                                 bits, mask, timeout);
+}
 #endif
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
index 63c081e5c63a..87d6de7efdd2 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
@@ -8,7 +8,7 @@
 * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
 * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -463,6 +463,9 @@ static void iwl_init_vht_hw_capab(const struct iwl_cfg *cfg,
        }
        vht_cap->vht_mcs.tx_mcs_map = vht_cap->vht_mcs.rx_mcs_map;
+        vht_cap->vht_mcs.tx_highest |=
+                cpu_to_le16(IEEE80211_VHT_EXT_NSS_BW_CAPABLE);
 }
 static struct ieee80211_sband_iftype_data iwl_he_capa[] = {
@@ -930,15 +933,13 @@ iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg,
        const __le16 *ch_section;
        if (cfg->nvm_type != IWL_NVM_EXT)
-                data = kzalloc(sizeof(*data) +
+                data = kzalloc(struct_size(data, channels,
-                               sizeof(struct ieee80211_channel) *
+                                           IWL_NVM_NUM_CHANNELS),
-                               IWL_NVM_NUM_CHANNELS,
+                                           GFP_KERNEL);
-                               GFP_KERNEL);
        else
-                data = kzalloc(sizeof(*data) +
+                data = kzalloc(struct_size(data, channels,
-                               sizeof(struct ieee80211_channel) *
+                                           IWL_NVM_NUM_CHANNELS_EXT),
-                               IWL_NVM_NUM_CHANNELS_EXT,
+                                           GFP_KERNEL);
-                               GFP_KERNEL);
        if (!data)
                return NULL;
@@ -1086,12 +1087,12 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
        int max_num_ch = cfg->nvm_type == IWL_NVM_EXT ?
                         IWL_NVM_NUM_CHANNELS_EXT : IWL_NVM_NUM_CHANNELS;
-        if (WARN_ON_ONCE(num_of_ch > NL80211_MAX_SUPP_REG_RULES))
-                return ERR_PTR(-EINVAL);
        if (WARN_ON(num_of_ch > max_num_ch))
                num_of_ch = max_num_ch;
+        if (WARN_ON_ONCE(num_of_ch > NL80211_MAX_SUPP_REG_RULES))
+                return ERR_PTR(-EINVAL);
        IWL_DEBUG_DEV(dev, IWL_DL_LAR, "building regdom for %d channels\n",
                      num_of_ch);
@@ -1425,9 +1426,7 @@ struct iwl_nvm_data *iwl_get_nvm(struct iwl_trans *trans,
        if (empty_otp)
                IWL_INFO(trans, "OTP is empty\n");
-        nvm = kzalloc(sizeof(*nvm) +
+        nvm = kzalloc(struct_size(nvm, channels, IWL_NUM_CHANNELS), GFP_KERNEL);
-                      sizeof(struct ieee80211_channel) * IWL_NUM_CHANNELS,
-                      GFP_KERNEL);
        if (!nvm) {
                ret = -ENOMEM;
                goto out;
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
index 3aaa5f06461c..1af9f9e1ecd4 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
@@ -8,7 +8,7 @@
 * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
 * Copyright(c) 2016        Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018 - 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
 * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
 * Copyright(c) 2016        Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018 - 2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -433,4 +433,7 @@ enum {
 #define HPM_DEBUG                       0xA03440
 #define PERSISTENCE_BIT                 BIT(12)
 #define PREG_WFPM_ACCESS                BIT(12)
+#define UREG_DOORBELL_TO_ISR6           0xA05C04
+#define UREG_DOORBELL_TO_ISR6_NMI_BIT   BIT(0)
 #endif                          /* __iwl_prph_h__ */
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
index a7009cd4232d..bbebbf3efd57 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
@@ -8,6 +8,7 @@
 * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018 - 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -30,6 +31,7 @@
 * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018 - 2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -230,6 +232,12 @@ enum iwl_hcmd_dataflag {
        IWL_HCMD_DFL_DUP        = BIT(1),
 };
+enum iwl_error_event_table_status {
+        IWL_ERROR_EVENT_TABLE_LMAC1 = BIT(0),
+        IWL_ERROR_EVENT_TABLE_LMAC2 = BIT(1),
+        IWL_ERROR_EVENT_TABLE_UMAC = BIT(2),
+};
 /**
 * struct iwl_host_cmd - Host command to the uCode
 *
@@ -330,6 +338,7 @@ enum iwl_d3_status {
 *      are sent
 * @STATUS_TRANS_IDLE: the trans is idle - general commands are not to be sent
 * @STATUS_TRANS_DEAD: trans is dead - avoid any read/write operation
+ * @STATUS_FW_WAIT_DUMP: if set, wait until cleared before collecting dump
 */
 enum iwl_trans_status {
        STATUS_SYNC_HCMD_ACTIVE,
@@ -342,6 +351,7 @@ enum iwl_trans_status {
        STATUS_TRANS_GOING_IDLE,
        STATUS_TRANS_IDLE,
        STATUS_TRANS_DEAD,
+        STATUS_FW_WAIT_DUMP,
 };
 static inline int
@@ -684,6 +694,9 @@ enum iwl_plat_pm_mode {
 */
 #define IWL_TRANS_IDLE_TIMEOUT 2000
+/* Max time to wait for nmi interrupt */
+#define IWL_TRANS_NMI_TIMEOUT (HZ / 4)
 /**
 * struct iwl_dram_data
 * @physical: page phy pointer
@@ -697,6 +710,20 @@ struct iwl_dram_data {
 };
 /**
+ * struct iwl_self_init_dram - dram data used by self init process
+ * @fw: lmac and umac dram data
+ * @fw_cnt: total number of items in array
+ * @paging: paging dram data
+ * @paging_cnt: total number of items in array
+ */
+struct iwl_self_init_dram {
+        struct iwl_dram_data *fw;
+        int fw_cnt;
+        struct iwl_dram_data *paging;
+        int paging_cnt;
+};
+/**
 * struct iwl_trans - transport common data
 *
 * @ops - pointer to iwl_trans_ops
@@ -738,6 +765,10 @@ struct iwl_dram_data {
 *      mode is set during the initialization phase and is not
 *      supposed to change during runtime.
 * @dbg_rec_on: true iff there is a fw debug recording currently active
+ * @lmac_error_event_table: addrs of lmacs error tables
+ * @umac_error_event_table: addr of umac error table
+ * @error_event_table_tlv_status: bitmap that indicates what error table
+ *      pointers was recevied via TLV. use enum &iwl_error_event_table_status
 */
 struct iwl_trans {
        const struct iwl_trans_ops *ops;
@@ -790,12 +821,18 @@ struct iwl_trans {
        u8 dbg_n_dest_reg;
        int num_blocks;
        struct iwl_dram_data fw_mon[IWL_FW_INI_APPLY_NUM];
+        struct iwl_self_init_dram init_dram;
        enum iwl_plat_pm_mode system_pm_mode;
        enum iwl_plat_pm_mode runtime_pm_mode;
        bool suspending;
        bool dbg_rec_on;
+        u32 lmac_error_event_table[2];
+        u32 umac_error_event_table;
+        unsigned int error_event_table_tlv_status;
+        wait_queue_head_t fw_halt_waitq;
        /* pointer to trans specific struct */
        /*Ensure that this pointer will always be aligned to sizeof pointer */
        char trans_specific[0] __aligned(sizeof(void *));
@@ -1202,6 +1239,10 @@ static inline void iwl_trans_fw_error(struct iwl_trans *trans)
        /* prevent double restarts due to the same erroneous FW */
        if (!test_and_set_bit(STATUS_FW_ERROR, &trans->status))
                iwl_op_mode_nic_error(trans->op_mode);
+        if (test_and_clear_bit(STATUS_FW_WAIT_DUMP, &trans->status))
+                wake_up(&trans->fw_halt_waitq);
 }
 /*****************************************************
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/Makefile b/drivers/net/wireless/intel/iwlwifi/mvm/Makefile
index 30cbd981efbd..dd268c4bd371 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/Makefile
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/Makefile
@@ -5,6 +5,7 @@ iwlmvm-y += utils.o rx.o rxmq.o tx.o binding.o quota.o sta.o sf.o
 iwlmvm-y += scan.o time-event.o rs.o rs-fw.o
 iwlmvm-y += power.o coex.o
 iwlmvm-y += tt.o offloading.o tdls.o
+iwlmvm-y += ftm-responder.o ftm-initiator.o
 iwlmvm-$(CONFIG_IWLWIFI_DEBUGFS) += debugfs.o debugfs-vif.o
 iwlmvm-$(CONFIG_IWLWIFI_LEDS) += led.o
 iwlmvm-$(CONFIG_PM) += d3.o
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/coex.c b/drivers/net/wireless/intel/iwlwifi/mvm/coex.c
index 730e37744dc0..3d2abbc5c76c 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/coex.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/coex.c
@@ -241,7 +241,6 @@ static int iwl_mvm_bt_coex_reduced_txp(struct iwl_mvm *mvm, u8 sta_id,
        struct iwl_bt_coex_reduced_txp_update_cmd cmd = {};
        struct iwl_mvm_sta *mvmsta;
        u32 value;
-        int ret;
        mvmsta = iwl_mvm_sta_from_staid_protected(mvm, sta_id);
        if (!mvmsta)
@@ -262,10 +261,8 @@ static int iwl_mvm_bt_coex_reduced_txp(struct iwl_mvm *mvm, u8 sta_id,
        cmd.reduced_txp = cpu_to_le32(value);
        mvmsta->bt_reduced_txpower = enable;
-        ret = iwl_mvm_send_cmd_pdu(mvm, BT_COEX_UPDATE_REDUCED_TXP, CMD_ASYNC,
+        return iwl_mvm_send_cmd_pdu(mvm, BT_COEX_UPDATE_REDUCED_TXP,
-                                   sizeof(cmd), &cmd);
+                                    CMD_ASYNC, sizeof(cmd), &cmd);
-        return ret;
 }
 struct iwl_bt_iterator_data {
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/constants.h b/drivers/net/wireless/intel/iwlwifi/mvm/constants.h
index d96ada3c06fc..dff14f1ec55f 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/constants.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/constants.h
@@ -8,6 +8,7 @@
 * Copyright(c) 2013 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2015        Intel Deutschland GmbH
+ * Copyright(c) 2018 - 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -30,6 +31,7 @@
 * Copyright(c) 2013 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2015        Intel Deutschland GmbH
+ * Copyright(c) 2018 - 2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -63,6 +65,7 @@
 #define __MVM_CONSTANTS_H
 #include <linux/ieee80211.h>
+#include "fw-api.h"
 #define IWL_MVM_UAPSD_NOAGG_BSSIDS_NUM          20
@@ -114,6 +117,7 @@
 #define IWL_MVM_TCM_LOWLAT_ENABLE_THRESH        100 /* packets/10 seconds */
 #define IWL_MVM_UAPSD_NONAGG_PERIOD             5000 /* msecs */
 #define IWL_MVM_UAPSD_NOAGG_LIST_LEN            IWL_MVM_UAPSD_NOAGG_BSSIDS_NUM
+#define IWL_MVM_NON_TRANSMITTING_AP             0
 #define IWL_MVM_RS_NUM_TRY_BEFORE_ANT_TOGGLE    1
 #define IWL_MVM_RS_HT_VHT_RETRIES_PER_RATE      2
 #define IWL_MVM_RS_HT_VHT_RETRIES_PER_RATE_TW   1
@@ -145,5 +149,8 @@
 #define IWL_MVM_RS_TPC_SR_NO_INCREASE           85      /* percent */
 #define IWL_MVM_RS_TPC_TX_POWER_STEP            3
 #define IWL_MVM_ENABLE_EBS                      1
+#define IWL_MVM_FTM_INITIATOR_ALGO              IWL_TOF_ALGO_TYPE_MAX_LIKE
+#define IWL_MVM_FTM_INITIATOR_DYNACK            true
+#define IWL_MVM_D3_DEBUG                        false
 #endif /* __MVM_CONSTANTS_H */
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
index 36ed7d6fc971..808bc6f363d0 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
@@ -1899,7 +1899,7 @@ static void iwl_mvm_d3_disconnect_iter(void *data, u8 *mac,
 static int iwl_mvm_check_rt_status(struct iwl_mvm *mvm,
                                   struct ieee80211_vif *vif)
 {
-        u32 base = mvm->error_event_table[0];
+        u32 base = mvm->trans->lmac_error_event_table[0];
        struct error_table_start {
                /* cf. struct iwl_error_event_table */
                u32 valid;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
index e136475a34f6..776b24f54200 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
@@ -8,7 +8,7 @@
 * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
 * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -1188,6 +1188,111 @@ out:
        return ret ?: count;
 }
+static int _iwl_dbgfs_inject_beacon_ie(struct iwl_mvm *mvm, char *bin, int len)
+{
+        struct ieee80211_vif *vif;
+        struct iwl_mvm_vif *mvmvif;
+        struct sk_buff *beacon;
+        struct ieee80211_tx_info *info;
+        struct iwl_mac_beacon_cmd beacon_cmd = {};
+        u8 rate;
+        u16 flags;
+        int i;
+        len /= 2;
+        /* Element len should be represented by u8 */
+        if (len >= U8_MAX)
+                return -EINVAL;
+        if (!iwl_mvm_firmware_running(mvm))
+                return -EIO;
+        if (!iwl_mvm_has_new_tx_api(mvm) &&
+            !fw_has_api(&mvm->fw->ucode_capa,
+                        IWL_UCODE_TLV_API_NEW_BEACON_TEMPLATE))
+                return -EINVAL;
+        rcu_read_lock();
+        for (i = 0; i < NUM_MAC_INDEX_DRIVER; i++) {
+                vif = iwl_mvm_rcu_dereference_vif_id(mvm, i, true);
+                if (!vif)
+                        continue;
+                if (vif->type == NL80211_IFTYPE_AP)
+                        break;
+        }
+        if (i == NUM_MAC_INDEX_DRIVER || !vif)
+                goto out_err;
+        mvm->hw->extra_beacon_tailroom = len;
+        beacon = ieee80211_beacon_get_template(mvm->hw, vif, NULL);
+        if (!beacon)
+                goto out_err;
+        if (len && hex2bin(skb_put_zero(beacon, len), bin, len)) {
+                dev_kfree_skb(beacon);
+                goto out_err;
+        }
+        mvm->beacon_inject_active = true;
+        mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        info = IEEE80211_SKB_CB(beacon);
+        rate = iwl_mvm_mac_ctxt_get_lowest_rate(info, vif);
+        flags = iwl_mvm_mac80211_idx_to_hwrate(rate);
+        if (rate == IWL_FIRST_CCK_RATE)
+                flags |= IWL_MAC_BEACON_CCK;
+        beacon_cmd.flags = cpu_to_le16(flags);
+        beacon_cmd.byte_cnt = cpu_to_le16((u16)beacon->len);
+        beacon_cmd.template_id = cpu_to_le32((u32)mvmvif->id);
+        iwl_mvm_mac_ctxt_set_tim(mvm, &beacon_cmd.tim_idx,
+                                 &beacon_cmd.tim_size,
+                                 beacon->data, beacon->len);
+        mutex_lock(&mvm->mutex);
+        iwl_mvm_mac_ctxt_send_beacon_cmd(mvm, beacon, &beacon_cmd,
+                                         sizeof(beacon_cmd));
+        mutex_unlock(&mvm->mutex);
+        dev_kfree_skb(beacon);
+        rcu_read_unlock();
+        return 0;
+out_err:
+        rcu_read_unlock();
+        return -EINVAL;
+}
+static ssize_t iwl_dbgfs_inject_beacon_ie_write(struct iwl_mvm *mvm,
+                                                char *buf, size_t count,
+                                                loff_t *ppos)
+{
+        int ret = _iwl_dbgfs_inject_beacon_ie(mvm, buf, count);
+        mvm->hw->extra_beacon_tailroom = 0;
+        return ret ?: count;
+}
+static ssize_t iwl_dbgfs_inject_beacon_ie_restore_write(struct iwl_mvm *mvm,
+                                                        char *buf,
+                                                        size_t count,
+                                                        loff_t *ppos)
+{
+        int ret = _iwl_dbgfs_inject_beacon_ie(mvm, NULL, 0);
+        mvm->hw->extra_beacon_tailroom = 0;
+        mvm->beacon_inject_active = false;
+        return ret ?: count;
+}
 static ssize_t iwl_dbgfs_fw_dbg_conf_read(struct file *file,
                                          char __user *user_buf,
                                          size_t count, loff_t *ppos)
@@ -1684,6 +1789,7 @@ iwl_dbgfs_send_echo_cmd_write(struct iwl_mvm *mvm, char *buf,
 struct iwl_mvm_sniffer_apply {
        struct iwl_mvm *mvm;
+        u8 *bssid;
        u16 aid;
 };
@@ -1693,6 +1799,8 @@ static bool iwl_mvm_sniffer_apply(struct iwl_notif_wait_data *notif_data,
        struct iwl_mvm_sniffer_apply *apply = data;
        apply->mvm->cur_aid = cpu_to_le16(apply->aid);
+        memcpy(apply->mvm->cur_bssid, apply->bssid,
+               sizeof(apply->mvm->cur_bssid));
        return true;
 }
@@ -1725,6 +1833,7 @@ iwl_dbgfs_he_sniffer_params_write(struct iwl_mvm *mvm, char *buf,
        he_mon_cmd.aid = cpu_to_le16(aid);
        apply.aid = aid;
+        apply.bssid = (void *)he_mon_cmd.bssid;
        mutex_lock(&mvm->mutex);
@@ -1754,6 +1863,23 @@ iwl_dbgfs_he_sniffer_params_write(struct iwl_mvm *mvm, char *buf,
 }
 static ssize_t
+iwl_dbgfs_he_sniffer_params_read(struct file *file, char __user *user_buf,
+                                 size_t count, loff_t *ppos)
+{
+        struct iwl_mvm *mvm = file->private_data;
+        u8 buf[32];
+        int len;
+        len = scnprintf(buf, sizeof(buf),
+                        "%d %02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx\n",
+                        le16_to_cpu(mvm->cur_aid), mvm->cur_bssid[0],
+                        mvm->cur_bssid[1], mvm->cur_bssid[2], mvm->cur_bssid[3],
+                        mvm->cur_bssid[4], mvm->cur_bssid[5]);
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+static ssize_t
 iwl_dbgfs_uapsd_noagg_bssids_read(struct file *file, char __user *user_buf,
                                  size_t count, loff_t *ppos)
 {
@@ -1806,6 +1932,8 @@ MVM_DEBUGFS_WRITE_FILE_OPS(max_amsdu_len, 8);
 MVM_DEBUGFS_WRITE_FILE_OPS(indirection_tbl,
                           (IWL_RSS_INDIRECTION_TABLE_SIZE * 2));
 MVM_DEBUGFS_WRITE_FILE_OPS(inject_packet, 512);
+MVM_DEBUGFS_WRITE_FILE_OPS(inject_beacon_ie, 512);
+MVM_DEBUGFS_WRITE_FILE_OPS(inject_beacon_ie_restore, 512);
 MVM_DEBUGFS_READ_FILE_OPS(uapsd_noagg_bssids);
@@ -1821,7 +1949,7 @@ MVM_DEBUGFS_READ_WRITE_FILE_OPS(d3_sram, 8);
 MVM_DEBUGFS_READ_FILE_OPS(sar_geo_profile);
 #endif
-MVM_DEBUGFS_WRITE_FILE_OPS(he_sniffer_params, 32);
+MVM_DEBUGFS_READ_WRITE_FILE_OPS(he_sniffer_params, 32);
 static ssize_t iwl_dbgfs_mem_read(struct file *file, char __user *user_buf,
                                  size_t count, loff_t *ppos)
@@ -2007,10 +2135,12 @@ int iwl_mvm_dbgfs_register(struct iwl_mvm *mvm, struct dentry *dbgfs_dir)
        MVM_DEBUGFS_ADD_FILE(send_echo_cmd, mvm->debugfs_dir, 0200);
        MVM_DEBUGFS_ADD_FILE(indirection_tbl, mvm->debugfs_dir, 0200);
        MVM_DEBUGFS_ADD_FILE(inject_packet, mvm->debugfs_dir, 0200);
+        MVM_DEBUGFS_ADD_FILE(inject_beacon_ie, mvm->debugfs_dir, 0200);
+        MVM_DEBUGFS_ADD_FILE(inject_beacon_ie_restore, mvm->debugfs_dir, 0200);
 #ifdef CONFIG_ACPI
        MVM_DEBUGFS_ADD_FILE(sar_geo_profile, dbgfs_dir, 0400);
 #endif
-        MVM_DEBUGFS_ADD_FILE(he_sniffer_params, mvm->debugfs_dir, 0200);
+        MVM_DEBUGFS_ADD_FILE(he_sniffer_params, mvm->debugfs_dir, 0600);
        if (!debugfs_create_bool("enable_scan_iteration_notif",
                                 0600,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c b/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c
new file mode 100644
index 000000000000..e9822a3ec373
--- /dev/null
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c
@@ -0,0 +1,654 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
+ * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2019 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called COPYING.
+ *
+ * Contact Information:
+ * Intel Linux Wireless <linuxwifi@intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
+ * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2019 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+#include <linux/etherdevice.h>
+#include <linux/math64.h>
+#include <net/cfg80211.h>
+#include "mvm.h"
+#include "iwl-io.h"
+#include "iwl-prph.h"
+#include "constants.h"
+struct iwl_mvm_loc_entry {
+        struct list_head list;
+        u8 addr[ETH_ALEN];
+        u8 lci_len, civic_len;
+        u8 buf[];
+};
+static void iwl_mvm_ftm_reset(struct iwl_mvm *mvm)
+{
+        struct iwl_mvm_loc_entry *e, *t;
+        mvm->ftm_initiator.req = NULL;
+        mvm->ftm_initiator.req_wdev = NULL;
+        memset(mvm->ftm_initiator.responses, 0,
+               sizeof(mvm->ftm_initiator.responses));
+        list_for_each_entry_safe(e, t, &mvm->ftm_initiator.loc_list, list) {
+                list_del(&e->list);
+                kfree(e);
+        }
+}
+void iwl_mvm_ftm_restart(struct iwl_mvm *mvm)
+{
+        struct cfg80211_pmsr_result result = {
+                .status = NL80211_PMSR_STATUS_FAILURE,
+                .final = 1,
+                .host_time = ktime_get_boot_ns(),
+                .type = NL80211_PMSR_TYPE_FTM,
+        };
+        int i;
+        lockdep_assert_held(&mvm->mutex);
+        if (!mvm->ftm_initiator.req)
+                return;
+        for (i = 0; i < mvm->ftm_initiator.req->n_peers; i++) {
+                memcpy(result.addr, mvm->ftm_initiator.req->peers[i].addr,
+                       ETH_ALEN);
+                result.ftm.burst_index = mvm->ftm_initiator.responses[i];
+                cfg80211_pmsr_report(mvm->ftm_initiator.req_wdev,
+                                     mvm->ftm_initiator.req,
+                                     &result, GFP_KERNEL);
+        }
+        cfg80211_pmsr_complete(mvm->ftm_initiator.req_wdev,
+                               mvm->ftm_initiator.req, GFP_KERNEL);
+        iwl_mvm_ftm_reset(mvm);
+}
+static int
+iwl_ftm_range_request_status_to_err(enum iwl_tof_range_request_status s)
+{
+        switch (s) {
+        case IWL_TOF_RANGE_REQUEST_STATUS_SUCCESS:
+                return 0;
+        case IWL_TOF_RANGE_REQUEST_STATUS_BUSY:
+                return -EBUSY;
+        default:
+                WARN_ON_ONCE(1);
+                return -EIO;
+        }
+}
+static void iwl_mvm_ftm_cmd_v5(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                               struct iwl_tof_range_req_cmd_v5 *cmd,
+                               struct cfg80211_pmsr_request *req)
+{
+        int i;
+        cmd->request_id = req->cookie;
+        cmd->num_of_ap = req->n_peers;
+        /* use maximum for "no timeout" or bigger than what we can do */
+        if (!req->timeout || req->timeout > 255 * 100)
+                cmd->req_timeout = 255;
+        else
+                cmd->req_timeout = DIV_ROUND_UP(req->timeout, 100);
+        /*
+         * We treat it always as random, since if not we'll
+         * have filled our local address there instead.
+         */
+        cmd->macaddr_random = 1;
+        memcpy(cmd->macaddr_template, req->mac_addr, ETH_ALEN);
+        for (i = 0; i < ETH_ALEN; i++)
+                cmd->macaddr_mask[i] = ~req->mac_addr_mask[i];
+        if (vif->bss_conf.assoc)
+                memcpy(cmd->range_req_bssid, vif->bss_conf.bssid, ETH_ALEN);
+        else
+                eth_broadcast_addr(cmd->range_req_bssid);
+}
+static void iwl_mvm_ftm_cmd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                            struct iwl_tof_range_req_cmd *cmd,
+                            struct cfg80211_pmsr_request *req)
+{
+        int i;
+        cmd->initiator_flags =
+                cpu_to_le32(IWL_TOF_INITIATOR_FLAGS_MACADDR_RANDOM |
+                            IWL_TOF_INITIATOR_FLAGS_NON_ASAP_SUPPORT);
+        cmd->request_id = req->cookie;
+        cmd->num_of_ap = req->n_peers;
+        /*
+         * Use a large value for "no timeout". Don't use the maximum value
+         * because of fw limitations.
+         */
+        if (req->timeout)
+                cmd->req_timeout_ms = cpu_to_le32(req->timeout);
+        else
+                cmd->req_timeout_ms = cpu_to_le32(0xfffff);
+        memcpy(cmd->macaddr_template, req->mac_addr, ETH_ALEN);
+        for (i = 0; i < ETH_ALEN; i++)
+                cmd->macaddr_mask[i] = ~req->mac_addr_mask[i];
+        if (vif->bss_conf.assoc)
+                memcpy(cmd->range_req_bssid, vif->bss_conf.bssid, ETH_ALEN);
+        else
+                eth_broadcast_addr(cmd->range_req_bssid);
+        /* TODO: fill in tsf_mac_id if needed */
+        cmd->tsf_mac_id = cpu_to_le32(0xff);
+}
+static int iwl_mvm_ftm_target_chandef(struct iwl_mvm *mvm,
+                                      struct cfg80211_pmsr_request_peer *peer,
+                                      u8 *channel, u8 *bandwidth,
+                                      u8 *ctrl_ch_position)
+{
+        u32 freq = peer->chandef.chan->center_freq;
+        *channel = ieee80211_frequency_to_channel(freq);
+        switch (peer->chandef.width) {
+        case NL80211_CHAN_WIDTH_20_NOHT:
+                *bandwidth = IWL_TOF_BW_20_LEGACY;
+                break;
+        case NL80211_CHAN_WIDTH_20:
+                *bandwidth = IWL_TOF_BW_20_HT;
+                break;
+        case NL80211_CHAN_WIDTH_40:
+                *bandwidth = IWL_TOF_BW_40;
+                break;
+        case NL80211_CHAN_WIDTH_80:
+                *bandwidth = IWL_TOF_BW_80;
+                break;
+        default:
+                IWL_ERR(mvm, "Unsupported BW in FTM request (%d)\n",
+                        peer->chandef.width);
+                return -EINVAL;
+        }
+        *ctrl_ch_position = (peer->chandef.width > NL80211_CHAN_WIDTH_20) ?
