Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem

244 files changed, 7662 insertions, 3181 deletions

diff --git a/Documentation/devicetree/bindings/net/nfc/pn544.txt b/Documentation/devicetree/bindings/net/nfc/pn544.txt
new file mode 100644
index 000000000000..dab69f36167c
--- /dev/null
+++ b/Documentation/devicetree/bindings/net/nfc/pn544.txt
@@ -0,0 +1,35 @@
+* NXP Semiconductors PN544 NFC Controller
+
+Required properties:
+- compatible: Should be "nxp,pn544-i2c".
+- clock-frequency: I²C work frequency.
+- reg: address on the bus
+- interrupt-parent: phandle for the interrupt gpio controller
+- interrupts: GPIO interrupt to which the chip is connected
+- enable-gpios: Output GPIO pin used for enabling/disabling the PN544
+- firmware-gpios: Output GPIO pin used to enter firmware download mode
+
+Optional SoC Specific Properties:
+- pinctrl-names: Contains only one value - "default".
+- pintctrl-0: Specifies the pin control groups used for this controller.
+
+Example (for ARM-based BeagleBone with PN544 on I2C2):
+
+&i2c2 {
+
+        status = "okay";
+
+        pn544: pn544@28 {
+
+                compatible = "nxp,pn544-i2c";
+
+                reg = <0x28>;
+                clock-frequency = <400000>;
+
+                interrupt-parent = <&gpio1>;
+                interrupts = <17 GPIO_ACTIVE_HIGH>;
+
+                enable-gpios = <&gpio3 21 GPIO_ACTIVE_HIGH>;
+                firmware-gpios = <&gpio3 19 GPIO_ACTIVE_HIGH>;
+        };
+};
diff --git a/Documentation/devicetree/bindings/net/nfc/st21nfca.txt b/Documentation/devicetree/bindings/net/nfc/st21nfca.txt
new file mode 100644
index 000000000000..4724fe669172
--- /dev/null
+++ b/Documentation/devicetree/bindings/net/nfc/st21nfca.txt
@@ -0,0 +1,33 @@
+* STMicroelectronics SAS. ST21NFCA NFC Controller
+
+Required properties:
+- compatible: Should be "st,st21nfca-i2c".
+- clock-frequency: I²C work frequency.
+- reg: address on the bus
+- interrupt-parent: phandle for the interrupt gpio controller
+- interrupts: GPIO interrupt to which the chip is connected
+- enable-gpios: Output GPIO pin used for enabling/disabling the ST21NFCA
+
+Optional SoC Specific Properties:
+- pinctrl-names: Contains only one value - "default".
+- pintctrl-0: Specifies the pin control groups used for this controller.
+
+Example (for ARM-based BeagleBoard xM with ST21NFCA on I2C2):
+
+&i2c2 {
+
+        status = "okay";
+
+        st21nfca: st21nfca@1 {
+
+                compatible = "st,st21nfca_i2c";
+
+                reg = <0x01>;
+                clock-frequency = <400000>;
+
+                interrupt-parent = <&gpio5>;
+                interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
+
+                enable-gpios = <&gpio5 29 GPIO_ACTIVE_HIGH>;
+        };
+};
diff --git a/Documentation/devicetree/bindings/net/nfc/trf7970a.txt b/Documentation/devicetree/bindings/net/nfc/trf7970a.txt
index 8dd3ef7bc56b..1e436133685f 100644
--- a/Documentation/devicetree/bindings/net/nfc/trf7970a.txt
+++ b/Documentation/devicetree/bindings/net/nfc/trf7970a.txt
@@ -12,6 +12,7 @@ Required properties:
 Optional SoC Specific Properties:
 - pinctrl-names: Contains only one value - "default".
 - pintctrl-0: Specifies the pin control groups used for this controller.
+- autosuspend-delay: Specify autosuspend delay in milliseconds.
 
 Example (for ARM-based BeagleBone with TRF7970A on SPI1):
 
@@ -29,6 +30,7 @@ Example (for ARM-based BeagleBone with TRF7970A on SPI1):
                 ti,enable-gpios = <&gpio2 2 GPIO_ACTIVE_LOW>,
                                   <&gpio2 5 GPIO_ACTIVE_LOW>;
                 vin-supply = <&ldo3_reg>;
+                autosuspend-delay = <30000>;
                 status = "okay";
         };
 };
diff --git a/arch/arm/mach-tegra/board-paz00.c b/arch/arm/mach-tegra/board-paz00.c
index e4dec9fcb084..9c6029ba526f 100644
--- a/arch/arm/mach-tegra/board-paz00.c
+++ b/arch/arm/mach-tegra/board-paz00.c
@@ -23,9 +23,7 @@
 #include "board.h"
 
 static struct rfkill_gpio_platform_data wifi_rfkill_platform_data = {
-        .name           = "wifi_rfkill",
-        .reset_gpio     = 25, /* PD1 */
-        .shutdown_gpio  = 85, /* PK5 */
+        .name   = "wifi_rfkill",
         .type   = RFKILL_TYPE_WLAN,
 };
 
diff --git a/arch/mips/bcm47xx/sprom.c b/arch/mips/bcm47xx/sprom.c
index a8b5408dd349..da4cdb16844e 100644
--- a/arch/mips/bcm47xx/sprom.c
+++ b/arch/mips/bcm47xx/sprom.c
@@ -168,6 +168,7 @@ static void nvram_read_alpha2(const char *prefix, const char *name,
 static void bcm47xx_fill_sprom_r1234589(struct ssb_sprom *sprom,
                                         const char *prefix, bool fallback)
 {
+        nvram_read_u16(prefix, NULL, "devid", &sprom->dev_id, 0, fallback);
         nvram_read_u8(prefix, NULL, "ledbh0", &sprom->gpio0, 0xff, fallback);
         nvram_read_u8(prefix, NULL, "ledbh1", &sprom->gpio1, 0xff, fallback);
         nvram_read_u8(prefix, NULL, "ledbh2", &sprom->gpio2, 0xff, fallback);
diff --git a/drivers/mmc/host/mmc_spi.c b/drivers/mmc/host/mmc_spi.c
index 0a87e5691341..cc8d4a6099cd 100644
--- a/drivers/mmc/host/mmc_spi.c
+++ b/drivers/mmc/host/mmc_spi.c
@@ -448,7 +448,6 @@ mmc_spi_command_send(struct mmc_spi_host *host,
 {
         struct scratch          *data = host->data;
         u8                      *cp = data->status;
-        u32                     arg = cmd->arg;
         int                     status;
         struct spi_transfer     *t;
 
@@ -465,14 +464,12 @@ mmc_spi_command_send(struct mmc_spi_host *host,
          * We init the whole buffer to all-ones, which is what we need
          * to write while we're reading (later) response data.
          */
-        memset(cp++, 0xff, sizeof(data->status));
+        memset(cp, 0xff, sizeof(data->status));
 
-        *cp++ = 0x40 | cmd->opcode;
-        *cp++ = (u8)(arg >> 24);
-        *cp++ = (u8)(arg >> 16);
-        *cp++ = (u8)(arg >> 8);
-        *cp++ = (u8)arg;
-        *cp++ = (crc7(0, &data->status[1], 5) << 1) | 0x01;
+        cp[1] = 0x40 | cmd->opcode;
+        put_unaligned_be32(cmd->arg, cp+2);
+        cp[6] = crc7_be(0, cp+1, 5) | 0x01;
+        cp += 7;
 
         /* Then, read up to 13 bytes (while writing all-ones):
          *  - N(CR) (== 1..8) bytes of all-ones
@@ -711,10 +708,7 @@ mmc_spi_writeblock(struct mmc_spi_host *host, struct spi_transfer *t,
          * so we have to cope with this situation and check the response
          * bit-by-bit. Arggh!!!
          */
-        pattern  = scratch->status[0] << 24;
-        pattern |= scratch->status[1] << 16;
-        pattern |= scratch->status[2] << 8;
-        pattern |= scratch->status[3];
+        pattern = get_unaligned_be32(scratch->status);
 
         /* First 3 bit of pattern are undefined */
         pattern |= 0xE0000000;
diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
index 6abde37fb339..75b3dfbd6509 100644
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -680,8 +680,8 @@ static void ath10k_core_restart(struct work_struct *work)
 
         switch (ar->state) {
         case ATH10K_STATE_ON:
-                ath10k_halt(ar);
                 ar->state = ATH10K_STATE_RESTARTING;
+                ath10k_halt(ar);
                 ieee80211_restart_hw(ar->hw);
                 break;
         case ATH10K_STATE_OFF:
@@ -908,7 +908,9 @@ void ath10k_core_stop(struct ath10k *ar)
         lockdep_assert_held(&ar->conf_mutex);
 
         /* try to suspend target */
-        ath10k_wait_for_suspend(ar, WMI_PDEV_SUSPEND_AND_DISABLE_INTR);
+        if (ar->state != ATH10K_STATE_RESTARTING)
+                ath10k_wait_for_suspend(ar, WMI_PDEV_SUSPEND_AND_DISABLE_INTR);
+
         ath10k_debug_stop(ar);
         ath10k_htc_stop(&ar->htc);
         ath10k_htt_detach(&ar->htt);
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 0ac5437492fd..7026f021ccbb 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -2291,6 +2291,8 @@ static void ath10k_tx(struct ieee80211_hw *hw,
  */
 void ath10k_halt(struct ath10k *ar)
 {
+        struct ath10k_vif *arvif;
+
         lockdep_assert_held(&ar->conf_mutex);
 
         if (ath10k_monitor_is_enabled(ar)) {
@@ -2313,6 +2315,17 @@ void ath10k_halt(struct ath10k *ar)
                 ar->scan.in_progress = false;
                 ieee80211_scan_completed(ar->hw, true);
         }
+
+        list_for_each_entry(arvif, &ar->arvifs, list) {
+                if (!arvif->beacon)
+                        continue;
+
+                dma_unmap_single(arvif->ar->dev,
+                                 ATH10K_SKB_CB(arvif->beacon)->paddr,
+                                 arvif->beacon->len, DMA_TO_DEVICE);
+                dev_kfree_skb_any(arvif->beacon);
+                arvif->beacon = NULL;
+        }
         spin_unlock_bh(&ar->data_lock);
 }
 
@@ -2771,6 +2784,9 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw,
 
         spin_lock_bh(&ar->data_lock);
         if (arvif->beacon) {
+                dma_unmap_single(arvif->ar->dev,
+                                 ATH10K_SKB_CB(arvif->beacon)->paddr,
+                                 arvif->beacon->len, DMA_TO_DEVICE);
                 dev_kfree_skb_any(arvif->beacon);
                 arvif->beacon = NULL;
         }
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index bf1083d52e61..66b1f3017f2b 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -2452,6 +2452,10 @@ static int ath10k_pci_wait_for_target_init(struct ath10k *ar)
                 if (val == 0xffffffff)
                         continue;
 
+                /* the device has crashed so don't bother trying anymore */
+                if (val & FW_IND_EVENT_PENDING)
+                        break;
+
                 if (val & FW_IND_INITIALIZED)
                         break;
 
@@ -2464,7 +2468,19 @@ static int ath10k_pci_wait_for_target_init(struct ath10k *ar)
                 mdelay(10);
         } while (time_before(jiffies, timeout));
 
-        if (val == 0xffffffff || !(val & FW_IND_INITIALIZED)) {
+        if (val == 0xffffffff) {
+                ath10k_err("failed to read device register, device is gone\n");
+                ret = -EIO;
+                goto out;
+        }
+
+        if (val & FW_IND_EVENT_PENDING) {
+                ath10k_warn("device has crashed during init\n");
+                ret = -ECOMM;
+                goto out;
+        }
+
+        if (!(val & FW_IND_INITIALIZED)) {
                 ath10k_err("failed to receive initialized event from target: %08x\n",
                            val);
                 ret = -ETIMEDOUT;
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index fe4d5f1c672f..72cc4f20d102 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -1431,6 +1431,7 @@ static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
                                          ATH10K_SKB_CB(arvif->beacon)->paddr,
                                          arvif->beacon->len, DMA_TO_DEVICE);
                         dev_kfree_skb_any(arvif->beacon);
+                        arvif->beacon = NULL;
                 }
 
                 ATH10K_SKB_CB(bcn)->paddr = dma_map_single(arvif->ar->dev,
@@ -1440,6 +1441,7 @@ static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
                                         ATH10K_SKB_CB(bcn)->paddr);
                 if (ret) {
                         ath10k_warn("failed to map beacon: %d\n", ret);
+                        dev_kfree_skb_any(bcn);
                         goto skip;
                 }
 
diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
index 09285084bcd3..0e26f4a34fda 100644
--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
@@ -1759,7 +1759,7 @@ static bool is_rate_ht40(s32 rate, u8 *mcs, bool *sgi)
 }
 
 static int ath6kl_get_station(struct wiphy *wiphy, struct net_device *dev,
-                              u8 *mac, struct station_info *sinfo)
+                              const u8 *mac, struct station_info *sinfo)
 {
         struct ath6kl *ar = ath6kl_priv(dev);
         struct ath6kl_vif *vif = netdev_priv(dev);
@@ -2974,7 +2974,7 @@ static int ath6kl_stop_ap(struct wiphy *wiphy, struct net_device *dev)
 static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
 
 static int ath6kl_del_station(struct wiphy *wiphy, struct net_device *dev,
-                              u8 *mac)
+                              const u8 *mac)
 {
         struct ath6kl *ar = ath6kl_priv(dev);
         struct ath6kl_vif *vif = netdev_priv(dev);
@@ -2985,7 +2985,8 @@ static int ath6kl_del_station(struct wiphy *wiphy, struct net_device *dev,
 }
 
 static int ath6kl_change_station(struct wiphy *wiphy, struct net_device *dev,
-                                 u8 *mac, struct station_parameters *params)
+                                 const u8 *mac,
+                                 struct station_parameters *params)
 {
         struct ath6kl *ar = ath6kl_priv(dev);
         struct ath6kl_vif *vif = netdev_priv(dev);
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
index 0c0e1e36e40f..4d7f9e4712e9 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.c
+++ b/drivers/net/wireless/ath/ath6kl/wmi.c
@@ -2320,7 +2320,7 @@ int ath6kl_wmi_addkey_cmd(struct wmi *wmi, u8 if_idx, u8 key_index,
         return ret;
 }
 
-int ath6kl_wmi_add_krk_cmd(struct wmi *wmi, u8 if_idx, u8 *krk)
+int ath6kl_wmi_add_krk_cmd(struct wmi *wmi, u8 if_idx, const u8 *krk)
 {
         struct sk_buff *skb;
         struct wmi_add_krk_cmd *cmd;
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.h b/drivers/net/wireless/ath/ath6kl/wmi.h
index 1f05ecd97c91..7809afbb3e93 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.h
+++ b/drivers/net/wireless/ath/ath6kl/wmi.h
@@ -2616,7 +2616,7 @@ int ath6kl_wmi_addkey_cmd(struct wmi *wmi, u8 if_idx, u8 key_index,
                           u8 *key_material,
                           u8 key_op_ctrl, u8 *mac_addr,
                           enum wmi_sync_flag sync_flag);
-int ath6kl_wmi_add_krk_cmd(struct wmi *wmi, u8 if_idx, u8 *krk);
+int ath6kl_wmi_add_krk_cmd(struct wmi *wmi, u8 if_idx, const u8 *krk);
 int ath6kl_wmi_deletekey_cmd(struct wmi *wmi, u8 if_idx, u8 key_index);
 int ath6kl_wmi_setpmkid_cmd(struct wmi *wmi, u8 if_idx, const u8 *bssid,
                             const u8 *pmkid, bool set);
diff --git a/drivers/net/wireless/ath/ath9k/Makefile b/drivers/net/wireless/ath/ath9k/Makefile
index 8e1c7b0fe76c..8fcd586d1c39 100644
--- a/drivers/net/wireless/ath/ath9k/Makefile
+++ b/drivers/net/wireless/ath/ath9k/Makefile
@@ -53,7 +53,8 @@ obj-$(CONFIG_ATH9K_HW) += ath9k_hw.o
 obj-$(CONFIG_ATH9K_COMMON) += ath9k_common.o
 ath9k_common-y:=        common.o \
                         common-init.o \
-                        common-beacon.o
+                        common-beacon.o \
+                        common-debug.o
 
 ath9k_htc-y +=  htc_hst.o \
                 hif_usb.o \
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 33a2ae77b595..b20469425865 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -23,8 +23,8 @@
 #include <linux/leds.h>
 #include <linux/completion.h>
 
-#include "debug.h"
 #include "common.h"
+#include "debug.h"
 #include "mci.h"
 #include "dfs.h"
 #include "spectral.h"
@@ -274,6 +274,7 @@ struct ath_node {
 #ifdef CONFIG_ATH9K_STATION_STATISTICS
         struct ath_rx_rate_stats rx_rate_stats;
 #endif
+        u8 key_idx[4];
 };
 
 struct ath_tx_control {
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index bd9e634879e6..e387f0b2954a 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -537,8 +537,6 @@ static void ath9k_cache_beacon_config(struct ath_softc *sc,
         cur_conf->dtim_period = bss_conf->dtim_period;
         cur_conf->dtim_count = 1;
         cur_conf->ibss_creator = bss_conf->ibss_creator;
-        cur_conf->bmiss_timeout =
-                ATH_DEFAULT_BMISS_LIMIT * cur_conf->beacon_interval;
 
         /*
          * It looks like mac80211 may end up using beacon interval of zero in
@@ -549,6 +547,9 @@ static void ath9k_cache_beacon_config(struct ath_softc *sc,
         if (cur_conf->beacon_interval == 0)
                 cur_conf->beacon_interval = 100;
 
+        cur_conf->bmiss_timeout =
+                ATH_DEFAULT_BMISS_LIMIT * cur_conf->beacon_interval;
+
         /*
          * We don't parse dtim period from mac80211 during the driver
          * initialization as it breaks association with hidden-ssid
diff --git a/drivers/net/wireless/ath/ath9k/common-debug.c b/drivers/net/wireless/ath/ath9k/common-debug.c
new file mode 100644
index 000000000000..3b289f933405
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/common-debug.c
@@ -0,0 +1,253 @@
+/*
+ * Copyright (c) 2008-2011 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "common.h"
+
+static ssize_t read_file_modal_eeprom(struct file *file, char __user *user_buf,
+                                      size_t count, loff_t *ppos)
+{
+        struct ath_hw *ah = file->private_data;
+        u32 len = 0, size = 6000;
+        char *buf;
+        size_t retval;
+
+        buf = kzalloc(size, GFP_KERNEL);
+        if (buf == NULL)
+                return -ENOMEM;
+
+        len = ah->eep_ops->dump_eeprom(ah, false, buf, len, size);
+
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+
+        return retval;
+}
+
+static const struct file_operations fops_modal_eeprom = {
+        .read = read_file_modal_eeprom,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+
+void ath9k_cmn_debug_modal_eeprom(struct dentry *debugfs_phy,
+                                  struct ath_hw *ah)
+{
+        debugfs_create_file("modal_eeprom", S_IRUSR, debugfs_phy, ah,
+                            &fops_modal_eeprom);
+}
+EXPORT_SYMBOL(ath9k_cmn_debug_modal_eeprom);
+
+static ssize_t read_file_base_eeprom(struct file *file, char __user *user_buf,
+                                     size_t count, loff_t *ppos)
+{
+        struct ath_hw *ah = file->private_data;
+        u32 len = 0, size = 1500;
+        ssize_t retval = 0;
+        char *buf;
+
+        buf = kzalloc(size, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        len = ah->eep_ops->dump_eeprom(ah, true, buf, len, size);
+
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+
+        return retval;
+}
+
+static const struct file_operations fops_base_eeprom = {
+        .read = read_file_base_eeprom,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+void ath9k_cmn_debug_base_eeprom(struct dentry *debugfs_phy,
+                                 struct ath_hw *ah)
+{
+        debugfs_create_file("base_eeprom", S_IRUSR, debugfs_phy, ah,
+                            &fops_base_eeprom);
+}
+EXPORT_SYMBOL(ath9k_cmn_debug_base_eeprom);
+
+void ath9k_cmn_debug_stat_rx(struct ath_rx_stats *rxstats,
+                             struct ath_rx_status *rs)
+{
+#define RX_PHY_ERR_INC(c) rxstats->phy_err_stats[c]++
+#define RX_CMN_STAT_INC(c) (rxstats->c++)
+
+        RX_CMN_STAT_INC(rx_pkts_all);
+        rxstats->rx_bytes_all += rs->rs_datalen;
+
+        if (rs->rs_status & ATH9K_RXERR_CRC)
+                RX_CMN_STAT_INC(crc_err);
+        if (rs->rs_status & ATH9K_RXERR_DECRYPT)
+                RX_CMN_STAT_INC(decrypt_crc_err);
+        if (rs->rs_status & ATH9K_RXERR_MIC)
+                RX_CMN_STAT_INC(mic_err);
+        if (rs->rs_status & ATH9K_RX_DELIM_CRC_PRE)
+                RX_CMN_STAT_INC(pre_delim_crc_err);
+        if (rs->rs_status & ATH9K_RX_DELIM_CRC_POST)
+                RX_CMN_STAT_INC(post_delim_crc_err);
+        if (rs->rs_status & ATH9K_RX_DECRYPT_BUSY)
+                RX_CMN_STAT_INC(decrypt_busy_err);
+
+        if (rs->rs_status & ATH9K_RXERR_PHY) {
+                RX_CMN_STAT_INC(phy_err);
+                if (rs->rs_phyerr < ATH9K_PHYERR_MAX)
+                        RX_PHY_ERR_INC(rs->rs_phyerr);
+        }
+
+#undef RX_CMN_STAT_INC
+#undef RX_PHY_ERR_INC
+}
+EXPORT_SYMBOL(ath9k_cmn_debug_stat_rx);
+
+static ssize_t read_file_recv(struct file *file, char __user *user_buf,
+                              size_t count, loff_t *ppos)
+{
+#define RXS_ERR(s, e)                                   \
+        do {                                            \
+                len += scnprintf(buf + len, size - len, \
+                                 "%18s : %10u\n", s,    \
+                                 rxstats->e);           \
+        } while (0)
+
+        struct ath_rx_stats *rxstats = file->private_data;
+        char *buf;
+        unsigned int len = 0, size = 1600;
+        ssize_t retval = 0;
+
+        buf = kzalloc(size, GFP_KERNEL);
+        if (buf == NULL)
+                return -ENOMEM;
+
+        RXS_ERR("PKTS-ALL", rx_pkts_all);
+        RXS_ERR("BYTES-ALL", rx_bytes_all);
+        RXS_ERR("BEACONS", rx_beacons);
+        RXS_ERR("FRAGS", rx_frags);
+        RXS_ERR("SPECTRAL", rx_spectral);
+
+        RXS_ERR("CRC ERR", crc_err);
+        RXS_ERR("DECRYPT CRC ERR", decrypt_crc_err);
+        RXS_ERR("PHY ERR", phy_err);
+        RXS_ERR("MIC ERR", mic_err);
+        RXS_ERR("PRE-DELIM CRC ERR", pre_delim_crc_err);
+        RXS_ERR("POST-DELIM CRC ERR", post_delim_crc_err);
+        RXS_ERR("DECRYPT BUSY ERR", decrypt_busy_err);
+        RXS_ERR("LENGTH-ERR", rx_len_err);
+        RXS_ERR("OOM-ERR", rx_oom_err);
+        RXS_ERR("RATE-ERR", rx_rate_err);
+        RXS_ERR("TOO-MANY-FRAGS", rx_too_many_frags_err);
+
+        if (len > size)
+                len = size;
+
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+
+        return retval;
+
+#undef RXS_ERR
+}
+
+static const struct file_operations fops_recv = {
+        .read = read_file_recv,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+void ath9k_cmn_debug_recv(struct dentry *debugfs_phy,
+                          struct ath_rx_stats *rxstats)
+{
+        debugfs_create_file("recv", S_IRUSR, debugfs_phy, rxstats,
+                            &fops_recv);
+}
+EXPORT_SYMBOL(ath9k_cmn_debug_recv);
+
+static ssize_t read_file_phy_err(struct file *file, char __user *user_buf,
+                                 size_t count, loff_t *ppos)
+{
+#define PHY_ERR(s, p) \
+        len += scnprintf(buf + len, size - len, "%22s : %10u\n", s, \
+                         rxstats->phy_err_stats[p]);
+
+        struct ath_rx_stats *rxstats = file->private_data;
+        char *buf;
+        unsigned int len = 0, size = 1600;
+        ssize_t retval = 0;
+
+        buf = kzalloc(size, GFP_KERNEL);
+        if (buf == NULL)
+                return -ENOMEM;
+
+        PHY_ERR("UNDERRUN ERR", ATH9K_PHYERR_UNDERRUN);
+        PHY_ERR("TIMING ERR", ATH9K_PHYERR_TIMING);
+        PHY_ERR("PARITY ERR", ATH9K_PHYERR_PARITY);
+        PHY_ERR("RATE ERR", ATH9K_PHYERR_RATE);
+        PHY_ERR("LENGTH ERR", ATH9K_PHYERR_LENGTH);
+        PHY_ERR("RADAR ERR", ATH9K_PHYERR_RADAR);
+        PHY_ERR("SERVICE ERR", ATH9K_PHYERR_SERVICE);
+        PHY_ERR("TOR ERR", ATH9K_PHYERR_TOR);
+        PHY_ERR("OFDM-TIMING ERR", ATH9K_PHYERR_OFDM_TIMING);
+        PHY_ERR("OFDM-SIGNAL-PARITY ERR", ATH9K_PHYERR_OFDM_SIGNAL_PARITY);
+        PHY_ERR("OFDM-RATE ERR", ATH9K_PHYERR_OFDM_RATE_ILLEGAL);
+        PHY_ERR("OFDM-LENGTH ERR", ATH9K_PHYERR_OFDM_LENGTH_ILLEGAL);
+        PHY_ERR("OFDM-POWER-DROP ERR", ATH9K_PHYERR_OFDM_POWER_DROP);
+        PHY_ERR("OFDM-SERVICE ERR", ATH9K_PHYERR_OFDM_SERVICE);
+        PHY_ERR("OFDM-RESTART ERR", ATH9K_PHYERR_OFDM_RESTART);
+        PHY_ERR("FALSE-RADAR-EXT ERR", ATH9K_PHYERR_FALSE_RADAR_EXT);
+        PHY_ERR("CCK-TIMING ERR", ATH9K_PHYERR_CCK_TIMING);
+        PHY_ERR("CCK-HEADER-CRC ERR", ATH9K_PHYERR_CCK_HEADER_CRC);
+        PHY_ERR("CCK-RATE ERR", ATH9K_PHYERR_CCK_RATE_ILLEGAL);
+        PHY_ERR("CCK-SERVICE ERR", ATH9K_PHYERR_CCK_SERVICE);
+        PHY_ERR("CCK-RESTART ERR", ATH9K_PHYERR_CCK_RESTART);
+        PHY_ERR("CCK-LENGTH ERR", ATH9K_PHYERR_CCK_LENGTH_ILLEGAL);
+        PHY_ERR("CCK-POWER-DROP ERR", ATH9K_PHYERR_CCK_POWER_DROP);
+        PHY_ERR("HT-CRC ERR", ATH9K_PHYERR_HT_CRC_ERROR);
+        PHY_ERR("HT-LENGTH ERR", ATH9K_PHYERR_HT_LENGTH_ILLEGAL);
+        PHY_ERR("HT-RATE ERR", ATH9K_PHYERR_HT_RATE_ILLEGAL);
+
+        if (len > size)
+                len = size;
+
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+
+        return retval;
+
+#undef PHY_ERR
+}
+
+static const struct file_operations fops_phy_err = {
+        .read = read_file_phy_err,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+void ath9k_cmn_debug_phy_err(struct dentry *debugfs_phy,
+                             struct ath_rx_stats *rxstats)
+{
+        debugfs_create_file("phy_err", S_IRUSR, debugfs_phy, rxstats,
+                            &fops_phy_err);
+}
+EXPORT_SYMBOL(ath9k_cmn_debug_phy_err);
diff --git a/drivers/net/wireless/ath/ath9k/common-debug.h b/drivers/net/wireless/ath/ath9k/common-debug.h
new file mode 100644
index 000000000000..7c9788490f7f
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/common-debug.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (c) 2008-2011 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+
+
+/**
+ * struct ath_rx_stats - RX Statistics
+ * @rx_pkts_all:  No. of total frames received, including ones that
+        may have had errors.
+ * @rx_bytes_all:  No. of total bytes received, including ones that
+        may have had errors.
+ * @crc_err: No. of frames with incorrect CRC value
+ * @decrypt_crc_err: No. of frames whose CRC check failed after
+        decryption process completed
+ * @phy_err: No. of frames whose reception failed because the PHY
+        encountered an error
+ * @mic_err: No. of frames with incorrect TKIP MIC verification failure
+ * @pre_delim_crc_err: Pre-Frame delimiter CRC error detections
+ * @post_delim_crc_err: Post-Frame delimiter CRC error detections
+ * @decrypt_busy_err: Decryption interruptions counter
+ * @phy_err_stats: Individual PHY error statistics
+ * @rx_len_err:  No. of frames discarded due to bad length.
+ * @rx_oom_err:  No. of frames dropped due to OOM issues.
+ * @rx_rate_err:  No. of frames dropped due to rate errors.
+ * @rx_too_many_frags_err:  Frames dropped due to too-many-frags received.
+ * @rx_beacons:  No. of beacons received.
+ * @rx_frags:  No. of rx-fragements received.
+ * @rx_spectral: No of spectral packets received.
+ */
+struct ath_rx_stats {
+        u32 rx_pkts_all;
+        u32 rx_bytes_all;
+        u32 crc_err;
+        u32 decrypt_crc_err;
+        u32 phy_err;
+        u32 mic_err;
+        u32 pre_delim_crc_err;
+        u32 post_delim_crc_err;
+        u32 decrypt_busy_err;
+        u32 phy_err_stats[ATH9K_PHYERR_MAX];
+        u32 rx_len_err;
+        u32 rx_oom_err;
+        u32 rx_rate_err;
+        u32 rx_too_many_frags_err;
+        u32 rx_beacons;
+        u32 rx_frags;
+        u32 rx_spectral;
+};
+
+void ath9k_cmn_debug_modal_eeprom(struct dentry *debugfs_phy,
+                                  struct ath_hw *ah);
+void ath9k_cmn_debug_base_eeprom(struct dentry *debugfs_phy,
+                                 struct ath_hw *ah);
+void ath9k_cmn_debug_stat_rx(struct ath_rx_stats *rxstats,
+                             struct ath_rx_status *rs);
+void ath9k_cmn_debug_recv(struct dentry *debugfs_phy,
+                          struct ath_rx_stats *rxstats);
+void ath9k_cmn_debug_phy_err(struct dentry *debugfs_phy,
+                             struct ath_rx_stats *rxstats);
diff --git a/drivers/net/wireless/ath/ath9k/common.h b/drivers/net/wireless/ath/ath9k/common.h
index ca38116838f0..ffc454b18637 100644
--- a/drivers/net/wireless/ath/ath9k/common.h
+++ b/drivers/net/wireless/ath/ath9k/common.h
@@ -23,6 +23,7 @@
 
 #include "common-init.h"
 #include "common-beacon.h"
+#include "common-debug.h"
 
 /* Common header for Atheros 802.11n base driver cores */
 
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 780ff1bee6f6..6cc42be48d4e 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -948,151 +948,11 @@ static const struct file_operations fops_reset = {
         .llseek = default_llseek,
 };
 
-static ssize_t read_file_recv(struct file *file, char __user *user_buf,
-                              size_t count, loff_t *ppos)
-{
-#define RXS_ERR(s, e)                                       \
-        do {                                                \
-                len += scnprintf(buf + len, size - len,     \
-                                 "%18s : %10u\n", s,        \
-                                 sc->debug.stats.rxstats.e);\
-        } while (0)
-
-        struct ath_softc *sc = file->private_data;
-        char *buf;
-        unsigned int len = 0, size = 1600;
-        ssize_t retval = 0;
-
-        buf = kzalloc(size, GFP_KERNEL);
-        if (buf == NULL)
-                return -ENOMEM;
-
-        RXS_ERR("PKTS-ALL", rx_pkts_all);
-        RXS_ERR("BYTES-ALL", rx_bytes_all);
-        RXS_ERR("BEACONS", rx_beacons);
-        RXS_ERR("FRAGS", rx_frags);
-        RXS_ERR("SPECTRAL", rx_spectral);
-
-        RXS_ERR("CRC ERR", crc_err);
-        RXS_ERR("DECRYPT CRC ERR", decrypt_crc_err);
-        RXS_ERR("PHY ERR", phy_err);
-        RXS_ERR("MIC ERR", mic_err);
-        RXS_ERR("PRE-DELIM CRC ERR", pre_delim_crc_err);
-        RXS_ERR("POST-DELIM CRC ERR", post_delim_crc_err);
-        RXS_ERR("DECRYPT BUSY ERR", decrypt_busy_err);
-        RXS_ERR("LENGTH-ERR", rx_len_err);
-        RXS_ERR("OOM-ERR", rx_oom_err);
-        RXS_ERR("RATE-ERR", rx_rate_err);
-        RXS_ERR("TOO-MANY-FRAGS", rx_too_many_frags_err);
-
-        if (len > size)
-                len = size;
-
-        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-        kfree(buf);
-
-        return retval;
-
-#undef RXS_ERR
-}
-
 void ath_debug_stat_rx(struct ath_softc *sc, struct ath_rx_status *rs)
 {
-#define RX_PHY_ERR_INC(c) sc->debug.stats.rxstats.phy_err_stats[c]++
-
-        RX_STAT_INC(rx_pkts_all);
-        sc->debug.stats.rxstats.rx_bytes_all += rs->rs_datalen;
-
-        if (rs->rs_status & ATH9K_RXERR_CRC)
-                RX_STAT_INC(crc_err);
-        if (rs->rs_status & ATH9K_RXERR_DECRYPT)
-                RX_STAT_INC(decrypt_crc_err);
-        if (rs->rs_status & ATH9K_RXERR_MIC)
-                RX_STAT_INC(mic_err);
-        if (rs->rs_status & ATH9K_RX_DELIM_CRC_PRE)
-                RX_STAT_INC(pre_delim_crc_err);
-        if (rs->rs_status & ATH9K_RX_DELIM_CRC_POST)
-                RX_STAT_INC(post_delim_crc_err);
-        if (rs->rs_status & ATH9K_RX_DECRYPT_BUSY)
-                RX_STAT_INC(decrypt_busy_err);
-
-        if (rs->rs_status & ATH9K_RXERR_PHY) {
-                RX_STAT_INC(phy_err);
-                if (rs->rs_phyerr < ATH9K_PHYERR_MAX)
-                        RX_PHY_ERR_INC(rs->rs_phyerr);
-        }
-
-#undef RX_PHY_ERR_INC
+        ath9k_cmn_debug_stat_rx(&sc->debug.stats.rxstats, rs);
 }
 
-static const struct file_operations fops_recv = {
-        .read = read_file_recv,
-        .open = simple_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
-static ssize_t read_file_phy_err(struct file *file, char __user *user_buf,
-                                 size_t count, loff_t *ppos)
-{
-#define PHY_ERR(s, p) \
-        len += scnprintf(buf + len, size - len, "%22s : %10u\n", s, \
-                         sc->debug.stats.rxstats.phy_err_stats[p]);
-
-        struct ath_softc *sc = file->private_data;
-        char *buf;
-        unsigned int len = 0, size = 1600;
-        ssize_t retval = 0;
-
-        buf = kzalloc(size, GFP_KERNEL);
-        if (buf == NULL)
-                return -ENOMEM;
-
-        PHY_ERR("UNDERRUN ERR", ATH9K_PHYERR_UNDERRUN);
-        PHY_ERR("TIMING ERR", ATH9K_PHYERR_TIMING);
-        PHY_ERR("PARITY ERR", ATH9K_PHYERR_PARITY);
-        PHY_ERR("RATE ERR", ATH9K_PHYERR_RATE);
-        PHY_ERR("LENGTH ERR", ATH9K_PHYERR_LENGTH);
-        PHY_ERR("RADAR ERR", ATH9K_PHYERR_RADAR);
-        PHY_ERR("SERVICE ERR", ATH9K_PHYERR_SERVICE);
-        PHY_ERR("TOR ERR", ATH9K_PHYERR_TOR);
-        PHY_ERR("OFDM-TIMING ERR", ATH9K_PHYERR_OFDM_TIMING);
-        PHY_ERR("OFDM-SIGNAL-PARITY ERR", ATH9K_PHYERR_OFDM_SIGNAL_PARITY);
-        PHY_ERR("OFDM-RATE ERR", ATH9K_PHYERR_OFDM_RATE_ILLEGAL);
-        PHY_ERR("OFDM-LENGTH ERR", ATH9K_PHYERR_OFDM_LENGTH_ILLEGAL);
-        PHY_ERR("OFDM-POWER-DROP ERR", ATH9K_PHYERR_OFDM_POWER_DROP);
-        PHY_ERR("OFDM-SERVICE ERR", ATH9K_PHYERR_OFDM_SERVICE);
-        PHY_ERR("OFDM-RESTART ERR", ATH9K_PHYERR_OFDM_RESTART);
-        PHY_ERR("FALSE-RADAR-EXT ERR", ATH9K_PHYERR_FALSE_RADAR_EXT);
-        PHY_ERR("CCK-TIMING ERR", ATH9K_PHYERR_CCK_TIMING);
-        PHY_ERR("CCK-HEADER-CRC ERR", ATH9K_PHYERR_CCK_HEADER_CRC);
-        PHY_ERR("CCK-RATE ERR", ATH9K_PHYERR_CCK_RATE_ILLEGAL);
-        PHY_ERR("CCK-SERVICE ERR", ATH9K_PHYERR_CCK_SERVICE);
-        PHY_ERR("CCK-RESTART ERR", ATH9K_PHYERR_CCK_RESTART);
-        PHY_ERR("CCK-LENGTH ERR", ATH9K_PHYERR_CCK_LENGTH_ILLEGAL);
-        PHY_ERR("CCK-POWER-DROP ERR", ATH9K_PHYERR_CCK_POWER_DROP);
-        PHY_ERR("HT-CRC ERR", ATH9K_PHYERR_HT_CRC_ERROR);
-        PHY_ERR("HT-LENGTH ERR", ATH9K_PHYERR_HT_LENGTH_ILLEGAL);
-        PHY_ERR("HT-RATE ERR", ATH9K_PHYERR_HT_RATE_ILLEGAL);
-
-        if (len > size)
-                len = size;
-
-        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-        kfree(buf);
-
-        return retval;
-
-#undef PHY_ERR
-}
-
-static const struct file_operations fops_phy_err = {
-        .read = read_file_phy_err,
-        .open = simple_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
 static ssize_t read_file_regidx(struct file *file, char __user *user_buf,
                                 size_t count, loff_t *ppos)
 {
@@ -1268,62 +1128,6 @@ static const struct file_operations fops_dump_nfcal = {
         .llseek = default_llseek,
 };
 
-static ssize_t read_file_base_eeprom(struct file *file, char __user *user_buf,
-                                     size_t count, loff_t *ppos)
-{
-        struct ath_softc *sc = file->private_data;
-        struct ath_hw *ah = sc->sc_ah;
-        u32 len = 0, size = 1500;
-        ssize_t retval = 0;
-        char *buf;
-
-        buf = kzalloc(size, GFP_KERNEL);
-        if (!buf)
-                return -ENOMEM;
-
-        len = ah->eep_ops->dump_eeprom(ah, true, buf, len, size);
-
-        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-        kfree(buf);
-
-        return retval;
-}
-
-static const struct file_operations fops_base_eeprom = {
-        .read = read_file_base_eeprom,
-        .open = simple_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
-static ssize_t read_file_modal_eeprom(struct file *file, char __user *user_buf,
-                                      size_t count, loff_t *ppos)
-{
-        struct ath_softc *sc = file->private_data;
-        struct ath_hw *ah = sc->sc_ah;
-        u32 len = 0, size = 6000;
-        char *buf;
-        size_t retval;
-
-        buf = kzalloc(size, GFP_KERNEL);
-        if (buf == NULL)
-                return -ENOMEM;
-
-        len = ah->eep_ops->dump_eeprom(ah, false, buf, len, size);
-
-        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-        kfree(buf);
-
-        return retval;
-}
-
-static const struct file_operations fops_modal_eeprom = {
-        .read = read_file_modal_eeprom,
-        .open = simple_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
 #ifdef CONFIG_ATH9K_BTCOEX_SUPPORT
 static ssize_t read_file_btcoex(struct file *file, char __user *user_buf,
                                 size_t count, loff_t *ppos)
@@ -1524,10 +1328,10 @@ int ath9k_init_debug(struct ath_hw *ah)
                             &fops_misc);
         debugfs_create_file("reset", S_IRUSR, sc->debug.debugfs_phy, sc,
                             &fops_reset);
-        debugfs_create_file("recv", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_recv);
-        debugfs_create_file("phy_err", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_phy_err);
+
+        ath9k_cmn_debug_recv(sc->debug.debugfs_phy, &sc->debug.stats.rxstats);
+        ath9k_cmn_debug_phy_err(sc->debug.debugfs_phy, &sc->debug.stats.rxstats);
+
         debugfs_create_u8("rx_chainmask", S_IRUSR, sc->debug.debugfs_phy,
                           &ah->rxchainmask);
         debugfs_create_u8("tx_chainmask", S_IRUSR, sc->debug.debugfs_phy,
@@ -1547,10 +1351,10 @@ int ath9k_init_debug(struct ath_hw *ah)
                             &fops_regdump);
         debugfs_create_file("dump_nfcal", S_IRUSR, sc->debug.debugfs_phy, sc,
                             &fops_dump_nfcal);
-        debugfs_create_file("base_eeprom", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_base_eeprom);
-        debugfs_create_file("modal_eeprom", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_modal_eeprom);
+
+        ath9k_cmn_debug_base_eeprom(sc->debug.debugfs_phy, sc->sc_ah);
+        ath9k_cmn_debug_modal_eeprom(sc->debug.debugfs_phy, sc->sc_ah);
+
         debugfs_create_u32("gpio_mask", S_IRUSR | S_IWUSR,
                            sc->debug.debugfs_phy, &sc->sc_ah->gpio_mask);
         debugfs_create_u32("gpio_val", S_IRUSR | S_IWUSR,
diff --git a/drivers/net/wireless/ath/ath9k/debug.h b/drivers/net/wireless/ath/ath9k/debug.h
index 559a68c2709c..53ae15bd0c9d 100644
--- a/drivers/net/wireless/ath/ath9k/debug.h
+++ b/drivers/net/wireless/ath/ath9k/debug.h
@@ -221,50 +221,6 @@ struct ath_rx_rate_stats {
         } cck_stats[4];
 };
 
-/**
- * struct ath_rx_stats - RX Statistics
- * @rx_pkts_all:  No. of total frames received, including ones that
-        may have had errors.
- * @rx_bytes_all:  No. of total bytes received, including ones that
-        may have had errors.
- * @crc_err: No. of frames with incorrect CRC value
- * @decrypt_crc_err: No. of frames whose CRC check failed after
-        decryption process completed
- * @phy_err: No. of frames whose reception failed because the PHY
-        encountered an error
- * @mic_err: No. of frames with incorrect TKIP MIC verification failure
- * @pre_delim_crc_err: Pre-Frame delimiter CRC error detections
- * @post_delim_crc_err: Post-Frame delimiter CRC error detections
- * @decrypt_busy_err: Decryption interruptions counter
- * @phy_err_stats: Individual PHY error statistics
- * @rx_len_err:  No. of frames discarded due to bad length.
- * @rx_oom_err:  No. of frames dropped due to OOM issues.
- * @rx_rate_err:  No. of frames dropped due to rate errors.
- * @rx_too_many_frags_err:  Frames dropped due to too-many-frags received.
- * @rx_beacons:  No. of beacons received.
- * @rx_frags:  No. of rx-fragements received.
- * @rx_spectral: No of spectral packets received.
- */
-struct ath_rx_stats {
-        u32 rx_pkts_all;
-        u32 rx_bytes_all;
-        u32 crc_err;
-        u32 decrypt_crc_err;
-        u32 phy_err;
-        u32 mic_err;
-        u32 pre_delim_crc_err;
-        u32 post_delim_crc_err;
-        u32 decrypt_busy_err;
-        u32 phy_err_stats[ATH9K_PHYERR_MAX];
-        u32 rx_len_err;
-        u32 rx_oom_err;
-        u32 rx_rate_err;
-        u32 rx_too_many_frags_err;
-        u32 rx_beacons;
-        u32 rx_frags;
-        u32 rx_spectral;
-};
-
 #define ANT_MAIN 0
 #define ANT_ALT  1
 
diff --git a/drivers/net/wireless/ath/ath9k/dfs.c b/drivers/net/wireless/ath/ath9k/dfs.c
index 857bb28b3894..e0c740dcfea8 100644
--- a/drivers/net/wireless/ath/ath9k/dfs.c
+++ b/drivers/net/wireless/ath/ath9k/dfs.c
@@ -178,12 +178,14 @@ void ath9k_dfs_process_phyerr(struct ath_softc *sc, void *data,
         pe.ts = mactime;
         if (ath9k_postprocess_radar_event(sc, &ard, &pe)) {
                 struct dfs_pattern_detector *pd = sc->dfs_detector;
-                static u64 last_ts;
+#ifdef CONFIG_ATH9K_DEBUGFS
                 ath_dbg(common, DFS,
                         "ath9k_dfs_process_phyerr: channel=%d, ts=%llu, "
                         "width=%d, rssi=%d, delta_ts=%llu\n",
-                        pe.freq, pe.ts, pe.width, pe.rssi, pe.ts-last_ts);
-                last_ts = pe.ts;
+                        pe.freq, pe.ts, pe.width, pe.rssi,
+                        pe.ts - sc->debug.stats.dfs_stats.last_ts);
+                sc->debug.stats.dfs_stats.last_ts = pe.ts;
+#endif
                 DFS_STAT_INC(sc, pulses_processed);
                 if (pd != NULL && pd->add_pulse(pd, &pe)) {
                         DFS_STAT_INC(sc, radar_detected);
diff --git a/drivers/net/wireless/ath/ath9k/dfs_debug.h b/drivers/net/wireless/ath/ath9k/dfs_debug.h
index 7936c9126a20..d9486867a5e0 100644
--- a/drivers/net/wireless/ath/ath9k/dfs_debug.h
+++ b/drivers/net/wireless/ath/ath9k/dfs_debug.h
@@ -51,6 +51,7 @@ struct ath_dfs_stats {
         /* pattern detection stats */
         u32 pulses_processed;
         u32 radar_detected;
+        u64 last_ts;
 };
 
 #if defined(CONFIG_ATH9K_DFS_DEBUGFS)
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index dab1f0cab993..09a5d72f3ff5 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -325,14 +325,14 @@ static inline struct ath9k_htc_tx_ctl *HTC_SKB_CB(struct sk_buff *skb)
 
 #define TX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.tx_stats.c++)
 #define TX_STAT_ADD(c, a) (hif_dev->htc_handle->drv_priv->debug.tx_stats.c += a)
-#define RX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.rx_stats.c++)
-#define RX_STAT_ADD(c, a) (hif_dev->htc_handle->drv_priv->debug.rx_stats.c += a)
+#define RX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c++)
+#define RX_STAT_ADD(c, a) (hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c += a)
 #define CAB_STAT_INC   priv->debug.tx_stats.cab_queued++
 
 #define TX_QSTAT_INC(q) (priv->debug.tx_stats.queue_stats[q]++)
 
 void ath9k_htc_err_stat_rx(struct ath9k_htc_priv *priv,
-                           struct ath_htc_rx_status *rxs);
+                           struct ath_rx_status *rs);
 
 struct ath_tx_stats {
         u32 buf_queued;
@@ -345,25 +345,18 @@ struct ath_tx_stats {
         u32 queue_stats[IEEE80211_NUM_ACS];
 };
 
-struct ath_rx_stats {
+struct ath_skbrx_stats {
         u32 skb_allocated;
         u32 skb_completed;
         u32 skb_completed_bytes;
         u32 skb_dropped;
-        u32 err_crc;
-        u32 err_decrypt_crc;
-        u32 err_mic;
-        u32 err_pre_delim;
-        u32 err_post_delim;
-        u32 err_decrypt_busy;
-        u32 err_phy;
-        u32 err_phy_stats[ATH9K_PHYERR_MAX];
 };
 
 struct ath9k_debug {
         struct dentry *debugfs_phy;
         struct ath_tx_stats tx_stats;
         struct ath_rx_stats rx_stats;
+        struct ath_skbrx_stats skbrx_stats;
 };
 
 void ath9k_htc_get_et_strings(struct ieee80211_hw *hw,
@@ -385,7 +378,7 @@ void ath9k_htc_get_et_stats(struct ieee80211_hw *hw,
 #define TX_QSTAT_INC(c) do { } while (0)
 
 static inline void ath9k_htc_err_stat_rx(struct ath9k_htc_priv *priv,
-                                         struct ath_htc_rx_status *rxs)
+                                         struct ath_rx_status *rs)
 {
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
index fb071ee4fcfb..8b529e4b8ac4 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
@@ -243,39 +243,14 @@ static const struct file_operations fops_xmit = {
 };
 
 void ath9k_htc_err_stat_rx(struct ath9k_htc_priv *priv,
-                           struct ath_htc_rx_status *rxs)
+                             struct ath_rx_status *rs)
 {
-#define RX_PHY_ERR_INC(c) priv->debug.rx_stats.err_phy_stats[c]++
-
-        if (rxs->rs_status & ATH9K_RXERR_CRC)
-                priv->debug.rx_stats.err_crc++;
-        if (rxs->rs_status & ATH9K_RXERR_DECRYPT)
-                priv->debug.rx_stats.err_decrypt_crc++;
-        if (rxs->rs_status & ATH9K_RXERR_MIC)
-                priv->debug.rx_stats.err_mic++;
-        if (rxs->rs_status & ATH9K_RX_DELIM_CRC_PRE)
-                priv->debug.rx_stats.err_pre_delim++;
-        if (rxs->rs_status & ATH9K_RX_DELIM_CRC_POST)
-                priv->debug.rx_stats.err_post_delim++;
-        if (rxs->rs_status & ATH9K_RX_DECRYPT_BUSY)
-                priv->debug.rx_stats.err_decrypt_busy++;
-
-        if (rxs->rs_status & ATH9K_RXERR_PHY) {
-                priv->debug.rx_stats.err_phy++;
-                if (rxs->rs_phyerr < ATH9K_PHYERR_MAX)
-                        RX_PHY_ERR_INC(rxs->rs_phyerr);
-        }
-
-#undef RX_PHY_ERR_INC
+        ath9k_cmn_debug_stat_rx(&priv->debug.rx_stats, rs);
 }
 
-static ssize_t read_file_recv(struct file *file, char __user *user_buf,
+static ssize_t read_file_skb_rx(struct file *file, char __user *user_buf,
                               size_t count, loff_t *ppos)
 {
-#define PHY_ERR(s, p)                                                   \
-        len += scnprintf(buf + len, size - len, "%20s : %10u\n", s,     \
-                         priv->debug.rx_stats.err_phy_stats[p]);
-
         struct ath9k_htc_priv *priv = file->private_data;
         char *buf;
         unsigned int len = 0, size = 1500;
@@ -287,63 +262,13 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
 
         len += scnprintf(buf + len, size - len,
                          "%20s : %10u\n", "SKBs allocated",
-                         priv->debug.rx_stats.skb_allocated);
+                         priv->debug.skbrx_stats.skb_allocated);
         len += scnprintf(buf + len, size - len,
                          "%20s : %10u\n", "SKBs completed",
-                         priv->debug.rx_stats.skb_completed);
+                         priv->debug.skbrx_stats.skb_completed);
         len += scnprintf(buf + len, size - len,
                          "%20s : %10u\n", "SKBs Dropped",
-                         priv->debug.rx_stats.skb_dropped);
-
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10u\n", "CRC ERR",
-                         priv->debug.rx_stats.err_crc);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10u\n", "DECRYPT CRC ERR",
-                         priv->debug.rx_stats.err_decrypt_crc);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10u\n", "MIC ERR",
-                         priv->debug.rx_stats.err_mic);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10u\n", "PRE-DELIM CRC ERR",
-                         priv->debug.rx_stats.err_pre_delim);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10u\n", "POST-DELIM CRC ERR",
-                         priv->debug.rx_stats.err_post_delim);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10u\n", "DECRYPT BUSY ERR",
-                         priv->debug.rx_stats.err_decrypt_busy);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10u\n", "TOTAL PHY ERR",
-                         priv->debug.rx_stats.err_phy);
-
-
-        PHY_ERR("UNDERRUN", ATH9K_PHYERR_UNDERRUN);
-        PHY_ERR("TIMING", ATH9K_PHYERR_TIMING);
-        PHY_ERR("PARITY", ATH9K_PHYERR_PARITY);
-        PHY_ERR("RATE", ATH9K_PHYERR_RATE);
-        PHY_ERR("LENGTH", ATH9K_PHYERR_LENGTH);
-        PHY_ERR("RADAR", ATH9K_PHYERR_RADAR);
-        PHY_ERR("SERVICE", ATH9K_PHYERR_SERVICE);
-        PHY_ERR("TOR", ATH9K_PHYERR_TOR);
-        PHY_ERR("OFDM-TIMING", ATH9K_PHYERR_OFDM_TIMING);
-        PHY_ERR("OFDM-SIGNAL-PARITY", ATH9K_PHYERR_OFDM_SIGNAL_PARITY);
-        PHY_ERR("OFDM-RATE", ATH9K_PHYERR_OFDM_RATE_ILLEGAL);
-        PHY_ERR("OFDM-LENGTH", ATH9K_PHYERR_OFDM_LENGTH_ILLEGAL);
-        PHY_ERR("OFDM-POWER-DROP", ATH9K_PHYERR_OFDM_POWER_DROP);
-        PHY_ERR("OFDM-SERVICE", ATH9K_PHYERR_OFDM_SERVICE);
-        PHY_ERR("OFDM-RESTART", ATH9K_PHYERR_OFDM_RESTART);
-        PHY_ERR("FALSE-RADAR-EXT", ATH9K_PHYERR_FALSE_RADAR_EXT);
-        PHY_ERR("CCK-TIMING", ATH9K_PHYERR_CCK_TIMING);
-        PHY_ERR("CCK-HEADER-CRC", ATH9K_PHYERR_CCK_HEADER_CRC);
-        PHY_ERR("CCK-RATE", ATH9K_PHYERR_CCK_RATE_ILLEGAL);
-        PHY_ERR("CCK-SERVICE", ATH9K_PHYERR_CCK_SERVICE);
-        PHY_ERR("CCK-RESTART", ATH9K_PHYERR_CCK_RESTART);
-        PHY_ERR("CCK-LENGTH", ATH9K_PHYERR_CCK_LENGTH_ILLEGAL);
-        PHY_ERR("CCK-POWER-DROP", ATH9K_PHYERR_CCK_POWER_DROP);
-        PHY_ERR("HT-CRC", ATH9K_PHYERR_HT_CRC_ERROR);
-        PHY_ERR("HT-LENGTH", ATH9K_PHYERR_HT_LENGTH_ILLEGAL);
-        PHY_ERR("HT-RATE", ATH9K_PHYERR_HT_RATE_ILLEGAL);
+                         priv->debug.skbrx_stats.skb_dropped);
 
         if (len > size)
                 len = size;
@@ -352,12 +277,10 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
         kfree(buf);
 
         return retval;
-
-#undef PHY_ERR
 }
 
-static const struct file_operations fops_recv = {
-        .read = read_file_recv,
+static const struct file_operations fops_skb_rx = {
+        .read = read_file_skb_rx,
         .open = simple_open,
         .owner = THIS_MODULE,
         .llseek = default_llseek,
@@ -486,423 +409,6 @@ static const struct file_operations fops_debug = {
         .llseek = default_llseek,
 };
 
-static ssize_t read_file_base_eeprom(struct file *file, char __user *user_buf,
-                                     size_t count, loff_t *ppos)
-{
-        struct ath9k_htc_priv *priv = file->private_data;
-        struct ath_common *common = ath9k_hw_common(priv->ah);
-        struct base_eep_header *pBase = NULL;
-        unsigned int len = 0, size = 1500;
-        ssize_t retval = 0;
-        char *buf;
-
-        pBase = ath9k_htc_get_eeprom_base(priv);
-
-        if (pBase == NULL) {
-                ath_err(common, "Unknown EEPROM type\n");
-                return 0;
-        }
-
-        buf = kzalloc(size, GFP_KERNEL);
-        if (buf == NULL)
-                return -ENOMEM;
-
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n", "Major Version",
-                         pBase->version >> 12);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n", "Minor Version",
-                         pBase->version & 0xFFF);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n", "Checksum",
-                         pBase->checksum);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n", "Length",
-                         pBase->length);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n", "RegDomain1",
-                         pBase->regDmn[0]);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n", "RegDomain2",
-                         pBase->regDmn[1]);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "TX Mask", pBase->txMask);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "RX Mask", pBase->rxMask);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Allow 5GHz",
-                         !!(pBase->opCapFlags & AR5416_OPFLAGS_11A));
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Allow 2GHz",
-                         !!(pBase->opCapFlags & AR5416_OPFLAGS_11G));
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Disable 2GHz HT20",
-                         !!(pBase->opCapFlags & AR5416_OPFLAGS_N_2G_HT20));
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Disable 2GHz HT40",
-                         !!(pBase->opCapFlags & AR5416_OPFLAGS_N_2G_HT40));
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Disable 5Ghz HT20",
-                         !!(pBase->opCapFlags & AR5416_OPFLAGS_N_5G_HT20));
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Disable 5Ghz HT40",
-                         !!(pBase->opCapFlags & AR5416_OPFLAGS_N_5G_HT40));
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Big Endian",
-                         !!(pBase->eepMisc & 0x01));
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Cal Bin Major Ver",
-                         (pBase->binBuildNumber >> 24) & 0xFF);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Cal Bin Minor Ver",
-                         (pBase->binBuildNumber >> 16) & 0xFF);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Cal Bin Build",
-                         (pBase->binBuildNumber >> 8) & 0xFF);
-
-        /*
-         * UB91 specific data.
-         */
-        if (AR_SREV_9271(priv->ah)) {
-                struct base_eep_header_4k *pBase4k =
-                        &priv->ah->eeprom.map4k.baseEepHeader;
-
-                len += scnprintf(buf + len, size - len,
-                                 "%20s : %10d\n",
-                                 "TX Gain type",
-                                 pBase4k->txGainType);
-        }
-
-        /*
-         * UB95 specific data.
-         */
-        if (priv->ah->hw_version.usbdev == AR9287_USB) {
-                struct base_eep_ar9287_header *pBase9287 =
-                        &priv->ah->eeprom.map9287.baseEepHeader;
-
-                len += scnprintf(buf + len, size - len,
-                                 "%20s : %10ddB\n",
-                                 "Power Table Offset",
-                                 pBase9287->pwrTableOffset);
-
-                len += scnprintf(buf + len, size - len,
-                                 "%20s : %10d\n",
-                                 "OpenLoop Power Ctrl",
-                                 pBase9287->openLoopPwrCntl);
-        }
-
-        len += scnprintf(buf + len, size - len, "%20s : %pM\n", "MacAddress",
-                         pBase->macAddr);
-        if (len > size)
-                len = size;
-
-        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-        kfree(buf);
-
-        return retval;
-}
-
-static const struct file_operations fops_base_eeprom = {
-        .read = read_file_base_eeprom,
-        .open = simple_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
-static ssize_t read_4k_modal_eeprom(struct file *file,
-                                    char __user *user_buf,
-                                    size_t count, loff_t *ppos)
-{
-#define PR_EEP(_s, _val)                                                \
-        do {                                                            \
-                len += scnprintf(buf + len, size - len, "%20s : %10d\n",\
-                                 _s, (_val));                           \
-        } while (0)
-
-        struct ath9k_htc_priv *priv = file->private_data;
-        struct modal_eep_4k_header *pModal = &priv->ah->eeprom.map4k.modalHeader;
-        unsigned int len = 0, size = 2048;
-        ssize_t retval = 0;
-        char *buf;
-
-        buf = kzalloc(size, GFP_KERNEL);
-        if (buf == NULL)
-                return -ENOMEM;
-
-        PR_EEP("Chain0 Ant. Control", pModal->antCtrlChain[0]);
-        PR_EEP("Ant. Common Control", pModal->antCtrlCommon);
-        PR_EEP("Chain0 Ant. Gain", pModal->antennaGainCh[0]);
-        PR_EEP("Switch Settle", pModal->switchSettling);
-        PR_EEP("Chain0 TxRxAtten", pModal->txRxAttenCh[0]);
-        PR_EEP("Chain0 RxTxMargin", pModal->rxTxMarginCh[0]);
-        PR_EEP("ADC Desired size", pModal->adcDesiredSize);
-        PR_EEP("PGA Desired size", pModal->pgaDesiredSize);
-        PR_EEP("Chain0 xlna Gain", pModal->xlnaGainCh[0]);
-        PR_EEP("txEndToXpaOff", pModal->txEndToXpaOff);
-        PR_EEP("txEndToRxOn", pModal->txEndToRxOn);
-        PR_EEP("txFrameToXpaOn", pModal->txFrameToXpaOn);
-        PR_EEP("CCA Threshold)", pModal->thresh62);
-        PR_EEP("Chain0 NF Threshold", pModal->noiseFloorThreshCh[0]);
-        PR_EEP("xpdGain", pModal->xpdGain);
-        PR_EEP("External PD", pModal->xpd);
-        PR_EEP("Chain0 I Coefficient", pModal->iqCalICh[0]);
-        PR_EEP("Chain0 Q Coefficient", pModal->iqCalQCh[0]);
-        PR_EEP("pdGainOverlap", pModal->pdGainOverlap);
-        PR_EEP("O/D Bias Version", pModal->version);
-        PR_EEP("CCK OutputBias", pModal->ob_0);
-        PR_EEP("BPSK OutputBias", pModal->ob_1);
-        PR_EEP("QPSK OutputBias", pModal->ob_2);
-        PR_EEP("16QAM OutputBias", pModal->ob_3);
-        PR_EEP("64QAM OutputBias", pModal->ob_4);
-        PR_EEP("CCK Driver1_Bias", pModal->db1_0);
-        PR_EEP("BPSK Driver1_Bias", pModal->db1_1);
-        PR_EEP("QPSK Driver1_Bias", pModal->db1_2);
-        PR_EEP("16QAM Driver1_Bias", pModal->db1_3);
-        PR_EEP("64QAM Driver1_Bias", pModal->db1_4);
-        PR_EEP("CCK Driver2_Bias", pModal->db2_0);
-        PR_EEP("BPSK Driver2_Bias", pModal->db2_1);
-        PR_EEP("QPSK Driver2_Bias", pModal->db2_2);
-        PR_EEP("16QAM Driver2_Bias", pModal->db2_3);
-        PR_EEP("64QAM Driver2_Bias", pModal->db2_4);
-        PR_EEP("xPA Bias Level", pModal->xpaBiasLvl);
-        PR_EEP("txFrameToDataStart", pModal->txFrameToDataStart);
-        PR_EEP("txFrameToPaOn", pModal->txFrameToPaOn);
-        PR_EEP("HT40 Power Inc.", pModal->ht40PowerIncForPdadc);
-        PR_EEP("Chain0 bswAtten", pModal->bswAtten[0]);
-        PR_EEP("Chain0 bswMargin", pModal->bswMargin[0]);
-        PR_EEP("HT40 Switch Settle", pModal->swSettleHt40);
-        PR_EEP("Chain0 xatten2Db", pModal->xatten2Db[0]);
-        PR_EEP("Chain0 xatten2Margin", pModal->xatten2Margin[0]);
-        PR_EEP("Ant. Diversity ctl1", pModal->antdiv_ctl1);
-        PR_EEP("Ant. Diversity ctl2", pModal->antdiv_ctl2);
-        PR_EEP("TX Diversity", pModal->tx_diversity);
-
-        if (len > size)
-                len = size;
-
-        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-        kfree(buf);
-
-        return retval;
-
-#undef PR_EEP
-}
-
-static ssize_t read_def_modal_eeprom(struct file *file,
-                                     char __user *user_buf,
-                                     size_t count, loff_t *ppos)
-{
-#define PR_EEP(_s, _val)                                                \
-        do {                                                            \
-                if (pBase->opCapFlags & AR5416_OPFLAGS_11G) {           \
-                        pModal = &priv->ah->eeprom.def.modalHeader[1];  \
-                        len += scnprintf(buf + len, size - len, "%20s : %8d%7s", \
-                                         _s, (_val), "|");              \
-                }                                                       \
-                if (pBase->opCapFlags & AR5416_OPFLAGS_11A) {           \
-                        pModal = &priv->ah->eeprom.def.modalHeader[0];  \
-                        len += scnprintf(buf + len, size - len, "%9d\n",\
-                                        (_val));                        \
-                }                                                       \
-        } while (0)
-
-        struct ath9k_htc_priv *priv = file->private_data;
-        struct base_eep_header *pBase = &priv->ah->eeprom.def.baseEepHeader;
-        struct modal_eep_header *pModal = NULL;
-        unsigned int len = 0, size = 3500;
-        ssize_t retval = 0;
-        char *buf;
-
-        buf = kzalloc(size, GFP_KERNEL);
-        if (buf == NULL)
-                return -ENOMEM;
-
-        len += scnprintf(buf + len, size - len,
-                         "%31s %15s\n", "2G", "5G");
-        len += scnprintf(buf + len, size - len,
-                         "%32s %16s\n", "====", "====\n");
-
-        PR_EEP("Chain0 Ant. Control", pModal->antCtrlChain[0]);
-        PR_EEP("Chain1 Ant. Control", pModal->antCtrlChain[1]);
-        PR_EEP("Chain2 Ant. Control", pModal->antCtrlChain[2]);
-        PR_EEP("Ant. Common Control", pModal->antCtrlCommon);
-        PR_EEP("Chain0 Ant. Gain", pModal->antennaGainCh[0]);
-        PR_EEP("Chain1 Ant. Gain", pModal->antennaGainCh[1]);
-        PR_EEP("Chain2 Ant. Gain", pModal->antennaGainCh[2]);
-        PR_EEP("Switch Settle", pModal->switchSettling);
-        PR_EEP("Chain0 TxRxAtten", pModal->txRxAttenCh[0]);
-        PR_EEP("Chain1 TxRxAtten", pModal->txRxAttenCh[1]);
-        PR_EEP("Chain2 TxRxAtten", pModal->txRxAttenCh[2]);
-        PR_EEP("Chain0 RxTxMargin", pModal->rxTxMarginCh[0]);
-        PR_EEP("Chain1 RxTxMargin", pModal->rxTxMarginCh[1]);
-        PR_EEP("Chain2 RxTxMargin", pModal->rxTxMarginCh[2]);
-        PR_EEP("ADC Desired size", pModal->adcDesiredSize);
-        PR_EEP("PGA Desired size", pModal->pgaDesiredSize);
-        PR_EEP("Chain0 xlna Gain", pModal->xlnaGainCh[0]);
-        PR_EEP("Chain1 xlna Gain", pModal->xlnaGainCh[1]);
-        PR_EEP("Chain2 xlna Gain", pModal->xlnaGainCh[2]);
-        PR_EEP("txEndToXpaOff", pModal->txEndToXpaOff);
-        PR_EEP("txEndToRxOn", pModal->txEndToRxOn);
-        PR_EEP("txFrameToXpaOn", pModal->txFrameToXpaOn);
-        PR_EEP("CCA Threshold)", pModal->thresh62);
-        PR_EEP("Chain0 NF Threshold", pModal->noiseFloorThreshCh[0]);
-        PR_EEP("Chain1 NF Threshold", pModal->noiseFloorThreshCh[1]);
-        PR_EEP("Chain2 NF Threshold", pModal->noiseFloorThreshCh[2]);
-        PR_EEP("xpdGain", pModal->xpdGain);
-        PR_EEP("External PD", pModal->xpd);
-        PR_EEP("Chain0 I Coefficient", pModal->iqCalICh[0]);
-        PR_EEP("Chain1 I Coefficient", pModal->iqCalICh[1]);
-        PR_EEP("Chain2 I Coefficient", pModal->iqCalICh[2]);
-        PR_EEP("Chain0 Q Coefficient", pModal->iqCalQCh[0]);
-        PR_EEP("Chain1 Q Coefficient", pModal->iqCalQCh[1]);
-        PR_EEP("Chain2 Q Coefficient", pModal->iqCalQCh[2]);
-        PR_EEP("pdGainOverlap", pModal->pdGainOverlap);
-        PR_EEP("Chain0 OutputBias", pModal->ob);
-        PR_EEP("Chain0 DriverBias", pModal->db);
-        PR_EEP("xPA Bias Level", pModal->xpaBiasLvl);
-        PR_EEP("2chain pwr decrease", pModal->pwrDecreaseFor2Chain);
-        PR_EEP("3chain pwr decrease", pModal->pwrDecreaseFor3Chain);
-        PR_EEP("txFrameToDataStart", pModal->txFrameToDataStart);
-        PR_EEP("txFrameToPaOn", pModal->txFrameToPaOn);
-        PR_EEP("HT40 Power Inc.", pModal->ht40PowerIncForPdadc);
-        PR_EEP("Chain0 bswAtten", pModal->bswAtten[0]);
-        PR_EEP("Chain1 bswAtten", pModal->bswAtten[1]);
-        PR_EEP("Chain2 bswAtten", pModal->bswAtten[2]);
-        PR_EEP("Chain0 bswMargin", pModal->bswMargin[0]);
-        PR_EEP("Chain1 bswMargin", pModal->bswMargin[1]);
-        PR_EEP("Chain2 bswMargin", pModal->bswMargin[2]);
-        PR_EEP("HT40 Switch Settle", pModal->swSettleHt40);
-        PR_EEP("Chain0 xatten2Db", pModal->xatten2Db[0]);
-        PR_EEP("Chain1 xatten2Db", pModal->xatten2Db[1]);
-        PR_EEP("Chain2 xatten2Db", pModal->xatten2Db[2]);
-        PR_EEP("Chain0 xatten2Margin", pModal->xatten2Margin[0]);
-        PR_EEP("Chain1 xatten2Margin", pModal->xatten2Margin[1]);
-        PR_EEP("Chain2 xatten2Margin", pModal->xatten2Margin[2]);
-        PR_EEP("Chain1 OutputBias", pModal->ob_ch1);
-        PR_EEP("Chain1 DriverBias", pModal->db_ch1);
-        PR_EEP("LNA Control", pModal->lna_ctl);
-        PR_EEP("XPA Bias Freq0", pModal->xpaBiasLvlFreq[0]);
-        PR_EEP("XPA Bias Freq1", pModal->xpaBiasLvlFreq[1]);
-        PR_EEP("XPA Bias Freq2", pModal->xpaBiasLvlFreq[2]);
-
-        if (len > size)
-                len = size;
-
-        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-        kfree(buf);
-
-        return retval;
-
-#undef PR_EEP
-}
-
-static ssize_t read_9287_modal_eeprom(struct file *file,
-                                      char __user *user_buf,
-                                      size_t count, loff_t *ppos)
-{
-#define PR_EEP(_s, _val)                                                \
-        do {                                                            \
-                len += scnprintf(buf + len, size - len, "%20s : %10d\n",\
-                                 _s, (_val));                           \
-        } while (0)
-
-        struct ath9k_htc_priv *priv = file->private_data;
-        struct modal_eep_ar9287_header *pModal = &priv->ah->eeprom.map9287.modalHeader;
-        unsigned int len = 0, size = 3000;
-        ssize_t retval = 0;
-        char *buf;
-
-        buf = kzalloc(size, GFP_KERNEL);
-        if (buf == NULL)
-                return -ENOMEM;
-
-        PR_EEP("Chain0 Ant. Control", pModal->antCtrlChain[0]);
-        PR_EEP("Chain1 Ant. Control", pModal->antCtrlChain[1]);
-        PR_EEP("Ant. Common Control", pModal->antCtrlCommon);
-        PR_EEP("Chain0 Ant. Gain", pModal->antennaGainCh[0]);
-        PR_EEP("Chain1 Ant. Gain", pModal->antennaGainCh[1]);
-        PR_EEP("Switch Settle", pModal->switchSettling);
-        PR_EEP("Chain0 TxRxAtten", pModal->txRxAttenCh[0]);
-        PR_EEP("Chain1 TxRxAtten", pModal->txRxAttenCh[1]);
-        PR_EEP("Chain0 RxTxMargin", pModal->rxTxMarginCh[0]);
-        PR_EEP("Chain1 RxTxMargin", pModal->rxTxMarginCh[1]);
-        PR_EEP("ADC Desired size", pModal->adcDesiredSize);
-        PR_EEP("txEndToXpaOff", pModal->txEndToXpaOff);
-        PR_EEP("txEndToRxOn", pModal->txEndToRxOn);
-        PR_EEP("txFrameToXpaOn", pModal->txFrameToXpaOn);
-        PR_EEP("CCA Threshold)", pModal->thresh62);
-        PR_EEP("Chain0 NF Threshold", pModal->noiseFloorThreshCh[0]);
-        PR_EEP("Chain1 NF Threshold", pModal->noiseFloorThreshCh[1]);
-        PR_EEP("xpdGain", pModal->xpdGain);
-        PR_EEP("External PD", pModal->xpd);
-        PR_EEP("Chain0 I Coefficient", pModal->iqCalICh[0]);
-        PR_EEP("Chain1 I Coefficient", pModal->iqCalICh[1]);
-        PR_EEP("Chain0 Q Coefficient", pModal->iqCalQCh[0]);
-        PR_EEP("Chain1 Q Coefficient", pModal->iqCalQCh[1]);
-        PR_EEP("pdGainOverlap", pModal->pdGainOverlap);
-        PR_EEP("xPA Bias Level", pModal->xpaBiasLvl);
-        PR_EEP("txFrameToDataStart", pModal->txFrameToDataStart);
-        PR_EEP("txFrameToPaOn", pModal->txFrameToPaOn);
-        PR_EEP("HT40 Power Inc.", pModal->ht40PowerIncForPdadc);
-        PR_EEP("Chain0 bswAtten", pModal->bswAtten[0]);
-        PR_EEP("Chain1 bswAtten", pModal->bswAtten[1]);
-        PR_EEP("Chain0 bswMargin", pModal->bswMargin[0]);
-        PR_EEP("Chain1 bswMargin", pModal->bswMargin[1]);
-        PR_EEP("HT40 Switch Settle", pModal->swSettleHt40);
-        PR_EEP("AR92x7 Version", pModal->version);
-        PR_EEP("DriverBias1", pModal->db1);
-        PR_EEP("DriverBias2", pModal->db1);
-        PR_EEP("CCK OutputBias", pModal->ob_cck);
-        PR_EEP("PSK OutputBias", pModal->ob_psk);
-        PR_EEP("QAM OutputBias", pModal->ob_qam);
-        PR_EEP("PAL_OFF OutputBias", pModal->ob_pal_off);
-
-        if (len > size)
-                len = size;
-
-        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-        kfree(buf);
-
-        return retval;
-
-#undef PR_EEP
-}
-
-static ssize_t read_file_modal_eeprom(struct file *file, char __user *user_buf,
-                                      size_t count, loff_t *ppos)
-{
-        struct ath9k_htc_priv *priv = file->private_data;
-
-        if (AR_SREV_9271(priv->ah))
-                return read_4k_modal_eeprom(file, user_buf, count, ppos);
-        else if (priv->ah->hw_version.usbdev == AR9280_USB)
-                return read_def_modal_eeprom(file, user_buf, count, ppos);
-        else if (priv->ah->hw_version.usbdev == AR9287_USB)
-                return read_9287_modal_eeprom(file, user_buf, count, ppos);
-
-        return 0;
-}
-
-static const struct file_operations fops_modal_eeprom = {
-        .read = read_file_modal_eeprom,
-        .open = simple_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
-
 /* Ethtool support for get-stats */
 #define AMKSTR(nm) #nm "_BE", #nm "_BK", #nm "_VI", #nm "_VO"
 static const char ath9k_htc_gstrings_stats[][ETH_GSTRING_LEN] = {
@@ -947,6 +453,8 @@ int ath9k_htc_get_et_sset_count(struct ieee80211_hw *hw,
 
 #define STXBASE priv->debug.tx_stats
 #define SRXBASE priv->debug.rx_stats
+#define SKBTXBASE priv->debug.tx_stats
+#define SKBRXBASE priv->debug.skbrx_stats
 #define ASTXQ(a)                                        \
         data[i++] = STXBASE.a[IEEE80211_AC_BE];         \
         data[i++] = STXBASE.a[IEEE80211_AC_BK];         \
@@ -960,24 +468,24 @@ void ath9k_htc_get_et_stats(struct ieee80211_hw *hw,
         struct ath9k_htc_priv *priv = hw->priv;
         int i = 0;
 
-        data[i++] = STXBASE.skb_success;
-        data[i++] = STXBASE.skb_success_bytes;
-        data[i++] = SRXBASE.skb_completed;
-        data[i++] = SRXBASE.skb_completed_bytes;
+        data[i++] = SKBTXBASE.skb_success;
+        data[i++] = SKBTXBASE.skb_success_bytes;
+        data[i++] = SKBRXBASE.skb_completed;
+        data[i++] = SKBRXBASE.skb_completed_bytes;
 
         ASTXQ(queue_stats);
 
-        data[i++] = SRXBASE.err_crc;
-        data[i++] = SRXBASE.err_decrypt_crc;
-        data[i++] = SRXBASE.err_phy;
-        data[i++] = SRXBASE.err_mic;
-        data[i++] = SRXBASE.err_pre_delim;
-        data[i++] = SRXBASE.err_post_delim;
-        data[i++] = SRXBASE.err_decrypt_busy;
+        data[i++] = SRXBASE.crc_err;
+        data[i++] = SRXBASE.decrypt_crc_err;
+        data[i++] = SRXBASE.phy_err;
+        data[i++] = SRXBASE.mic_err;
+        data[i++] = SRXBASE.pre_delim_crc_err;
+        data[i++] = SRXBASE.post_delim_crc_err;
+        data[i++] = SRXBASE.decrypt_busy_err;
 
-        data[i++] = SRXBASE.err_phy_stats[ATH9K_PHYERR_RADAR];
-        data[i++] = SRXBASE.err_phy_stats[ATH9K_PHYERR_OFDM_TIMING];
-        data[i++] = SRXBASE.err_phy_stats[ATH9K_PHYERR_CCK_TIMING];
+        data[i++] = SRXBASE.phy_err_stats[ATH9K_PHYERR_RADAR];
+        data[i++] = SRXBASE.phy_err_stats[ATH9K_PHYERR_OFDM_TIMING];
+        data[i++] = SRXBASE.phy_err_stats[ATH9K_PHYERR_CCK_TIMING];
 
         WARN_ON(i != ATH9K_HTC_SSTATS_LEN);
 }
@@ -1001,18 +509,21 @@ int ath9k_htc_init_debug(struct ath_hw *ah)
                             priv, &fops_tgt_rx_stats);
         debugfs_create_file("xmit", S_IRUSR, priv->debug.debugfs_phy,
                             priv, &fops_xmit);
-        debugfs_create_file("recv", S_IRUSR, priv->debug.debugfs_phy,
-                            priv, &fops_recv);
+        debugfs_create_file("skb_rx", S_IRUSR, priv->debug.debugfs_phy,
+                            priv, &fops_skb_rx);
+
+        ath9k_cmn_debug_recv(priv->debug.debugfs_phy, &priv->debug.rx_stats);
+        ath9k_cmn_debug_phy_err(priv->debug.debugfs_phy, &priv->debug.rx_stats);
+
         debugfs_create_file("slot", S_IRUSR, priv->debug.debugfs_phy,
                             priv, &fops_slot);
         debugfs_create_file("queue", S_IRUSR, priv->debug.debugfs_phy,
                             priv, &fops_queue);
         debugfs_create_file("debug", S_IRUSR | S_IWUSR, priv->debug.debugfs_phy,
                             priv, &fops_debug);
-        debugfs_create_file("base_eeprom", S_IRUSR, priv->debug.debugfs_phy,
-                            priv, &fops_base_eeprom);
-        debugfs_create_file("modal_eeprom", S_IRUSR, priv->debug.debugfs_phy,
-                            priv, &fops_modal_eeprom);
+
+        ath9k_cmn_debug_base_eeprom(priv->debug.debugfs_phy, priv->ah);
+        ath9k_cmn_debug_modal_eeprom(priv->debug.debugfs_phy, priv->ah);
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index 289f3d8924b5..bb86eb2ffc95 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -996,8 +996,6 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
                 goto rx_next;
         }
 
-        ath9k_htc_err_stat_rx(priv, rxstatus);
-
         /* Get the RX status information */
 
         memset(rx_status, 0, sizeof(struct ieee80211_rx_status));
@@ -1005,6 +1003,7 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
         /* Copy everything from ath_htc_rx_status (HTC_RX_FRAME_HEADER).
          * After this, we can drop this part of skb. */
         rx_status_htc_to_ath(&rx_stats, rxstatus);
+        ath9k_htc_err_stat_rx(priv, &rx_stats);
         rx_status->mactime = be64_to_cpu(rxstatus->rs_tstamp);
         skb_pull(skb, HTC_RX_FRAME_HEADER_SIZE);
 
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index c8a9dfab1fee..2a8ed8375ec0 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -26,7 +26,6 @@
 #include "ar9003_mac.h"
 #include "ar9003_mci.h"
 #include "ar9003_phy.h"
-#include "debug.h"
 #include "ath9k.h"
 
 static bool ath9k_hw_set_reset_reg(struct ath_hw *ah, u32 type);
@@ -246,6 +245,8 @@ static void ath9k_hw_read_revisions(struct ath_hw *ah)
                 return;
         case AR9300_DEVID_AR953X:
                 ah->hw_version.macVersion = AR_SREV_VERSION_9531;
+                if (ah->get_mac_revision)
+                        ah->hw_version.macRev = ah->get_mac_revision();
                 return;
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 4243509616bd..1af77081181e 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -508,7 +508,7 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc,
         sc->tx99_power = MAX_RATE_POWER + 1;
         init_waitqueue_head(&sc->tx_wait);
 
-        if (!pdata) {
+        if (!pdata || pdata->use_eeprom) {
                 ah->ah_flags |= AH_USE_EEPROM;
                 sc->sc_ah->led_pin = -1;
         } else {
@@ -714,7 +714,8 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
         if (AR_SREV_9160_10_OR_LATER(sc->sc_ah) || ath9k_modparam_nohwcrypt)
                 hw->flags |= IEEE80211_HW_MFP_CAPABLE;
 
-        hw->wiphy->features |= NL80211_FEATURE_ACTIVE_MONITOR;
+        hw->wiphy->features |= (NL80211_FEATURE_ACTIVE_MONITOR |
+                                NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE);
 
         if (!config_enabled(CONFIG_ATH9K_TX99)) {
                 hw->wiphy->interface_modes =
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 51ce36f108f9..275205ab5f15 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -958,3 +958,25 @@ void ath9k_hw_set_interrupts(struct ath_hw *ah)
         return;
 }
 EXPORT_SYMBOL(ath9k_hw_set_interrupts);
+
+#define ATH9K_HW_MAX_DCU       10
+#define ATH9K_HW_SLICE_PER_DCU 16
+#define ATH9K_HW_BIT_IN_SLICE  16
+void ath9k_hw_set_tx_filter(struct ath_hw *ah, u8 destidx, bool set)
+{
+        int dcu_idx;
+        u32 filter;
+
+        for (dcu_idx = 0; dcu_idx < 10; dcu_idx++) {
+                filter = SM(set, AR_D_TXBLK_WRITE_COMMAND);
+                filter |= SM(dcu_idx, AR_D_TXBLK_WRITE_DCU);
+                filter |= SM((destidx / ATH9K_HW_SLICE_PER_DCU),
+                             AR_D_TXBLK_WRITE_SLICE);
+                filter |= BIT(destidx % ATH9K_HW_BIT_IN_SLICE);
+                ath_dbg(ath9k_hw_common(ah), PS,
+                        "DCU%d staid %d set %d txfilter %08x\n",
+                        dcu_idx, destidx, set, filter);
+                REG_WRITE(ah, AR_D_TXBLK_BASE, filter);
+        }
+}
+EXPORT_SYMBOL(ath9k_hw_set_tx_filter);
diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h
index 89df634e81f9..da7686757535 100644
--- a/drivers/net/wireless/ath/ath9k/mac.h
+++ b/drivers/net/wireless/ath/ath9k/mac.h
@@ -729,6 +729,7 @@ void ath9k_hw_startpcureceive(struct ath_hw *ah, bool is_scanning);
 void ath9k_hw_abortpcurecv(struct ath_hw *ah);
 bool ath9k_hw_stopdmarecv(struct ath_hw *ah, bool *reset);
 int ath9k_hw_beaconq_setup(struct ath_hw *ah);
+void ath9k_hw_set_tx_filter(struct ath_hw *ah, u8 destidx, bool set);
 
 /* Interrupt Handling */
 bool ath9k_hw_intrpend(struct ath_hw *ah);
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 8d7b9b66fefa..6965ceac7bc6 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -421,6 +421,7 @@ static void ath_node_attach(struct ath_softc *sc, struct ieee80211_sta *sta,
         an->sc = sc;
         an->sta = sta;
         an->vif = vif;
+        memset(&an->key_idx, 0, sizeof(an->key_idx));
 
         ath_tx_node_init(sc, an);
 }
@@ -1461,8 +1462,10 @@ static int ath9k_sta_add(struct ieee80211_hw *hw,
                 return 0;
 
         key = ath_key_config(common, vif, sta, &ps_key);
-        if (key > 0)
+        if (key > 0) {
                 an->ps_key = key;
+                an->key_idx[0] = key;
+        }
 
         return 0;
 }
@@ -1480,6 +1483,7 @@ static void ath9k_del_ps_key(struct ath_softc *sc,
 
         ath_key_delete(common, &ps_key);
         an->ps_key = 0;
+        an->key_idx[0] = 0;
 }
 
 static int ath9k_sta_remove(struct ieee80211_hw *hw,
@@ -1494,6 +1498,19 @@ static int ath9k_sta_remove(struct ieee80211_hw *hw,
         return 0;
 }
 
+static void ath9k_sta_set_tx_filter(struct ath_hw *ah,
+                                    struct ath_node *an,
+                                    bool set)
+{
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(an->key_idx); i++) {
+                if (!an->key_idx[i])
+                        continue;
+                ath9k_hw_set_tx_filter(ah, an->key_idx[i], set);
+        }
+}
+
 static void ath9k_sta_notify(struct ieee80211_hw *hw,
                          struct ieee80211_vif *vif,
                          enum sta_notify_cmd cmd,
@@ -1506,8 +1523,10 @@ static void ath9k_sta_notify(struct ieee80211_hw *hw,
         case STA_NOTIFY_SLEEP:
                 an->sleeping = true;
                 ath_tx_aggr_sleep(sta, sc, an);
+                ath9k_sta_set_tx_filter(sc->sc_ah, an, true);
                 break;
         case STA_NOTIFY_AWAKE:
+                ath9k_sta_set_tx_filter(sc->sc_ah, an, false);
                 an->sleeping = false;
                 ath_tx_aggr_wakeup(sc, an);
                 break;
@@ -1563,7 +1582,8 @@ static int ath9k_set_key(struct ieee80211_hw *hw,
 {
         struct ath_softc *sc = hw->priv;
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        int ret = 0;
+        struct ath_node *an = NULL;
+        int ret = 0, i;
 
         if (ath9k_modparam_nohwcrypt)
                 return -ENOSPC;
@@ -1585,13 +1605,16 @@ static int ath9k_set_key(struct ieee80211_hw *hw,
 
         mutex_lock(&sc->mutex);
         ath9k_ps_wakeup(sc);
-        ath_dbg(common, CONFIG, "Set HW Key\n");
+        ath_dbg(common, CONFIG, "Set HW Key %d\n", cmd);
+        if (sta)
+                an = (struct ath_node *)sta->drv_priv;
 
         switch (cmd) {
         case SET_KEY:
                 if (sta)
                         ath9k_del_ps_key(sc, vif, sta);
 
+                key->hw_key_idx = 0;
                 ret = ath_key_config(common, vif, sta, key);
                 if (ret >= 0) {
                         key->hw_key_idx = ret;
@@ -1604,9 +1627,27 @@ static int ath9k_set_key(struct ieee80211_hw *hw,
                                 key->flags |= IEEE80211_KEY_FLAG_SW_MGMT_TX;
                         ret = 0;
                 }
+                if (an && key->hw_key_idx) {
+                        for (i = 0; i < ARRAY_SIZE(an->key_idx); i++) {
+                                if (an->key_idx[i])
+                                        continue;
+                                an->key_idx[i] = key->hw_key_idx;
+                                break;
+                        }
+                        WARN_ON(i == ARRAY_SIZE(an->key_idx));
+                }
                 break;
         case DISABLE_KEY:
                 ath_key_delete(common, key);
+                if (an) {
+                        for (i = 0; i < ARRAY_SIZE(an->key_idx); i++) {
+                                if (an->key_idx[i] != key->hw_key_idx)
+                                        continue;
+                                an->key_idx[i] = 0;
+                                break;
+                        }
+                }
+                key->hw_key_idx = 0;
                 break;
         default:
                 ret = -EINVAL;
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index 914dbc6b1720..4dec09e565ed 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -686,7 +686,7 @@ static bool ath_pci_eeprom_read(struct ath_common *common, u32 off, u16 *data)
         struct ath_softc *sc = (struct ath_softc *) common->priv;
         struct ath9k_platform_data *pdata = sc->dev->platform_data;
 
-        if (pdata) {
+        if (pdata && !pdata->use_eeprom) {
                 if (off >= (ARRAY_SIZE(pdata->eeprom_data))) {
                         ath_err(common,
                                 "%s: eeprom read failed, offset %08x is out of range\n",
@@ -914,6 +914,7 @@ static int ath_pci_suspend(struct device *device)
          */
         ath9k_stop_btcoex(sc);
         ath9k_hw_disable(sc->sc_ah);
+        del_timer_sync(&sc->sleep_timer);
         ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_FULL_SLEEP);
 
         return 0;
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 441c71448e4c..43ae199601f7 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -538,8 +538,8 @@ static void ath_rx_ps_beacon(struct ath_softc *sc, struct sk_buff *skb)
                 sc->ps_flags &= ~PS_BEACON_SYNC;
                 ath_dbg(common, PS,
                         "Reconfigure beacon timers based on synchronized timestamp\n");
-                ath9k_set_beacon(sc);
-
+                if (!(WARN_ON_ONCE(sc->cur_beacon_conf.beacon_interval == 0)))
+                        ath9k_set_beacon(sc);
                 if (sc->p2p_ps_vif)
                         ath9k_update_p2p_ps(sc, sc->p2p_ps_vif->vif);
         }
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index b1fd3fa84983..f1bbce3f7774 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -505,9 +505,6 @@
 #define AR_D_QCUMASK         0x000003FF
 #define AR_D_QCUMASK_RESV0   0xFFFFFC00
 
-#define AR_D_TXBLK_CMD  0x1038
-#define AR_D_TXBLK_DATA(i) (AR_D_TXBLK_CMD+(i))
-
 #define AR_D0_LCL_IFS     0x1040
 #define AR_D1_LCL_IFS     0x1044
 #define AR_D2_LCL_IFS     0x1048
diff --git a/drivers/net/wireless/ath/carl9170/usb.c b/drivers/net/wireless/ath/carl9170/usb.c
index ca115f33746f..f35c7f30f9a6 100644
--- a/drivers/net/wireless/ath/carl9170/usb.c
+++ b/drivers/net/wireless/ath/carl9170/usb.c
@@ -1076,8 +1076,14 @@ static int carl9170_usb_probe(struct usb_interface *intf,
 
         carl9170_set_state(ar, CARL9170_STOPPED);
 
-        return request_firmware_nowait(THIS_MODULE, 1, CARL9170FW_NAME,
+        err = request_firmware_nowait(THIS_MODULE, 1, CARL9170FW_NAME,
                 &ar->udev->dev, GFP_KERNEL, ar, carl9170_usb_firmware_step2);
+        if (err) {
+                usb_put_dev(udev);
+                usb_put_dev(udev);
+                carl9170_free(ar);
+        }
+        return err;
 }
 
 static void carl9170_usb_disconnect(struct usb_interface *intf)
diff --git a/drivers/net/wireless/ath/dfs_pattern_detector.c b/drivers/net/wireless/ath/dfs_pattern_detector.c
index a1a69c5db409..650be79c7ac9 100644
--- a/drivers/net/wireless/ath/dfs_pattern_detector.c
+++ b/drivers/net/wireless/ath/dfs_pattern_detector.c
@@ -73,9 +73,52 @@ static const struct radar_types etsi_radar_types_v15 = {
         .radar_types            = etsi_radar_ref_types_v15,
 };
 
-/* for now, we support ETSI radar types, FCC and JP are TODO */
+#define FCC_PATTERN(ID, WMIN, WMAX, PMIN, PMAX, PRF, PPB)       \
+{                                                               \
+        ID, WIDTH_LOWER(WMIN), WIDTH_UPPER(WMAX),               \
+        PMIN - PRI_TOLERANCE,                                   \
+        PMAX * PRF + PRI_TOLERANCE, PRF, PPB * PRF,             \
+        PPB_THRESH(PPB), PRI_TOLERANCE,                         \
+}
+
+static const struct radar_detector_specs fcc_radar_ref_types[] = {
+        FCC_PATTERN(0, 0, 1, 1428, 1428, 1, 18),
+        FCC_PATTERN(1, 0, 5, 150, 230, 1, 23),
+        FCC_PATTERN(2, 6, 10, 200, 500, 1, 16),
+        FCC_PATTERN(3, 11, 20, 200, 500, 1, 12),
+        FCC_PATTERN(4, 50, 100, 1000, 2000, 20, 1),
+        FCC_PATTERN(5, 0, 1, 333, 333, 1, 9),
+};
+
+static const struct radar_types fcc_radar_types = {
+        .region                 = NL80211_DFS_FCC,
+        .num_radar_types        = ARRAY_SIZE(fcc_radar_ref_types),
+        .radar_types            = fcc_radar_ref_types,
+};
+
+#define JP_PATTERN FCC_PATTERN
+static const struct radar_detector_specs jp_radar_ref_types[] = {
+        JP_PATTERN(0, 0, 1, 1428, 1428, 1, 18),
+        JP_PATTERN(1, 2, 3, 3846, 3846, 1, 18),
+        JP_PATTERN(2, 0, 1, 1388, 1388, 1, 18),
+        JP_PATTERN(3, 1, 2, 4000, 4000, 1, 18),
+        JP_PATTERN(4, 0, 5, 150, 230, 1, 23),
+        JP_PATTERN(5, 6, 10, 200, 500, 1, 16),
+        JP_PATTERN(6, 11, 20, 200, 500, 1, 12),
+        JP_PATTERN(7, 50, 100, 1000, 2000, 20, 1),
+        JP_PATTERN(5, 0, 1, 333, 333, 1, 9),
+};
+
+static const struct radar_types jp_radar_types = {
+        .region                 = NL80211_DFS_JP,
+        .num_radar_types        = ARRAY_SIZE(jp_radar_ref_types),
+        .radar_types            = jp_radar_ref_types,
+};
+
 static const struct radar_types *dfs_domains[] = {
         &etsi_radar_types_v15,
+        &fcc_radar_types,
+        &jp_radar_types,
 };
 
 /**
diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c
index 4806a49cb61b..6e699d050d1e 100644
--- a/drivers/net/wireless/ath/wil6210/cfg80211.c
+++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
@@ -172,7 +172,7 @@ static int wil_cid_fill_sinfo(struct wil6210_priv *wil, int cid,
 
 static int wil_cfg80211_get_station(struct wiphy *wiphy,
                                     struct net_device *ndev,
-                                    u8 *mac, struct station_info *sinfo)
+                                    const u8 *mac, struct station_info *sinfo)
 {
         struct wil6210_priv *wil = wiphy_to_wil(wiphy);
         int rc;
@@ -671,7 +671,7 @@ static int wil_cfg80211_stop_ap(struct wiphy *wiphy,
 }
 
 static int wil_cfg80211_del_station(struct wiphy *wiphy,
-                                    struct net_device *dev, u8 *mac)
+                                    struct net_device *dev, const u8 *mac)
 {
         struct wil6210_priv *wil = wiphy_to_wil(wiphy);
 
diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c
index 1b265fd19de2..670cc6de3b4c 100644
--- a/drivers/net/wireless/ath/wil6210/main.c
+++ b/drivers/net/wireless/ath/wil6210/main.c
@@ -81,7 +81,7 @@ static void wil_disconnect_cid(struct wil6210_priv *wil, int cid)
         memset(&sta->stats, 0, sizeof(sta->stats));
 }
 
-static void _wil6210_disconnect(struct wil6210_priv *wil, void *bssid)
+static void _wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid)
 {
         int cid = -ENOENT;
         struct net_device *ndev = wil_to_ndev(wil);
@@ -252,7 +252,7 @@ int wil_priv_init(struct wil6210_priv *wil)
         return 0;
 }
 
-void wil6210_disconnect(struct wil6210_priv *wil, void *bssid)
+void wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid)
 {
         del_timer_sync(&wil->connect_timer);
         _wil6210_disconnect(wil, bssid);
diff --git a/drivers/net/wireless/ath/wil6210/wil6210.h b/drivers/net/wireless/ath/wil6210/wil6210.h
index d3b8659ca32e..3427ac4a4fa1 100644
--- a/drivers/net/wireless/ath/wil6210/wil6210.h
+++ b/drivers/net/wireless/ath/wil6210/wil6210.h
@@ -508,7 +508,7 @@ void wil_wdev_free(struct wil6210_priv *wil);
 int wmi_set_mac_address(struct wil6210_priv *wil, void *addr);
 int wmi_pcp_start(struct wil6210_priv *wil, int bi, u8 wmi_nettype, u8 chan);
 int wmi_pcp_stop(struct wil6210_priv *wil);
-void wil6210_disconnect(struct wil6210_priv *wil, void *bssid);
+void wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid);
 
 int wil_rx_init(struct wil6210_priv *wil);
 void wil_rx_fini(struct wil6210_priv *wil);
diff --git a/drivers/net/wireless/b43/Kconfig b/drivers/net/wireless/b43/Kconfig
index 088d544ec63f..e3f67b8d3f80 100644
--- a/drivers/net/wireless/b43/Kconfig
+++ b/drivers/net/wireless/b43/Kconfig
@@ -1,7 +1,8 @@
 config B43
         tristate "Broadcom 43xx wireless support (mac80211 stack)"
-        depends on SSB_POSSIBLE && MAC80211 && HAS_DMA
-        select SSB
+        depends on (BCMA_POSSIBLE || SSB_POSSIBLE) && MAC80211 && HAS_DMA
+        select BCMA if B43_BCMA
+        select SSB if B43_SSB
         select FW_LOADER
         ---help---
           b43 is a driver for the Broadcom 43xx series wireless devices.
@@ -27,14 +28,33 @@ config B43
           If unsure, say M.
 
 config B43_BCMA
-        bool "Support for BCMA bus"
-        depends on B43 && (BCMA = y || BCMA = B43)
-        default y
+        bool
 
 config B43_SSB
         bool
-        depends on B43 && (SSB = y || SSB = B43)
-        default y
+
+choice
+        prompt "Supported bus types"
+        depends on B43
+        default B43_BCMA_AND_SSB
+
+config B43_BUSES_BCMA_AND_SSB
+        bool "BCMA and SSB"
+        depends on BCMA_POSSIBLE && SSB_POSSIBLE
+        select B43_BCMA
+        select B43_SSB
+
+config B43_BUSES_BCMA
+        bool "BCMA only"
+        depends on BCMA_POSSIBLE
+        select B43_BCMA
+
+config B43_BUSES_SSB
+        bool "SSB only"
+        depends on SSB_POSSIBLE
+        select B43_SSB
+
+endchoice
 
 # Auto-select SSB PCI-HOST support, if possible
 config B43_PCI_AUTOSELECT
@@ -53,7 +73,7 @@ config B43_PCICORE_AUTOSELECT
 
 config B43_PCMCIA
         bool "Broadcom 43xx PCMCIA device support"
-        depends on B43 && SSB_PCMCIAHOST_POSSIBLE
+        depends on B43 && B43_SSB && SSB_PCMCIAHOST_POSSIBLE
         select SSB_PCMCIAHOST
         ---help---
           Broadcom 43xx PCMCIA device support.
@@ -73,7 +93,7 @@ config B43_PCMCIA
 
 config B43_SDIO
         bool "Broadcom 43xx SDIO device support"
-        depends on B43 && SSB_SDIOHOST_POSSIBLE
+        depends on B43 && B43_SSB && SSB_SDIOHOST_POSSIBLE
         select SSB_SDIOHOST
         ---help---
           Broadcom 43xx device support for Soft-MAC SDIO devices.
@@ -98,7 +118,7 @@ config B43_BCMA_PIO
 
 config B43_PIO
         bool
-        depends on B43
+        depends on B43 && B43_SSB
         select SSB_BLOCKIO
         default y
 
