139 files changed, 5148 insertions, 2912 deletions

diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
index 86907e5ba6ca..999d24ff242f 100644
--- a/drivers/net/wireless/ath/ath.h
+++ b/drivers/net/wireless/ath/ath.h
@@ -148,7 +148,7 @@ struct ath_common {
         u16 cachelsz;
         u16 curaid;
         u8 macaddr[ETH_ALEN];
-        u8 curbssid[ETH_ALEN];
+        u8 curbssid[ETH_ALEN] __aligned(2);
         u8 bssidmask[ETH_ALEN];
 
         u32 rx_bufsize;
diff --git a/drivers/net/wireless/ath/ath10k/ce.c b/drivers/net/wireless/ath/ath10k/ce.c
index 101cadb6e4ba..9b89ac133946 100644
--- a/drivers/net/wireless/ath/ath10k/ce.c
+++ b/drivers/net/wireless/ath/ath10k/ce.c
@@ -443,12 +443,12 @@ int ath10k_ce_rx_post_buf(struct ath10k_ce_pipe *pipe, void *ctx, u32 paddr)
  * Guts of ath10k_ce_completed_recv_next.
  * The caller takes responsibility for any necessary locking.
  */
-static int ath10k_ce_completed_recv_next_nolock(struct ath10k_ce_pipe *ce_state,
-                                                void **per_transfer_contextp,
-                                                u32 *bufferp,
-                                                unsigned int *nbytesp,
-                                                unsigned int *transfer_idp,
-                                                unsigned int *flagsp)
+int ath10k_ce_completed_recv_next_nolock(struct ath10k_ce_pipe *ce_state,
+                                         void **per_transfer_contextp,
+                                         u32 *bufferp,
+                                         unsigned int *nbytesp,
+                                         unsigned int *transfer_idp,
+                                         unsigned int *flagsp)
 {
         struct ath10k_ce_ring *dest_ring = ce_state->dest_ring;
         unsigned int nentries_mask = dest_ring->nentries_mask;
@@ -576,11 +576,11 @@ int ath10k_ce_revoke_recv_next(struct ath10k_ce_pipe *ce_state,
  * Guts of ath10k_ce_completed_send_next.
  * The caller takes responsibility for any necessary locking.
  */
-static int ath10k_ce_completed_send_next_nolock(struct ath10k_ce_pipe *ce_state,
-                                                void **per_transfer_contextp,
-                                                u32 *bufferp,
-                                                unsigned int *nbytesp,
-                                                unsigned int *transfer_idp)
+int ath10k_ce_completed_send_next_nolock(struct ath10k_ce_pipe *ce_state,
+                                         void **per_transfer_contextp,
+                                         u32 *bufferp,
+                                         unsigned int *nbytesp,
+                                         unsigned int *transfer_idp)
 {
         struct ath10k_ce_ring *src_ring = ce_state->src_ring;
         u32 ctrl_addr = ce_state->ctrl_addr;
@@ -817,7 +817,10 @@ void ath10k_ce_enable_interrupts(struct ath10k *ar)
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         int ce_id;
 
-        for (ce_id = 0; ce_id < CE_COUNT; ce_id++)
+        /* Skip the last copy engine, CE7 the diagnostic window, as that
+         * uses polling and isn't initialized for interrupts.
+         */
+        for (ce_id = 0; ce_id < CE_COUNT - 1; ce_id++)
                 ath10k_ce_per_engine_handler_adjust(&ar_pci->ce_states[ce_id]);
 }
 
@@ -1020,37 +1023,10 @@ ath10k_ce_alloc_dest_ring(struct ath10k *ar, unsigned int ce_id,
  * initialized by software/firmware.
  */
 int ath10k_ce_init_pipe(struct ath10k *ar, unsigned int ce_id,
-                        const struct ce_attr *attr,
-                        void (*send_cb)(struct ath10k_ce_pipe *),
-                        void (*recv_cb)(struct ath10k_ce_pipe *))
+                        const struct ce_attr *attr)
 {
-        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct ath10k_ce_pipe *ce_state = &ar_pci->ce_states[ce_id];
         int ret;
 
-        /*
-         * Make sure there's enough CE ringbuffer entries for HTT TX to avoid
-         * additional TX locking checks.
-         *
-         * For the lack of a better place do the check here.
-         */
-        BUILD_BUG_ON(2*TARGET_NUM_MSDU_DESC >
-                     (CE_HTT_H2T_MSG_SRC_NENTRIES - 1));
-        BUILD_BUG_ON(2*TARGET_10X_NUM_MSDU_DESC >
-                     (CE_HTT_H2T_MSG_SRC_NENTRIES - 1));
-
-        spin_lock_bh(&ar_pci->ce_lock);
-        ce_state->ar = ar;
-        ce_state->id = ce_id;
-        ce_state->ctrl_addr = ath10k_ce_base_address(ce_id);
-        ce_state->attr_flags = attr->flags;
-        ce_state->src_sz_max = attr->src_sz_max;
-        if (attr->src_nentries)
-                ce_state->send_cb = send_cb;
-        if (attr->dest_nentries)
-                ce_state->recv_cb = recv_cb;
-        spin_unlock_bh(&ar_pci->ce_lock);
-
         if (attr->src_nentries) {
                 ret = ath10k_ce_init_src_ring(ar, ce_id, attr);
                 if (ret) {
@@ -1098,12 +1074,37 @@ void ath10k_ce_deinit_pipe(struct ath10k *ar, unsigned int ce_id)
 }
 
 int ath10k_ce_alloc_pipe(struct ath10k *ar, int ce_id,
-                         const struct ce_attr *attr)
+                         const struct ce_attr *attr,
+                         void (*send_cb)(struct ath10k_ce_pipe *),
+                         void (*recv_cb)(struct ath10k_ce_pipe *))
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         struct ath10k_ce_pipe *ce_state = &ar_pci->ce_states[ce_id];
         int ret;
 
+        /*
+         * Make sure there's enough CE ringbuffer entries for HTT TX to avoid
+         * additional TX locking checks.
+         *
+         * For the lack of a better place do the check here.
+         */
+        BUILD_BUG_ON(2*TARGET_NUM_MSDU_DESC >
+                     (CE_HTT_H2T_MSG_SRC_NENTRIES - 1));
+        BUILD_BUG_ON(2*TARGET_10X_NUM_MSDU_DESC >
+                     (CE_HTT_H2T_MSG_SRC_NENTRIES - 1));
+
+        ce_state->ar = ar;
+        ce_state->id = ce_id;
+        ce_state->ctrl_addr = ath10k_ce_base_address(ce_id);
+        ce_state->attr_flags = attr->flags;
+        ce_state->src_sz_max = attr->src_sz_max;
+
+        if (attr->src_nentries)
+                ce_state->send_cb = send_cb;
+
+        if (attr->dest_nentries)
+                ce_state->recv_cb = recv_cb;
+
         if (attr->src_nentries) {
                 ce_state->src_ring = ath10k_ce_alloc_src_ring(ar, ce_id, attr);
                 if (IS_ERR(ce_state->src_ring)) {
diff --git a/drivers/net/wireless/ath/ath10k/ce.h b/drivers/net/wireless/ath/ath10k/ce.h
index 329b7340fa72..617a151e8ce4 100644
--- a/drivers/net/wireless/ath/ath10k/ce.h
+++ b/drivers/net/wireless/ath/ath10k/ce.h
@@ -192,15 +192,21 @@ int ath10k_ce_completed_send_next(struct ath10k_ce_pipe *ce_state,
                                   unsigned int *nbytesp,
                                   unsigned int *transfer_idp);
 
+int ath10k_ce_completed_send_next_nolock(struct ath10k_ce_pipe *ce_state,
+                                         void **per_transfer_contextp,
+                                         u32 *bufferp,
+                                         unsigned int *nbytesp,
+                                         unsigned int *transfer_idp);
+
 /*==================CE Engine Initialization=======================*/
 
 int ath10k_ce_init_pipe(struct ath10k *ar, unsigned int ce_id,
-                        const struct ce_attr *attr,
-                        void (*send_cb)(struct ath10k_ce_pipe *),
-                        void (*recv_cb)(struct ath10k_ce_pipe *));
+                        const struct ce_attr *attr);
 void ath10k_ce_deinit_pipe(struct ath10k *ar, unsigned int ce_id);
 int ath10k_ce_alloc_pipe(struct ath10k *ar, int ce_id,
-                         const struct ce_attr *attr);
+                         const struct ce_attr *attr,
+                         void (*send_cb)(struct ath10k_ce_pipe *),
+                         void (*recv_cb)(struct ath10k_ce_pipe *));
 void ath10k_ce_free_pipe(struct ath10k *ar, int ce_id);
 
 /*==================CE Engine Shutdown=======================*/
@@ -213,6 +219,13 @@ int ath10k_ce_revoke_recv_next(struct ath10k_ce_pipe *ce_state,
                                void **per_transfer_contextp,
                                u32 *bufferp);
 
+int ath10k_ce_completed_recv_next_nolock(struct ath10k_ce_pipe *ce_state,
+                                         void **per_transfer_contextp,
+                                         u32 *bufferp,
+                                         unsigned int *nbytesp,
+                                         unsigned int *transfer_idp,
+                                         unsigned int *flagsp);
+
 /*
  * Support clean shutdown by allowing the caller to cancel
  * pending sends.  Target DMA must be stopped before using
diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
index cee18c89d7f2..5c23d00f7d60 100644
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -138,7 +138,8 @@ static const struct firmware *ath10k_fetch_fw_file(struct ath10k *ar,
         return fw;
 }
 
-static int ath10k_push_board_ext_data(struct ath10k *ar)
+static int ath10k_push_board_ext_data(struct ath10k *ar, const void *data,
+                                      size_t data_len)
 {
         u32 board_data_size = QCA988X_BOARD_DATA_SZ;
         u32 board_ext_data_size = QCA988X_BOARD_EXT_DATA_SZ;
@@ -159,14 +160,14 @@ static int ath10k_push_board_ext_data(struct ath10k *ar)
         if (board_ext_data_addr == 0)
                 return 0;
 
-        if (ar->board_len != (board_data_size + board_ext_data_size)) {
+        if (data_len != (board_data_size + board_ext_data_size)) {
                 ath10k_err(ar, "invalid board (ext) data sizes %zu != %d+%d\n",
-                           ar->board_len, board_data_size, board_ext_data_size);
+                           data_len, board_data_size, board_ext_data_size);
                 return -EINVAL;
         }
 
         ret = ath10k_bmi_write_memory(ar, board_ext_data_addr,
-                                      ar->board_data + board_data_size,
+                                      data + board_data_size,
                                       board_ext_data_size);
         if (ret) {
                 ath10k_err(ar, "could not write board ext data (%d)\n", ret);
@@ -184,13 +185,14 @@ static int ath10k_push_board_ext_data(struct ath10k *ar)
         return 0;
 }
 
-static int ath10k_download_board_data(struct ath10k *ar)
+static int ath10k_download_board_data(struct ath10k *ar, const void *data,
+                                      size_t data_len)
 {
         u32 board_data_size = QCA988X_BOARD_DATA_SZ;
         u32 address;
         int ret;
 
-        ret = ath10k_push_board_ext_data(ar);
+        ret = ath10k_push_board_ext_data(ar, data, data_len);
         if (ret) {
                 ath10k_err(ar, "could not push board ext data (%d)\n", ret);
                 goto exit;
@@ -202,9 +204,9 @@ static int ath10k_download_board_data(struct ath10k *ar)
                 goto exit;
         }
 
-        ret = ath10k_bmi_write_memory(ar, address, ar->board_data,
+        ret = ath10k_bmi_write_memory(ar, address, data,
                                       min_t(u32, board_data_size,
-                                            ar->board_len));
+                                            data_len));
         if (ret) {
                 ath10k_err(ar, "could not write board data (%d)\n", ret);
                 goto exit;
@@ -220,11 +222,39 @@ exit:
         return ret;
 }
 
+static int ath10k_download_cal_file(struct ath10k *ar)
+{
+        int ret;
+
+        if (!ar->cal_file)
+                return -ENOENT;
+
+        if (IS_ERR(ar->cal_file))
+                return PTR_ERR(ar->cal_file);
+
+        ret = ath10k_download_board_data(ar, ar->cal_file->data,
+                                         ar->cal_file->size);
+        if (ret) {
+                ath10k_err(ar, "failed to download cal_file data: %d\n", ret);
+                return ret;
+        }
+
+        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot cal file downloaded\n");
+
+        return 0;
+}
+
 static int ath10k_download_and_run_otp(struct ath10k *ar)
 {
         u32 result, address = ar->hw_params.patch_load_addr;
         int ret;
 
+        ret = ath10k_download_board_data(ar, ar->board_data, ar->board_len);
+        if (ret) {
+                ath10k_err(ar, "failed to download board data: %d\n", ret);
+                return ret;
+        }
+
         /* OTP is optional */
 
         if (!ar->otp_data || !ar->otp_len) {
@@ -308,6 +338,9 @@ static void ath10k_core_free_firmware_files(struct ath10k *ar)
         if (ar->firmware && !IS_ERR(ar->firmware))
                 release_firmware(ar->firmware);
 
+        if (ar->cal_file && !IS_ERR(ar->cal_file))
+                release_firmware(ar->cal_file);
+
         ar->board = NULL;
         ar->board_data = NULL;
         ar->board_len = 0;
@@ -319,6 +352,27 @@ static void ath10k_core_free_firmware_files(struct ath10k *ar)
         ar->firmware = NULL;
         ar->firmware_data = NULL;
         ar->firmware_len = 0;
+
+        ar->cal_file = NULL;
+}
+
+static int ath10k_fetch_cal_file(struct ath10k *ar)
+{
+        char filename[100];
+
+        /* cal-<bus>-<id>.bin */
+        scnprintf(filename, sizeof(filename), "cal-%s-%s.bin",
+                  ath10k_bus_str(ar->hif.bus), dev_name(ar->dev));
+
+        ar->cal_file = ath10k_fetch_fw_file(ar, ATH10K_FW_DIR, filename);
+        if (IS_ERR(ar->cal_file))
+                /* calibration file is optional, don't print any warnings */
+                return PTR_ERR(ar->cal_file);
+
+        ath10k_dbg(ar, ATH10K_DBG_BOOT, "found calibration file %s/%s\n",
+                   ATH10K_FW_DIR, filename);
+
+        return 0;
 }
 
 static int ath10k_core_fetch_firmware_api_1(struct ath10k *ar)
@@ -562,6 +616,9 @@ static int ath10k_core_fetch_firmware_files(struct ath10k *ar)
 {
         int ret;
 
+        /* calibration file is optional, don't check for any errors */
+        ath10k_fetch_cal_file(ar);
+
         ar->fw_api = 3;
         ath10k_dbg(ar, ATH10K_DBG_BOOT, "trying fw api %d\n", ar->fw_api);
 
@@ -589,30 +646,32 @@ success:
         return 0;
 }
 
-static int ath10k_init_download_firmware(struct ath10k *ar,
-                                         enum ath10k_firmware_mode mode)
+static int ath10k_download_cal_data(struct ath10k *ar)
 {
         int ret;
 
-        ret = ath10k_download_board_data(ar);
-        if (ret) {
-                ath10k_err(ar, "failed to download board data: %d\n", ret);
-                return ret;
+        ret = ath10k_download_cal_file(ar);
+        if (ret == 0) {
+                ar->cal_mode = ATH10K_CAL_MODE_FILE;
+                goto done;
         }
 
+        ath10k_dbg(ar, ATH10K_DBG_BOOT,
+                   "boot did not find a calibration file, try OTP next: %d\n",
+                   ret);
+
         ret = ath10k_download_and_run_otp(ar);
         if (ret) {
                 ath10k_err(ar, "failed to run otp: %d\n", ret);
                 return ret;
         }
 
-        ret = ath10k_download_fw(ar, mode);
-        if (ret) {
-                ath10k_err(ar, "failed to download firmware: %d\n", ret);
-                return ret;
-        }
+        ar->cal_mode = ATH10K_CAL_MODE_OTP;
 
-        return ret;
+done:
+        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot using calibration mode %s\n",
+                   ath10k_cal_mode_str(ar->cal_mode));
+        return 0;
 }
 
 static int ath10k_init_uart(struct ath10k *ar)
@@ -729,7 +788,11 @@ int ath10k_core_start(struct ath10k *ar, enum ath10k_firmware_mode mode)
                 goto err;
         }
 
-        status = ath10k_init_download_firmware(ar, mode);
+        status = ath10k_download_cal_data(ar);
+        if (status)
+                goto err;
+
+        status = ath10k_download_fw(ar, mode);
         if (status)
                 goto err;
 
@@ -846,9 +909,9 @@ int ath10k_core_start(struct ath10k *ar, enum ath10k_firmware_mode mode)
                 goto err_hif_stop;
 
         if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features))
-                ar->free_vdev_map = (1 << TARGET_10X_NUM_VDEVS) - 1;
+                ar->free_vdev_map = (1LL << TARGET_10X_NUM_VDEVS) - 1;
         else
-                ar->free_vdev_map = (1 << TARGET_NUM_VDEVS) - 1;
+                ar->free_vdev_map = (1LL << TARGET_NUM_VDEVS) - 1;
 
         INIT_LIST_HEAD(&ar->arvifs);
 
@@ -1084,6 +1147,7 @@ void ath10k_core_unregister(struct ath10k *ar)
 EXPORT_SYMBOL(ath10k_core_unregister);
 
 struct ath10k *ath10k_core_create(size_t priv_size, struct device *dev,
+                                  enum ath10k_bus bus,
                                   const struct ath10k_hif_ops *hif_ops)
 {
         struct ath10k *ar;
@@ -1100,6 +1164,7 @@ struct ath10k *ath10k_core_create(size_t priv_size, struct device *dev,
         ar->dev = dev;
 
         ar->hif.ops = hif_ops;
+        ar->hif.bus = bus;
 
         init_completion(&ar->scan.started);
         init_completion(&ar->scan.completed);
diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h
index fe531ea6926c..4ca6dc94dd05 100644
--- a/drivers/net/wireless/ath/ath10k/core.h
+++ b/drivers/net/wireless/ath/ath10k/core.h
@@ -63,6 +63,20 @@
 
 struct ath10k;
 
+enum ath10k_bus {
+        ATH10K_BUS_PCI,
+};
+
+static inline const char *ath10k_bus_str(enum ath10k_bus bus)
+{
+        switch (bus) {
+        case ATH10K_BUS_PCI:
+                return "pci";
+        }
+
+        return "unknown";
+}
+
 struct ath10k_skb_cb {
         dma_addr_t paddr;
         u8 vdev_id;
@@ -96,8 +110,6 @@ struct ath10k_bmi {
         bool done_sent;
 };
 
-#define ATH10K_MAX_MEM_REQS 16
-
 struct ath10k_mem_chunk {
         void *vaddr;
         dma_addr_t paddr;
@@ -115,17 +127,21 @@ struct ath10k_wmi {
         struct wmi_pdev_param_map *pdev_param;
 
         u32 num_mem_chunks;
-        struct ath10k_mem_chunk mem_chunks[ATH10K_MAX_MEM_REQS];
+        struct ath10k_mem_chunk mem_chunks[WMI_MAX_MEM_REQS];
 };
 
-struct ath10k_peer_stat {
+struct ath10k_fw_stats_peer {
+        struct list_head list;
+
         u8 peer_macaddr[ETH_ALEN];
         u32 peer_rssi;
         u32 peer_tx_rate;
         u32 peer_rx_rate; /* 10x only */
 };
 
-struct ath10k_target_stats {
+struct ath10k_fw_stats_pdev {
+        struct list_head list;
+
         /* PDEV stats */
         s32 ch_noise_floor;
         u32 tx_frame_count;
@@ -180,15 +196,11 @@ struct ath10k_target_stats {
         s32 phy_errs;
         s32 phy_err_drop;
         s32 mpdu_errs;
+};
 
-        /* VDEV STATS */
-
-        /* PEER STATS */
-        u8 peers;
-        struct ath10k_peer_stat peer_stat[TARGET_NUM_PEERS];
-
-        /* TODO: Beacon filter stats */
-
+struct ath10k_fw_stats {
+        struct list_head pdevs;
+        struct list_head peers;
 };
 
 struct ath10k_dfs_stats {
@@ -234,6 +246,8 @@ struct ath10k_vif {
         struct sk_buff *beacon;
         /* protected by data_lock */
         bool beacon_sent;
+        void *beacon_buf;
+        dma_addr_t beacon_paddr;
 
         struct ath10k *ar;
         struct ieee80211_vif *vif;
@@ -273,6 +287,7 @@ struct ath10k_vif {
         u8 force_sgi;
         bool use_cts_prot;
         int num_legacy_stations;
+        int txpower;
 };
 
 struct ath10k_vif_iter {
@@ -292,17 +307,19 @@ struct ath10k_fw_crash_data {
 struct ath10k_debug {
         struct dentry *debugfs_phy;
 
-        struct ath10k_target_stats target_stats;
+        struct ath10k_fw_stats fw_stats;
+        struct completion fw_stats_complete;
+        bool fw_stats_done;
         DECLARE_BITMAP(wmi_service_bitmap, WMI_SERVICE_MAX);
 
-        struct completion event_stats_compl;
-
         unsigned long htt_stats_mask;
         struct delayed_work htt_stats_dwork;
         struct ath10k_dfs_stats dfs_stats;
         struct ath_dfs_pool_stats dfs_pool_stats;
 
+        /* protected by conf_mutex */
         u32 fw_dbglog_mask;
+        u32 pktlog_filter;
 
         u8 htt_max_amsdu;
         u8 htt_max_ampdu;
@@ -321,7 +338,7 @@ enum ath10k_state {
          * stopped in ath10k_core_restart() work holding conf_mutex. The state
          * RESTARTED means that the device is up and mac80211 has started hw
          * reconfiguration. Once mac80211 is done with the reconfiguration we
-         * set the state to STATE_ON in restart_complete(). */
+         * set the state to STATE_ON in reconfig_complete(). */
         ATH10K_STATE_RESTARTING,
         ATH10K_STATE_RESTARTED,
 
@@ -371,6 +388,23 @@ enum ath10k_dev_flags {
         ATH10K_FLAG_CORE_REGISTERED,
 };
 
+enum ath10k_cal_mode {
+        ATH10K_CAL_MODE_FILE,
+        ATH10K_CAL_MODE_OTP,
+};
+
+static inline const char *ath10k_cal_mode_str(enum ath10k_cal_mode mode)
+{
+        switch (mode) {
+        case ATH10K_CAL_MODE_FILE:
+                return "file";
+        case ATH10K_CAL_MODE_OTP:
+                return "otp";
+        }
+
+        return "unknown";
+}
+
 enum ath10k_scan_state {
         ATH10K_SCAN_IDLE,
         ATH10K_SCAN_STARTING,
@@ -421,6 +455,7 @@ struct ath10k {
         bool p2p;
 
         struct {
+                enum ath10k_bus bus;
                 const struct ath10k_hif_ops *ops;
         } hif;
 
@@ -456,7 +491,10 @@ struct ath10k {
         const void *firmware_data;
         size_t firmware_len;
 
+        const struct firmware *cal_file;
+
         int fw_api;
+        enum ath10k_cal_mode cal_mode;
 
         struct {
                 struct completion started;
@@ -482,7 +520,7 @@ struct ath10k {
         /* current operating channel definition */
         struct cfg80211_chan_def chandef;
 
-        int free_vdev_map;
+        unsigned long long free_vdev_map;
         bool monitor;
         int monitor_vdev_id;
         bool monitor_started;
@@ -563,11 +601,19 @@ struct ath10k {
                 bool utf_monitor;
         } testmode;
 
+        struct {
+                /* protected by data_lock */
+                u32 fw_crash_counter;
+                u32 fw_warm_reset_counter;
+                u32 fw_cold_reset_counter;
+        } stats;
+
         /* must be last */
         u8 drv_priv[0] __aligned(sizeof(void *));
 };
 
 struct ath10k *ath10k_core_create(size_t priv_size, struct device *dev,
+                                  enum ath10k_bus bus,
                                   const struct ath10k_hif_ops *hif_ops);
 void ath10k_core_destroy(struct ath10k *ar);
 
diff --git a/drivers/net/wireless/ath/ath10k/debug.c b/drivers/net/wireless/ath/ath10k/debug.c
index 3756feba3223..9147dd36dcdd 100644
--- a/drivers/net/wireless/ath/ath10k/debug.c
+++ b/drivers/net/wireless/ath/ath10k/debug.c
@@ -23,6 +23,7 @@
 
 #include "core.h"
 #include "debug.h"
+#include "hif.h"
 
 /* ms */
 #define ATH10K_DEBUG_HTT_STATS_INTERVAL 1000
@@ -106,34 +107,36 @@ struct ath10k_dump_file_data {
         u8 data[0];
 } __packed;
 
-int ath10k_info(struct ath10k *ar, const char *fmt, ...)
+void ath10k_info(struct ath10k *ar, const char *fmt, ...)
 {
         struct va_format vaf = {
                 .fmt = fmt,
         };
         va_list args;
-        int ret;
 
         va_start(args, fmt);
         vaf.va = &args;
-        ret = dev_info(ar->dev, "%pV", &vaf);
+        dev_info(ar->dev, "%pV", &vaf);
         trace_ath10k_log_info(ar, &vaf);
         va_end(args);
-
-        return ret;
 }
 EXPORT_SYMBOL(ath10k_info);
 
 void ath10k_print_driver_info(struct ath10k *ar)
 {
-        ath10k_info(ar, "%s (0x%08x, 0x%08x) fw %s api %d htt %d.%d\n",
+        ath10k_info(ar, "%s (0x%08x, 0x%08x) fw %s api %d htt %d.%d wmi %d.%d.%d.%d cal %s\n",
                     ar->hw_params.name,
                     ar->target_version,
                     ar->chip_id,
                     ar->hw->wiphy->fw_version,
                     ar->fw_api,
                     ar->htt.target_version_major,
-                    ar->htt.target_version_minor);
+                    ar->htt.target_version_minor,
+                    ar->fw_version_major,
+                    ar->fw_version_minor,
+                    ar->fw_version_release,
+                    ar->fw_version_build,
+                    ath10k_cal_mode_str(ar->cal_mode));
         ath10k_info(ar, "debug %d debugfs %d tracing %d dfs %d testmode %d\n",
                     config_enabled(CONFIG_ATH10K_DEBUG),
                     config_enabled(CONFIG_ATH10K_DEBUGFS),
@@ -143,25 +146,22 @@ void ath10k_print_driver_info(struct ath10k *ar)
 }
 EXPORT_SYMBOL(ath10k_print_driver_info);
 
-int ath10k_err(struct ath10k *ar, const char *fmt, ...)
+void ath10k_err(struct ath10k *ar, const char *fmt, ...)
 {
         struct va_format vaf = {
                 .fmt = fmt,
         };
         va_list args;
-        int ret;
 
         va_start(args, fmt);
         vaf.va = &args;
-        ret = dev_err(ar->dev, "%pV", &vaf);
+        dev_err(ar->dev, "%pV", &vaf);
         trace_ath10k_log_err(ar, &vaf);
         va_end(args);
-
-        return ret;
 }
 EXPORT_SYMBOL(ath10k_err);
 
-int ath10k_warn(struct ath10k *ar, const char *fmt, ...)
+void ath10k_warn(struct ath10k *ar, const char *fmt, ...)
 {
         struct va_format vaf = {
                 .fmt = fmt,
@@ -174,15 +174,13 @@ int ath10k_warn(struct ath10k *ar, const char *fmt, ...)
         trace_ath10k_log_warn(ar, &vaf);
 
         va_end(args);
-
-        return 0;
 }
 EXPORT_SYMBOL(ath10k_warn);
 
 #ifdef CONFIG_ATH10K_DEBUGFS
 
 void ath10k_debug_read_service_map(struct ath10k *ar,
-                                   void *service_map,
+                                   const void *service_map,
                                    size_t map_size)
 {
         memcpy(ar->debug.wmi_service_bitmap, service_map, map_size);
@@ -242,169 +240,182 @@ static const struct file_operations fops_wmi_services = {
         .llseek = default_llseek,
 };
 
-void ath10k_debug_read_target_stats(struct ath10k *ar,
-                                    struct wmi_stats_event *ev)
+static void ath10k_debug_fw_stats_pdevs_free(struct list_head *head)
 {
-        u8 *tmp = ev->data;
-        struct ath10k_target_stats *stats;
-        int num_pdev_stats, num_vdev_stats, num_peer_stats;
-        struct wmi_pdev_stats_10x *ps;
-        int i;
+        struct ath10k_fw_stats_pdev *i, *tmp;
+
+        list_for_each_entry_safe(i, tmp, head, list) {
+                list_del(&i->list);
+                kfree(i);
+        }
+}
+
+static void ath10k_debug_fw_stats_peers_free(struct list_head *head)
+{
+        struct ath10k_fw_stats_peer *i, *tmp;
+
+        list_for_each_entry_safe(i, tmp, head, list) {
+                list_del(&i->list);
+                kfree(i);
+        }
+}
 
+static void ath10k_debug_fw_stats_reset(struct ath10k *ar)
+{
         spin_lock_bh(&ar->data_lock);
+        ar->debug.fw_stats_done = false;
+        ath10k_debug_fw_stats_pdevs_free(&ar->debug.fw_stats.pdevs);
+        ath10k_debug_fw_stats_peers_free(&ar->debug.fw_stats.peers);
+        spin_unlock_bh(&ar->data_lock);
+}
 
-        stats = &ar->debug.target_stats;
-
-        num_pdev_stats = __le32_to_cpu(ev->num_pdev_stats); /* 0 or 1 */
-        num_vdev_stats = __le32_to_cpu(ev->num_vdev_stats); /* 0 or max vdevs */
-        num_peer_stats = __le32_to_cpu(ev->num_peer_stats); /* 0 or max peers */
-
-        if (num_pdev_stats) {
-                ps = (struct wmi_pdev_stats_10x *)tmp;
-
-                stats->ch_noise_floor = __le32_to_cpu(ps->chan_nf);
-                stats->tx_frame_count = __le32_to_cpu(ps->tx_frame_count);
-                stats->rx_frame_count = __le32_to_cpu(ps->rx_frame_count);
-                stats->rx_clear_count = __le32_to_cpu(ps->rx_clear_count);
-                stats->cycle_count = __le32_to_cpu(ps->cycle_count);
-                stats->phy_err_count = __le32_to_cpu(ps->phy_err_count);
-                stats->chan_tx_power = __le32_to_cpu(ps->chan_tx_pwr);
-
-                stats->comp_queued = __le32_to_cpu(ps->wal.tx.comp_queued);
-                stats->comp_delivered =
-                        __le32_to_cpu(ps->wal.tx.comp_delivered);
-                stats->msdu_enqued = __le32_to_cpu(ps->wal.tx.msdu_enqued);
-                stats->mpdu_enqued = __le32_to_cpu(ps->wal.tx.mpdu_enqued);
-                stats->wmm_drop = __le32_to_cpu(ps->wal.tx.wmm_drop);
-                stats->local_enqued = __le32_to_cpu(ps->wal.tx.local_enqued);
-                stats->local_freed = __le32_to_cpu(ps->wal.tx.local_freed);
-                stats->hw_queued = __le32_to_cpu(ps->wal.tx.hw_queued);
-                stats->hw_reaped = __le32_to_cpu(ps->wal.tx.hw_reaped);
-                stats->underrun = __le32_to_cpu(ps->wal.tx.underrun);
-                stats->tx_abort = __le32_to_cpu(ps->wal.tx.tx_abort);
-                stats->mpdus_requed = __le32_to_cpu(ps->wal.tx.mpdus_requed);
-                stats->tx_ko = __le32_to_cpu(ps->wal.tx.tx_ko);
-                stats->data_rc = __le32_to_cpu(ps->wal.tx.data_rc);
-                stats->self_triggers = __le32_to_cpu(ps->wal.tx.self_triggers);
-                stats->sw_retry_failure =
-                        __le32_to_cpu(ps->wal.tx.sw_retry_failure);
-                stats->illgl_rate_phy_err =
-                        __le32_to_cpu(ps->wal.tx.illgl_rate_phy_err);
-                stats->pdev_cont_xretry =
-                        __le32_to_cpu(ps->wal.tx.pdev_cont_xretry);
-                stats->pdev_tx_timeout =
-                        __le32_to_cpu(ps->wal.tx.pdev_tx_timeout);
-                stats->pdev_resets = __le32_to_cpu(ps->wal.tx.pdev_resets);
-                stats->phy_underrun = __le32_to_cpu(ps->wal.tx.phy_underrun);
-                stats->txop_ovf = __le32_to_cpu(ps->wal.tx.txop_ovf);
-
-                stats->mid_ppdu_route_change =
-                        __le32_to_cpu(ps->wal.rx.mid_ppdu_route_change);
-                stats->status_rcvd = __le32_to_cpu(ps->wal.rx.status_rcvd);
-                stats->r0_frags = __le32_to_cpu(ps->wal.rx.r0_frags);
-                stats->r1_frags = __le32_to_cpu(ps->wal.rx.r1_frags);
-                stats->r2_frags = __le32_to_cpu(ps->wal.rx.r2_frags);
-                stats->r3_frags = __le32_to_cpu(ps->wal.rx.r3_frags);
-                stats->htt_msdus = __le32_to_cpu(ps->wal.rx.htt_msdus);
-                stats->htt_mpdus = __le32_to_cpu(ps->wal.rx.htt_mpdus);
-                stats->loc_msdus = __le32_to_cpu(ps->wal.rx.loc_msdus);
-                stats->loc_mpdus = __le32_to_cpu(ps->wal.rx.loc_mpdus);
-                stats->oversize_amsdu =
-                        __le32_to_cpu(ps->wal.rx.oversize_amsdu);
-                stats->phy_errs = __le32_to_cpu(ps->wal.rx.phy_errs);
-                stats->phy_err_drop = __le32_to_cpu(ps->wal.rx.phy_err_drop);
-                stats->mpdu_errs = __le32_to_cpu(ps->wal.rx.mpdu_errs);
-
-                if (test_bit(ATH10K_FW_FEATURE_WMI_10X,
-                             ar->fw_features)) {
-                        stats->ack_rx_bad = __le32_to_cpu(ps->ack_rx_bad);
-                        stats->rts_bad = __le32_to_cpu(ps->rts_bad);
-                        stats->rts_good = __le32_to_cpu(ps->rts_good);
-                        stats->fcs_bad = __le32_to_cpu(ps->fcs_bad);
-                        stats->no_beacons = __le32_to_cpu(ps->no_beacons);
-                        stats->mib_int_count = __le32_to_cpu(ps->mib_int_count);
-                        tmp += sizeof(struct wmi_pdev_stats_10x);
-                } else {
-                        tmp += sizeof(struct wmi_pdev_stats_old);
-                }
+static size_t ath10k_debug_fw_stats_num_peers(struct list_head *head)
+{
+        struct ath10k_fw_stats_peer *i;
+        size_t num = 0;
+
+        list_for_each_entry(i, head, list)
+                ++num;
+
+        return num;
+}
+
+void ath10k_debug_fw_stats_process(struct ath10k *ar, struct sk_buff *skb)
+{
+        struct ath10k_fw_stats stats = {};
+        bool is_start, is_started, is_end;
+        size_t num_peers;
+        int ret;
+
+        INIT_LIST_HEAD(&stats.pdevs);
+        INIT_LIST_HEAD(&stats.peers);
+
+        spin_lock_bh(&ar->data_lock);
+        ret = ath10k_wmi_pull_fw_stats(ar, skb, &stats);
+        if (ret) {
+                ath10k_warn(ar, "failed to pull fw stats: %d\n", ret);
+                goto unlock;
         }
 
-        /* 0 or max vdevs */
-        /* Currently firmware does not support VDEV stats */
-        if (num_vdev_stats) {
-                struct wmi_vdev_stats *vdev_stats;
+        /* Stat data may exceed htc-wmi buffer limit. In such case firmware
+         * splits the stats data and delivers it in a ping-pong fashion of
+         * request cmd-update event.
+         *
+         * However there is no explicit end-of-data. Instead start-of-data is
+         * used as an implicit one. This works as follows:
+         *  a) discard stat update events until one with pdev stats is
+         *     delivered - this skips session started at end of (b)
+         *  b) consume stat update events until another one with pdev stats is
+         *     delivered which is treated as end-of-data and is itself discarded
+         */
 
-                for (i = 0; i < num_vdev_stats; i++) {
-                        vdev_stats = (struct wmi_vdev_stats *)tmp;
-                        tmp += sizeof(struct wmi_vdev_stats);
-                }
+        if (ar->debug.fw_stats_done) {
+                ath10k_warn(ar, "received unsolicited stats update event\n");
+                goto free;
         }
 
-        if (num_peer_stats) {
-                struct wmi_peer_stats_10x *peer_stats;
-                struct ath10k_peer_stat *s;
-
-                stats->peers = num_peer_stats;
-
-                for (i = 0; i < num_peer_stats; i++) {
-                        peer_stats = (struct wmi_peer_stats_10x *)tmp;
-                        s = &stats->peer_stat[i];
-
-                        memcpy(s->peer_macaddr, &peer_stats->peer_macaddr.addr,
-                               ETH_ALEN);
-                        s->peer_rssi = __le32_to_cpu(peer_stats->peer_rssi);
-                        s->peer_tx_rate =
-                                __le32_to_cpu(peer_stats->peer_tx_rate);
-                        if (test_bit(ATH10K_FW_FEATURE_WMI_10X,
-                                     ar->fw_features)) {
-                                s->peer_rx_rate =
-                                        __le32_to_cpu(peer_stats->peer_rx_rate);
-                                tmp += sizeof(struct wmi_peer_stats_10x);
-
-                        } else {
-                                tmp += sizeof(struct wmi_peer_stats_old);
-                        }
+        num_peers = ath10k_debug_fw_stats_num_peers(&ar->debug.fw_stats.peers);
+        is_start = (list_empty(&ar->debug.fw_stats.pdevs) &&
+                    !list_empty(&stats.pdevs));
+        is_end = (!list_empty(&ar->debug.fw_stats.pdevs) &&
+                  !list_empty(&stats.pdevs));
+
+        if (is_start)
+                list_splice_tail_init(&stats.pdevs, &ar->debug.fw_stats.pdevs);
+
+        if (is_end)
+                ar->debug.fw_stats_done = true;
+
+        is_started = !list_empty(&ar->debug.fw_stats.pdevs);
+
+        if (is_started && !is_end) {
+                if (num_peers >= ATH10K_MAX_NUM_PEER_IDS) {
+                        /* Although this is unlikely impose a sane limit to
+                         * prevent firmware from DoS-ing the host.
+                         */
+                        ath10k_warn(ar, "dropping fw peer stats\n");
+                        goto free;
                 }
+
+                list_splice_tail_init(&stats.peers, &ar->debug.fw_stats.peers);
         }
 
+        complete(&ar->debug.fw_stats_complete);
+
+free:
+        /* In some cases lists have been spliced and cleared. Free up
+         * resources if that is not the case.
+         */
+        ath10k_debug_fw_stats_pdevs_free(&stats.pdevs);
+        ath10k_debug_fw_stats_peers_free(&stats.peers);
+
+unlock:
         spin_unlock_bh(&ar->data_lock);
-        complete(&ar->debug.event_stats_compl);
 }
 
-static ssize_t ath10k_read_fw_stats(struct file *file, char __user *user_buf,
-                                    size_t count, loff_t *ppos)
+static int ath10k_debug_fw_stats_request(struct ath10k *ar)
 {
-        struct ath10k *ar = file->private_data;
-        struct ath10k_target_stats *fw_stats;
-        char *buf = NULL;
-        unsigned int len = 0, buf_len = 8000;
-        ssize_t ret_cnt = 0;
-        long left;
-        int i;
+        unsigned long timeout;
         int ret;
 
-        fw_stats = &ar->debug.target_stats;
+        lockdep_assert_held(&ar->conf_mutex);
 
-        mutex_lock(&ar->conf_mutex);
+        timeout = jiffies + msecs_to_jiffies(1*HZ);
 
-        if (ar->state != ATH10K_STATE_ON)
-                goto exit;
+        ath10k_debug_fw_stats_reset(ar);
 
-        buf = kzalloc(buf_len, GFP_KERNEL);
-        if (!buf)
-                goto exit;
+        for (;;) {
+                if (time_after(jiffies, timeout))
+                        return -ETIMEDOUT;
 
-        ret = ath10k_wmi_request_stats(ar, WMI_REQUEST_PEER_STAT);
-        if (ret) {
-                ath10k_warn(ar, "could not request stats (%d)\n", ret);
-                goto exit;
+                reinit_completion(&ar->debug.fw_stats_complete);
+
+                ret = ath10k_wmi_request_stats(ar, WMI_REQUEST_PEER_STAT);
+                if (ret) {
+                        ath10k_warn(ar, "could not request stats (%d)\n", ret);
+                        return ret;
+                }
+
+                ret = wait_for_completion_timeout(&ar->debug.fw_stats_complete,
+                                                  1*HZ);
+                if (ret <= 0)
+                        return -ETIMEDOUT;
+
+                spin_lock_bh(&ar->data_lock);
+                if (ar->debug.fw_stats_done) {
+                        spin_unlock_bh(&ar->data_lock);
+                        break;
+                }
+                spin_unlock_bh(&ar->data_lock);
         }
 
-        left = wait_for_completion_timeout(&ar->debug.event_stats_compl, 1*HZ);
-        if (left <= 0)
-                goto exit;
+        return 0;
+}
+
+/* FIXME: How to calculate the buffer size sanely? */
+#define ATH10K_FW_STATS_BUF_SIZE (1024*1024)
+
+static void ath10k_fw_stats_fill(struct ath10k *ar,
+                                 struct ath10k_fw_stats *fw_stats,
+                                 char *buf)
+{
+        unsigned int len = 0;
+        unsigned int buf_len = ATH10K_FW_STATS_BUF_SIZE;
+        const struct ath10k_fw_stats_pdev *pdev;
+        const struct ath10k_fw_stats_peer *peer;
+        size_t num_peers;
 
         spin_lock_bh(&ar->data_lock);
+
+        pdev = list_first_entry_or_null(&fw_stats->pdevs,
+                                        struct ath10k_fw_stats_pdev, list);
+        if (!pdev) {
+                ath10k_warn(ar, "failed to get pdev stats\n");
+                goto unlock;
+        }
+
+        num_peers = ath10k_debug_fw_stats_num_peers(&fw_stats->peers);
+
         len += scnprintf(buf + len, buf_len - len, "\n");
         len += scnprintf(buf + len, buf_len - len, "%30s\n",
                          "ath10k PDEV stats");
@@ -412,29 +423,29 @@ static ssize_t ath10k_read_fw_stats(struct file *file, char __user *user_buf,
                                  "=================");
 
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "Channel noise floor", fw_stats->ch_noise_floor);
+                         "Channel noise floor", pdev->ch_noise_floor);
         len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
-                         "Channel TX power", fw_stats->chan_tx_power);
+                         "Channel TX power", pdev->chan_tx_power);
         len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
-                         "TX frame count", fw_stats->tx_frame_count);
+                         "TX frame count", pdev->tx_frame_count);
         len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
-                         "RX frame count", fw_stats->rx_frame_count);
+                         "RX frame count", pdev->rx_frame_count);
         len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
-                         "RX clear count", fw_stats->rx_clear_count);
+                         "RX clear count", pdev->rx_clear_count);
         len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
-                         "Cycle count", fw_stats->cycle_count);
+                         "Cycle count", pdev->cycle_count);
         len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
-                         "PHY error count", fw_stats->phy_err_count);
+                         "PHY error count", pdev->phy_err_count);
         len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
-                         "RTS bad count", fw_stats->rts_bad);
+                         "RTS bad count", pdev->rts_bad);
         len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
-                         "RTS good count", fw_stats->rts_good);
+                         "RTS good count", pdev->rts_good);
         len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
-                         "FCS bad count", fw_stats->fcs_bad);
+                         "FCS bad count", pdev->fcs_bad);
         len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
-                         "No beacon count", fw_stats->no_beacons);
+                         "No beacon count", pdev->no_beacons);
         len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
-                         "MIB int count", fw_stats->mib_int_count);
+                         "MIB int count", pdev->mib_int_count);
 
         len += scnprintf(buf + len, buf_len - len, "\n");
         len += scnprintf(buf + len, buf_len - len, "%30s\n",
@@ -443,51 +454,51 @@ static ssize_t ath10k_read_fw_stats(struct file *file, char __user *user_buf,
                                  "=================");
 
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "HTT cookies queued", fw_stats->comp_queued);
+                         "HTT cookies queued", pdev->comp_queued);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "HTT cookies disp.", fw_stats->comp_delivered);
+                         "HTT cookies disp.", pdev->comp_delivered);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "MSDU queued", fw_stats->msdu_enqued);
+                         "MSDU queued", pdev->msdu_enqued);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "MPDU queued", fw_stats->mpdu_enqued);
+                         "MPDU queued", pdev->mpdu_enqued);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "MSDUs dropped", fw_stats->wmm_drop);
+                         "MSDUs dropped", pdev->wmm_drop);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "Local enqued", fw_stats->local_enqued);
+                         "Local enqued", pdev->local_enqued);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "Local freed", fw_stats->local_freed);
+                         "Local freed", pdev->local_freed);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "HW queued", fw_stats->hw_queued);
+                         "HW queued", pdev->hw_queued);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "PPDUs reaped", fw_stats->hw_reaped);
+                         "PPDUs reaped", pdev->hw_reaped);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "Num underruns", fw_stats->underrun);
+                         "Num underruns", pdev->underrun);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "PPDUs cleaned", fw_stats->tx_abort);
+                         "PPDUs cleaned", pdev->tx_abort);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "MPDUs requed", fw_stats->mpdus_requed);
+                         "MPDUs requed", pdev->mpdus_requed);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "Excessive retries", fw_stats->tx_ko);
+                         "Excessive retries", pdev->tx_ko);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "HW rate", fw_stats->data_rc);
+                         "HW rate", pdev->data_rc);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "Sched self tiggers", fw_stats->self_triggers);
+                         "Sched self tiggers", pdev->self_triggers);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
                          "Dropped due to SW retries",
-                         fw_stats->sw_retry_failure);
+                         pdev->sw_retry_failure);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
                          "Illegal rate phy errors",
-                         fw_stats->illgl_rate_phy_err);
+                         pdev->illgl_rate_phy_err);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "Pdev continous xretry", fw_stats->pdev_cont_xretry);
+                         "Pdev continous xretry", pdev->pdev_cont_xretry);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "TX timeout", fw_stats->pdev_tx_timeout);
+                         "TX timeout", pdev->pdev_tx_timeout);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "PDEV resets", fw_stats->pdev_resets);
+                         "PDEV resets", pdev->pdev_resets);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "PHY underrun", fw_stats->phy_underrun);
+                         "PHY underrun", pdev->phy_underrun);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "MPDU is more than txop limit", fw_stats->txop_ovf);
+                         "MPDU is more than txop limit", pdev->txop_ovf);
 
         len += scnprintf(buf + len, buf_len - len, "\n");
         len += scnprintf(buf + len, buf_len - len, "%30s\n",
@@ -497,70 +508,161 @@ static ssize_t ath10k_read_fw_stats(struct file *file, char __user *user_buf,
 
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
                          "Mid PPDU route change",
-                         fw_stats->mid_ppdu_route_change);
+                         pdev->mid_ppdu_route_change);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "Tot. number of statuses", fw_stats->status_rcvd);
+                         "Tot. number of statuses", pdev->status_rcvd);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "Extra frags on rings 0", fw_stats->r0_frags);
+                         "Extra frags on rings 0", pdev->r0_frags);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "Extra frags on rings 1", fw_stats->r1_frags);
+                         "Extra frags on rings 1", pdev->r1_frags);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "Extra frags on rings 2", fw_stats->r2_frags);
+                         "Extra frags on rings 2", pdev->r2_frags);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "Extra frags on rings 3", fw_stats->r3_frags);
+                         "Extra frags on rings 3", pdev->r3_frags);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "MSDUs delivered to HTT", fw_stats->htt_msdus);
+                         "MSDUs delivered to HTT", pdev->htt_msdus);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "MPDUs delivered to HTT", fw_stats->htt_mpdus);
+                         "MPDUs delivered to HTT", pdev->htt_mpdus);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "MSDUs delivered to stack", fw_stats->loc_msdus);
+                         "MSDUs delivered to stack", pdev->loc_msdus);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "MPDUs delivered to stack", fw_stats->loc_mpdus);
+                         "MPDUs delivered to stack", pdev->loc_mpdus);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "Oversized AMSUs", fw_stats->oversize_amsdu);
+                         "Oversized AMSUs", pdev->oversize_amsdu);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "PHY errors", fw_stats->phy_errs);
+                         "PHY errors", pdev->phy_errs);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "PHY errors drops", fw_stats->phy_err_drop);
+                         "PHY errors drops", pdev->phy_err_drop);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "MPDU errors (FCS, MIC, ENC)", fw_stats->mpdu_errs);
+                         "MPDU errors (FCS, MIC, ENC)", pdev->mpdu_errs);
 
         len += scnprintf(buf + len, buf_len - len, "\n");
-        len += scnprintf(buf + len, buf_len - len, "%30s (%d)\n",
-                         "ath10k PEER stats", fw_stats->peers);
+        len += scnprintf(buf + len, buf_len - len, "%30s (%zu)\n",
+                         "ath10k PEER stats", num_peers);
         len += scnprintf(buf + len, buf_len - len, "%30s\n\n",
                                  "=================");
 
-        for (i = 0; i < fw_stats->peers; i++) {
+        list_for_each_entry(peer, &fw_stats->peers, list) {
                 len += scnprintf(buf + len, buf_len - len, "%30s %pM\n",
-                                 "Peer MAC address",
-                                 fw_stats->peer_stat[i].peer_macaddr);
+                                 "Peer MAC address", peer->peer_macaddr);
                 len += scnprintf(buf + len, buf_len - len, "%30s %u\n",
-                                 "Peer RSSI", fw_stats->peer_stat[i].peer_rssi);
+                                 "Peer RSSI", peer->peer_rssi);
                 len += scnprintf(buf + len, buf_len - len, "%30s %u\n",
-                                 "Peer TX rate",
-                                 fw_stats->peer_stat[i].peer_tx_rate);
+                                 "Peer TX rate", peer->peer_tx_rate);
                 len += scnprintf(buf + len, buf_len - len, "%30s %u\n",
-                                 "Peer RX rate",
-                                 fw_stats->peer_stat[i].peer_rx_rate);
+                                 "Peer RX rate", peer->peer_rx_rate);
                 len += scnprintf(buf + len, buf_len - len, "\n");
         }
+
+unlock:
         spin_unlock_bh(&ar->data_lock);
 
-        if (len > buf_len)
-                len = buf_len;
+        if (len >= buf_len)
+                buf[len - 1] = 0;
+        else
+                buf[len] = 0;
+}
 
-        ret_cnt = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+static int ath10k_fw_stats_open(struct inode *inode, struct file *file)
+{
+        struct ath10k *ar = inode->i_private;
+        void *buf = NULL;
+        int ret;
+
+        mutex_lock(&ar->conf_mutex);
+
+        if (ar->state != ATH10K_STATE_ON) {
+                ret = -ENETDOWN;
+                goto err_unlock;
+        }
+
+        buf = vmalloc(ATH10K_FW_STATS_BUF_SIZE);
+        if (!buf) {
+                ret = -ENOMEM;
+                goto err_unlock;
+        }
+
+        ret = ath10k_debug_fw_stats_request(ar);
+        if (ret) {
+                ath10k_warn(ar, "failed to request fw stats: %d\n", ret);
+                goto err_free;
+        }
+
+        ath10k_fw_stats_fill(ar, &ar->debug.fw_stats, buf);
+        file->private_data = buf;
 
-exit:
         mutex_unlock(&ar->conf_mutex);
-        kfree(buf);
-        return ret_cnt;
+        return 0;
+
+err_free:
+        vfree(buf);
+
+err_unlock:
+        mutex_unlock(&ar->conf_mutex);
+        return ret;
+}
+
+static int ath10k_fw_stats_release(struct inode *inode, struct file *file)
+{
+        vfree(file->private_data);
+
+        return 0;
+}
+
+static ssize_t ath10k_fw_stats_read(struct file *file, char __user *user_buf,
+                                    size_t count, loff_t *ppos)
+{
+        const char *buf = file->private_data;
+        unsigned int len = strlen(buf);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
 }
 
 static const struct file_operations fops_fw_stats = {
-        .read = ath10k_read_fw_stats,
+        .open = ath10k_fw_stats_open,
+        .release = ath10k_fw_stats_release,
+        .read = ath10k_fw_stats_read,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+static ssize_t ath10k_debug_fw_reset_stats_read(struct file *file,
+                                                char __user *user_buf,
+                                                size_t count, loff_t *ppos)
+{
+        struct ath10k *ar = file->private_data;
+        int ret, len, buf_len;
+        char *buf;
+
+        buf_len = 500;
+        buf = kmalloc(buf_len, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        spin_lock_bh(&ar->data_lock);
+
+        len = 0;
+        len += scnprintf(buf + len, buf_len - len,
+                         "fw_crash_counter\t\t%d\n", ar->stats.fw_crash_counter);
+        len += scnprintf(buf + len, buf_len - len,
+                         "fw_warm_reset_counter\t\t%d\n",
+                         ar->stats.fw_warm_reset_counter);
+        len += scnprintf(buf + len, buf_len - len,
+                         "fw_cold_reset_counter\t\t%d\n",
+                         ar->stats.fw_cold_reset_counter);
+
+        spin_unlock_bh(&ar->data_lock);
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+
+        kfree(buf);
+
+        return ret;
+}
+
+static const struct file_operations fops_fw_reset_stats = {
         .open = simple_open,
+        .read = ath10k_debug_fw_reset_stats_read,
         .owner = THIS_MODULE,
         .llseek = default_llseek,
 };
@@ -1029,6 +1131,166 @@ exit:
         return ret;
 }
 
+/* TODO:  Would be nice to always support ethtool stats, would need to
+ * move the stats storage out of ath10k_debug, or always have ath10k_debug
+ * struct available..
+ */
+
+/* This generally cooresponds to the debugfs fw_stats file */
+static const char ath10k_gstrings_stats[][ETH_GSTRING_LEN] = {
+        "tx_pkts_nic",
+        "tx_bytes_nic",
+        "rx_pkts_nic",
+        "rx_bytes_nic",
+        "d_noise_floor",
+        "d_cycle_count",
+        "d_phy_error",
+        "d_rts_bad",
+        "d_rts_good",
+        "d_tx_power", /* in .5 dbM I think */
+        "d_rx_crc_err", /* fcs_bad */
+        "d_no_beacon",
+        "d_tx_mpdus_queued",
+        "d_tx_msdu_queued",
+        "d_tx_msdu_dropped",
+        "d_local_enqued",
+        "d_local_freed",
+        "d_tx_ppdu_hw_queued",
+        "d_tx_ppdu_reaped",
+        "d_tx_fifo_underrun",
+        "d_tx_ppdu_abort",
+        "d_tx_mpdu_requed",
+        "d_tx_excessive_retries",
+        "d_tx_hw_rate",
+        "d_tx_dropped_sw_retries",
+        "d_tx_illegal_rate",
+        "d_tx_continuous_xretries",
+        "d_tx_timeout",
+        "d_tx_mpdu_txop_limit",
+        "d_pdev_resets",
+        "d_rx_mid_ppdu_route_change",
+        "d_rx_status",
+        "d_rx_extra_frags_ring0",
+        "d_rx_extra_frags_ring1",
+        "d_rx_extra_frags_ring2",
+        "d_rx_extra_frags_ring3",
+        "d_rx_msdu_htt",
+        "d_rx_mpdu_htt",
+        "d_rx_msdu_stack",
+        "d_rx_mpdu_stack",
+        "d_rx_phy_err",
+        "d_rx_phy_err_drops",
+        "d_rx_mpdu_errors", /* FCS, MIC, ENC */
+        "d_fw_crash_count",
+        "d_fw_warm_reset_count",
+        "d_fw_cold_reset_count",
+};
+
+#define ATH10K_SSTATS_LEN ARRAY_SIZE(ath10k_gstrings_stats)
+
+void ath10k_debug_get_et_strings(struct ieee80211_hw *hw,
+                                 struct ieee80211_vif *vif,
+                                 u32 sset, u8 *data)
+{
+        if (sset == ETH_SS_STATS)
+                memcpy(data, *ath10k_gstrings_stats,
+                       sizeof(ath10k_gstrings_stats));
+}
+
+int ath10k_debug_get_et_sset_count(struct ieee80211_hw *hw,
+                                   struct ieee80211_vif *vif, int sset)
+{
+        if (sset == ETH_SS_STATS)
+                return ATH10K_SSTATS_LEN;
+
+        return 0;
+}
+
+void ath10k_debug_get_et_stats(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif,
+                               struct ethtool_stats *stats, u64 *data)
+{
+        struct ath10k *ar = hw->priv;
+        static const struct ath10k_fw_stats_pdev zero_stats = {};
+        const struct ath10k_fw_stats_pdev *pdev_stats;
+        int i = 0, ret;
+
+        mutex_lock(&ar->conf_mutex);
+
+        if (ar->state == ATH10K_STATE_ON) {
+                ret = ath10k_debug_fw_stats_request(ar);
+                if (ret) {
+                        /* just print a warning and try to use older results */
+                        ath10k_warn(ar,
+                                    "failed to get fw stats for ethtool: %d\n",
+                                    ret);
+                }
+        }
+
+        pdev_stats = list_first_entry_or_null(&ar->debug.fw_stats.pdevs,
+                                              struct ath10k_fw_stats_pdev,
+                                              list);
+        if (!pdev_stats) {
+                /* no results available so just return zeroes */
+                pdev_stats = &zero_stats;
+        }
+
+        spin_lock_bh(&ar->data_lock);
+
+        data[i++] = pdev_stats->hw_reaped; /* ppdu reaped */
+        data[i++] = 0; /* tx bytes */
+        data[i++] = pdev_stats->htt_mpdus;
+        data[i++] = 0; /* rx bytes */
+        data[i++] = pdev_stats->ch_noise_floor;
+        data[i++] = pdev_stats->cycle_count;
+        data[i++] = pdev_stats->phy_err_count;
+        data[i++] = pdev_stats->rts_bad;
+        data[i++] = pdev_stats->rts_good;
+        data[i++] = pdev_stats->chan_tx_power;
+        data[i++] = pdev_stats->fcs_bad;
+        data[i++] = pdev_stats->no_beacons;
+        data[i++] = pdev_stats->mpdu_enqued;
+        data[i++] = pdev_stats->msdu_enqued;
+        data[i++] = pdev_stats->wmm_drop;
+        data[i++] = pdev_stats->local_enqued;
+        data[i++] = pdev_stats->local_freed;
+        data[i++] = pdev_stats->hw_queued;
+        data[i++] = pdev_stats->hw_reaped;
+        data[i++] = pdev_stats->underrun;
+        data[i++] = pdev_stats->tx_abort;
+        data[i++] = pdev_stats->mpdus_requed;
+        data[i++] = pdev_stats->tx_ko;
+        data[i++] = pdev_stats->data_rc;
+        data[i++] = pdev_stats->sw_retry_failure;
+        data[i++] = pdev_stats->illgl_rate_phy_err;
+        data[i++] = pdev_stats->pdev_cont_xretry;
+        data[i++] = pdev_stats->pdev_tx_timeout;
+        data[i++] = pdev_stats->txop_ovf;
+        data[i++] = pdev_stats->pdev_resets;
+        data[i++] = pdev_stats->mid_ppdu_route_change;
+        data[i++] = pdev_stats->status_rcvd;
+        data[i++] = pdev_stats->r0_frags;
+        data[i++] = pdev_stats->r1_frags;
+        data[i++] = pdev_stats->r2_frags;
+        data[i++] = pdev_stats->r3_frags;
+        data[i++] = pdev_stats->htt_msdus;
+        data[i++] = pdev_stats->htt_mpdus;
+        data[i++] = pdev_stats->loc_msdus;
+        data[i++] = pdev_stats->loc_mpdus;
+        data[i++] = pdev_stats->phy_errs;
+        data[i++] = pdev_stats->phy_err_drop;
+        data[i++] = pdev_stats->mpdu_errs;
+        data[i++] = ar->stats.fw_crash_counter;
+        data[i++] = ar->stats.fw_warm_reset_counter;
+        data[i++] = ar->stats.fw_cold_reset_counter;
+
+        spin_unlock_bh(&ar->data_lock);
+
+        mutex_unlock(&ar->conf_mutex);
+
+        WARN_ON(i != ATH10K_SSTATS_LEN);
+}
+
 static const struct file_operations fops_fw_dbglog = {
         .read = ath10k_read_fw_dbglog,
         .write = ath10k_write_fw_dbglog,
@@ -1037,6 +1299,84 @@ static const struct file_operations fops_fw_dbglog = {
         .llseek = default_llseek,
 };
 
+static int ath10k_debug_cal_data_open(struct inode *inode, struct file *file)
+{
+        struct ath10k *ar = inode->i_private;
+        void *buf;
+        u32 hi_addr;
+        __le32 addr;
+        int ret;
+
+        mutex_lock(&ar->conf_mutex);
+
+        if (ar->state != ATH10K_STATE_ON &&
+            ar->state != ATH10K_STATE_UTF) {
+                ret = -ENETDOWN;
+                goto err;
+        }
+
+        buf = vmalloc(QCA988X_CAL_DATA_LEN);
+        if (!buf) {
+                ret = -ENOMEM;
+                goto err;
+        }
+
+        hi_addr = host_interest_item_address(HI_ITEM(hi_board_data));
+
+        ret = ath10k_hif_diag_read(ar, hi_addr, &addr, sizeof(addr));
+        if (ret) {
+                ath10k_warn(ar, "failed to read hi_board_data address: %d\n", ret);
+                goto err_vfree;
+        }
+
+        ret = ath10k_hif_diag_read(ar, le32_to_cpu(addr), buf,
+                                   QCA988X_CAL_DATA_LEN);
+        if (ret) {
+                ath10k_warn(ar, "failed to read calibration data: %d\n", ret);
+                goto err_vfree;
+        }
+
+        file->private_data = buf;
+
+        mutex_unlock(&ar->conf_mutex);
+
+        return 0;
+
+err_vfree:
+        vfree(buf);
+
+err:
+        mutex_unlock(&ar->conf_mutex);
+
+        return ret;
+}
+
+static ssize_t ath10k_debug_cal_data_read(struct file *file,
+                                          char __user *user_buf,
+                                          size_t count, loff_t *ppos)
+{
+        void *buf = file->private_data;
+
+        return simple_read_from_buffer(user_buf, count, ppos,
+                                       buf, QCA988X_CAL_DATA_LEN);
+}
+
+static int ath10k_debug_cal_data_release(struct inode *inode,
+                                         struct file *file)
+{
+        vfree(file->private_data);
+
+        return 0;
+}
+
+static const struct file_operations fops_cal_data = {
+        .open = ath10k_debug_cal_data_open,
+        .read = ath10k_debug_cal_data_read,
+        .release = ath10k_debug_cal_data_release,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
 int ath10k_debug_start(struct ath10k *ar)
 {
         int ret;
@@ -1057,7 +1397,22 @@ int ath10k_debug_start(struct ath10k *ar)
                                     ret);
         }
 
-        return 0;
+        if (ar->debug.pktlog_filter) {
+                ret = ath10k_wmi_pdev_pktlog_enable(ar,
+                                                    ar->debug.pktlog_filter);
+                if (ret)
+                        /* not serious */
+                        ath10k_warn(ar,
+                                    "failed to enable pktlog filter %x: %d\n",
+                                    ar->debug.pktlog_filter, ret);
+        } else {
+                ret = ath10k_wmi_pdev_pktlog_disable(ar);
+                if (ret)
+                        /* not serious */
+                        ath10k_warn(ar, "failed to disable pktlog: %d\n", ret);
+        }
+
+        return ret;
 }
 
 void ath10k_debug_stop(struct ath10k *ar)
@@ -1072,6 +1427,8 @@ void ath10k_debug_stop(struct ath10k *ar)
 
         ar->debug.htt_max_amsdu = 0;
         ar->debug.htt_max_ampdu = 0;
+
+        ath10k_wmi_pdev_pktlog_disable(ar);
 }
 
 static ssize_t ath10k_write_simulate_radar(struct file *file,
@@ -1154,12 +1511,78 @@ static const struct file_operations fops_dfs_stats = {
         .llseek = default_llseek,
 };
 
+static ssize_t ath10k_write_pktlog_filter(struct file *file,
+                                          const char __user *ubuf,
+                                          size_t count, loff_t *ppos)
+{
+        struct ath10k *ar = file->private_data;
+        u32 filter;
+        int ret;
+
+        if (kstrtouint_from_user(ubuf, count, 0, &filter))
+                return -EINVAL;
+
+        mutex_lock(&ar->conf_mutex);
+
+        if (ar->state != ATH10K_STATE_ON) {
+                ar->debug.pktlog_filter = filter;
+                ret = count;
+                goto out;
+        }
+
+        if (filter && (filter != ar->debug.pktlog_filter)) {
+                ret = ath10k_wmi_pdev_pktlog_enable(ar, filter);
+                if (ret) {
+                        ath10k_warn(ar, "failed to enable pktlog filter %x: %d\n",
+                                    ar->debug.pktlog_filter, ret);
+                        goto out;
+                }
+        } else {
+                ret = ath10k_wmi_pdev_pktlog_disable(ar);
+                if (ret) {
+                        ath10k_warn(ar, "failed to disable pktlog: %d\n", ret);
+                        goto out;
+                }
+        }
+
+        ar->debug.pktlog_filter = filter;
+        ret = count;
+
+out:
+        mutex_unlock(&ar->conf_mutex);
+        return ret;
+}
+
+static ssize_t ath10k_read_pktlog_filter(struct file *file, char __user *ubuf,
+                                         size_t count, loff_t *ppos)
+{
+        char buf[32];
+        struct ath10k *ar = file->private_data;
+        int len = 0;
+
+        mutex_lock(&ar->conf_mutex);
+        len = scnprintf(buf, sizeof(buf) - len, "%08x\n",
+                        ar->debug.pktlog_filter);
+        mutex_unlock(&ar->conf_mutex);
+
+        return simple_read_from_buffer(ubuf, count, ppos, buf, len);
+}
+
+static const struct file_operations fops_pktlog_filter = {
+        .read = ath10k_read_pktlog_filter,
+        .write = ath10k_write_pktlog_filter,
+        .open = simple_open
+};
+
 int ath10k_debug_create(struct ath10k *ar)
 {
         ar->debug.fw_crash_data = vzalloc(sizeof(*ar->debug.fw_crash_data));
         if (!ar->debug.fw_crash_data)
                 return -ENOMEM;
 
+        INIT_LIST_HEAD(&ar->debug.fw_stats.pdevs);
+        INIT_LIST_HEAD(&ar->debug.fw_stats.peers);
+
         return 0;
 }
 
@@ -1167,6 +1590,8 @@ void ath10k_debug_destroy(struct ath10k *ar)
 {
         vfree(ar->debug.fw_crash_data);
         ar->debug.fw_crash_data = NULL;
+
+        ath10k_debug_fw_stats_reset(ar);
 }
 
 int ath10k_debug_register(struct ath10k *ar)
@@ -1183,11 +1608,14 @@ int ath10k_debug_register(struct ath10k *ar)
         INIT_DELAYED_WORK(&ar->debug.htt_stats_dwork,
                           ath10k_debug_htt_stats_dwork);
 
-        init_completion(&ar->debug.event_stats_compl);
+        init_completion(&ar->debug.fw_stats_complete);
 
         debugfs_create_file("fw_stats", S_IRUSR, ar->debug.debugfs_phy, ar,
                             &fops_fw_stats);
 
+        debugfs_create_file("fw_reset_stats", S_IRUSR, ar->debug.debugfs_phy,
+                            ar, &fops_fw_reset_stats);
+
         debugfs_create_file("wmi_services", S_IRUSR, ar->debug.debugfs_phy, ar,
                             &fops_wmi_services);
 
@@ -1210,6 +1638,9 @@ int ath10k_debug_register(struct ath10k *ar)
         debugfs_create_file("fw_dbglog", S_IRUSR, ar->debug.debugfs_phy,
                             ar, &fops_fw_dbglog);
 
+        debugfs_create_file("cal_data", S_IRUSR, ar->debug.debugfs_phy,
+                            ar, &fops_cal_data);
+
         if (config_enabled(CONFIG_ATH10K_DFS_CERTIFIED)) {
                 debugfs_create_file("dfs_simulate_radar", S_IWUSR,
                                     ar->debug.debugfs_phy, ar,
@@ -1224,6 +1655,9 @@ int ath10k_debug_register(struct ath10k *ar)
                                     &fops_dfs_stats);
         }
 
+        debugfs_create_file("pktlog_filter", S_IRUGO | S_IWUSR,
+                            ar->debug.debugfs_phy, ar, &fops_pktlog_filter);
+
         return 0;
 }
 
@@ -1260,11 +1694,26 @@ void ath10k_dbg_dump(struct ath10k *ar,
                      const char *msg, const char *prefix,
                      const void *buf, size_t len)
 {
+        char linebuf[256];
+        unsigned int linebuflen;
+        const void *ptr;
+
         if (ath10k_debug_mask & mask) {
                 if (msg)
                         ath10k_dbg(ar, mask, "%s\n", msg);
 
-                print_hex_dump_bytes(prefix, DUMP_PREFIX_OFFSET, buf, len);
+                for (ptr = buf; (ptr - buf) < len; ptr += 16) {
+                        linebuflen = 0;
+                        linebuflen += scnprintf(linebuf + linebuflen,
+                                                sizeof(linebuf) - linebuflen,
+                                                "%s%08x: ",
+                                                (prefix ? prefix : ""),
+                                                (unsigned int)(ptr - buf));
+                        hex_dump_to_buffer(ptr, len - (ptr - buf), 16, 1,
+                                           linebuf + linebuflen,
+                                           sizeof(linebuf) - linebuflen, true);
+                        dev_printk(KERN_DEBUG, ar->dev, "%s\n", linebuf);
+                }
         }
 
         /* tracing code doesn't like null strings :/ */
diff --git a/drivers/net/wireless/ath/ath10k/debug.h b/drivers/net/wireless/ath/ath10k/debug.h
index b3774f7f492c..0c934a8378db 100644
--- a/drivers/net/wireless/ath/ath10k/debug.h
+++ b/drivers/net/wireless/ath/ath10k/debug.h
@@ -38,11 +38,20 @@ enum ath10k_debug_mask {
         ATH10K_DBG_ANY          = 0xffffffff,
 };
 
+enum ath10k_pktlog_filter {
+        ATH10K_PKTLOG_RX         = 0x000000001,
+        ATH10K_PKTLOG_TX         = 0x000000002,
+        ATH10K_PKTLOG_RCFIND     = 0x000000004,
+        ATH10K_PKTLOG_RCUPDATE   = 0x000000008,
+        ATH10K_PKTLOG_DBG_PRINT  = 0x000000010,
+        ATH10K_PKTLOG_ANY        = 0x00000001f,
+};
+
 extern unsigned int ath10k_debug_mask;
 
-__printf(2, 3) int ath10k_info(struct ath10k *ar, const char *fmt, ...);
-__printf(2, 3) int ath10k_err(struct ath10k *ar, const char *fmt, ...);
-__printf(2, 3) int ath10k_warn(struct ath10k *ar, const char *fmt, ...);
+__printf(2, 3) void ath10k_info(struct ath10k *ar, const char *fmt, ...);
+__printf(2, 3) void ath10k_err(struct ath10k *ar, const char *fmt, ...);
+__printf(2, 3) void ath10k_warn(struct ath10k *ar, const char *fmt, ...);
 void ath10k_print_driver_info(struct ath10k *ar);
 