+                iwl_mvm_get_ctrl_pos(&peer->chandef) : 0;
+        return 0;
+}
+static int
+iwl_mvm_ftm_put_target_v2(struct iwl_mvm *mvm,
+                          struct cfg80211_pmsr_request_peer *peer,
+                          struct iwl_tof_range_req_ap_entry_v2 *target)
+{
+        int ret;
+        ret = iwl_mvm_ftm_target_chandef(mvm, peer, &target->channel_num,
+                                         &target->bandwidth,
+                                         &target->ctrl_ch_position);
+        if (ret)
+                return ret;
+        memcpy(target->bssid, peer->addr, ETH_ALEN);
+        target->burst_period =
+                cpu_to_le16(peer->ftm.burst_period);
+        target->samples_per_burst = peer->ftm.ftms_per_burst;
+        target->num_of_bursts = peer->ftm.num_bursts_exp;
+        target->measure_type = 0; /* regular two-sided FTM */
+        target->retries_per_sample = peer->ftm.ftmr_retries;
+        target->asap_mode = peer->ftm.asap;
+        target->enable_dyn_ack = IWL_MVM_FTM_INITIATOR_DYNACK;
+        if (peer->ftm.request_lci)
+                target->location_req |= IWL_TOF_LOC_LCI;
+        if (peer->ftm.request_civicloc)
+                target->location_req |= IWL_TOF_LOC_CIVIC;
+        target->algo_type = IWL_MVM_FTM_INITIATOR_ALGO;
+        return 0;
+}
+#define FTM_PUT_FLAG(flag)      (target->initiator_ap_flags |= \
+                                 cpu_to_le32(IWL_INITIATOR_AP_FLAGS_##flag))
+static int iwl_mvm_ftm_put_target(struct iwl_mvm *mvm,
+                                  struct cfg80211_pmsr_request_peer *peer,
+                                  struct iwl_tof_range_req_ap_entry *target)
+{
+        int ret;
+        ret = iwl_mvm_ftm_target_chandef(mvm, peer, &target->channel_num,
+                                         &target->bandwidth,
+                                         &target->ctrl_ch_position);
+        if (ret)
+                return ret;
+        memcpy(target->bssid, peer->addr, ETH_ALEN);
+        target->burst_period =
+                cpu_to_le16(peer->ftm.burst_period);
+        target->samples_per_burst = peer->ftm.ftms_per_burst;
+        target->num_of_bursts = peer->ftm.num_bursts_exp;
+        target->ftmr_max_retries = peer->ftm.ftmr_retries;
+        target->initiator_ap_flags = cpu_to_le32(0);
+        if (peer->ftm.asap)
+                FTM_PUT_FLAG(ASAP);
+        if (peer->ftm.request_lci)
+                FTM_PUT_FLAG(LCI_REQUEST);
+        if (peer->ftm.request_civicloc)
+                FTM_PUT_FLAG(CIVIC_REQUEST);
+        if (IWL_MVM_FTM_INITIATOR_DYNACK)
+                FTM_PUT_FLAG(DYN_ACK);
+        if (IWL_MVM_FTM_INITIATOR_ALGO == IWL_TOF_ALGO_TYPE_LINEAR_REG)
+                FTM_PUT_FLAG(ALGO_LR);
+        else if (IWL_MVM_FTM_INITIATOR_ALGO == IWL_TOF_ALGO_TYPE_FFT)
+                FTM_PUT_FLAG(ALGO_FFT);
+        return 0;
+}
+int iwl_mvm_ftm_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                      struct cfg80211_pmsr_request *req)
+{
+        struct iwl_tof_range_req_cmd_v5 cmd_v5;
+        struct iwl_tof_range_req_cmd cmd;
+        bool new_api = fw_has_api(&mvm->fw->ucode_capa,
+                                  IWL_UCODE_TLV_API_FTM_NEW_RANGE_REQ);
+        u8 num_of_ap;
+        struct iwl_host_cmd hcmd = {
+                .id = iwl_cmd_id(TOF_RANGE_REQ_CMD, LOCATION_GROUP, 0),
+                .dataflags[0] = IWL_HCMD_DFL_DUP,
+        };
+        u32 status = 0;
+        int err, i;
+        lockdep_assert_held(&mvm->mutex);
+        if (mvm->ftm_initiator.req)
+                return -EBUSY;
+        if (new_api) {
+                iwl_mvm_ftm_cmd(mvm, vif, &cmd, req);
+                hcmd.data[0] = &cmd;
+                hcmd.len[0] = sizeof(cmd);
+                num_of_ap = cmd.num_of_ap;
+        } else {
+                iwl_mvm_ftm_cmd_v5(mvm, vif, &cmd_v5, req);
+                hcmd.data[0] = &cmd_v5;
+                hcmd.len[0] = sizeof(cmd_v5);
+                num_of_ap = cmd_v5.num_of_ap;
+        }
+        for (i = 0; i < num_of_ap; i++) {
+                struct cfg80211_pmsr_request_peer *peer = &req->peers[i];
+                if (new_api)
+                        err = iwl_mvm_ftm_put_target(mvm, peer, &cmd.ap[i]);
+                else
+                        err = iwl_mvm_ftm_put_target_v2(mvm, peer,
+                                                        &cmd_v5.ap[i]);
+                if (err)
+                        return err;
+        }
+        err = iwl_mvm_send_cmd_status(mvm, &hcmd, &status);
+        if (!err && status) {
+                IWL_ERR(mvm, "FTM range request command failure, status: %u\n",
+                        status);
+                err = iwl_ftm_range_request_status_to_err(status);
+        }
+        if (!err) {
+                mvm->ftm_initiator.req = req;
+                mvm->ftm_initiator.req_wdev = ieee80211_vif_to_wdev(vif);
+        }
+        return err;
+}
+void iwl_mvm_ftm_abort(struct iwl_mvm *mvm, struct cfg80211_pmsr_request *req)
+{
+        struct iwl_tof_range_abort_cmd cmd = {
+                .request_id = req->cookie,
+        };
+        lockdep_assert_held(&mvm->mutex);
+        if (req != mvm->ftm_initiator.req)
+                return;
+        if (iwl_mvm_send_cmd_pdu(mvm, iwl_cmd_id(TOF_RANGE_ABORT_CMD,
+                                                 LOCATION_GROUP, 0),
+                                 0, sizeof(cmd), &cmd))
+                IWL_ERR(mvm, "failed to abort FTM process\n");
+}
+static int iwl_mvm_ftm_find_peer(struct cfg80211_pmsr_request *req,
+                                 const u8 *addr)
+{
+        int i;
+        for (i = 0; i < req->n_peers; i++) {
+                struct cfg80211_pmsr_request_peer *peer = &req->peers[i];
+                if (ether_addr_equal_unaligned(peer->addr, addr))
+                        return i;
+        }
+        return -ENOENT;
+}
+static u64 iwl_mvm_ftm_get_host_time(struct iwl_mvm *mvm, __le32 fw_gp2_ts)
+{
+        u32 gp2_ts = le32_to_cpu(fw_gp2_ts);
+        u32 curr_gp2, diff;
+        u64 now_from_boot_ns;
+        iwl_mvm_get_sync_time(mvm, &curr_gp2, &now_from_boot_ns);
+        if (curr_gp2 >= gp2_ts)
+                diff = curr_gp2 - gp2_ts;
+        else
+                diff = curr_gp2 + (U32_MAX - gp2_ts + 1);
+        return now_from_boot_ns - (u64)diff * 1000;
+}
+static void iwl_mvm_ftm_get_lci_civic(struct iwl_mvm *mvm,
+                                      struct cfg80211_pmsr_result *res)
+{
+        struct iwl_mvm_loc_entry *entry;
+        list_for_each_entry(entry, &mvm->ftm_initiator.loc_list, list) {
+                if (!ether_addr_equal_unaligned(res->addr, entry->addr))
+                        continue;
+                if (entry->lci_len) {
+                        res->ftm.lci_len = entry->lci_len;
+                        res->ftm.lci = entry->buf;
+                }
+                if (entry->civic_len) {
+                        res->ftm.civicloc_len = entry->civic_len;
+                        res->ftm.civicloc = entry->buf + entry->lci_len;
+                }
+                /* we found the entry we needed */
+                break;
+        }
+}
+static int iwl_mvm_ftm_range_resp_valid(struct iwl_mvm *mvm, u8 request_id,
+                                        u8 num_of_aps)
+{
+        lockdep_assert_held(&mvm->mutex);
+        if (request_id != (u8)mvm->ftm_initiator.req->cookie) {
+                IWL_ERR(mvm, "Request ID mismatch, got %u, active %u\n",
+                        request_id, (u8)mvm->ftm_initiator.req->cookie);
+                return -EINVAL;
+        }
+        if (num_of_aps > mvm->ftm_initiator.req->n_peers) {
+                IWL_ERR(mvm, "FTM range response invalid\n");
+                return -EINVAL;
+        }
+        return 0;
+}
+static void iwl_mvm_debug_range_resp(struct iwl_mvm *mvm, u8 index,
+                                     struct cfg80211_pmsr_result *res)
+{
+        s64 rtt_avg = res->ftm.rtt_avg * 100;
+        do_div(rtt_avg, 6666);
+        IWL_DEBUG_INFO(mvm, "entry %d\n", index);
+        IWL_DEBUG_INFO(mvm, "\tstatus: %d\n", res->status);
+        IWL_DEBUG_INFO(mvm, "\tBSSID: %pM\n", res->addr);
+        IWL_DEBUG_INFO(mvm, "\thost time: %llu\n", res->host_time);
+        IWL_DEBUG_INFO(mvm, "\tburst index: %hhu\n", res->ftm.burst_index);
+        IWL_DEBUG_INFO(mvm, "\tsuccess num: %u\n", res->ftm.num_ftmr_successes);
+        IWL_DEBUG_INFO(mvm, "\trssi: %d\n", res->ftm.rssi_avg);
+        IWL_DEBUG_INFO(mvm, "\trssi spread: %hhu\n", res->ftm.rssi_spread);
+        IWL_DEBUG_INFO(mvm, "\trtt: %lld\n", res->ftm.rtt_avg);
+        IWL_DEBUG_INFO(mvm, "\trtt var: %llu\n", res->ftm.rtt_variance);
+        IWL_DEBUG_INFO(mvm, "\trtt spread: %llu\n", res->ftm.rtt_spread);
+        IWL_DEBUG_INFO(mvm, "\tdistance: %lld\n", rtt_avg);
+}
+void iwl_mvm_ftm_range_resp(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        struct iwl_tof_range_rsp_ntfy_v5 *fw_resp_v5 = (void *)pkt->data;
+        struct iwl_tof_range_rsp_ntfy *fw_resp = (void *)pkt->data;
+        int i;
+        bool new_api = fw_has_api(&mvm->fw->ucode_capa,
+                                  IWL_UCODE_TLV_API_FTM_NEW_RANGE_REQ);
+        u8 num_of_aps, last_in_batch;
+        lockdep_assert_held(&mvm->mutex);
+        if (!mvm->ftm_initiator.req) {
+                IWL_ERR(mvm, "Got FTM response but have no request?\n");
+                return;
+        }
+        if (new_api) {
+                if (iwl_mvm_ftm_range_resp_valid(mvm, fw_resp->request_id,
+                                                 fw_resp->num_of_aps))
+                        return;
+                num_of_aps = fw_resp->num_of_aps;
+                last_in_batch = fw_resp->last_report;
+        } else {
+                if (iwl_mvm_ftm_range_resp_valid(mvm, fw_resp_v5->request_id,
+                                                 fw_resp_v5->num_of_aps))
+                        return;
+                num_of_aps = fw_resp_v5->num_of_aps;
+                last_in_batch = fw_resp_v5->last_in_batch;
+        }
+        IWL_DEBUG_INFO(mvm, "Range response received\n");
+        IWL_DEBUG_INFO(mvm, "request id: %lld, num of entries: %hhu\n",
+                       mvm->ftm_initiator.req->cookie, num_of_aps);
+        for (i = 0; i < num_of_aps && i < IWL_MVM_TOF_MAX_APS; i++) {
+                struct cfg80211_pmsr_result result = {};
+                struct iwl_tof_range_rsp_ap_entry_ntfy *fw_ap;
+                int peer_idx;
+                if (new_api) {
+                        fw_ap = &fw_resp->ap[i];
+                        result.final = fw_resp->ap[i].last_burst;
+                } else {
+                        /* the first part is the same for old and new APIs */
+                        fw_ap = (void *)&fw_resp_v5->ap[i];
+                        /*
+                         * FIXME: the firmware needs to report this, we don't
+                         * even know the number of bursts the responder picked
+                         * (if we asked it to)
+                         */
+                        result.final = 0;
+                }
+                peer_idx = iwl_mvm_ftm_find_peer(mvm->ftm_initiator.req,
+                                                 fw_ap->bssid);
+                if (peer_idx < 0) {
+                        IWL_WARN(mvm,
+                                 "Unknown address (%pM, target #%d) in FTM response\n",
+                                 fw_ap->bssid, i);
+                        continue;
+                }
+                switch (fw_ap->measure_status) {
+                case IWL_TOF_ENTRY_SUCCESS:
+                        result.status = NL80211_PMSR_STATUS_SUCCESS;
+                        break;
+                case IWL_TOF_ENTRY_TIMING_MEASURE_TIMEOUT:
+                        result.status = NL80211_PMSR_STATUS_TIMEOUT;
+                        break;
+                case IWL_TOF_ENTRY_NO_RESPONSE:
+                        result.status = NL80211_PMSR_STATUS_FAILURE;
+                        result.ftm.failure_reason =
+                                NL80211_PMSR_FTM_FAILURE_NO_RESPONSE;
+                        break;
+                case IWL_TOF_ENTRY_REQUEST_REJECTED:
+                        result.status = NL80211_PMSR_STATUS_FAILURE;
+                        result.ftm.failure_reason =
+                                NL80211_PMSR_FTM_FAILURE_PEER_BUSY;
+                        result.ftm.busy_retry_time = fw_ap->refusal_period;
+                        break;
+                default:
+                        result.status = NL80211_PMSR_STATUS_FAILURE;
+                        result.ftm.failure_reason =
+                                NL80211_PMSR_FTM_FAILURE_UNSPECIFIED;
+                        break;
+                }
+                memcpy(result.addr, fw_ap->bssid, ETH_ALEN);
+                result.host_time = iwl_mvm_ftm_get_host_time(mvm,
+                                                             fw_ap->timestamp);
+                result.type = NL80211_PMSR_TYPE_FTM;
+                result.ftm.burst_index = mvm->ftm_initiator.responses[peer_idx];
+                mvm->ftm_initiator.responses[peer_idx]++;
+                result.ftm.rssi_avg = fw_ap->rssi;
+                result.ftm.rssi_avg_valid = 1;
+                result.ftm.rssi_spread = fw_ap->rssi_spread;
+                result.ftm.rssi_spread_valid = 1;
+                result.ftm.rtt_avg = (s32)le32_to_cpu(fw_ap->rtt);
+                result.ftm.rtt_avg_valid = 1;
+                result.ftm.rtt_variance = le32_to_cpu(fw_ap->rtt_variance);
+                result.ftm.rtt_variance_valid = 1;
+                result.ftm.rtt_spread = le32_to_cpu(fw_ap->rtt_spread);
+                result.ftm.rtt_spread_valid = 1;
+                iwl_mvm_ftm_get_lci_civic(mvm, &result);
+                cfg80211_pmsr_report(mvm->ftm_initiator.req_wdev,
+                                     mvm->ftm_initiator.req,
+                                     &result, GFP_KERNEL);
+                iwl_mvm_debug_range_resp(mvm, i, &result);
+        }
+        if (last_in_batch) {
+                cfg80211_pmsr_complete(mvm->ftm_initiator.req_wdev,
+                                       mvm->ftm_initiator.req,
+                                       GFP_KERNEL);
+                iwl_mvm_ftm_reset(mvm);
+        }
+}
+void iwl_mvm_ftm_lc_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        const struct ieee80211_mgmt *mgmt = (void *)pkt->data;
+        size_t len = iwl_rx_packet_payload_len(pkt);
+        struct iwl_mvm_loc_entry *entry;
+        const u8 *ies, *lci, *civic, *msr_ie;
+        size_t ies_len, lci_len = 0, civic_len = 0;
+        size_t baselen = IEEE80211_MIN_ACTION_SIZE +
+                         sizeof(mgmt->u.action.u.ftm);
+        static const u8 rprt_type_lci = IEEE80211_SPCT_MSR_RPRT_TYPE_LCI;
+        static const u8 rprt_type_civic = IEEE80211_SPCT_MSR_RPRT_TYPE_CIVIC;
+        if (len <= baselen)
+                return;
+        lockdep_assert_held(&mvm->mutex);
+        ies = mgmt->u.action.u.ftm.variable;
+        ies_len = len - baselen;
+        msr_ie = cfg80211_find_ie_match(WLAN_EID_MEASURE_REPORT, ies, ies_len,
+                                        &rprt_type_lci, 1, 4);
+        if (msr_ie) {
+                lci = msr_ie + 2;
+                lci_len = msr_ie[1];
+        }
+        msr_ie = cfg80211_find_ie_match(WLAN_EID_MEASURE_REPORT, ies, ies_len,
+                                        &rprt_type_civic, 1, 4);
+        if (msr_ie) {
+                civic = msr_ie + 2;
+                civic_len = msr_ie[1];
+        }
+        entry = kmalloc(sizeof(*entry) + lci_len + civic_len, GFP_KERNEL);
+        if (!entry)
+                return;
+        memcpy(entry->addr, mgmt->bssid, ETH_ALEN);
+        entry->lci_len = lci_len;
+        if (lci_len)
+                memcpy(entry->buf, lci, lci_len);
+        entry->civic_len = civic_len;
+        if (civic_len)
+                memcpy(entry->buf + lci_len, civic, civic_len);
+        list_add_tail(&entry->list, &mvm->ftm_initiator.loc_list);
+}
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ftm-responder.c b/drivers/net/wireless/intel/iwlwifi/mvm/ftm-responder.c
new file mode 100644
index 000000000000..1513b8b4062f
--- /dev/null
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ftm-responder.c
@@ -0,0 +1,244 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
+ * Copyright (C) 2018 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called COPYING.
+ *
+ * Contact Information:
+ * Intel Linux Wireless <linuxwifi@intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
+ * Copyright (C) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+#include <net/cfg80211.h>
+#include <linux/etherdevice.h>
+#include "mvm.h"
+#include "constants.h"
+static int
+iwl_mvm_ftm_responder_cmd(struct iwl_mvm *mvm,
+                          struct ieee80211_vif *vif,
+                          struct cfg80211_chan_def *chandef)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct iwl_tof_responder_config_cmd cmd = {
+                .channel_num = chandef->chan->hw_value,
+                .cmd_valid_fields =
+                        cpu_to_le32(IWL_TOF_RESPONDER_CMD_VALID_CHAN_INFO |
+                                    IWL_TOF_RESPONDER_CMD_VALID_BSSID |
+                                    IWL_TOF_RESPONDER_CMD_VALID_STA_ID),
+                .sta_id = mvmvif->bcast_sta.sta_id,
+        };
+        lockdep_assert_held(&mvm->mutex);
+        switch (chandef->width) {
+        case NL80211_CHAN_WIDTH_20_NOHT:
+                cmd.bandwidth = IWL_TOF_BW_20_LEGACY;
+                break;
+        case NL80211_CHAN_WIDTH_20:
+                cmd.bandwidth = IWL_TOF_BW_20_HT;
+                break;
+        case NL80211_CHAN_WIDTH_40:
+                cmd.bandwidth = IWL_TOF_BW_40;
+                cmd.ctrl_ch_position = iwl_mvm_get_ctrl_pos(chandef);
+                break;
+        case NL80211_CHAN_WIDTH_80:
+                cmd.bandwidth = IWL_TOF_BW_80;
+                cmd.ctrl_ch_position = iwl_mvm_get_ctrl_pos(chandef);
+                break;
+        default:
+                WARN_ON(1);
+                return -EINVAL;
+        }
+        memcpy(cmd.bssid, vif->addr, ETH_ALEN);
+        return iwl_mvm_send_cmd_pdu(mvm, iwl_cmd_id(TOF_RESPONDER_CONFIG_CMD,
+                                                    LOCATION_GROUP, 0),
+                                    0, sizeof(cmd), &cmd);
+}
+static int
+iwl_mvm_ftm_responder_dyn_cfg_cmd(struct iwl_mvm *mvm,
+                                  struct ieee80211_vif *vif,
+                                  struct ieee80211_ftm_responder_params *params)
+{
+        struct iwl_tof_responder_dyn_config_cmd cmd = {
+                .lci_len = cpu_to_le32(params->lci_len + 2),
+                .civic_len = cpu_to_le32(params->civicloc_len + 2),
+        };
+        u8 data[IWL_LCI_CIVIC_IE_MAX_SIZE] = {0};
+        struct iwl_host_cmd hcmd = {
+                .id = iwl_cmd_id(TOF_RESPONDER_DYN_CONFIG_CMD,
+                                 LOCATION_GROUP, 0),
+                .data[0] = &cmd,
+                .len[0] = sizeof(cmd),
+                .data[1] = &data,
+                /* .len[1] set later */
+                /* may not be able to DMA from stack */
+                .dataflags[1] = IWL_HCMD_DFL_DUP,
+        };
+        u32 aligned_lci_len = ALIGN(params->lci_len + 2, 4);
+        u32 aligned_civicloc_len = ALIGN(params->civicloc_len + 2, 4);
+        u8 *pos = data;
+        lockdep_assert_held(&mvm->mutex);
+        if (aligned_lci_len + aligned_civicloc_len > sizeof(data)) {
+                IWL_ERR(mvm, "LCI/civicloc data too big (%zd + %zd)\n",
+                        params->lci_len, params->civicloc_len);
+                return -ENOBUFS;
+        }
+        pos[0] = WLAN_EID_MEASURE_REPORT;
+        pos[1] = params->lci_len;
+        memcpy(pos + 2, params->lci, params->lci_len);
+        pos += aligned_lci_len;
+        pos[0] = WLAN_EID_MEASURE_REPORT;
+        pos[1] = params->civicloc_len;
+        memcpy(pos + 2, params->civicloc, params->civicloc_len);
+        hcmd.len[1] = aligned_lci_len + aligned_civicloc_len;
+        return iwl_mvm_send_cmd(mvm, &hcmd);
+}
+int iwl_mvm_ftm_start_responder(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct ieee80211_ftm_responder_params *params;
+        struct ieee80211_chanctx_conf ctx, *pctx;
+        u16 *phy_ctxt_id;
+        struct iwl_mvm_phy_ctxt *phy_ctxt;
+        int ret;
+        params = vif->bss_conf.ftmr_params;
+        lockdep_assert_held(&mvm->mutex);
+        if (WARN_ON_ONCE(!vif->bss_conf.ftm_responder))
+                return -EINVAL;
+        if (vif->p2p || vif->type != NL80211_IFTYPE_AP ||
+            !mvmvif->ap_ibss_active) {
+                IWL_ERR(mvm, "Cannot start responder, not in AP mode\n");
+                return -EIO;
+        }
+        rcu_read_lock();
+        pctx = rcu_dereference(vif->chanctx_conf);
+        /* Copy the ctx to unlock the rcu and send the phy ctxt. We don't care
+         * about changes in the ctx after releasing the lock because the driver
+         * is still protected by the mutex. */
+        ctx = *pctx;
+        phy_ctxt_id  = (u16 *)pctx->drv_priv;
+        rcu_read_unlock();
+        phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
+        ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &ctx.def,
+                                       ctx.rx_chains_static,
+                                       ctx.rx_chains_dynamic);
+        if (ret)
+                return ret;
+        ret = iwl_mvm_ftm_responder_cmd(mvm, vif, &ctx.def);
+        if (ret)
+                return ret;
+        if (params)
+                ret = iwl_mvm_ftm_responder_dyn_cfg_cmd(mvm, vif, params);
+        return ret;
+}
+void iwl_mvm_ftm_restart_responder(struct iwl_mvm *mvm,
+                                   struct ieee80211_vif *vif)
+{
+        if (!vif->bss_conf.ftm_responder)
+                return;
+        iwl_mvm_ftm_start_responder(mvm, vif);
+}
+void iwl_mvm_ftm_responder_stats(struct iwl_mvm *mvm,
+                                 struct iwl_rx_cmd_buffer *rxb)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        struct iwl_ftm_responder_stats *resp = (void *)pkt->data;
+        struct cfg80211_ftm_responder_stats *stats = &mvm->ftm_resp_stats;
+        u32 flags = le32_to_cpu(resp->flags);
+        if (resp->success_ftm == resp->ftm_per_burst)
+                stats->success_num++;
+        else if (resp->success_ftm >= 2)
+                stats->partial_num++;
+        else
+                stats->failed_num++;
+        if ((flags & FTM_RESP_STAT_ASAP_REQ) &&
+            (flags & FTM_RESP_STAT_ASAP_RESP))
+                stats->asap_num++;
+        if (flags & FTM_RESP_STAT_NON_ASAP_RESP)
+                stats->non_asap_num++;
+        stats->total_duration_ms += le32_to_cpu(resp->duration) / USEC_PER_MSEC;
+        if (flags & FTM_RESP_STAT_TRIGGER_UNKNOWN)
+                stats->unknown_triggers_num++;
+        if (flags & FTM_RESP_STAT_DUP)
+                stats->reschedule_requests_num++;
+        if (flags & FTM_RESP_STAT_NON_ASAP_OUT_WIN)
+                stats->out_of_window_triggers_num++;
+}
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index d3dc9d276e0f..00a47f6f1d81 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -8,7 +8,7 @@
 * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019        Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
 * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019       Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -105,12 +105,12 @@ static int iwl_send_rss_cfg_cmd(struct iwl_mvm *mvm)
        int i;
        struct iwl_rss_config_cmd cmd = {
                .flags = cpu_to_le32(IWL_RSS_ENABLE),
-                .hash_mask = IWL_RSS_HASH_TYPE_IPV4_TCP |
+                .hash_mask = BIT(IWL_RSS_HASH_TYPE_IPV4_TCP) |
-                             IWL_RSS_HASH_TYPE_IPV4_UDP |
+                             BIT(IWL_RSS_HASH_TYPE_IPV4_UDP) |
-                             IWL_RSS_HASH_TYPE_IPV4_PAYLOAD |
+                             BIT(IWL_RSS_HASH_TYPE_IPV4_PAYLOAD) |
-                             IWL_RSS_HASH_TYPE_IPV6_TCP |
+                             BIT(IWL_RSS_HASH_TYPE_IPV6_TCP) |
-                             IWL_RSS_HASH_TYPE_IPV6_UDP |
+                             BIT(IWL_RSS_HASH_TYPE_IPV6_UDP) |
-                             IWL_RSS_HASH_TYPE_IPV6_PAYLOAD,
+                             BIT(IWL_RSS_HASH_TYPE_IPV6_PAYLOAD),
        };
        if (mvm->trans->num_rx_queues == 1)
@@ -127,13 +127,17 @@ static int iwl_send_rss_cfg_cmd(struct iwl_mvm *mvm)
 static int iwl_configure_rxq(struct iwl_mvm *mvm)
 {
-        int i, num_queues, size;
+        int i, num_queues, size, ret;
        struct iwl_rfh_queue_config *cmd;
+        struct iwl_host_cmd hcmd = {
+                .id = WIDE_ID(DATA_PATH_GROUP, RFH_QUEUE_CONFIG_CMD),
+                .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
+        };
        /* Do not configure default queue, it is configured via context info */
        num_queues = mvm->trans->num_rx_queues - 1;
-        size = sizeof(*cmd) + num_queues * sizeof(struct iwl_rfh_queue_data);
+        size = struct_size(cmd, data, num_queues);
        cmd = kzalloc(size, GFP_KERNEL);
        if (!cmd)
@@ -154,10 +158,14 @@ static int iwl_configure_rxq(struct iwl_mvm *mvm)
                cmd->data[i].fr_bd_wid = cpu_to_le32(data.fr_bd_wid);
        }
-        return iwl_mvm_send_cmd_pdu(mvm,
+        hcmd.data[0] = cmd;
-                                    WIDE_ID(DATA_PATH_GROUP,
+        hcmd.len[0] = size;
-                                            RFH_QUEUE_CONFIG_CMD),
-                                    0, size, cmd);
+        ret = iwl_mvm_send_cmd(mvm, &hcmd);
+        kfree(cmd);
+        return ret;
 }
 static int iwl_mvm_send_dqa_cmd(struct iwl_mvm *mvm)
@@ -210,7 +218,7 @@ static bool iwl_alive_fn(struct iwl_notif_wait_data *notif_wait,
        struct iwl_lmac_alive *lmac1;
        struct iwl_lmac_alive *lmac2 = NULL;
        u16 status;
-        u32 umac_error_event_table;
+        u32 lmac_error_event_table, umac_error_event_table;
        if (iwl_rx_packet_payload_len(pkt) == sizeof(*palive)) {
                palive = (void *)pkt->data;
@@ -225,30 +233,35 @@ static bool iwl_alive_fn(struct iwl_notif_wait_data *notif_wait,
                status = le16_to_cpu(palive3->status);
        }
-        mvm->error_event_table[0] = le32_to_cpu(lmac1->error_event_table_ptr);
+        lmac_error_event_table =
+                le32_to_cpu(lmac1->dbg_ptrs.error_event_table_ptr);
+        iwl_fw_lmac1_set_alive_err_table(mvm->trans, lmac_error_event_table);
        if (lmac2)
-                mvm->error_event_table[1] =
+                mvm->trans->lmac_error_event_table[1] =
-                        le32_to_cpu(lmac2->error_event_table_ptr);
+                        le32_to_cpu(lmac2->dbg_ptrs.error_event_table_ptr);
-        mvm->log_event_table = le32_to_cpu(lmac1->log_event_table_ptr);
-        umac_error_event_table = le32_to_cpu(umac->error_info_addr);
+        umac_error_event_table = le32_to_cpu(umac->dbg_ptrs.error_info_addr);
        if (!umac_error_event_table) {
                mvm->support_umac_log = false;
        } else if (umac_error_event_table >=
                   mvm->trans->cfg->min_umac_error_event_table) {
                mvm->support_umac_log = true;
-                mvm->umac_error_event_table = umac_error_event_table;
        } else {
                IWL_ERR(mvm,
                        "Not valid error log pointer 0x%08X for %s uCode\n",
-                        mvm->umac_error_event_table,
+                        umac_error_event_table,
                        (mvm->fwrt.cur_fw_img == IWL_UCODE_INIT) ?
