Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next

Kalle Valo says:

====================
pull-request: wireless-drivers-next 2015-01-22

now a bigger pull request for net-next. Rafal found a UTF-8 bug in
patchwork[1] and because of that two commits (d0c102f70aec and
d0f66df5392a) have his name corrupted:

    Acked-by: Rafa? Mi?ecki <zajec5@gmail.com>

Somehow I failed to spot that when I commited the patches. As rebasing
public git trees is bad, I thought we can live with these and decided
not to rebase. But I'll pay close attention to this in the future to
make sure that it won't happen again. Also we requested an update to
patchwork.kernel.org, the latest patchwork doesn't seem to have this
bug.

Also please note this pull request also adds one DT binding doc, but
this was reviewed in the device tree list:

 .../bindings/net/wireless/qcom,ath10k.txt          |   30 +

Please let me know if you have any issues.

[1] https://lists.ozlabs.org/pipermail/patchwork/2015-January/001261.html
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

233 files changed, 13702 insertions, 3323 deletions

diff --git a/Documentation/devicetree/bindings/net/wireless/qcom,ath10k.txt b/Documentation/devicetree/bindings/net/wireless/qcom,ath10k.txt
new file mode 100644
index 000000000000..edefc26c6204
--- /dev/null
+++ b/Documentation/devicetree/bindings/net/wireless/qcom,ath10k.txt
@@ -0,0 +1,30 @@
+* Qualcomm Atheros ath10k wireless devices
+
+For ath10k devices the calibration data can be provided through Device
+Tree. The node is a child node of the PCI controller.
+
+Required properties:
+-compatible : Should be "qcom,ath10k"
+
+Optional properties:
+- qcom,ath10k-calibration-data : calibration data as an array, the
+                                 length can vary between hw versions
+
+
+Example:
+
+pci {
+        pcie@0 {
+                reg = <0 0 0 0 0>;
+                #interrupt-cells = <1>;
+                #size-cells = <2>;
+                #address-cells = <3>;
+                device_type = "pci";
+
+                ath10k@0,0 {
+                        reg = <0 0 0 0 0>;
+                        device_type = "pci";
+                        qcom,ath10k-calibration-data = [ 01 02 03 ... ];
+                };
+        };
+};
diff --git a/MAINTAINERS b/MAINTAINERS
index e1ff4ce5bcab..aca34098415d 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1657,7 +1657,6 @@ M:	Jiri Slaby <jirislaby@gmail.com>
 M:      Nick Kossifidis <mickflemm@gmail.com>
 M:      "Luis R. Rodriguez" <mcgrof@do-not-panic.com>
 L:      linux-wireless@vger.kernel.org
-L:      ath5k-devel@lists.ath5k.org
 W:      http://wireless.kernel.org/en/users/Drivers/ath5k
 S:      Maintained
 F:      drivers/net/wireless/ath/ath5k/
diff --git a/drivers/bcma/bcma_private.h b/drivers/bcma/bcma_private.h
index 314ae4032f3e..3f314c98d089 100644
--- a/drivers/bcma/bcma_private.h
+++ b/drivers/bcma/bcma_private.h
@@ -25,22 +25,18 @@ struct bcma_bus;
 bool bcma_wait_value(struct bcma_device *core, u16 reg, u32 mask, u32 value,
                      int timeout);
 void bcma_prepare_core(struct bcma_bus *bus, struct bcma_device *core);
+void bcma_init_bus(struct bcma_bus *bus);
 int bcma_bus_register(struct bcma_bus *bus);
 void bcma_bus_unregister(struct bcma_bus *bus);
-int __init bcma_bus_early_register(struct bcma_bus *bus,
-                                   struct bcma_device *core_cc,
-                                   struct bcma_device *core_mips);
+int __init bcma_bus_early_register(struct bcma_bus *bus);
 #ifdef CONFIG_PM
 int bcma_bus_suspend(struct bcma_bus *bus);
 int bcma_bus_resume(struct bcma_bus *bus);
 #endif
 
 /* scan.c */
+void bcma_detect_chip(struct bcma_bus *bus);
 int bcma_bus_scan(struct bcma_bus *bus);
-int __init bcma_bus_scan_early(struct bcma_bus *bus,
-                               struct bcma_device_id *match,
-                               struct bcma_device *core);
-void bcma_init_bus(struct bcma_bus *bus);
 
 /* sprom.c */
 int bcma_sprom_get(struct bcma_bus *bus);
diff --git a/drivers/bcma/driver_chipcommon.c b/drivers/bcma/driver_chipcommon.c
index 19f679667ca4..84d4a95e6caf 100644
--- a/drivers/bcma/driver_chipcommon.c
+++ b/drivers/bcma/driver_chipcommon.c
@@ -79,7 +79,9 @@ static int bcma_chipco_watchdog_ticks_per_ms(struct bcma_drv_cc *cc)
 
         if (cc->capabilities & BCMA_CC_CAP_PMU) {
                 if (bus->chipinfo.id == BCMA_CHIP_ID_BCM4706)
-                        /* 4706 CC and PMU watchdogs are clocked at 1/4 of ALP clock */
+                        /* 4706 CC and PMU watchdogs are clocked at 1/4 of ALP
+                         * clock
+                         */
                         return bcma_chipco_get_alp_clock(cc) / 4000;
                 else
                         /* based on 32KHz ILP clock */
@@ -97,7 +99,8 @@ int bcma_chipco_watchdog_register(struct bcma_drv_cc *cc)
         wdt.driver_data = cc;
         wdt.timer_set = bcma_chipco_watchdog_timer_set_wdt;
         wdt.timer_set_ms = bcma_chipco_watchdog_timer_set_ms_wdt;
-        wdt.max_timer_ms = bcma_chipco_watchdog_get_max_timer(cc) / cc->ticks_per_ms;
+        wdt.max_timer_ms =
+                bcma_chipco_watchdog_get_max_timer(cc) / cc->ticks_per_ms;
 
         pdev = platform_device_register_data(NULL, "bcm47xx-wdt",
                                              cc->core->bus->num, &wdt,
@@ -335,7 +338,8 @@ void bcma_chipco_serial_init(struct bcma_drv_cc *cc)
                                        | BCMA_CC_CORECTL_UARTCLKEN);
                 }
         } else {
-                bcma_err(cc->core->bus, "serial not supported on this device ccrev: 0x%x\n", ccrev);
+                bcma_err(cc->core->bus, "serial not supported on this device ccrev: 0x%x\n",
+                         ccrev);
                 return;
         }
 
diff --git a/drivers/bcma/host_soc.c b/drivers/bcma/host_soc.c
index 335cbcfd945b..2dce34789329 100644
--- a/drivers/bcma/host_soc.c
+++ b/drivers/bcma/host_soc.c
@@ -193,7 +193,7 @@ int __init bcma_host_soc_init(struct bcma_soc *soc)
         int err;
 
         /* Scan bus and initialize it */
-        err = bcma_bus_early_register(bus, &soc->core_cc, &soc->core_mips);
+        err = bcma_bus_early_register(bus);
         if (err)
                 iounmap(bus->mmio);
 
diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
index 534e1337766d..c3c5e0a2d5be 100644
--- a/drivers/bcma/main.c
+++ b/drivers/bcma/main.c
@@ -268,6 +268,18 @@ void bcma_prepare_core(struct bcma_bus *bus, struct bcma_device *core)
         }
 }
 
+void bcma_init_bus(struct bcma_bus *bus)
+{
+        mutex_lock(&bcma_buses_mutex);
+        bus->num = bcma_bus_next_num++;
+        mutex_unlock(&bcma_buses_mutex);
+
+        INIT_LIST_HEAD(&bus->cores);
+        bus->nr_cores = 0;
+
+        bcma_detect_chip(bus);
+}
+
 static void bcma_register_core(struct bcma_bus *bus, struct bcma_device *core)
 {
         int err;
@@ -369,10 +381,6 @@ int bcma_bus_register(struct bcma_bus *bus)
         int err;
         struct bcma_device *core;
 
-        mutex_lock(&bcma_buses_mutex);
-        bus->num = bcma_bus_next_num++;
-        mutex_unlock(&bcma_buses_mutex);
-
         /* Scan for devices (cores) */
         err = bcma_bus_scan(bus);
         if (err) {
@@ -481,35 +489,20 @@ void bcma_bus_unregister(struct bcma_bus *bus)
         kfree(cores[0]);
 }
 
-int __init bcma_bus_early_register(struct bcma_bus *bus,
-                                   struct bcma_device *core_cc,
-                                   struct bcma_device *core_mips)
+/*
+ * This is a special version of bus registration function designed for SoCs.
+ * It scans bus and performs basic initialization of main cores only.
+ * Please note it requires memory allocation, however it won't try to sleep.
+ */
+int __init bcma_bus_early_register(struct bcma_bus *bus)
 {
         int err;
         struct bcma_device *core;
-        struct bcma_device_id match;
 
-        match.manuf = BCMA_MANUF_BCM;
-        match.id = bcma_cc_core_id(bus);
-        match.class = BCMA_CL_SIM;
-        match.rev = BCMA_ANY_REV;
-
-        /* Scan for chip common core */
-        err = bcma_bus_scan_early(bus, &match, core_cc);
-        if (err) {
-                bcma_err(bus, "Failed to scan for common core: %d\n", err);
-                return -1;
-        }
-
-        match.manuf = BCMA_MANUF_MIPS;
-        match.id = BCMA_CORE_MIPS_74K;
-        match.class = BCMA_CL_SIM;
-        match.rev = BCMA_ANY_REV;
-
-        /* Scan for mips core */
-        err = bcma_bus_scan_early(bus, &match, core_mips);
+        /* Scan for devices (cores) */
+        err = bcma_bus_scan(bus);
         if (err) {
-                bcma_err(bus, "Failed to scan for mips core: %d\n", err);
+                bcma_err(bus, "Failed to scan bus: %d\n", err);
                 return -1;
         }
 
diff --git a/drivers/bcma/scan.c b/drivers/bcma/scan.c
index 917520776879..df806b9c5490 100644
--- a/drivers/bcma/scan.c
+++ b/drivers/bcma/scan.c
@@ -435,15 +435,12 @@ static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr,
         return 0;
 }
 
-void bcma_init_bus(struct bcma_bus *bus)
+void bcma_detect_chip(struct bcma_bus *bus)
 {
         s32 tmp;
         struct bcma_chipinfo *chipinfo = &(bus->chipinfo);
         char chip_id[8];
 
-        INIT_LIST_HEAD(&bus->cores);
-        bus->nr_cores = 0;
-
         bcma_scan_switch_core(bus, BCMA_ADDR_BASE);
 
         tmp = bcma_scan_read32(bus, 0, BCMA_CC_ID);
@@ -464,6 +461,10 @@ int bcma_bus_scan(struct bcma_bus *bus)
 
         int err, core_num = 0;
 
+        /* Skip if bus was already scanned (e.g. during early register) */
+        if (bus->nr_cores)
+                return 0;
+
         erombase = bcma_scan_read32(bus, 0, BCMA_CC_EROM);
         if (bus->hosttype == BCMA_HOSTTYPE_SOC) {
                 eromptr = ioremap_nocache(erombase, BCMA_CORE_SIZE);
@@ -522,61 +523,3 @@ out:
 
         return err;
 }
-
-int __init bcma_bus_scan_early(struct bcma_bus *bus,
-                               struct bcma_device_id *match,
-                               struct bcma_device *core)
-{
-        u32 erombase;
-        u32 __iomem *eromptr, *eromend;
-
-        int err = -ENODEV;
-        int core_num = 0;
-
-        erombase = bcma_scan_read32(bus, 0, BCMA_CC_EROM);
-        if (bus->hosttype == BCMA_HOSTTYPE_SOC) {
-                eromptr = ioremap_nocache(erombase, BCMA_CORE_SIZE);
-                if (!eromptr)
-                        return -ENOMEM;
-        } else {
-                eromptr = bus->mmio;
-        }
-
-        eromend = eromptr + BCMA_CORE_SIZE / sizeof(u32);
-
-        bcma_scan_switch_core(bus, erombase);
-
-        while (eromptr < eromend) {
-                memset(core, 0, sizeof(*core));
-                INIT_LIST_HEAD(&core->list);
-                core->bus = bus;
-
-                err = bcma_get_next_core(bus, &eromptr, match, core_num, core);
-                if (err == -ENODEV) {
-                        core_num++;
-                        continue;
-                } else if (err == -ENXIO)
-                        continue;
-                else if (err == -ESPIPE)
-                        break;
-                else if (err < 0)
-                        goto out;
-
-                core->core_index = core_num++;
-                bus->nr_cores++;
-                bcma_info(bus, "Core %d found: %s (manuf 0x%03X, id 0x%03X, rev 0x%02X, class 0x%X)\n",
-                          core->core_index, bcma_device_name(&core->id),
-                          core->id.manuf, core->id.id, core->id.rev,
-                          core->id.class);
-
-                list_add_tail(&core->list, &bus->cores);
-                err = 0;
-                break;
-        }
-
-out:
-        if (bus->hosttype == BCMA_HOSTTYPE_SOC)
-                iounmap(eromptr);
-
-        return err;
-}
diff --git a/drivers/net/wireless/adm8211.c b/drivers/net/wireless/adm8211.c
index 17fcaabb2687..f07a61899545 100644
--- a/drivers/net/wireless/adm8211.c
+++ b/drivers/net/wireless/adm8211.c
@@ -1837,6 +1837,7 @@ static int adm8211_probe(struct pci_dev *pdev,
         if (!priv->map) {
                 printk(KERN_ERR "%s (adm8211): Cannot map device memory\n",
                        pci_name(pdev));
+                err = -ENOMEM;
                 goto err_free_dev;
         }
 
diff --git a/drivers/net/wireless/ath/ath10k/Makefile b/drivers/net/wireless/ath/ath10k/Makefile
index 8b1b1adb477a..ffa3b1a8745f 100644
--- a/drivers/net/wireless/ath/ath10k/Makefile
+++ b/drivers/net/wireless/ath/ath10k/Makefile
@@ -8,11 +8,13 @@ ath10k_core-y += mac.o \
                  htt_tx.o \
                  txrx.o \
                  wmi.o \
+                 wmi-tlv.o \
                  bmi.o
 
 ath10k_core-$(CONFIG_ATH10K_DEBUGFS) += spectral.o
 ath10k_core-$(CONFIG_NL80211_TESTMODE) += testmode.o
 ath10k_core-$(CONFIG_ATH10K_TRACING) += trace.o
+ath10k_core-$(CONFIG_THERMAL) += thermal.o
 
 obj-$(CONFIG_ATH10K_PCI) += ath10k_pci.o
 ath10k_pci-y += pci.o \
diff --git a/drivers/net/wireless/ath/ath10k/ce.c b/drivers/net/wireless/ath/ath10k/ce.c
index a156e6e48708..42ec79327943 100644
--- a/drivers/net/wireless/ath/ath10k/ce.c
+++ b/drivers/net/wireless/ath/ath10k/ce.c
@@ -1093,6 +1093,8 @@ int ath10k_ce_alloc_pipe(struct ath10k *ar, int ce_id,
                      (CE_HTT_H2T_MSG_SRC_NENTRIES - 1));
         BUILD_BUG_ON(2*TARGET_10X_NUM_MSDU_DESC >
                      (CE_HTT_H2T_MSG_SRC_NENTRIES - 1));
+        BUILD_BUG_ON(2*TARGET_TLV_NUM_MSDU_DESC >
+                     (CE_HTT_H2T_MSG_SRC_NENTRIES - 1));
 
         ce_state->ar = ar;
         ce_state->id = ce_id;
diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
index 7762061a1944..2d0671ebcf2b 100644
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -17,6 +17,7 @@
 
 #include <linux/module.h>
 #include <linux/firmware.h>
+#include <linux/of.h>
 
 #include "core.h"
 #include "mac.h"
@@ -27,20 +28,18 @@
 #include "debug.h"
 #include "htt.h"
 #include "testmode.h"
+#include "wmi-ops.h"
 
 unsigned int ath10k_debug_mask;
 static bool uart_print;
-static unsigned int ath10k_p2p;
 static bool skip_otp;
 
 module_param_named(debug_mask, ath10k_debug_mask, uint, 0644);
 module_param(uart_print, bool, 0644);
-module_param_named(p2p, ath10k_p2p, uint, 0644);
 module_param(skip_otp, bool, 0644);
 
 MODULE_PARM_DESC(debug_mask, "Debugging mask");
 MODULE_PARM_DESC(uart_print, "Uart target debugging");
-MODULE_PARM_DESC(p2p, "Enable ath10k P2P support");
 MODULE_PARM_DESC(skip_otp, "Skip otp failure for calibration in testmode");
 
 static const struct ath10k_hw_params ath10k_hw_params_list[] = {
@@ -48,11 +47,14 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
                 .id = QCA988X_HW_2_0_VERSION,
                 .name = "qca988x hw2.0",
                 .patch_load_addr = QCA988X_HW_2_0_PATCH_LOAD_ADDR,
+                .uart_pin = 7,
                 .fw = {
                         .dir = QCA988X_HW_2_0_FW_DIR,
                         .fw = QCA988X_HW_2_0_FW_FILE,
                         .otp = QCA988X_HW_2_0_OTP_FILE,
                         .board = QCA988X_HW_2_0_BOARD_DATA_FILE,
+                        .board_size = QCA988X_BOARD_DATA_SZ,
+                        .board_ext_size = QCA988X_BOARD_EXT_DATA_SZ,
                 },
         },
 };
@@ -146,8 +148,8 @@ static const struct firmware *ath10k_fetch_fw_file(struct ath10k *ar,
 static int ath10k_push_board_ext_data(struct ath10k *ar, const void *data,
                                       size_t data_len)
 {
-        u32 board_data_size = QCA988X_BOARD_DATA_SZ;
-        u32 board_ext_data_size = QCA988X_BOARD_EXT_DATA_SZ;
+        u32 board_data_size = ar->hw_params.fw.board_size;
+        u32 board_ext_data_size = ar->hw_params.fw.board_ext_size;
         u32 board_ext_data_addr;
         int ret;
 
@@ -193,7 +195,7 @@ static int ath10k_push_board_ext_data(struct ath10k *ar, const void *data,
 static int ath10k_download_board_data(struct ath10k *ar, const void *data,
                                       size_t data_len)
 {
-        u32 board_data_size = QCA988X_BOARD_DATA_SZ;
+        u32 board_data_size = ar->hw_params.fw.board_size;
         u32 address;
         int ret;
 
@@ -249,6 +251,63 @@ static int ath10k_download_cal_file(struct ath10k *ar)
         return 0;
 }
 
+static int ath10k_download_cal_dt(struct ath10k *ar)
+{
+        struct device_node *node;
+        int data_len;
+        void *data;
+        int ret;
+
+        node = ar->dev->of_node;
+        if (!node)
+                /* Device Tree is optional, don't print any warnings if
+                 * there's no node for ath10k.
+                 */
+                return -ENOENT;
+
+        if (!of_get_property(node, "qcom,ath10k-calibration-data",
+                             &data_len)) {
+                /* The calibration data node is optional */
+                return -ENOENT;
+        }
+
+        if (data_len != QCA988X_CAL_DATA_LEN) {
+                ath10k_warn(ar, "invalid calibration data length in DT: %d\n",
+                            data_len);
+                ret = -EMSGSIZE;
+                goto out;
+        }
+
+        data = kmalloc(data_len, GFP_KERNEL);
+        if (!data) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        ret = of_property_read_u8_array(node, "qcom,ath10k-calibration-data",
+                                        data, data_len);
+        if (ret) {
+                ath10k_warn(ar, "failed to read calibration data from DT: %d\n",
+                            ret);
+                goto out_free;
+        }
+
+        ret = ath10k_download_board_data(ar, data, data_len);
+        if (ret) {
+                ath10k_warn(ar, "failed to download calibration data from Device Tree: %d\n",
+                            ret);
+                goto out_free;
+        }
+
+        ret = 0;
+
+out_free:
+        kfree(data);
+
+out:
+        return ret;
+}
+
 static int ath10k_download_and_run_otp(struct ath10k *ar)
 {
         u32 result, address = ar->hw_params.patch_load_addr;
@@ -447,7 +506,7 @@ static int ath10k_core_fetch_firmware_api_n(struct ath10k *ar, const char *name)
         int ie_id, i, index, bit, ret;
         struct ath10k_fw_ie *hdr;
         const u8 *data;
-        __le32 *timestamp;
+        __le32 *timestamp, *version;
 
         /* first fetch the firmware file (firmware-*.bin) */
         ar->firmware = ath10k_fetch_fw_file(ar, ar->hw_params.fw.dir, name);
@@ -562,6 +621,17 @@ static int ath10k_core_fetch_firmware_api_n(struct ath10k *ar, const char *name)
                         ar->otp_len = ie_len;
 
                         break;
+                case ATH10K_FW_IE_WMI_OP_VERSION:
+                        if (ie_len != sizeof(u32))
+                                break;
+
+                        version = (__le32 *)data;
+
+                        ar->wmi.op_version = le32_to_cpup(version);
+
+                        ath10k_dbg(ar, ATH10K_DBG_BOOT, "found fw ie wmi op version %d\n",
+                                   ar->wmi.op_version);
+                        break;
                 default:
                         ath10k_warn(ar, "Unknown FW IE: %u\n",
                                     le32_to_cpu(hdr->id));
@@ -582,13 +652,6 @@ static int ath10k_core_fetch_firmware_api_n(struct ath10k *ar, const char *name)
                 goto err;
         }
 
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10_2, ar->fw_features) &&
-            !test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                ath10k_err(ar, "feature bits corrupted: 10.2 feature requires 10.x feature to be set as well");
-                ret = -EINVAL;
-                goto err;
-        }
-
         /* now fetch the board file */
         if (ar->hw_params.fw.board == NULL) {
                 ath10k_err(ar, "board data file not defined");
@@ -624,6 +687,13 @@ static int ath10k_core_fetch_firmware_files(struct ath10k *ar)
         /* calibration file is optional, don't check for any errors */
         ath10k_fetch_cal_file(ar);
 
+        ar->fw_api = 4;
+        ath10k_dbg(ar, ATH10K_DBG_BOOT, "trying fw api %d\n", ar->fw_api);
+
+        ret = ath10k_core_fetch_firmware_api_n(ar, ATH10K_FW_API4_FILE);
+        if (ret == 0)
+                goto success;
+
         ar->fw_api = 3;
         ath10k_dbg(ar, ATH10K_DBG_BOOT, "trying fw api %d\n", ar->fw_api);
 
@@ -662,7 +732,17 @@ static int ath10k_download_cal_data(struct ath10k *ar)
         }
 
         ath10k_dbg(ar, ATH10K_DBG_BOOT,
-                   "boot did not find a calibration file, try OTP next: %d\n",
+                   "boot did not find a calibration file, try DT next: %d\n",
+                   ret);
+
+        ret = ath10k_download_cal_dt(ar);
+        if (ret == 0) {
+                ar->cal_mode = ATH10K_CAL_MODE_DT;
+                goto done;
+        }
+
+        ath10k_dbg(ar, ATH10K_DBG_BOOT,
+                   "boot did not find DT entry, try OTP next: %d\n",
                    ret);
 
         ret = ath10k_download_and_run_otp(ar);
@@ -696,7 +776,7 @@ static int ath10k_init_uart(struct ath10k *ar)
         if (!uart_print)
                 return 0;
 
-        ret = ath10k_bmi_write32(ar, hi_dbg_uart_txpin, 7);
+        ret = ath10k_bmi_write32(ar, hi_dbg_uart_txpin, ar->hw_params.uart_pin);
         if (ret) {
                 ath10k_warn(ar, "could not enable UART prints (%d)\n", ret);
                 return ret;
@@ -764,6 +844,7 @@ static void ath10k_core_restart(struct work_struct *work)
         complete_all(&ar->offchan_tx_completed);
         complete_all(&ar->install_key_done);
         complete_all(&ar->vdev_setup_done);
+        complete_all(&ar->thermal.wmi_sync);
         wake_up(&ar->htt.empty_tx_wq);
         wake_up(&ar->wmi.tx_credits_wq);
         wake_up(&ar->peer_mapping_wq);
@@ -799,15 +880,62 @@ static void ath10k_core_restart(struct work_struct *work)
         mutex_unlock(&ar->conf_mutex);
 }
 
-static void ath10k_core_init_max_sta_count(struct ath10k *ar)
+static int ath10k_core_init_firmware_features(struct ath10k *ar)
 {
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                ar->max_num_peers = TARGET_10X_NUM_PEERS;
-                ar->max_num_stations = TARGET_10X_NUM_STATIONS;
-        } else {
+        if (test_bit(ATH10K_FW_FEATURE_WMI_10_2, ar->fw_features) &&
+            !test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
+                ath10k_err(ar, "feature bits corrupted: 10.2 feature requires 10.x feature to be set as well");
+                return -EINVAL;
+        }
+
+        if (ar->wmi.op_version >= ATH10K_FW_WMI_OP_VERSION_MAX) {
+                ath10k_err(ar, "unsupported WMI OP version (max %d): %d\n",
+                           ATH10K_FW_WMI_OP_VERSION_MAX, ar->wmi.op_version);
+                return -EINVAL;
+        }
+
+        /* Backwards compatibility for firmwares without
+         * ATH10K_FW_IE_WMI_OP_VERSION.
+         */
+        if (ar->wmi.op_version == ATH10K_FW_WMI_OP_VERSION_UNSET) {
+                if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
+                        if (test_bit(ATH10K_FW_FEATURE_WMI_10_2,
+                                     ar->fw_features))
+                                ar->wmi.op_version = ATH10K_FW_WMI_OP_VERSION_10_2;
+                        else
+                                ar->wmi.op_version = ATH10K_FW_WMI_OP_VERSION_10_1;
+                } else {
+                        ar->wmi.op_version = ATH10K_FW_WMI_OP_VERSION_MAIN;
+                }
+        }
+
+        switch (ar->wmi.op_version) {
+        case ATH10K_FW_WMI_OP_VERSION_MAIN:
                 ar->max_num_peers = TARGET_NUM_PEERS;
                 ar->max_num_stations = TARGET_NUM_STATIONS;
+                ar->max_num_vdevs = TARGET_NUM_VDEVS;
+                ar->htt.max_num_pending_tx = TARGET_NUM_MSDU_DESC;
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_10_1:
+        case ATH10K_FW_WMI_OP_VERSION_10_2:
+        case ATH10K_FW_WMI_OP_VERSION_10_2_4:
+                ar->max_num_peers = TARGET_10X_NUM_PEERS;
+                ar->max_num_stations = TARGET_10X_NUM_STATIONS;
+                ar->max_num_vdevs = TARGET_10X_NUM_VDEVS;
+                ar->htt.max_num_pending_tx = TARGET_10X_NUM_MSDU_DESC;
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_TLV:
+                ar->max_num_peers = TARGET_TLV_NUM_PEERS;
+                ar->max_num_stations = TARGET_TLV_NUM_STATIONS;
+                ar->htt.max_num_pending_tx = TARGET_TLV_NUM_MSDU_DESC;
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_UNSET:
+        case ATH10K_FW_WMI_OP_VERSION_MAX:
+                WARN_ON(1);
+                return -EINVAL;
         }
+
+        return 0;
 }
 
 int ath10k_core_start(struct ath10k *ar, enum ath10k_firmware_mode mode)
@@ -945,10 +1073,7 @@ int ath10k_core_start(struct ath10k *ar, enum ath10k_firmware_mode mode)
         if (status)
                 goto err_hif_stop;
 
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features))
-                ar->free_vdev_map = (1LL << TARGET_10X_NUM_VDEVS) - 1;
-        else
-                ar->free_vdev_map = (1LL << TARGET_NUM_VDEVS) - 1;
+        ar->free_vdev_map = (1LL << ar->max_num_vdevs) - 1;
 
         INIT_LIST_HEAD(&ar->arvifs);
 
@@ -1025,8 +1150,7 @@ static int ath10k_core_probe_fw(struct ath10k *ar)
         ret = ath10k_bmi_get_target_info(ar, &target_info);
         if (ret) {
                 ath10k_err(ar, "could not get target info (%d)\n", ret);
-                ath10k_hif_power_down(ar);
-                return ret;
+                goto err_power_down;
         }
 
         ar->target_version = target_info.version;
@@ -1035,28 +1159,28 @@ static int ath10k_core_probe_fw(struct ath10k *ar)
         ret = ath10k_init_hw_params(ar);
         if (ret) {
                 ath10k_err(ar, "could not get hw params (%d)\n", ret);
-                ath10k_hif_power_down(ar);
-                return ret;
+                goto err_power_down;
         }
 
         ret = ath10k_core_fetch_firmware_files(ar);
         if (ret) {
                 ath10k_err(ar, "could not fetch firmware files (%d)\n", ret);
-                ath10k_hif_power_down(ar);
-                return ret;
+                goto err_power_down;
         }
 
-        ath10k_core_init_max_sta_count(ar);
+        ret = ath10k_core_init_firmware_features(ar);
+        if (ret) {
+                ath10k_err(ar, "fatal problem with firmware features: %d\n",
+                           ret);
+                goto err_free_firmware_files;
+        }
 
         mutex_lock(&ar->conf_mutex);
 
         ret = ath10k_core_start(ar, ATH10K_FIRMWARE_MODE_NORMAL);
         if (ret) {
                 ath10k_err(ar, "could not init core (%d)\n", ret);
-                ath10k_core_free_firmware_files(ar);
-                ath10k_hif_power_down(ar);
-                mutex_unlock(&ar->conf_mutex);
-                return ret;
+                goto err_unlock;
         }
 
         ath10k_print_driver_info(ar);
@@ -1066,34 +1190,17 @@ static int ath10k_core_probe_fw(struct ath10k *ar)
 
         ath10k_hif_power_down(ar);
         return 0;
-}
-
-static int ath10k_core_check_chip_id(struct ath10k *ar)
-{
-        u32 hw_revision = MS(ar->chip_id, SOC_CHIP_ID_REV);
-
-        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot chip_id 0x%08x hw_revision 0x%x\n",
-                   ar->chip_id, hw_revision);
 
-        /* Check that we are not using hw1.0 (some of them have same pci id
-         * as hw2.0) before doing anything else as ath10k crashes horribly
-         * due to missing hw1.0 workarounds. */
-        switch (hw_revision) {
-        case QCA988X_HW_1_0_CHIP_ID_REV:
-                ath10k_err(ar, "ERROR: qca988x hw1.0 is not supported\n");
-                return -EOPNOTSUPP;
+err_unlock:
+        mutex_unlock(&ar->conf_mutex);
 
-        case QCA988X_HW_2_0_CHIP_ID_REV:
-                /* known hardware revision, continue normally */
-                return 0;
+err_free_firmware_files:
+        ath10k_core_free_firmware_files(ar);
 
-        default:
-                ath10k_warn(ar, "Warning: hardware revision unknown (0x%x), expect problems\n",
-                            ar->chip_id);
-                return 0;
-        }
+err_power_down:
+        ath10k_hif_power_down(ar);
 
-        return 0;
+        return ret;
 }
 
 static void ath10k_core_register_work(struct work_struct *work)
@@ -1125,9 +1232,18 @@ static void ath10k_core_register_work(struct work_struct *work)
                 goto err_debug_destroy;
         }
 
+        status = ath10k_thermal_register(ar);
+        if (status) {
+                ath10k_err(ar, "could not register thermal device: %d\n",
+                           status);
+                goto err_spectral_destroy;
+        }
+
         set_bit(ATH10K_FLAG_CORE_REGISTERED, &ar->dev_flags);
         return;
 
+err_spectral_destroy:
+        ath10k_spectral_destroy(ar);
 err_debug_destroy:
         ath10k_debug_destroy(ar);
 err_unregister_mac:
@@ -1143,16 +1259,7 @@ err:
 
 int ath10k_core_register(struct ath10k *ar, u32 chip_id)
 {
-        int status;
-
         ar->chip_id = chip_id;
-
-        status = ath10k_core_check_chip_id(ar);
-        if (status) {
-                ath10k_err(ar, "Unsupported chip id 0x%08x\n", ar->chip_id);
-                return status;
-        }
-
         queue_work(ar->workqueue, &ar->register_work);
 
         return 0;
@@ -1166,6 +1273,7 @@ void ath10k_core_unregister(struct ath10k *ar)
         if (!test_bit(ATH10K_FLAG_CORE_REGISTERED, &ar->dev_flags))
                 return;
 
+        ath10k_thermal_unregister(ar);
         /* Stop spectral before unregistering from mac80211 to remove the
          * relayfs debugfs file cleanly. Otherwise the parent debugfs tree
          * would be already be free'd recursively, leading to a double free.
@@ -1198,10 +1306,7 @@ struct ath10k *ath10k_core_create(size_t priv_size, struct device *dev,
 
         ar->ath_common.priv = ar;
         ar->ath_common.hw = ar->hw;
-
-        ar->p2p = !!ath10k_p2p;
         ar->dev = dev;
-
         ar->hif.ops = hif_ops;
         ar->hif.bus = bus;
 
@@ -1212,6 +1317,7 @@ struct ath10k *ath10k_core_create(size_t priv_size, struct device *dev,
 
         init_completion(&ar->install_key_done);
         init_completion(&ar->vdev_setup_done);
+        init_completion(&ar->thermal.wmi_sync);
 
         INIT_DELAYED_WORK(&ar->scan.timeout, ath10k_scan_timeout_work);
 
diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h
index 514c219263a5..7b6d9e4567a3 100644
--- a/drivers/net/wireless/ath/ath10k/core.h
+++ b/drivers/net/wireless/ath/ath10k/core.h
@@ -34,6 +34,7 @@
 #include "../regd.h"
 #include "../dfs_pattern_detector.h"
 #include "spectral.h"
+#include "thermal.h"
 
 #define MS(_v, _f) (((_v) & _f##_MASK) >> _f##_LSB)
 #define SM(_v, _f) (((_v) << _f##_LSB) & _f##_MASK)
@@ -120,6 +121,7 @@ struct ath10k_mem_chunk {
 };
 
 struct ath10k_wmi {
+        enum ath10k_fw_wmi_op_version op_version;
         enum ath10k_htc_ep_id eid;
         struct completion service_ready;
         struct completion unified_ready;
@@ -128,6 +130,7 @@ struct ath10k_wmi {
         struct wmi_cmd_map *cmd;
         struct wmi_vdev_param_map *vdev_param;
         struct wmi_pdev_param_map *pdev_param;
+        const struct wmi_ops *ops;
 
         u32 num_mem_chunks;
         struct ath10k_mem_chunk mem_chunks[WMI_MAX_MEM_REQS];
@@ -325,6 +328,7 @@ struct ath10k_debug {
         u32 fw_dbglog_mask;
         u32 pktlog_filter;
         u32 reg_addr;
+        u32 nf_cal_period;
 
         u8 htt_max_amsdu;
         u8 htt_max_ampdu;
@@ -369,7 +373,7 @@ enum ath10k_fw_features {
         /* wmi_mgmt_rx_hdr contains extra RSSI information */
         ATH10K_FW_FEATURE_EXT_WMI_MGMT_RX = 0,
 
-        /* firmware from 10X branch */
+        /* Firmware from 10X branch. Deprecated, don't use in new code. */
         ATH10K_FW_FEATURE_WMI_10X = 1,
 
         /* firmware support tx frame management over WMI, otherwise it's HTT */
@@ -378,8 +382,9 @@ enum ath10k_fw_features {
         /* Firmware does not support P2P */
         ATH10K_FW_FEATURE_NO_P2P = 3,
 
-        /* Firmware 10.2 feature bit. The ATH10K_FW_FEATURE_WMI_10X feature bit
-         * is required to be set as well.
+        /* Firmware 10.2 feature bit. The ATH10K_FW_FEATURE_WMI_10X feature
+         * bit is required to be set as well. Deprecated, don't use in new
+         * code.
          */
         ATH10K_FW_FEATURE_WMI_10_2 = 4,
 
@@ -401,6 +406,7 @@ enum ath10k_dev_flags {
 enum ath10k_cal_mode {
         ATH10K_CAL_MODE_FILE,
         ATH10K_CAL_MODE_OTP,
+        ATH10K_CAL_MODE_DT,
 };
 
 static inline const char *ath10k_cal_mode_str(enum ath10k_cal_mode mode)
@@ -410,6 +416,8 @@ static inline const char *ath10k_cal_mode_str(enum ath10k_cal_mode mode)
                 return "file";
         case ATH10K_CAL_MODE_OTP:
                 return "otp";
+        case ATH10K_CAL_MODE_DT:
+                return "dt";
         }
 
         return "unknown";
@@ -480,12 +488,15 @@ struct ath10k {
                 u32 id;
                 const char *name;
                 u32 patch_load_addr;
+                int uart_pin;
 
                 struct ath10k_hw_params_fw {
                         const char *dir;
                         const char *fw;
                         const char *otp;
                         const char *board;
+                        size_t board_size;
+                        size_t board_ext_size;
                 } fw;
         } hw_params;
 
@@ -571,6 +582,7 @@ struct ath10k {
 
         int max_num_peers;
         int max_num_stations;
+        int max_num_vdevs;
 
         struct work_struct offchan_tx_work;
         struct sk_buff_head offchan_tx_queue;
@@ -610,6 +622,7 @@ struct ath10k {
                 /* protected by conf_mutex */
                 const struct firmware *utf;
                 DECLARE_BITMAP(orig_fw_features, ATH10K_FW_FEATURE_COUNT);
+                enum ath10k_fw_wmi_op_version orig_wmi_op_version;
 
                 /* protected by data_lock */
                 bool utf_monitor;
@@ -622,6 +635,8 @@ struct ath10k {
                 u32 fw_cold_reset_counter;
         } stats;
 
+        struct ath10k_thermal thermal;
+
         /* must be last */
         u8 drv_priv[0] __aligned(sizeof(void *));
 };
diff --git a/drivers/net/wireless/ath/ath10k/debug.c b/drivers/net/wireless/ath/ath10k/debug.c
index a716758f14b0..6ca24427e184 100644
--- a/drivers/net/wireless/ath/ath10k/debug.c
+++ b/drivers/net/wireless/ath/ath10k/debug.c
@@ -23,6 +23,7 @@
 #include "core.h"
 #include "debug.h"
 #include "hif.h"
+#include "wmi-ops.h"
 
 /* ms */
 #define ATH10K_DEBUG_HTT_STATS_INTERVAL 1000
@@ -123,7 +124,7 @@ EXPORT_SYMBOL(ath10k_info);
 
 void ath10k_print_driver_info(struct ath10k *ar)
 {
-        ath10k_info(ar, "%s (0x%08x, 0x%08x) fw %s api %d htt %d.%d wmi %d.%d.%d.%d cal %s max_sta %d\n",
+        ath10k_info(ar, "%s (0x%08x, 0x%08x) fw %s api %d htt %d.%d wmi %d cal %s max_sta %d\n",
                     ar->hw_params.name,
                     ar->target_version,
                     ar->chip_id,
@@ -131,10 +132,7 @@ void ath10k_print_driver_info(struct ath10k *ar)
                     ar->fw_api,
                     ar->htt.target_version_major,
                     ar->htt.target_version_minor,
-                    ar->fw_version_major,
-                    ar->fw_version_minor,
-                    ar->fw_version_release,
-                    ar->fw_version_build,
+                    ar->wmi.op_version,
                     ath10k_cal_mode_str(ar->cal_mode),
                     ar->max_num_stations);
         ath10k_info(ar, "debug %d debugfs %d tracing %d dfs %d testmode %d\n",
@@ -1607,6 +1605,73 @@ static const struct file_operations fops_cal_data = {
         .llseek = default_llseek,
 };
 
+static ssize_t ath10k_read_nf_cal_period(struct file *file,
+                                         char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct ath10k *ar = file->private_data;
+        unsigned int len;
+        char buf[32];
+
+        len = scnprintf(buf, sizeof(buf), "%d\n",
+                        ar->debug.nf_cal_period);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t ath10k_write_nf_cal_period(struct file *file,
+                                          const char __user *user_buf,
+                                          size_t count, loff_t *ppos)
+{
+        struct ath10k *ar = file->private_data;
+        unsigned long period;
+        int ret;
+
+        ret = kstrtoul_from_user(user_buf, count, 0, &period);
+        if (ret)
+                return ret;
+
+        if (period > WMI_PDEV_PARAM_CAL_PERIOD_MAX)
+                return -EINVAL;
+
+        /* there's no way to switch back to the firmware default */
+        if (period == 0)
+                return -EINVAL;
+
+        mutex_lock(&ar->conf_mutex);
+
+        ar->debug.nf_cal_period = period;
+
+        if (ar->state != ATH10K_STATE_ON) {
+                /* firmware is not running, nothing else to do */
+                ret = count;
+                goto exit;
+        }
+
+        ret = ath10k_wmi_pdev_set_param(ar, ar->wmi.pdev_param->cal_period,
+                                        ar->debug.nf_cal_period);
+        if (ret) {
+                ath10k_warn(ar, "cal period cfg failed from debugfs: %d\n",
+                            ret);
+                goto exit;
+        }
+
+        ret = count;
+
+exit:
+        mutex_unlock(&ar->conf_mutex);
+
+        return ret;
+}
+
+static const struct file_operations fops_nf_cal_period = {
+        .read = ath10k_read_nf_cal_period,
+        .write = ath10k_write_nf_cal_period,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
 int ath10k_debug_start(struct ath10k *ar)
 {
         int ret;
@@ -1642,6 +1707,16 @@ int ath10k_debug_start(struct ath10k *ar)
                         ath10k_warn(ar, "failed to disable pktlog: %d\n", ret);
         }
 
+        if (ar->debug.nf_cal_period) {
+                ret = ath10k_wmi_pdev_set_param(ar,
+                                                ar->wmi.pdev_param->cal_period,
+                                                ar->debug.nf_cal_period);
+                if (ret)
+                        /* not serious */
+                        ath10k_warn(ar, "cal period cfg failed from debug start: %d\n",
+                                    ret);
+        }
+
         return ret;
 }
 
@@ -1880,6 +1955,9 @@ int ath10k_debug_register(struct ath10k *ar)
         debugfs_create_file("cal_data", S_IRUSR, ar->debug.debugfs_phy,
                             ar, &fops_cal_data);
 
+        debugfs_create_file("nf_cal_period", S_IRUSR | S_IWUSR,
+                            ar->debug.debugfs_phy, ar, &fops_nf_cal_period);
+
         if (config_enabled(CONFIG_ATH10K_DFS_CERTIFIED)) {
                 debugfs_create_file("dfs_simulate_radar", S_IWUSR,
                                     ar->debug.debugfs_phy, ar,
diff --git a/drivers/net/wireless/ath/ath10k/htt_tx.c b/drivers/net/wireless/ath/ath10k/htt_tx.c
index 4bc51d8a14a3..a1bda41fb543 100644
--- a/drivers/net/wireless/ath/ath10k/htt_tx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_tx.c
@@ -93,11 +93,6 @@ int ath10k_htt_tx_alloc(struct ath10k_htt *htt)
 
         spin_lock_init(&htt->tx_lock);
 
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, htt->ar->fw_features))
-                htt->max_num_pending_tx = TARGET_10X_NUM_MSDU_DESC;
-        else
-                htt->max_num_pending_tx = TARGET_NUM_MSDU_DESC;
-
         ath10k_dbg(ar, ATH10K_DBG_BOOT, "htt tx max num pending tx %d\n",
                    htt->max_num_pending_tx);
 
diff --git a/drivers/net/wireless/ath/ath10k/hw.h b/drivers/net/wireless/ath/ath10k/hw.h
index dfedfd0e0f34..5729901923ac 100644
--- a/drivers/net/wireless/ath/ath10k/hw.h
+++ b/drivers/net/wireless/ath/ath10k/hw.h
@@ -37,6 +37,9 @@
 #define ATH10K_FW_API2_FILE             "firmware-2.bin"
 #define ATH10K_FW_API3_FILE             "firmware-3.bin"
 
+/* added support for ATH10K_FW_IE_WMI_OP_VERSION */
+#define ATH10K_FW_API4_FILE             "firmware-4.bin"
+
 #define ATH10K_FW_UTF_FILE              "utf.bin"
 
 /* includes also the null byte */
@@ -58,6 +61,24 @@ enum ath10k_fw_ie_type {
         ATH10K_FW_IE_FEATURES = 2,
         ATH10K_FW_IE_FW_IMAGE = 3,
         ATH10K_FW_IE_OTP_IMAGE = 4,
+
+        /* WMI "operations" interface version, 32 bit value. Supported from
+         * FW API 4 and above.
+         */
+        ATH10K_FW_IE_WMI_OP_VERSION = 5,
+};
+
+enum ath10k_fw_wmi_op_version {
+        ATH10K_FW_WMI_OP_VERSION_UNSET = 0,
+
+        ATH10K_FW_WMI_OP_VERSION_MAIN = 1,
+        ATH10K_FW_WMI_OP_VERSION_10_1 = 2,
+        ATH10K_FW_WMI_OP_VERSION_10_2 = 3,
+        ATH10K_FW_WMI_OP_VERSION_TLV = 4,
+        ATH10K_FW_WMI_OP_VERSION_10_2_4 = 5,
+
+        /* keep last */
+        ATH10K_FW_WMI_OP_VERSION_MAX,
 };
 
 /* Known pecularities:
@@ -162,6 +183,15 @@ struct ath10k_pktlog_hdr {
 #define TARGET_10X_NUM_MSDU_DESC                (1024 + 400)
 #define TARGET_10X_MAX_FRAG_ENTRIES             0
 
+/* Target specific defines for WMI-TLV firmware */
+#define TARGET_TLV_NUM_VDEVS                    3
+#define TARGET_TLV_NUM_STATIONS                 32
+#define TARGET_TLV_NUM_PEERS                    ((TARGET_TLV_NUM_STATIONS) + \
+                                                 (TARGET_TLV_NUM_VDEVS) + \
+                                                 2)
+#define TARGET_TLV_NUM_TIDS                     ((TARGET_TLV_NUM_PEERS) * 2)
+#define TARGET_TLV_NUM_MSDU_DESC                (1024 + 32)
+
 /* Number of Copy Engines supported */
 #define CE_COUNT 8
 
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 2619db1e3e74..08f293411bf0 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -27,6 +27,8 @@
 #include "htt.h"
 #include "txrx.h"
 #include "testmode.h"
+#include "wmi.h"
+#include "wmi-ops.h"
 
 /**********/
 /* Crypto */
@@ -267,7 +269,10 @@ chan_to_phymode(const struct cfg80211_chan_def *chandef)
         case IEEE80211_BAND_2GHZ:
                 switch (chandef->width) {
                 case NL80211_CHAN_WIDTH_20_NOHT:
-                        phymode = MODE_11G;
+                        if (chandef->chan->flags & IEEE80211_CHAN_NO_OFDM)
+                                phymode = MODE_11B;
+                        else
+                                phymode = MODE_11G;
                         break;
                 case NL80211_CHAN_WIDTH_20:
                         phymode = MODE_11NG_HT20;
@@ -1046,28 +1051,85 @@ static void ath10k_control_ibss(struct ath10k_vif *arvif,
                             arvif->vdev_id, ret);
 }
 
-/*
- * Review this when mac80211 gains per-interface powersave support.
- */
+static int ath10k_mac_vif_recalc_ps_wake_threshold(struct ath10k_vif *arvif)
+{
+        struct ath10k *ar = arvif->ar;
+        u32 param;
+        u32 value;
+        int ret;
+
+        lockdep_assert_held(&arvif->ar->conf_mutex);
+
+        if (arvif->u.sta.uapsd)
+                value = WMI_STA_PS_TX_WAKE_THRESHOLD_NEVER;
+        else
+                value = WMI_STA_PS_TX_WAKE_THRESHOLD_ALWAYS;
+
+        param = WMI_STA_PS_PARAM_TX_WAKE_THRESHOLD;
+        ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id, param, value);
+        if (ret) {
+                ath10k_warn(ar, "failed to submit ps wake threshold %u on vdev %i: %d\n",
+                            value, arvif->vdev_id, ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+static int ath10k_mac_vif_recalc_ps_poll_count(struct ath10k_vif *arvif)
+{
+        struct ath10k *ar = arvif->ar;
+        u32 param;
+        u32 value;
+        int ret;
+
+        lockdep_assert_held(&arvif->ar->conf_mutex);
+
+        if (arvif->u.sta.uapsd)
+                value = WMI_STA_PS_PSPOLL_COUNT_UAPSD;
+        else
+                value = WMI_STA_PS_PSPOLL_COUNT_NO_MAX;
+
+        param = WMI_STA_PS_PARAM_PSPOLL_COUNT;
+        ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id,
+                                          param, value);
+        if (ret) {
+                ath10k_warn(ar, "failed to submit ps poll count %u on vdev %i: %d\n",
+                            value, arvif->vdev_id, ret);
+                return ret;
+        }
+
+        return 0;
+}
+
 static int ath10k_mac_vif_setup_ps(struct ath10k_vif *arvif)
 {
         struct ath10k *ar = arvif->ar;
+        struct ieee80211_vif *vif = arvif->vif;
         struct ieee80211_conf *conf = &ar->hw->conf;
         enum wmi_sta_powersave_param param;
         enum wmi_sta_ps_mode psmode;
         int ret;
+        int ps_timeout;
 
         lockdep_assert_held(&arvif->ar->conf_mutex);
 
         if (arvif->vif->type != NL80211_IFTYPE_STATION)
                 return 0;
 
-        if (conf->flags & IEEE80211_CONF_PS) {
+        if (vif->bss_conf.ps) {
                 psmode = WMI_STA_PS_MODE_ENABLED;
                 param = WMI_STA_PS_PARAM_INACTIVITY_TIME;
 
+                ps_timeout = conf->dynamic_ps_timeout;
+                if (ps_timeout == 0) {
+                        /* Firmware doesn't like 0 */
+                        ps_timeout = ieee80211_tu_to_usec(
+                                vif->bss_conf.beacon_int) / 1000;
+                }
+
                 ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id, param,
-                                                  conf->dynamic_ps_timeout);
+                                                  ps_timeout);
                 if (ret) {
                         ath10k_warn(ar, "failed to set inactivity time for vdev %d: %i\n",
                                     arvif->vdev_id, ret);
@@ -1409,9 +1471,22 @@ static void ath10k_peer_assoc_h_qos(struct ath10k *ar,
                 if (vif->bss_conf.qos)
                         arg->peer_flags |= WMI_PEER_QOS;
                 break;
+        case WMI_VDEV_TYPE_IBSS:
+                if (sta->wme)
+                        arg->peer_flags |= WMI_PEER_QOS;
+                break;
         default:
                 break;
         }
+
+        ath10k_dbg(ar, ATH10K_DBG_MAC, "mac peer %pM qos %d\n",
+                   sta->addr, !!(arg->peer_flags & WMI_PEER_QOS));
+}
+
+static bool ath10k_mac_sta_has_11g_rates(struct ieee80211_sta *sta)
+{
+        /* First 4 rates in ath10k_rates are CCK (11b) rates. */
+        return sta->supp_rates[IEEE80211_BAND_2GHZ] >> 4;
 }
 
 static void ath10k_peer_assoc_h_phymode(struct ath10k *ar,
@@ -1428,8 +1503,10 @@ static void ath10k_peer_assoc_h_phymode(struct ath10k *ar,
                                 phymode = MODE_11NG_HT40;
                         else
                                 phymode = MODE_11NG_HT20;
-                } else {
+                } else if (ath10k_mac_sta_has_11g_rates(sta)) {
                         phymode = MODE_11G;
+                } else {
+                        phymode = MODE_11B;
                 }
 
                 break;
@@ -2896,10 +2973,11 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
         arvif->vdev_id = bit;
         arvif->vdev_subtype = WMI_VDEV_SUBTYPE_NONE;
 
-        if (ar->p2p)
-                arvif->vdev_subtype = WMI_VDEV_SUBTYPE_P2P_DEVICE;
-
         switch (vif->type) {
+        case NL80211_IFTYPE_P2P_DEVICE:
+                arvif->vdev_type = WMI_VDEV_TYPE_STA;
+                arvif->vdev_subtype = WMI_VDEV_SUBTYPE_P2P_DEVICE;
+                break;
         case NL80211_IFTYPE_UNSPECIFIED:
         case NL80211_IFTYPE_STATION:
                 arvif->vdev_type = WMI_VDEV_TYPE_STA;
@@ -3028,22 +3106,16 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
                         goto err_peer_delete;
                 }
 
-                param = WMI_STA_PS_PARAM_TX_WAKE_THRESHOLD;
-                value = WMI_STA_PS_TX_WAKE_THRESHOLD_ALWAYS;
-                ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id,
-                                                  param, value);
+                ret = ath10k_mac_vif_recalc_ps_wake_threshold(arvif);
                 if (ret) {
-                        ath10k_warn(ar, "failed to set vdev %i TX wake thresh: %d\n",
+                        ath10k_warn(ar, "failed to recalc ps wake threshold on vdev %i: %d\n",
                                     arvif->vdev_id, ret);
                         goto err_peer_delete;
                 }
 
-                param = WMI_STA_PS_PARAM_PSPOLL_COUNT;
-                value = WMI_STA_PS_PSPOLL_COUNT_NO_MAX;
-                ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id,
-                                                  param, value);
+                ret = ath10k_mac_vif_recalc_ps_poll_count(arvif);
                 if (ret) {
-                        ath10k_warn(ar, "failed to set vdev %i PSPOLL count: %d\n",
+                        ath10k_warn(ar, "failed to recalc ps poll count on vdev %i: %d\n",
                                     arvif->vdev_id, ret);
                         goto err_peer_delete;
                 }
@@ -3316,6 +3388,13 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                         ath10k_warn(ar, "failed to recalc tx power: %d\n", ret);
         }
 
+        if (changed & BSS_CHANGED_PS) {
+                ret = ath10k_mac_vif_setup_ps(arvif);
+                if (ret)
+                        ath10k_warn(ar, "failed to setup ps on vdev %i: %d\n",
+                                    arvif->vdev_id, ret);
+        }
+
         mutex_unlock(&ar->conf_mutex);
 }
 
@@ -3585,8 +3664,9 @@ static void ath10k_sta_rc_update_wk(struct work_struct *wk)
                                     sta->addr, smps, err);
         }
 
-        if (changed & IEEE80211_RC_SUPP_RATES_CHANGED) {
-                ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM supp rates\n",
+        if (changed & IEEE80211_RC_SUPP_RATES_CHANGED ||
+            changed & IEEE80211_RC_NSS_CHANGED) {
+                ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM supp rates/nss\n",
                            sta->addr);
 
                 err = ath10k_station_assoc(ar, arvif->vif, sta, true);
@@ -3810,6 +3890,20 @@ static int ath10k_conf_tx_uapsd(struct ath10k *ar, struct ieee80211_vif *vif,
         if (ret)
                 ath10k_warn(ar, "failed to set rx wake param: %d\n", ret);
 
+        ret = ath10k_mac_vif_recalc_ps_wake_threshold(arvif);
+        if (ret) {
+                ath10k_warn(ar, "failed to recalc ps wake threshold on vdev %i: %d\n",
+                            arvif->vdev_id, ret);
+                return ret;
+        }
+
+        ret = ath10k_mac_vif_recalc_ps_poll_count(arvif);
+        if (ret) {
+                ath10k_warn(ar, "failed to recalc ps poll count on vdev %i: %d\n",
+                            arvif->vdev_id, ret);
+                return ret;
+        }
+
 exit:
         return ret;
 }
@@ -3991,29 +4085,6 @@ static int ath10k_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
         return ret;
 }
 
-static int ath10k_set_frag_threshold(struct ieee80211_hw *hw, u32 value)
-{
-        struct ath10k *ar = hw->priv;
-        struct ath10k_vif *arvif;
-        int ret = 0;
-
-        mutex_lock(&ar->conf_mutex);
-        list_for_each_entry(arvif, &ar->arvifs, list) {
-                ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d fragmentation threshold %d\n",
-                           arvif->vdev_id, value);
-
-                ret = ath10k_mac_set_frag(arvif, value);
-                if (ret) {
-                        ath10k_warn(ar, "failed to set fragmentation threshold for vdev %d: %d\n",
-                                    arvif->vdev_id, ret);
-                        break;
-                }
-        }
-        mutex_unlock(&ar->conf_mutex);
-
-        return ret;
-}
-
 static void ath10k_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                          u32 queues, bool drop)
 {
@@ -4657,7 +4728,6 @@ static const struct ieee80211_ops ath10k_ops = {
         .remain_on_channel              = ath10k_remain_on_channel,
         .cancel_remain_on_channel       = ath10k_cancel_remain_on_channel,
         .set_rts_threshold              = ath10k_set_rts_threshold,
-        .set_frag_threshold             = ath10k_set_frag_threshold,
         .flush                          = ath10k_flush,
         .tx_last_beacon                 = ath10k_tx_last_beacon,
         .set_antenna                    = ath10k_set_antenna,
@@ -4748,6 +4818,9 @@ static const struct ieee80211_channel ath10k_5ghz_channels[] = {
         CHAN5G(165, 5825, 0),
 };
 
+/* Note: Be careful if you re-order these. There is code which depends on this
+ * ordering.
+ */
 static struct ieee80211_rate ath10k_rates[] = {
         /* CCK */
         RATETAB_ENT(10,  0x82, 0),
@@ -4801,6 +4874,10 @@ static const struct ieee80211_iface_limit ath10k_if_limits[] = {
         .types  = BIT(NL80211_IFTYPE_P2P_GO)
         },
         {
+        .max    = 1,
+        .types  = BIT(NL80211_IFTYPE_P2P_DEVICE)
+        },
+        {
         .max    = 7,
         .types  = BIT(NL80211_IFTYPE_AP)
         },
@@ -5020,6 +5097,7 @@ int ath10k_mac_register(struct ath10k *ar)
 
         if (!test_bit(ATH10K_FW_FEATURE_NO_P2P, ar->fw_features))
                 ar->hw->wiphy->interface_modes |=
+                        BIT(NL80211_IFTYPE_P2P_DEVICE) |
                         BIT(NL80211_IFTYPE_P2P_CLIENT) |
                         BIT(NL80211_IFTYPE_P2P_GO);
 
@@ -5063,16 +5141,26 @@ int ath10k_mac_register(struct ath10k *ar)
          */
         ar->hw->queues = 4;
 
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                ar->hw->wiphy->iface_combinations = ath10k_10x_if_comb;
-                ar->hw->wiphy->n_iface_combinations =
-                        ARRAY_SIZE(ath10k_10x_if_comb);
-        } else {
+        switch (ar->wmi.op_version) {
+        case ATH10K_FW_WMI_OP_VERSION_MAIN:
+        case ATH10K_FW_WMI_OP_VERSION_TLV:
                 ar->hw->wiphy->iface_combinations = ath10k_if_comb;
                 ar->hw->wiphy->n_iface_combinations =
                         ARRAY_SIZE(ath10k_if_comb);
-
                 ar->hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC);
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_10_1:
+        case ATH10K_FW_WMI_OP_VERSION_10_2:
+        case ATH10K_FW_WMI_OP_VERSION_10_2_4:
+                ar->hw->wiphy->iface_combinations = ath10k_10x_if_comb;
+                ar->hw->wiphy->n_iface_combinations =
+                        ARRAY_SIZE(ath10k_10x_if_comb);
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_UNSET:
+        case ATH10K_FW_WMI_OP_VERSION_MAX:
+                WARN_ON(1);
+                ret = -EINVAL;
+                goto err_free;
         }
 
         ar->hw->netdev_features = NETIF_F_HW_CSUM;
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index 7abb8367119a..5e50214246f8 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -64,6 +64,14 @@ static const struct pci_device_id ath10k_pci_id_table[] = {
         {0}
 };
 
+static const struct ath10k_pci_supp_chip ath10k_pci_supp_chips[] = {
+        /* QCA988X pre 2.0 chips are not supported because they need some nasty
+         * hacks. ath10k doesn't have them and these devices crash horribly
+         * because of that.
+         */
+        { QCA988X_2_0_DEVICE_ID, QCA988X_HW_2_0_CHIP_ID_REV },
+};
+
 static void ath10k_pci_buffer_cleanup(struct ath10k *ar);
 static int ath10k_pci_cold_reset(struct ath10k *ar);
 static int ath10k_pci_warm_reset(struct ath10k *ar);
@@ -2476,6 +2484,23 @@ static void ath10k_pci_release(struct ath10k *ar)
         pci_disable_device(pdev);
 }
 
+static bool ath10k_pci_chip_is_supported(u32 dev_id, u32 chip_id)
+{
+        const struct ath10k_pci_supp_chip *supp_chip;
+        int i;
+        u32 rev_id = MS(chip_id, SOC_CHIP_ID_REV);
+
+        for (i = 0; i < ARRAY_SIZE(ath10k_pci_supp_chips); i++) {
+                supp_chip = &ath10k_pci_supp_chips[i];
+
+                if (supp_chip->dev_id == dev_id &&
+                    supp_chip->rev_id == rev_id)
+                        return true;
+        }
+
+        return false;
+}
+
 static int ath10k_pci_probe(struct pci_dev *pdev,
                             const struct pci_device_id *pci_dev)
 {
@@ -2521,6 +2546,12 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
                 goto err_sleep;
         }
 
+        if (!ath10k_pci_chip_is_supported(pdev->device, chip_id)) {
+                ath10k_err(ar, "device %04x with chip_id %08x isn't supported\n",
+                           pdev->device, chip_id);
+                goto err_sleep;
+        }
+
         ret = ath10k_pci_alloc_pipes(ar);
         if (ret) {
                 ath10k_err(ar, "failed to allocate copy engine pipes: %d\n",
diff --git a/drivers/net/wireless/ath/ath10k/pci.h b/drivers/net/wireless/ath/ath10k/pci.h
index cf36511c7f4d..ce4a1ef89961 100644
--- a/drivers/net/wireless/ath/ath10k/pci.h
+++ b/drivers/net/wireless/ath/ath10k/pci.h
@@ -152,6 +152,11 @@ struct ath10k_pci_pipe {
         struct tasklet_struct intr;
 };
 
+struct ath10k_pci_supp_chip {
+        u32 dev_id;
+        u32 rev_id;
+};
+
 struct ath10k_pci {
         struct pci_dev *pdev;
         struct device *dev;
diff --git a/drivers/net/wireless/ath/ath10k/spectral.c b/drivers/net/wireless/ath/ath10k/spectral.c
index 63ce61fcdac8..d22addf6118b 100644
--- a/drivers/net/wireless/ath/ath10k/spectral.c
+++ b/drivers/net/wireless/ath/ath10k/spectral.c
@@ -17,6 +17,7 @@
 #include <linux/relay.h>
 #include "core.h"
 #include "debug.h"
+#include "wmi-ops.h"
 
 static void send_fft_sample(struct ath10k *ar,
                             const struct fft_sample_tlv *fft_sample_tlv)
diff --git a/drivers/net/wireless/ath/ath10k/testmode.c b/drivers/net/wireless/ath/ath10k/testmode.c
index 483db9cb8c96..b084f88da102 100644
--- a/drivers/net/wireless/ath/ath10k/testmode.c
+++ b/drivers/net/wireless/ath/ath10k/testmode.c
@@ -187,13 +187,14 @@ static int ath10k_tm_cmd_utf_start(struct ath10k *ar, struct nlattr *tb[])
 
         memcpy(ar->testmode.orig_fw_features, ar->fw_features,
                sizeof(ar->fw_features));
+        ar->testmode.orig_wmi_op_version = ar->wmi.op_version;
 
         /* utf.bin firmware image does not advertise firmware features. Do
          * an ugly hack where we force the firmware features so that wmi.c
          * will use the correct WMI interface.
          */
         memset(ar->fw_features, 0, sizeof(ar->fw_features));
-        __set_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features);
+        ar->wmi.op_version = ATH10K_FW_WMI_OP_VERSION_10_1;
 
         ret = ath10k_hif_power_up(ar);
         if (ret) {
@@ -224,6 +225,7 @@ err_fw_features:
         /* return the original firmware features */
         memcpy(ar->fw_features, ar->testmode.orig_fw_features,
                sizeof(ar->fw_features));
+        ar->wmi.op_version = ar->testmode.orig_wmi_op_version;
 
         release_firmware(ar->testmode.utf);
         ar->testmode.utf = NULL;
@@ -250,6 +252,7 @@ static void __ath10k_tm_cmd_utf_stop(struct ath10k *ar)
         /* return the original firmware features */
         memcpy(ar->fw_features, ar->testmode.orig_fw_features,
                sizeof(ar->fw_features));
+        ar->wmi.op_version = ar->testmode.orig_wmi_op_version;
 