@@ -116,7 +136,7 @@ config B43_PHY_N
 
 config B43_PHY_LP
         bool "Support for low-power (LP-PHY) devices"
-        depends on B43
+        depends on B43 && B43_SSB
         default y
         ---help---
           Support for the LP-PHY.
diff --git a/drivers/net/wireless/b43/bus.h b/drivers/net/wireless/b43/bus.h
index 184c95659279..f3205c6988bc 100644
--- a/drivers/net/wireless/b43/bus.h
+++ b/drivers/net/wireless/b43/bus.h
@@ -5,7 +5,9 @@ enum b43_bus_type {
 #ifdef CONFIG_B43_BCMA
         B43_BUS_BCMA,
 #endif
+#ifdef CONFIG_B43_SSB
         B43_BUS_SSB,
+#endif
 };
 
 struct b43_bus_dev {
@@ -52,13 +54,21 @@ struct b43_bus_dev {
 
 static inline bool b43_bus_host_is_pcmcia(struct b43_bus_dev *dev)
 {
+#ifdef CONFIG_B43_SSB
         return (dev->bus_type == B43_BUS_SSB &&
                 dev->sdev->bus->bustype == SSB_BUSTYPE_PCMCIA);
+#else
+        return false;
+#endif
 }
 static inline bool b43_bus_host_is_sdio(struct b43_bus_dev *dev)
 {
+#ifdef CONFIG_B43_SSB
         return (dev->bus_type == B43_BUS_SSB &&
                 dev->sdev->bus->bustype == SSB_BUSTYPE_SDIO);
+#else
+        return false;
+#endif
 }
 
 struct b43_bus_dev *b43_bus_dev_bcma_init(struct bcma_device *core);
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 32e08d35c06e..3d67e6b08e1c 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -182,7 +182,7 @@ static struct ieee80211_rate __b43_ratetable[] = {
 #define b43_g_ratetable         (__b43_ratetable + 0)
 #define b43_g_ratetable_size    12
 
-#define CHAN4G(_channel, _freq, _flags) {                       \
+#define CHAN2G(_channel, _freq, _flags) {                       \
         .band                   = IEEE80211_BAND_2GHZ,          \
         .center_freq            = (_freq),                      \
         .hw_value               = (_channel),                   \
@@ -191,23 +191,31 @@ static struct ieee80211_rate __b43_ratetable[] = {
         .max_power              = 30,                           \
 }
 static struct ieee80211_channel b43_2ghz_chantable[] = {
-        CHAN4G(1, 2412, 0),
-        CHAN4G(2, 2417, 0),
-        CHAN4G(3, 2422, 0),
-        CHAN4G(4, 2427, 0),
-        CHAN4G(5, 2432, 0),
-        CHAN4G(6, 2437, 0),
-        CHAN4G(7, 2442, 0),
-        CHAN4G(8, 2447, 0),
-        CHAN4G(9, 2452, 0),
-        CHAN4G(10, 2457, 0),
-        CHAN4G(11, 2462, 0),
-        CHAN4G(12, 2467, 0),
-        CHAN4G(13, 2472, 0),
-        CHAN4G(14, 2484, 0),
+        CHAN2G(1, 2412, 0),
+        CHAN2G(2, 2417, 0),
+        CHAN2G(3, 2422, 0),
+        CHAN2G(4, 2427, 0),
+        CHAN2G(5, 2432, 0),
+        CHAN2G(6, 2437, 0),
+        CHAN2G(7, 2442, 0),
+        CHAN2G(8, 2447, 0),
+        CHAN2G(9, 2452, 0),
+        CHAN2G(10, 2457, 0),
+        CHAN2G(11, 2462, 0),
+        CHAN2G(12, 2467, 0),
+        CHAN2G(13, 2472, 0),
+        CHAN2G(14, 2484, 0),
 };
-#undef CHAN4G
+#undef CHAN2G
 
+#define CHAN4G(_channel, _flags) {                              \
+        .band                   = IEEE80211_BAND_5GHZ,          \
+        .center_freq            = 4000 + (5 * (_channel)),      \
+        .hw_value               = (_channel),                   \
+        .flags                  = (_flags),                     \
+        .max_antenna_gain       = 0,                            \
+        .max_power              = 30,                           \
+}
 #define CHAN5G(_channel, _flags) {                              \
         .band                   = IEEE80211_BAND_5GHZ,          \
         .center_freq            = 5000 + (5 * (_channel)),      \
@@ -217,6 +225,18 @@ static struct ieee80211_channel b43_2ghz_chantable[] = {
         .max_power              = 30,                           \
 }
 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
+        CHAN4G(184, 0),         CHAN4G(186, 0),
+        CHAN4G(188, 0),         CHAN4G(190, 0),
+        CHAN4G(192, 0),         CHAN4G(194, 0),
+        CHAN4G(196, 0),         CHAN4G(198, 0),
+        CHAN4G(200, 0),         CHAN4G(202, 0),
+        CHAN4G(204, 0),         CHAN4G(206, 0),
+        CHAN4G(208, 0),         CHAN4G(210, 0),
+        CHAN4G(212, 0),         CHAN4G(214, 0),
+        CHAN4G(216, 0),         CHAN4G(218, 0),
+        CHAN4G(220, 0),         CHAN4G(222, 0),
+        CHAN4G(224, 0),         CHAN4G(226, 0),
+        CHAN4G(228, 0),
         CHAN5G(32, 0),          CHAN5G(34, 0),
         CHAN5G(36, 0),          CHAN5G(38, 0),
         CHAN5G(40, 0),          CHAN5G(42, 0),
@@ -260,18 +280,7 @@ static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
         CHAN5G(170, 0),         CHAN5G(172, 0),
         CHAN5G(174, 0),         CHAN5G(176, 0),
         CHAN5G(178, 0),         CHAN5G(180, 0),
-        CHAN5G(182, 0),         CHAN5G(184, 0),
-        CHAN5G(186, 0),         CHAN5G(188, 0),
-        CHAN5G(190, 0),         CHAN5G(192, 0),
-        CHAN5G(194, 0),         CHAN5G(196, 0),
-        CHAN5G(198, 0),         CHAN5G(200, 0),
-        CHAN5G(202, 0),         CHAN5G(204, 0),
-        CHAN5G(206, 0),         CHAN5G(208, 0),
-        CHAN5G(210, 0),         CHAN5G(212, 0),
-        CHAN5G(214, 0),         CHAN5G(216, 0),
-        CHAN5G(218, 0),         CHAN5G(220, 0),
-        CHAN5G(222, 0),         CHAN5G(224, 0),
-        CHAN5G(226, 0),         CHAN5G(228, 0),
+        CHAN5G(182, 0),
 };
 
 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
@@ -295,6 +304,7 @@ static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
         CHAN5G(208, 0),         CHAN5G(212, 0),
         CHAN5G(216, 0),
 };
+#undef CHAN4G
 #undef CHAN5G
 
 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
@@ -1175,18 +1185,7 @@ static void b43_bcma_phy_reset(struct b43_wldev *dev)
         bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, flags);
         udelay(2);
 
-        /* Take PHY out of reset */
-        flags = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
-        flags &= ~B43_BCMA_IOCTL_PHY_RESET;
-        flags |= BCMA_IOCTL_FGC;
-        bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, flags);
-        udelay(1);
-
-        /* Do not force clock anymore */
-        flags = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
-        flags &= ~BCMA_IOCTL_FGC;
-        bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, flags);
-        udelay(1);
+        b43_phy_take_out_of_reset(dev);
 }
 
 static void b43_bcma_wireless_core_reset(struct b43_wldev *dev, bool gmode)
@@ -1208,10 +1207,9 @@ static void b43_bcma_wireless_core_reset(struct b43_wldev *dev, bool gmode)
 }
 #endif
 
+#ifdef CONFIG_B43_SSB
 static void b43_ssb_wireless_core_reset(struct b43_wldev *dev, bool gmode)
 {
-        struct ssb_device *sdev = dev->dev->sdev;
-        u32 tmslow;
         u32 flags = 0;
 
         if (gmode)
@@ -1223,18 +1221,9 @@ static void b43_ssb_wireless_core_reset(struct b43_wldev *dev, bool gmode)
         b43_device_enable(dev, flags);
         msleep(2);              /* Wait for the PLL to turn on. */
 
-        /* Now take the PHY out of Reset again */
-        tmslow = ssb_read32(sdev, SSB_TMSLOW);
-        tmslow |= SSB_TMSLOW_FGC;
-        tmslow &= ~B43_TMSLOW_PHYRESET;
-        ssb_write32(sdev, SSB_TMSLOW, tmslow);
-        ssb_read32(sdev, SSB_TMSLOW);   /* flush */
-        msleep(1);
-        tmslow &= ~SSB_TMSLOW_FGC;
-        ssb_write32(sdev, SSB_TMSLOW, tmslow);
-        ssb_read32(sdev, SSB_TMSLOW);   /* flush */
-        msleep(1);
+        b43_phy_take_out_of_reset(dev);
 }
+#endif
 
 void b43_wireless_core_reset(struct b43_wldev *dev, bool gmode)
 {
@@ -2709,32 +2698,37 @@ static int b43_upload_initvals(struct b43_wldev *dev)
         struct b43_firmware *fw = &dev->fw;
         const struct b43_iv *ivals;
         size_t count;
-        int err;
 
         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
         count = be32_to_cpu(hdr->size);
-        err = b43_write_initvals(dev, ivals, count,
+        return b43_write_initvals(dev, ivals, count,
                                  fw->initvals.data->size - hdr_len);
-        if (err)
-                goto out;
-        if (fw->initvals_band.data) {
-                hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
-                ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
-                count = be32_to_cpu(hdr->size);
-                err = b43_write_initvals(dev, ivals, count,
-                                         fw->initvals_band.data->size - hdr_len);
-                if (err)
-                        goto out;
-        }
-out:
+}
 
-        return err;
+static int b43_upload_initvals_band(struct b43_wldev *dev)
+{
+        const size_t hdr_len = sizeof(struct b43_fw_header);
+        const struct b43_fw_header *hdr;
+        struct b43_firmware *fw = &dev->fw;
+        const struct b43_iv *ivals;
+        size_t count;
+
+        if (!fw->initvals_band.data)
+                return 0;
+
+        hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
+        ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
+        count = be32_to_cpu(hdr->size);
+        return b43_write_initvals(dev, ivals, count,
+                                  fw->initvals_band.data->size - hdr_len);
 }
 
 /* Initialize the GPIOs
  * http://bcm-specs.sipsolutions.net/GPIO
  */
+
+#ifdef CONFIG_B43_SSB
 static struct ssb_device *b43_ssb_gpio_dev(struct b43_wldev *dev)
 {
         struct ssb_bus *bus = dev->dev->sdev->bus;
@@ -2745,10 +2739,13 @@ static struct ssb_device *b43_ssb_gpio_dev(struct b43_wldev *dev)
         return bus->chipco.dev;
 #endif
 }
+#endif
 
 static int b43_gpio_init(struct b43_wldev *dev)
 {
+#ifdef CONFIG_B43_SSB
         struct ssb_device *gpiodev;
+#endif
         u32 mask, set;
 
         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_GPOUTSMSK, 0);
@@ -2807,7 +2804,9 @@ static int b43_gpio_init(struct b43_wldev *dev)
 /* Turn off all GPIO stuff. Call this on module unload, for example. */
 static void b43_gpio_cleanup(struct b43_wldev *dev)
 {
+#ifdef CONFIG_B43_SSB
         struct ssb_device *gpiodev;
+#endif
 
         switch (dev->dev->bus_type) {
 #ifdef CONFIG_B43_BCMA
@@ -3091,6 +3090,10 @@ static int b43_chip_init(struct b43_wldev *dev)
         if (err)
                 goto err_gpio_clean;
 
+        err = b43_upload_initvals_band(dev);
+        if (err)
+                goto err_gpio_clean;
+
         /* Turn the Analog on and initialize the PHY. */
         phy->ops->switch_analog(dev, 1);
         err = b43_phy_init(dev);
@@ -3690,37 +3693,6 @@ static void b43_op_set_tsf(struct ieee80211_hw *hw,
         mutex_unlock(&wl->mutex);
 }
 
-static void b43_put_phy_into_reset(struct b43_wldev *dev)
-{
-        u32 tmp;
-
-        switch (dev->dev->bus_type) {
-#ifdef CONFIG_B43_BCMA
-        case B43_BUS_BCMA:
-                b43err(dev->wl,
-                       "Putting PHY into reset not supported on BCMA\n");
-                break;
-#endif
-#ifdef CONFIG_B43_SSB
-        case B43_BUS_SSB:
-                tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
-                tmp &= ~B43_TMSLOW_GMODE;
-                tmp |= B43_TMSLOW_PHYRESET;
-                tmp |= SSB_TMSLOW_FGC;
-                ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
-                msleep(1);
-
-                tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
-                tmp &= ~SSB_TMSLOW_FGC;
-                tmp |= B43_TMSLOW_PHYRESET;
-                ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
-                msleep(1);
-
-                break;
-#endif
-        }
-}
-
 static const char *band_to_string(enum ieee80211_band band)
 {
         switch (band) {
@@ -3736,89 +3708,73 @@ static const char *band_to_string(enum ieee80211_band band)
 }
 
 /* Expects wl->mutex locked */
-static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
+static int b43_switch_band(struct b43_wldev *dev,
+                           struct ieee80211_channel *chan)
 {
-        struct b43_wldev *up_dev = NULL;
-        struct b43_wldev *down_dev;
-        int err;
-        bool uninitialized_var(gmode);
-        int prev_status;
+        struct b43_phy *phy = &dev->phy;
+        bool gmode;
+        u32 tmp;
 
-        /* Find a device and PHY which supports the band. */
         switch (chan->band) {
         case IEEE80211_BAND_5GHZ:
-                if (wl->current_dev->phy.supports_5ghz) {
-                        up_dev = wl->current_dev;
-                        gmode = false;
-                }
+                gmode = false;
                 break;
         case IEEE80211_BAND_2GHZ:
-                if (wl->current_dev->phy.supports_2ghz) {
-                        up_dev = wl->current_dev;
-                        gmode = true;
-                }
+                gmode = true;
                 break;
         default:
                 B43_WARN_ON(1);
                 return -EINVAL;
         }
 
-        if (!up_dev) {
-                b43err(wl, "Could not find a device for %s-GHz band operation\n",
+        if (!((gmode && phy->supports_2ghz) ||
+              (!gmode && phy->supports_5ghz))) {
+                b43err(dev->wl, "This device doesn't support %s-GHz band\n",
                        band_to_string(chan->band));
                 return -ENODEV;
         }
-        if (!!wl->current_dev->phy.gmode == !!gmode) {
+
+        if (!!phy->gmode == !!gmode) {
                 /* This device is already running. */
                 return 0;
         }
-        b43dbg(wl, "Switching to %s-GHz band\n",
+
+        b43dbg(dev->wl, "Switching to %s GHz band\n",
                band_to_string(chan->band));
-        down_dev = wl->current_dev;
 
-        prev_status = b43_status(down_dev);
-        /* Shutdown the currently running core. */
-        if (prev_status >= B43_STAT_STARTED)
-                down_dev = b43_wireless_core_stop(down_dev);
-        if (prev_status >= B43_STAT_INITIALIZED)
-                b43_wireless_core_exit(down_dev);
+        b43_software_rfkill(dev, true);
 
-        if (down_dev != up_dev) {
-                /* We switch to a different core, so we put PHY into
-                 * RESET on the old core. */
-                b43_put_phy_into_reset(down_dev);
+        phy->gmode = gmode;
+        b43_phy_put_into_reset(dev);
+        switch (dev->dev->bus_type) {
+#ifdef CONFIG_B43_BCMA
+        case B43_BUS_BCMA:
+                tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
+                if (gmode)
+                        tmp |= B43_BCMA_IOCTL_GMODE;
+                else
+                        tmp &= ~B43_BCMA_IOCTL_GMODE;
+                bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
+                break;
+#endif
+#ifdef CONFIG_B43_SSB
+        case B43_BUS_SSB:
+                tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
+                if (gmode)
+                        tmp |= B43_TMSLOW_GMODE;
+                else
+                        tmp &= ~B43_TMSLOW_GMODE;
+                ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
+                break;
+#endif
         }
+        b43_phy_take_out_of_reset(dev);
 
-        /* Now start the new core. */
-        up_dev->phy.gmode = gmode;
-        if (prev_status >= B43_STAT_INITIALIZED) {
-                err = b43_wireless_core_init(up_dev);
-                if (err) {
-                        b43err(wl, "Fatal: Could not initialize device for "
-                               "selected %s-GHz band\n",
-                               band_to_string(chan->band));
-                        goto init_failure;
-                }
-        }
-        if (prev_status >= B43_STAT_STARTED) {
-                err = b43_wireless_core_start(up_dev);
-                if (err) {
-                        b43err(wl, "Fatal: Could not start device for "
-                               "selected %s-GHz band\n",
-                               band_to_string(chan->band));
-                        b43_wireless_core_exit(up_dev);
-                        goto init_failure;
-                }
-        }
-        B43_WARN_ON(b43_status(up_dev) != prev_status);
+        b43_upload_initvals_band(dev);
 
-        wl->current_dev = up_dev;
+        b43_phy_init(dev);
 
         return 0;
-init_failure:
-        /* Whoops, failed to init the new core. No core is operating now. */
-        wl->current_dev = NULL;
-        return err;
 }
 
 /* Write the short and long frame retry limit values. */
@@ -3851,8 +3807,10 @@ static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
 
         dev = wl->current_dev;
 
+        b43_mac_suspend(dev);
+
         /* Switch the band (if necessary). This might change the active core. */
-        err = b43_switch_band(wl, conf->chandef.chan);
+        err = b43_switch_band(dev, conf->chandef.chan);
         if (err)
                 goto out_unlock_mutex;
 
@@ -3871,8 +3829,6 @@ static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
         else
                 phy->is_40mhz = false;
 
-        b43_mac_suspend(dev);
-
         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
                                           conf->long_frame_max_tx_count);
@@ -4582,8 +4538,12 @@ static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
         struct ssb_bus *bus;
         u32 tmp;
 
+#ifdef CONFIG_B43_SSB
         if (dev->dev->bus_type != B43_BUS_SSB)
                 return;
+#else
+        return;
+#endif
 
         bus = dev->dev->sdev->bus;
 
@@ -4738,7 +4698,7 @@ static int b43_wireless_core_init(struct b43_wldev *dev)
         }
         if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
                 hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
-#ifdef CONFIG_SSB_DRIVER_PCICORE
+#if defined(CONFIG_B43_SSB) && defined(CONFIG_SSB_DRIVER_PCICORE)
         if (dev->dev->bus_type == B43_BUS_SSB &&
             dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI &&
             dev->dev->sdev->bus->pcicore.dev->id.revision <= 10)
@@ -5129,10 +5089,81 @@ static void b43_wireless_core_detach(struct b43_wldev *dev)
         b43_phy_free(dev);
 }
 
+static void b43_supported_bands(struct b43_wldev *dev, bool *have_2ghz_phy,
+                                bool *have_5ghz_phy)
+{
+        u16 dev_id = 0;
+
+#ifdef CONFIG_B43_BCMA
+        if (dev->dev->bus_type == B43_BUS_BCMA &&
+            dev->dev->bdev->bus->hosttype == BCMA_HOSTTYPE_PCI)
+                dev_id = dev->dev->bdev->bus->host_pci->device;
+#endif
+#ifdef CONFIG_B43_SSB
+        if (dev->dev->bus_type == B43_BUS_SSB &&
+            dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI)
+                dev_id = dev->dev->sdev->bus->host_pci->device;
+#endif
+        /* Override with SPROM value if available */
+        if (dev->dev->bus_sprom->dev_id)
+                dev_id = dev->dev->bus_sprom->dev_id;
+
+        /* Note: below IDs can be "virtual" (not maching e.g. real PCI ID) */
+        switch (dev_id) {
+        case 0x4324: /* BCM4306 */
+        case 0x4312: /* BCM4311 */
+        case 0x4319: /* BCM4318 */
+        case 0x4328: /* BCM4321 */
+        case 0x432b: /* BCM4322 */
+        case 0x4350: /* BCM43222 */
+        case 0x4353: /* BCM43224 */
+        case 0x0576: /* BCM43224 */
+        case 0x435f: /* BCM6362 */
+        case 0x4331: /* BCM4331 */
+        case 0x4359: /* BCM43228 */
+        case 0x43a0: /* BCM4360 */
+        case 0x43b1: /* BCM4352 */
+                /* Dual band devices */
+                *have_2ghz_phy = true;
+                *have_5ghz_phy = true;
+                return;
+        case 0x4321: /* BCM4306 */
+        case 0x4313: /* BCM4311 */
+        case 0x431a: /* BCM4318 */
+        case 0x432a: /* BCM4321 */
+        case 0x432d: /* BCM4322 */
+        case 0x4352: /* BCM43222 */
+        case 0x4333: /* BCM4331 */
+        case 0x43a2: /* BCM4360 */
+        case 0x43b3: /* BCM4352 */
+                /* 5 GHz only devices */
+                *have_2ghz_phy = false;
+                *have_5ghz_phy = true;
+                return;
+        }
+
+        /* As a fallback, try to guess using PHY type */
+        switch (dev->phy.type) {
+        case B43_PHYTYPE_A:
+                *have_2ghz_phy = false;
+                *have_5ghz_phy = true;
+                return;
+        case B43_PHYTYPE_G:
+        case B43_PHYTYPE_N:
+        case B43_PHYTYPE_LP:
+        case B43_PHYTYPE_HT:
+        case B43_PHYTYPE_LCN:
+                *have_2ghz_phy = true;
+                *have_5ghz_phy = false;
+                return;
+        }
+
+        B43_WARN_ON(1);
+}
+
 static int b43_wireless_core_attach(struct b43_wldev *dev)
 {
         struct b43_wl *wl = dev->wl;
-        struct pci_dev *pdev = NULL;
         int err;
         u32 tmp;
         bool have_2ghz_phy = false, have_5ghz_phy = false;
@@ -5144,19 +5175,13 @@ static int b43_wireless_core_attach(struct b43_wldev *dev)
          * that in core_init(), too.
          */
 
-#ifdef CONFIG_B43_SSB
-        if (dev->dev->bus_type == B43_BUS_SSB &&
-            dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI)
-                pdev = dev->dev->sdev->bus->host_pci;
-#endif
-
         err = b43_bus_powerup(dev, 0);
         if (err) {
                 b43err(wl, "Bus powerup failed\n");
                 goto out;
         }
 
-        /* Get the PHY type. */
+        /* Try to guess supported bands for the first init needs */
         switch (dev->dev->bus_type) {
 #ifdef CONFIG_B43_BCMA
         case B43_BUS_BCMA:
@@ -5180,48 +5205,29 @@ static int b43_wireless_core_attach(struct b43_wldev *dev)
         dev->phy.gmode = have_2ghz_phy;
         b43_wireless_core_reset(dev, dev->phy.gmode);
 
+        /* Get the PHY type. */
         err = b43_phy_versioning(dev);
         if (err)
                 goto err_powerdown;
-        /* Check if this device supports multiband. */
-        if (!pdev ||
-            (pdev->device != 0x4312 &&
-             pdev->device != 0x4319 && pdev->device != 0x4324)) {
-                /* No multiband support. */
-                have_2ghz_phy = false;
+
+        /* Get real info about supported bands */
+        b43_supported_bands(dev, &have_2ghz_phy, &have_5ghz_phy);
+
+        /* We don't support 5 GHz on some PHYs yet */
+        switch (dev->phy.type) {
+        case B43_PHYTYPE_A:
+        case B43_PHYTYPE_N:
+        case B43_PHYTYPE_LP:
+        case B43_PHYTYPE_HT:
+                b43warn(wl, "5 GHz band is unsupported on this PHY\n");
                 have_5ghz_phy = false;
-                switch (dev->phy.type) {
-                case B43_PHYTYPE_A:
-                        have_5ghz_phy = true;
-                        break;
-                case B43_PHYTYPE_LP: //FIXME not always!
-#if 0 //FIXME enabling 5GHz causes a NULL pointer dereference
-                        have_5ghz_phy = 1;
-#endif
-                case B43_PHYTYPE_G:
-                case B43_PHYTYPE_N:
-                case B43_PHYTYPE_HT:
-                case B43_PHYTYPE_LCN:
-                        have_2ghz_phy = true;
-                        break;
-                default:
-                        B43_WARN_ON(1);
-                }
         }
-        if (dev->phy.type == B43_PHYTYPE_A) {
-                /* FIXME */
-                b43err(wl, "IEEE 802.11a devices are unsupported\n");
+
+        if (!have_2ghz_phy && !have_5ghz_phy) {
+                b43err(wl, "b43 can't support any band on this device\n");
                 err = -EOPNOTSUPP;
                 goto err_powerdown;
         }
-        if (1 /* disable A-PHY */) {
-                /* FIXME: For now we disable the A-PHY on multi-PHY devices. */
-                if (dev->phy.type != B43_PHYTYPE_N &&
-                    dev->phy.type != B43_PHYTYPE_LP) {
-                        have_2ghz_phy = true;
-                        have_5ghz_phy = false;
-                }
-        }
 
         err = b43_phy_allocate(dev);
         if (err)
@@ -5310,6 +5316,7 @@ static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl)
         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
         (pdev->subsystem_device == _subdevice)                          )
 
+#ifdef CONFIG_B43_SSB
 static void b43_sprom_fixup(struct ssb_bus *bus)
 {
         struct pci_dev *pdev;
@@ -5341,6 +5348,7 @@ static void b43_wireless_exit(struct b43_bus_dev *dev, struct b43_wl *wl)
         ssb_set_devtypedata(dev->sdev, NULL);
         ieee80211_free_hw(hw);
 }
+#endif
 
 static struct b43_wl *b43_wireless_init(struct b43_bus_dev *dev)
 {
diff --git a/drivers/net/wireless/b43/phy_common.c b/drivers/net/wireless/b43/phy_common.c
index 3e45989f418d..fb0ddddde16b 100644
--- a/drivers/net/wireless/b43/phy_common.c
+++ b/drivers/net/wireless/b43/phy_common.c
@@ -96,6 +96,7 @@ int b43_phy_init(struct b43_wldev *dev)
 
         phy->channel = ops->get_default_chan(dev);
 
+        phy->ops->switch_analog(dev, true);
         b43_software_rfkill(dev, false);
         err = ops->init(dev);
         if (err) {
@@ -312,6 +313,90 @@ void b43_phy_maskset(struct b43_wldev *dev, u16 offset, u16 mask, u16 set)
         }
 }
 
+void b43_phy_put_into_reset(struct b43_wldev *dev)
+{
+        u32 tmp;
+
+        switch (dev->dev->bus_type) {
+#ifdef CONFIG_B43_BCMA
+        case B43_BUS_BCMA:
+                tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
+                tmp &= ~B43_BCMA_IOCTL_GMODE;
+                tmp |= B43_BCMA_IOCTL_PHY_RESET;
+                tmp |= BCMA_IOCTL_FGC;
+                bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
+                udelay(1);
+
+                tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
+                tmp &= ~BCMA_IOCTL_FGC;
+                bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
+                udelay(1);
+                break;
+#endif
+#ifdef CONFIG_B43_SSB
+        case B43_BUS_SSB:
+                tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
+                tmp &= ~B43_TMSLOW_GMODE;
+                tmp |= B43_TMSLOW_PHYRESET;
+                tmp |= SSB_TMSLOW_FGC;
+                ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
+                usleep_range(1000, 2000);
+
+                tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
+                tmp &= ~SSB_TMSLOW_FGC;
+                ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
+                usleep_range(1000, 2000);
+
+                break;
+#endif
+        }
+}
+
+void b43_phy_take_out_of_reset(struct b43_wldev *dev)
+{
+        u32 tmp;
+
+        switch (dev->dev->bus_type) {
+#ifdef CONFIG_B43_BCMA
+        case B43_BUS_BCMA:
+                /* Unset reset bit (with forcing clock) */
+                tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
+                tmp &= ~B43_BCMA_IOCTL_PHY_RESET;
+                tmp &= ~B43_BCMA_IOCTL_PHY_CLKEN;
+                tmp |= BCMA_IOCTL_FGC;
+                bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
+                udelay(1);
+
+                /* Do not force clock anymore */
+                tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
+                tmp &= ~BCMA_IOCTL_FGC;
+                tmp |= B43_BCMA_IOCTL_PHY_CLKEN;
+                bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
+                udelay(1);
+                break;
+#endif
+#ifdef CONFIG_B43_SSB
+        case B43_BUS_SSB:
+                /* Unset reset bit (with forcing clock) */
+                tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
+                tmp &= ~B43_TMSLOW_PHYRESET;
+                tmp &= ~B43_TMSLOW_PHYCLKEN;
+                tmp |= SSB_TMSLOW_FGC;
+                ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
+                ssb_read32(dev->dev->sdev, SSB_TMSLOW); /* flush */
+                usleep_range(1000, 2000);
+
+                tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
+                tmp &= ~SSB_TMSLOW_FGC;
+                tmp |= B43_TMSLOW_PHYCLKEN;
+                ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
+                ssb_read32(dev->dev->sdev, SSB_TMSLOW); /* flush */
+                usleep_range(1000, 2000);
+                break;
+#endif
+        }
+}
+
 int b43_switch_channel(struct b43_wldev *dev, unsigned int new_channel)
 {
         struct b43_phy *phy = &(dev->phy);
diff --git a/drivers/net/wireless/b43/phy_common.h b/drivers/net/wireless/b43/phy_common.h
index f1b999349876..47b55855c37d 100644
--- a/drivers/net/wireless/b43/phy_common.h
+++ b/drivers/net/wireless/b43/phy_common.h
@@ -231,7 +231,7 @@ struct b43_phy {
         /* HT info */
         bool is_40mhz;
 
-        /* GMODE bit enabled? */
+        /* Is GMODE (2 GHz mode) bit enabled? */
         bool gmode;
 
         /* Analog Type */
@@ -390,6 +390,9 @@ void b43_phy_lock(struct b43_wldev *dev);
  */
 void b43_phy_unlock(struct b43_wldev *dev);
 
+void b43_phy_put_into_reset(struct b43_wldev *dev);
+void b43_phy_take_out_of_reset(struct b43_wldev *dev);
+
 /**
  * b43_switch_channel - Switch to another channel
  */
diff --git a/drivers/net/wireless/b43/radio_2056.c b/drivers/net/wireless/b43/radio_2056.c
index a07e4cacab77..2ce25607c60d 100644
--- a/drivers/net/wireless/b43/radio_2056.c
+++ b/drivers/net/wireless/b43/radio_2056.c
@@ -9058,6 +9058,231 @@ static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_radio_rev
 
 static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_radio_rev11[] = {
         {
+                .freq                   = 4920,
+                RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xec, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07b4, 0x07b0, 0x07ac, 0x0214, 0x0215, 0x0216),
+        },
+        {
+                .freq                   = 4930,
+                RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xed, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07b8, 0x07b4, 0x07b0, 0x0213, 0x0214, 0x0215),
+        },
+        {
+                .freq                   = 4940,
+                RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xee, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07bc, 0x07b8, 0x07b4, 0x0212, 0x0213, 0x0214),
+        },
+        {
+                .freq                   = 4950,
+                RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xef, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07c0, 0x07bc, 0x07b8, 0x0211, 0x0212, 0x0213),
+        },
+        {
+                .freq                   = 4960,
+                RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf0, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07c4, 0x07c0, 0x07bc, 0x020f, 0x0211, 0x0212),
+        },
+        {
+                .freq                   = 4970,
+                RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf1, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07c8, 0x07c4, 0x07c0, 0x020e, 0x020f, 0x0211),
+        },
+        {
+                .freq                   = 4980,
+                RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf2, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07cc, 0x07c8, 0x07c4, 0x020d, 0x020e, 0x020f),
+        },
+        {
+                .freq                   = 4990,
+                RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf3, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07d0, 0x07cc, 0x07c8, 0x020c, 0x020d, 0x020e),
+        },
+        {
+                .freq                   = 5000,
+                RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf4, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07d4, 0x07d0, 0x07cc, 0x020b, 0x020c, 0x020d),
+        },
+        {
+                .freq                   = 5010,
+                RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf5, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07d8, 0x07d4, 0x07d0, 0x020a, 0x020b, 0x020c),
+        },
+        {
+                .freq                   = 5020,
+                RADIOREGS3(0xf7, 0x01, 0x01, 0x01, 0xf6, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07dc, 0x07d8, 0x07d4, 0x0209, 0x020a, 0x020b),
+        },
+        {
+                .freq                   = 5030,
+                RADIOREGS3(0xf7, 0x01, 0x01, 0x01, 0xf7, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07e0, 0x07dc, 0x07d8, 0x0208, 0x0209, 0x020a),
+        },
+        {
+                .freq                   = 5040,
+                RADIOREGS3(0xef, 0x01, 0x01, 0x01, 0xf8, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07e4, 0x07e0, 0x07dc, 0x0207, 0x0208, 0x0209),
+        },
+        {
+                .freq                   = 5050,
+                RADIOREGS3(0xef, 0x01, 0x01, 0x01, 0xf9, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07e8, 0x07e4, 0x07e0, 0x0206, 0x0207, 0x0208),
+        },
+        {
+                .freq                   = 5060,
+                RADIOREGS3(0xe6, 0x01, 0x01, 0x01, 0xfa, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07ec, 0x07e8, 0x07e4, 0x0205, 0x0206, 0x0207),
+        },
+        {
+                .freq                   = 5070,
+                RADIOREGS3(0xe6, 0x01, 0x01, 0x01, 0xfb, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfd, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfd, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07f0, 0x07ec, 0x07e8, 0x0204, 0x0205, 0x0206),
+        },
+        {
+                .freq                   = 5080,
+                RADIOREGS3(0xde, 0x01, 0x01, 0x01, 0xfc, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfd, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfd, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07f4, 0x07f0, 0x07ec, 0x0203, 0x0204, 0x0205),
+        },
+        {
+                .freq                   = 5090,
+                RADIOREGS3(0xde, 0x01, 0x01, 0x01, 0xfd, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfd, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfd, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07f8, 0x07f4, 0x07f0, 0x0202, 0x0203, 0x0204),
+        },
+        {
+                .freq                   = 5100,
+                RADIOREGS3(0xd6, 0x01, 0x01, 0x01, 0xfe, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfd, 0x00, 0x08, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfd, 0x00, 0x08, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07fc, 0x07f8, 0x07f4, 0x0201, 0x0202, 0x0203),
+        },
+        {
+                .freq                   = 5110,
+                RADIOREGS3(0xd6, 0x01, 0x01, 0x01, 0xff, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfc, 0x00, 0x08, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfc, 0x00, 0x08, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0800, 0x07fc, 0x07f8, 0x0200, 0x0201, 0x0202),
+        },
+        {
+                .freq                   = 5120,
+                RADIOREGS3(0xce, 0x01, 0x01, 0x02, 0x00, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfc, 0x00, 0x08, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfc, 0x00, 0x08, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0804, 0x0800, 0x07fc, 0x01ff, 0x0200, 0x0201),
+        },
+        {
+                .freq                   = 5130,
+                RADIOREGS3(0xce, 0x01, 0x01, 0x02, 0x01, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfc, 0x00, 0x08, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfc, 0x00, 0x08, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0808, 0x0804, 0x0800, 0x01fe, 0x01ff, 0x0200),
+        },
+        {
+                .freq                   = 5140,
+                RADIOREGS3(0xc6, 0x01, 0x01, 0x02, 0x02, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfb, 0x00, 0x08, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfb, 0x00, 0x08, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x080c, 0x0808, 0x0804, 0x01fd, 0x01fe, 0x01ff),
+        },
+        {
+                .freq                   = 5160,
+                RADIOREGS3(0xbe, 0x01, 0x01, 0x02, 0x04, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfa, 0x00, 0x07, 0x00, 0x77, 0x00, 0x0e,
+                           0x00, 0x6f, 0x00, 0xfa, 0x00, 0x07, 0x00, 0x77,
+                           0x00, 0x0e, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0814, 0x0810, 0x080c, 0x01fb, 0x01fc, 0x01fd),
+        },
+        {
+                .freq                   = 5170,
+                RADIOREGS3(0xbe, 0x01, 0x01, 0x02, 0x05, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfa, 0x00, 0x07, 0x00, 0x77, 0x00, 0x0e,
+                           0x00, 0x6f, 0x00, 0xfa, 0x00, 0x07, 0x00, 0x77,
+                           0x00, 0x0e, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0818, 0x0814, 0x0810, 0x01fa, 0x01fb, 0x01fc),
+        },
+        {
                 .freq                   = 5180,
                 RADIOREGS3(0xb6, 0x01, 0x01, 0x02, 0x06, 0x05, 0x05, 0x02,
                            0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
@@ -9067,6 +9292,15 @@ static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_radio_rev
                 PHYREGS(0x081c, 0x0818, 0x0814, 0x01f9, 0x01fa, 0x01fb),
         },
         {
+                .freq                   = 5190,
+                RADIOREGS3(0xb6, 0x01, 0x01, 0x02, 0x07, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                           0xff, 0xf9, 0x00, 0x06, 0x00, 0x77, 0x00, 0x0d,
+                           0x00, 0x6f, 0x00, 0xf9, 0x00, 0x06, 0x00, 0x77,
+                           0x00, 0x0d, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0820, 0x081c, 0x0818, 0x01f8, 0x01f9, 0x01fa),
+        },
+        {
                 .freq                   = 5200,
                 RADIOREGS3(0xaf, 0x01, 0x01, 0x02, 0x08, 0x05, 0x05, 0x02,
                            0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
@@ -9076,6 +9310,15 @@ static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_radio_rev
                 PHYREGS(0x0824, 0x0820, 0x081c, 0x01f7, 0x01f8, 0x01f9),
         },
         {
+                .freq                   = 5210,
+                RADIOREGS3(0xaf, 0x01, 0x01, 0x02, 0x09, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                           0xff, 0xf9, 0x00, 0x05, 0x00, 0x77, 0x00, 0x0d,
+                           0x00, 0x6f, 0x00, 0xf9, 0x00, 0x05, 0x00, 0x77,
+                           0x00, 0x0d, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0828, 0x0824, 0x0820, 0x01f6, 0x01f7, 0x01f8),
+        },
+        {
                 .freq                   = 5220,
                 RADIOREGS3(0xa7, 0x01, 0x01, 0x02, 0x0a, 0x05, 0x05, 0x02,
                            0x0c, 0x01, 0x02, 0x02, 0x02, 0x8e, 0x0f, 0x00,
@@ -9085,6 +9328,492 @@ static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_radio_rev
                 PHYREGS(0x082c, 0x0828, 0x0824, 0x01f5, 0x01f6, 0x01f7),
         },
         {
+                .freq                   = 5230,
+                RADIOREGS3(0xa7, 0x01, 0x01, 0x02, 0x0b, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x02, 0x02, 0x02, 0x8e, 0x0f, 0x00,
+                           0xee, 0xd8, 0x00, 0x05, 0x00, 0x77, 0x00, 0x0d,
+                           0x00, 0x6f, 0x00, 0xd8, 0x00, 0x05, 0x00, 0x77,
+                           0x00, 0x0d, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0830, 0x082c, 0x0828, 0x01f4, 0x01f5, 0x01f6),
+        },
+        {
+                .freq                   = 5240,
+                RADIOREGS3(0xa0, 0x01, 0x01, 0x02, 0x0c, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x02, 0x02, 0x02, 0x8e, 0x0f, 0x00,
+                           0xee, 0xc8, 0x00, 0x05, 0x00, 0x77, 0x00, 0x0d,
+                           0x00, 0x6f, 0x00, 0xc8, 0x00, 0x05, 0x00, 0x77,
+                           0x00, 0x0d, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0834, 0x0830, 0x082c, 0x01f3, 0x01f4, 0x01f5),
+        },
+        {
+                .freq                   = 5250,
+                RADIOREGS3(0xa0, 0x01, 0x01, 0x02, 0x0d, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x02, 0x02, 0x02, 0x8e, 0x0f, 0x00,
+                           0xed, 0xc7, 0x00, 0x05, 0x00, 0x77, 0x00, 0x0d,
+                           0x00, 0x6f, 0x00, 0xc7, 0x00, 0x05, 0x00, 0x77,
+                           0x00, 0x0d, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0838, 0x0834, 0x0830, 0x01f2, 0x01f3, 0x01f4),
+        },
+        {
+                .freq                   = 5260,
+                RADIOREGS3(0x98, 0x01, 0x01, 0x02, 0x0e, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x02, 0x02, 0x02, 0x8e, 0x0e, 0x00,
+                           0xed, 0xc7, 0x00, 0x04, 0x00, 0x77, 0x00, 0x0d,
+                           0x00, 0x6f, 0x00, 0xc7, 0x00, 0x04, 0x00, 0x77,
+                           0x00, 0x0d, 0x00, 0x6f, 0x00),
+                PHYREGS(0x083c, 0x0838, 0x0834, 0x01f1, 0x01f2, 0x01f3),
+        },
+        {
+                .freq                   = 5270,
+                RADIOREGS3(0x98, 0x01, 0x01, 0x02, 0x0f, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8e, 0x0e, 0x00,
+                           0xed, 0xc7, 0x00, 0x04, 0x00, 0x77, 0x00, 0x0c,
+                           0x00, 0x6f, 0x00, 0xc7, 0x00, 0x04, 0x00, 0x77,
+                           0x00, 0x0c, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0840, 0x083c, 0x0838, 0x01f0, 0x01f1, 0x01f2),
+        },
+        {
+                .freq                   = 5280,
+                RADIOREGS3(0x91, 0x01, 0x01, 0x02, 0x10, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0e, 0x00,
+                           0xdc, 0xb7, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0c,
+                           0x00, 0x6f, 0x00, 0xb7, 0x00, 0x03, 0x00, 0x77,
+                           0x00, 0x0c, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0844, 0x0840, 0x083c, 0x01f0, 0x01f0, 0x01f1),
+        },
+        {
+                .freq                   = 5290,
+                RADIOREGS3(0x91, 0x01, 0x01, 0x02, 0x11, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0e, 0x00,
+                           0xdc, 0xb7, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0c,
+                           0x00, 0x6f, 0x00, 0xb7, 0x00, 0x03, 0x00, 0x77,
+                           0x00, 0x0c, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0848, 0x0844, 0x0840, 0x01ef, 0x01f0, 0x01f0),
+        },
+        {
+                .freq                   = 5300,
+                RADIOREGS3(0x8a, 0x01, 0x01, 0x02, 0x12, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0e, 0x00,
+                           0xdc, 0xb7, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0c,
+                           0x00, 0x6f, 0x00, 0xb7, 0x00, 0x03, 0x00, 0x77,
+                           0x00, 0x0c, 0x00, 0x6f, 0x00),
+                PHYREGS(0x084c, 0x0848, 0x0844, 0x01ee, 0x01ef, 0x01f0),
+        },
+        {
+                .freq                   = 5310,
+                RADIOREGS3(0x8a, 0x01, 0x01, 0x02, 0x13, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0e, 0x00,
+                           0xdc, 0xb7, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0c,
+                           0x00, 0x6f, 0x00, 0xb7, 0x00, 0x03, 0x00, 0x77,
+                           0x00, 0x0c, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0850, 0x084c, 0x0848, 0x01ed, 0x01ee, 0x01ef),
+        },
+        {
+                .freq                   = 5320,
+                RADIOREGS3(0x83, 0x01, 0x01, 0x02, 0x14, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0e, 0x00,
+                           0xdb, 0xb7, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0c,
+                           0x00, 0x6f, 0x00, 0xb7, 0x00, 0x03, 0x00, 0x77,
+                           0x00, 0x0c, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0854, 0x0850, 0x084c, 0x01ec, 0x01ed, 0x01ee),
+        },
+        {
+                .freq                   = 5330,
+                RADIOREGS3(0x83, 0x01, 0x01, 0x02, 0x15, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0d, 0x00,
+                           0xcb, 0xa6, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0b,
+                           0x00, 0x6f, 0x00, 0xa6, 0x00, 0x03, 0x00, 0x77,
+                           0x00, 0x0b, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0858, 0x0854, 0x0850, 0x01eb, 0x01ec, 0x01ed),
+        },
+        {
+                .freq                   = 5340,
+                RADIOREGS3(0x7c, 0x01, 0x01, 0x02, 0x16, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0d, 0x00,
+                           0xca, 0xa6, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0b,
+                           0x00, 0x6f, 0x00, 0xa6, 0x00, 0x03, 0x00, 0x77,
+                           0x00, 0x0b, 0x00, 0x6f, 0x00),
+                PHYREGS(0x085c, 0x0858, 0x0854, 0x01ea, 0x01eb, 0x01ec),
+        },
+        {
+                .freq                   = 5350,
+                RADIOREGS3(0x7c, 0x01, 0x01, 0x02, 0x17, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0d, 0x00,
+                           0xca, 0xa6, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0b,
+                           0x00, 0x6f, 0x00, 0xa6, 0x00, 0x03, 0x00, 0x77,
+                           0x00, 0x0b, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0860, 0x085c, 0x0858, 0x01e9, 0x01ea, 0x01eb),
+        },
+        {
+                .freq                   = 5360,
+                RADIOREGS3(0x75, 0x01, 0x01, 0x02, 0x18, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0d, 0x00,
+                           0xc9, 0x95, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0a,
+                           0x00, 0x6f, 0x00, 0x95, 0x00, 0x03, 0x00, 0x77,
+                           0x00, 0x0a, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0864, 0x0860, 0x085c, 0x01e8, 0x01e9, 0x01ea),
+        },
+        {
+                .freq                   = 5370,
+                RADIOREGS3(0x75, 0x01, 0x01, 0x02, 0x19, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0d, 0x00,
+                           0xc9, 0x95, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0a,
+                           0x00, 0x6f, 0x00, 0x95, 0x00, 0x03, 0x00, 0x77,
+                           0x00, 0x0a, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0868, 0x0864, 0x0860, 0x01e7, 0x01e8, 0x01e9),
+        },
+        {
+                .freq                   = 5380,
+                RADIOREGS3(0x6e, 0x01, 0x01, 0x02, 0x1a, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0c, 0x00,
+                           0xb8, 0x95, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0a,
+                           0x00, 0x6f, 0x00, 0x95, 0x00, 0x03, 0x00, 0x77,
+                           0x00, 0x0a, 0x00, 0x6f, 0x00),
+                PHYREGS(0x086c, 0x0868, 0x0864, 0x01e6, 0x01e7, 0x01e8),
+        },
+        {
+                .freq                   = 5390,
+                RADIOREGS3(0x6e, 0x01, 0x01, 0x02, 0x1b, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0c, 0x00,
+                           0xb8, 0x84, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0a,
+                           0x00, 0x6f, 0x00, 0x84, 0x00, 0x03, 0x00, 0x77,
+                           0x00, 0x0a, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0870, 0x086c, 0x0868, 0x01e5, 0x01e6, 0x01e7),
+        },
+        {
+                .freq                   = 5400,
+                RADIOREGS3(0x67, 0x01, 0x01, 0x02, 0x1c, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0c, 0x00,
+                           0xb8, 0x84, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0a,
+                           0x00, 0x6f, 0x00, 0x84, 0x00, 0x03, 0x00, 0x77,
+                           0x00, 0x0a, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0874, 0x0870, 0x086c, 0x01e5, 0x01e5, 0x01e6),
+        },
+        {
+                .freq                   = 5410,
+                RADIOREGS3(0x67, 0x01, 0x01, 0x02, 0x1d, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0c, 0x00,
+                           0xb7, 0x84, 0x00, 0x02, 0x00, 0x77, 0x00, 0x0a,
+                           0x00, 0x6f, 0x00, 0x84, 0x00, 0x02, 0x00, 0x77,
+                           0x00, 0x0a, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0878, 0x0874, 0x0870, 0x01e4, 0x01e5, 0x01e5),
+        },
+        {
+                .freq                   = 5420,
+                RADIOREGS3(0x61, 0x01, 0x01, 0x02, 0x1e, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0c, 0x00,
+                           0xa7, 0x84, 0x00, 0x02, 0x00, 0x77, 0x00, 0x0a,
+                           0x00, 0x6f, 0x00, 0x84, 0x00, 0x02, 0x00, 0x77,
+                           0x00, 0x0a, 0x00, 0x6f, 0x00),
+                PHYREGS(0x087c, 0x0878, 0x0874, 0x01e3, 0x01e4, 0x01e5),
+        },
+        {
+                .freq                   = 5430,
+                RADIOREGS3(0x61, 0x01, 0x01, 0x02, 0x1f, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0b, 0x00,
+                           0xa6, 0x84, 0x00, 0x02, 0x00, 0x77, 0x00, 0x0a,
+                           0x00, 0x6f, 0x00, 0x84, 0x00, 0x02, 0x00, 0x77,
+                           0x00, 0x0a, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0880, 0x087c, 0x0878, 0x01e2, 0x01e3, 0x01e4),
+        },
+        {
+                .freq                   = 5440,
+                RADIOREGS3(0x5a, 0x01, 0x01, 0x02, 0x20, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x8b, 0x0b, 0x00,
+                           0xa6, 0x84, 0x00, 0x02, 0x00, 0x77, 0x00, 0x09,
+                           0x00, 0x6f, 0x00, 0x84, 0x00, 0x02, 0x00, 0x77,
+                           0x00, 0x09, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0884, 0x0880, 0x087c, 0x01e1, 0x01e2, 0x01e3),
+        },
+        {
+                .freq                   = 5450,
+                RADIOREGS3(0x5a, 0x01, 0x01, 0x02, 0x21, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x8b, 0x0b, 0x00,
+                           0x95, 0x84, 0x00, 0x01, 0x00, 0x77, 0x00, 0x09,
+                           0x00, 0x6f, 0x00, 0x84, 0x00, 0x01, 0x00, 0x77,
+                           0x00, 0x09, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0888, 0x0884, 0x0880, 0x01e0, 0x01e1, 0x01e2),
+        },
+        {
+                .freq                   = 5460,
+                RADIOREGS3(0x53, 0x01, 0x01, 0x02, 0x22, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x8b, 0x0b, 0x00,
+                           0x95, 0x84, 0x00, 0x01, 0x00, 0x77, 0x00, 0x09,
+                           0x00, 0x6f, 0x00, 0x84, 0x00, 0x01, 0x00, 0x77,
+                           0x00, 0x09, 0x00, 0x6f, 0x00),
+                PHYREGS(0x088c, 0x0888, 0x0884, 0x01df, 0x01e0, 0x01e1),
+        },
+        {
+                .freq                   = 5470,
+                RADIOREGS3(0x53, 0x01, 0x01, 0x02, 0x23, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x8b, 0x0b, 0x00,
+                           0x94, 0x73, 0x00, 0x01, 0x00, 0x77, 0x00, 0x09,
+                           0x00, 0x6f, 0x00, 0x73, 0x00, 0x01, 0x00, 0x77,
+                           0x00, 0x09, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0890, 0x088c, 0x0888, 0x01de, 0x01df, 0x01e0),
+        },
+        {
+                .freq                   = 5480,
+                RADIOREGS3(0x4d, 0x01, 0x01, 0x02, 0x24, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x0a, 0x00,
+                           0x84, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                           0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x09, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0894, 0x0890, 0x088c, 0x01dd, 0x01de, 0x01df),
+        },
+        {
+                .freq                   = 5490,
+                RADIOREGS3(0x4d, 0x01, 0x01, 0x02, 0x25, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x0a, 0x00,
+                           0x83, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                           0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x09, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0898, 0x0894, 0x0890, 0x01dd, 0x01dd, 0x01de),
+        },
+        {
+                .freq                   = 5500,
+                RADIOREGS3(0x47, 0x01, 0x01, 0x02, 0x26, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x0a, 0x00,
+                           0x82, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                           0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x09, 0x00, 0x6f, 0x00),
+                PHYREGS(0x089c, 0x0898, 0x0894, 0x01dc, 0x01dd, 0x01dd),
+        },
+        {
+                .freq                   = 5510,
+                RADIOREGS3(0x47, 0x01, 0x01, 0x02, 0x27, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x0a, 0x00,
+                           0x82, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                           0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x09, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08a0, 0x089c, 0x0898, 0x01db, 0x01dc, 0x01dd),
+        },
+        {
+                .freq                   = 5520,
+                RADIOREGS3(0x40, 0x01, 0x01, 0x02, 0x28, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x0a, 0x00,
+                           0x72, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                           0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x09, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08a4, 0x08a0, 0x089c, 0x01da, 0x01db, 0x01dc),
+        },
+        {
+                .freq                   = 5530,
+                RADIOREGS3(0x40, 0x01, 0x01, 0x02, 0x29, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x09, 0x00,
+                           0x72, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                           0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x09, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08a8, 0x08a4, 0x08a0, 0x01d9, 0x01da, 0x01db),
+        },
+        {
+                .freq                   = 5540,
+                RADIOREGS3(0x3a, 0x01, 0x01, 0x02, 0x2a, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x09, 0x00,
+                           0x71, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                           0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x09, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08ac, 0x08a8, 0x08a4, 0x01d8, 0x01d9, 0x01da),
+        },
+        {
+                .freq                   = 5550,
+                RADIOREGS3(0x3a, 0x01, 0x01, 0x02, 0x2b, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x89, 0x09, 0x00,
+                           0x61, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                           0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x09, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08b0, 0x08ac, 0x08a8, 0x01d7, 0x01d8, 0x01d9),
+        },
+        {
+                .freq                   = 5560,
+                RADIOREGS3(0x34, 0x01, 0x01, 0x02, 0x2c, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x89, 0x09, 0x00,
+                           0x61, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                           0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x09, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08b4, 0x08b0, 0x08ac, 0x01d7, 0x01d7, 0x01d8),
+        },
+        {
+                .freq                   = 5570,
+                RADIOREGS3(0x34, 0x01, 0x01, 0x02, 0x2d, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x89, 0x09, 0x00,
+                           0x61, 0x62, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                           0x00, 0x6f, 0x00, 0x62, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x09, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08b8, 0x08b4, 0x08b0, 0x01d6, 0x01d7, 0x01d7),
+        },
+        {
+                .freq                   = 5580,
+                RADIOREGS3(0x2e, 0x01, 0x01, 0x02, 0x2e, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x89, 0x08, 0x00,
+                           0x60, 0x62, 0x00, 0x00, 0x00, 0x77, 0x00, 0x08,
+                           0x00, 0x6f, 0x00, 0x62, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x08, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08bc, 0x08b8, 0x08b4, 0x01d5, 0x01d6, 0x01d7),
+        },
+        {
+                .freq                   = 5590,
+                RADIOREGS3(0x2e, 0x01, 0x01, 0x02, 0x2f, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x89, 0x08, 0x00,
+                           0x50, 0x61, 0x00, 0x00, 0x00, 0x77, 0x00, 0x08,
+                           0x00, 0x6f, 0x00, 0x61, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x08, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08c0, 0x08bc, 0x08b8, 0x01d4, 0x01d5, 0x01d6),
+        },
+        {
+                .freq                   = 5600,
+                RADIOREGS3(0x28, 0x01, 0x01, 0x02, 0x30, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x89, 0x08, 0x00,
+                           0x50, 0x51, 0x00, 0x00, 0x00, 0x77, 0x00, 0x08,
+                           0x00, 0x6f, 0x00, 0x51, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x08, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08c4, 0x08c0, 0x08bc, 0x01d3, 0x01d4, 0x01d5),
+        },
+        {
+                .freq                   = 5610,
+                RADIOREGS3(0x28, 0x01, 0x01, 0x02, 0x31, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x89, 0x08, 0x00,
+                           0x50, 0x51, 0x00, 0x00, 0x00, 0x77, 0x00, 0x08,
+                           0x00, 0x6f, 0x00, 0x51, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x08, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08c8, 0x08c4, 0x08c0, 0x01d2, 0x01d3, 0x01d4),
+        },
+        {
+                .freq                   = 5620,
+                RADIOREGS3(0x21, 0x01, 0x01, 0x02, 0x32, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x89, 0x08, 0x00,
+                           0x50, 0x50, 0x00, 0x00, 0x00, 0x77, 0x00, 0x07,
+                           0x00, 0x6f, 0x00, 0x50, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x07, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08cc, 0x08c8, 0x08c4, 0x01d2, 0x01d2, 0x01d3),
+        },
+        {
+                .freq                   = 5630,
+                RADIOREGS3(0x21, 0x01, 0x01, 0x02, 0x33, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x88, 0x07, 0x00,
+                           0x50, 0x50, 0x00, 0x00, 0x00, 0x77, 0x00, 0x07,
+                           0x00, 0x6f, 0x00, 0x50, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x07, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08d0, 0x08cc, 0x08c8, 0x01d1, 0x01d2, 0x01d2),
+        },
+        {
+                .freq                   = 5640,
+                RADIOREGS3(0x1c, 0x01, 0x01, 0x02, 0x34, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x88, 0x07, 0x00,
+                           0x40, 0x50, 0x00, 0x00, 0x00, 0x77, 0x00, 0x07,
+                           0x00, 0x6f, 0x00, 0x50, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x07, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08d4, 0x08d0, 0x08cc, 0x01d0, 0x01d1, 0x01d2),
+        },
+        {
+                .freq                   = 5650,
+                RADIOREGS3(0x1c, 0x01, 0x01, 0x02, 0x35, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x88, 0x07, 0x00,
+                           0x40, 0x40, 0x00, 0x00, 0x00, 0x77, 0x00, 0x07,
+                           0x00, 0x6f, 0x00, 0x40, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x07, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08d8, 0x08d4, 0x08d0, 0x01cf, 0x01d0, 0x01d1),
+        },
+        {
+                .freq                   = 5660,
+                RADIOREGS3(0x16, 0x01, 0x01, 0x02, 0x36, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x88, 0x07, 0x00,
+                           0x40, 0x40, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                           0x00, 0x6f, 0x00, 0x40, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x06, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08dc, 0x08d8, 0x08d4, 0x01ce, 0x01cf, 0x01d0),
+        },
+        {
+                .freq                   = 5670,
+                RADIOREGS3(0x16, 0x01, 0x01, 0x02, 0x37, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x88, 0x07, 0x00,
+                           0x40, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                           0x00, 0x6f, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x06, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08e0, 0x08dc, 0x08d8, 0x01ce, 0x01ce, 0x01cf),
+        },
+        {
+                .freq                   = 5680,
+                RADIOREGS3(0x10, 0x01, 0x01, 0x02, 0x38, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                           0x30, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                           0x00, 0x6f, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x06, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08e4, 0x08e0, 0x08dc, 0x01cd, 0x01ce, 0x01ce),
+        },
+        {
+                .freq                   = 5690,
+                RADIOREGS3(0x10, 0x01, 0x01, 0x02, 0x39, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                           0x30, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                           0x00, 0x6f, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x06, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08e8, 0x08e4, 0x08e0, 0x01cc, 0x01cd, 0x01ce),
+        },
+        {
+                .freq                   = 5700,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3a, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                           0x30, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                           0x00, 0x6e, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x06, 0x00, 0x6e, 0x00),
+                PHYREGS(0x08ec, 0x08e8, 0x08e4, 0x01cb, 0x01cc, 0x01cd),
+        },
+        {
+                .freq                   = 5710,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3b, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                           0x30, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                           0x00, 0x6e, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x06, 0x00, 0x6e, 0x00),
+                PHYREGS(0x08f0, 0x08ec, 0x08e8, 0x01ca, 0x01cb, 0x01cc),
+        },
+        {
+                .freq                   = 5720,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3c, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                           0x30, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                           0x00, 0x6e, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x06, 0x00, 0x6e, 0x00),
+                PHYREGS(0x08f4, 0x08f0, 0x08ec, 0x01c9, 0x01ca, 0x01cb),
+        },
+        {
+                .freq                   = 5725,
+                RADIOREGS3(0x03, 0x01, 0x02, 0x04, 0x79, 0x05, 0x05, 0x02,
+                           0x15, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                           0x30, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                           0x00, 0x6e, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x06, 0x00, 0x6e, 0x00),
+                PHYREGS(0x08f6, 0x08f2, 0x08ee, 0x01c9, 0x01ca, 0x01cb),
+        },
+        {
+                .freq                   = 5730,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3d, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
+                           0x20, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                           0x00, 0x6e, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x06, 0x00, 0x6e, 0x00),
+                PHYREGS(0x08f8, 0x08f4, 0x08f0, 0x01c9, 0x01c9, 0x01ca),
+        },
+        {
+                .freq                   = 5735,
+                RADIOREGS3(0x03, 0x01, 0x02, 0x04, 0x7b, 0x05, 0x05, 0x02,
+                           0x15, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
+                           0x20, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                           0x00, 0x6d, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x06, 0x00, 0x6d, 0x00),
+                PHYREGS(0x08fa, 0x08f6, 0x08f2, 0x01c8, 0x01c9, 0x01ca),
+        },
+        {
+                .freq                   = 5740,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3e, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
+                           0x20, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                           0x00, 0x6d, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x06, 0x00, 0x6d, 0x00),
+                PHYREGS(0x08fc, 0x08f8, 0x08f4, 0x01c8, 0x01c9, 0x01c9),
+        },
+        {
                 .freq                   = 5745,
                 RADIOREGS3(0xfe, 0x00, 0x02, 0x04, 0x7d, 0x05, 0x05, 0x02,
                            0x15, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
@@ -9094,6 +9823,33 @@ static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_radio_rev
                 PHYREGS(0x08fe, 0x08fa, 0x08f6, 0x01c8, 0x01c8, 0x01c9),
         },
         {
+                .freq                   = 5750,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3f, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
+                           0x20, 0x20, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x6d, 0x00, 0x20, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x6d, 0x00),
+                PHYREGS(0x0900, 0x08fc, 0x08f8, 0x01c7, 0x01c8, 0x01c9),
+        },
+        {
+                .freq                   = 5755,
+                RADIOREGS3(0xfe, 0x00, 0x02, 0x04, 0x7f, 0x05, 0x05, 0x02,
+                           0x15, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
+                           0x10, 0x20, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x6c, 0x00, 0x20, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x6c, 0x00),
+                PHYREGS(0x0902, 0x08fe, 0x08fa, 0x01c7, 0x01c8, 0x01c8),
+        },
+        {
+                .freq                   = 5760,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x40, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x86, 0x05, 0x00,
+                           0x10, 0x20, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x6c, 0x00, 0x20, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x6c, 0x00),
+                PHYREGS(0x0904, 0x0900, 0x08fc, 0x01c6, 0x01c7, 0x01c8),
+        },
+        {
                 .freq                   = 5765,
                 RADIOREGS3(0xf8, 0x00, 0x02, 0x04, 0x81, 0x05, 0x05, 0x02,
                            0x15, 0x01, 0x05, 0x05, 0x05, 0x86, 0x05, 0x00,
@@ -9103,6 +9859,33 @@ static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_radio_rev
                 PHYREGS(0x0906, 0x0902, 0x08fe, 0x01c6, 0x01c7, 0x01c8),
         },
         {
+                .freq                   = 5770,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x41, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x86, 0x04, 0x00,
+                           0x10, 0x10, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x6b, 0x00, 0x10, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x6b, 0x00),
+                PHYREGS(0x0908, 0x0904, 0x0900, 0x01c6, 0x01c6, 0x01c7),
+        },
+        {
+                .freq                   = 5775,
+                RADIOREGS3(0xf8, 0x00, 0x02, 0x04, 0x83, 0x05, 0x05, 0x02,
+                           0x15, 0x01, 0x05, 0x05, 0x05, 0x86, 0x04, 0x00,
+                           0x10, 0x10, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x6b, 0x00, 0x10, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x6b, 0x00),
+                PHYREGS(0x090a, 0x0906, 0x0902, 0x01c5, 0x01c6, 0x01c7),
+        },
+        {
+                .freq                   = 5780,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x42, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x86, 0x04, 0x00,
+                           0x10, 0x10, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x6b, 0x00, 0x10, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x6b, 0x00),
+                PHYREGS(0x090c, 0x0908, 0x0904, 0x01c5, 0x01c6, 0x01c6),
+        },
+        {
                 .freq                   = 5785,
                 RADIOREGS3(0xf2, 0x00, 0x02, 0x04, 0x85, 0x05, 0x05, 0x02,
                            0x15, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
@@ -9112,6 +9895,33 @@ static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_radio_rev
                 PHYREGS(0x090e, 0x090a, 0x0906, 0x01c4, 0x01c5, 0x01c6),
         },
         {
+                .freq                   = 5790,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x43, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                           0x00, 0x10, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x6b, 0x00, 0x10, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x6b, 0x00),
+                PHYREGS(0x0910, 0x090c, 0x0908, 0x01c4, 0x01c5, 0x01c6),
+        },
+        {
+                .freq                   = 5795,
+                RADIOREGS3(0xf2, 0x00, 0x02, 0x04, 0x87, 0x05, 0x05, 0x02,
+                           0x15, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x6b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x6b, 0x00),
+                PHYREGS(0x0912, 0x090e, 0x090a, 0x01c4, 0x01c4, 0x01c5),
+        },
+        {
+                .freq                   = 5800,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x44, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x6b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x6b, 0x00),
+                PHYREGS(0x0914, 0x0910, 0x090c, 0x01c3, 0x01c4, 0x01c5),
+        },
+        {
                 .freq                   = 5805,
                 RADIOREGS3(0xed, 0x00, 0x02, 0x04, 0x89, 0x05, 0x05, 0x02,
                            0x15, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
@@ -9121,6 +9931,33 @@ static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_radio_rev
                 PHYREGS(0x0916, 0x0912, 0x090e, 0x01c3, 0x01c4, 0x01c4),
         },
         {
+                .freq                   = 5810,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x45, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x6a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x6a, 0x00),
+                PHYREGS(0x0918, 0x0914, 0x0910, 0x01c2, 0x01c3, 0x01c4),
+        },
+        {
+                .freq                   = 5815,
+                RADIOREGS3(0xed, 0x00, 0x02, 0x04, 0x8b, 0x05, 0x05, 0x02,
+                           0x15, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x6a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x6a, 0x00),
+                PHYREGS(0x091a, 0x0916, 0x0912, 0x01c2, 0x01c3, 0x01c4),
+        },
+        {
+                .freq                   = 5820,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x46, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x6a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x6a, 0x00),
+                PHYREGS(0x091c, 0x0918, 0x0914, 0x01c2, 0x01c2, 0x01c3),
+        },
+        {
                 .freq                   = 5825,
                 RADIOREGS3(0xed, 0x00, 0x02, 0x04, 0x8d, 0x05, 0x05, 0x02,
                            0x15, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
@@ -9130,6 +9967,87 @@ static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_radio_rev
                 PHYREGS(0x091e, 0x091a, 0x0916, 0x01c1, 0x01c2, 0x01c3),
         },
         {
+                .freq                   = 5830,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x47, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x69, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x69, 0x00),
+                PHYREGS(0x0920, 0x091c, 0x0918, 0x01c1, 0x01c2, 0x01c2),
+        },
+        {
+                .freq                   = 5840,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x48, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                           0x00, 0x69, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x04, 0x00, 0x69, 0x00),
+                PHYREGS(0x0924, 0x0920, 0x091c, 0x01c0, 0x01c1, 0x01c2),
+        },
+        {
+                .freq                   = 5850,
+                RADIOREGS3(0xe0, 0x00, 0x01, 0x02, 0x49, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                           0x00, 0x69, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x04, 0x00, 0x69, 0x00),
+                PHYREGS(0x0928, 0x0924, 0x0920, 0x01bf, 0x01c0, 0x01c1),
+        },
+        {
+                .freq                   = 5860,
+                RADIOREGS3(0xde, 0x00, 0x01, 0x02, 0x4a, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                           0x00, 0x69, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x04, 0x00, 0x69, 0x00),
+                PHYREGS(0x092c, 0x0928, 0x0924, 0x01bf, 0x01bf, 0x01c0),
+        },
+        {
+                .freq                   = 5870,
+                RADIOREGS3(0xdb, 0x00, 0x01, 0x02, 0x4b, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                           0x00, 0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x04, 0x00, 0x68, 0x00),
+                PHYREGS(0x0930, 0x092c, 0x0928, 0x01be, 0x01bf, 0x01bf),
+        },
+        {
+                .freq                   = 5880,
+                RADIOREGS3(0xd8, 0x00, 0x01, 0x02, 0x4c, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                           0x00, 0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x04, 0x00, 0x68, 0x00),
+                PHYREGS(0x0934, 0x0930, 0x092c, 0x01bd, 0x01be, 0x01bf),
+        },
+        {
+                .freq                   = 5890,
+                RADIOREGS3(0xd6, 0x00, 0x01, 0x02, 0x4d, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                           0x00, 0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x04, 0x00, 0x68, 0x00),
+                PHYREGS(0x0938, 0x0934, 0x0930, 0x01bc, 0x01bd, 0x01be),
+        },
+        {
+                .freq                   = 5900,
+                RADIOREGS3(0xd3, 0x00, 0x01, 0x02, 0x4e, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                           0x00, 0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x04, 0x00, 0x68, 0x00),
+                PHYREGS(0x093c, 0x0938, 0x0934, 0x01bc, 0x01bc, 0x01bd),
+        },
+        {
+                .freq                   = 5910,
+                RADIOREGS3(0xd6, 0x00, 0x01, 0x02, 0x4f, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                           0x00, 0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x04, 0x00, 0x68, 0x00),
+                PHYREGS(0x0940, 0x093c, 0x0938, 0x01bb, 0x01bc, 0x01bc),
+        },
+        {
                 .freq                   = 2412,
                 RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x6c, 0x06, 0x06, 0x04,
                            0x2b, 0x01, 0x04, 0x04, 0x04, 0x8f, 0x30, 0x00,
diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
index 31adb8cf0291..4f38f19b8e3d 100644
--- a/drivers/net/wireless/b43/xmit.c
+++ b/drivers/net/wireless/b43/xmit.c
@@ -408,7 +408,7 @@ int b43_generate_txhdr(struct b43_wldev *dev,
                 mac_ctl |= B43_TXH_MAC_HWSEQ;
         if (info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)
                 mac_ctl |= B43_TXH_MAC_STMSDU;
-        if (phy->type == B43_PHYTYPE_A)
+        if (!phy->gmode)
                 mac_ctl |= B43_TXH_MAC_5GHZ;
 
         /* Overwrite rates[0].count to make the retry calculation
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
index 939d6b132922..16f9ab2568a8 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
@@ -186,7 +186,7 @@ void brcmf_del_if(struct brcmf_pub *drvr, s32 bssidx);
 void brcmf_txflowblock_if(struct brcmf_if *ifp,
                           enum brcmf_netif_stop_reason reason, bool state);
 u32 brcmf_get_chip_info(struct brcmf_if *ifp);
-void brcmf_txfinalize(struct brcmf_pub *drvr, struct sk_buff *txp,
+void brcmf_txfinalize(struct brcmf_pub *drvr, struct sk_buff *txp, u8 ifidx,
                       bool success);
 
 /* Sets dongle media info (drv_version, mac address). */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
index c4535616064e..c5dcd82e884b 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
@@ -99,6 +99,7 @@ struct brcmf_bus {
         unsigned long tx_realloc;
         u32 chip;
         u32 chiprev;
+        bool always_use_fws_queue;
 
         struct brcmf_bus_ops *ops;
 };
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
index 6a8983a1fb9c..ed3e32ce8c23 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
@@ -32,6 +32,9 @@
 #define BRCMF_DEFAULT_SCAN_UNASSOC_TIME 40
 #define BRCMF_DEFAULT_PACKET_FILTER     "100 0 0 0 0x01 0x00"
 
+/* boost value for RSSI_DELTA in preferred join selection */
+#define BRCMF_JOIN_PREF_RSSI_BOOST      8
+
 
 bool brcmf_c_prec_enq(struct device *dev, struct pktq *q,
                       struct sk_buff *pkt, int prec)
@@ -246,6 +249,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
 {
         s8 eventmask[BRCMF_EVENTING_MASK_LEN];
         u8 buf[BRCMF_DCMD_SMLEN];
+        struct brcmf_join_pref_params join_pref_params[2];
         char *ptr;
         s32 err;
 
@@ -298,6 +302,20 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
                 goto done;
         }
 
+        /* Setup join_pref to select target by RSSI(with boost on 5GHz) */
+        join_pref_params[0].type = BRCMF_JOIN_PREF_RSSI_DELTA;
+        join_pref_params[0].len = 2;
+        join_pref_params[0].rssi_gain = BRCMF_JOIN_PREF_RSSI_BOOST;
+        join_pref_params[0].band = WLC_BAND_5G;
+        join_pref_params[1].type = BRCMF_JOIN_PREF_RSSI;
+        join_pref_params[1].len = 2;
+        join_pref_params[1].rssi_gain = 0;
+        join_pref_params[1].band = 0;
+        err = brcmf_fil_iovar_data_set(ifp, "join_pref", join_pref_params,
+                                       sizeof(join_pref_params));
+        if (err)
+                brcmf_err("Set join_pref error (%d)\n", err);
+
         /* Setup event_msgs, enable E_IF */
         err = brcmf_fil_iovar_data_get(ifp, "event_msgs", eventmask,
                                        BRCMF_EVENTING_MASK_LEN);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
index 7d28cd385092..4cacc3d85212 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
@@ -190,7 +190,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
         int ret;
         struct brcmf_if *ifp = netdev_priv(ndev);
         struct brcmf_pub *drvr = ifp->drvr;
-        struct ethhdr *eh;
+        struct ethhdr *eh = (struct ethhdr *)(skb->data);
 
         brcmf_dbg(DATA, "Enter, idx=%d\n", ifp->bssidx);
 
@@ -236,6 +236,9 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
                 goto done;
         }
 
+        if (eh->h_proto == htons(ETH_P_PAE))
+                atomic_inc(&ifp->pend_8021x_cnt);
+
         ret = brcmf_fws_process_skb(ifp, skb);
 
 done:
@@ -538,31 +541,26 @@ void brcmf_rx_frame(struct device *dev, struct sk_buff *skb)
                 brcmf_netif_rx(ifp, skb);
 }
 
-void brcmf_txfinalize(struct brcmf_pub *drvr, struct sk_buff *txp,
+void brcmf_txfinalize(struct brcmf_pub *drvr, struct sk_buff *txp, u8 ifidx,
                       bool success)
 {
         struct brcmf_if *ifp;
         struct ethhdr *eh;
-        u8 ifidx;
         u16 type;
-        int res;
-
-        res = brcmf_proto_hdrpull(drvr, false, &ifidx, txp);
 
         ifp = drvr->iflist[ifidx];
         if (!ifp)
                 goto done;
 
-        if (res == 0) {
-                eh = (struct ethhdr *)(txp->data);
-                type = ntohs(eh->h_proto);
+        eh = (struct ethhdr *)(txp->data);
+        type = ntohs(eh->h_proto);
 
-                if (type == ETH_P_PAE) {
-                        atomic_dec(&ifp->pend_8021x_cnt);
-                        if (waitqueue_active(&ifp->pend_8021x_wait))
-                                wake_up(&ifp->pend_8021x_wait);
-                }
+        if (type == ETH_P_PAE) {
+                atomic_dec(&ifp->pend_8021x_cnt);
+                if (waitqueue_active(&ifp->pend_8021x_wait))
+                        wake_up(&ifp->pend_8021x_wait);
         }
+
         if (!success)
                 ifp->stats.tx_errors++;
 done:
@@ -573,13 +571,17 @@ void brcmf_txcomplete(struct device *dev, struct sk_buff *txp, bool success)
 {
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
         struct brcmf_pub *drvr = bus_if->drvr;
+        u8 ifidx;
 
         /* await txstatus signal for firmware if active */
         if (brcmf_fws_fc_active(drvr->fws)) {
                 if (!success)
                         brcmf_fws_bustxfail(drvr->fws, txp);
         } else {
-                brcmf_txfinalize(drvr, txp, success);
+                if (brcmf_proto_hdrpull(drvr, false, &ifidx, txp))
+                        brcmu_pkt_buf_free_skb(txp);
+                else
+                        brcmf_txfinalize(drvr, txp, ifidx, success);
         }
 }
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
index 614e4888504f..2bc68a2137fc 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
@@ -53,6 +53,14 @@
 #define BRCMF_OBSS_COEX_OFF             0
 #define BRCMF_OBSS_COEX_ON              1
 
+/* join preference types for join_pref iovar */
+enum brcmf_join_pref_types {
+        BRCMF_JOIN_PREF_RSSI = 1,
+        BRCMF_JOIN_PREF_WPA,
+        BRCMF_JOIN_PREF_BAND,
+        BRCMF_JOIN_PREF_RSSI_DELTA,
+};
+
 enum brcmf_fil_p2p_if_types {
         BRCMF_FIL_P2P_IF_CLIENT,
         BRCMF_FIL_P2P_IF_GO,
@@ -282,6 +290,22 @@ struct brcmf_assoc_params_le {
         __le16 chanspec_list[1];
 };
 
+/**
+ * struct join_pref params - parameters for preferred join selection.
+ *
+ * @type: preference type (see enum brcmf_join_pref_types).
+ * @len: length of bytes following (currently always 2).
+ * @rssi_gain: signal gain for selection (only when @type is RSSI_DELTA).
+ * @band: band to which selection preference applies.
+ *      This is used if @type is BAND or RSSI_DELTA.
+ */
+struct brcmf_join_pref_params {
+        u8 type;
+        u8 len;
+        u8 rssi_gain;
+        u8 band;
+};
+
 /* used for join with or without a specific bssid and channel list */
 struct brcmf_join_params {
         struct brcmf_ssid_le ssid_le;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
index c3e7d76dbf35..699908de314a 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
@@ -476,6 +476,7 @@ struct brcmf_fws_info {
         bool bus_flow_blocked;
         bool creditmap_received;
         u8 mode;
+        bool avoid_queueing;
 };
 
 /*
@@ -1369,13 +1370,12 @@ done:
 }
 
 static int brcmf_fws_txstatus_suppressed(struct brcmf_fws_info *fws, int fifo,
-                                         struct sk_buff *skb, u32 genbit,
-                                         u16 seq)
+                                         struct sk_buff *skb, u8 ifidx,
+                                         u32 genbit, u16 seq)
 {
         struct brcmf_fws_mac_descriptor *entry = brcmf_skbcb(skb)->mac;
         u32 hslot;
         int ret;
-        u8 ifidx;
 
         hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
 
@@ -1389,29 +1389,21 @@ static int brcmf_fws_txstatus_suppressed(struct brcmf_fws_info *fws, int fifo,
 
         entry->generation = genbit;
 
-        ret = brcmf_proto_hdrpull(fws->drvr, false, &ifidx, skb);
-        if (ret == 0) {
-                brcmf_skb_htod_tag_set_field(skb, GENERATION, genbit);
-                brcmf_skbcb(skb)->htod_seq = seq;
-                if (brcmf_skb_htod_seq_get_field(skb, FROMFW)) {
-                        brcmf_skb_htod_seq_set_field(skb, FROMDRV, 1);
-                        brcmf_skb_htod_seq_set_field(skb, FROMFW, 0);
-                } else {
-                        brcmf_skb_htod_seq_set_field(skb, FROMDRV, 0);
-                }
-                ret = brcmf_fws_enq(fws, BRCMF_FWS_SKBSTATE_SUPPRESSED, fifo,
-                                    skb);
+        brcmf_skb_htod_tag_set_field(skb, GENERATION, genbit);
+        brcmf_skbcb(skb)->htod_seq = seq;
+        if (brcmf_skb_htod_seq_get_field(skb, FROMFW)) {
+                brcmf_skb_htod_seq_set_field(skb, FROMDRV, 1);
+                brcmf_skb_htod_seq_set_field(skb, FROMFW, 0);
+        } else {
+                brcmf_skb_htod_seq_set_field(skb, FROMDRV, 0);
         }
+        ret = brcmf_fws_enq(fws, BRCMF_FWS_SKBSTATE_SUPPRESSED, fifo, skb);
 
         if (ret != 0) {
-                /* suppress q is full or hdrpull failed, drop this packet */
-                brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb,
-                                        true);
+                /* suppress q is full drop this packet */
+                brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb, true);
         } else {
-                /*
-                 * Mark suppressed to avoid a double free during
-                 * wlfc cleanup
-                 */
+                /* Mark suppressed to avoid a double free during wlfc cleanup */
                 brcmf_fws_hanger_mark_suppressed(&fws->hanger, hslot);
         }
 
@@ -1428,6 +1420,7 @@ brcmf_fws_txs_process(struct brcmf_fws_info *fws, u8 flags, u32 hslot,
         struct sk_buff *skb;
         struct brcmf_skbuff_cb *skcb;
         struct brcmf_fws_mac_descriptor *entry = NULL;
+        u8 ifidx;
 
         brcmf_dbg(DATA, "flags %d\n", flags);
 
@@ -1476,12 +1469,15 @@ brcmf_fws_txs_process(struct brcmf_fws_info *fws, u8 flags, u32 hslot,
         }
         brcmf_fws_macdesc_return_req_credit(skb);
 
+        if (brcmf_proto_hdrpull(fws->drvr, false, &ifidx, skb)) {
+                brcmu_pkt_buf_free_skb(skb);
+                return -EINVAL;
+        }
         if (!remove_from_hanger)
-                ret = brcmf_fws_txstatus_suppressed(fws, fifo, skb, genbit,
-                                                    seq);
-
+                ret = brcmf_fws_txstatus_suppressed(fws, fifo, skb, ifidx,
+                                                    genbit, seq);
         if (remove_from_hanger || ret)
-                brcmf_txfinalize(fws->drvr, skb, true);
+                brcmf_txfinalize(fws->drvr, skb, ifidx, true);
 
         return 0;
 }
@@ -1868,7 +1864,7 @@ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
         struct ethhdr *eh = (struct ethhdr *)(skb->data);
         int fifo = BRCMF_FWS_FIFO_BCMC;
         bool multicast = is_multicast_ether_addr(eh->h_dest);
-        bool pae = eh->h_proto == htons(ETH_P_PAE);
+        int rc = 0;
 
         brcmf_dbg(DATA, "tx proto=0x%X\n", ntohs(eh->h_proto));
         /* determine the priority */
@@ -1876,8 +1872,13 @@ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
                 skb->priority = cfg80211_classify8021d(skb, NULL);
 
         drvr->tx_multicast += !!multicast;
-        if (pae)
-                atomic_inc(&ifp->pend_8021x_cnt);
+
+        if (fws->avoid_queueing) {
+                rc = brcmf_proto_txdata(drvr, ifp->ifidx, 0, skb);
+                if (rc < 0)
+                        brcmf_txfinalize(drvr, skb, ifp->ifidx, false);
+                return rc;
+        }
 
         /* set control buffer information */
         skcb->if_flags = 0;
@@ -1899,15 +1900,12 @@ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
                 brcmf_fws_schedule_deq(fws);
         } else {
                 brcmf_err("drop skb: no hanger slot\n");
-                if (pae) {
-                        atomic_dec(&ifp->pend_8021x_cnt);
-                        if (waitqueue_active(&ifp->pend_8021x_wait))
-                                wake_up(&ifp->pend_8021x_wait);
-                }
-                brcmu_pkt_buf_free_skb(skb);
+                brcmf_txfinalize(drvr, skb, ifp->ifidx, false);
+                rc = -ENOMEM;
         }
         brcmf_fws_unlock(fws);
-        return 0;
+
+        return rc;
 }
 
 void brcmf_fws_reset_interface(struct brcmf_if *ifp)
@@ -1982,7 +1980,8 @@ static void brcmf_fws_dequeue_worker(struct work_struct *worker)
                                 ret = brcmf_proto_txdata(drvr, ifidx, 0, skb);
                                 brcmf_fws_lock(fws);
                                 if (ret < 0)
-                                        brcmf_txfinalize(drvr, skb, false);
+                                        brcmf_txfinalize(drvr, skb, ifidx,
+                                                         false);
                                 if (fws->bus_flow_blocked)
                                         break;
                         }
@@ -2039,6 +2038,13 @@ int brcmf_fws_init(struct brcmf_pub *drvr)
         fws->drvr = drvr;
         fws->fcmode = fcmode;
 
+        if ((drvr->bus_if->always_use_fws_queue == false) &&
+            (fcmode == BRCMF_FWS_FCMODE_NONE)) {
+                fws->avoid_queueing = true;
+                brcmf_dbg(INFO, "FWS queueing will be avoided\n");
+                return 0;
+        }
+
         fws->fws_wq = create_singlethread_workqueue("brcmf_fws_wq");
         if (fws->fws_wq == NULL) {
                 brcmf_err("workqueue creation failed\n");
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/nvram.c b/drivers/net/wireless/brcm80211/brcmfmac/nvram.c
index d5ef86db631b..5c450d11dbc9 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/nvram.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/nvram.c
@@ -18,72 +18,205 @@
 #include <linux/slab.h>
 #include <linux/firmware.h>
 
+#include "dhd_dbg.h"
 #include "nvram.h"
 
-/* brcmf_nvram_strip :Takes a buffer of "<var>=<value>\n" lines read from a file
+enum nvram_parser_state {
+        IDLE,
+        KEY,
+        VALUE,
+        COMMENT,
+        END
+};
+
+/**
+ * struct nvram_parser - internal info for parser.
+ *
+ * @state: current parser state.
+ * @fwnv: input buffer being parsed.
+ * @nvram: output buffer with parse result.
+ * @nvram_len: lenght of parse result.
+ * @line: current line.
+ * @column: current column in line.
+ * @pos: byte offset in input buffer.
+ * @entry: start position of key,value entry.
+ */
+struct nvram_parser {
+        enum nvram_parser_state state;
+        const struct firmware *fwnv;
+        u8 *nvram;
+        u32 nvram_len;
+        u32 line;
+        u32 column;
+        u32 pos;
+        u32 entry;
+};
+
+static bool is_nvram_char(char c)
+{
+        /* comment marker excluded */
+        if (c == '#')
+                return false;
+
+        /* key and value may have any other readable character */
+        return (c > 0x20 && c < 0x7f);
+}
+
+static bool is_whitespace(char c)
+{
+        return (c == ' ' || c == '\r' || c == '\n' || c == '\t');
+}
+
+static enum nvram_parser_state brcmf_nvram_handle_idle(struct nvram_parser *nvp)
+{
+        char c;
+
+        c = nvp->fwnv->data[nvp->pos];
+        if (c == '\n')
+                return COMMENT;
+        if (is_whitespace(c))
+                goto proceed;
+        if (c == '#')
+                return COMMENT;
+        if (is_nvram_char(c)) {
+                nvp->entry = nvp->pos;
+                return KEY;
+        }
+        brcmf_dbg(INFO, "warning: ln=%d:col=%d: ignoring invalid character\n",
+                  nvp->line, nvp->column);
+proceed:
+        nvp->column++;
+        nvp->pos++;
+        return IDLE;
+}
+
+static enum nvram_parser_state brcmf_nvram_handle_key(struct nvram_parser *nvp)
+{
+        enum nvram_parser_state st = nvp->state;
+        char c;
+
+        c = nvp->fwnv->data[nvp->pos];
+        if (c == '=') {
+                st = VALUE;
+        } else if (!is_nvram_char(c)) {
+                brcmf_dbg(INFO, "warning: ln=%d:col=%d: '=' expected, skip invalid key entry\n",
+                          nvp->line, nvp->column);
+                return COMMENT;
+        }
+
+        nvp->column++;
+        nvp->pos++;
+        return st;
+}
+
+static enum nvram_parser_state
+brcmf_nvram_handle_value(struct nvram_parser *nvp)
+{
+        char c;
+        char *skv;
+        char *ekv;
+        u32 cplen;
+
+        c = nvp->fwnv->data[nvp->pos];
+        if (!is_nvram_char(c)) {
+                /* key,value pair complete */
+                ekv = (u8 *)&nvp->fwnv->data[nvp->pos];
+                skv = (u8 *)&nvp->fwnv->data[nvp->entry];
+                cplen = ekv - skv;
+                /* copy to output buffer */
+                memcpy(&nvp->nvram[nvp->nvram_len], skv, cplen);
+                nvp->nvram_len += cplen;
+                nvp->nvram[nvp->nvram_len] = '\0';
+                nvp->nvram_len++;
+                return IDLE;
+        }
+        nvp->pos++;
+        nvp->column++;
+        return VALUE;
+}
+
+static enum nvram_parser_state
+brcmf_nvram_handle_comment(struct nvram_parser *nvp)
+{
+        char *eol, *sol;
+
+        sol = (char *)&nvp->fwnv->data[nvp->pos];
+        eol = strchr(sol, '\n');
+        if (eol == NULL)
+                return END;
+
+        /* eat all moving to next line */
+        nvp->line++;
+        nvp->column = 1;
+        nvp->pos += (eol - sol) + 1;
+        return IDLE;
+}
+
+static enum nvram_parser_state brcmf_nvram_handle_end(struct nvram_parser *nvp)
+{
+        /* final state */
+        return END;
+}
+
+static enum nvram_parser_state
+(*nv_parser_states[])(struct nvram_parser *nvp) = {
+        brcmf_nvram_handle_idle,
+        brcmf_nvram_handle_key,
+        brcmf_nvram_handle_value,
+        brcmf_nvram_handle_comment,
+        brcmf_nvram_handle_end
+};
+
+static int brcmf_init_nvram_parser(struct nvram_parser *nvp,
+                                   const struct firmware *nv)
+{
+        memset(nvp, 0, sizeof(*nvp));
+        nvp->fwnv = nv;
+        /* Alloc for extra 0 byte + roundup by 4 + length field */
+        nvp->nvram = kzalloc(nv->size + 1 + 3 + sizeof(u32), GFP_KERNEL);
+        if (!nvp->nvram)
+                return -ENOMEM;
+
+        nvp->line = 1;
+        nvp->column = 1;
+        return 0;
+}
+
+/* brcmf_nvram_strip :Takes a buffer of "<var>=<value>\n" lines read from a fil
  * and ending in a NUL. Removes carriage returns, empty lines, comment lines,
  * and converts newlines to NULs. Shortens buffer as needed and pads with NULs.
  * End of buffer is completed with token identifying length of buffer.
  */
 void *brcmf_nvram_strip(const struct firmware *nv, u32 *new_length)
 {
-        u8 *nvram;
-        u32 i;
-        u32 len;
-        u32 column;
-        u8 val;
-        bool comment;
+        struct nvram_parser nvp;
+        u32 pad;
         u32 token;
         __le32 token_le;
 
-        /* Alloc for extra 0 byte + roundup by 4 + length field */
-        nvram = kmalloc(nv->size + 1 + 3 + sizeof(token_le), GFP_KERNEL);
-        if (!nvram)
+        if (brcmf_init_nvram_parser(&nvp, nv) < 0)
                 return NULL;
 
-        len = 0;
-        column = 0;
-        comment = false;
-        for (i = 0; i < nv->size; i++) {
-                val = nv->data[i];
-                if (val == 0)
+        while (nvp.pos < nv->size) {
+                nvp.state = nv_parser_states[nvp.state](&nvp);
+                if (nvp.state == END)
                         break;
-                if (val == '\r')
-                        continue;
-                if (comment && (val != '\n'))
-                        continue;
-                comment = false;
-                if (val == '#') {
-                        comment = true;
-                        continue;
-                }
-                if (val == '\n') {
-                        if (column == 0)
-                                continue;
-                        nvram[len] = 0;
-                        len++;
-                        column = 0;
-                        continue;
-                }
-                nvram[len] = val;
-                len++;
-                column++;
         }
-        column = len;
-        *new_length = roundup(len + 1, 4);
-        while (column != *new_length) {
-                nvram[column] = 0;
-                column++;
+        pad = nvp.nvram_len;
+        *new_length = roundup(nvp.nvram_len + 1, 4);
+        while (pad != *new_length) {
+                nvp.nvram[pad] = 0;
+                pad++;
         }
 
         token = *new_length / 4;
         token = (~token << 16) | (token & 0x0000FFFF);
         token_le = cpu_to_le32(token);
 
-        memcpy(&nvram[*new_length], &token_le, sizeof(token_le));
+        memcpy(&nvp.nvram[*new_length], &token_le, sizeof(token_le));
         *new_length += sizeof(token_le);
 
-        return nvram;
+        return nvp.nvram;
 }
 
 void brcmf_nvram_free(void *nvram)
@@ -91,4 +224,3 @@ void brcmf_nvram_free(void *nvram)
         kfree(nvram);
 }
 
-
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index 24f65cd53859..3ce0e7cfd027 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -1254,6 +1254,7 @@ static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo)
         bus->chip = bus_pub->devid;
         bus->chiprev = bus_pub->chiprev;
         bus->proto_type = BRCMF_PROTO_BCDC;
+        bus->always_use_fws_queue = true;
 
         /* Attach to the common driver interface */
         ret = brcmf_attach(dev);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index be1985296bdc..92cb29a2003f 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -221,9 +221,9 @@ static const struct ieee80211_regdomain brcmf_regdom = {
                  */
                 REG_RULE(2484-10, 2484+10, 20, 6, 20, 0),
                 /* IEEE 802.11a, channel 36..64 */
-                REG_RULE(5150-10, 5350+10, 40, 6, 20, 0),
+                REG_RULE(5150-10, 5350+10, 80, 6, 20, 0),
                 /* IEEE 802.11a, channel 100..165 */
-                REG_RULE(5470-10, 5850+10, 40, 6, 20, 0), }
+                REG_RULE(5470-10, 5850+10, 80, 6, 20, 0), }
 };
 
 static const u32 __wl_cipher_suites[] = {
@@ -341,6 +341,60 @@ static u8 brcmf_mw_to_qdbm(u16 mw)
         return qdbm;
 }
 
+u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
+                        struct cfg80211_chan_def *ch)
+{
+        struct brcmu_chan ch_inf;
+        s32 primary_offset;
+
+        brcmf_dbg(TRACE, "chandef: control %d center %d width %d\n",
+                  ch->chan->center_freq, ch->center_freq1, ch->width);
+        ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq1);
+        primary_offset = ch->center_freq1 - ch->chan->center_freq;
+        switch (ch->width) {
+        case NL80211_CHAN_WIDTH_20:
+                ch_inf.bw = BRCMU_CHAN_BW_20;
+                WARN_ON(primary_offset != 0);
+                break;
+        case NL80211_CHAN_WIDTH_40:
+                ch_inf.bw = BRCMU_CHAN_BW_40;
+                if (primary_offset < 0)
+                        ch_inf.sb = BRCMU_CHAN_SB_U;
+                else
+                        ch_inf.sb = BRCMU_CHAN_SB_L;
+                break;
+        case NL80211_CHAN_WIDTH_80:
+                ch_inf.bw = BRCMU_CHAN_BW_80;
+                if (primary_offset < 0) {
+                        if (primary_offset < -CH_10MHZ_APART)
+                                ch_inf.sb = BRCMU_CHAN_SB_UU;
+                        else
+                                ch_inf.sb = BRCMU_CHAN_SB_UL;
+                } else {
+                        if (primary_offset > CH_10MHZ_APART)
+                                ch_inf.sb = BRCMU_CHAN_SB_LL;
+                        else
+                                ch_inf.sb = BRCMU_CHAN_SB_LU;
+                }
+                break;
+        default:
+                WARN_ON_ONCE(1);
+        }
+        switch (ch->chan->band) {
+        case IEEE80211_BAND_2GHZ:
+                ch_inf.band = BRCMU_CHAN_BAND_2G;
+                break;
+        case IEEE80211_BAND_5GHZ:
+                ch_inf.band = BRCMU_CHAN_BAND_5G;
+                break;
+        default:
+                WARN_ON_ONCE(1);
+        }
+        d11inf->encchspec(&ch_inf);
+
+        return ch_inf.chspec;
+}
+
 u16 channel_to_chanspec(struct brcmu_d11inf *d11inf,
                         struct ieee80211_channel *ch)
 {
@@ -1236,8 +1290,8 @@ brcmf_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *ndev,
                                 params->chandef.chan->center_freq);
                 if (params->channel_fixed) {
                         /* adding chanspec */
-                        chanspec = channel_to_chanspec(&cfg->d11inf,
-                                                       params->chandef.chan);
+                        chanspec = chandef_to_chanspec(&cfg->d11inf,
+                                                       &params->chandef);
                         join_params.params_le.chanspec_list[0] =
                                 cpu_to_le16(chanspec);
                         join_params.params_le.chanspec_num = cpu_to_le32(1);
@@ -2182,7 +2236,7 @@ brcmf_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
 
 static s32
 brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
-                           u8 *mac, struct station_info *sinfo)
+                           const u8 *mac, struct station_info *sinfo)
 {
         struct brcmf_if *ifp = netdev_priv(ndev);
         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
@@ -3734,23 +3788,6 @@ brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
 }
 
 static s32
-brcmf_cfg80211_set_channel(struct brcmf_cfg80211_info *cfg,
-                           struct brcmf_if *ifp,
-                           struct ieee80211_channel *channel)
-{
-        u16 chanspec;
-        s32 err;
-
-        brcmf_dbg(TRACE, "band=%d, center_freq=%d\n", channel->band,
-                  channel->center_freq);
-
-        chanspec = channel_to_chanspec(&cfg->d11inf, channel);
-        err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
-
-        return err;
-}
-
-static s32
 brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
                         struct cfg80211_ap_settings *settings)
 {
@@ -3765,11 +3802,12 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
         struct brcmf_join_params join_params;
         enum nl80211_iftype dev_role;
         struct brcmf_fil_bss_enable_le bss_enable;
+        u16 chanspec;
 
-        brcmf_dbg(TRACE, "channel_type=%d, beacon_interval=%d, dtim_period=%d,\n",
-                  cfg80211_get_chandef_type(&settings->chandef),
-                  settings->beacon_interval,
-                  settings->dtim_period);
+        brcmf_dbg(TRACE, "ctrlchn=%d, center=%d, bw=%d, beacon_interval=%d, dtim_period=%d,\n",
+                  settings->chandef.chan->hw_value,
+                  settings->chandef.center_freq1, settings->chandef.width,
+                  settings->beacon_interval, settings->dtim_period);
         brcmf_dbg(TRACE, "ssid=%s(%zu), auth_type=%d, inactivity_timeout=%d\n",
                   settings->ssid, settings->ssid_len, settings->auth_type,
                   settings->inactivity_timeout);
@@ -3826,9 +3864,10 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
 
         brcmf_config_ap_mgmt_ie(ifp->vif, &settings->beacon);
 
-        err = brcmf_cfg80211_set_channel(cfg, ifp, settings->chandef.chan);
+        chanspec = chandef_to_chanspec(&cfg->d11inf, &settings->chandef);
+        err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
         if (err < 0) {
-                brcmf_err("Set Channel failed, %d\n", err);
+                brcmf_err("Set Channel failed: chspec=%d, %d\n", chanspec, err);
                 goto exit;
         }
 
@@ -3975,7 +4014,7 @@ brcmf_cfg80211_change_beacon(struct wiphy *wiphy, struct net_device *ndev,
 
 static int
 brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
-                           u8 *mac)
+                           const u8 *mac)
 {
         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
         struct brcmf_scb_val_le scbval;
@@ -4203,7 +4242,7 @@ static int brcmf_convert_nl80211_tdls_oper(enum nl80211_tdls_operation oper)
 }
 
 static int brcmf_cfg80211_tdls_oper(struct wiphy *wiphy,
-                                    struct net_device *ndev, u8 *peer,
+                                    struct net_device *ndev, const u8 *peer,
                                     enum nl80211_tdls_operation oper)
 {
         struct brcmf_if *ifp;
@@ -4364,6 +4403,8 @@ static struct wiphy *brcmf_setup_wiphy(struct device *phydev)
                         WIPHY_FLAG_OFFCHAN_TX |
                         WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
                         WIPHY_FLAG_SUPPORTS_TDLS;
+        if (!brcmf_roamoff)
+                wiphy->flags |= WIPHY_FLAG_SUPPORTS_FW_ROAM;
         wiphy->mgmt_stypes = brcmf_txrx_stypes;
         wiphy->max_remain_on_channel_duration = 5000;
         brcmf_wiphy_pno_params(wiphy);
@@ -4685,7 +4726,6 @@ brcmf_notify_connect_status(struct brcmf_if *ifp,
         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
         struct ieee80211_channel *chan;
         s32 err = 0;
-        u16 reason;
 
         if (brcmf_is_apmode(ifp->vif)) {
                 err = brcmf_notify_connect_status_ap(cfg, ndev, e, data);
@@ -4706,16 +4746,6 @@ brcmf_notify_connect_status(struct brcmf_if *ifp,
                 brcmf_dbg(CONN, "Linkdown\n");
                 if (!brcmf_is_ibssmode(ifp->vif)) {
                         brcmf_bss_connect_done(cfg, ndev, e, false);
-                        if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTED,
-                                               &ifp->vif->sme_state)) {
-                                reason = 0;
-                                if (((e->event_code == BRCMF_E_DEAUTH_IND) ||
-                                     (e->event_code == BRCMF_E_DISASSOC_IND)) &&
-                                    (e->reason != WLAN_REASON_UNSPECIFIED))
-                                        reason = e->reason;
-                                cfg80211_disconnected(ndev, reason, NULL, 0,
-                                                      GFP_KERNEL);
-                        }
                 }
                 brcmf_link_down(ifp->vif);
                 brcmf_init_prof(ndev_to_prof(ndev));
@@ -5215,6 +5245,9 @@ static s32 brcmf_construct_reginfo(struct brcmf_cfg80211_info *cfg,
                 if (!(bw_cap[band] & WLC_BW_40MHZ_BIT) &&
                     ch.bw == BRCMU_CHAN_BW_40)
                         continue;
+                if (!(bw_cap[band] & WLC_BW_80MHZ_BIT) &&
+                    ch.bw == BRCMU_CHAN_BW_80)
+                        continue;
                 update = false;
                 for (j = 0; (j < *n_cnt && (*n_cnt < array_size)); j++) {
                         if (band_chan_arr[j].hw_value == ch.chnum) {
@@ -5231,10 +5264,13 @@ static s32 brcmf_construct_reginfo(struct brcmf_cfg80211_info *cfg,
                                 ieee80211_channel_to_frequency(ch.chnum, band);
                         band_chan_arr[index].hw_value = ch.chnum;
 