                        "Init" : "RT");
                mvm->support_umac_log = false;
        }
-        alive_data->scd_base_addr = le32_to_cpu(lmac1->scd_base_ptr);
+        if (mvm->support_umac_log)
+                iwl_fw_umac_set_alive_err_table(mvm->trans,
+                                                umac_error_event_table);
+        alive_data->scd_base_addr = le32_to_cpu(lmac1->dbg_ptrs.scd_base_ptr);
        alive_data->valid = status == IWL_ALIVE_STATUS_OK;
        IWL_DEBUG_FW(mvm,
@@ -299,7 +312,6 @@ static int iwl_mvm_load_ucode_wait_alive(struct iwl_mvm *mvm,
        enum iwl_ucode_type old_type = mvm->fwrt.cur_fw_img;
        static const u16 alive_cmd[] = { MVM_ALIVE };
-        set_bit(IWL_FWRT_STATUS_WAIT_ALIVE, &mvm->fwrt.status);
        if (ucode_type == IWL_UCODE_REGULAR &&
            iwl_fw_dbg_conf_usniffer(mvm->fw, FW_DBG_START_FROM_ALIVE) &&
            !(fw_has_capa(&mvm->fw->ucode_capa,
@@ -332,11 +344,16 @@ static int iwl_mvm_load_ucode_wait_alive(struct iwl_mvm *mvm,
        if (ret) {
                struct iwl_trans *trans = mvm->trans;
+                if (ret == -ETIMEDOUT)
+                        iwl_fw_dbg_error_collect(&mvm->fwrt,
+                                                 FW_DBG_TRIGGER_ALIVE_TIMEOUT);
                if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_22000)
                        IWL_ERR(mvm,
                                "SecBoot CPU1 Status: 0x%x, CPU2 Status: 0x%x\n",
-                                iwl_read_prph(trans, UMAG_SB_CPU_1_STATUS),
+                                iwl_read_umac_prph(trans, UMAG_SB_CPU_1_STATUS),
-                                iwl_read_prph(trans, UMAG_SB_CPU_2_STATUS));
+                                iwl_read_umac_prph(trans,
+                                                   UMAG_SB_CPU_2_STATUS));
                else if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_8000)
                        IWL_ERR(mvm,
                                "SecBoot CPU1 Status: 0x%x, CPU2 Status: 0x%x\n",
@@ -377,7 +394,6 @@ static int iwl_mvm_load_ucode_wait_alive(struct iwl_mvm *mvm,
 #ifdef CONFIG_IWLWIFI_DEBUGFS
        iwl_fw_set_dbg_rec_on(&mvm->fwrt);
 #endif
-        clear_bit(IWL_FWRT_STATUS_WAIT_ALIVE, &mvm->fwrt.status);
        return 0;
 }
@@ -403,13 +419,15 @@ static int iwl_run_unified_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
                                   iwl_wait_init_complete,
                                   NULL);
+        iwl_fw_dbg_apply_point(&mvm->fwrt, IWL_FW_INI_APPLY_EARLY);
        /* Will also start the device */
        ret = iwl_mvm_load_ucode_wait_alive(mvm, IWL_UCODE_REGULAR);
        if (ret) {
                IWL_ERR(mvm, "Failed to start RT ucode: %d\n", ret);
-                iwl_fw_assert_error_dump(&mvm->fwrt);
                goto error;
        }
+        iwl_fw_dbg_apply_point(&mvm->fwrt, IWL_FW_INI_APPLY_AFTER_ALIVE);
        /* Send init config command to mark that we are sending NVM access
         * commands
@@ -628,10 +646,10 @@ static int iwl_mvm_config_ltr(struct iwl_mvm *mvm)
 }
 #ifdef CONFIG_ACPI
-static int iwl_mvm_sar_set_profile(struct iwl_mvm *mvm,
+static inline int iwl_mvm_sar_set_profile(struct iwl_mvm *mvm,
-                                   union acpi_object *table,
+                                          union acpi_object *table,
-                                   struct iwl_mvm_sar_profile *profile,
+                                          struct iwl_mvm_sar_profile *profile,
-                                   bool enabled)
+                                          bool enabled)
 {
        int i;
@@ -962,6 +980,57 @@ int iwl_mvm_get_sar_geo_profile(struct iwl_mvm *mvm)
 }
 #endif /* CONFIG_ACPI */
+void iwl_mvm_send_recovery_cmd(struct iwl_mvm *mvm, u32 flags)
+{
+        u32 error_log_size = mvm->fw->ucode_capa.error_log_size;
+        int ret;
+        u32 resp;
+        struct iwl_fw_error_recovery_cmd recovery_cmd = {
+                .flags = cpu_to_le32(flags),
+                .buf_size = 0,
+        };
+        struct iwl_host_cmd host_cmd = {
+                .id = WIDE_ID(SYSTEM_GROUP, FW_ERROR_RECOVERY_CMD),
+                .flags = CMD_WANT_SKB,
+                .data = {&recovery_cmd, },
+                .len = {sizeof(recovery_cmd), },
+        };
+        /* no error log was defined in TLV */
+        if (!error_log_size)
+                return;
+        if (flags & ERROR_RECOVERY_UPDATE_DB) {
+                /* no buf was allocated while HW reset */
+                if (!mvm->error_recovery_buf)
+                        return;
+                host_cmd.data[1] = mvm->error_recovery_buf;
+                host_cmd.len[1] =  error_log_size;
+                host_cmd.dataflags[1] = IWL_HCMD_DFL_NOCOPY;
+                recovery_cmd.buf_size = cpu_to_le32(error_log_size);
+        }
+        ret = iwl_mvm_send_cmd(mvm, &host_cmd);
+        kfree(mvm->error_recovery_buf);
+        mvm->error_recovery_buf = NULL;
+        if (ret) {
+                IWL_ERR(mvm, "Failed to send recovery cmd %d\n", ret);
+                return;
+        }
+        /* skb respond is only relevant in ERROR_RECOVERY_UPDATE_DB */
+        if (flags & ERROR_RECOVERY_UPDATE_DB) {
+                resp = le32_to_cpu(*(__le32 *)host_cmd.resp_pkt->data);
+                if (resp)
+                        IWL_ERR(mvm,
+                                "Failed to send recovery cmd blob was invalid %d\n",
+                                resp);
+        }
+}
 static int iwl_mvm_sar_init(struct iwl_mvm *mvm)
 {
        int ret;
@@ -1052,7 +1121,7 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
        ret = iwl_mvm_load_rt_fw(mvm);
        if (ret) {
                IWL_ERR(mvm, "Failed to start RT ucode: %d\n", ret);
-                iwl_fw_assert_error_dump(&mvm->fwrt);
+                iwl_fw_dbg_error_collect(&mvm->fwrt, FW_DBG_TRIGGER_DRIVER);
                goto error;
        }
@@ -1198,6 +1267,12 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
        if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
                iwl_mvm_unref(mvm, IWL_MVM_REF_UCODE_DOWN);
+        if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
+                iwl_mvm_send_recovery_cmd(mvm, ERROR_RECOVERY_UPDATE_DB);
+        if (iwl_acpi_get_eckv(mvm->dev, &mvm->ext_clock_valid))
+                IWL_DEBUG_INFO(mvm, "ECKV table doesn't exist in BIOS\n");
        ret = iwl_mvm_sar_init(mvm);
        if (ret == 0) {
                ret = iwl_mvm_sar_geo_init(mvm);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/led.c b/drivers/net/wireless/intel/iwlwifi/mvm/led.c
index 9bb1de1cad64..4348bb00e761 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/led.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/led.c
@@ -7,6 +7,7 @@
 *
 * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2017        Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -28,6 +29,7 @@
 *
 * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2017        Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -113,6 +115,7 @@ int iwl_mvm_leds_init(struct iwl_mvm *mvm)
        switch (mode) {
        case IWL_LED_BLINK:
                IWL_ERR(mvm, "Blink led mode not supported, used default\n");
+                /* fall through */
        case IWL_LED_DEFAULT:
        case IWL_LED_RF_STATE:
                mode = IWL_LED_RF_STATE;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
index 7cfdd07d8736..6a70dece447d 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
@@ -706,8 +706,7 @@ static int iwl_mvm_mac_ctxt_cmd_sta(struct iwl_mvm *mvm,
        if (vif->probe_req_reg && vif->bss_conf.assoc && vif->p2p)
                cmd.filter_flags |= cpu_to_le32(MAC_FILTER_IN_PROBE_REQUEST);
-        if (vif->bss_conf.assoc && vif->bss_conf.he_support &&
+        if (vif->bss_conf.he_support && !iwlwifi_mod_params.disable_11ax) {
-            !iwlwifi_mod_params.disable_11ax) {
                cmd.filter_flags |= cpu_to_le32(MAC_FILTER_IN_11AX);
                if (vif->bss_conf.twt_requester)
                        ctxt_sta->data_policy |= cpu_to_le32(TWT_SUPPORTED);
@@ -812,9 +811,9 @@ static int iwl_mvm_mac_ctxt_cmd_p2p_device(struct iwl_mvm *mvm,
        return iwl_mvm_mac_ctxt_send_cmd(mvm, &cmd);
 }
-static void iwl_mvm_mac_ctxt_set_tim(struct iwl_mvm *mvm,
+void iwl_mvm_mac_ctxt_set_tim(struct iwl_mvm *mvm,
-                                     __le32 *tim_index, __le32 *tim_size,
+                              __le32 *tim_index, __le32 *tim_size,
-                                     u8 *beacon, u32 frame_size)
+                              u8 *beacon, u32 frame_size)
 {
        u32 tim_idx;
        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)beacon;
@@ -854,8 +853,8 @@ static u32 iwl_mvm_find_ie_offset(u8 *beacon, u8 eid, u32 frame_size)
        return ie - beacon;
 }
-static u8 iwl_mvm_mac_ctxt_get_lowest_rate(struct ieee80211_tx_info *info,
+u8 iwl_mvm_mac_ctxt_get_lowest_rate(struct ieee80211_tx_info *info,
-                                           struct ieee80211_vif *vif)
+                                    struct ieee80211_vif *vif)
 {
        u8 rate;
@@ -905,9 +904,9 @@ static void iwl_mvm_mac_ctxt_set_tx(struct iwl_mvm *mvm,
 }
-static int iwl_mvm_mac_ctxt_send_beacon_cmd(struct iwl_mvm *mvm,
+int iwl_mvm_mac_ctxt_send_beacon_cmd(struct iwl_mvm *mvm,
-                                            struct sk_buff *beacon,
+                                     struct sk_buff *beacon,
-                                            void *data, int len)
+                                     void *data, int len)
 {
        struct iwl_host_cmd cmd = {
                .id = BEACON_TEMPLATE_CMD,
@@ -1010,13 +1009,16 @@ static int iwl_mvm_mac_ctxt_send_beacon_v9(struct iwl_mvm *mvm,
                                                sizeof(beacon_cmd));
 }
-static int iwl_mvm_mac_ctxt_send_beacon(struct iwl_mvm *mvm,
+int iwl_mvm_mac_ctxt_send_beacon(struct iwl_mvm *mvm,
-                                        struct ieee80211_vif *vif,
+                                 struct ieee80211_vif *vif,
-                                        struct sk_buff *beacon)
+                                 struct sk_buff *beacon)
 {
        if (WARN_ON(!beacon))
                return -EINVAL;
+        if (IWL_MVM_NON_TRANSMITTING_AP)
+                return 0;
        if (!fw_has_capa(&mvm->fw->ucode_capa,
                         IWL_UCODE_TLV_CAPA_CSA_AND_TBTT_OFFLOAD))
                return iwl_mvm_mac_ctxt_send_beacon_v6(mvm, vif, beacon);
@@ -1042,6 +1044,11 @@ int iwl_mvm_mac_ctxt_beacon_changed(struct iwl_mvm *mvm,
        if (!beacon)
                return -ENOMEM;
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        if (mvm->beacon_inject_active)
+                return -EBUSY;
+#endif
        ret = iwl_mvm_mac_ctxt_send_beacon(mvm, vif, beacon);
        dev_kfree_skb(beacon);
        return ret;
@@ -1330,7 +1337,7 @@ void iwl_mvm_rx_beacon_notif(struct iwl_mvm *mvm,
 {
        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        struct iwl_extended_beacon_notif *beacon = (void *)pkt->data;
-        struct iwl_mvm_tx_resp *beacon_notify_hdr;
+        struct iwl_extended_beacon_notif_v5 *beacon_v5 = (void *)pkt->data;
        struct ieee80211_vif *csa_vif;
        struct ieee80211_vif *tx_blocked_vif;
        struct agg_tx_status *agg_status;
@@ -1338,18 +1345,29 @@ void iwl_mvm_rx_beacon_notif(struct iwl_mvm *mvm,
        lockdep_assert_held(&mvm->mutex);
-        beacon_notify_hdr = &beacon->beacon_notify_hdr;
        mvm->ap_last_beacon_gp2 = le32_to_cpu(beacon->gp2);
-        mvm->ibss_manager = beacon->ibss_mgr_status != 0;
-        agg_status = iwl_mvm_get_agg_status(mvm, beacon_notify_hdr);
+        if (!iwl_mvm_is_short_beacon_notif_supported(mvm)) {
-        status = le16_to_cpu(agg_status->status) & TX_STATUS_MSK;
+                struct iwl_mvm_tx_resp *beacon_notify_hdr =
-        IWL_DEBUG_RX(mvm,
+                        &beacon_v5->beacon_notify_hdr;
-                     "beacon status %#x retries:%d tsf:0x%016llX gp2:0x%X rate:%d\n",
-                     status, beacon_notify_hdr->failure_frame,
+                mvm->ibss_manager = beacon_v5->ibss_mgr_status != 0;
-                     le64_to_cpu(beacon->tsf),
+                agg_status = iwl_mvm_get_agg_status(mvm, beacon_notify_hdr);
-                     mvm->ap_last_beacon_gp2,
+                status = le16_to_cpu(agg_status->status) & TX_STATUS_MSK;
-                     le32_to_cpu(beacon_notify_hdr->initial_rate));
+                IWL_DEBUG_RX(mvm,
+                             "beacon status %#x retries:%d tsf:0x%016llX gp2:0x%X rate:%d\n",
+                             status, beacon_notify_hdr->failure_frame,
+                             le64_to_cpu(beacon->tsf),
+                             mvm->ap_last_beacon_gp2,
+                             le32_to_cpu(beacon_notify_hdr->initial_rate));
+        } else {
+                mvm->ibss_manager = beacon->ibss_mgr_status != 0;
+                status = le32_to_cpu(beacon->status) & TX_STATUS_MSK;
+                IWL_DEBUG_RX(mvm,
+                             "beacon status %#x tsf:0x%016llX gp2:0x%X\n",
+                             status, le64_to_cpu(beacon->tsf),
+                             mvm->ap_last_beacon_gp2);
+        }
        csa_vif = rcu_dereference_protected(mvm->csa_vif,
                                            lockdep_is_held(&mvm->mutex));
@@ -1539,42 +1557,58 @@ void iwl_mvm_channel_switch_noa_notif(struct iwl_mvm *mvm,
 {
        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        struct iwl_channel_switch_noa_notif *notif = (void *)pkt->data;
-        struct ieee80211_vif *csa_vif;
+        struct ieee80211_vif *csa_vif, *vif;
        struct iwl_mvm_vif *mvmvif;
        int len = iwl_rx_packet_payload_len(pkt);
-        u32 id_n_color;
+        u32 id_n_color, csa_id, mac_id;
        if (WARN_ON_ONCE(len < sizeof(*notif)))
                return;
-        rcu_read_lock();
-        csa_vif = rcu_dereference(mvm->csa_vif);
-        if (WARN_ON(!csa_vif || !csa_vif->csa_active))
-                goto out_unlock;
        id_n_color = le32_to_cpu(notif->id_and_color);
+        mac_id = id_n_color & FW_CTXT_ID_MSK;
-        mvmvif = iwl_mvm_vif_from_mac80211(csa_vif);
+        if (WARN_ON_ONCE(mac_id >= NUM_MAC_INDEX_DRIVER))
-        if (WARN(FW_CMD_ID_AND_COLOR(mvmvif->id, mvmvif->color) != id_n_color,
+                return;
-                 "channel switch noa notification on unexpected vif (csa_vif=%d, notif=%d)",
-                 FW_CMD_ID_AND_COLOR(mvmvif->id, mvmvif->color), id_n_color))
-                goto out_unlock;
-        IWL_DEBUG_INFO(mvm, "Channel Switch Started Notification\n");
+        rcu_read_lock();
+        vif = rcu_dereference(mvm->vif_id_to_mac[mac_id]);
-        schedule_delayed_work(&mvm->cs_tx_unblock_dwork,
+        switch (vif->type) {
-                              msecs_to_jiffies(IWL_MVM_CS_UNBLOCK_TX_TIMEOUT *
+        case NL80211_IFTYPE_AP:
-                                               csa_vif->bss_conf.beacon_int));
+                csa_vif = rcu_dereference(mvm->csa_vif);
+                if (WARN_ON(!csa_vif || !csa_vif->csa_active ||
+                            csa_vif != vif))
+                        goto out_unlock;
-        ieee80211_csa_finish(csa_vif);
+                mvmvif = iwl_mvm_vif_from_mac80211(csa_vif);
+                csa_id = FW_CMD_ID_AND_COLOR(mvmvif->id, mvmvif->color);
+                if (WARN(csa_id != id_n_color,
+                         "channel switch noa notification on unexpected vif (csa_vif=%d, notif=%d)",
+                         csa_id, id_n_color))
+                        goto out_unlock;
-        rcu_read_unlock();
+                IWL_DEBUG_INFO(mvm, "Channel Switch Started Notification\n");
-        RCU_INIT_POINTER(mvm->csa_vif, NULL);
+                schedule_delayed_work(&mvm->cs_tx_unblock_dwork,
+                                      msecs_to_jiffies(IWL_MVM_CS_UNBLOCK_TX_TIMEOUT *
+                                                       csa_vif->bss_conf.beacon_int));
-        return;
+                ieee80211_csa_finish(csa_vif);
+                rcu_read_unlock();
+                RCU_INIT_POINTER(mvm->csa_vif, NULL);
+                return;
+        case NL80211_IFTYPE_STATION:
+                iwl_mvm_csa_client_absent(mvm, vif);
+                ieee80211_chswitch_done(vif, true);
+                break;
+        default:
+                /* should never happen */
+                WARN_ON_ONCE(1);
+                break;
+        }
 out_unlock:
        rcu_read_unlock();
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index e098884dd915..3a92c09d4692 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -184,6 +184,29 @@ static const struct iwl_fw_bcast_filter iwl_mvm_default_bcast_filters[] = {
 };
 #endif
+static const struct cfg80211_pmsr_capabilities iwl_mvm_pmsr_capa = {
+        .max_peers = IWL_MVM_TOF_MAX_APS,
+        .report_ap_tsf = 1,
+        .randomize_mac_addr = 1,
+        .ftm = {
+                .supported = 1,
+                .asap = 1,
+                .non_asap = 1,
+                .request_lci = 1,
+                .request_civicloc = 1,
+                .max_bursts_exponent = -1, /* all supported */
+                .max_ftms_per_burst = 0, /* no limits */
+                .bandwidths = BIT(NL80211_CHAN_WIDTH_20_NOHT) |
+                              BIT(NL80211_CHAN_WIDTH_20) |
+                              BIT(NL80211_CHAN_WIDTH_40) |
+                              BIT(NL80211_CHAN_WIDTH_80),
+                .preambles = BIT(NL80211_PREAMBLE_LEGACY) |
+                             BIT(NL80211_PREAMBLE_HT) |
+                             BIT(NL80211_PREAMBLE_VHT),
+        },
+};
 void iwl_mvm_ref(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type)
 {
        if (!iwl_mvm_is_d0i3_supported(mvm))
@@ -420,6 +443,10 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
                WLAN_CIPHER_SUITE_TKIP,
                WLAN_CIPHER_SUITE_CCMP,
        };
+#ifdef CONFIG_PM_SLEEP
+        bool unified = fw_has_capa(&mvm->fw->ucode_capa,
+                                   IWL_UCODE_TLV_CAPA_CNSLDTD_D3_D0_IMG);
+#endif
        /* Tell mac80211 our characteristics */
        ieee80211_hw_set(hw, SIGNAL_DBM);
@@ -544,6 +571,13 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
                hw->wiphy->n_cipher_suites++;
        }
+        if (fw_has_capa(&mvm->fw->ucode_capa,
+                        IWL_UCODE_TLV_CAPA_FTM_CALIBRATED)) {
+                wiphy_ext_feature_set(hw->wiphy,
+                                      NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER);
+                hw->wiphy->pmsr_capa = &iwl_mvm_pmsr_capa;
+        }
        ieee80211_hw_set(hw, SINGLE_SCAN_ON_ALL_BANDS);
        hw->wiphy->features |=
                NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR |
@@ -709,7 +743,7 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
                hw->wiphy->wowlan = &mvm->wowlan;
        }
-        if (mvm->fw->img[IWL_UCODE_WOWLAN].num_sec &&
+        if ((unified || mvm->fw->img[IWL_UCODE_WOWLAN].num_sec) &&
            mvm->trans->ops->d3_suspend &&
            mvm->trans->ops->d3_resume &&
            device_can_wakeup(mvm->trans->dev)) {
@@ -762,15 +796,15 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
                        hw->netdev_features |= IWL_TX_CSUM_NETIF_FLAGS;
        }
-        ret = ieee80211_register_hw(mvm->hw);
-        if (ret)
-                iwl_mvm_leds_exit(mvm);
-        mvm->init_status |= IWL_MVM_INIT_STATUS_REG_HW_INIT_COMPLETE;
        if (mvm->cfg->vht_mu_mimo_supported)
                wiphy_ext_feature_set(hw->wiphy,
                                      NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER);
+        ret = ieee80211_register_hw(mvm->hw);
+        if (ret) {
+                iwl_mvm_leds_exit(mvm);
+        }
        return ret;
 }
@@ -907,8 +941,14 @@ void iwl_mvm_mac_itxq_xmit(struct ieee80211_hw *hw, struct ieee80211_txq *txq)
                               IWL_PLAT_PM_MODE_DISABLED))) {
                        skb = ieee80211_tx_dequeue(hw, txq);
-                        if (!skb)
+                        if (!skb) {
+                                if (txq->sta)
+                                        IWL_DEBUG_TX(mvm,
+                                                     "TXQ of sta %pM tid %d is now empty\n",
+                                                     txq->sta->addr,
+                                                     txq->tid);
                                break;
+                        }
                        if (!txq->sta)
                                iwl_mvm_tx_skb_non_sta(mvm, skb);
@@ -1177,6 +1217,8 @@ static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
        iwl_mvm_cleanup_roc_te(mvm);
        ieee80211_remain_on_channel_expired(mvm->hw);
+        iwl_mvm_ftm_restart(mvm);
        /*
         * cleanup all interfaces, even inactive ones, as some might have
         * gone down during the HW restart
@@ -1290,6 +1332,8 @@ static void iwl_mvm_restart_complete(struct iwl_mvm *mvm)
        /* allow transport/FW low power modes */
        iwl_mvm_unref(mvm, IWL_MVM_REF_UCODE_DOWN);
+        iwl_mvm_send_recovery_cmd(mvm, ERROR_RECOVERY_END_OF_RECOVERY);
        /*
         * If we have TDLS peers, remove them. We don't know the last seqno/PN
         * of packets the FW sent out, so we must reconnect.