         release_firmware(ar->testmode.utf);
         ar->testmode.utf = NULL;
diff --git a/drivers/net/wireless/ath/ath10k/thermal.c b/drivers/net/wireless/ath/ath10k/thermal.c
new file mode 100644
index 000000000000..b14ae8d135f6
--- /dev/null
+++ b/drivers/net/wireless/ath/ath10k/thermal.c
@@ -0,0 +1,243 @@
+/*
+ * Copyright (c) 2014 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/device.h>
+#include <linux/sysfs.h>
+#include <linux/thermal.h>
+#include <linux/hwmon.h>
+#include <linux/hwmon-sysfs.h>
+#include "core.h"
+#include "debug.h"
+#include "wmi-ops.h"
+
+static int ath10k_thermal_get_active_vifs(struct ath10k *ar,
+                                          enum wmi_vdev_type type)
+{
+        struct ath10k_vif *arvif;
+        int count = 0;
+
+        lockdep_assert_held(&ar->conf_mutex);
+
+        list_for_each_entry(arvif, &ar->arvifs, list) {
+                if (!arvif->is_started)
+                        continue;
+
+                if (!arvif->is_up)
+                        continue;
+
+                if (arvif->vdev_type != type)
+                        continue;
+
+                count++;
+        }
+        return count;
+}
+
+static int ath10k_thermal_get_max_dutycycle(struct thermal_cooling_device *cdev,
+                                            unsigned long *state)
+{
+        *state = ATH10K_QUIET_DUTY_CYCLE_MAX;
+
+        return 0;
+}
+
+static int ath10k_thermal_get_cur_dutycycle(struct thermal_cooling_device *cdev,
+                                            unsigned long *state)
+{
+        struct ath10k *ar = cdev->devdata;
+
+        mutex_lock(&ar->conf_mutex);
+        *state = ar->thermal.duty_cycle;
+        mutex_unlock(&ar->conf_mutex);
+
+        return 0;
+}
+
+static int ath10k_thermal_set_cur_dutycycle(struct thermal_cooling_device *cdev,
+                                            unsigned long duty_cycle)
+{
+        struct ath10k *ar = cdev->devdata;
+        u32 period, duration, enabled;
+        int num_bss, ret = 0;
+
+        mutex_lock(&ar->conf_mutex);
+        if (ar->state != ATH10K_STATE_ON) {
+                ret = -ENETDOWN;
+                goto out;
+        }
+
+        if (duty_cycle > ATH10K_QUIET_DUTY_CYCLE_MAX) {
+                ath10k_warn(ar, "duty cycle %ld is exceeding the limit %d\n",
+                            duty_cycle, ATH10K_QUIET_DUTY_CYCLE_MAX);
+                ret = -EINVAL;
+                goto out;
+        }
+        /* TODO: Right now, thermal mitigation is handled only for single/multi
+         * vif AP mode. Since quiet param is not validated in STA mode, it needs
+         * to be investigated further to handle multi STA and multi-vif (AP+STA)
+         * mode properly.
+         */
+        num_bss = ath10k_thermal_get_active_vifs(ar, WMI_VDEV_TYPE_AP);
+        if (!num_bss) {
+                ath10k_warn(ar, "no active AP interfaces\n");
+                ret = -ENETDOWN;
+                goto out;
+        }
+        period = max(ATH10K_QUIET_PERIOD_MIN,
+                     (ATH10K_QUIET_PERIOD_DEFAULT / num_bss));
+        duration = period * (duty_cycle / 100);
+        enabled = duration ? 1 : 0;
+
+        ret = ath10k_wmi_pdev_set_quiet_mode(ar, period, duration,
+                                             ATH10K_QUIET_START_OFFSET,
+                                             enabled);
+        if (ret) {
+                ath10k_warn(ar, "failed to set quiet mode period %u duarion %u enabled %u ret %d\n",
+                            period, duration, enabled, ret);
+                goto out;
+        }
+        ar->thermal.duty_cycle = duty_cycle;
+out:
+        mutex_unlock(&ar->conf_mutex);
+        return ret;
+}
+
+static struct thermal_cooling_device_ops ath10k_thermal_ops = {
+        .get_max_state = ath10k_thermal_get_max_dutycycle,
+        .get_cur_state = ath10k_thermal_get_cur_dutycycle,
+        .set_cur_state = ath10k_thermal_set_cur_dutycycle,
+};
+
+static ssize_t ath10k_thermal_show_temp(struct device *dev,
+                                        struct device_attribute *attr,
+                                        char *buf)
+{
+        struct ath10k *ar = dev_get_drvdata(dev);
+        int ret, temperature;
+
+        mutex_lock(&ar->conf_mutex);
+
+        /* Can't get temperature when the card is off */
+        if (ar->state != ATH10K_STATE_ON) {
+                ret = -ENETDOWN;
+                goto out;
+        }
+
+        reinit_completion(&ar->thermal.wmi_sync);
+        ret = ath10k_wmi_pdev_get_temperature(ar);
+        if (ret) {
+                ath10k_warn(ar, "failed to read temperature %d\n", ret);
+                goto out;
+        }
+
+        if (test_bit(ATH10K_FLAG_CRASH_FLUSH, &ar->dev_flags)) {
+                ret = -ESHUTDOWN;
+                goto out;
+        }
+
+        ret = wait_for_completion_timeout(&ar->thermal.wmi_sync,
+                                          ATH10K_THERMAL_SYNC_TIMEOUT_HZ);
+        if (ret == 0) {
+                ath10k_warn(ar, "failed to synchronize thermal read\n");
+                ret = -ETIMEDOUT;
+                goto out;
+        }
+
+        spin_lock_bh(&ar->data_lock);
+        temperature = ar->thermal.temperature;
+        spin_unlock_bh(&ar->data_lock);
+
+        ret = snprintf(buf, PAGE_SIZE, "%d", temperature);
+out:
+        mutex_unlock(&ar->conf_mutex);
+        return ret;
+}
+
+void ath10k_thermal_event_temperature(struct ath10k *ar, int temperature)
+{
+        spin_lock_bh(&ar->data_lock);
+        ar->thermal.temperature = temperature;
+        spin_unlock_bh(&ar->data_lock);
+        complete(&ar->thermal.wmi_sync);
+}
+
+static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO, ath10k_thermal_show_temp,
+                          NULL, 0);
+
+static struct attribute *ath10k_hwmon_attrs[] = {
+        &sensor_dev_attr_temp1_input.dev_attr.attr,
+        NULL,
+};
+ATTRIBUTE_GROUPS(ath10k_hwmon);
+
+int ath10k_thermal_register(struct ath10k *ar)
+{
+        struct thermal_cooling_device *cdev;
+        struct device *hwmon_dev;
+        int ret;
+
+        cdev = thermal_cooling_device_register("ath10k_thermal", ar,
+                                               &ath10k_thermal_ops);
+
+        if (IS_ERR(cdev)) {
+                ath10k_err(ar, "failed to setup thermal device result: %ld\n",
+                           PTR_ERR(cdev));
+                return -EINVAL;
+        }
+
+        ret = sysfs_create_link(&ar->dev->kobj, &cdev->device.kobj,
+                                "cooling_device");
+        if (ret) {
+                ath10k_err(ar, "failed to create thermal symlink\n");
+                goto err_cooling_destroy;
+        }
+
+        ar->thermal.cdev = cdev;
+
+        /* Do not register hwmon device when temperature reading is not
+         * supported by firmware
+         */
+        if (ar->wmi.op_version != ATH10K_FW_WMI_OP_VERSION_10_2_4)
+                return 0;
+
+        /* Avoid linking error on devm_hwmon_device_register_with_groups, I
+         * guess linux/hwmon.h is missing proper stubs. */
+        if (!config_enabled(HWMON))
+                return 0;
+
+        hwmon_dev = devm_hwmon_device_register_with_groups(ar->dev,
+                                                           "ath10k_hwmon", ar,
+                                                           ath10k_hwmon_groups);
+        if (IS_ERR(hwmon_dev)) {
+                ath10k_err(ar, "failed to register hwmon device: %ld\n",
+                           PTR_ERR(hwmon_dev));
+                ret = -EINVAL;
+                goto err_remove_link;
+        }
+        return 0;
+
+err_remove_link:
+        sysfs_remove_link(&ar->dev->kobj, "thermal_sensor");
+err_cooling_destroy:
+        thermal_cooling_device_unregister(cdev);
+        return ret;
+}
+
+void ath10k_thermal_unregister(struct ath10k *ar)
+{
+        thermal_cooling_device_unregister(ar->thermal.cdev);
+        sysfs_remove_link(&ar->dev->kobj, "cooling_device");
+}
diff --git a/drivers/net/wireless/ath/ath10k/thermal.h b/drivers/net/wireless/ath/ath10k/thermal.h
new file mode 100644
index 000000000000..bccc17ae0fde
--- /dev/null
+++ b/drivers/net/wireless/ath/ath10k/thermal.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (c) 2014 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef _THERMAL_
+#define _THERMAL_
+
+#define ATH10K_QUIET_PERIOD_DEFAULT     100
+#define ATH10K_QUIET_PERIOD_MIN         25
+#define ATH10K_QUIET_START_OFFSET       10
+#define ATH10K_QUIET_DUTY_CYCLE_MAX     70
+#define ATH10K_HWMON_NAME_LEN           15
+#define ATH10K_THERMAL_SYNC_TIMEOUT_HZ (5*HZ)
+
+struct ath10k_thermal {
+        struct thermal_cooling_device *cdev;
+        struct completion wmi_sync;
+
+        /* protected by conf_mutex */
+        u32 duty_cycle;
+        /* temperature value in Celcius degree
+         * protected by data_lock
+         */
+        int temperature;
+};
+
+#ifdef CONFIG_THERMAL
+int ath10k_thermal_register(struct ath10k *ar);
+void ath10k_thermal_unregister(struct ath10k *ar);
+void ath10k_thermal_event_temperature(struct ath10k *ar, int temperature);
+#else
+static inline int ath10k_thermal_register(struct ath10k *ar)
+{
+        return 0;
+}
+
+static inline void ath10k_thermal_unregister(struct ath10k *ar)
+{
+}
+
+static inline void ath10k_thermal_event_temperature(struct ath10k *ar,
+                                                    int temperature)
+{
+}
+
+#endif
+#endif /* _THERMAL_ */
diff --git a/drivers/net/wireless/ath/ath10k/wmi-ops.h b/drivers/net/wireless/ath/ath10k/wmi-ops.h
new file mode 100644
index 000000000000..20e2c3002bb5
--- /dev/null
+++ b/drivers/net/wireless/ath/ath10k/wmi-ops.h
@@ -0,0 +1,860 @@
+/*
+ * Copyright (c) 2005-2011 Atheros Communications Inc.
+ * Copyright (c) 2011-2014 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _WMI_OPS_H_
+#define _WMI_OPS_H_
+
+struct ath10k;
+struct sk_buff;
+
+struct wmi_ops {
+        void (*rx)(struct ath10k *ar, struct sk_buff *skb);
+        void (*map_svc)(const __le32 *in, unsigned long *out, size_t len);
+
+        int (*pull_scan)(struct ath10k *ar, struct sk_buff *skb,
+                         struct wmi_scan_ev_arg *arg);
+        int (*pull_mgmt_rx)(struct ath10k *ar, struct sk_buff *skb,
+                            struct wmi_mgmt_rx_ev_arg *arg);
+        int (*pull_ch_info)(struct ath10k *ar, struct sk_buff *skb,
+                            struct wmi_ch_info_ev_arg *arg);
+        int (*pull_vdev_start)(struct ath10k *ar, struct sk_buff *skb,
+                               struct wmi_vdev_start_ev_arg *arg);
+        int (*pull_peer_kick)(struct ath10k *ar, struct sk_buff *skb,
+                              struct wmi_peer_kick_ev_arg *arg);
+        int (*pull_swba)(struct ath10k *ar, struct sk_buff *skb,
+                         struct wmi_swba_ev_arg *arg);
+        int (*pull_phyerr)(struct ath10k *ar, struct sk_buff *skb,
+                           struct wmi_phyerr_ev_arg *arg);
+        int (*pull_svc_rdy)(struct ath10k *ar, struct sk_buff *skb,
+                            struct wmi_svc_rdy_ev_arg *arg);
+        int (*pull_rdy)(struct ath10k *ar, struct sk_buff *skb,
+                        struct wmi_rdy_ev_arg *arg);
+        int (*pull_fw_stats)(struct ath10k *ar, struct sk_buff *skb,
+                             struct ath10k_fw_stats *stats);
+
+        struct sk_buff *(*gen_pdev_suspend)(struct ath10k *ar, u32 suspend_opt);
+        struct sk_buff *(*gen_pdev_resume)(struct ath10k *ar);
+        struct sk_buff *(*gen_pdev_set_rd)(struct ath10k *ar, u16 rd, u16 rd2g,
+                                           u16 rd5g, u16 ctl2g, u16 ctl5g,
+                                           enum wmi_dfs_region dfs_reg);
+        struct sk_buff *(*gen_pdev_set_param)(struct ath10k *ar, u32 id,
+                                              u32 value);
+        struct sk_buff *(*gen_init)(struct ath10k *ar);
+        struct sk_buff *(*gen_start_scan)(struct ath10k *ar,
+                                          const struct wmi_start_scan_arg *arg);
+        struct sk_buff *(*gen_stop_scan)(struct ath10k *ar,
+                                         const struct wmi_stop_scan_arg *arg);
+        struct sk_buff *(*gen_vdev_create)(struct ath10k *ar, u32 vdev_id,
+                                           enum wmi_vdev_type type,
+                                           enum wmi_vdev_subtype subtype,
+                                           const u8 macaddr[ETH_ALEN]);
+        struct sk_buff *(*gen_vdev_delete)(struct ath10k *ar, u32 vdev_id);
+        struct sk_buff *(*gen_vdev_start)(struct ath10k *ar,
+                                          const struct wmi_vdev_start_request_arg *arg,
+                                          bool restart);
+        struct sk_buff *(*gen_vdev_stop)(struct ath10k *ar, u32 vdev_id);
+        struct sk_buff *(*gen_vdev_up)(struct ath10k *ar, u32 vdev_id, u32 aid,
+                                       const u8 *bssid);
+        struct sk_buff *(*gen_vdev_down)(struct ath10k *ar, u32 vdev_id);
+        struct sk_buff *(*gen_vdev_set_param)(struct ath10k *ar, u32 vdev_id,
+                                              u32 param_id, u32 param_value);
+        struct sk_buff *(*gen_vdev_install_key)(struct ath10k *ar,
+                                                const struct wmi_vdev_install_key_arg *arg);
+        struct sk_buff *(*gen_vdev_spectral_conf)(struct ath10k *ar,
+                                                  const struct wmi_vdev_spectral_conf_arg *arg);
+        struct sk_buff *(*gen_vdev_spectral_enable)(struct ath10k *ar, u32 vdev_id,
+                                                    u32 trigger, u32 enable);
+        struct sk_buff *(*gen_peer_create)(struct ath10k *ar, u32 vdev_id,
+                                           const u8 peer_addr[ETH_ALEN]);
+        struct sk_buff *(*gen_peer_delete)(struct ath10k *ar, u32 vdev_id,
+                                           const u8 peer_addr[ETH_ALEN]);
+        struct sk_buff *(*gen_peer_flush)(struct ath10k *ar, u32 vdev_id,
+                                          const u8 peer_addr[ETH_ALEN],
+                                          u32 tid_bitmap);
+        struct sk_buff *(*gen_peer_set_param)(struct ath10k *ar, u32 vdev_id,
+                                              const u8 *peer_addr,
+                                              enum wmi_peer_param param_id,
+                                              u32 param_value);
+        struct sk_buff *(*gen_peer_assoc)(struct ath10k *ar,
+                                          const struct wmi_peer_assoc_complete_arg *arg);
+        struct sk_buff *(*gen_set_psmode)(struct ath10k *ar, u32 vdev_id,
+                                          enum wmi_sta_ps_mode psmode);
+        struct sk_buff *(*gen_set_sta_ps)(struct ath10k *ar, u32 vdev_id,
+                                          enum wmi_sta_powersave_param param_id,
+                                          u32 value);
+        struct sk_buff *(*gen_set_ap_ps)(struct ath10k *ar, u32 vdev_id,
+                                         const u8 *mac,
+                                         enum wmi_ap_ps_peer_param param_id,
+                                         u32 value);
+        struct sk_buff *(*gen_scan_chan_list)(struct ath10k *ar,
+                                              const struct wmi_scan_chan_list_arg *arg);
+        struct sk_buff *(*gen_beacon_dma)(struct ath10k_vif *arvif);
+        struct sk_buff *(*gen_pdev_set_wmm)(struct ath10k *ar,
+                                            const struct wmi_pdev_set_wmm_params_arg *arg);
+        struct sk_buff *(*gen_request_stats)(struct ath10k *ar,
+                                             enum wmi_stats_id stats_id);
+        struct sk_buff *(*gen_force_fw_hang)(struct ath10k *ar,
+                                             enum wmi_force_fw_hang_type type,
+                                             u32 delay_ms);
+        struct sk_buff *(*gen_mgmt_tx)(struct ath10k *ar, struct sk_buff *skb);
+        struct sk_buff *(*gen_dbglog_cfg)(struct ath10k *ar, u32 module_enable);
+        struct sk_buff *(*gen_pktlog_enable)(struct ath10k *ar, u32 filter);
+        struct sk_buff *(*gen_pktlog_disable)(struct ath10k *ar);
+        struct sk_buff *(*gen_pdev_set_quiet_mode)(struct ath10k *ar,
+                                                   u32 period, u32 duration,
+                                                   u32 next_offset,
+                                                   u32 enabled);
+        struct sk_buff *(*gen_pdev_get_temperature)(struct ath10k *ar);
+};
+
+int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id);
+
+static inline int
+ath10k_wmi_rx(struct ath10k *ar, struct sk_buff *skb)
+{
+        if (WARN_ON_ONCE(!ar->wmi.ops->rx))
+                return -EOPNOTSUPP;
+
+        ar->wmi.ops->rx(ar, skb);
+        return 0;
+}
+
+static inline int
+ath10k_wmi_map_svc(struct ath10k *ar, const __le32 *in, unsigned long *out,
+                   size_t len)
+{
+        if (!ar->wmi.ops->map_svc)
+                return -EOPNOTSUPP;
+
+        ar->wmi.ops->map_svc(in, out, len);
+        return 0;
+}
+
+static inline int
+ath10k_wmi_pull_scan(struct ath10k *ar, struct sk_buff *skb,
+                     struct wmi_scan_ev_arg *arg)
+{
+        if (!ar->wmi.ops->pull_scan)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_scan(ar, skb, arg);
+}
+
+static inline int
+ath10k_wmi_pull_mgmt_rx(struct ath10k *ar, struct sk_buff *skb,
+                        struct wmi_mgmt_rx_ev_arg *arg)
+{
+        if (!ar->wmi.ops->pull_mgmt_rx)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_mgmt_rx(ar, skb, arg);
+}
+
+static inline int
+ath10k_wmi_pull_ch_info(struct ath10k *ar, struct sk_buff *skb,
+                        struct wmi_ch_info_ev_arg *arg)
+{
+        if (!ar->wmi.ops->pull_ch_info)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_ch_info(ar, skb, arg);
+}
+
+static inline int
+ath10k_wmi_pull_vdev_start(struct ath10k *ar, struct sk_buff *skb,
+                           struct wmi_vdev_start_ev_arg *arg)
+{
+        if (!ar->wmi.ops->pull_vdev_start)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_vdev_start(ar, skb, arg);
+}
+
+static inline int
+ath10k_wmi_pull_peer_kick(struct ath10k *ar, struct sk_buff *skb,
+                          struct wmi_peer_kick_ev_arg *arg)
+{
+        if (!ar->wmi.ops->pull_peer_kick)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_peer_kick(ar, skb, arg);
+}
+
+static inline int
+ath10k_wmi_pull_swba(struct ath10k *ar, struct sk_buff *skb,
+                     struct wmi_swba_ev_arg *arg)
+{
+        if (!ar->wmi.ops->pull_swba)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_swba(ar, skb, arg);
+}
+
+static inline int
+ath10k_wmi_pull_phyerr(struct ath10k *ar, struct sk_buff *skb,
+                       struct wmi_phyerr_ev_arg *arg)
+{
+        if (!ar->wmi.ops->pull_phyerr)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_phyerr(ar, skb, arg);
+}
+
+static inline int
+ath10k_wmi_pull_svc_rdy(struct ath10k *ar, struct sk_buff *skb,
+                        struct wmi_svc_rdy_ev_arg *arg)
+{
+        if (!ar->wmi.ops->pull_svc_rdy)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_svc_rdy(ar, skb, arg);
+}
+
+static inline int
+ath10k_wmi_pull_rdy(struct ath10k *ar, struct sk_buff *skb,
+                    struct wmi_rdy_ev_arg *arg)
+{
+        if (!ar->wmi.ops->pull_rdy)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_rdy(ar, skb, arg);
+}
+
+static inline int
+ath10k_wmi_pull_fw_stats(struct ath10k *ar, struct sk_buff *skb,
+                         struct ath10k_fw_stats *stats)
+{
+        if (!ar->wmi.ops->pull_fw_stats)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_fw_stats(ar, skb, stats);
+}
+
+static inline int
+ath10k_wmi_mgmt_tx(struct ath10k *ar, struct sk_buff *msdu)
+{
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(msdu);
+        struct sk_buff *skb;
+        int ret;
+
+        if (!ar->wmi.ops->gen_mgmt_tx)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_mgmt_tx(ar, msdu);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        ret = ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->mgmt_tx_cmdid);
+        if (ret)
+                return ret;
+
+        /* FIXME There's no ACK event for Management Tx. This probably
+         * shouldn't be called here either. */
+        info->flags |= IEEE80211_TX_STAT_ACK;
+        ieee80211_tx_status_irqsafe(ar->hw, msdu);
+
+        return 0;
+}
+
+static inline int
+ath10k_wmi_pdev_set_regdomain(struct ath10k *ar, u16 rd, u16 rd2g, u16 rd5g,
+                              u16 ctl2g, u16 ctl5g,
+                              enum wmi_dfs_region dfs_reg)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_pdev_set_rd)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_pdev_set_rd(ar, rd, rd2g, rd5g, ctl2g, ctl5g,
+                                           dfs_reg);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->pdev_set_regdomain_cmdid);
+}
+
+static inline int
+ath10k_wmi_pdev_suspend_target(struct ath10k *ar, u32 suspend_opt)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_pdev_suspend)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_pdev_suspend(ar, suspend_opt);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->pdev_suspend_cmdid);
+}
+
+static inline int
+ath10k_wmi_pdev_resume_target(struct ath10k *ar)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_pdev_resume)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_pdev_resume(ar);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->pdev_resume_cmdid);
+}
+
+static inline int
+ath10k_wmi_pdev_set_param(struct ath10k *ar, u32 id, u32 value)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_pdev_set_param)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_pdev_set_param(ar, id, value);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->pdev_set_param_cmdid);
+}
+
+static inline int
+ath10k_wmi_cmd_init(struct ath10k *ar)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_init)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_init(ar);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->init_cmdid);
+}
+
+static inline int
+ath10k_wmi_start_scan(struct ath10k *ar,
+                      const struct wmi_start_scan_arg *arg)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_start_scan)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_start_scan(ar, arg);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->start_scan_cmdid);
+}
+
+static inline int
+ath10k_wmi_stop_scan(struct ath10k *ar, const struct wmi_stop_scan_arg *arg)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_stop_scan)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_stop_scan(ar, arg);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->stop_scan_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_create(struct ath10k *ar, u32 vdev_id,
+                       enum wmi_vdev_type type,
+                       enum wmi_vdev_subtype subtype,
+                       const u8 macaddr[ETH_ALEN])
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_vdev_create)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_vdev_create(ar, vdev_id, type, subtype, macaddr);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_create_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_delete(struct ath10k *ar, u32 vdev_id)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_vdev_delete)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_vdev_delete(ar, vdev_id);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_delete_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_start(struct ath10k *ar,
+                      const struct wmi_vdev_start_request_arg *arg)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_vdev_start)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_vdev_start(ar, arg, false);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->vdev_start_request_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_restart(struct ath10k *ar,
+                        const struct wmi_vdev_start_request_arg *arg)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_vdev_start)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_vdev_start(ar, arg, true);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->vdev_restart_request_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_stop(struct ath10k *ar, u32 vdev_id)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_vdev_stop)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_vdev_stop(ar, vdev_id);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_stop_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_up(struct ath10k *ar, u32 vdev_id, u32 aid, const u8 *bssid)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_vdev_up)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_vdev_up(ar, vdev_id, aid, bssid);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_up_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_down(struct ath10k *ar, u32 vdev_id)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_vdev_down)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_vdev_down(ar, vdev_id);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_down_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_set_param(struct ath10k *ar, u32 vdev_id, u32 param_id,
+                          u32 param_value)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_vdev_set_param)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_vdev_set_param(ar, vdev_id, param_id,
+                                              param_value);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_set_param_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_install_key(struct ath10k *ar,
+                            const struct wmi_vdev_install_key_arg *arg)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_vdev_install_key)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_vdev_install_key(ar, arg);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->vdev_install_key_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_spectral_conf(struct ath10k *ar,
+                              const struct wmi_vdev_spectral_conf_arg *arg)
+{
+        struct sk_buff *skb;
+        u32 cmd_id;
+
+        skb = ar->wmi.ops->gen_vdev_spectral_conf(ar, arg);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        cmd_id = ar->wmi.cmd->vdev_spectral_scan_configure_cmdid;
+        return ath10k_wmi_cmd_send(ar, skb, cmd_id);
+}
+
+static inline int
+ath10k_wmi_vdev_spectral_enable(struct ath10k *ar, u32 vdev_id, u32 trigger,
+                                u32 enable)
+{
+        struct sk_buff *skb;
+        u32 cmd_id;
+
+        skb = ar->wmi.ops->gen_vdev_spectral_enable(ar, vdev_id, trigger,
+                                                    enable);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        cmd_id = ar->wmi.cmd->vdev_spectral_scan_enable_cmdid;
+        return ath10k_wmi_cmd_send(ar, skb, cmd_id);
+}
+
+static inline int
+ath10k_wmi_peer_create(struct ath10k *ar, u32 vdev_id,
+                       const u8 peer_addr[ETH_ALEN])
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_peer_create)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_peer_create(ar, vdev_id, peer_addr);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_create_cmdid);
+}
+
+static inline int
+ath10k_wmi_peer_delete(struct ath10k *ar, u32 vdev_id,
+                       const u8 peer_addr[ETH_ALEN])
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_peer_delete)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_peer_delete(ar, vdev_id, peer_addr);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_delete_cmdid);
+}
+
+static inline int
+ath10k_wmi_peer_flush(struct ath10k *ar, u32 vdev_id,
+                      const u8 peer_addr[ETH_ALEN], u32 tid_bitmap)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_peer_flush)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_peer_flush(ar, vdev_id, peer_addr, tid_bitmap);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_flush_tids_cmdid);
+}
+
+static inline int
+ath10k_wmi_peer_set_param(struct ath10k *ar, u32 vdev_id, const u8 *peer_addr,
+                          enum wmi_peer_param param_id, u32 param_value)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_peer_set_param)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_peer_set_param(ar, vdev_id, peer_addr, param_id,
+                                              param_value);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_set_param_cmdid);
+}
+
+static inline int
+ath10k_wmi_set_psmode(struct ath10k *ar, u32 vdev_id,
+                      enum wmi_sta_ps_mode psmode)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_set_psmode)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_set_psmode(ar, vdev_id, psmode);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->sta_powersave_mode_cmdid);
+}
+
+static inline int
+ath10k_wmi_set_sta_ps_param(struct ath10k *ar, u32 vdev_id,
+                            enum wmi_sta_powersave_param param_id, u32 value)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_set_sta_ps)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_set_sta_ps(ar, vdev_id, param_id, value);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->sta_powersave_param_cmdid);
+}
+
+static inline int
+ath10k_wmi_set_ap_ps_param(struct ath10k *ar, u32 vdev_id, const u8 *mac,
+                           enum wmi_ap_ps_peer_param param_id, u32 value)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_set_ap_ps)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_set_ap_ps(ar, vdev_id, mac, param_id, value);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->ap_ps_peer_param_cmdid);
+}
+
+static inline int
+ath10k_wmi_scan_chan_list(struct ath10k *ar,
+                          const struct wmi_scan_chan_list_arg *arg)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_scan_chan_list)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_scan_chan_list(ar, arg);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->scan_chan_list_cmdid);
+}
+
+static inline int
+ath10k_wmi_peer_assoc(struct ath10k *ar,
+                      const struct wmi_peer_assoc_complete_arg *arg)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_peer_assoc)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_peer_assoc(ar, arg);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_assoc_cmdid);
+}
+
+static inline int
+ath10k_wmi_beacon_send_ref_nowait(struct ath10k_vif *arvif)
+{
+        struct ath10k *ar = arvif->ar;
+        struct sk_buff *skb;
+        int ret;
+
+        if (!ar->wmi.ops->gen_beacon_dma)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_beacon_dma(arvif);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        ret = ath10k_wmi_cmd_send_nowait(ar, skb,
+                                         ar->wmi.cmd->pdev_send_bcn_cmdid);
+        if (ret) {
+                dev_kfree_skb(skb);
+                return ret;
+        }
+
+        return 0;
+}
+
+static inline int
+ath10k_wmi_pdev_set_wmm_params(struct ath10k *ar,
+                               const struct wmi_pdev_set_wmm_params_arg *arg)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_pdev_set_wmm)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_pdev_set_wmm(ar, arg);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->pdev_set_wmm_params_cmdid);
+}
+
+static inline int
+ath10k_wmi_request_stats(struct ath10k *ar, enum wmi_stats_id stats_id)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_request_stats)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_request_stats(ar, stats_id);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->request_stats_cmdid);
+}
+
+static inline int
+ath10k_wmi_force_fw_hang(struct ath10k *ar,
+                         enum wmi_force_fw_hang_type type, u32 delay_ms)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_force_fw_hang)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_force_fw_hang(ar, type, delay_ms);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->force_fw_hang_cmdid);
+}
+
+static inline int
+ath10k_wmi_dbglog_cfg(struct ath10k *ar, u32 module_enable)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_dbglog_cfg)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_dbglog_cfg(ar, module_enable);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->dbglog_cfg_cmdid);
+}
+
+static inline int
+ath10k_wmi_pdev_pktlog_enable(struct ath10k *ar, u32 filter)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_pktlog_enable)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_pktlog_enable(ar, filter);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->pdev_pktlog_enable_cmdid);
+}
+
+static inline int
+ath10k_wmi_pdev_pktlog_disable(struct ath10k *ar)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_pktlog_disable)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_pktlog_disable(ar);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->pdev_pktlog_disable_cmdid);
+}
+
+static inline int
+ath10k_wmi_pdev_set_quiet_mode(struct ath10k *ar, u32 period, u32 duration,
+                               u32 next_offset, u32 enabled)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_pdev_set_quiet_mode)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_pdev_set_quiet_mode(ar, period, duration,
+                                                   next_offset, enabled);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->pdev_set_quiet_mode_cmdid);
+}
+
+static inline int
+ath10k_wmi_pdev_get_temperature(struct ath10k *ar)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_pdev_get_temperature)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_pdev_get_temperature(ar);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->pdev_get_temperature_cmdid);
+}
+
+#endif
diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
new file mode 100644
index 000000000000..4c050cec3966
--- /dev/null
+++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
@@ -0,0 +1,2222 @@
+/*
+ * Copyright (c) 2005-2011 Atheros Communications Inc.
+ * Copyright (c) 2011-2014 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#include "core.h"
+#include "debug.h"
+#include "hw.h"
+#include "wmi.h"
+#include "wmi-ops.h"
+#include "wmi-tlv.h"
+
+/***************/
+/* TLV helpers */
+/**************/
+
+struct wmi_tlv_policy {
+        size_t min_len;
+};
+
+static const struct wmi_tlv_policy wmi_tlv_policies[] = {
+        [WMI_TLV_TAG_ARRAY_BYTE]
+                = { .min_len = sizeof(u8) },
+        [WMI_TLV_TAG_ARRAY_UINT32]
+                = { .min_len = sizeof(u32) },
+        [WMI_TLV_TAG_STRUCT_SCAN_EVENT]
+                = { .min_len = sizeof(struct wmi_scan_event) },
+        [WMI_TLV_TAG_STRUCT_MGMT_RX_HDR]
+                = { .min_len = sizeof(struct wmi_tlv_mgmt_rx_ev) },
+        [WMI_TLV_TAG_STRUCT_CHAN_INFO_EVENT]
+                = { .min_len = sizeof(struct wmi_chan_info_event) },
+        [WMI_TLV_TAG_STRUCT_VDEV_START_RESPONSE_EVENT]
+                = { .min_len = sizeof(struct wmi_vdev_start_response_event) },
+        [WMI_TLV_TAG_STRUCT_PEER_STA_KICKOUT_EVENT]
+                = { .min_len = sizeof(struct wmi_peer_sta_kickout_event) },
+        [WMI_TLV_TAG_STRUCT_HOST_SWBA_EVENT]
+                = { .min_len = sizeof(struct wmi_host_swba_event) },
+        [WMI_TLV_TAG_STRUCT_TIM_INFO]
+                = { .min_len = sizeof(struct wmi_tim_info) },
+        [WMI_TLV_TAG_STRUCT_P2P_NOA_INFO]
+                = { .min_len = sizeof(struct wmi_p2p_noa_info) },
+        [WMI_TLV_TAG_STRUCT_SERVICE_READY_EVENT]
+                = { .min_len = sizeof(struct wmi_tlv_svc_rdy_ev) },
+        [WMI_TLV_TAG_STRUCT_HAL_REG_CAPABILITIES]
+                = { .min_len = sizeof(struct hal_reg_capabilities) },
+        [WMI_TLV_TAG_STRUCT_WLAN_HOST_MEM_REQ]
+                = { .min_len = sizeof(struct wlan_host_mem_req) },
+        [WMI_TLV_TAG_STRUCT_READY_EVENT]
+                = { .min_len = sizeof(struct wmi_tlv_rdy_ev) },
+};
+
+static int
+ath10k_wmi_tlv_iter(struct ath10k *ar, const void *ptr, size_t len,
+                    int (*iter)(struct ath10k *ar, u16 tag, u16 len,
+                                const void *ptr, void *data),
+                    void *data)
+{
+        const void *begin = ptr;
+        const struct wmi_tlv *tlv;
+        u16 tlv_tag, tlv_len;
+        int ret;
+
+        while (len > 0) {
+                if (len < sizeof(*tlv)) {
+                        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                                   "wmi tlv parse failure at byte %zd (%zu bytes left, %zu expected)\n",
+                                   ptr - begin, len, sizeof(*tlv));
+                        return -EINVAL;
+                }
+
+                tlv = ptr;
+                tlv_tag = __le16_to_cpu(tlv->tag);
+                tlv_len = __le16_to_cpu(tlv->len);
+                ptr += sizeof(*tlv);
+                len -= sizeof(*tlv);
+
+                if (tlv_len > len) {
+                        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                                   "wmi tlv parse failure of tag %hhu at byte %zd (%zu bytes left, %hhu expected)\n",
+                                   tlv_tag, ptr - begin, len, tlv_len);
+                        return -EINVAL;
+                }
+
+                if (tlv_tag < ARRAY_SIZE(wmi_tlv_policies) &&
+                    wmi_tlv_policies[tlv_tag].min_len &&
+                    wmi_tlv_policies[tlv_tag].min_len > tlv_len) {
+                        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                                   "wmi tlv parse failure of tag %hhu at byte %zd (%hhu bytes is less than min length %zu)\n",
+                                   tlv_tag, ptr - begin, tlv_len,
+                                   wmi_tlv_policies[tlv_tag].min_len);
+                        return -EINVAL;
+                }
+
+                ret = iter(ar, tlv_tag, tlv_len, ptr, data);
+                if (ret)
+                        return ret;
+
+                ptr += tlv_len;
+                len -= tlv_len;
+        }
+
+        return 0;
+}
+
+static int ath10k_wmi_tlv_iter_parse(struct ath10k *ar, u16 tag, u16 len,
+                                     const void *ptr, void *data)
+{
+        const void **tb = data;
+
+        if (tag < WMI_TLV_TAG_MAX)
+                tb[tag] = ptr;
+
+        return 0;
+}
+
+static int ath10k_wmi_tlv_parse(struct ath10k *ar, const void **tb,
+                                const void *ptr, size_t len)
+{
+        return ath10k_wmi_tlv_iter(ar, ptr, len, ath10k_wmi_tlv_iter_parse,
+                                   (void *)tb);
+}
+
+static const void **
+ath10k_wmi_tlv_parse_alloc(struct ath10k *ar, const void *ptr,
+                           size_t len, gfp_t gfp)
+{
+        const void **tb;
+        int ret;
+
+        tb = kzalloc(sizeof(*tb) * WMI_TLV_TAG_MAX, gfp);
+        if (!tb)
+                return ERR_PTR(-ENOMEM);
+
+        ret = ath10k_wmi_tlv_parse(ar, tb, ptr, len);
+        if (ret) {
+                kfree(tb);
+                return ERR_PTR(ret);
+        }
+
+        return tb;
+}
+
+static u16 ath10k_wmi_tlv_len(const void *ptr)
+{
+        return __le16_to_cpu((((const struct wmi_tlv *)ptr) - 1)->len);
+}
+
+/***********/
+/* TLV ops */
+/***********/
+
+static void ath10k_wmi_tlv_op_rx(struct ath10k *ar, struct sk_buff *skb)
+{
+        struct wmi_cmd_hdr *cmd_hdr;
+        enum wmi_tlv_event_id id;
+
+        cmd_hdr = (struct wmi_cmd_hdr *)skb->data;
+        id = MS(__le32_to_cpu(cmd_hdr->cmd_id), WMI_CMD_HDR_CMD_ID);
+
+        if (skb_pull(skb, sizeof(struct wmi_cmd_hdr)) == NULL)
+                return;
+
+        trace_ath10k_wmi_event(ar, id, skb->data, skb->len);
+
+        switch (id) {
+        case WMI_TLV_MGMT_RX_EVENTID:
+                ath10k_wmi_event_mgmt_rx(ar, skb);
+                /* mgmt_rx() owns the skb now! */
+                return;
+        case WMI_TLV_SCAN_EVENTID:
+                ath10k_wmi_event_scan(ar, skb);
+                break;
+        case WMI_TLV_CHAN_INFO_EVENTID:
+                ath10k_wmi_event_chan_info(ar, skb);
+                break;
+        case WMI_TLV_ECHO_EVENTID:
+                ath10k_wmi_event_echo(ar, skb);
+                break;
+        case WMI_TLV_DEBUG_MESG_EVENTID:
+                ath10k_wmi_event_debug_mesg(ar, skb);
+                break;
+        case WMI_TLV_UPDATE_STATS_EVENTID:
+                ath10k_wmi_event_update_stats(ar, skb);
+                break;
+        case WMI_TLV_VDEV_START_RESP_EVENTID:
+                ath10k_wmi_event_vdev_start_resp(ar, skb);
+                break;
+        case WMI_TLV_VDEV_STOPPED_EVENTID:
+                ath10k_wmi_event_vdev_stopped(ar, skb);
+                break;
+        case WMI_TLV_PEER_STA_KICKOUT_EVENTID:
+                ath10k_wmi_event_peer_sta_kickout(ar, skb);
+                break;
+        case WMI_TLV_HOST_SWBA_EVENTID:
+                ath10k_wmi_event_host_swba(ar, skb);
+                break;
+        case WMI_TLV_TBTTOFFSET_UPDATE_EVENTID:
+                ath10k_wmi_event_tbttoffset_update(ar, skb);
+                break;
+        case WMI_TLV_PHYERR_EVENTID:
+                ath10k_wmi_event_phyerr(ar, skb);
+                break;
+        case WMI_TLV_ROAM_EVENTID:
+                ath10k_wmi_event_roam(ar, skb);
+                break;
+        case WMI_TLV_PROFILE_MATCH:
+                ath10k_wmi_event_profile_match(ar, skb);
+                break;
+        case WMI_TLV_DEBUG_PRINT_EVENTID:
+                ath10k_wmi_event_debug_print(ar, skb);
+                break;
+        case WMI_TLV_PDEV_QVIT_EVENTID:
+                ath10k_wmi_event_pdev_qvit(ar, skb);
+                break;
+        case WMI_TLV_WLAN_PROFILE_DATA_EVENTID:
+                ath10k_wmi_event_wlan_profile_data(ar, skb);
+                break;
+        case WMI_TLV_RTT_MEASUREMENT_REPORT_EVENTID:
+                ath10k_wmi_event_rtt_measurement_report(ar, skb);
+                break;
+        case WMI_TLV_TSF_MEASUREMENT_REPORT_EVENTID:
+                ath10k_wmi_event_tsf_measurement_report(ar, skb);
+                break;
+        case WMI_TLV_RTT_ERROR_REPORT_EVENTID:
+                ath10k_wmi_event_rtt_error_report(ar, skb);
+                break;
+        case WMI_TLV_WOW_WAKEUP_HOST_EVENTID:
+                ath10k_wmi_event_wow_wakeup_host(ar, skb);
+                break;
+        case WMI_TLV_DCS_INTERFERENCE_EVENTID:
+                ath10k_wmi_event_dcs_interference(ar, skb);
+                break;
+        case WMI_TLV_PDEV_TPC_CONFIG_EVENTID:
+                ath10k_wmi_event_pdev_tpc_config(ar, skb);
+                break;
+        case WMI_TLV_PDEV_FTM_INTG_EVENTID:
+                ath10k_wmi_event_pdev_ftm_intg(ar, skb);
+                break;
+        case WMI_TLV_GTK_OFFLOAD_STATUS_EVENTID:
+                ath10k_wmi_event_gtk_offload_status(ar, skb);
+                break;
+        case WMI_TLV_GTK_REKEY_FAIL_EVENTID:
+                ath10k_wmi_event_gtk_rekey_fail(ar, skb);
+                break;
+        case WMI_TLV_TX_DELBA_COMPLETE_EVENTID:
+                ath10k_wmi_event_delba_complete(ar, skb);
+                break;
+        case WMI_TLV_TX_ADDBA_COMPLETE_EVENTID:
+                ath10k_wmi_event_addba_complete(ar, skb);
+                break;
+        case WMI_TLV_VDEV_INSTALL_KEY_COMPLETE_EVENTID:
+                ath10k_wmi_event_vdev_install_key_complete(ar, skb);
+                break;
+        case WMI_TLV_SERVICE_READY_EVENTID:
+                ath10k_wmi_event_service_ready(ar, skb);
+                break;
+        case WMI_TLV_READY_EVENTID:
+                ath10k_wmi_event_ready(ar, skb);
+                break;
+        default:
+                ath10k_warn(ar, "Unknown eventid: %d\n", id);
+                break;
+        }
+
+        dev_kfree_skb(skb);
+}
+
+static int ath10k_wmi_tlv_op_pull_scan_ev(struct ath10k *ar,
+                                          struct sk_buff *skb,
+                                          struct wmi_scan_ev_arg *arg)
+{
+        const void **tb;
+        const struct wmi_scan_event *ev;
+        int ret;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_SCAN_EVENT];
+        if (!ev) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        arg->event_type = ev->event_type;
+        arg->reason = ev->reason;
+        arg->channel_freq = ev->channel_freq;
+        arg->scan_req_id = ev->scan_req_id;
+        arg->scan_id = ev->scan_id;
+        arg->vdev_id = ev->vdev_id;
+
+        kfree(tb);
+        return 0;
+}
+
+static int ath10k_wmi_tlv_op_pull_mgmt_rx_ev(struct ath10k *ar,
+                                             struct sk_buff *skb,
+                                             struct wmi_mgmt_rx_ev_arg *arg)
+{
+        const void **tb;
+        const struct wmi_tlv_mgmt_rx_ev *ev;
+        const u8 *frame;
+        u32 msdu_len;
+        int ret;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_MGMT_RX_HDR];
+        frame = tb[WMI_TLV_TAG_ARRAY_BYTE];
+
+        if (!ev || !frame) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        arg->channel = ev->channel;
+        arg->buf_len = ev->buf_len;
+        arg->status = ev->status;
+        arg->snr = ev->snr;
+        arg->phy_mode = ev->phy_mode;
+        arg->rate = ev->rate;
+
+        msdu_len = __le32_to_cpu(arg->buf_len);
+
+        if (skb->len < (frame - skb->data) + msdu_len) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        /* shift the sk_buff to point to `frame` */
+        skb_trim(skb, 0);
+        skb_put(skb, frame - skb->data);
+        skb_pull(skb, frame - skb->data);
+        skb_put(skb, msdu_len);
+
+        kfree(tb);
+        return 0;
+}
+
+static int ath10k_wmi_tlv_op_pull_ch_info_ev(struct ath10k *ar,
+                                             struct sk_buff *skb,
+                                             struct wmi_ch_info_ev_arg *arg)
+{
+        const void **tb;
+        const struct wmi_chan_info_event *ev;
+        int ret;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_CHAN_INFO_EVENT];
+        if (!ev) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        arg->err_code = ev->err_code;
+        arg->freq = ev->freq;
+        arg->cmd_flags = ev->cmd_flags;
+        arg->noise_floor = ev->noise_floor;
+        arg->rx_clear_count = ev->rx_clear_count;
+        arg->cycle_count = ev->cycle_count;
+
+        kfree(tb);
+        return 0;
+}
+
+static int
+ath10k_wmi_tlv_op_pull_vdev_start_ev(struct ath10k *ar, struct sk_buff *skb,
+                                     struct wmi_vdev_start_ev_arg *arg)
+{
+        const void **tb;
+        const struct wmi_vdev_start_response_event *ev;
+        int ret;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_VDEV_START_RESPONSE_EVENT];
+        if (!ev) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        skb_pull(skb, sizeof(*ev));
+        arg->vdev_id = ev->vdev_id;
+        arg->req_id = ev->req_id;
+        arg->resp_type = ev->resp_type;
+        arg->status = ev->status;
+
+        kfree(tb);
+        return 0;
+}
+
+static int ath10k_wmi_tlv_op_pull_peer_kick_ev(struct ath10k *ar,
+                                               struct sk_buff *skb,
+                                               struct wmi_peer_kick_ev_arg *arg)
+{
+        const void **tb;
+        const struct wmi_peer_sta_kickout_event *ev;
+        int ret;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_PEER_STA_KICKOUT_EVENT];
+        if (!ev) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        arg->mac_addr = ev->peer_macaddr.addr;
+
+        kfree(tb);
+        return 0;
+}
+
+struct wmi_tlv_swba_parse {
+        const struct wmi_host_swba_event *ev;
+        bool tim_done;
+        bool noa_done;
+        size_t n_tim;
+        size_t n_noa;
+        struct wmi_swba_ev_arg *arg;
+};
+
+static int ath10k_wmi_tlv_swba_tim_parse(struct ath10k *ar, u16 tag, u16 len,
+                                         const void *ptr, void *data)
+{
+        struct wmi_tlv_swba_parse *swba = data;
+
+        if (tag != WMI_TLV_TAG_STRUCT_TIM_INFO)
+                return -EPROTO;
+
+        if (swba->n_tim >= ARRAY_SIZE(swba->arg->tim_info))
+                return -ENOBUFS;
+
+        swba->arg->tim_info[swba->n_tim++] = ptr;
+        return 0;
+}
+
+static int ath10k_wmi_tlv_swba_noa_parse(struct ath10k *ar, u16 tag, u16 len,
+                                         const void *ptr, void *data)
+{
+        struct wmi_tlv_swba_parse *swba = data;
+
+        if (tag != WMI_TLV_TAG_STRUCT_P2P_NOA_INFO)
+                return -EPROTO;
+
+        if (swba->n_noa >= ARRAY_SIZE(swba->arg->noa_info))
+                return -ENOBUFS;
+
+        swba->arg->noa_info[swba->n_noa++] = ptr;
+        return 0;
+}
+
+static int ath10k_wmi_tlv_swba_parse(struct ath10k *ar, u16 tag, u16 len,
+                                     const void *ptr, void *data)
+{
+        struct wmi_tlv_swba_parse *swba = data;
+        int ret;
+
+        switch (tag) {
+        case WMI_TLV_TAG_STRUCT_HOST_SWBA_EVENT:
+                swba->ev = ptr;
+                break;
+        case WMI_TLV_TAG_ARRAY_STRUCT:
+                if (!swba->tim_done) {
+                        swba->tim_done = true;
+                        ret = ath10k_wmi_tlv_iter(ar, ptr, len,
+                                                  ath10k_wmi_tlv_swba_tim_parse,
+                                                  swba);
+                        if (ret)
+                                return ret;
+                } else if (!swba->noa_done) {
+                        swba->noa_done = true;
+                        ret = ath10k_wmi_tlv_iter(ar, ptr, len,
+                                                  ath10k_wmi_tlv_swba_noa_parse,
+                                                  swba);
+                        if (ret)
+                                return ret;
+                }
+                break;
+        default:
+                break;
+        }
+        return 0;
+}
+
+static int ath10k_wmi_tlv_op_pull_swba_ev(struct ath10k *ar,
+                                          struct sk_buff *skb,
+                                          struct wmi_swba_ev_arg *arg)
+{
+        struct wmi_tlv_swba_parse swba = { .arg = arg };
+        u32 map;
+        size_t n_vdevs;
+        int ret;
+
+        ret = ath10k_wmi_tlv_iter(ar, skb->data, skb->len,
+                                  ath10k_wmi_tlv_swba_parse, &swba);
+        if (ret) {
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        if (!swba.ev)
+                return -EPROTO;
+
+        arg->vdev_map = swba.ev->vdev_map;
+
+        for (map = __le32_to_cpu(arg->vdev_map), n_vdevs = 0; map; map >>= 1)
+                if (map & BIT(0))
+                        n_vdevs++;
+
+        if (n_vdevs != swba.n_tim ||
+            n_vdevs != swba.n_noa)
+                return -EPROTO;
+
+        return 0;
+}
+
+static int ath10k_wmi_tlv_op_pull_phyerr_ev(struct ath10k *ar,
+                                            struct sk_buff *skb,
+                                            struct wmi_phyerr_ev_arg *arg)
+{
+        const void **tb;
+        const struct wmi_tlv_phyerr_ev *ev;
+        const void *phyerrs;
+        int ret;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_COMB_PHYERR_RX_HDR];
+        phyerrs = tb[WMI_TLV_TAG_ARRAY_BYTE];
+
+        if (!ev || !phyerrs) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        arg->num_phyerrs  = ev->num_phyerrs;
+        arg->tsf_l32 = ev->tsf_l32;
+        arg->tsf_u32 = ev->tsf_u32;
+        arg->buf_len = ev->buf_len;
+        arg->phyerrs = phyerrs;
+
+        kfree(tb);
+        return 0;
+}
+
+#define WMI_TLV_ABI_VER_NS0 0x5F414351
+#define WMI_TLV_ABI_VER_NS1 0x00004C4D
+#define WMI_TLV_ABI_VER_NS2 0x00000000
+#define WMI_TLV_ABI_VER_NS3 0x00000000
+
+#define WMI_TLV_ABI_VER0_MAJOR 1
+#define WMI_TLV_ABI_VER0_MINOR 0
+#define WMI_TLV_ABI_VER0 ((((WMI_TLV_ABI_VER0_MAJOR) << 24) & 0xFF000000) | \
+                          (((WMI_TLV_ABI_VER0_MINOR) <<  0) & 0x00FFFFFF))
+#define WMI_TLV_ABI_VER1 53
+
+static int
+ath10k_wmi_tlv_parse_mem_reqs(struct ath10k *ar, u16 tag, u16 len,
+                              const void *ptr, void *data)
+{
+        struct wmi_svc_rdy_ev_arg *arg = data;
+        int i;
+
+        if (tag != WMI_TLV_TAG_STRUCT_WLAN_HOST_MEM_REQ)
+                return -EPROTO;
+
+        for (i = 0; i < ARRAY_SIZE(arg->mem_reqs); i++) {
+                if (!arg->mem_reqs[i]) {
+                        arg->mem_reqs[i] = ptr;
+                        return 0;
+                }
+        }
+
+        return -ENOMEM;
+}
+
+static int ath10k_wmi_tlv_op_pull_svc_rdy_ev(struct ath10k *ar,
+                                             struct sk_buff *skb,
+                                             struct wmi_svc_rdy_ev_arg *arg)
+{
+        const void **tb;
+        const struct hal_reg_capabilities *reg;
+        const struct wmi_tlv_svc_rdy_ev *ev;
+        const __le32 *svc_bmap;
+        const struct wlan_host_mem_req *mem_reqs;
+        int ret;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_SERVICE_READY_EVENT];
+        reg = tb[WMI_TLV_TAG_STRUCT_HAL_REG_CAPABILITIES];
+        svc_bmap = tb[WMI_TLV_TAG_ARRAY_UINT32];
+        mem_reqs = tb[WMI_TLV_TAG_ARRAY_STRUCT];
+
+        if (!ev || !reg || !svc_bmap || !mem_reqs) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        /* This is an internal ABI compatibility check for WMI TLV so check it
+         * here instead of the generic WMI code.
+         */
+        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                   "wmi tlv abi 0x%08x ?= 0x%08x, 0x%08x ?= 0x%08x, 0x%08x ?= 0x%08x, 0x%08x ?= 0x%08x, 0x%08x ?= 0x%08x\n",
+                   __le32_to_cpu(ev->abi.abi_ver0), WMI_TLV_ABI_VER0,
+                   __le32_to_cpu(ev->abi.abi_ver_ns0), WMI_TLV_ABI_VER_NS0,
+                   __le32_to_cpu(ev->abi.abi_ver_ns1), WMI_TLV_ABI_VER_NS1,
+                   __le32_to_cpu(ev->abi.abi_ver_ns2), WMI_TLV_ABI_VER_NS2,
+                   __le32_to_cpu(ev->abi.abi_ver_ns3), WMI_TLV_ABI_VER_NS3);
+
+        if (__le32_to_cpu(ev->abi.abi_ver0) != WMI_TLV_ABI_VER0 ||
+            __le32_to_cpu(ev->abi.abi_ver_ns0) != WMI_TLV_ABI_VER_NS0 ||
+            __le32_to_cpu(ev->abi.abi_ver_ns1) != WMI_TLV_ABI_VER_NS1 ||
+            __le32_to_cpu(ev->abi.abi_ver_ns2) != WMI_TLV_ABI_VER_NS2 ||
+            __le32_to_cpu(ev->abi.abi_ver_ns3) != WMI_TLV_ABI_VER_NS3) {
+                kfree(tb);
+                return -ENOTSUPP;
+        }
+
+        arg->min_tx_power = ev->hw_min_tx_power;
+        arg->max_tx_power = ev->hw_max_tx_power;
+        arg->ht_cap = ev->ht_cap_info;
+        arg->vht_cap = ev->vht_cap_info;
+        arg->sw_ver0 = ev->abi.abi_ver0;
+        arg->sw_ver1 = ev->abi.abi_ver1;
+        arg->fw_build = ev->fw_build_vers;
+        arg->phy_capab = ev->phy_capability;
+        arg->num_rf_chains = ev->num_rf_chains;
+        arg->eeprom_rd = reg->eeprom_rd;
+        arg->num_mem_reqs = ev->num_mem_reqs;
+        arg->service_map = svc_bmap;
+        arg->service_map_len = ath10k_wmi_tlv_len(svc_bmap);
+
+        ret = ath10k_wmi_tlv_iter(ar, mem_reqs, ath10k_wmi_tlv_len(mem_reqs),
+                                  ath10k_wmi_tlv_parse_mem_reqs, arg);
+        if (ret) {
+                kfree(tb);
+                ath10k_warn(ar, "failed to parse mem_reqs tlv: %d\n", ret);
+                return ret;
+        }
+
+        kfree(tb);
+        return 0;
+}
+
+static int ath10k_wmi_tlv_op_pull_rdy_ev(struct ath10k *ar,
+                                         struct sk_buff *skb,
+                                         struct wmi_rdy_ev_arg *arg)
+{
+        const void **tb;
+        const struct wmi_tlv_rdy_ev *ev;
+        int ret;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_READY_EVENT];
+        if (!ev) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        arg->sw_version = ev->abi.abi_ver0;
+        arg->abi_version = ev->abi.abi_ver1;
+        arg->status = ev->status;
+        arg->mac_addr = ev->mac_addr.addr;
+
+        kfree(tb);
+        return 0;
+}
+
+static int ath10k_wmi_tlv_op_pull_fw_stats(struct ath10k *ar,
+                                           struct sk_buff *skb,
+                                           struct ath10k_fw_stats *stats)
+{
+        const void **tb;
+        const struct wmi_stats_event *ev;
+        const void *data;
+        u32 num_pdev_stats, num_vdev_stats, num_peer_stats;
+        size_t data_len;
+        int ret;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_STATS_EVENT];
+        data = tb[WMI_TLV_TAG_ARRAY_BYTE];
+
+        if (!ev || !data) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        data_len = ath10k_wmi_tlv_len(data);
+        num_pdev_stats = __le32_to_cpu(ev->num_pdev_stats);
+        num_vdev_stats = __le32_to_cpu(ev->num_vdev_stats);
+        num_peer_stats = __le32_to_cpu(ev->num_peer_stats);
+
+        WARN_ON(1); /* FIXME: not implemented yet */
+
+        kfree(tb);
+        return 0;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_pdev_suspend(struct ath10k *ar, u32 opt)
+{
+        struct wmi_tlv_pdev_suspend *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PDEV_SUSPEND_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->opt = __cpu_to_le32(opt);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv pdev suspend\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_pdev_resume(struct ath10k *ar)
+{
+        struct wmi_tlv_resume_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PDEV_RESUME_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->reserved = __cpu_to_le32(0);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv pdev resume\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_pdev_set_rd(struct ath10k *ar,
+                                  u16 rd, u16 rd2g, u16 rd5g,
+                                  u16 ctl2g, u16 ctl5g,
+                                  enum wmi_dfs_region dfs_reg)
+{
+        struct wmi_tlv_pdev_set_rd_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PDEV_SET_REGDOMAIN_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->regd = __cpu_to_le32(rd);
+        cmd->regd_2ghz = __cpu_to_le32(rd2g);
+        cmd->regd_5ghz = __cpu_to_le32(rd5g);
+        cmd->conform_limit_2ghz = __cpu_to_le32(rd2g);
+        cmd->conform_limit_5ghz = __cpu_to_le32(rd5g);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv pdev set rd\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_pdev_set_param(struct ath10k *ar, u32 param_id,
+                                     u32 param_value)
+{
+        struct wmi_tlv_pdev_set_param_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PDEV_SET_PARAM_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->param_id = __cpu_to_le32(param_id);
+        cmd->param_value = __cpu_to_le32(param_value);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv pdev set param\n");
+        return skb;
+}
+
+static struct sk_buff *ath10k_wmi_tlv_op_gen_init(struct ath10k *ar)
+{
+        struct sk_buff *skb;
+        struct wmi_tlv *tlv;
+        struct wmi_tlv_init_cmd *cmd;
+        struct wmi_tlv_resource_config *cfg;
+        struct wmi_host_mem_chunks *chunks;
+        size_t len, chunks_len;
+        void *ptr;
+
+        chunks_len = ar->wmi.num_mem_chunks * sizeof(struct host_memory_chunk);
+        len = (sizeof(*tlv) + sizeof(*cmd)) +
+              (sizeof(*tlv) + sizeof(*cfg)) +
+              (sizeof(*tlv) + chunks_len);
+
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = skb->data;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_INIT_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_RESOURCE_CONFIG);
+        tlv->len = __cpu_to_le16(sizeof(*cfg));
+        cfg = (void *)tlv->value;
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cfg);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_STRUCT);
+        tlv->len = __cpu_to_le16(chunks_len);
+        chunks = (void *)tlv->value;
+
+        ptr += sizeof(*tlv);
+        ptr += chunks_len;
+
+        cmd->abi.abi_ver0 = __cpu_to_le32(WMI_TLV_ABI_VER0);
+        cmd->abi.abi_ver1 = __cpu_to_le32(WMI_TLV_ABI_VER1);
+        cmd->abi.abi_ver_ns0 = __cpu_to_le32(WMI_TLV_ABI_VER_NS0);
+        cmd->abi.abi_ver_ns1 = __cpu_to_le32(WMI_TLV_ABI_VER_NS1);
+        cmd->abi.abi_ver_ns2 = __cpu_to_le32(WMI_TLV_ABI_VER_NS2);
+        cmd->abi.abi_ver_ns3 = __cpu_to_le32(WMI_TLV_ABI_VER_NS3);
+        cmd->num_host_mem_chunks = __cpu_to_le32(ar->wmi.num_mem_chunks);
+
+        cfg->num_vdevs = __cpu_to_le32(TARGET_TLV_NUM_VDEVS);
+        cfg->num_peers = __cpu_to_le32(TARGET_TLV_NUM_PEERS);
+        cfg->num_offload_peers = __cpu_to_le32(0);
+        cfg->num_offload_reorder_bufs = __cpu_to_le32(0);
+        cfg->num_peer_keys = __cpu_to_le32(2);
+        cfg->num_tids = __cpu_to_le32(TARGET_TLV_NUM_TIDS);
+        cfg->ast_skid_limit = __cpu_to_le32(0x10);
+        cfg->tx_chain_mask = __cpu_to_le32(0x7);
+        cfg->rx_chain_mask = __cpu_to_le32(0x7);
+        cfg->rx_timeout_pri[0] = __cpu_to_le32(0x64);
+        cfg->rx_timeout_pri[1] = __cpu_to_le32(0x64);
+        cfg->rx_timeout_pri[2] = __cpu_to_le32(0x64);
+        cfg->rx_timeout_pri[3] = __cpu_to_le32(0x28);
+        cfg->rx_decap_mode = __cpu_to_le32(1);
+        cfg->scan_max_pending_reqs = __cpu_to_le32(4);
+        cfg->bmiss_offload_max_vdev = __cpu_to_le32(3);
+        cfg->roam_offload_max_vdev = __cpu_to_le32(3);
+        cfg->roam_offload_max_ap_profiles = __cpu_to_le32(8);
+        cfg->num_mcast_groups = __cpu_to_le32(0);
+        cfg->num_mcast_table_elems = __cpu_to_le32(0);
+        cfg->mcast2ucast_mode = __cpu_to_le32(0);
+        cfg->tx_dbg_log_size = __cpu_to_le32(0x400);
+        cfg->num_wds_entries = __cpu_to_le32(0x20);
+        cfg->dma_burst_size = __cpu_to_le32(0);
+        cfg->mac_aggr_delim = __cpu_to_le32(0);
+        cfg->rx_skip_defrag_timeout_dup_detection_check = __cpu_to_le32(0);
+        cfg->vow_config = __cpu_to_le32(0);
+        cfg->gtk_offload_max_vdev = __cpu_to_le32(2);
+        cfg->num_msdu_desc = __cpu_to_le32(TARGET_TLV_NUM_MSDU_DESC);
+        cfg->max_frag_entries = __cpu_to_le32(2);
+        cfg->num_tdls_vdevs = __cpu_to_le32(1);
+        cfg->num_tdls_conn_table_entries = __cpu_to_le32(0x20);
+        cfg->beacon_tx_offload_max_vdev = __cpu_to_le32(2);
+        cfg->num_multicast_filter_entries = __cpu_to_le32(5);
+        cfg->num_wow_filters = __cpu_to_le32(0x16);
+        cfg->num_keep_alive_pattern = __cpu_to_le32(6);
+        cfg->keep_alive_pattern_size = __cpu_to_le32(0);
+        cfg->max_tdls_concurrent_sleep_sta = __cpu_to_le32(1);
+        cfg->max_tdls_concurrent_buffer_sta = __cpu_to_le32(1);
+
+        ath10k_wmi_put_host_mem_chunks(ar, chunks);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv init\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_start_scan(struct ath10k *ar,
+                                 const struct wmi_start_scan_arg *arg)
+{
+        struct wmi_tlv_start_scan_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        size_t len, chan_len, ssid_len, bssid_len, ie_len;
+        __le32 *chans;
+        struct wmi_ssid *ssids;
+        struct wmi_mac_addr *addrs;
+        void *ptr;
+        int i, ret;
+
+        ret = ath10k_wmi_start_scan_verify(arg);
+        if (ret)
+                return ERR_PTR(ret);
+
+        chan_len = arg->n_channels * sizeof(__le32);
+        ssid_len = arg->n_ssids * sizeof(struct wmi_ssid);
+        bssid_len = arg->n_bssids * sizeof(struct wmi_mac_addr);
+        ie_len = roundup(arg->ie_len, 4);
+        len = (sizeof(*tlv) + sizeof(*cmd)) +
+              (arg->n_channels ? sizeof(*tlv) + chan_len : 0) +
+              (arg->n_ssids ? sizeof(*tlv) + ssid_len : 0) +
+              (arg->n_bssids ? sizeof(*tlv) + bssid_len : 0) +
+              (arg->ie_len ? sizeof(*tlv) + ie_len : 0);
+
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_START_SCAN_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+
+        ath10k_wmi_put_start_scan_common(&cmd->common, arg);
+        cmd->burst_duration_ms = __cpu_to_le32(0);
+        cmd->num_channels = __cpu_to_le32(arg->n_channels);
+        cmd->num_ssids = __cpu_to_le32(arg->n_ssids);
+        cmd->num_bssids = __cpu_to_le32(arg->n_bssids);
+        cmd->ie_len = __cpu_to_le32(arg->ie_len);
+        cmd->num_probes = __cpu_to_le32(3);
+
+        /* FIXME: There are some scan flag inconsistencies across firmwares,
+         * e.g. WMI-TLV inverts the logic behind the following flag.
+         */
+        cmd->common.scan_ctrl_flags ^= __cpu_to_le32(WMI_SCAN_FILTER_PROBE_REQ);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_UINT32);
+        tlv->len = __cpu_to_le16(chan_len);
+        chans = (void *)tlv->value;
+        for (i = 0; i < arg->n_channels; i++)
+                chans[i] = __cpu_to_le32(arg->channels[i]);
+
+        ptr += sizeof(*tlv);
+        ptr += chan_len;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_FIXED_STRUCT);
+        tlv->len = __cpu_to_le16(ssid_len);
+        ssids = (void *)tlv->value;
+        for (i = 0; i < arg->n_ssids; i++) {
+                ssids[i].ssid_len = __cpu_to_le32(arg->ssids[i].len);
+                memcpy(ssids[i].ssid, arg->ssids[i].ssid, arg->ssids[i].len);
+        }
+
+        ptr += sizeof(*tlv);
+        ptr += ssid_len;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_FIXED_STRUCT);
+        tlv->len = __cpu_to_le16(bssid_len);
+        addrs = (void *)tlv->value;
+        for (i = 0; i < arg->n_bssids; i++)
+                ether_addr_copy(addrs[i].addr, arg->bssids[i].bssid);
+
+        ptr += sizeof(*tlv);
+        ptr += bssid_len;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_BYTE);
+        tlv->len = __cpu_to_le16(ie_len);
+        memcpy(tlv->value, arg->ie, arg->ie_len);
+
+        ptr += sizeof(*tlv);
+        ptr += ie_len;
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv start scan\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_stop_scan(struct ath10k *ar,
+                                const struct wmi_stop_scan_arg *arg)
+{
+        struct wmi_stop_scan_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        u32 scan_id;
+        u32 req_id;
+
+        if (arg->req_id > 0xFFF)
+                return ERR_PTR(-EINVAL);
+        if (arg->req_type == WMI_SCAN_STOP_ONE && arg->u.scan_id > 0xFFF)
+                return ERR_PTR(-EINVAL);
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        scan_id = arg->u.scan_id;
+        scan_id |= WMI_HOST_SCAN_REQ_ID_PREFIX;
+
+        req_id = arg->req_id;
+        req_id |= WMI_HOST_SCAN_REQUESTOR_ID_PREFIX;
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_STOP_SCAN_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->req_type = __cpu_to_le32(arg->req_type);
+        cmd->vdev_id = __cpu_to_le32(arg->u.vdev_id);
+        cmd->scan_id = __cpu_to_le32(scan_id);
+        cmd->scan_req_id = __cpu_to_le32(req_id);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv stop scan\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_vdev_create(struct ath10k *ar,
+                                  u32 vdev_id,
+                                  enum wmi_vdev_type vdev_type,
+                                  enum wmi_vdev_subtype vdev_subtype,
+                                  const u8 mac_addr[ETH_ALEN])
+{
+        struct wmi_vdev_create_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_VDEV_CREATE_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->vdev_type = __cpu_to_le32(vdev_type);
+        cmd->vdev_subtype = __cpu_to_le32(vdev_subtype);
+        ether_addr_copy(cmd->vdev_macaddr.addr, mac_addr);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv vdev create\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_vdev_delete(struct ath10k *ar, u32 vdev_id)
+{
+        struct wmi_vdev_delete_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_VDEV_DELETE_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv vdev delete\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_vdev_start(struct ath10k *ar,
+                                 const struct wmi_vdev_start_request_arg *arg,
+                                 bool restart)
+{
+        struct wmi_tlv_vdev_start_cmd *cmd;
+        struct wmi_channel *ch;
+        struct wmi_p2p_noa_descriptor *noa;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        size_t len;
+        void *ptr;
+        u32 flags = 0;
+
+        if (WARN_ON(arg->ssid && arg->ssid_len == 0))
+                return ERR_PTR(-EINVAL);
+        if (WARN_ON(arg->hidden_ssid && !arg->ssid))
+                return ERR_PTR(-EINVAL);
+        if (WARN_ON(arg->ssid_len > sizeof(cmd->ssid.ssid)))
+                return ERR_PTR(-EINVAL);
+
+        len = (sizeof(*tlv) + sizeof(*cmd)) +
+              (sizeof(*tlv) + sizeof(*ch)) +
+              (sizeof(*tlv) + 0);
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        if (arg->hidden_ssid)
+                flags |= WMI_VDEV_START_HIDDEN_SSID;
+        if (arg->pmf_enabled)
+                flags |= WMI_VDEV_START_PMF_ENABLED;
+
+        ptr = (void *)skb->data;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_VDEV_START_REQUEST_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(arg->vdev_id);
+        cmd->bcn_intval = __cpu_to_le32(arg->bcn_intval);
+        cmd->dtim_period = __cpu_to_le32(arg->dtim_period);
+        cmd->flags = __cpu_to_le32(flags);
+        cmd->bcn_tx_rate = __cpu_to_le32(arg->bcn_tx_rate);
+        cmd->bcn_tx_power = __cpu_to_le32(arg->bcn_tx_power);
+        cmd->disable_hw_ack = __cpu_to_le32(arg->disable_hw_ack);
+
+        if (arg->ssid) {
+                cmd->ssid.ssid_len = __cpu_to_le32(arg->ssid_len);
+                memcpy(cmd->ssid.ssid, arg->ssid, arg->ssid_len);
+        }
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_CHANNEL);
+        tlv->len = __cpu_to_le16(sizeof(*ch));
+        ch = (void *)tlv->value;
+        ath10k_wmi_put_wmi_channel(ch, &arg->channel);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*ch);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_STRUCT);
+        tlv->len = 0;
+        noa = (void *)tlv->value;
+
+        /* Note: This is a nested TLV containing:
+         * [wmi_tlv][wmi_p2p_noa_descriptor][wmi_tlv]..
+         */
+
+        ptr += sizeof(*tlv);
+        ptr += 0;
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv vdev start\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_vdev_stop(struct ath10k *ar, u32 vdev_id)
+{
+        struct wmi_vdev_stop_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_VDEV_STOP_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv vdev stop\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_vdev_up(struct ath10k *ar, u32 vdev_id, u32 aid,
+                              const u8 *bssid)
+
+{
+        struct wmi_vdev_up_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_VDEV_UP_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->vdev_assoc_id = __cpu_to_le32(aid);
+        ether_addr_copy(cmd->vdev_bssid.addr, bssid);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv vdev up\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_vdev_down(struct ath10k *ar, u32 vdev_id)
+{
+        struct wmi_vdev_down_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_VDEV_DOWN_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv vdev down\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_vdev_set_param(struct ath10k *ar, u32 vdev_id,
+                                     u32 param_id, u32 param_value)
+{
+        struct wmi_vdev_set_param_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_VDEV_SET_PARAM_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->param_id = __cpu_to_le32(param_id);
+        cmd->param_value = __cpu_to_le32(param_value);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv vdev set param\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_vdev_install_key(struct ath10k *ar,
+                                       const struct wmi_vdev_install_key_arg *arg)
+{
+        struct wmi_vdev_install_key_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        size_t len;
+        void *ptr;
+
+        if (arg->key_cipher == WMI_CIPHER_NONE && arg->key_data != NULL)
+                return ERR_PTR(-EINVAL);
+        if (arg->key_cipher != WMI_CIPHER_NONE && arg->key_data == NULL)
+                return ERR_PTR(-EINVAL);
+
+        len = sizeof(*tlv) + sizeof(*cmd) +
+              sizeof(*tlv) + roundup(arg->key_len, sizeof(__le32));
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_VDEV_INSTALL_KEY_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(arg->vdev_id);
+        cmd->key_idx = __cpu_to_le32(arg->key_idx);
+        cmd->key_flags = __cpu_to_le32(arg->key_flags);
+        cmd->key_cipher = __cpu_to_le32(arg->key_cipher);
+        cmd->key_len = __cpu_to_le32(arg->key_len);
+        cmd->key_txmic_len = __cpu_to_le32(arg->key_txmic_len);
+        cmd->key_rxmic_len = __cpu_to_le32(arg->key_rxmic_len);
+
+        if (arg->macaddr)
+                ether_addr_copy(cmd->peer_macaddr.addr, arg->macaddr);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_BYTE);
+        tlv->len = __cpu_to_le16(roundup(arg->key_len, sizeof(__le32)));
+        if (arg->key_data)
+                memcpy(tlv->value, arg->key_data, arg->key_len);
+
+        ptr += sizeof(*tlv);
+        ptr += roundup(arg->key_len, sizeof(__le32));
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv vdev install key\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_peer_create(struct ath10k *ar, u32 vdev_id,
+                                  const u8 peer_addr[ETH_ALEN])
+{
+        struct wmi_tlv_peer_create_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PEER_CREATE_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->peer_type = __cpu_to_le32(WMI_TLV_PEER_TYPE_DEFAULT); /* FIXME */
+        ether_addr_copy(cmd->peer_addr.addr, peer_addr);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv peer create\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_peer_delete(struct ath10k *ar, u32 vdev_id,
+                                  const u8 peer_addr[ETH_ALEN])
+{
+        struct wmi_peer_delete_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PEER_DELETE_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        ether_addr_copy(cmd->peer_macaddr.addr, peer_addr);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv peer delete\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_peer_flush(struct ath10k *ar, u32 vdev_id,
+                                 const u8 peer_addr[ETH_ALEN], u32 tid_bitmap)
+{
+        struct wmi_peer_flush_tids_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PEER_FLUSH_TIDS_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->peer_tid_bitmap = __cpu_to_le32(tid_bitmap);
+        ether_addr_copy(cmd->peer_macaddr.addr, peer_addr);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv peer flush\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_peer_set_param(struct ath10k *ar, u32 vdev_id,
+                                     const u8 *peer_addr,
+                                     enum wmi_peer_param param_id,
+                                     u32 param_value)
+{
+        struct wmi_peer_set_param_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PEER_SET_PARAM_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->param_id = __cpu_to_le32(param_id);
+        cmd->param_value = __cpu_to_le32(param_value);
+        ether_addr_copy(cmd->peer_macaddr.addr, peer_addr);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv peer set param\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_peer_assoc(struct ath10k *ar,
+                                 const struct wmi_peer_assoc_complete_arg *arg)
+{
+        struct wmi_tlv_peer_assoc_cmd *cmd;
+        struct wmi_vht_rate_set *vht_rate;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        size_t len, legacy_rate_len, ht_rate_len;
+        void *ptr;
+
+        if (arg->peer_mpdu_density > 16)
+                return ERR_PTR(-EINVAL);
+        if (arg->peer_legacy_rates.num_rates > MAX_SUPPORTED_RATES)
+                return ERR_PTR(-EINVAL);
+        if (arg->peer_ht_rates.num_rates > MAX_SUPPORTED_RATES)
+                return ERR_PTR(-EINVAL);
+
+        legacy_rate_len = roundup(arg->peer_legacy_rates.num_rates,
+                                  sizeof(__le32));
+        ht_rate_len = roundup(arg->peer_ht_rates.num_rates, sizeof(__le32));
+        len = (sizeof(*tlv) + sizeof(*cmd)) +
+              (sizeof(*tlv) + legacy_rate_len) +
+              (sizeof(*tlv) + ht_rate_len) +
+              (sizeof(*tlv) + sizeof(*vht_rate));
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PEER_ASSOC_COMPLETE_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+
+        cmd->vdev_id = __cpu_to_le32(arg->vdev_id);
+        cmd->new_assoc = __cpu_to_le32(arg->peer_reassoc ? 0 : 1);
+        cmd->assoc_id = __cpu_to_le32(arg->peer_aid);
+        cmd->flags = __cpu_to_le32(arg->peer_flags);
+        cmd->caps = __cpu_to_le32(arg->peer_caps);
+        cmd->listen_intval = __cpu_to_le32(arg->peer_listen_intval);
+        cmd->ht_caps = __cpu_to_le32(arg->peer_ht_caps);
+        cmd->max_mpdu = __cpu_to_le32(arg->peer_max_mpdu);
+        cmd->mpdu_density = __cpu_to_le32(arg->peer_mpdu_density);
+        cmd->rate_caps = __cpu_to_le32(arg->peer_rate_caps);
+        cmd->nss = __cpu_to_le32(arg->peer_num_spatial_streams);
+        cmd->vht_caps = __cpu_to_le32(arg->peer_vht_caps);
+        cmd->phy_mode = __cpu_to_le32(arg->peer_phymode);
+        cmd->num_legacy_rates = __cpu_to_le32(arg->peer_legacy_rates.num_rates);
+        cmd->num_ht_rates = __cpu_to_le32(arg->peer_ht_rates.num_rates);
+        ether_addr_copy(cmd->mac_addr.addr, arg->addr);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_BYTE);
+        tlv->len = __cpu_to_le16(legacy_rate_len);
+        memcpy(tlv->value, arg->peer_legacy_rates.rates,
+               arg->peer_legacy_rates.num_rates);
+
+        ptr += sizeof(*tlv);
+        ptr += legacy_rate_len;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_BYTE);
+        tlv->len = __cpu_to_le16(ht_rate_len);
+        memcpy(tlv->value, arg->peer_ht_rates.rates,
+               arg->peer_ht_rates.num_rates);
+
+        ptr += sizeof(*tlv);
+        ptr += ht_rate_len;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_VHT_RATE_SET);
+        tlv->len = __cpu_to_le16(sizeof(*vht_rate));
+        vht_rate = (void *)tlv->value;
+
+        vht_rate->rx_max_rate = __cpu_to_le32(arg->peer_vht_rates.rx_max_rate);
+        vht_rate->rx_mcs_set = __cpu_to_le32(arg->peer_vht_rates.rx_mcs_set);
+        vht_rate->tx_max_rate = __cpu_to_le32(arg->peer_vht_rates.tx_max_rate);
+        vht_rate->tx_mcs_set = __cpu_to_le32(arg->peer_vht_rates.tx_mcs_set);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*vht_rate);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv peer assoc\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_set_psmode(struct ath10k *ar, u32 vdev_id,
+                                 enum wmi_sta_ps_mode psmode)
+{
+        struct wmi_sta_powersave_mode_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_STA_POWERSAVE_MODE_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->sta_ps_mode = __cpu_to_le32(psmode);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv set psmode\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_set_sta_ps(struct ath10k *ar, u32 vdev_id,
+                                 enum wmi_sta_powersave_param param_id,
+                                 u32 param_value)
+{
+        struct wmi_sta_powersave_param_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_STA_POWERSAVE_PARAM_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->param_id = __cpu_to_le32(param_id);
+        cmd->param_value = __cpu_to_le32(param_value);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv set sta ps\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_set_ap_ps(struct ath10k *ar, u32 vdev_id, const u8 *mac,
+                                enum wmi_ap_ps_peer_param param_id, u32 value)
+{
+        struct wmi_ap_ps_peer_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        if (!mac)
+                return ERR_PTR(-EINVAL);
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_AP_PS_PEER_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->param_id = __cpu_to_le32(param_id);
+        cmd->param_value = __cpu_to_le32(value);
+        ether_addr_copy(cmd->peer_macaddr.addr, mac);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv ap ps param\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_scan_chan_list(struct ath10k *ar,
+                                     const struct wmi_scan_chan_list_arg *arg)
+{
+        struct wmi_tlv_scan_chan_list_cmd *cmd;
+        struct wmi_channel *ci;
+        struct wmi_channel_arg *ch;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        size_t chans_len, len;
+        int i;
+        void *ptr, *chans;
+
+        chans_len = arg->n_channels * (sizeof(*tlv) + sizeof(*ci));
+        len = (sizeof(*tlv) + sizeof(*cmd)) +
+              (sizeof(*tlv) + chans_len);
+
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_SCAN_CHAN_LIST_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->num_scan_chans = __cpu_to_le32(arg->n_channels);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_STRUCT);
+        tlv->len = __cpu_to_le16(chans_len);
+        chans = (void *)tlv->value;
+
+        for (i = 0; i < arg->n_channels; i++) {
+                ch = &arg->channels[i];
+
+                tlv = chans;
+                tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_CHANNEL);
+                tlv->len = __cpu_to_le16(sizeof(*ci));
+                ci = (void *)tlv->value;
+
+                ath10k_wmi_put_wmi_channel(ci, ch);
+
+                chans += sizeof(*tlv);
+                chans += sizeof(*ci);
+        }
+
+        ptr += sizeof(*tlv);
+        ptr += chans_len;
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv scan chan list\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_beacon_dma(struct ath10k_vif *arvif)
+{
+        struct ath10k *ar = arvif->ar;
+        struct wmi_bcn_tx_ref_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        struct sk_buff *beacon = arvif->beacon;
+        struct ieee80211_hdr *hdr;
+        u16 fc;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        hdr = (struct ieee80211_hdr *)beacon->data;
+        fc = le16_to_cpu(hdr->frame_control);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_BCN_SEND_FROM_HOST_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(arvif->vdev_id);
+        cmd->data_len = __cpu_to_le32(beacon->len);
+        cmd->data_ptr = __cpu_to_le32(ATH10K_SKB_CB(beacon)->paddr);
+        cmd->msdu_id = 0;
+        cmd->frame_control = __cpu_to_le32(fc);
+        cmd->flags = 0;
+
+        if (ATH10K_SKB_CB(beacon)->bcn.dtim_zero)
+                cmd->flags |= __cpu_to_le32(WMI_BCN_TX_REF_FLAG_DTIM_ZERO);
+
+        if (ATH10K_SKB_CB(beacon)->bcn.deliver_cab)
+                cmd->flags |= __cpu_to_le32(WMI_BCN_TX_REF_FLAG_DELIVER_CAB);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv beacon dma\n");
+        return skb;
+}
+
+static void *ath10k_wmi_tlv_put_wmm(void *ptr,
+                                    const struct wmi_wmm_params_arg *arg)
+{
+        struct wmi_wmm_params *wmm;
+        struct wmi_tlv *tlv;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_WMM_PARAMS);
+        tlv->len = __cpu_to_le16(sizeof(*wmm));
+        wmm = (void *)tlv->value;
+        ath10k_wmi_pdev_set_wmm_param(wmm, arg);
+
+        return ptr + sizeof(*tlv) + sizeof(*wmm);
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_pdev_set_wmm(struct ath10k *ar,
+                                   const struct wmi_pdev_set_wmm_params_arg *arg)
+{
+        struct wmi_tlv_pdev_set_wmm_cmd *cmd;
+        struct wmi_wmm_params *wmm;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        size_t len;
+        void *ptr;
+
+        len = (sizeof(*tlv) + sizeof(*cmd)) +
+              (4 * (sizeof(*tlv) + sizeof(*wmm)));
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PDEV_SET_WMM_PARAMS_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+
+        /* nothing to set here */
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        ptr = ath10k_wmi_tlv_put_wmm(ptr, &arg->ac_be);
+        ptr = ath10k_wmi_tlv_put_wmm(ptr, &arg->ac_bk);
+        ptr = ath10k_wmi_tlv_put_wmm(ptr, &arg->ac_vi);
+        ptr = ath10k_wmi_tlv_put_wmm(ptr, &arg->ac_vo);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv pdev set wmm\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_request_stats(struct ath10k *ar,
+                                    enum wmi_stats_id stats_id)
+{
+        struct wmi_request_stats_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_REQUEST_STATS_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->stats_id = __cpu_to_le32(stats_id);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv request stats\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_force_fw_hang(struct ath10k *ar,
+                                    enum wmi_force_fw_hang_type type,
+                                    u32 delay_ms)
+{
+        struct wmi_force_fw_hang_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_FORCE_FW_HANG_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->type = __cpu_to_le32(type);
+        cmd->delay_ms = __cpu_to_le32(delay_ms);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv force fw hang\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_dbglog_cfg(struct ath10k *ar, u32 module_enable)
+{
+        struct wmi_tlv_dbglog_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        size_t len, bmap_len;
+        u32 value;
+        void *ptr;
+
+        if (module_enable) {
+                value = WMI_TLV_DBGLOG_LOG_LEVEL_VALUE(
+                                module_enable,
+                                WMI_TLV_DBGLOG_LOG_LEVEL_VERBOSE);
+        } else {
+                value = WMI_TLV_DBGLOG_LOG_LEVEL_VALUE(
+                                WMI_TLV_DBGLOG_ALL_MODULES,
+                                WMI_TLV_DBGLOG_LOG_LEVEL_WARN);
+        }
+
+        bmap_len = 0;
+        len = sizeof(*tlv) + sizeof(*cmd) + sizeof(*tlv) + bmap_len;
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_DEBUG_LOG_CONFIG_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->param = __cpu_to_le32(WMI_TLV_DBGLOG_PARAM_LOG_LEVEL);
+        cmd->value = __cpu_to_le32(value);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_UINT32);
+        tlv->len = __cpu_to_le16(bmap_len);
+
+        /* nothing to do here */
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(bmap_len);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv dbglog value 0x%08x\n", value);
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_pktlog_enable(struct ath10k *ar, u32 filter)
+{
+        struct wmi_tlv_pktlog_enable *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        void *ptr;
+        size_t len;
+
+        len = sizeof(*tlv) + sizeof(*cmd);
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PDEV_PKTLOG_ENABLE_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->filter = __cpu_to_le32(filter);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv pktlog enable filter 0x%08x\n",
+                   filter);
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_pktlog_disable(struct ath10k *ar)
+{
+        struct wmi_tlv_pktlog_disable *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        void *ptr;
+        size_t len;
+
+        len = sizeof(*tlv) + sizeof(*cmd);
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PDEV_PKTLOG_DISABLE_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv pktlog disable\n");
+        return skb;
+}
+
+/****************/
+/* TLV mappings */
+/****************/
+
+static struct wmi_cmd_map wmi_tlv_cmd_map = {
+        .init_cmdid = WMI_TLV_INIT_CMDID,
+        .start_scan_cmdid = WMI_TLV_START_SCAN_CMDID,
+        .stop_scan_cmdid = WMI_TLV_STOP_SCAN_CMDID,
+        .scan_chan_list_cmdid = WMI_TLV_SCAN_CHAN_LIST_CMDID,
+        .scan_sch_prio_tbl_cmdid = WMI_TLV_SCAN_SCH_PRIO_TBL_CMDID,
+        .pdev_set_regdomain_cmdid = WMI_TLV_PDEV_SET_REGDOMAIN_CMDID,
+        .pdev_set_channel_cmdid = WMI_TLV_PDEV_SET_CHANNEL_CMDID,
+        .pdev_set_param_cmdid = WMI_TLV_PDEV_SET_PARAM_CMDID,
+        .pdev_pktlog_enable_cmdid = WMI_TLV_PDEV_PKTLOG_ENABLE_CMDID,
+        .pdev_pktlog_disable_cmdid = WMI_TLV_PDEV_PKTLOG_DISABLE_CMDID,
+        .pdev_set_wmm_params_cmdid = WMI_TLV_PDEV_SET_WMM_PARAMS_CMDID,
+        .pdev_set_ht_cap_ie_cmdid = WMI_TLV_PDEV_SET_HT_CAP_IE_CMDID,
+        .pdev_set_vht_cap_ie_cmdid = WMI_TLV_PDEV_SET_VHT_CAP_IE_CMDID,
+        .pdev_set_dscp_tid_map_cmdid = WMI_TLV_PDEV_SET_DSCP_TID_MAP_CMDID,
+        .pdev_set_quiet_mode_cmdid = WMI_TLV_PDEV_SET_QUIET_MODE_CMDID,
+        .pdev_green_ap_ps_enable_cmdid = WMI_TLV_PDEV_GREEN_AP_PS_ENABLE_CMDID,
+        .pdev_get_tpc_config_cmdid = WMI_TLV_PDEV_GET_TPC_CONFIG_CMDID,
+        .pdev_set_base_macaddr_cmdid = WMI_TLV_PDEV_SET_BASE_MACADDR_CMDID,
+        .vdev_create_cmdid = WMI_TLV_VDEV_CREATE_CMDID,
+        .vdev_delete_cmdid = WMI_TLV_VDEV_DELETE_CMDID,
+        .vdev_start_request_cmdid = WMI_TLV_VDEV_START_REQUEST_CMDID,
+        .vdev_restart_request_cmdid = WMI_TLV_VDEV_RESTART_REQUEST_CMDID,
+        .vdev_up_cmdid = WMI_TLV_VDEV_UP_CMDID,
+        .vdev_stop_cmdid = WMI_TLV_VDEV_STOP_CMDID,
+        .vdev_down_cmdid = WMI_TLV_VDEV_DOWN_CMDID,
+        .vdev_set_param_cmdid = WMI_TLV_VDEV_SET_PARAM_CMDID,
+        .vdev_install_key_cmdid = WMI_TLV_VDEV_INSTALL_KEY_CMDID,
+        .peer_create_cmdid = WMI_TLV_PEER_CREATE_CMDID,
+        .peer_delete_cmdid = WMI_TLV_PEER_DELETE_CMDID,
+        .peer_flush_tids_cmdid = WMI_TLV_PEER_FLUSH_TIDS_CMDID,
+        .peer_set_param_cmdid = WMI_TLV_PEER_SET_PARAM_CMDID,
+        .peer_assoc_cmdid = WMI_TLV_PEER_ASSOC_CMDID,
+        .peer_add_wds_entry_cmdid = WMI_TLV_PEER_ADD_WDS_ENTRY_CMDID,
+        .peer_remove_wds_entry_cmdid = WMI_TLV_PEER_REMOVE_WDS_ENTRY_CMDID,
+        .peer_mcast_group_cmdid = WMI_TLV_PEER_MCAST_GROUP_CMDID,
+        .bcn_tx_cmdid = WMI_TLV_BCN_TX_CMDID,
+        .pdev_send_bcn_cmdid = WMI_TLV_PDEV_SEND_BCN_CMDID,
+        .bcn_tmpl_cmdid = WMI_TLV_BCN_TMPL_CMDID,
+        .bcn_filter_rx_cmdid = WMI_TLV_BCN_FILTER_RX_CMDID,
+        .prb_req_filter_rx_cmdid = WMI_TLV_PRB_REQ_FILTER_RX_CMDID,
+        .mgmt_tx_cmdid = WMI_TLV_MGMT_TX_CMDID,
+        .prb_tmpl_cmdid = WMI_TLV_PRB_TMPL_CMDID,
+        .addba_clear_resp_cmdid = WMI_TLV_ADDBA_CLEAR_RESP_CMDID,
+        .addba_send_cmdid = WMI_TLV_ADDBA_SEND_CMDID,
+        .addba_status_cmdid = WMI_TLV_ADDBA_STATUS_CMDID,
+        .delba_send_cmdid = WMI_TLV_DELBA_SEND_CMDID,
+        .addba_set_resp_cmdid = WMI_TLV_ADDBA_SET_RESP_CMDID,
+        .send_singleamsdu_cmdid = WMI_TLV_SEND_SINGLEAMSDU_CMDID,
+        .sta_powersave_mode_cmdid = WMI_TLV_STA_POWERSAVE_MODE_CMDID,
+        .sta_powersave_param_cmdid = WMI_TLV_STA_POWERSAVE_PARAM_CMDID,
+        .sta_mimo_ps_mode_cmdid = WMI_TLV_STA_MIMO_PS_MODE_CMDID,
+        .pdev_dfs_enable_cmdid = WMI_TLV_PDEV_DFS_ENABLE_CMDID,
+        .pdev_dfs_disable_cmdid = WMI_TLV_PDEV_DFS_DISABLE_CMDID,
+        .roam_scan_mode = WMI_TLV_ROAM_SCAN_MODE,
+        .roam_scan_rssi_threshold = WMI_TLV_ROAM_SCAN_RSSI_THRESHOLD,
+        .roam_scan_period = WMI_TLV_ROAM_SCAN_PERIOD,
+        .roam_scan_rssi_change_threshold =
+                                WMI_TLV_ROAM_SCAN_RSSI_CHANGE_THRESHOLD,
+        .roam_ap_profile = WMI_TLV_ROAM_AP_PROFILE,
+        .ofl_scan_add_ap_profile = WMI_TLV_ROAM_AP_PROFILE,
+        .ofl_scan_remove_ap_profile = WMI_TLV_OFL_SCAN_REMOVE_AP_PROFILE,
+        .ofl_scan_period = WMI_TLV_OFL_SCAN_PERIOD,
+        .p2p_dev_set_device_info = WMI_TLV_P2P_DEV_SET_DEVICE_INFO,
+        .p2p_dev_set_discoverability = WMI_TLV_P2P_DEV_SET_DISCOVERABILITY,
+        .p2p_go_set_beacon_ie = WMI_TLV_P2P_GO_SET_BEACON_IE,
+        .p2p_go_set_probe_resp_ie = WMI_TLV_P2P_GO_SET_PROBE_RESP_IE,
+        .p2p_set_vendor_ie_data_cmdid = WMI_TLV_P2P_SET_VENDOR_IE_DATA_CMDID,
+        .ap_ps_peer_param_cmdid = WMI_TLV_AP_PS_PEER_PARAM_CMDID,
+        .ap_ps_peer_uapsd_coex_cmdid = WMI_TLV_AP_PS_PEER_UAPSD_COEX_CMDID,
+        .peer_rate_retry_sched_cmdid = WMI_TLV_PEER_RATE_RETRY_SCHED_CMDID,
+        .wlan_profile_trigger_cmdid = WMI_TLV_WLAN_PROFILE_TRIGGER_CMDID,
+        .wlan_profile_set_hist_intvl_cmdid =
+                                WMI_TLV_WLAN_PROFILE_SET_HIST_INTVL_CMDID,
+        .wlan_profile_get_profile_data_cmdid =
+                                WMI_TLV_WLAN_PROFILE_GET_PROFILE_DATA_CMDID,
+        .wlan_profile_enable_profile_id_cmdid =
+                                WMI_TLV_WLAN_PROFILE_ENABLE_PROFILE_ID_CMDID,
+        .wlan_profile_list_profile_id_cmdid =
+                                WMI_TLV_WLAN_PROFILE_LIST_PROFILE_ID_CMDID,
+        .pdev_suspend_cmdid = WMI_TLV_PDEV_SUSPEND_CMDID,
+        .pdev_resume_cmdid = WMI_TLV_PDEV_RESUME_CMDID,
+        .add_bcn_filter_cmdid = WMI_TLV_ADD_BCN_FILTER_CMDID,
+        .rmv_bcn_filter_cmdid = WMI_TLV_RMV_BCN_FILTER_CMDID,
+        .wow_add_wake_pattern_cmdid = WMI_TLV_WOW_ADD_WAKE_PATTERN_CMDID,
+        .wow_del_wake_pattern_cmdid = WMI_TLV_WOW_DEL_WAKE_PATTERN_CMDID,
+        .wow_enable_disable_wake_event_cmdid =
+                                WMI_TLV_WOW_ENABLE_DISABLE_WAKE_EVENT_CMDID,
+        .wow_enable_cmdid = WMI_TLV_WOW_ENABLE_CMDID,
+        .wow_hostwakeup_from_sleep_cmdid =
+                                WMI_TLV_WOW_HOSTWAKEUP_FROM_SLEEP_CMDID,
+        .rtt_measreq_cmdid = WMI_TLV_RTT_MEASREQ_CMDID,
+        .rtt_tsf_cmdid = WMI_TLV_RTT_TSF_CMDID,
+        .vdev_spectral_scan_configure_cmdid = WMI_TLV_SPECTRAL_SCAN_CONF_CMDID,
+        .vdev_spectral_scan_enable_cmdid = WMI_TLV_SPECTRAL_SCAN_ENABLE_CMDID,
+        .request_stats_cmdid = WMI_TLV_REQUEST_STATS_CMDID,
+        .set_arp_ns_offload_cmdid = WMI_TLV_SET_ARP_NS_OFFLOAD_CMDID,
+        .network_list_offload_config_cmdid =
+                                WMI_TLV_NETWORK_LIST_OFFLOAD_CONFIG_CMDID,
+        .gtk_offload_cmdid = WMI_TLV_GTK_OFFLOAD_CMDID,
+        .csa_offload_enable_cmdid = WMI_TLV_CSA_OFFLOAD_ENABLE_CMDID,
+        .csa_offload_chanswitch_cmdid = WMI_TLV_CSA_OFFLOAD_CHANSWITCH_CMDID,
+        .chatter_set_mode_cmdid = WMI_TLV_CHATTER_SET_MODE_CMDID,
+        .peer_tid_addba_cmdid = WMI_TLV_PEER_TID_ADDBA_CMDID,
+        .peer_tid_delba_cmdid = WMI_TLV_PEER_TID_DELBA_CMDID,
+        .sta_dtim_ps_method_cmdid = WMI_TLV_STA_DTIM_PS_METHOD_CMDID,
+        .sta_uapsd_auto_trig_cmdid = WMI_TLV_STA_UAPSD_AUTO_TRIG_CMDID,
+        .sta_keepalive_cmd = WMI_TLV_STA_KEEPALIVE_CMDID,
+        .echo_cmdid = WMI_TLV_ECHO_CMDID,
+        .pdev_utf_cmdid = WMI_TLV_PDEV_UTF_CMDID,
+        .dbglog_cfg_cmdid = WMI_TLV_DBGLOG_CFG_CMDID,
+        .pdev_qvit_cmdid = WMI_TLV_PDEV_QVIT_CMDID,
+        .pdev_ftm_intg_cmdid = WMI_TLV_PDEV_FTM_INTG_CMDID,
+        .vdev_set_keepalive_cmdid = WMI_TLV_VDEV_SET_KEEPALIVE_CMDID,
+        .vdev_get_keepalive_cmdid = WMI_TLV_VDEV_GET_KEEPALIVE_CMDID,
+        .force_fw_hang_cmdid = WMI_TLV_FORCE_FW_HANG_CMDID,
+        .gpio_config_cmdid = WMI_TLV_GPIO_CONFIG_CMDID,
+        .gpio_output_cmdid = WMI_TLV_GPIO_OUTPUT_CMDID,
+        .pdev_get_temperature_cmdid = WMI_TLV_CMD_UNSUPPORTED,
+};
+
+static struct wmi_pdev_param_map wmi_tlv_pdev_param_map = {
+        .tx_chain_mask = WMI_TLV_PDEV_PARAM_TX_CHAIN_MASK,
+        .rx_chain_mask = WMI_TLV_PDEV_PARAM_RX_CHAIN_MASK,
+        .txpower_limit2g = WMI_TLV_PDEV_PARAM_TXPOWER_LIMIT2G,
+        .txpower_limit5g = WMI_TLV_PDEV_PARAM_TXPOWER_LIMIT5G,
+        .txpower_scale = WMI_TLV_PDEV_PARAM_TXPOWER_SCALE,
+        .beacon_gen_mode = WMI_TLV_PDEV_PARAM_BEACON_GEN_MODE,
+        .beacon_tx_mode = WMI_TLV_PDEV_PARAM_BEACON_TX_MODE,
+        .resmgr_offchan_mode = WMI_TLV_PDEV_PARAM_RESMGR_OFFCHAN_MODE,
+        .protection_mode = WMI_TLV_PDEV_PARAM_PROTECTION_MODE,
+        .dynamic_bw = WMI_TLV_PDEV_PARAM_DYNAMIC_BW,
+        .non_agg_sw_retry_th = WMI_TLV_PDEV_PARAM_NON_AGG_SW_RETRY_TH,
+        .agg_sw_retry_th = WMI_TLV_PDEV_PARAM_AGG_SW_RETRY_TH,
+        .sta_kickout_th = WMI_TLV_PDEV_PARAM_STA_KICKOUT_TH,
+        .ac_aggrsize_scaling = WMI_TLV_PDEV_PARAM_AC_AGGRSIZE_SCALING,
+        .ltr_enable = WMI_TLV_PDEV_PARAM_LTR_ENABLE,
+        .ltr_ac_latency_be = WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_BE,
+        .ltr_ac_latency_bk = WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_BK,
+        .ltr_ac_latency_vi = WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_VI,
+        .ltr_ac_latency_vo = WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_VO,
+        .ltr_ac_latency_timeout = WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_TIMEOUT,
+        .ltr_sleep_override = WMI_TLV_PDEV_PARAM_LTR_SLEEP_OVERRIDE,
+        .ltr_rx_override = WMI_TLV_PDEV_PARAM_LTR_RX_OVERRIDE,
+        .ltr_tx_activity_timeout = WMI_TLV_PDEV_PARAM_LTR_TX_ACTIVITY_TIMEOUT,
+        .l1ss_enable = WMI_TLV_PDEV_PARAM_L1SS_ENABLE,
+        .dsleep_enable = WMI_TLV_PDEV_PARAM_DSLEEP_ENABLE,
+        .pcielp_txbuf_flush = WMI_TLV_PDEV_PARAM_PCIELP_TXBUF_FLUSH,
+        .pcielp_txbuf_watermark = WMI_TLV_PDEV_PARAM_PCIELP_TXBUF_TMO_EN,
+        .pcielp_txbuf_tmo_en = WMI_TLV_PDEV_PARAM_PCIELP_TXBUF_TMO_EN,
+        .pcielp_txbuf_tmo_value = WMI_TLV_PDEV_PARAM_PCIELP_TXBUF_TMO_VALUE,
+        .pdev_stats_update_period = WMI_TLV_PDEV_PARAM_PDEV_STATS_UPDATE_PERIOD,
+        .vdev_stats_update_period = WMI_TLV_PDEV_PARAM_VDEV_STATS_UPDATE_PERIOD,
+        .peer_stats_update_period = WMI_TLV_PDEV_PARAM_PEER_STATS_UPDATE_PERIOD,
+        .bcnflt_stats_update_period =
+                                WMI_TLV_PDEV_PARAM_BCNFLT_STATS_UPDATE_PERIOD,
+        .pmf_qos = WMI_TLV_PDEV_PARAM_PMF_QOS,
+        .arp_ac_override = WMI_TLV_PDEV_PARAM_ARP_AC_OVERRIDE,
+        .dcs = WMI_TLV_PDEV_PARAM_DCS,
+        .ani_enable = WMI_TLV_PDEV_PARAM_ANI_ENABLE,
+        .ani_poll_period = WMI_TLV_PDEV_PARAM_ANI_POLL_PERIOD,
+        .ani_listen_period = WMI_TLV_PDEV_PARAM_ANI_LISTEN_PERIOD,
+        .ani_ofdm_level = WMI_TLV_PDEV_PARAM_ANI_OFDM_LEVEL,
+        .ani_cck_level = WMI_TLV_PDEV_PARAM_ANI_CCK_LEVEL,
+        .dyntxchain = WMI_TLV_PDEV_PARAM_DYNTXCHAIN,
+        .proxy_sta = WMI_TLV_PDEV_PARAM_PROXY_STA,
+        .idle_ps_config = WMI_TLV_PDEV_PARAM_IDLE_PS_CONFIG,
+        .power_gating_sleep = WMI_TLV_PDEV_PARAM_POWER_GATING_SLEEP,
+        .fast_channel_reset = WMI_TLV_PDEV_PARAM_UNSUPPORTED,
+        .burst_dur = WMI_TLV_PDEV_PARAM_BURST_DUR,
+        .burst_enable = WMI_TLV_PDEV_PARAM_BURST_ENABLE,
+        .cal_period = WMI_PDEV_PARAM_UNSUPPORTED,
+};
+
+static struct wmi_vdev_param_map wmi_tlv_vdev_param_map = {
+        .rts_threshold = WMI_TLV_VDEV_PARAM_RTS_THRESHOLD,
+        .fragmentation_threshold = WMI_TLV_VDEV_PARAM_FRAGMENTATION_THRESHOLD,
+        .beacon_interval = WMI_TLV_VDEV_PARAM_BEACON_INTERVAL,
+        .listen_interval = WMI_TLV_VDEV_PARAM_LISTEN_INTERVAL,
+        .multicast_rate = WMI_TLV_VDEV_PARAM_MULTICAST_RATE,
+        .mgmt_tx_rate = WMI_TLV_VDEV_PARAM_MGMT_TX_RATE,
+        .slot_time = WMI_TLV_VDEV_PARAM_SLOT_TIME,
+        .preamble = WMI_TLV_VDEV_PARAM_PREAMBLE,
+        .swba_time = WMI_TLV_VDEV_PARAM_SWBA_TIME,
+        .wmi_vdev_stats_update_period = WMI_TLV_VDEV_STATS_UPDATE_PERIOD,
+        .wmi_vdev_pwrsave_ageout_time = WMI_TLV_VDEV_PWRSAVE_AGEOUT_TIME,
+        .wmi_vdev_host_swba_interval = WMI_TLV_VDEV_HOST_SWBA_INTERVAL,
+        .dtim_period = WMI_TLV_VDEV_PARAM_DTIM_PERIOD,
+        .wmi_vdev_oc_scheduler_air_time_limit =
+                                WMI_TLV_VDEV_OC_SCHEDULER_AIR_TIME_LIMIT,
+        .wds = WMI_TLV_VDEV_PARAM_WDS,
+        .atim_window = WMI_TLV_VDEV_PARAM_ATIM_WINDOW,
+        .bmiss_count_max = WMI_TLV_VDEV_PARAM_BMISS_COUNT_MAX,
+        .bmiss_first_bcnt = WMI_TLV_VDEV_PARAM_BMISS_FIRST_BCNT,
+        .bmiss_final_bcnt = WMI_TLV_VDEV_PARAM_BMISS_FINAL_BCNT,
+        .feature_wmm = WMI_TLV_VDEV_PARAM_FEATURE_WMM,
+        .chwidth = WMI_TLV_VDEV_PARAM_CHWIDTH,
+        .chextoffset = WMI_TLV_VDEV_PARAM_CHEXTOFFSET,
+        .disable_htprotection = WMI_TLV_VDEV_PARAM_DISABLE_HTPROTECTION,
+        .sta_quickkickout = WMI_TLV_VDEV_PARAM_STA_QUICKKICKOUT,
+        .mgmt_rate = WMI_TLV_VDEV_PARAM_MGMT_RATE,
+        .protection_mode = WMI_TLV_VDEV_PARAM_PROTECTION_MODE,
+        .fixed_rate = WMI_TLV_VDEV_PARAM_FIXED_RATE,
+        .sgi = WMI_TLV_VDEV_PARAM_SGI,
+        .ldpc = WMI_TLV_VDEV_PARAM_LDPC,
+        .tx_stbc = WMI_TLV_VDEV_PARAM_TX_STBC,
+        .rx_stbc = WMI_TLV_VDEV_PARAM_RX_STBC,
+        .intra_bss_fwd = WMI_TLV_VDEV_PARAM_INTRA_BSS_FWD,
+        .def_keyid = WMI_TLV_VDEV_PARAM_DEF_KEYID,
+        .nss = WMI_TLV_VDEV_PARAM_NSS,
+        .bcast_data_rate = WMI_TLV_VDEV_PARAM_BCAST_DATA_RATE,
+        .mcast_data_rate = WMI_TLV_VDEV_PARAM_MCAST_DATA_RATE,
+        .mcast_indicate = WMI_TLV_VDEV_PARAM_MCAST_INDICATE,
+        .dhcp_indicate = WMI_TLV_VDEV_PARAM_DHCP_INDICATE,
+        .unknown_dest_indicate = WMI_TLV_VDEV_PARAM_UNKNOWN_DEST_INDICATE,
+        .ap_keepalive_min_idle_inactive_time_secs =
+                WMI_TLV_VDEV_PARAM_AP_KEEPALIVE_MIN_IDLE_INACTIVE_TIME_SECS,
+        .ap_keepalive_max_idle_inactive_time_secs =
+                WMI_TLV_VDEV_PARAM_AP_KEEPALIVE_MAX_IDLE_INACTIVE_TIME_SECS,
+        .ap_keepalive_max_unresponsive_time_secs =
+                WMI_TLV_VDEV_PARAM_AP_KEEPALIVE_MAX_UNRESPONSIVE_TIME_SECS,
+        .ap_enable_nawds = WMI_TLV_VDEV_PARAM_AP_ENABLE_NAWDS,
+        .mcast2ucast_set = WMI_TLV_VDEV_PARAM_UNSUPPORTED,
+        .enable_rtscts = WMI_TLV_VDEV_PARAM_ENABLE_RTSCTS,
+        .txbf = WMI_TLV_VDEV_PARAM_TXBF,
+        .packet_powersave = WMI_TLV_VDEV_PARAM_PACKET_POWERSAVE,
+        .drop_unencry = WMI_TLV_VDEV_PARAM_DROP_UNENCRY,
+        .tx_encap_type = WMI_TLV_VDEV_PARAM_TX_ENCAP_TYPE,
+        .ap_detect_out_of_sync_sleeping_sta_time_secs =
+                                        WMI_TLV_VDEV_PARAM_UNSUPPORTED,
+};
+
+static const struct wmi_ops wmi_tlv_ops = {
+        .rx = ath10k_wmi_tlv_op_rx,
+        .map_svc = wmi_tlv_svc_map,
+
+        .pull_scan = ath10k_wmi_tlv_op_pull_scan_ev,
+        .pull_mgmt_rx = ath10k_wmi_tlv_op_pull_mgmt_rx_ev,
+        .pull_ch_info = ath10k_wmi_tlv_op_pull_ch_info_ev,
+        .pull_vdev_start = ath10k_wmi_tlv_op_pull_vdev_start_ev,
+        .pull_peer_kick = ath10k_wmi_tlv_op_pull_peer_kick_ev,
+        .pull_swba = ath10k_wmi_tlv_op_pull_swba_ev,
+        .pull_phyerr = ath10k_wmi_tlv_op_pull_phyerr_ev,
+        .pull_svc_rdy = ath10k_wmi_tlv_op_pull_svc_rdy_ev,
+        .pull_rdy = ath10k_wmi_tlv_op_pull_rdy_ev,
+        .pull_fw_stats = ath10k_wmi_tlv_op_pull_fw_stats,
+
+        .gen_pdev_suspend = ath10k_wmi_tlv_op_gen_pdev_suspend,
+        .gen_pdev_resume = ath10k_wmi_tlv_op_gen_pdev_resume,
+        .gen_pdev_set_rd = ath10k_wmi_tlv_op_gen_pdev_set_rd,
+        .gen_pdev_set_param = ath10k_wmi_tlv_op_gen_pdev_set_param,
+        .gen_init = ath10k_wmi_tlv_op_gen_init,
+        .gen_start_scan = ath10k_wmi_tlv_op_gen_start_scan,
+        .gen_stop_scan = ath10k_wmi_tlv_op_gen_stop_scan,
+        .gen_vdev_create = ath10k_wmi_tlv_op_gen_vdev_create,
+        .gen_vdev_delete = ath10k_wmi_tlv_op_gen_vdev_delete,
+        .gen_vdev_start = ath10k_wmi_tlv_op_gen_vdev_start,
+        .gen_vdev_stop = ath10k_wmi_tlv_op_gen_vdev_stop,
+        .gen_vdev_up = ath10k_wmi_tlv_op_gen_vdev_up,
+        .gen_vdev_down = ath10k_wmi_tlv_op_gen_vdev_down,
+        .gen_vdev_set_param = ath10k_wmi_tlv_op_gen_vdev_set_param,
+        .gen_vdev_install_key = ath10k_wmi_tlv_op_gen_vdev_install_key,
+        .gen_peer_create = ath10k_wmi_tlv_op_gen_peer_create,
+        .gen_peer_delete = ath10k_wmi_tlv_op_gen_peer_delete,
+        .gen_peer_flush = ath10k_wmi_tlv_op_gen_peer_flush,
+        .gen_peer_set_param = ath10k_wmi_tlv_op_gen_peer_set_param,
+        .gen_peer_assoc = ath10k_wmi_tlv_op_gen_peer_assoc,
+        .gen_set_psmode = ath10k_wmi_tlv_op_gen_set_psmode,
+        .gen_set_sta_ps = ath10k_wmi_tlv_op_gen_set_sta_ps,
+        .gen_set_ap_ps = ath10k_wmi_tlv_op_gen_set_ap_ps,
+        .gen_scan_chan_list = ath10k_wmi_tlv_op_gen_scan_chan_list,
+        .gen_beacon_dma = ath10k_wmi_tlv_op_gen_beacon_dma,
+        .gen_pdev_set_wmm = ath10k_wmi_tlv_op_gen_pdev_set_wmm,
+        .gen_request_stats = ath10k_wmi_tlv_op_gen_request_stats,
+        .gen_force_fw_hang = ath10k_wmi_tlv_op_gen_force_fw_hang,
+        /* .gen_mgmt_tx = not implemented; HTT is used */
+        .gen_dbglog_cfg = ath10k_wmi_tlv_op_gen_dbglog_cfg,
+        .gen_pktlog_enable = ath10k_wmi_tlv_op_gen_pktlog_enable,
+        .gen_pktlog_disable = ath10k_wmi_tlv_op_gen_pktlog_disable,
+        /* .gen_pdev_set_quiet_mode not implemented */
+        /* .gen_pdev_get_temperature not implemented */
+};
+
+/************/
+/* TLV init */
+/************/
+
+void ath10k_wmi_tlv_attach(struct ath10k *ar)
+{
+        ar->wmi.cmd = &wmi_tlv_cmd_map;
+        ar->wmi.vdev_param = &wmi_tlv_vdev_param_map;
+        ar->wmi.pdev_param = &wmi_tlv_pdev_param_map;
+        ar->wmi.ops = &wmi_tlv_ops;
+}
diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.h b/drivers/net/wireless/ath/ath10k/wmi-tlv.h
new file mode 100644
index 000000000000..54ffa120cd60
--- /dev/null
+++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.h
@@ -0,0 +1,1380 @@
+/*
+ * Copyright (c) 2005-2011 Atheros Communications Inc.
+ * Copyright (c) 2011-2014 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef _WMI_TLV_H
+#define _WMI_TLV_H
+
+#define WMI_TLV_CMD(grp_id) (((grp_id) << 12) | 0x1)
+#define WMI_TLV_EV(grp_id) (((grp_id) << 12) | 0x1)
+#define WMI_TLV_CMD_UNSUPPORTED 0
+#define WMI_TLV_PDEV_PARAM_UNSUPPORTED 0
+#define WMI_TLV_VDEV_PARAM_UNSUPPORTED 0
+
+enum wmi_tlv_grp_id {
+        WMI_TLV_GRP_START = 0x3,
+        WMI_TLV_GRP_SCAN = WMI_TLV_GRP_START,
+        WMI_TLV_GRP_PDEV,
+        WMI_TLV_GRP_VDEV,
+        WMI_TLV_GRP_PEER,
+        WMI_TLV_GRP_MGMT,
+        WMI_TLV_GRP_BA_NEG,
+        WMI_TLV_GRP_STA_PS,
+        WMI_TLV_GRP_DFS,
+        WMI_TLV_GRP_ROAM,
+        WMI_TLV_GRP_OFL_SCAN,
+        WMI_TLV_GRP_P2P,
+        WMI_TLV_GRP_AP_PS,
+        WMI_TLV_GRP_RATECTL,
+        WMI_TLV_GRP_PROFILE,
+        WMI_TLV_GRP_SUSPEND,
+        WMI_TLV_GRP_BCN_FILTER,
+        WMI_TLV_GRP_WOW,
+        WMI_TLV_GRP_RTT,
+        WMI_TLV_GRP_SPECTRAL,
+        WMI_TLV_GRP_STATS,
+        WMI_TLV_GRP_ARP_NS_OFL,
+        WMI_TLV_GRP_NLO_OFL,
+        WMI_TLV_GRP_GTK_OFL,
+        WMI_TLV_GRP_CSA_OFL,
+        WMI_TLV_GRP_CHATTER,
+        WMI_TLV_GRP_TID_ADDBA,
+        WMI_TLV_GRP_MISC,
+        WMI_TLV_GRP_GPIO,
+        WMI_TLV_GRP_FWTEST,
+        WMI_TLV_GRP_TDLS,
+        WMI_TLV_GRP_RESMGR,
+        WMI_TLV_GRP_STA_SMPS,
+        WMI_TLV_GRP_WLAN_HB,
+        WMI_TLV_GRP_RMC,
+        WMI_TLV_GRP_MHF_OFL,
+        WMI_TLV_GRP_LOCATION_SCAN,
+        WMI_TLV_GRP_OEM,
+        WMI_TLV_GRP_NAN,
+        WMI_TLV_GRP_COEX,
+        WMI_TLV_GRP_OBSS_OFL,
+        WMI_TLV_GRP_LPI,
+        WMI_TLV_GRP_EXTSCAN,
+        WMI_TLV_GRP_DHCP_OFL,
+        WMI_TLV_GRP_IPA,
+        WMI_TLV_GRP_MDNS_OFL,
+        WMI_TLV_GRP_SAP_OFL,
+};
+
+enum wmi_tlv_cmd_id {
+        WMI_TLV_INIT_CMDID = 0x1,
+        WMI_TLV_START_SCAN_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_SCAN),
+        WMI_TLV_STOP_SCAN_CMDID,
+        WMI_TLV_SCAN_CHAN_LIST_CMDID,
+        WMI_TLV_SCAN_SCH_PRIO_TBL_CMDID,
+        WMI_TLV_SCAN_UPDATE_REQUEST_CMDID,
+        WMI_TLV_SCAN_PROB_REQ_OUI_CMDID,
+        WMI_TLV_PDEV_SET_REGDOMAIN_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_PDEV),
+        WMI_TLV_PDEV_SET_CHANNEL_CMDID,
+        WMI_TLV_PDEV_SET_PARAM_CMDID,
+        WMI_TLV_PDEV_PKTLOG_ENABLE_CMDID,
+        WMI_TLV_PDEV_PKTLOG_DISABLE_CMDID,
+        WMI_TLV_PDEV_SET_WMM_PARAMS_CMDID,
+        WMI_TLV_PDEV_SET_HT_CAP_IE_CMDID,
+        WMI_TLV_PDEV_SET_VHT_CAP_IE_CMDID,
+        WMI_TLV_PDEV_SET_DSCP_TID_MAP_CMDID,
+        WMI_TLV_PDEV_SET_QUIET_MODE_CMDID,
+        WMI_TLV_PDEV_GREEN_AP_PS_ENABLE_CMDID,
+        WMI_TLV_PDEV_GET_TPC_CONFIG_CMDID,
+        WMI_TLV_PDEV_SET_BASE_MACADDR_CMDID,
+        WMI_TLV_PDEV_DUMP_CMDID,
+        WMI_TLV_PDEV_SET_LED_CONFIG_CMDID,
+        WMI_TLV_PDEV_GET_TEMPERATURE_CMDID,
+        WMI_TLV_PDEV_SET_LED_FLASHING_CMDID,
+        WMI_TLV_VDEV_CREATE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_VDEV),
+        WMI_TLV_VDEV_DELETE_CMDID,
+        WMI_TLV_VDEV_START_REQUEST_CMDID,
+        WMI_TLV_VDEV_RESTART_REQUEST_CMDID,
+        WMI_TLV_VDEV_UP_CMDID,
+        WMI_TLV_VDEV_STOP_CMDID,
+        WMI_TLV_VDEV_DOWN_CMDID,
+        WMI_TLV_VDEV_SET_PARAM_CMDID,
+        WMI_TLV_VDEV_INSTALL_KEY_CMDID,
+        WMI_TLV_VDEV_WNM_SLEEPMODE_CMDID,
+        WMI_TLV_VDEV_WMM_ADDTS_CMDID,
+        WMI_TLV_VDEV_WMM_DELTS_CMDID,
+        WMI_TLV_VDEV_SET_WMM_PARAMS_CMDID,
+        WMI_TLV_VDEV_SET_GTX_PARAMS_CMDID,
+        WMI_TLV_VDEV_IPSEC_NATKEEPALIVE_FILTER_CMDID,
+        WMI_TLV_VDEV_PLMREQ_START_CMDID,
+        WMI_TLV_VDEV_PLMREQ_STOP_CMDID,
+        WMI_TLV_PEER_CREATE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_PEER),
+        WMI_TLV_PEER_DELETE_CMDID,
+        WMI_TLV_PEER_FLUSH_TIDS_CMDID,
+        WMI_TLV_PEER_SET_PARAM_CMDID,
+        WMI_TLV_PEER_ASSOC_CMDID,
+        WMI_TLV_PEER_ADD_WDS_ENTRY_CMDID,
+        WMI_TLV_PEER_REMOVE_WDS_ENTRY_CMDID,
+        WMI_TLV_PEER_MCAST_GROUP_CMDID,
+        WMI_TLV_PEER_INFO_REQ_CMDID,
+        WMI_TLV_PEER_GET_ESTIMATED_LINKSPEED_CMDID,
+        WMI_TLV_BCN_TX_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_MGMT),
+        WMI_TLV_PDEV_SEND_BCN_CMDID,
+        WMI_TLV_BCN_TMPL_CMDID,
+        WMI_TLV_BCN_FILTER_RX_CMDID,
+        WMI_TLV_PRB_REQ_FILTER_RX_CMDID,
+        WMI_TLV_MGMT_TX_CMDID,
+        WMI_TLV_PRB_TMPL_CMDID,
+        WMI_TLV_ADDBA_CLEAR_RESP_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_BA_NEG),
+        WMI_TLV_ADDBA_SEND_CMDID,
+        WMI_TLV_ADDBA_STATUS_CMDID,
+        WMI_TLV_DELBA_SEND_CMDID,
+        WMI_TLV_ADDBA_SET_RESP_CMDID,
+        WMI_TLV_SEND_SINGLEAMSDU_CMDID,
+        WMI_TLV_STA_POWERSAVE_MODE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_STA_PS),
+        WMI_TLV_STA_POWERSAVE_PARAM_CMDID,
+        WMI_TLV_STA_MIMO_PS_MODE_CMDID,
+        WMI_TLV_PDEV_DFS_ENABLE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_DFS),
+        WMI_TLV_PDEV_DFS_DISABLE_CMDID,
+        WMI_TLV_DFS_PHYERR_FILTER_ENA_CMDID,
+        WMI_TLV_DFS_PHYERR_FILTER_DIS_CMDID,
+        WMI_TLV_ROAM_SCAN_MODE = WMI_TLV_CMD(WMI_TLV_GRP_ROAM),
+        WMI_TLV_ROAM_SCAN_RSSI_THRESHOLD,
+        WMI_TLV_ROAM_SCAN_PERIOD,
+        WMI_TLV_ROAM_SCAN_RSSI_CHANGE_THRESHOLD,
+        WMI_TLV_ROAM_AP_PROFILE,
+        WMI_TLV_ROAM_CHAN_LIST,
+        WMI_TLV_ROAM_SCAN_CMD,
+        WMI_TLV_ROAM_SYNCH_COMPLETE,
+        WMI_TLV_ROAM_SET_RIC_REQUEST_CMDID,
+        WMI_TLV_ROAM_INVOKE_CMDID,
+        WMI_TLV_OFL_SCAN_ADD_AP_PROFILE = WMI_TLV_CMD(WMI_TLV_GRP_OFL_SCAN),
+        WMI_TLV_OFL_SCAN_REMOVE_AP_PROFILE,
+        WMI_TLV_OFL_SCAN_PERIOD,
+        WMI_TLV_P2P_DEV_SET_DEVICE_INFO = WMI_TLV_CMD(WMI_TLV_GRP_P2P),
+        WMI_TLV_P2P_DEV_SET_DISCOVERABILITY,
+        WMI_TLV_P2P_GO_SET_BEACON_IE,
+        WMI_TLV_P2P_GO_SET_PROBE_RESP_IE,
+        WMI_TLV_P2P_SET_VENDOR_IE_DATA_CMDID,
+        WMI_TLV_P2P_DISC_OFFLOAD_CONFIG_CMDID,
+        WMI_TLV_P2P_DISC_OFFLOAD_APPIE_CMDID,
+        WMI_TLV_P2P_DISC_OFFLOAD_PATTERN_CMDID,
+        WMI_TLV_P2P_SET_OPPPS_PARAM_CMDID,
+        WMI_TLV_AP_PS_PEER_PARAM_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_AP_PS),
+        WMI_TLV_AP_PS_PEER_UAPSD_COEX_CMDID,
+        WMI_TLV_PEER_RATE_RETRY_SCHED_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_RATECTL),
+        WMI_TLV_WLAN_PROFILE_TRIGGER_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_PROFILE),
+        WMI_TLV_WLAN_PROFILE_SET_HIST_INTVL_CMDID,
+        WMI_TLV_WLAN_PROFILE_GET_PROFILE_DATA_CMDID,
+        WMI_TLV_WLAN_PROFILE_ENABLE_PROFILE_ID_CMDID,
+        WMI_TLV_WLAN_PROFILE_LIST_PROFILE_ID_CMDID,
+        WMI_TLV_PDEV_SUSPEND_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_SUSPEND),
+        WMI_TLV_PDEV_RESUME_CMDID,
+        WMI_TLV_ADD_BCN_FILTER_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_BCN_FILTER),
+        WMI_TLV_RMV_BCN_FILTER_CMDID,
+        WMI_TLV_WOW_ADD_WAKE_PATTERN_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_WOW),
+        WMI_TLV_WOW_DEL_WAKE_PATTERN_CMDID,
+        WMI_TLV_WOW_ENABLE_DISABLE_WAKE_EVENT_CMDID,
+        WMI_TLV_WOW_ENABLE_CMDID,
+        WMI_TLV_WOW_HOSTWAKEUP_FROM_SLEEP_CMDID,
+        WMI_TLV_WOW_ACER_IOAC_ADD_KEEPALIVE_CMDID,
+        WMI_TLV_WOW_ACER_IOAC_DEL_KEEPALIVE_CMDID,
+        WMI_TLV_WOW_ACER_IOAC_ADD_WAKE_PATTERN_CMDID,
+        WMI_TLV_WOW_ACER_IOAC_DEL_WAKE_PATTERN_CMDID,
+        WMI_TLV_D0_WOW_ENABLE_DISABLE_CMDID,
+        WMI_TLV_EXTWOW_ENABLE_CMDID,
+        WMI_TLV_EXTWOW_SET_APP_TYPE1_PARAMS_CMDID,
+        WMI_TLV_EXTWOW_SET_APP_TYPE2_PARAMS_CMDID,
+        WMI_TLV_RTT_MEASREQ_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_RTT),
+        WMI_TLV_RTT_TSF_CMDID,
+        WMI_TLV_SPECTRAL_SCAN_CONF_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_SPECTRAL),
+        WMI_TLV_SPECTRAL_SCAN_ENABLE_CMDID,
+        WMI_TLV_REQUEST_STATS_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_STATS),
+        WMI_TLV_MCC_SCHED_TRAFFIC_STATS_CMDID,
+        WMI_TLV_REQUEST_STATS_EXT_CMDID,
+        WMI_TLV_REQUEST_LINK_STATS_CMDID,
+        WMI_TLV_START_LINK_STATS_CMDID,
+        WMI_TLV_CLEAR_LINK_STATS_CMDID,
+        WMI_TLV_SET_ARP_NS_OFFLOAD_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_ARP_NS_OFL),
+        WMI_TLV_ADD_PROACTIVE_ARP_RSP_PATTERN_CMDID,
+        WMI_TLV_DEL_PROACTIVE_ARP_RSP_PATTERN_CMDID,
+        WMI_TLV_NETWORK_LIST_OFFLOAD_CONFIG_CMDID =
+                        WMI_TLV_CMD(WMI_TLV_GRP_NLO_OFL),
+        WMI_TLV_APFIND_CMDID,
+        WMI_TLV_GTK_OFFLOAD_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_GTK_OFL),
+        WMI_TLV_CSA_OFFLOAD_ENABLE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_CSA_OFL),
+        WMI_TLV_CSA_OFFLOAD_CHANSWITCH_CMDID,
+        WMI_TLV_CHATTER_SET_MODE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_CHATTER),
+        WMI_TLV_CHATTER_ADD_COALESCING_FILTER_CMDID,
+        WMI_TLV_CHATTER_DELETE_COALESCING_FILTER_CMDID,
+        WMI_TLV_CHATTER_COALESCING_QUERY_CMDID,
+        WMI_TLV_PEER_TID_ADDBA_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_TID_ADDBA),
+        WMI_TLV_PEER_TID_DELBA_CMDID,
+        WMI_TLV_STA_DTIM_PS_METHOD_CMDID,
+        WMI_TLV_STA_UAPSD_AUTO_TRIG_CMDID,
+        WMI_TLV_STA_KEEPALIVE_CMDID,
+        WMI_TLV_BA_REQ_SSN_CMDID,
+        WMI_TLV_ECHO_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_MISC),
+        WMI_TLV_PDEV_UTF_CMDID,
+        WMI_TLV_DBGLOG_CFG_CMDID,
+        WMI_TLV_PDEV_QVIT_CMDID,
+        WMI_TLV_PDEV_FTM_INTG_CMDID,
+        WMI_TLV_VDEV_SET_KEEPALIVE_CMDID,
+        WMI_TLV_VDEV_GET_KEEPALIVE_CMDID,
+        WMI_TLV_FORCE_FW_HANG_CMDID,
+        WMI_TLV_SET_MCASTBCAST_FILTER_CMDID,
+        WMI_TLV_THERMAL_MGMT_CMDID,
+        WMI_TLV_HOST_AUTO_SHUTDOWN_CFG_CMDID,
+        WMI_TLV_TPC_CHAINMASK_CONFIG_CMDID,
+        WMI_TLV_SET_ANTENNA_DIVERSITY_CMDID,
+        WMI_TLV_GPIO_CONFIG_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_GPIO),
+        WMI_TLV_GPIO_OUTPUT_CMDID,
+        WMI_TLV_TXBF_CMDID,
+        WMI_TLV_FWTEST_VDEV_MCC_SET_TBTT_MODE_CMDID =
+                        WMI_TLV_CMD(WMI_TLV_GRP_FWTEST),
+        WMI_TLV_FWTEST_P2P_SET_NOA_PARAM_CMDID,
+        WMI_TLV_UNIT_TEST_CMDID,
+        WMI_TLV_TDLS_SET_STATE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_TDLS),
+        WMI_TLV_TDLS_PEER_UPDATE_CMDID,
+        WMI_TLV_TDLS_SET_OFFCHAN_MODE_CMDID,
+        WMI_TLV_RESMGR_ADAPTIVE_OCS_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_RESMGR),
+        WMI_TLV_RESMGR_SET_CHAN_TIME_QUOTA_CMDID,
+        WMI_TLV_RESMGR_SET_CHAN_LATENCY_CMDID,
+        WMI_TLV_STA_SMPS_FORCE_MODE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_STA_SMPS),
+        WMI_TLV_STA_SMPS_PARAM_CMDID,
+        WMI_TLV_HB_SET_ENABLE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_WLAN_HB),
+        WMI_TLV_HB_SET_TCP_PARAMS_CMDID,
+        WMI_TLV_HB_SET_TCP_PKT_FILTER_CMDID,
+        WMI_TLV_HB_SET_UDP_PARAMS_CMDID,
+        WMI_TLV_HB_SET_UDP_PKT_FILTER_CMDID,
+        WMI_TLV_RMC_SET_MODE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_RMC),
+        WMI_TLV_RMC_SET_ACTION_PERIOD_CMDID,
+        WMI_TLV_RMC_CONFIG_CMDID,
+        WMI_TLV_MHF_OFFLOAD_SET_MODE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_MHF_OFL),
+        WMI_TLV_MHF_OFFLOAD_PLUMB_ROUTING_TBL_CMDID,
+        WMI_TLV_BATCH_SCAN_ENABLE_CMDID =
+                        WMI_TLV_CMD(WMI_TLV_GRP_LOCATION_SCAN),
+        WMI_TLV_BATCH_SCAN_DISABLE_CMDID,
+        WMI_TLV_BATCH_SCAN_TRIGGER_RESULT_CMDID,
+        WMI_TLV_OEM_REQ_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_OEM),
+        WMI_TLV_NAN_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_NAN),
+        WMI_TLV_MODEM_POWER_STATE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_COEX),
+        WMI_TLV_CHAN_AVOID_UPDATE_CMDID,
+        WMI_TLV_OBSS_SCAN_ENABLE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_OBSS_OFL),
+        WMI_TLV_OBSS_SCAN_DISABLE_CMDID,
+        WMI_TLV_LPI_MGMT_SNOOPING_CONFIG_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_LPI),
+        WMI_TLV_LPI_START_SCAN_CMDID,
+        WMI_TLV_LPI_STOP_SCAN_CMDID,
+        WMI_TLV_EXTSCAN_START_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_EXTSCAN),
+        WMI_TLV_EXTSCAN_STOP_CMDID,
+        WMI_TLV_EXTSCAN_CONFIGURE_WLAN_CHANGE_MONITOR_CMDID,
+        WMI_TLV_EXTSCAN_CONFIGURE_HOTLIST_MONITOR_CMDID,
+        WMI_TLV_EXTSCAN_GET_CACHED_RESULTS_CMDID,
+        WMI_TLV_EXTSCAN_GET_WLAN_CHANGE_RESULTS_CMDID,
+        WMI_TLV_EXTSCAN_SET_CAPABILITIES_CMDID,
+        WMI_TLV_EXTSCAN_GET_CAPABILITIES_CMDID,
+        WMI_TLV_SET_DHCP_SERVER_OFFLOAD_CMDID =
+                        WMI_TLV_CMD(WMI_TLV_GRP_DHCP_OFL),
+        WMI_TLV_IPA_OFFLOAD_ENABLE_DISABLE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_IPA),
+        WMI_TLV_MDNS_OFFLOAD_ENABLE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_MDNS_OFL),
+        WMI_TLV_MDNS_SET_FQDN_CMDID,
+        WMI_TLV_MDNS_SET_RESPONSE_CMDID,
+        WMI_TLV_MDNS_GET_STATS_CMDID,
+        WMI_TLV_SAP_OFL_ENABLE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_SAP_OFL),
+};
+
+enum wmi_tlv_event_id {
+        WMI_TLV_SERVICE_READY_EVENTID = 0x1,
+        WMI_TLV_READY_EVENTID,
+        WMI_TLV_SCAN_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_SCAN),
+        WMI_TLV_PDEV_TPC_CONFIG_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_PDEV),
+        WMI_TLV_CHAN_INFO_EVENTID,
+        WMI_TLV_PHYERR_EVENTID,
+        WMI_TLV_PDEV_DUMP_EVENTID,
+        WMI_TLV_TX_PAUSE_EVENTID,
+        WMI_TLV_DFS_RADAR_EVENTID,
+        WMI_TLV_PDEV_L1SS_TRACK_EVENTID,
+        WMI_TLV_PDEV_TEMPERATURE_EVENTID,
+        WMI_TLV_VDEV_START_RESP_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_VDEV),
+        WMI_TLV_VDEV_STOPPED_EVENTID,
+        WMI_TLV_VDEV_INSTALL_KEY_COMPLETE_EVENTID,
+        WMI_TLV_VDEV_MCC_BCN_INTERVAL_CHANGE_REQ_EVENTID,
+        WMI_TLV_PEER_STA_KICKOUT_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_PEER),
+        WMI_TLV_PEER_INFO_EVENTID,
+        WMI_TLV_PEER_TX_FAIL_CNT_THR_EVENTID,
+        WMI_TLV_PEER_ESTIMATED_LINKSPEED_EVENTID,
+        WMI_TLV_PEER_STATE_EVENTID,
+        WMI_TLV_MGMT_RX_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_MGMT),
+        WMI_TLV_HOST_SWBA_EVENTID,
+        WMI_TLV_TBTTOFFSET_UPDATE_EVENTID,
+        WMI_TLV_OFFLOAD_BCN_TX_STATUS_EVENTID,
+        WMI_TLV_OFFLOAD_PROB_RESP_TX_STATUS_EVENTID,
+        WMI_TLV_TX_DELBA_COMPLETE_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_BA_NEG),
+        WMI_TLV_TX_ADDBA_COMPLETE_EVENTID,
+        WMI_TLV_BA_RSP_SSN_EVENTID,
+        WMI_TLV_AGGR_STATE_TRIG_EVENTID,
+        WMI_TLV_ROAM_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_ROAM),
+        WMI_TLV_PROFILE_MATCH,
+        WMI_TLV_ROAM_SYNCH_EVENTID,
+        WMI_TLV_P2P_DISC_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_P2P),
+        WMI_TLV_P2P_NOA_EVENTID,
+        WMI_TLV_PDEV_RESUME_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_SUSPEND),
+        WMI_TLV_WOW_WAKEUP_HOST_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_WOW),
+        WMI_TLV_D0_WOW_DISABLE_ACK_EVENTID,
+        WMI_TLV_RTT_MEASUREMENT_REPORT_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_RTT),
+        WMI_TLV_TSF_MEASUREMENT_REPORT_EVENTID,
+        WMI_TLV_RTT_ERROR_REPORT_EVENTID,
+        WMI_TLV_STATS_EXT_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_STATS),
+        WMI_TLV_IFACE_LINK_STATS_EVENTID,
+        WMI_TLV_PEER_LINK_STATS_EVENTID,
+        WMI_TLV_RADIO_LINK_STATS_EVENTID,
+        WMI_TLV_NLO_MATCH_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_NLO_OFL),
+        WMI_TLV_NLO_SCAN_COMPLETE_EVENTID,
+        WMI_TLV_APFIND_EVENTID,
+        WMI_TLV_GTK_OFFLOAD_STATUS_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_GTK_OFL),
+        WMI_TLV_GTK_REKEY_FAIL_EVENTID,
+        WMI_TLV_CSA_HANDLING_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_CSA_OFL),
+        WMI_TLV_CHATTER_PC_QUERY_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_CHATTER),
+        WMI_TLV_ECHO_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_MISC),
+        WMI_TLV_PDEV_UTF_EVENTID,
+        WMI_TLV_DEBUG_MESG_EVENTID,
+        WMI_TLV_UPDATE_STATS_EVENTID,
+        WMI_TLV_DEBUG_PRINT_EVENTID,
+        WMI_TLV_DCS_INTERFERENCE_EVENTID,
+        WMI_TLV_PDEV_QVIT_EVENTID,
+        WMI_TLV_WLAN_PROFILE_DATA_EVENTID,
+        WMI_TLV_PDEV_FTM_INTG_EVENTID,
+        WMI_TLV_WLAN_FREQ_AVOID_EVENTID,
+        WMI_TLV_VDEV_GET_KEEPALIVE_EVENTID,
+        WMI_TLV_THERMAL_MGMT_EVENTID,
+        WMI_TLV_DIAG_DATA_CONTAINER_EVENTID,
+        WMI_TLV_HOST_AUTO_SHUTDOWN_EVENTID,
+        WMI_TLV_UPDATE_WHAL_MIB_STATS_EVENTID,
+        WMI_TLV_UPDATE_VDEV_RATE_STATS_EVENTID,
+        WMI_TLV_DIAG_EVENTID,
+        WMI_TLV_GPIO_INPUT_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_GPIO),
+        WMI_TLV_UPLOADH_EVENTID,
+        WMI_TLV_CAPTUREH_EVENTID,
+        WMI_TLV_RFKILL_STATE_CHANGE_EVENTID,
+        WMI_TLV_TDLS_PEER_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_TDLS),
+        WMI_TLV_BATCH_SCAN_ENABLED_EVENTID =
+                        WMI_TLV_EV(WMI_TLV_GRP_LOCATION_SCAN),
+        WMI_TLV_BATCH_SCAN_RESULT_EVENTID,
+        WMI_TLV_OEM_CAPABILITY_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_OEM),
+        WMI_TLV_OEM_MEASUREMENT_REPORT_EVENTID,
+        WMI_TLV_OEM_ERROR_REPORT_EVENTID,
+        WMI_TLV_NAN_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_NAN),
+        WMI_TLV_LPI_RESULT_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_LPI),
+        WMI_TLV_LPI_STATUS_EVENTID,
+        WMI_TLV_LPI_HANDOFF_EVENTID,
+        WMI_TLV_EXTSCAN_START_STOP_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_EXTSCAN),
+        WMI_TLV_EXTSCAN_OPERATION_EVENTID,
+        WMI_TLV_EXTSCAN_TABLE_USAGE_EVENTID,
+        WMI_TLV_EXTSCAN_CACHED_RESULTS_EVENTID,
+        WMI_TLV_EXTSCAN_WLAN_CHANGE_RESULTS_EVENTID,
+        WMI_TLV_EXTSCAN_HOTLIST_MATCH_EVENTID,
+        WMI_TLV_EXTSCAN_CAPABILITIES_EVENTID,
+        WMI_TLV_MDNS_STATS_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_MDNS_OFL),
+        WMI_TLV_SAP_OFL_ADD_STA_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_SAP_OFL),
+        WMI_TLV_SAP_OFL_DEL_STA_EVENTID,
+};
+
+enum wmi_tlv_pdev_param {
+        WMI_TLV_PDEV_PARAM_TX_CHAIN_MASK = 0x1,
+        WMI_TLV_PDEV_PARAM_RX_CHAIN_MASK,
+        WMI_TLV_PDEV_PARAM_TXPOWER_LIMIT2G,
+        WMI_TLV_PDEV_PARAM_TXPOWER_LIMIT5G,
+        WMI_TLV_PDEV_PARAM_TXPOWER_SCALE,
+        WMI_TLV_PDEV_PARAM_BEACON_GEN_MODE,
+        WMI_TLV_PDEV_PARAM_BEACON_TX_MODE,
+        WMI_TLV_PDEV_PARAM_RESMGR_OFFCHAN_MODE,
+        WMI_TLV_PDEV_PARAM_PROTECTION_MODE,
+        WMI_TLV_PDEV_PARAM_DYNAMIC_BW,
+        WMI_TLV_PDEV_PARAM_NON_AGG_SW_RETRY_TH,
+        WMI_TLV_PDEV_PARAM_AGG_SW_RETRY_TH,
+        WMI_TLV_PDEV_PARAM_STA_KICKOUT_TH,
+        WMI_TLV_PDEV_PARAM_AC_AGGRSIZE_SCALING,
+        WMI_TLV_PDEV_PARAM_LTR_ENABLE,
+        WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_BE,
+        WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_BK,
+        WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_VI,
+        WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_VO,
+        WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_TIMEOUT,
+        WMI_TLV_PDEV_PARAM_LTR_SLEEP_OVERRIDE,
+        WMI_TLV_PDEV_PARAM_LTR_RX_OVERRIDE,
+        WMI_TLV_PDEV_PARAM_LTR_TX_ACTIVITY_TIMEOUT,
+        WMI_TLV_PDEV_PARAM_L1SS_ENABLE,
+        WMI_TLV_PDEV_PARAM_DSLEEP_ENABLE,
+        WMI_TLV_PDEV_PARAM_PCIELP_TXBUF_FLUSH,
+        WMI_TLV_PDEV_PARAM_PCIELP_TXBUF_WATERMARK,
+        WMI_TLV_PDEV_PARAM_PCIELP_TXBUF_TMO_EN,
+        WMI_TLV_PDEV_PARAM_PCIELP_TXBUF_TMO_VALUE,
+        WMI_TLV_PDEV_PARAM_PDEV_STATS_UPDATE_PERIOD,
+        WMI_TLV_PDEV_PARAM_VDEV_STATS_UPDATE_PERIOD,
+        WMI_TLV_PDEV_PARAM_PEER_STATS_UPDATE_PERIOD,
+        WMI_TLV_PDEV_PARAM_BCNFLT_STATS_UPDATE_PERIOD,
+        WMI_TLV_PDEV_PARAM_PMF_QOS,
+        WMI_TLV_PDEV_PARAM_ARP_AC_OVERRIDE,
+        WMI_TLV_PDEV_PARAM_DCS,
+        WMI_TLV_PDEV_PARAM_ANI_ENABLE,
+        WMI_TLV_PDEV_PARAM_ANI_POLL_PERIOD,
+        WMI_TLV_PDEV_PARAM_ANI_LISTEN_PERIOD,
+        WMI_TLV_PDEV_PARAM_ANI_OFDM_LEVEL,
+        WMI_TLV_PDEV_PARAM_ANI_CCK_LEVEL,
+        WMI_TLV_PDEV_PARAM_DYNTXCHAIN,
+        WMI_TLV_PDEV_PARAM_PROXY_STA,
+        WMI_TLV_PDEV_PARAM_IDLE_PS_CONFIG,
+        WMI_TLV_PDEV_PARAM_POWER_GATING_SLEEP,
+        WMI_TLV_PDEV_PARAM_RFKILL_ENABLE,
+        WMI_TLV_PDEV_PARAM_BURST_DUR,
+        WMI_TLV_PDEV_PARAM_BURST_ENABLE,
+        WMI_TLV_PDEV_PARAM_HW_RFKILL_CONFIG,
+        WMI_TLV_PDEV_PARAM_LOW_POWER_RF_ENABLE,
+        WMI_TLV_PDEV_PARAM_L1SS_TRACK,
+        WMI_TLV_PDEV_PARAM_HYST_EN,
+        WMI_TLV_PDEV_PARAM_POWER_COLLAPSE_ENABLE,
+        WMI_TLV_PDEV_PARAM_LED_SYS_STATE,
+        WMI_TLV_PDEV_PARAM_LED_ENABLE,
+        WMI_TLV_PDEV_PARAM_AUDIO_OVER_WLAN_LATENCY,
+        WMI_TLV_PDEV_PARAM_AUDIO_OVER_WLAN_ENABLE,
+        WMI_TLV_PDEV_PARAM_WHAL_MIB_STATS_UPDATE_ENABLE,
+        WMI_TLV_PDEV_PARAM_VDEV_RATE_STATS_UPDATE_PERIOD,
+        WMI_TLV_PDEV_PARAM_TXPOWER_REASON_NONE,
+        WMI_TLV_PDEV_PARAM_TXPOWER_REASON_SAR,
+        WMI_TLV_PDEV_PARAM_TXPOWER_REASON_MAX,
+};
+
+enum wmi_tlv_vdev_param {
+        WMI_TLV_VDEV_PARAM_RTS_THRESHOLD = 0x1,
+        WMI_TLV_VDEV_PARAM_FRAGMENTATION_THRESHOLD,
+        WMI_TLV_VDEV_PARAM_BEACON_INTERVAL,
+        WMI_TLV_VDEV_PARAM_LISTEN_INTERVAL,
+        WMI_TLV_VDEV_PARAM_MULTICAST_RATE,
+        WMI_TLV_VDEV_PARAM_MGMT_TX_RATE,
+        WMI_TLV_VDEV_PARAM_SLOT_TIME,
+        WMI_TLV_VDEV_PARAM_PREAMBLE,
+        WMI_TLV_VDEV_PARAM_SWBA_TIME,
+        WMI_TLV_VDEV_STATS_UPDATE_PERIOD,
+        WMI_TLV_VDEV_PWRSAVE_AGEOUT_TIME,
+        WMI_TLV_VDEV_HOST_SWBA_INTERVAL,
+        WMI_TLV_VDEV_PARAM_DTIM_PERIOD,
+        WMI_TLV_VDEV_OC_SCHEDULER_AIR_TIME_LIMIT,
+        WMI_TLV_VDEV_PARAM_WDS,
+        WMI_TLV_VDEV_PARAM_ATIM_WINDOW,
+        WMI_TLV_VDEV_PARAM_BMISS_COUNT_MAX,
+        WMI_TLV_VDEV_PARAM_BMISS_FIRST_BCNT,
+        WMI_TLV_VDEV_PARAM_BMISS_FINAL_BCNT,
+        WMI_TLV_VDEV_PARAM_FEATURE_WMM,
+        WMI_TLV_VDEV_PARAM_CHWIDTH,
+        WMI_TLV_VDEV_PARAM_CHEXTOFFSET,
+        WMI_TLV_VDEV_PARAM_DISABLE_HTPROTECTION,
+        WMI_TLV_VDEV_PARAM_STA_QUICKKICKOUT,
+        WMI_TLV_VDEV_PARAM_MGMT_RATE,
+        WMI_TLV_VDEV_PARAM_PROTECTION_MODE,
+        WMI_TLV_VDEV_PARAM_FIXED_RATE,
+        WMI_TLV_VDEV_PARAM_SGI,
+        WMI_TLV_VDEV_PARAM_LDPC,
+        WMI_TLV_VDEV_PARAM_TX_STBC,
+        WMI_TLV_VDEV_PARAM_RX_STBC,
+        WMI_TLV_VDEV_PARAM_INTRA_BSS_FWD,
+        WMI_TLV_VDEV_PARAM_DEF_KEYID,
+        WMI_TLV_VDEV_PARAM_NSS,
+        WMI_TLV_VDEV_PARAM_BCAST_DATA_RATE,
+        WMI_TLV_VDEV_PARAM_MCAST_DATA_RATE,
+        WMI_TLV_VDEV_PARAM_MCAST_INDICATE,
+        WMI_TLV_VDEV_PARAM_DHCP_INDICATE,
+        WMI_TLV_VDEV_PARAM_UNKNOWN_DEST_INDICATE,
+        WMI_TLV_VDEV_PARAM_AP_KEEPALIVE_MIN_IDLE_INACTIVE_TIME_SECS,
+        WMI_TLV_VDEV_PARAM_AP_KEEPALIVE_MAX_IDLE_INACTIVE_TIME_SECS,
+        WMI_TLV_VDEV_PARAM_AP_KEEPALIVE_MAX_UNRESPONSIVE_TIME_SECS,
+        WMI_TLV_VDEV_PARAM_AP_ENABLE_NAWDS,
+        WMI_TLV_VDEV_PARAM_ENABLE_RTSCTS,
+        WMI_TLV_VDEV_PARAM_TXBF,
+        WMI_TLV_VDEV_PARAM_PACKET_POWERSAVE,
+        WMI_TLV_VDEV_PARAM_DROP_UNENCRY,
+        WMI_TLV_VDEV_PARAM_TX_ENCAP_TYPE,
+        WMI_TLV_VDEV_PARAM_AP_DETECT_OUT_OF_SYNC_SLEEPING_STA_TIME_SECS,
+        WMI_TLV_VDEV_PARAM_EARLY_RX_ADJUST_ENABLE,
+        WMI_TLV_VDEV_PARAM_EARLY_RX_TGT_BMISS_NUM,
+        WMI_TLV_VDEV_PARAM_EARLY_RX_BMISS_SAMPLE_CYCLE,
+        WMI_TLV_VDEV_PARAM_EARLY_RX_SLOP_STEP,
+        WMI_TLV_VDEV_PARAM_EARLY_RX_INIT_SLOP,
+        WMI_TLV_VDEV_PARAM_EARLY_RX_ADJUST_PAUSE,
+        WMI_TLV_VDEV_PARAM_TX_PWRLIMIT,
+        WMI_TLV_VDEV_PARAM_SNR_NUM_FOR_CAL,
+        WMI_TLV_VDEV_PARAM_ROAM_FW_OFFLOAD,
+        WMI_TLV_VDEV_PARAM_ENABLE_RMC,
+        WMI_TLV_VDEV_PARAM_IBSS_MAX_BCN_LOST_MS,
+        WMI_TLV_VDEV_PARAM_MAX_RATE,
+        WMI_TLV_VDEV_PARAM_EARLY_RX_DRIFT_SAMPLE,
+        WMI_TLV_VDEV_PARAM_SET_IBSS_TX_FAIL_CNT_THR,
+        WMI_TLV_VDEV_PARAM_EBT_RESYNC_TIMEOUT,
+        WMI_TLV_VDEV_PARAM_AGGR_TRIG_EVENT_ENABLE,
+        WMI_TLV_VDEV_PARAM_IS_IBSS_POWER_SAVE_ALLOWED,
+        WMI_TLV_VDEV_PARAM_IS_POWER_COLLAPSE_ALLOWED,
+        WMI_TLV_VDEV_PARAM_IS_AWAKE_ON_TXRX_ENABLED,
+        WMI_TLV_VDEV_PARAM_INACTIVITY_CNT,
+        WMI_TLV_VDEV_PARAM_TXSP_END_INACTIVITY_TIME_MS,
+        WMI_TLV_VDEV_PARAM_DTIM_POLICY,
+        WMI_TLV_VDEV_PARAM_IBSS_PS_WARMUP_TIME_SECS,
+        WMI_TLV_VDEV_PARAM_IBSS_PS_1RX_CHAIN_IN_ATIM_WINDOW_ENABLE,
+};
+
+enum wmi_tlv_tag {
+        WMI_TLV_TAG_LAST_RESERVED = 15,
+
+        WMI_TLV_TAG_FIRST_ARRAY_ENUM,
+        WMI_TLV_TAG_ARRAY_UINT32 = WMI_TLV_TAG_FIRST_ARRAY_ENUM,
+        WMI_TLV_TAG_ARRAY_BYTE,
+        WMI_TLV_TAG_ARRAY_STRUCT,
+        WMI_TLV_TAG_ARRAY_FIXED_STRUCT,
+        WMI_TLV_TAG_LAST_ARRAY_ENUM = 31,
+
+        WMI_TLV_TAG_STRUCT_SERVICE_READY_EVENT,
+        WMI_TLV_TAG_STRUCT_HAL_REG_CAPABILITIES,
+        WMI_TLV_TAG_STRUCT_WLAN_HOST_MEM_REQ,
+        WMI_TLV_TAG_STRUCT_READY_EVENT,
+        WMI_TLV_TAG_STRUCT_SCAN_EVENT,
+        WMI_TLV_TAG_STRUCT_PDEV_TPC_CONFIG_EVENT,
+        WMI_TLV_TAG_STRUCT_CHAN_INFO_EVENT,
+        WMI_TLV_TAG_STRUCT_COMB_PHYERR_RX_HDR,
+        WMI_TLV_TAG_STRUCT_VDEV_START_RESPONSE_EVENT,
+        WMI_TLV_TAG_STRUCT_VDEV_STOPPED_EVENT,
+        WMI_TLV_TAG_STRUCT_VDEV_INSTALL_KEY_COMPLETE_EVENT,
+        WMI_TLV_TAG_STRUCT_PEER_STA_KICKOUT_EVENT,
+        WMI_TLV_TAG_STRUCT_MGMT_RX_HDR,
+        WMI_TLV_TAG_STRUCT_TBTT_OFFSET_EVENT,
+        WMI_TLV_TAG_STRUCT_TX_DELBA_COMPLETE_EVENT,
+        WMI_TLV_TAG_STRUCT_TX_ADDBA_COMPLETE_EVENT,
+        WMI_TLV_TAG_STRUCT_ROAM_EVENT,
+        WMI_TLV_TAG_STRUCT_WOW_EVENT_INFO,
+        WMI_TLV_TAG_STRUCT_WOW_EVENT_INFO_SECTION_BITMAP,
+        WMI_TLV_TAG_STRUCT_RTT_EVENT_HEADER,
+        WMI_TLV_TAG_STRUCT_RTT_ERROR_REPORT_EVENT,
+        WMI_TLV_TAG_STRUCT_RTT_MEAS_EVENT,
+        WMI_TLV_TAG_STRUCT_ECHO_EVENT,
+        WMI_TLV_TAG_STRUCT_FTM_INTG_EVENT,
+        WMI_TLV_TAG_STRUCT_VDEV_GET_KEEPALIVE_EVENT,
+        WMI_TLV_TAG_STRUCT_GPIO_INPUT_EVENT,
+        WMI_TLV_TAG_STRUCT_CSA_EVENT,
+        WMI_TLV_TAG_STRUCT_GTK_OFFLOAD_STATUS_EVENT,
+        WMI_TLV_TAG_STRUCT_IGTK_INFO,
+        WMI_TLV_TAG_STRUCT_DCS_INTERFERENCE_EVENT,
+        WMI_TLV_TAG_STRUCT_ATH_DCS_CW_INT,
+        WMI_TLV_TAG_STRUCT_ATH_DCS_WLAN_INT_STAT,
+        WMI_TLV_TAG_STRUCT_WLAN_PROFILE_CTX_T,
+        WMI_TLV_TAG_STRUCT_WLAN_PROFILE_T,
+        WMI_TLV_TAG_STRUCT_PDEV_QVIT_EVENT,
+        WMI_TLV_TAG_STRUCT_HOST_SWBA_EVENT,
+        WMI_TLV_TAG_STRUCT_TIM_INFO,
+        WMI_TLV_TAG_STRUCT_P2P_NOA_INFO,
+        WMI_TLV_TAG_STRUCT_STATS_EVENT,
+        WMI_TLV_TAG_STRUCT_AVOID_FREQ_RANGES_EVENT,
+        WMI_TLV_TAG_STRUCT_AVOID_FREQ_RANGE_DESC,
+        WMI_TLV_TAG_STRUCT_GTK_REKEY_FAIL_EVENT,
+        WMI_TLV_TAG_STRUCT_INIT_CMD,
+        WMI_TLV_TAG_STRUCT_RESOURCE_CONFIG,
+        WMI_TLV_TAG_STRUCT_WLAN_HOST_MEMORY_CHUNK,
+        WMI_TLV_TAG_STRUCT_START_SCAN_CMD,
+        WMI_TLV_TAG_STRUCT_STOP_SCAN_CMD,
+        WMI_TLV_TAG_STRUCT_SCAN_CHAN_LIST_CMD,
+        WMI_TLV_TAG_STRUCT_CHANNEL,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_REGDOMAIN_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_PARAM_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_WMM_PARAMS_CMD,
+        WMI_TLV_TAG_STRUCT_WMM_PARAMS,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_QUIET_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_CREATE_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_DELETE_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_START_REQUEST_CMD,
+        WMI_TLV_TAG_STRUCT_P2P_NOA_DESCRIPTOR,
+        WMI_TLV_TAG_STRUCT_P2P_GO_SET_BEACON_IE,
+        WMI_TLV_TAG_STRUCT_GTK_OFFLOAD_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_UP_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_STOP_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_DOWN_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_SET_PARAM_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_INSTALL_KEY_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_CREATE_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_DELETE_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_FLUSH_TIDS_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_SET_PARAM_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_ASSOC_COMPLETE_CMD,
+        WMI_TLV_TAG_STRUCT_VHT_RATE_SET,
+        WMI_TLV_TAG_STRUCT_BCN_TMPL_CMD,
+        WMI_TLV_TAG_STRUCT_PRB_TMPL_CMD,
+        WMI_TLV_TAG_STRUCT_BCN_PRB_INFO,
+        WMI_TLV_TAG_STRUCT_PEER_TID_ADDBA_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_TID_DELBA_CMD,
+        WMI_TLV_TAG_STRUCT_STA_POWERSAVE_MODE_CMD,
+        WMI_TLV_TAG_STRUCT_STA_POWERSAVE_PARAM_CMD,
+        WMI_TLV_TAG_STRUCT_STA_DTIM_PS_METHOD_CMD,
+        WMI_TLV_TAG_STRUCT_ROAM_SCAN_MODE,
+        WMI_TLV_TAG_STRUCT_ROAM_SCAN_RSSI_THRESHOLD,
+        WMI_TLV_TAG_STRUCT_ROAM_SCAN_PERIOD,
+        WMI_TLV_TAG_STRUCT_ROAM_SCAN_RSSI_CHANGE_THRESHOLD,
+        WMI_TLV_TAG_STRUCT_PDEV_SUSPEND_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_RESUME_CMD,
+        WMI_TLV_TAG_STRUCT_ADD_BCN_FILTER_CMD,
+        WMI_TLV_TAG_STRUCT_RMV_BCN_FILTER_CMD,
+        WMI_TLV_TAG_STRUCT_WOW_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_WOW_HOSTWAKEUP_FROM_SLEEP_CMD,
+        WMI_TLV_TAG_STRUCT_STA_UAPSD_AUTO_TRIG_CMD,
+        WMI_TLV_TAG_STRUCT_STA_UAPSD_AUTO_TRIG_PARAM,
+        WMI_TLV_TAG_STRUCT_SET_ARP_NS_OFFLOAD_CMD,
+        WMI_TLV_TAG_STRUCT_ARP_OFFLOAD_TUPLE,
+        WMI_TLV_TAG_STRUCT_NS_OFFLOAD_TUPLE,
+        WMI_TLV_TAG_STRUCT_FTM_INTG_CMD,
+        WMI_TLV_TAG_STRUCT_STA_KEEPALIVE_CMD,
+        WMI_TLV_TAG_STRUCT_STA_KEEPALVE_ARP_RESPONSE,
+        WMI_TLV_TAG_STRUCT_P2P_SET_VENDOR_IE_DATA_CMD,
+        WMI_TLV_TAG_STRUCT_AP_PS_PEER_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_RATE_RETRY_SCHED_CMD,
+        WMI_TLV_TAG_STRUCT_WLAN_PROFILE_TRIGGER_CMD,
+        WMI_TLV_TAG_STRUCT_WLAN_PROFILE_SET_HIST_INTVL_CMD,
+        WMI_TLV_TAG_STRUCT_WLAN_PROFILE_GET_PROF_DATA_CMD,
+        WMI_TLV_TAG_STRUCT_WLAN_PROFILE_ENABLE_PROFILE_ID_CMD,
+        WMI_TLV_TAG_STRUCT_WOW_DEL_PATTERN_CMD,
+        WMI_TLV_TAG_STRUCT_WOW_ADD_DEL_EVT_CMD,
+        WMI_TLV_TAG_STRUCT_RTT_MEASREQ_HEAD,
+        WMI_TLV_TAG_STRUCT_RTT_MEASREQ_BODY,
+        WMI_TLV_TAG_STRUCT_RTT_TSF_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_SPECTRAL_CONFIGURE_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_SPECTRAL_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_REQUEST_STATS_CMD,
+        WMI_TLV_TAG_STRUCT_NLO_CONFIG_CMD,
+        WMI_TLV_TAG_STRUCT_NLO_CONFIGURED_PARAMETERS,
+        WMI_TLV_TAG_STRUCT_CSA_OFFLOAD_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_CSA_OFFLOAD_CHANSWITCH_CMD,
+        WMI_TLV_TAG_STRUCT_CHATTER_SET_MODE_CMD,
+        WMI_TLV_TAG_STRUCT_ECHO_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_SET_KEEPALIVE_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_GET_KEEPALIVE_CMD,
+        WMI_TLV_TAG_STRUCT_FORCE_FW_HANG_CMD,
+        WMI_TLV_TAG_STRUCT_GPIO_CONFIG_CMD,
+        WMI_TLV_TAG_STRUCT_GPIO_OUTPUT_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_ADD_WDS_ENTRY_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_REMOVE_WDS_ENTRY_CMD,
+        WMI_TLV_TAG_STRUCT_BCN_TX_HDR,
+        WMI_TLV_TAG_STRUCT_BCN_SEND_FROM_HOST_CMD,
+        WMI_TLV_TAG_STRUCT_MGMT_TX_HDR,
+        WMI_TLV_TAG_STRUCT_ADDBA_CLEAR_RESP_CMD,
+        WMI_TLV_TAG_STRUCT_ADDBA_SEND_CMD,
+        WMI_TLV_TAG_STRUCT_DELBA_SEND_CMD,
+        WMI_TLV_TAG_STRUCT_ADDBA_SETRESPONSE_CMD,
+        WMI_TLV_TAG_STRUCT_SEND_SINGLEAMSDU_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_PKTLOG_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_PKTLOG_DISABLE_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_HT_IE_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_VHT_IE_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_DSCP_TID_MAP_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_GREEN_AP_PS_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_GET_TPC_CONFIG_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_BASE_MACADDR_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_MCAST_GROUP_CMD,
+        WMI_TLV_TAG_STRUCT_ROAM_AP_PROFILE,
+        WMI_TLV_TAG_STRUCT_AP_PROFILE,
+        WMI_TLV_TAG_STRUCT_SCAN_SCH_PRIORITY_TABLE_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_DFS_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_DFS_DISABLE_CMD,
+        WMI_TLV_TAG_STRUCT_WOW_ADD_PATTERN_CMD,
+        WMI_TLV_TAG_STRUCT_WOW_BITMAP_PATTERN_T,
+        WMI_TLV_TAG_STRUCT_WOW_IPV4_SYNC_PATTERN_T,
+        WMI_TLV_TAG_STRUCT_WOW_IPV6_SYNC_PATTERN_T,
+        WMI_TLV_TAG_STRUCT_WOW_MAGIC_PATTERN_CMD,
+        WMI_TLV_TAG_STRUCT_SCAN_UPDATE_REQUEST_CMD,
+        WMI_TLV_TAG_STRUCT_CHATTER_PKT_COALESCING_FILTER,
+        WMI_TLV_TAG_STRUCT_CHATTER_COALESCING_ADD_FILTER_CMD,
+        WMI_TLV_TAG_STRUCT_CHATTER_COALESCING_DELETE_FILTER_CMD,
+        WMI_TLV_TAG_STRUCT_CHATTER_COALESCING_QUERY_CMD,
+        WMI_TLV_TAG_STRUCT_TXBF_CMD,
+        WMI_TLV_TAG_STRUCT_DEBUG_LOG_CONFIG_CMD,
+        WMI_TLV_TAG_STRUCT_NLO_EVENT,
+        WMI_TLV_TAG_STRUCT_CHATTER_QUERY_REPLY_EVENT,
+        WMI_TLV_TAG_STRUCT_UPLOAD_H_HDR,
+        WMI_TLV_TAG_STRUCT_CAPTURE_H_EVENT_HDR,
+        WMI_TLV_TAG_STRUCT_VDEV_WNM_SLEEPMODE_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_IPSEC_NATKEEPALIVE_FILTER_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_WMM_ADDTS_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_WMM_DELTS_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_SET_WMM_PARAMS_CMD,
+        WMI_TLV_TAG_STRUCT_TDLS_SET_STATE_CMD,
+        WMI_TLV_TAG_STRUCT_TDLS_PEER_UPDATE_CMD,
+        WMI_TLV_TAG_STRUCT_TDLS_PEER_EVENT,
+        WMI_TLV_TAG_STRUCT_TDLS_PEER_CAPABILITIES,
+        WMI_TLV_TAG_STRUCT_VDEV_MCC_SET_TBTT_MODE_CMD,
+        WMI_TLV_TAG_STRUCT_ROAM_CHAN_LIST,
+        WMI_TLV_TAG_STRUCT_VDEV_MCC_BCN_INTVL_CHANGE_EVENT,
+        WMI_TLV_TAG_STRUCT_RESMGR_ADAPTIVE_OCS_CMD,
+        WMI_TLV_TAG_STRUCT_RESMGR_SET_CHAN_TIME_QUOTA_CMD,
+        WMI_TLV_TAG_STRUCT_RESMGR_SET_CHAN_LATENCY_CMD,
+        WMI_TLV_TAG_STRUCT_BA_REQ_SSN_CMD,
+        WMI_TLV_TAG_STRUCT_BA_RSP_SSN_EVENT,
+        WMI_TLV_TAG_STRUCT_STA_SMPS_FORCE_MODE_CMD,
+        WMI_TLV_TAG_STRUCT_SET_MCASTBCAST_FILTER_CMD,
+        WMI_TLV_TAG_STRUCT_P2P_SET_OPPPS_CMD,
+        WMI_TLV_TAG_STRUCT_P2P_SET_NOA_CMD,
+        WMI_TLV_TAG_STRUCT_BA_REQ_SSN_CMD_SUB_STRUCT_PARAM,
+        WMI_TLV_TAG_STRUCT_BA_REQ_SSN_EVENT_SUB_STRUCT_PARAM,
+        WMI_TLV_TAG_STRUCT_STA_SMPS_PARAM_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_SET_GTX_PARAMS_CMD,
+        WMI_TLV_TAG_STRUCT_MCC_SCHED_TRAFFIC_STATS_CMD,
+        WMI_TLV_TAG_STRUCT_MCC_SCHED_STA_TRAFFIC_STATS,
+        WMI_TLV_TAG_STRUCT_OFFLOAD_BCN_TX_STATUS_EVENT,
+        WMI_TLV_TAG_STRUCT_P2P_NOA_EVENT,
+        WMI_TLV_TAG_STRUCT_HB_SET_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_HB_SET_TCP_PARAMS_CMD,
+        WMI_TLV_TAG_STRUCT_HB_SET_TCP_PKT_FILTER_CMD,
+        WMI_TLV_TAG_STRUCT_HB_SET_UDP_PARAMS_CMD,
+        WMI_TLV_TAG_STRUCT_HB_SET_UDP_PKT_FILTER_CMD,
+        WMI_TLV_TAG_STRUCT_HB_IND_EVENT,
+        WMI_TLV_TAG_STRUCT_TX_PAUSE_EVENT,
+        WMI_TLV_TAG_STRUCT_RFKILL_EVENT,
+        WMI_TLV_TAG_STRUCT_DFS_RADAR_EVENT,
+        WMI_TLV_TAG_STRUCT_DFS_PHYERR_FILTER_ENA_CMD,
+        WMI_TLV_TAG_STRUCT_DFS_PHYERR_FILTER_DIS_CMD,
+        WMI_TLV_TAG_STRUCT_BATCH_SCAN_RESULT_SCAN_LIST,
+        WMI_TLV_TAG_STRUCT_BATCH_SCAN_RESULT_NETWORK_INFO,
+        WMI_TLV_TAG_STRUCT_BATCH_SCAN_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_BATCH_SCAN_DISABLE_CMD,
+        WMI_TLV_TAG_STRUCT_BATCH_SCAN_TRIGGER_RESULT_CMD,
+        WMI_TLV_TAG_STRUCT_BATCH_SCAN_ENABLED_EVENT,
+        WMI_TLV_TAG_STRUCT_BATCH_SCAN_RESULT_EVENT,
+        WMI_TLV_TAG_STRUCT_VDEV_PLMREQ_START_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_PLMREQ_STOP_CMD,
+        WMI_TLV_TAG_STRUCT_THERMAL_MGMT_CMD,
+        WMI_TLV_TAG_STRUCT_THERMAL_MGMT_EVENT,
+        WMI_TLV_TAG_STRUCT_PEER_INFO_REQ_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_INFO_EVENT,
+        WMI_TLV_TAG_STRUCT_PEER_INFO,
+        WMI_TLV_TAG_STRUCT_PEER_TX_FAIL_CNT_THR_EVENT,
+        WMI_TLV_TAG_STRUCT_RMC_SET_MODE_CMD,
+        WMI_TLV_TAG_STRUCT_RMC_SET_ACTION_PERIOD_CMD,
+        WMI_TLV_TAG_STRUCT_RMC_CONFIG_CMD,
+        WMI_TLV_TAG_STRUCT_MHF_OFFLOAD_SET_MODE_CMD,
+        WMI_TLV_TAG_STRUCT_MHF_OFFLOAD_PLUMB_ROUTING_TABLE_CMD,
+        WMI_TLV_TAG_STRUCT_ADD_PROACTIVE_ARP_RSP_PATTERN_CMD,
+        WMI_TLV_TAG_STRUCT_DEL_PROACTIVE_ARP_RSP_PATTERN_CMD,
+        WMI_TLV_TAG_STRUCT_NAN_CMD_PARAM,
+        WMI_TLV_TAG_STRUCT_NAN_EVENT_HDR,
+        WMI_TLV_TAG_STRUCT_PDEV_L1SS_TRACK_EVENT,
+        WMI_TLV_TAG_STRUCT_DIAG_DATA_CONTAINER_EVENT,
+        WMI_TLV_TAG_STRUCT_MODEM_POWER_STATE_CMD_PARAM,
+        WMI_TLV_TAG_STRUCT_PEER_GET_ESTIMATED_LINKSPEED_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_ESTIMATED_LINKSPEED_EVENT,
+        WMI_TLV_TAG_STRUCT_AGGR_STATE_TRIG_EVENT,
+        WMI_TLV_TAG_STRUCT_MHF_OFFLOAD_ROUTING_TABLE_ENTRY,
+        WMI_TLV_TAG_STRUCT_ROAM_SCAN_CMD,
+        WMI_TLV_TAG_STRUCT_REQ_STATS_EXT_CMD,
+        WMI_TLV_TAG_STRUCT_STATS_EXT_EVENT,
+        WMI_TLV_TAG_STRUCT_OBSS_SCAN_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_OBSS_SCAN_DISABLE_CMD,
+        WMI_TLV_TAG_STRUCT_OFFLOAD_PRB_RSP_TX_STATUS_EVENT,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_LED_CONFIG_CMD,
+        WMI_TLV_TAG_STRUCT_HOST_AUTO_SHUTDOWN_CFG_CMD,
+        WMI_TLV_TAG_STRUCT_HOST_AUTO_SHUTDOWN_EVENT,
+        WMI_TLV_TAG_STRUCT_UPDATE_WHAL_MIB_STATS_EVENT,
+        WMI_TLV_TAG_STRUCT_CHAN_AVOID_UPDATE_CMD_PARAM,
+        WMI_TLV_TAG_STRUCT_WOW_ACER_IOAC_PKT_PATTERN_T,
+        WMI_TLV_TAG_STRUCT_WOW_ACER_IOAC_TMR_PATTERN_T,
+        WMI_TLV_TAG_STRUCT_WOW_IOAC_ADD_KEEPALIVE_CMD,
+        WMI_TLV_TAG_STRUCT_WOW_IOAC_DEL_KEEPALIVE_CMD,
+        WMI_TLV_TAG_STRUCT_WOW_IOAC_KEEPALIVE_T,
+        WMI_TLV_TAG_STRUCT_WOW_ACER_IOAC_ADD_PATTERN_CMD,
+        WMI_TLV_TAG_STRUCT_WOW_ACER_IOAC_DEL_PATTERN_CMD,
+        WMI_TLV_TAG_STRUCT_START_LINK_STATS_CMD,
+        WMI_TLV_TAG_STRUCT_CLEAR_LINK_STATS_CMD,
+        WMI_TLV_TAG_STRUCT_REQUEST_LINK_STATS_CMD,
+        WMI_TLV_TAG_STRUCT_IFACE_LINK_STATS_EVENT,
+        WMI_TLV_TAG_STRUCT_RADIO_LINK_STATS_EVENT,
+        WMI_TLV_TAG_STRUCT_PEER_STATS_EVENT,
+        WMI_TLV_TAG_STRUCT_CHANNEL_STATS,
+        WMI_TLV_TAG_STRUCT_RADIO_LINK_STATS,
+        WMI_TLV_TAG_STRUCT_RATE_STATS,
+        WMI_TLV_TAG_STRUCT_PEER_LINK_STATS,
+        WMI_TLV_TAG_STRUCT_WMM_AC_STATS,
+        WMI_TLV_TAG_STRUCT_IFACE_LINK_STATS,
+        WMI_TLV_TAG_STRUCT_LPI_MGMT_SNOOPING_CONFIG_CMD,
+        WMI_TLV_TAG_STRUCT_LPI_START_SCAN_CMD,
+        WMI_TLV_TAG_STRUCT_LPI_STOP_SCAN_CMD,
+        WMI_TLV_TAG_STRUCT_LPI_RESULT_EVENT,
+        WMI_TLV_TAG_STRUCT_PEER_STATE_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_BUCKET_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_BUCKET_CHANNEL_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_START_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_STOP_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_CONFIGURE_WLAN_CHANGE_MONITOR_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_WLAN_CHANGE_BSSID_PARAM_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_CONFIGURE_HOTLIST_MONITOR_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_GET_CACHED_RESULTS_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_GET_WLAN_CHANGE_RESULTS_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_SET_CAPABILITIES_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_GET_CAPABILITIES_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_OPERATION_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_START_STOP_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_TABLE_USAGE_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_WLAN_DESCRIPTOR_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_RSSI_INFO_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_CACHED_RESULTS_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_WLAN_CHANGE_RESULTS_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_WLAN_CHANGE_RESULT_BSSID_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_HOTLIST_MATCH_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_CAPABILITIES_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_CACHE_CAPABILITIES_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_WLAN_CHANGE_MONITOR_CAPABILITIES_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_HOTLIST_MONITOR_CAPABILITIES_EVENT,
+        WMI_TLV_TAG_STRUCT_D0_WOW_ENABLE_DISABLE_CMD,
+        WMI_TLV_TAG_STRUCT_D0_WOW_DISABLE_ACK_EVENT,
+        WMI_TLV_TAG_STRUCT_UNIT_TEST_CMD,
+        WMI_TLV_TAG_STRUCT_ROAM_OFFLOAD_TLV_PARAM,
+        WMI_TLV_TAG_STRUCT_ROAM_11I_OFFLOAD_TLV_PARAM,
+        WMI_TLV_TAG_STRUCT_ROAM_11R_OFFLOAD_TLV_PARAM,
+        WMI_TLV_TAG_STRUCT_ROAM_ESE_OFFLOAD_TLV_PARAM,
+        WMI_TLV_TAG_STRUCT_ROAM_SYNCH_EVENT,
+        WMI_TLV_TAG_STRUCT_ROAM_SYNCH_COMPLETE,
+        WMI_TLV_TAG_STRUCT_EXTWOW_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_EXTWOW_SET_APP_TYPE1_PARAMS_CMD,
+        WMI_TLV_TAG_STRUCT_EXTWOW_SET_APP_TYPE2_PARAMS_CMD,
+        WMI_TLV_TAG_STRUCT_LPI_STATUS_EVENT,
+        WMI_TLV_TAG_STRUCT_LPI_HANDOFF_EVENT,
+        WMI_TLV_TAG_STRUCT_VDEV_RATE_STATS_EVENT,
+        WMI_TLV_TAG_STRUCT_VDEV_RATE_HT_INFO,
+        WMI_TLV_TAG_STRUCT_RIC_REQUEST,
+        WMI_TLV_TAG_STRUCT_PDEV_GET_TEMPERATURE_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_TEMPERATURE_EVENT,
+        WMI_TLV_TAG_STRUCT_SET_DHCP_SERVER_OFFLOAD_CMD,
+        WMI_TLV_TAG_STRUCT_TPC_CHAINMASK_CONFIG_CMD,
+        WMI_TLV_TAG_STRUCT_RIC_TSPEC,
+        WMI_TLV_TAG_STRUCT_TPC_CHAINMASK_CONFIG,
+        WMI_TLV_TAG_STRUCT_IPA_OFFLOAD_CMD,
+        WMI_TLV_TAG_STRUCT_SCAN_PROB_REQ_OUI_CMD,
+        WMI_TLV_TAG_STRUCT_KEY_MATERIAL,
+        WMI_TLV_TAG_STRUCT_TDLS_SET_OFFCHAN_MODE_CMD,
+        WMI_TLV_TAG_STRUCT_SET_LED_FLASHING_CMD,
+        WMI_TLV_TAG_STRUCT_MDNS_OFFLOAD_CMD,
+        WMI_TLV_TAG_STRUCT_MDNS_SET_FQDN_CMD,
+        WMI_TLV_TAG_STRUCT_MDNS_SET_RESP_CMD,
+        WMI_TLV_TAG_STRUCT_MDNS_GET_STATS_CMD,
+        WMI_TLV_TAG_STRUCT_MDNS_STATS_EVENT,
+        WMI_TLV_TAG_STRUCT_ROAM_INVOKE_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_RESUME_EVENT,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_ANTENNA_DIVERSITY_CMD,
+        WMI_TLV_TAG_STRUCT_SAP_OFL_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_SAP_OFL_ADD_STA_EVENT,
+        WMI_TLV_TAG_STRUCT_SAP_OFL_DEL_STA_EVENT,
+        WMI_TLV_TAG_STRUCT_APFIND_CMD_PARAM,
+        WMI_TLV_TAG_STRUCT_APFIND_EVENT_HDR,
+
+        WMI_TLV_TAG_MAX
+};
+
+enum wmi_tlv_service {
+        WMI_TLV_SERVICE_BEACON_OFFLOAD = 0,
+        WMI_TLV_SERVICE_SCAN_OFFLOAD,
+        WMI_TLV_SERVICE_ROAM_SCAN_OFFLOAD,
+        WMI_TLV_SERVICE_BCN_MISS_OFFLOAD,
+        WMI_TLV_SERVICE_STA_PWRSAVE,
+        WMI_TLV_SERVICE_STA_ADVANCED_PWRSAVE,
+        WMI_TLV_SERVICE_AP_UAPSD,
+        WMI_TLV_SERVICE_AP_DFS,
+        WMI_TLV_SERVICE_11AC,
+        WMI_TLV_SERVICE_BLOCKACK,
+        WMI_TLV_SERVICE_PHYERR,
+        WMI_TLV_SERVICE_BCN_FILTER,
+        WMI_TLV_SERVICE_RTT,
+        WMI_TLV_SERVICE_WOW,
+        WMI_TLV_SERVICE_RATECTRL_CACHE,
+        WMI_TLV_SERVICE_IRAM_TIDS,
+        WMI_TLV_SERVICE_ARPNS_OFFLOAD,
+        WMI_TLV_SERVICE_NLO,
+        WMI_TLV_SERVICE_GTK_OFFLOAD,
+        WMI_TLV_SERVICE_SCAN_SCH,
+        WMI_TLV_SERVICE_CSA_OFFLOAD,
+        WMI_TLV_SERVICE_CHATTER,
+        WMI_TLV_SERVICE_COEX_FREQAVOID,
+        WMI_TLV_SERVICE_PACKET_POWER_SAVE,
+        WMI_TLV_SERVICE_FORCE_FW_HANG,
+        WMI_TLV_SERVICE_GPIO,
+        WMI_TLV_SERVICE_STA_DTIM_PS_MODULATED_DTIM,
+        WMI_TLV_SERVICE_STA_UAPSD_BASIC_AUTO_TRIG,
+        WMI_TLV_SERVICE_STA_UAPSD_VAR_AUTO_TRIG,
+        WMI_TLV_SERVICE_STA_KEEP_ALIVE,
+        WMI_TLV_SERVICE_TX_ENCAP,
+        WMI_TLV_SERVICE_AP_PS_DETECT_OUT_OF_SYNC,
+        WMI_TLV_SERVICE_EARLY_RX,
+        WMI_TLV_SERVICE_STA_SMPS,
+        WMI_TLV_SERVICE_FWTEST,
+        WMI_TLV_SERVICE_STA_WMMAC,
+        WMI_TLV_SERVICE_TDLS,
+        WMI_TLV_SERVICE_BURST,
+        WMI_TLV_SERVICE_MCC_BCN_INTERVAL_CHANGE,
+        WMI_TLV_SERVICE_ADAPTIVE_OCS,
+        WMI_TLV_SERVICE_BA_SSN_SUPPORT,
+        WMI_TLV_SERVICE_FILTER_IPSEC_NATKEEPALIVE,
+        WMI_TLV_SERVICE_WLAN_HB,
+        WMI_TLV_SERVICE_LTE_ANT_SHARE_SUPPORT,
+        WMI_TLV_SERVICE_BATCH_SCAN,
+        WMI_TLV_SERVICE_QPOWER,
+        WMI_TLV_SERVICE_PLMREQ,
+        WMI_TLV_SERVICE_THERMAL_MGMT,
+        WMI_TLV_SERVICE_RMC,
+        WMI_TLV_SERVICE_MHF_OFFLOAD,
+        WMI_TLV_SERVICE_COEX_SAR,
+        WMI_TLV_SERVICE_BCN_TXRATE_OVERRIDE,
+        WMI_TLV_SERVICE_NAN,
+        WMI_TLV_SERVICE_L1SS_STAT,
+        WMI_TLV_SERVICE_ESTIMATE_LINKSPEED,
+        WMI_TLV_SERVICE_OBSS_SCAN,
+        WMI_TLV_SERVICE_TDLS_OFFCHAN,
+        WMI_TLV_SERVICE_TDLS_UAPSD_BUFFER_STA,
+        WMI_TLV_SERVICE_TDLS_UAPSD_SLEEP_STA,
+        WMI_TLV_SERVICE_IBSS_PWRSAVE,
+        WMI_TLV_SERVICE_LPASS,
+        WMI_TLV_SERVICE_EXTSCAN,
+        WMI_TLV_SERVICE_D0WOW,
+        WMI_TLV_SERVICE_HSOFFLOAD,
+        WMI_TLV_SERVICE_ROAM_HO_OFFLOAD,
+        WMI_TLV_SERVICE_RX_FULL_REORDER,
+        WMI_TLV_SERVICE_DHCP_OFFLOAD,
+        WMI_TLV_SERVICE_STA_RX_IPA_OFFLOAD_SUPPORT,
+        WMI_TLV_SERVICE_MDNS_OFFLOAD,
+        WMI_TLV_SERVICE_SAP_AUTH_OFFLOAD,
+};
+
+#define WMI_SERVICE_IS_ENABLED(wmi_svc_bmap, svc_id, len) \
+        ((svc_id) < (len) && \
+         __le32_to_cpu((wmi_svc_bmap)[(svc_id)/(sizeof(u32))]) & \
+         BIT((svc_id)%(sizeof(u32))))
+
+#define SVCMAP(x, y, len) \
+        do { \
+                if (WMI_SERVICE_IS_ENABLED((in), (x), (len))) \
+                        __set_bit(y, out); \
+        } while (0)
+
+static inline void
+wmi_tlv_svc_map(const __le32 *in, unsigned long *out, size_t len)
+{
+        SVCMAP(WMI_TLV_SERVICE_BEACON_OFFLOAD,
+               WMI_SERVICE_BEACON_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_SCAN_OFFLOAD,
+               WMI_SERVICE_SCAN_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_ROAM_SCAN_OFFLOAD,
+               WMI_SERVICE_ROAM_SCAN_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_BCN_MISS_OFFLOAD,
+               WMI_SERVICE_BCN_MISS_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_STA_PWRSAVE,
+               WMI_SERVICE_STA_PWRSAVE, len);
+        SVCMAP(WMI_TLV_SERVICE_STA_ADVANCED_PWRSAVE,
+               WMI_SERVICE_STA_ADVANCED_PWRSAVE, len);
+        SVCMAP(WMI_TLV_SERVICE_AP_UAPSD,
+               WMI_SERVICE_AP_UAPSD, len);
+        SVCMAP(WMI_TLV_SERVICE_AP_DFS,
+               WMI_SERVICE_AP_DFS, len);
+        SVCMAP(WMI_TLV_SERVICE_11AC,
+               WMI_SERVICE_11AC, len);
+        SVCMAP(WMI_TLV_SERVICE_BLOCKACK,
+               WMI_SERVICE_BLOCKACK, len);
+        SVCMAP(WMI_TLV_SERVICE_PHYERR,
+               WMI_SERVICE_PHYERR, len);
+        SVCMAP(WMI_TLV_SERVICE_BCN_FILTER,
+               WMI_SERVICE_BCN_FILTER, len);
+        SVCMAP(WMI_TLV_SERVICE_RTT,
+               WMI_SERVICE_RTT, len);
+        SVCMAP(WMI_TLV_SERVICE_WOW,
+               WMI_SERVICE_WOW, len);
+        SVCMAP(WMI_TLV_SERVICE_RATECTRL_CACHE,
+               WMI_SERVICE_RATECTRL_CACHE, len);
+        SVCMAP(WMI_TLV_SERVICE_IRAM_TIDS,
+               WMI_SERVICE_IRAM_TIDS, len);
+        SVCMAP(WMI_TLV_SERVICE_ARPNS_OFFLOAD,
+               WMI_SERVICE_ARPNS_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_NLO,
+               WMI_SERVICE_NLO, len);
+        SVCMAP(WMI_TLV_SERVICE_GTK_OFFLOAD,
+               WMI_SERVICE_GTK_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_SCAN_SCH,
+               WMI_SERVICE_SCAN_SCH, len);
+        SVCMAP(WMI_TLV_SERVICE_CSA_OFFLOAD,
+               WMI_SERVICE_CSA_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_CHATTER,
+               WMI_SERVICE_CHATTER, len);
+        SVCMAP(WMI_TLV_SERVICE_COEX_FREQAVOID,
+               WMI_SERVICE_COEX_FREQAVOID, len);
+        SVCMAP(WMI_TLV_SERVICE_PACKET_POWER_SAVE,
+               WMI_SERVICE_PACKET_POWER_SAVE, len);
+        SVCMAP(WMI_TLV_SERVICE_FORCE_FW_HANG,
+               WMI_SERVICE_FORCE_FW_HANG, len);
+        SVCMAP(WMI_TLV_SERVICE_GPIO,
+               WMI_SERVICE_GPIO, len);
+        SVCMAP(WMI_TLV_SERVICE_STA_DTIM_PS_MODULATED_DTIM,
+               WMI_SERVICE_STA_DTIM_PS_MODULATED_DTIM, len);
+        SVCMAP(WMI_TLV_SERVICE_STA_UAPSD_BASIC_AUTO_TRIG,
+               WMI_SERVICE_STA_UAPSD_BASIC_AUTO_TRIG, len);
+        SVCMAP(WMI_TLV_SERVICE_STA_UAPSD_VAR_AUTO_TRIG,
+               WMI_SERVICE_STA_UAPSD_VAR_AUTO_TRIG, len);
+        SVCMAP(WMI_TLV_SERVICE_STA_KEEP_ALIVE,
+               WMI_SERVICE_STA_KEEP_ALIVE, len);
+        SVCMAP(WMI_TLV_SERVICE_TX_ENCAP,
+               WMI_SERVICE_TX_ENCAP, len);
+        SVCMAP(WMI_TLV_SERVICE_AP_PS_DETECT_OUT_OF_SYNC,
+               WMI_SERVICE_AP_PS_DETECT_OUT_OF_SYNC, len);
+        SVCMAP(WMI_TLV_SERVICE_EARLY_RX,
+               WMI_SERVICE_EARLY_RX, len);
+        SVCMAP(WMI_TLV_SERVICE_STA_SMPS,
+               WMI_SERVICE_STA_SMPS, len);
+        SVCMAP(WMI_TLV_SERVICE_FWTEST,
+               WMI_SERVICE_FWTEST, len);
+        SVCMAP(WMI_TLV_SERVICE_STA_WMMAC,
+               WMI_SERVICE_STA_WMMAC, len);
+        SVCMAP(WMI_TLV_SERVICE_TDLS,
+               WMI_SERVICE_TDLS, len);
+        SVCMAP(WMI_TLV_SERVICE_BURST,
+               WMI_SERVICE_BURST, len);
+        SVCMAP(WMI_TLV_SERVICE_MCC_BCN_INTERVAL_CHANGE,
+               WMI_SERVICE_MCC_BCN_INTERVAL_CHANGE, len);
+        SVCMAP(WMI_TLV_SERVICE_ADAPTIVE_OCS,
+               WMI_SERVICE_ADAPTIVE_OCS, len);
+        SVCMAP(WMI_TLV_SERVICE_BA_SSN_SUPPORT,
+               WMI_SERVICE_BA_SSN_SUPPORT, len);
+        SVCMAP(WMI_TLV_SERVICE_FILTER_IPSEC_NATKEEPALIVE,
+               WMI_SERVICE_FILTER_IPSEC_NATKEEPALIVE, len);
+        SVCMAP(WMI_TLV_SERVICE_WLAN_HB,
+               WMI_SERVICE_WLAN_HB, len);
+        SVCMAP(WMI_TLV_SERVICE_LTE_ANT_SHARE_SUPPORT,
+               WMI_SERVICE_LTE_ANT_SHARE_SUPPORT, len);
+        SVCMAP(WMI_TLV_SERVICE_BATCH_SCAN,
+               WMI_SERVICE_BATCH_SCAN, len);
+        SVCMAP(WMI_TLV_SERVICE_QPOWER,
+               WMI_SERVICE_QPOWER, len);
+        SVCMAP(WMI_TLV_SERVICE_PLMREQ,
+               WMI_SERVICE_PLMREQ, len);
+        SVCMAP(WMI_TLV_SERVICE_THERMAL_MGMT,
+               WMI_SERVICE_THERMAL_MGMT, len);
+        SVCMAP(WMI_TLV_SERVICE_RMC,
+               WMI_SERVICE_RMC, len);
+        SVCMAP(WMI_TLV_SERVICE_MHF_OFFLOAD,
+               WMI_SERVICE_MHF_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_COEX_SAR,
+               WMI_SERVICE_COEX_SAR, len);
+        SVCMAP(WMI_TLV_SERVICE_BCN_TXRATE_OVERRIDE,
+               WMI_SERVICE_BCN_TXRATE_OVERRIDE, len);
+        SVCMAP(WMI_TLV_SERVICE_NAN,
+               WMI_SERVICE_NAN, len);
+        SVCMAP(WMI_TLV_SERVICE_L1SS_STAT,
+               WMI_SERVICE_L1SS_STAT, len);
+        SVCMAP(WMI_TLV_SERVICE_ESTIMATE_LINKSPEED,
+               WMI_SERVICE_ESTIMATE_LINKSPEED, len);
+        SVCMAP(WMI_TLV_SERVICE_OBSS_SCAN,
+               WMI_SERVICE_OBSS_SCAN, len);
+        SVCMAP(WMI_TLV_SERVICE_TDLS_OFFCHAN,
+               WMI_SERVICE_TDLS_OFFCHAN, len);
+        SVCMAP(WMI_TLV_SERVICE_TDLS_UAPSD_BUFFER_STA,
+               WMI_SERVICE_TDLS_UAPSD_BUFFER_STA, len);
+        SVCMAP(WMI_TLV_SERVICE_TDLS_UAPSD_SLEEP_STA,
+               WMI_SERVICE_TDLS_UAPSD_SLEEP_STA, len);
+        SVCMAP(WMI_TLV_SERVICE_IBSS_PWRSAVE,
+               WMI_SERVICE_IBSS_PWRSAVE, len);
+        SVCMAP(WMI_TLV_SERVICE_LPASS,
+               WMI_SERVICE_LPASS, len);
+        SVCMAP(WMI_TLV_SERVICE_EXTSCAN,
+               WMI_SERVICE_EXTSCAN, len);
+        SVCMAP(WMI_TLV_SERVICE_D0WOW,
+               WMI_SERVICE_D0WOW, len);
+        SVCMAP(WMI_TLV_SERVICE_HSOFFLOAD,
+               WMI_SERVICE_HSOFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_ROAM_HO_OFFLOAD,
+               WMI_SERVICE_ROAM_HO_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_RX_FULL_REORDER,
+               WMI_SERVICE_RX_FULL_REORDER, len);
+        SVCMAP(WMI_TLV_SERVICE_DHCP_OFFLOAD,
+               WMI_SERVICE_DHCP_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_STA_RX_IPA_OFFLOAD_SUPPORT,
+               WMI_SERVICE_STA_RX_IPA_OFFLOAD_SUPPORT, len);
+        SVCMAP(WMI_TLV_SERVICE_MDNS_OFFLOAD,
+               WMI_SERVICE_MDNS_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_SAP_AUTH_OFFLOAD,
+               WMI_SERVICE_SAP_AUTH_OFFLOAD, len);
+}
+
+#undef SVCMAP
+
+struct wmi_tlv {
+        __le16 len;
+        __le16 tag;
+        u8 value[0];
+} __packed;
+
+#define WMI_TLV_MGMT_RX_NUM_RSSI 4
+
+struct wmi_tlv_mgmt_rx_ev {
+        __le32 channel;
+        __le32 snr;
+        __le32 rate;
+        __le32 phy_mode;
+        __le32 buf_len;
+        __le32 status;
+        __le32 rssi[WMI_TLV_MGMT_RX_NUM_RSSI];
+} __packed;
+
+struct wmi_tlv_abi_version {
+        __le32 abi_ver0;
+        __le32 abi_ver1;
+        __le32 abi_ver_ns0;
+        __le32 abi_ver_ns1;
+        __le32 abi_ver_ns2;
+        __le32 abi_ver_ns3;
+} __packed;
+
+enum wmi_tlv_hw_bd_id {
+        WMI_TLV_HW_BD_LEGACY = 0,
+        WMI_TLV_HW_BD_QCA6174 = 1,
+        WMI_TLV_HW_BD_QCA2582 = 2,
+};
+
+struct wmi_tlv_hw_bd_info {
+        u8 rev;
+        u8 project_id;
+        u8 custom_id;
+        u8 reference_design_id;
+} __packed;
+
+struct wmi_tlv_svc_rdy_ev {
+        __le32 fw_build_vers;
+        struct wmi_tlv_abi_version abi;
+        __le32 phy_capability;
+        __le32 max_frag_entry;
+        __le32 num_rf_chains;
+        __le32 ht_cap_info;
+        __le32 vht_cap_info;
+        __le32 vht_supp_mcs;
+        __le32 hw_min_tx_power;
+        __le32 hw_max_tx_power;
+        __le32 sys_cap_info;
+        __le32 min_pkt_size_enable;
+        __le32 max_bcn_ie_size;
+        __le32 num_mem_reqs;
+        __le32 max_num_scan_chans;
+        __le32 hw_bd_id; /* 0 means hw_bd_info is invalid */
+        struct wmi_tlv_hw_bd_info hw_bd_info[5];
+} __packed;
+
+struct wmi_tlv_rdy_ev {
+        struct wmi_tlv_abi_version abi;
+        struct wmi_mac_addr mac_addr;
+        __le32 status;
+} __packed;
+
+struct wmi_tlv_resource_config {
+        __le32 num_vdevs;
+        __le32 num_peers;
+        __le32 num_offload_peers;
+        __le32 num_offload_reorder_bufs;
+        __le32 num_peer_keys;
+        __le32 num_tids;
+        __le32 ast_skid_limit;
+        __le32 tx_chain_mask;
+        __le32 rx_chain_mask;
+        __le32 rx_timeout_pri[4];
+        __le32 rx_decap_mode;
+        __le32 scan_max_pending_reqs;
+        __le32 bmiss_offload_max_vdev;
+        __le32 roam_offload_max_vdev;
+        __le32 roam_offload_max_ap_profiles;
+        __le32 num_mcast_groups;
+        __le32 num_mcast_table_elems;
+        __le32 mcast2ucast_mode;
+        __le32 tx_dbg_log_size;
+        __le32 num_wds_entries;
+        __le32 dma_burst_size;
+        __le32 mac_aggr_delim;
+        __le32 rx_skip_defrag_timeout_dup_detection_check;
+        __le32 vow_config;
+        __le32 gtk_offload_max_vdev;
+        __le32 num_msdu_desc;
+        __le32 max_frag_entries;
+        __le32 num_tdls_vdevs;
+        __le32 num_tdls_conn_table_entries;
+        __le32 beacon_tx_offload_max_vdev;
+        __le32 num_multicast_filter_entries;
+        __le32 num_wow_filters;
+        __le32 num_keep_alive_pattern;
+        __le32 keep_alive_pattern_size;
+        __le32 max_tdls_concurrent_sleep_sta;
+        __le32 max_tdls_concurrent_buffer_sta;
+} __packed;
+
+struct wmi_tlv_init_cmd {
+        struct wmi_tlv_abi_version abi;
+        __le32 num_host_mem_chunks;
+} __packed;
+
+struct wmi_tlv_pdev_set_param_cmd {
+        __le32 pdev_id; /* not used yet */
+        __le32 param_id;
+        __le32 param_value;
+} __packed;
+
+struct wmi_tlv_pdev_set_rd_cmd {
+        __le32 pdev_id; /* not used yet */
+        __le32 regd;
+        __le32 regd_2ghz;
+        __le32 regd_5ghz;
+        __le32 conform_limit_2ghz;
+        __le32 conform_limit_5ghz;
+} __packed;
+
+struct wmi_tlv_scan_chan_list_cmd {
+        __le32 num_scan_chans;
+} __packed;
+
+struct wmi_tlv_start_scan_cmd {
+        struct wmi_start_scan_common common;
+        __le32 burst_duration_ms;
+        __le32 num_channels;
+        __le32 num_bssids;
+        __le32 num_ssids;
+        __le32 ie_len;
+        __le32 num_probes;
+} __packed;
+
+struct wmi_tlv_vdev_start_cmd {
+        __le32 vdev_id;
+        __le32 requestor_id;
+        __le32 bcn_intval;
+        __le32 dtim_period;
+        __le32 flags;
+        struct wmi_ssid ssid;
+        __le32 bcn_tx_rate;
+        __le32 bcn_tx_power;
+        __le32 num_noa_descr;
+        __le32 disable_hw_ack;
+} __packed;
+
+enum {
+        WMI_TLV_PEER_TYPE_DEFAULT = 0, /* generic / non-BSS / self-peer */
+        WMI_TLV_PEER_TYPE_BSS = 1,
+        WMI_TLV_PEER_TYPE_TDLS = 2,
+        WMI_TLV_PEER_TYPE_HOST_MAX = 127,
+        WMI_TLV_PEER_TYPE_ROAMOFFLOAD_TMP = 128,
+};
+
+struct wmi_tlv_peer_create_cmd {
+        __le32 vdev_id;
+        struct wmi_mac_addr peer_addr;
+        __le32 peer_type;
+} __packed;
+
+struct wmi_tlv_peer_assoc_cmd {
+        struct wmi_mac_addr mac_addr;
+        __le32 vdev_id;
+        __le32 new_assoc;
+        __le32 assoc_id;
+        __le32 flags;
+        __le32 caps;
+        __le32 listen_intval;
+        __le32 ht_caps;
+        __le32 max_mpdu;
+        __le32 mpdu_density;
+        __le32 rate_caps;
+        __le32 nss;
+        __le32 vht_caps;
+        __le32 phy_mode;
+        __le32 ht_info[2];
+        __le32 num_legacy_rates;
+        __le32 num_ht_rates;
+} __packed;
+
+struct wmi_tlv_pdev_suspend {
+        __le32 pdev_id; /* not used yet */
+        __le32 opt;
+} __packed;
+
+struct wmi_tlv_pdev_set_wmm_cmd {
+        __le32 pdev_id; /* not used yet */
+        __le32 dg_type; /* no idea.. */
+} __packed;
+
+struct wmi_tlv_phyerr_ev {
+        __le32 num_phyerrs;
+        __le32 tsf_l32;
+        __le32 tsf_u32;
+        __le32 buf_len;
+} __packed;
+
+enum wmi_tlv_dbglog_param {
+        WMI_TLV_DBGLOG_PARAM_LOG_LEVEL = 1,
+        WMI_TLV_DBGLOG_PARAM_VDEV_ENABLE,
+        WMI_TLV_DBGLOG_PARAM_VDEV_DISABLE,
+        WMI_TLV_DBGLOG_PARAM_VDEV_ENABLE_BITMAP,
+        WMI_TLV_DBGLOG_PARAM_VDEV_DISABLE_BITMAP,
+};
+
+enum wmi_tlv_dbglog_log_level {
+        WMI_TLV_DBGLOG_LOG_LEVEL_VERBOSE = 0,
+        WMI_TLV_DBGLOG_LOG_LEVEL_INFO,
+        WMI_TLV_DBGLOG_LOG_LEVEL_INFO_LVL_1,
+        WMI_TLV_DBGLOG_LOG_LEVEL_INFO_LVL_2,
+        WMI_TLV_DBGLOG_LOG_LEVEL_WARN,
+        WMI_TLV_DBGLOG_LOG_LEVEL_ERR,
+};
+
+#define WMI_TLV_DBGLOG_BITMAP_MAX_IDS 512
+#define WMI_TLV_DBGLOG_BITMAP_MAX_WORDS (WMI_TLV_DBGLOG_BITMAP_MAX_IDS / \
+                                         sizeof(__le32))
+#define WMI_TLV_DBGLOG_ALL_MODULES 0xffff
+#define WMI_TLV_DBGLOG_LOG_LEVEL_VALUE(module_id, log_level) \
+                (((module_id << 16) & 0xffff0000) | \
+                 ((log_level <<  0) & 0x000000ff))
+
+struct wmi_tlv_dbglog_cmd {
+        __le32 param;
+        __le32 value;
+} __packed;
+
+struct wmi_tlv_resume_cmd {
+        __le32 reserved;
+} __packed;
+
+struct wmi_tlv_req_stats_cmd {
+        __le32 stats_id; /* wmi_stats_id */
+        __le32 vdev_id;
+        struct wmi_mac_addr peer_macaddr;
+} __packed;
+
+struct wmi_tlv_vdev_stats {
+        __le32 vdev_id;
+        __le32 beacon_snr;
+        __le32 data_snr;
+        __le32 num_tx_frames[4]; /* per-AC */
+        __le32 num_rx_frames;
+        __le32 num_tx_frames_retries[4];
+        __le32 num_tx_frames_failures[4];
+        __le32 num_rts_fail;
+        __le32 num_rts_success;
+        __le32 num_rx_err;
+        __le32 num_rx_discard;
+        __le32 num_tx_not_acked;
+        __le32 tx_rate_history[10];
+        __le32 beacon_rssi_history[10];
+} __packed;
+
+struct wmi_tlv_pktlog_enable {
+        __le32 reserved;
+        __le32 filter;
+} __packed;
+
+struct wmi_tlv_pktlog_disable {
+        __le32 reserved;
+} __packed;
+
+void ath10k_wmi_tlv_attach(struct ath10k *ar);
+
+#endif
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index 721631c3dd3e..23eca8bc85d1 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -22,8 +22,10 @@
 #include "htc.h"
 #include "debug.h"
 #include "wmi.h"
+#include "wmi-tlv.h"
 #include "mac.h"
 #include "testmode.h"
+#include "wmi-ops.h"
 
 /* MAIN WMI cmd track */
 static struct wmi_cmd_map wmi_cmd_map = {
@@ -143,6 +145,7 @@ static struct wmi_cmd_map wmi_cmd_map = {
         .force_fw_hang_cmdid = WMI_FORCE_FW_HANG_CMDID,
         .gpio_config_cmdid = WMI_GPIO_CONFIG_CMDID,
         .gpio_output_cmdid = WMI_GPIO_OUTPUT_CMDID,
+        .pdev_get_temperature_cmdid = WMI_CMD_UNSUPPORTED,
 };
 
 /* 10.X WMI cmd track */
@@ -265,6 +268,129 @@ static struct wmi_cmd_map wmi_10x_cmd_map = {
         .force_fw_hang_cmdid = WMI_CMD_UNSUPPORTED,
         .gpio_config_cmdid = WMI_10X_GPIO_CONFIG_CMDID,
         .gpio_output_cmdid = WMI_10X_GPIO_OUTPUT_CMDID,
+        .pdev_get_temperature_cmdid = WMI_CMD_UNSUPPORTED,
+};
+
+/* 10.2.4 WMI cmd track */
+static struct wmi_cmd_map wmi_10_2_4_cmd_map = {
+        .init_cmdid = WMI_10_2_INIT_CMDID,
+        .start_scan_cmdid = WMI_10_2_START_SCAN_CMDID,
+        .stop_scan_cmdid = WMI_10_2_STOP_SCAN_CMDID,
+        .scan_chan_list_cmdid = WMI_10_2_SCAN_CHAN_LIST_CMDID,
+        .scan_sch_prio_tbl_cmdid = WMI_CMD_UNSUPPORTED,
+        .pdev_set_regdomain_cmdid = WMI_10_2_PDEV_SET_REGDOMAIN_CMDID,
+        .pdev_set_channel_cmdid = WMI_10_2_PDEV_SET_CHANNEL_CMDID,
+        .pdev_set_param_cmdid = WMI_10_2_PDEV_SET_PARAM_CMDID,
+        .pdev_pktlog_enable_cmdid = WMI_10_2_PDEV_PKTLOG_ENABLE_CMDID,
+        .pdev_pktlog_disable_cmdid = WMI_10_2_PDEV_PKTLOG_DISABLE_CMDID,
+        .pdev_set_wmm_params_cmdid = WMI_10_2_PDEV_SET_WMM_PARAMS_CMDID,
+        .pdev_set_ht_cap_ie_cmdid = WMI_10_2_PDEV_SET_HT_CAP_IE_CMDID,
+        .pdev_set_vht_cap_ie_cmdid = WMI_10_2_PDEV_SET_VHT_CAP_IE_CMDID,
+        .pdev_set_quiet_mode_cmdid = WMI_10_2_PDEV_SET_QUIET_MODE_CMDID,
+        .pdev_green_ap_ps_enable_cmdid = WMI_10_2_PDEV_GREEN_AP_PS_ENABLE_CMDID,
+        .pdev_get_tpc_config_cmdid = WMI_10_2_PDEV_GET_TPC_CONFIG_CMDID,
+        .pdev_set_base_macaddr_cmdid = WMI_10_2_PDEV_SET_BASE_MACADDR_CMDID,
+        .vdev_create_cmdid = WMI_10_2_VDEV_CREATE_CMDID,
+        .vdev_delete_cmdid = WMI_10_2_VDEV_DELETE_CMDID,
+        .vdev_start_request_cmdid = WMI_10_2_VDEV_START_REQUEST_CMDID,
+        .vdev_restart_request_cmdid = WMI_10_2_VDEV_RESTART_REQUEST_CMDID,
+        .vdev_up_cmdid = WMI_10_2_VDEV_UP_CMDID,
+        .vdev_stop_cmdid = WMI_10_2_VDEV_STOP_CMDID,
+        .vdev_down_cmdid = WMI_10_2_VDEV_DOWN_CMDID,
+        .vdev_set_param_cmdid = WMI_10_2_VDEV_SET_PARAM_CMDID,
+        .vdev_install_key_cmdid = WMI_10_2_VDEV_INSTALL_KEY_CMDID,
+        .peer_create_cmdid = WMI_10_2_PEER_CREATE_CMDID,
+        .peer_delete_cmdid = WMI_10_2_PEER_DELETE_CMDID,
+        .peer_flush_tids_cmdid = WMI_10_2_PEER_FLUSH_TIDS_CMDID,
+        .peer_set_param_cmdid = WMI_10_2_PEER_SET_PARAM_CMDID,
+        .peer_assoc_cmdid = WMI_10_2_PEER_ASSOC_CMDID,
+        .peer_add_wds_entry_cmdid = WMI_10_2_PEER_ADD_WDS_ENTRY_CMDID,
+        .peer_remove_wds_entry_cmdid = WMI_10_2_PEER_REMOVE_WDS_ENTRY_CMDID,
+        .peer_mcast_group_cmdid = WMI_10_2_PEER_MCAST_GROUP_CMDID,
+        .bcn_tx_cmdid = WMI_10_2_BCN_TX_CMDID,
+        .pdev_send_bcn_cmdid = WMI_10_2_PDEV_SEND_BCN_CMDID,
+        .bcn_tmpl_cmdid = WMI_CMD_UNSUPPORTED,
+        .bcn_filter_rx_cmdid = WMI_10_2_BCN_FILTER_RX_CMDID,
+        .prb_req_filter_rx_cmdid = WMI_10_2_PRB_REQ_FILTER_RX_CMDID,
+        .mgmt_tx_cmdid = WMI_10_2_MGMT_TX_CMDID,
+        .prb_tmpl_cmdid = WMI_CMD_UNSUPPORTED,
+        .addba_clear_resp_cmdid = WMI_10_2_ADDBA_CLEAR_RESP_CMDID,
+        .addba_send_cmdid = WMI_10_2_ADDBA_SEND_CMDID,
+        .addba_status_cmdid = WMI_10_2_ADDBA_STATUS_CMDID,
+        .delba_send_cmdid = WMI_10_2_DELBA_SEND_CMDID,
+        .addba_set_resp_cmdid = WMI_10_2_ADDBA_SET_RESP_CMDID,
+        .send_singleamsdu_cmdid = WMI_10_2_SEND_SINGLEAMSDU_CMDID,
+        .sta_powersave_mode_cmdid = WMI_10_2_STA_POWERSAVE_MODE_CMDID,
+        .sta_powersave_param_cmdid = WMI_10_2_STA_POWERSAVE_PARAM_CMDID,
+        .sta_mimo_ps_mode_cmdid = WMI_10_2_STA_MIMO_PS_MODE_CMDID,
+        .pdev_dfs_enable_cmdid = WMI_10_2_PDEV_DFS_ENABLE_CMDID,
+        .pdev_dfs_disable_cmdid = WMI_10_2_PDEV_DFS_DISABLE_CMDID,
+        .roam_scan_mode = WMI_10_2_ROAM_SCAN_MODE,
+        .roam_scan_rssi_threshold = WMI_10_2_ROAM_SCAN_RSSI_THRESHOLD,
+        .roam_scan_period = WMI_10_2_ROAM_SCAN_PERIOD,
+        .roam_scan_rssi_change_threshold =
+                                WMI_10_2_ROAM_SCAN_RSSI_CHANGE_THRESHOLD,
+        .roam_ap_profile = WMI_10_2_ROAM_AP_PROFILE,
+        .ofl_scan_add_ap_profile = WMI_10_2_OFL_SCAN_ADD_AP_PROFILE,
+        .ofl_scan_remove_ap_profile = WMI_10_2_OFL_SCAN_REMOVE_AP_PROFILE,
+        .ofl_scan_period = WMI_10_2_OFL_SCAN_PERIOD,
+        .p2p_dev_set_device_info = WMI_10_2_P2P_DEV_SET_DEVICE_INFO,
+        .p2p_dev_set_discoverability = WMI_10_2_P2P_DEV_SET_DISCOVERABILITY,
+        .p2p_go_set_beacon_ie = WMI_10_2_P2P_GO_SET_BEACON_IE,
+        .p2p_go_set_probe_resp_ie = WMI_10_2_P2P_GO_SET_PROBE_RESP_IE,
+        .p2p_set_vendor_ie_data_cmdid = WMI_CMD_UNSUPPORTED,
+        .ap_ps_peer_param_cmdid = WMI_10_2_AP_PS_PEER_PARAM_CMDID,
+        .ap_ps_peer_uapsd_coex_cmdid = WMI_CMD_UNSUPPORTED,
+        .peer_rate_retry_sched_cmdid = WMI_10_2_PEER_RATE_RETRY_SCHED_CMDID,
+        .wlan_profile_trigger_cmdid = WMI_10_2_WLAN_PROFILE_TRIGGER_CMDID,
+        .wlan_profile_set_hist_intvl_cmdid =
+                                WMI_10_2_WLAN_PROFILE_SET_HIST_INTVL_CMDID,
+        .wlan_profile_get_profile_data_cmdid =
+                                WMI_10_2_WLAN_PROFILE_GET_PROFILE_DATA_CMDID,
+        .wlan_profile_enable_profile_id_cmdid =
+                                WMI_10_2_WLAN_PROFILE_ENABLE_PROFILE_ID_CMDID,
+        .wlan_profile_list_profile_id_cmdid =
+                                WMI_10_2_WLAN_PROFILE_LIST_PROFILE_ID_CMDID,
+        .pdev_suspend_cmdid = WMI_10_2_PDEV_SUSPEND_CMDID,
+        .pdev_resume_cmdid = WMI_10_2_PDEV_RESUME_CMDID,
+        .add_bcn_filter_cmdid = WMI_10_2_ADD_BCN_FILTER_CMDID,
+        .rmv_bcn_filter_cmdid = WMI_10_2_RMV_BCN_FILTER_CMDID,
+        .wow_add_wake_pattern_cmdid = WMI_10_2_WOW_ADD_WAKE_PATTERN_CMDID,
+        .wow_del_wake_pattern_cmdid = WMI_10_2_WOW_DEL_WAKE_PATTERN_CMDID,
+        .wow_enable_disable_wake_event_cmdid =
+                                WMI_10_2_WOW_ENABLE_DISABLE_WAKE_EVENT_CMDID,
+        .wow_enable_cmdid = WMI_10_2_WOW_ENABLE_CMDID,
+        .wow_hostwakeup_from_sleep_cmdid =
+                                WMI_10_2_WOW_HOSTWAKEUP_FROM_SLEEP_CMDID,
+        .rtt_measreq_cmdid = WMI_10_2_RTT_MEASREQ_CMDID,
+        .rtt_tsf_cmdid = WMI_10_2_RTT_TSF_CMDID,
+        .vdev_spectral_scan_configure_cmdid =
+                                WMI_10_2_VDEV_SPECTRAL_SCAN_CONFIGURE_CMDID,
+        .vdev_spectral_scan_enable_cmdid =
+                                WMI_10_2_VDEV_SPECTRAL_SCAN_ENABLE_CMDID,
+        .request_stats_cmdid = WMI_10_2_REQUEST_STATS_CMDID,
+        .set_arp_ns_offload_cmdid = WMI_CMD_UNSUPPORTED,
+        .network_list_offload_config_cmdid = WMI_CMD_UNSUPPORTED,
+        .gtk_offload_cmdid = WMI_CMD_UNSUPPORTED,
+        .csa_offload_enable_cmdid = WMI_CMD_UNSUPPORTED,
+        .csa_offload_chanswitch_cmdid = WMI_CMD_UNSUPPORTED,
+        .chatter_set_mode_cmdid = WMI_CMD_UNSUPPORTED,
+        .peer_tid_addba_cmdid = WMI_CMD_UNSUPPORTED,
+        .peer_tid_delba_cmdid = WMI_CMD_UNSUPPORTED,
+        .sta_dtim_ps_method_cmdid = WMI_CMD_UNSUPPORTED,
+        .sta_uapsd_auto_trig_cmdid = WMI_CMD_UNSUPPORTED,
+        .sta_keepalive_cmd = WMI_CMD_UNSUPPORTED,
+        .echo_cmdid = WMI_10_2_ECHO_CMDID,
+        .pdev_utf_cmdid = WMI_10_2_PDEV_UTF_CMDID,
+        .dbglog_cfg_cmdid = WMI_10_2_DBGLOG_CFG_CMDID,
+        .pdev_qvit_cmdid = WMI_10_2_PDEV_QVIT_CMDID,
+        .pdev_ftm_intg_cmdid = WMI_CMD_UNSUPPORTED,
+        .vdev_set_keepalive_cmdid = WMI_CMD_UNSUPPORTED,
+        .vdev_get_keepalive_cmdid = WMI_CMD_UNSUPPORTED,
+        .force_fw_hang_cmdid = WMI_CMD_UNSUPPORTED,
+        .gpio_config_cmdid = WMI_10_2_GPIO_CONFIG_CMDID,
+        .gpio_output_cmdid = WMI_10_2_GPIO_OUTPUT_CMDID,
+        .pdev_get_temperature_cmdid = WMI_10_2_PDEV_GET_TEMPERATURE_CMDID,
 };
 
 /* MAIN WMI VDEV param map */
@@ -385,6 +511,64 @@ static struct wmi_vdev_param_map wmi_10x_vdev_param_map = {
                 WMI_10X_VDEV_PARAM_AP_DETECT_OUT_OF_SYNC_SLEEPING_STA_TIME_SECS,
 };
 
+static struct wmi_vdev_param_map wmi_10_2_4_vdev_param_map = {
+        .rts_threshold = WMI_10X_VDEV_PARAM_RTS_THRESHOLD,
+        .fragmentation_threshold = WMI_10X_VDEV_PARAM_FRAGMENTATION_THRESHOLD,
+        .beacon_interval = WMI_10X_VDEV_PARAM_BEACON_INTERVAL,
+        .listen_interval = WMI_10X_VDEV_PARAM_LISTEN_INTERVAL,
+        .multicast_rate = WMI_10X_VDEV_PARAM_MULTICAST_RATE,
+        .mgmt_tx_rate = WMI_10X_VDEV_PARAM_MGMT_TX_RATE,
+        .slot_time = WMI_10X_VDEV_PARAM_SLOT_TIME,
+        .preamble = WMI_10X_VDEV_PARAM_PREAMBLE,
+        .swba_time = WMI_10X_VDEV_PARAM_SWBA_TIME,
+        .wmi_vdev_stats_update_period = WMI_10X_VDEV_STATS_UPDATE_PERIOD,
+        .wmi_vdev_pwrsave_ageout_time = WMI_10X_VDEV_PWRSAVE_AGEOUT_TIME,
+        .wmi_vdev_host_swba_interval = WMI_10X_VDEV_HOST_SWBA_INTERVAL,
+        .dtim_period = WMI_10X_VDEV_PARAM_DTIM_PERIOD,
+        .wmi_vdev_oc_scheduler_air_time_limit =
+                                WMI_10X_VDEV_OC_SCHEDULER_AIR_TIME_LIMIT,
+        .wds = WMI_10X_VDEV_PARAM_WDS,
+        .atim_window = WMI_10X_VDEV_PARAM_ATIM_WINDOW,
+        .bmiss_count_max = WMI_10X_VDEV_PARAM_BMISS_COUNT_MAX,
+        .bmiss_first_bcnt = WMI_VDEV_PARAM_UNSUPPORTED,
+        .bmiss_final_bcnt = WMI_VDEV_PARAM_UNSUPPORTED,
+        .feature_wmm = WMI_10X_VDEV_PARAM_FEATURE_WMM,
+        .chwidth = WMI_10X_VDEV_PARAM_CHWIDTH,
+        .chextoffset = WMI_10X_VDEV_PARAM_CHEXTOFFSET,
+        .disable_htprotection = WMI_10X_VDEV_PARAM_DISABLE_HTPROTECTION,
+        .sta_quickkickout = WMI_10X_VDEV_PARAM_STA_QUICKKICKOUT,
+        .mgmt_rate = WMI_10X_VDEV_PARAM_MGMT_RATE,
+        .protection_mode = WMI_10X_VDEV_PARAM_PROTECTION_MODE,
+        .fixed_rate = WMI_10X_VDEV_PARAM_FIXED_RATE,
+        .sgi = WMI_10X_VDEV_PARAM_SGI,
+        .ldpc = WMI_10X_VDEV_PARAM_LDPC,
+        .tx_stbc = WMI_10X_VDEV_PARAM_TX_STBC,
+        .rx_stbc = WMI_10X_VDEV_PARAM_RX_STBC,
+        .intra_bss_fwd = WMI_10X_VDEV_PARAM_INTRA_BSS_FWD,
+        .def_keyid = WMI_10X_VDEV_PARAM_DEF_KEYID,
+        .nss = WMI_10X_VDEV_PARAM_NSS,
+        .bcast_data_rate = WMI_10X_VDEV_PARAM_BCAST_DATA_RATE,
+        .mcast_data_rate = WMI_10X_VDEV_PARAM_MCAST_DATA_RATE,
+        .mcast_indicate = WMI_10X_VDEV_PARAM_MCAST_INDICATE,
+        .dhcp_indicate = WMI_10X_VDEV_PARAM_DHCP_INDICATE,
+        .unknown_dest_indicate = WMI_10X_VDEV_PARAM_UNKNOWN_DEST_INDICATE,
+        .ap_keepalive_min_idle_inactive_time_secs =
+                WMI_10X_VDEV_PARAM_AP_KEEPALIVE_MIN_IDLE_INACTIVE_TIME_SECS,
+        .ap_keepalive_max_idle_inactive_time_secs =
+                WMI_10X_VDEV_PARAM_AP_KEEPALIVE_MAX_IDLE_INACTIVE_TIME_SECS,
+        .ap_keepalive_max_unresponsive_time_secs =
+                WMI_10X_VDEV_PARAM_AP_KEEPALIVE_MAX_UNRESPONSIVE_TIME_SECS,
+        .ap_enable_nawds = WMI_10X_VDEV_PARAM_AP_ENABLE_NAWDS,
+        .mcast2ucast_set = WMI_10X_VDEV_PARAM_MCAST2UCAST_SET,
+        .enable_rtscts = WMI_10X_VDEV_PARAM_ENABLE_RTSCTS,
+        .txbf = WMI_VDEV_PARAM_UNSUPPORTED,
+        .packet_powersave = WMI_VDEV_PARAM_UNSUPPORTED,
+        .drop_unencry = WMI_VDEV_PARAM_UNSUPPORTED,
+        .tx_encap_type = WMI_VDEV_PARAM_UNSUPPORTED,
+        .ap_detect_out_of_sync_sleeping_sta_time_secs =
+                WMI_10X_VDEV_PARAM_AP_DETECT_OUT_OF_SYNC_SLEEPING_STA_TIME_SECS,
+};
+
 static struct wmi_pdev_param_map wmi_pdev_param_map = {
         .tx_chain_mask = WMI_PDEV_PARAM_TX_CHAIN_MASK,
         .rx_chain_mask = WMI_PDEV_PARAM_RX_CHAIN_MASK,
@@ -434,6 +618,7 @@ static struct wmi_pdev_param_map wmi_pdev_param_map = {
         .fast_channel_reset = WMI_PDEV_PARAM_UNSUPPORTED,
         .burst_dur = WMI_PDEV_PARAM_UNSUPPORTED,
         .burst_enable = WMI_PDEV_PARAM_UNSUPPORTED,
+        .cal_period = WMI_PDEV_PARAM_UNSUPPORTED,
 };
 
 static struct wmi_pdev_param_map wmi_10x_pdev_param_map = {
@@ -486,6 +671,60 @@ static struct wmi_pdev_param_map wmi_10x_pdev_param_map = {
         .fast_channel_reset = WMI_10X_PDEV_PARAM_FAST_CHANNEL_RESET,
         .burst_dur = WMI_10X_PDEV_PARAM_BURST_DUR,
         .burst_enable = WMI_10X_PDEV_PARAM_BURST_ENABLE,
+        .cal_period = WMI_10X_PDEV_PARAM_CAL_PERIOD,
+};
+
+static struct wmi_pdev_param_map wmi_10_2_4_pdev_param_map = {
+        .tx_chain_mask = WMI_10X_PDEV_PARAM_TX_CHAIN_MASK,
+        .rx_chain_mask = WMI_10X_PDEV_PARAM_RX_CHAIN_MASK,
+        .txpower_limit2g = WMI_10X_PDEV_PARAM_TXPOWER_LIMIT2G,
+        .txpower_limit5g = WMI_10X_PDEV_PARAM_TXPOWER_LIMIT5G,
+        .txpower_scale = WMI_10X_PDEV_PARAM_TXPOWER_SCALE,
+        .beacon_gen_mode = WMI_10X_PDEV_PARAM_BEACON_GEN_MODE,
+        .beacon_tx_mode = WMI_10X_PDEV_PARAM_BEACON_TX_MODE,
+        .resmgr_offchan_mode = WMI_10X_PDEV_PARAM_RESMGR_OFFCHAN_MODE,
+        .protection_mode = WMI_10X_PDEV_PARAM_PROTECTION_MODE,
+        .dynamic_bw = WMI_10X_PDEV_PARAM_DYNAMIC_BW,
+        .non_agg_sw_retry_th = WMI_10X_PDEV_PARAM_NON_AGG_SW_RETRY_TH,
+        .agg_sw_retry_th = WMI_10X_PDEV_PARAM_AGG_SW_RETRY_TH,
+        .sta_kickout_th = WMI_10X_PDEV_PARAM_STA_KICKOUT_TH,
+        .ac_aggrsize_scaling = WMI_10X_PDEV_PARAM_AC_AGGRSIZE_SCALING,
+        .ltr_enable = WMI_10X_PDEV_PARAM_LTR_ENABLE,
+        .ltr_ac_latency_be = WMI_10X_PDEV_PARAM_LTR_AC_LATENCY_BE,
+        .ltr_ac_latency_bk = WMI_10X_PDEV_PARAM_LTR_AC_LATENCY_BK,
+        .ltr_ac_latency_vi = WMI_10X_PDEV_PARAM_LTR_AC_LATENCY_VI,
+        .ltr_ac_latency_vo = WMI_10X_PDEV_PARAM_LTR_AC_LATENCY_VO,
+        .ltr_ac_latency_timeout = WMI_10X_PDEV_PARAM_LTR_AC_LATENCY_TIMEOUT,
+        .ltr_sleep_override = WMI_10X_PDEV_PARAM_LTR_SLEEP_OVERRIDE,
+        .ltr_rx_override = WMI_10X_PDEV_PARAM_LTR_RX_OVERRIDE,
+        .ltr_tx_activity_timeout = WMI_10X_PDEV_PARAM_LTR_TX_ACTIVITY_TIMEOUT,
+        .l1ss_enable = WMI_10X_PDEV_PARAM_L1SS_ENABLE,
+        .dsleep_enable = WMI_10X_PDEV_PARAM_DSLEEP_ENABLE,
+        .pcielp_txbuf_flush = WMI_PDEV_PARAM_UNSUPPORTED,
+        .pcielp_txbuf_watermark = WMI_PDEV_PARAM_UNSUPPORTED,
+        .pcielp_txbuf_tmo_en = WMI_PDEV_PARAM_UNSUPPORTED,
+        .pcielp_txbuf_tmo_value = WMI_PDEV_PARAM_UNSUPPORTED,
+        .pdev_stats_update_period = WMI_10X_PDEV_PARAM_PDEV_STATS_UPDATE_PERIOD,
+        .vdev_stats_update_period = WMI_10X_PDEV_PARAM_VDEV_STATS_UPDATE_PERIOD,
+        .peer_stats_update_period = WMI_10X_PDEV_PARAM_PEER_STATS_UPDATE_PERIOD,
+        .bcnflt_stats_update_period =
+                                WMI_10X_PDEV_PARAM_BCNFLT_STATS_UPDATE_PERIOD,
+        .pmf_qos = WMI_10X_PDEV_PARAM_PMF_QOS,
+        .arp_ac_override = WMI_10X_PDEV_PARAM_ARPDHCP_AC_OVERRIDE,
+        .dcs = WMI_10X_PDEV_PARAM_DCS,
+        .ani_enable = WMI_10X_PDEV_PARAM_ANI_ENABLE,
+        .ani_poll_period = WMI_10X_PDEV_PARAM_ANI_POLL_PERIOD,
+        .ani_listen_period = WMI_10X_PDEV_PARAM_ANI_LISTEN_PERIOD,
+        .ani_ofdm_level = WMI_10X_PDEV_PARAM_ANI_OFDM_LEVEL,
+        .ani_cck_level = WMI_10X_PDEV_PARAM_ANI_CCK_LEVEL,
+        .dyntxchain = WMI_10X_PDEV_PARAM_DYNTXCHAIN,
+        .proxy_sta = WMI_PDEV_PARAM_UNSUPPORTED,
+        .idle_ps_config = WMI_PDEV_PARAM_UNSUPPORTED,
+        .power_gating_sleep = WMI_PDEV_PARAM_UNSUPPORTED,
+        .fast_channel_reset = WMI_10X_PDEV_PARAM_FAST_CHANNEL_RESET,
+        .burst_dur = WMI_10X_PDEV_PARAM_BURST_DUR,
+        .burst_enable = WMI_10X_PDEV_PARAM_BURST_ENABLE,
+        .cal_period = WMI_10X_PDEV_PARAM_CAL_PERIOD,
 };
 
 /* firmware 10.2 specific mappings */
@@ -607,11 +846,11 @@ static struct wmi_cmd_map wmi_10_2_cmd_map = {
         .force_fw_hang_cmdid = WMI_CMD_UNSUPPORTED,
         .gpio_config_cmdid = WMI_10_2_GPIO_CONFIG_CMDID,
         .gpio_output_cmdid = WMI_10_2_GPIO_OUTPUT_CMDID,
+        .pdev_get_temperature_cmdid = WMI_CMD_UNSUPPORTED,
 };
 
-static void
-ath10k_wmi_put_wmi_channel(struct wmi_channel *ch,
-                           const struct wmi_channel_arg *arg)
+void ath10k_wmi_put_wmi_channel(struct wmi_channel *ch,
+                                const struct wmi_channel_arg *arg)
 {
         u32 flags = 0;
 
@@ -685,8 +924,8 @@ static void ath10k_wmi_htc_tx_complete(struct ath10k *ar, struct sk_buff *skb)
         dev_kfree_skb(skb);
 }
 
-static int ath10k_wmi_cmd_send_nowait(struct ath10k *ar, struct sk_buff *skb,
-                                      u32 cmd_id)
+int ath10k_wmi_cmd_send_nowait(struct ath10k *ar, struct sk_buff *skb,
+                               u32 cmd_id)
 {
         struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(skb);
         struct wmi_cmd_hdr *cmd_hdr;
@@ -792,24 +1031,23 @@ int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id)
         return ret;
 }
 
-int ath10k_wmi_mgmt_tx(struct ath10k *ar, struct sk_buff *skb)
+static struct sk_buff *
+ath10k_wmi_op_gen_mgmt_tx(struct ath10k *ar, struct sk_buff *msdu)
 {
-        int ret = 0;
         struct wmi_mgmt_tx_cmd *cmd;
         struct ieee80211_hdr *hdr;
-        struct sk_buff *wmi_skb;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct sk_buff *skb;
         int len;
-        u32 buf_len = skb->len;
+        u32 buf_len = msdu->len;
         u16 fc;
 
-        hdr = (struct ieee80211_hdr *)skb->data;
+        hdr = (struct ieee80211_hdr *)msdu->data;
         fc = le16_to_cpu(hdr->frame_control);
 
         if (WARN_ON_ONCE(!ieee80211_is_mgmt(hdr->frame_control)))
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
 
-        len = sizeof(cmd->hdr) + skb->len;
+        len = sizeof(cmd->hdr) + msdu->len;
 
         if ((ieee80211_is_action(hdr->frame_control) ||
              ieee80211_is_deauth(hdr->frame_control) ||
@@ -821,36 +1059,27 @@ int ath10k_wmi_mgmt_tx(struct ath10k *ar, struct sk_buff *skb)
 
         len = round_up(len, 4);
 
-        wmi_skb = ath10k_wmi_alloc_skb(ar, len);
-        if (!wmi_skb)
-                return -ENOMEM;
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
 
-        cmd = (struct wmi_mgmt_tx_cmd *)wmi_skb->data;
+        cmd = (struct wmi_mgmt_tx_cmd *)skb->data;
 
-        cmd->hdr.vdev_id = __cpu_to_le32(ATH10K_SKB_CB(skb)->vdev_id);
+        cmd->hdr.vdev_id = __cpu_to_le32(ATH10K_SKB_CB(msdu)->vdev_id);
         cmd->hdr.tx_rate = 0;
         cmd->hdr.tx_power = 0;
         cmd->hdr.buf_len = __cpu_to_le32(buf_len);
 
         ether_addr_copy(cmd->hdr.peer_macaddr.addr, ieee80211_get_DA(hdr));
-        memcpy(cmd->buf, skb->data, skb->len);
+        memcpy(cmd->buf, msdu->data, msdu->len);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi mgmt tx skb %p len %d ftype %02x stype %02x\n",
-                   wmi_skb, wmi_skb->len, fc & IEEE80211_FCTL_FTYPE,
+                   msdu, skb->len, fc & IEEE80211_FCTL_FTYPE,
                    fc & IEEE80211_FCTL_STYPE);
         trace_ath10k_tx_hdr(ar, skb->data, skb->len);
         trace_ath10k_tx_payload(ar, skb->data, skb->len);
 
-        /* Send the management frame buffer to the target */
-        ret = ath10k_wmi_cmd_send(ar, wmi_skb, ar->wmi.cmd->mgmt_tx_cmdid);
-        if (ret)
-                return ret;
-
-        /* TODO: report tx status to mac80211 - temporary just ACK */
-        info->flags |= IEEE80211_TX_STAT_ACK;
-        ieee80211_tx_status_irqsafe(ar->hw, skb);
-
-        return ret;
+        return skb;
 }
 
 static void ath10k_wmi_event_scan_started(struct ath10k *ar)
@@ -977,22 +1206,48 @@ ath10k_wmi_event_scan_type_str(enum wmi_scan_event_type type,
         }
 }
 
-static int ath10k_wmi_event_scan(struct ath10k *ar, struct sk_buff *skb)
+static int ath10k_wmi_op_pull_scan_ev(struct ath10k *ar, struct sk_buff *skb,
+                                      struct wmi_scan_ev_arg *arg)
 {
-        struct wmi_scan_event *event = (struct wmi_scan_event *)skb->data;
+        struct wmi_scan_event *ev = (void *)skb->data;
+
+        if (skb->len < sizeof(*ev))
+                return -EPROTO;
+
+        skb_pull(skb, sizeof(*ev));
+        arg->event_type = ev->event_type;
+        arg->reason = ev->reason;
+        arg->channel_freq = ev->channel_freq;
+        arg->scan_req_id = ev->scan_req_id;
+        arg->scan_id = ev->scan_id;
+        arg->vdev_id = ev->vdev_id;
+
+        return 0;
+}
+
+int ath10k_wmi_event_scan(struct ath10k *ar, struct sk_buff *skb)
+{
+        struct wmi_scan_ev_arg arg = {};
         enum wmi_scan_event_type event_type;
         enum wmi_scan_completion_reason reason;
         u32 freq;
         u32 req_id;
         u32 scan_id;
         u32 vdev_id;
+        int ret;
 