-                        if (ch.bw == BRCMU_CHAN_BW_40) {
-                                /* assuming the order is HT20, HT40 Upper,
-                                 * HT40 lower from chanspecs
-                                 */
+                        /* assuming the chanspecs order is HT20,
+                         * HT40 upper, HT40 lower, and VHT80.
+                         */
+                        if (ch.bw == BRCMU_CHAN_BW_80) {
+                                band_chan_arr[index].flags &=
+                                        ~IEEE80211_CHAN_NO_80MHZ;
+                        } else if (ch.bw == BRCMU_CHAN_BW_40) {
                                 ht40_flag = band_chan_arr[index].flags &
                                             IEEE80211_CHAN_NO_HT40;
                                 if (ch.sb == BRCMU_CHAN_SB_U) {
@@ -5255,8 +5291,13 @@ static s32 brcmf_construct_reginfo(struct brcmf_cfg80211_info *cfg,
                                                     IEEE80211_CHAN_NO_HT40MINUS;
                                 }
                         } else {
+                                /* disable other bandwidths for now as mentioned
+                                 * order assure they are enabled for subsequent
+                                 * chanspecs.
+                                 */
                                 band_chan_arr[index].flags =
-                                                        IEEE80211_CHAN_NO_HT40;
+                                                IEEE80211_CHAN_NO_HT40 |
+                                                IEEE80211_CHAN_NO_80MHZ;
                                 ch.bw = BRCMU_CHAN_BW_20;
                                 cfg->d11inf.encchspec(&ch);
                                 channel = ch.chspec;
@@ -5323,13 +5364,63 @@ static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
         }
 }
 
+static void brcmf_update_ht_cap(struct ieee80211_supported_band *band,
+                                u32 bw_cap[2], u32 nchain)
+{
+        band->ht_cap.ht_supported = true;
+        if (bw_cap[band->band] & WLC_BW_40MHZ_BIT) {
+                band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
+                band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+        }
+        band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
+        band->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
+        band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
+        band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
+        memset(band->ht_cap.mcs.rx_mask, 0xff, nchain);
+        band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
+}
+
+static __le16 brcmf_get_mcs_map(u32 nchain, enum ieee80211_vht_mcs_support supp)
+{
+        u16 mcs_map;
+        int i;
+
+        for (i = 0, mcs_map = 0xFFFF; i < nchain; i++)
+                mcs_map = (mcs_map << 2) | supp;
+
+        return cpu_to_le16(mcs_map);
+}
+
+static void brcmf_update_vht_cap(struct ieee80211_supported_band *band,
+                                 u32 bw_cap[2], u32 nchain)
+{
+        __le16 mcs_map;
+
+        /* not allowed in 2.4G band */
+        if (band->band == IEEE80211_BAND_2GHZ)
+                return;
+
+        band->vht_cap.vht_supported = true;
+        /* 80MHz is mandatory */
+        band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_80;
+        if (bw_cap[band->band] & WLC_BW_160MHZ_BIT) {
+                band->vht_cap.cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
+                band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_160;
+        }
+        /* all support 256-QAM */
+        mcs_map = brcmf_get_mcs_map(nchain, IEEE80211_VHT_MCS_SUPPORT_0_9);
+        band->vht_cap.vht_mcs.rx_mcs_map = mcs_map;
+        band->vht_cap.vht_mcs.tx_mcs_map = mcs_map;
+}
+
 static s32 brcmf_update_wiphybands(struct brcmf_cfg80211_info *cfg)
 {
         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
         struct wiphy *wiphy;
         s32 phy_list;
         u32 band_list[3];
-        u32 nmode;
+        u32 nmode = 0;
+        u32 vhtmode = 0;
         u32 bw_cap[2] = { 0, 0 };
         u32 rxchain;
         u32 nchain;
@@ -5360,14 +5451,16 @@ static s32 brcmf_update_wiphybands(struct brcmf_cfg80211_info *cfg)
         brcmf_dbg(INFO, "BRCMF_C_GET_BANDLIST reported: 0x%08x 0x%08x 0x%08x phy\n",
                   band_list[0], band_list[1], band_list[2]);
 
+        (void)brcmf_fil_iovar_int_get(ifp, "vhtmode", &vhtmode);
         err = brcmf_fil_iovar_int_get(ifp, "nmode", &nmode);
         if (err) {
                 brcmf_err("nmode error (%d)\n", err);
         } else {
                 brcmf_get_bwcap(ifp, bw_cap);
         }
-        brcmf_dbg(INFO, "nmode=%d, bw_cap=(%d, %d)\n", nmode,
-                  bw_cap[IEEE80211_BAND_2GHZ], bw_cap[IEEE80211_BAND_5GHZ]);
+        brcmf_dbg(INFO, "nmode=%d, vhtmode=%d, bw_cap=(%d, %d)\n",
+                  nmode, vhtmode, bw_cap[IEEE80211_BAND_2GHZ],
+                  bw_cap[IEEE80211_BAND_5GHZ]);
 
         err = brcmf_fil_iovar_int_get(ifp, "rxchain", &rxchain);
         if (err) {
@@ -5398,17 +5491,10 @@ static s32 brcmf_update_wiphybands(struct brcmf_cfg80211_info *cfg)
                 else
                         continue;
 
-                if (bw_cap[band->band] & WLC_BW_40MHZ_BIT) {
-                        band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
-                        band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
-                }
-                band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
-                band->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
-                band->ht_cap.ht_supported = true;
-                band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
-                band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
-                memset(band->ht_cap.mcs.rx_mask, 0xff, nchain);
-                band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
+                if (nmode)
+                        brcmf_update_ht_cap(band, bw_cap, nchain);
+                if (vhtmode)
+                        brcmf_update_vht_cap(band, bw_cap, nchain);
                 bands[band->band] = band;
         }
 
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index 9417cb5a2553..af8ba64ace39 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -4870,14 +4870,11 @@ static void brcms_c_detach_module(struct brcms_c_info *wlc)
 /*
  * low level detach
  */
-static int brcms_b_detach(struct brcms_c_info *wlc)
+static void brcms_b_detach(struct brcms_c_info *wlc)
 {
         uint i;
         struct brcms_hw_band *band;
         struct brcms_hardware *wlc_hw = wlc->hw;
-        int callbacks;
-
-        callbacks = 0;
 
         brcms_b_detach_dmapio(wlc_hw);
 
@@ -4900,9 +4897,6 @@ static int brcms_b_detach(struct brcms_c_info *wlc)
                 ai_detach(wlc_hw->sih);
                 wlc_hw->sih = NULL;
         }
-
-        return callbacks;
-
 }
 
 /*
@@ -4917,14 +4911,15 @@ static int brcms_b_detach(struct brcms_c_info *wlc)
  */
 uint brcms_c_detach(struct brcms_c_info *wlc)
 {
-        uint callbacks = 0;
+        uint callbacks;
 
         if (wlc == NULL)
                 return 0;
 
-        callbacks += brcms_b_detach(wlc);
+        brcms_b_detach(wlc);
 
         /* delete software timers */
+        callbacks = 0;
         if (!brcms_c_radio_monitor_stop(wlc))
                 callbacks++;
 
diff --git a/drivers/net/wireless/brcm80211/brcmutil/d11.c b/drivers/net/wireless/brcm80211/brcmutil/d11.c
index 30e54e2c6c9b..6cbc33d0fc19 100644
--- a/drivers/net/wireless/brcm80211/brcmutil/d11.c
+++ b/drivers/net/wireless/brcm80211/brcmutil/d11.c
@@ -21,43 +21,81 @@
 #include <brcmu_wifi.h>
 #include <brcmu_d11.h>
 
-static void brcmu_d11n_encchspec(struct brcmu_chan *ch)
+static u16 d11n_sb(enum brcmu_chan_sb sb)
 {
-        ch->chspec = ch->chnum & BRCMU_CHSPEC_CH_MASK;
+        switch (sb) {
+        case BRCMU_CHAN_SB_NONE:
+                return BRCMU_CHSPEC_D11N_SB_N;
+        case BRCMU_CHAN_SB_L:
+                return BRCMU_CHSPEC_D11N_SB_L;
+        case BRCMU_CHAN_SB_U:
+                return BRCMU_CHSPEC_D11N_SB_U;
+        default:
+                WARN_ON(1);
+        }
+        return 0;
+}
 
-        switch (ch->bw) {
+static u16 d11n_bw(enum brcmu_chan_bw bw)
+{
+        switch (bw) {
         case BRCMU_CHAN_BW_20:
-                ch->chspec |= BRCMU_CHSPEC_D11N_BW_20 | BRCMU_CHSPEC_D11N_SB_N;
-                break;
+                return BRCMU_CHSPEC_D11N_BW_20;
         case BRCMU_CHAN_BW_40:
+                return BRCMU_CHSPEC_D11N_BW_40;
         default:
-                WARN_ON_ONCE(1);
-                break;
+                WARN_ON(1);
         }
+        return 0;
+}
 
+static void brcmu_d11n_encchspec(struct brcmu_chan *ch)
+{
+        if (ch->bw == BRCMU_CHAN_BW_20)
+                ch->sb = BRCMU_CHAN_SB_NONE;
+
+        brcmu_maskset16(&ch->chspec, BRCMU_CHSPEC_CH_MASK,
+                        BRCMU_CHSPEC_CH_SHIFT, ch->chnum);
+        brcmu_maskset16(&ch->chspec, BRCMU_CHSPEC_D11N_SB_MASK,
+                        0, d11n_sb(ch->sb));
+        brcmu_maskset16(&ch->chspec, BRCMU_CHSPEC_D11N_BW_MASK,
+                        0, d11n_bw(ch->bw));
+
+        ch->chspec &= ~BRCMU_CHSPEC_D11N_BND_MASK;
         if (ch->chnum <= CH_MAX_2G_CHANNEL)
                 ch->chspec |= BRCMU_CHSPEC_D11N_BND_2G;
         else
                 ch->chspec |= BRCMU_CHSPEC_D11N_BND_5G;
 }
 
-static void brcmu_d11ac_encchspec(struct brcmu_chan *ch)
+static u16 d11ac_bw(enum brcmu_chan_bw bw)
 {
-        ch->chspec = ch->chnum & BRCMU_CHSPEC_CH_MASK;
-
-        switch (ch->bw) {
+        switch (bw) {
         case BRCMU_CHAN_BW_20:
-                ch->chspec |= BRCMU_CHSPEC_D11AC_BW_20;
-                break;
+                return BRCMU_CHSPEC_D11AC_BW_20;
         case BRCMU_CHAN_BW_40:
+                return BRCMU_CHSPEC_D11AC_BW_40;
         case BRCMU_CHAN_BW_80:
-        case BRCMU_CHAN_BW_80P80:
-        case BRCMU_CHAN_BW_160:
+                return BRCMU_CHSPEC_D11AC_BW_80;
         default:
-                WARN_ON_ONCE(1);
-                break;
+                WARN_ON(1);
         }
+        return 0;
+}
 
+static void brcmu_d11ac_encchspec(struct brcmu_chan *ch)
+{
+        if (ch->bw == BRCMU_CHAN_BW_20 || ch->sb == BRCMU_CHAN_SB_NONE)
+                ch->sb = BRCMU_CHAN_SB_L;
+
+        brcmu_maskset16(&ch->chspec, BRCMU_CHSPEC_CH_MASK,
+                        BRCMU_CHSPEC_CH_SHIFT, ch->chnum);
+        brcmu_maskset16(&ch->chspec, BRCMU_CHSPEC_D11AC_SB_MASK,
+                        BRCMU_CHSPEC_D11AC_SB_SHIFT, ch->sb);
+        brcmu_maskset16(&ch->chspec, BRCMU_CHSPEC_D11AC_BW_MASK,
+                        0, d11ac_bw(ch->bw));
+
+        ch->chspec &= ~BRCMU_CHSPEC_D11AC_BND_MASK;
         if (ch->chnum <= CH_MAX_2G_CHANNEL)
                 ch->chspec |= BRCMU_CHSPEC_D11AC_BND_2G;
         else
@@ -73,6 +111,7 @@ static void brcmu_d11n_decchspec(struct brcmu_chan *ch)
         switch (ch->chspec & BRCMU_CHSPEC_D11N_BW_MASK) {
         case BRCMU_CHSPEC_D11N_BW_20:
                 ch->bw = BRCMU_CHAN_BW_20;
+                ch->sb = BRCMU_CHAN_SB_NONE;
                 break;
         case BRCMU_CHSPEC_D11N_BW_40:
                 ch->bw = BRCMU_CHAN_BW_40;
@@ -112,6 +151,7 @@ static void brcmu_d11ac_decchspec(struct brcmu_chan *ch)
         switch (ch->chspec & BRCMU_CHSPEC_D11AC_BW_MASK) {
         case BRCMU_CHSPEC_D11AC_BW_20:
                 ch->bw = BRCMU_CHAN_BW_20;
+                ch->sb = BRCMU_CHAN_SB_NONE;
                 break;
         case BRCMU_CHSPEC_D11AC_BW_40:
                 ch->bw = BRCMU_CHAN_BW_40;
@@ -128,6 +168,25 @@ static void brcmu_d11ac_decchspec(struct brcmu_chan *ch)
                 break;
         case BRCMU_CHSPEC_D11AC_BW_80:
                 ch->bw = BRCMU_CHAN_BW_80;
+                ch->sb = brcmu_maskget16(ch->chspec, BRCMU_CHSPEC_D11AC_SB_MASK,
+                                         BRCMU_CHSPEC_D11AC_SB_SHIFT);
+                switch (ch->sb) {
+                case BRCMU_CHAN_SB_LL:
+                        ch->chnum -= CH_30MHZ_APART;
+                        break;
+                case BRCMU_CHAN_SB_LU:
+                        ch->chnum -= CH_10MHZ_APART;
+                        break;
+                case BRCMU_CHAN_SB_UL:
+                        ch->chnum += CH_10MHZ_APART;
+                        break;
+                case BRCMU_CHAN_SB_UU:
+                        ch->chnum += CH_30MHZ_APART;
+                        break;
+                default:
+                        WARN_ON_ONCE(1);
+                        break;
+                }
                 break;
         case BRCMU_CHSPEC_D11AC_BW_8080:
         case BRCMU_CHSPEC_D11AC_BW_160:
diff --git a/drivers/net/wireless/brcm80211/include/brcmu_d11.h b/drivers/net/wireless/brcm80211/include/brcmu_d11.h
index 8660a2cba098..f9745ea8b3e0 100644
--- a/drivers/net/wireless/brcm80211/include/brcmu_d11.h
+++ b/drivers/net/wireless/brcm80211/include/brcmu_d11.h
@@ -108,13 +108,7 @@ enum brcmu_chan_bw {
 };
 
 enum brcmu_chan_sb {
-        BRCMU_CHAN_SB_NONE = 0,
-        BRCMU_CHAN_SB_L,
-        BRCMU_CHAN_SB_U,
-        BRCMU_CHAN_SB_LL,
-        BRCMU_CHAN_SB_LU,
-        BRCMU_CHAN_SB_UL,
-        BRCMU_CHAN_SB_UU,
+        BRCMU_CHAN_SB_NONE = -1,
         BRCMU_CHAN_SB_LLL,
         BRCMU_CHAN_SB_LLU,
         BRCMU_CHAN_SB_LUL,
@@ -123,6 +117,12 @@ enum brcmu_chan_sb {
         BRCMU_CHAN_SB_ULU,
         BRCMU_CHAN_SB_UUL,
         BRCMU_CHAN_SB_UUU,
+        BRCMU_CHAN_SB_L = BRCMU_CHAN_SB_LLL,
+        BRCMU_CHAN_SB_U = BRCMU_CHAN_SB_LLU,
+        BRCMU_CHAN_SB_LL = BRCMU_CHAN_SB_LLL,
+        BRCMU_CHAN_SB_LU = BRCMU_CHAN_SB_LLU,
+        BRCMU_CHAN_SB_UL = BRCMU_CHAN_SB_LUL,
+        BRCMU_CHAN_SB_UU = BRCMU_CHAN_SB_LUU,
 };
 
 struct brcmu_chan {
diff --git a/drivers/net/wireless/brcm80211/include/brcmu_wifi.h b/drivers/net/wireless/brcm80211/include/brcmu_wifi.h
index 74419d4bd123..76b5d3a86294 100644
--- a/drivers/net/wireless/brcm80211/include/brcmu_wifi.h
+++ b/drivers/net/wireless/brcm80211/include/brcmu_wifi.h
@@ -29,6 +29,7 @@
 #define CH_UPPER_SB                     0x01
 #define CH_LOWER_SB                     0x02
 #define CH_EWA_VALID                    0x04
+#define CH_30MHZ_APART                  6
 #define CH_20MHZ_APART                  4
 #define CH_10MHZ_APART                  2
 #define CH_5MHZ_APART                   1 /* 2G band channels are 5 Mhz apart */
diff --git a/drivers/net/wireless/iwlwifi/Kconfig b/drivers/net/wireless/iwlwifi/Kconfig
index 74b3b4de7bb7..7fd50428b934 100644
--- a/drivers/net/wireless/iwlwifi/Kconfig
+++ b/drivers/net/wireless/iwlwifi/Kconfig
@@ -2,10 +2,6 @@ config IWLWIFI
         tristate "Intel Wireless WiFi Next Gen AGN - Wireless-N/Advanced-N/Ultimate-N (iwlwifi) "
         depends on PCI && MAC80211 && HAS_IOMEM
         select FW_LOADER
-        select NEW_LEDS
-        select LEDS_CLASS
-        select LEDS_TRIGGERS
-        select MAC80211_LEDS
         ---help---
           Select to build the driver supporting the:
 
@@ -43,6 +39,14 @@ config IWLWIFI
           say M here and read <file:Documentation/kbuild/modules.txt>.  The
           module will be called iwlwifi.
 
+config IWLWIFI_LEDS
+        bool
+        depends on IWLWIFI
+        depends on LEDS_CLASS=y || LEDS_CLASS=IWLWIFI
+        select LEDS_TRIGGERS
+        select MAC80211_LEDS
+        default y
+
 config IWLDVM
         tristate "Intel Wireless WiFi DVM Firmware support"
         depends on IWLWIFI
@@ -124,7 +128,6 @@ config IWLWIFI_DEBUG_EXPERIMENTAL_UCODE
           Enable use of experimental ucode for testing and debugging.
 
 config IWLWIFI_DEVICE_TRACING
-
         bool "iwlwifi device access tracing"
         depends on IWLWIFI
         depends on EVENT_TRACING
diff --git a/drivers/net/wireless/iwlwifi/dvm/Makefile b/drivers/net/wireless/iwlwifi/dvm/Makefile
index dce7ab2e0c4b..4d19685f31c3 100644
--- a/drivers/net/wireless/iwlwifi/dvm/Makefile
+++ b/drivers/net/wireless/iwlwifi/dvm/Makefile
@@ -4,9 +4,10 @@ iwldvm-objs		+= main.o rs.o mac80211.o ucode.o tx.o
 iwldvm-objs             += lib.o calib.o tt.o sta.o rx.o
 
 iwldvm-objs             += power.o
-iwldvm-objs             += scan.o led.o
+iwldvm-objs             += scan.o
 iwldvm-objs             += rxon.o devices.o
 
+iwldvm-$(CONFIG_IWLWIFI_LEDS) += led.o
 iwldvm-$(CONFIG_IWLWIFI_DEBUGFS) += debugfs.o
 
 ccflags-y += -D__CHECK_ENDIAN__ -I$(src)/../
diff --git a/drivers/net/wireless/iwlwifi/dvm/calib.c b/drivers/net/wireless/iwlwifi/dvm/calib.c
index be1086c87157..20e6aa910700 100644
--- a/drivers/net/wireless/iwlwifi/dvm/calib.c
+++ b/drivers/net/wireless/iwlwifi/dvm/calib.c
@@ -94,7 +94,6 @@ int iwl_send_calib_results(struct iwl_priv *priv)
 {
         struct iwl_host_cmd hcmd = {
                 .id = REPLY_PHY_CALIBRATION_CMD,
-                .flags = CMD_SYNC,
         };
         struct iwl_calib_result *res;
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/debugfs.c b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
index d2fe2596d54e..0ffb6ff1a255 100644
--- a/drivers/net/wireless/iwlwifi/dvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
@@ -1481,7 +1481,7 @@ static ssize_t iwl_dbgfs_ucode_bt_stats_read(struct file *file,
 
         /* make request to uCode to retrieve statistics information */
         mutex_lock(&priv->mutex);
-        ret = iwl_send_statistics_request(priv, CMD_SYNC, false);
+        ret = iwl_send_statistics_request(priv, 0, false);
         mutex_unlock(&priv->mutex);
 
         if (ret)
@@ -1868,7 +1868,7 @@ static ssize_t iwl_dbgfs_clear_ucode_statistics_write(struct file *file,
 
         /* make request to uCode to retrieve statistics information */
         mutex_lock(&priv->mutex);
-        iwl_send_statistics_request(priv, CMD_SYNC, true);
+        iwl_send_statistics_request(priv, 0, true);
         mutex_unlock(&priv->mutex);
 
         return count;
@@ -2188,7 +2188,6 @@ static int iwl_cmd_echo_test(struct iwl_priv *priv)
         struct iwl_host_cmd cmd = {
                 .id = REPLY_ECHO,
                 .len = { 0 },
-                .flags = CMD_SYNC,
         };
 
         ret = iwl_dvm_send_cmd(priv, &cmd);
@@ -2320,7 +2319,7 @@ static ssize_t iwl_dbgfs_fw_restart_write(struct file *file,
         mutex_lock(&priv->mutex);
 
         /* take the return value to make compiler happy - it will fail anyway */
-        ret = iwl_dvm_send_cmd_pdu(priv, REPLY_ERROR, CMD_SYNC, 0, NULL);
+        ret = iwl_dvm_send_cmd_pdu(priv, REPLY_ERROR, 0, 0, NULL);
 
         mutex_unlock(&priv->mutex);
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/dev.h b/drivers/net/wireless/iwlwifi/dvm/dev.h
index 3441f70d0ff9..a6f22c32a279 100644
--- a/drivers/net/wireless/iwlwifi/dvm/dev.h
+++ b/drivers/net/wireless/iwlwifi/dvm/dev.h
@@ -888,9 +888,11 @@ struct iwl_priv {
 
         struct iwl_event_log event_log;
 
+#ifdef CONFIG_IWLWIFI_LEDS
         struct led_classdev led;
         unsigned long blink_on, blink_off;
         bool led_registered;
+#endif
 
         /* WoWLAN GTK rekey data */
         u8 kck[NL80211_KCK_LEN], kek[NL80211_KEK_LEN];
diff --git a/drivers/net/wireless/iwlwifi/dvm/devices.c b/drivers/net/wireless/iwlwifi/dvm/devices.c
index 758c54eeb206..34b41e5f7cfc 100644
--- a/drivers/net/wireless/iwlwifi/dvm/devices.c
+++ b/drivers/net/wireless/iwlwifi/dvm/devices.c
@@ -417,7 +417,6 @@ static int iwl5000_hw_channel_switch(struct iwl_priv *priv,
         struct iwl_host_cmd hcmd = {
                 .id = REPLY_CHANNEL_SWITCH,
                 .len = { sizeof(cmd), },
-                .flags = CMD_SYNC,
                 .data = { &cmd, },
         };
 
@@ -579,7 +578,6 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv,
         struct iwl_host_cmd hcmd = {
                 .id = REPLY_CHANNEL_SWITCH,
                 .len = { sizeof(*cmd), },
-                .flags = CMD_SYNC,
                 .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
         };
         int err;
diff --git a/drivers/net/wireless/iwlwifi/dvm/led.h b/drivers/net/wireless/iwlwifi/dvm/led.h
index 6a0817d9c4fa..1c6b2252d0f2 100644
--- a/drivers/net/wireless/iwlwifi/dvm/led.h
+++ b/drivers/net/wireless/iwlwifi/dvm/led.h
@@ -36,8 +36,20 @@ struct iwl_priv;
 #define IWL_LED_ACTIVITY       (0<<1)
 #define IWL_LED_LINK           (1<<1)
 
+#ifdef CONFIG_IWLWIFI_LEDS
 void iwlagn_led_enable(struct iwl_priv *priv);
 void iwl_leds_init(struct iwl_priv *priv);
 void iwl_leds_exit(struct iwl_priv *priv);
+#else
+static inline void iwlagn_led_enable(struct iwl_priv *priv)
+{
+}
+static inline void iwl_leds_init(struct iwl_priv *priv)
+{
+}
+static inline void iwl_leds_exit(struct iwl_priv *priv)
+{
+}
+#endif
 
 #endif /* __iwl_leds_h__ */
diff --git a/drivers/net/wireless/iwlwifi/dvm/lib.c b/drivers/net/wireless/iwlwifi/dvm/lib.c
index d169228f59e7..2191621d69c1 100644
--- a/drivers/net/wireless/iwlwifi/dvm/lib.c
+++ b/drivers/net/wireless/iwlwifi/dvm/lib.c
@@ -81,7 +81,7 @@ int iwlagn_send_tx_power(struct iwl_priv *priv)
         else
                 tx_ant_cfg_cmd = REPLY_TX_POWER_DBM_CMD;
 
-        return iwl_dvm_send_cmd_pdu(priv, tx_ant_cfg_cmd, CMD_SYNC,
+        return iwl_dvm_send_cmd_pdu(priv, tx_ant_cfg_cmd, 0,
                         sizeof(tx_power_cmd), &tx_power_cmd);
 }
 
@@ -141,7 +141,6 @@ int iwlagn_txfifo_flush(struct iwl_priv *priv, u32 scd_q_msk)
         struct iwl_host_cmd cmd = {
                 .id = REPLY_TXFIFO_FLUSH,
                 .len = { sizeof(struct iwl_txfifo_flush_cmd), },
-                .flags = CMD_SYNC,
                 .data = { &flush_cmd, },
         };
 
@@ -333,12 +332,12 @@ void iwlagn_send_advance_bt_config(struct iwl_priv *priv)
                 memcpy(&bt_cmd_v2.basic, &basic,
                         sizeof(basic));
                 ret = iwl_dvm_send_cmd_pdu(priv, REPLY_BT_CONFIG,
-                        CMD_SYNC, sizeof(bt_cmd_v2), &bt_cmd_v2);
+                        0, sizeof(bt_cmd_v2), &bt_cmd_v2);
         } else {
                 memcpy(&bt_cmd_v1.basic, &basic,
                         sizeof(basic));
                 ret = iwl_dvm_send_cmd_pdu(priv, REPLY_BT_CONFIG,
-                        CMD_SYNC, sizeof(bt_cmd_v1), &bt_cmd_v1);
+                        0, sizeof(bt_cmd_v1), &bt_cmd_v1);
         }
         if (ret)
                 IWL_ERR(priv, "failed to send BT Coex Config\n");
@@ -1044,7 +1043,6 @@ int iwlagn_send_patterns(struct iwl_priv *priv,
         struct iwl_host_cmd cmd = {
                 .id = REPLY_WOWLAN_PATTERNS,
                 .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
-                .flags = CMD_SYNC,
         };
         int i, err;
 
@@ -1201,7 +1199,6 @@ int iwlagn_suspend(struct iwl_priv *priv, struct cfg80211_wowlan *wowlan)
                 if (key_data.use_rsc_tsc) {
                         struct iwl_host_cmd rsc_tsc_cmd = {
                                 .id = REPLY_WOWLAN_TSC_RSC_PARAMS,
-                                .flags = CMD_SYNC,
                                 .data[0] = key_data.rsc_tsc,
                                 .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
                                 .len[0] = sizeof(*key_data.rsc_tsc),
@@ -1215,7 +1212,7 @@ int iwlagn_suspend(struct iwl_priv *priv, struct cfg80211_wowlan *wowlan)
                 if (key_data.use_tkip) {
                         ret = iwl_dvm_send_cmd_pdu(priv,
                                                  REPLY_WOWLAN_TKIP_PARAMS,
-                                                 CMD_SYNC, sizeof(tkip_cmd),
+                                                 0, sizeof(tkip_cmd),
                                                  &tkip_cmd);
                         if (ret)
                                 goto out;
@@ -1231,20 +1228,20 @@ int iwlagn_suspend(struct iwl_priv *priv, struct cfg80211_wowlan *wowlan)
 
                         ret = iwl_dvm_send_cmd_pdu(priv,
                                                  REPLY_WOWLAN_KEK_KCK_MATERIAL,
-                                                 CMD_SYNC, sizeof(kek_kck_cmd),
+                                                 0, sizeof(kek_kck_cmd),
                                                  &kek_kck_cmd);
                         if (ret)
                                 goto out;
                 }
         }
 
-        ret = iwl_dvm_send_cmd_pdu(priv, REPLY_D3_CONFIG, CMD_SYNC,
+        ret = iwl_dvm_send_cmd_pdu(priv, REPLY_D3_CONFIG, 0,
                                      sizeof(d3_cfg_cmd), &d3_cfg_cmd);
         if (ret)
                 goto out;
 
         ret = iwl_dvm_send_cmd_pdu(priv, REPLY_WOWLAN_WAKEUP_FILTER,
-                                 CMD_SYNC, sizeof(wakeup_filter_cmd),
+                                 0, sizeof(wakeup_filter_cmd),
                                  &wakeup_filter_cmd);
         if (ret)
                 goto out;
diff --git a/drivers/net/wireless/iwlwifi/dvm/main.c b/drivers/net/wireless/iwlwifi/dvm/main.c
index 6a00353768f3..0b7f46f0b079 100644
--- a/drivers/net/wireless/iwlwifi/dvm/main.c
+++ b/drivers/net/wireless/iwlwifi/dvm/main.c
@@ -128,7 +128,6 @@ int iwlagn_send_beacon_cmd(struct iwl_priv *priv)
         struct iwl_tx_beacon_cmd *tx_beacon_cmd;
         struct iwl_host_cmd cmd = {
                 .id = REPLY_TX_BEACON,
-                .flags = CMD_SYNC,
         };
         struct ieee80211_tx_info *info;
         u32 frame_size;
@@ -311,8 +310,7 @@ int iwl_send_statistics_request(struct iwl_priv *priv, u8 flags, bool clear)
                                         sizeof(struct iwl_statistics_cmd),
                                         &statistics_cmd);
         else
-                return iwl_dvm_send_cmd_pdu(priv, REPLY_STATISTICS_CMD,
-                                        CMD_SYNC,
+                return iwl_dvm_send_cmd_pdu(priv, REPLY_STATISTICS_CMD, 0,
                                         sizeof(struct iwl_statistics_cmd),
                                         &statistics_cmd);
 }
@@ -622,7 +620,7 @@ static void iwl_rf_kill_ct_config(struct iwl_priv *priv)
 
                 ret = iwl_dvm_send_cmd_pdu(priv,
                                        REPLY_CT_KILL_CONFIG_CMD,
-                                       CMD_SYNC, sizeof(adv_cmd), &adv_cmd);
+                                       0, sizeof(adv_cmd), &adv_cmd);
                 if (ret)
                         IWL_ERR(priv, "REPLY_CT_KILL_CONFIG_CMD failed\n");
                 else
@@ -637,7 +635,7 @@ static void iwl_rf_kill_ct_config(struct iwl_priv *priv)
 
                 ret = iwl_dvm_send_cmd_pdu(priv,
                                        REPLY_CT_KILL_CONFIG_CMD,
-                                       CMD_SYNC, sizeof(cmd), &cmd);
+                                       0, sizeof(cmd), &cmd);
                 if (ret)
                         IWL_ERR(priv, "REPLY_CT_KILL_CONFIG_CMD failed\n");
                 else
@@ -673,9 +671,7 @@ static int iwlagn_send_tx_ant_config(struct iwl_priv *priv, u8 valid_tx_ant)
 
         if (IWL_UCODE_API(priv->fw->ucode_ver) > 1) {
                 IWL_DEBUG_HC(priv, "select valid tx ant: %u\n", valid_tx_ant);
-                return iwl_dvm_send_cmd_pdu(priv,
-                                        TX_ANT_CONFIGURATION_CMD,
-                                        CMD_SYNC,
+                return iwl_dvm_send_cmd_pdu(priv, TX_ANT_CONFIGURATION_CMD, 0,
                                         sizeof(struct iwl_tx_ant_config_cmd),
                                         &tx_ant_cmd);
         } else {
@@ -703,7 +699,7 @@ static void iwl_send_bt_config(struct iwl_priv *priv)
                 (bt_cmd.flags == BT_COEX_DISABLE) ? "disable" : "active");
 
         if (iwl_dvm_send_cmd_pdu(priv, REPLY_BT_CONFIG,
-                             CMD_SYNC, sizeof(struct iwl_bt_cmd), &bt_cmd))
+                             0, sizeof(struct iwl_bt_cmd), &bt_cmd))
                 IWL_ERR(priv, "failed to send BT Coex Config\n");
 }
 
@@ -987,7 +983,7 @@ static void iwl_bg_restart(struct work_struct *data)
                         ieee80211_restart_hw(priv->hw);
                 else
                         IWL_ERR(priv,
-                                "Cannot request restart before registrating with mac80211");
+                                "Cannot request restart before registrating with mac80211\n");
         } else {
                 WARN_ON(1);
         }
@@ -1127,7 +1123,6 @@ static void iwl_option_config(struct iwl_priv *priv)
 static int iwl_eeprom_init_hw_params(struct iwl_priv *priv)
 {
         struct iwl_nvm_data *data = priv->nvm_data;
-        char *debug_msg;
 
         if (data->sku_cap_11n_enable &&
             !priv->cfg->ht_params) {
@@ -1141,8 +1136,8 @@ static int iwl_eeprom_init_hw_params(struct iwl_priv *priv)
                 return -EINVAL;
         }
 
-        debug_msg = "Device SKU: 24GHz %s %s, 52GHz %s %s, 11.n %s %s\n";
-        IWL_DEBUG_INFO(priv, debug_msg,
+        IWL_DEBUG_INFO(priv,
+                       "Device SKU: 24GHz %s %s, 52GHz %s %s, 11.n %s %s\n",
                        data->sku_cap_band_24GHz_enable ? "" : "NOT", "enabled",
                        data->sku_cap_band_52GHz_enable ? "" : "NOT", "enabled",
                        data->sku_cap_11n_enable ? "" : "NOT", "enabled");
@@ -1350,7 +1345,7 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
         iwl_set_hw_params(priv);
 
         if (!(priv->nvm_data->sku_cap_ipan_enable)) {
-                IWL_DEBUG_INFO(priv, "Your EEPROM disabled PAN");
+                IWL_DEBUG_INFO(priv, "Your EEPROM disabled PAN\n");
                 ucode_flags &= ~IWL_UCODE_TLV_FLAGS_PAN;
                 /*
                  * if not PAN, then don't support P2P -- might be a uCode
@@ -2019,10 +2014,10 @@ void iwlagn_lift_passive_no_rx(struct iwl_priv *priv)
 
         for (mq = 0; mq < IWLAGN_FIRST_AMPDU_QUEUE; mq++) {
                 if (!test_bit(mq, &priv->transport_queue_stop)) {
-                        IWL_DEBUG_TX_QUEUES(priv, "Wake queue %d", mq);
+                        IWL_DEBUG_TX_QUEUES(priv, "Wake queue %d\n", mq);
                         ieee80211_wake_queue(priv->hw, mq);
                 } else {
-                        IWL_DEBUG_TX_QUEUES(priv, "Don't wake queue %d", mq);
+                        IWL_DEBUG_TX_QUEUES(priv, "Don't wake queue %d\n", mq);
                 }
         }
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/power.c b/drivers/net/wireless/iwlwifi/dvm/power.c
index b4e61417013a..f2c1439566b5 100644
--- a/drivers/net/wireless/iwlwifi/dvm/power.c
+++ b/drivers/net/wireless/iwlwifi/dvm/power.c
@@ -278,7 +278,7 @@ static int iwl_set_power(struct iwl_priv *priv, struct iwl_powertable_cmd *cmd)
                         le32_to_cpu(cmd->sleep_interval[3]),
                         le32_to_cpu(cmd->sleep_interval[4]));
 
-        return iwl_dvm_send_cmd_pdu(priv, POWER_TABLE_CMD, CMD_SYNC,
+        return iwl_dvm_send_cmd_pdu(priv, POWER_TABLE_CMD, 0,
                                 sizeof(struct iwl_powertable_cmd), cmd);
 }
 
@@ -361,7 +361,7 @@ int iwl_power_set_mode(struct iwl_priv *priv, struct iwl_powertable_cmd *cmd,
 
                 memcpy(&priv->power_data.sleep_cmd, cmd, sizeof(*cmd));
         } else
-                IWL_ERR(priv, "set power fail, ret = %d", ret);
+                IWL_ERR(priv, "set power fail, ret = %d\n", ret);
 
         return ret;
 }
diff --git a/drivers/net/wireless/iwlwifi/dvm/rs.c b/drivers/net/wireless/iwlwifi/dvm/rs.c
index aa773a2da4ab..32b78a66536d 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rs.c
@@ -1453,7 +1453,7 @@ static int rs_move_legacy_other(struct iwl_priv *priv,
                         tbl->action = IWL_LEGACY_SWITCH_SISO;
                 break;
         default:
-                IWL_ERR(priv, "Invalid BT load %d", priv->bt_traffic_load);
+                IWL_ERR(priv, "Invalid BT load %d\n", priv->bt_traffic_load);
                 break;
         }
 
@@ -1628,7 +1628,7 @@ static int rs_move_siso_to_other(struct iwl_priv *priv,
                         tbl->action = IWL_SISO_SWITCH_ANTENNA1;
                 break;
         default:
-                IWL_ERR(priv, "Invalid BT load %d", priv->bt_traffic_load);
+                IWL_ERR(priv, "Invalid BT load %d\n", priv->bt_traffic_load);
                 break;
         }
 
@@ -1799,7 +1799,7 @@ static int rs_move_mimo2_to_other(struct iwl_priv *priv,
                         tbl->action = IWL_MIMO2_SWITCH_SISO_A;
                 break;
         default:
-                IWL_ERR(priv, "Invalid BT load %d", priv->bt_traffic_load);
+                IWL_ERR(priv, "Invalid BT load %d\n", priv->bt_traffic_load);
                 break;
         }
 
@@ -1969,7 +1969,7 @@ static int rs_move_mimo3_to_other(struct iwl_priv *priv,
                         tbl->action = IWL_MIMO3_SWITCH_SISO_A;
                 break;
         default:
-                IWL_ERR(priv, "Invalid BT load %d", priv->bt_traffic_load);
+                IWL_ERR(priv, "Invalid BT load %d\n", priv->bt_traffic_load);
                 break;
         }
 
@@ -2709,7 +2709,7 @@ static void rs_initialize_lq(struct iwl_priv *priv,
         rs_set_expected_tpt_table(lq_sta, tbl);
         rs_fill_link_cmd(NULL, lq_sta, rate);
         priv->stations[lq_sta->lq.sta_id].lq = &lq_sta->lq;
-        iwl_send_lq_cmd(priv, ctx, &lq_sta->lq, CMD_SYNC, true);
+        iwl_send_lq_cmd(priv, ctx, &lq_sta->lq, 0, true);
 }
 
 static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta, void *priv_sta,
diff --git a/drivers/net/wireless/iwlwifi/dvm/rx.c b/drivers/net/wireless/iwlwifi/dvm/rx.c
index cd8377346aff..debec963c610 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rx.c
@@ -786,7 +786,7 @@ static void iwlagn_pass_packet_to_mac80211(struct iwl_priv *priv,
 
         memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));
 
-        ieee80211_rx_ni(priv->hw, skb);
+        ieee80211_rx(priv->hw, skb);
 }
 
 static u32 iwlagn_translate_rx_status(struct iwl_priv *priv, u32 decrypt_in)
diff --git a/drivers/net/wireless/iwlwifi/dvm/rxon.c b/drivers/net/wireless/iwlwifi/dvm/rxon.c
index 503a81e58185..ed50de6362ed 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rxon.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rxon.c
@@ -104,7 +104,7 @@ static int iwlagn_disable_bss(struct iwl_priv *priv,
 
         send->filter_flags &= ~RXON_FILTER_ASSOC_MSK;
         ret = iwl_dvm_send_cmd_pdu(priv, ctx->rxon_cmd,
-                                CMD_SYNC, sizeof(*send), send);
+                                0, sizeof(*send), send);
 
         send->filter_flags = old_filter;
 
@@ -134,7 +134,7 @@ static int iwlagn_disable_pan(struct iwl_priv *priv,
         send->filter_flags &= ~RXON_FILTER_ASSOC_MSK;
         send->dev_type = RXON_DEV_TYPE_P2P;
         ret = iwl_dvm_send_cmd_pdu(priv, ctx->rxon_cmd,
-                                CMD_SYNC, sizeof(*send), send);
+                                0, sizeof(*send), send);
 
         send->filter_flags = old_filter;
         send->dev_type = old_dev_type;
@@ -160,7 +160,7 @@ static int iwlagn_disconn_pan(struct iwl_priv *priv,
         int ret;
 
         send->filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-        ret = iwl_dvm_send_cmd_pdu(priv, ctx->rxon_cmd, CMD_SYNC,
+        ret = iwl_dvm_send_cmd_pdu(priv, ctx->rxon_cmd, 0,
                                 sizeof(*send), send);
 
         send->filter_flags = old_filter;
@@ -189,7 +189,7 @@ static void iwlagn_update_qos(struct iwl_priv *priv,
                       ctx->qos_data.qos_active,
                       ctx->qos_data.def_qos_parm.qos_flags);
 
-        ret = iwl_dvm_send_cmd_pdu(priv, ctx->qos_cmd, CMD_SYNC,
+        ret = iwl_dvm_send_cmd_pdu(priv, ctx->qos_cmd, 0,
                                sizeof(struct iwl_qosparam_cmd),
                                &ctx->qos_data.def_qos_parm);
         if (ret)
@@ -353,7 +353,7 @@ static int iwl_send_rxon_timing(struct iwl_priv *priv,
                         le16_to_cpu(ctx->timing.atim_window));
 
         return iwl_dvm_send_cmd_pdu(priv, ctx->rxon_timing_cmd,
-                                CMD_SYNC, sizeof(ctx->timing), &ctx->timing);
+                                0, sizeof(ctx->timing), &ctx->timing);
 }
 
 static int iwlagn_rxon_disconn(struct iwl_priv *priv,
@@ -495,7 +495,7 @@ static int iwlagn_rxon_connect(struct iwl_priv *priv,
          * Associated RXON doesn't clear the station table in uCode,
          * so we don't need to restore stations etc. after this.
          */
-        ret = iwl_dvm_send_cmd_pdu(priv, ctx->rxon_cmd, CMD_SYNC,
+        ret = iwl_dvm_send_cmd_pdu(priv, ctx->rxon_cmd, 0,
                       sizeof(struct iwl_rxon_cmd), &ctx->staging);
         if (ret) {
                 IWL_ERR(priv, "Error setting new RXON (%d)\n", ret);
@@ -610,7 +610,7 @@ int iwlagn_set_pan_params(struct iwl_priv *priv)
         cmd.slots[0].width = cpu_to_le16(slot0);
         cmd.slots[1].width = cpu_to_le16(slot1);
 
-        ret = iwl_dvm_send_cmd_pdu(priv, REPLY_WIPAN_PARAMS, CMD_SYNC,
+        ret = iwl_dvm_send_cmd_pdu(priv, REPLY_WIPAN_PARAMS, 0,
                         sizeof(cmd), &cmd);
         if (ret)
                 IWL_ERR(priv, "Error setting PAN parameters (%d)\n", ret);
@@ -823,7 +823,7 @@ static int iwl_check_rxon_cmd(struct iwl_priv *priv,
 
         if ((rxon->flags & (RXON_FLG_CCK_MSK | RXON_FLG_AUTO_DETECT_MSK))
                         == (RXON_FLG_CCK_MSK | RXON_FLG_AUTO_DETECT_MSK)) {
-                IWL_WARN(priv, "CCK and auto detect");
+                IWL_WARN(priv, "CCK and auto detect\n");
                 errors |= BIT(8);
         }
 
@@ -1395,7 +1395,7 @@ static void iwlagn_chain_noise_reset(struct iwl_priv *priv)
                         priv->phy_calib_chain_noise_reset_cmd);
                 ret = iwl_dvm_send_cmd_pdu(priv,
                                         REPLY_PHY_CALIBRATION_CMD,
-                                        CMD_SYNC, sizeof(cmd), &cmd);
+                                        0, sizeof(cmd), &cmd);
                 if (ret)
                         IWL_ERR(priv,
                                 "Could not send REPLY_PHY_CALIBRATION_CMD\n");
diff --git a/drivers/net/wireless/iwlwifi/dvm/scan.c b/drivers/net/wireless/iwlwifi/dvm/scan.c
index be98b913ed58..43bef901e8f9 100644
--- a/drivers/net/wireless/iwlwifi/dvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/dvm/scan.c
@@ -59,7 +59,7 @@ static int iwl_send_scan_abort(struct iwl_priv *priv)
         int ret;
         struct iwl_host_cmd cmd = {
                 .id = REPLY_SCAN_ABORT_CMD,
-                .flags = CMD_SYNC | CMD_WANT_SKB,
+                .flags = CMD_WANT_SKB,
         };
         __le32 *status;
 
@@ -639,7 +639,6 @@ static int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
         struct iwl_host_cmd cmd = {
                 .id = REPLY_SCAN_CMD,
                 .len = { sizeof(struct iwl_scan_cmd), },
-                .flags = CMD_SYNC,
         };
         struct iwl_scan_cmd *scan;
         struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
diff --git a/drivers/net/wireless/iwlwifi/dvm/sta.c b/drivers/net/wireless/iwlwifi/dvm/sta.c
index 9cdd91cdf661..6ec86adbe4a1 100644
--- a/drivers/net/wireless/iwlwifi/dvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/dvm/sta.c
@@ -39,7 +39,7 @@ static int iwl_sta_ucode_activate(struct iwl_priv *priv, u8 sta_id)
         lockdep_assert_held(&priv->sta_lock);
 
         if (sta_id >= IWLAGN_STATION_COUNT) {
-                IWL_ERR(priv, "invalid sta_id %u", sta_id);
+                IWL_ERR(priv, "invalid sta_id %u\n", sta_id);
                 return -EINVAL;
         }
         if (!(priv->stations[sta_id].used & IWL_STA_DRIVER_ACTIVE))
@@ -165,7 +165,7 @@ int iwl_send_add_sta(struct iwl_priv *priv,
         iwl_free_resp(&cmd);
 
         if (cmd.handler_status)
-                IWL_ERR(priv, "%s - error in the CMD response %d", __func__,
+                IWL_ERR(priv, "%s - error in the CMD response %d\n", __func__,
                         cmd.handler_status);
 
         return cmd.handler_status;
@@ -261,7 +261,7 @@ int iwl_sta_update_ht(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
         cmd.station_flags = flags;
         cmd.sta.sta_id = sta_id;
 
-        return iwl_send_add_sta(priv, &cmd, CMD_SYNC);
+        return iwl_send_add_sta(priv, &cmd, 0);
 }
 
 static void iwl_set_ht_add_station(struct iwl_priv *priv, u8 index,
@@ -413,7 +413,7 @@ int iwl_add_station_common(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
         spin_unlock_bh(&priv->sta_lock);
 
         /* Add station to device's station table */
-        ret = iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
+        ret = iwl_send_add_sta(priv, &sta_cmd, 0);
         if (ret) {
                 spin_lock_bh(&priv->sta_lock);
                 IWL_ERR(priv, "Adding station %pM failed.\n",
@@ -456,7 +456,6 @@ static int iwl_send_remove_station(struct iwl_priv *priv,
         struct iwl_host_cmd cmd = {
                 .id = REPLY_REMOVE_STA,
                 .len = { sizeof(struct iwl_rem_sta_cmd), },
-                .flags = CMD_SYNC,
                 .data = { &rm_sta_cmd, },
         };
 
@@ -740,7 +739,7 @@ void iwl_restore_stations(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
                                         send_lq = true;
                         }
                         spin_unlock_bh(&priv->sta_lock);
-                        ret = iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
+                        ret = iwl_send_add_sta(priv, &sta_cmd, 0);
                         if (ret) {
                                 spin_lock_bh(&priv->sta_lock);
                                 IWL_ERR(priv, "Adding station %pM failed.\n",
@@ -756,8 +755,7 @@ void iwl_restore_stations(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
                          * current LQ command
                          */
                         if (send_lq)
-                                iwl_send_lq_cmd(priv, ctx, &lq,
-                                                CMD_SYNC, true);
+                                iwl_send_lq_cmd(priv, ctx, &lq, 0, true);
                         spin_lock_bh(&priv->sta_lock);
                         priv->stations[i].used &= ~IWL_STA_UCODE_INPROGRESS;
                 }
@@ -968,7 +966,7 @@ int iwlagn_add_bssid_station(struct iwl_priv *priv,
                 return -ENOMEM;
         }
 
-        ret = iwl_send_lq_cmd(priv, ctx, link_cmd, CMD_SYNC, true);
+        ret = iwl_send_lq_cmd(priv, ctx, link_cmd, 0, true);
         if (ret)
                 IWL_ERR(priv, "Link quality command failed (%d)\n", ret);
 
@@ -999,7 +997,6 @@ static int iwl_send_static_wepkey_cmd(struct iwl_priv *priv,
         struct iwl_host_cmd cmd = {
                 .id = ctx->wep_key_cmd,
                 .data = { wep_cmd, },
-                .flags = CMD_SYNC,
         };
 
         might_sleep();
@@ -1248,7 +1245,7 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
         sta_cmd.sta.modify_mask = STA_MODIFY_KEY_MASK;
         sta_cmd.mode = STA_CONTROL_MODIFY_MSK;
 
-        return iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
+        return iwl_send_add_sta(priv, &sta_cmd, 0);
 }
 
 int iwl_set_dynamic_key(struct iwl_priv *priv,
@@ -1284,13 +1281,13 @@ int iwl_set_dynamic_key(struct iwl_priv *priv,
                 ieee80211_get_key_rx_seq(keyconf, 0, &seq);
                 ieee80211_get_tkip_rx_p1k(keyconf, addr, seq.tkip.iv32, p1k);
                 ret = iwlagn_send_sta_key(priv, keyconf, sta_id,
-                                          seq.tkip.iv32, p1k, CMD_SYNC);
+                                          seq.tkip.iv32, p1k, 0);
                 break;
         case WLAN_CIPHER_SUITE_CCMP:
         case WLAN_CIPHER_SUITE_WEP40:
         case WLAN_CIPHER_SUITE_WEP104:
                 ret = iwlagn_send_sta_key(priv, keyconf, sta_id,
-                                          0, NULL, CMD_SYNC);
+                                          0, NULL, 0);
                 break;
         default:
                 IWL_ERR(priv, "Unknown cipher %x\n", keyconf->cipher);
@@ -1409,7 +1406,7 @@ int iwl_sta_tx_modify_enable_tid(struct iwl_priv *priv, int sta_id, int tid)
         memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
         spin_unlock_bh(&priv->sta_lock);
 
-        return iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
+        return iwl_send_add_sta(priv, &sta_cmd, 0);
 }
 
 int iwl_sta_rx_agg_start(struct iwl_priv *priv, struct ieee80211_sta *sta,
@@ -1433,7 +1430,7 @@ int iwl_sta_rx_agg_start(struct iwl_priv *priv, struct ieee80211_sta *sta,
         memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
         spin_unlock_bh(&priv->sta_lock);
 
-        return iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
+        return iwl_send_add_sta(priv, &sta_cmd, 0);
 }
 
 int iwl_sta_rx_agg_stop(struct iwl_priv *priv, struct ieee80211_sta *sta,
@@ -1458,7 +1455,7 @@ int iwl_sta_rx_agg_stop(struct iwl_priv *priv, struct ieee80211_sta *sta,
         memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
         spin_unlock_bh(&priv->sta_lock);
 
-        return iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
+        return iwl_send_add_sta(priv, &sta_cmd, 0);
 }
 
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/tt.c b/drivers/net/wireless/iwlwifi/dvm/tt.c
index 058c5892c427..acb981a0a0aa 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tt.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tt.c
@@ -236,7 +236,7 @@ static void iwl_prepare_ct_kill_task(struct iwl_priv *priv)
 {
         IWL_DEBUG_TEMP(priv, "Prepare to enter IWL_TI_CT_KILL\n");
         /* make request to retrieve statistics information */
-        iwl_send_statistics_request(priv, CMD_SYNC, false);
+        iwl_send_statistics_request(priv, 0, false);
         /* Reschedule the ct_kill wait timer */
         mod_timer(&priv->thermal_throttle.ct_kill_waiting_tm,
                  jiffies + msecs_to_jiffies(CT_KILL_WAITING_DURATION));
diff --git a/drivers/net/wireless/iwlwifi/dvm/tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c
index 398dd096674c..3255a1723d17 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
@@ -402,10 +402,10 @@ int iwlagn_tx_skb(struct iwl_priv *priv,
                 /* aggregation is on for this <sta,tid> */
                 if (info->flags & IEEE80211_TX_CTL_AMPDU &&
                     tid_data->agg.state != IWL_AGG_ON) {
-                        IWL_ERR(priv, "TX_CTL_AMPDU while not in AGG:"
-                                " Tx flags = 0x%08x, agg.state = %d",
+                        IWL_ERR(priv,
+                                "TX_CTL_AMPDU while not in AGG: Tx flags = 0x%08x, agg.state = %d\n",
                                 info->flags, tid_data->agg.state);
-                        IWL_ERR(priv, "sta_id = %d, tid = %d seq_num = %d",
+                        IWL_ERR(priv, "sta_id = %d, tid = %d seq_num = %d\n",
                                 sta_id, tid,
                                 IEEE80211_SEQ_TO_SN(tid_data->seq_number));
                         goto drop_unlock_sta;
@@ -416,7 +416,7 @@ int iwlagn_tx_skb(struct iwl_priv *priv,
                  */
                 if (WARN_ONCE(tid_data->agg.state != IWL_AGG_ON &&
                               tid_data->agg.state != IWL_AGG_OFF,
-                    "Tx while agg.state = %d", tid_data->agg.state))
+                              "Tx while agg.state = %d\n", tid_data->agg.state))
                         goto drop_unlock_sta;
 
                 seq_number = tid_data->seq_number;
@@ -778,8 +778,8 @@ static void iwlagn_check_ratid_empty(struct iwl_priv *priv, int sta_id, u8 tid)
                 /* There are no packets for this RA / TID in the HW any more */
                 if (tid_data->agg.ssn == tid_data->next_reclaimed) {
                         IWL_DEBUG_TX_QUEUES(priv,
-                                "Can continue DELBA flow ssn = next_recl ="
-                                " %d", tid_data->next_reclaimed);
+                                "Can continue DELBA flow ssn = next_recl = %d\n",
+                                tid_data->next_reclaimed);
                         iwl_trans_txq_disable(priv->trans,
                                               tid_data->agg.txq_id);
                         iwlagn_dealloc_agg_txq(priv, tid_data->agg.txq_id);
@@ -791,8 +791,8 @@ static void iwlagn_check_ratid_empty(struct iwl_priv *priv, int sta_id, u8 tid)
                 /* There are no packets for this RA / TID in the HW any more */
                 if (tid_data->agg.ssn == tid_data->next_reclaimed) {
                         IWL_DEBUG_TX_QUEUES(priv,
-                                "Can continue ADDBA flow ssn = next_recl ="
-                                " %d", tid_data->next_reclaimed);
+                                "Can continue ADDBA flow ssn = next_recl = %d\n",
+                                tid_data->next_reclaimed);
                         tid_data->agg.state = IWL_AGG_STARTING;
                         ieee80211_start_tx_ba_cb_irqsafe(vif, addr, tid);
                 }
@@ -1216,8 +1216,8 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
                             ctx->vif->type == NL80211_IFTYPE_STATION) {
                                 /* block and stop all queues */
                                 priv->passive_no_rx = true;
-                                IWL_DEBUG_TX_QUEUES(priv, "stop all queues: "
-                                                    "passive channel");
+                                IWL_DEBUG_TX_QUEUES(priv,
+                                        "stop all queues: passive channel\n");
                                 ieee80211_stop_queues(priv->hw);
 
                                 IWL_DEBUG_TX_REPLY(priv,
@@ -1271,7 +1271,7 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
 
         while (!skb_queue_empty(&skbs)) {
                 skb = __skb_dequeue(&skbs);
-                ieee80211_tx_status_ni(priv->hw, skb);
+                ieee80211_tx_status(priv->hw, skb);
         }
 
         return 0;
@@ -1411,7 +1411,7 @@ int iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
 
         while (!skb_queue_empty(&reclaimed_skbs)) {
                 skb = __skb_dequeue(&reclaimed_skbs);
-                ieee80211_tx_status_ni(priv->hw, skb);
+                ieee80211_tx_status(priv->hw, skb);
         }
 
         return 0;
diff --git a/drivers/net/wireless/iwlwifi/dvm/ucode.c b/drivers/net/wireless/iwlwifi/dvm/ucode.c
index cf03ef5619d9..d5cee1530597 100644
--- a/drivers/net/wireless/iwlwifi/dvm/ucode.c
+++ b/drivers/net/wireless/iwlwifi/dvm/ucode.c
@@ -172,7 +172,7 @@ static int iwl_send_wimax_coex(struct iwl_priv *priv)
         memset(&coex_cmd, 0, sizeof(coex_cmd));
 
         return iwl_dvm_send_cmd_pdu(priv,
-                                COEX_PRIORITY_TABLE_CMD, CMD_SYNC,
+                                COEX_PRIORITY_TABLE_CMD, 0,
                                 sizeof(coex_cmd), &coex_cmd);
 }
 
@@ -205,7 +205,7 @@ void iwl_send_prio_tbl(struct iwl_priv *priv)
         memcpy(prio_tbl_cmd.prio_tbl, iwl_bt_prio_tbl,
                 sizeof(iwl_bt_prio_tbl));
         if (iwl_dvm_send_cmd_pdu(priv,
-                                REPLY_BT_COEX_PRIO_TABLE, CMD_SYNC,
+                                REPLY_BT_COEX_PRIO_TABLE, 0,
                                 sizeof(prio_tbl_cmd), &prio_tbl_cmd))
                 IWL_ERR(priv, "failed to send BT prio tbl command\n");
 }
@@ -218,7 +218,7 @@ int iwl_send_bt_env(struct iwl_priv *priv, u8 action, u8 type)
         env_cmd.action = action;
         env_cmd.type = type;
         ret = iwl_dvm_send_cmd_pdu(priv,
-                               REPLY_BT_COEX_PROT_ENV, CMD_SYNC,
+                               REPLY_BT_COEX_PROT_ENV, 0,
                                sizeof(env_cmd), &env_cmd);
         if (ret)
                 IWL_ERR(priv, "failed to send BT env command\n");
diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c
index f73de239cdc1..48730064da73 100644
--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
@@ -98,7 +98,7 @@
 #define NVM_HW_SECTION_NUM_FAMILY_7000          0
 
 static const struct iwl_base_params iwl7000_base_params = {
-        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .eeprom_size = OTP_LOW_IMAGE_SIZE_FAMILY_7000,
         .num_of_queues = IWLAGN_NUM_QUEUES,
         .pll_cfg_val = 0,
         .shadow_ram_support = true,
diff --git a/drivers/net/wireless/iwlwifi/iwl-8000.c b/drivers/net/wireless/iwlwifi/iwl-8000.c
index f5bd82b88592..51c41531d81d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-8000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-8000.c
@@ -83,9 +83,10 @@
 #define IWL8000_MODULE_FIRMWARE(api) IWL8000_FW_PRE __stringify(api) ".ucode"
 
 #define NVM_HW_SECTION_NUM_FAMILY_8000          10
+#define DEFAULT_NVM_FILE_FAMILY_8000            "iwl_nvm_8000.bin"
 
 static const struct iwl_base_params iwl8000_base_params = {
-        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .eeprom_size = OTP_LOW_IMAGE_SIZE_FAMILY_8000,
         .num_of_queues = IWLAGN_NUM_QUEUES,
         .pll_cfg_val = 0,
         .shadow_ram_support = true,
@@ -118,6 +119,7 @@ const struct iwl_cfg iwl8260_2ac_cfg = {
         .ht_params = &iwl8000_ht_params,
         .nvm_ver = IWL8000_NVM_VERSION,
         .nvm_calib_ver = IWL8000_TX_POWER_VERSION,
+        .default_nvm_file = DEFAULT_NVM_FILE_FAMILY_8000,
 };
 
 const struct iwl_cfg iwl8260_n_cfg = {
@@ -127,6 +129,7 @@ const struct iwl_cfg iwl8260_n_cfg = {
         .ht_params = &iwl8000_ht_params,
         .nvm_ver = IWL8000_NVM_VERSION,
         .nvm_calib_ver = IWL8000_TX_POWER_VERSION,
+        .default_nvm_file = DEFAULT_NVM_FILE_FAMILY_8000,
 };
 
 MODULE_FIRMWARE(IWL8000_MODULE_FIRMWARE(IWL8000_UCODE_API_OK));
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-hw.h b/drivers/net/wireless/iwlwifi/iwl-agn-hw.h
index 7f37fb86837b..04a483d38659 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-hw.h
@@ -102,9 +102,7 @@
 
 /* EEPROM */
 #define IWLAGN_EEPROM_IMG_SIZE          2048
-/* OTP */
-/* lower blocks contain EEPROM image and calibration data */
-#define OTP_LOW_IMAGE_SIZE              (2 * 512 * sizeof(u16)) /* 2 KB */
+
 /* high blocks contain PAPD data */
 #define OTP_HIGH_IMAGE_SIZE_6x00        (6 * 512 * sizeof(u16)) /* 6 KB */
 #define OTP_HIGH_IMAGE_SIZE_1000        (0x200 * sizeof(u16)) /* 1024 bytes */
diff --git a/drivers/net/wireless/iwlwifi/iwl-config.h b/drivers/net/wireless/iwlwifi/iwl-config.h
index 7ce82d9c7222..b7047905f41a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/iwlwifi/iwl-config.h
@@ -193,6 +193,11 @@ struct iwl_ht_params {
 #define EEPROM_6000_REG_BAND_24_HT40_CHANNELS   0x80
 #define EEPROM_REGULATORY_BAND_NO_HT40          0
 
+/* lower blocks contain EEPROM image and calibration data */
+#define OTP_LOW_IMAGE_SIZE              (2 * 512 * sizeof(u16)) /* 2 KB */
+#define OTP_LOW_IMAGE_SIZE_FAMILY_7000  (16 * 512 * sizeof(u16)) /* 16 KB */
+#define OTP_LOW_IMAGE_SIZE_FAMILY_8000  (32 * 512 * sizeof(u16)) /* 32 KB */
+
 struct iwl_eeprom_params {
         const u8 regulatory_bands[7];
         bool enhanced_txpower;
@@ -269,6 +274,8 @@ struct iwl_cfg {
         u8   nvm_hw_section_num;
         bool lp_xtal_workaround;
         const struct iwl_pwr_tx_backoff *pwr_tx_backoffs;
+        bool no_power_up_nic_in_init;
+        const char *default_nvm_file;
 };
 
 /*
diff --git a/drivers/net/wireless/iwlwifi/iwl-debug.c b/drivers/net/wireless/iwlwifi/iwl-debug.c
index 8a44f594528d..09feff4fa226 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debug.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debug.c
@@ -61,8 +61,6 @@
  *
  *****************************************************************************/
 
-#define DEBUG
-
 #include <linux/device.h>
 #include <linux/interrupt.h>
 #include <linux/export.h>
@@ -128,8 +126,8 @@ void __iwl_dbg(struct device *dev,
 #ifdef CONFIG_IWLWIFI_DEBUG
         if (iwl_have_debug_level(level) &&
             (!limit || net_ratelimit()))
-                dev_dbg(dev, "%c %s %pV", in_interrupt() ? 'I' : 'U',
-                        function, &vaf);
+                dev_printk(KERN_DEBUG, dev, "%c %s %pV",
+                           in_interrupt() ? 'I' : 'U', function, &vaf);
 #endif
         trace_iwlwifi_dbg(level, in_interrupt(), function, &vaf);
         va_end(args);
diff --git a/drivers/net/wireless/iwlwifi/iwl-debug.h b/drivers/net/wireless/iwlwifi/iwl-debug.h
index c8cbdbe15924..295083510e72 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debug.h
+++ b/drivers/net/wireless/iwlwifi/iwl-debug.h
@@ -47,12 +47,32 @@ void __iwl_warn(struct device *dev, const char *fmt, ...) __printf(2, 3);
 void __iwl_info(struct device *dev, const char *fmt, ...) __printf(2, 3);
 void __iwl_crit(struct device *dev, const char *fmt, ...) __printf(2, 3);
 
+/* not all compilers can evaluate strlen() at compile time, so use sizeof() */
+#define CHECK_FOR_NEWLINE(f) BUILD_BUG_ON(f[sizeof(f) - 2] != '\n')
+
 /* No matter what is m (priv, bus, trans), this will work */
-#define IWL_ERR(m, f, a...) __iwl_err((m)->dev, false, false, f, ## a)
-#define IWL_ERR_DEV(d, f, a...) __iwl_err((d), false, false, f, ## a)
-#define IWL_WARN(m, f, a...) __iwl_warn((m)->dev, f, ## a)
-#define IWL_INFO(m, f, a...) __iwl_info((m)->dev, f, ## a)
-#define IWL_CRIT(m, f, a...) __iwl_crit((m)->dev, f, ## a)
+#define IWL_ERR_DEV(d, f, a...)                                         \
+        do {                                                            \
+                CHECK_FOR_NEWLINE(f);                                   \
+                __iwl_err((d), false, false, f, ## a);                  \
+        } while (0)
+#define IWL_ERR(m, f, a...)                                             \
+        IWL_ERR_DEV((m)->dev, f, ## a)
+#define IWL_WARN(m, f, a...)                                            \
+        do {                                                            \
+                CHECK_FOR_NEWLINE(f);                                   \
+                __iwl_warn((m)->dev, f, ## a);                          \
+        } while (0)
+#define IWL_INFO(m, f, a...)                                            \
+        do {                                                            \
+                CHECK_FOR_NEWLINE(f);                                   \
+                __iwl_info((m)->dev, f, ## a);                          \
+        } while (0)
+#define IWL_CRIT(m, f, a...)                                            \
+        do {                                                            \
+                CHECK_FOR_NEWLINE(f);                                   \
+                __iwl_crit((m)->dev, f, ## a);                          \
+        } while (0)
 
 #if defined(CONFIG_IWLWIFI_DEBUG) || defined(CONFIG_IWLWIFI_DEVICE_TRACING)
 void __iwl_dbg(struct device *dev,
@@ -72,12 +92,17 @@ do {									\
                        DUMP_PREFIX_OFFSET, 16, 1, p, len, 1);           \
 } while (0)
 
+#define __IWL_DEBUG_DEV(dev, level, limit, fmt, args...)                \
+        do {                                                            \
+                CHECK_FOR_NEWLINE(fmt);                                 \
+                __iwl_dbg(dev, level, limit, __func__, fmt, ##args);    \
+        } while (0)
 #define IWL_DEBUG(m, level, fmt, args...)                               \
-        __iwl_dbg((m)->dev, level, false, __func__, fmt, ##args)
+        __IWL_DEBUG_DEV((m)->dev, level, false, fmt, ##args)
 #define IWL_DEBUG_DEV(dev, level, fmt, args...)                         \
-        __iwl_dbg((dev), level, false, __func__, fmt, ##args)
+        __IWL_DEBUG_DEV(dev, level, false, fmt, ##args)
 #define IWL_DEBUG_LIMIT(m, level, fmt, args...)                         \
-        __iwl_dbg((m)->dev, level, true, __func__, fmt, ##args)
+        __IWL_DEBUG_DEV((m)->dev, level, true, fmt, ##args)
 
 #ifdef CONFIG_IWLWIFI_DEBUG
 #define iwl_print_hex_dump(m, level, p, len)                            \
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.c b/drivers/net/wireless/iwlwifi/iwl-drv.c
index 0a3e841b44a9..f2a5c12269a3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.c
@@ -1243,6 +1243,7 @@ struct iwl_mod_params iwlwifi_mod_params = {
         .bt_coex_active = true,
         .power_level = IWL_POWER_INDEX_1,
         .wd_disable = true,
+        .uapsd_disable = false,
         /* the rest are 0 by default */
 };
 IWL_EXPORT_SYMBOL(iwlwifi_mod_params);
@@ -1356,6 +1357,10 @@ MODULE_PARM_DESC(wd_disable,
 module_param_named(nvm_file, iwlwifi_mod_params.nvm_file, charp, S_IRUGO);
 MODULE_PARM_DESC(nvm_file, "NVM file name");
 
+module_param_named(uapsd_disable, iwlwifi_mod_params.uapsd_disable,
+                   bool, S_IRUGO);
+MODULE_PARM_DESC(uapsd_disable, "disable U-APSD functionality (default: N)");
+
 /*
  * set bt_coex_active to true, uCode will do kill/defer
  * every time the priority line is asserted (BT is sending signals on the
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-error-dump.h b/drivers/net/wireless/iwlwifi/iwl-fw-error-dump.h
index f381908be7e5..2953ffceda38 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-error-dump.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw-error-dump.h
@@ -72,11 +72,14 @@
  * @IWL_FW_ERROR_DUMP_SRAM:
  * @IWL_FW_ERROR_DUMP_REG:
  * @IWL_FW_ERROR_DUMP_RXF:
+ * @IWL_FW_ERROR_DUMP_TXCMD: last TX command data, structured as
+ *      &struct iwl_fw_error_dump_txcmd packets
  */
 enum iwl_fw_error_dump_type {
         IWL_FW_ERROR_DUMP_SRAM = 0,
         IWL_FW_ERROR_DUMP_REG = 1,
         IWL_FW_ERROR_DUMP_RXF = 2,
+        IWL_FW_ERROR_DUMP_TXCMD = 3,
 
         IWL_FW_ERROR_DUMP_MAX,
 };
@@ -105,4 +108,27 @@ struct iwl_fw_error_dump_file {
         u8 data[0];
 } __packed;
 
+/**
+ * struct iwl_fw_error_dump_txcmd - TX command data
+ * @cmdlen: original length of command
+ * @caplen: captured length of command (may be less)
+ * @data: captured command data, @caplen bytes
+ */
+struct iwl_fw_error_dump_txcmd {
+        __le32 cmdlen;
+        __le32 caplen;
+        u8 data[];
+} __packed;
+
+/**
+ * iwl_mvm_fw_error_next_data - advance fw error dump data pointer
+ * @data: previous data block
+ * Returns: next data block
+ */
+static inline struct iwl_fw_error_dump_data *
+iwl_mvm_fw_error_next_data(struct iwl_fw_error_dump_data *data)
+{
+        return (void *)(data->data + le32_to_cpu(data->len));
+}
+
 #endif /* __fw_error_dump_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw.h b/drivers/net/wireless/iwlwifi/iwl-fw.h
index f5927d0cf9b6..0aa7c0085c9f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw.h
@@ -74,7 +74,7 @@
  * @IWL_UCODE_TLV_FLAGS_MFP: This uCode image supports MFP (802.11w).
  * @IWL_UCODE_TLV_FLAGS_P2P: This uCode image supports P2P.
  * @IWL_UCODE_TLV_FLAGS_DW_BC_TABLE: The SCD byte count table is in DWORDS
- * @IWL_UCODE_TLV_FLAGS_UAPSD: This uCode image supports uAPSD
+ * @IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT: This uCode image supports uAPSD
  * @IWL_UCODE_TLV_FLAGS_SHORT_BL: 16 entries of black list instead of 64 in scan
  *      offload profile config command.
  * @IWL_UCODE_TLV_FLAGS_D3_6_IPV6_ADDRS: D3 image supports up to six
@@ -107,6 +107,7 @@ enum iwl_ucode_tlv_flag {
         IWL_UCODE_TLV_FLAGS_P2P_PM              = BIT(21),
         IWL_UCODE_TLV_FLAGS_BSS_P2P_PS_DCM      = BIT(22),
         IWL_UCODE_TLV_FLAGS_BSS_P2P_PS_SCM      = BIT(23),
+        IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT       = BIT(24),
         IWL_UCODE_TLV_FLAGS_EBS_SUPPORT         = BIT(25),
         IWL_UCODE_TLV_FLAGS_P2P_PS_UAPSD        = BIT(26),
         IWL_UCODE_TLV_FLAGS_BCAST_FILTERING     = BIT(29),
@@ -116,9 +117,11 @@ enum iwl_ucode_tlv_flag {
 /**
  * enum iwl_ucode_tlv_api - ucode api
  * @IWL_UCODE_TLV_API_WOWLAN_CONFIG_TID: wowlan config includes tid field.
+ * @IWL_UCODE_TLV_API_CSA_FLOW: ucode can do unbind-bind flow for CSA.
  */
 enum iwl_ucode_tlv_api {
         IWL_UCODE_TLV_API_WOWLAN_CONFIG_TID     = BIT(0),
+        IWL_UCODE_TLV_API_CSA_FLOW              = BIT(4),
 };
 
 /**
@@ -194,6 +197,11 @@ struct fw_img {
         bool is_dual_cpus;
 };
 
+struct iwl_sf_region {
+        u32 addr;
+        u32 size;
+};
+
 /* uCode version contains 4 values: Major/Minor/API/Serial */
 #define IWL_UCODE_MAJOR(ver)    (((ver) & 0xFF000000) >> 24)
 #define IWL_UCODE_MINOR(ver)    (((ver) & 0x00FF0000) >> 16)
diff --git a/drivers/net/wireless/iwlwifi/iwl-io.c b/drivers/net/wireless/iwlwifi/iwl-io.c
index 44cc3cf45762..5eef4ae7333b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-io.c
+++ b/drivers/net/wireless/iwlwifi/iwl-io.c
@@ -33,6 +33,7 @@
 #include "iwl-io.h"
 #include "iwl-csr.h"
 #include "iwl-debug.h"
+#include "iwl-prph.h"
 #include "iwl-fh.h"
 
 #define IWL_POLL_INTERVAL 10    /* microseconds */
@@ -183,6 +184,23 @@ void iwl_clear_bits_prph(struct iwl_trans *trans, u32 ofs, u32 mask)
 }
 IWL_EXPORT_SYMBOL(iwl_clear_bits_prph);
 
+void iwl_force_nmi(struct iwl_trans *trans)
+{
+        /*
+         * In HW previous to the 8000 HW family, and in the 8000 HW family
+         * itself when the revision step==0, the DEVICE_SET_NMI_REG is used
+         * to force an NMI. Otherwise, a different register -
+         * DEVICE_SET_NMI_8000B_REG - is used.
+         */
+        if ((trans->cfg->device_family != IWL_DEVICE_FAMILY_8000) ||
+            ((trans->hw_rev & 0xc) == 0x0))
+                iwl_write_prph(trans, DEVICE_SET_NMI_REG, DEVICE_SET_NMI_VAL);
+        else
+                iwl_write_prph(trans, DEVICE_SET_NMI_8000B_REG,
+                               DEVICE_SET_NMI_8000B_VAL);
+}
+IWL_EXPORT_SYMBOL(iwl_force_nmi);
+
 static const char *get_fh_string(int cmd)
 {
 #define IWL_CMD(x) case x: return #x
diff --git a/drivers/net/wireless/iwlwifi/iwl-io.h b/drivers/net/wireless/iwlwifi/iwl-io.h
index 665ddd9dbbc4..705d12c079e8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-io.h
+++ b/drivers/net/wireless/iwlwifi/iwl-io.h
@@ -80,6 +80,7 @@ void iwl_set_bits_prph(struct iwl_trans *trans, u32 ofs, u32 mask);
 void iwl_set_bits_mask_prph(struct iwl_trans *trans, u32 ofs,
                             u32 bits, u32 mask);
 void iwl_clear_bits_prph(struct iwl_trans *trans, u32 ofs, u32 mask);
+void iwl_force_nmi(struct iwl_trans *trans);
 
 /* Error handling */
 int iwl_dump_fh(struct iwl_trans *trans, char **buf);
diff --git a/drivers/net/wireless/iwlwifi/iwl-modparams.h b/drivers/net/wireless/iwlwifi/iwl-modparams.h
index d994317db85b..d051857729ab 100644
--- a/drivers/net/wireless/iwlwifi/iwl-modparams.h
+++ b/drivers/net/wireless/iwlwifi/iwl-modparams.h
@@ -119,6 +119,7 @@ struct iwl_mod_params {
 #endif
         int ant_coupling;
         char *nvm_file;
+        bool uapsd_disable;
 };
 
 #endif /* #__iwl_modparams_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
index 4049c0d626ba..85eee79c495c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
@@ -62,6 +62,7 @@
 #include <linux/types.h>
 #include <linux/slab.h>
 #include <linux/export.h>
+#include <linux/etherdevice.h>
 #include "iwl-drv.h"
 #include "iwl-modparams.h"
 #include "iwl-nvm-parse.h"
@@ -127,7 +128,7 @@ static const u8 iwl_nvm_channels[] = {
 
 static const u8 iwl_nvm_channels_family_8000[] = {
         /* 2.4 GHz */
-        1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13,
+        1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
         /* 5 GHz */
         36, 40, 44, 48, 52, 56, 60, 64, 68, 72, 76, 80, 84, 88, 92,
         96, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
@@ -137,7 +138,7 @@ static const u8 iwl_nvm_channels_family_8000[] = {
 #define IWL_NUM_CHANNELS                ARRAY_SIZE(iwl_nvm_channels)
 #define IWL_NUM_CHANNELS_FAMILY_8000    ARRAY_SIZE(iwl_nvm_channels_family_8000)
 #define NUM_2GHZ_CHANNELS               14
-#define NUM_2GHZ_CHANNELS_FAMILY_8000   13
+#define NUM_2GHZ_CHANNELS_FAMILY_8000   14
 #define FIRST_2GHZ_HT_MINUS             5
 #define LAST_2GHZ_HT_PLUS               9
 #define LAST_5GHZ_HT                    161
@@ -450,13 +451,7 @@ static void iwl_set_hw_address(const struct iwl_cfg *cfg,
                                struct iwl_nvm_data *data,
                                const __le16 *nvm_sec)
 {
-        u8 hw_addr[ETH_ALEN];
-
-        if (cfg->device_family != IWL_DEVICE_FAMILY_8000)
-                memcpy(hw_addr, nvm_sec + HW_ADDR, ETH_ALEN);
-        else
-                memcpy(hw_addr, nvm_sec + MAC_ADDRESS_OVERRIDE_FAMILY_8000,
-                       ETH_ALEN);
+        const u8 *hw_addr = (const u8 *)(nvm_sec + HW_ADDR);
 
         /* The byte order is little endian 16 bit, meaning 214365 */
         data->hw_addr[0] = hw_addr[1];
@@ -467,6 +462,41 @@ static void iwl_set_hw_address(const struct iwl_cfg *cfg,
         data->hw_addr[5] = hw_addr[4];
 }
 
+static void iwl_set_hw_address_family_8000(const struct iwl_cfg *cfg,
+                                           struct iwl_nvm_data *data,
+                                           const __le16 *mac_override,
+                                           const __le16 *nvm_hw)
+{
+        const u8 *hw_addr;
+
+        if (mac_override) {
+                hw_addr = (const u8 *)(mac_override +
+                                 MAC_ADDRESS_OVERRIDE_FAMILY_8000);
+
+                /* The byte order is little endian 16 bit, meaning 214365 */
+                data->hw_addr[0] = hw_addr[1];
+                data->hw_addr[1] = hw_addr[0];
+                data->hw_addr[2] = hw_addr[3];
+                data->hw_addr[3] = hw_addr[2];
+                data->hw_addr[4] = hw_addr[5];
+                data->hw_addr[5] = hw_addr[4];
+
+                if (is_valid_ether_addr(hw_addr))
+                        return;
+        }
+
+        /* take the MAC address from the OTP */
+        hw_addr = (const u8 *)(nvm_hw + HW_ADDR0_FAMILY_8000);
+        data->hw_addr[0] = hw_addr[3];
+        data->hw_addr[1] = hw_addr[2];
+        data->hw_addr[2] = hw_addr[1];
+        data->hw_addr[3] = hw_addr[0];
+
+        hw_addr = (const u8 *)(nvm_hw + HW_ADDR1_FAMILY_8000);
+        data->hw_addr[4] = hw_addr[1];
+        data->hw_addr[5] = hw_addr[0];
+}
+
 struct iwl_nvm_data *
 iwl_parse_nvm_data(struct device *dev, const struct iwl_cfg *cfg,
                    const __le16 *nvm_hw, const __le16 *nvm_sw,
@@ -526,7 +556,7 @@ iwl_parse_nvm_data(struct device *dev, const struct iwl_cfg *cfg,
                                 rx_chains);
         } else {
                 /* MAC address in family 8000 */
-                iwl_set_hw_address(cfg, data, mac_override);
+                iwl_set_hw_address_family_8000(cfg, data, mac_override, nvm_hw);
 
                 iwl_init_sbands(dev, cfg, data, regulatory,
                                 sku & NVM_SKU_CAP_11AC_ENABLE, tx_chains,
diff --git a/drivers/net/wireless/iwlwifi/iwl-phy-db.c b/drivers/net/wireless/iwlwifi/iwl-phy-db.c
index b761ac4822a3..d4fb5cad07ea 100644
--- a/drivers/net/wireless/iwlwifi/iwl-phy-db.c
+++ b/drivers/net/wireless/iwlwifi/iwl-phy-db.c
@@ -345,7 +345,6 @@ static int iwl_send_phy_db_cmd(struct iwl_phy_db *phy_db, u16 type,
         struct iwl_phy_db_cmd phy_db_cmd;
         struct iwl_host_cmd cmd = {
                 .id = PHY_DB_CMD,
-                .flags = CMD_SYNC,
         };
 
         IWL_DEBUG_INFO(phy_db->trans,
@@ -393,13 +392,13 @@ static int iwl_phy_db_send_all_channel_groups(
                                           entry->data);
                 if (err) {
                         IWL_ERR(phy_db->trans,
-                                "Can't SEND phy_db section %d (%d), err %d",
+                                "Can't SEND phy_db section %d (%d), err %d\n",
                                 type, i, err);
                         return err;
                 }
 
                 IWL_DEBUG_INFO(phy_db->trans,
-                               "Sent PHY_DB HCMD, type = %d num = %d",
+                               "Sent PHY_DB HCMD, type = %d num = %d\n",
                                type, i);
         }
 
@@ -451,7 +450,7 @@ int iwl_send_phy_db_data(struct iwl_phy_db *phy_db)
                                                  IWL_NUM_PAPD_CH_GROUPS);
         if (err) {
                 IWL_ERR(phy_db->trans,
-                        "Cannot send channel specific PAPD groups");
+                        "Cannot send channel specific PAPD groups\n");
                 return err;
         }
 
@@ -461,7 +460,7 @@ int iwl_send_phy_db_data(struct iwl_phy_db *phy_db)
                                                  IWL_NUM_TXP_CH_GROUPS);
         if (err) {
                 IWL_ERR(phy_db->trans,
-                        "Cannot send channel specific TX power groups");
+                        "Cannot send channel specific TX power groups\n");
                 return err;
         }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
index 779311080a9e..4997e27672b3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
@@ -105,6 +105,9 @@
 
 /* Device NMI register */
 #define DEVICE_SET_NMI_REG 0x00a01c30
+#define DEVICE_SET_NMI_VAL 0x1
+#define DEVICE_SET_NMI_8000B_REG 0x00a01c24
+#define DEVICE_SET_NMI_8000B_VAL 0x1000000
 
 /* Shared registers (0x0..0x3ff, via target indirect or periphery */
 #define SHR_BASE        0x00a10000
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.h b/drivers/net/wireless/iwlwifi/iwl-trans.h
index 22fd94ec8048..34d49e171fb4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans.h
@@ -189,10 +189,9 @@ static inline u32 iwl_rx_packet_payload_len(const struct iwl_rx_packet *pkt)
 /**
  * enum CMD_MODE - how to send the host commands ?
  *
- * @CMD_SYNC: The caller will be stalled until the fw responds to the command
  * @CMD_ASYNC: Return right away and don't wait for the response
- * @CMD_WANT_SKB: valid only with CMD_SYNC. The caller needs the buffer of the
- *      response. The caller needs to call iwl_free_resp when done.
+ * @CMD_WANT_SKB: Not valid with CMD_ASYNC. The caller needs the buffer of
+ *      the response. The caller needs to call iwl_free_resp when done.
  * @CMD_HIGH_PRIO: The command is high priority - it goes to the front of the
  *      command queue, but after other high priority commands. valid only
  *      with CMD_ASYNC.
@@ -202,7 +201,6 @@ static inline u32 iwl_rx_packet_payload_len(const struct iwl_rx_packet *pkt)
  *      (i.e. mark it as non-idle).
  */
 enum CMD_MODE {
-        CMD_SYNC                = 0,
         CMD_ASYNC               = BIT(0),
         CMD_WANT_SKB            = BIT(1),
         CMD_SEND_IN_RFKILL      = BIT(2),
@@ -427,7 +425,7 @@ struct iwl_trans;
  * @send_cmd:send a host command. Must return -ERFKILL if RFkill is asserted.
  *      If RFkill is asserted in the middle of a SYNC host command, it must
  *      return -ERFKILL straight away.
- *      May sleep only if CMD_SYNC is set
+ *      May sleep only if CMD_ASYNC is not set
  * @tx: send an skb
  *      Must be atomic
  * @reclaim: free packet until ssn. Returns a list of freed packets.
@@ -463,6 +461,11 @@ struct iwl_trans;
  * @unref: release a reference previously taken with @ref. Note that
  *      initially the reference count is 1, making an initial @unref
  *      necessary to allow low power states.
+ * @dump_data: fill a data dump with debug data, maybe containing last
+ *      TX'ed commands and similar. When called with a NULL buffer and
+ *      zero buffer length, provide only the (estimated) required buffer
+ *      length. Return the used buffer length.
+ *      Note that the transport must fill in the proper file headers.
  */
 struct iwl_trans_ops {
 
@@ -470,6 +473,8 @@ struct iwl_trans_ops {
         void (*op_mode_leave)(struct iwl_trans *iwl_trans);
         int (*start_fw)(struct iwl_trans *trans, const struct fw_img *fw,
                         bool run_in_rfkill);
+        int (*update_sf)(struct iwl_trans *trans,
+                         struct iwl_sf_region *st_fwrd_space);
         void (*fw_alive)(struct iwl_trans *trans, u32 scd_addr);
         void (*stop_device)(struct iwl_trans *trans);
 
@@ -511,6 +516,10 @@ struct iwl_trans_ops {
                               u32 value);
         void (*ref)(struct iwl_trans *trans);
         void (*unref)(struct iwl_trans *trans);
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        u32 (*dump_data)(struct iwl_trans *trans, void *buf, u32 buflen);
+#endif
 };
 
 /**
@@ -629,6 +638,17 @@ static inline int iwl_trans_start_fw(struct iwl_trans *trans,
         return trans->ops->start_fw(trans, fw, run_in_rfkill);
 }
 
+static inline int iwl_trans_update_sf(struct iwl_trans *trans,
+                                      struct iwl_sf_region *st_fwrd_space)
+{
+        might_sleep();
+
+        if (trans->ops->update_sf)
+                return trans->ops->update_sf(trans, st_fwrd_space);
+
+        return 0;
+}
+
 static inline void iwl_trans_stop_device(struct iwl_trans *trans)
 {
         might_sleep();
@@ -664,6 +684,16 @@ static inline void iwl_trans_unref(struct iwl_trans *trans)
                 trans->ops->unref(trans);
 }
 
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+static inline u32 iwl_trans_dump_data(struct iwl_trans *trans,
+                                      void *buf, u32 buflen)
+{
+        if (!trans->ops->dump_data)
+                return 0;
+        return trans->ops->dump_data(trans, buf, buflen);
+}
+#endif
+
 static inline int iwl_trans_send_cmd(struct iwl_trans *trans,
                                      struct iwl_host_cmd *cmd)
 {
@@ -677,7 +707,7 @@ static inline int iwl_trans_send_cmd(struct iwl_trans *trans,
                 return -EIO;
 
         if (unlikely(trans->state != IWL_TRANS_FW_ALIVE)) {
-                IWL_ERR(trans, "%s bad state = %d", __func__, trans->state);
+                IWL_ERR(trans, "%s bad state = %d\n", __func__, trans->state);
                 return -EIO;
         }
 
@@ -719,7 +749,7 @@ static inline int iwl_trans_tx(struct iwl_trans *trans, struct sk_buff *skb,
                 return -EIO;
 
         if (unlikely(trans->state != IWL_TRANS_FW_ALIVE))
-                IWL_ERR(trans, "%s bad state = %d", __func__, trans->state);
+                IWL_ERR(trans, "%s bad state = %d\n", __func__, trans->state);
 
         return trans->ops->tx(trans, skb, dev_cmd, queue);
 }
@@ -728,7 +758,7 @@ static inline void iwl_trans_reclaim(struct iwl_trans *trans, int queue,
                                      int ssn, struct sk_buff_head *skbs)
 {
         if (unlikely(trans->state != IWL_TRANS_FW_ALIVE))
-                IWL_ERR(trans, "%s bad state = %d", __func__, trans->state);
+                IWL_ERR(trans, "%s bad state = %d\n", __func__, trans->state);
 
         trans->ops->reclaim(trans, queue, ssn, skbs);
 }
@@ -745,7 +775,7 @@ static inline void iwl_trans_txq_enable(struct iwl_trans *trans, int queue,
         might_sleep();
 
         if (unlikely((trans->state != IWL_TRANS_FW_ALIVE)))
-                IWL_ERR(trans, "%s bad state = %d", __func__, trans->state);
+                IWL_ERR(trans, "%s bad state = %d\n", __func__, trans->state);
 
         trans->ops->txq_enable(trans, queue, fifo, sta_id, tid,
                                  frame_limit, ssn);
@@ -762,7 +792,7 @@ static inline int iwl_trans_wait_tx_queue_empty(struct iwl_trans *trans,
                                                 u32 txq_bm)
 {
         if (unlikely(trans->state != IWL_TRANS_FW_ALIVE))
-                IWL_ERR(trans, "%s bad state = %d", __func__, trans->state);
+                IWL_ERR(trans, "%s bad state = %d\n", __func__, trans->state);
 
         return trans->ops->wait_tx_queue_empty(trans, txq_bm);
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/Makefile b/drivers/net/wireless/iwlwifi/mvm/Makefile
index ccdd3b7c4cce..c30d7f64ec1e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/Makefile
+++ b/drivers/net/wireless/iwlwifi/mvm/Makefile
@@ -3,8 +3,9 @@ iwlmvm-y += fw.o mac80211.o nvm.o ops.o phy-ctxt.o mac-ctxt.o
 iwlmvm-y += utils.o rx.o tx.o binding.o quota.o sta.o sf.o
 iwlmvm-y += scan.o time-event.o rs.o
 iwlmvm-y += power.o coex.o
-iwlmvm-y += led.o tt.o offloading.o
+iwlmvm-y += tt.o offloading.o
 iwlmvm-$(CONFIG_IWLWIFI_DEBUGFS) += debugfs.o debugfs-vif.o
+iwlmvm-$(CONFIG_IWLWIFI_LEDS) += led.o
 iwlmvm-$(CONFIG_PM_SLEEP) += d3.o
 
 ccflags-y += -D__CHECK_ENDIAN__ -I$(src)/../
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex.c b/drivers/net/wireless/iwlwifi/mvm/coex.c
index 4284672d0397..c8c3b38228f0 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex.c
@@ -106,7 +106,7 @@ static const u8 iwl_bt_prio_tbl[BT_COEX_PRIO_TBL_EVT_MAX] = {
 
 static int iwl_send_bt_prio_tbl(struct iwl_mvm *mvm)
 {
-        return iwl_mvm_send_cmd_pdu(mvm, BT_COEX_PRIO_TABLE, CMD_SYNC,
+        return iwl_mvm_send_cmd_pdu(mvm, BT_COEX_PRIO_TABLE, 0,
                                     sizeof(struct iwl_bt_coex_prio_tbl_cmd),
                                     &iwl_bt_prio_tbl);
 }
@@ -124,10 +124,10 @@ const u32 iwl_bt_cts_kill_msk[BT_KILL_MSK_MAX] = {
 };
 
 static const __le32 iwl_bt_prio_boost[BT_COEX_BOOST_SIZE] = {
-        cpu_to_le32(0xf0f0f0f0),
-        cpu_to_le32(0xc0c0c0c0),
-        cpu_to_le32(0xfcfcfcfc),
-        cpu_to_le32(0xff00ff00),
+        cpu_to_le32(0xf0f0f0f0), /* 50% */
+        cpu_to_le32(0xc0c0c0c0), /* 25% */
+        cpu_to_le32(0xfcfcfcfc), /* 75% */
+        cpu_to_le32(0xfefefefe), /* 87.5% */
 };
 
 static const __le32 iwl_single_shared_ant[BT_COEX_MAX_LUT][BT_COEX_LUT_SIZE] = {
@@ -300,8 +300,8 @@ static const __le64 iwl_ci_mask[][3] = {
 };
 
 static const __le32 iwl_bt_mprio_lut[BT_COEX_MULTI_PRIO_LUT_SIZE] = {
-        cpu_to_le32(0x22002200),
-        cpu_to_le32(0x33113311),
+        cpu_to_le32(0x28412201),
+        cpu_to_le32(0x11118451),
 };
 
 struct corunning_block_luts {
@@ -565,7 +565,6 @@ int iwl_send_bt_init_conf(struct iwl_mvm *mvm)
                 .id = BT_CONFIG,
                 .len = { sizeof(*bt_cmd), },
                 .dataflags = { IWL_HCMD_DFL_NOCOPY, },
-                .flags = CMD_SYNC,
         };
         int ret;
         u32 flags;
@@ -663,7 +662,6 @@ static int iwl_mvm_bt_udpate_ctrl_kill_msk(struct iwl_mvm *mvm,
                 .data[0] = &bt_cmd,
                 .len = { sizeof(*bt_cmd), },
                 .dataflags = { IWL_HCMD_DFL_NOCOPY, },
-                .flags = CMD_SYNC,
         };
         int ret = 0;
 
@@ -717,7 +715,8 @@ static int iwl_mvm_bt_udpate_ctrl_kill_msk(struct iwl_mvm *mvm,
         return ret;
 }
 
-int iwl_mvm_bt_coex_reduced_txp(struct iwl_mvm *mvm, u8 sta_id, bool enable)
+static int iwl_mvm_bt_coex_reduced_txp(struct iwl_mvm *mvm, u8 sta_id,
+                                       bool enable)
 {
         struct iwl_bt_coex_cmd *bt_cmd;
         /* Send ASYNC since this can be sent from an atomic context */
@@ -735,8 +734,7 @@ int iwl_mvm_bt_coex_reduced_txp(struct iwl_mvm *mvm, u8 sta_id, bool enable)
                 return 0;
 
         /* nothing to do */
-        if (mvmsta->bt_reduced_txpower_dbg ||
-            mvmsta->bt_reduced_txpower == enable)
+        if (mvmsta->bt_reduced_txpower == enable)
                 return 0;
 
         bt_cmd = kzalloc(sizeof(*bt_cmd), GFP_ATOMIC);
@@ -803,23 +801,10 @@ static void iwl_mvm_bt_notif_iterator(void *_data, u8 *mac,
 
         switch (vif->type) {
         case NL80211_IFTYPE_STATION:
+                /* Count BSSes vifs */
+                data->num_bss_ifaces++;
                 /* default smps_mode for BSS / P2P client is AUTOMATIC */
                 smps_mode = IEEE80211_SMPS_AUTOMATIC;
-                data->num_bss_ifaces++;
-
-                /*
-                 * Count unassoc BSSes, relax SMSP constraints
-                 * and disable reduced Tx Power
-                 */
-                if (!vif->bss_conf.assoc) {
-                        iwl_mvm_update_smps(mvm, vif, IWL_MVM_SMPS_REQ_BT_COEX,
-                                            smps_mode);
-                        if (iwl_mvm_bt_coex_reduced_txp(mvm,
-                                                        mvmvif->ap_sta_id,
-                                                        false))
-                                IWL_ERR(mvm, "Couldn't send BT_CONFIG cmd\n");
-                        return;
-                }
                 break;
         case NL80211_IFTYPE_AP:
                 /* default smps_mode for AP / GO is OFF */
@@ -845,8 +830,12 @@ static void iwl_mvm_bt_notif_iterator(void *_data, u8 *mac,
                 /* ... relax constraints and disable rssi events */
                 iwl_mvm_update_smps(mvm, vif, IWL_MVM_SMPS_REQ_BT_COEX,
                                     smps_mode);
-                if (vif->type == NL80211_IFTYPE_STATION)
+                data->reduced_tx_power = false;
+                if (vif->type == NL80211_IFTYPE_STATION) {
+                        iwl_mvm_bt_coex_reduced_txp(mvm, mvmvif->ap_sta_id,
+                                                    false);
                         iwl_mvm_bt_coex_enable_rssi_event(mvm, vif, false, 0);
+                }
                 return;
         }
 
@@ -857,6 +846,11 @@ static void iwl_mvm_bt_notif_iterator(void *_data, u8 *mac,
                 smps_mode = vif->type == NL80211_IFTYPE_AP ?
                                 IEEE80211_SMPS_OFF :
                                 IEEE80211_SMPS_DYNAMIC;
+
+        /* relax SMPS contraints for next association */
+        if (!vif->bss_conf.assoc)
+                smps_mode = IEEE80211_SMPS_AUTOMATIC;
+
         IWL_DEBUG_COEX(data->mvm,
                        "mac %d: bt_status %d bt_activity_grading %d smps_req %d\n",
                        mvmvif->id, data->notif->bt_status, bt_activity_grading,
@@ -903,22 +897,18 @@ static void iwl_mvm_bt_notif_iterator(void *_data, u8 *mac,
                 /* if secondary is not NULL, it might be a GO */
                 data->secondary = chanctx_conf;
 
-        /* don't reduce the Tx power if in loose scheme */
+        /*
+         * don't reduce the Tx power if one of these is true:
+         *  we are in LOOSE
+         *  single share antenna product
+         *  BT is active
+         *  we are associated
+         */
         if (iwl_get_coex_type(mvm, vif) == BT_COEX_LOOSE_LUT ||
-            mvm->cfg->bt_shared_single_ant) {
-                data->reduced_tx_power = false;
-                iwl_mvm_bt_coex_enable_rssi_event(mvm, vif, false, 0);
-                return;
-        }
-
-        /* reduced Txpower only if BT is on, so ...*/
-        if (!data->notif->bt_status) {
-                /* ... cancel reduced Tx power ... */
-                if (iwl_mvm_bt_coex_reduced_txp(mvm, mvmvif->ap_sta_id, false))
-                        IWL_ERR(mvm, "Couldn't send BT_CONFIG cmd\n");
+            mvm->cfg->bt_shared_single_ant || !vif->bss_conf.assoc ||
+            !data->notif->bt_status) {
                 data->reduced_tx_power = false;
-
-                /* ... and there is no need to get reports on RSSI any more. */
+                iwl_mvm_bt_coex_reduced_txp(mvm, mvmvif->ap_sta_id, false);
                 iwl_mvm_bt_coex_enable_rssi_event(mvm, vif, false, 0);
                 return;
         }
@@ -1022,9 +1012,9 @@ static void iwl_mvm_bt_coex_notif_handle(struct iwl_mvm *mvm)
 