 #ifdef CONFIG_ATH10K_DEBUGFS
@@ -53,17 +62,24 @@ void ath10k_debug_destroy(struct ath10k *ar);
 int ath10k_debug_register(struct ath10k *ar);
 void ath10k_debug_unregister(struct ath10k *ar);
 void ath10k_debug_read_service_map(struct ath10k *ar,
-                                   void *service_map,
+                                   const void *service_map,
                                    size_t map_size);
-void ath10k_debug_read_target_stats(struct ath10k *ar,
-                                    struct wmi_stats_event *ev);
+void ath10k_debug_fw_stats_process(struct ath10k *ar, struct sk_buff *skb);
 struct ath10k_fw_crash_data *
 ath10k_debug_get_new_fw_crash_data(struct ath10k *ar);
 
 void ath10k_debug_dbglog_add(struct ath10k *ar, u8 *buffer, int len);
-
 #define ATH10K_DFS_STAT_INC(ar, c) (ar->debug.dfs_stats.c++)
 
+void ath10k_debug_get_et_strings(struct ieee80211_hw *hw,
+                                 struct ieee80211_vif *vif,
+                                 u32 sset, u8 *data);
+int ath10k_debug_get_et_sset_count(struct ieee80211_hw *hw,
+                                   struct ieee80211_vif *vif, int sset);
+void ath10k_debug_get_et_stats(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif,
+                               struct ethtool_stats *stats, u64 *data);
+
 #else
 static inline int ath10k_debug_start(struct ath10k *ar)
 {
@@ -93,13 +109,13 @@ static inline void ath10k_debug_unregister(struct ath10k *ar)
 }
 
 static inline void ath10k_debug_read_service_map(struct ath10k *ar,
-                                                 void *service_map,
+                                                 const void *service_map,
                                                  size_t map_size)
 {
 }
 
-static inline void ath10k_debug_read_target_stats(struct ath10k *ar,
-                                                  struct wmi_stats_event *ev)
+static inline void ath10k_debug_fw_stats_process(struct ath10k *ar,
+                                                 struct sk_buff *skb)
 {
 }
 
@@ -116,6 +132,10 @@ ath10k_debug_get_new_fw_crash_data(struct ath10k *ar)
 
 #define ATH10K_DFS_STAT_INC(ar, c) do { } while (0)
 
+#define ath10k_debug_get_et_strings NULL
+#define ath10k_debug_get_et_sset_count NULL
+#define ath10k_debug_get_et_stats NULL
+
 #endif /* CONFIG_ATH10K_DEBUGFS */
 
 #ifdef CONFIG_ATH10K_DEBUG
diff --git a/drivers/net/wireless/ath/ath10k/hif.h b/drivers/net/wireless/ath/ath10k/hif.h
index 62323fea27e1..30301f5b6051 100644
--- a/drivers/net/wireless/ath/ath10k/hif.h
+++ b/drivers/net/wireless/ath/ath10k/hif.h
@@ -43,6 +43,10 @@ struct ath10k_hif_ops {
         int (*tx_sg)(struct ath10k *ar, u8 pipe_id,
                      struct ath10k_hif_sg_item *items, int n_items);
 
+        /* read firmware memory through the diagnose interface */
+        int (*diag_read)(struct ath10k *ar, u32 address, void *buf,
+                         size_t buf_len);
+
         /*
          * API to handle HIF-specific BMI message exchanges, this API is
          * synchronous and only allowed to be called from a context that
@@ -98,6 +102,12 @@ static inline int ath10k_hif_tx_sg(struct ath10k *ar, u8 pipe_id,
         return ar->hif.ops->tx_sg(ar, pipe_id, items, n_items);
 }
 
+static inline int ath10k_hif_diag_read(struct ath10k *ar, u32 address, void *buf,
+                                       size_t buf_len)
+{
+        return ar->hif.ops->diag_read(ar, address, buf, buf_len);
+}
+
 static inline int ath10k_hif_exchange_bmi_msg(struct ath10k *ar,
                                               void *request, u32 request_len,
                                               void *response, u32 *response_len)
diff --git a/drivers/net/wireless/ath/ath10k/htt.h b/drivers/net/wireless/ath/ath10k/htt.h
index 3b44217a6c19..15c58e884b6a 100644
--- a/drivers/net/wireless/ath/ath10k/htt.h
+++ b/drivers/net/wireless/ath/ath10k/htt.h
@@ -725,7 +725,7 @@ static inline u8 *htt_rx_test_get_chars(struct htt_rx_test *rx_test)
  */
 struct htt_pktlog_msg {
         u8 pad[3];
-        __le32 payload[1 /* or more */];
+        u8 payload[0];
 } __packed;
 
 struct htt_dbg_stats_rx_reorder_stats {
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index 60d40a04508b..fbb3175d4d6e 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -291,6 +291,9 @@ static inline struct sk_buff *ath10k_htt_rx_netbuf_pop(struct ath10k_htt *htt)
         htt->rx_ring.sw_rd_idx.msdu_payld = idx;
         htt->rx_ring.fill_cnt--;
 
+        trace_ath10k_htt_rx_pop_msdu(ar, msdu->data, msdu->len +
+                                     skb_tailroom(msdu));
+
         return msdu;
 }
 
@@ -316,6 +319,7 @@ static int ath10k_htt_rx_amsdu_pop(struct ath10k_htt *htt,
         int msdu_len, msdu_chaining = 0;
         struct sk_buff *msdu, *next;
         struct htt_rx_desc *rx_desc;
+        u32 tsf;
 
         lockdep_assert_held(&htt->rx_ring.lock);
 
@@ -447,6 +451,9 @@ static int ath10k_htt_rx_amsdu_pop(struct ath10k_htt *htt,
                 last_msdu = __le32_to_cpu(rx_desc->msdu_end.info0) &
                                 RX_MSDU_END_INFO0_LAST_MSDU;
 
+                tsf = __le32_to_cpu(rx_desc->ppdu_end.tsf_timestamp);
+                trace_ath10k_htt_rx_desc(ar, tsf, &rx_desc->attention,
+                                         sizeof(*rx_desc) - sizeof(u32));
                 if (last_msdu) {
                         msdu->next = NULL;
                         break;
@@ -1674,6 +1681,15 @@ void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb)
         case HTT_T2H_MSG_TYPE_RX_DELBA:
                 ath10k_htt_rx_delba(ar, resp);
                 break;
+        case HTT_T2H_MSG_TYPE_PKTLOG: {
+                struct ath10k_pktlog_hdr *hdr =
+                        (struct ath10k_pktlog_hdr *)resp->pktlog_msg.payload;
+
+                trace_ath10k_htt_pktlog(ar, resp->pktlog_msg.payload,
+                                        sizeof(*hdr) +
+                                        __le16_to_cpu(hdr->size));
+                break;
+        }
         case HTT_T2H_MSG_TYPE_RX_FLUSH: {
                 /* Ignore this event because mac80211 takes care of Rx
                  * aggregation reordering.
@@ -1681,8 +1697,8 @@ void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb)
                 break;
         }
         default:
-                ath10k_dbg(ar, ATH10K_DBG_HTT, "htt event (%d) not handled\n",
-                           resp->hdr.msg_type);
+                ath10k_warn(ar, "htt event (%d) not handled\n",
+                            resp->hdr.msg_type);
                 ath10k_dbg_dump(ar, ATH10K_DBG_HTT_DUMP, NULL, "htt event: ",
                                 skb->data, skb->len);
                 break;
diff --git a/drivers/net/wireless/ath/ath10k/htt_tx.c b/drivers/net/wireless/ath/ath10k/htt_tx.c
index bd87a35201d8..b0df470250a2 100644
--- a/drivers/net/wireless/ath/ath10k/htt_tx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_tx.c
@@ -557,12 +557,14 @@ int ath10k_htt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
         skb_cb->htt.txbuf->cmd_tx.frags_paddr = __cpu_to_le32(frags_paddr);
         skb_cb->htt.txbuf->cmd_tx.peerid = __cpu_to_le32(HTT_INVALID_PEERID);
 
+        trace_ath10k_htt_tx(ar, msdu_id, msdu->len, vdev_id, tid);
         ath10k_dbg(ar, ATH10K_DBG_HTT,
                    "htt tx flags0 %hhu flags1 %hu len %d id %hu frags_paddr %08x, msdu_paddr %08x vdev %hhu tid %hhu\n",
                    flags0, flags1, msdu->len, msdu_id, frags_paddr,
                    (u32)skb_cb->paddr, vdev_id, tid);
         ath10k_dbg_dump(ar, ATH10K_DBG_HTT_DUMP, NULL, "htt tx msdu: ",
                         msdu->data, msdu->len);
+        trace_ath10k_htt_tx_msdu(ar, msdu->data, msdu->len);
 
         sg_items[0].transfer_id = 0;
         sg_items[0].transfer_context = NULL;
diff --git a/drivers/net/wireless/ath/ath10k/hw.h b/drivers/net/wireless/ath/ath10k/hw.h
index 3cf5702c1e7e..392c2501d0a1 100644
--- a/drivers/net/wireless/ath/ath10k/hw.h
+++ b/drivers/net/wireless/ath/ath10k/hw.h
@@ -20,15 +20,16 @@
 
 #include "targaddrs.h"
 
+#define ATH10K_FW_DIR                   "ath10k"
+
 /* QCA988X 1.0 definitions (unsupported) */
 #define QCA988X_HW_1_0_CHIP_ID_REV      0x0
 
 /* QCA988X 2.0 definitions */
 #define QCA988X_HW_2_0_VERSION          0x4100016c
 #define QCA988X_HW_2_0_CHIP_ID_REV      0x2
-#define QCA988X_HW_2_0_FW_DIR           "ath10k/QCA988X/hw2.0"
+#define QCA988X_HW_2_0_FW_DIR           ATH10K_FW_DIR "/QCA988X/hw2.0"
 #define QCA988X_HW_2_0_FW_FILE          "firmware.bin"
-#define QCA988X_HW_2_0_FW_3_FILE        "firmware-3.bin"
 #define QCA988X_HW_2_0_OTP_FILE         "otp.bin"
 #define QCA988X_HW_2_0_BOARD_DATA_FILE  "board.bin"
 #define QCA988X_HW_2_0_PATCH_LOAD_ADDR  0x1234
@@ -43,6 +44,8 @@
 
 #define REG_DUMP_COUNT_QCA988X 60
 
+#define QCA988X_CAL_DATA_LEN            2116
+
 struct ath10k_fw_ie {
         __le32 id;
         __le32 len;
@@ -78,6 +81,15 @@ enum ath10k_mcast2ucast_mode {
         ATH10K_MCAST2UCAST_ENABLED = 1,
 };
 
+struct ath10k_pktlog_hdr {
+        __le16 flags;
+        __le16 missed_cnt;
+        __le16 log_type;
+        __le16 size;
+        __le32 timestamp;
+        u8 payload[0];
+} __packed;
+
 /* Target specific defines for MAIN firmware */
 #define TARGET_NUM_VDEVS                        8
 #define TARGET_NUM_PEER_AST                     2
@@ -279,6 +291,7 @@ enum ath10k_mcast2ucast_mode {
 #define SI_RX_DATA1_OFFSET                      0x00000014
 
 #define CORE_CTRL_CPU_INTR_MASK                 0x00002000
+#define CORE_CTRL_PCIE_REG_31_MASK              0x00000800
 #define CORE_CTRL_ADDRESS                       0x0000
 #define PCIE_INTR_ENABLE_ADDRESS                0x0008
 #define PCIE_INTR_CAUSE_ADDRESS                 0x000c
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 46709301a51e..61b006f42f95 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -479,6 +479,40 @@ static void ath10k_peer_cleanup_all(struct ath10k *ar)
 /* Interface management */
 /************************/
 
+void ath10k_mac_vif_beacon_free(struct ath10k_vif *arvif)
+{
+        struct ath10k *ar = arvif->ar;
+
+        lockdep_assert_held(&ar->data_lock);
+
+        if (!arvif->beacon)
+                return;
+
+        if (!arvif->beacon_buf)
+                dma_unmap_single(ar->dev, ATH10K_SKB_CB(arvif->beacon)->paddr,
+                                 arvif->beacon->len, DMA_TO_DEVICE);
+
+        dev_kfree_skb_any(arvif->beacon);
+
+        arvif->beacon = NULL;
+        arvif->beacon_sent = false;
+}
+
+static void ath10k_mac_vif_beacon_cleanup(struct ath10k_vif *arvif)
+{
+        struct ath10k *ar = arvif->ar;
+
+        lockdep_assert_held(&ar->data_lock);
+
+        ath10k_mac_vif_beacon_free(arvif);
+
+        if (arvif->beacon_buf) {
+                dma_free_coherent(ar->dev, IEEE80211_MAX_FRAME_LEN,
+                                  arvif->beacon_buf, arvif->beacon_paddr);
+                arvif->beacon_buf = NULL;
+        }
+}
+
 static inline int ath10k_vdev_setup_sync(struct ath10k *ar)
 {
         int ret;
@@ -590,9 +624,9 @@ static int ath10k_monitor_vdev_create(struct ath10k *ar)
                 return -ENOMEM;
         }
 
-        bit = ffs(ar->free_vdev_map);
+        bit = __ffs64(ar->free_vdev_map);
 
-        ar->monitor_vdev_id = bit - 1;
+        ar->monitor_vdev_id = bit;
 
         ret = ath10k_wmi_vdev_create(ar, ar->monitor_vdev_id,
                                      WMI_VDEV_TYPE_MONITOR,
@@ -603,7 +637,7 @@ static int ath10k_monitor_vdev_create(struct ath10k *ar)
                 return ret;
         }
 
-        ar->free_vdev_map &= ~(1 << ar->monitor_vdev_id);
+        ar->free_vdev_map &= ~(1LL << ar->monitor_vdev_id);
         ath10k_dbg(ar, ATH10K_DBG_MAC, "mac monitor vdev %d created\n",
                    ar->monitor_vdev_id);
 
@@ -623,7 +657,7 @@ static int ath10k_monitor_vdev_delete(struct ath10k *ar)
                 return ret;
         }
 
-        ar->free_vdev_map |= 1 << ar->monitor_vdev_id;
+        ar->free_vdev_map |= 1LL << ar->monitor_vdev_id;
 
         ath10k_dbg(ar, ATH10K_DBG_MAC, "mac monitor vdev %d deleted\n",
                    ar->monitor_vdev_id);
@@ -909,15 +943,7 @@ static void ath10k_control_beaconing(struct ath10k_vif *arvif,
                 arvif->is_up = false;
 
                 spin_lock_bh(&arvif->ar->data_lock);
-                if (arvif->beacon) {
-                        dma_unmap_single(arvif->ar->dev,
-                                         ATH10K_SKB_CB(arvif->beacon)->paddr,
-                                         arvif->beacon->len, DMA_TO_DEVICE);
-                        dev_kfree_skb_any(arvif->beacon);
-
-                        arvif->beacon = NULL;
-                        arvif->beacon_sent = false;
-                }
+                ath10k_mac_vif_beacon_free(arvif);
                 spin_unlock_bh(&arvif->ar->data_lock);
 
                 return;
@@ -966,14 +992,6 @@ static void ath10k_control_ibss(struct ath10k_vif *arvif,
                 if (is_zero_ether_addr(arvif->bssid))
                         return;
 
-                ret = ath10k_peer_delete(arvif->ar, arvif->vdev_id,
-                                         arvif->bssid);
-                if (ret) {
-                        ath10k_warn(ar, "failed to delete IBSS BSSID peer %pM for vdev %d: %d\n",
-                                    arvif->bssid, arvif->vdev_id, ret);
-                        return;
-                }
-
                 memset(arvif->bssid, 0, ETH_ALEN);
 
                 return;
@@ -1042,51 +1060,45 @@ static int ath10k_mac_vif_setup_ps(struct ath10k_vif *arvif)
 /* Station management */
 /**********************/
 
+static u32 ath10k_peer_assoc_h_listen_intval(struct ath10k *ar,
+                                             struct ieee80211_vif *vif)
+{
+        /* Some firmware revisions have unstable STA powersave when listen
+         * interval is set too high (e.g. 5). The symptoms are firmware doesn't
+         * generate NullFunc frames properly even if buffered frames have been
+         * indicated in Beacon TIM. Firmware would seldom wake up to pull
+         * buffered frames. Often pinging the device from AP would simply fail.
+         *
+         * As a workaround set it to 1.
+         */
+        if (vif->type == NL80211_IFTYPE_STATION)
+                return 1;
+
+        return ar->hw->conf.listen_interval;
+}
+
 static void ath10k_peer_assoc_h_basic(struct ath10k *ar,
-                                      struct ath10k_vif *arvif,
+                                      struct ieee80211_vif *vif,
                                       struct ieee80211_sta *sta,
-                                      struct ieee80211_bss_conf *bss_conf,
                                       struct wmi_peer_assoc_complete_arg *arg)
 {
+        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
+
         lockdep_assert_held(&ar->conf_mutex);
 
         ether_addr_copy(arg->addr, sta->addr);
         arg->vdev_id = arvif->vdev_id;
         arg->peer_aid = sta->aid;
         arg->peer_flags |= WMI_PEER_AUTH;
-
-        if (arvif->vdev_type == WMI_VDEV_TYPE_STA)
-                /*
-                 * Seems FW have problems with Power Save in STA
-                 * mode when we setup this parameter to high (eg. 5).
-                 * Often we see that FW don't send NULL (with clean P flags)
-                 * frame even there is info about buffered frames in beacons.
-                 * Sometimes we have to wait more than 10 seconds before FW
-                 * will wakeup. Often sending one ping from AP to our device
-                 * just fail (more than 50%).
-                 *
-                 * Seems setting this FW parameter to 1 couse FW
-                 * will check every beacon and will wakup immediately
-                 * after detection buffered data.
-                 */
-                arg->peer_listen_intval = 1;
-        else
-                arg->peer_listen_intval = ar->hw->conf.listen_interval;
-
+        arg->peer_listen_intval = ath10k_peer_assoc_h_listen_intval(ar, vif);
         arg->peer_num_spatial_streams = 1;
-
-        /*
-         * The assoc capabilities are available only in managed mode.
-         */
-        if (arvif->vdev_type == WMI_VDEV_TYPE_STA && bss_conf)
-                arg->peer_caps = bss_conf->assoc_capability;
+        arg->peer_caps = vif->bss_conf.assoc_capability;
 }
 
 static void ath10k_peer_assoc_h_crypto(struct ath10k *ar,
-                                       struct ath10k_vif *arvif,
+                                       struct ieee80211_vif *vif,
                                        struct wmi_peer_assoc_complete_arg *arg)
 {
-        struct ieee80211_vif *vif = arvif->vif;
         struct ieee80211_bss_conf *info = &vif->bss_conf;
         struct cfg80211_bss *bss;
         const u8 *rsnie = NULL;
@@ -1343,11 +1355,12 @@ static void ath10k_peer_assoc_h_vht(struct ath10k *ar,
 }
 
 static void ath10k_peer_assoc_h_qos(struct ath10k *ar,
-                                    struct ath10k_vif *arvif,
+                                    struct ieee80211_vif *vif,
                                     struct ieee80211_sta *sta,
-                                    struct ieee80211_bss_conf *bss_conf,
                                     struct wmi_peer_assoc_complete_arg *arg)
 {
+        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
+
         switch (arvif->vdev_type) {
         case WMI_VDEV_TYPE_AP:
                 if (sta->wme)
@@ -1359,7 +1372,7 @@ static void ath10k_peer_assoc_h_qos(struct ath10k *ar,
                 }
                 break;
         case WMI_VDEV_TYPE_STA:
-                if (bss_conf->qos)
+                if (vif->bss_conf.qos)
                         arg->peer_flags |= WMI_PEER_QOS;
                 break;
         default:
@@ -1368,7 +1381,7 @@ static void ath10k_peer_assoc_h_qos(struct ath10k *ar,
 }
 
 static void ath10k_peer_assoc_h_phymode(struct ath10k *ar,
-                                        struct ath10k_vif *arvif,
+                                        struct ieee80211_vif *vif,
                                         struct ieee80211_sta *sta,
                                         struct wmi_peer_assoc_complete_arg *arg)
 {
@@ -1419,22 +1432,21 @@ static void ath10k_peer_assoc_h_phymode(struct ath10k *ar,
 }
 
 static int ath10k_peer_assoc_prepare(struct ath10k *ar,
-                                     struct ath10k_vif *arvif,
+                                     struct ieee80211_vif *vif,
                                      struct ieee80211_sta *sta,
-                                     struct ieee80211_bss_conf *bss_conf,
                                      struct wmi_peer_assoc_complete_arg *arg)
 {
         lockdep_assert_held(&ar->conf_mutex);
 
         memset(arg, 0, sizeof(*arg));
 
-        ath10k_peer_assoc_h_basic(ar, arvif, sta, bss_conf, arg);
-        ath10k_peer_assoc_h_crypto(ar, arvif, arg);
+        ath10k_peer_assoc_h_basic(ar, vif, sta, arg);
+        ath10k_peer_assoc_h_crypto(ar, vif, arg);
         ath10k_peer_assoc_h_rates(ar, sta, arg);
         ath10k_peer_assoc_h_ht(ar, sta, arg);
         ath10k_peer_assoc_h_vht(ar, sta, arg);
-        ath10k_peer_assoc_h_qos(ar, arvif, sta, bss_conf, arg);
-        ath10k_peer_assoc_h_phymode(ar, arvif, sta, arg);
+        ath10k_peer_assoc_h_qos(ar, vif, sta, arg);
+        ath10k_peer_assoc_h_phymode(ar, vif, sta, arg);
 
         return 0;
 }
@@ -1480,6 +1492,9 @@ static void ath10k_bss_assoc(struct ieee80211_hw *hw,
 
         lockdep_assert_held(&ar->conf_mutex);
 
+        ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %i assoc bssid %pM aid %d\n",
+                   arvif->vdev_id, arvif->bssid, arvif->aid);
+
         rcu_read_lock();
 
         ap_sta = ieee80211_find_sta(vif, bss_conf->bssid);
@@ -1494,8 +1509,7 @@ static void ath10k_bss_assoc(struct ieee80211_hw *hw,
          * before calling ath10k_setup_peer_smps() which might sleep. */
         ht_cap = ap_sta->ht_cap;
 
-        ret = ath10k_peer_assoc_prepare(ar, arvif, ap_sta,
-                                        bss_conf, &peer_arg);
+        ret = ath10k_peer_assoc_prepare(ar, vif, ap_sta, &peer_arg);
         if (ret) {
                 ath10k_warn(ar, "failed to prepare peer assoc for %pM vdev %i: %d\n",
                             bss_conf->bssid, arvif->vdev_id, ret);
@@ -1523,6 +1537,8 @@ static void ath10k_bss_assoc(struct ieee80211_hw *hw,
                    "mac vdev %d up (associated) bssid %pM aid %d\n",
                    arvif->vdev_id, bss_conf->bssid, bss_conf->aid);
 
+        WARN_ON(arvif->is_up);
+
         arvif->aid = bss_conf->aid;
         ether_addr_copy(arvif->bssid, bss_conf->bssid);
 
@@ -1536,9 +1552,6 @@ static void ath10k_bss_assoc(struct ieee80211_hw *hw,
         arvif->is_up = true;
 }
 
-/*
- * FIXME: flush TIDs
- */
 static void ath10k_bss_disassoc(struct ieee80211_hw *hw,
                                 struct ieee80211_vif *vif)
 {
@@ -1548,45 +1561,30 @@ static void ath10k_bss_disassoc(struct ieee80211_hw *hw,
 
         lockdep_assert_held(&ar->conf_mutex);
 
-        /*
-         * For some reason, calling VDEV-DOWN before VDEV-STOP
-         * makes the FW to send frames via HTT after disassociation.
-         * No idea why this happens, even though VDEV-DOWN is supposed
-         * to be analogous to link down, so just stop the VDEV.
-         */
-        ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d stop (disassociated\n",
-                   arvif->vdev_id);
+        ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %i disassoc bssid %pM\n",
+                   arvif->vdev_id, arvif->bssid);
 
-        /* FIXME: check return value */
-        ret = ath10k_vdev_stop(arvif);
-
-        /*
-         * If we don't call VDEV-DOWN after VDEV-STOP FW will remain active and
-         * report beacons from previously associated network through HTT.
-         * This in turn would spam mac80211 WARN_ON if we bring down all
-         * interfaces as it expects there is no rx when no interface is
-         * running.
-         */
-        ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d down\n", arvif->vdev_id);
-
-        /* FIXME: why don't we print error if wmi call fails? */
         ret = ath10k_wmi_vdev_down(ar, arvif->vdev_id);
+        if (ret)
+                ath10k_warn(ar, "faield to down vdev %i: %d\n",
+                            arvif->vdev_id, ret);
 
         arvif->def_wep_key_idx = 0;
-
-        arvif->is_started = false;
         arvif->is_up = false;
 }
 
-static int ath10k_station_assoc(struct ath10k *ar, struct ath10k_vif *arvif,
-                                struct ieee80211_sta *sta, bool reassoc)
+static int ath10k_station_assoc(struct ath10k *ar,
+                                struct ieee80211_vif *vif,
+                                struct ieee80211_sta *sta,
+                                bool reassoc)
 {
+        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
         struct wmi_peer_assoc_complete_arg peer_arg;
         int ret = 0;
 
         lockdep_assert_held(&ar->conf_mutex);
 
-        ret = ath10k_peer_assoc_prepare(ar, arvif, sta, NULL, &peer_arg);
+        ret = ath10k_peer_assoc_prepare(ar, vif, sta, &peer_arg);
         if (ret) {
                 ath10k_warn(ar, "failed to prepare WMI peer assoc for %pM vdev %i: %i\n",
                             sta->addr, arvif->vdev_id, ret);
@@ -1601,43 +1599,51 @@ static int ath10k_station_assoc(struct ath10k *ar, struct ath10k_vif *arvif,
                 return ret;
         }
 
-        ret = ath10k_setup_peer_smps(ar, arvif, sta->addr, &sta->ht_cap);
-        if (ret) {
-                ath10k_warn(ar, "failed to setup peer SMPS for vdev %d: %d\n",
-                            arvif->vdev_id, ret);
-                return ret;
-        }
-
-        if (!sta->wme && !reassoc) {
-                arvif->num_legacy_stations++;
-                ret  = ath10k_recalc_rtscts_prot(arvif);
+        /* Re-assoc is run only to update supported rates for given station. It
+         * doesn't make much sense to reconfigure the peer completely.
+         */
+        if (!reassoc) {
+                ret = ath10k_setup_peer_smps(ar, arvif, sta->addr,
+                                             &sta->ht_cap);
                 if (ret) {
-                        ath10k_warn(ar, "failed to recalculate rts/cts prot for vdev %d: %d\n",
+                        ath10k_warn(ar, "failed to setup peer SMPS for vdev %d: %d\n",
                                     arvif->vdev_id, ret);
                         return ret;
                 }
-        }
 
-        ret = ath10k_install_peer_wep_keys(arvif, sta->addr);
-        if (ret) {
-                ath10k_warn(ar, "failed to install peer wep keys for vdev %i: %d\n",
-                            arvif->vdev_id, ret);
-                return ret;
-        }
+                ret = ath10k_peer_assoc_qos_ap(ar, arvif, sta);
+                if (ret) {
+                        ath10k_warn(ar, "failed to set qos params for STA %pM for vdev %i: %d\n",
+                                    sta->addr, arvif->vdev_id, ret);
+                        return ret;
+                }
 
-        ret = ath10k_peer_assoc_qos_ap(ar, arvif, sta);
-        if (ret) {
-                ath10k_warn(ar, "failed to set qos params for STA %pM for vdev %i: %d\n",
-                            sta->addr, arvif->vdev_id, ret);
-                return ret;
+                if (!sta->wme) {
+                        arvif->num_legacy_stations++;
+                        ret  = ath10k_recalc_rtscts_prot(arvif);
+                        if (ret) {
+                                ath10k_warn(ar, "failed to recalculate rts/cts prot for vdev %d: %d\n",
+                                            arvif->vdev_id, ret);
+                                return ret;
+                        }
+                }
+
+                ret = ath10k_install_peer_wep_keys(arvif, sta->addr);
+                if (ret) {
+                        ath10k_warn(ar, "failed to install peer wep keys for vdev %i: %d\n",
+                                    arvif->vdev_id, ret);
+                        return ret;
+                }
         }
 
         return ret;
 }
 
-static int ath10k_station_disassoc(struct ath10k *ar, struct ath10k_vif *arvif,
+static int ath10k_station_disassoc(struct ath10k *ar,
+                                   struct ieee80211_vif *vif,
                                    struct ieee80211_sta *sta)
 {
+        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
         int ret = 0;
 
         lockdep_assert_held(&ar->conf_mutex);
@@ -1729,6 +1735,7 @@ static int ath10k_update_channel_list(struct ath10k *ar)
                         ch->passive = passive;
 
                         ch->freq = channel->center_freq;
+                        ch->band_center_freq1 = channel->center_freq;
                         ch->min_power = 0;
                         ch->max_power = channel->max_power * 2;
                         ch->max_reg_power = channel->max_reg_power * 2;
@@ -2376,16 +2383,8 @@ void ath10k_halt(struct ath10k *ar)
         ath10k_hif_power_down(ar);
 
         spin_lock_bh(&ar->data_lock);
-        list_for_each_entry(arvif, &ar->arvifs, list) {
-                if (!arvif->beacon)
-                        continue;
-
-                dma_unmap_single(arvif->ar->dev,
-                                 ATH10K_SKB_CB(arvif->beacon)->paddr,
-                                 arvif->beacon->len, DMA_TO_DEVICE);
-                dev_kfree_skb_any(arvif->beacon);
-                arvif->beacon = NULL;
-        }
+        list_for_each_entry(arvif, &ar->arvifs, list)
+                ath10k_mac_vif_beacon_cleanup(arvif);
         spin_unlock_bh(&ar->data_lock);
 }
 
@@ -2677,12 +2676,68 @@ static void ath10k_config_chan(struct ath10k *ar)
         ath10k_monitor_recalc(ar);
 }
 
+static int ath10k_mac_txpower_setup(struct ath10k *ar, int txpower)
+{
+        int ret;
+        u32 param;
+
+        lockdep_assert_held(&ar->conf_mutex);
+
+        ath10k_dbg(ar, ATH10K_DBG_MAC, "mac txpower %d\n", txpower);
+
+        param = ar->wmi.pdev_param->txpower_limit2g;
+        ret = ath10k_wmi_pdev_set_param(ar, param, txpower * 2);
+        if (ret) {
+                ath10k_warn(ar, "failed to set 2g txpower %d: %d\n",
+                            txpower, ret);
+                return ret;
+        }
+
+        param = ar->wmi.pdev_param->txpower_limit5g;
+        ret = ath10k_wmi_pdev_set_param(ar, param, txpower * 2);
+        if (ret) {
+                ath10k_warn(ar, "failed to set 5g txpower %d: %d\n",
+                            txpower, ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+static int ath10k_mac_txpower_recalc(struct ath10k *ar)
+{
+        struct ath10k_vif *arvif;
+        int ret, txpower = -1;
+
+        lockdep_assert_held(&ar->conf_mutex);
+
+        list_for_each_entry(arvif, &ar->arvifs, list) {
+                WARN_ON(arvif->txpower < 0);
+
+                if (txpower == -1)
+                        txpower = arvif->txpower;
+                else
+                        txpower = min(txpower, arvif->txpower);
+        }
+
+        if (WARN_ON(txpower == -1))
+                return -EINVAL;
+
+        ret = ath10k_mac_txpower_setup(ar, txpower);
+        if (ret) {
+                ath10k_warn(ar, "failed to setup tx power %d: %d\n",
+                            txpower, ret);
+                return ret;
+        }
+
+        return 0;
+}
+
 static int ath10k_config(struct ieee80211_hw *hw, u32 changed)
 {
         struct ath10k *ar = hw->priv;
         struct ieee80211_conf *conf = &hw->conf;
         int ret = 0;
-        u32 param;
 
         mutex_lock(&ar->conf_mutex);
 
@@ -2706,25 +2761,6 @@ static int ath10k_config(struct ieee80211_hw *hw, u32 changed)
                 }
         }
 
-        if (changed & IEEE80211_CONF_CHANGE_POWER) {
-                ath10k_dbg(ar, ATH10K_DBG_MAC, "mac config power %d\n",
-                           hw->conf.power_level);
-
-                param = ar->wmi.pdev_param->txpower_limit2g;
-                ret = ath10k_wmi_pdev_set_param(ar, param,
-                                                hw->conf.power_level * 2);
-                if (ret)
-                        ath10k_warn(ar, "failed to set 2g txpower %d: %d\n",
-                                    hw->conf.power_level, ret);
-
-                param = ar->wmi.pdev_param->txpower_limit5g;
-                ret = ath10k_wmi_pdev_set_param(ar, param,
-                                                hw->conf.power_level * 2);
-                if (ret)
-                        ath10k_warn(ar, "failed to set 5g txpower %d: %d\n",
-                                    hw->conf.power_level, ret);
-        }
-
         if (changed & IEEE80211_CONF_CHANGE_PS)
                 ath10k_config_ps(ar);
 
@@ -2772,9 +2808,12 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
                 ret = -EBUSY;
                 goto err;
         }
-        bit = ffs(ar->free_vdev_map);
+        bit = __ffs64(ar->free_vdev_map);
+
+        ath10k_dbg(ar, ATH10K_DBG_MAC, "mac create vdev %i map %llx\n",
+                   bit, ar->free_vdev_map);
 
-        arvif->vdev_id = bit - 1;
+        arvif->vdev_id = bit;
         arvif->vdev_subtype = WMI_VDEV_SUBTYPE_NONE;
 
         if (ar->p2p)
@@ -2804,8 +2843,39 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
                 break;
         }
 
-        ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev create %d (add interface) type %d subtype %d\n",
-                   arvif->vdev_id, arvif->vdev_type, arvif->vdev_subtype);
+        /* Some firmware revisions don't wait for beacon tx completion before
+         * sending another SWBA event. This could lead to hardware using old
+         * (freed) beacon data in some cases, e.g. tx credit starvation
+         * combined with missed TBTT. This is very very rare.
+         *
+         * On non-IOMMU-enabled hosts this could be a possible security issue
+         * because hw could beacon some random data on the air.  On
+         * IOMMU-enabled hosts DMAR faults would occur in most cases and target
+         * device would crash.
+         *
+         * Since there are no beacon tx completions (implicit nor explicit)
+         * propagated to host the only workaround for this is to allocate a
+         * DMA-coherent buffer for a lifetime of a vif and use it for all
+         * beacon tx commands. Worst case for this approach is some beacons may
+         * become corrupted, e.g. have garbled IEs or out-of-date TIM bitmap.
+         */
+        if (vif->type == NL80211_IFTYPE_ADHOC ||
+            vif->type == NL80211_IFTYPE_AP) {
+                arvif->beacon_buf = dma_zalloc_coherent(ar->dev,
+                                                        IEEE80211_MAX_FRAME_LEN,
+                                                        &arvif->beacon_paddr,
+                                                        GFP_ATOMIC);
+                if (!arvif->beacon_buf) {
+                        ret = -ENOMEM;
+                        ath10k_warn(ar, "failed to allocate beacon buffer: %d\n",
+                                    ret);
+                        goto err;
+                }
+        }
+
+        ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev create %d (add interface) type %d subtype %d bcnmode %s\n",
+                   arvif->vdev_id, arvif->vdev_type, arvif->vdev_subtype,
+                   arvif->beacon_buf ? "single-buf" : "per-skb");
 
         ret = ath10k_wmi_vdev_create(ar, arvif->vdev_id, arvif->vdev_type,
                                      arvif->vdev_subtype, vif->addr);
@@ -2815,7 +2885,7 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
                 goto err;
         }
 
-        ar->free_vdev_map &= ~(1 << arvif->vdev_id);
+        ar->free_vdev_map &= ~(1LL << arvif->vdev_id);
         list_add(&arvif->list, &ar->arvifs);
 
         vdev_param = ar->wmi.vdev_param->def_keyid;
@@ -2899,6 +2969,13 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
                 goto err_peer_delete;
         }
 
+        arvif->txpower = vif->bss_conf.txpower;
+        ret = ath10k_mac_txpower_recalc(ar);
+        if (ret) {
+                ath10k_warn(ar, "failed to recalc tx power: %d\n", ret);
+                goto err_peer_delete;
+        }
+
         mutex_unlock(&ar->conf_mutex);
         return 0;
 
@@ -2908,10 +2985,16 @@ err_peer_delete:
 
 err_vdev_delete:
         ath10k_wmi_vdev_delete(ar, arvif->vdev_id);
-        ar->free_vdev_map |= 1 << arvif->vdev_id;
+        ar->free_vdev_map |= 1LL << arvif->vdev_id;
         list_del(&arvif->list);
 
 err:
+        if (arvif->beacon_buf) {
+                dma_free_coherent(ar->dev, IEEE80211_MAX_FRAME_LEN,
+                                  arvif->beacon_buf, arvif->beacon_paddr);
+                arvif->beacon_buf = NULL;
+        }
+
         mutex_unlock(&ar->conf_mutex);
 
         return ret;
@@ -2929,14 +3012,7 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw,
         cancel_work_sync(&arvif->wep_key_work);
 
         spin_lock_bh(&ar->data_lock);
-        if (arvif->beacon) {
-                dma_unmap_single(arvif->ar->dev,
-                                 ATH10K_SKB_CB(arvif->beacon)->paddr,
-                                 arvif->beacon->len, DMA_TO_DEVICE);
-                dev_kfree_skb_any(arvif->beacon);
-                arvif->beacon = NULL;
-        }
-
+        ath10k_mac_vif_beacon_cleanup(arvif);
         spin_unlock_bh(&ar->data_lock);
 
         ret = ath10k_spectral_vif_stop(arvif);
@@ -2944,7 +3020,7 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw,
                 ath10k_warn(ar, "failed to stop spectral for vdev %i: %d\n",
                             arvif->vdev_id, ret);
 
-        ar->free_vdev_map |= 1 << arvif->vdev_id;
+        ar->free_vdev_map |= 1LL << arvif->vdev_id;
         list_del(&arvif->list);
 
         if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
@@ -3068,54 +3144,8 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                 arvif->u.ap.hidden_ssid = info->hidden_ssid;
         }
 
-        /*
-         * Firmware manages AP self-peer internally so make sure to not create
-         * it in driver. Otherwise AP self-peer deletion may timeout later.
-         */
-        if (changed & BSS_CHANGED_BSSID &&
-            vif->type != NL80211_IFTYPE_AP) {
-                if (!is_zero_ether_addr(info->bssid)) {
-                        ath10k_dbg(ar, ATH10K_DBG_MAC,
-                                   "mac vdev %d create peer %pM\n",
-                                   arvif->vdev_id, info->bssid);
-
-                        ret = ath10k_peer_create(ar, arvif->vdev_id,
-                                                 info->bssid);
-                        if (ret)
-                                ath10k_warn(ar, "failed to add peer %pM for vdev %d when changing bssid: %i\n",
-                                            info->bssid, arvif->vdev_id, ret);
-
-                        if (vif->type == NL80211_IFTYPE_STATION) {
-                                /*
-                                 * this is never erased as we it for crypto key
-                                 * clearing; this is FW requirement
-                                 */
-                                ether_addr_copy(arvif->bssid, info->bssid);
-
-                                ath10k_dbg(ar, ATH10K_DBG_MAC,
-                                           "mac vdev %d start %pM\n",
-                                           arvif->vdev_id, info->bssid);
-
-                                ret = ath10k_vdev_start(arvif);
-                                if (ret) {
-                                        ath10k_warn(ar, "failed to start vdev %i: %d\n",
-                                                    arvif->vdev_id, ret);
-                                        goto exit;
-                                }
-
-                                arvif->is_started = true;
-                        }
-
-                        /*
-                         * Mac80211 does not keep IBSS bssid when leaving IBSS,
-                         * so driver need to store it. It is needed when leaving
-                         * IBSS in order to remove BSSID peer.
-                         */
-                        if (vif->type == NL80211_IFTYPE_ADHOC)
-                                memcpy(arvif->bssid, info->bssid,
-                                       ETH_ALEN);
-                }
-        }
+        if (changed & BSS_CHANGED_BSSID && !is_zero_ether_addr(info->bssid))
+                ether_addr_copy(arvif->bssid, info->bssid);
 
         if (changed & BSS_CHANGED_BEACON_ENABLED)
                 ath10k_control_beaconing(arvif, info);
@@ -3177,10 +3207,21 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                                 ath10k_monitor_stop(ar);
                         ath10k_bss_assoc(hw, vif, info);
                         ath10k_monitor_recalc(ar);
+                } else {
+                        ath10k_bss_disassoc(hw, vif);
                 }
         }
 
-exit:
+        if (changed & BSS_CHANGED_TXPOWER) {
+                ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev_id %i txpower %d\n",
+                           arvif->vdev_id, info->txpower);
+
+                arvif->txpower = info->txpower;
+                ret = ath10k_mac_txpower_recalc(ar);
+                if (ret)
+                        ath10k_warn(ar, "failed to recalc tx power: %d\n", ret);
+        }
+
         mutex_unlock(&ar->conf_mutex);
 }
 
@@ -3453,7 +3494,7 @@ static void ath10k_sta_rc_update_wk(struct work_struct *wk)
                 ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM supp rates\n",
                            sta->addr);
 
-                err = ath10k_station_assoc(ar, arvif, sta, true);
+                err = ath10k_station_assoc(ar, arvif->vif, sta, true);
                 if (err)
                         ath10k_warn(ar, "failed to reassociate station: %pM\n",
                                     sta->addr);
@@ -3489,8 +3530,7 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
         mutex_lock(&ar->conf_mutex);
 
         if (old_state == IEEE80211_STA_NOTEXIST &&
-            new_state == IEEE80211_STA_NONE &&
-            vif->type != NL80211_IFTYPE_STATION) {
+            new_state == IEEE80211_STA_NONE) {
                 /*
                  * New station addition.
                  */
@@ -3514,6 +3554,21 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                 if (ret)
                         ath10k_warn(ar, "failed to add peer %pM for vdev %d when adding a new sta: %i\n",
                                     sta->addr, arvif->vdev_id, ret);
+
+                if (vif->type == NL80211_IFTYPE_STATION) {
+                        WARN_ON(arvif->is_started);
+
+                        ret = ath10k_vdev_start(arvif);
+                        if (ret) {
+                                ath10k_warn(ar, "failed to start vdev %i: %d\n",
+                                            arvif->vdev_id, ret);
+                                WARN_ON(ath10k_peer_delete(ar, arvif->vdev_id,
+                                                           sta->addr));
+                                goto exit;
+                        }
+
+                        arvif->is_started = true;
+                }
         } else if ((old_state == IEEE80211_STA_NONE &&
                     new_state == IEEE80211_STA_NOTEXIST)) {
                 /*
@@ -3522,13 +3577,23 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                 ath10k_dbg(ar, ATH10K_DBG_MAC,
                            "mac vdev %d peer delete %pM (sta gone)\n",
                            arvif->vdev_id, sta->addr);
+
+                if (vif->type == NL80211_IFTYPE_STATION) {
+                        WARN_ON(!arvif->is_started);
+
+                        ret = ath10k_vdev_stop(arvif);
+                        if (ret)
+                                ath10k_warn(ar, "failed to stop vdev %i: %d\n",
+                                            arvif->vdev_id, ret);
+
+                        arvif->is_started = false;
+                }
+
                 ret = ath10k_peer_delete(ar, arvif->vdev_id, sta->addr);
                 if (ret)
                         ath10k_warn(ar, "failed to delete peer %pM for vdev %d: %i\n",
                                     sta->addr, arvif->vdev_id, ret);
 
-                if (vif->type == NL80211_IFTYPE_STATION)
-                        ath10k_bss_disassoc(hw, vif);
         } else if (old_state == IEEE80211_STA_AUTH &&
                    new_state == IEEE80211_STA_ASSOC &&
                    (vif->type == NL80211_IFTYPE_AP ||
@@ -3539,7 +3604,7 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                 ath10k_dbg(ar, ATH10K_DBG_MAC, "mac sta %pM associated\n",
                            sta->addr);
 
-                ret = ath10k_station_assoc(ar, arvif, sta, false);
+                ret = ath10k_station_assoc(ar, vif, sta, false);
                 if (ret)
                         ath10k_warn(ar, "failed to associate station %pM for vdev %i: %i\n",
                                     sta->addr, arvif->vdev_id, ret);
@@ -3553,7 +3618,7 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                 ath10k_dbg(ar, ATH10K_DBG_MAC, "mac sta %pM disassociated\n",
                            sta->addr);
 
-                ret = ath10k_station_disassoc(ar, arvif, sta);
+                ret = ath10k_station_disassoc(ar, vif, sta);
                 if (ret)
                         ath10k_warn(ar, "failed to disassociate station: %pM vdev %i: %i\n",
                                     sta->addr, arvif->vdev_id, ret);
@@ -3929,10 +3994,14 @@ exit:
 }
 #endif
 
-static void ath10k_restart_complete(struct ieee80211_hw *hw)
+static void ath10k_reconfig_complete(struct ieee80211_hw *hw,
+                                     enum ieee80211_reconfig_type reconfig_type)
 {
         struct ath10k *ar = hw->priv;
 
+        if (reconfig_type != IEEE80211_RECONFIG_TYPE_RESTART)
+                return;
+
         mutex_lock(&ar->conf_mutex);
 
         /* If device failed to restart it will be in a different state, e.g.
@@ -4450,12 +4519,15 @@ static const struct ieee80211_ops ath10k_ops = {
         .tx_last_beacon                 = ath10k_tx_last_beacon,
         .set_antenna                    = ath10k_set_antenna,
         .get_antenna                    = ath10k_get_antenna,
-        .restart_complete               = ath10k_restart_complete,
+        .reconfig_complete              = ath10k_reconfig_complete,
         .get_survey                     = ath10k_get_survey,
         .set_bitrate_mask               = ath10k_set_bitrate_mask,
         .sta_rc_update                  = ath10k_sta_rc_update,
         .get_tsf                        = ath10k_get_tsf,
         .ampdu_action                   = ath10k_ampdu_action,
+        .get_et_sset_count              = ath10k_debug_get_et_sset_count,
+        .get_et_stats                   = ath10k_debug_get_et_stats,
+        .get_et_strings                 = ath10k_debug_get_et_strings,
 
         CFG80211_TESTMODE_CMD(ath10k_tm_cmd)
 
@@ -4800,15 +4872,6 @@ int ath10k_mac_register(struct ath10k *ar)
                 BIT(NL80211_IFTYPE_STATION) |
                 BIT(NL80211_IFTYPE_AP);
 
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                /* TODO:  Have to deal with 2x2 chips if/when the come out. */
-                ar->supp_tx_chainmask = TARGET_10X_TX_CHAIN_MASK;
-                ar->supp_rx_chainmask = TARGET_10X_RX_CHAIN_MASK;
-        } else {
-                ar->supp_tx_chainmask = TARGET_TX_CHAIN_MASK;
-                ar->supp_rx_chainmask = TARGET_RX_CHAIN_MASK;
-        }
-
         ar->hw->wiphy->available_antennas_rx = ar->supp_rx_chainmask;
         ar->hw->wiphy->available_antennas_tx = ar->supp_tx_chainmask;
 
diff --git a/drivers/net/wireless/ath/ath10k/mac.h b/drivers/net/wireless/ath/ath10k/mac.h
index 6c80eeada3e2..965c51117499 100644
--- a/drivers/net/wireless/ath/ath10k/mac.h
+++ b/drivers/net/wireless/ath/ath10k/mac.h
@@ -39,6 +39,7 @@ void ath10k_offchan_tx_work(struct work_struct *work);
 void ath10k_mgmt_over_wmi_tx_purge(struct ath10k *ar);
 void ath10k_mgmt_over_wmi_tx_work(struct work_struct *work);
 void ath10k_halt(struct ath10k *ar);
+void ath10k_mac_vif_beacon_free(struct ath10k_vif *arvif);
 
 static inline struct ath10k_vif *ath10k_vif_to_arvif(struct ieee80211_vif *vif)
 {
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index 59e0ea83be50..4a4740b4bdc0 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -485,6 +485,8 @@ static int ath10k_pci_diag_read_mem(struct ath10k *ar, u32 address, void *data,
         void *data_buf = NULL;
         int i;
 
+        spin_lock_bh(&ar_pci->ce_lock);
+
         ce_diag = ar_pci->ce_diag;
 
         /*
@@ -511,7 +513,7 @@ static int ath10k_pci_diag_read_mem(struct ath10k *ar, u32 address, void *data,
                 nbytes = min_t(unsigned int, remaining_bytes,
                                DIAG_TRANSFER_LIMIT);
 
-                ret = ath10k_ce_rx_post_buf(ce_diag, NULL, ce_data);
+                ret = __ath10k_ce_rx_post_buf(ce_diag, NULL, ce_data);
                 if (ret != 0)
                         goto done;
 
@@ -527,15 +529,15 @@ static int ath10k_pci_diag_read_mem(struct ath10k *ar, u32 address, void *data,
                 address = TARG_CPU_SPACE_TO_CE_SPACE(ar, ar_pci->mem,
                                                      address);
 
-                ret = ath10k_ce_send(ce_diag, NULL, (u32)address, nbytes, 0,
-                                     0);
+                ret = ath10k_ce_send_nolock(ce_diag, NULL, (u32)address, nbytes, 0,
+                                            0);
                 if (ret)
                         goto done;
 
                 i = 0;
-                while (ath10k_ce_completed_send_next(ce_diag, NULL, &buf,
-                                                     &completed_nbytes,
-                                                     &id) != 0) {
+                while (ath10k_ce_completed_send_next_nolock(ce_diag, NULL, &buf,
+                                                            &completed_nbytes,
+                                                            &id) != 0) {
                         mdelay(1);
                         if (i++ > DIAG_ACCESS_CE_TIMEOUT_MS) {
                                 ret = -EBUSY;
@@ -554,9 +556,9 @@ static int ath10k_pci_diag_read_mem(struct ath10k *ar, u32 address, void *data,
                 }
 
                 i = 0;
-                while (ath10k_ce_completed_recv_next(ce_diag, NULL, &buf,
-                                                     &completed_nbytes,
-                                                     &id, &flags) != 0) {
+                while (ath10k_ce_completed_recv_next_nolock(ce_diag, NULL, &buf,
+                                                            &completed_nbytes,
+                                                            &id, &flags) != 0) {
                         mdelay(1);
 
                         if (i++ > DIAG_ACCESS_CE_TIMEOUT_MS) {
@@ -591,6 +593,8 @@ done:
                 dma_free_coherent(ar->dev, orig_nbytes, data_buf,
                                   ce_data_base);
 
+        spin_unlock_bh(&ar_pci->ce_lock);
+
         return ret;
 }
 
@@ -648,6 +652,8 @@ static int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
         dma_addr_t ce_data_base = 0;
         int i;
 
+        spin_lock_bh(&ar_pci->ce_lock);
+
         ce_diag = ar_pci->ce_diag;
 
         /*
@@ -688,7 +694,7 @@ static int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
                 nbytes = min_t(int, remaining_bytes, DIAG_TRANSFER_LIMIT);
 
                 /* Set up to receive directly into Target(!) address */
-                ret = ath10k_ce_rx_post_buf(ce_diag, NULL, address);
+                ret = __ath10k_ce_rx_post_buf(ce_diag, NULL, address);
                 if (ret != 0)
                         goto done;
 
@@ -696,15 +702,15 @@ static int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
                  * Request CE to send caller-supplied data that
                  * was copied to bounce buffer to Target(!) address.
                  */
-                ret = ath10k_ce_send(ce_diag, NULL, (u32)ce_data,
-                                     nbytes, 0, 0);
+                ret = ath10k_ce_send_nolock(ce_diag, NULL, (u32)ce_data,
+                                            nbytes, 0, 0);
                 if (ret != 0)
                         goto done;
 
                 i = 0;
-                while (ath10k_ce_completed_send_next(ce_diag, NULL, &buf,
-                                                     &completed_nbytes,
-                                                     &id) != 0) {
+                while (ath10k_ce_completed_send_next_nolock(ce_diag, NULL, &buf,
+                                                            &completed_nbytes,
+                                                            &id) != 0) {
                         mdelay(1);
 
                         if (i++ > DIAG_ACCESS_CE_TIMEOUT_MS) {
@@ -724,9 +730,9 @@ static int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
                 }
 
                 i = 0;
-                while (ath10k_ce_completed_recv_next(ce_diag, NULL, &buf,
-                                                     &completed_nbytes,
-                                                     &id, &flags) != 0) {
+                while (ath10k_ce_completed_recv_next_nolock(ce_diag, NULL, &buf,
+                                                            &completed_nbytes,
+                                                            &id, &flags) != 0) {
                         mdelay(1);
 
                         if (i++ > DIAG_ACCESS_CE_TIMEOUT_MS) {
@@ -760,6 +766,8 @@ done:
                 ath10k_warn(ar, "failed to write diag value at 0x%x: %d\n",
                             address, ret);
 
+        spin_unlock_bh(&ar_pci->ce_lock);
+
         return ret;
 }
 
@@ -861,6 +869,12 @@ static void ath10k_pci_ce_recv_data(struct ath10k_ce_pipe *ce_state)
                 }
 
                 skb_put(skb, nbytes);
+
+                ath10k_dbg(ar, ATH10K_DBG_PCI, "pci rx ce pipe %d len %d\n",
+                           ce_state->id, skb->len);
+                ath10k_dbg_dump(ar, ATH10K_DBG_PCI_DUMP, NULL, "pci rx: ",
+                                skb->data, skb->len);
+
                 cb->rx_completion(ar, skb, pipe_info->pipe_num);
         }
 
@@ -936,6 +950,12 @@ err:
         return err;
 }
 
+static int ath10k_pci_hif_diag_read(struct ath10k *ar, u32 address, void *buf,
+                                    size_t buf_len)
+{
+        return ath10k_pci_diag_read_mem(ar, address, buf, buf_len);
+}
+
 static u16 ath10k_pci_hif_get_free_queue_number(struct ath10k *ar, u8 pipe)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
@@ -986,6 +1006,8 @@ static void ath10k_pci_fw_crashed_dump(struct ath10k *ar)
 
         spin_lock_bh(&ar->data_lock);
 
+        ar->stats.fw_crash_counter++;
+
         crash_data = ath10k_debug_get_new_fw_crash_data(ar);
 
         if (crash_data)
@@ -1121,14 +1143,37 @@ static void ath10k_pci_hif_get_default_pipe(struct ath10k *ar,
                                                  &dl_is_polled);
 }
 
-static void ath10k_pci_irq_disable(struct ath10k *ar)
+static void ath10k_pci_irq_msi_fw_mask(struct ath10k *ar)
 {
-        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        int i;
+        u32 val;
 
+        val = ath10k_pci_read32(ar, SOC_CORE_BASE_ADDRESS + CORE_CTRL_ADDRESS);
+        val &= ~CORE_CTRL_PCIE_REG_31_MASK;
+
+        ath10k_pci_write32(ar, SOC_CORE_BASE_ADDRESS + CORE_CTRL_ADDRESS, val);
+}
+
+static void ath10k_pci_irq_msi_fw_unmask(struct ath10k *ar)
+{
+        u32 val;
+
+        val = ath10k_pci_read32(ar, SOC_CORE_BASE_ADDRESS + CORE_CTRL_ADDRESS);
+        val |= CORE_CTRL_PCIE_REG_31_MASK;
+
+        ath10k_pci_write32(ar, SOC_CORE_BASE_ADDRESS + CORE_CTRL_ADDRESS, val);
+}
+
+static void ath10k_pci_irq_disable(struct ath10k *ar)
+{
         ath10k_ce_disable_interrupts(ar);
         ath10k_pci_disable_and_clear_legacy_irq(ar);
-        /* FIXME: How to mask all MSI interrupts? */
+        ath10k_pci_irq_msi_fw_mask(ar);
+}
+
+static void ath10k_pci_irq_sync(struct ath10k *ar)
+{
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+        int i;
 
         for (i = 0; i < max(1, ar_pci->num_msi_intrs); i++)
                 synchronize_irq(ar_pci->pdev->irq + i);
@@ -1138,7 +1183,7 @@ static void ath10k_pci_irq_enable(struct ath10k *ar)
 {
         ath10k_ce_enable_interrupts(ar);
         ath10k_pci_enable_legacy_irq(ar);
-        /* FIXME: How to unmask all MSI interrupts? */
+        ath10k_pci_irq_msi_fw_unmask(ar);
 }
 
 static int ath10k_pci_hif_start(struct ath10k *ar)
@@ -1266,6 +1311,7 @@ static void ath10k_pci_hif_stop(struct ath10k *ar)
         ath10k_pci_warm_reset(ar);
 
         ath10k_pci_irq_disable(ar);
+        ath10k_pci_irq_sync(ar);
         ath10k_pci_flush(ar);
 }
 
@@ -1569,23 +1615,40 @@ static int ath10k_pci_init_config(struct ath10k *ar)
         return 0;
 }
 
-static int ath10k_pci_alloc_ce(struct ath10k *ar)
+static int ath10k_pci_alloc_pipes(struct ath10k *ar)
 {
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+        struct ath10k_pci_pipe *pipe;
         int i, ret;
 
         for (i = 0; i < CE_COUNT; i++) {
-                ret = ath10k_ce_alloc_pipe(ar, i, &host_ce_config_wlan[i]);
+                pipe = &ar_pci->pipe_info[i];
+                pipe->ce_hdl = &ar_pci->ce_states[i];
+                pipe->pipe_num = i;
+                pipe->hif_ce_state = ar;
+
+                ret = ath10k_ce_alloc_pipe(ar, i, &host_ce_config_wlan[i],
+                                           ath10k_pci_ce_send_done,
+                                           ath10k_pci_ce_recv_data);
                 if (ret) {
                         ath10k_err(ar, "failed to allocate copy engine pipe %d: %d\n",
                                    i, ret);
                         return ret;
                 }
+
+                /* Last CE is Diagnostic Window */
+                if (i == CE_COUNT - 1) {
+                        ar_pci->ce_diag = pipe->ce_hdl;
+                        continue;
+                }
+
+                pipe->buf_sz = (size_t)(host_ce_config_wlan[i].src_sz_max);
         }
 
         return 0;
 }
 
-static void ath10k_pci_free_ce(struct ath10k *ar)
+static void ath10k_pci_free_pipes(struct ath10k *ar)
 {
         int i;
 
@@ -1593,39 +1656,17 @@ static void ath10k_pci_free_ce(struct ath10k *ar)
                 ath10k_ce_free_pipe(ar, i);
 }
 
-static int ath10k_pci_ce_init(struct ath10k *ar)
+static int ath10k_pci_init_pipes(struct ath10k *ar)
 {
-        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct ath10k_pci_pipe *pipe_info;
-        const struct ce_attr *attr;
-        int pipe_num, ret;
+        int i, ret;
 
-        for (pipe_num = 0; pipe_num < CE_COUNT; pipe_num++) {
-                pipe_info = &ar_pci->pipe_info[pipe_num];
-                pipe_info->ce_hdl = &ar_pci->ce_states[pipe_num];
-                pipe_info->pipe_num = pipe_num;
-                pipe_info->hif_ce_state = ar;
-                attr = &host_ce_config_wlan[pipe_num];
-
-                ret = ath10k_ce_init_pipe(ar, pipe_num, attr,
-                                          ath10k_pci_ce_send_done,
-                                          ath10k_pci_ce_recv_data);
+        for (i = 0; i < CE_COUNT; i++) {
+                ret = ath10k_ce_init_pipe(ar, i, &host_ce_config_wlan[i]);
                 if (ret) {
                         ath10k_err(ar, "failed to initialize copy engine pipe %d: %d\n",
-                                   pipe_num, ret);
+                                   i, ret);
                         return ret;
                 }
-
-                if (pipe_num == CE_COUNT - 1) {
-                        /*
-                         * Reserve the ultimate CE for
-                         * diagnostic Window support
-                         */
-                        ar_pci->ce_diag = pipe_info->ce_hdl;
-                        continue;
-                }
-
-                pipe_info->buf_sz = (size_t)(attr->src_sz_max);
         }
 
         return 0;
@@ -1672,6 +1713,12 @@ static int ath10k_pci_warm_reset(struct ath10k *ar)
 
         ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot warm reset\n");
 
+        spin_lock_bh(&ar->data_lock);
+
+        ar->stats.fw_warm_reset_counter++;
+
+        spin_unlock_bh(&ar->data_lock);
+
         /* debug */
         val = ath10k_pci_read32(ar, SOC_CORE_BASE_ADDRESS +
                                 PCIE_INTR_CAUSE_ADDRESS);
@@ -1773,7 +1820,7 @@ static int __ath10k_pci_hif_power_up(struct ath10k *ar, bool cold_reset)
                 goto err;
         }
 
-        ret = ath10k_pci_ce_init(ar);
+        ret = ath10k_pci_init_pipes(ar);
         if (ret) {
                 ath10k_err(ar, "failed to initialize CE: %d\n", ret);
                 goto err;
@@ -1921,6 +1968,7 @@ static int ath10k_pci_hif_resume(struct ath10k *ar)
 
 static const struct ath10k_hif_ops ath10k_pci_hif_ops = {
         .tx_sg                  = ath10k_pci_hif_tx_sg,
+        .diag_read              = ath10k_pci_hif_diag_read,
         .exchange_bmi_msg       = ath10k_pci_hif_exchange_bmi_msg,
         .start                  = ath10k_pci_hif_start,
         .stop                   = ath10k_pci_hif_stop,
@@ -2250,14 +2298,14 @@ static int ath10k_pci_wait_for_target_init(struct ath10k *ar)
 
                 if (ar_pci->num_msi_intrs == 0)
                         /* Fix potential race by repeating CORE_BASE writes */
-                        ath10k_pci_write32(ar, SOC_CORE_BASE_ADDRESS +
-                                           PCIE_INTR_ENABLE_ADDRESS,
-                                           PCIE_INTR_FIRMWARE_MASK |
-                                           PCIE_INTR_CE_MASK_ALL);
+                        ath10k_pci_enable_legacy_irq(ar);
 
                 mdelay(10);
         } while (time_before(jiffies, timeout));
 
+        ath10k_pci_disable_and_clear_legacy_irq(ar);
+        ath10k_pci_irq_msi_fw_mask(ar);
+
         if (val == 0xffffffff) {
                 ath10k_err(ar, "failed to read device register, device is gone\n");
                 return -EIO;
@@ -2287,6 +2335,12 @@ static int ath10k_pci_cold_reset(struct ath10k *ar)
 
         ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot cold reset\n");
 
+        spin_lock_bh(&ar->data_lock);
+
+        ar->stats.fw_cold_reset_counter++;
+
+        spin_unlock_bh(&ar->data_lock);
+
         /* Put Target, including PCIe, into RESET. */
         val = ath10k_pci_reg_read32(ar, SOC_GLOBAL_RESET_ADDRESS);
         val |= 1;
@@ -2400,6 +2454,7 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
         u32 chip_id;
 
         ar = ath10k_core_create(sizeof(*ar_pci), &pdev->dev,
+                                ATH10K_BUS_PCI,
                                 &ath10k_pci_hif_ops);
         if (!ar) {
                 dev_err(&pdev->dev, "failed to allocate core\n");
@@ -2435,7 +2490,7 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
                 goto err_sleep;
         }
 
-        ret = ath10k_pci_alloc_ce(ar);
+        ret = ath10k_pci_alloc_pipes(ar);
         if (ret) {
                 ath10k_err(ar, "failed to allocate copy engine pipes: %d\n",
                            ret);
@@ -2443,25 +2498,12 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
         }
 
         ath10k_pci_ce_deinit(ar);
-
-        ret = ath10k_ce_disable_interrupts(ar);
-        if (ret) {
-                ath10k_err(ar, "failed to disable copy engine interrupts: %d\n",
-                           ret);
-                goto err_free_ce;
-        }
-
-        /* Workaround: There's no known way to mask all possible interrupts via
-         * device CSR. The only way to make sure device doesn't assert
-         * interrupts is to reset it. Interrupts are then disabled on host
-         * after handlers are registered.
-         */
-        ath10k_pci_warm_reset(ar);
+        ath10k_pci_irq_disable(ar);
 
         ret = ath10k_pci_init_irq(ar);
         if (ret) {
                 ath10k_err(ar, "failed to init irqs: %d\n", ret);
-                goto err_free_ce;
+                goto err_free_pipes;
         }
 
         ath10k_info(ar, "pci irq %s interrupts %d irq_mode %d reset_mode %d\n",
@@ -2474,9 +2516,6 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
                 goto err_deinit_irq;
         }
 
-        /* This shouldn't race as the device has been reset above. */
-        ath10k_pci_irq_disable(ar);
-
         ret = ath10k_core_register(ar, chip_id);
         if (ret) {
                 ath10k_err(ar, "failed to register driver core: %d\n", ret);
@@ -2492,8 +2531,8 @@ err_free_irq:
 err_deinit_irq:
         ath10k_pci_deinit_irq(ar);
 
-err_free_ce:
-        ath10k_pci_free_ce(ar);
+err_free_pipes:
+        ath10k_pci_free_pipes(ar);
 
 err_sleep:
         ath10k_pci_sleep(ar);
@@ -2527,7 +2566,7 @@ static void ath10k_pci_remove(struct pci_dev *pdev)
         ath10k_pci_kill_tasklet(ar);
         ath10k_pci_deinit_irq(ar);
         ath10k_pci_ce_deinit(ar);
-        ath10k_pci_free_ce(ar);
+        ath10k_pci_free_pipes(ar);
         ath10k_pci_sleep(ar);
         ath10k_pci_release(ar);
         ath10k_core_destroy(ar);
@@ -2565,5 +2604,7 @@ module_exit(ath10k_pci_exit);
 MODULE_AUTHOR("Qualcomm Atheros");
 MODULE_DESCRIPTION("Driver support for Atheros QCA988X PCIe devices");
 MODULE_LICENSE("Dual BSD/GPL");
-MODULE_FIRMWARE(QCA988X_HW_2_0_FW_DIR "/" QCA988X_HW_2_0_FW_3_FILE);
+MODULE_FIRMWARE(QCA988X_HW_2_0_FW_DIR "/" QCA988X_HW_2_0_FW_FILE);
+MODULE_FIRMWARE(QCA988X_HW_2_0_FW_DIR "/" ATH10K_FW_API2_FILE);
+MODULE_FIRMWARE(QCA988X_HW_2_0_FW_DIR "/" ATH10K_FW_API3_FILE);
 MODULE_FIRMWARE(QCA988X_HW_2_0_FW_DIR "/" QCA988X_HW_2_0_BOARD_DATA_FILE);
diff --git a/drivers/net/wireless/ath/ath10k/spectral.c b/drivers/net/wireless/ath/ath10k/spectral.c
index 3e1454b74e00..63ce61fcdac8 100644
--- a/drivers/net/wireless/ath/ath10k/spectral.c
+++ b/drivers/net/wireless/ath/ath10k/spectral.c
@@ -56,14 +56,14 @@ static uint8_t get_max_exp(s8 max_index, u16 max_magnitude, size_t bin_len,
 }
 
 int ath10k_spectral_process_fft(struct ath10k *ar,
-                                struct wmi_single_phyerr_rx_event *event,
-                                struct phyerr_fft_report *fftr,
+                                const struct wmi_phyerr *phyerr,
+                                const struct phyerr_fft_report *fftr,
                                 size_t bin_len, u64 tsf)
 {
         struct fft_sample_ath10k *fft_sample;
         u8 buf[sizeof(*fft_sample) + SPECTRAL_ATH10K_MAX_NUM_BINS];
         u16 freq1, freq2, total_gain_db, base_pwr_db, length, peak_mag;
-        u32 reg0, reg1, nf_list1, nf_list2;
+        u32 reg0, reg1;
         u8 chain_idx, *bins;
         int dc_pos;
 
@@ -82,7 +82,7 @@ int ath10k_spectral_process_fft(struct ath10k *ar,
         /* TODO: there might be a reason why the hardware reports 20/40/80 MHz,
          * but the results/plots suggest that its actually 22/44/88 MHz.
          */
-        switch (event->hdr.chan_width_mhz) {
+        switch (phyerr->chan_width_mhz) {
         case 20:
                 fft_sample->chan_width_mhz = 22;
                 break;
@@ -101,7 +101,7 @@ int ath10k_spectral_process_fft(struct ath10k *ar,
                 fft_sample->chan_width_mhz = 88;
                 break;
         default:
-                fft_sample->chan_width_mhz = event->hdr.chan_width_mhz;
+                fft_sample->chan_width_mhz = phyerr->chan_width_mhz;
         }
 
         fft_sample->relpwr_db = MS(reg1, SEARCH_FFT_REPORT_REG1_RELPWR_DB);
@@ -110,36 +110,22 @@ int ath10k_spectral_process_fft(struct ath10k *ar,
         peak_mag = MS(reg1, SEARCH_FFT_REPORT_REG1_PEAK_MAG);
         fft_sample->max_magnitude = __cpu_to_be16(peak_mag);
         fft_sample->max_index = MS(reg0, SEARCH_FFT_REPORT_REG0_PEAK_SIDX);
-        fft_sample->rssi = event->hdr.rssi_combined;
+        fft_sample->rssi = phyerr->rssi_combined;
 
         total_gain_db = MS(reg0, SEARCH_FFT_REPORT_REG0_TOTAL_GAIN_DB);
         base_pwr_db = MS(reg0, SEARCH_FFT_REPORT_REG0_BASE_PWR_DB);
         fft_sample->total_gain_db = __cpu_to_be16(total_gain_db);
         fft_sample->base_pwr_db = __cpu_to_be16(base_pwr_db);
 
-        freq1 = __le16_to_cpu(event->hdr.freq1);
-        freq2 = __le16_to_cpu(event->hdr.freq2);
+        freq1 = __le16_to_cpu(phyerr->freq1);
+        freq2 = __le16_to_cpu(phyerr->freq2);
         fft_sample->freq1 = __cpu_to_be16(freq1);
         fft_sample->freq2 = __cpu_to_be16(freq2);
 
-        nf_list1 = __le32_to_cpu(event->hdr.nf_list_1);
-        nf_list2 = __le32_to_cpu(event->hdr.nf_list_2);
         chain_idx = MS(reg0, SEARCH_FFT_REPORT_REG0_FFT_CHN_IDX);
 
-        switch (chain_idx) {
-        case 0:
-                fft_sample->noise = __cpu_to_be16(nf_list1 & 0xffffu);
-                break;
-        case 1:
-                fft_sample->noise = __cpu_to_be16((nf_list1 >> 16) & 0xffffu);
-                break;
-        case 2:
-                fft_sample->noise = __cpu_to_be16(nf_list2 & 0xffffu);
-                break;
-        case 3:
-                fft_sample->noise = __cpu_to_be16((nf_list2 >> 16) & 0xffffu);
-                break;
-        }
+        fft_sample->noise = __cpu_to_be16(
+                        __le16_to_cpu(phyerr->nf_chains[chain_idx]));
 
         bins = (u8 *)fftr;
         bins += sizeof(*fftr);
diff --git a/drivers/net/wireless/ath/ath10k/spectral.h b/drivers/net/wireless/ath/ath10k/spectral.h
index ddc57c557272..042f5b302c75 100644
--- a/drivers/net/wireless/ath/ath10k/spectral.h
+++ b/drivers/net/wireless/ath/ath10k/spectral.h
@@ -47,8 +47,8 @@ enum ath10k_spectral_mode {
 #ifdef CONFIG_ATH10K_DEBUGFS
 
 int ath10k_spectral_process_fft(struct ath10k *ar,
-                                struct wmi_single_phyerr_rx_event *event,
-                                struct phyerr_fft_report *fftr,
+                                const struct wmi_phyerr *phyerr,
+                                const struct phyerr_fft_report *fftr,
                                 size_t bin_len, u64 tsf);
 int ath10k_spectral_start(struct ath10k *ar);
 int ath10k_spectral_vif_stop(struct ath10k_vif *arvif);
@@ -59,8 +59,8 @@ void ath10k_spectral_destroy(struct ath10k *ar);
 
 static inline int
 ath10k_spectral_process_fft(struct ath10k *ar,
-                            struct wmi_single_phyerr_rx_event *event,
-                            struct phyerr_fft_report *fftr,
+                            const struct wmi_phyerr *phyerr,
+                            const struct phyerr_fft_report *fftr,
                             size_t bin_len, u64 tsf)
 {
         return 0;
diff --git a/drivers/net/wireless/ath/ath10k/trace.h b/drivers/net/wireless/ath/ath10k/trace.h
index 574b75ab2609..9d34e7f6c455 100644
--- a/drivers/net/wireless/ath/ath10k/trace.h
+++ b/drivers/net/wireless/ath/ath10k/trace.h
@@ -254,6 +254,169 @@ TRACE_EVENT(ath10k_wmi_dbglog,
         )
 );
 