@@ -1653,6 +1697,9 @@ static void iwl_mvm_mac_remove_interface(struct ieee80211_hw *hw,
                                       IEEE80211_VIF_SUPPORTS_CQM_RSSI);
        }
+        if (vif->bss_conf.ftm_responder)
+                memset(&mvm->ftm_resp_stats, 0, sizeof(mvm->ftm_resp_stats));
        iwl_mvm_vif_dbgfs_clean(mvm, vif);
        /*
@@ -2363,7 +2410,10 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
                         * If update fails - SF might be running in associated
                         * mode while disassociated - which is forbidden.
                         */
-                        WARN_ONCE(iwl_mvm_sf_update(mvm, vif, false),
+                        ret = iwl_mvm_sf_update(mvm, vif, false);
+                        WARN_ONCE(ret &&
+                                  !test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
+                                            &mvm->status),
                                  "Failed to update SF upon disassociation\n");
                        /*
@@ -2584,6 +2634,8 @@ static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
        if (iwl_mvm_phy_ctx_count(mvm) > 1)
                iwl_mvm_teardown_tdls_peers(mvm);
+        iwl_mvm_ftm_restart_responder(mvm, vif);
        goto out_unlock;
 out_quota_failed:
@@ -2695,6 +2747,15 @@ iwl_mvm_bss_info_changed_ap_ibss(struct iwl_mvm *mvm,
                                bss_conf->txpower);
                iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
        }
+        if (changes & BSS_CHANGED_FTM_RESPONDER) {
+                int ret = iwl_mvm_ftm_start_responder(mvm, vif);
+                if (ret)
+                        IWL_WARN(mvm, "Failed to enable FTM responder (%d)\n",
+                                 ret);
+        }
 }
 static void iwl_mvm_bss_info_changed(struct ieee80211_hw *hw,
@@ -3106,11 +3167,15 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
        } else if (old_state == IEEE80211_STA_AUTH &&
                   new_state == IEEE80211_STA_ASSOC) {
                if (vif->type == NL80211_IFTYPE_AP) {
+                        vif->bss_conf.he_support = sta->he_cap.has_he;
                        mvmvif->ap_assoc_sta_count++;
                        iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
                        if (vif->bss_conf.he_support &&
                            !iwlwifi_mod_params.disable_11ax)
                                iwl_mvm_cfg_he_sta(mvm, vif, mvm_sta->sta_id);
+                } else if (vif->type == NL80211_IFTYPE_STATION) {
+                        vif->bss_conf.he_support = sta->he_cap.has_he;
+                        iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
                }
                iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
@@ -3118,6 +3183,24 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
                ret = iwl_mvm_update_sta(mvm, vif, sta);
        } else if (old_state == IEEE80211_STA_ASSOC &&
                   new_state == IEEE80211_STA_AUTHORIZED) {
+                /* if wep is used, need to set the key for the station now */
+                if (vif->type == NL80211_IFTYPE_AP && mvmvif->ap_wep_key) {
+                        mvm_sta->wep_key =
+                                kmemdup(mvmvif->ap_wep_key,
+                                        sizeof(*mvmvif->ap_wep_key) +
+                                        mvmvif->ap_wep_key->keylen,
+                                        GFP_KERNEL);
+                        if (!mvm_sta->wep_key) {
+                                ret = -ENOMEM;
+                                goto out_unlock;
+                        }
+                        ret = iwl_mvm_set_sta_key(mvm, vif, sta,
+                                                  mvm_sta->wep_key,
+                                                  STA_KEY_IDX_INVALID);
+                } else {
+                        ret = 0;
+                }
                /* we don't support TDLS during DCM */
                if (iwl_mvm_phy_ctx_count(mvm) > 1)
@@ -3132,18 +3215,13 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
                iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
                                     true);
-                /* if wep is used, need to set the key for the station now */
-                if (vif->type == NL80211_IFTYPE_AP && mvmvif->ap_wep_key)
-                        ret = iwl_mvm_set_sta_key(mvm, vif, sta,
-                                                  mvmvif->ap_wep_key,
-                                                  STA_KEY_IDX_INVALID);
-                else
-                        ret = 0;
        } else if (old_state == IEEE80211_STA_AUTHORIZED &&
                   new_state == IEEE80211_STA_ASSOC) {
                /* disable beacon filtering */
-                WARN_ON(iwl_mvm_disable_beacon_filter(mvm, vif, 0));
+                ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
+                WARN_ON(ret &&
+                        !test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
+                                  &mvm->status));
                ret = 0;
        } else if (old_state == IEEE80211_STA_ASSOC &&
                   new_state == IEEE80211_STA_AUTH) {
@@ -3167,12 +3245,18 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
                /* Remove STA key if this is an AP using WEP */
                if (vif->type == NL80211_IFTYPE_AP && mvmvif->ap_wep_key) {
                        int rm_ret = iwl_mvm_remove_sta_key(mvm, vif, sta,
-                                                            mvmvif->ap_wep_key);
+                                                            mvm_sta->wep_key);
                        if (!ret)
                                ret = rm_ret;
+                        kfree(mvm_sta->wep_key);
+                        mvm_sta->wep_key = NULL;
                }
+                if (unlikely(ret &&
+                             test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
+                                      &mvm->status)))
+                        ret = 0;
        } else {
                ret = -EIO;
        }
@@ -3816,11 +3900,43 @@ static int iwl_mvm_cancel_roc(struct ieee80211_hw *hw)
        return 0;
 }
+struct iwl_mvm_ftm_responder_iter_data {
+        bool responder;
+        struct ieee80211_chanctx_conf *ctx;
+};
+static void iwl_mvm_ftm_responder_chanctx_iter(void *_data, u8 *mac,
+                                               struct ieee80211_vif *vif)
+{
+        struct iwl_mvm_ftm_responder_iter_data *data = _data;
+        if (rcu_access_pointer(vif->chanctx_conf) == data->ctx &&
+            vif->type == NL80211_IFTYPE_AP && vif->bss_conf.ftmr_params)
+                data->responder = true;
+}
+static bool iwl_mvm_is_ftm_responder_chanctx(struct iwl_mvm *mvm,
+                                             struct ieee80211_chanctx_conf *ctx)
+{
+        struct iwl_mvm_ftm_responder_iter_data data = {
+                .responder = false,
+                .ctx = ctx,
+        };
+        ieee80211_iterate_active_interfaces_atomic(mvm->hw,
+                                        IEEE80211_IFACE_ITER_NORMAL,
+                                        iwl_mvm_ftm_responder_chanctx_iter,
+                                        &data);
+        return data.responder;
+}
 static int __iwl_mvm_add_chanctx(struct iwl_mvm *mvm,
                                 struct ieee80211_chanctx_conf *ctx)
 {
        u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
        struct iwl_mvm_phy_ctxt *phy_ctxt;
+        bool responder = iwl_mvm_is_ftm_responder_chanctx(mvm, ctx);
+        struct cfg80211_chan_def *def = responder ? &ctx->def : &ctx->min_def;
        int ret;
        lockdep_assert_held(&mvm->mutex);
@@ -3833,7 +3949,7 @@ static int __iwl_mvm_add_chanctx(struct iwl_mvm *mvm,
                goto out;
        }
-        ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &ctx->min_def,
+        ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, def,
                                       ctx->rx_chains_static,
                                       ctx->rx_chains_dynamic);
        if (ret) {
@@ -3888,6 +4004,8 @@ static void iwl_mvm_change_chanctx(struct ieee80211_hw *hw,
        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
        u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
        struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
+        bool responder = iwl_mvm_is_ftm_responder_chanctx(mvm, ctx);
+        struct cfg80211_chan_def *def = responder ? &ctx->def : &ctx->min_def;
        if (WARN_ONCE((phy_ctxt->ref > 1) &&
                      (changed & ~(IEEE80211_CHANCTX_CHANGE_WIDTH |
@@ -3902,17 +4020,17 @@ static void iwl_mvm_change_chanctx(struct ieee80211_hw *hw,
        /* we are only changing the min_width, may be a noop */
        if (changed == IEEE80211_CHANCTX_CHANGE_MIN_WIDTH) {
-                if (phy_ctxt->width == ctx->min_def.width)
+                if (phy_ctxt->width == def->width)
                        goto out_unlock;
                /* we are just toggling between 20_NOHT and 20 */
                if (phy_ctxt->width <= NL80211_CHAN_WIDTH_20 &&
-                    ctx->min_def.width <= NL80211_CHAN_WIDTH_20)
+                    def->width <= NL80211_CHAN_WIDTH_20)
                        goto out_unlock;
        }
        iwl_mvm_bt_coex_vif_change(mvm);
-        iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &ctx->min_def,
+        iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, def,
                                 ctx->rx_chains_static,
                                 ctx->rx_chains_dynamic);
@@ -3941,6 +4059,7 @@ static int __iwl_mvm_assign_vif_chanctx(struct iwl_mvm *mvm,
                        mvmvif->ap_ibss_active = true;
                        break;
                }
+                /* fall through */
        case NL80211_IFTYPE_ADHOC:
                /*
                 * The AP binding flow is handled as part of the start_ap flow
@@ -3993,25 +4112,30 @@ static int __iwl_mvm_assign_vif_chanctx(struct iwl_mvm *mvm,
        }
        if (switching_chanctx && vif->type == NL80211_IFTYPE_STATION) {
-                u32 duration = 3 * vif->bss_conf.beacon_int;
+                mvmvif->csa_bcn_pending = true;
-                /* iwl_mvm_protect_session() reads directly from the
+                if (!fw_has_capa(&mvm->fw->ucode_capa,
-                 * device (the system time), so make sure it is
+                                 IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD)) {
-                 * available.
+                        u32 duration = 3 * vif->bss_conf.beacon_int;
-                 */
-                ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_PROTECT_CSA);
-                if (ret)
-                        goto out_remove_binding;
-                /* Protect the session to make sure we hear the first
-                 * beacon on the new channel.
-                 */
-                mvmvif->csa_bcn_pending = true;
-                iwl_mvm_protect_session(mvm, vif, duration, duration,
-                                        vif->bss_conf.beacon_int / 2,
-                                        true);
-                iwl_mvm_unref(mvm, IWL_MVM_REF_PROTECT_CSA);
+                        /* iwl_mvm_protect_session() reads directly from the
+                         * device (the system time), so make sure it is
+                         * available.
+                         */
+                        ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_PROTECT_CSA);
+                        if (ret)
+                                goto out_remove_binding;
+                        /* Protect the session to make sure we hear the first
+                         * beacon on the new channel.
+                         */
+                        iwl_mvm_protect_session(mvm, vif, duration, duration,
+                                                vif->bss_conf.beacon_int / 2,
+                                                true);
+                        iwl_mvm_unref(mvm, IWL_MVM_REF_PROTECT_CSA);
+                }
                iwl_mvm_update_quotas(mvm, false, NULL);
        }
@@ -4081,7 +4205,9 @@ static void __iwl_mvm_unassign_vif_chanctx(struct iwl_mvm *mvm,
                disabled_vif = vif;
-                iwl_mvm_mac_ctxt_changed(mvm, vif, true, NULL);
+                if (!fw_has_capa(&mvm->fw->ucode_capa,
+                                 IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD))
+                        iwl_mvm_mac_ctxt_changed(mvm, vif, true, NULL);
                break;
        default:
                break;
@@ -4332,6 +4458,27 @@ static void iwl_mvm_channel_switch(struct ieee80211_hw *hw,
                           "dummy channel switch op\n");
 }
+static int iwl_mvm_schedule_client_csa(struct iwl_mvm *mvm,
+                                       struct ieee80211_vif *vif,
+                                       struct ieee80211_channel_switch *chsw)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct iwl_chan_switch_te_cmd cmd = {
+                .mac_id = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
+                                                          mvmvif->color)),
+                .action = cpu_to_le32(FW_CTXT_ACTION_ADD),
+                .tsf = cpu_to_le32(chsw->timestamp),
+                .cs_count = chsw->count,
+        };
+        lockdep_assert_held(&mvm->mutex);
+        return iwl_mvm_send_cmd_pdu(mvm,
+                                    WIDE_ID(MAC_CONF_GROUP,
+                                            CHANNEL_SWITCH_TIME_EVENT_CMD),
+                                    0, sizeof(cmd), &cmd);
+}
 static int iwl_mvm_pre_channel_switch(struct ieee80211_hw *hw,
                                      struct ieee80211_vif *vif,
                                      struct ieee80211_channel_switch *chsw)
@@ -4399,14 +4546,19 @@ static int iwl_mvm_pre_channel_switch(struct ieee80211_hw *hw,
                if (chsw->block_tx)
                        iwl_mvm_csa_client_absent(mvm, vif);
-                iwl_mvm_schedule_csa_period(mvm, vif, vif->bss_conf.beacon_int,
-                                            apply_time);
                if (mvmvif->bf_data.bf_enabled) {
                        ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
                        if (ret)
                                goto out_unlock;
                }
+                if (fw_has_capa(&mvm->fw->ucode_capa,
+                                IWL_UCODE_TLV_CAPA_CHANNEL_SWITCH_CMD))
+                        iwl_mvm_schedule_client_csa(mvm, vif, chsw);
+                else
+                        iwl_mvm_schedule_csa_period(mvm, vif,
+                                                    vif->bss_conf.beacon_int,
+                                                    apply_time);
                break;
        default:
                break;
@@ -4799,6 +4951,60 @@ static void iwl_mvm_sync_rx_queues(struct ieee80211_hw *hw)
        mutex_unlock(&mvm->mutex);
 }
+static int
+iwl_mvm_mac_get_ftm_responder_stats(struct ieee80211_hw *hw,
+                                    struct ieee80211_vif *vif,
+                                    struct cfg80211_ftm_responder_stats *stats)
+{
+        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        if (vif->p2p || vif->type != NL80211_IFTYPE_AP ||
+            !mvmvif->ap_ibss_active || !vif->bss_conf.ftm_responder)
+                return -EINVAL;
+        mutex_lock(&mvm->mutex);
+        *stats = mvm->ftm_resp_stats;
+        mutex_unlock(&mvm->mutex);
+        stats->filled = BIT(NL80211_FTM_STATS_SUCCESS_NUM) |
+                        BIT(NL80211_FTM_STATS_PARTIAL_NUM) |
+                        BIT(NL80211_FTM_STATS_FAILED_NUM) |
+                        BIT(NL80211_FTM_STATS_ASAP_NUM) |
+                        BIT(NL80211_FTM_STATS_NON_ASAP_NUM) |
+                        BIT(NL80211_FTM_STATS_TOTAL_DURATION_MSEC) |
+                        BIT(NL80211_FTM_STATS_UNKNOWN_TRIGGERS_NUM) |
+                        BIT(NL80211_FTM_STATS_RESCHEDULE_REQUESTS_NUM) |
+                        BIT(NL80211_FTM_STATS_OUT_OF_WINDOW_TRIGGERS_NUM);
+        return 0;
+}
+static int iwl_mvm_start_pmsr(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif,
+                              struct cfg80211_pmsr_request *request)
+{
+        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+        int ret;
+        mutex_lock(&mvm->mutex);
+        ret = iwl_mvm_ftm_start(mvm, vif, request);
+        mutex_unlock(&mvm->mutex);
+        return ret;
+}
+static void iwl_mvm_abort_pmsr(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif,
+                               struct cfg80211_pmsr_request *request)
+{
+        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+        mutex_lock(&mvm->mutex);
+        iwl_mvm_ftm_abort(mvm, request);
+        mutex_unlock(&mvm->mutex);
+}
 static bool iwl_mvm_can_hw_csum(struct sk_buff *skb)
 {
        u8 protocol = ip_hdr(skb)->protocol;
@@ -4901,6 +5107,10 @@ const struct ieee80211_ops iwl_mvm_hw_ops = {
 #endif
        .get_survey = iwl_mvm_mac_get_survey,
        .sta_statistics = iwl_mvm_mac_sta_statistics,
+        .get_ftm_responder_stats = iwl_mvm_mac_get_ftm_responder_stats,
+        .start_pmsr = iwl_mvm_start_pmsr,
+        .abort_pmsr = iwl_mvm_abort_pmsr,
        .can_aggregate_in_amsdu = iwl_mvm_mac_can_aggregate,
 #ifdef CONFIG_IWLWIFI_DEBUGFS
        .sta_add_debugfs = iwl_mvm_sta_add_debugfs,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index 12e9ecc3ee27..bca6f6b536d9 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -879,9 +879,6 @@ struct iwl_mvm {
        bool hw_registered;
        bool calibrating;
-        u32 error_event_table[2];
-        u32 log_event_table;
-        u32 umac_error_event_table;
        bool support_umac_log;
        u32 ampdu_ref;
@@ -981,6 +978,7 @@ struct iwl_mvm {
        u32 dbgfs_prph_reg_addr;
        bool disable_power_off;
        bool disable_power_off_d3;
+        bool beacon_inject_active;
        bool scan_iter_notif_enabled;
@@ -1017,6 +1015,7 @@ struct iwl_mvm {
        /* -1 for always, 0 for never, >0 for that many times */
        s8 fw_restart;
+        u8 *error_recovery_buf;
 #ifdef CONFIG_IWLWIFI_LEDS
        struct led_classdev led;
@@ -1106,6 +1105,8 @@ struct iwl_mvm {
        /* Indicate if device power save is allowed */
        u8 ps_disabled; /* u8 instead of bool to ease debugfs_create_* usage */
+        /* Indicate if 32Khz external clock is valid */
+        u32 ext_clock_valid;
        unsigned int max_amsdu_len; /* used for debugfs only */
        struct ieee80211_vif __rcu *csa_vif;
@@ -1150,6 +1151,14 @@ struct iwl_mvm {
        u32 ciphers[IWL_MVM_NUM_CIPHERS];
        struct ieee80211_cipher_scheme cs[IWL_UCODE_MAX_CS];
+        struct cfg80211_ftm_responder_stats ftm_resp_stats;
+        struct {
+                struct cfg80211_pmsr_request *req;
+                struct wireless_dev *req_wdev;
+                struct list_head loc_list;
+                int responses[IWL_MVM_TOF_MAX_APS];
+        } ftm_initiator;
        struct ieee80211_vif *nan_vif;
 #define IWL_MAX_BAID    32
        struct iwl_mvm_baid_data __rcu *baid_map[IWL_MAX_BAID];
@@ -1167,6 +1176,7 @@ struct iwl_mvm {
        /* sniffer data to include in radiotap */
        __le16 cur_aid;
+        u8 cur_bssid[ETH_ALEN];
 #ifdef CONFIG_ACPI
        struct iwl_mvm_sar_profile sar_profiles[ACPI_SAR_PROFILE_NUM];
@@ -1211,7 +1221,6 @@ enum iwl_mvm_status {
 enum iwl_mvm_init_status {
        IWL_MVM_INIT_STATUS_THERMAL_INIT_COMPLETE = BIT(0),
        IWL_MVM_INIT_STATUS_LEDS_INIT_COMPLETE = BIT(1),
-        IWL_MVM_INIT_STATUS_REG_HW_INIT_COMPLETE = BIT(2),
 };
 static inline bool iwl_mvm_is_radio_killed(struct iwl_mvm *mvm)
@@ -1311,6 +1320,12 @@ static inline bool iwl_mvm_is_frag_ebs_supported(struct iwl_mvm *mvm)
        return fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_FRAG_EBS);
 }
+static inline bool iwl_mvm_is_short_beacon_notif_supported(struct iwl_mvm *mvm)
+{
+        return fw_has_api(&mvm->fw->ucode_capa,
+                          IWL_UCODE_TLV_API_SHORT_BEACON_NOTIF);
+}
 static inline bool iwl_mvm_enter_d0i3_on_suspend(struct iwl_mvm *mvm)
 {
        /* For now we only use this mode to differentiate between
@@ -1646,6 +1661,7 @@ void iwl_mvm_rx_queue_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
 void iwl_mvm_rx_tx_cmd(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb);
 void iwl_mvm_mfu_assert_dump_notif(struct iwl_mvm *mvm,
                                   struct iwl_rx_cmd_buffer *rxb);
+void iwl_mvm_send_recovery_cmd(struct iwl_mvm *mvm, u32 flags);
 void iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb);
 void iwl_mvm_rx_ant_coupling_notif(struct iwl_mvm *mvm,
                                   struct iwl_rx_cmd_buffer *rxb);
@@ -1680,6 +1696,17 @@ int iwl_mvm_mac_ctxt_changed(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 int iwl_mvm_mac_ctxt_remove(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
 int iwl_mvm_mac_ctxt_beacon_changed(struct iwl_mvm *mvm,
                                    struct ieee80211_vif *vif);
+int iwl_mvm_mac_ctxt_send_beacon(struct iwl_mvm *mvm,
+                                 struct ieee80211_vif *vif,
+                                 struct sk_buff *beacon);
+int iwl_mvm_mac_ctxt_send_beacon_cmd(struct iwl_mvm *mvm,
+                                     struct sk_buff *beacon,
+                                     void *data, int len);
+u8 iwl_mvm_mac_ctxt_get_lowest_rate(struct ieee80211_tx_info *info,
+                                    struct ieee80211_vif *vif);
+void iwl_mvm_mac_ctxt_set_tim(struct iwl_mvm *mvm,
+                              __le32 *tim_index, __le32 *tim_size,
+                              u8 *beacon, u32 frame_size);
 void iwl_mvm_rx_beacon_notif(struct iwl_mvm *mvm,
                             struct iwl_rx_cmd_buffer *rxb);
 void iwl_mvm_rx_missed_beacons_notif(struct iwl_mvm *mvm,
@@ -2007,15 +2034,12 @@ static inline void iwl_mvm_stop_device(struct iwl_mvm *mvm)
                               &mvm->status))
                iwl_fw_dbg_collect_desc(&mvm->fwrt, &iwl_dump_desc_assert,
                                        false, 0);
-        /* calling this function without using dump_start/end since at this
-         * point we already hold the op mode mutex
-         */
-        iwl_fw_dbg_collect_sync(&mvm->fwrt);
        iwl_fw_cancel_timestamp(&mvm->fwrt);
-        iwl_free_fw_paging(&mvm->fwrt);
        clear_bit(IWL_MVM_STATUS_FIRMWARE_RUNNING, &mvm->status);
+        iwl_fwrt_stop_device(&mvm->fwrt);
+        iwl_free_fw_paging(&mvm->fwrt);
        iwl_fw_dump_conf_clear(&mvm->fwrt);
-        iwl_trans_stop_device(mvm->trans);
 }
 /* Re-configure the SCD for a queue that has already been configured */
@@ -2057,6 +2081,23 @@ void iwl_mvm_update_changed_regdom(struct iwl_mvm *mvm);
 int iwl_mvm_sf_update(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                      bool added_vif);
+/* FTM responder */
+int iwl_mvm_ftm_start_responder(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
+void iwl_mvm_ftm_restart_responder(struct iwl_mvm *mvm,
+                                   struct ieee80211_vif *vif);
+void iwl_mvm_ftm_responder_stats(struct iwl_mvm *mvm,
+                                 struct iwl_rx_cmd_buffer *rxb);
+/* FTM initiator */
+void iwl_mvm_ftm_restart(struct iwl_mvm *mvm);
+void iwl_mvm_ftm_range_resp(struct iwl_mvm *mvm,
+                            struct iwl_rx_cmd_buffer *rxb);
+void iwl_mvm_ftm_lc_notif(struct iwl_mvm *mvm,
+                          struct iwl_rx_cmd_buffer *rxb);
+int iwl_mvm_ftm_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                      struct cfg80211_pmsr_request *request);
+void iwl_mvm_ftm_abort(struct iwl_mvm *mvm, struct cfg80211_pmsr_request *req);
 /* TDLS */
 /*
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index 5e4f8b767d10..ba27dce4c2bb 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -82,7 +82,6 @@
 #include "fw/api/scan.h"
 #include "time-event.h"
 #include "fw-api.h"
-#include "fw/api/scan.h"
 #include "fw/acpi.h"
 #define DRV_DESCRIPTION "The new Intel(R) wireless AGN driver for Linux"
@@ -301,6 +300,14 @@ static const struct iwl_rx_handlers iwl_mvm_rx_handlers[] = {
                   RX_HANDLER_ASYNC_LOCKED),
        RX_HANDLER(MFUART_LOAD_NOTIFICATION, iwl_mvm_rx_mfuart_notif,
                   RX_HANDLER_SYNC),
+        RX_HANDLER_GRP(LOCATION_GROUP, TOF_RESPONDER_STATS,
+                       iwl_mvm_ftm_responder_stats, RX_HANDLER_ASYNC_LOCKED),
+        RX_HANDLER_GRP(LOCATION_GROUP, TOF_RANGE_RESPONSE_NOTIF,
+                       iwl_mvm_ftm_range_resp, RX_HANDLER_ASYNC_LOCKED),
+        RX_HANDLER_GRP(LOCATION_GROUP, TOF_LC_NOTIF,
+                       iwl_mvm_ftm_lc_notif, RX_HANDLER_ASYNC_LOCKED),
        RX_HANDLER_GRP(DEBUG_GROUP, MFU_ASSERT_DUMP_NTF,
                       iwl_mvm_mfu_assert_dump_notif, RX_HANDLER_SYNC),
        RX_HANDLER_GRP(PROT_OFFLOAD_GROUP, STORED_BEACON_NTF,
@@ -415,12 +422,14 @@ static const struct iwl_hcmd_names iwl_mvm_legacy_names[] = {
 static const struct iwl_hcmd_names iwl_mvm_system_names[] = {
        HCMD_NAME(SHARED_MEM_CFG_CMD),
        HCMD_NAME(INIT_EXTENDED_CFG_CMD),
+        HCMD_NAME(FW_ERROR_RECOVERY_CMD),
 };
 /* Please keep this array *SORTED* by hex value.