         /* Don't spam the fw with the same command over and over */
         if (memcmp(&cmd, &mvm->last_bt_ci_cmd, sizeof(cmd))) {
-                if (iwl_mvm_send_cmd_pdu(mvm, BT_COEX_CI, CMD_SYNC,
+                if (iwl_mvm_send_cmd_pdu(mvm, BT_COEX_CI, 0,
                                          sizeof(cmd), &cmd))
-                        IWL_ERR(mvm, "Failed to send BT_CI cmd");
+                        IWL_ERR(mvm, "Failed to send BT_CI cmd\n");
                 memcpy(&mvm->last_bt_ci_cmd, &cmd, sizeof(cmd));
         }
 
@@ -1039,7 +1029,6 @@ static void iwl_mvm_bt_coex_notif_handle(struct iwl_mvm *mvm)
                 IWL_ERR(mvm, "Failed to update the ctrl_kill_msk\n");
 }
 
-/* upon association, the fw will send in BT Coex notification */
 int iwl_mvm_rx_bt_coex_notif(struct iwl_mvm *mvm,
                              struct iwl_rx_cmd_buffer *rxb,
                              struct iwl_device_cmd *dev_cmd)
@@ -1278,7 +1267,6 @@ int iwl_mvm_rx_ant_coupling_notif(struct iwl_mvm *mvm,
                 .id = BT_CONFIG,
                 .len = { sizeof(*bt_cmd), },
                 .dataflags = { IWL_HCMD_DFL_NOCOPY, },
-                .flags = CMD_SYNC,
         };
 
         if (!IWL_MVM_BT_COEX_CORUNNING)
diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c
index 7694472a303e..645b3cfc29a5 100644
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -193,8 +193,7 @@ static void iwl_mvm_wowlan_program_keys(struct ieee80211_hw *hw,
                         wkc.wep_key.key_offset = data->wep_key_idx;
                 }
 
-                ret = iwl_mvm_send_cmd_pdu(mvm, WEP_KEY, CMD_SYNC,
-                                           sizeof(wkc), &wkc);
+                ret = iwl_mvm_send_cmd_pdu(mvm, WEP_KEY, 0, sizeof(wkc), &wkc);
                 data->error = ret != 0;
 
                 mvm->ptk_ivlen = key->iv_len;
@@ -341,7 +340,6 @@ static int iwl_mvm_send_patterns(struct iwl_mvm *mvm,
         struct iwl_host_cmd cmd = {
                 .id = WOWLAN_PATTERNS,
                 .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
-                .flags = CMD_SYNC,
         };
         int i, err;
 
@@ -518,7 +516,6 @@ static int iwl_mvm_send_remote_wake_cfg(struct iwl_mvm *mvm,
                 .id = REMOTE_WAKE_CONFIG_CMD,
                 .len = { sizeof(*cfg), },
                 .dataflags = { IWL_HCMD_DFL_NOCOPY, },
-                .flags = CMD_SYNC,
         };
         int ret;
 
@@ -666,10 +663,8 @@ static int iwl_mvm_d3_reprogram(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 
         if (WARN_ON(!vif->bss_conf.assoc))
                 return -EINVAL;
-        /* hack */
-        vif->bss_conf.assoc = false;
+
         ret = iwl_mvm_mac_ctxt_add(mvm, vif);
-        vif->bss_conf.assoc = true;
         if (ret)
                 return ret;
 
@@ -705,7 +700,7 @@ static int iwl_mvm_d3_reprogram(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                 return ret;
         rcu_assign_pointer(mvm->fw_id_to_mac_id[mvmvif->ap_sta_id], ap_sta);
 
-        ret = iwl_mvm_mac_ctxt_changed(mvm, vif);
+        ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false);
         if (ret)
                 return ret;
 
@@ -719,7 +714,7 @@ static int iwl_mvm_d3_reprogram(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         for (i = 1; i < MAX_BINDINGS; i++)
                 quota_cmd.quotas[i].id_and_color = cpu_to_le32(FW_CTXT_INVALID);
 
-        ret = iwl_mvm_send_cmd_pdu(mvm, TIME_QUOTA_CMD, CMD_SYNC,
+        ret = iwl_mvm_send_cmd_pdu(mvm, TIME_QUOTA_CMD, 0,
                                    sizeof(quota_cmd), &quota_cmd);
         if (ret)
                 IWL_ERR(mvm, "Failed to send quota: %d\n", ret);
@@ -739,7 +734,7 @@ static int iwl_mvm_get_last_nonqos_seq(struct iwl_mvm *mvm,
         };
         struct iwl_host_cmd cmd = {
                 .id = NON_QOS_TX_COUNTER_CMD,
-                .flags = CMD_SYNC | CMD_WANT_SKB,
+                .flags = CMD_WANT_SKB,
         };
         int err;
         u32 size;
@@ -781,7 +776,7 @@ void iwl_mvm_set_last_nonqos_seq(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 
         mvmvif->seqno_valid = false;
 
-        if (iwl_mvm_send_cmd_pdu(mvm, NON_QOS_TX_COUNTER_CMD, CMD_SYNC,
+        if (iwl_mvm_send_cmd_pdu(mvm, NON_QOS_TX_COUNTER_CMD, 0,
                                  sizeof(query_cmd), &query_cmd))
                 IWL_ERR(mvm, "failed to set non-QoS seqno\n");
 }
@@ -796,7 +791,7 @@ iwl_mvm_send_wowlan_config_cmd(struct iwl_mvm *mvm,
         if (mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_WOWLAN_CONFIG_TID)
                 cmd_len = sizeof(*cmd);
 
-        return iwl_mvm_send_cmd_pdu(mvm, WOWLAN_CONFIGURATION, CMD_SYNC,
+        return iwl_mvm_send_cmd_pdu(mvm, WOWLAN_CONFIGURATION, 0,
                                     cmd_len, cmd);
 }
 
@@ -825,7 +820,7 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
         };
         struct iwl_host_cmd d3_cfg_cmd = {
                 .id = D3_CONFIG_CMD,
-                .flags = CMD_SYNC | CMD_WANT_SKB,
+                .flags = CMD_WANT_SKB,
                 .data[0] = &d3_cfg_cmd_data,
                 .len[0] = sizeof(d3_cfg_cmd_data),
         };
@@ -975,7 +970,6 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
                 if (key_data.use_rsc_tsc) {
                         struct iwl_host_cmd rsc_tsc_cmd = {
                                 .id = WOWLAN_TSC_RSC_PARAM,
-                                .flags = CMD_SYNC,
                                 .data[0] = key_data.rsc_tsc,
                                 .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
                                 .len[0] = sizeof(*key_data.rsc_tsc),
@@ -989,7 +983,7 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
                 if (key_data.use_tkip) {
                         ret = iwl_mvm_send_cmd_pdu(mvm,
                                                    WOWLAN_TKIP_PARAM,
-                                                   CMD_SYNC, sizeof(tkip_cmd),
+                                                   0, sizeof(tkip_cmd),
                                                    &tkip_cmd);
                         if (ret)
                                 goto out;
@@ -1006,8 +1000,7 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
                         kek_kck_cmd.replay_ctr = mvmvif->rekey_data.replay_ctr;
 
                         ret = iwl_mvm_send_cmd_pdu(mvm,
-                                                   WOWLAN_KEK_KCK_MATERIAL,
-                                                   CMD_SYNC,
+                                                   WOWLAN_KEK_KCK_MATERIAL, 0,
                                                    sizeof(kek_kck_cmd),
                                                    &kek_kck_cmd);
                         if (ret)
@@ -1023,7 +1016,7 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
         if (ret)
                 goto out;
 
-        ret = iwl_mvm_send_proto_offload(mvm, vif, false, CMD_SYNC);
+        ret = iwl_mvm_send_proto_offload(mvm, vif, false, 0);
         if (ret)
                 goto out;
 
@@ -1035,7 +1028,7 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
         if (ret)
                 goto out;
 
-        ret = iwl_mvm_power_update_mac(mvm, vif);
+        ret = iwl_mvm_power_update_mac(mvm);
         if (ret)
                 goto out;
 
@@ -1466,7 +1459,7 @@ static bool iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
         } err_info;
         struct iwl_host_cmd cmd = {
                 .id = WOWLAN_GET_STATUSES,
-                .flags = CMD_SYNC | CMD_WANT_SKB,
+                .flags = CMD_WANT_SKB,
         };
         struct iwl_wowlan_status_data status;
         struct iwl_wowlan_status *fw_status;
@@ -1492,7 +1485,7 @@ static bool iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
         }
 
         /* only for tracing for now */
-        ret = iwl_mvm_send_cmd_pdu(mvm, OFFLOADS_QUERY_CMD, CMD_SYNC, 0, NULL);
+        ret = iwl_mvm_send_cmd_pdu(mvm, OFFLOADS_QUERY_CMD, 0, 0, NULL);
         if (ret)
                 IWL_ERR(mvm, "failed to query offload statistics (%d)\n", ret);
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c b/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c
index 6047cfdafb95..2e90ff795c13 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c
@@ -175,7 +175,7 @@ static ssize_t iwl_dbgfs_pm_params_write(struct ieee80211_vif *vif, char *buf,
 
         mutex_lock(&mvm->mutex);
         iwl_dbgfs_update_pm(mvm, vif, param, val);
-        ret = iwl_mvm_power_update_mac(mvm, vif);
+        ret = iwl_mvm_power_update_mac(mvm);
         mutex_unlock(&mvm->mutex);
 
         return ret ?: count;
@@ -262,10 +262,9 @@ static ssize_t iwl_dbgfs_mac_params_read(struct file *file,
                         struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
 
                         pos += scnprintf(buf+pos, bufsz-pos,
-                                         "ap_sta_id %d - reduced Tx power %d force %d\n",
+                                         "ap_sta_id %d - reduced Tx power %d\n",
                                          ap_sta_id,
-                                         mvm_sta->bt_reduced_txpower,
-                                         mvm_sta->bt_reduced_txpower_dbg);
+                                         mvm_sta->bt_reduced_txpower);
                 }
         }
 
@@ -283,41 +282,6 @@ static ssize_t iwl_dbgfs_mac_params_read(struct file *file,
         return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
 
-static ssize_t iwl_dbgfs_reduced_txp_write(struct ieee80211_vif *vif,
-                                           char *buf, size_t count,
-                                           loff_t *ppos)
-{
-        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        struct iwl_mvm *mvm = mvmvif->mvm;
-        struct iwl_mvm_sta *mvmsta;
-        bool reduced_tx_power;
-        int ret;
-
-        if (mvmvif->ap_sta_id >= ARRAY_SIZE(mvm->fw_id_to_mac_id))
-                return -ENOTCONN;
-
-        if (strtobool(buf, &reduced_tx_power) != 0)
-                return -EINVAL;
-
-        mutex_lock(&mvm->mutex);
-
-        mvmsta = iwl_mvm_sta_from_staid_protected(mvm, mvmvif->ap_sta_id);
-        if (IS_ERR_OR_NULL(mvmsta)) {
-                mutex_unlock(&mvm->mutex);
-                return -ENOTCONN;
-        }
-
-        mvmsta->bt_reduced_txpower_dbg = false;
-        ret = iwl_mvm_bt_coex_reduced_txp(mvm, mvmvif->ap_sta_id,
-                                          reduced_tx_power);
-        if (!ret)
-                mvmsta->bt_reduced_txpower_dbg = true;
-
-        mutex_unlock(&mvm->mutex);
-
-        return ret ? : count;
-}
-
 static void iwl_dbgfs_update_bf(struct ieee80211_vif *vif,
                                 enum iwl_dbgfs_bf_mask param, int value)
 {
@@ -452,9 +416,9 @@ static ssize_t iwl_dbgfs_bf_params_write(struct ieee80211_vif *vif, char *buf,
         mutex_lock(&mvm->mutex);
         iwl_dbgfs_update_bf(vif, param, value);
         if (param == MVM_DEBUGFS_BF_ENABLE_BEACON_FILTER && !value)
-                ret = iwl_mvm_disable_beacon_filter(mvm, vif, CMD_SYNC);
+                ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
         else
-                ret = iwl_mvm_enable_beacon_filter(mvm, vif, CMD_SYNC);
+                ret = iwl_mvm_enable_beacon_filter(mvm, vif, 0);
         mutex_unlock(&mvm->mutex);
 
         return ret ?: count;
@@ -558,7 +522,6 @@ MVM_DEBUGFS_READ_FILE_OPS(mac_params);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(pm_params, 32);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(bf_params, 256);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(low_latency, 10);
-MVM_DEBUGFS_WRITE_FILE_OPS(reduced_txp, 10);
 
 void iwl_mvm_vif_dbgfs_register(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 {
@@ -590,7 +553,6 @@ void iwl_mvm_vif_dbgfs_register(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                                          S_IRUSR);
 
         MVM_DEBUGFS_ADD_FILE_VIF(mac_params, mvmvif->dbgfs_dir, S_IRUSR);
-        MVM_DEBUGFS_ADD_FILE_VIF(reduced_txp, mvmvif->dbgfs_dir, S_IWUSR);
         MVM_DEBUGFS_ADD_FILE_VIF(low_latency, mvmvif->dbgfs_dir,
                                  S_IRUSR | S_IWUSR);
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
index f462c9baa2b5..29ca72695eaa 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
@@ -65,9 +65,8 @@
 #include "mvm.h"
 #include "sta.h"
 #include "iwl-io.h"
-#include "iwl-prph.h"
 #include "debugfs.h"
-#include "fw-error-dump.h"
+#include "iwl-fw-error-dump.h"
 
 static ssize_t iwl_dbgfs_tx_flush_write(struct iwl_mvm *mvm, char *buf,
                                         size_t count, loff_t *ppos)
@@ -681,7 +680,7 @@ static ssize_t iwl_dbgfs_fw_restart_write(struct iwl_mvm *mvm, char *buf,
                 mvm->restart_fw++;
 
         /* take the return value to make compiler happy - it will fail anyway */
-        ret = iwl_mvm_send_cmd_pdu(mvm, REPLY_ERROR, CMD_SYNC, 0, NULL);
+        ret = iwl_mvm_send_cmd_pdu(mvm, REPLY_ERROR, 0, 0, NULL);
 
         mutex_unlock(&mvm->mutex);
 
@@ -691,7 +690,7 @@ static ssize_t iwl_dbgfs_fw_restart_write(struct iwl_mvm *mvm, char *buf,
 static ssize_t iwl_dbgfs_fw_nmi_write(struct iwl_mvm *mvm, char *buf,
                                       size_t count, loff_t *ppos)
 {
-        iwl_write_prph(mvm->trans, DEVICE_SET_NMI_REG, 1);
+        iwl_force_nmi(mvm->trans);
 
         return count;
 }
@@ -838,7 +837,7 @@ static ssize_t iwl_dbgfs_bcast_filters_write(struct iwl_mvm *mvm, char *buf,
         /* send updated bcast filtering configuration */
         if (mvm->dbgfs_bcast_filtering.override &&
             iwl_mvm_bcast_filter_build_cmd(mvm, &cmd))
-                err = iwl_mvm_send_cmd_pdu(mvm, BCAST_FILTER_CMD, CMD_SYNC,
+                err = iwl_mvm_send_cmd_pdu(mvm, BCAST_FILTER_CMD, 0,
                                            sizeof(cmd), &cmd);
         mutex_unlock(&mvm->mutex);
 
@@ -910,7 +909,7 @@ static ssize_t iwl_dbgfs_bcast_filters_macs_write(struct iwl_mvm *mvm,
         /* send updated bcast filtering configuration */
         if (mvm->dbgfs_bcast_filtering.override &&
             iwl_mvm_bcast_filter_build_cmd(mvm, &cmd))
-                err = iwl_mvm_send_cmd_pdu(mvm, BCAST_FILTER_CMD, CMD_SYNC,
+                err = iwl_mvm_send_cmd_pdu(mvm, BCAST_FILTER_CMD, 0,
                                            sizeof(cmd), &cmd);
         mutex_unlock(&mvm->mutex);
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw.c b/drivers/net/wireless/iwlwifi/mvm/fw.c
index 3d99cf564ba6..883e702152d5 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/iwlwifi/mvm/fw.c
@@ -99,7 +99,7 @@ static int iwl_send_tx_ant_cfg(struct iwl_mvm *mvm, u8 valid_tx_ant)
         };
 
         IWL_DEBUG_FW(mvm, "select valid tx ant: %u\n", valid_tx_ant);
-        return iwl_mvm_send_cmd_pdu(mvm, TX_ANT_CONFIGURATION_CMD, CMD_SYNC,
+        return iwl_mvm_send_cmd_pdu(mvm, TX_ANT_CONFIGURATION_CMD, 0,
                                     sizeof(tx_ant_cmd), &tx_ant_cmd);
 }
 
@@ -137,6 +137,8 @@ static bool iwl_alive_fn(struct iwl_notif_wait_data *notif_wait,
                 alive_data->scd_base_addr = le32_to_cpu(palive2->scd_base_ptr);
                 mvm->umac_error_event_table =
                         le32_to_cpu(palive2->error_info_addr);
+                mvm->sf_space.addr = le32_to_cpu(palive2->st_fwrd_addr);
+                mvm->sf_space.size = le32_to_cpu(palive2->st_fwrd_size);
 
                 alive_data->valid = le16_to_cpu(palive2->status) ==
                                     IWL_ALIVE_STATUS_OK;
@@ -180,6 +182,7 @@ static int iwl_mvm_load_ucode_wait_alive(struct iwl_mvm *mvm,
         int ret, i;
         enum iwl_ucode_type old_type = mvm->cur_ucode;
         static const u8 alive_cmd[] = { MVM_ALIVE };
+        struct iwl_sf_region st_fwrd_space;
 
         fw = iwl_get_ucode_image(mvm, ucode_type);
         if (WARN_ON(!fw))
@@ -215,6 +218,14 @@ static int iwl_mvm_load_ucode_wait_alive(struct iwl_mvm *mvm,
                 return -EIO;
         }
 
+        /*
+         * update the sdio allocation according to the pointer we get in the
+         * alive notification.
+         */
+        st_fwrd_space.addr = mvm->sf_space.addr;
+        st_fwrd_space.size = mvm->sf_space.size;
+        ret = iwl_trans_update_sf(mvm->trans, &st_fwrd_space);
+
         iwl_trans_fw_alive(mvm->trans, alive_data.scd_base_addr);
 
         /*
@@ -256,7 +267,7 @@ static int iwl_send_phy_cfg_cmd(struct iwl_mvm *mvm)
         IWL_DEBUG_INFO(mvm, "Sending Phy CFG command: 0x%x\n",
                        phy_cfg_cmd.phy_cfg);
 
-        return iwl_mvm_send_cmd_pdu(mvm, PHY_CONFIGURATION_CMD, CMD_SYNC,
+        return iwl_mvm_send_cmd_pdu(mvm, PHY_CONFIGURATION_CMD, 0,
                                     sizeof(phy_cfg_cmd), &phy_cfg_cmd);
 }
 
@@ -295,7 +306,7 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
         /* Read the NVM only at driver load time, no need to do this twice */
         if (read_nvm) {
                 /* Read nvm */
-                ret = iwl_nvm_init(mvm);
+                ret = iwl_nvm_init(mvm, true);
                 if (ret) {
                         IWL_ERR(mvm, "Failed to read NVM: %d\n", ret);
                         goto error;
@@ -303,7 +314,7 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
         }
 
         /* In case we read the NVM from external file, load it to the NIC */
-        if (iwlwifi_mod_params.nvm_file)
+        if (mvm->nvm_file_name)
                 iwl_mvm_load_nvm_to_nic(mvm);
 
         ret = iwl_nvm_check_version(mvm->nvm_data, mvm->trans);
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
index 7110ec2605d6..8b5302777632 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
@@ -685,7 +685,7 @@ static void iwl_mvm_mac_ctxt_cmd_common(struct iwl_mvm *mvm,
 static int iwl_mvm_mac_ctxt_send_cmd(struct iwl_mvm *mvm,
                                      struct iwl_mac_ctx_cmd *cmd)
 {
-        int ret = iwl_mvm_send_cmd_pdu(mvm, MAC_CONTEXT_CMD, CMD_SYNC,
+        int ret = iwl_mvm_send_cmd_pdu(mvm, MAC_CONTEXT_CMD, 0,
                                        sizeof(*cmd), cmd);
         if (ret)
                 IWL_ERR(mvm, "Failed to send MAC context (action:%d): %d\n",
@@ -693,19 +693,39 @@ static int iwl_mvm_mac_ctxt_send_cmd(struct iwl_mvm *mvm,
         return ret;
 }
 
-/*
- * Fill the specific data for mac context of type station or p2p client
- */
-static void iwl_mvm_mac_ctxt_cmd_fill_sta(struct iwl_mvm *mvm,
-                                          struct ieee80211_vif *vif,
-                                          struct iwl_mac_data_sta *ctxt_sta,
-                                          bool force_assoc_off)
+static int iwl_mvm_mac_ctxt_cmd_sta(struct iwl_mvm *mvm,
+                                    struct ieee80211_vif *vif,
+                                    u32 action, bool force_assoc_off)
 {
+        struct iwl_mac_ctx_cmd cmd = {};
+        struct iwl_mac_data_sta *ctxt_sta;
+
+        WARN_ON(vif->type != NL80211_IFTYPE_STATION);
+
+        /* Fill the common data for all mac context types */
+        iwl_mvm_mac_ctxt_cmd_common(mvm, vif, &cmd, action);
+
+        if (vif->p2p) {
+                struct ieee80211_p2p_noa_attr *noa =
+                        &vif->bss_conf.p2p_noa_attr;
+
+                cmd.p2p_sta.ctwin = cpu_to_le32(noa->oppps_ctwindow &
+                                        IEEE80211_P2P_OPPPS_CTWINDOW_MASK);
+                ctxt_sta = &cmd.p2p_sta.sta;
+        } else {
+                ctxt_sta = &cmd.sta;
+        }
+
         /* We need the dtim_period to set the MAC as associated */
         if (vif->bss_conf.assoc && vif->bss_conf.dtim_period &&
             !force_assoc_off) {
                 u32 dtim_offs;
 
+                /* Allow beacons to pass through as long as we are not
+                 * associated, or we do not have dtim period information.
+                 */
+                cmd.filter_flags |= cpu_to_le32(MAC_FILTER_IN_BEACON);
+
                 /*
                  * The DTIM count counts down, so when it is N that means N
                  * more beacon intervals happen until the DTIM TBTT. Therefore
@@ -752,51 +772,6 @@ static void iwl_mvm_mac_ctxt_cmd_fill_sta(struct iwl_mvm *mvm,
 
         ctxt_sta->listen_interval = cpu_to_le32(mvm->hw->conf.listen_interval);
         ctxt_sta->assoc_id = cpu_to_le32(vif->bss_conf.aid);
-}
-
-static int iwl_mvm_mac_ctxt_cmd_station(struct iwl_mvm *mvm,
-                                        struct ieee80211_vif *vif,
-                                        u32 action)
-{
-        struct iwl_mac_ctx_cmd cmd = {};
-
-        WARN_ON(vif->type != NL80211_IFTYPE_STATION || vif->p2p);
-
-        /* Fill the common data for all mac context types */
-        iwl_mvm_mac_ctxt_cmd_common(mvm, vif, &cmd, action);
-
-        /* Allow beacons to pass through as long as we are not associated,or we
-         * do not have dtim period information */
-        if (!vif->bss_conf.assoc || !vif->bss_conf.dtim_period)
-                cmd.filter_flags |= cpu_to_le32(MAC_FILTER_IN_BEACON);
-        else
-                cmd.filter_flags &= ~cpu_to_le32(MAC_FILTER_IN_BEACON);
-
-        /* Fill the data specific for station mode */
-        iwl_mvm_mac_ctxt_cmd_fill_sta(mvm, vif, &cmd.sta,
-                                      action == FW_CTXT_ACTION_ADD);
-
-        return iwl_mvm_mac_ctxt_send_cmd(mvm, &cmd);
-}
-
-static int iwl_mvm_mac_ctxt_cmd_p2p_client(struct iwl_mvm *mvm,
-                                           struct ieee80211_vif *vif,
-                                           u32 action)
-{
-        struct iwl_mac_ctx_cmd cmd = {};
-        struct ieee80211_p2p_noa_attr *noa = &vif->bss_conf.p2p_noa_attr;
-
-        WARN_ON(vif->type != NL80211_IFTYPE_STATION || !vif->p2p);
-
-        /* Fill the common data for all mac context types */
-        iwl_mvm_mac_ctxt_cmd_common(mvm, vif, &cmd, action);
-
-        /* Fill the data specific for station mode */
-        iwl_mvm_mac_ctxt_cmd_fill_sta(mvm, vif, &cmd.p2p_sta.sta,
-                                      action == FW_CTXT_ACTION_ADD);
-
-        cmd.p2p_sta.ctwin = cpu_to_le32(noa->oppps_ctwindow &
-                                        IEEE80211_P2P_OPPPS_CTWINDOW_MASK);
 
         return iwl_mvm_mac_ctxt_send_cmd(mvm, &cmd);
 }
@@ -1134,16 +1109,12 @@ static int iwl_mvm_mac_ctxt_cmd_go(struct iwl_mvm *mvm,
 }
 
 static int iwl_mvm_mac_ctx_send(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
-                                u32 action)
+                                u32 action, bool force_assoc_off)
 {
         switch (vif->type) {
         case NL80211_IFTYPE_STATION:
-                if (!vif->p2p)
-                        return iwl_mvm_mac_ctxt_cmd_station(mvm, vif,
-                                                            action);
-                else
-                        return iwl_mvm_mac_ctxt_cmd_p2p_client(mvm, vif,
-                                                               action);
+                return iwl_mvm_mac_ctxt_cmd_sta(mvm, vif, action,
+                                                force_assoc_off);
                 break;
         case NL80211_IFTYPE_AP:
                 if (!vif->p2p)
@@ -1173,7 +1144,8 @@ int iwl_mvm_mac_ctxt_add(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                       vif->addr, ieee80211_vif_type_p2p(vif)))
                 return -EIO;
 
-        ret = iwl_mvm_mac_ctx_send(mvm, vif, FW_CTXT_ACTION_ADD);
+        ret = iwl_mvm_mac_ctx_send(mvm, vif, FW_CTXT_ACTION_ADD,
+                                   true);
         if (ret)
                 return ret;
 
@@ -1184,7 +1156,8 @@ int iwl_mvm_mac_ctxt_add(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
         return 0;
 }
 
-int iwl_mvm_mac_ctxt_changed(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
+int iwl_mvm_mac_ctxt_changed(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                             bool force_assoc_off)
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 
@@ -1192,7 +1165,8 @@ int iwl_mvm_mac_ctxt_changed(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                       vif->addr, ieee80211_vif_type_p2p(vif)))
                 return -EIO;
 
-        return iwl_mvm_mac_ctx_send(mvm, vif, FW_CTXT_ACTION_MODIFY);
+        return iwl_mvm_mac_ctx_send(mvm, vif, FW_CTXT_ACTION_MODIFY,
+                                    force_assoc_off);
 }
 
 int iwl_mvm_mac_ctxt_remove(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
@@ -1211,7 +1185,7 @@ int iwl_mvm_mac_ctxt_remove(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                                                            mvmvif->color));
         cmd.action = cpu_to_le32(FW_CTXT_ACTION_REMOVE);
 
-        ret = iwl_mvm_send_cmd_pdu(mvm, MAC_CONTEXT_CMD, CMD_SYNC,
+        ret = iwl_mvm_send_cmd_pdu(mvm, MAC_CONTEXT_CMD, 0,
                                    sizeof(cmd), &cmd);
         if (ret) {
                 IWL_ERR(mvm, "Failed to remove MAC context: %d\n", ret);
@@ -1237,11 +1211,23 @@ int iwl_mvm_rx_beacon_notif(struct iwl_mvm *mvm,
         u32 rate __maybe_unused =
                 le32_to_cpu(beacon->beacon_notify_hdr.initial_rate);
 
+        lockdep_assert_held(&mvm->mutex);
+
         IWL_DEBUG_RX(mvm, "beacon status %#x retries:%d tsf:0x%16llX rate:%d\n",
                      status & TX_STATUS_MSK,
                      beacon->beacon_notify_hdr.failure_frame,
                      le64_to_cpu(beacon->tsf),
                      rate);
+
+        if (unlikely(mvm->csa_vif && mvm->csa_vif->csa_active)) {
+                if (!ieee80211_csa_is_complete(mvm->csa_vif)) {
+                        iwl_mvm_mac_ctxt_beacon_changed(mvm, mvm->csa_vif);
+                } else {
+                        ieee80211_csa_finish(mvm->csa_vif);
+                        mvm->csa_vif = NULL;
+                }
+        }
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 32682edfe5a4..7215f5980186 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -276,7 +276,6 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
                     IEEE80211_HW_AMPDU_AGGREGATION |
                     IEEE80211_HW_TIMING_BEACON_ONLY |
                     IEEE80211_HW_CONNECTION_MONITOR |
-                    IEEE80211_HW_SUPPORTS_UAPSD |
                     IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS |
                     IEEE80211_HW_SUPPORTS_STATIC_SMPS;
 
@@ -286,8 +285,6 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
                                     IEEE80211_RADIOTAP_MCS_HAVE_STBC;
         hw->radiotap_vht_details |= IEEE80211_RADIOTAP_VHT_KNOWN_STBC;
         hw->rate_control_algorithm = "iwl-mvm-rs";
-        hw->uapsd_queues = IWL_UAPSD_AC_INFO;
-        hw->uapsd_max_sp_len = IWL_UAPSD_MAX_SP;
 
         /*
          * Enable 11w if advertised by firmware and software crypto
@@ -298,9 +295,13 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
             !iwlwifi_mod_params.sw_crypto)
                 hw->flags |= IEEE80211_HW_MFP_CAPABLE;
 
-        /* Disable uAPSD due to firmware issues */
-        if (true)
-                hw->flags &= ~IEEE80211_HW_SUPPORTS_UAPSD;
+        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT &&
+            IWL_UCODE_API(mvm->fw->ucode_ver) >= 9 &&
+            !iwlwifi_mod_params.uapsd_disable) {
+                hw->flags |= IEEE80211_HW_SUPPORTS_UAPSD;
+                hw->uapsd_queues = IWL_UAPSD_AC_INFO;
+                hw->uapsd_max_sp_len = IWL_UAPSD_MAX_SP;
+        }
 
         hw->sta_data_size = sizeof(struct iwl_mvm_sta);
         hw->vif_data_size = sizeof(struct iwl_mvm_vif);
@@ -320,6 +321,9 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
         if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_GO_UAPSD)
                 hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
 
+        if (mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_CSA_FLOW)
+                hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
+
         hw->wiphy->iface_combinations = iwl_mvm_iface_combinations;
         hw->wiphy->n_iface_combinations =
                 ARRAY_SIZE(iwl_mvm_iface_combinations);
@@ -539,13 +543,22 @@ static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
                 return -EACCES;
 
         /* return from D0i3 before starting a new Tx aggregation */
-        if (action == IEEE80211_AMPDU_TX_START) {
+        switch (action) {
+        case IEEE80211_AMPDU_TX_START:
+        case IEEE80211_AMPDU_TX_STOP_CONT:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
+        case IEEE80211_AMPDU_TX_OPERATIONAL:
                 iwl_mvm_ref(mvm, IWL_MVM_REF_TX_AGG);
                 tx_agg_ref = true;
 
                 /*
-                 * wait synchronously until D0i3 exit to get the correct
-                 * sequence number for the tid
+                 * for tx start, wait synchronously until D0i3 exit to
+                 * get the correct sequence number for the tid.
+                 * additionally, some other ampdu actions use direct
+                 * target access, which is not handled automatically
+                 * by the trans layer (unlike commands), so wait for
+                 * d0i3 exit in these cases as well.
                  */
                 if (!wait_event_timeout(mvm->d0i3_exit_waitq,
                           !test_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status), HZ)) {
@@ -553,6 +566,9 @@ static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
                         iwl_mvm_unref(mvm, IWL_MVM_REF_TX_AGG);
                         return -EIO;
                 }
+                break;
+        default:
+                break;
         }
 
         mutex_lock(&mvm->mutex);
@@ -757,7 +773,7 @@ static int iwl_mvm_set_tx_power(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                 .pwr_restriction = cpu_to_le16(tx_power),
         };
 
-        return iwl_mvm_send_cmd_pdu(mvm, REDUCE_TX_POWER_CMD, CMD_SYNC,
+        return iwl_mvm_send_cmd_pdu(mvm, REDUCE_TX_POWER_CMD, 0,
                                     sizeof(reduce_txpwr_cmd),
                                     &reduce_txpwr_cmd);
 }
@@ -816,12 +832,12 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
         if (ret)
                 goto out_release;
 
-        ret = iwl_mvm_power_update_mac(mvm, vif);
+        ret = iwl_mvm_power_update_mac(mvm);
         if (ret)
                 goto out_release;
 
         /* beacon filtering */
-        ret = iwl_mvm_disable_beacon_filter(mvm, vif, CMD_SYNC);
+        ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
         if (ret)
                 goto out_remove_mac;
 
@@ -967,7 +983,7 @@ static void iwl_mvm_mac_remove_interface(struct ieee80211_hw *hw,
         if (mvm->vif_count && vif->type != NL80211_IFTYPE_P2P_DEVICE)
                 mvm->vif_count--;
 
-        iwl_mvm_power_update_mac(mvm, vif);
+        iwl_mvm_power_update_mac(mvm);
         iwl_mvm_mac_ctxt_remove(mvm, vif);
 
 out_release:
@@ -1228,7 +1244,7 @@ static int iwl_mvm_configure_bcast_filter(struct iwl_mvm *mvm,
         if (!iwl_mvm_bcast_filter_build_cmd(mvm, &cmd))
                 return 0;
 
-        return iwl_mvm_send_cmd_pdu(mvm, BCAST_FILTER_CMD, CMD_SYNC,
+        return iwl_mvm_send_cmd_pdu(mvm, BCAST_FILTER_CMD, 0,
                                     sizeof(cmd), &cmd);
 }
 #else
@@ -1255,7 +1271,7 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
         if (changes & BSS_CHANGED_ASSOC && bss_conf->assoc)
                 iwl_mvm_mac_ctxt_recalc_tsf_id(mvm, vif);
 
-        ret = iwl_mvm_mac_ctxt_changed(mvm, vif);
+        ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false);
         if (ret)
                 IWL_ERR(mvm, "failed to update MAC %pM\n", vif->addr);
 
@@ -1335,10 +1351,10 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
                 iwl_mvm_remove_time_event(mvm, mvmvif,
                                           &mvmvif->time_event_data);
                 iwl_mvm_sf_update(mvm, vif, false);
-                WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, CMD_SYNC));
+                WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
         } else if (changes & (BSS_CHANGED_PS | BSS_CHANGED_P2P_PS |
                               BSS_CHANGED_QOS)) {
-                ret = iwl_mvm_power_update_mac(mvm, vif);
+                ret = iwl_mvm_power_update_mac(mvm);
                 if (ret)
                         IWL_ERR(mvm, "failed to update power mode\n");
         }
@@ -1349,16 +1365,19 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
         }
 
         if (changes & BSS_CHANGED_CQM) {
-                IWL_DEBUG_MAC80211(mvm, "cqm info_changed");
+                IWL_DEBUG_MAC80211(mvm, "cqm info_changed\n");
                 /* reset cqm events tracking */
                 mvmvif->bf_data.last_cqm_event = 0;
-                ret = iwl_mvm_update_beacon_filter(mvm, vif, false, CMD_SYNC);
-                if (ret)
-                        IWL_ERR(mvm, "failed to update CQM thresholds\n");
+                if (mvmvif->bf_data.bf_enabled) {
+                        ret = iwl_mvm_enable_beacon_filter(mvm, vif, 0);
+                        if (ret)
+                                IWL_ERR(mvm,
+                                        "failed to update CQM thresholds\n");
+                }
         }
 
         if (changes & BSS_CHANGED_ARP_FILTER) {
-                IWL_DEBUG_MAC80211(mvm, "arp filter changed");
+                IWL_DEBUG_MAC80211(mvm, "arp filter changed\n");
                 iwl_mvm_configure_bcast_filter(mvm, vif);
         }
 }
@@ -1404,7 +1423,7 @@ static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
         mvmvif->ap_ibss_active = true;
 
         /* power updated needs to be done before quotas */
-        iwl_mvm_power_update_mac(mvm, vif);
+        iwl_mvm_power_update_mac(mvm);
 
         ret = iwl_mvm_update_quotas(mvm, vif);
         if (ret)
@@ -1412,7 +1431,7 @@ static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
 
         /* Need to update the P2P Device MAC (only GO, IBSS is single vif) */
         if (vif->p2p && mvm->p2p_device_vif)
-                iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif);
+                iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif, false);
 
         iwl_mvm_ref(mvm, IWL_MVM_REF_AP_IBSS);
 
@@ -1422,7 +1441,7 @@ static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
         return 0;
 
 out_quota_failed:
-        iwl_mvm_power_update_mac(mvm, vif);
+        iwl_mvm_power_update_mac(mvm);
         mvmvif->ap_ibss_active = false;
         iwl_mvm_send_rm_bcast_sta(mvm, &mvmvif->bcast_sta);
 out_unbind:
@@ -1452,13 +1471,13 @@ static void iwl_mvm_stop_ap_ibss(struct ieee80211_hw *hw,
 
         /* Need to update the P2P Device MAC (only GO, IBSS is single vif) */
         if (vif->p2p && mvm->p2p_device_vif)
-                iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif);
+                iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif, false);
 
         iwl_mvm_update_quotas(mvm, NULL);
         iwl_mvm_send_rm_bcast_sta(mvm, &mvmvif->bcast_sta);
         iwl_mvm_binding_remove_vif(mvm, vif);
 
-        iwl_mvm_power_update_mac(mvm, vif);
+        iwl_mvm_power_update_mac(mvm);
 
         iwl_mvm_mac_ctxt_remove(mvm, vif);
 
@@ -1479,7 +1498,7 @@ iwl_mvm_bss_info_changed_ap_ibss(struct iwl_mvm *mvm,
 
         if (changes & (BSS_CHANGED_ERP_CTS_PROT | BSS_CHANGED_HT |
                        BSS_CHANGED_BANDWIDTH) &&
-            iwl_mvm_mac_ctxt_changed(mvm, vif))
+            iwl_mvm_mac_ctxt_changed(mvm, vif, false))
                 IWL_ERR(mvm, "failed to update MAC %pM\n", vif->addr);
 
         /* Need to send a new beacon template to the FW */
@@ -1497,6 +1516,9 @@ static void iwl_mvm_bss_info_changed(struct ieee80211_hw *hw,
 
         mutex_lock(&mvm->mutex);
 
+        if (changes & BSS_CHANGED_IDLE && !bss_conf->idle)
+                iwl_mvm_sched_scan_stop(mvm, true);
+
         switch (vif->type) {
         case NL80211_IFTYPE_STATION:
                 iwl_mvm_bss_info_changed_station(mvm, vif, bss_conf, changes);
@@ -1527,7 +1549,7 @@ static int iwl_mvm_mac_hw_scan(struct ieee80211_hw *hw,
 
         switch (mvm->scan_status) {
         case IWL_MVM_SCAN_SCHED:
-                ret = iwl_mvm_sched_scan_stop(mvm);
+                ret = iwl_mvm_sched_scan_stop(mvm, true);
                 if (ret) {
                         ret = -EBUSY;
                         goto out;
@@ -1715,14 +1737,12 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
         } else if (old_state == IEEE80211_STA_ASSOC &&
                    new_state == IEEE80211_STA_AUTHORIZED) {
                 /* enable beacon filtering */
-                if (vif->bss_conf.dtim_period)
-                        WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif,
-                                                             CMD_SYNC));
+                WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
                 ret = 0;
         } else if (old_state == IEEE80211_STA_AUTHORIZED &&
                    new_state == IEEE80211_STA_ASSOC) {
                 /* disable beacon filtering */
-                WARN_ON(iwl_mvm_disable_beacon_filter(mvm, vif, CMD_SYNC));
+                WARN_ON(iwl_mvm_disable_beacon_filter(mvm, vif, 0));
                 ret = 0;
         } else if (old_state == IEEE80211_STA_ASSOC &&
                    new_state == IEEE80211_STA_AUTH) {
@@ -1779,7 +1799,7 @@ static int iwl_mvm_mac_conf_tx(struct ieee80211_hw *hw,
                 int ret;
 
                 mutex_lock(&mvm->mutex);
-                ret = iwl_mvm_mac_ctxt_changed(mvm, vif);
+                ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false);
                 mutex_unlock(&mvm->mutex);
                 return ret;
         }
@@ -1872,7 +1892,7 @@ static int iwl_mvm_mac_sched_scan_stop(struct ieee80211_hw *hw,
         int ret;
 
         mutex_lock(&mvm->mutex);
-        ret = iwl_mvm_sched_scan_stop(mvm);
+        ret = iwl_mvm_sched_scan_stop(mvm, false);
         mutex_unlock(&mvm->mutex);
         iwl_mvm_wait_for_async_handlers(mvm);
 
@@ -2168,10 +2188,10 @@ static void iwl_mvm_change_chanctx(struct ieee80211_hw *hw,
                 return;
 
         mutex_lock(&mvm->mutex);
+        iwl_mvm_bt_coex_vif_change(mvm);
         iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &ctx->min_def,
                                  ctx->rx_chains_static,
                                  ctx->rx_chains_dynamic);
-        iwl_mvm_bt_coex_vif_change(mvm);
         mutex_unlock(&mvm->mutex);
 }
 
@@ -2191,6 +2211,11 @@ static int iwl_mvm_assign_vif_chanctx(struct ieee80211_hw *hw,
 
         switch (vif->type) {
         case NL80211_IFTYPE_AP:
+                /* Unless it's a CSA flow we have nothing to do here */
+                if (vif->csa_active) {
+                        mvmvif->ap_ibss_active = true;
+                        break;
+                }
         case NL80211_IFTYPE_ADHOC:
                 /*
                  * The AP binding flow is handled as part of the start_ap flow
@@ -2214,7 +2239,7 @@ static int iwl_mvm_assign_vif_chanctx(struct ieee80211_hw *hw,
          * Power state must be updated before quotas,
          * otherwise fw will complain.
          */
-        iwl_mvm_power_update_mac(mvm, vif);
+        iwl_mvm_power_update_mac(mvm);
 
         /* Setting the quota at this stage is only required for monitor
          * interfaces. For the other types, the bss_info changed flow
@@ -2227,11 +2252,17 @@ static int iwl_mvm_assign_vif_chanctx(struct ieee80211_hw *hw,
                         goto out_remove_binding;
         }
 
+        /* Handle binding during CSA */
+        if (vif->type == NL80211_IFTYPE_AP) {
+                iwl_mvm_update_quotas(mvm, vif);
+                iwl_mvm_mac_ctxt_changed(mvm, vif, false);
+        }
+
         goto out_unlock;
 
  out_remove_binding:
         iwl_mvm_binding_remove_vif(mvm, vif);
-        iwl_mvm_power_update_mac(mvm, vif);
+        iwl_mvm_power_update_mac(mvm);
  out_unlock:
         mutex_unlock(&mvm->mutex);
         if (ret)
@@ -2251,22 +2282,29 @@ static void iwl_mvm_unassign_vif_chanctx(struct ieee80211_hw *hw,
         iwl_mvm_remove_time_event(mvm, mvmvif, &mvmvif->time_event_data);
 
         switch (vif->type) {
-        case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_ADHOC:
                 goto out_unlock;
         case NL80211_IFTYPE_MONITOR:
                 mvmvif->monitor_active = false;
                 iwl_mvm_update_quotas(mvm, NULL);
                 break;
+        case NL80211_IFTYPE_AP:
+                /* This part is triggered only during CSA */
+                if (!vif->csa_active || !mvmvif->ap_ibss_active)
+                        goto out_unlock;
+
+                mvmvif->ap_ibss_active = false;
+                iwl_mvm_update_quotas(mvm, NULL);
+                /*TODO: bt_coex notification here? */
         default:
                 break;
         }
 
         iwl_mvm_binding_remove_vif(mvm, vif);
-        iwl_mvm_power_update_mac(mvm, vif);
 
 out_unlock:
         mvmvif->phy_ctxt = NULL;
+        iwl_mvm_power_update_mac(mvm);
         mutex_unlock(&mvm->mutex);
 }
 
@@ -2330,9 +2368,8 @@ static int __iwl_mvm_mac_testmode_cmd(struct iwl_mvm *mvm,
                         return -EINVAL;
 
                 if (nla_get_u32(tb[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE]))
-                        return iwl_mvm_enable_beacon_filter(mvm, vif,
-                                                            CMD_SYNC);
-                return iwl_mvm_disable_beacon_filter(mvm, vif, CMD_SYNC);
+                        return iwl_mvm_enable_beacon_filter(mvm, vif, 0);
+                return iwl_mvm_disable_beacon_filter(mvm, vif, 0);
         }
 
         return -EOPNOTSUPP;
@@ -2353,6 +2390,53 @@ static int iwl_mvm_mac_testmode_cmd(struct ieee80211_hw *hw,
 }
 #endif
 
+static void iwl_mvm_channel_switch_beacon(struct ieee80211_hw *hw,
+                                          struct ieee80211_vif *vif,
+                                          struct cfg80211_chan_def *chandef)
+{
+        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+
+        mutex_lock(&mvm->mutex);
+        if (WARN(mvm->csa_vif && mvm->csa_vif->csa_active,
+                 "Another CSA is already in progress"))
+                goto out_unlock;
+
+        IWL_DEBUG_MAC80211(mvm, "CSA started to freq %d\n",
+                           chandef->center_freq1);
+        mvm->csa_vif = vif;
+
+out_unlock:
+        mutex_unlock(&mvm->mutex);
+}
+
+static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif, u32 queues, bool drop)
+{
+        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+        struct iwl_mvm_vif *mvmvif;
+        struct iwl_mvm_sta *mvmsta;
+
+        if (!vif || vif->type != NL80211_IFTYPE_STATION)
+                return;
+
+        mutex_lock(&mvm->mutex);
+        mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        mvmsta = iwl_mvm_sta_from_staid_protected(mvm, mvmvif->ap_sta_id);
+
+        if (WARN_ON_ONCE(!mvmsta))
+                goto done;
+
+        if (drop) {
+                if (iwl_mvm_flush_tx_path(mvm, mvmsta->tfd_queue_msk, true))
+                        IWL_ERR(mvm, "flush request fail\n");
+        } else {
+                iwl_trans_wait_tx_queue_empty(mvm->trans,
+                                              mvmsta->tfd_queue_msk);
+        }
+done:
+        mutex_unlock(&mvm->mutex);
+}
+
 const struct ieee80211_ops iwl_mvm_hw_ops = {
         .tx = iwl_mvm_mac_tx,
         .ampdu_action = iwl_mvm_mac_ampdu_action,
@@ -2376,6 +2460,7 @@ const struct ieee80211_ops iwl_mvm_hw_ops = {
         .sta_rc_update = iwl_mvm_sta_rc_update,
         .conf_tx = iwl_mvm_mac_conf_tx,
         .mgd_prepare_tx = iwl_mvm_mac_mgd_prepare_tx,
+        .flush = iwl_mvm_mac_flush,
         .sched_scan_start = iwl_mvm_mac_sched_scan_start,
         .sched_scan_stop = iwl_mvm_mac_sched_scan_stop,
         .set_key = iwl_mvm_mac_set_key,
@@ -2395,6 +2480,8 @@ const struct ieee80211_ops iwl_mvm_hw_ops = {
 
         .set_tim = iwl_mvm_set_tim,
 
+        .channel_switch_beacon = iwl_mvm_channel_switch_beacon,
+
         CFG80211_TESTMODE_CMD(iwl_mvm_mac_testmode_cmd)
 
 #ifdef CONFIG_PM_SLEEP
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index 107d864b3c0e..fcc6c29482d0 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -490,6 +490,7 @@ struct iwl_mvm {
         u32 log_event_table;
         u32 umac_error_event_table;
         bool support_umac_log;
+        struct iwl_sf_region sf_space;
 
         u32 ampdu_ref;
 
@@ -501,6 +502,7 @@ struct iwl_mvm {
         u8 queue_to_mac80211[IWL_MAX_HW_QUEUES];
         atomic_t queue_stop_count[IWL_MAX_HW_QUEUES];
 
+        const char *nvm_file_name;
         struct iwl_nvm_data *nvm_data;
         /* NVM sections */
         struct iwl_nvm_section nvm_sections[NVM_MAX_NUM_SECTIONS];
@@ -589,7 +591,9 @@ struct iwl_mvm {
         u32 *fw_error_rxf;
         u32 fw_error_rxf_len;
 
+#ifdef CONFIG_IWLWIFI_LEDS
         struct led_classdev led;
+#endif
 
         struct ieee80211_vif *p2p_device_vif;
 
@@ -642,6 +646,8 @@ struct iwl_mvm {
 
         /* Indicate if device power save is allowed */
         bool ps_disabled;
+
+        struct ieee80211_vif *csa_vif;
 };
 
 /* Extract MVM priv from op_mode and _hw */
@@ -757,7 +763,7 @@ int iwl_mvm_rx_statistics(struct iwl_mvm *mvm,
                           struct iwl_device_cmd *cmd);
 
 /* NVM */
-int iwl_nvm_init(struct iwl_mvm *mvm);
+int iwl_nvm_init(struct iwl_mvm *mvm, bool read_nvm_from_nic);
 int iwl_mvm_load_nvm_to_nic(struct iwl_mvm *mvm);
 
 int iwl_mvm_up(struct iwl_mvm *mvm);
@@ -808,7 +814,8 @@ void iwl_mvm_phy_ctxt_unref(struct iwl_mvm *mvm,
 int iwl_mvm_mac_ctxt_init(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
 void iwl_mvm_mac_ctxt_release(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
 int iwl_mvm_mac_ctxt_add(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
-int iwl_mvm_mac_ctxt_changed(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
+int iwl_mvm_mac_ctxt_changed(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                             bool force_assoc_off);
 int iwl_mvm_mac_ctxt_remove(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
 u32 iwl_mvm_mac_get_queues_mask(struct iwl_mvm *mvm,
                                 struct ieee80211_vif *vif);
@@ -852,7 +859,7 @@ int iwl_mvm_config_sched_scan_profiles(struct iwl_mvm *mvm,
                                        struct cfg80211_sched_scan_request *req);
 int iwl_mvm_sched_scan_start(struct iwl_mvm *mvm,
                              struct cfg80211_sched_scan_request *req);
-int iwl_mvm_sched_scan_stop(struct iwl_mvm *mvm);
+int iwl_mvm_sched_scan_stop(struct iwl_mvm *mvm, bool notify);
 int iwl_mvm_rx_sched_scan_results(struct iwl_mvm *mvm,
                                   struct iwl_rx_cmd_buffer *rxb,
                                   struct iwl_device_cmd *cmd);
@@ -887,7 +894,7 @@ int rs_pretty_print_rate(char *buf, const u32 rate);
 
 /* power management */
 int iwl_mvm_power_update_device(struct iwl_mvm *mvm);
-int iwl_mvm_power_update_mac(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
+int iwl_mvm_power_update_mac(struct iwl_mvm *mvm);
 int iwl_mvm_power_mac_dbgfs_read(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                                  char *buf, int bufsz);
 
@@ -896,8 +903,18 @@ int iwl_mvm_power_uapsd_misbehaving_ap_notif(struct iwl_mvm *mvm,
                                              struct iwl_rx_cmd_buffer *rxb,
                                              struct iwl_device_cmd *cmd);
 
+#ifdef CONFIG_IWLWIFI_LEDS
 int iwl_mvm_leds_init(struct iwl_mvm *mvm);
 void iwl_mvm_leds_exit(struct iwl_mvm *mvm);
+#else
+static inline int iwl_mvm_leds_init(struct iwl_mvm *mvm)
+{
+        return 0;
+}
+static inline void iwl_mvm_leds_exit(struct iwl_mvm *mvm)
+{
+}
+#endif
 
 /* D3 (WoWLAN, NetDetect) */
 int iwl_mvm_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan);
@@ -950,7 +967,6 @@ bool iwl_mvm_bt_coex_is_tpc_allowed(struct iwl_mvm *mvm,
                                     enum ieee80211_band band);
 u8 iwl_mvm_bt_coex_tx_prio(struct iwl_mvm *mvm, struct ieee80211_hdr *hdr,
                            struct ieee80211_tx_info *info, u8 ac);
-int iwl_mvm_bt_coex_reduced_txp(struct iwl_mvm *mvm, u8 sta_id, bool enable);
 
 enum iwl_bt_kill_msk {
         BT_KILL_MSK_DEFAULT,
@@ -981,17 +997,11 @@ int iwl_mvm_enable_beacon_filter(struct iwl_mvm *mvm,
 int iwl_mvm_disable_beacon_filter(struct iwl_mvm *mvm,
                                   struct ieee80211_vif *vif,
                                   u32 flags);
-int iwl_mvm_update_beacon_abort(struct iwl_mvm *mvm,
-                                struct ieee80211_vif *vif, bool enable);
-int iwl_mvm_update_beacon_filter(struct iwl_mvm *mvm,
-                                 struct ieee80211_vif *vif,
-                                 bool force,
-                                 u32 flags);
-
 /* SMPS */
 void iwl_mvm_update_smps(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                                 enum iwl_mvm_smps_type_request req_type,
                                 enum ieee80211_smps_mode smps_request);
+bool iwl_mvm_rx_diversity_allowed(struct iwl_mvm *mvm);
 
 /* Low latency */
 int iwl_mvm_update_low_latency(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
diff --git a/drivers/net/wireless/iwlwifi/mvm/nvm.c b/drivers/net/wireless/iwlwifi/mvm/nvm.c
index cf2d09f53782..808f78f6fbf9 100644
--- a/drivers/net/wireless/iwlwifi/mvm/nvm.c
+++ b/drivers/net/wireless/iwlwifi/mvm/nvm.c
@@ -74,6 +74,12 @@
 #define NVM_WRITE_OPCODE 1
 #define NVM_READ_OPCODE 0
 
+/* load nvm chunk response */
+enum {
+        READ_NVM_CHUNK_SUCCEED = 0,
+        READ_NVM_CHUNK_NOT_VALID_ADDRESS = 1
+};
+
 /*
  * prepare the NVM host command w/ the pointers to the nvm buffer
  * and send it to fw
@@ -90,7 +96,7 @@ static int iwl_nvm_write_chunk(struct iwl_mvm *mvm, u16 section,
         struct iwl_host_cmd cmd = {
                 .id = NVM_ACCESS_CMD,
                 .len = { sizeof(struct iwl_nvm_access_cmd), length },
-                .flags = CMD_SYNC | CMD_SEND_IN_RFKILL,
+                .flags = CMD_SEND_IN_RFKILL,
                 .data = { &nvm_access_cmd, data },
                 /* data may come from vmalloc, so use _DUP */
                 .dataflags = { 0, IWL_HCMD_DFL_DUP },
@@ -112,7 +118,7 @@ static int iwl_nvm_read_chunk(struct iwl_mvm *mvm, u16 section,
         struct iwl_rx_packet *pkt;
         struct iwl_host_cmd cmd = {
                 .id = NVM_ACCESS_CMD,
-                .flags = CMD_SYNC | CMD_WANT_SKB | CMD_SEND_IN_RFKILL,
+                .flags = CMD_WANT_SKB | CMD_SEND_IN_RFKILL,
                 .data = { &nvm_access_cmd, },
         };
         int ret, bytes_read, offset_read;
@@ -139,10 +145,26 @@ static int iwl_nvm_read_chunk(struct iwl_mvm *mvm, u16 section,
         offset_read = le16_to_cpu(nvm_resp->offset);
         resp_data = nvm_resp->data;
         if (ret) {
-                IWL_ERR(mvm,
-                        "NVM access command failed with status %d (device: %s)\n",
-                        ret, mvm->cfg->name);
-                ret = -EINVAL;
+                if ((offset != 0) &&
+                    (ret == READ_NVM_CHUNK_NOT_VALID_ADDRESS)) {
+                        /*
+                         * meaning of NOT_VALID_ADDRESS:
+                         * driver try to read chunk from address that is
+                         * multiple of 2K and got an error since addr is empty.
+                         * meaning of (offset != 0): driver already
+                         * read valid data from another chunk so this case
+                         * is not an error.
+                         */
+                        IWL_DEBUG_EEPROM(mvm->trans->dev,
+                                         "NVM access command failed on offset 0x%x since that section size is multiple 2K\n",
+                                         offset);
+                        ret = 0;
+                } else {
+                        IWL_DEBUG_EEPROM(mvm->trans->dev,
+                                         "NVM access command failed with status %d (device: %s)\n",
+                                         ret, mvm->cfg->name);
+                        ret = -EIO;
+                }
                 goto exit;
         }
 
@@ -211,9 +233,9 @@ static int iwl_nvm_read_section(struct iwl_mvm *mvm, u16 section,
         while (ret == length) {
                 ret = iwl_nvm_read_chunk(mvm, section, offset, length, data);
                 if (ret < 0) {
-                        IWL_ERR(mvm,
-                                "Cannot read NVM from section %d offset %d, length %d\n",
-                                section, offset, length);
+                        IWL_DEBUG_EEPROM(mvm->trans->dev,
+                                         "Cannot read NVM from section %d offset %d, length %d\n",
+                                         section, offset, length);
                         return ret;
                 }
                 offset += ret;
@@ -238,13 +260,20 @@ iwl_parse_nvm_sections(struct iwl_mvm *mvm)
                         return NULL;
                 }
         } else {
+                /* SW and REGULATORY sections are mandatory */
                 if (!mvm->nvm_sections[NVM_SECTION_TYPE_SW].data ||
-                    !mvm->nvm_sections[NVM_SECTION_TYPE_MAC_OVERRIDE].data ||
                     !mvm->nvm_sections[NVM_SECTION_TYPE_REGULATORY].data) {
                         IWL_ERR(mvm,
                                 "Can't parse empty family 8000 NVM sections\n");
                         return NULL;
                 }
+                /* MAC_OVERRIDE or at least HW section must exist */
+                if (!mvm->nvm_sections[mvm->cfg->nvm_hw_section_num].data &&
+                    !mvm->nvm_sections[NVM_SECTION_TYPE_MAC_OVERRIDE].data) {
+                        IWL_ERR(mvm,
+                                "Can't parse mac_address, empty sections\n");
+                        return NULL;
+                }
         }
 
         if (WARN_ON(!mvm->cfg))
@@ -311,16 +340,16 @@ static int iwl_mvm_read_external_nvm(struct iwl_mvm *mvm)
          * get here after that we assume the NVM request can be satisfied
          * synchronously.
          */
-        ret = request_firmware(&fw_entry, iwlwifi_mod_params.nvm_file,
+        ret = request_firmware(&fw_entry, mvm->nvm_file_name,
                                mvm->trans->dev);
         if (ret) {
                 IWL_ERR(mvm, "ERROR: %s isn't available %d\n",
-                        iwlwifi_mod_params.nvm_file, ret);
+                        mvm->nvm_file_name, ret);
                 return ret;
         }
 
         IWL_INFO(mvm, "Loaded NVM file %s (%zu bytes)\n",
-                 iwlwifi_mod_params.nvm_file, fw_entry->size);
+                 mvm->nvm_file_name, fw_entry->size);
 
         if (fw_entry->size < sizeof(*file_sec)) {
                 IWL_ERR(mvm, "NVM file too small\n");
@@ -427,53 +456,28 @@ int iwl_mvm_load_nvm_to_nic(struct iwl_mvm *mvm)
         return ret;
 }
 
-int iwl_nvm_init(struct iwl_mvm *mvm)
+int iwl_nvm_init(struct iwl_mvm *mvm, bool read_nvm_from_nic)
 {
-        int ret, i, section;
+        int ret, section;
         u8 *nvm_buffer, *temp;
-        int nvm_to_read[NVM_MAX_NUM_SECTIONS];
-        int num_of_sections_to_read;
 
         if (WARN_ON_ONCE(mvm->cfg->nvm_hw_section_num >= NVM_MAX_NUM_SECTIONS))
                 return -EINVAL;
 
-        /* load external NVM if configured */
-        if (iwlwifi_mod_params.nvm_file) {
-                /* move to External NVM flow */
-                ret = iwl_mvm_read_external_nvm(mvm);
-                if (ret)
-                        return ret;
-        } else {
-                /* list of NVM sections we are allowed/need to read */
-                if (mvm->trans->cfg->device_family != IWL_DEVICE_FAMILY_8000) {
-                        nvm_to_read[0] = mvm->cfg->nvm_hw_section_num;
-                        nvm_to_read[1] = NVM_SECTION_TYPE_SW;
-                        nvm_to_read[2] = NVM_SECTION_TYPE_CALIBRATION;
-                        nvm_to_read[3] = NVM_SECTION_TYPE_PRODUCTION;
-                        num_of_sections_to_read = 4;
-                } else {
-                        nvm_to_read[0] = NVM_SECTION_TYPE_SW;
-                        nvm_to_read[1] = NVM_SECTION_TYPE_CALIBRATION;
-                        nvm_to_read[2] = NVM_SECTION_TYPE_PRODUCTION;
-                        nvm_to_read[3] = NVM_SECTION_TYPE_REGULATORY;
-                        nvm_to_read[4] = NVM_SECTION_TYPE_MAC_OVERRIDE;
-                        num_of_sections_to_read = 5;
-                }
-
+        /* load NVM values from nic */
+        if (read_nvm_from_nic) {
                 /* Read From FW NVM */
                 IWL_DEBUG_EEPROM(mvm->trans->dev, "Read from NVM\n");
 
-                /* TODO: find correct NVM max size for a section */
                 nvm_buffer = kmalloc(mvm->cfg->base_params->eeprom_size,
                                      GFP_KERNEL);
                 if (!nvm_buffer)
                         return -ENOMEM;
-                for (i = 0; i < num_of_sections_to_read; i++) {
-                        section = nvm_to_read[i];
+                for (section = 0; section < NVM_MAX_NUM_SECTIONS; section++) {
                         /* we override the constness for initial read */
                         ret = iwl_nvm_read_section(mvm, section, nvm_buffer);
                         if (ret < 0)
-                                break;
+                                continue;
                         temp = kmemdup(nvm_buffer, ret, GFP_KERNEL);
                         if (!temp) {
                                 ret = -ENOMEM;
@@ -502,15 +506,21 @@ int iwl_nvm_init(struct iwl_mvm *mvm)
                                         mvm->nvm_hw_blob.size = ret;
                                         break;
                                 }
-                                WARN(1, "section: %d", section);
                         }
 #endif
                 }
                 kfree(nvm_buffer);
-                if (ret < 0)
+        }
+
+        /* load external NVM if configured */
+        if (mvm->nvm_file_name) {
+                /* move to External NVM flow */
+                ret = iwl_mvm_read_external_nvm(mvm);
+                if (ret)
                         return ret;
         }
 
+        /* parse the relevant nvm sections */
         mvm->nvm_data = iwl_parse_nvm_sections(mvm);
         if (!mvm->nvm_data)
                 return -ENODATA;
diff --git a/drivers/net/wireless/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwlwifi/mvm/ops.c
index 7a5a8bac5fd0..cc2f7de396de 100644
--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
@@ -79,8 +79,8 @@
 #include "iwl-prph.h"
 #include "rs.h"
 #include "fw-api-scan.h"
-#include "fw-error-dump.h"
 #include "time-event.h"
+#include "iwl-fw-error-dump.h"
 
 /*
  * module name, copyright, version, etc.
@@ -220,7 +220,7 @@ static const struct iwl_rx_handlers iwl_mvm_rx_handlers[] = {
         RX_HANDLER(BA_NOTIF, iwl_mvm_rx_ba_notif, false),
 
         RX_HANDLER(BT_PROFILE_NOTIFICATION, iwl_mvm_rx_bt_coex_notif, true),
-        RX_HANDLER(BEACON_NOTIFICATION, iwl_mvm_rx_beacon_notif, false),
+        RX_HANDLER(BEACON_NOTIFICATION, iwl_mvm_rx_beacon_notif, true),
         RX_HANDLER(STATISTICS_NOTIFICATION, iwl_mvm_rx_statistics, true),
         RX_HANDLER(ANTENNA_COUPLING_NOTIFICATION,
                    iwl_mvm_rx_ant_coupling_notif, true),
@@ -466,13 +466,24 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
 
         min_backoff = calc_min_backoff(trans, cfg);
         iwl_mvm_tt_initialize(mvm, min_backoff);
+        /* set the nvm_file_name according to priority */
+        if (iwlwifi_mod_params.nvm_file)
+                mvm->nvm_file_name = iwlwifi_mod_params.nvm_file;
+        else
+                mvm->nvm_file_name = mvm->cfg->default_nvm_file;
+
+        if (WARN(cfg->no_power_up_nic_in_init && !mvm->nvm_file_name,
+                 "not allowing power-up and not having nvm_file\n"))
+                goto out_free;
 
         /*
-         * If the NVM exists in an external file,
-         * there is no need to unnecessarily power up the NIC at driver load
+         * Even if nvm exists in the nvm_file driver should read agin the nvm
+         * from the nic because there might be entries that exist in the OTP
+         * and not in the file.
+         * for nics with no_power_up_nic_in_init: rely completley on nvm_file
          */
-        if (iwlwifi_mod_params.nvm_file) {
-                err = iwl_nvm_init(mvm);
+        if (cfg->no_power_up_nic_in_init && mvm->nvm_file_name) {
+                err = iwl_nvm_init(mvm, false);
                 if (err)
                         goto out_free;
         } else {
@@ -519,7 +530,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
  out_free:
         iwl_phy_db_free(mvm->phy_db);
         kfree(mvm->scan_cmd);
-        if (!iwlwifi_mod_params.nvm_file)
+        if (!cfg->no_power_up_nic_in_init || !mvm->nvm_file_name)
                 iwl_trans_op_mode_leave(trans);
         ieee80211_free_hw(mvm->hw);
         return NULL;
@@ -816,6 +827,7 @@ void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm)
         struct iwl_fw_error_dump_file *dump_file;
         struct iwl_fw_error_dump_data *dump_data;
         u32 file_len;
+        u32 trans_len;
 
         lockdep_assert_held(&mvm->mutex);
 
@@ -827,6 +839,10 @@ void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm)
                    sizeof(*dump_file) +
                    sizeof(*dump_data) * 2;
 
+        trans_len = iwl_trans_dump_data(mvm->trans, NULL, 0);
+        if (trans_len)
+                file_len += trans_len;
+
         dump_file = vmalloc(file_len);
         if (!dump_file)
                 return;
@@ -840,7 +856,7 @@ void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm)
         dump_data->len = cpu_to_le32(mvm->fw_error_rxf_len);
         memcpy(dump_data->data, mvm->fw_error_rxf, mvm->fw_error_rxf_len);
 
-        dump_data = (void *)((u8 *)dump_data->data + mvm->fw_error_rxf_len);
+        dump_data = iwl_mvm_fw_error_next_data(dump_data);
         dump_data->type = cpu_to_le32(IWL_FW_ERROR_DUMP_SRAM);
         dump_data->len = cpu_to_le32(mvm->fw_error_sram_len);
 
@@ -858,6 +874,15 @@ void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm)
         kfree(mvm->fw_error_sram);
         mvm->fw_error_sram = NULL;
         mvm->fw_error_sram_len = 0;
+
+        if (trans_len) {
+                void *buf = iwl_mvm_fw_error_next_data(dump_data);
+                u32 real_trans_len = iwl_trans_dump_data(mvm->trans, buf,
+                                                         trans_len);
+                dump_data = (void *)((u8 *)buf + real_trans_len);
+                dump_file->file_len =
+                        cpu_to_le32(file_len - trans_len + real_trans_len);
+        }
 }
 #endif
 
@@ -1143,7 +1168,7 @@ static void iwl_mvm_d0i3_exit_work(struct work_struct *wk)
         struct iwl_mvm *mvm = container_of(wk, struct iwl_mvm, d0i3_exit_work);
         struct iwl_host_cmd get_status_cmd = {
                 .id = WOWLAN_GET_STATUSES,
-                .flags = CMD_SYNC | CMD_HIGH_PRIO | CMD_WANT_SKB,
+                .flags = CMD_HIGH_PRIO | CMD_WANT_SKB,
         };
         struct iwl_wowlan_status *status;
         int ret;
diff --git a/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c b/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
index 237efe0ac1c4..539f3a942d43 100644
--- a/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
@@ -156,6 +156,18 @@ static void iwl_mvm_phy_ctxt_cmd_data(struct iwl_mvm *mvm,
         idle_cnt = chains_static;
         active_cnt = chains_dynamic;
 
+        /* In scenarios where we only ever use a single-stream rates,
+         * i.e. legacy 11b/g/a associations, single-stream APs or even
+         * static SMPS, enable both chains to get diversity, improving
+         * the case where we're far enough from the AP that attenuation
+         * between the two antennas is sufficiently different to impact
+         * performance.
+         */
+        if (active_cnt == 1 && iwl_mvm_rx_diversity_allowed(mvm)) {
+                idle_cnt = 2;
+                active_cnt = 2;
+        }
+
         cmd->rxchain_info = cpu_to_le32(mvm->fw->valid_rx_ant <<
                                         PHY_RX_CHAIN_VALID_POS);
         cmd->rxchain_info |= cpu_to_le32(idle_cnt << PHY_RX_CHAIN_CNT_POS);
@@ -187,7 +199,7 @@ static int iwl_mvm_phy_ctxt_apply(struct iwl_mvm *mvm,
         iwl_mvm_phy_ctxt_cmd_data(mvm, &cmd, chandef,
                                   chains_static, chains_dynamic);
 
-        ret = iwl_mvm_send_cmd_pdu(mvm, PHY_CONTEXT_CMD, CMD_SYNC,
+        ret = iwl_mvm_send_cmd_pdu(mvm, PHY_CONTEXT_CMD, 0,
                                    sizeof(struct iwl_phy_context_cmd),
                                    &cmd);
         if (ret)
@@ -202,18 +214,15 @@ int iwl_mvm_phy_ctxt_add(struct iwl_mvm *mvm, struct iwl_mvm_phy_ctxt *ctxt,
                          struct cfg80211_chan_def *chandef,
                          u8 chains_static, u8 chains_dynamic)
 {
-        int ret;
-
         WARN_ON(!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
                 ctxt->ref);
         lockdep_assert_held(&mvm->mutex);
 
         ctxt->channel = chandef->chan;
-        ret = iwl_mvm_phy_ctxt_apply(mvm, ctxt, chandef,
-                                     chains_static, chains_dynamic,
-                                     FW_CTXT_ACTION_ADD, 0);
 
-        return ret;
+        return iwl_mvm_phy_ctxt_apply(mvm, ctxt, chandef,
+                                      chains_static, chains_dynamic,
+                                      FW_CTXT_ACTION_ADD, 0);
 }
 
 /*
diff --git a/drivers/net/wireless/iwlwifi/mvm/power.c b/drivers/net/wireless/iwlwifi/mvm/power.c
index 78309f7d0b7b..c182a8baf685 100644
--- a/drivers/net/wireless/iwlwifi/mvm/power.c
+++ b/drivers/net/wireless/iwlwifi/mvm/power.c
@@ -123,28 +123,6 @@ void iwl_mvm_beacon_filter_set_cqm_params(struct iwl_mvm *mvm,
         cmd->ba_enable_beacon_abort = cpu_to_le32(mvmvif->bf_data.ba_enabled);
 }
 
-int iwl_mvm_update_beacon_abort(struct iwl_mvm *mvm,
-                                struct ieee80211_vif *vif, bool enable)
-{
-        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        struct iwl_beacon_filter_cmd cmd = {
-                IWL_BF_CMD_CONFIG_DEFAULTS,
-                .bf_enable_beacon_filter = cpu_to_le32(1),
-                .ba_enable_beacon_abort = cpu_to_le32(enable),
-        };
-
-        if (!mvmvif->bf_data.bf_enabled)
-                return 0;
-
-        if (mvm->cur_ucode == IWL_UCODE_WOWLAN)
-                cmd.ba_escape_timer = cpu_to_le32(IWL_BA_ESCAPE_TIMER_D3);
-
-        mvmvif->bf_data.ba_enabled = enable;
-        iwl_mvm_beacon_filter_set_cqm_params(mvm, vif, &cmd);
-        iwl_mvm_beacon_filter_debugfs_parameters(vif, &cmd);
-        return iwl_mvm_beacon_filter_send_cmd(mvm, &cmd, CMD_SYNC);
-}
-
 static void iwl_mvm_power_log(struct iwl_mvm *mvm,
                               struct iwl_mac_power_cmd *cmd)
 {
@@ -268,10 +246,30 @@ static void iwl_mvm_power_configure_uapsd(struct iwl_mvm *mvm,
                 IWL_MVM_PS_HEAVY_RX_THLD_PERCENT;
 }
 
+static void iwl_mvm_binding_iterator(void *_data, u8 *mac,
+                                      struct ieee80211_vif *vif)
+{
+        unsigned long *data = _data;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+
+        if (!mvmvif->phy_ctxt)
+                return;
+
+        if (vif->type == NL80211_IFTYPE_STATION ||
+            vif->type == NL80211_IFTYPE_AP)
+                __set_bit(mvmvif->phy_ctxt->id, data);
+}
+
 static bool iwl_mvm_power_allow_uapsd(struct iwl_mvm *mvm,
                                        struct ieee80211_vif *vif)
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        unsigned long phy_ctxt_counter = 0;
+
+        ieee80211_iterate_active_interfaces_atomic(mvm->hw,
+                                                   IEEE80211_IFACE_ITER_NORMAL,
+                                                   iwl_mvm_binding_iterator,
+                                                   &phy_ctxt_counter);
 
         if (!memcmp(mvmvif->uapsd_misbehaving_bssid, vif->bss_conf.bssid,
                     ETH_ALEN))
@@ -289,6 +287,13 @@ static bool iwl_mvm_power_allow_uapsd(struct iwl_mvm *mvm,
             IEEE80211_P2P_OPPPS_ENABLE_BIT))
                 return false;
 
+        /*
+         * Avoid using uAPSD if client is in DCM -
+         * low latency issue in Miracast
+         */
+        if (hweight8(phy_ctxt_counter) >= 2)
+                return false;
+
         return true;
 }
 
@@ -429,7 +434,7 @@ static int iwl_mvm_power_send_cmd(struct iwl_mvm *mvm,
         memcpy(&iwl_mvm_vif_from_mac80211(vif)->mac_pwr_cmd, &cmd, sizeof(cmd));
 #endif
 
-        return iwl_mvm_send_cmd_pdu(mvm, MAC_PM_POWER_TABLE, CMD_SYNC,
+        return iwl_mvm_send_cmd_pdu(mvm, MAC_PM_POWER_TABLE, 0,
                                     sizeof(cmd), &cmd);
 }
 
@@ -455,7 +460,7 @@ int iwl_mvm_power_update_device(struct iwl_mvm *mvm)
                         "Sending device power command with flags = 0x%X\n",
                         cmd.flags);
 
-        return iwl_mvm_send_cmd_pdu(mvm, POWER_TABLE_CMD, CMD_SYNC, sizeof(cmd),
+        return iwl_mvm_send_cmd_pdu(mvm, POWER_TABLE_CMD, 0, sizeof(cmd),
                                     &cmd);
 }
 
@@ -613,11 +618,15 @@ iwl_mvm_power_set_pm(struct iwl_mvm *mvm,
                 ap_same_channel = (bss_mvmvif->phy_ctxt->id ==
                                    ap_mvmvif->phy_ctxt->id);
 
-        /* bss is not stand alone: enable PM if alone on its channel */
-        if (vifs->bss_active && !(client_same_channel || ap_same_channel) &&
+        /* clients are not stand alone: enable PM if DCM */
+        if (!(client_same_channel || ap_same_channel) &&
             (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_BSS_P2P_PS_DCM)) {
+                if (vifs->bss_active)
                         bss_mvmvif->pm_enabled = true;
-                        return;
+                if (vifs->p2p_active &&
+                    (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_P2P_PM))
+                        p2p_mvmvif->pm_enabled = true;
+                return;
         }
 
         /*
@@ -633,55 +642,6 @@ iwl_mvm_power_set_pm(struct iwl_mvm *mvm,
         }
 }
 
-int iwl_mvm_power_update_mac(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
-{
-        struct iwl_mvm_vif *mvmvif;
-        struct iwl_power_vifs vifs = {};
-        bool ba_enable;
-        int ret;
-
-        lockdep_assert_held(&mvm->mutex);
-
-        iwl_mvm_power_set_pm(mvm, &vifs);
-
-        /* disable PS if CAM */
-        if (iwlmvm_mod_params.power_scheme == IWL_POWER_SCHEME_CAM) {
-                mvm->ps_disabled = true;
-        } else {
-        /* don't update device power state unless we add / remove monitor */
-                if (vifs.monitor_vif) {
-                        if (vifs.monitor_active)
-                                mvm->ps_disabled = true;
-                        ret = iwl_mvm_power_update_device(mvm);
-                        if (ret)
-                                return ret;
-                }
-        }
-
-        if (vifs.bss_vif) {
-                ret = iwl_mvm_power_send_cmd(mvm, vifs.bss_vif);
-                if (ret)
-                        return ret;
-        }
-
-        if (vifs.p2p_vif) {
-                ret = iwl_mvm_power_send_cmd(mvm, vifs.p2p_vif);
-                if (ret)
-                        return ret;
-        }
-
-        if (!vifs.bf_vif)
-                return 0;
-
-        vif = vifs.bf_vif;
-        mvmvif = iwl_mvm_vif_from_mac80211(vif);
-
-        ba_enable = !(!mvmvif->pm_enabled || mvm->ps_disabled ||
-                      !vif->bss_conf.ps || iwl_mvm_vif_low_latency(mvmvif));
-
-        return iwl_mvm_update_beacon_abort(mvm, vifs.bf_vif, ba_enable);
-}
-
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 int iwl_mvm_power_mac_dbgfs_read(struct iwl_mvm *mvm,
                                  struct ieee80211_vif *vif, char *buf,
@@ -801,7 +761,7 @@ static int _iwl_mvm_enable_beacon_filter(struct iwl_mvm *mvm,
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         int ret;
 
-        if (mvmvif != mvm->bf_allowed_vif ||
+        if (mvmvif != mvm->bf_allowed_vif || !vif->bss_conf.dtim_period ||
             vif->type != NL80211_IFTYPE_STATION || vif->p2p)
                 return 0;
 
@@ -829,6 +789,26 @@ int iwl_mvm_enable_beacon_filter(struct iwl_mvm *mvm,
         return _iwl_mvm_enable_beacon_filter(mvm, vif, &cmd, flags, false);
 }
 
+static int iwl_mvm_update_beacon_abort(struct iwl_mvm *mvm,
+                                       struct ieee80211_vif *vif,
+                                       bool enable)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct iwl_beacon_filter_cmd cmd = {
+                IWL_BF_CMD_CONFIG_DEFAULTS,
+                .bf_enable_beacon_filter = cpu_to_le32(1),
+        };
+
+        if (!mvmvif->bf_data.bf_enabled)
+                return 0;
+
+        if (mvm->cur_ucode == IWL_UCODE_WOWLAN)
+                cmd.ba_escape_timer = cpu_to_le32(IWL_BA_ESCAPE_TIMER_D3);
+
+        mvmvif->bf_data.ba_enabled = enable;
+        return _iwl_mvm_enable_beacon_filter(mvm, vif, &cmd, 0, false);
+}
+
 int iwl_mvm_disable_beacon_filter(struct iwl_mvm *mvm,
                                   struct ieee80211_vif *vif,
                                   u32 flags)
@@ -848,6 +828,55 @@ int iwl_mvm_disable_beacon_filter(struct iwl_mvm *mvm,
         return ret;
 }
 
+int iwl_mvm_power_update_mac(struct iwl_mvm *mvm)
+{
+        struct iwl_mvm_vif *mvmvif;
+        struct iwl_power_vifs vifs = {};
+        bool ba_enable;
+        int ret;
+
+        lockdep_assert_held(&mvm->mutex);
+
+        iwl_mvm_power_set_pm(mvm, &vifs);
+
+        /* disable PS if CAM */
+        if (iwlmvm_mod_params.power_scheme == IWL_POWER_SCHEME_CAM) {
+                mvm->ps_disabled = true;
+        } else {
+        /* don't update device power state unless we add / remove monitor */
+                if (vifs.monitor_vif) {
+                        if (vifs.monitor_active)
+                                mvm->ps_disabled = true;
+                        ret = iwl_mvm_power_update_device(mvm);
+                        if (ret)
+                                return ret;
+                }
+        }
+
+        if (vifs.bss_vif) {
+                ret = iwl_mvm_power_send_cmd(mvm, vifs.bss_vif);
+                if (ret)
+                        return ret;
+        }
+
+        if (vifs.p2p_vif) {
+                ret = iwl_mvm_power_send_cmd(mvm, vifs.p2p_vif);
+                if (ret)
+                        return ret;
+        }
+
+        if (!vifs.bf_vif)
+                return 0;
+
+        mvmvif = iwl_mvm_vif_from_mac80211(vifs.bf_vif);
+
+        ba_enable = !(!mvmvif->pm_enabled || mvm->ps_disabled ||
+                      !vifs.bf_vif->bss_conf.ps ||
+                      iwl_mvm_vif_low_latency(mvmvif));
+
+        return iwl_mvm_update_beacon_abort(mvm, vifs.bf_vif, ba_enable);
+}
+
 int iwl_mvm_update_d0i3_power_mode(struct iwl_mvm *mvm,
                                    struct ieee80211_vif *vif,
                                    bool enable, u32 flags)
@@ -871,9 +900,10 @@ int iwl_mvm_update_d0i3_power_mode(struct iwl_mvm *mvm,
                 if (WARN_ON(!dtimper_msec))
                         return 0;
 
-                cmd.flags |=
-                        cpu_to_le16(POWER_FLAGS_SKIP_OVER_DTIM_MSK);
                 cmd.skip_dtim_periods = 300 / dtimper_msec;
+                if (cmd.skip_dtim_periods)
+                        cmd.flags |=
+                                cpu_to_le16(POWER_FLAGS_SKIP_OVER_DTIM_MSK);
         }
         iwl_mvm_power_log(mvm, &cmd);
 #ifdef CONFIG_IWLWIFI_DEBUGFS
@@ -904,23 +934,3 @@ int iwl_mvm_update_d0i3_power_mode(struct iwl_mvm *mvm,
 
         return ret;
 }
-
-int iwl_mvm_update_beacon_filter(struct iwl_mvm *mvm,
-                                 struct ieee80211_vif *vif,
-                                 bool force,
-                                 u32 flags)
-{
-        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-
-        if (mvmvif != mvm->bf_allowed_vif)
-                return 0;
-
-        if (!mvmvif->bf_data.bf_enabled) {
-                /* disable beacon filtering explicitly if force is true */
-                if (force)
-                        return iwl_mvm_disable_beacon_filter(mvm, vif, flags);
-                return 0;
-        }
-
-        return iwl_mvm_enable_beacon_filter(mvm, vif, flags);
-}
diff --git a/drivers/net/wireless/iwlwifi/mvm/quota.c b/drivers/net/wireless/iwlwifi/mvm/quota.c
index 35e86e06dffd..ba68d7b84505 100644
--- a/drivers/net/wireless/iwlwifi/mvm/quota.c
+++ b/drivers/net/wireless/iwlwifi/mvm/quota.c
@@ -285,7 +285,7 @@ int iwl_mvm_update_quotas(struct iwl_mvm *mvm, struct ieee80211_vif *newvif)
 
         iwl_mvm_adjust_quota_for_noa(mvm, &cmd);
 
-        ret = iwl_mvm_send_cmd_pdu(mvm, TIME_QUOTA_CMD, CMD_SYNC,
+        ret = iwl_mvm_send_cmd_pdu(mvm, TIME_QUOTA_CMD, 0,
                                    sizeof(cmd), &cmd);
         if (ret)
                 IWL_ERR(mvm, "Failed to send quota: %d\n", ret);
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c
index 857ddaf6f48c..306a6caa4868 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
@@ -211,7 +211,7 @@ static const struct rs_tx_column rs_tx_columns[] = {
                 .next_columns = {
                         RS_COLUMN_LEGACY_ANT_B,
                         RS_COLUMN_SISO_ANT_A,
-                        RS_COLUMN_SISO_ANT_B,
+                        RS_COLUMN_MIMO2,
                         RS_COLUMN_INVALID,
                         RS_COLUMN_INVALID,
                         RS_COLUMN_INVALID,
@@ -223,8 +223,8 @@ static const struct rs_tx_column rs_tx_columns[] = {
                 .ant = ANT_B,
                 .next_columns = {
                         RS_COLUMN_LEGACY_ANT_A,
-                        RS_COLUMN_SISO_ANT_A,
                         RS_COLUMN_SISO_ANT_B,
+                        RS_COLUMN_MIMO2,
                         RS_COLUMN_INVALID,
                         RS_COLUMN_INVALID,
                         RS_COLUMN_INVALID,
@@ -238,10 +238,10 @@ static const struct rs_tx_column rs_tx_columns[] = {
                         RS_COLUMN_SISO_ANT_B,
                         RS_COLUMN_MIMO2,
                         RS_COLUMN_SISO_ANT_A_SGI,
-                        RS_COLUMN_SISO_ANT_B_SGI,
                         RS_COLUMN_LEGACY_ANT_A,
                         RS_COLUMN_LEGACY_ANT_B,
                         RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
                 },
                 .checks = {
                         rs_siso_allow,
@@ -254,10 +254,10 @@ static const struct rs_tx_column rs_tx_columns[] = {
                         RS_COLUMN_SISO_ANT_A,
                         RS_COLUMN_MIMO2,
                         RS_COLUMN_SISO_ANT_B_SGI,
-                        RS_COLUMN_SISO_ANT_A_SGI,
                         RS_COLUMN_LEGACY_ANT_A,
                         RS_COLUMN_LEGACY_ANT_B,
                         RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
                 },
                 .checks = {
                         rs_siso_allow,
@@ -271,10 +271,10 @@ static const struct rs_tx_column rs_tx_columns[] = {
                         RS_COLUMN_SISO_ANT_B_SGI,
                         RS_COLUMN_MIMO2_SGI,
                         RS_COLUMN_SISO_ANT_A,
-                        RS_COLUMN_SISO_ANT_B,
-                        RS_COLUMN_MIMO2,
                         RS_COLUMN_LEGACY_ANT_A,
                         RS_COLUMN_LEGACY_ANT_B,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
                 },
                 .checks = {
                         rs_siso_allow,
@@ -289,10 +289,10 @@ static const struct rs_tx_column rs_tx_columns[] = {
                         RS_COLUMN_SISO_ANT_A_SGI,
                         RS_COLUMN_MIMO2_SGI,
                         RS_COLUMN_SISO_ANT_B,
-                        RS_COLUMN_SISO_ANT_A,
-                        RS_COLUMN_MIMO2,
                         RS_COLUMN_LEGACY_ANT_A,
                         RS_COLUMN_LEGACY_ANT_B,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
                 },
                 .checks = {
                         rs_siso_allow,
@@ -304,12 +304,12 @@ static const struct rs_tx_column rs_tx_columns[] = {
                 .ant = ANT_AB,
                 .next_columns = {
                         RS_COLUMN_SISO_ANT_A,
-                        RS_COLUMN_SISO_ANT_B,
-                        RS_COLUMN_SISO_ANT_A_SGI,
-                        RS_COLUMN_SISO_ANT_B_SGI,
                         RS_COLUMN_MIMO2_SGI,
                         RS_COLUMN_LEGACY_ANT_A,
                         RS_COLUMN_LEGACY_ANT_B,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
                 },
                 .checks = {
                         rs_mimo_allow,
@@ -321,12 +321,12 @@ static const struct rs_tx_column rs_tx_columns[] = {
                 .sgi = true,
                 .next_columns = {
                         RS_COLUMN_SISO_ANT_A_SGI,
-                        RS_COLUMN_SISO_ANT_B_SGI,
-                        RS_COLUMN_SISO_ANT_A,
-                        RS_COLUMN_SISO_ANT_B,
                         RS_COLUMN_MIMO2,
                         RS_COLUMN_LEGACY_ANT_A,
                         RS_COLUMN_LEGACY_ANT_B,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
                 },
                 .checks = {
                         rs_mimo_allow,
@@ -1335,105 +1335,50 @@ static void rs_set_expected_tpt_table(struct iwl_lq_sta *lq_sta,
         tbl->expected_tpt = rs_get_expected_tpt_table(lq_sta, column, rate->bw);
 }
 
-/*
- * Find starting rate for new "search" high-throughput mode of modulation.
- * Goal is to find lowest expected rate (under perfect conditions) that is
- * above the current measured throughput of "active" mode, to give new mode
- * a fair chance to prove itself without too many challenges.
- *
- * This gets called when transitioning to more aggressive modulation
- * (i.e. legacy to SISO or MIMO, or SISO to MIMO), as well as less aggressive
- * (i.e. MIMO to SISO).  When moving to MIMO, bit rate will typically need
- * to decrease to match "active" throughput.  When moving from MIMO to SISO,
- * bit rate will typically need to increase, but not if performance was bad.
- */
 static s32 rs_get_best_rate(struct iwl_mvm *mvm,
                             struct iwl_lq_sta *lq_sta,
                             struct iwl_scale_tbl_info *tbl,     /* "search" */
-                            u16 rate_mask, s8 index)
+                            unsigned long rate_mask, s8 index)
 {
-        /* "active" values */
         struct iwl_scale_tbl_info *active_tbl =
             &(lq_sta->lq_info[lq_sta->active_tbl]);
-        s32 active_sr = active_tbl->win[index].success_ratio;
-        s32 active_tpt = active_tbl->expected_tpt[index];
-        /* expected "search" throughput */
+        s32 success_ratio = active_tbl->win[index].success_ratio;
+        u16 expected_current_tpt = active_tbl->expected_tpt[index];
         const u16 *tpt_tbl = tbl->expected_tpt;
-
-        s32 new_rate, high, low, start_hi;
         u16 high_low;
-        s8 rate = index;
-
-        new_rate = high = low = start_hi = IWL_RATE_INVALID;
-
-        while (1) {
-                high_low = rs_get_adjacent_rate(mvm, rate, rate_mask,
-                                                tbl->rate.type);
-
-                low = high_low & 0xff;
-                high = (high_low >> 8) & 0xff;
+        u32 target_tpt;
+        int rate_idx;
 
-                /*
-                 * Lower the "search" bit rate, to give new "search" mode
-                 * approximately the same throughput as "active" if:
-                 *
-                 * 1) "Active" mode has been working modestly well (but not
-                 *    great), and expected "search" throughput (under perfect
-                 *    conditions) at candidate rate is above the actual
-                 *    measured "active" throughput (but less than expected
-                 *    "active" throughput under perfect conditions).
-                 * OR
-                 * 2) "Active" mode has been working perfectly or very well
-                 *    and expected "search" throughput (under perfect
-                 *    conditions) at candidate rate is above expected
-                 *    "active" throughput (under perfect conditions).
-                 */
-                if ((((100 * tpt_tbl[rate]) > lq_sta->last_tpt) &&
-                     ((active_sr > RS_SR_FORCE_DECREASE) &&
-                      (active_sr <= IWL_RATE_HIGH_TH) &&
-                      (tpt_tbl[rate] <= active_tpt))) ||
-                    ((active_sr >= IWL_RATE_SCALE_SWITCH) &&
-                     (tpt_tbl[rate] > active_tpt))) {
-                        /* (2nd or later pass)
-                         * If we've already tried to raise the rate, and are
-                         * now trying to lower it, use the higher rate. */
-                        if (start_hi != IWL_RATE_INVALID) {
-                                new_rate = start_hi;
-                                break;
-                        }
-
-                        new_rate = rate;
-
-                        /* Loop again with lower rate */
-                        if (low != IWL_RATE_INVALID)
-                                rate = low;
+        if (success_ratio > RS_SR_NO_DECREASE) {
+                target_tpt = 100 * expected_current_tpt;
+                IWL_DEBUG_RATE(mvm,
+                               "SR %d high. Find rate exceeding EXPECTED_CURRENT %d\n",
+                               success_ratio, target_tpt);
+        } else {
+                target_tpt = lq_sta->last_tpt;
+                IWL_DEBUG_RATE(mvm,
+                               "SR %d not thag good. Find rate exceeding ACTUAL_TPT %d\n",
+                               success_ratio, target_tpt);
+        }
 
-                        /* Lower rate not available, use the original */
-                        else
-                                break;
+        rate_idx = find_first_bit(&rate_mask, BITS_PER_LONG);
 
-                /* Else try to raise the "search" rate to match "active" */
-                } else {
-                        /* (2nd or later pass)
-                         * If we've already tried to lower the rate, and are
-                         * now trying to raise it, use the lower rate. */
-                        if (new_rate != IWL_RATE_INVALID)
-                                break;
+        while (rate_idx != IWL_RATE_INVALID) {
+                if (target_tpt < (100 * tpt_tbl[rate_idx]))
+                        break;
 
-                        /* Loop again with higher rate */
-                        else if (high != IWL_RATE_INVALID) {
-                                start_hi = high;
-                                rate = high;
+                high_low = rs_get_adjacent_rate(mvm, rate_idx, rate_mask,
+                                                tbl->rate.type);
 
-                        /* Higher rate not available, use the original */
-                        } else {
-                                new_rate = rate;
-                                break;
-                        }
-                }
+                rate_idx = (high_low >> 8) & 0xff;
         }
 
-        return new_rate;
+        IWL_DEBUG_RATE(mvm, "Best rate found %d target_tp %d expected_new %d\n",
+                       rate_idx, target_tpt,
+                       rate_idx != IWL_RATE_INVALID ?
+                       100 * tpt_tbl[rate_idx] : IWL_INVALID_VALUE);
+
+        return rate_idx;
 }
 
 static u32 rs_bw_from_sta_bw(struct ieee80211_sta *sta)
@@ -1608,7 +1553,7 @@ static enum rs_column rs_get_next_column(struct iwl_mvm *mvm,
 
                 tpt = lq_sta->last_tpt / 100;
                 expected_tpt_tbl = rs_get_expected_tpt_table(lq_sta, next_col,
-                                                             tbl->rate.bw);
+                                                     rs_bw_from_sta_bw(sta));
                 if (WARN_ON_ONCE(!expected_tpt_tbl))
                         continue;
 
@@ -1649,7 +1594,7 @@ static int rs_switch_to_column(struct iwl_mvm *mvm,
         const struct rs_tx_column *curr_column = &rs_tx_columns[tbl->column];
         u32 sz = (sizeof(struct iwl_scale_tbl_info) -
                   (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT));
-        u16 rate_mask = 0;
+        unsigned long rate_mask = 0;
         u32 rate_idx = 0;
 
         memcpy(search_tbl, tbl, sz);
@@ -1691,7 +1636,7 @@ static int rs_switch_to_column(struct iwl_mvm *mvm,
                     !(BIT(rate_idx) & rate_mask)) {
                         IWL_DEBUG_RATE(mvm,
                                        "can not switch with index %d"
-                                       " rate mask %x\n",
+                                       " rate mask %lx\n",
                                        rate_idx, rate_mask);
 
                         goto err;
@@ -1805,16 +1750,21 @@ static void rs_get_adjacent_txp(struct iwl_mvm *mvm, int index,
                 *stronger = TPC_INVALID;
 }
 
-static bool rs_tpc_allowed(struct iwl_mvm *mvm, struct rs_rate *rate,
-                           enum ieee80211_band band)
+static bool rs_tpc_allowed(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                           struct rs_rate *rate, enum ieee80211_band band)
 {
         int index = rate->index;
+        bool cam = (iwlmvm_mod_params.power_scheme == IWL_POWER_SCHEME_CAM);
+        bool sta_ps_disabled = (vif->type == NL80211_IFTYPE_STATION &&
+                                !vif->bss_conf.ps);
 
+        IWL_DEBUG_RATE(mvm, "cam: %d sta_ps_disabled %d\n",
+                       cam, sta_ps_disabled);
         /*
          * allow tpc only if power management is enabled, or bt coex
          * activity grade allows it and we are on 2.4Ghz.
          */
-        if (iwlmvm_mod_params.power_scheme == IWL_POWER_SCHEME_CAM &&
+        if ((cam || sta_ps_disabled) &&
             !iwl_mvm_bt_coex_is_tpc_allowed(mvm, band))
                 return false;
 
@@ -1916,7 +1866,7 @@ static bool rs_tpc_perform(struct iwl_mvm *mvm,
 
 #ifdef CONFIG_MAC80211_DEBUGFS
         if (lq_sta->dbg_fixed_txp_reduction <= TPC_MAX_REDUCTION) {
-                IWL_DEBUG_RATE(mvm, "fixed tpc: %d",
+                IWL_DEBUG_RATE(mvm, "fixed tpc: %d\n",
                                lq_sta->dbg_fixed_txp_reduction);
                 lq_sta->lq.reduced_tpc = lq_sta->dbg_fixed_txp_reduction;
                 return cur != lq_sta->dbg_fixed_txp_reduction;
@@ -1931,9 +1881,9 @@ static bool rs_tpc_perform(struct iwl_mvm *mvm,
                 band = chanctx_conf->def.chan->band;
         rcu_read_unlock();
 
-        if (!rs_tpc_allowed(mvm, rate, band)) {
+        if (!rs_tpc_allowed(mvm, vif, rate, band)) {
                 IWL_DEBUG_RATE(mvm,
-                               "tpc is not allowed. remove txp restrictions");
+                               "tpc is not allowed. remove txp restrictions\n");
                 lq_sta->lq.reduced_tpc = TPC_NO_REDUCTION;
                 return cur != TPC_NO_REDUCTION;
         }
@@ -1959,12 +1909,12 @@ static bool rs_tpc_perform(struct iwl_mvm *mvm,
 
         /* override actions if we are on the edge */
         if (weak == TPC_INVALID && action == TPC_ACTION_DECREASE) {
-                IWL_DEBUG_RATE(mvm, "already in lowest txp, stay");
+                IWL_DEBUG_RATE(mvm, "already in lowest txp, stay\n");
                 action = TPC_ACTION_STAY;
         } else if (strong == TPC_INVALID &&
                    (action == TPC_ACTION_INCREASE ||
                     action == TPC_ACTION_NO_RESTIRCTION)) {
-                IWL_DEBUG_RATE(mvm, "already in highest txp, stay");
+                IWL_DEBUG_RATE(mvm, "already in highest txp, stay\n");
                 action = TPC_ACTION_STAY;
         }
 
@@ -2235,7 +2185,8 @@ static void rs_rate_scale_perform(struct iwl_mvm *mvm,
                 break;
         case RS_ACTION_STAY:
                 /* No change */
-                update_lq = rs_tpc_perform(mvm, sta, lq_sta, tbl);
+                if (lq_sta->rs_state == RS_STATE_STAY_IN_COLUMN)
+                        update_lq = rs_tpc_perform(mvm, sta, lq_sta, tbl);
                 break;
         default:
                 break;
@@ -2489,10 +2440,6 @@ static void rs_vht_set_enabled_rates(struct ieee80211_sta *sta,
                         if (i == IWL_RATE_9M_INDEX)
                                 continue;
 
-                        /* Disable MCS9 as a workaround */
-                        if (i == IWL_RATE_MCS_9_INDEX)
-                                continue;
-
                         /* VHT MCS9 isn't valid for 20Mhz for NSS=1,2 */
                         if (i == IWL_RATE_MCS_9_INDEX &&
                             sta->bandwidth == IEEE80211_STA_RX_BW_20)
@@ -2511,10 +2458,6 @@ static void rs_vht_set_enabled_rates(struct ieee80211_sta *sta,
                         if (i == IWL_RATE_9M_INDEX)
                                 continue;
 
-                        /* Disable MCS9 as a workaround */
-                        if (i == IWL_RATE_MCS_9_INDEX)
-                                continue;
-
                         /* VHT MCS9 isn't valid for 20Mhz for NSS=1,2 */
                         if (i == IWL_RATE_MCS_9_INDEX &&
                             sta->bandwidth == IEEE80211_STA_RX_BW_20)
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index 36ae01a18dee..4b6c7d4bd199 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -306,7 +306,6 @@ int iwl_mvm_scan_request(struct iwl_mvm *mvm,
                 .id = SCAN_REQUEST_CMD,
                 .len = { 0, },
                 .data = { mvm->scan_cmd, },
-                .flags = CMD_SYNC,
                 .dataflags = { IWL_HCMD_DFL_NOCOPY, },
         };
         struct iwl_scan_cmd *cmd = mvm->scan_cmd;
@@ -517,7 +516,7 @@ int iwl_mvm_cancel_scan(struct iwl_mvm *mvm)
                                    ARRAY_SIZE(scan_abort_notif),
                                    iwl_mvm_scan_abort_notif, NULL);
 