+TRACE_EVENT(ath10k_htt_pktlog,
+            TP_PROTO(struct ath10k *ar, void *buf, u16 buf_len),
+
+        TP_ARGS(ar, buf, buf_len),
+
+        TP_STRUCT__entry(
+                __string(device, dev_name(ar->dev))
+                __string(driver, dev_driver_string(ar->dev))
+                __field(u16, buf_len)
+                __dynamic_array(u8, pktlog, buf_len)
+        ),
+
+        TP_fast_assign(
+                __assign_str(device, dev_name(ar->dev));
+                __assign_str(driver, dev_driver_string(ar->dev));
+                __entry->buf_len = buf_len;
+                memcpy(__get_dynamic_array(pktlog), buf, buf_len);
+        ),
+
+        TP_printk(
+                "%s %s size %hu",
+                __get_str(driver),
+                __get_str(device),
+                __entry->buf_len
+         )
+);
+
+TRACE_EVENT(ath10k_htt_rx_desc,
+            TP_PROTO(struct ath10k *ar, u32 tsf, void *rxdesc, u16 len),
+
+        TP_ARGS(ar, tsf, rxdesc, len),
+
+        TP_STRUCT__entry(
+                __string(device, dev_name(ar->dev))
+                __string(driver, dev_driver_string(ar->dev))
+                __field(u32, tsf)
+                __field(u16, len)
+                __dynamic_array(u8, rxdesc, len)
+        ),
+
+        TP_fast_assign(
+                __assign_str(device, dev_name(ar->dev));
+                __assign_str(driver, dev_driver_string(ar->dev));
+                __entry->tsf = tsf;
+                __entry->len = len;
+                memcpy(__get_dynamic_array(rxdesc), rxdesc, len);
+        ),
+
+        TP_printk(
+                "%s %s %u len %hu",
+                __get_str(driver),
+                __get_str(device),
+                __entry->tsf,
+                __entry->len
+         )
+);
+
+TRACE_EVENT(ath10k_htt_tx,
+            TP_PROTO(struct ath10k *ar, u16 msdu_id, u16 msdu_len,
+                     u8 vdev_id, u8 tid),
+
+        TP_ARGS(ar, msdu_id, msdu_len, vdev_id, tid),
+
+        TP_STRUCT__entry(
+                __string(device, dev_name(ar->dev))
+                __string(driver, dev_driver_string(ar->dev))
+                __field(u16, msdu_id)
+                __field(u16, msdu_len)
+                __field(u8, vdev_id)
+                __field(u8, tid)
+        ),
+
+        TP_fast_assign(
+                __assign_str(device, dev_name(ar->dev));
+                __assign_str(driver, dev_driver_string(ar->dev));
+                __entry->msdu_id = msdu_id;
+                __entry->msdu_len = msdu_len;
+                __entry->vdev_id = vdev_id;
+                __entry->tid = tid;
+        ),
+
+        TP_printk(
+                "%s %s msdu_id %d msdu_len %d vdev_id %d tid %d",
+                __get_str(driver),
+                __get_str(device),
+                __entry->msdu_id,
+                __entry->msdu_len,
+                __entry->vdev_id,
+                __entry->tid
+         )
+);
+
+TRACE_EVENT(ath10k_txrx_tx_unref,
+            TP_PROTO(struct ath10k *ar, u16 msdu_id),
+
+        TP_ARGS(ar, msdu_id),
+
+        TP_STRUCT__entry(
+                __string(device, dev_name(ar->dev))
+                __string(driver, dev_driver_string(ar->dev))
+                __field(u16, msdu_id)
+        ),
+
+        TP_fast_assign(
+                __assign_str(device, dev_name(ar->dev));
+                __assign_str(driver, dev_driver_string(ar->dev));
+                __entry->msdu_id = msdu_id;
+        ),
+
+        TP_printk(
+                "%s %s msdu_id %d",
+                __get_str(driver),
+                __get_str(device),
+                __entry->msdu_id
+         )
+);
+
+DECLARE_EVENT_CLASS(ath10k_data_event,
+                    TP_PROTO(struct ath10k *ar, void *data, size_t len),
+
+        TP_ARGS(ar, data, len),
+
+        TP_STRUCT__entry(
+                __string(device, dev_name(ar->dev))
+                __string(driver, dev_driver_string(ar->dev))
+                __field(size_t, len)
+                __dynamic_array(u8, data, len)
+        ),
+
+        TP_fast_assign(
+                __assign_str(device, dev_name(ar->dev));
+                __assign_str(driver, dev_driver_string(ar->dev));
+                __entry->len = len;
+                memcpy(__get_dynamic_array(data), data, len);
+        ),
+
+        TP_printk(
+                "%s %s len %zu\n",
+                __get_str(driver),
+                __get_str(device),
+                __entry->len
+        )
+);
+
+DEFINE_EVENT(ath10k_data_event, ath10k_htt_tx_msdu,
+             TP_PROTO(struct ath10k *ar, void *data, size_t len),
+             TP_ARGS(ar, data, len)
+);
+
+DEFINE_EVENT(ath10k_data_event, ath10k_htt_rx_pop_msdu,
+             TP_PROTO(struct ath10k *ar, void *data, size_t len),
+             TP_ARGS(ar, data, len)
+);
+
+DEFINE_EVENT(ath10k_data_event, ath10k_wmi_mgmt_tx,
+             TP_PROTO(struct ath10k *ar, void *data, size_t len),
+             TP_ARGS(ar, data, len)
+);
+
+DEFINE_EVENT(ath10k_data_event, ath10k_wmi_bcn_tx,
+             TP_PROTO(struct ath10k *ar, void *data, size_t len),
+             TP_ARGS(ar, data, len)
+);
 #endif /* _TRACE_H_ || TRACE_HEADER_MULTI_READ*/
 
 /* we don't want to use include/trace/events */
diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c
index a0cbc21d0d4b..f9c90e37bc7c 100644
--- a/drivers/net/wireless/ath/ath10k/txrx.c
+++ b/drivers/net/wireless/ath/ath10k/txrx.c
@@ -78,6 +78,7 @@ void ath10k_txrx_tx_unref(struct ath10k_htt *htt,
 
         info = IEEE80211_SKB_CB(msdu);
         memset(&info->status, 0, sizeof(info->status));
+        trace_ath10k_txrx_tx_unref(ar, tx_done->msdu_id);
 
         if (tx_done->discard) {
                 ieee80211_free_txskb(htt->ar->hw, msdu);
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index 2c42bd504b79..ae746cece211 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -609,6 +609,40 @@ static struct wmi_cmd_map wmi_10_2_cmd_map = {
         .gpio_output_cmdid = WMI_10_2_GPIO_OUTPUT_CMDID,
 };
 
+static void
+ath10k_wmi_put_wmi_channel(struct wmi_channel *ch,
+                           const struct wmi_channel_arg *arg)
+{
+        u32 flags = 0;
+
+        memset(ch, 0, sizeof(*ch));
+
+        if (arg->passive)
+                flags |= WMI_CHAN_FLAG_PASSIVE;
+        if (arg->allow_ibss)
+                flags |= WMI_CHAN_FLAG_ADHOC_ALLOWED;
+        if (arg->allow_ht)
+                flags |= WMI_CHAN_FLAG_ALLOW_HT;
+        if (arg->allow_vht)
+                flags |= WMI_CHAN_FLAG_ALLOW_VHT;
+        if (arg->ht40plus)
+                flags |= WMI_CHAN_FLAG_HT40_PLUS;
+        if (arg->chan_radar)
+                flags |= WMI_CHAN_FLAG_DFS;
+
+        ch->mhz = __cpu_to_le32(arg->freq);
+        ch->band_center_freq1 = __cpu_to_le32(arg->band_center_freq1);
+        ch->band_center_freq2 = 0;
+        ch->min_power = arg->min_power;
+        ch->max_power = arg->max_power;
+        ch->reg_power = arg->max_reg_power;
+        ch->antenna_max = arg->max_antenna_gain;
+
+        /* mode & flags share storage */
+        ch->mode = arg->mode;
+        ch->flags |= __cpu_to_le32(flags);
+}
+
 int ath10k_wmi_wait_for_service_ready(struct ath10k *ar)
 {
         int ret;
@@ -800,6 +834,7 @@ int ath10k_wmi_mgmt_tx(struct ath10k *ar, struct sk_buff *skb)
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi mgmt tx skb %p len %d ftype %02x stype %02x\n",
                    wmi_skb, wmi_skb->len, fc & IEEE80211_FCTL_FTYPE,
                    fc & IEEE80211_FCTL_STYPE);
+        trace_ath10k_wmi_mgmt_tx(ar, skb->data, skb->len);
 
         /* Send the management frame buffer to the target */
         ret = ath10k_wmi_cmd_send(ar, wmi_skb, ar->wmi.cmd->mgmt_tx_cmdid);
@@ -1079,7 +1114,6 @@ static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
         struct wmi_mgmt_rx_event_v2 *ev_v2;
         struct wmi_mgmt_rx_hdr_v1 *ev_hdr;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
-        struct ieee80211_channel *ch;
         struct ieee80211_hdr *hdr;
         u32 rx_status;
         u32 channel;
@@ -1132,25 +1166,26 @@ static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
         if (rx_status & WMI_RX_STATUS_ERR_MIC)
                 status->flag |= RX_FLAG_MMIC_ERROR;
 
-        /* HW can Rx CCK rates on 5GHz. In that case phy_mode is set to
+        /* Hardware can Rx CCK rates on 5GHz. In that case phy_mode is set to
          * MODE_11B. This means phy_mode is not a reliable source for the band
-         * of mgmt rx. */
-
-        ch = ar->scan_channel;
-        if (!ch)
-                ch = ar->rx_channel;
-
-        if (ch) {
-                status->band = ch->band;
-
-                if (phy_mode == MODE_11B &&
-                    status->band == IEEE80211_BAND_5GHZ)
-                        ath10k_dbg(ar, ATH10K_DBG_MGMT, "wmi mgmt rx 11b (CCK) on 5GHz\n");
+         * of mgmt rx.
+         */
+        if (channel >= 1 && channel <= 14) {
+                status->band = IEEE80211_BAND_2GHZ;
+        } else if (channel >= 36 && channel <= 165) {
+                status->band = IEEE80211_BAND_5GHZ;
         } else {
-                ath10k_warn(ar, "using (unreliable) phy_mode to extract band for mgmt rx\n");
-                status->band = phy_mode_to_band(phy_mode);
+                /* Shouldn't happen unless list of advertised channels to
+                 * mac80211 has been changed.
+                 */
+                WARN_ON_ONCE(1);
+                dev_kfree_skb(skb);
+                return 0;
         }
 
+        if (phy_mode == MODE_11B && status->band == IEEE80211_BAND_5GHZ)
+                ath10k_dbg(ar, ATH10K_DBG_MGMT, "wmi mgmt rx 11b (CCK) on 5GHz\n");
+
         status->freq = ieee80211_channel_to_frequency(channel, status->band);
         status->signal = snr + ATH10K_DEFAULT_NOISE_FLOOR;
         status->rate_idx = get_rate_idx(rate, status->band);
@@ -1295,14 +1330,196 @@ static int ath10k_wmi_event_debug_mesg(struct ath10k *ar, struct sk_buff *skb)
         return 0;
 }
 
+static void ath10k_wmi_pull_pdev_stats(const struct wmi_pdev_stats *src,
+                                       struct ath10k_fw_stats_pdev *dst)
+{
+        const struct wal_dbg_tx_stats *tx = &src->wal.tx;
+        const struct wal_dbg_rx_stats *rx = &src->wal.rx;
+
+        dst->ch_noise_floor = __le32_to_cpu(src->chan_nf);
+        dst->tx_frame_count = __le32_to_cpu(src->tx_frame_count);
+        dst->rx_frame_count = __le32_to_cpu(src->rx_frame_count);
+        dst->rx_clear_count = __le32_to_cpu(src->rx_clear_count);
+        dst->cycle_count = __le32_to_cpu(src->cycle_count);
+        dst->phy_err_count = __le32_to_cpu(src->phy_err_count);
+        dst->chan_tx_power = __le32_to_cpu(src->chan_tx_pwr);
+
+        dst->comp_queued = __le32_to_cpu(tx->comp_queued);
+        dst->comp_delivered = __le32_to_cpu(tx->comp_delivered);
+        dst->msdu_enqued = __le32_to_cpu(tx->msdu_enqued);
+        dst->mpdu_enqued = __le32_to_cpu(tx->mpdu_enqued);
+        dst->wmm_drop = __le32_to_cpu(tx->wmm_drop);
+        dst->local_enqued = __le32_to_cpu(tx->local_enqued);
+        dst->local_freed = __le32_to_cpu(tx->local_freed);
+        dst->hw_queued = __le32_to_cpu(tx->hw_queued);
+        dst->hw_reaped = __le32_to_cpu(tx->hw_reaped);
+        dst->underrun = __le32_to_cpu(tx->underrun);
+        dst->tx_abort = __le32_to_cpu(tx->tx_abort);
+        dst->mpdus_requed = __le32_to_cpu(tx->mpdus_requed);
+        dst->tx_ko = __le32_to_cpu(tx->tx_ko);
+        dst->data_rc = __le32_to_cpu(tx->data_rc);
+        dst->self_triggers = __le32_to_cpu(tx->self_triggers);
+        dst->sw_retry_failure = __le32_to_cpu(tx->sw_retry_failure);
+        dst->illgl_rate_phy_err = __le32_to_cpu(tx->illgl_rate_phy_err);
+        dst->pdev_cont_xretry = __le32_to_cpu(tx->pdev_cont_xretry);
+        dst->pdev_tx_timeout = __le32_to_cpu(tx->pdev_tx_timeout);
+        dst->pdev_resets = __le32_to_cpu(tx->pdev_resets);
+        dst->phy_underrun = __le32_to_cpu(tx->phy_underrun);
+        dst->txop_ovf = __le32_to_cpu(tx->txop_ovf);
+
+        dst->mid_ppdu_route_change = __le32_to_cpu(rx->mid_ppdu_route_change);
+        dst->status_rcvd = __le32_to_cpu(rx->status_rcvd);
+        dst->r0_frags = __le32_to_cpu(rx->r0_frags);
+        dst->r1_frags = __le32_to_cpu(rx->r1_frags);
+        dst->r2_frags = __le32_to_cpu(rx->r2_frags);
+        dst->r3_frags = __le32_to_cpu(rx->r3_frags);
+        dst->htt_msdus = __le32_to_cpu(rx->htt_msdus);
+        dst->htt_mpdus = __le32_to_cpu(rx->htt_mpdus);
+        dst->loc_msdus = __le32_to_cpu(rx->loc_msdus);
+        dst->loc_mpdus = __le32_to_cpu(rx->loc_mpdus);
+        dst->oversize_amsdu = __le32_to_cpu(rx->oversize_amsdu);
+        dst->phy_errs = __le32_to_cpu(rx->phy_errs);
+        dst->phy_err_drop = __le32_to_cpu(rx->phy_err_drop);
+        dst->mpdu_errs = __le32_to_cpu(rx->mpdu_errs);
+}
+
+static void ath10k_wmi_pull_peer_stats(const struct wmi_peer_stats *src,
+                                       struct ath10k_fw_stats_peer *dst)
+{
+        ether_addr_copy(dst->peer_macaddr, src->peer_macaddr.addr);
+        dst->peer_rssi = __le32_to_cpu(src->peer_rssi);
+        dst->peer_tx_rate = __le32_to_cpu(src->peer_tx_rate);
+}
+
+static int ath10k_wmi_main_pull_fw_stats(struct ath10k *ar,
+                                         struct sk_buff *skb,
+                                         struct ath10k_fw_stats *stats)
+{
+        const struct wmi_stats_event *ev = (void *)skb->data;
+        u32 num_pdev_stats, num_vdev_stats, num_peer_stats;
+        int i;
+
+        if (!skb_pull(skb, sizeof(*ev)))
+                return -EPROTO;
+
+        num_pdev_stats = __le32_to_cpu(ev->num_pdev_stats);
+        num_vdev_stats = __le32_to_cpu(ev->num_vdev_stats);
+        num_peer_stats = __le32_to_cpu(ev->num_peer_stats);
+
+        for (i = 0; i < num_pdev_stats; i++) {
+                const struct wmi_pdev_stats *src;
+                struct ath10k_fw_stats_pdev *dst;
+
+                src = (void *)skb->data;
+                if (!skb_pull(skb, sizeof(*src)))
+                        return -EPROTO;
+
+                dst = kzalloc(sizeof(*dst), GFP_ATOMIC);
+                if (!dst)
+                        continue;
+
+                ath10k_wmi_pull_pdev_stats(src, dst);
+                list_add_tail(&dst->list, &stats->pdevs);
+        }
+
+        /* fw doesn't implement vdev stats */
+
+        for (i = 0; i < num_peer_stats; i++) {
+                const struct wmi_peer_stats *src;
+                struct ath10k_fw_stats_peer *dst;
+
+                src = (void *)skb->data;
+                if (!skb_pull(skb, sizeof(*src)))
+                        return -EPROTO;
+
+                dst = kzalloc(sizeof(*dst), GFP_ATOMIC);
+                if (!dst)
+                        continue;
+
+                ath10k_wmi_pull_peer_stats(src, dst);
+                list_add_tail(&dst->list, &stats->peers);
+        }
+
+        return 0;
+}
+
+static int ath10k_wmi_10x_pull_fw_stats(struct ath10k *ar,
+                                        struct sk_buff *skb,
+                                        struct ath10k_fw_stats *stats)
+{
+        const struct wmi_stats_event *ev = (void *)skb->data;
+        u32 num_pdev_stats, num_vdev_stats, num_peer_stats;
+        int i;
+
+        if (!skb_pull(skb, sizeof(*ev)))
+                return -EPROTO;
+
+        num_pdev_stats = __le32_to_cpu(ev->num_pdev_stats);
+        num_vdev_stats = __le32_to_cpu(ev->num_vdev_stats);
+        num_peer_stats = __le32_to_cpu(ev->num_peer_stats);
+
+        for (i = 0; i < num_pdev_stats; i++) {
+                const struct wmi_10x_pdev_stats *src;
+                struct ath10k_fw_stats_pdev *dst;
+
+                src = (void *)skb->data;
+                if (!skb_pull(skb, sizeof(*src)))
+                        return -EPROTO;
+
+                dst = kzalloc(sizeof(*dst), GFP_ATOMIC);
+                if (!dst)
+                        continue;
+
+                ath10k_wmi_pull_pdev_stats(&src->old, dst);
+
+                dst->ack_rx_bad = __le32_to_cpu(src->ack_rx_bad);
+                dst->rts_bad = __le32_to_cpu(src->rts_bad);
+                dst->rts_good = __le32_to_cpu(src->rts_good);
+                dst->fcs_bad = __le32_to_cpu(src->fcs_bad);
+                dst->no_beacons = __le32_to_cpu(src->no_beacons);
+                dst->mib_int_count = __le32_to_cpu(src->mib_int_count);
+
+                list_add_tail(&dst->list, &stats->pdevs);
+        }
+
+        /* fw doesn't implement vdev stats */
+
+        for (i = 0; i < num_peer_stats; i++) {
+                const struct wmi_10x_peer_stats *src;
+                struct ath10k_fw_stats_peer *dst;
+
+                src = (void *)skb->data;
+                if (!skb_pull(skb, sizeof(*src)))
+                        return -EPROTO;
+
+                dst = kzalloc(sizeof(*dst), GFP_ATOMIC);
+                if (!dst)
+                        continue;
+
+                ath10k_wmi_pull_peer_stats(&src->old, dst);
+
+                dst->peer_rx_rate = __le32_to_cpu(src->peer_rx_rate);
+
+                list_add_tail(&dst->list, &stats->peers);
+        }
+
+        return 0;
+}
+
+int ath10k_wmi_pull_fw_stats(struct ath10k *ar, struct sk_buff *skb,
+                             struct ath10k_fw_stats *stats)
+{
+        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features))
+                return ath10k_wmi_10x_pull_fw_stats(ar, skb, stats);
+        else
+                return ath10k_wmi_main_pull_fw_stats(ar, skb, stats);
+}
+
 static void ath10k_wmi_event_update_stats(struct ath10k *ar,
                                           struct sk_buff *skb)
 {
-        struct wmi_stats_event *ev = (struct wmi_stats_event *)skb->data;
-
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_UPDATE_STATS_EVENTID\n");
-
-        ath10k_debug_read_target_stats(ar, ev);
+        ath10k_debug_fw_stats_process(ar, skb);
 }
 
 static void ath10k_wmi_event_vdev_start_resp(struct ath10k *ar,
@@ -1579,6 +1796,7 @@ static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
         struct wmi_bcn_info *bcn_info;
         struct ath10k_vif *arvif;
         struct sk_buff *bcn;
+        dma_addr_t paddr;
         int ret, vdev_id = 0;
 
         ev = (struct wmi_host_swba_event *)skb->data;
@@ -1647,27 +1865,35 @@ static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
                                 ath10k_warn(ar, "SWBA overrun on vdev %d\n",
                                             arvif->vdev_id);
 
-                        dma_unmap_single(arvif->ar->dev,
-                                         ATH10K_SKB_CB(arvif->beacon)->paddr,
-                                         arvif->beacon->len, DMA_TO_DEVICE);
-                        dev_kfree_skb_any(arvif->beacon);
-                        arvif->beacon = NULL;
+                        ath10k_mac_vif_beacon_free(arvif);
                 }
 
-                ATH10K_SKB_CB(bcn)->paddr = dma_map_single(arvif->ar->dev,
-                                                           bcn->data, bcn->len,
-                                                           DMA_TO_DEVICE);
-                ret = dma_mapping_error(arvif->ar->dev,
-                                        ATH10K_SKB_CB(bcn)->paddr);
-                if (ret) {
-                        ath10k_warn(ar, "failed to map beacon: %d\n", ret);
-                        dev_kfree_skb_any(bcn);
-                        goto skip;
+                if (!arvif->beacon_buf) {
+                        paddr = dma_map_single(arvif->ar->dev, bcn->data,
+                                               bcn->len, DMA_TO_DEVICE);
+                        ret = dma_mapping_error(arvif->ar->dev, paddr);
+                        if (ret) {
+                                ath10k_warn(ar, "failed to map beacon: %d\n",
+                                            ret);
+                                dev_kfree_skb_any(bcn);
+                                goto skip;
+                        }
+
+                        ATH10K_SKB_CB(bcn)->paddr = paddr;
+                } else {
+                        if (bcn->len > IEEE80211_MAX_FRAME_LEN) {
+                                ath10k_warn(ar, "trimming beacon %d -> %d bytes!\n",
+                                            bcn->len, IEEE80211_MAX_FRAME_LEN);
+                                skb_trim(bcn, IEEE80211_MAX_FRAME_LEN);
+                        }
+                        memcpy(arvif->beacon_buf, bcn->data, bcn->len);
+                        ATH10K_SKB_CB(bcn)->paddr = arvif->beacon_paddr;
                 }
 
                 arvif->beacon = bcn;
                 arvif->beacon_sent = false;
 
+                trace_ath10k_wmi_bcn_tx(ar, bcn->data, bcn->len);
                 ath10k_wmi_tx_beacon_nowait(arvif);
 skip:
                 spin_unlock_bh(&ar->data_lock);
@@ -1681,8 +1907,8 @@ static void ath10k_wmi_event_tbttoffset_update(struct ath10k *ar,
 }
 
 static void ath10k_dfs_radar_report(struct ath10k *ar,
-                                    struct wmi_single_phyerr_rx_event *event,
-                                    struct phyerr_radar_report *rr,
+                                    const struct wmi_phyerr *phyerr,
+                                    const struct phyerr_radar_report *rr,
                                     u64 tsf)
 {
         u32 reg0, reg1, tsf32l;
@@ -1715,12 +1941,12 @@ static void ath10k_dfs_radar_report(struct ath10k *ar,
                 return;
 
         /* report event to DFS pattern detector */
-        tsf32l = __le32_to_cpu(event->hdr.tsf_timestamp);
+        tsf32l = __le32_to_cpu(phyerr->tsf_timestamp);
         tsf64 = tsf & (~0xFFFFFFFFULL);
         tsf64 |= tsf32l;
 
         width = MS(reg1, RADAR_REPORT_REG1_PULSE_DUR);
-        rssi = event->hdr.rssi_combined;
+        rssi = phyerr->rssi_combined;
 
         /* hardware store this as 8 bit signed value,
          * set to zero if negative number
@@ -1759,8 +1985,8 @@ static void ath10k_dfs_radar_report(struct ath10k *ar,
 }
 
 static int ath10k_dfs_fft_report(struct ath10k *ar,
-                                 struct wmi_single_phyerr_rx_event *event,
-                                 struct phyerr_fft_report *fftr,
+                                 const struct wmi_phyerr *phyerr,
+                                 const struct phyerr_fft_report *fftr,
                                  u64 tsf)
 {
         u32 reg0, reg1;
@@ -1768,7 +1994,7 @@ static int ath10k_dfs_fft_report(struct ath10k *ar,
 
         reg0 = __le32_to_cpu(fftr->reg0);
         reg1 = __le32_to_cpu(fftr->reg1);
-        rssi = event->hdr.rssi_combined;
+        rssi = phyerr->rssi_combined;
 
         ath10k_dbg(ar, ATH10K_DBG_REGULATORY,
                    "wmi phyerr fft report total_gain_db %d base_pwr_db %d fft_chn_idx %d peak_sidx %d\n",
@@ -1797,20 +2023,20 @@ static int ath10k_dfs_fft_report(struct ath10k *ar,
 }
 
 static void ath10k_wmi_event_dfs(struct ath10k *ar,
-                                 struct wmi_single_phyerr_rx_event *event,
+                                 const struct wmi_phyerr *phyerr,
                                  u64 tsf)
 {
         int buf_len, tlv_len, res, i = 0;
-        struct phyerr_tlv *tlv;
-        struct phyerr_radar_report *rr;
-        struct phyerr_fft_report *fftr;
-        u8 *tlv_buf;
+        const struct phyerr_tlv *tlv;
+        const struct phyerr_radar_report *rr;
+        const struct phyerr_fft_report *fftr;
+        const u8 *tlv_buf;
 
-        buf_len = __le32_to_cpu(event->hdr.buf_len);
+        buf_len = __le32_to_cpu(phyerr->buf_len);
         ath10k_dbg(ar, ATH10K_DBG_REGULATORY,
                    "wmi event dfs err_code %d rssi %d tsfl 0x%X tsf64 0x%llX len %d\n",
-                   event->hdr.phy_err_code, event->hdr.rssi_combined,
-                   __le32_to_cpu(event->hdr.tsf_timestamp), tsf, buf_len);
+                   phyerr->phy_err_code, phyerr->rssi_combined,
+                   __le32_to_cpu(phyerr->tsf_timestamp), tsf, buf_len);
 
         /* Skip event if DFS disabled */
         if (!config_enabled(CONFIG_ATH10K_DFS_CERTIFIED))
@@ -1825,9 +2051,9 @@ static void ath10k_wmi_event_dfs(struct ath10k *ar,
                         return;
                 }
 
-                tlv = (struct phyerr_tlv *)&event->bufp[i];
+                tlv = (struct phyerr_tlv *)&phyerr->buf[i];
                 tlv_len = __le16_to_cpu(tlv->len);
-                tlv_buf = &event->bufp[i + sizeof(*tlv)];
+                tlv_buf = &phyerr->buf[i + sizeof(*tlv)];
                 ath10k_dbg(ar, ATH10K_DBG_REGULATORY,
                            "wmi event dfs tlv_len %d tlv_tag 0x%02X tlv_sig 0x%02X\n",
                            tlv_len, tlv->tag, tlv->sig);
@@ -1841,7 +2067,7 @@ static void ath10k_wmi_event_dfs(struct ath10k *ar,
                         }
 
                         rr = (struct phyerr_radar_report *)tlv_buf;
-                        ath10k_dfs_radar_report(ar, event, rr, tsf);
+                        ath10k_dfs_radar_report(ar, phyerr, rr, tsf);
                         break;
                 case PHYERR_TLV_TAG_SEARCH_FFT_REPORT:
                         if (i + sizeof(*tlv) + sizeof(*fftr) > buf_len) {
@@ -1851,7 +2077,7 @@ static void ath10k_wmi_event_dfs(struct ath10k *ar,
                         }
 
                         fftr = (struct phyerr_fft_report *)tlv_buf;
-                        res = ath10k_dfs_fft_report(ar, event, fftr, tsf);
+                        res = ath10k_dfs_fft_report(ar, phyerr, fftr, tsf);
                         if (res)
                                 return;
                         break;
@@ -1863,16 +2089,16 @@ static void ath10k_wmi_event_dfs(struct ath10k *ar,
 
 static void
 ath10k_wmi_event_spectral_scan(struct ath10k *ar,
-                               struct wmi_single_phyerr_rx_event *event,
+                               const struct wmi_phyerr *phyerr,
                                u64 tsf)
 {
         int buf_len, tlv_len, res, i = 0;
         struct phyerr_tlv *tlv;
-        u8 *tlv_buf;
-        struct phyerr_fft_report *fftr;
+        const void *tlv_buf;
+        const struct phyerr_fft_report *fftr;
         size_t fftr_len;
 
-        buf_len = __le32_to_cpu(event->hdr.buf_len);
+        buf_len = __le32_to_cpu(phyerr->buf_len);
 
         while (i < buf_len) {
                 if (i + sizeof(*tlv) > buf_len) {
@@ -1881,9 +2107,9 @@ ath10k_wmi_event_spectral_scan(struct ath10k *ar,
                         return;
                 }
 
-                tlv = (struct phyerr_tlv *)&event->bufp[i];
+                tlv = (struct phyerr_tlv *)&phyerr->buf[i];
                 tlv_len = __le16_to_cpu(tlv->len);
-                tlv_buf = &event->bufp[i + sizeof(*tlv)];
+                tlv_buf = &phyerr->buf[i + sizeof(*tlv)];
 
                 if (i + sizeof(*tlv) + tlv_len > buf_len) {
                         ath10k_warn(ar, "failed to parse phyerr tlv payload at byte %d\n",
@@ -1900,8 +2126,8 @@ ath10k_wmi_event_spectral_scan(struct ath10k *ar,
                         }
 
                         fftr_len = tlv_len - sizeof(*fftr);
-                        fftr = (struct phyerr_fft_report *)tlv_buf;
-                        res = ath10k_spectral_process_fft(ar, event,
+                        fftr = tlv_buf;
+                        res = ath10k_spectral_process_fft(ar, phyerr,
                                                           fftr, fftr_len,
                                                           tsf);
                         if (res < 0) {
@@ -1918,8 +2144,8 @@ ath10k_wmi_event_spectral_scan(struct ath10k *ar,
 
 static void ath10k_wmi_event_phyerr(struct ath10k *ar, struct sk_buff *skb)
 {
-        struct wmi_comb_phyerr_rx_event *comb_event;
-        struct wmi_single_phyerr_rx_event *event;
+        const struct wmi_phyerr_event *ev;
+        const struct wmi_phyerr *phyerr;
         u32 count, i, buf_len, phy_err_code;
         u64 tsf;
         int left_len = skb->len;
@@ -1927,38 +2153,38 @@ static void ath10k_wmi_event_phyerr(struct ath10k *ar, struct sk_buff *skb)
         ATH10K_DFS_STAT_INC(ar, phy_errors);
 
         /* Check if combined event available */
-        if (left_len < sizeof(*comb_event)) {
+        if (left_len < sizeof(*ev)) {
                 ath10k_warn(ar, "wmi phyerr combined event wrong len\n");
                 return;
         }
 
-        left_len -= sizeof(*comb_event);
+        left_len -= sizeof(*ev);
 
         /* Check number of included events */
-        comb_event = (struct wmi_comb_phyerr_rx_event *)skb->data;
-        count = __le32_to_cpu(comb_event->hdr.num_phyerr_events);
+        ev = (const struct wmi_phyerr_event *)skb->data;
+        count = __le32_to_cpu(ev->num_phyerrs);
 
-        tsf = __le32_to_cpu(comb_event->hdr.tsf_u32);
+        tsf = __le32_to_cpu(ev->tsf_u32);
         tsf <<= 32;
-        tsf |= __le32_to_cpu(comb_event->hdr.tsf_l32);
+        tsf |= __le32_to_cpu(ev->tsf_l32);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi event phyerr count %d tsf64 0x%llX\n",
                    count, tsf);
 
-        event = (struct wmi_single_phyerr_rx_event *)comb_event->bufp;
+        phyerr = ev->phyerrs;
         for (i = 0; i < count; i++) {
                 /* Check if we can read event header */
-                if (left_len < sizeof(*event)) {
+                if (left_len < sizeof(*phyerr)) {
                         ath10k_warn(ar, "single event (%d) wrong head len\n",
                                     i);
                         return;
                 }
 
-                left_len -= sizeof(*event);
+                left_len -= sizeof(*phyerr);
 
-                buf_len = __le32_to_cpu(event->hdr.buf_len);
-                phy_err_code = event->hdr.phy_err_code;
+                buf_len = __le32_to_cpu(phyerr->buf_len);
+                phy_err_code = phyerr->phy_err_code;
 
                 if (left_len < buf_len) {
                         ath10k_warn(ar, "single event (%d) wrong buf len\n", i);
@@ -1969,20 +2195,20 @@ static void ath10k_wmi_event_phyerr(struct ath10k *ar, struct sk_buff *skb)
 
                 switch (phy_err_code) {
                 case PHY_ERROR_RADAR:
-                        ath10k_wmi_event_dfs(ar, event, tsf);
+                        ath10k_wmi_event_dfs(ar, phyerr, tsf);
                         break;
                 case PHY_ERROR_SPECTRAL_SCAN:
-                        ath10k_wmi_event_spectral_scan(ar, event, tsf);
+                        ath10k_wmi_event_spectral_scan(ar, phyerr, tsf);
                         break;
                 case PHY_ERROR_FALSE_RADAR_EXT:
-                        ath10k_wmi_event_dfs(ar, event, tsf);
-                        ath10k_wmi_event_spectral_scan(ar, event, tsf);
+                        ath10k_wmi_event_dfs(ar, phyerr, tsf);
+                        ath10k_wmi_event_spectral_scan(ar, phyerr, tsf);
                         break;
                 default:
                         break;
                 }
 
-                event += sizeof(*event) + buf_len;
+                phyerr = (void *)phyerr + sizeof(*phyerr) + buf_len;
         }
 }
 
@@ -2163,30 +2389,113 @@ static int ath10k_wmi_alloc_host_mem(struct ath10k *ar, u32 req_id,
         return 0;
 }
 
-static void ath10k_wmi_service_ready_event_rx(struct ath10k *ar,
-                                              struct sk_buff *skb)
+static int ath10k_wmi_main_pull_svc_rdy_ev(struct sk_buff *skb,
+                                           struct wmi_svc_rdy_ev_arg *arg)
 {
-        struct wmi_service_ready_event *ev = (void *)skb->data;
+        struct wmi_service_ready_event *ev;
+        size_t i, n;
+
+        if (skb->len < sizeof(*ev))
+                return -EPROTO;
+
+        ev = (void *)skb->data;
+        skb_pull(skb, sizeof(*ev));
+        arg->min_tx_power = ev->hw_min_tx_power;
+        arg->max_tx_power = ev->hw_max_tx_power;
+        arg->ht_cap = ev->ht_cap_info;
+        arg->vht_cap = ev->vht_cap_info;
+        arg->sw_ver0 = ev->sw_version;
+        arg->sw_ver1 = ev->sw_version_1;
+        arg->phy_capab = ev->phy_capability;
+        arg->num_rf_chains = ev->num_rf_chains;
+        arg->eeprom_rd = ev->hal_reg_capabilities.eeprom_rd;
+        arg->num_mem_reqs = ev->num_mem_reqs;
+        arg->service_map = ev->wmi_service_bitmap;
+
+        n = min_t(size_t, __le32_to_cpu(arg->num_mem_reqs),
+                  ARRAY_SIZE(arg->mem_reqs));
+        for (i = 0; i < n; i++)
+                arg->mem_reqs[i] = &ev->mem_reqs[i];
+
+        if (skb->len <
+            __le32_to_cpu(arg->num_mem_reqs) * sizeof(arg->mem_reqs[0]))
+                return -EPROTO;
+
+        return 0;
+}
+
+static int ath10k_wmi_10x_pull_svc_rdy_ev(struct sk_buff *skb,
+                                          struct wmi_svc_rdy_ev_arg *arg)
+{
+        struct wmi_10x_service_ready_event *ev;
+        int i, n;
+
+        if (skb->len < sizeof(*ev))
+                return -EPROTO;
+
+        ev = (void *)skb->data;
+        skb_pull(skb, sizeof(*ev));
+        arg->min_tx_power = ev->hw_min_tx_power;
+        arg->max_tx_power = ev->hw_max_tx_power;
+        arg->ht_cap = ev->ht_cap_info;
+        arg->vht_cap = ev->vht_cap_info;
+        arg->sw_ver0 = ev->sw_version;
+        arg->phy_capab = ev->phy_capability;
+        arg->num_rf_chains = ev->num_rf_chains;
+        arg->eeprom_rd = ev->hal_reg_capabilities.eeprom_rd;
+        arg->num_mem_reqs = ev->num_mem_reqs;
+        arg->service_map = ev->wmi_service_bitmap;
+
+        n = min_t(size_t, __le32_to_cpu(arg->num_mem_reqs),
+                  ARRAY_SIZE(arg->mem_reqs));
+        for (i = 0; i < n; i++)
+                arg->mem_reqs[i] = &ev->mem_reqs[i];
+
+        if (skb->len <
+            __le32_to_cpu(arg->num_mem_reqs) * sizeof(arg->mem_reqs[0]))
+                return -EPROTO;
+
+        return 0;
+}
+
+static void ath10k_wmi_event_service_ready(struct ath10k *ar,
+                                           struct sk_buff *skb)
+{
+        struct wmi_svc_rdy_ev_arg arg = {};
+        u32 num_units, req_id, unit_size, num_mem_reqs, num_unit_info, i;
         DECLARE_BITMAP(svc_bmap, WMI_SERVICE_MAX) = {};
+        int ret;
+
+        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
+                ret = ath10k_wmi_10x_pull_svc_rdy_ev(skb, &arg);
+                wmi_10x_svc_map(arg.service_map, svc_bmap);
+        } else {
+                ret = ath10k_wmi_main_pull_svc_rdy_ev(skb, &arg);
+                wmi_main_svc_map(arg.service_map, svc_bmap);
+        }
 
-        if (skb->len < sizeof(*ev)) {
-                ath10k_warn(ar, "Service ready event was %d B but expected %zu B. Wrong firmware version?\n",
-                            skb->len, sizeof(*ev));
+        if (ret) {
+                ath10k_warn(ar, "failed to parse service ready: %d\n", ret);
                 return;
         }
 
-        ar->hw_min_tx_power = __le32_to_cpu(ev->hw_min_tx_power);
-        ar->hw_max_tx_power = __le32_to_cpu(ev->hw_max_tx_power);
-        ar->ht_cap_info = __le32_to_cpu(ev->ht_cap_info);
-        ar->vht_cap_info = __le32_to_cpu(ev->vht_cap_info);
+        ar->hw_min_tx_power = __le32_to_cpu(arg.min_tx_power);
+        ar->hw_max_tx_power = __le32_to_cpu(arg.max_tx_power);
+        ar->ht_cap_info = __le32_to_cpu(arg.ht_cap);
+        ar->vht_cap_info = __le32_to_cpu(arg.vht_cap);
         ar->fw_version_major =
-                (__le32_to_cpu(ev->sw_version) & 0xff000000) >> 24;
-        ar->fw_version_minor = (__le32_to_cpu(ev->sw_version) & 0x00ffffff);
+                (__le32_to_cpu(arg.sw_ver0) & 0xff000000) >> 24;
+        ar->fw_version_minor = (__le32_to_cpu(arg.sw_ver0) & 0x00ffffff);
         ar->fw_version_release =
-                (__le32_to_cpu(ev->sw_version_1) & 0xffff0000) >> 16;
-        ar->fw_version_build = (__le32_to_cpu(ev->sw_version_1) & 0x0000ffff);
-        ar->phy_capability = __le32_to_cpu(ev->phy_capability);
-        ar->num_rf_chains = __le32_to_cpu(ev->num_rf_chains);
+                (__le32_to_cpu(arg.sw_ver1) & 0xffff0000) >> 16;
+        ar->fw_version_build = (__le32_to_cpu(arg.sw_ver1) & 0x0000ffff);
+        ar->phy_capability = __le32_to_cpu(arg.phy_capab);
+        ar->num_rf_chains = __le32_to_cpu(arg.num_rf_chains);
+        ar->ath_common.regulatory.current_rd = __le32_to_cpu(arg.eeprom_rd);
+
+        ath10k_debug_read_service_map(ar, svc_bmap, sizeof(svc_bmap));
+        ath10k_dbg_dump(ar, ATH10K_DBG_WMI, NULL, "wmi svc: ",
+                        arg.service_map, sizeof(arg.service_map));
 
         /* only manually set fw features when not using FW IE format */
         if (ar->fw_api == 1 && ar->fw_version_build > 636)
@@ -2198,13 +2507,8 @@ static void ath10k_wmi_service_ready_event_rx(struct ath10k *ar,
                 ar->num_rf_chains = WMI_MAX_SPATIAL_STREAM;
         }
 
-        ar->ath_common.regulatory.current_rd =
-                __le32_to_cpu(ev->hal_reg_capabilities.eeprom_rd);
-
-        wmi_main_svc_map(ev->wmi_service_bitmap, svc_bmap);
-        ath10k_debug_read_service_map(ar, svc_bmap, sizeof(svc_bmap));
-        ath10k_dbg_dump(ar, ATH10K_DBG_WMI, NULL, "wmi svc: ",
-                        ev->wmi_service_bitmap, sizeof(ev->wmi_service_bitmap));
+        ar->supp_tx_chainmask = (1 << ar->num_rf_chains) - 1;
+        ar->supp_rx_chainmask = (1 << ar->num_rf_chains) - 1;
 
         if (strlen(ar->hw->wiphy->fw_version) == 0) {
                 snprintf(ar->hw->wiphy->fw_version,
@@ -2216,93 +2520,18 @@ static void ath10k_wmi_service_ready_event_rx(struct ath10k *ar,
                          ar->fw_version_build);
         }
 
-        /* FIXME: it probably should be better to support this */
-        if (__le32_to_cpu(ev->num_mem_reqs) > 0) {
-                ath10k_warn(ar, "target requested %d memory chunks; ignoring\n",
-                            __le32_to_cpu(ev->num_mem_reqs));
-        }
-
-        ath10k_dbg(ar, ATH10K_DBG_WMI,
-                   "wmi event service ready sw_ver 0x%08x sw_ver1 0x%08x abi_ver %u phy_cap 0x%08x ht_cap 0x%08x vht_cap 0x%08x vht_supp_msc 0x%08x sys_cap_info 0x%08x mem_reqs %u num_rf_chains %u\n",
-                   __le32_to_cpu(ev->sw_version),
-                   __le32_to_cpu(ev->sw_version_1),
-                   __le32_to_cpu(ev->abi_version),
-                   __le32_to_cpu(ev->phy_capability),
-                   __le32_to_cpu(ev->ht_cap_info),
-                   __le32_to_cpu(ev->vht_cap_info),
-                   __le32_to_cpu(ev->vht_supp_mcs),
-                   __le32_to_cpu(ev->sys_cap_info),
-                   __le32_to_cpu(ev->num_mem_reqs),
-                   __le32_to_cpu(ev->num_rf_chains));
-
-        complete(&ar->wmi.service_ready);
-}
-
-static void ath10k_wmi_10x_service_ready_event_rx(struct ath10k *ar,
-                                                  struct sk_buff *skb)
-{
-        u32 num_units, req_id, unit_size, num_mem_reqs, num_unit_info, i;
-        int ret;
-        struct wmi_service_ready_event_10x *ev = (void *)skb->data;
-        DECLARE_BITMAP(svc_bmap, WMI_SERVICE_MAX) = {};
-
-        if (skb->len < sizeof(*ev)) {
-                ath10k_warn(ar, "Service ready event was %d B but expected %zu B. Wrong firmware version?\n",
-                            skb->len, sizeof(*ev));
-                return;
-        }
-
-        ar->hw_min_tx_power = __le32_to_cpu(ev->hw_min_tx_power);
-        ar->hw_max_tx_power = __le32_to_cpu(ev->hw_max_tx_power);
-        ar->ht_cap_info = __le32_to_cpu(ev->ht_cap_info);
-        ar->vht_cap_info = __le32_to_cpu(ev->vht_cap_info);
-        ar->fw_version_major =
-                (__le32_to_cpu(ev->sw_version) & 0xff000000) >> 24;
-        ar->fw_version_minor = (__le32_to_cpu(ev->sw_version) & 0x00ffffff);
-        ar->phy_capability = __le32_to_cpu(ev->phy_capability);
-        ar->num_rf_chains = __le32_to_cpu(ev->num_rf_chains);
-
-        if (ar->num_rf_chains > WMI_MAX_SPATIAL_STREAM) {
-                ath10k_warn(ar, "hardware advertises support for more spatial streams than it should (%d > %d)\n",
-                            ar->num_rf_chains, WMI_MAX_SPATIAL_STREAM);
-                ar->num_rf_chains = WMI_MAX_SPATIAL_STREAM;
-        }
-
-        ar->ath_common.regulatory.current_rd =
-                __le32_to_cpu(ev->hal_reg_capabilities.eeprom_rd);
-
-        wmi_10x_svc_map(ev->wmi_service_bitmap, svc_bmap);
-        ath10k_debug_read_service_map(ar, svc_bmap, sizeof(svc_bmap));
-        ath10k_dbg_dump(ar, ATH10K_DBG_WMI, NULL, "wmi svc: ",
-                        ev->wmi_service_bitmap, sizeof(ev->wmi_service_bitmap));
-
-        if (strlen(ar->hw->wiphy->fw_version) == 0) {
-                snprintf(ar->hw->wiphy->fw_version,
-                         sizeof(ar->hw->wiphy->fw_version),
-                         "%u.%u",
-                         ar->fw_version_major,
-                         ar->fw_version_minor);
-        }
-
-        num_mem_reqs = __le32_to_cpu(ev->num_mem_reqs);
-
-        if (num_mem_reqs > ATH10K_MAX_MEM_REQS) {
+        num_mem_reqs = __le32_to_cpu(arg.num_mem_reqs);
+        if (num_mem_reqs > WMI_MAX_MEM_REQS) {
                 ath10k_warn(ar, "requested memory chunks number (%d) exceeds the limit\n",
                             num_mem_reqs);
                 return;
         }
 
-        if (!num_mem_reqs)
-                goto exit;
-
-        ath10k_dbg(ar, ATH10K_DBG_WMI, "firmware has requested %d memory chunks\n",
-                   num_mem_reqs);
-
         for (i = 0; i < num_mem_reqs; ++i) {
-                req_id = __le32_to_cpu(ev->mem_reqs[i].req_id);
-                num_units = __le32_to_cpu(ev->mem_reqs[i].num_units);
-                unit_size = __le32_to_cpu(ev->mem_reqs[i].unit_size);
-                num_unit_info = __le32_to_cpu(ev->mem_reqs[i].num_unit_info);
+                req_id = __le32_to_cpu(arg.mem_reqs[i]->req_id);
+                num_units = __le32_to_cpu(arg.mem_reqs[i]->num_units);
+                unit_size = __le32_to_cpu(arg.mem_reqs[i]->unit_size);
+                num_unit_info = __le32_to_cpu(arg.mem_reqs[i]->num_unit_info);
 
                 if (num_unit_info & NUM_UNITS_IS_NUM_PEERS)
                         /* number of units to allocate is number of
@@ -2316,7 +2545,7 @@ static void ath10k_wmi_10x_service_ready_event_rx(struct ath10k *ar,
                 ath10k_dbg(ar, ATH10K_DBG_WMI,
                            "wmi mem_req_id %d num_units %d num_unit_info %d unit size %d actual units %d\n",
                            req_id,
-                           __le32_to_cpu(ev->mem_reqs[i].num_units),
+                           __le32_to_cpu(arg.mem_reqs[i]->num_units),
                            num_unit_info,
                            unit_size,
                            num_units);
@@ -2327,23 +2556,23 @@ static void ath10k_wmi_10x_service_ready_event_rx(struct ath10k *ar,
                         return;
         }
 
-exit:
         ath10k_dbg(ar, ATH10K_DBG_WMI,
-                   "wmi event service ready sw_ver 0x%08x abi_ver %u phy_cap 0x%08x ht_cap 0x%08x vht_cap 0x%08x vht_supp_msc 0x%08x sys_cap_info 0x%08x mem_reqs %u num_rf_chains %u\n",
-                   __le32_to_cpu(ev->sw_version),
-                   __le32_to_cpu(ev->abi_version),
-                   __le32_to_cpu(ev->phy_capability),
-                   __le32_to_cpu(ev->ht_cap_info),
-                   __le32_to_cpu(ev->vht_cap_info),
-                   __le32_to_cpu(ev->vht_supp_mcs),
-                   __le32_to_cpu(ev->sys_cap_info),
-                   __le32_to_cpu(ev->num_mem_reqs),
-                   __le32_to_cpu(ev->num_rf_chains));
+                   "wmi event service ready min_tx_power 0x%08x max_tx_power 0x%08x ht_cap 0x%08x vht_cap 0x%08x sw_ver0 0x%08x sw_ver1 0x%08x phy_capab 0x%08x num_rf_chains 0x%08x eeprom_rd 0x%08x num_mem_reqs 0x%08x\n",
+                   __le32_to_cpu(arg.min_tx_power),
+                   __le32_to_cpu(arg.max_tx_power),
+                   __le32_to_cpu(arg.ht_cap),
+                   __le32_to_cpu(arg.vht_cap),
+                   __le32_to_cpu(arg.sw_ver0),
+                   __le32_to_cpu(arg.sw_ver1),
+                   __le32_to_cpu(arg.phy_capab),
+                   __le32_to_cpu(arg.num_rf_chains),
+                   __le32_to_cpu(arg.eeprom_rd),
+                   __le32_to_cpu(arg.num_mem_reqs));
 
         complete(&ar->wmi.service_ready);
 }
 
-static int ath10k_wmi_ready_event_rx(struct ath10k *ar, struct sk_buff *skb)
+static int ath10k_wmi_event_ready(struct ath10k *ar, struct sk_buff *skb)
 {
         struct wmi_ready_event *ev = (struct wmi_ready_event *)skb->data;
 
@@ -2466,10 +2695,10 @@ static void ath10k_wmi_main_process_rx(struct ath10k *ar, struct sk_buff *skb)
                 ath10k_wmi_event_vdev_install_key_complete(ar, skb);
                 break;
         case WMI_SERVICE_READY_EVENTID:
-                ath10k_wmi_service_ready_event_rx(ar, skb);
+                ath10k_wmi_event_service_ready(ar, skb);
                 break;
         case WMI_READY_EVENTID:
-                ath10k_wmi_ready_event_rx(ar, skb);
+                ath10k_wmi_event_ready(ar, skb);
                 break;
         default:
                 ath10k_warn(ar, "Unknown eventid: %d\n", id);
@@ -2586,10 +2815,10 @@ static void ath10k_wmi_10x_process_rx(struct ath10k *ar, struct sk_buff *skb)
                 ath10k_wmi_event_vdev_resume_req(ar, skb);
                 break;
         case WMI_10X_SERVICE_READY_EVENTID:
-                ath10k_wmi_10x_service_ready_event_rx(ar, skb);
+                ath10k_wmi_event_service_ready(ar, skb);
                 break;
         case WMI_10X_READY_EVENTID:
-                ath10k_wmi_ready_event_rx(ar, skb);
+                ath10k_wmi_event_ready(ar, skb);
                 break;
         case WMI_10X_PDEV_UTF_EVENTID:
                 /* ignore utf events */
@@ -2697,10 +2926,10 @@ static void ath10k_wmi_10_2_process_rx(struct ath10k *ar, struct sk_buff *skb)
                 ath10k_wmi_event_vdev_resume_req(ar, skb);
                 break;
         case WMI_10_2_SERVICE_READY_EVENTID:
-                ath10k_wmi_10x_service_ready_event_rx(ar, skb);
+                ath10k_wmi_event_service_ready(ar, skb);
                 break;
         case WMI_10_2_READY_EVENTID:
-                ath10k_wmi_ready_event_rx(ar, skb);
+                ath10k_wmi_event_ready(ar, skb);
                 break;
         case WMI_10_2_RTT_KEEPALIVE_EVENTID:
         case WMI_10_2_GPIO_INPUT_EVENTID:
@@ -2732,45 +2961,6 @@ static void ath10k_wmi_process_rx(struct ath10k *ar, struct sk_buff *skb)
         }
 }
 
-/* WMI Initialization functions */
-int ath10k_wmi_attach(struct ath10k *ar)
-{
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                if (test_bit(ATH10K_FW_FEATURE_WMI_10_2, ar->fw_features))
-                        ar->wmi.cmd = &wmi_10_2_cmd_map;
-                else
-                        ar->wmi.cmd = &wmi_10x_cmd_map;
-
-                ar->wmi.vdev_param = &wmi_10x_vdev_param_map;
-                ar->wmi.pdev_param = &wmi_10x_pdev_param_map;
-        } else {
-                ar->wmi.cmd = &wmi_cmd_map;
-                ar->wmi.vdev_param = &wmi_vdev_param_map;
-                ar->wmi.pdev_param = &wmi_pdev_param_map;
-        }
-
-        init_completion(&ar->wmi.service_ready);
-        init_completion(&ar->wmi.unified_ready);
-        init_waitqueue_head(&ar->wmi.tx_credits_wq);
-
-        return 0;
-}
-
-void ath10k_wmi_detach(struct ath10k *ar)
-{
-        int i;
-
-        /* free the host memory chunks requested by firmware */
-        for (i = 0; i < ar->wmi.num_mem_chunks; i++) {
-                dma_free_coherent(ar->dev,
-                                  ar->wmi.mem_chunks[i].len,
-                                  ar->wmi.mem_chunks[i].vaddr,
-                                  ar->wmi.mem_chunks[i].paddr);
-        }
-
-        ar->wmi.num_mem_chunks = 0;
-}
-
 int ath10k_wmi_connect(struct ath10k *ar)
 {
         int status;
@@ -2865,42 +3055,6 @@ int ath10k_wmi_pdev_set_regdomain(struct ath10k *ar, u16 rd, u16 rd2g,
                                                          ctl2g, ctl5g);
 }
 
-int ath10k_wmi_pdev_set_channel(struct ath10k *ar,
-                                const struct wmi_channel_arg *arg)
-{
-        struct wmi_set_channel_cmd *cmd;
-        struct sk_buff *skb;
-        u32 ch_flags = 0;
-
-        if (arg->passive)
-                return -EINVAL;
-
-        skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
-        if (!skb)
-                return -ENOMEM;
-
-        if (arg->chan_radar)
-                ch_flags |= WMI_CHAN_FLAG_DFS;
-
-        cmd = (struct wmi_set_channel_cmd *)skb->data;
-        cmd->chan.mhz               = __cpu_to_le32(arg->freq);
-        cmd->chan.band_center_freq1 = __cpu_to_le32(arg->freq);
-        cmd->chan.mode              = arg->mode;
-        cmd->chan.flags            |= __cpu_to_le32(ch_flags);
-        cmd->chan.min_power         = arg->min_power;
-        cmd->chan.max_power         = arg->max_power;
-        cmd->chan.reg_power         = arg->max_reg_power;
-        cmd->chan.reg_classid       = arg->reg_class_id;
-        cmd->chan.antenna_max       = arg->max_antenna_gain;
-
-        ath10k_dbg(ar, ATH10K_DBG_WMI,
-                   "wmi set channel mode %d freq %d\n",
-                   arg->mode, arg->freq);
-
-        return ath10k_wmi_cmd_send(ar, skb,
-                                   ar->wmi.cmd->pdev_set_channel_cmdid);
-}
-
 int ath10k_wmi_pdev_suspend_target(struct ath10k *ar, u32 suspend_opt)
 {
         struct wmi_pdev_suspend_cmd *cmd;
@@ -2951,13 +3105,34 @@ int ath10k_wmi_pdev_set_param(struct ath10k *ar, u32 id, u32 value)
         return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->pdev_set_param_cmdid);
 }
 
+static void ath10k_wmi_put_host_mem_chunks(struct ath10k *ar,
+                                           struct wmi_host_mem_chunks *chunks)
+{
+        struct host_memory_chunk *chunk;
+        int i;
+
+        chunks->count = __cpu_to_le32(ar->wmi.num_mem_chunks);
+
+        for (i = 0; i < ar->wmi.num_mem_chunks; i++) {
+                chunk = &chunks->items[i];
+                chunk->ptr = __cpu_to_le32(ar->wmi.mem_chunks[i].paddr);
+                chunk->size = __cpu_to_le32(ar->wmi.mem_chunks[i].len);
+                chunk->req_id = __cpu_to_le32(ar->wmi.mem_chunks[i].req_id);
+
+                ath10k_dbg(ar, ATH10K_DBG_WMI,
+                           "wmi chunk %d len %d requested, addr 0x%llx\n",
+                           i,
+                           ar->wmi.mem_chunks[i].len,
+                           (unsigned long long)ar->wmi.mem_chunks[i].paddr);
+        }
+}
+
 static int ath10k_wmi_main_cmd_init(struct ath10k *ar)
 {
         struct wmi_init_cmd *cmd;
         struct sk_buff *buf;
         struct wmi_resource_config config = {};
         u32 len, val;
-        int i;
 
         config.num_vdevs = __cpu_to_le32(TARGET_NUM_VDEVS);
         config.num_peers = __cpu_to_le32(TARGET_NUM_PEERS + TARGET_NUM_VDEVS);
@@ -3019,32 +3194,8 @@ static int ath10k_wmi_main_cmd_init(struct ath10k *ar)
 
         cmd = (struct wmi_init_cmd *)buf->data;
 
-        if (ar->wmi.num_mem_chunks == 0) {
-                cmd->num_host_mem_chunks = 0;
-                goto out;
-        }
-
-        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi sending %d memory chunks info.\n",
-                   ar->wmi.num_mem_chunks);
-
-        cmd->num_host_mem_chunks = __cpu_to_le32(ar->wmi.num_mem_chunks);
-
-        for (i = 0; i < ar->wmi.num_mem_chunks; i++) {
-                cmd->host_mem_chunks[i].ptr =
-                        __cpu_to_le32(ar->wmi.mem_chunks[i].paddr);
-                cmd->host_mem_chunks[i].size =
-                        __cpu_to_le32(ar->wmi.mem_chunks[i].len);
-                cmd->host_mem_chunks[i].req_id =
-                        __cpu_to_le32(ar->wmi.mem_chunks[i].req_id);
-
-                ath10k_dbg(ar, ATH10K_DBG_WMI,
-                           "wmi chunk %d len %d requested, addr 0x%llx\n",
-                           i,
-                           ar->wmi.mem_chunks[i].len,
-                           (unsigned long long)ar->wmi.mem_chunks[i].paddr);
-        }
-out:
         memcpy(&cmd->resource_config, &config, sizeof(config));
+        ath10k_wmi_put_host_mem_chunks(ar, &cmd->mem_chunks);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi init\n");
         return ath10k_wmi_cmd_send(ar, buf, ar->wmi.cmd->init_cmdid);
@@ -3056,7 +3207,6 @@ static int ath10k_wmi_10x_cmd_init(struct ath10k *ar)
         struct sk_buff *buf;
         struct wmi_resource_config_10x config = {};
         u32 len, val;
-        int i;
 
         config.num_vdevs = __cpu_to_le32(TARGET_10X_NUM_VDEVS);
         config.num_peers = __cpu_to_le32(TARGET_10X_NUM_PEERS);
@@ -3110,32 +3260,8 @@ static int ath10k_wmi_10x_cmd_init(struct ath10k *ar)
 
         cmd = (struct wmi_init_cmd_10x *)buf->data;
 
-        if (ar->wmi.num_mem_chunks == 0) {
-                cmd->num_host_mem_chunks = 0;
-                goto out;
-        }
-
-        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi sending %d memory chunks info.\n",
-                   ar->wmi.num_mem_chunks);
-
-        cmd->num_host_mem_chunks = __cpu_to_le32(ar->wmi.num_mem_chunks);
-
-        for (i = 0; i < ar->wmi.num_mem_chunks; i++) {
-                cmd->host_mem_chunks[i].ptr =
-                        __cpu_to_le32(ar->wmi.mem_chunks[i].paddr);
-                cmd->host_mem_chunks[i].size =
-                        __cpu_to_le32(ar->wmi.mem_chunks[i].len);
-                cmd->host_mem_chunks[i].req_id =
-                        __cpu_to_le32(ar->wmi.mem_chunks[i].req_id);
-
-                ath10k_dbg(ar, ATH10K_DBG_WMI,
-                           "wmi chunk %d len %d requested, addr 0x%llx\n",
-                           i,
-                           ar->wmi.mem_chunks[i].len,
-                           (unsigned long long)ar->wmi.mem_chunks[i].paddr);
-        }
-out:
         memcpy(&cmd->resource_config, &config, sizeof(config));
+        ath10k_wmi_put_host_mem_chunks(ar, &cmd->mem_chunks);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi init 10x\n");
         return ath10k_wmi_cmd_send(ar, buf, ar->wmi.cmd->init_cmdid);
@@ -3147,7 +3273,6 @@ static int ath10k_wmi_10_2_cmd_init(struct ath10k *ar)
         struct sk_buff *buf;
         struct wmi_resource_config_10x config = {};
         u32 len, val;
-        int i;
 
         config.num_vdevs = __cpu_to_le32(TARGET_10X_NUM_VDEVS);
         config.num_peers = __cpu_to_le32(TARGET_10X_NUM_PEERS);
@@ -3201,32 +3326,8 @@ static int ath10k_wmi_10_2_cmd_init(struct ath10k *ar)
 
         cmd = (struct wmi_init_cmd_10_2 *)buf->data;
 
-        if (ar->wmi.num_mem_chunks == 0) {
-                cmd->num_host_mem_chunks = 0;
-                goto out;
-        }
-
-        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi sending %d memory chunks info.\n",
-                   ar->wmi.num_mem_chunks);
-
-        cmd->num_host_mem_chunks = __cpu_to_le32(ar->wmi.num_mem_chunks);
-
-        for (i = 0; i < ar->wmi.num_mem_chunks; i++) {
-                cmd->host_mem_chunks[i].ptr =
-                        __cpu_to_le32(ar->wmi.mem_chunks[i].paddr);
-                cmd->host_mem_chunks[i].size =
-                        __cpu_to_le32(ar->wmi.mem_chunks[i].len);
-                cmd->host_mem_chunks[i].req_id =
-                        __cpu_to_le32(ar->wmi.mem_chunks[i].req_id);
-
-                ath10k_dbg(ar, ATH10K_DBG_WMI,
-                           "wmi chunk %d len %d requested, addr 0x%llx\n",
-                           i,
-                           ar->wmi.mem_chunks[i].len,
-                           (unsigned long long)ar->wmi.mem_chunks[i].paddr);
-        }
-out:
         memcpy(&cmd->resource_config.common, &config, sizeof(config));
+        ath10k_wmi_put_host_mem_chunks(ar, &cmd->mem_chunks);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi init 10.2\n");
         return ath10k_wmi_cmd_send(ar, buf, ar->wmi.cmd->init_cmdid);
@@ -3248,52 +3349,50 @@ int ath10k_wmi_cmd_init(struct ath10k *ar)
         return ret;
 }
 
-static int ath10k_wmi_start_scan_calc_len(struct ath10k *ar,
-                                          const struct wmi_start_scan_arg *arg)
+static int ath10k_wmi_start_scan_verify(const struct wmi_start_scan_arg *arg)
 {
-        int len;
+        if (arg->ie_len && !arg->ie)
+                return -EINVAL;
+        if (arg->n_channels && !arg->channels)
+                return -EINVAL;
+        if (arg->n_ssids && !arg->ssids)
+                return -EINVAL;
+        if (arg->n_bssids && !arg->bssids)
+                return -EINVAL;
 
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features))
-                len = sizeof(struct wmi_start_scan_cmd_10x);
-        else
-                len = sizeof(struct wmi_start_scan_cmd);
+        if (arg->ie_len > WLAN_SCAN_PARAMS_MAX_IE_LEN)
+                return -EINVAL;
+        if (arg->n_channels > ARRAY_SIZE(arg->channels))
+                return -EINVAL;
+        if (arg->n_ssids > WLAN_SCAN_PARAMS_MAX_SSID)
+                return -EINVAL;
+        if (arg->n_bssids > WLAN_SCAN_PARAMS_MAX_BSSID)
+                return -EINVAL;
 
-        if (arg->ie_len) {
-                if (!arg->ie)
-                        return -EINVAL;
-                if (arg->ie_len > WLAN_SCAN_PARAMS_MAX_IE_LEN)
-                        return -EINVAL;
+        return 0;
+}
 
+static size_t
+ath10k_wmi_start_scan_tlvs_len(const struct wmi_start_scan_arg *arg)
+{
+        int len = 0;
+
+        if (arg->ie_len) {
                 len += sizeof(struct wmi_ie_data);
                 len += roundup(arg->ie_len, 4);
         }
 
         if (arg->n_channels) {
-                if (!arg->channels)
-                        return -EINVAL;
-                if (arg->n_channels > ARRAY_SIZE(arg->channels))
-                        return -EINVAL;
-
                 len += sizeof(struct wmi_chan_list);
                 len += sizeof(__le32) * arg->n_channels;
         }
 
         if (arg->n_ssids) {
-                if (!arg->ssids)
-                        return -EINVAL;
-                if (arg->n_ssids > WLAN_SCAN_PARAMS_MAX_SSID)
-                        return -EINVAL;
-
                 len += sizeof(struct wmi_ssid_list);
                 len += sizeof(struct wmi_ssid) * arg->n_ssids;
         }
 
         if (arg->n_bssids) {
-                if (!arg->bssids)
-                        return -EINVAL;
-                if (arg->n_bssids > WLAN_SCAN_PARAMS_MAX_BSSID)
-                        return -EINVAL;
-
                 len += sizeof(struct wmi_bssid_list);
                 len += sizeof(struct wmi_mac_addr) * arg->n_bssids;
         }
@@ -3301,28 +3400,12 @@ static int ath10k_wmi_start_scan_calc_len(struct ath10k *ar,
         return len;
 }
 
-int ath10k_wmi_start_scan(struct ath10k *ar,
-                          const struct wmi_start_scan_arg *arg)
+static void
+ath10k_wmi_put_start_scan_common(struct wmi_start_scan_common *cmn,
+                                 const struct wmi_start_scan_arg *arg)
 {
-        struct wmi_start_scan_cmd *cmd;
-        struct sk_buff *skb;
-        struct wmi_ie_data *ie;
-        struct wmi_chan_list *channels;
-        struct wmi_ssid_list *ssids;
-        struct wmi_bssid_list *bssids;
         u32 scan_id;
         u32 scan_req_id;
-        int off;
-        int len = 0;
-        int i;
-
-        len = ath10k_wmi_start_scan_calc_len(ar, arg);
-        if (len < 0)
-                return len; /* len contains error code here */
-
-        skb = ath10k_wmi_alloc_skb(ar, len);
-        if (!skb)
-                return -ENOMEM;
 
         scan_id  = WMI_HOST_SCAN_REQ_ID_PREFIX;
         scan_id |= arg->scan_id;
@@ -3330,35 +3413,36 @@ int ath10k_wmi_start_scan(struct ath10k *ar,
         scan_req_id  = WMI_HOST_SCAN_REQUESTOR_ID_PREFIX;
         scan_req_id |= arg->scan_req_id;
 
-        cmd = (struct wmi_start_scan_cmd *)skb->data;
-        cmd->scan_id            = __cpu_to_le32(scan_id);
-        cmd->scan_req_id        = __cpu_to_le32(scan_req_id);
-        cmd->vdev_id            = __cpu_to_le32(arg->vdev_id);
-        cmd->scan_priority      = __cpu_to_le32(arg->scan_priority);
-        cmd->notify_scan_events = __cpu_to_le32(arg->notify_scan_events);
-        cmd->dwell_time_active  = __cpu_to_le32(arg->dwell_time_active);
-        cmd->dwell_time_passive = __cpu_to_le32(arg->dwell_time_passive);
-        cmd->min_rest_time      = __cpu_to_le32(arg->min_rest_time);
-        cmd->max_rest_time      = __cpu_to_le32(arg->max_rest_time);
-        cmd->repeat_probe_time  = __cpu_to_le32(arg->repeat_probe_time);
-        cmd->probe_spacing_time = __cpu_to_le32(arg->probe_spacing_time);
-        cmd->idle_time          = __cpu_to_le32(arg->idle_time);
-        cmd->max_scan_time      = __cpu_to_le32(arg->max_scan_time);
-        cmd->probe_delay        = __cpu_to_le32(arg->probe_delay);
-        cmd->scan_ctrl_flags    = __cpu_to_le32(arg->scan_ctrl_flags);
-
-        /* TLV list starts after fields included in the struct */
-        /* There's just one filed that differes the two start_scan
-         * structures - burst_duration, which we are not using btw,
-           no point to make the split here, just shift the buffer to fit with
-           given FW */
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features))
-                off = sizeof(struct wmi_start_scan_cmd_10x);
-        else
-                off = sizeof(struct wmi_start_scan_cmd);
+        cmn->scan_id            = __cpu_to_le32(scan_id);
+        cmn->scan_req_id        = __cpu_to_le32(scan_req_id);
+        cmn->vdev_id            = __cpu_to_le32(arg->vdev_id);
+        cmn->scan_priority      = __cpu_to_le32(arg->scan_priority);
+        cmn->notify_scan_events = __cpu_to_le32(arg->notify_scan_events);
+        cmn->dwell_time_active  = __cpu_to_le32(arg->dwell_time_active);
+        cmn->dwell_time_passive = __cpu_to_le32(arg->dwell_time_passive);
+        cmn->min_rest_time      = __cpu_to_le32(arg->min_rest_time);
+        cmn->max_rest_time      = __cpu_to_le32(arg->max_rest_time);
+        cmn->repeat_probe_time  = __cpu_to_le32(arg->repeat_probe_time);
+        cmn->probe_spacing_time = __cpu_to_le32(arg->probe_spacing_time);
+        cmn->idle_time          = __cpu_to_le32(arg->idle_time);
+        cmn->max_scan_time      = __cpu_to_le32(arg->max_scan_time);
+        cmn->probe_delay        = __cpu_to_le32(arg->probe_delay);
+        cmn->scan_ctrl_flags    = __cpu_to_le32(arg->scan_ctrl_flags);
+}
+
+static void
+ath10k_wmi_put_start_scan_tlvs(struct wmi_start_scan_tlvs *tlvs,
+                               const struct wmi_start_scan_arg *arg)
+{
+        struct wmi_ie_data *ie;
+        struct wmi_chan_list *channels;
+        struct wmi_ssid_list *ssids;
+        struct wmi_bssid_list *bssids;
+        void *ptr = tlvs->tlvs;
+        int i;
 
         if (arg->n_channels) {
-                channels = (void *)skb->data + off;
+                channels = ptr;
                 channels->tag = __cpu_to_le32(WMI_CHAN_LIST_TAG);
                 channels->num_chan = __cpu_to_le32(arg->n_channels);
 
@@ -3366,12 +3450,12 @@ int ath10k_wmi_start_scan(struct ath10k *ar,
                         channels->channel_list[i].freq =
                                 __cpu_to_le16(arg->channels[i]);
 