 * Access is done through binary search
 */
 static const struct iwl_hcmd_names iwl_mvm_mac_conf_names[] = {
+        HCMD_NAME(CHANNEL_SWITCH_TIME_EVENT_CMD),
        HCMD_NAME(CHANNEL_SWITCH_NOA_NOTIF),
 };
@@ -445,6 +454,7 @@ static const struct iwl_hcmd_names iwl_mvm_data_path_names[] = {
        HCMD_NAME(TRIGGER_RX_QUEUES_NOTIF_CMD),
        HCMD_NAME(STA_HE_CTXT_CMD),
        HCMD_NAME(RFH_QUEUE_CONFIG_CMD),
+        HCMD_NAME(TLC_MNG_CONFIG_CMD),
        HCMD_NAME(CHEST_COLLECTOR_FILTER_CONFIG_CMD),
        HCMD_NAME(STA_PM_NOTIF),
        HCMD_NAME(MU_GROUP_MGMT_NOTIF),
@@ -591,11 +601,17 @@ static int iwl_mvm_fwrt_send_hcmd(void *ctx, struct iwl_host_cmd *host_cmd)
        return ret;
 }
+static bool iwl_mvm_d3_debug_enable(void *ctx)
+{
+        return IWL_MVM_D3_DEBUG;
+}
 static const struct iwl_fw_runtime_ops iwl_mvm_fwrt_ops = {
        .dump_start = iwl_mvm_fwrt_dump_start,
        .dump_end = iwl_mvm_fwrt_dump_end,
        .fw_running = iwl_mvm_fwrt_fw_running,
        .send_hcmd = iwl_mvm_fwrt_send_hcmd,
+        .d3_debug_enable = iwl_mvm_d3_debug_enable,
 };
 static struct iwl_op_mode *
@@ -690,6 +706,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
        INIT_LIST_HEAD(&mvm->aux_roc_te_list);
        INIT_LIST_HEAD(&mvm->async_handlers_list);
        spin_lock_init(&mvm->time_event_lock);
+        INIT_LIST_HEAD(&mvm->ftm_initiator.loc_list);
        INIT_WORK(&mvm->async_handlers_wk, iwl_mvm_async_handlers_wk);
        INIT_WORK(&mvm->roc_done_wk, iwl_mvm_roc_done_wk);
@@ -817,8 +834,8 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
        mutex_lock(&mvm->mutex);
        iwl_mvm_ref(mvm, IWL_MVM_REF_INIT_UCODE);
        err = iwl_run_init_mvm_ucode(mvm, true);
-        if (test_bit(IWL_FWRT_STATUS_WAIT_ALIVE, &mvm->fwrt.status))
+        if (err)
-                iwl_fw_alive_error_dump(&mvm->fwrt);
+                iwl_fw_dbg_error_collect(&mvm->fwrt, FW_DBG_TRIGGER_DRIVER);
        if (!iwlmvm_mod_params.init_dbg || !err)
                iwl_mvm_stop_device(mvm);
        iwl_mvm_unref(mvm, IWL_MVM_REF_INIT_UCODE);
@@ -902,15 +919,15 @@ static void iwl_op_mode_mvm_stop(struct iwl_op_mode *op_mode)
        iwl_mvm_thermal_exit(mvm);
-        if (mvm->init_status & IWL_MVM_INIT_STATUS_REG_HW_INIT_COMPLETE) {
+        ieee80211_unregister_hw(mvm->hw);
-                ieee80211_unregister_hw(mvm->hw);
-                mvm->init_status &= ~IWL_MVM_INIT_STATUS_REG_HW_INIT_COMPLETE;
-        }
        kfree(mvm->scan_cmd);
        kfree(mvm->mcast_filter_cmd);
        mvm->mcast_filter_cmd = NULL;
+        kfree(mvm->error_recovery_buf);
+        mvm->error_recovery_buf = NULL;
 #if defined(CONFIG_PM_SLEEP) && defined(CONFIG_IWLWIFI_DEBUGFS)
        kfree(mvm->d3_resume_sram);
 #endif
@@ -1105,6 +1122,12 @@ static void iwl_mvm_async_cb(struct iwl_op_mode *op_mode,
        iwl_trans_block_txq_ptrs(mvm->trans, false);
 }
+static int iwl_mvm_is_static_queue(struct iwl_mvm *mvm, int queue)
+{
+        return queue == mvm->aux_queue || queue == mvm->probe_queue ||
+                queue == mvm->p2p_dev_queue || queue == mvm->snif_queue;
+}
 static void iwl_mvm_queue_state_change(struct iwl_op_mode *op_mode,
                                       int hw_queue, bool start)
 {
@@ -1131,6 +1154,15 @@ static void iwl_mvm_queue_state_change(struct iwl_op_mode *op_mode,
                goto out;
        mvmsta = iwl_mvm_sta_from_mac80211(sta);
+        if (iwl_mvm_is_static_queue(mvm, hw_queue)) {
+                if (!start)
+                        ieee80211_stop_queues(mvm->hw);
+                else if (mvmsta->sta_state != IEEE80211_STA_NOTEXIST)
+                        ieee80211_wake_queues(mvm->hw);
+                goto out;
+        }
        if (iwl_mvm_has_new_tx_api(mvm)) {
                int tid = mvm->tvqm_info[hw_queue].txq_tid;
@@ -1285,12 +1317,29 @@ void iwl_mvm_nic_restart(struct iwl_mvm *mvm, bool fw_error)
                reprobe->dev = mvm->trans->dev;
                INIT_WORK(&reprobe->work, iwl_mvm_reprobe_wk);
                schedule_work(&reprobe->work);
+        } else if (test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
+                            &mvm->status)) {
+                IWL_ERR(mvm, "HW restart already requested, but not started\n");
        } else if (mvm->fwrt.cur_fw_img == IWL_UCODE_REGULAR &&
                   mvm->hw_registered &&
                   !test_bit(STATUS_TRANS_DEAD, &mvm->trans->status)) {
                /* don't let the transport/FW power down */
                iwl_mvm_ref(mvm, IWL_MVM_REF_UCODE_DOWN);
+                if (mvm->fw->ucode_capa.error_log_size) {
+                        u32 src_size = mvm->fw->ucode_capa.error_log_size;
+                        u32 src_addr = mvm->fw->ucode_capa.error_log_addr;
+                        u8 *recover_buf = kzalloc(src_size, GFP_ATOMIC);
+                        if (recover_buf) {
+                                mvm->error_recovery_buf = recover_buf;
+                                iwl_trans_read_mem_bytes(mvm->trans,
+                                                         src_addr,
+                                                         recover_buf,
+                                                         src_size);
+                        }
+                }
                if (fw_error && mvm->fw_restart > 0)
                        mvm->fw_restart--;
                set_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c
index f369173db11c..86e40bae57e3 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c
@@ -109,6 +109,7 @@ u8 iwl_mvm_get_ctrl_pos(struct cfg80211_chan_def *chandef)
                return PHY_VHT_CTRL_POS_4_ABOVE;
        default:
                WARN(1, "Invalid channel definition");
+                /* fall through */
        case 0:
                /*
                 * The FW is expected to check the control channel position only
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/power.c b/drivers/net/wireless/intel/iwlwifi/mvm/power.c
index 5a0a28fd762d..36f5fa1ee793 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/power.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/power.c
@@ -8,6 +8,7 @@
 * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
 * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
+ * Copyright (C) 2018 - 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -30,6 +31,7 @@
 * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
 * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
+ * Copyright (C) 2018 - 2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -79,6 +81,8 @@ int iwl_mvm_beacon_filter_send_cmd(struct iwl_mvm *mvm,
                                   struct iwl_beacon_filter_cmd *cmd,
                                   u32 flags)
 {
+        u16 len;
        IWL_DEBUG_POWER(mvm, "ba_enable_beacon_abort is: %d\n",
                        le32_to_cpu(cmd->ba_enable_beacon_abort));
        IWL_DEBUG_POWER(mvm, "ba_escape_timer is: %d\n",
@@ -101,9 +105,23 @@ int iwl_mvm_beacon_filter_send_cmd(struct iwl_mvm *mvm,
                        le32_to_cpu(cmd->bf_temp_fast_filter));
        IWL_DEBUG_POWER(mvm, "bf_temp_slow_filter is: %d\n",
                        le32_to_cpu(cmd->bf_temp_slow_filter));
+        IWL_DEBUG_POWER(mvm, "bf_threshold_absolute_low is: %d, %d\n",
+                        le32_to_cpu(cmd->bf_threshold_absolute_low[0]),
+                        le32_to_cpu(cmd->bf_threshold_absolute_low[1]));
+        IWL_DEBUG_POWER(mvm, "bf_threshold_absolute_high is: %d, %d\n",
+                        le32_to_cpu(cmd->bf_threshold_absolute_high[0]),
+                        le32_to_cpu(cmd->bf_threshold_absolute_high[1]));
+        if (fw_has_api(&mvm->fw->ucode_capa,
+                       IWL_UCODE_TLV_API_BEACON_FILTER_V4))
+                len = sizeof(struct iwl_beacon_filter_cmd);
+        else
+                len = offsetof(struct iwl_beacon_filter_cmd,
+                               bf_threshold_absolute_low);
        return iwl_mvm_send_cmd_pdu(mvm, REPLY_BEACON_FILTERING_CMD, flags,
-                                    sizeof(struct iwl_beacon_filter_cmd), cmd);
+                                    len, cmd);
 }
 static
@@ -526,6 +544,9 @@ int iwl_mvm_power_update_device(struct iwl_mvm *mvm)
                cmd.flags &=
                        cpu_to_le16(~DEVICE_POWER_FLAGS_POWER_SAVE_ENA_MSK);
 #endif
+        if (mvm->ext_clock_valid)
+                cmd.flags |= cpu_to_le16(DEVICE_POWER_FLAGS_32K_CLK_VALID_MSK);
        IWL_DEBUG_POWER(mvm,
                        "Sending device power command with flags = 0x%X\n",
                        cmd.flags);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
index 09866f50857a..e231a44d2423 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
@@ -3,7 +3,7 @@
 * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of version 2 of the GNU General Public License as
@@ -1643,8 +1643,26 @@ static s32 rs_get_best_rate(struct iwl_mvm *mvm,
 static u32 rs_bw_from_sta_bw(struct ieee80211_sta *sta)
 {
+        struct ieee80211_sta_vht_cap *sta_vht_cap = &sta->vht_cap;
+        struct ieee80211_vht_cap vht_cap = {
+                .vht_cap_info = cpu_to_le32(sta_vht_cap->cap),
+                .supp_mcs = sta_vht_cap->vht_mcs,
+        };
        switch (sta->bandwidth) {
        case IEEE80211_STA_RX_BW_160:
+                /*
+                 * Don't use 160 MHz if VHT extended NSS support
+                 * says we cannot use 2 streams, we don't want to
+                 * deal with this.
+                 * We only check MCS 0 - they will support that if
+                 * we got here at all and we don't care which MCS,
+                 * we want to determine a more global state.
+                 */
+                if (ieee80211_get_vht_max_nss(&vht_cap,
+                                              IEEE80211_VHT_CHANWIDTH_160MHZ,
+                                              0, true) < sta->rx_nss)
+                        return RATE_MCS_CHAN_WIDTH_80;
                return RATE_MCS_CHAN_WIDTH_160;
        case IEEE80211_STA_RX_BW_80:
                return RATE_MCS_CHAN_WIDTH_80;
@@ -1757,7 +1775,12 @@ static void rs_set_amsdu_len(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
        else
                mvmsta->amsdu_enabled = 0xFFFF;
-        mvmsta->max_amsdu_len = sta->max_amsdu_len;
+        if (mvmsta->vif->bss_conf.he_support &&
+            !iwlwifi_mod_params.disable_11ax)
+                mvmsta->max_amsdu_len = sta->max_amsdu_len;
+        else
+                mvmsta->max_amsdu_len = min_t(int, sta->max_amsdu_len, 8500);
        sta->max_rc_amsdu_len = mvmsta->max_amsdu_len;
        for (i = 0; i < IWL_MAX_TID_COUNT; i++) {
@@ -1791,7 +1814,7 @@ static bool rs_tweak_rate_tbl(struct iwl_mvm *mvm,
                              struct iwl_scale_tbl_info *tbl,
                              enum rs_action scale_action)
 {
-        if (sta->bandwidth != IEEE80211_STA_RX_BW_80)
+        if (rs_bw_from_sta_bw(sta) != RATE_MCS_CHAN_WIDTH_80)
                return false;
        if (!is_vht_siso(&tbl->rate))
@@ -4122,6 +4145,7 @@ static const struct rate_control_ops rs_mvm_ops_drv = {
        .add_sta_debugfs = rs_drv_add_sta_debugfs,
        .remove_sta_debugfs = rs_remove_sta_debugfs,
 #endif
+        .capa = RATE_CTRL_CAPA_VHT_EXT_NSS_BW,
 };
 void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
index 235ab26ca429..fbd3014e8b82 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
@@ -222,7 +222,7 @@ static u32 iwl_mvm_set_mac80211_rx_flag(struct iwl_mvm *mvm,
                    !(rx_pkt_status & RX_MPDU_RES_STATUS_TTAK_OK))
                        return 0;
                *crypt_len = IEEE80211_TKIP_IV_LEN;
-                /* fall through if TTAK OK */
+                /* fall through */
        case RX_MPDU_RES_STATUS_SEC_WEP_ENC:
                if (!(rx_pkt_status & RX_MPDU_RES_STATUS_ICV_OK))
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index 2c56f73d688e..1e03acf30762 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -66,11 +66,37 @@
 #include "mvm.h"
 #include "fw-api.h"
+static void *iwl_mvm_skb_get_hdr(struct sk_buff *skb)
+{
+        struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
+        u8 *data = skb->data;
+        /* Alignment concerns */
+        BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_he) % 4);
+        BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_he_mu) % 4);
+        BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_lsig) % 4);
+        BUILD_BUG_ON(sizeof(struct ieee80211_vendor_radiotap) % 4);
+        if (rx_status->flag & RX_FLAG_RADIOTAP_HE)
+                data += sizeof(struct ieee80211_radiotap_he);
+        if (rx_status->flag & RX_FLAG_RADIOTAP_HE_MU)
+                data += sizeof(struct ieee80211_radiotap_he_mu);
+        if (rx_status->flag & RX_FLAG_RADIOTAP_LSIG)
+                data += sizeof(struct ieee80211_radiotap_lsig);
+        if (rx_status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
+                struct ieee80211_vendor_radiotap *radiotap = (void *)data;
+                data += sizeof(*radiotap) + radiotap->len + radiotap->pad;
+        }
+        return data;
+}
 static inline int iwl_mvm_check_pn(struct iwl_mvm *mvm, struct sk_buff *skb,
                                   int queue, struct ieee80211_sta *sta)
 {
        struct iwl_mvm_sta *mvmsta;
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        struct ieee80211_hdr *hdr = iwl_mvm_skb_get_hdr(skb);
        struct ieee80211_rx_status *stats = IEEE80211_SKB_RXCB(skb);
        struct iwl_mvm_key_pn *ptk_pn;
        int res;
@@ -197,12 +223,15 @@ static void iwl_mvm_add_rtap_sniffer_config(struct iwl_mvm *mvm,
 {
        struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
        struct ieee80211_vendor_radiotap *radiotap;
-        int size = sizeof(*radiotap) + sizeof(__le16);
+        const int size = sizeof(*radiotap) + sizeof(__le16);
        if (!mvm->cur_aid)
                return;
-        radiotap = skb_put(skb, size);
+        /* ensure alignment */
+        BUILD_BUG_ON((size + 2) % 4);
+        radiotap = skb_put(skb, size + 2);
        radiotap->align = 1;
        /* Intel OUI */
        radiotap->oui[0] = 0xf6;
@@ -212,10 +241,12 @@ static void iwl_mvm_add_rtap_sniffer_config(struct iwl_mvm *mvm,
        radiotap->subns = 1;
        radiotap->present = 0x1;
        radiotap->len = size - sizeof(*radiotap);
-        radiotap->pad = 0;
+        radiotap->pad = 2;
        /* fill the data now */
        memcpy(radiotap->data, &mvm->cur_aid, sizeof(mvm->cur_aid));
+        /* and clear the padding */
+        memset(radiotap->data + sizeof(__le16), 0, radiotap->pad);
        rx_status->flag |= RX_FLAG_RADIOTAP_VENDOR_DATA;
 }
@@ -227,10 +258,7 @@ static void iwl_mvm_pass_packet_to_mac80211(struct iwl_mvm *mvm,
                                            struct ieee80211_sta *sta,
                                            bool csi)
 {
-        struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
+        if (iwl_mvm_check_pn(mvm, skb, queue, sta))
-        if (!(rx_status->flag & RX_FLAG_NO_PSDU) &&
-            iwl_mvm_check_pn(mvm, skb, queue, sta))
                kfree_skb(skb);
        else
                ieee80211_rx_napi(mvm->hw, sta, skb, napi);
@@ -310,7 +338,7 @@ static int iwl_mvm_rx_crypto(struct iwl_mvm *mvm, struct ieee80211_hdr *hdr,
                        stats->flag |= RX_FLAG_MMIC_ERROR;
                *crypt_len = IEEE80211_TKIP_IV_LEN;
-                /* fall through if TTAK OK */
+                /* fall through */
        case IWL_RX_MPDU_STATUS_SEC_WEP:
                if (!(status & IWL_RX_MPDU_STATUS_ICV_OK))
                        return -1;
@@ -663,7 +691,7 @@ static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
                            struct sk_buff *skb,
                            struct iwl_rx_mpdu_desc *desc)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        struct ieee80211_hdr *hdr = iwl_mvm_skb_get_hdr(skb);
        struct iwl_mvm_sta *mvm_sta;
        struct iwl_mvm_baid_data *baid_data;
        struct iwl_mvm_reorder_buffer *buffer;
@@ -960,6 +988,7 @@ iwl_mvm_decode_he_phy_ru_alloc(struct iwl_mvm_rx_phy_data *phy_data,
         * the TSF/timers are not be transmitted in HE-MU.
         */
        u8 ru = le32_get_bits(phy_data->d1, IWL_RX_PHY_DATA1_HE_RU_ALLOC_MASK);
+        u32 he_type = rate_n_flags & RATE_MCS_HE_TYPE_MSK;
        u8 offs = 0;
        rx_status->bw = RATE_INFO_BW_HE_RU;
@@ -1002,19 +1031,27 @@ iwl_mvm_decode_he_phy_ru_alloc(struct iwl_mvm_rx_phy_data *phy_data,
                he->data2 |=
                        cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA2_PRISEC_80_SEC);
-        if (he_mu) {
 #define CHECK_BW(bw) \
        BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_MU_FLAGS2_BW_FROM_SIG_A_BW_ ## bw ## MHZ != \
+                     RATE_MCS_CHAN_WIDTH_##bw >> RATE_MCS_CHAN_WIDTH_POS); \
+        BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA6_TB_PPDU_BW_ ## bw ## MHZ != \
                     RATE_MCS_CHAN_WIDTH_##bw >> RATE_MCS_CHAN_WIDTH_POS)
-                CHECK_BW(20);
+        CHECK_BW(20);
-                CHECK_BW(40);
+        CHECK_BW(40);
-                CHECK_BW(80);
+        CHECK_BW(80);
-                CHECK_BW(160);
+        CHECK_BW(160);
+        if (he_mu)
                he_mu->flags2 |=
                        le16_encode_bits(FIELD_GET(RATE_MCS_CHAN_WIDTH_MSK,
                                                   rate_n_flags),
                                         IEEE80211_RADIOTAP_HE_MU_FLAGS2_BW_FROM_SIG_A_BW);
-        }
+        else if (he_type == RATE_MCS_HE_TYPE_TRIG)
+                he->data6 |=
+                        cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA6_TB_PPDU_BW_KNOWN) |
+                        le16_encode_bits(FIELD_GET(RATE_MCS_CHAN_WIDTH_MSK,
+                                                   rate_n_flags),
+                                         IEEE80211_RADIOTAP_HE_DATA6_TB_PPDU_BW);
 }
 static void iwl_mvm_decode_he_phy_data(struct iwl_mvm *mvm,
@@ -1037,16 +1074,16 @@ static void iwl_mvm_decode_he_phy_data(struct iwl_mvm *mvm,
                                         IEEE80211_RADIOTAP_HE_DATA1_SPTL_REUSE2_KNOWN |
                                         IEEE80211_RADIOTAP_HE_DATA1_SPTL_REUSE3_KNOWN |
                                         IEEE80211_RADIOTAP_HE_DATA1_SPTL_REUSE4_KNOWN);
-                he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d0,
+                he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d2,
                                                            IWL_RX_PHY_DATA2_HE_TB_EXT_SPTL_REUSE1),
                                              IEEE80211_RADIOTAP_HE_DATA4_TB_SPTL_REUSE1);
-                he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d0,
+                he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d2,
                                                            IWL_RX_PHY_DATA2_HE_TB_EXT_SPTL_REUSE2),
                                              IEEE80211_RADIOTAP_HE_DATA4_TB_SPTL_REUSE2);
-                he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d0,
+                he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d2,
                                                            IWL_RX_PHY_DATA2_HE_TB_EXT_SPTL_REUSE3),
                                              IEEE80211_RADIOTAP_HE_DATA4_TB_SPTL_REUSE3);
-                he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d0,
+                he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d2,
                                                            IWL_RX_PHY_DATA2_HE_TB_EXT_SPTL_REUSE4),
                                              IEEE80211_RADIOTAP_HE_DATA4_TB_SPTL_REUSE4);
                /* fall through */
@@ -1056,7 +1093,6 @@ static void iwl_mvm_decode_he_phy_data(struct iwl_mvm *mvm,
        case IWL_RX_PHY_INFO_TYPE_HE_TB:
                /* HE common */
                he->data1 |= cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA1_LDPC_XSYMSEG_KNOWN |
-                                         IEEE80211_RADIOTAP_HE_DATA1_SPTL_REUSE_KNOWN |
                                         IEEE80211_RADIOTAP_HE_DATA1_DOPPLER_KNOWN |
                                         IEEE80211_RADIOTAP_HE_DATA1_BSS_COLOR_KNOWN);
                he->data2 |= cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA2_PRE_FEC_PAD_KNOWN |
@@ -1076,9 +1112,6 @@ static void iwl_mvm_decode_he_phy_data(struct iwl_mvm *mvm,
                he->data3 |= le16_encode_bits(le32_get_bits(phy_data->d0,
                                                            IWL_RX_PHY_DATA0_HE_LDPC_EXT_SYM),
                                              IEEE80211_RADIOTAP_HE_DATA3_LDPC_XSYMSEG);
-                he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d0,
-                                                            IWL_RX_PHY_DATA0_HE_SPATIAL_REUSE_MASK),
-                                              IEEE80211_RADIOTAP_HE_DATA4_SU_MU_SPTL_REUSE);
                he->data5 |= le16_encode_bits(le32_get_bits(phy_data->d0,
                                                            IWL_RX_PHY_DATA0_HE_PRE_FEC_PAD_MASK),
                                              IEEE80211_RADIOTAP_HE_DATA5_PRE_FEC_PAD);
@@ -1099,6 +1132,20 @@ static void iwl_mvm_decode_he_phy_data(struct iwl_mvm *mvm,
        switch (phy_data->info_type) {
        case IWL_RX_PHY_INFO_TYPE_HE_MU_EXT:
+        case IWL_RX_PHY_INFO_TYPE_HE_MU:
+        case IWL_RX_PHY_INFO_TYPE_HE_SU:
+                he->data1 |= cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA1_SPTL_REUSE_KNOWN);
+                he->data4 |= le16_encode_bits(le32_get_bits(phy_data->d0,
+                                                            IWL_RX_PHY_DATA0_HE_SPATIAL_REUSE_MASK),
+                                              IEEE80211_RADIOTAP_HE_DATA4_SU_MU_SPTL_REUSE);
+                break;
+        default:
+                /* nothing here */
+                break;
+        }
+        switch (phy_data->info_type) {
+        case IWL_RX_PHY_INFO_TYPE_HE_MU_EXT:
                he_mu->flags1 |=
                        le16_encode_bits(le16_get_bits(phy_data->d4,
                                                       IWL_RX_PHY_DATA4_HE_MU_EXT_SIGB_DCM),
@@ -1165,22 +1212,16 @@ static void iwl_mvm_rx_he(struct iwl_mvm *mvm, struct sk_buff *skb,
                .flags2 = cpu_to_le16(IEEE80211_RADIOTAP_HE_MU_FLAGS2_PUNC_FROM_SIG_A_BW_KNOWN |
                                      IEEE80211_RADIOTAP_HE_MU_FLAGS2_BW_FROM_SIG_A_BW_KNOWN),
        };
-        unsigned int radiotap_len = 0;
        he = skb_put_data(skb, &known, sizeof(known));
-        radiotap_len += sizeof(known);
        rx_status->flag |= RX_FLAG_RADIOTAP_HE;
        if (phy_data->info_type == IWL_RX_PHY_INFO_TYPE_HE_MU ||
            phy_data->info_type == IWL_RX_PHY_INFO_TYPE_HE_MU_EXT) {
                he_mu = skb_put_data(skb, &mu_known, sizeof(mu_known));
-                radiotap_len += sizeof(mu_known);
                rx_status->flag |= RX_FLAG_RADIOTAP_HE_MU;
        }
-        /* temporarily hide the radiotap data */
-        __skb_pull(skb, radiotap_len);
        /* report the AMPDU-EOF bit on single frames */
        if (!queue && !(phy_info & IWL_RX_MPDU_PHY_AMPDU)) {
                rx_status->flag |= RX_FLAG_AMPDU_DETAILS;
@@ -1766,7 +1807,7 @@ void iwl_mvm_rx_monitor_ndp(struct iwl_mvm *mvm, struct napi_struct *napi,
                rx_status->rate_idx = rate;
        }
-        iwl_mvm_pass_packet_to_mac80211(mvm, napi, skb, queue, sta, false);
+        ieee80211_rx_napi(mvm->hw, sta, skb, napi);
 out:
        rcu_read_unlock();
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
index 86d598d5b68f..78694bc38e76 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
@@ -8,7 +8,7 @@
 * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
 * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -1580,6 +1580,11 @@ static int iwl_mvm_check_running_scans(struct iwl_mvm *mvm, int type)
         * scheduled scan before starting a normal scan.