-        event_type = __le32_to_cpu(event->event_type);
-        reason     = __le32_to_cpu(event->reason);
-        freq       = __le32_to_cpu(event->channel_freq);
-        req_id     = __le32_to_cpu(event->scan_req_id);
-        scan_id    = __le32_to_cpu(event->scan_id);
-        vdev_id    = __le32_to_cpu(event->vdev_id);
+        ret = ath10k_wmi_pull_scan(ar, skb, &arg);
+        if (ret) {
+                ath10k_warn(ar, "failed to parse scan event: %d\n", ret);
+                return ret;
+        }
+
+        event_type = __le32_to_cpu(arg.event_type);
+        reason = __le32_to_cpu(arg.reason);
+        freq = __le32_to_cpu(arg.channel_freq);
+        req_id = __le32_to_cpu(arg.scan_req_id);
+        scan_id = __le32_to_cpu(arg.scan_id);
+        vdev_id = __le32_to_cpu(arg.vdev_id);
 
         spin_lock_bh(&ar->data_lock);
 
@@ -1147,11 +1402,51 @@ static void ath10k_wmi_handle_wep_reauth(struct ath10k *ar,
         }
 }
 
-static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
+static int ath10k_wmi_op_pull_mgmt_rx_ev(struct ath10k *ar, struct sk_buff *skb,
+                                         struct wmi_mgmt_rx_ev_arg *arg)
 {
         struct wmi_mgmt_rx_event_v1 *ev_v1;
         struct wmi_mgmt_rx_event_v2 *ev_v2;
         struct wmi_mgmt_rx_hdr_v1 *ev_hdr;
+        size_t pull_len;
+        u32 msdu_len;
+
+        if (test_bit(ATH10K_FW_FEATURE_EXT_WMI_MGMT_RX, ar->fw_features)) {
+                ev_v2 = (struct wmi_mgmt_rx_event_v2 *)skb->data;
+                ev_hdr = &ev_v2->hdr.v1;
+                pull_len = sizeof(*ev_v2);
+        } else {
+                ev_v1 = (struct wmi_mgmt_rx_event_v1 *)skb->data;
+                ev_hdr = &ev_v1->hdr;
+                pull_len = sizeof(*ev_v1);
+        }
+
+        if (skb->len < pull_len)
+                return -EPROTO;
+
+        skb_pull(skb, pull_len);
+        arg->channel = ev_hdr->channel;
+        arg->buf_len = ev_hdr->buf_len;
+        arg->status = ev_hdr->status;
+        arg->snr = ev_hdr->snr;
+        arg->phy_mode = ev_hdr->phy_mode;
+        arg->rate = ev_hdr->rate;
+
+        msdu_len = __le32_to_cpu(arg->buf_len);
+        if (skb->len < msdu_len)
+                return -EPROTO;
+
+        /* the WMI buffer might've ended up being padded to 4 bytes due to HTC
+         * trailer with credit update. Trim the excess garbage.
+         */
+        skb_trim(skb, msdu_len);
+
+        return 0;
+}
+
+int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
+{
+        struct wmi_mgmt_rx_ev_arg arg = {};
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_hdr *hdr;
         u32 rx_status;
@@ -1161,24 +1456,20 @@ static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
         u32 rate;
         u32 buf_len;
         u16 fc;
-        int pull_len;
+        int ret;
 
-        if (test_bit(ATH10K_FW_FEATURE_EXT_WMI_MGMT_RX, ar->fw_features)) {
-                ev_v2 = (struct wmi_mgmt_rx_event_v2 *)skb->data;
-                ev_hdr = &ev_v2->hdr.v1;
-                pull_len = sizeof(*ev_v2);
-        } else {
-                ev_v1 = (struct wmi_mgmt_rx_event_v1 *)skb->data;
-                ev_hdr = &ev_v1->hdr;
-                pull_len = sizeof(*ev_v1);
+        ret = ath10k_wmi_pull_mgmt_rx(ar, skb, &arg);
+        if (ret) {
+                ath10k_warn(ar, "failed to parse mgmt rx event: %d\n", ret);
+                return ret;
         }
 
-        channel   = __le32_to_cpu(ev_hdr->channel);
-        buf_len   = __le32_to_cpu(ev_hdr->buf_len);
-        rx_status = __le32_to_cpu(ev_hdr->status);
-        snr       = __le32_to_cpu(ev_hdr->snr);
-        phy_mode  = __le32_to_cpu(ev_hdr->phy_mode);
-        rate      = __le32_to_cpu(ev_hdr->rate);
+        channel = __le32_to_cpu(arg.channel);
+        buf_len = __le32_to_cpu(arg.buf_len);
+        rx_status = __le32_to_cpu(arg.status);
+        snr = __le32_to_cpu(arg.snr);
+        phy_mode = __le32_to_cpu(arg.phy_mode);
+        rate = __le32_to_cpu(arg.rate);
 
         memset(status, 0, sizeof(*status));
 
@@ -1232,8 +1523,6 @@ static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
         status->signal = snr + ATH10K_DEFAULT_NOISE_FLOOR;
         status->rate_idx = get_rate_idx(rate, status->band);
 
-        skb_pull(skb, pull_len);
-
         hdr = (struct ieee80211_hdr *)skb->data;
         fc = le16_to_cpu(hdr->frame_control);
 
@@ -1266,12 +1555,6 @@ static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
                    status->freq, status->band, status->signal,
                    status->rate_idx);
 
-        /*
-         * packets from HTC come aligned to 4byte boundaries
-         * because they can originally come in along with a trailer
-         */
-        skb_trim(skb, buf_len);
-
         ieee80211_rx(ar->hw, skb);
         return 0;
 }
@@ -1295,21 +1578,44 @@ exit:
         return idx;
 }
 
-static void ath10k_wmi_event_chan_info(struct ath10k *ar, struct sk_buff *skb)
+static int ath10k_wmi_op_pull_ch_info_ev(struct ath10k *ar, struct sk_buff *skb,
+                                         struct wmi_ch_info_ev_arg *arg)
 {
-        struct wmi_chan_info_event *ev;
+        struct wmi_chan_info_event *ev = (void *)skb->data;
+
+        if (skb->len < sizeof(*ev))
+                return -EPROTO;
+
+        skb_pull(skb, sizeof(*ev));
+        arg->err_code = ev->err_code;
+        arg->freq = ev->freq;
+        arg->cmd_flags = ev->cmd_flags;
+        arg->noise_floor = ev->noise_floor;
+        arg->rx_clear_count = ev->rx_clear_count;
+        arg->cycle_count = ev->cycle_count;
+
+        return 0;
+}
+
+void ath10k_wmi_event_chan_info(struct ath10k *ar, struct sk_buff *skb)
+{
+        struct wmi_ch_info_ev_arg arg = {};
         struct survey_info *survey;
         u32 err_code, freq, cmd_flags, noise_floor, rx_clear_count, cycle_count;
-        int idx;
+        int idx, ret;
 
-        ev = (struct wmi_chan_info_event *)skb->data;
+        ret = ath10k_wmi_pull_ch_info(ar, skb, &arg);
+        if (ret) {
+                ath10k_warn(ar, "failed to parse chan info event: %d\n", ret);
+                return;
+        }
 
-        err_code = __le32_to_cpu(ev->err_code);
-        freq = __le32_to_cpu(ev->freq);
-        cmd_flags = __le32_to_cpu(ev->cmd_flags);
-        noise_floor = __le32_to_cpu(ev->noise_floor);
-        rx_clear_count = __le32_to_cpu(ev->rx_clear_count);
-        cycle_count = __le32_to_cpu(ev->cycle_count);
+        err_code = __le32_to_cpu(arg.err_code);
+        freq = __le32_to_cpu(arg.freq);
+        cmd_flags = __le32_to_cpu(arg.cmd_flags);
+        noise_floor = __le32_to_cpu(arg.noise_floor);
+        rx_clear_count = __le32_to_cpu(arg.rx_clear_count);
+        cycle_count = __le32_to_cpu(arg.cycle_count);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "chan info err_code %d freq %d cmd_flags %d noise_floor %d rx_clear_count %d cycle_count %d\n",
@@ -1359,12 +1665,12 @@ exit:
         spin_unlock_bh(&ar->data_lock);
 }
 
-static void ath10k_wmi_event_echo(struct ath10k *ar, struct sk_buff *skb)
+void ath10k_wmi_event_echo(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_ECHO_EVENTID\n");
 }
 
-static int ath10k_wmi_event_debug_mesg(struct ath10k *ar, struct sk_buff *skb)
+int ath10k_wmi_event_debug_mesg(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi event debug mesg len %d\n",
                    skb->len);
@@ -1374,8 +1680,8 @@ static int ath10k_wmi_event_debug_mesg(struct ath10k *ar, struct sk_buff *skb)
         return 0;
 }
 
-static void ath10k_wmi_pull_pdev_stats(const struct wmi_pdev_stats *src,
-                                       struct ath10k_fw_stats_pdev *dst)
+void ath10k_wmi_pull_pdev_stats(const struct wmi_pdev_stats *src,
+                                struct ath10k_fw_stats_pdev *dst)
 {
         const struct wal_dbg_tx_stats *tx = &src->wal.tx;
         const struct wal_dbg_rx_stats *rx = &src->wal.rx;
@@ -1427,17 +1733,17 @@ static void ath10k_wmi_pull_pdev_stats(const struct wmi_pdev_stats *src,
         dst->mpdu_errs = __le32_to_cpu(rx->mpdu_errs);
 }
 
-static void ath10k_wmi_pull_peer_stats(const struct wmi_peer_stats *src,
-                                       struct ath10k_fw_stats_peer *dst)
+void ath10k_wmi_pull_peer_stats(const struct wmi_peer_stats *src,
+                                struct ath10k_fw_stats_peer *dst)
 {
         ether_addr_copy(dst->peer_macaddr, src->peer_macaddr.addr);
         dst->peer_rssi = __le32_to_cpu(src->peer_rssi);
         dst->peer_tx_rate = __le32_to_cpu(src->peer_tx_rate);
 }
 
-static int ath10k_wmi_main_pull_fw_stats(struct ath10k *ar,
-                                         struct sk_buff *skb,
-                                         struct ath10k_fw_stats *stats)
+static int ath10k_wmi_main_op_pull_fw_stats(struct ath10k *ar,
+                                            struct sk_buff *skb,
+                                            struct ath10k_fw_stats *stats)
 {
         const struct wmi_stats_event *ev = (void *)skb->data;
         u32 num_pdev_stats, num_vdev_stats, num_peer_stats;
@@ -1487,9 +1793,9 @@ static int ath10k_wmi_main_pull_fw_stats(struct ath10k *ar,
         return 0;
 }
 
-static int ath10k_wmi_10x_pull_fw_stats(struct ath10k *ar,
-                                        struct sk_buff *skb,
-                                        struct ath10k_fw_stats *stats)
+static int ath10k_wmi_10x_op_pull_fw_stats(struct ath10k *ar,
+                                           struct sk_buff *skb,
+                                           struct ath10k_fw_stats *stats)
 {
         const struct wmi_stats_event *ev = (void *)skb->data;
         u32 num_pdev_stats, num_vdev_stats, num_peer_stats;
@@ -1550,61 +1856,92 @@ static int ath10k_wmi_10x_pull_fw_stats(struct ath10k *ar,
         return 0;
 }
 
-int ath10k_wmi_pull_fw_stats(struct ath10k *ar, struct sk_buff *skb,
-                             struct ath10k_fw_stats *stats)
+void ath10k_wmi_event_update_stats(struct ath10k *ar, struct sk_buff *skb)
 {
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features))
-                return ath10k_wmi_10x_pull_fw_stats(ar, skb, stats);
-        else
-                return ath10k_wmi_main_pull_fw_stats(ar, skb, stats);
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_UPDATE_STATS_EVENTID\n");
+        ath10k_debug_fw_stats_process(ar, skb);
 }
 
-static void ath10k_wmi_event_update_stats(struct ath10k *ar,
-                                          struct sk_buff *skb)
+static int
+ath10k_wmi_op_pull_vdev_start_ev(struct ath10k *ar, struct sk_buff *skb,
+                                 struct wmi_vdev_start_ev_arg *arg)
 {
-        ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_UPDATE_STATS_EVENTID\n");
-        ath10k_debug_fw_stats_process(ar, skb);
+        struct wmi_vdev_start_response_event *ev = (void *)skb->data;
+
+        if (skb->len < sizeof(*ev))
+                return -EPROTO;
+
+        skb_pull(skb, sizeof(*ev));
+        arg->vdev_id = ev->vdev_id;
+        arg->req_id = ev->req_id;
+        arg->resp_type = ev->resp_type;
+        arg->status = ev->status;
+
+        return 0;
 }
 
-static void ath10k_wmi_event_vdev_start_resp(struct ath10k *ar,
-                                             struct sk_buff *skb)
+void ath10k_wmi_event_vdev_start_resp(struct ath10k *ar, struct sk_buff *skb)
 {
-        struct wmi_vdev_start_response_event *ev;
+        struct wmi_vdev_start_ev_arg arg = {};
+        int ret;
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_VDEV_START_RESP_EVENTID\n");
 
-        ev = (struct wmi_vdev_start_response_event *)skb->data;
+        ret = ath10k_wmi_pull_vdev_start(ar, skb, &arg);
+        if (ret) {
+                ath10k_warn(ar, "failed to parse vdev start event: %d\n", ret);
+                return;
+        }
 
-        if (WARN_ON(__le32_to_cpu(ev->status)))
+        if (WARN_ON(__le32_to_cpu(arg.status)))
                 return;
 
         complete(&ar->vdev_setup_done);
 }
 
-static void ath10k_wmi_event_vdev_stopped(struct ath10k *ar,
-                                          struct sk_buff *skb)
+void ath10k_wmi_event_vdev_stopped(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_VDEV_STOPPED_EVENTID\n");
         complete(&ar->vdev_setup_done);
 }
 
-static void ath10k_wmi_event_peer_sta_kickout(struct ath10k *ar,
-                                              struct sk_buff *skb)
+static int
+ath10k_wmi_op_pull_peer_kick_ev(struct ath10k *ar, struct sk_buff *skb,
+                                struct wmi_peer_kick_ev_arg *arg)
 {
-        struct wmi_peer_sta_kickout_event *ev;
+        struct wmi_peer_sta_kickout_event *ev = (void *)skb->data;
+
+        if (skb->len < sizeof(*ev))
+                return -EPROTO;
+
+        skb_pull(skb, sizeof(*ev));
+        arg->mac_addr = ev->peer_macaddr.addr;
+
+        return 0;
+}
+
+void ath10k_wmi_event_peer_sta_kickout(struct ath10k *ar, struct sk_buff *skb)
+{
+        struct wmi_peer_kick_ev_arg arg = {};
         struct ieee80211_sta *sta;
+        int ret;
 
-        ev = (struct wmi_peer_sta_kickout_event *)skb->data;
+        ret = ath10k_wmi_pull_peer_kick(ar, skb, &arg);
+        if (ret) {
+                ath10k_warn(ar, "failed to parse peer kickout event: %d\n",
+                            ret);
+                return;
+        }
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi event peer sta kickout %pM\n",
-                   ev->peer_macaddr.addr);
+                   arg.mac_addr);
 
         rcu_read_lock();
 
-        sta = ieee80211_find_sta_by_ifaddr(ar->hw, ev->peer_macaddr.addr, NULL);
+        sta = ieee80211_find_sta_by_ifaddr(ar->hw, arg.mac_addr, NULL);
         if (!sta) {
                 ath10k_warn(ar, "Spurious quick kickout for STA %pM\n",
-                            ev->peer_macaddr.addr);
+                            arg.mac_addr);
                 goto exit;
         }
 
@@ -1641,7 +1978,7 @@ exit:
 static void ath10k_wmi_update_tim(struct ath10k *ar,
                                   struct ath10k_vif *arvif,
                                   struct sk_buff *bcn,
-                                  struct wmi_bcn_info *bcn_info)
+                                  const struct wmi_tim_info *tim_info)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)bcn->data;
         struct ieee80211_tim_ie *tim;
@@ -1652,14 +1989,14 @@ static void ath10k_wmi_update_tim(struct ath10k *ar,
 
         /* if next SWBA has no tim_changed the tim_bitmap is garbage.
          * we must copy the bitmap upon change and reuse it later */
-        if (__le32_to_cpu(bcn_info->tim_info.tim_changed)) {
+        if (__le32_to_cpu(tim_info->tim_changed)) {
                 int i;
 
                 BUILD_BUG_ON(sizeof(arvif->u.ap.tim_bitmap) !=
-                             sizeof(bcn_info->tim_info.tim_bitmap));
+                             sizeof(tim_info->tim_bitmap));
 
                 for (i = 0; i < sizeof(arvif->u.ap.tim_bitmap); i++) {
-                        t = bcn_info->tim_info.tim_bitmap[i / 4];
+                        t = tim_info->tim_bitmap[i / 4];
                         v = __le32_to_cpu(t);
                         arvif->u.ap.tim_bitmap[i] = (v >> ((i % 4) * 8)) & 0xFF;
                 }
@@ -1711,13 +2048,13 @@ static void ath10k_wmi_update_tim(struct ath10k *ar,
                 return;
         }
 
-        tim->bitmap_ctrl = !!__le32_to_cpu(bcn_info->tim_info.tim_mcast);
+        tim->bitmap_ctrl = !!__le32_to_cpu(tim_info->tim_mcast);
         memcpy(tim->virtual_map, arvif->u.ap.tim_bitmap, pvm_len);
 
         if (tim->dtim_count == 0) {
                 ATH10K_SKB_CB(bcn)->bcn.dtim_zero = true;
 
-                if (__le32_to_cpu(bcn_info->tim_info.tim_mcast) == 1)
+                if (__le32_to_cpu(tim_info->tim_mcast) == 1)
                         ATH10K_SKB_CB(bcn)->bcn.deliver_cab = true;
         }
 
@@ -1727,7 +2064,7 @@ static void ath10k_wmi_update_tim(struct ath10k *ar,
 }
 
 static void ath10k_p2p_fill_noa_ie(u8 *data, u32 len,
-                                   struct wmi_p2p_noa_info *noa)
+                                   const struct wmi_p2p_noa_info *noa)
 {
         struct ieee80211_p2p_noa_attr *noa_attr;
         u8  ctwindow_oppps = noa->ctwindow_oppps;
@@ -1769,7 +2106,7 @@ static void ath10k_p2p_fill_noa_ie(u8 *data, u32 len,
         *noa_attr_len = __cpu_to_le16(attr_len);
 }
 
-static u32 ath10k_p2p_calc_noa_ie_len(struct wmi_p2p_noa_info *noa)
+static u32 ath10k_p2p_calc_noa_ie_len(const struct wmi_p2p_noa_info *noa)
 {
         u32 len = 0;
         u8 noa_descriptors = noa->num_descriptors;
@@ -1789,9 +2126,8 @@ static u32 ath10k_p2p_calc_noa_ie_len(struct wmi_p2p_noa_info *noa)
 
 static void ath10k_wmi_update_noa(struct ath10k *ar, struct ath10k_vif *arvif,
                                   struct sk_buff *bcn,
-                                  struct wmi_bcn_info *bcn_info)
+                                  const struct wmi_p2p_noa_info *noa)
 {
-        struct wmi_p2p_noa_info *noa = &bcn_info->p2p_noa_info;
         u8 *new_data, *old_data = arvif->u.ap.noa_data;
         u32 new_len;
 
@@ -1832,22 +2168,59 @@ cleanup:
         kfree(old_data);
 }
 
-static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
+static int ath10k_wmi_op_pull_swba_ev(struct ath10k *ar, struct sk_buff *skb,
+                                      struct wmi_swba_ev_arg *arg)
+{
+        struct wmi_host_swba_event *ev = (void *)skb->data;
+        u32 map;
+        size_t i;
+
+        if (skb->len < sizeof(*ev))
+                return -EPROTO;
+
+        skb_pull(skb, sizeof(*ev));
+        arg->vdev_map = ev->vdev_map;
+
+        for (i = 0, map = __le32_to_cpu(ev->vdev_map); map; map >>= 1) {
+                if (!(map & BIT(0)))
+                        continue;
+
+                /* If this happens there were some changes in firmware and
+                 * ath10k should update the max size of tim_info array.
+                 */
+                if (WARN_ON_ONCE(i == ARRAY_SIZE(arg->tim_info)))
+                        break;
+
+                arg->tim_info[i] = &ev->bcn_info[i].tim_info;
+                arg->noa_info[i] = &ev->bcn_info[i].p2p_noa_info;
+                i++;
+        }
+
+        return 0;
+}
+
+void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
 {
-        struct wmi_host_swba_event *ev;
+        struct wmi_swba_ev_arg arg = {};
         u32 map;
         int i = -1;
-        struct wmi_bcn_info *bcn_info;
+        const struct wmi_tim_info *tim_info;
+        const struct wmi_p2p_noa_info *noa_info;
         struct ath10k_vif *arvif;
         struct sk_buff *bcn;
         dma_addr_t paddr;
         int ret, vdev_id = 0;
 
-        ev = (struct wmi_host_swba_event *)skb->data;
-        map = __le32_to_cpu(ev->vdev_map);
+        ret = ath10k_wmi_pull_swba(ar, skb, &arg);
+        if (ret) {
+                ath10k_warn(ar, "failed to parse swba event: %d\n", ret);
+                return;
+        }
+
+        map = __le32_to_cpu(arg.vdev_map);
 
         ath10k_dbg(ar, ATH10K_DBG_MGMT, "mgmt swba vdev_map 0x%x\n",
-                   ev->vdev_map);
+                   map);
 
         for (; map; map >>= 1, vdev_id++) {
                 if (!(map & 0x1))
@@ -1860,19 +2233,20 @@ static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
                         break;
                 }
 
-                bcn_info = &ev->bcn_info[i];
+                tim_info = arg.tim_info[i];
+                noa_info = arg.noa_info[i];
 
                 ath10k_dbg(ar, ATH10K_DBG_MGMT,
                            "mgmt event bcn_info %d tim_len %d mcast %d changed %d num_ps_pending %d bitmap 0x%08x%08x%08x%08x\n",
                            i,
-                           __le32_to_cpu(bcn_info->tim_info.tim_len),
-                           __le32_to_cpu(bcn_info->tim_info.tim_mcast),
-                           __le32_to_cpu(bcn_info->tim_info.tim_changed),
-                           __le32_to_cpu(bcn_info->tim_info.tim_num_ps_pending),
-                           __le32_to_cpu(bcn_info->tim_info.tim_bitmap[3]),
-                           __le32_to_cpu(bcn_info->tim_info.tim_bitmap[2]),
-                           __le32_to_cpu(bcn_info->tim_info.tim_bitmap[1]),
-                           __le32_to_cpu(bcn_info->tim_info.tim_bitmap[0]));
+                           __le32_to_cpu(tim_info->tim_len),
+                           __le32_to_cpu(tim_info->tim_mcast),
+                           __le32_to_cpu(tim_info->tim_changed),
+                           __le32_to_cpu(tim_info->tim_num_ps_pending),
+                           __le32_to_cpu(tim_info->tim_bitmap[3]),
+                           __le32_to_cpu(tim_info->tim_bitmap[2]),
+                           __le32_to_cpu(tim_info->tim_bitmap[1]),
+                           __le32_to_cpu(tim_info->tim_bitmap[0]));
 
                 arvif = ath10k_get_arvif(ar, vdev_id);
                 if (arvif == NULL) {
@@ -1899,8 +2273,8 @@ static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
                 }
 
                 ath10k_tx_h_seq_no(arvif->vif, bcn);
-                ath10k_wmi_update_tim(ar, arvif, bcn, bcn_info);
-                ath10k_wmi_update_noa(ar, arvif, bcn, bcn_info);
+                ath10k_wmi_update_tim(ar, arvif, bcn, tim_info);
+                ath10k_wmi_update_noa(ar, arvif, bcn, noa_info);
 
                 spin_lock_bh(&ar->data_lock);
 
@@ -1946,8 +2320,7 @@ skip:
         }
 }
 
-static void ath10k_wmi_event_tbttoffset_update(struct ath10k *ar,
-                                               struct sk_buff *skb)
+void ath10k_wmi_event_tbttoffset_update(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_TBTTOFFSET_UPDATE_EVENTID\n");
 }
@@ -2068,9 +2441,9 @@ static int ath10k_dfs_fft_report(struct ath10k *ar,
         return 0;
 }
 
-static void ath10k_wmi_event_dfs(struct ath10k *ar,
-                                 const struct wmi_phyerr *phyerr,
-                                 u64 tsf)
+void ath10k_wmi_event_dfs(struct ath10k *ar,
+                          const struct wmi_phyerr *phyerr,
+                          u64 tsf)
 {
         int buf_len, tlv_len, res, i = 0;
         const struct phyerr_tlv *tlv;
@@ -2133,10 +2506,9 @@ static void ath10k_wmi_event_dfs(struct ath10k *ar,
         }
 }
 
-static void
-ath10k_wmi_event_spectral_scan(struct ath10k *ar,
-                               const struct wmi_phyerr *phyerr,
-                               u64 tsf)
+void ath10k_wmi_event_spectral_scan(struct ath10k *ar,
+                                    const struct wmi_phyerr *phyerr,
+                                    u64 tsf)
 {
         int buf_len, tlv_len, res, i = 0;
         struct phyerr_tlv *tlv;
@@ -2188,37 +2560,53 @@ ath10k_wmi_event_spectral_scan(struct ath10k *ar,
         }
 }
 
-static void ath10k_wmi_event_phyerr(struct ath10k *ar, struct sk_buff *skb)
+static int ath10k_wmi_op_pull_phyerr_ev(struct ath10k *ar, struct sk_buff *skb,
+                                        struct wmi_phyerr_ev_arg *arg)
+{
+        struct wmi_phyerr_event *ev = (void *)skb->data;
+
+        if (skb->len < sizeof(*ev))
+                return -EPROTO;
+
+        arg->num_phyerrs = ev->num_phyerrs;
+        arg->tsf_l32 = ev->tsf_l32;
+        arg->tsf_u32 = ev->tsf_u32;
+        arg->buf_len = __cpu_to_le32(skb->len - sizeof(*ev));
+        arg->phyerrs = ev->phyerrs;
+
+        return 0;
+}
+
+void ath10k_wmi_event_phyerr(struct ath10k *ar, struct sk_buff *skb)
 {
-        const struct wmi_phyerr_event *ev;
+        struct wmi_phyerr_ev_arg arg = {};
         const struct wmi_phyerr *phyerr;
         u32 count, i, buf_len, phy_err_code;
         u64 tsf;
-        int left_len = skb->len;
+        int left_len, ret;
 
         ATH10K_DFS_STAT_INC(ar, phy_errors);
 
-        /* Check if combined event available */
-        if (left_len < sizeof(*ev)) {
-                ath10k_warn(ar, "wmi phyerr combined event wrong len\n");
+        ret = ath10k_wmi_pull_phyerr(ar, skb, &arg);
+        if (ret) {
+                ath10k_warn(ar, "failed to parse phyerr event: %d\n", ret);
                 return;
         }
 
-        left_len -= sizeof(*ev);
+        left_len = __le32_to_cpu(arg.buf_len);
 
         /* Check number of included events */
-        ev = (const struct wmi_phyerr_event *)skb->data;
-        count = __le32_to_cpu(ev->num_phyerrs);
+        count = __le32_to_cpu(arg.num_phyerrs);
 
-        tsf = __le32_to_cpu(ev->tsf_u32);
+        tsf = __le32_to_cpu(arg.tsf_u32);
         tsf <<= 32;
-        tsf |= __le32_to_cpu(ev->tsf_l32);
+        tsf |= __le32_to_cpu(arg.tsf_l32);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi event phyerr count %d tsf64 0x%llX\n",
                    count, tsf);
 
-        phyerr = ev->phyerrs;
+        phyerr = arg.phyerrs;
         for (i = 0; i < count; i++) {
                 /* Check if we can read event header */
                 if (left_len < sizeof(*phyerr)) {
@@ -2258,19 +2646,17 @@ static void ath10k_wmi_event_phyerr(struct ath10k *ar, struct sk_buff *skb)
         }
 }
 
-static void ath10k_wmi_event_roam(struct ath10k *ar, struct sk_buff *skb)
+void ath10k_wmi_event_roam(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_ROAM_EVENTID\n");
 }
 
-static void ath10k_wmi_event_profile_match(struct ath10k *ar,
-                                           struct sk_buff *skb)
+void ath10k_wmi_event_profile_match(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_PROFILE_MATCH\n");
 }
 
-static void ath10k_wmi_event_debug_print(struct ath10k *ar,
-                                         struct sk_buff *skb)
+void ath10k_wmi_event_debug_print(struct ath10k *ar, struct sk_buff *skb)
 {
         char buf[101], c;
         int i;
@@ -2303,103 +2689,90 @@ static void ath10k_wmi_event_debug_print(struct ath10k *ar,
         ath10k_dbg(ar, ATH10K_DBG_WMI_PRINT, "wmi print '%s'\n", buf);
 }
 
-static void ath10k_wmi_event_pdev_qvit(struct ath10k *ar, struct sk_buff *skb)
+void ath10k_wmi_event_pdev_qvit(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_PDEV_QVIT_EVENTID\n");
 }
 
-static void ath10k_wmi_event_wlan_profile_data(struct ath10k *ar,
-                                               struct sk_buff *skb)
+void ath10k_wmi_event_wlan_profile_data(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_WLAN_PROFILE_DATA_EVENTID\n");
 }
 
-static void ath10k_wmi_event_rtt_measurement_report(struct ath10k *ar,
-                                                    struct sk_buff *skb)
+void ath10k_wmi_event_rtt_measurement_report(struct ath10k *ar,
+                                             struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_RTT_MEASUREMENT_REPORT_EVENTID\n");
 }
 
-static void ath10k_wmi_event_tsf_measurement_report(struct ath10k *ar,
-                                                    struct sk_buff *skb)
+void ath10k_wmi_event_tsf_measurement_report(struct ath10k *ar,
+                                             struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_TSF_MEASUREMENT_REPORT_EVENTID\n");
 }
 
-static void ath10k_wmi_event_rtt_error_report(struct ath10k *ar,
-                                              struct sk_buff *skb)
+void ath10k_wmi_event_rtt_error_report(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_RTT_ERROR_REPORT_EVENTID\n");
 }
 
-static void ath10k_wmi_event_wow_wakeup_host(struct ath10k *ar,
-                                             struct sk_buff *skb)
+void ath10k_wmi_event_wow_wakeup_host(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_WOW_WAKEUP_HOST_EVENTID\n");
 }
 
-static void ath10k_wmi_event_dcs_interference(struct ath10k *ar,
-                                              struct sk_buff *skb)
+void ath10k_wmi_event_dcs_interference(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_DCS_INTERFERENCE_EVENTID\n");
 }
 
-static void ath10k_wmi_event_pdev_tpc_config(struct ath10k *ar,
-                                             struct sk_buff *skb)
+void ath10k_wmi_event_pdev_tpc_config(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_PDEV_TPC_CONFIG_EVENTID\n");
 }
 
-static void ath10k_wmi_event_pdev_ftm_intg(struct ath10k *ar,
-                                           struct sk_buff *skb)
+void ath10k_wmi_event_pdev_ftm_intg(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_PDEV_FTM_INTG_EVENTID\n");
 }
 
-static void ath10k_wmi_event_gtk_offload_status(struct ath10k *ar,
-                                                struct sk_buff *skb)
+void ath10k_wmi_event_gtk_offload_status(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_GTK_OFFLOAD_STATUS_EVENTID\n");
 }
 
-static void ath10k_wmi_event_gtk_rekey_fail(struct ath10k *ar,
-                                            struct sk_buff *skb)
+void ath10k_wmi_event_gtk_rekey_fail(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_GTK_REKEY_FAIL_EVENTID\n");
 }
 
-static void ath10k_wmi_event_delba_complete(struct ath10k *ar,
-                                            struct sk_buff *skb)
+void ath10k_wmi_event_delba_complete(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_TX_DELBA_COMPLETE_EVENTID\n");
 }
 
-static void ath10k_wmi_event_addba_complete(struct ath10k *ar,
-                                            struct sk_buff *skb)
+void ath10k_wmi_event_addba_complete(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_TX_ADDBA_COMPLETE_EVENTID\n");
 }
 
-static void ath10k_wmi_event_vdev_install_key_complete(struct ath10k *ar,
-                                                       struct sk_buff *skb)
+void ath10k_wmi_event_vdev_install_key_complete(struct ath10k *ar,
+                                                struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_VDEV_INSTALL_KEY_COMPLETE_EVENTID\n");
 }
 
-static void ath10k_wmi_event_inst_rssi_stats(struct ath10k *ar,
-                                             struct sk_buff *skb)
+void ath10k_wmi_event_inst_rssi_stats(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_INST_RSSI_STATS_EVENTID\n");
 }
 
-static void ath10k_wmi_event_vdev_standby_req(struct ath10k *ar,
-                                              struct sk_buff *skb)
+void ath10k_wmi_event_vdev_standby_req(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_VDEV_STANDBY_REQ_EVENTID\n");
 }
 
-static void ath10k_wmi_event_vdev_resume_req(struct ath10k *ar,
-                                             struct sk_buff *skb)
+void ath10k_wmi_event_vdev_resume_req(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_VDEV_RESUME_REQ_EVENTID\n");
 }
@@ -2435,8 +2808,9 @@ static int ath10k_wmi_alloc_host_mem(struct ath10k *ar, u32 req_id,
         return 0;
 }
 
-static int ath10k_wmi_main_pull_svc_rdy_ev(struct sk_buff *skb,
-                                           struct wmi_svc_rdy_ev_arg *arg)
+static int
+ath10k_wmi_main_op_pull_svc_rdy_ev(struct ath10k *ar, struct sk_buff *skb,
+                                   struct wmi_svc_rdy_ev_arg *arg)
 {
         struct wmi_service_ready_event *ev;
         size_t i, n;
@@ -2471,8 +2845,9 @@ static int ath10k_wmi_main_pull_svc_rdy_ev(struct sk_buff *skb,
         return 0;
 }
 
-static int ath10k_wmi_10x_pull_svc_rdy_ev(struct sk_buff *skb,
-                                          struct wmi_svc_rdy_ev_arg *arg)
+static int
+ath10k_wmi_10x_op_pull_svc_rdy_ev(struct ath10k *ar, struct sk_buff *skb,
+                                  struct wmi_svc_rdy_ev_arg *arg)
 {
         struct wmi_10x_service_ready_event *ev;
         int i, n;
@@ -2506,30 +2881,22 @@ static int ath10k_wmi_10x_pull_svc_rdy_ev(struct sk_buff *skb,
         return 0;
 }
 
-static void ath10k_wmi_event_service_ready(struct ath10k *ar,
-                                           struct sk_buff *skb)
+void ath10k_wmi_event_service_ready(struct ath10k *ar, struct sk_buff *skb)
 {
         struct wmi_svc_rdy_ev_arg arg = {};
         u32 num_units, req_id, unit_size, num_mem_reqs, num_unit_info, i;
         int ret;
 
-        memset(&ar->wmi.svc_map, 0, sizeof(ar->wmi.svc_map));
-
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                ret = ath10k_wmi_10x_pull_svc_rdy_ev(skb, &arg);
-                wmi_10x_svc_map(arg.service_map, ar->wmi.svc_map,
-                                arg.service_map_len);
-        } else {
-                ret = ath10k_wmi_main_pull_svc_rdy_ev(skb, &arg);
-                wmi_main_svc_map(arg.service_map, ar->wmi.svc_map,
-                                 arg.service_map_len);
-        }
-
+        ret = ath10k_wmi_pull_svc_rdy(ar, skb, &arg);
         if (ret) {
                 ath10k_warn(ar, "failed to parse service ready: %d\n", ret);
                 return;
         }
 
+        memset(&ar->wmi.svc_map, 0, sizeof(ar->wmi.svc_map));
+        ath10k_wmi_map_svc(ar, arg.service_map, ar->wmi.svc_map,
+                           arg.service_map_len);
+
         ar->hw_min_tx_power = __le32_to_cpu(arg.min_tx_power);
         ar->hw_max_tx_power = __le32_to_cpu(arg.max_tx_power);
         ar->ht_cap_info = __le32_to_cpu(arg.ht_cap);
@@ -2607,13 +2974,14 @@ static void ath10k_wmi_event_service_ready(struct ath10k *ar,
         }
 
         ath10k_dbg(ar, ATH10K_DBG_WMI,
-                   "wmi event service ready min_tx_power 0x%08x max_tx_power 0x%08x ht_cap 0x%08x vht_cap 0x%08x sw_ver0 0x%08x sw_ver1 0x%08x phy_capab 0x%08x num_rf_chains 0x%08x eeprom_rd 0x%08x num_mem_reqs 0x%08x\n",
+                   "wmi event service ready min_tx_power 0x%08x max_tx_power 0x%08x ht_cap 0x%08x vht_cap 0x%08x sw_ver0 0x%08x sw_ver1 0x%08x fw_build 0x%08x phy_capab 0x%08x num_rf_chains 0x%08x eeprom_rd 0x%08x num_mem_reqs 0x%08x\n",
                    __le32_to_cpu(arg.min_tx_power),
                    __le32_to_cpu(arg.max_tx_power),
                    __le32_to_cpu(arg.ht_cap),
                    __le32_to_cpu(arg.vht_cap),
                    __le32_to_cpu(arg.sw_ver0),
                    __le32_to_cpu(arg.sw_ver1),
+                   __le32_to_cpu(arg.fw_build),
                    __le32_to_cpu(arg.phy_capab),
                    __le32_to_cpu(arg.num_rf_chains),
                    __le32_to_cpu(arg.eeprom_rd),
@@ -2622,27 +2990,59 @@ static void ath10k_wmi_event_service_ready(struct ath10k *ar,
         complete(&ar->wmi.service_ready);
 }
 
-static int ath10k_wmi_event_ready(struct ath10k *ar, struct sk_buff *skb)
+static int ath10k_wmi_op_pull_rdy_ev(struct ath10k *ar, struct sk_buff *skb,
+                                     struct wmi_rdy_ev_arg *arg)
 {
-        struct wmi_ready_event *ev = (struct wmi_ready_event *)skb->data;
+        struct wmi_ready_event *ev = (void *)skb->data;
 
-        if (WARN_ON(skb->len < sizeof(*ev)))
-                return -EINVAL;
+        if (skb->len < sizeof(*ev))
+                return -EPROTO;
+
+        skb_pull(skb, sizeof(*ev));
+        arg->sw_version = ev->sw_version;
+        arg->abi_version = ev->abi_version;
+        arg->status = ev->status;
+        arg->mac_addr = ev->mac_addr.addr;
 
-        ether_addr_copy(ar->mac_addr, ev->mac_addr.addr);
+        return 0;
+}
+
+int ath10k_wmi_event_ready(struct ath10k *ar, struct sk_buff *skb)
+{
+        struct wmi_rdy_ev_arg arg = {};
+        int ret;
+
+        ret = ath10k_wmi_pull_rdy(ar, skb, &arg);
+        if (ret) {
+                ath10k_warn(ar, "failed to parse ready event: %d\n", ret);
+                return ret;
+        }
 
         ath10k_dbg(ar, ATH10K_DBG_WMI,
-                   "wmi event ready sw_version %u abi_version %u mac_addr %pM status %d skb->len %i ev-sz %zu\n",
-                   __le32_to_cpu(ev->sw_version),
-                   __le32_to_cpu(ev->abi_version),
-                   ev->mac_addr.addr,
-                   __le32_to_cpu(ev->status), skb->len, sizeof(*ev));
+                   "wmi event ready sw_version %u abi_version %u mac_addr %pM status %d\n",
+                   __le32_to_cpu(arg.sw_version),
+                   __le32_to_cpu(arg.abi_version),
+                   arg.mac_addr,
+                   __le32_to_cpu(arg.status));
 
+        ether_addr_copy(ar->mac_addr, arg.mac_addr);
         complete(&ar->wmi.unified_ready);
         return 0;
 }
 
-static void ath10k_wmi_main_process_rx(struct ath10k *ar, struct sk_buff *skb)
+static int ath10k_wmi_event_temperature(struct ath10k *ar, struct sk_buff *skb)
+{
+        const struct wmi_pdev_temperature_event *ev;
+
+        ev = (struct wmi_pdev_temperature_event *)skb->data;
+        if (WARN_ON(skb->len < sizeof(*ev)))
+                return -EPROTO;
+
+        ath10k_thermal_event_temperature(ar, __le32_to_cpu(ev->temperature));
+        return 0;
+}
+
+static void ath10k_wmi_op_rx(struct ath10k *ar, struct sk_buff *skb)
 {
         struct wmi_cmd_hdr *cmd_hdr;
         enum wmi_event_id id;
@@ -2758,7 +3158,7 @@ static void ath10k_wmi_main_process_rx(struct ath10k *ar, struct sk_buff *skb)
         dev_kfree_skb(skb);
 }
 
-static void ath10k_wmi_10x_process_rx(struct ath10k *ar, struct sk_buff *skb)
+static void ath10k_wmi_10_1_op_rx(struct ath10k *ar, struct sk_buff *skb)
 {
         struct wmi_cmd_hdr *cmd_hdr;
         enum wmi_10x_event_id id;
@@ -2882,7 +3282,7 @@ out:
         dev_kfree_skb(skb);
 }
 
-static void ath10k_wmi_10_2_process_rx(struct ath10k *ar, struct sk_buff *skb)
+static void ath10k_wmi_10_2_op_rx(struct ath10k *ar, struct sk_buff *skb)
 {
         struct wmi_cmd_hdr *cmd_hdr;
         enum wmi_10_2_event_id id;
@@ -2981,6 +3381,9 @@ static void ath10k_wmi_10_2_process_rx(struct ath10k *ar, struct sk_buff *skb)
         case WMI_10_2_READY_EVENTID:
                 ath10k_wmi_event_ready(ar, skb);
                 break;
+        case WMI_10_2_PDEV_TEMPERATURE_EVENTID:
+                ath10k_wmi_event_temperature(ar, skb);
+                break;
         case WMI_10_2_RTT_KEEPALIVE_EVENTID:
         case WMI_10_2_GPIO_INPUT_EVENTID:
         case WMI_10_2_PEER_RATECODE_LIST_EVENTID:
@@ -3001,14 +3404,11 @@ static void ath10k_wmi_10_2_process_rx(struct ath10k *ar, struct sk_buff *skb)
 
 static void ath10k_wmi_process_rx(struct ath10k *ar, struct sk_buff *skb)
 {
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                if (test_bit(ATH10K_FW_FEATURE_WMI_10_2, ar->fw_features))
-                        ath10k_wmi_10_2_process_rx(ar, skb);
-                else
-                        ath10k_wmi_10x_process_rx(ar, skb);
-        } else {
-                ath10k_wmi_main_process_rx(ar, skb);
-        }
+        int ret;
+
+        ret = ath10k_wmi_rx(ar, skb);
+        if (ret)
+                ath10k_warn(ar, "failed to process wmi rx: %d\n", ret);
 }
 
 int ath10k_wmi_connect(struct ath10k *ar)
@@ -3039,16 +3439,17 @@ int ath10k_wmi_connect(struct ath10k *ar)
         return 0;
 }
 
-static int ath10k_wmi_main_pdev_set_regdomain(struct ath10k *ar, u16 rd,
-                                              u16 rd2g, u16 rd5g, u16 ctl2g,
-                                              u16 ctl5g)
+static struct sk_buff *
+ath10k_wmi_op_gen_pdev_set_rd(struct ath10k *ar, u16 rd, u16 rd2g, u16 rd5g,
+                              u16 ctl2g, u16 ctl5g,
+                              enum wmi_dfs_region dfs_reg)
 {
         struct wmi_pdev_set_regdomain_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_pdev_set_regdomain_cmd *)skb->data;
         cmd->reg_domain = __cpu_to_le32(rd);
@@ -3060,22 +3461,20 @@ static int ath10k_wmi_main_pdev_set_regdomain(struct ath10k *ar, u16 rd,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi pdev regdomain rd %x rd2g %x rd5g %x ctl2g %x ctl5g %x\n",
                    rd, rd2g, rd5g, ctl2g, ctl5g);
-
-        return ath10k_wmi_cmd_send(ar, skb,
-                                   ar->wmi.cmd->pdev_set_regdomain_cmdid);
+        return skb;
 }
 
-static int ath10k_wmi_10x_pdev_set_regdomain(struct ath10k *ar, u16 rd,
-                                             u16 rd2g, u16 rd5g,
-                                             u16 ctl2g, u16 ctl5g,
-                                             enum wmi_dfs_region dfs_reg)
+static struct sk_buff *
+ath10k_wmi_10x_op_gen_pdev_set_rd(struct ath10k *ar, u16 rd, u16 rd2g, u16
+                                  rd5g, u16 ctl2g, u16 ctl5g,
+                                  enum wmi_dfs_region dfs_reg)
 {
         struct wmi_pdev_set_regdomain_cmd_10x *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_pdev_set_regdomain_cmd_10x *)skb->data;
         cmd->reg_domain = __cpu_to_le32(rd);
@@ -3088,50 +3487,39 @@ static int ath10k_wmi_10x_pdev_set_regdomain(struct ath10k *ar, u16 rd,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi pdev regdomain rd %x rd2g %x rd5g %x ctl2g %x ctl5g %x dfs_region %x\n",
                    rd, rd2g, rd5g, ctl2g, ctl5g, dfs_reg);
-
-        return ath10k_wmi_cmd_send(ar, skb,
-                                   ar->wmi.cmd->pdev_set_regdomain_cmdid);
-}
-
-int ath10k_wmi_pdev_set_regdomain(struct ath10k *ar, u16 rd, u16 rd2g,
-                                  u16 rd5g, u16 ctl2g, u16 ctl5g,
-                                  enum wmi_dfs_region dfs_reg)
-{
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features))
-                return ath10k_wmi_10x_pdev_set_regdomain(ar, rd, rd2g, rd5g,
-                                                        ctl2g, ctl5g, dfs_reg);
-        else
-                return ath10k_wmi_main_pdev_set_regdomain(ar, rd, rd2g, rd5g,
-                                                         ctl2g, ctl5g);
+        return skb;
 }
 
-int ath10k_wmi_pdev_suspend_target(struct ath10k *ar, u32 suspend_opt)
+static struct sk_buff *
+ath10k_wmi_op_gen_pdev_suspend(struct ath10k *ar, u32 suspend_opt)
 {
         struct wmi_pdev_suspend_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_pdev_suspend_cmd *)skb->data;
         cmd->suspend_opt = __cpu_to_le32(suspend_opt);
 
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->pdev_suspend_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_pdev_resume_target(struct ath10k *ar)
+static struct sk_buff *
+ath10k_wmi_op_gen_pdev_resume(struct ath10k *ar)
 {
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, 0);
-        if (skb == NULL)
-                return -ENOMEM;
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
 
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->pdev_resume_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_pdev_set_param(struct ath10k *ar, u32 id, u32 value)
+static struct sk_buff *
+ath10k_wmi_op_gen_pdev_set_param(struct ath10k *ar, u32 id, u32 value)
 {
         struct wmi_pdev_set_param_cmd *cmd;
         struct sk_buff *skb;
@@ -3139,12 +3527,12 @@ int ath10k_wmi_pdev_set_param(struct ath10k *ar, u32 id, u32 value)
         if (id == WMI_PDEV_PARAM_UNSUPPORTED) {
                 ath10k_warn(ar, "pdev param %d not supported by firmware\n",
                             id);
-                return -EOPNOTSUPP;
+                return ERR_PTR(-EOPNOTSUPP);
         }
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_pdev_set_param_cmd *)skb->data;
         cmd->param_id    = __cpu_to_le32(id);
@@ -3152,11 +3540,11 @@ int ath10k_wmi_pdev_set_param(struct ath10k *ar, u32 id, u32 value)
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi pdev set param %d value %d\n",
                    id, value);
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->pdev_set_param_cmdid);
+        return skb;
 }
 
-static void ath10k_wmi_put_host_mem_chunks(struct ath10k *ar,
-                                           struct wmi_host_mem_chunks *chunks)
+void ath10k_wmi_put_host_mem_chunks(struct ath10k *ar,
+                                    struct wmi_host_mem_chunks *chunks)
 {
         struct host_memory_chunk *chunk;
         int i;
@@ -3177,7 +3565,7 @@ static void ath10k_wmi_put_host_mem_chunks(struct ath10k *ar,
         }
 }
 
-static int ath10k_wmi_main_cmd_init(struct ath10k *ar)
+static struct sk_buff *ath10k_wmi_op_gen_init(struct ath10k *ar)
 {
         struct wmi_init_cmd *cmd;
         struct sk_buff *buf;
@@ -3240,7 +3628,7 @@ static int ath10k_wmi_main_cmd_init(struct ath10k *ar)
 
         buf = ath10k_wmi_alloc_skb(ar, len);
         if (!buf)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_init_cmd *)buf->data;
 
@@ -3248,10 +3636,10 @@ static int ath10k_wmi_main_cmd_init(struct ath10k *ar)
         ath10k_wmi_put_host_mem_chunks(ar, &cmd->mem_chunks);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi init\n");
-        return ath10k_wmi_cmd_send(ar, buf, ar->wmi.cmd->init_cmdid);
+        return buf;
 }
 
-static int ath10k_wmi_10x_cmd_init(struct ath10k *ar)
+static struct sk_buff *ath10k_wmi_10_1_op_gen_init(struct ath10k *ar)
 {
         struct wmi_init_cmd_10x *cmd;
         struct sk_buff *buf;
@@ -3306,7 +3694,7 @@ static int ath10k_wmi_10x_cmd_init(struct ath10k *ar)
 
         buf = ath10k_wmi_alloc_skb(ar, len);
         if (!buf)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_init_cmd_10x *)buf->data;
 
@@ -3314,10 +3702,10 @@ static int ath10k_wmi_10x_cmd_init(struct ath10k *ar)
         ath10k_wmi_put_host_mem_chunks(ar, &cmd->mem_chunks);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi init 10x\n");
-        return ath10k_wmi_cmd_send(ar, buf, ar->wmi.cmd->init_cmdid);
+        return buf;
 }
 
-static int ath10k_wmi_10_2_cmd_init(struct ath10k *ar)
+static struct sk_buff *ath10k_wmi_10_2_op_gen_init(struct ath10k *ar)
 {
         struct wmi_init_cmd_10_2 *cmd;
         struct sk_buff *buf;
@@ -3372,7 +3760,7 @@ static int ath10k_wmi_10_2_cmd_init(struct ath10k *ar)
 
         buf = ath10k_wmi_alloc_skb(ar, len);
         if (!buf)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_init_cmd_10_2 *)buf->data;
 
@@ -3380,26 +3768,10 @@ static int ath10k_wmi_10_2_cmd_init(struct ath10k *ar)
         ath10k_wmi_put_host_mem_chunks(ar, &cmd->mem_chunks);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi init 10.2\n");
-        return ath10k_wmi_cmd_send(ar, buf, ar->wmi.cmd->init_cmdid);
+        return buf;
 }
 
-int ath10k_wmi_cmd_init(struct ath10k *ar)
-{
-        int ret;
-
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                if (test_bit(ATH10K_FW_FEATURE_WMI_10_2, ar->fw_features))
-                        ret = ath10k_wmi_10_2_cmd_init(ar);
-                else
-                        ret = ath10k_wmi_10x_cmd_init(ar);
-        } else {
-                ret = ath10k_wmi_main_cmd_init(ar);
-        }
-
-        return ret;
-}
-
-static int ath10k_wmi_start_scan_verify(const struct wmi_start_scan_arg *arg)
+int ath10k_wmi_start_scan_verify(const struct wmi_start_scan_arg *arg)
 {
         if (arg->ie_len && !arg->ie)
                 return -EINVAL;
@@ -3450,9 +3822,8 @@ ath10k_wmi_start_scan_tlvs_len(const struct wmi_start_scan_arg *arg)
         return len;
 }
 
-static void
-ath10k_wmi_put_start_scan_common(struct wmi_start_scan_common *cmn,
-                                 const struct wmi_start_scan_arg *arg)
+void ath10k_wmi_put_start_scan_common(struct wmi_start_scan_common *cmn,
+                                      const struct wmi_start_scan_arg *arg)
 {
         u32 scan_id;
         u32 scan_req_id;
@@ -3546,46 +3917,60 @@ ath10k_wmi_put_start_scan_tlvs(struct wmi_start_scan_tlvs *tlvs,
         }
 }
 
-int ath10k_wmi_start_scan(struct ath10k *ar,
-                          const struct wmi_start_scan_arg *arg)
+static struct sk_buff *
+ath10k_wmi_op_gen_start_scan(struct ath10k *ar,
+                             const struct wmi_start_scan_arg *arg)
 {
+        struct wmi_start_scan_cmd *cmd;
         struct sk_buff *skb;
         size_t len;
         int ret;
 
         ret = ath10k_wmi_start_scan_verify(arg);
         if (ret)
-                return ret;
-
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features))
-                len = sizeof(struct wmi_10x_start_scan_cmd) +
-                      ath10k_wmi_start_scan_tlvs_len(arg);
-        else
-                len = sizeof(struct wmi_start_scan_cmd) +
-                      ath10k_wmi_start_scan_tlvs_len(arg);
+                return ERR_PTR(ret);
 
+        len = sizeof(*cmd) + ath10k_wmi_start_scan_tlvs_len(arg);
         skb = ath10k_wmi_alloc_skb(ar, len);
         if (!skb)
-                return -ENOMEM;
-
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                struct wmi_10x_start_scan_cmd *cmd;
+                return ERR_PTR(-ENOMEM);
 
-                cmd = (struct wmi_10x_start_scan_cmd *)skb->data;
-                ath10k_wmi_put_start_scan_common(&cmd->common, arg);
-                ath10k_wmi_put_start_scan_tlvs(&cmd->tlvs, arg);
-        } else {
-                struct wmi_start_scan_cmd *cmd;
+        cmd = (struct wmi_start_scan_cmd *)skb->data;
 
-                cmd = (struct wmi_start_scan_cmd *)skb->data;
-                cmd->burst_duration_ms = __cpu_to_le32(0);
+        ath10k_wmi_put_start_scan_common(&cmd->common, arg);
+        ath10k_wmi_put_start_scan_tlvs(&cmd->tlvs, arg);
 
-                ath10k_wmi_put_start_scan_common(&cmd->common, arg);
-                ath10k_wmi_put_start_scan_tlvs(&cmd->tlvs, arg);
-        }
+        cmd->burst_duration_ms = __cpu_to_le32(0);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi start scan\n");
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->start_scan_cmdid);
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_10x_op_gen_start_scan(struct ath10k *ar,
+                                 const struct wmi_start_scan_arg *arg)
+{
+        struct wmi_10x_start_scan_cmd *cmd;
+        struct sk_buff *skb;
+        size_t len;
+        int ret;
+
+        ret = ath10k_wmi_start_scan_verify(arg);
+        if (ret)
+                return ERR_PTR(ret);
+
+        len = sizeof(*cmd) + ath10k_wmi_start_scan_tlvs_len(arg);
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        cmd = (struct wmi_10x_start_scan_cmd *)skb->data;
+
+        ath10k_wmi_put_start_scan_common(&cmd->common, arg);
+        ath10k_wmi_put_start_scan_tlvs(&cmd->tlvs, arg);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi 10x start scan\n");
+        return skb;
 }
 
 void ath10k_wmi_start_scan_init(struct ath10k *ar,
@@ -3614,7 +3999,9 @@ void ath10k_wmi_start_scan_init(struct ath10k *ar,
         arg->bssids[0].bssid = "\xFF\xFF\xFF\xFF\xFF\xFF";
 }
 
-int ath10k_wmi_stop_scan(struct ath10k *ar, const struct wmi_stop_scan_arg *arg)
+static struct sk_buff *
+ath10k_wmi_op_gen_stop_scan(struct ath10k *ar,
+                            const struct wmi_stop_scan_arg *arg)
 {
         struct wmi_stop_scan_cmd *cmd;
         struct sk_buff *skb;
@@ -3622,13 +4009,13 @@ int ath10k_wmi_stop_scan(struct ath10k *ar, const struct wmi_stop_scan_arg *arg)
         u32 req_id;
 
         if (arg->req_id > 0xFFF)
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
         if (arg->req_type == WMI_SCAN_STOP_ONE && arg->u.scan_id > 0xFFF)
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         scan_id = arg->u.scan_id;
         scan_id |= WMI_HOST_SCAN_REQ_ID_PREFIX;
@@ -3645,20 +4032,21 @@ int ath10k_wmi_stop_scan(struct ath10k *ar, const struct wmi_stop_scan_arg *arg)
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi stop scan reqid %d req_type %d vdev/scan_id %d\n",
                    arg->req_id, arg->req_type, arg->u.scan_id);
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->stop_scan_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_vdev_create(struct ath10k *ar, u32 vdev_id,
-                           enum wmi_vdev_type type,
-                           enum wmi_vdev_subtype subtype,
-                           const u8 macaddr[ETH_ALEN])
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_create(struct ath10k *ar, u32 vdev_id,
+                              enum wmi_vdev_type type,
+                              enum wmi_vdev_subtype subtype,
+                              const u8 macaddr[ETH_ALEN])
 {
         struct wmi_vdev_create_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_vdev_create_cmd *)skb->data;
         cmd->vdev_id      = __cpu_to_le32(vdev_id);
@@ -3669,58 +4057,52 @@ int ath10k_wmi_vdev_create(struct ath10k *ar, u32 vdev_id,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "WMI vdev create: id %d type %d subtype %d macaddr %pM\n",
                    vdev_id, type, subtype, macaddr);
-
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_create_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_vdev_delete(struct ath10k *ar, u32 vdev_id)
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_delete(struct ath10k *ar, u32 vdev_id)
 {
         struct wmi_vdev_delete_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_vdev_delete_cmd *)skb->data;
         cmd->vdev_id = __cpu_to_le32(vdev_id);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "WMI vdev delete id %d\n", vdev_id);
-
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_delete_cmdid);
+        return skb;
 }
 
-static int
-ath10k_wmi_vdev_start_restart(struct ath10k *ar,
-                              const struct wmi_vdev_start_request_arg *arg,
-                              u32 cmd_id)
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_start(struct ath10k *ar,
+                             const struct wmi_vdev_start_request_arg *arg,
+                             bool restart)
 {
         struct wmi_vdev_start_request_cmd *cmd;
         struct sk_buff *skb;
         const char *cmdname;
         u32 flags = 0;
 
-        if (cmd_id != ar->wmi.cmd->vdev_start_request_cmdid &&
-            cmd_id != ar->wmi.cmd->vdev_restart_request_cmdid)
-                return -EINVAL;
         if (WARN_ON(arg->ssid && arg->ssid_len == 0))
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
         if (WARN_ON(arg->hidden_ssid && !arg->ssid))
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
         if (WARN_ON(arg->ssid_len > sizeof(cmd->ssid.ssid)))
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
 
-        if (cmd_id == ar->wmi.cmd->vdev_start_request_cmdid)
-                cmdname = "start";
-        else if (cmd_id == ar->wmi.cmd->vdev_restart_request_cmdid)
+        if (restart)
                 cmdname = "restart";
         else
-                return -EINVAL; /* should not happen, we already check cmd_id */
+                cmdname = "start";
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         if (arg->hidden_ssid)
                 flags |= WMI_VDEV_START_HIDDEN_SSID;
@@ -3749,50 +4131,36 @@ ath10k_wmi_vdev_start_restart(struct ath10k *ar,
                    flags, arg->channel.freq, arg->channel.mode,
                    cmd->chan.flags, arg->channel.max_power);
 
-        return ath10k_wmi_cmd_send(ar, skb, cmd_id);
-}
-
-int ath10k_wmi_vdev_start(struct ath10k *ar,
-                          const struct wmi_vdev_start_request_arg *arg)
-{
-        u32 cmd_id = ar->wmi.cmd->vdev_start_request_cmdid;
-
-        return ath10k_wmi_vdev_start_restart(ar, arg, cmd_id);
-}
-
-int ath10k_wmi_vdev_restart(struct ath10k *ar,
-                            const struct wmi_vdev_start_request_arg *arg)
-{
-        u32 cmd_id = ar->wmi.cmd->vdev_restart_request_cmdid;
-
-        return ath10k_wmi_vdev_start_restart(ar, arg, cmd_id);
+        return skb;
 }
 
-int ath10k_wmi_vdev_stop(struct ath10k *ar, u32 vdev_id)
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_stop(struct ath10k *ar, u32 vdev_id)
 {
         struct wmi_vdev_stop_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_vdev_stop_cmd *)skb->data;
         cmd->vdev_id = __cpu_to_le32(vdev_id);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi vdev stop id 0x%x\n", vdev_id);
-
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_stop_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_vdev_up(struct ath10k *ar, u32 vdev_id, u32 aid, const u8 *bssid)
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_up(struct ath10k *ar, u32 vdev_id, u32 aid,
+                          const u8 *bssid)
 {
         struct wmi_vdev_up_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_vdev_up_cmd *)skb->data;
         cmd->vdev_id       = __cpu_to_le32(vdev_id);
@@ -3802,30 +4170,30 @@ int ath10k_wmi_vdev_up(struct ath10k *ar, u32 vdev_id, u32 aid, const u8 *bssid)
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi mgmt vdev up id 0x%x assoc id %d bssid %pM\n",
                    vdev_id, aid, bssid);
-
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_up_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_vdev_down(struct ath10k *ar, u32 vdev_id)
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_down(struct ath10k *ar, u32 vdev_id)
 {
         struct wmi_vdev_down_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_vdev_down_cmd *)skb->data;
         cmd->vdev_id = __cpu_to_le32(vdev_id);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi mgmt vdev down id 0x%x\n", vdev_id);
-
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_down_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_vdev_set_param(struct ath10k *ar, u32 vdev_id,
-                              u32 param_id, u32 param_value)
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_set_param(struct ath10k *ar, u32 vdev_id,
+                                 u32 param_id, u32 param_value)
 {
         struct wmi_vdev_set_param_cmd *cmd;
         struct sk_buff *skb;
@@ -3834,12 +4202,12 @@ int ath10k_wmi_vdev_set_param(struct ath10k *ar, u32 vdev_id,
                 ath10k_dbg(ar, ATH10K_DBG_WMI,
                            "vdev param %d not supported by firmware\n",
                             param_id);
-                return -EOPNOTSUPP;
+                return ERR_PTR(-EOPNOTSUPP);
         }
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_vdev_set_param_cmd *)skb->data;
         cmd->vdev_id     = __cpu_to_le32(vdev_id);
@@ -3849,24 +4217,24 @@ int ath10k_wmi_vdev_set_param(struct ath10k *ar, u32 vdev_id,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi vdev id 0x%x set param %d value %d\n",
                    vdev_id, param_id, param_value);
-
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_set_param_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_vdev_install_key(struct ath10k *ar,
-                                const struct wmi_vdev_install_key_arg *arg)
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_install_key(struct ath10k *ar,
+                                   const struct wmi_vdev_install_key_arg *arg)
 {
         struct wmi_vdev_install_key_cmd *cmd;
         struct sk_buff *skb;
 
         if (arg->key_cipher == WMI_CIPHER_NONE && arg->key_data != NULL)
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
         if (arg->key_cipher != WMI_CIPHER_NONE && arg->key_data == NULL)
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd) + arg->key_len);
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_vdev_install_key_cmd *)skb->data;
         cmd->vdev_id       = __cpu_to_le32(arg->vdev_id);
@@ -3885,20 +4253,19 @@ int ath10k_wmi_vdev_install_key(struct ath10k *ar,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi vdev install key idx %d cipher %d len %d\n",
                    arg->key_idx, arg->key_cipher, arg->key_len);
-        return ath10k_wmi_cmd_send(ar, skb,
-                                   ar->wmi.cmd->vdev_install_key_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_vdev_spectral_conf(struct ath10k *ar,
-                                  const struct wmi_vdev_spectral_conf_arg *arg)
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_spectral_conf(struct ath10k *ar,
+                                     const struct wmi_vdev_spectral_conf_arg *arg)
 {
         struct wmi_vdev_spectral_conf_cmd *cmd;
         struct sk_buff *skb;
-        u32 cmdid;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_vdev_spectral_conf_cmd *)skb->data;
         cmd->vdev_id = __cpu_to_le32(arg->vdev_id);
@@ -3921,39 +4288,38 @@ int ath10k_wmi_vdev_spectral_conf(struct ath10k *ar,
         cmd->scan_dbm_adj = __cpu_to_le32(arg->scan_dbm_adj);
         cmd->scan_chn_mask = __cpu_to_le32(arg->scan_chn_mask);
 
-        cmdid = ar->wmi.cmd->vdev_spectral_scan_configure_cmdid;
-        return ath10k_wmi_cmd_send(ar, skb, cmdid);
+        return skb;
 }
 
-int ath10k_wmi_vdev_spectral_enable(struct ath10k *ar, u32 vdev_id, u32 trigger,
-                                    u32 enable)
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_spectral_enable(struct ath10k *ar, u32 vdev_id,
+                                       u32 trigger, u32 enable)
 {
         struct wmi_vdev_spectral_enable_cmd *cmd;
         struct sk_buff *skb;
-        u32 cmdid;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_vdev_spectral_enable_cmd *)skb->data;
         cmd->vdev_id = __cpu_to_le32(vdev_id);
         cmd->trigger_cmd = __cpu_to_le32(trigger);
         cmd->enable_cmd = __cpu_to_le32(enable);
 
-        cmdid = ar->wmi.cmd->vdev_spectral_scan_enable_cmdid;
-        return ath10k_wmi_cmd_send(ar, skb, cmdid);
+        return skb;
 }
 
-int ath10k_wmi_peer_create(struct ath10k *ar, u32 vdev_id,
-                           const u8 peer_addr[ETH_ALEN])
+static struct sk_buff *
+ath10k_wmi_op_gen_peer_create(struct ath10k *ar, u32 vdev_id,
+                              const u8 peer_addr[ETH_ALEN])
 {
         struct wmi_peer_create_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_peer_create_cmd *)skb->data;
         cmd->vdev_id = __cpu_to_le32(vdev_id);
@@ -3962,18 +4328,19 @@ int ath10k_wmi_peer_create(struct ath10k *ar, u32 vdev_id,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi peer create vdev_id %d peer_addr %pM\n",
                    vdev_id, peer_addr);
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_create_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_peer_delete(struct ath10k *ar, u32 vdev_id,
-                           const u8 peer_addr[ETH_ALEN])
+static struct sk_buff *
+ath10k_wmi_op_gen_peer_delete(struct ath10k *ar, u32 vdev_id,
+                              const u8 peer_addr[ETH_ALEN])
 {
         struct wmi_peer_delete_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_peer_delete_cmd *)skb->data;
         cmd->vdev_id = __cpu_to_le32(vdev_id);
@@ -3982,18 +4349,19 @@ int ath10k_wmi_peer_delete(struct ath10k *ar, u32 vdev_id,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi peer delete vdev_id %d peer_addr %pM\n",
                    vdev_id, peer_addr);
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_delete_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_peer_flush(struct ath10k *ar, u32 vdev_id,
-                          const u8 peer_addr[ETH_ALEN], u32 tid_bitmap)
+static struct sk_buff *
+ath10k_wmi_op_gen_peer_flush(struct ath10k *ar, u32 vdev_id,
+                             const u8 peer_addr[ETH_ALEN], u32 tid_bitmap)
 {
         struct wmi_peer_flush_tids_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_peer_flush_tids_cmd *)skb->data;
         cmd->vdev_id         = __cpu_to_le32(vdev_id);
@@ -4003,19 +4371,21 @@ int ath10k_wmi_peer_flush(struct ath10k *ar, u32 vdev_id,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi peer flush vdev_id %d peer_addr %pM tids %08x\n",
                    vdev_id, peer_addr, tid_bitmap);
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_flush_tids_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_peer_set_param(struct ath10k *ar, u32 vdev_id,
-                              const u8 *peer_addr, enum wmi_peer_param param_id,
-                              u32 param_value)
+static struct sk_buff *
+ath10k_wmi_op_gen_peer_set_param(struct ath10k *ar, u32 vdev_id,
+                                 const u8 *peer_addr,
+                                 enum wmi_peer_param param_id,
+                                 u32 param_value)
 {
         struct wmi_peer_set_param_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_peer_set_param_cmd *)skb->data;
         cmd->vdev_id     = __cpu_to_le32(vdev_id);
@@ -4026,19 +4396,19 @@ int ath10k_wmi_peer_set_param(struct ath10k *ar, u32 vdev_id,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi vdev %d peer 0x%pM set param %d value %d\n",
                    vdev_id, peer_addr, param_id, param_value);
-
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_set_param_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_set_psmode(struct ath10k *ar, u32 vdev_id,
-                          enum wmi_sta_ps_mode psmode)
+static struct sk_buff *
+ath10k_wmi_op_gen_set_psmode(struct ath10k *ar, u32 vdev_id,
+                             enum wmi_sta_ps_mode psmode)
 {
         struct wmi_sta_powersave_mode_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_sta_powersave_mode_cmd *)skb->data;
         cmd->vdev_id     = __cpu_to_le32(vdev_id);
@@ -4047,21 +4417,20 @@ int ath10k_wmi_set_psmode(struct ath10k *ar, u32 vdev_id,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi set powersave id 0x%x mode %d\n",
                    vdev_id, psmode);
-
-        return ath10k_wmi_cmd_send(ar, skb,
-                                   ar->wmi.cmd->sta_powersave_mode_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_set_sta_ps_param(struct ath10k *ar, u32 vdev_id,
-                                enum wmi_sta_powersave_param param_id,
-                                u32 value)
+static struct sk_buff *
+ath10k_wmi_op_gen_set_sta_ps(struct ath10k *ar, u32 vdev_id,
+                             enum wmi_sta_powersave_param param_id,
+                             u32 value)
 {
         struct wmi_sta_powersave_param_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_sta_powersave_param_cmd *)skb->data;
         cmd->vdev_id     = __cpu_to_le32(vdev_id);
@@ -4071,22 +4440,22 @@ int ath10k_wmi_set_sta_ps_param(struct ath10k *ar, u32 vdev_id,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi sta ps param vdev_id 0x%x param %d value %d\n",
                    vdev_id, param_id, value);
-        return ath10k_wmi_cmd_send(ar, skb,
-                                   ar->wmi.cmd->sta_powersave_param_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_set_ap_ps_param(struct ath10k *ar, u32 vdev_id, const u8 *mac,
-                               enum wmi_ap_ps_peer_param param_id, u32 value)
+static struct sk_buff *
+ath10k_wmi_op_gen_set_ap_ps(struct ath10k *ar, u32 vdev_id, const u8 *mac,
+                            enum wmi_ap_ps_peer_param param_id, u32 value)
 {
         struct wmi_ap_ps_peer_cmd *cmd;
         struct sk_buff *skb;
 
         if (!mac)
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_ap_ps_peer_cmd *)skb->data;
         cmd->vdev_id = __cpu_to_le32(vdev_id);
@@ -4097,13 +4466,12 @@ int ath10k_wmi_set_ap_ps_param(struct ath10k *ar, u32 vdev_id, const u8 *mac,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi ap ps param vdev_id 0x%X param %d value %d mac_addr %pM\n",
                    vdev_id, param_id, value, mac);
-
-        return ath10k_wmi_cmd_send(ar, skb,
-                                   ar->wmi.cmd->ap_ps_peer_param_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_scan_chan_list(struct ath10k *ar,
-                              const struct wmi_scan_chan_list_arg *arg)
+static struct sk_buff *
+ath10k_wmi_op_gen_scan_chan_list(struct ath10k *ar,
+                                 const struct wmi_scan_chan_list_arg *arg)
 {
         struct wmi_scan_chan_list_cmd *cmd;
         struct sk_buff *skb;
@@ -4116,7 +4484,7 @@ int ath10k_wmi_scan_chan_list(struct ath10k *ar,
 
         skb = ath10k_wmi_alloc_skb(ar, len);
         if (!skb)
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
 
         cmd = (struct wmi_scan_chan_list_cmd *)skb->data;
         cmd->num_scan_chans = __cpu_to_le32(arg->n_channels);
@@ -4128,7 +4496,7 @@ int ath10k_wmi_scan_chan_list(struct ath10k *ar,
                 ath10k_wmi_put_wmi_channel(ci, ch);
         }
 
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->scan_chan_list_cmdid);
+        return skb;
 }
 
 static void
@@ -4209,12 +4577,9 @@ ath10k_wmi_peer_assoc_fill_10_2(struct ath10k *ar, void *buf,
         cmd->info0 = __cpu_to_le32(info0);
 }
 
-int ath10k_wmi_peer_assoc(struct ath10k *ar,
-                          const struct wmi_peer_assoc_complete_arg *arg)
+static int
+ath10k_wmi_peer_assoc_check_arg(const struct wmi_peer_assoc_complete_arg *arg)
 {
-        struct sk_buff *skb;
-        int len;
-
         if (arg->peer_mpdu_density > 16)
                 return -EINVAL;
         if (arg->peer_legacy_rates.num_rates > MAX_SUPPORTED_RATES)
@@ -4222,49 +4587,111 @@ int ath10k_wmi_peer_assoc(struct ath10k *ar,
         if (arg->peer_ht_rates.num_rates > MAX_SUPPORTED_RATES)
                 return -EINVAL;
 
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                if (test_bit(ATH10K_FW_FEATURE_WMI_10_2, ar->fw_features))
-                        len = sizeof(struct wmi_10_2_peer_assoc_complete_cmd);
-                else
-                        len = sizeof(struct wmi_10_1_peer_assoc_complete_cmd);
-        } else {
-                len = sizeof(struct wmi_main_peer_assoc_complete_cmd);
-        }
+        return 0;
+}
+
+static struct sk_buff *
+ath10k_wmi_op_gen_peer_assoc(struct ath10k *ar,
+                             const struct wmi_peer_assoc_complete_arg *arg)
+{
+        size_t len = sizeof(struct wmi_main_peer_assoc_complete_cmd);
+        struct sk_buff *skb;
+        int ret;
+
+        ret = ath10k_wmi_peer_assoc_check_arg(arg);
+        if (ret)
+                return ERR_PTR(ret);
 
         skb = ath10k_wmi_alloc_skb(ar, len);
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                if (test_bit(ATH10K_FW_FEATURE_WMI_10_2, ar->fw_features))
-                        ath10k_wmi_peer_assoc_fill_10_2(ar, skb->data, arg);
-                else
-                        ath10k_wmi_peer_assoc_fill_10_1(ar, skb->data, arg);
-        } else {
-                ath10k_wmi_peer_assoc_fill_main(ar, skb->data, arg);
-        }
+        ath10k_wmi_peer_assoc_fill_main(ar, skb->data, arg);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                   "wmi peer assoc vdev %d addr %pM (%s)\n",
+                   arg->vdev_id, arg->addr,
+                   arg->peer_reassoc ? "reassociate" : "new");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_10_1_op_gen_peer_assoc(struct ath10k *ar,
+                                  const struct wmi_peer_assoc_complete_arg *arg)
+{
+        size_t len = sizeof(struct wmi_10_1_peer_assoc_complete_cmd);
+        struct sk_buff *skb;
+        int ret;
+
+        ret = ath10k_wmi_peer_assoc_check_arg(arg);
+        if (ret)
+                return ERR_PTR(ret);
+
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ath10k_wmi_peer_assoc_fill_10_1(ar, skb->data, arg);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi peer assoc vdev %d addr %pM (%s)\n",
                    arg->vdev_id, arg->addr,
                    arg->peer_reassoc ? "reassociate" : "new");
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_assoc_cmdid);
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_10_2_op_gen_peer_assoc(struct ath10k *ar,
+                                  const struct wmi_peer_assoc_complete_arg *arg)
+{
+        size_t len = sizeof(struct wmi_10_2_peer_assoc_complete_cmd);
+        struct sk_buff *skb;
+        int ret;
+
+        ret = ath10k_wmi_peer_assoc_check_arg(arg);
+        if (ret)
+                return ERR_PTR(ret);
+
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ath10k_wmi_peer_assoc_fill_10_2(ar, skb->data, arg);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                   "wmi peer assoc vdev %d addr %pM (%s)\n",
+                   arg->vdev_id, arg->addr,
+                   arg->peer_reassoc ? "reassociate" : "new");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_10_2_op_gen_pdev_get_temperature(struct ath10k *ar)
+{
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, 0);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi pdev get temperature\n");
+        return skb;
 }
 
 /* This function assumes the beacon is already DMA mapped */
-int ath10k_wmi_beacon_send_ref_nowait(struct ath10k_vif *arvif)
+static struct sk_buff *
+ath10k_wmi_op_gen_beacon_dma(struct ath10k_vif *arvif)
 {
+        struct ath10k *ar = arvif->ar;
         struct wmi_bcn_tx_ref_cmd *cmd;
         struct sk_buff *skb;
         struct sk_buff *beacon = arvif->beacon;
-        struct ath10k *ar = arvif->ar;
         struct ieee80211_hdr *hdr;
-        int ret;
         u16 fc;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         hdr = (struct ieee80211_hdr *)beacon->data;
         fc = le16_to_cpu(hdr->frame_control);
@@ -4284,17 +4711,11 @@ int ath10k_wmi_beacon_send_ref_nowait(struct ath10k_vif *arvif)
         if (ATH10K_SKB_CB(beacon)->bcn.deliver_cab)
                 cmd->flags |= __cpu_to_le32(WMI_BCN_TX_REF_FLAG_DELIVER_CAB);
 
-        ret = ath10k_wmi_cmd_send_nowait(ar, skb,
-                                         ar->wmi.cmd->pdev_send_bcn_cmdid);
-
-        if (ret)
-                dev_kfree_skb(skb);
-
-        return ret;
+        return skb;
 }
 
-static void ath10k_wmi_pdev_set_wmm_param(struct wmi_wmm_params *params,
-                                          const struct wmi_wmm_params_arg *arg)
+void ath10k_wmi_pdev_set_wmm_param(struct wmi_wmm_params *params,
+                                   const struct wmi_wmm_params_arg *arg)
 {
         params->cwmin  = __cpu_to_le32(arg->cwmin);
         params->cwmax  = __cpu_to_le32(arg->cwmax);
@@ -4304,15 +4725,16 @@ static void ath10k_wmi_pdev_set_wmm_param(struct wmi_wmm_params *params,
         params->no_ack = __cpu_to_le32(arg->no_ack);
 }
 
-int ath10k_wmi_pdev_set_wmm_params(struct ath10k *ar,
-                                   const struct wmi_pdev_set_wmm_params_arg *arg)
+static struct sk_buff *
+ath10k_wmi_op_gen_pdev_set_wmm(struct ath10k *ar,
+                               const struct wmi_pdev_set_wmm_params_arg *arg)
 {
         struct wmi_pdev_set_wmm_params *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_pdev_set_wmm_params *)skb->data;
         ath10k_wmi_pdev_set_wmm_param(&cmd->ac_be, &arg->ac_be);
@@ -4321,35 +4743,36 @@ int ath10k_wmi_pdev_set_wmm_params(struct ath10k *ar,
         ath10k_wmi_pdev_set_wmm_param(&cmd->ac_vo, &arg->ac_vo);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi pdev set wmm params\n");
-        return ath10k_wmi_cmd_send(ar, skb,
-                                   ar->wmi.cmd->pdev_set_wmm_params_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_request_stats(struct ath10k *ar, enum wmi_stats_id stats_id)
+static struct sk_buff *
+ath10k_wmi_op_gen_request_stats(struct ath10k *ar, enum wmi_stats_id stats_id)
 {
         struct wmi_request_stats_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_request_stats_cmd *)skb->data;
         cmd->stats_id = __cpu_to_le32(stats_id);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi request stats %d\n", (int)stats_id);
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->request_stats_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_force_fw_hang(struct ath10k *ar,
-                             enum wmi_force_fw_hang_type type, u32 delay_ms)
+static struct sk_buff *
+ath10k_wmi_op_gen_force_fw_hang(struct ath10k *ar,
+                                enum wmi_force_fw_hang_type type, u32 delay_ms)
 {
         struct wmi_force_fw_hang_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_force_fw_hang_cmd *)skb->data;
         cmd->type = __cpu_to_le32(type);
@@ -4357,10 +4780,11 @@ int ath10k_wmi_force_fw_hang(struct ath10k *ar,
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi force fw hang %d delay %d\n",
                    type, delay_ms);
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->force_fw_hang_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_dbglog_cfg(struct ath10k *ar, u32 module_enable)
+static struct sk_buff *
+ath10k_wmi_op_gen_dbglog_cfg(struct ath10k *ar, u32 module_enable)
 {
         struct wmi_dbglog_cfg_cmd *cmd;
         struct sk_buff *skb;
@@ -4368,7 +4792,7 @@ int ath10k_wmi_dbglog_cfg(struct ath10k *ar, u32 module_enable)
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_dbglog_cfg_cmd *)skb->data;
 
@@ -4393,57 +4817,318 @@ int ath10k_wmi_dbglog_cfg(struct ath10k *ar, u32 module_enable)
                    __le32_to_cpu(cmd->module_valid),
                    __le32_to_cpu(cmd->config_enable),
                    __le32_to_cpu(cmd->config_valid));
-
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->dbglog_cfg_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_pdev_pktlog_enable(struct ath10k *ar, u32 ev_bitmap)
+static struct sk_buff *
+ath10k_wmi_op_gen_pktlog_enable(struct ath10k *ar, u32 ev_bitmap)
 {
         struct wmi_pdev_pktlog_enable_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         ev_bitmap &= ATH10K_PKTLOG_ANY;
-        ath10k_dbg(ar, ATH10K_DBG_WMI,
-                   "wmi enable pktlog filter:%x\n", ev_bitmap);
 
         cmd = (struct wmi_pdev_pktlog_enable_cmd *)skb->data;
         cmd->ev_bitmap = __cpu_to_le32(ev_bitmap);
-        return ath10k_wmi_cmd_send(ar, skb,
-                                   ar->wmi.cmd->pdev_pktlog_enable_cmdid);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi enable pktlog filter 0x%08x\n",
+                   ev_bitmap);
+        return skb;
 }
 
-int ath10k_wmi_pdev_pktlog_disable(struct ath10k *ar)
+static struct sk_buff *
+ath10k_wmi_op_gen_pktlog_disable(struct ath10k *ar)
 {
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, 0);
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi disable pktlog\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_op_gen_pdev_set_quiet_mode(struct ath10k *ar, u32 period,
+                                      u32 duration, u32 next_offset,
+                                      u32 enabled)
+{
+        struct wmi_pdev_set_quiet_cmd *cmd;
+        struct sk_buff *skb;
 
-        return ath10k_wmi_cmd_send(ar, skb,
-                                   ar->wmi.cmd->pdev_pktlog_disable_cmdid);
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        cmd = (struct wmi_pdev_set_quiet_cmd *)skb->data;
+        cmd->period = __cpu_to_le32(period);
+        cmd->duration = __cpu_to_le32(duration);
+        cmd->next_start = __cpu_to_le32(next_offset);
+        cmd->enabled = __cpu_to_le32(enabled);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                   "wmi quiet param: period %u duration %u enabled %d\n",
+                   period, duration, enabled);
+        return skb;
 }
 
+static const struct wmi_ops wmi_ops = {
+        .rx = ath10k_wmi_op_rx,
+        .map_svc = wmi_main_svc_map,
+
+        .pull_scan = ath10k_wmi_op_pull_scan_ev,
+        .pull_mgmt_rx = ath10k_wmi_op_pull_mgmt_rx_ev,
+        .pull_ch_info = ath10k_wmi_op_pull_ch_info_ev,
+        .pull_vdev_start = ath10k_wmi_op_pull_vdev_start_ev,
+        .pull_peer_kick = ath10k_wmi_op_pull_peer_kick_ev,
+        .pull_swba = ath10k_wmi_op_pull_swba_ev,
+        .pull_phyerr = ath10k_wmi_op_pull_phyerr_ev,
+        .pull_svc_rdy = ath10k_wmi_main_op_pull_svc_rdy_ev,
+        .pull_rdy = ath10k_wmi_op_pull_rdy_ev,
+        .pull_fw_stats = ath10k_wmi_main_op_pull_fw_stats,
+
+        .gen_pdev_suspend = ath10k_wmi_op_gen_pdev_suspend,
+        .gen_pdev_resume = ath10k_wmi_op_gen_pdev_resume,
+        .gen_pdev_set_rd = ath10k_wmi_op_gen_pdev_set_rd,
+        .gen_pdev_set_param = ath10k_wmi_op_gen_pdev_set_param,
+        .gen_init = ath10k_wmi_op_gen_init,
+        .gen_start_scan = ath10k_wmi_op_gen_start_scan,
+        .gen_stop_scan = ath10k_wmi_op_gen_stop_scan,
+        .gen_vdev_create = ath10k_wmi_op_gen_vdev_create,
+        .gen_vdev_delete = ath10k_wmi_op_gen_vdev_delete,
+        .gen_vdev_start = ath10k_wmi_op_gen_vdev_start,
+        .gen_vdev_stop = ath10k_wmi_op_gen_vdev_stop,
+        .gen_vdev_up = ath10k_wmi_op_gen_vdev_up,
+        .gen_vdev_down = ath10k_wmi_op_gen_vdev_down,
+        .gen_vdev_set_param = ath10k_wmi_op_gen_vdev_set_param,
+        .gen_vdev_install_key = ath10k_wmi_op_gen_vdev_install_key,
+        .gen_vdev_spectral_conf = ath10k_wmi_op_gen_vdev_spectral_conf,
+        .gen_vdev_spectral_enable = ath10k_wmi_op_gen_vdev_spectral_enable,
+        .gen_peer_create = ath10k_wmi_op_gen_peer_create,
+        .gen_peer_delete = ath10k_wmi_op_gen_peer_delete,
+        .gen_peer_flush = ath10k_wmi_op_gen_peer_flush,
+        .gen_peer_set_param = ath10k_wmi_op_gen_peer_set_param,
+        .gen_peer_assoc = ath10k_wmi_op_gen_peer_assoc,
+        .gen_set_psmode = ath10k_wmi_op_gen_set_psmode,
+        .gen_set_sta_ps = ath10k_wmi_op_gen_set_sta_ps,
+        .gen_set_ap_ps = ath10k_wmi_op_gen_set_ap_ps,
+        .gen_scan_chan_list = ath10k_wmi_op_gen_scan_chan_list,
+        .gen_beacon_dma = ath10k_wmi_op_gen_beacon_dma,
+        .gen_pdev_set_wmm = ath10k_wmi_op_gen_pdev_set_wmm,
+        .gen_request_stats = ath10k_wmi_op_gen_request_stats,
+        .gen_force_fw_hang = ath10k_wmi_op_gen_force_fw_hang,
+        .gen_mgmt_tx = ath10k_wmi_op_gen_mgmt_tx,
+        .gen_dbglog_cfg = ath10k_wmi_op_gen_dbglog_cfg,
+        .gen_pktlog_enable = ath10k_wmi_op_gen_pktlog_enable,
+        .gen_pktlog_disable = ath10k_wmi_op_gen_pktlog_disable,
+        .gen_pdev_set_quiet_mode = ath10k_wmi_op_gen_pdev_set_quiet_mode,
+        /* .gen_pdev_get_temperature not implemented */
+};
+
+static const struct wmi_ops wmi_10_1_ops = {
+        .rx = ath10k_wmi_10_1_op_rx,
+        .map_svc = wmi_10x_svc_map,
+        .pull_svc_rdy = ath10k_wmi_10x_op_pull_svc_rdy_ev,
+        .pull_fw_stats = ath10k_wmi_10x_op_pull_fw_stats,
+        .gen_init = ath10k_wmi_10_1_op_gen_init,
+        .gen_pdev_set_rd = ath10k_wmi_10x_op_gen_pdev_set_rd,
+        .gen_start_scan = ath10k_wmi_10x_op_gen_start_scan,
+        .gen_peer_assoc = ath10k_wmi_10_1_op_gen_peer_assoc,
+        /* .gen_pdev_get_temperature not implemented */
+
+        /* shared with main branch */
+        .pull_scan = ath10k_wmi_op_pull_scan_ev,
+        .pull_mgmt_rx = ath10k_wmi_op_pull_mgmt_rx_ev,
+        .pull_ch_info = ath10k_wmi_op_pull_ch_info_ev,
+        .pull_vdev_start = ath10k_wmi_op_pull_vdev_start_ev,
+        .pull_peer_kick = ath10k_wmi_op_pull_peer_kick_ev,
+        .pull_swba = ath10k_wmi_op_pull_swba_ev,
+        .pull_phyerr = ath10k_wmi_op_pull_phyerr_ev,
+        .pull_rdy = ath10k_wmi_op_pull_rdy_ev,
+
+        .gen_pdev_suspend = ath10k_wmi_op_gen_pdev_suspend,
+        .gen_pdev_resume = ath10k_wmi_op_gen_pdev_resume,
+        .gen_pdev_set_param = ath10k_wmi_op_gen_pdev_set_param,
+        .gen_stop_scan = ath10k_wmi_op_gen_stop_scan,
+        .gen_vdev_create = ath10k_wmi_op_gen_vdev_create,
+        .gen_vdev_delete = ath10k_wmi_op_gen_vdev_delete,
+        .gen_vdev_start = ath10k_wmi_op_gen_vdev_start,
+        .gen_vdev_stop = ath10k_wmi_op_gen_vdev_stop,
+        .gen_vdev_up = ath10k_wmi_op_gen_vdev_up,
+        .gen_vdev_down = ath10k_wmi_op_gen_vdev_down,
+        .gen_vdev_set_param = ath10k_wmi_op_gen_vdev_set_param,
+        .gen_vdev_install_key = ath10k_wmi_op_gen_vdev_install_key,
+        .gen_vdev_spectral_conf = ath10k_wmi_op_gen_vdev_spectral_conf,
+        .gen_vdev_spectral_enable = ath10k_wmi_op_gen_vdev_spectral_enable,
+        .gen_peer_create = ath10k_wmi_op_gen_peer_create,
+        .gen_peer_delete = ath10k_wmi_op_gen_peer_delete,
+        .gen_peer_flush = ath10k_wmi_op_gen_peer_flush,
+        .gen_peer_set_param = ath10k_wmi_op_gen_peer_set_param,
+        .gen_set_psmode = ath10k_wmi_op_gen_set_psmode,
+        .gen_set_sta_ps = ath10k_wmi_op_gen_set_sta_ps,
+        .gen_set_ap_ps = ath10k_wmi_op_gen_set_ap_ps,
+        .gen_scan_chan_list = ath10k_wmi_op_gen_scan_chan_list,
+        .gen_beacon_dma = ath10k_wmi_op_gen_beacon_dma,
+        .gen_pdev_set_wmm = ath10k_wmi_op_gen_pdev_set_wmm,
+        .gen_request_stats = ath10k_wmi_op_gen_request_stats,
+        .gen_force_fw_hang = ath10k_wmi_op_gen_force_fw_hang,
+        .gen_mgmt_tx = ath10k_wmi_op_gen_mgmt_tx,
+        .gen_dbglog_cfg = ath10k_wmi_op_gen_dbglog_cfg,
+        .gen_pktlog_enable = ath10k_wmi_op_gen_pktlog_enable,
+        .gen_pktlog_disable = ath10k_wmi_op_gen_pktlog_disable,
+        .gen_pdev_set_quiet_mode = ath10k_wmi_op_gen_pdev_set_quiet_mode,
+};
+
+static const struct wmi_ops wmi_10_2_ops = {
+        .rx = ath10k_wmi_10_2_op_rx,
+        .gen_init = ath10k_wmi_10_2_op_gen_init,
+        .gen_peer_assoc = ath10k_wmi_10_2_op_gen_peer_assoc,
+        /* .gen_pdev_get_temperature not implemented */
+
+        /* shared with 10.1 */
+        .map_svc = wmi_10x_svc_map,
+        .pull_svc_rdy = ath10k_wmi_10x_op_pull_svc_rdy_ev,
+        .pull_fw_stats = ath10k_wmi_10x_op_pull_fw_stats,
+        .gen_pdev_set_rd = ath10k_wmi_10x_op_gen_pdev_set_rd,
+        .gen_start_scan = ath10k_wmi_10x_op_gen_start_scan,
+
+        .pull_scan = ath10k_wmi_op_pull_scan_ev,
+        .pull_mgmt_rx = ath10k_wmi_op_pull_mgmt_rx_ev,
+        .pull_ch_info = ath10k_wmi_op_pull_ch_info_ev,
+        .pull_vdev_start = ath10k_wmi_op_pull_vdev_start_ev,
+        .pull_peer_kick = ath10k_wmi_op_pull_peer_kick_ev,
+        .pull_swba = ath10k_wmi_op_pull_swba_ev,
+        .pull_phyerr = ath10k_wmi_op_pull_phyerr_ev,
+        .pull_rdy = ath10k_wmi_op_pull_rdy_ev,
+
+        .gen_pdev_suspend = ath10k_wmi_op_gen_pdev_suspend,
+        .gen_pdev_resume = ath10k_wmi_op_gen_pdev_resume,
+        .gen_pdev_set_param = ath10k_wmi_op_gen_pdev_set_param,
+        .gen_stop_scan = ath10k_wmi_op_gen_stop_scan,
+        .gen_vdev_create = ath10k_wmi_op_gen_vdev_create,
+        .gen_vdev_delete = ath10k_wmi_op_gen_vdev_delete,
+        .gen_vdev_start = ath10k_wmi_op_gen_vdev_start,
+        .gen_vdev_stop = ath10k_wmi_op_gen_vdev_stop,
+        .gen_vdev_up = ath10k_wmi_op_gen_vdev_up,
+        .gen_vdev_down = ath10k_wmi_op_gen_vdev_down,
+        .gen_vdev_set_param = ath10k_wmi_op_gen_vdev_set_param,
+        .gen_vdev_install_key = ath10k_wmi_op_gen_vdev_install_key,
+        .gen_vdev_spectral_conf = ath10k_wmi_op_gen_vdev_spectral_conf,
+        .gen_vdev_spectral_enable = ath10k_wmi_op_gen_vdev_spectral_enable,
+        .gen_peer_create = ath10k_wmi_op_gen_peer_create,
+        .gen_peer_delete = ath10k_wmi_op_gen_peer_delete,
+        .gen_peer_flush = ath10k_wmi_op_gen_peer_flush,
+        .gen_peer_set_param = ath10k_wmi_op_gen_peer_set_param,
+        .gen_set_psmode = ath10k_wmi_op_gen_set_psmode,
+        .gen_set_sta_ps = ath10k_wmi_op_gen_set_sta_ps,
+        .gen_set_ap_ps = ath10k_wmi_op_gen_set_ap_ps,
+        .gen_scan_chan_list = ath10k_wmi_op_gen_scan_chan_list,
+        .gen_beacon_dma = ath10k_wmi_op_gen_beacon_dma,
+        .gen_pdev_set_wmm = ath10k_wmi_op_gen_pdev_set_wmm,
+        .gen_request_stats = ath10k_wmi_op_gen_request_stats,
+        .gen_force_fw_hang = ath10k_wmi_op_gen_force_fw_hang,
+        .gen_mgmt_tx = ath10k_wmi_op_gen_mgmt_tx,
+        .gen_dbglog_cfg = ath10k_wmi_op_gen_dbglog_cfg,
+        .gen_pktlog_enable = ath10k_wmi_op_gen_pktlog_enable,
+        .gen_pktlog_disable = ath10k_wmi_op_gen_pktlog_disable,
+        .gen_pdev_set_quiet_mode = ath10k_wmi_op_gen_pdev_set_quiet_mode,
+};
+
+static const struct wmi_ops wmi_10_2_4_ops = {
+        .rx = ath10k_wmi_10_2_op_rx,
+        .gen_init = ath10k_wmi_10_2_op_gen_init,
+        .gen_peer_assoc = ath10k_wmi_10_2_op_gen_peer_assoc,
+        .gen_pdev_get_temperature = ath10k_wmi_10_2_op_gen_pdev_get_temperature,
+
+        /* shared with 10.1 */
+        .map_svc = wmi_10x_svc_map,
+        .pull_svc_rdy = ath10k_wmi_10x_op_pull_svc_rdy_ev,
+        .pull_fw_stats = ath10k_wmi_10x_op_pull_fw_stats,
+        .gen_pdev_set_rd = ath10k_wmi_10x_op_gen_pdev_set_rd,
+        .gen_start_scan = ath10k_wmi_10x_op_gen_start_scan,
+
+        .pull_scan = ath10k_wmi_op_pull_scan_ev,
+        .pull_mgmt_rx = ath10k_wmi_op_pull_mgmt_rx_ev,
+        .pull_ch_info = ath10k_wmi_op_pull_ch_info_ev,
+        .pull_vdev_start = ath10k_wmi_op_pull_vdev_start_ev,
+        .pull_peer_kick = ath10k_wmi_op_pull_peer_kick_ev,
+        .pull_swba = ath10k_wmi_op_pull_swba_ev,
+        .pull_phyerr = ath10k_wmi_op_pull_phyerr_ev,
+        .pull_rdy = ath10k_wmi_op_pull_rdy_ev,
+
+        .gen_pdev_suspend = ath10k_wmi_op_gen_pdev_suspend,
+        .gen_pdev_resume = ath10k_wmi_op_gen_pdev_resume,
+        .gen_pdev_set_param = ath10k_wmi_op_gen_pdev_set_param,
+        .gen_stop_scan = ath10k_wmi_op_gen_stop_scan,
+        .gen_vdev_create = ath10k_wmi_op_gen_vdev_create,
+        .gen_vdev_delete = ath10k_wmi_op_gen_vdev_delete,
+        .gen_vdev_start = ath10k_wmi_op_gen_vdev_start,
+        .gen_vdev_stop = ath10k_wmi_op_gen_vdev_stop,
+        .gen_vdev_up = ath10k_wmi_op_gen_vdev_up,
+        .gen_vdev_down = ath10k_wmi_op_gen_vdev_down,
+        .gen_vdev_set_param = ath10k_wmi_op_gen_vdev_set_param,
+        .gen_vdev_install_key = ath10k_wmi_op_gen_vdev_install_key,
+        .gen_vdev_spectral_conf = ath10k_wmi_op_gen_vdev_spectral_conf,
+        .gen_vdev_spectral_enable = ath10k_wmi_op_gen_vdev_spectral_enable,
+        .gen_peer_create = ath10k_wmi_op_gen_peer_create,
+        .gen_peer_delete = ath10k_wmi_op_gen_peer_delete,
+        .gen_peer_flush = ath10k_wmi_op_gen_peer_flush,
+        .gen_peer_set_param = ath10k_wmi_op_gen_peer_set_param,
+        .gen_set_psmode = ath10k_wmi_op_gen_set_psmode,
+        .gen_set_sta_ps = ath10k_wmi_op_gen_set_sta_ps,
+        .gen_set_ap_ps = ath10k_wmi_op_gen_set_ap_ps,
+        .gen_scan_chan_list = ath10k_wmi_op_gen_scan_chan_list,
+        .gen_beacon_dma = ath10k_wmi_op_gen_beacon_dma,
+        .gen_pdev_set_wmm = ath10k_wmi_op_gen_pdev_set_wmm,
+        .gen_request_stats = ath10k_wmi_op_gen_request_stats,
+        .gen_force_fw_hang = ath10k_wmi_op_gen_force_fw_hang,
+        .gen_mgmt_tx = ath10k_wmi_op_gen_mgmt_tx,
+        .gen_dbglog_cfg = ath10k_wmi_op_gen_dbglog_cfg,
+        .gen_pktlog_enable = ath10k_wmi_op_gen_pktlog_enable,
+        .gen_pktlog_disable = ath10k_wmi_op_gen_pktlog_disable,
+        .gen_pdev_set_quiet_mode = ath10k_wmi_op_gen_pdev_set_quiet_mode,
+};
+
 int ath10k_wmi_attach(struct ath10k *ar)
 {
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                if (test_bit(ATH10K_FW_FEATURE_WMI_10_2, ar->fw_features))
-                        ar->wmi.cmd = &wmi_10_2_cmd_map;
-                else
-                        ar->wmi.cmd = &wmi_10x_cmd_map;
-
+        switch (ar->wmi.op_version) {
+        case ATH10K_FW_WMI_OP_VERSION_10_2_4:
+                ar->wmi.cmd = &wmi_10_2_4_cmd_map;
+                ar->wmi.ops = &wmi_10_2_4_ops;
+                ar->wmi.vdev_param = &wmi_10_2_4_vdev_param_map;
+                ar->wmi.pdev_param = &wmi_10_2_4_pdev_param_map;
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_10_2:
+                ar->wmi.cmd = &wmi_10_2_cmd_map;
+                ar->wmi.ops = &wmi_10_2_ops;
                 ar->wmi.vdev_param = &wmi_10x_vdev_param_map;
                 ar->wmi.pdev_param = &wmi_10x_pdev_param_map;
-        } else {
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_10_1:
+                ar->wmi.cmd = &wmi_10x_cmd_map;
+                ar->wmi.ops = &wmi_10_1_ops;
+                ar->wmi.vdev_param = &wmi_10x_vdev_param_map;
+                ar->wmi.pdev_param = &wmi_10x_pdev_param_map;
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_MAIN:
                 ar->wmi.cmd = &wmi_cmd_map;
+                ar->wmi.ops = &wmi_ops;
                 ar->wmi.vdev_param = &wmi_vdev_param_map;
                 ar->wmi.pdev_param = &wmi_pdev_param_map;
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_TLV:
+                ath10k_wmi_tlv_attach(ar);
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_UNSET:
+        case ATH10K_FW_WMI_OP_VERSION_MAX:
+                ath10k_err(ar, "unsupported WMI op version: %d\n",
+                           ar->wmi.op_version);
+                return -EINVAL;
         }
 
         init_completion(&ar->wmi.service_ready);
diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h
index 21391929d318..bd7f29a3a122 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.h
+++ b/drivers/net/wireless/ath/ath10k/wmi.h
@@ -109,6 +109,45 @@ enum wmi_service {
         WMI_SERVICE_BURST,
         WMI_SERVICE_SMART_ANTENNA_SW_SUPPORT,
         WMI_SERVICE_SMART_ANTENNA_HW_SUPPORT,
+        WMI_SERVICE_ROAM_SCAN_OFFLOAD,
+        WMI_SERVICE_AP_PS_DETECT_OUT_OF_SYNC,
+        WMI_SERVICE_EARLY_RX,
+        WMI_SERVICE_STA_SMPS,
+        WMI_SERVICE_FWTEST,
+        WMI_SERVICE_STA_WMMAC,
+        WMI_SERVICE_TDLS,
+        WMI_SERVICE_MCC_BCN_INTERVAL_CHANGE,
+        WMI_SERVICE_ADAPTIVE_OCS,
+        WMI_SERVICE_BA_SSN_SUPPORT,
+        WMI_SERVICE_FILTER_IPSEC_NATKEEPALIVE,
+        WMI_SERVICE_WLAN_HB,
+        WMI_SERVICE_LTE_ANT_SHARE_SUPPORT,
+        WMI_SERVICE_BATCH_SCAN,
+        WMI_SERVICE_QPOWER,
+        WMI_SERVICE_PLMREQ,
+        WMI_SERVICE_THERMAL_MGMT,
+        WMI_SERVICE_RMC,
+        WMI_SERVICE_MHF_OFFLOAD,
+        WMI_SERVICE_COEX_SAR,
+        WMI_SERVICE_BCN_TXRATE_OVERRIDE,
+        WMI_SERVICE_NAN,
+        WMI_SERVICE_L1SS_STAT,
+        WMI_SERVICE_ESTIMATE_LINKSPEED,
+        WMI_SERVICE_OBSS_SCAN,
+        WMI_SERVICE_TDLS_OFFCHAN,
+        WMI_SERVICE_TDLS_UAPSD_BUFFER_STA,
+        WMI_SERVICE_TDLS_UAPSD_SLEEP_STA,
+        WMI_SERVICE_IBSS_PWRSAVE,
+        WMI_SERVICE_LPASS,
+        WMI_SERVICE_EXTSCAN,
+        WMI_SERVICE_D0WOW,
+        WMI_SERVICE_HSOFFLOAD,
+        WMI_SERVICE_ROAM_HO_OFFLOAD,
+        WMI_SERVICE_RX_FULL_REORDER,
+        WMI_SERVICE_DHCP_OFFLOAD,
+        WMI_SERVICE_STA_RX_IPA_OFFLOAD_SUPPORT,
+        WMI_SERVICE_MDNS_OFFLOAD,
+        WMI_SERVICE_SAP_AUTH_OFFLOAD,
 
         /* keep last */
         WMI_SERVICE_MAX,
@@ -215,6 +254,45 @@ static inline char *wmi_service_name(int service_id)
         SVCSTR(WMI_SERVICE_BURST);
         SVCSTR(WMI_SERVICE_SMART_ANTENNA_SW_SUPPORT);
         SVCSTR(WMI_SERVICE_SMART_ANTENNA_HW_SUPPORT);
+        SVCSTR(WMI_SERVICE_ROAM_SCAN_OFFLOAD);
+        SVCSTR(WMI_SERVICE_AP_PS_DETECT_OUT_OF_SYNC);
+        SVCSTR(WMI_SERVICE_EARLY_RX);
+        SVCSTR(WMI_SERVICE_STA_SMPS);
+        SVCSTR(WMI_SERVICE_FWTEST);
+        SVCSTR(WMI_SERVICE_STA_WMMAC);
+        SVCSTR(WMI_SERVICE_TDLS);
+        SVCSTR(WMI_SERVICE_MCC_BCN_INTERVAL_CHANGE);
+        SVCSTR(WMI_SERVICE_ADAPTIVE_OCS);
+        SVCSTR(WMI_SERVICE_BA_SSN_SUPPORT);
+        SVCSTR(WMI_SERVICE_FILTER_IPSEC_NATKEEPALIVE);
+        SVCSTR(WMI_SERVICE_WLAN_HB);
+        SVCSTR(WMI_SERVICE_LTE_ANT_SHARE_SUPPORT);
+        SVCSTR(WMI_SERVICE_BATCH_SCAN);
+        SVCSTR(WMI_SERVICE_QPOWER);
+        SVCSTR(WMI_SERVICE_PLMREQ);
+        SVCSTR(WMI_SERVICE_THERMAL_MGMT);
+        SVCSTR(WMI_SERVICE_RMC);
+        SVCSTR(WMI_SERVICE_MHF_OFFLOAD);
+        SVCSTR(WMI_SERVICE_COEX_SAR);
+        SVCSTR(WMI_SERVICE_BCN_TXRATE_OVERRIDE);
+        SVCSTR(WMI_SERVICE_NAN);
+        SVCSTR(WMI_SERVICE_L1SS_STAT);
+        SVCSTR(WMI_SERVICE_ESTIMATE_LINKSPEED);
+        SVCSTR(WMI_SERVICE_OBSS_SCAN);
+        SVCSTR(WMI_SERVICE_TDLS_OFFCHAN);
+        SVCSTR(WMI_SERVICE_TDLS_UAPSD_BUFFER_STA);
+        SVCSTR(WMI_SERVICE_TDLS_UAPSD_SLEEP_STA);
+        SVCSTR(WMI_SERVICE_IBSS_PWRSAVE);
+        SVCSTR(WMI_SERVICE_LPASS);
+        SVCSTR(WMI_SERVICE_EXTSCAN);
+        SVCSTR(WMI_SERVICE_D0WOW);
+        SVCSTR(WMI_SERVICE_HSOFFLOAD);
+        SVCSTR(WMI_SERVICE_ROAM_HO_OFFLOAD);
+        SVCSTR(WMI_SERVICE_RX_FULL_REORDER);
+        SVCSTR(WMI_SERVICE_DHCP_OFFLOAD);
+        SVCSTR(WMI_SERVICE_STA_RX_IPA_OFFLOAD_SUPPORT);
+        SVCSTR(WMI_SERVICE_MDNS_OFFLOAD);
+        SVCSTR(WMI_SERVICE_SAP_AUTH_OFFLOAD);
         default:
                 return NULL;
         }
@@ -472,6 +550,7 @@ struct wmi_cmd_map {
         u32 force_fw_hang_cmdid;
         u32 gpio_config_cmdid;
         u32 gpio_output_cmdid;
+        u32 pdev_get_temperature_cmdid;
 };
 
 /*
@@ -1076,6 +1155,11 @@ enum wmi_10_2_cmd_id {
         WMI_10_2_PDEV_SET_MIMOGAIN_TABLE_CMDID,
         WMI_10_2_PDEV_RATEPWR_TABLE_CMDID,
         WMI_10_2_PDEV_RATEPWR_CHAINMSK_TABLE_CMDID,
+        WMI_10_2_PDEV_GET_INFO,
+        WMI_10_2_VDEV_GET_INFO,
+        WMI_10_2_VDEV_ATF_REQUEST_CMDID,
+        WMI_10_2_PEER_ATF_REQUEST_CMDID,
+        WMI_10_2_PDEV_GET_TEMPERATURE_CMDID,
         WMI_10_2_PDEV_UTF_CMDID = WMI_10_2_END_CMDID - 1,
 };
 
@@ -1117,6 +1201,8 @@ enum wmi_10_2_event_id {
         WMI_10_2_MCAST_BUF_RELEASE_EVENTID,
         WMI_10_2_MCAST_LIST_AGEOUT_EVENTID,
         WMI_10_2_WDS_PEER_EVENTID,
+        WMI_10_2_PEER_STA_PS_STATECHG_EVENTID,
+        WMI_10_2_PDEV_TEMPERATURE_EVENTID,
         WMI_10_2_PDEV_UTF_EVENTID = WMI_10_2_END_EVENTID - 1,
 };
 
@@ -1862,6 +1948,11 @@ struct wmi_resource_config_10x {
         __le32 max_frag_entries;
 } __packed;
 
+enum wmi_10_2_feature_mask {
+        WMI_10_2_RX_BATCH_MODE = BIT(0),
+        WMI_10_2_ATF_CONFIG    = BIT(1),
+};
+
 struct wmi_resource_config_10_2 {
         struct wmi_resource_config_10x common;
         __le32 max_peer_ext_stats;
@@ -1870,7 +1961,7 @@ struct wmi_resource_config_10_2 {
         __le32 be_min_free;
         __le32 vi_min_free;
         __le32 vo_min_free;
-        __le32 rx_batchmode; /* 0-disable, 1-enable */
+        __le32 feature_mask;
 } __packed;
 
 #define NUM_UNITS_IS_NUM_VDEVS   0x1
@@ -2505,6 +2596,7 @@ struct wmi_pdev_param_map {
         u32 fast_channel_reset;
         u32 burst_dur;
         u32 burst_enable;
+        u32 cal_period;
 };
 
 #define WMI_PDEV_PARAM_UNSUPPORTED 0
@@ -2715,6 +2807,9 @@ enum wmi_10x_pdev_param {
         WMI_10X_PDEV_PARAM_SET_MCAST2UCAST_MODE,
         WMI_10X_PDEV_PARAM_SET_MCAST2UCAST_BUFFER,
         WMI_10X_PDEV_PARAM_REMOVE_MCAST2UCAST_BUFFER,
+        WMI_10X_PDEV_PARAM_PEER_STA_PS_STATECHG_ENABLE,
+        WMI_10X_PDEV_PARAM_RTS_FIXED_RATE,
+        WMI_10X_PDEV_PARAM_CAL_PERIOD
 };
 
 struct wmi_pdev_set_param_cmd {
@@ -2722,6 +2817,9 @@ struct wmi_pdev_set_param_cmd {
         __le32 param_value;
 } __packed;
 
+/* valid period is 1 ~ 60000ms, unit in millisecond */
+#define WMI_PDEV_PARAM_CAL_PERIOD_MAX 60000
+
 struct wmi_pdev_get_tpc_config_cmd {
         /* parameter   */
         __le32 param;
@@ -3930,6 +4028,13 @@ enum wmi_sta_ps_param_pspoll_count {
          * Values greater than 0 indicate the maximum numer of PS-Poll frames
          * FW will send before waking up.
          */
+
+        /* When u-APSD is enabled the firmware will be very reluctant to exit
+         * STA PS. This could result in very poor Rx performance with STA doing
+         * PS-Poll for each and every buffered frame. This value is a bit
+         * arbitrary.
+         */
+        WMI_STA_PS_PSPOLL_COUNT_UAPSD = 3,
 };
 
 /*
@@ -4120,7 +4225,7 @@ struct wmi_bcn_info {
 
 struct wmi_host_swba_event {
         __le32 vdev_map;
-        struct wmi_bcn_info bcn_info[1];
+        struct wmi_bcn_info bcn_info[0];
 } __packed;
 
 #define WMI_MAX_AP_VDEV 16
@@ -4567,6 +4672,58 @@ struct wmi_dbglog_cfg_cmd {
 
 #define WMI_MAX_MEM_REQS 16
 
+struct wmi_scan_ev_arg {
+        __le32 event_type; /* %WMI_SCAN_EVENT_ */
+        __le32 reason; /* %WMI_SCAN_REASON_ */
+        __le32 channel_freq; /* only valid for WMI_SCAN_EVENT_FOREIGN_CHANNEL */
+        __le32 scan_req_id;
+        __le32 scan_id;
+        __le32 vdev_id;
+};
+
+struct wmi_mgmt_rx_ev_arg {
+        __le32 channel;
+        __le32 snr;
+        __le32 rate;
+        __le32 phy_mode;
+        __le32 buf_len;
+        __le32 status; /* %WMI_RX_STATUS_ */
+};
+
+struct wmi_ch_info_ev_arg {
+        __le32 err_code;
+        __le32 freq;
+        __le32 cmd_flags;
+        __le32 noise_floor;
+        __le32 rx_clear_count;
+        __le32 cycle_count;
+};
+
+struct wmi_vdev_start_ev_arg {
+        __le32 vdev_id;
+        __le32 req_id;
+        __le32 resp_type; /* %WMI_VDEV_RESP_ */
+        __le32 status;
+};
+
+struct wmi_peer_kick_ev_arg {
+        const u8 *mac_addr;
+};
+
+struct wmi_swba_ev_arg {
+        __le32 vdev_map;
+        const struct wmi_tim_info *tim_info[WMI_MAX_AP_VDEV];
+        const struct wmi_p2p_noa_info *noa_info[WMI_MAX_AP_VDEV];
+};
+
+struct wmi_phyerr_ev_arg {
+        __le32 num_phyerrs;
+        __le32 tsf_l32;
+        __le32 tsf_u32;
+        __le32 buf_len;
+        const struct wmi_phyerr *phyerrs;
+};
+
 struct wmi_svc_rdy_ev_arg {
         __le32 min_tx_power;
         __le32 max_tx_power;
@@ -4574,6 +4731,7 @@ struct wmi_svc_rdy_ev_arg {
         __le32 vht_cap;
         __le32 sw_ver0;
         __le32 sw_ver1;
+        __le32 fw_build;
         __le32 phy_capab;
         __le32 num_rf_chains;
         __le32 eeprom_rd;
@@ -4583,83 +4741,93 @@ struct wmi_svc_rdy_ev_arg {
         const struct wlan_host_mem_req *mem_reqs[WMI_MAX_MEM_REQS];
 };
 
+struct wmi_rdy_ev_arg {
+        __le32 sw_version;
+        __le32 abi_version;
+        __le32 status;
+        const u8 *mac_addr;
+};
+
+struct wmi_pdev_temperature_event {
+        /* temperature value in Celcius degree */
+        __le32 temperature;
+} __packed;
+
 struct ath10k;
 struct ath10k_vif;
-struct ath10k_fw_stats;
+struct ath10k_fw_stats_pdev;
+struct ath10k_fw_stats_peer;
 
 int ath10k_wmi_attach(struct ath10k *ar);
 void ath10k_wmi_detach(struct ath10k *ar);
 int ath10k_wmi_wait_for_service_ready(struct ath10k *ar);
 int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar);
 
+struct sk_buff *ath10k_wmi_alloc_skb(struct ath10k *ar, u32 len);
 int ath10k_wmi_connect(struct ath10k *ar);
 
 struct sk_buff *ath10k_wmi_alloc_skb(struct ath10k *ar, u32 len);
 int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id);
-
-int ath10k_wmi_pdev_suspend_target(struct ath10k *ar, u32 suspend_opt);
-int ath10k_wmi_pdev_resume_target(struct ath10k *ar);
-int ath10k_wmi_pdev_set_regdomain(struct ath10k *ar, u16 rd, u16 rd2g,
-                                  u16 rd5g, u16 ctl2g, u16 ctl5g,
-                                  enum wmi_dfs_region dfs_reg);
-int ath10k_wmi_pdev_set_param(struct ath10k *ar, u32 id, u32 value);
-int ath10k_wmi_cmd_init(struct ath10k *ar);
-int ath10k_wmi_start_scan(struct ath10k *ar, const struct wmi_start_scan_arg *);
+int ath10k_wmi_cmd_send_nowait(struct ath10k *ar, struct sk_buff *skb,
+                               u32 cmd_id);
 void ath10k_wmi_start_scan_init(struct ath10k *ar, struct wmi_start_scan_arg *);
-int ath10k_wmi_stop_scan(struct ath10k *ar,
-                         const struct wmi_stop_scan_arg *arg);
-int ath10k_wmi_vdev_create(struct ath10k *ar, u32 vdev_id,
-                           enum wmi_vdev_type type,
-                           enum wmi_vdev_subtype subtype,
-                           const u8 macaddr[ETH_ALEN]);
-int ath10k_wmi_vdev_delete(struct ath10k *ar, u32 vdev_id);
-int ath10k_wmi_vdev_start(struct ath10k *ar,
-                          const struct wmi_vdev_start_request_arg *);
-int ath10k_wmi_vdev_restart(struct ath10k *ar,
-                            const struct wmi_vdev_start_request_arg *);
-int ath10k_wmi_vdev_stop(struct ath10k *ar, u32 vdev_id);
-int ath10k_wmi_vdev_up(struct ath10k *ar, u32 vdev_id, u32 aid,
-                       const u8 *bssid);
-int ath10k_wmi_vdev_down(struct ath10k *ar, u32 vdev_id);
-int ath10k_wmi_vdev_set_param(struct ath10k *ar, u32 vdev_id,
-                              u32 param_id, u32 param_value);
-int ath10k_wmi_vdev_install_key(struct ath10k *ar,
-                                const struct wmi_vdev_install_key_arg *arg);
-int ath10k_wmi_vdev_spectral_conf(struct ath10k *ar,
-                                  const struct wmi_vdev_spectral_conf_arg *arg);
-int ath10k_wmi_vdev_spectral_enable(struct ath10k *ar, u32 vdev_id, u32 trigger,
-                                    u32 enable);
-int ath10k_wmi_peer_create(struct ath10k *ar, u32 vdev_id,
-                           const u8 peer_addr[ETH_ALEN]);
-int ath10k_wmi_peer_delete(struct ath10k *ar, u32 vdev_id,
-                           const u8 peer_addr[ETH_ALEN]);
-int ath10k_wmi_peer_flush(struct ath10k *ar, u32 vdev_id,
-                          const u8 peer_addr[ETH_ALEN], u32 tid_bitmap);
-int ath10k_wmi_peer_set_param(struct ath10k *ar, u32 vdev_id,
-                              const u8 *peer_addr,
-                              enum wmi_peer_param param_id, u32 param_value);
-int ath10k_wmi_peer_assoc(struct ath10k *ar,
-                          const struct wmi_peer_assoc_complete_arg *arg);
-int ath10k_wmi_set_psmode(struct ath10k *ar, u32 vdev_id,
-                          enum wmi_sta_ps_mode psmode);
-int ath10k_wmi_set_sta_ps_param(struct ath10k *ar, u32 vdev_id,
-                                enum wmi_sta_powersave_param param_id,
-                                u32 value);
-int ath10k_wmi_set_ap_ps_param(struct ath10k *ar, u32 vdev_id, const u8 *mac,
-                               enum wmi_ap_ps_peer_param param_id, u32 value);
-int ath10k_wmi_scan_chan_list(struct ath10k *ar,
-                              const struct wmi_scan_chan_list_arg *arg);
-int ath10k_wmi_beacon_send_ref_nowait(struct ath10k_vif *arvif);
-int ath10k_wmi_pdev_set_wmm_params(struct ath10k *ar,
-                                   const struct wmi_pdev_set_wmm_params_arg *arg);
-int ath10k_wmi_request_stats(struct ath10k *ar, enum wmi_stats_id stats_id);
-int ath10k_wmi_force_fw_hang(struct ath10k *ar,
-                             enum wmi_force_fw_hang_type type, u32 delay_ms);
-int ath10k_wmi_mgmt_tx(struct ath10k *ar, struct sk_buff *skb);
-int ath10k_wmi_dbglog_cfg(struct ath10k *ar, u32 module_enable);
-int ath10k_wmi_pull_fw_stats(struct ath10k *ar, struct sk_buff *skb,
-                             struct ath10k_fw_stats *stats);
-int ath10k_wmi_pdev_pktlog_enable(struct ath10k *ar, u32 ev_list);
-int ath10k_wmi_pdev_pktlog_disable(struct ath10k *ar);
+
+void ath10k_wmi_pull_pdev_stats(const struct wmi_pdev_stats *src,
+                                struct ath10k_fw_stats_pdev *dst);
+void ath10k_wmi_pull_peer_stats(const struct wmi_peer_stats *src,
+                                struct ath10k_fw_stats_peer *dst);
+void ath10k_wmi_put_host_mem_chunks(struct ath10k *ar,
+                                    struct wmi_host_mem_chunks *chunks);
+void ath10k_wmi_put_start_scan_common(struct wmi_start_scan_common *cmn,
+                                      const struct wmi_start_scan_arg *arg);
+void ath10k_wmi_pdev_set_wmm_param(struct wmi_wmm_params *params,
+                                   const struct wmi_wmm_params_arg *arg);
+void ath10k_wmi_put_wmi_channel(struct wmi_channel *ch,
+                                const struct wmi_channel_arg *arg);
+int ath10k_wmi_start_scan_verify(const struct wmi_start_scan_arg *arg);
+
+int ath10k_wmi_event_scan(struct ath10k *ar, struct sk_buff *skb);
+int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_chan_info(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_echo(struct ath10k *ar, struct sk_buff *skb);
+int ath10k_wmi_event_debug_mesg(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_update_stats(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_vdev_start_resp(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_vdev_stopped(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_peer_sta_kickout(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_tbttoffset_update(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_dfs(struct ath10k *ar,
+                          const struct wmi_phyerr *phyerr, u64 tsf);
+void ath10k_wmi_event_spectral_scan(struct ath10k *ar,
+                                    const struct wmi_phyerr *phyerr,
+                                    u64 tsf);
+void ath10k_wmi_event_phyerr(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_roam(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_profile_match(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_debug_print(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_pdev_qvit(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_wlan_profile_data(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_rtt_measurement_report(struct ath10k *ar,
+                                             struct sk_buff *skb);
+void ath10k_wmi_event_tsf_measurement_report(struct ath10k *ar,
+                                             struct sk_buff *skb);
+void ath10k_wmi_event_rtt_error_report(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_wow_wakeup_host(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_dcs_interference(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_pdev_tpc_config(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_pdev_ftm_intg(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_gtk_offload_status(struct ath10k *ar,
+                                         struct sk_buff *skb);
+void ath10k_wmi_event_gtk_rekey_fail(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_delba_complete(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_addba_complete(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_vdev_install_key_complete(struct ath10k *ar,
+                                                struct sk_buff *skb);
+void ath10k_wmi_event_inst_rssi_stats(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_vdev_standby_req(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_vdev_resume_req(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_service_ready(struct ath10k *ar, struct sk_buff *skb);
+int ath10k_wmi_event_ready(struct ath10k *ar, struct sk_buff *skb);
 
 #endif /* _WMI_H_ */
diff --git a/drivers/net/wireless/ath/ath5k/ahb.c b/drivers/net/wireless/ath/ath5k/ahb.c
index 8f387cf67340..2ca88b593e4c 100644
--- a/drivers/net/wireless/ath/ath5k/ahb.c
+++ b/drivers/net/wireless/ath/ath5k/ahb.c
@@ -227,7 +227,6 @@ static struct platform_driver ath_ahb_driver = {
         .remove     = ath_ahb_remove,
         .driver         = {
                 .name   = "ar231x-wmac",
-                .owner  = THIS_MODULE,
         },
 };
 
diff --git a/drivers/net/wireless/ath/ath5k/pcu.c b/drivers/net/wireless/ath/ath5k/pcu.c
index c60d36aa13e2..bf29da5e90da 100644
--- a/drivers/net/wireless/ath/ath5k/pcu.c
+++ b/drivers/net/wireless/ath/ath5k/pcu.c
@@ -912,6 +912,7 @@ ath5k_hw_set_opmode(struct ath5k_hw *ah, enum nl80211_iftype op_mode)
                 pcu_reg |= AR5K_STA_ID1_KEYSRCH_MODE
                         | (ah->ah_version == AR5K_AR5210 ?
                                 AR5K_STA_ID1_PWR_SV : 0);
+                /* fall through */
         case NL80211_IFTYPE_MONITOR:
                 pcu_reg |= AR5K_STA_ID1_KEYSRCH_MODE
                         | (ah->ah_version == AR5K_AR5210 ?
diff --git a/drivers/net/wireless/ath/ath9k/ahb.c b/drivers/net/wireless/ath/ath9k/ahb.c
index e000c4c27881..bd4a1a655f42 100644
--- a/drivers/net/wireless/ath/ath9k/ahb.c
+++ b/drivers/net/wireless/ath/ath9k/ahb.c
@@ -43,6 +43,10 @@ static const struct platform_device_id ath9k_platform_id_table[] = {
                 .name = "qca953x_wmac",
                 .driver_data = AR9300_DEVID_AR953X,
         },
+        {
+                .name = "qca956x_wmac",
+                .driver_data = AR9300_DEVID_QCA956X,
+        },
         {},
 };
 
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index ba502a2d199b..ca01d17d130f 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -259,7 +259,8 @@ static void ath9k_hw_set_cck_nil(struct ath_hw *ah, u_int8_t immunityLevel,
                                      entry_cck->fir_step_level);
 
         /* Skip MRC CCK for pre AR9003 families */
-        if (!AR_SREV_9300_20_OR_LATER(ah) || AR_SREV_9485(ah) || AR_SREV_9565(ah))
+        if (!AR_SREV_9300_20_OR_LATER(ah) || AR_SREV_9485(ah) ||
+            AR_SREV_9565(ah) || AR_SREV_9561(ah))
                 return;
 
         if (aniState->mrcCCK != entry_cck->mrc_cck_on)
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index 5829074208fa..f273427fdd29 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -22,6 +22,21 @@
 
 /* All code below is for AR5008, AR9001, AR9002 */
 
+#define AR5008_OFDM_RATES               8
+#define AR5008_HT_SS_RATES              8
+#define AR5008_HT_DS_RATES              8
+
+#define AR5008_HT20_SHIFT               16
+#define AR5008_HT40_SHIFT               24
+
+#define AR5008_11NA_OFDM_SHIFT          0
+#define AR5008_11NA_HT_SS_SHIFT         8
+#define AR5008_11NA_HT_DS_SHIFT         16
+
+#define AR5008_11NG_OFDM_SHIFT          4
+#define AR5008_11NG_HT_SS_SHIFT         12
+#define AR5008_11NG_HT_DS_SHIFT         20
+
 static const int firstep_table[] =
 /* level:  0   1   2   3   4   5   6   7   8  */
         { -4, -2,  0,  2,  4,  6,  8, 10, 12 }; /* lvl 0-8, default 2 */
@@ -1235,6 +1250,71 @@ static void ar5008_hw_set_radar_conf(struct ath_hw *ah)
         conf->radar_inband = 8;
 }
 
+static void ar5008_hw_init_txpower_cck(struct ath_hw *ah, int16_t *rate_array)
+{
+#define CCK_DELTA(x) ((OLC_FOR_AR9280_20_LATER) ? max((x) - 2, 0) : (x))
+        ah->tx_power[0] = CCK_DELTA(rate_array[rate1l]);
+        ah->tx_power[1] = CCK_DELTA(min(rate_array[rate2l],
+                                        rate_array[rate2s]));
+        ah->tx_power[2] = CCK_DELTA(min(rate_array[rate5_5l],
+                                        rate_array[rate5_5s]));
+        ah->tx_power[3] = CCK_DELTA(min(rate_array[rate11l],
+                                        rate_array[rate11s]));
+#undef CCK_DELTA
+}
+
+static void ar5008_hw_init_txpower_ofdm(struct ath_hw *ah, int16_t *rate_array,
+                                        int offset)
+{
+        int i, idx = 0;
+
+        for (i = offset; i < offset + AR5008_OFDM_RATES; i++) {
+                ah->tx_power[i] = rate_array[idx];
+                idx++;
+        }
+}
+
+static void ar5008_hw_init_txpower_ht(struct ath_hw *ah, int16_t *rate_array,
+                                      int ss_offset, int ds_offset,
+                                      bool is_40, int ht40_delta)
+{
+        int i, mcs_idx = (is_40) ? AR5008_HT40_SHIFT : AR5008_HT20_SHIFT;
+
+        for (i = ss_offset; i < ss_offset + AR5008_HT_SS_RATES; i++) {
+                ah->tx_power[i] = rate_array[mcs_idx] + ht40_delta;
+                mcs_idx++;
+        }
+        memcpy(&ah->tx_power[ds_offset], &ah->tx_power[ss_offset],
+               AR5008_HT_SS_RATES);
+}
+
+void ar5008_hw_init_rate_txpower(struct ath_hw *ah, int16_t *rate_array,
+                                 struct ath9k_channel *chan, int ht40_delta)
+{
+        if (IS_CHAN_5GHZ(chan)) {
+                ar5008_hw_init_txpower_ofdm(ah, rate_array,
+                                            AR5008_11NA_OFDM_SHIFT);
+                if (IS_CHAN_HT20(chan) || IS_CHAN_HT40(chan)) {
+                        ar5008_hw_init_txpower_ht(ah, rate_array,
+                                                  AR5008_11NA_HT_SS_SHIFT,
+                                                  AR5008_11NA_HT_DS_SHIFT,
+                                                  IS_CHAN_HT40(chan),
+                                                  ht40_delta);
+                }
+        } else {
+                ar5008_hw_init_txpower_cck(ah, rate_array);
+                ar5008_hw_init_txpower_ofdm(ah, rate_array,
+                                            AR5008_11NG_OFDM_SHIFT);
+                if (IS_CHAN_HT20(chan) || IS_CHAN_HT40(chan)) {
+                        ar5008_hw_init_txpower_ht(ah, rate_array,
+                                                  AR5008_11NG_HT_SS_SHIFT,
+                                                  AR5008_11NG_HT_DS_SHIFT,
+                                                  IS_CHAN_HT40(chan),
+                                                  ht40_delta);
+                }
+        }
+}
+
 int ar5008_hw_attach_phy_ops(struct ath_hw *ah)
 {
         struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 08225a0067c2..8b4561e8ce1a 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -3536,7 +3536,7 @@ static void ar9003_hw_xpa_bias_level_apply(struct ath_hw *ah, bool is2ghz)
         int bias = ar9003_modal_header(ah, is2ghz)->xpaBiasLvl;
 
         if (AR_SREV_9485(ah) || AR_SREV_9330(ah) || AR_SREV_9340(ah) ||
-            AR_SREV_9531(ah))
+            AR_SREV_9531(ah) || AR_SREV_9561(ah))
                 REG_RMW_FIELD(ah, AR_CH0_TOP2, AR_CH0_TOP2_XPABIASLVL, bias);
         else if (AR_SREV_9462(ah) || AR_SREV_9550(ah) || AR_SREV_9565(ah))
                 REG_RMW_FIELD(ah, AR_CH0_TOP, AR_CH0_TOP_XPABIASLVL, bias);
@@ -3599,7 +3599,7 @@ static void ar9003_hw_ant_ctrl_apply(struct ath_hw *ah, bool is2ghz)
         if (AR_SREV_9462(ah) || AR_SREV_9565(ah)) {
                 REG_RMW_FIELD(ah, AR_PHY_SWITCH_COM,
                                 AR_SWITCH_TABLE_COM_AR9462_ALL, value);
-        } else if (AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
+        } else if (AR_SREV_9550(ah) || AR_SREV_9531(ah) || AR_SREV_9561(ah)) {
                 REG_RMW_FIELD(ah, AR_PHY_SWITCH_COM,
                                 AR_SWITCH_TABLE_COM_AR9550_ALL, value);
         } else
@@ -3929,9 +3929,13 @@ void ar9003_hw_internal_regulator_apply(struct ath_hw *ah)
                         REG_WRITE(ah, AR_PHY_PMU2, reg_pmu_set);
                         if (!is_pmu_set(ah, AR_PHY_PMU2, reg_pmu_set))
                                 return;
-                } else if (AR_SREV_9462(ah) || AR_SREV_9565(ah)) {
+                } else if (AR_SREV_9462(ah) || AR_SREV_9565(ah) ||
+                           AR_SREV_9561(ah)) {
                         reg_val = le32_to_cpu(pBase->swreg);
                         REG_WRITE(ah, AR_PHY_PMU1, reg_val);
+
+                        if (AR_SREV_9561(ah))
+                                REG_WRITE(ah, AR_PHY_PMU2, 0x10200000);
                 } else {
                         /* Internal regulator is ON. Write swreg register. */
                         reg_val = le32_to_cpu(pBase->swreg);
@@ -4034,7 +4038,8 @@ static void ar9003_hw_xpa_timing_control_apply(struct ath_hw *ah, bool is2ghz)
         if (!AR_SREV_9300(ah) &&
             !AR_SREV_9340(ah) &&
             !AR_SREV_9580(ah) &&
-            !AR_SREV_9531(ah))
+            !AR_SREV_9531(ah) &&
+            !AR_SREV_9561(ah))
                 return;
 
         xpa_ctl = ar9003_modal_header(ah, is2ghz)->txFrameToXpaOn;
@@ -4812,7 +4817,7 @@ static void ar9003_hw_power_control_override(struct ath_hw *ah,
         }
 
 tempslope:
-        if (AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
+        if (AR_SREV_9550(ah) || AR_SREV_9531(ah) || AR_SREV_9561(ah)) {
                 u8 txmask = (eep->baseEepHeader.txrxMask & 0xf0) >> 4;
 
                 /*
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_hw.c b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
index 06ad2172030e..4335ccbe7d7e 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
@@ -29,6 +29,7 @@
 #include "ar9565_1p0_initvals.h"
 #include "ar9565_1p1_initvals.h"
 #include "ar953x_initvals.h"
+#include "ar956x_initvals.h"
 
 /* General hardware code for the AR9003 hadware family */
 
@@ -358,6 +359,40 @@ static void ar9003_hw_init_mode_regs(struct ath_hw *ah)
 
                 INIT_INI_ARRAY(&ah->iniModesFastClock,
                                qca953x_1p0_modes_fast_clock);
+        } else if (AR_SREV_9561(ah)) {
+                INIT_INI_ARRAY(&ah->iniMac[ATH_INI_CORE],
+                               qca956x_1p0_mac_core);
+                INIT_INI_ARRAY(&ah->iniMac[ATH_INI_POST],
+                               qca956x_1p0_mac_postamble);
+
+                INIT_INI_ARRAY(&ah->iniBB[ATH_INI_CORE],
+                               qca956x_1p0_baseband_core);
+                INIT_INI_ARRAY(&ah->iniBB[ATH_INI_POST],
+                               qca956x_1p0_baseband_postamble);
+
+                INIT_INI_ARRAY(&ah->iniRadio[ATH_INI_CORE],
+                               qca956x_1p0_radio_core);
+                INIT_INI_ARRAY(&ah->iniRadio[ATH_INI_POST],
+                               qca956x_1p0_radio_postamble);
+
+                INIT_INI_ARRAY(&ah->iniSOC[ATH_INI_PRE],
+                               qca956x_1p0_soc_preamble);
+                INIT_INI_ARRAY(&ah->iniSOC[ATH_INI_POST],
+                               qca956x_1p0_soc_postamble);
+
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                               qca956x_1p0_common_wo_xlna_rx_gain_table);
+                INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
+                               qca956x_1p0_common_wo_xlna_rx_gain_bounds);
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               qca956x_1p0_modes_no_xpa_tx_gain_table);
+
+                INIT_INI_ARRAY(&ah->ini_dfs,
+                               qca956x_1p0_baseband_postamble_dfs_channel);
+                INIT_INI_ARRAY(&ah->iniCckfirJapan2484,
+                               qca956x_1p0_baseband_core_txfir_coeff_japan_2484);
+                INIT_INI_ARRAY(&ah->iniModesFastClock,
+                               qca956x_1p0_modes_fast_clock);
         } else if (AR_SREV_9580(ah)) {
                 /* mac */
                 INIT_INI_ARRAY(&ah->iniMac[ATH_INI_CORE],
@@ -544,6 +579,9 @@ static void ar9003_tx_gain_table_mode0(struct ath_hw *ah)
         else if (AR_SREV_9531_20(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                                qca953x_2p0_modes_xpa_tx_gain_table);
+        else if (AR_SREV_9561(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               qca956x_1p0_modes_xpa_tx_gain_table);
         else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9580_1p0_lowest_ob_db_tx_gain_table);
@@ -594,7 +632,10 @@ static void ar9003_tx_gain_table_mode1(struct ath_hw *ah)
                 else
                         INIT_INI_ARRAY(&ah->iniModesTxGain,
                                        qca953x_1p0_modes_no_xpa_tx_gain_table);
-        } else if (AR_SREV_9462_21(ah))
+        } else if (AR_SREV_9561(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               qca956x_1p0_modes_no_xpa_tx_gain_table);
+        else if (AR_SREV_9462_21(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9462_2p1_modes_high_ob_db_tx_gain);
         else if (AR_SREV_9462_20(ah))
@@ -628,6 +669,9 @@ static void ar9003_tx_gain_table_mode2(struct ath_hw *ah)
         else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9580_1p0_low_ob_db_tx_gain_table);
+        else if (AR_SREV_9561(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               qca956x_1p0_modes_no_xpa_low_ob_db_tx_gain_table);
         else if (AR_SREV_9565_11(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                                ar9565_1p1_modes_low_ob_db_tx_gain_table);
@@ -699,6 +743,9 @@ static void ar9003_tx_gain_table_mode5(struct ath_hw *ah)
         else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9580_1p0_type5_tx_gain_table);
+        else if (AR_SREV_9561(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               qca956x_1p0_modes_no_xpa_green_tx_gain_table);
         else if (AR_SREV_9300_22(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9300Modes_type5_tx_gain_table_2p2);
@@ -770,6 +817,13 @@ static void ar9003_rx_gain_table_mode0(struct ath_hw *ah)
                                qca953x_1p0_common_rx_gain_table);
                 INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
                                qca953x_1p0_common_rx_gain_bounds);
+        } else if (AR_SREV_9561(ah)) {
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                               qca956x_1p0_common_rx_gain_table);
+                INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
+                               qca956x_1p0_common_rx_gain_bounds);
+                INIT_INI_ARRAY(&ah->ini_modes_rxgain_5g_xlna,
+                               qca956x_1p0_xlna_only);
         } else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                                 ar9580_1p0_rx_gain_table);
@@ -825,6 +879,11 @@ static void ar9003_rx_gain_table_mode1(struct ath_hw *ah)
                                qca953x_2p0_common_wo_xlna_rx_gain_table);
                 INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
                                qca953x_2p0_common_wo_xlna_rx_gain_bounds);
+        } else if (AR_SREV_9561(ah)) {
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                               qca956x_1p0_common_wo_xlna_rx_gain_table);
+                INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
+                               qca956x_1p0_common_wo_xlna_rx_gain_bounds);
         } else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                         ar9580_1p0_wo_xlna_rx_gain_table);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index ae6cde273414..1ad66b76749b 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -183,7 +183,8 @@ static int ar9003_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan)
                         } else {
                                 channelSel = CHANSEL_2G(freq) >> 1;
                         }
-                } else if (AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
+                } else if (AR_SREV_9550(ah) || AR_SREV_9531(ah) ||
+                           AR_SREV_9561(ah)) {
                         if (ah->is_clk_25mhz)
                                 div = 75;
                         else
@@ -198,7 +199,8 @@ static int ar9003_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan)
                 /* Set to 2G mode */
                 bMode = 1;
         } else {
-                if ((AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah)) &&
+                if ((AR_SREV_9340(ah) || AR_SREV_9550(ah) ||
+                     AR_SREV_9531(ah) || AR_SREV_9561(ah)) &&
                     ah->is_clk_25mhz) {
                         channelSel = freq / 75;
                         chan_frac = ((freq % 75) * 0x20000) / 75;
@@ -265,7 +267,7 @@ static void ar9003_hw_spur_mitigate_mrc_cck(struct ath_hw *ah,
          */
 
         if (AR_SREV_9485(ah) || AR_SREV_9340(ah) || AR_SREV_9330(ah) ||
-            AR_SREV_9550(ah)) {
+            AR_SREV_9550(ah) || AR_SREV_9561(ah)) {
                 if (spur_fbin_ptr[0] == 0) /* No spur */
                         return;
                 max_spur_cnts = 5;
@@ -292,7 +294,7 @@ static void ar9003_hw_spur_mitigate_mrc_cck(struct ath_hw *ah,
 
                 negative = 0;
                 if (AR_SREV_9485(ah) || AR_SREV_9340(ah) || AR_SREV_9330(ah) ||
-                    AR_SREV_9550(ah))
+                    AR_SREV_9550(ah) || AR_SREV_9561(ah))
                         cur_bb_spur = ath9k_hw_fbin2freq(spur_fbin_ptr[i],
                                                          IS_CHAN_2GHZ(chan));
                 else
@@ -641,8 +643,10 @@ static void ar9003_hw_set_channel_regs(struct ath_hw *ah,
                 (REG_READ(ah, AR_PHY_GEN_CTRL) & AR_PHY_GC_ENABLE_DAC_FIFO);
 
         /* Enable 11n HT, 20 MHz */
-        phymode = AR_PHY_GC_HT_EN | AR_PHY_GC_SINGLE_HT_LTF1 |
-                  AR_PHY_GC_SHORT_GI_40 | enableDacFifo;
+        phymode = AR_PHY_GC_HT_EN | AR_PHY_GC_SHORT_GI_40 | enableDacFifo;
+
+        if (!AR_SREV_9561(ah))
+                phymode |= AR_PHY_GC_SINGLE_HT_LTF1;
 
         /* Configure baseband for dynamic 20/40 operation */
         if (IS_CHAN_HT40(chan)) {
@@ -745,7 +749,8 @@ static void ar9003_hw_override_ini(struct ath_hw *ah)
         else
                 ah->enabled_cals &= ~TX_CL_CAL;
 
-        if (AR_SREV_9340(ah) || AR_SREV_9531(ah) || AR_SREV_9550(ah)) {
+        if (AR_SREV_9340(ah) || AR_SREV_9531(ah) || AR_SREV_9550(ah) ||
+            AR_SREV_9561(ah)) {
                 if (ah->is_clk_25mhz) {
                         REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x17c << 1);
                         REG_WRITE(ah, AR_SLP32_MODE, 0x0010f3d7);
@@ -812,6 +817,19 @@ static int ar9550_hw_get_modes_txgain_index(struct ath_hw *ah,
         return ret;
 }
 
+static int ar9561_hw_get_modes_txgain_index(struct ath_hw *ah,
+                                            struct ath9k_channel *chan)
+{
+        if (IS_CHAN_2GHZ(chan)) {
+                if (IS_CHAN_HT40(chan))
+                        return 1;
+                else
+                        return 2;
+        }
+
+        return 0;
+}
+
 static void ar9003_doubler_fix(struct ath_hw *ah)
 {
         if (AR_SREV_9300(ah) || AR_SREV_9580(ah) || AR_SREV_9550(ah)) {
@@ -911,21 +929,29 @@ static int ar9003_hw_process_ini(struct ath_hw *ah,
                         REG_WRITE_ARRAY(&ah->ini_modes_rxgain_5g_xlna,
                                         modesIndex, regWrites);
                 }
+
+                if (AR_SREV_9561(ah) && (ar9003_hw_get_rx_gain_idx(ah) == 0))
+                        REG_WRITE_ARRAY(&ah->ini_modes_rxgain_5g_xlna,
+                                        modesIndex, regWrites);
         }
 
-        if (AR_SREV_9550(ah))
+        if (AR_SREV_9550(ah) || AR_SREV_9561(ah))
                 REG_WRITE_ARRAY(&ah->ini_modes_rx_gain_bounds, modesIndex,
                                 regWrites);
 
         /*
          * TXGAIN initvals.
          */
-        if (AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
+        if (AR_SREV_9550(ah) || AR_SREV_9531(ah) || AR_SREV_9561(ah)) {
                 int modes_txgain_index = 1;
 
                 if (AR_SREV_9550(ah))
                         modes_txgain_index = ar9550_hw_get_modes_txgain_index(ah, chan);
 
+                if (AR_SREV_9561(ah))
+                        modes_txgain_index =
+                                ar9561_hw_get_modes_txgain_index(ah, chan);
+
                 if (modes_txgain_index < 0)
                         return -EINVAL;
 
@@ -1989,7 +2015,8 @@ void ar9003_hw_attach_phy_ops(struct ath_hw *ah)
         priv_ops->rf_set_freq = ar9003_hw_set_channel;
         priv_ops->spur_mitigate_freq = ar9003_hw_spur_mitigate;
 
-        if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah))
+        if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah) ||
+            AR_SREV_9561(ah))
                 priv_ops->compute_pll_control = ar9003_hw_compute_pll_control_soc;
         else
                 priv_ops->compute_pll_control = ar9003_hw_compute_pll_control;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
index fd090b1f2d0f..c311b2bfdb00 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
@@ -454,7 +454,7 @@
 #define AR_PHY_GEN_CTRL          (AR_SM_BASE + 0x4)
 #define AR_PHY_MODE              (AR_SM_BASE + 0x8)
 #define AR_PHY_ACTIVE            (AR_SM_BASE + 0xc)
-#define AR_PHY_SPUR_MASK_A       (AR_SM_BASE + 0x20)
+#define AR_PHY_SPUR_MASK_A       (AR_SM_BASE + (AR_SREV_9561(ah) ? 0x18 : 0x20))
 #define AR_PHY_SPUR_MASK_B       (AR_SM_BASE + 0x24)
 #define AR_PHY_SPECTRAL_SCAN     (AR_SM_BASE + 0x28)
 #define AR_PHY_RADAR_BW_FILTER   (AR_SM_BASE + 0x2c)
@@ -506,7 +506,7 @@
 #define AR_PHY_TEST_CHAIN_SEL      0xC0000000
 #define AR_PHY_TEST_CHAIN_SEL_S    30
 
-#define AR_PHY_TEST_CTL_STATUS   (AR_SM_BASE + 0x164)
+#define AR_PHY_TEST_CTL_STATUS   (AR_SM_BASE + (AR_SREV_9561(ah) ? 0x160 : 0x164))
 #define AR_PHY_TEST_CTL_TSTDAC_EN         0x1
 #define AR_PHY_TEST_CTL_TSTDAC_EN_S       0
 #define AR_PHY_TEST_CTL_TX_OBS_SEL        0x1C
@@ -525,7 +525,7 @@
 
 #define AR_PHY_CHAN_STATUS       (AR_SM_BASE + 0x16c)
 
-#define AR_PHY_CHAN_INFO_MEMORY                         (AR_SM_BASE + 0x170)
+#define AR_PHY_CHAN_INFO_MEMORY (AR_SM_BASE + (AR_SREV_9561(ah) ? 0x16c : 0x170))
 #define AR_PHY_CHAN_INFO_MEMORY_CHANINFOMEM_S2_READ     0x00000008
 #define AR_PHY_CHAN_INFO_MEMORY_CHANINFOMEM_S2_READ_S   3
 
@@ -536,7 +536,7 @@
 #define AR_PHY_SCRAMBLER_SEED    (AR_SM_BASE + 0x190)
 #define AR_PHY_CCK_TX_CTRL       (AR_SM_BASE + 0x194)
 
-#define AR_PHY_HEAVYCLIP_CTL     (AR_SM_BASE + 0x1a4)
+#define AR_PHY_HEAVYCLIP_CTL     (AR_SM_BASE + (AR_SREV_9561(ah) ? 0x198 : 0x1a4))
 #define AR_PHY_HEAVYCLIP_20      (AR_SM_BASE + 0x1a8)
 #define AR_PHY_HEAVYCLIP_40      (AR_SM_BASE + 0x1ac)
 #define AR_PHY_ILLEGAL_TXRATE    (AR_SM_BASE + 0x1b0)
@@ -726,21 +726,24 @@
 
 #define AR_CH0_TOP2             (AR_SREV_9300(ah) ? 0x1628c : \
                                         (AR_SREV_9462(ah) ? 0x16290 : 0x16284))
-#define AR_CH0_TOP2_XPABIASLVL          0xf000
+#define AR_CH0_TOP2_XPABIASLVL          (AR_SREV_9561(ah) ? 0x1e00 : 0xf000)
 #define AR_CH0_TOP2_XPABIASLVL_S        12
 
 #define AR_CH0_XTAL             (AR_SREV_9300(ah) ? 0x16294 : \
-                                 ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x16298 : 0x16290))
+                                 ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x16298 : \
+                                  (AR_SREV_9561(ah) ? 0x162c0 : 0x16290)))
 #define AR_CH0_XTAL_CAPINDAC    0x7f000000
 #define AR_CH0_XTAL_CAPINDAC_S  24
 #define AR_CH0_XTAL_CAPOUTDAC   0x00fe0000
 #define AR_CH0_XTAL_CAPOUTDAC_S 17
 
-#define AR_PHY_PMU1             ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x16340 : 0x16c40)
+#define AR_PHY_PMU1             ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x16340 : \
+                                 (AR_SREV_9561(ah) ? 0x16cc0 : 0x16c40))
 #define AR_PHY_PMU1_PWD         0x1
 #define AR_PHY_PMU1_PWD_S       0
 