-        ret = iwl_mvm_send_cmd_pdu(mvm, SCAN_ABORT_CMD, CMD_SYNC, 0, NULL);
+        ret = iwl_mvm_send_cmd_pdu(mvm, SCAN_ABORT_CMD, 0, 0, NULL);
         if (ret) {
                 IWL_ERR(mvm, "Couldn't send SCAN_ABORT_CMD: %d\n", ret);
                 /* mac80211's state will be cleaned in the nic_restart flow */
@@ -749,7 +748,6 @@ int iwl_mvm_config_sched_scan(struct iwl_mvm *mvm,
         struct iwl_scan_offload_cfg *scan_cfg;
         struct iwl_host_cmd cmd = {
                 .id = SCAN_OFFLOAD_CONFIG_CMD,
-                .flags = CMD_SYNC,
         };
         struct iwl_mvm_scan_params params = {};
 
@@ -807,7 +805,6 @@ int iwl_mvm_config_sched_scan_profiles(struct iwl_mvm *mvm,
         struct iwl_scan_offload_blacklist *blacklist;
         struct iwl_host_cmd cmd = {
                 .id = SCAN_OFFLOAD_UPDATE_PROFILES_CMD,
-                .flags = CMD_SYNC,
                 .len[1] = sizeof(*profile_cfg),
                 .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
                 .dataflags[1] = IWL_HCMD_DFL_NOCOPY,
@@ -898,7 +895,7 @@ int iwl_mvm_sched_scan_start(struct iwl_mvm *mvm,
                 scan_req.flags |=
                         cpu_to_le16(IWL_SCAN_OFFLOAD_FLAG_EBS_ACCURATE_MODE);
 
-        return iwl_mvm_send_cmd_pdu(mvm, SCAN_OFFLOAD_REQUEST_CMD, CMD_SYNC,
+        return iwl_mvm_send_cmd_pdu(mvm, SCAN_OFFLOAD_REQUEST_CMD, 0,
                                     sizeof(scan_req), &scan_req);
 }
 
@@ -907,7 +904,6 @@ static int iwl_mvm_send_sched_scan_abort(struct iwl_mvm *mvm)
         int ret;
         struct iwl_host_cmd cmd = {
                 .id = SCAN_OFFLOAD_ABORT_CMD,
-                .flags = CMD_SYNC,
         };
         u32 status;
 
@@ -936,7 +932,7 @@ static int iwl_mvm_send_sched_scan_abort(struct iwl_mvm *mvm)
         return ret;
 }
 
-int iwl_mvm_sched_scan_stop(struct iwl_mvm *mvm)
+int iwl_mvm_sched_scan_stop(struct iwl_mvm *mvm, bool notify)
 {
         int ret;
         struct iwl_notification_wait wait_scan_done;
@@ -974,5 +970,8 @@ int iwl_mvm_sched_scan_stop(struct iwl_mvm *mvm)
          */
         mvm->scan_status = IWL_MVM_SCAN_NONE;
 
+        if (notify)
+                ieee80211_sched_scan_stopped(mvm->hw);
+
         return 0;
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
index 3e11b9d802e7..1fb01ea2e704 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
@@ -327,7 +327,7 @@ static int iwl_mvm_rm_sta_common(struct iwl_mvm *mvm, u8 sta_id)
                 return -EINVAL;
         }
 
-        ret = iwl_mvm_send_cmd_pdu(mvm, REMOVE_STA, CMD_SYNC,
+        ret = iwl_mvm_send_cmd_pdu(mvm, REMOVE_STA, 0,
                                    sizeof(rm_sta_cmd), &rm_sta_cmd);
         if (ret) {
                 IWL_ERR(mvm, "Failed to remove station. Id=%d\n", sta_id);
@@ -1053,12 +1053,12 @@ static int iwl_mvm_send_sta_key(struct iwl_mvm *mvm,
         cmd.sta_id = sta_id;
 
         status = ADD_STA_SUCCESS;
-        if (cmd_flags == CMD_SYNC)
-                ret = iwl_mvm_send_cmd_pdu_status(mvm, ADD_STA_KEY, sizeof(cmd),
-                                                  &cmd, &status);
-        else
+        if (cmd_flags & CMD_ASYNC)
                 ret =  iwl_mvm_send_cmd_pdu(mvm, ADD_STA_KEY, CMD_ASYNC,
                                             sizeof(cmd), &cmd);
+        else
+                ret = iwl_mvm_send_cmd_pdu_status(mvm, ADD_STA_KEY, sizeof(cmd),
+                                                  &cmd, &status);
 
         switch (status) {
         case ADD_STA_SUCCESS:
@@ -1111,7 +1111,7 @@ static int iwl_mvm_send_sta_igtk(struct iwl_mvm *mvm,
                        remove_key ? "removing" : "installing",
                        igtk_cmd.sta_id);
 
-        return iwl_mvm_send_cmd_pdu(mvm, MGMT_MCAST_KEY, CMD_SYNC,
+        return iwl_mvm_send_cmd_pdu(mvm, MGMT_MCAST_KEY, 0,
                                     sizeof(igtk_cmd), &igtk_cmd);
 }
 
@@ -1198,15 +1198,15 @@ int iwl_mvm_set_sta_key(struct iwl_mvm *mvm,
                 ieee80211_get_key_rx_seq(keyconf, 0, &seq);
                 ieee80211_get_tkip_rx_p1k(keyconf, addr, seq.tkip.iv32, p1k);
                 ret = iwl_mvm_send_sta_key(mvm, mvm_sta, keyconf, sta_id,
-                                           seq.tkip.iv32, p1k, CMD_SYNC);
+                                           seq.tkip.iv32, p1k, 0);
                 break;
         case WLAN_CIPHER_SUITE_CCMP:
                 ret = iwl_mvm_send_sta_key(mvm, mvm_sta, keyconf, sta_id,
-                                           0, NULL, CMD_SYNC);
+                                           0, NULL, 0);
                 break;
         default:
                 ret = iwl_mvm_send_sta_key(mvm, mvm_sta, keyconf,
-                                           sta_id, 0, NULL, CMD_SYNC);
+                                           sta_id, 0, NULL, 0);
         }
 
         if (ret)
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.h b/drivers/net/wireless/iwlwifi/mvm/sta.h
index e5e3071ff252..d98e8a2142b8 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.h
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.h
@@ -287,8 +287,6 @@ static inline u16 iwl_mvm_tid_queued(struct iwl_mvm_tid_data *tid_data)
  * @tid_disable_agg: bitmap: if bit(tid) is set, the fw won't send ampdus for
  *      tid.
  * @max_agg_bufsize: the maximal size of the AGG buffer for this station
- * @bt_reduced_txpower_dbg: debug mode in which %bt_reduced_txpower is forced
- *      by debugfs.
  * @bt_reduced_txpower: is reduced tx power enabled for this station
  * @next_status_eosp: the next reclaimed packet is a PS-Poll response and
  *      we need to signal the EOSP
@@ -309,7 +307,6 @@ struct iwl_mvm_sta {
         u32 mac_id_n_color;
         u16 tid_disable_agg;
         u8 max_agg_bufsize;
-        bool bt_reduced_txpower_dbg;
         bool bt_reduced_txpower;
         bool next_status_eosp;
         spinlock_t lock;
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
index a9402937f767..80100f6cc12a 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
@@ -312,7 +312,7 @@ static int iwl_mvm_time_event_send_add(struct iwl_mvm *mvm,
                                    ARRAY_SIZE(time_event_response),
                                    iwl_mvm_time_event_response, te_data);
 
-        ret = iwl_mvm_send_cmd_pdu(mvm, TIME_EVENT_CMD, CMD_SYNC,
+        ret = iwl_mvm_send_cmd_pdu(mvm, TIME_EVENT_CMD, 0,
                                             sizeof(*te_cmd), te_cmd);
         if (ret) {
                 IWL_ERR(mvm, "Couldn't send TIME_EVENT_CMD: %d\n", ret);
@@ -434,7 +434,7 @@ void iwl_mvm_remove_time_event(struct iwl_mvm *mvm,
                 cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id, mvmvif->color));
 
         IWL_DEBUG_TE(mvm, "Removing TE 0x%x\n", le32_to_cpu(time_cmd.id));
-        ret = iwl_mvm_send_cmd_pdu(mvm, TIME_EVENT_CMD, CMD_SYNC,
+        ret = iwl_mvm_send_cmd_pdu(mvm, TIME_EVENT_CMD, 0,
                                    sizeof(time_cmd), &time_cmd);
         if (WARN_ON(ret))
                 return;
diff --git a/drivers/net/wireless/iwlwifi/mvm/tt.c b/drivers/net/wireless/iwlwifi/mvm/tt.c
index 39a3e03a0acd..868561512783 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tt.c
@@ -409,7 +409,6 @@ void iwl_mvm_tt_tx_backoff(struct iwl_mvm *mvm, u32 backoff)
                 .id = REPLY_THERMAL_MNG_BACKOFF,
                 .len = { sizeof(u32), },
                 .data = { &backoff, },
-                .flags = CMD_SYNC,
         };
 
         backoff = max(backoff, mvm->thermal_throttle.min_backoff);
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index ff1b630e130e..3846a6c41eb1 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -958,7 +958,7 @@ int iwl_mvm_flush_tx_path(struct iwl_mvm *mvm, u32 tfd_msk, bool sync)
                 .flush_ctl = cpu_to_le16(DUMP_TX_FIFO_FLUSH),
         };
 
-        u32 flags = sync ? CMD_SYNC : CMD_ASYNC;
+        u32 flags = sync ? 0 : CMD_ASYNC;
 
         ret = iwl_mvm_send_cmd_pdu(mvm, TXPATH_FLUSH, flags,
                                    sizeof(flush_cmd), &flush_cmd);
diff --git a/drivers/net/wireless/iwlwifi/mvm/utils.c b/drivers/net/wireless/iwlwifi/mvm/utils.c
index eb2ca64820fc..aa9fc77e8413 100644
--- a/drivers/net/wireless/iwlwifi/mvm/utils.c
+++ b/drivers/net/wireless/iwlwifi/mvm/utils.c
@@ -144,7 +144,7 @@ int iwl_mvm_send_cmd_status(struct iwl_mvm *mvm, struct iwl_host_cmd *cmd,
                       "cmd flags %x", cmd->flags))
                 return -EINVAL;
 
-        cmd->flags |= CMD_SYNC | CMD_WANT_SKB;
+        cmd->flags |= CMD_WANT_SKB;
 
         ret = iwl_trans_send_cmd(mvm->trans, cmd);
         if (ret == -ERFKILL) {
@@ -519,6 +519,7 @@ void iwl_mvm_dump_nic_error_log(struct iwl_mvm *mvm)
                 iwl_mvm_dump_umac_error_log(mvm);
 }
 
+#ifdef CONFIG_IWLWIFI_DEBUGFS
 void iwl_mvm_fw_error_sram_dump(struct iwl_mvm *mvm)
 {
         const struct fw_img *img;
@@ -581,6 +582,7 @@ void iwl_mvm_fw_error_rxf_dump(struct iwl_mvm *mvm)
         }
         iwl_trans_release_nic_access(mvm->trans, &flags);
 }
+#endif
 
 /**
  * iwl_mvm_send_lq_cmd() - Send link quality command
@@ -597,7 +599,7 @@ int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq, bool init)
         struct iwl_host_cmd cmd = {
                 .id = LQ_CMD,
                 .len = { sizeof(struct iwl_lq_cmd), },
-                .flags = init ? CMD_SYNC : CMD_ASYNC,
+                .flags = init ? 0 : CMD_ASYNC,
                 .data = { lq, },
         };
 
@@ -648,6 +650,39 @@ void iwl_mvm_update_smps(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         ieee80211_request_smps(vif, smps_mode);
 }
 
+static void iwl_mvm_diversity_iter(void *_data, u8 *mac,
+                                   struct ieee80211_vif *vif)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        bool *result = _data;
+        int i;
+
+        for (i = 0; i < NUM_IWL_MVM_SMPS_REQ; i++) {
+                if (mvmvif->smps_requests[i] == IEEE80211_SMPS_STATIC ||
+                    mvmvif->smps_requests[i] == IEEE80211_SMPS_DYNAMIC)
+                        *result = false;
+        }
+}
+
+bool iwl_mvm_rx_diversity_allowed(struct iwl_mvm *mvm)
+{
+        bool result = true;
+
+        lockdep_assert_held(&mvm->mutex);
+
+        if (num_of_ant(mvm->fw->valid_rx_ant) == 1)
+                return false;
+
+        if (!mvm->cfg->rx_with_siso_diversity)
+                return false;
+
+        ieee80211_iterate_active_interfaces_atomic(
+                        mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
+                        iwl_mvm_diversity_iter, &result);
+
+        return result;
+}
+
 int iwl_mvm_update_low_latency(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                                bool value)
 {
@@ -667,7 +702,7 @@ int iwl_mvm_update_low_latency(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 
         iwl_mvm_bt_coex_vif_change(mvm);
 
-        return iwl_mvm_power_update_mac(mvm, vif);
+        return iwl_mvm_power_update_mac(mvm);
 }
 
 static void iwl_mvm_ll_iter(void *_data, u8 *mac, struct ieee80211_vif *vif)
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index 3d1d57f9f5bc..7091a18d5a72 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -417,7 +417,7 @@ static u64 splx_get_pwr_limit(struct iwl_trans *trans, union acpi_object *splx)
             splx->package.count != 2 ||
             splx->package.elements[0].type != ACPI_TYPE_INTEGER ||
             splx->package.elements[0].integer.value != 0) {
-                IWL_ERR(trans, "Unsupported splx structure");
+                IWL_ERR(trans, "Unsupported splx structure\n");
                 return 0;
         }
 
@@ -426,14 +426,14 @@ static u64 splx_get_pwr_limit(struct iwl_trans *trans, union acpi_object *splx)
             limits->package.count < 2 ||
             limits->package.elements[0].type != ACPI_TYPE_INTEGER ||
             limits->package.elements[1].type != ACPI_TYPE_INTEGER) {
-                IWL_ERR(trans, "Invalid limits element");
+                IWL_ERR(trans, "Invalid limits element\n");
                 return 0;
         }
 
         domain_type = &limits->package.elements[0];
         power_limit = &limits->package.elements[1];
         if (!(domain_type->integer.value & SPL_DOMAINTYPE_WIFI)) {
-                IWL_DEBUG_INFO(trans, "WiFi power is not limited");
+                IWL_DEBUG_INFO(trans, "WiFi power is not limited\n");
                 return 0;
         }
 
@@ -450,26 +450,26 @@ static void set_dflt_pwr_limit(struct iwl_trans *trans, struct pci_dev *pdev)
         pxsx_handle = ACPI_HANDLE(&pdev->dev);
         if (!pxsx_handle) {
                 IWL_DEBUG_INFO(trans,
-                               "Could not retrieve root port ACPI handle");
+                               "Could not retrieve root port ACPI handle\n");
                 return;
         }
 
         /* Get the method's handle */
         status = acpi_get_handle(pxsx_handle, (acpi_string)SPL_METHOD, &handle);
         if (ACPI_FAILURE(status)) {
-                IWL_DEBUG_INFO(trans, "SPL method not found");
+                IWL_DEBUG_INFO(trans, "SPL method not found\n");
                 return;
         }
 
         /* Call SPLC with no arguments */
         status = acpi_evaluate_object(handle, NULL, NULL, &splx);
         if (ACPI_FAILURE(status)) {
-                IWL_ERR(trans, "SPLC invocation failed (0x%x)", status);
+                IWL_ERR(trans, "SPLC invocation failed (0x%x)\n", status);
                 return;
         }
 
         trans->dflt_pwr_limit = splx_get_pwr_limit(trans, splx.pointer);
-        IWL_DEBUG_INFO(trans, "Default power limit set to %lld",
+        IWL_DEBUG_INFO(trans, "Default power limit set to %lld\n",
                        trans->dflt_pwr_limit);
         kfree(splx.pointer);
 }
diff --git a/drivers/net/wireless/iwlwifi/pcie/internal.h b/drivers/net/wireless/iwlwifi/pcie/internal.h
index 1b95d856dfd5..6c22b23a2845 100644
--- a/drivers/net/wireless/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/iwlwifi/pcie/internal.h
@@ -117,21 +117,19 @@ struct iwl_dma_ptr {
 /**
  * iwl_queue_inc_wrap - increment queue index, wrap back to beginning
  * @index -- current index
- * @n_bd -- total number of entries in queue (must be power of 2)
  */
-static inline int iwl_queue_inc_wrap(int index, int n_bd)
+static inline int iwl_queue_inc_wrap(int index)
 {
-        return ++index & (n_bd - 1);
+        return ++index & (TFD_QUEUE_SIZE_MAX - 1);
 }
 
 /**
  * iwl_queue_dec_wrap - decrement queue index, wrap back to end
  * @index -- current index
- * @n_bd -- total number of entries in queue (must be power of 2)
  */
-static inline int iwl_queue_dec_wrap(int index, int n_bd)
+static inline int iwl_queue_dec_wrap(int index)
 {
-        return --index & (n_bd - 1);
+        return --index & (TFD_QUEUE_SIZE_MAX - 1);
 }
 
 struct iwl_cmd_meta {
@@ -145,13 +143,13 @@ struct iwl_cmd_meta {
  *
  * Contains common data for Rx and Tx queues.
  *
- * Note the difference between n_bd and n_window: the hardware
- * always assumes 256 descriptors, so n_bd is always 256 (unless
+ * Note the difference between TFD_QUEUE_SIZE_MAX and n_window: the hardware
+ * always assumes 256 descriptors, so TFD_QUEUE_SIZE_MAX is always 256 (unless
  * there might be HW changes in the future). For the normal TX
  * queues, n_window, which is the size of the software queue data
  * is also 256; however, for the command queue, n_window is only
  * 32 since we don't need so many commands pending. Since the HW
- * still uses 256 BDs for DMA though, n_bd stays 256. As a result,
+ * still uses 256 BDs for DMA though, TFD_QUEUE_SIZE_MAX stays 256. As a result,
  * the software buffers (in the variables @meta, @txb in struct
  * iwl_txq) only have 32 entries, while the HW buffers (@tfds in
  * the same struct) have 256.
@@ -162,7 +160,6 @@ struct iwl_cmd_meta {
  * data is a window overlayed over the HW queue.
  */
 struct iwl_queue {
-        int n_bd;              /* number of BDs in this queue */
         int write_ptr;       /* 1-st empty entry (index) host_w*/
         int read_ptr;         /* last used entry (index) host_r*/
         /* use for monitoring and recovering the stuck queue */
@@ -373,6 +370,13 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
                             struct sk_buff_head *skbs);
 void iwl_trans_pcie_tx_reset(struct iwl_trans *trans);
 
+static inline u16 iwl_pcie_tfd_tb_get_len(struct iwl_tfd *tfd, u8 idx)
+{
+        struct iwl_tfd_tb *tb = &tfd->tbs[idx];
+
+        return le16_to_cpu(tb->hi_n_len) >> 4;
+}
+
 /*****************************************************
 * Error handling
 ******************************************************/
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index 4a26a082a1ba..a2698e5e062c 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -850,7 +850,7 @@ static u32 iwl_pcie_int_cause_ict(struct iwl_trans *trans)
                                 trans_pcie->ict_index, read);
                 trans_pcie->ict_tbl[trans_pcie->ict_index] = 0;
                 trans_pcie->ict_index =
-                        iwl_queue_inc_wrap(trans_pcie->ict_index, ICT_COUNT);
+                        ((trans_pcie->ict_index + 1) & (ICT_COUNT - 1));
 
                 read = le32_to_cpu(trans_pcie->ict_tbl[trans_pcie->ict_index]);
                 trace_iwlwifi_dev_ict_read(trans->dev, trans_pcie->ict_index,
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index c76b148e1aba..788085bc65d7 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -73,6 +73,7 @@
 #include "iwl-csr.h"
 #include "iwl-prph.h"
 #include "iwl-agn-hw.h"
+#include "iwl-fw-error-dump.h"
 #include "internal.h"
 
 static u32 iwl_trans_pcie_read_shr(struct iwl_trans *trans, u32 reg)
@@ -453,6 +454,7 @@ static int iwl_pcie_prepare_card_hw(struct iwl_trans *trans)
 {
         int ret;
         int t = 0;
+        int iter;
 
         IWL_DEBUG_INFO(trans, "iwl_trans_prepare_card_hw enter\n");
 
@@ -461,18 +463,23 @@ static int iwl_pcie_prepare_card_hw(struct iwl_trans *trans)
         if (ret >= 0)
                 return 0;
 
-        /* If HW is not ready, prepare the conditions to check again */
-        iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
-                    CSR_HW_IF_CONFIG_REG_PREPARE);
+        for (iter = 0; iter < 10; iter++) {
+                /* If HW is not ready, prepare the conditions to check again */
+                iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
+                            CSR_HW_IF_CONFIG_REG_PREPARE);
+
+                do {
+                        ret = iwl_pcie_set_hw_ready(trans);
+                        if (ret >= 0)
+                                return 0;
 
-        do {
-                ret = iwl_pcie_set_hw_ready(trans);
-                if (ret >= 0)
-                        return 0;
+                        usleep_range(200, 1000);
+                        t += 200;
+                } while (t < 150000);
+                msleep(25);
+        }
 
-                usleep_range(200, 1000);
-                t += 200;
-        } while (t < 150000);
+        IWL_DEBUG_INFO(trans, "got NIC after %d iterations\n", iter);
 
         return ret;
 }
@@ -1337,8 +1344,8 @@ static int iwl_trans_pcie_wait_txq_empty(struct iwl_trans *trans, u32 txq_bm)
                 IWL_ERR(trans,
                         "Q %d is %sactive and mapped to fifo %d ra_tid 0x%04x [%d,%d]\n",
                         cnt, active ? "" : "in", fifo, tbl_dw,
-                        iwl_read_prph(trans,
-                                      SCD_QUEUE_RDPTR(cnt)) & (txq->q.n_bd - 1),
+                        iwl_read_prph(trans, SCD_QUEUE_RDPTR(cnt)) &
+                                (TFD_QUEUE_SIZE_MAX - 1),
                         iwl_read_prph(trans, SCD_QUEUE_WRPTR(cnt)));
         }
 
@@ -1669,6 +1676,61 @@ err:
         IWL_ERR(trans, "failed to create the trans debugfs entry\n");
         return -ENOMEM;
 }
+
+static u32 iwl_trans_pcie_get_cmdlen(struct iwl_tfd *tfd)
+{
+        u32 cmdlen = 0;
+        int i;
+
+        for (i = 0; i < IWL_NUM_OF_TBS; i++)
+                cmdlen += iwl_pcie_tfd_tb_get_len(tfd, i);
+
+        return cmdlen;
+}
+
+static u32 iwl_trans_pcie_dump_data(struct iwl_trans *trans,
+                                    void *buf, u32 buflen)
+{
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        struct iwl_fw_error_dump_data *data;
+        struct iwl_txq *cmdq = &trans_pcie->txq[trans_pcie->cmd_queue];
+        struct iwl_fw_error_dump_txcmd *txcmd;
+        u32 len;
+        int i, ptr;
+
+        if (!buf)
+                return sizeof(*data) +
+                       cmdq->q.n_window * (sizeof(*txcmd) +
+                                           TFD_MAX_PAYLOAD_SIZE);
+
+        len = 0;
+        data = buf;
+        data->type = cpu_to_le32(IWL_FW_ERROR_DUMP_TXCMD);
+        txcmd = (void *)data->data;
+        spin_lock_bh(&cmdq->lock);
+        ptr = cmdq->q.write_ptr;
+        for (i = 0; i < cmdq->q.n_window; i++) {
+                u8 idx = get_cmd_index(&cmdq->q, ptr);
+                u32 caplen, cmdlen;
+
+                cmdlen = iwl_trans_pcie_get_cmdlen(&cmdq->tfds[ptr]);
+                caplen = min_t(u32, TFD_MAX_PAYLOAD_SIZE, cmdlen);
+
+                if (cmdlen) {
+                        len += sizeof(*txcmd) + caplen;
+                        txcmd->cmdlen = cpu_to_le32(cmdlen);
+                        txcmd->caplen = cpu_to_le32(caplen);
+                        memcpy(txcmd->data, cmdq->entries[idx].cmd, caplen);
+                        txcmd = (void *)((u8 *)txcmd->data + caplen);
+                }
+
+                ptr = iwl_queue_dec_wrap(ptr);
+        }
+        spin_unlock_bh(&cmdq->lock);
+
+        data->len = cpu_to_le32(len);
+        return sizeof(*data) + len;
+}
 #else
 static int iwl_trans_pcie_dbgfs_register(struct iwl_trans *trans,
                                          struct dentry *dir)
@@ -1711,6 +1773,10 @@ static const struct iwl_trans_ops trans_ops_pcie = {
         .grab_nic_access = iwl_trans_pcie_grab_nic_access,
         .release_nic_access = iwl_trans_pcie_release_nic_access,
         .set_bits_mask = iwl_trans_pcie_set_bits_mask,
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        .dump_data = iwl_trans_pcie_dump_data,
+#endif
 };
 
 struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index dde6031f4257..038940afbdc5 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -70,20 +70,20 @@ static int iwl_queue_space(const struct iwl_queue *q)
 
         /*
          * To avoid ambiguity between empty and completely full queues, there
-         * should always be less than q->n_bd elements in the queue.
-         * If q->n_window is smaller than q->n_bd, there is no need to reserve
-         * any queue entries for this purpose.
+         * should always be less than TFD_QUEUE_SIZE_MAX elements in the queue.
+         * If q->n_window is smaller than TFD_QUEUE_SIZE_MAX, there is no need
+         * to reserve any queue entries for this purpose.
          */
-        if (q->n_window < q->n_bd)
+        if (q->n_window < TFD_QUEUE_SIZE_MAX)
                 max = q->n_window;
         else
-                max = q->n_bd - 1;
+                max = TFD_QUEUE_SIZE_MAX - 1;
 
         /*
-         * q->n_bd is a power of 2, so the following is equivalent to modulo by
-         * q->n_bd and is well defined for negative dividends.
+         * TFD_QUEUE_SIZE_MAX is a power of 2, so the following is equivalent to
+         * modulo by TFD_QUEUE_SIZE_MAX and is well defined.
          */
-        used = (q->write_ptr - q->read_ptr) & (q->n_bd - 1);
+        used = (q->write_ptr - q->read_ptr) & (TFD_QUEUE_SIZE_MAX - 1);
 
         if (WARN_ON(used > max))
                 return 0;
@@ -94,17 +94,11 @@ static int iwl_queue_space(const struct iwl_queue *q)
 /*
  * iwl_queue_init - Initialize queue's high/low-water and read/write indexes
  */
-static int iwl_queue_init(struct iwl_queue *q, int count, int slots_num, u32 id)
+static int iwl_queue_init(struct iwl_queue *q, int slots_num, u32 id)
 {
-        q->n_bd = count;
         q->n_window = slots_num;
         q->id = id;
 
-        /* count must be power-of-two size, otherwise iwl_queue_inc_wrap
-         * and iwl_queue_dec_wrap are broken. */
-        if (WARN_ON(!is_power_of_2(count)))
-                return -EINVAL;
-
         /* slots_num must be power-of-two size, otherwise
          * get_cmd_index is broken. */
         if (WARN_ON(!is_power_of_2(slots_num)))
@@ -197,17 +191,17 @@ static void iwl_pcie_txq_stuck_timer(unsigned long data)
                 IWL_ERR(trans,
                         "Q %d is %sactive and mapped to fifo %d ra_tid 0x%04x [%d,%d]\n",
                         i, active ? "" : "in", fifo, tbl_dw,
-                        iwl_read_prph(trans,
-                                      SCD_QUEUE_RDPTR(i)) & (txq->q.n_bd - 1),
+                        iwl_read_prph(trans, SCD_QUEUE_RDPTR(i)) &
+                                (TFD_QUEUE_SIZE_MAX - 1),
                         iwl_read_prph(trans, SCD_QUEUE_WRPTR(i)));
         }
 
         for (i = q->read_ptr; i != q->write_ptr;
-             i = iwl_queue_inc_wrap(i, q->n_bd))
+             i = iwl_queue_inc_wrap(i))
                 IWL_ERR(trans, "scratch %d = 0x%08x\n", i,
                         le32_to_cpu(txq->scratchbufs[i].scratch));
 
-        iwl_write_prph(trans, DEVICE_SET_NMI_REG, 1);
+        iwl_force_nmi(trans);
 }
 
 /*
@@ -338,12 +332,12 @@ void iwl_pcie_txq_check_wrptrs(struct iwl_trans *trans)
         for (i = 0; i < trans->cfg->base_params->num_of_queues; i++) {
                 struct iwl_txq *txq = &trans_pcie->txq[i];
 
-                spin_lock(&txq->lock);
+                spin_lock_bh(&txq->lock);
                 if (trans_pcie->txq[i].need_update) {
                         iwl_pcie_txq_inc_wr_ptr(trans, txq);
                         trans_pcie->txq[i].need_update = false;
                 }
-                spin_unlock(&txq->lock);
+                spin_unlock_bh(&txq->lock);
         }
 }
 
@@ -359,13 +353,6 @@ static inline dma_addr_t iwl_pcie_tfd_tb_get_addr(struct iwl_tfd *tfd, u8 idx)
         return addr;
 }
 
-static inline u16 iwl_pcie_tfd_tb_get_len(struct iwl_tfd *tfd, u8 idx)
-{
-        struct iwl_tfd_tb *tb = &tfd->tbs[idx];
-
-        return le16_to_cpu(tb->hi_n_len) >> 4;
-}
-
 static inline void iwl_pcie_tfd_set_tb(struct iwl_tfd *tfd, u8 idx,
                                        dma_addr_t addr, u16 len)
 {
@@ -425,13 +412,17 @@ static void iwl_pcie_txq_free_tfd(struct iwl_trans *trans, struct iwl_txq *txq)
 {
         struct iwl_tfd *tfd_tmp = txq->tfds;
 
-        /* rd_ptr is bounded by n_bd and idx is bounded by n_window */
+        /* rd_ptr is bounded by TFD_QUEUE_SIZE_MAX and
+         * idx is bounded by n_window
+         */
         int rd_ptr = txq->q.read_ptr;
         int idx = get_cmd_index(&txq->q, rd_ptr);
 
         lockdep_assert_held(&txq->lock);
 
-        /* We have only q->n_window txq->entries, but we use q->n_bd tfds */
+        /* We have only q->n_window txq->entries, but we use
+         * TFD_QUEUE_SIZE_MAX tfds
+         */
         iwl_pcie_tfd_unmap(trans, &txq->entries[idx].meta, &tfd_tmp[rd_ptr]);
 
         /* free SKB */
@@ -452,7 +443,7 @@ static void iwl_pcie_txq_free_tfd(struct iwl_trans *trans, struct iwl_txq *txq)
 }
 
 static int iwl_pcie_txq_build_tfd(struct iwl_trans *trans, struct iwl_txq *txq,
-                                  dma_addr_t addr, u16 len, u8 reset)
+                                  dma_addr_t addr, u16 len, bool reset)
 {
         struct iwl_queue *q;
         struct iwl_tfd *tfd, *tfd_tmp;
@@ -565,8 +556,7 @@ static int iwl_pcie_txq_init(struct iwl_trans *trans, struct iwl_txq *txq,
         BUILD_BUG_ON(TFD_QUEUE_SIZE_MAX & (TFD_QUEUE_SIZE_MAX - 1));
 
         /* Initialize queue's high/low-water marks, and head/tail indexes */
-        ret = iwl_queue_init(&txq->q, TFD_QUEUE_SIZE_MAX, slots_num,
-                        txq_id);
+        ret = iwl_queue_init(&txq->q, slots_num, txq_id);
         if (ret)
                 return ret;
 
@@ -591,15 +581,12 @@ static void iwl_pcie_txq_unmap(struct iwl_trans *trans, int txq_id)
         struct iwl_txq *txq = &trans_pcie->txq[txq_id];
         struct iwl_queue *q = &txq->q;
 
-        if (!q->n_bd)
-                return;
-
         spin_lock_bh(&txq->lock);
         while (q->write_ptr != q->read_ptr) {
                 IWL_DEBUG_TX_REPLY(trans, "Q %d Free %d\n",
                                    txq_id, q->read_ptr);
                 iwl_pcie_txq_free_tfd(trans, txq);
-                q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd);
+                q->read_ptr = iwl_queue_inc_wrap(q->read_ptr);
         }
         txq->active = false;
         spin_unlock_bh(&txq->lock);
@@ -636,10 +623,12 @@ static void iwl_pcie_txq_free(struct iwl_trans *trans, int txq_id)
                 }
 
         /* De-alloc circular buffer of TFDs */
-        if (txq->q.n_bd) {
-                dma_free_coherent(dev, sizeof(struct iwl_tfd) *
-                                  txq->q.n_bd, txq->tfds, txq->q.dma_addr);
+        if (txq->tfds) {
+                dma_free_coherent(dev,
+                                  sizeof(struct iwl_tfd) * TFD_QUEUE_SIZE_MAX,
+                                  txq->tfds, txq->q.dma_addr);
                 txq->q.dma_addr = 0;
+                txq->tfds = NULL;
 
                 dma_free_coherent(dev,
                                   sizeof(*txq->scratchbufs) * txq->q.n_window,
@@ -948,8 +937,7 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_txq *txq = &trans_pcie->txq[txq_id];
-        /* n_bd is usually 256 => n_bd - 1 = 0xff */
-        int tfd_num = ssn & (txq->q.n_bd - 1);
+        int tfd_num = ssn & (TFD_QUEUE_SIZE_MAX - 1);
         struct iwl_queue *q = &txq->q;
         int last_to_free;
 
@@ -973,12 +961,12 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
 
         /*Since we free until index _not_ inclusive, the one before index is
          * the last we will free. This one must be used */
-        last_to_free = iwl_queue_dec_wrap(tfd_num, q->n_bd);
+        last_to_free = iwl_queue_dec_wrap(tfd_num);
 
         if (!iwl_queue_used(q, last_to_free)) {
                 IWL_ERR(trans,
                         "%s: Read index for DMA queue txq id (%d), last_to_free %d is out of range [0-%d] %d %d.\n",
-                        __func__, txq_id, last_to_free, q->n_bd,
+                        __func__, txq_id, last_to_free, TFD_QUEUE_SIZE_MAX,
                         q->write_ptr, q->read_ptr);
                 goto out;
         }
@@ -988,7 +976,7 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
 
         for (;
              q->read_ptr != tfd_num;
-             q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
+             q->read_ptr = iwl_queue_inc_wrap(q->read_ptr)) {
 
                 if (WARN_ON_ONCE(txq->entries[txq->q.read_ptr].skb == NULL))
                         continue;
@@ -1027,21 +1015,21 @@ static void iwl_pcie_cmdq_reclaim(struct iwl_trans *trans, int txq_id, int idx)
 
         lockdep_assert_held(&txq->lock);
 
-        if ((idx >= q->n_bd) || (!iwl_queue_used(q, idx))) {
+        if ((idx >= TFD_QUEUE_SIZE_MAX) || (!iwl_queue_used(q, idx))) {
                 IWL_ERR(trans,
                         "%s: Read index for DMA queue txq id (%d), index %d is out of range [0-%d] %d %d.\n",
-                        __func__, txq_id, idx, q->n_bd,
+                        __func__, txq_id, idx, TFD_QUEUE_SIZE_MAX,
                         q->write_ptr, q->read_ptr);
                 return;
         }
 
-        for (idx = iwl_queue_inc_wrap(idx, q->n_bd); q->read_ptr != idx;
-             q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
+        for (idx = iwl_queue_inc_wrap(idx); q->read_ptr != idx;
+             q->read_ptr = iwl_queue_inc_wrap(q->read_ptr)) {
 
                 if (nfreed++ > 0) {
                         IWL_ERR(trans, "HCMD skipped: index (%d) %d %d\n",
                                 idx, q->write_ptr, q->read_ptr);
-                        iwl_write_prph(trans, DEVICE_SET_NMI_REG, 1);
+                        iwl_force_nmi(trans);
                 }
         }
 
@@ -1327,28 +1315,39 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
         cmd_pos = offsetof(struct iwl_device_cmd, payload);
         copy_size = sizeof(out_cmd->hdr);
         for (i = 0; i < IWL_MAX_CMD_TBS_PER_TFD; i++) {
-                int copy = 0;
+                int copy;
 
                 if (!cmd->len[i])
                         continue;
 
-                /* need at least IWL_HCMD_SCRATCHBUF_SIZE copied */
-                if (copy_size < IWL_HCMD_SCRATCHBUF_SIZE) {
-                        copy = IWL_HCMD_SCRATCHBUF_SIZE - copy_size;
-
-                        if (copy > cmd->len[i])
-                                copy = cmd->len[i];
-                }
-
                 /* copy everything if not nocopy/dup */
                 if (!(cmd->dataflags[i] & (IWL_HCMD_DFL_NOCOPY |
-                                           IWL_HCMD_DFL_DUP)))
+                                           IWL_HCMD_DFL_DUP))) {
                         copy = cmd->len[i];
 
-                if (copy) {
                         memcpy((u8 *)out_cmd + cmd_pos, cmd->data[i], copy);
                         cmd_pos += copy;
                         copy_size += copy;
+                        continue;
+                }
+
+                /*
+                 * Otherwise we need at least IWL_HCMD_SCRATCHBUF_SIZE copied
+                 * in total (for the scratchbuf handling), but copy up to what
+                 * we can fit into the payload for debug dump purposes.
+                 */
+                copy = min_t(int, TFD_MAX_PAYLOAD_SIZE - cmd_pos, cmd->len[i]);
+
+                memcpy((u8 *)out_cmd + cmd_pos, cmd->data[i], copy);
+                cmd_pos += copy;
+
+                /* However, treat copy_size the proper way, we need it below */
+                if (copy_size < IWL_HCMD_SCRATCHBUF_SIZE) {
+                        copy = IWL_HCMD_SCRATCHBUF_SIZE - copy_size;
+
+                        if (copy > cmd->len[i])
+                                copy = cmd->len[i];
+                        copy_size += copy;
                 }
         }
 
@@ -1363,7 +1362,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
         memcpy(&txq->scratchbufs[q->write_ptr], &out_cmd->hdr, scratch_size);
         iwl_pcie_txq_build_tfd(trans, txq,
                                iwl_pcie_get_scratchbuf_dma(txq, q->write_ptr),
-                               scratch_size, 1);
+                               scratch_size, true);
 
         /* map first command fragment, if any remains */
         if (copy_size > scratch_size) {
@@ -1379,7 +1378,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
                 }
 
                 iwl_pcie_txq_build_tfd(trans, txq, phys_addr,
-                                       copy_size - scratch_size, 0);
+                                       copy_size - scratch_size, false);
         }
 
         /* map the remaining (adjusted) nocopy/dup fragments */
@@ -1402,7 +1401,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
                         goto out;
                 }
 
-                iwl_pcie_txq_build_tfd(trans, txq, phys_addr, cmdlen[i], 0);
+                iwl_pcie_txq_build_tfd(trans, txq, phys_addr, cmdlen[i], false);
         }
 
         out_meta->flags = cmd->flags;
@@ -1445,7 +1444,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
         }
 
         /* Increment and update queue's write index */
-        q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
+        q->write_ptr = iwl_queue_inc_wrap(q->write_ptr);
         iwl_pcie_txq_inc_wr_ptr(trans, txq);
 
         spin_unlock_irqrestore(&trans_pcie->reg_lock, flags);
@@ -1601,7 +1600,7 @@ static int iwl_pcie_send_hcmd_sync(struct iwl_trans *trans,
                                get_cmd_string(trans_pcie, cmd->id));
                 ret = -ETIMEDOUT;
 
-                iwl_write_prph(trans, DEVICE_SET_NMI_REG, 1);
+                iwl_force_nmi(trans);
                 iwl_trans_fw_error(trans);
 
                 goto cancel;
@@ -1740,7 +1739,7 @@ int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
         memcpy(&txq->scratchbufs[q->write_ptr], &dev_cmd->hdr,
                IWL_HCMD_SCRATCHBUF_SIZE);
         iwl_pcie_txq_build_tfd(trans, txq, tb0_phys,
-                               IWL_HCMD_SCRATCHBUF_SIZE, 1);
+                               IWL_HCMD_SCRATCHBUF_SIZE, true);
 
         /* there must be data left over for TB1 or this code must be changed */
         BUILD_BUG_ON(sizeof(struct iwl_tx_cmd) < IWL_HCMD_SCRATCHBUF_SIZE);
@@ -1750,7 +1749,7 @@ int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
         tb1_phys = dma_map_single(trans->dev, tb1_addr, tb1_len, DMA_TO_DEVICE);
         if (unlikely(dma_mapping_error(trans->dev, tb1_phys)))
                 goto out_err;
-        iwl_pcie_txq_build_tfd(trans, txq, tb1_phys, tb1_len, 0);
+        iwl_pcie_txq_build_tfd(trans, txq, tb1_phys, tb1_len, false);
 
         /*
          * Set up TFD's third entry to point directly to remainder
@@ -1766,7 +1765,7 @@ int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
                                            &txq->tfds[q->write_ptr]);
                         goto out_err;
                 }
-                iwl_pcie_txq_build_tfd(trans, txq, tb2_phys, tb2_len, 0);
+                iwl_pcie_txq_build_tfd(trans, txq, tb2_phys, tb2_len, false);
         }
 
         /* Set up entry for this TFD in Tx byte-count array */
@@ -1788,7 +1787,7 @@ int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
                 mod_timer(&txq->stuck_timer, jiffies + trans_pcie->wd_timeout);
 
         /* Tell device the write index *just past* this latest filled TFD */
-        q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
+        q->write_ptr = iwl_queue_inc_wrap(q->write_ptr);
         if (!wait_write_ptr)
                 iwl_pcie_txq_inc_wr_ptr(trans, txq);
 
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index 54e344aed6e0..47a998d8f99e 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -1006,9 +1006,8 @@ struct cmd_key_material {
 } __packed;
 
 static int lbs_set_key_material(struct lbs_private *priv,
-                                int key_type,
-                                int key_info,
-                                u8 *key, u16 key_len)
+                                int key_type, int key_info,
+                                const u8 *key, u16 key_len)
 {
         struct cmd_key_material cmd;
         int ret;
@@ -1610,7 +1609,7 @@ static int lbs_cfg_del_key(struct wiphy *wiphy, struct net_device *netdev,
  */
 
 static int lbs_cfg_get_station(struct wiphy *wiphy, struct net_device *dev,
-                              u8 *mac, struct station_info *sinfo)
+                               const u8 *mac, struct station_info *sinfo)
 {
         struct lbs_private *priv = wiphy_priv(wiphy);
         s8 signal, noise;
diff --git a/drivers/net/wireless/libertas/defs.h b/drivers/net/wireless/libertas/defs.h
index ab966f08024a..407784aca627 100644
--- a/drivers/net/wireless/libertas/defs.h
+++ b/drivers/net/wireless/libertas/defs.h
@@ -90,7 +90,8 @@ do { if ((lbs_debug & (grp)) == (grp)) \
 #define lbs_deb_cfg80211(fmt, args...)  LBS_DEB_LL(LBS_DEB_CFG80211, " cfg80211", fmt, ##args)
 
 #ifdef DEBUG
-static inline void lbs_deb_hex(unsigned int grp, const char *prompt, u8 *buf, int len)
+static inline void lbs_deb_hex(unsigned int grp, const char *prompt,
+                               const u8 *buf, int len)
 {
         int i = 0;
 
diff --git a/drivers/net/wireless/libertas/rx.c b/drivers/net/wireless/libertas/rx.c
index c7366b07b568..e446fed7b345 100644
--- a/drivers/net/wireless/libertas/rx.c
+++ b/drivers/net/wireless/libertas/rx.c
@@ -71,8 +71,10 @@ int lbs_process_rxed_packet(struct lbs_private *priv, struct sk_buff *skb)
 
         skb->ip_summed = CHECKSUM_NONE;
 
-        if (priv->wdev->iftype == NL80211_IFTYPE_MONITOR)
-                return process_rxed_802_11_packet(priv, skb);
+        if (priv->wdev->iftype == NL80211_IFTYPE_MONITOR) {
+                ret = process_rxed_802_11_packet(priv, skb);
+                goto done;
+        }
 
         p_rx_pd = (struct rxpd *) skb->data;
         p_rx_pkt = (struct rxpackethdr *) ((u8 *)p_rx_pd +
@@ -86,7 +88,7 @@ int lbs_process_rxed_packet(struct lbs_private *priv, struct sk_buff *skb)
         if (skb->len < (ETH_HLEN + 8 + sizeof(struct rxpd))) {
                 lbs_deb_rx("rx err: frame received with bad length\n");
                 dev->stats.rx_length_errors++;
-                ret = 0;
+                ret = -EINVAL;
                 dev_kfree_skb(skb);
                 goto done;
         }
diff --git a/drivers/net/wireless/mwifiex/11n.c b/drivers/net/wireless/mwifiex/11n.c
index 2bd07d681c5e..e1c2f67ae85e 100644
--- a/drivers/net/wireless/mwifiex/11n.c
+++ b/drivers/net/wireless/mwifiex/11n.c
@@ -749,3 +749,45 @@ void mwifiex_set_ba_params(struct mwifiex_private *priv)
 
         return;
 }
+
+u8 mwifiex_get_sec_chan_offset(int chan)
+{
+        u8 sec_offset;
+
+        switch (chan) {
+        case 36:
+        case 44:
+        case 52:
+        case 60:
+        case 100:
+        case 108:
+        case 116:
+        case 124:
+        case 132:
+        case 140:
+        case 149:
+        case 157:
+                sec_offset = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
+                break;
+        case 40:
+        case 48:
+        case 56:
+        case 64:
+        case 104:
+        case 112:
+        case 120:
+        case 128:
+        case 136:
+        case 144:
+        case 153:
+        case 161:
+                sec_offset = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
+                break;
+        case 165:
+        default:
+                sec_offset = IEEE80211_HT_PARAM_CHA_SEC_NONE;
+                break;
+        }
+
+        return sec_offset;
+}
diff --git a/drivers/net/wireless/mwifiex/11n.h b/drivers/net/wireless/mwifiex/11n.h
index 40b007a00f4b..0b73fa08f5d4 100644
--- a/drivers/net/wireless/mwifiex/11n.h
+++ b/drivers/net/wireless/mwifiex/11n.h
@@ -63,6 +63,7 @@ int mwifiex_cmd_amsdu_aggr_ctrl(struct host_cmd_ds_command *cmd,
                                 int cmd_action,
                                 struct mwifiex_ds_11n_amsdu_aggr_ctrl *aa_ctrl);
 void mwifiex_del_tx_ba_stream_tbl_by_ra(struct mwifiex_private *priv, u8 *ra);
+u8 mwifiex_get_sec_chan_offset(int chan);
 
 static inline u8
 mwifiex_is_station_ampdu_allowed(struct mwifiex_private *priv,
@@ -199,7 +200,7 @@ static inline int mwifiex_is_sta_11n_enabled(struct mwifiex_private *priv,
 }
 
 static inline u8
-mwifiex_tdls_peer_11n_enabled(struct mwifiex_private *priv, u8 *ra)
+mwifiex_tdls_peer_11n_enabled(struct mwifiex_private *priv, const u8 *ra)
 {
         struct mwifiex_sta_node *node = mwifiex_get_sta_entry(priv, ra);
         if (node)
diff --git a/drivers/net/wireless/mwifiex/11n_aggr.c b/drivers/net/wireless/mwifiex/11n_aggr.c
index 860dfe71cf96..5b32106182f8 100644
--- a/drivers/net/wireless/mwifiex/11n_aggr.c
+++ b/drivers/net/wireless/mwifiex/11n_aggr.c
@@ -100,6 +100,7 @@ mwifiex_11n_form_amsdu_txpd(struct mwifiex_private *priv,
                             struct sk_buff *skb)
 {
         struct txpd *local_tx_pd;
+        struct mwifiex_txinfo *tx_info = MWIFIEX_SKB_TXCB(skb);
 
         skb_push(skb, sizeof(*local_tx_pd));
 
@@ -118,6 +119,9 @@ mwifiex_11n_form_amsdu_txpd(struct mwifiex_private *priv,
         local_tx_pd->tx_pkt_length = cpu_to_le16(skb->len -
                                                  sizeof(*local_tx_pd));
 
+        if (tx_info->flags & MWIFIEX_BUF_FLAG_TDLS_PKT)
+                local_tx_pd->flags |= MWIFIEX_TXPD_FLAGS_TDLS_PACKET;
+
         if (local_tx_pd->tx_control == 0)
                 /* TxCtrl set by user or default */
                 local_tx_pd->tx_control = cpu_to_le32(priv->pkt_tx_ctrl);
@@ -183,6 +187,9 @@ mwifiex_11n_aggregate_pkt(struct mwifiex_private *priv,
 
         tx_info_aggr->bss_type = tx_info_src->bss_type;
         tx_info_aggr->bss_num = tx_info_src->bss_num;
+
+        if (tx_info_src->flags & MWIFIEX_BUF_FLAG_TDLS_PKT)
+                tx_info_aggr->flags |= MWIFIEX_BUF_FLAG_TDLS_PKT;
         skb_aggr->priority = skb_src->priority;
 
         do_gettimeofday(&tv);
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index 21ee27ab7b74..e95dec91a561 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -994,7 +994,7 @@ mwifiex_dump_station_info(struct mwifiex_private *priv,
  */
 static int
 mwifiex_cfg80211_get_station(struct wiphy *wiphy, struct net_device *dev,
-                             u8 *mac, struct station_info *sinfo)
+                             const u8 *mac, struct station_info *sinfo)
 {
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
 
@@ -1270,7 +1270,7 @@ static int mwifiex_cfg80211_change_beacon(struct wiphy *wiphy,
  */
 static int
 mwifiex_cfg80211_del_station(struct wiphy *wiphy, struct net_device *dev,
-                             u8 *mac)
+                             const u8 *mac)
 {
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
         struct mwifiex_sta_node *sta_node;
@@ -2629,7 +2629,7 @@ static int mwifiex_cfg80211_set_coalesce(struct wiphy *wiphy,
  */
 static int
 mwifiex_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
-                           u8 *peer, u8 action_code, u8 dialog_token,
+                           const u8 *peer, u8 action_code, u8 dialog_token,
                            u16 status_code, u32 peer_capability,
                            const u8 *extra_ies, size_t extra_ies_len)
 {
@@ -2701,7 +2701,7 @@ mwifiex_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
 
 static int
 mwifiex_cfg80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
-                           u8 *peer, enum nl80211_tdls_operation action)
+                           const u8 *peer, enum nl80211_tdls_operation action)
 {
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
 
@@ -2748,9 +2748,8 @@ mwifiex_cfg80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
 }
 
 static int
-mwifiex_cfg80211_add_station(struct wiphy *wiphy,
-                             struct net_device *dev,
-                             u8 *mac, struct station_parameters *params)
+mwifiex_cfg80211_add_station(struct wiphy *wiphy, struct net_device *dev,
+                             const u8 *mac, struct station_parameters *params)
 {
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
 
@@ -2765,9 +2764,9 @@ mwifiex_cfg80211_add_station(struct wiphy *wiphy,
 }
 
 static int
-mwifiex_cfg80211_change_station(struct wiphy *wiphy,
-                                struct net_device *dev,
-                                u8 *mac, struct station_parameters *params)
+mwifiex_cfg80211_change_station(struct wiphy *wiphy, struct net_device *dev,
+                                const u8 *mac,
+                                struct station_parameters *params)
 {
         int ret;
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
index b485dc1ae5eb..42eaeda1dc82 100644
--- a/drivers/net/wireless/mwifiex/fw.h
+++ b/drivers/net/wireless/mwifiex/fw.h
@@ -169,6 +169,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 #define TLV_TYPE_GWK_CIPHER         (PROPRIETARY_TLV_BASE_ID + 146)
 #define TLV_TYPE_COALESCE_RULE      (PROPRIETARY_TLV_BASE_ID + 154)
 #define TLV_TYPE_KEY_PARAM_V2       (PROPRIETARY_TLV_BASE_ID + 156)
+#define TLV_TYPE_TDLS_IDLE_TIMEOUT  (PROPRIETARY_TLV_BASE_ID + 194)
 #define TLV_TYPE_FW_API_REV         (PROPRIETARY_TLV_BASE_ID + 199)
 
 #define MWIFIEX_TX_DATA_BUF_SIZE_2K        2048
@@ -229,6 +230,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 #define ISENABLED_40MHZ_INTOLERANT(Dot11nDevCap) (Dot11nDevCap & BIT(8))
 #define ISSUPP_RXLDPC(Dot11nDevCap) (Dot11nDevCap & BIT(22))
 #define ISSUPP_BEAMFORMING(Dot11nDevCap) (Dot11nDevCap & BIT(30))
+#define ISALLOWED_CHANWIDTH40(ht_param) (ht_param & BIT(2))
 
 /* httxcfg bitmap
  * 0            reserved
@@ -487,6 +489,7 @@ enum P2P_MODES {
 #define EVENT_UAP_MIC_COUNTERMEASURES   0x0000004c
 #define EVENT_HOSTWAKE_STAIE            0x0000004d
 #define EVENT_CHANNEL_SWITCH_ANN        0x00000050
+#define EVENT_TDLS_GENERIC_EVENT        0x00000052
 #define EVENT_EXT_SCAN_REPORT           0x00000058
 #define EVENT_REMAIN_ON_CHAN_EXPIRED    0x0000005f
 
@@ -519,6 +522,7 @@ enum P2P_MODES {
 #define ACT_TDLS_DELETE            0x00
 #define ACT_TDLS_CREATE            0x01
 #define ACT_TDLS_CONFIG            0x02
+#define TDLS_EVENT_LINK_TEAR_DOWN  3
 
 #define MWIFIEX_FW_V15             15
 
@@ -535,6 +539,7 @@ struct mwifiex_ie_types_data {
 #define MWIFIEX_TxPD_POWER_MGMT_NULL_PACKET 0x01
 #define MWIFIEX_TxPD_POWER_MGMT_LAST_PACKET 0x08
 #define MWIFIEX_TXPD_FLAGS_TDLS_PACKET      0x10
+#define MWIFIEX_RXPD_FLAGS_TDLS_PACKET      0x01
 
 struct txpd {
         u8 bss_type;
@@ -577,7 +582,7 @@ struct rxpd {
          * [Bit 7] Reserved
          */
         u8 ht_info;
-        u8 reserved;
+        u8 flags;
 } __packed;
 
 struct uap_txpd {
@@ -708,6 +713,13 @@ struct mwifiex_ie_types_vendor_param_set {
         u8 ie[MWIFIEX_MAX_VSIE_LEN];
 };
 
+#define MWIFIEX_TDLS_IDLE_TIMEOUT       60
+
+struct mwifiex_ie_types_tdls_idle_timeout {
+        struct mwifiex_ie_types_header header;
+        __le16 value;
+} __packed;
+
 struct mwifiex_ie_types_rsn_param_set {
         struct mwifiex_ie_types_header header;
         u8 rsn_ie[1];
@@ -1745,6 +1757,15 @@ struct host_cmd_ds_802_11_subsc_evt {
         __le16 events;
 } __packed;
 
+struct mwifiex_tdls_generic_event {
+        __le16 type;
+        u8 peer_mac[ETH_ALEN];
+        union {
+                __le16 reason_code;
+                __le16 reserved;
+        } u;
+} __packed;
+
 struct mwifiex_ie {
         __le16 ie_index;
         __le16 mgmt_subtype_mask;
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index 34181192a666..3f25feb1508e 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -910,8 +910,6 @@ int mwifiex_handle_uap_rx_forward(struct mwifiex_private *priv,
                                   struct sk_buff *skb);
 int mwifiex_process_sta_event(struct mwifiex_private *);
 int mwifiex_process_uap_event(struct mwifiex_private *);
-struct mwifiex_sta_node *
-mwifiex_get_sta_entry(struct mwifiex_private *priv, u8 *mac);
 void mwifiex_delete_all_station_list(struct mwifiex_private *priv);
 void *mwifiex_process_sta_txpd(struct mwifiex_private *, struct sk_buff *skb);
 void *mwifiex_process_uap_txpd(struct mwifiex_private *, struct sk_buff *skb);
@@ -1220,26 +1218,26 @@ void mwifiex_dnld_txpwr_table(struct mwifiex_private *priv);
 extern const struct ethtool_ops mwifiex_ethtool_ops;
 
 void mwifiex_del_all_sta_list(struct mwifiex_private *priv);
-void mwifiex_del_sta_entry(struct mwifiex_private *priv, u8 *mac);
+void mwifiex_del_sta_entry(struct mwifiex_private *priv, const u8 *mac);
 void
 mwifiex_set_sta_ht_cap(struct mwifiex_private *priv, const u8 *ies,
                        int ies_len, struct mwifiex_sta_node *node);
 struct mwifiex_sta_node *
-mwifiex_add_sta_entry(struct mwifiex_private *priv, u8 *mac);
+mwifiex_add_sta_entry(struct mwifiex_private *priv, const u8 *mac);
 struct mwifiex_sta_node *
-mwifiex_get_sta_entry(struct mwifiex_private *priv, u8 *mac);
-int mwifiex_send_tdls_data_frame(struct mwifiex_private *priv, u8 *peer,
+mwifiex_get_sta_entry(struct mwifiex_private *priv, const u8 *mac);
+int mwifiex_send_tdls_data_frame(struct mwifiex_private *priv, const u8 *peer,
                                  u8 action_code, u8 dialog_token,
                                  u16 status_code, const u8 *extra_ies,
                                  size_t extra_ies_len);
-int mwifiex_send_tdls_action_frame(struct mwifiex_private *priv,
-                                 u8 *peer, u8 action_code, u8 dialog_token,
-                                 u16 status_code, const u8 *extra_ies,
-                                 size_t extra_ies_len);
+int mwifiex_send_tdls_action_frame(struct mwifiex_private *priv, const u8 *peer,
+                                   u8 action_code, u8 dialog_token,
+                                   u16 status_code, const u8 *extra_ies,
+                                   size_t extra_ies_len);
 void mwifiex_process_tdls_action_frame(struct mwifiex_private *priv,
                                        u8 *buf, int len);
-int mwifiex_tdls_oper(struct mwifiex_private *priv, u8 *peer, u8 action);
-int mwifiex_get_tdls_link_status(struct mwifiex_private *priv, u8 *mac);
+int mwifiex_tdls_oper(struct mwifiex_private *priv, const u8 *peer, u8 action);
+int mwifiex_get_tdls_link_status(struct mwifiex_private *priv, const u8 *mac);
 void mwifiex_disable_all_tdls_links(struct mwifiex_private *priv);
 bool mwifiex_is_bss_in_11ac_mode(struct mwifiex_private *priv);
 u8 mwifiex_get_center_freq_index(struct mwifiex_private *priv, u8 band,
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index c2cfeec466d8..574d4b597468 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -1071,6 +1071,7 @@ static int mwifiex_pcie_send_data_complete(struct mwifiex_adapter *adapter)
  * is mapped to PCI device memory. Tx ring pointers are advanced accordingly.
  * Download ready interrupt to FW is deffered if Tx ring is not full and
  * additional payload can be accomodated.
+ * Caller must ensure tx_param parameter to this function is not NULL.
  */
 static int
 mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb,
diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
index a1773d3cb49f..4ce3d7b33991 100644
--- a/drivers/net/wireless/mwifiex/sdio.c
+++ b/drivers/net/wireless/mwifiex/sdio.c
@@ -1678,8 +1678,12 @@ static int mwifiex_sdio_host_to_card(struct mwifiex_adapter *adapter,
         if (ret) {
                 if (type == MWIFIEX_TYPE_CMD)
                         adapter->cmd_sent = false;
-                if (type == MWIFIEX_TYPE_DATA)
+                if (type == MWIFIEX_TYPE_DATA) {
                         adapter->data_sent = false;
+                        /* restore curr_wr_port in error cases */
+                        card->curr_wr_port = port;
+                        card->mp_wr_bitmap |= (u32)(1 << card->curr_wr_port);
+                }
         } else {
                 if (type == MWIFIEX_TYPE_DATA) {
                         if (!(card->mp_wr_bitmap & (1 << card->curr_wr_port)))
diff --git a/drivers/net/wireless/mwifiex/sta_cmd.c b/drivers/net/wireless/mwifiex/sta_cmd.c
index e3cac1495cc7..88202ce0c139 100644
--- a/drivers/net/wireless/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/mwifiex/sta_cmd.c
@@ -1546,6 +1546,7 @@ mwifiex_cmd_tdls_oper(struct mwifiex_private *priv,
         struct mwifiex_ie_types_extcap *extcap;
         struct mwifiex_ie_types_vhtcap *vht_capab;
         struct mwifiex_ie_types_aid *aid;
+        struct mwifiex_ie_types_tdls_idle_timeout *timeout;
         u8 *pos, qos_info;
         u16 config_len = 0;
         struct station_parameters *params = priv->sta_params;
@@ -1643,6 +1644,12 @@ mwifiex_cmd_tdls_oper(struct mwifiex_private *priv,
                         config_len += sizeof(struct mwifiex_ie_types_aid);
                 }
 
+                timeout = (void *)(pos + config_len);
+                timeout->header.type = cpu_to_le16(TLV_TYPE_TDLS_IDLE_TIMEOUT);
+                timeout->header.len = cpu_to_le16(sizeof(timeout->value));
+                timeout->value = cpu_to_le16(MWIFIEX_TDLS_IDLE_TIMEOUT);
+                config_len += sizeof(struct mwifiex_ie_types_tdls_idle_timeout);
+
                 break;
         default:
                 dev_err(priv->adapter->dev, "Unknown TDLS operation\n");
diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c
index bfebb0144df5..577f2979ed8f 100644
--- a/drivers/net/wireless/mwifiex/sta_cmdresp.c
+++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c
@@ -865,14 +865,20 @@ static int mwifiex_ret_tdls_oper(struct mwifiex_private *priv,
 
         switch (action) {
         case ACT_TDLS_DELETE:
-                if (reason)
-                        dev_err(priv->adapter->dev,
-                                "TDLS link delete for %pM failed: reason %d\n",
-                                cmd_tdls_oper->peer_mac, reason);
-                else
+                if (reason) {
+                        if (!node || reason == TDLS_ERR_LINK_NONEXISTENT)
+                                dev_dbg(priv->adapter->dev,
+                                        "TDLS link delete for %pM failed: reason %d\n",
+                                        cmd_tdls_oper->peer_mac, reason);
+                        else
+                                dev_err(priv->adapter->dev,
+                                        "TDLS link delete for %pM failed: reason %d\n",
+                                        cmd_tdls_oper->peer_mac, reason);
+                } else {
                         dev_dbg(priv->adapter->dev,
-                                "TDLS link config for %pM successful\n",
+                                "TDLS link delete for %pM successful\n",
                                 cmd_tdls_oper->peer_mac);
+                }
                 break;
         case ACT_TDLS_CREATE:
                 if (reason) {
diff --git a/drivers/net/wireless/mwifiex/sta_event.c b/drivers/net/wireless/mwifiex/sta_event.c
index 368450cc56c7..f6395ef11a72 100644
--- a/drivers/net/wireless/mwifiex/sta_event.c
+++ b/drivers/net/wireless/mwifiex/sta_event.c
@@ -134,6 +134,46 @@ mwifiex_reset_connect_state(struct mwifiex_private *priv, u16 reason_code)
                 netif_carrier_off(priv->netdev);
 }
 
+static int mwifiex_parse_tdls_event(struct mwifiex_private *priv,
+                                    struct sk_buff *event_skb)
+{
+        int ret = 0;
+        struct mwifiex_adapter *adapter = priv->adapter;
+        struct mwifiex_sta_node *sta_ptr;
+        struct mwifiex_tdls_generic_event *tdls_evt =
+                        (void *)event_skb->data + sizeof(adapter->event_cause);
+
+        /* reserved 2 bytes are not mandatory in tdls event */
+        if (event_skb->len < (sizeof(struct mwifiex_tdls_generic_event) -
+                              sizeof(u16) - sizeof(adapter->event_cause))) {
+                dev_err(adapter->dev, "Invalid event length!\n");
+                return -1;
+        }
+
+        sta_ptr = mwifiex_get_sta_entry(priv, tdls_evt->peer_mac);
+        if (!sta_ptr) {
+                dev_err(adapter->dev, "cannot get sta entry!\n");
+                return -1;
+        }
+
+        switch (le16_to_cpu(tdls_evt->type)) {
+        case TDLS_EVENT_LINK_TEAR_DOWN:
+                cfg80211_tdls_oper_request(priv->netdev,
+                                           tdls_evt->peer_mac,
+                                           NL80211_TDLS_TEARDOWN,
+                                           le16_to_cpu(tdls_evt->u.reason_code),
+                                           GFP_KERNEL);
+                ret = mwifiex_tdls_oper(priv, tdls_evt->peer_mac,
+                                        MWIFIEX_TDLS_DISABLE_LINK);
+                queue_work(adapter->workqueue, &adapter->main_work);
+                break;
+        default:
+                break;
+        }
+
+        return ret;
+}
+
 /*
  * This function handles events generated by firmware.
  *
@@ -459,6 +499,10 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
                         false);
                 break;
 
+        case EVENT_TDLS_GENERIC_EVENT:
+                ret = mwifiex_parse_tdls_event(priv, adapter->event_skb);
+                break;
+
         default:
                 dev_dbg(adapter->dev, "event: unknown event id: %#x\n",
                         eventcause);
diff --git a/drivers/net/wireless/mwifiex/sta_rx.c b/drivers/net/wireless/mwifiex/sta_rx.c
index ed26387eccf5..8b639d7fe6df 100644
--- a/drivers/net/wireless/mwifiex/sta_rx.c
+++ b/drivers/net/wireless/mwifiex/sta_rx.c
@@ -183,6 +183,7 @@ int mwifiex_process_sta_rx_packet(struct mwifiex_private *priv,
         struct rx_packet_hdr *rx_pkt_hdr;
         u8 ta[ETH_ALEN];
         u16 rx_pkt_type, rx_pkt_offset, rx_pkt_length, seq_num;
+        struct mwifiex_sta_node *sta_ptr;
 
         local_rx_pd = (struct rxpd *) (skb->data);
         rx_pkt_type = le16_to_cpu(local_rx_pd->rx_pkt_type);
@@ -213,14 +214,25 @@ int mwifiex_process_sta_rx_packet(struct mwifiex_private *priv,
          * If the packet is not an unicast packet then send the packet
          * directly to os. Don't pass thru rx reordering
          */
-        if (!IS_11N_ENABLED(priv) ||
+        if ((!IS_11N_ENABLED(priv) &&
+             !(ISSUPP_TDLS_ENABLED(priv->adapter->fw_cap_info) &&
+               !(local_rx_pd->flags & MWIFIEX_RXPD_FLAGS_TDLS_PACKET))) ||
             !ether_addr_equal_unaligned(priv->curr_addr, rx_pkt_hdr->eth803_hdr.h_dest)) {
                 mwifiex_process_rx_packet(priv, skb);
                 return ret;
         }
 
-        if (mwifiex_queuing_ra_based(priv)) {
+        if (mwifiex_queuing_ra_based(priv) ||
+            (ISSUPP_TDLS_ENABLED(priv->adapter->fw_cap_info) &&
+             local_rx_pd->flags & MWIFIEX_RXPD_FLAGS_TDLS_PACKET)) {
                 memcpy(ta, rx_pkt_hdr->eth803_hdr.h_source, ETH_ALEN);
+                if (local_rx_pd->flags & MWIFIEX_RXPD_FLAGS_TDLS_PACKET &&
+                    local_rx_pd->priority < MAX_NUM_TID) {
+                        sta_ptr = mwifiex_get_sta_entry(priv, ta);
+                        if (sta_ptr)
+                                sta_ptr->rx_seq[local_rx_pd->priority] =
+                                              le16_to_cpu(local_rx_pd->seq_num);
+                }
         } else {
                 if (rx_pkt_type != PKT_TYPE_BAR)
                         priv->rx_seq[local_rx_pd->priority] = seq_num;
diff --git a/drivers/net/wireless/mwifiex/sta_tx.c b/drivers/net/wireless/mwifiex/sta_tx.c
index 1236a5de7bca..5fce7e78a36e 100644
--- a/drivers/net/wireless/mwifiex/sta_tx.c
+++ b/drivers/net/wireless/mwifiex/sta_tx.c
@@ -128,6 +128,7 @@ int mwifiex_send_null_packet(struct mwifiex_private *priv, u8 flags)
 {
         struct mwifiex_adapter *adapter = priv->adapter;
         struct txpd *local_tx_pd;
+        struct mwifiex_tx_param tx_param;
 /* sizeof(struct txpd) + Interface specific header */
 #define NULL_PACKET_HDR 64
         u32 data_len = NULL_PACKET_HDR;
@@ -168,8 +169,9 @@ int mwifiex_send_null_packet(struct mwifiex_private *priv, u8 flags)
                                                    skb, NULL);
         } else {
                 skb_push(skb, INTF_HEADER_LEN);
+                tx_param.next_pkt_len = 0;
                 ret = adapter->if_ops.host_to_card(adapter, MWIFIEX_TYPE_DATA,
-                                                   skb, NULL);
+                                                   skb, &tx_param);
         }
         switch (ret) {
         case -EBUSY:
diff --git a/drivers/net/wireless/mwifiex/tdls.c b/drivers/net/wireless/mwifiex/tdls.c
index 97662a1ba58c..e73034fbbde9 100644
--- a/drivers/net/wireless/mwifiex/tdls.c
+++ b/drivers/net/wireless/mwifiex/tdls.c
@@ -25,8 +25,8 @@
 #define TDLS_RESP_FIX_LEN     8
 #define TDLS_CONFIRM_FIX_LEN  6
 
-static void
-mwifiex_restore_tdls_packets(struct mwifiex_private *priv, u8 *mac, u8 status)
+static void mwifiex_restore_tdls_packets(struct mwifiex_private *priv,
+                                         const u8 *mac, u8 status)
 {
         struct mwifiex_ra_list_tbl *ra_list;
         struct list_head *tid_list;
@@ -84,7 +84,8 @@ mwifiex_restore_tdls_packets(struct mwifiex_private *priv, u8 *mac, u8 status)
         return;
 }
 
-static void mwifiex_hold_tdls_packets(struct mwifiex_private *priv, u8 *mac)
+static void mwifiex_hold_tdls_packets(struct mwifiex_private *priv,
+                                      const u8 *mac)
 {
         struct mwifiex_ra_list_tbl *ra_list;
         struct list_head *ra_list_head;
@@ -185,8 +186,50 @@ static int mwifiex_tdls_add_vht_capab(struct mwifiex_private *priv,
         return 0;
 }
 
+static int
+mwifiex_tdls_add_ht_oper(struct mwifiex_private *priv, const u8 *mac,
+                         u8 vht_enabled, struct sk_buff *skb)
+{
+        struct ieee80211_ht_operation *ht_oper;
+        struct mwifiex_sta_node *sta_ptr;
+        struct mwifiex_bssdescriptor *bss_desc =
+                                        &priv->curr_bss_params.bss_descriptor;
+        u8 *pos;
+
+        sta_ptr = mwifiex_get_sta_entry(priv, mac);
+        if (unlikely(!sta_ptr)) {
+                dev_warn(priv->adapter->dev,
+                         "TDLS peer station not found in list\n");
+                return -1;
+        }
+
+        pos = (void *)skb_put(skb, sizeof(struct ieee80211_ht_operation) + 2);
+        *pos++ = WLAN_EID_HT_OPERATION;
+        *pos++ = sizeof(struct ieee80211_ht_operation);
+        ht_oper = (void *)pos;
+
+        ht_oper->primary_chan = bss_desc->channel;
+
+        /* follow AP's channel bandwidth */
+        if (ISSUPP_CHANWIDTH40(priv->adapter->hw_dot_11n_dev_cap) &&
+            bss_desc->bcn_ht_cap &&
+            ISALLOWED_CHANWIDTH40(bss_desc->bcn_ht_oper->ht_param))
+                ht_oper->ht_param = bss_desc->bcn_ht_oper->ht_param;
+
+        if (vht_enabled) {
+                ht_oper->ht_param =
+                          mwifiex_get_sec_chan_offset(bss_desc->channel);
+                ht_oper->ht_param |= BIT(2);
+        }
+
+        memcpy(&sta_ptr->tdls_cap.ht_oper, ht_oper,
+               sizeof(struct ieee80211_ht_operation));
+
+        return 0;
+}
+
 static int mwifiex_tdls_add_vht_oper(struct mwifiex_private *priv,
-                                     u8 *mac, struct sk_buff *skb)
+                                     const u8 *mac, struct sk_buff *skb)
 {
         struct mwifiex_bssdescriptor *bss_desc;
         struct ieee80211_vht_operation *vht_oper;
@@ -325,8 +368,9 @@ static void mwifiex_tdls_add_qos_capab(struct sk_buff *skb)
 }
 
 static int mwifiex_prep_tdls_encap_data(struct mwifiex_private *priv,
-                             u8 *peer, u8 action_code, u8 dialog_token,
-                             u16 status_code, struct sk_buff *skb)
+                                        const u8 *peer, u8 action_code,
+                                        u8 dialog_token,
+                                        u16 status_code, struct sk_buff *skb)
 {
         struct ieee80211_tdls_data *tf;
         int ret;
@@ -428,6 +472,17 @@ static int mwifiex_prep_tdls_encap_data(struct mwifiex_private *priv,
                                 dev_kfree_skb_any(skb);
                                 return ret;
                         }
+                        ret = mwifiex_tdls_add_ht_oper(priv, peer, 1, skb);
+                        if (ret) {
+                                dev_kfree_skb_any(skb);
+                                return ret;
+                        }
+                } else {
+                        ret = mwifiex_tdls_add_ht_oper(priv, peer, 0, skb);
+                        if (ret) {
+                                dev_kfree_skb_any(skb);
+                                return ret;
+                        }
                 }
                 break;
 
@@ -453,7 +508,8 @@ static int mwifiex_prep_tdls_encap_data(struct mwifiex_private *priv,
 }
 
 static void
-mwifiex_tdls_add_link_ie(struct sk_buff *skb, u8 *src_addr, u8 *peer, u8 *bssid)
+mwifiex_tdls_add_link_ie(struct sk_buff *skb, const u8 *src_addr,
+                         const u8 *peer, const u8 *bssid)
 {
         struct ieee80211_tdls_lnkie *lnkid;
 
@@ -467,8 +523,8 @@ mwifiex_tdls_add_link_ie(struct sk_buff *skb, u8 *src_addr, u8 *peer, u8 *bssid)
         memcpy(lnkid->resp_sta, peer, ETH_ALEN);
 }
 
-int mwifiex_send_tdls_data_frame(struct mwifiex_private *priv,
-                                 u8 *peer, u8 action_code, u8 dialog_token,
+int mwifiex_send_tdls_data_frame(struct mwifiex_private *priv, const u8 *peer,
+                                 u8 action_code, u8 dialog_token,
                                  u16 status_code, const u8 *extra_ies,
                                  size_t extra_ies_len)
 {
@@ -560,7 +616,8 @@ int mwifiex_send_tdls_data_frame(struct mwifiex_private *priv,
 }
 
 static int
-mwifiex_construct_tdls_action_frame(struct mwifiex_private *priv, u8 *peer,
+mwifiex_construct_tdls_action_frame(struct mwifiex_private *priv,
+                                    const u8 *peer,
                                     u8 action_code, u8 dialog_token,
                                     u16 status_code, struct sk_buff *skb)
 {
@@ -638,10 +695,10 @@ mwifiex_construct_tdls_action_frame(struct mwifiex_private *priv, u8 *peer,
         return 0;
 }
 
-int mwifiex_send_tdls_action_frame(struct mwifiex_private *priv,
-                                 u8 *peer, u8 action_code, u8 dialog_token,
-                                 u16 status_code, const u8 *extra_ies,
-                                 size_t extra_ies_len)
+int mwifiex_send_tdls_action_frame(struct mwifiex_private *priv, const u8 *peer,
+                                   u8 action_code, u8 dialog_token,
+                                   u16 status_code, const u8 *extra_ies,
+                                   size_t extra_ies_len)
 {
         struct sk_buff *skb;
         struct mwifiex_txinfo *tx_info;
@@ -848,7 +905,7 @@ void mwifiex_process_tdls_action_frame(struct mwifiex_private *priv,
 }
 
 static int
-mwifiex_tdls_process_config_link(struct mwifiex_private *priv, u8 *peer)
+mwifiex_tdls_process_config_link(struct mwifiex_private *priv, const u8 *peer)
 {
         struct mwifiex_sta_node *sta_ptr;
         struct mwifiex_ds_tdls_oper tdls_oper;
@@ -869,7 +926,7 @@ mwifiex_tdls_process_config_link(struct mwifiex_private *priv, u8 *peer)
 }
 
 static int
-mwifiex_tdls_process_create_link(struct mwifiex_private *priv, u8 *peer)
+mwifiex_tdls_process_create_link(struct mwifiex_private *priv, const u8 *peer)
 {
         struct mwifiex_sta_node *sta_ptr;
         struct mwifiex_ds_tdls_oper tdls_oper;
@@ -896,7 +953,7 @@ mwifiex_tdls_process_create_link(struct mwifiex_private *priv, u8 *peer)
 }
 
 static int
-mwifiex_tdls_process_disable_link(struct mwifiex_private *priv, u8 *peer)
+mwifiex_tdls_process_disable_link(struct mwifiex_private *priv, const u8 *peer)
 {
         struct mwifiex_sta_node *sta_ptr;
         struct mwifiex_ds_tdls_oper tdls_oper;
@@ -925,7 +982,7 @@ mwifiex_tdls_process_disable_link(struct mwifiex_private *priv, u8 *peer)
 }
 
 static int
-mwifiex_tdls_process_enable_link(struct mwifiex_private *priv, u8 *peer)
+mwifiex_tdls_process_enable_link(struct mwifiex_private *priv, const u8 *peer)
 {
         struct mwifiex_sta_node *sta_ptr;
         struct ieee80211_mcs_info mcs;
@@ -982,7 +1039,7 @@ mwifiex_tdls_process_enable_link(struct mwifiex_private *priv, u8 *peer)
         return 0;
 }
 
-int mwifiex_tdls_oper(struct mwifiex_private *priv, u8 *peer, u8 action)
+int mwifiex_tdls_oper(struct mwifiex_private *priv, const u8 *peer, u8 action)
 {
         switch (action) {
         case MWIFIEX_TDLS_ENABLE_LINK:
@@ -997,7 +1054,7 @@ int mwifiex_tdls_oper(struct mwifiex_private *priv, u8 *peer, u8 action)
         return 0;
 }
 
-int mwifiex_get_tdls_link_status(struct mwifiex_private *priv, u8 *mac)
+int mwifiex_get_tdls_link_status(struct mwifiex_private *priv, const u8 *mac)
 {
         struct mwifiex_sta_node *sta_ptr;
 
diff --git a/drivers/net/wireless/mwifiex/util.c b/drivers/net/wireless/mwifiex/util.c
index c3824e37f3f2..6da5abf52e61 100644
--- a/drivers/net/wireless/mwifiex/util.c
+++ b/drivers/net/wireless/mwifiex/util.c
@@ -259,7 +259,7 @@ int mwifiex_complete_cmd(struct mwifiex_adapter *adapter,
  * NULL is returned if station entry is not found in associated STA list.
  */
 struct mwifiex_sta_node *
-mwifiex_get_sta_entry(struct mwifiex_private *priv, u8 *mac)
+mwifiex_get_sta_entry(struct mwifiex_private *priv, const u8 *mac)
 {
         struct mwifiex_sta_node *node;
 
@@ -280,7 +280,7 @@ mwifiex_get_sta_entry(struct mwifiex_private *priv, u8 *mac)
  * If received mac address is NULL, NULL is returned.
  */
 struct mwifiex_sta_node *
-mwifiex_add_sta_entry(struct mwifiex_private *priv, u8 *mac)
+mwifiex_add_sta_entry(struct mwifiex_private *priv, const u8 *mac)
 {
         struct mwifiex_sta_node *node;
         unsigned long flags;
@@ -332,7 +332,7 @@ mwifiex_set_sta_ht_cap(struct mwifiex_private *priv, const u8 *ies,
 }
 
 /* This function will delete a station entry from station list */
-void mwifiex_del_sta_entry(struct mwifiex_private *priv, u8 *mac)
+void mwifiex_del_sta_entry(struct mwifiex_private *priv, const u8 *mac)
 {
         struct mwifiex_sta_node *node;
         unsigned long flags;
diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c
index 94b6c74ba727..6d9738a5dc31 100644
--- a/drivers/net/wireless/mwifiex/wmm.c
+++ b/drivers/net/wireless/mwifiex/wmm.c
@@ -92,7 +92,7 @@ mwifiex_wmm_ac_debug_print(const struct ieee_types_wmm_ac_parameters *ac_param)
  * The function also initializes the list with the provided RA.
  */
 static struct mwifiex_ra_list_tbl *
-mwifiex_wmm_allocate_ralist_node(struct mwifiex_adapter *adapter, u8 *ra)
+mwifiex_wmm_allocate_ralist_node(struct mwifiex_adapter *adapter, const u8 *ra)
 {
         struct mwifiex_ra_list_tbl *ra_list;
 
@@ -139,8 +139,7 @@ static u8 mwifiex_get_random_ba_threshold(void)
  * This function allocates and adds a RA list for all TIDs
  * with the given RA.
  */
-void
-mwifiex_ralist_add(struct mwifiex_private *priv, u8 *ra)
+void mwifiex_ralist_add(struct mwifiex_private *priv, const u8 *ra)
 {
         int i;
         struct mwifiex_ra_list_tbl *ra_list;
@@ -566,7 +565,7 @@ mwifiex_clean_txrx(struct mwifiex_private *priv)
  */
 static struct mwifiex_ra_list_tbl *
 mwifiex_wmm_get_ralist_node(struct mwifiex_private *priv, u8 tid,
-                            u8 *ra_addr)
+                            const u8 *ra_addr)
 {
         struct mwifiex_ra_list_tbl *ra_list;
 
@@ -587,7 +586,8 @@ mwifiex_wmm_get_ralist_node(struct mwifiex_private *priv, u8 tid,
  * retrieved.
  */
 struct mwifiex_ra_list_tbl *
-mwifiex_wmm_get_queue_raptr(struct mwifiex_private *priv, u8 tid, u8 *ra_addr)
+mwifiex_wmm_get_queue_raptr(struct mwifiex_private *priv, u8 tid,
+                            const u8 *ra_addr)
 {
         struct mwifiex_ra_list_tbl *ra_list;
 
@@ -648,7 +648,7 @@ mwifiex_wmm_add_buf_txqueue(struct mwifiex_private *priv,
                 if (ntohs(eth_hdr->h_proto) == ETH_P_TDLS)
                         dev_dbg(adapter->dev,
                                 "TDLS setup packet for %pM. Don't block\n", ra);
-                else
+                else if (memcmp(priv->cfg_bssid, ra, ETH_ALEN))
                         tdls_status = mwifiex_get_tdls_link_status(priv, ra);
         }
 
diff --git a/drivers/net/wireless/mwifiex/wmm.h b/drivers/net/wireless/mwifiex/wmm.h
index 83e42083ebff..eca56e371a57 100644
--- a/drivers/net/wireless/mwifiex/wmm.h
+++ b/drivers/net/wireless/mwifiex/wmm.h
@@ -99,7 +99,7 @@ mwifiex_wmm_is_ra_list_empty(struct list_head *ra_list_hhead)
 
 void mwifiex_wmm_add_buf_txqueue(struct mwifiex_private *priv,
                                  struct sk_buff *skb);
-void mwifiex_ralist_add(struct mwifiex_private *priv, u8 *ra);
+void mwifiex_ralist_add(struct mwifiex_private *priv, const u8 *ra);
 void mwifiex_rotate_priolists(struct mwifiex_private *priv,
                               struct mwifiex_ra_list_tbl *ra, int tid);
 
@@ -123,7 +123,8 @@ void mwifiex_wmm_setup_ac_downgrade(struct mwifiex_private *priv);
 int mwifiex_ret_wmm_get_status(struct mwifiex_private *priv,
                                const struct host_cmd_ds_command *resp);
 struct mwifiex_ra_list_tbl *
-mwifiex_wmm_get_queue_raptr(struct mwifiex_private *priv, u8 tid, u8 *ra_addr);
+mwifiex_wmm_get_queue_raptr(struct mwifiex_private *priv, u8 tid,
+                            const u8 *ra_addr);
 u8 mwifiex_wmm_downgrade_tid(struct mwifiex_private *priv, u32 tid);
 
 #endif /* !_MWIFIEX_WMM_H_ */
diff --git a/drivers/net/wireless/orinoco/hw.c b/drivers/net/wireless/orinoco/hw.c
index 49300d04efdf..e27e32851f1e 100644
--- a/drivers/net/wireless/orinoco/hw.c
+++ b/drivers/net/wireless/orinoco/hw.c
@@ -988,8 +988,8 @@ int __orinoco_hw_setup_enc(struct orinoco_private *priv)
  * tsc must be NULL or up to 8 bytes
  */
 int __orinoco_hw_set_tkip_key(struct orinoco_private *priv, int key_idx,
-                              int set_tx, u8 *key, u8 *rsc, size_t rsc_len,
-                              u8 *tsc, size_t tsc_len)
+                              int set_tx, const u8 *key, const u8 *rsc,
+                              size_t rsc_len, const u8 *tsc, size_t tsc_len)
 {
         struct {
                 __le16 idx;
diff --git a/drivers/net/wireless/orinoco/hw.h b/drivers/net/wireless/orinoco/hw.h
index 8f6831f4e328..466d1ede76f1 100644
--- a/drivers/net/wireless/orinoco/hw.h
+++ b/drivers/net/wireless/orinoco/hw.h
@@ -38,8 +38,8 @@ int __orinoco_hw_set_wap(struct orinoco_private *priv);
 int __orinoco_hw_setup_wepkeys(struct orinoco_private *priv);
 int __orinoco_hw_setup_enc(struct orinoco_private *priv);
 int __orinoco_hw_set_tkip_key(struct orinoco_private *priv, int key_idx,
-                              int set_tx, u8 *key, u8 *rsc, size_t rsc_len,
-                              u8 *tsc, size_t tsc_len);
+                              int set_tx, const u8 *key, const u8 *rsc,
+                              size_t rsc_len, const u8 *tsc, size_t tsc_len);
 int orinoco_clear_tkip_key(struct orinoco_private *priv, int key_idx);
 int __orinoco_hw_set_multicast_list(struct orinoco_private *priv,
                                     struct net_device *dev,
diff --git a/drivers/net/wireless/orinoco/orinoco_usb.c b/drivers/net/wireless/orinoco/orinoco_usb.c
index f9805c9353d2..1cbb7835806f 100644
--- a/drivers/net/wireless/orinoco/orinoco_usb.c
+++ b/drivers/net/wireless/orinoco/orinoco_usb.c
@@ -1687,7 +1687,7 @@ static int ezusb_probe(struct usb_interface *interface,
                 firmware.code = fw_entry->data;
         }
         if (firmware.size && firmware.code) {
-                if (ezusb_firmware_download(upriv, &firmware))
+                if (ezusb_firmware_download(upriv, &firmware) < 0)
                         goto error;
         } else {
                 err("No firmware to download");
diff --git a/drivers/net/wireless/orinoco/wext.c b/drivers/net/wireless/orinoco/wext.c
index b7a867b50b94..6abdaf0aa052 100644
--- a/drivers/net/wireless/orinoco/wext.c
+++ b/drivers/net/wireless/orinoco/wext.c
@@ -52,9 +52,9 @@ static int orinoco_set_key(struct orinoco_private *priv, int index,
         priv->keys[index].seq_len = seq_len;
 
         if (key_len)
-                memcpy(priv->keys[index].key, key, key_len);
+                memcpy((void *)priv->keys[index].key, key, key_len);
         if (seq_len)
-                memcpy(priv->keys[index].seq, seq, seq_len);
+                memcpy((void *)priv->keys[index].seq, seq, seq_len);
 
         switch (alg) {
         case ORINOCO_ALG_TKIP:
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 39d22a154341..d2a9a08210be 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -517,7 +517,7 @@ static int rndis_set_default_key(struct wiphy *wiphy, struct net_device *netdev,
                                  u8 key_index, bool unicast, bool multicast);
 
 static int rndis_get_station(struct wiphy *wiphy, struct net_device *dev,
-                                        u8 *mac, struct station_info *sinfo);
+                             const u8 *mac, struct station_info *sinfo);
 
 static int rndis_dump_station(struct wiphy *wiphy, struct net_device *dev,
                                int idx, u8 *mac, struct station_info *sinfo);
@@ -2490,7 +2490,7 @@ static void rndis_fill_station_info(struct usbnet *usbdev,
 }
 
 static int rndis_get_station(struct wiphy *wiphy, struct net_device *dev,
-                                        u8 *mac, struct station_info *sinfo)
+                             const u8 *mac, struct station_info *sinfo)
 {
         struct rndis_wlan_private *priv = wiphy_priv(wiphy);
         struct usbnet *usbdev = priv->usbdev;
diff --git a/drivers/net/wireless/rsi/rsi_91x_mac80211.c b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
index 84164747ace0..54aaeb09debf 100644
--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
@@ -656,6 +656,7 @@ static int rsi_mac80211_ampdu_action(struct ieee80211_hw *hw,
         case IEEE80211_AMPDU_TX_START:
                 common->vif_info[ii].seq_start = seq_no;
                 ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                status = 0;
                 break;
 
         case IEEE80211_AMPDU_TX_STOP_CONT:
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index 10572452cc21..86c43d112a4b 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -68,6 +68,12 @@ int rt2x00usb_vendor_request(struct rt2x00_dev *rt2x00dev,
                 }
         }
 
+        /* If the port is powered down, we get a -EPROTO error, and this
+         * leads to a endless loop. So just say that the device is gone.
+         */
+        if (status == -EPROTO)
+                clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
+
         rt2x00_err(rt2x00dev,
                    "Vendor Request 0x%02x failed for offset 0x%04x with error %d\n",
                    request, offset, status);
diff --git a/drivers/net/wireless/rtl818x/rtl8180/dev.c b/drivers/net/wireless/rtl818x/rtl8180/dev.c
index 50d69b13f984..2c1c02bafa10 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8180/dev.c
@@ -284,6 +284,8 @@ static void rtl8180_handle_rx(struct ieee80211_hw *dev)
                         rx_status.band = dev->conf.chandef.chan->band;
                         rx_status.mactime = tsft;
                         rx_status.flag |= RX_FLAG_MACTIME_START;
+                        if (flags & RTL818X_RX_DESC_FLAG_SPLCP)
+                                rx_status.flag |= RX_FLAG_SHORTPRE;
                         if (flags & RTL818X_RX_DESC_FLAG_CRC32_ERR)
                                 rx_status.flag |= RX_FLAG_FAILED_FCS_CRC;
 
@@ -461,18 +463,23 @@ static void rtl8180_tx(struct ieee80211_hw *dev,
                             RTL818X_TX_DESC_FLAG_NO_ENC;
 
         rc_flags = info->control.rates[0].flags;
+
+        /* HW will perform RTS-CTS when only RTS flags is set.
+         * HW will perform CTS-to-self when both RTS and CTS flags are set.
+         * RTS rate and RTS duration will be used also for CTS-to-self.
+         */
         if (rc_flags & IEEE80211_TX_RC_USE_RTS_CTS) {
                 tx_flags |= RTL818X_TX_DESC_FLAG_RTS;
                 tx_flags |= ieee80211_get_rts_cts_rate(dev, info)->hw_value << 19;
+                rts_duration = ieee80211_rts_duration(dev, priv->vif,
+                                                skb->len, info);
         } else if (rc_flags & IEEE80211_TX_RC_USE_CTS_PROTECT) {
-                tx_flags |= RTL818X_TX_DESC_FLAG_CTS;
+                tx_flags |= RTL818X_TX_DESC_FLAG_RTS | RTL818X_TX_DESC_FLAG_CTS;
                 tx_flags |= ieee80211_get_rts_cts_rate(dev, info)->hw_value << 19;
+                rts_duration = ieee80211_ctstoself_duration(dev, priv->vif,
+                                                skb->len, info);
         }
 
-        if (rc_flags & IEEE80211_TX_RC_USE_RTS_CTS)
-                rts_duration = ieee80211_rts_duration(dev, priv->vif, skb->len,
-                                                      info);
-
         if (priv->chip_family == RTL818X_CHIP_FAMILY_RTL8180) {
                 unsigned int remainder;
 
diff --git a/drivers/net/wireless/rtl818x/rtl8187/dev.c b/drivers/net/wireless/rtl818x/rtl8187/dev.c
index 0ca17cda48fa..629ad8cfa17b 100644
--- a/drivers/net/wireless/rtl818x/rtl8187/dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187/dev.c
@@ -253,14 +253,21 @@ static void rtl8187_tx(struct ieee80211_hw *dev,
         flags |= ieee80211_get_tx_rate(dev, info)->hw_value << 24;
         if (ieee80211_has_morefrags(tx_hdr->frame_control))
                 flags |= RTL818X_TX_DESC_FLAG_MOREFRAG;
+
+        /* HW will perform RTS-CTS when only RTS flags is set.
+         * HW will perform CTS-to-self when both RTS and CTS flags are set.
+         * RTS rate and RTS duration will be used also for CTS-to-self.
+         */
         if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) {
                 flags |= RTL818X_TX_DESC_FLAG_RTS;
                 flags |= ieee80211_get_rts_cts_rate(dev, info)->hw_value << 19;
                 rts_dur = ieee80211_rts_duration(dev, priv->vif,
                                                  skb->len, info);
         } else if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT) {
-                flags |= RTL818X_TX_DESC_FLAG_CTS;
+                flags |= RTL818X_TX_DESC_FLAG_RTS | RTL818X_TX_DESC_FLAG_CTS;
                 flags |= ieee80211_get_rts_cts_rate(dev, info)->hw_value << 19;
+                rts_dur = ieee80211_ctstoself_duration(dev, priv->vif,
+                                                 skb->len, info);
         }
 
         if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
@@ -381,6 +388,8 @@ static void rtl8187_rx_cb(struct urb *urb)
         rx_status.freq = dev->conf.chandef.chan->center_freq;
         rx_status.band = dev->conf.chandef.chan->band;
         rx_status.flag |= RX_FLAG_MACTIME_START;
+        if (flags & RTL818X_RX_DESC_FLAG_SPLCP)
+                rx_status.flag |= RX_FLAG_SHORTPRE;
         if (flags & RTL818X_RX_DESC_FLAG_CRC32_ERR)
                 rx_status.flag |= RX_FLAG_FAILED_FCS_CRC;
         memcpy(IEEE80211_SKB_RXCB(skb), &rx_status, sizeof(rx_status));
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
index 94cd9df98381..b14cf5a10f44 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
@@ -2515,23 +2515,3 @@ void rtl88ee_suspend(struct ieee80211_hw *hw)
 void rtl88ee_resume(struct ieee80211_hw *hw)
 {
 }
-
-/* Turn on AAP (RCR:bit 0) for promicuous mode. */
-void rtl88ee_allow_all_destaddr(struct ieee80211_hw *hw,
-                                bool allow_all_da, bool write_into_reg)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
-
-        if (allow_all_da) /* Set BIT0 */
-                rtlpci->receive_config |= RCR_AAP;
-         else /* Clear BIT0 */
-                rtlpci->receive_config &= ~RCR_AAP;
-
-        if (write_into_reg)
-                rtl_write_dword(rtlpriv, REG_RCR, rtlpci->receive_config);
-
-        RT_TRACE(rtlpriv, COMP_TURBO | COMP_INIT, DBG_LOUD,
-                 "receive_config = 0x%08X, write_into_reg =%d\n",
-                 rtlpci->receive_config, write_into_reg);
-}
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.h b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.h
index b4460a41bd01..1850fde881b5 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.h
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.h
@@ -61,8 +61,6 @@ void rtl8188ee_bt_reg_init(struct ieee80211_hw *hw);
 void rtl8188ee_bt_hw_init(struct ieee80211_hw *hw);
 void rtl88ee_suspend(struct ieee80211_hw *hw);
 void rtl88ee_resume(struct ieee80211_hw *hw);
-void rtl88ee_allow_all_destaddr(struct ieee80211_hw *hw,
-                                bool allow_all_da, bool write_into_reg);
 void rtl88ee_fw_clk_off_timer_callback(unsigned long data);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c b/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c
index 347af1e4f438..842d69349a37 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c
@@ -93,6 +93,7 @@ int rtl88e_init_sw_vars(struct ieee80211_hw *hw)
         u8 tid;
 
         rtl8188ee_bt_reg_init(hw);
+        rtlpci->msi_support = rtlpriv->cfg->mod_params->msi_support;
 
         rtlpriv->dm.dm_initialgain_enable = 1;
         rtlpriv->dm.dm_flag = 0;
@@ -254,7 +255,6 @@ static struct rtl_hal_ops rtl8188ee_hal_ops = {
         .enable_hw_sec = rtl88ee_enable_hw_security_config,
         .set_key = rtl88ee_set_key,
         .init_sw_leds = rtl88ee_init_sw_leds,
-        .allow_all_destaddr = rtl88ee_allow_all_destaddr,
         .get_bbreg = rtl88e_phy_query_bb_reg,
         .set_bbreg = rtl88e_phy_set_bb_reg,
         .get_rfreg = rtl88e_phy_query_rf_reg,
@@ -266,6 +266,7 @@ static struct rtl_mod_params rtl88ee_mod_params = {
         .inactiveps = true,
         .swctrl_lps = false,
         .fwctrl_lps = true,
+        .msi_support = false,
         .debug = DBG_EMERG,
 };
 