         */
+        /* FW supports only a single periodic scan */
+        if ((type == IWL_MVM_SCAN_SCHED || type == IWL_MVM_SCAN_NETDETECT) &&
+            mvm->scan_status & (IWL_MVM_SCAN_SCHED | IWL_MVM_SCAN_NETDETECT))
+                return -EBUSY;
        if (iwl_mvm_num_scans(mvm) < mvm->max_scans)
                return 0;
@@ -1616,10 +1621,10 @@ static int iwl_mvm_check_running_scans(struct iwl_mvm *mvm, int type)
                if (mvm->scan_status & IWL_MVM_SCAN_SCHED_MASK)
                        return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED,
                                                 true);
+                /* Something is wrong if no scan was running but we
-                /* fall through, something is wrong if no scan was
+                 * ran out of scans.
-                 * running but we ran out of scans.
                 */
+                /* fall through */
        default:
                WARN_ON(1);
                break;
@@ -1976,9 +1981,8 @@ static int iwl_mvm_scan_stop_wait(struct iwl_mvm *mvm, int type)
                return ret;
        }
-        ret = iwl_wait_notification(&mvm->notif_wait, &wait_scan_done, 1 * HZ);
+        return iwl_wait_notification(&mvm->notif_wait, &wait_scan_done,
+                                     1 * HZ);
-        return ret;
 }
 int iwl_mvm_scan_size(struct iwl_mvm *mvm)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index c5a01470a3bc..498c315291cf 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -314,7 +314,6 @@ static int iwl_mvm_invalidate_sta_queue(struct iwl_mvm *mvm, int queue,
        struct iwl_mvm_sta *mvmsta;
        u32 status;
        u8 sta_id;
-        int ret;
        if (WARN_ON(iwl_mvm_has_new_tx_api(mvm)))
                return -EINVAL;
@@ -349,11 +348,9 @@ static int iwl_mvm_invalidate_sta_queue(struct iwl_mvm *mvm, int queue,
        /* Notify FW of queue removal from the STA queues */
        status = ADD_STA_SUCCESS;
-        ret = iwl_mvm_send_cmd_pdu_status(mvm, ADD_STA,
+        return iwl_mvm_send_cmd_pdu_status(mvm, ADD_STA,
-                                          iwl_mvm_add_sta_cmd_size(mvm),
+                                           iwl_mvm_add_sta_cmd_size(mvm),
-                                          &cmd, &status);
+                                           &cmd, &status);
-        return ret;
 }
 static int iwl_mvm_disable_txq(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
@@ -753,7 +750,8 @@ static int iwl_mvm_tvqm_enable_txq(struct iwl_mvm *mvm,
        if (tid == IWL_MAX_TID_COUNT) {
                tid = IWL_MGMT_TID;
-                size = IWL_MGMT_QUEUE_SIZE;
+                size = max_t(u32, IWL_MGMT_QUEUE_SIZE,
+                             mvm->trans->cfg->min_txq_size);
        }
        queue = iwl_trans_txq_alloc(mvm->trans,
                                    cpu_to_le16(TX_QUEUE_CFG_ENABLE_QUEUE),
@@ -794,11 +792,9 @@ static int iwl_mvm_sta_alloc_queue_tvqm(struct iwl_mvm *mvm,
        if (queue < 0)
                return queue;
-        if (sta) {
+        mvmtxq->txq_id = queue;
-                mvmtxq->txq_id = queue;
+        mvm->tvqm_info[queue].txq_tid = tid;
-                mvm->tvqm_info[queue].txq_tid = tid;
+        mvm->tvqm_info[queue].sta_id = mvmsta->sta_id;
-                mvm->tvqm_info[queue].sta_id = mvmsta->sta_id;
-        }
        IWL_DEBUG_TX_QUEUES(mvm, "Allocated queue is %d\n", queue);
@@ -2340,11 +2336,13 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
        if (mvmvif->ap_wep_key) {
                u8 key_offset = iwl_mvm_set_fw_key_idx(mvm);
+                __set_bit(key_offset, mvm->fw_key_table);
                if (key_offset == STA_KEY_IDX_INVALID)
                        return -ENOSPC;
                ret = iwl_mvm_send_sta_key(mvm, mvmvif->mcast_sta.sta_id,
-                                           mvmvif->ap_wep_key, 1, 0, NULL, 0,
+                                           mvmvif->ap_wep_key, true, 0, NULL, 0,
                                           key_offset, 0);
                if (ret)
                        return ret;
@@ -2353,6 +2351,59 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
        return 0;
 }
+static int __iwl_mvm_remove_sta_key(struct iwl_mvm *mvm, u8 sta_id,
+                                    struct ieee80211_key_conf *keyconf,
+                                    bool mcast)
+{
+        union {
+                struct iwl_mvm_add_sta_key_cmd_v1 cmd_v1;
+                struct iwl_mvm_add_sta_key_cmd cmd;
+        } u = {};
+        bool new_api = fw_has_api(&mvm->fw->ucode_capa,
+                                  IWL_UCODE_TLV_API_TKIP_MIC_KEYS);
+        __le16 key_flags;
+        int ret, size;
+        u32 status;
+        /* This is a valid situation for GTK removal */
+        if (sta_id == IWL_MVM_INVALID_STA)
+                return 0;
+        key_flags = cpu_to_le16((keyconf->keyidx << STA_KEY_FLG_KEYID_POS) &
+                                 STA_KEY_FLG_KEYID_MSK);
+        key_flags |= cpu_to_le16(STA_KEY_FLG_NO_ENC | STA_KEY_FLG_WEP_KEY_MAP);
+        key_flags |= cpu_to_le16(STA_KEY_NOT_VALID);
+        if (mcast)
+                key_flags |= cpu_to_le16(STA_KEY_MULTICAST);
+        /*
+         * The fields assigned here are in the same location at the start
+         * of the command, so we can do this union trick.
+         */
+        u.cmd.common.key_flags = key_flags;
+        u.cmd.common.key_offset = keyconf->hw_key_idx;
+        u.cmd.common.sta_id = sta_id;
+        size = new_api ? sizeof(u.cmd) : sizeof(u.cmd_v1);
+        status = ADD_STA_SUCCESS;
+        ret = iwl_mvm_send_cmd_pdu_status(mvm, ADD_STA_KEY, size, &u.cmd,
+                                          &status);
+        switch (status) {
+        case ADD_STA_SUCCESS:
+                IWL_DEBUG_WEP(mvm, "MODIFY_STA: remove sta key passed\n");
+                break;
+        default:
+                ret = -EIO;
+                IWL_ERR(mvm, "MODIFY_STA: remove sta key failed\n");
+                break;
+        }
+        return ret;
+}
 /*
 * Send the FW a request to remove the station from it's internal data
 * structures, and in addition remove it from the local data structure.
@@ -2368,6 +2419,28 @@ int iwl_mvm_rm_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
        iwl_mvm_disable_txq(mvm, NULL, mvmvif->cab_queue, 0, 0);
+        if (mvmvif->ap_wep_key) {
+                int i;
+                if (!__test_and_clear_bit(mvmvif->ap_wep_key->hw_key_idx,
+                                          mvm->fw_key_table)) {
+                        IWL_ERR(mvm, "offset %d not used in fw key table.\n",
+                                mvmvif->ap_wep_key->hw_key_idx);
+                        return -ENOENT;
+                }
+                /* track which key was deleted last */
+                for (i = 0; i < STA_KEY_MAX_NUM; i++) {
+                        if (mvm->fw_key_deleted[i] < U8_MAX)
+                                mvm->fw_key_deleted[i]++;
+                }
+                mvm->fw_key_deleted[mvmvif->ap_wep_key->hw_key_idx] = 0;
+                ret = __iwl_mvm_remove_sta_key(mvm, mvmvif->mcast_sta.sta_id,
+                                               mvmvif->ap_wep_key, true);
+                if (ret)
+                        return ret;
+        }
        ret = iwl_mvm_rm_sta_common(mvm, mvmvif->mcast_sta.sta_id);
        if (ret)
                IWL_WARN(mvm, "Failed sending remove station\n");
@@ -3399,59 +3472,6 @@ static int __iwl_mvm_set_sta_key(struct iwl_mvm *mvm,
        return ret;
 }
-static int __iwl_mvm_remove_sta_key(struct iwl_mvm *mvm, u8 sta_id,
-                                    struct ieee80211_key_conf *keyconf,
-                                    bool mcast)
-{
-        union {
-                struct iwl_mvm_add_sta_key_cmd_v1 cmd_v1;
-                struct iwl_mvm_add_sta_key_cmd cmd;
-        } u = {};
-        bool new_api = fw_has_api(&mvm->fw->ucode_capa,
-                                  IWL_UCODE_TLV_API_TKIP_MIC_KEYS);
-        __le16 key_flags;
-        int ret, size;
-        u32 status;
-        /* This is a valid situation for GTK removal */
-        if (sta_id == IWL_MVM_INVALID_STA)
-                return 0;
-        key_flags = cpu_to_le16((keyconf->keyidx << STA_KEY_FLG_KEYID_POS) &
-                                 STA_KEY_FLG_KEYID_MSK);
-        key_flags |= cpu_to_le16(STA_KEY_FLG_NO_ENC | STA_KEY_FLG_WEP_KEY_MAP);
-        key_flags |= cpu_to_le16(STA_KEY_NOT_VALID);
-        if (mcast)
-                key_flags |= cpu_to_le16(STA_KEY_MULTICAST);
-        /*
-         * The fields assigned here are in the same location at the start
-         * of the command, so we can do this union trick.
-         */
-        u.cmd.common.key_flags = key_flags;
-        u.cmd.common.key_offset = keyconf->hw_key_idx;
-        u.cmd.common.sta_id = sta_id;
-        size = new_api ? sizeof(u.cmd) : sizeof(u.cmd_v1);
-        status = ADD_STA_SUCCESS;
-        ret = iwl_mvm_send_cmd_pdu_status(mvm, ADD_STA_KEY, size, &u.cmd,
-                                          &status);
-        switch (status) {
-        case ADD_STA_SUCCESS:
-                IWL_DEBUG_WEP(mvm, "MODIFY_STA: remove sta key passed\n");
-                break;
-        default:
-                ret = -EIO;
-                IWL_ERR(mvm, "MODIFY_STA: remove sta key failed\n");
-                break;
-        }
-        return ret;
-}
 int iwl_mvm_set_sta_key(struct iwl_mvm *mvm,
                        struct ieee80211_vif *vif,
                        struct ieee80211_sta *sta,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
index 0614296244b3..79700c7310a1 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
@@ -394,6 +394,7 @@ struct iwl_mvm_rxq_dup_data {
 *      the BA window. To be used for UAPSD only.
 * @ptk_pn: per-queue PTK PN data structures
 * @dup_data: per queue duplicate packet detection data
+ * @wep_key: used in AP mode. Is a duplicate of the WEP key.
 * @deferred_traffic_tid_map: indication bitmap of deferred traffic per-TID
 * @tx_ant: the index of the antenna to use for data tx to this station. Only
 *      used during connection establishment (e.g. for the 4 way handshake
@@ -425,6 +426,8 @@ struct iwl_mvm_sta {
        struct iwl_mvm_key_pn __rcu *ptk_pn[4];
        struct iwl_mvm_rxq_dup_data *dup_data;
+        struct ieee80211_key_conf *wep_key;
        u8 reserved_queue;
        /* Temporary, until the new TLC will control the Tx protection */
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
index 5b34100e9099..9693fa4cdc39 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
@@ -85,7 +85,7 @@ void iwl_mvm_te_clear_data(struct iwl_mvm *mvm,
 {
        lockdep_assert_held(&mvm->time_event_lock);
-        if (!te_data->vif)
+        if (!te_data || !te_data->vif)
                return;
        list_del(&te_data->list);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index ac62eb8c4b36..0c2aabc842f9 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -8,7 +8,7 @@
 * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
 * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -209,7 +209,9 @@ void iwl_mvm_set_tx_cmd(struct iwl_mvm *mvm, struct sk_buff *skb,
        u16 offload_assist = 0;
        u8 ac;
-        if (!(info->flags & IEEE80211_TX_CTL_NO_ACK))
+        if (!(info->flags & IEEE80211_TX_CTL_NO_ACK) ||
+            (ieee80211_is_probe_resp(fc) &&
+             !is_multicast_ether_addr(hdr->addr1)))
                tx_flags |= TX_CMD_FLG_ACK;
        else
                tx_flags &= ~TX_CMD_FLG_ACK;
@@ -278,7 +280,7 @@ void iwl_mvm_set_tx_cmd(struct iwl_mvm *mvm, struct sk_buff *skb,
        }
        if (ieee80211_is_data(fc) && len > mvm->rts_threshold &&
-            !is_multicast_ether_addr(ieee80211_get_DA(hdr)))
+            !is_multicast_ether_addr(hdr->addr1))
                tx_flags |= TX_CMD_FLG_PROT_REQUIRE;
        if (fw_has_capa(&mvm->fw->ucode_capa,
@@ -719,6 +721,9 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
                IEEE80211_TX_CTL_TX_OFFCHAN;
        int queue = -1;
+        if (IWL_MVM_NON_TRANSMITTING_AP && ieee80211_is_probe_resp(fc))
+                return -1;
        memcpy(&info, skb->cb, sizeof(info));
        if (WARN_ON_ONCE(info.flags & IEEE80211_TX_CTL_AMPDU))
@@ -1078,6 +1083,9 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb,
        fc = hdr->frame_control;
        hdrlen = ieee80211_hdrlen(fc);
+        if (IWL_MVM_NON_TRANSMITTING_AP && ieee80211_is_probe_resp(fc))
+                return -1;
        if (WARN_ON_ONCE(!mvmsta))
                return -1;
@@ -1107,12 +1115,14 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb,
         */
        if (ieee80211_is_data_qos(fc) && !ieee80211_is_qos_nullfunc(fc)) {
                tid = ieee80211_get_tid(hdr);
-                if (WARN_ON_ONCE(tid >= IWL_MAX_TID_COUNT))
+                if (WARN_ONCE(tid >= IWL_MAX_TID_COUNT, "Invalid TID %d", tid))
                        goto drop_unlock_sta;
                is_ampdu = info->flags & IEEE80211_TX_CTL_AMPDU;
-                if (WARN_ON_ONCE(is_ampdu &&
+                if (WARN_ONCE(is_ampdu &&
-                                 mvmsta->tid_data[tid].state != IWL_AGG_ON))
+                              mvmsta->tid_data[tid].state != IWL_AGG_ON,
+                              "Invalid internal agg state %d for TID %d",
+                               mvmsta->tid_data[tid].state, tid))
                        goto drop_unlock_sta;
                seq_number = mvmsta->tid_data[tid].seq_number;
@@ -1134,7 +1144,7 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb,
        WARN_ON_ONCE(info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM);
-        if (WARN_ON_ONCE(txq_id == IWL_MVM_INVALID_QUEUE)) {
+        if (WARN_ONCE(txq_id == IWL_MVM_INVALID_QUEUE, "Invalid TXQ id")) {
                iwl_trans_free_tx_cmd(mvm->trans, dev_cmd);
                spin_unlock(&mvmsta->lock);
                return 0;
@@ -1184,6 +1194,7 @@ drop_unlock_sta:
        iwl_trans_free_tx_cmd(mvm->trans, dev_cmd);
        spin_unlock(&mvmsta->lock);
 drop:
+        IWL_DEBUG_TX(mvm, "TX to [%d|%d] dropped\n", mvmsta->sta_id, tid);
        return -1;
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
index 211c4638d690..4649327abb45 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
@@ -294,6 +294,7 @@ static const struct {
        { "SYSASSERT", 0x35 },
        { "UCODE_VERSION_MISMATCH", 0x37 },
        { "BAD_COMMAND", 0x38 },
+        { "BAD_COMMAND", 0x39 },
        { "NMI_INTERRUPT_DATA_ACTION_PT", 0x3C },
        { "FATAL_ERROR", 0x3D },
        { "NMI_TRM_HW_ERR", 0x46 },
@@ -456,12 +457,14 @@ static void iwl_mvm_dump_umac_error_log(struct iwl_mvm *mvm)
 {
        struct iwl_trans *trans = mvm->trans;
        struct iwl_umac_error_event_table table;
+        u32 base = mvm->trans->umac_error_event_table;
-        if (!mvm->support_umac_log)
+        if (!mvm->support_umac_log &&
+            !(mvm->trans->error_event_table_tlv_status &
+              IWL_ERROR_EVENT_TABLE_UMAC))
                return;
-        iwl_trans_read_mem_bytes(trans, mvm->umac_error_event_table, &table,
+        iwl_trans_read_mem_bytes(trans, base, &table, sizeof(table));
-                                 sizeof(table));
        if (table.valid)
                mvm->fwrt.dump.umac_err_id = table.error_id;
@@ -493,7 +496,7 @@ static void iwl_mvm_dump_lmac_error_log(struct iwl_mvm *mvm, u8 lmac_num)
 {
        struct iwl_trans *trans = mvm->trans;
        struct iwl_error_event_table table;
-        u32 val, base = mvm->error_event_table[lmac_num];
+        u32 val, base = mvm->trans->lmac_error_event_table[lmac_num];
        if (mvm->fwrt.cur_fw_img == IWL_UCODE_INIT) {
                if (!base)
@@ -522,23 +525,9 @@ static void iwl_mvm_dump_lmac_error_log(struct iwl_mvm *mvm, u8 lmac_num)
                /* reset the device */
                iwl_trans_sw_reset(trans);
-                /* set INIT_DONE flag */
+                err = iwl_finish_nic_init(trans);
-                iwl_set_bit(trans, CSR_GP_CNTRL,
+                if (err)
-                            BIT(trans->cfg->csr->flag_init_done));
-                /* and wait for clock stabilization */
-                if (trans->cfg->device_family == IWL_DEVICE_FAMILY_8000)
-                        udelay(2);
-                err = iwl_poll_bit(trans, CSR_GP_CNTRL,
-                                   BIT(trans->cfg->csr->flag_mac_clock_ready),
-                                   BIT(trans->cfg->csr->flag_mac_clock_ready),
-                                   25000);
-                if (err < 0) {
-                        IWL_DEBUG_INFO(trans,
-                                       "Failed to reset the card for the dump\n");
                        return;
-                }
        }
        iwl_trans_read_mem_bytes(trans, base, &table, sizeof(table));
@@ -603,7 +592,7 @@ void iwl_mvm_dump_nic_error_log(struct iwl_mvm *mvm)
        iwl_mvm_dump_lmac_error_log(mvm, 0);
-        if (mvm->error_event_table[1])
+        if (mvm->trans->lmac_error_event_table[1])
                iwl_mvm_dump_lmac_error_log(mvm, 1);
        iwl_mvm_dump_umac_error_log(mvm);
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
index ceb3aa03d561..1e36459948db 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
@@ -5,7 +5,7 @@
 *
 * GPL LICENSE SUMMARY
 *
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -18,7 +18,7 @@
 *
 * BSD LICENSE
 *
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -66,6 +66,7 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans,
        void *iml_img;
        u32 control_flags = 0;
        int ret;
+        int cmdq_size = max_t(u32, TFD_CMD_SLOTS, trans->cfg->min_txq_size);
        /* Allocate prph scratch */
        prph_scratch = dma_alloc_coherent(trans->dev, sizeof(*prph_scratch),
@@ -151,7 +152,7 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans,
        ctxt_info_gen3->mcr_base_addr =
                cpu_to_le64(trans_pcie->rxq->used_bd_dma);
        ctxt_info_gen3->mtr_size =
-                cpu_to_le16(TFD_QUEUE_CB_SIZE(TFD_CMD_SLOTS));
+                cpu_to_le16(TFD_QUEUE_CB_SIZE(cmdq_size));
        ctxt_info_gen3->mcr_size =
                cpu_to_le16(RX_QUEUE_CB_SIZE(MQ_RX_TABLE_SIZE));
@@ -175,8 +176,13 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans,
        iwl_write64(trans, CSR_IML_DATA_ADDR,
                    trans_pcie->iml_dma_addr);
        iwl_write32(trans, CSR_IML_SIZE_ADDR, trans->iml_len);
-        iwl_set_bit(trans, CSR_CTXT_INFO_BOOT_CTRL, CSR_AUTO_FUNC_BOOT_ENA);
-        iwl_set_bit(trans, CSR_GP_CNTRL, CSR_AUTO_FUNC_INIT);
+        iwl_set_bit(trans, CSR_CTXT_INFO_BOOT_CTRL,
+                    CSR_AUTO_FUNC_BOOT_ENA);
+        if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_AX210)
+                iwl_write_umac_prph(trans, UREG_CPU_INIT_RUN, 1);
+        else
+                iwl_set_bit(trans, CSR_GP_CNTRL, CSR_AUTO_FUNC_INIT);
        return 0;
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c
index 7f4aaa810ea1..9274e317cc77 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c
@@ -59,8 +59,7 @@
 void iwl_pcie_ctxt_info_free_paging(struct iwl_trans *trans)
 {
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        struct iwl_self_init_dram *dram = &trans->init_dram;
-        struct iwl_self_init_dram *dram = &trans_pcie->init_dram;
        int i;
        if (!dram->paging) {
@@ -83,8 +82,7 @@ int iwl_pcie_init_fw_sec(struct iwl_trans *trans,
                         const struct fw_img *fw,
                         struct iwl_context_info_dram *ctxt_dram)
 {
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        struct iwl_self_init_dram *dram = &trans->init_dram;
-        struct iwl_self_init_dram *dram = &trans_pcie->init_dram;
        int i, ret, lmac_cnt, umac_cnt, paging_cnt;
        if (WARN(dram->paging,
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index a22e47639a4e..2b94e4cef56c 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -8,7 +8,7 @@
 * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016-2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -32,7 +32,7 @@
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * All rights reserved.