-#define AR_PHY_PMU2             ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x16344 : 0x16c44)
+#define AR_PHY_PMU2             ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x16344 : \
+                                 (AR_SREV_9561(ah) ? 0x16cc4 : 0x16c44))
 #define AR_PHY_PMU2_PGM         0x00200000
 #define AR_PHY_PMU2_PGM_S       21
 
diff --git a/drivers/net/wireless/ath/ath9k/ar956x_initvals.h b/drivers/net/wireless/ath/ath9k/ar956x_initvals.h
new file mode 100644
index 000000000000..c3a47eaaf0c0
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/ar956x_initvals.h
@@ -0,0 +1,1046 @@
+/*
+ * Copyright (c) 2010-2011 Atheros Communications Inc.
+ * Copyright (c) 2011-2012 Qualcomm Atheros Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef INITVALS_956X_H
+#define INITVALS_956X_H
+
+#define qca956x_1p0_mac_core ar955x_1p0_mac_core
+
+#define qca956x_1p0_mac_postamble ar9331_1p1_mac_postamble
+
+#define qca956x_1p0_soc_preamble ar955x_1p0_soc_preamble
+
+#define qca956x_1p0_soc_postamble ar9300_2p2_soc_postamble
+
+#define qca956x_1p0_common_wo_xlna_rx_gain_table ar9300Common_wo_xlna_rx_gain_table_2p2
+
+#define qca956x_1p0_baseband_postamble_dfs_channel ar9300_2p2_baseband_postamble_dfs_channel
+
+#define qca956x_1p0_common_wo_xlna_rx_gain_bounds ar955x_1p0_common_wo_xlna_rx_gain_bounds
+
+#define qca956x_1p0_common_rx_gain_bounds ar955x_1p0_common_rx_gain_bounds
+
+#define qca956x_1p0_modes_fast_clock ar9462_2p0_modes_fast_clock
+
+static const u32 qca956x_1p0_baseband_core[][2] = {
+        /* Addr      allmodes  */
+        {0x00009800, 0xafe68e30},
+        {0x00009804, 0xfd14e000},
+        {0x00009808, 0x9c0a9f6b},
+        {0x0000980c, 0x04900000},
+        {0x00009814, 0x0280c00a},
+        {0x00009818, 0x00000000},
+        {0x0000981c, 0x00020028},
+        {0x00009834, 0x6400a190},
+        {0x00009838, 0x0108ecff},
+        {0x0000983c, 0x14000600},
+        {0x00009880, 0x201fff00},
+        {0x00009884, 0x00001042},
+        {0x000098a4, 0x00200400},
+        {0x000098b0, 0x32840cbf},
+        {0x000098bc, 0x00000002},
+        {0x000098d0, 0x004b6a8e},
+        {0x000098d4, 0x00000820},
+        {0x000098dc, 0x00000000},
+        {0x000098f0, 0x00000000},
+        {0x000098f4, 0x00000000},
+        {0x00009c04, 0xff55ff55},
+        {0x00009c08, 0x0320ff55},
+        {0x00009c0c, 0x00000000},
+        {0x00009c10, 0x00000000},
+        {0x00009c14, 0x00046384},
+        {0x00009c18, 0x05b6b440},
+        {0x00009c1c, 0x00b6b440},
+        {0x00009d00, 0xc080a333},
+        {0x00009d04, 0x40206c10},
+        {0x00009d08, 0x009c4060},
+        {0x00009d0c, 0x9883800a},
+        {0x00009d10, 0x01834061},
+        {0x00009d14, 0x00c0040b},
+        {0x00009d18, 0x00000000},
+        {0x00009e08, 0x0038230c},
+        {0x00009e24, 0x990bb514},
+        {0x00009e28, 0x0c6f0000},
+        {0x00009e30, 0x06336f77},
+        {0x00009e34, 0x6af6532f},
+        {0x00009e38, 0x0cc80c00},
+        {0x00009e40, 0x0d261820},
+        {0x00009e4c, 0x00001004},
+        {0x00009e50, 0x00ff03f1},
+        {0x00009fc0, 0x813e4789},
+        {0x00009fc4, 0x0001efb5},
+        {0x00009fcc, 0x40000014},
+        {0x00009fd0, 0x02993b93},
+        {0x0000a20c, 0x00000000},
+        {0x0000a218, 0x00000000},
+        {0x0000a21c, 0x00000000},
+        {0x0000a228, 0x10002310},
+        {0x0000a23c, 0x00000000},
+        {0x0000a244, 0x0c000000},
+        {0x0000a248, 0x00000140},
+        {0x0000a2a0, 0x00000007},
+        {0x0000a2c0, 0x00000007},
+        {0x0000a2c8, 0x00000000},
+        {0x0000a2d4, 0x00000000},
+        {0x0000a2ec, 0x00000000},
+        {0x0000a2f0, 0x00000000},
+        {0x0000a2f4, 0x00000000},
+        {0x0000a2f8, 0x00000000},
+        {0x0000a344, 0x00000000},
+        {0x0000a34c, 0x00000000},
+        {0x0000a350, 0x0000a000},
+        {0x0000a360, 0x00000000},
+        {0x0000a36c, 0x00000000},
+        {0x0000a384, 0x00000001},
+        {0x0000a388, 0x00000444},
+        {0x0000a38c, 0x00000000},
+        {0x0000a390, 0x210d0401},
+        {0x0000a394, 0xab9a7144},
+        {0x0000a398, 0x00000201},
+        {0x0000a39c, 0x42424848},
+        {0x0000a3a0, 0x3c466478},
+        {0x0000a3a4, 0x3a363600},
+        {0x0000a3a8, 0x0000003a},
+        {0x0000a3ac, 0x00000000},
+        {0x0000a3b0, 0x009011fe},
+        {0x0000a3b4, 0x00000034},
+        {0x0000a3b8, 0x00b3ec0a},
+        {0x0000a3bc, 0x00000036},
+        {0x0000a3c0, 0x20202020},
+        {0x0000a3c4, 0x22222220},
+        {0x0000a3c8, 0x20200020},
+        {0x0000a3cc, 0x20202020},
+        {0x0000a3d0, 0x20202020},
+        {0x0000a3d4, 0x20202020},
+        {0x0000a3d8, 0x20202020},
+        {0x0000a3dc, 0x20202020},
+        {0x0000a3e0, 0x20202020},
+        {0x0000a3e4, 0x20202020},
+        {0x0000a3e8, 0x20202020},
+        {0x0000a3ec, 0x20202020},
+        {0x0000a3f0, 0x00000000},
+        {0x0000a3f4, 0x00000000},
+        {0x0000a3f8, 0x0c9bd380},
+        {0x0000a3fc, 0x000f0f01},
+        {0x0000a400, 0x8fa91f01},
+        {0x0000a404, 0x00000000},
+        {0x0000a408, 0x0e79e5c6},
+        {0x0000a40c, 0x00820820},
+        {0x0000a414, 0x1ce739ce},
+        {0x0000a418, 0x2d0019ce},
+        {0x0000a41c, 0x1ce739ce},
+        {0x0000a420, 0x000001ce},
+        {0x0000a424, 0x1ce739ce},
+        {0x0000a428, 0x000001ce},
+        {0x0000a42c, 0x1ce739ce},
+        {0x0000a430, 0x1ce739ce},
+        {0x0000a434, 0x00000000},
+        {0x0000a438, 0x00001801},
+        {0x0000a43c, 0x00100000},
+        {0x0000a444, 0x00000000},
+        {0x0000a448, 0x05000080},
+        {0x0000a44c, 0x00000001},
+        {0x0000a450, 0x00010000},
+        {0x0000a454, 0x05000000},
+        {0x0000a458, 0x00000000},
+        {0x0000a644, 0xbfad9fee},
+        {0x0000a648, 0x0048660d},
+        {0x0000a64c, 0x00003c37},
+        {0x0000a670, 0x03020100},
+        {0x0000a674, 0x21200504},
+        {0x0000a678, 0x61602322},
+        {0x0000a67c, 0x65646362},
+        {0x0000a680, 0x6b6a6968},
+        {0x0000a684, 0xe2706d6c},
+        {0x0000a688, 0x000000e3},
+        {0x0000a690, 0x00000838},
+        {0x0000a7cc, 0x00000000},
+        {0x0000a7d0, 0x00000000},
+        {0x0000a7d4, 0x00000004},
+        {0x0000a7dc, 0x00000000},
+        {0x0000a8d0, 0x004b6a8e},
+        {0x0000a8d4, 0x00000820},
+        {0x0000a8dc, 0x00000000},
+        {0x0000a8f0, 0x00000000},
+        {0x0000a8f4, 0x00000000},
+        {0x0000b2d0, 0x00000080},
+        {0x0000b2d4, 0x00000000},
+        {0x0000b2ec, 0x00000000},
+        {0x0000b2f0, 0x00000000},
+        {0x0000b2f4, 0x00000000},
+        {0x0000b2f8, 0x00000000},
+        {0x0000b408, 0x0e79e5c0},
+        {0x0000b40c, 0x00820820},
+        {0x0000b420, 0x00000000},
+        {0x0000b8d0, 0x004b6a8e},
+        {0x0000b8d4, 0x00000820},
+        {0x0000b8dc, 0x00000000},
+        {0x0000b8f0, 0x00000000},
+        {0x0000b8f4, 0x00000000},
+        {0x0000c2d0, 0x00000080},
+        {0x0000c2d4, 0x00000000},
+        {0x0000c2ec, 0x00000000},
+        {0x0000c2f0, 0x00000000},
+        {0x0000c2f4, 0x00000000},
+        {0x0000c2f8, 0x00000000},
+        {0x0000c408, 0x0e79e5c0},
+        {0x0000c40c, 0x00820820},
+        {0x0000c420, 0x00000000},
+};
+
+static const u32 qca956x_1p0_baseband_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00009810, 0xd00a8005, 0xd00a8005, 0xd00a8011, 0xd00a8011},
+        {0x00009820, 0x206a022e, 0x206a022e, 0x206a01ae, 0x206a01ae},
+        {0x00009824, 0x5ac640d0, 0x5ac640d0, 0x5ac621f1, 0x5ac621f1},
+        {0x00009828, 0x06903081, 0x06903081, 0x07d43881, 0x07d43881},
+        {0x0000982c, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4},
+        {0x00009830, 0x0000059c, 0x0000059c, 0x0000119c, 0x0000119c},
+        {0x00009c00, 0x000000c4, 0x000000c4, 0x000000c4, 0x000000c4},
+        {0x00009e00, 0x0372111a, 0x0372111a, 0x037216a0, 0x037216a0},
+        {0x00009e04, 0x001c2020, 0x001c2020, 0x001c2020, 0x001c2020},
+        {0x00009e0c, 0x6c4000e2, 0x6d4000e2, 0x6d4000de, 0x6c4000de},
+        {0x00009e10, 0x7ec88d2e, 0x7ec88d2e, 0x7ec84d2e, 0x7ec86d2e},
+        {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x337d605e, 0x337d5d5e},
+        {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
+        {0x00009e20, 0x000003b5, 0x000003b5, 0x000003a6, 0x000003a6},
+        {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
+        {0x00009e3c, 0xcfa10820, 0xcfa10820, 0xcf946222, 0xcf946222},
+        {0x00009e44, 0xfe321e27, 0xfe321e27, 0xfe291e27, 0xfe291e27},
+        {0x00009e48, 0x5030201a, 0x5030201a, 0x50302012, 0x50302012},
+        {0x00009fc8, 0x0003f000, 0x0003f000, 0x0001a000, 0x0001a000},
+        {0x0000a204, 0x005c0ec0, 0x005c0ec4, 0x045c0cc4, 0x045c0cc0},
+        {0x0000a208, 0x00000104, 0x00000104, 0x00000004, 0x00000004},
+        {0x0000a22c, 0x07e26a2f, 0x07e26a2f, 0x01026a2f, 0x01026a2f},
+        {0x0000a230, 0x0000400a, 0x00004014, 0x00004016, 0x0000400b},
+        {0x0000a234, 0x00000fff, 0x10000fff, 0x10000fff, 0x00000fff},
+        {0x0000a238, 0xffb01018, 0xffb01018, 0xffb01018, 0xffb01018},
+        {0x0000a250, 0x00000000, 0x00000000, 0x00000210, 0x00000108},
+        {0x0000a254, 0x000007d0, 0x00000fa0, 0x00001130, 0x00000898},
+        {0x0000a258, 0x02020002, 0x02020002, 0x02020002, 0x02020002},
+        {0x0000a25c, 0x01000e0e, 0x01000e0e, 0x01010e0e, 0x01010e0e},
+        {0x0000a260, 0x0a021501, 0x0a021501, 0x3a021501, 0x3a021501},
+        {0x0000a264, 0x00000e0e, 0x00000e0e, 0x01000e0e, 0x01000e0e},
+        {0x0000a280, 0x00000007, 0x00000007, 0x0000000b, 0x0000000b},
+        {0x0000a284, 0x00000000, 0x00000000, 0x00000010, 0x00000010},
+        {0x0000a288, 0x00000110, 0x00000110, 0x00000110, 0x00000110},
+        {0x0000a28c, 0x00022222, 0x00022222, 0x00022222, 0x00022222},
+        {0x0000a2c4, 0x00058d18, 0x00058d18, 0x00058d18, 0x00058d18},
+        {0x0000a2cc, 0x18c50033, 0x18c43433, 0x18c41033, 0x18c44c33},
+        {0x0000a2d0, 0x00041982, 0x00041982, 0x00041982, 0x00041982},
+        {0x0000a2d8, 0x7999a83b, 0x7999a83b, 0x7999a83b, 0x7999a83b},
+        {0x0000a358, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a830, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000ae04, 0x001c0000, 0x001c0000, 0x001c0000, 0x001c0000},
+        {0x0000ae18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000ae1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000ae20, 0x000001b5, 0x000001b5, 0x000001a6, 0x000001a6},
+        {0x0000b284, 0x00000000, 0x00000000, 0x00000010, 0x00000010},
+        {0x0000b830, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000be04, 0x001c0000, 0x001c0000, 0x001c0000, 0x001c0000},
+        {0x0000be18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000be1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000be20, 0x000001b5, 0x000001b5, 0x000001a6, 0x000001a6},
+        {0x0000c284, 0x00000000, 0x00000000, 0x00000010, 0x00000010},
+};
+
+static const u32 qca956x_1p0_radio_core[][2] = {
+        /* Addr      allmodes  */
+        {0x00016000, 0x36db6db6},
+        {0x00016004, 0x6db6db40},
+        {0x00016008, 0x73f00000},
+        {0x0001600c, 0x00000000},
+        {0x00016040, 0x3f80fff8},
+        {0x0001604c, 0x000f0278},
+        {0x00016050, 0x8036db6c},
+        {0x00016054, 0x6db60000},
+        {0x00016080, 0x00080000},
+        {0x00016084, 0x0e48048c},
+        {0x00016088, 0x14214514},
+        {0x0001608c, 0x119f080a},
+        {0x00016090, 0x24926490},
+        {0x00016094, 0x00000000},
+        {0x000160a0, 0xc2108ffe},
+        {0x000160a4, 0x812fc370},
+        {0x000160a8, 0x423c8000},
+        {0x000160b4, 0x92480000},
+        {0x000160c0, 0x006db6d8},
+        {0x000160c4, 0x24b6db6c},
+        {0x000160c8, 0x6db6db6c},
+        {0x000160cc, 0x6db6fb7c},
+        {0x000160d0, 0x6db6da44},
+        {0x00016100, 0x07ff8001},
+        {0x00016108, 0x00080010},
+        {0x00016144, 0x01884080},
+        {0x00016148, 0x00008058},
+        {0x00016288, 0x001c6000},
+        {0x0001628c, 0x50000000},
+        {0x000162c0, 0x4b962100},
+        {0x000162c4, 0x00000480},
+        {0x000162c8, 0x04000144},
+        {0x00016380, 0x00000000},
+        {0x00016384, 0x00000000},
+        {0x00016388, 0x00800700},
+        {0x0001638c, 0x00800700},
+        {0x00016390, 0x00800700},
+        {0x00016394, 0x00000000},
+        {0x00016398, 0x00000000},
+        {0x0001639c, 0x00000000},
+        {0x000163a0, 0x00000001},
+        {0x000163a4, 0x00000001},
+        {0x000163a8, 0x00000000},
+        {0x000163ac, 0x00000000},
+        {0x000163b0, 0x00000000},
+        {0x000163b4, 0x00000000},
+        {0x000163b8, 0x00000000},
+        {0x000163bc, 0x00000000},
+        {0x000163c0, 0x000000a0},
+        {0x000163c4, 0x000c0000},
+        {0x000163c8, 0x14021402},
+        {0x000163cc, 0x00001402},
+        {0x000163d0, 0x00000000},
+        {0x000163d4, 0x00000000},
+        {0x00016400, 0x36db6db6},
+        {0x00016404, 0x6db6db40},
+        {0x00016408, 0x73f00000},
+        {0x0001640c, 0x00000000},
+        {0x00016440, 0x3f80fff8},
+        {0x0001644c, 0x000f0278},
+        {0x00016450, 0x8036db6c},
+        {0x00016454, 0x6db60000},
+        {0x00016500, 0x07ff8001},
+        {0x00016508, 0x00080010},
+        {0x00016544, 0x01884080},
+        {0x00016548, 0x00008058},
+        {0x00016780, 0x00000000},
+        {0x00016784, 0x00000000},
+        {0x00016788, 0x00800700},
+        {0x0001678c, 0x00800700},
+        {0x00016790, 0x00800700},
+        {0x00016794, 0x00000000},
+        {0x00016798, 0x00000000},
+        {0x0001679c, 0x00000000},
+        {0x000167a0, 0x00000001},
+        {0x000167a4, 0x00000001},
+        {0x000167a8, 0x00000000},
+        {0x000167ac, 0x00000000},
+        {0x000167b0, 0x00000000},
+        {0x000167b4, 0x00000000},
+        {0x000167b8, 0x00000000},
+        {0x000167bc, 0x00000000},
+        {0x000167c0, 0x000000a0},
+        {0x000167c4, 0x000c0000},
+        {0x000167c8, 0x14021402},
+        {0x000167cc, 0x00001402},
+        {0x000167d0, 0x00000000},
+        {0x000167d4, 0x00000000},
+        {0x00016800, 0x36db6db6},
+        {0x00016804, 0x6db6db40},
+        {0x00016808, 0x73f00000},
+        {0x0001680c, 0x00000000},
+        {0x00016840, 0x3f80fff8},
+        {0x0001684c, 0x000f0278},
+        {0x00016850, 0x8036db6c},
+        {0x00016854, 0x6db60000},
+        {0x00016900, 0x07ff8001},
+        {0x00016908, 0x00080010},
+        {0x00016944, 0x01884080},
+        {0x00016948, 0x00008058},
+        {0x00016b80, 0x00000000},
+        {0x00016b84, 0x00000000},
+        {0x00016b88, 0x00800700},
+        {0x00016b8c, 0x00800700},
+        {0x00016b90, 0x00800700},
+        {0x00016b94, 0x00000000},
+        {0x00016b98, 0x00000000},
+        {0x00016b9c, 0x00000000},
+        {0x00016ba0, 0x00000001},
+        {0x00016ba4, 0x00000001},
+        {0x00016ba8, 0x00000000},
+        {0x00016bac, 0x00000000},
+        {0x00016bb0, 0x00000000},
+        {0x00016bb4, 0x00000000},
+        {0x00016bb8, 0x00000000},
+        {0x00016bbc, 0x00000000},
+        {0x00016bc0, 0x000000a0},
+        {0x00016bc4, 0x000c0000},
+        {0x00016bc8, 0x14021402},
+        {0x00016bcc, 0x00001402},
+        {0x00016bd0, 0x00000000},
+        {0x00016bd4, 0x00000000},
+};
+
+static const u32 qca956x_1p0_radio_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00016098, 0xd2dd5554, 0xd2dd5554, 0xc4128f5c, 0xc4128f5c},
+        {0x0001609c, 0x0a566f3a, 0x0a566f3a, 0x0fd08f25, 0x0fd08f25},
+        {0x000160ac, 0xa4647c00, 0xa4647c00, 0x24646800, 0x24646800},
+        {0x000160b0, 0x01885f52, 0x01885f52, 0x00fe7f46, 0x00fe7f46},
+        {0x00016104, 0xb7a00000, 0xb7a00000, 0xfff80001, 0xfff80001},
+        {0x0001610c, 0xc0000000, 0xc0000000, 0x00000000, 0x00000000},
+        {0x00016140, 0x10804008, 0x10804008, 0x50804000, 0x50804000},
+        {0x00016504, 0xb7a00000, 0xb7a00000, 0xfff80001, 0xfff80001},
+        {0x0001650c, 0xc0000000, 0xc0000000, 0x00000000, 0x00000000},
+        {0x00016540, 0x10804008, 0x10804008, 0x50804000, 0x50804000},
+        {0x00016904, 0xb7a00000, 0xb7a00000, 0xfff80001, 0xfff80001},
+        {0x0001690c, 0xc0000000, 0xc0000000, 0x00000000, 0x00000000},
+        {0x00016940, 0x10804008, 0x10804008, 0x50804000, 0x50804000},
+};
+
+static const u32 qca956x_1p0_baseband_core_txfir_coeff_japan_2484[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a38c, 0x00000000},
+        {0x0000a390, 0x6f7f0301},
+        {0x0000a394, 0xca9228ee},
+};
+
+static const u32 qca956x_1p0_modes_no_xpa_tx_gain_table[][3] = {
+        /* Addr      5G          2G        */
+        {0x0000a2dc, 0xffa9ac94, 0xffa9ac94},
+        {0x0000a2e0, 0xff323118, 0xff323118},
+        {0x0000a2e4, 0xff3ffe00, 0xff3ffe00},
+        {0x0000a2e8, 0xffc00000, 0xffc00000},
+        {0x0000a39c, 0x42424242, 0x42424242},
+        {0x0000a3a4, 0x3a3e3e00, 0x3a3e3e00},
+        {0x0000a3b0, 0x00a01404, 0x00a01404},
+        {0x0000a3b4, 0x00000034, 0x00000034},
+        {0x0000a3b8, 0x00800408, 0x00800408},
+        {0x0000a3bc, 0x00000036, 0x00000036},
+        {0x0000a410, 0x000050dc, 0x000050dc},
+        {0x0000a500, 0x09000040, 0x09000040},
+        {0x0000a504, 0x0b000041, 0x0b000041},
+        {0x0000a508, 0x0d000042, 0x0d000042},
+        {0x0000a50c, 0x11000044, 0x11000044},
+        {0x0000a510, 0x15000046, 0x15000046},
+        {0x0000a514, 0x1d000440, 0x1d000440},
+        {0x0000a518, 0x1f000441, 0x1f000441},
+        {0x0000a51c, 0x23000443, 0x23000443},
+        {0x0000a520, 0x25000444, 0x25000444},
+        {0x0000a524, 0x280004e0, 0x280004e0},
+        {0x0000a528, 0x2c0004e2, 0x2c0004e2},
+        {0x0000a52c, 0x2e0004e3, 0x2e0004e3},
+        {0x0000a530, 0x300004e4, 0x300004e4},
+        {0x0000a534, 0x340004e6, 0x340004e6},
+        {0x0000a538, 0x37000ce0, 0x37000ce0},
+        {0x0000a53c, 0x3b000ce2, 0x3b000ce2},
+        {0x0000a540, 0x3d000ce3, 0x3d000ce3},
+        {0x0000a544, 0x3f000ce4, 0x3f000ce4},
+        {0x0000a548, 0x45001ee0, 0x45001ee0},
+        {0x0000a54c, 0x49001ee2, 0x49001ee2},
+        {0x0000a550, 0x4d001ee4, 0x4d001ee4},
+        {0x0000a554, 0x51001ee6, 0x51001ee6},
+        {0x0000a558, 0x55001eea, 0x55001eea},
+        {0x0000a55c, 0x59001eec, 0x59001eec},
+        {0x0000a560, 0x5d001ef0, 0x5d001ef0},
+        {0x0000a564, 0x5f001ef1, 0x5f001ef1},
+        {0x0000a568, 0x60001ef2, 0x60001ef2},
+        {0x0000a56c, 0x61001ef3, 0x61001ef3},
+        {0x0000a570, 0x62001ef4, 0x62001ef4},
+        {0x0000a574, 0x63001ef5, 0x63001ef5},
+        {0x0000a578, 0x64001ffc, 0x64001ffc},
+        {0x0000a57c, 0x64001ffc, 0x64001ffc},
+        {0x0000a600, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00804000, 0x00804000},
+        {0x0000a614, 0x00804201, 0x00804201},
+        {0x0000a618, 0x00804201, 0x00804201},
+        {0x0000a61c, 0x00804201, 0x00804201},
+        {0x0000a620, 0x00804201, 0x00804201},
+        {0x0000a624, 0x00804201, 0x00804201},
+        {0x0000a628, 0x00804201, 0x00804201},
+        {0x0000a62c, 0x02808a02, 0x02808a02},
+        {0x0000a630, 0x0340cd03, 0x0340cd03},
+        {0x0000a634, 0x0340cd03, 0x0340cd03},
+        {0x0000a638, 0x0340cd03, 0x0340cd03},
+        {0x0000a63c, 0x05011404, 0x05011404},
+        {0x0000b2dc, 0xffa9ac94, 0xffa9ac94},
+        {0x0000b2e0, 0xff323118, 0xff323118},
+        {0x0000b2e4, 0xff3ffe00, 0xff3ffe00},
+        {0x0000b2e8, 0xffc00000, 0xffc00000},
+        {0x0000c2dc, 0xffa9ac94, 0xffa9ac94},
+        {0x0000c2e0, 0xff323118, 0xff323118},
+        {0x0000c2e4, 0xff3ffe00, 0xff3ffe00},
+        {0x0000c2e8, 0xffc00000, 0xffc00000},
+        {0x00016044, 0x049242db, 0x049242db},
+        {0x00016048, 0x64925a70, 0x64925a70},
+        {0x00016148, 0x00008050, 0x00008050},
+        {0x00016280, 0x41110005, 0x41110005},
+        {0x00016284, 0x453a6000, 0x453a6000},
+        {0x00016444, 0x049242db, 0x049242db},
+        {0x00016448, 0x6c925a70, 0x6c925a70},
+        {0x00016548, 0x00008050, 0x00008050},
+        {0x00016844, 0x049242db, 0x049242db},
+        {0x00016848, 0x6c925a70, 0x6c925a70},
+        {0x00016948, 0x00008050, 0x00008050},
+};
+
+static const u32 qca956x_1p0_modes_xpa_tx_gain_table[][3] = {
+        /* Addr      5G          2G        */
+        {0x0000a2dc, 0xcc69ac94, 0xcc69ac94},
+        {0x0000a2e0, 0xf0b23118, 0xf0b23118},
+        {0x0000a2e4, 0xffffc000, 0xffffc000},
+        {0x0000a2e8, 0xc0000000, 0xc0000000},
+        {0x0000a410, 0x000050d2, 0x000050d2},
+        {0x0000a500, 0x0a000040, 0x0a000040},
+        {0x0000a504, 0x0c000041, 0x0c000041},
+        {0x0000a508, 0x0e000042, 0x0e000042},
+        {0x0000a50c, 0x12000044, 0x12000044},
+        {0x0000a510, 0x16000046, 0x16000046},
+        {0x0000a514, 0x1d000440, 0x1d000440},
+        {0x0000a518, 0x1f000441, 0x1f000441},
+        {0x0000a51c, 0x23000443, 0x23000443},
+        {0x0000a520, 0x25000444, 0x25000444},
+        {0x0000a524, 0x29000a40, 0x29000a40},
+        {0x0000a528, 0x2d000a42, 0x2d000a42},
+        {0x0000a52c, 0x2f000a43, 0x2f000a43},
+        {0x0000a530, 0x31000a44, 0x31000a44},
+        {0x0000a534, 0x35000a46, 0x35000a46},
+        {0x0000a538, 0x38000ce0, 0x38000ce0},
+        {0x0000a53c, 0x3c000ce2, 0x3c000ce2},
+        {0x0000a540, 0x3e000ce3, 0x3e000ce3},
+        {0x0000a544, 0x40000ce4, 0x40000ce4},
+        {0x0000a548, 0x46001ee0, 0x46001ee0},
+        {0x0000a54c, 0x4a001ee2, 0x4a001ee2},
+        {0x0000a550, 0x4e001ee4, 0x4e001ee4},
+        {0x0000a554, 0x52001ee6, 0x52001ee6},
+        {0x0000a558, 0x56001eea, 0x56001eea},
+        {0x0000a55c, 0x5a001eec, 0x5a001eec},
+        {0x0000a560, 0x5e001ef0, 0x5e001ef0},
+        {0x0000a564, 0x60001ef1, 0x60001ef1},
+        {0x0000a568, 0x61001ef2, 0x61001ef2},
+        {0x0000a56c, 0x62001ef3, 0x62001ef3},
+        {0x0000a570, 0x63001ef4, 0x63001ef4},
+        {0x0000a574, 0x64001ef5, 0x64001ef5},
+        {0x0000a578, 0x65001ffc, 0x65001ffc},
+        {0x0000a57c, 0x65001ffc, 0x65001ffc},
+        {0x0000a600, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00000000, 0x00000000},
+        {0x0000a614, 0x00000000, 0x00000000},
+        {0x0000a618, 0x00000000, 0x00000000},
+        {0x0000a61c, 0x00804201, 0x00804201},
+        {0x0000a620, 0x00804201, 0x00804201},
+        {0x0000a624, 0x00804201, 0x00804201},
+        {0x0000a628, 0x00804201, 0x00804201},
+        {0x0000a62c, 0x02808a02, 0x02808a02},
+        {0x0000a630, 0x0340cd03, 0x0340cd03},
+        {0x0000a634, 0x0340cd03, 0x0340cd03},
+        {0x0000a638, 0x0340cd03, 0x0340cd03},
+        {0x0000a63c, 0x05011404, 0x05011404},
+        {0x0000b2dc, 0xcc69ac94, 0xcc69ac94},
+        {0x0000b2e0, 0xf0b23118, 0xf0b23118},
+        {0x0000b2e4, 0xffffc000, 0xffffc000},
+        {0x0000b2e8, 0xc0000000, 0xc0000000},
+        {0x0000c2dc, 0xcc69ac94, 0xcc69ac94},
+        {0x0000c2e0, 0xf0b23118, 0xf0b23118},
+        {0x0000c2e4, 0xffffc000, 0xffffc000},
+        {0x0000c2e8, 0xc0000000, 0xc0000000},
+        {0x00016044, 0x012492db, 0x012492db},
+        {0x00016048, 0x6c927a70, 0x6c927a70},
+        {0x00016050, 0x8036d36c, 0x8036d36c},
+        {0x00016280, 0x41110005, 0x41110005},
+        {0x00016284, 0x453a7e00, 0x453a7e00},
+        {0x00016444, 0x012492db, 0x012492db},
+        {0x00016448, 0x6c927a70, 0x6c927a70},
+        {0x00016450, 0x8036d36c, 0x8036d36c},
+        {0x00016844, 0x012492db, 0x012492db},
+        {0x00016848, 0x6c927a70, 0x6c927a70},
+        {0x00016850, 0x8036d36c, 0x8036d36c},
+};
+
+static const u32 qca956x_1p0_modes_no_xpa_low_ob_db_tx_gain_table[][3] = {
+        /* Addr      5G          2G        */
+        {0x0000a2dc, 0xffa9ac94, 0xffa9ac94},
+        {0x0000a2e0, 0xff323118, 0xff323118},
+        {0x0000a2e4, 0xff3ffe00, 0xff3ffe00},
+        {0x0000a2e8, 0xffc00000, 0xffc00000},
+        {0x0000a39c, 0x42424242, 0x42424242},
+        {0x0000a3a4, 0x3a3e3e00, 0x3a3e3e00},
+        {0x0000a3b0, 0x00a01404, 0x00a01404},
+        {0x0000a3b4, 0x00000034, 0x00000034},
+        {0x0000a3b8, 0x00800408, 0x00800408},
+        {0x0000a3bc, 0x00000036, 0x00000036},
+        {0x0000a410, 0x000050dc, 0x000050dc},
+        {0x0000a414, 0x16b739ce, 0x16b739ce},
+        {0x0000a418, 0x2d00198b, 0x2d00198b},
+        {0x0000a41c, 0x16b5adce, 0x16b5adce},
+        {0x0000a420, 0x0000014a, 0x0000014a},
+        {0x0000a424, 0x14a525cc, 0x14a525cc},
+        {0x0000a428, 0x0000012a, 0x0000012a},
+        {0x0000a42c, 0x14a5294a, 0x14a5294a},
+        {0x0000a430, 0x1294a929, 0x1294a929},
+        {0x0000a500, 0x09000040, 0x09000040},
+        {0x0000a504, 0x0b000041, 0x0b000041},
+        {0x0000a508, 0x0d000042, 0x0d000042},
+        {0x0000a50c, 0x11000044, 0x11000044},
+        {0x0000a510, 0x15000046, 0x15000046},
+        {0x0000a514, 0x1d000440, 0x1d000440},
+        {0x0000a518, 0x1f000441, 0x1f000441},
+        {0x0000a51c, 0x23000443, 0x23000443},
+        {0x0000a520, 0x25000444, 0x25000444},
+        {0x0000a524, 0x280004e0, 0x280004e0},
+        {0x0000a528, 0x2c0004e2, 0x2c0004e2},
+        {0x0000a52c, 0x2e0004e3, 0x2e0004e3},
+        {0x0000a530, 0x300004e4, 0x300004e4},
+        {0x0000a534, 0x340004e6, 0x340004e6},
+        {0x0000a538, 0x37000ce0, 0x37000ce0},
+        {0x0000a53c, 0x3b000ce2, 0x3b000ce2},
+        {0x0000a540, 0x3d000ce3, 0x3d000ce3},
+        {0x0000a544, 0x3f000ce4, 0x3f000ce4},
+        {0x0000a548, 0x45001ee0, 0x45001ee0},
+        {0x0000a54c, 0x49001ee2, 0x49001ee2},
+        {0x0000a550, 0x4d001ee4, 0x4d001ee4},
+        {0x0000a554, 0x51001ee6, 0x51001ee6},
+        {0x0000a558, 0x55001eea, 0x55001eea},
+        {0x0000a55c, 0x59001eec, 0x59001eec},
+        {0x0000a560, 0x5d001ef0, 0x5d001ef0},
+        {0x0000a564, 0x5f001ef1, 0x5f001ef1},
+        {0x0000a568, 0x60001ef2, 0x60001ef2},
+        {0x0000a56c, 0x61001ef3, 0x61001ef3},
+        {0x0000a570, 0x62001ef4, 0x62001ef4},
+        {0x0000a574, 0x63001ef5, 0x63001ef5},
+        {0x0000a578, 0x64001ffc, 0x64001ffc},
+        {0x0000a57c, 0x64001ffc, 0x64001ffc},
+        {0x0000a600, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00804000, 0x00804000},
+        {0x0000a614, 0x00804201, 0x00804201},
+        {0x0000a618, 0x00804201, 0x00804201},
+        {0x0000a61c, 0x00804201, 0x00804201},
+        {0x0000a620, 0x00804201, 0x00804201},
+        {0x0000a624, 0x00804201, 0x00804201},
+        {0x0000a628, 0x00804201, 0x00804201},
+        {0x0000a62c, 0x02808a02, 0x02808a02},
+        {0x0000a630, 0x0340cd03, 0x0340cd03},
+        {0x0000a634, 0x0340cd03, 0x0340cd03},
+        {0x0000a638, 0x0340cd03, 0x0340cd03},
+        {0x0000a63c, 0x05011404, 0x05011404},
+        {0x0000b2dc, 0xffa9ac94, 0xffa9ac94},
+        {0x0000b2e0, 0xff323118, 0xff323118},
+        {0x0000b2e4, 0xff3ffe00, 0xff3ffe00},
+        {0x0000b2e8, 0xffc00000, 0xffc00000},
+        {0x0000c2dc, 0xffa9ac94, 0xffa9ac94},
+        {0x0000c2e0, 0xff323118, 0xff323118},
+        {0x0000c2e4, 0xff3ffe00, 0xff3ffe00},
+        {0x0000c2e8, 0xffc00000, 0xffc00000},
+        {0x00016044, 0x046e42db, 0x046e42db},
+        {0x00016048, 0x64925a70, 0x64925a70},
+        {0x00016148, 0x00008050, 0x00008050},
+        {0x00016280, 0x41110005, 0x41110005},
+        {0x00016284, 0x453a6000, 0x453a6000},
+        {0x00016444, 0x046e42db, 0x046e42db},
+        {0x00016448, 0x6c925a70, 0x6c925a70},
+        {0x00016548, 0x00008050, 0x00008050},
+        {0x00016844, 0x046e42db, 0x046e42db},
+        {0x00016848, 0x6c925a70, 0x6c925a70},
+        {0x00016948, 0x00008050, 0x00008050},
+};
+
+static const u32 qca956x_1p0_modes_no_xpa_green_tx_gain_table[][3] = {
+        /* Addr      5G          2G        */
+        {0x000098bc, 0x00000001, 0x00000001},
+        {0x0000a2dc, 0xd3555284, 0xd3555284},
+        {0x0000a2e0, 0x1c666318, 0x1c666318},
+        {0x0000a2e4, 0xe07bbc00, 0xe07bbc00},
+        {0x0000a2e8, 0xff800000, 0xff800000},
+        {0x0000a3a4, 0x3a3e3e00, 0x3a3e3e00},
+        {0x0000a410, 0x000050dc, 0x000050dc},
+        {0x0000a500, 0x02000040, 0x02000040},
+        {0x0000a504, 0x04000041, 0x04000041},
+        {0x0000a508, 0x06000042, 0x06000042},
+        {0x0000a50c, 0x0a000044, 0x0a000044},
+        {0x0000a510, 0x0c000045, 0x0c000045},
+        {0x0000a514, 0x13000440, 0x13000440},
+        {0x0000a518, 0x15000441, 0x15000441},
+        {0x0000a51c, 0x19000443, 0x19000443},
+        {0x0000a520, 0x1b000444, 0x1b000444},
+        {0x0000a524, 0x1e0004e0, 0x1e0004e0},
+        {0x0000a528, 0x220004e2, 0x220004e2},
+        {0x0000a52c, 0x240004e3, 0x240004e3},
+        {0x0000a530, 0x260004e4, 0x260004e4},
+        {0x0000a534, 0x2a0004e6, 0x2a0004e6},
+        {0x0000a538, 0x32000ce0, 0x32000ce0},
+        {0x0000a53c, 0x36000ce2, 0x36000ce2},
+        {0x0000a540, 0x3a000ce4, 0x3a000ce4},
+        {0x0000a544, 0x3e000ce6, 0x3e000ce6},
+        {0x0000a548, 0x45001ee0, 0x45001ee0},
+        {0x0000a54c, 0x49001ee2, 0x49001ee2},
+        {0x0000a550, 0x4d001ee4, 0x4d001ee4},
+        {0x0000a554, 0x51001ee6, 0x51001ee6},
+        {0x0000a558, 0x55001eea, 0x55001eea},
+        {0x0000a55c, 0x59001eec, 0x59001eec},
+        {0x0000a560, 0x5d001ef0, 0x5d001ef0},
+        {0x0000a564, 0x5f001ef1, 0x5f001ef1},
+        {0x0000a568, 0x60001ef2, 0x60001ef2},
+        {0x0000a56c, 0x61001ef3, 0x61001ef3},
+        {0x0000a570, 0x62001ef4, 0x62001ef4},
+        {0x0000a574, 0x63001ff5, 0x63001ff5},
+        {0x0000a578, 0x64001ffc, 0x64001ffc},
+        {0x0000a57c, 0x64001ffc, 0x64001ffc},
+        {0x0000a600, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00804000, 0x00804000},
+        {0x0000a614, 0x00804201, 0x00804201},
+        {0x0000a618, 0x00804201, 0x00804201},
+        {0x0000a61c, 0x00804201, 0x00804201},
+        {0x0000a620, 0x00804201, 0x00804201},
+        {0x0000a624, 0x00804201, 0x00804201},
+        {0x0000a628, 0x00804201, 0x00804201},
+        {0x0000a62c, 0x02808a02, 0x02808a02},
+        {0x0000a630, 0x0340cd03, 0x0340cd03},
+        {0x0000a634, 0x0340cd03, 0x0340cd03},
+        {0x0000a638, 0x0340cd03, 0x0340cd03},
+        {0x0000a63c, 0x05011404, 0x05011404},
+        {0x0000b2dc, 0xd3555284, 0xd3555284},
+        {0x0000b2e0, 0x1c666318, 0x1c666318},
+        {0x0000b2e4, 0xe07bbc00, 0xe07bbc00},
+        {0x0000b2e8, 0xff800000, 0xff800000},
+        {0x0000c2dc, 0xd3555284, 0xd3555284},
+        {0x0000c2e0, 0x1c666318, 0x1c666318},
+        {0x0000c2e4, 0xe07bbc00, 0xe07bbc00},
+        {0x0000c2e8, 0xff800000, 0xff800000},
+        {0x00016044, 0x849242db, 0x849242db},
+        {0x00016048, 0x64925a70, 0x64925a70},
+        {0x00016280, 0x41110005, 0x41110005},
+        {0x00016284, 0x453a6000, 0x453a6000},
+        {0x00016444, 0x849242db, 0x849242db},
+        {0x00016448, 0x6c925a70, 0x6c925a70},
+        {0x00016844, 0x849242db, 0x849242db},
+        {0x00016848, 0x6c925a70, 0x6c925a70},
+        {0x0000a7f0, 0x800002cc, 0x800002cc},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000028, 0x00000028},
+        {0x0000a7f4, 0x00000028, 0x00000028},
+        {0x0000a7f4, 0x00000028, 0x00000028},
+        {0x0000a7f4, 0x00000028, 0x00000028},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+};
+
+static const u32 qca956x_1p0_common_rx_gain_table[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a000, 0x00010000},
+        {0x0000a004, 0x00030002},
+        {0x0000a008, 0x00050004},
+        {0x0000a00c, 0x00810080},
+        {0x0000a010, 0x00830082},
+        {0x0000a014, 0x01810180},
+        {0x0000a018, 0x01830182},
+        {0x0000a01c, 0x01850184},
+        {0x0000a020, 0x01890188},
+        {0x0000a024, 0x018b018a},
+        {0x0000a028, 0x018d018c},
+        {0x0000a02c, 0x01910190},
+        {0x0000a030, 0x01930192},
+        {0x0000a034, 0x01950194},
+        {0x0000a038, 0x038a0196},
+        {0x0000a03c, 0x038c038b},
+        {0x0000a040, 0x0390038d},
+        {0x0000a044, 0x03920391},
+        {0x0000a048, 0x03940393},
+        {0x0000a04c, 0x03960395},
+        {0x0000a050, 0x00000000},
+        {0x0000a054, 0x00000000},
+        {0x0000a058, 0x00000000},
+        {0x0000a05c, 0x00000000},
+        {0x0000a060, 0x00000000},
+        {0x0000a064, 0x00000000},
+        {0x0000a068, 0x00000000},
+        {0x0000a06c, 0x00000000},
+        {0x0000a070, 0x00000000},
+        {0x0000a074, 0x00000000},
+        {0x0000a078, 0x00000000},
+        {0x0000a07c, 0x00000000},
+        {0x0000a080, 0x22222222},
+        {0x0000a084, 0x1d1d1d1d},
+        {0x0000a088, 0x1d1d1d1d},
+        {0x0000a08c, 0x1d1d1d1d},
+        {0x0000a090, 0x17171717},
+        {0x0000a094, 0x11111717},
+        {0x0000a098, 0x00030311},
+        {0x0000a09c, 0x00000000},
+        {0x0000a0a0, 0x00000000},
+        {0x0000a0a4, 0x00000000},
+        {0x0000a0a8, 0x00000000},
+        {0x0000a0ac, 0x00000000},
+        {0x0000a0b0, 0x00000000},
+        {0x0000a0b4, 0x00000000},
+        {0x0000a0b8, 0x00000000},
+        {0x0000a0bc, 0x00000000},
+        {0x0000a0c0, 0x001f0000},
+        {0x0000a0c4, 0x01000101},
+        {0x0000a0c8, 0x011e011f},
+        {0x0000a0cc, 0x011c011d},
+        {0x0000a0d0, 0x02030204},
+        {0x0000a0d4, 0x02010202},
+        {0x0000a0d8, 0x021f0200},
+        {0x0000a0dc, 0x0302021e},
+        {0x0000a0e0, 0x03000301},
+        {0x0000a0e4, 0x031e031f},
+        {0x0000a0e8, 0x0402031d},
+        {0x0000a0ec, 0x04000401},
+        {0x0000a0f0, 0x041e041f},
+        {0x0000a0f4, 0x0502041d},
+        {0x0000a0f8, 0x05000501},
+        {0x0000a0fc, 0x051e051f},
+        {0x0000a100, 0x06010602},
+        {0x0000a104, 0x061f0600},
+        {0x0000a108, 0x061d061e},
+        {0x0000a10c, 0x07020703},
+        {0x0000a110, 0x07000701},
+        {0x0000a114, 0x00000000},
+        {0x0000a118, 0x00000000},
+        {0x0000a11c, 0x00000000},
+        {0x0000a120, 0x00000000},
+        {0x0000a124, 0x00000000},
+        {0x0000a128, 0x00000000},
+        {0x0000a12c, 0x00000000},
+        {0x0000a130, 0x00000000},
+        {0x0000a134, 0x00000000},
+        {0x0000a138, 0x00000000},
+        {0x0000a13c, 0x00000000},
+        {0x0000a140, 0x001f0000},
+        {0x0000a144, 0x01000101},
+        {0x0000a148, 0x011e011f},
+        {0x0000a14c, 0x011c011d},
+        {0x0000a150, 0x02030204},
+        {0x0000a154, 0x02010202},
+        {0x0000a158, 0x021f0200},
+        {0x0000a15c, 0x0302021e},
+        {0x0000a160, 0x03000301},
+        {0x0000a164, 0x031e031f},
+        {0x0000a168, 0x0402031d},
+        {0x0000a16c, 0x04000401},
+        {0x0000a170, 0x041e041f},
+        {0x0000a174, 0x0502041d},
+        {0x0000a178, 0x05000501},
+        {0x0000a17c, 0x051e051f},
+        {0x0000a180, 0x06010602},
+        {0x0000a184, 0x061f0600},
+        {0x0000a188, 0x061d061e},
+        {0x0000a18c, 0x07020703},
+        {0x0000a190, 0x07000701},
+        {0x0000a194, 0x00000000},
+        {0x0000a198, 0x00000000},
+        {0x0000a19c, 0x00000000},
+        {0x0000a1a0, 0x00000000},
+        {0x0000a1a4, 0x00000000},
+        {0x0000a1a8, 0x00000000},
+        {0x0000a1ac, 0x00000000},
+        {0x0000a1b0, 0x00000000},
+        {0x0000a1b4, 0x00000000},
+        {0x0000a1b8, 0x00000000},
+        {0x0000a1bc, 0x00000000},
+        {0x0000a1c0, 0x00000000},
+        {0x0000a1c4, 0x00000000},
+        {0x0000a1c8, 0x00000000},
+        {0x0000a1cc, 0x00000000},
+        {0x0000a1d0, 0x00000000},
+        {0x0000a1d4, 0x00000000},
+        {0x0000a1d8, 0x00000000},
+        {0x0000a1dc, 0x00000000},
+        {0x0000a1e0, 0x00000000},
+        {0x0000a1e4, 0x00000000},
+        {0x0000a1e8, 0x00000000},
+        {0x0000a1ec, 0x00000000},
+        {0x0000a1f0, 0x00000396},
+        {0x0000a1f4, 0x00000396},
+        {0x0000a1f8, 0x00000396},
+        {0x0000a1fc, 0x00000196},
+        {0x0000b000, 0x00010000},
+        {0x0000b004, 0x00030002},
+        {0x0000b008, 0x00050004},
+        {0x0000b00c, 0x00810080},
+        {0x0000b010, 0x00830082},
+        {0x0000b014, 0x01810180},
+        {0x0000b018, 0x01830182},
+        {0x0000b01c, 0x01850184},
+        {0x0000b020, 0x02810280},
+        {0x0000b024, 0x02830282},
+        {0x0000b028, 0x02850284},
+        {0x0000b02c, 0x02890288},
+        {0x0000b030, 0x028b028a},
+        {0x0000b034, 0x0388028c},
+        {0x0000b038, 0x038a0389},
+        {0x0000b03c, 0x038c038b},
+        {0x0000b040, 0x0390038d},
+        {0x0000b044, 0x03920391},
+        {0x0000b048, 0x03940393},
+        {0x0000b04c, 0x03960395},
+        {0x0000b050, 0x00000000},
+        {0x0000b054, 0x00000000},
+        {0x0000b058, 0x00000000},
+        {0x0000b05c, 0x00000000},
+        {0x0000b060, 0x00000000},
+        {0x0000b064, 0x00000000},
+        {0x0000b068, 0x00000000},
+        {0x0000b06c, 0x00000000},
+        {0x0000b070, 0x00000000},
+        {0x0000b074, 0x00000000},
+        {0x0000b078, 0x00000000},
+        {0x0000b07c, 0x00000000},
+        {0x0000b080, 0x23232323},
+        {0x0000b084, 0x21232323},
+        {0x0000b088, 0x19191c1e},
+        {0x0000b08c, 0x12141417},
+        {0x0000b090, 0x07070e0e},
+        {0x0000b094, 0x03030305},
+        {0x0000b098, 0x00000003},
+        {0x0000b09c, 0x00000000},
+        {0x0000b0a0, 0x00000000},
+        {0x0000b0a4, 0x00000000},
+        {0x0000b0a8, 0x00000000},
+        {0x0000b0ac, 0x00000000},
+        {0x0000b0b0, 0x00000000},
+        {0x0000b0b4, 0x00000000},
+        {0x0000b0b8, 0x00000000},
+        {0x0000b0bc, 0x00000000},
+        {0x0000b0c0, 0x003f0020},
+        {0x0000b0c4, 0x00400041},
+        {0x0000b0c8, 0x0140005f},
+        {0x0000b0cc, 0x0160015f},
+        {0x0000b0d0, 0x017e017f},
+        {0x0000b0d4, 0x02410242},
+        {0x0000b0d8, 0x025f0240},
+        {0x0000b0dc, 0x027f0260},
+        {0x0000b0e0, 0x0341027e},
+        {0x0000b0e4, 0x035f0340},
+        {0x0000b0e8, 0x037f0360},
+        {0x0000b0ec, 0x04400441},
+        {0x0000b0f0, 0x0460045f},
+        {0x0000b0f4, 0x0541047f},
+        {0x0000b0f8, 0x055f0540},
+        {0x0000b0fc, 0x057f0560},
+        {0x0000b100, 0x06400641},
+        {0x0000b104, 0x0660065f},
+        {0x0000b108, 0x067e067f},
+        {0x0000b10c, 0x07410742},
+        {0x0000b110, 0x075f0740},
+        {0x0000b114, 0x077f0760},
+        {0x0000b118, 0x07800781},
+        {0x0000b11c, 0x07a0079f},
+        {0x0000b120, 0x07c107bf},
+        {0x0000b124, 0x000007c0},
+        {0x0000b128, 0x00000000},
+        {0x0000b12c, 0x00000000},
+        {0x0000b130, 0x00000000},
+        {0x0000b134, 0x00000000},
+        {0x0000b138, 0x00000000},
+        {0x0000b13c, 0x00000000},
+        {0x0000b140, 0x003f0020},
+        {0x0000b144, 0x00400041},
+        {0x0000b148, 0x0140005f},
+        {0x0000b14c, 0x0160015f},
+        {0x0000b150, 0x017e017f},
+        {0x0000b154, 0x02410242},
+        {0x0000b158, 0x025f0240},
+        {0x0000b15c, 0x027f0260},
+        {0x0000b160, 0x0341027e},
+        {0x0000b164, 0x035f0340},
+        {0x0000b168, 0x037f0360},
+        {0x0000b16c, 0x04400441},
+        {0x0000b170, 0x0460045f},
+        {0x0000b174, 0x0541047f},
+        {0x0000b178, 0x055f0540},
+        {0x0000b17c, 0x057f0560},
+        {0x0000b180, 0x06400641},
+        {0x0000b184, 0x0660065f},
+        {0x0000b188, 0x067e067f},
+        {0x0000b18c, 0x07410742},
+        {0x0000b190, 0x075f0740},
+        {0x0000b194, 0x077f0760},
+        {0x0000b198, 0x07800781},
+        {0x0000b19c, 0x07a0079f},
+        {0x0000b1a0, 0x07c107bf},
+        {0x0000b1a4, 0x000007c0},
+        {0x0000b1a8, 0x00000000},
+        {0x0000b1ac, 0x00000000},
+        {0x0000b1b0, 0x00000000},
+        {0x0000b1b4, 0x00000000},
+        {0x0000b1b8, 0x00000000},
+        {0x0000b1bc, 0x00000000},
+        {0x0000b1c0, 0x00000000},
+        {0x0000b1c4, 0x00000000},
+        {0x0000b1c8, 0x00000000},
+        {0x0000b1cc, 0x00000000},
+        {0x0000b1d0, 0x00000000},
+        {0x0000b1d4, 0x00000000},
+        {0x0000b1d8, 0x00000000},
+        {0x0000b1dc, 0x00000000},
+        {0x0000b1e0, 0x00000000},
+        {0x0000b1e4, 0x00000000},
+        {0x0000b1e8, 0x00000000},
+        {0x0000b1ec, 0x00000000},
+        {0x0000b1f0, 0x00000396},
+        {0x0000b1f4, 0x00000396},
+        {0x0000b1f8, 0x00000396},
+        {0x0000b1fc, 0x00000196},
+};
+
+static const u32 qca956x_1p0_xlna_only[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00009820, 0x206a022e, 0x206a022e, 0x206a01ae, 0x206a01ae},
+        {0x00009824, 0x5ac640d0, 0x5ac640d0, 0x5ac621f1, 0x5ac621f1},
+        {0x00009828, 0x06903081, 0x06903081, 0x07d43881, 0x07d43881},
+        {0x00009e00, 0x0372111a, 0x0372111a, 0x037216a0, 0x03721720},
+        {0x00009e0c, 0x6c4000e2, 0x6d4000e2, 0x6d4000de, 0x6c4000da},
+        {0x00009e10, 0x7ec88d2e, 0x7ec88d2e, 0x7ec86d2e, 0x7ec8ad2e},
+        {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x317a6062, 0x317a5ae2},
+        {0x00009e18, 0x00000000, 0x00000000, 0x03c00000, 0x03c00000},
+        {0x00009e20, 0x000003b5, 0x000003b5, 0x000003b2, 0x000003b2},
+        {0x00009fc0, 0x813e4788, 0x813e4788, 0x813e4789, 0x813e4789},
+        {0x0000ae18, 0x00000000, 0x00000000, 0x03c00000, 0x03c00000},
+        {0x0000ae20, 0x000001b5, 0x000001b5, 0x000001b2, 0x000001b2},
+        {0x0000be18, 0x00000000, 0x00000000, 0x03c00000, 0x03c00000},
+        {0x0000be20, 0x000001b5, 0x000001b5, 0x000001b2, 0x000001b2},
+};
+
+#endif /* INITVALS_956X_H */
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index c43e2ad36587..dd5d3914799b 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -403,7 +403,8 @@ static const struct file_operations fops_antenna_diversity = {
 
 static int read_file_dma(struct seq_file *file, void *data)
 {
-        struct ath_softc *sc = file->private;
+        struct ieee80211_hw *hw = dev_get_drvdata(file->private);
+        struct ath_softc *sc = hw->priv;
         struct ath_hw *ah = sc->sc_ah;
         u32 val[ATH9K_NUM_DMA_DEBUG_REGS];
         int i, qcuOffset = 0, dcuOffset = 0;
@@ -470,20 +471,6 @@ static int read_file_dma(struct seq_file *file, void *data)
         return 0;
 }
 
-static int open_file_dma(struct inode *inode, struct file *f)
-{
-        return single_open(f, read_file_dma, inode->i_private);
-}
-
-static const struct file_operations fops_dma = {
-        .open = open_file_dma,
-        .read = seq_read,
-        .owner = THIS_MODULE,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
-
-
 void ath_debug_stat_interrupt(struct ath_softc *sc, enum ath9k_int status)
 {
         if (status)
@@ -539,7 +526,8 @@ void ath_debug_stat_interrupt(struct ath_softc *sc, enum ath9k_int status)
 
 static int read_file_interrupt(struct seq_file *file, void *data)
 {
-        struct ath_softc *sc = file->private;
+        struct ieee80211_hw *hw = dev_get_drvdata(file->private);
+        struct ath_softc *sc = hw->priv;
 
 #define PR_IS(a, s)                                             \
         do {                                                    \
@@ -600,22 +588,10 @@ static int read_file_interrupt(struct seq_file *file, void *data)
         return 0;
 }
 
-static int open_file_interrupt(struct inode *inode, struct file *f)
-{
-        return single_open(f, read_file_interrupt, inode->i_private);
-}
-
-static const struct file_operations fops_interrupt = {
-        .read = seq_read,
-        .open = open_file_interrupt,
-        .owner = THIS_MODULE,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
-
 static int read_file_xmit(struct seq_file *file, void *data)
 {
-        struct ath_softc *sc = file->private;
+        struct ieee80211_hw *hw = dev_get_drvdata(file->private);
+        struct ath_softc *sc = hw->priv;
 
         seq_printf(file, "%30s %10s%10s%10s\n\n", "BE", "BK", "VI", "VO");
 
@@ -661,7 +637,8 @@ static void print_queue(struct ath_softc *sc, struct ath_txq *txq,
 
 static int read_file_queues(struct seq_file *file, void *data)
 {
-        struct ath_softc *sc = file->private;
+        struct ieee80211_hw *hw = dev_get_drvdata(file->private);
+        struct ath_softc *sc = hw->priv;
         struct ath_txq *txq;
         int i;
         static const char *qname[4] = {
@@ -682,7 +659,8 @@ static int read_file_queues(struct seq_file *file, void *data)
 
 static int read_file_misc(struct seq_file *file, void *data)
 {
-        struct ath_softc *sc = file->private;
+        struct ieee80211_hw *hw = dev_get_drvdata(file->private);
+        struct ath_softc *sc = hw->priv;
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath9k_vif_iter_data iter_data;
         struct ath_chanctx *ctx;
@@ -773,7 +751,8 @@ static int read_file_misc(struct seq_file *file, void *data)
 
 static int read_file_reset(struct seq_file *file, void *data)
 {
-        struct ath_softc *sc = file->private;
+        struct ieee80211_hw *hw = dev_get_drvdata(file->private);
+        struct ath_softc *sc = hw->priv;
         static const char * const reset_cause[__RESET_TYPE_MAX] = {
                 [RESET_TYPE_BB_HANG] = "Baseband Hang",
                 [RESET_TYPE_BB_WATCHDOG] = "Baseband Watchdog",
@@ -837,58 +816,6 @@ void ath_debug_stat_tx(struct ath_softc *sc, struct ath_buf *bf,
                 TX_STAT_INC(qnum, delim_underrun);
 }
 
-static int open_file_xmit(struct inode *inode, struct file *f)
-{
-        return single_open(f, read_file_xmit, inode->i_private);
-}
-
-static const struct file_operations fops_xmit = {
-        .read = seq_read,
-        .open = open_file_xmit,
-        .owner = THIS_MODULE,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
-
-static int open_file_queues(struct inode *inode, struct file *f)
-{
-        return single_open(f, read_file_queues, inode->i_private);
-}
-
-static const struct file_operations fops_queues = {
-        .read = seq_read,
-        .open = open_file_queues,
-        .owner = THIS_MODULE,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
-
-static int open_file_misc(struct inode *inode, struct file *f)
-{
-        return single_open(f, read_file_misc, inode->i_private);
-}
-
-static const struct file_operations fops_misc = {
-        .read = seq_read,
-        .open = open_file_misc,
-        .owner = THIS_MODULE,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
-
-static int open_file_reset(struct inode *inode, struct file *f)
-{
-        return single_open(f, read_file_reset, inode->i_private);
-}
-
-static const struct file_operations fops_reset = {
-        .read = seq_read,
-        .open = open_file_reset,
-        .owner = THIS_MODULE,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
-
 void ath_debug_stat_rx(struct ath_softc *sc, struct ath_rx_status *rs)
 {
         ath9k_cmn_debug_stat_rx(&sc->debug.stats.rxstats, rs);
@@ -1018,7 +945,8 @@ static const struct file_operations fops_regdump = {
 
 static int read_file_dump_nfcal(struct seq_file *file, void *data)
 {
-        struct ath_softc *sc = file->private;
+        struct ieee80211_hw *hw = dev_get_drvdata(file->private);
+        struct ath_softc *sc = hw->priv;
         struct ath_hw *ah = sc->sc_ah;
         struct ath9k_nfcal_hist *h = sc->cur_chan->caldata.nfCalHist;
         struct ath_common *common = ath9k_hw_common(ah);
@@ -1150,11 +1078,6 @@ static ssize_t write_file_tpc(struct file *file, const char __user *user_buf,
         ssize_t len;
         bool tpc_enabled;
 
-        if (!AR_SREV_9300_20_OR_LATER(ah)) {
-                /* ar9002 does not support TPC for the moment */
-                return -EOPNOTSUPP;
-        }
-
         len = min(count, sizeof(buf) - 1);
         if (copy_from_user(buf, user_buf, len))
                 return -EFAULT;
@@ -1329,14 +1252,14 @@ int ath9k_init_debug(struct ath_hw *ah)
         ath9k_tx99_init_debug(sc);
         ath9k_cmn_spectral_init_debug(&sc->spec_priv, sc->debug.debugfs_phy);
 
-        debugfs_create_file("dma", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_dma);
-        debugfs_create_file("interrupt", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_interrupt);
-        debugfs_create_file("xmit", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_xmit);
-        debugfs_create_file("queues", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_queues);
+        debugfs_create_devm_seqfile(sc->dev, "dma", sc->debug.debugfs_phy,
+                                    read_file_dma);
+        debugfs_create_devm_seqfile(sc->dev, "interrupt", sc->debug.debugfs_phy,
+                                    read_file_interrupt);
+        debugfs_create_devm_seqfile(sc->dev, "xmit", sc->debug.debugfs_phy,
+                                    read_file_xmit);
+        debugfs_create_devm_seqfile(sc->dev, "queues", sc->debug.debugfs_phy,
+                                    read_file_queues);
         debugfs_create_u32("qlen_bk", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
                            &sc->tx.txq_max_pending[IEEE80211_AC_BK]);
         debugfs_create_u32("qlen_be", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
@@ -1345,10 +1268,10 @@ int ath9k_init_debug(struct ath_hw *ah)
                            &sc->tx.txq_max_pending[IEEE80211_AC_VI]);
         debugfs_create_u32("qlen_vo", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
                            &sc->tx.txq_max_pending[IEEE80211_AC_VO]);
-        debugfs_create_file("misc", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_misc);
-        debugfs_create_file("reset", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_reset);
+        debugfs_create_devm_seqfile(sc->dev, "misc", sc->debug.debugfs_phy,
+                                    read_file_misc);
+        debugfs_create_devm_seqfile(sc->dev, "reset", sc->debug.debugfs_phy,
+                                    read_file_reset);
 
         ath9k_cmn_debug_recv(sc->debug.debugfs_phy, &sc->debug.stats.rxstats);
         ath9k_cmn_debug_phy_err(sc->debug.debugfs_phy, &sc->debug.stats.rxstats);
@@ -1370,8 +1293,9 @@ int ath9k_init_debug(struct ath_hw *ah)
                             &ah->config.cwm_ignore_extcca);
         debugfs_create_file("regdump", S_IRUSR, sc->debug.debugfs_phy, sc,
                             &fops_regdump);
-        debugfs_create_file("dump_nfcal", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_dump_nfcal);
+        debugfs_create_devm_seqfile(sc->dev, "dump_nfcal",
+                                    sc->debug.debugfs_phy,
+                                    read_file_dump_nfcal);
 
         ath9k_cmn_debug_base_eeprom(sc->debug.debugfs_phy, sc->sc_ah);
         ath9k_cmn_debug_modal_eeprom(sc->debug.debugfs_phy, sc->sc_ah);
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_4k.c b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
index 07b806c56c56..e5a78d4fd66e 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_4k.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
@@ -748,6 +748,20 @@ static void ath9k_hw_4k_set_txpower(struct ath_hw *ah,
                           | ATH9K_POW_SM(ratesArray[rateDupCck], 0));
         }
 
+        /* TPC initializations */
+        if (ah->tpc_enabled) {
+                int ht40_delta;
+
+                ht40_delta = (IS_CHAN_HT40(chan)) ? ht40PowerIncForPdadc : 0;
+                ar5008_hw_init_rate_txpower(ah, ratesArray, chan, ht40_delta);
+                /* Enable TPC */
+                REG_WRITE(ah, AR_PHY_POWER_TX_RATE_MAX,
+                        MAX_RATE_POWER | AR_PHY_POWER_TX_RATE_MAX_TPC_ENABLE);
+        } else {
+                /* Disable TPC */
+                REG_WRITE(ah, AR_PHY_POWER_TX_RATE_MAX, MAX_RATE_POWER);
+        }
+
         REGWRITE_BUFFER_FLUSH(ah);
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_9287.c b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
index 5ba1385c9838..6ca33dfde1fd 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
@@ -886,6 +886,21 @@ static void ath9k_hw_ar9287_set_txpower(struct ath_hw *ah,
                           | ATH9K_POW_SM(ratesArray[rateDupOfdm], 8)
                           | ATH9K_POW_SM(ratesArray[rateDupCck], 0));
         }
+
+        /* TPC initializations */
+        if (ah->tpc_enabled) {
+                int ht40_delta;
+
+                ht40_delta = (IS_CHAN_HT40(chan)) ? ht40PowerIncForPdadc : 0;
+                ar5008_hw_init_rate_txpower(ah, ratesArray, chan, ht40_delta);
+                /* Enable TPC */
+                REG_WRITE(ah, AR_PHY_POWER_TX_RATE_MAX,
+                        MAX_RATE_POWER | AR_PHY_POWER_TX_RATE_MAX_TPC_ENABLE);
+        } else {
+                /* Disable TPC */
+                REG_WRITE(ah, AR_PHY_POWER_TX_RATE_MAX, MAX_RATE_POWER);
+        }
+
         REGWRITE_BUFFER_FLUSH(ah);
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_def.c b/drivers/net/wireless/ath/ath9k/eeprom_def.c
index 122b846b8ec0..098059039351 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_def.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c
@@ -1332,6 +1332,20 @@ static void ath9k_hw_def_set_txpower(struct ath_hw *ah,
                   ATH9K_POW_SM(pModal->pwrDecreaseFor3Chain, 6)
                   | ATH9K_POW_SM(pModal->pwrDecreaseFor2Chain, 0));
 
+        /* TPC initializations */
+        if (ah->tpc_enabled) {
+                int ht40_delta;
+
+                ht40_delta = (IS_CHAN_HT40(chan)) ? ht40PowerIncForPdadc : 0;
+                ar5008_hw_init_rate_txpower(ah, ratesArray, chan, ht40_delta);
+                /* Enable TPC */
+                REG_WRITE(ah, AR_PHY_POWER_TX_RATE_MAX,
+                        MAX_RATE_POWER | AR_PHY_POWER_TX_RATE_MAX_TPC_ENABLE);
+        } else {
+                /* Disable TPC */
+                REG_WRITE(ah, AR_PHY_POWER_TX_RATE_MAX, MAX_RATE_POWER);
+        }
+
         REGWRITE_BUFFER_FLUSH(ah);
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index 9dde265d3f84..c43fec51b8ec 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -44,6 +44,9 @@
 
 extern struct ieee80211_ops ath9k_htc_ops;
 extern int htc_modparam_nohwcrypt;
+#ifdef CONFIG_MAC80211_LEDS
+extern int led_blink;
+#endif
 
 enum htc_phymode {
         HTC_MODE_11NA           = 0,
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_gpio.c b/drivers/net/wireless/ath/ath9k/htc_drv_gpio.c
index 50f74a2a4cf8..998b558d4126 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_gpio.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_gpio.c
@@ -279,6 +279,10 @@ void ath9k_init_leds(struct ath9k_htc_priv *priv)
         else
                 priv->ah->led_pin = ATH_LED_PIN_DEF;
 
+        if (!led_blink)
+                priv->led_cdev.default_trigger =
+                        ieee80211_get_radio_led_name(priv->hw);
+
         ath9k_configure_leds(priv);
 
         snprintf(priv->led_name, sizeof(priv->led_name),
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index e8fa9448da24..947012757f81 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -39,6 +39,10 @@ module_param_named(ps_enable, ath9k_ps_enable, int, 0444);
 MODULE_PARM_DESC(ps_enable, "Enable WLAN PowerSave");
 
 #ifdef CONFIG_MAC80211_LEDS
+int led_blink = 1;
+module_param_named(blink, led_blink, int, 0444);
+MODULE_PARM_DESC(blink, "Enable LED blink on activity");
+
 static const struct ieee80211_tpt_blink ath9k_htc_tpt_blink[] = {
         { .throughput = 0 * 1024, .blink_time = 334 },
         { .throughput = 1 * 1024, .blink_time = 260 },
diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
index a0ff5b637054..d2408da38c1c 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
@@ -351,11 +351,7 @@ void ath9k_htc_txcompletion_cb(struct htc_target *htc_handle,
 
         return;
 ret:
-        /* HTC-generated packets are freed here. */
-        if (htc_hdr && htc_hdr->endpoint_id != ENDPOINT0)
-                dev_kfree_skb_any(skb);
-        else
-                kfree_skb(skb);
+        kfree_skb(skb);
 }
 
 static void ath9k_htc_fw_panic_report(struct htc_target *htc_handle,
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 258c4d236cbe..82d8f32a3461 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -246,6 +246,8 @@ static void ath9k_hw_read_revisions(struct ath_hw *ah)
         case AR9300_DEVID_AR953X:
                 ah->hw_version.macVersion = AR_SREV_VERSION_9531;
                 return;
+        case AR9300_DEVID_QCA956X:
+                ah->hw_version.macVersion = AR_SREV_VERSION_9561;
         }
 
         val = REG_READ(ah, AR_SREV) & AR_SREV_ID;
@@ -422,8 +424,7 @@ static void ath9k_hw_init_defaults(struct ath_hw *ah)
         ah->power_mode = ATH9K_PM_UNDEFINED;
         ah->htc_reset_init = true;
 
-        /* ar9002 does not support TPC for the moment */
-        ah->tpc_enabled = !!AR_SREV_9300_20_OR_LATER(ah);
+        ah->tpc_enabled = true;
 
         ah->ani_function = ATH9K_ANI_ALL;
         if (!AR_SREV_9300_20_OR_LATER(ah))
@@ -539,6 +540,7 @@ static int __ath9k_hw_init(struct ath_hw *ah)
         case AR_SREV_VERSION_9550:
         case AR_SREV_VERSION_9565:
         case AR_SREV_VERSION_9531:
+        case AR_SREV_VERSION_9561:
                 break;
         default:
                 ath_err(common,
@@ -639,6 +641,7 @@ int ath9k_hw_init(struct ath_hw *ah)
         case AR9485_DEVID_AR1111:
         case AR9300_DEVID_AR9565:
         case AR9300_DEVID_AR953X:
+        case AR9300_DEVID_QCA956X:
                 break;
         default:
                 if (common->bus_ops->ath_bus_type == ATH_USB)
@@ -779,7 +782,8 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
                 /* program BB PLL phase_shift */
                 REG_RMW_FIELD(ah, AR_CH0_BB_DPLL3,
                               AR_CH0_BB_DPLL3_PHASE_SHIFT, 0x1);
-        } else if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
+        } else if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah) ||
+                   AR_SREV_9561(ah)) {
                 u32 regval, pll2_divint, pll2_divfrac, refdiv;
 
                 REG_WRITE(ah, AR_RTC_PLL_CONTROL,
@@ -790,7 +794,7 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
                 udelay(100);
 
                 if (ah->is_clk_25mhz) {
-                        if (AR_SREV_9531(ah)) {
+                        if (AR_SREV_9531(ah) || AR_SREV_9561(ah)) {
                                 pll2_divint = 0x1c;
                                 pll2_divfrac = 0xa3d2;
                                 refdiv = 1;
@@ -806,14 +810,15 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
                                 refdiv = 5;
                         } else {
                                 pll2_divint = 0x11;
-                                pll2_divfrac =
-                                        AR_SREV_9531(ah) ? 0x26665 : 0x26666;
+                                pll2_divfrac = (AR_SREV_9531(ah) ||
+                                                AR_SREV_9561(ah)) ?
+                                                0x26665 : 0x26666;
                                 refdiv = 1;
                         }
                 }
 
                 regval = REG_READ(ah, AR_PHY_PLL_MODE);
-                if (AR_SREV_9531(ah))
+                if (AR_SREV_9531(ah) || AR_SREV_9561(ah))
                         regval |= (0x1 << 22);
                 else
                         regval |= (0x1 << 16);
@@ -831,14 +836,16 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
                                 (0x1 << 13) |
                                 (0x4 << 26) |
                                 (0x18 << 19);
-                else if (AR_SREV_9531(ah))
+                else if (AR_SREV_9531(ah) || AR_SREV_9561(ah)) {
                         regval = (regval & 0x01c00fff) |
                                 (0x1 << 31) |
                                 (0x2 << 29) |
                                 (0xa << 25) |
-                                (0x1 << 19) |
-                                (0x6 << 12);
-                else
+                                (0x1 << 19);
+
+                        if (AR_SREV_9531(ah))
+                                regval |= (0x6 << 12);
+                } else
                         regval = (regval & 0x80071fff) |
                                 (0x3 << 30) |
                                 (0x1 << 13) |
@@ -846,7 +853,7 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
                                 (0x60 << 19);
                 REG_WRITE(ah, AR_PHY_PLL_MODE, regval);
 
-                if (AR_SREV_9531(ah))
+                if (AR_SREV_9531(ah) || AR_SREV_9561(ah))
                         REG_WRITE(ah, AR_PHY_PLL_MODE,
                                   REG_READ(ah, AR_PHY_PLL_MODE) & 0xffbfffff);
                 else
@@ -885,7 +892,8 @@ static void ath9k_hw_init_interrupt_masks(struct ath_hw *ah,
                 AR_IMR_RXORN |
                 AR_IMR_BCNMISC;
 
-        if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah))
+        if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah) ||
+            AR_SREV_9561(ah))
                 sync_default &= ~AR_INTR_SYNC_HOST1_FATAL;
 
         if (AR_SREV_9300_20_OR_LATER(ah)) {
@@ -1674,7 +1682,8 @@ static void ath9k_hw_init_desc(struct ath_hw *ah)
                 }
 #ifdef __BIG_ENDIAN
                 else if (AR_SREV_9330(ah) || AR_SREV_9340(ah) ||
-                         AR_SREV_9550(ah) || AR_SREV_9531(ah))
+                         AR_SREV_9550(ah) || AR_SREV_9531(ah) ||
+                         AR_SREV_9561(ah))
                         REG_RMW(ah, AR_CFG, AR_CFG_SWRB | AR_CFG_SWTB, 0);
                 else
                         REG_WRITE(ah, AR_CFG, AR_CFG_SWTD | AR_CFG_SWRD);
@@ -2462,7 +2471,8 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
 
         if (AR_SREV_9300_20_OR_LATER(ah)) {
                 pCap->hw_caps |= ATH9K_HW_CAP_EDMA | ATH9K_HW_CAP_FASTCLOCK;
-                if (!AR_SREV_9330(ah) && !AR_SREV_9485(ah) && !AR_SREV_9565(ah))
+                if (!AR_SREV_9330(ah) && !AR_SREV_9485(ah) &&
+                    !AR_SREV_9561(ah) && !AR_SREV_9565(ah))
                         pCap->hw_caps |= ATH9K_HW_CAP_LDPC;
 
                 pCap->rx_hp_qdepth = ATH9K_HW_RX_HP_QDEPTH;
@@ -2479,7 +2489,9 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
         if (AR_SREV_9300_20_OR_LATER(ah))
                 pCap->hw_caps |= ATH9K_HW_CAP_RAC_SUPPORTED;
 
-        if (AR_SREV_9300_20_OR_LATER(ah))
+        if (AR_SREV_9561(ah))
+                ah->ent_mode = 0x3BDA000;
+        else if (AR_SREV_9300_20_OR_LATER(ah))
                 ah->ent_mode = REG_READ(ah, AR_ENT_OTP);
 
         if (AR_SREV_9287_11_OR_LATER(ah) || AR_SREV_9271(ah))
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 1cbd33551513..450704e49f03 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -54,6 +54,7 @@
 #define AR9485_DEVID_AR1111     0x0037
 #define AR9300_DEVID_AR9565     0x0036
 #define AR9300_DEVID_AR953X     0x003d
+#define AR9300_DEVID_QCA956X    0x003f
 
 #define AR5416_AR9100_DEVID     0x000b
 
@@ -1086,6 +1087,8 @@ bool ar9003_is_paprd_enabled(struct ath_hw *ah);
 void ar9003_hw_set_chain_masks(struct ath_hw *ah, u8 rx, u8 tx);
 void ar9003_hw_init_rate_txpower(struct ath_hw *ah, u8 *rate_array,
                                  struct ath9k_channel *chan);
+void ar5008_hw_init_rate_txpower(struct ath_hw *ah, int16_t *rate_array,
+                                 struct ath9k_channel *chan, int ht40_delta);
 
 /* Hardware family op attach helpers */
 int ar5008_hw_attach_phy_ops(struct ath_hw *ah);
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 3e58bfa0c1fd..bba85d1a6cd1 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -820,7 +820,8 @@ void ath9k_hw_enable_interrupts(struct ath_hw *ah)
                 return;
         }
 
-        if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah))
+        if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah) ||
+            AR_SREV_9561(ah))
                 sync_default &= ~AR_INTR_SYNC_HOST1_FATAL;
 
         async_mask = AR_INTR_MAC_IRQ;
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index f009b5b57e5e..cc5c6810f32e 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -427,6 +427,11 @@ static const struct pci_device_id ath_pci_id_table[] = {
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
                          0x11AD, /* LITEON */
+                         0x1842),
+          .driver_data = ATH9K_PCI_AR9565_1ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
                          0x6671),
           .driver_data = ATH9K_PCI_AR9565_1ANT },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
@@ -446,9 +451,19 @@ static const struct pci_device_id ath_pci_id_table[] = {
           .driver_data = ATH9K_PCI_AR9565_1ANT },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
+                         0x1B9A, /* XAVI */
+                         0x28A3),
+          .driver_data = ATH9K_PCI_AR9565_1ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
                          PCI_VENDOR_ID_AZWAVE,
                          0x218A),
           .driver_data = ATH9K_PCI_AR9565_1ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x2F8A),
+          .driver_data = ATH9K_PCI_AR9565_1ANT },
 
         /* WB335 1-ANT / Antenna Diversity */
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
@@ -508,6 +523,11 @@ static const struct pci_device_id ath_pci_id_table[] = {
           .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x213C),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
                          PCI_VENDOR_ID_HP,
                          0x18E3),
           .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
@@ -555,6 +575,16 @@ static const struct pci_device_id ath_pci_id_table[] = {
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
+                         PCI_VENDOR_ID_SAMSUNG,
+                         0x4129),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_SAMSUNG,
+                         0x412A),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
                          PCI_VENDOR_ID_ATHEROS,
                          0x3027),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
@@ -586,10 +616,25 @@ static const struct pci_device_id ath_pci_id_table[] = {
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
                          0x11AD, /* LITEON */
+                         0x1832),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
                          0x0692),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
+                         0x11AD, /* LITEON */
+                         0x0803),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
+                         0x0813),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
                          PCI_VENDOR_ID_AZWAVE,
                          0x2130),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
@@ -605,6 +650,21 @@ static const struct pci_device_id ath_pci_id_table[] = {
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x218B),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x218C),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x2F82),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
                          0x144F, /* ASKEY */
                          0x7202),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
@@ -616,10 +676,20 @@ static const struct pci_device_id ath_pci_id_table[] = {
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
                          0x1B9A, /* XAVI */
+                         0x2813),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x1B9A, /* XAVI */
                          0x28A2),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
+                         0x1B9A, /* XAVI */
+                         0x28A4),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
                          0x185F, /* WNC */
                          0x3027),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
@@ -636,10 +706,25 @@ static const struct pci_device_id ath_pci_id_table[] = {
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
                          PCI_VENDOR_ID_FOXCONN,
+                         0xE08F),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_FOXCONN,
                          0xE081),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
+                         PCI_VENDOR_ID_FOXCONN,
+                         0xE091),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_FOXCONN,
+                         0xE099),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
                          PCI_VENDOR_ID_LENOVO,
                          0x3026),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 7395afbc5124..6fb40ef86fd6 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -425,7 +425,8 @@ u32 ath_calcrxfilter(struct ath_softc *sc)
                 rfilt |= ATH9K_RX_FILTER_MCAST_BCAST_ALL;
         }
 
-        if (AR_SREV_9550(sc->sc_ah) || AR_SREV_9531(sc->sc_ah))
+        if (AR_SREV_9550(sc->sc_ah) || AR_SREV_9531(sc->sc_ah) ||
+            AR_SREV_9561(sc->sc_ah))
                 rfilt |= ATH9K_RX_FILTER_4ADDRESS;
 
         if (ath9k_is_chanctx_enabled() &&
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index fb11a9172f38..eb2bb0db297f 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -814,6 +814,7 @@
 #define AR_SREV_REVISION_9531_10        0
 #define AR_SREV_REVISION_9531_11        1
 #define AR_SREV_REVISION_9531_20        2
+#define AR_SREV_VERSION_9561            0x600
 
 #define AR_SREV_5416(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_5416_PCI) || \
@@ -974,6 +975,9 @@
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9531) && \
          ((_ah)->hw_version.macRev == AR_SREV_REVISION_9531_20))
 
+#define AR_SREV_9561(_ah) \
+        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9561))
+
 /* NOTE: When adding chips newer than Peacock, add chip check here */
 #define AR_SREV_9580_10_OR_LATER(_ah) \
         (AR_SREV_9580(_ah))
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index cf60cc405d14..1b8e75c4d2c2 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1097,24 +1097,65 @@ void ath_update_max_aggr_framelen(struct ath_softc *sc, int queue, int txop)
 }
 
 static u8 ath_get_rate_txpower(struct ath_softc *sc, struct ath_buf *bf,
-                               u8 rateidx)
+                               u8 rateidx, bool is_40, bool is_cck)
 {
         u8 max_power;
+        struct sk_buff *skb;
+        struct ath_frame_info *fi;
+        struct ieee80211_tx_info *info;
         struct ath_hw *ah = sc->sc_ah;
 
-        if (sc->tx99_state)
+        if (sc->tx99_state || !ah->tpc_enabled)
                 return MAX_RATE_POWER;
 
+        skb = bf->bf_mpdu;
+        fi = get_frame_info(skb);
+        info = IEEE80211_SKB_CB(skb);
+
         if (!AR_SREV_9300_20_OR_LATER(ah)) {
-                /* ar9002 does not support TPC for the moment */
-                return MAX_RATE_POWER;
-        }
+                int txpower = fi->tx_power;
 
-        if (!bf->bf_state.bfs_paprd) {
-                struct sk_buff *skb = bf->bf_mpdu;
-                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-                struct ath_frame_info *fi = get_frame_info(skb);
+                if (is_40) {
+                        u8 power_ht40delta;
+                        struct ar5416_eeprom_def *eep = &ah->eeprom.def;
+
+                        if (AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_2) {
+                                bool is_2ghz;
+                                struct modal_eep_header *pmodal;
 
+                                is_2ghz = info->band == IEEE80211_BAND_2GHZ;
+                                pmodal = &eep->modalHeader[is_2ghz];
+                                power_ht40delta = pmodal->ht40PowerIncForPdadc;
+                        } else {
+                                power_ht40delta = 2;
+                        }
+                        txpower += power_ht40delta;
+                }
+
+                if (AR_SREV_9287(ah) || AR_SREV_9285(ah) ||
+                    AR_SREV_9271(ah)) {
+                        txpower -= 2 * AR9287_PWR_TABLE_OFFSET_DB;
+                } else if (AR_SREV_9280_20_OR_LATER(ah)) {
+                        s8 power_offset;
+
+                        power_offset = ah->eep_ops->get_eeprom(ah,
+                                                        EEP_PWR_TABLE_OFFSET);
+                        txpower -= 2 * power_offset;
+                }
+
+                if (OLC_FOR_AR9280_20_LATER && is_cck)
+                        txpower -= 2;
+
+                txpower = max(txpower, 0);
+                max_power = min_t(u8, ah->tx_power[rateidx], txpower);
+
+                /* XXX: clamp minimum TX power at 1 for AR9160 since if
+                 * max_power is set to 0, frames are transmitted at max
+                 * TX power
+                 */
+                if (!max_power && !AR_SREV_9280_20_OR_LATER(ah))
+                        max_power = 1;
+        } else if (!bf->bf_state.bfs_paprd) {
                 if (rateidx < 8 && (info->flags & IEEE80211_TX_CTL_STBC))
                         max_power = min(ah->tx_power_stbc[rateidx],
                                         fi->tx_power);
@@ -1152,7 +1193,7 @@ static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf,
         info->rtscts_rate = fi->rtscts_rate;
 
         for (i = 0; i < ARRAY_SIZE(bf->rates); i++) {
-                bool is_40, is_sgi, is_sp;
+                bool is_40, is_sgi, is_sp, is_cck;
                 int phy;
 
                 if (!rates[i].count || (rates[i].idx < 0))
@@ -1198,7 +1239,8 @@ static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf,
                         if (rix < 8 && (tx_info->flags & IEEE80211_TX_CTL_STBC))
                                 info->rates[i].RateFlags |= ATH9K_RATESERIES_STBC;
 
-                        info->txpower[i] = ath_get_rate_txpower(sc, bf, rix);
+                        info->txpower[i] = ath_get_rate_txpower(sc, bf, rix,
+                                                                is_40, false);
                         continue;
                 }
 
@@ -1227,7 +1269,9 @@ static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf,
                 info->rates[i].PktDuration = ath9k_hw_computetxtime(sc->sc_ah,
                         phy, rate->bitrate * 100, len, rix, is_sp);
 
-                info->txpower[i] = ath_get_rate_txpower(sc, bf, rix);
+                is_cck = IS_CCK_RATE(info->rates[i].Rate);
+                info->txpower[i] = ath_get_rate_txpower(sc, bf, rix, false,
+                                                        is_cck);
         }
 
         /* For AR5416 - RTS cannot be followed by a frame larger than 8K */
@@ -2445,9 +2489,12 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
         if (sc->sc_ah->caldata)
                 set_bit(PAPRD_PACKET_SENT, &sc->sc_ah->caldata->cal_flags);
 
-        if (!(tx_flags & ATH_TX_ERROR))
-                /* Frame was ACKed */
-                tx_info->flags |= IEEE80211_TX_STAT_ACK;
+        if (!(tx_flags & ATH_TX_ERROR)) {
+                if (tx_info->flags & IEEE80211_TX_CTL_NO_ACK)
+                        tx_info->flags |= IEEE80211_TX_STAT_NOACK_TRANSMITTED;
+                else
+                        tx_info->flags |= IEEE80211_TX_STAT_ACK;
+        }
 
         padpos = ieee80211_hdrlen(hdr->frame_control);
         padsize = padpos & 3;
diff --git a/drivers/net/wireless/ath/wcn36xx/dxe.c b/drivers/net/wireless/ath/wcn36xx/dxe.c
index 73f12f196f14..086549b732b9 100644
--- a/drivers/net/wireless/ath/wcn36xx/dxe.c
+++ b/drivers/net/wireless/ath/wcn36xx/dxe.c
@@ -84,6 +84,7 @@ static int wcn36xx_dxe_allocate_ctl_block(struct wcn36xx_dxe_ch *ch)
                 if (!cur_ctl)
                         goto out_fail;
 
+                spin_lock_init(&cur_ctl->skb_lock);
                 cur_ctl->ctl_blk_order = i;
                 if (i == 0) {
                         ch->head_blk_ctl = cur_ctl;
@@ -354,6 +355,8 @@ static void reap_tx_dxes(struct wcn36xx *wcn, struct wcn36xx_dxe_ch *ch)
          * and while-do will not make any cycles.
          */
         do {
+                if (ctl->desc->ctrl & WCN36XX_DXE_CTRL_VALID_MASK)
+                        break;
                 if (ctl->skb) {
                         dma_unmap_single(NULL, ctl->desc->src_addr_l,
                                          ctl->skb->len, DMA_TO_DEVICE);
diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
index 7dd8873f757e..0783d2ed8238 100644
--- a/drivers/net/wireless/ath/wcn36xx/main.c
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -298,6 +298,8 @@ static int wcn36xx_start(struct ieee80211_hw *hw)
         wcn36xx_debugfs_init(wcn);
 
         INIT_LIST_HEAD(&wcn->vif_list);
+        spin_lock_init(&wcn->dxe_lock);
+
         return 0;
 
 out_smd_stop:
@@ -795,6 +797,7 @@ static int wcn36xx_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
         wcn36xx_dbg(WCN36XX_DBG_MAC, "mac sta add vif %p sta %pM\n",
                     vif, sta->addr);
 
+        spin_lock_init(&sta_priv->ampdu_lock);
         vif_priv->sta = sta_priv;
         sta_priv->vif = vif_priv;
         /*
@@ -873,21 +876,32 @@ static int wcn36xx_ampdu_action(struct ieee80211_hw *hw,
                         get_sta_index(vif, sta_priv));
                 wcn36xx_smd_add_ba(wcn);
                 wcn36xx_smd_trigger_ba(wcn, get_sta_index(vif, sta_priv));
-                ieee80211_start_tx_ba_session(sta, tid, 0);
                 break;
         case IEEE80211_AMPDU_RX_STOP:
                 wcn36xx_smd_del_ba(wcn, tid, get_sta_index(vif, sta_priv));
                 break;
         case IEEE80211_AMPDU_TX_START:
+                spin_lock_bh(&sta_priv->ampdu_lock);
+                sta_priv->ampdu_state[tid] = WCN36XX_AMPDU_START;
+                spin_unlock_bh(&sta_priv->ampdu_lock);
+
                 ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
                 break;
         case IEEE80211_AMPDU_TX_OPERATIONAL:
+                spin_lock_bh(&sta_priv->ampdu_lock);
+                sta_priv->ampdu_state[tid] = WCN36XX_AMPDU_OPERATIONAL;
+                spin_unlock_bh(&sta_priv->ampdu_lock);
+
                 wcn36xx_smd_add_ba_session(wcn, sta, tid, ssn, 1,
                         get_sta_index(vif, sta_priv));
                 break;
         case IEEE80211_AMPDU_TX_STOP_FLUSH:
         case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
         case IEEE80211_AMPDU_TX_STOP_CONT:
+                spin_lock_bh(&sta_priv->ampdu_lock);
+                sta_priv->ampdu_state[tid] = WCN36XX_AMPDU_NONE;
+                spin_unlock_bh(&sta_priv->ampdu_lock);
+
                 ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
                 break;
         default:
diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
index 63986931829e..69ed39731902 100644
--- a/drivers/net/wireless/ath/wcn36xx/smd.c
+++ b/drivers/net/wireless/ath/wcn36xx/smd.c
@@ -21,6 +21,61 @@
 #include <linux/bitops.h>
 #include "smd.h"
 
+struct wcn36xx_cfg_val {
+        u32 cfg_id;
+        u32 value;
+};
+
+#define WCN36XX_CFG_VAL(id, val) \
+{ \
+        .cfg_id = WCN36XX_HAL_CFG_ ## id, \
+        .value = val \
+}
+
+static struct wcn36xx_cfg_val wcn36xx_cfg_vals[] = {
+        WCN36XX_CFG_VAL(CURRENT_TX_ANTENNA, 1),
+        WCN36XX_CFG_VAL(CURRENT_RX_ANTENNA, 1),
+        WCN36XX_CFG_VAL(LOW_GAIN_OVERRIDE, 0),
+        WCN36XX_CFG_VAL(POWER_STATE_PER_CHAIN, 785),
+        WCN36XX_CFG_VAL(CAL_PERIOD, 5),
+        WCN36XX_CFG_VAL(CAL_CONTROL, 1),
+        WCN36XX_CFG_VAL(PROXIMITY, 0),
+        WCN36XX_CFG_VAL(NETWORK_DENSITY, 3),
+        WCN36XX_CFG_VAL(MAX_MEDIUM_TIME, 6000),
+        WCN36XX_CFG_VAL(MAX_MPDUS_IN_AMPDU, 64),
+        WCN36XX_CFG_VAL(RTS_THRESHOLD, 2347),
+        WCN36XX_CFG_VAL(SHORT_RETRY_LIMIT, 6),
+        WCN36XX_CFG_VAL(LONG_RETRY_LIMIT, 6),
+        WCN36XX_CFG_VAL(FRAGMENTATION_THRESHOLD, 8000),
+        WCN36XX_CFG_VAL(DYNAMIC_THRESHOLD_ZERO, 5),
+        WCN36XX_CFG_VAL(DYNAMIC_THRESHOLD_ONE, 10),
+        WCN36XX_CFG_VAL(DYNAMIC_THRESHOLD_TWO, 15),
+        WCN36XX_CFG_VAL(FIXED_RATE, 0),
+        WCN36XX_CFG_VAL(RETRYRATE_POLICY, 4),
+        WCN36XX_CFG_VAL(RETRYRATE_SECONDARY, 0),
+        WCN36XX_CFG_VAL(RETRYRATE_TERTIARY, 0),
+        WCN36XX_CFG_VAL(FORCE_POLICY_PROTECTION, 5),
+        WCN36XX_CFG_VAL(FIXED_RATE_MULTICAST_24GHZ, 1),
+        WCN36XX_CFG_VAL(FIXED_RATE_MULTICAST_5GHZ, 5),
+        WCN36XX_CFG_VAL(DEFAULT_RATE_INDEX_5GHZ, 5),
+        WCN36XX_CFG_VAL(MAX_BA_SESSIONS, 40),
+        WCN36XX_CFG_VAL(PS_DATA_INACTIVITY_TIMEOUT, 200),
+        WCN36XX_CFG_VAL(PS_ENABLE_BCN_FILTER, 1),
+        WCN36XX_CFG_VAL(PS_ENABLE_RSSI_MONITOR, 1),
+        WCN36XX_CFG_VAL(NUM_BEACON_PER_RSSI_AVERAGE, 20),
+        WCN36XX_CFG_VAL(STATS_PERIOD, 10),
+        WCN36XX_CFG_VAL(CFP_MAX_DURATION, 30000),
+        WCN36XX_CFG_VAL(FRAME_TRANS_ENABLED, 0),
+        WCN36XX_CFG_VAL(BA_THRESHOLD_HIGH, 128),
+        WCN36XX_CFG_VAL(MAX_BA_BUFFERS, 2560),
+        WCN36XX_CFG_VAL(DYNAMIC_PS_POLL_VALUE, 0),
+        WCN36XX_CFG_VAL(TX_PWR_CTRL_ENABLE, 1),
+        WCN36XX_CFG_VAL(ENABLE_CLOSE_LOOP, 1),
+        WCN36XX_CFG_VAL(ENABLE_LPWR_IMG_TRANSITION, 0),
+        WCN36XX_CFG_VAL(MAX_ASSOC_LIMIT, 10),
+        WCN36XX_CFG_VAL(ENABLE_MCC_ADAPTIVE_SCHEDULER, 0),
+};
+
 static int put_cfg_tlv_u32(struct wcn36xx *wcn, size_t *len, u32 id, u32 value)
 {
         struct wcn36xx_hal_cfg *entry;
@@ -357,8 +412,10 @@ static int wcn36xx_smd_start_rsp(struct wcn36xx *wcn, void *buf, size_t len)
 
 int wcn36xx_smd_start(struct wcn36xx *wcn)
 {
-        struct wcn36xx_hal_mac_start_req_msg msg_body;
+        struct wcn36xx_hal_mac_start_req_msg msg_body, *body;
         int ret = 0;
+        int i;
+        size_t len;
 
         mutex_lock(&wcn->hal_mutex);
         INIT_HAL_MSG(msg_body, WCN36XX_HAL_START_REQ);
@@ -368,10 +425,22 @@ int wcn36xx_smd_start(struct wcn36xx *wcn)
 
         PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
 
+        body = (struct wcn36xx_hal_mac_start_req_msg *)wcn->hal_buf;
+        len = body->header.len;
+
+        for (i = 0; i < ARRAY_SIZE(wcn36xx_cfg_vals); i++) {
+                ret = put_cfg_tlv_u32(wcn, &len, wcn36xx_cfg_vals[i].cfg_id,
+                                      wcn36xx_cfg_vals[i].value);
+                if (ret)
+                        goto out;
+        }
+        body->header.len = len;
+        body->params.len = len - sizeof(*body);
+
         wcn36xx_dbg(WCN36XX_DBG_HAL, "hal start type %d\n",
                     msg_body.params.type);
 
-        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        ret = wcn36xx_smd_send_and_wait(wcn, body->header.len);
         if (ret) {
                 wcn36xx_err("Sending hal_start failed\n");
                 goto out;
diff --git a/drivers/net/wireless/ath/wcn36xx/txrx.c b/drivers/net/wireless/ath/wcn36xx/txrx.c
index 32bb26a0db2a..9bec8237231d 100644
--- a/drivers/net/wireless/ath/wcn36xx/txrx.c
+++ b/drivers/net/wireless/ath/wcn36xx/txrx.c
@@ -93,6 +93,7 @@ static void wcn36xx_set_tx_pdu(struct wcn36xx_tx_bd *bd,
                 bd->pdu.mpdu_header_off;
         bd->pdu.mpdu_len = len;
         bd->pdu.tid = tid;
+        bd->pdu.bd_ssn = WCN36XX_TXBD_SSN_FILL_DPU_QOS;
 }
 
 static inline struct wcn36xx_vif *get_vif_by_addr(struct wcn36xx *wcn,
@@ -110,15 +111,54 @@ static inline struct wcn36xx_vif *get_vif_by_addr(struct wcn36xx *wcn,
         wcn36xx_warn("vif %pM not found\n", addr);
         return NULL;
 }
+
+static void wcn36xx_tx_start_ampdu(struct wcn36xx *wcn,
+                                   struct wcn36xx_sta *sta_priv,
+                                   struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        struct ieee80211_sta *sta;
+        u8 *qc, tid;
+
+        if (!conf_is_ht(&wcn->hw->conf))
+                return;
+
+        sta = wcn36xx_priv_to_sta(sta_priv);
+
+        if (WARN_ON(!ieee80211_is_data_qos(hdr->frame_control)))
+                return;
+
+        if (skb_get_queue_mapping(skb) == IEEE80211_AC_VO)
+                return;
+
+        qc = ieee80211_get_qos_ctl(hdr);
+        tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
+
+        spin_lock(&sta_priv->ampdu_lock);
+        if (sta_priv->ampdu_state[tid] != WCN36XX_AMPDU_NONE)
+                goto out_unlock;
+
+        if (sta_priv->non_agg_frame_ct++ >= WCN36XX_AMPDU_START_THRESH) {
+                sta_priv->ampdu_state[tid] = WCN36XX_AMPDU_START;
+                sta_priv->non_agg_frame_ct = 0;
+                ieee80211_start_tx_ba_session(sta, tid, 0);
+        }
+out_unlock:
+        spin_unlock(&sta_priv->ampdu_lock);
+}
+
 static void wcn36xx_set_tx_data(struct wcn36xx_tx_bd *bd,
                                 struct wcn36xx *wcn,
                                 struct wcn36xx_vif **vif_priv,
                                 struct wcn36xx_sta *sta_priv,
-                                struct ieee80211_hdr *hdr,
+                                struct sk_buff *skb,
                                 bool bcast)
 {
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         struct ieee80211_vif *vif = NULL;
         struct wcn36xx_vif *__vif_priv = NULL;
+        bool is_data_qos;
+
         bd->bd_rate = WCN36XX_BD_RATE_DATA;
 
         /*
@@ -157,14 +197,26 @@ static void wcn36xx_set_tx_data(struct wcn36xx_tx_bd *bd,
                 bd->ack_policy = 1;
         }
         *vif_priv = __vif_priv;
+
+        is_data_qos = ieee80211_is_data_qos(hdr->frame_control);
+
+        wcn36xx_set_tx_pdu(bd,
+                           is_data_qos ?
+                           sizeof(struct ieee80211_qos_hdr) :
+                           sizeof(struct ieee80211_hdr_3addr),
+                           skb->len, sta_priv ? sta_priv->tid : 0);
+
+        if (sta_priv && is_data_qos)
+                wcn36xx_tx_start_ampdu(wcn, sta_priv, skb);
 }
 
 static void wcn36xx_set_tx_mgmt(struct wcn36xx_tx_bd *bd,
                                 struct wcn36xx *wcn,
                                 struct wcn36xx_vif **vif_priv,
-                                struct ieee80211_hdr *hdr,
+                                struct sk_buff *skb,
                                 bool bcast)
 {
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         struct wcn36xx_vif *__vif_priv =
                 get_vif_by_addr(wcn, hdr->addr2);
         bd->sta_index = __vif_priv->self_sta_index;
@@ -198,6 +250,12 @@ static void wcn36xx_set_tx_mgmt(struct wcn36xx_tx_bd *bd,
         } else
                 bd->queue_id = WCN36XX_TX_U_WQ_ID;
         *vif_priv = __vif_priv;
+
+        wcn36xx_set_tx_pdu(bd,
+                           ieee80211_is_data_qos(hdr->frame_control) ?
+                           sizeof(struct ieee80211_qos_hdr) :
+                           sizeof(struct ieee80211_hdr_3addr),
+                           skb->len, WCN36XX_TID);
 }
 
 int wcn36xx_start_tx(struct wcn36xx *wcn,
@@ -237,7 +295,7 @@ int wcn36xx_start_tx(struct wcn36xx *wcn,
 
         bd->dpu_rf = WCN36XX_BMU_WQ_TX;
 
-        bd->tx_comp = info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS;
+        bd->tx_comp = !!(info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS);
         if (bd->tx_comp) {
                 wcn36xx_dbg(WCN36XX_DBG_DXE, "TX_ACK status requested\n");
                 spin_lock_irqsave(&wcn->dxe_lock, flags);
@@ -259,22 +317,11 @@ int wcn36xx_start_tx(struct wcn36xx *wcn,
         }
 
         /* Data frames served first*/
-        if (is_low) {
-                wcn36xx_set_tx_data(bd, wcn, &vif_priv, sta_priv, hdr, bcast);
-                wcn36xx_set_tx_pdu(bd,
-                           ieee80211_is_data_qos(hdr->frame_control) ?
-                           sizeof(struct ieee80211_qos_hdr) :
-                           sizeof(struct ieee80211_hdr_3addr),
-                           skb->len, sta_priv ? sta_priv->tid : 0);
-        } else {
+        if (is_low)
+                wcn36xx_set_tx_data(bd, wcn, &vif_priv, sta_priv, skb, bcast);
+        else
                 /* MGMT and CTRL frames are handeld here*/
-                wcn36xx_set_tx_mgmt(bd, wcn, &vif_priv, hdr, bcast);
-                wcn36xx_set_tx_pdu(bd,
-                           ieee80211_is_data_qos(hdr->frame_control) ?
-                           sizeof(struct ieee80211_qos_hdr) :
-                           sizeof(struct ieee80211_hdr_3addr),
-                           skb->len, WCN36XX_TID);
-        }
+                wcn36xx_set_tx_mgmt(bd, wcn, &vif_priv, skb, bcast);
 
         buff_to_be((u32 *)bd, sizeof(*bd)/sizeof(u32));
         bd->tx_bd_sign = 0xbdbdbdbd;
diff --git a/drivers/net/wireless/ath/wcn36xx/txrx.h b/drivers/net/wireless/ath/wcn36xx/txrx.h
index bbfbcf808c77..032216e82b2b 100644
--- a/drivers/net/wireless/ath/wcn36xx/txrx.h
+++ b/drivers/net/wireless/ath/wcn36xx/txrx.h
@@ -32,6 +32,12 @@
 #define WCN36XX_BD_RATE_MGMT 2
 #define WCN36XX_BD_RATE_CTRL 3
 
+enum wcn36xx_txbd_ssn_type {
+        WCN36XX_TXBD_SSN_FILL_HOST = 0,
+        WCN36XX_TXBD_SSN_FILL_DPU_NON_QOS = 1,
+        WCN36XX_TXBD_SSN_FILL_DPU_QOS = 2,
+};
+
 struct wcn36xx_pdu {
         u32     dpu_fb:8;
         u32     adu_fb:8;
@@ -50,7 +56,8 @@ struct wcn36xx_pdu {
         /* 0x0c*/
         u32     reserved4:8;
         u32     tid:4;
-        u32     reserved3:4;
+        u32     bd_ssn:2;
+        u32     reserved3:2;
         u32     mpdu_len:16;
 };
 
diff --git a/drivers/net/wireless/ath/wcn36xx/wcn36xx.h b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
index f0fb81dfd17b..7b41e833e18c 100644
--- a/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
+++ b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
@@ -32,6 +32,9 @@
 #define WLAN_NV_FILE               "wlan/prima/WCNSS_qcom_wlan_nv.bin"
 #define WCN36XX_AGGR_BUFFER_SIZE 64
 
+/* How many frames until we start a-mpdu TX session */
+#define WCN36XX_AMPDU_START_THRESH      20
+
 extern unsigned int wcn36xx_dbg_mask;
 
 enum wcn36xx_debug_mask {
@@ -74,6 +77,13 @@ enum wcn36xx_debug_mask {
                                buf, len, false);                \
 } while (0)
 
+enum wcn36xx_ampdu_state {
+        WCN36XX_AMPDU_NONE,
+        WCN36XX_AMPDU_INIT,
+        WCN36XX_AMPDU_START,
+        WCN36XX_AMPDU_OPERATIONAL,
+};
+
 #define WCN36XX_HW_CHANNEL(__wcn) (__wcn->hw->conf.chandef.chan->hw_value)
 #define WCN36XX_BAND(__wcn) (__wcn->hw->conf.chandef.chan->band)
 #define WCN36XX_CENTER_FREQ(__wcn) (__wcn->hw->conf.chandef.chan->center_freq)
@@ -165,6 +175,10 @@ struct wcn36xx_sta {
         bool is_data_encrypted;
         /* Rates */
         struct wcn36xx_hal_supported_rates supported_rates;
+
+        spinlock_t ampdu_lock;          /* protects next two fields */
+        enum wcn36xx_ampdu_state ampdu_state[16];
+        int non_agg_frame_ct;
 };
 struct wcn36xx_dxe_ch;
 struct wcn36xx {
@@ -243,4 +257,10 @@ static inline bool wcn36xx_is_fw_version(struct wcn36xx *wcn,
 }
 void wcn36xx_set_default_rates(struct wcn36xx_hal_supported_rates *rates);
 
+static inline
+struct ieee80211_sta *wcn36xx_priv_to_sta(struct wcn36xx_sta *sta_priv)
+{
+        return container_of((void *)sta_priv, struct ieee80211_sta, drv_priv);
+}
+
 #endif  /* _WCN36XX_H_ */
diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c
index e72a95d1ced6..bd013fdb86dc 100644
--- a/drivers/net/wireless/ath/wil6210/cfg80211.c
+++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
@@ -162,7 +162,7 @@ int wil_cid_fill_sinfo(struct wil6210_priv *wil, int cid,
         sinfo->tx_packets = stats->tx_packets;
         sinfo->tx_failed = stats->tx_errors;
 
-        if (test_bit(wil_status_fwconnected, &wil->status)) {
+        if (test_bit(wil_status_fwconnected, wil->status)) {
                 sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
                 sinfo->signal = reply.evt.sqi;
         }
@@ -282,7 +282,7 @@ static int wil_cfg80211_scan(struct wiphy *wiphy,
         }
 
         /* FW don't support scan after connection attempt */
-        if (test_bit(wil_status_dontscan, &wil->status)) {
+        if (test_bit(wil_status_dontscan, wil->status)) {
                 wil_err(wil, "Can't scan now\n");
                 return -EBUSY;
         }
@@ -362,8 +362,8 @@ static int wil_cfg80211_connect(struct wiphy *wiphy,
         int ch;
         int rc = 0;
 
-        if (test_bit(wil_status_fwconnecting, &wil->status) ||
-            test_bit(wil_status_fwconnected, &wil->status))
+        if (test_bit(wil_status_fwconnecting, wil->status) ||
+            test_bit(wil_status_fwconnected, wil->status))
                 return -EALREADY;
 
         wil_print_connect_params(wil, sme);
@@ -450,7 +450,7 @@ static int wil_cfg80211_connect(struct wiphy *wiphy,
         memcpy(conn.bssid, bss->bssid, ETH_ALEN);
         memcpy(conn.dst_mac, bss->bssid, ETH_ALEN);
 
-        set_bit(wil_status_fwconnecting, &wil->status);
+        set_bit(wil_status_fwconnecting, wil->status);
 
         rc = wmi_send(wil, WMI_CONNECT_CMDID, &conn, sizeof(conn));
         if (rc == 0) {
@@ -458,7 +458,7 @@ static int wil_cfg80211_connect(struct wiphy *wiphy,
                 mod_timer(&wil->connect_timer,
                           jiffies + msecs_to_jiffies(2000));
         } else {
-                clear_bit(wil_status_fwconnecting, &wil->status);
+                clear_bit(wil_status_fwconnecting, wil->status);
         }
 
  out:
diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
index 4e6e14501c2f..45c3558ec804 100644
--- a/drivers/net/wireless/ath/wil6210/debugfs.c
+++ b/drivers/net/wireless/ath/wil6210/debugfs.c
@@ -50,6 +50,7 @@ static void wil_print_vring(struct seq_file *s, struct wil6210_priv *wil,
                             char _s, char _h)
 {
         void __iomem *x = wmi_addr(wil, vring->hwtail);
+        u32 v;
 
         seq_printf(s, "VRING %s = {\n", name);
         seq_printf(s, "  pa     = %pad\n", &vring->pa);
@@ -58,10 +59,12 @@ static void wil_print_vring(struct seq_file *s, struct wil6210_priv *wil,
         seq_printf(s, "  swtail = %d\n", vring->swtail);
         seq_printf(s, "  swhead = %d\n", vring->swhead);
         seq_printf(s, "  hwtail = [0x%08x] -> ", vring->hwtail);
-        if (x)
-                seq_printf(s, "0x%08x\n", ioread32(x));
-        else
+        if (x) {
+                v = ioread32(x);
+                seq_printf(s, "0x%08x = %d\n", v, v);
+        } else {
                 seq_puts(s, "???\n");
+        }
 
         if (vring->va && (vring->size < 1025)) {
                 uint i;
@@ -101,8 +104,8 @@ static int wil_vring_debugfs_show(struct seq_file *s, void *data)
                         char name[10];
                         /* performance monitoring */
                         cycles_t now = get_cycles();
-                        cycles_t idle = txdata->idle * 100;
-                        cycles_t total = now - txdata->begin;
+                        uint64_t idle = txdata->idle * 100;
+                        uint64_t total = now - txdata->begin;
 
                         do_div(idle, total);
                         txdata->begin = now;
@@ -110,9 +113,12 @@ static int wil_vring_debugfs_show(struct seq_file *s, void *data)
 
                         snprintf(name, sizeof(name), "tx_%2d", i);
 
-                        seq_printf(s, "\n%pM CID %d TID %d [%3d|%3d] idle %3d%%\n",
-                                   wil->sta[cid].addr, cid, tid, used, avail,
-                                   (int)idle);
+                        seq_printf(s,
+                                   "\n%pM CID %d TID %d BACK([%d] %d TU A%s) [%3d|%3d] idle %3d%%\n",
+                                   wil->sta[cid].addr, cid, tid,
+                                   txdata->agg_wsize, txdata->agg_timeout,
+                                   txdata->agg_amsdu ? "+" : "-",
+                                   used, avail, (int)idle);
 
                         wil_print_vring(s, wil, name, vring, '_', 'H');
                 }
@@ -384,24 +390,67 @@ static int wil6210_debugfs_create_pseudo_ISR(struct wil6210_priv *wil,
         return 0;
 }
 
-static const struct dbg_off itr_cnt_off[] = {
+static const struct dbg_off lgc_itr_cnt_off[] = {
         {"TRSH", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_CNT_TRSH), doff_io32},
         {"DATA", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_CNT_DATA), doff_io32},
         {"CTL",  S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_CNT_CRL), doff_io32},
         {},
 };
 
+static const struct dbg_off tx_itr_cnt_off[] = {
+        {"TRSH", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_TX_CNT_TRSH),
+         doff_io32},
+        {"DATA", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_TX_CNT_DATA),
+         doff_io32},
+        {"CTL",  S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_TX_CNT_CTL),
+         doff_io32},
+        {"IDL_TRSH", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_TX_IDL_CNT_TRSH),
+         doff_io32},
+        {"IDL_DATA", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_TX_IDL_CNT_DATA),
+         doff_io32},
+        {"IDL_CTL",  S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_TX_IDL_CNT_CTL),
+         doff_io32},
+        {},
+};
+
+static const struct dbg_off rx_itr_cnt_off[] = {
+        {"TRSH", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_RX_CNT_TRSH),
+         doff_io32},
+        {"DATA", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_RX_CNT_DATA),
+         doff_io32},
+        {"CTL",  S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_RX_CNT_CTL),
+         doff_io32},
+        {"IDL_TRSH", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_RX_IDL_CNT_TRSH),
+         doff_io32},
+        {"IDL_DATA", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_RX_IDL_CNT_DATA),
+         doff_io32},
+        {"IDL_CTL",  S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_RX_IDL_CNT_CTL),
+         doff_io32},
+        {},
+};
+
 static int wil6210_debugfs_create_ITR_CNT(struct wil6210_priv *wil,
                                           struct dentry *parent)
 {
-        struct dentry *d = debugfs_create_dir("ITR_CNT", parent);
+        struct dentry *d, *dtx, *drx;
 
+        d = debugfs_create_dir("ITR_CNT", parent);
         if (IS_ERR_OR_NULL(d))
                 return -ENODEV;
 
+        dtx = debugfs_create_dir("TX", d);
+        drx = debugfs_create_dir("RX", d);
+        if (IS_ERR_OR_NULL(dtx) || IS_ERR_OR_NULL(drx))
+                return -ENODEV;
+
         wil6210_debugfs_init_offset(wil, d, (void * __force)wil->csr,
-                                    itr_cnt_off);
+                                    lgc_itr_cnt_off);
+
+        wil6210_debugfs_init_offset(wil, dtx, (void * __force)wil->csr,
+                                    tx_itr_cnt_off);
 
+        wil6210_debugfs_init_offset(wil, drx, (void * __force)wil->csr,
+                                    rx_itr_cnt_off);
         return 0;
 }
 
@@ -558,6 +607,87 @@ static const struct file_operations fops_rxon = {
         .open  = simple_open,
 };
 
+/* block ack control, write:
+ * - "add <ringid> <agg_size> <timeout>" to trigger ADDBA
+ * - "del_tx <ringid> <reason>" to trigger DELBA for Tx side
+ * - "del_rx <CID> <TID> <reason>" to trigger DELBA for Rx side
+ */
+static ssize_t wil_write_back(struct file *file, const char __user *buf,
+                              size_t len, loff_t *ppos)
+{
+        struct wil6210_priv *wil = file->private_data;
+        int rc;
+        char *kbuf = kmalloc(len + 1, GFP_KERNEL);
+        char cmd[8];
+        int p1, p2, p3;
+
+        if (!kbuf)
+                return -ENOMEM;
+
+        rc = simple_write_to_buffer(kbuf, len, ppos, buf, len);
+        if (rc != len) {
+                kfree(kbuf);
+                return rc >= 0 ? -EIO : rc;
+        }
+
+        kbuf[len] = '\0';
+        rc = sscanf(kbuf, "%8s %d %d %d", cmd, &p1, &p2, &p3);
+        kfree(kbuf);
+
+        if (rc < 0)
+                return rc;
+        if (rc < 2)
+                return -EINVAL;
+
+        if (0 == strcmp(cmd, "add")) {
+                if (rc < 3) {
+                        wil_err(wil, "BACK: add require at least 2 params\n");
+                        return -EINVAL;
+                }
+                if (rc < 4)
+                        p3 = 0;
+                wmi_addba(wil, p1, p2, p3);
+        } else if (0 == strcmp(cmd, "del_tx")) {
+                if (rc < 3)
+                        p2 = WLAN_REASON_QSTA_LEAVE_QBSS;
+                wmi_delba_tx(wil, p1, p2);
+        } else if (0 == strcmp(cmd, "del_rx")) {
+                if (rc < 3) {
+                        wil_err(wil,
+                                "BACK: del_rx require at least 2 params\n");
+                        return -EINVAL;
+                }
+                if (rc < 4)
+                        p3 = WLAN_REASON_QSTA_LEAVE_QBSS;
+                wmi_delba_rx(wil, mk_cidxtid(p1, p2), p3);
+        } else {
+                wil_err(wil, "BACK: Unrecognized command \"%s\"\n", cmd);
+                return -EINVAL;
+        }
+
+        return len;
+}
+
+static ssize_t wil_read_back(struct file *file, char __user *user_buf,
+                             size_t count, loff_t *ppos)
+{
+        static const char text[] = "block ack control, write:\n"
+        " - \"add <ringid> <agg_size> <timeout>\" to trigger ADDBA\n"
+        "If missing, <timeout> defaults to 0\n"
+        " - \"del_tx <ringid> <reason>\" to trigger DELBA for Tx side\n"
+        " - \"del_rx <CID> <TID> <reason>\" to trigger DELBA for Rx side\n"
+        "If missing, <reason> set to \"STA_LEAVING\" (36)\n";
+
+        return simple_read_from_buffer(user_buf, count, ppos, text,
+                                       sizeof(text));
+}
+
+static const struct file_operations fops_back = {
+        .read = wil_read_back,
+        .write = wil_write_back,
+        .open  = simple_open,
+};
+
 /*---tx_mgmt---*/
 /* Write mgmt frame to this file to send it */
 static ssize_t wil_write_file_txmgmt(struct file *file, const char __user *buf,
@@ -1116,7 +1246,8 @@ static void wil_print_rxtid(struct seq_file *s, struct wil_tid_ampdu_rx *r)
         int i;
         u16 index = ((r->head_seq_num - r->ssn) & 0xfff) % r->buf_size;
 
-        seq_printf(s, "0x%03x [", r->head_seq_num);
+        seq_printf(s, "([%2d] %3d TU) 0x%03x [", r->buf_size, r->timeout,
+                   r->head_seq_num);
         for (i = 0; i < r->buf_size; i++) {
                 if (i == index)
                         seq_printf(s, "%c", r->reorder_buf[i] ? 'O' : '|');
@@ -1127,10 +1258,10 @@ static void wil_print_rxtid(struct seq_file *s, struct wil_tid_ampdu_rx *r)
 }
 
 static int wil_sta_debugfs_show(struct seq_file *s, void *data)
+__acquires(&p->tid_rx_lock) __releases(&p->tid_rx_lock)
 {
         struct wil6210_priv *wil = s->private;
         int i, tid;
-        unsigned long flags;
 
         for (i = 0; i < ARRAY_SIZE(wil->sta); i++) {
                 struct wil_sta_info *p = &wil->sta[i];
@@ -1151,7 +1282,7 @@ static int wil_sta_debugfs_show(struct seq_file *s, void *data)
                            (p->data_port_open ? " data_port_open" : ""));
 
                 if (p->status == wil_sta_connected) {
-                        spin_lock_irqsave(&p->tid_rx_lock, flags);
+                        spin_lock_bh(&p->tid_rx_lock);
                         for (tid = 0; tid < WIL_STA_TID_NUM; tid++) {
                                 struct wil_tid_ampdu_rx *r = p->tid_rx[tid];
 
@@ -1160,7 +1291,7 @@ static int wil_sta_debugfs_show(struct seq_file *s, void *data)
                                         wil_print_rxtid(s, r);
                                 }
                         }
-                        spin_unlock_irqrestore(&p->tid_rx_lock, flags);
+                        spin_unlock_bh(&p->tid_rx_lock);
                 }
         }
 
@@ -1217,6 +1348,7 @@ static const struct {
         {"rxon",                  S_IWUSR,      &fops_rxon},
         {"tx_mgmt",               S_IWUSR,      &fops_txmgmt},
         {"wmi_send",              S_IWUSR,      &fops_wmi},
+        {"back",        S_IRUGO | S_IWUSR,      &fops_back},
         {"temp",        S_IRUGO,                &fops_temp},
         {"freq",        S_IRUGO,                &fops_freq},
         {"link",        S_IRUGO,                &fops_link},
@@ -1261,7 +1393,7 @@ static void wil6210_debugfs_init_isr(struct wil6210_priv *wil,
 /* fields in struct wil6210_priv */
 static const struct dbg_off dbg_wil_off[] = {
         WIL_FIELD(secure_pcp,   S_IRUGO | S_IWUSR,      doff_u32),
-        WIL_FIELD(status,       S_IRUGO | S_IWUSR,      doff_ulong),
+        WIL_FIELD(status[0],    S_IRUGO | S_IWUSR,      doff_ulong),
         WIL_FIELD(fw_version,   S_IRUGO,                doff_u32),
         WIL_FIELD(hw_version,   S_IRUGO,                doff_x32),
         WIL_FIELD(recovery_count, S_IRUGO,              doff_u32),
diff --git a/drivers/net/wireless/ath/wil6210/ethtool.c b/drivers/net/wireless/ath/wil6210/ethtool.c
index d686638972be..4c44a82c34d7 100644
--- a/drivers/net/wireless/ath/wil6210/ethtool.c
+++ b/drivers/net/wireless/ath/wil6210/ethtool.c
@@ -45,16 +45,35 @@ static int wil_ethtoolops_get_coalesce(struct net_device *ndev,
                                        struct ethtool_coalesce *cp)
 {
         struct wil6210_priv *wil = ndev_to_wil(ndev);
-        u32 itr_en, itr_val = 0;
+        u32 tx_itr_en, tx_itr_val = 0;
+        u32 rx_itr_en, rx_itr_val = 0;
 
         wil_dbg_misc(wil, "%s()\n", __func__);
 
-        itr_en = ioread32(wil->csr + HOSTADDR(RGF_DMA_ITR_CNT_CRL));
-        if (itr_en & BIT_DMA_ITR_CNT_CRL_EN)
-                itr_val = ioread32(wil->csr + HOSTADDR(RGF_DMA_ITR_CNT_TRSH));
-
-        cp->rx_coalesce_usecs = itr_val;
+        if (test_bit(hw_capability_advanced_itr_moderation,
+                     wil->hw_capabilities)) {
+                tx_itr_en = ioread32(wil->csr +
+                                     HOSTADDR(RGF_DMA_ITR_TX_CNT_CTL));
+                if (tx_itr_en & BIT_DMA_ITR_TX_CNT_CTL_EN)
+                        tx_itr_val =
+                                ioread32(wil->csr +
+                                         HOSTADDR(RGF_DMA_ITR_TX_CNT_TRSH));
+
+                rx_itr_en = ioread32(wil->csr +
+                                     HOSTADDR(RGF_DMA_ITR_RX_CNT_CTL));
+                if (rx_itr_en & BIT_DMA_ITR_RX_CNT_CTL_EN)
+                        rx_itr_val =
+                                ioread32(wil->csr +
+                                         HOSTADDR(RGF_DMA_ITR_RX_CNT_TRSH));
+        } else {
+                rx_itr_en = ioread32(wil->csr + HOSTADDR(RGF_DMA_ITR_CNT_CRL));
+                if (rx_itr_en & BIT_DMA_ITR_CNT_CRL_EN)
+                        rx_itr_val = ioread32(wil->csr +
+                                              HOSTADDR(RGF_DMA_ITR_CNT_TRSH));
+        }
 
+        cp->tx_coalesce_usecs = tx_itr_val;
+        cp->rx_coalesce_usecs = rx_itr_val;
         return 0;
 }
 
@@ -63,22 +82,25 @@ static int wil_ethtoolops_set_coalesce(struct net_device *ndev,
 {
         struct wil6210_priv *wil = ndev_to_wil(ndev);
 
-        wil_dbg_misc(wil, "%s(%d usec)\n", __func__, cp->rx_coalesce_usecs);
+        wil_dbg_misc(wil, "%s(rx %d usec, tx %d usec)\n", __func__,
+                     cp->rx_coalesce_usecs, cp->tx_coalesce_usecs);
 
         if (wil->wdev->iftype == NL80211_IFTYPE_MONITOR) {
                 wil_dbg_misc(wil, "No IRQ coalescing in monitor mode\n");
                 return -EINVAL;
         }
 
-        /* only @rx_coalesce_usecs supported, ignore
-         * other parameters
+        /* only @rx_coalesce_usecs and @tx_coalesce_usecs supported,
+         * ignore other parameters
          */
 
-        if (cp->rx_coalesce_usecs > WIL6210_ITR_TRSH_MAX)
+        if (cp->rx_coalesce_usecs > WIL6210_ITR_TRSH_MAX ||
+            cp->tx_coalesce_usecs > WIL6210_ITR_TRSH_MAX)
                 goto out_bad;
 
-        wil->itr_trsh = cp->rx_coalesce_usecs;
-        wil_set_itr_trsh(wil);
+        wil->tx_max_burst_duration = cp->tx_coalesce_usecs;
+        wil->rx_max_burst_duration = cp->rx_coalesce_usecs;
+        wil_configure_interrupt_moderation(wil);
 
         return 0;
 
diff --git a/drivers/net/wireless/ath/wil6210/interrupt.c b/drivers/net/wireless/ath/wil6210/interrupt.c
index 4bcbd6297b3e..a6f923086f31 100644
--- a/drivers/net/wireless/ath/wil6210/interrupt.c
+++ b/drivers/net/wireless/ath/wil6210/interrupt.c
@@ -102,7 +102,7 @@ static void wil6210_mask_irq_pseudo(struct wil6210_priv *wil)
         iowrite32(WIL6210_IRQ_DISABLE, wil->csr +
                   HOSTADDR(RGF_DMA_PSEUDO_CAUSE_MASK_SW));
 
-        clear_bit(wil_status_irqen, &wil->status);
+        clear_bit(wil_status_irqen, wil->status);
 }
 
 void wil6210_unmask_irq_tx(struct wil6210_priv *wil)
@@ -130,7 +130,7 @@ static void wil6210_unmask_irq_pseudo(struct wil6210_priv *wil)
 {
         wil_dbg_irq(wil, "%s()\n", __func__);
 
-        set_bit(wil_status_irqen, &wil->status);
+        set_bit(wil_status_irqen, wil->status);
 
         iowrite32(WIL6210_IRQ_PSEUDO_MASK, wil->csr +
                   HOSTADDR(RGF_DMA_PSEUDO_CAUSE_MASK_SW));
@@ -157,15 +157,91 @@ void wil_unmask_irq(struct wil6210_priv *wil)
         iowrite32(WIL_ICR_ICC_VALUE, wil->csr + HOSTADDR(RGF_DMA_EP_MISC_ICR) +
                   offsetof(struct RGF_ICR, ICC));
 
-        /* interrupt moderation parameters */
-        wil_set_itr_trsh(wil);
-
         wil6210_unmask_irq_pseudo(wil);
         wil6210_unmask_irq_tx(wil);
         wil6210_unmask_irq_rx(wil);
         wil6210_unmask_irq_misc(wil);
 }
 
+/* target write operation */
+#define W(a, v) do { iowrite32(v, wil->csr + HOSTADDR(a)); wmb(); } while (0)
+
+static
+void wil_configure_interrupt_moderation_new(struct wil6210_priv *wil)
+{
+        /* Disable and clear tx counter before (re)configuration */
+        W(RGF_DMA_ITR_TX_CNT_CTL, BIT_DMA_ITR_TX_CNT_CTL_CLR);
+        W(RGF_DMA_ITR_TX_CNT_TRSH, wil->tx_max_burst_duration);
+        wil_info(wil, "set ITR_TX_CNT_TRSH = %d usec\n",
+                 wil->tx_max_burst_duration);
+        /* Configure TX max burst duration timer to use usec units */
+        W(RGF_DMA_ITR_TX_CNT_CTL,
+          BIT_DMA_ITR_TX_CNT_CTL_EN | BIT_DMA_ITR_TX_CNT_CTL_EXT_TIC_SEL);
+
+        /* Disable and clear tx idle counter before (re)configuration */
+        W(RGF_DMA_ITR_TX_IDL_CNT_CTL, BIT_DMA_ITR_TX_IDL_CNT_CTL_CLR);
+        W(RGF_DMA_ITR_TX_IDL_CNT_TRSH, wil->tx_interframe_timeout);
+        wil_info(wil, "set ITR_TX_IDL_CNT_TRSH = %d usec\n",
+                 wil->tx_interframe_timeout);
+        /* Configure TX max burst duration timer to use usec units */
+        W(RGF_DMA_ITR_TX_IDL_CNT_CTL, BIT_DMA_ITR_TX_IDL_CNT_CTL_EN |
+                                      BIT_DMA_ITR_TX_IDL_CNT_CTL_EXT_TIC_SEL);
+
+        /* Disable and clear rx counter before (re)configuration */
+        W(RGF_DMA_ITR_RX_CNT_CTL, BIT_DMA_ITR_RX_CNT_CTL_CLR);
+        W(RGF_DMA_ITR_RX_CNT_TRSH, wil->rx_max_burst_duration);
+        wil_info(wil, "set ITR_RX_CNT_TRSH = %d usec\n",
+                 wil->rx_max_burst_duration);
+        /* Configure TX max burst duration timer to use usec units */
+        W(RGF_DMA_ITR_RX_CNT_CTL,
+          BIT_DMA_ITR_RX_CNT_CTL_EN | BIT_DMA_ITR_RX_CNT_CTL_EXT_TIC_SEL);
+
+        /* Disable and clear rx idle counter before (re)configuration */
+        W(RGF_DMA_ITR_RX_IDL_CNT_CTL, BIT_DMA_ITR_RX_IDL_CNT_CTL_CLR);
+        W(RGF_DMA_ITR_RX_IDL_CNT_TRSH, wil->rx_interframe_timeout);
+        wil_info(wil, "set ITR_RX_IDL_CNT_TRSH = %d usec\n",
+                 wil->rx_interframe_timeout);
+        /* Configure TX max burst duration timer to use usec units */
+        W(RGF_DMA_ITR_RX_IDL_CNT_CTL, BIT_DMA_ITR_RX_IDL_CNT_CTL_EN |
+                                      BIT_DMA_ITR_RX_IDL_CNT_CTL_EXT_TIC_SEL);
+}
+
+static
+void wil_configure_interrupt_moderation_lgc(struct wil6210_priv *wil)
+{
+        /* disable, use usec resolution */
+        W(RGF_DMA_ITR_CNT_CRL, BIT_DMA_ITR_CNT_CRL_CLR);
+
+        wil_info(wil, "set ITR_TRSH = %d usec\n", wil->rx_max_burst_duration);
+        W(RGF_DMA_ITR_CNT_TRSH, wil->rx_max_burst_duration);
+        /* start it */
+        W(RGF_DMA_ITR_CNT_CRL,
+          BIT_DMA_ITR_CNT_CRL_EN | BIT_DMA_ITR_CNT_CRL_EXT_TICK);
+}
+
+#undef W
+
+void wil_configure_interrupt_moderation(struct wil6210_priv *wil)
+{
+        wil_dbg_irq(wil, "%s()\n", __func__);
+
+        /* disable interrupt moderation for monitor
+         * to get better timestamp precision
+         */
+        if (wil->wdev->iftype == NL80211_IFTYPE_MONITOR)
+                return;
+
+        if (test_bit(hw_capability_advanced_itr_moderation,
+                     wil->hw_capabilities))
+                wil_configure_interrupt_moderation_new(wil);
+        else {
+                /* Advanced interrupt moderation is not available before
+                 * Sparrow v2. Will use legacy interrupt moderation
+                 */
+                wil_configure_interrupt_moderation_lgc(wil);
+        }
+}
+
 static irqreturn_t wil6210_irq_rx(int irq, void *cookie)
 {
         struct wil6210_priv *wil = cookie;
@@ -194,18 +270,19 @@ static irqreturn_t wil6210_irq_rx(int irq, void *cookie)
                 wil_dbg_irq(wil, "RX done\n");
 
                 if (isr & BIT_DMA_EP_RX_ICR_RX_HTRSH)
-                        wil_err_ratelimited(wil, "Received \"Rx buffer is in risk "
-                                "of overflow\" interrupt\n");
+                        wil_err_ratelimited(wil,
+                                            "Received \"Rx buffer is in risk of overflow\" interrupt\n");
 
-                isr &= ~(BIT_DMA_EP_RX_ICR_RX_DONE | BIT_DMA_EP_RX_ICR_RX_HTRSH);
-                if (test_bit(wil_status_reset_done, &wil->status)) {
-                        if (test_bit(wil_status_napi_en, &wil->status)) {
+                isr &= ~(BIT_DMA_EP_RX_ICR_RX_DONE |
+                         BIT_DMA_EP_RX_ICR_RX_HTRSH);
+                if (test_bit(wil_status_reset_done, wil->status)) {
+                        if (test_bit(wil_status_napi_en, wil->status)) {
                                 wil_dbg_txrx(wil, "NAPI(Rx) schedule\n");
                                 need_unmask = false;
                                 napi_schedule(&wil->napi_rx);
                         } else {
-                                wil_err(wil, "Got Rx interrupt while "
-                                        "stopping interface\n");
+                                wil_err(wil,
+                                        "Got Rx interrupt while stopping interface\n");
                         }
                 } else {
                         wil_err(wil, "Got Rx interrupt while in reset\n");
@@ -248,7 +325,7 @@ static irqreturn_t wil6210_irq_tx(int irq, void *cookie)
                 isr &= ~BIT_DMA_EP_TX_ICR_TX_DONE;
                 /* clear also all VRING interrupts */
                 isr &= ~(BIT(25) - 1UL);
-                if (test_bit(wil_status_reset_done, &wil->status)) {
+                if (test_bit(wil_status_reset_done, wil->status)) {
                         wil_dbg_txrx(wil, "NAPI(Tx) schedule\n");
                         need_unmask = false;
                         napi_schedule(&wil->napi_tx);
@@ -310,7 +387,7 @@ static irqreturn_t wil6210_irq_misc(int irq, void *cookie)
 
         if (isr & ISR_MISC_FW_ERROR) {
                 wil_err(wil, "Firmware error detected\n");
-                clear_bit(wil_status_fwready, &wil->status);
+                clear_bit(wil_status_fwready, wil->status);
                 /*
                  * do not clear @isr here - we do 2-nd part in thread
                  * there, user space get notified, and it should be done
@@ -321,7 +398,7 @@ static irqreturn_t wil6210_irq_misc(int irq, void *cookie)
         if (isr & ISR_MISC_FW_READY) {
                 wil_dbg_irq(wil, "IRQ: FW ready\n");
                 wil_cache_mbox_regs(wil);
-                set_bit(wil_status_reset_done, &wil->status);
+                set_bit(wil_status_reset_done, wil->status);
                 /**
                  * Actual FW ready indicated by the
                  * WMI_FW_READY_EVENTID
@@ -394,7 +471,7 @@ static irqreturn_t wil6210_thread_irq(int irq, void *cookie)
  */
 static int wil6210_debug_irq_mask(struct wil6210_priv *wil, u32 pseudo_cause)
 {
-        if (!test_bit(wil_status_irqen, &wil->status)) {
+        if (!test_bit(wil_status_irqen, wil->status)) {
                 u32 icm_rx = wil_ioread32_and_clear(wil->csr +
                                 HOSTADDR(RGF_DMA_EP_RX_ICR) +
                                 offsetof(struct RGF_ICR, ICM));
diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c
index 8ff3fe34fe05..62dc24189bd3 100644
--- a/drivers/net/wireless/ath/wil6210/main.c
+++ b/drivers/net/wireless/ath/wil6210/main.c
@@ -33,15 +33,46 @@ static bool no_fw_load = true;
 module_param(no_fw_load, bool, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(no_fw_load, " do not download FW, use one in on-card flash.");
 
-static unsigned int itr_trsh = WIL6210_ITR_TRSH_DEFAULT;
+static unsigned int tx_interframe_timeout =
+                WIL6210_ITR_TX_INTERFRAME_TIMEOUT_DEFAULT;
 
-module_param(itr_trsh, uint, S_IRUGO);
-MODULE_PARM_DESC(itr_trsh, " Interrupt moderation threshold, usecs.");
+module_param(tx_interframe_timeout, uint, S_IRUGO);
+MODULE_PARM_DESC(tx_interframe_timeout,
+                 " Interrupt moderation TX interframe timeout, usecs.");
+
+static unsigned int rx_interframe_timeout =
+                WIL6210_ITR_RX_INTERFRAME_TIMEOUT_DEFAULT;
+
+module_param(rx_interframe_timeout, uint, S_IRUGO);
+MODULE_PARM_DESC(rx_interframe_timeout,
+                 " Interrupt moderation RX interframe timeout, usecs.");
+
+static unsigned int tx_max_burst_duration =
+                WIL6210_ITR_TX_MAX_BURST_DURATION_DEFAULT;
+
+module_param(tx_max_burst_duration, uint, S_IRUGO);
+MODULE_PARM_DESC(tx_max_burst_duration,
+                 " Interrupt moderation TX max burst duration, usecs.");
+
+static unsigned int rx_max_burst_duration =
+                WIL6210_ITR_RX_MAX_BURST_DURATION_DEFAULT;
+
+module_param(rx_max_burst_duration, uint, S_IRUGO);
+MODULE_PARM_DESC(rx_max_burst_duration,
+                 " Interrupt moderation RX max burst duration, usecs.");
+
+/* if not set via modparam, will be set to default value of 1/8 of
+ * rx ring size during init flow
+ */
+unsigned short rx_ring_overflow_thrsh = WIL6210_RX_HIGH_TRSH_INIT;
+module_param(rx_ring_overflow_thrsh, ushort, S_IRUGO);
+MODULE_PARM_DESC(rx_ring_overflow_thrsh,
+                 " RX ring overflow threshold in descriptors.");
 
 /* We allow allocation of more than 1 page buffers to support large packets.
  * It is suboptimal behavior performance wise in case MTU above page size.
  */
-unsigned int mtu_max = TXRX_BUF_LEN_DEFAULT - ETH_HLEN;
+unsigned int mtu_max = TXRX_BUF_LEN_DEFAULT - WIL_MAX_MPDU_OVERHEAD;
 static int mtu_max_set(const char *val, const struct kernel_param *kp)
 {
         int ret;
@@ -53,7 +84,7 @@ static int mtu_max_set(const char *val, const struct kernel_param *kp)
         if (ret)
                 return ret;
 
-        if (mtu_max < 68 || mtu_max > IEEE80211_MAX_DATA_LEN_DMG)
+        if (mtu_max < 68 || mtu_max > WIL_MAX_ETH_MTU)
                 ret = -EINVAL;
 
         return ret;
@@ -135,12 +166,14 @@ void wil_memcpy_toio_32(volatile void __iomem *dst, const void *src,
 
 static void wil_disconnect_cid(struct wil6210_priv *wil, int cid,
                                u16 reason_code, bool from_event)
+__acquires(&sta->tid_rx_lock) __releases(&sta->tid_rx_lock)
 {
         uint i;
         struct net_device *ndev = wil_to_ndev(wil);
         struct wireless_dev *wdev = wil->wdev;
         struct wil_sta_info *sta = &wil->sta[cid];
 
+        might_sleep();
         wil_dbg_misc(wil, "%s(CID %d, status %d)\n", __func__, cid,
                      sta->status);
 
@@ -163,15 +196,14 @@ static void wil_disconnect_cid(struct wil6210_priv *wil, int cid,
 
         for (i = 0; i < WIL_STA_TID_NUM; i++) {
                 struct wil_tid_ampdu_rx *r;
-                unsigned long flags;
 
-                spin_lock_irqsave(&sta->tid_rx_lock, flags);
+                spin_lock_bh(&sta->tid_rx_lock);
 
                 r = sta->tid_rx[i];
                 sta->tid_rx[i] = NULL;
                 wil_tid_ampdu_rx_free(wil, r);
 
-                spin_unlock_irqrestore(&sta->tid_rx_lock, flags);
+                spin_unlock_bh(&sta->tid_rx_lock);
         }
         for (i = 0; i < ARRAY_SIZE(wil->vring_tx); i++) {
                 if (wil->vring2cid_tid[i][0] == cid)
@@ -188,34 +220,45 @@ static void _wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid,
         struct wireless_dev *wdev = wil->wdev;
 
         might_sleep();
-        if (bssid) {
+        wil_dbg_misc(wil, "%s(bssid=%pM, reason=%d, ev%s)\n", __func__, bssid,
+                     reason_code, from_event ? "+" : "-");
+
+        /* Cases are:
+         * - disconnect single STA, still connected
+         * - disconnect single STA, already disconnected
+         * - disconnect all
+         *
+         * For "disconnect all", there are 2 options:
+         * - bssid == NULL
+         * - bssid is our MAC address
+         */
+        if (bssid && memcmp(ndev->dev_addr, bssid, ETH_ALEN)) {
                 cid = wil_find_cid(wil, bssid);
-                wil_dbg_misc(wil, "%s(%pM, CID %d)\n", __func__, bssid, cid);
-        } else {
-                wil_dbg_misc(wil, "%s(all)\n", __func__);
-        }
-
-        if (cid >= 0) /* disconnect 1 peer */
-                wil_disconnect_cid(wil, cid, reason_code, from_event);
-        else /* disconnect all */
+                wil_dbg_misc(wil, "Disconnect %pM, CID=%d, reason=%d\n",
+                             bssid, cid, reason_code);
+                if (cid >= 0) /* disconnect 1 peer */
+                        wil_disconnect_cid(wil, cid, reason_code, from_event);
+        } else { /* all */
+                wil_dbg_misc(wil, "Disconnect all\n");
                 for (cid = 0; cid < WIL6210_MAX_CID; cid++)
                         wil_disconnect_cid(wil, cid, reason_code, from_event);
+        }
 
         /* link state */
         switch (wdev->iftype) {
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_P2P_CLIENT:
                 wil_link_off(wil);
-                if (test_bit(wil_status_fwconnected, &wil->status)) {
-                        clear_bit(wil_status_fwconnected, &wil->status);
+                if (test_bit(wil_status_fwconnected, wil->status)) {
+                        clear_bit(wil_status_fwconnected, wil->status);
                         cfg80211_disconnected(ndev, reason_code,
                                               NULL, 0, GFP_KERNEL);
-                } else if (test_bit(wil_status_fwconnecting, &wil->status)) {
+                } else if (test_bit(wil_status_fwconnecting, wil->status)) {
                         cfg80211_connect_result(ndev, bssid, NULL, 0, NULL, 0,
                                                 WLAN_STATUS_UNSPECIFIED_FAILURE,
                                                 GFP_KERNEL);
                 }
-                clear_bit(wil_status_fwconnecting, &wil->status);
+                clear_bit(wil_status_fwconnecting, wil->status);
                 break;
         default:
                 break;
@@ -248,7 +291,7 @@ static void wil_scan_timer_fn(ulong x)
 {
         struct wil6210_priv *wil = (void *)x;
 
-        clear_bit(wil_status_fwready, &wil->status);
+        clear_bit(wil_status_fwready, wil->status);
         wil_err(wil, "Scan timeout detected, start fw error recovery\n");
         wil->recovery_state = fw_recovery_pending;
         schedule_work(&wil->fw_error_worker);
@@ -384,6 +427,8 @@ int wil_priv_init(struct wil6210_priv *wil)
 
         mutex_init(&wil->mutex);
         mutex_init(&wil->wmi_mutex);
+        mutex_init(&wil->back_rx_mutex);
+        mutex_init(&wil->back_tx_mutex);
 
         init_completion(&wil->wmi_ready);
         init_completion(&wil->wmi_call);
@@ -396,25 +441,37 @@ int wil_priv_init(struct wil6210_priv *wil)
         INIT_WORK(&wil->disconnect_worker, wil_disconnect_worker);
         INIT_WORK(&wil->wmi_event_worker, wmi_event_worker);
         INIT_WORK(&wil->fw_error_worker, wil_fw_error_worker);
+        INIT_WORK(&wil->back_rx_worker, wil_back_rx_worker);
+        INIT_WORK(&wil->back_tx_worker, wil_back_tx_worker);
 
         INIT_LIST_HEAD(&wil->pending_wmi_ev);
+        INIT_LIST_HEAD(&wil->back_rx_pending);
+        INIT_LIST_HEAD(&wil->back_tx_pending);
         spin_lock_init(&wil->wmi_ev_lock);
         init_waitqueue_head(&wil->wq);
 
-        wil->wmi_wq = create_singlethread_workqueue(WIL_NAME"_wmi");
+        wil->wmi_wq = create_singlethread_workqueue(WIL_NAME "_wmi");
         if (!wil->wmi_wq)
                 return -EAGAIN;
 
-        wil->wmi_wq_conn = create_singlethread_workqueue(WIL_NAME"_connect");
-        if (!wil->wmi_wq_conn) {
-                destroy_workqueue(wil->wmi_wq);
-                return -EAGAIN;
-        }
+        wil->wq_service = create_singlethread_workqueue(WIL_NAME "_service");
+        if (!wil->wq_service)
+                goto out_wmi_wq;
 
         wil->last_fw_recovery = jiffies;
-        wil->itr_trsh = itr_trsh;
+        wil->tx_interframe_timeout = tx_interframe_timeout;
+        wil->rx_interframe_timeout = rx_interframe_timeout;
+        wil->tx_max_burst_duration = tx_max_burst_duration;
+        wil->rx_max_burst_duration = rx_max_burst_duration;
 
+        if (rx_ring_overflow_thrsh == WIL6210_RX_HIGH_TRSH_INIT)
+                rx_ring_overflow_thrsh = WIL6210_RX_HIGH_TRSH_DEFAULT;
         return 0;
+
+out_wmi_wq:
+        destroy_workqueue(wil->wmi_wq);
+
+        return -EAGAIN;
 }
 
 /**
@@ -448,7 +505,11 @@ void wil_priv_deinit(struct wil6210_priv *wil)
         wil6210_disconnect(wil, NULL, WLAN_REASON_DEAUTH_LEAVING, false);
         mutex_unlock(&wil->mutex);
         wmi_event_flush(wil);
-        destroy_workqueue(wil->wmi_wq_conn);
+        wil_back_rx_flush(wil);
+        cancel_work_sync(&wil->back_rx_worker);
+        wil_back_tx_flush(wil);
+        cancel_work_sync(&wil->back_tx_worker);
+        destroy_workqueue(wil->wq_service);
         destroy_workqueue(wil->wmi_wq);
 }
 
@@ -478,13 +539,10 @@ static int wil_target_reset(struct wil6210_priv *wil)
 {
         int delay = 0;
         u32 x;
-        u32 rev_id;
-        bool is_sparrow = (wil->board->board == WIL_BOARD_SPARROW);
-
-        wil_dbg_misc(wil, "Resetting \"%s\"...\n", wil->board->name);
+        bool is_reset_v2 = test_bit(hw_capability_reset_v2,
+                                    wil->hw_capabilities);
 
-        wil->hw_version = R(RGF_USER_FW_REV_ID);
-        rev_id = wil->hw_version & 0xff;
+        wil_dbg_misc(wil, "Resetting \"%s\"...\n", wil->hw_name);
 
         /* Clear MAC link up */
         S(RGF_HP_CTRL, BIT(15));
@@ -496,7 +554,7 @@ static int wil_target_reset(struct wil6210_priv *wil)
         /* Clear Fw Download notification */
         C(RGF_USER_USAGE_6, BIT(0));
 
-        if (is_sparrow) {
+        if (is_reset_v2) {
                 S(RGF_CAF_OSC_CONTROL, BIT_CAF_OSC_XTAL_EN);
                 /* XTAL stabilization should take about 3ms */
                 usleep_range(5000, 7000);
@@ -517,10 +575,11 @@ static int wil_target_reset(struct wil6210_priv *wil)
 
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0xFE000000);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_1, 0x0000003F);
-        W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, is_sparrow ? 0x000000f0 : 0x00000170);
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_3,
+          is_reset_v2 ? 0x000000f0 : 0x00000170);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_0, 0xFFE7FE00);
 
-        if (is_sparrow) {
+        if (is_reset_v2) {
                 W(RGF_USER_CLKS_CTL_EXT_SW_RST_VEC_0, 0x0);
                 W(RGF_USER_CLKS_CTL_EXT_SW_RST_VEC_1, 0x0);
         }
@@ -530,19 +589,14 @@ static int wil_target_reset(struct wil6210_priv *wil)
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_1, 0);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_0, 0);
 
-        if (is_sparrow) {
+        if (is_reset_v2) {
                 W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0x00000003);
                 /* reset A2 PCIE AHB */
                 W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0x00008000);
         } else {
                 W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0x00000001);
-                if (rev_id == 1) {
-                        /* reset A1 BOTH PCIE AHB & PCIE RGF */
-                        W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0x00000080);
-                } else {
-                        W(RGF_PCIE_LOS_COUNTER_CTL, BIT(6) | BIT(8));
-                        W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0x00008000);
-                }
+                W(RGF_PCIE_LOS_COUNTER_CTL, BIT(6) | BIT(8));
+                W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0x00008000);
         }
 
         /* TODO: check order here!!! Erez code is different */
@@ -559,8 +613,7 @@ static int wil_target_reset(struct wil6210_priv *wil)
                 }
         } while (x != HW_MACHINE_BOOT_DONE);
 
-        /* TODO: Erez check rev_id != 1 */
-        if (!is_sparrow && (rev_id != 1))
+        if (!is_reset_v2)
                 W(RGF_PCIE_LOS_COUNTER_CTL, BIT(8));
 
         C(RGF_USER_CLKS_CTL_0, BIT_USER_CLKS_RST_PWGD);
@@ -569,26 +622,6 @@ static int wil_target_reset(struct wil6210_priv *wil)
         return 0;
 }
 
-/**
- * wil_set_itr_trsh: - apply interrupt coalescing params
- */
-void wil_set_itr_trsh(struct wil6210_priv *wil)
-{
-        /* disable, use usec resolution */
-        W(RGF_DMA_ITR_CNT_CRL, BIT_DMA_ITR_CNT_CRL_EXT_TICK);
-
-        /* disable interrupt moderation for monitor
-         * to get better timestamp precision
-         */
-        if (wil->wdev->iftype == NL80211_IFTYPE_MONITOR)
-                return;
-
-        wil_info(wil, "set ITR_TRSH = %d usec\n", wil->itr_trsh);
-        W(RGF_DMA_ITR_CNT_TRSH, wil->itr_trsh);
-        W(RGF_DMA_ITR_CNT_CRL, BIT_DMA_ITR_CNT_CRL_EN |
-          BIT_DMA_ITR_CNT_CRL_EXT_TICK); /* start it */
-}
-
 #undef R
 #undef W
 #undef S
@@ -629,13 +662,17 @@ int wil_reset(struct wil6210_priv *wil)
 
         wil_dbg_misc(wil, "%s()\n", __func__);
 