-                off += sizeof(*channels);
-                off += sizeof(__le32) * arg->n_channels;
+                ptr += sizeof(*channels);
+                ptr += sizeof(__le32) * arg->n_channels;
         }
 
         if (arg->n_ssids) {
-                ssids = (void *)skb->data + off;
+                ssids = ptr;
                 ssids->tag = __cpu_to_le32(WMI_SSID_LIST_TAG);
                 ssids->num_ssids = __cpu_to_le32(arg->n_ssids);
 
@@ -3383,12 +3467,12 @@ int ath10k_wmi_start_scan(struct ath10k *ar,
                                arg->ssids[i].len);
                 }
 
-                off += sizeof(*ssids);
-                off += sizeof(struct wmi_ssid) * arg->n_ssids;
+                ptr += sizeof(*ssids);
+                ptr += sizeof(struct wmi_ssid) * arg->n_ssids;
         }
 
         if (arg->n_bssids) {
-                bssids = (void *)skb->data + off;
+                bssids = ptr;
                 bssids->tag = __cpu_to_le32(WMI_BSSID_LIST_TAG);
                 bssids->num_bssid = __cpu_to_le32(arg->n_bssids);
 
@@ -3397,23 +3481,57 @@ int ath10k_wmi_start_scan(struct ath10k *ar,
                                arg->bssids[i].bssid,
                                ETH_ALEN);
 
-                off += sizeof(*bssids);
-                off += sizeof(struct wmi_mac_addr) * arg->n_bssids;
+                ptr += sizeof(*bssids);
+                ptr += sizeof(struct wmi_mac_addr) * arg->n_bssids;
         }
 
         if (arg->ie_len) {
-                ie = (void *)skb->data + off;
+                ie = ptr;
                 ie->tag = __cpu_to_le32(WMI_IE_TAG);
                 ie->ie_len = __cpu_to_le32(arg->ie_len);
                 memcpy(ie->ie_data, arg->ie, arg->ie_len);
 
-                off += sizeof(*ie);
-                off += roundup(arg->ie_len, 4);
+                ptr += sizeof(*ie);
+                ptr += roundup(arg->ie_len, 4);
         }
+}
 
-        if (off != skb->len) {
-                dev_kfree_skb(skb);
-                return -EINVAL;
+int ath10k_wmi_start_scan(struct ath10k *ar,
+                          const struct wmi_start_scan_arg *arg)
+{
+        struct sk_buff *skb;
+        size_t len;
+        int ret;
+
+        ret = ath10k_wmi_start_scan_verify(arg);
+        if (ret)
+                return ret;
+
+        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features))
+                len = sizeof(struct wmi_10x_start_scan_cmd) +
+                      ath10k_wmi_start_scan_tlvs_len(arg);
+        else
+                len = sizeof(struct wmi_start_scan_cmd) +
+                      ath10k_wmi_start_scan_tlvs_len(arg);
+
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return -ENOMEM;
+
+        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
+                struct wmi_10x_start_scan_cmd *cmd;
+
+                cmd = (struct wmi_10x_start_scan_cmd *)skb->data;
+                ath10k_wmi_put_start_scan_common(&cmd->common, arg);
+                ath10k_wmi_put_start_scan_tlvs(&cmd->tlvs, arg);
+        } else {
+                struct wmi_start_scan_cmd *cmd;
+
+                cmd = (struct wmi_start_scan_cmd *)skb->data;
+                cmd->burst_duration_ms = __cpu_to_le32(0);
+
+                ath10k_wmi_put_start_scan_common(&cmd->common, arg);
+                ath10k_wmi_put_start_scan_tlvs(&cmd->tlvs, arg);
         }
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi start scan\n");
@@ -3532,7 +3650,6 @@ ath10k_wmi_vdev_start_restart(struct ath10k *ar,
         struct sk_buff *skb;
         const char *cmdname;
         u32 flags = 0;
-        u32 ch_flags = 0;
 
         if (cmd_id != ar->wmi.cmd->vdev_start_request_cmdid &&
             cmd_id != ar->wmi.cmd->vdev_restart_request_cmdid)
@@ -3559,8 +3676,6 @@ ath10k_wmi_vdev_start_restart(struct ath10k *ar,
                 flags |= WMI_VDEV_START_HIDDEN_SSID;
         if (arg->pmf_enabled)
                 flags |= WMI_VDEV_START_PMF_ENABLED;
-        if (arg->channel.chan_radar)
-                ch_flags |= WMI_CHAN_FLAG_DFS;
 
         cmd = (struct wmi_vdev_start_request_cmd *)skb->data;
         cmd->vdev_id         = __cpu_to_le32(arg->vdev_id);
@@ -3576,18 +3691,7 @@ ath10k_wmi_vdev_start_restart(struct ath10k *ar,
                 memcpy(cmd->ssid.ssid, arg->ssid, arg->ssid_len);
         }
 
-        cmd->chan.mhz = __cpu_to_le32(arg->channel.freq);
-
-        cmd->chan.band_center_freq1 =
-                __cpu_to_le32(arg->channel.band_center_freq1);
-
-        cmd->chan.mode = arg->channel.mode;
-        cmd->chan.flags |= __cpu_to_le32(ch_flags);
-        cmd->chan.min_power = arg->channel.min_power;
-        cmd->chan.max_power = arg->channel.max_power;
-        cmd->chan.reg_power = arg->channel.max_reg_power;
-        cmd->chan.reg_classid = arg->channel.reg_class_id;
-        cmd->chan.antenna_max = arg->channel.max_antenna_gain;
+        ath10k_wmi_put_wmi_channel(&cmd->chan, &arg->channel);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi vdev %s id 0x%x flags: 0x%0X, freq %d, mode %d, ch_flags: 0x%0X, max_power: %d\n",
@@ -3968,35 +4072,10 @@ int ath10k_wmi_scan_chan_list(struct ath10k *ar,
         cmd->num_scan_chans = __cpu_to_le32(arg->n_channels);
 
         for (i = 0; i < arg->n_channels; i++) {
-                u32 flags = 0;
-
                 ch = &arg->channels[i];
                 ci = &cmd->chan_info[i];
 
-                if (ch->passive)
-                        flags |= WMI_CHAN_FLAG_PASSIVE;
-                if (ch->allow_ibss)
-                        flags |= WMI_CHAN_FLAG_ADHOC_ALLOWED;
-                if (ch->allow_ht)
-                        flags |= WMI_CHAN_FLAG_ALLOW_HT;
-                if (ch->allow_vht)
-                        flags |= WMI_CHAN_FLAG_ALLOW_VHT;
-                if (ch->ht40plus)
-                        flags |= WMI_CHAN_FLAG_HT40_PLUS;
-                if (ch->chan_radar)
-                        flags |= WMI_CHAN_FLAG_DFS;
-
-                ci->mhz               = __cpu_to_le32(ch->freq);
-                ci->band_center_freq1 = __cpu_to_le32(ch->freq);
-                ci->band_center_freq2 = 0;
-                ci->min_power         = ch->min_power;
-                ci->max_power         = ch->max_power;
-                ci->reg_power         = ch->max_reg_power;
-                ci->antenna_max       = ch->max_antenna_gain;
-
-                /* mode & flags share storage */
-                ci->mode              = ch->mode;
-                ci->flags            |= __cpu_to_le32(flags);
+                ath10k_wmi_put_wmi_channel(ci, ch);
         }
 
         return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->scan_chan_list_cmdid);
@@ -4267,3 +4346,74 @@ int ath10k_wmi_dbglog_cfg(struct ath10k *ar, u32 module_enable)
 
         return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->dbglog_cfg_cmdid);
 }
+
+int ath10k_wmi_pdev_pktlog_enable(struct ath10k *ar, u32 ev_bitmap)
+{
+        struct wmi_pdev_pktlog_enable_cmd *cmd;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
+        if (!skb)
+                return -ENOMEM;
+
+        ev_bitmap &= ATH10K_PKTLOG_ANY;
+        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                   "wmi enable pktlog filter:%x\n", ev_bitmap);
+
+        cmd = (struct wmi_pdev_pktlog_enable_cmd *)skb->data;
+        cmd->ev_bitmap = __cpu_to_le32(ev_bitmap);
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->pdev_pktlog_enable_cmdid);
+}
+
+int ath10k_wmi_pdev_pktlog_disable(struct ath10k *ar)
+{
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, 0);
+        if (!skb)
+                return -ENOMEM;
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi disable pktlog\n");
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->pdev_pktlog_disable_cmdid);
+}
+
+int ath10k_wmi_attach(struct ath10k *ar)
+{
+        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
+                if (test_bit(ATH10K_FW_FEATURE_WMI_10_2, ar->fw_features))
+                        ar->wmi.cmd = &wmi_10_2_cmd_map;
+                else
+                        ar->wmi.cmd = &wmi_10x_cmd_map;
+
+                ar->wmi.vdev_param = &wmi_10x_vdev_param_map;
+                ar->wmi.pdev_param = &wmi_10x_pdev_param_map;
+        } else {
+                ar->wmi.cmd = &wmi_cmd_map;
+                ar->wmi.vdev_param = &wmi_vdev_param_map;
+                ar->wmi.pdev_param = &wmi_pdev_param_map;
+        }
+
+        init_completion(&ar->wmi.service_ready);
+        init_completion(&ar->wmi.unified_ready);
+        init_waitqueue_head(&ar->wmi.tx_credits_wq);
+
+        return 0;
+}
+
+void ath10k_wmi_detach(struct ath10k *ar)
+{
+        int i;
+
+        /* free the host memory chunks requested by firmware */
+        for (i = 0; i < ar->wmi.num_mem_chunks; i++) {
+                dma_free_coherent(ar->dev,
+                                  ar->wmi.mem_chunks[i].len,
+                                  ar->wmi.mem_chunks[i].vaddr,
+                                  ar->wmi.mem_chunks[i].paddr);
+        }
+
+        ar->wmi.num_mem_chunks = 0;
+}
diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h
index 86f5ebccfe79..a38d788a6101 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.h
+++ b/drivers/net/wireless/ath/ath10k/wmi.h
@@ -1428,11 +1428,11 @@ struct wmi_service_ready_event {
          * where FW can access this memory directly (or) by DMA.
          */
         __le32 num_mem_reqs;
-        struct wlan_host_mem_req mem_reqs[1];
+        struct wlan_host_mem_req mem_reqs[0];
 } __packed;
 
 /* This is the definition from 10.X firmware branch */
-struct wmi_service_ready_event_10x {
+struct wmi_10x_service_ready_event {
         __le32 sw_version;
         __le32 abi_version;
 
@@ -1467,7 +1467,7 @@ struct wmi_service_ready_event_10x {
          */
         __le32 num_mem_reqs;
 
-        struct wlan_host_mem_req mem_reqs[1];
+        struct wlan_host_mem_req mem_reqs[0];
 } __packed;
 
 #define WMI_SERVICE_READY_TIMEOUT_HZ (5*HZ)
@@ -1883,38 +1883,26 @@ struct host_memory_chunk {
         __le32 size;
 } __packed;
 
+struct wmi_host_mem_chunks {
+        __le32 count;
+        /* some fw revisions require at least 1 chunk regardless of count */
+        struct host_memory_chunk items[1];
+} __packed;
+
 struct wmi_init_cmd {
         struct wmi_resource_config resource_config;
-        __le32 num_host_mem_chunks;
-
-        /*
-         * variable number of host memory chunks.
-         * This should be the last element in the structure
-         */
-        struct host_memory_chunk host_mem_chunks[1];
+        struct wmi_host_mem_chunks mem_chunks;
 } __packed;
 
 /* _10x stucture is from 10.X FW API */
 struct wmi_init_cmd_10x {
         struct wmi_resource_config_10x resource_config;
-        __le32 num_host_mem_chunks;
-
-        /*
-         * variable number of host memory chunks.
-         * This should be the last element in the structure
-         */
-        struct host_memory_chunk host_mem_chunks[1];
+        struct wmi_host_mem_chunks mem_chunks;
 } __packed;
 
 struct wmi_init_cmd_10_2 {
         struct wmi_resource_config_10_2 resource_config;
-        __le32 num_host_mem_chunks;
-
-        /*
-         * variable number of host memory chunks.
-         * This should be the last element in the structure
-         */
-        struct host_memory_chunk host_mem_chunks[1];
+        struct wmi_host_mem_chunks mem_chunks;
 } __packed;
 
 struct wmi_chan_list_entry {
@@ -1974,7 +1962,7 @@ enum wmi_scan_priority {
         WMI_SCAN_PRIORITY_COUNT   /* number of priorities supported */
 };
 
-struct wmi_start_scan_cmd {
+struct wmi_start_scan_common {
         /* Scan ID */
         __le32 scan_id;
         /* Scan requestor ID */
@@ -2032,95 +2020,25 @@ struct wmi_start_scan_cmd {
         __le32 probe_delay;
         /* Scan control flags */
         __le32 scan_ctrl_flags;
-
-        /* Burst duration time in msecs */
-        __le32 burst_duration;
-        /*
-         * TLV (tag length value )  paramerters follow the scan_cmd structure.
-         * TLV can contain channel list, bssid list, ssid list and
-         * ie. the TLV tags are defined above;
-         */
 } __packed;
 
-/* This is the definition from 10.X firmware branch */
-struct wmi_start_scan_cmd_10x {
-        /* Scan ID */
-        __le32 scan_id;
-
-        /* Scan requestor ID */
-        __le32 scan_req_id;
-
-        /* VDEV id(interface) that is requesting scan */
-        __le32 vdev_id;
-
-        /* Scan Priority, input to scan scheduler */
-        __le32 scan_priority;
-
-        /* Scan events subscription */
-        __le32 notify_scan_events;
-
-        /* dwell time in msec on active channels */
-        __le32 dwell_time_active;
-
-        /* dwell time in msec on passive channels */
-        __le32 dwell_time_passive;
-
-        /*
-         * min time in msec on the BSS channel,only valid if atleast one
-         * VDEV is active
-         */
-        __le32 min_rest_time;
-
-        /*
-         * max rest time in msec on the BSS channel,only valid if at least
-         * one VDEV is active
-         */
-        /*
-         * the scanner will rest on the bss channel at least min_rest_time
-         * after min_rest_time the scanner will start checking for tx/rx
-         * activity on all VDEVs. if there is no activity the scanner will
-         * switch to off channel. if there is activity the scanner will let
-         * the radio on the bss channel until max_rest_time expires.at
-         * max_rest_time scanner will switch to off channel irrespective of
-         * activity. activity is determined by the idle_time parameter.
-         */
-        __le32 max_rest_time;
-
-        /*
-         * time before sending next set of probe requests.
-         * The scanner keeps repeating probe requests transmission with
-         * period specified by repeat_probe_time.
-         * The number of probe requests specified depends on the ssid_list
-         * and bssid_list
-         */
-        __le32 repeat_probe_time;
-
-        /* time in msec between 2 consequetive probe requests with in a set. */
-        __le32 probe_spacing_time;
-
-        /*
-         * data inactivity time in msec on bss channel that will be used by
-         * scanner for measuring the inactivity.
-         */
-        __le32 idle_time;
-
-        /* maximum time in msec allowed for scan  */
-        __le32 max_scan_time;
-
-        /*
-         * delay in msec before sending first probe request after switching
-         * to a channel
+struct wmi_start_scan_tlvs {
+        /* TLV parameters. These includes channel list, ssid list, bssid list,
+         * extra ies.
          */
-        __le32 probe_delay;
+        u8 tlvs[0];
+} __packed;
 
-        /* Scan control flags */
-        __le32 scan_ctrl_flags;
+struct wmi_start_scan_cmd {
+        struct wmi_start_scan_common common;
+        __le32 burst_duration_ms;
+        struct wmi_start_scan_tlvs tlvs;
+} __packed;
 
-        /*
-         * TLV (tag length value )  paramerters follow the scan_cmd structure.
-         * TLV can contain channel list, bssid list, ssid list and
-         * ie. the TLV tags are defined above;
-         */
+/* This is the definition from 10.X firmware branch */
+struct wmi_10x_start_scan_cmd {
+        struct wmi_start_scan_common common;
+        struct wmi_start_scan_tlvs tlvs;
 } __packed;
 
 struct wmi_ssid_arg {
@@ -2306,94 +2224,25 @@ struct wmi_mgmt_rx_event_v2 {
 #define PHY_ERROR_FALSE_RADAR_EXT               0x24
 #define PHY_ERROR_RADAR                         0x05
 
-struct wmi_single_phyerr_rx_hdr {
-        /* TSF timestamp */
+struct wmi_phyerr {
         __le32 tsf_timestamp;
-
-        /*
-         * Current freq1, freq2
-         *
-         * [7:0]:    freq1[lo]
-         * [15:8] :   freq1[hi]
-         * [23:16]:   freq2[lo]
-         * [31:24]:   freq2[hi]
-         */
         __le16 freq1;
         __le16 freq2;
-
-        /*
-         * Combined RSSI over all chains and channel width for this PHY error
-         *
-         * [7:0]: RSSI combined
-         * [15:8]: Channel width (MHz)
-         * [23:16]: PHY error code
-         * [24:16]: reserved (future use)
-         */
         u8 rssi_combined;
         u8 chan_width_mhz;
         u8 phy_err_code;
         u8 rsvd0;
-
-        /*
-         * RSSI on chain 0 through 3
-         *
-         * This is formatted the same as the PPDU_START RX descriptor
-         * field:
-         *
-         * [7:0]:   pri20
-         * [15:8]:  sec20
-         * [23:16]: sec40
-         * [31:24]: sec80
-         */
-
-        __le32 rssi_chain0;
-        __le32 rssi_chain1;
-        __le32 rssi_chain2;
-        __le32 rssi_chain3;
-
-        /*
-         * Last calibrated NF value for chain 0 through 3
-         *
-         * nf_list_1:
-         *
-         * + [15:0] - chain 0
-         * + [31:16] - chain 1
-         *
-         * nf_list_2:
-         *
-         * + [15:0] - chain 2
-         * + [31:16] - chain 3
-         */
-        __le32 nf_list_1;
-        __le32 nf_list_2;
-
-        /* Length of the frame */
+        __le32 rssi_chains[4];
+        __le16 nf_chains[4];
         __le32 buf_len;
+        u8 buf[0];
 } __packed;
 
-struct wmi_single_phyerr_rx_event {
-        /* Phy error event header */
-        struct wmi_single_phyerr_rx_hdr hdr;
-        /* frame buffer */
-        u8 bufp[0];
-} __packed;
-
-struct wmi_comb_phyerr_rx_hdr {
-        /* Phy error phy error count */
-        __le32 num_phyerr_events;
+struct wmi_phyerr_event {
+        __le32 num_phyerrs;
         __le32 tsf_l32;
         __le32 tsf_u32;
-} __packed;
-
-struct wmi_comb_phyerr_rx_event {
-        /* Phy error phy error count */
-        struct wmi_comb_phyerr_rx_hdr hdr;
-        /*
-         * frame buffer - contains multiple payloads in the order:
-         *                    header - payload, header - payload...
-         *  (The header is of type: wmi_single_phyerr_rx_hdr)
-         */
-        u8 bufp[0];
+        struct wmi_phyerr phyerrs[0];
 } __packed;
 
 #define PHYERR_TLV_SIG                          0xBB
@@ -2908,11 +2757,6 @@ enum wmi_tp_scale {
         WMI_TP_SCALE_SIZE   = 5,        /* max num of enum     */
 };
 
-struct wmi_set_channel_cmd {
-        /* channel (only frequency and mode info are used) */
-        struct wmi_channel chan;
-} __packed;
-
 struct wmi_pdev_chanlist_update_event {
         /* number of channels */
         __le32 num_chan;
@@ -2943,6 +2787,10 @@ struct wmi_pdev_set_channel_cmd {
         struct wmi_channel chan;
 } __packed;
 
+struct wmi_pdev_pktlog_enable_cmd {
+        __le32 ev_bitmap;
+} __packed;
+
 /* Customize the DSCP (bit) to TID (0-7) mapping for QOS */
 #define WMI_DSCP_MAP_MAX    (64)
 struct wmi_pdev_set_dscp_tid_map_cmd {
@@ -3177,7 +3025,7 @@ struct wmi_stats_event {
  * PDEV statistics
  * TODO: add all PDEV stats here
  */
-struct wmi_pdev_stats_old {
+struct wmi_pdev_stats {
         __le32 chan_nf;        /* Channel noise floor */
         __le32 tx_frame_count; /* TX frame count */
         __le32 rx_frame_count; /* RX frame count */
@@ -3188,15 +3036,8 @@ struct wmi_pdev_stats_old {
         struct wal_dbg_stats wal; /* WAL dbg stats */
 } __packed;
 
-struct wmi_pdev_stats_10x {
-        __le32 chan_nf;        /* Channel noise floor */
-        __le32 tx_frame_count; /* TX frame count */
-        __le32 rx_frame_count; /* RX frame count */
-        __le32 rx_clear_count; /* rx clear count */
-        __le32 cycle_count;    /* cycle count */
-        __le32 phy_err_count;  /* Phy error count */
-        __le32 chan_tx_pwr;    /* channel tx power */
-        struct wal_dbg_stats wal; /* WAL dbg stats */
+struct wmi_10x_pdev_stats {
+        struct wmi_pdev_stats old;
         __le32 ack_rx_bad;
         __le32 rts_bad;
         __le32 rts_good;
@@ -3217,16 +3058,14 @@ struct wmi_vdev_stats {
  * peer statistics.
  * TODO: add more stats
  */
-struct wmi_peer_stats_old {
+struct wmi_peer_stats {
         struct wmi_mac_addr peer_macaddr;
         __le32 peer_rssi;
         __le32 peer_tx_rate;
 } __packed;
 
-struct wmi_peer_stats_10x {
-        struct wmi_mac_addr peer_macaddr;
-        __le32 peer_rssi;
-        __le32 peer_tx_rate;
+struct wmi_10x_peer_stats {
+        struct wmi_peer_stats old;
         __le32 peer_rx_rate;
 } __packed;
 
@@ -4719,8 +4558,26 @@ struct wmi_dbglog_cfg_cmd {
 /* By default disable power save for IBSS */
 #define ATH10K_DEFAULT_ATIM 0
 
+#define WMI_MAX_MEM_REQS 16
+
+struct wmi_svc_rdy_ev_arg {
+        __le32 min_tx_power;
+        __le32 max_tx_power;
+        __le32 ht_cap;
+        __le32 vht_cap;
+        __le32 sw_ver0;
+        __le32 sw_ver1;
+        __le32 phy_capab;
+        __le32 num_rf_chains;
+        __le32 eeprom_rd;
+        __le32 num_mem_reqs;
+        const __le32 *service_map;
+        const struct wlan_host_mem_req *mem_reqs[WMI_MAX_MEM_REQS];
+};
+
 struct ath10k;
 struct ath10k_vif;
+struct ath10k_fw_stats;
 
 int ath10k_wmi_attach(struct ath10k *ar);
 void ath10k_wmi_detach(struct ath10k *ar);
@@ -4732,8 +4589,6 @@ int ath10k_wmi_connect(struct ath10k *ar);
 struct sk_buff *ath10k_wmi_alloc_skb(struct ath10k *ar, u32 len);
 int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id);
 
-int ath10k_wmi_pdev_set_channel(struct ath10k *ar,
-                                const struct wmi_channel_arg *);
 int ath10k_wmi_pdev_suspend_target(struct ath10k *ar, u32 suspend_opt);
 int ath10k_wmi_pdev_resume_target(struct ath10k *ar);
 int ath10k_wmi_pdev_set_regdomain(struct ath10k *ar, u16 rd, u16 rd2g,
@@ -4794,5 +4649,9 @@ int ath10k_wmi_force_fw_hang(struct ath10k *ar,
                              enum wmi_force_fw_hang_type type, u32 delay_ms);
 int ath10k_wmi_mgmt_tx(struct ath10k *ar, struct sk_buff *skb);
 int ath10k_wmi_dbglog_cfg(struct ath10k *ar, u32 module_enable);
+int ath10k_wmi_pull_fw_stats(struct ath10k *ar, struct sk_buff *skb,
+                             struct ath10k_fw_stats *stats);
+int ath10k_wmi_pdev_pktlog_enable(struct ath10k *ar, u32 ev_list);
+int ath10k_wmi_pdev_pktlog_disable(struct ath10k *ar);
 
 #endif /* _WMI_H_ */
diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
index ba60e37213eb..7a5337877a0c 100644
--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
@@ -2976,11 +2976,11 @@ static int ath6kl_stop_ap(struct wiphy *wiphy, struct net_device *dev)
 static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
 
 static int ath6kl_del_station(struct wiphy *wiphy, struct net_device *dev,
-                              const u8 *mac)
+                              struct station_del_parameters *params)
 {
         struct ath6kl *ar = ath6kl_priv(dev);
         struct ath6kl_vif *vif = netdev_priv(dev);
-        const u8 *addr = mac ? mac : bcast_addr;
+        const u8 *addr = params->mac ? params->mac : bcast_addr;
 
         return ath6kl_wmi_ap_set_mlme(ar->wmi, vif->fw_vif_idx, WMI_AP_DEAUTH,
                                       addr, WLAN_REASON_PREV_AUTH_NOT_VALID);
diff --git a/drivers/net/wireless/ath/ath6kl/common.h b/drivers/net/wireless/ath/ath6kl/common.h
index 05debf700a84..4f82e8632d37 100644
--- a/drivers/net/wireless/ath/ath6kl/common.h
+++ b/drivers/net/wireless/ath/ath6kl/common.h
@@ -22,7 +22,7 @@
 
 #define ATH6KL_MAX_IE                   256
 
-__printf(2, 3) int ath6kl_printk(const char *level, const char *fmt, ...);
+__printf(2, 3) void ath6kl_printk(const char *level, const char *fmt, ...);
 
 /*
  * Reflects the version of binary interface exposed by ATH6KL target
diff --git a/drivers/net/wireless/ath/ath6kl/debug.c b/drivers/net/wireless/ath/ath6kl/debug.c
index 55c4064dd506..81ba48d2938b 100644
--- a/drivers/net/wireless/ath/ath6kl/debug.c
+++ b/drivers/net/wireless/ath/ath6kl/debug.c
@@ -37,76 +37,64 @@ struct ath6kl_fwlog_slot {
 
 #define ATH6KL_FWLOG_VALID_MASK 0x1ffff
 
-int ath6kl_printk(const char *level, const char *fmt, ...)
+void ath6kl_printk(const char *level, const char *fmt, ...)
 {
         struct va_format vaf;
         va_list args;
-        int rtn;
 
         va_start(args, fmt);
 
         vaf.fmt = fmt;
         vaf.va = &args;
 
-        rtn = printk("%sath6kl: %pV", level, &vaf);
+        printk("%sath6kl: %pV", level, &vaf);
 
         va_end(args);
-
-        return rtn;
 }
 EXPORT_SYMBOL(ath6kl_printk);
 
-int ath6kl_info(const char *fmt, ...)
+void ath6kl_info(const char *fmt, ...)
 {
         struct va_format vaf = {
                 .fmt = fmt,
         };
         va_list args;
-        int ret;
 
         va_start(args, fmt);
         vaf.va = &args;
-        ret = ath6kl_printk(KERN_INFO, "%pV", &vaf);
+        ath6kl_printk(KERN_INFO, "%pV", &vaf);
         trace_ath6kl_log_info(&vaf);
         va_end(args);
-
-        return ret;
 }
 EXPORT_SYMBOL(ath6kl_info);
 
-int ath6kl_err(const char *fmt, ...)
+void ath6kl_err(const char *fmt, ...)
 {
         struct va_format vaf = {
                 .fmt = fmt,
         };
         va_list args;
-        int ret;
 
         va_start(args, fmt);
         vaf.va = &args;
-        ret = ath6kl_printk(KERN_ERR, "%pV", &vaf);
+        ath6kl_printk(KERN_ERR, "%pV", &vaf);
         trace_ath6kl_log_err(&vaf);
         va_end(args);
-
-        return ret;
 }
 EXPORT_SYMBOL(ath6kl_err);
 
-int ath6kl_warn(const char *fmt, ...)
+void ath6kl_warn(const char *fmt, ...)
 {
         struct va_format vaf = {
                 .fmt = fmt,
         };
         va_list args;
-        int ret;
 
         va_start(args, fmt);
         vaf.va = &args;
-        ret = ath6kl_printk(KERN_WARNING, "%pV", &vaf);
+        ath6kl_printk(KERN_WARNING, "%pV", &vaf);
         trace_ath6kl_log_warn(&vaf);
         va_end(args);
-
-        return ret;
 }
 EXPORT_SYMBOL(ath6kl_warn);
 
diff --git a/drivers/net/wireless/ath/ath6kl/debug.h b/drivers/net/wireless/ath/ath6kl/debug.h
index e194c10d9f00..19106ed28961 100644
--- a/drivers/net/wireless/ath/ath6kl/debug.h
+++ b/drivers/net/wireless/ath/ath6kl/debug.h
@@ -50,10 +50,10 @@ enum ATH6K_DEBUG_MASK {
 };
 
 extern unsigned int debug_mask;
-__printf(2, 3) int ath6kl_printk(const char *level, const char *fmt, ...);
-__printf(1, 2) int ath6kl_info(const char *fmt, ...);
-__printf(1, 2) int ath6kl_err(const char *fmt, ...);
-__printf(1, 2) int ath6kl_warn(const char *fmt, ...);
+__printf(2, 3) void ath6kl_printk(const char *level, const char *fmt, ...);
+__printf(1, 2) void ath6kl_info(const char *fmt, ...);
+__printf(1, 2) void ath6kl_err(const char *fmt, ...);
+__printf(1, 2) void ath6kl_warn(const char *fmt, ...);
 
 enum ath6kl_war {
         ATH6KL_WAR_INVALID_RATE,
@@ -81,10 +81,9 @@ int ath6kl_debug_init_fs(struct ath6kl *ar);
 void ath6kl_debug_cleanup(struct ath6kl *ar);
 
 #else
-static inline int ath6kl_dbg(enum ATH6K_DEBUG_MASK dbg_mask,
-                             const char *fmt, ...)
+static inline void ath6kl_dbg(enum ATH6K_DEBUG_MASK dbg_mask,
+                              const char *fmt, ...)
 {
-        return 0;
 }
 
 static inline void ath6kl_dbg_dump(enum ATH6K_DEBUG_MASK mask,
diff --git a/drivers/net/wireless/ath/ath9k/Kconfig b/drivers/net/wireless/ath/ath9k/Kconfig
index 896e63281b3b..ca101d7cb99f 100644
--- a/drivers/net/wireless/ath/ath9k/Kconfig
+++ b/drivers/net/wireless/ath/ath9k/Kconfig
@@ -148,6 +148,11 @@ config ATH9K_CHANNEL_CONTEXT
          for multi-channel concurrency. Enable this if P2P PowerSave support
          is required.
 
+config ATH9K_PCOEM
+        bool "Atheros ath9k support for PC OEM cards" if EXPERT
+        depends on ATH9K
+        default y
+
 config ATH9K_HTC
        tristate "Atheros HTC based wireless cards support"
        depends on USB && MAC80211
diff --git a/drivers/net/wireless/ath/ath9k/Makefile b/drivers/net/wireless/ath/ath9k/Makefile
index 73704c1be736..22b934b07bd4 100644
--- a/drivers/net/wireless/ath/ath9k/Makefile
+++ b/drivers/net/wireless/ath/ath9k/Makefile
@@ -32,7 +32,6 @@ ath9k_hw-y:=	\
                 ar5008_phy.o \
                 ar9002_calib.o \
                 ar9003_calib.o \
-                ar9003_rtt.o \
                 calib.o \
                 eeprom.o \
                 eeprom_def.o \
@@ -50,6 +49,8 @@ ath9k_hw-$(CONFIG_ATH9K_WOW) += ar9003_wow.o
 ath9k_hw-$(CONFIG_ATH9K_BTCOEX_SUPPORT) += btcoex.o \
                                            ar9003_mci.o
 
+ath9k_hw-$(CONFIG_ATH9K_PCOEM) += ar9003_rtt.o
+
 ath9k_hw-$(CONFIG_ATH9K_DYNACK) += dynack.o
 
 obj-$(CONFIG_ATH9K_HW) += ath9k_hw.o
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index b72d0be716db..5829074208fa 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -1190,7 +1190,7 @@ static void ar5008_hw_set_nf_limits(struct ath_hw *ah)
 static void ar5008_hw_set_radar_params(struct ath_hw *ah,
                                        struct ath_hw_radar_conf *conf)
 {
-        u32 radar_0 = 0, radar_1 = 0;
+        u32 radar_0 = 0, radar_1;
 
         if (!conf) {
                 REG_CLR_BIT(ah, AR_PHY_RADAR_0, AR_PHY_RADAR_0_ENA);
@@ -1204,6 +1204,9 @@ static void ar5008_hw_set_radar_params(struct ath_hw *ah,
         radar_0 |= SM(conf->pulse_rssi, AR_PHY_RADAR_0_PRSSI);
         radar_0 |= SM(conf->pulse_inband, AR_PHY_RADAR_0_INBAND);
 
+        radar_1 = REG_READ(ah, AR_PHY_RADAR_1);
+        radar_1 &= ~(AR_PHY_RADAR_1_MAXLEN | AR_PHY_RADAR_1_RELSTEP_THRESH |
+                     AR_PHY_RADAR_1_RELPWR_THRESH);
         radar_1 |= AR_PHY_RADAR_1_MAX_RRSSI;
         radar_1 |= AR_PHY_RADAR_1_BLOCK_CHECK;
         radar_1 |= SM(conf->pulse_maxlen, AR_PHY_RADAR_1_MAXLEN);
@@ -1225,7 +1228,7 @@ static void ar5008_hw_set_radar_conf(struct ath_hw *ah)
         conf->fir_power = -33;
         conf->radar_rssi = 20;
         conf->pulse_height = 10;
-        conf->pulse_rssi = 24;
+        conf->pulse_rssi = 15;
         conf->pulse_inband = 15;
         conf->pulse_maxlen = 255;
         conf->pulse_inband_step = 12;
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_calib.c b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
index cdc74005650c..42190b67c671 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
@@ -657,31 +657,29 @@ static void ar9002_hw_olc_temp_compensation(struct ath_hw *ah)
                 ar9280_hw_olc_temp_compensation(ah);
 }
 
-static bool ar9002_hw_calibrate(struct ath_hw *ah,
-                                struct ath9k_channel *chan,
-                                u8 rxchainmask,
-                                bool longcal)
+static int ar9002_hw_calibrate(struct ath_hw *ah, struct ath9k_channel *chan,
+                               u8 rxchainmask, bool longcal)
 {
-        bool iscaldone = true;
         struct ath9k_cal_list *currCal = ah->cal_list_curr;
-        bool nfcal, nfcal_pending = false;
+        bool nfcal, nfcal_pending = false, percal_pending;
+        int ret;
 
         nfcal = !!(REG_READ(ah, AR_PHY_AGC_CONTROL) & AR_PHY_AGC_CONTROL_NF);
         if (ah->caldata)
                 nfcal_pending = test_bit(NFCAL_PENDING, &ah->caldata->cal_flags);
 
-        if (currCal && !nfcal &&
-            (currCal->calState == CAL_RUNNING ||
-             currCal->calState == CAL_WAITING)) {
-                iscaldone = ar9002_hw_per_calibration(ah, chan,
-                                                      rxchainmask, currCal);
-                if (iscaldone) {
-                        ah->cal_list_curr = currCal = currCal->calNext;
-
-                        if (currCal->calState == CAL_WAITING) {
-                                iscaldone = false;
-                                ath9k_hw_reset_calibration(ah, currCal);
-                        }
+        percal_pending = (currCal &&
+                          (currCal->calState == CAL_RUNNING ||
+                           currCal->calState == CAL_WAITING));
+
+        if (percal_pending && !nfcal) {
+                if (!ar9002_hw_per_calibration(ah, chan, rxchainmask, currCal))
+                        return 0;
+
+                ah->cal_list_curr = currCal = currCal->calNext;
+                if (currCal->calState == CAL_WAITING) {
+                        ath9k_hw_reset_calibration(ah, currCal);
+                        return 0;
                 }
         }
 
@@ -698,7 +696,9 @@ static bool ar9002_hw_calibrate(struct ath_hw *ah,
                          * NF is slow time-variant, so it is OK to use a
                          * historical value.
                          */
-                        ath9k_hw_loadnf(ah, ah->curchan);
+                        ret = ath9k_hw_loadnf(ah, ah->curchan);
+                        if (ret < 0)
+                                return ret;
                 }
 
                 if (longcal) {
@@ -709,7 +709,7 @@ static bool ar9002_hw_calibrate(struct ath_hw *ah,
                 }
         }
 
-        return iscaldone;
+        return !percal_pending;
 }
 
 /* Carrier leakage Calibration fix */
@@ -856,6 +856,8 @@ static bool ar9002_hw_init_cal(struct ath_hw *ah, struct ath9k_channel *chan)
 
         /* Do PA Calibration */
         ar9002_hw_pa_cal(ah, true);
+        ath9k_hw_loadnf(ah, chan);
+        ath9k_hw_start_nfcal(ah, true);
 
         if (ah->caldata)
                 set_bit(NFCAL_PENDING, &ah->caldata->cal_flags);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
index ac8301ef5242..06ab71db6e80 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
@@ -121,13 +121,12 @@ static bool ar9003_hw_per_calibration(struct ath_hw *ah,
         return iscaldone;
 }
 
-static bool ar9003_hw_calibrate(struct ath_hw *ah,
-                                struct ath9k_channel *chan,
-                                u8 rxchainmask,
-                                bool longcal)
+static int ar9003_hw_calibrate(struct ath_hw *ah, struct ath9k_channel *chan,
+                               u8 rxchainmask, bool longcal)
 {
         bool iscaldone = true;
         struct ath9k_cal_list *currCal = ah->cal_list_curr;
+        int ret;
 
         /*
          * For given calibration:
@@ -163,7 +162,9 @@ static bool ar9003_hw_calibrate(struct ath_hw *ah,
                  * NF is slow time-variant, so it is OK to use a historical
                  * value.
                  */
-                ath9k_hw_loadnf(ah, ah->curchan);
+                ret = ath9k_hw_loadnf(ah, ah->curchan);
+                if (ret < 0)
+                        return ret;
 
                 /* start NF calibration, without updating BB NF register */
                 ath9k_hw_start_nfcal(ah, false);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_hw.c b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
index ddef9eedbac6..cb09102245b2 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
@@ -670,9 +670,6 @@ static void ar9003_tx_gain_table_mode5(struct ath_hw *ah)
         if (AR_SREV_9485_11_OR_LATER(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9485Modes_green_ob_db_tx_gain_1_1);
-        else if (AR_SREV_9340(ah))
-                INIT_INI_ARRAY(&ah->iniModesTxGain,
-                        ar9340Modes_ub124_tx_gain_table_1p0);
         else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9580_1p0_type5_tx_gain_table);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index 697c4ae90af0..9bdaa0afc37f 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -1348,7 +1348,7 @@ static void ar9003_hw_set_radar_params(struct ath_hw *ah,
                                        struct ath_hw_radar_conf *conf)
 {
         unsigned int regWrites = 0;
-        u32 radar_0 = 0, radar_1 = 0;
+        u32 radar_0 = 0, radar_1;
 
         if (!conf) {
                 REG_CLR_BIT(ah, AR_PHY_RADAR_0, AR_PHY_RADAR_0_ENA);
@@ -1362,6 +1362,9 @@ static void ar9003_hw_set_radar_params(struct ath_hw *ah,
         radar_0 |= SM(conf->pulse_rssi, AR_PHY_RADAR_0_PRSSI);
         radar_0 |= SM(conf->pulse_inband, AR_PHY_RADAR_0_INBAND);
 
+        radar_1 = REG_READ(ah, AR_PHY_RADAR_1);
+        radar_1 &= ~(AR_PHY_RADAR_1_MAXLEN | AR_PHY_RADAR_1_RELSTEP_THRESH |
+                     AR_PHY_RADAR_1_RELPWR_THRESH);
         radar_1 |= AR_PHY_RADAR_1_MAX_RRSSI;
         radar_1 |= AR_PHY_RADAR_1_BLOCK_CHECK;
         radar_1 |= SM(conf->pulse_maxlen, AR_PHY_RADAR_1_MAXLEN);
@@ -1388,7 +1391,7 @@ static void ar9003_hw_set_radar_conf(struct ath_hw *ah)
         conf->fir_power = -28;
         conf->radar_rssi = 0;
         conf->pulse_height = 10;
-        conf->pulse_rssi = 24;
+        conf->pulse_rssi = 15;
         conf->pulse_inband = 8;
         conf->pulse_maxlen = 255;
         conf->pulse_inband_step = 12;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_rtt.h b/drivers/net/wireless/ath/ath9k/ar9003_rtt.h
index a43b30d723a4..6290467a75a0 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_rtt.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_rtt.h
@@ -17,6 +17,7 @@
 #ifndef AR9003_RTT_H
 #define AR9003_RTT_H
 
+#ifdef CONFIG_ATH9K_PCOEM
 void ar9003_hw_rtt_enable(struct ath_hw *ah);
 void ar9003_hw_rtt_disable(struct ath_hw *ah);
 void ar9003_hw_rtt_set_mask(struct ath_hw *ah, u32 rtt_mask);
@@ -25,5 +26,40 @@ void ar9003_hw_rtt_load_hist(struct ath_hw *ah);
 void ar9003_hw_rtt_fill_hist(struct ath_hw *ah);
 void ar9003_hw_rtt_clear_hist(struct ath_hw *ah);
 bool ar9003_hw_rtt_restore(struct ath_hw *ah, struct ath9k_channel *chan);
+#else
+static inline void ar9003_hw_rtt_enable(struct ath_hw *ah)
+{
+}
+
+static inline void ar9003_hw_rtt_disable(struct ath_hw *ah)
+{
+}
+
+static inline void ar9003_hw_rtt_set_mask(struct ath_hw *ah, u32 rtt_mask)
+{
+}
+
+static inline bool ar9003_hw_rtt_force_restore(struct ath_hw *ah)
+{
+        return false;
+}
+
+static inline void ar9003_hw_rtt_load_hist(struct ath_hw *ah)
+{
+}
+
+static inline void ar9003_hw_rtt_fill_hist(struct ath_hw *ah)
+{
+}
+
+static inline void ar9003_hw_rtt_clear_hist(struct ath_hw *ah)
+{
+}
+
+static inline bool ar9003_hw_rtt_restore(struct ath_hw *ah, struct ath9k_channel *chan)
+{
+        return false;
+}
+#endif
 
 #endif
diff --git a/drivers/net/wireless/ath/ath9k/ar955x_1p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar955x_1p0_initvals.h
index 74d8bc05b317..fd6a84ccd49e 100644
--- a/drivers/net/wireless/ath/ath9k/ar955x_1p0_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar955x_1p0_initvals.h
@@ -507,7 +507,7 @@ static const u32 ar955x_1p0_baseband_core[][2] = {
         {0x00009d04, 0x40206c10},
         {0x00009d08, 0x009c4060},
         {0x00009d0c, 0x9883800a},
-        {0x00009d10, 0x01834061},
+        {0x00009d10, 0x01884061},
         {0x00009d14, 0x00c0040b},
         {0x00009d18, 0x00000000},
         {0x00009e08, 0x0038230c},
@@ -545,9 +545,9 @@ static const u32 ar955x_1p0_baseband_core[][2] = {
         {0x0000a370, 0x00000000},
         {0x0000a390, 0x00000001},
         {0x0000a394, 0x00000444},
-        {0x0000a398, 0x1f020503},
-        {0x0000a39c, 0x29180c03},
-        {0x0000a3a0, 0x9a8b6844},
+        {0x0000a398, 0x001f0e0f},
+        {0x0000a39c, 0x0075393f},
+        {0x0000a3a0, 0xb79f6427},
         {0x0000a3a4, 0x00000000},
         {0x0000a3a8, 0xaaaaaaaa},
         {0x0000a3ac, 0x3c466478},
diff --git a/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
index a5ca65240af3..5d4629f96c15 100644
--- a/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
@@ -24,7 +24,149 @@
 
 #define ar9580_1p0_soc_postamble ar9300_2p2_soc_postamble
 
-#define ar9580_1p0_radio_core ar9300_2p2_radio_core
+static const u32 ar9580_1p0_radio_core[][2] = {
+        /* Addr      allmodes  */
+        {0x00016000, 0x36db2db6},
+        {0x00016004, 0x6db6db40},
+        {0x00016008, 0x73f00000},
+        {0x0001600c, 0x00000000},
+        {0x00016040, 0x7f80fff8},
+        {0x0001604c, 0x76d005b5},
+        {0x00016050, 0x556cf031},
+        {0x00016054, 0x13449440},
+        {0x00016058, 0x0c51c92c},
+        {0x0001605c, 0x3db7fffc},
+        {0x00016060, 0xfffffffc},
+        {0x00016064, 0x000f0278},
+        {0x0001606c, 0x6db60000},
+        {0x00016080, 0x00000000},
+        {0x00016084, 0x0e48048c},
+        {0x00016088, 0x54214514},
+        {0x0001608c, 0x119f481e},
+        {0x00016090, 0x24926490},
+        {0x00016098, 0xd2888888},
+        {0x000160a0, 0x0a108ffe},
+        {0x000160a4, 0x812fc370},
+        {0x000160a8, 0x423c8000},
+        {0x000160b4, 0x92480080},
+        {0x000160c0, 0x00adb6d0},
+        {0x000160c4, 0x6db6db60},
+        {0x000160c8, 0x6db6db6c},
+        {0x000160cc, 0x01e6c000},
+        {0x00016100, 0x3fffbe01},
+        {0x00016104, 0xfff80000},
+        {0x00016108, 0x00080010},
+        {0x00016144, 0x02084080},
+        {0x00016148, 0x00000000},
+        {0x00016280, 0x058a0001},
+        {0x00016284, 0x3d840208},
+        {0x00016288, 0x05a20408},
+        {0x0001628c, 0x00038c07},
+        {0x00016290, 0x00000004},
+        {0x00016294, 0x458a214f},
+        {0x00016380, 0x00000000},
+        {0x00016384, 0x00000000},
+        {0x00016388, 0x00800700},
+        {0x0001638c, 0x00800700},
+        {0x00016390, 0x00800700},
+        {0x00016394, 0x00000000},
+        {0x00016398, 0x00000000},
+        {0x0001639c, 0x00000000},
+        {0x000163a0, 0x00000001},
+        {0x000163a4, 0x00000001},
+        {0x000163a8, 0x00000000},
+        {0x000163ac, 0x00000000},
+        {0x000163b0, 0x00000000},
+        {0x000163b4, 0x00000000},
+        {0x000163b8, 0x00000000},
+        {0x000163bc, 0x00000000},
+        {0x000163c0, 0x000000a0},
+        {0x000163c4, 0x000c0000},
+        {0x000163c8, 0x14021402},
+        {0x000163cc, 0x00001402},
+        {0x000163d0, 0x00000000},
+        {0x000163d4, 0x00000000},
+        {0x00016400, 0x36db2db6},
+        {0x00016404, 0x6db6db40},
+        {0x00016408, 0x73f00000},
+        {0x0001640c, 0x00000000},
+        {0x00016440, 0x7f80fff8},
+        {0x0001644c, 0x76d005b5},
+        {0x00016450, 0x556cf031},
+        {0x00016454, 0x13449440},
+        {0x00016458, 0x0c51c92c},
+        {0x0001645c, 0x3db7fffc},
+        {0x00016460, 0xfffffffc},
+        {0x00016464, 0x000f0278},
+        {0x0001646c, 0x6db60000},
+        {0x00016500, 0x3fffbe01},
+        {0x00016504, 0xfff80000},
+        {0x00016508, 0x00080010},
+        {0x00016544, 0x02084080},
+        {0x00016548, 0x00000000},
+        {0x00016780, 0x00000000},
+        {0x00016784, 0x00000000},
+        {0x00016788, 0x00800700},
+        {0x0001678c, 0x00800700},
+        {0x00016790, 0x00800700},
+        {0x00016794, 0x00000000},
+        {0x00016798, 0x00000000},
+        {0x0001679c, 0x00000000},
+        {0x000167a0, 0x00000001},
+        {0x000167a4, 0x00000001},
+        {0x000167a8, 0x00000000},
+        {0x000167ac, 0x00000000},
+        {0x000167b0, 0x00000000},
+        {0x000167b4, 0x00000000},
+        {0x000167b8, 0x00000000},
+        {0x000167bc, 0x00000000},
+        {0x000167c0, 0x000000a0},
+        {0x000167c4, 0x000c0000},
+        {0x000167c8, 0x14021402},
+        {0x000167cc, 0x00001402},
+        {0x000167d0, 0x00000000},
+        {0x000167d4, 0x00000000},
+        {0x00016800, 0x36db2db6},
+        {0x00016804, 0x6db6db40},
+        {0x00016808, 0x73f00000},
+        {0x0001680c, 0x00000000},
+        {0x00016840, 0x7f80fff8},
+        {0x0001684c, 0x76d005b5},
+        {0x00016850, 0x556cf031},
+        {0x00016854, 0x13449440},
+        {0x00016858, 0x0c51c92c},
+        {0x0001685c, 0x3db7fffc},
+        {0x00016860, 0xfffffffc},
+        {0x00016864, 0x000f0278},
+        {0x0001686c, 0x6db60000},
+        {0x00016900, 0x3fffbe01},
+        {0x00016904, 0xfff80000},
+        {0x00016908, 0x00080010},
+        {0x00016944, 0x02084080},
+        {0x00016948, 0x00000000},
+        {0x00016b80, 0x00000000},
+        {0x00016b84, 0x00000000},
+        {0x00016b88, 0x00800700},
+        {0x00016b8c, 0x00800700},
+        {0x00016b90, 0x00800700},
+        {0x00016b94, 0x00000000},
+        {0x00016b98, 0x00000000},
+        {0x00016b9c, 0x00000000},
+        {0x00016ba0, 0x00000001},
+        {0x00016ba4, 0x00000001},
+        {0x00016ba8, 0x00000000},
+        {0x00016bac, 0x00000000},
+        {0x00016bb0, 0x00000000},
+        {0x00016bb4, 0x00000000},
+        {0x00016bb8, 0x00000000},
+        {0x00016bbc, 0x00000000},
+        {0x00016bc0, 0x000000a0},
+        {0x00016bc4, 0x000c0000},
+        {0x00016bc8, 0x14021402},
+        {0x00016bcc, 0x00001402},
+        {0x00016bd0, 0x00000000},
+        {0x00016bd4, 0x00000000},
+};
 
 #define ar9580_1p0_mac_postamble ar9300_2p2_mac_postamble
 
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 01a7db061c6a..85d74ff0767c 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -345,6 +345,7 @@ struct ath_chanctx {
         u64 tsf_val;
         u32 last_beacon;
 
+        int flush_timeout;
         u16 txpower;
         bool offchannel;
         bool stopped;
@@ -362,7 +363,7 @@ enum ath_chanctx_event {
         ATH_CHANCTX_EVENT_BEACON_SENT,
         ATH_CHANCTX_EVENT_TSF_TIMER,
         ATH_CHANCTX_EVENT_BEACON_RECEIVED,
-        ATH_CHANCTX_EVENT_ASSOC,
+        ATH_CHANCTX_EVENT_AUTHORIZED,
         ATH_CHANCTX_EVENT_SWITCH,
         ATH_CHANCTX_EVENT_ASSIGN,
         ATH_CHANCTX_EVENT_UNASSIGN,
@@ -384,6 +385,7 @@ struct ath_chanctx_sched {
         bool wait_switch;
         bool force_noa_update;
         bool extend_absence;
+        bool mgd_prepare_tx;
         enum ath_chanctx_state state;
         u8 beacon_miss;
 
@@ -468,6 +470,7 @@ void ath_chanctx_set_next(struct ath_softc *sc, bool force);
 void ath_offchannel_next(struct ath_softc *sc);
 void ath_scan_complete(struct ath_softc *sc, bool abort);
 void ath_roc_complete(struct ath_softc *sc, bool abort);
+struct ath_chanctx* ath_is_go_chanctx_present(struct ath_softc *sc);
 
 #else
 
@@ -540,7 +543,6 @@ static inline void ath_chanctx_check_active(struct ath_softc *sc,
 
 #endif /* CONFIG_ATH9K_CHANNEL_CONTEXT */
 
-int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan);
 void ath_startrecv(struct ath_softc *sc);
 bool ath_stoprecv(struct ath_softc *sc);
 u32 ath_calcrxfilter(struct ath_softc *sc);
@@ -595,7 +597,7 @@ struct ath_vif {
         u16 seq_no;
 
         /* BSS info */
-        u8 bssid[ETH_ALEN];
+        u8 bssid[ETH_ALEN] __aligned(2);
         u16 aid;
         bool assoc;
 
@@ -618,6 +620,7 @@ struct ath_vif {
         u32 noa_start;
         u32 noa_duration;
         bool periodic_noa;
+        bool oneshot_noa;
 };
 
 struct ath9k_vif_iter_data {
@@ -715,7 +718,8 @@ int ath_update_survey_stats(struct ath_softc *sc);
 void ath_update_survey_nf(struct ath_softc *sc, int channel);
 void ath9k_queue_reset(struct ath_softc *sc, enum ath_reset_type type);
 void ath_ps_full_sleep(unsigned long data);
-void __ath9k_flush(struct ieee80211_hw *hw, u32 queues, bool drop);
+void __ath9k_flush(struct ieee80211_hw *hw, u32 queues, bool drop,
+                   bool sw_pending, bool timeout_override);
 
 /**********/
 /* BTCOEX */
@@ -975,6 +979,7 @@ struct ath_softc {
         struct ath_chanctx_sched sched;
         struct ath_offchannel offchannel;
         struct ath_chanctx *next_chan;
+        struct completion go_beacon;
 #endif
 
         unsigned long driver_data;
@@ -1069,7 +1074,7 @@ void ath9k_tasklet(unsigned long data);
 int ath_cabq_update(struct ath_softc *);
 u8 ath9k_parse_mpdudensity(u8 mpdudensity);
 irqreturn_t ath_isr(int irq, void *dev);
-int ath_reset(struct ath_softc *sc);
+int ath_reset(struct ath_softc *sc, struct ath9k_channel *hchan);
 void ath_cancel_work(struct ath_softc *sc);
 void ath_restart_work(struct ath_softc *sc);
 int ath9k_init_device(u16 devid, struct ath_softc *sc,
diff --git a/drivers/net/wireless/ath/ath9k/calib.c b/drivers/net/wireless/ath/ath9k/calib.c
index 278365b8a895..e200a6e3aca5 100644
--- a/drivers/net/wireless/ath/ath9k/calib.c
+++ b/drivers/net/wireless/ath/ath9k/calib.c
@@ -234,7 +234,7 @@ void ath9k_hw_start_nfcal(struct ath_hw *ah, bool update)
         REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
 }
 
-void ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan)
+int ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan)
 {
         struct ath9k_nfcal_hist *h = NULL;
         unsigned i, j;
@@ -301,7 +301,7 @@ void ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan)
                 ath_dbg(common, ANY,
                         "Timeout while waiting for nf to load: AR_PHY_AGC_CONTROL=0x%x\n",
                         REG_READ(ah, AR_PHY_AGC_CONTROL));
-                return;
+                return -ETIMEDOUT;
         }
 
         /*
@@ -322,6 +322,8 @@ void ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan)
                 }
         }
         REGWRITE_BUFFER_FLUSH(ah);
+
+        return 0;
 }
 
 
diff --git a/drivers/net/wireless/ath/ath9k/calib.h b/drivers/net/wireless/ath/ath9k/calib.h
index b8ed95e9a335..87badf4bb8a4 100644
--- a/drivers/net/wireless/ath/ath9k/calib.h
+++ b/drivers/net/wireless/ath/ath9k/calib.h
@@ -109,7 +109,7 @@ struct ath9k_pacal_info{
 
 bool ath9k_hw_reset_calvalid(struct ath_hw *ah);
 void ath9k_hw_start_nfcal(struct ath_hw *ah, bool update);
-void ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan);
+int ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan);
 bool ath9k_hw_getnf(struct ath_hw *ah, struct ath9k_channel *chan);
 void ath9k_init_nfcal_hist_buffer(struct ath_hw *ah,
                                   struct ath9k_channel *chan);
diff --git a/drivers/net/wireless/ath/ath9k/channel.c b/drivers/net/wireless/ath/ath9k/channel.c
index 945c89826b14..c7234d5dda34 100644
--- a/drivers/net/wireless/ath/ath9k/channel.c
+++ b/drivers/net/wireless/ath/ath9k/channel.c
@@ -66,7 +66,7 @@ static int ath_set_channel(struct ath_softc *sc)
         }
 
         hchan = &sc->sc_ah->channels[pos];
-        r = ath_reset_internal(sc, hchan);
+        r = ath_reset(sc, hchan);
         if (r)
                 return r;
 
@@ -117,6 +117,7 @@ void ath_chanctx_init(struct ath_softc *sc)
                 cfg80211_chandef_create(&ctx->chandef, chan, NL80211_CHAN_HT20);
                 INIT_LIST_HEAD(&ctx->vifs);
                 ctx->txpower = ATH_TXPOWER_MAX;
+                ctx->flush_timeout = HZ / 5; /* 200ms */
                 for (j = 0; j < ARRAY_SIZE(ctx->acq); j++)
                         INIT_LIST_HEAD(&ctx->acq[j]);
         }
@@ -145,6 +146,36 @@ void ath_chanctx_set_channel(struct ath_softc *sc, struct ath_chanctx *ctx,
 
 #ifdef CONFIG_ATH9K_CHANNEL_CONTEXT
 
+/*************/
+/* Utilities */
+/*************/
+
+struct ath_chanctx* ath_is_go_chanctx_present(struct ath_softc *sc)
+{
+        struct ath_chanctx *ctx;
+        struct ath_vif *avp;
+        struct ieee80211_vif *vif;
+
+        spin_lock_bh(&sc->chan_lock);
+
+        ath_for_each_chanctx(sc, ctx) {
+                if (!ctx->active)
+                        continue;
+
+                list_for_each_entry(avp, &ctx->vifs, list) {
+                        vif = avp->vif;
+
+                        if (ieee80211_vif_type_p2p(vif) == NL80211_IFTYPE_P2P_GO) {
+                                spin_unlock_bh(&sc->chan_lock);
+                                return ctx;
+                        }
+                }
+        }
+
+        spin_unlock_bh(&sc->chan_lock);
+        return NULL;
+}
+
 /**********************************************************/
 /* Functions to handle the channel context state machine. */
 /**********************************************************/
@@ -171,7 +202,7 @@ static const char *chanctx_event_string(enum ath_chanctx_event ev)
                 case_rtn_string(ATH_CHANCTX_EVENT_BEACON_SENT);
                 case_rtn_string(ATH_CHANCTX_EVENT_TSF_TIMER);
                 case_rtn_string(ATH_CHANCTX_EVENT_BEACON_RECEIVED);
-                case_rtn_string(ATH_CHANCTX_EVENT_ASSOC);
+                case_rtn_string(ATH_CHANCTX_EVENT_AUTHORIZED);
                 case_rtn_string(ATH_CHANCTX_EVENT_SWITCH);
                 case_rtn_string(ATH_CHANCTX_EVENT_ASSIGN);
                 case_rtn_string(ATH_CHANCTX_EVENT_UNASSIGN);
@@ -198,6 +229,7 @@ static const char *chanctx_state_string(enum ath_chanctx_state state)
 void ath_chanctx_check_active(struct ath_softc *sc, struct ath_chanctx *ctx)
 {
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        struct ath_chanctx *ictx;
         struct ath_vif *avp;
         bool active = false;
         u8 n_active = 0;
@@ -205,6 +237,28 @@ void ath_chanctx_check_active(struct ath_softc *sc, struct ath_chanctx *ctx)
         if (!ctx)
                 return;
 
+        if (ctx == &sc->offchannel.chan) {
+                spin_lock_bh(&sc->chan_lock);
+
+                if (likely(sc->sched.channel_switch_time))
+                        ctx->flush_timeout =
+                                usecs_to_jiffies(sc->sched.channel_switch_time);
+                else
+                        ctx->flush_timeout =
+                                msecs_to_jiffies(10);
+
+                spin_unlock_bh(&sc->chan_lock);
+
+                /*
+                 * There is no need to iterate over the
+                 * active/assigned channel contexts if
+                 * the current context is offchannel.
+                 */
+                return;
+        }
+
+        ictx = ctx;
+
         list_for_each_entry(avp, &ctx->vifs, list) {
                 struct ieee80211_vif *vif = avp->vif;
 
@@ -227,12 +281,23 @@ void ath_chanctx_check_active(struct ath_softc *sc, struct ath_chanctx *ctx)
                 n_active++;
         }
 
+        spin_lock_bh(&sc->chan_lock);
+
         if (n_active <= 1) {
+                ictx->flush_timeout = HZ / 5;
                 clear_bit(ATH_OP_MULTI_CHANNEL, &common->op_flags);
+                spin_unlock_bh(&sc->chan_lock);
                 return;
         }
-        if (test_and_set_bit(ATH_OP_MULTI_CHANNEL, &common->op_flags))
+
+        ictx->flush_timeout = usecs_to_jiffies(sc->sched.channel_switch_time);
+
+        if (test_and_set_bit(ATH_OP_MULTI_CHANNEL, &common->op_flags)) {
+                spin_unlock_bh(&sc->chan_lock);
                 return;
+        }
+
+        spin_unlock_bh(&sc->chan_lock);
 
         if (ath9k_is_chanctx_enabled()) {
                 ath_chanctx_event(sc, NULL,
@@ -301,6 +366,111 @@ static void ath_chanctx_setup_timer(struct ath_softc *sc, u32 tsf_time)
                 "Setup chanctx timer with timeout: %d ms\n", jiffies_to_msecs(tsf_time));
 }
 
+static void ath_chanctx_handle_bmiss(struct ath_softc *sc,
+                                     struct ath_chanctx *ctx,
+                                     struct ath_vif *avp)
+{
+        /*
+         * Clear the extend_absence flag if it had been
+         * set during the previous beacon transmission,
+         * since we need to revert to the normal NoA
+         * schedule.
+         */
+        if (ctx->active && sc->sched.extend_absence) {
+                avp->noa_duration = 0;
+                sc->sched.extend_absence = false;
+        }
+
+        /* If at least two consecutive beacons were missed on the STA
+         * chanctx, stay on the STA channel for one extra beacon period,
+         * to resync the timer properly.
+         */
+        if (ctx->active && sc->sched.beacon_miss >= 2) {
+                avp->noa_duration = 0;
+                sc->sched.extend_absence = true;
+        }
+}
+
+static void ath_chanctx_offchannel_noa(struct ath_softc *sc,
+                                       struct ath_chanctx *ctx,
+                                       struct ath_vif *avp,
+                                       u32 tsf_time)
+{
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+
+        avp->noa_index++;
+        avp->offchannel_start = tsf_time;
+        avp->offchannel_duration = sc->sched.offchannel_duration;
+
+        ath_dbg(common, CHAN_CTX,
+                "offchannel noa_duration: %d, noa_start: %d, noa_index: %d\n",
+                avp->offchannel_duration,
+                avp->offchannel_start,
+                avp->noa_index);
+
+        /*
+         * When multiple contexts are active, the NoA
+         * has to be recalculated and advertised after
+         * an offchannel operation.
+         */
+        if (ctx->active && avp->noa_duration)
+                avp->noa_duration = 0;
+}
+
+static void ath_chanctx_set_periodic_noa(struct ath_softc *sc,
+                                         struct ath_vif *avp,
+                                         struct ath_beacon_config *cur_conf,
+                                         u32 tsf_time,
+                                         u32 beacon_int)
+{
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+
+        avp->noa_index++;
+        avp->noa_start = tsf_time;
+
+        if (sc->sched.extend_absence)
+                avp->noa_duration = (3 * beacon_int / 2) +
+                        sc->sched.channel_switch_time;
+        else
+                avp->noa_duration =
+                        TU_TO_USEC(cur_conf->beacon_interval) / 2 +
+                        sc->sched.channel_switch_time;
+
+        if (test_bit(ATH_OP_SCANNING, &common->op_flags) ||
+            sc->sched.extend_absence)
+                avp->periodic_noa = false;
+        else
+                avp->periodic_noa = true;
+
+        ath_dbg(common, CHAN_CTX,
+                "noa_duration: %d, noa_start: %d, noa_index: %d, periodic: %d\n",
+                avp->noa_duration,
+                avp->noa_start,
+                avp->noa_index,
+                avp->periodic_noa);
+}
+
+static void ath_chanctx_set_oneshot_noa(struct ath_softc *sc,
+                                        struct ath_vif *avp,
+                                        u32 tsf_time,
+                                        u32 duration)
+{
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+
+        avp->noa_index++;
+        avp->noa_start = tsf_time;
+        avp->periodic_noa = false;
+        avp->oneshot_noa = true;
+        avp->noa_duration = duration + sc->sched.channel_switch_time;
+
+        ath_dbg(common, CHAN_CTX,
+                "oneshot noa_duration: %d, noa_start: %d, noa_index: %d, periodic: %d\n",
+                avp->noa_duration,
+                avp->noa_start,
+                avp->noa_index,
+                avp->periodic_noa);
+}
+
 void ath_chanctx_event(struct ath_softc *sc, struct ieee80211_vif *vif,
                        enum ath_chanctx_event ev)
 {
@@ -327,6 +497,14 @@ void ath_chanctx_event(struct ath_softc *sc, struct ieee80211_vif *vif,
                 if (avp->offchannel_duration)
                         avp->offchannel_duration = 0;
 
+                if (avp->oneshot_noa) {
+                        avp->noa_duration = 0;
+                        avp->oneshot_noa = false;
+
+                        ath_dbg(common, CHAN_CTX,
+                                "Clearing oneshot NoA\n");
+                }
+
                 if (avp->chanctx != sc->cur_chan) {
                         ath_dbg(common, CHAN_CTX,
                                 "Contexts differ, not preparing beacon\n");
@@ -356,6 +534,24 @@ void ath_chanctx_event(struct ath_softc *sc, struct ieee80211_vif *vif,
                                 "Move chanctx state from WAIT_FOR_TIMER to WAIT_FOR_BEACON\n");
                 }
 
+                if (sc->sched.mgd_prepare_tx)
+                        sc->sched.state = ATH_CHANCTX_STATE_WAIT_FOR_BEACON;
+
+                /*
+                 * When a context becomes inactive, for example,
+                 * disassociation of a station context, the NoA
+                 * attribute needs to be removed from subsequent
+                 * beacons.
+                 */
+                if (!ctx->active && avp->noa_duration &&
+                    sc->sched.state != ATH_CHANCTX_STATE_WAIT_FOR_BEACON) {
+                        avp->noa_duration = 0;
+                        avp->periodic_noa = false;
+
+                        ath_dbg(common, CHAN_CTX,
+                                "Clearing NoA schedule\n");
+                }
+
                 if (sc->sched.state != ATH_CHANCTX_STATE_WAIT_FOR_BEACON)
                         break;
 
@@ -378,45 +574,22 @@ void ath_chanctx_event(struct ath_softc *sc, struct ieee80211_vif *vif,
                  * values and increment the index.
                  */
                 if (sc->next_chan == &sc->offchannel.chan) {
-                        avp->noa_index++;
-                        avp->offchannel_start = tsf_time;
-                        avp->offchannel_duration = sc->sched.offchannel_duration;
-
-                        ath_dbg(common, CHAN_CTX,
-                                "offchannel noa_duration: %d, noa_start: %d, noa_index: %d\n",
-                                avp->offchannel_duration,
-                                avp->offchannel_start,
-                                avp->noa_index);
-
-                        /*
-                         * When multiple contexts are active, the NoA
-                         * has to be recalculated and advertised after
-                         * an offchannel operation.
-                         */
-                        if (ctx->active && avp->noa_duration)
-                                avp->noa_duration = 0;
-
+                        ath_chanctx_offchannel_noa(sc, ctx, avp, tsf_time);
                         break;
                 }
 
-                /*
-                 * Clear the extend_absence flag if it had been
-                 * set during the previous beacon transmission,
-                 * since we need to revert to the normal NoA
-                 * schedule.
-                 */
-                if (ctx->active && sc->sched.extend_absence) {
-                        avp->noa_duration = 0;
-                        sc->sched.extend_absence = false;
-                }
+                ath_chanctx_handle_bmiss(sc, ctx, avp);
 
-                /* If at least two consecutive beacons were missed on the STA
-                 * chanctx, stay on the STA channel for one extra beacon period,
-                 * to resync the timer properly.
+                /*
+                 * If a mgd_prepare_tx() has been called by mac80211,
+                 * a one-shot NoA needs to be sent. This can happen
+                 * with one or more active channel contexts - in both
+                 * cases, a new NoA schedule has to be advertised.
                  */
-                if (ctx->active && sc->sched.beacon_miss >= 2) {
-                        avp->noa_duration = 0;
-                        sc->sched.extend_absence = true;
+                if (sc->sched.mgd_prepare_tx) {
+                        ath_chanctx_set_oneshot_noa(sc, avp, tsf_time,
+                                                    jiffies_to_usecs(HZ / 5));
+                        break;
                 }
 
                 /* Prevent wrap-around issues */
@@ -429,31 +602,9 @@ void ath_chanctx_event(struct ath_softc *sc, struct ieee80211_vif *vif,
                  * announcement.
                  */
                 if (ctx->active &&
-                    (!avp->noa_duration || sc->sched.force_noa_update)) {
-                        avp->noa_index++;
-                        avp->noa_start = tsf_time;
-
-                        if (sc->sched.extend_absence)
-                                avp->noa_duration = (3 * beacon_int / 2) +
-                                        sc->sched.channel_switch_time;
-                        else
-                                avp->noa_duration =
-                                        TU_TO_USEC(cur_conf->beacon_interval) / 2 +
-                                        sc->sched.channel_switch_time;
-
-                        if (test_bit(ATH_OP_SCANNING, &common->op_flags) ||
-                            sc->sched.extend_absence)
-                                avp->periodic_noa = false;
-                        else
-                                avp->periodic_noa = true;
-
-                        ath_dbg(common, CHAN_CTX,
-                                "noa_duration: %d, noa_start: %d, noa_index: %d, periodic: %d\n",
-                                avp->noa_duration,
-                                avp->noa_start,
-                                avp->noa_index,
-                                avp->periodic_noa);
-                }
+                    (!avp->noa_duration || sc->sched.force_noa_update))
+                        ath_chanctx_set_periodic_noa(sc, avp, cur_conf,
+                                                     tsf_time, beacon_int);
 
                 if (ctx->active && sc->sched.force_noa_update)
                         sc->sched.force_noa_update = false;
@@ -467,6 +618,15 @@ void ath_chanctx_event(struct ath_softc *sc, struct ieee80211_vif *vif,
                 }
 
                 sc->sched.beacon_pending = false;
+
+                if (sc->sched.mgd_prepare_tx) {
+                        sc->sched.mgd_prepare_tx = false;
+                        complete(&sc->go_beacon);
+                        ath_dbg(common, CHAN_CTX,
+                                "Beacon sent, complete go_beacon\n");
+                        break;
+                }
+
                 if (sc->sched.state != ATH_CHANCTX_STATE_WAIT_FOR_BEACON)
                         break;
 
@@ -495,10 +655,15 @@ void ath_chanctx_event(struct ath_softc *sc, struct ieee80211_vif *vif,
                     sc->cur_chan == &sc->offchannel.chan)
                         break;
 
-                ath_chanctx_adjust_tbtt_delta(sc);
                 sc->sched.beacon_pending = false;
                 sc->sched.beacon_miss = 0;
 