 * Copyright(c) 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
@@ -517,6 +517,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
        {IWL_PCI_DEVICE(0x02F0, 0x0034, iwl9560_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x02F0, 0x0038, iwl9560_2ac_160_cfg_soc)},
        {IWL_PCI_DEVICE(0x02F0, 0x003C, iwl9560_2ac_160_cfg_soc)},
+        {IWL_PCI_DEVICE(0x02F0, 0x0040, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0x02F0, 0x0044, iwl_ax101_cfg_qu_hr)},
        {IWL_PCI_DEVICE(0x02F0, 0x0060, iwl9461_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x02F0, 0x0064, iwl9461_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x02F0, 0x00A0, iwl9462_2ac_cfg_soc)},
@@ -525,6 +527,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
        {IWL_PCI_DEVICE(0x02F0, 0x0234, iwl9560_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x02F0, 0x0238, iwl9560_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x02F0, 0x023C, iwl9560_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x02F0, 0x0244, iwl_ax101_cfg_qu_hr)},
        {IWL_PCI_DEVICE(0x02F0, 0x0260, iwl9461_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x02F0, 0x0264, iwl9461_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x02F0, 0x02A0, iwl9462_2ac_cfg_soc)},
@@ -542,6 +545,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
        {IWL_PCI_DEVICE(0x06F0, 0x0034, iwl9560_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x06F0, 0x0038, iwl9560_2ac_160_cfg_soc)},
        {IWL_PCI_DEVICE(0x06F0, 0x003C, iwl9560_2ac_160_cfg_soc)},
+        {IWL_PCI_DEVICE(0x06F0, 0x0040, iwl_ax101_cfg_qu_hr)},
+        {IWL_PCI_DEVICE(0x06F0, 0x0044, iwl_ax101_cfg_qu_hr)},
        {IWL_PCI_DEVICE(0x06F0, 0x0060, iwl9461_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x06F0, 0x0064, iwl9461_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x06F0, 0x00A0, iwl9462_2ac_cfg_soc)},
@@ -550,6 +555,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
        {IWL_PCI_DEVICE(0x06F0, 0x0234, iwl9560_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x06F0, 0x0238, iwl9560_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x06F0, 0x023C, iwl9560_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x06F0, 0x0244, iwl_ax101_cfg_qu_hr)},
        {IWL_PCI_DEVICE(0x06F0, 0x0260, iwl9461_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x06F0, 0x0264, iwl9461_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x06F0, 0x02A0, iwl9462_2ac_cfg_soc)},
@@ -597,6 +603,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
        {IWL_PCI_DEVICE(0x2526, 0x2030, iwl9560_2ac_160_cfg_soc)},
        {IWL_PCI_DEVICE(0x2526, 0x2034, iwl9560_2ac_160_cfg_soc)},
        {IWL_PCI_DEVICE(0x2526, 0x4010, iwl9260_2ac_160_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x4018, iwl9260_2ac_160_cfg)},
        {IWL_PCI_DEVICE(0x2526, 0x401C, iwl9260_2ac_160_cfg)},
        {IWL_PCI_DEVICE(0x2526, 0x4030, iwl9560_2ac_160_cfg)},
        {IWL_PCI_DEVICE(0x2526, 0x4034, iwl9560_2ac_160_cfg_soc)},
@@ -614,6 +621,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
        {IWL_PCI_DEVICE(0x2720, 0x0034, iwl9560_2ac_160_cfg)},
        {IWL_PCI_DEVICE(0x2720, 0x0038, iwl9560_2ac_160_cfg)},
        {IWL_PCI_DEVICE(0x2720, 0x003C, iwl9560_2ac_160_cfg)},
+        {IWL_PCI_DEVICE(0x2720, 0x0044, iwl_ax101_cfg_qu_hr)},
        {IWL_PCI_DEVICE(0x2720, 0x0060, iwl9461_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x2720, 0x0064, iwl9461_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x2720, 0x00A0, iwl9462_2ac_cfg_soc)},
@@ -622,6 +630,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
        {IWL_PCI_DEVICE(0x2720, 0x0234, iwl9560_2ac_cfg)},
        {IWL_PCI_DEVICE(0x2720, 0x0238, iwl9560_2ac_cfg)},
        {IWL_PCI_DEVICE(0x2720, 0x023C, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2720, 0x0244, iwl_ax101_cfg_qu_hr)},
        {IWL_PCI_DEVICE(0x2720, 0x0260, iwl9461_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x2720, 0x0264, iwl9461_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x2720, 0x02A0, iwl9462_2ac_cfg_soc)},
@@ -699,6 +708,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
        {IWL_PCI_DEVICE(0x34F0, 0x0034, iwl9560_2ac_cfg_qu_b0_jf_b0)},
        {IWL_PCI_DEVICE(0x34F0, 0x0038, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
        {IWL_PCI_DEVICE(0x34F0, 0x003C, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x34F0, 0x0044, iwl_ax101_cfg_qu_hr)},
        {IWL_PCI_DEVICE(0x34F0, 0x0060, iwl9461_2ac_cfg_qu_b0_jf_b0)},
        {IWL_PCI_DEVICE(0x34F0, 0x0064, iwl9461_2ac_cfg_qu_b0_jf_b0)},
        {IWL_PCI_DEVICE(0x34F0, 0x00A0, iwl9462_2ac_cfg_qu_b0_jf_b0)},
@@ -707,6 +717,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
        {IWL_PCI_DEVICE(0x34F0, 0x0234, iwl9560_2ac_cfg_qu_b0_jf_b0)},
        {IWL_PCI_DEVICE(0x34F0, 0x0238, iwl9560_2ac_cfg_qu_b0_jf_b0)},
        {IWL_PCI_DEVICE(0x34F0, 0x023C, iwl9560_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x34F0, 0x0244, iwl_ax101_cfg_qu_hr)},
        {IWL_PCI_DEVICE(0x34F0, 0x0260, iwl9461_2ac_cfg_qu_b0_jf_b0)},
        {IWL_PCI_DEVICE(0x34F0, 0x0264, iwl9461_2ac_cfg_qu_b0_jf_b0)},
        {IWL_PCI_DEVICE(0x34F0, 0x02A0, iwl9462_2ac_cfg_qu_b0_jf_b0)},
@@ -753,6 +764,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
        {IWL_PCI_DEVICE(0x43F0, 0x0034, iwl9560_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x43F0, 0x0038, iwl9560_2ac_160_cfg_soc)},
        {IWL_PCI_DEVICE(0x43F0, 0x003C, iwl9560_2ac_160_cfg_soc)},
+        {IWL_PCI_DEVICE(0x43F0, 0x0044, iwl_ax101_cfg_qu_hr)},
        {IWL_PCI_DEVICE(0x43F0, 0x0060, iwl9461_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x43F0, 0x0064, iwl9461_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x43F0, 0x00A0, iwl9462_2ac_cfg_soc)},
@@ -761,6 +773,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
        {IWL_PCI_DEVICE(0x43F0, 0x0234, iwl9560_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x43F0, 0x0238, iwl9560_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x43F0, 0x023C, iwl9560_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x43F0, 0x0244, iwl_ax101_cfg_qu_hr)},
        {IWL_PCI_DEVICE(0x43F0, 0x0260, iwl9461_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x43F0, 0x0264, iwl9461_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x43F0, 0x02A0, iwl9462_2ac_cfg_soc)},
@@ -820,6 +833,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
        {IWL_PCI_DEVICE(0xA0F0, 0x0034, iwl9560_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0xA0F0, 0x0038, iwl9560_2ac_160_cfg_soc)},
        {IWL_PCI_DEVICE(0xA0F0, 0x003C, iwl9560_2ac_160_cfg_soc)},
+        {IWL_PCI_DEVICE(0xA0F0, 0x0044, iwl_ax101_cfg_qu_hr)},
        {IWL_PCI_DEVICE(0xA0F0, 0x0060, iwl9461_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0xA0F0, 0x0064, iwl9461_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0xA0F0, 0x00A0, iwl9462_2ac_cfg_soc)},
@@ -828,6 +842,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
        {IWL_PCI_DEVICE(0xA0F0, 0x0234, iwl9560_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0xA0F0, 0x0238, iwl9560_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0xA0F0, 0x023C, iwl9560_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0xA0F0, 0x0244, iwl_ax101_cfg_qu_hr)},
        {IWL_PCI_DEVICE(0xA0F0, 0x0260, iwl9461_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0xA0F0, 0x0264, iwl9461_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0xA0F0, 0x02A0, iwl9462_2ac_cfg_soc)},
@@ -872,82 +887,92 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
        {IWL_PCI_DEVICE(0xA370, 0x40A4, iwl9462_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0xA370, 0x4234, iwl9560_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0xA370, 0x42A4, iwl9462_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2720, 0x0030, iwl9560_2ac_cfg_qnj_jf_b0)},
 /* 22000 Series */
-        {IWL_PCI_DEVICE(0x02F0, 0x0070, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x02F0, 0x0070, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0x02F0, 0x0074, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x02F0, 0x0074, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0x02F0, 0x0078, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x02F0, 0x0078, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0x02F0, 0x007C, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x02F0, 0x007C, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0x02F0, 0x0310, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x02F0, 0x0310, iwl_ax101_cfg_qu_hr)},
        {IWL_PCI_DEVICE(0x02F0, 0x1651, killer1650s_2ax_cfg_qu_b0_hr_b0)},
        {IWL_PCI_DEVICE(0x02F0, 0x1652, killer1650i_2ax_cfg_qu_b0_hr_b0)},
-        {IWL_PCI_DEVICE(0x02F0, 0x4070, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x02F0, 0x4070, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0x06F0, 0x0070, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x06F0, 0x0070, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0x06F0, 0x0074, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x06F0, 0x0074, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0x06F0, 0x0078, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x06F0, 0x0078, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0x06F0, 0x007C, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x06F0, 0x007C, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0x06F0, 0x0310, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x06F0, 0x0310, iwl_ax101_cfg_qu_hr)},
        {IWL_PCI_DEVICE(0x06F0, 0x1651, killer1650s_2ax_cfg_qu_b0_hr_b0)},
        {IWL_PCI_DEVICE(0x06F0, 0x1652, killer1650i_2ax_cfg_qu_b0_hr_b0)},
-        {IWL_PCI_DEVICE(0x06F0, 0x4070, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x06F0, 0x4070, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0x2720, 0x0000, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x2720, 0x0000, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0x2720, 0x0030, iwl9560_2ac_160_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2720, 0x0040, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0x2720, 0x0040, iwl22560_2ax_cfg_hr)},
        {IWL_PCI_DEVICE(0x2720, 0x0070, iwl22000_2ac_cfg_hr_cdb)},
-        {IWL_PCI_DEVICE(0x2720, 0x0074, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x2720, 0x0074, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0x2720, 0x0078, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x2720, 0x0078, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0x2720, 0x007C, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x2720, 0x007C, iwl_ax101_cfg_qu_hr)},
        {IWL_PCI_DEVICE(0x2720, 0x0090, iwl22000_2ac_cfg_hr_cdb)},
        {IWL_PCI_DEVICE(0x2720, 0x0310, iwl22000_2ac_cfg_hr_cdb)},
        {IWL_PCI_DEVICE(0x2720, 0x0A10, iwl22000_2ac_cfg_hr_cdb)},
-        {IWL_PCI_DEVICE(0x2720, 0x1080, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x2720, 0x1080, iwl_ax101_cfg_qu_hr)},
        {IWL_PCI_DEVICE(0x2720, 0x1651, killer1650s_2ax_cfg_qu_b0_hr_b0)},
        {IWL_PCI_DEVICE(0x2720, 0x1652, killer1650i_2ax_cfg_qu_b0_hr_b0)},
-        {IWL_PCI_DEVICE(0x2720, 0x4070, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x2720, 0x4070, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0x34F0, 0x0040, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x34F0, 0x0040, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0x34F0, 0x0070, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x34F0, 0x0070, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0x34F0, 0x0074, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x34F0, 0x0074, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0x34F0, 0x0078, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x34F0, 0x0078, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0x34F0, 0x007C, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x34F0, 0x007C, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0x34F0, 0x0310, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x34F0, 0x0310, iwl_ax101_cfg_qu_hr)},
        {IWL_PCI_DEVICE(0x34F0, 0x1651, killer1650s_2ax_cfg_qu_b0_hr_b0)},
        {IWL_PCI_DEVICE(0x34F0, 0x1652, killer1650i_2ax_cfg_qu_b0_hr_b0)},
-        {IWL_PCI_DEVICE(0x34F0, 0x4070, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x34F0, 0x4070, iwl_ax101_cfg_qu_hr)},
        {IWL_PCI_DEVICE(0x40C0, 0x0000, iwl22560_2ax_cfg_su_cdb)},
        {IWL_PCI_DEVICE(0x40C0, 0x0010, iwl22560_2ax_cfg_su_cdb)},
        {IWL_PCI_DEVICE(0x40c0, 0x0090, iwl22560_2ax_cfg_su_cdb)},
        {IWL_PCI_DEVICE(0x40C0, 0x0310, iwl22560_2ax_cfg_su_cdb)},
        {IWL_PCI_DEVICE(0x40C0, 0x0A10, iwl22560_2ax_cfg_su_cdb)},
-        {IWL_PCI_DEVICE(0x43F0, 0x0040, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x43F0, 0x0040, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0x43F0, 0x0070, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x43F0, 0x0070, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0x43F0, 0x0074, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x43F0, 0x0074, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0x43F0, 0x0078, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x43F0, 0x0078, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0x43F0, 0x007C, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x43F0, 0x007C, iwl_ax101_cfg_qu_hr)},
        {IWL_PCI_DEVICE(0x43F0, 0x1651, killer1650s_2ax_cfg_qu_b0_hr_b0)},
        {IWL_PCI_DEVICE(0x43F0, 0x1652, killer1650i_2ax_cfg_qu_b0_hr_b0)},
-        {IWL_PCI_DEVICE(0x43F0, 0x4070, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0x43F0, 0x4070, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0xA0F0, 0x0000, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0xA0F0, 0x0000, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0xA0F0, 0x0040, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0xA0F0, 0x0040, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0xA0F0, 0x0070, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0xA0F0, 0x0070, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0xA0F0, 0x0074, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0xA0F0, 0x0074, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0xA0F0, 0x0078, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0xA0F0, 0x0078, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0xA0F0, 0x007C, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0xA0F0, 0x007C, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0xA0F0, 0x00B0, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0xA0F0, 0x00B0, iwl_ax101_cfg_qu_hr)},
-        {IWL_PCI_DEVICE(0xA0F0, 0x0A10, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0xA0F0, 0x0A10, iwl_ax101_cfg_qu_hr)},
        {IWL_PCI_DEVICE(0xA0F0, 0x1651, killer1650s_2ax_cfg_qu_b0_hr_b0)},
        {IWL_PCI_DEVICE(0xA0F0, 0x1652, killer1650i_2ax_cfg_qu_b0_hr_b0)},
-        {IWL_PCI_DEVICE(0xA0F0, 0x4070, iwl22560_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0xA0F0, 0x4070, iwl_ax101_cfg_qu_hr)},
        {IWL_PCI_DEVICE(0x2723, 0x0080, iwl22260_2ax_cfg)},
        {IWL_PCI_DEVICE(0x2723, 0x0084, iwl22260_2ax_cfg)},
        {IWL_PCI_DEVICE(0x2723, 0x0088, iwl22260_2ax_cfg)},
        {IWL_PCI_DEVICE(0x2723, 0x008C, iwl22260_2ax_cfg)},
+        {IWL_PCI_DEVICE(0x2723, 0x1653, killer1650w_2ax_cfg)},
+        {IWL_PCI_DEVICE(0x2723, 0x1654, killer1650x_2ax_cfg)},
        {IWL_PCI_DEVICE(0x2723, 0x4080, iwl22260_2ax_cfg)},
        {IWL_PCI_DEVICE(0x2723, 0x4088, iwl22260_2ax_cfg)},
        {IWL_PCI_DEVICE(0x1a56, 0x1653, killer1650w_2ax_cfg)},
        {IWL_PCI_DEVICE(0x1a56, 0x1654, killer1650x_2ax_cfg)},
+        {IWL_PCI_DEVICE(0x2725, 0x0090, iwlax210_2ax_cfg_so_hr_a0)},
+        {IWL_PCI_DEVICE(0x7A70, 0x0090, iwlax210_2ax_cfg_so_hr_a0)},
+        {IWL_PCI_DEVICE(0x7A70, 0x0310, iwlax210_2ax_cfg_so_hr_a0)},
+        {IWL_PCI_DEVICE(0x2725, 0x0020, iwlax210_2ax_cfg_so_hr_a0)},
+        {IWL_PCI_DEVICE(0x2725, 0x0310, iwlax210_2ax_cfg_so_hr_a0)},
+        {IWL_PCI_DEVICE(0x2725, 0x0A10, iwlax210_2ax_cfg_so_hr_a0)},
+        {IWL_PCI_DEVICE(0x2725, 0x00B0, iwlax210_2ax_cfg_so_hr_a0)},
 #endif /* CONFIG_IWLMVM */
        {0}
@@ -999,7 +1024,7 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                if (rf_id_chp == jf_chp_id) {
                        if (iwl_trans->hw_rev == CSR_HW_REV_TYPE_QNJ)
-                                cfg = &iwl22000_2ax_cfg_qnj_jf_b0;
+                                cfg = &iwl9560_2ac_cfg_qnj_jf_b0;
                        else
                                cfg = &iwl22000_2ac_cfg_jf;
                } else if (rf_id_chp == hr_chp_id) {
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
index 0d16bcc3141f..bf8b61a476c5 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
@@ -8,7 +8,7 @@
 * Copyright(c) 2003 - 2015 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
 * Copyright(c) 2003 - 2015 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -400,6 +400,8 @@ struct iwl_txq {
        u32 id;
        int low_mark;
        int high_mark;
+        bool overflow_tx;
 };
 static inline dma_addr_t
@@ -454,20 +456,6 @@ enum iwl_image_response_code {
 };
 /**
- * struct iwl_self_init_dram - dram data used by self init process
- * @fw: lmac and umac dram data
- * @fw_cnt: total number of items in array
- * @paging: paging dram data
- * @paging_cnt: total number of items in array
- */
-struct iwl_self_init_dram {
-        struct iwl_dram_data *fw;
-        int fw_cnt;
-        struct iwl_dram_data *paging;
-        int paging_cnt;
-};
-/**
 * struct cont_rec: continuous recording data structure
 * @prev_wr_ptr: the last address that was read in monitor_data
 *      debugfs file
@@ -538,6 +526,8 @@ struct cont_rec {
 * @fh_mask: current unmasked fh causes
 * @hw_mask: current unmasked hw causes
 * @in_rescan: true if we have triggered a device rescan
+ * @base_rb_stts: base virtual address of receive buffer status for all queues
+ * @base_rb_stts_dma: base physical address of receive buffer status
 */
 struct iwl_trans_pcie {
        struct iwl_rxq *rxq;
@@ -554,7 +544,6 @@ struct iwl_trans_pcie {
        dma_addr_t prph_info_dma_addr;
        dma_addr_t prph_scratch_dma_addr;
        dma_addr_t iml_dma_addr;
-        struct iwl_self_init_dram init_dram;
        struct iwl_trans *trans;
        struct net_device napi_dev;
@@ -630,6 +619,9 @@ struct iwl_trans_pcie {
        cpumask_t affinity_mask[IWL_MAX_RX_HW_QUEUES];
        u16 tx_cmd_queue_size;
        bool in_rescan;
+        void *base_rb_stts;
+        dma_addr_t base_rb_stts_dma;
 };
 static inline struct iwl_trans_pcie *
@@ -813,8 +805,7 @@ static inline int iwl_pcie_ctxt_info_alloc_dma(struct iwl_trans *trans,
 static inline void iwl_pcie_ctxt_info_free_fw_img(struct iwl_trans *trans)
 {
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        struct iwl_self_init_dram *dram = &trans->init_dram;
-        struct iwl_self_init_dram *dram = &trans_pcie->init_dram;
        int i;
        if (!dram->fw) {
@@ -1052,6 +1043,7 @@ static inline bool iwl_pcie_dbg_on(struct iwl_trans *trans)
 void iwl_trans_pcie_rf_kill(struct iwl_trans *trans, bool state);
 void iwl_trans_pcie_dump_regs(struct iwl_trans *trans);
+void iwl_trans_sync_nmi(struct iwl_trans *trans);
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 int iwl_trans_pcie_dbgfs_register(struct iwl_trans *trans);
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
index c260d1251b5f..8d4f0628622b 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
@@ -8,7 +8,7 @@
 * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
 * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -202,9 +202,9 @@ int iwl_pcie_rx_stop(struct iwl_trans *trans)
 {
        if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_22560) {
                /* TODO: remove this for 22560 once fw does it */
-                iwl_write_prph(trans, RFH_RXF_DMA_CFG_GEN3, 0);
+                iwl_write_umac_prph(trans, RFH_RXF_DMA_CFG_GEN3, 0);
-                return iwl_poll_prph_bit(trans, RFH_GEN_STATUS_GEN3,
+                return iwl_poll_umac_prph_bit(trans, RFH_GEN_STATUS_GEN3,
-                                         RXF_DMA_IDLE, RXF_DMA_IDLE, 1000);
+                                              RXF_DMA_IDLE, RXF_DMA_IDLE, 1000);
        } else if (trans->cfg->mq_rx_supported) {
                iwl_write_prph(trans, RFH_RXF_DMA_CFG, 0);
                return iwl_poll_prph_bit(trans, RFH_GEN_STATUS,
@@ -247,7 +247,7 @@ static void iwl_pcie_rxq_inc_wr_ptr(struct iwl_trans *trans,
        }
        rxq->write_actual = round_down(rxq->write, 8);
-        if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_22560)
+        if (trans->cfg->device_family == IWL_DEVICE_FAMILY_22560)
                iwl_write32(trans, HBUS_TARG_WRPTR,
                            (rxq->write_actual |
                             ((FIRST_RX_QUEUE + rxq->id) << 16)));
@@ -538,9 +538,9 @@ static void iwl_pcie_rx_allocator(struct iwl_trans *trans)
        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
        struct iwl_rb_allocator *rba = &trans_pcie->rba;
        struct list_head local_empty;
-        int pending = atomic_xchg(&rba->req_pending, 0);
+        int pending = atomic_read(&rba->req_pending);
-        IWL_DEBUG_RX(trans, "Pending allocation requests = %d\n", pending);
+        IWL_DEBUG_TPT(trans, "Pending allocation requests = %d\n", pending);
        /* If we were scheduled - there is at least one request */
        spin_lock(&rba->lock);
@@ -593,12 +593,15 @@ static void iwl_pcie_rx_allocator(struct iwl_trans *trans)
                        i++;
                }
+                atomic_dec(&rba->req_pending);
                pending--;
                if (!pending) {
-                        pending = atomic_xchg(&rba->req_pending, 0);
+                        pending = atomic_read(&rba->req_pending);
-                        IWL_DEBUG_RX(trans,
+                        if (pending)
-                                     "Pending allocation requests = %d\n",
+                                IWL_DEBUG_TPT(trans,
-                                     pending);
+                                              "Got more pending allocation requests = %d\n",
+                                              pending);
                }
                spin_lock(&rba->lock);
@@ -609,12 +612,15 @@ static void iwl_pcie_rx_allocator(struct iwl_trans *trans)
                spin_unlock(&rba->lock);
                atomic_inc(&rba->req_ready);
        }
        spin_lock(&rba->lock);
        /* return unused rbds to the allocator empty list */
        list_splice_tail(&local_empty, &rba->rbd_empty);
        spin_unlock(&rba->lock);
+        IWL_DEBUG_TPT(trans, "%s, exit.\n", __func__);
 }
 /*
@@ -696,11 +702,6 @@ static void iwl_pcie_free_rxq_dma(struct iwl_trans *trans,
        rxq->bd_dma = 0;
        rxq->bd = NULL;
-        if (rxq->rb_stts)
-                dma_free_coherent(trans->dev,
-                                  use_rx_td ? sizeof(__le16) :
-                                  sizeof(struct iwl_rb_status),
-                                  rxq->rb_stts, rxq->rb_stts_dma);
        rxq->rb_stts_dma = 0;
        rxq->rb_stts = NULL;
@@ -737,6 +738,8 @@ static int iwl_pcie_alloc_rxq_dma(struct iwl_trans *trans,
        int free_size;
        bool use_rx_td = (trans->cfg->device_family >=
                          IWL_DEVICE_FAMILY_22560);
+        size_t rb_stts_size = use_rx_td ? sizeof(__le16) :
+                              sizeof(struct iwl_rb_status);
        spin_lock_init(&rxq->lock);
        if (trans->cfg->mq_rx_supported)
@@ -764,12 +767,9 @@ static int iwl_pcie_alloc_rxq_dma(struct iwl_trans *trans,
                        goto err;
        }
-        /* Allocate the driver's pointer to receive buffer status */
+        rxq->rb_stts = trans_pcie->base_rb_stts + rxq->id * rb_stts_size;
-        rxq->rb_stts = dma_alloc_coherent(dev,
+        rxq->rb_stts_dma =
-                                          use_rx_td ? sizeof(__le16) : sizeof(struct iwl_rb_status),
+                trans_pcie->base_rb_stts_dma + rxq->id * rb_stts_size;
-                                          &rxq->rb_stts_dma, GFP_KERNEL);
-        if (!rxq->rb_stts)
-                goto err;
        if (!use_rx_td)
                return 0;
@@ -799,7 +799,6 @@ err:
                iwl_pcie_free_rxq_dma(trans, rxq);
        }
-        kfree(trans_pcie->rxq);
        return -ENOMEM;
 }
@@ -809,6 +808,9 @@ int iwl_pcie_rx_alloc(struct iwl_trans *trans)
        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
        struct iwl_rb_allocator *rba = &trans_pcie->rba;
        int i, ret;
+        size_t rb_stts_size = trans->cfg->device_family >=
+                              IWL_DEVICE_FAMILY_22560 ?
+                              sizeof(__le16) : sizeof(struct iwl_rb_status);
        if (WARN_ON(trans_pcie->rxq))
                return -EINVAL;
@@ -816,18 +818,46 @@ int iwl_pcie_rx_alloc(struct iwl_trans *trans)
        trans_pcie->rxq = kcalloc(trans->num_rx_queues, sizeof(struct iwl_rxq),
                                  GFP_KERNEL);
        if (!trans_pcie->rxq)
-                return -EINVAL;
+                return -ENOMEM;
        spin_lock_init(&rba->lock);
+        /*
+         * Allocate the driver's pointer to receive buffer status.
+         * Allocate for all queues continuously (HW requirement).
+         */
+        trans_pcie->base_rb_stts =
+                        dma_alloc_coherent(trans->dev,
+                                           rb_stts_size * trans->num_rx_queues,
+                                           &trans_pcie->base_rb_stts_dma,
+                                           GFP_KERNEL);
+        if (!trans_pcie->base_rb_stts) {
+                ret = -ENOMEM;
+                goto err;
+        }
        for (i = 0; i < trans->num_rx_queues; i++) {
                struct iwl_rxq *rxq = &trans_pcie->rxq[i];
+                rxq->id = i;
                ret = iwl_pcie_alloc_rxq_dma(trans, rxq);
                if (ret)
-                        return ret;
+                        goto err;
        }
        return 0;
+err:
+        if (trans_pcie->base_rb_stts) {
+                dma_free_coherent(trans->dev,
+                                  rb_stts_size * trans->num_rx_queues,
+                                  trans_pcie->base_rb_stts,
+                                  trans_pcie->base_rb_stts_dma);
+                trans_pcie->base_rb_stts = NULL;
+                trans_pcie->base_rb_stts_dma = 0;
+        }
+        kfree(trans_pcie->rxq);
+        return ret;
 }
 static void iwl_pcie_rx_hw_init(struct iwl_trans *trans, struct iwl_rxq *rxq)
@@ -1036,8 +1066,6 @@ int _iwl_pcie_rx_init(struct iwl_trans *trans)
        for (i = 0; i < trans->num_rx_queues; i++) {
                struct iwl_rxq *rxq = &trans_pcie->rxq[i];
-                rxq->id = i;
                spin_lock(&rxq->lock);
                /*
                 * Set read write pointer to reflect that we have processed
@@ -1124,6 +1152,9 @@ void iwl_pcie_rx_free(struct iwl_trans *trans)
        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
        struct iwl_rb_allocator *rba = &trans_pcie->rba;
        int i;
+        size_t rb_stts_size = trans->cfg->device_family >=
+                              IWL_DEVICE_FAMILY_22560 ?
+                              sizeof(__le16) : sizeof(struct iwl_rb_status);
        /*
         * if rxq is NULL, it means that nothing has been allocated,
@@ -1138,6 +1169,15 @@ void iwl_pcie_rx_free(struct iwl_trans *trans)
        iwl_pcie_free_rbs_pool(trans);
+        if (trans_pcie->base_rb_stts) {
+                dma_free_coherent(trans->dev,
+                                  rb_stts_size * trans->num_rx_queues,
+                                  trans_pcie->base_rb_stts,
+                                  trans_pcie->base_rb_stts_dma);
+                trans_pcie->base_rb_stts = NULL;
+                trans_pcie->base_rb_stts_dma = 0;
+        }
        for (i = 0; i < trans->num_rx_queues; i++) {
                struct iwl_rxq *rxq = &trans_pcie->rxq[i];
@@ -1424,6 +1464,9 @@ restart:
                             !emergency)) {
                        iwl_pcie_rx_move_to_allocator(rxq, rba);
                        emergency = true;
+                        IWL_DEBUG_TPT(trans,
+                                      "RX path is in emergency. Pending allocations %d\n",
+                                      rb_pending_alloc);
                }
                IWL_DEBUG_RX(trans, "Q %d: HW = %d, SW = %d\n", rxq->id, r, i);
@@ -1453,8 +1496,12 @@ restart:
                        count++;
                        if (count == 8) {
                                count = 0;
-                                if (rb_pending_alloc < rxq->queue_size / 3)
+                                if (rb_pending_alloc < rxq->queue_size / 3) {
+                                        IWL_DEBUG_TPT(trans,
+                                                      "RX path exited emergency. Pending allocations %d\n",
+                                                      rb_pending_alloc);
                                        emergency = false;
+                                }
                                rxq->read = i;
                                spin_unlock(&rxq->lock);
@@ -2120,7 +2167,7 @@ irqreturn_t iwl_pcie_irq_msix_handler(int irq, void *dev_id)
                }
        }
-        if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_22560 &&
+        if (trans->cfg->device_family == IWL_DEVICE_FAMILY_22560 &&
            inta_hw & MSIX_HW_INT_CAUSES_REG_IPC) {
                /* Reflect IML transfer status */
                int res = iwl_read32(trans, CSR_IML_RESP_ADDR);
@@ -2139,6 +2186,17 @@ irqreturn_t iwl_pcie_irq_msix_handler(int irq, void *dev_id)
                isr_stats->wakeup++;
        }
+        if (inta_hw & MSIX_HW_INT_CAUSES_REG_IML) {
+                /* Reflect IML transfer status */
+                int res = iwl_read32(trans, CSR_IML_RESP_ADDR);
+                IWL_DEBUG_ISR(trans, "IML transfer status: %d\n", res);
+                if (res == IWL_IMAGE_RESP_FAIL) {
+                        isr_stats->sw++;
+                        iwl_pcie_irq_handle_error(trans);
+                }
+        }
        /* Chip got too hot and stopped itself */
        if (inta_hw & MSIX_HW_INT_CAUSES_REG_CT_KILL) {
                IWL_ERR(trans, "Microcode CT kill error detected.\n");
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
index 77f3610e5ca9..9c203ca75de9 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
@@ -92,26 +92,9 @@ int iwl_pcie_gen2_apm_init(struct iwl_trans *trans)
        iwl_pcie_apm_config(trans);
-        /*
+        ret = iwl_finish_nic_init(trans);
-         * Set "initialization complete" bit to move adapter from
+        if (ret)
-         * D0U* --> D0A* (powered-up active) state.