+        if (wil->hw_version == HW_VER_UNKNOWN)
+                return -ENODEV;
+
         WARN_ON(!mutex_is_locked(&wil->mutex));
-        WARN_ON(test_bit(wil_status_napi_en, &wil->status));
+        WARN_ON(test_bit(wil_status_napi_en, wil->status));
 
         cancel_work_sync(&wil->disconnect_worker);
         wil6210_disconnect(wil, NULL, WLAN_REASON_DEAUTH_LEAVING, false);
 
-        wil->status = 0; /* prevent NAPI from being scheduled */
+        /* prevent NAPI from being scheduled */
+        bitmap_zero(wil->status, wil_status_last);
 
         if (wil->scan_request) {
                 wil_dbg_misc(wil, "Abort scan_request 0x%p\n",
@@ -649,7 +686,7 @@ int wil_reset(struct wil6210_priv *wil)
 
         wmi_event_flush(wil);
 
-        flush_workqueue(wil->wmi_wq_conn);
+        flush_workqueue(wil->wq_service);
         flush_workqueue(wil->wmi_wq);
 
         rc = wil_target_reset(wil);
@@ -688,6 +725,7 @@ int wil_reset(struct wil6210_priv *wil)
         reinit_completion(&wil->wmi_ready);
         reinit_completion(&wil->wmi_call);
 
+        wil_configure_interrupt_moderation(wil);
         wil_unmask_irq(wil);
 
         /* we just started MAC, wait for FW ready */
@@ -774,7 +812,7 @@ int __wil_up(struct wil6210_priv *wil)
         wil_dbg_misc(wil, "NAPI enable\n");
         napi_enable(&wil->napi_rx);
         napi_enable(&wil->napi_tx);
-        set_bit(wil_status_napi_en, &wil->status);
+        set_bit(wil_status_napi_en, wil->status);
 
         if (wil->platform_ops.bus_request)
                 wil->platform_ops.bus_request(wil->platform_handle,
@@ -807,7 +845,7 @@ int __wil_down(struct wil6210_priv *wil)
                 wil->platform_ops.bus_request(wil->platform_handle, 0);
 
         wil_disable_irq(wil);
-        if (test_and_clear_bit(wil_status_napi_en, &wil->status)) {
+        if (test_and_clear_bit(wil_status_napi_en, wil->status)) {
                 napi_disable(&wil->napi_rx);
                 napi_disable(&wil->napi_tx);
                 wil_dbg_misc(wil, "NAPI disable\n");
@@ -822,15 +860,15 @@ int __wil_down(struct wil6210_priv *wil)
                 wil->scan_request = NULL;
         }
 
-        if (test_bit(wil_status_fwconnected, &wil->status) ||
-            test_bit(wil_status_fwconnecting, &wil->status))
+        if (test_bit(wil_status_fwconnected, wil->status) ||
+            test_bit(wil_status_fwconnecting, wil->status))
                 wmi_send(wil, WMI_DISCONNECT_CMDID, NULL, 0);
 
         /* make sure wil is idle (not connected) */
         mutex_unlock(&wil->mutex);
         while (iter--) {
-                int idle = !test_bit(wil_status_fwconnected, &wil->status) &&
-                           !test_bit(wil_status_fwconnecting, &wil->status);
+                int idle = !test_bit(wil_status_fwconnected, wil->status) &&
+                           !test_bit(wil_status_fwconnecting, wil->status);
                 if (idle)
                         break;
                 msleep(WAIT_FOR_DISCONNECT_INTERVAL_MS);
diff --git a/drivers/net/wireless/ath/wil6210/pcie_bus.c b/drivers/net/wireless/ath/wil6210/pcie_bus.c
index 66626a8ee728..3dd26709ccb2 100644
--- a/drivers/net/wireless/ath/wil6210/pcie_bus.c
+++ b/drivers/net/wireless/ath/wil6210/pcie_bus.c
@@ -31,6 +31,46 @@ static bool debug_fw; /* = false; */
 module_param(debug_fw, bool, S_IRUGO);
 MODULE_PARM_DESC(debug_fw, " load driver if FW not ready. For FW debug");
 
+static
+void wil_set_capabilities(struct wil6210_priv *wil)
+{
+        u32 rev_id = ioread32(wil->csr + HOSTADDR(RGF_USER_JTAG_DEV_ID));
+
+        bitmap_zero(wil->hw_capabilities, hw_capability_last);
+
+        switch (rev_id) {
+        case JTAG_DEV_ID_MARLON_B0:
+                wil->hw_name = "Marlon B0";
+                wil->hw_version = HW_VER_MARLON_B0;
+                break;
+        case JTAG_DEV_ID_SPARROW_A0:
+                wil->hw_name = "Sparrow A0";
+                wil->hw_version = HW_VER_SPARROW_A0;
+                break;
+        case JTAG_DEV_ID_SPARROW_A1:
+                wil->hw_name = "Sparrow A1";
+                wil->hw_version = HW_VER_SPARROW_A1;
+                break;
+        case JTAG_DEV_ID_SPARROW_B0:
+                wil->hw_name = "Sparrow B0";
+                wil->hw_version = HW_VER_SPARROW_B0;
+                break;
+        default:
+                wil_err(wil, "Unknown board hardware 0x%08x\n", rev_id);
+                wil->hw_name = "Unknown";
+                wil->hw_version = HW_VER_UNKNOWN;
+        }
+
+        wil_info(wil, "Board hardware is %s\n", wil->hw_name);
+
+        if (wil->hw_version >= HW_VER_SPARROW_A0)
+                set_bit(hw_capability_reset_v2, wil->hw_capabilities);
+
+        if (wil->hw_version >= HW_VER_SPARROW_B0)
+                set_bit(hw_capability_advanced_itr_moderation,
+                        wil->hw_capabilities);
+}
+
 void wil_disable_irq(struct wil6210_priv *wil)
 {
         int irq = wil->pdev->irq;
@@ -149,12 +189,11 @@ static int wil_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         struct wil6210_priv *wil;
         struct device *dev = &pdev->dev;
         void __iomem *csr;
-        struct wil_board *board = (struct wil_board *)id->driver_data;
         int rc;
 
         /* check HW */
         dev_info(&pdev->dev, WIL_NAME
-                 " \"%s\" device found [%04x:%04x] (rev %x)\n", board->name,
+                 " device found [%04x:%04x] (rev %x)\n",
                  (int)pdev->vendor, (int)pdev->device, (int)pdev->revision);
 
         if (pci_resource_len(pdev, 0) != WIL6210_MEM_SIZE) {
@@ -204,8 +243,7 @@ static int wil_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 
         pci_set_drvdata(pdev, wil);
         wil->pdev = pdev;
-        wil->board = board;
-
+        wil_set_capabilities(wil);
         wil6210_clear_irq(wil);
 
         wil->platform_handle =
@@ -266,23 +304,10 @@ static void wil_pcie_remove(struct pci_dev *pdev)
         pci_disable_device(pdev);
 }
 
-static const struct wil_board wil_board_marlon = {
-        .board = WIL_BOARD_MARLON,
-        .name = "marlon",
-};
-
-static const struct wil_board wil_board_sparrow = {
-        .board = WIL_BOARD_SPARROW,
-        .name = "sparrow",
-};
-
 static const struct pci_device_id wil6210_pcie_ids[] = {
-        { PCI_DEVICE(0x1ae9, 0x0301),
-          .driver_data = (kernel_ulong_t)&wil_board_marlon },
-        { PCI_DEVICE(0x1ae9, 0x0310),
-          .driver_data = (kernel_ulong_t)&wil_board_sparrow },
-        { PCI_DEVICE(0x1ae9, 0x0302), /* same as above, firmware broken */
-          .driver_data = (kernel_ulong_t)&wil_board_sparrow },
+        { PCI_DEVICE(0x1ae9, 0x0301) },
+        { PCI_DEVICE(0x1ae9, 0x0310) },
+        { PCI_DEVICE(0x1ae9, 0x0302) }, /* same as above, firmware broken */
         { /* end: all zeroes */ },
 };
 MODULE_DEVICE_TABLE(pci, wil6210_pcie_ids);
diff --git a/drivers/net/wireless/ath/wil6210/rx_reorder.c b/drivers/net/wireless/ath/wil6210/rx_reorder.c
index 489cb73d139b..552209227de9 100644
--- a/drivers/net/wireless/ath/wil6210/rx_reorder.c
+++ b/drivers/net/wireless/ath/wil6210/rx_reorder.c
@@ -89,7 +89,9 @@ static void wil_reorder_release(struct wil6210_priv *wil,
         }
 }
 
+/* called in NAPI context */
 void wil_rx_reorder(struct wil6210_priv *wil, struct sk_buff *skb)
+__acquires(&sta->tid_rx_lock) __releases(&sta->tid_rx_lock)
 {
         struct net_device *ndev = wil_to_ndev(wil);
         struct vring_rx_desc *d = wil_skb_rxdesc(skb);
@@ -97,22 +99,26 @@ void wil_rx_reorder(struct wil6210_priv *wil, struct sk_buff *skb)
         int cid = wil_rxdesc_cid(d);
         int mid = wil_rxdesc_mid(d);
         u16 seq = wil_rxdesc_seq(d);
+        int mcast = wil_rxdesc_mcast(d);
         struct wil_sta_info *sta = &wil->sta[cid];
         struct wil_tid_ampdu_rx *r;
         u16 hseq;
         int index;
-        unsigned long flags;
 
-        wil_dbg_txrx(wil, "MID %d CID %d TID %d Seq 0x%03x\n",
-                     mid, cid, tid, seq);
+        wil_dbg_txrx(wil, "MID %d CID %d TID %d Seq 0x%03x mcast %01x\n",
+                     mid, cid, tid, seq, mcast);
 
-        spin_lock_irqsave(&sta->tid_rx_lock, flags);
+        if (unlikely(mcast)) {
+                wil_netif_rx_any(skb, ndev);
+                return;
+        }
+
+        spin_lock(&sta->tid_rx_lock);
 
         r = sta->tid_rx[tid];
         if (!r) {
-                spin_unlock_irqrestore(&sta->tid_rx_lock, flags);
                 wil_netif_rx_any(skb, ndev);
-                return;
+                goto out;
         }
 
         hseq = r->head_seq_num;
@@ -121,13 +127,24 @@ void wil_rx_reorder(struct wil6210_priv *wil, struct sk_buff *skb)
          * reported, and data Rx, few packets may be pass up before reorder
          * buffer get allocated. Catch up by pretending SSN is what we
          * see in the 1-st Rx packet
+         *
+         * Another scenario, Rx get delayed and we got packet from before
+         * BACK. Pass it to the stack and wait.
          */
         if (r->first_time) {
                 r->first_time = false;
                 if (seq != r->head_seq_num) {
-                        wil_err(wil, "Error: 1-st frame with wrong sequence"
-                                " %d, should be %d. Fixing...\n", seq,
-                                r->head_seq_num);
+                        if (seq_less(seq, r->head_seq_num)) {
+                                wil_err(wil,
+                                        "Error: frame with early sequence 0x%03x, should be 0x%03x. Waiting...\n",
+                                        seq, r->head_seq_num);
+                                r->first_time = true;
+                                wil_netif_rx_any(skb, ndev);
+                                goto out;
+                        }
+                        wil_err(wil,
+                                "Error: 1-st frame with wrong sequence 0x%03x, should be 0x%03x. Fixing...\n",
+                                seq, r->head_seq_num);
                         r->head_seq_num = seq;
                         r->ssn = seq;
                 }
@@ -179,7 +196,7 @@ void wil_rx_reorder(struct wil6210_priv *wil, struct sk_buff *skb)
         wil_reorder_release(wil, r);
 
 out:
-        spin_unlock_irqrestore(&sta->tid_rx_lock, flags);
+        spin_unlock(&sta->tid_rx_lock);
 }
 
 struct wil_tid_ampdu_rx *wil_tid_ampdu_rx_alloc(struct wil6210_priv *wil,
@@ -219,3 +236,241 @@ void wil_tid_ampdu_rx_free(struct wil6210_priv *wil,
         kfree(r->reorder_time);
         kfree(r);
 }
+
+/* ADDBA processing */
+static u16 wil_agg_size(struct wil6210_priv *wil, u16 req_agg_wsize)
+{
+        u16 max_agg_size = min_t(u16, WIL_MAX_AGG_WSIZE, WIL_MAX_AMPDU_SIZE /
+                                 (mtu_max + WIL_MAX_MPDU_OVERHEAD));
+
+        if (!req_agg_wsize)
+                return max_agg_size;
+
+        return min(max_agg_size, req_agg_wsize);
+}
+
+/* Block Ack - Rx side (recipient */
+int wil_addba_rx_request(struct wil6210_priv *wil, u8 cidxtid,
+                         u8 dialog_token, __le16 ba_param_set,
+                         __le16 ba_timeout, __le16 ba_seq_ctrl)
+{
+        struct wil_back_rx *req = kzalloc(sizeof(*req), GFP_KERNEL);
+
+        if (!req)
+                return -ENOMEM;
+
+        req->cidxtid = cidxtid;
+        req->dialog_token = dialog_token;
+        req->ba_param_set = le16_to_cpu(ba_param_set);
+        req->ba_timeout = le16_to_cpu(ba_timeout);
+        req->ba_seq_ctrl = le16_to_cpu(ba_seq_ctrl);
+
+        mutex_lock(&wil->back_rx_mutex);
+        list_add_tail(&req->list, &wil->back_rx_pending);
+        mutex_unlock(&wil->back_rx_mutex);
+
+        queue_work(wil->wq_service, &wil->back_rx_worker);
+
+        return 0;
+}
+
+static void wil_back_rx_handle(struct wil6210_priv *wil,
+                               struct wil_back_rx *req)
+__acquires(&sta->tid_rx_lock) __releases(&sta->tid_rx_lock)
+{
+        struct wil_sta_info *sta;
+        u8 cid, tid;
+        u16 agg_wsize = 0;
+        /* bit 0: A-MSDU supported
+         * bit 1: policy (should be 0 for us)
+         * bits 2..5: TID
+         * bits 6..15: buffer size
+         */
+        u16 req_agg_wsize = WIL_GET_BITS(req->ba_param_set, 6, 15);
+        bool agg_amsdu = !!(req->ba_param_set & BIT(0));
+        int ba_policy = req->ba_param_set & BIT(1);
+        u16 agg_timeout = req->ba_timeout;
+        u16 status = WLAN_STATUS_SUCCESS;
+        u16 ssn = req->ba_seq_ctrl >> 4;
+        int rc;
+
+        might_sleep();
+        parse_cidxtid(req->cidxtid, &cid, &tid);
+
+        /* sanity checks */
+        if (cid >= WIL6210_MAX_CID) {
+                wil_err(wil, "BACK: invalid CID %d\n", cid);
+                return;
+        }
+
+        sta = &wil->sta[cid];
+        if (sta->status != wil_sta_connected) {
+                wil_err(wil, "BACK: CID %d not connected\n", cid);
+                return;
+        }
+
+        wil_dbg_wmi(wil,
+                    "ADDBA request for CID %d %pM TID %d size %d timeout %d AMSDU%s policy %d token %d SSN 0x%03x\n",
+                    cid, sta->addr, tid, req_agg_wsize, req->ba_timeout,
+                    agg_amsdu ? "+" : "-", !!ba_policy, req->dialog_token, ssn);
+
+        /* apply policies */
+        if (ba_policy) {
+                wil_err(wil, "BACK requested unsupported ba_policy == 1\n");
+                status = WLAN_STATUS_INVALID_QOS_PARAM;
+        }
+        if (status == WLAN_STATUS_SUCCESS)
+                agg_wsize = wil_agg_size(wil, req_agg_wsize);
+
+        rc = wmi_addba_rx_resp(wil, cid, tid, req->dialog_token, status,
+                               agg_amsdu, agg_wsize, agg_timeout);
+        if (rc || (status != WLAN_STATUS_SUCCESS))
+                return;
+
+        /* apply */
+        spin_lock_bh(&sta->tid_rx_lock);
+
+        wil_tid_ampdu_rx_free(wil, sta->tid_rx[tid]);
+        sta->tid_rx[tid] = wil_tid_ampdu_rx_alloc(wil, agg_wsize, ssn);
+
+        spin_unlock_bh(&sta->tid_rx_lock);
+}
+
+void wil_back_rx_flush(struct wil6210_priv *wil)
+{
+        struct wil_back_rx *evt, *t;
+
+        wil_dbg_misc(wil, "%s()\n", __func__);
+
+        mutex_lock(&wil->back_rx_mutex);
+
+        list_for_each_entry_safe(evt, t, &wil->back_rx_pending, list) {
+                list_del(&evt->list);
+                kfree(evt);
+        }
+
+        mutex_unlock(&wil->back_rx_mutex);
+}
+
+/* Retrieve next ADDBA request from the pending list */
+static struct list_head *next_back_rx(struct wil6210_priv *wil)
+{
+        struct list_head *ret = NULL;
+
+        mutex_lock(&wil->back_rx_mutex);
+
+        if (!list_empty(&wil->back_rx_pending)) {
+                ret = wil->back_rx_pending.next;
+                list_del(ret);
+        }
+
+        mutex_unlock(&wil->back_rx_mutex);
+
+        return ret;
+}
+
+void wil_back_rx_worker(struct work_struct *work)
+{
+        struct wil6210_priv *wil = container_of(work, struct wil6210_priv,
+                                                back_rx_worker);
+        struct wil_back_rx *evt;
+        struct list_head *lh;
+
+        while ((lh = next_back_rx(wil)) != NULL) {
+                evt = list_entry(lh, struct wil_back_rx, list);
+
+                wil_back_rx_handle(wil, evt);
+                kfree(evt);
+        }
+}
+
+/* BACK - Tx (originator) side */
+static void wil_back_tx_handle(struct wil6210_priv *wil,
+                               struct wil_back_tx *req)
+{
+        struct vring_tx_data *txdata = &wil->vring_tx_data[req->ringid];
+        int rc;
+
+        if (txdata->addba_in_progress) {
+                wil_dbg_misc(wil, "ADDBA for vring[%d] already in progress\n",
+                             req->ringid);
+                return;
+        }
+        if (txdata->agg_wsize) {
+                wil_dbg_misc(wil,
+                             "ADDBA for vring[%d] already established wsize %d\n",
+                             req->ringid, txdata->agg_wsize);
+                return;
+        }
+        txdata->addba_in_progress = true;
+        rc = wmi_addba(wil, req->ringid, req->agg_wsize, req->agg_timeout);
+        if (rc)
+                txdata->addba_in_progress = false;
+}
+
+static struct list_head *next_back_tx(struct wil6210_priv *wil)
+{
+        struct list_head *ret = NULL;
+
+        mutex_lock(&wil->back_tx_mutex);
+
+        if (!list_empty(&wil->back_tx_pending)) {
+                ret = wil->back_tx_pending.next;
+                list_del(ret);
+        }
+
+        mutex_unlock(&wil->back_tx_mutex);
+
+        return ret;
+}
+
+void wil_back_tx_worker(struct work_struct *work)
+{
+        struct wil6210_priv *wil = container_of(work, struct wil6210_priv,
+                                                 back_tx_worker);
+        struct wil_back_tx *evt;
+        struct list_head *lh;
+
+        while ((lh = next_back_tx(wil)) != NULL) {
+                evt = list_entry(lh, struct wil_back_tx, list);
+
+                wil_back_tx_handle(wil, evt);
+                kfree(evt);
+        }
+}
+
+void wil_back_tx_flush(struct wil6210_priv *wil)
+{
+        struct wil_back_tx *evt, *t;
+
+        wil_dbg_misc(wil, "%s()\n", __func__);
+
+        mutex_lock(&wil->back_tx_mutex);
+
+        list_for_each_entry_safe(evt, t, &wil->back_tx_pending, list) {
+                list_del(&evt->list);
+                kfree(evt);
+        }
+
+        mutex_unlock(&wil->back_tx_mutex);
+}
+
+int wil_addba_tx_request(struct wil6210_priv *wil, u8 ringid, u16 wsize)
+{
+        struct wil_back_tx *req = kzalloc(sizeof(*req), GFP_KERNEL);
+
+        if (!req)
+                return -ENOMEM;
+
+        req->ringid = ringid;
+        req->agg_wsize = wil_agg_size(wil, wsize);
+        req->agg_timeout = 0;
+
+        mutex_lock(&wil->back_tx_mutex);
+        list_add_tail(&req->list, &wil->back_tx_pending);
+        mutex_unlock(&wil->back_tx_mutex);
+
+        queue_work(wil->wq_service, &wil->back_tx_worker);
+
+        return 0;
+}
diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
index e3f8bdce5abc..b58ee52e1860 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.c
+++ b/drivers/net/wireless/ath/wil6210/txrx.c
@@ -463,7 +463,7 @@ static struct sk_buff *wil_vring_reap_rx(struct wil6210_priv *wil,
          * and in case of error drop the packet
          * higher stack layers will handle retransmission (if required)
          */
-        if (d->dma.status & RX_DMA_STATUS_L4_IDENT) {
+        if (d->dma.status & RX_DMA_STATUS_L4I) {
                 /* L4 protocol identified, csum calculated */
                 if ((d->dma.error & RX_DMA_ERROR_L4_ERR) == 0)
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -581,14 +581,8 @@ void wil_rx_handle(struct wil6210_priv *wil, int *quota)
                         skb->protocol = htons(ETH_P_802_2);
                         wil_netif_rx_any(skb, ndev);
                 } else {
-                        struct ethhdr *eth = (void *)skb->data;
-
                         skb->protocol = eth_type_trans(skb, ndev);
-
-                        if (is_unicast_ether_addr(eth->h_dest))
-                                wil_rx_reorder(wil, skb);
-                        else
-                                wil_netif_rx_any(skb, ndev);
+                        wil_rx_reorder(wil, skb);
                 }
         }
         wil_rx_refill(wil, v->size);
@@ -645,7 +639,7 @@ int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
                 .vring_cfg = {
                         .tx_sw_ring = {
                                 .max_mpdu_size =
-                                        cpu_to_le16(mtu_max + ETH_HLEN),
+                                        cpu_to_le16(wil_mtu2macbuf(mtu_max)),
                                 .ring_size = cpu_to_le16(size),
                         },
                         .ringid = id,
@@ -653,7 +647,7 @@ int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
                         .encap_trans_type = WMI_VRING_ENC_TYPE_802_3,
                         .mac_ctrl = 0,
                         .to_resolution = 0,
-                        .agg_max_wsize = 16,
+                        .agg_max_wsize = 0,
                         .schd_params = {
                                 .priority = cpu_to_le16(0),
                                 .timeslot_us = cpu_to_le16(0xfff),
@@ -701,6 +695,8 @@ int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
         vring->hwtail = le32_to_cpu(reply.cmd.tx_vring_tail_ptr);
 
         txdata->enabled = 1;
+        if (wil->sta[cid].data_port_open && (agg_wsize >= 0))
+                wil_addba_tx_request(wil, id, agg_wsize);
 
         return 0;
  out_free:
@@ -713,6 +709,7 @@ int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
 void wil_vring_fini_tx(struct wil6210_priv *wil, int id)
 {
         struct vring *vring = &wil->vring_tx[id];
+        struct vring_tx_data *txdata = &wil->vring_tx_data[id];
 
         WARN_ON(!mutex_is_locked(&wil->mutex));
 
@@ -723,10 +720,11 @@ void wil_vring_fini_tx(struct wil6210_priv *wil, int id)
 
         /* make sure NAPI won't touch this vring */
         wil->vring_tx_data[id].enabled = 0;
-        if (test_bit(wil_status_napi_en, &wil->status))
+        if (test_bit(wil_status_napi_en, wil->status))
                 napi_synchronize(&wil->napi_tx);
 
         wil_vring_free(wil, vring, 1);
+        memset(txdata, 0, sizeof(*txdata));
 }
 
 static struct vring *wil_find_tx_vring(struct wil6210_priv *wil,
@@ -773,6 +771,38 @@ static void wil_set_da_for_vring(struct wil6210_priv *wil,
 
 static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
                         struct sk_buff *skb);
+
+static struct vring *wil_find_tx_vring_sta(struct wil6210_priv *wil,
+                                           struct sk_buff *skb)
+{
+        struct vring *v;
+        int i;
+        u8 cid;
+
+        /* In the STA mode, it is expected to have only 1 VRING
+         * for the AP we connected to.
+         * find 1-st vring and see whether it is eligible for data
+         */
+        for (i = 0; i < WIL6210_MAX_TX_RINGS; i++) {
+                v = &wil->vring_tx[i];
+                if (!v->va)
+                        continue;
+
+                cid = wil->vring2cid_tid[i][0];
+                if (!wil->sta[cid].data_port_open &&
+                    (skb->protocol != cpu_to_be16(ETH_P_PAE)))
+                        break;
+
+                wil_dbg_txrx(wil, "Tx -> ring %d\n", i);
+
+                return v;
+        }
+
+        wil_dbg_txrx(wil, "Tx while no vrings active?\n");
+
+        return NULL;
+}
+
 /*
  * Find 1-st vring and return it; set dest address for this vring in skb
  * duplicate skb and send it to other active vrings
@@ -1034,14 +1064,14 @@ netdev_tx_t wil_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         int rc;
 
         wil_dbg_txrx(wil, "%s()\n", __func__);
-        if (!test_bit(wil_status_fwready, &wil->status)) {
+        if (!test_bit(wil_status_fwready, wil->status)) {
                 if (!pr_once_fw) {
                         wil_err(wil, "FW not ready\n");
                         pr_once_fw = true;
                 }
                 goto drop;
         }
-        if (!test_bit(wil_status_fwconnected, &wil->status)) {
+        if (!test_bit(wil_status_fwconnected, wil->status)) {
                 wil_err(wil, "FW not connected\n");
                 goto drop;
         }
@@ -1052,15 +1082,19 @@ netdev_tx_t wil_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         pr_once_fw = false;
 
         /* find vring */
-        if (is_unicast_ether_addr(eth->h_dest))
-                vring = wil_find_tx_vring(wil, skb);
-        else
-                vring = wil_tx_bcast(wil, skb);
+        if (wil->wdev->iftype == NL80211_IFTYPE_STATION) {
+                /* in STA mode (ESS), all to same VRING */
+                vring = wil_find_tx_vring_sta(wil, skb);
+        } else { /* direct communication, find matching VRING */
+                if (is_unicast_ether_addr(eth->h_dest))
+                        vring = wil_find_tx_vring(wil, skb);
+                else
+                        vring = wil_tx_bcast(wil, skb);
+        }
         if (!vring) {
                 wil_dbg_txrx(wil, "No Tx VRING found for %pM\n", eth->h_dest);
                 goto drop;
         }
-
         /* set up vring entry */
         rc = wil_tx_vring(wil, vring, skb);
 
diff --git a/drivers/net/wireless/ath/wil6210/txrx.h b/drivers/net/wireless/ath/wil6210/txrx.h
index 630aeb5fa7f4..d90c8aa20c15 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.h
+++ b/drivers/net/wireless/ath/wil6210/txrx.h
@@ -20,17 +20,15 @@
 #define BUF_SW_OWNED    (1)
 #define BUF_HW_OWNED    (0)
 
-/* size of max. Tx/Rx buffers, as supported by FW */
-#define TXRX_BUF_LEN_DEFAULT (2242)
+/* default size of MAC Tx/Rx buffers */
+#define TXRX_BUF_LEN_DEFAULT (2048)
 
 /* how many bytes to reserve for rtap header? */
 #define WIL6210_RTAP_SIZE (128)
 
 /* Tx/Rx path */
 
-/*
- * Common representation of physical address in Vring
- */
+/* Common representation of physical address in Vring */
 struct vring_dma_addr {
         __le32 addr_low;
         __le16 addr_high;
@@ -49,11 +47,10 @@ static inline void wil_desc_addr_set(struct vring_dma_addr *addr,
         addr->addr_high = cpu_to_le16((u16)upper_32_bits(pa));
 }
 
-/*
- * Tx descriptor - MAC part
+/* Tx descriptor - MAC part
  * [dword 0]
  * bit  0.. 9 : lifetime_expiry_value:10
- * bit     10 : interrup_en:1
+ * bit     10 : interrupt_en:1
  * bit     11 : status_en:1
  * bit 12..13 : txss_override:2
  * bit     14 : timestamp_insertion:1
@@ -61,15 +58,12 @@ static inline void wil_desc_addr_set(struct vring_dma_addr *addr,
  * bit 16..21 : reserved0:6
  * bit 22..26 : mcs_index:5
  * bit     27 : mcs_en:1
- * bit 28..29 : reserved1:2
- * bit     30 : reserved2:1
+ * bit 28..30 : reserved1:3
  * bit     31 : sn_preserved:1
  * [dword 1]
  * bit  0.. 3 : pkt_mode:4
  * bit      4 : pkt_mode_en:1
- * bit  5.. 7 : reserved0:3
- * bit  8..13 : reserved1:6
- * bit     14 : reserved2:1
+ * bit  5..14 : reserved0:10
  * bit     15 : ack_policy_en:1
  * bit 16..19 : dst_index:4
  * bit     20 : dst_index_en:1
@@ -80,7 +74,7 @@ static inline void wil_desc_addr_set(struct vring_dma_addr *addr,
  * [dword 2]
  * bit  0.. 7 : num_of_descriptors:8
  * bit  8..17 : reserved:10
- * bit 18..19 : l2_translation_type:2
+ * bit 18..19 : l2_translation_type:2 00 - bypass, 01 - 802.3, 10 - 802.11
  * bit     20 : snap_hdr_insertion_en:1
  * bit     21 : vlan_removal_en:1
  * bit 22..31 : reserved0:10
@@ -247,6 +241,46 @@ struct vring_tx_mac {
 
 #define TX_DMA_STATUS_DU         BIT(0)
 
+/* Tx descriptor - DMA part
+ * [dword 0]
+ * bit  0.. 7 : l4_length:8 layer 4 length
+ * bit      8 : cmd_eop:1 This descriptor is the last one in the packet
+ * bit      9 : reserved
+ * bit     10 : cmd_dma_it:1 immediate interrupt
+ * bit 11..12 : SBD - Segment Buffer Details
+ *              00 - Header Segment
+ *              01 - First Data Segment
+ *              10 - Medium Data Segment
+ *              11 - Last Data Segment
+ * bit     13 : TSE - TCP Segmentation Enable
+ * bit     14 : IIC - Directs the HW to Insert IPv4 Checksum
+ * bit     15 : ITC - Directs the HW to Insert TCP/UDP Checksum
+ * bit 16..20 : QID - The target QID that the packet should be stored
+ *              in the MAC.
+ * bit     21 : PO - Pseudo header Offload:
+ *              0 - Use the pseudo header value from the TCP checksum field
+ *              1- Calculate Pseudo header Checksum
+ * bit     22 : NC - No UDP Checksum
+ * bit 23..29 : reserved
+ * bit 30..31 : L4T - Layer 4 Type: 00 - UDP , 10 - TCP , 10, 11 - Reserved
+ *              If L4Len equal 0, no L4 at all
+ * [dword 1]
+ * bit  0..31 : addr_low:32 The payload buffer low address
+ * [dword 2]
+ * bit  0..15 : addr_high:16 The payload buffer high address
+ * bit 16..23 : ip_length:8 The IP header length for the TX IP checksum
+ *              offload feature
+ * bit 24..30 : mac_length:7
+ * bit     31 : ip_version:1 1 - IPv4, 0 - IPv6
+ * [dword 3]
+ *  [byte 12] error
+ * bit  0   2 : mac_status:3
+ * bit  3   7 : reserved:5
+ *  [byte 13] status
+ * bit      0 : DU:1 Descriptor Used
+ * bit  1   7 : reserved:7
+ *  [word 7] length
+ */
 struct vring_tx_dma {
         u32 d0;
         struct vring_dma_addr addr;
@@ -257,45 +291,45 @@ struct vring_tx_dma {
         __le16 length;
 } __packed;
 
-/*
- * Rx descriptor - MAC part
+/* Rx descriptor - MAC part
  * [dword 0]
  * bit  0.. 3 : tid:4 The QoS (b3-0) TID Field
- * bit  4.. 6 : connection_id:3 :The Source index that  was found during
- *  Parsing the TA.  This field is used to  define the source of the packet
+ * bit  4.. 6 : cid:3 The Source index that  was found during parsing the TA.
+ *              This field is used to define the source of the packet
  * bit      7 : reserved:1
- * bit  8.. 9 : mac_id:2 : The MAC virtual  Ring number (always zero)
- * bit 10..11 : frame_type:2 : The FC Control  (b3-2) -  MPDU Type
- *              (management, data, control  and extension)
- * bit 12..15 : frame_subtype:4 : The FC Control  (b7-4) -  Frame Subtype
+ * bit  8.. 9 : mid:2 The MAC virtual number
+ * bit 10..11 : frame_type:2 : The FC (b3-2) - MPDU Type
+ *              (management, data, control and extension)
+ * bit 12..15 : frame_subtype:4 : The FC (b7-4) - Frame Subtype
  * bit 16..27 : seq_number:12 The received Sequence number field
  * bit 28..31 : extended:4 extended subtype
  * [dword 1]
  * bit  0.. 3 : reserved
  * bit  4.. 5 : key_id:2
  * bit      6 : decrypt_bypass:1
- * bit      7 : security:1
- * bit  8.. 9 : ds_bits:2
- * bit     10 : a_msdu_present:1  from qos header
- * bit     11 : a_msdu_type:1  from qos header
+ * bit      7 : security:1 FC (b14)
+ * bit  8.. 9 : ds_bits:2 FC (b9-8)
+ * bit     10 : a_msdu_present:1  QoS (b7)
+ * bit     11 : a_msdu_type:1  QoS (b8)
  * bit     12 : a_mpdu:1  part of AMPDU aggregation
  * bit     13 : broadcast:1
  * bit     14 : mutlicast:1
  * bit     15 : reserved:1
- * bit 16..20 : rx_mac_qid:5   The Queue Identifier that the packet
- *                             is received from
+ * bit 16..20 : rx_mac_qid:5 The Queue Identifier that the packet
+ *              is received from
  * bit 21..24 : mcs:4
- * bit 25..28 : mic_icr:4
+ * bit 25..28 : mic_icr:4 this signal tells the DMA to assert an interrupt
+ *              after it writes the packet
  * bit 29..31 : reserved:3
  * [dword 2]
  * bit  0.. 2 : time_slot:3 The timeslot that the MPDU is received
- * bit      3 : fc_protocol_ver:1 The FC Control  (b0) - Protocol  Version
- * bit      4 : fc_order:1 The FC Control (b15) -Order
- * bit  5.. 7 : qos_ack_policy:3  The QoS (b6-5) ack policy Field
+ * bit  3.. 4 : fc_protocol_ver:1 The FC (b1-0) - Protocol Version
+ * bit      5 : fc_order:1 The FC Control (b15) -Order
+ * bit  6.. 7 : qos_ack_policy:2 The QoS (b6-5) ack policy Field
  * bit      8 : esop:1 The QoS (b4) ESOP field
- * bit      9 : qos_rdg_more_ppdu:1 The QoS (b9) RDG  field
- * bit 10..14 : qos_reserved:5 The QoS (b14-10) Reserved  field
- * bit     15 : qos_ac_constraint:1
+ * bit      9 : qos_rdg_more_ppdu:1 The QoS (b9) RDG field
+ * bit 10..14 : qos_reserved:5 The QoS (b14-10) Reserved field
+ * bit     15 : qos_ac_constraint:1 QoS (b15)
  * bit 16..31 : pn_15_0:16 low 2 bytes of PN
  * [dword 3]
  * bit  0..31 : pn_47_16:32 high 4 bytes of PN
@@ -308,35 +342,46 @@ struct vring_rx_mac {
         u32 pn_47_16;
 } __packed;
 
-/*
- * Rx descriptor - DMA part
+/* Rx descriptor - DMA part
  * [dword 0]
- * bit  0.. 7 : l4_length:8 layer 4 length
- * bit  8.. 9 : reserved:2
- * bit     10 : cmd_dma_it:1
+ * bit  0.. 7 : l4_length:8 layer 4 length. The field is only valid if
+ *              L4I bit is set
+ * bit      8 : cmd_eop:1 set to 1
+ * bit      9 : cmd_rt:1 set to 1
+ * bit     10 : cmd_dma_it:1 immediate interrupt
  * bit 11..15 : reserved:5
- * bit 16..29 : phy_info_length:14
+ * bit 16..29 : phy_info_length:14 It is valid when the PII is set.
+ *              When the FFM bit is set bits 29-27 are used for for
+ *              Flex Filter Match. Matching Index to one of the L2
+ *              EtherType Flex Filter
  * bit 30..31 : l4_type:2 valid if the L4I bit is set in the status field
+ *              00 - UDP, 01 - TCP, 10, 11 - reserved
  * [dword 1]
  * bit  0..31 : addr_low:32 The payload buffer low address
  * [dword 2]
  * bit  0..15 : addr_high:16 The payload buffer high address
- * bit 16..23 : ip_length:8
+ * bit 16..23 : ip_length:8 The filed is valid only if the L3I bit is set
  * bit 24..30 : mac_length:7
- * bit     31 : ip_version:1
+ * bit     31 : ip_version:1 1 - IPv4, 0 - IPv6
  * [dword 3]
  *  [byte 12] error
+ * bit      0 : FCS:1
+ * bit      1 : MIC:1
+ * bit      2 : Key miss:1
+ * bit      3 : Replay:1
+ * bit      4 : L3:1 IPv4 checksum
+ * bit      5 : L4:1 TCP/UDP checksum
+ * bit  6   7 : reserved:2
  *  [byte 13] status
- * bit      0 : du:1
- * bit      1 : eop:1
+ * bit      0 : DU:1 Descriptor Used
+ * bit      1 : EOP:1 The descriptor indicates the End of Packet
  * bit      2 : error:1
- * bit      3 : mi:1
- * bit      4 : l3_identified:1
- * bit      5 : l4_identified:1
- * bit      6 : phy_info_included:1
- * bit      7 : reserved:1
+ * bit      3 : MI:1 MAC Interrupt is asserted (according to parser decision)
+ * bit      4 : L3I:1 L3 identified and checksum calculated
+ * bit      5 : L4I:1 L4 identified and checksum calculated
+ * bit      6 : PII:1 PHY Info Included in the packet
+ * bit      7 : FFM:1 EtherType Flex Filter Match
  *  [word 7] length
- *
  */
 
 #define RX_DMA_D0_CMD_DMA_IT     BIT(10)
@@ -349,9 +394,9 @@ struct vring_rx_mac {
 #define RX_DMA_STATUS_DU         BIT(0)
 #define RX_DMA_STATUS_ERROR      BIT(2)
 
-#define RX_DMA_STATUS_L3_IDENT   BIT(4)
-#define RX_DMA_STATUS_L4_IDENT   BIT(5)
-#define RX_DMA_STATUS_PHY_INFO   BIT(6)
+#define RX_DMA_STATUS_L3I       BIT(4)
+#define RX_DMA_STATUS_L4I       BIT(5)
+#define RX_DMA_STATUS_PHY_INFO  BIT(6)
 
 struct vring_rx_dma {
         u32 d0;
@@ -423,6 +468,11 @@ static inline int wil_rxdesc_mcs(struct vring_rx_desc *d)
         return WIL_GET_BITS(d->mac.d1, 21, 24);
 }
 
+static inline int wil_rxdesc_mcast(struct vring_rx_desc *d)
+{
+        return WIL_GET_BITS(d->mac.d1, 13, 14);
+}
+
 static inline int wil_rxdesc_phy_length(struct vring_rx_desc *d)
 {
         return WIL_GET_BITS(d->dma.d0, 16, 29);
diff --git a/drivers/net/wireless/ath/wil6210/wil6210.h b/drivers/net/wireless/ath/wil6210/wil6210.h
index c6ec5b99ac7d..da3fe7853d63 100644
--- a/drivers/net/wireless/ath/wil6210/wil6210.h
+++ b/drivers/net/wireless/ath/wil6210/wil6210.h
@@ -25,19 +25,14 @@
 
 extern bool no_fw_recovery;
 extern unsigned int mtu_max;
+extern unsigned short rx_ring_overflow_thrsh;
+extern int agg_wsize;
 
 #define WIL_NAME "wil6210"
 #define WIL_FW_NAME "wil6210.fw"
 
 #define WIL_MAX_BUS_REQUEST_KBPS 800000 /* ~6.1Gbps */
 
-struct wil_board {
-        int board;
-#define WIL_BOARD_MARLON        (1)
-#define WIL_BOARD_SPARROW       (2)
-        const char * const name;
-};
-
 /**
  * extract bits [@b0:@b1] (inclusive) from the value @x
  * it should be @b0 <= @b1, or result is incorrect
@@ -57,13 +52,41 @@ static inline u32 WIL_GET_BITS(u32 x, int b0, int b1)
 #define WIL6210_MAX_TX_RINGS    (24) /* HW limit */
 #define WIL6210_MAX_CID         (8) /* HW limit */
 #define WIL6210_NAPI_BUDGET     (16) /* arbitrary */
+#define WIL_MAX_AMPDU_SIZE      (64 * 1024) /* FW/HW limit */
+#define WIL_MAX_AGG_WSIZE       (32) /* FW/HW limit */
+/* Hardware offload block adds the following:
+ * 26 bytes - 3-address QoS data header
+ *  8 bytes - IV + EIV (for GCMP)
+ *  8 bytes - SNAP
+ * 16 bytes - MIC (for GCMP)
+ *  4 bytes - CRC
+ */
+#define WIL_MAX_MPDU_OVERHEAD   (62)
+
+/* Calculate MAC buffer size for the firmware. It includes all overhead,
+ * as it will go over the air, and need to be 8 byte aligned
+ */
+static inline u32 wil_mtu2macbuf(u32 mtu)
+{
+        return ALIGN(mtu + WIL_MAX_MPDU_OVERHEAD, 8);
+}
+
+/* MTU for Ethernet need to take into account 8-byte SNAP header
+ * to be added when encapsulating Ethernet frame into 802.11
+ */
+#define WIL_MAX_ETH_MTU         (IEEE80211_MAX_DATA_LEN_DMG - 8)
 /* Max supported by wil6210 value for interrupt threshold is 5sec. */
 #define WIL6210_ITR_TRSH_MAX (5000000)
-#define WIL6210_ITR_TRSH_DEFAULT        (300) /* usec */
+#define WIL6210_ITR_TX_INTERFRAME_TIMEOUT_DEFAULT (15) /* usec */
+#define WIL6210_ITR_RX_INTERFRAME_TIMEOUT_DEFAULT (15) /* usec */
+#define WIL6210_ITR_TX_MAX_BURST_DURATION_DEFAULT (500) /* usec */
+#define WIL6210_ITR_RX_MAX_BURST_DURATION_DEFAULT (500) /* usec */
 #define WIL6210_FW_RECOVERY_RETRIES     (5) /* try to recover this many times */
 #define WIL6210_FW_RECOVERY_TO  msecs_to_jiffies(5000)
 #define WIL6210_SCAN_TO         msecs_to_jiffies(10000)
-
+#define WIL6210_RX_HIGH_TRSH_INIT               (0)
+#define WIL6210_RX_HIGH_TRSH_DEFAULT \
+                                (1 << (WIL_RX_RING_SIZE_ORDER_DEFAULT - 3))
 /* Hardware definitions begin */
 
 /*
@@ -135,7 +158,7 @@ struct RGF_ICR {
         #define BIT_DMA_EP_MISC_ICR_TX_NO_ACT   BIT(1)
         #define BIT_DMA_EP_MISC_ICR_FW_INT(n)   BIT(28+n) /* n = [0..3] */
 
-/* Interrupt moderation control */
+/* Legacy interrupt moderation control (before Sparrow v2)*/
 #define RGF_DMA_ITR_CNT_TRSH            (0x881c5c)
 #define RGF_DMA_ITR_CNT_DATA            (0x881c60)
 #define RGF_DMA_ITR_CNT_CRL             (0x881c64)
@@ -145,6 +168,46 @@ struct RGF_ICR {
         #define BIT_DMA_ITR_CNT_CRL_CLR         BIT(3)
         #define BIT_DMA_ITR_CNT_CRL_REACH_TRSH  BIT(4)
 
+/* New (sparrow v2+) interrupt moderation control */
+#define RGF_DMA_ITR_TX_DESQ_NO_MOD              (0x881d40)
+#define RGF_DMA_ITR_TX_CNT_TRSH                 (0x881d34)
+#define RGF_DMA_ITR_TX_CNT_DATA                 (0x881d38)
+#define RGF_DMA_ITR_TX_CNT_CTL                  (0x881d3c)
+        #define BIT_DMA_ITR_TX_CNT_CTL_EN               BIT(0)
+        #define BIT_DMA_ITR_TX_CNT_CTL_EXT_TIC_SEL      BIT(1)
+        #define BIT_DMA_ITR_TX_CNT_CTL_FOREVER          BIT(2)
+        #define BIT_DMA_ITR_TX_CNT_CTL_CLR              BIT(3)
+        #define BIT_DMA_ITR_TX_CNT_CTL_REACHED_TRESH    BIT(4)
+        #define BIT_DMA_ITR_TX_CNT_CTL_CROSS_EN         BIT(5)
+        #define BIT_DMA_ITR_TX_CNT_CTL_FREE_RUNNIG      BIT(6)
+#define RGF_DMA_ITR_TX_IDL_CNT_TRSH                     (0x881d60)
+#define RGF_DMA_ITR_TX_IDL_CNT_DATA                     (0x881d64)
+#define RGF_DMA_ITR_TX_IDL_CNT_CTL                      (0x881d68)
+        #define BIT_DMA_ITR_TX_IDL_CNT_CTL_EN                   BIT(0)
+        #define BIT_DMA_ITR_TX_IDL_CNT_CTL_EXT_TIC_SEL          BIT(1)
+        #define BIT_DMA_ITR_TX_IDL_CNT_CTL_FOREVER              BIT(2)
+        #define BIT_DMA_ITR_TX_IDL_CNT_CTL_CLR                  BIT(3)
+        #define BIT_DMA_ITR_TX_IDL_CNT_CTL_REACHED_TRESH        BIT(4)
+#define RGF_DMA_ITR_RX_DESQ_NO_MOD              (0x881d50)
+#define RGF_DMA_ITR_RX_CNT_TRSH                 (0x881d44)
+#define RGF_DMA_ITR_RX_CNT_DATA                 (0x881d48)
+#define RGF_DMA_ITR_RX_CNT_CTL                  (0x881d4c)
+        #define BIT_DMA_ITR_RX_CNT_CTL_EN               BIT(0)
+        #define BIT_DMA_ITR_RX_CNT_CTL_EXT_TIC_SEL      BIT(1)
+        #define BIT_DMA_ITR_RX_CNT_CTL_FOREVER          BIT(2)
+        #define BIT_DMA_ITR_RX_CNT_CTL_CLR              BIT(3)
+        #define BIT_DMA_ITR_RX_CNT_CTL_REACHED_TRESH    BIT(4)
+        #define BIT_DMA_ITR_RX_CNT_CTL_CROSS_EN         BIT(5)
+        #define BIT_DMA_ITR_RX_CNT_CTL_FREE_RUNNIG      BIT(6)
+#define RGF_DMA_ITR_RX_IDL_CNT_TRSH                     (0x881d54)
+#define RGF_DMA_ITR_RX_IDL_CNT_DATA                     (0x881d58)
+#define RGF_DMA_ITR_RX_IDL_CNT_CTL                      (0x881d5c)
+        #define BIT_DMA_ITR_RX_IDL_CNT_CTL_EN                   BIT(0)
+        #define BIT_DMA_ITR_RX_IDL_CNT_CTL_EXT_TIC_SEL          BIT(1)
+        #define BIT_DMA_ITR_RX_IDL_CNT_CTL_FOREVER              BIT(2)
+        #define BIT_DMA_ITR_RX_IDL_CNT_CTL_CLR                  BIT(3)
+        #define BIT_DMA_ITR_RX_IDL_CNT_CTL_REACHED_TRESH        BIT(4)
+
 #define RGF_DMA_PSEUDO_CAUSE            (0x881c68)
 #define RGF_DMA_PSEUDO_CAUSE_MASK_SW    (0x881c6c)
 #define RGF_DMA_PSEUDO_CAUSE_MASK_FW    (0x881c70)
@@ -164,6 +227,20 @@ struct RGF_ICR {
 #define RGF_CAF_PLL_LOCK_STATUS         (0x88afec)
         #define BIT_CAF_OSC_DIG_XTAL_STABLE     BIT(0)
 
+#define RGF_USER_JTAG_DEV_ID    (0x880b34) /* device ID */
+        #define JTAG_DEV_ID_MARLON_B0   (0x0612072f)
+        #define JTAG_DEV_ID_SPARROW_A0  (0x0632072f)
+        #define JTAG_DEV_ID_SPARROW_A1  (0x1632072f)
+        #define JTAG_DEV_ID_SPARROW_B0  (0x2632072f)
+
+enum {
+        HW_VER_UNKNOWN,
+        HW_VER_MARLON_B0,  /* JTAG_DEV_ID_MARLON_B0  */
+        HW_VER_SPARROW_A0, /* JTAG_DEV_ID_SPARROW_A0 */
+        HW_VER_SPARROW_A1, /* JTAG_DEV_ID_SPARROW_A1 */
+        HW_VER_SPARROW_B0, /* JTAG_DEV_ID_SPARROW_B0 */
+};
+
 /* popular locations */
 #define HOST_MBOX   HOSTADDR(RGF_USER_USER_SCRATCH_PAD)
 #define HOST_SW_INT (HOSTADDR(RGF_USER_USER_ICR) + \
@@ -303,6 +380,10 @@ struct vring {
 struct vring_tx_data {
         int enabled;
         cycles_t idle, last_idle, begin;
+        u8 agg_wsize; /* agreed aggregation window, 0 - no agg */
+        u16 agg_timeout;
+        u8 agg_amsdu;
+        bool addba_in_progress; /* if set, agg_xxx is for request in progress */
 };
 
 enum { /* for wil6210_priv.status */
@@ -313,6 +394,7 @@ enum { /* for wil6210_priv.status */
         wil_status_reset_done,
         wil_status_irqen, /* FIXME: interrupts enabled - for debug */
         wil_status_napi_en, /* NAPI enabled protected by wil->mutex */
+        wil_status_last /* keep last */
 };
 
 struct pci_dev;
@@ -397,15 +479,40 @@ enum {
         fw_recovery_running = 2,
 };
 
+enum {
+        hw_capability_reset_v2 = 0,
+        hw_capability_advanced_itr_moderation = 1,
+        hw_capability_last
+};
+
+struct wil_back_rx {
+        struct list_head list;
+        /* request params, converted to CPU byte order - what we asked for */
+        u8 cidxtid;
+        u8 dialog_token;
+        u16 ba_param_set;
+        u16 ba_timeout;
+        u16 ba_seq_ctrl;
+};
+
+struct wil_back_tx {
+        struct list_head list;
+        /* request params, converted to CPU byte order - what we asked for */
+        u8 ringid;
+        u8 agg_wsize;
+        u16 agg_timeout;
+};
+
 struct wil6210_priv {
         struct pci_dev *pdev;
         int n_msi;
         struct wireless_dev *wdev;
         void __iomem *csr;
-        ulong status;
+        DECLARE_BITMAP(status, wil_status_last);
         u32 fw_version;
         u32 hw_version;
-        struct wil_board *board;
+        const char *hw_name;
+        DECLARE_BITMAP(hw_capabilities, hw_capability_last);
         u8 n_mids; /* number of additional MIDs as reported by FW */
         u32 recovery_count; /* num of FW recovery attempts in a short time */
         u32 recovery_state; /* FW recovery state machine */
@@ -415,7 +522,11 @@ struct wil6210_priv {
         u32 monitor_flags;
         u32 secure_pcp; /* create secure PCP? */
         int sinfo_gen;
-        u32 itr_trsh;
+        /* interrupt moderation */
+        u32 tx_max_burst_duration;
+        u32 tx_interframe_timeout;
+        u32 rx_max_burst_duration;
+        u32 rx_interframe_timeout;
         /* cached ISR registers */
         u32 isr_misc;
         /* mailbox related */
@@ -429,7 +540,7 @@ struct wil6210_priv {
         u16 reply_size;
         struct workqueue_struct *wmi_wq; /* for deferred calls */
         struct work_struct wmi_event_worker;
-        struct workqueue_struct *wmi_wq_conn; /* for connect worker */
+        struct workqueue_struct *wq_service;
         struct work_struct connect_worker;
         struct work_struct disconnect_worker;
         struct work_struct fw_error_worker;     /* for FW error recovery */
@@ -445,6 +556,13 @@ struct wil6210_priv {
         spinlock_t wmi_ev_lock;
         struct napi_struct napi_rx;
         struct napi_struct napi_tx;
+        /* BACK */
+        struct list_head back_rx_pending;
+        struct mutex back_rx_mutex; /* protect @back_rx_pending */
+        struct work_struct back_rx_worker;
+        struct list_head back_tx_pending;
+        struct mutex back_tx_mutex; /* protect @back_tx_pending */
+        struct work_struct back_tx_worker;
         /* DMA related */
         struct vring vring_rx;
         struct vring vring_tx[WIL6210_MAX_TX_RINGS];
@@ -529,7 +647,6 @@ void wil_if_remove(struct wil6210_priv *wil);
 int wil_priv_init(struct wil6210_priv *wil);
 void wil_priv_deinit(struct wil6210_priv *wil);
 int wil_reset(struct wil6210_priv *wil);
-void wil_set_itr_trsh(struct wil6210_priv *wil);
 void wil_fw_error_recovery(struct wil6210_priv *wil);
 void wil_set_recovery_state(struct wil6210_priv *wil, int state);
 void wil_link_on(struct wil6210_priv *wil);
@@ -567,12 +684,26 @@ int wmi_p2p_cfg(struct wil6210_priv *wil, int channel);
 int wmi_rxon(struct wil6210_priv *wil, bool on);
 int wmi_get_temperature(struct wil6210_priv *wil, u32 *t_m, u32 *t_r);
 int wmi_disconnect_sta(struct wil6210_priv *wil, const u8 *mac, u16 reason);
+int wmi_addba(struct wil6210_priv *wil, u8 ringid, u8 size, u16 timeout);
+int wmi_delba_tx(struct wil6210_priv *wil, u8 ringid, u16 reason);
+int wmi_delba_rx(struct wil6210_priv *wil, u8 cidxtid, u16 reason);
+int wmi_addba_rx_resp(struct wil6210_priv *wil, u8 cid, u8 tid, u8 token,
+                      u16 status, bool amsdu, u16 agg_wsize, u16 timeout);
+int wil_addba_rx_request(struct wil6210_priv *wil, u8 cidxtid,
+                         u8 dialog_token, __le16 ba_param_set,
+                         __le16 ba_timeout, __le16 ba_seq_ctrl);
+void wil_back_rx_worker(struct work_struct *work);
+void wil_back_rx_flush(struct wil6210_priv *wil);
+int wil_addba_tx_request(struct wil6210_priv *wil, u8 ringid, u16 wsize);
+void wil_back_tx_worker(struct work_struct *work);
+void wil_back_tx_flush(struct wil6210_priv *wil);
 
 void wil6210_clear_irq(struct wil6210_priv *wil);
 int wil6210_init_irq(struct wil6210_priv *wil, int irq);
 void wil6210_fini_irq(struct wil6210_priv *wil, int irq);
 void wil_mask_irq(struct wil6210_priv *wil);
 void wil_unmask_irq(struct wil6210_priv *wil);
+void wil_configure_interrupt_moderation(struct wil6210_priv *wil);
 void wil_disable_irq(struct wil6210_priv *wil);
 void wil_enable_irq(struct wil6210_priv *wil);
 int wil_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
index 899754920955..b2b0fe1faa96 100644
--- a/drivers/net/wireless/ath/wil6210/wmi.c
+++ b/drivers/net/wireless/ath/wil6210/wmi.c
@@ -23,10 +23,15 @@
 #include "wmi.h"
 #include "trace.h"
 
-static uint max_assoc_sta = 1;
+static uint max_assoc_sta = WIL6210_MAX_CID;
 module_param(max_assoc_sta, uint, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(max_assoc_sta, " Max number of stations associated to the AP");
 
+int agg_wsize; /* = 0; */
+module_param(agg_wsize, int, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(agg_wsize, " Window size for Tx Block Ack after connect;"
+                 " 0 - use default; < 0 - don't auto-establish");
+
 /**
  * WMI event receiving - theory of operations
  *
@@ -197,7 +202,7 @@ static int __wmi_send(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len)
 
         might_sleep();
 
-        if (!test_bit(wil_status_fwready, &wil->status)) {
+        if (!test_bit(wil_status_fwready, wil->status)) {
                 wil_err(wil, "WMI: cannot send command while FW not ready\n");
                 return -EAGAIN;
         }
@@ -300,7 +305,7 @@ static void wmi_evt_fw_ready(struct wil6210_priv *wil, int id, void *d,
         wil_dbg_wmi(wil, "WMI: got FW ready event\n");
 
         wil_set_recovery_state(wil, fw_recovery_idle);
-        set_bit(wil_status_fwready, &wil->status);
+        set_bit(wil_status_fwready, wil->status);
         /* let the reset sequence continue */
         complete(&wil->wmi_ready);
 }
@@ -438,7 +443,7 @@ static void wmi_evt_connect(struct wil6210_priv *wil, int id, void *d, int len)
 
         if ((wdev->iftype == NL80211_IFTYPE_STATION) ||
             (wdev->iftype == NL80211_IFTYPE_P2P_CLIENT)) {
-                if (!test_bit(wil_status_fwconnecting, &wil->status)) {
+                if (!test_bit(wil_status_fwconnecting, wil->status)) {
                         wil_err(wil, "Not in connecting state\n");
                         return;
                 }
@@ -461,8 +466,8 @@ static void wmi_evt_connect(struct wil6210_priv *wil, int id, void *d, int len)
 
                 cfg80211_new_sta(ndev, evt->bssid, &sinfo, GFP_KERNEL);
         }
-        clear_bit(wil_status_fwconnecting, &wil->status);
-        set_bit(wil_status_fwconnected, &wil->status);
+        clear_bit(wil_status_fwconnecting, wil->status);
+        set_bit(wil_status_fwconnected, wil->status);
 
         /* FIXME FW can transmit only ucast frames to peer */
         /* FIXME real ring_id instead of hard coded 0 */
@@ -470,7 +475,7 @@ static void wmi_evt_connect(struct wil6210_priv *wil, int id, void *d, int len)
         wil->sta[evt->cid].status = wil_sta_conn_pending;
 
         wil->pending_connect_cid = evt->cid;
-        queue_work(wil->wmi_wq_conn, &wil->connect_worker);
+        queue_work(wil->wq_service, &wil->connect_worker);
 }
 
 static void wmi_evt_disconnect(struct wil6210_priv *wil, int id,
@@ -543,6 +548,22 @@ static void wmi_evt_eapol_rx(struct wil6210_priv *wil, int id,
         }
 }
 
+static void wil_addba_tx_cid(struct wil6210_priv *wil, u8 cid, u16 wsize)
+{
+        struct vring_tx_data *t;
+        int i;
+
+        for (i = 0; i < WIL6210_MAX_TX_RINGS; i++) {
+                if (cid != wil->vring2cid_tid[i][0])
+                        continue;
+                t = &wil->vring_tx_data[i];
+                if (!t->enabled)
+                        continue;
+
+                wil_addba_tx_request(wil, i, wsize);
+        }
+}
+
 static void wmi_evt_linkup(struct wil6210_priv *wil, int id, void *d, int len)
 {
         struct net_device *ndev = wil_to_ndev(wil);
@@ -557,6 +578,8 @@ static void wmi_evt_linkup(struct wil6210_priv *wil, int id, void *d, int len)
         }
 
         wil->sta[cid].data_port_open = true;
+        if (agg_wsize >= 0)
+                wil_addba_tx_cid(wil, cid, agg_wsize);
         netif_carrier_on(ndev);
 }
 
@@ -582,55 +605,89 @@ static void wmi_evt_ba_status(struct wil6210_priv *wil, int id, void *d,
                               int len)
 {
         struct wmi_vring_ba_status_event *evt = d;
-        struct wil_sta_info *sta;
-        uint i, cid;
-
-        /* TODO: use Rx BA status, not Tx one */
+        struct vring_tx_data *txdata;
 
-        wil_dbg_wmi(wil, "BACK[%d] %s {%d} timeout %d\n",
+        wil_dbg_wmi(wil, "BACK[%d] %s {%d} timeout %d AMSDU%s\n",
                     evt->ringid,
                     evt->status == WMI_BA_AGREED ? "OK" : "N/A",
-                    evt->agg_wsize, __le16_to_cpu(evt->ba_timeout));
+                    evt->agg_wsize, __le16_to_cpu(evt->ba_timeout),
+                    evt->amsdu ? "+" : "-");
 
         if (evt->ringid >= WIL6210_MAX_TX_RINGS) {
                 wil_err(wil, "invalid ring id %d\n", evt->ringid);
                 return;
         }
 
-        mutex_lock(&wil->mutex);
-
-        cid = wil->vring2cid_tid[evt->ringid][0];
-        if (cid >= WIL6210_MAX_CID) {
-                wil_err(wil, "invalid CID %d for vring %d\n", cid, evt->ringid);
-                goto out;
+        if (evt->status != WMI_BA_AGREED) {
+                evt->ba_timeout = 0;
+                evt->agg_wsize = 0;
+                evt->amsdu = 0;
         }
 
-        sta = &wil->sta[cid];
-        if (sta->status == wil_sta_unused) {
-                wil_err(wil, "CID %d unused\n", cid);
-                goto out;
-        }
+        txdata = &wil->vring_tx_data[evt->ringid];
 
-        wil_dbg_wmi(wil, "BACK for CID %d %pM\n", cid, sta->addr);
-        for (i = 0; i < WIL_STA_TID_NUM; i++) {
-                struct wil_tid_ampdu_rx *r;
-                unsigned long flags;
+        txdata->agg_timeout = le16_to_cpu(evt->ba_timeout);
+        txdata->agg_wsize = evt->agg_wsize;
+        txdata->agg_amsdu = evt->amsdu;
+        txdata->addba_in_progress = false;
+}
 
-                spin_lock_irqsave(&sta->tid_rx_lock, flags);
+static void wmi_evt_addba_rx_req(struct wil6210_priv *wil, int id, void *d,
+                                 int len)
+{
+        struct wmi_rcp_addba_req_event *evt = d;
 
-                r = sta->tid_rx[i];
-                sta->tid_rx[i] = NULL;
-                wil_tid_ampdu_rx_free(wil, r);
+        wil_addba_rx_request(wil, evt->cidxtid, evt->dialog_token,
+                             evt->ba_param_set, evt->ba_timeout,
+                             evt->ba_seq_ctrl);
+}
 
-                spin_unlock_irqrestore(&sta->tid_rx_lock, flags);
+static void wmi_evt_delba(struct wil6210_priv *wil, int id, void *d, int len)
+__acquires(&sta->tid_rx_lock) __releases(&sta->tid_rx_lock)
+{
+        struct wmi_delba_event *evt = d;
+        u8 cid, tid;
+        u16 reason = __le16_to_cpu(evt->reason);
+        struct wil_sta_info *sta;
+        struct wil_tid_ampdu_rx *r;
 
-                if ((evt->status == WMI_BA_AGREED) && evt->agg_wsize)
-                        sta->tid_rx[i] = wil_tid_ampdu_rx_alloc(wil,
-                                                evt->agg_wsize, 0);
+        might_sleep();
+        parse_cidxtid(evt->cidxtid, &cid, &tid);
+        wil_dbg_wmi(wil, "DELBA CID %d TID %d from %s reason %d\n",
+                    cid, tid,
+                    evt->from_initiator ? "originator" : "recipient",
+                    reason);
+        if (!evt->from_initiator) {
+                int i;
+                /* find Tx vring it belongs to */
+                for (i = 0; i < ARRAY_SIZE(wil->vring2cid_tid); i++) {
+                        if ((wil->vring2cid_tid[i][0] == cid) &&
+                            (wil->vring2cid_tid[i][1] == tid)) {
+                                struct vring_tx_data *txdata =
+                                        &wil->vring_tx_data[i];
+
+                                wil_dbg_wmi(wil, "DELBA Tx vring %d\n", i);
+                                txdata->agg_timeout = 0;
+                                txdata->agg_wsize = 0;
+                                txdata->addba_in_progress = false;
+
+                                break; /* max. 1 matching ring */
+                        }
+                }
+                if (i >= ARRAY_SIZE(wil->vring2cid_tid))
+                        wil_err(wil, "DELBA: unable to find Tx vring\n");
+                return;
         }
 
-out:
-        mutex_unlock(&wil->mutex);
+        sta = &wil->sta[cid];
+
+        spin_lock_bh(&sta->tid_rx_lock);
+
+        r = sta->tid_rx[tid];
+        sta->tid_rx[tid] = NULL;
+        wil_tid_ampdu_rx_free(wil, r);
+
+        spin_unlock_bh(&sta->tid_rx_lock);
 }
 
 static const struct {
@@ -648,6 +705,8 @@ static const struct {
         {WMI_DATA_PORT_OPEN_EVENTID,    wmi_evt_linkup},
         {WMI_WBE_LINKDOWN_EVENTID,      wmi_evt_linkdown},
         {WMI_BA_STATUS_EVENTID,         wmi_evt_ba_status},
+        {WMI_RCP_ADDBA_REQ_EVENTID,     wmi_evt_addba_rx_req},
+        {WMI_DELBA_EVENTID,             wmi_evt_delba},
 };
 
 /*
@@ -667,7 +726,7 @@ void wmi_recv_cmd(struct wil6210_priv *wil)
         ulong flags;
         unsigned n;
 
-        if (!test_bit(wil_status_reset_done, &wil->status)) {
+        if (!test_bit(wil_status_reset_done, wil->status)) {
                 wil_err(wil, "Reset in progress. Cannot handle WMI event\n");
                 return;
         }
@@ -1024,13 +1083,14 @@ int wmi_rx_chain_add(struct wil6210_priv *wil, struct vring *vring)
         struct wmi_cfg_rx_chain_cmd cmd = {
                 .action = WMI_RX_CHAIN_ADD,
                 .rx_sw_ring = {
-                        .max_mpdu_size = cpu_to_le16(mtu_max + ETH_HLEN),
+                        .max_mpdu_size = cpu_to_le16(wil_mtu2macbuf(mtu_max)),
                         .ring_mem_base = cpu_to_le64(vring->pa),
                         .ring_size = cpu_to_le16(vring->size),
                 },
                 .mid = 0, /* TODO - what is it? */
                 .decap_trans_type = WMI_DECAP_TYPE_802_3,
                 .reorder_type = WMI_RX_SW_REORDER,
+                .host_thrsh = cpu_to_le16(rx_ring_overflow_thrsh),
         };
         struct {
                 struct wil6210_mbox_hdr_wmi wmi;
@@ -1110,6 +1170,87 @@ int wmi_disconnect_sta(struct wil6210_priv *wil, const u8 *mac, u16 reason)
         return wmi_send(wil, WMI_DISCONNECT_STA_CMDID, &cmd, sizeof(cmd));
 }
 
+int wmi_addba(struct wil6210_priv *wil, u8 ringid, u8 size, u16 timeout)
+{
+        struct wmi_vring_ba_en_cmd cmd = {
+                .ringid = ringid,
+                .agg_max_wsize = size,
+                .ba_timeout = cpu_to_le16(timeout),
+                .amsdu = 0,
+        };
+
+        wil_dbg_wmi(wil, "%s(ring %d size %d timeout %d)\n", __func__,
+                    ringid, size, timeout);
+
+        return wmi_send(wil, WMI_VRING_BA_EN_CMDID, &cmd, sizeof(cmd));
+}
+
+int wmi_delba_tx(struct wil6210_priv *wil, u8 ringid, u16 reason)
+{
+        struct wmi_vring_ba_dis_cmd cmd = {
+                .ringid = ringid,
+                .reason = cpu_to_le16(reason),
+        };
+
+        wil_dbg_wmi(wil, "%s(ring %d reason %d)\n", __func__,
+                    ringid, reason);
+
+        return wmi_send(wil, WMI_VRING_BA_DIS_CMDID, &cmd, sizeof(cmd));
+}
+
+int wmi_delba_rx(struct wil6210_priv *wil, u8 cidxtid, u16 reason)
+{
+        struct wmi_rcp_delba_cmd cmd = {
+                .cidxtid = cidxtid,
+                .reason = cpu_to_le16(reason),
+        };
+
+        wil_dbg_wmi(wil, "%s(CID %d TID %d reason %d)\n", __func__,
+                    cidxtid & 0xf, (cidxtid >> 4) & 0xf, reason);
+
+        return wmi_send(wil, WMI_RCP_DELBA_CMDID, &cmd, sizeof(cmd));
+}
+
+int wmi_addba_rx_resp(struct wil6210_priv *wil, u8 cid, u8 tid, u8 token,
+                      u16 status, bool amsdu, u16 agg_wsize, u16 timeout)
+{
+        int rc;
+        struct wmi_rcp_addba_resp_cmd cmd = {
+                .cidxtid = mk_cidxtid(cid, tid),
+                .dialog_token = token,
+                .status_code = cpu_to_le16(status),
+                /* bit 0: A-MSDU supported
+                 * bit 1: policy (should be 0 for us)
+                 * bits 2..5: TID
+                 * bits 6..15: buffer size
+                 */
+                .ba_param_set = cpu_to_le16((amsdu ? 1 : 0) | (tid << 2) |
+                                            (agg_wsize << 6)),
+                .ba_timeout = cpu_to_le16(timeout),
+        };
+        struct {
+                struct wil6210_mbox_hdr_wmi wmi;
+                struct wmi_rcp_addba_resp_sent_event evt;
+        } __packed reply;
+
+        wil_dbg_wmi(wil,
+                    "ADDBA response for CID %d TID %d size %d timeout %d status %d AMSDU%s\n",
+                    cid, tid, agg_wsize, timeout, status, amsdu ? "+" : "-");
+
+        rc = wmi_call(wil, WMI_RCP_ADDBA_RESP_CMDID, &cmd, sizeof(cmd),
+                      WMI_ADDBA_RESP_SENT_EVENTID, &reply, sizeof(reply), 100);
+        if (rc)
+                return rc;
+
+        if (reply.evt.status) {
+                wil_err(wil, "ADDBA response failed with status %d\n",
+                        le16_to_cpu(reply.evt.status));
+                rc = -EINVAL;
+        }
+
+        return rc;
+}
+
 void wmi_event_flush(struct wil6210_priv *wil)
 {
         struct pending_wmi_event *evt, *t;
diff --git a/drivers/net/wireless/ath/wil6210/wmi.h b/drivers/net/wireless/ath/wil6210/wmi.h
index 27b97432d1c2..b5102f0b97f4 100644
--- a/drivers/net/wireless/ath/wil6210/wmi.h
+++ b/drivers/net/wireless/ath/wil6210/wmi.h
@@ -586,6 +586,7 @@ struct wmi_vring_ba_en_cmd {
         u8 ringid;
         u8 agg_max_wsize;
         __le16 ba_timeout;
+        u8 amsdu;
 } __packed;
 
 /*
@@ -1052,14 +1053,23 @@ struct wmi_scan_complete_event {
 enum wmi_vring_ba_status {
         WMI_BA_AGREED                   = 0,
         WMI_BA_NON_AGREED               = 1,
+        /* BA_EN in middle of teardown flow */
+        WMI_BA_TD_WIP                   = 2,
+        /* BA_DIS or BA_EN in middle of BA SETUP flow */
+        WMI_BA_SETUP_WIP                = 3,
+        /* BA_EN when the BA session is already active */
+        WMI_BA_SESSION_ACTIVE           = 4,
+        /* BA_DIS when the BA session is not active */
+        WMI_BA_SESSION_NOT_ACTIVE       = 5,
 };
 
 struct wmi_vring_ba_status_event {
-        __le16 status;
+        __le16 status; /* enum wmi_vring_ba_status */
         u8 reserved[2];
         u8 ringid;
         u8 agg_wsize;
         __le16 ba_timeout;
+        u8 amsdu;
 } __packed;
 
 /*
diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c
index 9183f1cf89a7..55db9f03eb2a 100644
--- a/drivers/net/wireless/atmel.c
+++ b/drivers/net/wireless/atmel.c
@@ -45,7 +45,6 @@
 #include <linux/ptrace.h>
 #include <linux/slab.h>
 #include <linux/string.h>
-#include <linux/ctype.h>
 #include <linux/timer.h>
 #include <asm/byteorder.h>
 #include <asm/io.h>
@@ -2699,16 +2698,7 @@ static int atmel_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
                 domain[REGDOMAINSZ] = 0;
                 rc = -EINVAL;
                 for (i = 0; i < ARRAY_SIZE(channel_table); i++) {
-                        /* strcasecmp doesn't exist in the library */
-                        char *a = channel_table[i].name;
-                        char *b = domain;
-                        while (*a) {
-                                char c1 = *a++;
-                                char c2 = *b++;
-                                if (tolower(c1) != tolower(c2))
-                                        break;
-                        }
-                        if (!*a && !*b) {
+                        if (!strcasecmp(channel_table[i].name, domain)) {
                                 priv->config_reg_domain = channel_table[i].reg_domain;
                                 rc = 0;
                         }
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 47731cb0d815..58a2e88631fb 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -4318,6 +4318,7 @@ redo:
         mutex_unlock(&wl->mutex);
         cancel_delayed_work_sync(&dev->periodic_work);
         cancel_work_sync(&wl->tx_work);
+        b43_leds_stop(dev);
         mutex_lock(&wl->mutex);
         dev = wl->current_dev;
         if (!dev || b43_status(dev) < B43_STAT_STARTED) {
diff --git a/drivers/net/wireless/b43legacy/radio.c b/drivers/net/wireless/b43legacy/radio.c
index 896177690394..9501420340a9 100644
--- a/drivers/net/wireless/b43legacy/radio.c
+++ b/drivers/net/wireless/b43legacy/radio.c
@@ -1743,25 +1743,6 @@ u16 freq_r3A_value(u16 frequency)
         return value;
 }
 
-void b43legacy_radio_set_tx_iq(struct b43legacy_wldev *dev)
-{
-        static const u8 data_high[5] = { 0x00, 0x40, 0x80, 0x90, 0xD0 };
-        static const u8 data_low[5]  = { 0x00, 0x01, 0x05, 0x06, 0x0A };
-        u16 tmp = b43legacy_radio_read16(dev, 0x001E);
-        int i;
-        int j;
-
-        for (i = 0; i < 5; i++) {
-                for (j = 0; j < 5; j++) {
-                        if (tmp == (data_high[i] | data_low[j])) {
-                                b43legacy_phy_write(dev, 0x0069, (i - j) << 8 |
-                                                    0x00C0);
-                                return;
-                        }
-                }
-        }
-}
-
 int b43legacy_radio_selectchannel(struct b43legacy_wldev *dev,
                                   u8 channel,
                                   int synthetic_pu_workaround)
diff --git a/drivers/net/wireless/b43legacy/radio.h b/drivers/net/wireless/b43legacy/radio.h
index bccb3d7da682..dd2976d1d561 100644
--- a/drivers/net/wireless/b43legacy/radio.h
+++ b/drivers/net/wireless/b43legacy/radio.h
@@ -92,7 +92,6 @@ void b43legacy_nrssi_hw_write(struct b43legacy_wldev *dev, u16 offset, s16 val);
 void b43legacy_nrssi_hw_update(struct b43legacy_wldev *dev, u16 val);
 void b43legacy_nrssi_mem_update(struct b43legacy_wldev *dev);
 
-void b43legacy_radio_set_tx_iq(struct b43legacy_wldev *dev);
 u16 b43legacy_radio_calibrationvalue(struct b43legacy_wldev *dev);
 
 #endif /* B43legacy_RADIO_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
index 9880dae2a569..00ba90b89455 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
@@ -996,18 +996,20 @@ out:
 }
 
 #define BRCMF_SDIO_DEVICE(dev_id)       \
-        {SDIO_DEVICE(BRCM_SDIO_VENDOR_ID_BROADCOM, dev_id)}
+        {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, dev_id)}
 
 /* devices we support, null terminated */
 static const struct sdio_device_id brcmf_sdmmc_ids[] = {
-        BRCMF_SDIO_DEVICE(BRCM_SDIO_43143_DEVICE_ID),
-        BRCMF_SDIO_DEVICE(BRCM_SDIO_43241_DEVICE_ID),
-        BRCMF_SDIO_DEVICE(BRCM_SDIO_4329_DEVICE_ID),
-        BRCMF_SDIO_DEVICE(BRCM_SDIO_4330_DEVICE_ID),
-        BRCMF_SDIO_DEVICE(BRCM_SDIO_4334_DEVICE_ID),
-        BRCMF_SDIO_DEVICE(BRCM_SDIO_43362_DEVICE_ID),
-        BRCMF_SDIO_DEVICE(BRCM_SDIO_4335_4339_DEVICE_ID),
-        BRCMF_SDIO_DEVICE(BRCM_SDIO_4354_DEVICE_ID),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43143),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43241),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4329),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4330),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4334),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43340),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43341),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43362),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4335_4339),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4354),
         { /* end: all zeroes */ }
 };
 MODULE_DEVICE_TABLE(sdio, brcmf_sdmmc_ids);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
index 4a88b2381a68..5eba81bfc6ed 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
@@ -38,6 +38,7 @@
 #include "proto.h"
 #include "vendor.h"
 #include "bus.h"
+#include "common.h"
 
 #define BRCMF_SCAN_IE_LEN_MAX           2048
 #define BRCMF_PNO_VERSION               2
@@ -452,16 +453,16 @@ static void convert_key_from_CPU(struct brcmf_wsec_key *key,
 }
 
 static int
-send_key_to_dongle(struct net_device *ndev, struct brcmf_wsec_key *key)
+send_key_to_dongle(struct brcmf_if *ifp, struct brcmf_wsec_key *key)
 {
         int err;
         struct brcmf_wsec_key_le key_le;
 
         convert_key_from_CPU(key, &key_le);
 
-        brcmf_netdev_wait_pend8021x(ndev);
+        brcmf_netdev_wait_pend8021x(ifp);
 
-        err = brcmf_fil_bsscfg_data_set(netdev_priv(ndev), "wsec_key", &key_le,
+        err = brcmf_fil_bsscfg_data_set(ifp, "wsec_key", &key_le,
                                         sizeof(key_le));
 
         if (err)
@@ -1670,7 +1671,7 @@ brcmf_set_sharedkey(struct net_device *ndev,
         brcmf_dbg(CONN, "key length (%d) key index (%d) algo (%d)\n",
                   key.len, key.index, key.algo);
         brcmf_dbg(CONN, "key \"%s\"\n", key.data);
-        err = send_key_to_dongle(ndev, &key);
+        err = send_key_to_dongle(netdev_priv(ndev), &key);
         if (err)
                 return err;
 
@@ -2052,7 +2053,7 @@ brcmf_add_keyext(struct wiphy *wiphy, struct net_device *ndev,
         /* check for key index change */
         if (key.len == 0) {
                 /* key delete */
-                err = send_key_to_dongle(ndev, &key);
+                err = send_key_to_dongle(ifp, &key);
                 if (err)
                         brcmf_err("key delete error (%d)\n", err);
         } else {
@@ -2108,7 +2109,7 @@ brcmf_add_keyext(struct wiphy *wiphy, struct net_device *ndev,
                         brcmf_err("Invalid cipher (0x%x)\n", params->cipher);
                         return -EINVAL;
                 }
-                err = send_key_to_dongle(ndev, &key);
+                err = send_key_to_dongle(ifp, &key);
                 if (err)
                         brcmf_err("wsec_key error (%d)\n", err);
         }
@@ -2121,7 +2122,7 @@ brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
                     struct key_params *params)
 {
         struct brcmf_if *ifp = netdev_priv(ndev);
-        struct brcmf_wsec_key key;
+        struct brcmf_wsec_key *key;
         s32 val;
         s32 wsec;
         s32 err = 0;
@@ -2132,54 +2133,62 @@ brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
         if (!check_vif_up(ifp->vif))
                 return -EIO;
 
+        if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
+                /* we ignore this key index in this case */
+                brcmf_err("invalid key index (%d)\n", key_idx);
+                return -EINVAL;
+        }
+
         if (mac_addr &&
                 (params->cipher != WLAN_CIPHER_SUITE_WEP40) &&
                 (params->cipher != WLAN_CIPHER_SUITE_WEP104)) {
                 brcmf_dbg(TRACE, "Exit");
                 return brcmf_add_keyext(wiphy, ndev, key_idx, mac_addr, params);
         }
-        memset(&key, 0, sizeof(key));
 
-        key.len = (u32) params->key_len;
-        key.index = (u32) key_idx;
+        key = &ifp->vif->profile.key[key_idx];
+        memset(key, 0, sizeof(*key));
 
-        if (key.len > sizeof(key.data)) {
-                brcmf_err("Too long key length (%u)\n", key.len);
+        if (params->key_len > sizeof(key->data)) {
+                brcmf_err("Too long key length (%u)\n", params->key_len);
                 err = -EINVAL;
                 goto done;
         }
-        memcpy(key.data, params->key, key.len);
+        key->len = params->key_len;
+        key->index = key_idx;
 
-        key.flags = BRCMF_PRIMARY_KEY;
+        memcpy(key->data, params->key, key->len);
+
+        key->flags = BRCMF_PRIMARY_KEY;
         switch (params->cipher) {
         case WLAN_CIPHER_SUITE_WEP40:
-                key.algo = CRYPTO_ALGO_WEP1;
+                key->algo = CRYPTO_ALGO_WEP1;
                 val = WEP_ENABLED;
                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
                 break;
         case WLAN_CIPHER_SUITE_WEP104:
-                key.algo = CRYPTO_ALGO_WEP128;
+                key->algo = CRYPTO_ALGO_WEP128;
                 val = WEP_ENABLED;
                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
                 break;
         case WLAN_CIPHER_SUITE_TKIP:
                 if (!brcmf_is_apmode(ifp->vif)) {
                         brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
-                        memcpy(keybuf, &key.data[24], sizeof(keybuf));
-                        memcpy(&key.data[24], &key.data[16], sizeof(keybuf));
-                        memcpy(&key.data[16], keybuf, sizeof(keybuf));
+                        memcpy(keybuf, &key->data[24], sizeof(keybuf));
+                        memcpy(&key->data[24], &key->data[16], sizeof(keybuf));
+                        memcpy(&key->data[16], keybuf, sizeof(keybuf));
                 }
-                key.algo = CRYPTO_ALGO_TKIP;
+                key->algo = CRYPTO_ALGO_TKIP;
                 val = TKIP_ENABLED;
                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
                 break;
         case WLAN_CIPHER_SUITE_AES_CMAC:
-                key.algo = CRYPTO_ALGO_AES_CCM;
+                key->algo = CRYPTO_ALGO_AES_CCM;
                 val = AES_ENABLED;
                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
                 break;
         case WLAN_CIPHER_SUITE_CCMP:
-                key.algo = CRYPTO_ALGO_AES_CCM;
+                key->algo = CRYPTO_ALGO_AES_CCM;
                 val = AES_ENABLED;
                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_CCMP\n");
                 break;
@@ -2189,7 +2198,7 @@ brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
                 goto done;
         }
 
-        err = send_key_to_dongle(ndev, &key);
+        err = send_key_to_dongle(ifp, key);
         if (err)
                 goto done;
 
@@ -2222,7 +2231,7 @@ brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
         if (!check_vif_up(ifp->vif))
                 return -EIO;
 
-        if (key_idx >= DOT11_MAX_DEFAULT_KEYS) {
+        if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
                 /* we ignore this key index in this case */
                 brcmf_err("invalid key index (%d)\n", key_idx);
                 return -EINVAL;
@@ -2237,7 +2246,7 @@ brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
 
         /* Set the new key/index */
-        err = send_key_to_dongle(ndev, &key);
+        err = send_key_to_dongle(ifp, &key);
 
         brcmf_dbg(TRACE, "Exit\n");
         return err;
@@ -2305,6 +2314,39 @@ brcmf_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
         return -EOPNOTSUPP;
 }
 
+static void
+brcmf_cfg80211_reconfigure_wep(struct brcmf_if *ifp)
+{
+        s32 err;
+        u8 key_idx;
+        struct brcmf_wsec_key *key;
+        s32 wsec;
+
+        for (key_idx = 0; key_idx < BRCMF_MAX_DEFAULT_KEYS; key_idx++) {
+                key = &ifp->vif->profile.key[key_idx];
+                if ((key->algo == CRYPTO_ALGO_WEP1) ||
+                    (key->algo == CRYPTO_ALGO_WEP128))
+                        break;
+        }
+        if (key_idx == BRCMF_MAX_DEFAULT_KEYS)
+                return;
+
+        err = send_key_to_dongle(ifp, key);
+        if (err) {
+                brcmf_err("Setting WEP key failed (%d)\n", err);
+                return;
+        }
+        err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
+        if (err) {
+                brcmf_err("get wsec error (%d)\n", err);
+                return;
+        }
+        wsec |= WEP_ENABLED;
+        err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
+        if (err)
+                brcmf_err("set wsec error (%d)\n", err);
+}
+
 static s32
 brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
                            const u8 *mac, struct station_info *sinfo)
@@ -3695,17 +3737,12 @@ static u32
 brcmf_vndr_ie(u8 *iebuf, s32 pktflag, u8 *ie_ptr, u32 ie_len, s8 *add_del_cmd)
 {
 
-        __le32 iecount_le;
-        __le32 pktflag_le;
-
         strncpy(iebuf, add_del_cmd, VNDR_IE_CMD_LEN - 1);
         iebuf[VNDR_IE_CMD_LEN - 1] = '\0';
 
-        iecount_le = cpu_to_le32(1);
-        memcpy(&iebuf[VNDR_IE_COUNT_OFFSET], &iecount_le, sizeof(iecount_le));
+        put_unaligned_le32(1, &iebuf[VNDR_IE_COUNT_OFFSET]);
 
-        pktflag_le = cpu_to_le32(pktflag);
-        memcpy(&iebuf[VNDR_IE_PKTFLAG_OFFSET], &pktflag_le, sizeof(pktflag_le));
+        put_unaligned_le32(pktflag, &iebuf[VNDR_IE_PKTFLAG_OFFSET]);
 
         memcpy(&iebuf[VNDR_IE_VSIE_OFFSET], ie_ptr, ie_len);
 
@@ -3924,6 +3961,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
         struct brcmf_if *ifp = netdev_priv(ndev);
         const struct brcmf_tlv *ssid_ie;
+        const struct brcmf_tlv *country_ie;
         struct brcmf_ssid_le ssid_le;
         s32 err = -EPERM;
         const struct brcmf_tlv *rsn_ie;
@@ -3933,6 +3971,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
         struct brcmf_fil_bss_enable_le bss_enable;
         u16 chanspec;
         bool mbss;
+        int is_11d;
 
         brcmf_dbg(TRACE, "ctrlchn=%d, center=%d, bw=%d, beacon_interval=%d, dtim_period=%d,\n",
                   settings->chandef.chan->hw_value,
@@ -3941,10 +3980,16 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
         brcmf_dbg(TRACE, "ssid=%s(%zu), auth_type=%d, inactivity_timeout=%d\n",
                   settings->ssid, settings->ssid_len, settings->auth_type,
                   settings->inactivity_timeout);
-
         dev_role = ifp->vif->wdev.iftype;
         mbss = ifp->vif->mbss;
 
+        /* store current 11d setting */
+        brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_REGULATORY, &ifp->vif->is_11d);
+        country_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
+                                      settings->beacon.tail_len,
+                                      WLAN_EID_COUNTRY);
+        is_11d = country_ie ? 1 : 0;
+
         memset(&ssid_le, 0, sizeof(ssid_le));
         if (settings->ssid == NULL || settings->ssid_len == 0) {
                 ie_offset = DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
@@ -4010,6 +4055,14 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
                         goto exit;
                 }
 
+                if (is_11d != ifp->vif->is_11d) {
+                        err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
+                                                    is_11d);
+                        if (err < 0) {
+                                brcmf_err("Regulatory Set Error, %d\n", err);
+                                goto exit;
+                        }
+                }
                 if (settings->beacon_interval) {
                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD,
                                                     settings->beacon_interval);
@@ -4042,6 +4095,10 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
                         brcmf_err("SET INFRA error %d\n", err);
                         goto exit;
                 }
+        } else if (WARN_ON(is_11d != ifp->vif->is_11d)) {
+                /* Multiple-BSS should use same 11d configuration */
+                err = -EINVAL;
+                goto exit;
         }
         if (dev_role == NL80211_IFTYPE_AP) {
                 if ((brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) && (!mbss))
@@ -4057,6 +4114,10 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
                         brcmf_err("BRCMF_C_UP error (%d)\n", err);
                         goto exit;
                 }
+                /* On DOWN the firmware removes the WEP keys, reconfigure
+                 * them if they were set.
+                 */
+                brcmf_cfg80211_reconfigure_wep(ifp);
 
                 memset(&join_params, 0, sizeof(join_params));
                 /* join parameters starts with ssid */
@@ -4133,6 +4194,11 @@ static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
                         brcmf_err("setting INFRA mode failed %d\n", err);
                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
                         brcmf_fil_iovar_int_set(ifp, "mbss", 0);
+                err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
+                                            ifp->vif->is_11d);
+                if (err < 0)
+                        brcmf_err("restoring REGULATORY setting failed %d\n",
+                                  err);
                 /* Bring device back up so it can be used again */
                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
                 if (err < 0)
@@ -4197,6 +4263,34 @@ brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
         return err;
 }
 
+static int
+brcmf_cfg80211_change_station(struct wiphy *wiphy, struct net_device *ndev,
+                              const u8 *mac, struct station_parameters *params)
+{
+        struct brcmf_if *ifp = netdev_priv(ndev);
+        s32 err;
+
+        brcmf_dbg(TRACE, "Enter, MAC %pM, mask 0x%04x set 0x%04x\n", mac,
+                  params->sta_flags_mask, params->sta_flags_set);
+
+        /* Ignore all 00 MAC */
+        if (is_zero_ether_addr(mac))
+                return 0;
+
+        if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
+                return 0;
+
+        if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED))
+                err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_AUTHORIZE,
+                                             (void *)mac, ETH_ALEN);
+        else
+                err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_DEAUTHORIZE,
+                                             (void *)mac, ETH_ALEN);
+        if (err < 0)
+                brcmf_err("Setting SCB (de-)authorize failed, %d\n", err);
+
+        return err;
+}
 
 static void
 brcmf_cfg80211_mgmt_frame_register(struct wiphy *wiphy,
@@ -4471,6 +4565,7 @@ static struct cfg80211_ops wl_cfg80211_ops = {
         .stop_ap = brcmf_cfg80211_stop_ap,
         .change_beacon = brcmf_cfg80211_change_beacon,
         .del_station = brcmf_cfg80211_del_station,
+        .change_station = brcmf_cfg80211_change_station,
         .sched_scan_start = brcmf_cfg80211_sched_scan_start,
         .sched_scan_stop = brcmf_cfg80211_sched_scan_stop,
         .mgmt_frame_register = brcmf_cfg80211_mgmt_frame_register,
@@ -5875,6 +5970,29 @@ int brcmf_cfg80211_wait_vif_event_timeout(struct brcmf_cfg80211_info *cfg,
                                   vif_event_equals(event, action), timeout);
 }
 
+static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
+                                        struct regulatory_request *req)
+{
+        struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
+        struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
+        struct brcmf_fil_country_le ccreq;
+        int i;
+
+        brcmf_dbg(TRACE, "enter: initiator=%d, alpha=%c%c\n", req->initiator,
+                  req->alpha2[0], req->alpha2[1]);
+
+        /* ignore non-ISO3166 country codes */
+        for (i = 0; i < sizeof(req->alpha2); i++)
+                if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
+                        brcmf_err("not a ISO3166 code\n");
+                        return;
+                }
+        memset(&ccreq, 0, sizeof(ccreq));
+        ccreq.rev = cpu_to_le32(-1);
+        memcpy(ccreq.ccode, req->alpha2, sizeof(req->alpha2));
+        brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq));
+}
+
 static void brcmf_free_wiphy(struct wiphy *wiphy)
 {
         kfree(wiphy->iface_combinations);
@@ -5951,6 +6069,7 @@ struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
                 goto priv_out;
 
         brcmf_dbg(INFO, "Registering custom regulatory\n");
+        wiphy->reg_notifier = brcmf_cfg80211_reg_notifier;
         wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
         wiphy_apply_custom_regulatory(wiphy, &brcmf_regdom);
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.h b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.h
index 9e98b8d52757..d9e6d01b2b69 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.h
@@ -75,6 +75,8 @@
 
 #define BRCMF_VNDR_IE_P2PAF_SHIFT       12
 
+#define BRCMF_MAX_DEFAULT_KEYS          4
+
 
 /**
  * enum brcmf_scan_status - scan engine status
@@ -125,11 +127,13 @@ struct brcmf_cfg80211_security {
  * @ssid: ssid of associated/associating ap.
  * @bssid: bssid of joined/joining ibss.
  * @sec: security information.
+ * @key: key information
  */
 struct brcmf_cfg80211_profile {
         struct brcmf_ssid ssid;
         u8 bssid[ETH_ALEN];
         struct brcmf_cfg80211_security sec;
+        struct brcmf_wsec_key key[BRCMF_MAX_DEFAULT_KEYS];
 };
 
 /**
@@ -196,6 +200,7 @@ struct brcmf_cfg80211_vif {
         struct list_head list;
         u16 mgmt_rx_reg;
         bool mbss;
+        int is_11d;
 };
 
 /* association inform */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/chip.c b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
index ddae0b5e56ec..04d2ca0d87d6 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/chip.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
@@ -101,14 +101,7 @@
 /* ARM Cortex M3 core, ID 0x82a */
 #define BCM4329_CORE_ARM_BASE           0x18002000
 #define BCM4329_RAMSIZE                 0x48000
-
 /* bcm43143 */
-/* SDIO device core */
-#define BCM43143_CORE_BUS_BASE          0x18002000
-/* internal memory core */
-#define BCM43143_CORE_SOCRAM_BASE       0x18004000
-/* ARM Cortex M3 core, ID 0x82a */
-#define BCM43143_CORE_ARM_BASE          0x18003000
 #define BCM43143_RAMSIZE                0x70000
 
 #define CORE_SB(base, field) \
@@ -164,13 +157,6 @@ struct brcmf_core_priv {
         struct brcmf_chip_priv *chip;
 };
 
-/* ARM CR4 core specific control flag bits */
-#define ARMCR4_BCMA_IOCTL_CPUHALT       0x0020
-
-/* D11 core specific control flag bits */
-#define D11_BCMA_IOCTL_PHYCLOCKEN       0x0004
-#define D11_BCMA_IOCTL_PHYRESET         0x0008
-
 struct brcmf_chip_priv {
         struct brcmf_chip pub;
         const struct brcmf_buscore_ops *ops;
@@ -495,6 +481,7 @@ static void brcmf_chip_get_raminfo(struct brcmf_chip_priv *ci)
                 ci->pub.ramsize = 0x48000;
                 break;
         case BRCM_CC_4334_CHIP_ID:
+        case BRCM_CC_43340_CHIP_ID:
                 ci->pub.ramsize = 0x80000;
                 break;
         case BRCM_CC_4335_CHIP_ID:
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/common.c b/drivers/net/wireless/brcm80211/brcmfmac/common.c
index 1861a13e8d03..ddf05af13d44 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/common.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/common.c
@@ -25,6 +25,9 @@
 #include "fwil.h"
 #include "fwil_types.h"
 #include "tracepoint.h"
+#include "common.h"
+
+const u8 ALLFFMAC[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
 
 #define BRCMF_DEFAULT_BCN_TIMEOUT       3
 #define BRCMF_DEFAULT_SCAN_CHANNEL_TIME 40
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/common.h b/drivers/net/wireless/brcm80211/brcmfmac/common.h
new file mode 100644
index 000000000000..0d39d80cee28
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/brcmfmac/common.h
@@ -0,0 +1,20 @@
+/* Copyright (c) 2014 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef BRCMFMAC_COMMON_H
+#define BRCMFMAC_COMMON_H
+
+extern const u8 ALLFFMAC[ETH_ALEN];
+
+#endif /* BRCMFMAC_COMMON_H */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/core.c b/drivers/net/wireless/brcm80211/brcmfmac/core.c
index effe6d7831d9..e2a9e33f71ab 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
@@ -1093,9 +1093,8 @@ static int brcmf_get_pend_8021x_cnt(struct brcmf_if *ifp)
         return atomic_read(&ifp->pend_8021x_cnt);
 }
 
-int brcmf_netdev_wait_pend8021x(struct net_device *ndev)
+int brcmf_netdev_wait_pend8021x(struct brcmf_if *ifp)
 {
-        struct brcmf_if *ifp = netdev_priv(ndev);
         int err;
 
         err = wait_event_timeout(ifp->pend_8021x_wait,
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/core.h b/drivers/net/wireless/brcm80211/brcmfmac/core.h
index 23f74b139cc8..f2f7d3d1a8ef 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/core.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.h
@@ -29,8 +29,6 @@
 /* For supporting multiple interfaces */
 #define BRCMF_MAX_IFS   16
 
-#define DOT11_MAX_DEFAULT_KEYS  4
-
 /* Small, medium and maximum buffer size for dcmd
  */
 #define BRCMF_DCMD_SMLEN        256
@@ -167,7 +165,7 @@ struct brcmf_skb_reorder_data {
         u8 *reorder;
 };
 
-int brcmf_netdev_wait_pend8021x(struct net_device *ndev);
+int brcmf_netdev_wait_pend8021x(struct brcmf_if *ifp);
 
 /* Return pointer to interface name */
 char *brcmf_ifname(struct brcmf_pub *drvr, int idx);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/flowring.c b/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
index 44f3a84d1999..910fbb561469 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
@@ -25,6 +25,7 @@
 #include "proto.h"
 #include "flowring.h"
 #include "msgbuf.h"
+#include "common.h"
 
 
 #define BRCMF_FLOWRING_HIGH             1024
@@ -34,9 +35,6 @@
 #define BRCMF_FLOWRING_HASH_AP(da, fifo, ifidx) (da[5] + fifo + ifidx * 16)
 #define BRCMF_FLOWRING_HASH_STA(fifo, ifidx) (fifo + ifidx * 16)
 
-static const u8 ALLZEROMAC[ETH_ALEN] = { 0, 0, 0, 0, 0, 0 };
-static const u8 ALLFFMAC[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
-
 static const u8 brcmf_flowring_prio2fifo[] = {
         1,
         0,
@@ -137,7 +135,7 @@ u32 brcmf_flowring_create(struct brcmf_flowring *flow, u8 da[ETH_ALEN],
         hash = flow->hash;
         for (i = 0; i < BRCMF_FLOWRING_HASHSIZE; i++) {
                 if ((hash[hash_idx].ifidx == BRCMF_FLOWRING_INVALID_IFIDX) &&
-                    (memcmp(hash[hash_idx].mac, ALLZEROMAC, ETH_ALEN) == 0)) {
+                    (is_zero_ether_addr(hash[hash_idx].mac))) {
                         found = true;
                         break;
                 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwil.h b/drivers/net/wireless/brcm80211/brcmfmac/fwil.h
index a30be683f4a1..37345e7b873d 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwil.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil.h
@@ -43,6 +43,8 @@
 #define BRCMF_C_SET_RADIO                       38
 #define BRCMF_C_GET_PHYTYPE                     39
 #define BRCMF_C_SET_KEY                         45
+#define BRCMF_C_GET_REGULATORY                  46
+#define BRCMF_C_SET_REGULATORY                  47
 #define BRCMF_C_SET_PASSIVE_SCAN                49
 #define BRCMF_C_SCAN                            50
 #define BRCMF_C_SCAN_RESULTS                    51
@@ -60,6 +62,8 @@
 #define BRCMF_C_GET_CURR_RATESET                114
 #define BRCMF_C_GET_AP                          117
 #define BRCMF_C_SET_AP                          118
+#define BRCMF_C_SET_SCB_AUTHORIZE               121
+#define BRCMF_C_SET_SCB_DEAUTHORIZE             122
 #define BRCMF_C_GET_RSSI                        127
 #define BRCMF_C_GET_WSEC                        133
 #define BRCMF_C_SET_WSEC                        134
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
index 50891c02c4c1..619669bbdb83 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
@@ -112,6 +112,7 @@
 #define BRCMF_WOWL_MAXPATTERNS          8
 #define BRCMF_WOWL_MAXPATTERNSIZE       128
 
+#define BRCMF_COUNTRY_BUF_SZ            4
 
 /* join preference types for join_pref iovar */
 enum brcmf_join_pref_types {
@@ -525,4 +526,17 @@ struct brcmf_mbss_ssid_le {
         unsigned char SSID[32];
 };
 
+/**
+ * struct brcmf_fil_country_le - country configuration structure.
+ *
+ * @country_abbrev: null-terminated country code used in the country IE.
+ * @rev: revision specifier for ccode. on set, -1 indicates unspecified.
+ * @ccode: null-terminated built-in country code.
+ */
+struct brcmf_fil_country_le {
+        char country_abbrev[BRCMF_COUNTRY_BUF_SZ];
+        __le32 rev;
+        char ccode[BRCMF_COUNTRY_BUF_SZ];
+};
+
 #endif /* FWIL_TYPES_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
index 456944a6a2db..ee147f5c706a 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
@@ -583,7 +583,7 @@ brcmf_msgbuf_flowring_create_worker(struct brcmf_msgbuf *msgbuf,
         u32 flowid;
         void *dma_buf;
         u32 dma_sz;
-        long long address;
+        u64 address;
         int err;
 
         flowid = work->flowid;
@@ -620,7 +620,7 @@ brcmf_msgbuf_flowring_create_worker(struct brcmf_msgbuf *msgbuf,
                                            BRCMF_NROF_H2D_COMMON_MSGRINGS);
         memcpy(create->sa, work->sa, ETH_ALEN);
         memcpy(create->da, work->da, ETH_ALEN);
-        address = (long long)(long)msgbuf->flowring_dma_handle[flowid];
+        address = (u64)msgbuf->flowring_dma_handle[flowid];
         create->flow_ring_addr.high_addr = cpu_to_le32(address >> 32);
         create->flow_ring_addr.low_addr = cpu_to_le32(address & 0xffffffff);
         create->max_items = cpu_to_le16(BRCMF_H2D_TXFLOWRING_MAX_ITEM);
@@ -698,7 +698,7 @@ static void brcmf_msgbuf_txflow(struct brcmf_msgbuf *msgbuf, u8 flowid)
         dma_addr_t physaddr;
         u32 pktid;
         struct msgbuf_tx_msghdr *tx_msghdr;
-        long long address;
+        u64 address;
 
         commonring = msgbuf->flowrings[flowid];
         if (!brcmf_commonring_write_available(commonring))
@@ -742,7 +742,7 @@ static void brcmf_msgbuf_txflow(struct brcmf_msgbuf *msgbuf, u8 flowid)
                 tx_msghdr->seg_cnt = 1;
                 memcpy(tx_msghdr->txhdr, skb->data, ETH_HLEN);
                 tx_msghdr->data_len = cpu_to_le16(skb->len - ETH_HLEN);
-                address = (long long)(long)physaddr;
+                address = (u64)physaddr;
                 tx_msghdr->data_buf_addr.high_addr = cpu_to_le32(address >> 32);
                 tx_msghdr->data_buf_addr.low_addr =
                         cpu_to_le32(address & 0xffffffff);
@@ -885,7 +885,7 @@ static u32 brcmf_msgbuf_rxbuf_data_post(struct brcmf_msgbuf *msgbuf, u32 count)
         u32 pktlen;
         dma_addr_t physaddr;
         struct msgbuf_rx_bufpost *rx_bufpost;
-        long long address;
+        u64 address;
         u32 pktid;
         u32 i;
 
@@ -894,7 +894,7 @@ static u32 brcmf_msgbuf_rxbuf_data_post(struct brcmf_msgbuf *msgbuf, u32 count)
                                                               count,
                                                               &alloced);
         if (!ret_ptr) {
-                brcmf_err("Failed to reserve space in commonring\n");
+                brcmf_dbg(MSGBUF, "Failed to reserve space in commonring\n");
                 return 0;
         }
 
@@ -921,7 +921,7 @@ static u32 brcmf_msgbuf_rxbuf_data_post(struct brcmf_msgbuf *msgbuf, u32 count)
                 }
 
                 if (msgbuf->rx_metadata_offset) {
-                        address = (long long)(long)physaddr;
+                        address = (u64)physaddr;
                         rx_bufpost->metadata_buf_len =
                                 cpu_to_le16(msgbuf->rx_metadata_offset);
                         rx_bufpost->metadata_buf_addr.high_addr =
@@ -936,7 +936,7 @@ static u32 brcmf_msgbuf_rxbuf_data_post(struct brcmf_msgbuf *msgbuf, u32 count)
                 rx_bufpost->msg.msgtype = MSGBUF_TYPE_RXBUF_POST;
                 rx_bufpost->msg.request_id = cpu_to_le32(pktid);
 
-                address = (long long)(long)physaddr;
+                address = (u64)physaddr;
                 rx_bufpost->data_buf_len = cpu_to_le16((u16)pktlen);
                 rx_bufpost->data_buf_addr.high_addr =
                         cpu_to_le32(address >> 32);
@@ -992,7 +992,7 @@ brcmf_msgbuf_rxbuf_ctrl_post(struct brcmf_msgbuf *msgbuf, bool event_buf,
         u32 pktlen;
         dma_addr_t physaddr;
         struct msgbuf_rx_ioctl_resp_or_event *rx_bufpost;
-        long long address;
+        u64 address;
         u32 pktid;
         u32 i;
 
@@ -1035,7 +1035,7 @@ brcmf_msgbuf_rxbuf_ctrl_post(struct brcmf_msgbuf *msgbuf, bool event_buf,
                                 MSGBUF_TYPE_IOCTLRESP_BUF_POST;
                 rx_bufpost->msg.request_id = cpu_to_le32(pktid);
 
-                address = (long long)(long)physaddr;
+                address = (u64)physaddr;
                 rx_bufpost->host_buf_len = cpu_to_le16((u16)pktlen);
                 rx_bufpost->host_buf_addr.high_addr =
                         cpu_to_le32(address >> 32);
@@ -1348,7 +1348,7 @@ int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)
 {
         struct brcmf_bus_msgbuf *if_msgbuf;
         struct brcmf_msgbuf *msgbuf;
-        long long address;
+        u64 address;
         u32 count;
 
         if_msgbuf = drvr->bus_if->msgbuf;
@@ -1379,7 +1379,7 @@ int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)
                                              GFP_KERNEL);
         if (!msgbuf->ioctbuf)
                 goto fail;
-        address = (long long)(long)msgbuf->ioctbuf_handle;
+        address = (u64)msgbuf->ioctbuf_handle;
         msgbuf->ioctbuf_phys_hi = address >> 32;
         msgbuf->ioctbuf_phys_lo = address & 0xffffffff;
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
index 905991fdb7b1..e91fa9a2c885 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
@@ -959,14 +959,14 @@ brcmf_pcie_init_dmabuffer_for_device(struct brcmf_pciedev_info *devinfo,
                                      dma_addr_t *dma_handle)
 {
         void *ring;
-        long long address;
+        u64 address;
 
         ring = dma_alloc_coherent(&devinfo->pdev->dev, size, dma_handle,
                                   GFP_KERNEL);
         if (!ring)
                 return NULL;
 
-        address = (long long)(long)*dma_handle;
+        address = (u64)*dma_handle;
         brcmf_pcie_write_tcm32(devinfo, tcm_dma_phys_addr,
                                address & 0xffffffff);
         brcmf_pcie_write_tcm32(devinfo, tcm_dma_phys_addr + 4, address >> 32);
@@ -1166,7 +1166,7 @@ brcmf_pcie_release_scratchbuffers(struct brcmf_pciedev_info *devinfo)
 
 static int brcmf_pcie_init_scratchbuffers(struct brcmf_pciedev_info *devinfo)
 {
-        long long address;
+        u64 address;
         u32 addr;
 
         devinfo->shared.scratch = dma_alloc_coherent(&devinfo->pdev->dev,
@@ -1180,7 +1180,7 @@ static int brcmf_pcie_init_scratchbuffers(struct brcmf_pciedev_info *devinfo)
 
         addr = devinfo->shared.tcm_base_address +
                BRCMF_SHARED_DMA_SCRATCH_ADDR_OFFSET;
-        address = (long long)(long)devinfo->shared.scratch_dmahandle;
+        address = (u64)devinfo->shared.scratch_dmahandle;
         brcmf_pcie_write_tcm32(devinfo, addr, address & 0xffffffff);
         brcmf_pcie_write_tcm32(devinfo, addr + 4, address >> 32);
         addr = devinfo->shared.tcm_base_address +
@@ -1198,7 +1198,7 @@ static int brcmf_pcie_init_scratchbuffers(struct brcmf_pciedev_info *devinfo)
 
         addr = devinfo->shared.tcm_base_address +
                BRCMF_SHARED_DMA_RINGUPD_ADDR_OFFSET;
-        address = (long long)(long)devinfo->shared.ringupd_dmahandle;
+        address = (u64)devinfo->shared.ringupd_dmahandle;
         brcmf_pcie_write_tcm32(devinfo, addr, address & 0xffffffff);
         brcmf_pcie_write_tcm32(devinfo, addr + 4, address >> 32);
         addr = devinfo->shared.tcm_base_address +
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
index 0b0d51a61060..99a37765888d 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
@@ -608,6 +608,8 @@ static const struct sdiod_drive_str sdiod_drvstr_tab2_3v3[] = {
 #define BCM4330_NVRAM_NAME              "brcm/brcmfmac4330-sdio.txt"
 #define BCM4334_FIRMWARE_NAME           "brcm/brcmfmac4334-sdio.bin"
 #define BCM4334_NVRAM_NAME              "brcm/brcmfmac4334-sdio.txt"
+#define BCM43340_FIRMWARE_NAME          "brcm/brcmfmac43340-sdio.bin"
+#define BCM43340_NVRAM_NAME             "brcm/brcmfmac43340-sdio.txt"
 #define BCM4335_FIRMWARE_NAME           "brcm/brcmfmac4335-sdio.bin"
 #define BCM4335_NVRAM_NAME              "brcm/brcmfmac4335-sdio.txt"
 #define BCM43362_FIRMWARE_NAME          "brcm/brcmfmac43362-sdio.bin"
@@ -629,6 +631,8 @@ MODULE_FIRMWARE(BCM4330_FIRMWARE_NAME);
 MODULE_FIRMWARE(BCM4330_NVRAM_NAME);
 MODULE_FIRMWARE(BCM4334_FIRMWARE_NAME);
 MODULE_FIRMWARE(BCM4334_NVRAM_NAME);
+MODULE_FIRMWARE(BCM43340_FIRMWARE_NAME);
+MODULE_FIRMWARE(BCM43340_NVRAM_NAME);
 MODULE_FIRMWARE(BCM4335_FIRMWARE_NAME);
 MODULE_FIRMWARE(BCM4335_NVRAM_NAME);
 MODULE_FIRMWARE(BCM43362_FIRMWARE_NAME);
@@ -660,6 +664,7 @@ static const struct brcmf_firmware_names brcmf_fwname_data[] = {
         { BRCM_CC_4329_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4329) },
         { BRCM_CC_4330_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4330) },
         { BRCM_CC_4334_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4334) },
+        { BRCM_CC_43340_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM43340) },
         { BRCM_CC_4335_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4335) },
         { BRCM_CC_43362_CHIP_ID, 0xFFFFFFFE, BRCMF_FIRMWARE_NVRAM(BCM43362) },
         { BRCM_CC_4339_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4339) },
@@ -3811,7 +3816,7 @@ static u32 brcmf_sdio_buscore_read32(void *ctx, u32 addr)
         u32 val, rev;
 
         val = brcmf_sdiod_regrl(sdiodev, addr, NULL);
-        if (sdiodev->func[0]->device == BRCM_SDIO_4335_4339_DEVICE_ID &&
+        if (sdiodev->func[0]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339 &&
             addr == CORE_CC_REG(SI_ENUM_BASE, chipid)) {
                 rev = (val & CID_REV_MASK) >> CID_REV_SHIFT;
                 if (rev >= 2) {
diff --git a/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h b/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
index 6996fcc144cf..2124a17d0bfd 100644
--- a/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
+++ b/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
@@ -22,7 +22,6 @@
 
 #define BRCM_USB_VENDOR_ID_BROADCOM     0x0a5c
 #define BRCM_PCIE_VENDOR_ID_BROADCOM    PCI_VENDOR_ID_BROADCOM
-#define BRCM_SDIO_VENDOR_ID_BROADCOM    SDIO_VENDOR_ID_BROADCOM
 
 /* Chipcommon Core Chip IDs */
 #define BRCM_CC_43143_CHIP_ID           43143
@@ -34,6 +33,7 @@
 #define BRCM_CC_4329_CHIP_ID            0x4329
 #define BRCM_CC_4330_CHIP_ID            0x4330
 #define BRCM_CC_4334_CHIP_ID            0x4334
+#define BRCM_CC_43340_CHIP_ID           43340
 #define BRCM_CC_43362_CHIP_ID           43362
 #define BRCM_CC_4335_CHIP_ID            0x4335
 #define BRCM_CC_4339_CHIP_ID            0x4339
@@ -45,16 +45,6 @@
 #define BRCM_CC_43570_CHIP_ID           43570
 #define BRCM_CC_43602_CHIP_ID           43602
 
-/* SDIO Device IDs */
-#define BRCM_SDIO_43143_DEVICE_ID       BRCM_CC_43143_CHIP_ID
-#define BRCM_SDIO_43241_DEVICE_ID       BRCM_CC_43241_CHIP_ID
-#define BRCM_SDIO_4329_DEVICE_ID        BRCM_CC_4329_CHIP_ID
-#define BRCM_SDIO_4330_DEVICE_ID        BRCM_CC_4330_CHIP_ID
-#define BRCM_SDIO_4334_DEVICE_ID        BRCM_CC_4334_CHIP_ID
-#define BRCM_SDIO_43362_DEVICE_ID       BRCM_CC_43362_CHIP_ID
-#define BRCM_SDIO_4335_4339_DEVICE_ID   BRCM_CC_4335_CHIP_ID
-#define BRCM_SDIO_4354_DEVICE_ID        BRCM_CC_4354_CHIP_ID
-
 /* USB Device IDs */
 #define BRCM_USB_43143_DEVICE_ID        0xbd1e
 #define BRCM_USB_43236_DEVICE_ID        0xbd17
diff --git a/drivers/net/wireless/cw1200/main.c b/drivers/net/wireless/cw1200/main.c
index 0da6e423da63..3689dbbd10bd 100644
--- a/drivers/net/wireless/cw1200/main.c
+++ b/drivers/net/wireless/cw1200/main.c
@@ -373,9 +373,8 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr,
         INIT_WORK(&priv->update_filtering_work, cw1200_update_filtering_work);
         INIT_WORK(&priv->set_beacon_wakeup_period_work,
                   cw1200_set_beacon_wakeup_period_work);
-        init_timer(&priv->mcast_timeout);
-        priv->mcast_timeout.data = (unsigned long)priv;
-        priv->mcast_timeout.function = cw1200_mcast_timeout;
+        setup_timer(&priv->mcast_timeout, cw1200_mcast_timeout,
+                    (unsigned long)priv);
 
         if (cw1200_queue_stats_init(&priv->tx_queue_stats,
                                     CW1200_LINK_ID_MAX,
diff --git a/drivers/net/wireless/cw1200/pm.c b/drivers/net/wireless/cw1200/pm.c
index 6907c8fd4578..d2202ae92bdd 100644
--- a/drivers/net/wireless/cw1200/pm.c
+++ b/drivers/net/wireless/cw1200/pm.c
@@ -101,9 +101,8 @@ int cw1200_pm_init(struct cw1200_pm_state *pm,
 {
         spin_lock_init(&pm->lock);
 
-        init_timer(&pm->stay_awake);
-        pm->stay_awake.data = (unsigned long)pm;
-        pm->stay_awake.function = cw1200_pm_stay_awake_tmo;
+        setup_timer(&pm->stay_awake, cw1200_pm_stay_awake_tmo,
+                    (unsigned long)pm);
 
         return 0;
 }
diff --git a/drivers/net/wireless/cw1200/queue.c b/drivers/net/wireless/cw1200/queue.c
index 9c3925f58d79..0ba5ef9b3e7b 100644
--- a/drivers/net/wireless/cw1200/queue.c
+++ b/drivers/net/wireless/cw1200/queue.c
@@ -179,9 +179,7 @@ int cw1200_queue_init(struct cw1200_queue *queue,
         INIT_LIST_HEAD(&queue->pending);
         INIT_LIST_HEAD(&queue->free_pool);
         spin_lock_init(&queue->lock);
-        init_timer(&queue->gc);
-        queue->gc.data = (unsigned long)queue;
-        queue->gc.function = cw1200_queue_gc;
+        setup_timer(&queue->gc, cw1200_queue_gc, (unsigned long)queue);
 
         queue->pool = kzalloc(sizeof(struct cw1200_queue_item) * capacity,
                         GFP_KERNEL);
diff --git a/drivers/net/wireless/iwlegacy/3945-mac.c b/drivers/net/wireless/iwlegacy/3945-mac.c
index dc1d20cf64ee..e5665804d986 100644
--- a/drivers/net/wireless/iwlegacy/3945-mac.c
+++ b/drivers/net/wireless/iwlegacy/3945-mac.c
@@ -3429,9 +3429,7 @@ il3945_setup_deferred_work(struct il_priv *il)
 
         il3945_hw_setup_deferred_work(il);
 
-        init_timer(&il->watchdog);
-        il->watchdog.data = (unsigned long)il;
-        il->watchdog.function = il_bg_watchdog;
+        setup_timer(&il->watchdog, il_bg_watchdog, (unsigned long)il);
 
         tasklet_init(&il->irq_tasklet,
                      (void (*)(unsigned long))il3945_irq_tasklet,
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
index 2748fde4b90c..976f65fe9c38 100644
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
@@ -6247,13 +6247,10 @@ il4965_setup_deferred_work(struct il_priv *il)
 
         INIT_WORK(&il->txpower_work, il4965_bg_txpower_work);
 
-        init_timer(&il->stats_periodic);
-        il->stats_periodic.data = (unsigned long)il;
-        il->stats_periodic.function = il4965_bg_stats_periodic;
+        setup_timer(&il->stats_periodic, il4965_bg_stats_periodic,
+                    (unsigned long)il);
 
-        init_timer(&il->watchdog);
-        il->watchdog.data = (unsigned long)il;
-        il->watchdog.function = il_bg_watchdog;
+        setup_timer(&il->watchdog, il_bg_watchdog, (unsigned long)il);
 
         tasklet_init(&il->irq_tasklet,
                      (void (*)(unsigned long))il4965_irq_tasklet,
diff --git a/drivers/net/wireless/iwlwifi/dvm/main.c b/drivers/net/wireless/iwlwifi/dvm/main.c
index 0b7f46f0b079..de43dd7e170a 100644
--- a/drivers/net/wireless/iwlwifi/dvm/main.c
+++ b/drivers/net/wireless/iwlwifi/dvm/main.c
@@ -64,22 +64,8 @@
  *
  ******************************************************************************/
 
-/*
- * module name, copyright, version, etc.
- */
 #define DRV_DESCRIPTION "Intel(R) Wireless WiFi Link AGN driver for Linux"
-
-#ifdef CONFIG_IWLWIFI_DEBUG
-#define VD "d"
-#else
-#define VD
-#endif
-
-#define DRV_VERSION     IWLWIFI_VERSION VD
-
-
 MODULE_DESCRIPTION(DRV_DESCRIPTION);
-MODULE_VERSION(DRV_VERSION);
 MODULE_AUTHOR(DRV_COPYRIGHT " " DRV_AUTHOR);
 MODULE_LICENSE("GPL");
 
@@ -1011,13 +997,11 @@ static void iwl_setup_deferred_work(struct iwl_priv *priv)
         if (priv->lib->bt_params)
                 iwlagn_bt_setup_deferred_work(priv);
 
-        init_timer(&priv->statistics_periodic);
-        priv->statistics_periodic.data = (unsigned long)priv;
-        priv->statistics_periodic.function = iwl_bg_statistics_periodic;
+        setup_timer(&priv->statistics_periodic, iwl_bg_statistics_periodic,
+                    (unsigned long)priv);
 
-        init_timer(&priv->ucode_trace);
-        priv->ucode_trace.data = (unsigned long)priv;
-        priv->ucode_trace.function = iwl_bg_ucode_trace;
+        setup_timer(&priv->ucode_trace, iwl_bg_ucode_trace,
+                    (unsigned long)priv);
 }
 
 void iwl_cancel_deferred_work(struct iwl_priv *priv)
diff --git a/drivers/net/wireless/iwlwifi/dvm/tt.c b/drivers/net/wireless/iwlwifi/dvm/tt.c
index acb981a0a0aa..c4736c8834c5 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tt.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tt.c
@@ -612,15 +612,10 @@ void iwl_tt_initialize(struct iwl_priv *priv)
         memset(tt, 0, sizeof(struct iwl_tt_mgmt));
 
         tt->state = IWL_TI_0;
-        init_timer(&priv->thermal_throttle.ct_kill_exit_tm);
-        priv->thermal_throttle.ct_kill_exit_tm.data = (unsigned long)priv;
-        priv->thermal_throttle.ct_kill_exit_tm.function =
-                iwl_tt_check_exit_ct_kill;
-        init_timer(&priv->thermal_throttle.ct_kill_waiting_tm);
-        priv->thermal_throttle.ct_kill_waiting_tm.data =
-                (unsigned long)priv;
-        priv->thermal_throttle.ct_kill_waiting_tm.function =
-                iwl_tt_ready_for_ct_kill;
+        setup_timer(&priv->thermal_throttle.ct_kill_exit_tm,
+                    iwl_tt_check_exit_ct_kill, (unsigned long)priv);
+        setup_timer(&priv->thermal_throttle.ct_kill_waiting_tm,
+                    iwl_tt_ready_for_ct_kill, (unsigned long)priv);
         /* setup deferred ct kill work */
         INIT_WORK(&priv->tt_work, iwl_bg_tt_work);
         INIT_WORK(&priv->ct_enter, iwl_bg_ct_enter);
diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c
index a5f9198d5747..97e38d2e2983 100644
--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
@@ -92,6 +92,12 @@
 #define IWL7265D_NVM_VERSION            0x0c11
 #define IWL7265_TX_POWER_VERSION        0xffff /* meaningless */
 
+/* DCCM offsets and lengths */
+#define IWL7000_DCCM_OFFSET             0x800000
+#define IWL7260_DCCM_LEN                0x14000
+#define IWL3160_DCCM_LEN                0x10000
+#define IWL7265_DCCM_LEN                0x17A00
+
 #define IWL7260_FW_PRE "iwlwifi-7260-"
 #define IWL7260_MODULE_FIRMWARE(api) IWL7260_FW_PRE __stringify(api) ".ucode"
 
@@ -138,7 +144,8 @@ static const struct iwl_ht_params iwl7000_ht_params = {
         .led_mode = IWL_LED_RF_STATE,                           \
         .nvm_hw_section_num = NVM_HW_SECTION_NUM_FAMILY_7000,   \
         .non_shared_ant = ANT_A,                                \
-        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,    \
+        .dccm_offset = IWL7000_DCCM_OFFSET
 
 const struct iwl_cfg iwl7260_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 7260",
@@ -149,6 +156,7 @@ const struct iwl_cfg iwl7260_2ac_cfg = {
         .nvm_calib_ver = IWL7260_TX_POWER_VERSION,
         .host_interrupt_operation_mode = true,
         .lp_xtal_workaround = true,
+        .dccm_len = IWL7260_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl7260_2ac_cfg_high_temp = {
@@ -161,6 +169,7 @@ const struct iwl_cfg iwl7260_2ac_cfg_high_temp = {
         .high_temp = true,
         .host_interrupt_operation_mode = true,
         .lp_xtal_workaround = true,
+        .dccm_len = IWL7260_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl7260_2n_cfg = {
@@ -172,6 +181,7 @@ const struct iwl_cfg iwl7260_2n_cfg = {
         .nvm_calib_ver = IWL7260_TX_POWER_VERSION,
         .host_interrupt_operation_mode = true,
         .lp_xtal_workaround = true,
+        .dccm_len = IWL7260_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl7260_n_cfg = {
@@ -183,6 +193,7 @@ const struct iwl_cfg iwl7260_n_cfg = {
         .nvm_calib_ver = IWL7260_TX_POWER_VERSION,
         .host_interrupt_operation_mode = true,
         .lp_xtal_workaround = true,
+        .dccm_len = IWL7260_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl3160_2ac_cfg = {
@@ -193,6 +204,7 @@ const struct iwl_cfg iwl3160_2ac_cfg = {
         .nvm_ver = IWL3160_NVM_VERSION,
         .nvm_calib_ver = IWL3160_TX_POWER_VERSION,
         .host_interrupt_operation_mode = true,
+        .dccm_len = IWL3160_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl3160_2n_cfg = {
@@ -203,6 +215,7 @@ const struct iwl_cfg iwl3160_2n_cfg = {
         .nvm_ver = IWL3160_NVM_VERSION,
         .nvm_calib_ver = IWL3160_TX_POWER_VERSION,
         .host_interrupt_operation_mode = true,
+        .dccm_len = IWL3160_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl3160_n_cfg = {
@@ -213,6 +226,7 @@ const struct iwl_cfg iwl3160_n_cfg = {
         .nvm_ver = IWL3160_NVM_VERSION,
         .nvm_calib_ver = IWL3160_TX_POWER_VERSION,
         .host_interrupt_operation_mode = true,
+        .dccm_len = IWL3160_DCCM_LEN,
 };
 
 static const struct iwl_pwr_tx_backoff iwl7265_pwr_tx_backoffs[] = {
@@ -240,6 +254,7 @@ const struct iwl_cfg iwl3165_2ac_cfg = {
         .nvm_ver = IWL3165_NVM_VERSION,
         .nvm_calib_ver = IWL3165_TX_POWER_VERSION,
         .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+        .dccm_len = IWL7265_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl7265_2ac_cfg = {
@@ -250,6 +265,7 @@ const struct iwl_cfg iwl7265_2ac_cfg = {
         .nvm_ver = IWL7265_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
         .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+        .dccm_len = IWL7265_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl7265_2n_cfg = {
@@ -260,6 +276,7 @@ const struct iwl_cfg iwl7265_2n_cfg = {
         .nvm_ver = IWL7265_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
         .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+        .dccm_len = IWL7265_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl7265_n_cfg = {
@@ -270,6 +287,7 @@ const struct iwl_cfg iwl7265_n_cfg = {
         .nvm_ver = IWL7265_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
         .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+        .dccm_len = IWL7265_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl7265d_2ac_cfg = {
@@ -280,6 +298,7 @@ const struct iwl_cfg iwl7265d_2ac_cfg = {
         .nvm_ver = IWL7265D_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
         .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+        .dccm_len = IWL7265_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl7265d_2n_cfg = {
@@ -290,6 +309,7 @@ const struct iwl_cfg iwl7265d_2n_cfg = {
         .nvm_ver = IWL7265D_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
         .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+        .dccm_len = IWL7265_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl7265d_n_cfg = {
@@ -300,6 +320,7 @@ const struct iwl_cfg iwl7265d_n_cfg = {
         .nvm_ver = IWL7265D_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
         .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+        .dccm_len = IWL7265_DCCM_LEN,
 };
 
 MODULE_FIRMWARE(IWL7260_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
diff --git a/drivers/net/wireless/iwlwifi/iwl-8000.c b/drivers/net/wireless/iwlwifi/iwl-8000.c
index 3668fc57e770..2f7fe8167dc9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-8000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-8000.c
@@ -81,12 +81,21 @@
 #define IWL8000_NVM_VERSION             0x0a1d
 #define IWL8000_TX_POWER_VERSION        0xffff /* meaningless */
 
+/* Memory offsets and lengths */
+#define IWL8260_DCCM_OFFSET             0x800000
+#define IWL8260_DCCM_LEN                0x18000
+#define IWL8260_DCCM2_OFFSET            0x880000
+#define IWL8260_DCCM2_LEN               0x8000
+#define IWL8260_SMEM_OFFSET             0x400000
+#define IWL8260_SMEM_LEN                0x68000
+
 #define IWL8000_FW_PRE "iwlwifi-8000"
 #define IWL8000_MODULE_FIRMWARE(api) \
         IWL8000_FW_PRE "-" __stringify(api) ".ucode"
 
 #define NVM_HW_SECTION_NUM_FAMILY_8000          10
-#define DEFAULT_NVM_FILE_FAMILY_8000            "iwl_nvm_8000.bin"
+#define DEFAULT_NVM_FILE_FAMILY_8000A           "iwl_nvm_8000.bin"
+#define DEFAULT_NVM_FILE_FAMILY_8000            "iwl_nvm_8000B.bin"
 
 /* Max SDIO RX aggregation size of the ADDBA request/response */
 #define MAX_RX_AGG_SIZE_8260_SDIO       28
@@ -124,7 +133,13 @@ static const struct iwl_ht_params iwl8000_ht_params = {
         .led_mode = IWL_LED_RF_STATE,                           \
         .nvm_hw_section_num = NVM_HW_SECTION_NUM_FAMILY_8000,   \
         .d0i3 = true,                                           \
-        .non_shared_ant = ANT_A
+        .non_shared_ant = ANT_A,                                \
+        .dccm_offset = IWL8260_DCCM_OFFSET,                     \
+        .dccm_len = IWL8260_DCCM_LEN,                           \
+        .dccm2_offset = IWL8260_DCCM2_OFFSET,                   \
+        .dccm2_len = IWL8260_DCCM2_LEN,                         \
+        .smem_offset = IWL8260_SMEM_OFFSET,                     \
+        .smem_len = IWL8260_SMEM_LEN
 
 const struct iwl_cfg iwl8260_2n_cfg = {
         .name = "Intel(R) Dual Band Wireless N 8260",
@@ -145,6 +160,16 @@ const struct iwl_cfg iwl8260_2ac_cfg = {
         .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
 };
 
+const struct iwl_cfg iwl4165_2ac_cfg = {
+        .name = "Intel(R) Dual Band Wireless AC 4165",
+        .fw_name_pre = IWL8000_FW_PRE,
+        IWL_DEVICE_8000,
+        .ht_params = &iwl8000_ht_params,
+        .nvm_ver = IWL8000_NVM_VERSION,
+        .nvm_calib_ver = IWL8000_TX_POWER_VERSION,
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+};
+
 const struct iwl_cfg iwl8260_2ac_sdio_cfg = {
         .name = "Intel(R) Dual Band Wireless-AC 8260",
         .fw_name_pre = IWL8000_FW_PRE,
@@ -153,6 +178,7 @@ const struct iwl_cfg iwl8260_2ac_sdio_cfg = {
         .nvm_ver = IWL8000_NVM_VERSION,
         .nvm_calib_ver = IWL8000_TX_POWER_VERSION,
         .default_nvm_file = DEFAULT_NVM_FILE_FAMILY_8000,
+        .default_nvm_file_8000A = DEFAULT_NVM_FILE_FAMILY_8000A,
         .max_rx_agg_size = MAX_RX_AGG_SIZE_8260_SDIO,
         .disable_dummy_notification = true,
         .max_ht_ampdu_exponent  = MAX_HT_AMPDU_EXPONENT_8260_SDIO,
@@ -167,6 +193,7 @@ const struct iwl_cfg iwl4165_2ac_sdio_cfg = {
         .nvm_ver = IWL8000_NVM_VERSION,
         .nvm_calib_ver = IWL8000_TX_POWER_VERSION,
         .default_nvm_file = DEFAULT_NVM_FILE_FAMILY_8000,
+        .default_nvm_file_8000A = DEFAULT_NVM_FILE_FAMILY_8000A,
         .max_rx_agg_size = MAX_RX_AGG_SIZE_8260_SDIO,
         .bt_shared_single_ant = true,
         .disable_dummy_notification = true,
diff --git a/drivers/net/wireless/iwlwifi/iwl-config.h b/drivers/net/wireless/iwlwifi/iwl-config.h
index 3a4b9c7fc083..445bff690a63 100644
--- a/drivers/net/wireless/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/iwlwifi/iwl-config.h
@@ -261,6 +261,12 @@ struct iwl_pwr_tx_backoff {
  *      station can receive in HT
  * @max_vht_ampdu_exponent: the exponent of the max length of A-MPDU that the
  *      station can receive in VHT
+ * @dccm_offset: offset from which DCCM begins
+ * @dccm_len: length of DCCM (including runtime stack CCM)
+ * @dccm2_offset: offset from which the second DCCM begins
+ * @dccm2_len: length of the second DCCM
+ * @smem_offset: offset from which the SMEM begins
+ * @smem_len: the length of SMEM
  *
  * We enable the driver to be backward compatible wrt. hardware features.
  * API differences in uCode shouldn't be handled here but through TLVs
@@ -298,11 +304,18 @@ struct iwl_cfg {
         const struct iwl_pwr_tx_backoff *pwr_tx_backoffs;
         bool no_power_up_nic_in_init;
         const char *default_nvm_file;
+        const char *default_nvm_file_8000A;
         unsigned int max_rx_agg_size;
         bool disable_dummy_notification;
         unsigned int max_tx_agg_size;
         unsigned int max_ht_ampdu_exponent;
         unsigned int max_vht_ampdu_exponent;
+        const u32 dccm_offset;
+        const u32 dccm_len;
+        const u32 dccm2_offset;
+        const u32 dccm2_len;
+        const u32 smem_offset;
+        const u32 smem_len;
 };
 
 /*
@@ -369,8 +382,8 @@ extern const struct iwl_cfg iwl7265d_2n_cfg;
 extern const struct iwl_cfg iwl7265d_n_cfg;
 extern const struct iwl_cfg iwl8260_2n_cfg;
 extern const struct iwl_cfg iwl8260_2ac_cfg;
+extern const struct iwl_cfg iwl4165_2ac_cfg;
 extern const struct iwl_cfg iwl8260_2ac_sdio_cfg;
-extern const struct iwl_cfg iwl4265_2ac_sdio_cfg;
 extern const struct iwl_cfg iwl4165_2ac_sdio_cfg;
 #endif /* CONFIG_IWLMVM */
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h
index aff63c3f5bf8..faa17f2e352a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/iwlwifi/iwl-csr.h
@@ -184,6 +184,7 @@
 #define CSR_HW_IF_CONFIG_REG_BIT_NIC_READY      (0x00400000) /* PCI_OWN_SEM */
 #define CSR_HW_IF_CONFIG_REG_BIT_NIC_PREPARE_DONE (0x02000000) /* ME_OWN */
 #define CSR_HW_IF_CONFIG_REG_PREPARE              (0x08000000) /* WAKE_ME */
+#define CSR_HW_IF_CONFIG_REG_ENABLE_PME           (0x10000000)
 #define CSR_HW_IF_CONFIG_REG_PERSIST_MODE         (0x40000000) /* PERSISTENCE */
 
 #define CSR_MBOX_SET_REG_OS_ALIVE               BIT(5)
@@ -306,6 +307,7 @@
 enum {
         SILICON_A_STEP = 0,
         SILICON_B_STEP,
+        SILICON_C_STEP,
 };
 
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.c b/drivers/net/wireless/iwlwifi/iwl-drv.c
index 850b85a47806..e7c0df6db6ee 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.c
@@ -84,21 +84,8 @@
  *
  ******************************************************************************/
 
-/*
- * module name, copyright, version, etc.
- */
 #define DRV_DESCRIPTION "Intel(R) Wireless WiFi driver for Linux"
-
-#ifdef CONFIG_IWLWIFI_DEBUG
-#define VD "d"
-#else
-#define VD
-#endif
-
-#define DRV_VERSION     IWLWIFI_VERSION VD
-
 MODULE_DESCRIPTION(DRV_DESCRIPTION);
-MODULE_VERSION(DRV_VERSION);
 MODULE_AUTHOR(DRV_COPYRIGHT " " DRV_AUTHOR);
 MODULE_LICENSE("GPL");
 
@@ -250,9 +237,6 @@ static int iwl_request_firmware(struct iwl_drv *drv, bool first)
         /*
          * Starting 8000B - FW name format has changed. This overwrites the
          * previous name and uses the new format.
-         *
-         * TODO:
-         * Once there is only one supported step for 8000 family - delete this!
          */
         if (drv->trans->cfg->device_family == IWL_DEVICE_FAMILY_8000) {
                 char rev_step[2] = {
@@ -263,13 +247,6 @@ static int iwl_request_firmware(struct iwl_drv *drv, bool first)
                 if (CSR_HW_REV_STEP(drv->trans->hw_rev) == SILICON_A_STEP)
                         rev_step[0] = 0;
 
-                /*
-                 * If hw_rev wasn't set yet - default as B-step. If it IS A-step
-                 * we'll reload that FW later instead.
-                 */
-                if (drv->trans->hw_rev == 0)
-                        rev_step[0] = 'B';
-
                 snprintf(drv->firmware_name, sizeof(drv->firmware_name),
                          "%s%s-%s.ucode", name_pre, rev_step, tag);
         }
@@ -926,6 +903,12 @@ static int iwl_parse_tlv_firmware(struct iwl_drv *drv,
                                             IWL_UCODE_REGULAR_USNIFFER,
                                             tlv_len);
                         break;
+                case IWL_UCODE_TLV_SDIO_ADMA_ADDR:
+                        if (tlv_len != sizeof(u32))
+                                goto invalid_tlv_len;
+                        drv->fw.sdio_adma_addr =
+                                le32_to_cpup((__le32 *)tlv_data);
+                        break;
                 default:
                         IWL_DEBUG_INFO(drv, "unknown TLV: %d\n", tlv_type);
                         break;
@@ -1082,7 +1065,6 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context)
         u32 api_ver;
         int i;
         bool load_module = false;
-        u32 hw_rev = drv->trans->hw_rev;
 
         fw->ucode_capa.max_probe_length = IWL_DEFAULT_MAX_PROBE_LENGTH;
         fw->ucode_capa.standard_phy_calibration_size =
@@ -1275,50 +1257,6 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context)
                                 op->name, err);
 #endif
         }
-
-        /*
-         * We may have loaded the wrong FW file in 8000 HW family if it is an
-         * A-step card, and if drv->trans->hw_rev wasn't properly read when
-         * the FW file had been loaded. (This might happen in SDIO.) In such a
-         * case - unload and reload the correct file.
-         *
-         * TODO:
-         * Once there is only one supported step for 8000 family - delete this!
-         */
-        if (drv->trans->cfg->device_family == IWL_DEVICE_FAMILY_8000 &&
-            CSR_HW_REV_STEP(drv->trans->hw_rev) == SILICON_A_STEP &&
-            drv->trans->hw_rev != hw_rev) {
-                char firmware_name[32];
-
-                /* Free previous FW resources */
-                if (drv->op_mode)
-                        _iwl_op_mode_stop(drv);
-                iwl_dealloc_ucode(drv);
-
-                /* Build name of correct-step FW */
-                snprintf(firmware_name, sizeof(firmware_name),
-                         strrchr(drv->firmware_name, '-'));
-                snprintf(drv->firmware_name, sizeof(drv->firmware_name),
-                         "%s%s", drv->cfg->fw_name_pre, firmware_name);
-
-                /* Clear data before loading correct FW */
-                list_del(&drv->list);
-
-                /* Request correct FW file this time */
-                IWL_DEBUG_INFO(drv, "attempting to load A-step FW %s\n",
-                               drv->firmware_name);
-                err = request_firmware(&ucode_raw, drv->firmware_name,
-                                       drv->trans->dev);
-                if (err) {
-                        IWL_ERR(drv, "Failed swapping FW!\n");
-                        goto out_unbind;
-                }
-
-                /* Redo callback function - this time with right FW */
-                iwl_req_fw_callback(ucode_raw, context);
-        }
-
-        kfree(pieces);
         return;
 
  try_again:
@@ -1430,6 +1368,7 @@ struct iwl_mod_params iwlwifi_mod_params = {
         .bt_coex_active = true,
         .power_level = IWL_POWER_INDEX_1,
         .wd_disable = true,
+        .d0i3_disable = true,
 #ifndef CONFIG_IWLWIFI_UAPSD
         .uapsd_disable = true,
 #endif /* CONFIG_IWLWIFI_UAPSD */
@@ -1492,7 +1431,7 @@ static int __init iwl_drv_init(void)
         for (i = 0; i < ARRAY_SIZE(iwlwifi_opmode_table); i++)
                 INIT_LIST_HEAD(&iwlwifi_opmode_table[i].drv);
 
-        pr_info(DRV_DESCRIPTION ", " DRV_VERSION "\n");
+        pr_info(DRV_DESCRIPTION "\n");
         pr_info(DRV_COPYRIGHT "\n");
 
 #ifdef CONFIG_IWLWIFI_DEBUGFS
@@ -1546,8 +1485,12 @@ MODULE_PARM_DESC(wd_disable,
 module_param_named(nvm_file, iwlwifi_mod_params.nvm_file, charp, S_IRUGO);
 MODULE_PARM_DESC(nvm_file, "NVM file name");
 
-module_param_named(uapsd_disable, iwlwifi_mod_params.uapsd_disable,
+module_param_named(d0i3_disable, iwlwifi_mod_params.d0i3_disable,
                    bool, S_IRUGO);
+MODULE_PARM_DESC(d0i3_disable, "disable d0i3 functionality (default: Y)");
+
+module_param_named(uapsd_disable, iwlwifi_mod_params.uapsd_disable,
+                   bool, S_IRUGO | S_IWUSR);
 #ifdef CONFIG_IWLWIFI_UAPSD
 MODULE_PARM_DESC(uapsd_disable, "disable U-APSD functionality (default: N)");
 #else
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.h b/drivers/net/wireless/iwlwifi/iwl-drv.h
index be4f8972241a..adf522c756e6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.h
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.h
@@ -68,7 +68,6 @@
 
 /* for all modules */
 #define DRV_NAME        "iwlwifi"
-#define IWLWIFI_VERSION "in-tree:"
 #define DRV_COPYRIGHT   "Copyright(c) 2003- 2014 Intel Corporation"
 #define DRV_AUTHOR     "<ilw@linux.intel.com>"
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw-error-dump.h b/drivers/net/wireless/iwlwifi/iwl-fw-error-dump.h
index 20a8a64c9fe3..919a2548a92c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw-error-dump.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw-error-dump.h
@@ -71,7 +71,6 @@
 
 /**
  * enum iwl_fw_error_dump_type - types of data in the dump file
- * @IWL_FW_ERROR_DUMP_SRAM:
  * @IWL_FW_ERROR_DUMP_CSR: Control Status Registers - from offset 0
  * @IWL_FW_ERROR_DUMP_RXF:
  * @IWL_FW_ERROR_DUMP_TXCMD: last TX command data, structured as
@@ -82,9 +81,10 @@
  * @IWL_FW_ERROR_DUMP_PRPH: range of periphery registers - there can be several
  *      sections like this in a single file.
  * @IWL_FW_ERROR_DUMP_FH_REGS: range of FH registers
+ * @IWL_FW_ERROR_DUMP_MEM: chunk of memory
  */
 enum iwl_fw_error_dump_type {
-        IWL_FW_ERROR_DUMP_SRAM = 0,
+        /* 0 is deprecated */
         IWL_FW_ERROR_DUMP_CSR = 1,
         IWL_FW_ERROR_DUMP_RXF = 2,
         IWL_FW_ERROR_DUMP_TXCMD = 3,
@@ -93,6 +93,7 @@ enum iwl_fw_error_dump_type {
         IWL_FW_ERROR_DUMP_PRPH = 6,
         IWL_FW_ERROR_DUMP_TXF = 7,
         IWL_FW_ERROR_DUMP_FH_REGS = 8,
+        IWL_FW_ERROR_DUMP_MEM = 9,
 
         IWL_FW_ERROR_DUMP_MAX,
 };
@@ -133,6 +134,27 @@ struct iwl_fw_error_dump_txcmd {
         u8 data[];
 } __packed;
 
+/**
+ * struct iwl_fw_error_dump_fifo - RX/TX FIFO data
+ * @fifo_num: number of FIFO (starting from 0)
+ * @available_bytes: num of bytes available in FIFO (may be less than FIFO size)
+ * @wr_ptr: position of write pointer
+ * @rd_ptr: position of read pointer
+ * @fence_ptr: position of fence pointer
+ * @fence_mode: the current mode of the fence (before locking) -
+ *      0=follow RD pointer ; 1 = freeze
+ * @data: all of the FIFO's data
+ */
+struct iwl_fw_error_dump_fifo {
+        __le32 fifo_num;
+        __le32 available_bytes;
+        __le32 wr_ptr;
+        __le32 rd_ptr;
+        __le32 fence_ptr;
+        __le32 fence_mode;
+        u8 data[];
+} __packed;
+
 enum iwl_fw_error_dump_family {
         IWL_FW_ERROR_DUMP_FAMILY_7 = 7,
         IWL_FW_ERROR_DUMP_FAMILY_8 = 8,
@@ -180,6 +202,23 @@ struct iwl_fw_error_dump_prph {
         __le32 data[];
 };
 
+enum iwl_fw_error_dump_mem_type {
+        IWL_FW_ERROR_DUMP_MEM_SRAM,
+        IWL_FW_ERROR_DUMP_MEM_SMEM,
+};
+
+/**
+ * struct iwl_fw_error_dump_mem - chunk of memory
+ * @type: %enum iwl_fw_error_dump_mem_type
+ * @offset: the offset from which the memory was read
+ * @data: the content of the memory
+ */
+struct iwl_fw_error_dump_mem {
+        __le32 type;
+        __le32 offset;
+        u8 data[];
+};
+
 /**
  * iwl_fw_error_next_data - advance fw error dump data pointer
  * @data: previous data block
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw-file.h b/drivers/net/wireless/iwlwifi/iwl-fw-file.h
index 1bbe4fc47b97..e4f589898eda 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw-file.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw-file.h
@@ -132,6 +132,7 @@ enum iwl_ucode_tlv_type {
         IWL_UCODE_TLV_ENABLED_CAPABILITIES      = 30,
         IWL_UCODE_TLV_N_SCAN_CHANNELS           = 31,
         IWL_UCODE_TLV_SEC_RT_USNIFFER   = 34,
+        IWL_UCODE_TLV_SDIO_ADMA_ADDR    = 35,
         IWL_UCODE_TLV_FW_DBG_DEST       = 38,
         IWL_UCODE_TLV_FW_DBG_CONF       = 39,
 };
@@ -234,29 +235,34 @@ enum iwl_ucode_tlv_flag {
 
 /**
  * enum iwl_ucode_tlv_api - ucode api
- * @IWL_UCODE_TLV_API_WOWLAN_CONFIG_TID: wowlan config includes tid field.
- * @IWL_UCODE_TLV_CAPA_EXTENDED_BEACON: Support Extended beacon notification
  * @IWL_UCODE_TLV_API_BT_COEX_SPLIT: new API for BT Coex
- * @IWL_UCODE_TLV_API_CSA_FLOW: ucode can do unbind-bind flow for CSA.
  * @IWL_UCODE_TLV_API_DISABLE_STA_TX: ucode supports tx_disable bit.
  * @IWL_UCODE_TLV_API_LMAC_SCAN: This ucode uses LMAC unified scan API.
  * @IWL_UCODE_TLV_API_SF_NO_DUMMY_NOTIF: ucode supports disabling dummy notif.
  * @IWL_UCODE_TLV_API_FRAGMENTED_SCAN: This ucode supports active dwell time
  *      longer than the passive one, which is essential for fragmented scan.
+ * IWL_UCODE_TLV_API_HDC_PHASE_0: ucode supports finer configuration of LTR
  * @IWL_UCODE_TLV_API_BASIC_DWELL: use only basic dwell time in scan command,
  *      regardless of the band or the number of the probes. FW will calculate
  *      the actual dwell time.
+ * @IWL_UCODE_TLV_API_SCD_CFG: This firmware can configure the scheduler
+ *      through the dedicated host command.
+ * @IWL_UCODE_TLV_API_SINGLE_SCAN_EBS: EBS is supported for single scans too.
+ * @IWL_UCODE_TLV_API_ASYNC_DTM: Async temperature notifications are supported.
+ * @IWL_UCODE_TLV_API_LQ_SS_PARAMS: Configure STBC/BFER via LQ CMD ss_params
  */
 enum iwl_ucode_tlv_api {
-        IWL_UCODE_TLV_API_WOWLAN_CONFIG_TID     = BIT(0),
-        IWL_UCODE_TLV_CAPA_EXTENDED_BEACON      = BIT(1),
         IWL_UCODE_TLV_API_BT_COEX_SPLIT         = BIT(3),
-        IWL_UCODE_TLV_API_CSA_FLOW              = BIT(4),
         IWL_UCODE_TLV_API_DISABLE_STA_TX        = BIT(5),
         IWL_UCODE_TLV_API_LMAC_SCAN             = BIT(6),
         IWL_UCODE_TLV_API_SF_NO_DUMMY_NOTIF     = BIT(7),
         IWL_UCODE_TLV_API_FRAGMENTED_SCAN       = BIT(8),
+        IWL_UCODE_TLV_API_HDC_PHASE_0           = BIT(10),
         IWL_UCODE_TLV_API_BASIC_DWELL           = BIT(13),
+        IWL_UCODE_TLV_API_SCD_CFG               = BIT(15),
+        IWL_UCODE_TLV_API_SINGLE_SCAN_EBS       = BIT(16),
+        IWL_UCODE_TLV_API_ASYNC_DTM             = BIT(17),
+        IWL_UCODE_TLV_API_LQ_SS_PARAMS          = BIT(18),
 };
 
 /**
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw.h b/drivers/net/wireless/iwlwifi/iwl-fw.h
index e6dc3b870949..ffd785cc67d6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw.h
@@ -152,6 +152,8 @@ struct iwl_fw_cscheme_list {
  * @mvm_fw: indicates this is MVM firmware
  * @cipher_scheme: optional external cipher scheme.
  * @human_readable: human readable version
+ * @sdio_adma_addr: the default address to set for the ADMA in SDIO mode until
+ *      we get the ALIVE from the uCode
  * @dbg_dest_tlv: points to the destination TLV for debug
  * @dbg_conf_tlv: array of pointers to configuration TLVs for debug
  * @dbg_conf_tlv_len: lengths of the @dbg_conf_tlv entries
@@ -181,6 +183,8 @@ struct iwl_fw {
         struct ieee80211_cipher_scheme cs[IWL_UCODE_MAX_CS];
         u8 human_readable[FW_VER_HUMAN_READABLE_SZ];
 