+                if (sc->sched.state == ATH_CHANCTX_STATE_FORCE_ACTIVE ||
+                    !sc->cur_chan->tsf_val)
+                        break;
+
+                ath_chanctx_adjust_tbtt_delta(sc);
+
                 /* TSF time might have been updated by the incoming beacon,
                  * need update the channel switch timer to reflect the change.
                  */
@@ -510,7 +675,7 @@ void ath_chanctx_event(struct ath_softc *sc, struct ieee80211_vif *vif,
 
                 ath_chanctx_setup_timer(sc, tsf_time);
                 break;
-        case ATH_CHANCTX_EVENT_ASSOC:
+        case ATH_CHANCTX_EVENT_AUTHORIZED:
                 if (sc->sched.state != ATH_CHANCTX_STATE_FORCE_ACTIVE ||
                     avp->chanctx != sc->cur_chan)
                         break;
@@ -578,22 +743,6 @@ void ath_chanctx_event(struct ath_softc *sc, struct ieee80211_vif *vif,
                 ieee80211_queue_work(sc->hw, &sc->chanctx_work);
                 break;
         case ATH_CHANCTX_EVENT_ASSIGN:
-                /*
-                 * When adding a new channel context, check if a scan
-                 * is in progress and abort it since the addition of
-                 * a new channel context is usually followed by VIF
-                 * assignment, in which case we have to start multi-channel
-                 * operation.
-                 */
-                if (test_bit(ATH_OP_SCANNING, &common->op_flags)) {
-                        ath_dbg(common, CHAN_CTX,
-                                "Aborting HW scan to add new context\n");
-
-                        spin_unlock_bh(&sc->chan_lock);
-                        del_timer_sync(&sc->offchannel.timer);
-                        ath_scan_complete(sc, true);
-                        spin_lock_bh(&sc->chan_lock);
-                }
                 break;
         case ATH_CHANCTX_EVENT_CHANGE:
                 break;
@@ -770,7 +919,7 @@ void ath_roc_complete(struct ath_softc *sc, bool abort)
 
         sc->offchannel.roc_vif = NULL;
         sc->offchannel.roc_chan = NULL;
-        if (!abort)
+        if (abort)
                 ieee80211_remain_on_channel_expired(sc->hw);
         ath_offchannel_next(sc);
         ath9k_ps_restore(sc);
@@ -904,6 +1053,7 @@ static void ath_offchannel_timer(unsigned long data)
         case ATH_OFFCHANNEL_ROC_WAIT:
                 ctx = ath_chanctx_get_oper_chan(sc, false);
                 sc->offchannel.state = ATH_OFFCHANNEL_ROC_DONE;
+                ieee80211_remain_on_channel_expired(sc->hw);
                 ath_chanctx_switch(sc, ctx, NULL);
                 break;
         default:
@@ -1082,10 +1232,11 @@ void ath_chanctx_set_next(struct ath_softc *sc, bool force)
                 ath9k_chanctx_stop_queues(sc, sc->cur_chan);
                 queues_stopped = true;
 
-                __ath9k_flush(sc->hw, ~0, true);
+                __ath9k_flush(sc->hw, ~0, true, false, false);
 
                 if (ath_chanctx_send_ps_frame(sc, true))
-                        __ath9k_flush(sc->hw, BIT(IEEE80211_AC_VO), false);
+                        __ath9k_flush(sc->hw, BIT(IEEE80211_AC_VO),
+                                      false, false, false);
 
                 send_ps = true;
                 spin_lock_bh(&sc->chan_lock);
@@ -1177,6 +1328,8 @@ void ath9k_init_channel_context(struct ath_softc *sc)
                     (unsigned long)sc);
         setup_timer(&sc->sched.timer, ath_chanctx_timer,
                     (unsigned long)sc);
+
+        init_completion(&sc->go_beacon);
 }
 
 void ath9k_deinit_channel_context(struct ath_softc *sc)
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 5c45e787814e..c9afc15cd4d3 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -852,36 +852,31 @@ static ssize_t read_file_reset(struct file *file, char __user *user_buf,
                                size_t count, loff_t *ppos)
 {
         struct ath_softc *sc = file->private_data;
+        static const char * const reset_cause[__RESET_TYPE_MAX] = {
+                [RESET_TYPE_BB_HANG] = "Baseband Hang",
+                [RESET_TYPE_BB_WATCHDOG] = "Baseband Watchdog",
+                [RESET_TYPE_FATAL_INT] = "Fatal HW Error",
+                [RESET_TYPE_TX_ERROR] = "TX HW error",
+                [RESET_TYPE_TX_GTT] = "Transmit timeout",
+                [RESET_TYPE_TX_HANG] = "TX Path Hang",
+                [RESET_TYPE_PLL_HANG] = "PLL RX Hang",
+                [RESET_TYPE_MAC_HANG] = "MAC Hang",
+                [RESET_TYPE_BEACON_STUCK] = "Stuck Beacon",
+                [RESET_TYPE_MCI] = "MCI Reset",
+                [RESET_TYPE_CALIBRATION] = "Calibration error",
+        };
         char buf[512];
         unsigned int len = 0;
+        int i;
 
-        len += scnprintf(buf + len, sizeof(buf) - len,
-                         "%17s: %2d\n", "Baseband Hang",
-                         sc->debug.stats.reset[RESET_TYPE_BB_HANG]);
-        len += scnprintf(buf + len, sizeof(buf) - len,
-                         "%17s: %2d\n", "Baseband Watchdog",
-                         sc->debug.stats.reset[RESET_TYPE_BB_WATCHDOG]);
-        len += scnprintf(buf + len, sizeof(buf) - len,
-                         "%17s: %2d\n", "Fatal HW Error",
-                         sc->debug.stats.reset[RESET_TYPE_FATAL_INT]);
-        len += scnprintf(buf + len, sizeof(buf) - len,
-                         "%17s: %2d\n", "TX HW error",
-                         sc->debug.stats.reset[RESET_TYPE_TX_ERROR]);
-        len += scnprintf(buf + len, sizeof(buf) - len,
-                         "%17s: %2d\n", "TX Path Hang",
-                         sc->debug.stats.reset[RESET_TYPE_TX_HANG]);
-        len += scnprintf(buf + len, sizeof(buf) - len,
-                         "%17s: %2d\n", "PLL RX Hang",
-                         sc->debug.stats.reset[RESET_TYPE_PLL_HANG]);
-        len += scnprintf(buf + len, sizeof(buf) - len,
-                         "%17s: %2d\n", "MAC Hang",
-                         sc->debug.stats.reset[RESET_TYPE_MAC_HANG]);
-        len += scnprintf(buf + len, sizeof(buf) - len,
-                         "%17s: %2d\n", "Stuck Beacon",
-                         sc->debug.stats.reset[RESET_TYPE_BEACON_STUCK]);
-        len += scnprintf(buf + len, sizeof(buf) - len,
-                         "%17s: %2d\n", "MCI Reset",
-                         sc->debug.stats.reset[RESET_TYPE_MCI]);
+        for (i = 0; i < ARRAY_SIZE(reset_cause); i++) {
+                if (!reset_cause[i])
+                    continue;
+
+                len += scnprintf(buf + len, sizeof(buf) - len,
+                                 "%17s: %2d\n", reset_cause[i],
+                                 sc->debug.stats.reset[i]);
+        }
 
         if (len > sizeof(buf))
                 len = sizeof(buf);
diff --git a/drivers/net/wireless/ath/ath9k/debug.h b/drivers/net/wireless/ath/ath9k/debug.h
index 53ae15bd0c9d..bd75b1f716db 100644
--- a/drivers/net/wireless/ath/ath9k/debug.h
+++ b/drivers/net/wireless/ath/ath9k/debug.h
@@ -49,6 +49,7 @@ enum ath_reset_type {
         RESET_TYPE_MAC_HANG,
         RESET_TYPE_BEACON_STUCK,
         RESET_TYPE_MCI,
+        RESET_TYPE_CALIBRATION,
         __RESET_TYPE_MAX
 };
 
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_def.c b/drivers/net/wireless/ath/ath9k/eeprom_def.c
index 3218ca994746..122b846b8ec0 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_def.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c
@@ -262,7 +262,7 @@ static int ath9k_hw_def_check_eeprom(struct ath_hw *ah)
 {
         struct ar5416_eeprom_def *eep = &ah->eeprom.def;
         struct ath_common *common = ath9k_hw_common(ah);
-        u16 *eepdata, temp, magic, magic2;
+        u16 *eepdata, temp, magic;
         u32 sum = 0, el;
         bool need_swap = false;
         int i, addr, size;
@@ -272,27 +272,16 @@ static int ath9k_hw_def_check_eeprom(struct ath_hw *ah)
                 return false;
         }
 
-        if (!ath9k_hw_use_flash(ah)) {
-                ath_dbg(common, EEPROM, "Read Magic = 0x%04X\n", magic);
-
-                if (magic != AR5416_EEPROM_MAGIC) {
-                        magic2 = swab16(magic);
-
-                        if (magic2 == AR5416_EEPROM_MAGIC) {
-                                size = sizeof(struct ar5416_eeprom_def);
-                                need_swap = true;
-                                eepdata = (u16 *) (&ah->eeprom);
+        if (swab16(magic) == AR5416_EEPROM_MAGIC &&
+            !(ah->ah_flags & AH_NO_EEP_SWAP)) {
+                size = sizeof(struct ar5416_eeprom_def);
+                need_swap = true;
+                eepdata = (u16 *) (&ah->eeprom);
 
-                                for (addr = 0; addr < size / sizeof(u16); addr++) {
-                                        temp = swab16(*eepdata);
-                                        *eepdata = temp;
-                                        eepdata++;
-                                }
-                        } else {
-                                ath_err(common,
-                                        "Invalid EEPROM Magic. Endianness mismatch.\n");
-                                return -EINVAL;
-                        }
+                for (addr = 0; addr < size / sizeof(u16); addr++) {
+                        temp = swab16(*eepdata);
+                        *eepdata = temp;
+                        eepdata++;
                 }
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/hw-ops.h b/drivers/net/wireless/ath/ath9k/hw-ops.h
index 8e85efeaeffc..88769b64b20b 100644
--- a/drivers/net/wireless/ath/ath9k/hw-ops.h
+++ b/drivers/net/wireless/ath/ath9k/hw-ops.h
@@ -41,10 +41,9 @@ static inline void ath9k_hw_set_desc_link(struct ath_hw *ah, void *ds,
         ath9k_hw_ops(ah)->set_desc_link(ds, link);
 }
 
-static inline bool ath9k_hw_calibrate(struct ath_hw *ah,
-                                      struct ath9k_channel *chan,
-                                      u8 rxchainmask,
-                                      bool longcal)
+static inline int ath9k_hw_calibrate(struct ath_hw *ah,
+                                     struct ath9k_channel *chan,
+                                     u8 rxchainmask, bool longcal)
 {
         return ath9k_hw_ops(ah)->calibrate(ah, chan, rxchainmask, longcal);
 }
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 8be4b1453394..ee9fb52cec62 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -19,6 +19,7 @@
 #include <linux/module.h>
 #include <linux/time.h>
 #include <linux/bitops.h>
+#include <linux/etherdevice.h>
 #include <asm/unaligned.h>
 
 #include "hw.h"
@@ -446,8 +447,16 @@ static int ath9k_hw_init_macaddr(struct ath_hw *ah)
                 common->macaddr[2 * i] = eeval >> 8;
                 common->macaddr[2 * i + 1] = eeval & 0xff;
         }
-        if (sum == 0 || sum == 0xffff * 3)
-                return -EADDRNOTAVAIL;
+        if (!is_valid_ether_addr(common->macaddr)) {
+                ath_err(common,
+                        "eeprom contains invalid mac address: %pM\n",
+                        common->macaddr);
+
+                random_ether_addr(common->macaddr);
+                ath_err(common,
+                        "random mac address will be used: %pM\n",
+                        common->macaddr);
+        }
 
         return 0;
 }
@@ -1953,8 +1962,10 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         if (ath9k_hw_mci_is_enabled(ah))
                 ar9003_mci_check_bt(ah);
 
-        ath9k_hw_loadnf(ah, chan);
-        ath9k_hw_start_nfcal(ah, true);
+        if (AR_SREV_9300_20_OR_LATER(ah)) {
+                ath9k_hw_loadnf(ah, chan);
+                ath9k_hw_start_nfcal(ah, true);
+        }
 
         if (AR_SREV_9300_20_OR_LATER(ah))
                 ar9003_hw_bb_watchdog_config(ah);
@@ -2342,17 +2353,25 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
         }
 
         eeval = ah->eep_ops->get_eeprom(ah, EEP_OP_MODE);
-        if ((eeval & (AR5416_OPFLAGS_11G | AR5416_OPFLAGS_11A)) == 0) {
-                ath_err(common,
-                        "no band has been marked as supported in EEPROM\n");
-                return -EINVAL;
+
+        if (eeval & AR5416_OPFLAGS_11A) {
+                if (ah->disable_5ghz)
+                        ath_warn(common, "disabling 5GHz band\n");
+                else
+                        pCap->hw_caps |= ATH9K_HW_CAP_5GHZ;
         }
 
-        if (eeval & AR5416_OPFLAGS_11A)
-                pCap->hw_caps |= ATH9K_HW_CAP_5GHZ;
+        if (eeval & AR5416_OPFLAGS_11G) {
+                if (ah->disable_2ghz)
+                        ath_warn(common, "disabling 2GHz band\n");
+                else
+                        pCap->hw_caps |= ATH9K_HW_CAP_2GHZ;
+        }
 
-        if (eeval & AR5416_OPFLAGS_11G)
-                pCap->hw_caps |= ATH9K_HW_CAP_2GHZ;
+        if ((pCap->hw_caps & (ATH9K_HW_CAP_2GHZ | ATH9K_HW_CAP_5GHZ)) == 0) {
+                ath_err(common, "both bands are disabled\n");
+                return -EINVAL;
+        }
 
         if (AR_SREV_9485(ah) ||
             AR_SREV_9285(ah) ||
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 975074fc11bc..e49721e85f6a 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -244,13 +244,20 @@ enum ath9k_hw_caps {
         ATH9K_HW_CAP_2GHZ                       = BIT(11),
         ATH9K_HW_CAP_5GHZ                       = BIT(12),
         ATH9K_HW_CAP_APM                        = BIT(13),
+#ifdef CONFIG_ATH9K_PCOEM
         ATH9K_HW_CAP_RTT                        = BIT(14),
         ATH9K_HW_CAP_MCI                        = BIT(15),
-        ATH9K_HW_CAP_DFS                        = BIT(16),
-        ATH9K_HW_WOW_DEVICE_CAPABLE             = BIT(17),
-        ATH9K_HW_CAP_PAPRD                      = BIT(18),
-        ATH9K_HW_CAP_FCC_BAND_SWITCH            = BIT(19),
-        ATH9K_HW_CAP_BT_ANT_DIV                 = BIT(20),
+        ATH9K_HW_WOW_DEVICE_CAPABLE             = BIT(16),
+        ATH9K_HW_CAP_BT_ANT_DIV                 = BIT(17),
+#else
+        ATH9K_HW_CAP_RTT                        = 0,
+        ATH9K_HW_CAP_MCI                        = 0,
+        ATH9K_HW_WOW_DEVICE_CAPABLE             = 0,
+        ATH9K_HW_CAP_BT_ANT_DIV                 = 0,
+#endif
+        ATH9K_HW_CAP_DFS                        = BIT(18),
+        ATH9K_HW_CAP_PAPRD                      = BIT(19),
+        ATH9K_HW_CAP_FCC_BAND_SWITCH            = BIT(20),
 };
 
 /*
@@ -681,10 +688,8 @@ struct ath_hw_ops {
                                      bool power_off);
         void (*rx_enable)(struct ath_hw *ah);
         void (*set_desc_link)(void *ds, u32 link);
-        bool (*calibrate)(struct ath_hw *ah,
-                          struct ath9k_channel *chan,
-                          u8 rxchainmask,
-                          bool longcal);
+        int (*calibrate)(struct ath_hw *ah, struct ath9k_channel *chan,
+                         u8 rxchainmask, bool longcal);
         bool (*get_isr)(struct ath_hw *ah, enum ath9k_int *masked,
                         u32 *sync_cause_p);
         void (*set_txdesc)(struct ath_hw *ah, void *ds,
@@ -726,6 +731,7 @@ enum ath_cal_list {
 #define AH_USE_EEPROM   0x1
 #define AH_UNPLUGGED    0x2 /* The card has been physically removed. */
 #define AH_FASTCC       0x4
+#define AH_NO_EEP_SWAP  0x8 /* Do not swap EEPROM data */
 
 struct ath_hw {
         struct ath_ops reg_ops;
@@ -924,6 +930,8 @@ struct ath_hw {
         bool is_clk_25mhz;
         int (*get_mac_revision)(void);
         int (*external_reset)(void);
+        bool disable_2ghz;
+        bool disable_5ghz;
 
         const struct firmware *eeprom_blob;
 
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 3bd030494986..a4d69a059753 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -362,6 +362,9 @@ static void ath9k_init_pcoem_platform(struct ath_softc *sc)
         struct ath9k_hw_capabilities *pCap = &ah->caps;
         struct ath_common *common = ath9k_hw_common(ah);
 
+        if (!IS_ENABLED(CONFIG_ATH9K_PCOEM))
+                return;
+
         if (common->bus_ops->ath_bus_type != ATH_PCI)
                 return;
 
@@ -528,6 +531,10 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc,
                 ah->is_clk_25mhz = pdata->is_clk_25mhz;
                 ah->get_mac_revision = pdata->get_mac_revision;
                 ah->external_reset = pdata->external_reset;
+                ah->disable_2ghz = pdata->disable_2ghz;
+                ah->disable_5ghz = pdata->disable_5ghz;
+                if (!pdata->endian_check)
+                        ah->ah_flags |= AH_NO_EEP_SWAP;
         }
 
         common->ops = &ah->reg_ops;
diff --git a/drivers/net/wireless/ath/ath9k/link.c b/drivers/net/wireless/ath/ath9k/link.c
index 2343f56e6498..b829263e3d0a 100644
--- a/drivers/net/wireless/ath/ath9k/link.c
+++ b/drivers/net/wireless/ath/ath9k/link.c
@@ -371,9 +371,15 @@ void ath_ani_calibrate(unsigned long data)
 
         /* Perform calibration if necessary */
         if (longcal || shortcal) {
-                common->ani.caldone =
-                        ath9k_hw_calibrate(ah, ah->curchan,
-                                           ah->rxchainmask, longcal);
+                int ret = ath9k_hw_calibrate(ah, ah->curchan, ah->rxchainmask,
+                                             longcal);
+                if (ret < 0) {
+                        common->ani.caldone = 0;
+                        ath9k_queue_reset(sc, RESET_TYPE_CALIBRATION);
+                        return;
+                }
+
+                common->ani.caldone = ret;
         }
 
         ath_dbg(common, ANI,
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 30c66dfcd7a0..a91ee92d9d3f 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -54,7 +54,8 @@ u8 ath9k_parse_mpdudensity(u8 mpdudensity)
         }
 }
 
-static bool ath9k_has_pending_frames(struct ath_softc *sc, struct ath_txq *txq)
+static bool ath9k_has_pending_frames(struct ath_softc *sc, struct ath_txq *txq,
+                                     bool sw_pending)
 {
         bool pending = false;
 
@@ -65,6 +66,9 @@ static bool ath9k_has_pending_frames(struct ath_softc *sc, struct ath_txq *txq)
                 goto out;
         }
 
+        if (!sw_pending)
+                goto out;
+
         if (txq->mac80211_qnum >= 0) {
                 struct list_head *list;
 
@@ -270,7 +274,7 @@ static bool ath_complete_reset(struct ath_softc *sc, bool start)
         return true;
 }
 
-int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan)
+static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan)
 {
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
@@ -281,6 +285,7 @@ int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan)
         __ath_cancel_work(sc);
 
         tasklet_disable(&sc->intr_tq);
+        tasklet_disable(&sc->bcon_tasklet);
         spin_lock_bh(&sc->sc_pcu_lock);
 
         if (!sc->cur_chan->offchannel) {
@@ -326,6 +331,7 @@ int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan)
 
 out:
         spin_unlock_bh(&sc->sc_pcu_lock);
+        tasklet_enable(&sc->bcon_tasklet);
         tasklet_enable(&sc->intr_tq);
 
         return r;
@@ -539,11 +545,10 @@ irqreturn_t ath_isr(int irq, void *dev)
                 sched = true;
 
         /*
-         * If a FATAL or RXORN interrupt is received, we have to reset the
-         * chip immediately.
+         * If a FATAL interrupt is received, we have to reset the chip
+         * immediately.
          */
-        if ((status & ATH9K_INT_FATAL) || ((status & ATH9K_INT_RXORN) &&
-            !(ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)))
+        if (status & ATH9K_INT_FATAL)
                 goto chip_reset;
 
         if ((ah->config.hw_hang_checks & HW_BB_WATCHDOG) &&
@@ -598,17 +603,29 @@ chip_reset:
 #undef SCHED_INTR
 }
 
-int ath_reset(struct ath_softc *sc)
+/*
+ * This function is called when a HW reset cannot be deferred
+ * and has to be immediate.
+ */
+int ath_reset(struct ath_softc *sc, struct ath9k_channel *hchan)
 {
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         int r;
 
+        set_bit(ATH_OP_HW_RESET, &common->op_flags);
+
         ath9k_ps_wakeup(sc);
-        r = ath_reset_internal(sc, NULL);
+        r = ath_reset_internal(sc, hchan);
         ath9k_ps_restore(sc);
 
         return r;
 }
 
+/*
+ * When a HW reset can be deferred, it is added to the
+ * hw_reset_work workqueue, but we set ATH_OP_HW_RESET before
+ * queueing.
+ */
 void ath9k_queue_reset(struct ath_softc *sc, enum ath_reset_type type)
 {
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
@@ -623,7 +640,9 @@ void ath_reset_work(struct work_struct *work)
 {
         struct ath_softc *sc = container_of(work, struct ath_softc, hw_reset_work);
 
-        ath_reset(sc);
+        ath9k_ps_wakeup(sc);
+        ath_reset_internal(sc, NULL);
+        ath9k_ps_restore(sc);
 }
 
 /**********************/
@@ -1037,7 +1056,7 @@ static void ath9k_set_offchannel_state(struct ath_softc *sc)
 
         eth_zero_addr(common->curbssid);
         eth_broadcast_addr(common->bssidmask);
-        ether_addr_copy(common->macaddr, vif->addr);
+        memcpy(common->macaddr, vif->addr, ETH_ALEN);
         common->curaid = 0;
         ah->opmode = vif->type;
         ah->imask &= ~ATH9K_INT_SWBA;
@@ -1078,7 +1097,7 @@ void ath9k_calculate_summary_state(struct ath_softc *sc,
         ath9k_calculate_iter_data(sc, ctx, &iter_data);
 
         if (iter_data.has_hw_macaddr)
-                ether_addr_copy(common->macaddr, iter_data.hw_macaddr);
+                memcpy(common->macaddr, iter_data.hw_macaddr, ETH_ALEN);
 
         memcpy(common->bssidmask, iter_data.mask, ETH_ALEN);
         ath_hw_setbssidmask(common);
@@ -1550,6 +1569,40 @@ static int ath9k_sta_remove(struct ieee80211_hw *hw,
         return 0;
 }
 
+static int ath9k_sta_state(struct ieee80211_hw *hw,
+                           struct ieee80211_vif *vif,
+                           struct ieee80211_sta *sta,
+                           enum ieee80211_sta_state old_state,
+                           enum ieee80211_sta_state new_state)
+{
+        struct ath_softc *sc = hw->priv;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        int ret = 0;
+
+        if (old_state == IEEE80211_STA_AUTH &&
+            new_state == IEEE80211_STA_ASSOC) {
+                ret = ath9k_sta_add(hw, vif, sta);
+                ath_dbg(common, CONFIG,
+                        "Add station: %pM\n", sta->addr);
+        } else if (old_state == IEEE80211_STA_ASSOC &&
+                   new_state == IEEE80211_STA_AUTH) {
+                ret = ath9k_sta_remove(hw, vif, sta);
+                ath_dbg(common, CONFIG,
+                        "Remove station: %pM\n", sta->addr);
+        }
+
+        if (ath9k_is_chanctx_enabled()) {
+                if (vif->type == NL80211_IFTYPE_STATION) {
+                        if (old_state == IEEE80211_STA_ASSOC &&
+                            new_state == IEEE80211_STA_AUTHORIZED)
+                                ath_chanctx_event(sc, vif,
+                                                  ATH_CHANCTX_EVENT_AUTHORIZED);
+                }
+        }
+
+        return ret;
+}
+
 static void ath9k_sta_set_tx_filter(struct ath_hw *ah,
                                     struct ath_node *an,
                                     bool set)
@@ -1734,17 +1787,11 @@ static void ath9k_bss_info_changed(struct ieee80211_hw *hw,
                 ath_dbg(common, CONFIG, "BSSID %pM Changed ASSOC %d\n",
                         bss_conf->bssid, bss_conf->assoc);
 
-                ether_addr_copy(avp->bssid, bss_conf->bssid);
+                memcpy(avp->bssid, bss_conf->bssid, ETH_ALEN);
                 avp->aid = bss_conf->aid;
                 avp->assoc = bss_conf->assoc;
 
                 ath9k_calculate_summary_state(sc, avp->chanctx);
-
-                if (ath9k_is_chanctx_enabled()) {
-                        if (bss_conf->assoc)
-                                ath_chanctx_event(sc, vif,
-                                                  ATH_CHANCTX_EVENT_ASSOC);
-                }
         }
 
         if (changed & BSS_CHANGED_IBSS) {
@@ -1840,6 +1887,7 @@ static int ath9k_ampdu_action(struct ieee80211_hw *hw,
                               u16 tid, u16 *ssn, u8 buf_size)
 {
         struct ath_softc *sc = hw->priv;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         bool flush = false;
         int ret = 0;
 
@@ -1851,6 +1899,12 @@ static int ath9k_ampdu_action(struct ieee80211_hw *hw,
         case IEEE80211_AMPDU_RX_STOP:
                 break;
         case IEEE80211_AMPDU_TX_START:
+                if (ath9k_is_chanctx_enabled()) {
+                        if (test_bit(ATH_OP_SCANNING, &common->op_flags)) {
+                                ret = -EBUSY;
+                                break;
+                        }
+                }
                 ath9k_ps_wakeup(sc);
                 ret = ath_tx_aggr_start(sc, sta, tid, ssn);
                 if (!ret)
@@ -1964,7 +2018,8 @@ static void ath9k_set_coverage_class(struct ieee80211_hw *hw,
         mutex_unlock(&sc->mutex);
 }
 
-static bool ath9k_has_tx_pending(struct ath_softc *sc)
+static bool ath9k_has_tx_pending(struct ath_softc *sc,
+                                 bool sw_pending)
 {
         int i, npend = 0;
 
@@ -1972,7 +2027,8 @@ static bool ath9k_has_tx_pending(struct ath_softc *sc)
                 if (!ATH_TXQ_SETUP(sc, i))
                         continue;
 
-                npend = ath9k_has_pending_frames(sc, &sc->tx.txq[i]);
+                npend = ath9k_has_pending_frames(sc, &sc->tx.txq[i],
+                                                 sw_pending);
                 if (npend)
                         break;
         }
@@ -1984,18 +2040,38 @@ static void ath9k_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                         u32 queues, bool drop)
 {
         struct ath_softc *sc = hw->priv;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
 
+        if (ath9k_is_chanctx_enabled()) {
+                if (!test_bit(ATH_OP_MULTI_CHANNEL, &common->op_flags))
+                        goto flush;
+
+                /*
+                 * If MCC is active, extend the flush timeout
+                 * and wait for the HW/SW queues to become
+                 * empty. This needs to be done outside the
+                 * sc->mutex lock to allow the channel scheduler
+                 * to switch channel contexts.
+                 *
+                 * The vif queues have been stopped in mac80211,
+                 * so there won't be any incoming frames.
+                 */
+                __ath9k_flush(hw, queues, drop, true, true);
+                return;
+        }
+flush:
         mutex_lock(&sc->mutex);
-        __ath9k_flush(hw, queues, drop);
+        __ath9k_flush(hw, queues, drop, true, false);
         mutex_unlock(&sc->mutex);
 }
 
-void __ath9k_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+void __ath9k_flush(struct ieee80211_hw *hw, u32 queues, bool drop,
+                   bool sw_pending, bool timeout_override)
 {
         struct ath_softc *sc = hw->priv;
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
-        int timeout = HZ / 5; /* 200 ms */
+        int timeout;
         bool drain_txq;
 
         cancel_delayed_work_sync(&sc->tx_complete_work);
@@ -2010,7 +2086,17 @@ void __ath9k_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
                 return;
         }
 
-        if (wait_event_timeout(sc->tx_wait, !ath9k_has_tx_pending(sc),
+        spin_lock_bh(&sc->chan_lock);
+        if (timeout_override)
+                timeout = HZ / 5;
+        else
+                timeout = sc->cur_chan->flush_timeout;
+        spin_unlock_bh(&sc->chan_lock);
+
+        ath_dbg(common, CHAN_CTX,
+                "Flush timeout: %d\n", jiffies_to_msecs(timeout));
+
+        if (wait_event_timeout(sc->tx_wait, !ath9k_has_tx_pending(sc, sw_pending),
                                timeout) > 0)
                 drop = false;
 
@@ -2021,7 +2107,7 @@ void __ath9k_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
                 spin_unlock_bh(&sc->sc_pcu_lock);
 
                 if (!drain_txq)
-                        ath_reset(sc);
+                        ath_reset(sc, NULL);
 
                 ath9k_ps_restore(sc);
         }
@@ -2033,7 +2119,7 @@ static bool ath9k_tx_frames_pending(struct ieee80211_hw *hw)
 {
         struct ath_softc *sc = hw->priv;
 
-        return ath9k_has_tx_pending(sc);
+        return ath9k_has_tx_pending(sc, true);
 }
 
 static int ath9k_tx_last_beacon(struct ieee80211_hw *hw)
@@ -2310,7 +2396,6 @@ static int ath9k_add_chanctx(struct ieee80211_hw *hw,
                         conf->def.chan->center_freq);
 
                 ath_chanctx_set_channel(sc, ctx, &conf->def);
-                ath_chanctx_event(sc, NULL, ATH_CHANCTX_EVENT_ASSIGN);
 
                 mutex_unlock(&sc->mutex);
                 return 0;
@@ -2419,7 +2504,11 @@ static void ath9k_mgd_prepare_tx(struct ieee80211_hw *hw,
         struct ath_softc *sc = hw->priv;
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath_vif *avp = (struct ath_vif *) vif->drv_priv;
+        struct ath_beacon_config *cur_conf;
+        struct ath_chanctx *go_ctx;
+        unsigned long timeout;
         bool changed = false;
+        u32 beacon_int;
 
         if (!test_bit(ATH_OP_MULTI_CHANNEL, &common->op_flags))
                 return;
@@ -2430,19 +2519,59 @@ static void ath9k_mgd_prepare_tx(struct ieee80211_hw *hw,
         mutex_lock(&sc->mutex);
 
         spin_lock_bh(&sc->chan_lock);
-        if (sc->next_chan || (sc->cur_chan != avp->chanctx)) {
-                sc->next_chan = avp->chanctx;
+        if (sc->next_chan || (sc->cur_chan != avp->chanctx))
                 changed = true;
+        spin_unlock_bh(&sc->chan_lock);
+
+        if (!changed)
+                goto out;
+
+        if (test_bit(ATH_OP_SCANNING, &common->op_flags)) {
+                ath_dbg(common, CHAN_CTX,
+                        "%s: Aborting HW scan\n", __func__);
+
+                mutex_unlock(&sc->mutex);
+
+                del_timer_sync(&sc->offchannel.timer);
+                ath_scan_complete(sc, true);
+                flush_work(&sc->chanctx_work);
+
+                mutex_lock(&sc->mutex);
+        }
+
+        go_ctx = ath_is_go_chanctx_present(sc);
+
+        if (go_ctx) {
+                /*
+                 * Wait till the GO interface gets a chance
+                 * to send out an NoA.
+                 */
+                spin_lock_bh(&sc->chan_lock);
+                sc->sched.mgd_prepare_tx = true;
+                cur_conf = &go_ctx->beacon;
+                beacon_int = TU_TO_USEC(cur_conf->beacon_interval);
+                spin_unlock_bh(&sc->chan_lock);
+
+                timeout = usecs_to_jiffies(beacon_int);
+                init_completion(&sc->go_beacon);
+
+                if (wait_for_completion_timeout(&sc->go_beacon,
+                                                timeout) == 0)
+                        ath_dbg(common, CHAN_CTX,
+                                "Failed to send new NoA\n");
         }
+
         ath_dbg(common, CHAN_CTX,
-                "%s: Set chanctx state to FORCE_ACTIVE, changed: %d\n",
-                __func__, changed);
+                "%s: Set chanctx state to FORCE_ACTIVE for vif: %pM\n",
+                __func__, vif->addr);
+
+        spin_lock_bh(&sc->chan_lock);
+        sc->next_chan = avp->chanctx;
         sc->sched.state = ATH_CHANCTX_STATE_FORCE_ACTIVE;
         spin_unlock_bh(&sc->chan_lock);
 
-        if (changed)
-                ath_chanctx_set_next(sc, true);
-
+        ath_chanctx_set_next(sc, true);
+out:
         mutex_unlock(&sc->mutex);
 }
 
@@ -2474,8 +2603,7 @@ struct ieee80211_ops ath9k_ops = {
         .remove_interface   = ath9k_remove_interface,
         .config             = ath9k_config,
         .configure_filter   = ath9k_configure_filter,
-        .sta_add            = ath9k_sta_add,
-        .sta_remove         = ath9k_sta_remove,
+        .sta_state          = ath9k_sta_state,
         .sta_notify         = ath9k_sta_notify,
         .conf_tx            = ath9k_conf_tx,
         .bss_info_changed   = ath9k_bss_info_changed,
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index c018dea0b2e8..e3f60d5c5263 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -30,6 +30,7 @@ static const struct pci_device_id ath_pci_id_table[] = {
         { PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI   */
         { PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */
 
+#ifdef CONFIG_ATH9K_PCOEM
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x002A,
                          PCI_VENDOR_ID_AZWAVE,
@@ -82,6 +83,7 @@ static const struct pci_device_id ath_pci_id_table[] = {
                          PCI_VENDOR_ID_AZWAVE,
                          0x2C37),
           .driver_data = ATH9K_PCI_BT_ANT_DIV },
+#endif
 
         { PCI_VDEVICE(ATHEROS, 0x002B) }, /* PCI-E */
         { PCI_VDEVICE(ATHEROS, 0x002C) }, /* PCI-E 802.11n bonded out */
@@ -102,6 +104,7 @@ static const struct pci_device_id ath_pci_id_table[] = {
 
         { PCI_VDEVICE(ATHEROS, 0x0030) }, /* PCI-E  AR9300 */
 
+#ifdef CONFIG_ATH9K_PCOEM
         /* PCI-E CUS198 */
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0032,
@@ -294,10 +297,12 @@ static const struct pci_device_id ath_pci_id_table[] = {
                          PCI_VENDOR_ID_ASUSTEK,
                          0x850D),
           .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+#endif
 
         { PCI_VDEVICE(ATHEROS, 0x0032) }, /* PCI-E  AR9485 */
         { PCI_VDEVICE(ATHEROS, 0x0033) }, /* PCI-E  AR9580 */
 
+#ifdef CONFIG_ATH9K_PCOEM
         /* PCI-E CUS217 */
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0034,
@@ -657,6 +662,7 @@ static const struct pci_device_id ath_pci_id_table[] = {
         /* PCI-E AR9565 (WB335) */
         { PCI_VDEVICE(ATHEROS, 0x0036),
           .driver_data = ATH9K_PCI_BT_ANT_DIV },
+#endif
 
         { 0 }
 };
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index 2a938f4feac5..1c0b1c1c5350 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -892,10 +892,21 @@
         (AR_SREV_9330((_ah)) && \
          ((_ah)->hw_version.macRev == AR_SREV_REVISION_9330_12))
 
+#ifdef CONFIG_ATH9K_PCOEM
+#define AR_SREV_9462(_ah) \
+        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9462))
 #define AR_SREV_9485(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9485))
+#define AR_SREV_9565(_ah) \
+        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9565))
+#else
+#define AR_SREV_9462(_ah) 0
+#define AR_SREV_9485(_ah) 0
+#define AR_SREV_9565(_ah) 0
+#endif
+
 #define AR_SREV_9485_11_OR_LATER(_ah) \
-        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9485) && \
+        (AR_SREV_9485(_ah) && \
          ((_ah)->hw_version.macRev >= AR_SREV_REVISION_9485_11))
 #define AR_SREV_9485_OR_LATER(_ah) \
         (((_ah)->hw_version.macVersion >= AR_SREV_VERSION_9485))
@@ -915,34 +926,30 @@
     (AR_SREV_9285_12_OR_LATER(_ah) && \
      ((REG_READ(_ah, AR_AN_SYNTH9) & 0x7) == 0x1))
 
-#define AR_SREV_9462(_ah) \
-        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9462))
 #define AR_SREV_9462_20(_ah) \
-        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9462) && \
+        (AR_SREV_9462(_ah) && \
          ((_ah)->hw_version.macRev == AR_SREV_REVISION_9462_20))
 #define AR_SREV_9462_21(_ah) \
-        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9462) && \
+        (AR_SREV_9462(_ah) && \
          ((_ah)->hw_version.macRev == AR_SREV_REVISION_9462_21))
 #define AR_SREV_9462_20_OR_LATER(_ah) \
-        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9462) && \
+        (AR_SREV_9462(_ah) && \
          ((_ah)->hw_version.macRev >= AR_SREV_REVISION_9462_20))
 #define AR_SREV_9462_21_OR_LATER(_ah) \
-        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9462) && \
+        (AR_SREV_9462(_ah) && \
          ((_ah)->hw_version.macRev >= AR_SREV_REVISION_9462_21))
 
-#define AR_SREV_9565(_ah) \
-        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9565))
 #define AR_SREV_9565_10(_ah) \
-        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9565) && \
+        (AR_SREV_9565(_ah) && \
          ((_ah)->hw_version.macRev == AR_SREV_REVISION_9565_10))
 #define AR_SREV_9565_101(_ah) \
-        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9565) && \
+        (AR_SREV_9565(_ah) && \
          ((_ah)->hw_version.macRev == AR_SREV_REVISION_9565_101))
 #define AR_SREV_9565_11(_ah) \
-        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9565) && \
+        (AR_SREV_9565(_ah) && \
          ((_ah)->hw_version.macRev == AR_SREV_REVISION_9565_11))
 #define AR_SREV_9565_11_OR_LATER(_ah) \
-        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9565) && \
+        (AR_SREV_9565(_ah) && \
          ((_ah)->hw_version.macRev >= AR_SREV_REVISION_9565_11))
 
 #define AR_SREV_9550(_ah) \
diff --git a/drivers/net/wireless/ath/ath9k/tx99.c b/drivers/net/wireless/ath/ath9k/tx99.c
index 40ab65e6882f..ac4781f37e78 100644
--- a/drivers/net/wireless/ath/ath9k/tx99.c
+++ b/drivers/net/wireless/ath/ath9k/tx99.c
@@ -99,7 +99,7 @@ static struct sk_buff *ath9k_build_tx99_skb(struct ath_softc *sc)
 
 static void ath9k_tx99_deinit(struct ath_softc *sc)
 {
-        ath_reset(sc);
+        ath_reset(sc, NULL);
 
         ath9k_ps_wakeup(sc);
         ath9k_tx99_stop(sc);
@@ -127,7 +127,7 @@ static int ath9k_tx99_init(struct ath_softc *sc)
         memset(&txctl, 0, sizeof(txctl));
         txctl.txq = sc->tx.txq_map[IEEE80211_AC_VO];
 
-        ath_reset(sc);
+        ath_reset(sc, NULL);
 
         ath9k_ps_wakeup(sc);
 
diff --git a/drivers/net/wireless/ath/carl9170/phy.c b/drivers/net/wireless/ath/carl9170/phy.c
index b80b2138ce3c..dca6df13fd5b 100644
--- a/drivers/net/wireless/ath/carl9170/phy.c
+++ b/drivers/net/wireless/ath/carl9170/phy.c
@@ -994,7 +994,7 @@ static int carl9170_init_rf_bank4_pwr(struct ar9170 *ar, bool band5ghz,
                         refsel0 = 0;
                         refsel1 = 1;
                 }
-                chansel = byte_rev_table[chansel];
+                chansel = bitrev8(chansel);
         } else {
                 if (freq == 2484) {
                         chansel = 10 + (freq - 2274) / 5;
@@ -1002,7 +1002,7 @@ static int carl9170_init_rf_bank4_pwr(struct ar9170 *ar, bool band5ghz,
                 } else
                         chansel = 16 + (freq - 2272) / 5;
                 chansel *= 4;
-                chansel = byte_rev_table[chansel];
+                chansel = bitrev8(chansel);
         }
 
         d1 =    chansel;
diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c
index d9f4b30dd343..0fc0b9f8e605 100644
--- a/drivers/net/wireless/ath/wil6210/cfg80211.c
+++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
@@ -792,12 +792,13 @@ static int wil_cfg80211_stop_ap(struct wiphy *wiphy,
 }
 
 static int wil_cfg80211_del_station(struct wiphy *wiphy,
-                                    struct net_device *dev, const u8 *mac)
+                                    struct net_device *dev,
+                                    struct station_del_parameters *params)
 {
         struct wil6210_priv *wil = wiphy_to_wil(wiphy);
 
         mutex_lock(&wil->mutex);
-        wil6210_disconnect(wil, mac);
+        wil6210_disconnect(wil, params->mac, false);
         mutex_unlock(&wil->mutex);
 
         return 0;
diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c
index 6500caf8d609..6212983fede2 100644
--- a/drivers/net/wireless/ath/wil6210/main.c
+++ b/drivers/net/wireless/ath/wil6210/main.c
@@ -38,6 +38,35 @@ static unsigned int itr_trsh = WIL6210_ITR_TRSH_DEFAULT;
 module_param(itr_trsh, uint, S_IRUGO);
 MODULE_PARM_DESC(itr_trsh, " Interrupt moderation threshold, usecs.");
 
+/* We allow allocation of more than 1 page buffers to support large packets.
+ * It is suboptimal behavior performance wise in case MTU above page size.
+ */
+unsigned int mtu_max = TXRX_BUF_LEN_DEFAULT - ETH_HLEN;
+static int mtu_max_set(const char *val, const struct kernel_param *kp)
+{
+        int ret;
+
+        /* sets mtu_max directly. no need to restore it in case of
+         * illegal value since we assume this will fail insmod
+         */
+        ret = param_set_uint(val, kp);
+        if (ret)
+                return ret;
+
+        if (mtu_max < 68 || mtu_max > IEEE80211_MAX_DATA_LEN_DMG)
+                ret = -EINVAL;
+
+        return ret;
+}
+
+static struct kernel_param_ops mtu_max_ops = {
+        .set = mtu_max_set,
+        .get = param_get_uint,
+};
+
+module_param_cb(mtu_max, &mtu_max_ops, &mtu_max, S_IRUGO);
+MODULE_PARM_DESC(mtu_max, " Max MTU value.");
+
 #define RST_DELAY (20) /* msec, for loop in @wil_target_reset */
 #define RST_COUNT (1 + 1000/RST_DELAY) /* round up to be above 1 sec total */
 
@@ -74,7 +103,8 @@ void wil_memcpy_toio_32(volatile void __iomem *dst, const void *src,
                 __raw_writel(*s++, d++);
 }
 
-static void wil_disconnect_cid(struct wil6210_priv *wil, int cid)
+static void wil_disconnect_cid(struct wil6210_priv *wil, int cid,
+                               bool from_event)
 {
         uint i;
         struct net_device *ndev = wil_to_ndev(wil);
@@ -86,7 +116,10 @@ static void wil_disconnect_cid(struct wil6210_priv *wil, int cid)
 
         sta->data_port_open = false;
         if (sta->status != wil_sta_unused) {
-                wmi_disconnect_sta(wil, sta->addr, WLAN_REASON_DEAUTH_LEAVING);
+                if (!from_event)
+                        wmi_disconnect_sta(wil, sta->addr,
+                                           WLAN_REASON_DEAUTH_LEAVING);
+
                 switch (wdev->iftype) {
                 case NL80211_IFTYPE_AP:
                 case NL80211_IFTYPE_P2P_GO:
@@ -118,7 +151,8 @@ static void wil_disconnect_cid(struct wil6210_priv *wil, int cid)
         memset(&sta->stats, 0, sizeof(sta->stats));
 }
 
-static void _wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid)
+static void _wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid,
+                                bool from_event)
 {
         int cid = -ENOENT;
         struct net_device *ndev = wil_to_ndev(wil);
@@ -133,10 +167,10 @@ static void _wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid)
         }
 
         if (cid >= 0) /* disconnect 1 peer */
-                wil_disconnect_cid(wil, cid);
+                wil_disconnect_cid(wil, cid, from_event);
         else /* disconnect all */
                 for (cid = 0; cid < WIL6210_MAX_CID; cid++)
-                        wil_disconnect_cid(wil, cid);
+                        wil_disconnect_cid(wil, cid, from_event);
 
         /* link state */
         switch (wdev->iftype) {
@@ -166,7 +200,7 @@ static void wil_disconnect_worker(struct work_struct *work)
                         struct wil6210_priv, disconnect_worker);
 
         mutex_lock(&wil->mutex);
-        _wil6210_disconnect(wil, NULL);
+        _wil6210_disconnect(wil, NULL, false);
         mutex_unlock(&wil->mutex);
 }
 
@@ -223,6 +257,11 @@ static void wil_fw_error_worker(struct work_struct *work)
 
         wil_dbg_misc(wil, "fw error worker\n");
 
+        if (!netif_running(wil_to_ndev(wil))) {
+                wil_info(wil, "No recovery - interface is down\n");
+                return;
+        }
+
         /* increment @recovery_count if less then WIL6210_FW_RECOVERY_TO
          * passed since last recovery attempt
          */
@@ -257,9 +296,12 @@ static void wil_fw_error_worker(struct work_struct *work)
                 break;
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_P2P_GO:
+                wil_info(wil, "No recovery for AP-like interface\n");
                 /* recovery in these modes is done by upper layers */
                 break;
         default:
+                wil_err(wil, "No recovery - unknown interface type %d\n",
+                        wdev->iftype);
                 break;
         }
         mutex_unlock(&wil->mutex);
@@ -346,12 +388,22 @@ int wil_priv_init(struct wil6210_priv *wil)
         return 0;
 }
 
-void wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid)
+/**
+ * wil6210_disconnect - disconnect one connection
+ * @wil: driver context
+ * @bssid: peer to disconnect, NULL to disconnect all
+ * @from_event: whether is invoked from FW event handler
+ *
+ * Disconnect and release associated resources. If invoked not from the
+ * FW event handler, issue WMI command(s) to trigger MAC disconnect.
+ */
+void wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid,
+                        bool from_event)
 {
         wil_dbg_misc(wil, "%s()\n", __func__);
 
         del_timer_sync(&wil->connect_timer);
-        _wil6210_disconnect(wil, bssid);
+        _wil6210_disconnect(wil, bssid, from_event);
 }
 
 void wil_priv_deinit(struct wil6210_priv *wil)
@@ -363,7 +415,7 @@ void wil_priv_deinit(struct wil6210_priv *wil)
         cancel_work_sync(&wil->disconnect_worker);
         cancel_work_sync(&wil->fw_error_worker);
         mutex_lock(&wil->mutex);
-        wil6210_disconnect(wil, NULL);
+        wil6210_disconnect(wil, NULL, false);
         mutex_unlock(&wil->mutex);
         wmi_event_flush(wil);
         destroy_workqueue(wil->wmi_wq_conn);
@@ -395,7 +447,7 @@ static inline void wil_release_cpu(struct wil6210_priv *wil)
 static int wil_target_reset(struct wil6210_priv *wil)
 {
         int delay = 0;
-        u32 hw_state;
+        u32 x;
         u32 rev_id;
         bool is_sparrow = (wil->board->board == WIL_BOARD_SPARROW);
 
@@ -410,9 +462,22 @@ static int wil_target_reset(struct wil6210_priv *wil)
         S(RGF_USER_CLKS_CTL_SW_RST_MASK_0, BIT_CAR_PERST_RST);
 
         wil_halt_cpu(wil);
-        C(RGF_USER_CLKS_CTL_0, BIT_USER_CLKS_CAR_AHB_SW_SEL); /* 40 MHz */
 
         if (is_sparrow) {
+                S(RGF_CAF_OSC_CONTROL, BIT_CAF_OSC_XTAL_EN);
+                /* XTAL stabilization should take about 3ms */
+                usleep_range(5000, 7000);
+                x = R(RGF_CAF_PLL_LOCK_STATUS);
+                if (!(x & BIT_CAF_OSC_DIG_XTAL_STABLE)) {
+                        wil_err(wil, "Xtal stabilization timeout\n"
+                                "RGF_CAF_PLL_LOCK_STATUS = 0x%08x\n", x);
+                        return -ETIME;
+                }
+                /* switch 10k to XTAL*/
+                C(RGF_USER_SPARROW_M_4, BIT_SPARROW_M_4_SEL_SLEEP_OR_REF);
+                /* 40 MHz */
+                C(RGF_USER_CLKS_CTL_0, BIT_USER_CLKS_CAR_AHB_SW_SEL);
+
                 W(RGF_USER_CLKS_CTL_EXT_SW_RST_VEC_0, 0x3ff81f);
                 W(RGF_USER_CLKS_CTL_EXT_SW_RST_VEC_1, 0xf);
         }
@@ -453,13 +518,13 @@ static int wil_target_reset(struct wil6210_priv *wil)
         /* wait until device ready. typical time is 200..250 msec */
         do {
                 msleep(RST_DELAY);
-                hw_state = R(RGF_USER_HW_MACHINE_STATE);
+                x = R(RGF_USER_HW_MACHINE_STATE);
                 if (delay++ > RST_COUNT) {
                         wil_err(wil, "Reset not completed, hw_state 0x%08x\n",
-                                hw_state);
+                                x);
                         return -ETIME;
                 }
-        } while (hw_state != HW_MACHINE_BOOT_DONE);
+        } while (x != HW_MACHINE_BOOT_DONE);
 
         /* TODO: Erez check rev_id != 1 */
         if (!is_sparrow && (rev_id != 1))
@@ -535,7 +600,7 @@ int wil_reset(struct wil6210_priv *wil)
         WARN_ON(test_bit(wil_status_napi_en, &wil->status));
 
         cancel_work_sync(&wil->disconnect_worker);
-        wil6210_disconnect(wil, NULL);
+        wil6210_disconnect(wil, NULL, false);
 
         wil->status = 0; /* prevent NAPI from being scheduled */
 
diff --git a/drivers/net/wireless/ath/wil6210/netdev.c b/drivers/net/wireless/ath/wil6210/netdev.c
index 239965106c05..e81703ca7701 100644
--- a/drivers/net/wireless/ath/wil6210/netdev.c
+++ b/drivers/net/wireless/ath/wil6210/netdev.c
@@ -41,7 +41,7 @@ static int wil_change_mtu(struct net_device *ndev, int new_mtu)
 {
         struct wil6210_priv *wil = ndev_to_wil(ndev);
 
-        if (new_mtu < 68 || new_mtu > (TX_BUF_LEN - ETH_HLEN)) {
+        if (new_mtu < 68 || new_mtu > mtu_max) {
                 wil_err(wil, "invalid MTU %d\n", new_mtu);
                 return -EINVAL;
         }
diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
index 2936ef0c18cb..c680906bc0dc 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.c
+++ b/drivers/net/wireless/ath/wil6210/txrx.c
@@ -206,7 +206,7 @@ static int wil_vring_alloc_skb(struct wil6210_priv *wil, struct vring *vring,
                                u32 i, int headroom)
 {
         struct device *dev = wil_to_dev(wil);
-        unsigned int sz = RX_BUF_LEN;
+        unsigned int sz = mtu_max + ETH_HLEN;
         struct vring_rx_desc dd, *d = &dd;
         volatile struct vring_rx_desc *_d = &vring->va[i].rx;
         dma_addr_t pa;
@@ -385,7 +385,7 @@ static struct sk_buff *wil_vring_reap_rx(struct wil6210_priv *wil,
         struct vring_rx_desc *d;
         struct sk_buff *skb;
         dma_addr_t pa;
-        unsigned int sz = RX_BUF_LEN;
+        unsigned int sz = mtu_max + ETH_HLEN;
         u16 dmalen;
         u8 ftype;
         u8 ds_bits;
@@ -646,7 +646,8 @@ int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
                 .action = cpu_to_le32(WMI_VRING_CMD_ADD),
                 .vring_cfg = {
                         .tx_sw_ring = {
-                                .max_mpdu_size = cpu_to_le16(TX_BUF_LEN),
+                                .max_mpdu_size =
+                                        cpu_to_le16(mtu_max + ETH_HLEN),
                                 .ring_size = cpu_to_le16(size),
                         },
                         .ringid = id,
diff --git a/drivers/net/wireless/ath/wil6210/txrx.h b/drivers/net/wireless/ath/wil6210/txrx.h
index de046716d2b7..630aeb5fa7f4 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.h
+++ b/drivers/net/wireless/ath/wil6210/txrx.h
@@ -21,8 +21,8 @@
 #define BUF_HW_OWNED    (0)
 
 /* size of max. Tx/Rx buffers, as supported by FW */
-#define RX_BUF_LEN      (2242)
-#define TX_BUF_LEN      (2242)
+#define TXRX_BUF_LEN_DEFAULT (2242)
+
 /* how many bytes to reserve for rtap header? */
 #define WIL6210_RTAP_SIZE (128)
 
diff --git a/drivers/net/wireless/ath/wil6210/wil6210.h b/drivers/net/wireless/ath/wil6210/wil6210.h
index ce6488e42091..95d3a062d35c 100644
--- a/drivers/net/wireless/ath/wil6210/wil6210.h
+++ b/drivers/net/wireless/ath/wil6210/wil6210.h
@@ -24,6 +24,7 @@
 #include "wil_platform.h"
 
 extern bool no_fw_recovery;
+extern unsigned int mtu_max;
 
 #define WIL_NAME "wil6210"
 #define WIL_FW_NAME "wil6210.fw"
@@ -117,6 +118,8 @@ struct RGF_ICR {
         #define BIT_USER_USER_ICR_SW_INT_2      BIT(18)
 #define RGF_USER_CLKS_CTL_EXT_SW_RST_VEC_0      (0x880c18)
 #define RGF_USER_CLKS_CTL_EXT_SW_RST_VEC_1      (0x880c2c)
+#define RGF_USER_SPARROW_M_4                    (0x880c50) /* Sparrow */
+        #define BIT_SPARROW_M_4_SEL_SLEEP_OR_REF        BIT(2)
 
 #define RGF_DMA_EP_TX_ICR               (0x881bb4) /* struct RGF_ICR */
         #define BIT_DMA_EP_TX_ICR_TX_DONE       BIT(0)
@@ -152,6 +155,10 @@ struct RGF_ICR {
 #define RGF_MAC_MTRL_COUNTER_0          (0x886aa8)
 
 #define RGF_CAF_ICR                     (0x88946c) /* struct RGF_ICR */
+#define RGF_CAF_OSC_CONTROL             (0x88afa4)
+        #define BIT_CAF_OSC_XTAL_EN             BIT(0)
+#define RGF_CAF_PLL_LOCK_STATUS         (0x88afec)
+        #define BIT_CAF_OSC_DIG_XTAL_STABLE     BIT(0)
 
 /* popular locations */
 #define HOST_MBOX   HOSTADDR(RGF_USER_USER_SCRATCH_PAD)
@@ -463,8 +470,11 @@ struct wil6210_priv {
 #define ndev_to_wil(n) (wdev_to_wil(n->ieee80211_ptr))
 #define wil_to_pcie_dev(i) (&i->pdev->dev)
 
+__printf(2, 3)
 void wil_dbg_trace(struct wil6210_priv *wil, const char *fmt, ...);
+__printf(2, 3)
 void wil_err(struct wil6210_priv *wil, const char *fmt, ...);
+__printf(2, 3)
 void wil_info(struct wil6210_priv *wil, const char *fmt, ...);
 #define wil_dbg(wil, fmt, arg...) do { \
         netdev_dbg(wil_to_ndev(wil), fmt, ##arg); \
@@ -575,7 +585,8 @@ void wil_wdev_free(struct wil6210_priv *wil);
 int wmi_set_mac_address(struct wil6210_priv *wil, void *addr);
 int wmi_pcp_start(struct wil6210_priv *wil, int bi, u8 wmi_nettype, u8 chan);
 int wmi_pcp_stop(struct wil6210_priv *wil);
-void wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid);
+void wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid,
+                        bool from_event);
 
 int wil_rx_init(struct wil6210_priv *wil);
 void wil_rx_fini(struct wil6210_priv *wil);
diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
index 4311df982c60..bb1e066f756a 100644
--- a/drivers/net/wireless/ath/wil6210/wmi.c
+++ b/drivers/net/wireless/ath/wil6210/wmi.c
@@ -486,7 +486,7 @@ static void wmi_evt_disconnect(struct wil6210_priv *wil, int id,
         wil->sinfo_gen++;
 
         mutex_lock(&wil->mutex);
-        wil6210_disconnect(wil, evt->bssid);
+        wil6210_disconnect(wil, evt->bssid, true);
         mutex_unlock(&wil->mutex);
 }
 
@@ -1025,7 +1025,7 @@ int wmi_rx_chain_add(struct wil6210_priv *wil, struct vring *vring)
         struct wmi_cfg_rx_chain_cmd cmd = {
                 .action = WMI_RX_CHAIN_ADD,
                 .rx_sw_ring = {
-                        .max_mpdu_size = cpu_to_le16(RX_BUF_LEN),
+                        .max_mpdu_size = cpu_to_le16(mtu_max + ETH_HLEN),
                         .ring_mem_base = cpu_to_le64(vring->pa),
                         .ring_size = cpu_to_le16(vring->size),
                 },
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/Makefile b/drivers/net/wireless/brcm80211/brcmfmac/Makefile
index 90a977fe9a64..dc4c75083085 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/Makefile
+++ b/drivers/net/wireless/brcm80211/brcmfmac/Makefile
@@ -23,15 +23,15 @@ ccflags-y += -D__CHECK_ENDIAN__
 
 obj-$(CONFIG_BRCMFMAC) += brcmfmac.o
 brcmfmac-objs += \
-                wl_cfg80211.o \
+                cfg80211.o \
                 chip.o \
                 fwil.o \
                 fweh.o \
                 fwsignal.o \
                 p2p.o \
                 proto.o \
-                dhd_common.o \
-                dhd_linux.o \
+                common.o \
+                core.o \
                 firmware.o \
                 feature.o \
                 btcoex.o \
@@ -43,14 +43,14 @@ brcmfmac-$(CONFIG_BRCMFMAC_PROTO_MSGBUF) += \
                 flowring.o \
                 msgbuf.o
 brcmfmac-$(CONFIG_BRCMFMAC_SDIO) += \
-                dhd_sdio.o \
+                sdio.o \
                 bcmsdh.o
 brcmfmac-$(CONFIG_BRCMFMAC_USB) += \
                 usb.o
 brcmfmac-$(CONFIG_BRCMFMAC_PCIE) += \
                 pcie.o
 brcmfmac-$(CONFIG_BRCMDBG) += \
-                dhd_dbg.o
+                debug.o
 brcmfmac-$(CONFIG_BRCM_TRACING) += \
                 tracepoint.o
 brcmfmac-$(CONFIG_OF) += \
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c b/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c
index a159ff3427de..8e0e91c4a0b1 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c
@@ -25,10 +25,10 @@
 #include <brcmu_utils.h>
 #include <brcmu_wifi.h>
 
-#include "dhd.h"
-#include "dhd_bus.h"
+#include "core.h"
+#include "bus.h"
 #include "fwsignal.h"
-#include "dhd_dbg.h"
+#include "debug.h"
 #include "tracepoint.h"
 #include "proto.h"
 #include "bcdc.h"
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
index 8dbd5dbb78fd..f754ffcd0308 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
@@ -41,9 +41,9 @@
 #include <chipcommon.h>
 #include <soc.h>
 #include "chip.h"
-#include "dhd_bus.h"
-#include "dhd_dbg.h"
-#include "sdio_host.h"
+#include "bus.h"
+#include "debug.h"
+#include "sdio.h"
 #include "of.h"
 
 #define SDIOH_API_ACCESS_RETRY_LIMIT    2
@@ -1064,6 +1064,16 @@ static int brcmf_ops_sdio_probe(struct sdio_func *func,
         if (!sdiodev->pdata)
                 brcmf_of_probe(sdiodev);
 
+#ifdef CONFIG_PM_SLEEP
+        /* wowl can be supported when KEEP_POWER is true and (WAKE_SDIO_IRQ
+         * is true or when platform data OOB irq is true).
+         */
+        if ((sdio_get_host_pm_caps(sdiodev->func[1]) & MMC_PM_KEEP_POWER) &&
+            ((sdio_get_host_pm_caps(sdiodev->func[1]) & MMC_PM_WAKE_SDIO_IRQ) ||
+             (sdiodev->pdata->oob_irq_supported)))
+                bus_if->wowl_supported = true;
+#endif
+
         atomic_set(&sdiodev->suspend, false);
         init_waitqueue_head(&sdiodev->request_word_wait);
         init_waitqueue_head(&sdiodev->request_buffer_wait);
@@ -1116,34 +1126,39 @@ static void brcmf_ops_sdio_remove(struct sdio_func *func)
         brcmf_dbg(SDIO, "Exit\n");
 }
 
+void brcmf_sdio_wowl_config(struct device *dev, bool enabled)
+{
+        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+        struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
+
+        brcmf_dbg(SDIO, "Configuring WOWL, enabled=%d\n", enabled);
+        sdiodev->wowl_enabled = enabled;
+}
+
 #ifdef CONFIG_PM_SLEEP
 static int brcmf_ops_sdio_suspend(struct device *dev)
 {
-        mmc_pm_flag_t sdio_flags;
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
-        int ret = 0;
+        mmc_pm_flag_t sdio_flags;
 
         brcmf_dbg(SDIO, "Enter\n");
 
-        sdio_flags = sdio_get_host_pm_caps(sdiodev->func[1]);
-        if (!(sdio_flags & MMC_PM_KEEP_POWER)) {
-                brcmf_err("Host can't keep power while suspended\n");
-                return -EINVAL;
-        }
-
         atomic_set(&sdiodev->suspend, true);
 
-        ret = sdio_set_host_pm_flags(sdiodev->func[1], MMC_PM_KEEP_POWER);
-        if (ret) {
-                brcmf_err("Failed to set pm_flags\n");
-                atomic_set(&sdiodev->suspend, false);
-                return ret;
+        if (sdiodev->wowl_enabled) {
+                sdio_flags = MMC_PM_KEEP_POWER;
+                if (sdiodev->pdata->oob_irq_supported)
+                        enable_irq_wake(sdiodev->pdata->oob_irq_nr);
+                else
+                        sdio_flags = MMC_PM_WAKE_SDIO_IRQ;
+                if (sdio_set_host_pm_flags(sdiodev->func[1], sdio_flags))
+                        brcmf_err("Failed to set pm_flags %x\n", sdio_flags);
         }
 
         brcmf_sdio_wd_timer(sdiodev->bus, 0);
 
-        return ret;
+        return 0;
 }
 
 static int brcmf_ops_sdio_resume(struct device *dev)
@@ -1152,6 +1167,8 @@ static int brcmf_ops_sdio_resume(struct device *dev)
         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
 
         brcmf_dbg(SDIO, "Enter\n");
+        if (sdiodev->pdata->oob_irq_supported)
+                disable_irq_wake(sdiodev->pdata->oob_irq_nr);
         brcmf_sdio_wd_timer(sdiodev->bus, BRCMF_WD_POLL_MS);
         atomic_set(&sdiodev->suspend, false);
         return 0;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/btcoex.c b/drivers/net/wireless/brcm80211/brcmfmac/btcoex.c
index a29ac4977b3a..0445163991b7 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/btcoex.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/btcoex.c
@@ -20,13 +20,13 @@
 #include <brcmu_wifi.h>
 #include <brcmu_utils.h>
 #include <defs.h>
-#include <dhd.h>
-#include <dhd_dbg.h>
+#include "core.h"
+#include "debug.h"
 #include "fwil.h"
 #include "fwil_types.h"
 #include "btcoex.h"
 #include "p2p.h"
-#include "wl_cfg80211.h"
+#include "cfg80211.h"
 
 /* T1 start SCO/eSCO priority suppression */
 #define BRCMF_BTCOEX_OPPR_WIN_TIME   2000
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h b/drivers/net/wireless/brcm80211/brcmfmac/bus.h
index 80e73a1262be..ef344e47218a 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bus.h
@@ -14,10 +14,10 @@
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#ifndef _BRCMF_BUS_H_
-#define _BRCMF_BUS_H_
+#ifndef BRCMFMAC_BUS_H
+#define BRCMFMAC_BUS_H
 
-#include "dhd_dbg.h"
+#include "debug.h"
 
 /* IDs of the 6 default common rings of msgbuf protocol */
 #define BRCMF_H2D_MSGRING_CONTROL_SUBMIT        0
@@ -227,8 +227,7 @@ void brcmf_txflowblock(struct device *dev, bool state);
 void brcmf_txcomplete(struct device *dev, struct sk_buff *txp, bool success);
 
 int brcmf_bus_start(struct device *dev);
-s32 brcmf_iovar_data_set(struct device *dev, char *name, void *data,
-                                u32 len);
+s32 brcmf_iovar_data_set(struct device *dev, char *name, void *data, u32 len);
 void brcmf_bus_add_txhdrlen(struct device *dev, uint len);
 
 #ifdef CONFIG_BRCMFMAC_SDIO
@@ -241,4 +240,4 @@ void brcmf_usb_exit(void);
 void brcmf_usb_register(void);
 #endif
 
-#endif                          /* _BRCMF_BUS_H_ */
+#endif /* BRCMFMAC_BUS_H */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
index 28fa25b509db..e418969679c9 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
@@ -26,18 +26,18 @@
 #include <brcmu_utils.h>
 #include <defs.h>
 #include <brcmu_wifi.h>
-#include "dhd.h"
-#include "dhd_dbg.h"
+#include "core.h"
+#include "debug.h"
 #include "tracepoint.h"
 #include "fwil_types.h"
 #include "p2p.h"
 #include "btcoex.h"
-#include "wl_cfg80211.h"
+#include "cfg80211.h"
 #include "feature.h"
 #include "fwil.h"
 #include "proto.h"
 #include "vendor.h"
-#include "dhd_bus.h"
+#include "bus.h"
 
 #define BRCMF_SCAN_IE_LEN_MAX           2048
 #define BRCMF_PNO_VERSION               2
@@ -2779,6 +2779,44 @@ static __always_inline void brcmf_delay(u32 ms)
         }
 }
 
+static s32 brcmf_config_wowl_pattern(struct brcmf_if *ifp, u8 cmd[4],
+                                     u8 *pattern, u32 patternsize, u8 *mask,
+                                     u32 packet_offset)
+{
+        struct brcmf_fil_wowl_pattern_le *filter;
+        u32 masksize;
+        u32 patternoffset;
+        u8 *buf;
+        u32 bufsize;
+        s32 ret;
+
+        masksize = (patternsize + 7) / 8;
+        patternoffset = sizeof(*filter) - sizeof(filter->cmd) + masksize;
+
+        bufsize = sizeof(*filter) + patternsize + masksize;
+        buf = kzalloc(bufsize, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+        filter = (struct brcmf_fil_wowl_pattern_le *)buf;
+
+        memcpy(filter->cmd, cmd, 4);
+        filter->masksize = cpu_to_le32(masksize);
+        filter->offset = cpu_to_le32(packet_offset);
+        filter->patternoffset = cpu_to_le32(patternoffset);
+        filter->patternsize = cpu_to_le32(patternsize);
+        filter->type = cpu_to_le32(BRCMF_WOWL_PATTERN_TYPE_BITMAP);
+
+        if ((mask) && (masksize))
+                memcpy(buf + sizeof(*filter), mask, masksize);
+        if ((pattern) && (patternsize))
+                memcpy(buf + sizeof(*filter) + masksize, pattern, patternsize);
+
+        ret = brcmf_fil_iovar_data_set(ifp, "wowl_pattern", buf, bufsize);
+
+        kfree(buf);
+        return ret;
+}
+
 static s32 brcmf_cfg80211_resume(struct wiphy *wiphy)
 {
         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
@@ -2788,10 +2826,11 @@ static s32 brcmf_cfg80211_resume(struct wiphy *wiphy)
         brcmf_dbg(TRACE, "Enter\n");
 
         if (cfg->wowl_enabled) {
+                brcmf_configure_arp_offload(ifp, true);
                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM,
                                       cfg->pre_wowl_pmmode);
-                brcmf_fil_iovar_data_set(ifp, "wowl_pattern", "clr", 4);
                 brcmf_fil_iovar_int_set(ifp, "wowl_clear", 0);
+                brcmf_config_wowl_pattern(ifp, "clr", NULL, 0, NULL, 0);
                 cfg->wowl_enabled = false;
         }
         return 0;
@@ -2802,21 +2841,29 @@ static void brcmf_configure_wowl(struct brcmf_cfg80211_info *cfg,
                                  struct cfg80211_wowlan *wowl)
 {
         u32 wowl_config;
+        u32 i;
 
         brcmf_dbg(TRACE, "Suspend, wowl config.\n");
 
+        brcmf_configure_arp_offload(ifp, false);
         brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PM, &cfg->pre_wowl_pmmode);
         brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, PM_MAX);
 
         wowl_config = 0;
         if (wowl->disconnect)
-                wowl_config |= WL_WOWL_DIS | WL_WOWL_BCN | WL_WOWL_RETR;
-                /* Note: if "wowl" target and not "wowlpf" then wowl_bcn_loss
-                 * should be configured. This paramater is not supported by
-                 * wowlpf.
-                 */
+                wowl_config = BRCMF_WOWL_DIS | BRCMF_WOWL_BCN | BRCMF_WOWL_RETR;
         if (wowl->magic_pkt)
-                wowl_config |= WL_WOWL_MAGIC;
+                wowl_config |= BRCMF_WOWL_MAGIC;
+        if ((wowl->patterns) && (wowl->n_patterns)) {
+                wowl_config |= BRCMF_WOWL_NET;
+                for (i = 0; i < wowl->n_patterns; i++) {
+                        brcmf_config_wowl_pattern(ifp, "add",
+                                (u8 *)wowl->patterns[i].pattern,
+                                wowl->patterns[i].pattern_len,
+                                (u8 *)wowl->patterns[i].mask,
+                                wowl->patterns[i].pkt_offset);
+                }
+        }
         brcmf_fil_iovar_int_set(ifp, "wowl", wowl_config);
         brcmf_fil_iovar_int_set(ifp, "wowl_activate", 1);
         brcmf_bus_wowl_config(cfg->pub->bus_if, true);
@@ -3998,24 +4045,24 @@ brcmf_cfg80211_change_beacon(struct wiphy *wiphy, struct net_device *ndev,
 
 static int
 brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
-                           const u8 *mac)
+                           struct station_del_parameters *params)
 {
         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
         struct brcmf_scb_val_le scbval;
         struct brcmf_if *ifp = netdev_priv(ndev);
         s32 err;
 
-        if (!mac)
+        if (!params->mac)
                 return -EFAULT;
 
-        brcmf_dbg(TRACE, "Enter %pM\n", mac);
+        brcmf_dbg(TRACE, "Enter %pM\n", params->mac);
 
         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
                 ifp = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
         if (!check_vif_up(ifp->vif))
                 return -EIO;
 
-        memcpy(&scbval.ea, mac, ETH_ALEN);
+        memcpy(&scbval.ea, params->mac, ETH_ALEN);
         scbval.val = cpu_to_le32(WLAN_REASON_DEAUTH_LEAVING);
         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON,
                                      &scbval, sizeof(scbval));
@@ -5440,10 +5487,13 @@ static void brcmf_wiphy_pno_params(struct wiphy *wiphy)
         wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
 }
 
-
 #ifdef CONFIG_PM
 static const struct wiphy_wowlan_support brcmf_wowlan_support = {
         .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
+        .n_patterns = BRCMF_WOWL_MAXPATTERNS,
+        .pattern_max_len = BRCMF_WOWL_MAXPATTERNSIZE,
+        .pattern_min_len = 1,
+        .max_pkt_offset = 1500,
 };
 #endif
 