-         */
-        iwl_set_bit(trans, CSR_GP_CNTRL,
-                    BIT(trans->cfg->csr->flag_init_done));
-        /*
-         * Wait for clock stabilization; once stabilized, access to
-         * device-internal resources is supported, e.g. iwl_write_prph()
-         * and accesses to uCode SRAM.
-         */
-        ret = iwl_poll_bit(trans, CSR_GP_CNTRL,
-                           BIT(trans->cfg->csr->flag_mac_clock_ready),
-                           BIT(trans->cfg->csr->flag_mac_clock_ready),
-                           25000);
-        if (ret < 0) {
-                IWL_DEBUG_INFO(trans, "Failed to init the card\n");
                return ret;
-        }
        set_bit(STATUS_DEVICE_ENABLED, &trans->status);
@@ -188,7 +171,7 @@ void _iwl_trans_pcie_gen2_stop_device(struct iwl_trans *trans, bool low_power)
        }
        iwl_pcie_ctxt_info_free_paging(trans);
-        if (trans->cfg->device_family == IWL_DEVICE_FAMILY_22560)
+        if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_22560)
                iwl_pcie_ctxt_info_gen3_free(trans);
        else
                iwl_pcie_ctxt_info_free(trans);
@@ -251,6 +234,7 @@ void iwl_trans_pcie_gen2_stop_device(struct iwl_trans *trans, bool low_power)
 static int iwl_pcie_gen2_nic_init(struct iwl_trans *trans)
 {
        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        int queue_size = max_t(u32, TFD_CMD_SLOTS, trans->cfg->min_txq_size);
        /* TODO: most of the logic can be removed in A0 - but not in Z0 */
        spin_lock(&trans_pcie->irq_lock);
@@ -264,7 +248,7 @@ static int iwl_pcie_gen2_nic_init(struct iwl_trans *trans)
                return -ENOMEM;
        /* Allocate or reset and init all Tx and Command queues */
-        if (iwl_pcie_gen2_tx_init(trans, trans_pcie->cmd_queue, TFD_CMD_SLOTS))
+        if (iwl_pcie_gen2_tx_init(trans, trans_pcie->cmd_queue, queue_size))
                return -ENOMEM;
        /* enable shadow regs in HW */
@@ -349,7 +333,7 @@ int iwl_trans_pcie_gen2_start_fw(struct iwl_trans *trans,
                goto out;
        }
-        if (trans->cfg->device_family == IWL_DEVICE_FAMILY_22560)
+        if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_22560)
                ret = iwl_pcie_ctxt_info_gen3_init(trans, fw);
        else
                ret = iwl_pcie_ctxt_info_init(trans, fw);
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
index f74281508197..fe8269d023de 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -8,7 +8,7 @@
 * Copyright(c) 2007 - 2015 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
 * Copyright(c) 2005 - 2015 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -364,26 +364,9 @@ static int iwl_pcie_apm_init(struct iwl_trans *trans)
        if (trans->cfg->base_params->pll_cfg)
                iwl_set_bit(trans, CSR_ANA_PLL_CFG, CSR50_ANA_PLL_CFG_VAL);
-        /*
+        ret = iwl_finish_nic_init(trans);
-         * Set "initialization complete" bit to move adapter from
+        if (ret)
-         * D0U* --> D0A* (powered-up active) state.
-         */
-        iwl_set_bit(trans, CSR_GP_CNTRL,
-                    BIT(trans->cfg->csr->flag_init_done));
-        /*
-         * Wait for clock stabilization; once stabilized, access to
-         * device-internal resources is supported, e.g. iwl_write_prph()
-         * and accesses to uCode SRAM.
-         */
-        ret = iwl_poll_bit(trans, CSR_GP_CNTRL,
-                           BIT(trans->cfg->csr->flag_mac_clock_ready),
-                           BIT(trans->cfg->csr->flag_mac_clock_ready),
-                           25000);
-        if (ret < 0) {
-                IWL_ERR(trans, "Failed to init the card\n");
                return ret;
-        }
        if (trans->cfg->host_interrupt_operation_mode) {
                /*
@@ -453,23 +436,8 @@ static void iwl_pcie_apm_lp_xtal_enable(struct iwl_trans *trans)
        iwl_trans_pcie_sw_reset(trans);
-        /*
+        ret = iwl_finish_nic_init(trans);
-         * Set "initialization complete" bit to move adapter from
+        if (WARN_ON(ret)) {
-         * D0U* --> D0A* (powered-up active) state.
-         */
-        iwl_set_bit(trans, CSR_GP_CNTRL,
-                    BIT(trans->cfg->csr->flag_init_done));
-        /*
-         * Wait for clock stabilization; once stabilized, access to
-         * device-internal resources is possible.
-         */
-        ret = iwl_poll_bit(trans, CSR_GP_CNTRL,
-                           BIT(trans->cfg->csr->flag_mac_clock_ready),
-                           BIT(trans->cfg->csr->flag_mac_clock_ready),
-                           25000);
-        if (WARN_ON(ret < 0)) {
-                IWL_ERR(trans, "Access time out - failed to enable LP XTAL\n");
                /* Release XTAL ON request */
                __iwl_trans_pcie_clear_bit(trans, CSR_GP_CNTRL,
                                           CSR_GP_CNTRL_REG_FLAG_XTAL_ON);
@@ -928,13 +896,13 @@ void iwl_pcie_apply_destination(struct iwl_trans *trans)
                if (!trans->num_blocks)
                        return;
-                iwl_write_prph(trans, MON_BUFF_BASE_ADDR_VER2,
+                iwl_write_umac_prph(trans, MON_BUFF_BASE_ADDR_VER2,
-                               trans->fw_mon[0].physical >>
+                                    trans->fw_mon[0].physical >>
-                               MON_BUFF_SHIFT_VER2);
+                                    MON_BUFF_SHIFT_VER2);
-                iwl_write_prph(trans, MON_BUFF_END_ADDR_VER2,
+                iwl_write_umac_prph(trans, MON_BUFF_END_ADDR_VER2,
-                               (trans->fw_mon[0].physical +
+                                    (trans->fw_mon[0].physical +
-                                trans->fw_mon[0].size - 256) >>
+                                     trans->fw_mon[0].size - 256) >>
-                               MON_BUFF_SHIFT_VER2);
+                                    MON_BUFF_SHIFT_VER2);
                return;
        }
@@ -1126,6 +1094,7 @@ static struct iwl_causes_list causes_list[] = {
        {MSIX_FH_INT_CAUSES_FH_ERR,             CSR_MSIX_FH_INT_MASK_AD, 0x5},
        {MSIX_HW_INT_CAUSES_REG_ALIVE,          CSR_MSIX_HW_INT_MASK_AD, 0x10},
        {MSIX_HW_INT_CAUSES_REG_WAKEUP,         CSR_MSIX_HW_INT_MASK_AD, 0x11},
+        {MSIX_HW_INT_CAUSES_REG_IML,            CSR_MSIX_HW_INT_MASK_AD, 0x12},
        {MSIX_HW_INT_CAUSES_REG_CT_KILL,        CSR_MSIX_HW_INT_MASK_AD, 0x16},
        {MSIX_HW_INT_CAUSES_REG_RF_KILL,        CSR_MSIX_HW_INT_MASK_AD, 0x17},
        {MSIX_HW_INT_CAUSES_REG_PERIODIC,       CSR_MSIX_HW_INT_MASK_AD, 0x18},
@@ -1158,7 +1127,7 @@ static void iwl_pcie_map_non_rx_causes(struct iwl_trans *trans)
        struct iwl_trans_pcie *trans_pcie =  IWL_TRANS_GET_PCIE_TRANS(trans);
        int val = trans_pcie->def_irq | MSIX_NON_AUTO_CLEAR_CAUSE;
        int i, arr_size =
-                (trans->cfg->device_family < IWL_DEVICE_FAMILY_22560) ?
+                (trans->cfg->device_family != IWL_DEVICE_FAMILY_22560) ?
                ARRAY_SIZE(causes_list) : ARRAY_SIZE(causes_list_v2);
        /*
@@ -1168,7 +1137,7 @@ static void iwl_pcie_map_non_rx_causes(struct iwl_trans *trans)
         */
        for (i = 0; i < arr_size; i++) {
                struct iwl_causes_list *causes =
-                        (trans->cfg->device_family < IWL_DEVICE_FAMILY_22560) ?
+                        (trans->cfg->device_family != IWL_DEVICE_FAMILY_22560) ?
                        causes_list : causes_list_v2;
                iwl_write8(trans, CSR_MSIX_IVAR(causes[i].addr), val);
@@ -1214,8 +1183,8 @@ void iwl_pcie_conf_msix_hw(struct iwl_trans_pcie *trans_pcie)
        if (!trans_pcie->msix_enabled) {
                if (trans->cfg->mq_rx_supported &&
                    test_bit(STATUS_DEVICE_ENABLED, &trans->status))
-                        iwl_write_prph(trans, UREG_CHICK,
+                        iwl_write_umac_prph(trans, UREG_CHICK,
-                                       UREG_CHICK_MSI_ENABLE);
+                                            UREG_CHICK_MSI_ENABLE);
                return;
        }
        /*
@@ -1224,7 +1193,7 @@ void iwl_pcie_conf_msix_hw(struct iwl_trans_pcie *trans_pcie)
         * prph.
         */
        if (test_bit(STATUS_DEVICE_ENABLED, &trans->status))
-                iwl_write_prph(trans, UREG_CHICK, UREG_CHICK_MSIX_ENABLE);
+                iwl_write_umac_prph(trans, UREG_CHICK, UREG_CHICK_MSIX_ENABLE);
        /*
         * Each cause from the causes list above and the RX causes is
@@ -1558,20 +1527,10 @@ static int iwl_trans_pcie_d3_resume(struct iwl_trans *trans,
        iwl_set_bit(trans, CSR_GP_CNTRL,
                    BIT(trans->cfg->csr->flag_mac_access_req));
-        iwl_set_bit(trans, CSR_GP_CNTRL,
-                    BIT(trans->cfg->csr->flag_init_done));
-        if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_8000)
-                udelay(2);
-        ret = iwl_poll_bit(trans, CSR_GP_CNTRL,
+        ret = iwl_finish_nic_init(trans);
-                           BIT(trans->cfg->csr->flag_mac_clock_ready),
+        if (ret)
-                           BIT(trans->cfg->csr->flag_mac_clock_ready),
-                           25000);
-        if (ret < 0) {
-                IWL_ERR(trans, "Failed to resume the device (mac ready)\n");
                return ret;
-        }
        /*
         * Reconfigure IVAR table in case of MSIX or reset ict table in
@@ -1602,7 +1561,7 @@ static int iwl_trans_pcie_d3_resume(struct iwl_trans *trans,
        }
        IWL_DEBUG_POWER(trans, "WFPM value upon resume = 0x%08X\n",
-                        iwl_read_prph(trans, WFPM_GP2));
+                        iwl_read_umac_prph(trans, WFPM_GP2));
        val = iwl_read32(trans, CSR_RESET);
        if (val & CSR_RESET_REG_FLAG_NEVO_RESET)
@@ -1751,15 +1710,18 @@ static int _iwl_trans_pcie_start_hw(struct iwl_trans *trans, bool low_power)
                return err;
        }
-        hpm = iwl_trans_read_prph(trans, HPM_DEBUG);
+        hpm = iwl_read_umac_prph_no_grab(trans, HPM_DEBUG);
        if (hpm != 0xa5a5a5a0 && (hpm & PERSISTENCE_BIT)) {
-                if (iwl_trans_read_prph(trans, PREG_PRPH_WPROT_0) &
+                int wfpm_val = iwl_read_umac_prph_no_grab(trans,
-                    PREG_WFPM_ACCESS) {
+                                                          PREG_PRPH_WPROT_0);
+                if (wfpm_val & PREG_WFPM_ACCESS) {
                        IWL_ERR(trans,
                                "Error, can not clear persistence bit\n");
                        return -EPERM;
                }
-                iwl_trans_write_prph(trans, HPM_DEBUG, hpm & ~PERSISTENCE_BIT);
+                iwl_write_umac_prph_no_grab(trans, HPM_DEBUG,
+                                            hpm & ~PERSISTENCE_BIT);
        }
        iwl_trans_pcie_sw_reset(trans);
@@ -2281,6 +2243,7 @@ static int iwl_trans_pcie_wait_txq_empty(struct iwl_trans *trans, int txq_idx)
        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
        struct iwl_txq *txq;
        unsigned long now = jiffies;
+        bool overflow_tx;
        u8 wr_ptr;
        /* Make sure the NIC is still alive in the bus */
@@ -2292,18 +2255,37 @@ static int iwl_trans_pcie_wait_txq_empty(struct iwl_trans *trans, int txq_idx)
        IWL_DEBUG_TX_QUEUES(trans, "Emptying queue %d...\n", txq_idx);
        txq = trans_pcie->txq[txq_idx];
+        spin_lock_bh(&txq->lock);
+        overflow_tx = txq->overflow_tx ||
+                      !skb_queue_empty(&txq->overflow_q);
+        spin_unlock_bh(&txq->lock);
        wr_ptr = READ_ONCE(txq->write_ptr);
-        while (txq->read_ptr != READ_ONCE(txq->write_ptr) &&
+        while ((txq->read_ptr != READ_ONCE(txq->write_ptr) ||
+                overflow_tx) &&
               !time_after(jiffies,
                           now + msecs_to_jiffies(IWL_FLUSH_WAIT_MS))) {
                u8 write_ptr = READ_ONCE(txq->write_ptr);
-                if (WARN_ONCE(wr_ptr != write_ptr,
+                /*
+                 * If write pointer moved during the wait, warn only
+                 * if the TX came from op mode. In case TX came from
+                 * trans layer (overflow TX) don't warn.
+                 */
+                if (WARN_ONCE(wr_ptr != write_ptr && !overflow_tx,
                              "WR pointer moved while flushing %d -> %d\n",
                              wr_ptr, write_ptr))
                        return -ETIMEDOUT;
+                wr_ptr = write_ptr;
                usleep_range(1000, 2000);
+                spin_lock_bh(&txq->lock);
+                overflow_tx = txq->overflow_tx ||
+                              !skb_queue_empty(&txq->overflow_q);
+                spin_unlock_bh(&txq->lock);
        }
        if (txq->read_ptr != txq->write_ptr) {
@@ -2989,7 +2971,8 @@ static u32 iwl_trans_pcie_fh_regs_dump(struct iwl_trans *trans,
                     i += sizeof(u32))
                        *val++ = cpu_to_le32(iwl_trans_pcie_read32(trans, i));
        else
-                for (i = FH_MEM_LOWER_BOUND_GEN2; i < FH_MEM_UPPER_BOUND_GEN2;
+                for (i = iwl_umac_prph(trans, FH_MEM_LOWER_BOUND_GEN2);
+                     i < iwl_umac_prph(trans, FH_MEM_UPPER_BOUND_GEN2);
                     i += sizeof(u32))
                        *val++ = cpu_to_le32(iwl_trans_pcie_read_prph(trans,
                                                                      i));
@@ -3014,11 +2997,11 @@ iwl_trans_pci_dump_marbh_monitor(struct iwl_trans *trans,
        if (!iwl_trans_grab_nic_access(trans, &flags))
                return 0;
-        iwl_write_prph_no_grab(trans, MON_DMARB_RD_CTL_ADDR, 0x1);
+        iwl_write_umac_prph_no_grab(trans, MON_DMARB_RD_CTL_ADDR, 0x1);
        for (i = 0; i < buf_size_in_dwords; i++)
-                buffer[i] = iwl_read_prph_no_grab(trans,
+                buffer[i] = iwl_read_umac_prph_no_grab(trans,
-                                MON_DMARB_RD_DATA_ADDR);
+                                                       MON_DMARB_RD_DATA_ADDR);
-        iwl_write_prph_no_grab(trans, MON_DMARB_RD_CTL_ADDR, 0x0);
+        iwl_write_umac_prph_no_grab(trans, MON_DMARB_RD_CTL_ADDR, 0x0);
        iwl_trans_release_nic_access(trans, &flags);
@@ -3033,9 +3016,9 @@ iwl_trans_pcie_dump_pointers(struct iwl_trans *trans,
        /* If there was a dest TLV - use the values from there */
        if (trans->ini_valid) {
-                base = MON_BUFF_BASE_ADDR_VER2;
+                base = iwl_umac_prph(trans, MON_BUFF_BASE_ADDR_VER2);
-                write_ptr = MON_BUFF_WRPTR_VER2;
+                write_ptr = iwl_umac_prph(trans, MON_BUFF_WRPTR_VER2);
-                wrap_cnt = MON_BUFF_CYCLE_CNT_VER2;
+                wrap_cnt = iwl_umac_prph(trans, MON_BUFF_CYCLE_CNT_VER2);
        } else if (trans->dbg_dest_tlv) {
                write_ptr = le32_to_cpu(trans->dbg_dest_tlv->write_ptr_reg);
                wrap_cnt = le32_to_cpu(trans->dbg_dest_tlv->wrap_count);
@@ -3197,8 +3180,8 @@ static struct iwl_trans_dump_data
        if (dump_mask & BIT(IWL_FW_ERROR_DUMP_FH_REGS)) {
                if (trans->cfg->gen2)
                        len += sizeof(*data) +
-                               (FH_MEM_UPPER_BOUND_GEN2 -
+                               (iwl_umac_prph(trans, FH_MEM_UPPER_BOUND_GEN2) -
-                                FH_MEM_LOWER_BOUND_GEN2);
+                                iwl_umac_prph(trans, FH_MEM_LOWER_BOUND_GEN2));
                else
                        len += sizeof(*data) +
                               (FH_MEM_UPPER_BOUND -
@@ -3220,10 +3203,10 @@ static struct iwl_trans_dump_data
        /* Paged memory for gen2 HW */
        if (trans->cfg->gen2 && dump_mask & BIT(IWL_FW_ERROR_DUMP_PAGING))
-                for (i = 0; i < trans_pcie->init_dram.paging_cnt; i++)
+                for (i = 0; i < trans->init_dram.paging_cnt; i++)
                        len += sizeof(*data) +
                               sizeof(struct iwl_fw_error_dump_paging) +
-                               trans_pcie->init_dram.paging[i].size;
+                               trans->init_dram.paging[i].size;
        dump_data = vzalloc(len);
        if (!dump_data)
@@ -3275,20 +3258,16 @@ static struct iwl_trans_dump_data
        /* Paged memory for gen2 HW */
        if (trans->cfg->gen2 && dump_mask & BIT(IWL_FW_ERROR_DUMP_PAGING)) {
-                for (i = 0; i < trans_pcie->init_dram.paging_cnt; i++) {
+                for (i = 0; i < trans->init_dram.paging_cnt; i++) {
                        struct iwl_fw_error_dump_paging *paging;
-                        dma_addr_t addr =
+                        u32 page_len = trans->init_dram.paging[i].size;
-                                trans_pcie->init_dram.paging[i].physical;
-                        u32 page_len = trans_pcie->init_dram.paging[i].size;
                        data->type = cpu_to_le32(IWL_FW_ERROR_DUMP_PAGING);
                        data->len = cpu_to_le32(sizeof(*paging) + page_len);
                        paging = (void *)data->data;
                        paging->index = cpu_to_le32(i);
-                        dma_sync_single_for_cpu(trans->dev, addr, page_len,
-                                                DMA_BIDIRECTIONAL);
                        memcpy(paging->data,
-                               trans_pcie->init_dram.paging[i].block, page_len);
+                               trans->init_dram.paging[i].block, page_len);
                        data = iwl_fw_error_next_data(data);
                        len += sizeof(*data) + sizeof(*paging) + page_len;
@@ -3525,25 +3504,18 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
                 * in-order to recognize C step driver should read chip version
                 * id located at the AUX bus MISC address space.
                 */
-                iwl_set_bit(trans, CSR_GP_CNTRL,
+                ret = iwl_finish_nic_init(trans);
-                            BIT(trans->cfg->csr->flag_init_done));
+                if (ret)
-                udelay(2);
-                ret = iwl_poll_bit(trans, CSR_GP_CNTRL,
-                                   BIT(trans->cfg->csr->flag_mac_clock_ready),
-                                   BIT(trans->cfg->csr->flag_mac_clock_ready),
-                                   25000);
-                if (ret < 0) {
-                        IWL_DEBUG_INFO(trans, "Failed to wake up the nic\n");
                        goto out_no_pci;
-                }
                if (iwl_trans_grab_nic_access(trans, &flags)) {
                        u32 hw_step;
-                        hw_step = iwl_read_prph_no_grab(trans, WFPM_CTRL_REG);
+                        hw_step = iwl_read_umac_prph_no_grab(trans,
+                                                             WFPM_CTRL_REG);
                        hw_step |= ENABLE_WFPM;
-                        iwl_write_prph_no_grab(trans, WFPM_CTRL_REG, hw_step);
+                        iwl_write_umac_prph_no_grab(trans, WFPM_CTRL_REG,
+                                                    hw_step);
                        hw_step = iwl_read_prph_no_grab(trans, AUX_MISC_REG);
                        hw_step = (hw_step >> HW_STEP_LOCATION_BITS) & 0xF;
                        if (hw_step == 0x3)
@@ -3558,10 +3530,20 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
 #if IS_ENABLED(CONFIG_IWLMVM)
        trans->hw_rf_id = iwl_read32(trans, CSR_HW_RF_ID);
-        if (cfg == &iwl22560_2ax_cfg_hr) {
+        if (cfg == &iwlax210_2ax_cfg_so_hr_a0) {
+                if (trans->hw_rev == CSR_HW_REV_TYPE_TY) {
+                        trans->cfg = &iwlax210_2ax_cfg_ty_gf_a0;
+                } else if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
+                           CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_JF)) {
+                        trans->cfg = &iwlax210_2ax_cfg_so_jf_a0;
+                } else if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
+                           CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_GF)) {
+                        trans->cfg = &iwlax210_2ax_cfg_so_gf_a0;
+                }
+        } else if (cfg == &iwl_ax101_cfg_qu_hr) {
                if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
                    CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HR)) {
-                        trans->cfg = &iwl22560_2ax_cfg_hr;
+                        trans->cfg = &iwl_ax101_cfg_qu_hr;
                } else if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
                           CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_JF)) {
                        trans->cfg = &iwl22000_2ax_cfg_jf;
@@ -3654,3 +3636,28 @@ out_no_pci:
        iwl_trans_free(trans);
        return ERR_PTR(ret);
 }
+void iwl_trans_sync_nmi(struct iwl_trans *trans)
+{
+        unsigned long timeout = jiffies + IWL_TRANS_NMI_TIMEOUT;
+        iwl_disable_interrupts(trans);
+        iwl_force_nmi(trans);
+        while (time_after(timeout, jiffies)) {
+                u32 inta_hw = iwl_read32(trans,
+                                         CSR_MSIX_HW_INT_CAUSES_AD);
+                /* Error detected by uCode */
+                if (inta_hw & MSIX_HW_INT_CAUSES_REG_SW_ERR) {
+                        /* Clear causes register */
+                        iwl_write32(trans, CSR_MSIX_HW_INT_CAUSES_AD,
+                                    inta_hw &
+                                    MSIX_HW_INT_CAUSES_REG_SW_ERR);
+                        break;
+                }
+                mdelay(1);
+        }
+        iwl_enable_interrupts(trans);
+        iwl_trans_fw_error(trans);
+}
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
index f3d2e8fe920b..88530d9f4a54 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
@@ -6,7 +6,7 @@
 * GPL LICENSE SUMMARY
 *
 * Copyright(c) 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -20,7 +20,7 @@
 * BSD LICENSE
 *
 * Copyright(c) 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -965,9 +965,7 @@ static int iwl_pcie_gen2_send_hcmd_sync(struct iwl_trans *trans,
                               cmd_str);
                ret = -ETIMEDOUT;
-                iwl_force_nmi(trans);
+                iwl_trans_sync_nmi(trans);
-                iwl_trans_fw_error(trans);
                goto cancel;
        }
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
index 07395502f419..9fbd37d23e85 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
@@ -8,7 +8,7 @@
 * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
 * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -995,7 +995,11 @@ static int iwl_pcie_tx_alloc(struct iwl_trans *trans)
             txq_id++) {
                bool cmd_queue = (txq_id == trans_pcie->cmd_queue);
-                slots_num = cmd_queue ? TFD_CMD_SLOTS : TFD_TX_CMD_SLOTS;
+                if (cmd_queue)
+                        slots_num = max_t(u32, TFD_CMD_SLOTS,
+                                          trans->cfg->min_txq_size);
+                else
+                        slots_num = TFD_TX_CMD_SLOTS;
                trans_pcie->txq[txq_id] = &trans_pcie->txq_memory[txq_id];
                ret = iwl_pcie_txq_alloc(trans, trans_pcie->txq[txq_id],
                                         slots_num, cmd_queue);
@@ -1044,7 +1048,11 @@ int iwl_pcie_tx_init(struct iwl_trans *trans)
             txq_id++) {
                bool cmd_queue = (txq_id == trans_pcie->cmd_queue);
-                slots_num = cmd_queue ? TFD_CMD_SLOTS : TFD_TX_CMD_SLOTS;
+                if (cmd_queue)
+                        slots_num = max_t(u32, TFD_CMD_SLOTS,
+                                          trans->cfg->min_txq_size);
+                else
+                        slots_num = TFD_TX_CMD_SLOTS;
                ret = iwl_pcie_txq_init(trans, trans_pcie->txq[txq_id],
                                        slots_num, cmd_queue);
                if (ret) {
@@ -1174,6 +1182,15 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
                skb_queue_splice_init(&txq->overflow_q, &overflow_skbs);
                /*
+                 * We are going to transmit from the overflow queue.
+                 * Remember this state so that wait_for_txq_empty will know we
+                 * are adding more packets to the TFD queue. It cannot rely on
+                 * the state of &txq->overflow_q, as we just emptied it, but
+                 * haven't TXed the content yet.
+                 */
+                txq->overflow_tx = true;
+                /*
                 * This is tricky: we are in reclaim path which is non
                 * re-entrant, so noone will try to take the access the
                 * txq data from that path. We stopped tx, so we can't
@@ -1201,6 +1218,7 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
                        iwl_wake_queue(trans, txq);
                spin_lock_bh(&txq->lock);
+                txq->overflow_tx = false;
        }
        if (txq->read_ptr == txq->write_ptr) {
@@ -1942,9 +1960,7 @@ static int iwl_pcie_send_hcmd_sync(struct iwl_trans *trans,
                               iwl_get_cmd_string(trans, cmd->id));
                ret = -ETIMEDOUT;
-                iwl_force_nmi(trans);
+                iwl_trans_sync_nmi(trans);
-                iwl_trans_fw_error(trans);
                goto cancel;
        }