+        u32 sdio_adma_addr;
+
         struct iwl_fw_dbg_dest_tlv *dbg_dest_tlv;
         struct iwl_fw_dbg_conf_tlv *dbg_conf_tlv[FW_DBG_MAX];
         size_t dbg_conf_tlv_len[FW_DBG_MAX];
diff --git a/drivers/net/wireless/iwlwifi/iwl-io.c b/drivers/net/wireless/iwlwifi/iwl-io.c
index 7a2cbf6f90db..03250a45272e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-io.c
+++ b/drivers/net/wireless/iwlwifi/iwl-io.c
@@ -193,11 +193,15 @@ void iwl_force_nmi(struct iwl_trans *trans)
          * DEVICE_SET_NMI_8000B_REG - is used.
          */
         if ((trans->cfg->device_family != IWL_DEVICE_FAMILY_8000) ||
-            (CSR_HW_REV_STEP(trans->hw_rev) == SILICON_A_STEP))
-                iwl_write_prph(trans, DEVICE_SET_NMI_REG, DEVICE_SET_NMI_VAL);
-        else
+            (CSR_HW_REV_STEP(trans->hw_rev) == SILICON_A_STEP)) {
+                iwl_write_prph(trans, DEVICE_SET_NMI_REG,
+                               DEVICE_SET_NMI_VAL_DRV);
+                iwl_write_prph(trans, DEVICE_SET_NMI_REG,
+                               DEVICE_SET_NMI_VAL_HW);
+        } else {
                 iwl_write_prph(trans, DEVICE_SET_NMI_8000B_REG,
                                DEVICE_SET_NMI_8000B_VAL);
+        }
 }
 IWL_EXPORT_SYMBOL(iwl_force_nmi);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-modparams.h b/drivers/net/wireless/iwlwifi/iwl-modparams.h
index 71507cf490e6..2a8cf4b2445c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-modparams.h
+++ b/drivers/net/wireless/iwlwifi/iwl-modparams.h
@@ -103,6 +103,7 @@ enum iwl_disable_11n {
  * @power_level: power level, default = 1
  * @debug_level: levels are IWL_DL_*
  * @ant_coupling: antenna coupling in dB, default = 0
+ * @d0i3_disable: disable d0i3, default = 1,
  * @fw_monitor: allow to use firmware monitor
  */
 struct iwl_mod_params {
@@ -121,6 +122,7 @@ struct iwl_mod_params {
         int ant_coupling;
         char *nvm_file;
         bool uapsd_disable;
+        bool d0i3_disable;
         bool fw_monitor;
 };
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
index 06e02fcd6f7b..c74f1a4edf23 100644
--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
@@ -468,6 +468,8 @@ static void iwl_set_radio_cfg(const struct iwl_cfg *cfg,
         data->radio_cfg_step = NVM_RF_CFG_STEP_MSK_FAMILY_8000(radio_cfg);
         data->radio_cfg_dash = NVM_RF_CFG_DASH_MSK_FAMILY_8000(radio_cfg);
         data->radio_cfg_pnum = NVM_RF_CFG_FLAVOR_MSK_FAMILY_8000(radio_cfg);
+        data->valid_tx_ant = NVM_RF_CFG_TX_ANT_MSK_FAMILY_8000(radio_cfg);
+        data->valid_rx_ant = NVM_RF_CFG_RX_ANT_MSK_FAMILY_8000(radio_cfg);
 }
 
 static void iwl_set_hw_address(const struct iwl_cfg *cfg,
@@ -592,6 +594,10 @@ iwl_parse_nvm_data(struct device *dev, const struct iwl_cfg *cfg,
 
         radio_cfg = iwl_get_radio_cfg(cfg, nvm_sw);
         iwl_set_radio_cfg(cfg, data, radio_cfg);
+        if (data->valid_tx_ant)
+                tx_chains &= data->valid_tx_ant;
+        if (data->valid_rx_ant)
+                rx_chains &= data->valid_rx_ant;
 
         sku = iwl_get_sku(cfg, nvm_sw);
         data->sku_cap_band_24GHz_enable = sku & NVM_SKU_CAP_BAND_24GHZ;
diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
index 2df51eab1348..b21fcf042b77 100644
--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
@@ -99,6 +99,7 @@
 
 #define APMG_PCIDEV_STT_VAL_PERSIST_DIS (0x00000200)
 #define APMG_PCIDEV_STT_VAL_L1_ACT_DIS  (0x00000800)
+#define APMG_PCIDEV_STT_VAL_WAKE_ME     (0x00004000)
 
 #define APMG_RTC_INT_STT_RFKILL         (0x10000000)
 
@@ -107,7 +108,8 @@
 
 /* Device NMI register */
 #define DEVICE_SET_NMI_REG 0x00a01c30
-#define DEVICE_SET_NMI_VAL 0x1
+#define DEVICE_SET_NMI_VAL_HW BIT(0)
+#define DEVICE_SET_NMI_VAL_DRV BIT(7)
 #define DEVICE_SET_NMI_8000B_REG 0x00a01c24
 #define DEVICE_SET_NMI_8000B_VAL 0x1000000
 
@@ -358,18 +360,40 @@ enum secure_load_status_reg {
 
 /* Rx FIFO */
 #define RXF_SIZE_ADDR                   (0xa00c88)
+#define RXF_RD_D_SPACE                  (0xa00c40)
+#define RXF_RD_WR_PTR                   (0xa00c50)
+#define RXF_RD_RD_PTR                   (0xa00c54)
+#define RXF_RD_FENCE_PTR                (0xa00c4c)
+#define RXF_SET_FENCE_MODE              (0xa00c14)
+#define RXF_LD_WR2FENCE         (0xa00c1c)
+#define RXF_FIFO_RD_FENCE_INC           (0xa00c68)
 #define RXF_SIZE_BYTE_CND_POS           (7)
 #define RXF_SIZE_BYTE_CNT_MSK           (0x3ff << RXF_SIZE_BYTE_CND_POS)
+#define RXF_DIFF_FROM_PREV              (0x200)
 
 #define RXF_LD_FENCE_OFFSET_ADDR        (0xa00c10)
 #define RXF_FIFO_RD_FENCE_ADDR          (0xa00c0c)
 
+/* Tx FIFO */
+#define TXF_FIFO_ITEM_CNT               (0xa00438)
+#define TXF_WR_PTR                      (0xa00414)
+#define TXF_RD_PTR                      (0xa00410)
+#define TXF_FENCE_PTR                   (0xa00418)
+#define TXF_LOCK_FENCE                  (0xa00424)
+#define TXF_LARC_NUM                    (0xa0043c)
+#define TXF_READ_MODIFY_DATA            (0xa00448)
+#define TXF_READ_MODIFY_ADDR            (0xa0044c)
+
 /* FW monitor */
+#define MON_BUFF_SAMPLE_CTL             (0xa03c00)
 #define MON_BUFF_BASE_ADDR              (0xa03c3c)
 #define MON_BUFF_END_ADDR               (0xa03c40)
 #define MON_BUFF_WRPTR                  (0xa03c44)
 #define MON_BUFF_CYCLE_CNT              (0xa03c48)
 
+#define DBGC_IN_SAMPLE                  (0xa03c00)
+#define DBGC_OUT_CTRL                   (0xa03c0c)
+
 /* FW chicken bits */
 #define LMPM_CHICK                      0xA01FF8
 enum {
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.h b/drivers/net/wireless/iwlwifi/iwl-trans.h
index 028408a6ecba..84d8477432a2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans.h
@@ -382,6 +382,8 @@ enum iwl_trans_status {
  *      are considered stuck and will trigger device restart
  * @command_names: array of command names, must be 256 entries
  *      (one for each command); for debugging only
+ * @sdio_adma_addr: the default address to set for the ADMA in SDIO mode until
+ *      we get the ALIVE from the uCode
  */
 struct iwl_trans_config {
         struct iwl_op_mode *op_mode;
@@ -396,6 +398,8 @@ struct iwl_trans_config {
         bool scd_set_active;
         unsigned int queue_watchdog_timeout;
         const char *const *command_names;
+
+        u32 sdio_adma_addr;
 };
 
 struct iwl_trans_dump_data {
@@ -552,6 +556,21 @@ enum iwl_trans_state {
 };
 
 /**
+ * enum iwl_d0i3_mode - d0i3 mode
+ *
+ * @IWL_D0I3_MODE_OFF - d0i3 is disabled
+ * @IWL_D0I3_MODE_ON_IDLE - enter d0i3 when device is idle
+ *      (e.g. no active references)
+ * @IWL_D0I3_MODE_ON_SUSPEND - enter d0i3 only on suspend
+ *      (in case of 'any' trigger)
+ */
+enum iwl_d0i3_mode {
+        IWL_D0I3_MODE_OFF = 0,
+        IWL_D0I3_MODE_ON_IDLE,
+        IWL_D0I3_MODE_ON_SUSPEND,
+};
+
+/**
  * struct iwl_trans - transport common data
  *
  * @ops - pointer to iwl_trans_ops
@@ -612,6 +631,8 @@ struct iwl_trans {
         const struct iwl_fw_dbg_conf_tlv *dbg_conf_tlv[FW_DBG_MAX];
         u8 dbg_dest_reg_num;
 
+        enum iwl_d0i3_mode d0i3_mode;
+
         /* pointer to trans specific struct */
         /*Ensure that this pointer will always be aligned to sizeof pointer */
         char trans_specific[0] __aligned(sizeof(void *));
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex.c b/drivers/net/wireless/iwlwifi/mvm/coex.c
index a3bfda45d9e6..1ec4d55155f7 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex.c
@@ -342,7 +342,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 12,
                 .lut20 = {
-                        cpu_to_le32(0x00000001),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -363,7 +363,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 20,
                 .lut20 = {
-                        cpu_to_le32(0x00000002),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -384,7 +384,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 21,
                 .lut20 = {
-                        cpu_to_le32(0x00000003),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -405,7 +405,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 23,
                 .lut20 = {
-                        cpu_to_le32(0x00000004),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -426,7 +426,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 27,
                 .lut20 = {
-                        cpu_to_le32(0x00000005),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -447,7 +447,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 30,
                 .lut20 = {
-                        cpu_to_le32(0x00000006),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -468,7 +468,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 32,
                 .lut20 = {
-                        cpu_to_le32(0x00000007),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -489,7 +489,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 33,
                 .lut20 = {
-                        cpu_to_le32(0x00000008),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -989,7 +989,7 @@ int iwl_mvm_rx_bt_coex_notif(struct iwl_mvm *mvm,
 static void iwl_mvm_bt_rssi_iterator(void *_data, u8 *mac,
                                    struct ieee80211_vif *vif)
 {
-        struct iwl_mvm_vif *mvmvif = (void *)vif->drv_priv;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_bt_iterator_data *data = _data;
         struct iwl_mvm *mvm = data->mvm;
 
@@ -1025,7 +1025,7 @@ static void iwl_mvm_bt_rssi_iterator(void *_data, u8 *mac,
 void iwl_mvm_bt_rssi_event(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                            enum ieee80211_rssi_event rssi_event)
 {
-        struct iwl_mvm_vif *mvmvif = (void *)vif->drv_priv;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_bt_iterator_data data = {
                 .mvm = mvm,
         };
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
index b3210cfbecc8..d530ef3da107 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
@@ -330,7 +330,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 12,
                 .lut20 = {
-                        cpu_to_le32(0x00000001),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -351,7 +351,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 20,
                 .lut20 = {
-                        cpu_to_le32(0x00000002),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -372,7 +372,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 21,
                 .lut20 = {
-                        cpu_to_le32(0x00000003),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -393,7 +393,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 23,
                 .lut20 = {
-                        cpu_to_le32(0x00000004),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -414,7 +414,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 27,
                 .lut20 = {
-                        cpu_to_le32(0x00000005),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -435,7 +435,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 30,
                 .lut20 = {
-                        cpu_to_le32(0x00000006),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -456,7 +456,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 32,
                 .lut20 = {
-                        cpu_to_le32(0x00000007),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -477,7 +477,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 33,
                 .lut20 = {
-                        cpu_to_le32(0x00000008),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -1034,7 +1034,7 @@ int iwl_mvm_rx_bt_coex_notif_old(struct iwl_mvm *mvm,
 static void iwl_mvm_bt_rssi_iterator(void *_data, u8 *mac,
                                      struct ieee80211_vif *vif)
 {
-        struct iwl_mvm_vif *mvmvif = (void *)vif->drv_priv;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_bt_iterator_data *data = _data;
         struct iwl_mvm *mvm = data->mvm;
 
@@ -1070,7 +1070,7 @@ static void iwl_mvm_bt_rssi_iterator(void *_data, u8 *mac,
 void iwl_mvm_bt_rssi_event_old(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                                enum ieee80211_rssi_event rssi_event)
 {
-        struct iwl_mvm_vif *mvmvif = (void *)vif->drv_priv;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_bt_iterator_data data = {
                 .mvm = mvm,
         };
diff --git a/drivers/net/wireless/iwlwifi/mvm/constants.h b/drivers/net/wireless/iwlwifi/mvm/constants.h
index 3bd93476ec1c..d91c46b0f888 100644
--- a/drivers/net/wireless/iwlwifi/mvm/constants.h
+++ b/drivers/net/wireless/iwlwifi/mvm/constants.h
@@ -94,13 +94,42 @@
 #define IWL_MVM_BT_COEX_MPLUT                   1
 #define IWL_MVM_BT_COEX_RRC                     1
 #define IWL_MVM_BT_COEX_TTC                     1
-#define IWL_MVM_BT_COEX_MPLUT_REG0              0x28412201
+#define IWL_MVM_BT_COEX_MPLUT_REG0              0x22002200
 #define IWL_MVM_BT_COEX_MPLUT_REG1              0x11118451
 #define IWL_MVM_BT_COEX_ANTENNA_COUPLING_THRS   30
 #define IWL_MVM_FW_MCAST_FILTER_PASS_ALL        0
 #define IWL_MVM_FW_BCAST_FILTER_PASS_ALL        0
 #define IWL_MVM_QUOTA_THRESHOLD                 8
 #define IWL_MVM_RS_RSSI_BASED_INIT_RATE         0
-#define IWL_MVM_RS_DISABLE_MIMO                 0
+#define IWL_MVM_RS_DISABLE_P2P_MIMO             0
+#define IWL_MVM_RS_NUM_TRY_BEFORE_ANT_TOGGLE    1
+#define IWL_MVM_RS_HT_VHT_RETRIES_PER_RATE      2
+#define IWL_MVM_RS_HT_VHT_RETRIES_PER_RATE_TW   1
+#define IWL_MVM_RS_INITIAL_MIMO_NUM_RATES       3
+#define IWL_MVM_RS_INITIAL_SISO_NUM_RATES       3
+#define IWL_MVM_RS_INITIAL_LEGACY_NUM_RATES     2
+#define IWL_MVM_RS_INITIAL_LEGACY_RETRIES       2
+#define IWL_MVM_RS_SECONDARY_LEGACY_RETRIES     1
+#define IWL_MVM_RS_SECONDARY_LEGACY_NUM_RATES   16
+#define IWL_MVM_RS_SECONDARY_SISO_NUM_RATES     3
+#define IWL_MVM_RS_SECONDARY_SISO_RETRIES       1
+#define IWL_MVM_RS_RATE_MIN_FAILURE_TH          3
+#define IWL_MVM_RS_RATE_MIN_SUCCESS_TH          8
+#define IWL_MVM_RS_STAY_IN_COLUMN_TIMEOUT       5       /* Seconds */
+#define IWL_MVM_RS_IDLE_TIMEOUT                 5       /* Seconds */
+#define IWL_MVM_RS_MISSED_RATE_MAX              15
+#define IWL_MVM_RS_LEGACY_FAILURE_LIMIT         160
+#define IWL_MVM_RS_LEGACY_SUCCESS_LIMIT         480
+#define IWL_MVM_RS_LEGACY_TABLE_COUNT           160
+#define IWL_MVM_RS_NON_LEGACY_FAILURE_LIMIT     400
+#define IWL_MVM_RS_NON_LEGACY_SUCCESS_LIMIT     4500
+#define IWL_MVM_RS_NON_LEGACY_TABLE_COUNT       1500
+#define IWL_MVM_RS_SR_FORCE_DECREASE            15      /* percent */
+#define IWL_MVM_RS_SR_NO_DECREASE               85      /* percent */
+#define IWL_MVM_RS_AGG_TIME_LIMIT               4000    /* 4 msecs. valid 100-8000 */
+#define IWL_MVM_RS_AGG_DISABLE_START            3
+#define IWL_MVM_RS_TPC_SR_FORCE_INCREASE        75      /* percent */
+#define IWL_MVM_RS_TPC_SR_NO_INCREASE           85      /* percent */
+#define IWL_MVM_RS_TPC_TX_POWER_STEP            3
 
 #endif /* __MVM_CONSTANTS_H */
diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c
index 744de262373e..14e8fd661889 100644
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -793,7 +793,7 @@ iwl_mvm_get_wowlan_config(struct iwl_mvm *mvm,
                           struct ieee80211_sta *ap_sta)
 {
         int ret;
-        struct iwl_mvm_sta *mvm_ap_sta = (struct iwl_mvm_sta *)ap_sta->drv_priv;
+        struct iwl_mvm_sta *mvm_ap_sta = iwl_mvm_sta_from_mac80211(ap_sta);
 
         /* TODO: wowlan_config_cmd->wowlan_ba_teardown_tids */
 
@@ -1137,12 +1137,43 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
         return ret;
 }
 
+static int iwl_mvm_enter_d0i3_sync(struct iwl_mvm *mvm)
+{
+        struct iwl_notification_wait wait_d3;
+        static const u8 d3_notif[] = { D3_CONFIG_CMD };
+        int ret;
+
+        iwl_init_notification_wait(&mvm->notif_wait, &wait_d3,
+                                   d3_notif, ARRAY_SIZE(d3_notif),
+                                   NULL, NULL);
+
+        ret = iwl_mvm_enter_d0i3(mvm->hw->priv);
+        if (ret)
+                goto remove_notif;
+
+        ret = iwl_wait_notification(&mvm->notif_wait, &wait_d3, HZ);
+        WARN_ON_ONCE(ret);
+        return ret;
+
+remove_notif:
+        iwl_remove_notification(&mvm->notif_wait, &wait_d3);
+        return ret;
+}
+
 int iwl_mvm_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 
         iwl_trans_suspend(mvm->trans);
-        if (iwl_mvm_is_d0i3_supported(mvm)) {
+        if (wowlan->any) {
+                /* 'any' trigger means d0i3 usage */
+                if (mvm->trans->d0i3_mode == IWL_D0I3_MODE_ON_SUSPEND) {
+                        int ret = iwl_mvm_enter_d0i3_sync(mvm);
+
+                        if (ret)
+                                return ret;
+                }
+
                 mutex_lock(&mvm->d0i3_suspend_mutex);
                 __set_bit(D0I3_DEFER_WAKEUP, &mvm->d0i3_suspend_flags);
                 mutex_unlock(&mvm->d0i3_suspend_mutex);
@@ -1626,7 +1657,7 @@ static bool iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
         if (IS_ERR_OR_NULL(ap_sta))
                 goto out_free;
 
-        mvm_ap_sta = (struct iwl_mvm_sta *)ap_sta->drv_priv;
+        mvm_ap_sta = iwl_mvm_sta_from_mac80211(ap_sta);
         for (i = 0; i < IWL_MAX_TID_COUNT; i++) {
                 u16 seq = status.qos_seq_ctr[i];
                 /* firmware stores last-used value, we store next value */
@@ -1876,8 +1907,20 @@ int iwl_mvm_resume(struct ieee80211_hw *hw)
 
         iwl_trans_resume(mvm->trans);
 
-        if (iwl_mvm_is_d0i3_supported(mvm))
+        if (mvm->hw->wiphy->wowlan_config->any) {
+                /* 'any' trigger means d0i3 usage */
+                if (mvm->trans->d0i3_mode == IWL_D0I3_MODE_ON_SUSPEND) {
+                        int ret = iwl_mvm_exit_d0i3(hw->priv);
+
+                        if (ret)
+                                return ret;
+                        /*
+                         * d0i3 exit will be deferred until reconfig_complete.
+                         * make sure there we are out of d0i3.
+                         */
+                }
                 return 0;
+        }
 
         return __iwl_mvm_resume(mvm, false);
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c b/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c
index 9aa2311a776c..5fe14591e1c4 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c
@@ -268,7 +268,7 @@ static ssize_t iwl_dbgfs_mac_params_read(struct file *file,
                 sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[ap_sta_id],
                                                 lockdep_is_held(&mvm->mutex));
                 if (!IS_ERR_OR_NULL(sta)) {
-                        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+                        struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
 
                         pos += scnprintf(buf+pos, bufsz-pos,
                                          "ap_sta_id %d - reduced Tx power %d\n",
@@ -517,6 +517,34 @@ static ssize_t iwl_dbgfs_low_latency_read(struct file *file,
         return simple_read_from_buffer(user_buf, count, ppos, buf, sizeof(buf));
 }
 
+static ssize_t iwl_dbgfs_uapsd_misbehaving_read(struct file *file,
+                                                char __user *user_buf,
+                                                size_t count, loff_t *ppos)
+{
+        struct ieee80211_vif *vif = file->private_data;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        char buf[20];
+        int len;
+
+        len = sprintf(buf, "%pM\n", mvmvif->uapsd_misbehaving_bssid);
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t iwl_dbgfs_uapsd_misbehaving_write(struct ieee80211_vif *vif,
+                                                 char *buf, size_t count,
+                                                 loff_t *ppos)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct iwl_mvm *mvm = mvmvif->mvm;
+        bool ret;
+
+        mutex_lock(&mvm->mutex);
+        ret = mac_pton(buf, mvmvif->uapsd_misbehaving_bssid);
+        mutex_unlock(&mvm->mutex);
+
+        return ret ? count : -EINVAL;
+}
+
 #define MVM_DEBUGFS_WRITE_FILE_OPS(name, bufsz) \
         _MVM_DEBUGFS_WRITE_FILE_OPS(name, bufsz, struct ieee80211_vif)
 #define MVM_DEBUGFS_READ_WRITE_FILE_OPS(name, bufsz) \
@@ -531,6 +559,7 @@ MVM_DEBUGFS_READ_FILE_OPS(mac_params);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(pm_params, 32);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(bf_params, 256);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(low_latency, 10);
+MVM_DEBUGFS_READ_WRITE_FILE_OPS(uapsd_misbehaving, 20);
 
 void iwl_mvm_vif_dbgfs_register(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 {
@@ -564,6 +593,8 @@ void iwl_mvm_vif_dbgfs_register(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
         MVM_DEBUGFS_ADD_FILE_VIF(mac_params, mvmvif->dbgfs_dir, S_IRUSR);
         MVM_DEBUGFS_ADD_FILE_VIF(low_latency, mvmvif->dbgfs_dir,
                                  S_IRUSR | S_IWUSR);
+        MVM_DEBUGFS_ADD_FILE_VIF(uapsd_misbehaving, mvmvif->dbgfs_dir,
+                                 S_IRUSR | S_IWUSR);
 
         if (vif->type == NL80211_IFTYPE_STATION && !vif->p2p &&
             mvmvif == mvm->bf_allowed_vif)
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
index 33bf915cd7ea..82c09d86af8c 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
@@ -654,10 +654,10 @@ out:
         return ret ?: count;
 }
 
-#define PRINT_STATS_LE32(_str, _val)                                    \
+#define PRINT_STATS_LE32(_struct, _memb)                                \
                          pos += scnprintf(buf + pos, bufsz - pos,       \
-                                          fmt_table, _str,              \
-                                          le32_to_cpu(_val))
+                                          fmt_table, #_memb,            \
+                                          le32_to_cpu(_struct->_memb))
 
 static ssize_t iwl_dbgfs_fw_rx_stats_read(struct file *file,
                                           char __user *user_buf, size_t count,
@@ -692,97 +692,89 @@ static ssize_t iwl_dbgfs_fw_rx_stats_read(struct file *file,
 
         pos += scnprintf(buf + pos, bufsz - pos, fmt_header,
                          "Statistics_Rx - OFDM");
-        PRINT_STATS_LE32("ina_cnt", ofdm->ina_cnt);
-        PRINT_STATS_LE32("fina_cnt", ofdm->fina_cnt);
-        PRINT_STATS_LE32("plcp_err", ofdm->plcp_err);
-        PRINT_STATS_LE32("crc32_err", ofdm->crc32_err);
-        PRINT_STATS_LE32("overrun_err", ofdm->overrun_err);
-        PRINT_STATS_LE32("early_overrun_err", ofdm->early_overrun_err);
-        PRINT_STATS_LE32("crc32_good", ofdm->crc32_good);
-        PRINT_STATS_LE32("false_alarm_cnt", ofdm->false_alarm_cnt);
-        PRINT_STATS_LE32("fina_sync_err_cnt", ofdm->fina_sync_err_cnt);
-        PRINT_STATS_LE32("sfd_timeout", ofdm->sfd_timeout);
-        PRINT_STATS_LE32("fina_timeout", ofdm->fina_timeout);
-        PRINT_STATS_LE32("unresponded_rts", ofdm->unresponded_rts);
-        PRINT_STATS_LE32("rxe_frame_lmt_overrun",
-                         ofdm->rxe_frame_limit_overrun);
-        PRINT_STATS_LE32("sent_ack_cnt", ofdm->sent_ack_cnt);
-        PRINT_STATS_LE32("sent_cts_cnt", ofdm->sent_cts_cnt);
-        PRINT_STATS_LE32("sent_ba_rsp_cnt", ofdm->sent_ba_rsp_cnt);
-        PRINT_STATS_LE32("dsp_self_kill", ofdm->dsp_self_kill);
-        PRINT_STATS_LE32("mh_format_err", ofdm->mh_format_err);
-        PRINT_STATS_LE32("re_acq_main_rssi_sum", ofdm->re_acq_main_rssi_sum);
-        PRINT_STATS_LE32("reserved", ofdm->reserved);
+        PRINT_STATS_LE32(ofdm, ina_cnt);
+        PRINT_STATS_LE32(ofdm, fina_cnt);
+        PRINT_STATS_LE32(ofdm, plcp_err);
+        PRINT_STATS_LE32(ofdm, crc32_err);
+        PRINT_STATS_LE32(ofdm, overrun_err);
+        PRINT_STATS_LE32(ofdm, early_overrun_err);
+        PRINT_STATS_LE32(ofdm, crc32_good);
+        PRINT_STATS_LE32(ofdm, false_alarm_cnt);
+        PRINT_STATS_LE32(ofdm, fina_sync_err_cnt);
+        PRINT_STATS_LE32(ofdm, sfd_timeout);
+        PRINT_STATS_LE32(ofdm, fina_timeout);
+        PRINT_STATS_LE32(ofdm, unresponded_rts);
+        PRINT_STATS_LE32(ofdm, rxe_frame_lmt_overrun);
+        PRINT_STATS_LE32(ofdm, sent_ack_cnt);
+        PRINT_STATS_LE32(ofdm, sent_cts_cnt);
+        PRINT_STATS_LE32(ofdm, sent_ba_rsp_cnt);
+        PRINT_STATS_LE32(ofdm, dsp_self_kill);
+        PRINT_STATS_LE32(ofdm, mh_format_err);
+        PRINT_STATS_LE32(ofdm, re_acq_main_rssi_sum);
+        PRINT_STATS_LE32(ofdm, reserved);
 
         pos += scnprintf(buf + pos, bufsz - pos, fmt_header,
                          "Statistics_Rx - CCK");
-        PRINT_STATS_LE32("ina_cnt", cck->ina_cnt);
-        PRINT_STATS_LE32("fina_cnt", cck->fina_cnt);
-        PRINT_STATS_LE32("plcp_err", cck->plcp_err);
-        PRINT_STATS_LE32("crc32_err", cck->crc32_err);
-        PRINT_STATS_LE32("overrun_err", cck->overrun_err);
-        PRINT_STATS_LE32("early_overrun_err", cck->early_overrun_err);
-        PRINT_STATS_LE32("crc32_good", cck->crc32_good);
-        PRINT_STATS_LE32("false_alarm_cnt", cck->false_alarm_cnt);
-        PRINT_STATS_LE32("fina_sync_err_cnt", cck->fina_sync_err_cnt);
-        PRINT_STATS_LE32("sfd_timeout", cck->sfd_timeout);
-        PRINT_STATS_LE32("fina_timeout", cck->fina_timeout);
-        PRINT_STATS_LE32("unresponded_rts", cck->unresponded_rts);
-        PRINT_STATS_LE32("rxe_frame_lmt_overrun",
-                         cck->rxe_frame_limit_overrun);
-        PRINT_STATS_LE32("sent_ack_cnt", cck->sent_ack_cnt);
-        PRINT_STATS_LE32("sent_cts_cnt", cck->sent_cts_cnt);
-        PRINT_STATS_LE32("sent_ba_rsp_cnt", cck->sent_ba_rsp_cnt);
-        PRINT_STATS_LE32("dsp_self_kill", cck->dsp_self_kill);
-        PRINT_STATS_LE32("mh_format_err", cck->mh_format_err);
-        PRINT_STATS_LE32("re_acq_main_rssi_sum", cck->re_acq_main_rssi_sum);
-        PRINT_STATS_LE32("reserved", cck->reserved);
+        PRINT_STATS_LE32(cck, ina_cnt);
+        PRINT_STATS_LE32(cck, fina_cnt);
+        PRINT_STATS_LE32(cck, plcp_err);
+        PRINT_STATS_LE32(cck, crc32_err);
+        PRINT_STATS_LE32(cck, overrun_err);
+        PRINT_STATS_LE32(cck, early_overrun_err);
+        PRINT_STATS_LE32(cck, crc32_good);
+        PRINT_STATS_LE32(cck, false_alarm_cnt);
+        PRINT_STATS_LE32(cck, fina_sync_err_cnt);
+        PRINT_STATS_LE32(cck, sfd_timeout);
+        PRINT_STATS_LE32(cck, fina_timeout);
+        PRINT_STATS_LE32(cck, unresponded_rts);
+        PRINT_STATS_LE32(cck, rxe_frame_lmt_overrun);
+        PRINT_STATS_LE32(cck, sent_ack_cnt);
+        PRINT_STATS_LE32(cck, sent_cts_cnt);
+        PRINT_STATS_LE32(cck, sent_ba_rsp_cnt);
+        PRINT_STATS_LE32(cck, dsp_self_kill);
+        PRINT_STATS_LE32(cck, mh_format_err);
+        PRINT_STATS_LE32(cck, re_acq_main_rssi_sum);
+        PRINT_STATS_LE32(cck, reserved);
 
         pos += scnprintf(buf + pos, bufsz - pos, fmt_header,
                          "Statistics_Rx - GENERAL");
-        PRINT_STATS_LE32("bogus_cts", general->bogus_cts);
-        PRINT_STATS_LE32("bogus_ack", general->bogus_ack);
-        PRINT_STATS_LE32("non_bssid_frames", general->non_bssid_frames);
-        PRINT_STATS_LE32("filtered_frames", general->filtered_frames);
-        PRINT_STATS_LE32("non_channel_beacons", general->non_channel_beacons);
-        PRINT_STATS_LE32("channel_beacons", general->channel_beacons);
-        PRINT_STATS_LE32("num_missed_bcon", general->num_missed_bcon);
-        PRINT_STATS_LE32("adc_rx_saturation_time",
-                         general->adc_rx_saturation_time);
-        PRINT_STATS_LE32("ina_detection_search_time",
-                         general->ina_detection_search_time);
-        PRINT_STATS_LE32("beacon_silence_rssi_a",
-                         general->beacon_silence_rssi_a);
-        PRINT_STATS_LE32("beacon_silence_rssi_b",
-                         general->beacon_silence_rssi_b);
-        PRINT_STATS_LE32("beacon_silence_rssi_c",
-                         general->beacon_silence_rssi_c);
-        PRINT_STATS_LE32("interference_data_flag",
-                         general->interference_data_flag);
-        PRINT_STATS_LE32("channel_load", general->channel_load);
-        PRINT_STATS_LE32("dsp_false_alarms", general->dsp_false_alarms);
-        PRINT_STATS_LE32("beacon_rssi_a", general->beacon_rssi_a);
-        PRINT_STATS_LE32("beacon_rssi_b", general->beacon_rssi_b);
-        PRINT_STATS_LE32("beacon_rssi_c", general->beacon_rssi_c);
-        PRINT_STATS_LE32("beacon_energy_a", general->beacon_energy_a);
-        PRINT_STATS_LE32("beacon_energy_b", general->beacon_energy_b);
-        PRINT_STATS_LE32("beacon_energy_c", general->beacon_energy_c);
-        PRINT_STATS_LE32("num_bt_kills", general->num_bt_kills);
-        PRINT_STATS_LE32("mac_id", general->mac_id);
-        PRINT_STATS_LE32("directed_data_mpdu", general->directed_data_mpdu);
+        PRINT_STATS_LE32(general, bogus_cts);
+        PRINT_STATS_LE32(general, bogus_ack);
+        PRINT_STATS_LE32(general, non_bssid_frames);
+        PRINT_STATS_LE32(general, filtered_frames);
+        PRINT_STATS_LE32(general, non_channel_beacons);
+        PRINT_STATS_LE32(general, channel_beacons);
+        PRINT_STATS_LE32(general, num_missed_bcon);
+        PRINT_STATS_LE32(general, adc_rx_saturation_time);
+        PRINT_STATS_LE32(general, ina_detection_search_time);
+        PRINT_STATS_LE32(general, beacon_silence_rssi_a);
+        PRINT_STATS_LE32(general, beacon_silence_rssi_b);
+        PRINT_STATS_LE32(general, beacon_silence_rssi_c);
+        PRINT_STATS_LE32(general, interference_data_flag);
+        PRINT_STATS_LE32(general, channel_load);
+        PRINT_STATS_LE32(general, dsp_false_alarms);
+        PRINT_STATS_LE32(general, beacon_rssi_a);
+        PRINT_STATS_LE32(general, beacon_rssi_b);
+        PRINT_STATS_LE32(general, beacon_rssi_c);
+        PRINT_STATS_LE32(general, beacon_energy_a);
+        PRINT_STATS_LE32(general, beacon_energy_b);
+        PRINT_STATS_LE32(general, beacon_energy_c);
+        PRINT_STATS_LE32(general, num_bt_kills);
+        PRINT_STATS_LE32(general, mac_id);
+        PRINT_STATS_LE32(general, directed_data_mpdu);
 
         pos += scnprintf(buf + pos, bufsz - pos, fmt_header,
                          "Statistics_Rx - HT");
-        PRINT_STATS_LE32("plcp_err", ht->plcp_err);
-        PRINT_STATS_LE32("overrun_err", ht->overrun_err);
-        PRINT_STATS_LE32("early_overrun_err", ht->early_overrun_err);
-        PRINT_STATS_LE32("crc32_good", ht->crc32_good);
-        PRINT_STATS_LE32("crc32_err", ht->crc32_err);
-        PRINT_STATS_LE32("mh_format_err", ht->mh_format_err);
-        PRINT_STATS_LE32("agg_crc32_good", ht->agg_crc32_good);
-        PRINT_STATS_LE32("agg_mpdu_cnt", ht->agg_mpdu_cnt);
-        PRINT_STATS_LE32("agg_cnt", ht->agg_cnt);
-        PRINT_STATS_LE32("unsupport_mcs", ht->unsupport_mcs);
+        PRINT_STATS_LE32(ht, plcp_err);
+        PRINT_STATS_LE32(ht, overrun_err);
+        PRINT_STATS_LE32(ht, early_overrun_err);
+        PRINT_STATS_LE32(ht, crc32_good);
+        PRINT_STATS_LE32(ht, crc32_err);
+        PRINT_STATS_LE32(ht, mh_format_err);
+        PRINT_STATS_LE32(ht, agg_crc32_good);
+        PRINT_STATS_LE32(ht, agg_mpdu_cnt);
+        PRINT_STATS_LE32(ht, agg_cnt);
+        PRINT_STATS_LE32(ht, unsupport_mcs);
 
         mutex_unlock(&mvm->mutex);
 
@@ -933,7 +925,7 @@ iwl_dbgfs_scan_ant_rxchain_write(struct iwl_mvm *mvm, char *buf,
                 return -EINVAL;
         if (scan_rx_ant > ANT_ABC)
                 return -EINVAL;
-        if (scan_rx_ant & ~mvm->fw->valid_rx_ant)
+        if (scan_rx_ant & ~(iwl_mvm_get_valid_rx_ant(mvm)))
                 return -EINVAL;
 
         if (mvm->scan_rx_ant != scan_rx_ant) {
@@ -945,6 +937,61 @@ iwl_dbgfs_scan_ant_rxchain_write(struct iwl_mvm *mvm, char *buf,
         return count;
 }
 
+static ssize_t iwl_dbgfs_fw_dbg_conf_read(struct file *file,
+                                          char __user *user_buf,
+                                          size_t count, loff_t *ppos)
+{
+        struct iwl_mvm *mvm = file->private_data;
+        enum iwl_fw_dbg_conf conf;
+        char buf[8];
+        const size_t bufsz = sizeof(buf);
+        int pos = 0;
+
+        mutex_lock(&mvm->mutex);
+        conf = mvm->fw_dbg_conf;
+        mutex_unlock(&mvm->mutex);
+
+        pos += scnprintf(buf + pos, bufsz - pos, "%d\n", conf);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+}
+
+static ssize_t iwl_dbgfs_fw_dbg_conf_write(struct iwl_mvm *mvm,
+                                           char *buf, size_t count,
+                                           loff_t *ppos)
+{
+        int ret, conf_id;
+
+        ret = kstrtoint(buf, 0, &conf_id);
+        if (ret)
+                return ret;
+
+        if (WARN_ON(conf_id >= FW_DBG_MAX))
+                return -EINVAL;
+
+        mutex_lock(&mvm->mutex);
+        ret = iwl_mvm_start_fw_dbg_conf(mvm, conf_id);
+        mutex_unlock(&mvm->mutex);
+
+        return ret ?: count;
+}
+
+static ssize_t iwl_dbgfs_fw_dbg_collect_write(struct iwl_mvm *mvm,
+                                              char *buf, size_t count,
+                                              loff_t *ppos)
+{
+        int ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_PRPH_WRITE);
+
+        if (ret)
+                return ret;
+
+        iwl_mvm_fw_dbg_collect(mvm);
+
+        iwl_mvm_unref(mvm, IWL_MVM_REF_PRPH_WRITE);
+
+        return count;
+}
+
 #define ADD_TEXT(...) pos += scnprintf(buf + pos, bufsz - pos, __VA_ARGS__)
 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
 static ssize_t iwl_dbgfs_bcast_filters_read(struct file *file,
@@ -1340,6 +1387,7 @@ static ssize_t iwl_dbgfs_d0i3_refs_read(struct file *file,
         PRINT_MVM_REF(IWL_MVM_REF_TM_CMD);
         PRINT_MVM_REF(IWL_MVM_REF_EXIT_WORK);
         PRINT_MVM_REF(IWL_MVM_REF_PROTECT_CSA);
+        PRINT_MVM_REF(IWL_MVM_REF_FW_DBG_COLLECT);
 
         return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
@@ -1439,6 +1487,26 @@ out:
         return count;
 }
 
+static ssize_t iwl_dbgfs_enable_scan_iteration_notif_write(struct iwl_mvm *mvm,
+                                                           char *buf,
+                                                           size_t count,
+                                                           loff_t *ppos)
+{
+        int val;
+
+        mutex_lock(&mvm->mutex);
+
+        if (kstrtoint(buf, 10, &val)) {
+                mutex_unlock(&mvm->mutex);
+                return -EINVAL;
+        }
+
+        mvm->scan_iter_notif_enabled = val;
+        mutex_unlock(&mvm->mutex);
+
+        return count;
+}
+
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(prph_reg, 64);
 
 /* Device wide debugfs entries */
@@ -1459,6 +1527,9 @@ MVM_DEBUGFS_WRITE_FILE_OPS(bt_tx_prio, 10);
 MVM_DEBUGFS_WRITE_FILE_OPS(bt_force_ant, 10);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(scan_ant_rxchain, 8);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(d0i3_refs, 8);
+MVM_DEBUGFS_READ_WRITE_FILE_OPS(fw_dbg_conf, 8);
+MVM_DEBUGFS_WRITE_FILE_OPS(fw_dbg_collect, 8);
+MVM_DEBUGFS_WRITE_FILE_OPS(enable_scan_iteration_notif, 8);
 
 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(bcast_filters, 256);
@@ -1500,6 +1571,10 @@ int iwl_mvm_dbgfs_register(struct iwl_mvm *mvm, struct dentry *dbgfs_dir)
                              S_IWUSR | S_IRUSR);
         MVM_DEBUGFS_ADD_FILE(prph_reg, mvm->debugfs_dir, S_IWUSR | S_IRUSR);
         MVM_DEBUGFS_ADD_FILE(d0i3_refs, mvm->debugfs_dir, S_IRUSR | S_IWUSR);
+        MVM_DEBUGFS_ADD_FILE(fw_dbg_conf, mvm->debugfs_dir, S_IRUSR | S_IWUSR);
+        MVM_DEBUGFS_ADD_FILE(fw_dbg_collect, mvm->debugfs_dir, S_IWUSR);
+        MVM_DEBUGFS_ADD_FILE(enable_scan_iteration_notif, mvm->debugfs_dir,
+                             S_IWUSR);
 
 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
         if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_BCAST_FILTERING) {
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
index 430020047b77..4fc0938b3fb6 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
@@ -92,14 +92,32 @@ enum iwl_ltr_config_flags {
 };
 
 /**
+ * struct iwl_ltr_config_cmd_v1 - configures the LTR
+ * @flags: See %enum iwl_ltr_config_flags
+ */
+struct iwl_ltr_config_cmd_v1 {
+        __le32 flags;
+        __le32 static_long;
+        __le32 static_short;
+} __packed; /* LTR_CAPABLE_API_S_VER_1 */
+
+#define LTR_VALID_STATES_NUM 4
+
+/**
  * struct iwl_ltr_config_cmd - configures the LTR
  * @flags: See %enum iwl_ltr_config_flags
+ * @static_long:
+ * @static_short:
+ * @ltr_cfg_values:
+ * @ltr_short_idle_timeout:
  */
 struct iwl_ltr_config_cmd {
         __le32 flags;
         __le32 static_long;
         __le32 static_short;
-} __packed;
+        __le32 ltr_cfg_values[LTR_VALID_STATES_NUM];
+        __le32 ltr_short_idle_timeout;
+} __packed; /* LTR_CAPABLE_API_S_VER_2 */
 
 /* Radio LP RX Energy Threshold measured in dBm */
 #define POWER_LPRX_RSSI_THRESHOLD       75
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-rs.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-rs.h
index 8bb5b94bf963..6a2a6b0ab91b 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-rs.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-rs.h
@@ -308,6 +308,17 @@ enum {
 #define LQ_FLAG_DYNAMIC_BW_POS          6
 #define LQ_FLAG_DYNAMIC_BW_MSK          (1 << LQ_FLAG_DYNAMIC_BW_POS)
 
+/* Single Stream Parameters
+ * SS_STBC/BFER_ALLOWED - Controls whether STBC or Beamformer (BFER) is allowed
+ * ucode will make a smart decision between SISO/STBC/BFER
+ * SS_PARAMS_VALID - if not set ignore the ss_params field.
+ */
+enum {
+        RS_SS_STBC_ALLOWED = BIT(0),
+        RS_SS_BFER_ALLOWED = BIT(1),
+        RS_SS_PARAMS_VALID = BIT(31),
+};
+
 /**
  * struct iwl_lq_cmd - link quality command
  * @sta_id: station to update
@@ -330,7 +341,7 @@ enum {
  *      2 - 0x3f: maximal number of frames (up to 3f == 63)
  * @rs_table: array of rates for each TX try, each is rate_n_flags,
  *      meaning it is a combination of RATE_MCS_* and IWL_RATE_*_PLCP
- * @bf_params: beam forming params, currently not used
+ * @ss_params: single stream features. declare whether STBC or BFER are allowed.
  */
 struct iwl_lq_cmd {
         u8 sta_id;
@@ -348,6 +359,6 @@ struct iwl_lq_cmd {
         u8 agg_frame_cnt_limit;
         __le32 reserved2;
         __le32 rs_table[LQ_MAX_RETRY_NUM];
-        __le32 bf_params;
+        __le32 ss_params;
 }; /* LINK_QUALITY_CMD_API_S_VER_1 */
 #endif /* __fw_api_rs_h__ */
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
index 201846de94e7..cfc0e65b34a5 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
@@ -653,8 +653,11 @@ enum iwl_scan_channel_flags {
 };
 
 /* iwl_scan_channel_opt - CHANNEL_OPTIMIZATION_API_S
- * @flags: enum iwl_scan_channel_flgs
- * @non_ebs_ratio: how many regular scan iteration before EBS
+ * @flags: enum iwl_scan_channel_flags
+ * @non_ebs_ratio: defines the ratio of number of scan iterations where EBS is
+ *      involved.
+ *      1 - EBS is disabled.
+ *      2 - every second scan will be full scan(and so on).
  */
 struct iwl_scan_channel_opt {
         __le16 flags;
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-stats.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-stats.h
new file mode 100644
index 000000000000..928168b18346
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-stats.h
@@ -0,0 +1,277 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called COPYING.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#ifndef __fw_api_stats_h__
+#define __fw_api_stats_h__
+
+struct mvm_statistics_dbg {
+        __le32 burst_check;
+        __le32 burst_count;
+        __le32 wait_for_silence_timeout_cnt;
+        __le32 reserved[3];
+} __packed; /* STATISTICS_DEBUG_API_S_VER_2 */
+
+struct mvm_statistics_div {
+        __le32 tx_on_a;
+        __le32 tx_on_b;
+        __le32 exec_time;
+        __le32 probe_time;
+        __le32 rssi_ant;
+        __le32 reserved2;
+} __packed; /* STATISTICS_SLOW_DIV_API_S_VER_2 */
+
+struct mvm_statistics_rx_non_phy {
+        __le32 bogus_cts;       /* CTS received when not expecting CTS */
+        __le32 bogus_ack;       /* ACK received when not expecting ACK */
+        __le32 non_bssid_frames;        /* number of frames with BSSID that
+                                         * doesn't belong to the STA BSSID */
+        __le32 filtered_frames; /* count frames that were dumped in the
+                                 * filtering process */
+        __le32 non_channel_beacons;     /* beacons with our bss id but not on
+                                         * our serving channel */
+        __le32 channel_beacons; /* beacons with our bss id and in our
+                                 * serving channel */
+        __le32 num_missed_bcon; /* number of missed beacons */
+        __le32 adc_rx_saturation_time;  /* count in 0.8us units the time the
+                                         * ADC was in saturation */
+        __le32 ina_detection_search_time;/* total time (in 0.8us) searched
+                                          * for INA */
+        __le32 beacon_silence_rssi_a;   /* RSSI silence after beacon frame */
+        __le32 beacon_silence_rssi_b;   /* RSSI silence after beacon frame */
+        __le32 beacon_silence_rssi_c;   /* RSSI silence after beacon frame */
+        __le32 interference_data_flag;  /* flag for interference data
+                                         * availability. 1 when data is
+                                         * available. */
+        __le32 channel_load;            /* counts RX Enable time in uSec */
+        __le32 dsp_false_alarms;        /* DSP false alarm (both OFDM
+                                         * and CCK) counter */
+        __le32 beacon_rssi_a;
+        __le32 beacon_rssi_b;
+        __le32 beacon_rssi_c;
+        __le32 beacon_energy_a;
+        __le32 beacon_energy_b;
+        __le32 beacon_energy_c;
+        __le32 num_bt_kills;
+        __le32 mac_id;
+        __le32 directed_data_mpdu;
+} __packed; /* STATISTICS_RX_NON_PHY_API_S_VER_3 */
+
+struct mvm_statistics_rx_phy {
+        __le32 ina_cnt;
+        __le32 fina_cnt;
+        __le32 plcp_err;
+        __le32 crc32_err;
+        __le32 overrun_err;
+        __le32 early_overrun_err;
+        __le32 crc32_good;
+        __le32 false_alarm_cnt;
+        __le32 fina_sync_err_cnt;
+        __le32 sfd_timeout;
+        __le32 fina_timeout;
+        __le32 unresponded_rts;
+        __le32 rxe_frame_lmt_overrun;
+        __le32 sent_ack_cnt;
+        __le32 sent_cts_cnt;
+        __le32 sent_ba_rsp_cnt;
+        __le32 dsp_self_kill;
+        __le32 mh_format_err;
+        __le32 re_acq_main_rssi_sum;
+        __le32 reserved;
+} __packed; /* STATISTICS_RX_PHY_API_S_VER_2 */
+
+struct mvm_statistics_rx_ht_phy {
+        __le32 plcp_err;
+        __le32 overrun_err;
+        __le32 early_overrun_err;
+        __le32 crc32_good;
+        __le32 crc32_err;
+        __le32 mh_format_err;
+        __le32 agg_crc32_good;
+        __le32 agg_mpdu_cnt;
+        __le32 agg_cnt;
+        __le32 unsupport_mcs;
+} __packed;  /* STATISTICS_HT_RX_PHY_API_S_VER_1 */
+
+struct mvm_statistics_tx_non_phy {
+        __le32 preamble_cnt;
+        __le32 rx_detected_cnt;
+        __le32 bt_prio_defer_cnt;
+        __le32 bt_prio_kill_cnt;
+        __le32 few_bytes_cnt;
+        __le32 cts_timeout;
+        __le32 ack_timeout;
+        __le32 expected_ack_cnt;
+        __le32 actual_ack_cnt;
+        __le32 dump_msdu_cnt;
+        __le32 burst_abort_next_frame_mismatch_cnt;
+        __le32 burst_abort_missing_next_frame_cnt;
+        __le32 cts_timeout_collision;
+        __le32 ack_or_ba_timeout_collision;
+} __packed; /* STATISTICS_TX_NON_PHY_API_S_VER_3 */
+
+#define MAX_CHAINS 3
+
+struct mvm_statistics_tx_non_phy_agg {
+        __le32 ba_timeout;
+        __le32 ba_reschedule_frames;
+        __le32 scd_query_agg_frame_cnt;
+        __le32 scd_query_no_agg;
+        __le32 scd_query_agg;
+        __le32 scd_query_mismatch;
+        __le32 frame_not_ready;
+        __le32 underrun;
+        __le32 bt_prio_kill;
+        __le32 rx_ba_rsp_cnt;
+        __s8 txpower[MAX_CHAINS];
+        __s8 reserved;
+        __le32 reserved2;
+} __packed; /* STATISTICS_TX_NON_PHY_AGG_API_S_VER_1 */
+
+struct mvm_statistics_tx_channel_width {
+        __le32 ext_cca_narrow_ch20[1];
+        __le32 ext_cca_narrow_ch40[2];
+        __le32 ext_cca_narrow_ch80[3];
+        __le32 ext_cca_narrow_ch160[4];
+        __le32 last_tx_ch_width_indx;
+        __le32 rx_detected_per_ch_width[4];
+        __le32 success_per_ch_width[4];
+        __le32 fail_per_ch_width[4];
+}; /* STATISTICS_TX_CHANNEL_WIDTH_API_S_VER_1 */
+
+struct mvm_statistics_tx {
+        struct mvm_statistics_tx_non_phy general;
+        struct mvm_statistics_tx_non_phy_agg agg;
+        struct mvm_statistics_tx_channel_width channel_width;
+} __packed; /* STATISTICS_TX_API_S_VER_4 */
+
+
+struct mvm_statistics_bt_activity {
+        __le32 hi_priority_tx_req_cnt;
+        __le32 hi_priority_tx_denied_cnt;
+        __le32 lo_priority_tx_req_cnt;
+        __le32 lo_priority_tx_denied_cnt;
+        __le32 hi_priority_rx_req_cnt;
+        __le32 hi_priority_rx_denied_cnt;
+        __le32 lo_priority_rx_req_cnt;
+        __le32 lo_priority_rx_denied_cnt;
+} __packed;  /* STATISTICS_BT_ACTIVITY_API_S_VER_1 */
+
+struct mvm_statistics_general {
+        __le32 radio_temperature;
+        __le32 radio_voltage;
+        struct mvm_statistics_dbg dbg;
+        __le32 sleep_time;
+        __le32 slots_out;
+        __le32 slots_idle;
+        __le32 ttl_timestamp;
+        struct mvm_statistics_div slow_div;
+        __le32 rx_enable_counter;
+        /*
+         * num_of_sos_states:
+         *  count the number of times we have to re-tune
+         *  in order to get out of bad PHY status
+         */
+        __le32 num_of_sos_states;
+        __le32 beacon_filtered;
+        __le32 missed_beacons;
+        __s8 beacon_filter_average_energy;
+        __s8 beacon_filter_reason;
+        __s8 beacon_filter_current_energy;
+        __s8 beacon_filter_reserved;
+        __le32 beacon_filter_delta_time;
+        struct mvm_statistics_bt_activity bt_activity;
+} __packed; /* STATISTICS_GENERAL_API_S_VER_5 */
+
+struct mvm_statistics_rx {
+        struct mvm_statistics_rx_phy ofdm;
+        struct mvm_statistics_rx_phy cck;
+        struct mvm_statistics_rx_non_phy general;
+        struct mvm_statistics_rx_ht_phy ofdm_ht;
+} __packed; /* STATISTICS_RX_API_S_VER_3 */
+
+/*
+ * STATISTICS_NOTIFICATION = 0x9d (notification only, not a command)
+ *
+ * By default, uCode issues this notification after receiving a beacon
+ * while associated.  To disable this behavior, set DISABLE_NOTIF flag in the
+ * REPLY_STATISTICS_CMD 0x9c, above.
+ *
+ * Statistics counters continue to increment beacon after beacon, but are
+ * cleared when changing channels or when driver issues REPLY_STATISTICS_CMD
+ * 0x9c with CLEAR_STATS bit set (see above).
+ *
+ * uCode also issues this notification during scans.  uCode clears statistics
+ * appropriately so that each notification contains statistics for only the
+ * one channel that has just been scanned.
+ */
+
+struct iwl_notif_statistics {
+        __le32 flag;
+        struct mvm_statistics_rx rx;
+        struct mvm_statistics_tx tx;
+        struct mvm_statistics_general general;
+} __packed; /* STATISTICS_NTFY_API_S_VER_8 */
+
+#endif /* __fw_api_stats_h__ */
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
index 5bca1f8bfebf..81c4ea3c6958 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
@@ -592,4 +592,43 @@ static inline u32 iwl_mvm_get_scd_ssn(struct iwl_mvm_tx_resp *tx_resp)
                             tx_resp->frame_count) & 0xfff;
 }
 
+/**
+ * struct iwl_scd_txq_cfg_cmd - New txq hw scheduler config command
+ * @token:
+ * @sta_id: station id
+ * @tid:
+ * @scd_queue: scheduler queue to confiug
+ * @enable: 1 queue enable, 0 queue disable
+ * @aggregate: 1 aggregated queue, 0 otherwise
+ * @tx_fifo: %enum iwl_mvm_tx_fifo
+ * @window: BA window size
+ * @ssn: SSN for the BA agreement
+ */
+struct iwl_scd_txq_cfg_cmd {
+        u8 token;
+        u8 sta_id;
+        u8 tid;
+        u8 scd_queue;
+        u8 enable;
+        u8 aggregate;
+        u8 tx_fifo;
+        u8 window;
+        __le16 ssn;
+        __le16 reserved;
+} __packed; /* SCD_QUEUE_CFG_CMD_API_S_VER_1 */
+
+/**
+ * struct iwl_scd_txq_cfg_rsp
+ * @token: taken from the command
+ * @sta_id: station id from the command
+ * @tid: tid from the command
+ * @scd_queue: scd_queue from the command
+ */
+struct iwl_scd_txq_cfg_rsp {
+        u8 token;
+        u8 sta_id;
+        u8 tid;
+        u8 scd_queue;
+} __packed; /* SCD_QUEUE_CFG_RSP_API_S_VER_1 */
+
 #endif /* __fw_api_tx_h__ */
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api.h b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
index 88af6dd2ceaa..b56154fe8ec5 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
@@ -74,6 +74,7 @@
 #include "fw-api-d3.h"
 #include "fw-api-coex.h"
 #include "fw-api-scan.h"
+#include "fw-api-stats.h"
 
 /* Tx queue numbers */
 enum {
@@ -128,6 +129,9 @@ enum {
         /* global key */
         WEP_KEY = 0x20,
 
+        /* Memory */
+        SHARED_MEM_CFG = 0x25,
+
         /* TDLS */
         TDLS_CHANNEL_SWITCH_CMD = 0x27,
         TDLS_CHANNEL_SWITCH_NOTIFICATION = 0xaa,
@@ -1381,214 +1385,6 @@ struct iwl_mvm_marker {
         __le32 metadata[0];
 } __packed; /* MARKER_API_S_VER_1 */
 
-struct mvm_statistics_dbg {
-        __le32 burst_check;
-        __le32 burst_count;
-        __le32 wait_for_silence_timeout_cnt;
-        __le32 reserved[3];
-} __packed; /* STATISTICS_DEBUG_API_S_VER_2 */
-
-struct mvm_statistics_div {
-        __le32 tx_on_a;
-        __le32 tx_on_b;
-        __le32 exec_time;
-        __le32 probe_time;
-        __le32 rssi_ant;
-        __le32 reserved2;
-} __packed; /* STATISTICS_SLOW_DIV_API_S_VER_2 */
-
-struct mvm_statistics_general_common {
-        __le32 temperature;   /* radio temperature */
-        __le32 temperature_m; /* radio voltage */
-        struct mvm_statistics_dbg dbg;
-        __le32 sleep_time;
-        __le32 slots_out;
-        __le32 slots_idle;
-        __le32 ttl_timestamp;
-        struct mvm_statistics_div div;
-        __le32 rx_enable_counter;
-        /*
-         * num_of_sos_states:
-         *  count the number of times we have to re-tune
-         *  in order to get out of bad PHY status
-         */
-        __le32 num_of_sos_states;
-} __packed; /* STATISTICS_GENERAL_API_S_VER_5 */
-
-struct mvm_statistics_rx_non_phy {
-        __le32 bogus_cts;       /* CTS received when not expecting CTS */
-        __le32 bogus_ack;       /* ACK received when not expecting ACK */
-        __le32 non_bssid_frames;        /* number of frames with BSSID that
-                                         * doesn't belong to the STA BSSID */
-        __le32 filtered_frames; /* count frames that were dumped in the
-                                 * filtering process */
-        __le32 non_channel_beacons;     /* beacons with our bss id but not on
-                                         * our serving channel */
-        __le32 channel_beacons; /* beacons with our bss id and in our
-                                 * serving channel */
-        __le32 num_missed_bcon; /* number of missed beacons */
-        __le32 adc_rx_saturation_time;  /* count in 0.8us units the time the
-                                         * ADC was in saturation */
-        __le32 ina_detection_search_time;/* total time (in 0.8us) searched
-                                          * for INA */
-        __le32 beacon_silence_rssi_a;   /* RSSI silence after beacon frame */
-        __le32 beacon_silence_rssi_b;   /* RSSI silence after beacon frame */
-        __le32 beacon_silence_rssi_c;   /* RSSI silence after beacon frame */
-        __le32 interference_data_flag;  /* flag for interference data
-                                         * availability. 1 when data is
-                                         * available. */
-        __le32 channel_load;            /* counts RX Enable time in uSec */
-        __le32 dsp_false_alarms;        /* DSP false alarm (both OFDM
-                                         * and CCK) counter */
-        __le32 beacon_rssi_a;
-        __le32 beacon_rssi_b;
-        __le32 beacon_rssi_c;
-        __le32 beacon_energy_a;
-        __le32 beacon_energy_b;
-        __le32 beacon_energy_c;
-        __le32 num_bt_kills;
-        __le32 mac_id;
-        __le32 directed_data_mpdu;
-} __packed; /* STATISTICS_RX_NON_PHY_API_S_VER_3 */
-
-struct mvm_statistics_rx_phy {
-        __le32 ina_cnt;
-        __le32 fina_cnt;
-        __le32 plcp_err;
-        __le32 crc32_err;
-        __le32 overrun_err;
-        __le32 early_overrun_err;
-        __le32 crc32_good;
-        __le32 false_alarm_cnt;
-        __le32 fina_sync_err_cnt;
-        __le32 sfd_timeout;
-        __le32 fina_timeout;
-        __le32 unresponded_rts;
-        __le32 rxe_frame_limit_overrun;
-        __le32 sent_ack_cnt;
-        __le32 sent_cts_cnt;
-        __le32 sent_ba_rsp_cnt;
-        __le32 dsp_self_kill;
-        __le32 mh_format_err;
-        __le32 re_acq_main_rssi_sum;
-        __le32 reserved;
-} __packed; /* STATISTICS_RX_PHY_API_S_VER_2 */
-
-struct mvm_statistics_rx_ht_phy {
-        __le32 plcp_err;
-        __le32 overrun_err;
-        __le32 early_overrun_err;
-        __le32 crc32_good;
-        __le32 crc32_err;
-        __le32 mh_format_err;
-        __le32 agg_crc32_good;
-        __le32 agg_mpdu_cnt;
-        __le32 agg_cnt;
-        __le32 unsupport_mcs;
-} __packed;  /* STATISTICS_HT_RX_PHY_API_S_VER_1 */
-
-#define MAX_CHAINS 3
-
-struct mvm_statistics_tx_non_phy_agg {
-        __le32 ba_timeout;
-        __le32 ba_reschedule_frames;
-        __le32 scd_query_agg_frame_cnt;
-        __le32 scd_query_no_agg;
-        __le32 scd_query_agg;
-        __le32 scd_query_mismatch;
-        __le32 frame_not_ready;
-        __le32 underrun;
-        __le32 bt_prio_kill;
-        __le32 rx_ba_rsp_cnt;
-        __s8 txpower[MAX_CHAINS];
-        __s8 reserved;
-        __le32 reserved2;
-} __packed; /* STATISTICS_TX_NON_PHY_AGG_API_S_VER_1 */
-
-struct mvm_statistics_tx_channel_width {
-        __le32 ext_cca_narrow_ch20[1];
-        __le32 ext_cca_narrow_ch40[2];
-        __le32 ext_cca_narrow_ch80[3];
-        __le32 ext_cca_narrow_ch160[4];
-        __le32 last_tx_ch_width_indx;
-        __le32 rx_detected_per_ch_width[4];
-        __le32 success_per_ch_width[4];
-        __le32 fail_per_ch_width[4];
-}; /* STATISTICS_TX_CHANNEL_WIDTH_API_S_VER_1 */
-
-struct mvm_statistics_tx {
-        __le32 preamble_cnt;
-        __le32 rx_detected_cnt;
-        __le32 bt_prio_defer_cnt;
-        __le32 bt_prio_kill_cnt;
-        __le32 few_bytes_cnt;
-        __le32 cts_timeout;
-        __le32 ack_timeout;
-        __le32 expected_ack_cnt;
-        __le32 actual_ack_cnt;
-        __le32 dump_msdu_cnt;
-        __le32 burst_abort_next_frame_mismatch_cnt;
-        __le32 burst_abort_missing_next_frame_cnt;
-        __le32 cts_timeout_collision;
-        __le32 ack_or_ba_timeout_collision;
-        struct mvm_statistics_tx_non_phy_agg agg;
-        struct mvm_statistics_tx_channel_width channel_width;
-} __packed; /* STATISTICS_TX_API_S_VER_4 */
-
-
-struct mvm_statistics_bt_activity {
-        __le32 hi_priority_tx_req_cnt;
-        __le32 hi_priority_tx_denied_cnt;
-        __le32 lo_priority_tx_req_cnt;
-        __le32 lo_priority_tx_denied_cnt;
-        __le32 hi_priority_rx_req_cnt;
-        __le32 hi_priority_rx_denied_cnt;
-        __le32 lo_priority_rx_req_cnt;
-        __le32 lo_priority_rx_denied_cnt;
-} __packed;  /* STATISTICS_BT_ACTIVITY_API_S_VER_1 */
-
-struct mvm_statistics_general {
-        struct mvm_statistics_general_common common;
-        __le32 beacon_filtered;
-        __le32 missed_beacons;
-        __s8 beacon_filter_average_energy;
-        __s8 beacon_filter_reason;
-        __s8 beacon_filter_current_energy;
-        __s8 beacon_filter_reserved;
-        __le32 beacon_filter_delta_time;
-        struct mvm_statistics_bt_activity bt_activity;
-} __packed; /* STATISTICS_GENERAL_API_S_VER_5 */
-
-struct mvm_statistics_rx {
-        struct mvm_statistics_rx_phy ofdm;
-        struct mvm_statistics_rx_phy cck;
-        struct mvm_statistics_rx_non_phy general;
-        struct mvm_statistics_rx_ht_phy ofdm_ht;
-} __packed; /* STATISTICS_RX_API_S_VER_3 */
-
-/*
- * STATISTICS_NOTIFICATION = 0x9d (notification only, not a command)
- *
- * By default, uCode issues this notification after receiving a beacon
- * while associated.  To disable this behavior, set DISABLE_NOTIF flag in the
- * REPLY_STATISTICS_CMD 0x9c, above.
- *
- * Statistics counters continue to increment beacon after beacon, but are
- * cleared when changing channels or when driver issues REPLY_STATISTICS_CMD
- * 0x9c with CLEAR_STATS bit set (see above).
- *
- * uCode also issues this notification during scans.  uCode clears statistics
- * appropriately so that each notification contains statistics for only the
- * one channel that has just been scanned.
- */
-
-struct iwl_notif_statistics { /* STATISTICS_NTFY_API_S_VER_8 */
-        __le32 flag;
-        struct mvm_statistics_rx rx;
-        struct mvm_statistics_tx tx;
-        struct mvm_statistics_general general;
-} __packed;
-
 /***********************************
  * Smart Fifo API
  ***********************************/
@@ -1680,63 +1476,6 @@ struct iwl_dts_measurement_notif {
         __le32 voltage;
 } __packed; /* TEMPERATURE_MEASUREMENT_TRIGGER_NTFY_S */
 
-/**
- * enum iwl_scd_control - scheduler config command control flags
- * @IWL_SCD_CONTROL_RM_TID: remove TID from this queue
- * @IWL_SCD_CONTROL_SET_SSN: use the SSN and program it into HW
- */
-enum iwl_scd_control {
-        IWL_SCD_CONTROL_RM_TID  = BIT(4),
-        IWL_SCD_CONTROL_SET_SSN = BIT(5),
-};
-
-/**
- * enum iwl_scd_flags - scheduler config command flags
- * @IWL_SCD_FLAGS_SHARE_TID: multiple TIDs map to this queue
- * @IWL_SCD_FLAGS_SHARE_RA: multiple RAs map to this queue
- * @IWL_SCD_FLAGS_DQA_ENABLED: DQA is enabled
- */
-enum iwl_scd_flags {
-        IWL_SCD_FLAGS_SHARE_TID         = BIT(0),
-        IWL_SCD_FLAGS_SHARE_RA          = BIT(1),
-        IWL_SCD_FLAGS_DQA_ENABLED       = BIT(2),
-};
-
-#define IWL_SCDQ_INVALID_STA    0xff
-
-/**
- * struct iwl_scd_txq_cfg_cmd - New txq hw scheduler config command
- * @token:      dialog token addba - unused legacy
- * @sta_id:     station id 4-bit
- * @tid:        TID 0..7
- * @scd_queue:  TFD queue num 0 .. 31
- * @enable:     1 queue enable, 0 queue disable
- * @aggregate:  1 aggregated queue, 0 otherwise
- * @tx_fifo:    tx fifo num 0..7
- * @window:     up to 64
- * @ssn:        starting seq num 12-bit
- * @control:    command control flags
- * @flags:      flags - see &enum iwl_scd_flags
- *
- * Note that every time the command is sent, all parameters must
- * be filled with the exception of
- *  - the SSN, which is only used with @IWL_SCD_CONTROL_SET_SSN
- *  - the window, which is only relevant when starting aggregation
- */
-struct iwl_scd_txq_cfg_cmd {
-        u8 token;
-        u8 sta_id;
-        u8 tid;
-        u8 scd_queue;
-        u8 enable;
-        u8 aggregate;
-        u8 tx_fifo;
-        u8 window;
-        __le16 ssn;
-        u8 control;
-        u8 flags;
-} __packed;
-
 /***********************************
  * TDLS API
  ***********************************/
@@ -1878,4 +1617,36 @@ struct iwl_tdls_config_res {
         struct iwl_tdls_config_sta_info_res sta_info[IWL_MVM_TDLS_STA_COUNT];
 } __packed; /* TDLS_CONFIG_RSP_API_S_VER_1 */
 
+#define TX_FIFO_MAX_NUM         8
+#define RX_FIFO_MAX_NUM         2
+
+/**
+ * Shared memory configuration information from the FW
+ *
+ * @shared_mem_addr: shared memory addr (pre 8000 HW set to 0x0 as MARBH is not
+ *      accessible)
+ * @shared_mem_size: shared memory size
+ * @sample_buff_addr: internal sample (mon/adc) buff addr (pre 8000 HW set to
+ *      0x0 as accessible only via DBGM RDAT)
+ * @sample_buff_size: internal sample buff size
+ * @txfifo_addr: start addr of TXF0 (excluding the context table 0.5KB), (pre
+ *      8000 HW set to 0x0 as not accessible)
+ * @txfifo_size: size of TXF0 ... TXF7
+ * @rxfifo_size: RXF1, RXF2 sizes. If there is no RXF2, it'll have a value of 0
+ * @page_buff_addr: used by UMAC and performance debug (page miss analysis),
+ *      when paging is not supported this should be 0
+ * @page_buff_size: size of %page_buff_addr
+ */
+struct iwl_shared_mem_cfg {
+        __le32 shared_mem_addr;
+        __le32 shared_mem_size;
+        __le32 sample_buff_addr;
+        __le32 sample_buff_size;
+        __le32 txfifo_addr;
+        __le32 txfifo_size[TX_FIFO_MAX_NUM];
+        __le32 rxfifo_size[RX_FIFO_MAX_NUM];
+        __le32 page_buff_addr;
+        __le32 page_buff_size;
+} __packed; /* SHARED_MEM_ALLOC_API_S_VER_1 */
+
 #endif /* __fw_api_h__ */
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw.c b/drivers/net/wireless/iwlwifi/mvm/fw.c
index d0fa6e9ed590..a322a5e3d31b 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/iwlwifi/mvm/fw.c
@@ -70,6 +70,7 @@
 #include "iwl-debug.h"
 #include "iwl-csr.h" /* for iwl_mvm_rx_card_state_notif */
 #include "iwl-io.h" /* for iwl_mvm_rx_card_state_notif */
+#include "iwl-prph.h"
 #include "iwl-eeprom-parse.h"
 
 #include "mvm.h"
@@ -269,7 +270,7 @@ static int iwl_send_phy_cfg_cmd(struct iwl_mvm *mvm)
         enum iwl_ucode_type ucode_type = mvm->cur_ucode;
 
         /* Set parameters */
-        phy_cfg_cmd.phy_cfg = cpu_to_le32(mvm->fw->phy_config);
+        phy_cfg_cmd.phy_cfg = cpu_to_le32(iwl_mvm_get_phy_config(mvm));
         phy_cfg_cmd.calib_control.event_trigger =
                 mvm->fw->default_calib[ucode_type].event_trigger;
         phy_cfg_cmd.calib_control.flow_trigger =
@@ -346,7 +347,7 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
         mvm->calibrating = true;
 
         /* Send TX valid antennas before triggering calibrations */
-        ret = iwl_send_tx_ant_cfg(mvm, mvm->fw->valid_tx_ant);
+        ret = iwl_send_tx_ant_cfg(mvm, iwl_mvm_get_valid_tx_ant(mvm));
         if (ret)
                 goto error;
 
@@ -399,8 +400,71 @@ out:
         return ret;
 }
 
-static int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm,
-                                     enum iwl_fw_dbg_conf conf_id)
+static void iwl_mvm_get_shared_mem_conf(struct iwl_mvm *mvm)
+{
+        struct iwl_host_cmd cmd = {
+                .id = SHARED_MEM_CFG,
+                .flags = CMD_WANT_SKB,
+                .data = { NULL, },
+                .len = { 0, },
+        };
+        struct iwl_rx_packet *pkt;
+        struct iwl_shared_mem_cfg *mem_cfg;
+        u32 i;
+
+        lockdep_assert_held(&mvm->mutex);
+
+        if (WARN_ON(iwl_mvm_send_cmd(mvm, &cmd)))
+                return;
+
+        pkt = cmd.resp_pkt;
+        if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
+                IWL_ERR(mvm, "Bad return from SHARED_MEM_CFG (0x%08X)\n",
+                        pkt->hdr.flags);
+                goto exit;
+        }
+
+        mem_cfg = (void *)pkt->data;
+
+        mvm->shared_mem_cfg.shared_mem_addr =
+                le32_to_cpu(mem_cfg->shared_mem_addr);
+        mvm->shared_mem_cfg.shared_mem_size =
+                le32_to_cpu(mem_cfg->shared_mem_size);
+        mvm->shared_mem_cfg.sample_buff_addr =
+                le32_to_cpu(mem_cfg->sample_buff_addr);
+        mvm->shared_mem_cfg.sample_buff_size =
+                le32_to_cpu(mem_cfg->sample_buff_size);
+        mvm->shared_mem_cfg.txfifo_addr = le32_to_cpu(mem_cfg->txfifo_addr);
+        for (i = 0; i < ARRAY_SIZE(mvm->shared_mem_cfg.txfifo_size); i++)
+                mvm->shared_mem_cfg.txfifo_size[i] =
+                        le32_to_cpu(mem_cfg->txfifo_size[i]);
+        for (i = 0; i < ARRAY_SIZE(mvm->shared_mem_cfg.rxfifo_size); i++)
+                mvm->shared_mem_cfg.rxfifo_size[i] =
+                        le32_to_cpu(mem_cfg->rxfifo_size[i]);
+        mvm->shared_mem_cfg.page_buff_addr =
+                le32_to_cpu(mem_cfg->page_buff_addr);
+        mvm->shared_mem_cfg.page_buff_size =
+                le32_to_cpu(mem_cfg->page_buff_size);
+        IWL_DEBUG_INFO(mvm, "SHARED MEM CFG: got memory offsets/sizes\n");
+
+exit:
+        iwl_free_resp(&cmd);
+}
+
+void iwl_mvm_fw_dbg_collect(struct iwl_mvm *mvm)
+{
+        /* stop recording */
+        if (mvm->cfg->device_family == IWL_DEVICE_FAMILY_7000) {
+                iwl_set_bits_prph(mvm->trans, MON_BUFF_SAMPLE_CTL, 0x100);
+        } else {
+                iwl_write_prph(mvm->trans, DBGC_IN_SAMPLE, 0);
+                iwl_write_prph(mvm->trans, DBGC_OUT_CTRL, 0);
+        }
+
+        schedule_work(&mvm->fw_error_dump_wk);
+}
+
+int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm, enum iwl_fw_dbg_conf conf_id)
 {
         u8 *ptr;
         int ret;
@@ -435,6 +499,35 @@ static int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm,
         return ret;
 }
 
+static int iwl_mvm_config_ltr_v1(struct iwl_mvm *mvm)
+{
+        struct iwl_ltr_config_cmd_v1 cmd_v1 = {
+                .flags = cpu_to_le32(LTR_CFG_FLAG_FEATURE_ENABLE),
+        };
+
+        if (!mvm->trans->ltr_enabled)
+                return 0;
+
+        return iwl_mvm_send_cmd_pdu(mvm, LTR_CONFIG, 0,
+                                    sizeof(cmd_v1), &cmd_v1);
+}
+
+static int iwl_mvm_config_ltr(struct iwl_mvm *mvm)
+{
+        struct iwl_ltr_config_cmd cmd = {
+                .flags = cpu_to_le32(LTR_CFG_FLAG_FEATURE_ENABLE),
+        };
+
+        if (!mvm->trans->ltr_enabled)
+                return 0;
+
+        if (!(mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_HDC_PHASE_0))
+                return iwl_mvm_config_ltr_v1(mvm);
+
+        return iwl_mvm_send_cmd_pdu(mvm, LTR_CONFIG, 0,
+                                    sizeof(cmd), &cmd);
+}
+
 int iwl_mvm_up(struct iwl_mvm *mvm)
 {
         int ret, i;
@@ -482,6 +575,8 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
                 goto error;
         }
 
+        iwl_mvm_get_shared_mem_conf(mvm);
+
         ret = iwl_mvm_sf_update(mvm, NULL, false);
         if (ret)
                 IWL_ERR(mvm, "Failed to initialize Smart Fifo\n");
@@ -489,7 +584,7 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
         mvm->fw_dbg_conf = FW_DBG_INVALID;
         iwl_mvm_start_fw_dbg_conf(mvm, FW_DBG_CUSTOM);
 
-        ret = iwl_send_tx_ant_cfg(mvm, mvm->fw->valid_tx_ant);
+        ret = iwl_send_tx_ant_cfg(mvm, iwl_mvm_get_valid_tx_ant(mvm));
         if (ret)
                 goto error;
 
@@ -538,14 +633,7 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
         /* Initialize tx backoffs to the minimal possible */
         iwl_mvm_tt_tx_backoff(mvm, 0);
 
-        if (mvm->trans->ltr_enabled) {
-                struct iwl_ltr_config_cmd cmd = {
-                        .flags = cpu_to_le32(LTR_CFG_FLAG_FEATURE_ENABLE),
-                };
-
-                WARN_ON(iwl_mvm_send_cmd_pdu(mvm, LTR_CONFIG, 0,
-                                             sizeof(cmd), &cmd));
-        }
+        WARN_ON(iwl_mvm_config_ltr(mvm));
 
         ret = iwl_mvm_power_update_device(mvm);
         if (ret)
@@ -584,7 +672,7 @@ int iwl_mvm_load_d3_fw(struct iwl_mvm *mvm)
                 goto error;
         }
 
-        ret = iwl_send_tx_ant_cfg(mvm, mvm->fw->valid_tx_ant);
+        ret = iwl_send_tx_ant_cfg(mvm, iwl_mvm_get_valid_tx_ant(mvm));
         if (ret)
                 goto error;
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
index f6d86ccce6a8..8bf78fa8ace0 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
@@ -208,8 +208,10 @@ u32 iwl_mvm_mac_get_queues_mask(struct ieee80211_vif *vif)
         if (vif->type == NL80211_IFTYPE_P2P_DEVICE)
                 return BIT(IWL_MVM_OFFCHANNEL_QUEUE);
 
-        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
-                qmask |= BIT(vif->hw_queue[ac]);
+        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+                if (vif->hw_queue[ac] != IEEE80211_INVAL_HW_QUEUE)
+                        qmask |= BIT(vif->hw_queue[ac]);
+        }
 
         if (vif->type == NL80211_IFTYPE_AP)
                 qmask |= BIT(vif->cab_queue);
@@ -496,14 +498,14 @@ void iwl_mvm_mac_ctxt_release(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 
         switch (vif->type) {
         case NL80211_IFTYPE_P2P_DEVICE:
-                iwl_mvm_disable_txq(mvm, IWL_MVM_OFFCHANNEL_QUEUE);
+                iwl_mvm_disable_txq(mvm, IWL_MVM_OFFCHANNEL_QUEUE, 0);
                 break;
         case NL80211_IFTYPE_AP:
-                iwl_mvm_disable_txq(mvm, vif->cab_queue);
+                iwl_mvm_disable_txq(mvm, vif->cab_queue, 0);
                 /* fall through */
         default:
                 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
-                        iwl_mvm_disable_txq(mvm, vif->hw_queue[ac]);
+                        iwl_mvm_disable_txq(mvm, vif->hw_queue[ac], 0);
         }
 }
 
@@ -975,7 +977,7 @@ static int iwl_mvm_mac_ctxt_send_beacon(struct iwl_mvm *mvm,
         beacon_cmd.tx.tx_flags = cpu_to_le32(tx_flags);
 
         mvm->mgmt_last_antenna_idx =
-                iwl_mvm_next_antenna(mvm, mvm->fw->valid_tx_ant,
+                iwl_mvm_next_antenna(mvm, iwl_mvm_get_valid_tx_ant(mvm),
                                      mvm->mgmt_last_antenna_idx);
 
         beacon_cmd.tx.rate_n_flags =
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 17358a88e26d..cef6f3373542 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -85,6 +85,7 @@
 #include "testmode.h"
 #include "iwl-fw-error-dump.h"
 #include "iwl-prph.h"
+#include "iwl-csr.h"
 
 static const struct ieee80211_iface_limit iwl_mvm_limits[] = {
         {
@@ -105,7 +106,7 @@ static const struct ieee80211_iface_limit iwl_mvm_limits[] = {
 
 static const struct ieee80211_iface_combination iwl_mvm_iface_combinations[] = {
         {
-                .num_different_channels = 1,
+                .num_different_channels = 2,
                 .max_interfaces = 3,
                 .limits = iwl_mvm_limits,
                 .n_limits = ARRAY_SIZE(iwl_mvm_limits),
@@ -372,6 +373,8 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
 
         hw->wiphy->max_remain_on_channel_duration = 10000;
         hw->max_listen_interval = IWL_CONN_MAX_LISTEN_INTERVAL;
+        /* we can compensate an offset of up to 3 channels = 15 MHz */
+        hw->wiphy->max_adj_channel_rssi_comp = 3 * 5;
 
         /* Extract MAC address */
         memcpy(mvm->addresses[0].addr, mvm->nvm_data->hw_addr, ETH_ALEN);
@@ -454,15 +457,17 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
             device_can_wakeup(mvm->trans->dev)) {
                 mvm->wowlan.flags = WIPHY_WOWLAN_ANY;
                 hw->wiphy->wowlan = &mvm->wowlan;
-        } else if (mvm->fw->img[IWL_UCODE_WOWLAN].sec[0].len &&
+        }
+
+        if (mvm->fw->img[IWL_UCODE_WOWLAN].sec[0].len &&
             mvm->trans->ops->d3_suspend &&
             mvm->trans->ops->d3_resume &&
             device_can_wakeup(mvm->trans->dev)) {
-                mvm->wowlan.flags = WIPHY_WOWLAN_MAGIC_PKT |
-                                    WIPHY_WOWLAN_DISCONNECT |
-                                    WIPHY_WOWLAN_EAP_IDENTITY_REQ |
-                                    WIPHY_WOWLAN_RFKILL_RELEASE |
-                                    WIPHY_WOWLAN_NET_DETECT;
+                mvm->wowlan.flags |= WIPHY_WOWLAN_MAGIC_PKT |
+                                     WIPHY_WOWLAN_DISCONNECT |
+                                     WIPHY_WOWLAN_EAP_IDENTITY_REQ |
+                                     WIPHY_WOWLAN_RFKILL_RELEASE |
+                                     WIPHY_WOWLAN_NET_DETECT;
                 if (!iwlwifi_mod_params.sw_crypto)
                         mvm->wowlan.flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY |
                                              WIPHY_WOWLAN_GTK_REKEY_FAILURE |
@@ -756,41 +761,215 @@ static void iwl_mvm_free_coredump(const void *data)
         kfree(fw_error_dump);
 }
 
+static void iwl_mvm_dump_fifos(struct iwl_mvm *mvm,
+                               struct iwl_fw_error_dump_data **dump_data)
+{
+        struct iwl_fw_error_dump_fifo *fifo_hdr;
+        u32 *fifo_data;
+        u32 fifo_len;
+        unsigned long flags;
+        int i, j;
+
+        if (!iwl_trans_grab_nic_access(mvm->trans, false, &flags))
+                return;
+
+        /* Pull RXF data from all RXFs */
+        for (i = 0; i < ARRAY_SIZE(mvm->shared_mem_cfg.rxfifo_size); i++) {
+                /*
+                 * Keep aside the additional offset that might be needed for
+                 * next RXF
+                 */
+                u32 offset_diff = RXF_DIFF_FROM_PREV * i;
+
+                fifo_hdr = (void *)(*dump_data)->data;
+                fifo_data = (void *)fifo_hdr->data;
+                fifo_len = mvm->shared_mem_cfg.rxfifo_size[i];
+
+                /* No need to try to read the data if the length is 0 */
+                if (fifo_len == 0)
+                        continue;
+
+                /* Add a TLV for the RXF */
+                (*dump_data)->type = cpu_to_le32(IWL_FW_ERROR_DUMP_RXF);
+                (*dump_data)->len = cpu_to_le32(fifo_len + sizeof(*fifo_hdr));
+
+                fifo_hdr->fifo_num = cpu_to_le32(i);
+                fifo_hdr->available_bytes =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        RXF_RD_D_SPACE +
+                                                        offset_diff));
+                fifo_hdr->wr_ptr =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        RXF_RD_WR_PTR +
+                                                        offset_diff));
+                fifo_hdr->rd_ptr =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        RXF_RD_RD_PTR +
+                                                        offset_diff));
+                fifo_hdr->fence_ptr =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        RXF_RD_FENCE_PTR +
+                                                        offset_diff));
+                fifo_hdr->fence_mode =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        RXF_SET_FENCE_MODE +
+                                                        offset_diff));
+
+                /* Lock fence */
+                iwl_trans_write_prph(mvm->trans,
+                                     RXF_SET_FENCE_MODE + offset_diff, 0x1);
+                /* Set fence pointer to the same place like WR pointer */
+                iwl_trans_write_prph(mvm->trans,
+                                     RXF_LD_WR2FENCE + offset_diff, 0x1);
+                /* Set fence offset */
+                iwl_trans_write_prph(mvm->trans,
+                                     RXF_LD_FENCE_OFFSET_ADDR + offset_diff,
+                                     0x0);
+
+                /* Read FIFO */
+                fifo_len /= sizeof(u32); /* Size in DWORDS */
+                for (j = 0; j < fifo_len; j++)
+                        fifo_data[j] = iwl_trans_read_prph(mvm->trans,
+                                                         RXF_FIFO_RD_FENCE_INC +
+                                                         offset_diff);
+                *dump_data = iwl_fw_error_next_data(*dump_data);
+        }
+
+        /* Pull TXF data from all TXFs */
+        for (i = 0; i < ARRAY_SIZE(mvm->shared_mem_cfg.txfifo_size); i++) {
+                /* Mark the number of TXF we're pulling now */
+                iwl_trans_write_prph(mvm->trans, TXF_LARC_NUM, i);
+
+                fifo_hdr = (void *)(*dump_data)->data;
+                fifo_data = (void *)fifo_hdr->data;
+                fifo_len = mvm->shared_mem_cfg.txfifo_size[i];
+
+                /* No need to try to read the data if the length is 0 */
+                if (fifo_len == 0)
+                        continue;
+
+                /* Add a TLV for the FIFO */
+                (*dump_data)->type = cpu_to_le32(IWL_FW_ERROR_DUMP_TXF);
+                (*dump_data)->len = cpu_to_le32(fifo_len + sizeof(*fifo_hdr));
+
+                fifo_hdr->fifo_num = cpu_to_le32(i);
+                fifo_hdr->available_bytes =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        TXF_FIFO_ITEM_CNT));
+                fifo_hdr->wr_ptr =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        TXF_WR_PTR));
+                fifo_hdr->rd_ptr =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        TXF_RD_PTR));
+                fifo_hdr->fence_ptr =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        TXF_FENCE_PTR));
+                fifo_hdr->fence_mode =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        TXF_LOCK_FENCE));
+
+                /* Set the TXF_READ_MODIFY_ADDR to TXF_WR_PTR */
+                iwl_trans_write_prph(mvm->trans, TXF_READ_MODIFY_ADDR,
+                                     TXF_WR_PTR);
+
+                /* Dummy-read to advance the read pointer to the head */
+                iwl_trans_read_prph(mvm->trans, TXF_READ_MODIFY_DATA);
+
+                /* Read FIFO */
+                fifo_len /= sizeof(u32); /* Size in DWORDS */
+                for (j = 0; j < fifo_len; j++)
+                        fifo_data[j] = iwl_trans_read_prph(mvm->trans,
+                                                          TXF_READ_MODIFY_DATA);
+                *dump_data = iwl_fw_error_next_data(*dump_data);
+        }
+
+        iwl_trans_release_nic_access(mvm->trans, &flags);
+}
+
 void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm)
 {
         struct iwl_fw_error_dump_file *dump_file;
         struct iwl_fw_error_dump_data *dump_data;
         struct iwl_fw_error_dump_info *dump_info;
+        struct iwl_fw_error_dump_mem *dump_mem;
         struct iwl_mvm_dump_ptrs *fw_error_dump;
-        const struct fw_img *img;
         u32 sram_len, sram_ofs;
-        u32 file_len, rxf_len;
-        unsigned long flags;
-        int reg_val;
+        u32 file_len, fifo_data_len = 0;
+        u32 smem_len = mvm->cfg->smem_len;
+        u32 sram2_len = mvm->cfg->dccm2_len;
 
         lockdep_assert_held(&mvm->mutex);
 
+        /* W/A for 8000 HW family A-step */
+        if (mvm->cfg->device_family == IWL_DEVICE_FAMILY_8000 &&
+            CSR_HW_REV_STEP(mvm->trans->hw_rev) == SILICON_A_STEP) {
+                if (smem_len)
+                        smem_len = 0x38000;
+
+                if (sram2_len)
+                        sram2_len = 0x10000;
+        }
+
         fw_error_dump = kzalloc(sizeof(*fw_error_dump), GFP_KERNEL);
         if (!fw_error_dump)
                 return;
 
-        img = &mvm->fw->img[mvm->cur_ucode];
-        sram_ofs = img->sec[IWL_UCODE_SECTION_DATA].offset;
-        sram_len = img->sec[IWL_UCODE_SECTION_DATA].len;
+        /* SRAM - include stack CCM if driver knows the values for it */
+        if (!mvm->cfg->dccm_offset || !mvm->cfg->dccm_len) {
+                const struct fw_img *img;
+
+                img = &mvm->fw->img[mvm->cur_ucode];
+                sram_ofs = img->sec[IWL_UCODE_SECTION_DATA].offset;
+                sram_len = img->sec[IWL_UCODE_SECTION_DATA].len;
+        } else {
+                sram_ofs = mvm->cfg->dccm_offset;
+                sram_len = mvm->cfg->dccm_len;
+        }
+
+        /* reading RXF/TXF sizes */
+        if (test_bit(STATUS_FW_ERROR, &mvm->trans->status)) {
+                struct iwl_mvm_shared_mem_cfg *mem_cfg = &mvm->shared_mem_cfg;
+                int i;
+
+                fifo_data_len = 0;
+
+                /* Count RXF size */
+                for (i = 0; i < ARRAY_SIZE(mem_cfg->rxfifo_size); i++) {
+                        if (!mem_cfg->rxfifo_size[i])
+                                continue;
+
+                        /* Add header info */
+                        fifo_data_len += mem_cfg->rxfifo_size[i] +
+                                         sizeof(*dump_data) +
+                                         sizeof(struct iwl_fw_error_dump_fifo);
+                }
 
-        /* reading buffer size */
-        reg_val = iwl_trans_read_prph(mvm->trans, RXF_SIZE_ADDR);
-        rxf_len = (reg_val & RXF_SIZE_BYTE_CNT_MSK) >> RXF_SIZE_BYTE_CND_POS;
+                for (i = 0; i < ARRAY_SIZE(mem_cfg->txfifo_size); i++) {
+                        if (!mem_cfg->txfifo_size[i])
+                                continue;
 
-        /* the register holds the value divided by 128 */
-        rxf_len = rxf_len << 7;
+                        /* Add header info */
+                        fifo_data_len += mem_cfg->txfifo_size[i] +
+                                         sizeof(*dump_data) +
+                                         sizeof(struct iwl_fw_error_dump_fifo);
+                }
+        }
 
         file_len = sizeof(*dump_file) +
-                   sizeof(*dump_data) * 3 +
-                   sram_len +
-                   rxf_len +
+                   sizeof(*dump_data) * 2 +
+                   sram_len + sizeof(*dump_mem) +
+                   fifo_data_len +
                    sizeof(*dump_info);
 
+        /* Make room for the SMEM, if it exists */
+        if (smem_len)
+                file_len += sizeof(*dump_data) + sizeof(*dump_mem) + smem_len;
+
+        /* Make room for the secondary SRAM, if it exists */
+        if (sram2_len)
+                file_len += sizeof(*dump_data) + sizeof(*dump_mem) + sram2_len;
+
         dump_file = vzalloc(file_len);
         if (!dump_file) {
                 kfree(fw_error_dump);
@@ -809,6 +988,7 @@ void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm)
                 mvm->cfg->device_family == IWL_DEVICE_FAMILY_7000 ?
                         cpu_to_le32(IWL_FW_ERROR_DUMP_FAMILY_7) :
                         cpu_to_le32(IWL_FW_ERROR_DUMP_FAMILY_8);
+        dump_info->hw_step = cpu_to_le32(CSR_HW_REV_STEP(mvm->trans->hw_rev));
         memcpy(dump_info->fw_human_readable, mvm->fw->human_readable,
                sizeof(dump_info->fw_human_readable));
         strncpy(dump_info->dev_human_readable, mvm->cfg->name,
@@ -817,28 +997,39 @@ void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm)
                 sizeof(dump_info->bus_human_readable));
 
         dump_data = iwl_fw_error_next_data(dump_data);
-        dump_data->type = cpu_to_le32(IWL_FW_ERROR_DUMP_RXF);
-        dump_data->len = cpu_to_le32(rxf_len);
-
-        if (iwl_trans_grab_nic_access(mvm->trans, false, &flags)) {
-                u32 *rxf = (void *)dump_data->data;
-                int i;
+        /* We only dump the FIFOs if the FW is in error state */
+        if (test_bit(STATUS_FW_ERROR, &mvm->trans->status))
+                iwl_mvm_dump_fifos(mvm, &dump_data);
+
+        dump_data->type = cpu_to_le32(IWL_FW_ERROR_DUMP_MEM);
+        dump_data->len = cpu_to_le32(sram_len + sizeof(*dump_mem));
+        dump_mem = (void *)dump_data->data;
+        dump_mem->type = cpu_to_le32(IWL_FW_ERROR_DUMP_MEM_SRAM);
+        dump_mem->offset = cpu_to_le32(sram_ofs);
+        iwl_trans_read_mem_bytes(mvm->trans, sram_ofs, dump_mem->data,
+                                 sram_len);
 
-                for (i = 0; i < (rxf_len / sizeof(u32)); i++) {
-                        iwl_trans_write_prph(mvm->trans,
-                                             RXF_LD_FENCE_OFFSET_ADDR,
-                                             i * sizeof(u32));
-                        rxf[i] = iwl_trans_read_prph(mvm->trans,
-                                                     RXF_FIFO_RD_FENCE_ADDR);
-                }
-                iwl_trans_release_nic_access(mvm->trans, &flags);
+        if (smem_len) {
+                dump_data = iwl_fw_error_next_data(dump_data);
+                dump_data->type = cpu_to_le32(IWL_FW_ERROR_DUMP_MEM);
+                dump_data->len = cpu_to_le32(smem_len + sizeof(*dump_mem));
+                dump_mem = (void *)dump_data->data;
+                dump_mem->type = cpu_to_le32(IWL_FW_ERROR_DUMP_MEM_SMEM);
+                dump_mem->offset = cpu_to_le32(mvm->cfg->smem_offset);
+                iwl_trans_read_mem_bytes(mvm->trans, mvm->cfg->smem_offset,
+                                         dump_mem->data, smem_len);
         }
 
-        dump_data = iwl_fw_error_next_data(dump_data);
-        dump_data->type = cpu_to_le32(IWL_FW_ERROR_DUMP_SRAM);
-        dump_data->len = cpu_to_le32(sram_len);
-        iwl_trans_read_mem_bytes(mvm->trans, sram_ofs, dump_data->data,
-                                 sram_len);
+        if (sram2_len) {
+                dump_data = iwl_fw_error_next_data(dump_data);
+                dump_data->type = cpu_to_le32(IWL_FW_ERROR_DUMP_MEM);
+                dump_data->len = cpu_to_le32(sram2_len + sizeof(*dump_mem));
+                dump_mem = (void *)dump_data->data;
+                dump_mem->type = cpu_to_le32(IWL_FW_ERROR_DUMP_MEM_SRAM);
+                dump_mem->offset = cpu_to_le32(mvm->cfg->dccm2_offset);
+                iwl_trans_read_mem_bytes(mvm->trans, mvm->cfg->dccm2_offset,
+                                         dump_mem->data, sram2_len);
+        }
 
         fw_error_dump->trans_ptr = iwl_trans_dump_data(mvm->trans);
         fw_error_dump->op_mode_len = file_len;
@@ -859,6 +1050,11 @@ static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
         if (!test_and_clear_bit(IWL_MVM_STATUS_D3_RECONFIG, &mvm->status))
                 iwl_mvm_fw_error_dump(mvm);
 
+        /* cleanup all stale references (scan, roc), but keep the
+         * ucode_down ref until reconfig is complete
+         */
+        iwl_mvm_unref_all_except(mvm, IWL_MVM_REF_UCODE_DOWN);
+
         iwl_trans_stop_device(mvm->trans);
 
         mvm->scan_status = IWL_MVM_SCAN_NONE;
@@ -888,10 +1084,6 @@ static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
 
         ieee80211_wake_queues(mvm->hw);
 
-        /* cleanup all stale references (scan, roc), but keep the
-         * ucode_down ref until reconfig is complete */
-        iwl_mvm_unref_all_except(mvm, IWL_MVM_REF_UCODE_DOWN);
-
         /* clear any stale d0i3 state */
         clear_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status);
 
@@ -928,6 +1120,19 @@ static int iwl_mvm_mac_start(struct ieee80211_hw *hw)
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
         int ret;
 
+        /* Some hw restart cleanups must not hold the mutex */
+        if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
+                /*
+                 * Make sure we are out of d0i3. This is needed
+                 * to make sure the reference accounting is correct
+                 * (and there is no stale d0i3_exit_work).
+                 */
+                wait_event_timeout(mvm->d0i3_exit_waitq,
+                                   !test_bit(IWL_MVM_STATUS_IN_D0I3,
+                                             &mvm->status),
+                                   HZ);
+        }
+
         mutex_lock(&mvm->mutex);
         ret = __iwl_mvm_mac_start(mvm);
         mutex_unlock(&mvm->mutex);
@@ -977,6 +1182,13 @@ static void iwl_mvm_resume_complete(struct iwl_mvm *mvm)
                 IWL_DEBUG_RPM(mvm, "Run deferred d0i3 exit\n");
                 _iwl_mvm_exit_d0i3(mvm);
         }
+
+        if (mvm->trans->d0i3_mode == IWL_D0I3_MODE_ON_SUSPEND)
+                if (!wait_event_timeout(mvm->d0i3_exit_waitq,
+                                        !test_bit(IWL_MVM_STATUS_IN_D0I3,
+                                                  &mvm->status),
+                                        HZ))
+                        WARN_ONCE(1, "D0i3 exit on resume timed out\n");
 }
 
 static void
@@ -1153,10 +1365,6 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
                 mvm->bf_allowed_vif = mvmvif;
                 vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER |
                                      IEEE80211_VIF_SUPPORTS_CQM_RSSI;
-                if (mvm->fw->ucode_capa.flags &
-                                        IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT &&
-                    !iwlwifi_mod_params.uapsd_disable)
-                        vif->driver_flags |= IEEE80211_VIF_SUPPORTS_UAPSD;
         }
 
         /*
@@ -2087,7 +2295,7 @@ static void iwl_mvm_sta_pre_rcu_remove(struct ieee80211_hw *hw,
                                        struct ieee80211_sta *sta)
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
-        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
 
         /*
          * This is called before mac80211 does RCU synchronisation,
@@ -2104,6 +2312,20 @@ static void iwl_mvm_sta_pre_rcu_remove(struct ieee80211_hw *hw,
         mutex_unlock(&mvm->mutex);
 }
 
+static void iwl_mvm_check_uapsd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                                const u8 *bssid)
+{
+        if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT))
+                return;
+
+        if (iwlwifi_mod_params.uapsd_disable) {
+                vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
+                return;
+        }
+
+        vif->driver_flags |= IEEE80211_VIF_SUPPORTS_UAPSD;
+}
+
 static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
                                  struct ieee80211_vif *vif,
                                  struct ieee80211_sta *sta,
@@ -2163,6 +2385,7 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
                  * Reset EBS status here assuming environment has been changed.
                  */
                 mvm->last_ebs_successful = true;
+                iwl_mvm_check_uapsd(mvm, vif, sta->addr);
                 ret = 0;
         } else if (old_state == IEEE80211_STA_AUTH &&
                    new_state == IEEE80211_STA_ASSOC) {
@@ -3102,7 +3325,7 @@ static int iwl_mvm_set_tim(struct ieee80211_hw *hw,
                            bool set)
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
-        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
 
         if (!mvm_sta || !mvm_sta->vif) {
                 IWL_ERR(mvm, "Station is not associated to a vif\n");
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index d24660fb4ef2..979ac23522f2 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -276,6 +276,7 @@ enum iwl_mvm_ref_type {
         IWL_MVM_REF_TM_CMD,
         IWL_MVM_REF_EXIT_WORK,
         IWL_MVM_REF_PROTECT_CSA,
+        IWL_MVM_REF_FW_DBG_COLLECT,
 
         /* update debugfs.c when changing this */
 
@@ -535,6 +536,18 @@ enum iwl_mvm_tdls_cs_state {
         IWL_MVM_TDLS_SW_ACTIVE,
 };
 
+struct iwl_mvm_shared_mem_cfg {
+        u32 shared_mem_addr;
+        u32 shared_mem_size;
+        u32 sample_buff_addr;
+        u32 sample_buff_size;
+        u32 txfifo_addr;
+        u32 txfifo_size[TX_FIFO_MAX_NUM];
+        u32 rxfifo_size[RX_FIFO_MAX_NUM];
+        u32 page_buff_addr;
+        u32 page_buff_size;
+};
+
 struct iwl_mvm {
         /* for logger access */
         struct device *dev;
@@ -641,6 +654,8 @@ struct iwl_mvm {
         bool disable_power_off;
         bool disable_power_off_d3;
 
+        bool scan_iter_notif_enabled;
+
         struct debugfs_blob_wrapper nvm_hw_blob;
         struct debugfs_blob_wrapper nvm_sw_blob;
         struct debugfs_blob_wrapper nvm_calib_blob;
@@ -784,6 +799,8 @@ struct iwl_mvm {
                         u32 ch_sw_tm_ie;
                 } peer;
         } tdls_cs;
+
+        struct iwl_mvm_shared_mem_cfg shared_mem_cfg;
 };
 
 /* Extract MVM priv from op_mode and _hw */
@@ -850,12 +867,14 @@ iwl_mvm_sta_from_staid_protected(struct iwl_mvm *mvm, u8 sta_id)
 static inline bool iwl_mvm_is_d0i3_supported(struct iwl_mvm *mvm)
 {
         return mvm->trans->cfg->d0i3 &&
+               mvm->trans->d0i3_mode != IWL_D0I3_MODE_OFF &&
+               !iwlwifi_mod_params.d0i3_disable &&
                (mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_D0I3_SUPPORT);
 }
 
-static inline bool iwl_mvm_is_dqa_supported(struct iwl_mvm *mvm)
+static inline bool iwl_mvm_is_scd_cfg_supported(struct iwl_mvm *mvm)
 {
-        return mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_DQA_SUPPORT;
+        return mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_API_SCD_CFG;
 }
 
 extern const u8 iwl_mvm_ac_to_tx_fifo[];
@@ -937,6 +956,33 @@ int iwl_mvm_rx_statistics(struct iwl_mvm *mvm,
 int iwl_nvm_init(struct iwl_mvm *mvm, bool read_nvm_from_nic);
 int iwl_mvm_load_nvm_to_nic(struct iwl_mvm *mvm);
 
+static inline u8 iwl_mvm_get_valid_tx_ant(struct iwl_mvm *mvm)
+{
+        return mvm->nvm_data && mvm->nvm_data->valid_tx_ant ?
+               mvm->fw->valid_tx_ant & mvm->nvm_data->valid_tx_ant :
+               mvm->fw->valid_tx_ant;
+}
+
+static inline u8 iwl_mvm_get_valid_rx_ant(struct iwl_mvm *mvm)
+{
+        return mvm->nvm_data && mvm->nvm_data->valid_rx_ant ?
+               mvm->fw->valid_rx_ant & mvm->nvm_data->valid_rx_ant :
+               mvm->fw->valid_rx_ant;
+}
+
+static inline u32 iwl_mvm_get_phy_config(struct iwl_mvm *mvm)
+{
+        u32 phy_config = ~(FW_PHY_CFG_TX_CHAIN |
+                           FW_PHY_CFG_RX_CHAIN);
+        u32 valid_rx_ant = iwl_mvm_get_valid_rx_ant(mvm);
+        u32 valid_tx_ant = iwl_mvm_get_valid_tx_ant(mvm);
+
+        phy_config |= valid_tx_ant << FW_PHY_CFG_TX_CHAIN_POS |
+                      valid_rx_ant << FW_PHY_CFG_RX_CHAIN_POS;
+
+        return mvm->fw->phy_config & phy_config;
+}
+
 int iwl_mvm_up(struct iwl_mvm *mvm);
 int iwl_mvm_load_d3_fw(struct iwl_mvm *mvm);
 
@@ -970,6 +1016,9 @@ int iwl_mvm_rx_radio_ver(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
                          struct iwl_device_cmd *cmd);
 int iwl_mvm_rx_mfuart_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
                             struct iwl_device_cmd *cmd);
+int iwl_mvm_rx_shared_mem_cfg_notif(struct iwl_mvm *mvm,
+                                    struct iwl_rx_cmd_buffer *rxb,
+                                    struct iwl_device_cmd *cmd);
 
 /* MVM PHY */
 int iwl_mvm_phy_ctxt_add(struct iwl_mvm *mvm, struct iwl_mvm_phy_ctxt *ctxt,
@@ -1031,6 +1080,9 @@ int iwl_mvm_max_scan_ie_len(struct iwl_mvm *mvm, bool is_sched_scan);
 int iwl_mvm_rx_scan_offload_complete_notif(struct iwl_mvm *mvm,
                                            struct iwl_rx_cmd_buffer *rxb,
                                            struct iwl_device_cmd *cmd);
+int iwl_mvm_rx_scan_offload_iter_complete_notif(struct iwl_mvm *mvm,
+                                                struct iwl_rx_cmd_buffer *rxb,
+                                                struct iwl_device_cmd *cmd);
 int iwl_mvm_config_sched_scan(struct iwl_mvm *mvm,
                               struct ieee80211_vif *vif,
                               struct cfg80211_sched_scan_request *req,
@@ -1091,9 +1143,7 @@ iwl_mvm_vif_dbgfs_clean(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 
 /* rate scaling */
 int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq, bool init);
-void iwl_mvm_update_frame_stats(struct iwl_mvm *mvm,
-                                struct iwl_mvm_frame_stats *stats,
-                                u32 rate, bool agg);
+void iwl_mvm_update_frame_stats(struct iwl_mvm *mvm, u32 rate, bool agg);
 int rs_pretty_print_rate(char *buf, const u32 rate);
 void rs_update_last_rssi(struct iwl_mvm *mvm,
                          struct iwl_lq_sta *lq_sta,
@@ -1159,6 +1209,8 @@ void iwl_mvm_unref(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type);
 int iwl_mvm_ref_sync(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type);
 bool iwl_mvm_ref_taken(struct iwl_mvm *mvm);
 void iwl_mvm_d0i3_enable_tx(struct iwl_mvm *mvm, __le16 *qos_seq);
+int iwl_mvm_enter_d0i3(struct iwl_op_mode *op_mode);
+int iwl_mvm_exit_d0i3(struct iwl_op_mode *op_mode);
 int _iwl_mvm_exit_d0i3(struct iwl_mvm *mvm);
 
 /* BT Coex */
@@ -1261,7 +1313,7 @@ static inline bool iwl_mvm_vif_low_latency(struct iwl_mvm_vif *mvmvif)
 /* hw scheduler queue config */
 void iwl_mvm_enable_txq(struct iwl_mvm *mvm, int queue, u16 ssn,
                         const struct iwl_trans_txq_scd_cfg *cfg);
-void iwl_mvm_disable_txq(struct iwl_mvm *mvm, int queue);
+void iwl_mvm_disable_txq(struct iwl_mvm *mvm, int queue, u8 flags);
 
 static inline void iwl_mvm_enable_ac_txq(struct iwl_mvm *mvm, int queue,
                                          u8 fifo)
@@ -1344,4 +1396,7 @@ struct ieee80211_vif *iwl_mvm_get_bss_vif(struct iwl_mvm *mvm);
 void iwl_mvm_nic_restart(struct iwl_mvm *mvm, bool fw_error);
 void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm);
 
+int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm, enum iwl_fw_dbg_conf id);
+void iwl_mvm_fw_dbg_collect(struct iwl_mvm *mvm);
+
 #endif /* __IWL_MVM_H__ */
diff --git a/drivers/net/wireless/iwlwifi/mvm/nvm.c b/drivers/net/wireless/iwlwifi/mvm/nvm.c
index d55fd8e3654c..5383429d96c1 100644
--- a/drivers/net/wireless/iwlwifi/mvm/nvm.c
+++ b/drivers/net/wireless/iwlwifi/mvm/nvm.c
@@ -356,7 +356,7 @@ static int iwl_mvm_read_external_nvm(struct iwl_mvm *mvm)
                 max_section_size = IWL_MAX_NVM_SECTION_SIZE;
         else if (CSR_HW_REV_STEP(mvm->trans->hw_rev) == SILICON_A_STEP)
                 max_section_size = IWL_MAX_NVM_8000A_SECTION_SIZE;
-        else /* Family 8000 B-step */
+        else /* Family 8000 B-step or C-step */
                 max_section_size = IWL_MAX_NVM_8000B_SECTION_SIZE;
 
         /*
@@ -565,6 +565,8 @@ int iwl_nvm_init(struct iwl_mvm *mvm, bool read_nvm_from_nic)
         mvm->nvm_data = iwl_parse_nvm_sections(mvm);
         if (!mvm->nvm_data)
                 return -ENODATA;
+        IWL_DEBUG_EEPROM(mvm->trans->dev, "nvm version = %x\n",
+                         mvm->nvm_data->nvm_version);
 
         return 0;
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwlwifi/mvm/ops.c
index 97dfba50c682..8bf8c2a29e5e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
@@ -84,15 +84,8 @@
 #include "time-event.h"
 #include "iwl-fw-error-dump.h"
 
-/*
- * module name, copyright, version, etc.
- */
 #define DRV_DESCRIPTION "The new Intel(R) wireless AGN driver for Linux"
-
-#define DRV_VERSION     IWLWIFI_VERSION
-
 MODULE_DESCRIPTION(DRV_DESCRIPTION);
-MODULE_VERSION(DRV_VERSION);
 MODULE_AUTHOR(DRV_COPYRIGHT " " DRV_AUTHOR);
 MODULE_LICENSE("GPL");
 
@@ -146,13 +139,14 @@ static void iwl_mvm_nic_config(struct iwl_op_mode *op_mode)
         struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
         u8 radio_cfg_type, radio_cfg_step, radio_cfg_dash;
         u32 reg_val = 0;
+        u32 phy_config = iwl_mvm_get_phy_config(mvm);
 
-        radio_cfg_type = (mvm->fw->phy_config & FW_PHY_CFG_RADIO_TYPE) >>
-                          FW_PHY_CFG_RADIO_TYPE_POS;
-        radio_cfg_step = (mvm->fw->phy_config & FW_PHY_CFG_RADIO_STEP) >>
-                          FW_PHY_CFG_RADIO_STEP_POS;
-        radio_cfg_dash = (mvm->fw->phy_config & FW_PHY_CFG_RADIO_DASH) >>
-                          FW_PHY_CFG_RADIO_DASH_POS;
+        radio_cfg_type = (phy_config & FW_PHY_CFG_RADIO_TYPE) >>
+                         FW_PHY_CFG_RADIO_TYPE_POS;
+        radio_cfg_step = (phy_config & FW_PHY_CFG_RADIO_STEP) >>
+                         FW_PHY_CFG_RADIO_STEP_POS;
+        radio_cfg_dash = (phy_config & FW_PHY_CFG_RADIO_DASH) >>
+                         FW_PHY_CFG_RADIO_DASH_POS;
 
         /* SKU control */
         reg_val |= CSR_HW_REV_STEP(mvm->trans->hw_rev) <<
@@ -240,6 +234,8 @@ static const struct iwl_rx_handlers iwl_mvm_rx_handlers[] = {
 
         RX_HANDLER(SCAN_REQUEST_CMD, iwl_mvm_rx_scan_response, false),
         RX_HANDLER(SCAN_COMPLETE_NOTIFICATION, iwl_mvm_rx_scan_complete, true),
+        RX_HANDLER(SCAN_ITERATION_COMPLETE,
+                   iwl_mvm_rx_scan_offload_iter_complete_notif, false),
         RX_HANDLER(SCAN_OFFLOAD_COMPLETE,
                    iwl_mvm_rx_scan_offload_complete_notif, true),
         RX_HANDLER(MATCH_FOUND_NOTIFICATION, iwl_mvm_rx_scan_offload_results,
@@ -274,6 +270,7 @@ static const char *const iwl_mvm_cmd_strings[REPLY_MAX] = {
         CMD(MGMT_MCAST_KEY),
         CMD(TX_CMD),
         CMD(TXPATH_FLUSH),
+        CMD(SHARED_MEM_CFG),
         CMD(MAC_CONTEXT_CMD),
         CMD(TIME_EVENT_CMD),
         CMD(TIME_EVENT_NOTIFICATION),
@@ -487,6 +484,8 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         trans_cfg.cmd_fifo = IWL_MVM_TX_FIFO_CMD;
         trans_cfg.scd_set_active = true;
 
+        trans_cfg.sdio_adma_addr = fw->sdio_adma_addr;
+
         snprintf(mvm->hw->wiphy->fw_version,
                  sizeof(mvm->hw->wiphy->fw_version),
                  "%s", fw->fw_version);
@@ -517,10 +516,15 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         min_backoff = calc_min_backoff(trans, cfg);
         iwl_mvm_tt_initialize(mvm, min_backoff);
         /* set the nvm_file_name according to priority */
-        if (iwlwifi_mod_params.nvm_file)
+        if (iwlwifi_mod_params.nvm_file) {
                 mvm->nvm_file_name = iwlwifi_mod_params.nvm_file;
-        else
-                mvm->nvm_file_name = mvm->cfg->default_nvm_file;
+        } else {
+                if ((trans->cfg->device_family == IWL_DEVICE_FAMILY_8000) &&
+                    (CSR_HW_REV_STEP(trans->hw_rev) == SILICON_A_STEP))
+                        mvm->nvm_file_name = mvm->cfg->default_nvm_file_8000A;
+                else
+                        mvm->nvm_file_name = mvm->cfg->default_nvm_file;
+        }
 
         if (WARN(cfg->no_power_up_nic_in_init && !mvm->nvm_file_name,
                  "not allowing power-up and not having nvm_file\n"))
@@ -817,9 +821,20 @@ static void iwl_mvm_fw_error_dump_wk(struct work_struct *work)
         struct iwl_mvm *mvm =
                 container_of(work, struct iwl_mvm, fw_error_dump_wk);
 
+        if (iwl_mvm_ref_sync(mvm, IWL_MVM_REF_FW_DBG_COLLECT))
+                return;
+
         mutex_lock(&mvm->mutex);
         iwl_mvm_fw_error_dump(mvm);
+
+        /* start recording again if the firmware is not crashed */
+        WARN_ON_ONCE((!test_bit(STATUS_FW_ERROR, &mvm->trans->status)) &&
+                      mvm->fw->dbg_dest_tlv &&
+                      iwl_mvm_start_fw_dbg_conf(mvm, mvm->fw_dbg_conf));
+
         mutex_unlock(&mvm->mutex);
+
+        iwl_mvm_unref(mvm, IWL_MVM_REF_FW_DBG_COLLECT);
 }
 
 void iwl_mvm_nic_restart(struct iwl_mvm *mvm, bool fw_error)
@@ -1031,7 +1046,8 @@ static void iwl_mvm_set_wowlan_data(struct iwl_mvm *mvm,
 out:
         rcu_read_unlock();
 }
-static int iwl_mvm_enter_d0i3(struct iwl_op_mode *op_mode)
+
+int iwl_mvm_enter_d0i3(struct iwl_op_mode *op_mode)
 {
         struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
         u32 flags = CMD_ASYNC | CMD_HIGH_PRIO | CMD_SEND_IN_IDLE;
@@ -1047,6 +1063,7 @@ static int iwl_mvm_enter_d0i3(struct iwl_op_mode *op_mode)
         };
         struct iwl_d3_manager_config d3_cfg_cmd = {
                 .min_sleep_time = cpu_to_le32(1000),
+                .wakeup_flags = cpu_to_le32(IWL_WAKEUP_D3_CONFIG_FW_ERROR),
         };
 
         IWL_DEBUG_RPM(mvm, "MVM entering D0i3\n");
@@ -1146,7 +1163,7 @@ void iwl_mvm_d0i3_enable_tx(struct iwl_mvm *mvm, __le16 *qos_seq)
 
         if (mvm->d0i3_offloading && qos_seq) {
                 /* update qos seq numbers if offloading was enabled */
-                mvm_ap_sta = (struct iwl_mvm_sta *)sta->drv_priv;
+                mvm_ap_sta = iwl_mvm_sta_from_mac80211(sta);
                 for (i = 0; i < IWL_MAX_TID_COUNT; i++) {
                         u16 seq = le16_to_cpu(qos_seq[i]);
                         /* firmware stores last-used one, we store next one */
@@ -1245,7 +1262,7 @@ out:
         return ret;
 }
 
-static int iwl_mvm_exit_d0i3(struct iwl_op_mode *op_mode)
+int iwl_mvm_exit_d0i3(struct iwl_op_mode *op_mode)
 {
         struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c b/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
index 1c0d4a45c1a8..5b43616eeb06 100644
--- a/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
@@ -170,13 +170,13 @@ static void iwl_mvm_phy_ctxt_cmd_data(struct iwl_mvm *mvm,
                 active_cnt = 2;
         }
 
-        cmd->rxchain_info = cpu_to_le32(mvm->fw->valid_rx_ant <<
+        cmd->rxchain_info = cpu_to_le32(iwl_mvm_get_valid_rx_ant(mvm) <<
                                         PHY_RX_CHAIN_VALID_POS);
         cmd->rxchain_info |= cpu_to_le32(idle_cnt << PHY_RX_CHAIN_CNT_POS);
         cmd->rxchain_info |= cpu_to_le32(active_cnt <<
                                          PHY_RX_CHAIN_MIMO_CNT_POS);
 
-        cmd->txchain_info = cpu_to_le32(mvm->fw->valid_tx_ant);
+        cmd->txchain_info = cpu_to_le32(iwl_mvm_get_valid_tx_ant(mvm));
 }
 
 /*
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c
index 30ceb67ed7a7..9f32f2db95bd 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
@@ -42,25 +42,12 @@
 
 #define RS_NAME "iwl-mvm-rs"
 
-#define NUM_TRY_BEFORE_ANT_TOGGLE       1
-#define RS_LEGACY_RETRIES_PER_RATE      1
-#define RS_HT_VHT_RETRIES_PER_RATE      2
-#define RS_HT_VHT_RETRIES_PER_RATE_TW   1
-#define RS_INITIAL_MIMO_NUM_RATES       3
-#define RS_INITIAL_SISO_NUM_RATES       3
-#define RS_INITIAL_LEGACY_NUM_RATES     LINK_QUAL_MAX_RETRY_NUM
-#define RS_SECONDARY_LEGACY_NUM_RATES   LINK_QUAL_MAX_RETRY_NUM
-#define RS_SECONDARY_SISO_NUM_RATES     3
-#define RS_SECONDARY_SISO_RETRIES       1
-
 #define IWL_RATE_MAX_WINDOW             62      /* # tx in history window */
-#define IWL_RATE_MIN_FAILURE_TH         3       /* min failures to calc tpt */
-#define IWL_RATE_MIN_SUCCESS_TH         8       /* min successes to calc tpt */
 
-/* max allowed rate miss before sync LQ cmd */
-#define IWL_MISSED_RATE_MAX             15
-#define RS_STAY_IN_COLUMN_TIMEOUT       (5*HZ)
-#define RS_IDLE_TIMEOUT                 (5*HZ)
+/* Calculations of success ratio are done in fixed point where 12800 is 100%.
+ * Use this macro when dealing with thresholds consts set as a percentage
+ */
+#define RS_PERCENT(x) (128 * x)
 
 static u8 rs_ht_to_legacy[] = {
         [IWL_RATE_MCS_0_INDEX] = IWL_RATE_6M_INDEX,
@@ -173,7 +160,7 @@ static bool rs_mimo_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         if (sta->smps_mode == IEEE80211_SMPS_STATIC)
                 return false;
 
-        if (num_of_ant(mvm->fw->valid_tx_ant) < 2)
+        if (num_of_ant(iwl_mvm_get_valid_tx_ant(mvm)) < 2)
                 return false;
 
         if (!iwl_mvm_bt_coex_is_mimo_allowed(mvm, sta))
@@ -613,7 +600,8 @@ static s32 get_expected_tpt(struct iwl_scale_tbl_info *tbl, int rs_index)
  * at this rate.  window->data contains the bitmask of successful
  * packets.
  */
-static int _rs_collect_tx_data(struct iwl_scale_tbl_info *tbl,
+static int _rs_collect_tx_data(struct iwl_mvm *mvm,
+                               struct iwl_scale_tbl_info *tbl,
                                int scale_index, int attempts, int successes,
                                struct iwl_rate_scale_data *window)
 {
@@ -668,8 +656,8 @@ static int _rs_collect_tx_data(struct iwl_scale_tbl_info *tbl,
         fail_count = window->counter - window->success_counter;
 
         /* Calculate average throughput, if we have enough history. */
-        if ((fail_count >= IWL_RATE_MIN_FAILURE_TH) ||
-            (window->success_counter >= IWL_RATE_MIN_SUCCESS_TH))
+        if ((fail_count >= IWL_MVM_RS_RATE_MIN_FAILURE_TH) ||
+            (window->success_counter >= IWL_MVM_RS_RATE_MIN_SUCCESS_TH))
                 window->average_tpt = (window->success_ratio * tpt + 64) / 128;
         else
                 window->average_tpt = IWL_INVALID_VALUE;
@@ -677,7 +665,8 @@ static int _rs_collect_tx_data(struct iwl_scale_tbl_info *tbl,
         return 0;
 }
 
-static int rs_collect_tx_data(struct iwl_lq_sta *lq_sta,
+static int rs_collect_tx_data(struct iwl_mvm *mvm,
+                              struct iwl_lq_sta *lq_sta,
                               struct iwl_scale_tbl_info *tbl,
                               int scale_index, int attempts, int successes,
                               u8 reduced_txp)
@@ -698,7 +687,7 @@ static int rs_collect_tx_data(struct iwl_lq_sta *lq_sta,
         /* Select window for current tx bit rate */
         window = &(tbl->win[scale_index]);
 
-        ret = _rs_collect_tx_data(tbl, scale_index, attempts, successes,
+        ret = _rs_collect_tx_data(mvm, tbl, scale_index, attempts, successes,
                                   window);
         if (ret)
                 return ret;
@@ -707,7 +696,7 @@ static int rs_collect_tx_data(struct iwl_lq_sta *lq_sta,
                 return -EINVAL;
 
         window = &tbl->tpc_win[reduced_txp];
-        return _rs_collect_tx_data(tbl, scale_index, attempts, successes,
+        return _rs_collect_tx_data(mvm, tbl, scale_index, attempts, successes,
                                    window);
 }
 
@@ -928,7 +917,6 @@ static u16 rs_get_adjacent_rate(struct iwl_mvm *mvm, u8 index, u16 rate_mask,
                         break;
                 if (rate_mask & (1 << low))
                         break;
-                IWL_DEBUG_RATE(mvm, "Skipping masked lower rate: %d\n", low);
         }
 
         high = index;
@@ -938,7 +926,6 @@ static u16 rs_get_adjacent_rate(struct iwl_mvm *mvm, u8 index, u16 rate_mask,
                         break;
                 if (rate_mask & (1 << high))
                         break;
-                IWL_DEBUG_RATE(mvm, "Skipping masked higher rate: %d\n", high);
         }
 
         return (high << 8) | low;
@@ -1004,7 +991,7 @@ static void rs_get_lower_rate_down_column(struct iwl_lq_sta *lq_sta,
         }
 
         if (num_of_ant(rate->ant) > 1)
-                rate->ant = first_antenna(mvm->fw->valid_tx_ant);
+                rate->ant = first_antenna(iwl_mvm_get_valid_tx_ant(mvm));
 
         /* Relevant in both switching to SISO or Legacy */
         rate->sgi = false;
@@ -1125,7 +1112,8 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         }
 
         if (time_after(jiffies,
-                       (unsigned long)(lq_sta->last_tx + RS_IDLE_TIMEOUT))) {
+                       (unsigned long)(lq_sta->last_tx +
+                                       (IWL_MVM_RS_IDLE_TIMEOUT * HZ)))) {
                 int t;
 
                 IWL_DEBUG_RATE(mvm, "Tx idle for too long. reinit rs\n");
@@ -1158,7 +1146,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                  * ... driver.
                  */
                 lq_sta->missed_rate_counter++;
-                if (lq_sta->missed_rate_counter > IWL_MISSED_RATE_MAX) {
+                if (lq_sta->missed_rate_counter > IWL_MVM_RS_MISSED_RATE_MAX) {
                         lq_sta->missed_rate_counter = 0;
                         IWL_DEBUG_RATE(mvm,
                                        "Too many rates mismatch. Send sync LQ. rs_state %d\n",
@@ -1213,7 +1201,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 
                 ucode_rate = le32_to_cpu(table->rs_table[0]);
                 rs_rate_from_ucode_rate(ucode_rate, info->band, &rate);
-                rs_collect_tx_data(lq_sta, curr_tbl, rate.index,
+                rs_collect_tx_data(mvm, lq_sta, curr_tbl, rate.index,
                                    info->status.ampdu_len,
                                    info->status.ampdu_ack_len,
                                    reduced_txp);
@@ -1249,7 +1237,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                         else
                                 continue;
 
-                        rs_collect_tx_data(lq_sta, tmp_tbl, rate.index, 1,
+                        rs_collect_tx_data(mvm, lq_sta, tmp_tbl, rate.index, 1,
                                            i < retries ? 0 : legacy_success,
                                            reduced_txp);
                 }
@@ -1303,13 +1291,13 @@ static void rs_set_stay_in_table(struct iwl_mvm *mvm, u8 is_legacy,
         IWL_DEBUG_RATE(mvm, "Moving to RS_STATE_STAY_IN_COLUMN\n");
         lq_sta->rs_state = RS_STATE_STAY_IN_COLUMN;
         if (is_legacy) {
-                lq_sta->table_count_limit = IWL_LEGACY_TABLE_COUNT;
-                lq_sta->max_failure_limit = IWL_LEGACY_FAILURE_LIMIT;
-                lq_sta->max_success_limit = IWL_LEGACY_SUCCESS_LIMIT;
+                lq_sta->table_count_limit = IWL_MVM_RS_LEGACY_TABLE_COUNT;
+                lq_sta->max_failure_limit = IWL_MVM_RS_LEGACY_FAILURE_LIMIT;
+                lq_sta->max_success_limit = IWL_MVM_RS_LEGACY_SUCCESS_LIMIT;
         } else {
-                lq_sta->table_count_limit = IWL_NONE_LEGACY_TABLE_COUNT;
-                lq_sta->max_failure_limit = IWL_NONE_LEGACY_FAILURE_LIMIT;
-                lq_sta->max_success_limit = IWL_NONE_LEGACY_SUCCESS_LIMIT;
+                lq_sta->table_count_limit = IWL_MVM_RS_NON_LEGACY_TABLE_COUNT;
+                lq_sta->max_failure_limit = IWL_MVM_RS_NON_LEGACY_FAILURE_LIMIT;
+                lq_sta->max_success_limit = IWL_MVM_RS_NON_LEGACY_SUCCESS_LIMIT;
         }
         lq_sta->table_count = 0;
         lq_sta->total_failed = 0;
@@ -1318,6 +1306,13 @@ static void rs_set_stay_in_table(struct iwl_mvm *mvm, u8 is_legacy,
         lq_sta->visited_columns = 0;
 }
 
+static inline int rs_get_max_rate_from_mask(unsigned long rate_mask)
+{
+        if (rate_mask)
+                return find_last_bit(&rate_mask, BITS_PER_LONG);
+        return IWL_RATE_INVALID;
+}
+
 static int rs_get_max_allowed_rate(struct iwl_lq_sta *lq_sta,
                                    const struct rs_tx_column *column)
 {
@@ -1420,7 +1415,7 @@ static s32 rs_get_best_rate(struct iwl_mvm *mvm,
         u32 target_tpt;
         int rate_idx;
 
-        if (success_ratio > RS_SR_NO_DECREASE) {
+        if (success_ratio > IWL_MVM_RS_SR_NO_DECREASE) {
                 target_tpt = 100 * expected_current_tpt;
                 IWL_DEBUG_RATE(mvm,
                                "SR %d high. Find rate exceeding EXPECTED_CURRENT %d\n",
@@ -1488,7 +1483,7 @@ static void rs_stay_in_table(struct iwl_lq_sta *lq_sta, bool force_search)
                         flush_interval_passed =
                                 time_after(jiffies,
                                            (unsigned long)(lq_sta->flush_timer +
-                                                RS_STAY_IN_COLUMN_TIMEOUT));
+                                                           (IWL_MVM_RS_STAY_IN_COLUMN_TIMEOUT * HZ)));
 
                 /*
                  * Check if we should allow search for new modulation mode.
@@ -1567,7 +1562,7 @@ static enum rs_column rs_get_next_column(struct iwl_mvm *mvm,
         const struct rs_tx_column *curr_col = &rs_tx_columns[tbl->column];
         const struct rs_tx_column *next_col;
         allow_column_func_t allow_func;
-        u8 valid_ants = mvm->fw->valid_tx_ant;
+        u8 valid_ants = iwl_mvm_get_valid_tx_ant(mvm);
         const u16 *expected_tpt_tbl;
         u16 tpt, max_expected_tpt;
 
@@ -1613,8 +1608,12 @@ static enum rs_column rs_get_next_column(struct iwl_mvm *mvm,
                         continue;
 
                 max_rate = rs_get_max_allowed_rate(lq_sta, next_col);
-                if (WARN_ON_ONCE(max_rate == IWL_RATE_INVALID))
+                if (max_rate == IWL_RATE_INVALID) {
+                        IWL_DEBUG_RATE(mvm,
+                                       "Skip column %d: no rate is allowed in this column\n",
+                                       next_col_id);
                         continue;
+                }
 
                 max_expected_tpt = expected_tpt_tbl[max_rate];
                 if (tpt >= max_expected_tpt) {
@@ -1724,7 +1723,8 @@ static enum rs_action rs_get_rate_action(struct iwl_mvm *mvm,
 {
         enum rs_action action = RS_ACTION_STAY;
 
-        if ((sr <= RS_SR_FORCE_DECREASE) || (current_tpt == 0)) {
+        if ((sr <= RS_PERCENT(IWL_MVM_RS_SR_FORCE_DECREASE)) ||
+            (current_tpt == 0)) {
                 IWL_DEBUG_RATE(mvm,
                                "Decrease rate because of low SR\n");
                 return RS_ACTION_DOWNSCALE;
@@ -1783,7 +1783,7 @@ static enum rs_action rs_get_rate_action(struct iwl_mvm *mvm,
 
 out:
         if ((action == RS_ACTION_DOWNSCALE) && (low != IWL_RATE_INVALID)) {
-                if (sr >= RS_SR_NO_DECREASE) {
+                if (sr >= RS_PERCENT(IWL_MVM_RS_SR_NO_DECREASE)) {
                         IWL_DEBUG_RATE(mvm,
                                        "SR is above NO DECREASE. Avoid downscale\n");
                         action = RS_ACTION_STAY;
@@ -1802,20 +1802,12 @@ out:
 static bool rs_stbc_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                           struct iwl_lq_sta *lq_sta)
 {
-        struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
-        struct ieee80211_vif *vif = mvmsta->vif;
-        bool sta_ps_disabled = (vif->type == NL80211_IFTYPE_STATION &&
-                                !vif->bss_conf.ps);
-
         /* Our chip supports Tx STBC and the peer is an HT/VHT STA which
          * supports STBC of at least 1*SS
          */
         if (!lq_sta->stbc)
                 return false;
 
-        if (!mvm->ps_disabled && !sta_ps_disabled)
-                return false;
-
         if (!iwl_mvm_bt_coex_is_mimo_allowed(mvm, sta))
                 return false;
 
@@ -1825,11 +1817,11 @@ static bool rs_stbc_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 static void rs_get_adjacent_txp(struct iwl_mvm *mvm, int index,
                                 int *weaker, int *stronger)
 {
-        *weaker = index + TPC_TX_POWER_STEP;
+        *weaker = index + IWL_MVM_RS_TPC_TX_POWER_STEP;
         if (*weaker > TPC_MAX_REDUCTION)
                 *weaker = TPC_INVALID;
 
-        *stronger = index - TPC_TX_POWER_STEP;
+        *stronger = index - IWL_MVM_RS_TPC_TX_POWER_STEP;
         if (*stronger < 0)
                 *stronger = TPC_INVALID;
 }
@@ -1885,7 +1877,8 @@ static enum tpc_action rs_get_tpc_action(struct iwl_mvm *mvm,
         }
 
         /* Too many failures, increase txp */
-        if (sr <= TPC_SR_FORCE_INCREASE || current_tpt == 0) {
+        if (sr <= RS_PERCENT(IWL_MVM_RS_TPC_SR_FORCE_INCREASE) ||
+            current_tpt == 0) {
                 IWL_DEBUG_RATE(mvm, "increase txp because of weak SR\n");
                 return TPC_ACTION_NO_RESTIRCTION;
         }
@@ -1908,7 +1901,8 @@ static enum tpc_action rs_get_tpc_action(struct iwl_mvm *mvm,
         }
 
         /* next, increase if needed */
-        if (sr < TPC_SR_NO_INCREASE && strong != TPC_INVALID) {
+        if (sr < RS_PERCENT(IWL_MVM_RS_TPC_SR_NO_INCREASE) &&
+            strong != TPC_INVALID) {
                 if (weak_tpt == IWL_INVALID_VALUE &&
                     strong_tpt != IWL_INVALID_VALUE &&
                     current_tpt < strong_tpt) {
@@ -1935,7 +1929,7 @@ static bool rs_tpc_perform(struct iwl_mvm *mvm,
                            struct iwl_lq_sta *lq_sta,
                            struct iwl_scale_tbl_info *tbl)
 {
-        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
         struct ieee80211_vif *vif = mvm_sta->vif;
         struct ieee80211_chanctx_conf *chanctx_conf;
         enum ieee80211_band band;
@@ -2044,7 +2038,7 @@ static void rs_rate_scale_perform(struct iwl_mvm *mvm,
         u16 high_low;
         s32 sr;
         u8 prev_agg = lq_sta->is_agg;
-        struct iwl_mvm_sta *sta_priv = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *sta_priv = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_mvm_tid_data *tid_data;
         struct rs_rate *rate;
 
@@ -2106,8 +2100,8 @@ static void rs_rate_scale_perform(struct iwl_mvm *mvm,
          * in current association (use new rate found above).
          */
         fail_count = window->counter - window->success_counter;
-        if ((fail_count < IWL_RATE_MIN_FAILURE_TH) &&
-            (window->success_counter < IWL_RATE_MIN_SUCCESS_TH)) {
+        if ((fail_count < IWL_MVM_RS_RATE_MIN_FAILURE_TH) &&
+            (window->success_counter < IWL_MVM_RS_RATE_MIN_SUCCESS_TH)) {
                 IWL_DEBUG_RATE(mvm,
                                "(%s: %d): Test Window: succ %d total %d\n",
                                rs_pretty_lq_type(rate->type),
@@ -2385,7 +2379,7 @@ static void rs_get_initial_rate(struct iwl_mvm *mvm,
         int i, nentries;
         s8 best_rssi = S8_MIN;
         u8 best_ant = ANT_NONE;
-        u8 valid_tx_ant = mvm->fw->valid_tx_ant;
+        u8 valid_tx_ant = iwl_mvm_get_valid_tx_ant(mvm);
         const struct rs_init_rate_info *initial_rates;
 
         for (i = 0; i < ARRAY_SIZE(lq_sta->pers.chain_signal); i++) {
@@ -2530,7 +2524,7 @@ static void rs_get_rate(void *mvm_r, struct ieee80211_sta *sta, void *mvm_sta,
 static void *rs_alloc_sta(void *mvm_rate, struct ieee80211_sta *sta,
                           gfp_t gfp)
 {
-        struct iwl_mvm_sta *sta_priv = (struct iwl_mvm_sta *)sta->drv_priv;
+        struct iwl_mvm_sta *sta_priv = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_op_mode *op_mode = (struct iwl_op_mode *)mvm_rate;
         struct iwl_mvm *mvm  = IWL_OP_MODE_GET_MVM(op_mode);
         struct iwl_lq_sta *lq_sta = &sta_priv->lq_sta;
@@ -2606,68 +2600,116 @@ static void rs_vht_set_enabled_rates(struct ieee80211_sta *sta,
         }
 }
 
+static void rs_ht_init(struct iwl_mvm *mvm,
+                       struct ieee80211_sta *sta,
+                       struct iwl_lq_sta *lq_sta,
+                       struct ieee80211_sta_ht_cap *ht_cap)
+{
+        /* active_siso_rate mask includes 9 MBits (bit 5),
+         * and CCK (bits 0-3), supp_rates[] does not;
+         * shift to convert format, force 9 MBits off.
+         */
+        lq_sta->active_siso_rate = ht_cap->mcs.rx_mask[0] << 1;
+        lq_sta->active_siso_rate |= ht_cap->mcs.rx_mask[0] & 0x1;
+        lq_sta->active_siso_rate &= ~((u16)0x2);
+        lq_sta->active_siso_rate <<= IWL_FIRST_OFDM_RATE;
+
+        lq_sta->active_mimo2_rate = ht_cap->mcs.rx_mask[1] << 1;
+        lq_sta->active_mimo2_rate |= ht_cap->mcs.rx_mask[1] & 0x1;
+        lq_sta->active_mimo2_rate &= ~((u16)0x2);
+        lq_sta->active_mimo2_rate <<= IWL_FIRST_OFDM_RATE;
+
+        if (mvm->cfg->ht_params->ldpc &&
+            (ht_cap->cap & IEEE80211_HT_CAP_LDPC_CODING))
+                lq_sta->ldpc = true;
+
+        if (mvm->cfg->ht_params->stbc &&
+            (num_of_ant(iwl_mvm_get_valid_tx_ant(mvm)) > 1) &&
+            (ht_cap->cap & IEEE80211_HT_CAP_RX_STBC))
+                lq_sta->stbc = true;
+
+        lq_sta->is_vht = false;
+}
+
+static void rs_vht_init(struct iwl_mvm *mvm,
+                        struct ieee80211_sta *sta,
+                        struct iwl_lq_sta *lq_sta,
+                        struct ieee80211_sta_vht_cap *vht_cap)
+{
+        rs_vht_set_enabled_rates(sta, vht_cap, lq_sta);
+
+        if (mvm->cfg->ht_params->ldpc &&
+            (vht_cap->cap & IEEE80211_VHT_CAP_RXLDPC))
+                lq_sta->ldpc = true;
+
+        if (mvm->cfg->ht_params->stbc &&
+            (num_of_ant(iwl_mvm_get_valid_tx_ant(mvm)) > 1) &&
+            (vht_cap->cap & IEEE80211_VHT_CAP_RXSTBC_MASK))
+                lq_sta->stbc = true;
+
+        lq_sta->is_vht = true;
+}
+
 #ifdef CONFIG_IWLWIFI_DEBUGFS
-static void iwl_mvm_reset_frame_stats(struct iwl_mvm *mvm,
-                                      struct iwl_mvm_frame_stats *stats)
+static void iwl_mvm_reset_frame_stats(struct iwl_mvm *mvm)
 {
         spin_lock_bh(&mvm->drv_stats_lock);
-        memset(stats, 0, sizeof(*stats));
+        memset(&mvm->drv_rx_stats, 0, sizeof(mvm->drv_rx_stats));
         spin_unlock_bh(&mvm->drv_stats_lock);
 }
 
-void iwl_mvm_update_frame_stats(struct iwl_mvm *mvm,
-                                struct iwl_mvm_frame_stats *stats,
-                                u32 rate, bool agg)
+void iwl_mvm_update_frame_stats(struct iwl_mvm *mvm, u32 rate, bool agg)
 {
         u8 nss = 0, mcs = 0;
 
         spin_lock(&mvm->drv_stats_lock);
 
         if (agg)
-                stats->agg_frames++;
+                mvm->drv_rx_stats.agg_frames++;
 
-        stats->success_frames++;
+        mvm->drv_rx_stats.success_frames++;
 
         switch (rate & RATE_MCS_CHAN_WIDTH_MSK) {
         case RATE_MCS_CHAN_WIDTH_20:
-                stats->bw_20_frames++;
+                mvm->drv_rx_stats.bw_20_frames++;
                 break;
         case RATE_MCS_CHAN_WIDTH_40:
-                stats->bw_40_frames++;
+                mvm->drv_rx_stats.bw_40_frames++;
                 break;
         case RATE_MCS_CHAN_WIDTH_80:
-                stats->bw_80_frames++;
+                mvm->drv_rx_stats.bw_80_frames++;
                 break;
         default:
                 WARN_ONCE(1, "bad BW. rate 0x%x", rate);
         }
 
         if (rate & RATE_MCS_HT_MSK) {
-                stats->ht_frames++;
+                mvm->drv_rx_stats.ht_frames++;
                 mcs = rate & RATE_HT_MCS_RATE_CODE_MSK;
                 nss = ((rate & RATE_HT_MCS_NSS_MSK) >> RATE_HT_MCS_NSS_POS) + 1;
         } else if (rate & RATE_MCS_VHT_MSK) {
-                stats->vht_frames++;
+                mvm->drv_rx_stats.vht_frames++;
                 mcs = rate & RATE_VHT_MCS_RATE_CODE_MSK;
                 nss = ((rate & RATE_VHT_MCS_NSS_MSK) >>
                        RATE_VHT_MCS_NSS_POS) + 1;
         } else {
-                stats->legacy_frames++;
+                mvm->drv_rx_stats.legacy_frames++;
         }
 
         if (nss == 1)
-                stats->siso_frames++;
+                mvm->drv_rx_stats.siso_frames++;
         else if (nss == 2)
-                stats->mimo2_frames++;
+                mvm->drv_rx_stats.mimo2_frames++;
 
         if (rate & RATE_MCS_SGI_MSK)
-                stats->sgi_frames++;
+                mvm->drv_rx_stats.sgi_frames++;
         else
-                stats->ngi_frames++;
+                mvm->drv_rx_stats.ngi_frames++;
 
-        stats->last_rates[stats->last_frame_idx] = rate;
-        stats->last_frame_idx = (stats->last_frame_idx + 1) %
-                ARRAY_SIZE(stats->last_rates);
+        mvm->drv_rx_stats.last_rates[mvm->drv_rx_stats.last_frame_idx] = rate;
+        mvm->drv_rx_stats.last_frame_idx =
+                (mvm->drv_rx_stats.last_frame_idx + 1) %
+                        ARRAY_SIZE(mvm->drv_rx_stats.last_rates);
 
         spin_unlock(&mvm->drv_stats_lock);
 }
@@ -2683,14 +2725,11 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         struct ieee80211_hw *hw = mvm->hw;
         struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
         struct ieee80211_sta_vht_cap *vht_cap = &sta->vht_cap;
-        struct iwl_mvm_sta *sta_priv;
-        struct iwl_lq_sta *lq_sta;
+        struct iwl_mvm_sta *sta_priv = iwl_mvm_sta_from_mac80211(sta);
+        struct iwl_lq_sta *lq_sta = &sta_priv->lq_sta;
         struct ieee80211_supported_band *sband;
         unsigned long supp; /* must be unsigned long for for_each_set_bit */
 
-        sta_priv = (struct iwl_mvm_sta *)sta->drv_priv;
-        lq_sta = &sta_priv->lq_sta;
-
         /* clear all non-persistent lq data */
         memset(lq_sta, 0, offsetof(typeof(*lq_sta), pers));
 
@@ -2712,7 +2751,7 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
          * previous packets? Need to have IEEE 802.1X auth succeed immediately
          * after assoc.. */
 
-        lq_sta->missed_rate_counter = IWL_MISSED_RATE_MAX;
+        lq_sta->missed_rate_counter = IWL_MVM_RS_MISSED_RATE_MAX;
         lq_sta->band = sband->band;
         /*
          * active legacy rates as per supported rates bitmap
@@ -2723,57 +2762,23 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                 lq_sta->active_legacy_rate |= BIT(sband->bitrates[i].hw_value);
 
         /* TODO: should probably account for rx_highest for both HT/VHT */
-        if (!vht_cap || !vht_cap->vht_supported) {
-                /* active_siso_rate mask includes 9 MBits (bit 5),
-                 * and CCK (bits 0-3), supp_rates[] does not;
-                 * shift to convert format, force 9 MBits off.
-                 */
-                lq_sta->active_siso_rate = ht_cap->mcs.rx_mask[0] << 1;
-                lq_sta->active_siso_rate |= ht_cap->mcs.rx_mask[0] & 0x1;
-                lq_sta->active_siso_rate &= ~((u16)0x2);
-                lq_sta->active_siso_rate <<= IWL_FIRST_OFDM_RATE;
-
-                /* Same here */
-                lq_sta->active_mimo2_rate = ht_cap->mcs.rx_mask[1] << 1;
-                lq_sta->active_mimo2_rate |= ht_cap->mcs.rx_mask[1] & 0x1;
-                lq_sta->active_mimo2_rate &= ~((u16)0x2);
-                lq_sta->active_mimo2_rate <<= IWL_FIRST_OFDM_RATE;
-
-                lq_sta->is_vht = false;
-                if (mvm->cfg->ht_params->ldpc &&
-                    (ht_cap->cap & IEEE80211_HT_CAP_LDPC_CODING))
-                        lq_sta->ldpc = true;
-
-                if (mvm->cfg->ht_params->stbc &&
-                    (num_of_ant(mvm->fw->valid_tx_ant) > 1) &&
-                    (ht_cap->cap & IEEE80211_HT_CAP_RX_STBC))
-                        lq_sta->stbc = true;
-        } else {
-                rs_vht_set_enabled_rates(sta, vht_cap, lq_sta);
-                lq_sta->is_vht = true;
-
-                if (mvm->cfg->ht_params->ldpc &&
-                    (vht_cap->cap & IEEE80211_VHT_CAP_RXLDPC))
-                        lq_sta->ldpc = true;
-
-                if (mvm->cfg->ht_params->stbc &&
-                    (num_of_ant(mvm->fw->valid_tx_ant) > 1) &&
-                    (vht_cap->cap & IEEE80211_VHT_CAP_RXSTBC_MASK))
-                        lq_sta->stbc = true;
-        }
+        if (!vht_cap || !vht_cap->vht_supported)
+                rs_ht_init(mvm, sta, lq_sta, ht_cap);
+        else
+                rs_vht_init(mvm, sta, lq_sta, vht_cap);
 
-        if (IWL_MVM_RS_DISABLE_MIMO)
+        if (IWL_MVM_RS_DISABLE_P2P_MIMO && sta_priv->vif->p2p)
                 lq_sta->active_mimo2_rate = 0;
 
-        lq_sta->max_legacy_rate_idx = find_last_bit(&lq_sta->active_legacy_rate,
-                                                    BITS_PER_LONG);
-        lq_sta->max_siso_rate_idx = find_last_bit(&lq_sta->active_siso_rate,
-                                                  BITS_PER_LONG);
-        lq_sta->max_mimo2_rate_idx = find_last_bit(&lq_sta->active_mimo2_rate,
-                                                   BITS_PER_LONG);
+        lq_sta->max_legacy_rate_idx =
+                rs_get_max_rate_from_mask(lq_sta->active_legacy_rate);
+        lq_sta->max_siso_rate_idx =
+                rs_get_max_rate_from_mask(lq_sta->active_siso_rate);
+        lq_sta->max_mimo2_rate_idx =
+                rs_get_max_rate_from_mask(lq_sta->active_mimo2_rate);
 
         IWL_DEBUG_RATE(mvm,
-                       "RATE MASK: LEGACY=%lX SISO=%lX MIMO2=%lX VHT=%d LDPC=%d STBC%d\n",
+                       "RATE MASK: LEGACY=%lX SISO=%lX MIMO2=%lX VHT=%d LDPC=%d STBC=%d\n",
                        lq_sta->active_legacy_rate,
                        lq_sta->active_siso_rate,
                        lq_sta->active_mimo2_rate,
@@ -2785,14 +2790,14 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 
         /* These values will be overridden later */
         lq_sta->lq.single_stream_ant_msk =
-                first_antenna(mvm->fw->valid_tx_ant);
+                first_antenna(iwl_mvm_get_valid_tx_ant(mvm));
         lq_sta->lq.dual_stream_ant_msk = ANT_AB;
 
         /* as default allow aggregation for all tids */
         lq_sta->tx_agg_tid_en = IWL_AGG_ALL_TID;
         lq_sta->is_agg = 0;
 #ifdef CONFIG_IWLWIFI_DEBUGFS
-        iwl_mvm_reset_frame_stats(mvm, &mvm->drv_rx_stats);
+        iwl_mvm_reset_frame_stats(mvm);
 #endif
         rs_initialize_lq(mvm, sta, lq_sta, band, init);
 }
@@ -2861,12 +2866,13 @@ static void rs_fill_rates_for_column(struct iwl_mvm *mvm,
         int index = *rs_table_index;
 
         for (i = 0; i < num_rates && index < end; i++) {
-                ucode_rate = cpu_to_le32(ucode_rate_from_rs_rate(mvm, rate));
-                for (j = 0; j < num_retries && index < end; j++, index++)
+                for (j = 0; j < num_retries && index < end; j++, index++) {
+                        ucode_rate = cpu_to_le32(ucode_rate_from_rs_rate(mvm,
+                                                                         rate));
                         rs_table[index] = ucode_rate;
-
-                if (toggle_ant)
-                        rs_toggle_antenna(valid_tx_ant, rate);
+                        if (toggle_ant)
+                                rs_toggle_antenna(valid_tx_ant, rate);
+                }
 
                 prev_rate_idx = rate->index;
                 bottom_reached = rs_get_lower_rate_in_column(lq_sta, rate);
@@ -2874,7 +2880,7 @@ static void rs_fill_rates_for_column(struct iwl_mvm *mvm,
                         break;
         }
 