@@ -5607,7 +5657,8 @@ enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp)
         return wdev->iftype;
 }
 
-bool brcmf_get_vif_state_any(struct brcmf_cfg80211_info *cfg, unsigned long state)
+bool brcmf_get_vif_state_any(struct brcmf_cfg80211_info *cfg,
+                             unsigned long state)
 {
         struct brcmf_cfg80211_vif *vif;
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.h
index 6abf94e41d3d..2a5b22cb3fef 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.h
@@ -14,8 +14,8 @@
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#ifndef _wl_cfg80211_h_
-#define _wl_cfg80211_h_
+#ifndef BRCMFMAC_CFG80211_H
+#define BRCMFMAC_CFG80211_H
 
 /* for brcmu_d11inf */
 #include <brcmu_d11.h>
@@ -480,7 +480,8 @@ const struct brcmf_tlv *
 brcmf_parse_tlvs(const void *buf, int buflen, uint key);
 u16 channel_to_chanspec(struct brcmu_d11inf *d11inf,
                         struct ieee80211_channel *ch);
-bool brcmf_get_vif_state_any(struct brcmf_cfg80211_info *cfg, unsigned long state);
+bool brcmf_get_vif_state_any(struct brcmf_cfg80211_info *cfg,
+                             unsigned long state);
 void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
                                   struct brcmf_cfg80211_vif *vif);
 bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg);
@@ -493,4 +494,4 @@ void brcmf_set_mpc(struct brcmf_if *ndev, int mpc);
 void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg);
 void brcmf_cfg80211_free_netdev(struct net_device *ndev);
 
-#endif                          /* _wl_cfg80211_h_ */
+#endif /* BRCMFMAC_CFG80211_H */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/chip.c b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
index 95efde868db8..ddae0b5e56ec 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/chip.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
@@ -25,7 +25,7 @@
 #include <brcm_hw_ids.h>
 #include <brcmu_utils.h>
 #include <chipcommon.h>
-#include "dhd_dbg.h"
+#include "debug.h"
 #include "chip.h"
 
 /* SOC Interconnect types (aka chip types) */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/common.c b/drivers/net/wireless/brcm80211/brcmfmac/common.c
new file mode 100644
index 000000000000..1861a13e8d03
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/brcmfmac/common.c
@@ -0,0 +1,168 @@
+/*
+ * Copyright (c) 2010 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/netdevice.h>
+#include <brcmu_wifi.h>
+#include <brcmu_utils.h>
+#include "core.h"
+#include "bus.h"
+#include "debug.h"
+#include "fwil.h"
+#include "fwil_types.h"
+#include "tracepoint.h"
+
+#define BRCMF_DEFAULT_BCN_TIMEOUT       3
+#define BRCMF_DEFAULT_SCAN_CHANNEL_TIME 40
+#define BRCMF_DEFAULT_SCAN_UNASSOC_TIME 40
+
+/* boost value for RSSI_DELTA in preferred join selection */
+#define BRCMF_JOIN_PREF_RSSI_BOOST      8
+
+int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
+{
+        s8 eventmask[BRCMF_EVENTING_MASK_LEN];
+        u8 buf[BRCMF_DCMD_SMLEN];
+        struct brcmf_join_pref_params join_pref_params[2];
+        char *ptr;
+        s32 err;
+
+        /* retreive mac address */
+        err = brcmf_fil_iovar_data_get(ifp, "cur_etheraddr", ifp->mac_addr,
+                                       sizeof(ifp->mac_addr));
+        if (err < 0) {
+                brcmf_err("Retreiving cur_etheraddr failed, %d\n",
+                          err);
+                goto done;
+        }
+        memcpy(ifp->drvr->mac, ifp->mac_addr, sizeof(ifp->drvr->mac));
+
+        /* query for 'ver' to get version info from firmware */
+        memset(buf, 0, sizeof(buf));
+        strcpy(buf, "ver");
+        err = brcmf_fil_iovar_data_get(ifp, "ver", buf, sizeof(buf));
+        if (err < 0) {
+                brcmf_err("Retreiving version information failed, %d\n",
+                          err);
+                goto done;
+        }
+        ptr = (char *)buf;
+        strsep(&ptr, "\n");
+
+        /* Print fw version info */
+        brcmf_err("Firmware version = %s\n", buf);
+
+        /* locate firmware version number for ethtool */
+        ptr = strrchr(buf, ' ') + 1;
+        strlcpy(ifp->drvr->fwver, ptr, sizeof(ifp->drvr->fwver));
+
+        /* set mpc */
+        err = brcmf_fil_iovar_int_set(ifp, "mpc", 1);
+        if (err) {
+                brcmf_err("failed setting mpc\n");
+                goto done;
+        }
+
+        /*
+         * Setup timeout if Beacons are lost and roam is off to report
+         * link down
+         */
+        err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout",
+                                      BRCMF_DEFAULT_BCN_TIMEOUT);
+        if (err) {
+                brcmf_err("bcn_timeout error (%d)\n", err);
+                goto done;
+        }
+
+        /* Enable/Disable build-in roaming to allowed ext supplicant to take
+         * of romaing
+         */
+        err = brcmf_fil_iovar_int_set(ifp, "roam_off", 1);
+        if (err) {
+                brcmf_err("roam_off error (%d)\n", err);
+                goto done;
+        }
+
+        /* Setup join_pref to select target by RSSI(with boost on 5GHz) */
+        join_pref_params[0].type = BRCMF_JOIN_PREF_RSSI_DELTA;
+        join_pref_params[0].len = 2;
+        join_pref_params[0].rssi_gain = BRCMF_JOIN_PREF_RSSI_BOOST;
+        join_pref_params[0].band = WLC_BAND_5G;
+        join_pref_params[1].type = BRCMF_JOIN_PREF_RSSI;
+        join_pref_params[1].len = 2;
+        join_pref_params[1].rssi_gain = 0;
+        join_pref_params[1].band = 0;
+        err = brcmf_fil_iovar_data_set(ifp, "join_pref", join_pref_params,
+                                       sizeof(join_pref_params));
+        if (err)
+                brcmf_err("Set join_pref error (%d)\n", err);
+
+        /* Setup event_msgs, enable E_IF */
+        err = brcmf_fil_iovar_data_get(ifp, "event_msgs", eventmask,
+                                       BRCMF_EVENTING_MASK_LEN);
+        if (err) {
+                brcmf_err("Get event_msgs error (%d)\n", err);
+                goto done;
+        }
+        setbit(eventmask, BRCMF_E_IF);
+        err = brcmf_fil_iovar_data_set(ifp, "event_msgs", eventmask,
+                                       BRCMF_EVENTING_MASK_LEN);
+        if (err) {
+                brcmf_err("Set event_msgs error (%d)\n", err);
+                goto done;
+        }
+
+        /* Setup default scan channel time */
+        err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
+                                    BRCMF_DEFAULT_SCAN_CHANNEL_TIME);
+        if (err) {
+                brcmf_err("BRCMF_C_SET_SCAN_CHANNEL_TIME error (%d)\n",
+                          err);
+                goto done;
+        }
+
+        /* Setup default scan unassoc time */
+        err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_UNASSOC_TIME,
+                                    BRCMF_DEFAULT_SCAN_UNASSOC_TIME);
+        if (err) {
+                brcmf_err("BRCMF_C_SET_SCAN_UNASSOC_TIME error (%d)\n",
+                          err);
+                goto done;
+        }
+
+        /* do bus specific preinit here */
+        err = brcmf_bus_preinit(ifp->drvr->bus_if);
+done:
+        return err;
+}
+
+#if defined(CONFIG_BRCM_TRACING) || defined(CONFIG_BRCMDBG)
+void __brcmf_dbg(u32 level, const char *func, const char *fmt, ...)
+{
+        struct va_format vaf = {
+                .fmt = fmt,
+        };
+        va_list args;
+
+        va_start(args, fmt);
+        vaf.va = &args;
+        if (brcmf_msg_level & level)
+                pr_debug("%s %pV", func, &vaf);
+        trace_brcmf_dbg(level, func, &vaf);
+        va_end(args);
+}
+#endif
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/commonring.c b/drivers/net/wireless/brcm80211/brcmfmac/commonring.c
index c6d65b8e1e15..77656c711bed 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/commonring.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/commonring.c
@@ -19,7 +19,7 @@
 #include <brcmu_utils.h>
 #include <brcmu_wifi.h>
 
-#include "dhd.h"
+#include "core.h"
 #include "commonring.h"
 
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/core.c
index fb1043908a23..f407665cb1ea 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
@@ -22,12 +22,12 @@
 #include <brcmu_utils.h>
 #include <brcmu_wifi.h>
 
-#include "dhd.h"
-#include "dhd_bus.h"
-#include "dhd_dbg.h"
+#include "core.h"
+#include "bus.h"
+#include "debug.h"
 #include "fwil_types.h"
 #include "p2p.h"
-#include "wl_cfg80211.h"
+#include "cfg80211.h"
 #include "fwil.h"
 #include "fwsignal.h"
 #include "feature.h"
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h b/drivers/net/wireless/brcm80211/brcmfmac/core.h
index 5e4317dbc2b0..98228e922d3a 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.h
@@ -18,8 +18,8 @@
  * Common types *
  */
 
-#ifndef _BRCMF_H_
-#define _BRCMF_H_
+#ifndef BRCMFMAC_CORE_H
+#define BRCMFMAC_CORE_H
 
 #include "fweh.h"
 
@@ -83,7 +83,6 @@ struct brcmf_pub {
         /* Internal brcmf items */
         uint hdrlen;            /* Total BRCMF header length (proto + bus) */
         uint rxsz;              /* Rx buffer size bus module should use */
-        u8 wme_dp;              /* wme discard priority */
 
         /* Dongle media info */
         char fwver[BRCMF_DRIVER_FIRMWARE_VERSION_LEN];
@@ -186,4 +185,4 @@ void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb);
 /* Sets dongle media info (drv_version, mac address). */
 int brcmf_c_preinit_dcmds(struct brcmf_if *ifp);
 
-#endif                          /* _BRCMF_H_ */
+#endif /* BRCMFMAC_CORE_H */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.c b/drivers/net/wireless/brcm80211/brcmfmac/debug.c
index be9f4f829192..9b473d50b005 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/debug.c
@@ -19,9 +19,9 @@
 
 #include <brcmu_wifi.h>
 #include <brcmu_utils.h>
-#include "dhd.h"
-#include "dhd_bus.h"
-#include "dhd_dbg.h"
+#include "core.h"
+#include "bus.h"
+#include "debug.h"
 
 static struct dentry *root_folder;
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h b/drivers/net/wireless/brcm80211/brcmfmac/debug.h
index dec40d316c82..eb0b8c47479d 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/debug.h
@@ -14,8 +14,8 @@
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#ifndef _BRCMF_DBG_H_
-#define _BRCMF_DBG_H_
+#ifndef BRCMFMAC_DEBUG_H
+#define BRCMFMAC_DEBUG_H
 
 /* message levels */
 #define BRCMF_TRACE_VAL         0x00000002
@@ -133,4 +133,4 @@ int brcmf_debugfs_add_entry(struct brcmf_pub *drvr, const char *fn,
 }
 #endif
 
-#endif                          /* _BRCMF_DBG_H_ */
+#endif /* BRCMFMAC_DEBUG_H */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
deleted file mode 100644
index d991f8e3d9ec..000000000000
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
+++ /dev/null
@@ -1,400 +0,0 @@
-/*
- * Copyright (c) 2010 Broadcom Corporation
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#include <linux/kernel.h>
-#include <linux/string.h>
-#include <linux/netdevice.h>
-#include <brcmu_wifi.h>
-#include <brcmu_utils.h>
-#include "dhd.h"
-#include "dhd_bus.h"
-#include "dhd_dbg.h"
-#include "fwil.h"
-#include "fwil_types.h"
-#include "tracepoint.h"
-
-#define PKTFILTER_BUF_SIZE              128
-#define BRCMF_DEFAULT_BCN_TIMEOUT       3
-#define BRCMF_DEFAULT_SCAN_CHANNEL_TIME 40
-#define BRCMF_DEFAULT_SCAN_UNASSOC_TIME 40
-#define BRCMF_DEFAULT_PACKET_FILTER     "100 0 0 0 0x01 0x00"
-
-/* boost value for RSSI_DELTA in preferred join selection */
-#define BRCMF_JOIN_PREF_RSSI_BOOST      8
-
-
-bool brcmf_c_prec_enq(struct device *dev, struct pktq *q,
-                      struct sk_buff *pkt, int prec)
-{
-        struct sk_buff *p;
-        int eprec = -1;         /* precedence to evict from */
-        bool discard_oldest;
-        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
-        struct brcmf_pub *drvr = bus_if->drvr;
-
-        /* Fast case, precedence queue is not full and we are also not
-         * exceeding total queue length
-         */
-        if (!pktq_pfull(q, prec) && !pktq_full(q)) {
-                brcmu_pktq_penq(q, prec, pkt);
-                return true;
-        }
-
-        /* Determine precedence from which to evict packet, if any */
-        if (pktq_pfull(q, prec))
-                eprec = prec;
-        else if (pktq_full(q)) {
-                p = brcmu_pktq_peek_tail(q, &eprec);
-                if (eprec > prec)
-                        return false;
-        }
-
-        /* Evict if needed */
-        if (eprec >= 0) {
-                /* Detect queueing to unconfigured precedence */
-                discard_oldest = ac_bitmap_tst(drvr->wme_dp, eprec);
-                if (eprec == prec && !discard_oldest)
-                        return false;   /* refuse newer (incoming) packet */
-                /* Evict packet according to discard policy */
-                p = discard_oldest ? brcmu_pktq_pdeq(q, eprec) :
-                        brcmu_pktq_pdeq_tail(q, eprec);
-                if (p == NULL)
-                        brcmf_err("brcmu_pktq_penq() failed, oldest %d\n",
-                                  discard_oldest);
-
-                brcmu_pkt_buf_free_skb(p);
-        }
-
-        /* Enqueue */
-        p = brcmu_pktq_penq(q, prec, pkt);
-        if (p == NULL)
-                brcmf_err("brcmu_pktq_penq() failed\n");
-
-        return p != NULL;
-}
-
-/* Convert user's input in hex pattern to byte-size mask */
-static int brcmf_c_pattern_atoh(char *src, char *dst)
-{
-        int i;
-        if (strncmp(src, "0x", 2) != 0 && strncmp(src, "0X", 2) != 0) {
-                brcmf_err("Mask invalid format. Needs to start with 0x\n");
-                return -EINVAL;
-        }
-        src = src + 2;          /* Skip past 0x */
-        if (strlen(src) % 2 != 0) {
-                brcmf_err("Mask invalid format. Length must be even.\n");
-                return -EINVAL;
-        }
-        for (i = 0; *src != '\0'; i++) {
-                unsigned long res;
-                char num[3];
-                strncpy(num, src, 2);
-                num[2] = '\0';
-                if (kstrtoul(num, 16, &res))
-                        return -EINVAL;
-                dst[i] = (u8)res;
-                src += 2;
-        }
-        return i;
-}
-
-static void
-brcmf_c_pktfilter_offload_enable(struct brcmf_if *ifp, char *arg, int enable,
-                                 int master_mode)
-{
-        unsigned long res;
-        char *argv;
-        char *arg_save = NULL, *arg_org = NULL;
-        s32 err;
-        struct brcmf_pkt_filter_enable_le enable_parm;
-
-        arg_save = kstrdup(arg, GFP_ATOMIC);
-        if (!arg_save)
-                goto fail;
-
-        arg_org = arg_save;
-
-        argv = strsep(&arg_save, " ");
-
-        if (argv == NULL) {
-                brcmf_err("No args provided\n");
-                goto fail;
-        }
-
-        /* Parse packet filter id. */
-        enable_parm.id = 0;
-        if (!kstrtoul(argv, 0, &res))
-                enable_parm.id = cpu_to_le32((u32)res);
-
-        /* Enable/disable the specified filter. */
-        enable_parm.enable = cpu_to_le32(enable);
-
-        err = brcmf_fil_iovar_data_set(ifp, "pkt_filter_enable", &enable_parm,
-                                       sizeof(enable_parm));
-        if (err)
-                brcmf_err("Set pkt_filter_enable error (%d)\n", err);
-
-        /* Control the master mode */
-        err = brcmf_fil_iovar_int_set(ifp, "pkt_filter_mode", master_mode);
-        if (err)
-                brcmf_err("Set pkt_filter_mode error (%d)\n", err);
-
-fail:
-        kfree(arg_org);
-}
-
-static void brcmf_c_pktfilter_offload_set(struct brcmf_if *ifp, char *arg)
-{
-        struct brcmf_pkt_filter_le *pkt_filter;
-        unsigned long res;
-        int buf_len;
-        s32 err;
-        u32 mask_size;
-        u32 pattern_size;
-        char *argv[8], *buf = NULL;
-        int i = 0;
-        char *arg_save = NULL, *arg_org = NULL;
-
-        arg_save = kstrdup(arg, GFP_ATOMIC);
-        if (!arg_save)
-                goto fail;
-
-        arg_org = arg_save;
-
-        buf = kmalloc(PKTFILTER_BUF_SIZE, GFP_ATOMIC);
-        if (!buf)
-                goto fail;
-
-        argv[i] = strsep(&arg_save, " ");
-        while (argv[i]) {
-                i++;
-                if (i >= 8) {
-                        brcmf_err("Too many parameters\n");
-                        goto fail;
-                }
-                argv[i] = strsep(&arg_save, " ");
-        }
-
-        if (i != 6) {
-                brcmf_err("Not enough args provided %d\n", i);
-                goto fail;
-        }
-
-        pkt_filter = (struct brcmf_pkt_filter_le *)buf;
-
-        /* Parse packet filter id. */
-        pkt_filter->id = 0;
-        if (!kstrtoul(argv[0], 0, &res))
-                pkt_filter->id = cpu_to_le32((u32)res);
-
-        /* Parse filter polarity. */
-        pkt_filter->negate_match = 0;
-        if (!kstrtoul(argv[1], 0, &res))
-                pkt_filter->negate_match = cpu_to_le32((u32)res);
-
-        /* Parse filter type. */
-        pkt_filter->type = 0;
-        if (!kstrtoul(argv[2], 0, &res))
-                pkt_filter->type = cpu_to_le32((u32)res);
-
-        /* Parse pattern filter offset. */
-        pkt_filter->u.pattern.offset = 0;
-        if (!kstrtoul(argv[3], 0, &res))
-                pkt_filter->u.pattern.offset = cpu_to_le32((u32)res);
-
-        /* Parse pattern filter mask. */
-        mask_size = brcmf_c_pattern_atoh(argv[4],
-                        (char *)pkt_filter->u.pattern.mask_and_pattern);
-
-        /* Parse pattern filter pattern. */
-        pattern_size = brcmf_c_pattern_atoh(argv[5],
-                (char *)&pkt_filter->u.pattern.mask_and_pattern[mask_size]);
-
-        if (mask_size != pattern_size) {
-                brcmf_err("Mask and pattern not the same size\n");
-                goto fail;
-        }
-
-        pkt_filter->u.pattern.size_bytes = cpu_to_le32(mask_size);
-        buf_len = offsetof(struct brcmf_pkt_filter_le,
-                           u.pattern.mask_and_pattern);
-        buf_len += mask_size + pattern_size;
-
-        err = brcmf_fil_iovar_data_set(ifp, "pkt_filter_add", pkt_filter,
-                                       buf_len);
-        if (err)
-                brcmf_err("Set pkt_filter_add error (%d)\n", err);
-
-fail:
-        kfree(arg_org);
-
-        kfree(buf);
-}
-
-int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
-{
-        s8 eventmask[BRCMF_EVENTING_MASK_LEN];
-        u8 buf[BRCMF_DCMD_SMLEN];
-        struct brcmf_join_pref_params join_pref_params[2];
-        char *ptr;
-        s32 err;
-
-        /* retreive mac address */
-        err = brcmf_fil_iovar_data_get(ifp, "cur_etheraddr", ifp->mac_addr,
-                                       sizeof(ifp->mac_addr));
-        if (err < 0) {
-                brcmf_err("Retreiving cur_etheraddr failed, %d\n",
-                          err);
-                goto done;
-        }
-        memcpy(ifp->drvr->mac, ifp->mac_addr, sizeof(ifp->drvr->mac));
-
-        /* query for 'ver' to get version info from firmware */
-        memset(buf, 0, sizeof(buf));
-        strcpy(buf, "ver");
-        err = brcmf_fil_iovar_data_get(ifp, "ver", buf, sizeof(buf));
-        if (err < 0) {
-                brcmf_err("Retreiving version information failed, %d\n",
-                          err);
-                goto done;
-        }
-        ptr = (char *)buf;
-        strsep(&ptr, "\n");
-
-        /* Print fw version info */
-        brcmf_err("Firmware version = %s\n", buf);
-
-        /* locate firmware version number for ethtool */
-        ptr = strrchr(buf, ' ') + 1;
-        strlcpy(ifp->drvr->fwver, ptr, sizeof(ifp->drvr->fwver));
-
-        /* set mpc */
-        err = brcmf_fil_iovar_int_set(ifp, "mpc", 1);
-        if (err) {
-                brcmf_err("failed setting mpc\n");
-                goto done;
-        }
-
-        /*
-         * Setup timeout if Beacons are lost and roam is off to report
-         * link down
-         */
-        err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout",
-                                      BRCMF_DEFAULT_BCN_TIMEOUT);
-        if (err) {
-                brcmf_err("bcn_timeout error (%d)\n", err);
-                goto done;
-        }
-
-        /* Enable/Disable build-in roaming to allowed ext supplicant to take
-         * of romaing
-         */
-        err = brcmf_fil_iovar_int_set(ifp, "roam_off", 1);
-        if (err) {
-                brcmf_err("roam_off error (%d)\n", err);
-                goto done;
-        }
-
-        /* Setup join_pref to select target by RSSI(with boost on 5GHz) */
-        join_pref_params[0].type = BRCMF_JOIN_PREF_RSSI_DELTA;
-        join_pref_params[0].len = 2;
-        join_pref_params[0].rssi_gain = BRCMF_JOIN_PREF_RSSI_BOOST;
-        join_pref_params[0].band = WLC_BAND_5G;
-        join_pref_params[1].type = BRCMF_JOIN_PREF_RSSI;
-        join_pref_params[1].len = 2;
-        join_pref_params[1].rssi_gain = 0;
-        join_pref_params[1].band = 0;
-        err = brcmf_fil_iovar_data_set(ifp, "join_pref", join_pref_params,
-                                       sizeof(join_pref_params));
-        if (err)
-                brcmf_err("Set join_pref error (%d)\n", err);
-
-        /* Setup event_msgs, enable E_IF */
-        err = brcmf_fil_iovar_data_get(ifp, "event_msgs", eventmask,
-                                       BRCMF_EVENTING_MASK_LEN);
-        if (err) {
-                brcmf_err("Get event_msgs error (%d)\n", err);
-                goto done;
-        }
-        setbit(eventmask, BRCMF_E_IF);
-        err = brcmf_fil_iovar_data_set(ifp, "event_msgs", eventmask,
-                                       BRCMF_EVENTING_MASK_LEN);
-        if (err) {
-                brcmf_err("Set event_msgs error (%d)\n", err);
-                goto done;
-        }
-
-        /* Setup default scan channel time */
-        err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
-                                    BRCMF_DEFAULT_SCAN_CHANNEL_TIME);
-        if (err) {
-                brcmf_err("BRCMF_C_SET_SCAN_CHANNEL_TIME error (%d)\n",
-                          err);
-                goto done;
-        }
-
-        /* Setup default scan unassoc time */
-        err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_UNASSOC_TIME,
-                                    BRCMF_DEFAULT_SCAN_UNASSOC_TIME);
-        if (err) {
-                brcmf_err("BRCMF_C_SET_SCAN_UNASSOC_TIME error (%d)\n",
-                          err);
-                goto done;
-        }
-
-        /* Setup packet filter */
-        brcmf_c_pktfilter_offload_set(ifp, BRCMF_DEFAULT_PACKET_FILTER);
-        brcmf_c_pktfilter_offload_enable(ifp, BRCMF_DEFAULT_PACKET_FILTER,
-                                         0, true);
-
-        /* do bus specific preinit here */
-        err = brcmf_bus_preinit(ifp->drvr->bus_if);
-done:
-        return err;
-}
-
-#ifdef CONFIG_BRCM_TRACING
-void __brcmf_err(const char *func, const char *fmt, ...)
-{
-        struct va_format vaf = {
-                .fmt = fmt,
-        };
-        va_list args;
-
-        va_start(args, fmt);
-        vaf.va = &args;
-        pr_err("%s: %pV", func, &vaf);
-        trace_brcmf_err(func, &vaf);
-        va_end(args);
-}
-#endif
-#if defined(CONFIG_BRCM_TRACING) || defined(CONFIG_BRCMDBG)
-void __brcmf_dbg(u32 level, const char *func, const char *fmt, ...)
-{
-        struct va_format vaf = {
-                .fmt = fmt,
-        };
-        va_list args;
-
-        va_start(args, fmt);
-        vaf.va = &args;
-        if (brcmf_msg_level & level)
-                pr_debug("%s %pV", func, &vaf);
-        trace_brcmf_dbg(level, func, &vaf);
-        va_end(args);
-}
-#endif
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/feature.c b/drivers/net/wireless/brcm80211/brcmfmac/feature.c
index aed53acef456..931f68aefaa4 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/feature.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/feature.c
@@ -17,18 +17,13 @@
 #include <linux/netdevice.h>
 
 #include <brcm_hw_ids.h>
-#include "dhd.h"
-#include "dhd_bus.h"
-#include "dhd_dbg.h"
+#include "core.h"
+#include "bus.h"
+#include "debug.h"
 #include "fwil.h"
 #include "feature.h"
 
 /*
- * firmware error code received if iovar is unsupported.
- */
-#define EBRCMF_FEAT_UNSUPPORTED         23
-
-/*
  * expand feature list to array of feature strings.
  */
 #define BRCMF_FEAT_DEF(_f) \
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/firmware.c b/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
index 8ea9f283d2b8..0f157f151282 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
@@ -20,7 +20,7 @@
 #include <linux/firmware.h>
 #include <linux/module.h>
 
-#include "dhd_dbg.h"
+#include "debug.h"
 #include "firmware.h"
 
 char brcmf_firmware_path[BRCMF_FW_PATH_LEN];
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/flowring.c b/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
index 1faa929f5fff..44f3a84d1999 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
@@ -19,9 +19,9 @@
 #include <linux/etherdevice.h>
 #include <brcmu_utils.h>
 
-#include "dhd.h"
-#include "dhd_dbg.h"
-#include "dhd_bus.h"
+#include "core.h"
+#include "debug.h"
+#include "bus.h"
 #include "proto.h"
 #include "flowring.h"
 #include "msgbuf.h"
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fweh.c b/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
index 44fc85f68f7a..7338b335e153 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
@@ -18,8 +18,8 @@
 #include "brcmu_wifi.h"
 #include "brcmu_utils.h"
 
-#include "dhd.h"
-#include "dhd_dbg.h"
+#include "core.h"
+#include "debug.h"
 #include "tracepoint.h"
 #include "fwsignal.h"
 #include "fweh.h"
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwil.c b/drivers/net/wireless/brcm80211/brcmfmac/fwil.c
index ded328f80cd1..51f88c11e642 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwil.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil.c
@@ -22,9 +22,9 @@
 #include <linux/netdevice.h>
 #include <brcmu_utils.h>
 #include <brcmu_wifi.h>
-#include "dhd.h"
-#include "dhd_bus.h"
-#include "dhd_dbg.h"
+#include "core.h"
+#include "bus.h"
+#include "debug.h"
 #include "tracepoint.h"
 #include "fwil.h"
 #include "proto.h"
@@ -32,6 +32,76 @@
 
 #define MAX_HEX_DUMP_LEN        64
 
+#ifdef DEBUG
+static const char * const brcmf_fil_errstr[] = {
+        "BCME_OK",
+        "BCME_ERROR",
+        "BCME_BADARG",
+        "BCME_BADOPTION",
+        "BCME_NOTUP",
+        "BCME_NOTDOWN",
+        "BCME_NOTAP",
+        "BCME_NOTSTA",
+        "BCME_BADKEYIDX",
+        "BCME_RADIOOFF",
+        "BCME_NOTBANDLOCKED",
+        "BCME_NOCLK",
+        "BCME_BADRATESET",
+        "BCME_BADBAND",
+        "BCME_BUFTOOSHORT",
+        "BCME_BUFTOOLONG",
+        "BCME_BUSY",
+        "BCME_NOTASSOCIATED",
+        "BCME_BADSSIDLEN",
+        "BCME_OUTOFRANGECHAN",
+        "BCME_BADCHAN",
+        "BCME_BADADDR",
+        "BCME_NORESOURCE",
+        "BCME_UNSUPPORTED",
+        "BCME_BADLEN",
+        "BCME_NOTREADY",
+        "BCME_EPERM",
+        "BCME_NOMEM",
+        "BCME_ASSOCIATED",
+        "BCME_RANGE",
+        "BCME_NOTFOUND",
+        "BCME_WME_NOT_ENABLED",
+        "BCME_TSPEC_NOTFOUND",
+        "BCME_ACM_NOTSUPPORTED",
+        "BCME_NOT_WME_ASSOCIATION",
+        "BCME_SDIO_ERROR",
+        "BCME_DONGLE_DOWN",
+        "BCME_VERSION",
+        "BCME_TXFAIL",
+        "BCME_RXFAIL",
+        "BCME_NODEVICE",
+        "BCME_NMODE_DISABLED",
+        "BCME_NONRESIDENT",
+        "BCME_SCANREJECT",
+        "BCME_USAGE_ERROR",
+        "BCME_IOCTL_ERROR",
+        "BCME_SERIAL_PORT_ERR",
+        "BCME_DISABLED",
+        "BCME_DECERR",
+        "BCME_ENCERR",
+        "BCME_MICERR",
+        "BCME_REPLAY",
+        "BCME_IE_NOTFOUND",
+};
+
+static const char *brcmf_fil_get_errstr(u32 err)
+{
+        if (err >= ARRAY_SIZE(brcmf_fil_errstr))
+                return "(unknown)";
+
+        return brcmf_fil_errstr[err];
+}
+#else
+static const char *brcmf_fil_get_errstr(u32 err)
+{
+        return "";
+}
+#endif /* DEBUG */
 
 static s32
 brcmf_fil_cmd_data(struct brcmf_if *ifp, u32 cmd, void *data, u32 len, bool set)
@@ -52,11 +122,11 @@ brcmf_fil_cmd_data(struct brcmf_if *ifp, u32 cmd, void *data, u32 len, bool set)
                 err = brcmf_proto_query_dcmd(drvr, ifp->ifidx, cmd, data, len);
 
         if (err >= 0)
-                err = 0;
-        else
-                brcmf_dbg(FIL, "Failed err=%d\n", err);
+                return 0;
 
-        return err;
+        brcmf_dbg(FIL, "Failed: %s (%d)\n",
+                  brcmf_fil_get_errstr((u32)(-err)), err);
+        return -EBADE;
 }
 
 s32
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
index 5ff5cd0bb032..ba64b292f7a5 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
@@ -55,59 +55,63 @@
 
 /* WOWL bits */
 /* Wakeup on Magic packet: */
-#define WL_WOWL_MAGIC                   (1 << 0)
+#define BRCMF_WOWL_MAGIC                (1 << 0)
 /* Wakeup on Netpattern */
-#define WL_WOWL_NET                     (1 << 1)
+#define BRCMF_WOWL_NET                  (1 << 1)
 /* Wakeup on loss-of-link due to Disassoc/Deauth: */
-#define WL_WOWL_DIS                     (1 << 2)
+#define BRCMF_WOWL_DIS                  (1 << 2)
 /* Wakeup on retrograde TSF: */
-#define WL_WOWL_RETR                    (1 << 3)
+#define BRCMF_WOWL_RETR                 (1 << 3)
 /* Wakeup on loss of beacon: */
-#define WL_WOWL_BCN                     (1 << 4)
+#define BRCMF_WOWL_BCN                  (1 << 4)
 /* Wakeup after test: */
-#define WL_WOWL_TST                     (1 << 5)
+#define BRCMF_WOWL_TST                  (1 << 5)
 /* Wakeup after PTK refresh: */
-#define WL_WOWL_M1                      (1 << 6)
+#define BRCMF_WOWL_M1                   (1 << 6)
 /* Wakeup after receipt of EAP-Identity Req: */
-#define WL_WOWL_EAPID                   (1 << 7)
+#define BRCMF_WOWL_EAPID                (1 << 7)
 /* Wakeind via PME(0) or GPIO(1): */
-#define WL_WOWL_PME_GPIO                (1 << 8)
+#define BRCMF_WOWL_PME_GPIO             (1 << 8)
 /* need tkip phase 1 key to be updated by the driver: */
-#define WL_WOWL_NEEDTKIP1               (1 << 9)
+#define BRCMF_WOWL_NEEDTKIP1            (1 << 9)
 /* enable wakeup if GTK fails: */
-#define WL_WOWL_GTK_FAILURE             (1 << 10)
+#define BRCMF_WOWL_GTK_FAILURE          (1 << 10)
 /* support extended magic packets: */
-#define WL_WOWL_EXTMAGPAT               (1 << 11)
+#define BRCMF_WOWL_EXTMAGPAT            (1 << 11)
 /* support ARP/NS/keepalive offloading: */
-#define WL_WOWL_ARPOFFLOAD              (1 << 12)
+#define BRCMF_WOWL_ARPOFFLOAD           (1 << 12)
 /* read protocol version for EAPOL frames: */
-#define WL_WOWL_WPA2                    (1 << 13)
+#define BRCMF_WOWL_WPA2                 (1 << 13)
 /* If the bit is set, use key rotaton: */
-#define WL_WOWL_KEYROT                  (1 << 14)
+#define BRCMF_WOWL_KEYROT               (1 << 14)
 /* If the bit is set, frm received was bcast frame: */
-#define WL_WOWL_BCAST                   (1 << 15)
+#define BRCMF_WOWL_BCAST                (1 << 15)
 /* If the bit is set, scan offload is enabled: */
-#define WL_WOWL_SCANOL                  (1 << 16)
+#define BRCMF_WOWL_SCANOL               (1 << 16)
 /* Wakeup on tcpkeep alive timeout: */
-#define WL_WOWL_TCPKEEP_TIME            (1 << 17)
+#define BRCMF_WOWL_TCPKEEP_TIME         (1 << 17)
 /* Wakeup on mDNS Conflict Resolution: */
-#define WL_WOWL_MDNS_CONFLICT           (1 << 18)
+#define BRCMF_WOWL_MDNS_CONFLICT        (1 << 18)
 /* Wakeup on mDNS Service Connect: */
-#define WL_WOWL_MDNS_SERVICE            (1 << 19)
+#define BRCMF_WOWL_MDNS_SERVICE         (1 << 19)
 /* tcp keepalive got data: */
-#define WL_WOWL_TCPKEEP_DATA            (1 << 20)
+#define BRCMF_WOWL_TCPKEEP_DATA         (1 << 20)
 /* Firmware died in wowl mode: */
-#define WL_WOWL_FW_HALT                 (1 << 21)
+#define BRCMF_WOWL_FW_HALT              (1 << 21)
 /* Enable detection of radio button changes: */
-#define WL_WOWL_ENAB_HWRADIO            (1 << 22)
+#define BRCMF_WOWL_ENAB_HWRADIO         (1 << 22)
 /* Offloads detected MIC failure(s): */
-#define WL_WOWL_MIC_FAIL                (1 << 23)
+#define BRCMF_WOWL_MIC_FAIL             (1 << 23)
 /* Wakeup in Unassociated state (Net/Magic Pattern): */
-#define WL_WOWL_UNASSOC                 (1 << 24)
+#define BRCMF_WOWL_UNASSOC              (1 << 24)
 /* Wakeup if received matched secured pattern: */
-#define WL_WOWL_SECURE                  (1 << 25)
+#define BRCMF_WOWL_SECURE               (1 << 25)
 /* Link Down indication in WoWL mode: */
-#define WL_WOWL_LINKDOWN                (1 << 31)
+#define BRCMF_WOWL_LINKDOWN             (1 << 31)
+
+#define BRCMF_WOWL_MAXPATTERNS          8
+#define BRCMF_WOWL_MAXPATTERNSIZE       128
+
 
 /* join preference types for join_pref iovar */
 enum brcmf_join_pref_types {
@@ -124,6 +128,12 @@ enum brcmf_fil_p2p_if_types {
         BRCMF_FIL_P2P_IF_DEV,
 };
 
+enum brcmf_wowl_pattern_type {
+        BRCMF_WOWL_PATTERN_TYPE_BITMAP = 0,
+        BRCMF_WOWL_PATTERN_TYPE_ARP,
+        BRCMF_WOWL_PATTERN_TYPE_NA
+};
+
 struct brcmf_fil_p2p_if_le {
         u8 addr[ETH_ALEN];
         __le16 type;
@@ -484,4 +494,29 @@ struct brcmf_rx_mgmt_data {
         __be32  rate;
 };
 
+/**
+ * struct brcmf_fil_wowl_pattern_le - wowl pattern configuration struct.
+ *
+ * @cmd: "add", "del" or "clr".
+ * @masksize: Size of the mask in #of bytes
+ * @offset: Pattern byte offset in packet
+ * @patternoffset: Offset of start of pattern. Starting from field masksize.
+ * @patternsize: Size of the pattern itself in #of bytes
+ * @id: id
+ * @reasonsize: Size of the wakeup reason code
+ * @type: Type of pattern (enum brcmf_wowl_pattern_type)
+ */
+struct brcmf_fil_wowl_pattern_le {
+        u8      cmd[4];
+        __le32  masksize;
+        __le32  offset;
+        __le32  patternoffset;
+        __le32  patternsize;
+        __le32  id;
+        __le32  reasonsize;
+        __le32  type;
+        /* u8 mask[] - Mask follows the structure above */
+        /* u8 pattern[] - Pattern follows the mask is at 'patternoffset' */
+};
+
 #endif /* FWIL_TYPES_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
index 183f08d7fc8c..f0dda0ecd23b 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
@@ -26,15 +26,15 @@
 
 #include <brcmu_utils.h>
 #include <brcmu_wifi.h>
-#include "dhd.h"
-#include "dhd_dbg.h"
-#include "dhd_bus.h"
+#include "core.h"
+#include "debug.h"
+#include "bus.h"
 #include "fwil.h"
 #include "fwil_types.h"
 #include "fweh.h"
 #include "fwsignal.h"
 #include "p2p.h"
-#include "wl_cfg80211.h"
+#include "cfg80211.h"
 #include "proto.h"
 
 /**
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
index 11cc051f97cd..02d39ce8dbca 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
@@ -24,13 +24,13 @@
 #include <brcmu_utils.h>
 #include <brcmu_wifi.h>
 
-#include "dhd.h"
-#include "dhd_dbg.h"
+#include "core.h"
+#include "debug.h"
 #include "proto.h"
 #include "msgbuf.h"
 #include "commonring.h"
 #include "flowring.h"
-#include "dhd_bus.h"
+#include "bus.h"
 #include "tracepoint.h"
 
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/of.c b/drivers/net/wireless/brcm80211/brcmfmac/of.c
index f05f5270fec1..eb3fce82a223 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/of.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/of.c
@@ -21,8 +21,8 @@
 #include <linux/mmc/sdio_func.h>
 
 #include <defs.h>
-#include "dhd_dbg.h"
-#include "sdio_host.h"
+#include "debug.h"
+#include "sdio.h"
 
 void brcmf_of_probe(struct brcmf_sdio_dev *sdiodev)
 {
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
index d54c58a32faa..effb48ebd864 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
@@ -21,12 +21,12 @@
 #include <brcmu_wifi.h>
 #include <brcmu_utils.h>
 #include <defs.h>
-#include <dhd.h>
-#include <dhd_dbg.h>
+#include "core.h"
+#include "debug.h"
 #include "fwil.h"
 #include "fwil_types.h"
 #include "p2p.h"
-#include "wl_cfg80211.h"
+#include "cfg80211.h"
 
 /* parameters used for p2p escan */
 #define P2PAPI_SCAN_NPROBES 1
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
index 8c0632ec9f7a..b0ae7993e2e8 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
@@ -30,8 +30,8 @@
 #include <brcmu_wifi.h>
 #include <brcm_hw_ids.h>
 
-#include "dhd_dbg.h"
-#include "dhd_bus.h"
+#include "debug.h"
+#include "bus.h"
 #include "commonring.h"
 #include "msgbuf.h"
 #include "pcie.h"
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/proto.c b/drivers/net/wireless/brcm80211/brcmfmac/proto.c
index 62b940723339..26b68c367f57 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/proto.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/proto.c
@@ -20,9 +20,9 @@
 #include <linux/netdevice.h>
 
 #include <brcmu_wifi.h>
-#include "dhd.h"
-#include "dhd_bus.h"
-#include "dhd_dbg.h"
+#include "core.h"
+#include "bus.h"
+#include "debug.h"
 #include "proto.h"
 #include "bcdc.h"
 #include "msgbuf.h"
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
index d20d4e6f391a..0b0d51a61060 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
@@ -40,7 +40,7 @@
 #include <brcmu_utils.h>
 #include <brcm_hw_ids.h>
 #include <soc.h>
-#include "sdio_host.h"
+#include "sdio.h"
 #include "chip.h"
 #include "firmware.h"
 
@@ -96,8 +96,8 @@ struct rte_console {
 #endif                          /* DEBUG */
 #include <chipcommon.h>
 
-#include "dhd_bus.h"
-#include "dhd_dbg.h"
+#include "bus.h"
+#include "debug.h"
 #include "tracepoint.h"
 
 #define TXQLEN          2048    /* bulk tx queue length */
@@ -2762,6 +2762,48 @@ static struct pktq *brcmf_sdio_bus_gettxq(struct device *dev)
         return &bus->txq;
 }
 
+static bool brcmf_sdio_prec_enq(struct pktq *q, struct sk_buff *pkt, int prec)
+{
+        struct sk_buff *p;
+        int eprec = -1;         /* precedence to evict from */
+
+        /* Fast case, precedence queue is not full and we are also not
+         * exceeding total queue length
+         */
+        if (!pktq_pfull(q, prec) && !pktq_full(q)) {
+                brcmu_pktq_penq(q, prec, pkt);
+                return true;
+        }
+
+        /* Determine precedence from which to evict packet, if any */
+        if (pktq_pfull(q, prec)) {
+                eprec = prec;
+        } else if (pktq_full(q)) {
+                p = brcmu_pktq_peek_tail(q, &eprec);
+                if (eprec > prec)
+                        return false;
+        }
+
+        /* Evict if needed */
+        if (eprec >= 0) {
+                /* Detect queueing to unconfigured precedence */
+                if (eprec == prec)
+                        return false;   /* refuse newer (incoming) packet */
+                /* Evict packet according to discard policy */
+                p = brcmu_pktq_pdeq_tail(q, eprec);
+                if (p == NULL)
+                        brcmf_err("brcmu_pktq_pdeq_tail() failed\n");
+                brcmu_pkt_buf_free_skb(p);
+        }
+
+        /* Enqueue */
+        p = brcmu_pktq_penq(q, prec, pkt);
+        if (p == NULL)
+                brcmf_err("brcmu_pktq_penq() failed\n");
+
+        return p != NULL;
+}
+
 static int brcmf_sdio_bus_txdata(struct device *dev, struct sk_buff *pkt)
 {
         int ret = -EBADE;
@@ -2787,7 +2829,7 @@ static int brcmf_sdio_bus_txdata(struct device *dev, struct sk_buff *pkt)
         spin_lock_bh(&bus->txq_lock);
         /* reset bus_flags in packet cb */
         *(u16 *)(pkt->cb) = 0;
-        if (!brcmf_c_prec_enq(bus->sdiodev->dev, &bus->txq, pkt, prec)) {
+        if (!brcmf_sdio_prec_enq(&bus->txq, pkt, prec)) {
                 skb_pull(pkt, bus->tx_hdrlen);
                 brcmf_err("out of bus->txq !!!\n");
                 ret = -ENOSR;
@@ -2797,7 +2839,7 @@ static int brcmf_sdio_bus_txdata(struct device *dev, struct sk_buff *pkt)
 
         if (pktq_len(&bus->txq) >= TXHI) {
                 bus->txoff = true;
-                brcmf_txflowblock(bus->sdiodev->dev, true);
+                brcmf_txflowblock(dev, true);
         }
         spin_unlock_bh(&bus->txq_lock);
 
@@ -3948,6 +3990,7 @@ static struct brcmf_bus_ops brcmf_sdio_bus_ops = {
         .txctl = brcmf_sdio_bus_txctl,
         .rxctl = brcmf_sdio_bus_rxctl,
         .gettxq = brcmf_sdio_bus_gettxq,
+        .wowl_config = brcmf_sdio_wowl_config
 };
 
 static void brcmf_sdio_firmware_callback(struct device *dev,
@@ -4074,7 +4117,7 @@ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
 
         /* platform specific configuration:
          *   alignments must be at least 4 bytes for ADMA
-         */
+         */
         bus->head_align = ALIGNMENT;
         bus->sgentry_align = ALIGNMENT;
         if (sdiodev->pdata) {
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h b/drivers/net/wireless/brcm80211/brcmfmac/sdio.h
index f2d06cae366a..8eb42620129c 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.h
@@ -14,8 +14,8 @@
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#ifndef _BRCM_SDH_H_
-#define _BRCM_SDH_H_
+#ifndef BRCMFMAC_SDIO_H
+#define BRCMFMAC_SDIO_H
 
 #include <linux/skbuff.h>
 #include <linux/firmware.h>
@@ -186,6 +186,7 @@ struct brcmf_sdio_dev {
         struct sg_table sgtable;
         char fw_name[BRCMF_FW_PATH_LEN + BRCMF_FW_NAME_LEN];
         char nvram_name[BRCMF_FW_PATH_LEN + BRCMF_FW_NAME_LEN];
+        bool wowl_enabled;
 };
 
 /* sdio core registers */
@@ -334,5 +335,6 @@ void brcmf_sdio_remove(struct brcmf_sdio *bus);
 void brcmf_sdio_isr(struct brcmf_sdio *bus);
 
 void brcmf_sdio_wd_timer(struct brcmf_sdio *bus, uint wdtick);
+void brcmf_sdio_wowl_config(struct device *dev, bool enabled);
 
-#endif                          /* _BRCM_SDH_H_ */
+#endif /* BRCMFMAC_SDIO_H */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/tracepoint.c b/drivers/net/wireless/brcm80211/brcmfmac/tracepoint.c
index b505db48c60d..a10f35c5eb3d 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/tracepoint.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/tracepoint.c
@@ -19,4 +19,19 @@
 #ifndef __CHECKER__
 #define CREATE_TRACE_POINTS
 #include "tracepoint.h"
+
+void __brcmf_err(const char *func, const char *fmt, ...)
+{
+        struct va_format vaf = {
+                .fmt = fmt,
+        };
+        va_list args;
+
+        va_start(args, fmt);
+        vaf.va = &args;
+        pr_err("%s: %pV", func, &vaf);
+        trace_brcmf_err(func, &vaf);
+        va_end(args);
+}
+
 #endif
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index dc135915470d..5265aa70b094 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -23,13 +23,12 @@
 #include <brcmu_utils.h>
 #include <brcm_hw_ids.h>
 #include <brcmu_wifi.h>
-#include <dhd_bus.h>
-#include <dhd_dbg.h>
-
+#include "bus.h"
+#include "debug.h"
 #include "firmware.h"
-#include "usb_rdl.h"
 #include "usb.h"
 
+
 #define IOCTL_RESP_TIMEOUT              2000
 
 #define BRCMF_USB_RESET_GETVER_SPINWAIT 100     /* in unit of ms */
@@ -49,6 +48,71 @@
 #define BRCMF_USB_43242_FW_NAME         "brcm/brcmfmac43242a.bin"
 #define BRCMF_USB_43569_FW_NAME         "brcm/brcmfmac43569.bin"
 
+#define TRX_MAGIC               0x30524448      /* "HDR0" */
+#define TRX_MAX_OFFSET          3               /* Max number of file offsets */
+#define TRX_UNCOMP_IMAGE        0x20            /* Trx holds uncompressed img */
+#define TRX_RDL_CHUNK           1500            /* size of each dl transfer */
+#define TRX_OFFSETS_DLFWLEN_IDX 0
+
+/* Control messages: bRequest values */
+#define DL_GETSTATE     0       /* returns the rdl_state_t struct */
+#define DL_CHECK_CRC    1       /* currently unused */
+#define DL_GO           2       /* execute downloaded image */
+#define DL_START        3       /* initialize dl state */
+#define DL_REBOOT       4       /* reboot the device in 2 seconds */
+#define DL_GETVER       5       /* returns the bootrom_id_t struct */
+#define DL_GO_PROTECTED 6       /* execute the downloaded code and set reset
+                                 * event to occur in 2 seconds.  It is the
+                                 * responsibility of the downloaded code to
+                                 * clear this event
+                                 */
+#define DL_EXEC         7       /* jump to a supplied address */
+#define DL_RESETCFG     8       /* To support single enum on dongle
+                                 * - Not used by bootloader
+                                 */
+#define DL_DEFER_RESP_OK 9      /* Potentially defer the response to setup
+                                 * if resp unavailable
+                                 */
+
+/* states */
+#define DL_WAITING      0       /* waiting to rx first pkt */
+#define DL_READY        1       /* hdr was good, waiting for more of the
+                                 * compressed image
+                                 */
+#define DL_BAD_HDR      2       /* hdr was corrupted */
+#define DL_BAD_CRC      3       /* compressed image was corrupted */
+#define DL_RUNNABLE     4       /* download was successful,waiting for go cmd */
+#define DL_START_FAIL   5       /* failed to initialize correctly */
+#define DL_NVRAM_TOOBIG 6       /* host specified nvram data exceeds DL_NVRAM
+                                 * value
+                                 */
+#define DL_IMAGE_TOOBIG 7       /* firmware image too big */
+
+
+struct trx_header_le {
+        __le32 magic;           /* "HDR0" */
+        __le32 len;             /* Length of file including header */
+        __le32 crc32;           /* CRC from flag_version to end of file */
+        __le32 flag_version;    /* 0:15 flags, 16:31 version */
+        __le32 offsets[TRX_MAX_OFFSET]; /* Offsets of partitions from start of
+                                         * header
+                                         */
+};
+
+struct rdl_state_le {
+        __le32 state;
+        __le32 bytes;
+};
+
+struct bootrom_id_le {
+        __le32 chip;            /* Chip id */
+        __le32 chiprev;         /* Chip rev */
+        __le32 ramsize;         /* Size of  RAM */
+        __le32 remapbase;       /* Current remap base address */
+        __le32 boardtype;       /* Type of board */
+        __le32 boardrev;        /* Board revision */
+};
+
 struct brcmf_usb_image {
         struct list_head list;
         s8 *fwname;
@@ -93,6 +157,8 @@ struct brcmf_usbdev_info {
         u8 ifnum;
 
         struct urb *bulk_urb; /* used for FW download */
+
+        bool wowl_enabled;
 };
 
 static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
@@ -600,6 +666,16 @@ static int brcmf_usb_up(struct device *dev)
         return 0;
 }
 
+static void brcmf_cancel_all_urbs(struct brcmf_usbdev_info *devinfo)
+{
+        if (devinfo->ctl_urb)
+                usb_kill_urb(devinfo->ctl_urb);
+        if (devinfo->bulk_urb)
+                usb_kill_urb(devinfo->bulk_urb);
+        brcmf_usb_free_q(&devinfo->tx_postq, true);
+        brcmf_usb_free_q(&devinfo->rx_postq, true);
+}
+
 static void brcmf_usb_down(struct device *dev)
 {
         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
@@ -613,14 +689,7 @@ static void brcmf_usb_down(struct device *dev)
 
         brcmf_usb_state_change(devinfo, BRCMFMAC_USB_STATE_DOWN);
 
-        if (devinfo->ctl_urb)
-                usb_kill_urb(devinfo->ctl_urb);
-
-        if (devinfo->bulk_urb)
-                usb_kill_urb(devinfo->bulk_urb);
-        brcmf_usb_free_q(&devinfo->tx_postq, true);
-
-        brcmf_usb_free_q(&devinfo->rx_postq, true);
+        brcmf_cancel_all_urbs(devinfo);
 }
 
 static void
@@ -783,7 +852,7 @@ brcmf_usb_dl_writeimage(struct brcmf_usbdev_info *devinfo, u8 *fw, int fwlen)
 
         brcmf_dbg(USB, "Enter, fw %p, len %d\n", fw, fwlen);
 
-        bulkchunk = kmalloc(RDL_CHUNK, GFP_ATOMIC);
+        bulkchunk = kmalloc(TRX_RDL_CHUNK, GFP_ATOMIC);
         if (bulkchunk == NULL) {
                 err = -ENOMEM;
                 goto fail;
@@ -810,10 +879,10 @@ brcmf_usb_dl_writeimage(struct brcmf_usbdev_info *devinfo, u8 *fw, int fwlen)
                 /* Wait until the usb device reports it received all
                  * the bytes we sent */
                 if ((rdlbytes == sent) && (rdlbytes != dllen)) {
-                        if ((dllen-sent) < RDL_CHUNK)
+                        if ((dllen-sent) < TRX_RDL_CHUNK)
                                 sendlen = dllen-sent;
                         else
-                                sendlen = RDL_CHUNK;
+                                sendlen = TRX_RDL_CHUNK;
 
                         /* simply avoid having to send a ZLP by ensuring we
                          * never have an even
@@ -978,21 +1047,6 @@ static void brcmf_usb_detach(struct brcmf_usbdev_info *devinfo)
         kfree(devinfo->rx_reqs);
 }
 
-#define TRX_MAGIC       0x30524448      /* "HDR0" */
-#define TRX_VERSION     1               /* Version 1 */
-#define TRX_MAX_LEN     0x3B0000        /* Max length */
-#define TRX_NO_HEADER   1               /* Do not write TRX header */
-#define TRX_MAX_OFFSET  3               /* Max number of individual files */
-#define TRX_UNCOMP_IMAGE        0x20    /* Trx contains uncompressed image */
-
-struct trx_header_le {
-        __le32 magic;           /* "HDR0" */
-        __le32 len;             /* Length of file including header */
-        __le32 crc32;           /* CRC from flag_version to end of file */
-        __le32 flag_version;    /* 0:15 flags, 16:31 version */
-        __le32 offsets[TRX_MAX_OFFSET]; /* Offsets of partitions from start of
-                                         * header */
-};
 
 static int check_file(const u8 *headers)
 {
@@ -1094,11 +1148,24 @@ error:
         return NULL;
 }
 
+static void brcmf_usb_wowl_config(struct device *dev, bool enabled)
+{
+        struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
+
+        brcmf_dbg(USB, "Configuring WOWL, enabled=%d\n", enabled);
+        devinfo->wowl_enabled = enabled;
+        if (enabled)
+                device_set_wakeup_enable(devinfo->dev, true);
+        else
+                device_set_wakeup_enable(devinfo->dev, false);
+}
+
 static struct brcmf_bus_ops brcmf_usb_bus_ops = {
         .txdata = brcmf_usb_tx,
         .stop = brcmf_usb_down,
         .txctl = brcmf_usb_tx_ctlpkt,
         .rxctl = brcmf_usb_rx_ctlpkt,
+        .wowl_config = brcmf_usb_wowl_config,
 };
 
 static int brcmf_usb_bus_setup(struct brcmf_usbdev_info *devinfo)
@@ -1186,6 +1253,9 @@ static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo)
         bus->ops = &brcmf_usb_bus_ops;
         bus->proto_type = BRCMF_PROTO_BCDC;
         bus->always_use_fws_queue = true;
+#ifdef CONFIG_PM
+        bus->wowl_supported = true;
+#endif
 
         if (!brcmf_usb_dlneeded(devinfo)) {
                 ret = brcmf_usb_bus_setup(devinfo);
@@ -1339,7 +1409,10 @@ static int brcmf_usb_suspend(struct usb_interface *intf, pm_message_t state)
 
         brcmf_dbg(USB, "Enter\n");
         devinfo->bus_pub.state = BRCMFMAC_USB_STATE_SLEEP;
-        brcmf_detach(&usb->dev);
+        if (devinfo->wowl_enabled)
+                brcmf_cancel_all_urbs(devinfo);
+        else
+                brcmf_detach(&usb->dev);
         return 0;
 }
 
@@ -1352,7 +1425,12 @@ static int brcmf_usb_resume(struct usb_interface *intf)
         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
 
         brcmf_dbg(USB, "Enter\n");
-        return brcmf_usb_bus_setup(devinfo);
+        if (!devinfo->wowl_enabled)
+                return brcmf_usb_bus_setup(devinfo);
+
+        devinfo->bus_pub.state = BRCMFMAC_USB_STATE_UP;
+        brcmf_usb_rx_fill_all(devinfo);
+        return 0;
 }
 
 static int brcmf_usb_reset_resume(struct usb_interface *intf)
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb_rdl.h b/drivers/net/wireless/brcm80211/brcmfmac/usb_rdl.h
deleted file mode 100644
index 0a35c51c3da2..000000000000
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb_rdl.h
+++ /dev/null
@@ -1,75 +0,0 @@
-/*
- * Copyright (c) 2011 Broadcom Corporation
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#ifndef _USB_RDL_H
-#define _USB_RDL_H
-
-/* Control messages: bRequest values */
-#define DL_GETSTATE     0       /* returns the rdl_state_t struct */
-#define DL_CHECK_CRC    1       /* currently unused */
-#define DL_GO           2       /* execute downloaded image */
-#define DL_START        3       /* initialize dl state */
-#define DL_REBOOT       4       /* reboot the device in 2 seconds */
-#define DL_GETVER       5       /* returns the bootrom_id_t struct */
-#define DL_GO_PROTECTED 6       /* execute the downloaded code and set reset
-                                 * event to occur in 2 seconds.  It is the
-                                 * responsibility of the downloaded code to
-                                 * clear this event
-                                 */
-#define DL_EXEC         7       /* jump to a supplied address */
-#define DL_RESETCFG     8       /* To support single enum on dongle
-                                 * - Not used by bootloader
-                                 */
-#define DL_DEFER_RESP_OK 9      /* Potentially defer the response to setup
-                                 * if resp unavailable
-                                 */
-
-/* states */
-#define DL_WAITING      0       /* waiting to rx first pkt */
-#define DL_READY        1       /* hdr was good, waiting for more of the
-                                 * compressed image */
-#define DL_BAD_HDR      2       /* hdr was corrupted */
-#define DL_BAD_CRC      3       /* compressed image was corrupted */
-#define DL_RUNNABLE     4       /* download was successful,waiting for go cmd */
-#define DL_START_FAIL   5       /* failed to initialize correctly */
-#define DL_NVRAM_TOOBIG 6       /* host specified nvram data exceeds DL_NVRAM
-                                 * value */
-#define DL_IMAGE_TOOBIG 7       /* download image too big (exceeds DATA_START
-                                 *  for rdl) */
-
-struct rdl_state_le {
-        __le32 state;
-        __le32 bytes;
-};
-
-struct bootrom_id_le {
-        __le32 chip;    /* Chip id */
-        __le32 chiprev; /* Chip rev */
-        __le32 ramsize; /* Size of  RAM */
-        __le32 remapbase;       /* Current remap base address */
-        __le32 boardtype;       /* Type of board */
-        __le32 boardrev;        /* Board revision */
-};
-
-#define RDL_CHUNK       1500  /* size of each dl transfer */
-
-#define TRX_OFFSETS_DLFWLEN_IDX 0
-#define TRX_OFFSETS_JUMPTO_IDX  1
-#define TRX_OFFSETS_NVM_LEN_IDX 2
-
-#define TRX_OFFSETS_DLBASE_IDX  0
-
-#endif  /* _USB_RDL_H */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
index 5960d827508c..222f26a39642 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
@@ -20,10 +20,10 @@
 
 #include <brcmu_wifi.h>
 #include "fwil_types.h"
-#include "dhd.h"
+#include "core.h"
 #include "p2p.h"
-#include "dhd_dbg.h"
-#include "wl_cfg80211.h"
+#include "debug.h"
+#include "cfg80211.h"
 #include "vendor.h"
 #include "fwil.h"
 
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/debug.c b/drivers/net/wireless/brcm80211/brcmsmac/debug.c
index a5d4add26f41..19740c1b1566 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/debug.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/debug.c
@@ -71,48 +71,148 @@ struct dentry *brcms_debugfs_get_devdir(struct brcms_pub *drvr)
 }
 
 static
-ssize_t brcms_debugfs_hardware_read(struct file *f, char __user *data,
-                                        size_t count, loff_t *ppos)
+int brcms_debugfs_hardware_read(struct seq_file *s, void *data)
 {
-        char buf[128];
-        int res;
-        struct brcms_pub *drvr = f->private_data;
-
-        /* only allow read from start */
-        if (*ppos > 0)
-                return 0;
-
-        res = scnprintf(buf, sizeof(buf),
-                "board vendor: %x\n"
-                "board type: %x\n"
-                "board revision: %x\n"
-                "board flags: %x\n"
-                "board flags2: %x\n"
-                "firmware revision: %x\n",
-                drvr->wlc->hw->d11core->bus->boardinfo.vendor,
-                drvr->wlc->hw->d11core->bus->boardinfo.type,
-                drvr->wlc->hw->boardrev,
-                drvr->wlc->hw->boardflags,
-                drvr->wlc->hw->boardflags2,
-                drvr->wlc->ucode_rev
-                );
-
-        return simple_read_from_buffer(data, count, ppos, buf, res);
+        struct brcms_pub *drvr = s->private;
+
+        seq_printf(s, "board vendor: %x\n"
+                   "board type: %x\n"
+                   "board revision: %x\n"
+                   "board flags: %x\n"
+                   "board flags2: %x\n"
+                   "firmware revision: %x\n",
+                   drvr->wlc->hw->d11core->bus->boardinfo.vendor,
+                   drvr->wlc->hw->d11core->bus->boardinfo.type,
+                   drvr->wlc->hw->boardrev,
+                   drvr->wlc->hw->boardflags,
+                   drvr->wlc->hw->boardflags2,
+                   drvr->wlc->ucode_rev);
+
+        return 0;
+}
+
+static int brcms_debugfs_macstat_read(struct seq_file *s, void *data)
+{
+        struct brcms_pub *drvr = s->private;
+        struct brcms_info *wl = drvr->ieee_hw->priv;
+        struct macstat stats;
+        int i;
+
+        spin_lock_bh(&wl->lock);
+        stats = *(drvr->wlc->core->macstat_snapshot);
+        spin_unlock_bh(&wl->lock);
+
+        seq_printf(s, "txallfrm: %d\n", stats.txallfrm);
+        seq_printf(s, "txrtsfrm: %d\n", stats.txrtsfrm);
+        seq_printf(s, "txctsfrm: %d\n", stats.txctsfrm);
+        seq_printf(s, "txackfrm: %d\n", stats.txackfrm);
+        seq_printf(s, "txdnlfrm: %d\n", stats.txdnlfrm);
+        seq_printf(s, "txbcnfrm: %d\n", stats.txbcnfrm);
+        seq_printf(s, "txfunfl[8]:");
+        for (i = 0; i < ARRAY_SIZE(stats.txfunfl); i++)
+                seq_printf(s, " %d", stats.txfunfl[i]);
+        seq_printf(s, "\ntxtplunfl: %d\n", stats.txtplunfl);
+        seq_printf(s, "txphyerr: %d\n", stats.txphyerr);
+        seq_printf(s, "pktengrxducast: %d\n", stats.pktengrxducast);
+        seq_printf(s, "pktengrxdmcast: %d\n", stats.pktengrxdmcast);
+        seq_printf(s, "rxfrmtoolong: %d\n", stats.rxfrmtoolong);
+        seq_printf(s, "rxfrmtooshrt: %d\n", stats.rxfrmtooshrt);
+        seq_printf(s, "rxinvmachdr: %d\n", stats.rxinvmachdr);
+        seq_printf(s, "rxbadfcs: %d\n", stats.rxbadfcs);
+        seq_printf(s, "rxbadplcp: %d\n", stats.rxbadplcp);
+        seq_printf(s, "rxcrsglitch: %d\n", stats.rxcrsglitch);
+        seq_printf(s, "rxstrt: %d\n", stats.rxstrt);
+        seq_printf(s, "rxdfrmucastmbss: %d\n", stats.rxdfrmucastmbss);
+        seq_printf(s, "rxmfrmucastmbss: %d\n", stats.rxmfrmucastmbss);
+        seq_printf(s, "rxcfrmucast: %d\n", stats.rxcfrmucast);
+        seq_printf(s, "rxrtsucast: %d\n", stats.rxrtsucast);
+        seq_printf(s, "rxctsucast: %d\n", stats.rxctsucast);
+        seq_printf(s, "rxackucast: %d\n", stats.rxackucast);
+        seq_printf(s, "rxdfrmocast: %d\n", stats.rxdfrmocast);
+        seq_printf(s, "rxmfrmocast: %d\n", stats.rxmfrmocast);
+        seq_printf(s, "rxcfrmocast: %d\n", stats.rxcfrmocast);
+        seq_printf(s, "rxrtsocast: %d\n", stats.rxrtsocast);
+        seq_printf(s, "rxctsocast: %d\n", stats.rxctsocast);
+        seq_printf(s, "rxdfrmmcast: %d\n", stats.rxdfrmmcast);
+        seq_printf(s, "rxmfrmmcast: %d\n", stats.rxmfrmmcast);
+        seq_printf(s, "rxcfrmmcast: %d\n", stats.rxcfrmmcast);
+        seq_printf(s, "rxbeaconmbss: %d\n", stats.rxbeaconmbss);
+        seq_printf(s, "rxdfrmucastobss: %d\n", stats.rxdfrmucastobss);
+        seq_printf(s, "rxbeaconobss: %d\n", stats.rxbeaconobss);
+        seq_printf(s, "rxrsptmout: %d\n", stats.rxrsptmout);
+        seq_printf(s, "bcntxcancl: %d\n", stats.bcntxcancl);
+        seq_printf(s, "rxf0ovfl: %d\n", stats.rxf0ovfl);
+        seq_printf(s, "rxf1ovfl: %d\n", stats.rxf1ovfl);
+        seq_printf(s, "rxf2ovfl: %d\n", stats.rxf2ovfl);
+        seq_printf(s, "txsfovfl: %d\n", stats.txsfovfl);
+        seq_printf(s, "pmqovfl: %d\n", stats.pmqovfl);
+        seq_printf(s, "rxcgprqfrm: %d\n", stats.rxcgprqfrm);
+        seq_printf(s, "rxcgprsqovfl: %d\n", stats.rxcgprsqovfl);
+        seq_printf(s, "txcgprsfail: %d\n", stats.txcgprsfail);
+        seq_printf(s, "txcgprssuc: %d\n", stats.txcgprssuc);
+        seq_printf(s, "prs_timeout: %d\n", stats.prs_timeout);
+        seq_printf(s, "rxnack: %d\n", stats.rxnack);
+        seq_printf(s, "frmscons: %d\n", stats.frmscons);
+        seq_printf(s, "txnack: %d\n", stats.txnack);
+        seq_printf(s, "txglitch_nack: %d\n", stats.txglitch_nack);
+        seq_printf(s, "txburst: %d\n", stats.txburst);
+        seq_printf(s, "bphy_rxcrsglitch: %d\n", stats.bphy_rxcrsglitch);
+        seq_printf(s, "phywatchdog: %d\n", stats.phywatchdog);
+        seq_printf(s, "bphy_badplcp: %d\n", stats.bphy_badplcp);
+        return 0;
+}
+
+struct brcms_debugfs_entry {
+        int (*read)(struct seq_file *seq, void *data);
+        struct brcms_pub *drvr;
+};
+
+static int brcms_debugfs_entry_open(struct inode *inode, struct file *f)
+{
+        struct brcms_debugfs_entry *entry = inode->i_private;
+
+        return single_open(f, entry->read, entry->drvr);
 }
 
-static const struct file_operations brcms_debugfs_hardware_ops = {
+static const struct file_operations brcms_debugfs_def_ops = {
         .owner = THIS_MODULE,
-        .open = simple_open,
-        .read = brcms_debugfs_hardware_read
+        .open = brcms_debugfs_entry_open,
+        .release = single_release,
+        .read = seq_read,
+        .llseek = seq_lseek
 };
 
+static int
+brcms_debugfs_add_entry(struct brcms_pub *drvr, const char *fn,
+                        int (*read_fn)(struct seq_file *seq, void *data))
+{
+        struct device *dev = &drvr->wlc->hw->d11core->dev;
+        struct dentry *dentry =  drvr->dbgfs_dir;
+        struct brcms_debugfs_entry *entry;
+
+        if (IS_ERR_OR_NULL(dentry))
+                return -ENOENT;
+
+        entry = devm_kzalloc(dev, sizeof(*entry), GFP_KERNEL);
+        if (!entry)
+                return -ENOMEM;
+
+        entry->read = read_fn;
+        entry->drvr = drvr;
+
+        dentry = debugfs_create_file(fn, S_IRUGO, dentry, entry,
+                                     &brcms_debugfs_def_ops);
+
+        return PTR_ERR_OR_ZERO(dentry);
+}
+
 void brcms_debugfs_create_files(struct brcms_pub *drvr)
 {
-        struct dentry *dentry = drvr->dbgfs_dir;
+        if (IS_ERR_OR_NULL(drvr->dbgfs_dir))
+                return;
 
-        if (!IS_ERR_OR_NULL(dentry))
-                debugfs_create_file("hardware", S_IRUGO, dentry,
-                                    drvr, &brcms_debugfs_hardware_ops);
+        brcms_debugfs_add_entry(drvr, "hardware", brcms_debugfs_hardware_read);
+        brcms_debugfs_add_entry(drvr, "macstat", brcms_debugfs_macstat_read);
 }
 
 #define __brcms_fn(fn)                                          \
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index 1b474828d5b8..bc9be78faafa 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -3081,7 +3081,7 @@ static bool brcms_c_ps_allowed(struct brcms_c_info *wlc)
 static void brcms_c_statsupd(struct brcms_c_info *wlc)
 {
         int i;
-        struct macstat macstats;
+        struct macstat *macstats;
 #ifdef DEBUG
         u16 delta;
         u16 rxf0ovfl;
@@ -3092,31 +3092,31 @@ static void brcms_c_statsupd(struct brcms_c_info *wlc)
         if (!wlc->pub->up)
                 return;
 
+        macstats = wlc->core->macstat_snapshot;
+
 #ifdef DEBUG
         /* save last rx fifo 0 overflow count */
-        rxf0ovfl = wlc->core->macstat_snapshot->rxf0ovfl;
+        rxf0ovfl = macstats->rxf0ovfl;
 
         /* save last tx fifo  underflow count */
         for (i = 0; i < NFIFO; i++)
-                txfunfl[i] = wlc->core->macstat_snapshot->txfunfl[i];
+                txfunfl[i] = macstats->txfunfl[i];
 #endif                          /* DEBUG */
 
         /* Read mac stats from contiguous shared memory */
-        brcms_b_copyfrom_objmem(wlc->hw, M_UCODE_MACSTAT, &macstats,
-                                sizeof(struct macstat), OBJADDR_SHM_SEL);
+        brcms_b_copyfrom_objmem(wlc->hw, M_UCODE_MACSTAT, macstats,
+                                sizeof(*macstats), OBJADDR_SHM_SEL);
 
 #ifdef DEBUG
         /* check for rx fifo 0 overflow */
-        delta = (u16) (wlc->core->macstat_snapshot->rxf0ovfl - rxf0ovfl);
+        delta = (u16)(macstats->rxf0ovfl - rxf0ovfl);
         if (delta)
                 brcms_err(wlc->hw->d11core, "wl%d: %u rx fifo 0 overflows!\n",
                           wlc->pub->unit, delta);
 