@@ -382,10 +383,12 @@ module_param_named(debug, rtl88ee_mod_params.debug, int, 0444);
 module_param_named(ips, rtl88ee_mod_params.inactiveps, bool, 0444);
 module_param_named(swlps, rtl88ee_mod_params.swctrl_lps, bool, 0444);
 module_param_named(fwlps, rtl88ee_mod_params.fwctrl_lps, bool, 0444);
+module_param_named(msi, rtl88ee_mod_params.msi_support, bool, 0444);
 MODULE_PARM_DESC(swenc, "Set to 1 for software crypto (default 0)\n");
 MODULE_PARM_DESC(ips, "Set to 0 to not use link power save (default 1)\n");
 MODULE_PARM_DESC(swlps, "Set to 1 to use SW control power save (default 0)\n");
 MODULE_PARM_DESC(fwlps, "Set to 1 to use FW control power save (default 1)\n");
+MODULE_PARM_DESC(msi, "Set to 1 to use MSI interrupts mode (default 0)\n");
 MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)");
 
 static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
index 55adf043aef7..cdecb0fd4d8e 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
@@ -2423,24 +2423,3 @@ void rtl92ce_suspend(struct ieee80211_hw *hw)
 void rtl92ce_resume(struct ieee80211_hw *hw)
 {
 }
-
-/* Turn on AAP (RCR:bit 0) for promicuous mode. */
-void rtl92ce_allow_all_destaddr(struct ieee80211_hw *hw,
-        bool allow_all_da, bool write_into_reg)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
-
-        if (allow_all_da) {/* Set BIT0 */
-                rtlpci->receive_config |= RCR_AAP;
-        } else {/* Clear BIT0 */
-                rtlpci->receive_config &= ~RCR_AAP;
-        }
-
-        if (write_into_reg)
-                rtl_write_dword(rtlpriv, REG_RCR, rtlpci->receive_config);
-
-        RT_TRACE(rtlpriv, COMP_TURBO | COMP_INIT, DBG_LOUD,
-                 "receive_config=0x%08X, write_into_reg=%d\n",
-                 rtlpci->receive_config, write_into_reg);
-}
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.h b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.h
index 2d063b0c7760..5533070f266c 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.h
@@ -76,7 +76,5 @@ void rtl8192ce_bt_reg_init(struct ieee80211_hw *hw);
 void rtl8192ce_bt_hw_init(struct ieee80211_hw *hw);
 void rtl92ce_suspend(struct ieee80211_hw *hw);
 void rtl92ce_resume(struct ieee80211_hw *hw);
-void rtl92ce_allow_all_destaddr(struct ieee80211_hw *hw,
-                                bool allow_all_da, bool write_into_reg);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
index b790320d2030..12f21f4073e8 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
@@ -229,7 +229,6 @@ static struct rtl_hal_ops rtl8192ce_hal_ops = {
         .enable_hw_sec = rtl92ce_enable_hw_security_config,
         .set_key = rtl92ce_set_key,
         .init_sw_leds = rtl92ce_init_sw_leds,
-        .allow_all_destaddr = rtl92ce_allow_all_destaddr,
         .get_bbreg = rtl92c_phy_query_bb_reg,
         .set_bbreg = rtl92c_phy_set_bb_reg,
         .set_rfreg = rtl92ce_phy_set_rf_reg,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
index 07cb06da6729..a903c2671b4d 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
@@ -511,7 +511,7 @@ static int _rtl92cu_init_power_on(struct ieee80211_hw *hw)
                         pr_info("MAC auto ON okay!\n");
                         break;
                 }
-                if (pollingCount++ > 100) {
+                if (pollingCount++ > 1000) {
                         RT_TRACE(rtlpriv, COMP_INIT, DBG_EMERG,
                                  "Failed to polling REG_APS_FSMCO[APFM_ONMAC] done!\n");
                         return -ENODEV;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/hw.c b/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
index 9098558d916d..1c7101bcd790 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
@@ -2544,23 +2544,3 @@ void rtl92se_resume(struct ieee80211_hw *hw)
                 pci_write_config_dword(rtlpci->pdev, 0x40,
                         val & 0xffff00ff);
 }
-
-/* Turn on AAP (RCR:bit 0) for promicuous mode. */
-void rtl92se_allow_all_destaddr(struct ieee80211_hw *hw,
-                                bool allow_all_da, bool write_into_reg)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
-
-        if (allow_all_da) /* Set BIT0 */
-                rtlpci->receive_config |= RCR_AAP;
-        else /* Clear BIT0 */
-                rtlpci->receive_config &= ~RCR_AAP;
-
-        if (write_into_reg)
-                rtl_write_dword(rtlpriv, RCR, rtlpci->receive_config);
-
-        RT_TRACE(rtlpriv, COMP_TURBO | COMP_INIT, DBG_LOUD,
-                 "receive_config=0x%08X, write_into_reg=%d\n",
-                 rtlpci->receive_config, write_into_reg);
-}
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/hw.h b/drivers/net/wireless/rtlwifi/rtl8192se/hw.h
index da48aa8cbe6f..4cacee10f31e 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/hw.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/hw.h
@@ -74,7 +74,5 @@ void rtl92se_set_key(struct ieee80211_hw *hw,
                      u8 enc_algo, bool is_wepkey, bool clear_all);
 void rtl92se_suspend(struct ieee80211_hw *hw);
 void rtl92se_resume(struct ieee80211_hw *hw);
-void rtl92se_allow_all_destaddr(struct ieee80211_hw *hw,
-                                bool allow_all_da, bool write_into_reg);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
index 2e8e6f8d2d51..1bff2a0f7600 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
@@ -290,7 +290,6 @@ static struct rtl_hal_ops rtl8192se_hal_ops = {
         .enable_hw_sec = rtl92se_enable_hw_security_config,
         .set_key = rtl92se_set_key,
         .init_sw_leds = rtl92se_init_sw_leds,
-        .allow_all_destaddr = rtl92se_allow_all_destaddr,
         .get_bbreg = rtl92s_phy_query_bb_reg,
         .set_bbreg = rtl92s_phy_set_bb_reg,
         .get_rfreg = rtl92s_phy_query_rf_reg,
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c b/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
index 65c9e80e1f78..87f69166a7ed 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
@@ -2383,24 +2383,3 @@ void rtl8723ae_suspend(struct ieee80211_hw *hw)
 void rtl8723ae_resume(struct ieee80211_hw *hw)
 {
 }
-
-/* Turn on AAP (RCR:bit 0) for promicuous mode. */
-void rtl8723ae_allow_all_destaddr(struct ieee80211_hw *hw,
-        bool allow_all_da, bool write_into_reg)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
-
-        if (allow_all_da) /* Set BIT0 */
-                rtlpci->receive_config |= RCR_AAP;
-        else /* Clear BIT0 */
-                rtlpci->receive_config &= ~RCR_AAP;
-
-        if (write_into_reg)
-                rtl_write_dword(rtlpriv, REG_RCR, rtlpci->receive_config);
-
-
-        RT_TRACE(rtlpriv, COMP_TURBO | COMP_INIT, DBG_LOUD,
-                 "receive_config=0x%08X, write_into_reg=%d\n",
-                 rtlpci->receive_config, write_into_reg);
-}
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/hw.h b/drivers/net/wireless/rtlwifi/rtl8723ae/hw.h
index 6fa24f79b1d7..d3bc39fb27a5 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/hw.h
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/hw.h
@@ -67,7 +67,5 @@ void rtl8723ae_bt_reg_init(struct ieee80211_hw *hw);
 void rtl8723ae_bt_hw_init(struct ieee80211_hw *hw);
 void rtl8723ae_suspend(struct ieee80211_hw *hw);
 void rtl8723ae_resume(struct ieee80211_hw *hw);
-void rtl8723ae_allow_all_destaddr(struct ieee80211_hw *hw,
-                                  bool allow_all_da, bool write_into_reg);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c b/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c
index 1087a3bd07fa..73cba1eec8cf 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c
@@ -238,7 +238,6 @@ static struct rtl_hal_ops rtl8723ae_hal_ops = {
         .enable_hw_sec = rtl8723ae_enable_hw_security_config,
         .set_key = rtl8723ae_set_key,
         .init_sw_leds = rtl8723ae_init_sw_leds,
-        .allow_all_destaddr = rtl8723ae_allow_all_destaddr,
         .get_bbreg = rtl8723_phy_query_bb_reg,
         .set_bbreg = rtl8723_phy_set_bb_reg,
         .get_rfreg = rtl8723ae_phy_query_rf_reg,
diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/rtlwifi/rtl8723be/hw.c
index 0fdf0909321f..3d555495b453 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723be/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723be/hw.c
@@ -2501,23 +2501,3 @@ void rtl8723be_suspend(struct ieee80211_hw *hw)
 void rtl8723be_resume(struct ieee80211_hw *hw)
 {
 }
-
-/* Turn on AAP (RCR:bit 0) for promicuous mode. */
-void rtl8723be_allow_all_destaddr(struct ieee80211_hw *hw, bool allow_all_da,
-                                  bool write_into_reg)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
-
-        if (allow_all_da) /* Set BIT0 */
-                rtlpci->receive_config |= RCR_AAP;
-        else /* Clear BIT0 */
-                rtlpci->receive_config &= ~RCR_AAP;
-
-        if (write_into_reg)
-                rtl_write_dword(rtlpriv, REG_RCR, rtlpci->receive_config);
-
-        RT_TRACE(rtlpriv, COMP_TURBO | COMP_INIT, DBG_LOUD,
-                 "receive_config = 0x%08X, write_into_reg =%d\n",
-                 rtlpci->receive_config, write_into_reg);
-}
diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/hw.h b/drivers/net/wireless/rtlwifi/rtl8723be/hw.h
index b7449a9b57e4..64c7551af6b7 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723be/hw.h
+++ b/drivers/net/wireless/rtlwifi/rtl8723be/hw.h
@@ -59,6 +59,4 @@ void rtl8723be_bt_reg_init(struct ieee80211_hw *hw);
 void rtl8723be_bt_hw_init(struct ieee80211_hw *hw);
 void rtl8723be_suspend(struct ieee80211_hw *hw);
 void rtl8723be_resume(struct ieee80211_hw *hw);
-void rtl8723be_allow_all_destaddr(struct ieee80211_hw *hw, bool allow_all_da,
-                                  bool write_into_reg);
 #endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/sw.c b/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
index a07213645da0..ff12bf41644b 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
@@ -92,7 +92,7 @@ int rtl8723be_init_sw_vars(struct ieee80211_hw *hw)
         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
 
         rtl8723be_bt_reg_init(hw);
-        rtlpci->msi_support = false;
+        rtlpci->msi_support = rtlpriv->cfg->mod_params->msi_support;
         rtlpriv->btcoexist.btc_ops = rtl_btc_get_ops_pointer();
 
         rtlpriv->dm.dm_initialgain_enable = 1;
@@ -253,6 +253,7 @@ static struct rtl_mod_params rtl8723be_mod_params = {
         .inactiveps = true,
         .swctrl_lps = false,
         .fwctrl_lps = true,
+        .msi_support = false,
         .debug = DBG_EMERG,
 };
 
@@ -365,9 +366,11 @@ module_param_named(debug, rtl8723be_mod_params.debug, int, 0444);
 module_param_named(ips, rtl8723be_mod_params.inactiveps, bool, 0444);
 module_param_named(swlps, rtl8723be_mod_params.swctrl_lps, bool, 0444);
 module_param_named(fwlps, rtl8723be_mod_params.fwctrl_lps, bool, 0444);
+module_param_named(msi, rtl8723be_mod_params.msi_support, bool, 0444);
 MODULE_PARM_DESC(swenc, "using hardware crypto (default 0 [hardware])\n");
 MODULE_PARM_DESC(ips, "using no link power save (default 1 is open)\n");
 MODULE_PARM_DESC(fwlps, "using linked fw control power save (default 1 is open)\n");
+MODULE_PARM_DESC(msi, "Set to 1 to use MSI interrupts mode (default 0)\n");
 MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)");
 
 static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume);
diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
index 6965afdf572a..407a7936d364 100644
--- a/drivers/net/wireless/rtlwifi/wifi.h
+++ b/drivers/net/wireless/rtlwifi/wifi.h
@@ -1960,8 +1960,6 @@ struct rtl_hal_ops {
                           u32 regaddr, u32 bitmask);
         void (*set_rfreg) (struct ieee80211_hw *hw, enum radio_path rfpath,
                            u32 regaddr, u32 bitmask, u32 data);
-        void (*allow_all_destaddr)(struct ieee80211_hw *hw,
-                bool allow_all_da, bool write_into_reg);
         void (*linked_set_reg) (struct ieee80211_hw *hw);
         void (*chk_switch_dmdp) (struct ieee80211_hw *hw);
         void (*dualmac_easy_concurrent) (struct ieee80211_hw *hw);
@@ -2030,6 +2028,10 @@ struct rtl_mod_params {
 
         /* default: 1 = using linked fw power save */
         bool fwctrl_lps;
+
+        /* default: 0 = not using MSI interrupts mode */
+        /* submodules should set their own defalut value */
+        bool msi_support;
 };
 
 struct rtl_hal_usbint_cfg {
diff --git a/drivers/net/wireless/ti/wl1251/acx.c b/drivers/net/wireless/ti/wl1251/acx.c
index 5a4ec56c83d0..5695628757ee 100644
--- a/drivers/net/wireless/ti/wl1251/acx.c
+++ b/drivers/net/wireless/ti/wl1251/acx.c
@@ -2,7 +2,6 @@
 
 #include <linux/module.h>
 #include <linux/slab.h>
-#include <linux/crc7.h>
 
 #include "wl1251.h"
 #include "reg.h"
diff --git a/drivers/net/wireless/ti/wl1251/cmd.c b/drivers/net/wireless/ti/wl1251/cmd.c
index bf1fa18b9786..ede31f048ef9 100644
--- a/drivers/net/wireless/ti/wl1251/cmd.c
+++ b/drivers/net/wireless/ti/wl1251/cmd.c
@@ -2,7 +2,6 @@
 
 #include <linux/module.h>
 #include <linux/slab.h>
-#include <linux/crc7.h>
 #include <linux/etherdevice.h>
 
 #include "wl1251.h"
diff --git a/drivers/net/wireless/ti/wl1251/event.c b/drivers/net/wireless/ti/wl1251/event.c
index db0105313745..c98630394a1a 100644
--- a/drivers/net/wireless/ti/wl1251/event.c
+++ b/drivers/net/wireless/ti/wl1251/event.c
@@ -124,11 +124,12 @@ static int wl1251_event_process(struct wl1251 *wl, struct event_mailbox *mbox)
                         return ret;
         }
 
-        if (wl->vif && vector & SYNCHRONIZATION_TIMEOUT_EVENT_ID) {
+        if (vector & SYNCHRONIZATION_TIMEOUT_EVENT_ID) {
                 wl1251_debug(DEBUG_EVENT, "SYNCHRONIZATION_TIMEOUT_EVENT");
 
                 /* indicate to the stack, that beacons have been lost */
-                ieee80211_beacon_loss(wl->vif);
+                if (wl->vif && wl->vif->type == NL80211_IFTYPE_STATION)
+                        ieee80211_beacon_loss(wl->vif);
         }
 
         if (vector & REGAINED_BSS_EVENT_ID) {
diff --git a/drivers/net/wireless/ti/wl1251/main.c b/drivers/net/wireless/ti/wl1251/main.c
index 757e25784a8a..4e782f18ae34 100644
--- a/drivers/net/wireless/ti/wl1251/main.c
+++ b/drivers/net/wireless/ti/wl1251/main.c
@@ -550,6 +550,34 @@ static void wl1251_op_remove_interface(struct ieee80211_hw *hw,
         mutex_unlock(&wl->mutex);
 }
 
+static int wl1251_build_null_data(struct wl1251 *wl)
+{
+        struct sk_buff *skb = NULL;
+        int size;
+        void *ptr;
+        int ret = -ENOMEM;
+
+        if (wl->bss_type == BSS_TYPE_IBSS) {
+                size = sizeof(struct wl12xx_null_data_template);
+                ptr = NULL;
+        } else {
+                skb = ieee80211_nullfunc_get(wl->hw, wl->vif);
+                if (!skb)
+                        goto out;
+                size = skb->len;
+                ptr = skb->data;
+        }
+
+        ret = wl1251_cmd_template_set(wl, CMD_NULL_DATA, ptr, size);
+
+out:
+        dev_kfree_skb(skb);
+        if (ret)
+                wl1251_warning("cmd buld null data failed: %d", ret);
+
+        return ret;
+}
+
 static int wl1251_build_qos_null_data(struct wl1251 *wl)
 {
         struct ieee80211_qos_hdr template;
@@ -687,16 +715,6 @@ static int wl1251_op_config(struct ieee80211_hw *hw, u32 changed)
                 wl->power_level = conf->power_level;
         }
 
-        /*
-         * Tell stack that connection is lost because hw encryption isn't
-         * supported in monitor mode.
-         * This requires temporary enabling of the hw connection monitor flag
-         */
-        if ((changed & IEEE80211_CONF_CHANGE_MONITOR) && wl->vif) {
-                wl->hw->flags |= IEEE80211_HW_CONNECTION_MONITOR;
-                ieee80211_connection_loss(wl->vif);
-        }
-
 out_sleep:
         wl1251_ps_elp_sleep(wl);
 
@@ -1103,24 +1121,19 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
                 wl->rssi_thold = bss_conf->cqm_rssi_thold;
         }
 
-        if (changed & BSS_CHANGED_BSSID) {
+        if ((changed & BSS_CHANGED_BSSID) &&
+            memcmp(wl->bssid, bss_conf->bssid, ETH_ALEN)) {
                 memcpy(wl->bssid, bss_conf->bssid, ETH_ALEN);
 
-                skb = ieee80211_nullfunc_get(wl->hw, wl->vif);
-                if (!skb)
-                        goto out_sleep;
-
-                ret = wl1251_cmd_template_set(wl, CMD_NULL_DATA,
-                                              skb->data, skb->len);
-                dev_kfree_skb(skb);
-                if (ret < 0)
-                        goto out_sleep;
+                if (!is_zero_ether_addr(wl->bssid)) {
+                        ret = wl1251_build_null_data(wl);
+                        if (ret < 0)
+                                goto out_sleep;
 
-                ret = wl1251_build_qos_null_data(wl);
-                if (ret < 0)
-                        goto out;
+                        ret = wl1251_build_qos_null_data(wl);
+                        if (ret < 0)
+                                goto out_sleep;
 
-                if (wl->bss_type != BSS_TYPE_IBSS) {
                         ret = wl1251_join(wl, wl->bss_type, wl->channel,
                                           wl->beacon_int, wl->dtim_period);
                         if (ret < 0)
@@ -1129,9 +1142,6 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
         }
 
         if (changed & BSS_CHANGED_ASSOC) {
-                /* Disable temporary enabled hw connection monitor flag */
-                wl->hw->flags &= ~IEEE80211_HW_CONNECTION_MONITOR;
-
                 if (bss_conf->assoc) {
                         wl->beacon_int = bss_conf->beacon_int;
 
@@ -1216,8 +1226,8 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
                 if (ret < 0)
                         goto out_sleep;
 
-                ret = wl1251_join(wl, wl->bss_type, wl->beacon_int,
-                                  wl->channel, wl->dtim_period);
+                ret = wl1251_join(wl, wl->bss_type, wl->channel,
+                                  wl->beacon_int, wl->dtim_period);
 
                 if (ret < 0)
                         goto out_sleep;
diff --git a/drivers/net/wireless/ti/wl1251/spi.c b/drivers/net/wireless/ti/wl1251/spi.c
index b06d36d99362..a0aa8fa72392 100644
--- a/drivers/net/wireless/ti/wl1251/spi.c
+++ b/drivers/net/wireless/ti/wl1251/spi.c
@@ -23,6 +23,7 @@
 #include <linux/irq.h>
 #include <linux/module.h>
 #include <linux/slab.h>
+#include <linux/swab.h>
 #include <linux/crc7.h>
 #include <linux/spi/spi.h>
 #include <linux/wl12xx.h>
@@ -83,47 +84,44 @@ static void wl1251_spi_reset(struct wl1251 *wl)
 
 static void wl1251_spi_wake(struct wl1251 *wl)
 {
-        u8 crc[WSPI_INIT_CMD_CRC_LEN], *cmd;
         struct spi_transfer t;
         struct spi_message m;
+        u8 *cmd = kzalloc(WSPI_INIT_CMD_LEN, GFP_KERNEL);
 
-        cmd = kzalloc(WSPI_INIT_CMD_LEN, GFP_KERNEL);
         if (!cmd) {
                 wl1251_error("could not allocate cmd for spi init");
                 return;
         }
 
-        memset(crc, 0, sizeof(crc));
         memset(&t, 0, sizeof(t));
         spi_message_init(&m);
 
         /* Set WSPI_INIT_COMMAND
          * the data is being send from the MSB to LSB
          */
-        cmd[2] = 0xff;
-        cmd[3] = 0xff;
-        cmd[1] = WSPI_INIT_CMD_START | WSPI_INIT_CMD_TX;
-        cmd[0] = 0;
-        cmd[7] = 0;
-        cmd[6] |= HW_ACCESS_WSPI_INIT_CMD_MASK << 3;
-        cmd[6] |= HW_ACCESS_WSPI_FIXED_BUSY_LEN & WSPI_INIT_CMD_FIXEDBUSY_LEN;
+        cmd[0] = 0xff;
+        cmd[1] = 0xff;
+        cmd[2] = WSPI_INIT_CMD_START | WSPI_INIT_CMD_TX;
+        cmd[3] = 0;
+        cmd[4] = 0;
+        cmd[5] = HW_ACCESS_WSPI_INIT_CMD_MASK << 3;
+        cmd[5] |= HW_ACCESS_WSPI_FIXED_BUSY_LEN & WSPI_INIT_CMD_FIXEDBUSY_LEN;
+
+        cmd[6] = WSPI_INIT_CMD_IOD | WSPI_INIT_CMD_IP | WSPI_INIT_CMD_CS
+                | WSPI_INIT_CMD_WSPI | WSPI_INIT_CMD_WS;
 
         if (HW_ACCESS_WSPI_FIXED_BUSY_LEN == 0)
-                cmd[5] |=  WSPI_INIT_CMD_DIS_FIXEDBUSY;
+                cmd[6] |= WSPI_INIT_CMD_DIS_FIXEDBUSY;
         else
-                cmd[5] |= WSPI_INIT_CMD_EN_FIXEDBUSY;
-
-        cmd[5] |= WSPI_INIT_CMD_IOD | WSPI_INIT_CMD_IP | WSPI_INIT_CMD_CS
-                | WSPI_INIT_CMD_WSPI | WSPI_INIT_CMD_WS;
-
-        crc[0] = cmd[1];
-        crc[1] = cmd[0];
-        crc[2] = cmd[7];
-        crc[3] = cmd[6];
-        crc[4] = cmd[5];
+                cmd[6] |= WSPI_INIT_CMD_EN_FIXEDBUSY;
 
-        cmd[4] |= crc7(0, crc, WSPI_INIT_CMD_CRC_LEN) << 1;
-        cmd[4] |= WSPI_INIT_CMD_END;
+        cmd[7] = crc7_be(0, cmd+2, WSPI_INIT_CMD_CRC_LEN) | WSPI_INIT_CMD_END;
+        /*
+         * The above is the logical order; it must actually be stored
+         * in the buffer byte-swapped.
+         */
+        __swab32s((u32 *)cmd);
+        __swab32s((u32 *)cmd+1);
 
         t.tx_buf = cmd;
         t.len = WSPI_INIT_CMD_LEN;
diff --git a/drivers/net/wireless/ti/wlcore/debugfs.h b/drivers/net/wireless/ti/wlcore/debugfs.h
index f7381dd69009..0f2cfb0d2a9e 100644
--- a/drivers/net/wireless/ti/wlcore/debugfs.h
+++ b/drivers/net/wireless/ti/wlcore/debugfs.h
@@ -57,7 +57,7 @@ static const struct file_operations name## _ops = {			\
                                             wl, &name## _ops);          \
                 if (!entry || IS_ERR(entry))                            \
                         goto err;                                       \
-        } while (0);
+        } while (0)
 
 
 #define DEBUGFS_ADD_PREFIX(prefix, name, parent)                        \
@@ -66,7 +66,7 @@ static const struct file_operations name## _ops = {			\
                                     wl, &prefix## _## name## _ops);     \
                 if (!entry || IS_ERR(entry))                            \
                         goto err;                                       \
-        } while (0);
+        } while (0)
 
 #define DEBUGFS_FWSTATS_FILE(sub, name, fmt, struct_type)               \
 static ssize_t sub## _ ##name## _read(struct file *file,                \
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index 077eb5b9cd74..02c91d6db753 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -1416,7 +1416,7 @@ void wl1271_rx_filter_free(struct wl12xx_rx_filter *filter)
 
 int wl1271_rx_filter_alloc_field(struct wl12xx_rx_filter *filter,
                                  u16 offset, u8 flags,
-                                 u8 *pattern, u8 len)
+                                 const u8 *pattern, u8 len)
 {
         struct wl12xx_rx_filter_field *field;
 
diff --git a/drivers/net/wireless/ti/wlcore/spi.c b/drivers/net/wireless/ti/wlcore/spi.c
index 5f3a389dd74c..392c882b28f0 100644
--- a/drivers/net/wireless/ti/wlcore/spi.c
+++ b/drivers/net/wireless/ti/wlcore/spi.c
@@ -24,11 +24,12 @@
 #include <linux/interrupt.h>
 #include <linux/irq.h>
 #include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/swab.h>
 #include <linux/crc7.h>
 #include <linux/spi/spi.h>
 #include <linux/wl12xx.h>
 #include <linux/platform_device.h>
-#include <linux/slab.h>
 
 #include "wlcore.h"
 #include "wl12xx_80211.h"
@@ -110,18 +111,16 @@ static void wl12xx_spi_reset(struct device *child)
 static void wl12xx_spi_init(struct device *child)
 {
         struct wl12xx_spi_glue *glue = dev_get_drvdata(child->parent);
-        u8 crc[WSPI_INIT_CMD_CRC_LEN], *cmd;
         struct spi_transfer t;
         struct spi_message m;
+        u8 *cmd = kzalloc(WSPI_INIT_CMD_LEN, GFP_KERNEL);
 
-        cmd = kzalloc(WSPI_INIT_CMD_LEN, GFP_KERNEL);
         if (!cmd) {
                 dev_err(child->parent,
                         "could not allocate cmd for spi init\n");
                 return;
         }
 
-        memset(crc, 0, sizeof(crc));
         memset(&t, 0, sizeof(t));
         spi_message_init(&m);
 
@@ -129,30 +128,29 @@ static void wl12xx_spi_init(struct device *child)
          * Set WSPI_INIT_COMMAND
          * the data is being send from the MSB to LSB
          */
-        cmd[2] = 0xff;
-        cmd[3] = 0xff;
-        cmd[1] = WSPI_INIT_CMD_START | WSPI_INIT_CMD_TX;
-        cmd[0] = 0;
-        cmd[7] = 0;
-        cmd[6] |= HW_ACCESS_WSPI_INIT_CMD_MASK << 3;
-        cmd[6] |= HW_ACCESS_WSPI_FIXED_BUSY_LEN & WSPI_INIT_CMD_FIXEDBUSY_LEN;
+        cmd[0] = 0xff;
+        cmd[1] = 0xff;
+        cmd[2] = WSPI_INIT_CMD_START | WSPI_INIT_CMD_TX;
+        cmd[3] = 0;
+        cmd[4] = 0;
+        cmd[5] = HW_ACCESS_WSPI_INIT_CMD_MASK << 3;
+        cmd[5] |= HW_ACCESS_WSPI_FIXED_BUSY_LEN & WSPI_INIT_CMD_FIXEDBUSY_LEN;
+
+        cmd[6] = WSPI_INIT_CMD_IOD | WSPI_INIT_CMD_IP | WSPI_INIT_CMD_CS
+                | WSPI_INIT_CMD_WSPI | WSPI_INIT_CMD_WS;
 
         if (HW_ACCESS_WSPI_FIXED_BUSY_LEN == 0)
-                cmd[5] |=  WSPI_INIT_CMD_DIS_FIXEDBUSY;
+                cmd[6] |= WSPI_INIT_CMD_DIS_FIXEDBUSY;
         else
-                cmd[5] |= WSPI_INIT_CMD_EN_FIXEDBUSY;
+                cmd[6] |= WSPI_INIT_CMD_EN_FIXEDBUSY;
 
-        cmd[5] |= WSPI_INIT_CMD_IOD | WSPI_INIT_CMD_IP | WSPI_INIT_CMD_CS
-                | WSPI_INIT_CMD_WSPI | WSPI_INIT_CMD_WS;
-
-        crc[0] = cmd[1];
-        crc[1] = cmd[0];
-        crc[2] = cmd[7];
-        crc[3] = cmd[6];
-        crc[4] = cmd[5];
-
-        cmd[4] |= crc7(0, crc, WSPI_INIT_CMD_CRC_LEN) << 1;
-        cmd[4] |= WSPI_INIT_CMD_END;
+        cmd[7] = crc7_be(0, cmd+2, WSPI_INIT_CMD_CRC_LEN) | WSPI_INIT_CMD_END;
+        /*
+         * The above is the logical order; it must actually be stored
+         * in the buffer byte-swapped.
+         */
+        __swab32s((u32 *)cmd);
+        __swab32s((u32 *)cmd+1);
 
         t.tx_buf = cmd;
         t.len = WSPI_INIT_CMD_LEN;
diff --git a/drivers/net/wireless/ti/wlcore/wlcore_i.h b/drivers/net/wireless/ti/wlcore/wlcore_i.h
index 756e890bc5ee..c2c34a84ff3d 100644
--- a/drivers/net/wireless/ti/wlcore/wlcore_i.h
+++ b/drivers/net/wireless/ti/wlcore/wlcore_i.h
@@ -512,8 +512,8 @@ int wl1271_recalc_rx_streaming(struct wl1271 *wl, struct wl12xx_vif *wlvif);
 void wl12xx_queue_recovery_work(struct wl1271 *wl);
 size_t wl12xx_copy_fwlog(struct wl1271 *wl, u8 *memblock, size_t maxlen);
 int wl1271_rx_filter_alloc_field(struct wl12xx_rx_filter *filter,
-                                        u16 offset, u8 flags,
-                                        u8 *pattern, u8 len);
+                                 u16 offset, u8 flags,
+                                 const u8 *pattern, u8 len);
 void wl1271_rx_filter_free(struct wl12xx_rx_filter *filter);
 struct wl12xx_rx_filter *wl1271_rx_filter_alloc(void);
 int wl1271_rx_filter_get_fields_size(struct wl12xx_rx_filter *filter);
diff --git a/drivers/nfc/Kconfig b/drivers/nfc/Kconfig
index 65d4ca19d132..26c66a126551 100644
--- a/drivers/nfc/Kconfig
+++ b/drivers/nfc/Kconfig
@@ -71,5 +71,6 @@ config NFC_PORT100
 source "drivers/nfc/pn544/Kconfig"
 source "drivers/nfc/microread/Kconfig"
 source "drivers/nfc/nfcmrvl/Kconfig"
+source "drivers/nfc/st21nfca/Kconfig"
 
 endmenu
diff --git a/drivers/nfc/Makefile b/drivers/nfc/Makefile
index ae42a3fa60c9..23225b0287fd 100644
--- a/drivers/nfc/Makefile
+++ b/drivers/nfc/Makefile
@@ -11,5 +11,6 @@ obj-$(CONFIG_NFC_SIM)		+= nfcsim.o
 obj-$(CONFIG_NFC_PORT100)       += port100.o
 obj-$(CONFIG_NFC_MRVL)          += nfcmrvl/
 obj-$(CONFIG_NFC_TRF7970A)      += trf7970a.o
+obj-$(CONFIG_NFC_ST21NFCA)  += st21nfca/
 
 ccflags-$(CONFIG_NFC_DEBUG) := -DDEBUG
diff --git a/drivers/nfc/pn544/i2c.c b/drivers/nfc/pn544/i2c.c
index f2acd85be86e..440291ab7263 100644
--- a/drivers/nfc/pn544/i2c.c
+++ b/drivers/nfc/pn544/i2c.c
@@ -22,6 +22,8 @@
 #include <linux/module.h>
 #include <linux/i2c.h>
 #include <linux/gpio.h>
+#include <linux/of_gpio.h>
+#include <linux/of_irq.h>
 #include <linux/miscdevice.h>
 #include <linux/interrupt.h>
 #include <linux/delay.h>
@@ -857,6 +859,92 @@ exit_state_wait_secure_write_answer:
         }
 }
 
+#ifdef CONFIG_OF
+
+static int pn544_hci_i2c_of_request_resources(struct i2c_client *client)
+{
+        struct pn544_i2c_phy *phy = i2c_get_clientdata(client);
+        struct device_node *pp;
+        int ret;
+
+        pp = client->dev.of_node;
+        if (!pp) {
+                ret = -ENODEV;
+                goto err_dt;
+        }
+
+        /* Obtention of EN GPIO from device tree */
+        ret = of_get_named_gpio(pp, "enable-gpios", 0);
+        if (ret < 0) {
+                if (ret != -EPROBE_DEFER)
+                        nfc_err(&client->dev,
+                                "Failed to get EN gpio, error: %d\n", ret);
+                goto err_dt;
+        }
+        phy->gpio_en = ret;
+
+        /* Configuration of EN GPIO */
+        ret = gpio_request(phy->gpio_en, "pn544_en");
+        if (ret) {
+                nfc_err(&client->dev, "Fail EN pin\n");
+                goto err_dt;
+        }
+        ret = gpio_direction_output(phy->gpio_en, 0);
+        if (ret) {
+                nfc_err(&client->dev, "Fail EN pin direction\n");
+                goto err_gpio_en;
+        }
+
+        /* Obtention of FW GPIO from device tree */
+        ret = of_get_named_gpio(pp, "firmware-gpios", 0);
+        if (ret < 0) {
+                if (ret != -EPROBE_DEFER)
+                        nfc_err(&client->dev,
+                                "Failed to get FW gpio, error: %d\n", ret);
+                goto err_gpio_en;
+        }
+        phy->gpio_fw = ret;
+
+        /* Configuration of FW GPIO */
+        ret = gpio_request(phy->gpio_fw, "pn544_fw");
+        if (ret) {
+                nfc_err(&client->dev, "Fail FW pin\n");
+                goto err_gpio_en;
+        }
+        ret = gpio_direction_output(phy->gpio_fw, 0);
+        if (ret) {
+                nfc_err(&client->dev, "Fail FW pin direction\n");
+                goto err_gpio_fw;
+        }
+
+        /* IRQ */
+        ret = irq_of_parse_and_map(pp, 0);
+        if (ret < 0) {
+                nfc_err(&client->dev,
+                        "Unable to get irq, error: %d\n", ret);
+                goto err_gpio_fw;
+        }
+        client->irq = ret;
+
+        return 0;
+
+err_gpio_fw:
+        gpio_free(phy->gpio_fw);
+err_gpio_en:
+        gpio_free(phy->gpio_en);
+err_dt:
+        return ret;
+}
+
+#else
+
+static int pn544_hci_i2c_of_request_resources(struct i2c_client *client)
+{
+        return -ENODEV;
+}
+
+#endif
+
 static int pn544_hci_i2c_probe(struct i2c_client *client,
                                const struct i2c_device_id *id)
 {
@@ -887,25 +975,36 @@ static int pn544_hci_i2c_probe(struct i2c_client *client,
         i2c_set_clientdata(client, phy);
 
         pdata = client->dev.platform_data;
-        if (pdata == NULL) {
-                nfc_err(&client->dev, "No platform data\n");
-                return -EINVAL;
-        }
 
-        if (pdata->request_resources == NULL) {
-                nfc_err(&client->dev, "request_resources() missing\n");
-                return -EINVAL;
-        }
+        /* No platform data, using device tree. */
+        if (!pdata && client->dev.of_node) {
+                r = pn544_hci_i2c_of_request_resources(client);
+                if (r) {
+                        nfc_err(&client->dev, "No DT data\n");
+                        return r;
+                }
+        /* Using platform data. */
+        } else if (pdata) {
 
-        r = pdata->request_resources(client);
-        if (r) {
-                nfc_err(&client->dev, "Cannot get platform resources\n");
-                return r;
-        }
+                if (pdata->request_resources == NULL) {
+                        nfc_err(&client->dev, "request_resources() missing\n");
+                        return -EINVAL;
+                }
 
-        phy->gpio_en = pdata->get_gpio(NFC_GPIO_ENABLE);
-        phy->gpio_fw = pdata->get_gpio(NFC_GPIO_FW_RESET);
-        phy->gpio_irq = pdata->get_gpio(NFC_GPIO_IRQ);
+                r = pdata->request_resources(client);
+                if (r) {
+                        nfc_err(&client->dev,
+                                "Cannot get platform resources\n");
+                        return r;
+                }
+
+                phy->gpio_en = pdata->get_gpio(NFC_GPIO_ENABLE);
+                phy->gpio_fw = pdata->get_gpio(NFC_GPIO_FW_RESET);
+                phy->gpio_irq = pdata->get_gpio(NFC_GPIO_IRQ);
+        } else {
+                nfc_err(&client->dev, "No platform data\n");
+                return -EINVAL;
+        }
 
         pn544_hci_i2c_platform_init(phy);
 
@@ -930,8 +1029,12 @@ err_hci:
         free_irq(client->irq, phy);
 
 err_rti:
-        if (pdata->free_resources != NULL)
+        if (!pdata) {
+                gpio_free(phy->gpio_en);
+                gpio_free(phy->gpio_fw);
+        } else if (pdata->free_resources) {
                 pdata->free_resources();
+        }
 
         return r;
 }
@@ -953,15 +1056,30 @@ static int pn544_hci_i2c_remove(struct i2c_client *client)
                 pn544_hci_i2c_disable(phy);
 
         free_irq(client->irq, phy);
-        if (pdata->free_resources)
+
+        /* No platform data, GPIOs have been requested by this driver */
+        if (!pdata) {
+                gpio_free(phy->gpio_en);
+                gpio_free(phy->gpio_fw);
+        /* Using platform data */
+        } else if (pdata->free_resources) {
                 pdata->free_resources();
+        }
 
         return 0;
 }
 
+static const struct of_device_id of_pn544_i2c_match[] = {
+        { .compatible = "nxp,pn544-i2c", },
+        {},
+};
+MODULE_DEVICE_TABLE(of, of_pn544_i2c_match);
+
 static struct i2c_driver pn544_hci_i2c_driver = {
         .driver = {
                    .name = PN544_HCI_I2C_DRIVER_NAME,
+                   .owner  = THIS_MODULE,
+                   .of_match_table = of_match_ptr(of_pn544_i2c_match),
                   },
         .probe = pn544_hci_i2c_probe,
         .id_table = pn544_hci_i2c_id_table,
diff --git a/drivers/nfc/st21nfca/Kconfig b/drivers/nfc/st21nfca/Kconfig
new file mode 100644
index 000000000000..ee459f066ade
--- /dev/null
+++ b/drivers/nfc/st21nfca/Kconfig
@@ -0,0 +1,23 @@
+config NFC_ST21NFCA
+        tristate "STMicroelectronics ST21NFCA NFC driver"
+        depends on NFC_HCI
+        select CRC_CCITT
+        default n
+        ---help---
+          STMicroelectronics ST21NFCA core driver. It implements the chipset
+          HCI logic and hooks into the NFC kernel APIs. Physical layers will
+          register against it.
+
+          To compile this driver as a module, choose m here. The module will
+          be called st21nfca.
+          Say N if unsure.
+
+config NFC_ST21NFCA_I2C
+        tristate "NFC ST21NFCA i2c support"
+        depends on NFC_ST21NFCA && I2C && NFC_SHDLC
+        ---help---
+          This module adds support for the STMicroelectronics st21nfca i2c interface.
+          Select this if your platform is using the i2c bus.
+
+          If you choose to build a module, it'll be called st21nfca_i2c.
+          Say N if unsure.
diff --git a/drivers/nfc/st21nfca/Makefile b/drivers/nfc/st21nfca/Makefile
new file mode 100644
index 000000000000..038ed093a119
--- /dev/null
+++ b/drivers/nfc/st21nfca/Makefile
@@ -0,0 +1,8 @@
+#
+# Makefile for ST21NFCA HCI based NFC driver
+#
+
+st21nfca_i2c-objs  = i2c.o
+
+obj-$(CONFIG_NFC_ST21NFCA)     += st21nfca.o
+obj-$(CONFIG_NFC_ST21NFCA_I2C) += st21nfca_i2c.o
diff --git a/drivers/nfc/st21nfca/i2c.c b/drivers/nfc/st21nfca/i2c.c
new file mode 100644
index 000000000000..3f954ed86d98
--- /dev/null
+++ b/drivers/nfc/st21nfca/i2c.c
@@ -0,0 +1,724 @@
+/*
+ * I2C Link Layer for ST21NFCA HCI based Driver
+ * Copyright (C) 2014  STMicroelectronics SAS. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/crc-ccitt.h>
+#include <linux/module.h>
+#include <linux/i2c.h>
+#include <linux/gpio.h>
+#include <linux/of_irq.h>
+#include <linux/of_gpio.h>
+#include <linux/miscdevice.h>
+#include <linux/interrupt.h>
+#include <linux/delay.h>
+#include <linux/nfc.h>
+#include <linux/firmware.h>
+#include <linux/unaligned/access_ok.h>
+#include <linux/platform_data/st21nfca.h>
+
+#include <net/nfc/hci.h>
+#include <net/nfc/llc.h>
+#include <net/nfc/nfc.h>
+
+#include "st21nfca.h"
+
+/*
+ * Every frame starts with ST21NFCA_SOF_EOF and ends with ST21NFCA_SOF_EOF.
+ * Because ST21NFCA_SOF_EOF is a possible data value, there is a mecanism
+ * called byte stuffing has been introduced.
+ *
+ * if byte == ST21NFCA_SOF_EOF or ST21NFCA_ESCAPE_BYTE_STUFFING
+ * - insert ST21NFCA_ESCAPE_BYTE_STUFFING (escape byte)
+ * - xor byte with ST21NFCA_BYTE_STUFFING_MASK
+ */
+#define ST21NFCA_SOF_EOF                0x7e
+#define ST21NFCA_BYTE_STUFFING_MASK     0x20
+#define ST21NFCA_ESCAPE_BYTE_STUFFING   0x7d
+
+/* SOF + 00 */
+#define ST21NFCA_FRAME_HEADROOM                 2
+
+/* 2 bytes crc + EOF */
+#define ST21NFCA_FRAME_TAILROOM 3
+#define IS_START_OF_FRAME(buf) (buf[0] == ST21NFCA_SOF_EOF && \
+                                buf[1] == 0)
+
+#define ST21NFCA_HCI_I2C_DRIVER_NAME "st21nfca_hci_i2c"
+
+static struct i2c_device_id st21nfca_hci_i2c_id_table[] = {
+        {ST21NFCA_HCI_DRIVER_NAME, 0},
+        {}
+};
+
+MODULE_DEVICE_TABLE(i2c, st21nfca_hci_i2c_id_table);
+
+struct st21nfca_i2c_phy {
+        struct i2c_client *i2c_dev;
+        struct nfc_hci_dev *hdev;
+
+        unsigned int gpio_ena;
+        unsigned int gpio_irq;
+        unsigned int irq_polarity;
+
+        struct sk_buff *pending_skb;
+        int current_read_len;
+        /*
+         * crc might have fail because i2c macro
+         * is disable due to other interface activity
+         */
+        int crc_trials;
+
+        int powered;
+        int run_mode;
+
+        /*
+         * < 0 if hardware error occured (e.g. i2c err)
+         * and prevents normal operation.
+         */
+        int hard_fault;
+        struct mutex phy_lock;
+};
+static u8 len_seq[] = { 13, 24, 15, 29 };
+static u16 wait_tab[] = { 2, 3, 5, 15, 20, 40};
+
+#define I2C_DUMP_SKB(info, skb)                                 \
+do {                                                            \
+        pr_debug("%s:\n", info);                                \
+        print_hex_dump(KERN_DEBUG, "i2c: ", DUMP_PREFIX_OFFSET, \
+                       16, 1, (skb)->data, (skb)->len, 0);      \
+} while (0)
+
+/*
+ * In order to get the CLF in a known state we generate an internal reboot
+ * using a proprietary command.
+ * Once the reboot is completed, we expect to receive a ST21NFCA_SOF_EOF
+ * fill buffer.
+ */
+static int st21nfca_hci_platform_init(struct st21nfca_i2c_phy *phy)
+{
+        u16 wait_reboot[] = { 50, 300, 1000 };
+        char reboot_cmd[] = { 0x7E, 0x66, 0x48, 0xF6, 0x7E };
+        u8 tmp[ST21NFCA_HCI_LLC_MAX_SIZE];
+        int i, r = -1;
+
+        for (i = 0; i < ARRAY_SIZE(wait_reboot) && r < 0; i++) {
+                r = i2c_master_send(phy->i2c_dev, reboot_cmd,
+                                    sizeof(reboot_cmd));
+                if (r < 0)
+                        msleep(wait_reboot[i]);
+        }
+        if (r < 0)
+                return r;
+
+        /* CLF is spending about 20ms to do an internal reboot */
+        msleep(20);
+        r = -1;
+        for (i = 0; i < ARRAY_SIZE(wait_reboot) && r < 0; i++) {
+                r = i2c_master_recv(phy->i2c_dev, tmp,
+                                    ST21NFCA_HCI_LLC_MAX_SIZE);
+                if (r < 0)
+                        msleep(wait_reboot[i]);
+        }
+        if (r < 0)
+                return r;
+
+        for (i = 0; i < ST21NFCA_HCI_LLC_MAX_SIZE &&
+                tmp[i] == ST21NFCA_SOF_EOF; i++)
+                ;
+
+        if (r != ST21NFCA_HCI_LLC_MAX_SIZE)
+                return -ENODEV;
+
+        usleep_range(1000, 1500);
+        return 0;
+}
+
+static int st21nfca_hci_i2c_enable(void *phy_id)
+{
+        struct st21nfca_i2c_phy *phy = phy_id;
+
+        gpio_set_value(phy->gpio_ena, 1);
+        phy->powered = 1;
+        phy->run_mode = ST21NFCA_HCI_MODE;
+
+        usleep_range(10000, 15000);
+
+        return 0;
+}
+
+static void st21nfca_hci_i2c_disable(void *phy_id)
+{
+        struct st21nfca_i2c_phy *phy = phy_id;
+
+        pr_info("\n");
+        gpio_set_value(phy->gpio_ena, 0);
+
+        phy->powered = 0;
+}
+
+static void st21nfca_hci_add_len_crc(struct sk_buff *skb)
+{
+        u16 crc;
+        u8 tmp;
+
+        *skb_push(skb, 1) = 0;
+
+        crc = crc_ccitt(0xffff, skb->data, skb->len);
+        crc = ~crc;
+
+        tmp = crc & 0x00ff;
+        *skb_put(skb, 1) = tmp;
+
+        tmp = (crc >> 8) & 0x00ff;
+        *skb_put(skb, 1) = tmp;
+}
+
+static void st21nfca_hci_remove_len_crc(struct sk_buff *skb)
+{
+        skb_pull(skb, ST21NFCA_FRAME_HEADROOM);
+        skb_trim(skb, skb->len - ST21NFCA_FRAME_TAILROOM);
+}
+
+/*
+ * Writing a frame must not return the number of written bytes.
+ * It must return either zero for success, or <0 for error.
+ * In addition, it must not alter the skb
+ */
+static int st21nfca_hci_i2c_write(void *phy_id, struct sk_buff *skb)
+{
+        int r = -1, i, j;
+        struct st21nfca_i2c_phy *phy = phy_id;
+        struct i2c_client *client = phy->i2c_dev;
+        u8 tmp[ST21NFCA_HCI_LLC_MAX_SIZE * 2];
+
+        I2C_DUMP_SKB("st21nfca_hci_i2c_write", skb);
+
+
+        if (phy->hard_fault != 0)
+                return phy->hard_fault;
+
+        /*
+         * Compute CRC before byte stuffing computation on frame
+         * Note st21nfca_hci_add_len_crc is doing a byte stuffing
+         * on its own value
+         */
+        st21nfca_hci_add_len_crc(skb);
+
+        /* add ST21NFCA_SOF_EOF on tail */
+        *skb_put(skb, 1) = ST21NFCA_SOF_EOF;
+        /* add ST21NFCA_SOF_EOF on head */
+        *skb_push(skb, 1) = ST21NFCA_SOF_EOF;
+
+        /*
+         * Compute byte stuffing
+         * if byte == ST21NFCA_SOF_EOF or ST21NFCA_ESCAPE_BYTE_STUFFING
+         * insert ST21NFCA_ESCAPE_BYTE_STUFFING (escape byte)
+         * xor byte with ST21NFCA_BYTE_STUFFING_MASK
+         */
+        tmp[0] = skb->data[0];
+        for (i = 1, j = 1; i < skb->len - 1; i++, j++) {
+                if (skb->data[i] == ST21NFCA_SOF_EOF
+                    || skb->data[i] == ST21NFCA_ESCAPE_BYTE_STUFFING) {
+                        tmp[j] = ST21NFCA_ESCAPE_BYTE_STUFFING;
+                        j++;
+                        tmp[j] = skb->data[i] ^ ST21NFCA_BYTE_STUFFING_MASK;
+                } else {
+                        tmp[j] = skb->data[i];
+                }
+        }
+        tmp[j] = skb->data[i];
+        j++;
+
+        /*
+         * Manage sleep mode
+         * Try 3 times to send data with delay between each
+         */
+        mutex_lock(&phy->phy_lock);
+        for (i = 0; i < ARRAY_SIZE(wait_tab) && r < 0; i++) {
+                r = i2c_master_send(client, tmp, j);
+                if (r < 0)
+                        msleep(wait_tab[i]);
+        }
+        mutex_unlock(&phy->phy_lock);
+
+        if (r >= 0) {
+                if (r != j)
+                        r = -EREMOTEIO;
+                else
+                        r = 0;
+        }
+
+        st21nfca_hci_remove_len_crc(skb);
+
+        return r;
+}
+
+static int get_frame_size(u8 *buf, int buflen)
+{
+        int len = 0;
+        if (buf[len + 1] == ST21NFCA_SOF_EOF)
+                return 0;
+
+        for (len = 1; len < buflen && buf[len] != ST21NFCA_SOF_EOF; len++)
+                ;
+
+        return len;
+}
+
+static int check_crc(u8 *buf, int buflen)
+{
+        u16 crc;
+
+        crc = crc_ccitt(0xffff, buf, buflen - 2);
+        crc = ~crc;
+
+        if (buf[buflen - 2] != (crc & 0xff) || buf[buflen - 1] != (crc >> 8)) {
+                pr_err(ST21NFCA_HCI_DRIVER_NAME
+                       ": CRC error 0x%x != 0x%x 0x%x\n", crc, buf[buflen - 1],
+                       buf[buflen - 2]);
+
+                pr_info(DRIVER_DESC ": %s : BAD CRC\n", __func__);
+                print_hex_dump(KERN_DEBUG, "crc: ", DUMP_PREFIX_NONE,
+                               16, 2, buf, buflen, false);
+                return -EPERM;
+        }
+        return 0;
+}
+
+/*
+ * Prepare received data for upper layer.
+ * Received data include byte stuffing, crc and sof/eof
+ * which is not usable by hci part.
+ * returns:
+ * frame size without sof/eof, header and byte stuffing
+ * -EBADMSG : frame was incorrect and discarded
+ */
+static int st21nfca_hci_i2c_repack(struct sk_buff *skb)
+{
+        int i, j, r, size;
+        if (skb->len < 1 || (skb->len > 1 && skb->data[1] != 0))
+                return -EBADMSG;
+
+        size = get_frame_size(skb->data, skb->len);
+        if (size > 0) {
+                skb_trim(skb, size);
+                /* remove ST21NFCA byte stuffing for upper layer */
+                for (i = 1, j = 0; i < skb->len; i++) {
+                        if (skb->data[i + j] ==
+                                        (u8) ST21NFCA_ESCAPE_BYTE_STUFFING) {
+                                skb->data[i] = skb->data[i + j + 1]
+                                                | ST21NFCA_BYTE_STUFFING_MASK;
+                                i++;
+                                j++;
+                        }
+                        skb->data[i] = skb->data[i + j];
+                }
+                /* remove byte stuffing useless byte */
+                skb_trim(skb, i - j);
+                /* remove ST21NFCA_SOF_EOF from head */
+                skb_pull(skb, 1);
+
+                r = check_crc(skb->data, skb->len);
+                if (r != 0) {
+                        i = 0;
+                        return -EBADMSG;
+                }
+
+                /* remove headbyte */
+                skb_pull(skb, 1);
+                /* remove crc. Byte Stuffing is already removed here */
+                skb_trim(skb, skb->len - 2);
+                return skb->len;
+        }
+        return 0;
+}
+
+/*
+ * Reads an shdlc frame and returns it in a newly allocated sk_buff. Guarantees
+ * that i2c bus will be flushed and that next read will start on a new frame.
+ * returned skb contains only LLC header and payload.
+ * returns:
+ * frame size : if received frame is complete (find ST21NFCA_SOF_EOF at
+ * end of read)
+ * -EAGAIN : if received frame is incomplete (not find ST21NFCA_SOF_EOF
+ * at end of read)
+ * -EREMOTEIO : i2c read error (fatal)
+ * -EBADMSG : frame was incorrect and discarded
+ * (value returned from st21nfca_hci_i2c_repack)
+ * -EIO : if no ST21NFCA_SOF_EOF is found after reaching
+ * the read length end sequence
+ */
+static int st21nfca_hci_i2c_read(struct st21nfca_i2c_phy *phy,
+                                 struct sk_buff *skb)
+{
+        int r, i;
+        u8 len;
+        u8 buf[ST21NFCA_HCI_LLC_MAX_PAYLOAD];
+        struct i2c_client *client = phy->i2c_dev;
+
+        if (phy->current_read_len < ARRAY_SIZE(len_seq)) {
+                len = len_seq[phy->current_read_len];
+
+                /*
+                 * Add retry mecanism
+                 * Operation on I2C interface may fail in case of operation on
+                 * RF or SWP interface
+                 */
+                r = 0;
+                mutex_lock(&phy->phy_lock);
+                for (i = 0; i < ARRAY_SIZE(wait_tab) && r <= 0; i++) {
+                        r = i2c_master_recv(client, buf, len);
+                        if (r < 0)
+                                msleep(wait_tab[i]);
+                }
+                mutex_unlock(&phy->phy_lock);
+
+                if (r != len) {
+                        phy->current_read_len = 0;
+                        return -EREMOTEIO;
+                }
+
+                /*
+                 * The first read sequence does not start with SOF.
+                 * Data is corrupeted so we drop it.
+                 */
+                if (!phy->current_read_len && buf[0] != ST21NFCA_SOF_EOF) {
+                        skb_trim(skb, 0);
+                        phy->current_read_len = 0;
+                        return -EIO;
+                } else if (phy->current_read_len &&
+                        IS_START_OF_FRAME(buf)) {
+                        /*
+                         * Previous frame transmission was interrupted and
+                         * the frame got repeated.
+                         * Received frame start with ST21NFCA_SOF_EOF + 00.
+                         */
+                        skb_trim(skb, 0);
+                        phy->current_read_len = 0;
+                }
+
+                memcpy(skb_put(skb, len), buf, len);
+
+                if (skb->data[skb->len - 1] == ST21NFCA_SOF_EOF) {
+                        phy->current_read_len = 0;
+                        return st21nfca_hci_i2c_repack(skb);
+                }
+                phy->current_read_len++;
+                return -EAGAIN;
+        }
+        return -EIO;
+}
+
+/*
+ * Reads an shdlc frame from the chip. This is not as straightforward as it
+ * seems. The frame format is data-crc, and corruption can occur anywhere
+ * while transiting on i2c bus, such that we could read an invalid data.
+ * The tricky case is when we read a corrupted data or crc. We must detect
+ * this here in order to determine that data can be transmitted to the hci
+ * core. This is the reason why we check the crc here.
+ * The CLF will repeat a frame until we send a RR on that frame.
+ *
+ * On ST21NFCA, IRQ goes in idle when read starts. As no size information are
+ * available in the incoming data, other IRQ might come. Every IRQ will trigger
+ * a read sequence with different length and will fill the current frame.
+ * The reception is complete once we reach a ST21NFCA_SOF_EOF.
+ */
+static irqreturn_t st21nfca_hci_irq_thread_fn(int irq, void *phy_id)
+{
+        struct st21nfca_i2c_phy *phy = phy_id;
+        struct i2c_client *client;
+
+        int r;
+
+        if (!phy || irq != phy->i2c_dev->irq) {
+                WARN_ON_ONCE(1);
+                return IRQ_NONE;
+        }
+
+        client = phy->i2c_dev;
+        dev_dbg(&client->dev, "IRQ\n");
+
+        if (phy->hard_fault != 0)
+                return IRQ_HANDLED;
+
+        r = st21nfca_hci_i2c_read(phy, phy->pending_skb);
+        if (r == -EREMOTEIO) {
+                phy->hard_fault = r;
+
+                nfc_hci_recv_frame(phy->hdev, NULL);
+
+                return IRQ_HANDLED;
+        } else if (r == -EAGAIN || r == -EIO) {
+                return IRQ_HANDLED;
+        } else if (r == -EBADMSG && phy->crc_trials < ARRAY_SIZE(wait_tab)) {
+                /*
+                 * With ST21NFCA, only one interface (I2C, RF or SWP)
+                 * may be active at a time.
+                 * Having incorrect crc is usually due to i2c macrocell
+                 * deactivation in the middle of a transmission.
+                 * It may generate corrupted data on i2c.
+                 * We give sometime to get i2c back.
+                 * The complete frame will be repeated.
+                 */
+                msleep(wait_tab[phy->crc_trials]);
+                phy->crc_trials++;
+                phy->current_read_len = 0;
+                kfree_skb(phy->pending_skb);
+        } else if (r > 0) {
+                /*
+                 * We succeeded to read data from the CLF and
+                 * data is valid.
+                 * Reset counter.
+                 */
+                nfc_hci_recv_frame(phy->hdev, phy->pending_skb);
+                phy->crc_trials = 0;
+        }
+
+        phy->pending_skb = alloc_skb(ST21NFCA_HCI_LLC_MAX_SIZE * 2, GFP_KERNEL);
+        if (phy->pending_skb == NULL) {
+                phy->hard_fault = -ENOMEM;
+                nfc_hci_recv_frame(phy->hdev, NULL);
+        }
+
+        return IRQ_HANDLED;
+}
+
+static struct nfc_phy_ops i2c_phy_ops = {
+        .write = st21nfca_hci_i2c_write,
+        .enable = st21nfca_hci_i2c_enable,
+        .disable = st21nfca_hci_i2c_disable,
+};
+
+#ifdef CONFIG_OF
+static int st21nfca_hci_i2c_of_request_resources(struct i2c_client *client)
+{
+        struct st21nfca_i2c_phy *phy = i2c_get_clientdata(client);
+        struct device_node *pp;
+        int gpio;
+        int r;
+
+        pp = client->dev.of_node;
+        if (!pp)
+                return -ENODEV;
+
+        /* Get GPIO from device tree */
+        gpio = of_get_named_gpio(pp, "enable-gpios", 0);
+        if (gpio < 0) {
+                nfc_err(&client->dev, "Failed to retrieve enable-gpios from device tree\n");
+                return gpio;
+        }
+
+        /* GPIO request and configuration */
+        r = devm_gpio_request(&client->dev, gpio, "clf_enable");
+        if (r) {
+                nfc_err(&client->dev, "Failed to request enable pin\n");
+                return -ENODEV;
+        }
+
+        r = gpio_direction_output(gpio, 1);
+        if (r) {
+                nfc_err(&client->dev, "Failed to set enable pin direction as output\n");
+                return -ENODEV;
+        }
+        phy->gpio_ena = gpio;
+
+        /* IRQ */
+        r = irq_of_parse_and_map(pp, 0);
+        if (r < 0) {
+                nfc_err(&client->dev,
+                                "Unable to get irq, error: %d\n", r);
+                return r;
+        }
+
+        phy->irq_polarity = irq_get_trigger_type(r);
+        client->irq = r;
+
+        return 0;
+}
+#else
+static int st21nfca_hci_i2c_of_request_resources(struct i2c_client *client)
+{
+        return -ENODEV;
+}
+#endif
+
+static int st21nfca_hci_i2c_request_resources(struct i2c_client *client)
+{
+        struct st21nfca_nfc_platform_data *pdata;
+        struct st21nfca_i2c_phy *phy = i2c_get_clientdata(client);
+        int r;
+        int irq;
+
+        pdata = client->dev.platform_data;
+        if (pdata == NULL) {
+                nfc_err(&client->dev, "No platform data\n");
+                return -EINVAL;
+        }
+
+        /* store for later use */
+        phy->gpio_irq = pdata->gpio_irq;
+        phy->gpio_ena = pdata->gpio_ena;
+        phy->irq_polarity = pdata->irq_polarity;
+
+        r = devm_gpio_request(&client->dev, phy->gpio_irq, "wake_up");
+        if (r) {
+                pr_err("%s : gpio_request failed\n", __FILE__);
+                return -ENODEV;
+        }
+
+        r = gpio_direction_input(phy->gpio_irq);
+        if (r) {
+                pr_err("%s : gpio_direction_input failed\n", __FILE__);
+                return -ENODEV;
+        }
+
+        if (phy->gpio_ena > 0) {
+                r = devm_gpio_request(&client->dev,
+                                        phy->gpio_ena, "clf_enable");
+                if (r) {
+                        pr_err("%s : ena gpio_request failed\n", __FILE__);
+                        return -ENODEV;
+                }
+                r = gpio_direction_output(phy->gpio_ena, 1);
+
+                if (r) {
+                        pr_err("%s : ena gpio_direction_output failed\n",
+                               __FILE__);
+                        return -ENODEV;
+                }
+        }
+
+        /* IRQ */
+        irq = gpio_to_irq(phy->gpio_irq);
+        if (irq < 0) {
+                nfc_err(&client->dev,
+                                "Unable to get irq number for GPIO %d error %d\n",
+                                phy->gpio_irq, r);
+                return -ENODEV;
+        }
+        client->irq = irq;
+
+        return 0;
+}
+
+static int st21nfca_hci_i2c_probe(struct i2c_client *client,
+                                  const struct i2c_device_id *id)
+{
+        struct st21nfca_i2c_phy *phy;
+        struct st21nfca_nfc_platform_data *pdata;
+        int r;
+
+        dev_dbg(&client->dev, "%s\n", __func__);
+        dev_dbg(&client->dev, "IRQ: %d\n", client->irq);
+
+        if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
+                nfc_err(&client->dev, "Need I2C_FUNC_I2C\n");
+                return -ENODEV;
+        }
+
+        phy = devm_kzalloc(&client->dev, sizeof(struct st21nfca_i2c_phy),
+                           GFP_KERNEL);
+        if (!phy) {
+                nfc_err(&client->dev,
+                        "Cannot allocate memory for st21nfca i2c phy.\n");
+                return -ENOMEM;
+        }
+
+        phy->i2c_dev = client;
+        phy->pending_skb = alloc_skb(ST21NFCA_HCI_LLC_MAX_SIZE * 2, GFP_KERNEL);
+        if (phy->pending_skb == NULL)
+                return -ENOMEM;
+
+        phy->current_read_len = 0;
+        phy->crc_trials = 0;
+        mutex_init(&phy->phy_lock);
+        i2c_set_clientdata(client, phy);
+
+        pdata = client->dev.platform_data;
+        if (!pdata && client->dev.of_node) {
+                r = st21nfca_hci_i2c_of_request_resources(client);
+                if (r) {
+                        nfc_err(&client->dev, "No platform data\n");
+                        return r;
+                }
+        } else if (pdata) {
+                r = st21nfca_hci_i2c_request_resources(client);
+                if (r) {
+                        nfc_err(&client->dev, "Cannot get platform resources\n");
+                        return r;
+                }
+        } else {
+                nfc_err(&client->dev, "st21nfca platform resources not available\n");
+                return -ENODEV;
+        }
+
+        r = st21nfca_hci_platform_init(phy);
+        if (r < 0) {
+                nfc_err(&client->dev, "Unable to reboot st21nfca\n");
+                return -ENODEV;
+        }
+
+        r = devm_request_threaded_irq(&client->dev, client->irq, NULL,
+                                st21nfca_hci_irq_thread_fn,
+                                phy->irq_polarity | IRQF_ONESHOT,
+                                ST21NFCA_HCI_DRIVER_NAME, phy);
+        if (r < 0) {
+                nfc_err(&client->dev, "Unable to register IRQ handler\n");
+                return r;
+        }
+
+        return st21nfca_hci_probe(phy, &i2c_phy_ops, LLC_SHDLC_NAME,
+                               ST21NFCA_FRAME_HEADROOM, ST21NFCA_FRAME_TAILROOM,
+                               ST21NFCA_HCI_LLC_MAX_PAYLOAD, &phy->hdev);
+}
+
+static int st21nfca_hci_i2c_remove(struct i2c_client *client)
+{
+        struct st21nfca_i2c_phy *phy = i2c_get_clientdata(client);
+
+        dev_dbg(&client->dev, "%s\n", __func__);
+
+        st21nfca_hci_remove(phy->hdev);
+
+        if (phy->powered)
+                st21nfca_hci_i2c_disable(phy);
+
+        return 0;
+}
+
+static const struct of_device_id of_st21nfca_i2c_match[] = {
+        { .compatible = "st,st21nfca_i2c", },
+        {}
+};
+
+static struct i2c_driver st21nfca_hci_i2c_driver = {
+        .driver = {
+                .owner = THIS_MODULE,
+                .name = ST21NFCA_HCI_I2C_DRIVER_NAME,
+                .owner = THIS_MODULE,
+                .of_match_table = of_match_ptr(of_st21nfca_i2c_match),
+        },
+        .probe = st21nfca_hci_i2c_probe,
+        .id_table = st21nfca_hci_i2c_id_table,
+        .remove = st21nfca_hci_i2c_remove,
+};
+
+module_i2c_driver(st21nfca_hci_i2c_driver);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION(DRIVER_DESC);
diff --git a/drivers/nfc/st21nfca/st21nfca.c b/drivers/nfc/st21nfca/st21nfca.c
new file mode 100644
index 000000000000..51e0f00b3a4f
--- /dev/null
+++ b/drivers/nfc/st21nfca/st21nfca.c
@@ -0,0 +1,698 @@
+/*
+ * HCI based Driver for STMicroelectronics NFC Chip
+ *
+ * Copyright (C) 2014  STMicroelectronics SAS. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/module.h>
+#include <linux/nfc.h>
+#include <net/nfc/hci.h>
+#include <net/nfc/llc.h>
+
+#include "st21nfca.h"
+
+#define DRIVER_DESC "HCI NFC driver for ST21NFCA"
+
+#define FULL_VERSION_LEN 3
+
+/* Proprietary gates, events, commands and registers */
+
+/* Commands that apply to all RF readers */
+#define ST21NFCA_RF_READER_CMD_PRESENCE_CHECK   0x30
+
+#define ST21NFCA_RF_READER_ISO15693_GATE        0x12
+#define ST21NFCA_RF_READER_ISO15693_INVENTORY 0x01
+
+/*
+ * Reader gate for communication with contact-less cards using Type A
+ * protocol ISO14443-3 but not compliant with ISO14443-4
+ */
+#define ST21NFCA_RF_READER_14443_3_A_GATE       0x15
+#define ST21NFCA_RF_READER_14443_3_A_UID        0x02
+#define ST21NFCA_RF_READER_14443_3_A_ATQA       0x03
+#define ST21NFCA_RF_READER_14443_3_A_SAK        0x04
+
+#define ST21NFCA_DEVICE_MGNT_GATE               0x01
+#define ST21NFCA_DEVICE_MGNT_PIPE               0x02
+
+#define ST21NFCA_DM_GETINFO         0x13
+#define ST21NFCA_DM_GETINFO_PIPE_LIST       0x02
+#define ST21NFCA_DM_GETINFO_PIPE_INFO       0x01
+#define ST21NFCA_DM_PIPE_CREATED        0x02
+#define ST21NFCA_DM_PIPE_OPEN           0x04
+#define ST21NFCA_DM_RF_ACTIVE           0x80
+
+#define ST21NFCA_DM_IS_PIPE_OPEN(p) \
+        ((p & 0x0f) == (ST21NFCA_DM_PIPE_CREATED | ST21NFCA_DM_PIPE_OPEN))
+
+#define ST21NFCA_NFC_MODE       0x03    /* NFC_MODE parameter*/
+
+static DECLARE_BITMAP(dev_mask, ST21NFCA_NUM_DEVICES);
+
+static struct nfc_hci_gate st21nfca_gates[] = {
+        {NFC_HCI_ADMIN_GATE, NFC_HCI_ADMIN_PIPE},
+        {NFC_HCI_LOOPBACK_GATE, NFC_HCI_INVALID_PIPE},
+        {NFC_HCI_ID_MGMT_GATE, NFC_HCI_INVALID_PIPE},
+        {NFC_HCI_LINK_MGMT_GATE, NFC_HCI_LINK_MGMT_PIPE},
+        {NFC_HCI_RF_READER_B_GATE, NFC_HCI_INVALID_PIPE},
+        {NFC_HCI_RF_READER_A_GATE, NFC_HCI_INVALID_PIPE},
+        {ST21NFCA_DEVICE_MGNT_GATE, ST21NFCA_DEVICE_MGNT_PIPE},
+        {ST21NFCA_RF_READER_F_GATE, NFC_HCI_INVALID_PIPE},
+        {ST21NFCA_RF_READER_14443_3_A_GATE, NFC_HCI_INVALID_PIPE},
+        {ST21NFCA_RF_READER_ISO15693_GATE, NFC_HCI_INVALID_PIPE},
+};
+
+struct st21nfca_pipe_info {
+        u8 pipe_state;
+        u8 src_host_id;
+        u8 src_gate_id;
+        u8 dst_host_id;
+        u8 dst_gate_id;
+} __packed;
+
+/* Largest headroom needed for outgoing custom commands */
+#define ST21NFCA_CMDS_HEADROOM  7
+
+static int st21nfca_hci_load_session(struct nfc_hci_dev *hdev)
+{
+        int i, j, r;
+        struct sk_buff *skb_pipe_list, *skb_pipe_info;
+        struct st21nfca_pipe_info *info;
+
+        u8 pipe_list[] = { ST21NFCA_DM_GETINFO_PIPE_LIST,
+                NFC_HCI_TERMINAL_HOST_ID
+        };
+        u8 pipe_info[] = { ST21NFCA_DM_GETINFO_PIPE_INFO,
+                NFC_HCI_TERMINAL_HOST_ID, 0
+        };
+
+        skb_pipe_list = alloc_skb(ST21NFCA_HCI_LLC_MAX_SIZE, GFP_KERNEL);
+        if (!skb_pipe_list) {
+                r = -ENOMEM;
+                goto free_list;
+        }
+
+        skb_pipe_info = alloc_skb(ST21NFCA_HCI_LLC_MAX_SIZE, GFP_KERNEL);
+        if (!skb_pipe_info) {
+                r = -ENOMEM;
+                goto free_info;
+        }
+
+        /* On ST21NFCA device pipes number are dynamics
+         * A maximum of 16 pipes can be created at the same time
+         * If pipes are already created, hci_dev_up will fail.
+         * Doing a clear all pipe is a bad idea because:
+         * - It does useless EEPROM cycling
+         * - It might cause issue for secure elements support
+         * (such as removing connectivity or APDU reader pipe)
+         * A better approach on ST21NFCA is to:
+         * - get a pipe list for each host.
+         * (eg: NFC_HCI_HOST_CONTROLLER_ID for now).
+         * (TODO Later on UICC HOST and eSE HOST)
+         * - get pipe information
+         * - match retrieved pipe list in st21nfca_gates
+         * ST21NFCA_DEVICE_MGNT_GATE is a proprietary gate
+         * with ST21NFCA_DEVICE_MGNT_PIPE.
+         * Pipe can be closed and need to be open.
+         */
+        r = nfc_hci_connect_gate(hdev, NFC_HCI_HOST_CONTROLLER_ID,
+                ST21NFCA_DEVICE_MGNT_GATE, ST21NFCA_DEVICE_MGNT_PIPE);
+        if (r < 0)
+                goto free_info;
+
+        /* Get pipe list */
+        r = nfc_hci_send_cmd(hdev, ST21NFCA_DEVICE_MGNT_GATE,
+                        ST21NFCA_DM_GETINFO, pipe_list, sizeof(pipe_list),
+                        &skb_pipe_list);
+        if (r < 0)
+                goto free_info;
+
+        /* Complete the existing gate_pipe table */
+        for (i = 0; i < skb_pipe_list->len; i++) {
+                pipe_info[2] = skb_pipe_list->data[i];
+                r = nfc_hci_send_cmd(hdev, ST21NFCA_DEVICE_MGNT_GATE,
+                                        ST21NFCA_DM_GETINFO, pipe_info,
+                                        sizeof(pipe_info), &skb_pipe_info);
+
+                if (r)
+                        continue;
+
+                /*
+                 * Match pipe ID and gate ID
+                 * Output format from ST21NFC_DM_GETINFO is:
+                 * - pipe state (1byte)
+                 * - source hid (1byte)
+                 * - source gid (1byte)
+                 * - destination hid (1byte)
+                 * - destination gid (1byte)
+                 */
+                info = (struct st21nfca_pipe_info *) skb_pipe_info->data;
+                for (j = 0; (j < ARRAY_SIZE(st21nfca_gates)) &&
+                        (st21nfca_gates[j].gate != info->dst_gate_id);
+                        j++)
+                        ;
+
+                if (j < ARRAY_SIZE(st21nfca_gates) &&
+                        st21nfca_gates[j].gate == info->dst_gate_id &&
+                        ST21NFCA_DM_IS_PIPE_OPEN(info->pipe_state)) {
+                        st21nfca_gates[j].pipe = pipe_info[2];
+                        hdev->gate2pipe[st21nfca_gates[j].gate] =
+                                st21nfca_gates[j].pipe;
+                }
+        }
+
+        /*
+         * 3 gates have a well known pipe ID.
+         * They will never appear in the pipe list
+         */
+        if (skb_pipe_list->len + 3 < ARRAY_SIZE(st21nfca_gates)) {
+                for (i = skb_pipe_list->len + 3;
+                                i < ARRAY_SIZE(st21nfca_gates); i++) {
+                        r = nfc_hci_connect_gate(hdev,
+                                        NFC_HCI_HOST_CONTROLLER_ID,
+                                        st21nfca_gates[i].gate,
+                                        st21nfca_gates[i].pipe);
+                        if (r < 0)
+                                goto free_info;
+                }
+        }
+
+        memcpy(hdev->init_data.gates, st21nfca_gates, sizeof(st21nfca_gates));
+free_info:
+        kfree_skb(skb_pipe_info);
+free_list:
+        kfree_skb(skb_pipe_list);
+        return r;
+}
+
+static int st21nfca_hci_open(struct nfc_hci_dev *hdev)
+{
+        struct st21nfca_hci_info *info = nfc_hci_get_clientdata(hdev);
+        int r;
+
+        mutex_lock(&info->info_lock);
+
+        if (info->state != ST21NFCA_ST_COLD) {
+                r = -EBUSY;
+                goto out;
+        }
+
+        r = info->phy_ops->enable(info->phy_id);
+
+        if (r == 0)
+                info->state = ST21NFCA_ST_READY;
+
+out:
+        mutex_unlock(&info->info_lock);
+        return r;
+}
+
+static void st21nfca_hci_close(struct nfc_hci_dev *hdev)
+{
+        struct st21nfca_hci_info *info = nfc_hci_get_clientdata(hdev);
+
+        mutex_lock(&info->info_lock);
+
+        if (info->state == ST21NFCA_ST_COLD)
+                goto out;
+
+        info->phy_ops->disable(info->phy_id);
+        info->state = ST21NFCA_ST_COLD;
+
+out:
+        mutex_unlock(&info->info_lock);
+}
+
+static int st21nfca_hci_ready(struct nfc_hci_dev *hdev)
+{
+        struct sk_buff *skb;
+
+        u8 param;
+        int r;
+
+        param = NFC_HCI_UICC_HOST_ID;
+        r = nfc_hci_set_param(hdev, NFC_HCI_ADMIN_GATE,
+                              NFC_HCI_ADMIN_WHITELIST, &param, 1);
+        if (r < 0)
+                return r;
+
+        /* Set NFC_MODE in device management gate to enable */
+        r = nfc_hci_get_param(hdev, ST21NFCA_DEVICE_MGNT_GATE,
+                              ST21NFCA_NFC_MODE, &skb);
+        if (r < 0)
+                return r;
+
+        if (skb->data[0] == 0) {
+                kfree_skb(skb);
+                param = 1;
+
+                r = nfc_hci_set_param(hdev, ST21NFCA_DEVICE_MGNT_GATE,
+                                        ST21NFCA_NFC_MODE, &param, 1);
+                if (r < 0)
+                        return r;
+        }
+
+        r = nfc_hci_send_event(hdev, NFC_HCI_RF_READER_A_GATE,
+                               NFC_HCI_EVT_END_OPERATION, NULL, 0);
+        if (r < 0)
+                return r;
+
+        r = nfc_hci_get_param(hdev, NFC_HCI_ID_MGMT_GATE,
+                              NFC_HCI_ID_MGMT_VERSION_SW, &skb);
+        if (r < 0)
+                return r;
+
+        if (skb->len != FULL_VERSION_LEN) {
+                kfree_skb(skb);
+                return -EINVAL;
+        }
+
+        print_hex_dump(KERN_DEBUG, "FULL VERSION SOFTWARE INFO: ",
+                       DUMP_PREFIX_NONE, 16, 1,
+                       skb->data, FULL_VERSION_LEN, false);
+
+        kfree_skb(skb);
+
+        return 0;
+}
+
+static int st21nfca_hci_xmit(struct nfc_hci_dev *hdev, struct sk_buff *skb)
+{
+        struct st21nfca_hci_info *info = nfc_hci_get_clientdata(hdev);
+
+        return info->phy_ops->write(info->phy_id, skb);
+}
+
+static int st21nfca_hci_start_poll(struct nfc_hci_dev *hdev,
+                                   u32 im_protocols, u32 tm_protocols)
+{
+        int r;
+
+        pr_info(DRIVER_DESC ": %s protocols 0x%x 0x%x\n",
+                __func__, im_protocols, tm_protocols);
+
+        r = nfc_hci_send_event(hdev, NFC_HCI_RF_READER_A_GATE,
+                               NFC_HCI_EVT_END_OPERATION, NULL, 0);
+        if (r < 0)
+                return r;
+        if (im_protocols) {
+                /*
+                 * enable polling according to im_protocols & tm_protocols
+                 * - CLOSE pipe according to im_protocols & tm_protocols
+                 */
+                if ((NFC_HCI_RF_READER_B_GATE & im_protocols) == 0) {
+                        r = nfc_hci_disconnect_gate(hdev,
+                                        NFC_HCI_RF_READER_B_GATE);
+                        if (r < 0)
+                                return r;
+                }
+
+                if ((NFC_HCI_RF_READER_A_GATE & im_protocols) == 0) {
+                        r = nfc_hci_disconnect_gate(hdev,
+                                        NFC_HCI_RF_READER_A_GATE);
+                        if (r < 0)
+                                return r;
+                }
+
+                if ((ST21NFCA_RF_READER_F_GATE & im_protocols) == 0) {
+                        r = nfc_hci_disconnect_gate(hdev,
+                                        ST21NFCA_RF_READER_F_GATE);
+                        if (r < 0)
+                                return r;
+                }
+
+                if ((ST21NFCA_RF_READER_14443_3_A_GATE & im_protocols) == 0) {
+                        r = nfc_hci_disconnect_gate(hdev,
+                                        ST21NFCA_RF_READER_14443_3_A_GATE);
+                        if (r < 0)
+                                return r;
+                }
+
+                if ((ST21NFCA_RF_READER_ISO15693_GATE & im_protocols) == 0) {
+                        r = nfc_hci_disconnect_gate(hdev,
+                                        ST21NFCA_RF_READER_ISO15693_GATE);
+                        if (r < 0)
+                                return r;
+                }
+
+                r = nfc_hci_send_event(hdev, NFC_HCI_RF_READER_A_GATE,
+                                       NFC_HCI_EVT_READER_REQUESTED, NULL, 0);
+                if (r < 0)
+                        nfc_hci_send_event(hdev, NFC_HCI_RF_READER_A_GATE,
+                                           NFC_HCI_EVT_END_OPERATION, NULL, 0);
+        }
+        return r;
+}
+
+static int st21nfca_get_iso14443_3_atqa(struct nfc_hci_dev *hdev, u16 *atqa)
+{
+        int r;
+        struct sk_buff *atqa_skb = NULL;
+
+        r = nfc_hci_get_param(hdev, ST21NFCA_RF_READER_14443_3_A_GATE,
+                              ST21NFCA_RF_READER_14443_3_A_ATQA, &atqa_skb);
+        if (r < 0)
+                goto exit;
+
+        if (atqa_skb->len != 2) {
+                r = -EPROTO;
+                goto exit;
+        }
+
+        *atqa = be16_to_cpu(*(__be16 *) atqa_skb->data);
+
+exit:
+        kfree_skb(atqa_skb);
+        return r;
+}
+
+static int st21nfca_get_iso14443_3_sak(struct nfc_hci_dev *hdev, u8 *sak)
+{
+        int r;
+        struct sk_buff *sak_skb = NULL;
+
+        r = nfc_hci_get_param(hdev, ST21NFCA_RF_READER_14443_3_A_GATE,
+                              ST21NFCA_RF_READER_14443_3_A_SAK, &sak_skb);
+        if (r < 0)
+                goto exit;
+
+        if (sak_skb->len != 1) {
+                r = -EPROTO;
+                goto exit;
+        }
+
+        *sak = sak_skb->data[0];
+
+exit:
+        kfree_skb(sak_skb);
+        return r;
+}
+
+static int st21nfca_get_iso14443_3_uid(struct nfc_hci_dev *hdev, u8 *gate,
+                                       int *len)
+{
+        int r;
+        struct sk_buff *uid_skb = NULL;
+
+        r = nfc_hci_get_param(hdev, ST21NFCA_RF_READER_14443_3_A_GATE,
+                              ST21NFCA_RF_READER_14443_3_A_UID, &uid_skb);
+        if (r < 0)
+                goto exit;
+
+        if (uid_skb->len == 0 || uid_skb->len > NFC_NFCID1_MAXSIZE) {
+                r = -EPROTO;
+                goto exit;
+        }
+
+        gate = uid_skb->data;
+        *len = uid_skb->len;
+exit:
+        kfree_skb(uid_skb);
+        return r;
+}
+
+static int st21nfca_get_iso15693_inventory(struct nfc_hci_dev *hdev,
+                                           struct nfc_target *target)
+{
+        int r;
+        struct sk_buff *inventory_skb = NULL;
+
+        r = nfc_hci_get_param(hdev, ST21NFCA_RF_READER_ISO15693_GATE,
+                              ST21NFCA_RF_READER_ISO15693_INVENTORY,
+                              &inventory_skb);
+        if (r < 0)
+                goto exit;
+
+        skb_pull(inventory_skb, 2);
+
+        if (inventory_skb->len == 0 ||
+            inventory_skb->len > NFC_ISO15693_UID_MAXSIZE) {
+                r = -EPROTO;
+                goto exit;
+        }
+
+        memcpy(target->iso15693_uid, inventory_skb->data, inventory_skb->len);
+        target->iso15693_dsfid  = inventory_skb->data[1];
+        target->is_iso15693 = 1;
+exit:
+        kfree_skb(inventory_skb);
+        return r;
+}
+
+static int st21nfca_hci_target_from_gate(struct nfc_hci_dev *hdev, u8 gate,
+                                         struct nfc_target *target)
+{
+        int r, len;
+        u16 atqa;
+        u8 sak;
+        u8 uid[NFC_NFCID1_MAXSIZE];
+
+        switch (gate) {
+        case ST21NFCA_RF_READER_F_GATE:
+                target->supported_protocols = NFC_PROTO_FELICA_MASK;
+                break;
+        case ST21NFCA_RF_READER_14443_3_A_GATE:
+                /* ISO14443-3 type 1 or 2 tags */
+                r = st21nfca_get_iso14443_3_atqa(hdev, &atqa);
+                if (r < 0)
+                        return r;
+                if (atqa == 0x000c) {
+                        target->supported_protocols = NFC_PROTO_JEWEL_MASK;
+                        target->sens_res = 0x0c00;
+                } else {
+                        r = st21nfca_get_iso14443_3_sak(hdev, &sak);
+                        if (r < 0)
+                                return r;
+
+                        r = st21nfca_get_iso14443_3_uid(hdev, uid, &len);
+                        if (r < 0)
+                                return r;
+
+                        target->supported_protocols =
+                            nfc_hci_sak_to_protocol(sak);
+                        if (target->supported_protocols == 0xffffffff)
+                                return -EPROTO;
+
+                        target->sens_res = atqa;
+                        target->sel_res = sak;
+                        memcpy(target->nfcid1, uid, len);
+                        target->nfcid1_len = len;
+                }
+
+                break;
+        case ST21NFCA_RF_READER_ISO15693_GATE:
+                target->supported_protocols = NFC_PROTO_ISO15693_MASK;
+                r = st21nfca_get_iso15693_inventory(hdev, target);
+                if (r < 0)
+                        return r;
+                break;
+        default:
+                return -EPROTO;
+        }
+
+        return 0;
+}
+
+#define ST21NFCA_CB_TYPE_READER_ISO15693 1
+static void st21nfca_hci_data_exchange_cb(void *context, struct sk_buff *skb,
+                                          int err)
+{
+        struct st21nfca_hci_info *info = context;
+
+        switch (info->async_cb_type) {
+        case ST21NFCA_CB_TYPE_READER_ISO15693:
+                if (err == 0)
+                        skb_trim(skb, skb->len - 1);
+                info->async_cb(info->async_cb_context, skb, err);
+                break;
+        default:
+                if (err == 0)
+                        kfree_skb(skb);
+                break;
+        }
+}
+
+/*
+ * Returns:
+ * <= 0: driver handled the data exchange
+ *    1: driver doesn't especially handle, please do standard processing
+ */
+static int st21nfca_hci_im_transceive(struct nfc_hci_dev *hdev,
+                                      struct nfc_target *target,
+                                      struct sk_buff *skb,
+                                      data_exchange_cb_t cb, void *cb_context)
+{
+        struct st21nfca_hci_info *info = nfc_hci_get_clientdata(hdev);
+
+        pr_info(DRIVER_DESC ": %s for gate=%d len=%d\n", __func__,
+                target->hci_reader_gate, skb->len);
+
+        switch (target->hci_reader_gate) {
+        case ST21NFCA_RF_READER_F_GATE:
+                *skb_push(skb, 1) = 0x1a;
+                return nfc_hci_send_cmd_async(hdev, target->hci_reader_gate,
+                                              ST21NFCA_WR_XCHG_DATA, skb->data,
+                                              skb->len, cb, cb_context);
+        case ST21NFCA_RF_READER_14443_3_A_GATE:
+                *skb_push(skb, 1) = 0x1a;       /* CTR, see spec:10.2.2.1 */
+
+                return nfc_hci_send_cmd_async(hdev, target->hci_reader_gate,
+                                              ST21NFCA_WR_XCHG_DATA, skb->data,
+                                              skb->len, cb, cb_context);
+        case ST21NFCA_RF_READER_ISO15693_GATE:
+                info->async_cb_type = ST21NFCA_CB_TYPE_READER_ISO15693;
+                info->async_cb = cb;
+                info->async_cb_context = cb_context;
+
+                *skb_push(skb, 1) = 0x17;
+
+                return nfc_hci_send_cmd_async(hdev, target->hci_reader_gate,
+                                              ST21NFCA_WR_XCHG_DATA, skb->data,
+                                              skb->len,
+                                              st21nfca_hci_data_exchange_cb,
+                                              info);
+                break;
+        default:
+                return 1;
+        }
+}
+
+static int st21nfca_hci_check_presence(struct nfc_hci_dev *hdev,
+                                       struct nfc_target *target)
+{
+        u8 fwi = 0x11;
+        switch (target->hci_reader_gate) {
+        case NFC_HCI_RF_READER_A_GATE:
+        case NFC_HCI_RF_READER_B_GATE:
+                /*
+                 * PRESENCE_CHECK on those gates is available
+                 * However, the answer to this command is taking 3 * fwi
+                 * if the card is no present.
+                 * Instead, we send an empty I-Frame with a very short
+                 * configurable fwi ~604µs.
+                 */
+                return nfc_hci_send_cmd(hdev, target->hci_reader_gate,
+                                        ST21NFCA_WR_XCHG_DATA, &fwi, 1, NULL);
+        case ST21NFCA_RF_READER_14443_3_A_GATE:
+                return nfc_hci_send_cmd(hdev, target->hci_reader_gate,
+                                        ST21NFCA_RF_READER_CMD_PRESENCE_CHECK,
+                                        NULL, 0, NULL);
+        default:
+                return -EOPNOTSUPP;
+        }
+}
+
+static struct nfc_hci_ops st21nfca_hci_ops = {
+        .open = st21nfca_hci_open,
+        .close = st21nfca_hci_close,
+        .load_session = st21nfca_hci_load_session,
+        .hci_ready = st21nfca_hci_ready,
+        .xmit = st21nfca_hci_xmit,
+        .start_poll = st21nfca_hci_start_poll,
+        .target_from_gate = st21nfca_hci_target_from_gate,
+        .im_transceive = st21nfca_hci_im_transceive,
+        .check_presence = st21nfca_hci_check_presence,
+};
+
+int st21nfca_hci_probe(void *phy_id, struct nfc_phy_ops *phy_ops,
+                       char *llc_name, int phy_headroom, int phy_tailroom,
+                       int phy_payload, struct nfc_hci_dev **hdev)
+{
+        struct st21nfca_hci_info *info;
+        int r = 0;
+        int dev_num;
+        u32 protocols;
+        struct nfc_hci_init_data init_data;
+        unsigned long quirks = 0;
+
+        info = kzalloc(sizeof(struct st21nfca_hci_info), GFP_KERNEL);
+        if (!info) {
+                r = -ENOMEM;
+                goto err_alloc_hdev;
+        }
+
+        info->phy_ops = phy_ops;
+        info->phy_id = phy_id;
+        info->state = ST21NFCA_ST_COLD;
+        mutex_init(&info->info_lock);
+
+        init_data.gate_count = ARRAY_SIZE(st21nfca_gates);
+
+        memcpy(init_data.gates, st21nfca_gates, sizeof(st21nfca_gates));
+
+        /*
+         * Session id must include the driver name + i2c bus addr
+         * persistent info to discriminate 2 identical chips
+         */
+        dev_num = find_first_zero_bit(dev_mask, ST21NFCA_NUM_DEVICES);
+        if (dev_num >= ST21NFCA_NUM_DEVICES)
+                goto err_alloc_hdev;
+
+        scnprintf(init_data.session_id, sizeof(init_data.session_id), "%s%2x",
+                  "ST21AH", dev_num);
+
+        protocols = NFC_PROTO_JEWEL_MASK |
+            NFC_PROTO_MIFARE_MASK |
+            NFC_PROTO_FELICA_MASK |
+            NFC_PROTO_ISO14443_MASK |
+            NFC_PROTO_ISO14443_B_MASK |
+            NFC_PROTO_ISO15693_MASK;
+
+        set_bit(NFC_HCI_QUIRK_SHORT_CLEAR, &quirks);
+
+        info->hdev =
+            nfc_hci_allocate_device(&st21nfca_hci_ops, &init_data, quirks,
+                                    protocols, llc_name,
+                                    phy_headroom + ST21NFCA_CMDS_HEADROOM,
+                                    phy_tailroom, phy_payload);
+
+        if (!info->hdev) {
+                pr_err("Cannot allocate nfc hdev.\n");
+                r = -ENOMEM;
+                goto err_alloc_hdev;
+        }
+
+        nfc_hci_set_clientdata(info->hdev, info);
+
+        r = nfc_hci_register_device(info->hdev);
+        if (r)
+                goto err_regdev;
+
+        *hdev = info->hdev;
+
+        return 0;
+
+err_regdev:
+        nfc_hci_free_device(info->hdev);
+
+err_alloc_hdev:
+        kfree(info);
+
+        return r;
+}
+EXPORT_SYMBOL(st21nfca_hci_probe);
+
+void st21nfca_hci_remove(struct nfc_hci_dev *hdev)
+{
+        struct st21nfca_hci_info *info = nfc_hci_get_clientdata(hdev);
+
+        nfc_hci_unregister_device(hdev);
+        nfc_hci_free_device(hdev);
+        kfree(info);
+}
+EXPORT_SYMBOL(st21nfca_hci_remove);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION(DRIVER_DESC);
diff --git a/drivers/nfc/st21nfca/st21nfca.h b/drivers/nfc/st21nfca/st21nfca.h
new file mode 100644
index 000000000000..334cd90bcc8c
--- /dev/null
+++ b/drivers/nfc/st21nfca/st21nfca.h
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2014  STMicroelectronics SAS. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef __LOCAL_ST21NFCA_H_
+#define __LOCAL_ST21NFCA_H_
+
+#include <net/nfc/hci.h>
+
+#define HCI_MODE 0
+
+/* framing in HCI mode */
+#define ST21NFCA_SOF_EOF_LEN    2
+
+/* Almost every time value is 0 */
+#define ST21NFCA_HCI_LLC_LEN    1
+
+/* Size in worst case :
+ * In normal case CRC len = 2 but byte stuffing
+ * may appear in case one CRC byte = ST21NFCA_SOF_EOF
+ */
+#define ST21NFCA_HCI_LLC_CRC    4
+
+#define ST21NFCA_HCI_LLC_LEN_CRC        (ST21NFCA_SOF_EOF_LEN + \
+                                                ST21NFCA_HCI_LLC_LEN + \
+                                                ST21NFCA_HCI_LLC_CRC)
+#define ST21NFCA_HCI_LLC_MIN_SIZE       (1 + ST21NFCA_HCI_LLC_LEN_CRC)
+
+/* Worst case when adding byte stuffing between each byte */
+#define ST21NFCA_HCI_LLC_MAX_PAYLOAD    29
+#define ST21NFCA_HCI_LLC_MAX_SIZE       (ST21NFCA_HCI_LLC_LEN_CRC + 1 + \
+                                        ST21NFCA_HCI_LLC_MAX_PAYLOAD)
+
+#define DRIVER_DESC "HCI NFC driver for ST21NFCA"
+
+#define ST21NFCA_HCI_MODE 0
+
+#define ST21NFCA_NUM_DEVICES 256
+
+int st21nfca_hci_probe(void *phy_id, struct nfc_phy_ops *phy_ops,
+                       char *llc_name, int phy_headroom, int phy_tailroom,
+                       int phy_payload, struct nfc_hci_dev **hdev);
+void st21nfca_hci_remove(struct nfc_hci_dev *hdev);
+
+enum st21nfca_state {
+        ST21NFCA_ST_COLD,
+        ST21NFCA_ST_READY,
+};
+
+struct st21nfca_hci_info {
+        struct nfc_phy_ops *phy_ops;
+        void *phy_id;
+
+        struct nfc_hci_dev *hdev;
+
+        enum st21nfca_state state;
+
+        struct mutex info_lock;
+
+        int async_cb_type;
+        data_exchange_cb_t async_cb;
+        void *async_cb_context;
+
+} __packed;
+
+/* Reader RF commands */
+#define ST21NFCA_WR_XCHG_DATA            0x10
+
+#define ST21NFCA_RF_READER_F_GATE               0x14
+#define ST21NFCA_RF_READER_F_DATARATE 0x01
+#define ST21NFCA_RF_READER_F_DATARATE_106 0x01
+#define ST21NFCA_RF_READER_F_DATARATE_212 0x02
+#define ST21NFCA_RF_READER_F_DATARATE_424 0x04
+
+#endif /* __LOCAL_ST21NFCA_H_ */
diff --git a/drivers/nfc/trf7970a.c b/drivers/nfc/trf7970a.c
index d9babe986473..efb36593ecb4 100644
--- a/drivers/nfc/trf7970a.c
+++ b/drivers/nfc/trf7970a.c
@@ -16,6 +16,7 @@
 #include <linux/device.h>
 #include <linux/netdevice.h>
 #include <linux/interrupt.h>
+#include <linux/pm_runtime.h>
 #include <linux/nfc.h>
 #include <linux/skbuff.h>
 #include <linux/delay.h>
@@ -67,14 +68,14 @@
  * only the SRX bit set, it means that all of the data has been received
  * (once what's in the fifo has been read).  However, depending on timing
  * an interrupt status with only the SRX bit set may not be recived.  In
- * those cases, the timeout mechanism is used to wait 5 ms in case more
- * data arrives.  After 5 ms, it is assumed that all of the data has been
+ * those cases, the timeout mechanism is used to wait 20 ms in case more
+ * data arrives.  After 20 ms, it is assumed that all of the data has been
  * received and the accumulated rx data is sent upstream.  The
  * 'TRF7970A_ST_WAIT_FOR_RX_DATA_CONT' state is used for this purpose
  * (i.e., it indicates that some data has been received but we're not sure
  * if there is more coming so a timeout in this state means all data has
- * been received and there isn't an error).  The delay is 5 ms since delays
- * over 2 ms have been observed during testing (a little extra just in case).
+ * been received and there isn't an error).  The delay is 20 ms since delays
+ * of ~16 ms have been observed during testing.
  *
  * Type 2 write and sector select commands respond with a 4-bit ACK or NACK.
  * Having only 4 bits in the FIFO won't normally generate an interrupt so
@@ -104,7 +105,9 @@
 
 #define TRF7970A_SUPPORTED_PROTOCOLS \
                 (NFC_PROTO_MIFARE_MASK | NFC_PROTO_ISO14443_MASK |      \
-                 NFC_PROTO_ISO15693_MASK)
+                 NFC_PROTO_ISO14443_B_MASK | NFC_PROTO_ISO15693_MASK)
+
+#define TRF7970A_AUTOSUSPEND_DELAY              30000 /* 30 seconds */
 
 /* TX data must be prefixed with a FIFO reset cmd, a cmd that depends
  * on what the current framing is, the address of the TX length byte 1
@@ -120,7 +123,7 @@
 /* TX length is 3 nibbles long ==> 4KB - 1 bytes max */
 #define TRF7970A_TX_MAX                         (4096 - 1)
 
-#define TRF7970A_WAIT_FOR_RX_DATA_TIMEOUT       5
+#define TRF7970A_WAIT_FOR_RX_DATA_TIMEOUT       20
 #define TRF7970A_WAIT_FOR_FIFO_DRAIN_TIMEOUT    3
 #define TRF7970A_WAIT_TO_ISSUE_ISO15693_EOF     20
 
@@ -330,13 +333,15 @@ struct trf7970a {
         struct regulator                *regulator;
         struct nfc_digital_dev          *ddev;
         u32                             quirks;
-        bool                            powering_up;
         bool                            aborting;
         struct sk_buff                  *tx_skb;
         struct sk_buff                  *rx_skb;
         nfc_digital_cmd_complete_t      cb;
         void                            *cb_arg;
+        u8                              chip_status_ctrl;
         u8                              iso_ctrl;
+        u8                              iso_ctrl_tech;
+        u8                              modulator_sys_clk_ctrl;
         u8                              special_fcn_reg1;
         int                             technology;
         int                             framing;
@@ -681,7 +686,9 @@ static irqreturn_t trf7970a_irq(int irq, void *dev_id)
                         trf->ignore_timeout =
                                 !cancel_delayed_work(&trf->timeout_work);
                         trf7970a_drain_fifo(trf, status);
-                } else if (!(status & TRF7970A_IRQ_STATUS_TX)) {
+                } else if (status == TRF7970A_IRQ_STATUS_TX) {
+                        trf7970a_cmd(trf, TRF7970A_CMD_FIFO_RESET);
+                } else {
                         trf7970a_send_err_upstream(trf, -EIO);
                 }
                 break;
@@ -757,8 +764,8 @@ static int trf7970a_init(struct trf7970a *trf)
         if (ret)
                 goto err_out;
 
-        ret = trf7970a_write(trf, TRF7970A_MODULATOR_SYS_CLK_CTRL,
-                        TRF7970A_MODULATOR_DEPTH_OOK);
+        /* Must clear NFC Target Detection Level reg due to erratum */
+        ret = trf7970a_write(trf, TRF7970A_NFC_TARGET_LEVEL, 0);
         if (ret)
                 goto err_out;
 
@@ -774,12 +781,7 @@ static int trf7970a_init(struct trf7970a *trf)
 
         trf->special_fcn_reg1 = 0;
 
-        ret = trf7970a_write(trf, TRF7970A_CHIP_STATUS_CTRL,
-                        TRF7970A_CHIP_STATUS_RF_ON |
-                                TRF7970A_CHIP_STATUS_VRS5_3);
-        if (ret)
-                goto err_out;
-
+        trf->iso_ctrl = 0xff;
         return 0;
 
 err_out:
@@ -791,53 +793,29 @@ static void trf7970a_switch_rf_off(struct trf7970a *trf)
 {
         dev_dbg(trf->dev, "Switching rf off\n");
 
-        gpio_set_value(trf->en_gpio, 0);
-        gpio_set_value(trf->en2_gpio, 0);
+        trf->chip_status_ctrl &= ~TRF7970A_CHIP_STATUS_RF_ON;
+
+        trf7970a_write(trf, TRF7970A_CHIP_STATUS_CTRL, trf->chip_status_ctrl);
 
         trf->aborting = false;
         trf->state = TRF7970A_ST_OFF;
+
+        pm_runtime_mark_last_busy(trf->dev);
+        pm_runtime_put_autosuspend(trf->dev);
 }
 
-static int trf7970a_switch_rf_on(struct trf7970a *trf)
+static void trf7970a_switch_rf_on(struct trf7970a *trf)
 {
-        unsigned long delay;
-        int ret;
-
         dev_dbg(trf->dev, "Switching rf on\n");
 
-        if (trf->powering_up)
-                usleep_range(5000, 6000);
-
-        gpio_set_value(trf->en2_gpio, 1);
-        usleep_range(1000, 2000);
-        gpio_set_value(trf->en_gpio, 1);
+        pm_runtime_get_sync(trf->dev);
 
-        /* The delay between enabling the trf7970a and issuing the first
-         * command is significantly longer the very first time after powering
-         * up.  Make sure the longer delay is only done the first time.
-         */
-        if (trf->powering_up) {
-                delay = 20000;
-                trf->powering_up = false;
-        } else {
-                delay = 5000;
-        }
-
-        usleep_range(delay, delay + 1000);
-
-        ret = trf7970a_init(trf);
-        if (ret)
-                trf7970a_switch_rf_off(trf);
-        else
-                trf->state = TRF7970A_ST_IDLE;
-
-        return ret;
+        trf->state = TRF7970A_ST_IDLE;
 }
 
 static int trf7970a_switch_rf(struct nfc_digital_dev *ddev, bool on)
 {
         struct trf7970a *trf = nfc_digital_get_drvdata(ddev);
-        int ret = 0;
 
         dev_dbg(trf->dev, "Switching RF - state: %d, on: %d\n", trf->state, on);
 