-        if (!bottom_reached)
+        if (!bottom_reached && !is_legacy(rate))
                 rate->index = prev_rate_idx;
 
         *rs_table_index = index;
@@ -2910,21 +2916,33 @@ static void rs_build_rates_table(struct iwl_mvm *mvm,
         u8 valid_tx_ant = 0;
         struct iwl_lq_cmd *lq_cmd = &lq_sta->lq;
         bool toggle_ant = false;
+        bool stbc_allowed = false;
 
         memcpy(&rate, initial_rate, sizeof(rate));
 
-        valid_tx_ant = mvm->fw->valid_tx_ant;
-        rate.stbc = rs_stbc_allow(mvm, sta, lq_sta);
+        valid_tx_ant = iwl_mvm_get_valid_tx_ant(mvm);
+
+        stbc_allowed = rs_stbc_allow(mvm, sta, lq_sta);
+        if (mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_LQ_SS_PARAMS) {
+                u32 ss_params = RS_SS_PARAMS_VALID;
+
+                if (stbc_allowed)
+                        ss_params |= RS_SS_STBC_ALLOWED;
+                lq_cmd->ss_params = cpu_to_le32(ss_params);
+        } else {
+                /* TODO: remove old API when min FW API hits 14 */
+                rate.stbc = stbc_allowed;
+        }
 
         if (is_siso(&rate)) {
-                num_rates = RS_INITIAL_SISO_NUM_RATES;
-                num_retries = RS_HT_VHT_RETRIES_PER_RATE;
+                num_rates = IWL_MVM_RS_INITIAL_SISO_NUM_RATES;
+                num_retries = IWL_MVM_RS_HT_VHT_RETRIES_PER_RATE;
         } else if (is_mimo(&rate)) {
-                num_rates = RS_INITIAL_MIMO_NUM_RATES;
-                num_retries = RS_HT_VHT_RETRIES_PER_RATE;
+                num_rates = IWL_MVM_RS_INITIAL_MIMO_NUM_RATES;
+                num_retries = IWL_MVM_RS_HT_VHT_RETRIES_PER_RATE;
         } else {
-                num_rates = RS_INITIAL_LEGACY_NUM_RATES;
-                num_retries = RS_LEGACY_RETRIES_PER_RATE;
+                num_rates = IWL_MVM_RS_INITIAL_LEGACY_NUM_RATES;
+                num_retries = IWL_MVM_RS_INITIAL_LEGACY_RETRIES;
                 toggle_ant = true;
         }
 
@@ -2935,12 +2953,12 @@ static void rs_build_rates_table(struct iwl_mvm *mvm,
         rs_get_lower_rate_down_column(lq_sta, &rate);
 
         if (is_siso(&rate)) {
-                num_rates = RS_SECONDARY_SISO_NUM_RATES;
-                num_retries = RS_SECONDARY_SISO_RETRIES;
+                num_rates = IWL_MVM_RS_SECONDARY_SISO_NUM_RATES;
+                num_retries = IWL_MVM_RS_SECONDARY_SISO_RETRIES;
                 lq_cmd->mimo_delim = index;
         } else if (is_legacy(&rate)) {
-                num_rates = RS_SECONDARY_LEGACY_NUM_RATES;
-                num_retries = RS_LEGACY_RETRIES_PER_RATE;
+                num_rates = IWL_MVM_RS_SECONDARY_LEGACY_NUM_RATES;
+                num_retries = IWL_MVM_RS_SECONDARY_LEGACY_RETRIES;
         } else {
                 WARN_ON_ONCE(1);
         }
@@ -2953,8 +2971,8 @@ static void rs_build_rates_table(struct iwl_mvm *mvm,
 
         rs_get_lower_rate_down_column(lq_sta, &rate);
 
-        num_rates = RS_SECONDARY_LEGACY_NUM_RATES;
-        num_retries = RS_LEGACY_RETRIES_PER_RATE;
+        num_rates = IWL_MVM_RS_SECONDARY_LEGACY_NUM_RATES;
+        num_retries = IWL_MVM_RS_SECONDARY_LEGACY_RETRIES;
 
         rs_fill_rates_for_column(mvm, lq_sta, &rate, lq_cmd->rs_table, &index,
                                  num_rates, num_retries, valid_tx_ant,
@@ -2971,9 +2989,9 @@ static void rs_fill_lq_cmd(struct iwl_mvm *mvm,
         struct iwl_mvm_sta *mvmsta;
         struct iwl_mvm_vif *mvmvif;
 
-        lq_cmd->agg_disable_start_th = LINK_QUAL_AGG_DISABLE_START_DEF;
+        lq_cmd->agg_disable_start_th = IWL_MVM_RS_AGG_DISABLE_START;
         lq_cmd->agg_time_limit =
-                cpu_to_le16(LINK_QUAL_AGG_TIME_LIMIT_DEF);
+                cpu_to_le16(IWL_MVM_RS_AGG_TIME_LIMIT);
 
 #ifdef CONFIG_MAC80211_DEBUGFS
         if (lq_sta->pers.dbg_fixed_rate) {
@@ -3167,9 +3185,9 @@ static ssize_t rs_sta_dbgfs_scale_table_read(struct file *file,
         desc += sprintf(buff+desc, "fixed rate 0x%X\n",
                         lq_sta->pers.dbg_fixed_rate);
         desc += sprintf(buff+desc, "valid_tx_ant %s%s%s\n",
-            (mvm->fw->valid_tx_ant & ANT_A) ? "ANT_A," : "",
-            (mvm->fw->valid_tx_ant & ANT_B) ? "ANT_B," : "",
-            (mvm->fw->valid_tx_ant & ANT_C) ? "ANT_C" : "");
+            (iwl_mvm_get_valid_tx_ant(mvm) & ANT_A) ? "ANT_A," : "",
+            (iwl_mvm_get_valid_tx_ant(mvm) & ANT_B) ? "ANT_B," : "",
+            (iwl_mvm_get_valid_tx_ant(mvm) & ANT_C) ? "ANT_C" : "");
         desc += sprintf(buff+desc, "lq type %s\n",
                         (is_legacy(rate)) ? "legacy" :
                         is_vht(rate) ? "VHT" : "HT");
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.h b/drivers/net/wireless/iwlwifi/mvm/rs.h
index defd70a6d9e6..f8f5bf21cc38 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.h
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.h
@@ -137,42 +137,10 @@ enum {
 
 #define IWL_INVALID_VALUE    -1
 
-#define IWL_MIN_RSSI_VAL                 -100
-#define IWL_MAX_RSSI_VAL                    0
-
-/* These values specify how many Tx frame attempts before
- * searching for a new modulation mode */
-#define IWL_LEGACY_FAILURE_LIMIT        160
-#define IWL_LEGACY_SUCCESS_LIMIT        480
-#define IWL_LEGACY_TABLE_COUNT          160
-
-#define IWL_NONE_LEGACY_FAILURE_LIMIT   400
-#define IWL_NONE_LEGACY_SUCCESS_LIMIT   4500
-#define IWL_NONE_LEGACY_TABLE_COUNT     1500
-
-/* Success ratio (ACKed / attempted tx frames) values (perfect is 128 * 100) */
-#define IWL_RS_GOOD_RATIO               12800   /* 100% */
-#define IWL_RATE_SCALE_SWITCH           10880   /*  85% */
-#define IWL_RATE_HIGH_TH                10880   /*  85% */
-#define IWL_RATE_INCREASE_TH            6400    /*  50% */
-#define RS_SR_FORCE_DECREASE            1920    /*  15% */
-#define RS_SR_NO_DECREASE               10880   /*  85% */
-
-#define TPC_SR_FORCE_INCREASE           9600    /* 75% */
-#define TPC_SR_NO_INCREASE              10880   /* 85% */
-#define TPC_TX_POWER_STEP               3
 #define TPC_MAX_REDUCTION               15
 #define TPC_NO_REDUCTION                0
 #define TPC_INVALID                     0xff
 
-#define LINK_QUAL_AGG_TIME_LIMIT_DEF    (4000) /* 4 milliseconds */
-#define LINK_QUAL_AGG_TIME_LIMIT_MAX    (8000)
-#define LINK_QUAL_AGG_TIME_LIMIT_MIN    (100)
-
-#define LINK_QUAL_AGG_DISABLE_START_DEF (3)
-#define LINK_QUAL_AGG_DISABLE_START_MAX (255)
-#define LINK_QUAL_AGG_DISABLE_START_MIN (0)
-
 #define LINK_QUAL_AGG_FRAME_LIMIT_DEF   (63)
 #define LINK_QUAL_AGG_FRAME_LIMIT_MAX   (63)
 #define LINK_QUAL_AGG_FRAME_LIMIT_MIN   (0)
@@ -181,14 +149,7 @@ enum {
 
 /* load per tid defines for A-MPDU activation */
 #define IWL_AGG_TPT_THREHOLD    0
-#define IWL_AGG_LOAD_THRESHOLD  10
 #define IWL_AGG_ALL_TID         0xff
-#define TID_QUEUE_CELL_SPACING  50      /*mS */
-#define TID_QUEUE_MAX_SIZE      20
-#define TID_ROUND_VALUE         5       /* mS */
-
-#define TID_MAX_TIME_DIFF ((TID_QUEUE_MAX_SIZE - 1) * TID_QUEUE_CELL_SPACING)
-#define TIME_WRAP_AROUND(x, y) (((y) > (x)) ? (y) - (x) : (0-(x)) + (y))
 
 enum iwl_table_type {
         LQ_NONE,
diff --git a/drivers/net/wireless/iwlwifi/mvm/rx.c b/drivers/net/wireless/iwlwifi/mvm/rx.c
index 94b6e7297a1e..f922131b4eab 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rx.c
@@ -407,7 +407,7 @@ int iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
         }
 
 #ifdef CONFIG_IWLWIFI_DEBUGFS
-        iwl_mvm_update_frame_stats(mvm, &mvm->drv_rx_stats, rate_n_flags,
+        iwl_mvm_update_frame_stats(mvm, rate_n_flags,
                                    rx_status->flag & RX_FLAG_AMPDU_DETAILS);
 #endif
         iwl_mvm_pass_packet_to_mac80211(mvm, skb, hdr, len, ampdu_status,
@@ -511,13 +511,17 @@ int iwl_mvm_rx_statistics(struct iwl_mvm *mvm,
 {
         struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_notif_statistics *stats = (void *)&pkt->data;
-        struct mvm_statistics_general_common *common = &stats->general.common;
         struct iwl_mvm_stat_data data = {
                 .stats = stats,
                 .mvm = mvm,
         };
 
-        iwl_mvm_tt_temp_changed(mvm, le32_to_cpu(common->temperature));
+        /* Only handle rx statistics temperature changes if async temp
+         * notifications are not supported
+         */
+        if (!(mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_ASYNC_DTM))
+                iwl_mvm_tt_temp_changed(mvm,
+                                le32_to_cpu(stats->general.radio_temperature));
 
         iwl_mvm_update_rx_statistics(mvm, stats);
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index ec9a8e7bae1d..3bd5f34d3285 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -72,6 +72,8 @@
 
 #define IWL_PLCP_QUIET_THRESH 1
 #define IWL_ACTIVE_QUIET_TIME 10
+#define IWL_DENSE_EBS_SCAN_RATIO 5
+#define IWL_SPARSE_EBS_SCAN_RATIO 1
 
 struct iwl_mvm_scan_params {
         u32 max_out_time;
@@ -97,7 +99,7 @@ static u8 iwl_mvm_scan_rx_ant(struct iwl_mvm *mvm)
 {
         if (mvm->scan_rx_ant != ANT_NONE)
                 return mvm->scan_rx_ant;
-        return mvm->fw->valid_rx_ant;
+        return iwl_mvm_get_valid_rx_ant(mvm);
 }
 
 static inline __le16 iwl_mvm_scan_rx_chain(struct iwl_mvm *mvm)
@@ -128,7 +130,7 @@ iwl_mvm_scan_rate_n_flags(struct iwl_mvm *mvm, enum ieee80211_band band,
         u32 tx_ant;
 
         mvm->scan_last_antenna_idx =
-                iwl_mvm_next_antenna(mvm, mvm->fw->valid_tx_ant,
+                iwl_mvm_next_antenna(mvm, iwl_mvm_get_valid_tx_ant(mvm),
                                      mvm->scan_last_antenna_idx);
         tx_ant = BIT(mvm->scan_last_antenna_idx) << RATE_MCS_ANT_POS;
 
@@ -288,11 +290,11 @@ static void iwl_mvm_scan_condition_iterator(void *data, u8 *mac,
                                             struct ieee80211_vif *vif)
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        bool *global_bound = data;
+        int *global_cnt = data;
 
         if (vif->type != NL80211_IFTYPE_P2P_DEVICE && mvmvif->phy_ctxt &&
             mvmvif->phy_ctxt->id < MAX_PHYS)
-                *global_bound = true;
+                *global_cnt += 1;
 }
 
 static void iwl_mvm_scan_calc_params(struct iwl_mvm *mvm,
@@ -300,27 +302,31 @@ static void iwl_mvm_scan_calc_params(struct iwl_mvm *mvm,
                                      int n_ssids, u32 flags,
                                      struct iwl_mvm_scan_params *params)
 {
-        bool global_bound = false;
+        int global_cnt = 0;
         enum ieee80211_band band;
         u8 frag_passive_dwell = 0;
 
         ieee80211_iterate_active_interfaces_atomic(mvm->hw,
                                             IEEE80211_IFACE_ITER_NORMAL,
                                             iwl_mvm_scan_condition_iterator,
-                                            &global_bound);
+                                            &global_cnt);
 
-        if (!global_bound)
+        if (!global_cnt)
                 goto not_bound;
 
         params->suspend_time = 30;
-        params->max_out_time = 170;
+        params->max_out_time = 120;
 
         if (iwl_mvm_low_latency(mvm)) {
                 if (mvm->fw->ucode_capa.api[0] &
                     IWL_UCODE_TLV_API_FRAGMENTED_SCAN) {
                         params->suspend_time = 105;
-                        params->max_out_time = 70;
-                        frag_passive_dwell = 20;
+                        /*
+                         * If there is more than one active interface make
+                         * passive scan more fragmented.
+                         */
+                        frag_passive_dwell = (global_cnt < 2) ? 40 : 20;
+                        params->max_out_time = frag_passive_dwell;
                 } else {
                         params->suspend_time = 120;
                         params->max_out_time = 120;
@@ -537,6 +543,19 @@ int iwl_mvm_rx_scan_response(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
         return 0;
 }
 
+int iwl_mvm_rx_scan_offload_iter_complete_notif(struct iwl_mvm *mvm,
+                                                struct iwl_rx_cmd_buffer *rxb,
+                                                struct iwl_device_cmd *cmd)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        struct iwl_scan_complete_notif *notif = (void *)pkt->data;
+
+        IWL_DEBUG_SCAN(mvm,
+                       "Scan offload iteration complete: status=0x%x scanned channels=%d\n",
+                       notif->status, notif->scanned_channels);
+        return 0;
+}
+
 int iwl_mvm_rx_scan_complete(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
                           struct iwl_device_cmd *cmd)
 {
@@ -1105,6 +1124,12 @@ int iwl_mvm_scan_offload_stop(struct iwl_mvm *mvm, bool notify)
                 return iwl_umac_scan_stop(mvm, IWL_UMAC_SCAN_UID_SCHED_SCAN,
                                           notify);
 
+        if (mvm->scan_status == IWL_MVM_SCAN_NONE)
+                return 0;
+
+        if (iwl_mvm_is_radio_killed(mvm))
+                goto out;
+
         if (mvm->scan_status != IWL_MVM_SCAN_SCHED &&
             (!(mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_LMAC_SCAN) ||
              mvm->scan_status != IWL_MVM_SCAN_OS)) {
@@ -1141,6 +1166,7 @@ int iwl_mvm_scan_offload_stop(struct iwl_mvm *mvm, bool notify)
         if (mvm->scan_status == IWL_MVM_SCAN_OS)
                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
 
+out:
         mvm->scan_status = IWL_MVM_SCAN_NONE;
 
         if (notify) {
@@ -1297,18 +1323,6 @@ iwl_mvm_build_generic_unified_scan_cmd(struct iwl_mvm *mvm,
         cmd->scan_prio = cpu_to_le32(IWL_SCAN_PRIORITY_HIGH);
         cmd->iter_num = cpu_to_le32(1);
 
-        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_EBS_SUPPORT &&
-            mvm->last_ebs_successful) {
-                cmd->channel_opt[0].flags =
-                        cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
-                                    IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
-                                    IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
-                cmd->channel_opt[1].flags =
-                        cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
-                                    IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
-                                    IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
-        }
-
         if (iwl_mvm_rrm_scan_needed(mvm))
                 cmd->scan_flags |=
                         cpu_to_le32(IWL_MVM_LMAC_SCAN_FLAGS_RRM_ENABLED);
@@ -1383,6 +1397,22 @@ int iwl_mvm_unified_scan_lmac(struct iwl_mvm *mvm,
         cmd->schedule[1].iterations = 0;
         cmd->schedule[1].full_scan_mul = 0;
 
+        if (mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_SINGLE_SCAN_EBS &&
+            mvm->last_ebs_successful) {
+                cmd->channel_opt[0].flags =
+                        cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
+                                    IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
+                                    IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
+                cmd->channel_opt[0].non_ebs_ratio =
+                        cpu_to_le16(IWL_DENSE_EBS_SCAN_RATIO);
+                cmd->channel_opt[1].flags =
+                        cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
+                                    IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
+                                    IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
+                cmd->channel_opt[1].non_ebs_ratio =
+                        cpu_to_le16(IWL_SPARSE_EBS_SCAN_RATIO);
+        }
+
         for (i = 1; i <= req->req.n_ssids; i++)
                 ssid_bitmap |= BIT(i);
 
@@ -1467,6 +1497,11 @@ int iwl_mvm_unified_sched_scan_lmac(struct iwl_mvm *mvm,
         if (req->n_ssids == 0)
                 flags |= IWL_MVM_LMAC_SCAN_FLAG_PASSIVE;
 
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        if (mvm->scan_iter_notif_enabled)
+                flags |= IWL_MVM_LMAC_SCAN_FLAG_ITER_COMPLETE;
+#endif
+
         cmd->scan_flags |= cpu_to_le32(flags);
 
         cmd->flags = iwl_mvm_scan_rxon_flags(req->channels[0]->band);
@@ -1483,6 +1518,22 @@ int iwl_mvm_unified_sched_scan_lmac(struct iwl_mvm *mvm,
         cmd->schedule[1].iterations = 0xff;
         cmd->schedule[1].full_scan_mul = IWL_FULL_SCAN_MULTIPLIER;
 
+        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_EBS_SUPPORT &&
+            mvm->last_ebs_successful) {
+                cmd->channel_opt[0].flags =
+                        cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
+                                    IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
+                                    IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
+                cmd->channel_opt[0].non_ebs_ratio =
+                        cpu_to_le16(IWL_DENSE_EBS_SCAN_RATIO);
+                cmd->channel_opt[1].flags =
+                        cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
+                                    IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
+                                    IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
+                cmd->channel_opt[1].non_ebs_ratio =
+                        cpu_to_le16(IWL_SPARSE_EBS_SCAN_RATIO);
+        }
+
         iwl_mvm_lmac_scan_cfg_channels(mvm, req->channels, req->n_channels,
                                        ssid_bitmap, cmd);
 
@@ -1612,7 +1663,7 @@ int iwl_mvm_config_scan(struct iwl_mvm *mvm)
                                          SCAN_CONFIG_FLAG_SET_MAC_ADDR |
                                          SCAN_CONFIG_FLAG_SET_CHANNEL_FLAGS|
                                          SCAN_CONFIG_N_CHANNELS(num_channels));
-        scan_config->tx_chains = cpu_to_le32(mvm->fw->valid_tx_ant);
+        scan_config->tx_chains = cpu_to_le32(iwl_mvm_get_valid_tx_ant(mvm));
         scan_config->rx_chains = cpu_to_le32(iwl_mvm_scan_rx_ant(mvm));
         scan_config->legacy_rates = iwl_mvm_scan_config_rates(mvm);
         scan_config->out_of_channel_time = cpu_to_le32(170);
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
index d86fe432e51f..14a848480d04 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
@@ -99,7 +99,7 @@ static int iwl_mvm_find_free_sta_id(struct iwl_mvm *mvm,
 int iwl_mvm_sta_send_to_fw(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                            bool update)
 {
-        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_mvm_add_sta_cmd add_sta_cmd = {
                 .sta_id = mvm_sta->sta_id,
                 .mac_id_n_color = cpu_to_le32(mvm_sta->mac_id_n_color),
@@ -250,8 +250,8 @@ static void iwl_mvm_tdls_sta_deinit(struct iwl_mvm *mvm,
 
         /* disable the TDLS STA-specific queues */
         sta_msk = mvmsta->tfd_queue_msk;
-        for_each_set_bit(i, &sta_msk, sizeof(sta_msk))
-                iwl_mvm_disable_txq(mvm, i);
+        for_each_set_bit(i, &sta_msk, sizeof(sta_msk) * BITS_PER_BYTE)
+                iwl_mvm_disable_txq(mvm, i, 0);
 }
 
 int iwl_mvm_add_sta(struct iwl_mvm *mvm,
@@ -259,7 +259,7 @@ int iwl_mvm_add_sta(struct iwl_mvm *mvm,
                     struct ieee80211_sta *sta)
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
         int i, ret, sta_id;
 
         lockdep_assert_held(&mvm->mutex);
@@ -464,8 +464,8 @@ void iwl_mvm_sta_drained_wk(struct work_struct *wk)
                 if (mvm->tfd_drained[sta_id]) {
                         unsigned long i, msk = mvm->tfd_drained[sta_id];
 
-                        for_each_set_bit(i, &msk, sizeof(msk))
-                                iwl_mvm_disable_txq(mvm, i);
+                        for_each_set_bit(i, &msk, sizeof(msk) * BITS_PER_BYTE)
+                                iwl_mvm_disable_txq(mvm, i, 0);
 
                         mvm->tfd_drained[sta_id] = 0;
                         IWL_DEBUG_TDLS(mvm, "Drained sta %d, with queues %ld\n",
@@ -481,7 +481,7 @@ int iwl_mvm_rm_sta(struct iwl_mvm *mvm,
                    struct ieee80211_sta *sta)
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
         int ret;
 
         lockdep_assert_held(&mvm->mutex);
@@ -774,7 +774,7 @@ int iwl_mvm_rm_bcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                        int tid, u16 ssn, bool start)
 {
-        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_mvm_add_sta_cmd cmd = {};
         int ret;
         u32 status;
@@ -834,7 +834,7 @@ int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 static int iwl_mvm_sta_tx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                               int tid, u8 queue, bool start)
 {
-        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_mvm_add_sta_cmd cmd = {};
         int ret;
         u32 status;
@@ -1058,7 +1058,7 @@ int iwl_mvm_sta_tx_agg_stop(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 
                 iwl_mvm_sta_tx_agg(mvm, sta, tid, txq_id, false);
 
-                iwl_mvm_disable_txq(mvm, txq_id);
+                iwl_mvm_disable_txq(mvm, txq_id, 0);
                 return 0;
         case IWL_AGG_STARTING:
         case IWL_EMPTYING_HW_QUEUE_ADDBA:
@@ -1116,7 +1116,7 @@ int iwl_mvm_sta_tx_agg_flush(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 
                 iwl_mvm_sta_tx_agg(mvm, sta, tid, txq_id, false);
 
-                iwl_mvm_disable_txq(mvm, tid_data->txq_id);
+                iwl_mvm_disable_txq(mvm, tid_data->txq_id, 0);
         }
 
         mvm->queue_to_mac80211[tid_data->txq_id] =
@@ -1144,10 +1144,10 @@ static int iwl_mvm_set_fw_key_idx(struct iwl_mvm *mvm)
 static u8 iwl_mvm_get_key_sta_id(struct ieee80211_vif *vif,
                                  struct ieee80211_sta *sta)
 {
-        struct iwl_mvm_vif *mvmvif = (void *)vif->drv_priv;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 
         if (sta) {
-                struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+                struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
 
                 return mvm_sta->sta_id;
         }
@@ -1196,6 +1196,7 @@ static int iwl_mvm_send_sta_key(struct iwl_mvm *mvm,
                 break;
         case WLAN_CIPHER_SUITE_WEP104:
                 key_flags |= cpu_to_le16(STA_KEY_FLG_WEP_13BYTES);
+                /* fall through */
         case WLAN_CIPHER_SUITE_WEP40:
                 key_flags |= cpu_to_le16(STA_KEY_FLG_WEP);
                 memcpy(cmd.key + 3, keyconf->key, keyconf->keylen);
@@ -1280,7 +1281,7 @@ static inline u8 *iwl_mvm_get_mac_addr(struct iwl_mvm *mvm,
                                        struct ieee80211_vif *vif,
                                        struct ieee80211_sta *sta)
 {
-        struct iwl_mvm_vif *mvmvif = (void *)vif->drv_priv;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 
         if (sta)
                 return sta->addr;
diff --git a/drivers/net/wireless/iwlwifi/mvm/tt.c b/drivers/net/wireless/iwlwifi/mvm/tt.c
index 2b1e61fac34a..ba615ad2176c 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tt.c
@@ -69,6 +69,7 @@
 
 static void iwl_mvm_enter_ctkill(struct iwl_mvm *mvm)
 {
+        struct iwl_mvm_tt_mgmt *tt = &mvm->thermal_throttle;
         u32 duration = mvm->thermal_throttle.params->ct_kill_duration;
 
         if (test_bit(IWL_MVM_STATUS_HW_CTKILL, &mvm->status))
@@ -77,12 +78,15 @@ static void iwl_mvm_enter_ctkill(struct iwl_mvm *mvm)
         IWL_ERR(mvm, "Enter CT Kill\n");
         iwl_mvm_set_hw_ctkill_state(mvm, true);
 
+        tt->throttle = false;
+        tt->dynamic_smps = false;
+
         /* Don't schedule an exit work if we're in test mode, since
          * the temperature will not change unless we manually set it
          * again (or disable testing).
          */
         if (!mvm->temperature_test)
-                schedule_delayed_work(&mvm->thermal_throttle.ct_kill_exit,
+                schedule_delayed_work(&tt->ct_kill_exit,
                                       round_jiffies_relative(duration * HZ));
 }
 
@@ -452,6 +456,7 @@ void iwl_mvm_tt_initialize(struct iwl_mvm *mvm, u32 min_backoff)
                 tt->params = &iwl7000_tt_params;
 
         tt->throttle = false;
+        tt->dynamic_smps = false;
         tt->min_backoff = min_backoff;
         INIT_DELAYED_WORK(&tt->ct_kill_exit, check_exit_ctkill);
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index 4333306ccdee..07304e1fd64a 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -90,8 +90,6 @@ void iwl_mvm_set_tx_cmd(struct iwl_mvm *mvm, struct sk_buff *skb,
 
         if (ieee80211_is_probe_resp(fc))
                 tx_flags |= TX_CMD_FLG_TSF;
-        else if (ieee80211_is_back_req(fc))
-                tx_flags |= TX_CMD_FLG_ACK | TX_CMD_FLG_BAR;
 
         if (ieee80211_has_morefrags(fc))
                 tx_flags |= TX_CMD_FLG_MORE_FRAG;
@@ -100,6 +98,15 @@ void iwl_mvm_set_tx_cmd(struct iwl_mvm *mvm, struct sk_buff *skb,
                 u8 *qc = ieee80211_get_qos_ctl(hdr);
                 tx_cmd->tid_tspec = qc[0] & 0xf;
                 tx_flags &= ~TX_CMD_FLG_SEQ_CTL;
+        } else if (ieee80211_is_back_req(fc)) {
+                struct ieee80211_bar *bar = (void *)skb->data;
+                u16 control = le16_to_cpu(bar->control);
+
+                tx_flags |= TX_CMD_FLG_ACK | TX_CMD_FLG_BAR;
+                tx_cmd->tid_tspec = (control &
+                                     IEEE80211_BAR_CTRL_TID_INFO_MASK) >>
+                        IEEE80211_BAR_CTRL_TID_INFO_SHIFT;
+                WARN_ON_ONCE(tx_cmd->tid_tspec >= IWL_MAX_TID_COUNT);
         } else {
                 tx_cmd->tid_tspec = IWL_TID_NON_QOS;
                 if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ)
@@ -213,7 +220,7 @@ void iwl_mvm_set_tx_cmd_rate(struct iwl_mvm *mvm, struct iwl_tx_cmd *tx_cmd,
         rate_plcp = iwl_mvm_mac80211_idx_to_hwrate(rate_idx);
 
         mvm->mgmt_last_antenna_idx =
-                iwl_mvm_next_antenna(mvm, mvm->fw->valid_tx_ant,
+                iwl_mvm_next_antenna(mvm, iwl_mvm_get_valid_tx_ant(mvm),
                                      mvm->mgmt_last_antenna_idx);
 
         if (info->band == IEEE80211_BAND_2GHZ &&
@@ -500,7 +507,7 @@ static void iwl_mvm_check_ratid_empty(struct iwl_mvm *mvm,
                 IWL_DEBUG_TX_QUEUES(mvm,
                                     "Can continue DELBA flow ssn = next_recl = %d\n",
                                     tid_data->next_reclaimed);
-                iwl_mvm_disable_txq(mvm, tid_data->txq_id);
+                iwl_mvm_disable_txq(mvm, tid_data->txq_id, CMD_ASYNC);
                 tid_data->state = IWL_AGG_OFF;
                 /*
                  * we can't hold the mutex - but since we are after a sequence
@@ -660,7 +667,8 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
 
                 /* Single frame failure in an AMPDU queue => send BAR */
                 if (txq_id >= mvm->first_agg_queue &&
-                    !(info->flags & IEEE80211_TX_STAT_ACK))
+                    !(info->flags & IEEE80211_TX_STAT_ACK) &&
+                    !(info->flags & IEEE80211_TX_STAT_TX_FILTERED))
                         info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;
 
                 /* W/A FW bug: seq_ctl is wrong when the status isn't success */
@@ -923,6 +931,11 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
         sta_id = ba_notif->sta_id;
         tid = ba_notif->tid;
 
+        if (WARN_ONCE(sta_id >= IWL_MVM_STATION_COUNT ||
+                      tid >= IWL_MAX_TID_COUNT,
+                      "sta_id %d tid %d", sta_id, tid))
+                return 0;
+
         rcu_read_lock();
 
         sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
diff --git a/drivers/net/wireless/iwlwifi/mvm/utils.c b/drivers/net/wireless/iwlwifi/mvm/utils.c
index 917431e30f74..4eb3cad31aa9 100644
--- a/drivers/net/wireless/iwlwifi/mvm/utils.c
+++ b/drivers/net/wireless/iwlwifi/mvm/utils.c
@@ -533,47 +533,46 @@ void iwl_mvm_dump_nic_error_log(struct iwl_mvm *mvm)
 void iwl_mvm_enable_txq(struct iwl_mvm *mvm, int queue, u16 ssn,
                         const struct iwl_trans_txq_scd_cfg *cfg)
 {
-        if (iwl_mvm_is_dqa_supported(mvm)) {
-                struct iwl_scd_txq_cfg_cmd cmd = {
-                        .scd_queue = queue,
-                        .enable = 1,
-                        .window = cfg->frame_limit,
-                        .sta_id = cfg->sta_id,
-                        .ssn = cpu_to_le16(ssn),
-                        .tx_fifo = cfg->fifo,
-                        .aggregate = cfg->aggregate,
-                        .flags = IWL_SCD_FLAGS_DQA_ENABLED,
-                        .tid = cfg->tid,
-                        .control = IWL_SCD_CONTROL_SET_SSN,
-                };
-                int ret = iwl_mvm_send_cmd_pdu(mvm, SCD_QUEUE_CFG, 0,
-                                               sizeof(cmd), &cmd);
-                if (ret)
-                        IWL_ERR(mvm,
-                                "Failed to configure queue %d on FIFO %d\n",
-                                queue, cfg->fifo);
+        struct iwl_scd_txq_cfg_cmd cmd = {
+                .scd_queue = queue,
+                .enable = 1,
+                .window = cfg->frame_limit,
+                .sta_id = cfg->sta_id,
+                .ssn = cpu_to_le16(ssn),
+                .tx_fifo = cfg->fifo,
+                .aggregate = cfg->aggregate,
+                .tid = cfg->tid,
+        };
+
+        if (!iwl_mvm_is_scd_cfg_supported(mvm)) {
+                iwl_trans_txq_enable_cfg(mvm->trans, queue, ssn, cfg);
+                return;
         }
 
-        iwl_trans_txq_enable_cfg(mvm->trans, queue, ssn,
-                                 iwl_mvm_is_dqa_supported(mvm) ? NULL : cfg);
+        iwl_trans_txq_enable_cfg(mvm->trans, queue, ssn, NULL);
+        WARN(iwl_mvm_send_cmd_pdu(mvm, SCD_QUEUE_CFG, 0, sizeof(cmd), &cmd),
+             "Failed to configure queue %d on FIFO %d\n", queue, cfg->fifo);
 }
 
-void iwl_mvm_disable_txq(struct iwl_mvm *mvm, int queue)
+void iwl_mvm_disable_txq(struct iwl_mvm *mvm, int queue, u8 flags)
 {
-        iwl_trans_txq_disable(mvm->trans, queue,
-                              !iwl_mvm_is_dqa_supported(mvm));
-
-        if (iwl_mvm_is_dqa_supported(mvm)) {
-                struct iwl_scd_txq_cfg_cmd cmd = {
-                        .scd_queue = queue,
-                        .enable = 0,
-                };
-                int ret = iwl_mvm_send_cmd_pdu(mvm, SCD_QUEUE_CFG, CMD_ASYNC,
-                                               sizeof(cmd), &cmd);
-                if (ret)
-                        IWL_ERR(mvm, "Failed to disable queue %d (ret=%d)\n",
-                                queue, ret);
+        struct iwl_scd_txq_cfg_cmd cmd = {
+                .scd_queue = queue,
+                .enable = 0,
+        };
+        int ret;
+
+        if (!iwl_mvm_is_scd_cfg_supported(mvm)) {
+                iwl_trans_txq_disable(mvm->trans, queue, true);
+                return;
         }
+
+        iwl_trans_txq_disable(mvm->trans, queue, false);
+        ret = iwl_mvm_send_cmd_pdu(mvm, SCD_QUEUE_CFG, flags,
+                                   sizeof(cmd), &cmd);
+        if (ret)
+                IWL_ERR(mvm, "Failed to disable queue %d (ret=%d)\n",
+                        queue, ret);
 }
 
 /**
@@ -620,7 +619,7 @@ void iwl_mvm_update_smps(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         lockdep_assert_held(&mvm->mutex);
 
         /* SMPS is irrelevant for NICs that don't have at least 2 RX antenna */
-        if (num_of_ant(mvm->fw->valid_rx_ant) == 1)
+        if (num_of_ant(iwl_mvm_get_valid_rx_ant(mvm)) == 1)
                 return;
 
         if (vif->type == NL80211_IFTYPE_AP)
@@ -662,7 +661,7 @@ bool iwl_mvm_rx_diversity_allowed(struct iwl_mvm *mvm)
 
         lockdep_assert_held(&mvm->mutex);
 
-        if (num_of_ant(mvm->fw->valid_rx_ant) == 1)
+        if (num_of_ant(iwl_mvm_get_valid_rx_ant(mvm)) == 1)
                 return false;
 
         if (mvm->cfg->rx_with_siso_diversity)
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index d5aadb00dd9e..dbd6bcf52205 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -415,6 +415,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x24F3, 0x0010, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F3, 0x0004, iwl8260_2n_cfg)},
         {IWL_PCI_DEVICE(0x24F4, 0x0030, iwl8260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x24F5, 0x0010, iwl4165_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x24F6, 0x0030, iwl4165_2ac_cfg)},
 #endif /* CONFIG_IWLMVM */
 
         {0}
diff --git a/drivers/net/wireless/iwlwifi/pcie/internal.h b/drivers/net/wireless/iwlwifi/pcie/internal.h
index 1aea6b66c594..e5652d82d79e 100644
--- a/drivers/net/wireless/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/iwlwifi/pcie/internal.h
@@ -318,6 +318,11 @@ struct iwl_trans_pcie {
         /*protect hw register */
         spinlock_t reg_lock;
         bool cmd_in_flight;
+        bool ref_cmd_in_flight;
+
+        /* protect ref counter */
+        spinlock_t ref_lock;
+        u32 ref_count;
 
         dma_addr_t fw_mon_phys;
         struct page *fw_mon_page;
@@ -381,6 +386,9 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
                             struct sk_buff_head *skbs);
 void iwl_trans_pcie_tx_reset(struct iwl_trans *trans);
 
+void iwl_trans_pcie_ref(struct iwl_trans *trans);
+void iwl_trans_pcie_unref(struct iwl_trans *trans);
+
 static inline u16 iwl_pcie_tfd_tb_get_len(struct iwl_tfd *tfd, u8 idx)
 {
         struct iwl_tfd_tb *tb = &tfd->tbs[idx];
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 523fe0c88dcb..1ff87677c3d3 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -443,10 +443,25 @@ static int iwl_pcie_apm_stop_master(struct iwl_trans *trans)
         return ret;
 }
 
-static void iwl_pcie_apm_stop(struct iwl_trans *trans)
+static void iwl_pcie_apm_stop(struct iwl_trans *trans, bool op_mode_leave)
 {
         IWL_DEBUG_INFO(trans, "Stop card, put in low power state\n");
 
+        if (op_mode_leave) {
+                if (!test_bit(STATUS_DEVICE_ENABLED, &trans->status))
+                        iwl_pcie_apm_init(trans);
+
+                /* inform ME that we are leaving */
+                if (trans->cfg->device_family == IWL_DEVICE_FAMILY_7000)
+                        iwl_set_bits_prph(trans, APMG_PCIDEV_STT_REG,
+                                          APMG_PCIDEV_STT_VAL_WAKE_ME);
+                else if (trans->cfg->device_family == IWL_DEVICE_FAMILY_8000)
+                        iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
+                                    CSR_HW_IF_CONFIG_REG_PREPARE |
+                                    CSR_HW_IF_CONFIG_REG_ENABLE_PME);
+                mdelay(5);
+        }
+
         clear_bit(STATUS_DEVICE_ENABLED, &trans->status);
 
         /* Stop device's DMA activity */
@@ -707,6 +722,11 @@ static int iwl_pcie_load_cpu_sections_8000b(struct iwl_trans *trans,
 
         *first_ucode_section = last_read_idx;
 
+        if (cpu == 1)
+                iwl_write_direct32(trans, FH_UCODE_LOAD_STATUS, 0xFFFF);
+        else
+                iwl_write_direct32(trans, FH_UCODE_LOAD_STATUS, 0xFFFFFFFF);
+
         return 0;
 }
 
@@ -893,8 +913,8 @@ static int iwl_pcie_load_given_ucode_8000b(struct iwl_trans *trans,
         if (ret)
                 return ret;
 
-        /* Notify FW loading is done */
-        iwl_write_direct32(trans, FH_UCODE_LOAD_STATUS, 0xFFFFFFFF);
+        if (trans->dbg_dest_tlv)
+                iwl_pcie_apply_destination(trans);
 
         /* wait for image verification to complete  */
         ret = iwl_poll_prph_bit(trans, LMPM_SECURE_BOOT_CPU1_STATUS_ADDR_B0,
@@ -916,6 +936,7 @@ static int iwl_pcie_load_given_ucode_8000b(struct iwl_trans *trans,
 static int iwl_trans_pcie_start_fw(struct iwl_trans *trans,
                                    const struct fw_img *fw, bool run_in_rfkill)
 {
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         int ret;
         bool hw_rfkill;
 
@@ -945,6 +966,9 @@ static int iwl_trans_pcie_start_fw(struct iwl_trans *trans,
                 return ret;
         }
 
+        /* init ref_count to 1 (should be cleared when ucode is loaded) */
+        trans_pcie->ref_count = 1;
+
         /* make sure rfkill handshake bits are cleared */
         iwl_write32(trans, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
         iwl_write32(trans, CSR_UCODE_DRV_GP1_CLR,
@@ -960,7 +984,7 @@ static int iwl_trans_pcie_start_fw(struct iwl_trans *trans,
 
         /* Load the given image to the HW */
         if ((trans->cfg->device_family == IWL_DEVICE_FAMILY_8000) &&
-            (CSR_HW_REV_STEP(trans->hw_rev) == SILICON_B_STEP))
+            (CSR_HW_REV_STEP(trans->hw_rev) != SILICON_A_STEP))
                 return iwl_pcie_load_given_ucode_8000b(trans, fw);
         else
                 return iwl_pcie_load_given_ucode(trans, fw);
@@ -1010,7 +1034,7 @@ static void iwl_trans_pcie_stop_device(struct iwl_trans *trans)
                       CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
 
         /* Stop the device, and put it in low power state */
-        iwl_pcie_apm_stop(trans);
+        iwl_pcie_apm_stop(trans, false);
 
         /* stop and reset the on-board processor */
         iwl_write32(trans, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
@@ -1192,7 +1216,7 @@ static void iwl_trans_pcie_op_mode_leave(struct iwl_trans *trans)
         iwl_disable_interrupts(trans);
         spin_unlock(&trans_pcie->irq_lock);
 
-        iwl_pcie_apm_stop(trans);
+        iwl_pcie_apm_stop(trans, true);
 
         spin_lock(&trans_pcie->irq_lock);
         iwl_disable_interrupts(trans);
@@ -1540,6 +1564,38 @@ static void iwl_trans_pcie_set_bits_mask(struct iwl_trans *trans, u32 reg,
         spin_unlock_irqrestore(&trans_pcie->reg_lock, flags);
 }
 
+void iwl_trans_pcie_ref(struct iwl_trans *trans)
+{
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        unsigned long flags;
+
+        if (iwlwifi_mod_params.d0i3_disable)
+                return;
+
+        spin_lock_irqsave(&trans_pcie->ref_lock, flags);
+        IWL_DEBUG_RPM(trans, "ref_counter: %d\n", trans_pcie->ref_count);
+        trans_pcie->ref_count++;
+        spin_unlock_irqrestore(&trans_pcie->ref_lock, flags);
+}
+
+void iwl_trans_pcie_unref(struct iwl_trans *trans)
+{
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        unsigned long flags;
+
+        if (iwlwifi_mod_params.d0i3_disable)
+                return;
+
+        spin_lock_irqsave(&trans_pcie->ref_lock, flags);
+        IWL_DEBUG_RPM(trans, "ref_counter: %d\n", trans_pcie->ref_count);
+        if (WARN_ON_ONCE(trans_pcie->ref_count == 0)) {
+                spin_unlock_irqrestore(&trans_pcie->ref_lock, flags);
+                return;
+        }
+        trans_pcie->ref_count--;
+        spin_unlock_irqrestore(&trans_pcie->ref_lock, flags);
+}
+
 static const char *get_csr_string(int cmd)
 {
 #define IWL_CMD(x) case x: return #x
@@ -2264,6 +2320,9 @@ static const struct iwl_trans_ops trans_ops_pcie = {
         .release_nic_access = iwl_trans_pcie_release_nic_access,
         .set_bits_mask = iwl_trans_pcie_set_bits_mask,
 
+        .ref = iwl_trans_pcie_ref,
+        .unref = iwl_trans_pcie_unref,
+
         .dump_data = iwl_trans_pcie_dump_data,
 };
 
@@ -2291,6 +2350,7 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
         trans_pcie->trans = trans;
         spin_lock_init(&trans_pcie->irq_lock);
         spin_lock_init(&trans_pcie->reg_lock);
+        spin_lock_init(&trans_pcie->ref_lock);
         init_waitqueue_head(&trans_pcie->ucode_write_waitq);
 
         err = pci_enable_device(pdev);
@@ -2404,6 +2464,7 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
         }
 
         trans_pcie->inta_mask = CSR_INI_SET_MASK;
+        trans->d0i3_mode = IWL_D0I3_MODE_ON_SUSPEND;
 
         return trans;
 
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index 8a6c7a084aa1..d40cd4a67d6e 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -985,17 +985,31 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
 
         if (iwl_queue_space(&txq->q) > txq->q.low_mark)
                 iwl_wake_queue(trans, txq);
+
+        if (q->read_ptr == q->write_ptr) {
+                IWL_DEBUG_RPM(trans, "Q %d - last tx reclaimed\n", q->id);
+                iwl_trans_pcie_unref(trans);
+        }
+
 out:
         spin_unlock_bh(&txq->lock);
 }
 
-static int iwl_pcie_set_cmd_in_flight(struct iwl_trans *trans)
+static int iwl_pcie_set_cmd_in_flight(struct iwl_trans *trans,
+                                      const struct iwl_host_cmd *cmd)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         int ret;
 
         lockdep_assert_held(&trans_pcie->reg_lock);
 
+        if (!(cmd->flags & CMD_SEND_IN_IDLE) &&
+            !trans_pcie->ref_cmd_in_flight) {
+                trans_pcie->ref_cmd_in_flight = true;
+                IWL_DEBUG_RPM(trans, "set ref_cmd_in_flight - ref\n");
+                iwl_trans_pcie_ref(trans);
+        }
+
         if (trans_pcie->cmd_in_flight)
                 return 0;
 
@@ -1036,6 +1050,12 @@ static int iwl_pcie_clear_cmd_in_flight(struct iwl_trans *trans)
 
         lockdep_assert_held(&trans_pcie->reg_lock);
 
+        if (trans_pcie->ref_cmd_in_flight) {
+                trans_pcie->ref_cmd_in_flight = false;
+                IWL_DEBUG_RPM(trans, "clear ref_cmd_in_flight - unref\n");
+                iwl_trans_pcie_unref(trans);
+        }
+
         if (WARN_ON(!trans_pcie->cmd_in_flight))
                 return 0;
 
@@ -1170,12 +1190,12 @@ void iwl_trans_pcie_txq_enable(struct iwl_trans *trans, int txq_id, u16 ssn,
          * Assumes that ssn_idx is valid (!= 0xFFF) */
         trans_pcie->txq[txq_id].q.read_ptr = (ssn & 0xff);
         trans_pcie->txq[txq_id].q.write_ptr = (ssn & 0xff);
+        iwl_write_direct32(trans, HBUS_TARG_WRPTR,
+                           (ssn & 0xff) | (txq_id << 8));
 
         if (cfg) {
                 u8 frame_limit = cfg->frame_limit;
 
-                iwl_write_direct32(trans, HBUS_TARG_WRPTR,
-                                   (ssn & 0xff) | (txq_id << 8));
                 iwl_write_prph(trans, SCD_QUEUE_RDPTR(txq_id), ssn);
 
                 /* Set up Tx window size and frame limit for this queue */
@@ -1200,11 +1220,17 @@ void iwl_trans_pcie_txq_enable(struct iwl_trans *trans, int txq_id, u16 ssn,
                 if (txq_id == trans_pcie->cmd_queue &&
                     trans_pcie->scd_set_active)
                         iwl_scd_enable_set_active(trans, BIT(txq_id));
+
+                IWL_DEBUG_TX_QUEUES(trans,
+                                    "Activate queue %d on FIFO %d WrPtr: %d\n",
+                                    txq_id, fifo, ssn & 0xff);
+        } else {
+                IWL_DEBUG_TX_QUEUES(trans,
+                                    "Activate queue %d WrPtr: %d\n",
+                                    txq_id, ssn & 0xff);
         }
 
         trans_pcie->txq[txq_id].active = true;
-        IWL_DEBUG_TX_QUEUES(trans, "Activate queue %d on FIFO %d WrPtr: %d\n",
-                            txq_id, fifo, ssn & 0xff);
 }
 
 void iwl_trans_pcie_txq_disable(struct iwl_trans *trans, int txq_id,
@@ -1473,7 +1499,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
                 mod_timer(&txq->stuck_timer, jiffies + trans_pcie->wd_timeout);
 
         spin_lock_irqsave(&trans_pcie->reg_lock, flags);
-        ret = iwl_pcie_set_cmd_in_flight(trans);
+        ret = iwl_pcie_set_cmd_in_flight(trans, cmd);
         if (ret < 0) {
                 idx = ret;
                 spin_unlock_irqrestore(&trans_pcie->reg_lock, flags);
@@ -1819,9 +1845,13 @@ int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
         wait_write_ptr = ieee80211_has_morefrags(fc);
 
         /* start timer if queue currently empty */
-        if (txq->need_update && q->read_ptr == q->write_ptr &&
-            trans_pcie->wd_timeout)
-                mod_timer(&txq->stuck_timer, jiffies + trans_pcie->wd_timeout);
+        if (q->read_ptr == q->write_ptr) {
+                if (txq->need_update && trans_pcie->wd_timeout)
+                        mod_timer(&txq->stuck_timer,
+                                  jiffies + trans_pcie->wd_timeout);
+                IWL_DEBUG_RPM(trans, "Q: %d first tx - take ref\n", q->id);
+                iwl_trans_pcie_ref(trans);
+        }
 
         /* Tell device the write index *just past* this latest filled TFD */
         q->write_ptr = iwl_queue_inc_wrap(q->write_ptr);
diff --git a/drivers/net/wireless/mwifiex/11n.c b/drivers/net/wireless/mwifiex/11n.c
index 9d4786e7ddff..c5c83cf664d8 100644
--- a/drivers/net/wireless/mwifiex/11n.c
+++ b/drivers/net/wireless/mwifiex/11n.c
@@ -558,10 +558,10 @@ int mwifiex_send_addba(struct mwifiex_private *priv, int tid, u8 *peer_mac)
                 spin_lock_irqsave(&priv->sta_list_spinlock, flags);
                 sta_ptr = mwifiex_get_sta_entry(priv, peer_mac);
                 if (!sta_ptr) {
+                        spin_unlock_irqrestore(&priv->sta_list_spinlock, flags);
                         dev_warn(priv->adapter->dev,
                                  "BA setup with unknown TDLS peer %pM!\n",
                                 peer_mac);
-                        spin_unlock_irqrestore(&priv->sta_list_spinlock, flags);
                         return -1;
                 }
                 if (sta_ptr->is_11ac_enabled)
diff --git a/drivers/net/wireless/mwifiex/11n.h b/drivers/net/wireless/mwifiex/11n.h
index f275675cdbd3..8e2e39422ad8 100644
--- a/drivers/net/wireless/mwifiex/11n.h
+++ b/drivers/net/wireless/mwifiex/11n.h
@@ -130,7 +130,9 @@ static inline u8 mwifiex_space_avail_for_new_ba_stream(
 {
         struct mwifiex_private *priv;
         u8 i;
-        u32 ba_stream_num = 0;
+        u32 ba_stream_num = 0, ba_stream_max;
+
+        ba_stream_max = MWIFIEX_MAX_TX_BASTREAM_SUPPORTED;
 
         for (i = 0; i < adapter->priv_num; i++) {
                 priv = adapter->priv[i];
@@ -139,8 +141,14 @@ static inline u8 mwifiex_space_avail_for_new_ba_stream(
                                 &priv->tx_ba_stream_tbl_ptr);
         }
 
-        return ((ba_stream_num <
-                 MWIFIEX_MAX_TX_BASTREAM_SUPPORTED) ? true : false);
+        if (adapter->fw_api_ver == MWIFIEX_FW_V15) {
+                ba_stream_max =
+                               GETSUPP_TXBASTREAMS(adapter->hw_dot_11n_dev_cap);
+                if (!ba_stream_max)
+                        ba_stream_max = MWIFIEX_MAX_TX_BASTREAM_SUPPORTED;
+        }
+
+        return ((ba_stream_num < ba_stream_max) ? true : false);
 }
 
 /*
diff --git a/drivers/net/wireless/mwifiex/11n_aggr.c b/drivers/net/wireless/mwifiex/11n_aggr.c
index 8720a3d3c755..9b983b5cebbd 100644
--- a/drivers/net/wireless/mwifiex/11n_aggr.c
+++ b/drivers/net/wireless/mwifiex/11n_aggr.c
@@ -101,6 +101,13 @@ mwifiex_11n_form_amsdu_txpd(struct mwifiex_private *priv,
 {
         struct txpd *local_tx_pd;
         struct mwifiex_txinfo *tx_info = MWIFIEX_SKB_TXCB(skb);
+        unsigned int pad;
+        int headroom = (priv->adapter->iface_type ==
+                        MWIFIEX_USB) ? 0 : INTF_HEADER_LEN;
+
+        pad = ((void *)skb->data - sizeof(*local_tx_pd) -
+                headroom - NULL) & (MWIFIEX_DMA_ALIGN_SZ - 1);
+        skb_push(skb, pad);
 
         skb_push(skb, sizeof(*local_tx_pd));
 
@@ -114,10 +121,12 @@ mwifiex_11n_form_amsdu_txpd(struct mwifiex_private *priv,
         local_tx_pd->bss_num = priv->bss_num;
         local_tx_pd->bss_type = priv->bss_type;
         /* Always zero as the data is followed by struct txpd */
-        local_tx_pd->tx_pkt_offset = cpu_to_le16(sizeof(struct txpd));
+        local_tx_pd->tx_pkt_offset = cpu_to_le16(sizeof(struct txpd) +
+                                                 pad);
         local_tx_pd->tx_pkt_type = cpu_to_le16(PKT_TYPE_AMSDU);
         local_tx_pd->tx_pkt_length = cpu_to_le16(skb->len -
-                                                 sizeof(*local_tx_pd));
+                                                 sizeof(*local_tx_pd) -
+                                                 pad);
 
         if (tx_info->flags & MWIFIEX_BUF_FLAG_TDLS_PKT)
                 local_tx_pd->flags |= MWIFIEX_TXPD_FLAGS_TDLS_PACKET;
@@ -182,7 +191,7 @@ mwifiex_11n_aggregate_pkt(struct mwifiex_private *priv,
                                        ra_list_flags);
                 return -1;
         }
-        skb_reserve(skb_aggr, headroom + sizeof(struct txpd));
+        skb_reserve(skb_aggr, MWIFIEX_MIN_DATA_HEADER_LEN);
         tx_info_aggr =  MWIFIEX_SKB_TXCB(skb_aggr);
 
         memset(tx_info_aggr, 0, sizeof(*tx_info_aggr));
diff --git a/drivers/net/wireless/mwifiex/11n_rxreorder.c b/drivers/net/wireless/mwifiex/11n_rxreorder.c
index d73fda312c87..c7ca5b734875 100644
--- a/drivers/net/wireless/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless/mwifiex/11n_rxreorder.c
@@ -353,9 +353,6 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
 
         spin_lock_irqsave(&priv->sta_list_spinlock, flags);
         if (mwifiex_queuing_ra_based(priv)) {
-                dev_dbg(priv->adapter->dev,
-                        "info: AP/ADHOC:last_seq=%d start_win=%d\n",
-                        last_seq, new_node->start_win);
                 if (priv->bss_role == MWIFIEX_BSS_ROLE_UAP) {
                         node = mwifiex_get_sta_entry(priv, ta);
                         if (node)
@@ -370,6 +367,9 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
         }
         spin_unlock_irqrestore(&priv->sta_list_spinlock, flags);
 
+        dev_dbg(priv->adapter->dev, "info: last_seq=%d start_win=%d\n",
+                last_seq, new_node->start_win);
+
         if (last_seq != MWIFIEX_DEF_11N_RX_SEQ_NUM &&
             last_seq >= new_node->start_win) {
                 new_node->start_win = last_seq + 1;
@@ -391,10 +391,8 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
         new_node->timer_context.priv = priv;
         new_node->timer_context.timer_is_set = false;
 
-        init_timer(&new_node->timer_context.timer);
-        new_node->timer_context.timer.function = mwifiex_flush_data;
-        new_node->timer_context.timer.data =
-                        (unsigned long) &new_node->timer_context;
+        setup_timer(&new_node->timer_context.timer, mwifiex_flush_data,
+                    (unsigned long)&new_node->timer_context);
 
         for (i = 0; i < win_size; ++i)
                 new_node->rx_reorder_ptr[i] = NULL;
@@ -468,10 +466,10 @@ int mwifiex_cmd_11n_addba_rsp_gen(struct mwifiex_private *priv,
                 sta_ptr = mwifiex_get_sta_entry(priv,
                                                 cmd_addba_req->peer_mac_addr);
                 if (!sta_ptr) {
+                        spin_unlock_irqrestore(&priv->sta_list_spinlock, flags);
                         dev_warn(priv->adapter->dev,
                                  "BA setup with unknown TDLS peer %pM!\n",
                                  cmd_addba_req->peer_mac_addr);
-                        spin_unlock_irqrestore(&priv->sta_list_spinlock, flags);
                         return -1;
                 }
                 if (sta_ptr->is_11ac_enabled)
diff --git a/drivers/net/wireless/mwifiex/Makefile b/drivers/net/wireless/mwifiex/Makefile
index 9487d728ac20..fdfd9bf15ed4 100644
--- a/drivers/net/wireless/mwifiex/Makefile
+++ b/drivers/net/wireless/mwifiex/Makefile
@@ -53,3 +53,5 @@ obj-$(CONFIG_MWIFIEX_PCIE) += mwifiex_pcie.o
 
 mwifiex_usb-y += usb.o
 obj-$(CONFIG_MWIFIEX_USB) += mwifiex_usb.o
+
+ccflags-y += -D__CHECK_ENDIAN
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index 1996a8b612d2..7be1e9b83fd0 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -1786,6 +1786,7 @@ mwifiex_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
                          struct cfg80211_connect_params *sme)
 {
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
+        struct mwifiex_adapter *adapter = priv->adapter;
         int ret;
 
         if (GET_BSS_ROLE(priv) != MWIFIEX_BSS_ROLE_STA) {
@@ -1800,6 +1801,13 @@ mwifiex_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
                 return -EALREADY;
         }
 
+        if (adapter->surprise_removed || adapter->is_cmd_timedout) {
+                wiphy_err(wiphy,
+                          "%s: Ignore connection. Card removed or FW in bad state\n",
+                          dev->name);
+                return -EFAULT;
+        }
+
         wiphy_dbg(wiphy, "info: Trying to associate to %s and bssid %pM\n",
                   (char *) sme->ssid, sme->bssid);
 
@@ -2388,6 +2396,10 @@ int mwifiex_del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev)
 
         priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
 
+        if (GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_STA ||
+            GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_UAP)
+                kfree(priv->hist_data);
+
         return 0;
 }
 EXPORT_SYMBOL_GPL(mwifiex_del_virtual_intf);
@@ -2423,30 +2435,16 @@ mwifiex_is_pattern_supported(struct cfg80211_pkt_pattern *pat, s8 *byte_seq,
 }
 
 #ifdef CONFIG_PM
-static int mwifiex_cfg80211_suspend(struct wiphy *wiphy,
-                                    struct cfg80211_wowlan *wowlan)
+static int mwifiex_set_mef_filter(struct mwifiex_private *priv,
+                                  struct cfg80211_wowlan *wowlan)
 {
-        struct mwifiex_adapter *adapter = mwifiex_cfg80211_get_adapter(wiphy);
-        struct mwifiex_ds_mef_cfg mef_cfg;
-        struct mwifiex_mef_entry *mef_entry;
-        int i, filt_num = 0, ret;
+        int i, filt_num = 0, ret = 0;
         bool first_pat = true;
         u8 byte_seq[MWIFIEX_MEF_MAX_BYTESEQ + 1];
         const u8 ipv4_mc_mac[] = {0x33, 0x33};
         const u8 ipv6_mc_mac[] = {0x01, 0x00, 0x5e};
-        struct mwifiex_private *priv =
-                        mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_STA);
-
-        if (!wowlan) {
-                dev_warn(adapter->dev, "None of the WOWLAN triggers enabled\n");
-                return 0;
-        }
-
-        if (!priv->media_connected) {
-                dev_warn(adapter->dev,
-                         "Can not configure WOWLAN in disconnected state\n");
-                return 0;
-        }
+        struct mwifiex_ds_mef_cfg mef_cfg;
+        struct mwifiex_mef_entry *mef_entry;
 
         mef_entry = kzalloc(sizeof(*mef_entry), GFP_KERNEL);
         if (!mef_entry)
@@ -2461,9 +2459,9 @@ static int mwifiex_cfg80211_suspend(struct wiphy *wiphy,
         for (i = 0; i < wowlan->n_patterns; i++) {
                 memset(byte_seq, 0, sizeof(byte_seq));
                 if (!mwifiex_is_pattern_supported(&wowlan->patterns[i],
-                                                  byte_seq,
-                                                  MWIFIEX_MEF_MAX_BYTESEQ)) {
-                        wiphy_err(wiphy, "Pattern not supported\n");
+                                        byte_seq,
+                                        MWIFIEX_MEF_MAX_BYTESEQ)) {
+                        dev_err(priv->adapter->dev, "Pattern not supported\n");
                         kfree(mef_entry);
                         return -EOPNOTSUPP;
                 }
@@ -2487,9 +2485,9 @@ static int mwifiex_cfg80211_suspend(struct wiphy *wiphy,
 
                 mef_entry->filter[filt_num].repeat = 1;
                 mef_entry->filter[filt_num].offset =
-                                                wowlan->patterns[i].pkt_offset;
+                        wowlan->patterns[i].pkt_offset;
                 memcpy(mef_entry->filter[filt_num].byte_seq, byte_seq,
-                       sizeof(byte_seq));
+                                sizeof(byte_seq));
                 mef_entry->filter[filt_num].filt_type = TYPE_EQ;
 
                 if (first_pat)
@@ -2504,9 +2502,9 @@ static int mwifiex_cfg80211_suspend(struct wiphy *wiphy,
                 mef_cfg.criteria |= MWIFIEX_CRITERIA_UNICAST;
                 mef_entry->filter[filt_num].repeat = 16;
                 memcpy(mef_entry->filter[filt_num].byte_seq, priv->curr_addr,
-                       ETH_ALEN);
+                                ETH_ALEN);
                 mef_entry->filter[filt_num].byte_seq[MWIFIEX_MEF_MAX_BYTESEQ] =
-                                                                ETH_ALEN;
+                        ETH_ALEN;
                 mef_entry->filter[filt_num].offset = 28;
                 mef_entry->filter[filt_num].filt_type = TYPE_EQ;
                 if (filt_num)
@@ -2515,9 +2513,9 @@ static int mwifiex_cfg80211_suspend(struct wiphy *wiphy,
                 filt_num++;
                 mef_entry->filter[filt_num].repeat = 16;
                 memcpy(mef_entry->filter[filt_num].byte_seq, priv->curr_addr,
-                       ETH_ALEN);
+                                ETH_ALEN);
                 mef_entry->filter[filt_num].byte_seq[MWIFIEX_MEF_MAX_BYTESEQ] =
-                                                                ETH_ALEN;
+                        ETH_ALEN;
                 mef_entry->filter[filt_num].offset = 56;
                 mef_entry->filter[filt_num].filt_type = TYPE_EQ;
                 mef_entry->filter[filt_num].filt_action = TYPE_OR;
@@ -2525,16 +2523,61 @@ static int mwifiex_cfg80211_suspend(struct wiphy *wiphy,
 
         if (!mef_cfg.criteria)
                 mef_cfg.criteria = MWIFIEX_CRITERIA_BROADCAST |
-                                   MWIFIEX_CRITERIA_UNICAST |
-                                   MWIFIEX_CRITERIA_MULTICAST;
+                        MWIFIEX_CRITERIA_UNICAST |
+                        MWIFIEX_CRITERIA_MULTICAST;
 
         ret = mwifiex_send_cmd(priv, HostCmd_CMD_MEF_CFG,
-                               HostCmd_ACT_GEN_SET, 0, &mef_cfg, true);
+                        HostCmd_ACT_GEN_SET, 0, &mef_cfg, true);
 
         kfree(mef_entry);
         return ret;
 }
 
+static int mwifiex_cfg80211_suspend(struct wiphy *wiphy,
+                                    struct cfg80211_wowlan *wowlan)
+{
+        struct mwifiex_adapter *adapter = mwifiex_cfg80211_get_adapter(wiphy);
+        struct mwifiex_ds_hs_cfg hs_cfg;
+        int ret = 0;
+        struct mwifiex_private *priv =
+                        mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_STA);
+
+        if (!wowlan) {
+                dev_warn(adapter->dev, "None of the WOWLAN triggers enabled\n");
+                return 0;
+        }
+
+        if (!priv->media_connected) {
+                dev_warn(adapter->dev,
+                         "Can not configure WOWLAN in disconnected state\n");
+                return 0;
+        }
+
+        if (wowlan->n_patterns || wowlan->magic_pkt) {
+                ret = mwifiex_set_mef_filter(priv, wowlan);
+                if (ret) {
+                        dev_err(adapter->dev, "Failed to set MEF filter\n");
+                        return ret;
+                }
+        }
+
+        if (wowlan->disconnect) {
+                memset(&hs_cfg, 0, sizeof(hs_cfg));
+                hs_cfg.is_invoke_hostcmd = false;
+                hs_cfg.conditions = HS_CFG_COND_MAC_EVENT;
+                hs_cfg.gpio = HS_CFG_GPIO_DEF;
+                hs_cfg.gap = HS_CFG_GAP_DEF;
+                ret = mwifiex_set_hs_params(priv, HostCmd_ACT_GEN_SET,
+                                            MWIFIEX_SYNC_CMD, &hs_cfg);
+                if (ret) {
+                        dev_err(adapter->dev, "Failed to set HS params\n");
+                        return ret;
+                }
+        }
+
+        return ret;
+}
+
 static int mwifiex_cfg80211_resume(struct wiphy *wiphy)
 {
         return 0;
@@ -2872,7 +2915,7 @@ static struct cfg80211_ops mwifiex_cfg80211_ops = {
 
 #ifdef CONFIG_PM
 static const struct wiphy_wowlan_support mwifiex_wowlan_support = {
-        .flags = WIPHY_WOWLAN_MAGIC_PKT,
+        .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
         .n_patterns = MWIFIEX_MEF_MAX_FILTERS,
         .pattern_min_len = 1,
         .pattern_max_len = MWIFIEX_MAX_PATTERN_LEN,
diff --git a/drivers/net/wireless/mwifiex/cfp.c b/drivers/net/wireless/mwifiex/cfp.c
index b8242eb2be6f..f494fc7eeb62 100644
--- a/drivers/net/wireless/mwifiex/cfp.c
+++ b/drivers/net/wireless/mwifiex/cfp.c
@@ -509,3 +509,21 @@ u32 mwifiex_get_supported_rates(struct mwifiex_private *priv, u8 *rates)
 
         return k;
 }
+
+u8 mwifiex_adjust_data_rate(struct mwifiex_private *priv,
+                            u8 rx_rate, u8 rate_info)
+{
+        u8 rate_index = 0;
+
+        /* HT40 */
+        if ((rate_info & BIT(0)) && (rate_info & BIT(1)))
+                rate_index = MWIFIEX_RATE_INDEX_MCS0 +
+                             MWIFIEX_BW20_MCS_NUM + rx_rate;
+        else if (rate_info & BIT(0)) /* HT20 */
+                rate_index = MWIFIEX_RATE_INDEX_MCS0 + rx_rate;
+        else
+                rate_index = (rx_rate > MWIFIEX_RATE_INDEX_OFDM0) ?
+                              rx_rate - 1 : rx_rate;
+
+        return rate_index;
+}
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index 85597200badc..946a2f7a172f 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -1008,11 +1008,9 @@ mwifiex_cancel_all_pending_cmd(struct mwifiex_adapter *adapter)
         list_for_each_entry_safe(cmd_node, tmp_node,
                                  &adapter->scan_pending_q, list) {
                 list_del(&cmd_node->list);
-                spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags);
 
                 cmd_node->wait_q_enabled = false;
                 mwifiex_insert_cmd_to_free_q(adapter, cmd_node);
-                spin_lock_irqsave(&adapter->scan_pending_q_lock, flags);
         }
         spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags);
 
@@ -1070,12 +1068,8 @@ mwifiex_cancel_pending_ioctl(struct mwifiex_adapter *adapter)
         list_for_each_entry_safe(cmd_node, tmp_node,
                                  &adapter->scan_pending_q, list) {
                 list_del(&cmd_node->list);
-                spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
-                                       scan_pending_q_flags);
                 cmd_node->wait_q_enabled = false;
                 mwifiex_insert_cmd_to_free_q(adapter, cmd_node);
-                spin_lock_irqsave(&adapter->scan_pending_q_lock,
-                                  scan_pending_q_flags);
         }
         spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
                                scan_pending_q_flags);
diff --git a/drivers/net/wireless/mwifiex/debugfs.c b/drivers/net/wireless/mwifiex/debugfs.c
index 2713f7acd35e..1fb329dc6744 100644
--- a/drivers/net/wireless/mwifiex/debugfs.c
+++ b/drivers/net/wireless/mwifiex/debugfs.c
@@ -39,111 +39,6 @@ static char *bss_modes[] = {
         "P2P_DEVICE",
 };
 
-/* size/addr for mwifiex_debug_info */
-#define item_size(n)            (FIELD_SIZEOF(struct mwifiex_debug_info, n))
-#define item_addr(n)            (offsetof(struct mwifiex_debug_info, n))
-
-/* size/addr for struct mwifiex_adapter */
-#define adapter_item_size(n)    (FIELD_SIZEOF(struct mwifiex_adapter, n))
-#define adapter_item_addr(n)    (offsetof(struct mwifiex_adapter, n))
-
-struct mwifiex_debug_data {
-        char name[32];          /* variable/array name */
-        u32 size;               /* size of the variable/array */
-        size_t addr;            /* address of the variable/array */
-        int num;                /* number of variables in an array */
-};
-
-static struct mwifiex_debug_data items[] = {
-        {"int_counter", item_size(int_counter),
-         item_addr(int_counter), 1},
-        {"wmm_ac_vo", item_size(packets_out[WMM_AC_VO]),
-         item_addr(packets_out[WMM_AC_VO]), 1},
-        {"wmm_ac_vi", item_size(packets_out[WMM_AC_VI]),
-         item_addr(packets_out[WMM_AC_VI]), 1},
-        {"wmm_ac_be", item_size(packets_out[WMM_AC_BE]),
-         item_addr(packets_out[WMM_AC_BE]), 1},
-        {"wmm_ac_bk", item_size(packets_out[WMM_AC_BK]),
-         item_addr(packets_out[WMM_AC_BK]), 1},
-        {"tx_buf_size", item_size(tx_buf_size),
-         item_addr(tx_buf_size), 1},
-        {"curr_tx_buf_size", item_size(curr_tx_buf_size),
-         item_addr(curr_tx_buf_size), 1},
-        {"ps_mode", item_size(ps_mode),
-         item_addr(ps_mode), 1},
-        {"ps_state", item_size(ps_state),
-         item_addr(ps_state), 1},
-        {"is_deep_sleep", item_size(is_deep_sleep),
-         item_addr(is_deep_sleep), 1},
-        {"wakeup_dev_req", item_size(pm_wakeup_card_req),
-         item_addr(pm_wakeup_card_req), 1},
-        {"wakeup_tries", item_size(pm_wakeup_fw_try),
-         item_addr(pm_wakeup_fw_try), 1},
-        {"hs_configured", item_size(is_hs_configured),
-         item_addr(is_hs_configured), 1},
-        {"hs_activated", item_size(hs_activated),
-         item_addr(hs_activated), 1},
-        {"num_tx_timeout", item_size(num_tx_timeout),
-         item_addr(num_tx_timeout), 1},
-        {"is_cmd_timedout", item_size(is_cmd_timedout),
-         item_addr(is_cmd_timedout), 1},
-        {"timeout_cmd_id", item_size(timeout_cmd_id),
-         item_addr(timeout_cmd_id), 1},
-        {"timeout_cmd_act", item_size(timeout_cmd_act),
-         item_addr(timeout_cmd_act), 1},
-        {"last_cmd_id", item_size(last_cmd_id),
-         item_addr(last_cmd_id), DBG_CMD_NUM},
-        {"last_cmd_act", item_size(last_cmd_act),
-         item_addr(last_cmd_act), DBG_CMD_NUM},
-        {"last_cmd_index", item_size(last_cmd_index),
-         item_addr(last_cmd_index), 1},
-        {"last_cmd_resp_id", item_size(last_cmd_resp_id),
-         item_addr(last_cmd_resp_id), DBG_CMD_NUM},
-        {"last_cmd_resp_index", item_size(last_cmd_resp_index),
-         item_addr(last_cmd_resp_index), 1},
-        {"last_event", item_size(last_event),
-         item_addr(last_event), DBG_CMD_NUM},
-        {"last_event_index", item_size(last_event_index),
-         item_addr(last_event_index), 1},
-        {"num_cmd_h2c_fail", item_size(num_cmd_host_to_card_failure),
-         item_addr(num_cmd_host_to_card_failure), 1},
-        {"num_cmd_sleep_cfm_fail",
-         item_size(num_cmd_sleep_cfm_host_to_card_failure),
-         item_addr(num_cmd_sleep_cfm_host_to_card_failure), 1},
-        {"num_tx_h2c_fail", item_size(num_tx_host_to_card_failure),
-         item_addr(num_tx_host_to_card_failure), 1},
-        {"num_evt_deauth", item_size(num_event_deauth),
-         item_addr(num_event_deauth), 1},
-        {"num_evt_disassoc", item_size(num_event_disassoc),
-         item_addr(num_event_disassoc), 1},
-        {"num_evt_link_lost", item_size(num_event_link_lost),
-         item_addr(num_event_link_lost), 1},
-        {"num_cmd_deauth", item_size(num_cmd_deauth),
-         item_addr(num_cmd_deauth), 1},
-        {"num_cmd_assoc_ok", item_size(num_cmd_assoc_success),
-         item_addr(num_cmd_assoc_success), 1},
-        {"num_cmd_assoc_fail", item_size(num_cmd_assoc_failure),
-         item_addr(num_cmd_assoc_failure), 1},
-        {"cmd_sent", item_size(cmd_sent),
-         item_addr(cmd_sent), 1},
-        {"data_sent", item_size(data_sent),
-         item_addr(data_sent), 1},
-        {"cmd_resp_received", item_size(cmd_resp_received),
-         item_addr(cmd_resp_received), 1},
-        {"event_received", item_size(event_received),
-         item_addr(event_received), 1},
-
-        /* variables defined in struct mwifiex_adapter */
-        {"cmd_pending", adapter_item_size(cmd_pending),
-         adapter_item_addr(cmd_pending), 1},
-        {"tx_pending", adapter_item_size(tx_pending),
-         adapter_item_addr(tx_pending), 1},
-        {"rx_pending", adapter_item_size(rx_pending),
-         adapter_item_addr(rx_pending), 1},
-};
-
-static int num_of_items = ARRAY_SIZE(items);
-
 /*
  * Proc info file read handler.
  *
@@ -297,6 +192,8 @@ mwifiex_fw_dump_read(struct file *file, char __user *ubuf,
  *      - Number of FCS errors
  *      - Number of Tx frames
  *      - WEP ICV error counts
+ *      - Number of received beacons
+ *      - Number of missed beacons
  */
 static ssize_t
 mwifiex_getlog_read(struct file *file, char __user *ubuf,
@@ -333,7 +230,9 @@ mwifiex_getlog_read(struct file *file, char __user *ubuf,
                      "wepicverrcnt-1   %u\n"
                      "wepicverrcnt-2   %u\n"
                      "wepicverrcnt-3   %u\n"
-                     "wepicverrcnt-4   %u\n",
+                     "wepicverrcnt-4   %u\n"
+                     "bcn_rcv_cnt   %u\n"
+                     "bcn_miss_cnt   %u\n",
                      stats.mcast_tx_frame,
                      stats.failed,
                      stats.retry,
@@ -349,7 +248,9 @@ mwifiex_getlog_read(struct file *file, char __user *ubuf,
                      stats.wep_icv_error[0],
                      stats.wep_icv_error[1],
                      stats.wep_icv_error[2],
-                     stats.wep_icv_error[3]);
+                     stats.wep_icv_error[3],
+                     stats.bcn_rcv_cnt,
+                     stats.bcn_miss_cnt);
 
 
         ret = simple_read_from_buffer(ubuf, count, ppos, (char *) page,
@@ -360,6 +261,103 @@ free_and_exit:
         return ret;
 }
 
+/* Sysfs histogram file read handler.
+ *
+ * This function is called when the 'histogram' file is opened for reading
+ * It prints the following histogram information -
+ *      - Number of histogram samples
+ *      - Receive packet number of each rx_rate
+ *      - Receive packet number of each snr
+ *      - Receive packet number of each nosie_flr
+ *      - Receive packet number of each signal streath
+ */
+static ssize_t
+mwifiex_histogram_read(struct file *file, char __user *ubuf,
+                       size_t count, loff_t *ppos)
+{
+        struct mwifiex_private *priv =
+                (struct mwifiex_private *)file->private_data;
+        ssize_t ret;
+        struct mwifiex_histogram_data *phist_data;
+        int i, value;
+        unsigned long page = get_zeroed_page(GFP_KERNEL);
+        char *p = (char *)page;
+
+        if (!p)
+                return -ENOMEM;
+
+        if (!priv || !priv->hist_data)
+                return -EFAULT;
+        phist_data = priv->hist_data;
+
+        p += sprintf(p, "\n"
+                     "total samples = %d\n",
+                     atomic_read(&phist_data->num_samples));
+
+        p += sprintf(p, "rx rates (in Mbps): 0=1M   1=2M");
+        p += sprintf(p, "2=5.5M  3=11M   4=6M   5=9M  6=12M\n");
+        p += sprintf(p, "7=18M  8=24M  9=36M  10=48M  11=54M");
+        p += sprintf(p, "12-27=MCS0-15(BW20) 28-43=MCS0-15(BW40)\n");
+
+        if (ISSUPP_11ACENABLED(priv->adapter->fw_cap_info)) {
+                p += sprintf(p, "44-53=MCS0-9(VHT:BW20)");
+                p += sprintf(p, "54-63=MCS0-9(VHT:BW40)");
+                p += sprintf(p, "64-73=MCS0-9(VHT:BW80)\n\n");
+        } else {
+                p += sprintf(p, "\n");
+        }
+
+        for (i = 0; i < MWIFIEX_MAX_RX_RATES; i++) {
+                value = atomic_read(&phist_data->rx_rate[i]);
+                if (value)
+                        p += sprintf(p, "rx_rate[%02d] = %d\n", i, value);
+        }
+
+        if (ISSUPP_11ACENABLED(priv->adapter->fw_cap_info)) {
+                for (i = MWIFIEX_MAX_RX_RATES; i < MWIFIEX_MAX_AC_RX_RATES;
+                     i++) {
+                        value = atomic_read(&phist_data->rx_rate[i]);
+                        if (value)
+                                p += sprintf(p, "rx_rate[%02d] = %d\n",
+                                           i, value);
+                }
+        }
+
+        for (i = 0; i < MWIFIEX_MAX_SNR; i++) {
+                value =  atomic_read(&phist_data->snr[i]);
+                if (value)
+                        p += sprintf(p, "snr[%02ddB] = %d\n", i, value);
+        }
+        for (i = 0; i < MWIFIEX_MAX_NOISE_FLR; i++) {
+                value = atomic_read(&phist_data->noise_flr[i]);
+                if (value)
+                        p += sprintf(p, "noise_flr[-%02ddBm] = %d\n",
+                                (int)(i-128), value);
+        }
+        for (i = 0; i < MWIFIEX_MAX_SIG_STRENGTH; i++) {
+                value = atomic_read(&phist_data->sig_str[i]);
+                if (value)
+                        p += sprintf(p, "sig_strength[-%02ddBm] = %d\n",
+                                i, value);
+        }
+
+        ret = simple_read_from_buffer(ubuf, count, ppos, (char *)page,
+                                      (unsigned long)p - page);
+
+        return ret;
+}
+
+static ssize_t
+mwifiex_histogram_write(struct file *file, const char __user *ubuf,
+                        size_t count, loff_t *ppos)
+{
+        struct mwifiex_private *priv = (void *)file->private_data;
+
+        if (priv && priv->hist_data)
+                mwifiex_hist_data_reset(priv);
+        return 0;
+}
+
 static struct mwifiex_debug_info info;
 
 /*
@@ -415,13 +413,9 @@ mwifiex_debug_read(struct file *file, char __user *ubuf,
 {
         struct mwifiex_private *priv =
                 (struct mwifiex_private *) file->private_data;
-        struct mwifiex_debug_data *d = &items[0];
         unsigned long page = get_zeroed_page(GFP_KERNEL);
         char *p = (char *) page;
         ssize_t ret;
-        size_t size, addr;
-        long val;
-        int i, j;
 
         if (!p)
                 return -ENOMEM;
@@ -430,68 +424,7 @@ mwifiex_debug_read(struct file *file, char __user *ubuf,
         if (ret)
                 goto free_and_exit;
 
-        for (i = 0; i < num_of_items; i++) {
-                p += sprintf(p, "%s=", d[i].name);
-
-                size = d[i].size / d[i].num;
-
-                if (i < (num_of_items - 3))
-                        addr = d[i].addr + (size_t) &info;
-                else /* The last 3 items are struct mwifiex_adapter variables */
-                        addr = d[i].addr + (size_t) priv->adapter;
-
-                for (j = 0; j < d[i].num; j++) {
-                        switch (size) {
-                        case 1:
-                                val = *((u8 *) addr);
-                                break;
-                        case 2:
-                                val = *((u16 *) addr);
-                                break;
-                        case 4:
-                                val = *((u32 *) addr);
-                                break;
-                        case 8:
-                                val = *((long long *) addr);
-                                break;
-                        default:
-                                val = -1;
-                                break;
-                        }
-
-                        p += sprintf(p, "%#lx ", val);
-                        addr += size;
-                }
-
-                p += sprintf(p, "\n");
-        }
-
-        if (info.tx_tbl_num) {
-                p += sprintf(p, "Tx BA stream table:\n");
-                for (i = 0; i < info.tx_tbl_num; i++)
-                        p += sprintf(p, "tid = %d, ra = %pM\n",
-                                     info.tx_tbl[i].tid, info.tx_tbl[i].ra);
-        }
-
-        if (info.rx_tbl_num) {
-                p += sprintf(p, "Rx reorder table:\n");
-                for (i = 0; i < info.rx_tbl_num; i++) {
-                        p += sprintf(p, "tid = %d, ta = %pM, "
-                                     "start_win = %d, "
-                                     "win_size = %d, buffer: ",
-                                     info.rx_tbl[i].tid,
-                                     info.rx_tbl[i].ta,
-                                     info.rx_tbl[i].start_win,
-                                     info.rx_tbl[i].win_size);
-
-                        for (j = 0; j < info.rx_tbl[i].win_size; j++)
-                                p += sprintf(p, "%c ",
-                                             info.rx_tbl[i].buffer[j] ?
-                                             '1' : '0');
-
-                        p += sprintf(p, "\n");
-                }
-        }
+        p += mwifiex_debug_info_to_buffer(priv, p, &info);
 
         ret = simple_read_from_buffer(ubuf, count, ppos, (char *) page,
                                       (unsigned long) p - page);
@@ -817,6 +750,7 @@ MWIFIEX_DFS_FILE_READ_OPS(fw_dump);
 MWIFIEX_DFS_FILE_OPS(regrdwr);
 MWIFIEX_DFS_FILE_OPS(rdeeprom);
 MWIFIEX_DFS_FILE_OPS(hscfg);
+MWIFIEX_DFS_FILE_OPS(histogram);
 
 /*
  * This function creates the debug FS directory structure and the files.
@@ -840,6 +774,7 @@ mwifiex_dev_debugfs_init(struct mwifiex_private *priv)
         MWIFIEX_DFS_ADD_FILE(rdeeprom);
         MWIFIEX_DFS_ADD_FILE(fw_dump);
         MWIFIEX_DFS_ADD_FILE(hscfg);
+        MWIFIEX_DFS_ADD_FILE(histogram);
 }
 
 /*
diff --git a/drivers/net/wireless/mwifiex/decl.h b/drivers/net/wireless/mwifiex/decl.h
index 2269acf41ad8..7aa988e1dc7a 100644
--- a/drivers/net/wireless/mwifiex/decl.h
+++ b/drivers/net/wireless/mwifiex/decl.h
@@ -32,15 +32,19 @@
 
 #define MWIFIEX_MAX_BSS_NUM         (3)
 
-#define MWIFIEX_MIN_DATA_HEADER_LEN 36  /* sizeof(mwifiex_txpd)
-                                         *   + 4 byte alignment
-                                         */
+#define MWIFIEX_DMA_ALIGN_SZ        64
+#define MAX_TXPD_SZ                 32
+#define INTF_HDR_ALIGN               4
+
+#define MWIFIEX_MIN_DATA_HEADER_LEN (MWIFIEX_DMA_ALIGN_SZ + INTF_HDR_ALIGN + \
+                                     MAX_TXPD_SZ)
 #define MWIFIEX_MGMT_FRAME_HEADER_SIZE  8       /* sizeof(pkt_type)
                                                  *   + sizeof(tx_control)
                                                  */
 
 #define MWIFIEX_MAX_TX_BASTREAM_SUPPORTED       2
 #define MWIFIEX_MAX_RX_BASTREAM_SUPPORTED       16
+#define MWIFIEX_MAX_TDLS_PEER_SUPPORTED 8
 
 #define MWIFIEX_STA_AMPDU_DEF_TXWINSIZE        64
 #define MWIFIEX_STA_AMPDU_DEF_RXWINSIZE        64
@@ -92,6 +96,14 @@
 #define MWIFIEX_TDLS_MAX_FAIL_COUNT      4
 #define MWIFIEX_AUTO_TDLS_IDLE_TIME     10
 
+/* 54M rates, index from 0 to 11 */
+#define MWIFIEX_RATE_INDEX_MCS0 12
+/* 12-27=MCS0-15(BW20) */
+#define MWIFIEX_BW20_MCS_NUM 15
+
+/* Rate index for OFDM 0 */
+#define MWIFIEX_RATE_INDEX_OFDM0   4
+
 enum mwifiex_bss_type {
         MWIFIEX_BSS_TYPE_STA = 0,
         MWIFIEX_BSS_TYPE_UAP = 1,
@@ -204,4 +216,20 @@ struct mwifiex_chan_stats {
         u16 cca_scan_dur;
         u16 cca_busy_dur;
 } __packed;
+
+#define MWIFIEX_HIST_MAX_SAMPLES        1048576
+#define MWIFIEX_MAX_RX_RATES                 44
+#define MWIFIEX_MAX_AC_RX_RATES              74
+#define MWIFIEX_MAX_SNR                     256
+#define MWIFIEX_MAX_NOISE_FLR               256
+#define MWIFIEX_MAX_SIG_STRENGTH            256
+
+struct mwifiex_histogram_data {
+        atomic_t rx_rate[MWIFIEX_MAX_AC_RX_RATES];
+        atomic_t snr[MWIFIEX_MAX_SNR];
+        atomic_t noise_flr[MWIFIEX_MAX_NOISE_FLR];
+        atomic_t sig_str[MWIFIEX_MAX_SIG_STRENGTH];
+        atomic_t num_samples;
+};
+
 #endif /* !_MWIFIEX_DECL_H_ */
diff --git a/drivers/net/wireless/mwifiex/ethtool.c b/drivers/net/wireless/mwifiex/ethtool.c
index 04e56b5fc535..65d8d6d4b6ba 100644
--- a/drivers/net/wireless/mwifiex/ethtool.c
+++ b/drivers/net/wireless/mwifiex/ethtool.c
@@ -76,7 +76,9 @@ mwifiex_get_dump_flag(struct net_device *dev, struct ethtool_dump *dump)
 
         dump->flag = adapter->curr_mem_idx;
         dump->version = 1;
-        if (adapter->curr_mem_idx != MWIFIEX_FW_DUMP_IDX) {
+        if (adapter->curr_mem_idx == MWIFIEX_DRV_INFO_IDX) {
+                dump->len = adapter->drv_info_size;
+        } else if (adapter->curr_mem_idx != MWIFIEX_FW_DUMP_IDX) {
                 entry = &adapter->mem_type_mapping_tbl[adapter->curr_mem_idx];
                 dump->len = entry->mem_size;
         } else {
@@ -98,6 +100,13 @@ mwifiex_get_dump_data(struct net_device *dev, struct ethtool_dump *dump,
         if (!adapter->if_ops.fw_dump)
                 return -ENOTSUPP;
 
+        if (adapter->curr_mem_idx == MWIFIEX_DRV_INFO_IDX) {
+                if (!adapter->drv_info_dump)
+                        return -EFAULT;
+                memcpy(p, adapter->drv_info_dump, adapter->drv_info_size);
+                return 0;
+        }
+
         if (adapter->curr_mem_idx == MWIFIEX_FW_DUMP_IDX) {
                 dev_err(adapter->dev, "firmware dump in progress!!\n");
                 return -EBUSY;
@@ -125,6 +134,11 @@ static int mwifiex_set_dump(struct net_device *dev, struct ethtool_dump *val)
         if (!adapter->if_ops.fw_dump)
                 return -ENOTSUPP;
 
+        if (val->flag == MWIFIEX_DRV_INFO_IDX) {
+                adapter->curr_mem_idx = MWIFIEX_DRV_INFO_IDX;
+                return 0;
+        }
+
         if (adapter->curr_mem_idx == MWIFIEX_FW_DUMP_IDX) {
                 dev_err(adapter->dev, "firmware dump in progress!!\n");
                 return -EBUSY;
diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
index fb5936eb82e3..15ad776ae08e 100644
--- a/drivers/net/wireless/mwifiex/fw.h
+++ b/drivers/net/wireless/mwifiex/fw.h
@@ -233,6 +233,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 #define ISSUPP_RXLDPC(Dot11nDevCap) (Dot11nDevCap & BIT(22))
 #define ISSUPP_BEAMFORMING(Dot11nDevCap) (Dot11nDevCap & BIT(30))
 #define ISALLOWED_CHANWIDTH40(ht_param) (ht_param & BIT(2))
+#define GETSUPP_TXBASTREAMS(Dot11nDevCap) ((Dot11nDevCap >> 18) & 0xF)
 
 /* httxcfg bitmap
  * 0            reserved
@@ -1076,6 +1077,8 @@ struct host_cmd_ds_802_11_get_log {
         __le32 tx_frame;
         __le32 reserved;
         __le32 wep_icv_err_cnt[4];
+        __le32 bcn_rcv_cnt;
+        __le32 bcn_miss_cnt;
 };
 
 /* Enumeration for rate format */
diff --git a/drivers/net/wireless/mwifiex/init.c b/drivers/net/wireless/mwifiex/init.c
index 520ad4a3018b..b115e0f94dd7 100644
--- a/drivers/net/wireless/mwifiex/init.c
+++ b/drivers/net/wireless/mwifiex/init.c
@@ -52,6 +52,18 @@ static int mwifiex_add_bss_prio_tbl(struct mwifiex_private *priv)
         return 0;
 }
 
+static void wakeup_timer_fn(unsigned long data)
+{
+        struct mwifiex_adapter *adapter = (struct mwifiex_adapter *)data;
+
+        dev_err(adapter->dev, "Firmware wakeup failed\n");
+        adapter->hw_status = MWIFIEX_HW_STATUS_RESET;
+        mwifiex_cancel_all_pending_cmd(adapter);
+
+        if (adapter->if_ops.card_reset)
+                adapter->if_ops.card_reset(adapter);
+}
+
 /*
  * This function initializes the private structure and sets default
  * values to the members.
@@ -285,6 +297,9 @@ static void mwifiex_init_adapter(struct mwifiex_adapter *adapter)
         adapter->ext_scan = true;
         adapter->key_api_major_ver = 0;
         adapter->key_api_minor_ver = 0;
+
+        setup_timer(&adapter->wakeup_timer, wakeup_timer_fn,
+                    (unsigned long)adapter);
 }
 
 /*
@@ -391,7 +406,10 @@ mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
                 return;
         }
 
+        del_timer(&adapter->wakeup_timer);
         mwifiex_cancel_all_pending_cmd(adapter);
+        wake_up_interruptible(&adapter->cmd_wait_q.wait);
+        wake_up_interruptible(&adapter->hs_activate_wait_q);
 
         /* Free lock variables */
         mwifiex_free_lock_list(adapter);
@@ -411,6 +429,11 @@ mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
                 entry->mem_size = 0;
         }
 
+        if (adapter->drv_info_dump) {
+                vfree(adapter->drv_info_dump);
+                adapter->drv_info_size = 0;
+        }
+
         if (adapter->sleep_cfm)
                 dev_kfree_skb_any(adapter->sleep_cfm);
 }
diff --git a/drivers/net/wireless/mwifiex/ioctl.h b/drivers/net/wireless/mwifiex/ioctl.h
index 0847f3e07ab7..d2b05c3a96da 100644
--- a/drivers/net/wireless/mwifiex/ioctl.h
+++ b/drivers/net/wireless/mwifiex/ioctl.h
@@ -137,6 +137,8 @@ struct mwifiex_ds_get_stats {
         u32 fcs_error;
         u32 tx_frame;
         u32 wep_icv_error[4];
+        u32 bcn_rcv_cnt;
+        u32 bcn_miss_cnt;
 };
 
 #define MWIFIEX_MAX_VER_STR_LEN    128
@@ -180,7 +182,11 @@ struct mwifiex_ds_tx_ba_stream_tbl {
         u8 amsdu;
 };
 
-#define DBG_CMD_NUM     5
+#define DBG_CMD_NUM    5
+
+struct tdls_peer_info {
+        u8 peer_addr[ETH_ALEN];
+};
 
 struct mwifiex_debug_info {
         u32 int_counter;
@@ -193,6 +199,9 @@ struct mwifiex_debug_info {
         u32 rx_tbl_num;
         struct mwifiex_ds_rx_reorder_tbl rx_tbl
                 [MWIFIEX_MAX_RX_BASTREAM_SUPPORTED];
+        u32 tdls_peer_num;
+        struct tdls_peer_info tdls_list
+                [MWIFIEX_MAX_TDLS_PEER_SUPPORTED];
         u16 ps_mode;
         u32 ps_state;
         u8 is_deep_sleep;
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index d4d2223d1f31..d235adb82c94 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -83,9 +83,8 @@ static int mwifiex_register(void *card, struct mwifiex_if_ops *if_ops,
         }
         mwifiex_init_lock_list(adapter);
 
-        init_timer(&adapter->cmd_timer);
-        adapter->cmd_timer.function = mwifiex_cmd_timeout_func;
-        adapter->cmd_timer.data = (unsigned long) adapter;
+        setup_timer(&adapter->cmd_timer, mwifiex_cmd_timeout_func,
+                    (unsigned long)adapter);
 
         return 0;
 
@@ -237,6 +236,7 @@ process_start:
                     (is_command_pending(adapter) ||
                      !mwifiex_wmm_lists_empty(adapter))) {
                         adapter->pm_wakeup_fw_try = true;
+                        mod_timer(&adapter->wakeup_timer, jiffies + (HZ*3));
                         adapter->if_ops.wakeup(adapter);
                         continue;
                 }
@@ -244,6 +244,7 @@ process_start:
                 if (IS_CARD_RX_RCVD(adapter)) {
                         adapter->data_received = false;
                         adapter->pm_wakeup_fw_try = false;
+                        del_timer_sync(&adapter->wakeup_timer);
                         if (adapter->ps_state == PS_STATE_SLEEP)
                                 adapter->ps_state = PS_STATE_AWAKE;
                 } else {
@@ -511,8 +512,7 @@ err_dnld_fw:
         if (adapter->if_ops.unregister_dev)
                 adapter->if_ops.unregister_dev(adapter);
 
-        if ((adapter->hw_status == MWIFIEX_HW_STATUS_FW_READY) ||
-            (adapter->hw_status == MWIFIEX_HW_STATUS_READY)) {
+        if (adapter->hw_status == MWIFIEX_HW_STATUS_READY) {
                 pr_debug("info: %s: shutdown mwifiex\n", __func__);
                 adapter->init_wait_q_woken = false;
 
@@ -801,6 +801,114 @@ mwifiex_tx_timeout(struct net_device *dev)
         }
 }
 
+void mwifiex_dump_drv_info(struct mwifiex_adapter *adapter)
+{
+        void *p;
+        char drv_version[64];
+        struct usb_card_rec *cardp;
+        struct sdio_mmc_card *sdio_card;
+        struct mwifiex_private *priv;
+        int i, idx;
+        struct netdev_queue *txq;
+        struct mwifiex_debug_info *debug_info;
+
+        if (adapter->drv_info_dump) {
+                vfree(adapter->drv_info_dump);
+                adapter->drv_info_size = 0;
+        }
+
+        dev_info(adapter->dev, "=== DRIVER INFO DUMP START===\n");
+
+        adapter->drv_info_dump = vzalloc(MWIFIEX_DRV_INFO_SIZE_MAX);
+
+        if (!adapter->drv_info_dump)
+                return;
+
+        p = (char *)(adapter->drv_info_dump);
+        p += sprintf(p, "driver_name = " "\"mwifiex\"\n");
+
+        mwifiex_drv_get_driver_version(adapter, drv_version,
+                                       sizeof(drv_version) - 1);
+        p += sprintf(p, "driver_version = %s\n", drv_version);
+
+        if (adapter->iface_type == MWIFIEX_USB) {
+                cardp = (struct usb_card_rec *)adapter->card;
+                p += sprintf(p, "tx_cmd_urb_pending = %d\n",
+                             atomic_read(&cardp->tx_cmd_urb_pending));
+                p += sprintf(p, "tx_data_urb_pending = %d\n",
+                             atomic_read(&cardp->tx_data_urb_pending));
+                p += sprintf(p, "rx_cmd_urb_pending = %d\n",
+                             atomic_read(&cardp->rx_cmd_urb_pending));
+                p += sprintf(p, "rx_data_urb_pending = %d\n",
+                             atomic_read(&cardp->rx_data_urb_pending));
+        }
+
+        p += sprintf(p, "tx_pending = %d\n",
+                     atomic_read(&adapter->tx_pending));
+        p += sprintf(p, "rx_pending = %d\n",
+                     atomic_read(&adapter->rx_pending));
+
+        if (adapter->iface_type == MWIFIEX_SDIO) {
+                sdio_card = (struct sdio_mmc_card *)adapter->card;
+                p += sprintf(p, "\nmp_rd_bitmap=0x%x curr_rd_port=0x%x\n",
+                             sdio_card->mp_rd_bitmap, sdio_card->curr_rd_port);
+                p += sprintf(p, "mp_wr_bitmap=0x%x curr_wr_port=0x%x\n",
+                             sdio_card->mp_wr_bitmap, sdio_card->curr_wr_port);
+        }
+
+        for (i = 0; i < adapter->priv_num; i++) {
+                if (!adapter->priv[i] || !adapter->priv[i]->netdev)
+                        continue;
+                priv = adapter->priv[i];
+                p += sprintf(p, "\n[interface  : \"%s\"]\n",
+                             priv->netdev->name);
+                p += sprintf(p, "wmm_tx_pending[0] = %d\n",
+                             atomic_read(&priv->wmm_tx_pending[0]));
+                p += sprintf(p, "wmm_tx_pending[1] = %d\n",
+                             atomic_read(&priv->wmm_tx_pending[1]));
+                p += sprintf(p, "wmm_tx_pending[2] = %d\n",
+                             atomic_read(&priv->wmm_tx_pending[2]));
+                p += sprintf(p, "wmm_tx_pending[3] = %d\n",
+                             atomic_read(&priv->wmm_tx_pending[3]));
+                p += sprintf(p, "media_state=\"%s\"\n", !priv->media_connected ?
+                             "Disconnected" : "Connected");
+                p += sprintf(p, "carrier %s\n", (netif_carrier_ok(priv->netdev)
+                             ? "on" : "off"));
+                for (idx = 0; idx < priv->netdev->num_tx_queues; idx++) {
+                        txq = netdev_get_tx_queue(priv->netdev, idx);
+                        p += sprintf(p, "tx queue %d:%s  ", idx,
+                                     netif_tx_queue_stopped(txq) ?
+                                     "stopped" : "started");
+                }
+                p += sprintf(p, "\n%s: num_tx_timeout = %d\n",
+                             priv->netdev->name, priv->num_tx_timeout);
+        }
+
+        if (adapter->iface_type == MWIFIEX_SDIO) {
+                p += sprintf(p, "\n=== SDIO register DUMP===\n");
+                if (adapter->if_ops.reg_dump)
+                        p += adapter->if_ops.reg_dump(adapter, p);
+        }
+
+        p += sprintf(p, "\n=== MORE DEBUG INFORMATION\n");
+        debug_info = kzalloc(sizeof(*debug_info), GFP_KERNEL);
+        if (debug_info) {
+                for (i = 0; i < adapter->priv_num; i++) {
+                        if (!adapter->priv[i] || !adapter->priv[i]->netdev)
+                                continue;
+                        priv = adapter->priv[i];
+                        mwifiex_get_debug_info(priv, debug_info);
+                        p += mwifiex_debug_info_to_buffer(priv, p, debug_info);
+                        break;
+                }
+                kfree(debug_info);
+        }
+
+        adapter->drv_info_size = p - adapter->drv_info_dump;
+        dev_info(adapter->dev, "=== DRIVER INFO DUMP END===\n");
+}
+EXPORT_SYMBOL_GPL(mwifiex_dump_drv_info);
+
 /*
  * CFG802.11 network device handler for statistics retrieval.
  */
@@ -847,6 +955,7 @@ static const struct net_device_ops mwifiex_netdev_ops = {
  *      - Nick name             : Set to null
  *      - Number of Tx timeout  : Set to 0
  *      - Device address        : Set to current address
+ *      - Rx histogram statistc : Set to 0
  *
  * In addition, the CFG80211 work queue is also created.
  */
@@ -867,6 +976,13 @@ void mwifiex_init_priv_params(struct mwifiex_private *priv,
         priv->rsn_idx = MWIFIEX_AUTO_IDX_MASK;
         priv->num_tx_timeout = 0;
         memcpy(dev->dev_addr, priv->curr_addr, ETH_ALEN);
+
+        if (GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_STA ||
+            GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_UAP) {
+                priv->hist_data = kmalloc(sizeof(*priv->hist_data), GFP_KERNEL);
+                if (priv->hist_data)
+                        mwifiex_hist_data_reset(priv);
+        }
 }
 
 /*
@@ -1000,8 +1116,7 @@ err_init_fw:
         pr_debug("info: %s: unregister device\n", __func__);
         if (adapter->if_ops.unregister_dev)
                 adapter->if_ops.unregister_dev(adapter);
-        if ((adapter->hw_status == MWIFIEX_HW_STATUS_FW_READY) ||
-            (adapter->hw_status == MWIFIEX_HW_STATUS_READY)) {
+        if (adapter->hw_status == MWIFIEX_HW_STATUS_READY) {
                 pr_debug("info: %s: shutdown mwifiex\n", __func__);
                 adapter->init_wait_q_woken = false;
 
@@ -1052,6 +1167,8 @@ int mwifiex_remove_card(struct mwifiex_adapter *adapter, struct semaphore *sem)
 
         adapter->surprise_removed = true;
 
+        mwifiex_terminate_workqueue(adapter);
+
         /* Stop data */
         for (i = 0; i < adapter->priv_num; i++) {
                 priv = adapter->priv[i];
@@ -1094,8 +1211,6 @@ int mwifiex_remove_card(struct mwifiex_adapter *adapter, struct semaphore *sem)
         wiphy_unregister(adapter->wiphy);
         wiphy_free(adapter->wiphy);
 
-        mwifiex_terminate_workqueue(adapter);
-
         /* Unregister device */
         dev_dbg(adapter->dev, "info: unregister device\n");
         if (adapter->if_ops.unregister_dev)
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index e66993cb5daf..55273eefb785 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -41,6 +41,8 @@
 #include "util.h"
 #include "fw.h"
 #include "pcie.h"
+#include "usb.h"
+#include "sdio.h"
 
 extern const char driver_version[];
 
@@ -136,6 +138,8 @@ enum {
 /* Threshold for tx_timeout_cnt before we trigger a card reset */
 #define TX_TIMEOUT_THRESHOLD    6
 
+#define MWIFIEX_DRV_INFO_SIZE_MAX 0x40000
+
 struct mwifiex_dbg {
         u32 num_cmd_host_to_card_failure;
         u32 num_cmd_sleep_cfm_host_to_card_failure;
@@ -161,7 +165,6 @@ struct mwifiex_dbg {
 enum MWIFIEX_HARDWARE_STATUS {
         MWIFIEX_HW_STATUS_READY,
         MWIFIEX_HW_STATUS_INITIALIZING,
-        MWIFIEX_HW_STATUS_FW_READY,
         MWIFIEX_HW_STATUS_INIT_DONE,
         MWIFIEX_HW_STATUS_RESET,
         MWIFIEX_HW_STATUS_CLOSING,
@@ -413,6 +416,7 @@ struct mwifiex_roc_cfg {
 };
 
 #define MWIFIEX_FW_DUMP_IDX             0xff
+#define MWIFIEX_DRV_INFO_IDX            20
 #define FW_DUMP_MAX_NAME_LEN            8
 #define FW_DUMP_HOST_READY              0xEE
 #define FW_DUMP_DONE                    0xFF
@@ -582,6 +586,8 @@ struct mwifiex_private {
         struct idr ack_status_frames;
         /* spin lock for ack status */
         spinlock_t ack_status_lock;
+        /** rx histogram data */
+        struct mwifiex_histogram_data *hist_data;
 };
 
 enum mwifiex_ba_status {
@@ -717,6 +723,7 @@ struct mwifiex_if_ops {
         int (*dnld_fw) (struct mwifiex_adapter *, struct mwifiex_fw_image *);
         void (*card_reset) (struct mwifiex_adapter *);
         void (*fw_dump)(struct mwifiex_adapter *);
+        int (*reg_dump)(struct mwifiex_adapter *, char *);
         int (*clean_pcie_ring) (struct mwifiex_adapter *adapter);
         void (*iface_work)(struct work_struct *work);
         void (*submit_rem_rx_urbs)(struct mwifiex_adapter *adapter);
@@ -823,6 +830,7 @@ struct mwifiex_adapter {
         u16 gen_null_pkt;
         u16 pps_uapsd_mode;
         u32 pm_wakeup_fw_try;
+        struct timer_list wakeup_timer;
         u8 is_hs_configured;
         struct mwifiex_hs_config_param hs_cfg;
         u8 hs_activated;
@@ -865,6 +873,8 @@ struct mwifiex_adapter {
         struct memory_type_mapping *mem_type_mapping_tbl;
         u8 num_mem_types;
         u8 curr_mem_idx;
+        void *drv_info_dump;
+        u32 drv_info_size;
         bool scan_chan_gap_enabled;
         struct sk_buff_head rx_data_q;
         struct mwifiex_chan_stats *chan_stats;
@@ -1324,6 +1334,8 @@ void mwifiex_process_tdls_action_frame(struct mwifiex_private *priv,
                                        u8 *buf, int len);
 int mwifiex_tdls_oper(struct mwifiex_private *priv, const u8 *peer, u8 action);
 int mwifiex_get_tdls_link_status(struct mwifiex_private *priv, const u8 *mac);
+int mwifiex_get_tdls_list(struct mwifiex_private *priv,
+                          struct tdls_peer_info *buf);
 void mwifiex_disable_all_tdls_links(struct mwifiex_private *priv);
 bool mwifiex_is_bss_in_11ac_mode(struct mwifiex_private *priv);
 u8 mwifiex_get_center_freq_index(struct mwifiex_private *priv, u8 band,
@@ -1348,6 +1360,16 @@ struct sk_buff *
 mwifiex_clone_skb_for_tx_status(struct mwifiex_private *priv,
                                 struct sk_buff *skb, u8 flag, u64 *cookie);
 
+void mwifiex_hist_data_set(struct mwifiex_private *priv, u8 rx_rate, s8 snr,
+                           s8 nflr);
+void mwifiex_hist_data_reset(struct mwifiex_private *priv);
+void mwifiex_hist_data_add(struct mwifiex_private *priv,
+                           u8 rx_rate, s8 snr, s8 nflr);
+u8 mwifiex_adjust_data_rate(struct mwifiex_private *priv,
+                            u8 rx_rate, u8 ht_info);
+
+void mwifiex_dump_drv_info(struct mwifiex_adapter *adapter);
+
 #ifdef CONFIG_DEBUG_FS
 void mwifiex_debugfs_init(void);
 void mwifiex_debugfs_remove(void);
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index c3a20f94f3c9..a460b0e6a151 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -1952,8 +1952,8 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
                 offset += txlen;
         } while (true);
 
-        dev_dbg(adapter->dev, "info:\nFW download over, size %d bytes\n",
-                offset);
+        dev_notice(adapter->dev,
+                   "info: FW download over, size %d bytes\n", offset);
 
         ret = 0;
 
@@ -2064,6 +2064,7 @@ static void mwifiex_interrupt_status(struct mwifiex_adapter *adapter)
                                  * state until cookie is set */
                                 adapter->ps_state = PS_STATE_AWAKE;
                                 adapter->pm_wakeup_fw_try = false;
+                                del_timer(&adapter->wakeup_timer);
                 }
         }
 }
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index 984a7a4fa93b..e304f0731647 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -1429,6 +1429,12 @@ int mwifiex_scan_networks(struct mwifiex_private *priv,
                 return -EBUSY;
         }
 
+        if (adapter->surprise_removed || adapter->is_cmd_timedout) {
+                dev_err(adapter->dev,
+                        "Ignore scan. Card removed or firmware in bad state\n");
+                return -EFAULT;
+        }
+
         spin_lock_irqsave(&adapter->mwifiex_cmd_lock, flags);
         adapter->scan_processing = true;
         spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, flags);
diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
index 933dae137850..a70f103359ea 100644
--- a/drivers/net/wireless/mwifiex/sdio.c
+++ b/drivers/net/wireless/mwifiex/sdio.c
@@ -986,8 +986,8 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
                 offset += txlen;
         } while (true);
 
-        dev_dbg(adapter->dev, "info: FW download over, size %d bytes\n",
-                offset);
+        dev_notice(adapter->dev,
+                   "info: FW download over, size %d bytes\n", offset);
 
         ret = 0;
 done:
@@ -1958,8 +1958,8 @@ static void mwifiex_sdio_card_reset_work(struct mwifiex_adapter *adapter)
 
         pr_err("Resetting card...\n");
         mmc_remove_host(target);
-        /* 20ms delay is based on experiment with sdhci controller */
-        mdelay(20);
+        /* 200ms delay is based on experiment with sdhci controller */
+        mdelay(200);
         target->rescan_entered = 0; /* rescan non-removable cards */
         mmc_add_host(target);
 }
@@ -2023,6 +2023,8 @@ static void mwifiex_sdio_fw_dump_work(struct work_struct *work)
         u32 memory_size;
         static char *env[] = { "DRIVER=mwifiex_sdio", "EVENT=fw_dump", NULL };
 
+        mwifiex_dump_drv_info(adapter);
+
         if (!card->supports_fw_dump)
                 return;
 
@@ -2166,6 +2168,99 @@ static void mwifiex_sdio_fw_dump(struct mwifiex_adapter *adapter)
         schedule_work(&adapter->iface_work);
 }
 
+/* Function to dump SDIO function registers and SDIO scratch registers in case
+ * of FW crash
+ */
+static int
+mwifiex_sdio_reg_dump(struct mwifiex_adapter *adapter, char *drv_buf)
+{
+        char *p = drv_buf;
+        struct sdio_mmc_card *cardp = adapter->card;
+        int ret = 0;
+        u8 count, func, data, index = 0, size = 0;
+        u8 reg, reg_start, reg_end;
+        char buf[256], *ptr;
+
+        if (!p)
+                return 0;
+
+        dev_info(adapter->dev, "SDIO register DUMP START\n");
+
+        mwifiex_pm_wakeup_card(adapter);
+
+        sdio_claim_host(cardp->func);
+
+        for (count = 0; count < 5; count++) {
+                memset(buf, 0, sizeof(buf));
+                ptr = buf;
+
+                switch (count) {
+                case 0:
+                        /* Read the registers of SDIO function0 */
+                        func = count;
+                        reg_start = 0;
+                        reg_end = 9;
+                        break;
+                case 1:
+                        /* Read the registers of SDIO function1 */
+                        func = count;
+                        reg_start = cardp->reg->func1_dump_reg_start;
+                        reg_end = cardp->reg->func1_dump_reg_end;
+                        break;
+                case 2:
+                        index = 0;
+                        func = 1;
+                        reg_start = cardp->reg->func1_spec_reg_table[index++];
+                        size = cardp->reg->func1_spec_reg_num;
+                        reg_end = cardp->reg->func1_spec_reg_table[size-1];
+                        break;
+                default:
+                        /* Read the scratch registers of SDIO function1 */
+                        if (count == 4)
+                                mdelay(100);
+                        func = 1;
+                        reg_start = cardp->reg->func1_scratch_reg;
+                        reg_end = reg_start + MWIFIEX_SDIO_SCRATCH_SIZE;
+                }
+
+                if (count != 2)
+                        ptr += sprintf(ptr, "SDIO Func%d (%#x-%#x): ",
+                                       func, reg_start, reg_end);
+                else
+                        ptr += sprintf(ptr, "SDIO Func%d: ", func);
+
+                for (reg = reg_start; reg <= reg_end;) {
+                        if (func == 0)
+                                data = sdio_f0_readb(cardp->func, reg, &ret);
+                        else
+                                data = sdio_readb(cardp->func, reg, &ret);
+
+                        if (count == 2)
+                                ptr += sprintf(ptr, "(%#x) ", reg);
+                        if (!ret) {
+                                ptr += sprintf(ptr, "%02x ", data);
+                        } else {
+                                ptr += sprintf(ptr, "ERR");
+                                break;
+                        }
+
+                        if (count == 2 && reg < reg_end)
+                                reg = cardp->reg->func1_spec_reg_table[index++];
+                        else
+                                reg++;
+                }
+
+                dev_info(adapter->dev, "%s\n", buf);
+                p += sprintf(p, "%s\n", buf);
+        }
+
+        sdio_release_host(cardp->func);
+
+        dev_info(adapter->dev, "SDIO register DUMP END\n");
+
+        return p - drv_buf;
+}
+
 static struct mwifiex_if_ops sdio_ops = {
         .init_if = mwifiex_init_sdio,
         .cleanup_if = mwifiex_cleanup_sdio,
@@ -2188,6 +2283,7 @@ static struct mwifiex_if_ops sdio_ops = {
         .card_reset = mwifiex_sdio_card_reset,
         .iface_work = mwifiex_sdio_work,
         .fw_dump = mwifiex_sdio_fw_dump,
+        .reg_dump = mwifiex_sdio_reg_dump,
 };
 
 /*
diff --git a/drivers/net/wireless/mwifiex/sdio.h b/drivers/net/wireless/mwifiex/sdio.h
index 54c07156dd78..895eea054c9e 100644
--- a/drivers/net/wireless/mwifiex/sdio.h
+++ b/drivers/net/wireless/mwifiex/sdio.h
@@ -44,6 +44,9 @@
 
 #define MWIFIEX_SDIO_BYTE_MODE_MASK     0x80000000
 
+#define MWIFIEX_MAX_FUNC2_REG_NUM       13
+#define MWIFIEX_SDIO_SCRATCH_SIZE       10
+
 #define SDIO_MPA_ADDR_BASE              0x1000
 #define CTRL_PORT                       0
 #define CTRL_PORT_MASK                  0x0001
@@ -219,6 +222,11 @@ struct mwifiex_sdio_card_reg {
         u8 fw_dump_ctrl;
         u8 fw_dump_start;
         u8 fw_dump_end;
+        u8 func1_dump_reg_start;
+        u8 func1_dump_reg_end;
+        u8 func1_scratch_reg;
+        u8 func1_spec_reg_num;
+        u8 func1_spec_reg_table[MWIFIEX_MAX_FUNC2_REG_NUM];
 };
 
 struct sdio_mmc_card {
@@ -291,6 +299,11 @@ static const struct mwifiex_sdio_card_reg mwifiex_reg_sd87xx = {
         .rd_len_p0_l = 0x08,
         .rd_len_p0_u = 0x09,
         .card_misc_cfg_reg = 0x6c,
+        .func1_dump_reg_start = 0x0,
+        .func1_dump_reg_end = 0x9,
+        .func1_scratch_reg = 0x60,
+        .func1_spec_reg_num = 5,
+        .func1_spec_reg_table = {0x28, 0x30, 0x34, 0x38, 0x3c},
 };
 
 static const struct mwifiex_sdio_card_reg mwifiex_reg_sd8897 = {
@@ -335,6 +348,12 @@ static const struct mwifiex_sdio_card_reg mwifiex_reg_sd8897 = {
         .fw_dump_ctrl = 0xe2,
         .fw_dump_start = 0xe3,
         .fw_dump_end = 0xea,
+        .func1_dump_reg_start = 0x0,
+        .func1_dump_reg_end = 0xb,
+        .func1_scratch_reg = 0xc0,
+        .func1_spec_reg_num = 8,
+        .func1_spec_reg_table = {0x4C, 0x50, 0x54, 0x55, 0x58,
+                                 0x59, 0x5c, 0x5d},
 };
 
 static const struct mwifiex_sdio_card_reg mwifiex_reg_sd8887 = {
@@ -376,6 +395,13 @@ static const struct mwifiex_sdio_card_reg mwifiex_reg_sd8887 = {
         .cmd_cfg_1 = 0xc5,
         .cmd_cfg_2 = 0xc6,
         .cmd_cfg_3 = 0xc7,
+        .func1_dump_reg_start = 0x10,
+        .func1_dump_reg_end = 0x17,
+        .func1_scratch_reg = 0x90,
+        .func1_spec_reg_num = 13,
+        .func1_spec_reg_table = {0x08, 0x58, 0x5C, 0x5D, 0x60,
+                                 0x61, 0x62, 0x64, 0x65, 0x66,
+                                 0x68, 0x69, 0x6a},
 };
 
 static const struct mwifiex_sdio_device mwifiex_sdio_sd8786 = {
diff --git a/drivers/net/wireless/mwifiex/sta_cmd.c b/drivers/net/wireless/mwifiex/sta_cmd.c
index 1c2ca291d1f5..f7b920d7a95a 100644
--- a/drivers/net/wireless/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/mwifiex/sta_cmd.c
@@ -26,6 +26,10 @@
 #include "11n.h"
 #include "11ac.h"
 
+static bool disable_auto_ds;
+module_param(disable_auto_ds, bool, 0);
+MODULE_PARM_DESC(disable_auto_ds,
+                 "deepsleep enabled=0(default), deepsleep disabled=1");
 /*
  * This function prepares command to set/get RSSI information.
  *
@@ -2031,7 +2035,8 @@ int mwifiex_sta_init_cmd(struct mwifiex_private *priv, u8 first_sta)
         if (ret)
                 return -1;
 
-        if (first_sta && priv->adapter->iface_type != MWIFIEX_USB &&
+        if (!disable_auto_ds &&
+            first_sta && priv->adapter->iface_type != MWIFIEX_USB &&
             priv->bss_type != MWIFIEX_BSS_TYPE_UAP) {
                 /* Enable auto deep sleep */
                 auto_ds.auto_ds = DEEP_SLEEP_ON;
diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c
index b65e1014b0fc..65d10a33eab5 100644
--- a/drivers/net/wireless/mwifiex/sta_cmdresp.c
+++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c
@@ -248,6 +248,8 @@ static int mwifiex_ret_get_log(struct mwifiex_private *priv,
                         le32_to_cpu(get_log->wep_icv_err_cnt[2]);
                 stats->wep_icv_error[3] =
                         le32_to_cpu(get_log->wep_icv_err_cnt[3]);
+                stats->bcn_rcv_cnt = le32_to_cpu(get_log->bcn_rcv_cnt);
+                stats->bcn_miss_cnt = le32_to_cpu(get_log->bcn_miss_cnt);
         }
 
         return 0;
diff --git a/drivers/net/wireless/mwifiex/sta_event.c b/drivers/net/wireless/mwifiex/sta_event.c
index b8c171df6223..419e35f1dbf3 100644
--- a/drivers/net/wireless/mwifiex/sta_event.c
+++ b/drivers/net/wireless/mwifiex/sta_event.c
@@ -90,6 +90,10 @@ mwifiex_reset_connect_state(struct mwifiex_private *priv, u16 reason_code)
         priv->is_data_rate_auto = true;
         priv->data_rate = 0;
 
+        if ((GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_STA ||
+             GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_UAP) && priv->hist_data)
+                mwifiex_hist_data_reset(priv);
+
         if (priv->bss_mode == NL80211_IFTYPE_ADHOC) {
                 priv->adhoc_state = ADHOC_IDLE;
                 priv->adhoc_is_link_sensed = false;
@@ -308,6 +312,8 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
                                         adapter->ps_state = PS_STATE_AWAKE;
                                         adapter->pm_wakeup_card_req = false;
                                         adapter->pm_wakeup_fw_try = false;
+                                        mod_timer(&adapter->wakeup_timer,
+                                                  jiffies + (HZ*3));
                                         break;
                                 }
                                 if (!mwifiex_send_null_packet
@@ -322,6 +328,7 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
                 adapter->ps_state = PS_STATE_AWAKE;
                 adapter->pm_wakeup_card_req = false;
                 adapter->pm_wakeup_fw_try = false;
+                del_timer_sync(&adapter->wakeup_timer);
 
                 break;
 
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index 1626868a4b5c..fb9c5fc83e5d 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -902,9 +902,12 @@ static int mwifiex_sec_ioctl_set_wep_key(struct mwifiex_private *priv,
         if (wep_key->key_length) {
                 void *enc_key;
 
-                if (encrypt_key->key_disable)
+                if (encrypt_key->key_disable) {
                         memset(&priv->wep_key[index], 0,
                                sizeof(struct mwifiex_wep_key));
+                        if (wep_key->key_length)
+                                goto done;
+                        }
 
                 if (adapter->key_api_major_ver == KEY_API_VER_MAJOR_V2)
                         enc_key = encrypt_key;
@@ -918,6 +921,7 @@ static int mwifiex_sec_ioctl_set_wep_key(struct mwifiex_private *priv,
                         return ret;
         }
 
+done:
         if (priv->sec_info.wep_enabled)
                 priv->curr_pkt_filter |= HostCmd_ACT_MAC_WEP_ENABLE;
         else
diff --git a/drivers/net/wireless/mwifiex/sta_rx.c b/drivers/net/wireless/mwifiex/sta_rx.c
index c2ad3b63ae70..b8729c9394e9 100644
--- a/drivers/net/wireless/mwifiex/sta_rx.c
+++ b/drivers/net/wireless/mwifiex/sta_rx.c
@@ -90,6 +90,7 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv,
         struct ethhdr *eth;
         u16 rx_pkt_off, rx_pkt_len;
         u8 *offset;
+        u8 adj_rx_rate = 0;
 
         local_rx_pd = (struct rxpd *) (skb->data);
 
@@ -155,6 +156,14 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv,
 
         priv->rxpd_htinfo = local_rx_pd->ht_info;
 
+        if (GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_STA ||
+            GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_UAP) {
+                adj_rx_rate = mwifiex_adjust_data_rate(priv, priv->rxpd_rate,
+                                                       priv->rxpd_htinfo);
+                mwifiex_hist_data_add(priv, adj_rx_rate, local_rx_pd->snr,
+                                      local_rx_pd->nf);
+        }
+
         ret = mwifiex_recv_packet(priv, skb);
         if (ret == -1)
                 dev_err(priv->adapter->dev, "recv packet failed\n");
diff --git a/drivers/net/wireless/mwifiex/sta_tx.c b/drivers/net/wireless/mwifiex/sta_tx.c
index b896d7375b52..1debe76017b1 100644
--- a/drivers/net/wireless/mwifiex/sta_tx.c
+++ b/drivers/net/wireless/mwifiex/sta_tx.c
@@ -47,8 +47,10 @@ void *mwifiex_process_sta_txpd(struct mwifiex_private *priv,
         struct mwifiex_adapter *adapter = priv->adapter;
         struct txpd *local_tx_pd;
         struct mwifiex_txinfo *tx_info = MWIFIEX_SKB_TXCB(skb);
-        u8 pad;
+        unsigned int pad;
         u16 pkt_type, pkt_offset;
+        int hroom = (priv->adapter->iface_type == MWIFIEX_USB) ? 0 :
+                       INTF_HEADER_LEN;
 
         if (!skb->len) {
                 dev_err(adapter->dev, "Tx: bad packet length: %d\n", skb->len);
@@ -56,13 +58,12 @@ void *mwifiex_process_sta_txpd(struct mwifiex_private *priv,
                 return skb->data;
         }
 
-        pkt_type = mwifiex_is_skb_mgmt_frame(skb) ? PKT_TYPE_MGMT : 0;
+        BUG_ON(skb_headroom(skb) < MWIFIEX_MIN_DATA_HEADER_LEN);
 
-        /* If skb->data is not aligned; add padding */
-        pad = (4 - (((void *)skb->data - NULL) & 0x3)) % 4;
+        pkt_type = mwifiex_is_skb_mgmt_frame(skb) ? PKT_TYPE_MGMT : 0;
 
-        BUG_ON(skb_headroom(skb) < (sizeof(*local_tx_pd) + INTF_HEADER_LEN
-                                    + pad));
+        pad = ((void *)skb->data - (sizeof(*local_tx_pd) + hroom)-
+                         NULL) & (MWIFIEX_DMA_ALIGN_SZ - 1);
         skb_push(skb, sizeof(*local_tx_pd) + pad);
 
         local_tx_pd = (struct txpd *) skb->data;
@@ -70,8 +71,8 @@ void *mwifiex_process_sta_txpd(struct mwifiex_private *priv,
         local_tx_pd->bss_num = priv->bss_num;
         local_tx_pd->bss_type = priv->bss_type;
         local_tx_pd->tx_pkt_length = cpu_to_le16((u16)(skb->len -
-                                                       (sizeof(struct txpd)
-                                                        + pad)));
+                                                       (sizeof(struct txpd) +
+                                                        pad)));
 
         local_tx_pd->priority = (u8) skb->priority;
         local_tx_pd->pkt_delay_2ms =
@@ -115,7 +116,7 @@ void *mwifiex_process_sta_txpd(struct mwifiex_private *priv,
         local_tx_pd->tx_pkt_offset = cpu_to_le16(pkt_offset);
 
         /* make space for INTF_HEADER_LEN */
-        skb_push(skb, INTF_HEADER_LEN);
+        skb_push(skb, hroom);
 
         if (!local_tx_pd->tx_control)
                 /* TxCtrl set by user or default */
diff --git a/drivers/net/wireless/mwifiex/tdls.c b/drivers/net/wireless/mwifiex/tdls.c
index 22884b429be7..087d84762cd3 100644
--- a/drivers/net/wireless/mwifiex/tdls.c
+++ b/drivers/net/wireless/mwifiex/tdls.c
@@ -1123,6 +1123,36 @@ int mwifiex_get_tdls_link_status(struct mwifiex_private *priv, const u8 *mac)
         return TDLS_NOT_SETUP;
 }
 
+int mwifiex_get_tdls_list(struct mwifiex_private *priv,
+                          struct tdls_peer_info *buf)
+{
+        struct mwifiex_sta_node *sta_ptr;
+        struct tdls_peer_info *peer = buf;
+        int count = 0;
+        unsigned long flags;
+
+        if (!ISSUPP_TDLS_ENABLED(priv->adapter->fw_cap_info))
+                return 0;
+
+        /* make sure we are in station mode and connected */
+        if (!(priv->bss_type == MWIFIEX_BSS_TYPE_STA && priv->media_connected))
+                return 0;
+
+        spin_lock_irqsave(&priv->sta_list_spinlock, flags);
+        list_for_each_entry(sta_ptr, &priv->sta_list, list) {
+                if (sta_ptr->tdls_status == TDLS_SETUP_COMPLETE) {
+                        ether_addr_copy(peer->peer_addr, sta_ptr->mac_addr);
+                        peer++;
+                        count++;
+                        if (count >= MWIFIEX_MAX_TDLS_PEER_SUPPORTED)
+                                break;
+                }
+        }
+        spin_unlock_irqrestore(&priv->sta_list_spinlock, flags);
+
+        return count;
+}
+
 void mwifiex_disable_all_tdls_links(struct mwifiex_private *priv)
 {
         struct mwifiex_sta_node *sta_ptr;
@@ -1367,9 +1397,8 @@ void mwifiex_check_auto_tdls(unsigned long context)
 
 void mwifiex_setup_auto_tdls_timer(struct mwifiex_private *priv)
 {
-        init_timer(&priv->auto_tdls_timer);
-        priv->auto_tdls_timer.function = mwifiex_check_auto_tdls;
-        priv->auto_tdls_timer.data = (unsigned long)priv;
+        setup_timer(&priv->auto_tdls_timer, mwifiex_check_auto_tdls,
+                    (unsigned long)priv);
         priv->auto_tdls_timer_active = true;
         mod_timer(&priv->auto_tdls_timer,
                   jiffies + msecs_to_jiffies(MWIFIEX_TIMER_10S));
diff --git a/drivers/net/wireless/mwifiex/uap_event.c b/drivers/net/wireless/mwifiex/uap_event.c
index 3b3a970e2086..96ff39722f8f 100644
--- a/drivers/net/wireless/mwifiex/uap_event.c
+++ b/drivers/net/wireless/mwifiex/uap_event.c
@@ -131,6 +131,8 @@ int mwifiex_process_uap_event(struct mwifiex_private *priv)
                 dev_dbg(adapter->dev, "AP EVENT: event id: %#x\n", eventcause);
                 memcpy(priv->netdev->dev_addr, adapter->event_body + 2,
                        ETH_ALEN);
+                if (priv->hist_data)
+                        mwifiex_hist_data_reset(priv);
                 break;
         case EVENT_UAP_MIC_COUNTERMEASURES:
                 /* For future development */
diff --git a/drivers/net/wireless/mwifiex/uap_txrx.c b/drivers/net/wireless/mwifiex/uap_txrx.c
index be3a203a529b..38ac4d74c486 100644
--- a/drivers/net/wireless/mwifiex/uap_txrx.c
+++ b/drivers/net/wireless/mwifiex/uap_txrx.c
@@ -348,8 +348,10 @@ void *mwifiex_process_uap_txpd(struct mwifiex_private *priv,
         struct mwifiex_adapter *adapter = priv->adapter;
         struct uap_txpd *txpd;
         struct mwifiex_txinfo *tx_info = MWIFIEX_SKB_TXCB(skb);
-        int pad, len;
-        u16 pkt_type;
+        int pad;
+        u16 pkt_type, pkt_offset;
+        int hroom = (priv->adapter->iface_type == MWIFIEX_USB) ? 0 :
+                       INTF_HEADER_LEN;
 
         if (!skb->len) {
                 dev_err(adapter->dev, "Tx: bad packet length: %d\n", skb->len);
@@ -357,22 +359,21 @@ void *mwifiex_process_uap_txpd(struct mwifiex_private *priv,
                 return skb->data;
         }
 
-        pkt_type = mwifiex_is_skb_mgmt_frame(skb) ? PKT_TYPE_MGMT : 0;
-
-        /* If skb->data is not aligned, add padding */
-        pad = (4 - (((void *)skb->data - NULL) & 0x3)) % 4;
+        BUG_ON(skb_headroom(skb) < MWIFIEX_MIN_DATA_HEADER_LEN);
 
-        len = sizeof(*txpd) + pad;
+        pkt_type = mwifiex_is_skb_mgmt_frame(skb) ? PKT_TYPE_MGMT : 0;
 
-        BUG_ON(skb_headroom(skb) < len + INTF_HEADER_LEN);
+        pad = ((void *)skb->data - (sizeof(*txpd) + hroom) - NULL) &
+                        (MWIFIEX_DMA_ALIGN_SZ - 1);
 
-        skb_push(skb, len);
+        skb_push(skb, sizeof(*txpd) + pad);
 
         txpd = (struct uap_txpd *)skb->data;
         memset(txpd, 0, sizeof(*txpd));
         txpd->bss_num = priv->bss_num;
         txpd->bss_type = priv->bss_type;
-        txpd->tx_pkt_length = cpu_to_le16((u16)(skb->len - len));
+        txpd->tx_pkt_length = cpu_to_le16((u16)(skb->len - (sizeof(*txpd) +
+                                                pad)));
         txpd->priority = (u8)skb->priority;
 
         txpd->pkt_delay_2ms = mwifiex_wmm_compute_drv_pkt_delay(priv, skb);
@@ -392,16 +393,17 @@ void *mwifiex_process_uap_txpd(struct mwifiex_private *priv,
                     cpu_to_le32(priv->wmm.user_pri_pkt_tx_ctrl[txpd->priority]);
 
         /* Offset of actual data */
+        pkt_offset = sizeof(*txpd) + pad;
         if (pkt_type == PKT_TYPE_MGMT) {
                 /* Set the packet type and add header for management frame */
                 txpd->tx_pkt_type = cpu_to_le16(pkt_type);
-                len += MWIFIEX_MGMT_FRAME_HEADER_SIZE;
+                pkt_offset += MWIFIEX_MGMT_FRAME_HEADER_SIZE;
         }
 
-        txpd->tx_pkt_offset = cpu_to_le16(len);
+        txpd->tx_pkt_offset = cpu_to_le16(pkt_offset);
 
         /* make space for INTF_HEADER_LEN */
-        skb_push(skb, INTF_HEADER_LEN);
+        skb_push(skb, hroom);
 
         if (!txpd->tx_control)
                 /* TxCtrl set by user or default */
diff --git a/drivers/net/wireless/mwifiex/usb.c b/drivers/net/wireless/mwifiex/usb.c
index 1b56495ec872..6c62995028e6 100644
--- a/drivers/net/wireless/mwifiex/usb.c
+++ b/drivers/net/wireless/mwifiex/usb.c
@@ -930,7 +930,8 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
         } while ((dnld_cmd != FW_HAS_LAST_BLOCK) && retries);
 
 cleanup:
-        dev_dbg(adapter->dev, "%s: %d bytes downloaded\n", __func__, tlen);
+        dev_notice(adapter->dev,
+                   "info: FW download over, size %d bytes\n", tlen);
 
         kfree(recv_buff);
         kfree(fwdata);
@@ -990,6 +991,7 @@ static int mwifiex_pm_wakeup_card(struct mwifiex_adapter *adapter)
 {
         /* Simulation of HS_AWAKE event */
         adapter->pm_wakeup_fw_try = false;
+        del_timer_sync(&adapter->wakeup_timer);
         adapter->pm_wakeup_card_req = false;
         adapter->ps_state = PS_STATE_AWAKE;
 
@@ -1010,6 +1012,13 @@ static void mwifiex_usb_submit_rem_rx_urbs(struct mwifiex_adapter *adapter)
         }
 }
 
+/* This function is called after the card has woken up. */
+static inline int
+mwifiex_pm_wakeup_card_complete(struct mwifiex_adapter *adapter)
+{
+        return 0;
+}
+
 static struct mwifiex_if_ops usb_ops = {
         .register_dev =         mwifiex_register_dev,
         .unregister_dev =       mwifiex_unregister_dev,
diff --git a/drivers/net/wireless/mwifiex/usb.h b/drivers/net/wireless/mwifiex/usb.h
index a7cbba1355af..0ad1bebc3f93 100644
--- a/drivers/net/wireless/mwifiex/usb.h
+++ b/drivers/net/wireless/mwifiex/usb.h
@@ -96,11 +96,4 @@ struct fw_data {
         u8 data[1];
 };
 
-/* This function is called after the card has woken up. */
-static inline int
-mwifiex_pm_wakeup_card_complete(struct mwifiex_adapter *adapter)
-{
-        return 0;
-}
-
 #endif /*_MWIFIEX_USB_H */
diff --git a/drivers/net/wireless/mwifiex/util.c b/drivers/net/wireless/mwifiex/util.c
index b1768fbf98f2..707319799942 100644
--- a/drivers/net/wireless/mwifiex/util.c
+++ b/drivers/net/wireless/mwifiex/util.c
@@ -25,6 +25,96 @@
 #include "wmm.h"
 #include "11n.h"
 
+static struct mwifiex_debug_data items[] = {
+        {"int_counter", item_size(int_counter),
+         item_addr(int_counter), 1},
+        {"wmm_ac_vo", item_size(packets_out[WMM_AC_VO]),
+         item_addr(packets_out[WMM_AC_VO]), 1},
+        {"wmm_ac_vi", item_size(packets_out[WMM_AC_VI]),
+         item_addr(packets_out[WMM_AC_VI]), 1},
+        {"wmm_ac_be", item_size(packets_out[WMM_AC_BE]),
+         item_addr(packets_out[WMM_AC_BE]), 1},
+        {"wmm_ac_bk", item_size(packets_out[WMM_AC_BK]),
+         item_addr(packets_out[WMM_AC_BK]), 1},
+        {"tx_buf_size", item_size(tx_buf_size),
+         item_addr(tx_buf_size), 1},
+        {"curr_tx_buf_size", item_size(curr_tx_buf_size),
+         item_addr(curr_tx_buf_size), 1},
+        {"ps_mode", item_size(ps_mode),
+         item_addr(ps_mode), 1},
+        {"ps_state", item_size(ps_state),
+         item_addr(ps_state), 1},
+        {"is_deep_sleep", item_size(is_deep_sleep),
+         item_addr(is_deep_sleep), 1},
+        {"wakeup_dev_req", item_size(pm_wakeup_card_req),
+         item_addr(pm_wakeup_card_req), 1},
+        {"wakeup_tries", item_size(pm_wakeup_fw_try),
+         item_addr(pm_wakeup_fw_try), 1},
+        {"hs_configured", item_size(is_hs_configured),
+         item_addr(is_hs_configured), 1},
+        {"hs_activated", item_size(hs_activated),
+         item_addr(hs_activated), 1},
+        {"num_tx_timeout", item_size(num_tx_timeout),
+         item_addr(num_tx_timeout), 1},
+        {"is_cmd_timedout", item_size(is_cmd_timedout),
+         item_addr(is_cmd_timedout), 1},
+        {"timeout_cmd_id", item_size(timeout_cmd_id),
+         item_addr(timeout_cmd_id), 1},
+        {"timeout_cmd_act", item_size(timeout_cmd_act),
+         item_addr(timeout_cmd_act), 1},
+        {"last_cmd_id", item_size(last_cmd_id),
+         item_addr(last_cmd_id), DBG_CMD_NUM},
+        {"last_cmd_act", item_size(last_cmd_act),
+         item_addr(last_cmd_act), DBG_CMD_NUM},
+        {"last_cmd_index", item_size(last_cmd_index),
+         item_addr(last_cmd_index), 1},
+        {"last_cmd_resp_id", item_size(last_cmd_resp_id),
+         item_addr(last_cmd_resp_id), DBG_CMD_NUM},
+        {"last_cmd_resp_index", item_size(last_cmd_resp_index),
+         item_addr(last_cmd_resp_index), 1},
+        {"last_event", item_size(last_event),
+         item_addr(last_event), DBG_CMD_NUM},
+        {"last_event_index", item_size(last_event_index),
+         item_addr(last_event_index), 1},
+        {"num_cmd_h2c_fail", item_size(num_cmd_host_to_card_failure),
+         item_addr(num_cmd_host_to_card_failure), 1},
+        {"num_cmd_sleep_cfm_fail",
+         item_size(num_cmd_sleep_cfm_host_to_card_failure),
+         item_addr(num_cmd_sleep_cfm_host_to_card_failure), 1},
+        {"num_tx_h2c_fail", item_size(num_tx_host_to_card_failure),
+         item_addr(num_tx_host_to_card_failure), 1},
+        {"num_evt_deauth", item_size(num_event_deauth),
+         item_addr(num_event_deauth), 1},
+        {"num_evt_disassoc", item_size(num_event_disassoc),
+         item_addr(num_event_disassoc), 1},
+        {"num_evt_link_lost", item_size(num_event_link_lost),
+         item_addr(num_event_link_lost), 1},
+        {"num_cmd_deauth", item_size(num_cmd_deauth),
+         item_addr(num_cmd_deauth), 1},
+        {"num_cmd_assoc_ok", item_size(num_cmd_assoc_success),
+         item_addr(num_cmd_assoc_success), 1},
+        {"num_cmd_assoc_fail", item_size(num_cmd_assoc_failure),
+         item_addr(num_cmd_assoc_failure), 1},
+        {"cmd_sent", item_size(cmd_sent),
+         item_addr(cmd_sent), 1},
+        {"data_sent", item_size(data_sent),
+         item_addr(data_sent), 1},
+        {"cmd_resp_received", item_size(cmd_resp_received),
+         item_addr(cmd_resp_received), 1},
+        {"event_received", item_size(event_received),
+         item_addr(event_received), 1},
+
+        /* variables defined in struct mwifiex_adapter */
+        {"cmd_pending", adapter_item_size(cmd_pending),
+         adapter_item_addr(cmd_pending), 1},
+        {"tx_pending", adapter_item_size(tx_pending),
+         adapter_item_addr(tx_pending), 1},
+        {"rx_pending", adapter_item_size(rx_pending),
+         adapter_item_addr(rx_pending), 1},
+};
+
+static int num_of_items = ARRAY_SIZE(items);
+
 /*
  * Firmware initialization complete callback handler.
  *
@@ -97,6 +187,8 @@ int mwifiex_get_debug_info(struct mwifiex_private *priv,
                                                               info->rx_tbl);
                 info->tx_tbl_num = mwifiex_get_tx_ba_stream_tbl(priv,
                                                                 info->tx_tbl);
+                info->tdls_peer_num = mwifiex_get_tdls_list(priv,
+                                                            info->tdls_list);
                 info->ps_mode = adapter->ps_mode;
                 info->ps_state = adapter->ps_state;
                 info->is_deep_sleep = adapter->is_deep_sleep;
@@ -141,6 +233,93 @@ int mwifiex_get_debug_info(struct mwifiex_private *priv,
         return 0;
 }
 
+int mwifiex_debug_info_to_buffer(struct mwifiex_private *priv, char *buf,
+                                 struct mwifiex_debug_info *info)
+{
+        char *p = buf;
+        struct mwifiex_debug_data *d = &items[0];
+        size_t size, addr;
+        long val;
+        int i, j;
+
+        if (!info)
+                return 0;
+
+        for (i = 0; i < num_of_items; i++) {
+                p += sprintf(p, "%s=", d[i].name);
+
+                size = d[i].size / d[i].num;
+
+                if (i < (num_of_items - 3))
+                        addr = d[i].addr + (size_t)info;
+                else /* The last 3 items are struct mwifiex_adapter variables */
+                        addr = d[i].addr + (size_t)priv->adapter;
+
+                for (j = 0; j < d[i].num; j++) {
+                        switch (size) {
+                        case 1:
+                                val = *((u8 *)addr);
+                                break;
+                        case 2:
+                                val = *((u16 *)addr);
+                                break;
+                        case 4:
+                                val = *((u32 *)addr);
+                                break;
+                        case 8:
+                                val = *((long long *)addr);
+                                break;
+                        default:
+                                val = -1;
+                                break;
+                        }
+
+                        p += sprintf(p, "%#lx ", val);
+                        addr += size;
+                }
+
+                p += sprintf(p, "\n");
+        }
+
+        if (info->tx_tbl_num) {
+                p += sprintf(p, "Tx BA stream table:\n");
+                for (i = 0; i < info->tx_tbl_num; i++)
+                        p += sprintf(p, "tid = %d, ra = %pM\n",
+                                     info->tx_tbl[i].tid, info->tx_tbl[i].ra);
+        }
+
+        if (info->rx_tbl_num) {
+                p += sprintf(p, "Rx reorder table:\n");
+                for (i = 0; i < info->rx_tbl_num; i++) {
+                        p += sprintf(p, "tid = %d, ta = %pM, ",
+                                     info->rx_tbl[i].tid,
+                                     info->rx_tbl[i].ta);
+                        p += sprintf(p, "start_win = %d, ",
+                                     info->rx_tbl[i].start_win);
+                        p += sprintf(p, "win_size = %d, buffer: ",
+                                     info->rx_tbl[i].win_size);
+
+                        for (j = 0; j < info->rx_tbl[i].win_size; j++)
+                                p += sprintf(p, "%c ",
+                                             info->rx_tbl[i].buffer[j] ?
+                                             '1' : '0');
+
+                        p += sprintf(p, "\n");
+                }
+        }
+
+        if (info->tdls_peer_num) {
+                p += sprintf(p, "TDLS peer table:\n");
+                for (i = 0; i < info->tdls_peer_num; i++) {
+                        p += sprintf(p, "peer = %pM",
+                                     info->tdls_list[i].peer_addr);
+                        p += sprintf(p, "\n");
+                }
+        }
+
+        return p - buf;
+}
+
 static int
 mwifiex_parse_mgmt_packet(struct mwifiex_private *priv, u8 *payload, u16 len,
                           struct rxpd *rx_pd)
@@ -404,3 +583,44 @@ void mwifiex_del_all_sta_list(struct mwifiex_private *priv)
         spin_unlock_irqrestore(&priv->sta_list_spinlock, flags);
         return;
 }
+
+/* This function adds histogram data to histogram array*/
+void mwifiex_hist_data_add(struct mwifiex_private *priv,
+                           u8 rx_rate, s8 snr, s8 nflr)
+{
+        struct mwifiex_histogram_data *phist_data = priv->hist_data;
+
+        if (atomic_read(&phist_data->num_samples) > MWIFIEX_HIST_MAX_SAMPLES)
+                mwifiex_hist_data_reset(priv);
+        mwifiex_hist_data_set(priv, rx_rate, snr, nflr);
+}
+
+/* function to add histogram record */
+void mwifiex_hist_data_set(struct mwifiex_private *priv, u8 rx_rate, s8 snr,
+                           s8 nflr)
+{
+        struct mwifiex_histogram_data *phist_data = priv->hist_data;
+
+        atomic_inc(&phist_data->num_samples);
+        atomic_inc(&phist_data->rx_rate[rx_rate]);
+        atomic_inc(&phist_data->snr[snr]);
+        atomic_inc(&phist_data->noise_flr[128 + nflr]);
+        atomic_inc(&phist_data->sig_str[nflr - snr]);
+}
+
+/* function to reset histogram data during init/reset */
+void mwifiex_hist_data_reset(struct mwifiex_private *priv)
+{
+        int ix;
+        struct mwifiex_histogram_data *phist_data = priv->hist_data;
+
+        atomic_set(&phist_data->num_samples, 0);
+        for (ix = 0; ix < MWIFIEX_MAX_AC_RX_RATES; ix++)
+                atomic_set(&phist_data->rx_rate[ix], 0);
+        for (ix = 0; ix < MWIFIEX_MAX_SNR; ix++)
+                atomic_set(&phist_data->snr[ix], 0);
+        for (ix = 0; ix < MWIFIEX_MAX_NOISE_FLR; ix++)
+                atomic_set(&phist_data->noise_flr[ix], 0);
+        for (ix = 0; ix < MWIFIEX_MAX_SIG_STRENGTH; ix++)
+                atomic_set(&phist_data->sig_str[ix], 0);
+}
diff --git a/drivers/net/wireless/mwifiex/util.h b/drivers/net/wireless/mwifiex/util.h
index 40296cb4a3f1..b541d66c01eb 100644
--- a/drivers/net/wireless/mwifiex/util.h
+++ b/drivers/net/wireless/mwifiex/util.h
@@ -20,6 +20,8 @@
 #ifndef _MWIFIEX_UTIL_H_
 #define _MWIFIEX_UTIL_H_
 
+struct mwifiex_private;
+
 struct mwifiex_dma_mapping {
         dma_addr_t addr;
         size_t len;
@@ -33,6 +35,21 @@ struct mwifiex_cb {
         };
 };
 
+/* size/addr for mwifiex_debug_info */
+#define item_size(n)            (FIELD_SIZEOF(struct mwifiex_debug_info, n))
+#define item_addr(n)            (offsetof(struct mwifiex_debug_info, n))
+
+/* size/addr for struct mwifiex_adapter */
+#define adapter_item_size(n)    (FIELD_SIZEOF(struct mwifiex_adapter, n))
+#define adapter_item_addr(n)    (offsetof(struct mwifiex_adapter, n))
+
+struct mwifiex_debug_data {
+        char name[32];          /* variable/array name */
+        u32 size;               /* size of the variable/array */
+        size_t addr;            /* address of the variable/array */
+        int num;                /* number of variables in an array */
+};
+
 static inline struct mwifiex_rxinfo *MWIFIEX_SKB_RXCB(struct sk_buff *skb)
 {
         struct mwifiex_cb *cb = (struct mwifiex_cb *)skb->cb;
@@ -73,4 +90,7 @@ static inline dma_addr_t MWIFIEX_SKB_DMA_ADDR(struct sk_buff *skb)
         return mapping.addr;
 }
 
+int mwifiex_debug_info_to_buffer(struct mwifiex_private *priv, char *buf,
+                                 struct mwifiex_debug_info *info);
+
 #endif /* !_MWIFIEX_UTIL_H_ */
diff --git a/drivers/net/wireless/orinoco/Kconfig b/drivers/net/wireless/orinoco/Kconfig
index 60698b020851..6d831d4d1b5f 100644
--- a/drivers/net/wireless/orinoco/Kconfig
+++ b/drivers/net/wireless/orinoco/Kconfig
@@ -1,7 +1,8 @@
 config HERMES
         tristate "Hermes chipset 802.11b support (Orinoco/Prism2/Symbol)"
         depends on (PPC_PMAC || PCI || PCMCIA)
-        depends on CFG80211 && CFG80211_WEXT
+        depends on CFG80211
+        select CFG80211_WEXT
         select WIRELESS_EXT
         select WEXT_SPY
         select WEXT_PRIV
diff --git a/drivers/net/wireless/orinoco/orinoco_usb.c b/drivers/net/wireless/orinoco/orinoco_usb.c
index 995846422dc0..91f05442de28 100644
--- a/drivers/net/wireless/orinoco/orinoco_usb.c
+++ b/drivers/net/wireless/orinoco/orinoco_usb.c
@@ -364,9 +364,7 @@ static struct request_context *ezusb_alloc_ctx(struct ezusb_priv *upriv,
         atomic_set(&ctx->refcount, 1);
         init_completion(&ctx->done);
 
-        init_timer(&ctx->timer);
-        ctx->timer.function = ezusb_request_timerfn;
-        ctx->timer.data = (u_long) ctx;
+        setup_timer(&ctx->timer, ezusb_request_timerfn, (u_long)ctx);
         return ctx;
 }
 
diff --git a/drivers/net/wireless/p54/fwio.c b/drivers/net/wireless/p54/fwio.c
index bc065e8e348b..5367d510b22d 100644
--- a/drivers/net/wireless/p54/fwio.c
+++ b/drivers/net/wireless/p54/fwio.c
@@ -220,6 +220,7 @@ int p54_download_eeprom(struct p54_common *priv, void *buf,
         struct sk_buff *skb;
         size_t eeprom_hdr_size;
         int ret = 0;
+        long timeout;
 
         if (priv->fw_var >= 0x509)
                 eeprom_hdr_size = sizeof(*eeprom_hdr);
@@ -249,9 +250,11 @@ int p54_download_eeprom(struct p54_common *priv, void *buf,
 
         p54_tx(priv, skb);
 