         /* check for tx fifo underflows */
         for (i = 0; i < NFIFO; i++) {
-                delta =
-                    (u16) (wlc->core->macstat_snapshot->txfunfl[i] -
-                              txfunfl[i]);
+                delta = macstats->txfunfl[i] - txfunfl[i];
                 if (delta)
                         brcms_err(wlc->hw->d11core,
                                   "wl%d: %u tx fifo %d underflows!\n",
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index edc344334a75..67cad9b05ad8 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -1363,7 +1363,7 @@ static ssize_t show_cmd_log(struct device *d,
         if (!priv->cmdlog)
                 return 0;
         for (i = (priv->cmdlog_pos + 1) % priv->cmdlog_len;
-             (i != priv->cmdlog_pos) && (PAGE_SIZE - len);
+             (i != priv->cmdlog_pos) && (len < PAGE_SIZE);
              i = (i + 1) % priv->cmdlog_len) {
                 len +=
                     snprintf(buf + len, PAGE_SIZE - len,
diff --git a/drivers/net/wireless/ipw2x00/libipw.h b/drivers/net/wireless/ipw2x00/libipw.h
index 5ce2f59d3378..b0571618c2ed 100644
--- a/drivers/net/wireless/ipw2x00/libipw.h
+++ b/drivers/net/wireless/ipw2x00/libipw.h
@@ -654,10 +654,6 @@ struct libipw_network {
         /* TPC Report - mandatory if spctrm mgmt required */
         struct libipw_tpc_report tpc_report;
 
-        /* IBSS DFS - mandatory if spctrm mgmt required and IBSS
-         * NOTE: This is variable length and so must be allocated dynamically */
-        struct libipw_ibss_dfs *ibss_dfs;
-
         /* Channel Switch Announcement - optional if spctrm mgmt required */
         struct libipw_csa csa;
 
@@ -970,7 +966,6 @@ int libipw_rx(struct libipw_device *ieee, struct sk_buff *skb,
 /* make sure to set stats->len */
 void libipw_rx_mgt(struct libipw_device *ieee, struct libipw_hdr_4addr *header,
                    struct libipw_rx_stats *stats);
-void libipw_network_reset(struct libipw_network *network);
 
 /* libipw_geo.c */
 const struct libipw_geo *libipw_get_geo(struct libipw_device *ieee);
diff --git a/drivers/net/wireless/ipw2x00/libipw_module.c b/drivers/net/wireless/ipw2x00/libipw_module.c
index 5f31b72a4921..60f28740f6af 100644
--- a/drivers/net/wireless/ipw2x00/libipw_module.c
+++ b/drivers/net/wireless/ipw2x00/libipw_module.c
@@ -84,25 +84,12 @@ static int libipw_networks_allocate(struct libipw_device *ieee)
         return 0;
 }
 
-void libipw_network_reset(struct libipw_network *network)
-{
-        if (!network)
-                return;
-
-        if (network->ibss_dfs) {
-                kfree(network->ibss_dfs);
-                network->ibss_dfs = NULL;
-        }
-}
-
 static inline void libipw_networks_free(struct libipw_device *ieee)
 {
         int i;
 
-        for (i = 0; i < MAX_NETWORK_COUNT; i++) {
-                kfree(ieee->networks[i]->ibss_dfs);
+        for (i = 0; i < MAX_NETWORK_COUNT; i++)
                 kfree(ieee->networks[i]);
-        }
 }
 
 void libipw_networks_age(struct libipw_device *ieee,
diff --git a/drivers/net/wireless/ipw2x00/libipw_rx.c b/drivers/net/wireless/ipw2x00/libipw_rx.c
index 2d66984079bb..a6877dd6ba73 100644
--- a/drivers/net/wireless/ipw2x00/libipw_rx.c
+++ b/drivers/net/wireless/ipw2x00/libipw_rx.c
@@ -1298,13 +1298,6 @@ static int libipw_parse_info_param(struct libipw_info_element
                         break;
 
                 case WLAN_EID_IBSS_DFS:
-                        if (network->ibss_dfs)
-                                break;
-                        network->ibss_dfs = kmemdup(info_element->data,
-                                                    info_element->len,
-                                                    GFP_ATOMIC);
-                        if (!network->ibss_dfs)
-                                return 1;
                         network->flags |= NETWORK_HAS_IBSS_DFS;
                         break;
 
@@ -1335,9 +1328,7 @@ static int libipw_parse_info_param(struct libipw_info_element
 static int libipw_handle_assoc_resp(struct libipw_device *ieee, struct libipw_assoc_response
                                        *frame, struct libipw_rx_stats *stats)
 {
-        struct libipw_network network_resp = {
-                .ibss_dfs = NULL,
-        };
+        struct libipw_network network_resp = { };
         struct libipw_network *network = &network_resp;
         struct net_device *dev = ieee->dev;
 
@@ -1472,9 +1463,6 @@ static void update_network(struct libipw_network *dst,
         int qos_active;
         u8 old_param;
 
-        libipw_network_reset(dst);
-        dst->ibss_dfs = src->ibss_dfs;
-
         /* We only update the statistics if they were created by receiving
          * the network information on the actual channel the network is on.
          *
@@ -1548,9 +1536,7 @@ static void libipw_process_probe_response(struct libipw_device
                                                     *stats)
 {
         struct net_device *dev = ieee->dev;
-        struct libipw_network network = {
-                .ibss_dfs = NULL,
-        };
+        struct libipw_network network = { };
         struct libipw_network *target;
         struct libipw_network *oldest = NULL;
 #ifdef CONFIG_LIBIPW_DEBUG
@@ -1618,7 +1604,6 @@ static void libipw_process_probe_response(struct libipw_device
                         LIBIPW_DEBUG_SCAN("Expired '%*pE' (%pM) from network list.\n",
                                           target->ssid_len, target->ssid,
                                           target->bssid);
-                        libipw_network_reset(target);
                 } else {
                         /* Otherwise just pull from the free list */
                         target = list_entry(ieee->network_free_list.next,
@@ -1634,7 +1619,6 @@ static void libipw_process_probe_response(struct libipw_device
                                   "BEACON" : "PROBE RESPONSE");
 #endif
                 memcpy(target, &network, sizeof(*target));
-                network.ibss_dfs = NULL;
                 list_add_tail(&target->list, &ieee->network_list);
         } else {
                 LIBIPW_DEBUG_SCAN("Updating '%*pE' (%pM) via %s.\n",
@@ -1643,7 +1627,6 @@ static void libipw_process_probe_response(struct libipw_device
                                   is_beacon(beacon->header.frame_ctl) ?
                                   "BEACON" : "PROBE RESPONSE");
                 update_network(target, &network);
-                network.ibss_dfs = NULL;
         }
 
         spin_unlock_irqrestore(&ieee->lock, flags);
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
index 26fec54dcd03..2748fde4b90c 100644
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
@@ -6063,7 +6063,7 @@ il4965_mac_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 }
 
 void
-il4965_mac_channel_switch(struct ieee80211_hw *hw,
+il4965_mac_channel_switch(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                           struct ieee80211_channel_switch *ch_switch)
 {
         struct il_priv *il = hw->priv;
diff --git a/drivers/net/wireless/iwlegacy/4965.h b/drivers/net/wireless/iwlegacy/4965.h
index 337dfcf3bbde..3a57f71b8ed5 100644
--- a/drivers/net/wireless/iwlegacy/4965.h
+++ b/drivers/net/wireless/iwlegacy/4965.h
@@ -187,8 +187,9 @@ int il4965_mac_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                             u8 buf_size);
 int il4965_mac_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                        struct ieee80211_sta *sta);
-void il4965_mac_channel_switch(struct ieee80211_hw *hw,
-                               struct ieee80211_channel_switch *ch_switch);
+void
+il4965_mac_channel_switch(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                          struct ieee80211_channel_switch *ch_switch);
 
 void il4965_led_enable(struct il_priv *il);
 
diff --git a/drivers/net/wireless/iwlwifi/Kconfig b/drivers/net/wireless/iwlwifi/Kconfig
index 267e48a2915e..139de90c2aaf 100644
--- a/drivers/net/wireless/iwlwifi/Kconfig
+++ b/drivers/net/wireless/iwlwifi/Kconfig
@@ -59,6 +59,7 @@ config IWLDVM
 
 config IWLMVM
         tristate "Intel Wireless WiFi MVM Firmware support"
+        select BACKPORT_WANT_DEV_COREDUMP
         help
           This is the driver that supports the MVM firmware which is
           currently only available for 7260 and 3160 devices.
diff --git a/drivers/net/wireless/iwlwifi/dvm/lib.c b/drivers/net/wireless/iwlwifi/dvm/lib.c
index 2191621d69c1..02e4ede2b042 100644
--- a/drivers/net/wireless/iwlwifi/dvm/lib.c
+++ b/drivers/net/wireless/iwlwifi/dvm/lib.c
@@ -418,8 +418,8 @@ void iwlagn_bt_adjust_rssi_monitor(struct iwl_priv *priv, bool rssi_ena)
 
 static bool iwlagn_bt_traffic_is_sco(struct iwl_bt_uart_msg *uart_msg)
 {
-        return BT_UART_MSG_FRAME3SCOESCO_MSK & uart_msg->frame3 >>
-                        BT_UART_MSG_FRAME3SCOESCO_POS;
+        return (BT_UART_MSG_FRAME3SCOESCO_MSK & uart_msg->frame3) >>
+                BT_UART_MSG_FRAME3SCOESCO_POS;
 }
 
 static void iwlagn_bt_traffic_change_work(struct work_struct *work)
diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index cae692ff1013..47e64e8b9517 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -941,6 +941,7 @@ static int iwlagn_mac_sta_state(struct ieee80211_hw *hw,
 }
 
 static void iwlagn_mac_channel_switch(struct ieee80211_hw *hw,
+                                      struct ieee80211_vif *vif,
                                       struct ieee80211_channel_switch *ch_switch)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
diff --git a/drivers/net/wireless/iwlwifi/iwl-8000.c b/drivers/net/wireless/iwlwifi/iwl-8000.c
index d2b7234b1c73..896ea906549c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-8000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-8000.c
@@ -104,6 +104,7 @@ static const struct iwl_base_params iwl8000_base_params = {
 };
 
 static const struct iwl_ht_params iwl8000_ht_params = {
+        .stbc = true,
         .ldpc = true,
         .ht40_bands = BIT(IEEE80211_BAND_2GHZ) | BIT(IEEE80211_BAND_5GHZ),
 };
diff --git a/drivers/net/wireless/iwlwifi/iwl-config.h b/drivers/net/wireless/iwlwifi/iwl-config.h
index 2ef83a39ff10..f8aa9cf08279 100644
--- a/drivers/net/wireless/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/iwlwifi/iwl-config.h
@@ -87,6 +87,16 @@ enum iwl_device_family {
         IWL_DEVICE_FAMILY_8000,
 };
 
+static inline bool iwl_has_secure_boot(u32 hw_rev,
+                                       enum iwl_device_family family)
+{
+        /* return 1 only for family 8000 B0 */
+        if ((family == IWL_DEVICE_FAMILY_8000) && (hw_rev & 0xC))
+                return 1;
+
+        return 0;
+}
+
 /*
  * LED mode
  *    IWL_LED_DEFAULT:  use device default
@@ -246,6 +256,7 @@ struct iwl_pwr_tx_backoff {
  * @nvm_hw_section_num: the ID of the HW NVM section
  * @pwr_tx_backoffs: translation table between power limits and backoffs
  * @max_rx_agg_size: max RX aggregation size of the ADDBA request/response
+ * @max_tx_agg_size: max TX aggregation size of the ADDBA request/response
  *
  * We enable the driver to be backward compatible wrt. hardware features.
  * API differences in uCode shouldn't be handled here but through TLVs
@@ -285,6 +296,7 @@ struct iwl_cfg {
         const char *default_nvm_file;
         unsigned int max_rx_agg_size;
         bool disable_dummy_notification;
+        unsigned int max_tx_agg_size;
 };
 
 /*
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.c b/drivers/net/wireless/iwlwifi/iwl-drv.c
index 0f1084f09caa..d9fa8e034da2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.c
@@ -807,19 +807,16 @@ static int iwl_parse_tlv_firmware(struct iwl_drv *drv,
                         iwl_store_ucode_sec(pieces, tlv_data, IWL_UCODE_REGULAR,
                                             tlv_len);
                         drv->fw.mvm_fw = true;
-                        drv->fw.img[IWL_UCODE_REGULAR].is_secure = true;
                         break;
                 case IWL_UCODE_TLV_SECURE_SEC_INIT:
                         iwl_store_ucode_sec(pieces, tlv_data, IWL_UCODE_INIT,
                                             tlv_len);
                         drv->fw.mvm_fw = true;
-                        drv->fw.img[IWL_UCODE_INIT].is_secure = true;
                         break;
                 case IWL_UCODE_TLV_SECURE_SEC_WOWLAN:
                         iwl_store_ucode_sec(pieces, tlv_data, IWL_UCODE_WOWLAN,
                                             tlv_len);
                         drv->fw.mvm_fw = true;
-                        drv->fw.img[IWL_UCODE_WOWLAN].is_secure = true;
                         break;
                 case IWL_UCODE_TLV_NUM_OF_CPU:
                         if (tlv_len != sizeof(u32))
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw.h b/drivers/net/wireless/iwlwifi/iwl-fw.h
index 4f6e66892acc..6f7ae5f7bdae 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw.h
@@ -227,7 +227,6 @@ struct fw_desc {
 
 struct fw_img {
         struct fw_desc sec[IWL_UCODE_SECTION_MAX];
-        bool is_secure;
         bool is_dual_cpus;
 };
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.h b/drivers/net/wireless/iwlwifi/iwl-trans.h
index d8fc548c0d6c..0768f83e709d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans.h
@@ -535,9 +535,7 @@ struct iwl_trans_ops {
         void (*ref)(struct iwl_trans *trans);
         void (*unref)(struct iwl_trans *trans);
 
-#ifdef CONFIG_IWLWIFI_DEBUGFS
         struct iwl_trans_dump_data *(*dump_data)(struct iwl_trans *trans);
-#endif
 };
 
 /**
@@ -704,7 +702,6 @@ static inline void iwl_trans_unref(struct iwl_trans *trans)
                 trans->ops->unref(trans);
 }
 
-#ifdef CONFIG_IWLWIFI_DEBUGFS
 static inline struct iwl_trans_dump_data *
 iwl_trans_dump_data(struct iwl_trans *trans)
 {
@@ -712,7 +709,6 @@ iwl_trans_dump_data(struct iwl_trans *trans)
                 return NULL;
         return trans->ops->dump_data(trans);
 }
-#endif
 
 static inline int iwl_trans_send_cmd(struct iwl_trans *trans,
                                      struct iwl_host_cmd *cmd)
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex.c b/drivers/net/wireless/iwlwifi/mvm/coex.c
index da2ffb785194..508c81359e41 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex.c
@@ -72,8 +72,6 @@
 #include "mvm.h"
 #include "iwl-debug.h"
 
-#define BT_ANTENNA_COUPLING_THRESHOLD           (30)
-
 const u32 iwl_bt_ctl_kill_msk[BT_KILL_MSK_MAX] = {
         [BT_KILL_MSK_DEFAULT] = 0xfffffc00,
         [BT_KILL_MSK_NEVER] = 0xffffffff,
@@ -302,11 +300,6 @@ static const __le64 iwl_ci_mask[][3] = {
         },
 };
 
-static const __le32 iwl_bt_mprio_lut[BT_COEX_MULTI_PRIO_LUT_SIZE] = {
-        cpu_to_le32(0x2e402280),
-        cpu_to_le32(0x7711a751),
-};
-
 struct corunning_block_luts {
         u8 range;
         __le32 lut20[BT_COEX_CORUN_LUT_SIZE];
@@ -605,7 +598,7 @@ int iwl_send_bt_init_conf(struct iwl_mvm *mvm)
 
         bt_cmd->max_kill = cpu_to_le32(5);
         bt_cmd->bt4_antenna_isolation_thr =
-                                cpu_to_le32(BT_ANTENNA_COUPLING_THRESHOLD);
+                cpu_to_le32(IWL_MVM_BT_COEX_ANTENNA_COUPLING_THRS);
         bt_cmd->bt4_tx_tx_delta_freq_thr = cpu_to_le32(15);
         bt_cmd->bt4_tx_rx_max_freq0 = cpu_to_le32(15);
         bt_cmd->override_primary_lut = cpu_to_le32(BT_COEX_INVALID_LUT);
@@ -638,8 +631,8 @@ int iwl_send_bt_init_conf(struct iwl_mvm *mvm)
 
         memcpy(&bt_cmd->mplut_prio_boost, iwl_bt_prio_boost,
                sizeof(iwl_bt_prio_boost));
-        memcpy(&bt_cmd->multiprio_lut, iwl_bt_mprio_lut,
-               sizeof(iwl_bt_mprio_lut));
+        bt_cmd->multiprio_lut[0] = cpu_to_le32(IWL_MVM_BT_COEX_MPLUT_REG0);
+        bt_cmd->multiprio_lut[1] = cpu_to_le32(IWL_MVM_BT_COEX_MPLUT_REG1);
 
 send_cmd:
         memset(&mvm->last_bt_notif, 0, sizeof(mvm->last_bt_notif));
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
index 8a1d2f33d5b7..b571e1b0550c 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
@@ -102,8 +102,6 @@ static const u8 iwl_bt_prio_tbl[BT_COEX_PRIO_TBL_EVT_MAX] = {
 
 #undef EVENT_PRIO_ANT
 
-#define BT_ANTENNA_COUPLING_THRESHOLD           (30)
-
 static int iwl_send_bt_prio_tbl(struct iwl_mvm *mvm)
 {
         if (unlikely(mvm->bt_force_ant_mode != BT_FORCE_ANT_DIS))
@@ -290,11 +288,6 @@ static const __le64 iwl_ci_mask[][3] = {
         },
 };
 
-static const __le32 iwl_bt_mprio_lut[BT_COEX_MULTI_PRIO_LUT_SIZE] = {
-        cpu_to_le32(0x2e402280),
-        cpu_to_le32(0x7711a751),
-};
-
 struct corunning_block_luts {
         u8 range;
         __le32 lut20[BT_COEX_CORUN_LUT_SIZE];
@@ -593,7 +586,8 @@ int iwl_send_bt_init_conf_old(struct iwl_mvm *mvm)
         }
 
         bt_cmd->max_kill = 5;
-        bt_cmd->bt4_antenna_isolation_thr = BT_ANTENNA_COUPLING_THRESHOLD;
+        bt_cmd->bt4_antenna_isolation_thr =
+                IWL_MVM_BT_COEX_ANTENNA_COUPLING_THRS;
         bt_cmd->bt4_antenna_isolation = iwlwifi_mod_params.ant_coupling;
         bt_cmd->bt4_tx_tx_delta_freq_thr = 15;
         bt_cmd->bt4_tx_rx_max_freq0 = 15;
@@ -649,8 +643,8 @@ int iwl_send_bt_init_conf_old(struct iwl_mvm *mvm)
 
         memcpy(&bt_cmd->bt_prio_boost, iwl_bt_prio_boost,
                sizeof(iwl_bt_prio_boost));
-        memcpy(&bt_cmd->bt4_multiprio_lut, iwl_bt_mprio_lut,
-               sizeof(iwl_bt_mprio_lut));
+        bt_cmd->bt4_multiprio_lut[0] = cpu_to_le32(IWL_MVM_BT_COEX_MPLUT_REG0);
+        bt_cmd->bt4_multiprio_lut[1] = cpu_to_le32(IWL_MVM_BT_COEX_MPLUT_REG1);
 
 send_cmd:
         memset(&mvm->last_bt_notif_old, 0, sizeof(mvm->last_bt_notif_old));
diff --git a/drivers/net/wireless/iwlwifi/mvm/constants.h b/drivers/net/wireless/iwlwifi/mvm/constants.h
index d4dfbe4cb66d..5c1ea80d5e3b 100644
--- a/drivers/net/wireless/iwlwifi/mvm/constants.h
+++ b/drivers/net/wireless/iwlwifi/mvm/constants.h
@@ -92,8 +92,13 @@
 #define IWL_MVM_BT_COEX_SYNC2SCO                1
 #define IWL_MVM_BT_COEX_CORUNNING               0
 #define IWL_MVM_BT_COEX_MPLUT                   1
+#define IWL_MVM_BT_COEX_MPLUT_REG0              0x2e402280
+#define IWL_MVM_BT_COEX_MPLUT_REG1              0x7711a751
+#define IWL_MVM_BT_COEX_ANTENNA_COUPLING_THRS   30
 #define IWL_MVM_FW_MCAST_FILTER_PASS_ALL        0
+#define IWL_MVM_FW_BCAST_FILTER_PASS_ALL        0
 #define IWL_MVM_QUOTA_THRESHOLD                 8
 #define IWL_MVM_RS_RSSI_BASED_INIT_RATE         0
+#define IWL_MVM_RS_DISABLE_MIMO                 0
 
 #endif /* __MVM_CONSTANTS_H */
diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c
index c17be0fb7283..3bbb511b0b38 100644
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -601,33 +601,6 @@ static int iwl_mvm_send_remote_wake_cfg(struct iwl_mvm *mvm,
         return ret;
 }
 
-struct iwl_d3_iter_data {
-        struct iwl_mvm *mvm;
-        struct ieee80211_vif *vif;
-        bool error;
-};
-
-static void iwl_mvm_d3_iface_iterator(void *_data, u8 *mac,
-                                      struct ieee80211_vif *vif)
-{
-        struct iwl_d3_iter_data *data = _data;
-        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-
-        if (vif->type != NL80211_IFTYPE_STATION || vif->p2p)
-                return;
-
-        if (mvmvif->ap_sta_id == IWL_MVM_STATION_COUNT)
-                return;
-
-        if (data->vif) {
-                IWL_ERR(data->mvm, "More than one managed interface active!\n");
-                data->error = true;
-                return;
-        }
-
-        data->vif = vif;
-}
-
 static int iwl_mvm_d3_reprogram(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                                 struct ieee80211_sta *ap_sta)
 {
@@ -783,6 +756,35 @@ void iwl_mvm_set_last_nonqos_seq(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                 IWL_ERR(mvm, "failed to set non-QoS seqno\n");
 }
 
+static int iwl_mvm_switch_to_d3(struct iwl_mvm *mvm)
+{
+        iwl_mvm_cancel_scan(mvm);
+
+        iwl_trans_stop_device(mvm->trans);
+
+        /*
+         * Set the HW restart bit -- this is mostly true as we're
+         * going to load new firmware and reprogram that, though
+         * the reprogramming is going to be manual to avoid adding
+         * all the MACs that aren't support.
+         * We don't have to clear up everything though because the
+         * reprogramming is manual. When we resume, we'll actually
+         * go through a proper restart sequence again to switch
+         * back to the runtime firmware image.
+         */
+        set_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
+
+        /* We reprogram keys and shouldn't allocate new key indices */
+        memset(mvm->fw_key_table, 0, sizeof(mvm->fw_key_table));
+
+        mvm->ptk_ivlen = 0;
+        mvm->ptk_icvlen = 0;
+        mvm->ptk_ivlen = 0;
+        mvm->ptk_icvlen = 0;
+
+        return iwl_mvm_load_d3_fw(mvm);
+}
+
 static int
 iwl_mvm_send_wowlan_config_cmd(struct iwl_mvm *mvm,
                                const struct iwl_wowlan_config_cmd_v3 *cmd)
@@ -797,116 +799,52 @@ iwl_mvm_send_wowlan_config_cmd(struct iwl_mvm *mvm,
                                     cmd_len, cmd);
 }
 
-static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
-                             struct cfg80211_wowlan *wowlan,
-                             bool test)
+static int
+iwl_mvm_get_wowlan_config(struct iwl_mvm *mvm,
+                          struct cfg80211_wowlan *wowlan,
+                          struct iwl_wowlan_config_cmd_v3 *wowlan_config_cmd,
+                          struct ieee80211_vif *vif, struct iwl_mvm_vif *mvmvif,
+                          struct ieee80211_sta *ap_sta)
 {
-        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
-        struct iwl_d3_iter_data suspend_iter_data = {
-                .mvm = mvm,
-        };
-        struct ieee80211_vif *vif;
-        struct iwl_mvm_vif *mvmvif;
-        struct ieee80211_sta *ap_sta;
-        struct iwl_mvm_sta *mvm_ap_sta;
-        struct iwl_wowlan_config_cmd_v3 wowlan_config_cmd = {};
-        struct iwl_wowlan_kek_kck_material_cmd kek_kck_cmd = {};
-        struct iwl_wowlan_tkip_params_cmd tkip_cmd = {};
-        struct iwl_d3_manager_config d3_cfg_cmd_data = {
-                /*
-                 * Program the minimum sleep time to 10 seconds, as many
-                 * platforms have issues processing a wakeup signal while
-                 * still being in the process of suspending.
-                 */
-                .min_sleep_time = cpu_to_le32(10 * 1000 * 1000),
-        };
-        struct iwl_host_cmd d3_cfg_cmd = {
-                .id = D3_CONFIG_CMD,
-                .flags = CMD_WANT_SKB,
-                .data[0] = &d3_cfg_cmd_data,
-                .len[0] = sizeof(d3_cfg_cmd_data),
-        };
-        struct wowlan_key_data key_data = {
-                .use_rsc_tsc = false,
-                .tkip = &tkip_cmd,
-                .use_tkip = false,
-        };
         int ret;
-        int len __maybe_unused;
-
-        if (!wowlan) {
-                /*
-                 * mac80211 shouldn't get here, but for D3 test
-                 * it doesn't warrant a warning
-                 */
-                WARN_ON(!test);
-                return -EINVAL;
-        }
-
-        key_data.rsc_tsc = kzalloc(sizeof(*key_data.rsc_tsc), GFP_KERNEL);
-        if (!key_data.rsc_tsc)
-                return -ENOMEM;
-
-        mutex_lock(&mvm->mutex);
-
-        /* see if there's only a single BSS vif and it's associated */
-        ieee80211_iterate_active_interfaces_atomic(
-                mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
-                iwl_mvm_d3_iface_iterator, &suspend_iter_data);
-
-        if (suspend_iter_data.error || !suspend_iter_data.vif) {
-                ret = 1;
-                goto out_noreset;
-        }
-
-        vif = suspend_iter_data.vif;
-        mvmvif = iwl_mvm_vif_from_mac80211(vif);
-
-        ap_sta = rcu_dereference_protected(
-                        mvm->fw_id_to_mac_id[mvmvif->ap_sta_id],
-                        lockdep_is_held(&mvm->mutex));
-        if (IS_ERR_OR_NULL(ap_sta)) {
-                ret = -EINVAL;
-                goto out_noreset;
-        }
-
-        mvm_ap_sta = (struct iwl_mvm_sta *)ap_sta->drv_priv;
+        struct iwl_mvm_sta *mvm_ap_sta = (struct iwl_mvm_sta *)ap_sta->drv_priv;
 
-        /* TODO: wowlan_config_cmd.common.wowlan_ba_teardown_tids */
+        /* TODO: wowlan_config_cmd->common.wowlan_ba_teardown_tids */
 
-        wowlan_config_cmd.common.is_11n_connection =
+        wowlan_config_cmd->common.is_11n_connection =
                                         ap_sta->ht_cap.ht_supported;
 
         /* Query the last used seqno and set it */
         ret = iwl_mvm_get_last_nonqos_seq(mvm, vif);
         if (ret < 0)
-                goto out_noreset;
-        wowlan_config_cmd.common.non_qos_seq = cpu_to_le16(ret);
+                return ret;
 
-        iwl_mvm_set_wowlan_qos_seq(mvm_ap_sta, &wowlan_config_cmd.common);
+        wowlan_config_cmd->common.non_qos_seq = cpu_to_le16(ret);
+
+        iwl_mvm_set_wowlan_qos_seq(mvm_ap_sta, &wowlan_config_cmd->common);
 
         if (wowlan->disconnect)
-                wowlan_config_cmd.common.wakeup_filter |=
+                wowlan_config_cmd->common.wakeup_filter |=
                         cpu_to_le32(IWL_WOWLAN_WAKEUP_BEACON_MISS |
                                     IWL_WOWLAN_WAKEUP_LINK_CHANGE);
         if (wowlan->magic_pkt)
-                wowlan_config_cmd.common.wakeup_filter |=
+                wowlan_config_cmd->common.wakeup_filter |=
                         cpu_to_le32(IWL_WOWLAN_WAKEUP_MAGIC_PACKET);
         if (wowlan->gtk_rekey_failure)
-                wowlan_config_cmd.common.wakeup_filter |=
+                wowlan_config_cmd->common.wakeup_filter |=
                         cpu_to_le32(IWL_WOWLAN_WAKEUP_GTK_REKEY_FAIL);
         if (wowlan->eap_identity_req)
-                wowlan_config_cmd.common.wakeup_filter |=
+                wowlan_config_cmd->common.wakeup_filter |=
                         cpu_to_le32(IWL_WOWLAN_WAKEUP_EAP_IDENT_REQ);
         if (wowlan->four_way_handshake)
-                wowlan_config_cmd.common.wakeup_filter |=
+                wowlan_config_cmd->common.wakeup_filter |=
                         cpu_to_le32(IWL_WOWLAN_WAKEUP_4WAY_HANDSHAKE);
         if (wowlan->n_patterns)
-                wowlan_config_cmd.common.wakeup_filter |=
+                wowlan_config_cmd->common.wakeup_filter |=
                         cpu_to_le32(IWL_WOWLAN_WAKEUP_PATTERN_MATCH);
 
         if (wowlan->rfkill_release)
-                wowlan_config_cmd.common.wakeup_filter |=
+                wowlan_config_cmd->common.wakeup_filter |=
                         cpu_to_le32(IWL_WOWLAN_WAKEUP_RF_KILL_DEASSERT);
 
         if (wowlan->tcp) {
@@ -914,44 +852,39 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
                  * Set the "link change" (really "link lost") flag as well
                  * since that implies losing the TCP connection.
                  */
-                wowlan_config_cmd.common.wakeup_filter |=
+                wowlan_config_cmd->common.wakeup_filter |=
                         cpu_to_le32(IWL_WOWLAN_WAKEUP_REMOTE_LINK_LOSS |
                                     IWL_WOWLAN_WAKEUP_REMOTE_SIGNATURE_TABLE |
                                     IWL_WOWLAN_WAKEUP_REMOTE_WAKEUP_PACKET |
                                     IWL_WOWLAN_WAKEUP_LINK_CHANGE);
         }
 
-        iwl_mvm_cancel_scan(mvm);
-
-        iwl_trans_stop_device(mvm->trans);
-
-        /*
-         * Set the HW restart bit -- this is mostly true as we're
-         * going to load new firmware and reprogram that, though
-         * the reprogramming is going to be manual to avoid adding
-         * all the MACs that aren't support.
-         * We don't have to clear up everything though because the
-         * reprogramming is manual. When we resume, we'll actually
-         * go through a proper restart sequence again to switch
-         * back to the runtime firmware image.
-         */
-        set_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
-
-        /* We reprogram keys and shouldn't allocate new key indices */
-        memset(mvm->fw_key_table, 0, sizeof(mvm->fw_key_table));
-
-        mvm->ptk_ivlen = 0;
-        mvm->ptk_icvlen = 0;
-        mvm->ptk_ivlen = 0;
-        mvm->ptk_icvlen = 0;
+        return 0;
+}
 
-        ret = iwl_mvm_load_d3_fw(mvm);
-        if (ret)
-                goto out;
+static int
+iwl_mvm_wowlan_config(struct iwl_mvm *mvm,
+                      struct cfg80211_wowlan *wowlan,
+                      struct iwl_wowlan_config_cmd_v3 *wowlan_config_cmd,
+                      struct ieee80211_vif *vif, struct iwl_mvm_vif *mvmvif,
+                      struct ieee80211_sta *ap_sta)
+{
+        struct iwl_wowlan_kek_kck_material_cmd kek_kck_cmd = {};
+        struct iwl_wowlan_tkip_params_cmd tkip_cmd = {};
+        struct wowlan_key_data key_data = {
+                .use_rsc_tsc = false,
+                .tkip = &tkip_cmd,
+                .use_tkip = false,
+        };
+        int ret;
 
         ret = iwl_mvm_d3_reprogram(mvm, vif, ap_sta);
         if (ret)
-                goto out;
+                return ret;
+
+        key_data.rsc_tsc = kzalloc(sizeof(*key_data.rsc_tsc), GFP_KERNEL);
+        if (!key_data.rsc_tsc)
+                return -ENOMEM;
 
         if (!iwlwifi_mod_params.sw_crypto) {
                 /*
@@ -1010,7 +943,7 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
                 }
         }
 
-        ret = iwl_mvm_send_wowlan_config_cmd(mvm, &wowlan_config_cmd);
+        ret = iwl_mvm_send_wowlan_config_cmd(mvm, wowlan_config_cmd);
         if (ret)
                 goto out;
 
@@ -1023,8 +956,93 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
                 goto out;
 
         ret = iwl_mvm_send_remote_wake_cfg(mvm, vif, wowlan->tcp);
-        if (ret)
-                goto out;
+
+out:
+        kfree(key_data.rsc_tsc);
+        return ret;
+}
+
+static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
+                             struct cfg80211_wowlan *wowlan,
+                             bool test)
+{
+        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+        struct ieee80211_vif *vif = NULL;
+        struct iwl_mvm_vif *mvmvif = NULL;
+        struct ieee80211_sta *ap_sta = NULL;
+        struct iwl_wowlan_config_cmd_v3 wowlan_config_cmd = {};
+        struct iwl_d3_manager_config d3_cfg_cmd_data = {
+                /*
+                 * Program the minimum sleep time to 10 seconds, as many
+                 * platforms have issues processing a wakeup signal while
+                 * still being in the process of suspending.
+                 */
+                .min_sleep_time = cpu_to_le32(10 * 1000 * 1000),
+        };
+        struct iwl_host_cmd d3_cfg_cmd = {
+                .id = D3_CONFIG_CMD,
+                .flags = CMD_WANT_SKB,
+                .data[0] = &d3_cfg_cmd_data,
+                .len[0] = sizeof(d3_cfg_cmd_data),
+        };
+        int ret;
+        int len __maybe_unused;
+
+        if (!wowlan) {
+                /*
+                 * mac80211 shouldn't get here, but for D3 test
+                 * it doesn't warrant a warning
+                 */
+                WARN_ON(!test);
+                return -EINVAL;
+        }
+
+        mutex_lock(&mvm->mutex);
+
+        vif = iwl_mvm_get_bss_vif(mvm);
+        if (IS_ERR_OR_NULL(vif)) {
+                ret = 1;
+                goto out_noreset;
+        }
+
+        mvmvif = iwl_mvm_vif_from_mac80211(vif);
+
+        /* if we're associated, this is wowlan */
+        if (mvmvif->ap_sta_id != IWL_MVM_STATION_COUNT) {
+                ap_sta = rcu_dereference_protected(
+                        mvm->fw_id_to_mac_id[mvmvif->ap_sta_id],
+                        lockdep_is_held(&mvm->mutex));
+                if (IS_ERR_OR_NULL(ap_sta)) {
+                        ret = -EINVAL;
+                        goto out_noreset;
+                }
+
+                ret = iwl_mvm_get_wowlan_config(mvm, wowlan, &wowlan_config_cmd,
+                                                vif, mvmvif, ap_sta);
+                if (ret)
+                        goto out_noreset;
+
+                ret = iwl_mvm_switch_to_d3(mvm);
+                if (ret)
+                        goto out;
+
+                ret = iwl_mvm_wowlan_config(mvm, wowlan, &wowlan_config_cmd,
+                                            vif, mvmvif, ap_sta);
+                if (ret)
+                        goto out;
+        } else if (mvm->nd_config) {
+                ret = iwl_mvm_switch_to_d3(mvm);
+                if (ret)
+                        goto out;
+
+                ret = iwl_mvm_scan_offload_start(mvm, vif, mvm->nd_config,
+                                                 mvm->nd_ies);
+                if (ret)
+                        goto out;
+        } else {
+                ret = 1;
+                goto out_noreset;
+        }
 
         ret = iwl_mvm_power_update_device(mvm);
         if (ret)
@@ -1060,8 +1078,6 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
         if (ret < 0)
                 ieee80211_restart_hw(mvm->hw);
  out_noreset:
-        kfree(key_data.rsc_tsc);
-
         mutex_unlock(&mvm->mutex);
 
         return ret;
@@ -1592,9 +1608,6 @@ static void iwl_mvm_d3_disconnect_iter(void *data, u8 *mac,
 
 static int __iwl_mvm_resume(struct iwl_mvm *mvm, bool test)
 {
-        struct iwl_d3_iter_data resume_iter_data = {
-                .mvm = mvm,
-        };
         struct ieee80211_vif *vif = NULL;
         int ret;
         enum iwl_d3_status d3_status;
@@ -1603,15 +1616,10 @@ static int __iwl_mvm_resume(struct iwl_mvm *mvm, bool test)
         mutex_lock(&mvm->mutex);
 
         /* get the BSS vif pointer again */
-        ieee80211_iterate_active_interfaces_atomic(
-                mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
-                iwl_mvm_d3_iface_iterator, &resume_iter_data);
-
-        if (WARN_ON(resume_iter_data.error || !resume_iter_data.vif))
+        vif = iwl_mvm_get_bss_vif(mvm);
+        if (IS_ERR_OR_NULL(vif))
                 goto out_unlock;
 
-        vif = resume_iter_data.vif;
-
         ret = iwl_trans_d3_resume(mvm->trans, &d3_status, test);
         if (ret)
                 goto out_unlock;
@@ -1741,7 +1749,9 @@ static int iwl_mvm_d3_test_release(struct inode *inode, struct file *file)
         int remaining_time = 10;
 
         mvm->d3_test_active = false;
+        rtnl_lock();
         __iwl_mvm_resume(mvm, true);
+        rtnl_unlock();
         iwl_abort_notification_waits(&mvm->notif_wait);
         ieee80211_restart_hw(mvm->hw);
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
index 50527a9bb267..51b7116965ed 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
@@ -121,78 +121,6 @@ static ssize_t iwl_dbgfs_sta_drain_write(struct iwl_mvm *mvm, char *buf,
         return ret;
 }
 
-static int iwl_dbgfs_fw_error_dump_open(struct inode *inode, struct file *file)
-{
-        struct iwl_mvm *mvm = inode->i_private;
-        int ret;
-
-        if (!mvm)
-                return -EINVAL;
-
-        mutex_lock(&mvm->mutex);
-        if (!mvm->fw_error_dump) {
-                ret = -ENODATA;
-                goto out;
-        }
-
-        file->private_data = mvm->fw_error_dump;
-        mvm->fw_error_dump = NULL;
-        ret = 0;
-
-out:
-        mutex_unlock(&mvm->mutex);
-        return ret;
-}
-
-static ssize_t iwl_dbgfs_fw_error_dump_read(struct file *file,
-                                            char __user *user_buf,
-                                            size_t count, loff_t *ppos)
-{
-        struct iwl_mvm_dump_ptrs *dump_ptrs = (void *)file->private_data;
-        ssize_t bytes_read = 0;
-        ssize_t bytes_read_trans = 0;
-
-        if (*ppos < dump_ptrs->op_mode_len)
-                bytes_read +=
-                        simple_read_from_buffer(user_buf, count, ppos,
-                                                dump_ptrs->op_mode_ptr,
-                                                dump_ptrs->op_mode_len);
-
-        if (bytes_read < 0 || *ppos < dump_ptrs->op_mode_len)
-                return bytes_read;
-
-        if (dump_ptrs->trans_ptr) {
-                *ppos -= dump_ptrs->op_mode_len;
-                bytes_read_trans =
-                        simple_read_from_buffer(user_buf + bytes_read,
-                                                count - bytes_read, ppos,
-                                                dump_ptrs->trans_ptr->data,
-                                                dump_ptrs->trans_ptr->len);
-                *ppos += dump_ptrs->op_mode_len;
-
-                if (bytes_read_trans >= 0)
-                        bytes_read += bytes_read_trans;
-                else if (!bytes_read)
-                        /* propagate the failure */
-                        return bytes_read_trans;
-        }
-
-        return bytes_read;
-
-}
-
-static int iwl_dbgfs_fw_error_dump_release(struct inode *inode,
-                                           struct file *file)
-{
-        struct iwl_mvm_dump_ptrs *dump_ptrs = (void *)file->private_data;
-
-        vfree(dump_ptrs->op_mode_ptr);
-        vfree(dump_ptrs->trans_ptr);
-        kfree(dump_ptrs);
-
-        return 0;
-}
-
 static ssize_t iwl_dbgfs_sram_read(struct file *file, char __user *user_buf,
                                    size_t count, loff_t *ppos)
 {
@@ -1250,6 +1178,126 @@ static ssize_t iwl_dbgfs_d3_sram_read(struct file *file, char __user *user_buf,
 
         return ret;
 }
+
+#define MAX_NUM_ND_MATCHSETS 10
+
+static ssize_t iwl_dbgfs_netdetect_write(struct iwl_mvm *mvm, char *buf,
+                                         size_t count, loff_t *ppos)
+{
+        const char *seps = ",\n";
+        char *buf_ptr = buf;
+        char *value_str = NULL;
+        int ret, i;
+
+        /* TODO: don't free if write is being called several times in one go */
+        if (mvm->nd_config) {
+                kfree(mvm->nd_config->match_sets);
+                kfree(mvm->nd_config);
+                mvm->nd_config = NULL;
+                kfree(mvm->nd_ies);
+                mvm->nd_ies = NULL;
+        }
+
+        mvm->nd_ies = kzalloc(sizeof(*mvm->nd_ies), GFP_KERNEL);
+        if (!mvm->nd_ies)
+                return -ENOMEM;
+
+        mvm->nd_config = kzalloc(sizeof(*mvm->nd_config) +
+                                 (11 * sizeof(struct ieee80211_channel *)),
+                                 GFP_KERNEL);
+        if (!mvm->nd_config) {
+                ret = -ENOMEM;
+                goto out_free;
+        }
+
+        mvm->nd_config->n_channels = 11;
+        mvm->nd_config->scan_width = NL80211_BSS_CHAN_WIDTH_20;
+        mvm->nd_config->interval = 5;
+        mvm->nd_config->min_rssi_thold = -80;
+        for (i = 0; i < mvm->nd_config->n_channels; i++)
+                mvm->nd_config->channels[i] = &mvm->nvm_data->channels[i];
+
+        mvm->nd_config->match_sets =
+                kcalloc(MAX_NUM_ND_MATCHSETS,
+                        sizeof(*mvm->nd_config->match_sets),
+                        GFP_KERNEL);
+        if (!mvm->nd_config->match_sets) {
+                ret = -ENOMEM;
+                goto out_free;
+        }
+
+        while ((value_str = strsep(&buf_ptr, seps)) &&
+               strlen(value_str)) {
+                struct cfg80211_match_set *set;
+
+                if (mvm->nd_config->n_match_sets >= MAX_NUM_ND_MATCHSETS) {
+                        ret = -EINVAL;
+                        goto out_free;
+                }
+
+                set = &mvm->nd_config->match_sets[mvm->nd_config->n_match_sets];
+                set->ssid.ssid_len = strlen(value_str);
+
+                if (set->ssid.ssid_len > IEEE80211_MAX_SSID_LEN) {
+                        ret = -EINVAL;
+                        goto out_free;
+                }
+
+                memcpy(set->ssid.ssid, value_str, set->ssid.ssid_len);
+
+                mvm->nd_config->n_match_sets++;
+        }
+
+        ret = count;
+
+        if (mvm->nd_config->n_match_sets)
+                goto out;
+
+out_free:
+        if (mvm->nd_config)
+                kfree(mvm->nd_config->match_sets);
+        kfree(mvm->nd_config);
+        mvm->nd_config = NULL;
+        kfree(mvm->nd_ies);
+        mvm->nd_ies = NULL;
+out:
+        return ret;
+}
+
+static ssize_t
+iwl_dbgfs_netdetect_read(struct file *file, char __user *user_buf,
+                         size_t count, loff_t *ppos)
+{
+        struct iwl_mvm *mvm = file->private_data;
+        size_t bufsz, ret;
+        char *buf;
+        int i, n_match_sets, pos = 0;
+
+        n_match_sets = mvm->nd_config ? mvm->nd_config->n_match_sets : 0;
+
+        bufsz = n_match_sets * (IEEE80211_MAX_SSID_LEN + 1) + 1;
+        buf = kzalloc(bufsz, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        for (i = 0; i < n_match_sets; i++) {
+                if (pos +
+                    mvm->nd_config->match_sets[i].ssid.ssid_len + 2 > bufsz) {
+                        ret = -EIO;
+                        goto out;
+                }
+
+                memcpy(buf + pos, mvm->nd_config->match_sets[i].ssid.ssid,
+                       mvm->nd_config->match_sets[i].ssid.ssid_len);
+                pos += mvm->nd_config->match_sets[i].ssid.ssid_len;
+                buf[pos++] = '\n';
+        }
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+out:
+        kfree(buf);
+        return ret;
+}
 #endif
 
 #define PRINT_MVM_REF(ref) do {                                         \
@@ -1415,12 +1463,6 @@ MVM_DEBUGFS_WRITE_FILE_OPS(bt_force_ant, 10);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(scan_ant_rxchain, 8);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(d0i3_refs, 8);
 
-static const struct file_operations iwl_dbgfs_fw_error_dump_ops = {
-        .open = iwl_dbgfs_fw_error_dump_open,
-        .read = iwl_dbgfs_fw_error_dump_read,
-        .release = iwl_dbgfs_fw_error_dump_release,
-};
-
 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(bcast_filters, 256);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(bcast_filters_macs, 256);
@@ -1428,6 +1470,7 @@ MVM_DEBUGFS_READ_WRITE_FILE_OPS(bcast_filters_macs, 256);
 
 #ifdef CONFIG_PM_SLEEP
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(d3_sram, 8);
+MVM_DEBUGFS_READ_WRITE_FILE_OPS(netdetect, 384);
 #endif
 
 int iwl_mvm_dbgfs_register(struct iwl_mvm *mvm, struct dentry *dbgfs_dir)
@@ -1446,7 +1489,6 @@ int iwl_mvm_dbgfs_register(struct iwl_mvm *mvm, struct dentry *dbgfs_dir)
                              S_IWUSR | S_IRUSR);
         MVM_DEBUGFS_ADD_FILE(nic_temp, dbgfs_dir, S_IRUSR);
         MVM_DEBUGFS_ADD_FILE(stations, dbgfs_dir, S_IRUSR);
-        MVM_DEBUGFS_ADD_FILE(fw_error_dump, dbgfs_dir, S_IRUSR);
         MVM_DEBUGFS_ADD_FILE(bt_notif, dbgfs_dir, S_IRUSR);
         MVM_DEBUGFS_ADD_FILE(bt_cmd, dbgfs_dir, S_IRUSR);
         MVM_DEBUGFS_ADD_FILE(disable_power_off, mvm->debugfs_dir,
@@ -1487,6 +1529,7 @@ int iwl_mvm_dbgfs_register(struct iwl_mvm *mvm, struct dentry *dbgfs_dir)
         if (!debugfs_create_bool("d3_wake_sysassert", S_IRUSR | S_IWUSR,
                                  mvm->debugfs_dir, &mvm->d3_wake_sysassert))
                 goto err;
+        MVM_DEBUGFS_ADD_FILE(netdetect, mvm->debugfs_dir, S_IRUSR | S_IWUSR);
 #endif
 
         if (!debugfs_create_u8("low_latency_agg_frame_limit", S_IRUSR | S_IWUSR,
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
index 0c5c0b0e23f5..b8ab4a108720 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
@@ -197,8 +197,7 @@ static void iwl_mvm_mac_tsf_id_iter(void *_data, u8 *mac,
 /*
  * Get the mask of the queues used by the vif
  */
-u32 iwl_mvm_mac_get_queues_mask(struct iwl_mvm *mvm,
-                                struct ieee80211_vif *vif)
+u32 iwl_mvm_mac_get_queues_mask(struct ieee80211_vif *vif)
 {
         u32 qmask = 0, ac;
 
@@ -227,7 +226,7 @@ static void iwl_mvm_mac_iface_iterator(void *_data, u8 *mac,
         }
 
         /* Mark the queues used by the vif */
-        data->used_hw_queues |= iwl_mvm_mac_get_queues_mask(data->mvm, vif);
+        data->used_hw_queues |= iwl_mvm_mac_get_queues_mask(vif);
 
         /* Mark MAC IDs as used by clearing the available bit, and
          * (below) mark TSFs as used if their existing use is not
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index b62405865b25..57325589ee5b 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -69,6 +69,7 @@
 #include <linux/etherdevice.h>
 #include <linux/ip.h>
 #include <linux/if_arp.h>
+#include <linux/devcoredump.h>
 #include <net/mac80211.h>
 #include <net/ieee80211_radiotap.h>
 #include <net/tcp.h>
@@ -679,10 +680,51 @@ static void iwl_mvm_cleanup_iterator(void *data, u8 *mac,
         memset(&mvmvif->bf_data, 0, sizeof(mvmvif->bf_data));
 }
 
-#ifdef CONFIG_IWLWIFI_DEBUGFS
+static ssize_t iwl_mvm_read_coredump(char *buffer, loff_t offset, size_t count,
+                                     const void *data, size_t datalen)
+{
+        const struct iwl_mvm_dump_ptrs *dump_ptrs = data;
+        ssize_t bytes_read;
+        ssize_t bytes_read_trans;
+
+        if (offset < dump_ptrs->op_mode_len) {
+                bytes_read = min_t(ssize_t, count,
+                                   dump_ptrs->op_mode_len - offset);
+                memcpy(buffer, (u8 *)dump_ptrs->op_mode_ptr + offset,
+                       bytes_read);
+                offset += bytes_read;
+                count -= bytes_read;
+
+                if (count == 0)
+                        return bytes_read;
+        } else {
+                bytes_read = 0;
+        }
+
+        if (!dump_ptrs->trans_ptr)
+                return bytes_read;
+
+        offset -= dump_ptrs->op_mode_len;
+        bytes_read_trans = min_t(ssize_t, count,
+                                 dump_ptrs->trans_ptr->len - offset);
+        memcpy(buffer + bytes_read,
+               (u8 *)dump_ptrs->trans_ptr->data + offset,
+               bytes_read_trans);
+
+        return bytes_read + bytes_read_trans;
+}
+
+static void iwl_mvm_free_coredump(const void *data)
+{
+        const struct iwl_mvm_dump_ptrs *fw_error_dump = data;
+
+        vfree(fw_error_dump->op_mode_ptr);
+        vfree(fw_error_dump->trans_ptr);
+        kfree(fw_error_dump);
+}
+
 void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm)
 {
-        static char *env[] = { "DRIVER=iwlwifi", "EVENT=error_dump", NULL };
         struct iwl_fw_error_dump_file *dump_file;
         struct iwl_fw_error_dump_data *dump_data;
         struct iwl_fw_error_dump_info *dump_info;
@@ -695,10 +737,7 @@ void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm)
 
         lockdep_assert_held(&mvm->mutex);
 
-        if (mvm->fw_error_dump)
-                return;
-
-        fw_error_dump = kzalloc(sizeof(*mvm->fw_error_dump), GFP_KERNEL);
+        fw_error_dump = kzalloc(sizeof(*fw_error_dump), GFP_KERNEL);
         if (!fw_error_dump)
                 return;
 
@@ -773,12 +812,10 @@ void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm)
         if (fw_error_dump->trans_ptr)
                 file_len += fw_error_dump->trans_ptr->len;
         dump_file->file_len = cpu_to_le32(file_len);
-        mvm->fw_error_dump = fw_error_dump;
 
-        /* notify the userspace about the error we had */
-        kobject_uevent_env(&mvm->hw->wiphy->dev.kobj, KOBJ_CHANGE, env);
+        dev_coredumpm(mvm->trans->dev, THIS_MODULE, fw_error_dump, 0,
+                      GFP_KERNEL, iwl_mvm_read_coredump, iwl_mvm_free_coredump);
 }
-#endif
 
 static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
 {
@@ -859,9 +896,8 @@ static int iwl_mvm_mac_start(struct ieee80211_hw *hw)
         return ret;
 }
 
-static void iwl_mvm_mac_restart_complete(struct ieee80211_hw *hw)
+static void iwl_mvm_restart_complete(struct iwl_mvm *mvm)
 {
-        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
         int ret;
 
         mutex_lock(&mvm->mutex);
@@ -879,6 +915,21 @@ static void iwl_mvm_mac_restart_complete(struct ieee80211_hw *hw)
         mutex_unlock(&mvm->mutex);
 }
 
+static void
+iwl_mvm_mac_reconfig_complete(struct ieee80211_hw *hw,
+                              enum ieee80211_reconfig_type reconfig_type)
+{
+        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+
+        switch (reconfig_type) {
+        case IEEE80211_RECONFIG_TYPE_RESTART:
+                iwl_mvm_restart_complete(mvm);
+                break;
+        case IEEE80211_RECONFIG_TYPE_SUSPEND:
+                break;
+        }
+}
+
 void __iwl_mvm_mac_stop(struct iwl_mvm *mvm)
 {
         lockdep_assert_held(&mvm->mutex);
@@ -1087,7 +1138,7 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
 static void iwl_mvm_prepare_mac_removal(struct iwl_mvm *mvm,
                                         struct ieee80211_vif *vif)
 {
-        u32 tfd_msk = iwl_mvm_mac_get_queues_mask(mvm, vif);
+        u32 tfd_msk = iwl_mvm_mac_get_queues_mask(vif);
 
         if (tfd_msk) {
                 mutex_lock(&mvm->mutex);
@@ -1383,6 +1434,9 @@ bool iwl_mvm_bcast_filter_build_cmd(struct iwl_mvm *mvm,
                 .cmd = cmd,
         };
 
+        if (IWL_MVM_FW_BCAST_FILTER_PASS_ALL)
+                return false;
+
         memset(cmd, 0, sizeof(*cmd));
         cmd->max_bcast_filters = ARRAY_SIZE(cmd->filters);
         cmd->max_macs = ARRAY_SIZE(cmd->macs);
@@ -2171,25 +2225,9 @@ static int iwl_mvm_mac_sched_scan_start(struct ieee80211_hw *hw,
 
         mvm->scan_status = IWL_MVM_SCAN_SCHED;
 
-        if (!(mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_LMAC_SCAN)) {
-                ret = iwl_mvm_config_sched_scan(mvm, vif, req, ies);
-                if (ret)
-                        goto err;
-        }
-
-        ret = iwl_mvm_config_sched_scan_profiles(mvm, req);
+        ret = iwl_mvm_scan_offload_start(mvm, vif, req, ies);
         if (ret)
-                goto err;
-
-        if (mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_LMAC_SCAN)
-                ret = iwl_mvm_unified_sched_scan_lmac(mvm, vif, req, ies);
-        else
-                ret = iwl_mvm_sched_scan_start(mvm, req);
-
-        if (!ret)
-                goto out;
-err:
-        mvm->scan_status = IWL_MVM_SCAN_NONE;
+                mvm->scan_status = IWL_MVM_SCAN_NONE;
 out:
         mutex_unlock(&mvm->mutex);
         return ret;
@@ -3011,25 +3049,31 @@ static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,
         mvmvif = iwl_mvm_vif_from_mac80211(vif);
         mvmsta = iwl_mvm_sta_from_staid_protected(mvm, mvmvif->ap_sta_id);
 
-        if (WARN_ON_ONCE(!mvmsta))
-                goto done;
+        if (WARN_ON_ONCE(!mvmsta)) {
+                mutex_unlock(&mvm->mutex);
+                return;
+        }
 
         if (drop) {
                 if (iwl_mvm_flush_tx_path(mvm, mvmsta->tfd_queue_msk, true))
                         IWL_ERR(mvm, "flush request fail\n");
+                mutex_unlock(&mvm->mutex);
         } else {
-                iwl_trans_wait_tx_queue_empty(mvm->trans,
-                                              mvmsta->tfd_queue_msk);
+                u32 tfd_queue_msk = mvmsta->tfd_queue_msk;
+                mutex_unlock(&mvm->mutex);
+
+                /* this can take a while, and we may need/want other operations
+                 * to succeed while doing this, so do it without the mutex held
+                 */
+                iwl_trans_wait_tx_queue_empty(mvm->trans, tfd_queue_msk);
         }
-done:
-        mutex_unlock(&mvm->mutex);
 }
 
 const struct ieee80211_ops iwl_mvm_hw_ops = {
         .tx = iwl_mvm_mac_tx,
         .ampdu_action = iwl_mvm_mac_ampdu_action,
         .start = iwl_mvm_mac_start,
-        .restart_complete = iwl_mvm_mac_restart_complete,
+        .reconfig_complete = iwl_mvm_mac_reconfig_complete,
         .stop = iwl_mvm_mac_stop,
         .add_interface = iwl_mvm_mac_add_interface,
         .remove_interface = iwl_mvm_mac_remove_interface,
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index 845429c88cf4..d015fac06a62 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -649,7 +649,6 @@ struct iwl_mvm {
         /* -1 for always, 0 for never, >0 for that many times */
         s8 restart_fw;
         struct work_struct fw_error_dump_wk;
-        struct iwl_mvm_dump_ptrs *fw_error_dump;
 
 #ifdef CONFIG_IWLWIFI_LEDS
         struct led_classdev led;
@@ -660,6 +659,10 @@ struct iwl_mvm {
 #ifdef CONFIG_PM_SLEEP
         struct wiphy_wowlan_support wowlan;
         int gtk_ivlen, gtk_icvlen, ptk_ivlen, ptk_icvlen;
+
+        /* sched scan settings for net detect */
+        struct cfg80211_sched_scan_request *nd_config;
+        struct ieee80211_scan_ies *nd_ies;
 #ifdef CONFIG_IWLWIFI_DEBUGFS
         u32 d3_wake_sysassert; /* must be u32 for debugfs_create_bool */
         bool d3_test_active;
@@ -906,8 +909,7 @@ int iwl_mvm_mac_ctxt_add(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
 int iwl_mvm_mac_ctxt_changed(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                              bool force_assoc_off, const u8 *bssid_override);
 int iwl_mvm_mac_ctxt_remove(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
-u32 iwl_mvm_mac_get_queues_mask(struct iwl_mvm *mvm,
-                                struct ieee80211_vif *vif);
+u32 iwl_mvm_mac_get_queues_mask(struct ieee80211_vif *vif);
 int iwl_mvm_mac_ctxt_beacon_changed(struct iwl_mvm *mvm,
                                     struct ieee80211_vif *vif);
 int iwl_mvm_rx_beacon_notif(struct iwl_mvm *mvm,
@@ -950,6 +952,10 @@ int iwl_mvm_config_sched_scan_profiles(struct iwl_mvm *mvm,
                                        struct cfg80211_sched_scan_request *req);
 int iwl_mvm_sched_scan_start(struct iwl_mvm *mvm,
                              struct cfg80211_sched_scan_request *req);
+int iwl_mvm_scan_offload_start(struct iwl_mvm *mvm,
+                               struct ieee80211_vif *vif,
+                               struct cfg80211_sched_scan_request *req,
+                               struct ieee80211_scan_ies *ies);
 int iwl_mvm_scan_offload_stop(struct iwl_mvm *mvm, bool notify);
 int iwl_mvm_rx_scan_offload_results(struct iwl_mvm *mvm,
                                     struct iwl_rx_cmd_buffer *rxb,
@@ -1207,11 +1213,9 @@ void iwl_mvm_recalc_tdls_state(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 void iwl_mvm_mac_mgd_protect_tdls_discover(struct ieee80211_hw *hw,
                                            struct ieee80211_vif *vif);
 
+struct ieee80211_vif *iwl_mvm_get_bss_vif(struct iwl_mvm *mvm);
+
 void iwl_mvm_nic_restart(struct iwl_mvm *mvm, bool fw_error);
-#ifdef CONFIG_IWLWIFI_DEBUGFS
 void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm);
-#else
-static inline void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm) {}
-#endif
 
 #endif /* __IWL_MVM_H__ */
diff --git a/drivers/net/wireless/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwlwifi/mvm/ops.c
index 5b719ee8e789..7a9578567f4f 100644
--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
@@ -403,6 +403,9 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         if (cfg->max_rx_agg_size)
                 hw->max_rx_aggregation_subframes = cfg->max_rx_agg_size;
 
+        if (cfg->max_tx_agg_size)
+                hw->max_tx_aggregation_subframes = cfg->max_tx_agg_size;
+
         op_mode = hw->priv;
         op_mode->ops = &iwl_mvm_ops;
 
@@ -585,16 +588,18 @@ static void iwl_op_mode_mvm_stop(struct iwl_op_mode *op_mode)
         ieee80211_unregister_hw(mvm->hw);
 
         kfree(mvm->scan_cmd);
-        if (mvm->fw_error_dump) {
-                vfree(mvm->fw_error_dump->op_mode_ptr);
-                vfree(mvm->fw_error_dump->trans_ptr);
-                kfree(mvm->fw_error_dump);
-        }
         kfree(mvm->mcast_filter_cmd);
         mvm->mcast_filter_cmd = NULL;
 
 #if defined(CONFIG_PM_SLEEP) && defined(CONFIG_IWLWIFI_DEBUGFS)
         kfree(mvm->d3_resume_sram);
+        if (mvm->nd_config) {
+                kfree(mvm->nd_config->match_sets);
+                kfree(mvm->nd_config);
+                mvm->nd_config = NULL;
+                kfree(mvm->nd_ies);
+                mvm->nd_ies = NULL;
+        }
 #endif
 
         iwl_trans_op_mode_leave(mvm->trans);
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c
index 18a539999580..ce884847cc8a 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
@@ -505,10 +505,11 @@ static const char *rs_pretty_lq_type(enum iwl_table_type type)
 static inline void rs_dump_rate(struct iwl_mvm *mvm, const struct rs_rate *rate,
                                 const char *prefix)
 {
-        IWL_DEBUG_RATE(mvm, "%s: (%s: %d) ANT: %s BW: %d SGI: %d LDPC: %d\n",
+        IWL_DEBUG_RATE(mvm,
+                       "%s: (%s: %d) ANT: %s BW: %d SGI: %d LDPC: %d STBC %d\n",
                        prefix, rs_pretty_lq_type(rate->type),
                        rate->index, rs_pretty_ant(rate->ant),
-                       rate->bw, rate->sgi, rate->ldpc);
+                       rate->bw, rate->sgi, rate->ldpc, rate->stbc);
 }
 
 static void rs_rate_scale_clear_window(struct iwl_rate_scale_data *window)
@@ -741,6 +742,12 @@ static u32 ucode_rate_from_rs_rate(struct iwl_mvm *mvm,
                 IWL_ERR(mvm, "Invalid rate->type %d\n", rate->type);
         }
 
+        if (is_siso(rate) && rate->stbc) {
+                /* To enable STBC we need to set both a flag and ANT_AB */
+                ucode_rate |= RATE_MCS_ANT_AB_MSK;
+                ucode_rate |= RATE_MCS_VHT_STBC_MSK;
+        }
+
         ucode_rate |= rate->bw;
         if (rate->sgi)
                 ucode_rate |= RATE_MCS_SGI_MSK;
@@ -785,6 +792,8 @@ static int rs_rate_from_ucode_rate(const u32 ucode_rate,
                 rate->sgi = true;
         if (ucode_rate & RATE_MCS_LDPC_MSK)
                 rate->ldpc = true;
+        if (ucode_rate & RATE_MCS_VHT_STBC_MSK)
+                rate->stbc = true;
 
         rate->bw = ucode_rate & RATE_MCS_CHAN_WIDTH_MSK;
 
@@ -794,7 +803,7 @@ static int rs_rate_from_ucode_rate(const u32 ucode_rate,
 
                 if (nss == 1) {
                         rate->type = LQ_HT_SISO;
-                        WARN_ON_ONCE(num_of_ant != 1);
+                        WARN_ON_ONCE(!rate->stbc && num_of_ant != 1);
                 } else if (nss == 2) {
                         rate->type = LQ_HT_MIMO2;
                         WARN_ON_ONCE(num_of_ant != 2);
@@ -992,7 +1001,15 @@ static void rs_get_lower_rate_down_column(struct iwl_lq_sta *lq_sta,
 static inline bool rs_rate_match(struct rs_rate *a,
                                  struct rs_rate *b)
 {
-        return (a->type == b->type) && (a->ant == b->ant) && (a->sgi == b->sgi);
+        bool ant_match;
+
+        if (a->stbc)
+                ant_match = (b->ant == ANT_A || b->ant == ANT_B);
+        else
+                ant_match = (a->ant == b->ant);
+
+        return (a->type == b->type) && (a->bw == b->bw) && (a->sgi == b->sgi)
+                && ant_match;
 }
 
 static u32 rs_ch_width_from_mac_flags(enum mac80211_rate_control_flags flags)
@@ -1225,7 +1242,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         IWL_DEBUG_RATE(mvm, "reduced txpower: %d\n", reduced_txp);
 done:
         /* See if there's a better rate or modulation mode to try. */
-        if (sta && sta->supp_rates[info->band])
+        if (sta->supp_rates[info->band])
                 rs_rate_scale_perform(mvm, sta, lq_sta, tid);
 }
 
@@ -1623,6 +1640,8 @@ static int rs_switch_to_column(struct iwl_mvm *mvm,
                 else
                         rate->type = LQ_LEGACY_G;
 
+                rate->bw = RATE_MCS_CHAN_WIDTH_20;
+                rate->ldpc = false;
                 rate_mask = lq_sta->active_legacy_rate;
         } else if (column->mode == RS_SISO) {
                 rate->type = lq_sta->is_vht ? LQ_VHT_SISO : LQ_HT_SISO;
@@ -1634,8 +1653,11 @@ static int rs_switch_to_column(struct iwl_mvm *mvm,
                 WARN_ON_ONCE("Bad column mode");
         }
 
-        rate->bw = rs_bw_from_sta_bw(sta);
-        rate->ldpc = lq_sta->ldpc;
+        if (column->mode != RS_LEGACY) {
+                rate->bw = rs_bw_from_sta_bw(sta);
+                rate->ldpc = lq_sta->ldpc;
+        }
+
         search_tbl->column = col_id;
         rs_set_expected_tpt_table(lq_sta, search_tbl);
 
@@ -1754,6 +1776,29 @@ out:
         return action;
 }
 
+static bool rs_stbc_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+                          struct iwl_lq_sta *lq_sta)
+{
+        struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
+        struct ieee80211_vif *vif = mvmsta->vif;
+        bool sta_ps_disabled = (vif->type == NL80211_IFTYPE_STATION &&
+                                !vif->bss_conf.ps);
+
+        /* Our chip supports Tx STBC and the peer is an HT/VHT STA which
+         * supports STBC of at least 1*SS
+         */
+        if (!lq_sta->stbc)
+                return false;
+
+        if (!mvm->ps_disabled && !sta_ps_disabled)
+                return false;
+
+        if (!iwl_mvm_bt_coex_is_mimo_allowed(mvm, sta))
+                return false;
+
+        return true;
+}
+
 static void rs_get_adjacent_txp(struct iwl_mvm *mvm, int index,
                                 int *weaker, int *stronger)
 {
@@ -2675,6 +2720,11 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                 if (mvm->cfg->ht_params->ldpc &&
                     (ht_cap->cap & IEEE80211_HT_CAP_LDPC_CODING))
                         lq_sta->ldpc = true;
+
+                if (mvm->cfg->ht_params->stbc &&
+                    (num_of_ant(mvm->fw->valid_tx_ant) > 1) &&
+                    (ht_cap->cap & IEEE80211_HT_CAP_RX_STBC))
+                        lq_sta->stbc = true;
         } else {
                 rs_vht_set_enabled_rates(sta, vht_cap, lq_sta);
                 lq_sta->is_vht = true;
@@ -2682,8 +2732,16 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                 if (mvm->cfg->ht_params->ldpc &&
                     (vht_cap->cap & IEEE80211_VHT_CAP_RXLDPC))
                         lq_sta->ldpc = true;
+
+                if (mvm->cfg->ht_params->stbc &&
+                    (num_of_ant(mvm->fw->valid_tx_ant) > 1) &&
+                    (vht_cap->cap & IEEE80211_VHT_CAP_RXSTBC_MASK))
+                        lq_sta->stbc = true;
         }
 
+        if (IWL_MVM_RS_DISABLE_MIMO)
+                lq_sta->active_mimo2_rate = 0;
+
         lq_sta->max_legacy_rate_idx = find_last_bit(&lq_sta->active_legacy_rate,
                                                     BITS_PER_LONG);
         lq_sta->max_siso_rate_idx = find_last_bit(&lq_sta->active_siso_rate,
@@ -2692,11 +2750,11 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                                                    BITS_PER_LONG);
 
         IWL_DEBUG_RATE(mvm,
-                       "RATE MASK: LEGACY=%lX SISO=%lX MIMO2=%lX VHT=%d LDPC=%d\n",
+                       "RATE MASK: LEGACY=%lX SISO=%lX MIMO2=%lX VHT=%d LDPC=%d STBC%d\n",
                        lq_sta->active_legacy_rate,
                        lq_sta->active_siso_rate,
                        lq_sta->active_mimo2_rate,
-                       lq_sta->is_vht, lq_sta->ldpc);
+                       lq_sta->is_vht, lq_sta->ldpc, lq_sta->stbc);
         IWL_DEBUG_RATE(mvm, "MAX RATE: LEGACY=%d SISO=%d MIMO2=%d\n",
                        lq_sta->max_legacy_rate_idx,
                        lq_sta->max_siso_rate_idx,
@@ -2820,6 +2878,7 @@ static void rs_fill_rates_for_column(struct iwl_mvm *mvm,
  * rate[15] 0x800D Legacy | ANT: B Rate: 6 Mbps
  */
 static void rs_build_rates_table(struct iwl_mvm *mvm,
+                                 struct ieee80211_sta *sta,
                                  struct iwl_lq_sta *lq_sta,
                                  const struct rs_rate *initial_rate)
 {
@@ -2832,6 +2891,7 @@ static void rs_build_rates_table(struct iwl_mvm *mvm,
         memcpy(&rate, initial_rate, sizeof(rate));
 
         valid_tx_ant = mvm->fw->valid_tx_ant;
+        rate.stbc = rs_stbc_allow(mvm, sta, lq_sta);
 
         if (is_siso(&rate)) {
                 num_rates = RS_INITIAL_SISO_NUM_RATES;
@@ -2903,7 +2963,7 @@ static void rs_fill_lq_cmd(struct iwl_mvm *mvm,
         if (WARN_ON_ONCE(!sta || !initial_rate))
                 return;
 
-        rs_build_rates_table(mvm, lq_sta, initial_rate);
+        rs_build_rates_table(mvm, sta, lq_sta, initial_rate);
 
         if (num_of_ant(initial_rate->ant) == 1)
                 lq_cmd->single_stream_ant_msk = initial_rate->ant;
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.h b/drivers/net/wireless/iwlwifi/mvm/rs.h
index eb34c1209acc..defd70a6d9e6 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.h
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.h
@@ -208,6 +208,7 @@ struct rs_rate {
         u32 bw;
         bool sgi;
         bool ldpc;
+        bool stbc;
 };
 
 
@@ -331,6 +332,7 @@ struct iwl_lq_sta {
         u64 last_tx;
         bool is_vht;
         bool ldpc;              /* LDPC Rx is supported by the STA */
+        bool stbc;              /* Tx STBC is supported by chip and Rx by STA */
         enum ieee80211_band band;
 
         /* The following are bitmaps of rates; IWL_RATE_6M_MASK, etc. */
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index b280d5d87127..5cd59a43e1da 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -270,7 +270,8 @@ static void iwl_mvm_scan_condition_iterator(void *data, u8 *mac,
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         bool *global_bound = data;
 
-        if (mvmvif->phy_ctxt && mvmvif->phy_ctxt->id < MAX_PHYS)
+        if (vif->type != NL80211_IFTYPE_P2P_DEVICE && mvmvif->phy_ctxt &&
+            mvmvif->phy_ctxt->id < MAX_PHYS)
                 *global_bound = true;
 }
 
@@ -672,6 +673,7 @@ int iwl_mvm_rx_scan_offload_complete_notif(struct iwl_mvm *mvm,
                 mvm->scan_status = IWL_MVM_SCAN_NONE;
                 ieee80211_scan_completed(mvm->hw,
                                          status == IWL_SCAN_OFFLOAD_ABORTED);
+                iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
         }
 
         mvm->last_ebs_successful = !ebs_status;
@@ -1007,6 +1009,31 @@ int iwl_mvm_sched_scan_start(struct iwl_mvm *mvm,
                                     sizeof(scan_req), &scan_req);
 }
 