@@ -846,7 +824,7 @@ static int trf7970a_switch_rf(struct nfc_digital_dev *ddev, bool on)
         if (on) {
                 switch (trf->state) {
                 case TRF7970A_ST_OFF:
-                        ret = trf7970a_switch_rf_on(trf);
+                        trf7970a_switch_rf_on(trf);
                         break;
                 case TRF7970A_ST_IDLE:
                 case TRF7970A_ST_IDLE_RX_BLOCKED:
@@ -871,7 +849,7 @@ static int trf7970a_switch_rf(struct nfc_digital_dev *ddev, bool on)
         }
 
         mutex_unlock(&trf->lock);
-        return ret;
+        return 0;
 }
 
 static int trf7970a_config_rf_tech(struct trf7970a *trf, int tech)
@@ -882,10 +860,16 @@ static int trf7970a_config_rf_tech(struct trf7970a *trf, int tech)
 
         switch (tech) {
         case NFC_DIGITAL_RF_TECH_106A:
-                trf->iso_ctrl = TRF7970A_ISO_CTRL_14443A_106;
+                trf->iso_ctrl_tech = TRF7970A_ISO_CTRL_14443A_106;
+                trf->modulator_sys_clk_ctrl = TRF7970A_MODULATOR_DEPTH_OOK;
+                break;
+        case NFC_DIGITAL_RF_TECH_106B:
+                trf->iso_ctrl_tech = TRF7970A_ISO_CTRL_14443B_106;
+                trf->modulator_sys_clk_ctrl = TRF7970A_MODULATOR_DEPTH_ASK10;
                 break;
         case NFC_DIGITAL_RF_TECH_ISO15693:
-                trf->iso_ctrl = TRF7970A_ISO_CTRL_15693_SGL_1OF4_2648;
+                trf->iso_ctrl_tech = TRF7970A_ISO_CTRL_15693_SGL_1OF4_2648;
+                trf->modulator_sys_clk_ctrl = TRF7970A_MODULATOR_DEPTH_OOK;
                 break;
         default:
                 dev_dbg(trf->dev, "Unsupported rf technology: %d\n", tech);
@@ -899,24 +883,29 @@ static int trf7970a_config_rf_tech(struct trf7970a *trf, int tech)
 
 static int trf7970a_config_framing(struct trf7970a *trf, int framing)
 {
+        u8 iso_ctrl = trf->iso_ctrl_tech;
+        int ret;
+
         dev_dbg(trf->dev, "framing: %d\n", framing);
 
         switch (framing) {
         case NFC_DIGITAL_FRAMING_NFCA_SHORT:
         case NFC_DIGITAL_FRAMING_NFCA_STANDARD:
                 trf->tx_cmd = TRF7970A_CMD_TRANSMIT_NO_CRC;
-                trf->iso_ctrl |= TRF7970A_ISO_CTRL_RX_CRC_N;
+                iso_ctrl |= TRF7970A_ISO_CTRL_RX_CRC_N;
                 break;
         case NFC_DIGITAL_FRAMING_NFCA_STANDARD_WITH_CRC_A:
         case NFC_DIGITAL_FRAMING_NFCA_T4T:
+        case NFC_DIGITAL_FRAMING_NFCB:
+        case NFC_DIGITAL_FRAMING_NFCB_T4T:
         case NFC_DIGITAL_FRAMING_ISO15693_INVENTORY:
         case NFC_DIGITAL_FRAMING_ISO15693_T5T:
                 trf->tx_cmd = TRF7970A_CMD_TRANSMIT;
-                trf->iso_ctrl &= ~TRF7970A_ISO_CTRL_RX_CRC_N;
+                iso_ctrl &= ~TRF7970A_ISO_CTRL_RX_CRC_N;
                 break;
         case NFC_DIGITAL_FRAMING_NFCA_T2T:
                 trf->tx_cmd = TRF7970A_CMD_TRANSMIT;
-                trf->iso_ctrl |= TRF7970A_ISO_CTRL_RX_CRC_N;
+                iso_ctrl |= TRF7970A_ISO_CTRL_RX_CRC_N;
                 break;
         default:
                 dev_dbg(trf->dev, "Unsupported Framing: %d\n", framing);
@@ -925,24 +914,46 @@ static int trf7970a_config_framing(struct trf7970a *trf, int framing)
 
         trf->framing = framing;
 
-        return trf7970a_write(trf, TRF7970A_ISO_CTRL, trf->iso_ctrl);
+        if (iso_ctrl != trf->iso_ctrl) {
+                ret = trf7970a_write(trf, TRF7970A_ISO_CTRL, iso_ctrl);
+                if (ret)
+                        return ret;
+
+                trf->iso_ctrl = iso_ctrl;
+
+                ret = trf7970a_write(trf, TRF7970A_MODULATOR_SYS_CLK_CTRL,
+                                trf->modulator_sys_clk_ctrl);
+                if (ret)
+                        return ret;
+        }
+
+        if (!(trf->chip_status_ctrl & TRF7970A_CHIP_STATUS_RF_ON)) {
+                ret = trf7970a_write(trf, TRF7970A_CHIP_STATUS_CTRL,
+                                trf->chip_status_ctrl |
+                                        TRF7970A_CHIP_STATUS_RF_ON);
+                if (ret)
+                        return ret;
+
+                trf->chip_status_ctrl |= TRF7970A_CHIP_STATUS_RF_ON;
+
+                usleep_range(5000, 6000);
+        }
+
+        return 0;
 }
 
 static int trf7970a_in_configure_hw(struct nfc_digital_dev *ddev, int type,
                 int param)
 {
         struct trf7970a *trf = nfc_digital_get_drvdata(ddev);
-        int ret = 0;
+        int ret;
 
         dev_dbg(trf->dev, "Configure hw - type: %d, param: %d\n", type, param);
 
         mutex_lock(&trf->lock);
 
-        if (trf->state == TRF7970A_ST_OFF) {
-                ret = trf7970a_switch_rf_on(trf);
-                if (ret)
-                        goto err_out;
-        }
+        if (trf->state == TRF7970A_ST_OFF)
+                trf7970a_switch_rf_on(trf);
 
         switch (type) {
         case NFC_DIGITAL_CONFIG_RF_TECH:
@@ -956,7 +967,6 @@ static int trf7970a_in_configure_hw(struct nfc_digital_dev *ddev, int type,
                 ret = -EINVAL;
         }
 
-err_out:
         mutex_unlock(&trf->lock);
         return ret;
 }
@@ -1191,7 +1201,18 @@ static void trf7970a_abort_cmd(struct nfc_digital_dev *ddev)
         dev_dbg(trf->dev, "Abort process initiated\n");
 
         mutex_lock(&trf->lock);
-        trf->aborting = true;
+
+        switch (trf->state) {
+        case TRF7970A_ST_WAIT_FOR_TX_FIFO:
+        case TRF7970A_ST_WAIT_FOR_RX_DATA:
+        case TRF7970A_ST_WAIT_FOR_RX_DATA_CONT:
+        case TRF7970A_ST_WAIT_TO_ISSUE_EOF:
+                trf->aborting = true;
+                break;
+        default:
+                break;
+        }
+
         mutex_unlock(&trf->lock);
 }
 
@@ -1206,12 +1227,25 @@ static struct nfc_digital_ops trf7970a_nfc_ops = {
         .abort_cmd              = trf7970a_abort_cmd,
 };
 
+static int trf7970a_get_autosuspend_delay(struct device_node *np)
+{
+        int autosuspend_delay, ret;
+
+        ret = of_property_read_u32(np, "autosuspend-delay", &autosuspend_delay);
+        if (ret)
+                autosuspend_delay = TRF7970A_AUTOSUSPEND_DELAY;
+
+        of_node_put(np);
+
+        return autosuspend_delay;
+}
+
 static int trf7970a_probe(struct spi_device *spi)
 {
         struct device_node *np = spi->dev.of_node;
         const struct spi_device_id *id = spi_get_device_id(spi);
         struct trf7970a *trf;
-        int ret;
+        int uvolts, autosuspend_delay, ret;
 
         if (!np) {
                 dev_err(&spi->dev, "No Device Tree entry\n");
@@ -1281,7 +1315,10 @@ static int trf7970a_probe(struct spi_device *spi)
                 goto err_destroy_lock;
         }
 
-        trf->powering_up = true;
+        uvolts = regulator_get_voltage(trf->regulator);
+
+        if (uvolts > 4000000)
+                trf->chip_status_ctrl = TRF7970A_CHIP_STATUS_VRS5_3;
 
         trf->ddev = nfc_digital_allocate_device(&trf7970a_nfc_ops,
                         TRF7970A_SUPPORTED_PROTOCOLS,
@@ -1297,6 +1334,12 @@ static int trf7970a_probe(struct spi_device *spi)
         nfc_digital_set_drvdata(trf->ddev, trf);
         spi_set_drvdata(spi, trf);
 
+        autosuspend_delay = trf7970a_get_autosuspend_delay(np);
+
+        pm_runtime_set_autosuspend_delay(trf->dev, autosuspend_delay);
+        pm_runtime_use_autosuspend(trf->dev);
+        pm_runtime_enable(trf->dev);
+
         ret = nfc_digital_register_device(trf->ddev);
         if (ret) {
                 dev_err(trf->dev, "Can't register NFC digital device: %d\n",
@@ -1307,6 +1350,7 @@ static int trf7970a_probe(struct spi_device *spi)
         return 0;
 
 err_free_ddev:
+        pm_runtime_disable(trf->dev);
         nfc_digital_free_device(trf->ddev);
 err_disable_regulator:
         regulator_disable(trf->regulator);
@@ -1321,15 +1365,16 @@ static int trf7970a_remove(struct spi_device *spi)
 
         mutex_lock(&trf->lock);
 
-        trf7970a_switch_rf_off(trf);
-        trf7970a_init(trf);
-
         switch (trf->state) {
         case TRF7970A_ST_WAIT_FOR_TX_FIFO:
         case TRF7970A_ST_WAIT_FOR_RX_DATA:
         case TRF7970A_ST_WAIT_FOR_RX_DATA_CONT:
         case TRF7970A_ST_WAIT_TO_ISSUE_EOF:
                 trf7970a_send_err_upstream(trf, -ECANCELED);
+                /* FALLTHROUGH */
+        case TRF7970A_ST_IDLE:
+        case TRF7970A_ST_IDLE_RX_BLOCKED:
+                pm_runtime_put_sync(trf->dev);
                 break;
         default:
                 break;
@@ -1337,6 +1382,8 @@ static int trf7970a_remove(struct spi_device *spi)
 
         mutex_unlock(&trf->lock);
 
+        pm_runtime_disable(trf->dev);
+
         nfc_digital_unregister_device(trf->ddev);
         nfc_digital_free_device(trf->ddev);
 
@@ -1347,6 +1394,70 @@ static int trf7970a_remove(struct spi_device *spi)
         return 0;
 }
 
+#ifdef CONFIG_PM_RUNTIME
+static int trf7970a_pm_runtime_suspend(struct device *dev)
+{
+        struct spi_device *spi = container_of(dev, struct spi_device, dev);
+        struct trf7970a *trf = spi_get_drvdata(spi);
+        int ret;
+
+        dev_dbg(dev, "Runtime suspend\n");
+
+        if (trf->state != TRF7970A_ST_OFF) {
+                dev_dbg(dev, "Can't suspend - not in OFF state (%d)\n",
+                                trf->state);
+                return -EBUSY;
+        }
+
+        gpio_set_value(trf->en_gpio, 0);
+        gpio_set_value(trf->en2_gpio, 0);
+
+        ret = regulator_disable(trf->regulator);
+        if (ret)
+                dev_err(dev, "%s - Can't disable VIN: %d\n", __func__, ret);
+
+        return ret;
+}
+
+static int trf7970a_pm_runtime_resume(struct device *dev)
+{
+        struct spi_device *spi = container_of(dev, struct spi_device, dev);
+        struct trf7970a *trf = spi_get_drvdata(spi);
+        int ret;
+
+        dev_dbg(dev, "Runtime resume\n");
+
+        ret = regulator_enable(trf->regulator);
+        if (ret) {
+                dev_err(dev, "%s - Can't enable VIN: %d\n", __func__, ret);
+                return ret;
+        }
+
+        usleep_range(5000, 6000);
+
+        gpio_set_value(trf->en2_gpio, 1);
+        usleep_range(1000, 2000);
+        gpio_set_value(trf->en_gpio, 1);
+
+        usleep_range(20000, 21000);
+
+        ret = trf7970a_init(trf);
+        if (ret) {
+                dev_err(dev, "%s - Can't initialize: %d\n", __func__, ret);
+                return ret;
+        }
+
+        pm_runtime_mark_last_busy(dev);
+
+        return 0;
+}
+#endif
+
+static const struct dev_pm_ops trf7970a_pm_ops = {
+        SET_RUNTIME_PM_OPS(trf7970a_pm_runtime_suspend,
+                        trf7970a_pm_runtime_resume, NULL)
+};
+
 static const struct spi_device_id trf7970a_id_table[] = {
         { "trf7970a", TRF7970A_QUIRK_IRQ_STATUS_READ_ERRATA },
         { }
@@ -1360,6 +1471,7 @@ static struct spi_driver trf7970a_spi_driver = {
         .driver         = {
                 .name   = "trf7970a",
                 .owner  = THIS_MODULE,
+                .pm     = &trf7970a_pm_ops,
         },
 };
 
diff --git a/drivers/staging/wlan-ng/cfg80211.c b/drivers/staging/wlan-ng/cfg80211.c
index f76f95c29617..723319ee08f3 100644
--- a/drivers/staging/wlan-ng/cfg80211.c
+++ b/drivers/staging/wlan-ng/cfg80211.c
@@ -84,7 +84,7 @@ static int prism2_domibset_uint32(wlandevice_t *wlandev, u32 did, u32 data)
 }
 
 static int prism2_domibset_pstr32(wlandevice_t *wlandev,
-                                  u32 did, u8 len, u8 *data)
+                                  u32 did, u8 len, const u8 *data)
 {
         struct p80211msg_dot11req_mibset msg;
         p80211item_pstr32_t *mibitem =
@@ -298,7 +298,7 @@ static int prism2_set_default_key(struct wiphy *wiphy, struct net_device *dev,
 
 
 static int prism2_get_station(struct wiphy *wiphy, struct net_device *dev,
-                              u8 *mac, struct station_info *sinfo)
+                              const u8 *mac, struct station_info *sinfo)
 {
         wlandevice_t *wlandev = dev->ml_priv;
         struct p80211msg_lnxreq_commsquality quality;
diff --git a/include/linux/ath9k_platform.h b/include/linux/ath9k_platform.h
index 8598f8eacb20..a495a959e8a7 100644
--- a/include/linux/ath9k_platform.h
+++ b/include/linux/ath9k_platform.h
@@ -36,6 +36,8 @@ struct ath9k_platform_data {
 
         int (*get_mac_revision)(void);
         int (*external_reset)(void);
+
+        bool use_eeprom;
 };
 
 #endif /* _LINUX_ATH9K_PLATFORM_H */
diff --git a/include/linux/crc7.h b/include/linux/crc7.h
index 1786e772d5c6..d590765106f3 100644
--- a/include/linux/crc7.h
+++ b/include/linux/crc7.h
@@ -2,13 +2,13 @@
 #define _LINUX_CRC7_H
 #include <linux/types.h>
 
-extern const u8 crc7_syndrome_table[256];
+extern const u8 crc7_be_syndrome_table[256];
 
-static inline u8 crc7_byte(u8 crc, u8 data)
+static inline u8 crc7_be_byte(u8 crc, u8 data)
 {
-        return crc7_syndrome_table[(crc << 1) ^ data];
+        return crc7_be_syndrome_table[crc ^ data];
 }
 
-extern u8 crc7(u8 crc, const u8 *buffer, size_t len);
+extern u8 crc7_be(u8 crc, const u8 *buffer, size_t len);
 
 #endif
diff --git a/include/linux/platform_data/st21nfca.h b/include/linux/platform_data/st21nfca.h
new file mode 100644
index 000000000000..1730312398ff
--- /dev/null
+++ b/include/linux/platform_data/st21nfca.h
@@ -0,0 +1,32 @@
+/*
+ * Driver include for the ST21NFCA NFC chip.
+ *
+ * Copyright (C) 2014  STMicroelectronics SAS. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _ST21NFCA_HCI_H_
+#define _ST21NFCA_HCI_H_
+
+#include <linux/i2c.h>
+
+#define ST21NFCA_HCI_DRIVER_NAME "st21nfca_hci"
+
+struct st21nfca_nfc_platform_data {
+        unsigned int gpio_irq;
+        unsigned int gpio_ena;
+        unsigned int irq_polarity;
+};
+
+#endif /* _ST21NFCA_HCI_H_ */
diff --git a/include/linux/rfkill-gpio.h b/include/linux/rfkill-gpio.h
index 4d09f6eab359..20bcb55498cd 100644
--- a/include/linux/rfkill-gpio.h
+++ b/include/linux/rfkill-gpio.h
@@ -27,21 +27,11 @@
  * struct rfkill_gpio_platform_data - platform data for rfkill gpio device.
  * for unused gpio's, the expected value is -1.
  * @name:               name for the gpio rf kill instance
- * @reset_gpio:         GPIO which is used for reseting rfkill switch
- * @shutdown_gpio:      GPIO which is used for shutdown of rfkill switch
- * @power_clk_name:     [optional] name of clk to turn off while blocked
- * @gpio_runtime_close: clean up platform specific gpio configuration
- * @gpio_runtime_setup: set up platform specific gpio configuration
  */
 
 struct rfkill_gpio_platform_data {
         char                    *name;
-        int                     reset_gpio;
-        int                     shutdown_gpio;
-        const char              *power_clk_name;
         enum rfkill_type        type;
-        void    (*gpio_runtime_close)(struct platform_device *);
-        int     (*gpio_runtime_setup)(struct platform_device *);
 };
 
 #endif /* __RFKILL_GPIO_H */
diff --git a/include/linux/ssb/ssb.h b/include/linux/ssb/ssb.h
index 07ef9b82b66d..4568a5cc9ab8 100644
--- a/include/linux/ssb/ssb.h
+++ b/include/linux/ssb/ssb.h
@@ -33,6 +33,7 @@ struct ssb_sprom {
         u8 et1phyaddr;          /* MII address for enet1 */
         u8 et0mdcport;          /* MDIO for enet0 */
         u8 et1mdcport;          /* MDIO for enet1 */
+        u16 dev_id;             /* Device ID overriding e.g. PCI ID */
         u16 board_rev;          /* Board revision number from SPROM. */
         u16 board_num;          /* Board number from SPROM. */
         u16 board_type;         /* Board type from SPROM. */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index f2c318655519..e46c437944f7 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -341,8 +341,8 @@ struct vif_params {
  * @seq_len: length of @seq.
  */
 struct key_params {
-        u8 *key;
-        u8 *seq;
+        const u8 *key;
+        const u8 *seq;
         int key_len;
         int seq_len;
         u32 cipher;
@@ -458,7 +458,7 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
  */
 int cfg80211_chandef_dfs_required(struct wiphy *wiphy,
                                   const struct cfg80211_chan_def *chandef,
-                                  enum nl80211_iftype);
+                                  enum nl80211_iftype iftype);
 
 /**
  * ieee80211_chandef_rate_flags - returns rate flags for a channel
@@ -694,8 +694,10 @@ struct cfg80211_ap_settings {
  *
  * @chandef: defines the channel to use after the switch
  * @beacon_csa: beacon data while performing the switch
- * @counter_offset_beacon: offset for the counter within the beacon (tail)
- * @counter_offset_presp: offset for the counter within the probe response
+ * @counter_offsets_beacon: offsets of the counters within the beacon (tail)
+ * @counter_offsets_presp: offsets of the counters within the probe response
+ * @n_counter_offsets_beacon: number of csa counters the beacon (tail)
+ * @n_counter_offsets_presp: number of csa counters in the probe response
  * @beacon_after: beacon data to be used on the new channel
  * @radar_required: whether radar detection is required on the new channel
  * @block_tx: whether transmissions should be blocked while changing
@@ -704,7 +706,10 @@ struct cfg80211_ap_settings {
 struct cfg80211_csa_settings {
         struct cfg80211_chan_def chandef;
         struct cfg80211_beacon_data beacon_csa;
-        u16 counter_offset_beacon, counter_offset_presp;
+        const u16 *counter_offsets_beacon;
+        const u16 *counter_offsets_presp;
+        unsigned int n_counter_offsets_beacon;
+        unsigned int n_counter_offsets_presp;
         struct cfg80211_beacon_data beacon_after;
         bool radar_required;
         bool block_tx;
@@ -868,36 +873,38 @@ int cfg80211_check_station_change(struct wiphy *wiphy,
  * @STATION_INFO_NONPEER_PM: @nonpeer_pm filled
  * @STATION_INFO_CHAIN_SIGNAL: @chain_signal filled
  * @STATION_INFO_CHAIN_SIGNAL_AVG: @chain_signal_avg filled
+ * @STATION_INFO_EXPECTED_THROUGHPUT: @expected_throughput filled
  */
 enum station_info_flags {
-        STATION_INFO_INACTIVE_TIME      = 1<<0,
-        STATION_INFO_RX_BYTES           = 1<<1,
-        STATION_INFO_TX_BYTES           = 1<<2,
-        STATION_INFO_LLID               = 1<<3,
-        STATION_INFO_PLID               = 1<<4,
-        STATION_INFO_PLINK_STATE        = 1<<5,
-        STATION_INFO_SIGNAL             = 1<<6,
-        STATION_INFO_TX_BITRATE         = 1<<7,
-        STATION_INFO_RX_PACKETS         = 1<<8,
-        STATION_INFO_TX_PACKETS         = 1<<9,
-        STATION_INFO_TX_RETRIES         = 1<<10,
-        STATION_INFO_TX_FAILED          = 1<<11,
-        STATION_INFO_RX_DROP_MISC       = 1<<12,
-        STATION_INFO_SIGNAL_AVG         = 1<<13,
-        STATION_INFO_RX_BITRATE         = 1<<14,
-        STATION_INFO_BSS_PARAM          = 1<<15,
-        STATION_INFO_CONNECTED_TIME     = 1<<16,
-        STATION_INFO_ASSOC_REQ_IES      = 1<<17,
-        STATION_INFO_STA_FLAGS          = 1<<18,
-        STATION_INFO_BEACON_LOSS_COUNT  = 1<<19,
-        STATION_INFO_T_OFFSET           = 1<<20,
-        STATION_INFO_LOCAL_PM           = 1<<21,
-        STATION_INFO_PEER_PM            = 1<<22,
-        STATION_INFO_NONPEER_PM         = 1<<23,
-        STATION_INFO_RX_BYTES64         = 1<<24,
-        STATION_INFO_TX_BYTES64         = 1<<25,
-        STATION_INFO_CHAIN_SIGNAL       = 1<<26,
-        STATION_INFO_CHAIN_SIGNAL_AVG   = 1<<27,
+        STATION_INFO_INACTIVE_TIME              = BIT(0),
+        STATION_INFO_RX_BYTES                   = BIT(1),
+        STATION_INFO_TX_BYTES                   = BIT(2),
+        STATION_INFO_LLID                       = BIT(3),
+        STATION_INFO_PLID                       = BIT(4),
+        STATION_INFO_PLINK_STATE                = BIT(5),
+        STATION_INFO_SIGNAL                     = BIT(6),
+        STATION_INFO_TX_BITRATE                 = BIT(7),
+        STATION_INFO_RX_PACKETS                 = BIT(8),
+        STATION_INFO_TX_PACKETS                 = BIT(9),
+        STATION_INFO_TX_RETRIES                 = BIT(10),
+        STATION_INFO_TX_FAILED                  = BIT(11),
+        STATION_INFO_RX_DROP_MISC               = BIT(12),
+        STATION_INFO_SIGNAL_AVG                 = BIT(13),
+        STATION_INFO_RX_BITRATE                 = BIT(14),
+        STATION_INFO_BSS_PARAM                  = BIT(15),
+        STATION_INFO_CONNECTED_TIME             = BIT(16),
+        STATION_INFO_ASSOC_REQ_IES              = BIT(17),
+        STATION_INFO_STA_FLAGS                  = BIT(18),
+        STATION_INFO_BEACON_LOSS_COUNT          = BIT(19),
+        STATION_INFO_T_OFFSET                   = BIT(20),
+        STATION_INFO_LOCAL_PM                   = BIT(21),
+        STATION_INFO_PEER_PM                    = BIT(22),
+        STATION_INFO_NONPEER_PM                 = BIT(23),
+        STATION_INFO_RX_BYTES64                 = BIT(24),
+        STATION_INFO_TX_BYTES64                 = BIT(25),
+        STATION_INFO_CHAIN_SIGNAL               = BIT(26),
+        STATION_INFO_CHAIN_SIGNAL_AVG           = BIT(27),
+        STATION_INFO_EXPECTED_THROUGHPUT        = BIT(28),
 };
 
 /**
@@ -1019,6 +1026,8 @@ struct sta_bss_parameters {
  * @local_pm: local mesh STA power save mode
  * @peer_pm: peer mesh STA power save mode
  * @nonpeer_pm: non-peer mesh STA power save mode
+ * @expected_throughput: expected throughput in kbps (including 802.11 headers)
+ *      towards this station.
  */
 struct station_info {
         u32 filled;
@@ -1057,6 +1066,8 @@ struct station_info {
         enum nl80211_mesh_power_mode peer_pm;
         enum nl80211_mesh_power_mode nonpeer_pm;
 
+        u32 expected_throughput;
+
         /*
          * Note: Add a new enum station_info_flags value for each new field and
          * use it to check which fields are initialized.
@@ -1064,6 +1075,19 @@ struct station_info {
 };
 
 /**
+ * cfg80211_get_station - retrieve information about a given station
+ * @dev: the device where the station is supposed to be connected to
+ * @mac_addr: the mac address of the station of interest
+ * @sinfo: pointer to the structure to fill with the information
+ *
+ * Returns 0 on success and sinfo is filled with the available information
+ * otherwise returns a negative error code and the content of sinfo has to be
+ * considered undefined.
+ */
+int cfg80211_get_station(struct net_device *dev, const u8 *mac_addr,
+                         struct station_info *sinfo);
+
+/**
  * enum monitor_flags - monitor flags
  *
  * Monitor interface configuration flags. Note that these must be the bits
@@ -1164,7 +1188,7 @@ struct bss_parameters {
         int use_cts_prot;
         int use_short_preamble;
         int use_short_slot_time;
-        u8 *basic_rates;
+        const u8 *basic_rates;
         u8 basic_rates_len;
         int ap_isolate;
         int ht_opmode;
@@ -1694,10 +1718,10 @@ struct cfg80211_disassoc_request {
  * @ht_capa_mask:  The bits of ht_capa which are to be used.
  */
 struct cfg80211_ibss_params {
-        u8 *ssid;
-        u8 *bssid;
+        const u8 *ssid;
+        const u8 *bssid;
         struct cfg80211_chan_def chandef;
-        u8 *ie;
+        const u8 *ie;
         u8 ssid_len, ie_len;
         u16 beacon_interval;
         u32 basic_rates;
@@ -1806,8 +1830,8 @@ struct cfg80211_bitrate_mask {
  * @pmkid: The PMK material itself.
  */
 struct cfg80211_pmksa {
-        u8 *bssid;
-        u8 *pmkid;
+        const u8 *bssid;
+        const u8 *pmkid;
 };
 
 /**
@@ -1822,7 +1846,7 @@ struct cfg80211_pmksa {
  * memory, free @mask only!
  */
 struct cfg80211_pkt_pattern {
-        u8 *mask, *pattern;
+        const u8 *mask, *pattern;
         int pattern_len;
         int pkt_offset;
 };
@@ -1986,6 +2010,8 @@ struct cfg80211_update_ft_ies_params {
  * @len: buffer length
  * @no_cck: don't use cck rates for this frame
  * @dont_wait_for_ack: tells the low level not to wait for an ack
+ * @n_csa_offsets: length of csa_offsets array
+ * @csa_offsets: array of all the csa offsets in the frame
  */
 struct cfg80211_mgmt_tx_params {
         struct ieee80211_channel *chan;
@@ -1995,6 +2021,8 @@ struct cfg80211_mgmt_tx_params {
         size_t len;
         bool no_cck;
         bool dont_wait_for_ack;
+        int n_csa_offsets;
+        const u16 *csa_offsets;
 };
 
 /**
@@ -2336,28 +2364,29 @@ struct cfg80211_ops {
 
 
         int     (*add_station)(struct wiphy *wiphy, struct net_device *dev,
-                               u8 *mac, struct station_parameters *params);
+                               const u8 *mac,
+                               struct station_parameters *params);
         int     (*del_station)(struct wiphy *wiphy, struct net_device *dev,
-                               u8 *mac);
+                               const u8 *mac);
         int     (*change_station)(struct wiphy *wiphy, struct net_device *dev,
-                                  u8 *mac, struct station_parameters *params);
+                                  const u8 *mac,
+                                  struct station_parameters *params);
         int     (*get_station)(struct wiphy *wiphy, struct net_device *dev,
-                               u8 *mac, struct station_info *sinfo);
+                               const u8 *mac, struct station_info *sinfo);
         int     (*dump_station)(struct wiphy *wiphy, struct net_device *dev,
-                               int idx, u8 *mac, struct station_info *sinfo);
+                                int idx, u8 *mac, struct station_info *sinfo);
 
         int     (*add_mpath)(struct wiphy *wiphy, struct net_device *dev,
-                               u8 *dst, u8 *next_hop);
+                               const u8 *dst, const u8 *next_hop);
         int     (*del_mpath)(struct wiphy *wiphy, struct net_device *dev,
-                               u8 *dst);
+                               const u8 *dst);
         int     (*change_mpath)(struct wiphy *wiphy, struct net_device *dev,
-                                  u8 *dst, u8 *next_hop);
+                                  const u8 *dst, const u8 *next_hop);
         int     (*get_mpath)(struct wiphy *wiphy, struct net_device *dev,
-                               u8 *dst, u8 *next_hop,
-                               struct mpath_info *pinfo);
+                             u8 *dst, u8 *next_hop, struct mpath_info *pinfo);
         int     (*dump_mpath)(struct wiphy *wiphy, struct net_device *dev,
-                               int idx, u8 *dst, u8 *next_hop,
-                               struct mpath_info *pinfo);
+                              int idx, u8 *dst, u8 *next_hop,
+                              struct mpath_info *pinfo);
         int     (*get_mesh_config)(struct wiphy *wiphy,
                                 struct net_device *dev,
                                 struct mesh_config *conf);
@@ -2487,11 +2516,11 @@ struct cfg80211_ops {
                                   struct cfg80211_gtk_rekey_data *data);
 
         int     (*tdls_mgmt)(struct wiphy *wiphy, struct net_device *dev,
-                             u8 *peer, u8 action_code,  u8 dialog_token,
+                             const u8 *peer, u8 action_code,  u8 dialog_token,
                              u16 status_code, u32 peer_capability,
                              const u8 *buf, size_t len);
         int     (*tdls_oper)(struct wiphy *wiphy, struct net_device *dev,
-                             u8 *peer, enum nl80211_tdls_operation oper);
+                             const u8 *peer, enum nl80211_tdls_operation oper);
 
         int     (*probe_client)(struct wiphy *wiphy, struct net_device *dev,
                                 const u8 *peer, u64 *cookie);
@@ -2638,6 +2667,7 @@ struct ieee80211_iface_limit {
  *      between infrastructure and AP types must match. This is required
  *      only in special cases.
  * @radar_detect_widths: bitmap of channel widths supported for radar detection
+ * @radar_detect_regions: bitmap of regions supported for radar detection
  *
  * With this structure the driver can describe which interface
  * combinations it supports concurrently.
@@ -2695,6 +2725,7 @@ struct ieee80211_iface_combination {
         u8 n_limits;
         bool beacon_int_infra_match;
         u8 radar_detect_widths;
+        u8 radar_detect_regions;
 };
 
 struct ieee80211_txrx_stypes {
@@ -2925,6 +2956,17 @@ struct wiphy_vendor_command {
  *      (including P2P GO) or 0 to indicate no such limit is advertised. The
  *      driver is allowed to advertise a theoretical limit that it can reach in
  *      some cases, but may not always reach.
+ *
+ * @max_num_csa_counters: Number of supported csa_counters in beacons
+ *      and probe responses.  This value should be set if the driver
+ *      wishes to limit the number of csa counters. Default (0) means
+ *      infinite.
+ * @max_adj_channel_rssi_comp: max offset of between the channel on which the
+ *      frame was sent and the channel on which the frame was heard for which
+ *      the reported rssi is still valid. If a driver is able to compensate the
+ *      low rssi when a frame is heard on different channel, then it should set
+ *      this variable to the maximal offset for which it can compensate.
+ *      This value should be set in MHz.
  */
 struct wiphy {
         /* assign these fields before you register the wiphy */
@@ -3042,6 +3084,9 @@ struct wiphy {
 
         u16 max_ap_assoc_sta;
 
+        u8 max_num_csa_counters;
+        u8 max_adj_channel_rssi_comp;
+
         char priv[0] __aligned(NETDEV_ALIGN);
 };
 
@@ -3270,7 +3315,7 @@ struct wireless_dev {
                 struct cfg80211_ibss_params ibss;
                 struct cfg80211_connect_params connect;
                 struct cfg80211_cached_keys *keys;
-                u8 *ie;
+                const u8 *ie;
                 size_t ie_len;
                 u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN];
                 u8 ssid[IEEE80211_MAX_SSID_LEN];
@@ -3511,7 +3556,8 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
  * Return: 0 on success, or a negative error code.
  */
 int ieee80211_data_from_8023(struct sk_buff *skb, const u8 *addr,
-                             enum nl80211_iftype iftype, u8 *bssid, bool qos);
+                             enum nl80211_iftype iftype, const u8 *bssid,
+                             bool qos);
 
 /**
  * ieee80211_amsdu_to_8023s - decode an IEEE 802.11n A-MSDU frame
@@ -4312,7 +4358,7 @@ void cfg80211_roamed_bss(struct net_device *dev, struct cfg80211_bss *bss,
  * and not try to connect to any AP any more.
  */
 void cfg80211_disconnected(struct net_device *dev, u16 reason,
-                           u8 *ie, size_t ie_len, gfp_t gfp);
+                           const u8 *ie, size_t ie_len, gfp_t gfp);
 
 /**
  * cfg80211_ready_on_channel - notification of remain_on_channel start
@@ -4768,6 +4814,35 @@ int cfg80211_iter_combinations(struct wiphy *wiphy,
                                             void *data),
                                void *data);
 
+/*
+ * cfg80211_stop_iface - trigger interface disconnection
+ *
+ * @wiphy: the wiphy
+ * @wdev: wireless device
+ * @gfp: context flags
+ *
+ * Trigger interface to be stopped as if AP was stopped, IBSS/mesh left, STA
+ * disconnected.
+ *
+ * Note: This doesn't need any locks and is asynchronous.
+ */
+void cfg80211_stop_iface(struct wiphy *wiphy, struct wireless_dev *wdev,
+                         gfp_t gfp);
+
+/**
+ * cfg80211_shutdown_all_interfaces - shut down all interfaces for a wiphy
+ * @wiphy: the wiphy to shut down
+ *
+ * This function shuts down all interfaces belonging to this wiphy by
+ * calling dev_close() (and treating non-netdev interfaces as needed).
+ * It shouldn't really be used unless there are some fatal device errors
+ * that really can't be recovered in any other way.
+ *
+ * Callers must hold the RTNL and be able to deal with callbacks into
+ * the driver while the function is running.
+ */
+void cfg80211_shutdown_all_interfaces(struct wiphy *wiphy);
+
 /* Logging, debugging and troubleshooting/diagnostic helpers. */
 
 /* wiphy_printk helpers, similar to dev_printk */
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 451c1bf00df9..2c78997bc48d 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1113,7 +1113,9 @@ enum ieee80211_vif_flags {
  * @addr: address of this interface
  * @p2p: indicates whether this AP or STA interface is a p2p
  *      interface, i.e. a GO or p2p-sta respectively
- * @csa_active: marks whether a channel switch is going on
+ * @csa_active: marks whether a channel switch is going on. Internally it is
+ *      write-protected by sdata_lock and local->mtx so holding either is fine
+ *      for read access.
  * @driver_flags: flags/capabilities the driver has for this interface,
  *      these need to be set (or cleared) when the interface is added
  *      or, if supported by the driver, the interface type is changed
@@ -1374,6 +1376,7 @@ struct ieee80211_sta_rates {
  *      the station moves to associated state.
  * @smps_mode: current SMPS mode (off, static or dynamic)
  * @rates: rate control selection table
+ * @tdls: indicates whether the STA is a TDLS peer
  */
 struct ieee80211_sta {
         u32 supp_rates[IEEE80211_NUM_BANDS];
@@ -1388,6 +1391,7 @@ struct ieee80211_sta {
         enum ieee80211_sta_rx_bandwidth bandwidth;
         enum ieee80211_smps_mode smps_mode;
         struct ieee80211_sta_rates __rcu *rates;
+        bool tdls;
 
         /* must be last */
         u8 drv_priv[0] __aligned(sizeof(void *));
@@ -2765,6 +2769,10 @@ enum ieee80211_roc_type {
  *      information in bss_conf is set up and the beacon can be retrieved. A
  *      channel context is bound before this is called.
  * @leave_ibss: Leave the IBSS again.
+ *
+ * @get_expected_throughput: extract the expected throughput towards the
+ *      specified station. The returned value is expressed in Kbps. It returns 0
+ *      if the RC algorithm does not have proper data to provide.
  */
 struct ieee80211_ops {
         void (*tx)(struct ieee80211_hw *hw,
@@ -2958,6 +2966,7 @@ struct ieee80211_ops {
 
         int (*join_ibss)(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
         void (*leave_ibss)(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
+        u32 (*get_expected_throughput)(struct ieee80211_sta *sta);
 };
 
 /**
@@ -3407,6 +3416,47 @@ void ieee80211_tx_status_irqsafe(struct ieee80211_hw *hw,
  */
 void ieee80211_report_low_ack(struct ieee80211_sta *sta, u32 num_packets);
 
+#define IEEE80211_MAX_CSA_COUNTERS_NUM 2
+
+/**
+ * struct ieee80211_mutable_offsets - mutable beacon offsets
+ * @tim_offset: position of TIM element
+ * @tim_length: size of TIM element
+ * @csa_counter_offs: array of IEEE80211_MAX_CSA_COUNTERS_NUM offsets
+ *      to CSA counters.  This array can contain zero values which
+ *      should be ignored.
+ */
+struct ieee80211_mutable_offsets {
+        u16 tim_offset;
+        u16 tim_length;
+
+        u16 csa_counter_offs[IEEE80211_MAX_CSA_COUNTERS_NUM];
+};
+
+/**
+ * ieee80211_beacon_get_template - beacon template generation function
+ * @hw: pointer obtained from ieee80211_alloc_hw().
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+ * @offs: &struct ieee80211_mutable_offsets pointer to struct that will
+ *      receive the offsets that may be updated by the driver.
+ *
+ * If the driver implements beaconing modes, it must use this function to
+ * obtain the beacon template.
+ *
+ * This function should be used if the beacon frames are generated by the
+ * device, and then the driver must use the returned beacon as the template
+ * The driver or the device are responsible to update the DTIM and, when
+ * applicable, the CSA count.
+ *
+ * The driver is responsible for freeing the returned skb.
+ *
+ * Return: The beacon template. %NULL on error.
+ */
+struct sk_buff *
+ieee80211_beacon_get_template(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif,
+                              struct ieee80211_mutable_offsets *offs);
+
 /**
  * ieee80211_beacon_get_tim - beacon generation function
  * @hw: pointer obtained from ieee80211_alloc_hw().
@@ -3418,16 +3468,12 @@ void ieee80211_report_low_ack(struct ieee80211_sta *sta, u32 num_packets);
  *      Set to 0 if invalid (in non-AP modes).
  *
  * If the driver implements beaconing modes, it must use this function to
- * obtain the beacon frame/template.
+ * obtain the beacon frame.
  *
  * If the beacon frames are generated by the host system (i.e., not in
  * hardware/firmware), the driver uses this function to get each beacon
- * frame from mac80211 -- it is responsible for calling this function
- * before the beacon is needed (e.g. based on hardware interrupt).
- *
- * If the beacon frames are generated by the device, then the driver
- * must use the returned beacon as the template and change the TIM IE
- * according to the current DTIM parameters/TIM bitmap.
+ * frame from mac80211 -- it is responsible for calling this function exactly
+ * once before the beacon is needed (e.g. based on hardware interrupt).
  *
  * The driver is responsible for freeing the returned skb.
  *
@@ -3453,6 +3499,20 @@ static inline struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
 }
 
 /**
+ * ieee80211_csa_update_counter - request mac80211 to decrement the csa counter
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+ *
+ * The csa counter should be updated after each beacon transmission.
+ * This function is called implicitly when
+ * ieee80211_beacon_get/ieee80211_beacon_get_tim are called, however if the
+ * beacon frames are generated by the device, the driver should call this
+ * function after each beacon transmission to sync mac80211's csa counters.
+ *
+ * Return: new csa counter value
+ */
+u8 ieee80211_csa_update_counter(struct ieee80211_vif *vif);
+
+/**
  * ieee80211_csa_finish - notify mac80211 about channel switch
  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
  *
@@ -4480,6 +4540,8 @@ struct rate_control_ops {
         void (*add_sta_debugfs)(void *priv, void *priv_sta,
                                 struct dentry *dir);
         void (*remove_sta_debugfs)(void *priv, void *priv_sta);
+
+        u32 (*get_expected_throughput)(void *priv_sta);
 };
 
 static inline int rate_supported(struct ieee80211_sta *sta,
diff --git a/include/net/nfc/digital.h b/include/net/nfc/digital.h
index 7655cfe27c34..bdf55c3b7a19 100644
--- a/include/net/nfc/digital.h
+++ b/include/net/nfc/digital.h
@@ -36,6 +36,7 @@ enum {
         NFC_DIGITAL_RF_TECH_212F,
         NFC_DIGITAL_RF_TECH_424F,
         NFC_DIGITAL_RF_TECH_ISO15693,
+        NFC_DIGITAL_RF_TECH_106B,
 
         NFC_DIGITAL_RF_TECH_LAST,
 };
@@ -62,6 +63,9 @@ enum {
         NFC_DIGITAL_FRAMING_ISO15693_INVENTORY,
         NFC_DIGITAL_FRAMING_ISO15693_T5T,
 
+        NFC_DIGITAL_FRAMING_NFCB,
+        NFC_DIGITAL_FRAMING_NFCB_T4T,
+
         NFC_DIGITAL_FRAMING_LAST,
 };
 
diff --git a/include/net/nfc/hci.h b/include/net/nfc/hci.h
index 03c4650b548c..61286db54388 100644
--- a/include/net/nfc/hci.h
+++ b/include/net/nfc/hci.h
@@ -27,6 +27,7 @@ struct nfc_hci_dev;
 struct nfc_hci_ops {
         int (*open) (struct nfc_hci_dev *hdev);
         void (*close) (struct nfc_hci_dev *hdev);
+        int (*load_session) (struct nfc_hci_dev *hdev);
         int (*hci_ready) (struct nfc_hci_dev *hdev);
         /*
          * xmit must always send the complete buffer before
diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
index 2e8b40c16274..6c583e244de2 100644
--- a/include/net/nfc/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -264,4 +264,7 @@ int nfc_add_se(struct nfc_dev *dev, u32 se_idx, u16 type);
 int nfc_remove_se(struct nfc_dev *dev, u32 se_idx);
 struct nfc_se *nfc_find_se(struct nfc_dev *dev, u32 se_idx);
 
+void nfc_send_to_raw_sock(struct nfc_dev *dev, struct sk_buff *skb,
+                          u8 payload_type, u8 direction);
+
 #endif /* __NET_NFC_H */
diff --git a/include/uapi/linux/nfc.h b/include/uapi/linux/nfc.h
index 9789dc95b6a8..9b19b4461928 100644
--- a/include/uapi/linux/nfc.h
+++ b/include/uapi/linux/nfc.h
@@ -273,11 +273,19 @@ struct sockaddr_nfc_llcp {
  * First byte is the adapter index
  * Second byte contains flags
  *  - 0x01 - Direction (0=RX, 1=TX)
- *  - 0x02-0x80 - Reserved
+ *  - 0x02-0x04 - Payload type (000=LLCP, 001=NCI, 010=HCI, 011=Digital,
+ *                              100=Proprietary)
+ *  - 0x05-0x80 - Reserved
  **/
-#define NFC_LLCP_RAW_HEADER_SIZE        2
-#define NFC_LLCP_DIRECTION_RX           0x00
-#define NFC_LLCP_DIRECTION_TX           0x01
+#define NFC_RAW_HEADER_SIZE     2
+#define NFC_DIRECTION_RX                0x00
+#define NFC_DIRECTION_TX                0x01
+
+#define RAW_PAYLOAD_LLCP 0
+#define RAW_PAYLOAD_NCI 1
+#define RAW_PAYLOAD_HCI 2
+#define RAW_PAYLOAD_DIGITAL     3
+#define RAW_PAYLOAD_PROPRIETARY 4
 
 /* socket option names */
 #define NFC_LLCP_RW             0
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 9922b9b828a2..be9519b52bb1 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -503,6 +503,9 @@
  *      TX status event pertaining to the TX request.
  *      %NL80211_ATTR_TX_NO_CCK_RATE is used to decide whether to send the
  *      management frames at CCK rate or not in 2GHz band.
+ *      %NL80211_ATTR_CSA_C_OFFSETS_TX is an array of offsets to CSA
+ *      counters which will be updated to the current value. This attribute
+ *      is used during CSA period.
  * @NL80211_CMD_FRAME_WAIT_CANCEL: When an off-channel TX was requested, this
  *      command may be used with the corresponding cookie to cancel the wait
  *      time if it is known that it is no longer necessary.
@@ -1525,10 +1528,10 @@ enum nl80211_commands {
  *      operation).
  * @NL80211_ATTR_CSA_IES: Nested set of attributes containing the IE information
  *      for the time while performing a channel switch.
- * @NL80211_ATTR_CSA_C_OFF_BEACON: Offset of the channel switch counter
- *      field in the beacons tail (%NL80211_ATTR_BEACON_TAIL).
- * @NL80211_ATTR_CSA_C_OFF_PRESP: Offset of the channel switch counter
- *      field in the probe response (%NL80211_ATTR_PROBE_RESP).
+ * @NL80211_ATTR_CSA_C_OFF_BEACON: An array of offsets (u16) to the channel
+ *      switch counters in the beacons tail (%NL80211_ATTR_BEACON_TAIL).
+ * @NL80211_ATTR_CSA_C_OFF_PRESP: An array of offsets (u16) to the channel
+ *      switch counters in the probe response (%NL80211_ATTR_PROBE_RESP).
  *
  * @NL80211_ATTR_RXMGMT_FLAGS: flags for nl80211_send_mgmt(), u32.
  *      As specified in the &enum nl80211_rxmgmt_flags.
@@ -1576,6 +1579,11 @@ enum nl80211_commands {
  *      advertise values that cannot always be met. In such cases, an attempt
  *      to add a new station entry with @NL80211_CMD_NEW_STATION may fail.
  *
+ * @NL80211_ATTR_CSA_C_OFFSETS_TX: An array of csa counter offsets (u16) which
+ *      should be updated when the frame is transmitted.
+ * @NL80211_ATTR_MAX_CSA_COUNTERS: U8 attribute used to advertise the maximum
+ *      supported number of csa counters.
+ *
  * @NL80211_ATTR_TDLS_PEER_CAPABILITY: flags for TDLS peer capabilities, u32.
  *      As specified in the &enum nl80211_tdls_peer_capability.
  *
@@ -1920,6 +1928,9 @@ enum nl80211_attrs {
 
         NL80211_ATTR_IFACE_SOCKET_OWNER,
 
+        NL80211_ATTR_CSA_C_OFFSETS_TX,
+        NL80211_ATTR_MAX_CSA_COUNTERS,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
@@ -2188,6 +2199,8 @@ enum nl80211_sta_bss_param {
  *      Contains a nested array of signal strength attributes (u8, dBm)
  * @NL80211_STA_INFO_CHAIN_SIGNAL_AVG: per-chain signal strength average
  *      Same format as NL80211_STA_INFO_CHAIN_SIGNAL.
+ * @NL80211_STA_EXPECTED_THROUGHPUT: expected throughput considering also the
+ *      802.11 header (u32, kbps)
  * @__NL80211_STA_INFO_AFTER_LAST: internal
  * @NL80211_STA_INFO_MAX: highest possible station info attribute
  */
@@ -2219,6 +2232,7 @@ enum nl80211_sta_info {
         NL80211_STA_INFO_TX_BYTES64,
         NL80211_STA_INFO_CHAIN_SIGNAL,
         NL80211_STA_INFO_CHAIN_SIGNAL_AVG,
+        NL80211_STA_INFO_EXPECTED_THROUGHPUT,
 
         /* keep last */
         __NL80211_STA_INFO_AFTER_LAST,
@@ -3688,6 +3702,8 @@ enum nl80211_iface_limit_attrs {
  *      different channels may be used within this group.
  * @NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS: u32 attribute containing the bitmap
  *      of supported channel widths for radar detection.
+ * @NL80211_IFACE_COMB_RADAR_DETECT_REGIONS: u32 attribute containing the bitmap
+ *      of supported regulatory regions for radar detection.
  * @NUM_NL80211_IFACE_COMB: number of attributes
  * @MAX_NL80211_IFACE_COMB: highest attribute number
  *
@@ -3721,6 +3737,7 @@ enum nl80211_if_combination_attrs {
         NL80211_IFACE_COMB_STA_AP_BI_MATCH,
         NL80211_IFACE_COMB_NUM_CHANNELS,
         NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
+        NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
 
         /* keep last */
         NUM_NL80211_IFACE_COMB,
diff --git a/lib/crc7.c b/lib/crc7.c
index f1c3a144cec1..bf6255e23919 100644
--- a/lib/crc7.c
+++ b/lib/crc7.c
@@ -10,42 +10,47 @@
 #include <linux/crc7.h>
 
 
-/* Table for CRC-7 (polynomial x^7 + x^3 + 1) */
-const u8 crc7_syndrome_table[256] = {
-        0x00, 0x09, 0x12, 0x1b, 0x24, 0x2d, 0x36, 0x3f,
-        0x48, 0x41, 0x5a, 0x53, 0x6c, 0x65, 0x7e, 0x77,
-        0x19, 0x10, 0x0b, 0x02, 0x3d, 0x34, 0x2f, 0x26,
-        0x51, 0x58, 0x43, 0x4a, 0x75, 0x7c, 0x67, 0x6e,
-        0x32, 0x3b, 0x20, 0x29, 0x16, 0x1f, 0x04, 0x0d,
-        0x7a, 0x73, 0x68, 0x61, 0x5e, 0x57, 0x4c, 0x45,
-        0x2b, 0x22, 0x39, 0x30, 0x0f, 0x06, 0x1d, 0x14,
-        0x63, 0x6a, 0x71, 0x78, 0x47, 0x4e, 0x55, 0x5c,
-        0x64, 0x6d, 0x76, 0x7f, 0x40, 0x49, 0x52, 0x5b,
-        0x2c, 0x25, 0x3e, 0x37, 0x08, 0x01, 0x1a, 0x13,
-        0x7d, 0x74, 0x6f, 0x66, 0x59, 0x50, 0x4b, 0x42,
-        0x35, 0x3c, 0x27, 0x2e, 0x11, 0x18, 0x03, 0x0a,
-        0x56, 0x5f, 0x44, 0x4d, 0x72, 0x7b, 0x60, 0x69,
-        0x1e, 0x17, 0x0c, 0x05, 0x3a, 0x33, 0x28, 0x21,
-        0x4f, 0x46, 0x5d, 0x54, 0x6b, 0x62, 0x79, 0x70,
-        0x07, 0x0e, 0x15, 0x1c, 0x23, 0x2a, 0x31, 0x38,
-        0x41, 0x48, 0x53, 0x5a, 0x65, 0x6c, 0x77, 0x7e,
-        0x09, 0x00, 0x1b, 0x12, 0x2d, 0x24, 0x3f, 0x36,
-        0x58, 0x51, 0x4a, 0x43, 0x7c, 0x75, 0x6e, 0x67,
-        0x10, 0x19, 0x02, 0x0b, 0x34, 0x3d, 0x26, 0x2f,
-        0x73, 0x7a, 0x61, 0x68, 0x57, 0x5e, 0x45, 0x4c,
-        0x3b, 0x32, 0x29, 0x20, 0x1f, 0x16, 0x0d, 0x04,
-        0x6a, 0x63, 0x78, 0x71, 0x4e, 0x47, 0x5c, 0x55,
-        0x22, 0x2b, 0x30, 0x39, 0x06, 0x0f, 0x14, 0x1d,
-        0x25, 0x2c, 0x37, 0x3e, 0x01, 0x08, 0x13, 0x1a,
-        0x6d, 0x64, 0x7f, 0x76, 0x49, 0x40, 0x5b, 0x52,
-        0x3c, 0x35, 0x2e, 0x27, 0x18, 0x11, 0x0a, 0x03,
-        0x74, 0x7d, 0x66, 0x6f, 0x50, 0x59, 0x42, 0x4b,
-        0x17, 0x1e, 0x05, 0x0c, 0x33, 0x3a, 0x21, 0x28,
-        0x5f, 0x56, 0x4d, 0x44, 0x7b, 0x72, 0x69, 0x60,
-        0x0e, 0x07, 0x1c, 0x15, 0x2a, 0x23, 0x38, 0x31,
-        0x46, 0x4f, 0x54, 0x5d, 0x62, 0x6b, 0x70, 0x79
+/*
+ * Table for CRC-7 (polynomial x^7 + x^3 + 1).
+ * This is a big-endian CRC (msbit is highest power of x),
+ * aligned so the msbit of the byte is the x^6 coefficient
+ * and the lsbit is not used.
+ */
+const u8 crc7_be_syndrome_table[256] = {
+        0x00, 0x12, 0x24, 0x36, 0x48, 0x5a, 0x6c, 0x7e,
+        0x90, 0x82, 0xb4, 0xa6, 0xd8, 0xca, 0xfc, 0xee,
+        0x32, 0x20, 0x16, 0x04, 0x7a, 0x68, 0x5e, 0x4c,
+        0xa2, 0xb0, 0x86, 0x94, 0xea, 0xf8, 0xce, 0xdc,
+        0x64, 0x76, 0x40, 0x52, 0x2c, 0x3e, 0x08, 0x1a,
+        0xf4, 0xe6, 0xd0, 0xc2, 0xbc, 0xae, 0x98, 0x8a,
+        0x56, 0x44, 0x72, 0x60, 0x1e, 0x0c, 0x3a, 0x28,
+        0xc6, 0xd4, 0xe2, 0xf0, 0x8e, 0x9c, 0xaa, 0xb8,
+        0xc8, 0xda, 0xec, 0xfe, 0x80, 0x92, 0xa4, 0xb6,
+        0x58, 0x4a, 0x7c, 0x6e, 0x10, 0x02, 0x34, 0x26,
+        0xfa, 0xe8, 0xde, 0xcc, 0xb2, 0xa0, 0x96, 0x84,
+        0x6a, 0x78, 0x4e, 0x5c, 0x22, 0x30, 0x06, 0x14,
+        0xac, 0xbe, 0x88, 0x9a, 0xe4, 0xf6, 0xc0, 0xd2,
+        0x3c, 0x2e, 0x18, 0x0a, 0x74, 0x66, 0x50, 0x42,
+        0x9e, 0x8c, 0xba, 0xa8, 0xd6, 0xc4, 0xf2, 0xe0,
+        0x0e, 0x1c, 0x2a, 0x38, 0x46, 0x54, 0x62, 0x70,
+        0x82, 0x90, 0xa6, 0xb4, 0xca, 0xd8, 0xee, 0xfc,
+        0x12, 0x00, 0x36, 0x24, 0x5a, 0x48, 0x7e, 0x6c,
+        0xb0, 0xa2, 0x94, 0x86, 0xf8, 0xea, 0xdc, 0xce,
+        0x20, 0x32, 0x04, 0x16, 0x68, 0x7a, 0x4c, 0x5e,
+        0xe6, 0xf4, 0xc2, 0xd0, 0xae, 0xbc, 0x8a, 0x98,
+        0x76, 0x64, 0x52, 0x40, 0x3e, 0x2c, 0x1a, 0x08,
+        0xd4, 0xc6, 0xf0, 0xe2, 0x9c, 0x8e, 0xb8, 0xaa,
+        0x44, 0x56, 0x60, 0x72, 0x0c, 0x1e, 0x28, 0x3a,
+        0x4a, 0x58, 0x6e, 0x7c, 0x02, 0x10, 0x26, 0x34,
+        0xda, 0xc8, 0xfe, 0xec, 0x92, 0x80, 0xb6, 0xa4,
+        0x78, 0x6a, 0x5c, 0x4e, 0x30, 0x22, 0x14, 0x06,
+        0xe8, 0xfa, 0xcc, 0xde, 0xa0, 0xb2, 0x84, 0x96,
+        0x2e, 0x3c, 0x0a, 0x18, 0x66, 0x74, 0x42, 0x50,
+        0xbe, 0xac, 0x9a, 0x88, 0xf6, 0xe4, 0xd2, 0xc0,
+        0x1c, 0x0e, 0x38, 0x2a, 0x54, 0x46, 0x70, 0x62,
+        0x8c, 0x9e, 0xa8, 0xba, 0xc4, 0xd6, 0xe0, 0xf2
 };
-EXPORT_SYMBOL(crc7_syndrome_table);
+EXPORT_SYMBOL(crc7_be_syndrome_table);
 
 /**
  * crc7 - update the CRC7 for the data buffer
@@ -55,14 +60,17 @@ EXPORT_SYMBOL(crc7_syndrome_table);
  * Context: any
  *
  * Returns the updated CRC7 value.
+ * The CRC7 is left-aligned in the byte (the lsbit is always 0), as that
+ * makes the computation easier, and all callers want it in that form.
+ *
  */
-u8 crc7(u8 crc, const u8 *buffer, size_t len)
+u8 crc7_be(u8 crc, const u8 *buffer, size_t len)
 {
         while (len--)
-                crc = crc7_byte(crc, *buffer++);
+                crc = crc7_be_byte(crc, *buffer++);
         return crc;
 }
-EXPORT_SYMBOL(crc7);
+EXPORT_SYMBOL(crc7_be);
 
 MODULE_DESCRIPTION("CRC7 calculations");
 MODULE_LICENSE("GPL");
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index a1e5bb7d06e8..dc4d301d3a72 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -7519,9 +7519,9 @@ int __init l2cap_init(void)
         l2cap_debugfs = debugfs_create_file("l2cap", 0444, bt_debugfs,
                                             NULL, &l2cap_debugfs_fops);
 
-        debugfs_create_u16("l2cap_le_max_credits", 0466, bt_debugfs,
+        debugfs_create_u16("l2cap_le_max_credits", 0644, bt_debugfs,
                            &le_max_credits);
-        debugfs_create_u16("l2cap_le_default_mps", 0466, bt_debugfs,
+        debugfs_create_u16("l2cap_le_default_mps", 0644, bt_debugfs,
                            &le_default_mps);
 
         bt_6lowpan_init();
diff --git a/net/mac80211/Makefile b/net/mac80211/Makefile
index 9d7d840aac6d..1e46ffa69167 100644
--- a/net/mac80211/Makefile
+++ b/net/mac80211/Makefile
@@ -25,7 +25,8 @@ mac80211-y := \
         wme.o \
         event.o \
         chan.o \
-        trace.o mlme.o
+        trace.o mlme.o \
+        tdls.o
 
 mac80211-$(CONFIG_MAC80211_LEDS) += led.o
 mac80211-$(CONFIG_MAC80211_DEBUGFS) += \
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 7b8d3cf89574..d7513a503be1 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -472,8 +472,10 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
         struct ieee80211_local *local = sdata->local;
+        struct rate_control_ref *ref = local->rate_ctrl;
         struct timespec uptime;
         u64 packets = 0;
+        u32 thr = 0;
         int i, ac;
 
         sinfo->generation = sdata->local->sta_generation;
@@ -587,6 +589,17 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
         if (test_sta_flag(sta, WLAN_STA_TDLS_PEER))
                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
+
+        /* check if the driver has a SW RC implementation */
+        if (ref && ref->ops->get_expected_throughput)
+                thr = ref->ops->get_expected_throughput(sta->rate_ctrl_priv);
+        else
+                thr = drv_get_expected_throughput(local, &sta->sta);
+
+        if (thr != 0) {
+                sinfo->filled |= STATION_INFO_EXPECTED_THROUGHPUT;
+                sinfo->expected_throughput = thr;
+        }
 }
 
 static const char ieee80211_gstrings_sta_stats[][ETH_GSTRING_LEN] = {
@@ -777,7 +790,7 @@ static void ieee80211_get_et_strings(struct wiphy *wiphy,
 }
 
 static int ieee80211_dump_station(struct wiphy *wiphy, struct net_device *dev,
-                                 int idx, u8 *mac, struct station_info *sinfo)
+                                  int idx, u8 *mac, struct station_info *sinfo)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
@@ -807,7 +820,7 @@ static int ieee80211_dump_survey(struct wiphy *wiphy, struct net_device *dev,
 }
 
 static int ieee80211_get_station(struct wiphy *wiphy, struct net_device *dev,
-                                 u8 *mac, struct station_info *sinfo)
+                                 const u8 *mac, struct station_info *sinfo)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
@@ -1084,6 +1097,31 @@ static int ieee80211_change_beacon(struct wiphy *wiphy, struct net_device *dev,
         return 0;
 }
 
+bool ieee80211_csa_needs_block_tx(struct ieee80211_local *local)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        lockdep_assert_held(&local->mtx);
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                if (!ieee80211_sdata_running(sdata))
+                        continue;
+
+                if (!sdata->vif.csa_active)
+                        continue;
+
+                if (!sdata->csa_block_tx)
+                        continue;
+
+                rcu_read_unlock();
+                return true;
+        }
+        rcu_read_unlock();
+
+        return false;
+}
+
 static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
@@ -1101,7 +1139,14 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
         old_probe_resp = sdata_dereference(sdata->u.ap.probe_resp, sdata);
 
         /* abort any running channel switch */
+        mutex_lock(&local->mtx);
         sdata->vif.csa_active = false;
+        if (!ieee80211_csa_needs_block_tx(local))
+                ieee80211_wake_queues_by_reason(&local->hw,
+                                        IEEE80211_MAX_QUEUE_MAP,
+                                        IEEE80211_QUEUE_STOP_REASON_CSA);
+        mutex_unlock(&local->mtx);
+
         kfree(sdata->u.ap.next_beacon);
         sdata->u.ap.next_beacon = NULL;
 
@@ -1425,7 +1470,8 @@ static int sta_apply_parameters(struct ieee80211_local *local,
 }
 
 static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
-                                 u8 *mac, struct station_parameters *params)
+                                 const u8 *mac,
+                                 struct station_parameters *params)
 {
         struct ieee80211_local *local = wiphy_priv(wiphy);
         struct sta_info *sta;
@@ -1459,6 +1505,8 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
         if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))) {
                 sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
                 sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
+        } else {
+                sta->sta.tdls = true;
         }
 
         err = sta_apply_parameters(local, sta, params);
@@ -1492,7 +1540,7 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
 }
 
 static int ieee80211_del_station(struct wiphy *wiphy, struct net_device *dev,
-                                 u8 *mac)
+                                 const u8 *mac)
 {
         struct ieee80211_sub_if_data *sdata;
 
@@ -1506,7 +1554,7 @@ static int ieee80211_del_station(struct wiphy *wiphy, struct net_device *dev,
 }
 
 static int ieee80211_change_station(struct wiphy *wiphy,
-                                    struct net_device *dev, u8 *mac,
+                                    struct net_device *dev, const u8 *mac,
                                     struct station_parameters *params)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
@@ -1631,7 +1679,7 @@ out_err:
 
 #ifdef CONFIG_MAC80211_MESH
 static int ieee80211_add_mpath(struct wiphy *wiphy, struct net_device *dev,
-                                 u8 *dst, u8 *next_hop)
+                               const u8 *dst, const u8 *next_hop)
 {
         struct ieee80211_sub_if_data *sdata;
         struct mesh_path *mpath;
@@ -1659,7 +1707,7 @@ static int ieee80211_add_mpath(struct wiphy *wiphy, struct net_device *dev,
 }
 
 static int ieee80211_del_mpath(struct wiphy *wiphy, struct net_device *dev,
-                               u8 *dst)
+                               const u8 *dst)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
@@ -1670,9 +1718,8 @@ static int ieee80211_del_mpath(struct wiphy *wiphy, struct net_device *dev,
         return 0;
 }
 
-static int ieee80211_change_mpath(struct wiphy *wiphy,
-                                    struct net_device *dev,
-                                    u8 *dst, u8 *next_hop)
+static int ieee80211_change_mpath(struct wiphy *wiphy, struct net_device *dev,
+                                  const u8 *dst, const u8 *next_hop)
 {
         struct ieee80211_sub_if_data *sdata;
         struct mesh_path *mpath;
@@ -1764,8 +1811,8 @@ static int ieee80211_get_mpath(struct wiphy *wiphy, struct net_device *dev,
 }
 
 static int ieee80211_dump_mpath(struct wiphy *wiphy, struct net_device *dev,
-                                 int idx, u8 *dst, u8 *next_hop,
-                                 struct mpath_info *pinfo)
+                                int idx, u8 *dst, u8 *next_hop,
+                                struct mpath_info *pinfo)
 {
         struct ieee80211_sub_if_data *sdata;
         struct mesh_path *mpath;
@@ -3019,26 +3066,11 @@ void ieee80211_csa_finish(struct ieee80211_vif *vif)
 }
 EXPORT_SYMBOL(ieee80211_csa_finish);
 
-static void ieee80211_csa_finalize(struct ieee80211_sub_if_data *sdata)
+static int ieee80211_set_after_csa_beacon(struct ieee80211_sub_if_data *sdata,
+                                          u32 *changed)
 {
-        struct ieee80211_local *local = sdata->local;
-        int err, changed = 0;
-
-        sdata_assert_lock(sdata);
-
-        mutex_lock(&local->mtx);
-        sdata->radar_required = sdata->csa_radar_required;
-        err = ieee80211_vif_change_channel(sdata, &changed);
-        mutex_unlock(&local->mtx);
-        if (WARN_ON(err < 0))
-                return;
-
-        if (!local->use_chanctx) {
-                local->_oper_chandef = sdata->csa_chandef;
-                ieee80211_hw_config(local, 0);
-        }
+        int err;
 
-        sdata->vif.csa_active = false;
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_AP:
                 err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon);
@@ -3046,35 +3078,74 @@ static void ieee80211_csa_finalize(struct ieee80211_sub_if_data *sdata)
                 sdata->u.ap.next_beacon = NULL;
 
                 if (err < 0)
-                        return;
-                changed |= err;
+                        return err;
+                *changed |= err;
                 break;
         case NL80211_IFTYPE_ADHOC:
                 err = ieee80211_ibss_finish_csa(sdata);
                 if (err < 0)
-                        return;
-                changed |= err;
+                        return err;
+                *changed |= err;
                 break;
 #ifdef CONFIG_MAC80211_MESH
         case NL80211_IFTYPE_MESH_POINT:
                 err = ieee80211_mesh_finish_csa(sdata);
                 if (err < 0)
-                        return;
-                changed |= err;
+                        return err;
+                *changed |= err;
                 break;
 #endif
         default:
                 WARN_ON(1);
-                return;
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static int __ieee80211_csa_finalize(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        u32 changed = 0;
+        int err;
+
+        sdata_assert_lock(sdata);
+        lockdep_assert_held(&local->mtx);
+
+        sdata->radar_required = sdata->csa_radar_required;
+        err = ieee80211_vif_change_channel(sdata, &changed);
+        if (err < 0)
+                return err;
+
+        if (!local->use_chanctx) {
+                local->_oper_chandef = sdata->csa_chandef;
+                ieee80211_hw_config(local, 0);
         }
 
+        sdata->vif.csa_active = false;
+
+        err = ieee80211_set_after_csa_beacon(sdata, &changed);
+        if (err)
+                return err;
+
         ieee80211_bss_info_change_notify(sdata, changed);
+        cfg80211_ch_switch_notify(sdata->dev, &sdata->csa_chandef);
 
-        ieee80211_wake_queues_by_reason(&sdata->local->hw,
+        if (!ieee80211_csa_needs_block_tx(local))
+                ieee80211_wake_queues_by_reason(&local->hw,
                                         IEEE80211_MAX_QUEUE_MAP,
                                         IEEE80211_QUEUE_STOP_REASON_CSA);
 
-        cfg80211_ch_switch_notify(sdata->dev, &sdata->csa_chandef);
+        return 0;
+}
+
+static void ieee80211_csa_finalize(struct ieee80211_sub_if_data *sdata)
+{
+        if (__ieee80211_csa_finalize(sdata)) {
+                sdata_info(sdata, "failed to finalize CSA, disconnecting\n");
+                cfg80211_stop_iface(sdata->local->hw.wiphy, &sdata->wdev,
+                                    GFP_KERNEL);
+        }
 }
 
 void ieee80211_csa_finalize_work(struct work_struct *work)
@@ -3082,8 +3153,11 @@ void ieee80211_csa_finalize_work(struct work_struct *work)
         struct ieee80211_sub_if_data *sdata =
                 container_of(work, struct ieee80211_sub_if_data,
                              csa_finalize_work);
+        struct ieee80211_local *local = sdata->local;
 
         sdata_lock(sdata);
+        mutex_lock(&local->mtx);
+
         /* AP might have been stopped while waiting for the lock. */
         if (!sdata->vif.csa_active)
                 goto unlock;
@@ -3094,6 +3168,7 @@ void ieee80211_csa_finalize_work(struct work_struct *work)
         ieee80211_csa_finalize(sdata);
 
 unlock:
+        mutex_unlock(&local->mtx);
         sdata_unlock(sdata);
 }
 
@@ -3129,9 +3204,25 @@ static int ieee80211_set_csa_beacon(struct ieee80211_sub_if_data *sdata,
                 if (params->count <= 1)
                         break;
 
-                sdata->csa_counter_offset_beacon =
-                        params->counter_offset_beacon;
-                sdata->csa_counter_offset_presp = params->counter_offset_presp;
+                if ((params->n_counter_offsets_beacon >
+                     IEEE80211_MAX_CSA_COUNTERS_NUM) ||
+                    (params->n_counter_offsets_presp >
+                     IEEE80211_MAX_CSA_COUNTERS_NUM))
+                        return -EINVAL;
+
+                /* make sure we don't have garbage in other counters */
+                memset(sdata->csa_counter_offset_beacon, 0,
+                       sizeof(sdata->csa_counter_offset_beacon));
+                memset(sdata->csa_counter_offset_presp, 0,
+                       sizeof(sdata->csa_counter_offset_presp));
+
+                memcpy(sdata->csa_counter_offset_beacon,
+                       params->counter_offsets_beacon,
+                       params->n_counter_offsets_beacon * sizeof(u16));
+                memcpy(sdata->csa_counter_offset_presp,
+                       params->counter_offsets_presp,
+                       params->n_counter_offsets_presp * sizeof(u16));
+
                 err = ieee80211_assign_beacon(sdata, &params->beacon_csa);
                 if (err < 0) {
                         kfree(sdata->u.ap.next_beacon);
@@ -3220,8 +3311,9 @@ static int ieee80211_set_csa_beacon(struct ieee80211_sub_if_data *sdata,
         return 0;
 }
 
-int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
-                             struct cfg80211_csa_settings *params)
+static int
+__ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
+                           struct cfg80211_csa_settings *params)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
@@ -3230,6 +3322,7 @@ int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
         int err, num_chanctx, changed = 0;
 
         sdata_assert_lock(sdata);
+        lockdep_assert_held(&local->mtx);
 
         if (!list_empty(&local->roc_list) || local->scanning)
                 return -EBUSY;
@@ -3272,15 +3365,16 @@ int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
                 return err;
 
         sdata->csa_radar_required = params->radar_required;
-
-        if (params->block_tx)
-                ieee80211_stop_queues_by_reason(&local->hw,
-                                IEEE80211_MAX_QUEUE_MAP,
-                                IEEE80211_QUEUE_STOP_REASON_CSA);
-
         sdata->csa_chandef = params->chandef;
+        sdata->csa_block_tx = params->block_tx;
+        sdata->csa_current_counter = params->count;
         sdata->vif.csa_active = true;
 
+        if (sdata->csa_block_tx)
+                ieee80211_stop_queues_by_reason(&local->hw,
+                                        IEEE80211_MAX_QUEUE_MAP,
+                                        IEEE80211_QUEUE_STOP_REASON_CSA);
+
         if (changed) {
                 ieee80211_bss_info_change_notify(sdata, changed);
                 drv_channel_switch_beacon(sdata, &params->chandef);
@@ -3292,6 +3386,20 @@ int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
         return 0;
 }
 
+int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
+                             struct cfg80211_csa_settings *params)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
+        int err;
+
+        mutex_lock(&local->mtx);
+        err = __ieee80211_channel_switch(wiphy, dev, params);
+        mutex_unlock(&local->mtx);
+
+        return err;
+}
+
 static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
                              struct cfg80211_mgmt_tx_params *params,
                              u64 *cookie)
@@ -3304,6 +3412,7 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
         bool need_offchan = false;
         u32 flags;
         int ret;
+        u8 *data;
 
         if (params->dont_wait_for_ack)
                 flags = IEEE80211_TX_CTL_NO_ACK;
@@ -3397,7 +3506,20 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
         }
         skb_reserve(skb, local->hw.extra_tx_headroom);
 
-        memcpy(skb_put(skb, params->len), params->buf, params->len);
+        data = skb_put(skb, params->len);
+        memcpy(data, params->buf, params->len);
+
+        /* Update CSA counters */
+        if (sdata->vif.csa_active &&
+            (sdata->vif.type == NL80211_IFTYPE_AP ||
+             sdata->vif.type == NL80211_IFTYPE_ADHOC) &&
+            params->n_csa_offsets) {
+                int i;
+                u8 c = sdata->csa_current_counter;
+
+                for (i = 0; i < params->n_csa_offsets; i++)
+                        data[params->csa_offsets[i]] = c;
+        }
 
         IEEE80211_SKB_CB(skb)->flags = flags;
 
@@ -3506,320 +3628,6 @@ static int ieee80211_set_rekey_data(struct wiphy *wiphy,
         return 0;
 }
 
-static void ieee80211_tdls_add_ext_capab(struct sk_buff *skb)
-{
-        u8 *pos = (void *)skb_put(skb, 7);
-
-        *pos++ = WLAN_EID_EXT_CAPABILITY;
-        *pos++ = 5; /* len */
-        *pos++ = 0x0;
-        *pos++ = 0x0;
-        *pos++ = 0x0;
-        *pos++ = 0x0;
-        *pos++ = WLAN_EXT_CAPA5_TDLS_ENABLED;
-}
-
-static u16 ieee80211_get_tdls_sta_capab(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_local *local = sdata->local;
-        u16 capab;
-
-        capab = 0;
-        if (ieee80211_get_sdata_band(sdata) != IEEE80211_BAND_2GHZ)
-                return capab;
-
-        if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
-                capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
-        if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
-                capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
-
-        return capab;
-}
-
-static void ieee80211_tdls_add_link_ie(struct sk_buff *skb, u8 *src_addr,
-                                       u8 *peer, u8 *bssid)
-{
-        struct ieee80211_tdls_lnkie *lnkid;
-
-        lnkid = (void *)skb_put(skb, sizeof(struct ieee80211_tdls_lnkie));
-
-        lnkid->ie_type = WLAN_EID_LINK_ID;
-        lnkid->ie_len = sizeof(struct ieee80211_tdls_lnkie) - 2;
-
-        memcpy(lnkid->bssid, bssid, ETH_ALEN);
-        memcpy(lnkid->init_sta, src_addr, ETH_ALEN);
-        memcpy(lnkid->resp_sta, peer, ETH_ALEN);
-}
-
-static int
-ieee80211_prep_tdls_encap_data(struct wiphy *wiphy, struct net_device *dev,
-                               u8 *peer, u8 action_code, u8 dialog_token,
-                               u16 status_code, struct sk_buff *skb)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
-        struct ieee80211_tdls_data *tf;
-
-        tf = (void *)skb_put(skb, offsetof(struct ieee80211_tdls_data, u));
-
-        memcpy(tf->da, peer, ETH_ALEN);
-        memcpy(tf->sa, sdata->vif.addr, ETH_ALEN);
-        tf->ether_type = cpu_to_be16(ETH_P_TDLS);
-        tf->payload_type = WLAN_TDLS_SNAP_RFTYPE;
-
-        switch (action_code) {
-        case WLAN_TDLS_SETUP_REQUEST:
-                tf->category = WLAN_CATEGORY_TDLS;
-                tf->action_code = WLAN_TDLS_SETUP_REQUEST;
-
-                skb_put(skb, sizeof(tf->u.setup_req));
-                tf->u.setup_req.dialog_token = dialog_token;
-                tf->u.setup_req.capability =
-                        cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
-
-                ieee80211_add_srates_ie(sdata, skb, false, band);
-                ieee80211_add_ext_srates_ie(sdata, skb, false, band);
-                ieee80211_tdls_add_ext_capab(skb);
-                break;
-        case WLAN_TDLS_SETUP_RESPONSE:
-                tf->category = WLAN_CATEGORY_TDLS;
-                tf->action_code = WLAN_TDLS_SETUP_RESPONSE;
-
-                skb_put(skb, sizeof(tf->u.setup_resp));
-                tf->u.setup_resp.status_code = cpu_to_le16(status_code);
-                tf->u.setup_resp.dialog_token = dialog_token;
-                tf->u.setup_resp.capability =
-                        cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
-
-                ieee80211_add_srates_ie(sdata, skb, false, band);
-                ieee80211_add_ext_srates_ie(sdata, skb, false, band);
-                ieee80211_tdls_add_ext_capab(skb);
-                break;
-        case WLAN_TDLS_SETUP_CONFIRM:
-                tf->category = WLAN_CATEGORY_TDLS;
-                tf->action_code = WLAN_TDLS_SETUP_CONFIRM;
-
-                skb_put(skb, sizeof(tf->u.setup_cfm));
-                tf->u.setup_cfm.status_code = cpu_to_le16(status_code);
-                tf->u.setup_cfm.dialog_token = dialog_token;
-                break;
-        case WLAN_TDLS_TEARDOWN:
-                tf->category = WLAN_CATEGORY_TDLS;
-                tf->action_code = WLAN_TDLS_TEARDOWN;
-
-                skb_put(skb, sizeof(tf->u.teardown));
-                tf->u.teardown.reason_code = cpu_to_le16(status_code);
-                break;
-        case WLAN_TDLS_DISCOVERY_REQUEST:
-                tf->category = WLAN_CATEGORY_TDLS;
-                tf->action_code = WLAN_TDLS_DISCOVERY_REQUEST;
-
-                skb_put(skb, sizeof(tf->u.discover_req));
-                tf->u.discover_req.dialog_token = dialog_token;
-                break;
-        default:
-                return -EINVAL;
-        }
-
-        return 0;
-}
-
-static int
-ieee80211_prep_tdls_direct(struct wiphy *wiphy, struct net_device *dev,
-                           u8 *peer, u8 action_code, u8 dialog_token,
-                           u16 status_code, struct sk_buff *skb)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
-        struct ieee80211_mgmt *mgmt;
-
-        mgmt = (void *)skb_put(skb, 24);
-        memset(mgmt, 0, 24);
-        memcpy(mgmt->da, peer, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
-        memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
-
-        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-                                          IEEE80211_STYPE_ACTION);
-
-        switch (action_code) {
-        case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
-                skb_put(skb, 1 + sizeof(mgmt->u.action.u.tdls_discover_resp));
-                mgmt->u.action.category = WLAN_CATEGORY_PUBLIC;
-                mgmt->u.action.u.tdls_discover_resp.action_code =
-                        WLAN_PUB_ACTION_TDLS_DISCOVER_RES;
-                mgmt->u.action.u.tdls_discover_resp.dialog_token =
-                        dialog_token;
-                mgmt->u.action.u.tdls_discover_resp.capability =
-                        cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
-
-                ieee80211_add_srates_ie(sdata, skb, false, band);
-                ieee80211_add_ext_srates_ie(sdata, skb, false, band);
-                ieee80211_tdls_add_ext_capab(skb);
-                break;
-        default:
-                return -EINVAL;
-        }
-
-        return 0;
-}
-
-static int ieee80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
-                               u8 *peer, u8 action_code, u8 dialog_token,
-                               u16 status_code, u32 peer_capability,
-                               const u8 *extra_ies, size_t extra_ies_len)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_local *local = sdata->local;
-        struct sk_buff *skb = NULL;
-        bool send_direct;
-        int ret;
-
-        if (!(wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS))
-                return -ENOTSUPP;
-
-        /* make sure we are in managed mode, and associated */
-        if (sdata->vif.type != NL80211_IFTYPE_STATION ||
-            !sdata->u.mgd.associated)
-                return -EINVAL;
-
-        tdls_dbg(sdata, "TDLS mgmt action %d peer %pM\n",
-                 action_code, peer);
-
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom +
-                            max(sizeof(struct ieee80211_mgmt),
-                                sizeof(struct ieee80211_tdls_data)) +
-                            50 + /* supported rates */
-                            7 + /* ext capab */
-                            extra_ies_len +
-                            sizeof(struct ieee80211_tdls_lnkie));
-        if (!skb)
-                return -ENOMEM;
-
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-
-        switch (action_code) {
-        case WLAN_TDLS_SETUP_REQUEST:
-        case WLAN_TDLS_SETUP_RESPONSE:
-        case WLAN_TDLS_SETUP_CONFIRM:
-        case WLAN_TDLS_TEARDOWN:
-        case WLAN_TDLS_DISCOVERY_REQUEST:
-                ret = ieee80211_prep_tdls_encap_data(wiphy, dev, peer,
-                                                     action_code, dialog_token,
-                                                     status_code, skb);
-                send_direct = false;
-                break;
-        case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
-                ret = ieee80211_prep_tdls_direct(wiphy, dev, peer, action_code,
-                                                 dialog_token, status_code,
-                                                 skb);
-                send_direct = true;
-                break;
-        default:
-                ret = -ENOTSUPP;
-                break;
-        }
-
-        if (ret < 0)
-                goto fail;
-
-        if (extra_ies_len)
-                memcpy(skb_put(skb, extra_ies_len), extra_ies, extra_ies_len);
-
-        /* the TDLS link IE is always added last */
-        switch (action_code) {
-        case WLAN_TDLS_SETUP_REQUEST:
-        case WLAN_TDLS_SETUP_CONFIRM:
-        case WLAN_TDLS_TEARDOWN:
-        case WLAN_TDLS_DISCOVERY_REQUEST:
-                /* we are the initiator */
-                ieee80211_tdls_add_link_ie(skb, sdata->vif.addr, peer,
-                                           sdata->u.mgd.bssid);
-                break;
-        case WLAN_TDLS_SETUP_RESPONSE:
-        case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
-                /* we are the responder */
-                ieee80211_tdls_add_link_ie(skb, peer, sdata->vif.addr,
-                                           sdata->u.mgd.bssid);
-                break;
-        default:
-                ret = -ENOTSUPP;
-                goto fail;
-        }
-
-        if (send_direct) {
-                ieee80211_tx_skb(sdata, skb);
-                return 0;
-        }
-
-        /*
-         * According to 802.11z: Setup req/resp are sent in AC_BK, otherwise
-         * we should default to AC_VI.
-         */
-        switch (action_code) {
-        case WLAN_TDLS_SETUP_REQUEST:
-        case WLAN_TDLS_SETUP_RESPONSE:
-                skb_set_queue_mapping(skb, IEEE80211_AC_BK);
-                skb->priority = 2;
-                break;
-        default:
-                skb_set_queue_mapping(skb, IEEE80211_AC_VI);
-                skb->priority = 5;
-                break;
-        }
-
-        /* disable bottom halves when entering the Tx path */
-        local_bh_disable();
-        ret = ieee80211_subif_start_xmit(skb, dev);
-        local_bh_enable();
-
-        return ret;
-
-fail:
-        dev_kfree_skb(skb);
-        return ret;
-}
-
-static int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
-                               u8 *peer, enum nl80211_tdls_operation oper)
-{
-        struct sta_info *sta;
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        if (!(wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS))
-                return -ENOTSUPP;
-
-        if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                return -EINVAL;
-
-        tdls_dbg(sdata, "TDLS oper %d peer %pM\n", oper, peer);
-
-        switch (oper) {
-        case NL80211_TDLS_ENABLE_LINK:
-                rcu_read_lock();
-                sta = sta_info_get(sdata, peer);
-                if (!sta) {
-                        rcu_read_unlock();
-                        return -ENOLINK;
-                }
-
-                set_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH);
-                rcu_read_unlock();
-                break;
-        case NL80211_TDLS_DISABLE_LINK:
-                return sta_info_destroy_addr(sdata, peer);
-        case NL80211_TDLS_TEARDOWN:
-        case NL80211_TDLS_SETUP:
-        case NL80211_TDLS_DISCOVERY_REQ:
-                /* We don't support in-driver setup/teardown/discovery */
-                return -ENOTSUPP;
-        default:
-                return -ENOTSUPP;
-        }
-
-        return 0;
-}
-
 static int ieee80211_probe_client(struct wiphy *wiphy, struct net_device *dev,
                                   const u8 *peer, u64 *cookie)
 {
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 48e6d6f010cd..a310e33972de 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -855,7 +855,7 @@ static void
 __ieee80211_vif_copy_chanctx_to_vlans(struct ieee80211_sub_if_data *sdata,
                                       bool clear)
 {
-        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_local *local __maybe_unused = sdata->local;
         struct ieee80211_sub_if_data *vlan;
         struct ieee80211_chanctx_conf *conf;
 
@@ -871,7 +871,7 @@ __ieee80211_vif_copy_chanctx_to_vlans(struct ieee80211_sub_if_data *sdata,
          * to a channel context that has already been freed.
          */
         conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
-                                lockdep_is_held(&local->chanctx_mtx));
+                                         lockdep_is_held(&local->chanctx_mtx));
         WARN_ON(!conf);
 
         if (clear)
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 5331582a2c81..696ef78b1fb7 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -5,11 +5,11 @@
 #include "ieee80211_i.h"
 #include "trace.h"
 
-static inline void check_sdata_in_driver(struct ieee80211_sub_if_data *sdata)
+static inline bool check_sdata_in_driver(struct ieee80211_sub_if_data *sdata)
 {
-        WARN(!(sdata->flags & IEEE80211_SDATA_IN_DRIVER),
-             "%s:  Failed check-sdata-in-driver check, flags: 0x%x\n",
-             sdata->dev ? sdata->dev->name : sdata->name, sdata->flags);
+        return !WARN(!(sdata->flags & IEEE80211_SDATA_IN_DRIVER),
+                     "%s:  Failed check-sdata-in-driver check, flags: 0x%x\n",
+                     sdata->dev ? sdata->dev->name : sdata->name, sdata->flags);
 }
 
 static inline struct ieee80211_sub_if_data *
@@ -168,7 +168,8 @@ static inline int drv_change_interface(struct ieee80211_local *local,
 
         might_sleep();
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
 
         trace_drv_change_interface(local, sdata, type, p2p);
         ret = local->ops->change_interface(&local->hw, &sdata->vif, type, p2p);
@@ -181,7 +182,8 @@ static inline void drv_remove_interface(struct ieee80211_local *local,
 {
         might_sleep();
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         trace_drv_remove_interface(local, sdata);
         local->ops->remove_interface(&local->hw, &sdata->vif);
@@ -219,7 +221,8 @@ static inline void drv_bss_info_changed(struct ieee80211_local *local,
                          sdata->vif.type == NL80211_IFTYPE_MONITOR))
                 return;
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         trace_drv_bss_info_changed(local, sdata, info, changed);
         if (local->ops->bss_info_changed)
@@ -278,7 +281,8 @@ static inline int drv_set_key(struct ieee80211_local *local,
         might_sleep();
 
         sdata = get_bss_sdata(sdata);
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
 
         trace_drv_set_key(local, cmd, sdata, sta, key);
         ret = local->ops->set_key(&local->hw, cmd, &sdata->vif, sta, key);
@@ -298,7 +302,8 @@ static inline void drv_update_tkip_key(struct ieee80211_local *local,
                 ista = &sta->sta;
 
         sdata = get_bss_sdata(sdata);
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         trace_drv_update_tkip_key(local, sdata, conf, ista, iv32);
         if (local->ops->update_tkip_key)
@@ -315,7 +320,8 @@ static inline int drv_hw_scan(struct ieee80211_local *local,
 
         might_sleep();
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
 
         trace_drv_hw_scan(local, sdata);
         ret = local->ops->hw_scan(&local->hw, &sdata->vif, req);
@@ -328,7 +334,8 @@ static inline void drv_cancel_hw_scan(struct ieee80211_local *local,
 {
         might_sleep();
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         trace_drv_cancel_hw_scan(local, sdata);
         local->ops->cancel_hw_scan(&local->hw, &sdata->vif);
@@ -345,7 +352,8 @@ drv_sched_scan_start(struct ieee80211_local *local,
 
         might_sleep();
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
 
         trace_drv_sched_scan_start(local, sdata);
         ret = local->ops->sched_scan_start(&local->hw, &sdata->vif,
@@ -361,7 +369,8 @@ static inline int drv_sched_scan_stop(struct ieee80211_local *local,
 
         might_sleep();
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
 
         trace_drv_sched_scan_stop(local, sdata);
         ret = local->ops->sched_scan_stop(&local->hw, &sdata->vif);
@@ -462,7 +471,8 @@ static inline void drv_sta_notify(struct ieee80211_local *local,
                                   struct ieee80211_sta *sta)
 {
         sdata = get_bss_sdata(sdata);
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         trace_drv_sta_notify(local, sdata, cmd, sta);
         if (local->ops->sta_notify)
@@ -479,7 +489,8 @@ static inline int drv_sta_add(struct ieee80211_local *local,
         might_sleep();
 
         sdata = get_bss_sdata(sdata);
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
 
         trace_drv_sta_add(local, sdata, sta);
         if (local->ops->sta_add)
@@ -497,7 +508,8 @@ static inline void drv_sta_remove(struct ieee80211_local *local,
         might_sleep();
 
         sdata = get_bss_sdata(sdata);
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         trace_drv_sta_remove(local, sdata, sta);
         if (local->ops->sta_remove)
@@ -515,7 +527,8 @@ static inline void drv_sta_add_debugfs(struct ieee80211_local *local,
         might_sleep();
 
         sdata = get_bss_sdata(sdata);
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         if (local->ops->sta_add_debugfs)
                 local->ops->sta_add_debugfs(&local->hw, &sdata->vif,
@@ -545,7 +558,8 @@ static inline void drv_sta_pre_rcu_remove(struct ieee80211_local *local,
         might_sleep();
 
         sdata = get_bss_sdata(sdata);
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         trace_drv_sta_pre_rcu_remove(local, sdata, &sta->sta);
         if (local->ops->sta_pre_rcu_remove)
@@ -566,7 +580,8 @@ int drv_sta_state(struct ieee80211_local *local,
         might_sleep();
 
         sdata = get_bss_sdata(sdata);
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
 
         trace_drv_sta_state(local, sdata, &sta->sta, old_state, new_state);
         if (local->ops->sta_state) {
@@ -590,7 +605,8 @@ static inline void drv_sta_rc_update(struct ieee80211_local *local,
                                      struct ieee80211_sta *sta, u32 changed)
 {
         sdata = get_bss_sdata(sdata);
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         WARN_ON(changed & IEEE80211_RC_SUPP_RATES_CHANGED &&
                 (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
@@ -612,7 +628,8 @@ static inline int drv_conf_tx(struct ieee80211_local *local,
 
         might_sleep();
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
 
         trace_drv_conf_tx(local, sdata, ac, params);
         if (local->ops->conf_tx)
@@ -629,7 +646,8 @@ static inline u64 drv_get_tsf(struct ieee80211_local *local,
 
         might_sleep();
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return ret;
 
         trace_drv_get_tsf(local, sdata);
         if (local->ops->get_tsf)
@@ -644,7 +662,8 @@ static inline void drv_set_tsf(struct ieee80211_local *local,
 {
         might_sleep();
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         trace_drv_set_tsf(local, sdata, tsf);
         if (local->ops->set_tsf)
@@ -657,7 +676,8 @@ static inline void drv_reset_tsf(struct ieee80211_local *local,
 {
         might_sleep();
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         trace_drv_reset_tsf(local, sdata);
         if (local->ops->reset_tsf)
@@ -689,7 +709,8 @@ static inline int drv_ampdu_action(struct ieee80211_local *local,
         might_sleep();
 
         sdata = get_bss_sdata(sdata);
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
 
         trace_drv_ampdu_action(local, sdata, action, sta, tid, ssn, buf_size);
 
@@ -733,8 +754,8 @@ static inline void drv_flush(struct ieee80211_local *local,
 
         might_sleep();
 
-        if (sdata)
-                check_sdata_in_driver(sdata);
+        if (sdata && !check_sdata_in_driver(sdata))
+                return;
 
         trace_drv_flush(local, queues, drop);
         if (local->ops->flush)
@@ -854,7 +875,8 @@ static inline int drv_set_bitrate_mask(struct ieee80211_local *local,
 
         might_sleep();
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
 
         trace_drv_set_bitrate_mask(local, sdata, mask);
         if (local->ops->set_bitrate_mask)
@@ -869,7 +891,8 @@ static inline void drv_set_rekey_data(struct ieee80211_local *local,
                                       struct ieee80211_sub_if_data *sdata,
                                       struct cfg80211_gtk_rekey_data *data)
 {
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         trace_drv_set_rekey_data(local, sdata, data);
         if (local->ops->set_rekey_data)
@@ -937,7 +960,8 @@ static inline void drv_mgd_prepare_tx(struct ieee80211_local *local,
 {
         might_sleep();
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
         WARN_ON_ONCE(sdata->vif.type != NL80211_IFTYPE_STATION);
 
         trace_drv_mgd_prepare_tx(local, sdata);
@@ -964,6 +988,9 @@ static inline int drv_add_chanctx(struct ieee80211_local *local,
 static inline void drv_remove_chanctx(struct ieee80211_local *local,
                                       struct ieee80211_chanctx *ctx)
 {
+        if (WARN_ON(!ctx->driver_present))
+                return;
+
         trace_drv_remove_chanctx(local, ctx);
         if (local->ops->remove_chanctx)
                 local->ops->remove_chanctx(&local->hw, &ctx->conf);
@@ -989,7 +1016,8 @@ static inline int drv_assign_vif_chanctx(struct ieee80211_local *local,
 {
         int ret = 0;
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
 
         trace_drv_assign_vif_chanctx(local, sdata, ctx);
         if (local->ops->assign_vif_chanctx) {
@@ -1007,7 +1035,8 @@ static inline void drv_unassign_vif_chanctx(struct ieee80211_local *local,
                                             struct ieee80211_sub_if_data *sdata,
                                             struct ieee80211_chanctx *ctx)
 {
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         trace_drv_unassign_vif_chanctx(local, sdata, ctx);
         if (local->ops->unassign_vif_chanctx) {
@@ -1024,7 +1053,8 @@ static inline int drv_start_ap(struct ieee80211_local *local,
 {
         int ret = 0;
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
 
         trace_drv_start_ap(local, sdata, &sdata->vif.bss_conf);
         if (local->ops->start_ap)
@@ -1036,7 +1066,8 @@ static inline int drv_start_ap(struct ieee80211_local *local,
 static inline void drv_stop_ap(struct ieee80211_local *local,
                                struct ieee80211_sub_if_data *sdata)
 {
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         trace_drv_stop_ap(local, sdata);
         if (local->ops->stop_ap)
@@ -1059,7 +1090,8 @@ drv_set_default_unicast_key(struct ieee80211_local *local,
                             struct ieee80211_sub_if_data *sdata,
                             int key_idx)
 {
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         WARN_ON_ONCE(key_idx < -1 || key_idx > 3);
 
@@ -1101,7 +1133,8 @@ static inline int drv_join_ibss(struct ieee80211_local *local,
         int ret = 0;
 
         might_sleep();
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
 
         trace_drv_join_ibss(local, sdata, &sdata->vif.bss_conf);
         if (local->ops->join_ibss)
@@ -1114,7 +1147,8 @@ static inline void drv_leave_ibss(struct ieee80211_local *local,
                                   struct ieee80211_sub_if_data *sdata)
 {
         might_sleep();
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         trace_drv_leave_ibss(local, sdata);
         if (local->ops->leave_ibss)
@@ -1122,4 +1156,17 @@ static inline void drv_leave_ibss(struct ieee80211_local *local,
         trace_drv_return_void(local);
 }
 
+static inline u32 drv_get_expected_throughput(struct ieee80211_local *local,
+                                              struct ieee80211_sta *sta)
+{
+        u32 ret = 0;
+
+        trace_drv_get_expected_throughput(sta);
+        if (local->ops->get_expected_throughput)
+                ret = local->ops->get_expected_throughput(sta);
+        trace_drv_return_u32(local, ret);
+
+        return ret;
+}
+
 #endif /* __MAC80211_DRIVER_OPS */
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index ff4d4155a84d..1bbac94da58d 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -143,7 +143,7 @@ ieee80211_ibss_build_presp(struct ieee80211_sub_if_data *sdata,
                 *pos++ = csa_settings->block_tx ? 1 : 0;
                 *pos++ = ieee80211_frequency_to_channel(
                                 csa_settings->chandef.chan->center_freq);
-                sdata->csa_counter_offset_beacon = (pos - presp->head);
+                sdata->csa_counter_offset_beacon[0] = (pos - presp->head);
                 *pos++ = csa_settings->count;
         }
 
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 487c2ef0982a..ac9836e0aab3 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -754,9 +754,10 @@ struct ieee80211_sub_if_data {
         struct mac80211_qos_map __rcu *qos_map;
 
         struct work_struct csa_finalize_work;
-        int csa_counter_offset_beacon;
-        int csa_counter_offset_presp;
+        u16 csa_counter_offset_beacon[IEEE80211_MAX_CSA_COUNTERS_NUM];
+        u16 csa_counter_offset_presp[IEEE80211_MAX_CSA_COUNTERS_NUM];
         bool csa_radar_required;
+        bool csa_block_tx; /* write-protected by sdata_lock and local->mtx */
         struct cfg80211_chan_def csa_chandef;
 
         struct list_head assigned_chanctx_list; /* protected by chanctx_mtx */
@@ -766,6 +767,7 @@ struct ieee80211_sub_if_data {
         struct ieee80211_chanctx *reserved_chanctx;
         struct cfg80211_chan_def reserved_chandef;
         bool reserved_radar_required;
+        u8 csa_current_counter;
 
         /* used to reconfigure hardware SM PS */
         struct work_struct recalc_smps;
@@ -1459,6 +1461,7 @@ __ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
 int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
                                        struct cfg80211_sched_scan_request *req);
 int ieee80211_request_sched_scan_stop(struct ieee80211_sub_if_data *sdata);
+void ieee80211_sched_scan_end(struct ieee80211_local *local);
 void ieee80211_sched_scan_stopped_work(struct work_struct *work);
 
 /* off-channel helpers */
@@ -1473,6 +1476,7 @@ void ieee80211_sw_roc_work(struct work_struct *work);
 void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc);
 
 /* channel switch handling */
+bool ieee80211_csa_needs_block_tx(struct ieee80211_local *local);
 void ieee80211_csa_finalize_work(struct work_struct *work);
 int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
                              struct cfg80211_csa_settings *params);
@@ -1834,6 +1838,15 @@ int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
                                  u8 radar_detect);
 int ieee80211_max_num_channels(struct ieee80211_local *local);
 
+/* TDLS */
+int ieee80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+                        const u8 *peer, u8 action_code, u8 dialog_token,
+                        u16 status_code, u32 peer_capability,
+                        const u8 *extra_ies, size_t extra_ies_len);
+int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
+                        const u8 *peer, enum nl80211_tdls_operation oper);
+
+
 #ifdef CONFIG_MAC80211_NOINLINE
 #define debug_noinline noinline
 #else
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 7fff3dcaac43..79fc98815da8 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -838,8 +838,15 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
 
         cancel_work_sync(&sdata->recalc_smps);
         sdata_lock(sdata);
+        mutex_lock(&local->mtx);
         sdata->vif.csa_active = false;
+        if (!ieee80211_csa_needs_block_tx(local))
+                ieee80211_wake_queues_by_reason(&local->hw,
+                                        IEEE80211_MAX_QUEUE_MAP,
+                                        IEEE80211_QUEUE_STOP_REASON_CSA);
+        mutex_unlock(&local->mtx);
         sdata_unlock(sdata);
+
         cancel_work_sync(&sdata->csa_finalize_work);
 
         cancel_delayed_work_sync(&sdata->dfs_cac_timer_work);
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 6ff65a1ebaa9..16d97f044a20 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -325,7 +325,8 @@ ieee80211_key_alloc(u32 cipher, int idx, size_t key_len,
         struct ieee80211_key *key;
         int i, j, err;
 
-        BUG_ON(idx < 0 || idx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS);
+        if (WARN_ON(idx < 0 || idx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS))
+                return ERR_PTR(-EINVAL);
 
         key = kzalloc(sizeof(struct ieee80211_key) + key_len, GFP_KERNEL);
         if (!key)
@@ -481,8 +482,8 @@ int ieee80211_key_link(struct ieee80211_key *key,
         int idx, ret;
         bool pairwise;
 
-        BUG_ON(!sdata);
-        BUG_ON(!key);
+        if (WARN_ON(!sdata || !key))
+                return -EINVAL;
 
         pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE;
         idx = key->conf.keyidx;
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 27b9364cdf17..d17c26d6e369 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -956,6 +956,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         if (local->hw.wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS)
                 local->hw.wiphy->flags |= WIPHY_FLAG_TDLS_EXTERNAL_SETUP;
 
+        local->hw.wiphy->max_num_csa_counters = IEEE80211_MAX_CSA_COUNTERS_NUM;
+
         result = wiphy_register(local->hw.wiphy);
         if (result < 0)
                 goto fail_wiphy_register;
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index b06ddc9519ce..6495a3f0428d 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -679,7 +679,7 @@ ieee80211_mesh_build_beacon(struct ieee80211_if_mesh *ifmsh)
                 *pos++ = 0x0;
                 *pos++ = ieee80211_frequency_to_channel(
                                 csa->settings.chandef.chan->center_freq);
-                sdata->csa_counter_offset_beacon = hdr_len + 6;
+                sdata->csa_counter_offset_beacon[0] = hdr_len + 6;
                 *pos++ = csa->settings.count;
                 *pos++ = WLAN_EID_CHAN_SWITCH_PARAM;
                 *pos++ = 6;
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 7d050ed6fe5a..cf032a8db9d7 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -287,8 +287,10 @@ static void mesh_path_move_to_queue(struct mesh_path *gate_mpath,
         struct sk_buff_head failq;
         unsigned long flags;
 
-        BUG_ON(gate_mpath == from_mpath);
-        BUG_ON(!gate_mpath->next_hop);
+        if (WARN_ON(gate_mpath == from_mpath))
+                return;
+        if (WARN_ON(!gate_mpath->next_hop))
+                return;
 
         __skb_queue_head_init(&failq);
 
diff --git a/net/mac80211/mesh_sync.c b/net/mac80211/mesh_sync.c
index 2bc5dc25d5ad..09625d6205c3 100644
--- a/net/mac80211/mesh_sync.c
+++ b/net/mac80211/mesh_sync.c
@@ -171,7 +171,7 @@ static void mesh_sync_offset_adjust_tbtt(struct ieee80211_sub_if_data *sdata,
         u8 cap;
 
         WARN_ON(ifmsh->mesh_sp_id != IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET);
-        BUG_ON(!rcu_read_lock_held());
+        WARN_ON(!rcu_read_lock_held());
         cap = beacon->meshconf->meshconf_cap;
 
         spin_lock_bh(&ifmsh->sync_offset_lock);
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index bfb5e20796b6..3345401be1b3 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -975,16 +975,23 @@ static void ieee80211_chswitch_work(struct work_struct *work)
         /* XXX: shouldn't really modify cfg80211-owned data! */
         ifmgd->associated->channel = sdata->csa_chandef.chan;
 
+        ieee80211_bss_info_change_notify(sdata, changed);
+
+        mutex_lock(&local->mtx);
+        sdata->vif.csa_active = false;
         /* XXX: wait for a beacon first? */
-        ieee80211_wake_queues_by_reason(&local->hw,
+        if (!ieee80211_csa_needs_block_tx(local))
+                ieee80211_wake_queues_by_reason(&local->hw,
                                         IEEE80211_MAX_QUEUE_MAP,
                                         IEEE80211_QUEUE_STOP_REASON_CSA);
+        mutex_unlock(&local->mtx);
 
-        ieee80211_bss_info_change_notify(sdata, changed);
-
- out:
-        sdata->vif.csa_active = false;
         ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
+
+        ieee80211_sta_reset_beacon_monitor(sdata);
+        ieee80211_sta_reset_conn_monitor(sdata);
+
+out:
         sdata_unlock(sdata);
 }
 
@@ -1100,12 +1107,16 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         mutex_unlock(&local->chanctx_mtx);
 
         sdata->csa_chandef = csa_ie.chandef;
+
+        mutex_lock(&local->mtx);
         sdata->vif.csa_active = true;
+        sdata->csa_block_tx = csa_ie.mode;
 
-        if (csa_ie.mode)
+        if (sdata->csa_block_tx)
                 ieee80211_stop_queues_by_reason(&local->hw,
-                                IEEE80211_MAX_QUEUE_MAP,
-                                IEEE80211_QUEUE_STOP_REASON_CSA);
+                                        IEEE80211_MAX_QUEUE_MAP,
+                                        IEEE80211_QUEUE_STOP_REASON_CSA);
+        mutex_unlock(&local->mtx);
 
         if (local->ops->channel_switch) {
                 /* use driver's channel switch callback */
@@ -1817,6 +1828,12 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         ifmgd->flags = 0;
         mutex_lock(&local->mtx);
         ieee80211_vif_release_channel(sdata);
+
+        sdata->vif.csa_active = false;
+        if (!ieee80211_csa_needs_block_tx(local))
+                ieee80211_wake_queues_by_reason(&local->hw,
+                                        IEEE80211_MAX_QUEUE_MAP,
+                                        IEEE80211_QUEUE_STOP_REASON_CSA);
         mutex_unlock(&local->mtx);
 
         sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
@@ -2045,6 +2062,7 @@ EXPORT_SYMBOL(ieee80211_ap_probereq_get);
 
 static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
 {
+        struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
 
@@ -2058,10 +2076,14 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
                                WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
                                true, frame_buf);
         ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
+
+        mutex_lock(&local->mtx);
         sdata->vif.csa_active = false;
-        ieee80211_wake_queues_by_reason(&sdata->local->hw,
+        if (!ieee80211_csa_needs_block_tx(local))
+                ieee80211_wake_queues_by_reason(&local->hw,
                                         IEEE80211_MAX_QUEUE_MAP,
                                         IEEE80211_QUEUE_STOP_REASON_CSA);
+        mutex_unlock(&local->mtx);
 
         cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
                               IEEE80211_DEAUTH_FRAME_LEN);
@@ -3546,6 +3568,9 @@ static void ieee80211_sta_bcn_mon_timer(unsigned long data)
         if (local->quiescing)
                 return;
 
+        if (sdata->vif.csa_active)
+                return;
+
         sdata->u.mgd.connection_loss = false;
         ieee80211_queue_work(&sdata->local->hw,
                              &sdata->u.mgd.beacon_connection_loss_work);
@@ -3561,6 +3586,9 @@ static void ieee80211_sta_conn_mon_timer(unsigned long data)
         if (local->quiescing)
                 return;
 
+        if (sdata->vif.csa_active)
+                return;
+
         ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
 }
 
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 26fd94fa0aed..1c1469c36dca 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -657,6 +657,17 @@ minstrel_free(void *priv)
         kfree(priv);
 }
 
+static u32 minstrel_get_expected_throughput(void *priv_sta)
+{
+        struct minstrel_sta_info *mi = priv_sta;
+        int idx = mi->max_tp_rate[0];
+
+        /* convert pkt per sec in kbps (1200 is the average pkt size used for
+         * computing cur_tp
+         */
+        return MINSTREL_TRUNC(mi->r[idx].cur_tp) * 1200 * 8 / 1024;
+}
+
 const struct rate_control_ops mac80211_minstrel = {
         .name = "minstrel",
         .tx_status = minstrel_tx_status,
@@ -670,6 +681,7 @@ const struct rate_control_ops mac80211_minstrel = {
         .add_sta_debugfs = minstrel_add_sta_debugfs,
         .remove_sta_debugfs = minstrel_remove_sta_debugfs,
 #endif
+        .get_expected_throughput = minstrel_get_expected_throughput,
 };
 
 int __init
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index bccaf854a309..85c1e74b7714 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -22,7 +22,7 @@
 #define MCS_NBITS (AVG_PKT_SIZE << 3)
 
 /* Number of symbols for a packet with (bps) bits per symbol */
-#define MCS_NSYMS(bps) ((MCS_NBITS + (bps) - 1) / (bps))
+#define MCS_NSYMS(bps) DIV_ROUND_UP(MCS_NBITS, (bps))
 
 /* Transmission time (nanoseconds) for a packet containing (syms) symbols */
 #define MCS_SYMBOL_TIME(sgi, syms)                                      \
@@ -226,8 +226,9 @@ minstrel_ht_calc_tp(struct minstrel_ht_sta *mi, int group, int rate)
                 nsecs = 1000 * mi->overhead / MINSTREL_TRUNC(mi->avg_ampdu_len);
 
         nsecs += minstrel_mcs_groups[group].duration[rate];
-        tp = 1000000 * ((prob * 1000) / nsecs);
 
+        /* prob is scaled - see MINSTREL_FRAC above */
+        tp = 1000000 * ((prob * 1000) / nsecs);
         mr->cur_tp = MINSTREL_TRUNC(tp);
 }
 
@@ -1031,6 +1032,22 @@ minstrel_ht_free(void *priv)
         mac80211_minstrel.free(priv);
 }
 
+static u32 minstrel_ht_get_expected_throughput(void *priv_sta)
+{
+        struct minstrel_ht_sta_priv *msp = priv_sta;
+        struct minstrel_ht_sta *mi = &msp->ht;
+        int i, j;
+
+        if (!msp->is_ht)
+                return mac80211_minstrel.get_expected_throughput(priv_sta);
+
+        i = mi->max_tp_rate / MCS_GROUP_RATES;
+        j = mi->max_tp_rate % MCS_GROUP_RATES;
+
+        /* convert cur_tp from pkt per second in kbps */
+        return mi->groups[i].rates[j].cur_tp * AVG_PKT_SIZE * 8 / 1024;
+}
+
 static const struct rate_control_ops mac80211_minstrel_ht = {
         .name = "minstrel_ht",
         .tx_status = minstrel_ht_tx_status,
@@ -1045,6 +1062,7 @@ static const struct rate_control_ops mac80211_minstrel_ht = {
         .add_sta_debugfs = minstrel_ht_add_sta_debugfs,
         .remove_sta_debugfs = minstrel_ht_remove_sta_debugfs,
 #endif
+        .get_expected_throughput = minstrel_ht_get_expected_throughput,
 };
 
 
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 28185c8dc19a..f40661eb75b5 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -1076,12 +1076,8 @@ void ieee80211_sched_scan_results(struct ieee80211_hw *hw)
 }
 EXPORT_SYMBOL(ieee80211_sched_scan_results);
 
-void ieee80211_sched_scan_stopped_work(struct work_struct *work)
+void ieee80211_sched_scan_end(struct ieee80211_local *local)
 {
-        struct ieee80211_local *local =
-                container_of(work, struct ieee80211_local,
-                             sched_scan_stopped_work);
-
         mutex_lock(&local->mtx);
 
         if (!rcu_access_pointer(local->sched_scan_sdata)) {
@@ -1099,6 +1095,15 @@ void ieee80211_sched_scan_stopped_work(struct work_struct *work)
         cfg80211_sched_scan_stopped(local->hw.wiphy);
 }
 
+void ieee80211_sched_scan_stopped_work(struct work_struct *work)
+{
+        struct ieee80211_local *local =
+                container_of(work, struct ieee80211_local,
+                             sched_scan_stopped_work);
+
+        ieee80211_sched_scan_end(local);
+}
+
 void ieee80211_sched_scan_stopped(struct ieee80211_hw *hw)
 {
         struct ieee80211_local *local = hw_to_local(hw);
diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c
new file mode 100644
index 000000000000..652813b2d3df
--- /dev/null
+++ b/net/mac80211/tdls.c
@@ -0,0 +1,325 @@
+/*
+ * mac80211 TDLS handling code
+ *
+ * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2014, Intel Corporation
+ *
+ * This file is GPLv2 as found in COPYING.
+ */
+
+#include <linux/ieee80211.h>
+#include "ieee80211_i.h"
+
+static void ieee80211_tdls_add_ext_capab(struct sk_buff *skb)
+{
+        u8 *pos = (void *)skb_put(skb, 7);
+
+        *pos++ = WLAN_EID_EXT_CAPABILITY;
+        *pos++ = 5; /* len */
+        *pos++ = 0x0;
+        *pos++ = 0x0;
+        *pos++ = 0x0;
+        *pos++ = 0x0;
+        *pos++ = WLAN_EXT_CAPA5_TDLS_ENABLED;
+}
+
+static u16 ieee80211_get_tdls_sta_capab(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        u16 capab;
+
+        capab = 0;
+        if (ieee80211_get_sdata_band(sdata) != IEEE80211_BAND_2GHZ)
+                return capab;
+
+        if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
+                capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
+        if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
+                capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
+
+        return capab;
+}
+
+static void ieee80211_tdls_add_link_ie(struct sk_buff *skb, const u8 *src_addr,
+                                       const u8 *peer, const u8 *bssid)
+{
+        struct ieee80211_tdls_lnkie *lnkid;
+
+        lnkid = (void *)skb_put(skb, sizeof(struct ieee80211_tdls_lnkie));
+
+        lnkid->ie_type = WLAN_EID_LINK_ID;
+        lnkid->ie_len = sizeof(struct ieee80211_tdls_lnkie) - 2;
+
+        memcpy(lnkid->bssid, bssid, ETH_ALEN);
+        memcpy(lnkid->init_sta, src_addr, ETH_ALEN);
+        memcpy(lnkid->resp_sta, peer, ETH_ALEN);
+}
+
+static int
+ieee80211_prep_tdls_encap_data(struct wiphy *wiphy, struct net_device *dev,
+                               const u8 *peer, u8 action_code, u8 dialog_token,
+                               u16 status_code, struct sk_buff *skb)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
+        struct ieee80211_tdls_data *tf;
+
+        tf = (void *)skb_put(skb, offsetof(struct ieee80211_tdls_data, u));
+
+        memcpy(tf->da, peer, ETH_ALEN);
+        memcpy(tf->sa, sdata->vif.addr, ETH_ALEN);
+        tf->ether_type = cpu_to_be16(ETH_P_TDLS);
+        tf->payload_type = WLAN_TDLS_SNAP_RFTYPE;
+
+        switch (action_code) {
+        case WLAN_TDLS_SETUP_REQUEST:
+                tf->category = WLAN_CATEGORY_TDLS;
+                tf->action_code = WLAN_TDLS_SETUP_REQUEST;
+
+                skb_put(skb, sizeof(tf->u.setup_req));
+                tf->u.setup_req.dialog_token = dialog_token;
+                tf->u.setup_req.capability =
+                        cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
+
+                ieee80211_add_srates_ie(sdata, skb, false, band);
+                ieee80211_add_ext_srates_ie(sdata, skb, false, band);
+                ieee80211_tdls_add_ext_capab(skb);
+                break;
+        case WLAN_TDLS_SETUP_RESPONSE:
+                tf->category = WLAN_CATEGORY_TDLS;
+                tf->action_code = WLAN_TDLS_SETUP_RESPONSE;
+
+                skb_put(skb, sizeof(tf->u.setup_resp));
+                tf->u.setup_resp.status_code = cpu_to_le16(status_code);
+                tf->u.setup_resp.dialog_token = dialog_token;
+                tf->u.setup_resp.capability =
+                        cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
+
+                ieee80211_add_srates_ie(sdata, skb, false, band);
+                ieee80211_add_ext_srates_ie(sdata, skb, false, band);
+                ieee80211_tdls_add_ext_capab(skb);
+                break;
+        case WLAN_TDLS_SETUP_CONFIRM:
+                tf->category = WLAN_CATEGORY_TDLS;
+                tf->action_code = WLAN_TDLS_SETUP_CONFIRM;
+
+                skb_put(skb, sizeof(tf->u.setup_cfm));
+                tf->u.setup_cfm.status_code = cpu_to_le16(status_code);
+                tf->u.setup_cfm.dialog_token = dialog_token;
+                break;
+        case WLAN_TDLS_TEARDOWN:
+                tf->category = WLAN_CATEGORY_TDLS;
+                tf->action_code = WLAN_TDLS_TEARDOWN;
+
+                skb_put(skb, sizeof(tf->u.teardown));
+                tf->u.teardown.reason_code = cpu_to_le16(status_code);
+                break;
+        case WLAN_TDLS_DISCOVERY_REQUEST:
+                tf->category = WLAN_CATEGORY_TDLS;
+                tf->action_code = WLAN_TDLS_DISCOVERY_REQUEST;
+
+                skb_put(skb, sizeof(tf->u.discover_req));
+                tf->u.discover_req.dialog_token = dialog_token;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static int
+ieee80211_prep_tdls_direct(struct wiphy *wiphy, struct net_device *dev,
+                           const u8 *peer, u8 action_code, u8 dialog_token,
+                           u16 status_code, struct sk_buff *skb)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
+        struct ieee80211_mgmt *mgmt;
+
+        mgmt = (void *)skb_put(skb, 24);
+        memset(mgmt, 0, 24);
+        memcpy(mgmt->da, peer, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
+        memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
+
+        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                          IEEE80211_STYPE_ACTION);
+
+        switch (action_code) {
+        case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
+                skb_put(skb, 1 + sizeof(mgmt->u.action.u.tdls_discover_resp));
+                mgmt->u.action.category = WLAN_CATEGORY_PUBLIC;
+                mgmt->u.action.u.tdls_discover_resp.action_code =
+                        WLAN_PUB_ACTION_TDLS_DISCOVER_RES;
+                mgmt->u.action.u.tdls_discover_resp.dialog_token =
+                        dialog_token;
+                mgmt->u.action.u.tdls_discover_resp.capability =
+                        cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
+
+                ieee80211_add_srates_ie(sdata, skb, false, band);
+                ieee80211_add_ext_srates_ie(sdata, skb, false, band);
+                ieee80211_tdls_add_ext_capab(skb);
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+int ieee80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+                        const u8 *peer, u8 action_code, u8 dialog_token,
+                        u16 status_code, u32 peer_capability,
+                        const u8 *extra_ies, size_t extra_ies_len)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
+        struct sk_buff *skb = NULL;
+        bool send_direct;
+        int ret;
+
+        if (!(wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS))
+                return -ENOTSUPP;
+
+        /* make sure we are in managed mode, and associated */
+        if (sdata->vif.type != NL80211_IFTYPE_STATION ||
+            !sdata->u.mgd.associated)
+                return -EINVAL;
+
+        tdls_dbg(sdata, "TDLS mgmt action %d peer %pM\n",
+                 action_code, peer);
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom +
+                            max(sizeof(struct ieee80211_mgmt),
+                                sizeof(struct ieee80211_tdls_data)) +
+                            50 + /* supported rates */
+                            7 + /* ext capab */
+                            extra_ies_len +
+                            sizeof(struct ieee80211_tdls_lnkie));
+        if (!skb)
+                return -ENOMEM;
+
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+
+        switch (action_code) {
+        case WLAN_TDLS_SETUP_REQUEST:
+        case WLAN_TDLS_SETUP_RESPONSE:
+        case WLAN_TDLS_SETUP_CONFIRM:
+        case WLAN_TDLS_TEARDOWN:
+        case WLAN_TDLS_DISCOVERY_REQUEST:
+                ret = ieee80211_prep_tdls_encap_data(wiphy, dev, peer,
+                                                     action_code, dialog_token,
+                                                     status_code, skb);
+                send_direct = false;
+                break;
+        case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
+                ret = ieee80211_prep_tdls_direct(wiphy, dev, peer, action_code,
+                                                 dialog_token, status_code,
+                                                 skb);
+                send_direct = true;
+                break;
+        default:
+                ret = -ENOTSUPP;
+                break;
+        }
+
+        if (ret < 0)
+                goto fail;
+
+        if (extra_ies_len)
+                memcpy(skb_put(skb, extra_ies_len), extra_ies, extra_ies_len);
+
+        /* the TDLS link IE is always added last */
+        switch (action_code) {
+        case WLAN_TDLS_SETUP_REQUEST:
+        case WLAN_TDLS_SETUP_CONFIRM:
+        case WLAN_TDLS_TEARDOWN:
+        case WLAN_TDLS_DISCOVERY_REQUEST:
+                /* we are the initiator */
+                ieee80211_tdls_add_link_ie(skb, sdata->vif.addr, peer,
+                                           sdata->u.mgd.bssid);
+                break;
+        case WLAN_TDLS_SETUP_RESPONSE:
+        case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
+                /* we are the responder */
+                ieee80211_tdls_add_link_ie(skb, peer, sdata->vif.addr,
+                                           sdata->u.mgd.bssid);
+                break;
+        default:
+                ret = -ENOTSUPP;
+                goto fail;
+        }
+
+        if (send_direct) {
+                ieee80211_tx_skb(sdata, skb);
+                return 0;
+        }
+
+        /*
+         * According to 802.11z: Setup req/resp are sent in AC_BK, otherwise
+         * we should default to AC_VI.
+         */
+        switch (action_code) {
+        case WLAN_TDLS_SETUP_REQUEST:
+        case WLAN_TDLS_SETUP_RESPONSE:
+                skb_set_queue_mapping(skb, IEEE80211_AC_BK);
+                skb->priority = 2;
+                break;
+        default:
+                skb_set_queue_mapping(skb, IEEE80211_AC_VI);
+                skb->priority = 5;
+                break;
+        }
+
+        /* disable bottom halves when entering the Tx path */
+        local_bh_disable();
+        ret = ieee80211_subif_start_xmit(skb, dev);
+        local_bh_enable();
+
+        return ret;
+
+fail:
+        dev_kfree_skb(skb);
+        return ret;
+}
+
+int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
+                        const u8 *peer, enum nl80211_tdls_operation oper)
+{
+        struct sta_info *sta;
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        if (!(wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS))
+                return -ENOTSUPP;
+
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                return -EINVAL;
+
+        tdls_dbg(sdata, "TDLS oper %d peer %pM\n", oper, peer);
+
+        switch (oper) {
+        case NL80211_TDLS_ENABLE_LINK:
+                rcu_read_lock();
+                sta = sta_info_get(sdata, peer);
+                if (!sta) {
+                        rcu_read_unlock();
+                        return -ENOLINK;
+                }
+
+                set_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH);
+                rcu_read_unlock();
+                break;
+        case NL80211_TDLS_DISABLE_LINK:
+                return sta_info_destroy_addr(sdata, peer);
+        case NL80211_TDLS_TEARDOWN:
+        case NL80211_TDLS_SETUP:
+        case NL80211_TDLS_DISCOVERY_REQ:
+                /* We don't support in-driver setup/teardown/discovery */
+                return -ENOTSUPP;
+        default:
+                return -ENOTSUPP;
+        }
+
+        return 0;
+}
diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
index cec5b60487a4..762e4cd16386 100644
--- a/net/mac80211/trace.h
+++ b/net/mac80211/trace.h
@@ -184,6 +184,20 @@ TRACE_EVENT(drv_return_bool,
                   "true" : "false")
 );
 
+TRACE_EVENT(drv_return_u32,
+        TP_PROTO(struct ieee80211_local *local, u32 ret),
+        TP_ARGS(local, ret),
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(u32, ret)
+        ),
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->ret = ret;
+        ),
+        TP_printk(LOCAL_PR_FMT " - %u", LOCAL_PR_ARG, __entry->ret)
+);
+
 TRACE_EVENT(drv_return_u64,
         TP_PROTO(struct ieee80211_local *local, u64 ret),
         TP_ARGS(local, ret),
@@ -1499,6 +1513,24 @@ DEFINE_EVENT(local_sdata_evt, drv_leave_ibss,
         TP_ARGS(local, sdata)
 );
 
+TRACE_EVENT(drv_get_expected_throughput,
+        TP_PROTO(struct ieee80211_sta *sta),
+
+        TP_ARGS(sta),
+
+        TP_STRUCT__entry(
+                STA_ENTRY
+        ),
+
+        TP_fast_assign(
+                STA_ASSIGN;
+        ),
+
+        TP_printk(
+                STA_PR_FMT, STA_PR_ARG
+        )
+);
+
 /*
  * Tracing for API calls that drivers call.
  */
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 19d36d4117e0..5214686d9fd1 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2328,7 +2328,8 @@ void ieee80211_tx_pending(unsigned long data)
 /* functions for drivers to get certain frames */
 
 static void __ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
-                                       struct ps_data *ps, struct sk_buff *skb)
+                                       struct ps_data *ps, struct sk_buff *skb,
+                                       bool is_template)
 {
         u8 *pos, *tim;
         int aid0 = 0;
@@ -2341,11 +2342,12 @@ static void __ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
                  * checking byte-for-byte */
                 have_bits = !bitmap_empty((unsigned long *)ps->tim,
                                           IEEE80211_MAX_AID+1);
-
-        if (ps->dtim_count == 0)
-                ps->dtim_count = sdata->vif.bss_conf.dtim_period - 1;
-        else
-                ps->dtim_count--;
+        if (!is_template) {
+                if (ps->dtim_count == 0)
+                        ps->dtim_count = sdata->vif.bss_conf.dtim_period - 1;
+                else
+                        ps->dtim_count--;
+        }
 
         tim = pos = (u8 *) skb_put(skb, 6);
         *pos++ = WLAN_EID_TIM;
@@ -2391,7 +2393,8 @@ static void __ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
 }
 
 static int ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
-                                    struct ps_data *ps, struct sk_buff *skb)
+                                    struct ps_data *ps, struct sk_buff *skb,
+                                    bool is_template)
 {
         struct ieee80211_local *local = sdata->local;
 
@@ -2403,24 +2406,24 @@ static int ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
          * of the tim bitmap in mac80211 and the driver.
          */
         if (local->tim_in_locked_section) {
-                __ieee80211_beacon_add_tim(sdata, ps, skb);
+                __ieee80211_beacon_add_tim(sdata, ps, skb, is_template);
         } else {
                 spin_lock_bh(&local->tim_lock);
-                __ieee80211_beacon_add_tim(sdata, ps, skb);
+                __ieee80211_beacon_add_tim(sdata, ps, skb, is_template);
                 spin_unlock_bh(&local->tim_lock);
         }
 
         return 0;
 }
 
-static void ieee80211_update_csa(struct ieee80211_sub_if_data *sdata,
-                                 struct beacon_data *beacon)
+static void ieee80211_set_csa(struct ieee80211_sub_if_data *sdata,
+                              struct beacon_data *beacon)
 {
         struct probe_resp *resp;
-        int counter_offset_beacon = sdata->csa_counter_offset_beacon;
-        int counter_offset_presp = sdata->csa_counter_offset_presp;
         u8 *beacon_data;
         size_t beacon_data_len;
+        int i;
+        u8 count = sdata->csa_current_counter;
 
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_AP:
@@ -2438,40 +2441,57 @@ static void ieee80211_update_csa(struct ieee80211_sub_if_data *sdata,
         default:
                 return;
         }
-        if (WARN_ON(counter_offset_beacon >= beacon_data_len))
-                return;
 
-        /* Warn if the driver did not check for/react to csa
-         * completeness.  A beacon with CSA counter set to 0 should
-         * never occur, because a counter of 1 means switch just
-         * before the next beacon.
-         */
-        if (WARN_ON(beacon_data[counter_offset_beacon] == 1))
-                return;
+        for (i = 0; i < IEEE80211_MAX_CSA_COUNTERS_NUM; ++i) {
+                u16 counter_offset_beacon =
+                        sdata->csa_counter_offset_beacon[i];
+                u16 counter_offset_presp = sdata->csa_counter_offset_presp[i];
 
-        beacon_data[counter_offset_beacon]--;
+                if (counter_offset_beacon) {
+                        if (WARN_ON(counter_offset_beacon >= beacon_data_len))
+                                return;
 
-        if (sdata->vif.type == NL80211_IFTYPE_AP && counter_offset_presp) {
-                rcu_read_lock();
-                resp = rcu_dereference(sdata->u.ap.probe_resp);
+                        beacon_data[counter_offset_beacon] = count;
+                }
+
+                if (sdata->vif.type == NL80211_IFTYPE_AP &&
+                    counter_offset_presp) {
+                        rcu_read_lock();
+                        resp = rcu_dereference(sdata->u.ap.probe_resp);
 
-                /* if nl80211 accepted the offset, this should not happen. */
-                if (WARN_ON(!resp)) {
+                        /* If nl80211 accepted the offset, this should
+                         * not happen.
+                         */
+                        if (WARN_ON(!resp)) {
+                                rcu_read_unlock();
+                                return;
+                        }
+                        resp->data[counter_offset_presp] = count;
                         rcu_read_unlock();
-                        return;
                 }
-                resp->data[counter_offset_presp]--;
-                rcu_read_unlock();
         }
 }
 
+u8 ieee80211_csa_update_counter(struct ieee80211_vif *vif)
+{
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+
+        sdata->csa_current_counter--;
+
+        /* the counter should never reach 0 */
+        WARN_ON(!sdata->csa_current_counter);
+
+        return sdata->csa_current_counter;
+}
+EXPORT_SYMBOL(ieee80211_csa_update_counter);
+
 bool ieee80211_csa_is_complete(struct ieee80211_vif *vif)
 {
         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
         struct beacon_data *beacon = NULL;
         u8 *beacon_data;
         size_t beacon_data_len;
-        int counter_beacon = sdata->csa_counter_offset_beacon;
+        int counter_beacon = sdata->csa_counter_offset_beacon[0];
         int ret = false;
 
         if (!ieee80211_sdata_running(sdata))
@@ -2521,9 +2541,11 @@ bool ieee80211_csa_is_complete(struct ieee80211_vif *vif)
 }
 EXPORT_SYMBOL(ieee80211_csa_is_complete);
 
-struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
-                                         struct ieee80211_vif *vif,
-                                         u16 *tim_offset, u16 *tim_length)
+static struct sk_buff *
+__ieee80211_beacon_get(struct ieee80211_hw *hw,
+                       struct ieee80211_vif *vif,
+                       struct ieee80211_mutable_offsets *offs,
+                       bool is_template)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct sk_buff *skb = NULL;
@@ -2532,6 +2554,7 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
         enum ieee80211_band band;
         struct ieee80211_tx_rate_control txrc;
         struct ieee80211_chanctx_conf *chanctx_conf;
+        int csa_off_base = 0;
 
         rcu_read_lock();
 
@@ -2541,18 +2564,20 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
         if (!ieee80211_sdata_running(sdata) || !chanctx_conf)
                 goto out;
 
-        if (tim_offset)
-                *tim_offset = 0;
-        if (tim_length)
-                *tim_length = 0;
+        if (offs)
+                memset(offs, 0, sizeof(*offs));
 
         if (sdata->vif.type == NL80211_IFTYPE_AP) {
                 struct ieee80211_if_ap *ap = &sdata->u.ap;
                 struct beacon_data *beacon = rcu_dereference(ap->beacon);
 
                 if (beacon) {
-                        if (sdata->vif.csa_active)
-                                ieee80211_update_csa(sdata, beacon);
+                        if (sdata->vif.csa_active) {
+                                if (!is_template)
+                                        ieee80211_csa_update_counter(vif);
+
+                                ieee80211_set_csa(sdata, beacon);
+                        }
 
                         /*
                          * headroom, head length,
@@ -2569,12 +2594,16 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                         memcpy(skb_put(skb, beacon->head_len), beacon->head,
                                beacon->head_len);
 
-                        ieee80211_beacon_add_tim(sdata, &ap->ps, skb);
+                        ieee80211_beacon_add_tim(sdata, &ap->ps, skb,
+                                                 is_template);
 
-                        if (tim_offset)
-                                *tim_offset = beacon->head_len;
-                        if (tim_length)
-                                *tim_length = skb->len - beacon->head_len;
+                        if (offs) {
+                                offs->tim_offset = beacon->head_len;
+                                offs->tim_length = skb->len - beacon->head_len;
+
+                                /* for AP the csa offsets are from tail */
+                                csa_off_base = skb->len;
+                        }
 
                         if (beacon->tail)
                                 memcpy(skb_put(skb, beacon->tail_len),
@@ -2589,9 +2618,12 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                 if (!presp)
                         goto out;
 
-                if (sdata->vif.csa_active)
-                        ieee80211_update_csa(sdata, presp);
+                if (sdata->vif.csa_active) {
+                        if (!is_template)
+                                ieee80211_csa_update_counter(vif);
 
+                        ieee80211_set_csa(sdata, presp);
+                }
 
                 skb = dev_alloc_skb(local->tx_headroom + presp->head_len +
                                     local->hw.extra_beacon_tailroom);
@@ -2611,8 +2643,17 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                 if (!bcn)
                         goto out;
 
-                if (sdata->vif.csa_active)
-                        ieee80211_update_csa(sdata, bcn);
+                if (sdata->vif.csa_active) {
+                        if (!is_template)
+                                /* TODO: For mesh csa_counter is in TU, so
+                                 * decrementing it by one isn't correct, but
+                                 * for now we leave it consistent with overall
+                                 * mac80211's behavior.
+                                 */
+                                ieee80211_csa_update_counter(vif);
+
+                        ieee80211_set_csa(sdata, bcn);
+                }
 
                 if (ifmsh->sync_ops)
                         ifmsh->sync_ops->adjust_tbtt(sdata, bcn);
@@ -2626,13 +2667,33 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                         goto out;
                 skb_reserve(skb, local->tx_headroom);
                 memcpy(skb_put(skb, bcn->head_len), bcn->head, bcn->head_len);
-                ieee80211_beacon_add_tim(sdata, &ifmsh->ps, skb);
+                ieee80211_beacon_add_tim(sdata, &ifmsh->ps, skb, is_template);
+
+                if (offs) {
+                        offs->tim_offset = bcn->head_len;
+                        offs->tim_length = skb->len - bcn->head_len;
+                }
+
                 memcpy(skb_put(skb, bcn->tail_len), bcn->tail, bcn->tail_len);
         } else {
                 WARN_ON(1);
                 goto out;
         }
 
+        /* CSA offsets */
+        if (offs) {
+                int i;
+
+                for (i = 0; i < IEEE80211_MAX_CSA_COUNTERS_NUM; i++) {
+                        u16 csa_off = sdata->csa_counter_offset_beacon[i];
+
+                        if (!csa_off)
+                                continue;
+
+                        offs->csa_counter_offs[i] = csa_off_base + csa_off;
+                }
+        }
+
         band = chanctx_conf->def.chan->band;
 
         info = IEEE80211_SKB_CB(skb);
@@ -2663,6 +2724,32 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
  out:
         rcu_read_unlock();
         return skb;
+
+}
+
+struct sk_buff *
+ieee80211_beacon_get_template(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif,
+                              struct ieee80211_mutable_offsets *offs)
+{
+        return __ieee80211_beacon_get(hw, vif, offs, true);
+}
+EXPORT_SYMBOL(ieee80211_beacon_get_template);
+
+struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
+                                         struct ieee80211_vif *vif,
+                                         u16 *tim_offset, u16 *tim_length)
+{
+        struct ieee80211_mutable_offsets offs = {};
+        struct sk_buff *bcn = __ieee80211_beacon_get(hw, vif, &offs, false);
+
+        if (tim_offset)
+                *tim_offset = offs.tim_offset;
+
+        if (tim_length)
+                *tim_length = offs.tim_length;
+
+        return bcn;
 }
 EXPORT_SYMBOL(ieee80211_beacon_get_tim);
 
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index c08bd4aca6bb..6886601afe1c 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1457,6 +1457,44 @@ void ieee80211_stop_device(struct ieee80211_local *local)
         drv_stop(local);
 }
 
+static void ieee80211_handle_reconfig_failure(struct ieee80211_local *local)
+{
+        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_chanctx *ctx;
+
+        /*
+         * We get here if during resume the device can't be restarted properly.
+         * We might also get here if this happens during HW reset, which is a
+         * slightly different situation and we need to drop all connections in
+         * the latter case.
+         *
+         * Ask cfg80211 to turn off all interfaces, this will result in more
+         * warnings but at least we'll then get into a clean stopped state.
+         */
+
+        local->resuming = false;
+        local->suspended = false;
+        local->started = false;
+
+        /* scheduled scan clearly can't be running any more, but tell
+         * cfg80211 and clear local state
+         */
+        ieee80211_sched_scan_end(local);
+
+        list_for_each_entry(sdata, &local->interfaces, list)
+                sdata->flags &= ~IEEE80211_SDATA_IN_DRIVER;
+
+        /* Mark channel contexts as not being in the driver any more to avoid
+         * removing them from the driver during the shutdown process...
+         */
+        mutex_lock(&local->chanctx_mtx);
+        list_for_each_entry(ctx, &local->chanctx_list, list)
+                ctx->driver_present = false;
+        mutex_unlock(&local->chanctx_mtx);
+
+        cfg80211_shutdown_all_interfaces(local->hw.wiphy);
+}
+
 static void ieee80211_assign_chanctx(struct ieee80211_local *local,
                                      struct ieee80211_sub_if_data *sdata)
 {
@@ -1520,9 +1558,11 @@ int ieee80211_reconfig(struct ieee80211_local *local)
          */
         res = drv_start(local);
         if (res) {
-                WARN(local->suspended, "Hardware became unavailable "
-                     "upon resume. This could be a software issue "
-                     "prior to suspend or a hardware issue.\n");
+                if (local->suspended)
+                        WARN(1, "Hardware became unavailable upon resume. This could be a software issue prior to suspend or a hardware issue.\n");
+                else
+                        WARN(1, "Hardware became unavailable during restart.\n");
+                ieee80211_handle_reconfig_failure(local);
                 return res;
         }
 
diff --git a/net/nfc/digital.h b/net/nfc/digital.h
index 3759add68b1b..71ad7eefddd4 100644
--- a/net/nfc/digital.h
+++ b/net/nfc/digital.h
@@ -71,6 +71,7 @@ static inline int digital_in_send_cmd(struct nfc_digital_dev *ddev,
 void digital_poll_next_tech(struct nfc_digital_dev *ddev);
 
 int digital_in_send_sens_req(struct nfc_digital_dev *ddev, u8 rf_tech);
+int digital_in_send_sensb_req(struct nfc_digital_dev *ddev, u8 rf_tech);
 int digital_in_send_sensf_req(struct nfc_digital_dev *ddev, u8 rf_tech);
 int digital_in_send_iso15693_inv_req(struct nfc_digital_dev *ddev, u8 rf_tech);
 
diff --git a/net/nfc/digital_core.c b/net/nfc/digital_core.c
index e01e15dbf1ab..b105cfb00e76 100644
--- a/net/nfc/digital_core.c
+++ b/net/nfc/digital_core.c
@@ -22,6 +22,8 @@
 #define DIGITAL_PROTO_NFCA_RF_TECH \
         (NFC_PROTO_JEWEL_MASK | NFC_PROTO_MIFARE_MASK | NFC_PROTO_NFC_DEP_MASK)
 
+#define DIGITAL_PROTO_NFCB_RF_TECH      NFC_PROTO_ISO14443_B_MASK
+
 #define DIGITAL_PROTO_NFCF_RF_TECH \
         (NFC_PROTO_FELICA_MASK | NFC_PROTO_NFC_DEP_MASK)
 
@@ -345,6 +347,12 @@ int digital_target_found(struct nfc_digital_dev *ddev,
                 add_crc = digital_skb_add_crc_a;
                 break;
 
+        case NFC_PROTO_ISO14443_B:
+                framing = NFC_DIGITAL_FRAMING_NFCB_T4T;
+                check_crc = digital_skb_check_crc_b;
+                add_crc = digital_skb_add_crc_b;
+                break;
+
         default:
                 pr_err("Invalid protocol %d\n", protocol);
                 return -EINVAL;
@@ -475,6 +483,10 @@ static int digital_start_poll(struct nfc_dev *nfc_dev, __u32 im_protocols,
                 digital_add_poll_tech(ddev, NFC_DIGITAL_RF_TECH_106A,
                                       digital_in_send_sens_req);
 
+        if (matching_im_protocols & DIGITAL_PROTO_NFCB_RF_TECH)
+                digital_add_poll_tech(ddev, NFC_DIGITAL_RF_TECH_106B,
+                                      digital_in_send_sensb_req);
+
         if (matching_im_protocols & DIGITAL_PROTO_NFCF_RF_TECH) {
                 digital_add_poll_tech(ddev, NFC_DIGITAL_RF_TECH_212F,
                                       digital_in_send_sensf_req);
@@ -635,7 +647,8 @@ static void digital_in_send_complete(struct nfc_digital_dev *ddev, void *arg,
                 goto done;
         }
 
-        if (ddev->curr_protocol == NFC_PROTO_ISO14443) {
+        if ((ddev->curr_protocol == NFC_PROTO_ISO14443) ||
+            (ddev->curr_protocol == NFC_PROTO_ISO14443_B)) {
                 rc = digital_in_iso_dep_pull_sod(ddev, resp);
                 if (rc)
                         goto done;
@@ -676,7 +689,8 @@ static int digital_in_send(struct nfc_dev *nfc_dev, struct nfc_target *target,
                 goto exit;
         }
 
-        if (ddev->curr_protocol == NFC_PROTO_ISO14443) {
+        if ((ddev->curr_protocol == NFC_PROTO_ISO14443) ||
+            (ddev->curr_protocol == NFC_PROTO_ISO14443_B)) {
                 rc = digital_in_iso_dep_push_sod(ddev, skb);
                 if (rc)
                         goto exit;
@@ -747,6 +761,8 @@ struct nfc_digital_dev *nfc_digital_allocate_device(struct nfc_digital_ops *ops,
                 ddev->protocols |= NFC_PROTO_ISO15693_MASK;
         if (supported_protocols & NFC_PROTO_ISO14443_MASK)
                 ddev->protocols |= NFC_PROTO_ISO14443_MASK;
+        if (supported_protocols & NFC_PROTO_ISO14443_B_MASK)
+                ddev->protocols |= NFC_PROTO_ISO14443_B_MASK;
 
         ddev->tx_headroom = tx_headroom + DIGITAL_MAX_HEADER_LEN;
         ddev->tx_tailroom = tx_tailroom + DIGITAL_CRC_LEN;
diff --git a/net/nfc/digital_technology.c b/net/nfc/digital_technology.c
index 278c3fed27e0..12a233e9ece5 100644
--- a/net/nfc/digital_technology.c
+++ b/net/nfc/digital_technology.c
@@ -41,6 +41,24 @@
 #define DIGITAL_MIFARE_READ_RES_LEN 16
 #define DIGITAL_MIFARE_ACK_RES  0x0A
 
+#define DIGITAL_CMD_SENSB_REQ                   0x05
+#define DIGITAL_SENSB_ADVANCED                  BIT(5)
+#define DIGITAL_SENSB_EXTENDED                  BIT(4)
+#define DIGITAL_SENSB_ALLB_REQ                  BIT(3)
+#define DIGITAL_SENSB_N(n)                      ((n) & 0x7)
+
+#define DIGITAL_CMD_SENSB_RES                   0x50
+
+#define DIGITAL_CMD_ATTRIB_REQ                  0x1D
+#define DIGITAL_ATTRIB_P1_TR0_DEFAULT           (0x0 << 6)
+#define DIGITAL_ATTRIB_P1_TR1_DEFAULT           (0x0 << 4)
+#define DIGITAL_ATTRIB_P1_SUPRESS_EOS           BIT(3)
+#define DIGITAL_ATTRIB_P1_SUPRESS_SOS           BIT(2)
+#define DIGITAL_ATTRIB_P2_LISTEN_POLL_1         (0x0 << 6)
+#define DIGITAL_ATTRIB_P2_POLL_LISTEN_1         (0x0 << 4)
+#define DIGITAL_ATTRIB_P2_MAX_FRAME_256         0x8
+#define DIGITAL_ATTRIB_P4_DID(n)                ((n) & 0xf)
+
 #define DIGITAL_CMD_SENSF_REQ   0x00
 #define DIGITAL_CMD_SENSF_RES   0x01
 
@@ -75,6 +93,7 @@ static const u8 digital_ats_fsc[] = {
 };
 
 #define DIGITAL_ATS_FSCI(t0) ((t0) & 0x0F)
+#define DIGITAL_SENSB_FSCI(pi2) (((pi2) & 0xF0) >> 4)
 #define DIGITAL_ATS_MAX_FSC  256
 
 #define DIGITAL_RATS_BYTE1 0xE0
@@ -92,6 +111,32 @@ struct digital_sel_req {
         u8 bcc;
 } __packed;
 
+struct digital_sensb_req {
+        u8 cmd;
+        u8 afi;
+        u8 param;
+} __packed;
+
+struct digital_sensb_res {
+        u8 cmd;
+        u8 nfcid0[4];
+        u8 app_data[4];
+        u8 proto_info[3];
+} __packed;
+
+struct digital_attrib_req {
+        u8 cmd;
+        u8 nfcid0[4];
+        u8 param1;
+        u8 param2;
+        u8 param3;
+        u8 param4;
+} __packed;
+
+struct digital_attrib_res {
+        u8 mbli_did;
+} __packed;
+
 struct digital_sensf_req {
         u8 cmd;
         u8 sc1;
@@ -531,6 +576,175 @@ int digital_in_recv_mifare_res(struct sk_buff *resp)
         return -EIO;
 }
 
+static void digital_in_recv_attrib_res(struct nfc_digital_dev *ddev, void *arg,
+                                       struct sk_buff *resp)
+{
+        struct nfc_target *target = arg;
+        struct digital_attrib_res *attrib_res;
+        int rc;
+
+        if (IS_ERR(resp)) {
+                rc = PTR_ERR(resp);
+                resp = NULL;
+                goto exit;
+        }
+
+        if (resp->len < sizeof(*attrib_res)) {
+                PROTOCOL_ERR("12.6.2");
+                rc = -EIO;
+                goto exit;
+        }
+
+        attrib_res = (struct digital_attrib_res *)resp->data;
+
+        if (attrib_res->mbli_did & 0x0f) {
+                PROTOCOL_ERR("12.6.2.1");
+                rc = -EIO;
+                goto exit;
+        }
+
+        rc = digital_target_found(ddev, target, NFC_PROTO_ISO14443_B);
+
+exit:
+        dev_kfree_skb(resp);
+        kfree(target);
+
+        if (rc)
+                digital_poll_next_tech(ddev);
+}
+
+int digital_in_send_attrib_req(struct nfc_digital_dev *ddev,
+                               struct nfc_target *target,
+                               struct digital_sensb_res *sensb_res)
+{
+        struct digital_attrib_req *attrib_req;
+        struct sk_buff *skb;
+        int rc;
+
+        skb = digital_skb_alloc(ddev, sizeof(*attrib_req));
+        if (!skb)
+                return -ENOMEM;
+
+        attrib_req = (struct digital_attrib_req *)skb_put(skb,
+                                                          sizeof(*attrib_req));
+
+        attrib_req->cmd = DIGITAL_CMD_ATTRIB_REQ;
+        memcpy(attrib_req->nfcid0, sensb_res->nfcid0,
+               sizeof(attrib_req->nfcid0));
+        attrib_req->param1 = DIGITAL_ATTRIB_P1_TR0_DEFAULT |
+                             DIGITAL_ATTRIB_P1_TR1_DEFAULT;
+        attrib_req->param2 = DIGITAL_ATTRIB_P2_LISTEN_POLL_1 |
+                             DIGITAL_ATTRIB_P2_POLL_LISTEN_1 |
+                             DIGITAL_ATTRIB_P2_MAX_FRAME_256;
+        attrib_req->param3 = sensb_res->proto_info[1] & 0x07;
+        attrib_req->param4 = DIGITAL_ATTRIB_P4_DID(0);
+
+        rc = digital_in_send_cmd(ddev, skb, 30, digital_in_recv_attrib_res,
+                                 target);
+        if (rc)
+                kfree_skb(skb);
+
+        return rc;
+}
+
+static void digital_in_recv_sensb_res(struct nfc_digital_dev *ddev, void *arg,
+                                      struct sk_buff *resp)
+{
+        struct nfc_target *target = NULL;
+        struct digital_sensb_res *sensb_res;
+        u8 fsci;
+        int rc;
+
+        if (IS_ERR(resp)) {
+                rc = PTR_ERR(resp);
+                resp = NULL;
+                goto exit;
+        }
+
+        if (resp->len != sizeof(*sensb_res)) {
+                PROTOCOL_ERR("5.6.2.1");
+                rc = -EIO;
+                goto exit;
+        }
+
+        sensb_res = (struct digital_sensb_res *)resp->data;
+
+        if (sensb_res->cmd != DIGITAL_CMD_SENSB_RES) {
+                PROTOCOL_ERR("5.6.2");
+                rc = -EIO;
+                goto exit;
+        }
+
+        if (!(sensb_res->proto_info[1] & BIT(0))) {
+                PROTOCOL_ERR("5.6.2.12");
+                rc = -EIO;
+                goto exit;
+        }
+
+        if (sensb_res->proto_info[1] & BIT(3)) {
+                PROTOCOL_ERR("5.6.2.16");
+                rc = -EIO;
+                goto exit;
+        }
+
+        fsci = DIGITAL_SENSB_FSCI(sensb_res->proto_info[1]);
+        if (fsci >= 8)
+                ddev->target_fsc = DIGITAL_ATS_MAX_FSC;
+        else
+                ddev->target_fsc = digital_ats_fsc[fsci];
+
+        target = kzalloc(sizeof(struct nfc_target), GFP_KERNEL);
+        if (!target) {
+                rc = -ENOMEM;
+                goto exit;
+        }
+
+        rc = digital_in_send_attrib_req(ddev, target, sensb_res);
+
+exit:
+        dev_kfree_skb(resp);
+
+        if (rc) {
+                kfree(target);
+                digital_poll_next_tech(ddev);
+        }
+}
+
+int digital_in_send_sensb_req(struct nfc_digital_dev *ddev, u8 rf_tech)
+{
+        struct digital_sensb_req *sensb_req;
+        struct sk_buff *skb;
+        int rc;
+
+        rc = digital_in_configure_hw(ddev, NFC_DIGITAL_CONFIG_RF_TECH,
+                                     NFC_DIGITAL_RF_TECH_106B);
+        if (rc)
+                return rc;
+
+        rc = digital_in_configure_hw(ddev, NFC_DIGITAL_CONFIG_FRAMING,
+                                     NFC_DIGITAL_FRAMING_NFCB);
+        if (rc)
+                return rc;
+
+        skb = digital_skb_alloc(ddev, sizeof(*sensb_req));
+        if (!skb)
+                return -ENOMEM;
+
+        sensb_req = (struct digital_sensb_req *)skb_put(skb,
+                                                        sizeof(*sensb_req));
+
+        sensb_req->cmd = DIGITAL_CMD_SENSB_REQ;
+        sensb_req->afi = 0x00; /* All families and sub-families */
+        sensb_req->param = DIGITAL_SENSB_N(0);
+
+        rc = digital_in_send_cmd(ddev, skb, 30, digital_in_recv_sensb_res,
+                                 NULL);
+        if (rc)
+                kfree_skb(skb);
+
+        return rc;
+}
+
 static void digital_in_recv_sensf_res(struct nfc_digital_dev *ddev, void *arg,
                                    struct sk_buff *resp)
 {
@@ -877,6 +1091,18 @@ exit:
         dev_kfree_skb(resp);
 }
 
+static void digital_tg_recv_atr_or_sensf_req(struct nfc_digital_dev *ddev,
+                void *arg, struct sk_buff *resp)
+{
+        if (!IS_ERR(resp) && (resp->len >= 2) &&
+                        (resp->data[1] == DIGITAL_CMD_SENSF_REQ))
+                digital_tg_recv_sensf_req(ddev, arg, resp);
+        else
+                digital_tg_recv_atr_req(ddev, arg, resp);
+
+        return;
+}
+
 static int digital_tg_send_sensf_res(struct nfc_digital_dev *ddev,
                               struct digital_sensf_req *sensf_req)
 {
@@ -887,7 +1113,7 @@ static int digital_tg_send_sensf_res(struct nfc_digital_dev *ddev,
 
         size = sizeof(struct digital_sensf_res);
 
-        if (sensf_req->rc != DIGITAL_SENSF_REQ_RC_NONE)
+        if (sensf_req->rc == DIGITAL_SENSF_REQ_RC_NONE)
                 size -= sizeof(sensf_res->rd);
 
         skb = digital_skb_alloc(ddev, size);
@@ -922,7 +1148,7 @@ static int digital_tg_send_sensf_res(struct nfc_digital_dev *ddev,
                 digital_skb_add_crc_f(skb);
 
         rc = digital_tg_send_cmd(ddev, skb, 300,
-                                 digital_tg_recv_atr_req, NULL);
+                                 digital_tg_recv_atr_or_sensf_req, NULL);
         if (rc)
                 kfree_skb(skb);
 
diff --git a/net/nfc/hci/command.c b/net/nfc/hci/command.c
index a9f4d2e62d8d..677d24bb70f8 100644
--- a/net/nfc/hci/command.c
+++ b/net/nfc/hci/command.c
@@ -26,6 +26,8 @@
 
 #include "hci.h"
 
+#define MAX_FWI 4949
+
 static int nfc_hci_execute_cmd_async(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd,
                                const u8 *param, size_t param_len,
                                data_exchange_cb_t cb, void *cb_context)
@@ -37,7 +39,7 @@ static int nfc_hci_execute_cmd_async(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd,
          * for all commands?
          */
         return nfc_hci_hcp_message_tx(hdev, pipe, NFC_HCI_HCP_COMMAND, cmd,
-                                      param, param_len, cb, cb_context, 3000);
+                                      param, param_len, cb, cb_context, MAX_FWI);
 }
 
 /*
@@ -82,7 +84,7 @@ static int nfc_hci_execute_cmd(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd,
                                                     NFC_HCI_HCP_COMMAND, cmd,
                                                     param, param_len,
                                                     nfc_hci_execute_cb, &hcp_ew,
-                                                    3000);
+                                                    MAX_FWI);
         if (hcp_ew.exec_result < 0)
                 return hcp_ew.exec_result;
 
diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c
index d45b638e77c7..47403705197e 100644
--- a/net/nfc/hci/core.c
+++ b/net/nfc/hci/core.c
@@ -225,7 +225,7 @@ int nfc_hci_target_discovered(struct nfc_hci_dev *hdev, u8 gate)
                         goto exit;
                 }
 
-                targets->sens_res = be16_to_cpu(*(u16 *)atqa_skb->data);
+                targets->sens_res = be16_to_cpu(*(__be16 *)atqa_skb->data);
                 targets->sel_res = sak_skb->data[0];
 
                 r = nfc_hci_get_param(hdev, NFC_HCI_RF_READER_A_GATE,
@@ -380,34 +380,31 @@ static int hci_dev_session_init(struct nfc_hci_dev *hdev)
         if (r < 0)
                 goto disconnect_all;
 
-        if (skb->len && skb->len == strlen(hdev->init_data.session_id))
-                if (memcmp(hdev->init_data.session_id, skb->data,
-                           skb->len) == 0) {
-                        /* TODO ELa: restore gate<->pipe table from
-                         * some TBD location.
-                         * note: it doesn't seem possible to get the chip
-                         * currently open gate/pipe table.
-                         * It is only possible to obtain the supported
-                         * gate list.
-                         */
+        if (skb->len && skb->len == strlen(hdev->init_data.session_id) &&
+                (memcmp(hdev->init_data.session_id, skb->data,
+                           skb->len) == 0) && hdev->ops->load_session) {
+                /* Restore gate<->pipe table from some proprietary location. */
 
-                        /* goto exit
-                         * For now, always do a full initialization */
-                }
+                r = hdev->ops->load_session(hdev);
 
-        r = nfc_hci_disconnect_all_gates(hdev);
-        if (r < 0)
-                goto exit;
+                if (r < 0)
+                        goto disconnect_all;
+        } else {
 
-        r = hci_dev_connect_gates(hdev, hdev->init_data.gate_count,
-                                  hdev->init_data.gates);
-        if (r < 0)
-                goto disconnect_all;
+                r = nfc_hci_disconnect_all_gates(hdev);
+                if (r < 0)
+                        goto exit;
 
-        r = nfc_hci_set_param(hdev, NFC_HCI_ADMIN_GATE,
-                              NFC_HCI_ADMIN_SESSION_IDENTITY,
-                              hdev->init_data.session_id,
-                              strlen(hdev->init_data.session_id));
+                r = hci_dev_connect_gates(hdev, hdev->init_data.gate_count,
+                                          hdev->init_data.gates);
+                if (r < 0)
+                        goto disconnect_all;
+
+                r = nfc_hci_set_param(hdev, NFC_HCI_ADMIN_GATE,
+                                NFC_HCI_ADMIN_SESSION_IDENTITY,
+                                hdev->init_data.session_id,
+                                strlen(hdev->init_data.session_id));
+        }
         if (r == 0)
                 goto exit;
 
diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c
index bec6ed15f503..a3ad69a4c648 100644
--- a/net/nfc/llcp_commands.c
+++ b/net/nfc/llcp_commands.c
@@ -387,7 +387,7 @@ int nfc_llcp_send_symm(struct nfc_dev *dev)
 
         __net_timestamp(skb);
 
-        nfc_llcp_send_to_raw_sock(local, skb, NFC_LLCP_DIRECTION_TX);
+        nfc_llcp_send_to_raw_sock(local, skb, NFC_DIRECTION_TX);
 
         return nfc_data_exchange(dev, local->target_idx, skb,
                                  nfc_llcp_recv, local);
diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
index b4671958fcf9..f6278da68763 100644
--- a/net/nfc/llcp_core.c
+++ b/net/nfc/llcp_core.c
@@ -680,16 +680,17 @@ void nfc_llcp_send_to_raw_sock(struct nfc_llcp_local *local,
                         continue;
 
                 if (skb_copy == NULL) {
-                        skb_copy = __pskb_copy(skb, NFC_LLCP_RAW_HEADER_SIZE,
+                        skb_copy = __pskb_copy(skb, NFC_RAW_HEADER_SIZE,
                                                GFP_ATOMIC);
 
                         if (skb_copy == NULL)
                                 continue;
 
-                        data = skb_push(skb_copy, NFC_LLCP_RAW_HEADER_SIZE);
+                        data = skb_push(skb_copy, NFC_RAW_HEADER_SIZE);
 
                         data[0] = local->dev ? local->dev->idx : 0xFF;
-                        data[1] = direction;
+                        data[1] = direction & 0x01;
+                        data[1] |= (RAW_PAYLOAD_LLCP << 1);
                 }
 
                 nskb = skb_clone(skb_copy, GFP_ATOMIC);
@@ -747,7 +748,7 @@ static void nfc_llcp_tx_work(struct work_struct *work)
                         __net_timestamp(skb);
 
                         nfc_llcp_send_to_raw_sock(local, skb,
-                                                  NFC_LLCP_DIRECTION_TX);
+                                                  NFC_DIRECTION_TX);
 
                         ret = nfc_data_exchange(local->dev, local->target_idx,
                                                 skb, nfc_llcp_recv, local);
@@ -1476,7 +1477,7 @@ static void nfc_llcp_rx_work(struct work_struct *work)
 
         __net_timestamp(skb);
 
-        nfc_llcp_send_to_raw_sock(local, skb, NFC_LLCP_DIRECTION_RX);
+        nfc_llcp_send_to_raw_sock(local, skb, NFC_DIRECTION_RX);
 
         nfc_llcp_rx_skb(local, skb);
 
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index 6c34ac978501..2b400e1a8695 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -861,6 +861,10 @@ static int nci_send_frame(struct nci_dev *ndev, struct sk_buff *skb)
         /* Get rid of skb owner, prior to sending to the driver. */
         skb_orphan(skb);
 
+        /* Send copy to sniffer */
+        nfc_send_to_raw_sock(ndev->nfc_dev, skb,
+                             RAW_PAYLOAD_NCI, NFC_DIRECTION_TX);
+
         return ndev->ops->send(ndev, skb);
 }
 
@@ -935,6 +939,11 @@ static void nci_rx_work(struct work_struct *work)
         struct sk_buff *skb;
 
         while ((skb = skb_dequeue(&ndev->rx_q))) {
+
+                /* Send copy to sniffer */
+                nfc_send_to_raw_sock(ndev->nfc_dev, skb,
+                                     RAW_PAYLOAD_NCI, NFC_DIRECTION_RX);
+
                 /* Process frame */
                 switch (nci_mt(skb->data)) {
                 case NCI_MT_RSP_PKT:
diff --git a/net/nfc/nci/ntf.c b/net/nfc/nci/ntf.c
index 1e905097456b..f8f6af231381 100644
--- a/net/nfc/nci/ntf.c
+++ b/net/nfc/nci/ntf.c
@@ -366,7 +366,6 @@ static int nci_extract_activation_params_nfc_dep(struct nci_dev *ndev,
                         struct nci_rf_intf_activated_ntf *ntf, __u8 *data)
 {
         struct activation_params_poll_nfc_dep *poll;
-        int i;
 
         switch (ntf->activation_rf_tech_and_mode) {
         case NCI_NFC_A_PASSIVE_POLL_MODE:
@@ -374,10 +373,8 @@ static int nci_extract_activation_params_nfc_dep(struct nci_dev *ndev,
                 poll = &ntf->activation_params.poll_nfc_dep;
                 poll->atr_res_len = min_t(__u8, *data++, 63);
                 pr_debug("atr_res_len %d\n", poll->atr_res_len);
-                if (poll->atr_res_len > 0) {
-                        for (i = 0; i < poll->atr_res_len; i++)
-                                poll->atr_res[poll->atr_res_len-1-i] = data[i];
-                }
+                if (poll->atr_res_len > 0)
+                        memcpy(poll->atr_res, data, poll->atr_res_len);
                 break;
 
         default:
diff --git a/net/nfc/nfc.h b/net/nfc/nfc.h
index 9d6e74f7e6b3..88d60064890e 100644
--- a/net/nfc/nfc.h
+++ b/net/nfc/nfc.h
@@ -40,6 +40,12 @@ struct nfc_rawsock {
         struct work_struct tx_work;
         bool tx_work_scheduled;
 };
+
+struct nfc_sock_list {
+        struct hlist_head head;
+        rwlock_t          lock;
+};
+
 #define nfc_rawsock(sk) ((struct nfc_rawsock *) sk)
 #define to_rawsock_sk(_tx_work) \
         ((struct sock *) container_of(_tx_work, struct nfc_rawsock, tx_work))
diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c
index c27a6e86cae4..8627c75063e2 100644
--- a/net/nfc/rawsock.c
+++ b/net/nfc/rawsock.c
@@ -27,6 +27,24 @@
 
 #include "nfc.h"
 
+static struct nfc_sock_list raw_sk_list = {
+        .lock = __RW_LOCK_UNLOCKED(raw_sk_list.lock)
+};
+
+void nfc_sock_link(struct nfc_sock_list *l, struct sock *sk)
+{
+        write_lock(&l->lock);
+        sk_add_node(sk, &l->head);
+        write_unlock(&l->lock);
+}
+
+void nfc_sock_unlink(struct nfc_sock_list *l, struct sock *sk)
+{
+        write_lock(&l->lock);
+        sk_del_node_init(sk);
+        write_unlock(&l->lock);
+}
+
 static void rawsock_write_queue_purge(struct sock *sk)
 {
         pr_debug("sk=%p\n", sk);
@@ -57,6 +75,9 @@ static int rawsock_release(struct socket *sock)
         if (!sk)
                 return 0;
 
+        if (sock->type == SOCK_RAW)
+                nfc_sock_unlink(&raw_sk_list, sk);
+
         sock_orphan(sk);
         sock_put(sk);
 
@@ -275,6 +296,26 @@ static const struct proto_ops rawsock_ops = {
         .mmap           = sock_no_mmap,
 };
 
+static const struct proto_ops rawsock_raw_ops = {
+        .family         = PF_NFC,
+        .owner          = THIS_MODULE,
+        .release        = rawsock_release,
+        .bind           = sock_no_bind,
+        .connect        = sock_no_connect,
+        .socketpair     = sock_no_socketpair,
+        .accept         = sock_no_accept,
+        .getname        = sock_no_getname,
+        .poll           = datagram_poll,
+        .ioctl          = sock_no_ioctl,
+        .listen         = sock_no_listen,
+        .shutdown       = sock_no_shutdown,
+        .setsockopt     = sock_no_setsockopt,
+        .getsockopt     = sock_no_getsockopt,
+        .sendmsg        = sock_no_sendmsg,
+        .recvmsg        = rawsock_recvmsg,
+        .mmap           = sock_no_mmap,
+};
+
 static void rawsock_destruct(struct sock *sk)
 {
         pr_debug("sk=%p\n", sk);
@@ -300,10 +341,13 @@ static int rawsock_create(struct net *net, struct socket *sock,
 
         pr_debug("sock=%p\n", sock);
 
-        if (sock->type != SOCK_SEQPACKET)
+        if ((sock->type != SOCK_SEQPACKET) && (sock->type != SOCK_RAW))
                 return -ESOCKTNOSUPPORT;
 
-        sock->ops = &rawsock_ops;
+        if (sock->type == SOCK_RAW)
+                sock->ops = &rawsock_raw_ops;
+        else
+                sock->ops = &rawsock_ops;
 
         sk = sk_alloc(net, PF_NFC, GFP_ATOMIC, nfc_proto->proto);
         if (!sk)
@@ -313,13 +357,53 @@ static int rawsock_create(struct net *net, struct socket *sock,
         sk->sk_protocol = nfc_proto->id;
         sk->sk_destruct = rawsock_destruct;
         sock->state = SS_UNCONNECTED;
-
-        INIT_WORK(&nfc_rawsock(sk)->tx_work, rawsock_tx_work);
-        nfc_rawsock(sk)->tx_work_scheduled = false;
+        if (sock->type == SOCK_RAW)
+                nfc_sock_link(&raw_sk_list, sk);
+        else {
+                INIT_WORK(&nfc_rawsock(sk)->tx_work, rawsock_tx_work);
+                nfc_rawsock(sk)->tx_work_scheduled = false;
+        }
 
         return 0;
 }
 
+void nfc_send_to_raw_sock(struct nfc_dev *dev, struct sk_buff *skb,
+                          u8 payload_type, u8 direction)
+{
+        struct sk_buff *skb_copy = NULL, *nskb;
+        struct sock *sk;
+        u8 *data;
+
+        read_lock(&raw_sk_list.lock);
+
+        sk_for_each(sk, &raw_sk_list.head) {
+                if (!skb_copy) {
+                        skb_copy = __pskb_copy(skb, NFC_RAW_HEADER_SIZE,
+                                     GFP_ATOMIC);
+                        if (!skb_copy)
+                                continue;
+
+                        data = skb_push(skb_copy, NFC_RAW_HEADER_SIZE);
+
+                        data[0] = dev ? dev->idx : 0xFF;
+                        data[1] = direction & 0x01;
+                        data[1] |= (payload_type << 1);
+                }
+
+                nskb = skb_clone(skb_copy, GFP_ATOMIC);
+                if (!nskb)
+                        continue;
+
+                if (sock_queue_rcv_skb(sk, nskb))
+                        kfree_skb(nskb);
+        }
+
+        read_unlock(&raw_sk_list.lock);
+
+        kfree_skb(skb_copy);
+}
+EXPORT_SYMBOL(nfc_send_to_raw_sock);
+
 static struct proto rawsock_proto = {
         .name     = "NFC_RAW",
         .owner    = THIS_MODULE,
diff --git a/net/rfkill/rfkill-gpio.c b/net/rfkill/rfkill-gpio.c
index bd2a5b90400c..14c98e48f261 100644
--- a/net/rfkill/rfkill-gpio.c
+++ b/net/rfkill/rfkill-gpio.c
@@ -36,8 +36,6 @@ struct rfkill_gpio_data {
         struct gpio_desc        *shutdown_gpio;
 
         struct rfkill           *rfkill_dev;
-        char                    *reset_name;
-        char                    *shutdown_name;
         struct clk              *clk;
 
         bool                    clk_enabled;
@@ -47,17 +45,14 @@ static int rfkill_gpio_set_power(void *data, bool blocked)
 {
         struct rfkill_gpio_data *rfkill = data;
 
-        if (blocked) {
-                gpiod_set_value(rfkill->shutdown_gpio, 0);
-                gpiod_set_value(rfkill->reset_gpio, 0);
-                if (!IS_ERR(rfkill->clk) && rfkill->clk_enabled)
-                        clk_disable(rfkill->clk);
-        } else {
-                if (!IS_ERR(rfkill->clk) && !rfkill->clk_enabled)
-                        clk_enable(rfkill->clk);
-                gpiod_set_value(rfkill->reset_gpio, 1);
-                gpiod_set_value(rfkill->shutdown_gpio, 1);
-        }
+        if (!blocked && !IS_ERR(rfkill->clk) && !rfkill->clk_enabled)
+                clk_enable(rfkill->clk);
+
+        gpiod_set_value_cansleep(rfkill->shutdown_gpio, !blocked);
+        gpiod_set_value_cansleep(rfkill->reset_gpio, !blocked);
+
+        if (blocked && !IS_ERR(rfkill->clk) && rfkill->clk_enabled)
+                clk_disable(rfkill->clk);
 
         rfkill->clk_enabled = blocked;
 
@@ -87,10 +82,8 @@ static int rfkill_gpio_probe(struct platform_device *pdev)
 {
         struct rfkill_gpio_platform_data *pdata = pdev->dev.platform_data;
         struct rfkill_gpio_data *rfkill;
-        const char *clk_name = NULL;
         struct gpio_desc *gpio;
         int ret;
-        int len;
 
         rfkill = devm_kzalloc(&pdev->dev, sizeof(*rfkill), GFP_KERNEL);
         if (!rfkill)
@@ -101,28 +94,15 @@ static int rfkill_gpio_probe(struct platform_device *pdev)
                 if (ret)
                         return ret;
         } else if (pdata) {
-                clk_name = pdata->power_clk_name;
                 rfkill->name = pdata->name;
                 rfkill->type = pdata->type;
         } else {
                 return -ENODEV;
         }
 
-        len = strlen(rfkill->name);
-        rfkill->reset_name = devm_kzalloc(&pdev->dev, len + 7, GFP_KERNEL);
-        if (!rfkill->reset_name)
-                return -ENOMEM;
-
-        rfkill->shutdown_name = devm_kzalloc(&pdev->dev, len + 10, GFP_KERNEL);
-        if (!rfkill->shutdown_name)
-                return -ENOMEM;
+        rfkill->clk = devm_clk_get(&pdev->dev, NULL);
 
-        snprintf(rfkill->reset_name, len + 6 , "%s_reset", rfkill->name);
-        snprintf(rfkill->shutdown_name, len + 9, "%s_shutdown", rfkill->name);
-
-        rfkill->clk = devm_clk_get(&pdev->dev, clk_name);
-
-        gpio = devm_gpiod_get_index(&pdev->dev, rfkill->reset_name, 0);
+        gpio = devm_gpiod_get_index(&pdev->dev, "reset", 0);
         if (!IS_ERR(gpio)) {
                 ret = gpiod_direction_output(gpio, 0);
                 if (ret)
@@ -130,7 +110,7 @@ static int rfkill_gpio_probe(struct platform_device *pdev)
                 rfkill->reset_gpio = gpio;
         }
 
-        gpio = devm_gpiod_get_index(&pdev->dev, rfkill->shutdown_name, 1);
+        gpio = devm_gpiod_get_index(&pdev->dev, "shutdown", 1);
         if (!IS_ERR(gpio)) {
                 ret = gpiod_direction_output(gpio, 0);
                 if (ret)
@@ -146,14 +126,6 @@ static int rfkill_gpio_probe(struct platform_device *pdev)
                 return -EINVAL;
         }
 
-        if (pdata && pdata->gpio_runtime_setup) {
-                ret = pdata->gpio_runtime_setup(pdev);
-                if (ret) {
-                        dev_err(&pdev->dev, "can't set up gpio\n");
-                        return ret;
-                }
-        }
-
         rfkill->rfkill_dev = rfkill_alloc(rfkill->name, &pdev->dev,
                                           rfkill->type, &rfkill_gpio_ops,
                                           rfkill);
@@ -174,20 +146,23 @@ static int rfkill_gpio_probe(struct platform_device *pdev)
 static int rfkill_gpio_remove(struct platform_device *pdev)
 {
         struct rfkill_gpio_data *rfkill = platform_get_drvdata(pdev);
-        struct rfkill_gpio_platform_data *pdata = pdev->dev.platform_data;
 
-        if (pdata && pdata->gpio_runtime_close)
-                pdata->gpio_runtime_close(pdev);
         rfkill_unregister(rfkill->rfkill_dev);
         rfkill_destroy(rfkill->rfkill_dev);
 
         return 0;
 }
 
+#ifdef CONFIG_ACPI
 static const struct acpi_device_id rfkill_acpi_match[] = {
+        { "BCM2E1A", RFKILL_TYPE_BLUETOOTH },
+        { "BCM2E39", RFKILL_TYPE_BLUETOOTH },
+        { "BCM2E3D", RFKILL_TYPE_BLUETOOTH },
         { "BCM4752", RFKILL_TYPE_GPS },
+        { "LNV4752", RFKILL_TYPE_GPS },
         { },
 };
+#endif
 
 static struct platform_driver rfkill_gpio_driver = {
         .probe = rfkill_gpio_probe,
diff --git a/net/wireless/ap.c b/net/wireless/ap.c
index 3e02ade508d8..bdad1f951561 100644
--- a/net/wireless/ap.c
+++ b/net/wireless/ap.c
@@ -6,8 +6,8 @@
 #include "rdev-ops.h"
 
 
-static int __cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
-                              struct net_device *dev, bool notify)
+int __cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
+                       struct net_device *dev, bool notify)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         int err;
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index 84d686e2dbd0..992b34070bcb 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -370,8 +370,8 @@ int cfg80211_chandef_dfs_required(struct wiphy *wiphy,
         case NL80211_IFTYPE_AP_VLAN:
         case NL80211_IFTYPE_WDS:
         case NL80211_IFTYPE_P2P_DEVICE:
-        case NL80211_IFTYPE_UNSPECIFIED:
                 break;
+        case NL80211_IFTYPE_UNSPECIFIED:
         case NUM_NL80211_IFTYPES:
                 WARN_ON(1);
         }
@@ -796,8 +796,7 @@ bool cfg80211_reg_can_beacon(struct wiphy *wiphy,
             !cfg80211_go_permissive_chan(rdev, chandef->chan))
                 prohibited_flags |= IEEE80211_CHAN_NO_IR;
 
-        if (cfg80211_chandef_dfs_required(wiphy, chandef,
-                                          NL80211_IFTYPE_UNSPECIFIED) > 0 &&
+        if (cfg80211_chandef_dfs_required(wiphy, chandef, iftype) > 0 &&
             cfg80211_chandef_dfs_available(wiphy, chandef)) {
                 /* We can skip IEEE80211_CHAN_NO_IR if chandef dfs available */
                 prohibited_flags = IEEE80211_CHAN_DISABLED;
diff --git a/net/wireless/core.c b/net/wireless/core.c
index b3ff3697239a..d03d8bdb29ca 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -210,15 +210,12 @@ void cfg80211_stop_p2p_device(struct cfg80211_registered_device *rdev,
         }
 }
 
-static int cfg80211_rfkill_set_block(void *data, bool blocked)
+void cfg80211_shutdown_all_interfaces(struct wiphy *wiphy)
 {
-        struct cfg80211_registered_device *rdev = data;
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
         struct wireless_dev *wdev;
 
-        if (!blocked)
-                return 0;
-
-        rtnl_lock();
+        ASSERT_RTNL();
 
         list_for_each_entry(wdev, &rdev->wdev_list, list) {
                 if (wdev->netdev) {
@@ -234,7 +231,18 @@ static int cfg80211_rfkill_set_block(void *data, bool blocked)
                         break;
                 }
         }
+}
+EXPORT_SYMBOL_GPL(cfg80211_shutdown_all_interfaces);
 
+static int cfg80211_rfkill_set_block(void *data, bool blocked)
+{
+        struct cfg80211_registered_device *rdev = data;
+
+        if (!blocked)
+                return 0;
+
+        rtnl_lock();
+        cfg80211_shutdown_all_interfaces(&rdev->wiphy);
         rtnl_unlock();
 
         return 0;
@@ -394,6 +402,8 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
         rdev->wiphy.rts_threshold = (u32) -1;
         rdev->wiphy.coverage_class = 0;
 
+        rdev->wiphy.max_num_csa_counters = 1;
+
         return &rdev->wiphy;
 }
 EXPORT_SYMBOL(wiphy_new);
@@ -690,7 +700,7 @@ void wiphy_unregister(struct wiphy *wiphy)
         rtnl_lock();
         rdev->wiphy.registered = false;
 
-        BUG_ON(!list_empty(&rdev->wdev_list));
+        WARN_ON(!list_empty(&rdev->wdev_list));
 
         /*
          * First remove the hardware from everywhere, this makes
@@ -792,23 +802,23 @@ void cfg80211_update_iface_num(struct cfg80211_registered_device *rdev,
                 rdev->num_running_monitor_ifaces += num;
 }
 
-void cfg80211_leave(struct cfg80211_registered_device *rdev,
-                    struct wireless_dev *wdev)
+void __cfg80211_leave(struct cfg80211_registered_device *rdev,
+                      struct wireless_dev *wdev)
 {
         struct net_device *dev = wdev->netdev;
 
         ASSERT_RTNL();
+        ASSERT_WDEV_LOCK(wdev);
 
         switch (wdev->iftype) {
         case NL80211_IFTYPE_ADHOC:
-                cfg80211_leave_ibss(rdev, dev, true);
+                __cfg80211_leave_ibss(rdev, dev, true);
                 break;
         case NL80211_IFTYPE_P2P_CLIENT:
         case NL80211_IFTYPE_STATION:
                 if (rdev->sched_scan_req && dev == rdev->sched_scan_req->dev)
                         __cfg80211_stop_sched_scan(rdev, false);
 
-                wdev_lock(wdev);
 #ifdef CONFIG_CFG80211_WEXT
                 kfree(wdev->wext.ie);
                 wdev->wext.ie = NULL;
@@ -817,20 +827,49 @@ void cfg80211_leave(struct cfg80211_registered_device *rdev,
 #endif
                 cfg80211_disconnect(rdev, dev,
                                     WLAN_REASON_DEAUTH_LEAVING, true);
-                wdev_unlock(wdev);
                 break;
         case NL80211_IFTYPE_MESH_POINT:
-                cfg80211_leave_mesh(rdev, dev);
+                __cfg80211_leave_mesh(rdev, dev);
                 break;
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_P2P_GO:
-                cfg80211_stop_ap(rdev, dev, true);
+                __cfg80211_stop_ap(rdev, dev, true);
                 break;
         default:
                 break;
         }
 }
 
+void cfg80211_leave(struct cfg80211_registered_device *rdev,
+                    struct wireless_dev *wdev)
+{
+        wdev_lock(wdev);
+        __cfg80211_leave(rdev, wdev);
+        wdev_unlock(wdev);
+}
+
+void cfg80211_stop_iface(struct wiphy *wiphy, struct wireless_dev *wdev,
+                         gfp_t gfp)
+{
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
+        struct cfg80211_event *ev;
+        unsigned long flags;
+
+        trace_cfg80211_stop_iface(wiphy, wdev);
+
+        ev = kzalloc(sizeof(*ev), gfp);
+        if (!ev)
+                return;
+
+        ev->type = EVENT_STOPPED;
+
+        spin_lock_irqsave(&wdev->event_lock, flags);
+        list_add_tail(&ev->list, &wdev->event_list);
+        spin_unlock_irqrestore(&wdev->event_lock, flags);
+        queue_work(cfg80211_wq, &rdev->event_work);
+}
+EXPORT_SYMBOL(cfg80211_stop_iface);
+
 static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                                          unsigned long state, void *ptr)
 {
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 681b8fa4355b..e9afbf10e756 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -185,6 +185,7 @@ enum cfg80211_event_type {
         EVENT_ROAMED,
         EVENT_DISCONNECTED,
         EVENT_IBSS_JOINED,
+        EVENT_STOPPED,
 };
 
 struct cfg80211_event {
@@ -281,6 +282,8 @@ int cfg80211_join_mesh(struct cfg80211_registered_device *rdev,
                        struct net_device *dev,
                        struct mesh_setup *setup,
                        const struct mesh_config *conf);
+int __cfg80211_leave_mesh(struct cfg80211_registered_device *rdev,
+                          struct net_device *dev);
 int cfg80211_leave_mesh(struct cfg80211_registered_device *rdev,
                         struct net_device *dev);
 int cfg80211_set_mesh_channel(struct cfg80211_registered_device *rdev,
@@ -288,6 +291,8 @@ int cfg80211_set_mesh_channel(struct cfg80211_registered_device *rdev,
                               struct cfg80211_chan_def *chandef);
 
 /* AP */
+int __cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
+                       struct net_device *dev, bool notify);
 int cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
                      struct net_device *dev, bool notify);
 
@@ -441,6 +446,8 @@ int cfg80211_validate_beacon_int(struct cfg80211_registered_device *rdev,
 void cfg80211_update_iface_num(struct cfg80211_registered_device *rdev,
                                enum nl80211_iftype iftype, int num);
 
+void __cfg80211_leave(struct cfg80211_registered_device *rdev,
+                      struct wireless_dev *wdev);
 void cfg80211_leave(struct cfg80211_registered_device *rdev,
                     struct wireless_dev *wdev);
 
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index 6b50588b709f..8f345da3ea5f 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -420,8 +420,8 @@ int cfg80211_ibss_wext_siwessid(struct net_device *dev,
         if (len > 0 && ssid[len - 1] == '\0')
                 len--;
 
+        memcpy(wdev->ssid, ssid, len);
         wdev->wext.ibss.ssid = wdev->ssid;
-        memcpy(wdev->wext.ibss.ssid, ssid, len);
         wdev->wext.ibss.ssid_len = len;
 
         wdev_lock(wdev);
diff --git a/net/wireless/mesh.c b/net/wireless/mesh.c
index 3ddfb7cd335e..092300b30c37 100644
--- a/net/wireless/mesh.c
+++ b/net/wireless/mesh.c
@@ -238,8 +238,8 @@ int cfg80211_set_mesh_channel(struct cfg80211_registered_device *rdev,
         return 0;
 }
 
-static int __cfg80211_leave_mesh(struct cfg80211_registered_device *rdev,
-                                 struct net_device *dev)
+int __cfg80211_leave_mesh(struct cfg80211_registered_device *rdev,
+                          struct net_device *dev)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         int err;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 0f1b18f209d6..62bdb1adaa4d 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -371,8 +371,8 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
-        [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_U16 },
-        [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_U16 },
+        [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
+        [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
@@ -386,6 +386,7 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
         [NL80211_ATTR_IFACE_SOCKET_OWNER] = { .type = NLA_FLAG },
+        [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 };
 
 /* policy for the key attributes */
@@ -970,8 +971,10 @@ static int nl80211_put_iface_combinations(struct wiphy *wiphy,
                                 c->max_interfaces))
                         goto nla_put_failure;
                 if (large &&
-                    nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
-                                c->radar_detect_widths))
+                    (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
+                                c->radar_detect_widths) ||
+                     nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
+                                c->radar_detect_regions)))
                         goto nla_put_failure;
 
                 nla_nest_end(msg, nl_combi);
@@ -1667,6 +1670,13 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
                         }
                         nla_nest_end(msg, nested);
                 }
+                state->split_start++;
+                break;
+        case 12:
+                if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
+                    nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
+                               rdev->wiphy.max_num_csa_counters))
+                        goto nla_put_failure;
 
                 /* done */
                 state->split_start = 0;
@@ -3640,6 +3650,10 @@ static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
                         sinfo->tx_failed))
                 goto nla_put_failure;
+        if ((sinfo->filled & STATION_INFO_EXPECTED_THROUGHPUT) &&
+            nla_put_u32(msg, NL80211_STA_INFO_EXPECTED_THROUGHPUT,
+                        sinfo->expected_throughput))
+                goto nla_put_failure;
         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
                         sinfo->beacon_loss_count))
@@ -5820,7 +5834,7 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,
                 return -EBUSY;
 
         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
-                                            NL80211_IFTYPE_UNSPECIFIED);
+                                            wdev->iftype);
         if (err < 0)
                 return err;
 
@@ -5861,6 +5875,7 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
         u8 radar_detect_width = 0;
         int err;
         bool need_new_beacon = false;
+        int len, i;
 
         if (!rdev->ops->channel_switch ||
             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
@@ -5919,26 +5934,55 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
                 return -EINVAL;
 
-        params.counter_offset_beacon =
-                nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
-        if (params.counter_offset_beacon >= params.beacon_csa.tail_len)
+        len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
+        if (!len || (len % sizeof(u16)))
                 return -EINVAL;
 
-        /* sanity check - counters should be the same */
-        if (params.beacon_csa.tail[params.counter_offset_beacon] !=
-            params.count)
+        params.n_counter_offsets_beacon = len / sizeof(u16);
+        if (rdev->wiphy.max_num_csa_counters &&
+            (params.n_counter_offsets_beacon >
+             rdev->wiphy.max_num_csa_counters))
                 return -EINVAL;
 
+        params.counter_offsets_beacon =
+                nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
+
+        /* sanity checks - counters should fit and be the same */
+        for (i = 0; i < params.n_counter_offsets_beacon; i++) {
+                u16 offset = params.counter_offsets_beacon[i];
+
+                if (offset >= params.beacon_csa.tail_len)
+                        return -EINVAL;
+
+                if (params.beacon_csa.tail[offset] != params.count)
+                        return -EINVAL;
+        }
+
         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
-                params.counter_offset_presp =
-                        nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
-                if (params.counter_offset_presp >=
-                    params.beacon_csa.probe_resp_len)
+                len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
+                if (!len || (len % sizeof(u16)))
                         return -EINVAL;
 
-                if (params.beacon_csa.probe_resp[params.counter_offset_presp] !=
-                    params.count)
+                params.n_counter_offsets_presp = len / sizeof(u16);
+                if (rdev->wiphy.max_num_csa_counters &&
+                    (params.n_counter_offsets_beacon >
+                     rdev->wiphy.max_num_csa_counters))
                         return -EINVAL;
+
+                params.counter_offsets_presp =
+                        nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
+
+                /* sanity checks - counters should fit and be the same */
+                for (i = 0; i < params.n_counter_offsets_presp; i++) {
+                        u16 offset = params.counter_offsets_presp[i];
+
+                        if (offset >= params.beacon_csa.probe_resp_len)
+                                return -EINVAL;
+
+                        if (params.beacon_csa.probe_resp[offset] !=
+                            params.count)
+                                return -EINVAL;
+                }
         }
 
 skip_beacons:
@@ -7784,6 +7828,27 @@ static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
         if (!chandef.chan && params.offchan)
                 return -EINVAL;
 
+        params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
+        params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
+
+        if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
+                int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
+                int i;
+
+                if (len % sizeof(u16))
+                        return -EINVAL;
+
+                params.n_csa_offsets = len / sizeof(u16);
+                params.csa_offsets =
+                        nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
+
+                /* check that all the offsets fit the frame */
+                for (i = 0; i < params.n_csa_offsets; i++) {
+                        if (params.csa_offsets[i] >= params.len)
+                                return -EINVAL;
+                }
+        }
+
         if (!params.dont_wait_for_ack) {
                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
                 if (!msg)
@@ -7797,8 +7862,6 @@ static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
                 }
         }
 
-        params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
-        params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
         params.chan = chandef.chan;
         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
         if (err)
@@ -8495,6 +8558,8 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
 
                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
                                     rem) {
+                        u8 *mask_pat;
+
                         nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
                                   nla_len(pat), NULL);
                         err = -EINVAL;
@@ -8518,19 +8583,18 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
                                 goto error;
                         new_triggers.patterns[i].pkt_offset = pkt_offset;
 
-                        new_triggers.patterns[i].mask =
-                                kmalloc(mask_len + pat_len, GFP_KERNEL);
-                        if (!new_triggers.patterns[i].mask) {
+                        mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
+                        if (!mask_pat) {
                                 err = -ENOMEM;
                                 goto error;
                         }
-                        new_triggers.patterns[i].pattern =
-                                new_triggers.patterns[i].mask + mask_len;
-                        memcpy(new_triggers.patterns[i].mask,
-                               nla_data(pat_tb[NL80211_PKTPAT_MASK]),
+                        new_triggers.patterns[i].mask = mask_pat;
+                        memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
                                mask_len);
+                        mask_pat += mask_len;
+                        new_triggers.patterns[i].pattern = mask_pat;
                         new_triggers.patterns[i].pattern_len = pat_len;
-                        memcpy(new_triggers.patterns[i].pattern,
+                        memcpy(mask_pat,
                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
                                pat_len);
                         i++;
@@ -8722,6 +8786,8 @@ static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
 
         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
                             rem) {
+                u8 *mask_pat;
+
                 nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
                           nla_len(pat), NULL);
                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
@@ -8743,17 +8809,19 @@ static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
                         return -EINVAL;
                 new_rule->patterns[i].pkt_offset = pkt_offset;
 
-                new_rule->patterns[i].mask =
-                        kmalloc(mask_len + pat_len, GFP_KERNEL);
-                if (!new_rule->patterns[i].mask)
+                mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
+                if (!mask_pat)
                         return -ENOMEM;
-                new_rule->patterns[i].pattern =
-                        new_rule->patterns[i].mask + mask_len;
-                memcpy(new_rule->patterns[i].mask,
-                       nla_data(pat_tb[NL80211_PKTPAT_MASK]), mask_len);
+
+                new_rule->patterns[i].mask = mask_pat;
+                memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
+                       mask_len);
+
+                mask_pat += mask_len;
+                new_rule->patterns[i].pattern = mask_pat;
                 new_rule->patterns[i].pattern_len = pat_len;
-                memcpy(new_rule->patterns[i].pattern,
-                       nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), pat_len);
+                memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
+                       pat_len);
                 i++;
         }
 
diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h
index 00cdf73ba6c4..d95bbe348138 100644
--- a/net/wireless/rdev-ops.h
+++ b/net/wireless/rdev-ops.h
@@ -199,7 +199,7 @@ static inline int rdev_change_station(struct cfg80211_registered_device *rdev,
 }
 
 static inline int rdev_get_station(struct cfg80211_registered_device *rdev,
-                                   struct net_device *dev, u8 *mac,
+                                   struct net_device *dev, const u8 *mac,
                                    struct station_info *sinfo)
 {
         int ret;
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index e78f532aaa5b..558b0e3a02d8 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1876,7 +1876,8 @@ static void reg_process_hint(struct regulatory_request *reg_request)
         case NL80211_REGDOM_SET_BY_USER:
                 treatment = reg_process_hint_user(reg_request);
                 if (treatment == REG_REQ_IGNORE ||
-                    treatment == REG_REQ_ALREADY_SET)
+                    treatment == REG_REQ_ALREADY_SET ||
+                    treatment == REG_REQ_USER_HINT_HANDLED)
                         return;
                 queue_delayed_work(system_power_efficient_wq,
                                    &reg_timeout, msecs_to_jiffies(3142));
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index e7329bb6a323..0798c62e6085 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -891,6 +891,7 @@ cfg80211_inform_bss_width(struct wiphy *wiphy,
         struct cfg80211_bss_ies *ies;
         struct ieee80211_channel *channel;
         struct cfg80211_internal_bss tmp = {}, *res;
+        bool signal_valid;
 
         if (WARN_ON(!wiphy))
                 return NULL;
@@ -927,8 +928,9 @@ cfg80211_inform_bss_width(struct wiphy *wiphy,
         rcu_assign_pointer(tmp.pub.beacon_ies, ies);
         rcu_assign_pointer(tmp.pub.ies, ies);
 
-        res = cfg80211_bss_update(wiphy_to_rdev(wiphy), &tmp,
-                                  rx_channel == channel);
+        signal_valid = abs(rx_channel->center_freq - channel->center_freq) <=
+                wiphy->max_adj_channel_rssi_comp;
+        res = cfg80211_bss_update(wiphy_to_rdev(wiphy), &tmp, signal_valid);
         if (!res)
                 return NULL;
 
@@ -952,6 +954,7 @@ cfg80211_inform_bss_width_frame(struct wiphy *wiphy,
         struct cfg80211_internal_bss tmp = {}, *res;
         struct cfg80211_bss_ies *ies;
         struct ieee80211_channel *channel;
+        bool signal_valid;
         size_t ielen = len - offsetof(struct ieee80211_mgmt,
                                       u.probe_resp.variable);
 
@@ -999,8 +1002,9 @@ cfg80211_inform_bss_width_frame(struct wiphy *wiphy,
         tmp.pub.beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
         tmp.pub.capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
 
-        res = cfg80211_bss_update(wiphy_to_rdev(wiphy), &tmp,
-                                  rx_channel == channel);
+        signal_valid = abs(rx_channel->center_freq - channel->center_freq) <=
+                wiphy->max_adj_channel_rssi_comp;
+        res = cfg80211_bss_update(wiphy_to_rdev(wiphy), &tmp, signal_valid);
         if (!res)
                 return NULL;
 
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 0c0844b585d1..8bbeeb302216 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -149,7 +149,8 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
         case CFG80211_CONN_SCAN_AGAIN:
                 return cfg80211_conn_scan(wdev);
         case CFG80211_CONN_AUTHENTICATE_NEXT:
-                BUG_ON(!rdev->ops->auth);
+                if (WARN_ON(!rdev->ops->auth))
+                        return -EOPNOTSUPP;
                 wdev->conn->state = CFG80211_CONN_AUTHENTICATING;
                 return cfg80211_mlme_auth(rdev, wdev->netdev,
                                           params->channel, params->auth_type,
@@ -161,7 +162,8 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
         case CFG80211_CONN_AUTH_FAILED:
                 return -ENOTCONN;
         case CFG80211_CONN_ASSOCIATE_NEXT:
-                BUG_ON(!rdev->ops->assoc);
+                if (WARN_ON(!rdev->ops->assoc))
+                        return -EOPNOTSUPP;
                 wdev->conn->state = CFG80211_CONN_ASSOCIATING;
                 if (wdev->conn->prev_bssid_valid)
                         req.prev_bssid = wdev->conn->prev_bssid;
@@ -877,7 +879,7 @@ void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
 }
 
 void cfg80211_disconnected(struct net_device *dev, u16 reason,
-                           u8 *ie, size_t ie_len, gfp_t gfp)
+                           const u8 *ie, size_t ie_len, gfp_t gfp)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index f3c13ff4d04c..560ed77084e9 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h
@@ -1876,29 +1876,33 @@ TRACE_EVENT(rdev_channel_switch,
                 WIPHY_ENTRY
                 NETDEV_ENTRY
                 CHAN_DEF_ENTRY
-                __field(u16, counter_offset_beacon)
-                __field(u16, counter_offset_presp)
                 __field(bool, radar_required)
                 __field(bool, block_tx)
                 __field(u8, count)
+                __dynamic_array(u16, bcn_ofs, params->n_counter_offsets_beacon)
+                __dynamic_array(u16, pres_ofs, params->n_counter_offsets_presp)
         ),
         TP_fast_assign(
                 WIPHY_ASSIGN;
                 NETDEV_ASSIGN;
                 CHAN_DEF_ASSIGN(&params->chandef);
-                __entry->counter_offset_beacon = params->counter_offset_beacon;
-                __entry->counter_offset_presp = params->counter_offset_presp;
                 __entry->radar_required = params->radar_required;
                 __entry->block_tx = params->block_tx;
                 __entry->count = params->count;
+                memcpy(__get_dynamic_array(bcn_ofs),
+                       params->counter_offsets_beacon,
+                       params->n_counter_offsets_beacon * sizeof(u16));
+
+                /* probe response offsets are optional */
+                if (params->n_counter_offsets_presp)
+                        memcpy(__get_dynamic_array(pres_ofs),
+                               params->counter_offsets_presp,
+                               params->n_counter_offsets_presp * sizeof(u16));
         ),
         TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", " CHAN_DEF_PR_FMT
-                  ", block_tx: %d, count: %u, radar_required: %d"
-                  ", counter offsets (beacon/presp): %u/%u",
+                  ", block_tx: %d, count: %u, radar_required: %d",
                   WIPHY_PR_ARG, NETDEV_PR_ARG, CHAN_DEF_PR_ARG,
-                  __entry->block_tx, __entry->count, __entry->radar_required,
-                  __entry->counter_offset_beacon,
-                  __entry->counter_offset_presp)
+                  __entry->block_tx, __entry->count, __entry->radar_required)
 );
 
 TRACE_EVENT(rdev_set_qos_map,
@@ -2636,6 +2640,21 @@ TRACE_EVENT(cfg80211_ft_event,
                   WIPHY_PR_ARG, NETDEV_PR_ARG, MAC_PR_ARG(target_ap))
 );
 
+TRACE_EVENT(cfg80211_stop_iface,
+        TP_PROTO(struct wiphy *wiphy, struct wireless_dev *wdev),
+        TP_ARGS(wiphy, wdev),
+        TP_STRUCT__entry(
+                WIPHY_ENTRY
+                WDEV_ENTRY
+        ),
+        TP_fast_assign(
+                WIPHY_ASSIGN;
+                WDEV_ASSIGN;
+        ),
+        TP_printk(WIPHY_PR_FMT ", " WDEV_PR_FMT,
+                  WIPHY_PR_ARG, WDEV_PR_ARG)
+);
+
 #endif /* !__RDEV_OPS_TRACE || TRACE_HEADER_MULTI_READ */
 
 #undef TRACE_INCLUDE_PATH
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 7c47fa07b276..728f1c0dc70d 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -476,7 +476,8 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
 EXPORT_SYMBOL(ieee80211_data_to_8023);
 
 int ieee80211_data_from_8023(struct sk_buff *skb, const u8 *addr,
-                             enum nl80211_iftype iftype, u8 *bssid, bool qos)
+                             enum nl80211_iftype iftype,
+                             const u8 *bssid, bool qos)
 {
         struct ieee80211_hdr hdr;
         u16 hdrlen, ethertype;
@@ -839,6 +840,9 @@ void cfg80211_process_wdev_events(struct wireless_dev *wdev)
                         __cfg80211_ibss_joined(wdev->netdev, ev->ij.bssid,
                                                ev->ij.channel);
                         break;
+                case EVENT_STOPPED:
+                        __cfg80211_leave(wiphy_to_rdev(wdev->wiphy), wdev);
+                        break;
                 }
                 wdev_unlock(wdev);
 
@@ -1271,10 +1275,20 @@ int cfg80211_iter_combinations(struct wiphy *wiphy,
                                             void *data),
                                void *data)
 {
+        const struct ieee80211_regdomain *regdom;
+        enum nl80211_dfs_regions region = 0;
         int i, j, iftype;
         int num_interfaces = 0;
         u32 used_iftypes = 0;
 
+        if (radar_detect) {
+                rcu_read_lock();
+                regdom = rcu_dereference(cfg80211_regdomain);
+                if (regdom)
+                        region = regdom->dfs_region;
+                rcu_read_unlock();
+        }
+
         for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
                 num_interfaces += iftype_num[iftype];
                 if (iftype_num[iftype] > 0 &&
@@ -1315,6 +1329,10 @@ int cfg80211_iter_combinations(struct wiphy *wiphy,
                 if (radar_detect != (c->radar_detect_widths & radar_detect))
                         goto cont;
 
+                if (radar_detect && c->radar_detect_regions &&
+                    !(c->radar_detect_regions & BIT(region)))
+                        goto cont;
+
                 /* Finally check that all iftypes that we're currently
                  * using are actually part of this combination. If they
                  * aren't then we can't use this combination and have
@@ -1528,6 +1546,24 @@ unsigned int ieee80211_get_num_supported_channels(struct wiphy *wiphy)
 }
 EXPORT_SYMBOL(ieee80211_get_num_supported_channels);
 
+int cfg80211_get_station(struct net_device *dev, const u8 *mac_addr,
+                         struct station_info *sinfo)
+{
+        struct cfg80211_registered_device *rdev;
+        struct wireless_dev *wdev;
+
+        wdev = dev->ieee80211_ptr;
+        if (!wdev)
+                return -EOPNOTSUPP;
+
+        rdev = wiphy_to_rdev(wdev->wiphy);
+        if (!rdev->ops->get_station)
+                return -EOPNOTSUPP;
+
+        return rdev_get_station(rdev, dev, mac_addr, sinfo);
+}
+EXPORT_SYMBOL(cfg80211_get_station);
+
 /* See IEEE 802.1H for LLC/SNAP encapsulation/decapsulation */
 /* Ethernet-II snap header (RFC1042 for most EtherTypes) */
 const unsigned char rfc1042_header[] __aligned(2) =