-        if (!wait_for_completion_interruptible_timeout(
-             &priv->eeprom_comp, HZ)) {
-                wiphy_err(priv->hw->wiphy, "device does not respond!\n");
+        timeout = wait_for_completion_interruptible_timeout(
+                        &priv->eeprom_comp, HZ);
+        if (timeout <= 0) {
+                wiphy_err(priv->hw->wiphy,
+                        "device does not respond or signal received!\n");
                 ret = -EBUSY;
         }
         priv->eeprom = NULL;
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index d4aee64fb5ea..27a49068d32d 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -431,6 +431,7 @@ static int p54p_open(struct ieee80211_hw *dev)
 {
         struct p54p_priv *priv = dev->priv;
         int err;
+        long timeout;
 
         init_completion(&priv->boot_comp);
         err = request_irq(priv->pdev->irq, p54p_interrupt,
@@ -468,10 +469,12 @@ static int p54p_open(struct ieee80211_hw *dev)
         P54P_WRITE(dev_int, cpu_to_le32(ISL38XX_DEV_INT_RESET));
         P54P_READ(dev_int);
 
-        if (!wait_for_completion_interruptible_timeout(&priv->boot_comp, HZ)) {
+        timeout = wait_for_completion_interruptible_timeout(
+                        &priv->boot_comp, HZ);
+        if (timeout <= 0) {
                 wiphy_err(dev->wiphy, "Cannot boot firmware!\n");
                 p54p_stop(dev);
-                return -ETIMEDOUT;
+                return timeout ? -ERESTARTSYS : -ETIMEDOUT;
         }
 
         P54P_WRITE(int_enable, cpu_to_le32(ISL38XX_INT_IDENT_UPDATE));
diff --git a/drivers/net/wireless/rt2x00/rt2x00config.c b/drivers/net/wireless/rt2x00/rt2x00config.c
index 1122dc44c9fd..48a2cad29477 100644
--- a/drivers/net/wireless/rt2x00/rt2x00config.c
+++ b/drivers/net/wireless/rt2x00/rt2x00config.c
@@ -240,7 +240,7 @@ void rt2x00lib_config(struct rt2x00_dev *rt2x00dev,
                 rt2x00dev->rf_channel = libconf.rf.channel;
         }
 
-        if (test_bit(REQUIRE_PS_AUTOWAKE, &rt2x00dev->cap_flags) &&
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_PS_AUTOWAKE) &&
             (ieee80211_flags & IEEE80211_CONF_CHANGE_PS))
                 cancel_delayed_work_sync(&rt2x00dev->autowakeup_work);
 
@@ -257,7 +257,7 @@ void rt2x00lib_config(struct rt2x00_dev *rt2x00dev,
                 rt2x00link_reset_tuner(rt2x00dev, false);
 
         if (test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags) &&
-            test_bit(REQUIRE_PS_AUTOWAKE, &rt2x00dev->cap_flags) &&
+            rt2x00_has_cap_flag(rt2x00dev, REQUIRE_PS_AUTOWAKE) &&
             (ieee80211_flags & IEEE80211_CONF_CHANGE_PS) &&
             (conf->flags & IEEE80211_CONF_PS)) {
                 beacon_diff = (long)jiffies - (long)rt2x00dev->last_beacon;
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 9967a1d9f0ec..5639ed816813 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -351,7 +351,7 @@ void rt2x00lib_txdone(struct queue_entry *entry,
         /*
          * Remove L2 padding which was added during
          */
-        if (test_bit(REQUIRE_L2PAD, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_L2PAD))
                 rt2x00queue_remove_l2pad(entry->skb, header_length);
 
         /*
@@ -460,7 +460,7 @@ void rt2x00lib_txdone(struct queue_entry *entry,
          * send the status report back.
          */
         if (!(skbdesc_flags & SKBDESC_NOT_MAC80211)) {
-                if (test_bit(REQUIRE_TASKLET_CONTEXT, &rt2x00dev->cap_flags))
+                if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_TASKLET_CONTEXT))
                         ieee80211_tx_status(rt2x00dev->hw, entry->skb);
                 else
                         ieee80211_tx_status_ni(rt2x00dev->hw, entry->skb);
@@ -1056,9 +1056,9 @@ static int rt2x00lib_probe_hw(struct rt2x00_dev *rt2x00dev)
         /*
          * Take TX headroom required for alignment into account.
          */
-        if (test_bit(REQUIRE_L2PAD, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_L2PAD))
                 rt2x00dev->hw->extra_tx_headroom += RT2X00_L2PAD_SIZE;
-        else if (test_bit(REQUIRE_DMA, &rt2x00dev->cap_flags))
+        else if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DMA))
                 rt2x00dev->hw->extra_tx_headroom += RT2X00_ALIGN_SIZE;
 
         /*
@@ -1069,7 +1069,7 @@ static int rt2x00lib_probe_hw(struct rt2x00_dev *rt2x00dev)
         /*
          * Allocate tx status FIFO for driver use.
          */
-        if (test_bit(REQUIRE_TXSTATUS_FIFO, &rt2x00dev->cap_flags)) {
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_TXSTATUS_FIFO)) {
                 /*
                  * Allocate the txstatus fifo. In the worst case the tx
                  * status fifo has to hold the tx status of all entries
@@ -1131,7 +1131,7 @@ static void rt2x00lib_uninitialize(struct rt2x00_dev *rt2x00dev)
         /*
          * Stop rfkill polling.
          */
-        if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DELAYED_RFKILL))
                 rt2x00rfkill_unregister(rt2x00dev);
 
         /*
@@ -1173,7 +1173,7 @@ static int rt2x00lib_initialize(struct rt2x00_dev *rt2x00dev)
         /*
          * Start rfkill polling.
          */
-        if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DELAYED_RFKILL))
                 rt2x00rfkill_register(rt2x00dev);
 
         return 0;
@@ -1389,7 +1389,7 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
         /*
          * Start rfkill polling.
          */
-        if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+        if (!rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DELAYED_RFKILL))
                 rt2x00rfkill_register(rt2x00dev);
 
         return 0;
@@ -1408,7 +1408,7 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
         /*
          * Stop rfkill polling.
          */
-        if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+        if (!rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DELAYED_RFKILL))
                 rt2x00rfkill_unregister(rt2x00dev);
 
         /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00firmware.c b/drivers/net/wireless/rt2x00/rt2x00firmware.c
index fbae2799e3ee..5813300f68a2 100644
--- a/drivers/net/wireless/rt2x00/rt2x00firmware.c
+++ b/drivers/net/wireless/rt2x00/rt2x00firmware.c
@@ -96,7 +96,7 @@ int rt2x00lib_load_firmware(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
 
-        if (!test_bit(REQUIRE_FIRMWARE, &rt2x00dev->cap_flags))
+        if (!rt2x00_has_cap_flag(rt2x00dev, REQUIRE_FIRMWARE))
                 return 0;
 
         if (!rt2x00dev->fw) {
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index cb40245a0695..300876df056f 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -119,7 +119,7 @@ void rt2x00mac_tx(struct ieee80211_hw *hw,
          * Use the ATIM queue if appropriate and present.
          */
         if (tx_info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM &&
-            test_bit(REQUIRE_ATIM_QUEUE, &rt2x00dev->cap_flags))
+            rt2x00_has_cap_flag(rt2x00dev, REQUIRE_ATIM_QUEUE))
                 qid = QID_ATIM;
 
         queue = rt2x00queue_get_tx_queue(rt2x00dev, qid);
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 66ff36447b94..68b620b2462f 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -85,7 +85,7 @@ struct sk_buff *rt2x00queue_alloc_rxskb(struct queue_entry *entry, gfp_t gfp)
         memset(skbdesc, 0, sizeof(*skbdesc));
         skbdesc->entry = entry;
 
-        if (test_bit(REQUIRE_DMA, &rt2x00dev->cap_flags)) {
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DMA)) {
                 dma_addr_t skb_dma;
 
                 skb_dma = dma_map_single(rt2x00dev->dev, skb->data, skb->len,
@@ -198,7 +198,7 @@ static void rt2x00queue_create_tx_descriptor_seq(struct rt2x00_dev *rt2x00dev,
 
         __set_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags);
 
-        if (!test_bit(REQUIRE_SW_SEQNO, &rt2x00dev->cap_flags)) {
+        if (!rt2x00_has_cap_flag(rt2x00dev, REQUIRE_SW_SEQNO)) {
                 /*
                  * rt2800 has a H/W (or F/W) bug, device incorrectly increase
                  * seqno on retransmited data (non-QOS) frames. To workaround
@@ -484,7 +484,7 @@ static void rt2x00queue_create_tx_descriptor(struct rt2x00_dev *rt2x00dev,
         rt2x00crypto_create_tx_descriptor(rt2x00dev, skb, txdesc);
         rt2x00queue_create_tx_descriptor_seq(rt2x00dev, skb, txdesc);
 
-        if (test_bit(REQUIRE_HT_TX_DESC, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_HT_TX_DESC))
                 rt2x00queue_create_tx_descriptor_ht(rt2x00dev, skb, txdesc,
                                                    sta, hwrate);
         else
@@ -526,7 +526,7 @@ static int rt2x00queue_write_tx_data(struct queue_entry *entry,
         /*
          * Map the skb to DMA.
          */
-        if (test_bit(REQUIRE_DMA, &rt2x00dev->cap_flags) &&
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DMA) &&
             rt2x00queue_map_txskb(entry))
                 return -ENOMEM;
 
@@ -646,7 +646,7 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
          */
         if (test_bit(ENTRY_TXD_ENCRYPT, &txdesc.flags) &&
             !test_bit(ENTRY_TXD_ENCRYPT_IV, &txdesc.flags)) {
-                if (test_bit(REQUIRE_COPY_IV, &queue->rt2x00dev->cap_flags))
+                if (rt2x00_has_cap_flag(queue->rt2x00dev, REQUIRE_COPY_IV))
                         rt2x00crypto_tx_copy_iv(skb, &txdesc);
                 else
                         rt2x00crypto_tx_remove_iv(skb, &txdesc);
@@ -660,9 +660,9 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
          * PCI and USB devices, while header alignment only is valid
          * for PCI devices.
          */
-        if (test_bit(REQUIRE_L2PAD, &queue->rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_flag(queue->rt2x00dev, REQUIRE_L2PAD))
                 rt2x00queue_insert_l2pad(skb, txdesc.header_length);
-        else if (test_bit(REQUIRE_DMA, &queue->rt2x00dev->cap_flags))
+        else if (rt2x00_has_cap_flag(queue->rt2x00dev, REQUIRE_DMA))
                 rt2x00queue_align_frame(skb);
 
         /*
@@ -1178,7 +1178,7 @@ int rt2x00queue_initialize(struct rt2x00_dev *rt2x00dev)
         if (status)
                 goto exit;
 
-        if (test_bit(REQUIRE_ATIM_QUEUE, &rt2x00dev->cap_flags)) {
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_ATIM_QUEUE)) {
                 status = rt2x00queue_alloc_entries(rt2x00dev->atim);
                 if (status)
                         goto exit;
@@ -1234,7 +1234,7 @@ int rt2x00queue_allocate(struct rt2x00_dev *rt2x00dev)
         struct data_queue *queue;
         enum data_queue_qid qid;
         unsigned int req_atim =
-            !!test_bit(REQUIRE_ATIM_QUEUE, &rt2x00dev->cap_flags);
+            rt2x00_has_cap_flag(rt2x00dev, REQUIRE_ATIM_QUEUE);
 
         /*
          * We need the following queues:
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index 892270dd3e7b..7627af6098eb 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -274,7 +274,7 @@ static void rt2x00usb_interrupt_txdone(struct urb *urb)
          * Schedule the delayed work for reading the TX status
          * from the device.
          */
-        if (!test_bit(REQUIRE_TXSTATUS_FIFO, &rt2x00dev->cap_flags) ||
+        if (!rt2x00_has_cap_flag(rt2x00dev, REQUIRE_TXSTATUS_FIFO) ||
             !kfifo_is_empty(&rt2x00dev->txstatus_fifo))
                 queue_work(rt2x00dev->workqueue, &rt2x00dev->txdone_work);
 }
@@ -456,7 +456,7 @@ static bool rt2x00usb_flush_entry(struct queue_entry *entry, void *data)
          * Kill guardian urb (if required by driver).
          */
         if ((entry->queue->qid == QID_BEACON) &&
-            (test_bit(REQUIRE_BEACON_GUARD, &rt2x00dev->cap_flags)))
+            (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_BEACON_GUARD)))
                 usb_kill_urb(bcn_priv->guardian_urb);
 
         return false;
@@ -655,7 +655,7 @@ static int rt2x00usb_alloc_entries(struct data_queue *queue)
          * then we are done.
          */
         if (queue->qid != QID_BEACON ||
-            !test_bit(REQUIRE_BEACON_GUARD, &rt2x00dev->cap_flags))
+            !rt2x00_has_cap_flag(rt2x00dev, REQUIRE_BEACON_GUARD))
                 return 0;
 
         for (i = 0; i < queue->limit; i++) {
@@ -690,7 +690,7 @@ static void rt2x00usb_free_entries(struct data_queue *queue)
          * then we are done.
          */
         if (queue->qid != QID_BEACON ||
-            !test_bit(REQUIRE_BEACON_GUARD, &rt2x00dev->cap_flags))
+            !rt2x00_has_cap_flag(rt2x00dev, REQUIRE_BEACON_GUARD))
                 return;
 
         for (i = 0; i < queue->limit; i++) {
diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c
index deab85236bfd..eb203163ed05 100644
--- a/drivers/net/wireless/rtlwifi/core.c
+++ b/drivers/net/wireless/rtlwifi/core.c
@@ -1871,3 +1871,40 @@ bool rtl_btc_status_false(void)
         return false;
 }
 EXPORT_SYMBOL_GPL(rtl_btc_status_false);
+
+void rtl_dm_diginit(struct ieee80211_hw *hw, u32 cur_igvalue)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct dig_t *dm_digtable = &rtlpriv->dm_digtable;
+
+        dm_digtable->dig_enable_flag = true;
+        dm_digtable->dig_ext_port_stage = DIG_EXT_PORT_STAGE_MAX;
+        dm_digtable->cur_igvalue = cur_igvalue;
+        dm_digtable->pre_igvalue = 0;
+        dm_digtable->cur_sta_cstate = DIG_STA_DISCONNECT;
+        dm_digtable->presta_cstate = DIG_STA_DISCONNECT;
+        dm_digtable->curmultista_cstate = DIG_MULTISTA_DISCONNECT;
+        dm_digtable->rssi_lowthresh = DM_DIG_THRESH_LOW;
+        dm_digtable->rssi_highthresh = DM_DIG_THRESH_HIGH;
+        dm_digtable->fa_lowthresh = DM_FALSEALARM_THRESH_LOW;
+        dm_digtable->fa_highthresh = DM_FALSEALARM_THRESH_HIGH;
+        dm_digtable->rx_gain_max = DM_DIG_MAX;
+        dm_digtable->rx_gain_min = DM_DIG_MIN;
+        dm_digtable->back_val = DM_DIG_BACKOFF_DEFAULT;
+        dm_digtable->back_range_max = DM_DIG_BACKOFF_MAX;
+        dm_digtable->back_range_min = DM_DIG_BACKOFF_MIN;
+        dm_digtable->pre_cck_cca_thres = 0xff;
+        dm_digtable->cur_cck_cca_thres = 0x83;
+        dm_digtable->forbidden_igi = DM_DIG_MIN;
+        dm_digtable->large_fa_hit = 0;
+        dm_digtable->recover_cnt = 0;
+        dm_digtable->dig_min_0 = 0x25;
+        dm_digtable->dig_min_1 = 0x25;
+        dm_digtable->media_connect_0 = false;
+        dm_digtable->media_connect_1 = false;
+        rtlpriv->dm.dm_initialgain_enable = true;
+        dm_digtable->bt30_cur_igi = 0x32;
+        dm_digtable->pre_cck_pd_state = CCK_PD_STAGE_MAX;
+        dm_digtable->cur_cck_pd_state = CCK_PD_STAGE_LOWRSSI;
+}
+EXPORT_SYMBOL(rtl_dm_diginit);
diff --git a/drivers/net/wireless/rtlwifi/core.h b/drivers/net/wireless/rtlwifi/core.h
index 8c87eb54be66..7b64e34f421e 100644
--- a/drivers/net/wireless/rtlwifi/core.h
+++ b/drivers/net/wireless/rtlwifi/core.h
@@ -35,6 +35,46 @@
 
 #define RTL_SUPPORTED_CTRL_FILTER       0xFF
 
+#define DM_DIG_THRESH_HIGH              40
+#define DM_DIG_THRESH_LOW               35
+#define DM_FALSEALARM_THRESH_LOW        400
+#define DM_FALSEALARM_THRESH_HIGH       1000
+
+#define DM_DIG_MAX                      0x3e
+#define DM_DIG_MIN                      0x1e
+#define DM_DIG_MAX_AP                   0x32
+#define DM_DIG_BACKOFF_MAX              12
+#define DM_DIG_BACKOFF_MIN              -4
+#define DM_DIG_BACKOFF_DEFAULT          10
+
+enum cck_packet_detection_threshold {
+        CCK_PD_STAGE_LOWRSSI = 0,
+        CCK_PD_STAGE_HIGHRSSI = 1,
+        CCK_FA_STAGE_LOW = 2,
+        CCK_FA_STAGE_HIGH = 3,
+        CCK_PD_STAGE_MAX = 4,
+};
+
+enum dm_dig_ext_port_alg_e {
+        DIG_EXT_PORT_STAGE_0 = 0,
+        DIG_EXT_PORT_STAGE_1 = 1,
+        DIG_EXT_PORT_STAGE_2 = 2,
+        DIG_EXT_PORT_STAGE_3 = 3,
+        DIG_EXT_PORT_STAGE_MAX = 4,
+};
+
+enum dm_dig_connect_e {
+        DIG_STA_DISCONNECT,
+        DIG_STA_CONNECT,
+        DIG_STA_BEFORE_CONNECT,
+        DIG_MULTISTA_DISCONNECT,
+        DIG_MULTISTA_CONNECT,
+        DIG_AP_DISCONNECT,
+        DIG_AP_CONNECT,
+        DIG_AP_ADD_STATION,
+        DIG_CONNECT_MAX
+};
+
 extern const struct ieee80211_ops rtl_ops;
 void rtl_fw_cb(const struct firmware *firmware, void *context);
 void rtl_wowlan_fw_cb(const struct firmware *firmware, void *context);
@@ -44,5 +84,6 @@ void rtl_rfreg_delay(struct ieee80211_hw *hw, enum radio_path rfpath, u32 addr,
 void rtl_bb_delay(struct ieee80211_hw *hw, u32 addr, u32 data);
 bool rtl_cmd_send_packet(struct ieee80211_hw *hw, struct sk_buff *skb);
 bool rtl_btc_status_false(void);
+void rtl_dm_diginit(struct ieee80211_hw *hw, u32 cur_igval);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c b/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c
index 2aa34d9055f0..d930c1f78721 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c
@@ -26,6 +26,7 @@
 #include "../wifi.h"
 #include "../base.h"
 #include "../pci.h"
+#include "../core.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -341,38 +342,6 @@ static void dm_tx_pwr_track_set_pwr(struct ieee80211_hw *hw,
         }
 }
 
-static void rtl88e_dm_diginit(struct ieee80211_hw *hw)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct dig_t *dm_dig = &rtlpriv->dm_digtable;
-
-        dm_dig->dig_enable_flag = true;
-        dm_dig->cur_igvalue = rtl_get_bbreg(hw, ROFDM0_XAAGCCORE1, 0x7f);
-        dm_dig->pre_igvalue = 0;
-        dm_dig->cur_sta_cstate = DIG_STA_DISCONNECT;
-        dm_dig->presta_cstate = DIG_STA_DISCONNECT;
-        dm_dig->curmultista_cstate = DIG_MULTISTA_DISCONNECT;
-        dm_dig->rssi_lowthresh = DM_DIG_THRESH_LOW;
-        dm_dig->rssi_highthresh = DM_DIG_THRESH_HIGH;
-        dm_dig->fa_lowthresh = DM_FALSEALARM_THRESH_LOW;
-        dm_dig->fa_highthresh = DM_FALSEALARM_THRESH_HIGH;
-        dm_dig->rx_gain_max = DM_DIG_MAX;
-        dm_dig->rx_gain_min = DM_DIG_MIN;
-        dm_dig->back_val = DM_DIG_BACKOFF_DEFAULT;
-        dm_dig->back_range_max = DM_DIG_BACKOFF_MAX;
-        dm_dig->back_range_min = DM_DIG_BACKOFF_MIN;
-        dm_dig->pre_cck_cca_thres = 0xff;
-        dm_dig->cur_cck_cca_thres = 0x83;
-        dm_dig->forbidden_igi = DM_DIG_MIN;
-        dm_dig->large_fa_hit = 0;
-        dm_dig->recover_cnt = 0;
-        dm_dig->dig_min_0 = 0x25;
-        dm_dig->dig_min_1 = 0x25;
-        dm_dig->media_connect_0 = false;
-        dm_dig->media_connect_1 = false;
-        rtlpriv->dm.dm_initialgain_enable = true;
-}
-
 static u8 rtl88e_dm_initial_gain_min_pwdb(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -1796,9 +1765,10 @@ static void rtl88e_dm_antenna_diversity(struct ieee80211_hw *hw)
 void rtl88e_dm_init(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u32 cur_igvalue = rtl_get_bbreg(hw, ROFDM0_XAAGCCORE1, 0x7f);
 
         rtlpriv->dm.dm_type = DM_TYPE_BYDRIVER;
-        rtl88e_dm_diginit(hw);
+        rtl_dm_diginit(hw, cur_igvalue);
         rtl88e_dm_init_dynamic_txpower(hw);
         rtl88e_dm_init_edca_turbo(hw);
         rtl88e_dm_init_rate_adaptive_mask(hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/dm.h b/drivers/net/wireless/rtlwifi/rtl8188ee/dm.h
index 64f1f3ea9807..071ccee69eae 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/dm.h
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/dm.h
@@ -186,28 +186,12 @@
 #define BW_AUTO_SWITCH_HIGH_LOW                         25
 #define BW_AUTO_SWITCH_LOW_HIGH                         30
 
-#define DM_DIG_THRESH_HIGH                              40
-#define DM_DIG_THRESH_LOW                               35
-
-#define DM_FALSEALARM_THRESH_LOW                        400
-#define DM_FALSEALARM_THRESH_HIGH                       1000
-
-#define DM_DIG_MAX                                      0x3e
-#define DM_DIG_MIN                                      0x1e
-
-#define DM_DIG_MAX_AP                                   0x32
-#define DM_DIG_MIN_AP                                   0x20
-
 #define DM_DIG_FA_UPPER                                 0x3e
 #define DM_DIG_FA_LOWER                                 0x1e
 #define DM_DIG_FA_TH0                                   0x200
 #define DM_DIG_FA_TH1                                   0x300
 #define DM_DIG_FA_TH2                                   0x400
 
-#define DM_DIG_BACKOFF_MAX                              12
-#define DM_DIG_BACKOFF_MIN                              -4
-#define DM_DIG_BACKOFF_DEFAULT                          10
-
 #define RXPATHSELECTION_SS_TH_W                         30
 #define RXPATHSELECTION_DIFF_TH                         18
 
@@ -262,14 +246,6 @@ enum tag_dynamic_init_gain_operation_type_definition {
         DIG_OP_TYPE_MAX
 };
 
-enum tag_cck_packet_detection_threshold_type_definition {
-        CCK_PD_STAGE_LOWRSSI = 0,
-        CCK_PD_STAGE_HIGHRSSI = 1,
-        CCK_FA_STAGE_LOW = 2,
-        CCK_FA_STAGE_HIGH = 3,
-        CCK_PD_STAGE_MAX = 4,
-};
-
 enum dm_1r_cca_e {
         CCA_1R = 0,
         CCA_2R = 1,
@@ -288,23 +264,6 @@ enum dm_sw_ant_switch_e {
         ANS_ANTENNA_MAX = 3,
 };
 
-enum dm_dig_ext_port_alg_e {
-        DIG_EXT_PORT_STAGE_0 = 0,
-        DIG_EXT_PORT_STAGE_1 = 1,
-        DIG_EXT_PORT_STAGE_2 = 2,
-        DIG_EXT_PORT_STAGE_3 = 3,
-        DIG_EXT_PORT_STAGE_MAX = 4,
-};
-
-enum dm_dig_connect_e {
-        DIG_STA_DISCONNECT = 0,
-        DIG_STA_CONNECT = 1,
-        DIG_STA_BEFORE_CONNECT = 2,
-        DIG_MULTISTA_DISCONNECT = 3,
-        DIG_MULTISTA_CONNECT = 4,
-        DIG_CONNECT_MAX
-};
-
 enum pwr_track_control_method {
         BBSWING,
         TXAGC
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
index f6cb5aedfdd1..f5ee67cda73a 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
@@ -32,6 +32,7 @@
 #include "phy_common.h"
 #include "../pci.h"
 #include "../base.h"
+#include "../core.h"
 
 #define BT_RSSI_STATE_NORMAL_POWER      BIT_OFFSET_LEN_MASK_32(0, 1)
 #define BT_RSSI_STATE_AMDPU_OFF         BIT_OFFSET_LEN_MASK_32(1, 1)
@@ -194,36 +195,6 @@ void dm_savepowerindex(struct ieee80211_hw *hw)
 }
 EXPORT_SYMBOL_GPL(dm_savepowerindex);
 
-static void rtl92c_dm_diginit(struct ieee80211_hw *hw)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct dig_t *dm_digtable = &rtlpriv->dm_digtable;
-
-        dm_digtable->dig_enable_flag = true;
-        dm_digtable->dig_ext_port_stage = DIG_EXT_PORT_STAGE_MAX;
-        dm_digtable->cur_igvalue = 0x20;
-        dm_digtable->pre_igvalue = 0x0;
-        dm_digtable->cursta_cstate = DIG_STA_DISCONNECT;
-        dm_digtable->presta_cstate = DIG_STA_DISCONNECT;
-        dm_digtable->curmultista_cstate = DIG_MULTISTA_DISCONNECT;
-        dm_digtable->rssi_lowthresh = DM_DIG_THRESH_LOW;
-        dm_digtable->rssi_highthresh = DM_DIG_THRESH_HIGH;
-        dm_digtable->fa_lowthresh = DM_FALSEALARM_THRESH_LOW;
-        dm_digtable->fa_highthresh = DM_FALSEALARM_THRESH_HIGH;
-        dm_digtable->rx_gain_max = DM_DIG_MAX;
-        dm_digtable->rx_gain_min = DM_DIG_MIN;
-        dm_digtable->back_val = DM_DIG_BACKOFF_DEFAULT;
-        dm_digtable->back_range_max = DM_DIG_BACKOFF_MAX;
-        dm_digtable->back_range_min = DM_DIG_BACKOFF_MIN;
-        dm_digtable->pre_cck_pd_state = CCK_PD_STAGE_MAX;
-        dm_digtable->cur_cck_pd_state = CCK_PD_STAGE_LowRssi;
-
-        dm_digtable->forbidden_igi = DM_DIG_MIN;
-        dm_digtable->large_fa_hit = 0;
-        dm_digtable->recover_cnt = 0;
-        dm_digtable->dig_dynamic_min  = 0x25;
-}
-
 static u8 rtl92c_dm_initial_gain_min_pwdb(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -507,27 +478,27 @@ static void rtl92c_dm_cck_packet_detection_thresh(struct ieee80211_hw *hw)
                 if (dm_digtable->rssi_val_min > 100)
                         dm_digtable->rssi_val_min = 100;
 
-                if (dm_digtable->pre_cck_pd_state == CCK_PD_STAGE_LowRssi) {
+                if (dm_digtable->pre_cck_pd_state == CCK_PD_STAGE_LOWRSSI) {
                         if (dm_digtable->rssi_val_min <= 25)
                                 dm_digtable->cur_cck_pd_state =
-                                    CCK_PD_STAGE_LowRssi;
+                                    CCK_PD_STAGE_LOWRSSI;
                         else
                                 dm_digtable->cur_cck_pd_state =
-                                    CCK_PD_STAGE_HighRssi;
+                                    CCK_PD_STAGE_HIGHRSSI;
                 } else {
                         if (dm_digtable->rssi_val_min <= 20)
                                 dm_digtable->cur_cck_pd_state =
-                                    CCK_PD_STAGE_LowRssi;
+                                    CCK_PD_STAGE_LOWRSSI;
                         else
                                 dm_digtable->cur_cck_pd_state =
-                                    CCK_PD_STAGE_HighRssi;
+                                    CCK_PD_STAGE_HIGHRSSI;
                 }
         } else {
                 dm_digtable->cur_cck_pd_state = CCK_PD_STAGE_MAX;
         }
 
         if (dm_digtable->pre_cck_pd_state != dm_digtable->cur_cck_pd_state) {
-                if ((dm_digtable->cur_cck_pd_state == CCK_PD_STAGE_LowRssi) ||
+                if ((dm_digtable->cur_cck_pd_state == CCK_PD_STAGE_LOWRSSI) ||
                     (dm_digtable->cur_cck_pd_state == CCK_PD_STAGE_MAX))
                         rtl_set_bbreg(hw, RCCK0_CCA, MASKBYTE2, 0x83);
                 else
@@ -1374,7 +1345,7 @@ void rtl92c_dm_init(struct ieee80211_hw *hw)
         rtlpriv->dm.undec_sm_pwdb = -1;
         rtlpriv->dm.undec_sm_cck = -1;
         rtlpriv->dm.dm_initialgain_enable = true;
-        rtl92c_dm_diginit(hw);
+        rtl_dm_diginit(hw, 0x20);
 
         rtlpriv->dm.dm_flag |= HAL_DM_HIPWR_DISABLE;
         rtl92c_dm_init_dynamic_txpower(hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h
index 4f232a063636..4422e31fedd9 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h
@@ -47,25 +47,12 @@
 #define BW_AUTO_SWITCH_HIGH_LOW                 25
 #define BW_AUTO_SWITCH_LOW_HIGH                 30
 
-#define DM_DIG_THRESH_HIGH                      40
-#define DM_DIG_THRESH_LOW                       35
-
-#define DM_FALSEALARM_THRESH_LOW                400
-#define DM_FALSEALARM_THRESH_HIGH               1000
-
-#define DM_DIG_MAX                              0x3e
-#define DM_DIG_MIN                              0x1e
-
 #define DM_DIG_FA_UPPER                         0x32
 #define DM_DIG_FA_LOWER                         0x20
 #define DM_DIG_FA_TH0                           0x20
 #define DM_DIG_FA_TH1                           0x100
 #define DM_DIG_FA_TH2                           0x200
 
-#define DM_DIG_BACKOFF_MAX                      12
-#define DM_DIG_BACKOFF_MIN                      -4
-#define DM_DIG_BACKOFF_DEFAULT                  10
-
 #define RXPATHSELECTION_SS_TH_lOW               30
 #define RXPATHSELECTION_DIFF_TH                 18
 
@@ -123,14 +110,6 @@ enum tag_dynamic_init_gain_operation_type_definition {
         DIG_OP_TYPE_MAX
 };
 
-enum tag_cck_packet_detection_threshold_type_definition {
-        CCK_PD_STAGE_LowRssi = 0,
-        CCK_PD_STAGE_HighRssi = 1,
-        CCK_FA_STAGE_Low = 2,
-        CCK_FA_STAGE_High = 3,
-        CCK_PD_STAGE_MAX = 4,
-};
-
 enum dm_1r_cca_e {
         CCA_1R = 0,
         CCA_2R = 1,
@@ -149,23 +128,6 @@ enum dm_sw_ant_switch_e {
         ANS_ANTENNA_MAX = 3,
 };
 
-enum dm_dig_ext_port_alg_e {
-        DIG_EXT_PORT_STAGE_0 = 0,
-        DIG_EXT_PORT_STAGE_1 = 1,
-        DIG_EXT_PORT_STAGE_2 = 2,
-        DIG_EXT_PORT_STAGE_3 = 3,
-        DIG_EXT_PORT_STAGE_MAX = 4,
-};
-
-enum dm_dig_connect_e {
-        DIG_STA_DISCONNECT = 0,
-        DIG_STA_CONNECT = 1,
-        DIG_STA_BEFORE_CONNECT = 2,
-        DIG_MULTISTA_DISCONNECT = 3,
-        DIG_MULTISTA_CONNECT = 4,
-        DIG_CONNECT_MAX
-};
-
 void rtl92c_dm_init(struct ieee80211_hw *hw);
 void rtl92c_dm_watchdog(struct ieee80211_hw *hw);
 void rtl92c_dm_write_dig(struct ieee80211_hw *hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/dm.c b/drivers/net/wireless/rtlwifi/rtl8192ce/dm.c
index 74f9c083b80d..09898cf2e07a 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/dm.c
@@ -30,6 +30,7 @@
 #include "../wifi.h"
 #include "../base.h"
 #include "../pci.h"
+#include "../core.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/dm.h b/drivers/net/wireless/rtlwifi/rtl8192ce/dm.h
index 9c5311c299fd..38ba707015f5 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/dm.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/dm.h
@@ -42,25 +42,12 @@
 #define BW_AUTO_SWITCH_HIGH_LOW                 25
 #define BW_AUTO_SWITCH_LOW_HIGH                 30
 
-#define DM_DIG_THRESH_HIGH                      40
-#define DM_DIG_THRESH_LOW                       35
-
-#define DM_FALSEALARM_THRESH_LOW                400
-#define DM_FALSEALARM_THRESH_HIGH               1000
-
-#define DM_DIG_MAX                              0x3e
-#define DM_DIG_MIN                              0x1e
-
 #define DM_DIG_FA_UPPER                         0x32
 #define DM_DIG_FA_LOWER                         0x20
 #define DM_DIG_FA_TH0                           0x20
 #define DM_DIG_FA_TH1                           0x100
 #define DM_DIG_FA_TH2                           0x200
 
-#define DM_DIG_BACKOFF_MAX                      12
-#define DM_DIG_BACKOFF_MIN                      -4
-#define DM_DIG_BACKOFF_DEFAULT                  10
-
 #define RXPATHSELECTION_SS_TH_lOW               30
 #define RXPATHSELECTION_DIFF_TH                 18
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/dm.c b/drivers/net/wireless/rtlwifi/rtl8192de/dm.c
index 304c443b89b2..a1be5a68edfb 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/dm.c
@@ -29,6 +29,7 @@
 
 #include "../wifi.h"
 #include "../base.h"
+#include "../core.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -155,34 +156,6 @@ static const u8 cckswing_table_ch14[CCK_TABLE_SIZE][8] = {
         {0x09, 0x08, 0x07, 0x04, 0x00, 0x00, 0x00, 0x00}     /* 32, -16.0dB */
 };
 
-static void rtl92d_dm_diginit(struct ieee80211_hw *hw)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct dig_t *de_digtable = &rtlpriv->dm_digtable;
-
-        de_digtable->dig_enable_flag = true;
-        de_digtable->dig_ext_port_stage = DIG_EXT_PORT_STAGE_MAX;
-        de_digtable->cur_igvalue = 0x20;
-        de_digtable->pre_igvalue = 0x0;
-        de_digtable->cursta_cstate = DIG_STA_DISCONNECT;
-        de_digtable->presta_cstate = DIG_STA_DISCONNECT;
-        de_digtable->curmultista_cstate = DIG_MULTISTA_DISCONNECT;
-        de_digtable->rssi_lowthresh = DM_DIG_THRESH_LOW;
-        de_digtable->rssi_highthresh = DM_DIG_THRESH_HIGH;
-        de_digtable->fa_lowthresh = DM_FALSEALARM_THRESH_LOW;
-        de_digtable->fa_highthresh = DM_FALSEALARM_THRESH_HIGH;
-        de_digtable->rx_gain_max = DM_DIG_FA_UPPER;
-        de_digtable->rx_gain_min = DM_DIG_FA_LOWER;
-        de_digtable->back_val = DM_DIG_BACKOFF_DEFAULT;
-        de_digtable->back_range_max = DM_DIG_BACKOFF_MAX;
-        de_digtable->back_range_min = DM_DIG_BACKOFF_MIN;
-        de_digtable->pre_cck_pd_state = CCK_PD_STAGE_LOWRSSI;
-        de_digtable->cur_cck_pd_state = CCK_PD_STAGE_MAX;
-        de_digtable->large_fa_hit = 0;
-        de_digtable->recover_cnt = 0;
-        de_digtable->forbidden_igi = DM_DIG_FA_LOWER;
-}
-
 static void rtl92d_dm_false_alarm_counter_statistics(struct ieee80211_hw *hw)
 {
         u32 ret_value;
@@ -1305,7 +1278,9 @@ void rtl92d_dm_init(struct ieee80211_hw *hw)
         struct rtl_priv *rtlpriv = rtl_priv(hw);
 
         rtlpriv->dm.dm_type = DM_TYPE_BYDRIVER;
-        rtl92d_dm_diginit(hw);
+        rtl_dm_diginit(hw, 0x20);
+        rtlpriv->dm_digtable.rx_gain_max = DM_DIG_FA_UPPER;
+        rtlpriv->dm_digtable.rx_gain_min = DM_DIG_FA_LOWER;
         rtl92d_dm_init_dynamic_txpower(hw);
         rtl92d_dm_init_edca_turbo(hw);
         rtl92d_dm_init_rate_adaptive_mask(hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/dm.h b/drivers/net/wireless/rtlwifi/rtl8192de/dm.h
index 3fea0c11c24a..f2d318ceeb28 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/dm.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/dm.h
@@ -42,25 +42,12 @@
 #define BW_AUTO_SWITCH_HIGH_LOW                 25
 #define BW_AUTO_SWITCH_LOW_HIGH                 30
 
-#define DM_DIG_THRESH_HIGH                      40
-#define DM_DIG_THRESH_LOW                       35
-
-#define DM_FALSEALARM_THRESH_LOW                400
-#define DM_FALSEALARM_THRESH_HIGH               1000
-
-#define DM_DIG_MAX                              0x3e
-#define DM_DIG_MIN                              0x1c
-
 #define DM_DIG_FA_UPPER                         0x32
 #define DM_DIG_FA_LOWER                         0x20
 #define DM_DIG_FA_TH0                           0x100
 #define DM_DIG_FA_TH1                           0x400
 #define DM_DIG_FA_TH2                           0x600
 
-#define DM_DIG_BACKOFF_MAX                      12
-#define DM_DIG_BACKOFF_MIN                      -4
-#define DM_DIG_BACKOFF_DEFAULT                  10
-
 #define RXPATHSELECTION_SS_TH_lOW               30
 #define RXPATHSELECTION_DIFF_TH                 18
 
@@ -108,14 +95,6 @@ enum tag_dynamic_init_gain_operation_type_definition {
         DIG_OP_TYPE_MAX
 };
 
-enum tag_cck_packet_detection_threshold_type_definition {
-        CCK_PD_STAGE_LOWRSSI = 0,
-        CCK_PD_STAGE_HIGHRSSI = 1,
-        CCK_FA_STAGE_LOW = 2,
-        CCK_FA_STAGE_HIGH = 3,
-        CCK_PD_STAGE_MAX = 4,
-};
-
 enum dm_1r_cca {
         CCA_1R = 0,
         CCA_2R = 1,
@@ -134,23 +113,6 @@ enum dm_sw_ant_switch {
         ANS_ANTENNA_MAX = 3,
 };
 
-enum dm_dig_ext_port_alg {
-        DIG_EXT_PORT_STAGE_0 = 0,
-        DIG_EXT_PORT_STAGE_1 = 1,
-        DIG_EXT_PORT_STAGE_2 = 2,
-        DIG_EXT_PORT_STAGE_3 = 3,
-        DIG_EXT_PORT_STAGE_MAX = 4,
-};
-
-enum dm_dig_connect {
-        DIG_STA_DISCONNECT = 0,
-        DIG_STA_CONNECT = 1,
-        DIG_STA_BEFORE_CONNECT = 2,
-        DIG_MULTISTA_DISCONNECT = 3,
-        DIG_MULTISTA_CONNECT = 4,
-        DIG_CONNECT_MAX
-};
-
 void rtl92d_dm_init(struct ieee80211_hw *hw);
 void rtl92d_dm_watchdog(struct ieee80211_hw *hw);
 void rtl92d_dm_init_edca_turbo(struct ieee80211_hw *hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/hw.c b/drivers/net/wireless/rtlwifi/rtl8192de/hw.c
index 280c3da42993..01bcc2d218dc 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/hw.c
@@ -546,7 +546,7 @@ static bool _rtl92de_llt_table_init(struct ieee80211_hw *hw)
                 txpktbuf_bndy = 246;
                 value8 = 0;
                 value32 = 0x80bf0d29;
-        } else if (rtlpriv->rtlhal.macphymode != SINGLEMAC_SINGLEPHY) {
+        } else {
                 maxPage = 127;
                 txpktbuf_bndy = 123;
                 value8 = 0;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/dm.c b/drivers/net/wireless/rtlwifi/rtl8192ee/dm.c
index 77deedf79d1d..459f3d0efa2f 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ee/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ee/dm.c
@@ -26,6 +26,7 @@
 #include "../wifi.h"
 #include "../base.h"
 #include "../pci.h"
+#include "../core.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -151,35 +152,6 @@ static const u8 cckswing_table_ch14[CCK_TABLE_SIZE][8] = {
         {0x09, 0x08, 0x07, 0x04, 0x00, 0x00, 0x00, 0x00}  /* 32, -16.0dB */
 };
 
-static void rtl92ee_dm_diginit(struct ieee80211_hw *hw)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct dig_t *dm_dig = &rtlpriv->dm_digtable;
-
-        dm_dig->cur_igvalue = rtl_get_bbreg(hw, DM_REG_IGI_A_11N,
-                                            DM_BIT_IGI_11N);
-        dm_dig->rssi_lowthresh = DM_DIG_THRESH_LOW;
-        dm_dig->rssi_highthresh = DM_DIG_THRESH_HIGH;
-        dm_dig->fa_lowthresh = DM_FALSEALARM_THRESH_LOW;
-        dm_dig->fa_highthresh = DM_FALSEALARM_THRESH_HIGH;
-        dm_dig->rx_gain_max = DM_DIG_MAX;
-        dm_dig->rx_gain_min = DM_DIG_MIN;
-        dm_dig->back_val = DM_DIG_BACKOFF_DEFAULT;
-        dm_dig->back_range_max = DM_DIG_BACKOFF_MAX;
-        dm_dig->back_range_min = DM_DIG_BACKOFF_MIN;
-        dm_dig->pre_cck_cca_thres = 0xff;
-        dm_dig->cur_cck_cca_thres = 0x83;
-        dm_dig->forbidden_igi = DM_DIG_MIN;
-        dm_dig->large_fa_hit = 0;
-        dm_dig->recover_cnt = 0;
-        dm_dig->dig_dynamic_min = DM_DIG_MIN;
-        dm_dig->dig_dynamic_min_1 = DM_DIG_MIN;
-        dm_dig->media_connect_0 = false;
-        dm_dig->media_connect_1 = false;
-        rtlpriv->dm.dm_initialgain_enable = true;
-        dm_dig->bt30_cur_igi = 0x32;
-}
-
 static void rtl92ee_dm_false_alarm_counter_statistics(struct ieee80211_hw *hw)
 {
         u32 ret_value;
@@ -298,7 +270,7 @@ static void rtl92ee_dm_dig(struct ieee80211_hw *hw)
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
         struct dig_t *dm_dig = &rtlpriv->dm_digtable;
-        u8 dig_dynamic_min , dig_maxofmin;
+        u8 dig_min_0, dig_maxofmin;
         bool bfirstconnect , bfirstdisconnect;
         u8 dm_dig_max, dm_dig_min;
         u8 current_igi = dm_dig->cur_igvalue;
@@ -308,7 +280,7 @@ static void rtl92ee_dm_dig(struct ieee80211_hw *hw)
         if (mac->act_scanning)
                 return;
 
-        dig_dynamic_min = dm_dig->dig_dynamic_min;
+        dig_min_0 = dm_dig->dig_min_0;
         bfirstconnect = (mac->link_state >= MAC80211_LINKED) &&
                         !dm_dig->media_connect_0;
         bfirstdisconnect = (mac->link_state < MAC80211_LINKED) &&
@@ -329,19 +301,19 @@ static void rtl92ee_dm_dig(struct ieee80211_hw *hw)
                 if (rtlpriv->dm.one_entry_only) {
                         offset = 0;
                         if (dm_dig->rssi_val_min - offset < dm_dig_min)
-                                dig_dynamic_min = dm_dig_min;
+                                dig_min_0 = dm_dig_min;
                         else if (dm_dig->rssi_val_min - offset >
                                  dig_maxofmin)
-                                dig_dynamic_min = dig_maxofmin;
+                                dig_min_0 = dig_maxofmin;
                         else
-                                dig_dynamic_min = dm_dig->rssi_val_min - offset;
+                                dig_min_0 = dm_dig->rssi_val_min - offset;
                 } else {
-                        dig_dynamic_min = dm_dig_min;
+                        dig_min_0 = dm_dig_min;
                 }
 
         } else {
                 dm_dig->rx_gain_max = dm_dig_max;
-                dig_dynamic_min = dm_dig_min;
+                dig_min_0 = dm_dig_min;
                 RT_TRACE(rtlpriv, COMP_DIG, DBG_LOUD, "no link\n");
         }
 
@@ -368,10 +340,10 @@ static void rtl92ee_dm_dig(struct ieee80211_hw *hw)
                 } else {
                         if (dm_dig->large_fa_hit < 3) {
                                 if ((dm_dig->forbidden_igi - 1) <
-                                    dig_dynamic_min) {
-                                        dm_dig->forbidden_igi = dig_dynamic_min;
+                                    dig_min_0) {
+                                        dm_dig->forbidden_igi = dig_min_0;
                                         dm_dig->rx_gain_min =
-                                                                dig_dynamic_min;
+                                                                dig_min_0;
                                 } else {
                                         dm_dig->forbidden_igi--;
                                         dm_dig->rx_gain_min =
@@ -430,7 +402,7 @@ static void rtl92ee_dm_dig(struct ieee80211_hw *hw)
         rtl92ee_dm_write_dig(hw , current_igi);
         dm_dig->media_connect_0 = ((mac->link_state >= MAC80211_LINKED) ?
                                    true : false);
-        dm_dig->dig_dynamic_min = dig_dynamic_min;
+        dm_dig->dig_min_0 = dig_min_0;
 }
 
 void rtl92ee_dm_write_cck_cca_thres(struct ieee80211_hw *hw, u8 cur_thres)
@@ -1088,10 +1060,11 @@ static void rtl92ee_dm_init_dynamic_atc_switch(struct ieee80211_hw *hw)
 void rtl92ee_dm_init(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u32 cur_igvalue = rtl_get_bbreg(hw, DM_REG_IGI_A_11N, DM_BIT_IGI_11N);
 
         rtlpriv->dm.dm_type = DM_TYPE_BYDRIVER;
 
-        rtl92ee_dm_diginit(hw);
+        rtl_dm_diginit(hw, cur_igvalue);
         rtl92ee_dm_init_rate_adaptive_mask(hw);
         rtl92ee_dm_init_primary_cca_check(hw);
         rtl92ee_dm_init_edca_turbo(hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/dm.h b/drivers/net/wireless/rtlwifi/rtl8192ee/dm.h
index 881db7d6fef7..107d5a488fa8 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ee/dm.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ee/dm.h
@@ -189,28 +189,12 @@
 #define BW_AUTO_SWITCH_HIGH_LOW                 25
 #define BW_AUTO_SWITCH_LOW_HIGH                 30
 
-#define DM_DIG_THRESH_HIGH                      40
-#define DM_DIG_THRESH_LOW                       35
-
-#define DM_FALSEALARM_THRESH_LOW                400
-#define DM_FALSEALARM_THRESH_HIGH               1000
-
-#define DM_DIG_MAX                              0x3e
-#define DM_DIG_MIN                              0x1e
-
-#define DM_DIG_MAX_AP                           0x32
-#define DM_DIG_MIN_AP                           0x20
-
 #define DM_DIG_FA_UPPER                         0x3e
 #define DM_DIG_FA_LOWER                         0x1e
 #define DM_DIG_FA_TH0                           0x200
 #define DM_DIG_FA_TH1                           0x300
 #define DM_DIG_FA_TH2                           0x400
 
-#define DM_DIG_BACKOFF_MAX                      12
-#define DM_DIG_BACKOFF_MIN                      -4
-#define DM_DIG_BACKOFF_DEFAULT                  10
-
 #define RXPATHSELECTION_SS_TH_LOW               30
 #define RXPATHSELECTION_DIFF_TH                 18
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/dm.c b/drivers/net/wireless/rtlwifi/rtl8192se/dm.c
index b3a2d5ec59e6..575980b88658 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/dm.c
@@ -29,6 +29,7 @@
 
 #include "../wifi.h"
 #include "../base.h"
+#include "../core.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -469,7 +470,7 @@ static void _rtl92s_dm_initial_gain_sta_beforeconnect(struct ieee80211_hw *hw)
                         if (digtable->backoff_enable_flag)
                                 rtl92s_backoff_enable_flag(hw);
                         else
-                                digtable->back_val = DM_DIG_BACKOFF;
+                                digtable->back_val = DM_DIG_BACKOFF_MAX;
 
                         if ((digtable->rssi_val + 10 - digtable->back_val) >
                                 digtable->rx_gain_max)
@@ -503,7 +504,7 @@ static void _rtl92s_dm_initial_gain_sta_beforeconnect(struct ieee80211_hw *hw)
                 digtable->dig_ext_port_stage = DIG_EXT_PORT_STAGE_MAX;
                 rtl92s_phy_set_fw_cmd(hw, FW_CMD_DIG_ENABLE);
 
-                digtable->back_val = DM_DIG_BACKOFF;
+                digtable->back_val = DM_DIG_BACKOFF_MAX;
                 digtable->cur_igvalue = rtlpriv->phy.default_initialgain[0];
                 digtable->pre_igvalue = 0;
                 return;
@@ -691,7 +692,7 @@ static void _rtl92s_dm_init_dig(struct ieee80211_hw *hw)
 
         /* for dig debug rssi value */
         digtable->rssi_val = 50;
-        digtable->back_val = DM_DIG_BACKOFF;
+        digtable->back_val = DM_DIG_BACKOFF_MAX;
         digtable->rx_gain_max = DM_DIG_MAX;
 
         digtable->rx_gain_min = DM_DIG_MIN;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/dm.h b/drivers/net/wireless/rtlwifi/rtl8192se/dm.h
index 2e9052c8fe4b..de6ac796c74d 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/dm.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/dm.h
@@ -54,24 +54,6 @@ enum dm_dig_sta {
         DM_STA_DIG_MAX
 };
 
-enum dm_dig_connect {
-        DIG_STA_DISCONNECT = 0,
-        DIG_STA_CONNECT = 1,
-        DIG_STA_BEFORE_CONNECT = 2,
-        DIG_AP_DISCONNECT = 3,
-        DIG_AP_CONNECT = 4,
-        DIG_AP_ADD_STATION = 5,
-        DIG_CONNECT_MAX
-};
-
-enum dm_dig_ext_port_alg {
-        DIG_EXT_PORT_STAGE_0 = 0,
-        DIG_EXT_PORT_STAGE_1 = 1,
-        DIG_EXT_PORT_STAGE_2 = 2,
-        DIG_EXT_PORT_STAGE_3 = 3,
-        DIG_EXT_PORT_STAGE_MAX = 4,
-};
-
 enum dm_ratr_sta {
         DM_RATR_STA_HIGH = 0,
         DM_RATR_STA_MIDDLEHIGH = 1,
@@ -99,22 +81,12 @@ enum dm_ratr_sta {
 #define TX_POWER_NEAR_FIELD_THRESH_LVL2 74
 #define TX_POWER_NEAR_FIELD_THRESH_LVL1 67
 
-#define DM_DIG_THRESH_HIGH              40
-#define DM_DIG_THRESH_LOW               35
-#define DM_FALSEALARM_THRESH_LOW        40
-#define DM_FALSEALARM_THRESH_HIGH       1000
 #define DM_DIG_HIGH_PWR_THRESH_HIGH     75
 #define DM_DIG_HIGH_PWR_THRESH_LOW      70
-#define DM_DIG_BACKOFF                  12
-#define DM_DIG_MAX                      0x3e
-#define DM_DIG_MIN                      0x1c
 #define DM_DIG_MIN_Netcore              0x12
-#define DM_DIG_BACKOFF_MAX              12
-#define DM_DIG_BACKOFF_MIN              -4
 
 void rtl92s_dm_watchdog(struct ieee80211_hw *hw);
 void rtl92s_dm_init(struct ieee80211_hw *hw);
 void rtl92s_dm_init_edca_turbo(struct ieee80211_hw *hw);
 
 #endif
-
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/dm.c b/drivers/net/wireless/rtlwifi/rtl8723ae/dm.c
index a0e86922780a..4c1c96c96a5a 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/dm.c
@@ -26,6 +26,7 @@
 #include "../wifi.h"
 #include "../base.h"
 #include "../pci.h"
+#include "../core.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -146,31 +147,6 @@ static const u8 cckswing_table_ch14[CCK_TABLE_SIZE][8] = {
         {0x09, 0x08, 0x07, 0x04, 0x00, 0x00, 0x00, 0x00}
 };
 
-static void rtl8723e_dm_diginit(struct ieee80211_hw *hw)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct dig_t *dm_digtable = &rtlpriv->dm_digtable;
-
-        dm_digtable->dig_enable_flag = true;
-        dm_digtable->dig_ext_port_stage = DIG_EXT_PORT_STAGE_MAX;
-        dm_digtable->cur_igvalue = 0x20;
-        dm_digtable->pre_igvalue = 0x0;
-        dm_digtable->cursta_cstate = DIG_STA_DISCONNECT;
-        dm_digtable->presta_cstate = DIG_STA_DISCONNECT;
-        dm_digtable->curmultista_cstate = DIG_MULTISTA_DISCONNECT;
-        dm_digtable->rssi_lowthresh = DM_DIG_THRESH_LOW;
-        dm_digtable->rssi_highthresh = DM_DIG_THRESH_HIGH;
-        dm_digtable->fa_lowthresh = DM_FALSEALARM_THRESH_LOW;
-        dm_digtable->fa_highthresh = DM_FALSEALARM_THRESH_HIGH;
-        dm_digtable->rx_gain_max = DM_DIG_MAX;
-        dm_digtable->rx_gain_min = DM_DIG_MIN;
-        dm_digtable->back_val = DM_DIG_BACKOFF_DEFAULT;
-        dm_digtable->back_range_max = DM_DIG_BACKOFF_MAX;
-        dm_digtable->back_range_min = DM_DIG_BACKOFF_MIN;
-        dm_digtable->pre_cck_pd_state = CCK_PD_STAGE_MAX;
-        dm_digtable->cur_cck_pd_state = CCK_PD_STAGE_MAX;
-}
-
 static u8 rtl8723e_dm_initial_gain_min_pwdb(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -395,30 +371,30 @@ static void rtl8723e_dm_cck_packet_detection_thresh(struct ieee80211_hw *hw)
         if (dm_digtable->cursta_cstate == DIG_STA_CONNECT) {
                 dm_digtable->rssi_val_min = rtl8723e_dm_initial_gain_min_pwdb(hw);
 
-                if (dm_digtable->pre_cck_pd_state == CCK_PD_STAGE_LowRssi) {
+                if (dm_digtable->pre_cck_pd_state == CCK_PD_STAGE_LOWRSSI) {
                         if (dm_digtable->rssi_val_min <= 25)
                                 dm_digtable->cur_cck_pd_state =
-                                    CCK_PD_STAGE_LowRssi;
+                                    CCK_PD_STAGE_LOWRSSI;
                         else
                                 dm_digtable->cur_cck_pd_state =
-                                    CCK_PD_STAGE_HighRssi;
+                                    CCK_PD_STAGE_HIGHRSSI;
                 } else {
                         if (dm_digtable->rssi_val_min <= 20)
                                 dm_digtable->cur_cck_pd_state =
-                                    CCK_PD_STAGE_LowRssi;
+                                    CCK_PD_STAGE_LOWRSSI;
                         else
                                 dm_digtable->cur_cck_pd_state =
-                                    CCK_PD_STAGE_HighRssi;
+                                    CCK_PD_STAGE_HIGHRSSI;
                 }
         } else {
                 dm_digtable->cur_cck_pd_state = CCK_PD_STAGE_MAX;
         }
 
         if (dm_digtable->pre_cck_pd_state != dm_digtable->cur_cck_pd_state) {
-                if (dm_digtable->cur_cck_pd_state == CCK_PD_STAGE_LowRssi) {
+                if (dm_digtable->cur_cck_pd_state == CCK_PD_STAGE_LOWRSSI) {
                         if (rtlpriv->falsealm_cnt.cnt_cck_fail > 800)
                                 dm_digtable->cur_cck_fa_state =
-                                    CCK_FA_STAGE_High;
+                                    CCK_FA_STAGE_HIGH;
                         else
                                 dm_digtable->cur_cck_fa_state =
                                     CCK_FA_STAGE_LOW;
@@ -818,7 +794,7 @@ void rtl8723e_dm_init(struct ieee80211_hw *hw)
         struct rtl_priv *rtlpriv = rtl_priv(hw);
 
         rtlpriv->dm.dm_type = DM_TYPE_BYDRIVER;
-        rtl8723e_dm_diginit(hw);
+        rtl_dm_diginit(hw, 0x20);
         rtl8723_dm_init_dynamic_txpower(hw);
         rtl8723_dm_init_edca_turbo(hw);
         rtl8723e_dm_init_rate_adaptive_mask(hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/dm.h b/drivers/net/wireless/rtlwifi/rtl8723ae/dm.h
index 6fa0feb05f6d..57111052e86b 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/dm.h
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/dm.h
@@ -42,25 +42,12 @@
 #define BW_AUTO_SWITCH_HIGH_LOW                 25
 #define BW_AUTO_SWITCH_LOW_HIGH                 30
 
-#define DM_DIG_THRESH_HIGH                      40
-#define DM_DIG_THRESH_LOW                       35
-
-#define DM_FALSEALARM_THRESH_LOW                400
-#define DM_FALSEALARM_THRESH_HIGH               1000
-
-#define DM_DIG_MAX                              0x3e
-#define DM_DIG_MIN                              0x1e
-
 #define DM_DIG_FA_UPPER                         0x32
 #define DM_DIG_FA_LOWER                         0x20
 #define DM_DIG_FA_TH0                           0x20
 #define DM_DIG_FA_TH1                           0x100
 #define DM_DIG_FA_TH2                           0x200
 
-#define DM_DIG_BACKOFF_MAX                      12
-#define DM_DIG_BACKOFF_MIN                      -4
-#define DM_DIG_BACKOFF_DEFAULT                  10
-
 #define RXPATHSELECTION_SS_TH_LOW               30
 #define RXPATHSELECTION_DIFF_TH                 18
 
@@ -108,14 +95,6 @@ enum tag_dynamic_init_gain_operation_type_definition {
         DIG_OP_TYPE_MAX
 };
 
-enum tag_cck_packet_detection_threshold_type_definition {
-        CCK_PD_STAGE_LowRssi = 0,
-        CCK_PD_STAGE_HighRssi = 1,
-        CCK_FA_STAGE_LOW = 2,
-        CCK_FA_STAGE_High = 3,
-        CCK_PD_STAGE_MAX = 4,
-};
-
 enum dm_1r_cca_e {
         CCA_1R = 0,
         CCA_2R = 1,
@@ -134,23 +113,6 @@ enum dm_sw_ant_switch_e {
         ANS_ANTENNA_MAX = 3,
 };
 
-enum dm_dig_ext_port_alg_e {
-        DIG_EXT_PORT_STAGE_0 = 0,
-        DIG_EXT_PORT_STAGE_1 = 1,
-        DIG_EXT_PORT_STAGE_2 = 2,
-        DIG_EXT_PORT_STAGE_3 = 3,
-        DIG_EXT_PORT_STAGE_MAX = 4,
-};
-
-enum dm_dig_connect_e {
-        DIG_STA_DISCONNECT = 0,
-        DIG_STA_CONNECT = 1,
-        DIG_STA_BEFORE_CONNECT = 2,
-        DIG_MULTISTA_DISCONNECT = 3,
-        DIG_MULTISTA_CONNECT = 4,
-        DIG_CONNECT_MAX
-};
-
 #define BT_RSSI_STATE_NORMAL_POWER      BIT_OFFSET_LEN_MASK_32(0, 1)
 #define BT_RSSI_STATE_AMDPU_OFF         BIT_OFFSET_LEN_MASK_32(1, 1)
 #define BT_RSSI_STATE_SPECIAL_LOW       BIT_OFFSET_LEN_MASK_32(2, 1)
diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/dm.c b/drivers/net/wireless/rtlwifi/rtl8723be/dm.c
index dd7eb4371f49..2367e8f47a5b 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723be/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723be/dm.c
@@ -26,6 +26,7 @@
 #include "../wifi.h"
 #include "../base.h"
 #include "../pci.h"
+#include "../core.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -211,35 +212,6 @@ void rtl8723be_dm_txpower_track_adjust(struct ieee80211_hw *hw, u8 type,
                 (pwr_val << 16) | (pwr_val << 24);
 }
 
-static void rtl8723be_dm_diginit(struct ieee80211_hw *hw)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct dig_t *dm_digtable = &rtlpriv->dm_digtable;
-
-        dm_digtable->dig_enable_flag = true;
-        dm_digtable->cur_igvalue = rtl_get_bbreg(hw, ROFDM0_XAAGCCORE1, 0x7f);
-        dm_digtable->rssi_lowthresh = DM_DIG_THRESH_LOW;
-        dm_digtable->rssi_highthresh = DM_DIG_THRESH_HIGH;
-        dm_digtable->fa_lowthresh = DM_FALSEALARM_THRESH_LOW;
-        dm_digtable->fa_highthresh = DM_FALSEALARM_THRESH_HIGH;
-        dm_digtable->rx_gain_max = DM_DIG_MAX;
-        dm_digtable->rx_gain_min = DM_DIG_MIN;
-        dm_digtable->back_val = DM_DIG_BACKOFF_DEFAULT;
-        dm_digtable->back_range_max = DM_DIG_BACKOFF_MAX;
-        dm_digtable->back_range_min = DM_DIG_BACKOFF_MIN;
-        dm_digtable->pre_cck_cca_thres = 0xff;
-        dm_digtable->cur_cck_cca_thres = 0x83;
-        dm_digtable->forbidden_igi = DM_DIG_MIN;
-        dm_digtable->large_fa_hit = 0;
-        dm_digtable->recover_cnt = 0;
-        dm_digtable->dig_dynamic_min = DM_DIG_MIN;
-        dm_digtable->dig_dynamic_min_1 = DM_DIG_MIN;
-        dm_digtable->media_connect_0 = false;
-        dm_digtable->media_connect_1 = false;
-        rtlpriv->dm.dm_initialgain_enable = true;
-        dm_digtable->bt30_cur_igi = 0x32;
-}
-
 void rtl8723be_dm_init_rate_adaptive_mask(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -293,9 +265,10 @@ static void rtl8723be_dm_init_dynamic_atc_switch(struct ieee80211_hw *hw)
 void rtl8723be_dm_init(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u32 cur_igvalue = rtl_get_bbreg(hw, ROFDM0_XAAGCCORE1, 0x7f);
 
         rtlpriv->dm.dm_type = DM_TYPE_BYDRIVER;
-        rtl8723be_dm_diginit(hw);
+        rtl_dm_diginit(hw, cur_igvalue);
         rtl8723be_dm_init_rate_adaptive_mask(hw);
         rtl8723_dm_init_edca_turbo(hw);
         rtl8723_dm_init_dynamic_bb_powersaving(hw);
@@ -424,7 +397,7 @@ static void rtl8723be_dm_dig(struct ieee80211_hw *hw)
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct dig_t *dm_digtable = &rtlpriv->dm_digtable;
         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
-        u8 dig_dynamic_min, dig_maxofmin;
+        u8 dig_min_0, dig_maxofmin;
         bool bfirstconnect, bfirstdisconnect;
         u8 dm_dig_max, dm_dig_min;
         u8 current_igi = dm_digtable->cur_igvalue;
@@ -434,7 +407,7 @@ static void rtl8723be_dm_dig(struct ieee80211_hw *hw)
         if (mac->act_scanning)
                 return;
 
-        dig_dynamic_min = dm_digtable->dig_dynamic_min;
+        dig_min_0 = dm_digtable->dig_min_0;
         bfirstconnect = (mac->link_state >= MAC80211_LINKED) &&
                         !dm_digtable->media_connect_0;
         bfirstdisconnect = (mac->link_state < MAC80211_LINKED) &&
@@ -456,20 +429,20 @@ static void rtl8723be_dm_dig(struct ieee80211_hw *hw)
                 if (rtlpriv->dm.one_entry_only) {
                         offset = 12;
                         if (dm_digtable->rssi_val_min - offset < dm_dig_min)
-                                dig_dynamic_min = dm_dig_min;
+                                dig_min_0 = dm_dig_min;
                         else if (dm_digtable->rssi_val_min - offset >
                                                         dig_maxofmin)
-                                dig_dynamic_min = dig_maxofmin;
+                                dig_min_0 = dig_maxofmin;
                         else
-                                dig_dynamic_min =
+                                dig_min_0 =
                                         dm_digtable->rssi_val_min - offset;
                 } else {
-                        dig_dynamic_min = dm_dig_min;
+                        dig_min_0 = dm_dig_min;
                 }
 
         } else {
                 dm_digtable->rx_gain_max = dm_dig_max;
-                dig_dynamic_min = dm_dig_min;
+                dig_min_0 = dm_dig_min;
                 RT_TRACE(rtlpriv, COMP_DIG, DBG_LOUD, "no link\n");
         }
 
@@ -497,11 +470,11 @@ static void rtl8723be_dm_dig(struct ieee80211_hw *hw)
                 } else {
                         if (dm_digtable->large_fa_hit < 3) {
                                 if ((dm_digtable->forbidden_igi - 1) <
-                                     dig_dynamic_min) {
+                                     dig_min_0) {
                                         dm_digtable->forbidden_igi =
-                                                        dig_dynamic_min;
+                                                        dig_min_0;
                                         dm_digtable->rx_gain_min =
-                                                        dig_dynamic_min;
+                                                        dig_min_0;
                                 } else {
                                         dm_digtable->forbidden_igi--;
                                         dm_digtable->rx_gain_min =
@@ -552,7 +525,7 @@ static void rtl8723be_dm_dig(struct ieee80211_hw *hw)
         rtl8723be_dm_write_dig(hw, current_igi);
         dm_digtable->media_connect_0 =
                 ((mac->link_state >= MAC80211_LINKED) ? true : false);
-        dm_digtable->dig_dynamic_min = dig_dynamic_min;
+        dm_digtable->dig_min_0 = dig_min_0;
 }
 
 static void rtl8723be_dm_false_alarm_counter_statistics(
diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/dm.h b/drivers/net/wireless/rtlwifi/rtl8723be/dm.h
index e4c0e8ae6f47..f752a2cad63d 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723be/dm.h
+++ b/drivers/net/wireless/rtlwifi/rtl8723be/dm.h
@@ -180,28 +180,12 @@
 #define BW_AUTO_SWITCH_HIGH_LOW                 25
 #define BW_AUTO_SWITCH_LOW_HIGH                 30
 
-#define DM_DIG_THRESH_HIGH                      40
-#define DM_DIG_THRESH_LOW                       35
-
-#define DM_FALSEALARM_THRESH_LOW                400
-#define DM_FALSEALARM_THRESH_HIGH               1000
-
-#define DM_DIG_MAX                              0x3e
-#define DM_DIG_MIN                              0x1e
-
-#define DM_DIG_MAX_AP                           0x32
-#define DM_DIG_MIN_AP                           0x20
-
 #define DM_DIG_FA_UPPER                         0x3e
 #define DM_DIG_FA_LOWER                         0x1e
 #define DM_DIG_FA_TH0                           0x200
 #define DM_DIG_FA_TH1                           0x300
 #define DM_DIG_FA_TH2                           0x400
 
-#define DM_DIG_BACKOFF_MAX                      12
-#define DM_DIG_BACKOFF_MIN                      -4
-#define DM_DIG_BACKOFF_DEFAULT                  10
-
 #define RXPATHSELECTION_SS_TH_LOW               30
 #define RXPATHSELECTION_DIFF_TH                 18
 
@@ -252,23 +236,6 @@ enum dm_sw_ant_switch_e {
         ANS_ANTENNA_MAX = 3,
 };
 
-enum dm_dig_ext_port_alg_e {
-        DIG_EXT_PORT_STAGE_0    = 0,
-        DIG_EXT_PORT_STAGE_1    = 1,
-        DIG_EXT_PORT_STAGE_2    = 2,
-        DIG_EXT_PORT_STAGE_3    = 3,
-        DIG_EXT_PORT_STAGE_MAX  = 4,
-};
-
-enum dm_dig_connect_e {
-        DIG_STA_DISCONNECT      = 0,
-        DIG_STA_CONNECT         = 1,
-        DIG_STA_BEFORE_CONNECT  = 2,
-        DIG_MULTISTA_DISCONNECT = 3,
-        DIG_MULTISTA_CONNECT    = 4,
-        DIG_CONNECT_MAX
-};
-
 enum pwr_track_control_method {
         BBSWING,
         TXAGC
diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/sw.c b/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
index 223eb42992bd..1017f02d7bf7 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
@@ -387,12 +387,14 @@ module_param_named(swlps, rtl8723be_mod_params.swctrl_lps, bool, 0444);
 module_param_named(fwlps, rtl8723be_mod_params.fwctrl_lps, bool, 0444);
 module_param_named(disable_watchdog, rtl8723be_mod_params.disable_watchdog,
                    bool, 0444);
-MODULE_PARM_DESC(swenc, "using hardware crypto (default 0 [hardware])\n");
-MODULE_PARM_DESC(ips, "using no link power save (default 1 is open)\n");
-MODULE_PARM_DESC(fwlps, "using linked fw control power save (default 1 is open)\n");
+MODULE_PARM_DESC(swenc, "Set to 1 for software crypto (default 0)\n");
+MODULE_PARM_DESC(ips, "Set to 0 to not use link power save (default 1)\n");
+MODULE_PARM_DESC(swlps, "Set to 1 to use SW control power save (default 0)\n");
+MODULE_PARM_DESC(fwlps, "Set to 1 to use FW control power save (default 1)\n");
 MODULE_PARM_DESC(msi, "Set to 1 to use MSI interrupts mode (default 0)\n");
 MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)");
-MODULE_PARM_DESC(disable_watchdog, "Set to 1 to disable the watchdog (default 0)\n");
+MODULE_PARM_DESC(disable_watchdog,
+                 "Set to 1 to disable the watchdog (default 0)\n");
 
 static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume);
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/dm.c b/drivers/net/wireless/rtlwifi/rtl8821ae/dm.c
index ba30b0d250fd..0b2082dc48f1 100644
--- a/drivers/net/wireless/rtlwifi/rtl8821ae/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/dm.c
@@ -26,6 +26,7 @@
 #include "../wifi.h"
 #include "../base.h"
 #include "../pci.h"
+#include "../core.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -519,34 +520,6 @@ void rtl8821ae_dm_initialize_txpower_tracking_thermalmeter(
         }
 }
 
-static void rtl8821ae_dm_diginit(struct ieee80211_hw *hw)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct dig_t *dm_digtable = &rtlpriv->dm_digtable;
-
-        dm_digtable->cur_igvalue = rtl_get_bbreg(hw, ROFDM0_XAAGCCORE1, 0x7f);
-        dm_digtable->rssi_lowthresh = DM_DIG_THRESH_LOW;
-        dm_digtable->rssi_highthresh = DM_DIG_THRESH_HIGH;
-        dm_digtable->fa_lowthresh = DM_FALSEALARM_THRESH_LOW;
-        dm_digtable->fa_highthresh = DM_FALSEALARM_THRESH_HIGH;
-        dm_digtable->rx_gain_max = DM_DIG_MAX;
-        dm_digtable->rx_gain_min = DM_DIG_MIN;
-        dm_digtable->back_val = DM_DIG_BACKOFF_DEFAULT;
-        dm_digtable->back_range_max = DM_DIG_BACKOFF_MAX;
-        dm_digtable->back_range_min = DM_DIG_BACKOFF_MIN;
-        dm_digtable->pre_cck_cca_thres = 0xff;
-        dm_digtable->cur_cck_cca_thres = 0x83;
-        dm_digtable->forbidden_igi = DM_DIG_MIN;
-        dm_digtable->large_fa_hit = 0;
-        dm_digtable->recover_cnt = 0;
-        dm_digtable->dig_dynamic_min = DM_DIG_MIN;
-        dm_digtable->dig_dynamic_min_1 = DM_DIG_MIN;
-        dm_digtable->media_connect_0 = false;
-        dm_digtable->media_connect_1 = false;
-        rtlpriv->dm.dm_initialgain_enable = true;
-        dm_digtable->bt30_cur_igi = 0x32;
-}
-
 void rtl8821ae_dm_init_edca_turbo(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -606,6 +579,7 @@ void rtl8821ae_dm_init(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_phy *rtlphy = &rtlpriv->phy;
+        u32 cur_igvalue = rtl_get_bbreg(hw, ROFDM0_XAAGCCORE1, 0x7f);
 
         spin_lock(&rtlpriv->locks.iqk_lock);
         rtlphy->lck_inprogress = false;
@@ -613,7 +587,7 @@ void rtl8821ae_dm_init(struct ieee80211_hw *hw)
 
         rtlpriv->dm.dm_type = DM_TYPE_BYDRIVER;
         rtl8821ae_dm_common_info_self_init(hw);
-        rtl8821ae_dm_diginit(hw);
+        rtl_dm_diginit(hw, cur_igvalue);
         rtl8821ae_dm_init_rate_adaptive_mask(hw);
         rtl8821ae_dm_init_edca_turbo(hw);
         rtl8821ae_dm_initialize_txpower_tracking_thermalmeter(hw);
@@ -822,7 +796,7 @@ static void rtl8821ae_dm_dig(struct ieee80211_hw *hw)
         struct dig_t *dm_digtable = &rtlpriv->dm_digtable;
         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
         struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
-        u8 dig_dynamic_min;
+        u8 dig_min_0;
         u8 dig_max_of_min;
         bool first_connect, first_disconnect;
         u8 dm_dig_max, dm_dig_min, offset;
@@ -837,7 +811,7 @@ static void rtl8821ae_dm_dig(struct ieee80211_hw *hw)
         }
 
         /*add by Neil Chen to avoid PSD is processing*/
-        dig_dynamic_min = dm_digtable->dig_dynamic_min;
+        dig_min_0 = dm_digtable->dig_min_0;
         first_connect = (mac->link_state >= MAC80211_LINKED) &&
                         (!dm_digtable->media_connect_0);
         first_disconnect = (mac->link_state < MAC80211_LINKED) &&
@@ -876,23 +850,23 @@ static void rtl8821ae_dm_dig(struct ieee80211_hw *hw)
                         offset = 0;
 
                         if (dm_digtable->rssi_val_min - offset < dm_dig_min)
-                                dig_dynamic_min = dm_dig_min;
+                                dig_min_0 = dm_dig_min;
                         else if (dm_digtable->rssi_val_min -
                                 offset > dig_max_of_min)
-                                dig_dynamic_min = dig_max_of_min;
+                                dig_min_0 = dig_max_of_min;
                         else
-                                dig_dynamic_min =
+                                dig_min_0 =
                                         dm_digtable->rssi_val_min - offset;
 
                         RT_TRACE(rtlpriv, COMP_DIG, DBG_LOUD,
-                                 "bOneEntryOnly=TRUE, dig_dynamic_min=0x%x\n",
-                                 dig_dynamic_min);
+                                 "bOneEntryOnly=TRUE, dig_min_0=0x%x\n",
+                                 dig_min_0);
                 } else {
-                        dig_dynamic_min = dm_dig_min;
+                        dig_min_0 = dm_dig_min;
                 }
         } else {
                 dm_digtable->rx_gain_max = dm_dig_max;
-                dig_dynamic_min = dm_dig_min;
+                dig_min_0 = dm_dig_min;
                 RT_TRACE(rtlpriv, COMP_DIG, DBG_LOUD,
                          "No Link\n");
         }
@@ -925,11 +899,11 @@ static void rtl8821ae_dm_dig(struct ieee80211_hw *hw)
                 } else {
                         if (dm_digtable->large_fa_hit < 3) {
                                 if ((dm_digtable->forbidden_igi - 1) <
-                                    dig_dynamic_min) {
+                                    dig_min_0) {
                                         dm_digtable->forbidden_igi =
-                                                dig_dynamic_min;
+                                                dig_min_0;
                                         dm_digtable->rx_gain_min =
-                                                dig_dynamic_min;
+                                                dig_min_0;
                                         RT_TRACE(rtlpriv, COMP_DIG, DBG_LOUD,
                                                  "Normal Case: At Lower Bound\n");
                                 } else {
@@ -1024,7 +998,7 @@ static void rtl8821ae_dm_dig(struct ieee80211_hw *hw)
         rtl8821ae_dm_write_dig(hw, current_igi);
         dm_digtable->media_connect_0 =
                 ((mac->link_state >= MAC80211_LINKED) ? true : false);
-        dm_digtable->dig_dynamic_min = dig_dynamic_min;
+        dm_digtable->dig_min_0 = dig_min_0;
 }
 
 static void rtl8821ae_dm_common_info_self_update(struct ieee80211_hw *hw)
diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/dm.h b/drivers/net/wireless/rtlwifi/rtl8821ae/dm.h
index 9dd40dd316c1..625a6bbb21fc 100644
--- a/drivers/net/wireless/rtlwifi/rtl8821ae/dm.h
+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/dm.h
@@ -187,28 +187,12 @@
 #define BW_AUTO_SWITCH_HIGH_LOW         25
 #define BW_AUTO_SWITCH_LOW_HIGH         30
 
-#define DM_DIG_THRESH_HIGH                      40
-#define DM_DIG_THRESH_LOW                       35
-
-#define DM_FALSEALARM_THRESH_LOW        400
-#define DM_FALSEALARM_THRESH_HIGH       1000
-
-#define DM_DIG_MAX                                      0x3e
-#define DM_DIG_MIN                                      0x1e
-
-#define DM_DIG_MAX_AP                           0x32
-#define DM_DIG_MIN_AP                           0x20
-
 #define DM_DIG_FA_UPPER                         0x3e
 #define DM_DIG_FA_LOWER                         0x1e
 #define DM_DIG_FA_TH0                           200
 #define DM_DIG_FA_TH1                           0x300
 #define DM_DIG_FA_TH2                           0x400
 
-#define DM_DIG_BACKOFF_MAX                      12
-#define DM_DIG_BACKOFF_MIN                      -4
-#define DM_DIG_BACKOFF_DEFAULT          10
-
 #define RXPATHSELECTION_SS_TH_LOW       30
 #define RXPATHSELECTION_DIFF_TH         18
 
@@ -262,14 +246,6 @@ enum tag_dynamic_init_gain_operation_type_definition {
         DIG_OP_TYPE_MAX
 };
 
-enum tag_cck_packet_detection_threshold_type_definition {
-        CCK_PD_STAGE_LOWRSSI = 0,
-        CCK_PD_STAGE_HIGHRSSI = 1,
-        CCK_FA_STAGE_LOW = 2,
-        CCK_FA_STAGE_HIGH = 3,
-        CCK_PD_STAGE_MAX = 4,
-};
-
 enum dm_1r_cca_e {
         CCA_1R = 0,
         CCA_2R = 1,
@@ -288,23 +264,6 @@ enum dm_sw_ant_switch_e {
         ANS_ANTENNA_MAX = 3,
 };
 
-enum dm_dig_ext_port_alg_e {
-        DIG_EXT_PORT_STAGE_0 = 0,
-        DIG_EXT_PORT_STAGE_1 = 1,
-        DIG_EXT_PORT_STAGE_2 = 2,
-        DIG_EXT_PORT_STAGE_3 = 3,
-        DIG_EXT_PORT_STAGE_MAX = 4,
-};
-
-enum dm_dig_connect_e {
-        DIG_STA_DISCONNECT = 0,
-        DIG_STA_CONNECT = 1,
-        DIG_STA_BEFORE_CONNECT = 2,
-        DIG_MULTISTA_DISCONNECT = 3,
-        DIG_MULTISTA_CONNECT = 4,
-        DIG_CONNECT_MAX
-};
-
 enum pwr_track_control_method {
         BBSWING,
         TXAGC,
diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
index 7a718fdb82cd..b53d9dd7a595 100644
--- a/drivers/net/wireless/rtlwifi/wifi.h
+++ b/drivers/net/wireless/rtlwifi/wifi.h
@@ -2412,8 +2412,6 @@ struct dig_t {
         u8 pre_ccastate;
         u8 cur_ccasate;
         u8 large_fa_hit;
-        u8 dig_dynamic_min;
-        u8 dig_dynamic_min_1;
         u8 forbidden_igi;
         u8 dig_state;
         u8 dig_highpwrstate;
diff --git a/drivers/net/wireless/ti/wl12xx/main.c b/drivers/net/wireless/ti/wl12xx/main.c
index d6d0d6d9c7a8..144d1f8ba473 100644
--- a/drivers/net/wireless/ti/wl12xx/main.c
+++ b/drivers/net/wireless/ti/wl12xx/main.c
@@ -250,6 +250,7 @@ static struct wlcore_conf wl12xx_conf = {
                 .keep_alive_interval         = 55000,
                 .max_listen_interval         = 20,
                 .sta_sleep_auth              = WL1271_PSM_ILLEGAL,
+                .suspend_rx_ba_activity      = 0,
         },
         .itrim = {
                 .enable = false,
@@ -1728,6 +1729,9 @@ static struct wlcore_ops wl12xx_ops = {
         .convert_hwaddr         = wl12xx_convert_hwaddr,
         .lnk_high_prio          = wl12xx_lnk_high_prio,
         .lnk_low_prio           = wl12xx_lnk_low_prio,
+        .interrupt_notify       = NULL,
+        .rx_ba_filter           = NULL,
+        .ap_sleep               = NULL,
 };
 
 static struct ieee80211_sta_ht_cap wl12xx_ht_cap = {
diff --git a/drivers/net/wireless/ti/wl18xx/acx.c b/drivers/net/wireless/ti/wl18xx/acx.c
index a169bb5a5dbf..67f2a0eec854 100644
--- a/drivers/net/wireless/ti/wl18xx/acx.c
+++ b/drivers/net/wireless/ti/wl18xx/acx.c
@@ -24,6 +24,7 @@
 #include "../wlcore/acx.h"
 
 #include "acx.h"
+#include "wl18xx.h"
 
 int wl18xx_acx_host_if_cfg_bitmap(struct wl1271 *wl, u32 host_cfg_bitmap,
                                   u32 sdio_blk_size, u32 extra_mem_blks,
@@ -194,3 +195,90 @@ out:
         kfree(acx);
         return ret;
 }
+
+/*
+ * When the host is suspended, we don't want to get any fast-link/PSM
+ * notifications
+ */
+int wl18xx_acx_interrupt_notify_config(struct wl1271 *wl,
+                                       bool action)
+{
+        struct wl18xx_acx_interrupt_notify *acx;
+        int ret = 0;
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->enable = action;
+        ret = wl1271_cmd_configure(wl, ACX_INTERRUPT_NOTIFY, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("acx interrupt notify setting failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
+/*
+ * When the host is suspended, we can configure the FW to disable RX BA
+ * notifications.
+ */
+int wl18xx_acx_rx_ba_filter(struct wl1271 *wl, bool action)
+{
+        struct wl18xx_acx_rx_ba_filter *acx;
+        int ret = 0;
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->enable = (u32)action;
+        ret = wl1271_cmd_configure(wl, ACX_RX_BA_FILTER, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("acx rx ba activity filter setting failed: %d",
+                               ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
+int wl18xx_acx_ap_sleep(struct wl1271 *wl)
+{
+        struct wl18xx_priv *priv = wl->priv;
+        struct acx_ap_sleep_cfg *acx;
+        struct conf_ap_sleep_settings *conf = &priv->conf.ap_sleep;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx config ap sleep");
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->idle_duty_cycle = conf->idle_duty_cycle;
+        acx->connected_duty_cycle = conf->connected_duty_cycle;
+        acx->max_stations_thresh = conf->max_stations_thresh;
+        acx->idle_conn_thresh = conf->idle_conn_thresh;
+
+        ret = wl1271_cmd_configure(wl, ACX_AP_SLEEP_CFG, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("acx config ap-sleep failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
diff --git a/drivers/net/wireless/ti/wl18xx/acx.h b/drivers/net/wireless/ti/wl18xx/acx.h
index 0e636def1217..4afccd4b9467 100644
--- a/drivers/net/wireless/ti/wl18xx/acx.h
+++ b/drivers/net/wireless/ti/wl18xx/acx.h
@@ -32,7 +32,10 @@ enum {
         ACX_SIM_CONFIG                   = 0x0053,
         ACX_CLEAR_STATISTICS             = 0x0054,
         ACX_AUTO_RX_STREAMING            = 0x0055,
-        ACX_PEER_CAP                     = 0x0056
+        ACX_PEER_CAP                     = 0x0056,
+        ACX_INTERRUPT_NOTIFY             = 0x0057,
+        ACX_RX_BA_FILTER                 = 0x0058,
+        ACX_AP_SLEEP_CFG                 = 0x0059
 };
 
 /* numbers of bits the length field takes (add 1 for the actual number) */
@@ -326,6 +329,44 @@ struct wlcore_acx_peer_cap {
         u8 padding;
 } __packed;
 
+/*
+ * ACX_INTERRUPT_NOTIFY
+ * enable/disable fast-link/PSM notification from FW
+ */
+struct wl18xx_acx_interrupt_notify {
+        struct acx_header header;
+        u32 enable;
+};
+
+/*
+ * ACX_RX_BA_FILTER
+ * enable/disable RX BA filtering in FW
+ */
+struct wl18xx_acx_rx_ba_filter {
+        struct acx_header header;
+        u32 enable;
+};
+
+struct acx_ap_sleep_cfg {
+        struct acx_header header;
+        /* Duty Cycle (20-80% of staying Awake) for IDLE AP
+         * (0: disable)
+         */
+        u8 idle_duty_cycle;
+        /* Duty Cycle (20-80% of staying Awake) for Connected AP
+         * (0: disable)
+         */
+        u8 connected_duty_cycle;
+        /* Maximum stations that are allowed to be connected to AP
+         *  (255: no limit)
+         */
+        u8 max_stations_thresh;
+        /* Timeout till enabling the Sleep Mechanism after data stops
+         * [unit: 100 msec]
+         */
+        u8 idle_conn_thresh;
+} __packed;
+
 int wl18xx_acx_host_if_cfg_bitmap(struct wl1271 *wl, u32 host_cfg_bitmap,
                                   u32 sdio_blk_size, u32 extra_mem_blks,
                                   u32 len_field_size);
@@ -336,5 +377,8 @@ int wl18xx_acx_set_peer_cap(struct wl1271 *wl,
                             struct ieee80211_sta_ht_cap *ht_cap,
                             bool allow_ht_operation,
                             u32 rate_set, u8 hlid);
+int wl18xx_acx_interrupt_notify_config(struct wl1271 *wl, bool action);
+int wl18xx_acx_rx_ba_filter(struct wl1271 *wl, bool action);
+int wl18xx_acx_ap_sleep(struct wl1271 *wl);
 
 #endif /* __WL18XX_ACX_H__ */
diff --git a/drivers/net/wireless/ti/wl18xx/cmd.c b/drivers/net/wireless/ti/wl18xx/cmd.c
index 44f0b205b065..a8d176ddc73c 100644
--- a/drivers/net/wireless/ti/wl18xx/cmd.c
+++ b/drivers/net/wireless/ti/wl18xx/cmd.c
@@ -33,7 +33,8 @@ int wl18xx_cmd_channel_switch(struct wl1271 *wl,
         u32 supported_rates;
         int ret;
 
-        wl1271_debug(DEBUG_ACX, "cmd channel switch");
+        wl1271_debug(DEBUG_ACX, "cmd channel switch (count=%d)",
+                     ch_switch->count);
 
         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
         if (!cmd) {
@@ -60,8 +61,12 @@ int wl18xx_cmd_channel_switch(struct wl1271 *wl,
                 goto out_free;
         }
 
-        supported_rates = CONF_TX_ENABLED_RATES | CONF_TX_MCS_RATES |
-                          wlcore_hw_sta_get_ap_rate_mask(wl, wlvif);
+        supported_rates = CONF_TX_ENABLED_RATES | CONF_TX_MCS_RATES;
+        if (wlvif->bss_type == BSS_TYPE_STA_BSS)
+                supported_rates |= wlcore_hw_sta_get_ap_rate_mask(wl, wlvif);
+        else
+                supported_rates |=
+                        wlcore_hw_ap_get_mimo_wide_rate_mask(wl, wlvif);
         if (wlvif->p2p)
                 supported_rates &= ~CONF_TX_CCK_RATES;
         cmd->local_supported_rates = cpu_to_le32(supported_rates);
@@ -167,3 +172,85 @@ out_free:
 out:
         return ret;
 }
+
+int wl18xx_cmd_set_cac(struct wl1271 *wl, struct wl12xx_vif *wlvif, bool start)
+{
+        struct wlcore_cmd_cac_start *cmd;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_CMD, "cmd cac (channel %d) %s",
+                     wlvif->channel, start ? "start" : "stop");
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd)
+                return -ENOMEM;
+
+        cmd->role_id = wlvif->role_id;
+        cmd->channel = wlvif->channel;
+        if (wlvif->band == IEEE80211_BAND_5GHZ)
+                cmd->band = WLCORE_BAND_5GHZ;
+        cmd->bandwidth = wlcore_get_native_channel_type(wlvif->channel_type);
+
+        ret = wl1271_cmd_send(wl,
+                              start ? CMD_CAC_START : CMD_CAC_STOP,
+                              cmd, sizeof(*cmd), 0);
+        if (ret < 0) {
+                wl1271_error("failed to send cac command");
+                goto out_free;
+        }
+
+out_free:
+        kfree(cmd);
+        return ret;
+}
+
+int wl18xx_cmd_radar_detection_debug(struct wl1271 *wl, u8 channel)
+{
+        struct wl18xx_cmd_dfs_radar_debug *cmd;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_CMD, "cmd radar detection debug (chan %d)",
+                     channel);
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd)
+                return -ENOMEM;
+
+        cmd->channel = channel;
+
+        ret = wl1271_cmd_send(wl, CMD_DFS_RADAR_DETECTION_DEBUG,
+                              cmd, sizeof(*cmd), 0);
+        if (ret < 0) {
+                wl1271_error("failed to send radar detection debug command");
+                goto out_free;
+        }
+
+out_free:
+        kfree(cmd);
+        return ret;
+}
+
+int wl18xx_cmd_dfs_master_restart(struct wl1271 *wl, struct wl12xx_vif *wlvif)
+{
+        struct wl18xx_cmd_dfs_master_restart *cmd;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_CMD, "cmd dfs master restart (role %d)",
+                     wlvif->role_id);
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd)
+                return -ENOMEM;
+
+        cmd->role_id = wlvif->role_id;
+
+        ret = wl1271_cmd_send(wl, CMD_DFS_MASTER_RESTART,
+                              cmd, sizeof(*cmd), 0);
+        if (ret < 0) {
+                wl1271_error("failed to send dfs master restart command");
+                goto out_free;
+        }
+out_free:
+        kfree(cmd);
+        return ret;
+}
diff --git a/drivers/net/wireless/ti/wl18xx/cmd.h b/drivers/net/wireless/ti/wl18xx/cmd.h
index 92499e2dfa83..7f9440a2bff8 100644
--- a/drivers/net/wireless/ti/wl18xx/cmd.h
+++ b/drivers/net/wireless/ti/wl18xx/cmd.h
@@ -59,6 +59,30 @@ struct wl18xx_cmd_smart_config_set_group_key {
         u8 key[16];
 } __packed;
 
+struct wl18xx_cmd_dfs_radar_debug {
+        struct wl1271_cmd_header header;
+
+        u8 channel;
+        u8 padding[3];
+} __packed;
+
+struct wl18xx_cmd_dfs_master_restart {
+        struct wl1271_cmd_header header;
+
+        u8 role_id;
+        u8 padding[3];
+} __packed;
+
+/* cac_start and cac_stop share the same params */
+struct wlcore_cmd_cac_start {
+        struct wl1271_cmd_header header;
+
+        u8 role_id;
+        u8 channel;
+        u8 band;
+        u8 bandwidth;
+} __packed;
+
 int wl18xx_cmd_channel_switch(struct wl1271 *wl,
                               struct wl12xx_vif *wlvif,
                               struct ieee80211_channel_switch *ch_switch);
@@ -66,4 +90,7 @@ int wl18xx_cmd_smart_config_start(struct wl1271 *wl, u32 group_bitmap);
 int wl18xx_cmd_smart_config_stop(struct wl1271 *wl);
 int wl18xx_cmd_smart_config_set_group_key(struct wl1271 *wl, u16 group_id,
                                           u8 key_len, u8 *key);
+int wl18xx_cmd_set_cac(struct wl1271 *wl, struct wl12xx_vif *wlvif, bool start);
+int wl18xx_cmd_radar_detection_debug(struct wl1271 *wl, u8 channel);
+int wl18xx_cmd_dfs_master_restart(struct wl1271 *wl, struct wl12xx_vif *wlvif);
 #endif
diff --git a/drivers/net/wireless/ti/wl18xx/conf.h b/drivers/net/wireless/ti/wl18xx/conf.h
index e34302e3b51d..71f1ec448ba5 100644
--- a/drivers/net/wireless/ti/wl18xx/conf.h
+++ b/drivers/net/wireless/ti/wl18xx/conf.h
@@ -23,7 +23,7 @@
 #define __WL18XX_CONF_H__
 
 #define WL18XX_CONF_MAGIC       0x10e100ca
-#define WL18XX_CONF_VERSION     (WLCORE_CONF_VERSION | 0x0006)
+#define WL18XX_CONF_VERSION     (WLCORE_CONF_VERSION | 0x0007)
 #define WL18XX_CONF_MASK        0x0000ffff
 #define WL18XX_CONF_SIZE        (WLCORE_CONF_SIZE + \
                                  sizeof(struct wl18xx_priv_conf))
@@ -110,12 +110,33 @@ struct wl18xx_ht_settings {
         u8 mode;
 } __packed;
 
+struct conf_ap_sleep_settings {
+        /* Duty Cycle (20-80% of staying Awake) for IDLE AP
+         * (0: disable)
+         */
+        u8 idle_duty_cycle;
+        /* Duty Cycle (20-80% of staying Awake) for Connected AP
+         * (0: disable)
+         */
+        u8 connected_duty_cycle;
+        /* Maximum stations that are allowed to be connected to AP
+         *  (255: no limit)
+         */
+        u8 max_stations_thresh;
+        /* Timeout till enabling the Sleep Mechanism after data stops
+         * [unit: 100 msec]
+         */
+        u8 idle_conn_thresh;
+} __packed;
+
 struct wl18xx_priv_conf {
         /* Module params structures */
         struct wl18xx_ht_settings ht;
 
         /* this structure is copied wholesale to FW */
         struct wl18xx_mac_and_phy_params phy;
+
+        struct conf_ap_sleep_settings ap_sleep;
 } __packed;
 
 #endif /* __WL18XX_CONF_H__ */
diff --git a/drivers/net/wireless/ti/wl18xx/debugfs.c b/drivers/net/wireless/ti/wl18xx/debugfs.c
index 7f1669cdea09..c93fae95baac 100644
--- a/drivers/net/wireless/ti/wl18xx/debugfs.c
+++ b/drivers/net/wireless/ti/wl18xx/debugfs.c
@@ -22,9 +22,12 @@
 
 #include "../wlcore/debugfs.h"
 #include "../wlcore/wlcore.h"
+#include "../wlcore/debug.h"
+#include "../wlcore/ps.h"
 
 #include "wl18xx.h"
 #include "acx.h"
+#include "cmd.h"
 #include "debugfs.h"
 
 #define WL18XX_DEBUGFS_FWSTATS_FILE(a, b, c) \
@@ -239,6 +242,45 @@ static const struct file_operations clear_fw_stats_ops = {
         .llseek = default_llseek,
 };
 
+static ssize_t radar_detection_write(struct file *file,
+                                     const char __user *user_buf,
+                                     size_t count, loff_t *ppos)
+{
+        struct wl1271 *wl = file->private_data;
+        int ret;
+        u8 channel;
+
+        ret = kstrtou8_from_user(user_buf, count, 10, &channel);
+        if (ret < 0) {
+                wl1271_warning("illegal channel");
+                return -EINVAL;
+        }
+
+        mutex_lock(&wl->mutex);
+
+        if (unlikely(wl->state != WLCORE_STATE_ON))
+                goto out;
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
+        ret = wl18xx_cmd_radar_detection_debug(wl, channel);
+        if (ret < 0)
+                count = ret;
+
+        wl1271_ps_elp_sleep(wl);
+out:
+        mutex_unlock(&wl->mutex);
+        return count;
+}
+
+static const struct file_operations radar_detection_ops = {
+        .write = radar_detection_write,
+        .open = simple_open,
+        .llseek = default_llseek,
+};
+
 int wl18xx_debugfs_add_files(struct wl1271 *wl,
                              struct dentry *rootdir)
 {
@@ -390,6 +432,7 @@ int wl18xx_debugfs_add_files(struct wl1271 *wl,
         DEBUGFS_FWSTATS_ADD(mem, fw_gen_free_mem_blks);
 
         DEBUGFS_ADD(conf, moddir);
+        DEBUGFS_ADD(radar_detection, moddir);
 
         return 0;
 
diff --git a/drivers/net/wireless/ti/wl18xx/event.c b/drivers/net/wireless/ti/wl18xx/event.c
index eb1848e08424..c28f06854195 100644
--- a/drivers/net/wireless/ti/wl18xx/event.c
+++ b/drivers/net/wireless/ti/wl18xx/event.c
@@ -47,6 +47,19 @@ int wl18xx_wait_for_event(struct wl1271 *wl, enum wlcore_wait_event event,
         return wlcore_cmd_wait_for_event_or_timeout(wl, local_event, timeout);
 }
 
+static const char *wl18xx_radar_type_decode(u8 radar_type)
+{
+        switch (radar_type) {
+        case RADAR_TYPE_REGULAR:
+                return "REGULAR";
+        case RADAR_TYPE_CHIRP:
+                return "CHIRP";
+        case RADAR_TYPE_NONE:
+        default:
+                return "N/A";
+        }
+}
+
 static int wlcore_smart_config_sync_event(struct wl1271 *wl, u8 sync_channel,
                                           u8 sync_band)
 {
@@ -115,6 +128,14 @@ int wl18xx_process_mailbox_events(struct wl1271 *wl)
                         wl18xx_scan_completed(wl, wl->scan_wlvif);
         }
 
+        if (vector & RADAR_DETECTED_EVENT_ID) {
+                wl1271_info("radar event: channel %d type %s",
+                            mbox->radar_channel,
+                            wl18xx_radar_type_decode(mbox->radar_type));
+
+                ieee80211_radar_detected(wl->hw);
+        }
+
         if (vector & PERIODIC_SCAN_REPORT_EVENT_ID) {
                 wl1271_debug(DEBUG_EVENT,
                              "PERIODIC_SCAN_REPORT_EVENT (results %d)",
diff --git a/drivers/net/wireless/ti/wl18xx/event.h b/drivers/net/wireless/ti/wl18xx/event.h
index 0680312d4943..266ee87834e4 100644
--- a/drivers/net/wireless/ti/wl18xx/event.h
+++ b/drivers/net/wireless/ti/wl18xx/event.h
@@ -42,6 +42,12 @@ enum {
         SMART_CONFIG_DECODE_EVENT_ID             = BIT(23),
 };
 
+enum wl18xx_radar_types {
+        RADAR_TYPE_NONE,
+        RADAR_TYPE_REGULAR,
+        RADAR_TYPE_CHIRP
+};
+
 struct wl18xx_event_mailbox {
         __le32 events_vector;
 
@@ -83,13 +89,19 @@ struct wl18xx_event_mailbox {
         u8 sc_token_len;
         u8 padding1;
         u8 sc_ssid[32];
-        u8 sc_pwd[32];
+        u8 sc_pwd[64];
         u8 sc_token[32];
 
         /* smart config sync channel */
         u8 sc_sync_channel;
         u8 sc_sync_band;
         u8 padding2[2];
+
+        /* radar detect */
+        u8 radar_channel;
+        u8 radar_type;
+
+        u8 padding3[2];
 } __packed;
 
 int wl18xx_wait_for_event(struct wl1271 *wl, enum wlcore_wait_event event,
diff --git a/drivers/net/wireless/ti/wl18xx/main.c b/drivers/net/wireless/ti/wl18xx/main.c
index 8e562610bf16..717c4f5a02c2 100644
--- a/drivers/net/wireless/ti/wl18xx/main.c
+++ b/drivers/net/wireless/ti/wl18xx/main.c
@@ -378,6 +378,7 @@ static struct wlcore_conf wl18xx_conf = {
                 .keep_alive_interval         = 55000,
                 .max_listen_interval         = 20,
                 .sta_sleep_auth              = WL1271_PSM_ILLEGAL,
+                .suspend_rx_ba_activity      = 0,
         },
         .itrim = {
                 .enable = false,
@@ -567,6 +568,12 @@ static struct wl18xx_priv_conf wl18xx_default_priv_conf = {
                 .high_power_val_2nd             = 0xff,
                 .tx_rf_margin                   = 1,
         },
+        .ap_sleep = {               /* disabled by default */
+                .idle_duty_cycle        = 0,
+                .connected_duty_cycle   = 0,
+                .max_stations_thresh    = 0,
+                .idle_conn_thresh       = 0,
+        },
 };
 
 static const struct wlcore_partition_set wl18xx_ptable[PART_TABLE_LEN] = {
@@ -648,7 +655,7 @@ static const struct wl18xx_clk_cfg wl18xx_clk_table[NUM_CLOCK_CONFIGS] = {
 };
 
 /* TODO: maybe move to a new header file? */
-#define WL18XX_FW_NAME "ti-connectivity/wl18xx-fw-3.bin"
+#define WL18XX_FW_NAME "ti-connectivity/wl18xx-fw-4.bin"
 
 static int wl18xx_identify_chip(struct wl1271 *wl)
 {
@@ -983,6 +990,7 @@ static int wl18xx_boot(struct wl1271 *wl)
 
         wl->event_mask = BSS_LOSS_EVENT_ID |
                 SCAN_COMPLETE_EVENT_ID |
+                RADAR_DETECTED_EVENT_ID |
                 RSSI_SNR_TRIGGER_0_EVENT_ID |
                 PERIODIC_SCAN_COMPLETE_EVENT_ID |
                 PERIODIC_SCAN_REPORT_EVENT_ID |
@@ -1559,26 +1567,19 @@ static u32 wl18xx_pre_pkt_send(struct wl1271 *wl,
 }
 
 static void wl18xx_sta_rc_update(struct wl1271 *wl,
-                                 struct wl12xx_vif *wlvif,
-                                 struct ieee80211_sta *sta,
-                                 u32 changed)
+                                 struct wl12xx_vif *wlvif)
 {
-        bool wide = sta->bandwidth >= IEEE80211_STA_RX_BW_40;
+        bool wide = wlvif->rc_update_bw >= IEEE80211_STA_RX_BW_40;
 
         wl1271_debug(DEBUG_MAC80211, "mac80211 sta_rc_update wide %d", wide);
 
-        if (!(changed & IEEE80211_RC_BW_CHANGED))
-                return;
-
-        mutex_lock(&wl->mutex);
-
         /* sanity */
         if (WARN_ON(wlvif->bss_type != BSS_TYPE_STA_BSS))
-                goto out;
+                return;
 
         /* ignore the change before association */
         if (!test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags))
-                goto out;
+                return;
 
         /*
          * If we started out as wide, we can change the operation mode. If we
@@ -1589,9 +1590,6 @@ static void wl18xx_sta_rc_update(struct wl1271 *wl,
                 wl18xx_acx_peer_ht_operation_mode(wl, wlvif->sta.hlid, wide);
         else
                 ieee80211_connection_loss(wl12xx_wlvif_to_vif(wlvif));
-
-out:
-        mutex_unlock(&wl->mutex);
 }
 
 static int wl18xx_set_peer_cap(struct wl1271 *wl,
@@ -1703,6 +1701,11 @@ static struct wlcore_ops wl18xx_ops = {
         .smart_config_start = wl18xx_cmd_smart_config_start,
         .smart_config_stop  = wl18xx_cmd_smart_config_stop,
         .smart_config_set_group_key = wl18xx_cmd_smart_config_set_group_key,
+        .interrupt_notify = wl18xx_acx_interrupt_notify_config,
+        .rx_ba_filter   = wl18xx_acx_rx_ba_filter,
+        .ap_sleep       = wl18xx_acx_ap_sleep,
+        .set_cac        = wl18xx_cmd_set_cac,
+        .dfs_master_restart     = wl18xx_cmd_dfs_master_restart,
 };
 
 /* HT cap appropriate for wide channels in 2Ghz */
@@ -1796,6 +1799,10 @@ wl18xx_iface_combinations[] = {
                 .limits = wl18xx_iface_ap_limits,
                 .n_limits = ARRAY_SIZE(wl18xx_iface_ap_limits),
                 .num_different_channels = 1,
+                .radar_detect_widths =  BIT(NL80211_CHAN_NO_HT) |
+                                        BIT(NL80211_CHAN_HT20) |
+                                        BIT(NL80211_CHAN_HT40MINUS) |
+                                        BIT(NL80211_CHAN_HT40PLUS),
         }
 };
 
diff --git a/drivers/net/wireless/ti/wl18xx/wl18xx.h b/drivers/net/wireless/ti/wl18xx/wl18xx.h
index 6a2b88030c1d..71e9e382ce80 100644
--- a/drivers/net/wireless/ti/wl18xx/wl18xx.h
+++ b/drivers/net/wireless/ti/wl18xx/wl18xx.h
@@ -26,10 +26,10 @@
 
 /* minimum FW required for driver */
 #define WL18XX_CHIP_VER         8
-#define WL18XX_IFTYPE_VER       8
+#define WL18XX_IFTYPE_VER       9
 #define WL18XX_MAJOR_VER        WLCORE_FW_VER_IGNORE
 #define WL18XX_SUBTYPE_VER      WLCORE_FW_VER_IGNORE
-#define WL18XX_MINOR_VER        13
+#define WL18XX_MINOR_VER        11
 
 #define WL18XX_CMD_MAX_SIZE          740
 
diff --git a/drivers/net/wireless/ti/wlcore/acx.c b/drivers/net/wireless/ti/wlcore/acx.c
index b924ceadc02c..f28fa3b5029d 100644
--- a/drivers/net/wireless/ti/wlcore/acx.c
+++ b/drivers/net/wireless/ti/wlcore/acx.c
@@ -1725,7 +1725,7 @@ int wl12xx_acx_config_hangover(struct wl1271 *wl)
         acx->decrease_delta = conf->decrease_delta;
         acx->quiet_time = conf->quiet_time;
         acx->increase_time = conf->increase_time;
-        acx->window_size = acx->window_size;
+        acx->window_size = conf->window_size;
 
         ret = wl1271_cmd_configure(wl, ACX_CONFIG_HANGOVER, acx,
                                    sizeof(*acx));
diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c
index b82661962d33..c26fc2106e5b 100644
--- a/drivers/net/wireless/ti/wlcore/cmd.c
+++ b/drivers/net/wireless/ti/wlcore/cmd.c
@@ -403,7 +403,7 @@ void wl12xx_free_link(struct wl1271 *wl, struct wl12xx_vif *wlvif, u8 *hlid)
         WARN_ON_ONCE(wl->active_link_count < 0);
 }
 
-static u8 wlcore_get_native_channel_type(u8 nl_channel_type)
+u8 wlcore_get_native_channel_type(u8 nl_channel_type)
 {
         switch (nl_channel_type) {
         case NL80211_CHAN_NO_HT:
@@ -419,6 +419,7 @@ static u8 wlcore_get_native_channel_type(u8 nl_channel_type)
                 return WLCORE_CHAN_NO_HT;
         }
 }
+EXPORT_SYMBOL_GPL(wlcore_get_native_channel_type);
 
 static int wl12xx_cmd_role_start_dev(struct wl1271 *wl,
                                      struct wl12xx_vif *wlvif,
@@ -1686,9 +1687,7 @@ int wlcore_cmd_regdomain_config_locked(struct wl1271 *wl)
 {
         struct wl12xx_cmd_regdomain_dfs_config *cmd = NULL;
         int ret = 0, i, b, ch_bit_idx;
-        struct ieee80211_channel *channel;
         u32 tmp_ch_bitmap[2];
-        u16 ch;
         struct wiphy *wiphy = wl->hw->wiphy;
         struct ieee80211_supported_band *band;
         bool timeout = false;
@@ -1703,12 +1702,16 @@ int wlcore_cmd_regdomain_config_locked(struct wl1271 *wl)
         for (b = IEEE80211_BAND_2GHZ; b <= IEEE80211_BAND_5GHZ; b++) {
                 band = wiphy->bands[b];
                 for (i = 0; i < band->n_channels; i++) {
-                        channel = &band->channels[i];
-                        ch = channel->hw_value;
+                        struct ieee80211_channel *channel = &band->channels[i];
+                        u16 ch = channel->hw_value;
+                        u32 flags = channel->flags;
 
-                        if (channel->flags & (IEEE80211_CHAN_DISABLED |
-                                              IEEE80211_CHAN_RADAR |
-                                              IEEE80211_CHAN_NO_IR))
+                        if (flags & (IEEE80211_CHAN_DISABLED |
+                                     IEEE80211_CHAN_NO_IR))
+                                continue;
+
+                        if ((flags & IEEE80211_CHAN_RADAR) &&
+                            channel->dfs_state != NL80211_DFS_AVAILABLE)
                                 continue;
 
                         ch_bit_idx = wlcore_get_reg_conf_ch_idx(b, ch);
@@ -1733,6 +1736,7 @@ int wlcore_cmd_regdomain_config_locked(struct wl1271 *wl)
 
         cmd->ch_bit_map1 = cpu_to_le32(tmp_ch_bitmap[0]);
         cmd->ch_bit_map2 = cpu_to_le32(tmp_ch_bitmap[1]);
+        cmd->dfs_region = wl->dfs_region;
 
         wl1271_debug(DEBUG_CMD,
                      "cmd reg domain bitmap1: 0x%08x, bitmap2: 0x%08x",
diff --git a/drivers/net/wireless/ti/wlcore/cmd.h b/drivers/net/wireless/ti/wlcore/cmd.h
index 453684a71d30..e14cd407a6ae 100644
--- a/drivers/net/wireless/ti/wlcore/cmd.h
+++ b/drivers/net/wireless/ti/wlcore/cmd.h
@@ -105,6 +105,7 @@ int wl12xx_allocate_link(struct wl1271 *wl, struct wl12xx_vif *wlvif,
 void wl12xx_free_link(struct wl1271 *wl, struct wl12xx_vif *wlvif, u8 *hlid);
 int wlcore_cmd_wait_for_event_or_timeout(struct wl1271 *wl,
                                          u32 mask, bool *timeout);
+u8 wlcore_get_native_channel_type(u8 nl_channel_type);
 
 enum wl1271_commands {
         CMD_INTERROGATE = 1, /* use this to read information elements */
@@ -172,6 +173,11 @@ enum wl1271_commands {
         CMD_SMART_CONFIG_STOP           = 62,
         CMD_SMART_CONFIG_SET_GROUP_KEY  = 63,
 
+        CMD_CAC_START                   = 64,
+        CMD_CAC_STOP                    = 65,
+        CMD_DFS_MASTER_RESTART          = 66,
+        CMD_DFS_RADAR_DETECTION_DEBUG   = 67,
+
         MAX_COMMAND_ID = 0xFFFF,
 };
 
@@ -642,6 +648,8 @@ struct wl12xx_cmd_regdomain_dfs_config {
 
         __le32 ch_bit_map1;
         __le32 ch_bit_map2;
+        u8 dfs_region;
+        u8 padding[3];
 } __packed;
 
 struct wl12xx_cmd_config_fwlog {
diff --git a/drivers/net/wireless/ti/wlcore/conf.h b/drivers/net/wireless/ti/wlcore/conf.h
index 40995c42bef8..166add00b50f 100644
--- a/drivers/net/wireless/ti/wlcore/conf.h
+++ b/drivers/net/wireless/ti/wlcore/conf.h
@@ -997,6 +997,11 @@ struct conf_conn_settings {
          * whether we can go to ELP.
          */
         u8 sta_sleep_auth;
+
+        /*
+         * Default RX BA Activity filter configuration
+         */
+        u8 suspend_rx_ba_activity;
 } __packed;
 
 enum {
@@ -1347,7 +1352,7 @@ struct conf_recovery_settings {
  * version, the two LSB are the lower driver's private conf
  * version.
  */
-#define WLCORE_CONF_VERSION     (0x0005 << 16)
+#define WLCORE_CONF_VERSION     (0x0006 << 16)
 #define WLCORE_CONF_MASK        0xffff0000
 #define WLCORE_CONF_SIZE        (sizeof(struct wlcore_conf_header) +    \
                                  sizeof(struct wlcore_conf))
diff --git a/drivers/net/wireless/ti/wlcore/debugfs.c b/drivers/net/wireless/ti/wlcore/debugfs.c
index 0be21f62fcb0..68f3bf229b5a 100644
--- a/drivers/net/wireless/ti/wlcore/debugfs.c
+++ b/drivers/net/wireless/ti/wlcore/debugfs.c
@@ -929,17 +929,10 @@ static ssize_t beacon_filtering_write(struct file *file,
 {
         struct wl1271 *wl = file->private_data;
         struct wl12xx_vif *wlvif;
-        char buf[10];
-        size_t len;
         unsigned long value;
         int ret;
 
-        len = min(count, sizeof(buf) - 1);
-        if (copy_from_user(buf, user_buf, len))
-                return -EFAULT;
-        buf[len] = '\0';
-
-        ret = kstrtoul(buf, 0, &value);
+        ret = kstrtoul_from_user(user_buf, count, 0, &value);
         if (ret < 0) {
                 wl1271_warning("illegal value for beacon_filtering!");
                 return -EINVAL;
diff --git a/drivers/net/wireless/ti/wlcore/event.c b/drivers/net/wireless/ti/wlcore/event.c
index 5153640f4532..c42e78955e7b 100644
--- a/drivers/net/wireless/ti/wlcore/event.c
+++ b/drivers/net/wireless/ti/wlcore/event.c
@@ -139,7 +139,7 @@ void wlcore_event_channel_switch(struct wl1271 *wl,
         wl1271_debug(DEBUG_EVENT, "%s: roles=0x%lx success=%d",
                      __func__, roles_bitmap, success);
 
-        wl12xx_for_each_wlvif_sta(wl, wlvif) {
+        wl12xx_for_each_wlvif(wl, wlvif) {
                 if (wlvif->role_id == WL12XX_INVALID_ROLE_ID ||
                     !test_bit(wlvif->role_id , &roles_bitmap))
                         continue;
@@ -150,8 +150,13 @@ void wlcore_event_channel_switch(struct wl1271 *wl,
 
                 vif = wl12xx_wlvif_to_vif(wlvif);
 
-                ieee80211_chswitch_done(vif, success);
-                cancel_delayed_work(&wlvif->channel_switch_work);
+                if (wlvif->bss_type == BSS_TYPE_STA_BSS) {
+                        ieee80211_chswitch_done(vif, success);
+                        cancel_delayed_work(&wlvif->channel_switch_work);
+                } else {
+                        set_bit(WLVIF_FLAG_BEACON_DISABLED, &wlvif->flags);
+                        ieee80211_csa_finish(vif);
+                }
         }
 }
 EXPORT_SYMBOL_GPL(wlcore_event_channel_switch);
diff --git a/drivers/net/wireless/ti/wlcore/hw_ops.h b/drivers/net/wireless/ti/wlcore/hw_ops.h
index aa9f82c72296..eec56935b1b6 100644
--- a/drivers/net/wireless/ti/wlcore/hw_ops.h
+++ b/drivers/net/wireless/ti/wlcore/hw_ops.h
@@ -211,11 +211,35 @@ wlcore_hw_pre_pkt_send(struct wl1271 *wl, u32 buf_offset, u32 last_len)
 }
 
 static inline void
-wlcore_hw_sta_rc_update(struct wl1271 *wl, struct wl12xx_vif *wlvif,
-                        struct ieee80211_sta *sta, u32 changed)
+wlcore_hw_sta_rc_update(struct wl1271 *wl, struct wl12xx_vif *wlvif)
 {
         if (wl->ops->sta_rc_update)
-                wl->ops->sta_rc_update(wl, wlvif, sta, changed);
+                wl->ops->sta_rc_update(wl, wlvif);
+}
+
+static inline int
+wlcore_hw_interrupt_notify(struct wl1271 *wl, bool action)
+{
+        if (wl->ops->interrupt_notify)
+                return wl->ops->interrupt_notify(wl, action);
+        return 0;
+}
+
+static inline int
+wlcore_hw_rx_ba_filter(struct wl1271 *wl, bool action)
+{
+        if (wl->ops->rx_ba_filter)
+                return wl->ops->rx_ba_filter(wl, action);
+        return 0;
+}
+
+static inline int
+wlcore_hw_ap_sleep(struct wl1271 *wl)
+{
+        if (wl->ops->ap_sleep)
+                return wl->ops->ap_sleep(wl);
+
+        return 0;
 }
 
 static inline int
@@ -287,4 +311,22 @@ wlcore_smart_config_set_group_key(struct wl1271 *wl, u16 group_id,
 
         return wl->ops->smart_config_set_group_key(wl, group_id, key_len, key);
 }
+
+static inline int
+wlcore_hw_set_cac(struct wl1271 *wl, struct wl12xx_vif *wlvif, bool start)
+{
+        if (!wl->ops->set_cac)
+                return -EINVAL;
+
+        return wl->ops->set_cac(wl, wlvif, start);
+}
+
+static inline int
+wlcore_hw_dfs_master_restart(struct wl1271 *wl, struct wl12xx_vif *wlvif)
+{
+        if (!wl->ops->dfs_master_restart)
+                return -EINVAL;
+
+        return wl->ops->dfs_master_restart(wl, wlvif);
+}
 #endif
diff --git a/drivers/net/wireless/ti/wlcore/init.c b/drivers/net/wireless/ti/wlcore/init.c
index 199e94120864..5ca1fb161a50 100644
--- a/drivers/net/wireless/ti/wlcore/init.c
+++ b/drivers/net/wireless/ti/wlcore/init.c
@@ -392,6 +392,11 @@ static int wl1271_ap_hw_init(struct wl1271 *wl, struct wl12xx_vif *wlvif)
         if (ret < 0)
                 return ret;
 
+        /* configure AP sleep, if enabled */
+        ret = wlcore_hw_ap_sleep(wl);
+        if (ret < 0)
+                return ret;
+
         return 0;
 }
 
@@ -567,8 +572,7 @@ int wl1271_init_vif_specific(struct wl1271 *wl, struct ieee80211_vif *vif)
         /* consider all existing roles before configuring psm. */
 
         if (wl->ap_count == 0 && is_ap) { /* first AP */
-                /* Configure for power always on */
-                ret = wl1271_acx_sleep_auth(wl, WL1271_PSM_CAM);
+                ret = wl1271_acx_sleep_auth(wl, WL1271_PSM_ELP);
                 if (ret < 0)
                         return ret;
 
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index a2133b1fd631..1e136993580f 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -79,22 +79,12 @@ static int wl12xx_set_authorized(struct wl1271 *wl, struct wl12xx_vif *wlvif)
 static void wl1271_reg_notify(struct wiphy *wiphy,
                               struct regulatory_request *request)
 {
-        struct ieee80211_supported_band *band;
-        struct ieee80211_channel *ch;
-        int i;
         struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
         struct wl1271 *wl = hw->priv;
 
-        band = wiphy->bands[IEEE80211_BAND_5GHZ];
-        for (i = 0; i < band->n_channels; i++) {
-                ch = &band->channels[i];
-                if (ch->flags & IEEE80211_CHAN_DISABLED)
-                        continue;
-
-                if (ch->flags & IEEE80211_CHAN_RADAR)
-                        ch->flags |= IEEE80211_CHAN_NO_IR;
-
-        }
+        /* copy the current dfs region */
+        if (request)
+                wl->dfs_region = request->dfs_region;
 
         wlcore_regdomain_config(wl);
 }
@@ -226,6 +216,29 @@ void wl12xx_rearm_tx_watchdog_locked(struct wl1271 *wl)
                 msecs_to_jiffies(wl->conf.tx.tx_watchdog_timeout));
 }
 
+static void wlcore_rc_update_work(struct work_struct *work)
+{
+        int ret;
+        struct wl12xx_vif *wlvif = container_of(work, struct wl12xx_vif,
+                                                rc_update_work);
+        struct wl1271 *wl = wlvif->wl;
+
+        mutex_lock(&wl->mutex);
+
+        if (unlikely(wl->state != WLCORE_STATE_ON))
+                goto out;
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
+        wlcore_hw_sta_rc_update(wl, wlvif);
+
+        wl1271_ps_elp_sleep(wl);
+out:
+        mutex_unlock(&wl->mutex);
+}
+
 static void wl12xx_tx_watchdog_work(struct work_struct *work)
 {
         struct delayed_work *dwork;
@@ -1662,19 +1675,15 @@ static int wl1271_configure_suspend_sta(struct wl1271 *wl,
         if (!test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags))
                 goto out;
 
-        ret = wl1271_ps_elp_wakeup(wl);
-        if (ret < 0)
-                goto out;
-
         ret = wl1271_configure_wowlan(wl, wow);
         if (ret < 0)
-                goto out_sleep;
+                goto out;
 
         if ((wl->conf.conn.suspend_wake_up_event ==
              wl->conf.conn.wake_up_event) &&
             (wl->conf.conn.suspend_listen_interval ==
              wl->conf.conn.listen_interval))
-                goto out_sleep;
+                goto out;
 
         ret = wl1271_acx_wake_up_conditions(wl, wlvif,
                                     wl->conf.conn.suspend_wake_up_event,
@@ -1682,29 +1691,28 @@ static int wl1271_configure_suspend_sta(struct wl1271 *wl,
 
         if (ret < 0)
                 wl1271_error("suspend: set wake up conditions failed: %d", ret);
-
-out_sleep:
-        wl1271_ps_elp_sleep(wl);
 out:
         return ret;
 
 }
 
 static int wl1271_configure_suspend_ap(struct wl1271 *wl,
-                                       struct wl12xx_vif *wlvif)
+                                        struct wl12xx_vif *wlvif,
+                                        struct cfg80211_wowlan *wow)
 {
         int ret = 0;
 
         if (!test_bit(WLVIF_FLAG_AP_STARTED, &wlvif->flags))
                 goto out;
 
-        ret = wl1271_ps_elp_wakeup(wl);
+        ret = wl1271_acx_beacon_filter_opt(wl, wlvif, true);
         if (ret < 0)
                 goto out;
 
-        ret = wl1271_acx_beacon_filter_opt(wl, wlvif, true);
+        ret = wl1271_configure_wowlan(wl, wow);
+        if (ret < 0)
+                goto out;
 
-        wl1271_ps_elp_sleep(wl);
 out:
         return ret;
 
@@ -1717,7 +1725,7 @@ static int wl1271_configure_suspend(struct wl1271 *wl,
         if (wlvif->bss_type == BSS_TYPE_STA_BSS)
                 return wl1271_configure_suspend_sta(wl, wlvif, wow);
         if (wlvif->bss_type == BSS_TYPE_AP_BSS)
-                return wl1271_configure_suspend_ap(wl, wlvif);
+                return wl1271_configure_suspend_ap(wl, wlvif, wow);
         return 0;
 }
 
@@ -1730,21 +1738,18 @@ static void wl1271_configure_resume(struct wl1271 *wl, struct wl12xx_vif *wlvif)
         if ((!is_ap) && (!is_sta))
                 return;
 
-        if (is_sta && !test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags))
+        if ((is_sta && !test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags)) ||
+            (is_ap && !test_bit(WLVIF_FLAG_AP_STARTED, &wlvif->flags)))
                 return;
 
-        ret = wl1271_ps_elp_wakeup(wl);
-        if (ret < 0)
-                return;
+        wl1271_configure_wowlan(wl, NULL);
 
         if (is_sta) {
-                wl1271_configure_wowlan(wl, NULL);
-
                 if ((wl->conf.conn.suspend_wake_up_event ==
                      wl->conf.conn.wake_up_event) &&
                     (wl->conf.conn.suspend_listen_interval ==
                      wl->conf.conn.listen_interval))
-                        goto out_sleep;
+                        return;
 
                 ret = wl1271_acx_wake_up_conditions(wl, wlvif,
                                     wl->conf.conn.wake_up_event,
@@ -1757,9 +1762,6 @@ static void wl1271_configure_resume(struct wl1271 *wl, struct wl12xx_vif *wlvif)
         } else if (is_ap) {
                 ret = wl1271_acx_beacon_filter_opt(wl, wlvif, false);
         }
-
-out_sleep:
-        wl1271_ps_elp_sleep(wl);
 }
 
 static int wl1271_op_suspend(struct ieee80211_hw *hw,
@@ -1781,6 +1783,13 @@ static int wl1271_op_suspend(struct ieee80211_hw *hw,
         wl1271_tx_flush(wl);
 
         mutex_lock(&wl->mutex);
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0) {
+                mutex_unlock(&wl->mutex);
+                return ret;
+        }
+
         wl->wow_enabled = true;
         wl12xx_for_each_wlvif(wl, wlvif) {
                 ret = wl1271_configure_suspend(wl, wlvif, wow);
@@ -1790,7 +1799,27 @@ static int wl1271_op_suspend(struct ieee80211_hw *hw,
                         return ret;
                 }
         }
+
+        /* disable fast link flow control notifications from FW */
+        ret = wlcore_hw_interrupt_notify(wl, false);
+        if (ret < 0)
+                goto out_sleep;
+
+        /* if filtering is enabled, configure the FW to drop all RX BA frames */
+        ret = wlcore_hw_rx_ba_filter(wl,
+                                     !!wl->conf.conn.suspend_rx_ba_activity);
+        if (ret < 0)
+                goto out_sleep;
+
+out_sleep:
+        wl1271_ps_elp_sleep(wl);
         mutex_unlock(&wl->mutex);
+
+        if (ret < 0) {
+                wl1271_warning("couldn't prepare device to suspend");
+                return ret;
+        }
+
         /* flush any remaining work */
         wl1271_debug(DEBUG_MAC80211, "flushing remaining works");
 
@@ -1864,13 +1893,29 @@ static int wl1271_op_resume(struct ieee80211_hw *hw)
         if (pending_recovery) {
                 wl1271_warning("queuing forgotten recovery on resume");
                 ieee80211_queue_work(wl->hw, &wl->recovery_work);
-                goto out;
+                goto out_sleep;
         }
 
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
         wl12xx_for_each_wlvif(wl, wlvif) {
                 wl1271_configure_resume(wl, wlvif);
         }
 
+        ret = wlcore_hw_interrupt_notify(wl, true);
+        if (ret < 0)
+                goto out_sleep;
+
+        /* if filtering is enabled, configure the FW to drop all RX BA frames */
+        ret = wlcore_hw_rx_ba_filter(wl, false);
+        if (ret < 0)
+                goto out_sleep;
+
+out_sleep:
+        wl1271_ps_elp_sleep(wl);
+
 out:
         wl->wow_enabled = false;
 
@@ -2279,6 +2324,7 @@ static int wl12xx_init_vif_data(struct wl1271 *wl, struct ieee80211_vif *vif)
                   wl1271_rx_streaming_enable_work);
         INIT_WORK(&wlvif->rx_streaming_disable_work,
                   wl1271_rx_streaming_disable_work);
+        INIT_WORK(&wlvif->rc_update_work, wlcore_rc_update_work);
         INIT_DELAYED_WORK(&wlvif->channel_switch_work,
                           wlcore_channel_switch_work);
         INIT_DELAYED_WORK(&wlvif->connection_loss_work,
@@ -2724,6 +2770,7 @@ unlock:
         del_timer_sync(&wlvif->rx_streaming_timer);
         cancel_work_sync(&wlvif->rx_streaming_enable_work);
         cancel_work_sync(&wlvif->rx_streaming_disable_work);
+        cancel_work_sync(&wlvif->rc_update_work);
         cancel_delayed_work_sync(&wlvif->connection_loss_work);
         cancel_delayed_work_sync(&wlvif->channel_switch_work);
         cancel_delayed_work_sync(&wlvif->pending_auth_complete_work);
@@ -4073,8 +4120,14 @@ static int wl1271_bss_beacon_info_changed(struct wl1271 *wl,
                 ret = wlcore_set_beacon_template(wl, vif, is_ap);
                 if (ret < 0)
                         goto out;
-        }
 
+                if (test_and_clear_bit(WLVIF_FLAG_BEACON_DISABLED,
+                                       &wlvif->flags)) {
+                        ret = wlcore_hw_dfs_master_restart(wl, wlvif);
+                        if (ret < 0)
+                                goto out;
+                }
+        }
 out:
         if (ret != 0)
                 wl1271_error("beacon info change failed: %d", ret);
@@ -4575,10 +4628,46 @@ static void wlcore_op_change_chanctx(struct ieee80211_hw *hw,
                                      struct ieee80211_chanctx_conf *ctx,
                                      u32 changed)
 {
+        struct wl1271 *wl = hw->priv;
+        struct wl12xx_vif *wlvif;
+        int ret;
+        int channel = ieee80211_frequency_to_channel(
+                ctx->def.chan->center_freq);
+
         wl1271_debug(DEBUG_MAC80211,
                      "mac80211 change chanctx %d (type %d) changed 0x%x",
-                     ieee80211_frequency_to_channel(ctx->def.chan->center_freq),
-                     cfg80211_get_chandef_type(&ctx->def), changed);
+                     channel, cfg80211_get_chandef_type(&ctx->def), changed);
+
+        mutex_lock(&wl->mutex);
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
+        wl12xx_for_each_wlvif(wl, wlvif) {
+                struct ieee80211_vif *vif = wl12xx_wlvif_to_vif(wlvif);
+
+                rcu_read_lock();
+                if (rcu_access_pointer(vif->chanctx_conf) != ctx) {
+                        rcu_read_unlock();
+                        continue;
+                }
+                rcu_read_unlock();
+
+                /* start radar if needed */
+                if (changed & IEEE80211_CHANCTX_CHANGE_RADAR &&
+                    wlvif->bss_type == BSS_TYPE_AP_BSS &&
+                    ctx->radar_enabled && !wlvif->radar_enabled &&
+                    ctx->def.chan->dfs_state == NL80211_DFS_USABLE) {
+                        wl1271_debug(DEBUG_MAC80211, "Start radar detection");
+                        wlcore_hw_set_cac(wl, wlvif, true);
+                        wlvif->radar_enabled = true;
+                }
+        }
+
+        wl1271_ps_elp_sleep(wl);
+out:
+        mutex_unlock(&wl->mutex);
 }
 
 static int wlcore_op_assign_vif_chanctx(struct ieee80211_hw *hw,
@@ -4589,13 +4678,26 @@ static int wlcore_op_assign_vif_chanctx(struct ieee80211_hw *hw,
         struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
         int channel = ieee80211_frequency_to_channel(
                 ctx->def.chan->center_freq);
+        int ret = -EINVAL;
 
         wl1271_debug(DEBUG_MAC80211,
-                     "mac80211 assign chanctx (role %d) %d (type %d)",
-                     wlvif->role_id, channel, cfg80211_get_chandef_type(&ctx->def));
+                     "mac80211 assign chanctx (role %d) %d (type %d) (radar %d dfs_state %d)",
+                     wlvif->role_id, channel,
+                     cfg80211_get_chandef_type(&ctx->def),
+                     ctx->radar_enabled, ctx->def.chan->dfs_state);
 
         mutex_lock(&wl->mutex);
 
+        if (unlikely(wl->state != WLCORE_STATE_ON))
+                goto out;
+
+        if (unlikely(!test_bit(WLVIF_FLAG_INITIALIZED, &wlvif->flags)))
+                goto out;
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
         wlvif->band = ctx->def.chan->band;
         wlvif->channel = channel;
         wlvif->channel_type = cfg80211_get_chandef_type(&ctx->def);
@@ -4603,6 +4705,15 @@ static int wlcore_op_assign_vif_chanctx(struct ieee80211_hw *hw,
         /* update default rates according to the band */
         wl1271_set_band_rate(wl, wlvif);
 
+        if (ctx->radar_enabled &&
+            ctx->def.chan->dfs_state == NL80211_DFS_USABLE) {
+                wl1271_debug(DEBUG_MAC80211, "Start radar detection");
+                wlcore_hw_set_cac(wl, wlvif, true);
+                wlvif->radar_enabled = true;
+        }
+
+        wl1271_ps_elp_sleep(wl);
+out:
         mutex_unlock(&wl->mutex);
 
         return 0;
@@ -4614,6 +4725,7 @@ static void wlcore_op_unassign_vif_chanctx(struct ieee80211_hw *hw,
 {
         struct wl1271 *wl = hw->priv;
         struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
+        int ret;
 
         wl1271_debug(DEBUG_MAC80211,
                      "mac80211 unassign chanctx (role %d) %d (type %d)",
@@ -4622,6 +4734,99 @@ static void wlcore_op_unassign_vif_chanctx(struct ieee80211_hw *hw,
                      cfg80211_get_chandef_type(&ctx->def));
 
         wl1271_tx_flush(wl);
+
+        mutex_lock(&wl->mutex);
+
+        if (unlikely(wl->state != WLCORE_STATE_ON))
+                goto out;
+
+        if (unlikely(!test_bit(WLVIF_FLAG_INITIALIZED, &wlvif->flags)))
+                goto out;
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
+        if (wlvif->radar_enabled) {
+                wl1271_debug(DEBUG_MAC80211, "Stop radar detection");
+                wlcore_hw_set_cac(wl, wlvif, false);
+                wlvif->radar_enabled = false;
+        }
+
+        wl1271_ps_elp_sleep(wl);
+out:
+        mutex_unlock(&wl->mutex);
+}
+
+static int __wlcore_switch_vif_chan(struct wl1271 *wl,
+                                    struct wl12xx_vif *wlvif,
+                                    struct ieee80211_chanctx_conf *new_ctx)
+{
+        int channel = ieee80211_frequency_to_channel(
+                new_ctx->def.chan->center_freq);
+
+        wl1271_debug(DEBUG_MAC80211,
+                     "switch vif (role %d) %d -> %d chan_type: %d",
+                     wlvif->role_id, wlvif->channel, channel,
+                     cfg80211_get_chandef_type(&new_ctx->def));
+
+        if (WARN_ON_ONCE(wlvif->bss_type != BSS_TYPE_AP_BSS))
+                return 0;
+
+        WARN_ON(!test_bit(WLVIF_FLAG_BEACON_DISABLED, &wlvif->flags));
+
+        if (wlvif->radar_enabled) {
+                wl1271_debug(DEBUG_MAC80211, "Stop radar detection");
+                wlcore_hw_set_cac(wl, wlvif, false);
+                wlvif->radar_enabled = false;
+        }
+
+        wlvif->band = new_ctx->def.chan->band;
+        wlvif->channel = channel;
+        wlvif->channel_type = cfg80211_get_chandef_type(&new_ctx->def);
+
+        /* start radar if needed */
+        if (new_ctx->radar_enabled) {
+                wl1271_debug(DEBUG_MAC80211, "Start radar detection");
+                wlcore_hw_set_cac(wl, wlvif, true);
+                wlvif->radar_enabled = true;
+        }
+
+        return 0;
+}
+
+static int
+wlcore_op_switch_vif_chanctx(struct ieee80211_hw *hw,
+                             struct ieee80211_vif_chanctx_switch *vifs,
+                             int n_vifs,
+                             enum ieee80211_chanctx_switch_mode mode)
+{
+        struct wl1271 *wl = hw->priv;
+        int i, ret;
+
+        wl1271_debug(DEBUG_MAC80211,
+                     "mac80211 switch chanctx n_vifs %d mode %d",
+                     n_vifs, mode);
+
+        mutex_lock(&wl->mutex);
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
+        for (i = 0; i < n_vifs; i++) {
+                struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vifs[i].vif);
+
+                ret = __wlcore_switch_vif_chan(wl, wlvif, vifs[i].new_ctx);
+                if (ret)
+                        goto out_sleep;
+        }
+out_sleep:
+        wl1271_ps_elp_sleep(wl);
+out:
+        mutex_unlock(&wl->mutex);
+
+        return 0;
 }
 
 static int wl1271_op_conf_tx(struct ieee80211_hw *hw,
@@ -5229,6 +5434,83 @@ out:
         mutex_unlock(&wl->mutex);
 }
 
+static const void *wlcore_get_beacon_ie(struct wl1271 *wl,
+                                        struct wl12xx_vif *wlvif,
+                                        u8 eid)
+{
+        int ieoffset = offsetof(struct ieee80211_mgmt, u.beacon.variable);
+        struct sk_buff *beacon =
+                ieee80211_beacon_get(wl->hw, wl12xx_wlvif_to_vif(wlvif));
+
+        if (!beacon)
+                return NULL;
+
+        return cfg80211_find_ie(eid,
+                                beacon->data + ieoffset,
+                                beacon->len - ieoffset);
+}
+
+static int wlcore_get_csa_count(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                                u8 *csa_count)
+{
+        const u8 *ie;
+        const struct ieee80211_channel_sw_ie *ie_csa;
+
+        ie = wlcore_get_beacon_ie(wl, wlvif, WLAN_EID_CHANNEL_SWITCH);
+        if (!ie)
+                return -EINVAL;
+
+        ie_csa = (struct ieee80211_channel_sw_ie *)&ie[2];
+        *csa_count = ie_csa->count;
+
+        return 0;
+}
+
+static void wlcore_op_channel_switch_beacon(struct ieee80211_hw *hw,
+                                            struct ieee80211_vif *vif,
+                                            struct cfg80211_chan_def *chandef)
+{
+        struct wl1271 *wl = hw->priv;
+        struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
+        struct ieee80211_channel_switch ch_switch = {
+                .block_tx = true,
+                .chandef = *chandef,
+        };
+        int ret;
+
+        wl1271_debug(DEBUG_MAC80211,
+                     "mac80211 channel switch beacon (role %d)",
+                     wlvif->role_id);
+
+        ret = wlcore_get_csa_count(wl, wlvif, &ch_switch.count);
+        if (ret < 0) {
+                wl1271_error("error getting beacon (for CSA counter)");
+                return;
+        }
+
+        mutex_lock(&wl->mutex);
+
+        if (unlikely(wl->state != WLCORE_STATE_ON)) {
+                ret = -EBUSY;
+                goto out;
+        }
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
+        ret = wl->ops->channel_switch(wl, wlvif, &ch_switch);
+        if (ret)
+                goto out_sleep;
+
+        set_bit(WLVIF_FLAG_CS_PROGRESS, &wlvif->flags);
+
+out_sleep:
+        wl1271_ps_elp_sleep(wl);
+out:
+        mutex_unlock(&wl->mutex);
+}
+
 static void wlcore_op_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                             u32 queues, bool drop)
 {
@@ -5371,9 +5653,15 @@ static void wlcore_op_sta_rc_update(struct ieee80211_hw *hw,
                                     u32 changed)
 {
         struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
-        struct wl1271 *wl = hw->priv;
 
-        wlcore_hw_sta_rc_update(wl, wlvif, sta, changed);
+        wl1271_debug(DEBUG_MAC80211, "mac80211 sta_rc_update");
+
+        if (!(changed & IEEE80211_RC_BW_CHANGED))
+                return;
+
+        /* this callback is atomic, so schedule a new work */
+        wlvif->rc_update_bw = sta->bandwidth;
+        ieee80211_queue_work(hw, &wlvif->rc_update_work);
 }
 
 static void wlcore_op_sta_statistics(struct ieee80211_hw *hw,
@@ -5599,6 +5887,7 @@ static const struct ieee80211_ops wl1271_ops = {
         .set_bitrate_mask = wl12xx_set_bitrate_mask,
         .set_default_unicast_key = wl1271_op_set_default_key_idx,
         .channel_switch = wl12xx_op_channel_switch,
+        .channel_switch_beacon = wlcore_op_channel_switch_beacon,
         .flush = wlcore_op_flush,
         .remain_on_channel = wlcore_op_remain_on_channel,
         .cancel_remain_on_channel = wlcore_op_cancel_remain_on_channel,
@@ -5607,6 +5896,7 @@ static const struct ieee80211_ops wl1271_ops = {
         .change_chanctx = wlcore_op_change_chanctx,
         .assign_vif_chanctx = wlcore_op_assign_vif_chanctx,
         .unassign_vif_chanctx = wlcore_op_unassign_vif_chanctx,
+        .switch_vif_chanctx = wlcore_op_switch_vif_chanctx,
         .sta_rc_update = wlcore_op_sta_rc_update,
         .sta_statistics = wlcore_op_sta_statistics,
         CFG80211_TESTMODE_CMD(wl1271_tm_cmd)
@@ -5813,7 +6103,8 @@ static int wl1271_init_ieee80211(struct wl1271 *wl)
 
         wl->hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD |
                                 WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
-                                WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
+                                WIPHY_FLAG_SUPPORTS_SCHED_SCAN |
+                                WIPHY_FLAG_HAS_CHANNEL_SWITCH;
 
         /* make sure all our channels fit in the scanned_ch bitmask */
         BUILD_BUG_ON(ARRAY_SIZE(wl1271_channels) +
diff --git a/drivers/net/wireless/ti/wlcore/ps.c b/drivers/net/wireless/ti/wlcore/ps.c
index b52516eed7b2..4cd316e61466 100644
--- a/drivers/net/wireless/ti/wlcore/ps.c
+++ b/drivers/net/wireless/ti/wlcore/ps.c
@@ -56,9 +56,6 @@ void wl1271_elp_work(struct work_struct *work)
                 goto out;
 
         wl12xx_for_each_wlvif(wl, wlvif) {
-                if (wlvif->bss_type == BSS_TYPE_AP_BSS)
-                        goto out;
-
                 if (!test_bit(WLVIF_FLAG_IN_PS, &wlvif->flags) &&
                     test_bit(WLVIF_FLAG_IN_USE, &wlvif->flags))
                         goto out;
@@ -95,9 +92,6 @@ void wl1271_ps_elp_sleep(struct wl1271 *wl)
                 return;
 
         wl12xx_for_each_wlvif(wl, wlvif) {
-                if (wlvif->bss_type == BSS_TYPE_AP_BSS)
-                        return;
-
                 if (!test_bit(WLVIF_FLAG_IN_PS, &wlvif->flags) &&
                     test_bit(WLVIF_FLAG_IN_USE, &wlvif->flags))
                         return;
@@ -108,6 +102,7 @@ void wl1271_ps_elp_sleep(struct wl1271 *wl)
         ieee80211_queue_delayed_work(wl->hw, &wl->elp_work,
                                      msecs_to_jiffies(timeout));
 }
+EXPORT_SYMBOL_GPL(wl1271_ps_elp_sleep);
 
 int wl1271_ps_elp_wakeup(struct wl1271 *wl)
 {
@@ -175,6 +170,7 @@ err:
 out:
         return 0;
 }
+EXPORT_SYMBOL_GPL(wl1271_ps_elp_wakeup);
 
 int wl1271_ps_set_mode(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                        enum wl1271_cmd_ps_mode mode)
diff --git a/drivers/net/wireless/ti/wlcore/vendor_cmd.c b/drivers/net/wireless/ti/wlcore/vendor_cmd.c
index ad86a48dcfcb..fd4e9ba176c9 100644
--- a/drivers/net/wireless/ti/wlcore/vendor_cmd.c
+++ b/drivers/net/wireless/ti/wlcore/vendor_cmd.c
@@ -21,7 +21,7 @@ static const
 struct nla_policy wlcore_vendor_attr_policy[NUM_WLCORE_VENDOR_ATTR] = {
         [WLCORE_VENDOR_ATTR_FREQ]               = { .type = NLA_U32 },
         [WLCORE_VENDOR_ATTR_GROUP_ID]           = { .type = NLA_U32 },
-        [WLCORE_VENDOR_ATTR_GROUP_KEY]          = { .type = NLA_U32,
+        [WLCORE_VENDOR_ATTR_GROUP_KEY]          = { .type = NLA_BINARY,
                                                     .len = WLAN_MAX_KEY_LEN },
 };
 
diff --git a/drivers/net/wireless/ti/wlcore/wlcore.h b/drivers/net/wireless/ti/wlcore/wlcore.h
index df78cf12ef15..d599c869e6e8 100644
--- a/drivers/net/wireless/ti/wlcore/wlcore.h
+++ b/drivers/net/wireless/ti/wlcore/wlcore.h
@@ -106,8 +106,7 @@ struct wlcore_ops {
                               struct wl12xx_vif *wlvif,
                               struct ieee80211_channel_switch *ch_switch);
         u32 (*pre_pkt_send)(struct wl1271 *wl, u32 buf_offset, u32 last_len);
-        void (*sta_rc_update)(struct wl1271 *wl, struct wl12xx_vif *wlvif,
-                              struct ieee80211_sta *sta, u32 changed);
+        void (*sta_rc_update)(struct wl1271 *wl, struct wl12xx_vif *wlvif);
         int (*set_peer_cap)(struct wl1271 *wl,
                             struct ieee80211_sta_ht_cap *ht_cap,
                             bool allow_ht_operation,
@@ -117,10 +116,16 @@ struct wlcore_ops {
                               struct wl1271_link *lnk);
         bool (*lnk_low_prio)(struct wl1271 *wl, u8 hlid,
                              struct wl1271_link *lnk);
+        int (*interrupt_notify)(struct wl1271 *wl, bool action);
+        int (*rx_ba_filter)(struct wl1271 *wl, bool action);
+        int (*ap_sleep)(struct wl1271 *wl);
         int (*smart_config_start)(struct wl1271 *wl, u32 group_bitmap);
         int (*smart_config_stop)(struct wl1271 *wl);
         int (*smart_config_set_group_key)(struct wl1271 *wl, u16 group_id,
                                           u8 key_len, u8 *key);
+        int (*set_cac)(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                       bool start);
+        int (*dfs_master_restart)(struct wl1271 *wl, struct wl12xx_vif *wlvif);
 };
 
 enum wlcore_partitions {
@@ -460,6 +465,9 @@ struct wl1271 {
         /* HW HT (11n) capabilities */
         struct ieee80211_sta_ht_cap ht_cap[WLCORE_NUM_BANDS];
 
+        /* the current dfs region */
+        enum nl80211_dfs_regions dfs_region;
+
         /* size of the private FW status data */
         size_t fw_status_len;
         size_t fw_status_priv_len;
diff --git a/drivers/net/wireless/ti/wlcore/wlcore_i.h b/drivers/net/wireless/ti/wlcore/wlcore_i.h
index 0e52556044d9..3396ce5a934d 100644
--- a/drivers/net/wireless/ti/wlcore/wlcore_i.h
+++ b/drivers/net/wireless/ti/wlcore/wlcore_i.h
@@ -251,6 +251,7 @@ enum wl12xx_vif_flags {
         WLVIF_FLAG_AP_PROBE_RESP_SET,
         WLVIF_FLAG_IN_USE,
         WLVIF_FLAG_ACTIVE,
+        WLVIF_FLAG_BEACON_DISABLED,
 };
 
 struct wl12xx_vif;
@@ -434,6 +435,8 @@ struct wl12xx_vif {
 
         bool wmm_enabled;
 
+        bool radar_enabled;
+
         /* Rx Streaming */
         struct work_struct rx_streaming_enable_work;
         struct work_struct rx_streaming_disable_work;
@@ -463,6 +466,10 @@ struct wl12xx_vif {
         /* work for canceling ROC after pending auth reply */
         struct delayed_work pending_auth_complete_work;
 
+        /* update rate conrol */
+        enum ieee80211_sta_rx_bandwidth rc_update_bw;
+        struct work_struct rc_update_work;
+
         /*
          * total freed FW packets on the link.
          * For STA this holds the PN of the link to the AP.
diff --git a/include/linux/bcma/bcma_soc.h b/include/linux/bcma/bcma_soc.h
index f24d245f8394..1b5fc0c3b1b5 100644
--- a/include/linux/bcma/bcma_soc.h
+++ b/include/linux/bcma/bcma_soc.h
@@ -5,8 +5,6 @@
 
 struct bcma_soc {
         struct bcma_bus bus;
-        struct bcma_device core_cc;
-        struct bcma_device core_mips;
 };
 
 int __init bcma_host_soc_register(struct bcma_soc *soc);
diff --git a/include/linux/mmc/sdio_ids.h b/include/linux/mmc/sdio_ids.h
index 0f01fe065424..996807963716 100644
--- a/include/linux/mmc/sdio_ids.h
+++ b/include/linux/mmc/sdio_ids.h
@@ -24,13 +24,15 @@
  * Vendors and devices.  Sort key: vendor first, device next.
  */
 #define SDIO_VENDOR_ID_BROADCOM                 0x02d0
-#define SDIO_DEVICE_ID_BROADCOM_43143           43143
+#define SDIO_DEVICE_ID_BROADCOM_43143           0xa887
 #define SDIO_DEVICE_ID_BROADCOM_43241           0x4324
 #define SDIO_DEVICE_ID_BROADCOM_4329            0x4329
 #define SDIO_DEVICE_ID_BROADCOM_4330            0x4330
 #define SDIO_DEVICE_ID_BROADCOM_4334            0x4334
+#define SDIO_DEVICE_ID_BROADCOM_43340           0xa94c
+#define SDIO_DEVICE_ID_BROADCOM_43341           0xa94d
 #define SDIO_DEVICE_ID_BROADCOM_4335_4339       0x4335
-#define SDIO_DEVICE_ID_BROADCOM_43362           43362
+#define SDIO_DEVICE_ID_BROADCOM_43362           0xa962
 #define SDIO_DEVICE_ID_BROADCOM_4354            0x4354
 
 #define SDIO_VENDOR_ID_INTEL                    0x0089