+int iwl_mvm_scan_offload_start(struct iwl_mvm *mvm,
+                               struct ieee80211_vif *vif,
+                               struct cfg80211_sched_scan_request *req,
+                               struct ieee80211_scan_ies *ies)
+{
+        int ret;
+
+        if ((mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_LMAC_SCAN)) {
+                ret = iwl_mvm_config_sched_scan_profiles(mvm, req);
+                if (ret)
+                        return ret;
+                ret = iwl_mvm_unified_sched_scan_lmac(mvm, vif, req, ies);
+        } else {
+                ret = iwl_mvm_config_sched_scan(mvm, vif, req, ies);
+                if (ret)
+                        return ret;
+                ret = iwl_mvm_config_sched_scan_profiles(mvm, req);
+                if (ret)
+                        return ret;
+                ret = iwl_mvm_sched_scan_start(mvm, req);
+        }
+
+        return ret;
+}
+
 static int iwl_mvm_send_scan_offload_abort(struct iwl_mvm *mvm)
 {
         int ret;
@@ -1081,8 +1108,12 @@ int iwl_mvm_scan_offload_stop(struct iwl_mvm *mvm, bool notify)
         /*
          * Clear the scan status so the next scan requests will succeed. This
          * also ensures the Rx handler doesn't do anything, as the scan was
-         * stopped from above.
+         * stopped from above. Since the rx handler won't do anything now,
+         * we have to release the scan reference here.
          */
+        if (mvm->scan_status == IWL_MVM_SCAN_OS)
+                iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
+
         mvm->scan_status = IWL_MVM_SCAN_NONE;
 
         if (notify) {
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
index 1731c205c81d..dd0dc5bf8583 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
@@ -609,7 +609,7 @@ int iwl_mvm_alloc_bcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 
         lockdep_assert_held(&mvm->mutex);
 
-        qmask = iwl_mvm_mac_get_queues_mask(mvm, vif);
+        qmask = iwl_mvm_mac_get_queues_mask(vif);
 
         /*
          * The firmware defines the TFD queue mask to only be relevant
diff --git a/drivers/net/wireless/iwlwifi/mvm/tt.c b/drivers/net/wireless/iwlwifi/mvm/tt.c
index acca44a45086..d4f2c29025c7 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tt.c
@@ -64,10 +64,6 @@
  *****************************************************************************/
 
 #include "mvm.h"
-#include "iwl-config.h"
-#include "iwl-io.h"
-#include "iwl-csr.h"
-#include "iwl-prph.h"
 
 #define IWL_MVM_TEMP_NOTIF_WAIT_TIMEOUT HZ
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index c6a517c771df..8d848735cdb8 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -189,8 +189,10 @@ static void iwl_mvm_set_tx_cmd_rate(struct iwl_mvm *mvm,
 
         /* HT rate doesn't make sense for a non data frame */
         WARN_ONCE(info->control.rates[0].flags & IEEE80211_TX_RC_MCS,
-                  "Got an HT rate for a non data frame 0x%x\n",
-                  info->control.rates[0].flags);
+                  "Got an HT rate (flags:0x%x/mcs:%d) for a non data frame (fc:0x%x)\n",
+                  info->control.rates[0].flags,
+                  info->control.rates[0].idx,
+                  le16_to_cpu(fc));
 
         rate_idx = info->control.rates[0].idx;
         /* if the rate isn't a well known legacy rate, take the lowest one */
diff --git a/drivers/net/wireless/iwlwifi/mvm/utils.c b/drivers/net/wireless/iwlwifi/mvm/utils.c
index 8021f6eec27f..e56e77ef5d2e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/utils.c
+++ b/drivers/net/wireless/iwlwifi/mvm/utils.c
@@ -734,3 +734,40 @@ bool iwl_mvm_is_idle(struct iwl_mvm *mvm)
 
         return idle;
 }
+
+struct iwl_bss_iter_data {
+        struct ieee80211_vif *vif;
+        bool error;
+};
+
+static void iwl_mvm_bss_iface_iterator(void *_data, u8 *mac,
+                                       struct ieee80211_vif *vif)
+{
+        struct iwl_bss_iter_data *data = _data;
+
+        if (vif->type != NL80211_IFTYPE_STATION || vif->p2p)
+                return;
+
+        if (data->vif) {
+                data->error = true;
+                return;
+        }
+
+        data->vif = vif;
+}
+
+struct ieee80211_vif *iwl_mvm_get_bss_vif(struct iwl_mvm *mvm)
+{
+        struct iwl_bss_iter_data bss_iter_data = {};
+
+        ieee80211_iterate_active_interfaces_atomic(
+                mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
+                iwl_mvm_bss_iface_iterator, &bss_iter_data);
+
+        if (bss_iter_data.error) {
+                IWL_ERR(mvm, "More than one managed interface active!\n");
+                return ERR_PTR(-EINVAL);
+        }
+
+        return bss_iter_data.vif;
+}
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 160c3ebc48d0..836725e92687 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -133,7 +133,7 @@ static void iwl_pcie_alloc_fw_monitor(struct iwl_trans *trans)
                 break;
         }
 
-        if (!page)
+        if (WARN_ON_ONCE(!page))
                 return;
 
         trans_pcie->fw_mon_page = page;
@@ -747,14 +747,11 @@ static int iwl_pcie_load_given_ucode(struct iwl_trans *trans,
         int first_ucode_section;
 
         IWL_DEBUG_FW(trans,
-                     "working with %s image\n",
-                     image->is_secure ? "Secured" : "Non Secured");
-        IWL_DEBUG_FW(trans,
                      "working with %s CPU\n",
                      image->is_dual_cpus ? "Dual" : "Single");
 
         /* configure the ucode to be ready to get the secured image */
-        if (image->is_secure) {
+        if (iwl_has_secure_boot(trans->hw_rev, trans->cfg->device_family)) {
                 /* set secure boot inspector addresses */
                 iwl_write_prph(trans,
                                LMPM_SECURE_INSPECTOR_CODE_ADDR,
@@ -790,7 +787,8 @@ static int iwl_pcie_load_given_ucode(struct iwl_trans *trans,
                                LMPM_SECURE_CPU2_HDR_MEM_SPACE);
 
                 /* load to FW the binary sections of CPU2 */
-                if (image->is_secure)
+                if (iwl_has_secure_boot(trans->hw_rev,
+                                        trans->cfg->device_family))
                         ret = iwl_pcie_load_cpu_secured_sections(
                                                         trans, image, 2,
                                                         &first_ucode_section);
@@ -821,7 +819,7 @@ static int iwl_pcie_load_given_ucode(struct iwl_trans *trans,
         else
                 iwl_write32(trans, CSR_RESET, 0);
 
-        if (image->is_secure) {
+        if (iwl_has_secure_boot(trans->hw_rev, trans->cfg->device_family)) {
                 /* wait for image verification to complete  */
                 ret = iwl_poll_prph_bit(trans,
                                         LMPM_SECURE_BOOT_CPU1_STATUS_ADDR,
@@ -1023,14 +1021,6 @@ static int iwl_trans_pcie_d3_resume(struct iwl_trans *trans,
                 return 0;
         }
 
-        iwl_pcie_set_pwr(trans, false);
-
-        val = iwl_read32(trans, CSR_RESET);
-        if (val & CSR_RESET_REG_FLAG_NEVO_RESET) {
-                *status = IWL_D3_STATUS_RESET;
-                return 0;
-        }
-
         /*
          * Also enables interrupts - none will happen as the device doesn't
          * know we're waking it up, only when the opmode actually tells it
@@ -1050,6 +1040,8 @@ static int iwl_trans_pcie_d3_resume(struct iwl_trans *trans,
                 return ret;
         }
 
+        iwl_pcie_set_pwr(trans, false);
+
         iwl_trans_pcie_tx_reset(trans);
 
         ret = iwl_pcie_rx_init(trans);
@@ -1058,7 +1050,12 @@ static int iwl_trans_pcie_d3_resume(struct iwl_trans *trans,
                 return ret;
         }
 
-        *status = IWL_D3_STATUS_ALIVE;
+        val = iwl_read32(trans, CSR_RESET);
+        if (val & CSR_RESET_REG_FLAG_NEVO_RESET)
+                *status = IWL_D3_STATUS_RESET;
+        else
+                *status = IWL_D3_STATUS_ALIVE;
+
         return 0;
 }
 
@@ -1767,6 +1764,13 @@ err:
         IWL_ERR(trans, "failed to create the trans debugfs entry\n");
         return -ENOMEM;
 }
+#else
+static int iwl_trans_pcie_dbgfs_register(struct iwl_trans *trans,
+                                         struct dentry *dir)
+{
+        return 0;
+}
+#endif /*CONFIG_IWLWIFI_DEBUGFS */
 
 static u32 iwl_trans_pcie_get_cmdlen(struct iwl_tfd *tfd)
 {
@@ -2045,13 +2049,6 @@ struct iwl_trans_dump_data *iwl_trans_pcie_dump_data(struct iwl_trans *trans)
 
         return dump_data;
 }
-#else
-static int iwl_trans_pcie_dbgfs_register(struct iwl_trans *trans,
-                                         struct dentry *dir)
-{
-        return 0;
-}
-#endif /*CONFIG_IWLWIFI_DEBUGFS */
 
 static const struct iwl_trans_ops trans_ops_pcie = {
         .start_hw = iwl_trans_pcie_start_hw,
@@ -2088,9 +2085,7 @@ static const struct iwl_trans_ops trans_ops_pcie = {
         .release_nic_access = iwl_trans_pcie_release_nic_access,
         .set_bits_mask = iwl_trans_pcie_set_bits_mask,
 
-#ifdef CONFIG_IWLWIFI_DEBUGFS
         .dump_data = iwl_trans_pcie_dump_data,
-#endif
 };
 
 struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index c9ad4cf1adfb..77fbf3035038 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -412,6 +412,9 @@ struct mac80211_hwsim_data {
         struct mac_address addresses[2];
         int channels, idx;
         bool use_chanctx;
+        bool destroy_on_close;
+        struct work_struct destroy_work;
+        u32 portid;
 
         struct ieee80211_channel *tmp_chan;
         struct delayed_work roc_done;
@@ -436,7 +439,7 @@ struct mac80211_hwsim_data {
         /*
          * Only radios in the same group can communicate together (the
          * channel has to match too). Each bit represents a group. A
-         * radio can be in more then one group.
+         * radio can be in more than one group.
          */
         u64 group;
 
@@ -447,6 +450,14 @@ struct mac80211_hwsim_data {
         s64 bcn_delta;
         /* absolute beacon transmission time. Used to cover up "tx" delay. */
         u64 abs_bcn_ts;
+
+        /* Stats */
+        u64 tx_pkts;
+        u64 rx_pkts;
+        u64 tx_bytes;
+        u64 rx_bytes;
+        u64 tx_dropped;
+        u64 tx_failed;
 };
 
 
@@ -476,6 +487,14 @@ static struct genl_family hwsim_genl_family = {
         .maxattr = HWSIM_ATTR_MAX,
 };
 
+enum hwsim_multicast_groups {
+        HWSIM_MCGRP_CONFIG,
+};
+
+static const struct genl_multicast_group hwsim_mcgrps[] = {
+        [HWSIM_MCGRP_CONFIG] = { .name = "config", },
+};
+
 /* MAC80211_HWSIM netlink policy */
 
 static const struct nla_policy hwsim_genl_policy[HWSIM_ATTR_MAX + 1] = {
@@ -496,6 +515,10 @@ static const struct nla_policy hwsim_genl_policy[HWSIM_ATTR_MAX + 1] = {
         [HWSIM_ATTR_REG_CUSTOM_REG] = { .type = NLA_U32 },
         [HWSIM_ATTR_REG_STRICT_REG] = { .type = NLA_FLAG },
         [HWSIM_ATTR_SUPPORT_P2P_DEVICE] = { .type = NLA_FLAG },
+        [HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE] = { .type = NLA_FLAG },
+        [HWSIM_ATTR_RADIO_NAME] = { .type = NLA_STRING },
+        [HWSIM_ATTR_NO_VIF] = { .type = NLA_FLAG },
+        [HWSIM_ATTR_FREQ] = { .type = NLA_U32 },
 };
 
 static void mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
@@ -861,8 +884,10 @@ static void mac80211_hwsim_tx_frame_nl(struct ieee80211_hw *hw,
         /* If the queue contains MAX_QUEUE skb's drop some */
         if (skb_queue_len(&data->pending) >= MAX_QUEUE) {
                 /* Droping until WARN_QUEUE level */
-                while (skb_queue_len(&data->pending) >= WARN_QUEUE)
-                        skb_dequeue(&data->pending);
+                while (skb_queue_len(&data->pending) >= WARN_QUEUE) {
+                        ieee80211_free_txskb(hw, skb_dequeue(&data->pending));
+                        data->tx_dropped++;
+                }
         }
 
         skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_ATOMIC);
@@ -896,6 +921,9 @@ static void mac80211_hwsim_tx_frame_nl(struct ieee80211_hw *hw,
         if (nla_put_u32(skb, HWSIM_ATTR_FLAGS, hwsim_flags))
                 goto nla_put_failure;
 
+        if (nla_put_u32(skb, HWSIM_ATTR_FREQ, data->channel->center_freq))
+                goto nla_put_failure;
+
         /* We get the tx control (rate and retries) info*/
 
         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
@@ -917,10 +945,14 @@ static void mac80211_hwsim_tx_frame_nl(struct ieee80211_hw *hw,
 
         /* Enqueue the packet */
         skb_queue_tail(&data->pending, my_skb);
+        data->tx_pkts++;
+        data->tx_bytes += my_skb->len;
         return;
 
 nla_put_failure:
         printk(KERN_DEBUG "mac80211_hwsim: error occurred in %s\n", __func__);
+        ieee80211_free_txskb(hw, my_skb);
+        data->tx_failed++;
 }
 
 static bool hwsim_chans_compat(struct ieee80211_channel *c1,
@@ -1066,6 +1098,8 @@ static bool mac80211_hwsim_tx_frame_no_nl(struct ieee80211_hw *hw,
                 rx_status.mactime = now + data2->tsf_offset;
 
                 memcpy(IEEE80211_SKB_RXCB(nskb), &rx_status, sizeof(rx_status));
+                data2->rx_pkts++;
+                data2->rx_bytes += nskb->len;
                 ieee80211_rx_irqsafe(data2->hw, nskb);
         }
         spin_unlock(&hwsim_radio_lock);
@@ -1133,6 +1167,8 @@ static void mac80211_hwsim_tx(struct ieee80211_hw *hw,
                 return mac80211_hwsim_tx_frame_nl(hw, skb, _portid);
 
         /* NO wmediumd detected, perfect medium simulation */
+        data->tx_pkts++;
+        data->tx_bytes += skb->len;
         ack = mac80211_hwsim_tx_frame_no_nl(hw, skb, channel);
 
         if (ack && skb->len >= 16) {
@@ -1916,6 +1952,57 @@ static void mac80211_hwsim_unassign_vif_chanctx(struct ieee80211_hw *hw,
         hwsim_check_chanctx_magic(ctx);
 }
 
+static const char mac80211_hwsim_gstrings_stats[][ETH_GSTRING_LEN] = {
+        "tx_pkts_nic",
+        "tx_bytes_nic",
+        "rx_pkts_nic",
+        "rx_bytes_nic",
+        "d_tx_dropped",
+        "d_tx_failed",
+        "d_ps_mode",
+        "d_group",
+        "d_tx_power",
+};
+
+#define MAC80211_HWSIM_SSTATS_LEN ARRAY_SIZE(mac80211_hwsim_gstrings_stats)
+
+static void mac80211_hwsim_get_et_strings(struct ieee80211_hw *hw,
+                                          struct ieee80211_vif *vif,
+                                          u32 sset, u8 *data)
+{
+        if (sset == ETH_SS_STATS)
+                memcpy(data, *mac80211_hwsim_gstrings_stats,
+                       sizeof(mac80211_hwsim_gstrings_stats));
+}
+
+static int mac80211_hwsim_get_et_sset_count(struct ieee80211_hw *hw,
+                                            struct ieee80211_vif *vif, int sset)
+{
+        if (sset == ETH_SS_STATS)
+                return MAC80211_HWSIM_SSTATS_LEN;
+        return 0;
+}
+
+static void mac80211_hwsim_get_et_stats(struct ieee80211_hw *hw,
+                                        struct ieee80211_vif *vif,
+                                        struct ethtool_stats *stats, u64 *data)
+{
+        struct mac80211_hwsim_data *ar = hw->priv;
+        int i = 0;
+
+        data[i++] = ar->tx_pkts;
+        data[i++] = ar->tx_bytes;
+        data[i++] = ar->rx_pkts;
+        data[i++] = ar->rx_bytes;
+        data[i++] = ar->tx_dropped;
+        data[i++] = ar->tx_failed;
+        data[i++] = ar->ps;
+        data[i++] = ar->group;
+        data[i++] = ar->power_level;
+
+        WARN_ON(i != MAC80211_HWSIM_SSTATS_LEN);
+}
+
 static const struct ieee80211_ops mac80211_hwsim_ops = {
         .tx = mac80211_hwsim_tx,
         .start = mac80211_hwsim_start,
@@ -1939,14 +2026,131 @@ static const struct ieee80211_ops mac80211_hwsim_ops = {
         .flush = mac80211_hwsim_flush,
         .get_tsf = mac80211_hwsim_get_tsf,
         .set_tsf = mac80211_hwsim_set_tsf,
+        .get_et_sset_count = mac80211_hwsim_get_et_sset_count,
+        .get_et_stats = mac80211_hwsim_get_et_stats,
+        .get_et_strings = mac80211_hwsim_get_et_strings,
 };
 
 static struct ieee80211_ops mac80211_hwsim_mchan_ops;
 
-static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
-                                       const struct ieee80211_regdomain *regd,
-                                       bool reg_strict, bool p2p_device,
-                                       bool use_chanctx)
+struct hwsim_new_radio_params {
+        unsigned int channels;
+        const char *reg_alpha2;
+        const struct ieee80211_regdomain *regd;
+        bool reg_strict;
+        bool p2p_device;
+        bool use_chanctx;
+        bool destroy_on_close;
+        const char *hwname;
+        bool no_vif;
+};
+
+static void hwsim_mcast_config_msg(struct sk_buff *mcast_skb,
+                                   struct genl_info *info)
+{
+        if (info)
+                genl_notify(&hwsim_genl_family, mcast_skb,
+                            genl_info_net(info), info->snd_portid,
+                            HWSIM_MCGRP_CONFIG, info->nlhdr, GFP_KERNEL);
+        else
+                genlmsg_multicast(&hwsim_genl_family, mcast_skb, 0,
+                                  HWSIM_MCGRP_CONFIG, GFP_KERNEL);
+}
+
+static struct sk_buff *build_radio_msg(int cmd, int id,
+                                       struct hwsim_new_radio_params *param)
+{
+        struct sk_buff *skb;
+        void *data;
+        int ret;
+
+        skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!skb)
+                return NULL;
+
+        data = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0, cmd);
+        if (!data)
+                goto error;
+
+        ret = nla_put_u32(skb, HWSIM_ATTR_RADIO_ID, id);
+        if (ret < 0)
+                goto error;
+
+        if (param->channels) {
+                ret = nla_put_u32(skb, HWSIM_ATTR_CHANNELS, param->channels);
+                if (ret < 0)
+                        goto error;
+        }
+
+        if (param->reg_alpha2) {
+                ret = nla_put(skb, HWSIM_ATTR_REG_HINT_ALPHA2, 2,
+                              param->reg_alpha2);
+                if (ret < 0)
+                        goto error;
+        }
+
+        if (param->regd) {
+                int i;
+
+                for (i = 0; hwsim_world_regdom_custom[i] != param->regd &&
+                     i < ARRAY_SIZE(hwsim_world_regdom_custom); i++)
+                        ;
+
+                if (i < ARRAY_SIZE(hwsim_world_regdom_custom)) {
+                        ret = nla_put_u32(skb, HWSIM_ATTR_REG_CUSTOM_REG, i);
+                        if (ret < 0)
+                                goto error;
+                }
+        }
+
+        if (param->reg_strict) {
+                ret = nla_put_flag(skb, HWSIM_ATTR_REG_STRICT_REG);
+                if (ret < 0)
+                        goto error;
+        }
+
+        if (param->p2p_device) {
+                ret = nla_put_flag(skb, HWSIM_ATTR_SUPPORT_P2P_DEVICE);
+                if (ret < 0)
+                        goto error;
+        }
+
+        if (param->use_chanctx) {
+                ret = nla_put_flag(skb, HWSIM_ATTR_USE_CHANCTX);
+                if (ret < 0)
+                        goto error;
+        }
+
+        if (param->hwname) {
+                ret = nla_put(skb, HWSIM_ATTR_RADIO_NAME,
+                              strlen(param->hwname), param->hwname);
+                if (ret < 0)
+                        goto error;
+        }
+
+        genlmsg_end(skb, data);
+
+        return skb;
+
+error:
+        nlmsg_free(skb);
+        return NULL;
+}
+
+static void hswim_mcast_new_radio(int id, struct genl_info *info,
+                                  struct hwsim_new_radio_params *param)
+{
+        struct sk_buff *mcast_skb;
+
+        mcast_skb = build_radio_msg(HWSIM_CMD_NEW_RADIO, id, param);
+        if (!mcast_skb)
+                return;
+
+        hwsim_mcast_config_msg(mcast_skb, info);
+}
+
+static int mac80211_hwsim_new_radio(struct genl_info *info,
+                                    struct hwsim_new_radio_params *param)
 {
         int err;
         u8 addr[ETH_ALEN];
@@ -1956,16 +2160,16 @@ static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
         const struct ieee80211_ops *ops = &mac80211_hwsim_ops;
         int idx;
 
-        if (WARN_ON(channels > 1 && !use_chanctx))
+        if (WARN_ON(param->channels > 1 && !param->use_chanctx))
                 return -EINVAL;
 
         spin_lock_bh(&hwsim_radio_lock);
         idx = hwsim_radio_idx++;
         spin_unlock_bh(&hwsim_radio_lock);
 
-        if (use_chanctx)
+        if (param->use_chanctx)
                 ops = &mac80211_hwsim_mchan_ops;
-        hw = ieee80211_alloc_hw(sizeof(*data), ops);
+        hw = ieee80211_alloc_hw_nm(sizeof(*data), ops, param->hwname);
         if (!hw) {
                 printk(KERN_DEBUG "mac80211_hwsim: ieee80211_alloc_hw failed\n");
                 err = -ENOMEM;
@@ -2003,9 +2207,12 @@ static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
         hw->wiphy->n_addresses = 2;
         hw->wiphy->addresses = data->addresses;
 
-        data->channels = channels;
-        data->use_chanctx = use_chanctx;
+        data->channels = param->channels;
+        data->use_chanctx = param->use_chanctx;
         data->idx = idx;
+        data->destroy_on_close = param->destroy_on_close;
+        if (info)
+                data->portid = info->snd_portid;
 
         if (data->use_chanctx) {
                 hw->wiphy->max_scan_ssids = 255;
@@ -2014,12 +2221,12 @@ static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
                 /* For channels > 1 DFS is not allowed */
                 hw->wiphy->n_iface_combinations = 1;
                 hw->wiphy->iface_combinations = &data->if_combination;
-                if (p2p_device)
+                if (param->p2p_device)
                         data->if_combination = hwsim_if_comb_p2p_dev[0];
                 else
                         data->if_combination = hwsim_if_comb[0];
                 data->if_combination.num_different_channels = data->channels;
-        } else if (p2p_device) {
+        } else if (param->p2p_device) {
                 hw->wiphy->iface_combinations = hwsim_if_comb_p2p_dev;
                 hw->wiphy->n_iface_combinations =
                         ARRAY_SIZE(hwsim_if_comb_p2p_dev);
@@ -2040,7 +2247,7 @@ static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
                                      BIT(NL80211_IFTYPE_ADHOC) |
                                      BIT(NL80211_IFTYPE_MESH_POINT);
 
-        if (p2p_device)
+        if (param->p2p_device)
                 hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_DEVICE);
 
         hw->flags = IEEE80211_HW_MFP_CAPABLE |
@@ -2095,6 +2302,7 @@ static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
                 sband->ht_cap.ht_supported = true;
                 sband->ht_cap.cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
                                     IEEE80211_HT_CAP_GRN_FLD |
+                                    IEEE80211_HT_CAP_SGI_20 |
                                     IEEE80211_HT_CAP_SGI_40 |
                                     IEEE80211_HT_CAP_DSSSCCK40;
                 sband->ht_cap.ampdu_factor = 0x3;
@@ -2142,15 +2350,18 @@ static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
         hw->max_rates = 4;
         hw->max_rate_tries = 11;
 
-        if (reg_strict)
+        if (param->reg_strict)
                 hw->wiphy->regulatory_flags |= REGULATORY_STRICT_REG;
-        if (regd) {
+        if (param->regd) {
                 hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
-                wiphy_apply_custom_regulatory(hw->wiphy, regd);
+                wiphy_apply_custom_regulatory(hw->wiphy, param->regd);
                 /* give the regulatory workqueue a chance to run */
                 schedule_timeout_interruptible(1);
         }
 
+        if (param->no_vif)
+                hw->flags |= IEEE80211_HW_NO_AUTO_VIF;
+
         err = ieee80211_register_hw(hw);
         if (err < 0) {
                 printk(KERN_DEBUG "mac80211_hwsim: ieee80211_register_hw failed (%d)\n",
@@ -2160,8 +2371,8 @@ static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
 
         wiphy_debug(hw->wiphy, "hwaddr %pM registered\n", hw->wiphy->perm_addr);
 
-        if (reg_alpha2)
-                regulatory_hint(hw->wiphy, reg_alpha2);
+        if (param->reg_alpha2)
+                regulatory_hint(hw->wiphy, param->reg_alpha2);
 
         data->debugfs = debugfs_create_dir("hwsim", hw->wiphy->debugfsdir);
         debugfs_create_file("ps", 0666, data->debugfs, data, &hwsim_fops_ps);
@@ -2180,6 +2391,9 @@ static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
         list_add_tail(&data->list, &hwsim_radios);
         spin_unlock_bh(&hwsim_radio_lock);
 
+        if (idx > 0)
+                hswim_mcast_new_radio(idx, info, param);
+
         return idx;
 
 failed_hw:
@@ -2192,8 +2406,48 @@ failed:
         return err;
 }
 
-static void mac80211_hwsim_destroy_radio(struct mac80211_hwsim_data *data)
+static void hwsim_mcast_del_radio(int id, const char *hwname,
+                                  struct genl_info *info)
+{
+        struct sk_buff *skb;
+        void *data;
+        int ret;
+
+        skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!skb)
+                return;
+
+        data = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
+                           HWSIM_CMD_DEL_RADIO);
+        if (!data)
+                goto error;
+
+        ret = nla_put_u32(skb, HWSIM_ATTR_RADIO_ID, id);
+        if (ret < 0)
+                goto error;
+
+        if (hwname) {
+                ret = nla_put(skb, HWSIM_ATTR_RADIO_NAME, strlen(hwname),
+                              hwname);
+                if (ret < 0)
+                        goto error;
+        }
+
+        genlmsg_end(skb, data);
+
+        hwsim_mcast_config_msg(skb, info);
+
+        return;
+
+error:
+        nlmsg_free(skb);
+}
+
+static void mac80211_hwsim_del_radio(struct mac80211_hwsim_data *data,
+                                     const char *hwname,
+                                     struct genl_info *info)
 {
+        hwsim_mcast_del_radio(data->idx, hwname, info);
         debugfs_remove_recursive(data->debugfs);
         ieee80211_unregister_hw(data->hw);
         device_release_driver(data->dev);
@@ -2211,7 +2465,7 @@ static void mac80211_hwsim_free(void)
                                                 list))) {
                 list_del(&data->list);
                 spin_unlock_bh(&hwsim_radio_lock);
-                mac80211_hwsim_destroy_radio(data);
+                mac80211_hwsim_del_radio(data, NULL, NULL);
                 spin_lock_bh(&hwsim_radio_lock);
         }
         spin_unlock_bh(&hwsim_radio_lock);
@@ -2339,7 +2593,6 @@ out:
 static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
                                           struct genl_info *info)
 {
-
         struct mac80211_hwsim_data *data2;
         struct ieee80211_rx_status rx_status;
         const u8 *dst;
@@ -2382,18 +2635,22 @@ static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
 
         /* A frame is received from user space */
         memset(&rx_status, 0, sizeof(rx_status));
+        /* TODO: Check ATTR_FREQ if it exists, and maybe throw away off-channel
+         * packets?
+         */
         rx_status.freq = data2->channel->center_freq;
         rx_status.band = data2->channel->band;
         rx_status.rate_idx = nla_get_u32(info->attrs[HWSIM_ATTR_RX_RATE]);
         rx_status.signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
 
         memcpy(IEEE80211_SKB_RXCB(skb), &rx_status, sizeof(rx_status));
+        data2->rx_pkts++;
+        data2->rx_bytes += skb->len;
         ieee80211_rx_irqsafe(data2->hw, skb);
 
         return 0;
 err:
         printk(KERN_DEBUG "mac80211_hwsim: error occurred in %s\n", __func__);
-        goto out;
 out:
         dev_kfree_skb(skb);
         return -EINVAL;
@@ -2429,54 +2686,72 @@ static int hwsim_register_received_nl(struct sk_buff *skb_2,
         return 0;
 }
 
-static int hwsim_create_radio_nl(struct sk_buff *msg, struct genl_info *info)
+static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
 {
-        unsigned int chans = channels;
-        const char *alpha2 = NULL;
-        const struct ieee80211_regdomain *regd = NULL;
-        bool reg_strict = info->attrs[HWSIM_ATTR_REG_STRICT_REG];
-        bool p2p_device = info->attrs[HWSIM_ATTR_SUPPORT_P2P_DEVICE];
-        bool use_chanctx;
+        struct hwsim_new_radio_params param = { 0 };
+
+        param.reg_strict = info->attrs[HWSIM_ATTR_REG_STRICT_REG];
+        param.p2p_device = info->attrs[HWSIM_ATTR_SUPPORT_P2P_DEVICE];
+        param.channels = channels;
+        param.destroy_on_close =
+                info->attrs[HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE];
 
         if (info->attrs[HWSIM_ATTR_CHANNELS])
-                chans = nla_get_u32(info->attrs[HWSIM_ATTR_CHANNELS]);
+                param.channels = nla_get_u32(info->attrs[HWSIM_ATTR_CHANNELS]);
+
+        if (info->attrs[HWSIM_ATTR_NO_VIF])
+                param.no_vif = true;
+
+        if (info->attrs[HWSIM_ATTR_RADIO_NAME])
+                param.hwname = nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]);
 
         if (info->attrs[HWSIM_ATTR_USE_CHANCTX])
-                use_chanctx = true;
+                param.use_chanctx = true;
         else
-                use_chanctx = (chans > 1);
+                param.use_chanctx = (param.channels > 1);
 
         if (info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2])
-                alpha2 = nla_data(info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2]);
+                param.reg_alpha2 =
+                        nla_data(info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2]);
 
         if (info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]) {
                 u32 idx = nla_get_u32(info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]);
 
                 if (idx >= ARRAY_SIZE(hwsim_world_regdom_custom))
                         return -EINVAL;
-                regd = hwsim_world_regdom_custom[idx];
+                param.regd = hwsim_world_regdom_custom[idx];
         }
 
-        return mac80211_hwsim_create_radio(chans, alpha2, regd, reg_strict,
-                                           p2p_device, use_chanctx);
+        return mac80211_hwsim_new_radio(info, &param);
 }
 
-static int hwsim_destroy_radio_nl(struct sk_buff *msg, struct genl_info *info)
+static int hwsim_del_radio_nl(struct sk_buff *msg, struct genl_info *info)
 {
         struct mac80211_hwsim_data *data;
-        int idx;
+        s64 idx = -1;
+        const char *hwname = NULL;
 
-        if (!info->attrs[HWSIM_ATTR_RADIO_ID])
+        if (info->attrs[HWSIM_ATTR_RADIO_ID])
+                idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
+        else if (info->attrs[HWSIM_ATTR_RADIO_NAME])
+                hwname = (void *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]);
+        else
                 return -EINVAL;
-        idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
 
         spin_lock_bh(&hwsim_radio_lock);
         list_for_each_entry(data, &hwsim_radios, list) {
-                if (data->idx != idx)
-                        continue;
+                if (idx >= 0) {
+                        if (data->idx != idx)
+                                continue;
+                } else {
+                        if (hwname &&
+                            strcmp(hwname, wiphy_name(data->hw->wiphy)))
+                                continue;
+                }
+
                 list_del(&data->list);
                 spin_unlock_bh(&hwsim_radio_lock);
-                mac80211_hwsim_destroy_radio(data);
+                mac80211_hwsim_del_radio(data, hwname, info);
                 return 0;
         }
         spin_unlock_bh(&hwsim_radio_lock);
@@ -2503,19 +2778,42 @@ static const struct genl_ops hwsim_ops[] = {
                 .doit = hwsim_tx_info_frame_received_nl,
         },
         {
-                .cmd = HWSIM_CMD_CREATE_RADIO,
+                .cmd = HWSIM_CMD_NEW_RADIO,
                 .policy = hwsim_genl_policy,
-                .doit = hwsim_create_radio_nl,
+                .doit = hwsim_new_radio_nl,
                 .flags = GENL_ADMIN_PERM,
         },
         {
-                .cmd = HWSIM_CMD_DESTROY_RADIO,
+                .cmd = HWSIM_CMD_DEL_RADIO,
                 .policy = hwsim_genl_policy,
-                .doit = hwsim_destroy_radio_nl,
+                .doit = hwsim_del_radio_nl,
                 .flags = GENL_ADMIN_PERM,
         },
 };
 
+static void destroy_radio(struct work_struct *work)
+{
+        struct mac80211_hwsim_data *data =
+                container_of(work, struct mac80211_hwsim_data, destroy_work);
+
+        mac80211_hwsim_del_radio(data, NULL, NULL);
+}
+
+static void remove_user_radios(u32 portid)
+{
+        struct mac80211_hwsim_data *entry, *tmp;
+
+        spin_lock_bh(&hwsim_radio_lock);
+        list_for_each_entry_safe(entry, tmp, &hwsim_radios, list) {
+                if (entry->destroy_on_close && entry->portid == portid) {
+                        list_del(&entry->list);
+                        INIT_WORK(&entry->destroy_work, destroy_radio);
+                        schedule_work(&entry->destroy_work);
+                }
+        }
+        spin_unlock_bh(&hwsim_radio_lock);
+}
+
 static int mac80211_hwsim_netlink_notify(struct notifier_block *nb,
                                          unsigned long state,
                                          void *_notify)
@@ -2525,6 +2823,8 @@ static int mac80211_hwsim_netlink_notify(struct notifier_block *nb,
         if (state != NETLINK_URELEASE)
                 return NOTIFY_DONE;
 
+        remove_user_radios(notify->portid);
+
         if (notify->portid == wmediumd_portid) {
                 printk(KERN_INFO "mac80211_hwsim: wmediumd released netlink"
                        " socket, switching to perfect channel medium\n");
@@ -2544,7 +2844,9 @@ static int hwsim_init_netlink(void)
 
         printk(KERN_INFO "mac80211_hwsim: initializing netlink\n");
 
-        rc = genl_register_family_with_ops(&hwsim_genl_family, hwsim_ops);
+        rc = genl_register_family_with_ops_groups(&hwsim_genl_family,
+                                                  hwsim_ops,
+                                                  hwsim_mcgrps);
         if (rc)
                 goto failure;
 
@@ -2605,69 +2907,73 @@ static int __init init_mac80211_hwsim(void)
                 goto out_unregister_driver;
         }
 
+        err = hwsim_init_netlink();
+        if (err < 0)
+                goto out_unregister_driver;
+
         for (i = 0; i < radios; i++) {
-                const char *reg_alpha2 = NULL;
-                const struct ieee80211_regdomain *regd = NULL;
-                bool reg_strict = false;
+                struct hwsim_new_radio_params param = { 0 };
+
+                param.channels = channels;
 
                 switch (regtest) {
                 case HWSIM_REGTEST_DIFF_COUNTRY:
                         if (i < ARRAY_SIZE(hwsim_alpha2s))
-                                reg_alpha2 = hwsim_alpha2s[i];
+                                param.reg_alpha2 = hwsim_alpha2s[i];
                         break;
                 case HWSIM_REGTEST_DRIVER_REG_FOLLOW:
                         if (!i)
-                                reg_alpha2 = hwsim_alpha2s[0];
+                                param.reg_alpha2 = hwsim_alpha2s[0];
                         break;
                 case HWSIM_REGTEST_STRICT_ALL:
-                        reg_strict = true;
+                        param.reg_strict = true;
                 case HWSIM_REGTEST_DRIVER_REG_ALL:
-                        reg_alpha2 = hwsim_alpha2s[0];
+                        param.reg_alpha2 = hwsim_alpha2s[0];
                         break;
                 case HWSIM_REGTEST_WORLD_ROAM:
                         if (i == 0)
-                                regd = &hwsim_world_regdom_custom_01;
+                                param.regd = &hwsim_world_regdom_custom_01;
                         break;
                 case HWSIM_REGTEST_CUSTOM_WORLD:
-                        regd = &hwsim_world_regdom_custom_01;
+                        param.regd = &hwsim_world_regdom_custom_01;
                         break;
                 case HWSIM_REGTEST_CUSTOM_WORLD_2:
                         if (i == 0)
-                                regd = &hwsim_world_regdom_custom_01;
+                                param.regd = &hwsim_world_regdom_custom_01;
                         else if (i == 1)
-                                regd = &hwsim_world_regdom_custom_02;
+                                param.regd = &hwsim_world_regdom_custom_02;
                         break;
                 case HWSIM_REGTEST_STRICT_FOLLOW:
                         if (i == 0) {
-                                reg_strict = true;
-                                reg_alpha2 = hwsim_alpha2s[0];
+                                param.reg_strict = true;
+                                param.reg_alpha2 = hwsim_alpha2s[0];
                         }
                         break;
                 case HWSIM_REGTEST_STRICT_AND_DRIVER_REG:
                         if (i == 0) {
-                                reg_strict = true;
-                                reg_alpha2 = hwsim_alpha2s[0];
+                                param.reg_strict = true;
+                                param.reg_alpha2 = hwsim_alpha2s[0];
                         } else if (i == 1) {
-                                reg_alpha2 = hwsim_alpha2s[1];
+                                param.reg_alpha2 = hwsim_alpha2s[1];
                         }
                         break;
                 case HWSIM_REGTEST_ALL:
                         switch (i) {
                         case 0:
-                                regd = &hwsim_world_regdom_custom_01;
+                                param.regd = &hwsim_world_regdom_custom_01;
                                 break;
                         case 1:
-                                regd = &hwsim_world_regdom_custom_02;
+                                param.regd = &hwsim_world_regdom_custom_02;
                                 break;
                         case 2:
-                                reg_alpha2 = hwsim_alpha2s[0];
+                                param.reg_alpha2 = hwsim_alpha2s[0];
                                 break;
                         case 3:
-                                reg_alpha2 = hwsim_alpha2s[1];
+                                param.reg_alpha2 = hwsim_alpha2s[1];
                                 break;
                         case 4:
-                                reg_strict = true;
-                                reg_alpha2 = hwsim_alpha2s[2];
+                                param.reg_strict = true;
+                                param.reg_alpha2 = hwsim_alpha2s[2];
                                 break;
                         }
                         break;
@@ -2675,10 +2981,10 @@ static int __init init_mac80211_hwsim(void)
                         break;
                 }
 
-                err = mac80211_hwsim_create_radio(channels, reg_alpha2,
-                                                  regd, reg_strict,
-                                                  support_p2p_device,
-                                                  channels > 1);
+                param.p2p_device = support_p2p_device;
+                param.use_chanctx = channels > 1;
+
+                err = mac80211_hwsim_new_radio(NULL, &param);
                 if (err < 0)
                         goto out_free_radios;
         }
@@ -2704,10 +3010,6 @@ static int __init init_mac80211_hwsim(void)
         }
         rtnl_unlock();
 
-        err = hwsim_init_netlink();
-        if (err < 0)
-                goto out_free_mon;
-
         return 0;
 
 out_free_mon:
diff --git a/drivers/net/wireless/mac80211_hwsim.h b/drivers/net/wireless/mac80211_hwsim.h
index c9d0315575ba..f08debdd639b 100644
--- a/drivers/net/wireless/mac80211_hwsim.h
+++ b/drivers/net/wireless/mac80211_hwsim.h
@@ -60,14 +60,15 @@ enum hwsim_tx_control_flags {
  * space, uses:
  *      %HWSIM_ATTR_ADDR_TRANSMITTER, %HWSIM_ATTR_ADDR_RECEIVER,
  *      %HWSIM_ATTR_FRAME, %HWSIM_ATTR_FLAGS, %HWSIM_ATTR_RX_RATE,
- *      %HWSIM_ATTR_SIGNAL, %HWSIM_ATTR_COOKIE
+ *      %HWSIM_ATTR_SIGNAL, %HWSIM_ATTR_COOKIE, %HWSIM_ATTR_FREQ (optional)
  * @HWSIM_CMD_TX_INFO_FRAME: Transmission info report from user space to
  * kernel, uses:
  *      %HWSIM_ATTR_ADDR_TRANSMITTER, %HWSIM_ATTR_FLAGS,
  *      %HWSIM_ATTR_TX_INFO, %HWSIM_ATTR_SIGNAL, %HWSIM_ATTR_COOKIE
- * @HWSIM_CMD_CREATE_RADIO: create a new radio with the given parameters,
- *      returns the radio ID (>= 0) or negative on errors
- * @HWSIM_CMD_DESTROY_RADIO: destroy a radio
+ * @HWSIM_CMD_NEW_RADIO: create a new radio with the given parameters,
+ *      returns the radio ID (>= 0) or negative on errors, if successful
+ *      then multicast the result
+ * @HWSIM_CMD_DEL_RADIO: destroy a radio, reply is multicasted
  * @__HWSIM_CMD_MAX: enum limit
  */
 enum {
@@ -75,12 +76,15 @@ enum {
         HWSIM_CMD_REGISTER,
         HWSIM_CMD_FRAME,
         HWSIM_CMD_TX_INFO_FRAME,
-        HWSIM_CMD_CREATE_RADIO,
-        HWSIM_CMD_DESTROY_RADIO,
+        HWSIM_CMD_NEW_RADIO,
+        HWSIM_CMD_DEL_RADIO,
         __HWSIM_CMD_MAX,
 };
 #define HWSIM_CMD_MAX (_HWSIM_CMD_MAX - 1)
 
+#define HWSIM_CMD_CREATE_RADIO   HWSIM_CMD_NEW_RADIO
+#define HWSIM_CMD_DESTROY_RADIO  HWSIM_CMD_DEL_RADIO
+
 /**
  * enum hwsim_attrs - hwsim netlink attributes
  *
@@ -111,6 +115,11 @@ enum {
  * @HWSIM_ATTR_USE_CHANCTX: used with the %HWSIM_CMD_CREATE_RADIO
  *      command to force use of channel contexts even when only a
  *      single channel is supported
+ * @HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE: used with the %HWSIM_CMD_CREATE_RADIO
+ *      command to force radio removal when process that created the radio dies
+ * @HWSIM_ATTR_RADIO_NAME: Name of radio, e.g. phy666
+ * @HWSIM_ATTR_NO_VIF:  Do not create vif (wlanX) when creating radio.
+ * @HWSIM_ATTR_FREQ: Frequency at which packet is transmitted or received.
  * @__HWSIM_ATTR_MAX: enum limit
  */
 
@@ -132,6 +141,10 @@ enum {
         HWSIM_ATTR_REG_STRICT_REG,
         HWSIM_ATTR_SUPPORT_P2P_DEVICE,
         HWSIM_ATTR_USE_CHANCTX,
+        HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE,
+        HWSIM_ATTR_RADIO_NAME,
+        HWSIM_ATTR_NO_VIF,
+        HWSIM_ATTR_FREQ,
         __HWSIM_ATTR_MAX,
 };
 #define HWSIM_ATTR_MAX (__HWSIM_ATTR_MAX - 1)
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index 0dd672954ad1..f63abfd8acd7 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -992,6 +992,52 @@ mwifiex_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *dev,
         return mwifiex_dump_station_info(priv, sinfo);
 }
 
+static int
+mwifiex_cfg80211_dump_survey(struct wiphy *wiphy, struct net_device *dev,
+                             int idx, struct survey_info *survey)
+{
+        struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
+        struct mwifiex_chan_stats *pchan_stats = priv->adapter->chan_stats;
+        enum ieee80211_band band;
+
+        dev_dbg(priv->adapter->dev, "dump_survey idx=%d\n", idx);
+
+        memset(survey, 0, sizeof(struct survey_info));
+
+        if ((GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_STA) &&
+            priv->media_connected && idx == 0) {
+                        u8 curr_bss_band = priv->curr_bss_params.band;
+                        u32 chan = priv->curr_bss_params.bss_descriptor.channel;
+
+                        band = mwifiex_band_to_radio_type(curr_bss_band);
+                        survey->channel = ieee80211_get_channel(wiphy,
+                                ieee80211_channel_to_frequency(chan, band));
+
+                        if (priv->bcn_nf_last) {
+                                survey->filled = SURVEY_INFO_NOISE_DBM;
+                                survey->noise = priv->bcn_nf_last;
+                        }
+                        return 0;
+        }
+
+        if (idx >= priv->adapter->num_in_chan_stats)
+                return -ENOENT;
+
+        if (!pchan_stats[idx].cca_scan_dur)
+                return 0;
+
+        band = pchan_stats[idx].bandcfg;
+        survey->channel = ieee80211_get_channel(wiphy,
+            ieee80211_channel_to_frequency(pchan_stats[idx].chan_num, band));
+        survey->filled = SURVEY_INFO_NOISE_DBM |
+                SURVEY_INFO_CHANNEL_TIME | SURVEY_INFO_CHANNEL_TIME_BUSY;
+        survey->noise = pchan_stats[idx].noise;
+        survey->channel_time = pchan_stats[idx].cca_scan_dur;
+        survey->channel_time_busy = pchan_stats[idx].cca_busy_dur;
+
+        return 0;
+}
+
 /* Supported rates to be advertised to the cfg80211 */
 static struct ieee80211_rate mwifiex_rates[] = {
         {.bitrate = 10, .hw_value = 2, },
@@ -1239,7 +1285,7 @@ static int mwifiex_cfg80211_change_beacon(struct wiphy *wiphy,
  */
 static int
 mwifiex_cfg80211_del_station(struct wiphy *wiphy, struct net_device *dev,
-                             const u8 *mac)
+                             struct station_del_parameters *params)
 {
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
         struct mwifiex_sta_node *sta_node;
@@ -1248,7 +1294,7 @@ mwifiex_cfg80211_del_station(struct wiphy *wiphy, struct net_device *dev,
         if (list_empty(&priv->sta_list) || !priv->bss_started)
                 return 0;
 
-        if (!mac || is_broadcast_ether_addr(mac)) {
+        if (!params->mac || is_broadcast_ether_addr(params->mac)) {
                 wiphy_dbg(wiphy, "%s: NULL/broadcast mac address\n", __func__);
                 list_for_each_entry(sta_node, &priv->sta_list, list) {
                         if (mwifiex_send_cmd(priv, HostCmd_CMD_UAP_STA_DEAUTH,
@@ -1258,9 +1304,10 @@ mwifiex_cfg80211_del_station(struct wiphy *wiphy, struct net_device *dev,
                         mwifiex_uap_del_sta_data(priv, sta_node);
                 }
         } else {
-                wiphy_dbg(wiphy, "%s: mac address %pM\n", __func__, mac);
+                wiphy_dbg(wiphy, "%s: mac address %pM\n", __func__,
+                          params->mac);
                 spin_lock_irqsave(&priv->sta_list_spinlock, flags);
-                sta_node = mwifiex_get_sta_entry(priv, mac);
+                sta_node = mwifiex_get_sta_entry(priv, params->mac);
                 spin_unlock_irqrestore(&priv->sta_list_spinlock, flags);
                 if (sta_node) {
                         if (mwifiex_send_cmd(priv, HostCmd_CMD_UAP_STA_DEAUTH,
@@ -2779,6 +2826,7 @@ static struct cfg80211_ops mwifiex_cfg80211_ops = {
         .disconnect = mwifiex_cfg80211_disconnect,
         .get_station = mwifiex_cfg80211_get_station,
         .dump_station = mwifiex_cfg80211_dump_station,
+        .dump_survey = mwifiex_cfg80211_dump_survey,
         .set_wiphy_params = mwifiex_cfg80211_set_wiphy_params,
         .join_ibss = mwifiex_cfg80211_join_ibss,
         .leave_ibss = mwifiex_cfg80211_leave_ibss,
@@ -2840,6 +2888,25 @@ static const struct wiphy_coalesce_support mwifiex_coalesce_support = {
         .max_pkt_offset = MWIFIEX_MAX_OFFSET_LEN,
 };
 
+int mwifiex_init_channel_scan_gap(struct mwifiex_adapter *adapter)
+{
+        u32 n_channels_bg, n_channels_a = 0;
+
+        n_channels_bg = mwifiex_band_2ghz.n_channels;
+
+        if (adapter->config_bands & BAND_A)
+                n_channels_a = mwifiex_band_5ghz.n_channels;
+
+        adapter->num_in_chan_stats = max_t(u32, n_channels_bg, n_channels_a);
+        adapter->chan_stats = vmalloc(sizeof(*adapter->chan_stats) *
+                                      adapter->num_in_chan_stats);
+
+        if (!adapter->chan_stats)
+                return -ENOMEM;
+
+        return 0;
+}
+
 /*
  * This function registers the device with CFG802.11 subsystem.
  *
diff --git a/drivers/net/wireless/mwifiex/decl.h b/drivers/net/wireless/mwifiex/decl.h
index e0d00a7f0ec3..f53e5b50d3d8 100644
--- a/drivers/net/wireless/mwifiex/decl.h
+++ b/drivers/net/wireless/mwifiex/decl.h
@@ -185,4 +185,14 @@ struct mwifiex_arp_eth_header {
         u8 ar_tha[ETH_ALEN];
         u8 ar_tip[4];
 } __packed;
+
+struct mwifiex_chan_stats {
+        u8 chan_num;
+        u8 bandcfg;
+        u8 flags;
+        s8 noise;
+        u16 total_bss;
+        u16 cca_scan_dur;
+        u16 cca_busy_dur;
+} __packed;
 #endif /* !_MWIFIEX_DECL_H_ */
diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
index 1eb61739071f..7f922a882c13 100644
--- a/drivers/net/wireless/mwifiex/fw.h
+++ b/drivers/net/wireless/mwifiex/fw.h
@@ -172,6 +172,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 #define TLV_TYPE_TDLS_IDLE_TIMEOUT  (PROPRIETARY_TLV_BASE_ID + 194)
 #define TLV_TYPE_SCAN_CHANNEL_GAP   (PROPRIETARY_TLV_BASE_ID + 197)
 #define TLV_TYPE_API_REV            (PROPRIETARY_TLV_BASE_ID + 199)
+#define TLV_TYPE_CHANNEL_STATS      (PROPRIETARY_TLV_BASE_ID + 198)
 
 #define MWIFIEX_TX_DATA_BUF_SIZE_2K        2048
 
@@ -611,6 +612,16 @@ struct uap_rxpd {
         u8 reserved1;
 };
 
+struct mwifiex_fw_chan_stats {
+        u8 chan_num;
+        u8 bandcfg;
+        u8 flags;
+        s8 noise;
+        __le16 total_bss;
+        __le16 cca_scan_dur;
+        __le16 cca_busy_dur;
+} __packed;
+
 enum mwifiex_chan_scan_mode_bitmasks {
         MWIFIEX_PASSIVE_SCAN = BIT(0),
         MWIFIEX_DISABLE_CHAN_FILT = BIT(1),
@@ -660,6 +671,11 @@ struct mwifiex_ie_types_scan_chan_gap {
         __le16 chan_gap;
 } __packed;
 
+struct mwifiex_ietypes_chanstats {
+        struct mwifiex_ie_types_header header;
+        struct mwifiex_fw_chan_stats chanstats[0];
+} __packed;
+
 struct mwifiex_ie_types_wildcard_ssid_params {
         struct mwifiex_ie_types_header header;
         u8 max_ssid_length;
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index d5070c444fe1..f26420dbab6f 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -122,6 +122,7 @@ static int mwifiex_unregister(struct mwifiex_adapter *adapter)
                 }
         }
 
+        vfree(adapter->chan_stats);
         kfree(adapter);
         return 0;
 }
@@ -447,6 +448,11 @@ static void mwifiex_fw_dpc(const struct firmware *firmware, void *context)
                 goto err_init_fw;
         }
 
+        if (mwifiex_init_channel_scan_gap(adapter)) {
+                dev_err(adapter->dev, "could not init channel stats table\n");
+                goto err_init_fw;
+        }
+
         rtnl_lock();
         /* Create station interface by default */
         wdev = mwifiex_add_virtual_intf(adapter->wiphy, "mlan%d",
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index f55658d15c60..cb393195eee1 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -845,6 +845,9 @@ struct mwifiex_adapter {
         u8 curr_mem_idx;
         bool scan_chan_gap_enabled;
         struct sk_buff_head rx_data_q;
+        struct mwifiex_chan_stats *chan_stats;
+        u32 num_in_chan_stats;
+        int survey_idx;
 };
 
 int mwifiex_init_lock_list(struct mwifiex_adapter *adapter);
@@ -1031,7 +1034,8 @@ void mwifiex_set_11ac_ba_params(struct mwifiex_private *priv);
 int mwifiex_cmd_802_11_scan_ext(struct mwifiex_private *priv,
                                 struct host_cmd_ds_command *cmd,
                                 void *data_buf);
-int mwifiex_ret_802_11_scan_ext(struct mwifiex_private *priv);
+int mwifiex_ret_802_11_scan_ext(struct mwifiex_private *priv,
+                                struct host_cmd_ds_command *resp);
 int mwifiex_handle_event_ext_scan_report(struct mwifiex_private *priv,
                                          void *buf);
 
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index ca64d4c94112..3a17821157d7 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -1755,6 +1755,7 @@ static void mwifiex_complete_scan(struct mwifiex_private *priv)
 {
         struct mwifiex_adapter *adapter = priv->adapter;
 
+        adapter->survey_idx = 0;
         if (adapter->curr_cmd->wait_q_enabled) {
                 adapter->cmd_wait_q.status = 0;
                 if (!priv->scan_request) {
@@ -1976,10 +1977,53 @@ int mwifiex_cmd_802_11_scan_ext(struct mwifiex_private *priv,
         return 0;
 }
 
+static void
+mwifiex_update_chan_statistics(struct mwifiex_private *priv,
+                               struct mwifiex_ietypes_chanstats *tlv_stat)
+{
+        struct mwifiex_adapter *adapter = priv->adapter;
+        u8 i, num_chan;
+        struct mwifiex_fw_chan_stats *fw_chan_stats;
+        struct mwifiex_chan_stats chan_stats;
+
+        fw_chan_stats = (void *)((u8 *)tlv_stat +
+                              sizeof(struct mwifiex_ie_types_header));
+        num_chan = le16_to_cpu(tlv_stat->header.len) /
+                                              sizeof(struct mwifiex_chan_stats);
+
+        for (i = 0 ; i < num_chan; i++) {
+                chan_stats.chan_num = fw_chan_stats->chan_num;
+                chan_stats.bandcfg = fw_chan_stats->bandcfg;
+                chan_stats.flags = fw_chan_stats->flags;
+                chan_stats.noise = fw_chan_stats->noise;
+                chan_stats.total_bss = le16_to_cpu(fw_chan_stats->total_bss);
+                chan_stats.cca_scan_dur =
+                                       le16_to_cpu(fw_chan_stats->cca_scan_dur);
+                chan_stats.cca_busy_dur =
+                                       le16_to_cpu(fw_chan_stats->cca_busy_dur);
+                dev_dbg(adapter->dev,
+                        "chan=%d, noise=%d, total_network=%d scan_duration=%d, busy_duration=%d\n",
+                        chan_stats.chan_num,
+                        chan_stats.noise,
+                        chan_stats.total_bss,
+                        chan_stats.cca_scan_dur,
+                        chan_stats.cca_busy_dur);
+                memcpy(&adapter->chan_stats[adapter->survey_idx++], &chan_stats,
+                       sizeof(struct mwifiex_chan_stats));
+                fw_chan_stats++;
+        }
+}
+
 /* This function handles the command response of extended scan */
-int mwifiex_ret_802_11_scan_ext(struct mwifiex_private *priv)
+int mwifiex_ret_802_11_scan_ext(struct mwifiex_private *priv,
+                                struct host_cmd_ds_command *resp)
 {
         struct mwifiex_adapter *adapter = priv->adapter;
+        struct host_cmd_ds_802_11_scan_ext *ext_scan_resp;
+        struct mwifiex_ie_types_header *tlv;
+        struct mwifiex_ietypes_chanstats *tlv_stat;
+        u16 buf_left, type, len;
+
         struct host_cmd_ds_command *cmd_ptr;
         struct cmd_ctrl_node *cmd_node;
         unsigned long cmd_flags, scan_flags;
@@ -1987,6 +2031,36 @@ int mwifiex_ret_802_11_scan_ext(struct mwifiex_private *priv)
 
         dev_dbg(priv->adapter->dev, "info: EXT scan returns successfully\n");
 
+        ext_scan_resp = &resp->params.ext_scan;
+
+        tlv = (void *)ext_scan_resp->tlv_buffer;
+        buf_left = le16_to_cpu(resp->size) - (sizeof(*ext_scan_resp) + S_DS_GEN
+                                              - 1);
+
+        while (buf_left >= sizeof(struct mwifiex_ie_types_header)) {
+                type = le16_to_cpu(tlv->type);
+                len = le16_to_cpu(tlv->len);
+
+                if (buf_left < (sizeof(struct mwifiex_ie_types_header) + len)) {
+                        dev_err(adapter->dev,
+                                "error processing scan response TLVs");
+                        break;
+                }
+
+                switch (type) {
+                case TLV_TYPE_CHANNEL_STATS:
+                        tlv_stat = (void *)tlv;
+                        mwifiex_update_chan_statistics(priv, tlv_stat);
+                        break;
+                default:
+                        break;
+                }
+
+                buf_left -= len + sizeof(struct mwifiex_ie_types_header);
+                tlv = (void *)((u8 *)tlv + len +
+                               sizeof(struct mwifiex_ie_types_header));
+        }
+
         spin_lock_irqsave(&adapter->cmd_pending_q_lock, cmd_flags);
         spin_lock_irqsave(&adapter->scan_pending_q_lock, scan_flags);
         if (list_empty(&adapter->scan_pending_q)) {
diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c
index 4aad44685f8d..b65e1014b0fc 100644
--- a/drivers/net/wireless/mwifiex/sta_cmdresp.c
+++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c
@@ -983,7 +983,7 @@ int mwifiex_process_sta_cmdresp(struct mwifiex_private *priv, u16 cmdresp_no,
                 adapter->curr_cmd->wait_q_enabled = false;
                 break;
         case HostCmd_CMD_802_11_SCAN_EXT:
-                ret = mwifiex_ret_802_11_scan_ext(priv);
+                ret = mwifiex_ret_802_11_scan_ext(priv, resp);
                 adapter->curr_cmd->wait_q_enabled = false;
                 break;
         case HostCmd_CMD_802_11_BG_SCAN_QUERY:
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index d849d590de25..c878e3f3993c 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -62,7 +62,7 @@ static inline void rt2500usb_register_read(struct rt2x00_dev *rt2x00dev,
         __le16 reg;
         rt2x00usb_vendor_request_buff(rt2x00dev, USB_MULTI_READ,
                                       USB_VENDOR_REQUEST_IN, offset,
-                                      &reg, sizeof(reg), REGISTER_TIMEOUT);
+                                      &reg, sizeof(reg));
         *value = le16_to_cpu(reg);
 }
 
@@ -83,8 +83,7 @@ static inline void rt2500usb_register_multiread(struct rt2x00_dev *rt2x00dev,
 {
         rt2x00usb_vendor_request_buff(rt2x00dev, USB_MULTI_READ,
                                       USB_VENDOR_REQUEST_IN, offset,
-                                      value, length,
-                                      REGISTER_TIMEOUT16(length));
+                                      value, length);
 }
 
 static inline void rt2500usb_register_write(struct rt2x00_dev *rt2x00dev,
@@ -94,7 +93,7 @@ static inline void rt2500usb_register_write(struct rt2x00_dev *rt2x00dev,
         __le16 reg = cpu_to_le16(value);
         rt2x00usb_vendor_request_buff(rt2x00dev, USB_MULTI_WRITE,
                                       USB_VENDOR_REQUEST_OUT, offset,
-                                      &reg, sizeof(reg), REGISTER_TIMEOUT);
+                                      &reg, sizeof(reg));
 }
 
 static inline void rt2500usb_register_write_lock(struct rt2x00_dev *rt2x00dev,
@@ -113,8 +112,7 @@ static inline void rt2500usb_register_multiwrite(struct rt2x00_dev *rt2x00dev,
 {
         rt2x00usb_vendor_request_buff(rt2x00dev, USB_MULTI_WRITE,
                                       USB_VENDOR_REQUEST_OUT, offset,
-                                      value, length,
-                                      REGISTER_TIMEOUT16(length));
+                                      value, length);
 }
 
 static int rt2500usb_regbusy_read(struct rt2x00_dev *rt2x00dev,
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index 86c43d112a4b..dc85d3e0ffe5 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -116,7 +116,7 @@ EXPORT_SYMBOL_GPL(rt2x00usb_vendor_req_buff_lock);
 int rt2x00usb_vendor_request_buff(struct rt2x00_dev *rt2x00dev,
                                   const u8 request, const u8 requesttype,
                                   const u16 offset, void *buffer,
-                                  const u16 buffer_length, const int timeout)
+                                  const u16 buffer_length)
 {
         int status = 0;
         unsigned char *tb;
@@ -131,7 +131,7 @@ int rt2x00usb_vendor_request_buff(struct rt2x00_dev *rt2x00dev,
                 bsize = min_t(u16, CSR_CACHE_SIZE, len);
                 status = rt2x00usb_vendor_req_buff_lock(rt2x00dev, request,
                                                         requesttype, off, tb,
-                                                        bsize, timeout);
+                                                        bsize, REGISTER_TIMEOUT);
 
                 tb  += bsize;
                 len -= bsize;
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.h b/drivers/net/wireless/rt2x00/rt2x00usb.h
index 831b65f93feb..819690e978c0 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.h
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.h
@@ -33,27 +33,14 @@
 })
 
 /*
- * For USB vendor requests we need to pass a timeout
- * time in ms, for this we use the REGISTER_TIMEOUT,
- * however when loading firmware a higher value is
- * required. In that case we use the REGISTER_TIMEOUT_FIRMWARE.
+ * For USB vendor requests we need to pass a timeout time in ms, for this we
+ * use the REGISTER_TIMEOUT, however when loading firmware or read EEPROM
+ * a higher value is required. In that case we use the REGISTER_TIMEOUT_FIRMWARE
+ * and EEPROM_TIMEOUT.
  */
 #define REGISTER_TIMEOUT                500
 #define REGISTER_TIMEOUT_FIRMWARE       1000
-
-/**
- * REGISTER_TIMEOUT16 - Determine the timeout for 16bit register access
- * @__datalen: Data length
- */
-#define REGISTER_TIMEOUT16(__datalen)   \
-        ( REGISTER_TIMEOUT * ((__datalen) / sizeof(u16)) )
-
-/**
- * REGISTER_TIMEOUT32 - Determine the timeout for 32bit register access
- * @__datalen: Data length
- */
-#define REGISTER_TIMEOUT32(__datalen)   \
-        ( REGISTER_TIMEOUT * ((__datalen) / sizeof(u32)) )
+#define EEPROM_TIMEOUT                  2000
 
 /*
  * Cache size
@@ -126,7 +113,6 @@ int rt2x00usb_vendor_request(struct rt2x00_dev *rt2x00dev,
  * @offset: Register offset to perform action on
  * @buffer: Buffer where information will be read/written to by device
  * @buffer_length: Size of &buffer
- * @timeout: Operation timeout
  *
  * This function will use a previously with kmalloc allocated cache
  * to communicate with the device. The contents of the buffer pointer
@@ -139,7 +125,7 @@ int rt2x00usb_vendor_request(struct rt2x00_dev *rt2x00dev,
 int rt2x00usb_vendor_request_buff(struct rt2x00_dev *rt2x00dev,
                                   const u8 request, const u8 requesttype,
                                   const u16 offset, void *buffer,
-                                  const u16 buffer_length, const int timeout);
+                                  const u16 buffer_length);
 
 /**
  * rt2x00usb_vendor_request_buff - Send register command to device (buffered)
@@ -197,8 +183,7 @@ static inline int rt2x00usb_eeprom_read(struct rt2x00_dev *rt2x00dev,
 {
         return rt2x00usb_vendor_request(rt2x00dev, USB_EEPROM_READ,
                                         USB_VENDOR_REQUEST_IN, 0, 0,
-                                        eeprom, length,
-                                        REGISTER_TIMEOUT16(length));
+                                        eeprom, length, EEPROM_TIMEOUT);
 }
 
 /**
@@ -217,7 +202,7 @@ static inline void rt2x00usb_register_read(struct rt2x00_dev *rt2x00dev,
         __le32 reg;
         rt2x00usb_vendor_request_buff(rt2x00dev, USB_MULTI_READ,
                                       USB_VENDOR_REQUEST_IN, offset,
-                                      &reg, sizeof(reg), REGISTER_TIMEOUT);
+                                      &reg, sizeof(reg));
         *value = le32_to_cpu(reg);
 }
 
@@ -257,8 +242,7 @@ static inline void rt2x00usb_register_multiread(struct rt2x00_dev *rt2x00dev,
 {
         rt2x00usb_vendor_request_buff(rt2x00dev, USB_MULTI_READ,
                                       USB_VENDOR_REQUEST_IN, offset,
-                                      value, length,
-                                      REGISTER_TIMEOUT32(length));
+                                      value, length);
 }
 
 /**
@@ -277,7 +261,7 @@ static inline void rt2x00usb_register_write(struct rt2x00_dev *rt2x00dev,
         __le32 reg = cpu_to_le32(value);
         rt2x00usb_vendor_request_buff(rt2x00dev, USB_MULTI_WRITE,
                                       USB_VENDOR_REQUEST_OUT, offset,
-                                      &reg, sizeof(reg), REGISTER_TIMEOUT);
+                                      &reg, sizeof(reg));
 }
 
 /**
@@ -316,8 +300,7 @@ static inline void rt2x00usb_register_multiwrite(struct rt2x00_dev *rt2x00dev,
 {
         rt2x00usb_vendor_request_buff(rt2x00dev, USB_MULTI_WRITE,
                                       USB_VENDOR_REQUEST_OUT, offset,
-                                      (void *)value, length,
-                                      REGISTER_TIMEOUT32(length));
+                                      (void *)value, length);
 }
 
 /**
diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/phy.c b/drivers/net/wireless/rtlwifi/rtl8821ae/phy.c
index 1e9570fa874f..9b4d8a637915 100644
--- a/drivers/net/wireless/rtlwifi/rtl8821ae/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/phy.c
@@ -800,7 +800,7 @@ static void _rtl8821ae_phy_set_txpower_by_rate_base(struct ieee80211_hw *hw,
                                  "Invalid RateSection %d in Band 2.4G,Rf Path %d, %dTx in PHY_SetTxPowerByRateBase()\n",
                                  rate_section, path, txnum);
                         break;
-                };
+                }
         } else if (band == BAND_ON_5G) {
                 switch (rate_section) {
                 case OFDM:
@@ -823,7 +823,7 @@ static void _rtl8821ae_phy_set_txpower_by_rate_base(struct ieee80211_hw *hw,
                                 "Invalid RateSection %d in Band 5G, Rf Path %d, %dTx in PHY_SetTxPowerByRateBase()\n",
                                 rate_section, path, txnum);
                         break;
-                };
+                }
         } else {
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
                         "Invalid Band %d in PHY_SetTxPowerByRateBase()\n", band);
@@ -870,7 +870,7 @@ static u8 _rtl8821ae_phy_get_txpower_by_rate_base(struct ieee80211_hw *hw,
                                  "Invalid RateSection %d in Band 2.4G, Rf Path %d, %dTx in PHY_GetTxPowerByRateBase()\n",
                                  rate_section, path, txnum);
                         break;
-                };
+                }
         } else if (band == BAND_ON_5G) {
                 switch (rate_section) {
                 case OFDM:
@@ -893,7 +893,7 @@ static u8 _rtl8821ae_phy_get_txpower_by_rate_base(struct ieee80211_hw *hw,
                                  "Invalid RateSection %d in Band 5G, Rf Path %d, %dTx in PHY_GetTxPowerByRateBase()\n",
                                  rate_section, path, txnum);
                         break;
-                };
+                }
         } else {
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
                          "Invalid Band %d in PHY_GetTxPowerByRateBase()\n", band);
@@ -3746,7 +3746,7 @@ static void _rtl8821ae_iqk_tx_fill_iqc(struct ieee80211_hw *hw,
                 break;
         default:
                 break;
-        };
+        }
 }
 
 static void _rtl8821ae_iqk_rx_fill_iqc(struct ieee80211_hw *hw,
@@ -3767,7 +3767,7 @@ static void _rtl8821ae_iqk_rx_fill_iqc(struct ieee80211_hw *hw,
                 break;
         default:
                 break;
-        };
+        }
 }
 
 #define cal_num 10
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index 575c8f6d4009..6ad3fcedab9b 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -5177,10 +5177,11 @@ out:
 }
 
 static void wl12xx_op_channel_switch(struct ieee80211_hw *hw,
+                                     struct ieee80211_vif *vif,
                                      struct ieee80211_channel_switch *ch_switch)
 {
         struct wl1271 *wl = hw->priv;
-        struct wl12xx_vif *wlvif;
+        struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
         int ret;
 
         wl1271_debug(DEBUG_MAC80211, "mac80211 channel switch");
@@ -5190,14 +5191,8 @@ static void wl12xx_op_channel_switch(struct ieee80211_hw *hw,
         mutex_lock(&wl->mutex);
 
         if (unlikely(wl->state == WLCORE_STATE_OFF)) {
-                wl12xx_for_each_wlvif_sta(wl, wlvif) {
-                        struct ieee80211_vif *vif = wl12xx_wlvif_to_vif(wlvif);
-
-                        if (!test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags))
-                                continue;
-
+                if (test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags))
                         ieee80211_chswitch_done(vif, false);
-                }
                 goto out;
         } else if (unlikely(wl->state != WLCORE_STATE_ON)) {
                 goto out;
@@ -5208,11 +5203,9 @@ static void wl12xx_op_channel_switch(struct ieee80211_hw *hw,
                 goto out;
 
         /* TODO: change mac80211 to pass vif as param */
-        wl12xx_for_each_wlvif_sta(wl, wlvif) {
-                unsigned long delay_usec;
 
-                if (!test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags))
-                        continue;
+        if (test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags)) {
+                unsigned long delay_usec;
 
                 ret = wl->ops->channel_switch(wl, wlvif, ch_switch);
                 if (ret)
@@ -5222,10 +5215,10 @@ static void wl12xx_op_channel_switch(struct ieee80211_hw *hw,
 
                 /* indicate failure 5 seconds after channel switch time */
                 delay_usec = ieee80211_tu_to_usec(wlvif->beacon_int) *
-                             ch_switch->count;
+                        ch_switch->count;
                 ieee80211_queue_delayed_work(hw, &wlvif->channel_switch_work,
-                                usecs_to_jiffies(delay_usec) +
-                                msecs_to_jiffies(5000));
+                                             usecs_to_jiffies(delay_usec) +
+                                             msecs_to_jiffies(5000));
         }
 
 out_sleep: