Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem

89 files changed, 11937 insertions, 1309 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index 7a86b44a4c56..a46bcf816a6a 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -6830,6 +6830,14 @@ L:	linux-hexagon@vger.kernel.org
 S:      Supported
 F:      arch/hexagon/
 
+QUALCOMM WCN36XX WIRELESS DRIVER
+M:      Eugene Krasnikov <k.eugene.e@gmail.com>
+L:      wcn36xx@lists.infradead.org
+W:      http://wireless.kernel.org/en/users/Drivers/wcn36xx
+T:      git git://github.com/KrasnikovEugene/wcn36xx.git
+S:      Supported
+F:      drivers/net/wireless/ath/wcn36xx/
+
 QUICKCAM PARALLEL PORT WEBCAMS
 M:      Hans Verkuil <hverkuil@xs4all.nl>
 L:      linux-media@vger.kernel.org
diff --git a/drivers/bcma/host_pci.c b/drivers/bcma/host_pci.c
index a355e63a3838..6fb98b53533f 100644
--- a/drivers/bcma/host_pci.c
+++ b/drivers/bcma/host_pci.c
@@ -188,8 +188,11 @@ static int bcma_host_pci_probe(struct pci_dev *dev,
                 pci_write_config_dword(dev, 0x40, val & 0xffff00ff);
 
         /* SSB needed additional powering up, do we have any AMBA PCI cards? */
-        if (!pci_is_pcie(dev))
-                bcma_err(bus, "PCI card detected, report problems.\n");
+        if (!pci_is_pcie(dev)) {
+                bcma_err(bus, "PCI card detected, they are not supported.\n");
+                err = -ENXIO;
+                goto err_pci_release_regions;
+        }
 
         /* Map MMIO */
         err = -ENOMEM;
@@ -269,6 +272,7 @@ static SIMPLE_DEV_PM_OPS(bcma_pm_ops, bcma_host_pci_suspend,
 
 static DEFINE_PCI_DEVICE_TABLE(bcma_pci_bridge_tbl) = {
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x0576) },
+        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4313) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43224) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4331) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4353) },
diff --git a/drivers/net/wireless/ath/Kconfig b/drivers/net/wireless/ath/Kconfig
index 1abf1d421173..ba81d6292eeb 100644
--- a/drivers/net/wireless/ath/Kconfig
+++ b/drivers/net/wireless/ath/Kconfig
@@ -32,5 +32,6 @@ source "drivers/net/wireless/ath/ath6kl/Kconfig"
 source "drivers/net/wireless/ath/ar5523/Kconfig"
 source "drivers/net/wireless/ath/wil6210/Kconfig"
 source "drivers/net/wireless/ath/ath10k/Kconfig"
+source "drivers/net/wireless/ath/wcn36xx/Kconfig"
 
 endif
diff --git a/drivers/net/wireless/ath/Makefile b/drivers/net/wireless/ath/Makefile
index fb05cfd19361..363b05653c7e 100644
--- a/drivers/net/wireless/ath/Makefile
+++ b/drivers/net/wireless/ath/Makefile
@@ -5,6 +5,7 @@ obj-$(CONFIG_ATH6KL)		+= ath6kl/
 obj-$(CONFIG_AR5523)            += ar5523/
 obj-$(CONFIG_WIL6210)           += wil6210/
 obj-$(CONFIG_ATH10K)            += ath10k/
+obj-$(CONFIG_WCN36XX)           += wcn36xx/
 
 obj-$(CONFIG_ATH_COMMON)        += ath.o
 
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index be466b0ef7a7..d28923b7435b 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -338,10 +338,9 @@ void ath9k_ani_reset(struct ath_hw *ah, bool is_scanning)
                     aniState->cckNoiseImmunityLevel !=
                     ATH9K_ANI_CCK_DEF_LEVEL) {
                         ath_dbg(common, ANI,
-                                "Restore defaults: opmode %u chan %d Mhz/0x%x is_scanning=%d ofdm:%d cck:%d\n",
+                                "Restore defaults: opmode %u chan %d Mhz is_scanning=%d ofdm:%d cck:%d\n",
                                 ah->opmode,
                                 chan->channel,
-                                chan->channelFlags,
                                 is_scanning,
                                 aniState->ofdmNoiseImmunityLevel,
                                 aniState->cckNoiseImmunityLevel);
@@ -354,10 +353,9 @@ void ath9k_ani_reset(struct ath_hw *ah, bool is_scanning)
                  * restore historical levels for this channel
                  */
                 ath_dbg(common, ANI,
-                        "Restore history: opmode %u chan %d Mhz/0x%x is_scanning=%d ofdm:%d cck:%d\n",
+                        "Restore history: opmode %u chan %d Mhz is_scanning=%d ofdm:%d cck:%d\n",
                         ah->opmode,
                         chan->channel,
-                        chan->channelFlags,
                         is_scanning,
                         aniState->ofdmNoiseImmunityLevel,
                         aniState->cckNoiseImmunityLevel);
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index cb6435e7c6f5..ff415e863ee9 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -666,14 +666,13 @@ static void ar5008_hw_set_channel_regs(struct ath_hw *ah,
         if (IS_CHAN_HT40(chan)) {
                 phymode |= AR_PHY_FC_DYN2040_EN;
 
-                if ((chan->chanmode == CHANNEL_A_HT40PLUS) ||
-                    (chan->chanmode == CHANNEL_G_HT40PLUS))
+                if (IS_CHAN_HT40PLUS(chan))
                         phymode |= AR_PHY_FC_DYN2040_PRI_CH;
 
         }
         REG_WRITE(ah, AR_PHY_TURBO, phymode);
 
-        ath9k_hw_set11nmac2040(ah);
+        ath9k_hw_set11nmac2040(ah, chan);
 
         ENABLE_REGWRITE_BUFFER(ah);
 
@@ -691,31 +690,12 @@ static int ar5008_hw_process_ini(struct ath_hw *ah,
         int i, regWrites = 0;
         u32 modesIndex, freqIndex;
 
-        switch (chan->chanmode) {
-        case CHANNEL_A:
-        case CHANNEL_A_HT20:
-                modesIndex = 1;
+        if (IS_CHAN_5GHZ(chan)) {
                 freqIndex = 1;
-                break;
-        case CHANNEL_A_HT40PLUS:
-        case CHANNEL_A_HT40MINUS:
-                modesIndex = 2;
-                freqIndex = 1;
-                break;
-        case CHANNEL_G:
-        case CHANNEL_G_HT20:
-        case CHANNEL_B:
-                modesIndex = 4;
-                freqIndex = 2;
-                break;
-        case CHANNEL_G_HT40PLUS:
-        case CHANNEL_G_HT40MINUS:
-                modesIndex = 3;
+                modesIndex = IS_CHAN_HT40(chan) ? 2 : 1;
+        } else {
                 freqIndex = 2;
-                break;
-
-        default:
-                return -EINVAL;
+                modesIndex = IS_CHAN_HT40(chan) ? 3 : 4;
         }
 
         /*
@@ -814,8 +794,10 @@ static void ar5008_hw_set_rfmode(struct ath_hw *ah, struct ath9k_channel *chan)
         if (chan == NULL)
                 return;
 
-        rfMode |= (IS_CHAN_B(chan) || IS_CHAN_G(chan))
-                ? AR_PHY_MODE_DYNAMIC : AR_PHY_MODE_OFDM;
+        if (IS_CHAN_2GHZ(chan))
+                rfMode |= AR_PHY_MODE_DYNAMIC;
+        else
+                rfMode |= AR_PHY_MODE_OFDM;
 
         if (!AR_SREV_9280_20_OR_LATER(ah))
                 rfMode |= (IS_CHAN_5GHZ(chan)) ?
@@ -1218,12 +1200,11 @@ static void ar5008_hw_ani_cache_ini_regs(struct ath_hw *ah)
 
         iniDef = &aniState->iniDef;
 
-        ath_dbg(common, ANI, "ver %d.%d opmode %u chan %d Mhz/0x%x\n",
+        ath_dbg(common, ANI, "ver %d.%d opmode %u chan %d Mhz\n",
                 ah->hw_version.macVersion,
                 ah->hw_version.macRev,
                 ah->opmode,
-                chan->channel,
-                chan->channelFlags);
+                chan->channel);
 
         val = REG_READ(ah, AR_PHY_SFCORR);
         iniDef->m1Thresh = MS(val, AR_PHY_SFCORR_M1_THRESH);
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_calib.c b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
index 32376ad74011..cdc74005650c 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
@@ -33,15 +33,12 @@ static bool ar9002_hw_is_cal_supported(struct ath_hw *ah,
         bool supported = false;
         switch (ah->supp_cals & cal_type) {
         case IQ_MISMATCH_CAL:
-                /* Run IQ Mismatch for non-CCK only */
-                if (!IS_CHAN_B(chan))
-                        supported = true;
+                supported = true;
                 break;
         case ADC_GAIN_CAL:
         case ADC_DC_CAL:
                 /* Run ADC Gain Cal for non-CCK & non 2GHz-HT20 only */
-                if (!IS_CHAN_B(chan) &&
-                    !((IS_CHAN_2GHZ(chan) || IS_CHAN_A_FAST_CLOCK(ah, chan)) &&
+                if (!((IS_CHAN_2GHZ(chan) || IS_CHAN_A_FAST_CLOCK(ah, chan)) &&
                       IS_CHAN_HT20(chan)))
                         supported = true;
                 break;
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_hw.c b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
index fb61b081d172..5c95fd9e9c9e 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
@@ -419,28 +419,10 @@ void ar9002_hw_load_ani_reg(struct ath_hw *ah, struct ath9k_channel *chan)
         u32 modesIndex;
         int i;
 
-        switch (chan->chanmode) {
-        case CHANNEL_A:
-        case CHANNEL_A_HT20:
-                modesIndex = 1;
-                break;
-        case CHANNEL_A_HT40PLUS:
-        case CHANNEL_A_HT40MINUS:
-                modesIndex = 2;
-                break;
-        case CHANNEL_G:
-        case CHANNEL_G_HT20:
-        case CHANNEL_B:
-                modesIndex = 4;
-                break;
-        case CHANNEL_G_HT40PLUS:
-        case CHANNEL_G_HT40MINUS:
-                modesIndex = 3;
-                break;
-
-        default:
-                return;
-        }
+        if (IS_CHAN_5GHZ(chan))
+                modesIndex = IS_CHAN_HT40(chan) ? 2 : 1;
+        else
+                modesIndex = IS_CHAN_HT40(chan) ? 3 : 4;
 
         ENABLE_REGWRITE_BUFFER(ah);
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index 0131ba2f5d51..f3adafd33704 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -551,8 +551,7 @@ static void ar9003_hw_set_channel_regs(struct ath_hw *ah,
         if (IS_CHAN_HT40(chan)) {
                 phymode |= AR_PHY_GC_DYN2040_EN;
                 /* Configure control (primary) channel at +-10MHz */
-                if ((chan->chanmode == CHANNEL_A_HT40PLUS) ||
-                    (chan->chanmode == CHANNEL_G_HT40PLUS))
+                if (IS_CHAN_HT40PLUS(chan))
                         phymode |= AR_PHY_GC_DYN2040_PRI_CH;
 
         }
@@ -565,7 +564,7 @@ static void ar9003_hw_set_channel_regs(struct ath_hw *ah,
         REG_WRITE(ah, AR_PHY_GEN_CTRL, phymode);
 
         /* Configure MAC for 20/40 operation */
-        ath9k_hw_set11nmac2040(ah);
+        ath9k_hw_set11nmac2040(ah, chan);
 
         /* global transmit timeout (25 TUs default)*/
         REG_WRITE(ah, AR_GTXTO, 25 << AR_GTXTO_TIMEOUT_LIMIT_S);
@@ -682,41 +681,22 @@ static int ar9550_hw_get_modes_txgain_index(struct ath_hw *ah,
 {
         int ret;
 
-        switch (chan->chanmode) {
-        case CHANNEL_A:
-        case CHANNEL_A_HT20:
-                if (chan->channel <= 5350)
-                        ret = 1;
-                else if ((chan->channel > 5350) && (chan->channel <= 5600))
-                        ret = 3;
+        if (IS_CHAN_2GHZ(chan)) {
+                if (IS_CHAN_HT40(chan))
+                        return 7;
                 else
-                        ret = 5;
-                break;
-
-        case CHANNEL_A_HT40PLUS:
-        case CHANNEL_A_HT40MINUS:
-                if (chan->channel <= 5350)
-                        ret = 2;
-                else if ((chan->channel > 5350) && (chan->channel <= 5600))
-                        ret = 4;
-                else
-                        ret = 6;
-                break;
-
-        case CHANNEL_G:
-        case CHANNEL_G_HT20:
-        case CHANNEL_B:
-                ret = 8;
-                break;
+                        return 8;
+        }
 
-        case CHANNEL_G_HT40PLUS:
-        case CHANNEL_G_HT40MINUS:
-                ret = 7;
-                break;
+        if (chan->channel <= 5350)
+                ret = 1;
+        else if ((chan->channel > 5350) && (chan->channel <= 5600))
+                ret = 3;
+        else
+                ret = 5;
 
-        default:
-                ret = -EINVAL;
-        }
+        if (IS_CHAN_HT40(chan))
+                ret++;
 
         return ret;
 }
@@ -727,28 +707,10 @@ static int ar9003_hw_process_ini(struct ath_hw *ah,
         unsigned int regWrites = 0, i;
         u32 modesIndex;
 
-        switch (chan->chanmode) {
-        case CHANNEL_A:
-        case CHANNEL_A_HT20:
-                modesIndex = 1;
-                break;
-        case CHANNEL_A_HT40PLUS:
-        case CHANNEL_A_HT40MINUS:
-                modesIndex = 2;
-                break;
-        case CHANNEL_G:
-        case CHANNEL_G_HT20:
-        case CHANNEL_B:
-                modesIndex = 4;
-                break;
-        case CHANNEL_G_HT40PLUS:
-        case CHANNEL_G_HT40MINUS:
-                modesIndex = 3;
-                break;
-
-        default:
-                return -EINVAL;
-        }
+        if (IS_CHAN_5GHZ(chan))
+                modesIndex = IS_CHAN_HT40(chan) ? 2 : 1;
+        else
+                modesIndex = IS_CHAN_HT40(chan) ? 3 : 4;
 
         /*
          * SOC, MAC, BB, RADIO initvals.
@@ -846,8 +808,10 @@ static void ar9003_hw_set_rfmode(struct ath_hw *ah,
         if (chan == NULL)
                 return;
 
-        rfMode |= (IS_CHAN_B(chan) || IS_CHAN_G(chan))
-                ? AR_PHY_MODE_DYNAMIC : AR_PHY_MODE_OFDM;
+        if (IS_CHAN_2GHZ(chan))
+                rfMode |= AR_PHY_MODE_DYNAMIC;
+        else
+                rfMode |= AR_PHY_MODE_OFDM;
 
         if (IS_CHAN_A_FAST_CLOCK(ah, chan))
                 rfMode |= (AR_PHY_MODE_DYNAMIC | AR_PHY_MODE_DYN_CCK_DISABLE);
@@ -1273,12 +1237,11 @@ static void ar9003_hw_ani_cache_ini_regs(struct ath_hw *ah)
         aniState = &ah->ani;
         iniDef = &aniState->iniDef;
 
-        ath_dbg(common, ANI, "ver %d.%d opmode %u chan %d Mhz/0x%x\n",
+        ath_dbg(common, ANI, "ver %d.%d opmode %u chan %d Mhz\n",
                 ah->hw_version.macVersion,
                 ah->hw_version.macRev,
                 ah->opmode,
-                chan->channel,
-                chan->channelFlags);
+                chan->channel);
 
         val = REG_READ(ah, AR_PHY_SFCORR);
         iniDef->m1Thresh = MS(val, AR_PHY_SFCORR_M1_THRESH);
@@ -1536,28 +1499,10 @@ static int ar9003_hw_fast_chan_change(struct ath_hw *ah,
         unsigned int regWrites = 0;
         u32 modesIndex;
 
-        switch (chan->chanmode) {
-        case CHANNEL_A:
-        case CHANNEL_A_HT20:
-                modesIndex = 1;
-                break;
-        case CHANNEL_A_HT40PLUS:
-        case CHANNEL_A_HT40MINUS:
-                modesIndex = 2;
-                break;
-        case CHANNEL_G:
-        case CHANNEL_G_HT20:
-        case CHANNEL_B:
-                modesIndex = 4;
-                break;
-        case CHANNEL_G_HT40PLUS:
-        case CHANNEL_G_HT40MINUS:
-                modesIndex = 3;
-                break;
-
-        default:
-                return -EINVAL;
-        }
+        if (IS_CHAN_5GHZ(chan))
+                modesIndex = IS_CHAN_HT40(chan) ? 2 : 1;
+        else
+                modesIndex = IS_CHAN_HT40(chan) ? 3 : 4;
 
         if (modesIndex == ah->modes_index) {
                 *ini_reloaded = false;
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 15afde3c348b..14ff7e9dde4c 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -64,7 +64,6 @@ struct ath_node;
 
 struct ath_config {
         u16 txpowlimit;
-        u8 cabqReadytime;
 };
 
 /*************************/
@@ -207,6 +206,14 @@ struct ath_frame_info {
         u8 baw_tracked : 1;
 };
 
+struct ath_rxbuf {
+        struct list_head list;
+        struct sk_buff *bf_mpdu;
+        void *bf_desc;
+        dma_addr_t bf_daddr;
+        dma_addr_t bf_buf_addr;
+};
+
 struct ath_buf_state {
         u8 bf_type;
         u8 bfs_paprd;
@@ -307,7 +314,7 @@ struct ath_rx {
         struct ath_descdma rxdma;
         struct ath_rx_edma rx_edma[ATH9K_RX_QUEUE_MAX];
 
-        struct ath_buf *buf_hold;
+        struct ath_rxbuf *buf_hold;
         struct sk_buff *frag;
 
         u32 ampdu_ref;
@@ -926,7 +933,6 @@ void ath9k_deinit_device(struct ath_softc *sc);
 void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw);
 void ath9k_reload_chainmask_settings(struct ath_softc *sc);
 
-bool ath9k_uses_beacons(int type);
 void ath9k_spectral_scan_trigger(struct ieee80211_hw *hw);
 int ath9k_spectral_scan_config(struct ieee80211_hw *hw,
                                enum spectral_mode spectral_mode);
diff --git a/drivers/net/wireless/ath/ath9k/calib.c b/drivers/net/wireless/ath/ath9k/calib.c
index d438a0341e68..d8db74b0ef66 100644
--- a/drivers/net/wireless/ath/ath9k/calib.c
+++ b/drivers/net/wireless/ath/ath9k/calib.c
@@ -186,7 +186,6 @@ void ath9k_hw_reset_calibration(struct ath_hw *ah,
 bool ath9k_hw_reset_calvalid(struct ath_hw *ah)
 {
         struct ath_common *common = ath9k_hw_common(ah);
-        struct ieee80211_conf *conf = &common->hw->conf;
         struct ath9k_cal_list *currCal = ah->cal_list_curr;
 
         if (!ah->caldata)
@@ -208,7 +207,7 @@ bool ath9k_hw_reset_calvalid(struct ath_hw *ah)
                 return true;
 
         ath_dbg(common, CALIBRATE, "Resetting Cal %d state for channel %u\n",
-                currCal->calData->calType, conf->chandef.chan->center_freq);
+                currCal->calData->calType, ah->curchan->chan->center_freq);
 
         ah->caldata->CalValid &= ~currCal->calData->calType;
         currCal->calState = CAL_WAITING;
@@ -242,7 +241,6 @@ void ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan)
         int32_t val;
         u8 chainmask = (ah->rxchainmask << 3) | ah->rxchainmask;
         struct ath_common *common = ath9k_hw_common(ah);
-        struct ieee80211_conf *conf = &common->hw->conf;
         s16 default_nf = ath9k_hw_get_default_nf(ah, chan);
 
         if (ah->caldata)
@@ -252,7 +250,7 @@ void ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan)
                 if (chainmask & (1 << i)) {
                         s16 nfval;
 
-                        if ((i >= AR5416_MAX_CHAINS) && !conf_is_ht40(conf))
+                        if ((i >= AR5416_MAX_CHAINS) && !IS_CHAN_HT40(chan))
                                 continue;
 
                         if (h)
@@ -314,7 +312,7 @@ void ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan)
         ENABLE_REGWRITE_BUFFER(ah);
         for (i = 0; i < NUM_NF_READINGS; i++) {
                 if (chainmask & (1 << i)) {
-                        if ((i >= AR5416_MAX_CHAINS) && !conf_is_ht40(conf))
+                        if ((i >= AR5416_MAX_CHAINS) && !IS_CHAN_HT40(chan))
                                 continue;
 
                         val = REG_READ(ah, ah->nf_regs[i]);
@@ -408,7 +406,6 @@ void ath9k_init_nfcal_hist_buffer(struct ath_hw *ah,
 
         ah->caldata->channel = chan->channel;
         ah->caldata->channelFlags = chan->channelFlags;
-        ah->caldata->chanmode = chan->chanmode;
         h = ah->caldata->nfCalHist;
         default_nf = ath9k_hw_get_default_nf(ah, chan);
         for (i = 0; i < NUM_NF_READINGS; i++) {
diff --git a/drivers/net/wireless/ath/ath9k/common.c b/drivers/net/wireless/ath/ath9k/common.c
index d3063c21e16c..a7e5a05b2eff 100644
--- a/drivers/net/wireless/ath/ath9k/common.c
+++ b/drivers/net/wireless/ath/ath9k/common.c
@@ -49,103 +49,64 @@ int ath9k_cmn_get_hw_crypto_keytype(struct sk_buff *skb)
 }
 EXPORT_SYMBOL(ath9k_cmn_get_hw_crypto_keytype);
 
-static u32 ath9k_get_extchanmode(struct cfg80211_chan_def *chandef)
-{
-        u32 chanmode = 0;
-
-        switch (chandef->chan->band) {
-        case IEEE80211_BAND_2GHZ:
-                switch (chandef->width) {
-                case NL80211_CHAN_WIDTH_20_NOHT:
-                case NL80211_CHAN_WIDTH_20:
-                        chanmode = CHANNEL_G_HT20;
-                        break;
-                case NL80211_CHAN_WIDTH_40:
-                        if (chandef->center_freq1 > chandef->chan->center_freq)
-                                chanmode = CHANNEL_G_HT40PLUS;
-                        else
-                                chanmode = CHANNEL_G_HT40MINUS;
-                        break;
-                default:
-                        break;
-                }
-                break;
-        case IEEE80211_BAND_5GHZ:
-                switch (chandef->width) {
-                case NL80211_CHAN_WIDTH_20_NOHT:
-                case NL80211_CHAN_WIDTH_20:
-                        chanmode = CHANNEL_A_HT20;
-                        break;
-                case NL80211_CHAN_WIDTH_40:
-                        if (chandef->center_freq1 > chandef->chan->center_freq)
-                                chanmode = CHANNEL_A_HT40PLUS;
-                        else
-                                chanmode = CHANNEL_A_HT40MINUS;
-                        break;
-                default:
-                        break;
-                }
-                break;
-        default:
-                break;
-        }
-
-        return chanmode;
-}
-
 /*
  * Update internal channel flags.
  */
-void ath9k_cmn_update_ichannel(struct ath9k_channel *ichan,
-                               struct cfg80211_chan_def *chandef)
+static void ath9k_cmn_update_ichannel(struct ath9k_channel *ichan,
+                                      struct cfg80211_chan_def *chandef)
 {
-        ichan->channel = chandef->chan->center_freq;
-        ichan->chan = chandef->chan;
-
-        if (chandef->chan->band == IEEE80211_BAND_2GHZ) {
-                ichan->chanmode = CHANNEL_G;
-                ichan->channelFlags = CHANNEL_2GHZ | CHANNEL_OFDM;
-        } else {
-                ichan->chanmode = CHANNEL_A;
-                ichan->channelFlags = CHANNEL_5GHZ | CHANNEL_OFDM;
-        }
+        struct ieee80211_channel *chan = chandef->chan;
+        u16 flags = 0;
+
+        ichan->channel = chan->center_freq;
+        ichan->chan = chan;
+
+        if (chan->band == IEEE80211_BAND_5GHZ)
+                flags |= CHANNEL_5GHZ;
 
         switch (chandef->width) {
         case NL80211_CHAN_WIDTH_5:
-                ichan->channelFlags |= CHANNEL_QUARTER;
+                flags |= CHANNEL_QUARTER;
                 break;
         case NL80211_CHAN_WIDTH_10:
-                ichan->channelFlags |= CHANNEL_HALF;
+                flags |= CHANNEL_HALF;
                 break;
         case NL80211_CHAN_WIDTH_20_NOHT:
                 break;
         case NL80211_CHAN_WIDTH_20:
+                flags |= CHANNEL_HT;
+                break;
         case NL80211_CHAN_WIDTH_40:
-                ichan->chanmode = ath9k_get_extchanmode(chandef);
+                if (chandef->center_freq1 > chandef->chan->center_freq)
+                        flags |= CHANNEL_HT40PLUS | CHANNEL_HT;
+                else
+                        flags |= CHANNEL_HT40MINUS | CHANNEL_HT;
                 break;
         default:
                 WARN_ON(1);
         }
+
+        ichan->channelFlags = flags;
 }
-EXPORT_SYMBOL(ath9k_cmn_update_ichannel);
 
 /*
  * Get the internal channel reference.
  */
-struct ath9k_channel *ath9k_cmn_get_curchannel(struct ieee80211_hw *hw,
-                                               struct ath_hw *ah)
+struct ath9k_channel *ath9k_cmn_get_channel(struct ieee80211_hw *hw,
+                                            struct ath_hw *ah,
+                                            struct cfg80211_chan_def *chandef)
 {
-        struct ieee80211_channel *curchan = hw->conf.chandef.chan;
+        struct ieee80211_channel *curchan = chandef->chan;
         struct ath9k_channel *channel;
         u8 chan_idx;
 
         chan_idx = curchan->hw_value;
         channel = &ah->channels[chan_idx];
-        ath9k_cmn_update_ichannel(channel, &hw->conf.chandef);
+        ath9k_cmn_update_ichannel(channel, chandef);
 
         return channel;
 }
-EXPORT_SYMBOL(ath9k_cmn_get_curchannel);
+EXPORT_SYMBOL(ath9k_cmn_get_channel);
 
 int ath9k_cmn_count_streams(unsigned int chainmask, int max)
 {
diff --git a/drivers/net/wireless/ath/ath9k/common.h b/drivers/net/wireless/ath/ath9k/common.h
index e039bcbfbd79..eb85e1bdca88 100644
--- a/drivers/net/wireless/ath/ath9k/common.h
+++ b/drivers/net/wireless/ath/ath9k/common.h
@@ -43,10 +43,9 @@
         (((x) + ((mul)/2)) / (mul))
 
 int ath9k_cmn_get_hw_crypto_keytype(struct sk_buff *skb);
-void ath9k_cmn_update_ichannel(struct ath9k_channel *ichan,
-                               struct cfg80211_chan_def *chandef);
-struct ath9k_channel *ath9k_cmn_get_curchannel(struct ieee80211_hw *hw,
-                                               struct ath_hw *ah);
+struct ath9k_channel *ath9k_cmn_get_channel(struct ieee80211_hw *hw,
+                                            struct ath_hw *ah,
+                                            struct cfg80211_chan_def *chandef);
 int ath9k_cmn_count_streams(unsigned int chainmask, int max);
 void ath9k_cmn_btcoex_bt_stomp(struct ath_common *common,
                                   enum ath_stomp_type stomp_type);
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index d44258172c0f..9a2657fdd9cc 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -24,30 +24,10 @@
 static enum htc_phymode ath9k_htc_get_curmode(struct ath9k_htc_priv *priv,
                                               struct ath9k_channel *ichan)
 {
-        enum htc_phymode mode;
-
-        mode = -EINVAL;
-
-        switch (ichan->chanmode) {
-        case CHANNEL_G:
-        case CHANNEL_G_HT20:
-        case CHANNEL_G_HT40PLUS:
-        case CHANNEL_G_HT40MINUS:
-                mode = HTC_MODE_11NG;
-                break;
-        case CHANNEL_A:
-        case CHANNEL_A_HT20:
-        case CHANNEL_A_HT40PLUS:
-        case CHANNEL_A_HT40MINUS:
-                mode = HTC_MODE_11NA;
-                break;
-        default:
-                break;
-        }
+        if (IS_CHAN_5GHZ(ichan))
+                return HTC_MODE_11NA;
 
-        WARN_ON(mode < 0);
-
-        return mode;
+        return HTC_MODE_11NG;
 }
 
 bool ath9k_htc_setpower(struct ath9k_htc_priv *priv,
@@ -926,7 +906,7 @@ static int ath9k_htc_start(struct ieee80211_hw *hw)
         WMI_CMD(WMI_FLUSH_RECV_CMDID);
 
         /* setup initial channel */
-        init_channel = ath9k_cmn_get_curchannel(hw, ah);
+        init_channel = ath9k_cmn_get_channel(hw, ah, &hw->conf.chandef);
 
         ret = ath9k_hw_reset(ah, init_channel, ah->caldata, false);
         if (ret) {
@@ -1208,9 +1188,7 @@ static int ath9k_htc_config(struct ieee80211_hw *hw, u32 changed)
                 ath_dbg(common, CONFIG, "Set channel: %d MHz\n",
                         curchan->center_freq);
 
-                ath9k_cmn_update_ichannel(&priv->ah->channels[pos],
-                                          &hw->conf.chandef);
-
+                ath9k_cmn_get_channel(hw, priv->ah, &hw->conf.chandef);
                 if (ath9k_htc_set_channel(priv, hw, &priv->ah->channels[pos]) < 0) {
                         ath_err(common, "Unable to set channel\n");
                         ret = -EINVAL;
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index f11e8389a9be..dcdbab48709e 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -130,29 +130,29 @@ void ath9k_debug_sync_cause(struct ath_common *common, u32 sync_cause)
 
 static void ath9k_hw_set_clockrate(struct ath_hw *ah)
 {
-        struct ieee80211_conf *conf = &ath9k_hw_common(ah)->hw->conf;
         struct ath_common *common = ath9k_hw_common(ah);
+        struct ath9k_channel *chan = ah->curchan;
         unsigned int clockrate;
 
         /* AR9287 v1.3+ uses async FIFO and runs the MAC at 117 MHz */
         if (AR_SREV_9287(ah) && AR_SREV_9287_13_OR_LATER(ah))
                 clockrate = 117;
-        else if (!ah->curchan) /* should really check for CCK instead */
+        else if (!chan) /* should really check for CCK instead */
                 clockrate = ATH9K_CLOCK_RATE_CCK;
-        else if (conf->chandef.chan->band == IEEE80211_BAND_2GHZ)
+        else if (IS_CHAN_2GHZ(chan))
                 clockrate = ATH9K_CLOCK_RATE_2GHZ_OFDM;
         else if (ah->caps.hw_caps & ATH9K_HW_CAP_FASTCLOCK)
                 clockrate = ATH9K_CLOCK_FAST_RATE_5GHZ_OFDM;
         else
                 clockrate = ATH9K_CLOCK_RATE_5GHZ_OFDM;
 
-        if (conf_is_ht40(conf))
+        if (IS_CHAN_HT40(chan))
                 clockrate *= 2;
 
         if (ah->curchan) {
-                if (IS_CHAN_HALF_RATE(ah->curchan))
+                if (IS_CHAN_HALF_RATE(chan))
                         clockrate /= 2;
-                if (IS_CHAN_QUARTER_RATE(ah->curchan))
+                if (IS_CHAN_QUARTER_RATE(chan))
                         clockrate /= 4;
         }
 
@@ -190,10 +190,7 @@ EXPORT_SYMBOL(ath9k_hw_wait);
 void ath9k_hw_synth_delay(struct ath_hw *ah, struct ath9k_channel *chan,
                           int hw_delay)
 {
-        if (IS_CHAN_B(chan))
-                hw_delay = (4 * hw_delay) / 22;
-        else
-                hw_delay /= 10;
+        hw_delay /= 10;
 
         if (IS_CHAN_HALF_RATE(chan))
                 hw_delay *= 2;
@@ -294,8 +291,7 @@ void ath9k_hw_get_channel_centers(struct ath_hw *ah,
                 return;
         }
 
-        if ((chan->chanmode == CHANNEL_A_HT40PLUS) ||
-            (chan->chanmode == CHANNEL_G_HT40PLUS)) {
+        if (IS_CHAN_HT40PLUS(chan)) {
                 centers->synth_center =
                         chan->channel + HT40_CHANNEL_CENTER_SHIFT;
                 extoff = 1;
@@ -1042,7 +1038,6 @@ static bool ath9k_hw_set_global_txtimeout(struct ath_hw *ah, u32 tu)
 void ath9k_hw_init_global_settings(struct ath_hw *ah)
 {
         struct ath_common *common = ath9k_hw_common(ah);
-        struct ieee80211_conf *conf = &common->hw->conf;
         const struct ath9k_channel *chan = ah->curchan;
         int acktimeout, ctstimeout, ack_offset = 0;
         int slottime;
@@ -1117,8 +1112,7 @@ void ath9k_hw_init_global_settings(struct ath_hw *ah)
          * BA frames in some implementations, but it has been found to fix ACK
          * timeout issues in other cases as well.
          */
-        if (conf->chandef.chan &&
-            conf->chandef.chan->band == IEEE80211_BAND_2GHZ &&
+        if (IS_CHAN_2GHZ(chan) &&
             !IS_CHAN_HALF_RATE(chan) && !IS_CHAN_QUARTER_RATE(chan)) {
                 acktimeout += 64 - sifstime - ah->slottime;
                 ctstimeout += 48 - sifstime - ah->slottime;
@@ -1160,9 +1154,7 @@ u32 ath9k_regd_get_ctl(struct ath_regulatory *reg, struct ath9k_channel *chan)
 {
         u32 ctl = ath_regd_get_band_ctl(reg, chan->chan->band);
 
-        if (IS_CHAN_B(chan))
-                ctl |= CTL_11B;
-        else if (IS_CHAN_G(chan))
+        if (IS_CHAN_2GHZ(chan))
                 ctl |= CTL_11G;
         else
                 ctl |= CTL_11A;
@@ -1510,10 +1502,8 @@ static bool ath9k_hw_channel_change(struct ath_hw *ah,
         int r;
 
         if (pCap->hw_caps & ATH9K_HW_CAP_FCC_BAND_SWITCH) {
-                u32 cur = ah->curchan->channelFlags & (CHANNEL_2GHZ | CHANNEL_5GHZ);
-                u32 new = chan->channelFlags & (CHANNEL_2GHZ | CHANNEL_5GHZ);
-                band_switch = (cur != new);
-                mode_diff = (chan->chanmode != ah->curchan->chanmode);
+                band_switch = IS_CHAN_5GHZ(ah->curchan) != IS_CHAN_5GHZ(chan);
+                mode_diff = (chan->channelFlags != ah->curchan->channelFlags);
         }
 
         for (qnum = 0; qnum < AR_NUM_QCU; qnum++) {
@@ -1552,9 +1542,7 @@ static bool ath9k_hw_channel_change(struct ath_hw *ah,
         ath9k_hw_set_clockrate(ah);
         ath9k_hw_apply_txpower(ah, chan, false);
 
-        if (IS_CHAN_OFDM(chan) || IS_CHAN_HT(chan))
-                ath9k_hw_set_delta_slope(ah, chan);
-
+        ath9k_hw_set_delta_slope(ah, chan);
         ath9k_hw_spur_mitigate_freq(ah, chan);
 
         if (band_switch || ini_reloaded)
@@ -1824,20 +1812,11 @@ static int ath9k_hw_do_fastcc(struct ath_hw *ah, struct ath9k_channel *chan)
                 goto fail;
 
         /*
-         * If cross-band fcc is not supoprted, bail out if
-         * either channelFlags or chanmode differ.
-         *
-         * chanmode will be different if the HT operating mode
-         * changes because of CSA.
+         * If cross-band fcc is not supoprted, bail out if channelFlags differ.
          */
-        if (!(pCap->hw_caps & ATH9K_HW_CAP_FCC_BAND_SWITCH)) {
-                if ((chan->channelFlags & CHANNEL_ALL) !=
-                    (ah->curchan->channelFlags & CHANNEL_ALL))
-                        goto fail;
-
-                if (chan->chanmode != ah->curchan->chanmode)
-                        goto fail;
-        }
+        if (!(pCap->hw_caps & ATH9K_HW_CAP_FCC_BAND_SWITCH) &&
+            chan->channelFlags != ah->curchan->channelFlags)
+                goto fail;
 
         if (!ath9k_hw_check_alive(ah))
                 goto fail;
@@ -1899,8 +1878,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
 
         ah->caldata = caldata;
         if (caldata && (chan->channel != caldata->channel ||
-                        chan->channelFlags != caldata->channelFlags ||
-                        chan->chanmode != caldata->chanmode)) {
+                        chan->channelFlags != caldata->channelFlags)) {
                 /* Operating channel changed, reset channel calibration data */
                 memset(caldata, 0, sizeof(*caldata));
                 ath9k_init_nfcal_hist_buffer(ah, chan);
@@ -1989,9 +1967,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
 
         ath9k_hw_init_mfp(ah);
 
-        if (IS_CHAN_OFDM(chan) || IS_CHAN_HT(chan))
-                ath9k_hw_set_delta_slope(ah, chan);
-
+        ath9k_hw_set_delta_slope(ah, chan);
         ath9k_hw_spur_mitigate_freq(ah, chan);
         ah->eep_ops->set_board_values(ah, chan);
 
@@ -2968,12 +2944,11 @@ void ath9k_hw_set_tsfadjust(struct ath_hw *ah, bool set)
 }
 EXPORT_SYMBOL(ath9k_hw_set_tsfadjust);
 
-void ath9k_hw_set11nmac2040(struct ath_hw *ah)
+void ath9k_hw_set11nmac2040(struct ath_hw *ah, struct ath9k_channel *chan)
 {
-        struct ieee80211_conf *conf = &ath9k_hw_common(ah)->hw->conf;
         u32 macmode;
 
-        if (conf_is_ht40(conf) && !ah->config.cwm_ignore_extcca)
+        if (IS_CHAN_HT40(chan) && !ah->config.cwm_ignore_extcca)
                 macmode = AR_2040_JOINED_RX_CLEAR;
         else
                 macmode = 0;
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 2babf931b459..81fcbc756122 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -369,36 +369,6 @@ enum ath9k_int {
         ATH9K_INT_NOCARD = 0xffffffff
 };
 
-#define CHANNEL_CCK       0x00020
-#define CHANNEL_OFDM      0x00040
-#define CHANNEL_2GHZ      0x00080
-#define CHANNEL_5GHZ      0x00100
-#define CHANNEL_PASSIVE   0x00200
-#define CHANNEL_DYN       0x00400
-#define CHANNEL_HALF      0x04000
-#define CHANNEL_QUARTER   0x08000
-#define CHANNEL_HT20      0x10000
-#define CHANNEL_HT40PLUS  0x20000
-#define CHANNEL_HT40MINUS 0x40000
-
-#define CHANNEL_A           (CHANNEL_5GHZ|CHANNEL_OFDM)
-#define CHANNEL_B           (CHANNEL_2GHZ|CHANNEL_CCK)
-#define CHANNEL_G           (CHANNEL_2GHZ|CHANNEL_OFDM)
-#define CHANNEL_G_HT20      (CHANNEL_2GHZ|CHANNEL_HT20)
-#define CHANNEL_A_HT20      (CHANNEL_5GHZ|CHANNEL_HT20)
-#define CHANNEL_G_HT40PLUS  (CHANNEL_2GHZ|CHANNEL_HT40PLUS)
-#define CHANNEL_G_HT40MINUS (CHANNEL_2GHZ|CHANNEL_HT40MINUS)
-#define CHANNEL_A_HT40PLUS  (CHANNEL_5GHZ|CHANNEL_HT40PLUS)
-#define CHANNEL_A_HT40MINUS (CHANNEL_5GHZ|CHANNEL_HT40MINUS)
-#define CHANNEL_ALL                             \
-        (CHANNEL_OFDM|                          \
-         CHANNEL_CCK|                           \
-         CHANNEL_2GHZ |                         \
-         CHANNEL_5GHZ |                         \
-         CHANNEL_HT20 |                         \
-         CHANNEL_HT40PLUS |                     \
-         CHANNEL_HT40MINUS)
-
 #define MAX_RTT_TABLE_ENTRY     6
 #define MAX_IQCAL_MEASUREMENT   8
 #define MAX_CL_TAB_ENTRY        16
@@ -417,8 +387,7 @@ enum ath9k_cal_flags {
 
 struct ath9k_hw_cal_data {
         u16 channel;
-        u32 channelFlags;
-        u32 chanmode;
+        u16 channelFlags;
         unsigned long cal_flags;
         int32_t CalValid;
         int8_t iCoff;
@@ -436,33 +405,34 @@ struct ath9k_hw_cal_data {
 struct ath9k_channel {
         struct ieee80211_channel *chan;
         u16 channel;
-        u32 channelFlags;
-        u32 chanmode;
+        u16 channelFlags;
         s16 noisefloor;
 };
 
-#define IS_CHAN_G(_c) ((((_c)->channelFlags & (CHANNEL_G)) == CHANNEL_G) || \
-       (((_c)->channelFlags & CHANNEL_G_HT20) == CHANNEL_G_HT20) || \
-       (((_c)->channelFlags & CHANNEL_G_HT40PLUS) == CHANNEL_G_HT40PLUS) || \
-       (((_c)->channelFlags & CHANNEL_G_HT40MINUS) == CHANNEL_G_HT40MINUS))
-#define IS_CHAN_OFDM(_c) (((_c)->channelFlags & CHANNEL_OFDM) != 0)
-#define IS_CHAN_5GHZ(_c) (((_c)->channelFlags & CHANNEL_5GHZ) != 0)
-#define IS_CHAN_2GHZ(_c) (((_c)->channelFlags & CHANNEL_2GHZ) != 0)
-#define IS_CHAN_HALF_RATE(_c) (((_c)->channelFlags & CHANNEL_HALF) != 0)
-#define IS_CHAN_QUARTER_RATE(_c) (((_c)->channelFlags & CHANNEL_QUARTER) != 0)
+#define CHANNEL_5GHZ            BIT(0)
+#define CHANNEL_HALF            BIT(1)
+#define CHANNEL_QUARTER         BIT(2)
+#define CHANNEL_HT              BIT(3)
+#define CHANNEL_HT40PLUS        BIT(4)
+#define CHANNEL_HT40MINUS       BIT(5)
+
+#define IS_CHAN_5GHZ(_c) (!!((_c)->channelFlags & CHANNEL_5GHZ))
+#define IS_CHAN_2GHZ(_c) (!IS_CHAN_5GHZ(_c))
+
+#define IS_CHAN_HALF_RATE(_c) (!!((_c)->channelFlags & CHANNEL_HALF))
+#define IS_CHAN_QUARTER_RATE(_c) (!!((_c)->channelFlags & CHANNEL_QUARTER))
 #define IS_CHAN_A_FAST_CLOCK(_ah, _c)                   \
-        ((((_c)->channelFlags & CHANNEL_5GHZ) != 0) &&  \
-         ((_ah)->caps.hw_caps & ATH9K_HW_CAP_FASTCLOCK))
-
-/* These macros check chanmode and not channelFlags */
-#define IS_CHAN_B(_c) ((_c)->chanmode == CHANNEL_B)
-#define IS_CHAN_HT20(_c) (((_c)->chanmode == CHANNEL_A_HT20) || \
-                          ((_c)->chanmode == CHANNEL_G_HT20))
-#define IS_CHAN_HT40(_c) (((_c)->chanmode == CHANNEL_A_HT40PLUS) ||     \
-                          ((_c)->chanmode == CHANNEL_A_HT40MINUS) ||    \
-                          ((_c)->chanmode == CHANNEL_G_HT40PLUS) ||     \
-                          ((_c)->chanmode == CHANNEL_G_HT40MINUS))
-#define IS_CHAN_HT(_c) (IS_CHAN_HT20((_c)) || IS_CHAN_HT40((_c)))
+        (IS_CHAN_5GHZ(_c) && ((_ah)->caps.hw_caps & ATH9K_HW_CAP_FASTCLOCK))
+
+#define IS_CHAN_HT(_c) ((_c)->channelFlags & CHANNEL_HT)
+
+#define IS_CHAN_HT20(_c) (IS_CHAN_HT(_c) && !IS_CHAN_HT40(_c))
+
+#define IS_CHAN_HT40(_c) \
+        (!!((_c)->channelFlags & (CHANNEL_HT40PLUS | CHANNEL_HT40MINUS)))
+
+#define IS_CHAN_HT40PLUS(_c) ((_c)->channelFlags & CHANNEL_HT40PLUS)
+#define IS_CHAN_HT40MINUS(_c) ((_c)->channelFlags & CHANNEL_HT40MINUS)
 
 enum ath9k_power_mode {
         ATH9K_PM_AWAKE = 0,
@@ -1033,7 +1003,7 @@ void ath9k_hw_reset_tsf(struct ath_hw *ah);
 void ath9k_hw_set_tsfadjust(struct ath_hw *ah, bool set);
 void ath9k_hw_init_global_settings(struct ath_hw *ah);
 u32 ar9003_get_pll_sqsum_dvc(struct ath_hw *ah);
-void ath9k_hw_set11nmac2040(struct ath_hw *ah);
+void ath9k_hw_set11nmac2040(struct ath_hw *ah, struct ath9k_channel *chan);
 void ath9k_hw_beaconinit(struct ath_hw *ah, u32 next_beacon, u32 beacon_period);
 void ath9k_hw_set_sta_beacon_timers(struct ath_hw *ah,
                                     const struct ath9k_beacon_state *bs);
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index e3d11c41a145..7df728f36330 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -347,7 +347,6 @@ int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd,
 {
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         u8 *ds;
-        struct ath_buf *bf;
         int i, bsize, desc_len;
 
         ath_dbg(common, CONFIG, "%s DMA: %u buffers %u desc/buf\n",
@@ -399,33 +398,68 @@ int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd,
                 ito64(dd->dd_desc_paddr), /*XXX*/(u32) dd->dd_desc_len);
 
         /* allocate buffers */
-        bsize = sizeof(struct ath_buf) * nbuf;
-        bf = devm_kzalloc(sc->dev, bsize, GFP_KERNEL);
-        if (!bf)
-                return -ENOMEM;
+        if (is_tx) {
+                struct ath_buf *bf;
+
+                bsize = sizeof(struct ath_buf) * nbuf;
+                bf = devm_kzalloc(sc->dev, bsize, GFP_KERNEL);
+                if (!bf)
+                        return -ENOMEM;
+
+                for (i = 0; i < nbuf; i++, bf++, ds += (desc_len * ndesc)) {
+                        bf->bf_desc = ds;
+                        bf->bf_daddr = DS2PHYS(dd, ds);
+
+                        if (!(sc->sc_ah->caps.hw_caps &
+                                  ATH9K_HW_CAP_4KB_SPLITTRANS)) {
+                                /*
+                                 * Skip descriptor addresses which can cause 4KB
+                                 * boundary crossing (addr + length) with a 32 dword
+                                 * descriptor fetch.
+                                 */
+                                while (ATH_DESC_4KB_BOUND_CHECK(bf->bf_daddr)) {
+                                        BUG_ON((caddr_t) bf->bf_desc >=
+                                                   ((caddr_t) dd->dd_desc +
+                                                dd->dd_desc_len));
+
+                                        ds += (desc_len * ndesc);
+                                        bf->bf_desc = ds;
+                                        bf->bf_daddr = DS2PHYS(dd, ds);
+                                }
+                        }
+                        list_add_tail(&bf->list, head);
+                }
+        } else {
+                struct ath_rxbuf *bf;
+
+                bsize = sizeof(struct ath_rxbuf) * nbuf;
+                bf = devm_kzalloc(sc->dev, bsize, GFP_KERNEL);
+                if (!bf)
+                        return -ENOMEM;
 
-        for (i = 0; i < nbuf; i++, bf++, ds += (desc_len * ndesc)) {
-                bf->bf_desc = ds;
-                bf->bf_daddr = DS2PHYS(dd, ds);
-
-                if (!(sc->sc_ah->caps.hw_caps &
-                      ATH9K_HW_CAP_4KB_SPLITTRANS)) {
-                        /*
-                         * Skip descriptor addresses which can cause 4KB
-                         * boundary crossing (addr + length) with a 32 dword
-                         * descriptor fetch.
-                         */
-                        while (ATH_DESC_4KB_BOUND_CHECK(bf->bf_daddr)) {
-                                BUG_ON((caddr_t) bf->bf_desc >=
-                                       ((caddr_t) dd->dd_desc +
-                                        dd->dd_desc_len));
-
-                                ds += (desc_len * ndesc);
-                                bf->bf_desc = ds;
-                                bf->bf_daddr = DS2PHYS(dd, ds);
+                for (i = 0; i < nbuf; i++, bf++, ds += (desc_len * ndesc)) {
+                        bf->bf_desc = ds;
+                        bf->bf_daddr = DS2PHYS(dd, ds);
+
+                        if (!(sc->sc_ah->caps.hw_caps &
+                                  ATH9K_HW_CAP_4KB_SPLITTRANS)) {
+                                /*
+                                 * Skip descriptor addresses which can cause 4KB
+                                 * boundary crossing (addr + length) with a 32 dword
+                                 * descriptor fetch.
+                                 */
+                                while (ATH_DESC_4KB_BOUND_CHECK(bf->bf_daddr)) {
+                                        BUG_ON((caddr_t) bf->bf_desc >=
+                                                   ((caddr_t) dd->dd_desc +
+                                                dd->dd_desc_len));
+
+                                        ds += (desc_len * ndesc);
+                                        bf->bf_desc = ds;
+                                        bf->bf_daddr = DS2PHYS(dd, ds);
+                                }
                         }
+                        list_add_tail(&bf->list, head);
                 }
-                list_add_tail(&bf->list, head);
         }
         return 0;
 }
@@ -437,7 +471,6 @@ static int ath9k_init_queues(struct ath_softc *sc)
         sc->beacon.beaconq = ath9k_hw_beaconq_setup(sc->sc_ah);
         sc->beacon.cabq = ath_txq_setup(sc, ATH9K_TX_QUEUE_CAB, 0);
 
-        sc->config.cabqReadytime = ATH_CABQ_READY_TIME;
         ath_cabq_update(sc);
 
         sc->tx.uapsdq = ath_txq_setup(sc, ATH9K_TX_QUEUE_UAPSD, 0);
@@ -768,7 +801,7 @@ static void ath9k_init_band_txpower(struct ath_softc *sc, int band)
                 chan = &sband->channels[i];
                 ah->curchan = &ah->channels[chan->hw_value];
                 cfg80211_chandef_create(&chandef, chan, NL80211_CHAN_HT20);
-                ath9k_cmn_update_ichannel(ah->curchan, &chandef);
+                ath9k_cmn_get_channel(sc->hw, ah, &chandef);
                 ath9k_hw_set_txpowerlimit(ah, MAX_RATE_POWER, true);
         }
 }
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index a3eff0986a3f..6a18f9d3e9cc 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -374,7 +374,6 @@ EXPORT_SYMBOL(ath9k_hw_releasetxqueue);
 bool ath9k_hw_resettxqueue(struct ath_hw *ah, u32 q)
 {
         struct ath_common *common = ath9k_hw_common(ah);
-        struct ath9k_channel *chan = ah->curchan;
         struct ath9k_tx_queue_info *qi;
         u32 cwMin, chanCwMin, value;
 
@@ -387,10 +386,7 @@ bool ath9k_hw_resettxqueue(struct ath_hw *ah, u32 q)
         ath_dbg(common, QUEUE, "Reset TX queue: %u\n", q);
 
         if (qi->tqi_cwmin == ATH9K_TXQ_USEDEFAULT) {
-                if (chan && IS_CHAN_B(chan))
-                        chanCwMin = INIT_CWMIN_11B;
-                else
-                        chanCwMin = INIT_CWMIN;
+                chanCwMin = INIT_CWMIN;
 
                 for (cwMin = 1; cwMin < chanCwMin; cwMin = (cwMin << 1) | 1);
         } else
diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h
index bfccaceed44e..e3eed81f2439 100644
--- a/drivers/net/wireless/ath/ath9k/mac.h
+++ b/drivers/net/wireless/ath/ath9k/mac.h
@@ -603,8 +603,6 @@ enum ath9k_tx_queue_flags {
 #define ATH9K_TXQ_USE_LOCKOUT_BKOFF_DIS 0x00000001
 
 #define ATH9K_DECOMP_MASK_SIZE     128
-#define ATH9K_READY_TIME_LO_BOUND  50
-#define ATH9K_READY_TIME_HI_BOUND  96
 
 enum ath9k_pkt_type {
         ATH9K_PKT_TYPE_NORMAL = 0,
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index cdb3b1e10b95..c42b55c1face 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -302,17 +302,91 @@ out:
  * by reseting the chip.  To accomplish this we must first cleanup any pending
  * DMA, then restart stuff.
 */
-static int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
-                    struct ath9k_channel *hchan)
+static int ath_set_channel(struct ath_softc *sc, struct cfg80211_chan_def *chandef)
 {
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ieee80211_hw *hw = sc->hw;
+        struct ath9k_channel *hchan;
+        struct ieee80211_channel *chan = chandef->chan;
+        unsigned long flags;
+        bool offchannel;
+        int pos = chan->hw_value;
+        int old_pos = -1;
         int r;
 
         if (test_bit(SC_OP_INVALID, &sc->sc_flags))
                 return -EIO;
 
+        offchannel = !!(hw->conf.flags & IEEE80211_CONF_OFFCHANNEL);
+
+        if (ah->curchan)
+                old_pos = ah->curchan - &ah->channels[0];
+
+        ath_dbg(common, CONFIG, "Set channel: %d MHz width: %d\n",
+                chan->center_freq, chandef->width);
+
+        /* update survey stats for the old channel before switching */
+        spin_lock_irqsave(&common->cc_lock, flags);
+        ath_update_survey_stats(sc);
+        spin_unlock_irqrestore(&common->cc_lock, flags);
+
+        ath9k_cmn_get_channel(hw, ah, chandef);
+
+        /*
+         * If the operating channel changes, change the survey in-use flags
+         * along with it.
+         * Reset the survey data for the new channel, unless we're switching
+         * back to the operating channel from an off-channel operation.
+         */
+        if (!offchannel && sc->cur_survey != &sc->survey[pos]) {
+                if (sc->cur_survey)
+                        sc->cur_survey->filled &= ~SURVEY_INFO_IN_USE;
+
+                sc->cur_survey = &sc->survey[pos];
+
+                memset(sc->cur_survey, 0, sizeof(struct survey_info));
+                sc->cur_survey->filled |= SURVEY_INFO_IN_USE;
+        } else if (!(sc->survey[pos].filled & SURVEY_INFO_IN_USE)) {
+                memset(&sc->survey[pos], 0, sizeof(struct survey_info));
+        }
+
+        hchan = &sc->sc_ah->channels[pos];
         r = ath_reset_internal(sc, hchan);
+        if (r)
+                return r;
 
-        return r;
+        /*
+         * The most recent snapshot of channel->noisefloor for the old
+         * channel is only available after the hardware reset. Copy it to
+         * the survey stats now.
+         */
+        if (old_pos >= 0)
+                ath_update_survey_nf(sc, old_pos);
+
+        /*
+         * Enable radar pulse detection if on a DFS channel. Spectral
+         * scanning and radar detection can not be used concurrently.
+         */
+        if (hw->conf.radar_enabled) {
+                u32 rxfilter;
+
+                /* set HW specific DFS configuration */
+                ath9k_hw_set_radar_params(ah);
+                rxfilter = ath9k_hw_getrxfilter(ah);
+                rxfilter |= ATH9K_RX_FILTER_PHYRADAR |
+                                ATH9K_RX_FILTER_PHYERR;
+                ath9k_hw_setrxfilter(ah, rxfilter);
+                ath_dbg(common, DFS, "DFS enabled at freq %d\n",
+                        chan->center_freq);
+        } else {
+                /* perform spectral scan if requested. */
+                if (test_bit(SC_OP_SCANNING, &sc->sc_flags) &&
+                        sc->spectral_mode == SPECTRAL_CHANSCAN)
+                        ath9k_spectral_scan_trigger(hw);
+        }
+
+        return 0;
 }
 
 static void ath_node_attach(struct ath_softc *sc, struct ieee80211_sta *sta,
@@ -601,7 +675,7 @@ static int ath9k_start(struct ieee80211_hw *hw)
         ath9k_ps_wakeup(sc);
         mutex_lock(&sc->mutex);
 
-        init_channel = ath9k_cmn_get_curchannel(hw, ah);
+        init_channel = ath9k_cmn_get_channel(hw, ah, &hw->conf.chandef);
 
         /* Reset SERDES registers */
         ath9k_hw_configpcipowersave(ah, false);
@@ -804,7 +878,7 @@ static void ath9k_stop(struct ieee80211_hw *hw)
         }
 
         if (!ah->curchan)
-                ah->curchan = ath9k_cmn_get_curchannel(hw, ah);
+                ah->curchan = ath9k_cmn_get_channel(hw, ah, &hw->conf.chandef);
 
         ath9k_hw_reset(ah, ah->curchan, ah->caldata, false);
         ath9k_hw_phy_disable(ah);
@@ -823,7 +897,7 @@ static void ath9k_stop(struct ieee80211_hw *hw)
         ath_dbg(common, CONFIG, "Driver halt\n");
 }
 
-bool ath9k_uses_beacons(int type)
+static bool ath9k_uses_beacons(int type)
 {
         switch (type) {
         case NL80211_IFTYPE_AP:
@@ -1208,81 +1282,12 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
         }
 
         if ((changed & IEEE80211_CONF_CHANGE_CHANNEL) || reset_channel) {
-                struct ieee80211_channel *curchan = hw->conf.chandef.chan;
-                int pos = curchan->hw_value;
-                int old_pos = -1;
-                unsigned long flags;
-
-                if (ah->curchan)
-                        old_pos = ah->curchan - &ah->channels[0];
-
-                ath_dbg(common, CONFIG, "Set channel: %d MHz width: %d\n",
-                        curchan->center_freq, hw->conf.chandef.width);
-
-                /* update survey stats for the old channel before switching */
-                spin_lock_irqsave(&common->cc_lock, flags);
-                ath_update_survey_stats(sc);
-                spin_unlock_irqrestore(&common->cc_lock, flags);
-
-                ath9k_cmn_update_ichannel(&sc->sc_ah->channels[pos],
-                                          &conf->chandef);
-
-                /*
-                 * If the operating channel changes, change the survey in-use flags
-                 * along with it.
-                 * Reset the survey data for the new channel, unless we're switching
-                 * back to the operating channel from an off-channel operation.
-                 */
-                if (!(hw->conf.flags & IEEE80211_CONF_OFFCHANNEL) &&
-                    sc->cur_survey != &sc->survey[pos]) {
-
-                        if (sc->cur_survey)
-                                sc->cur_survey->filled &= ~SURVEY_INFO_IN_USE;
-
-                        sc->cur_survey = &sc->survey[pos];
-
-                        memset(sc->cur_survey, 0, sizeof(struct survey_info));
-                        sc->cur_survey->filled |= SURVEY_INFO_IN_USE;
-                } else if (!(sc->survey[pos].filled & SURVEY_INFO_IN_USE)) {
-                        memset(&sc->survey[pos], 0, sizeof(struct survey_info));
-                }
-
-                if (ath_set_channel(sc, hw, &sc->sc_ah->channels[pos]) < 0) {
+                if (ath_set_channel(sc, &hw->conf.chandef) < 0) {
                         ath_err(common, "Unable to set channel\n");
                         mutex_unlock(&sc->mutex);
                         ath9k_ps_restore(sc);
                         return -EINVAL;
                 }
-
-                /*
-                 * The most recent snapshot of channel->noisefloor for the old
-                 * channel is only available after the hardware reset. Copy it to
-                 * the survey stats now.
-                 */
-                if (old_pos >= 0)
-                        ath_update_survey_nf(sc, old_pos);
-
-                /*
-                 * Enable radar pulse detection if on a DFS channel. Spectral
-                 * scanning and radar detection can not be used concurrently.
-                 */
-                if (hw->conf.radar_enabled) {
-                        u32 rxfilter;
-
-                        /* set HW specific DFS configuration */
-                        ath9k_hw_set_radar_params(ah);
-                        rxfilter = ath9k_hw_getrxfilter(ah);
-                        rxfilter |= ATH9K_RX_FILTER_PHYRADAR |
-                                    ATH9K_RX_FILTER_PHYERR;
-                        ath9k_hw_setrxfilter(ah, rxfilter);
-                        ath_dbg(common, DFS, "DFS enabled at freq %d\n",
-                                curchan->center_freq);
-                } else {
-                        /* perform spectral scan if requested. */
-                        if (test_bit(SC_OP_SCANNING, &sc->sc_flags) &&
-                            sc->spectral_mode == SPECTRAL_CHANSCAN)
-                                ath9k_spectral_scan_trigger(hw);
-                }
         }
 
         if (changed & IEEE80211_CONF_CHANGE_POWER) {
diff --git a/drivers/net/wireless/ath/ath9k/mci.c b/drivers/net/wireless/ath/ath9k/mci.c
index 815bee21c19a..0ac1b5f04256 100644
--- a/drivers/net/wireless/ath/ath9k/mci.c
+++ b/drivers/net/wireless/ath/ath9k/mci.c
@@ -661,9 +661,9 @@ void ath9k_mci_update_wlan_channels(struct ath_softc *sc, bool allow_all)
         chan_start = wlan_chan - 10;
         chan_end = wlan_chan + 10;
 
-        if (chan->chanmode == CHANNEL_G_HT40PLUS)
+        if (IS_CHAN_HT40PLUS(chan))
                 chan_end += 20;
-        else if (chan->chanmode == CHANNEL_G_HT40MINUS)
+        else if (IS_CHAN_HT40MINUS(chan))
                 chan_start -= 20;
 
         /* adjust side band */
@@ -707,11 +707,11 @@ void ath9k_mci_set_txpower(struct ath_softc *sc, bool setchannel,
 
         if (setchannel) {
                 struct ath9k_hw_cal_data *caldata = &sc->caldata;
-                if ((caldata->chanmode == CHANNEL_G_HT40PLUS) &&
+                if (IS_CHAN_HT40PLUS(ah->curchan) &&
                     (ah->curchan->channel > caldata->channel) &&
                     (ah->curchan->channel <= caldata->channel + 20))
                         return;
-                if ((caldata->chanmode == CHANNEL_G_HT40MINUS) &&
+                if (IS_CHAN_HT40MINUS(ah->curchan) &&
                     (ah->curchan->channel < caldata->channel) &&
                     (ah->curchan->channel >= caldata->channel - 20))
                         return;
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index ab9e3a8410bc..8b788efb41fd 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -19,7 +19,7 @@
 #include "ath9k.h"
 #include "ar9003_mac.h"
 
-#define SKB_CB_ATHBUF(__skb)    (*((struct ath_buf **)__skb->cb))
+#define SKB_CB_ATHBUF(__skb)    (*((struct ath_rxbuf **)__skb->cb))
 
 static inline bool ath9k_check_auto_sleep(struct ath_softc *sc)
 {
@@ -35,7 +35,7 @@ static inline bool ath9k_check_auto_sleep(struct ath_softc *sc)
  * buffer (or rx fifo). This can incorrectly acknowledge packets
  * to a sender if last desc is self-linked.
  */
-static void ath_rx_buf_link(struct ath_softc *sc, struct ath_buf *bf)
+static void ath_rx_buf_link(struct ath_softc *sc, struct ath_rxbuf *bf)
 {
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
@@ -68,7 +68,7 @@ static void ath_rx_buf_link(struct ath_softc *sc, struct ath_buf *bf)
         sc->rx.rxlink = &ds->ds_link;
 }
 
-static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_buf *bf)
+static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_rxbuf *bf)
 {
         if (sc->rx.buf_hold)
                 ath_rx_buf_link(sc, sc->rx.buf_hold);
@@ -112,13 +112,13 @@ static bool ath_rx_edma_buf_link(struct ath_softc *sc,
         struct ath_hw *ah = sc->sc_ah;
         struct ath_rx_edma *rx_edma;
         struct sk_buff *skb;
-        struct ath_buf *bf;
+        struct ath_rxbuf *bf;
 
         rx_edma = &sc->rx.rx_edma[qtype];
         if (skb_queue_len(&rx_edma->rx_fifo) >= rx_edma->rx_fifo_hwsize)
                 return false;
 
-        bf = list_first_entry(&sc->rx.rxbuf, struct ath_buf, list);
+        bf = list_first_entry(&sc->rx.rxbuf, struct ath_rxbuf, list);
         list_del_init(&bf->list);
 
         skb = bf->bf_mpdu;
@@ -138,7 +138,7 @@ static void ath_rx_addbuffer_edma(struct ath_softc *sc,
                                   enum ath9k_rx_qtype qtype)
 {
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        struct ath_buf *bf, *tbf;
+        struct ath_rxbuf *bf, *tbf;
 
         if (list_empty(&sc->rx.rxbuf)) {
                 ath_dbg(common, QUEUE, "No free rx buf available\n");
@@ -154,7 +154,7 @@ static void ath_rx_addbuffer_edma(struct ath_softc *sc,
 static void ath_rx_remove_buffer(struct ath_softc *sc,
                                  enum ath9k_rx_qtype qtype)
 {
-        struct ath_buf *bf;
+        struct ath_rxbuf *bf;
         struct ath_rx_edma *rx_edma;
         struct sk_buff *skb;
 
@@ -171,7 +171,7 @@ static void ath_rx_edma_cleanup(struct ath_softc *sc)
 {
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
-        struct ath_buf *bf;
+        struct ath_rxbuf *bf;
 
         ath_rx_remove_buffer(sc, ATH9K_RX_QUEUE_LP);
         ath_rx_remove_buffer(sc, ATH9K_RX_QUEUE_HP);
@@ -199,7 +199,7 @@ static int ath_rx_edma_init(struct ath_softc *sc, int nbufs)
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath_hw *ah = sc->sc_ah;
         struct sk_buff *skb;
-        struct ath_buf *bf;
+        struct ath_rxbuf *bf;
         int error = 0, i;
         u32 size;
 
@@ -211,7 +211,7 @@ static int ath_rx_edma_init(struct ath_softc *sc, int nbufs)
         ath_rx_edma_init_queue(&sc->rx.rx_edma[ATH9K_RX_QUEUE_HP],
                                ah->caps.rx_hp_qdepth);
 
-        size = sizeof(struct ath_buf) * nbufs;
+        size = sizeof(struct ath_rxbuf) * nbufs;
         bf = devm_kzalloc(sc->dev, size, GFP_KERNEL);
         if (!bf)
                 return -ENOMEM;
@@ -271,7 +271,7 @@ int ath_rx_init(struct ath_softc *sc, int nbufs)
 {
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct sk_buff *skb;
-        struct ath_buf *bf;
+        struct ath_rxbuf *bf;
         int error = 0;
 
         spin_lock_init(&sc->sc_pcu_lock);
@@ -332,7 +332,7 @@ void ath_rx_cleanup(struct ath_softc *sc)
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
         struct sk_buff *skb;
-        struct ath_buf *bf;
+        struct ath_rxbuf *bf;
 
         if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
                 ath_rx_edma_cleanup(sc);
@@ -427,7 +427,7 @@ u32 ath_calcrxfilter(struct ath_softc *sc)
 int ath_startrecv(struct ath_softc *sc)
 {
         struct ath_hw *ah = sc->sc_ah;
-        struct ath_buf *bf, *tbf;
+        struct ath_rxbuf *bf, *tbf;
 
         if (ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
                 ath_edma_start_recv(sc);
@@ -447,7 +447,7 @@ int ath_startrecv(struct ath_softc *sc)
         if (list_empty(&sc->rx.rxbuf))
                 goto start_recv;
 
-        bf = list_first_entry(&sc->rx.rxbuf, struct ath_buf, list);
+        bf = list_first_entry(&sc->rx.rxbuf, struct ath_rxbuf, list);
         ath9k_hw_putrxbuf(ah, bf->bf_daddr);
         ath9k_hw_rxena(ah);
 
@@ -603,13 +603,13 @@ static void ath_rx_ps(struct ath_softc *sc, struct sk_buff *skb, bool mybeacon)
 static bool ath_edma_get_buffers(struct ath_softc *sc,
                                  enum ath9k_rx_qtype qtype,
                                  struct ath_rx_status *rs,
-                                 struct ath_buf **dest)
+                                 struct ath_rxbuf **dest)
 {
         struct ath_rx_edma *rx_edma = &sc->rx.rx_edma[qtype];
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
         struct sk_buff *skb;
-        struct ath_buf *bf;
+        struct ath_rxbuf *bf;
         int ret;
 
         skb = skb_peek(&rx_edma->rx_fifo);
@@ -653,11 +653,11 @@ static bool ath_edma_get_buffers(struct ath_softc *sc,
         return true;
 }
 
-static struct ath_buf *ath_edma_get_next_rx_buf(struct ath_softc *sc,
+static struct ath_rxbuf *ath_edma_get_next_rx_buf(struct ath_softc *sc,
                                                 struct ath_rx_status *rs,
                                                 enum ath9k_rx_qtype qtype)
 {
-        struct ath_buf *bf = NULL;
+        struct ath_rxbuf *bf = NULL;
 
         while (ath_edma_get_buffers(sc, qtype, rs, &bf)) {
                 if (!bf)
@@ -668,13 +668,13 @@ static struct ath_buf *ath_edma_get_next_rx_buf(struct ath_softc *sc,
         return NULL;
 }
 
-static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc,
+static struct ath_rxbuf *ath_get_next_rx_buf(struct ath_softc *sc,
                                            struct ath_rx_status *rs)
 {
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
         struct ath_desc *ds;
-        struct ath_buf *bf;
+        struct ath_rxbuf *bf;
         int ret;
 
         if (list_empty(&sc->rx.rxbuf)) {
@@ -682,7 +682,7 @@ static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc,
                 return NULL;
         }
 
-        bf = list_first_entry(&sc->rx.rxbuf, struct ath_buf, list);
+        bf = list_first_entry(&sc->rx.rxbuf, struct ath_rxbuf, list);
         if (bf == sc->rx.buf_hold)
                 return NULL;
 
@@ -702,7 +702,7 @@ static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc,
         ret = ath9k_hw_rxprocdesc(ah, ds, rs);
         if (ret == -EINPROGRESS) {
                 struct ath_rx_status trs;
-                struct ath_buf *tbf;
+                struct ath_rxbuf *tbf;
                 struct ath_desc *tds;
 
                 memset(&trs, 0, sizeof(trs));
@@ -711,7 +711,7 @@ static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc,
                         return NULL;
                 }
 
-                tbf = list_entry(bf->list.next, struct ath_buf, list);
+                tbf = list_entry(bf->list.next, struct ath_rxbuf, list);
 
                 /*
                  * On some hardware the descriptor status words could
@@ -1308,7 +1308,7 @@ static void ath9k_apply_ampdu_details(struct ath_softc *sc,
 
 int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
 {
-        struct ath_buf *bf;
+        struct ath_rxbuf *bf;
         struct sk_buff *skb = NULL, *requeue_skb, *hdr_skb;
         struct ieee80211_rx_status *rxs;
         struct ath_hw *ah = sc->sc_ah;
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 1ce8af276878..47696d29743c 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1704,16 +1704,9 @@ int ath_cabq_update(struct ath_softc *sc)
         int qnum = sc->beacon.cabq->axq_qnum;
 
         ath9k_hw_get_txq_props(sc->sc_ah, qnum, &qi);
-        /*
-         * Ensure the readytime % is within the bounds.
-         */
-        if (sc->config.cabqReadytime < ATH9K_READY_TIME_LO_BOUND)
-                sc->config.cabqReadytime = ATH9K_READY_TIME_LO_BOUND;
-        else if (sc->config.cabqReadytime > ATH9K_READY_TIME_HI_BOUND)
-                sc->config.cabqReadytime = ATH9K_READY_TIME_HI_BOUND;
 
         qi.tqi_readyTime = (cur_conf->beacon_interval *
-                            sc->config.cabqReadytime) / 100;
+                            ATH_CABQ_READY_TIME) / 100;
         ath_txq_update(sc, qnum, &qi);
 
         return 0;
@@ -2037,8 +2030,7 @@ u8 ath_txchainmask_reduction(struct ath_softc *sc, u8 chainmask, u32 rate)
         struct ath_hw *ah = sc->sc_ah;
         struct ath9k_channel *curchan = ah->curchan;
 
-        if ((ah->caps.hw_caps & ATH9K_HW_CAP_APM) &&
-            (curchan->channelFlags & CHANNEL_5GHZ) &&
+        if ((ah->caps.hw_caps & ATH9K_HW_CAP_APM) && IS_CHAN_5GHZ(curchan) &&
             (chainmask == 0x7) && (rate < 0x90))
                 return 0x3;
         else if (AR_SREV_9462(ah) && ath9k_hw_btcoex_is_enabled(ah) &&
diff --git a/drivers/net/wireless/ath/wcn36xx/Kconfig b/drivers/net/wireless/ath/wcn36xx/Kconfig
new file mode 100644
index 000000000000..591ebaea8265
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/Kconfig
@@ -0,0 +1,16 @@
+config WCN36XX
+        tristate "Qualcomm Atheros WCN3660/3680 support"
+        depends on MAC80211 && HAS_DMA
+        ---help---
+          This module adds support for wireless adapters based on
+          Qualcomm Atheros WCN3660 and WCN3680 mobile chipsets.
+
+          If you choose to build a module, it'll be called wcn36xx.
+
+config WCN36XX_DEBUGFS
+        bool "WCN36XX debugfs support"
+        depends on WCN36XX
+        ---help---
+          Enabled debugfs support
+
+          If unsure, say Y to make it easier to debug problems.
diff --git a/drivers/net/wireless/ath/wcn36xx/Makefile b/drivers/net/wireless/ath/wcn36xx/Makefile
new file mode 100644
index 000000000000..50c43b4382ba
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/Makefile
@@ -0,0 +1,7 @@
+obj-$(CONFIG_WCN36XX) := wcn36xx.o
+wcn36xx-y +=   main.o \
+               dxe.o \
+               txrx.o \
+               smd.o \
+               pmc.o \
+               debug.o
diff --git a/drivers/net/wireless/ath/wcn36xx/debug.c b/drivers/net/wireless/ath/wcn36xx/debug.c
new file mode 100644
index 000000000000..5b84f7ae0b1e
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/debug.c
@@ -0,0 +1,181 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/debugfs.h>
+#include <linux/uaccess.h>
+#include "wcn36xx.h"
+#include "debug.h"
+#include "pmc.h"
+
+#ifdef CONFIG_WCN36XX_DEBUGFS
+
+static ssize_t read_file_bool_bmps(struct file *file, char __user *user_buf,
+                                   size_t count, loff_t *ppos)
+{
+        struct wcn36xx *wcn = file->private_data;
+        struct wcn36xx_vif *vif_priv = NULL;
+        struct ieee80211_vif *vif = NULL;
+        char buf[3];
+
+        list_for_each_entry(vif_priv, &wcn->vif_list, list) {
+                        vif = container_of((void *)vif_priv,
+                                   struct ieee80211_vif,
+                                   drv_priv);
+                        if (NL80211_IFTYPE_STATION == vif->type) {
+                                if (vif_priv->pw_state == WCN36XX_BMPS)
+                                        buf[0] = '1';
+                                else
+                                        buf[0] = '0';
+                                break;
+                        }
+        }
+        buf[1] = '\n';
+        buf[2] = 0x00;
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
+}
+
+static ssize_t write_file_bool_bmps(struct file *file,
+                                    const char __user *user_buf,
+                                    size_t count, loff_t *ppos)
+{
+        struct wcn36xx *wcn = file->private_data;
+        struct wcn36xx_vif *vif_priv = NULL;
+        struct ieee80211_vif *vif = NULL;
+
+        char buf[32];
+        int buf_size;
+
+        buf_size = min(count, (sizeof(buf)-1));
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+
+        switch (buf[0]) {
+        case 'y':
+        case 'Y':
+        case '1':
+                list_for_each_entry(vif_priv, &wcn->vif_list, list) {
+                        vif = container_of((void *)vif_priv,
+                                   struct ieee80211_vif,
+                                   drv_priv);
+                        if (NL80211_IFTYPE_STATION == vif->type) {
+                                wcn36xx_enable_keep_alive_null_packet(wcn, vif);
+                                wcn36xx_pmc_enter_bmps_state(wcn, vif);
+                        }
+                }
+                break;
+        case 'n':
+        case 'N':
+        case '0':
+                list_for_each_entry(vif_priv, &wcn->vif_list, list) {
+                        vif = container_of((void *)vif_priv,
+                                   struct ieee80211_vif,
+                                   drv_priv);
+                        if (NL80211_IFTYPE_STATION == vif->type)
+                                wcn36xx_pmc_exit_bmps_state(wcn, vif);
+                }
+                break;
+        }
+
+        return count;
+}
+
+static const struct file_operations fops_wcn36xx_bmps = {
+        .open = simple_open,
+        .read  =       read_file_bool_bmps,
+        .write =       write_file_bool_bmps,
+};
+
+static ssize_t write_file_dump(struct file *file,
+                                    const char __user *user_buf,
+                                    size_t count, loff_t *ppos)
+{
+        struct wcn36xx *wcn = file->private_data;
+        char buf[255], *tmp;
+        int buf_size;
+        u32 arg[WCN36xx_MAX_DUMP_ARGS];
+        int i;
+
+        memset(buf, 0, sizeof(buf));
+        memset(arg, 0, sizeof(arg));
+
+        buf_size = min(count, (sizeof(buf) - 1));
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+
+        tmp = buf;
+
+        for (i = 0; i < WCN36xx_MAX_DUMP_ARGS; i++) {
+                char *begin;
+                begin = strsep(&tmp, " ");
+                if (begin == NULL)
+                        break;
+
+                if (kstrtoul(begin, 0, (unsigned long *)(arg + i)) != 0)
+                        break;
+        }
+
+        wcn36xx_info("DUMP args is %d %d %d %d %d\n", arg[0], arg[1], arg[2],
+                     arg[3], arg[4]);
+        wcn36xx_smd_dump_cmd_req(wcn, arg[0], arg[1], arg[2], arg[3], arg[4]);
+
+        return count;
+}
+
+static const struct file_operations fops_wcn36xx_dump = {
+        .open = simple_open,
+        .write =       write_file_dump,
+};
+
+#define ADD_FILE(name, mode, fop, priv_data)            \
+        do {                                                    \
+                struct dentry *d;                               \
+                d = debugfs_create_file(__stringify(name),      \
+                                        mode, dfs->rootdir,     \
+                                        priv_data, fop);        \
+                dfs->file_##name.dentry = d;                    \
+                if (IS_ERR(d)) {                                \
+                        wcn36xx_warn("Create the debugfs entry failed");\
+                        dfs->file_##name.dentry = NULL;         \
+                }                                               \
+        } while (0)
+
+
+void wcn36xx_debugfs_init(struct wcn36xx *wcn)
+{
+        struct wcn36xx_dfs_entry *dfs = &wcn->dfs;
+
+        dfs->rootdir = debugfs_create_dir(KBUILD_MODNAME,
+                                          wcn->hw->wiphy->debugfsdir);
+        if (IS_ERR(dfs->rootdir)) {
+                wcn36xx_warn("Create the debugfs failed\n");
+                dfs->rootdir = NULL;
+        }
+
+        ADD_FILE(bmps_switcher, S_IRUSR | S_IWUSR,
+                 &fops_wcn36xx_bmps, wcn);
+        ADD_FILE(dump, S_IWUSR, &fops_wcn36xx_dump, wcn);
+}
+
+void wcn36xx_debugfs_exit(struct wcn36xx *wcn)
+{
+        struct wcn36xx_dfs_entry *dfs = &wcn->dfs;
+        debugfs_remove_recursive(dfs->rootdir);
+}
+
+#endif /* CONFIG_WCN36XX_DEBUGFS */
diff --git a/drivers/net/wireless/ath/wcn36xx/debug.h b/drivers/net/wireless/ath/wcn36xx/debug.h
new file mode 100644
index 000000000000..46307aa562d3
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/debug.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _WCN36XX_DEBUG_H_
+#define _WCN36XX_DEBUG_H_
+
+#include <linux/kernel.h>
+
+#define WCN36xx_MAX_DUMP_ARGS   5
+
+#ifdef CONFIG_WCN36XX_DEBUGFS
+struct wcn36xx_dfs_file {
+        struct dentry *dentry;
+        u32 value;
+};
+
+struct wcn36xx_dfs_entry {
+        struct dentry *rootdir;
+        struct wcn36xx_dfs_file file_bmps_switcher;
+        struct wcn36xx_dfs_file file_dump;
+};
+
+void wcn36xx_debugfs_init(struct wcn36xx *wcn);
+void wcn36xx_debugfs_exit(struct wcn36xx *wcn);
+
+#else
+static inline void wcn36xx_debugfs_init(struct wcn36xx *wcn)
+{
+}
+static inline void wcn36xx_debugfs_exit(struct wcn36xx *wcn)
+{
+}
+
+#endif /* CONFIG_WCN36XX_DEBUGFS */
+
+#endif  /* _WCN36XX_DEBUG_H_ */
diff --git a/drivers/net/wireless/ath/wcn36xx/dxe.c b/drivers/net/wireless/ath/wcn36xx/dxe.c
new file mode 100644
index 000000000000..ee25786b4447
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/dxe.c
@@ -0,0 +1,805 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* DXE - DMA transfer engine
+ * we have 2 channels(High prio and Low prio) for TX and 2 channels for RX.
+ * through low channels data packets are transfered
+ * through high channels managment packets are transfered
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/interrupt.h>
+#include "wcn36xx.h"
+#include "txrx.h"
+
+void *wcn36xx_dxe_get_next_bd(struct wcn36xx *wcn, bool is_low)
+{
+        struct wcn36xx_dxe_ch *ch = is_low ?
+                &wcn->dxe_tx_l_ch :
+                &wcn->dxe_tx_h_ch;
+
+        return ch->head_blk_ctl->bd_cpu_addr;
+}
+
+static void wcn36xx_dxe_write_register(struct wcn36xx *wcn, int addr, int data)
+{
+        wcn36xx_dbg(WCN36XX_DBG_DXE,
+                    "wcn36xx_dxe_write_register: addr=%x, data=%x\n",
+                    addr, data);
+
+        writel(data, wcn->mmio + addr);
+}
+
+static void wcn36xx_dxe_read_register(struct wcn36xx *wcn, int addr, int *data)
+{
+        *data = readl(wcn->mmio + addr);
+
+        wcn36xx_dbg(WCN36XX_DBG_DXE,
+                    "wcn36xx_dxe_read_register: addr=%x, data=%x\n",
+                    addr, *data);
+}
+
+static void wcn36xx_dxe_free_ctl_block(struct wcn36xx_dxe_ch *ch)
+{
+        struct wcn36xx_dxe_ctl *ctl = ch->head_blk_ctl, *next;
+        int i;
+
+        for (i = 0; i < ch->desc_num && ctl; i++) {
+                next = ctl->next;
+                kfree(ctl);
+                ctl = next;
+        }
+}
+
+static int wcn36xx_dxe_allocate_ctl_block(struct wcn36xx_dxe_ch *ch)
+{
+        struct wcn36xx_dxe_ctl *prev_ctl = NULL;
+        struct wcn36xx_dxe_ctl *cur_ctl = NULL;
+        int i;
+
+        for (i = 0; i < ch->desc_num; i++) {
+                cur_ctl = kzalloc(sizeof(*cur_ctl), GFP_KERNEL);
+                if (!cur_ctl)
+                        goto out_fail;
+
+                cur_ctl->ctl_blk_order = i;
+                if (i == 0) {
+                        ch->head_blk_ctl = cur_ctl;
+                        ch->tail_blk_ctl = cur_ctl;
+                } else if (ch->desc_num - 1 == i) {
+                        prev_ctl->next = cur_ctl;
+                        cur_ctl->next = ch->head_blk_ctl;
+                } else {
+                        prev_ctl->next = cur_ctl;
+                }
+                prev_ctl = cur_ctl;
+        }
+
+        return 0;
+
+out_fail:
+        wcn36xx_dxe_free_ctl_block(ch);
+        return -ENOMEM;
+}
+
+int wcn36xx_dxe_alloc_ctl_blks(struct wcn36xx *wcn)
+{
+        int ret;
+
+        wcn->dxe_tx_l_ch.ch_type = WCN36XX_DXE_CH_TX_L;
+        wcn->dxe_tx_h_ch.ch_type = WCN36XX_DXE_CH_TX_H;
+        wcn->dxe_rx_l_ch.ch_type = WCN36XX_DXE_CH_RX_L;
+        wcn->dxe_rx_h_ch.ch_type = WCN36XX_DXE_CH_RX_H;
+
+        wcn->dxe_tx_l_ch.desc_num = WCN36XX_DXE_CH_DESC_NUMB_TX_L;
+        wcn->dxe_tx_h_ch.desc_num = WCN36XX_DXE_CH_DESC_NUMB_TX_H;
+        wcn->dxe_rx_l_ch.desc_num = WCN36XX_DXE_CH_DESC_NUMB_RX_L;
+        wcn->dxe_rx_h_ch.desc_num = WCN36XX_DXE_CH_DESC_NUMB_RX_H;
+
+        wcn->dxe_tx_l_ch.dxe_wq =  WCN36XX_DXE_WQ_TX_L;
+        wcn->dxe_tx_h_ch.dxe_wq =  WCN36XX_DXE_WQ_TX_H;
+
+        wcn->dxe_tx_l_ch.ctrl_bd = WCN36XX_DXE_CTRL_TX_L_BD;
+        wcn->dxe_tx_h_ch.ctrl_bd = WCN36XX_DXE_CTRL_TX_H_BD;
+
+        wcn->dxe_tx_l_ch.ctrl_skb = WCN36XX_DXE_CTRL_TX_L_SKB;
+        wcn->dxe_tx_h_ch.ctrl_skb = WCN36XX_DXE_CTRL_TX_H_SKB;
+
+        wcn->dxe_tx_l_ch.reg_ctrl = WCN36XX_DXE_REG_CTL_TX_L;
+        wcn->dxe_tx_h_ch.reg_ctrl = WCN36XX_DXE_REG_CTL_TX_H;
+
+        wcn->dxe_tx_l_ch.def_ctrl = WCN36XX_DXE_CH_DEFAULT_CTL_TX_L;
+        wcn->dxe_tx_h_ch.def_ctrl = WCN36XX_DXE_CH_DEFAULT_CTL_TX_H;
+
+        /* DXE control block allocation */
+        ret = wcn36xx_dxe_allocate_ctl_block(&wcn->dxe_tx_l_ch);
+        if (ret)
+                goto out_err;
+        ret = wcn36xx_dxe_allocate_ctl_block(&wcn->dxe_tx_h_ch);
+        if (ret)
+                goto out_err;
+        ret = wcn36xx_dxe_allocate_ctl_block(&wcn->dxe_rx_l_ch);
+        if (ret)
+                goto out_err;
+        ret = wcn36xx_dxe_allocate_ctl_block(&wcn->dxe_rx_h_ch);
+        if (ret)
+                goto out_err;
+
+        /* Initialize SMSM state  Clear TX Enable RING EMPTY STATE */
+        ret = wcn->ctrl_ops->smsm_change_state(
+                WCN36XX_SMSM_WLAN_TX_ENABLE,
+                WCN36XX_SMSM_WLAN_TX_RINGS_EMPTY);
+
+        return 0;
+
+out_err:
+        wcn36xx_err("Failed to allocate DXE control blocks\n");
+        wcn36xx_dxe_free_ctl_blks(wcn);
+        return -ENOMEM;
+}
+
+void wcn36xx_dxe_free_ctl_blks(struct wcn36xx *wcn)
+{
+        wcn36xx_dxe_free_ctl_block(&wcn->dxe_tx_l_ch);
+        wcn36xx_dxe_free_ctl_block(&wcn->dxe_tx_h_ch);
+        wcn36xx_dxe_free_ctl_block(&wcn->dxe_rx_l_ch);
+        wcn36xx_dxe_free_ctl_block(&wcn->dxe_rx_h_ch);
+}
+
+static int wcn36xx_dxe_init_descs(struct wcn36xx_dxe_ch *wcn_ch)
+{
+        struct wcn36xx_dxe_desc *cur_dxe = NULL;
+        struct wcn36xx_dxe_desc *prev_dxe = NULL;
+        struct wcn36xx_dxe_ctl *cur_ctl = NULL;
+        size_t size;
+        int i;
+
+        size = wcn_ch->desc_num * sizeof(struct wcn36xx_dxe_desc);
+        wcn_ch->cpu_addr = dma_alloc_coherent(NULL, size, &wcn_ch->dma_addr,
+                                              GFP_KERNEL);
+        if (!wcn_ch->cpu_addr)
+                return -ENOMEM;
+
+        memset(wcn_ch->cpu_addr, 0, size);
+
+        cur_dxe = (struct wcn36xx_dxe_desc *)wcn_ch->cpu_addr;
+        cur_ctl = wcn_ch->head_blk_ctl;
+
+        for (i = 0; i < wcn_ch->desc_num; i++) {
+                cur_ctl->desc = cur_dxe;
+                cur_ctl->desc_phy_addr = wcn_ch->dma_addr +
+                        i * sizeof(struct wcn36xx_dxe_desc);
+
+                switch (wcn_ch->ch_type) {
+                case WCN36XX_DXE_CH_TX_L:
+                        cur_dxe->ctrl = WCN36XX_DXE_CTRL_TX_L;
+                        cur_dxe->dst_addr_l = WCN36XX_DXE_WQ_TX_L;
+                        break;
+                case WCN36XX_DXE_CH_TX_H:
+                        cur_dxe->ctrl = WCN36XX_DXE_CTRL_TX_H;
+                        cur_dxe->dst_addr_l = WCN36XX_DXE_WQ_TX_H;
+                        break;
+                case WCN36XX_DXE_CH_RX_L:
+                        cur_dxe->ctrl = WCN36XX_DXE_CTRL_RX_L;
+                        cur_dxe->src_addr_l = WCN36XX_DXE_WQ_RX_L;
+                        break;
+                case WCN36XX_DXE_CH_RX_H:
+                        cur_dxe->ctrl = WCN36XX_DXE_CTRL_RX_H;
+                        cur_dxe->src_addr_l = WCN36XX_DXE_WQ_RX_H;
+                        break;
+                }
+                if (0 == i) {
+                        cur_dxe->phy_next_l = 0;
+                } else if ((0 < i) && (i < wcn_ch->desc_num - 1)) {
+                        prev_dxe->phy_next_l =
+                                cur_ctl->desc_phy_addr;
+                } else if (i == (wcn_ch->desc_num - 1)) {
+                        prev_dxe->phy_next_l =
+                                cur_ctl->desc_phy_addr;
+                        cur_dxe->phy_next_l =
+                                wcn_ch->head_blk_ctl->desc_phy_addr;
+                }
+                cur_ctl = cur_ctl->next;
+                prev_dxe = cur_dxe;
+                cur_dxe++;
+        }
+
+        return 0;
+}
+
+static void wcn36xx_dxe_init_tx_bd(struct wcn36xx_dxe_ch *ch,
+                                   struct wcn36xx_dxe_mem_pool *pool)
+{
+        int i, chunk_size = pool->chunk_size;
+        dma_addr_t bd_phy_addr = pool->phy_addr;
+        void *bd_cpu_addr = pool->virt_addr;
+        struct wcn36xx_dxe_ctl *cur = ch->head_blk_ctl;
+
+        for (i = 0; i < ch->desc_num; i++) {
+                /* Only every second dxe needs a bd pointer,
+                   the other will point to the skb data */
+                if (!(i & 1)) {
+                        cur->bd_phy_addr = bd_phy_addr;
+                        cur->bd_cpu_addr = bd_cpu_addr;
+                        bd_phy_addr += chunk_size;
+                        bd_cpu_addr += chunk_size;
+                } else {
+                        cur->bd_phy_addr = 0;
+                        cur->bd_cpu_addr = NULL;
+                }
+                cur = cur->next;
+        }
+}
+
+static int wcn36xx_dxe_enable_ch_int(struct wcn36xx *wcn, u16 wcn_ch)
+{
+        int reg_data = 0;
+
+        wcn36xx_dxe_read_register(wcn,
+                                  WCN36XX_DXE_INT_MASK_REG,
+                                  &reg_data);
+
+        reg_data |= wcn_ch;
+
+        wcn36xx_dxe_write_register(wcn,
+                                   WCN36XX_DXE_INT_MASK_REG,
+                                   (int)reg_data);
+        return 0;
+}
+
+static int wcn36xx_dxe_fill_skb(struct wcn36xx_dxe_ctl *ctl)
+{
+        struct wcn36xx_dxe_desc *dxe = ctl->desc;
+        struct sk_buff *skb;
+
+        skb = alloc_skb(WCN36XX_PKT_SIZE, GFP_ATOMIC);
+        if (skb == NULL)
+                return -ENOMEM;
+
+        dxe->dst_addr_l = dma_map_single(NULL,
+                                         skb_tail_pointer(skb),
+                                         WCN36XX_PKT_SIZE,
+                                         DMA_FROM_DEVICE);
+        ctl->skb = skb;
+
+        return 0;
+}
+
+static int wcn36xx_dxe_ch_alloc_skb(struct wcn36xx *wcn,
+                                    struct wcn36xx_dxe_ch *wcn_ch)
+{
+        int i;
+        struct wcn36xx_dxe_ctl *cur_ctl = NULL;
+
+        cur_ctl = wcn_ch->head_blk_ctl;
+
+        for (i = 0; i < wcn_ch->desc_num; i++) {
+                wcn36xx_dxe_fill_skb(cur_ctl);
+                cur_ctl = cur_ctl->next;
+        }
+
+        return 0;
+}
+
+static void wcn36xx_dxe_ch_free_skbs(struct wcn36xx *wcn,
+                                     struct wcn36xx_dxe_ch *wcn_ch)
+{
+        struct wcn36xx_dxe_ctl *cur = wcn_ch->head_blk_ctl;
+        int i;
+
+        for (i = 0; i < wcn_ch->desc_num; i++) {
+                kfree_skb(cur->skb);
+                cur = cur->next;
+        }
+}
+
+void wcn36xx_dxe_tx_ack_ind(struct wcn36xx *wcn, u32 status)
+{
+        struct ieee80211_tx_info *info;
+        struct sk_buff *skb;
+        unsigned long flags;
+
+        spin_lock_irqsave(&wcn->dxe_lock, flags);
+        skb = wcn->tx_ack_skb;
+        wcn->tx_ack_skb = NULL;
+        spin_unlock_irqrestore(&wcn->dxe_lock, flags);
+
+        if (!skb) {
+                wcn36xx_warn("Spurious TX complete indication\n");
+                return;
+        }
+
+        info = IEEE80211_SKB_CB(skb);
+
+        if (status == 1)
+                info->flags |= IEEE80211_TX_STAT_ACK;
+
+        wcn36xx_dbg(WCN36XX_DBG_DXE, "dxe tx ack status: %d\n", status);
+
+        ieee80211_tx_status_irqsafe(wcn->hw, skb);
+        ieee80211_wake_queues(wcn->hw);
+}
+
+static void reap_tx_dxes(struct wcn36xx *wcn, struct wcn36xx_dxe_ch *ch)
+{
+        struct wcn36xx_dxe_ctl *ctl = ch->tail_blk_ctl;
+        struct ieee80211_tx_info *info;
+        unsigned long flags;
+
+        /*
+         * Make at least one loop of do-while because in case ring is
+         * completely full head and tail are pointing to the same element
+         * and while-do will not make any cycles.
+         */
+        do {
+                if (ctl->skb) {
+                        dma_unmap_single(NULL, ctl->desc->src_addr_l,
+                                         ctl->skb->len, DMA_TO_DEVICE);
+                        info = IEEE80211_SKB_CB(ctl->skb);
+                        if (!(info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS)) {
+                                /* Keep frame until TX status comes */
+                                ieee80211_free_txskb(wcn->hw, ctl->skb);
+                        }
+                        spin_lock_irqsave(&ctl->skb_lock, flags);
+                        if (wcn->queues_stopped) {
+                                wcn->queues_stopped = false;
+                                ieee80211_wake_queues(wcn->hw);
+                        }
+                        spin_unlock_irqrestore(&ctl->skb_lock, flags);
+
+                        ctl->skb = NULL;
+                }
+                ctl = ctl->next;
+        } while (ctl != ch->head_blk_ctl &&
+               !(ctl->desc->ctrl & WCN36XX_DXE_CTRL_VALID_MASK));
+
+        ch->tail_blk_ctl = ctl;
+}
+
+static irqreturn_t wcn36xx_irq_tx_complete(int irq, void *dev)
+{
+        struct wcn36xx *wcn = (struct wcn36xx *)dev;
+        int int_src, int_reason;
+
+        wcn36xx_dxe_read_register(wcn, WCN36XX_DXE_INT_SRC_RAW_REG, &int_src);
+
+        if (int_src & WCN36XX_INT_MASK_CHAN_TX_H) {
+                wcn36xx_dxe_read_register(wcn,
+                                          WCN36XX_DXE_CH_STATUS_REG_ADDR_TX_H,
+                                          &int_reason);
+
+                /* TODO: Check int_reason */
+
+                wcn36xx_dxe_write_register(wcn,
+                                           WCN36XX_DXE_0_INT_CLR,
+                                           WCN36XX_INT_MASK_CHAN_TX_H);
+
+                wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_0_INT_ED_CLR,
+                                           WCN36XX_INT_MASK_CHAN_TX_H);
+                wcn36xx_dbg(WCN36XX_DBG_DXE, "dxe tx ready high\n");
+                reap_tx_dxes(wcn, &wcn->dxe_tx_h_ch);
+        }
+
+        if (int_src & WCN36XX_INT_MASK_CHAN_TX_L) {
+                wcn36xx_dxe_read_register(wcn,
+                                          WCN36XX_DXE_CH_STATUS_REG_ADDR_TX_L,
+                                          &int_reason);
+                /* TODO: Check int_reason */
+
+                wcn36xx_dxe_write_register(wcn,
+                                           WCN36XX_DXE_0_INT_CLR,
+                                           WCN36XX_INT_MASK_CHAN_TX_L);
+
+                wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_0_INT_ED_CLR,
+                                           WCN36XX_INT_MASK_CHAN_TX_L);
+                wcn36xx_dbg(WCN36XX_DBG_DXE, "dxe tx ready low\n");
+                reap_tx_dxes(wcn, &wcn->dxe_tx_l_ch);
+        }
+
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t wcn36xx_irq_rx_ready(int irq, void *dev)
+{
+        struct wcn36xx *wcn = (struct wcn36xx *)dev;
+
+        disable_irq_nosync(wcn->rx_irq);
+        wcn36xx_dxe_rx_frame(wcn);
+        enable_irq(wcn->rx_irq);
+        return IRQ_HANDLED;
+}
+
+static int wcn36xx_dxe_request_irqs(struct wcn36xx *wcn)
+{
+        int ret;
+
+        ret = request_irq(wcn->tx_irq, wcn36xx_irq_tx_complete,
+                          IRQF_TRIGGER_HIGH, "wcn36xx_tx", wcn);
+        if (ret) {
+                wcn36xx_err("failed to alloc tx irq\n");
+                goto out_err;
+        }
+
+        ret = request_irq(wcn->rx_irq, wcn36xx_irq_rx_ready, IRQF_TRIGGER_HIGH,
+                          "wcn36xx_rx", wcn);
+        if (ret) {
+                wcn36xx_err("failed to alloc rx irq\n");
+                goto out_txirq;
+        }
+
+        enable_irq_wake(wcn->rx_irq);
+
+        return 0;
+
+out_txirq:
+        free_irq(wcn->tx_irq, wcn);
+out_err:
+        return ret;
+
+}
+
+static int wcn36xx_rx_handle_packets(struct wcn36xx *wcn,
+                                     struct wcn36xx_dxe_ch *ch)
+{
+        struct wcn36xx_dxe_ctl *ctl = ch->head_blk_ctl;
+        struct wcn36xx_dxe_desc *dxe = ctl->desc;
+        dma_addr_t  dma_addr;
+        struct sk_buff *skb;
+
+        while (!(dxe->ctrl & WCN36XX_DXE_CTRL_VALID_MASK)) {
+                skb = ctl->skb;
+                dma_addr = dxe->dst_addr_l;
+                wcn36xx_dxe_fill_skb(ctl);
+
+                switch (ch->ch_type) {
+                case WCN36XX_DXE_CH_RX_L:
+                        dxe->ctrl = WCN36XX_DXE_CTRL_RX_L;
+                        wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_ENCH_ADDR,
+                                                   WCN36XX_DXE_INT_CH1_MASK);
+                        break;
+                case WCN36XX_DXE_CH_RX_H:
+                        dxe->ctrl = WCN36XX_DXE_CTRL_RX_H;
+                        wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_ENCH_ADDR,
+                                                   WCN36XX_DXE_INT_CH3_MASK);
+                        break;
+                default:
+                        wcn36xx_warn("Unknown channel\n");
+                }
+
+                dma_unmap_single(NULL, dma_addr, WCN36XX_PKT_SIZE,
+                                 DMA_FROM_DEVICE);
+                wcn36xx_rx_skb(wcn, skb);
+                ctl = ctl->next;
+                dxe = ctl->desc;
+        }
+
+        ch->head_blk_ctl = ctl;
+
+        return 0;
+}
+
+void wcn36xx_dxe_rx_frame(struct wcn36xx *wcn)
+{
+        int int_src;
+
+        wcn36xx_dxe_read_register(wcn, WCN36XX_DXE_INT_SRC_RAW_REG, &int_src);
+
+        /* RX_LOW_PRI */
+        if (int_src & WCN36XX_DXE_INT_CH1_MASK) {
+                wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_0_INT_CLR,
+                                           WCN36XX_DXE_INT_CH1_MASK);
+                wcn36xx_rx_handle_packets(wcn, &(wcn->dxe_rx_l_ch));
+        }
+
+        /* RX_HIGH_PRI */
+        if (int_src & WCN36XX_DXE_INT_CH3_MASK) {
+                /* Clean up all the INT within this channel */
+                wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_0_INT_CLR,
+                                           WCN36XX_DXE_INT_CH3_MASK);
+                wcn36xx_rx_handle_packets(wcn, &(wcn->dxe_rx_h_ch));
+        }
+
+        if (!int_src)
+                wcn36xx_warn("No DXE interrupt pending\n");
+}
+
+int wcn36xx_dxe_allocate_mem_pools(struct wcn36xx *wcn)
+{
+        size_t s;
+        void *cpu_addr;
+
+        /* Allocate BD headers for MGMT frames */
+
+        /* Where this come from ask QC */
+        wcn->mgmt_mem_pool.chunk_size = WCN36XX_BD_CHUNK_SIZE +
+                16 - (WCN36XX_BD_CHUNK_SIZE % 8);
+
+        s = wcn->mgmt_mem_pool.chunk_size * WCN36XX_DXE_CH_DESC_NUMB_TX_H;
+        cpu_addr = dma_alloc_coherent(NULL, s, &wcn->mgmt_mem_pool.phy_addr,
+                                      GFP_KERNEL);
+        if (!cpu_addr)
+                goto out_err;
+
+        wcn->mgmt_mem_pool.virt_addr = cpu_addr;
+        memset(cpu_addr, 0, s);
+
+        /* Allocate BD headers for DATA frames */
+
+        /* Where this come from ask QC */
+        wcn->data_mem_pool.chunk_size = WCN36XX_BD_CHUNK_SIZE +
+                16 - (WCN36XX_BD_CHUNK_SIZE % 8);
+
+        s = wcn->data_mem_pool.chunk_size * WCN36XX_DXE_CH_DESC_NUMB_TX_L;
+        cpu_addr = dma_alloc_coherent(NULL, s, &wcn->data_mem_pool.phy_addr,
+                                      GFP_KERNEL);
+        if (!cpu_addr)
+                goto out_err;
+
+        wcn->data_mem_pool.virt_addr = cpu_addr;
+        memset(cpu_addr, 0, s);
+
+        return 0;
+
+out_err:
+        wcn36xx_dxe_free_mem_pools(wcn);
+        wcn36xx_err("Failed to allocate BD mempool\n");
+        return -ENOMEM;
+}
+
+void wcn36xx_dxe_free_mem_pools(struct wcn36xx *wcn)
+{
+        if (wcn->mgmt_mem_pool.virt_addr)
+                dma_free_coherent(NULL, wcn->mgmt_mem_pool.chunk_size *
+                                  WCN36XX_DXE_CH_DESC_NUMB_TX_H,
+                                  wcn->mgmt_mem_pool.virt_addr,
+                                  wcn->mgmt_mem_pool.phy_addr);
+
+        if (wcn->data_mem_pool.virt_addr) {
+                dma_free_coherent(NULL, wcn->data_mem_pool.chunk_size *
+                                  WCN36XX_DXE_CH_DESC_NUMB_TX_L,
+                                  wcn->data_mem_pool.virt_addr,
+                                  wcn->data_mem_pool.phy_addr);
+        }
+}
+
+int wcn36xx_dxe_tx_frame(struct wcn36xx *wcn,
+                         struct wcn36xx_vif *vif_priv,
+                         struct sk_buff *skb,
+                         bool is_low)
+{
+        struct wcn36xx_dxe_ctl *ctl = NULL;
+        struct wcn36xx_dxe_desc *desc = NULL;
+        struct wcn36xx_dxe_ch *ch = NULL;
+        unsigned long flags;
+
+        ch = is_low ? &wcn->dxe_tx_l_ch : &wcn->dxe_tx_h_ch;
+
+        ctl = ch->head_blk_ctl;
+
+        spin_lock_irqsave(&ctl->next->skb_lock, flags);
+
+        /*
+         * If skb is not null that means that we reached the tail of the ring
+         * hence ring is full. Stop queues to let mac80211 back off until ring
+         * has an empty slot again.
+         */
+        if (NULL != ctl->next->skb) {
+                ieee80211_stop_queues(wcn->hw);
+                wcn->queues_stopped = true;
+                spin_unlock_irqrestore(&ctl->next->skb_lock, flags);
+                return -EBUSY;
+        }
+        spin_unlock_irqrestore(&ctl->next->skb_lock, flags);
+
+        ctl->skb = NULL;
+        desc = ctl->desc;
+
+        /* Set source address of the BD we send */
+        desc->src_addr_l = ctl->bd_phy_addr;
+
+        desc->dst_addr_l = ch->dxe_wq;
+        desc->fr_len = sizeof(struct wcn36xx_tx_bd);
+        desc->ctrl = ch->ctrl_bd;
+
+        wcn36xx_dbg(WCN36XX_DBG_DXE, "DXE TX\n");
+
+        wcn36xx_dbg_dump(WCN36XX_DBG_DXE_DUMP, "DESC1 >>> ",
+                         (char *)desc, sizeof(*desc));
+        wcn36xx_dbg_dump(WCN36XX_DBG_DXE_DUMP,
+                         "BD   >>> ", (char *)ctl->bd_cpu_addr,
+                         sizeof(struct wcn36xx_tx_bd));
+
+        /* Set source address of the SKB we send */
+        ctl = ctl->next;
+        ctl->skb = skb;
+        desc = ctl->desc;
+        if (ctl->bd_cpu_addr) {
+                wcn36xx_err("bd_cpu_addr cannot be NULL for skb DXE\n");
+                return -EINVAL;
+        }
+
+        desc->src_addr_l = dma_map_single(NULL,
+                                          ctl->skb->data,
+                                          ctl->skb->len,
+                                          DMA_TO_DEVICE);
+
+        desc->dst_addr_l = ch->dxe_wq;
+        desc->fr_len = ctl->skb->len;
+
+        /* set dxe descriptor to VALID */
+        desc->ctrl = ch->ctrl_skb;
+
+        wcn36xx_dbg_dump(WCN36XX_DBG_DXE_DUMP, "DESC2 >>> ",
+                         (char *)desc, sizeof(*desc));
+        wcn36xx_dbg_dump(WCN36XX_DBG_DXE_DUMP, "SKB   >>> ",
+                         (char *)ctl->skb->data, ctl->skb->len);
+
+        /* Move the head of the ring to the next empty descriptor */
+         ch->head_blk_ctl = ctl->next;
+
+        /*
+         * When connected and trying to send data frame chip can be in sleep
+         * mode and writing to the register will not wake up the chip. Instead
+         * notify chip about new frame through SMSM bus.
+         */
+        if (is_low &&  vif_priv->pw_state == WCN36XX_BMPS) {
+                wcn->ctrl_ops->smsm_change_state(
+                                  0,
+                                  WCN36XX_SMSM_WLAN_TX_ENABLE);
+        } else {
+                /* indicate End Of Packet and generate interrupt on descriptor
+                 * done.
+                 */
+                wcn36xx_dxe_write_register(wcn,
+                        ch->reg_ctrl, ch->def_ctrl);
+        }
+
+        return 0;
+}
+
+int wcn36xx_dxe_init(struct wcn36xx *wcn)
+{
+        int reg_data = 0, ret;
+
+        reg_data = WCN36XX_DXE_REG_RESET;
+        wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_REG_CSR_RESET, reg_data);
+
+        /* Setting interrupt path */
+        reg_data = WCN36XX_DXE_CCU_INT;
+        wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_REG_CCU_INT, reg_data);
+
+        /***************************************/
+        /* Init descriptors for TX LOW channel */
+        /***************************************/
+        wcn36xx_dxe_init_descs(&wcn->dxe_tx_l_ch);
+        wcn36xx_dxe_init_tx_bd(&wcn->dxe_tx_l_ch, &wcn->data_mem_pool);
+
+        /* Write channel head to a NEXT register */
+        wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_CH_NEXT_DESC_ADDR_TX_L,
+                wcn->dxe_tx_l_ch.head_blk_ctl->desc_phy_addr);
+
+        /* Program DMA destination addr for TX LOW */
+        wcn36xx_dxe_write_register(wcn,
+                WCN36XX_DXE_CH_DEST_ADDR_TX_L,
+                WCN36XX_DXE_WQ_TX_L);
+
+        wcn36xx_dxe_read_register(wcn, WCN36XX_DXE_REG_CH_EN, &reg_data);
+        wcn36xx_dxe_enable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_TX_L);
+
+        /***************************************/
+        /* Init descriptors for TX HIGH channel */
+        /***************************************/
+        wcn36xx_dxe_init_descs(&wcn->dxe_tx_h_ch);
+        wcn36xx_dxe_init_tx_bd(&wcn->dxe_tx_h_ch, &wcn->mgmt_mem_pool);
+
+        /* Write channel head to a NEXT register */
+        wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_CH_NEXT_DESC_ADDR_TX_H,
+                wcn->dxe_tx_h_ch.head_blk_ctl->desc_phy_addr);
+
+        /* Program DMA destination addr for TX HIGH */
+        wcn36xx_dxe_write_register(wcn,
+                WCN36XX_DXE_CH_DEST_ADDR_TX_H,
+                WCN36XX_DXE_WQ_TX_H);
+
+        wcn36xx_dxe_read_register(wcn, WCN36XX_DXE_REG_CH_EN, &reg_data);
+
+        /* Enable channel interrupts */
+        wcn36xx_dxe_enable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_TX_H);
+
+        /***************************************/
+        /* Init descriptors for RX LOW channel */
+        /***************************************/
+        wcn36xx_dxe_init_descs(&wcn->dxe_rx_l_ch);
+
+        /* For RX we need to preallocated buffers */
+        wcn36xx_dxe_ch_alloc_skb(wcn, &wcn->dxe_rx_l_ch);
+
+        /* Write channel head to a NEXT register */
+        wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_CH_NEXT_DESC_ADDR_RX_L,
+                wcn->dxe_rx_l_ch.head_blk_ctl->desc_phy_addr);
+
+        /* Write DMA source address */
+        wcn36xx_dxe_write_register(wcn,
+                WCN36XX_DXE_CH_SRC_ADDR_RX_L,
+                WCN36XX_DXE_WQ_RX_L);
+
+        /* Program preallocated destination address */
+        wcn36xx_dxe_write_register(wcn,
+                WCN36XX_DXE_CH_DEST_ADDR_RX_L,
+                wcn->dxe_rx_l_ch.head_blk_ctl->desc->phy_next_l);
+
+        /* Enable default control registers */
+        wcn36xx_dxe_write_register(wcn,
+                WCN36XX_DXE_REG_CTL_RX_L,
+                WCN36XX_DXE_CH_DEFAULT_CTL_RX_L);
+
+        /* Enable channel interrupts */
+        wcn36xx_dxe_enable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_RX_L);
+
+        /***************************************/
+        /* Init descriptors for RX HIGH channel */
+        /***************************************/
+        wcn36xx_dxe_init_descs(&wcn->dxe_rx_h_ch);
+
+        /* For RX we need to prealocat buffers */
+        wcn36xx_dxe_ch_alloc_skb(wcn, &wcn->dxe_rx_h_ch);
+
+        /* Write chanel head to a NEXT register */
+        wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_CH_NEXT_DESC_ADDR_RX_H,
+                wcn->dxe_rx_h_ch.head_blk_ctl->desc_phy_addr);
+
+        /* Write DMA source address */
+        wcn36xx_dxe_write_register(wcn,
+                WCN36XX_DXE_CH_SRC_ADDR_RX_H,
+                WCN36XX_DXE_WQ_RX_H);
+
+        /* Program preallocated destination address */
+        wcn36xx_dxe_write_register(wcn,
+                WCN36XX_DXE_CH_DEST_ADDR_RX_H,
+                 wcn->dxe_rx_h_ch.head_blk_ctl->desc->phy_next_l);
+
+        /* Enable default control registers */
+        wcn36xx_dxe_write_register(wcn,
+                WCN36XX_DXE_REG_CTL_RX_H,
+                WCN36XX_DXE_CH_DEFAULT_CTL_RX_H);
+
+        /* Enable channel interrupts */
+        wcn36xx_dxe_enable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_RX_H);
+
+        ret = wcn36xx_dxe_request_irqs(wcn);
+        if (ret < 0)
+                goto out_err;
+
+        return 0;
+
+out_err:
+        return ret;
+}
+
+void wcn36xx_dxe_deinit(struct wcn36xx *wcn)
+{
+        free_irq(wcn->tx_irq, wcn);
+        free_irq(wcn->rx_irq, wcn);
+
+        if (wcn->tx_ack_skb) {
+                ieee80211_tx_status_irqsafe(wcn->hw, wcn->tx_ack_skb);
+                wcn->tx_ack_skb = NULL;
+        }
+
+        wcn36xx_dxe_ch_free_skbs(wcn, &wcn->dxe_rx_l_ch);
+        wcn36xx_dxe_ch_free_skbs(wcn, &wcn->dxe_rx_h_ch);
+}
diff --git a/drivers/net/wireless/ath/wcn36xx/dxe.h b/drivers/net/wireless/ath/wcn36xx/dxe.h
new file mode 100644
index 000000000000..c88562f85de1
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/dxe.h
@@ -0,0 +1,284 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _DXE_H_
+#define _DXE_H_
+
+#include "wcn36xx.h"
+
+/*
+TX_LOW  = DMA0
+TX_HIGH = DMA4
+RX_LOW  = DMA1
+RX_HIGH = DMA3
+H2H_TEST_RX_TX = DMA2
+*/
+
+/* DXE registers */
+#define WCN36XX_DXE_MEM_BASE                    0x03000000
+#define WCN36XX_DXE_MEM_REG                     0x202000
+
+#define WCN36XX_DXE_CCU_INT                     0xA0011
+#define WCN36XX_DXE_REG_CCU_INT                 0x200b10
+
+/* TODO This must calculated properly but not hardcoded */
+#define WCN36XX_DXE_CTRL_TX_L                   0x328a44
+#define WCN36XX_DXE_CTRL_TX_H                   0x32ce44
+#define WCN36XX_DXE_CTRL_RX_L                   0x12ad2f
+#define WCN36XX_DXE_CTRL_RX_H                   0x12d12f
+#define WCN36XX_DXE_CTRL_TX_H_BD                0x30ce45
+#define WCN36XX_DXE_CTRL_TX_H_SKB               0x32ce4d
+#define WCN36XX_DXE_CTRL_TX_L_BD                0x308a45
+#define WCN36XX_DXE_CTRL_TX_L_SKB               0x328a4d
+
+/* TODO This must calculated properly but not hardcoded */
+#define WCN36XX_DXE_WQ_TX_L                     0x17
+#define WCN36XX_DXE_WQ_TX_H                     0x17
+#define WCN36XX_DXE_WQ_RX_L                     0xB
+#define WCN36XX_DXE_WQ_RX_H                     0x4
+
+/* DXE descriptor control filed */
+#define WCN36XX_DXE_CTRL_VALID_MASK (0x00000001)
+
+/* TODO This must calculated properly but not hardcoded */
+/* DXE default control register values */
+#define WCN36XX_DXE_CH_DEFAULT_CTL_RX_L         0x847EAD2F
+#define WCN36XX_DXE_CH_DEFAULT_CTL_RX_H         0x84FED12F
+#define WCN36XX_DXE_CH_DEFAULT_CTL_TX_H         0x853ECF4D
+#define WCN36XX_DXE_CH_DEFAULT_CTL_TX_L         0x843e8b4d
+
+/* Common DXE registers */
+#define WCN36XX_DXE_MEM_CSR                     (WCN36XX_DXE_MEM_REG + 0x00)
+#define WCN36XX_DXE_REG_CSR_RESET               (WCN36XX_DXE_MEM_REG + 0x00)
+#define WCN36XX_DXE_ENCH_ADDR                   (WCN36XX_DXE_MEM_REG + 0x04)
+#define WCN36XX_DXE_REG_CH_EN                   (WCN36XX_DXE_MEM_REG + 0x08)
+#define WCN36XX_DXE_REG_CH_DONE                 (WCN36XX_DXE_MEM_REG + 0x0C)
+#define WCN36XX_DXE_REG_CH_ERR                  (WCN36XX_DXE_MEM_REG + 0x10)
+#define WCN36XX_DXE_INT_MASK_REG                (WCN36XX_DXE_MEM_REG + 0x18)
+#define WCN36XX_DXE_INT_SRC_RAW_REG             (WCN36XX_DXE_MEM_REG + 0x20)
+        /* #define WCN36XX_DXE_INT_CH6_MASK     0x00000040 */
+        /* #define WCN36XX_DXE_INT_CH5_MASK     0x00000020 */
+        #define WCN36XX_DXE_INT_CH4_MASK        0x00000010
+        #define WCN36XX_DXE_INT_CH3_MASK        0x00000008
+        /* #define WCN36XX_DXE_INT_CH2_MASK     0x00000004 */
+        #define WCN36XX_DXE_INT_CH1_MASK        0x00000002
+        #define WCN36XX_DXE_INT_CH0_MASK        0x00000001
+#define WCN36XX_DXE_0_INT_CLR                   (WCN36XX_DXE_MEM_REG + 0x30)
+#define WCN36XX_DXE_0_INT_ED_CLR                (WCN36XX_DXE_MEM_REG + 0x34)
+#define WCN36XX_DXE_0_INT_DONE_CLR              (WCN36XX_DXE_MEM_REG + 0x38)
+#define WCN36XX_DXE_0_INT_ERR_CLR               (WCN36XX_DXE_MEM_REG + 0x3C)
+
+#define WCN36XX_DXE_0_CH0_STATUS                (WCN36XX_DXE_MEM_REG + 0x404)
+#define WCN36XX_DXE_0_CH1_STATUS                (WCN36XX_DXE_MEM_REG + 0x444)
+#define WCN36XX_DXE_0_CH2_STATUS                (WCN36XX_DXE_MEM_REG + 0x484)
+#define WCN36XX_DXE_0_CH3_STATUS                (WCN36XX_DXE_MEM_REG + 0x4C4)
+#define WCN36XX_DXE_0_CH4_STATUS                (WCN36XX_DXE_MEM_REG + 0x504)
+
+#define WCN36XX_DXE_REG_RESET                   0x5c89
+
+/* Temporary BMU Workqueue 4 */
+#define WCN36XX_DXE_BMU_WQ_RX_LOW               0xB
+#define WCN36XX_DXE_BMU_WQ_RX_HIGH              0x4
+/* DMA channel offset */
+#define WCN36XX_DXE_TX_LOW_OFFSET               0x400
+#define WCN36XX_DXE_TX_HIGH_OFFSET              0x500
+#define WCN36XX_DXE_RX_LOW_OFFSET               0x440
+#define WCN36XX_DXE_RX_HIGH_OFFSET              0x4C0
+
+/* Address of the next DXE descriptor */
+#define WCN36XX_DXE_CH_NEXT_DESC_ADDR           0x001C
+#define WCN36XX_DXE_CH_NEXT_DESC_ADDR_TX_L      (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_TX_LOW_OFFSET + \
+                                                 WCN36XX_DXE_CH_NEXT_DESC_ADDR)
+#define WCN36XX_DXE_CH_NEXT_DESC_ADDR_TX_H      (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_TX_HIGH_OFFSET + \
+                                                 WCN36XX_DXE_CH_NEXT_DESC_ADDR)
+#define WCN36XX_DXE_CH_NEXT_DESC_ADDR_RX_L      (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_LOW_OFFSET + \
+                                                 WCN36XX_DXE_CH_NEXT_DESC_ADDR)
+#define WCN36XX_DXE_CH_NEXT_DESC_ADDR_RX_H      (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_HIGH_OFFSET + \
+                                                 WCN36XX_DXE_CH_NEXT_DESC_ADDR)
+
+/* DXE Descriptor source address */
+#define WCN36XX_DXE_CH_SRC_ADDR                 0x000C
+#define WCN36XX_DXE_CH_SRC_ADDR_RX_L            (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_LOW_OFFSET + \
+                                                 WCN36XX_DXE_CH_SRC_ADDR)
+#define WCN36XX_DXE_CH_SRC_ADDR_RX_H            (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_HIGH_OFFSET + \
+                                                 WCN36XX_DXE_CH_SRC_ADDR)
+
+/* DXE Descriptor address destination address */
+#define WCN36XX_DXE_CH_DEST_ADDR                0x0014
+#define WCN36XX_DXE_CH_DEST_ADDR_TX_L           (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_TX_LOW_OFFSET + \
+                                                 WCN36XX_DXE_CH_DEST_ADDR)
+#define WCN36XX_DXE_CH_DEST_ADDR_TX_H           (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_TX_HIGH_OFFSET + \
+                                                 WCN36XX_DXE_CH_DEST_ADDR)
+#define WCN36XX_DXE_CH_DEST_ADDR_RX_L           (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_LOW_OFFSET + \
+                                                 WCN36XX_DXE_CH_DEST_ADDR)
+#define WCN36XX_DXE_CH_DEST_ADDR_RX_H           (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_HIGH_OFFSET + \
+                                                 WCN36XX_DXE_CH_DEST_ADDR)
+
+/* Interrupt status */
+#define WCN36XX_DXE_CH_STATUS_REG_ADDR          0x0004
+#define WCN36XX_DXE_CH_STATUS_REG_ADDR_TX_L     (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_TX_LOW_OFFSET + \
+                                                 WCN36XX_DXE_CH_STATUS_REG_ADDR)
+#define WCN36XX_DXE_CH_STATUS_REG_ADDR_TX_H     (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_TX_HIGH_OFFSET + \
+                                                 WCN36XX_DXE_CH_STATUS_REG_ADDR)
+#define WCN36XX_DXE_CH_STATUS_REG_ADDR_RX_L     (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_LOW_OFFSET + \
+                                                 WCN36XX_DXE_CH_STATUS_REG_ADDR)
+#define WCN36XX_DXE_CH_STATUS_REG_ADDR_RX_H     (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_HIGH_OFFSET + \
+                                                 WCN36XX_DXE_CH_STATUS_REG_ADDR)
+
+
+/* DXE default control register */
+#define WCN36XX_DXE_REG_CTL_RX_L                (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_LOW_OFFSET)
+#define WCN36XX_DXE_REG_CTL_RX_H                (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_HIGH_OFFSET)
+#define WCN36XX_DXE_REG_CTL_TX_H                (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_TX_HIGH_OFFSET)
+#define WCN36XX_DXE_REG_CTL_TX_L                (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_TX_LOW_OFFSET)
+
+#define WCN36XX_SMSM_WLAN_TX_ENABLE             0x00000400
+#define WCN36XX_SMSM_WLAN_TX_RINGS_EMPTY        0x00000200
+
+
+/* Interrupt control channel mask */
+#define WCN36XX_INT_MASK_CHAN_TX_L              0x00000001
+#define WCN36XX_INT_MASK_CHAN_RX_L              0x00000002
+#define WCN36XX_INT_MASK_CHAN_RX_H              0x00000008
+#define WCN36XX_INT_MASK_CHAN_TX_H              0x00000010
+
+#define WCN36XX_BD_CHUNK_SIZE                   128
+
+#define WCN36XX_PKT_SIZE                        0xF20
+enum wcn36xx_dxe_ch_type {
+        WCN36XX_DXE_CH_TX_L,
+        WCN36XX_DXE_CH_TX_H,
+        WCN36XX_DXE_CH_RX_L,
+        WCN36XX_DXE_CH_RX_H
+};
+
+/* amount of descriptors per channel */
+enum wcn36xx_dxe_ch_desc_num {
+        WCN36XX_DXE_CH_DESC_NUMB_TX_L           = 128,
+        WCN36XX_DXE_CH_DESC_NUMB_TX_H           = 10,
+        WCN36XX_DXE_CH_DESC_NUMB_RX_L           = 512,
+        WCN36XX_DXE_CH_DESC_NUMB_RX_H           = 40
+};
+
+/**
+ * struct wcn36xx_dxe_desc - describes descriptor of one DXE buffer
+ *
+ * @ctrl: is a union that consists of following bits:
+ * union {
+ *      u32     valid           :1; //0 = DMA stop, 1 = DMA continue with this
+ *                                  //descriptor
+ *      u32     transfer_type   :2; //0 = Host to Host space
+ *      u32     eop             :1; //End of Packet
+ *      u32     bd_handling     :1; //if transferType = Host to BMU, then 0
+ *                                  // means first 128 bytes contain BD, and 1
+ *                                  // means create new empty BD
+ *      u32     siq             :1; // SIQ
+ *      u32     diq             :1; // DIQ
+ *      u32     pdu_rel         :1; //0 = don't release BD and PDUs when done,
+ *                                  // 1 = release them
+ *      u32     bthld_sel       :4; //BMU Threshold Select
+ *      u32     prio            :3; //Specifies the priority level to use for
+ *                                  // the transfer
+ *      u32     stop_channel    :1; //1 = DMA stops processing further, channel
+ *                                  //requires re-enabling after this
+ *      u32     intr            :1; //Interrupt on Descriptor Done
+ *      u32     rsvd            :1; //reserved
+ *      u32     size            :14;//14 bits used - ignored for BMU transfers,
+ *                                  //only used for host to host transfers?
+ * } ctrl;
+ */
+struct wcn36xx_dxe_desc {
+        u32     ctrl;
+        u32     fr_len;
+
+        u32     src_addr_l;
+        u32     dst_addr_l;
+        u32     phy_next_l;
+        u32     src_addr_h;
+        u32     dst_addr_h;
+        u32     phy_next_h;
+} __packed;
+
+/* DXE Control block */
+struct wcn36xx_dxe_ctl {
+        struct wcn36xx_dxe_ctl  *next;
+        struct wcn36xx_dxe_desc *desc;
+        unsigned int            desc_phy_addr;
+        int                     ctl_blk_order;
+        struct sk_buff          *skb;
+        spinlock_t              skb_lock;
+        void                    *bd_cpu_addr;
+        dma_addr_t              bd_phy_addr;
+};
+
+struct wcn36xx_dxe_ch {
+        enum wcn36xx_dxe_ch_type        ch_type;
+        void                            *cpu_addr;
+        dma_addr_t                      dma_addr;
+        enum wcn36xx_dxe_ch_desc_num    desc_num;
+        /* DXE control block ring */
+        struct wcn36xx_dxe_ctl          *head_blk_ctl;
+        struct wcn36xx_dxe_ctl          *tail_blk_ctl;
+
+        /* DXE channel specific configs */
+        u32                             dxe_wq;
+        u32                             ctrl_bd;
+        u32                             ctrl_skb;
+        u32                             reg_ctrl;
+        u32                             def_ctrl;
+};
+
+/* Memory Pool for BD headers */
+struct wcn36xx_dxe_mem_pool {
+        int             chunk_size;
+        void            *virt_addr;
+        dma_addr_t      phy_addr;
+};
+
+struct wcn36xx_vif;
+int wcn36xx_dxe_allocate_mem_pools(struct wcn36xx *wcn);
+void wcn36xx_dxe_free_mem_pools(struct wcn36xx *wcn);
+void wcn36xx_dxe_rx_frame(struct wcn36xx *wcn);
+int wcn36xx_dxe_alloc_ctl_blks(struct wcn36xx *wcn);
+void wcn36xx_dxe_free_ctl_blks(struct wcn36xx *wcn);
+int wcn36xx_dxe_init(struct wcn36xx *wcn);
+void wcn36xx_dxe_deinit(struct wcn36xx *wcn);
+int wcn36xx_dxe_init_channels(struct wcn36xx *wcn);
+int wcn36xx_dxe_tx_frame(struct wcn36xx *wcn,
+                         struct wcn36xx_vif *vif_priv,
+                         struct sk_buff *skb,
+                         bool is_low);
+void wcn36xx_dxe_tx_ack_ind(struct wcn36xx *wcn, u32 status);
+void *wcn36xx_dxe_get_next_bd(struct wcn36xx *wcn, bool is_low);
+#endif  /* _DXE_H_ */
diff --git a/drivers/net/wireless/ath/wcn36xx/hal.h b/drivers/net/wireless/ath/wcn36xx/hal.h
new file mode 100644
index 000000000000..c02dbc618724
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/hal.h
@@ -0,0 +1,4657 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _HAL_H_
+#define _HAL_H_
+
+/*---------------------------------------------------------------------------
+  API VERSIONING INFORMATION
+
+  The RIVA API is versioned as MAJOR.MINOR.VERSION.REVISION
+  The MAJOR is incremented for major product/architecture changes
+      (and then MINOR/VERSION/REVISION are zeroed)
+  The MINOR is incremented for minor product/architecture changes
+      (and then VERSION/REVISION are zeroed)
+  The VERSION is incremented if a significant API change occurs
+      (and then REVISION is zeroed)
+  The REVISION is incremented if an insignificant API change occurs
+      or if a new API is added
+  All values are in the range 0..255 (ie they are 8-bit values)
+ ---------------------------------------------------------------------------*/
+#define WCN36XX_HAL_VER_MAJOR 1
+#define WCN36XX_HAL_VER_MINOR 4
+#define WCN36XX_HAL_VER_VERSION 1
+#define WCN36XX_HAL_VER_REVISION 2
+
+/* This is to force compiler to use the maximum of an int ( 4 bytes ) */
+#define WCN36XX_HAL_MAX_ENUM_SIZE    0x7FFFFFFF
+#define WCN36XX_HAL_MSG_TYPE_MAX_ENUM_SIZE    0x7FFF
+
+/* Max no. of transmit categories */
+#define STACFG_MAX_TC    8
+
+/* The maximum value of access category */
+#define WCN36XX_HAL_MAX_AC  4
+
+#define WCN36XX_HAL_IPV4_ADDR_LEN       4
+
+#define WALN_HAL_STA_INVALID_IDX 0xFF
+#define WCN36XX_HAL_BSS_INVALID_IDX 0xFF
+
+/* Default Beacon template size */
+#define BEACON_TEMPLATE_SIZE 0x180
+
+/* Param Change Bitmap sent to HAL */
+#define PARAM_BCN_INTERVAL_CHANGED                      (1 << 0)
+#define PARAM_SHORT_PREAMBLE_CHANGED                 (1 << 1)
+#define PARAM_SHORT_SLOT_TIME_CHANGED                 (1 << 2)
+#define PARAM_llACOEXIST_CHANGED                            (1 << 3)
+#define PARAM_llBCOEXIST_CHANGED                            (1 << 4)
+#define PARAM_llGCOEXIST_CHANGED                            (1 << 5)
+#define PARAM_HT20MHZCOEXIST_CHANGED                  (1<<6)
+#define PARAM_NON_GF_DEVICES_PRESENT_CHANGED (1<<7)
+#define PARAM_RIFS_MODE_CHANGED                            (1<<8)
+#define PARAM_LSIG_TXOP_FULL_SUPPORT_CHANGED   (1<<9)
+#define PARAM_OBSS_MODE_CHANGED                               (1<<10)
+#define PARAM_BEACON_UPDATE_MASK \
+        (PARAM_BCN_INTERVAL_CHANGED |                                   \
+         PARAM_SHORT_PREAMBLE_CHANGED |                                 \
+         PARAM_SHORT_SLOT_TIME_CHANGED |                                \
+         PARAM_llACOEXIST_CHANGED |                                     \
+         PARAM_llBCOEXIST_CHANGED |                                     \
+         PARAM_llGCOEXIST_CHANGED |                                     \
+         PARAM_HT20MHZCOEXIST_CHANGED |                                 \
+         PARAM_NON_GF_DEVICES_PRESENT_CHANGED |                         \
+         PARAM_RIFS_MODE_CHANGED |                                      \
+         PARAM_LSIG_TXOP_FULL_SUPPORT_CHANGED |                         \
+         PARAM_OBSS_MODE_CHANGED)
+
+/* dump command response Buffer size */
+#define DUMPCMD_RSP_BUFFER 100
+
+/* version string max length (including NULL) */
+#define WCN36XX_HAL_VERSION_LENGTH  64
+
+/* message types for messages exchanged between WDI and HAL */
+enum wcn36xx_hal_host_msg_type {
+        /* Init/De-Init */
+        WCN36XX_HAL_START_REQ = 0,
+        WCN36XX_HAL_START_RSP = 1,
+        WCN36XX_HAL_STOP_REQ = 2,
+        WCN36XX_HAL_STOP_RSP = 3,
+
+        /* Scan */
+        WCN36XX_HAL_INIT_SCAN_REQ = 4,
+        WCN36XX_HAL_INIT_SCAN_RSP = 5,
+        WCN36XX_HAL_START_SCAN_REQ = 6,
+        WCN36XX_HAL_START_SCAN_RSP = 7,
+        WCN36XX_HAL_END_SCAN_REQ = 8,
+        WCN36XX_HAL_END_SCAN_RSP = 9,
+        WCN36XX_HAL_FINISH_SCAN_REQ = 10,
+        WCN36XX_HAL_FINISH_SCAN_RSP = 11,
+
+        /* HW STA configuration/deconfiguration */
+        WCN36XX_HAL_CONFIG_STA_REQ = 12,
+        WCN36XX_HAL_CONFIG_STA_RSP = 13,
+        WCN36XX_HAL_DELETE_STA_REQ = 14,
+        WCN36XX_HAL_DELETE_STA_RSP = 15,
+        WCN36XX_HAL_CONFIG_BSS_REQ = 16,
+        WCN36XX_HAL_CONFIG_BSS_RSP = 17,
+        WCN36XX_HAL_DELETE_BSS_REQ = 18,
+        WCN36XX_HAL_DELETE_BSS_RSP = 19,
+
+        /* Infra STA asscoiation */
+        WCN36XX_HAL_JOIN_REQ = 20,
+        WCN36XX_HAL_JOIN_RSP = 21,
+        WCN36XX_HAL_POST_ASSOC_REQ = 22,
+        WCN36XX_HAL_POST_ASSOC_RSP = 23,
+
+        /* Security */
+        WCN36XX_HAL_SET_BSSKEY_REQ = 24,
+        WCN36XX_HAL_SET_BSSKEY_RSP = 25,
+        WCN36XX_HAL_SET_STAKEY_REQ = 26,
+        WCN36XX_HAL_SET_STAKEY_RSP = 27,
+        WCN36XX_HAL_RMV_BSSKEY_REQ = 28,
+        WCN36XX_HAL_RMV_BSSKEY_RSP = 29,
+        WCN36XX_HAL_RMV_STAKEY_REQ = 30,
+        WCN36XX_HAL_RMV_STAKEY_RSP = 31,
+
+        /* Qos Related */
+        WCN36XX_HAL_ADD_TS_REQ = 32,
+        WCN36XX_HAL_ADD_TS_RSP = 33,
+        WCN36XX_HAL_DEL_TS_REQ = 34,
+        WCN36XX_HAL_DEL_TS_RSP = 35,
+        WCN36XX_HAL_UPD_EDCA_PARAMS_REQ = 36,
+        WCN36XX_HAL_UPD_EDCA_PARAMS_RSP = 37,
+        WCN36XX_HAL_ADD_BA_REQ = 38,
+        WCN36XX_HAL_ADD_BA_RSP = 39,
+        WCN36XX_HAL_DEL_BA_REQ = 40,
+        WCN36XX_HAL_DEL_BA_RSP = 41,
+
+        WCN36XX_HAL_CH_SWITCH_REQ = 42,
+        WCN36XX_HAL_CH_SWITCH_RSP = 43,
+        WCN36XX_HAL_SET_LINK_ST_REQ = 44,
+        WCN36XX_HAL_SET_LINK_ST_RSP = 45,
+        WCN36XX_HAL_GET_STATS_REQ = 46,
+        WCN36XX_HAL_GET_STATS_RSP = 47,
+        WCN36XX_HAL_UPDATE_CFG_REQ = 48,
+        WCN36XX_HAL_UPDATE_CFG_RSP = 49,
+
+        WCN36XX_HAL_MISSED_BEACON_IND = 50,
+        WCN36XX_HAL_UNKNOWN_ADDR2_FRAME_RX_IND = 51,
+        WCN36XX_HAL_MIC_FAILURE_IND = 52,
+        WCN36XX_HAL_FATAL_ERROR_IND = 53,
+        WCN36XX_HAL_SET_KEYDONE_MSG = 54,
+
+        /* NV Interface */
+        WCN36XX_HAL_DOWNLOAD_NV_REQ = 55,
+        WCN36XX_HAL_DOWNLOAD_NV_RSP = 56,
+
+        WCN36XX_HAL_ADD_BA_SESSION_REQ = 57,
+        WCN36XX_HAL_ADD_BA_SESSION_RSP = 58,
+        WCN36XX_HAL_TRIGGER_BA_REQ = 59,
+        WCN36XX_HAL_TRIGGER_BA_RSP = 60,
+        WCN36XX_HAL_UPDATE_BEACON_REQ = 61,
+        WCN36XX_HAL_UPDATE_BEACON_RSP = 62,
+        WCN36XX_HAL_SEND_BEACON_REQ = 63,
+        WCN36XX_HAL_SEND_BEACON_RSP = 64,
+
+        WCN36XX_HAL_SET_BCASTKEY_REQ = 65,
+        WCN36XX_HAL_SET_BCASTKEY_RSP = 66,
+        WCN36XX_HAL_DELETE_STA_CONTEXT_IND = 67,
+        WCN36XX_HAL_UPDATE_PROBE_RSP_TEMPLATE_REQ = 68,
+        WCN36XX_HAL_UPDATE_PROBE_RSP_TEMPLATE_RSP = 69,
+
+        /* PTT interface support */
+        WCN36XX_HAL_PROCESS_PTT_REQ = 70,
+        WCN36XX_HAL_PROCESS_PTT_RSP = 71,
+
+        /* BTAMP related events */
+        WCN36XX_HAL_SIGNAL_BTAMP_EVENT_REQ = 72,
+        WCN36XX_HAL_SIGNAL_BTAMP_EVENT_RSP = 73,
+        WCN36XX_HAL_TL_HAL_FLUSH_AC_REQ = 74,
+        WCN36XX_HAL_TL_HAL_FLUSH_AC_RSP = 75,
+
+        WCN36XX_HAL_ENTER_IMPS_REQ = 76,
+        WCN36XX_HAL_EXIT_IMPS_REQ = 77,
+        WCN36XX_HAL_ENTER_BMPS_REQ = 78,
+        WCN36XX_HAL_EXIT_BMPS_REQ = 79,
+        WCN36XX_HAL_ENTER_UAPSD_REQ = 80,
+        WCN36XX_HAL_EXIT_UAPSD_REQ = 81,
+        WCN36XX_HAL_UPDATE_UAPSD_PARAM_REQ = 82,
+        WCN36XX_HAL_CONFIGURE_RXP_FILTER_REQ = 83,
+        WCN36XX_HAL_ADD_BCN_FILTER_REQ = 84,
+        WCN36XX_HAL_REM_BCN_FILTER_REQ = 85,
+        WCN36XX_HAL_ADD_WOWL_BCAST_PTRN = 86,
+        WCN36XX_HAL_DEL_WOWL_BCAST_PTRN = 87,
+        WCN36XX_HAL_ENTER_WOWL_REQ = 88,
+        WCN36XX_HAL_EXIT_WOWL_REQ = 89,
+        WCN36XX_HAL_HOST_OFFLOAD_REQ = 90,
+        WCN36XX_HAL_SET_RSSI_THRESH_REQ = 91,
+        WCN36XX_HAL_GET_RSSI_REQ = 92,
+        WCN36XX_HAL_SET_UAPSD_AC_PARAMS_REQ = 93,
+        WCN36XX_HAL_CONFIGURE_APPS_CPU_WAKEUP_STATE_REQ = 94,
+
+        WCN36XX_HAL_ENTER_IMPS_RSP = 95,
+        WCN36XX_HAL_EXIT_IMPS_RSP = 96,
+        WCN36XX_HAL_ENTER_BMPS_RSP = 97,
+        WCN36XX_HAL_EXIT_BMPS_RSP = 98,
+        WCN36XX_HAL_ENTER_UAPSD_RSP = 99,
+        WCN36XX_HAL_EXIT_UAPSD_RSP = 100,
+        WCN36XX_HAL_SET_UAPSD_AC_PARAMS_RSP = 101,
+        WCN36XX_HAL_UPDATE_UAPSD_PARAM_RSP = 102,
+        WCN36XX_HAL_CONFIGURE_RXP_FILTER_RSP = 103,
+        WCN36XX_HAL_ADD_BCN_FILTER_RSP = 104,
+        WCN36XX_HAL_REM_BCN_FILTER_RSP = 105,
+        WCN36XX_HAL_SET_RSSI_THRESH_RSP = 106,
+        WCN36XX_HAL_HOST_OFFLOAD_RSP = 107,
+        WCN36XX_HAL_ADD_WOWL_BCAST_PTRN_RSP = 108,
+        WCN36XX_HAL_DEL_WOWL_BCAST_PTRN_RSP = 109,
+        WCN36XX_HAL_ENTER_WOWL_RSP = 110,
+        WCN36XX_HAL_EXIT_WOWL_RSP = 111,
+        WCN36XX_HAL_RSSI_NOTIFICATION_IND = 112,
+        WCN36XX_HAL_GET_RSSI_RSP = 113,
+        WCN36XX_HAL_CONFIGURE_APPS_CPU_WAKEUP_STATE_RSP = 114,
+
+        /* 11k related events */
+        WCN36XX_HAL_SET_MAX_TX_POWER_REQ = 115,
+        WCN36XX_HAL_SET_MAX_TX_POWER_RSP = 116,
+
+        /* 11R related msgs */
+        WCN36XX_HAL_AGGR_ADD_TS_REQ = 117,
+        WCN36XX_HAL_AGGR_ADD_TS_RSP = 118,
+
+        /* P2P  WLAN_FEATURE_P2P */
+        WCN36XX_HAL_SET_P2P_GONOA_REQ = 119,
+        WCN36XX_HAL_SET_P2P_GONOA_RSP = 120,
+
+        /* WLAN Dump commands */
+        WCN36XX_HAL_DUMP_COMMAND_REQ = 121,
+        WCN36XX_HAL_DUMP_COMMAND_RSP = 122,
+
+        /* OEM_DATA FEATURE SUPPORT */
+        WCN36XX_HAL_START_OEM_DATA_REQ = 123,
+        WCN36XX_HAL_START_OEM_DATA_RSP = 124,
+
+        /* ADD SELF STA REQ and RSP */
+        WCN36XX_HAL_ADD_STA_SELF_REQ = 125,
+        WCN36XX_HAL_ADD_STA_SELF_RSP = 126,
+
+        /* DEL SELF STA SUPPORT */
+        WCN36XX_HAL_DEL_STA_SELF_REQ = 127,
+        WCN36XX_HAL_DEL_STA_SELF_RSP = 128,
+
+        /* Coex Indication */
+        WCN36XX_HAL_COEX_IND = 129,
+
+        /* Tx Complete Indication */
+        WCN36XX_HAL_OTA_TX_COMPL_IND = 130,
+
+        /* Host Suspend/resume messages */
+        WCN36XX_HAL_HOST_SUSPEND_IND = 131,
+        WCN36XX_HAL_HOST_RESUME_REQ = 132,
+        WCN36XX_HAL_HOST_RESUME_RSP = 133,
+
+        WCN36XX_HAL_SET_TX_POWER_REQ = 134,
+        WCN36XX_HAL_SET_TX_POWER_RSP = 135,
+        WCN36XX_HAL_GET_TX_POWER_REQ = 136,
+        WCN36XX_HAL_GET_TX_POWER_RSP = 137,
+
+        WCN36XX_HAL_P2P_NOA_ATTR_IND = 138,
+
+        WCN36XX_HAL_ENABLE_RADAR_DETECT_REQ = 139,
+        WCN36XX_HAL_ENABLE_RADAR_DETECT_RSP = 140,
+        WCN36XX_HAL_GET_TPC_REPORT_REQ = 141,
+        WCN36XX_HAL_GET_TPC_REPORT_RSP = 142,
+        WCN36XX_HAL_RADAR_DETECT_IND = 143,
+        WCN36XX_HAL_RADAR_DETECT_INTR_IND = 144,
+        WCN36XX_HAL_KEEP_ALIVE_REQ = 145,
+        WCN36XX_HAL_KEEP_ALIVE_RSP = 146,
+
+        /* PNO messages */
+        WCN36XX_HAL_SET_PREF_NETWORK_REQ = 147,
+        WCN36XX_HAL_SET_PREF_NETWORK_RSP = 148,
+        WCN36XX_HAL_SET_RSSI_FILTER_REQ = 149,
+        WCN36XX_HAL_SET_RSSI_FILTER_RSP = 150,
+        WCN36XX_HAL_UPDATE_SCAN_PARAM_REQ = 151,
+        WCN36XX_HAL_UPDATE_SCAN_PARAM_RSP = 152,
+        WCN36XX_HAL_PREF_NETW_FOUND_IND = 153,
+
+        WCN36XX_HAL_SET_TX_PER_TRACKING_REQ = 154,
+        WCN36XX_HAL_SET_TX_PER_TRACKING_RSP = 155,
+        WCN36XX_HAL_TX_PER_HIT_IND = 156,
+
+        WCN36XX_HAL_8023_MULTICAST_LIST_REQ = 157,
+        WCN36XX_HAL_8023_MULTICAST_LIST_RSP = 158,
+
+        WCN36XX_HAL_SET_PACKET_FILTER_REQ = 159,
+        WCN36XX_HAL_SET_PACKET_FILTER_RSP = 160,
+        WCN36XX_HAL_PACKET_FILTER_MATCH_COUNT_REQ = 161,
+        WCN36XX_HAL_PACKET_FILTER_MATCH_COUNT_RSP = 162,
+        WCN36XX_HAL_CLEAR_PACKET_FILTER_REQ = 163,
+        WCN36XX_HAL_CLEAR_PACKET_FILTER_RSP = 164,
+
+        /*
+         * This is temp fix. Should be removed once Host and Riva code is
+         * in sync.
+         */
+        WCN36XX_HAL_INIT_SCAN_CON_REQ = 165,
+
+        WCN36XX_HAL_SET_POWER_PARAMS_REQ = 166,
+        WCN36XX_HAL_SET_POWER_PARAMS_RSP = 167,
+
+        WCN36XX_HAL_TSM_STATS_REQ = 168,
+        WCN36XX_HAL_TSM_STATS_RSP = 169,
+
+        /* wake reason indication (WOW) */
+        WCN36XX_HAL_WAKE_REASON_IND = 170,
+
+        /* GTK offload support */
+        WCN36XX_HAL_GTK_OFFLOAD_REQ = 171,
+        WCN36XX_HAL_GTK_OFFLOAD_RSP = 172,
+        WCN36XX_HAL_GTK_OFFLOAD_GETINFO_REQ = 173,
+        WCN36XX_HAL_GTK_OFFLOAD_GETINFO_RSP = 174,
+
+        WCN36XX_HAL_FEATURE_CAPS_EXCHANGE_REQ = 175,
+        WCN36XX_HAL_FEATURE_CAPS_EXCHANGE_RSP = 176,
+        WCN36XX_HAL_EXCLUDE_UNENCRYPTED_IND = 177,
+
+        WCN36XX_HAL_SET_THERMAL_MITIGATION_REQ = 178,
+        WCN36XX_HAL_SET_THERMAL_MITIGATION_RSP = 179,
+
+        WCN36XX_HAL_UPDATE_VHT_OP_MODE_REQ = 182,
+        WCN36XX_HAL_UPDATE_VHT_OP_MODE_RSP = 183,
+
+        WCN36XX_HAL_P2P_NOA_START_IND = 184,
+
+        WCN36XX_HAL_GET_ROAM_RSSI_REQ = 185,
+        WCN36XX_HAL_GET_ROAM_RSSI_RSP = 186,
+
+        WCN36XX_HAL_CLASS_B_STATS_IND = 187,
+        WCN36XX_HAL_DEL_BA_IND = 188,
+        WCN36XX_HAL_DHCP_START_IND = 189,
+        WCN36XX_HAL_DHCP_STOP_IND = 190,
+
+        WCN36XX_HAL_MSG_MAX = WCN36XX_HAL_MSG_TYPE_MAX_ENUM_SIZE
+};
+
+/* Enumeration for Version */
+enum wcn36xx_hal_host_msg_version {
+        WCN36XX_HAL_MSG_VERSION0 = 0,
+        WCN36XX_HAL_MSG_VERSION1 = 1,
+        /* define as 2 bytes data */
+        WCN36XX_HAL_MSG_WCNSS_CTRL_VERSION = 0x7FFF,
+        WCN36XX_HAL_MSG_VERSION_MAX_FIELD = WCN36XX_HAL_MSG_WCNSS_CTRL_VERSION
+};
+
+enum driver_type {
+        DRIVER_TYPE_PRODUCTION = 0,
+        DRIVER_TYPE_MFG = 1,
+        DRIVER_TYPE_DVT = 2,
+        DRIVER_TYPE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+enum wcn36xx_hal_stop_type {
+        HAL_STOP_TYPE_SYS_RESET,
+        HAL_STOP_TYPE_SYS_DEEP_SLEEP,
+        HAL_STOP_TYPE_RF_KILL,
+        HAL_STOP_TYPE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+enum wcn36xx_hal_sys_mode {
+        HAL_SYS_MODE_NORMAL,
+        HAL_SYS_MODE_LEARN,
+        HAL_SYS_MODE_SCAN,
+        HAL_SYS_MODE_PROMISC,
+        HAL_SYS_MODE_SUSPEND_LINK,
+        HAL_SYS_MODE_ROAM_SCAN,
+        HAL_SYS_MODE_ROAM_SUSPEND_LINK,
+        HAL_SYS_MODE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+enum phy_chan_bond_state {
+        /* 20MHz IF bandwidth centered on IF carrier */
+        PHY_SINGLE_CHANNEL_CENTERED = 0,
+
+        /* 40MHz IF bandwidth with lower 20MHz supporting the primary channel */
+        PHY_DOUBLE_CHANNEL_LOW_PRIMARY = 1,
+
+        /* 40MHz IF bandwidth centered on IF carrier */
+        PHY_DOUBLE_CHANNEL_CENTERED = 2,
+
+        /* 40MHz IF bandwidth with higher 20MHz supporting the primary ch */
+        PHY_DOUBLE_CHANNEL_HIGH_PRIMARY = 3,
+
+        /* 20/40MHZ offset LOW 40/80MHZ offset CENTERED */
+        PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_CENTERED = 4,
+
+        /* 20/40MHZ offset CENTERED 40/80MHZ offset CENTERED */
+        PHY_QUADRUPLE_CHANNEL_20MHZ_CENTERED_40MHZ_CENTERED = 5,
+
+        /* 20/40MHZ offset HIGH 40/80MHZ offset CENTERED */
+        PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_CENTERED = 6,
+
+        /* 20/40MHZ offset LOW 40/80MHZ offset LOW */
+        PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_LOW = 7,
+
+        /* 20/40MHZ offset HIGH 40/80MHZ offset LOW */
+        PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_LOW = 8,
+
+        /* 20/40MHZ offset LOW 40/80MHZ offset HIGH */
+        PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_HIGH = 9,
+
+        /* 20/40MHZ offset-HIGH 40/80MHZ offset HIGH */
+        PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_HIGH = 10,
+
+        PHY_CHANNEL_BONDING_STATE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+/* Spatial Multiplexing(SM) Power Save mode */
+enum wcn36xx_hal_ht_mimo_state {
+        /* Static SM Power Save mode */
+        WCN36XX_HAL_HT_MIMO_PS_STATIC = 0,
+
+        /* Dynamic SM Power Save mode */
+        WCN36XX_HAL_HT_MIMO_PS_DYNAMIC = 1,
+
+        /* reserved */
+        WCN36XX_HAL_HT_MIMO_PS_NA = 2,
+
+        /* SM Power Save disabled */
+        WCN36XX_HAL_HT_MIMO_PS_NO_LIMIT = 3,
+
+        WCN36XX_HAL_HT_MIMO_PS_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+/* each station added has a rate mode which specifies the sta attributes */
+enum sta_rate_mode {
+        STA_TAURUS = 0,
+        STA_TITAN,
+        STA_POLARIS,
+        STA_11b,
+        STA_11bg,
+        STA_11a,
+        STA_11n,
+        STA_11ac,
+        STA_INVALID_RATE_MODE = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+/* 1,2,5.5,11 */
+#define WCN36XX_HAL_NUM_DSSS_RATES           4
+
+/* 6,9,12,18,24,36,48,54 */
+#define WCN36XX_HAL_NUM_OFDM_RATES           8
+
+/* 72,96,108 */
+#define WCN36XX_HAL_NUM_POLARIS_RATES       3
+
+#define WCN36XX_HAL_MAC_MAX_SUPPORTED_MCS_SET    16
+
+enum wcn36xx_hal_bss_type {
+        WCN36XX_HAL_INFRASTRUCTURE_MODE,
+
+        /* Added for softAP support */
+        WCN36XX_HAL_INFRA_AP_MODE,
+
+        WCN36XX_HAL_IBSS_MODE,
+
+        /* Added for BT-AMP support */
+        WCN36XX_HAL_BTAMP_STA_MODE,
+
+        /* Added for BT-AMP support */
+        WCN36XX_HAL_BTAMP_AP_MODE,
+
+        WCN36XX_HAL_AUTO_MODE,
+
+        WCN36XX_HAL_DONOT_USE_BSS_TYPE = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+enum wcn36xx_hal_nw_type {
+        WCN36XX_HAL_11A_NW_TYPE,
+        WCN36XX_HAL_11B_NW_TYPE,
+        WCN36XX_HAL_11G_NW_TYPE,
+        WCN36XX_HAL_11N_NW_TYPE,
+        WCN36XX_HAL_DONOT_USE_NW_TYPE = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+#define WCN36XX_HAL_MAC_RATESET_EID_MAX            12
+
+enum wcn36xx_hal_ht_operating_mode {
+        /* No Protection */
+        WCN36XX_HAL_HT_OP_MODE_PURE,
+
+        /* Overlap Legacy device present, protection is optional */
+        WCN36XX_HAL_HT_OP_MODE_OVERLAP_LEGACY,
+
+        /* No legacy device, but 20 MHz HT present */
+        WCN36XX_HAL_HT_OP_MODE_NO_LEGACY_20MHZ_HT,
+
+        /* Protection is required */
+        WCN36XX_HAL_HT_OP_MODE_MIXED,
+
+        WCN36XX_HAL_HT_OP_MODE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+/* Encryption type enum used with peer */
+enum ani_ed_type {
+        WCN36XX_HAL_ED_NONE,
+        WCN36XX_HAL_ED_WEP40,
+        WCN36XX_HAL_ED_WEP104,
+        WCN36XX_HAL_ED_TKIP,
+        WCN36XX_HAL_ED_CCMP,
+        WCN36XX_HAL_ED_WPI,
+        WCN36XX_HAL_ED_AES_128_CMAC,
+        WCN36XX_HAL_ED_NOT_IMPLEMENTED = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+#define WLAN_MAX_KEY_RSC_LEN                16
+#define WLAN_WAPI_KEY_RSC_LEN               16
+
+/* MAX key length when ULA is used */
+#define WCN36XX_HAL_MAC_MAX_KEY_LENGTH              32
+#define WCN36XX_HAL_MAC_MAX_NUM_OF_DEFAULT_KEYS     4
+
+/*
+ * Enum to specify whether key is used for TX only, RX only or both.
+ */
+enum ani_key_direction {
+        WCN36XX_HAL_TX_ONLY,
+        WCN36XX_HAL_RX_ONLY,
+        WCN36XX_HAL_TX_RX,
+        WCN36XX_HAL_TX_DEFAULT,
+        WCN36XX_HAL_DONOT_USE_KEY_DIRECTION = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+enum ani_wep_type {
+        WCN36XX_HAL_WEP_STATIC,
+        WCN36XX_HAL_WEP_DYNAMIC,
+        WCN36XX_HAL_WEP_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+enum wcn36xx_hal_link_state {
+
+        WCN36XX_HAL_LINK_IDLE_STATE = 0,
+        WCN36XX_HAL_LINK_PREASSOC_STATE = 1,
+        WCN36XX_HAL_LINK_POSTASSOC_STATE = 2,
+        WCN36XX_HAL_LINK_AP_STATE = 3,
+        WCN36XX_HAL_LINK_IBSS_STATE = 4,
+
+        /* BT-AMP Case */
+        WCN36XX_HAL_LINK_BTAMP_PREASSOC_STATE = 5,
+        WCN36XX_HAL_LINK_BTAMP_POSTASSOC_STATE = 6,
+        WCN36XX_HAL_LINK_BTAMP_AP_STATE = 7,
+        WCN36XX_HAL_LINK_BTAMP_STA_STATE = 8,
+
+        /* Reserved for HAL Internal Use */
+        WCN36XX_HAL_LINK_LEARN_STATE = 9,
+        WCN36XX_HAL_LINK_SCAN_STATE = 10,
+        WCN36XX_HAL_LINK_FINISH_SCAN_STATE = 11,
+        WCN36XX_HAL_LINK_INIT_CAL_STATE = 12,
+        WCN36XX_HAL_LINK_FINISH_CAL_STATE = 13,
+        WCN36XX_HAL_LINK_LISTEN_STATE = 14,
+
+        WCN36XX_HAL_LINK_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+enum wcn36xx_hal_stats_mask {
+        HAL_SUMMARY_STATS_INFO = 0x00000001,
+        HAL_GLOBAL_CLASS_A_STATS_INFO = 0x00000002,
+        HAL_GLOBAL_CLASS_B_STATS_INFO = 0x00000004,
+        HAL_GLOBAL_CLASS_C_STATS_INFO = 0x00000008,
+        HAL_GLOBAL_CLASS_D_STATS_INFO = 0x00000010,
+        HAL_PER_STA_STATS_INFO = 0x00000020
+};
+
+/* BT-AMP events type */
+enum bt_amp_event_type {
+        BTAMP_EVENT_CONNECTION_START,
+        BTAMP_EVENT_CONNECTION_STOP,
+        BTAMP_EVENT_CONNECTION_TERMINATED,
+
+        /* This and beyond are invalid values */
+        BTAMP_EVENT_TYPE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE,
+};
+
+/* PE Statistics */
+enum pe_stats_mask {
+        PE_SUMMARY_STATS_INFO = 0x00000001,
+        PE_GLOBAL_CLASS_A_STATS_INFO = 0x00000002,
+        PE_GLOBAL_CLASS_B_STATS_INFO = 0x00000004,
+        PE_GLOBAL_CLASS_C_STATS_INFO = 0x00000008,
+        PE_GLOBAL_CLASS_D_STATS_INFO = 0x00000010,
+        PE_PER_STA_STATS_INFO = 0x00000020,
+
+        /* This and beyond are invalid values */
+        PE_STATS_TYPE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+/*
+ * Configuration Parameter IDs
+ */
+#define WCN36XX_HAL_CFG_STA_ID                          0
+#define WCN36XX_HAL_CFG_CURRENT_TX_ANTENNA              1
+#define WCN36XX_HAL_CFG_CURRENT_RX_ANTENNA              2
+#define WCN36XX_HAL_CFG_LOW_GAIN_OVERRIDE               3
+#define WCN36XX_HAL_CFG_POWER_STATE_PER_CHAIN           4
+#define WCN36XX_HAL_CFG_CAL_PERIOD                      5
+#define WCN36XX_HAL_CFG_CAL_CONTROL                     6
+#define WCN36XX_HAL_CFG_PROXIMITY                       7
+#define WCN36XX_HAL_CFG_NETWORK_DENSITY                 8
+#define WCN36XX_HAL_CFG_MAX_MEDIUM_TIME                 9
+#define WCN36XX_HAL_CFG_MAX_MPDUS_IN_AMPDU              10
+#define WCN36XX_HAL_CFG_RTS_THRESHOLD                   11
+#define WCN36XX_HAL_CFG_SHORT_RETRY_LIMIT               12
+#define WCN36XX_HAL_CFG_LONG_RETRY_LIMIT                13
+#define WCN36XX_HAL_CFG_FRAGMENTATION_THRESHOLD         14
+#define WCN36XX_HAL_CFG_DYNAMIC_THRESHOLD_ZERO          15
+#define WCN36XX_HAL_CFG_DYNAMIC_THRESHOLD_ONE           16
+#define WCN36XX_HAL_CFG_DYNAMIC_THRESHOLD_TWO           17
+#define WCN36XX_HAL_CFG_FIXED_RATE                      18
+#define WCN36XX_HAL_CFG_RETRYRATE_POLICY                19
+#define WCN36XX_HAL_CFG_RETRYRATE_SECONDARY             20
+#define WCN36XX_HAL_CFG_RETRYRATE_TERTIARY              21
+#define WCN36XX_HAL_CFG_FORCE_POLICY_PROTECTION         22
+#define WCN36XX_HAL_CFG_FIXED_RATE_MULTICAST_24GHZ      23
+#define WCN36XX_HAL_CFG_FIXED_RATE_MULTICAST_5GHZ       24
+#define WCN36XX_HAL_CFG_DEFAULT_RATE_INDEX_24GHZ        25
+#define WCN36XX_HAL_CFG_DEFAULT_RATE_INDEX_5GHZ         26
+#define WCN36XX_HAL_CFG_MAX_BA_SESSIONS                 27
+#define WCN36XX_HAL_CFG_PS_DATA_INACTIVITY_TIMEOUT      28
+#define WCN36XX_HAL_CFG_PS_ENABLE_BCN_FILTER            29
+#define WCN36XX_HAL_CFG_PS_ENABLE_RSSI_MONITOR          30
+#define WCN36XX_HAL_CFG_NUM_BEACON_PER_RSSI_AVERAGE     31
+#define WCN36XX_HAL_CFG_STATS_PERIOD                    32
+#define WCN36XX_HAL_CFG_CFP_MAX_DURATION                33
+#define WCN36XX_HAL_CFG_FRAME_TRANS_ENABLED             34
+#define WCN36XX_HAL_CFG_DTIM_PERIOD                     35
+#define WCN36XX_HAL_CFG_EDCA_WMM_ACBK                   36
+#define WCN36XX_HAL_CFG_EDCA_WMM_ACBE                   37
+#define WCN36XX_HAL_CFG_EDCA_WMM_ACVO                   38
+#define WCN36XX_HAL_CFG_EDCA_WMM_ACVI                   39
+#define WCN36XX_HAL_CFG_BA_THRESHOLD_HIGH               40
+#define WCN36XX_HAL_CFG_MAX_BA_BUFFERS                  41
+#define WCN36XX_HAL_CFG_RPE_POLLING_THRESHOLD           42
+#define WCN36XX_HAL_CFG_RPE_AGING_THRESHOLD_FOR_AC0_REG 43
+#define WCN36XX_HAL_CFG_RPE_AGING_THRESHOLD_FOR_AC1_REG 44
+#define WCN36XX_HAL_CFG_RPE_AGING_THRESHOLD_FOR_AC2_REG 45
+#define WCN36XX_HAL_CFG_RPE_AGING_THRESHOLD_FOR_AC3_REG 46
+#define WCN36XX_HAL_CFG_NO_OF_ONCHIP_REORDER_SESSIONS   47
+#define WCN36XX_HAL_CFG_PS_LISTEN_INTERVAL              48
+#define WCN36XX_HAL_CFG_PS_HEART_BEAT_THRESHOLD         49
+#define WCN36XX_HAL_CFG_PS_NTH_BEACON_FILTER            50
+#define WCN36XX_HAL_CFG_PS_MAX_PS_POLL                  51
+#define WCN36XX_HAL_CFG_PS_MIN_RSSI_THRESHOLD           52
+#define WCN36XX_HAL_CFG_PS_RSSI_FILTER_PERIOD           53
+#define WCN36XX_HAL_CFG_PS_BROADCAST_FRAME_FILTER_ENABLE 54
+#define WCN36XX_HAL_CFG_PS_IGNORE_DTIM                  55
+#define WCN36XX_HAL_CFG_PS_ENABLE_BCN_EARLY_TERM        56
+#define WCN36XX_HAL_CFG_DYNAMIC_PS_POLL_VALUE           57
+#define WCN36XX_HAL_CFG_PS_NULLDATA_AP_RESP_TIMEOUT     58
+#define WCN36XX_HAL_CFG_TELE_BCN_WAKEUP_EN              59
+#define WCN36XX_HAL_CFG_TELE_BCN_TRANS_LI               60
+#define WCN36XX_HAL_CFG_TELE_BCN_TRANS_LI_IDLE_BCNS     61
+#define WCN36XX_HAL_CFG_TELE_BCN_MAX_LI                 62
+#define WCN36XX_HAL_CFG_TELE_BCN_MAX_LI_IDLE_BCNS       63
+#define WCN36XX_HAL_CFG_TX_PWR_CTRL_ENABLE              64
+#define WCN36XX_HAL_CFG_VALID_RADAR_CHANNEL_LIST        65
+#define WCN36XX_HAL_CFG_TX_POWER_24_20                  66
+#define WCN36XX_HAL_CFG_TX_POWER_24_40                  67
+#define WCN36XX_HAL_CFG_TX_POWER_50_20                  68
+#define WCN36XX_HAL_CFG_TX_POWER_50_40                  69
+#define WCN36XX_HAL_CFG_MCAST_BCAST_FILTER_SETTING      70
+#define WCN36XX_HAL_CFG_BCN_EARLY_TERM_WAKEUP_INTERVAL  71
+#define WCN36XX_HAL_CFG_MAX_TX_POWER_2_4                72
+#define WCN36XX_HAL_CFG_MAX_TX_POWER_5                  73
+#define WCN36XX_HAL_CFG_INFRA_STA_KEEP_ALIVE_PERIOD     74
+#define WCN36XX_HAL_CFG_ENABLE_CLOSE_LOOP               75
+#define WCN36XX_HAL_CFG_BTC_EXECUTION_MODE              76
+#define WCN36XX_HAL_CFG_BTC_DHCP_BT_SLOTS_TO_BLOCK      77
+#define WCN36XX_HAL_CFG_BTC_A2DP_DHCP_BT_SUB_INTERVALS  78
+#define WCN36XX_HAL_CFG_PS_TX_INACTIVITY_TIMEOUT        79
+#define WCN36XX_HAL_CFG_WCNSS_API_VERSION               80
+#define WCN36XX_HAL_CFG_AP_KEEPALIVE_TIMEOUT            81
+#define WCN36XX_HAL_CFG_GO_KEEPALIVE_TIMEOUT            82
+#define WCN36XX_HAL_CFG_ENABLE_MC_ADDR_LIST             83
+#define WCN36XX_HAL_CFG_BTC_STATIC_LEN_INQ_BT           84
+#define WCN36XX_HAL_CFG_BTC_STATIC_LEN_PAGE_BT          85
+#define WCN36XX_HAL_CFG_BTC_STATIC_LEN_CONN_BT          86
+#define WCN36XX_HAL_CFG_BTC_STATIC_LEN_LE_BT            87
+#define WCN36XX_HAL_CFG_BTC_STATIC_LEN_INQ_WLAN         88
+#define WCN36XX_HAL_CFG_BTC_STATIC_LEN_PAGE_WLAN        89
+#define WCN36XX_HAL_CFG_BTC_STATIC_LEN_CONN_WLAN        90
+#define WCN36XX_HAL_CFG_BTC_STATIC_LEN_LE_WLAN          91
+#define WCN36XX_HAL_CFG_BTC_DYN_MAX_LEN_BT              92
+#define WCN36XX_HAL_CFG_BTC_DYN_MAX_LEN_WLAN            93
+#define WCN36XX_HAL_CFG_BTC_MAX_SCO_BLOCK_PERC          94
+#define WCN36XX_HAL_CFG_BTC_DHCP_PROT_ON_A2DP           95
+#define WCN36XX_HAL_CFG_BTC_DHCP_PROT_ON_SCO            96
+#define WCN36XX_HAL_CFG_ENABLE_UNICAST_FILTER           97
+#define WCN36XX_HAL_CFG_MAX_ASSOC_LIMIT                 98
+#define WCN36XX_HAL_CFG_ENABLE_LPWR_IMG_TRANSITION      99
+#define WCN36XX_HAL_CFG_ENABLE_MCC_ADAPTIVE_SCHEDULER   100
+#define WCN36XX_HAL_CFG_ENABLE_DETECT_PS_SUPPORT        101
+#define WCN36XX_HAL_CFG_AP_LINK_MONITOR_TIMEOUT         102
+#define WCN36XX_HAL_CFG_BTC_DWELL_TIME_MULTIPLIER       103
+#define WCN36XX_HAL_CFG_ENABLE_TDLS_OXYGEN_MODE         104
+#define WCN36XX_HAL_CFG_MAX_PARAMS                      105
+
+/* Message definitons - All the messages below need to be packed */
+
+/* Definition for HAL API Version. */
+struct wcnss_wlan_version {
+        u8 revision;
+        u8 version;
+        u8 minor;
+        u8 major;
+} __packed;
+
+/* Definition for Encryption Keys */
+struct wcn36xx_hal_keys {
+        u8 id;
+
+        /* 0 for multicast */
+        u8 unicast;
+
+        enum ani_key_direction direction;
+
+        /* Usage is unknown */
+        u8 rsc[WLAN_MAX_KEY_RSC_LEN];
+
+        /* =1 for authenticator,=0 for supplicant */
+        u8 pae_role;
+
+        u16 length;
+        u8 key[WCN36XX_HAL_MAC_MAX_KEY_LENGTH];
+} __packed;
+
+/*
+ * set_sta_key_params Moving here since it is shared by
+ * configbss/setstakey msgs
+ */
+struct wcn36xx_hal_set_sta_key_params {
+        /* STA Index */
+        u16 sta_index;
+
+        /* Encryption Type used with peer */
+        enum ani_ed_type enc_type;
+
+        /* STATIC/DYNAMIC - valid only for WEP */
+        enum ani_wep_type wep_type;
+
+        /* Default WEP key, valid only for static WEP, must between 0 and 3. */
+        u8 def_wep_idx;
+
+        /* valid only for non-static WEP encyrptions */
+        struct wcn36xx_hal_keys key[WCN36XX_HAL_MAC_MAX_NUM_OF_DEFAULT_KEYS];
+
+        /*
+         * Control for Replay Count, 1= Single TID based replay count on Tx
+         * 0 = Per TID based replay count on TX
+         */
+        u8 single_tid_rc;
+
+} __packed;
+
+/* 4-byte control message header used by HAL*/
+struct wcn36xx_hal_msg_header {
+        enum wcn36xx_hal_host_msg_type msg_type:16;
+        enum wcn36xx_hal_host_msg_version msg_version:16;
+        u32 len;
+} __packed;
+
+/* Config format required by HAL for each CFG item*/
+struct wcn36xx_hal_cfg {
+        /* Cfg Id. The Id required by HAL is exported by HAL
+         * in shared header file between UMAC and HAL.*/
+        u16 id;
+
+        /* Length of the Cfg. This parameter is used to go to next cfg
+         * in the TLV format.*/
+        u16 len;
+
+        /* Padding bytes for unaligned address's */
+        u16 pad_bytes;
+
+        /* Reserve bytes for making cfgVal to align address */
+        u16 reserve;
+
+        /* Following the uCfgLen field there should be a 'uCfgLen' bytes
+         * containing the uCfgValue ; u8 uCfgValue[uCfgLen] */
+} __packed;
+
+struct wcn36xx_hal_mac_start_parameters {
+        /* Drive Type - Production or FTM etc */
+        enum driver_type type;
+
+        /* Length of the config buffer */
+        u32 len;
+
+        /* Following this there is a TLV formatted buffer of length
+         * "len" bytes containing all config values.
+         * The TLV is expected to be formatted like this:
+         * 0           15            31           31+CFG_LEN-1        length-1
+         * |   CFG_ID   |   CFG_LEN   |   CFG_BODY    |  CFG_ID  |......|
+         */
+} __packed;
+
+struct wcn36xx_hal_mac_start_req_msg {
+        /* config buffer must start in TLV format just here */
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_mac_start_parameters params;
+} __packed;
+
+struct wcn36xx_hal_mac_start_rsp_params {
+        /* success or failure */
+        u16 status;
+
+        /* Max number of STA supported by the device */
+        u8 stations;
+
+        /* Max number of BSS supported by the device */
+        u8 bssids;
+
+        /* API Version */
+        struct wcnss_wlan_version version;
+
+        /* CRM build information */
+        u8 crm_version[WCN36XX_HAL_VERSION_LENGTH];
+
+        /* hardware/chipset/misc version information */
+        u8 wlan_version[WCN36XX_HAL_VERSION_LENGTH];
+
+} __packed;
+
+struct wcn36xx_hal_mac_start_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_mac_start_rsp_params start_rsp_params;
+} __packed;
+
+struct wcn36xx_hal_mac_stop_req_params {
+        /* The reason for which the device is being stopped */
+        enum wcn36xx_hal_stop_type reason;
+
+} __packed;
+
+struct wcn36xx_hal_mac_stop_req_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_mac_stop_req_params stop_req_params;
+} __packed;
+
+struct wcn36xx_hal_mac_stop_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+} __packed;
+
+struct wcn36xx_hal_update_cfg_req_msg {
+        /*
+         * Note: The length specified in tHalUpdateCfgReqMsg messages should be
+         * header.msgLen = sizeof(tHalUpdateCfgReqMsg) + uConfigBufferLen
+         */
+        struct wcn36xx_hal_msg_header header;
+
+        /* Length of the config buffer. Allows UMAC to update multiple CFGs */
+        u32 len;
+
+        /*
+         * Following this there is a TLV formatted buffer of length
+         * "uConfigBufferLen" bytes containing all config values.
+         * The TLV is expected to be formatted like this:
+         * 0           15            31           31+CFG_LEN-1        length-1
+         * |   CFG_ID   |   CFG_LEN   |   CFG_BODY    |  CFG_ID  |......|
+         */
+
+} __packed;
+
+struct wcn36xx_hal_update_cfg_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+} __packed;
+
+/* Frame control field format (2 bytes) */
+struct wcn36xx_hal_mac_frame_ctl {
+
+#ifndef ANI_LITTLE_BIT_ENDIAN
+
+        u8 subType:4;
+        u8 type:2;
+        u8 protVer:2;
+
+        u8 order:1;
+        u8 wep:1;
+        u8 moreData:1;
+        u8 powerMgmt:1;
+        u8 retry:1;
+        u8 moreFrag:1;
+        u8 fromDS:1;
+        u8 toDS:1;
+
+#else
+
+        u8 protVer:2;
+        u8 type:2;
+        u8 subType:4;
+
+        u8 toDS:1;
+        u8 fromDS:1;
+        u8 moreFrag:1;
+        u8 retry:1;
+        u8 powerMgmt:1;
+        u8 moreData:1;
+        u8 wep:1;
+        u8 order:1;
+
+#endif
+
+};
+
+/* Sequence control field */
+struct wcn36xx_hal_mac_seq_ctl {
+        u8 fragNum:4;
+        u8 seqNumLo:4;
+        u8 seqNumHi:8;
+};
+
+/* Management header format */
+struct wcn36xx_hal_mac_mgmt_hdr {
+        struct wcn36xx_hal_mac_frame_ctl fc;
+        u8 durationLo;
+        u8 durationHi;
+        u8 da[6];
+        u8 sa[6];
+        u8 bssId[6];
+        struct wcn36xx_hal_mac_seq_ctl seqControl;
+};
+
+/* FIXME: pronto v1 apparently has 4 */
+#define WCN36XX_HAL_NUM_BSSID               2
+
+/* Scan Entry to hold active BSS idx's */
+struct wcn36xx_hal_scan_entry {
+        u8 bss_index[WCN36XX_HAL_NUM_BSSID];
+        u8 active_bss_count;
+};
+
+struct wcn36xx_hal_init_scan_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* LEARN - AP Role
+           SCAN - STA Role */
+        enum wcn36xx_hal_sys_mode mode;
+
+        /* BSSID of the BSS */
+        u8 bssid[ETH_ALEN];
+
+        /* Whether BSS needs to be notified */
+        u8 notify;
+
+        /* Kind of frame to be used for notifying the BSS (Data Null, QoS
+         * Null, or CTS to Self). Must always be a valid frame type. */
+        u8 frame_type;
+
+        /* UMAC has the option of passing the MAC frame to be used for
+         * notifying the BSS. If non-zero, HAL will use the MAC frame
+         * buffer pointed to by macMgmtHdr. If zero, HAL will generate the
+         * appropriate MAC frame based on frameType. */
+        u8 frame_len;
+
+        /* Following the framelength there is a MAC frame buffer if
+         * frameLength is non-zero. */
+        struct wcn36xx_hal_mac_mgmt_hdr mac_mgmt_hdr;
+
+        /* Entry to hold number of active BSS idx's */
+        struct wcn36xx_hal_scan_entry scan_entry;
+};
+
+struct wcn36xx_hal_init_scan_con_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* LEARN - AP Role
+           SCAN - STA Role */
+        enum wcn36xx_hal_sys_mode mode;
+
+        /* BSSID of the BSS */
+        u8 bssid[ETH_ALEN];
+
+        /* Whether BSS needs to be notified */
+        u8 notify;
+
+        /* Kind of frame to be used for notifying the BSS (Data Null, QoS
+         * Null, or CTS to Self). Must always be a valid frame type. */
+        u8 frame_type;
+
+        /* UMAC has the option of passing the MAC frame to be used for
+         * notifying the BSS. If non-zero, HAL will use the MAC frame
+         * buffer pointed to by macMgmtHdr. If zero, HAL will generate the
+         * appropriate MAC frame based on frameType. */
+        u8 frame_length;
+
+        /* Following the framelength there is a MAC frame buffer if
+         * frameLength is non-zero. */
+        struct wcn36xx_hal_mac_mgmt_hdr mac_mgmt_hdr;
+
+        /* Entry to hold number of active BSS idx's */
+        struct wcn36xx_hal_scan_entry scan_entry;
+
+        /* Single NoA usage in Scanning */
+        u8 use_noa;
+
+        /* Indicates the scan duration (in ms) */
+        u16 scan_duration;
+
+};
+
+struct wcn36xx_hal_init_scan_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+} __packed;
+
+struct wcn36xx_hal_start_scan_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Indicates the channel to scan */
+        u8 scan_channel;
+} __packed;
+
+struct wcn36xx_hal_start_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        u32 start_tsf[2];
+        u8 tx_mgmt_power;
+
+} __packed;
+
+struct wcn36xx_hal_end_scan_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Indicates the channel to stop scanning. Not used really. But
+         * retained for symmetry with "start Scan" message. It can also
+         * help in error check if needed. */
+        u8 scan_channel;
+} __packed;
+
+struct wcn36xx_hal_end_scan_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+} __packed;
+
+struct wcn36xx_hal_finish_scan_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Identifies the operational state of the AP/STA
+         * LEARN - AP Role SCAN - STA Role */
+        enum wcn36xx_hal_sys_mode mode;
+
+        /* Operating channel to tune to. */
+        u8 oper_channel;
+
+        /* Channel Bonding state If 20/40 MHz is operational, this will
+         * indicate the 40 MHz extension channel in combination with the
+         * control channel */
+        enum phy_chan_bond_state cb_state;
+
+        /* BSSID of the BSS */
+        u8 bssid[ETH_ALEN];
+
+        /* Whether BSS needs to be notified */
+        u8 notify;
+
+        /* Kind of frame to be used for notifying the BSS (Data Null, QoS
+         * Null, or CTS to Self). Must always be a valid frame type. */
+        u8 frame_type;
+
+        /* UMAC has the option of passing the MAC frame to be used for
+         * notifying the BSS. If non-zero, HAL will use the MAC frame
+         * buffer pointed to by macMgmtHdr. If zero, HAL will generate the
+         * appropriate MAC frame based on frameType. */
+        u8 frame_length;
+
+        /* Following the framelength there is a MAC frame buffer if
+         * frameLength is non-zero. */
+        struct wcn36xx_hal_mac_mgmt_hdr mac_mgmt_hdr;
+
+        /* Entry to hold number of active BSS idx's */
+        struct wcn36xx_hal_scan_entry scan_entry;
+
+} __packed;
+
+struct wcn36xx_hal_finish_scan_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+} __packed;
+
+enum wcn36xx_hal_rate_index {
+        HW_RATE_INDEX_1MBPS     = 0x82,
+        HW_RATE_INDEX_2MBPS     = 0x84,
+        HW_RATE_INDEX_5_5MBPS   = 0x8B,
+        HW_RATE_INDEX_6MBPS     = 0x0C,
+        HW_RATE_INDEX_9MBPS     = 0x12,
+        HW_RATE_INDEX_11MBPS    = 0x96,
+        HW_RATE_INDEX_12MBPS    = 0x18,
+        HW_RATE_INDEX_18MBPS    = 0x24,
+        HW_RATE_INDEX_24MBPS    = 0x30,
+        HW_RATE_INDEX_36MBPS    = 0x48,
+        HW_RATE_INDEX_48MBPS    = 0x60,
+        HW_RATE_INDEX_54MBPS    = 0x6C
+};
+
+struct wcn36xx_hal_supported_rates {
+        /*
+         * For Self STA Entry: this represents Self Mode.
+         * For Peer Stations, this represents the mode of the peer.
+         * On Station:
+         *
+         * --this mode is updated when PE adds the Self Entry.
+         *
+         * -- OR when PE sends 'ADD_BSS' message and station context in BSS
+         *    is used to indicate the mode of the AP.
+         *
+         * ON AP:
+         *
+         * -- this mode is updated when PE sends 'ADD_BSS' and Sta entry
+         *     for that BSS is used to indicate the self mode of the AP.
+         *
+         * -- OR when a station is associated, PE sends 'ADD_STA' message
+         *    with this mode updated.
+         */
+
+        enum sta_rate_mode op_rate_mode;
+
+        /* 11b, 11a and aniLegacyRates are IE rates which gives rate in
+         * unit of 500Kbps */
+        u16 dsss_rates[WCN36XX_HAL_NUM_DSSS_RATES];
+        u16 ofdm_rates[WCN36XX_HAL_NUM_OFDM_RATES];
+        u16 legacy_rates[WCN36XX_HAL_NUM_POLARIS_RATES];
+        u16 reserved;
+
+        /* Taurus only supports 26 Titan Rates(no ESF/concat Rates will be
+         * supported) First 26 bits are reserved for those Titan rates and
+         * the last 4 bits(bit28-31) for Taurus, 2(bit26-27) bits are
+         * reserved. */
+        /* Titan and Taurus Rates */
+        u32 enhanced_rate_bitmap;
+
+        /*
+         * 0-76 bits used, remaining reserved
+         * bits 0-15 and 32 should be set.
+         */
+        u8 supported_mcs_set[WCN36XX_HAL_MAC_MAX_SUPPORTED_MCS_SET];
+
+        /*
+         * RX Highest Supported Data Rate defines the highest data
+         * rate that the STA is able to receive, in unites of 1Mbps.
+         * This value is derived from "Supported MCS Set field" inside
+         * the HT capability element.
+         */
+        u16 rx_highest_data_rate;
+
+} __packed;
+
+struct wcn36xx_hal_config_sta_params {
+        /* BSSID of STA */
+        u8 bssid[ETH_ALEN];
+
+        /* ASSOC ID, as assigned by UMAC */
+        u16 aid;
+
+        /* STA entry Type: 0 - Self, 1 - Other/Peer, 2 - BSSID, 3 - BCAST */
+        u8 type;
+
+        /* Short Preamble Supported. */
+        u8 short_preamble_supported;
+
+        /* MAC Address of STA */
+        u8 mac[ETH_ALEN];
+
+        /* Listen interval of the STA */
+        u16 listen_interval;
+
+        /* Support for 11e/WMM */
+        u8 wmm_enabled;
+
+        /* 11n HT capable STA */
+        u8 ht_capable;
+
+        /* TX Width Set: 0 - 20 MHz only, 1 - 20/40 MHz */
+        u8 tx_channel_width_set;
+
+        /* RIFS mode 0 - NA, 1 - Allowed */
+        u8 rifs_mode;
+
+        /* L-SIG TXOP Protection mechanism
+           0 - No Support, 1 - Supported
+           SG - there is global field */
+        u8 lsig_txop_protection;
+
+        /* Max Ampdu Size supported by STA. TPE programming.
+           0 : 8k , 1 : 16k, 2 : 32k, 3 : 64k */
+        u8 max_ampdu_size;
+
+        /* Max Ampdu density. Used by RA.  3 : 0~7 : 2^(11nAMPDUdensity -4) */
+        u8 max_ampdu_density;
+
+        /* Max AMSDU size 1 : 3839 bytes, 0 : 7935 bytes */
+        u8 max_amsdu_size;
+
+        /* Short GI support for 40Mhz packets */
+        u8 sgi_40mhz;
+
+        /* Short GI support for 20Mhz packets */
+        u8 sgi_20Mhz;
+
+        /* TODO move this parameter to the end for 3680 */
+        /* These rates are the intersection of peer and self capabilities. */
+        struct wcn36xx_hal_supported_rates supported_rates;
+
+        /* Robust Management Frame (RMF) enabled/disabled */
+        u8 rmf;
+
+        /* The unicast encryption type in the association */
+        u32 encrypt_type;
+
+        /* HAL should update the existing STA entry, if this flag is set. UMAC
+           will set this flag in case of RE-ASSOC, where we want to reuse the
+           old STA ID. 0 = Add, 1 = Update */
+        u8 action;
+
+        /* U-APSD Flags: 1b per AC.  Encoded as follows:
+           b7 b6 b5 b4 b3 b2 b1 b0 =
+           X  X  X  X  BE BK VI VO */
+        u8 uapsd;
+
+        /* Max SP Length */
+        u8 max_sp_len;
+
+        /* 11n Green Field preamble support
+           0 - Not supported, 1 - Supported */
+        u8 green_field_capable;
+
+        /* MIMO Power Save mode */
+        enum wcn36xx_hal_ht_mimo_state mimo_ps;
+
+        /* Delayed BA Support */
+        u8 delayed_ba_support;
+
+        /* Max AMPDU duration in 32us */
+        u8 max_ampdu_duration;
+
+        /* HT STA should set it to 1 if it is enabled in BSS. HT STA should
+         * set it to 0 if AP does not support it. This indication is sent
+         * to HAL and HAL uses this flag to pickup up appropriate 40Mhz
+         * rates. */
+        u8 dsss_cck_mode_40mhz;
+
+        /* Valid STA Idx when action=Update. Set to 0xFF when invalid!
+         * Retained for backward compalibity with existing HAL code */
+        u8 sta_index;
+
+        /* BSSID of BSS to which station is associated. Set to 0xFF when
+         * invalid. Retained for backward compalibity with existing HAL
+         * code */
+        u8 bssid_index;
+
+        u8 p2p;
+
+        /* TODO add this parameter for 3680. */
+        /* Reserved to align next field on a dword boundary */
+        /* u8 reserved; */
+} __packed;
+
+struct wcn36xx_hal_config_sta_req_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_config_sta_params sta_params;
+} __packed;
+
+struct wcn36xx_hal_config_sta_params_v1 {
+        /* BSSID of STA */
+        u8 bssid[ETH_ALEN];
+
+        /* ASSOC ID, as assigned by UMAC */
+        u16 aid;
+
+        /* STA entry Type: 0 - Self, 1 - Other/Peer, 2 - BSSID, 3 - BCAST */
+        u8 type;
+
+        /* Short Preamble Supported. */
+        u8 short_preamble_supported;
+
+        /* MAC Address of STA */
+        u8 mac[ETH_ALEN];
+
+        /* Listen interval of the STA */
+        u16 listen_interval;
+
+        /* Support for 11e/WMM */
+        u8 wmm_enabled;
+
+        /* 11n HT capable STA */
+        u8 ht_capable;
+
+        /* TX Width Set: 0 - 20 MHz only, 1 - 20/40 MHz */
+        u8 tx_channel_width_set;
+
+        /* RIFS mode 0 - NA, 1 - Allowed */
+        u8 rifs_mode;
+
+        /* L-SIG TXOP Protection mechanism
+           0 - No Support, 1 - Supported
+           SG - there is global field */
+        u8 lsig_txop_protection;
+
+        /* Max Ampdu Size supported by STA. TPE programming.
+           0 : 8k , 1 : 16k, 2 : 32k, 3 : 64k */
+        u8 max_ampdu_size;
+
+        /* Max Ampdu density. Used by RA.  3 : 0~7 : 2^(11nAMPDUdensity -4) */
+        u8 max_ampdu_density;
+
+        /* Max AMSDU size 1 : 3839 bytes, 0 : 7935 bytes */
+        u8 max_amsdu_size;
+
+        /* Short GI support for 40Mhz packets */
+        u8 sgi_40mhz;
+
+        /* Short GI support for 20Mhz packets */
+        u8 sgi_20Mhz;
+
+        /* Robust Management Frame (RMF) enabled/disabled */
+        u8 rmf;
+
+        /* The unicast encryption type in the association */
+        u32 encrypt_type;
+
+        /* HAL should update the existing STA entry, if this flag is set. UMAC
+           will set this flag in case of RE-ASSOC, where we want to reuse the
+           old STA ID. 0 = Add, 1 = Update */
+        u8 action;
+
+        /* U-APSD Flags: 1b per AC.  Encoded as follows:
+           b7 b6 b5 b4 b3 b2 b1 b0 =
+           X  X  X  X  BE BK VI VO */
+        u8 uapsd;
+
+        /* Max SP Length */
+        u8 max_sp_len;
+
+        /* 11n Green Field preamble support
+           0 - Not supported, 1 - Supported */
+        u8 green_field_capable;
+
+        /* MIMO Power Save mode */
+        enum wcn36xx_hal_ht_mimo_state mimo_ps;
+
+        /* Delayed BA Support */
+        u8 delayed_ba_support;
+
+        /* Max AMPDU duration in 32us */
+        u8 max_ampdu_duration;
+
+        /* HT STA should set it to 1 if it is enabled in BSS. HT STA should
+         * set it to 0 if AP does not support it. This indication is sent
+         * to HAL and HAL uses this flag to pickup up appropriate 40Mhz
+         * rates. */
+        u8 dsss_cck_mode_40mhz;
+
+        /* Valid STA Idx when action=Update. Set to 0xFF when invalid!
+         * Retained for backward compalibity with existing HAL code */
+        u8 sta_index;
+
+        /* BSSID of BSS to which station is associated. Set to 0xFF when
+         * invalid. Retained for backward compalibity with existing HAL
+         * code */
+        u8 bssid_index;
+
+        u8 p2p;
+
+        /* Reserved to align next field on a dword boundary */
+        u8 reserved;
+
+        /* These rates are the intersection of peer and self capabilities. */
+        struct wcn36xx_hal_supported_rates supported_rates;
+} __packed;
+
+struct wcn36xx_hal_config_sta_req_msg_v1 {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_config_sta_params_v1 sta_params;
+} __packed;
+
+struct config_sta_rsp_params {
+        /* success or failure */
+        u32 status;
+
+        /* Station index; valid only when 'status' field value SUCCESS */
+        u8 sta_index;
+
+        /* BSSID Index of BSS to which the station is associated */
+        u8 bssid_index;
+
+        /* DPU Index for PTK */
+        u8 dpu_index;
+
+        /* DPU Index for GTK */
+        u8 bcast_dpu_index;
+
+        /* DPU Index for IGTK  */
+        u8 bcast_mgmt_dpu_idx;
+
+        /* PTK DPU signature */
+        u8 uc_ucast_sig;
+
+        /* GTK DPU isignature */
+        u8 uc_bcast_sig;
+
+        /* IGTK DPU signature */
+        u8 uc_mgmt_sig;
+
+        u8 p2p;
+
+} __packed;
+
+struct wcn36xx_hal_config_sta_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        struct config_sta_rsp_params params;
+} __packed;
+
+/* Delete STA Request message */
+struct wcn36xx_hal_delete_sta_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Index of STA to delete */
+        u8 sta_index;
+
+} __packed;
+
+/* Delete STA Response message */
+struct wcn36xx_hal_delete_sta_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        /* Index of STA deleted */
+        u8 sta_id;
+} __packed;
+
+/* 12 Bytes long because this structure can be used to represent rate and
+ * extended rate set IEs. The parser assume this to be at least 12 */
+struct wcn36xx_hal_rate_set {
+        u8 num_rates;
+        u8 rate[WCN36XX_HAL_MAC_RATESET_EID_MAX];
+} __packed;
+
+/* access category record */
+struct wcn36xx_hal_aci_aifsn {
+#ifndef ANI_LITTLE_BIT_ENDIAN
+        u8 rsvd:1;
+        u8 aci:2;
+        u8 acm:1;
+        u8 aifsn:4;
+#else
+        u8 aifsn:4;
+        u8 acm:1;
+        u8 aci:2;
+        u8 rsvd:1;
+#endif
+} __packed;
+
+/* contention window size */
+struct wcn36xx_hal_mac_cw {
+#ifndef ANI_LITTLE_BIT_ENDIAN
+        u8 max:4;
+        u8 min:4;
+#else
+        u8 min:4;
+        u8 max:4;
+#endif
+} __packed;
+
+struct wcn36xx_hal_edca_param_record {
+        struct wcn36xx_hal_aci_aifsn aci;
+        struct wcn36xx_hal_mac_cw cw;
+        u16 txop_limit;
+} __packed;
+
+struct wcn36xx_hal_mac_ssid {
+        u8 length;
+        u8 ssid[32];
+} __packed;
+
+/* Concurrency role. These are generic IDs that identify the various roles
+ *  in the software system. */
+enum wcn36xx_hal_con_mode {
+        WCN36XX_HAL_STA_MODE = 0,
+
+        /* to support softAp mode . This is misleading.
+           It means AP MODE only. */
+        WCN36XX_HAL_STA_SAP_MODE = 1,
+
+        WCN36XX_HAL_P2P_CLIENT_MODE,
+        WCN36XX_HAL_P2P_GO_MODE,
+        WCN36XX_HAL_MONITOR_MODE,
+};
+
+/* This is a bit pattern to be set for each mode
+ * bit 0 - sta mode
+ * bit 1 - ap mode
+ * bit 2 - p2p client mode
+ * bit 3 - p2p go mode */
+enum wcn36xx_hal_concurrency_mode {
+        HAL_STA = 1,
+        HAL_SAP = 2,
+
+        /* to support sta, softAp  mode . This means STA+AP mode */
+        HAL_STA_SAP = 3,
+
+        HAL_P2P_CLIENT = 4,
+        HAL_P2P_GO = 8,
+        HAL_MAX_CONCURRENCY_PERSONA = 4
+};
+
+struct wcn36xx_hal_config_bss_params {
+        /* BSSID */
+        u8 bssid[ETH_ALEN];
+
+        /* Self Mac Address */
+        u8 self_mac_addr[ETH_ALEN];
+
+        /* BSS type */
+        enum wcn36xx_hal_bss_type bss_type;
+
+        /* Operational Mode: AP =0, STA = 1 */
+        u8 oper_mode;
+
+        /* Network Type */
+        enum wcn36xx_hal_nw_type nw_type;
+
+        /* Used to classify PURE_11G/11G_MIXED to program MTU */
+        u8 short_slot_time_supported;
+
+        /* Co-exist with 11a STA */
+        u8 lla_coexist;
+
+        /* Co-exist with 11b STA */
+        u8 llb_coexist;
+
+        /* Co-exist with 11g STA */
+        u8 llg_coexist;
+
+        /* Coexistence with 11n STA */
+        u8 ht20_coexist;
+
+        /* Non GF coexist flag */
+        u8 lln_non_gf_coexist;
+
+        /* TXOP protection support */
+        u8 lsig_tx_op_protection_full_support;
+
+        /* RIFS mode */
+        u8 rifs_mode;
+
+        /* Beacon Interval in TU */
+        u16 beacon_interval;
+
+        /* DTIM period */
+        u8 dtim_period;
+
+        /* TX Width Set: 0 - 20 MHz only, 1 - 20/40 MHz */
+        u8 tx_channel_width_set;
+
+        /* Operating channel */
+        u8 oper_channel;
+
+        /* Extension channel for channel bonding */
+        u8 ext_channel;
+
+        /* Reserved to align next field on a dword boundary */
+        u8 reserved;
+
+        /* TODO move sta to the end for 3680 */
+        /* Context of the station being added in HW
+         *  Add a STA entry for "itself" -
+         *
+         *  On AP  - Add the AP itself in an "STA context"
+         *
+         *  On STA - Add the AP to which this STA is joining in an
+         *  "STA context"
+         */
+        struct wcn36xx_hal_config_sta_params sta;
+        /* SSID of the BSS */
+        struct wcn36xx_hal_mac_ssid ssid;
+
+        /* HAL should update the existing BSS entry, if this flag is set.
+         * UMAC will set this flag in case of reassoc, where we want to
+         * resue the the old BSSID and still return success 0 = Add, 1 =
+         * Update */
+        u8 action;
+
+        /* MAC Rate Set */
+        struct wcn36xx_hal_rate_set rateset;
+
+        /* Enable/Disable HT capabilities of the BSS */
+        u8 ht;
+
+        /* Enable/Disable OBSS protection */
+        u8 obss_prot_enabled;
+
+        /* RMF enabled/disabled */
+        u8 rmf;
+
+        /* HT Operating Mode operating mode of the 802.11n STA */
+        enum wcn36xx_hal_ht_operating_mode ht_oper_mode;
+
+        /* Dual CTS Protection: 0 - Unused, 1 - Used */
+        u8 dual_cts_protection;
+
+        /* Probe Response Max retries */
+        u8 max_probe_resp_retry_limit;
+
+        /* To Enable Hidden ssid */
+        u8 hidden_ssid;
+
+        /* To Enable Disable FW Proxy Probe Resp */
+        u8 proxy_probe_resp;
+
+        /* Boolean to indicate if EDCA params are valid. UMAC might not
+         * have valid EDCA params or might not desire to apply EDCA params
+         * during config BSS. 0 implies Not Valid ; Non-Zero implies
+         * valid */
+        u8 edca_params_valid;
+
+        /* EDCA Parameters for Best Effort Access Category */
+        struct wcn36xx_hal_edca_param_record acbe;
+
+        /* EDCA Parameters forBackground Access Category */
+        struct wcn36xx_hal_edca_param_record acbk;
+
+        /* EDCA Parameters for Video Access Category */
+        struct wcn36xx_hal_edca_param_record acvi;
+
+        /* EDCA Parameters for Voice Access Category */
+        struct wcn36xx_hal_edca_param_record acvo;
+
+        /* Ext Bss Config Msg if set */
+        u8 ext_set_sta_key_param_valid;
+
+        /* SetStaKeyParams for ext bss msg */
+        struct wcn36xx_hal_set_sta_key_params ext_set_sta_key_param;
+
+        /* Persona for the BSS can be STA,AP,GO,CLIENT value same as enum
+         * wcn36xx_hal_con_mode */
+        u8 wcn36xx_hal_persona;
+
+        u8 spectrum_mgt_enable;
+
+        /* HAL fills in the tx power used for mgmt frames in txMgmtPower */
+        s8 tx_mgmt_power;
+
+        /* maxTxPower has max power to be used after applying the power
+         * constraint if any */
+        s8 max_tx_power;
+} __packed;
+
+struct wcn36xx_hal_config_bss_req_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_config_bss_params bss_params;
+} __packed;
+
+struct wcn36xx_hal_config_bss_params_v1 {
+        /* BSSID */
+        u8 bssid[ETH_ALEN];
+
+        /* Self Mac Address */
+        u8 self_mac_addr[ETH_ALEN];
+
+        /* BSS type */
+        enum wcn36xx_hal_bss_type bss_type;
+
+        /* Operational Mode: AP =0, STA = 1 */
+        u8 oper_mode;
+
+        /* Network Type */
+        enum wcn36xx_hal_nw_type nw_type;
+
+        /* Used to classify PURE_11G/11G_MIXED to program MTU */
+        u8 short_slot_time_supported;
+
+        /* Co-exist with 11a STA */
+        u8 lla_coexist;
+
+        /* Co-exist with 11b STA */
+        u8 llb_coexist;
+
+        /* Co-exist with 11g STA */
+        u8 llg_coexist;
+
+        /* Coexistence with 11n STA */
+        u8 ht20_coexist;
+
+        /* Non GF coexist flag */
+        u8 lln_non_gf_coexist;
+
+        /* TXOP protection support */
+        u8 lsig_tx_op_protection_full_support;
+
+        /* RIFS mode */
+        u8 rifs_mode;
+
+        /* Beacon Interval in TU */
+        u16 beacon_interval;
+
+        /* DTIM period */
+        u8 dtim_period;
+
+        /* TX Width Set: 0 - 20 MHz only, 1 - 20/40 MHz */
+        u8 tx_channel_width_set;
+
+        /* Operating channel */
+        u8 oper_channel;
+
+        /* Extension channel for channel bonding */
+        u8 ext_channel;
+
+        /* Reserved to align next field on a dword boundary */
+        u8 reserved;
+
+        /* SSID of the BSS */
+        struct wcn36xx_hal_mac_ssid ssid;
+
+        /* HAL should update the existing BSS entry, if this flag is set.
+         * UMAC will set this flag in case of reassoc, where we want to
+         * resue the the old BSSID and still return success 0 = Add, 1 =
+         * Update */
+        u8 action;
+
+        /* MAC Rate Set */
+        struct wcn36xx_hal_rate_set rateset;
+
+        /* Enable/Disable HT capabilities of the BSS */
+        u8 ht;
+
+        /* Enable/Disable OBSS protection */
+        u8 obss_prot_enabled;
+
+        /* RMF enabled/disabled */
+        u8 rmf;
+
+        /* HT Operating Mode operating mode of the 802.11n STA */
+        enum wcn36xx_hal_ht_operating_mode ht_oper_mode;
+
+        /* Dual CTS Protection: 0 - Unused, 1 - Used */
+        u8 dual_cts_protection;
+
+        /* Probe Response Max retries */
+        u8 max_probe_resp_retry_limit;
+
+        /* To Enable Hidden ssid */
+        u8 hidden_ssid;
+
+        /* To Enable Disable FW Proxy Probe Resp */
+        u8 proxy_probe_resp;
+
+        /* Boolean to indicate if EDCA params are valid. UMAC might not
+         * have valid EDCA params or might not desire to apply EDCA params
+         * during config BSS. 0 implies Not Valid ; Non-Zero implies
+         * valid */
+        u8 edca_params_valid;
+
+        /* EDCA Parameters for Best Effort Access Category */
+        struct wcn36xx_hal_edca_param_record acbe;
+
+        /* EDCA Parameters forBackground Access Category */
+        struct wcn36xx_hal_edca_param_record acbk;
+
+        /* EDCA Parameters for Video Access Category */
+        struct wcn36xx_hal_edca_param_record acvi;
+
+        /* EDCA Parameters for Voice Access Category */
+        struct wcn36xx_hal_edca_param_record acvo;
+
+        /* Ext Bss Config Msg if set */
+        u8 ext_set_sta_key_param_valid;
+
+        /* SetStaKeyParams for ext bss msg */
+        struct wcn36xx_hal_set_sta_key_params ext_set_sta_key_param;
+
+        /* Persona for the BSS can be STA,AP,GO,CLIENT value same as enum
+         * wcn36xx_hal_con_mode */
+        u8 wcn36xx_hal_persona;
+
+        u8 spectrum_mgt_enable;
+
+        /* HAL fills in the tx power used for mgmt frames in txMgmtPower */
+        s8 tx_mgmt_power;
+
+        /* maxTxPower has max power to be used after applying the power
+         * constraint if any */
+        s8 max_tx_power;
+
+        /* Context of the station being added in HW
+         *  Add a STA entry for "itself" -
+         *
+         *  On AP  - Add the AP itself in an "STA context"
+         *
+         *  On STA - Add the AP to which this STA is joining in an
+         *  "STA context"
+         */
+        struct wcn36xx_hal_config_sta_params_v1 sta;
+} __packed;
+
+struct wcn36xx_hal_config_bss_req_msg_v1 {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_config_bss_params_v1 bss_params;
+} __packed;
+
+struct wcn36xx_hal_config_bss_rsp_params {
+        /* Success or Failure */
+        u32 status;
+
+        /* BSS index allocated by HAL */
+        u8 bss_index;
+
+        /* DPU descriptor index for PTK */
+        u8 dpu_desc_index;
+
+        /* PTK DPU signature */
+        u8 ucast_dpu_signature;
+
+        /* DPU descriptor index for GTK */
+        u8 bcast_dpu_desc_indx;
+
+        /* GTK DPU signature */
+        u8 bcast_dpu_signature;
+
+        /* DPU descriptor for IGTK */
+        u8 mgmt_dpu_desc_index;
+
+        /* IGTK DPU signature */
+        u8 mgmt_dpu_signature;
+
+        /* Station Index for BSS entry */
+        u8 bss_sta_index;
+
+        /* Self station index for this BSS */
+        u8 bss_self_sta_index;
+
+        /* Bcast station for buffering bcast frames in AP role */
+        u8 bss_bcast_sta_idx;
+
+        /* MAC Address of STA(PEER/SELF) in staContext of configBSSReq */
+        u8 mac[ETH_ALEN];
+
+        /* HAL fills in the tx power used for mgmt frames in this field. */
+        s8 tx_mgmt_power;
+
+} __packed;
+
+struct wcn36xx_hal_config_bss_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_config_bss_rsp_params bss_rsp_params;
+} __packed;
+
+struct wcn36xx_hal_delete_bss_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* BSS index to be deleted */
+        u8 bss_index;
+
+} __packed;
+
+struct wcn36xx_hal_delete_bss_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Success or Failure */
+        u32 status;
+
+        /* BSS index that has been deleted */
+        u8 bss_index;
+
+} __packed;
+
+struct wcn36xx_hal_join_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Indicates the BSSID to which STA is going to associate */
+        u8 bssid[ETH_ALEN];
+
+        /* Indicates the channel to switch to. */
+        u8 channel;
+
+        /* Self STA MAC */
+        u8 self_sta_mac_addr[ETH_ALEN];
+
+        /* Local power constraint */
+        u8 local_power_constraint;
+
+        /* Secondary channel offset */
+        enum phy_chan_bond_state secondary_channel_offset;
+
+        /* link State */
+        enum wcn36xx_hal_link_state link_state;
+
+        /* Max TX power */
+        s8 max_tx_power;
+} __packed;
+
+struct wcn36xx_hal_join_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        /* HAL fills in the tx power used for mgmt frames in this field */
+        u8 tx_mgmt_power;
+} __packed;
+
+struct post_assoc_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        struct wcn36xx_hal_config_sta_params sta_params;
+        struct wcn36xx_hal_config_bss_params bss_params;
+};
+
+struct post_assoc_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct config_sta_rsp_params sta_rsp_params;
+        struct wcn36xx_hal_config_bss_rsp_params bss_rsp_params;
+};
+
+/* This is used to create a set of WEP keys for a given BSS. */
+struct wcn36xx_hal_set_bss_key_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* BSS Index of the BSS */
+        u8 bss_idx;
+
+        /* Encryption Type used with peer */
+        enum ani_ed_type enc_type;
+
+        /* Number of keys */
+        u8 num_keys;
+
+        /* Array of keys. */
+        struct wcn36xx_hal_keys keys[WCN36XX_HAL_MAC_MAX_NUM_OF_DEFAULT_KEYS];
+
+        /* Control for Replay Count, 1= Single TID based replay count on Tx
+         * 0 = Per TID based replay count on TX */
+        u8 single_tid_rc;
+} __packed;
+
+/* tagged version of set bss key */
+struct wcn36xx_hal_set_bss_key_req_msg_tagged {
+        struct wcn36xx_hal_set_bss_key_req_msg Msg;
+        u32 tag;
+} __packed;
+
+struct wcn36xx_hal_set_bss_key_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+} __packed;
+
+/*
+ * This is used  configure the key information on a given station.
+ * When the sec_type is WEP40 or WEP104, the def_wep_idx is used to locate
+ * a preconfigured key from a BSS the station assoicated with; otherwise
+ * a new key descriptor is created based on the key field.
+ */
+struct wcn36xx_hal_set_sta_key_req_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_set_sta_key_params set_sta_key_params;
+} __packed;
+
+struct wcn36xx_hal_set_sta_key_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+} __packed;
+
+struct wcn36xx_hal_remove_bss_key_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* BSS Index of the BSS */
+        u8 bss_idx;
+
+        /* Encryption Type used with peer */
+        enum ani_ed_type enc_type;
+
+        /* Key Id */
+        u8 key_id;
+
+        /* STATIC/DYNAMIC. Used in Nullifying in Key Descriptors for
+         * Static/Dynamic keys */
+        enum ani_wep_type wep_type;
+} __packed;
+
+struct wcn36xx_hal_remove_bss_key_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+} __packed;
+
+/*
+ * This is used by PE to Remove the key information on a given station.
+ */
+struct wcn36xx_hal_remove_sta_key_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* STA Index */
+        u16 sta_idx;
+
+        /* Encryption Type used with peer */
+        enum ani_ed_type enc_type;
+
+        /* Key Id */
+        u8 key_id;
+
+        /* Whether to invalidate the Broadcast key or Unicast key. In case
+         * of WEP, the same key is used for both broadcast and unicast. */
+        u8 unicast;
+
+} __packed;
+
+struct wcn36xx_hal_remove_sta_key_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /*success or failure */
+        u32 status;
+
+} __packed;
+
+#ifdef FEATURE_OEM_DATA_SUPPORT
+
+#ifndef OEM_DATA_REQ_SIZE
+#define OEM_DATA_REQ_SIZE 134
+#endif
+
+#ifndef OEM_DATA_RSP_SIZE
+#define OEM_DATA_RSP_SIZE 1968
+#endif
+
+struct start_oem_data_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u32 status;
+        tSirMacAddr self_mac_addr;
+        u8 oem_data_req[OEM_DATA_REQ_SIZE];
+
+};
+
+struct start_oem_data_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 oem_data_rsp[OEM_DATA_RSP_SIZE];
+};
+
+#endif
+
+struct wcn36xx_hal_switch_channel_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Channel number */
+        u8 channel_number;
+
+        /* Local power constraint */
+        u8 local_power_constraint;
+
+        /* Secondary channel offset */
+        enum phy_chan_bond_state secondary_channel_offset;
+
+        /* HAL fills in the tx power used for mgmt frames in this field. */
+        u8 tx_mgmt_power;
+
+        /* Max TX power */
+        u8 max_tx_power;
+
+        /* Self STA MAC */
+        u8 self_sta_mac_addr[ETH_ALEN];
+
+        /* VO WIFI comment: BSSID needed to identify session. As the
+         * request has power constraints, this should be applied only to
+         * that session Since MTU timing and EDCA are sessionized, this
+         * struct needs to be sessionized and bssid needs to be out of the
+         * VOWifi feature flag V IMP: Keep bssId field at the end of this
+         * msg. It is used to mantain backward compatbility by way of
+         * ignoring if using new host/old FW or old host/new FW since it is
+         * at the end of this struct
+         */
+        u8 bssid[ETH_ALEN];
+} __packed;
+
+struct wcn36xx_hal_switch_channel_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Status */
+        u32 status;
+
+        /* Channel number - same as in request */
+        u8 channel_number;
+
+        /* HAL fills in the tx power used for mgmt frames in this field */
+        u8 tx_mgmt_power;
+
+        /* BSSID needed to identify session - same as in request */
+        u8 bssid[ETH_ALEN];
+
+} __packed;
+
+struct update_edca_params_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /*BSS Index */
+        u16 bss_index;
+
+        /* Best Effort */
+        struct wcn36xx_hal_edca_param_record acbe;
+
+        /* Background */
+        struct wcn36xx_hal_edca_param_record acbk;
+
+        /* Video */
+        struct wcn36xx_hal_edca_param_record acvi;
+
+        /* Voice */
+        struct wcn36xx_hal_edca_param_record acvo;
+};
+
+struct update_edca_params_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct dpu_stats_params {
+        /* Index of STA to which the statistics */
+        u16 sta_index;
+
+        /* Encryption mode */
+        u8 enc_mode;
+
+        /* status */
+        u32 status;
+
+        /* Statistics */
+        u32 send_blocks;
+        u32 recv_blocks;
+        u32 replays;
+        u8 mic_error_cnt;
+        u32 prot_excl_cnt;
+        u16 format_err_cnt;
+        u16 un_decryptable_cnt;
+        u32 decrypt_err_cnt;
+        u32 decrypt_ok_cnt;
+};
+
+struct wcn36xx_hal_stats_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Valid STA Idx for per STA stats request */
+        u32 sta_id;
+
+        /* Categories of stats requested as specified in eHalStatsMask */
+        u32 stats_mask;
+};
+
+struct ani_summary_stats_info {
+        /* Total number of packets(per AC) that were successfully
+         * transmitted with retries */
+        u32 retry_cnt[4];
+
+        /* The number of MSDU packets and MMPDU frames per AC that the
+         * 802.11 station successfully transmitted after more than one
+         * retransmission attempt */
+        u32 multiple_retry_cnt[4];
+
+        /* Total number of packets(per AC) that were successfully
+         * transmitted (with and without retries, including multi-cast,
+         * broadcast) */
+        u32 tx_frm_cnt[4];
+
+        /* Total number of packets that were successfully received (after
+         * appropriate filter rules including multi-cast, broadcast) */
+        u32 rx_frm_cnt;
+
+        /* Total number of duplicate frames received successfully */
+        u32 frm_dup_cnt;
+
+        /* Total number packets(per AC) failed to transmit */
+        u32 fail_cnt[4];
+
+        /* Total number of RTS/CTS sequence failures for transmission of a
+         * packet */
+        u32 rts_fail_cnt;
+
+        /* Total number packets failed transmit because of no ACK from the
+         * remote entity */
+        u32 ack_fail_cnt;
+
+        /* Total number of RTS/CTS sequence success for transmission of a
+         * packet */
+        u32 rts_succ_cnt;
+
+        /* The sum of the receive error count and dropped-receive-buffer
+         * error count. HAL will provide this as a sum of (FCS error) +
+         * (Fail get BD/PDU in HW) */
+        u32 rx_discard_cnt;
+
+        /*
+         * The receive error count. HAL will provide the RxP FCS error
+         * global counter. */
+        u32 rx_error_cnt;
+
+        /* The sum of the transmit-directed byte count, transmit-multicast
+         * byte count and transmit-broadcast byte count. HAL will sum TPE
+         * UC/MC/BCAST global counters to provide this. */
+        u32 tx_byte_cnt;
+};
+
+/* defines tx_rate_flags */
+enum tx_rate_info {
+        /* Legacy rates */
+        HAL_TX_RATE_LEGACY = 0x1,
+
+        /* HT20 rates */
+        HAL_TX_RATE_HT20 = 0x2,
+
+        /* HT40 rates */
+        HAL_TX_RATE_HT40 = 0x4,
+
+        /* Rate with Short guard interval */
+        HAL_TX_RATE_SGI = 0x8,
+
+        /* Rate with Long guard interval */
+        HAL_TX_RATE_LGI = 0x10
+};
+
+struct ani_global_class_a_stats_info {
+        /* The number of MPDU frames received by the 802.11 station for
+         * MSDU packets or MMPDU frames */
+        u32 rx_frag_cnt;
+
+        /* The number of MPDU frames received by the 802.11 station for
+         * MSDU packets or MMPDU frames when a promiscuous packet filter
+         * was enabled */
+        u32 promiscuous_rx_frag_cnt;
+
+        /* The receiver input sensitivity referenced to a FER of 8% at an
+         * MPDU length of 1024 bytes at the antenna connector. Each element
+         * of the array shall correspond to a supported rate and the order
+         * shall be the same as the supporteRates parameter. */
+        u32 rx_input_sensitivity;
+
+        /* The maximum transmit power in dBm upto one decimal. for eg: if
+         * it is 10.5dBm, the value would be 105 */
+        u32 max_pwr;
+
+        /* Number of times the receiver failed to synchronize with the
+         * incoming signal after detecting the sync in the preamble of the
+         * transmitted PLCP protocol data unit. */
+        u32 sync_fail_cnt;
+
+        /* Legacy transmit rate, in units of 500 kbit/sec, for the most
+         * recently transmitted frame */
+        u32 tx_rate;
+
+        /* mcs index for HT20 and HT40 rates */
+        u32 mcs_index;
+
+        /* to differentiate between HT20 and HT40 rates; short and long
+         * guard interval */
+        u32 tx_rate_flags;
+};
+
+struct ani_global_security_stats {
+        /* The number of unencrypted received MPDU frames that the MAC
+         * layer discarded when the IEEE 802.11 dot11ExcludeUnencrypted
+         * management information base (MIB) object is enabled */
+        u32 rx_wep_unencrypted_frm_cnt;
+
+        /* The number of received MSDU packets that that the 802.11 station
+         * discarded because of MIC failures */
+        u32 rx_mic_fail_cnt;
+
+        /* The number of encrypted MPDU frames that the 802.11 station
+         * failed to decrypt because of a TKIP ICV error */
+        u32 tkip_icv_err;
+
+        /* The number of received MPDU frames that the 802.11 discarded
+         * because of an invalid AES-CCMP format */
+        u32 aes_ccmp_format_err;
+
+        /* The number of received MPDU frames that the 802.11 station
+         * discarded because of the AES-CCMP replay protection procedure */
+        u32 aes_ccmp_replay_cnt;
+
+        /* The number of received MPDU frames that the 802.11 station
+         * discarded because of errors detected by the AES-CCMP decryption
+         * algorithm */
+        u32 aes_ccmp_decrpt_err;
+
+        /* The number of encrypted MPDU frames received for which a WEP
+         * decryption key was not available on the 802.11 station */
+        u32 wep_undecryptable_cnt;
+
+        /* The number of encrypted MPDU frames that the 802.11 station
+         * failed to decrypt because of a WEP ICV error */
+        u32 wep_icv_err;
+
+        /* The number of received encrypted packets that the 802.11 station
+         * successfully decrypted */
+        u32 rx_decrypt_succ_cnt;
+
+        /* The number of encrypted packets that the 802.11 station failed
+         * to decrypt */
+        u32 rx_decrypt_fail_cnt;
+};
+
+struct ani_global_class_b_stats_info {
+        struct ani_global_security_stats uc_stats;
+        struct ani_global_security_stats mc_bc_stats;
+};
+
+struct ani_global_class_c_stats_info {
+        /* This counter shall be incremented for a received A-MSDU frame
+         * with the stations MAC address in the address 1 field or an
+         * A-MSDU frame with a group address in the address 1 field */
+        u32 rx_amsdu_cnt;
+
+        /* This counter shall be incremented when the MAC receives an AMPDU
+         * from the PHY */
+        u32 rx_ampdu_cnt;
+
+        /* This counter shall be incremented when a Frame is transmitted
+         * only on the primary channel */
+        u32 tx_20_frm_cnt;
+
+        /* This counter shall be incremented when a Frame is received only
+         * on the primary channel */
+        u32 rx_20_frm_cnt;
+
+        /* This counter shall be incremented by the number of MPDUs
+         * received in the A-MPDU when an A-MPDU is received */
+        u32 rx_mpdu_in_ampdu_cnt;
+
+        /* This counter shall be incremented when an MPDU delimiter has a
+         * CRC error when this is the first CRC error in the received AMPDU
+         * or when the previous delimiter has been decoded correctly */
+        u32 ampdu_delimiter_crc_err;
+};
+
+struct ani_per_sta_stats_info {
+        /* The number of MPDU frames that the 802.11 station transmitted
+         * and acknowledged through a received 802.11 ACK frame */
+        u32 tx_frag_cnt[4];
+
+        /* This counter shall be incremented when an A-MPDU is transmitted */
+        u32 tx_ampdu_cnt;
+
+        /* This counter shall increment by the number of MPDUs in the AMPDU
+         * when an A-MPDU is transmitted */
+        u32 tx_mpdu_in_ampdu_cnt;
+};
+
+struct wcn36xx_hal_stats_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Success or Failure */
+        u32 status;
+
+        /* STA Idx */
+        u32 sta_index;
+
+        /* Categories of STATS being returned as per eHalStatsMask */
+        u32 stats_mask;
+
+        /* message type is same as the request type */
+        u16 msg_type;
+
+        /* length of the entire request, includes the pStatsBuf length too */
+        u16 msg_len;
+};
+
+struct wcn36xx_hal_set_link_state_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 bssid[ETH_ALEN];
+        enum wcn36xx_hal_link_state state;
+        u8 self_mac_addr[ETH_ALEN];
+
+} __packed;
+
+struct set_link_state_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+/* TSPEC Params */
+struct wcn36xx_hal_ts_info_tfc {
+#ifndef ANI_LITTLE_BIT_ENDIAN
+        u16 ackPolicy:2;
+        u16 userPrio:3;
+        u16 psb:1;
+        u16 aggregation:1;
+        u16 accessPolicy:2;
+        u16 direction:2;
+        u16 tsid:4;
+        u16 trafficType:1;
+#else
+        u16 trafficType:1;
+        u16 tsid:4;
+        u16 direction:2;
+        u16 accessPolicy:2;
+        u16 aggregation:1;
+        u16 psb:1;
+        u16 userPrio:3;
+        u16 ackPolicy:2;
+#endif
+};
+
+/* Flag to schedule the traffic type */
+struct wcn36xx_hal_ts_info_sch {
+#ifndef ANI_LITTLE_BIT_ENDIAN
+        u8 rsvd:7;
+        u8 schedule:1;
+#else
+        u8 schedule:1;
+        u8 rsvd:7;
+#endif
+};
+
+/* Traffic and scheduling info */
+struct wcn36xx_hal_ts_info {
+        struct wcn36xx_hal_ts_info_tfc traffic;
+        struct wcn36xx_hal_ts_info_sch schedule;
+};
+
+/* Information elements */
+struct wcn36xx_hal_tspec_ie {
+        u8 type;
+        u8 length;
+        struct wcn36xx_hal_ts_info ts_info;
+        u16 nom_msdu_size;
+        u16 max_msdu_size;
+        u32 min_svc_interval;
+        u32 max_svc_interval;
+        u32 inact_interval;
+        u32 suspend_interval;
+        u32 svc_start_time;
+        u32 min_data_rate;
+        u32 mean_data_rate;
+        u32 peak_data_rate;
+        u32 max_burst_sz;
+        u32 delay_bound;
+        u32 min_phy_rate;
+        u16 surplus_bw;
+        u16 medium_time;
+};
+
+struct add_ts_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Station Index */
+        u16 sta_index;
+
+        /* TSPEC handler uniquely identifying a TSPEC for a STA in a BSS */
+        u16 tspec_index;
+
+        /* To program TPE with required parameters */
+        struct wcn36xx_hal_tspec_ie tspec;
+
+        /* U-APSD Flags: 1b per AC.  Encoded as follows:
+           b7 b6 b5 b4 b3 b2 b1 b0 =
+           X  X  X  X  BE BK VI VO */
+        u8 uapsd;
+
+        /* These parameters are for all the access categories */
+
+        /* Service Interval */
+        u32 service_interval[WCN36XX_HAL_MAX_AC];
+
+        /* Suspend Interval */
+        u32 suspend_interval[WCN36XX_HAL_MAX_AC];
+
+        /* Delay Interval */
+        u32 delay_interval[WCN36XX_HAL_MAX_AC];
+};
+
+struct add_rs_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct del_ts_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Station Index */
+        u16 sta_index;
+
+        /* TSPEC identifier uniquely identifying a TSPEC for a STA in a BSS */
+        u16 tspec_index;
+
+        /* To lookup station id using the mac address */
+        u8 bssid[ETH_ALEN];
+};
+
+struct del_ts_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+/* End of TSpec Parameters */
+
+/* Start of BLOCK ACK related Parameters */
+
+struct wcn36xx_hal_add_ba_session_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Station Index */
+        u16 sta_index;
+
+        /* Peer MAC Address */
+        u8 mac_addr[ETH_ALEN];
+
+        /* ADDBA Action Frame dialog token
+           HAL will not interpret this object */
+        u8 dialog_token;
+
+        /* TID for which the BA is being setup
+           This identifies the TC or TS of interest */
+        u8 tid;
+
+        /* 0 - Delayed BA (Not supported)
+           1 - Immediate BA */
+        u8 policy;
+
+        /* Indicates the number of buffers for this TID (baTID)
+           NOTE - This is the requested buffer size. When this
+           is processed by HAL and subsequently by HDD, it is
+           possible that HDD may change this buffer size. Any
+           change in the buffer size should be noted by PE and
+           advertized appropriately in the ADDBA response */
+        u16 buffer_size;
+
+        /* BA timeout in TU's 0 means no timeout will occur */
+        u16 timeout;
+
+        /* b0..b3 - Fragment Number - Always set to 0
+           b4..b15 - Starting Sequence Number of first MSDU
+           for which this BA is setup */
+        u16 ssn;
+
+        /* ADDBA direction
+           1 - Originator
+           0 - Recipient */
+        u8 direction;
+} __packed;
+
+struct wcn36xx_hal_add_ba_session_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        /* Dialog token */
+        u8 dialog_token;
+
+        /* TID for which the BA session has been setup */
+        u8 ba_tid;
+
+        /* BA Buffer Size allocated for the current BA session */
+        u8 ba_buffer_size;
+
+        u8 ba_session_id;
+
+        /* Reordering Window buffer */
+        u8 win_size;
+
+        /* Station Index to id the sta */
+        u8 sta_index;
+
+        /* Starting Sequence Number */
+        u16 ssn;
+} __packed;
+
+struct wcn36xx_hal_add_ba_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Session Id */
+        u8 session_id;
+
+        /* Reorder Window Size */
+        u8 win_size;
+/* Old FW 1.2.2.4 does not support this*/
+#ifdef FEATURE_ON_CHIP_REORDERING
+        u8 reordering_done_on_chip;
+#endif
+} __packed;
+
+struct wcn36xx_hal_add_ba_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        /* Dialog token */
+        u8 dialog_token;
+} __packed;
+
+struct add_ba_info {
+        u16 ba_enable:1;
+        u16 starting_seq_num:12;
+        u16 reserved:3;
+};
+
+struct wcn36xx_hal_trigger_ba_rsp_candidate {
+        u8 sta_addr[ETH_ALEN];
+        struct add_ba_info ba_info[STACFG_MAX_TC];
+} __packed;
+
+struct wcn36xx_hal_trigget_ba_req_candidate {
+        u8 sta_index;
+        u8 tid_bitmap;
+} __packed;
+
+struct wcn36xx_hal_trigger_ba_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Session Id */
+        u8 session_id;
+
+        /* baCandidateCnt is followed by trigger BA
+         * Candidate List(tTriggerBaCandidate)
+         */
+        u16 candidate_cnt;
+
+} __packed;
+
+struct wcn36xx_hal_trigger_ba_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* TO SUPPORT BT-AMP */
+        u8 bssid[ETH_ALEN];
+
+        /* success or failure */
+        u32 status;
+
+        /* baCandidateCnt is followed by trigger BA
+         * Rsp Candidate List(tTriggerRspBaCandidate)
+         */
+        u16 candidate_cnt;
+} __packed;
+
+struct wcn36xx_hal_del_ba_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Station Index */
+        u16 sta_index;
+
+        /* TID for which the BA session is being deleted */
+        u8 tid;
+
+        /* DELBA direction
+           1 - Originator
+           0 - Recipient */
+        u8 direction;
+} __packed;
+
+struct wcn36xx_hal_del_ba_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+} __packed;
+
+struct tsm_stats_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Traffic Id */
+        u8 tid;
+
+        u8 bssid[ETH_ALEN];
+};
+
+struct tsm_stats_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /*success or failure */
+        u32 status;
+
+        /* Uplink Packet Queue delay */
+        u16 uplink_pkt_queue_delay;
+
+        /* Uplink Packet Queue delay histogram */
+        u16 uplink_pkt_queue_delay_hist[4];
+
+        /* Uplink Packet Transmit delay */
+        u32 uplink_pkt_tx_delay;
+
+        /* Uplink Packet loss */
+        u16 uplink_pkt_loss;
+
+        /* Uplink Packet count */
+        u16 uplink_pkt_count;
+
+        /* Roaming count */
+        u8 roaming_count;
+
+        /* Roaming Delay */
+        u16 roaming_delay;
+};
+
+struct set_key_done_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /*bssid of the keys */
+        u8 bssidx;
+        u8 enc_type;
+};
+
+struct wcn36xx_hal_nv_img_download_req_msg {
+        /* Note: The length specified in wcn36xx_hal_nv_img_download_req_msg
+         * messages should be
+         * header.len = sizeof(wcn36xx_hal_nv_img_download_req_msg) +
+         * nv_img_buffer_size */
+        struct wcn36xx_hal_msg_header header;
+
+        /* Fragment sequence number of the NV Image. Note that NV Image
+         * might not fit into one message due to size limitation of the SMD
+         * channel FIFO. UMAC can hence choose to chop the NV blob into
+         * multiple fragments starting with seqeunce number 0, 1, 2 etc.
+         * The last fragment MUST be indicated by marking the
+         * isLastFragment field to 1. Note that all the NV blobs would be
+         * concatenated together by HAL without any padding bytes in
+         * between.*/
+        u16 frag_number;
+
+        /* Is this the last fragment? When set to 1 it indicates that no
+         * more fragments will be sent by UMAC and HAL can concatenate all
+         * the NV blobs rcvd & proceed with the parsing. HAL would generate
+         * a WCN36XX_HAL_DOWNLOAD_NV_RSP to the WCN36XX_HAL_DOWNLOAD_NV_REQ
+         * after it receives each fragment */
+        u16 last_fragment;
+
+        /* NV Image size (number of bytes) */
+        u32 nv_img_buffer_size;
+
+        /* Following the 'nv_img_buffer_size', there should be
+         * nv_img_buffer_size bytes of NV Image i.e.
+         * u8[nv_img_buffer_size] */
+} __packed;
+
+struct wcn36xx_hal_nv_img_download_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Success or Failure. HAL would generate a
+         * WCN36XX_HAL_DOWNLOAD_NV_RSP after each fragment */
+        u32 status;
+} __packed;
+
+struct wcn36xx_hal_nv_store_ind {
+        /* Note: The length specified in tHalNvStoreInd messages should be
+         * header.msgLen = sizeof(tHalNvStoreInd) + nvBlobSize */
+        struct wcn36xx_hal_msg_header header;
+
+        /* NV Item */
+        u32 table_id;
+
+        /* Size of NV Blob */
+        u32 nv_blob_size;
+
+        /* Following the 'nvBlobSize', there should be nvBlobSize bytes of
+         * NV blob i.e. u8[nvBlobSize] */
+};
+
+/* End of Block Ack Related Parameters */
+
+#define WCN36XX_HAL_CIPHER_SEQ_CTR_SIZE 6
+
+/* Definition for MIC failure indication MAC reports this each time a MIC
+ * failure occures on Rx TKIP packet
+ */
+struct mic_failure_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 bssid[ETH_ALEN];
+
+        /* address used to compute MIC */
+        u8 src_addr[ETH_ALEN];
+
+        /* transmitter address */
+        u8 ta_addr[ETH_ALEN];
+
+        u8 dst_addr[ETH_ALEN];
+
+        u8 multicast;
+
+        /* first byte of IV */
+        u8 iv1;
+
+        /* second byte of IV */
+        u8 key_id;
+
+        /* sequence number */
+        u8 tsc[WCN36XX_HAL_CIPHER_SEQ_CTR_SIZE];
+
+        /* receive address */
+        u8 rx_addr[ETH_ALEN];
+};
+
+struct update_vht_op_mode_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u16 op_mode;
+        u16 sta_id;
+};
+
+struct update_vht_op_mode_params_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u32 status;
+};
+
+struct update_beacon_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 bss_index;
+
+        /* shortPreamble mode. HAL should update all the STA rates when it
+         * receives this message */
+        u8 short_preamble;
+
+        /* short Slot time. */
+        u8 short_slot_time;
+
+        /* Beacon Interval */
+        u16 beacon_interval;
+
+        /* Protection related */
+        u8 lla_coexist;
+        u8 llb_coexist;
+        u8 llg_coexist;
+        u8 ht20_coexist;
+        u8 lln_non_gf_coexist;
+        u8 lsig_tx_op_protection_full_support;
+        u8 rifs_mode;
+
+        u16 param_change_bitmap;
+};
+
+struct update_beacon_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+        u32 status;
+};
+
+struct wcn36xx_hal_send_beacon_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* length of the template. */
+        u32 beacon_length;
+
+        /* Beacon data. */
+        u8 beacon[BEACON_TEMPLATE_SIZE];
+
+        u8 bssid[ETH_ALEN];
+
+        /* TIM IE offset from the beginning of the template. */
+        u32 tim_ie_offset;
+
+        /* P2P IE offset from the begining of the template */
+        u16 p2p_ie_offset;
+} __packed;
+
+struct send_beacon_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+        u32 status;
+} __packed;
+
+struct enable_radar_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 bssid[ETH_ALEN];
+        u8 channel;
+};
+
+struct enable_radar_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Link Parameters */
+        u8 bssid[ETH_ALEN];
+
+        /* success or failure */
+        u32 status;
+};
+
+struct radar_detect_intr_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 radar_det_channel;
+};
+
+struct radar_detect_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* channel number in which the RADAR detected */
+        u8 channel_number;
+
+        /* RADAR pulse width in usecond */
+        u16 radar_pulse_width;
+
+        /* Number of RADAR pulses */
+        u16 num_radar_pulse;
+};
+
+struct wcn36xx_hal_get_tpc_report_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 sta[ETH_ALEN];
+        u8 dialog_token;
+        u8 txpower;
+};
+
+struct wcn36xx_hal_get_tpc_report_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_send_probe_resp_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 probe_resp_template[BEACON_TEMPLATE_SIZE];
+        u32 probe_resp_template_len;
+        u32 proxy_probe_req_valid_ie_bmap[8];
+        u8 bssid[ETH_ALEN];
+};
+
+struct send_probe_resp_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct send_unknown_frame_rx_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_delete_sta_context_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u16 aid;
+        u16 sta_id;
+
+        /* TO SUPPORT BT-AMP */
+        u8 bssid[ETH_ALEN];
+
+        /* HAL copies bssid from the sta table. */
+        u8 addr2[ETH_ALEN];
+
+        /* To unify the keepalive / unknown A2 / tim-based disa */
+        u16 reason_code;
+} __packed;
+
+struct indicate_del_sta {
+        struct wcn36xx_hal_msg_header header;
+        u8 aid;
+        u8 sta_index;
+        u8 bss_index;
+        u8 reason_code;
+        u32 status;
+};
+
+struct bt_amp_event_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        enum bt_amp_event_type btAmpEventType;
+};
+
+struct bt_amp_event_rsp {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct tl_hal_flush_ac_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Station Index. originates from HAL */
+        u8 sta_id;
+
+        /* TID for which the transmit queue is being flushed */
+        u8 tid;
+};
+
+struct tl_hal_flush_ac_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Station Index. originates from HAL */
+        u8 sta_id;
+
+        /* TID for which the transmit queue is being flushed */
+        u8 tid;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_enter_imps_req_msg {
+        struct wcn36xx_hal_msg_header header;
+};
+
+struct wcn36xx_hal_exit_imps_req {
+        struct wcn36xx_hal_msg_header header;
+};
+
+struct wcn36xx_hal_enter_bmps_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 bss_index;
+
+        /* TBTT value derived from the last beacon */
+#ifndef BUILD_QWPTTSTATIC
+        u64 tbtt;
+#endif
+        u8 dtim_count;
+
+        /* DTIM period given to HAL during association may not be valid, if
+         * association is based on ProbeRsp instead of beacon. */
+        u8 dtim_period;
+
+        /* For CCX and 11R Roaming */
+        u32 rssi_filter_period;
+
+        u32 num_beacon_per_rssi_average;
+        u8 rssi_filter_enable;
+} __packed;
+
+struct wcn36xx_hal_exit_bmps_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 send_data_null;
+        u8 bss_index;
+} __packed;
+
+struct wcn36xx_hal_missed_beacon_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 bss_index;
+} __packed;
+
+/* Beacon Filtering data structures */
+
+/* The above structure would be followed by multiple of below mentioned
+ * structure
+ */
+struct beacon_filter_ie {
+        u8 element_id;
+        u8 check_ie_presence;
+        u8 offset;
+        u8 value;
+        u8 bitmask;
+        u8 ref;
+};
+
+struct wcn36xx_hal_add_bcn_filter_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u16 capability_info;
+        u16 capability_mask;
+        u16 beacon_interval;
+        u16 ie_num;
+        u8 bss_index;
+        u8 reserved;
+};
+
+struct wcn36xx_hal_rem_bcn_filter_req {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 ie_Count;
+        u8 rem_ie_id[1];
+};
+
+#define WCN36XX_HAL_IPV4_ARP_REPLY_OFFLOAD                  0
+#define WCN36XX_HAL_IPV6_NEIGHBOR_DISCOVERY_OFFLOAD         1
+#define WCN36XX_HAL_IPV6_NS_OFFLOAD                         2
+#define WCN36XX_HAL_IPV6_ADDR_LEN                           16
+#define WCN36XX_HAL_OFFLOAD_DISABLE                         0
+#define WCN36XX_HAL_OFFLOAD_ENABLE                          1
+#define WCN36XX_HAL_OFFLOAD_BCAST_FILTER_ENABLE             0x2
+#define WCN36XX_HAL_OFFLOAD_ARP_AND_BCAST_FILTER_ENABLE \
+        (HAL_OFFLOAD_ENABLE|HAL_OFFLOAD_BCAST_FILTER_ENABLE)
+
+struct wcn36xx_hal_ns_offload_params {
+        u8 src_ipv6_addr[WCN36XX_HAL_IPV6_ADDR_LEN];
+        u8 self_ipv6_addr[WCN36XX_HAL_IPV6_ADDR_LEN];
+
+        /* Only support 2 possible Network Advertisement IPv6 address */
+        u8 target_ipv6_addr1[WCN36XX_HAL_IPV6_ADDR_LEN];
+        u8 target_ipv6_addr2[WCN36XX_HAL_IPV6_ADDR_LEN];
+
+        u8 self_addr[ETH_ALEN];
+        u8 src_ipv6_addr_valid:1;
+        u8 target_ipv6_addr1_valid:1;
+        u8 target_ipv6_addr2_valid:1;
+        u8 reserved1:5;
+
+        /* make it DWORD aligned */
+        u8 reserved2;
+
+        /* slot index for this offload */
+        u32 slot_index;
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_host_offload_req {
+        u8 offload_Type;
+
+        /* enable or disable */
+        u8 enable;
+
+        union {
+                u8 host_ipv4_addr[4];
+                u8 host_ipv6_addr[WCN36XX_HAL_IPV6_ADDR_LEN];
+        } u;
+};
+
+struct wcn36xx_hal_host_offload_req_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_host_offload_req host_offload_params;
+        struct wcn36xx_hal_ns_offload_params ns_offload_params;
+};
+
+/* Packet Types. */
+#define WCN36XX_HAL_KEEP_ALIVE_NULL_PKT              1
+#define WCN36XX_HAL_KEEP_ALIVE_UNSOLICIT_ARP_RSP     2
+
+/* Enable or disable keep alive */
+#define WCN36XX_HAL_KEEP_ALIVE_DISABLE   0
+#define WCN36XX_HAL_KEEP_ALIVE_ENABLE    1
+#define WCN36XX_KEEP_ALIVE_TIME_PERIOD   30 /* unit: s */
+
+/* Keep Alive request. */
+struct wcn36xx_hal_keep_alive_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 packet_type;
+        u32 time_period;
+        u8 host_ipv4_addr[WCN36XX_HAL_IPV4_ADDR_LEN];
+        u8 dest_ipv4_addr[WCN36XX_HAL_IPV4_ADDR_LEN];
+        u8 dest_addr[ETH_ALEN];
+        u8 bss_index;
+} __packed;
+
+struct wcn36xx_hal_rssi_threshold_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        s8 threshold1:8;
+        s8 threshold2:8;
+        s8 threshold3:8;
+        u8 thres1_pos_notify:1;
+        u8 thres1_neg_notify:1;
+        u8 thres2_pos_notify:1;
+        u8 thres2_neg_notify:1;
+        u8 thres3_pos_notify:1;
+        u8 thres3_neg_notify:1;
+        u8 reserved10:2;
+};
+
+struct wcn36xx_hal_enter_uapsd_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 bk_delivery:1;
+        u8 be_delivery:1;
+        u8 vi_delivery:1;
+        u8 vo_delivery:1;
+        u8 bk_trigger:1;
+        u8 be_trigger:1;
+        u8 vi_trigger:1;
+        u8 vo_trigger:1;
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_exit_uapsd_req_msg {
+        struct wcn36xx_hal_msg_header header;
+        u8 bss_index;
+};
+
+#define WCN36XX_HAL_WOWL_BCAST_PATTERN_MAX_SIZE 128
+#define WCN36XX_HAL_WOWL_BCAST_MAX_NUM_PATTERNS 16
+
+struct wcn36xx_hal_wowl_add_bcast_ptrn_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Pattern ID */
+        u8 id;
+
+        /* Pattern byte offset from beginning of the 802.11 packet to start
+         * of the wake-up pattern */
+        u8 byte_Offset;
+
+        /* Non-Zero Pattern size */
+        u8 size;
+
+        /* Pattern */
+        u8 pattern[WCN36XX_HAL_WOWL_BCAST_PATTERN_MAX_SIZE];
+
+        /* Non-zero pattern mask size */
+        u8 mask_size;
+
+        /* Pattern mask */
+        u8 mask[WCN36XX_HAL_WOWL_BCAST_PATTERN_MAX_SIZE];
+
+        /* Extra pattern */
+        u8 extra[WCN36XX_HAL_WOWL_BCAST_PATTERN_MAX_SIZE];
+
+        /* Extra pattern mask */
+        u8 mask_extra[WCN36XX_HAL_WOWL_BCAST_PATTERN_MAX_SIZE];
+
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_wow_del_bcast_ptrn_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Pattern ID of the wakeup pattern to be deleted */
+        u8 id;
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_wowl_enter_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Enables/disables magic packet filtering */
+        u8 magic_packet_enable;
+
+        /* Magic pattern */
+        u8 magic_pattern[ETH_ALEN];
+
+        /* Enables/disables packet pattern filtering in firmware. Enabling
+         * this flag enables broadcast pattern matching in Firmware. If
+         * unicast pattern matching is also desired,
+         * ucUcastPatternFilteringEnable flag must be set tot true as well
+         */
+        u8 pattern_filtering_enable;
+
+        /* Enables/disables unicast packet pattern filtering. This flag
+         * specifies whether we want to do pattern match on unicast packets
+         * as well and not just broadcast packets. This flag has no effect
+         * if the ucPatternFilteringEnable (main controlling flag) is set
+         * to false
+         */
+        u8 ucast_pattern_filtering_enable;
+
+        /* This configuration is valid only when magicPktEnable=1. It
+         * requests hardware to wake up when it receives the Channel Switch
+         * Action Frame.
+         */
+        u8 wow_channel_switch_receive;
+
+        /* This configuration is valid only when magicPktEnable=1. It
+         * requests hardware to wake up when it receives the
+         * Deauthentication Frame.
+         */
+        u8 wow_deauth_receive;
+
+        /* This configuration is valid only when magicPktEnable=1. It
+         * requests hardware to wake up when it receives the Disassociation
+         * Frame.
+         */
+        u8 wow_disassoc_receive;
+
+        /* This configuration is valid only when magicPktEnable=1. It
+         * requests hardware to wake up when it has missed consecutive
+         * beacons. This is a hardware register configuration (NOT a
+         * firmware configuration).
+         */
+        u8 wow_max_missed_beacons;
+
+        /* This configuration is valid only when magicPktEnable=1. This is
+         * a timeout value in units of microsec. It requests hardware to
+         * unconditionally wake up after it has stayed in WoWLAN mode for
+         * some time. Set 0 to disable this feature.
+         */
+        u8 wow_max_sleep;
+
+        /* This configuration directs the WoW packet filtering to look for
+         * EAP-ID requests embedded in EAPOL frames and use this as a wake
+         * source.
+         */
+        u8 wow_eap_id_request_enable;
+
+        /* This configuration directs the WoW packet filtering to look for
+         * EAPOL-4WAY requests and use this as a wake source.
+         */
+        u8 wow_eapol_4way_enable;
+
+        /* This configuration allows a host wakeup on an network scan
+         * offload match.
+         */
+        u8 wow_net_scan_offload_match;
+
+        /* This configuration allows a host wakeup on any GTK rekeying
+         * error.
+         */
+        u8 wow_gtk_rekey_error;
+
+        /* This configuration allows a host wakeup on BSS connection loss.
+         */
+        u8 wow_bss_connection_loss;
+
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_wowl_exit_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_get_rssi_req_msg {
+        struct wcn36xx_hal_msg_header header;
+};
+
+struct wcn36xx_hal_get_roam_rssi_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Valid STA Idx for per STA stats request */
+        u32 sta_id;
+};
+
+struct wcn36xx_hal_set_uapsd_ac_params_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* STA index */
+        u8 sta_idx;
+
+        /* Access Category */
+        u8 ac;
+
+        /* User Priority */
+        u8 up;
+
+        /* Service Interval */
+        u32 service_interval;
+
+        /* Suspend Interval */
+        u32 suspend_interval;
+
+        /* Delay Interval */
+        u32 delay_interval;
+};
+
+struct wcn36xx_hal_configure_rxp_filter_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 set_mcst_bcst_filter_setting;
+        u8 set_mcst_bcst_filter;
+};
+
+struct wcn36xx_hal_enter_imps_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_exit_imps_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_enter_bmps_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        u8 bss_index;
+} __packed;
+
+struct wcn36xx_hal_exit_bmps_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        u8 bss_index;
+} __packed;
+
+struct wcn36xx_hal_enter_uapsd_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_exit_uapsd_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_rssi_notification_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u32 rssi_thres1_pos_cross:1;
+        u32 rssi_thres1_neg_cross:1;
+        u32 rssi_thres2_pos_cross:1;
+        u32 rssi_thres2_neg_cross:1;
+        u32 rssi_thres3_pos_cross:1;
+        u32 rssi_thres3_neg_cross:1;
+        u32 avg_rssi:8;
+        u32 reserved:18;
+
+};
+
+struct wcn36xx_hal_get_rssio_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+        s8 rssi;
+
+};
+
+struct wcn36xx_hal_get_roam_rssi_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        u8 sta_id;
+        s8 rssi;
+};
+
+struct wcn36xx_hal_wowl_enter_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_wowl_exit_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_add_bcn_filter_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_rem_bcn_filter_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_add_wowl_bcast_ptrn_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_del_wowl_bcast_ptrn_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_host_offload_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_keep_alive_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_set_rssi_thresh_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_set_uapsd_ac_params_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_configure_rxp_filter_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct set_max_tx_pwr_req {
+        struct wcn36xx_hal_msg_header header;
+
+        /* BSSID is needed to identify which session issued this request.
+         * As the request has power constraints, this should be applied
+         * only to that session */
+        u8 bssid[ETH_ALEN];
+
+        u8 self_addr[ETH_ALEN];
+
+        /* In request, power == MaxTx power to be used. */
+        u8 power;
+};
+
+struct set_max_tx_pwr_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* power == tx power used for management frames */
+        u8 power;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct set_tx_pwr_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* TX Power in milli watts */
+        u32 tx_power;
+
+        u8 bss_index;
+};
+
+struct set_tx_pwr_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct get_tx_pwr_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 sta_id;
+};
+
+struct get_tx_pwr_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        /* TX Power in milli watts */
+        u32 tx_power;
+};
+
+struct set_p2p_gonoa_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 opp_ps;
+        u32 ct_window;
+        u8 count;
+        u32 duration;
+        u32 interval;
+        u32 single_noa_duration;
+        u8 ps_selection;
+};
+
+struct set_p2p_gonoa_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_add_sta_self_req {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 self_addr[ETH_ALEN];
+        u32 status;
+} __packed;
+
+struct wcn36xx_hal_add_sta_self_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        /* Self STA Index */
+        u8 self_sta_index;
+
+        /* DPU Index (IGTK, PTK, GTK all same) */
+        u8 dpu_index;
+
+        /* DPU Signature */
+        u8 dpu_signature;
+} __packed;
+
+struct wcn36xx_hal_del_sta_self_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 self_addr[ETH_ALEN];
+} __packed;
+
+struct wcn36xx_hal_del_sta_self_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /*success or failure */
+        u32 status;
+
+        u8 self_addr[ETH_ALEN];
+} __packed;
+
+struct aggr_add_ts_req {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Station Index */
+        u16 sta_idx;
+
+        /* TSPEC handler uniquely identifying a TSPEC for a STA in a BSS.
+         * This will carry the bitmap with the bit positions representing
+         * different AC.s */
+        u16 tspec_index;
+
+        /* Tspec info per AC To program TPE with required parameters */
+        struct wcn36xx_hal_tspec_ie tspec[WCN36XX_HAL_MAX_AC];
+
+        /* U-APSD Flags: 1b per AC.  Encoded as follows:
+           b7 b6 b5 b4 b3 b2 b1 b0 =
+           X  X  X  X  BE BK VI VO */
+        u8 uapsd;
+
+        /* These parameters are for all the access categories */
+
+        /* Service Interval */
+        u32 service_interval[WCN36XX_HAL_MAX_AC];
+
+        /* Suspend Interval */
+        u32 suspend_interval[WCN36XX_HAL_MAX_AC];
+
+        /* Delay Interval */
+        u32 delay_interval[WCN36XX_HAL_MAX_AC];
+};
+
+struct aggr_add_ts_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status0;
+
+        /* FIXME PRIMA for future use for 11R */
+        u32 status1;
+};
+
+struct wcn36xx_hal_configure_apps_cpu_wakeup_state_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 is_apps_cpu_awake;
+};
+
+struct wcn36xx_hal_configure_apps_cpu_wakeup_state_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_dump_cmd_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u32 arg1;
+        u32 arg2;
+        u32 arg3;
+        u32 arg4;
+        u32 arg5;
+} __packed;
+
+struct wcn36xx_hal_dump_cmd_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        /* Length of the responce message */
+        u32 rsp_length;
+
+        /* FIXME: Currently considering the the responce will be less than
+         * 100bytes */
+        u8 rsp_buffer[DUMPCMD_RSP_BUFFER];
+} __packed;
+
+#define WLAN_COEX_IND_DATA_SIZE (4)
+#define WLAN_COEX_IND_TYPE_DISABLE_HB_MONITOR (0)
+#define WLAN_COEX_IND_TYPE_ENABLE_HB_MONITOR (1)
+
+struct coex_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Coex Indication Type */
+        u32 type;
+
+        /* Coex Indication Data */
+        u32 data[WLAN_COEX_IND_DATA_SIZE];
+};
+
+struct wcn36xx_hal_tx_compl_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Tx Complete Indication Success or Failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_wlan_host_suspend_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u32 configured_mcst_bcst_filter_setting;
+        u32 active_session_count;
+};
+
+struct wcn36xx_hal_wlan_exclude_unencrpted_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 dot11_exclude_unencrypted;
+        u8 bssid[ETH_ALEN];
+};
+
+struct noa_attr_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 index;
+        u8 opp_ps_flag;
+        u16 ctwin;
+
+        u16 noa1_interval_count;
+        u16 bss_index;
+        u32 noa1_duration;
+        u32 noa1_interval;
+        u32 noa1_starttime;
+
+        u16 noa2_interval_count;
+        u16 reserved2;
+        u32 noa2_duration;
+        u32 noa2_interval;
+        u32 noa2_start_time;
+
+        u32 status;
+};
+
+struct noa_start_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u32 status;
+        u32 bss_index;
+};
+
+struct wcn36xx_hal_wlan_host_resume_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 configured_mcst_bcst_filter_setting;
+};
+
+struct wcn36xx_hal_host_resume_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_del_ba_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u16 sta_idx;
+
+        /* Peer MAC Address, whose BA session has timed out */
+        u8 peer_addr[ETH_ALEN];
+
+        /* TID for which a BA session timeout is being triggered */
+        u8 ba_tid;
+
+        /* DELBA direction
+         * 1 - Originator
+         * 0 - Recipient
+         */
+        u8 direction;
+
+        u32 reason_code;
+
+        /* TO SUPPORT BT-AMP */
+        u8 bssid[ETH_ALEN];
+};
+
+/* PNO Messages */
+
+/* Max number of channels that a network can be found on */
+#define WCN36XX_HAL_PNO_MAX_NETW_CHANNELS  26
+
+/* Max number of channels that a network can be found on */
+#define WCN36XX_HAL_PNO_MAX_NETW_CHANNELS_EX  60
+
+/* Maximum numbers of networks supported by PNO */
+#define WCN36XX_HAL_PNO_MAX_SUPP_NETWORKS  16
+
+/* The number of scan time intervals that can be programmed into PNO */
+#define WCN36XX_HAL_PNO_MAX_SCAN_TIMERS    10
+
+/* Maximum size of the probe template */
+#define WCN36XX_HAL_PNO_MAX_PROBE_SIZE     450
+
+/* Type of PNO enabling:
+ *
+ * Immediate - scanning will start immediately and PNO procedure will be
+ * repeated based on timer
+ *
+ * Suspend - scanning will start at suspend
+ *
+ * Resume - scanning will start on system resume
+ */
+enum pno_mode {
+        PNO_MODE_IMMEDIATE,
+        PNO_MODE_ON_SUSPEND,
+        PNO_MODE_ON_RESUME,
+        PNO_MODE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+/* Authentication type */
+enum auth_type {
+        AUTH_TYPE_ANY = 0,
+        AUTH_TYPE_OPEN_SYSTEM = 1,
+
+        /* Upper layer authentication types */
+        AUTH_TYPE_WPA = 2,
+        AUTH_TYPE_WPA_PSK = 3,
+
+        AUTH_TYPE_RSN = 4,
+        AUTH_TYPE_RSN_PSK = 5,
+        AUTH_TYPE_FT_RSN = 6,
+        AUTH_TYPE_FT_RSN_PSK = 7,
+        AUTH_TYPE_WAPI_WAI_CERTIFICATE = 8,
+        AUTH_TYPE_WAPI_WAI_PSK = 9,
+
+        AUTH_TYPE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+/* Encryption type */
+enum ed_type {
+        ED_ANY = 0,
+        ED_NONE = 1,
+        ED_WEP = 2,
+        ED_TKIP = 3,
+        ED_CCMP = 4,
+        ED_WPI = 5,
+
+        ED_TYPE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+/* SSID broadcast  type */
+enum ssid_bcast_type {
+        BCAST_UNKNOWN = 0,
+        BCAST_NORMAL = 1,
+        BCAST_HIDDEN = 2,
+
+        BCAST_TYPE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+/* The network description for which PNO will have to look for */
+struct network_type {
+        /* SSID of the BSS */
+        struct wcn36xx_hal_mac_ssid ssid;
+
+        /* Authentication type for the network */
+        enum auth_type authentication;
+
+        /* Encryption type for the network */
+        enum ed_type encryption;
+
+        /* Indicate the channel on which the Network can be found 0 - if
+         * all channels */
+        u8 channel_count;
+        u8 channels[WCN36XX_HAL_PNO_MAX_NETW_CHANNELS];
+
+        /* Indicates the RSSI threshold for the network to be considered */
+        u8 rssi_threshold;
+};
+
+struct scan_timer {
+        /* How much it should wait */
+        u32 value;
+
+        /* How many times it should repeat that wait value 0 - keep using
+         * this timer until PNO is disabled */
+        u32 repeat;
+
+        /* e.g: 2 3 4 0 - it will wait 2s between consecutive scans for 3
+         * times - after that it will wait 4s between consecutive scans
+         * until disabled */
+};
+
+/* The network parameters to be sent to the PNO algorithm */
+struct scan_timers_type {
+        /* set to 0 if you wish for PNO to use its default telescopic timer */
+        u8 count;
+
+        /* A set value represents the amount of time that PNO will wait
+         * between two consecutive scan procedures If the desired is for a
+         * uniform timer that fires always at the exact same interval - one
+         * single value is to be set If there is a desire for a more
+         * complex - telescopic like timer multiple values can be set -
+         * once PNO reaches the end of the array it will continue scanning
+         * at intervals presented by the last value */
+        struct scan_timer values[WCN36XX_HAL_PNO_MAX_SCAN_TIMERS];
+};
+
+/* Preferred network list request */
+struct set_pref_netw_list_req {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Enable PNO */
+        u32 enable;
+
+        /* Immediate,  On Suspend,   On Resume */
+        enum pno_mode mode;
+
+        /* Number of networks sent for PNO */
+        u32 networks_count;
+
+        /* The networks that PNO needs to look for */
+        struct network_type networks[WCN36XX_HAL_PNO_MAX_SUPP_NETWORKS];
+
+        /* The scan timers required for PNO */
+        struct scan_timers_type scan_timers;
+
+        /* Probe template for 2.4GHz band */
+        u16 band_24g_probe_size;
+        u8 band_24g_probe_template[WCN36XX_HAL_PNO_MAX_PROBE_SIZE];
+
+        /* Probe template for 5GHz band */
+        u16 band_5g_probe_size;
+        u8 band_5g_probe_template[WCN36XX_HAL_PNO_MAX_PROBE_SIZE];
+};
+
+/* The network description for which PNO will have to look for */
+struct network_type_new {
+        /* SSID of the BSS */
+        struct wcn36xx_hal_mac_ssid ssid;
+
+        /* Authentication type for the network */
+        enum auth_type authentication;
+
+        /* Encryption type for the network */
+        enum ed_type encryption;
+
+        /* SSID broadcast type, normal, hidden or unknown */
+        enum ssid_bcast_type bcast_network_type;
+
+        /* Indicate the channel on which the Network can be found 0 - if
+         * all channels */
+        u8 channel_count;
+        u8 channels[WCN36XX_HAL_PNO_MAX_NETW_CHANNELS];
+
+        /* Indicates the RSSI threshold for the network to be considered */
+        u8 rssi_threshold;
+};
+
+/* Preferred network list request new */
+struct set_pref_netw_list_req_new {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Enable PNO */
+        u32 enable;
+
+        /* Immediate,  On Suspend,   On Resume */
+        enum pno_mode mode;
+
+        /* Number of networks sent for PNO */
+        u32 networks_count;
+
+        /* The networks that PNO needs to look for */
+        struct network_type_new networks[WCN36XX_HAL_PNO_MAX_SUPP_NETWORKS];
+
+        /* The scan timers required for PNO */
+        struct scan_timers_type scan_timers;
+
+        /* Probe template for 2.4GHz band */
+        u16 band_24g_probe_size;
+        u8 band_24g_probe_template[WCN36XX_HAL_PNO_MAX_PROBE_SIZE];
+
+        /* Probe template for 5GHz band */
+        u16 band_5g_probe_size;
+        u8 band_5g_probe_template[WCN36XX_HAL_PNO_MAX_PROBE_SIZE];
+};
+
+/* Preferred network list response */
+struct set_pref_netw_list_resp {
+        struct wcn36xx_hal_msg_header header;
+
+        /* status of the request - just to indicate that PNO has
+         * acknowledged the request and will start scanning */
+        u32 status;
+};
+
+/* Preferred network found indication */
+struct pref_netw_found_ind {
+
+        struct wcn36xx_hal_msg_header header;
+
+        /* Network that was found with the highest RSSI */
+        struct wcn36xx_hal_mac_ssid ssid;
+
+        /* Indicates the RSSI */
+        u8 rssi;
+};
+
+/* RSSI Filter request */
+struct set_rssi_filter_req {
+        struct wcn36xx_hal_msg_header header;
+
+        /* RSSI Threshold */
+        u8 rssi_threshold;
+};
+
+/* Set RSSI filter resp */
+struct set_rssi_filter_resp {
+        struct wcn36xx_hal_msg_header header;
+
+        /* status of the request */
+        u32 status;
+};
+
+/* Update scan params - sent from host to PNO to be used during PNO
+ * scanningx */
+struct wcn36xx_hal_update_scan_params_req {
+
+        struct wcn36xx_hal_msg_header header;
+
+        /* Host setting for 11d */
+        u8 dot11d_enabled;
+
+        /* Lets PNO know that host has determined the regulatory domain */
+        u8 dot11d_resolved;
+
+        /* Channels on which PNO is allowed to scan */
+        u8 channel_count;
+        u8 channels[WCN36XX_HAL_PNO_MAX_NETW_CHANNELS];
+
+        /* Minimum channel time */
+        u16 active_min_ch_time;
+
+        /* Maximum channel time */
+        u16 active_max_ch_time;
+
+        /* Minimum channel time */
+        u16 passive_min_ch_time;
+
+        /* Maximum channel time */
+        u16 passive_max_ch_time;
+
+        /* Cb State */
+        enum phy_chan_bond_state state;
+} __packed;
+
+/* Update scan params - sent from host to PNO to be used during PNO
+ * scanningx */
+struct update_scan_params_req_ex {
+
+        struct wcn36xx_hal_msg_header header;
+
+        /* Host setting for 11d */
+        u8 dot11d_enabled;
+
+        /* Lets PNO know that host has determined the regulatory domain */
+        u8 dot11d_resolved;
+
+        /* Channels on which PNO is allowed to scan */
+        u8 channel_count;
+        u8 channels[WCN36XX_HAL_PNO_MAX_NETW_CHANNELS_EX];
+
+        /* Minimum channel time */
+        u16 active_min_ch_time;
+
+        /* Maximum channel time */
+        u16 active_max_ch_time;
+
+        /* Minimum channel time */
+        u16 passive_min_ch_time;
+
+        /* Maximum channel time */
+        u16 passive_max_ch_time;
+
+        /* Cb State */
+        enum phy_chan_bond_state state;
+};
+
+/* Update scan params - sent from host to PNO to be used during PNO
+ * scanningx */
+struct wcn36xx_hal_update_scan_params_resp {
+
+        struct wcn36xx_hal_msg_header header;
+
+        /* status of the request */
+        u32 status;
+} __packed;
+
+struct wcn36xx_hal_set_tx_per_tracking_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* 0: disable, 1:enable */
+        u8 tx_per_tracking_enable;
+
+        /* Check period, unit is sec. */
+        u8 tx_per_tracking_period;
+
+        /* (Fail TX packet)/(Total TX packet) ratio, the unit is 10%. */
+        u8 tx_per_tracking_ratio;
+
+        /* A watermark of check number, once the tx packet exceed this
+         * number, we do the check, default is 5 */
+        u32 tx_per_tracking_watermark;
+};
+
+struct wcn36xx_hal_set_tx_per_tracking_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+};
+
+struct tx_per_hit_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+};
+
+/* Packet Filtering Definitions Begin */
+#define    WCN36XX_HAL_PROTOCOL_DATA_LEN                  8
+#define    WCN36XX_HAL_MAX_NUM_MULTICAST_ADDRESS        240
+#define    WCN36XX_HAL_MAX_NUM_FILTERS                   20
+#define    WCN36XX_HAL_MAX_CMP_PER_FILTER                10
+
+enum wcn36xx_hal_receive_packet_filter_type {
+        HAL_RCV_FILTER_TYPE_INVALID,
+        HAL_RCV_FILTER_TYPE_FILTER_PKT,
+        HAL_RCV_FILTER_TYPE_BUFFER_PKT,
+        HAL_RCV_FILTER_TYPE_MAX_ENUM_SIZE
+};
+
+enum wcn36xx_hal_rcv_pkt_flt_protocol_type {
+        HAL_FILTER_PROTO_TYPE_INVALID,
+        HAL_FILTER_PROTO_TYPE_MAC,
+        HAL_FILTER_PROTO_TYPE_ARP,
+        HAL_FILTER_PROTO_TYPE_IPV4,
+        HAL_FILTER_PROTO_TYPE_IPV6,
+        HAL_FILTER_PROTO_TYPE_UDP,
+        HAL_FILTER_PROTO_TYPE_MAX
+};
+
+enum wcn36xx_hal_rcv_pkt_flt_cmp_flag_type {
+        HAL_FILTER_CMP_TYPE_INVALID,
+        HAL_FILTER_CMP_TYPE_EQUAL,
+        HAL_FILTER_CMP_TYPE_MASK_EQUAL,
+        HAL_FILTER_CMP_TYPE_NOT_EQUAL,
+        HAL_FILTER_CMP_TYPE_MAX
+};
+
+struct wcn36xx_hal_rcv_pkt_filter_params {
+        u8 protocol_layer;
+        u8 cmp_flag;
+
+        /* Length of the data to compare */
+        u16 data_length;
+
+        /* from start of the respective frame header */
+        u8 data_offset;
+
+        /* Reserved field */
+        u8 reserved;
+
+        /* Data to compare */
+        u8 compare_data[WCN36XX_HAL_PROTOCOL_DATA_LEN];
+
+        /* Mask to be applied on the received packet data before compare */
+        u8 data_mask[WCN36XX_HAL_PROTOCOL_DATA_LEN];
+};
+
+struct wcn36xx_hal_sessionized_rcv_pkt_filter_cfg_type {
+        u8 id;
+        u8 type;
+        u8 params_count;
+        u32 coleasce_time;
+        u8 bss_index;
+        struct wcn36xx_hal_rcv_pkt_filter_params params[1];
+};
+
+struct wcn36xx_hal_set_rcv_pkt_filter_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 id;
+        u8 type;
+        u8 params_count;
+        u32 coalesce_time;
+        struct wcn36xx_hal_rcv_pkt_filter_params params[1];
+};
+
+struct wcn36xx_hal_rcv_flt_mc_addr_list_type {
+        /* from start of the respective frame header */
+        u8 data_offset;
+
+        u32 mc_addr_count;
+        u8 mc_addr[ETH_ALEN][WCN36XX_HAL_MAX_NUM_MULTICAST_ADDRESS];
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_set_pkt_filter_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_rcv_flt_pkt_match_cnt_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_rcv_flt_pkt_match_cnt {
+        u8 id;
+        u32 match_cnt;
+};
+
+struct wcn36xx_hal_rcv_flt_pkt_match_cnt_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Success or Failure */
+        u32 status;
+
+        u32 match_count;
+        struct wcn36xx_hal_rcv_flt_pkt_match_cnt
+                matches[WCN36XX_HAL_MAX_NUM_FILTERS];
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_rcv_flt_pkt_clear_param {
+        /* only valid for response message */
+        u32 status;
+        u8 id;
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_rcv_flt_pkt_clear_req_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_rcv_flt_pkt_clear_param param;
+};
+
+struct wcn36xx_hal_rcv_flt_pkt_clear_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_rcv_flt_pkt_clear_param param;
+};
+
+struct wcn36xx_hal_rcv_flt_pkt_set_mc_list_req_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_rcv_flt_mc_addr_list_type mc_addr_list;
+};
+
+struct wcn36xx_hal_rcv_flt_pkt_set_mc_list_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+        u32 status;
+        u8 bss_index;
+};
+
+/* Packet Filtering Definitions End */
+
+struct wcn36xx_hal_set_power_params_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /*  Ignore DTIM */
+        u32 ignore_dtim;
+
+        /* DTIM Period */
+        u32 dtim_period;
+
+        /* Listen Interval */
+        u32 listen_interval;
+
+        /* Broadcast Multicast Filter  */
+        u32 bcast_mcast_filter;
+
+        /* Beacon Early Termination */
+        u32 enable_bet;
+
+        /* Beacon Early Termination Interval */
+        u32 bet_interval;
+} __packed;
+
+struct wcn36xx_hal_set_power_params_resp {
+
+        struct wcn36xx_hal_msg_header header;
+
+        /* status of the request */
+        u32 status;
+} __packed;
+
+/* Capability bitmap exchange definitions and macros starts */
+
+enum place_holder_in_cap_bitmap {
+        MCC = 0,
+        P2P = 1,
+        DOT11AC = 2,
+        SLM_SESSIONIZATION = 3,
+        DOT11AC_OPMODE = 4,
+        SAP32STA = 5,
+        TDLS = 6,
+        P2P_GO_NOA_DECOUPLE_INIT_SCAN = 7,
+        WLANACTIVE_OFFLOAD = 8,
+        BEACON_OFFLOAD = 9,
+        SCAN_OFFLOAD = 10,
+        ROAM_OFFLOAD = 11,
+        BCN_MISS_OFFLOAD = 12,
+        STA_POWERSAVE = 13,
+        STA_ADVANCED_PWRSAVE = 14,
+        AP_UAPSD = 15,
+        AP_DFS = 16,
+        BLOCKACK = 17,
+        PHY_ERR = 18,
+        BCN_FILTER = 19,
+        RTT = 20,
+        RATECTRL = 21,
+        WOW = 22,
+        MAX_FEATURE_SUPPORTED = 128,
+};
+
+struct wcn36xx_hal_feat_caps_msg {
+
+        struct wcn36xx_hal_msg_header header;
+
+        u32 feat_caps[4];
+} __packed;
+
+/* status codes to help debug rekey failures */
+enum gtk_rekey_status {
+        WCN36XX_HAL_GTK_REKEY_STATUS_SUCCESS = 0,
+
+        /* rekey detected, but not handled */
+        WCN36XX_HAL_GTK_REKEY_STATUS_NOT_HANDLED = 1,
+
+        /* MIC check error on M1 */
+        WCN36XX_HAL_GTK_REKEY_STATUS_MIC_ERROR = 2,
+
+        /* decryption error on M1  */
+        WCN36XX_HAL_GTK_REKEY_STATUS_DECRYPT_ERROR = 3,
+
+        /* M1 replay detected */
+        WCN36XX_HAL_GTK_REKEY_STATUS_REPLAY_ERROR = 4,
+
+        /* missing GTK key descriptor in M1 */
+        WCN36XX_HAL_GTK_REKEY_STATUS_MISSING_KDE = 5,
+
+        /* missing iGTK key descriptor in M1 */
+        WCN36XX_HAL_GTK_REKEY_STATUS_MISSING_IGTK_KDE = 6,
+
+        /* key installation error */
+        WCN36XX_HAL_GTK_REKEY_STATUS_INSTALL_ERROR = 7,
+
+        /* iGTK key installation error */
+        WCN36XX_HAL_GTK_REKEY_STATUS_IGTK_INSTALL_ERROR = 8,
+
+        /* GTK rekey M2 response TX error */
+        WCN36XX_HAL_GTK_REKEY_STATUS_RESP_TX_ERROR = 9,
+
+        /* non-specific general error */
+        WCN36XX_HAL_GTK_REKEY_STATUS_GEN_ERROR = 255
+};
+
+/* wake reason types */
+enum wake_reason_type {
+        WCN36XX_HAL_WAKE_REASON_NONE = 0,
+
+        /* magic packet match */
+        WCN36XX_HAL_WAKE_REASON_MAGIC_PACKET = 1,
+
+        /* host defined pattern match */
+        WCN36XX_HAL_WAKE_REASON_PATTERN_MATCH = 2,
+
+        /* EAP-ID frame detected */
+        WCN36XX_HAL_WAKE_REASON_EAPID_PACKET = 3,
+
+        /* start of EAPOL 4-way handshake detected */
+        WCN36XX_HAL_WAKE_REASON_EAPOL4WAY_PACKET = 4,
+
+        /* network scan offload match */
+        WCN36XX_HAL_WAKE_REASON_NETSCAN_OFFL_MATCH = 5,
+
+        /* GTK rekey status wakeup (see status) */
+        WCN36XX_HAL_WAKE_REASON_GTK_REKEY_STATUS = 6,
+
+        /* BSS connection lost */
+        WCN36XX_HAL_WAKE_REASON_BSS_CONN_LOST = 7,
+};
+
+/*
+  Wake Packet which is saved at tWakeReasonParams.DataStart
+  This data is sent for any wake reasons that involve a packet-based wakeup :
+
+  WCN36XX_HAL_WAKE_REASON_TYPE_MAGIC_PACKET
+  WCN36XX_HAL_WAKE_REASON_TYPE_PATTERN_MATCH
+  WCN36XX_HAL_WAKE_REASON_TYPE_EAPID_PACKET
+  WCN36XX_HAL_WAKE_REASON_TYPE_EAPOL4WAY_PACKET
+  WCN36XX_HAL_WAKE_REASON_TYPE_GTK_REKEY_STATUS
+
+  The information is provided to the host for auditing and debug purposes
+
+*/
+
+/* Wake reason indication */
+struct wcn36xx_hal_wake_reason_ind {
+        struct wcn36xx_hal_msg_header header;
+
+        /* see tWakeReasonType */
+        u32 reason;
+
+        /* argument specific to the reason type */
+        u32 reason_arg;
+
+        /* length of optional data stored in this message, in case HAL
+         * truncates the data (i.e. data packets) this length will be less
+         * than the actual length */
+        u32 stored_data_len;
+
+        /* actual length of data */
+        u32 actual_data_len;
+
+        /* variable length start of data (length == storedDataLen) see
+         * specific wake type */
+        u8 data_start[1];
+
+        u32 bss_index:8;
+        u32 reserved:24;
+};
+
+#define WCN36XX_HAL_GTK_KEK_BYTES 16
+#define WCN36XX_HAL_GTK_KCK_BYTES 16
+
+#define WCN36XX_HAL_GTK_OFFLOAD_FLAGS_DISABLE (1 << 0)
+
+#define GTK_SET_BSS_KEY_TAG  0x1234AA55
+
+struct wcn36xx_hal_gtk_offload_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* optional flags */
+        u32 flags;
+
+        /* Key confirmation key */
+        u8 kck[WCN36XX_HAL_GTK_KCK_BYTES];
+
+        /* key encryption key */
+        u8 kek[WCN36XX_HAL_GTK_KEK_BYTES];
+
+        /* replay counter */
+        u64 key_replay_counter;
+
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_gtk_offload_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_gtk_offload_get_info_req_msg {
+        struct wcn36xx_hal_msg_header header;
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_gtk_offload_get_info_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        /* last rekey status when the rekey was offloaded */
+        u32 last_rekey_status;
+
+        /* current replay counter value */
+        u64 key_replay_counter;
+
+        /* total rekey attempts */
+        u32 total_rekey_count;
+
+        /* successful GTK rekeys */
+        u32 gtk_rekey_count;
+
+        /* successful iGTK rekeys */
+        u32 igtk_rekey_count;
+
+        u8 bss_index;
+};
+
+struct dhcp_info {
+        /* Indicates the device mode which indicates about the DHCP activity */
+        u8 device_mode;
+
+        u8 addr[ETH_ALEN];
+};
+
+struct dhcp_ind_status {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+/*
+ *   Thermal Mitigation mode of operation.
+ *
+ *  WCN36XX_HAL_THERMAL_MITIGATION_MODE_0 - Based on AMPDU disabling aggregation
+ *
+ *  WCN36XX_HAL_THERMAL_MITIGATION_MODE_1 - Based on AMPDU disabling aggregation
+ *  and reducing transmit power
+ *
+ *  WCN36XX_HAL_THERMAL_MITIGATION_MODE_2 - Not supported */
+enum wcn36xx_hal_thermal_mitigation_mode_type {
+        HAL_THERMAL_MITIGATION_MODE_INVALID = -1,
+        HAL_THERMAL_MITIGATION_MODE_0,
+        HAL_THERMAL_MITIGATION_MODE_1,
+        HAL_THERMAL_MITIGATION_MODE_2,
+        HAL_THERMAL_MITIGATION_MODE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE,
+};
+
+
+/*
+ *   Thermal Mitigation level.
+ * Note the levels are incremental i.e WCN36XX_HAL_THERMAL_MITIGATION_LEVEL_2 =
+ * WCN36XX_HAL_THERMAL_MITIGATION_LEVEL_0 +
+ * WCN36XX_HAL_THERMAL_MITIGATION_LEVEL_1
+ *
+ * WCN36XX_HAL_THERMAL_MITIGATION_LEVEL_0 - lowest level of thermal mitigation.
+ * This level indicates normal mode of operation
+ *
+ * WCN36XX_HAL_THERMAL_MITIGATION_LEVEL_1 - 1st level of thermal mitigation
+ *
+ * WCN36XX_HAL_THERMAL_MITIGATION_LEVEL_2 - 2nd level of thermal mitigation
+ *
+ * WCN36XX_HAL_THERMAL_MITIGATION_LEVEL_3 - 3rd level of thermal mitigation
+ *
+ * WCN36XX_HAL_THERMAL_MITIGATION_LEVEL_4 - 4th level of thermal mitigation
+ */
+enum wcn36xx_hal_thermal_mitigation_level_type {
+        HAL_THERMAL_MITIGATION_LEVEL_INVALID = -1,
+        HAL_THERMAL_MITIGATION_LEVEL_0,
+        HAL_THERMAL_MITIGATION_LEVEL_1,
+        HAL_THERMAL_MITIGATION_LEVEL_2,
+        HAL_THERMAL_MITIGATION_LEVEL_3,
+        HAL_THERMAL_MITIGATION_LEVEL_4,
+        HAL_THERMAL_MITIGATION_LEVEL_MAX = WCN36XX_HAL_MAX_ENUM_SIZE,
+};
+
+
+/* WCN36XX_HAL_SET_THERMAL_MITIGATION_REQ */
+struct set_thermal_mitigation_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Thermal Mitigation Operation Mode */
+        enum wcn36xx_hal_thermal_mitigation_mode_type mode;
+
+        /* Thermal Mitigation Level */
+        enum wcn36xx_hal_thermal_mitigation_level_type level;
+};
+
+struct set_thermal_mitigation_resp {
+
+        struct wcn36xx_hal_msg_header header;
+
+        /* status of the request */
+        u32 status;
+};
+
+/* Per STA Class B Statistics. Class B statistics are STA TX/RX stats
+ * provided to FW from Host via periodic messages */
+struct stats_class_b_ind {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Duration over which this stats was collected */
+        u32 duration;
+
+        /* Per STA Stats */
+
+        /* TX stats */
+        u32 tx_bytes_pushed;
+        u32 tx_packets_pushed;
+
+        /* RX stats */
+        u32 rx_bytes_rcvd;
+        u32 rx_packets_rcvd;
+        u32 rx_time_total;
+};
+
+#endif /* _HAL_H_ */
diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
new file mode 100644
index 000000000000..7839b31e4826
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -0,0 +1,1036 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include "wcn36xx.h"
+
+unsigned int wcn36xx_dbg_mask;
+module_param_named(debug_mask, wcn36xx_dbg_mask, uint, 0644);
+MODULE_PARM_DESC(debug_mask, "Debugging mask");
+
+#define CHAN2G(_freq, _idx) { \
+        .band = IEEE80211_BAND_2GHZ, \
+        .center_freq = (_freq), \
+        .hw_value = (_idx), \
+        .max_power = 25, \
+}
+
+#define CHAN5G(_freq, _idx) { \
+        .band = IEEE80211_BAND_5GHZ, \
+        .center_freq = (_freq), \
+        .hw_value = (_idx), \
+        .max_power = 25, \
+}
+
+/* The wcn firmware expects channel values to matching
+ * their mnemonic values. So use these for .hw_value. */
+static struct ieee80211_channel wcn_2ghz_channels[] = {
+        CHAN2G(2412, 1), /* Channel 1 */
+        CHAN2G(2417, 2), /* Channel 2 */
+        CHAN2G(2422, 3), /* Channel 3 */
+        CHAN2G(2427, 4), /* Channel 4 */
+        CHAN2G(2432, 5), /* Channel 5 */
+        CHAN2G(2437, 6), /* Channel 6 */
+        CHAN2G(2442, 7), /* Channel 7 */
+        CHAN2G(2447, 8), /* Channel 8 */
+        CHAN2G(2452, 9), /* Channel 9 */
+        CHAN2G(2457, 10), /* Channel 10 */
+        CHAN2G(2462, 11), /* Channel 11 */
+        CHAN2G(2467, 12), /* Channel 12 */
+        CHAN2G(2472, 13), /* Channel 13 */
+        CHAN2G(2484, 14)  /* Channel 14 */
+
+};
+
+static struct ieee80211_channel wcn_5ghz_channels[] = {
+        CHAN5G(5180, 36),
+        CHAN5G(5200, 40),
+        CHAN5G(5220, 44),
+        CHAN5G(5240, 48),
+        CHAN5G(5260, 52),
+        CHAN5G(5280, 56),
+        CHAN5G(5300, 60),
+        CHAN5G(5320, 64),
+        CHAN5G(5500, 100),
+        CHAN5G(5520, 104),
+        CHAN5G(5540, 108),
+        CHAN5G(5560, 112),
+        CHAN5G(5580, 116),
+        CHAN5G(5600, 120),
+        CHAN5G(5620, 124),
+        CHAN5G(5640, 128),
+        CHAN5G(5660, 132),
+        CHAN5G(5700, 140),
+        CHAN5G(5745, 149),
+        CHAN5G(5765, 153),
+        CHAN5G(5785, 157),
+        CHAN5G(5805, 161),
+        CHAN5G(5825, 165)
+};
+
+#define RATE(_bitrate, _hw_rate, _flags) { \
+        .bitrate        = (_bitrate),                   \
+        .flags          = (_flags),                     \
+        .hw_value       = (_hw_rate),                   \
+        .hw_value_short = (_hw_rate)  \
+}
+
+static struct ieee80211_rate wcn_2ghz_rates[] = {
+        RATE(10, HW_RATE_INDEX_1MBPS, 0),
+        RATE(20, HW_RATE_INDEX_2MBPS, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATE(55, HW_RATE_INDEX_5_5MBPS, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATE(110, HW_RATE_INDEX_11MBPS, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATE(60, HW_RATE_INDEX_6MBPS, 0),
+        RATE(90, HW_RATE_INDEX_9MBPS, 0),
+        RATE(120, HW_RATE_INDEX_12MBPS, 0),
+        RATE(180, HW_RATE_INDEX_18MBPS, 0),
+        RATE(240, HW_RATE_INDEX_24MBPS, 0),
+        RATE(360, HW_RATE_INDEX_36MBPS, 0),
+        RATE(480, HW_RATE_INDEX_48MBPS, 0),
+        RATE(540, HW_RATE_INDEX_54MBPS, 0)
+};
+
+static struct ieee80211_rate wcn_5ghz_rates[] = {
+        RATE(60, HW_RATE_INDEX_6MBPS, 0),
+        RATE(90, HW_RATE_INDEX_9MBPS, 0),
+        RATE(120, HW_RATE_INDEX_12MBPS, 0),
+        RATE(180, HW_RATE_INDEX_18MBPS, 0),
+        RATE(240, HW_RATE_INDEX_24MBPS, 0),
+        RATE(360, HW_RATE_INDEX_36MBPS, 0),
+        RATE(480, HW_RATE_INDEX_48MBPS, 0),
+        RATE(540, HW_RATE_INDEX_54MBPS, 0)
+};
+
+static struct ieee80211_supported_band wcn_band_2ghz = {
+        .channels       = wcn_2ghz_channels,
+        .n_channels     = ARRAY_SIZE(wcn_2ghz_channels),
+        .bitrates       = wcn_2ghz_rates,
+        .n_bitrates     = ARRAY_SIZE(wcn_2ghz_rates),
+        .ht_cap         = {
+                .cap =  IEEE80211_HT_CAP_GRN_FLD |
+                        IEEE80211_HT_CAP_SGI_20 |
+                        IEEE80211_HT_CAP_DSSSCCK40 |
+                        IEEE80211_HT_CAP_LSIG_TXOP_PROT,
+                .ht_supported = true,
+                .ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K,
+                .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16,
+                .mcs = {
+                        .rx_mask = { 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+                        .rx_highest = cpu_to_le16(72),
+                        .tx_params = IEEE80211_HT_MCS_TX_DEFINED,
+                }
+        }
+};
+
+static struct ieee80211_supported_band wcn_band_5ghz = {
+        .channels       = wcn_5ghz_channels,
+        .n_channels     = ARRAY_SIZE(wcn_5ghz_channels),
+        .bitrates       = wcn_5ghz_rates,
+        .n_bitrates     = ARRAY_SIZE(wcn_5ghz_rates),
+        .ht_cap         = {
+                .cap =  IEEE80211_HT_CAP_GRN_FLD |
+                        IEEE80211_HT_CAP_SGI_20 |
+                        IEEE80211_HT_CAP_DSSSCCK40 |
+                        IEEE80211_HT_CAP_LSIG_TXOP_PROT |
+                        IEEE80211_HT_CAP_SGI_40 |
+                        IEEE80211_HT_CAP_SUP_WIDTH_20_40,
+                .ht_supported = true,
+                .ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K,
+                .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16,
+                .mcs = {
+                        .rx_mask = { 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+                        .rx_highest = cpu_to_le16(72),
+                        .tx_params = IEEE80211_HT_MCS_TX_DEFINED,
+                }
+        }
+};
+
+#ifdef CONFIG_PM
+
+static const struct wiphy_wowlan_support wowlan_support = {
+        .flags = WIPHY_WOWLAN_ANY
+};
+
+#endif
+
+static inline u8 get_sta_index(struct ieee80211_vif *vif,
+                               struct wcn36xx_sta *sta_priv)
+{
+        return NL80211_IFTYPE_STATION == vif->type ?
+               sta_priv->bss_sta_index :
+               sta_priv->sta_index;
+}
+
+static int wcn36xx_start(struct ieee80211_hw *hw)
+{
+        struct wcn36xx *wcn = hw->priv;
+        int ret;
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac start\n");
+
+        /* SMD initialization */
+        ret = wcn36xx_smd_open(wcn);
+        if (ret) {
+                wcn36xx_err("Failed to open smd channel: %d\n", ret);
+                goto out_err;
+        }
+
+        /* Allocate memory pools for Mgmt BD headers and Data BD headers */
+        ret = wcn36xx_dxe_allocate_mem_pools(wcn);
+        if (ret) {
+                wcn36xx_err("Failed to alloc DXE mempool: %d\n", ret);
+                goto out_smd_close;
+        }
+
+        ret = wcn36xx_dxe_alloc_ctl_blks(wcn);
+        if (ret) {
+                wcn36xx_err("Failed to alloc DXE ctl blocks: %d\n", ret);
+                goto out_free_dxe_pool;
+        }
+
+        wcn->hal_buf = kmalloc(WCN36XX_HAL_BUF_SIZE, GFP_KERNEL);
+        if (!wcn->hal_buf) {
+                wcn36xx_err("Failed to allocate smd buf\n");
+                ret = -ENOMEM;
+                goto out_free_dxe_ctl;
+        }
+
+        ret = wcn36xx_smd_load_nv(wcn);
+        if (ret) {
+                wcn36xx_err("Failed to push NV to chip\n");
+                goto out_free_smd_buf;
+        }
+
+        ret = wcn36xx_smd_start(wcn);
+        if (ret) {
+                wcn36xx_err("Failed to start chip\n");
+                goto out_free_smd_buf;
+        }
+
+        /* DMA channel initialization */
+        ret = wcn36xx_dxe_init(wcn);
+        if (ret) {
+                wcn36xx_err("DXE init failed\n");
+                goto out_smd_stop;
+        }
+
+        wcn36xx_debugfs_init(wcn);
+
+        if (!wcn36xx_is_fw_version(wcn, 1, 2, 2, 24)) {
+                ret = wcn36xx_smd_feature_caps_exchange(wcn);
+                if (ret)
+                        wcn36xx_warn("Exchange feature caps failed\n");
+        }
+        INIT_LIST_HEAD(&wcn->vif_list);
+        return 0;
+
+out_smd_stop:
+        wcn36xx_smd_stop(wcn);
+out_free_smd_buf:
+        kfree(wcn->hal_buf);
+out_free_dxe_pool:
+        wcn36xx_dxe_free_mem_pools(wcn);
+out_free_dxe_ctl:
+        wcn36xx_dxe_free_ctl_blks(wcn);
+out_smd_close:
+        wcn36xx_smd_close(wcn);
+out_err:
+        return ret;
+}
+
+static void wcn36xx_stop(struct ieee80211_hw *hw)
+{
+        struct wcn36xx *wcn = hw->priv;
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac stop\n");
+
+        wcn36xx_debugfs_exit(wcn);
+        wcn36xx_smd_stop(wcn);
+        wcn36xx_dxe_deinit(wcn);
+        wcn36xx_smd_close(wcn);
+
+        wcn36xx_dxe_free_mem_pools(wcn);
+        wcn36xx_dxe_free_ctl_blks(wcn);
+
+        kfree(wcn->hal_buf);
+}
+
+static int wcn36xx_config(struct ieee80211_hw *hw, u32 changed)
+{
+        struct wcn36xx *wcn = hw->priv;
+        struct ieee80211_vif *vif = NULL;
+        struct wcn36xx_vif *tmp;
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac config changed 0x%08x\n", changed);
+
+        if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
+                int ch = WCN36XX_HW_CHANNEL(wcn);
+                wcn36xx_dbg(WCN36XX_DBG_MAC, "wcn36xx_config channel switch=%d\n",
+                            ch);
+                list_for_each_entry(tmp, &wcn->vif_list, list) {
+                        vif = container_of((void *)tmp,
+                                           struct ieee80211_vif,
+                                           drv_priv);
+                        wcn36xx_smd_switch_channel(wcn, vif, ch);
+                }
+        }
+
+        return 0;
+}
+
+#define WCN36XX_SUPPORTED_FILTERS (0)
+
+static void wcn36xx_configure_filter(struct ieee80211_hw *hw,
+                                     unsigned int changed,
+                                     unsigned int *total, u64 multicast)
+{
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac configure filter\n");
+
+        *total &= WCN36XX_SUPPORTED_FILTERS;
+}
+
+static void wcn36xx_tx(struct ieee80211_hw *hw,
+                       struct ieee80211_tx_control *control,
+                       struct sk_buff *skb)
+{
+        struct wcn36xx *wcn = hw->priv;
+        struct wcn36xx_sta *sta_priv = NULL;
+
+        if (control->sta)
+                sta_priv = (struct wcn36xx_sta *)control->sta->drv_priv;
+
+        if (wcn36xx_start_tx(wcn, sta_priv, skb))
+                ieee80211_free_txskb(wcn->hw, skb);
+}
+
+static int wcn36xx_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+                           struct ieee80211_vif *vif,
+                           struct ieee80211_sta *sta,
+                           struct ieee80211_key_conf *key_conf)
+{
+        struct wcn36xx *wcn = hw->priv;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+        struct wcn36xx_sta *sta_priv = vif_priv->sta;
+        int ret = 0;
+        u8 key[WLAN_MAX_KEY_LEN];
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac80211 set key\n");
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "Key: cmd=0x%x algo:0x%x, id:%d, len:%d flags 0x%x\n",
+                    cmd, key_conf->cipher, key_conf->keyidx,
+                    key_conf->keylen, key_conf->flags);
+        wcn36xx_dbg_dump(WCN36XX_DBG_MAC, "KEY: ",
+                         key_conf->key,
+                         key_conf->keylen);
+
+        switch (key_conf->cipher) {
+        case WLAN_CIPHER_SUITE_WEP40:
+                vif_priv->encrypt_type = WCN36XX_HAL_ED_WEP40;
+                break;
+        case WLAN_CIPHER_SUITE_WEP104:
+                vif_priv->encrypt_type = WCN36XX_HAL_ED_WEP40;
+                break;
+        case WLAN_CIPHER_SUITE_CCMP:
+                vif_priv->encrypt_type = WCN36XX_HAL_ED_CCMP;
+                break;
+        case WLAN_CIPHER_SUITE_TKIP:
+                vif_priv->encrypt_type = WCN36XX_HAL_ED_TKIP;
+                break;
+        default:
+                wcn36xx_err("Unsupported key type 0x%x\n",
+                              key_conf->cipher);
+                ret = -EOPNOTSUPP;
+                goto out;
+        }
+
+        switch (cmd) {
+        case SET_KEY:
+                if (WCN36XX_HAL_ED_TKIP == vif_priv->encrypt_type) {
+                        /*
+                         * Supplicant is sending key in the wrong order:
+                         * Temporal Key (16 b) - TX MIC (8 b) - RX MIC (8 b)
+                         * but HW expects it to be in the order as described in
+                         * IEEE 802.11 spec (see chapter 11.7) like this:
+                         * Temporal Key (16 b) - RX MIC (8 b) - TX MIC (8 b)
+                         */
+                        memcpy(key, key_conf->key, 16);
+                        memcpy(key + 16, key_conf->key + 24, 8);
+                        memcpy(key + 24, key_conf->key + 16, 8);
+                } else {
+                        memcpy(key, key_conf->key, key_conf->keylen);
+                }
+
+                if (IEEE80211_KEY_FLAG_PAIRWISE & key_conf->flags) {
+                        sta_priv->is_data_encrypted = true;
+                        /* Reconfigure bss with encrypt_type */
+                        if (NL80211_IFTYPE_STATION == vif->type)
+                                wcn36xx_smd_config_bss(wcn,
+                                                       vif,
+                                                       sta,
+                                                       sta->addr,
+                                                       true);
+
+                        wcn36xx_smd_set_stakey(wcn,
+                                vif_priv->encrypt_type,
+                                key_conf->keyidx,
+                                key_conf->keylen,
+                                key,
+                                get_sta_index(vif, sta_priv));
+                } else {
+                        wcn36xx_smd_set_bsskey(wcn,
+                                vif_priv->encrypt_type,
+                                key_conf->keyidx,
+                                key_conf->keylen,
+                                key);
+                        if ((WLAN_CIPHER_SUITE_WEP40 == key_conf->cipher) ||
+                            (WLAN_CIPHER_SUITE_WEP104 == key_conf->cipher)) {
+                                sta_priv->is_data_encrypted = true;
+                                wcn36xx_smd_set_stakey(wcn,
+                                        vif_priv->encrypt_type,
+                                        key_conf->keyidx,
+                                        key_conf->keylen,
+                                        key,
+                                        get_sta_index(vif, sta_priv));
+                        }
+                }
+                break;
+        case DISABLE_KEY:
+                if (!(IEEE80211_KEY_FLAG_PAIRWISE & key_conf->flags)) {
+                        wcn36xx_smd_remove_bsskey(wcn,
+                                vif_priv->encrypt_type,
+                                key_conf->keyidx);
+                } else {
+                        sta_priv->is_data_encrypted = false;
+                        /* do not remove key if disassociated */
+                        if (sta_priv->aid)
+                                wcn36xx_smd_remove_stakey(wcn,
+                                        vif_priv->encrypt_type,
+                                        key_conf->keyidx,
+                                        get_sta_index(vif, sta_priv));
+                }
+                break;
+        default:
+                wcn36xx_err("Unsupported key cmd 0x%x\n", cmd);
+                ret = -EOPNOTSUPP;
+                goto out;
+                break;
+        }
+
+out:
+        return ret;
+}
+
+static void wcn36xx_sw_scan_start(struct ieee80211_hw *hw)
+{
+        struct wcn36xx *wcn = hw->priv;
+
+        wcn36xx_smd_init_scan(wcn, HAL_SYS_MODE_SCAN);
+        wcn36xx_smd_start_scan(wcn);
+}
+
+static void wcn36xx_sw_scan_complete(struct ieee80211_hw *hw)
+{
+        struct wcn36xx *wcn = hw->priv;
+
+        wcn36xx_smd_end_scan(wcn);
+        wcn36xx_smd_finish_scan(wcn, HAL_SYS_MODE_SCAN);
+}
+
+static void wcn36xx_update_allowed_rates(struct ieee80211_sta *sta,
+                                         enum ieee80211_band band)
+{
+        int i, size;
+        u16 *rates_table;
+        struct wcn36xx_sta *sta_priv = (struct wcn36xx_sta *)sta->drv_priv;
+        u32 rates = sta->supp_rates[band];
+
+        memset(&sta_priv->supported_rates, 0,
+                sizeof(sta_priv->supported_rates));
+        sta_priv->supported_rates.op_rate_mode = STA_11n;
+
+        size = ARRAY_SIZE(sta_priv->supported_rates.dsss_rates);
+        rates_table = sta_priv->supported_rates.dsss_rates;
+        if (band == IEEE80211_BAND_2GHZ) {
+                for (i = 0; i < size; i++) {
+                        if (rates & 0x01) {
+                                rates_table[i] = wcn_2ghz_rates[i].hw_value;
+                                rates = rates >> 1;
+                        }
+                }
+        }
+
+        size = ARRAY_SIZE(sta_priv->supported_rates.ofdm_rates);
+        rates_table = sta_priv->supported_rates.ofdm_rates;
+        for (i = 0; i < size; i++) {
+                if (rates & 0x01) {
+                        rates_table[i] = wcn_5ghz_rates[i].hw_value;
+                        rates = rates >> 1;
+                }
+        }
+
+        if (sta->ht_cap.ht_supported) {
+                BUILD_BUG_ON(sizeof(sta->ht_cap.mcs.rx_mask) >
+                        sizeof(sta_priv->supported_rates.supported_mcs_set));
+                memcpy(sta_priv->supported_rates.supported_mcs_set,
+                       sta->ht_cap.mcs.rx_mask,
+                       sizeof(sta->ht_cap.mcs.rx_mask));
+        }
+}
+void wcn36xx_set_default_rates(struct wcn36xx_hal_supported_rates *rates)
+{
+        u16 ofdm_rates[WCN36XX_HAL_NUM_OFDM_RATES] = {
+                HW_RATE_INDEX_6MBPS,
+                HW_RATE_INDEX_9MBPS,
+                HW_RATE_INDEX_12MBPS,
+                HW_RATE_INDEX_18MBPS,
+                HW_RATE_INDEX_24MBPS,
+                HW_RATE_INDEX_36MBPS,
+                HW_RATE_INDEX_48MBPS,
+                HW_RATE_INDEX_54MBPS
+        };
+        u16 dsss_rates[WCN36XX_HAL_NUM_DSSS_RATES] = {
+                HW_RATE_INDEX_1MBPS,
+                HW_RATE_INDEX_2MBPS,
+                HW_RATE_INDEX_5_5MBPS,
+                HW_RATE_INDEX_11MBPS
+        };
+
+        rates->op_rate_mode = STA_11n;
+        memcpy(rates->dsss_rates, dsss_rates,
+                sizeof(*dsss_rates) * WCN36XX_HAL_NUM_DSSS_RATES);
+        memcpy(rates->ofdm_rates, ofdm_rates,
+                sizeof(*ofdm_rates) * WCN36XX_HAL_NUM_OFDM_RATES);
+        rates->supported_mcs_set[0] = 0xFF;
+}
+static void wcn36xx_bss_info_changed(struct ieee80211_hw *hw,
+                                     struct ieee80211_vif *vif,
+                                     struct ieee80211_bss_conf *bss_conf,
+                                     u32 changed)
+{
+        struct wcn36xx *wcn = hw->priv;
+        struct sk_buff *skb = NULL;
+        u16 tim_off, tim_len;
+        enum wcn36xx_hal_link_state link_state;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac bss info changed vif %p changed 0x%08x\n",
+                    vif, changed);
+
+        if (changed & BSS_CHANGED_BEACON_INFO) {
+                wcn36xx_dbg(WCN36XX_DBG_MAC,
+                            "mac bss changed dtim period %d\n",
+                            bss_conf->dtim_period);
+
+                vif_priv->dtim_period = bss_conf->dtim_period;
+        }
+
+        if (changed & BSS_CHANGED_PS) {
+                wcn36xx_dbg(WCN36XX_DBG_MAC,
+                            "mac bss PS set %d\n",
+                            bss_conf->ps);
+                if (bss_conf->ps) {
+                        wcn36xx_pmc_enter_bmps_state(wcn, vif);
+                } else {
+                        wcn36xx_pmc_exit_bmps_state(wcn, vif);
+                }
+        }
+
+        if (changed & BSS_CHANGED_BSSID) {
+                wcn36xx_dbg(WCN36XX_DBG_MAC, "mac bss changed_bssid %pM\n",
+                            bss_conf->bssid);
+
+                if (!is_zero_ether_addr(bss_conf->bssid)) {
+                        vif_priv->is_joining = true;
+                        vif_priv->bss_index = 0xff;
+                        wcn36xx_smd_join(wcn, bss_conf->bssid,
+                                         vif->addr, WCN36XX_HW_CHANNEL(wcn));
+                        wcn36xx_smd_config_bss(wcn, vif, NULL,
+                                               bss_conf->bssid, false);
+                } else {
+                        vif_priv->is_joining = false;
+                        wcn36xx_smd_delete_bss(wcn, vif);
+                }
+        }
+
+        if (changed & BSS_CHANGED_SSID) {
+                wcn36xx_dbg(WCN36XX_DBG_MAC,
+                            "mac bss changed ssid\n");
+                wcn36xx_dbg_dump(WCN36XX_DBG_MAC, "ssid ",
+                                 bss_conf->ssid, bss_conf->ssid_len);
+
+                vif_priv->ssid.length = bss_conf->ssid_len;
+                memcpy(&vif_priv->ssid.ssid,
+                       bss_conf->ssid,
+                       bss_conf->ssid_len);
+        }
+
+        if (changed & BSS_CHANGED_ASSOC) {
+                vif_priv->is_joining = false;
+                if (bss_conf->assoc) {
+                        struct ieee80211_sta *sta;
+                        struct wcn36xx_sta *sta_priv;
+
+                        wcn36xx_dbg(WCN36XX_DBG_MAC,
+                                    "mac assoc bss %pM vif %pM AID=%d\n",
+                                     bss_conf->bssid,
+                                     vif->addr,
+                                     bss_conf->aid);
+
+                        rcu_read_lock();
+                        sta = ieee80211_find_sta(vif, bss_conf->bssid);
+                        if (!sta) {
+                                wcn36xx_err("sta %pM is not found\n",
+                                              bss_conf->bssid);
+                                rcu_read_unlock();
+                                goto out;
+                        }
+                        sta_priv = (struct wcn36xx_sta *)sta->drv_priv;
+
+                        wcn36xx_update_allowed_rates(sta, WCN36XX_BAND(wcn));
+
+                        wcn36xx_smd_set_link_st(wcn, bss_conf->bssid,
+                                vif->addr,
+                                WCN36XX_HAL_LINK_POSTASSOC_STATE);
+                        wcn36xx_smd_config_bss(wcn, vif, sta,
+                                               bss_conf->bssid,
+                                               true);
+                        sta_priv->aid = bss_conf->aid;
+                        /*
+                         * config_sta must be called from  because this is the
+                         * place where AID is available.
+                         */
+                        wcn36xx_smd_config_sta(wcn, vif, sta);
+                        rcu_read_unlock();
+                } else {
+                        wcn36xx_dbg(WCN36XX_DBG_MAC,
+                                    "disassociated bss %pM vif %pM AID=%d\n",
+                                    bss_conf->bssid,
+                                    vif->addr,
+                                    bss_conf->aid);
+                        wcn36xx_smd_set_link_st(wcn,
+                                                bss_conf->bssid,
+                                                vif->addr,
+                                                WCN36XX_HAL_LINK_IDLE_STATE);
+                }
+        }
+
+        if (changed & BSS_CHANGED_AP_PROBE_RESP) {
+                wcn36xx_dbg(WCN36XX_DBG_MAC, "mac bss changed ap probe resp\n");
+                skb = ieee80211_proberesp_get(hw, vif);
+                if (!skb) {
+                        wcn36xx_err("failed to alloc probereq skb\n");
+                        goto out;
+                }
+
+                wcn36xx_smd_update_proberesp_tmpl(wcn, vif, skb);
+                dev_kfree_skb(skb);
+        }
+
+        if (changed & BSS_CHANGED_BEACON_ENABLED) {
+                wcn36xx_dbg(WCN36XX_DBG_MAC,
+                            "mac bss changed beacon enabled %d\n",
+                            bss_conf->enable_beacon);
+
+                if (bss_conf->enable_beacon) {
+                        vif_priv->bss_index = 0xff;
+                        wcn36xx_smd_config_bss(wcn, vif, NULL,
+                                               vif->addr, false);
+                        skb = ieee80211_beacon_get_tim(hw, vif, &tim_off,
+                                                       &tim_len);
+                        if (!skb) {
+                                wcn36xx_err("failed to alloc beacon skb\n");
+                                goto out;
+                        }
+                        wcn36xx_smd_send_beacon(wcn, vif, skb, tim_off, 0);
+                        dev_kfree_skb(skb);
+
+                        if (vif->type == NL80211_IFTYPE_ADHOC ||
+                            vif->type == NL80211_IFTYPE_MESH_POINT)
+                                link_state = WCN36XX_HAL_LINK_IBSS_STATE;
+                        else
+                                link_state = WCN36XX_HAL_LINK_AP_STATE;
+
+                        wcn36xx_smd_set_link_st(wcn, vif->addr, vif->addr,
+                                                link_state);
+                } else {
+                        wcn36xx_smd_set_link_st(wcn, vif->addr, vif->addr,
+                                                WCN36XX_HAL_LINK_IDLE_STATE);
+                        wcn36xx_smd_delete_bss(wcn, vif);
+                }
+        }
+out:
+        return;
+}
+
+/* this is required when using IEEE80211_HW_HAS_RATE_CONTROL */
+static int wcn36xx_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
+{
+        struct wcn36xx *wcn = hw->priv;
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac set RTS threshold %d\n", value);
+
+        wcn36xx_smd_update_cfg(wcn, WCN36XX_HAL_CFG_RTS_THRESHOLD, value);
+        return 0;
+}
+
+static void wcn36xx_remove_interface(struct ieee80211_hw *hw,
+                                     struct ieee80211_vif *vif)
+{
+        struct wcn36xx *wcn = hw->priv;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac remove interface vif %p\n", vif);
+
+        list_del(&vif_priv->list);
+        wcn36xx_smd_delete_sta_self(wcn, vif->addr);
+}
+
+static int wcn36xx_add_interface(struct ieee80211_hw *hw,
+                                 struct ieee80211_vif *vif)
+{
+        struct wcn36xx *wcn = hw->priv;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac add interface vif %p type %d\n",
+                    vif, vif->type);
+
+        if (!(NL80211_IFTYPE_STATION == vif->type ||
+              NL80211_IFTYPE_AP == vif->type ||
+              NL80211_IFTYPE_ADHOC == vif->type ||
+              NL80211_IFTYPE_MESH_POINT == vif->type)) {
+                wcn36xx_warn("Unsupported interface type requested: %d\n",
+                             vif->type);
+                return -EOPNOTSUPP;
+        }
+
+        list_add(&vif_priv->list, &wcn->vif_list);
+        wcn36xx_smd_add_sta_self(wcn, vif);
+
+        return 0;
+}
+
+static int wcn36xx_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                           struct ieee80211_sta *sta)
+{
+        struct wcn36xx *wcn = hw->priv;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+        struct wcn36xx_sta *sta_priv = (struct wcn36xx_sta *)sta->drv_priv;
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac sta add vif %p sta %pM\n",
+                    vif, sta->addr);
+
+        vif_priv->sta = sta_priv;
+        sta_priv->vif = vif_priv;
+        /*
+         * For STA mode HW will be configured on BSS_CHANGED_ASSOC because
+         * at this stage AID is not available yet.
+         */
+        if (NL80211_IFTYPE_STATION != vif->type) {
+                wcn36xx_update_allowed_rates(sta, WCN36XX_BAND(wcn));
+                sta_priv->aid = sta->aid;
+                wcn36xx_smd_config_sta(wcn, vif, sta);
+        }
+        return 0;
+}
+
+static int wcn36xx_sta_remove(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif,
+                              struct ieee80211_sta *sta)
+{
+        struct wcn36xx *wcn = hw->priv;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+        struct wcn36xx_sta *sta_priv = (struct wcn36xx_sta *)sta->drv_priv;
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac sta remove vif %p sta %pM index %d\n",
+                    vif, sta->addr, sta_priv->sta_index);
+
+        wcn36xx_smd_delete_sta(wcn, sta_priv->sta_index);
+        vif_priv->sta = NULL;
+        sta_priv->vif = NULL;
+        return 0;
+}
+
+#ifdef CONFIG_PM
+
+static int wcn36xx_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wow)
+{
+        struct wcn36xx *wcn = hw->priv;
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac suspend\n");
+
+        flush_workqueue(wcn->hal_ind_wq);
+        wcn36xx_smd_set_power_params(wcn, true);
+        return 0;
+}
+
+static int wcn36xx_resume(struct ieee80211_hw *hw)
+{
+        struct wcn36xx *wcn = hw->priv;
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac resume\n");
+
+        flush_workqueue(wcn->hal_ind_wq);
+        wcn36xx_smd_set_power_params(wcn, false);
+        return 0;
+}
+
+#endif
+
+static int wcn36xx_ampdu_action(struct ieee80211_hw *hw,
+                    struct ieee80211_vif *vif,
+                    enum ieee80211_ampdu_mlme_action action,
+                    struct ieee80211_sta *sta, u16 tid, u16 *ssn,
+                    u8 buf_size)
+{
+        struct wcn36xx *wcn = hw->priv;
+        struct wcn36xx_sta *sta_priv = NULL;
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac ampdu action action %d tid %d\n",
+                    action, tid);
+
+        sta_priv = (struct wcn36xx_sta *)sta->drv_priv;
+
+        switch (action) {
+        case IEEE80211_AMPDU_RX_START:
+                sta_priv->tid = tid;
+                wcn36xx_smd_add_ba_session(wcn, sta, tid, ssn, 0,
+                        get_sta_index(vif, sta_priv));
+                wcn36xx_smd_add_ba(wcn);
+                wcn36xx_smd_trigger_ba(wcn, get_sta_index(vif, sta_priv));
+                ieee80211_start_tx_ba_session(sta, tid, 0);
+                break;
+        case IEEE80211_AMPDU_RX_STOP:
+                wcn36xx_smd_del_ba(wcn, tid, get_sta_index(vif, sta_priv));
+                break;
+        case IEEE80211_AMPDU_TX_START:
+                ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                break;
+        case IEEE80211_AMPDU_TX_OPERATIONAL:
+                wcn36xx_smd_add_ba_session(wcn, sta, tid, ssn, 1,
+                        get_sta_index(vif, sta_priv));
+                break;
+        case IEEE80211_AMPDU_TX_STOP_FLUSH:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
+        case IEEE80211_AMPDU_TX_STOP_CONT:
+                ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                break;
+        default:
+                wcn36xx_err("Unknown AMPDU action\n");
+        }
+
+        return 0;
+}
+
+static const struct ieee80211_ops wcn36xx_ops = {
+        .start                  = wcn36xx_start,
+        .stop                   = wcn36xx_stop,
+        .add_interface          = wcn36xx_add_interface,
+        .remove_interface       = wcn36xx_remove_interface,
+#ifdef CONFIG_PM
+        .suspend                = wcn36xx_suspend,
+        .resume                 = wcn36xx_resume,
+#endif
+        .config                 = wcn36xx_config,
+        .configure_filter       = wcn36xx_configure_filter,
+        .tx                     = wcn36xx_tx,
+        .set_key                = wcn36xx_set_key,
+        .sw_scan_start          = wcn36xx_sw_scan_start,
+        .sw_scan_complete       = wcn36xx_sw_scan_complete,
+        .bss_info_changed       = wcn36xx_bss_info_changed,
+        .set_rts_threshold      = wcn36xx_set_rts_threshold,
+        .sta_add                = wcn36xx_sta_add,
+        .sta_remove             = wcn36xx_sta_remove,
+        .ampdu_action           = wcn36xx_ampdu_action,
+};
+
+static int wcn36xx_init_ieee80211(struct wcn36xx *wcn)
+{
+        int ret = 0;
+
+        static const u32 cipher_suites[] = {
+                WLAN_CIPHER_SUITE_WEP40,
+                WLAN_CIPHER_SUITE_WEP104,
+                WLAN_CIPHER_SUITE_TKIP,
+                WLAN_CIPHER_SUITE_CCMP,
+        };
+
+        wcn->hw->flags = IEEE80211_HW_SIGNAL_DBM |
+                IEEE80211_HW_HAS_RATE_CONTROL |
+                IEEE80211_HW_SUPPORTS_PS |
+                IEEE80211_HW_CONNECTION_MONITOR |
+                IEEE80211_HW_AMPDU_AGGREGATION |
+                IEEE80211_HW_TIMING_BEACON_ONLY;
+
+        wcn->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
+                BIT(NL80211_IFTYPE_AP) |
+                BIT(NL80211_IFTYPE_ADHOC) |
+                BIT(NL80211_IFTYPE_MESH_POINT);
+
+        wcn->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &wcn_band_2ghz;
+        wcn->hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &wcn_band_5ghz;
+
+        wcn->hw->wiphy->cipher_suites = cipher_suites;
+        wcn->hw->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
+
+        wcn->hw->wiphy->flags |= WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD;
+
+#ifdef CONFIG_PM
+        wcn->hw->wiphy->wowlan = &wowlan_support;
+#endif
+
+        wcn->hw->max_listen_interval = 200;
+
+        wcn->hw->queues = 4;
+
+        SET_IEEE80211_DEV(wcn->hw, wcn->dev);
+
+        wcn->hw->sta_data_size = sizeof(struct wcn36xx_sta);
+        wcn->hw->vif_data_size = sizeof(struct wcn36xx_vif);
+
+        return ret;
+}
+
+static int wcn36xx_platform_get_resources(struct wcn36xx *wcn,
+                                          struct platform_device *pdev)
+{
+        struct resource *res;
+        /* Set TX IRQ */
+        res = platform_get_resource_byname(pdev, IORESOURCE_IRQ,
+                                           "wcnss_wlantx_irq");
+        if (!res) {
+                wcn36xx_err("failed to get tx_irq\n");
+                return -ENOENT;
+        }
+        wcn->tx_irq = res->start;
+
+        /* Set RX IRQ */
+        res = platform_get_resource_byname(pdev, IORESOURCE_IRQ,
+                                           "wcnss_wlanrx_irq");
+        if (!res) {
+                wcn36xx_err("failed to get rx_irq\n");
+                return -ENOENT;
+        }
+        wcn->rx_irq = res->start;
+
+        /* Map the memory */
+        res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
+                                                 "wcnss_mmio");
+        if (!res) {
+                wcn36xx_err("failed to get mmio\n");
+                return -ENOENT;
+        }
+        wcn->mmio = ioremap(res->start, resource_size(res));
+        if (!wcn->mmio) {
+                wcn36xx_err("failed to map io memory\n");
+                return -ENOMEM;
+        }
+        return 0;
+}
+
+static int wcn36xx_probe(struct platform_device *pdev)
+{
+        struct ieee80211_hw *hw;
+        struct wcn36xx *wcn;
+        int ret;
+        u8 addr[ETH_ALEN];
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "platform probe\n");
+
+        hw = ieee80211_alloc_hw(sizeof(struct wcn36xx), &wcn36xx_ops);
+        if (!hw) {
+                wcn36xx_err("failed to alloc hw\n");
+                ret = -ENOMEM;
+                goto out_err;
+        }
+        platform_set_drvdata(pdev, hw);
+        wcn = hw->priv;
+        wcn->hw = hw;
+        wcn->dev = &pdev->dev;
+        wcn->ctrl_ops = pdev->dev.platform_data;
+
+        mutex_init(&wcn->hal_mutex);
+
+        if (!wcn->ctrl_ops->get_hw_mac(addr)) {
+                wcn36xx_info("mac address: %pM\n", addr);
+                SET_IEEE80211_PERM_ADDR(wcn->hw, addr);
+        }
+
+        ret = wcn36xx_platform_get_resources(wcn, pdev);
+        if (ret)
+                goto out_wq;
+
+        wcn36xx_init_ieee80211(wcn);
+        ret = ieee80211_register_hw(wcn->hw);
+        if (ret)
+                goto out_unmap;
+
+        return 0;
+
+out_unmap:
+        iounmap(wcn->mmio);
+out_wq:
+        ieee80211_free_hw(hw);
+out_err:
+        return ret;
+}
+static int wcn36xx_remove(struct platform_device *pdev)
+{
+        struct ieee80211_hw *hw = platform_get_drvdata(pdev);
+        struct wcn36xx *wcn = hw->priv;
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "platform remove\n");
+
+        mutex_destroy(&wcn->hal_mutex);
+
+        ieee80211_unregister_hw(hw);
+        iounmap(wcn->mmio);
+        ieee80211_free_hw(hw);
+
+        return 0;
+}
+static const struct platform_device_id wcn36xx_platform_id_table[] = {
+        {
+                .name = "wcn36xx",
+                .driver_data = 0
+        },
+        {}
+};
+MODULE_DEVICE_TABLE(platform, wcn36xx_platform_id_table);
+
+static struct platform_driver wcn36xx_driver = {
+        .probe      = wcn36xx_probe,
+        .remove     = wcn36xx_remove,
+        .driver         = {
+                .name   = "wcn36xx",
+                .owner  = THIS_MODULE,
+        },
+        .id_table    = wcn36xx_platform_id_table,
+};
+
+static int __init wcn36xx_init(void)
+{
+        platform_driver_register(&wcn36xx_driver);
+        return 0;
+}
+module_init(wcn36xx_init);
+
+static void __exit wcn36xx_exit(void)
+{
+        platform_driver_unregister(&wcn36xx_driver);
+}
+module_exit(wcn36xx_exit);
+
+MODULE_LICENSE("Dual BSD/GPL");
+MODULE_AUTHOR("Eugene Krasnikov k.eugene.e@gmail.com");
+MODULE_FIRMWARE(WLAN_NV_FILE);
diff --git a/drivers/net/wireless/ath/wcn36xx/pmc.c b/drivers/net/wireless/ath/wcn36xx/pmc.c
new file mode 100644
index 000000000000..28b515c81b0e
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/pmc.c
@@ -0,0 +1,62 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include "wcn36xx.h"
+
+int wcn36xx_pmc_enter_bmps_state(struct wcn36xx *wcn,
+                                 struct ieee80211_vif *vif)
+{
+        int ret = 0;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+        /* TODO: Make sure the TX chain clean */
+        ret = wcn36xx_smd_enter_bmps(wcn, vif);
+        if (!ret) {
+                wcn36xx_dbg(WCN36XX_DBG_PMC, "Entered BMPS\n");
+                vif_priv->pw_state = WCN36XX_BMPS;
+        } else {
+                /*
+                 * One of the reasons why HW will not enter BMPS is because
+                 * driver is trying to enter bmps before first beacon was
+                 * received just after auth complete
+                 */
+                wcn36xx_err("Can not enter BMPS!\n");
+        }
+        return ret;
+}
+
+int wcn36xx_pmc_exit_bmps_state(struct wcn36xx *wcn,
+                                struct ieee80211_vif *vif)
+{
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+
+        if (WCN36XX_BMPS != vif_priv->pw_state) {
+                wcn36xx_err("Not in BMPS mode, no need to exit from BMPS mode!\n");
+                return -EINVAL;
+        }
+        wcn36xx_smd_exit_bmps(wcn, vif);
+        vif_priv->pw_state = WCN36XX_FULL_POWER;
+        return 0;
+}
+
+int wcn36xx_enable_keep_alive_null_packet(struct wcn36xx *wcn,
+                                          struct ieee80211_vif *vif)
+{
+        wcn36xx_dbg(WCN36XX_DBG_PMC, "%s\n", __func__);
+        return wcn36xx_smd_keep_alive_req(wcn, vif,
+                                          WCN36XX_HAL_KEEP_ALIVE_NULL_PKT);
+}
diff --git a/drivers/net/wireless/ath/wcn36xx/pmc.h b/drivers/net/wireless/ath/wcn36xx/pmc.h
new file mode 100644
index 000000000000..f72ed68b5a07
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/pmc.h
@@ -0,0 +1,33 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _WCN36XX_PMC_H_
+#define _WCN36XX_PMC_H_
+
+struct wcn36xx;
+
+enum wcn36xx_power_state {
+        WCN36XX_FULL_POWER,
+        WCN36XX_BMPS
+};
+
+int wcn36xx_pmc_enter_bmps_state(struct wcn36xx *wcn,
+                                 struct ieee80211_vif *vif);
+int wcn36xx_pmc_exit_bmps_state(struct wcn36xx *wcn,
+                                struct ieee80211_vif *vif);
+int wcn36xx_enable_keep_alive_null_packet(struct wcn36xx *wcn,
+                                          struct ieee80211_vif *vif);
+#endif  /* _WCN36XX_PMC_H_ */
diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
new file mode 100644
index 000000000000..f8c3a10510c2
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/smd.c
@@ -0,0 +1,2126 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/etherdevice.h>
+#include <linux/firmware.h>
+#include <linux/bitops.h>
+#include "smd.h"
+
+static int put_cfg_tlv_u32(struct wcn36xx *wcn, size_t *len, u32 id, u32 value)
+{
+        struct wcn36xx_hal_cfg *entry;
+        u32 *val;
+
+        if (*len + sizeof(*entry) + sizeof(u32) >= WCN36XX_HAL_BUF_SIZE) {
+                wcn36xx_err("Not enough room for TLV entry\n");
+                return -ENOMEM;
+        }
+
+        entry = (struct wcn36xx_hal_cfg *) (wcn->hal_buf + *len);
+        entry->id = id;
+        entry->len = sizeof(u32);
+        entry->pad_bytes = 0;
+        entry->reserve = 0;
+
+        val = (u32 *) (entry + 1);
+        *val = value;
+
+        *len += sizeof(*entry) + sizeof(u32);
+
+        return 0;
+}
+
+static void wcn36xx_smd_set_bss_nw_type(struct wcn36xx *wcn,
+                struct ieee80211_sta *sta,
+                struct wcn36xx_hal_config_bss_params *bss_params)
+{
+        if (IEEE80211_BAND_5GHZ == WCN36XX_BAND(wcn))
+                bss_params->nw_type = WCN36XX_HAL_11A_NW_TYPE;
+        else if (sta && sta->ht_cap.ht_supported)
+                bss_params->nw_type = WCN36XX_HAL_11N_NW_TYPE;
+        else if (sta && (sta->supp_rates[IEEE80211_BAND_2GHZ] & 0x7f))
+                bss_params->nw_type = WCN36XX_HAL_11G_NW_TYPE;
+        else
+                bss_params->nw_type = WCN36XX_HAL_11B_NW_TYPE;
+}
+
+static inline u8 is_cap_supported(unsigned long caps, unsigned long flag)
+{
+        return caps & flag ? 1 : 0;
+}
+static void wcn36xx_smd_set_bss_ht_params(struct ieee80211_vif *vif,
+                struct ieee80211_sta *sta,
+                struct wcn36xx_hal_config_bss_params *bss_params)
+{
+        if (sta && sta->ht_cap.ht_supported) {
+                unsigned long caps = sta->ht_cap.cap;
+                bss_params->ht = sta->ht_cap.ht_supported;
+                bss_params->tx_channel_width_set = is_cap_supported(caps,
+                        IEEE80211_HT_CAP_SUP_WIDTH_20_40);
+                bss_params->lsig_tx_op_protection_full_support =
+                        is_cap_supported(caps,
+                                         IEEE80211_HT_CAP_LSIG_TXOP_PROT);
+
+                bss_params->ht_oper_mode = vif->bss_conf.ht_operation_mode;
+                bss_params->lln_non_gf_coexist =
+                        !!(vif->bss_conf.ht_operation_mode &
+                           IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT);
+                /* IEEE80211_HT_STBC_PARAM_DUAL_CTS_PROT */
+                bss_params->dual_cts_protection = 0;
+                /* IEEE80211_HT_OP_MODE_PROTECTION_20MHZ */
+                bss_params->ht20_coexist = 0;
+        }
+}
+
+static void wcn36xx_smd_set_sta_ht_params(struct ieee80211_sta *sta,
+                struct wcn36xx_hal_config_sta_params *sta_params)
+{
+        if (sta->ht_cap.ht_supported) {
+                unsigned long caps = sta->ht_cap.cap;
+                sta_params->ht_capable = sta->ht_cap.ht_supported;
+                sta_params->tx_channel_width_set = is_cap_supported(caps,
+                        IEEE80211_HT_CAP_SUP_WIDTH_20_40);
+                sta_params->lsig_txop_protection = is_cap_supported(caps,
+                        IEEE80211_HT_CAP_LSIG_TXOP_PROT);
+
+                sta_params->max_ampdu_size = sta->ht_cap.ampdu_factor;
+                sta_params->max_ampdu_density = sta->ht_cap.ampdu_density;
+                sta_params->max_amsdu_size = is_cap_supported(caps,
+                        IEEE80211_HT_CAP_MAX_AMSDU);
+                sta_params->sgi_20Mhz = is_cap_supported(caps,
+                        IEEE80211_HT_CAP_SGI_20);
+                sta_params->sgi_40mhz = is_cap_supported(caps,
+                        IEEE80211_HT_CAP_SGI_40);
+                sta_params->green_field_capable = is_cap_supported(caps,
+                        IEEE80211_HT_CAP_GRN_FLD);
+                sta_params->delayed_ba_support = is_cap_supported(caps,
+                        IEEE80211_HT_CAP_DELAY_BA);
+                sta_params->dsss_cck_mode_40mhz = is_cap_supported(caps,
+                        IEEE80211_HT_CAP_DSSSCCK40);
+        }
+}
+
+static void wcn36xx_smd_set_sta_params(struct wcn36xx *wcn,
+                struct ieee80211_vif *vif,
+                struct ieee80211_sta *sta,
+                struct wcn36xx_hal_config_sta_params *sta_params)
+{
+        struct wcn36xx_vif *priv_vif = (struct wcn36xx_vif *)vif->drv_priv;
+        struct wcn36xx_sta *priv_sta = NULL;
+        if (vif->type == NL80211_IFTYPE_ADHOC ||
+            vif->type == NL80211_IFTYPE_AP ||
+            vif->type == NL80211_IFTYPE_MESH_POINT) {
+                sta_params->type = 1;
+                sta_params->sta_index = 0xFF;
+        } else {
+                sta_params->type = 0;
+                sta_params->sta_index = 1;
+        }
+
+        sta_params->listen_interval = WCN36XX_LISTEN_INTERVAL(wcn);
+
+        /*
+         * In STA mode ieee80211_sta contains bssid and ieee80211_vif
+         * contains our mac address. In  AP mode we are bssid so vif
+         * contains bssid and ieee80211_sta contains mac.
+         */
+        if (NL80211_IFTYPE_STATION == vif->type)
+                memcpy(&sta_params->mac, vif->addr, ETH_ALEN);
+        else
+                memcpy(&sta_params->bssid, vif->addr, ETH_ALEN);
+
+        sta_params->encrypt_type = priv_vif->encrypt_type;
+        sta_params->short_preamble_supported =
+                !(WCN36XX_FLAGS(wcn) &
+                  IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE);
+
+        sta_params->rifs_mode = 0;
+        sta_params->rmf = 0;
+        sta_params->action = 0;
+        sta_params->uapsd = 0;
+        sta_params->mimo_ps = WCN36XX_HAL_HT_MIMO_PS_STATIC;
+        sta_params->max_ampdu_duration = 0;
+        sta_params->bssid_index = priv_vif->bss_index;
+        sta_params->p2p = 0;
+
+        if (sta) {
+                priv_sta = (struct wcn36xx_sta *)sta->drv_priv;
+                if (NL80211_IFTYPE_STATION == vif->type)
+                        memcpy(&sta_params->bssid, sta->addr, ETH_ALEN);
+                else
+                        memcpy(&sta_params->mac, sta->addr, ETH_ALEN);
+                sta_params->wmm_enabled = sta->wme;
+                sta_params->max_sp_len = sta->max_sp;
+                sta_params->aid = priv_sta->aid;
+                wcn36xx_smd_set_sta_ht_params(sta, sta_params);
+                memcpy(&sta_params->supported_rates, &priv_sta->supported_rates,
+                        sizeof(priv_sta->supported_rates));
+        } else {
+                wcn36xx_set_default_rates(&sta_params->supported_rates);
+        }
+}
+
+static int wcn36xx_smd_send_and_wait(struct wcn36xx *wcn, size_t len)
+{
+        int ret = 0;
+        wcn36xx_dbg_dump(WCN36XX_DBG_SMD_DUMP, "HAL >>> ", wcn->hal_buf, len);
+
+        init_completion(&wcn->hal_rsp_compl);
+        ret = wcn->ctrl_ops->tx(wcn->hal_buf, len);
+        if (ret) {
+                wcn36xx_err("HAL TX failed\n");
+                goto out;
+        }
+        if (wait_for_completion_timeout(&wcn->hal_rsp_compl,
+                msecs_to_jiffies(HAL_MSG_TIMEOUT)) <= 0) {
+                wcn36xx_err("Timeout while waiting SMD response\n");
+                ret = -ETIME;
+                goto out;
+        }
+out:
+        return ret;
+}
+
+#define INIT_HAL_MSG(msg_body, type) \
+        do {                                                            \
+                memset(&msg_body, 0, sizeof(msg_body));                 \
+                msg_body.header.msg_type = type;                        \
+                msg_body.header.msg_version = WCN36XX_HAL_MSG_VERSION0; \
+                msg_body.header.len = sizeof(msg_body);                 \
+        } while (0)                                                     \
+
+#define PREPARE_HAL_BUF(send_buf, msg_body) \
+        do {                                                    \
+                memset(send_buf, 0, msg_body.header.len);       \
+                memcpy(send_buf, &msg_body, sizeof(msg_body));  \
+        } while (0)                                             \
+
+static int wcn36xx_smd_rsp_status_check(void *buf, size_t len)
+{
+        struct wcn36xx_fw_msg_status_rsp *rsp;
+
+        if (len < sizeof(struct wcn36xx_hal_msg_header) +
+            sizeof(struct wcn36xx_fw_msg_status_rsp))
+                return -EIO;
+
+        rsp = (struct wcn36xx_fw_msg_status_rsp *)
+                (buf + sizeof(struct wcn36xx_hal_msg_header));
+
+        if (WCN36XX_FW_MSG_RESULT_SUCCESS != rsp->status)
+                return rsp->status;
+
+        return 0;
+}
+
+int wcn36xx_smd_load_nv(struct wcn36xx *wcn)
+{
+        const struct firmware *nv;
+        struct nv_data *nv_d;
+        struct wcn36xx_hal_nv_img_download_req_msg msg_body;
+        int fw_bytes_left;
+        int ret;
+        u16 fm_offset = 0;
+
+        ret = request_firmware(&nv, WLAN_NV_FILE, wcn->dev);
+        if (ret) {
+                wcn36xx_err("Failed to load nv file %s: %d\n",
+                              WLAN_NV_FILE, ret);
+                goto out_free_nv;
+        }
+
+        nv_d = (struct nv_data *)nv->data;
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_DOWNLOAD_NV_REQ);
+
+        msg_body.header.len += WCN36XX_NV_FRAGMENT_SIZE;
+
+        msg_body.frag_number = 0;
+        /* hal_buf must be protected with  mutex */
+        mutex_lock(&wcn->hal_mutex);
+
+        do {
+                fw_bytes_left = nv->size - fm_offset - 4;
+                if (fw_bytes_left > WCN36XX_NV_FRAGMENT_SIZE) {
+                        msg_body.last_fragment = 0;
+                        msg_body.nv_img_buffer_size = WCN36XX_NV_FRAGMENT_SIZE;
+                } else {
+                        msg_body.last_fragment = 1;
+                        msg_body.nv_img_buffer_size = fw_bytes_left;
+
+                        /* Do not forget update general message len */
+                        msg_body.header.len = sizeof(msg_body) + fw_bytes_left;
+
+                }
+
+                /* Add load NV request message header */
+                memcpy(wcn->hal_buf, &msg_body, sizeof(msg_body));
+
+                /* Add NV body itself */
+                memcpy(wcn->hal_buf + sizeof(msg_body),
+                       &nv_d->table + fm_offset,
+                       msg_body.nv_img_buffer_size);
+
+                ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+                if (ret)
+                        goto out_unlock;
+                ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf,
+                                                   wcn->hal_rsp_len);
+                if (ret) {
+                        wcn36xx_err("hal_load_nv response failed err=%d\n",
+                                    ret);
+                        goto out_unlock;
+                }
+                msg_body.frag_number++;
+                fm_offset += WCN36XX_NV_FRAGMENT_SIZE;
+
+        } while (msg_body.last_fragment != 1);
+
+out_unlock:
+        mutex_unlock(&wcn->hal_mutex);
+out_free_nv:
+        release_firmware(nv);
+
+        return ret;
+}
+
+static int wcn36xx_smd_start_rsp(struct wcn36xx *wcn, void *buf, size_t len)
+{
+        struct wcn36xx_hal_mac_start_rsp_msg *rsp;
+
+        if (len < sizeof(*rsp))
+                return -EIO;
+
+        rsp = (struct wcn36xx_hal_mac_start_rsp_msg *)buf;
+
+        if (WCN36XX_FW_MSG_RESULT_SUCCESS != rsp->start_rsp_params.status)
+                return -EIO;
+
+        memcpy(wcn->crm_version, rsp->start_rsp_params.crm_version,
+               WCN36XX_HAL_VERSION_LENGTH);
+        memcpy(wcn->wlan_version, rsp->start_rsp_params.wlan_version,
+               WCN36XX_HAL_VERSION_LENGTH);
+
+        /* null terminate the strings, just in case */
+        wcn->crm_version[WCN36XX_HAL_VERSION_LENGTH] = '\0';
+        wcn->wlan_version[WCN36XX_HAL_VERSION_LENGTH] = '\0';
+
+        wcn->fw_revision = rsp->start_rsp_params.version.revision;
+        wcn->fw_version = rsp->start_rsp_params.version.version;
+        wcn->fw_minor = rsp->start_rsp_params.version.minor;
+        wcn->fw_major = rsp->start_rsp_params.version.major;
+
+        wcn36xx_info("firmware WLAN version '%s' and CRM version '%s'\n",
+                     wcn->wlan_version, wcn->crm_version);
+
+        wcn36xx_info("firmware API %u.%u.%u.%u, %u stations, %u bssids\n",
+                     wcn->fw_major, wcn->fw_minor,
+                     wcn->fw_version, wcn->fw_revision,
+                     rsp->start_rsp_params.stations,
+                     rsp->start_rsp_params.bssids);
+
+        return 0;
+}
+
+int wcn36xx_smd_start(struct wcn36xx *wcn)
+{
+        struct wcn36xx_hal_mac_start_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_START_REQ);
+
+        msg_body.params.type = DRIVER_TYPE_PRODUCTION;
+        msg_body.params.len = 0;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL, "hal start type %d\n",
+                    msg_body.params.type);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_start failed\n");
+                goto out;
+        }
+
+        ret = wcn36xx_smd_start_rsp(wcn, wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_start response failed err=%d\n", ret);
+                goto out;
+        }
+
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_stop(struct wcn36xx *wcn)
+{
+        struct wcn36xx_hal_mac_stop_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_STOP_REQ);
+
+        msg_body.stop_req_params.reason = HAL_STOP_TYPE_RF_KILL;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_stop failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_stop response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_init_scan(struct wcn36xx *wcn, enum wcn36xx_hal_sys_mode mode)
+{
+        struct wcn36xx_hal_init_scan_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_INIT_SCAN_REQ);
+
+        msg_body.mode = mode;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL, "hal init scan mode %d\n", msg_body.mode);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_init_scan failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_init_scan response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_start_scan(struct wcn36xx *wcn)
+{
+        struct wcn36xx_hal_start_scan_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_START_SCAN_REQ);
+
+        msg_body.scan_channel = WCN36XX_HW_CHANNEL(wcn);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL, "hal start scan channel %d\n",
+                    msg_body.scan_channel);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_start_scan failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_start_scan response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_end_scan(struct wcn36xx *wcn)
+{
+        struct wcn36xx_hal_end_scan_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_END_SCAN_REQ);
+
+        msg_body.scan_channel = WCN36XX_HW_CHANNEL(wcn);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL, "hal end scan channel %d\n",
+                    msg_body.scan_channel);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_end_scan failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_end_scan response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_finish_scan(struct wcn36xx *wcn,
+                            enum wcn36xx_hal_sys_mode mode)
+{
+        struct wcn36xx_hal_finish_scan_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_FINISH_SCAN_REQ);
+
+        msg_body.mode = mode;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL, "hal finish scan mode %d\n",
+                    msg_body.mode);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_finish_scan failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_finish_scan response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+static int wcn36xx_smd_switch_channel_rsp(void *buf, size_t len)
+{
+        struct wcn36xx_hal_switch_channel_rsp_msg *rsp;
+        int ret = 0;
+
+        ret = wcn36xx_smd_rsp_status_check(buf, len);
+        if (ret)
+                return ret;
+        rsp = (struct wcn36xx_hal_switch_channel_rsp_msg *)buf;
+        wcn36xx_dbg(WCN36XX_DBG_HAL, "channel switched to: %d, status: %d\n",
+                    rsp->channel_number, rsp->status);
+        return ret;
+}
+
+int wcn36xx_smd_switch_channel(struct wcn36xx *wcn,
+                               struct ieee80211_vif *vif, int ch)
+{
+        struct wcn36xx_hal_switch_channel_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_CH_SWITCH_REQ);
+
+        msg_body.channel_number = (u8)ch;
+        msg_body.tx_mgmt_power = 0xbf;
+        msg_body.max_tx_power = 0xbf;
+        memcpy(msg_body.self_sta_mac_addr, vif->addr, ETH_ALEN);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_switch_channel failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_switch_channel_rsp(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_switch_channel response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+static int wcn36xx_smd_update_scan_params_rsp(void *buf, size_t len)
+{
+        struct wcn36xx_hal_update_scan_params_resp *rsp;
+
+        rsp = (struct wcn36xx_hal_update_scan_params_resp *)buf;
+
+        /* Remove the PNO version bit */
+        rsp->status &= (~(WCN36XX_FW_MSG_PNO_VERSION_MASK));
+
+        if (WCN36XX_FW_MSG_RESULT_SUCCESS != rsp->status) {
+                wcn36xx_warn("error response from update scan\n");
+                return rsp->status;
+        }
+
+        return 0;
+}
+
+int wcn36xx_smd_update_scan_params(struct wcn36xx *wcn)
+{
+        struct wcn36xx_hal_update_scan_params_req msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_UPDATE_SCAN_PARAM_REQ);
+
+        msg_body.dot11d_enabled = 0;
+        msg_body.dot11d_resolved = 0;
+        msg_body.channel_count = 26;
+        msg_body.active_min_ch_time = 60;
+        msg_body.active_max_ch_time = 120;
+        msg_body.passive_min_ch_time = 60;
+        msg_body.passive_max_ch_time = 110;
+        msg_body.state = 0;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal update scan params channel_count %d\n",
+                    msg_body.channel_count);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_update_scan_params failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_update_scan_params_rsp(wcn->hal_buf,
+                                                 wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_update_scan_params response failed err=%d\n",
+                            ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+static int wcn36xx_smd_add_sta_self_rsp(struct wcn36xx *wcn,
+                                        struct ieee80211_vif *vif,
+                                        void *buf,
+                                        size_t len)
+{
+        struct wcn36xx_hal_add_sta_self_rsp_msg *rsp;
+        struct wcn36xx_vif *priv_vif = (struct wcn36xx_vif *)vif->drv_priv;
+
+        if (len < sizeof(*rsp))
+                return -EINVAL;
+
+        rsp = (struct wcn36xx_hal_add_sta_self_rsp_msg *)buf;
+
+        if (rsp->status != WCN36XX_FW_MSG_RESULT_SUCCESS) {
+                wcn36xx_warn("hal add sta self failure: %d\n",
+                             rsp->status);
+                return rsp->status;
+        }
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal add sta self status %d self_sta_index %d dpu_index %d\n",
+                    rsp->status, rsp->self_sta_index, rsp->dpu_index);
+
+        priv_vif->self_sta_index = rsp->self_sta_index;
+        priv_vif->self_dpu_desc_index = rsp->dpu_index;
+
+        return 0;
+}
+
+int wcn36xx_smd_add_sta_self(struct wcn36xx *wcn, struct ieee80211_vif *vif)
+{
+        struct wcn36xx_hal_add_sta_self_req msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_ADD_STA_SELF_REQ);
+
+        memcpy(&msg_body.self_addr, vif->addr, ETH_ALEN);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal add sta self self_addr %pM status %d\n",
+                    msg_body.self_addr, msg_body.status);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_add_sta_self failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_add_sta_self_rsp(wcn,
+                                           vif,
+                                           wcn->hal_buf,
+                                           wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_add_sta_self response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_delete_sta_self(struct wcn36xx *wcn, u8 *addr)
+{
+        struct wcn36xx_hal_del_sta_self_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_DEL_STA_SELF_REQ);
+
+        memcpy(&msg_body.self_addr, addr, ETH_ALEN);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_delete_sta_self failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_delete_sta_self response failed err=%d\n",
+                            ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_delete_sta(struct wcn36xx *wcn, u8 sta_index)
+{
+        struct wcn36xx_hal_delete_sta_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_DELETE_STA_REQ);
+
+        msg_body.sta_index = sta_index;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal delete sta sta_index %d\n",
+                    msg_body.sta_index);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_delete_sta failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_delete_sta response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+static int wcn36xx_smd_join_rsp(void *buf, size_t len)
+{
+        struct wcn36xx_hal_join_rsp_msg *rsp;
+
+        if (wcn36xx_smd_rsp_status_check(buf, len))
+                return -EIO;
+
+        rsp = (struct wcn36xx_hal_join_rsp_msg *)buf;
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal rsp join status %d tx_mgmt_power %d\n",
+                    rsp->status, rsp->tx_mgmt_power);
+
+        return 0;
+}
+
+int wcn36xx_smd_join(struct wcn36xx *wcn, const u8 *bssid, u8 *vif, u8 ch)
+{
+        struct wcn36xx_hal_join_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_JOIN_REQ);
+
+        memcpy(&msg_body.bssid, bssid, ETH_ALEN);
+        memcpy(&msg_body.self_sta_mac_addr, vif, ETH_ALEN);
+        msg_body.channel = ch;
+
+        if (conf_is_ht40_minus(&wcn->hw->conf))
+                msg_body.secondary_channel_offset =
+                        PHY_DOUBLE_CHANNEL_HIGH_PRIMARY;
+        else if (conf_is_ht40_plus(&wcn->hw->conf))
+                msg_body.secondary_channel_offset =
+                        PHY_DOUBLE_CHANNEL_LOW_PRIMARY;
+        else
+                msg_body.secondary_channel_offset =
+                        PHY_SINGLE_CHANNEL_CENTERED;
+
+        msg_body.link_state = WCN36XX_HAL_LINK_PREASSOC_STATE;
+
+        msg_body.max_tx_power = 0xbf;
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal join req bssid %pM self_sta_mac_addr %pM channel %d link_state %d\n",
+                    msg_body.bssid, msg_body.self_sta_mac_addr,
+                    msg_body.channel, msg_body.link_state);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_join failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_join_rsp(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_join response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_set_link_st(struct wcn36xx *wcn, const u8 *bssid,
+                            const u8 *sta_mac,
+                            enum wcn36xx_hal_link_state state)
+{
+        struct wcn36xx_hal_set_link_state_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_SET_LINK_ST_REQ);
+
+        memcpy(&msg_body.bssid, bssid, ETH_ALEN);
+        memcpy(&msg_body.self_mac_addr, sta_mac, ETH_ALEN);
+        msg_body.state = state;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal set link state bssid %pM self_mac_addr %pM state %d\n",
+                    msg_body.bssid, msg_body.self_mac_addr, msg_body.state);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_set_link_st failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_set_link_st response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+static void wcn36xx_smd_convert_sta_to_v1(struct wcn36xx *wcn,
+                        const struct wcn36xx_hal_config_sta_params *orig,
+                        struct wcn36xx_hal_config_sta_params_v1 *v1)
+{
+        /* convert orig to v1 format */
+        memcpy(&v1->bssid, orig->bssid, ETH_ALEN);
+        memcpy(&v1->mac, orig->mac, ETH_ALEN);
+        v1->aid = orig->aid;
+        v1->type = orig->type;
+        v1->listen_interval = orig->listen_interval;
+        v1->ht_capable = orig->ht_capable;
+
+        v1->max_ampdu_size = orig->max_ampdu_size;
+        v1->max_ampdu_density = orig->max_ampdu_density;
+        v1->sgi_40mhz = orig->sgi_40mhz;
+        v1->sgi_20Mhz = orig->sgi_20Mhz;
+
+        memcpy(&v1->supported_rates, &orig->supported_rates,
+               sizeof(orig->supported_rates));
+        v1->sta_index = orig->sta_index;
+}
+
+static int wcn36xx_smd_config_sta_rsp(struct wcn36xx *wcn,
+                                      struct ieee80211_sta *sta,
+                                      void *buf,
+                                      size_t len)
+{
+        struct wcn36xx_hal_config_sta_rsp_msg *rsp;
+        struct config_sta_rsp_params *params;
+        struct wcn36xx_sta *sta_priv = (struct wcn36xx_sta *)sta->drv_priv;
+
+        if (len < sizeof(*rsp))
+                return -EINVAL;
+
+        rsp = (struct wcn36xx_hal_config_sta_rsp_msg *)buf;
+        params = &rsp->params;
+
+        if (params->status != WCN36XX_FW_MSG_RESULT_SUCCESS) {
+                wcn36xx_warn("hal config sta response failure: %d\n",
+                             params->status);
+                return -EIO;
+        }
+
+        sta_priv->sta_index = params->sta_index;
+        sta_priv->dpu_desc_index = params->dpu_index;
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal config sta rsp status %d sta_index %d bssid_index %d p2p %d\n",
+                    params->status, params->sta_index, params->bssid_index,
+                    params->p2p);
+
+        return 0;
+}
+
+static int wcn36xx_smd_config_sta_v1(struct wcn36xx *wcn,
+                     const struct wcn36xx_hal_config_sta_req_msg *orig)
+{
+        struct wcn36xx_hal_config_sta_req_msg_v1 msg_body;
+        struct wcn36xx_hal_config_sta_params_v1 *sta = &msg_body.sta_params;
+
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_CONFIG_STA_REQ);
+
+        wcn36xx_smd_convert_sta_to_v1(wcn, &orig->sta_params,
+                                      &msg_body.sta_params);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal config sta v1 action %d sta_index %d bssid_index %d bssid %pM type %d mac %pM aid %d\n",
+                    sta->action, sta->sta_index, sta->bssid_index,
+                    sta->bssid, sta->type, sta->mac, sta->aid);
+
+        return wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+}
+
+int wcn36xx_smd_config_sta(struct wcn36xx *wcn, struct ieee80211_vif *vif,
+                           struct ieee80211_sta *sta)
+{
+        struct wcn36xx_hal_config_sta_req_msg msg;
+        struct wcn36xx_hal_config_sta_params *sta_params;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg, WCN36XX_HAL_CONFIG_STA_REQ);
+
+        sta_params = &msg.sta_params;
+
+        wcn36xx_smd_set_sta_params(wcn, vif, sta, sta_params);
+
+        if (!wcn36xx_is_fw_version(wcn, 1, 2, 2, 24)) {
+                ret = wcn36xx_smd_config_sta_v1(wcn, &msg);
+        } else {
+                PREPARE_HAL_BUF(wcn->hal_buf, msg);
+
+                wcn36xx_dbg(WCN36XX_DBG_HAL,
+                            "hal config sta action %d sta_index %d bssid_index %d bssid %pM type %d mac %pM aid %d\n",
+                            sta_params->action, sta_params->sta_index,
+                            sta_params->bssid_index, sta_params->bssid,
+                            sta_params->type, sta_params->mac, sta_params->aid);
+
+                ret = wcn36xx_smd_send_and_wait(wcn, msg.header.len);
+        }
+        if (ret) {
+                wcn36xx_err("Sending hal_config_sta failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_config_sta_rsp(wcn,
+                                         sta,
+                                         wcn->hal_buf,
+                                         wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_config_sta response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+static int wcn36xx_smd_config_bss_v1(struct wcn36xx *wcn,
+                        const struct wcn36xx_hal_config_bss_req_msg *orig)
+{
+        struct wcn36xx_hal_config_bss_req_msg_v1 msg_body;
+        struct wcn36xx_hal_config_bss_params_v1 *bss = &msg_body.bss_params;
+        struct wcn36xx_hal_config_sta_params_v1 *sta = &bss->sta;
+
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_CONFIG_BSS_REQ);
+
+        /* convert orig to v1 */
+        memcpy(&msg_body.bss_params.bssid,
+               &orig->bss_params.bssid, ETH_ALEN);
+        memcpy(&msg_body.bss_params.self_mac_addr,
+               &orig->bss_params.self_mac_addr, ETH_ALEN);
+
+        msg_body.bss_params.bss_type = orig->bss_params.bss_type;
+        msg_body.bss_params.oper_mode = orig->bss_params.oper_mode;
+        msg_body.bss_params.nw_type = orig->bss_params.nw_type;
+
+        msg_body.bss_params.short_slot_time_supported =
+                orig->bss_params.short_slot_time_supported;
+        msg_body.bss_params.lla_coexist = orig->bss_params.lla_coexist;
+        msg_body.bss_params.llb_coexist = orig->bss_params.llb_coexist;
+        msg_body.bss_params.llg_coexist = orig->bss_params.llg_coexist;
+        msg_body.bss_params.ht20_coexist = orig->bss_params.ht20_coexist;
+        msg_body.bss_params.lln_non_gf_coexist =
+                orig->bss_params.lln_non_gf_coexist;
+
+        msg_body.bss_params.lsig_tx_op_protection_full_support =
+                orig->bss_params.lsig_tx_op_protection_full_support;
+        msg_body.bss_params.rifs_mode = orig->bss_params.rifs_mode;
+        msg_body.bss_params.beacon_interval = orig->bss_params.beacon_interval;
+        msg_body.bss_params.dtim_period = orig->bss_params.dtim_period;
+        msg_body.bss_params.tx_channel_width_set =
+                orig->bss_params.tx_channel_width_set;
+        msg_body.bss_params.oper_channel = orig->bss_params.oper_channel;
+        msg_body.bss_params.ext_channel = orig->bss_params.ext_channel;
+
+        msg_body.bss_params.reserved = orig->bss_params.reserved;
+
+        memcpy(&msg_body.bss_params.ssid,
+               &orig->bss_params.ssid,
+               sizeof(orig->bss_params.ssid));
+
+        msg_body.bss_params.action = orig->bss_params.action;
+        msg_body.bss_params.rateset = orig->bss_params.rateset;
+        msg_body.bss_params.ht = orig->bss_params.ht;
+        msg_body.bss_params.obss_prot_enabled =
+                orig->bss_params.obss_prot_enabled;
+        msg_body.bss_params.rmf = orig->bss_params.rmf;
+        msg_body.bss_params.ht_oper_mode = orig->bss_params.ht_oper_mode;
+        msg_body.bss_params.dual_cts_protection =
+                orig->bss_params.dual_cts_protection;
+
+        msg_body.bss_params.max_probe_resp_retry_limit =
+                orig->bss_params.max_probe_resp_retry_limit;
+        msg_body.bss_params.hidden_ssid = orig->bss_params.hidden_ssid;
+        msg_body.bss_params.proxy_probe_resp =
+                orig->bss_params.proxy_probe_resp;
+        msg_body.bss_params.edca_params_valid =
+                orig->bss_params.edca_params_valid;
+
+        memcpy(&msg_body.bss_params.acbe,
+               &orig->bss_params.acbe,
+               sizeof(orig->bss_params.acbe));
+        memcpy(&msg_body.bss_params.acbk,
+               &orig->bss_params.acbk,
+               sizeof(orig->bss_params.acbk));
+        memcpy(&msg_body.bss_params.acvi,
+               &orig->bss_params.acvi,
+               sizeof(orig->bss_params.acvi));
+        memcpy(&msg_body.bss_params.acvo,
+               &orig->bss_params.acvo,
+               sizeof(orig->bss_params.acvo));
+
+        msg_body.bss_params.ext_set_sta_key_param_valid =
+                orig->bss_params.ext_set_sta_key_param_valid;
+
+        memcpy(&msg_body.bss_params.ext_set_sta_key_param,
+               &orig->bss_params.ext_set_sta_key_param,
+               sizeof(orig->bss_params.acvo));
+
+        msg_body.bss_params.wcn36xx_hal_persona =
+                orig->bss_params.wcn36xx_hal_persona;
+        msg_body.bss_params.spectrum_mgt_enable =
+                orig->bss_params.spectrum_mgt_enable;
+        msg_body.bss_params.tx_mgmt_power = orig->bss_params.tx_mgmt_power;
+        msg_body.bss_params.max_tx_power = orig->bss_params.max_tx_power;
+
+        wcn36xx_smd_convert_sta_to_v1(wcn, &orig->bss_params.sta,
+                                      &msg_body.bss_params.sta);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal config bss v1 bssid %pM self_mac_addr %pM bss_type %d oper_mode %d nw_type %d\n",
+                    bss->bssid, bss->self_mac_addr, bss->bss_type,
+                    bss->oper_mode, bss->nw_type);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "- sta bssid %pM action %d sta_index %d bssid_index %d aid %d type %d mac %pM\n",
+                    sta->bssid, sta->action, sta->sta_index,
+                    sta->bssid_index, sta->aid, sta->type, sta->mac);
+
+        return wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+}
+
+
+static int wcn36xx_smd_config_bss_rsp(struct wcn36xx *wcn,
+                                      struct ieee80211_vif *vif,
+                                      void *buf,
+                                      size_t len)
+{
+        struct wcn36xx_hal_config_bss_rsp_msg *rsp;
+        struct wcn36xx_hal_config_bss_rsp_params *params;
+        struct wcn36xx_vif *priv_vif = (struct wcn36xx_vif *)vif->drv_priv;
+
+        if (len < sizeof(*rsp))
+                return -EINVAL;
+
+        rsp = (struct wcn36xx_hal_config_bss_rsp_msg *)buf;
+        params = &rsp->bss_rsp_params;
+
+        if (params->status != WCN36XX_FW_MSG_RESULT_SUCCESS) {
+                wcn36xx_warn("hal config bss response failure: %d\n",
+                             params->status);
+                return -EIO;
+        }
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal config bss rsp status %d bss_idx %d dpu_desc_index %d"
+                    " sta_idx %d self_idx %d bcast_idx %d mac %pM"
+                    " power %d ucast_dpu_signature %d\n",
+                    params->status, params->bss_index, params->dpu_desc_index,
+                    params->bss_sta_index, params->bss_self_sta_index,
+                    params->bss_bcast_sta_idx, params->mac,
+                    params->tx_mgmt_power, params->ucast_dpu_signature);
+
+        priv_vif->bss_index = params->bss_index;
+
+        if (priv_vif->sta) {
+                priv_vif->sta->bss_sta_index =  params->bss_sta_index;
+                priv_vif->sta->bss_dpu_desc_index = params->dpu_desc_index;
+        }
+
+        priv_vif->ucast_dpu_signature = params->ucast_dpu_signature;
+
+        return 0;
+}
+
+int wcn36xx_smd_config_bss(struct wcn36xx *wcn, struct ieee80211_vif *vif,
+                           struct ieee80211_sta *sta, const u8 *bssid,
+                           bool update)
+{
+        struct wcn36xx_hal_config_bss_req_msg msg;
+        struct wcn36xx_hal_config_bss_params *bss;
+        struct wcn36xx_hal_config_sta_params *sta_params;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg, WCN36XX_HAL_CONFIG_BSS_REQ);
+
+        bss = &msg.bss_params;
+        sta_params = &bss->sta;
+
+        WARN_ON(is_zero_ether_addr(bssid));
+
+        memcpy(&bss->bssid, bssid, ETH_ALEN);
+
+        memcpy(bss->self_mac_addr, vif->addr, ETH_ALEN);
+
+        if (vif->type == NL80211_IFTYPE_STATION) {
+                bss->bss_type = WCN36XX_HAL_INFRASTRUCTURE_MODE;
+
+                /* STA */
+                bss->oper_mode = 1;
+                bss->wcn36xx_hal_persona = WCN36XX_HAL_STA_MODE;
+        } else if (vif->type == NL80211_IFTYPE_AP) {
+                bss->bss_type = WCN36XX_HAL_INFRA_AP_MODE;
+
+                /* AP */
+                bss->oper_mode = 0;
+                bss->wcn36xx_hal_persona = WCN36XX_HAL_STA_SAP_MODE;
+        } else if (vif->type == NL80211_IFTYPE_ADHOC ||
+                   vif->type == NL80211_IFTYPE_MESH_POINT) {
+                bss->bss_type = WCN36XX_HAL_IBSS_MODE;
+
+                /* STA */
+                bss->oper_mode = 1;
+        } else {
+                wcn36xx_warn("Unknown type for bss config: %d\n", vif->type);
+        }
+
+        if (vif->type == NL80211_IFTYPE_STATION)
+                wcn36xx_smd_set_bss_nw_type(wcn, sta, bss);
+        else
+                bss->nw_type = WCN36XX_HAL_11N_NW_TYPE;
+
+        bss->short_slot_time_supported = vif->bss_conf.use_short_slot;
+        bss->lla_coexist = 0;
+        bss->llb_coexist = 0;
+        bss->llg_coexist = 0;
+        bss->rifs_mode = 0;
+        bss->beacon_interval = vif->bss_conf.beacon_int;
+        bss->dtim_period = vif_priv->dtim_period;
+
+        wcn36xx_smd_set_bss_ht_params(vif, sta, bss);
+
+        bss->oper_channel = WCN36XX_HW_CHANNEL(wcn);
+
+        if (conf_is_ht40_minus(&wcn->hw->conf))
+                bss->ext_channel = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
+        else if (conf_is_ht40_plus(&wcn->hw->conf))
+                bss->ext_channel = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
+        else
+                bss->ext_channel = IEEE80211_HT_PARAM_CHA_SEC_NONE;
+
+        bss->reserved = 0;
+        wcn36xx_smd_set_sta_params(wcn, vif, sta, sta_params);
+
+        /* wcn->ssid is only valid in AP and IBSS mode */
+        bss->ssid.length = vif_priv->ssid.length;
+        memcpy(bss->ssid.ssid, vif_priv->ssid.ssid, vif_priv->ssid.length);
+
+        bss->obss_prot_enabled = 0;
+        bss->rmf = 0;
+        bss->max_probe_resp_retry_limit = 0;
+        bss->hidden_ssid = vif->bss_conf.hidden_ssid;
+        bss->proxy_probe_resp = 0;
+        bss->edca_params_valid = 0;
+
+        /* FIXME: set acbe, acbk, acvi and acvo */
+
+        bss->ext_set_sta_key_param_valid = 0;
+
+        /* FIXME: set ext_set_sta_key_param */
+
+        bss->spectrum_mgt_enable = 0;
+        bss->tx_mgmt_power = 0;
+        bss->max_tx_power = WCN36XX_MAX_POWER(wcn);
+
+        bss->action = update;
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal config bss bssid %pM self_mac_addr %pM bss_type %d oper_mode %d nw_type %d\n",
+                    bss->bssid, bss->self_mac_addr, bss->bss_type,
+                    bss->oper_mode, bss->nw_type);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "- sta bssid %pM action %d sta_index %d bssid_index %d aid %d type %d mac %pM\n",
+                    sta_params->bssid, sta_params->action,
+                    sta_params->sta_index, sta_params->bssid_index,
+                    sta_params->aid, sta_params->type,
+                    sta_params->mac);
+
+        if (!wcn36xx_is_fw_version(wcn, 1, 2, 2, 24)) {
+                ret = wcn36xx_smd_config_bss_v1(wcn, &msg);
+        } else {
+                PREPARE_HAL_BUF(wcn->hal_buf, msg);
+
+                ret = wcn36xx_smd_send_and_wait(wcn, msg.header.len);
+        }
+        if (ret) {
+                wcn36xx_err("Sending hal_config_bss failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_config_bss_rsp(wcn,
+                                         vif,
+                                         wcn->hal_buf,
+                                         wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_config_bss response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_delete_bss(struct wcn36xx *wcn, struct ieee80211_vif *vif)
+{
+        struct wcn36xx_hal_delete_bss_req_msg msg_body;
+        struct wcn36xx_vif *priv_vif = (struct wcn36xx_vif *)vif->drv_priv;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_DELETE_BSS_REQ);
+
+        msg_body.bss_index = priv_vif->bss_index;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL, "hal delete bss %d\n", msg_body.bss_index);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_delete_bss failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_delete_bss response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_send_beacon(struct wcn36xx *wcn, struct ieee80211_vif *vif,
+                            struct sk_buff *skb_beacon, u16 tim_off,
+                            u16 p2p_off)
+{
+        struct wcn36xx_hal_send_beacon_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_SEND_BEACON_REQ);
+
+        /* TODO need to find out why this is needed? */
+        msg_body.beacon_length = skb_beacon->len + 6;
+
+        if (BEACON_TEMPLATE_SIZE > msg_body.beacon_length) {
+                memcpy(&msg_body.beacon, &skb_beacon->len, sizeof(u32));
+                memcpy(&(msg_body.beacon[4]), skb_beacon->data,
+                       skb_beacon->len);
+        } else {
+                wcn36xx_err("Beacon is to big: beacon size=%d\n",
+                              msg_body.beacon_length);
+                return -ENOMEM;
+        }
+        memcpy(msg_body.bssid, vif->addr, ETH_ALEN);
+
+        /* TODO need to find out why this is needed? */
+        msg_body.tim_ie_offset = tim_off+4;
+        msg_body.p2p_ie_offset = p2p_off;
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal send beacon beacon_length %d\n",
+                    msg_body.beacon_length);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_send_beacon failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_send_beacon response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_update_proberesp_tmpl(struct wcn36xx *wcn,
+                                      struct ieee80211_vif *vif,
+                                      struct sk_buff *skb)
+{
+        struct wcn36xx_hal_send_probe_resp_req_msg msg;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg, WCN36XX_HAL_UPDATE_PROBE_RSP_TEMPLATE_REQ);
+
+        if (skb->len > BEACON_TEMPLATE_SIZE) {
+                wcn36xx_warn("probe response template is too big: %d\n",
+                             skb->len);
+                return -E2BIG;
+        }
+
+        msg.probe_resp_template_len = skb->len;
+        memcpy(&msg.probe_resp_template, skb->data, skb->len);
+
+        memcpy(msg.bssid, vif->addr, ETH_ALEN);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal update probe rsp len %d bssid %pM\n",
+                    msg.probe_resp_template_len, msg.bssid);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_update_proberesp_tmpl failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_update_proberesp_tmpl response failed err=%d\n",
+                            ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_set_stakey(struct wcn36xx *wcn,
+                           enum ani_ed_type enc_type,
+                           u8 keyidx,
+                           u8 keylen,
+                           u8 *key,
+                           u8 sta_index)
+{
+        struct wcn36xx_hal_set_sta_key_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_SET_STAKEY_REQ);
+
+        msg_body.set_sta_key_params.sta_index = sta_index;
+        msg_body.set_sta_key_params.enc_type = enc_type;
+
+        msg_body.set_sta_key_params.key[0].id = keyidx;
+        msg_body.set_sta_key_params.key[0].unicast = 1;
+        msg_body.set_sta_key_params.key[0].direction = WCN36XX_HAL_TX_RX;
+        msg_body.set_sta_key_params.key[0].pae_role = 0;
+        msg_body.set_sta_key_params.key[0].length = keylen;
+        memcpy(msg_body.set_sta_key_params.key[0].key, key, keylen);
+        msg_body.set_sta_key_params.single_tid_rc = 1;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_set_stakey failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_set_stakey response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_set_bsskey(struct wcn36xx *wcn,
+                           enum ani_ed_type enc_type,
+                           u8 keyidx,
+                           u8 keylen,
+                           u8 *key)
+{
+        struct wcn36xx_hal_set_bss_key_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_SET_BSSKEY_REQ);
+        msg_body.bss_idx = 0;
+        msg_body.enc_type = enc_type;
+        msg_body.num_keys = 1;
+        msg_body.keys[0].id = keyidx;
+        msg_body.keys[0].unicast = 0;
+        msg_body.keys[0].direction = WCN36XX_HAL_RX_ONLY;
+        msg_body.keys[0].pae_role = 0;
+        msg_body.keys[0].length = keylen;
+        memcpy(msg_body.keys[0].key, key, keylen);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_set_bsskey failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_set_bsskey response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_remove_stakey(struct wcn36xx *wcn,
+                              enum ani_ed_type enc_type,
+                              u8 keyidx,
+                              u8 sta_index)
+{
+        struct wcn36xx_hal_remove_sta_key_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_RMV_STAKEY_REQ);
+
+        msg_body.sta_idx = sta_index;
+        msg_body.enc_type = enc_type;
+        msg_body.key_id = keyidx;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_remove_stakey failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_remove_stakey response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_remove_bsskey(struct wcn36xx *wcn,
+                              enum ani_ed_type enc_type,
+                              u8 keyidx)
+{
+        struct wcn36xx_hal_remove_bss_key_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_RMV_BSSKEY_REQ);
+        msg_body.bss_idx = 0;
+        msg_body.enc_type = enc_type;
+        msg_body.key_id = keyidx;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_remove_bsskey failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_remove_bsskey response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_enter_bmps(struct wcn36xx *wcn, struct ieee80211_vif *vif)
+{
+        struct wcn36xx_hal_enter_bmps_req_msg msg_body;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_ENTER_BMPS_REQ);
+
+        msg_body.bss_index = vif_priv->bss_index;
+        msg_body.tbtt = vif->bss_conf.sync_tsf;
+        msg_body.dtim_period = vif_priv->dtim_period;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_enter_bmps failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_enter_bmps response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_exit_bmps(struct wcn36xx *wcn, struct ieee80211_vif *vif)
+{
+        struct wcn36xx_hal_enter_bmps_req_msg msg_body;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_EXIT_BMPS_REQ);
+
+        msg_body.bss_index = vif_priv->bss_index;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_exit_bmps failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_exit_bmps response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+int wcn36xx_smd_set_power_params(struct wcn36xx *wcn, bool ignore_dtim)
+{
+        struct wcn36xx_hal_set_power_params_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_SET_POWER_PARAMS_REQ);
+
+        /*
+         * When host is down ignore every second dtim
+         */
+        if (ignore_dtim) {
+                msg_body.ignore_dtim = 1;
+                msg_body.dtim_period = 2;
+        }
+        msg_body.listen_interval = WCN36XX_LISTEN_INTERVAL(wcn);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_set_power_params failed\n");
+                goto out;
+        }
+
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+/* Notice: This function should be called after associated, or else it
+ * will be invalid
+ */
+int wcn36xx_smd_keep_alive_req(struct wcn36xx *wcn,
+                               struct ieee80211_vif *vif,
+                               int packet_type)
+{
+        struct wcn36xx_hal_keep_alive_req_msg msg_body;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_KEEP_ALIVE_REQ);
+
+        if (packet_type == WCN36XX_HAL_KEEP_ALIVE_NULL_PKT) {
+                msg_body.bss_index = vif_priv->bss_index;
+                msg_body.packet_type = WCN36XX_HAL_KEEP_ALIVE_NULL_PKT;
+                msg_body.time_period = WCN36XX_KEEP_ALIVE_TIME_PERIOD;
+        } else if (packet_type == WCN36XX_HAL_KEEP_ALIVE_UNSOLICIT_ARP_RSP) {
+                /* TODO: it also support ARP response type */
+        } else {
+                wcn36xx_warn("unknow keep alive packet type %d\n", packet_type);
+                return -EINVAL;
+        }
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_exit_bmps failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_exit_bmps response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_dump_cmd_req(struct wcn36xx *wcn, u32 arg1, u32 arg2,
+                             u32 arg3, u32 arg4, u32 arg5)
+{
+        struct wcn36xx_hal_dump_cmd_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_DUMP_COMMAND_REQ);
+
+        msg_body.arg1 = arg1;
+        msg_body.arg2 = arg2;
+        msg_body.arg3 = arg3;
+        msg_body.arg4 = arg4;
+        msg_body.arg5 = arg5;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_dump_cmd failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_dump_cmd response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+static inline void set_feat_caps(u32 *bitmap,
+                                 enum place_holder_in_cap_bitmap cap)
+{
+        int arr_idx, bit_idx;
+
+        if (cap < 0 || cap > 127) {
+                wcn36xx_warn("error cap idx %d\n", cap);
+                return;
+        }
+
+        arr_idx = cap / 32;
+        bit_idx = cap % 32;
+        bitmap[arr_idx] |= (1 << bit_idx);
+}
+
+static inline int get_feat_caps(u32 *bitmap,
+                                enum place_holder_in_cap_bitmap cap)
+{
+        int arr_idx, bit_idx;
+        int ret = 0;
+
+        if (cap < 0 || cap > 127) {
+                wcn36xx_warn("error cap idx %d\n", cap);
+                return -EINVAL;
+        }
+
+        arr_idx = cap / 32;
+        bit_idx = cap % 32;
+        ret = (bitmap[arr_idx] & (1 << bit_idx)) ? 1 : 0;
+        return ret;
+}
+
+static inline void clear_feat_caps(u32 *bitmap,
+                                enum place_holder_in_cap_bitmap cap)
+{
+        int arr_idx, bit_idx;
+
+        if (cap < 0 || cap > 127) {
+                wcn36xx_warn("error cap idx %d\n", cap);
+                return;
+        }
+
+        arr_idx = cap / 32;
+        bit_idx = cap % 32;
+        bitmap[arr_idx] &= ~(1 << bit_idx);
+}
+
+int wcn36xx_smd_feature_caps_exchange(struct wcn36xx *wcn)
+{
+        struct wcn36xx_hal_feat_caps_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_FEATURE_CAPS_EXCHANGE_REQ);
+
+        set_feat_caps(msg_body.feat_caps, STA_POWERSAVE);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_feature_caps_exchange failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_feature_caps_exchange response failed err=%d\n",
+                            ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_add_ba_session(struct wcn36xx *wcn,
+                struct ieee80211_sta *sta,
+                u16 tid,
+                u16 *ssn,
+                u8 direction,
+                u8 sta_index)
+{
+        struct wcn36xx_hal_add_ba_session_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_ADD_BA_SESSION_REQ);
+
+        msg_body.sta_index = sta_index;
+        memcpy(&msg_body.mac_addr, sta->addr, ETH_ALEN);
+        msg_body.dialog_token = 0x10;
+        msg_body.tid = tid;
+
+        /* Immediate BA because Delayed BA is not supported */
+        msg_body.policy = 1;
+        msg_body.buffer_size = WCN36XX_AGGR_BUFFER_SIZE;
+        msg_body.timeout = 0;
+        if (ssn)
+                msg_body.ssn = *ssn;
+        msg_body.direction = direction;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_add_ba_session failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_add_ba_session response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_add_ba(struct wcn36xx *wcn)
+{
+        struct wcn36xx_hal_add_ba_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_ADD_BA_REQ);
+
+        msg_body.session_id = 0;
+        msg_body.win_size = WCN36XX_AGGR_BUFFER_SIZE;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_add_ba failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_add_ba response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_del_ba(struct wcn36xx *wcn, u16 tid, u8 sta_index)
+{
+        struct wcn36xx_hal_del_ba_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_DEL_BA_REQ);
+
+        msg_body.sta_index = sta_index;
+        msg_body.tid = tid;
+        msg_body.direction = 0;
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_del_ba failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_del_ba response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_trigger_ba(struct wcn36xx *wcn, u8 sta_index)
+{
+        struct wcn36xx_hal_trigger_ba_req_msg msg_body;
+        struct wcn36xx_hal_trigget_ba_req_candidate *candidate;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_TRIGGER_BA_REQ);
+
+        msg_body.session_id = 0;
+        msg_body.candidate_cnt = 1;
+        msg_body.header.len += sizeof(*candidate);
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        candidate = (struct wcn36xx_hal_trigget_ba_req_candidate *)
+                (wcn->hal_buf + sizeof(msg_body));
+        candidate->sta_index = sta_index;
+        candidate->tid_bitmap = 1;
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_trigger_ba failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_trigger_ba response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+static int wcn36xx_smd_tx_compl_ind(struct wcn36xx *wcn, void *buf, size_t len)
+{
+        struct wcn36xx_hal_tx_compl_ind_msg *rsp = buf;
+
+        if (len != sizeof(*rsp)) {
+                wcn36xx_warn("Bad TX complete indication\n");
+                return -EIO;
+        }
+
+        wcn36xx_dxe_tx_ack_ind(wcn, rsp->status);
+
+        return 0;
+}
+
+static int wcn36xx_smd_missed_beacon_ind(struct wcn36xx *wcn,
+                                         void *buf,
+                                         size_t len)
+{
+        struct wcn36xx_hal_missed_beacon_ind_msg *rsp = buf;
+        struct ieee80211_vif *vif = NULL;
+        struct wcn36xx_vif *tmp;
+
+        /* Old FW does not have bss index */
+        if (wcn36xx_is_fw_version(wcn, 1, 2, 2, 24)) {
+                list_for_each_entry(tmp, &wcn->vif_list, list) {
+                        wcn36xx_dbg(WCN36XX_DBG_HAL, "beacon missed bss_index %d\n",
+                                    tmp->bss_index);
+                        vif = container_of((void *)tmp,
+                                                 struct ieee80211_vif,
+                                                 drv_priv);
+                        ieee80211_connection_loss(vif);
+                }
+                return 0;
+        }
+
+        if (len != sizeof(*rsp)) {
+                wcn36xx_warn("Corrupted missed beacon indication\n");
+                return -EIO;
+        }
+
+        list_for_each_entry(tmp, &wcn->vif_list, list) {
+                if (tmp->bss_index == rsp->bss_index) {
+                        wcn36xx_dbg(WCN36XX_DBG_HAL, "beacon missed bss_index %d\n",
+                                    rsp->bss_index);
+                        vif = container_of((void *)tmp,
+                                                 struct ieee80211_vif,
+                                                 drv_priv);
+                        ieee80211_connection_loss(vif);
+                        return 0;
+                }
+        }
+
+        wcn36xx_warn("BSS index %d not found\n", rsp->bss_index);
+        return -ENOENT;
+}
+
+static int wcn36xx_smd_delete_sta_context_ind(struct wcn36xx *wcn,
+                                              void *buf,
+                                              size_t len)
+{
+        struct wcn36xx_hal_delete_sta_context_ind_msg *rsp = buf;
+        struct wcn36xx_vif *tmp;
+        struct ieee80211_sta *sta = NULL;
+
+        if (len != sizeof(*rsp)) {
+                wcn36xx_warn("Corrupted delete sta indication\n");
+                return -EIO;
+        }
+
+        list_for_each_entry(tmp, &wcn->vif_list, list) {
+                if (sta && (tmp->sta->sta_index == rsp->sta_id)) {
+                        sta = container_of((void *)tmp->sta,
+                                                 struct ieee80211_sta,
+                                                 drv_priv);
+                        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                                    "delete station indication %pM index %d\n",
+                                    rsp->addr2,
+                                    rsp->sta_id);
+                        ieee80211_report_low_ack(sta, 0);
+                        return 0;
+                }
+        }
+
+        wcn36xx_warn("STA with addr %pM and index %d not found\n",
+                     rsp->addr2,
+                     rsp->sta_id);
+        return -ENOENT;
+}
+
+int wcn36xx_smd_update_cfg(struct wcn36xx *wcn, u32 cfg_id, u32 value)
+{
+        struct wcn36xx_hal_update_cfg_req_msg msg_body, *body;
+        size_t len;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_UPDATE_CFG_REQ);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        body = (struct wcn36xx_hal_update_cfg_req_msg *) wcn->hal_buf;
+        len = msg_body.header.len;
+
+        put_cfg_tlv_u32(wcn, &len, cfg_id, value);
+        body->header.len = len;
+        body->len = len - sizeof(*body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, body->header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_update_cfg failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_update_cfg response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+static void wcn36xx_smd_rsp_process(struct wcn36xx *wcn, void *buf, size_t len)
+{
+        struct wcn36xx_hal_msg_header *msg_header = buf;
+        struct wcn36xx_hal_ind_msg *msg_ind;
+        wcn36xx_dbg_dump(WCN36XX_DBG_SMD_DUMP, "SMD <<< ", buf, len);
+
+        switch (msg_header->msg_type) {
+        case WCN36XX_HAL_START_RSP:
+        case WCN36XX_HAL_CONFIG_STA_RSP:
+        case WCN36XX_HAL_CONFIG_BSS_RSP:
+        case WCN36XX_HAL_ADD_STA_SELF_RSP:
+        case WCN36XX_HAL_STOP_RSP:
+        case WCN36XX_HAL_DEL_STA_SELF_RSP:
+        case WCN36XX_HAL_DELETE_STA_RSP:
+        case WCN36XX_HAL_INIT_SCAN_RSP:
+        case WCN36XX_HAL_START_SCAN_RSP:
+        case WCN36XX_HAL_END_SCAN_RSP:
+        case WCN36XX_HAL_FINISH_SCAN_RSP:
+        case WCN36XX_HAL_DOWNLOAD_NV_RSP:
+        case WCN36XX_HAL_DELETE_BSS_RSP:
+        case WCN36XX_HAL_SEND_BEACON_RSP:
+        case WCN36XX_HAL_SET_LINK_ST_RSP:
+        case WCN36XX_HAL_UPDATE_PROBE_RSP_TEMPLATE_RSP:
+        case WCN36XX_HAL_SET_BSSKEY_RSP:
+        case WCN36XX_HAL_SET_STAKEY_RSP:
+        case WCN36XX_HAL_RMV_STAKEY_RSP:
+        case WCN36XX_HAL_RMV_BSSKEY_RSP:
+        case WCN36XX_HAL_ENTER_BMPS_RSP:
+        case WCN36XX_HAL_SET_POWER_PARAMS_RSP:
+        case WCN36XX_HAL_EXIT_BMPS_RSP:
+        case WCN36XX_HAL_KEEP_ALIVE_RSP:
+        case WCN36XX_HAL_DUMP_COMMAND_RSP:
+        case WCN36XX_HAL_ADD_BA_SESSION_RSP:
+        case WCN36XX_HAL_ADD_BA_RSP:
+        case WCN36XX_HAL_DEL_BA_RSP:
+        case WCN36XX_HAL_TRIGGER_BA_RSP:
+        case WCN36XX_HAL_UPDATE_CFG_RSP:
+        case WCN36XX_HAL_JOIN_RSP:
+        case WCN36XX_HAL_UPDATE_SCAN_PARAM_RSP:
+        case WCN36XX_HAL_CH_SWITCH_RSP:
+        case WCN36XX_HAL_FEATURE_CAPS_EXCHANGE_RSP:
+                memcpy(wcn->hal_buf, buf, len);
+                wcn->hal_rsp_len = len;
+                complete(&wcn->hal_rsp_compl);
+                break;
+
+        case WCN36XX_HAL_OTA_TX_COMPL_IND:
+        case WCN36XX_HAL_MISSED_BEACON_IND:
+        case WCN36XX_HAL_DELETE_STA_CONTEXT_IND:
+                mutex_lock(&wcn->hal_ind_mutex);
+                msg_ind = kmalloc(sizeof(*msg_ind), GFP_KERNEL);
+                msg_ind->msg_len = len;
+                msg_ind->msg = kmalloc(len, GFP_KERNEL);
+                memcpy(msg_ind->msg, buf, len);
+                list_add_tail(&msg_ind->list, &wcn->hal_ind_queue);
+                queue_work(wcn->hal_ind_wq, &wcn->hal_ind_work);
+                wcn36xx_dbg(WCN36XX_DBG_HAL, "indication arrived\n");
+                mutex_unlock(&wcn->hal_ind_mutex);
+                break;
+        default:
+                wcn36xx_err("SMD_EVENT (%d) not supported\n",
+                              msg_header->msg_type);
+        }
+}
+static void wcn36xx_ind_smd_work(struct work_struct *work)
+{
+        struct wcn36xx *wcn =
+                container_of(work, struct wcn36xx, hal_ind_work);
+        struct wcn36xx_hal_msg_header *msg_header;
+        struct wcn36xx_hal_ind_msg *hal_ind_msg;
+
+        mutex_lock(&wcn->hal_ind_mutex);
+
+        hal_ind_msg = list_first_entry(&wcn->hal_ind_queue,
+                                       struct wcn36xx_hal_ind_msg,
+                                       list);
+
+        msg_header = (struct wcn36xx_hal_msg_header *)hal_ind_msg->msg;
+
+        switch (msg_header->msg_type) {
+        case WCN36XX_HAL_OTA_TX_COMPL_IND:
+                wcn36xx_smd_tx_compl_ind(wcn,
+                                         hal_ind_msg->msg,
+                                         hal_ind_msg->msg_len);
+                break;
+        case WCN36XX_HAL_MISSED_BEACON_IND:
+                wcn36xx_smd_missed_beacon_ind(wcn,
+                                              hal_ind_msg->msg,
+                                              hal_ind_msg->msg_len);
+                break;
+        case WCN36XX_HAL_DELETE_STA_CONTEXT_IND:
+                wcn36xx_smd_delete_sta_context_ind(wcn,
+                                                   hal_ind_msg->msg,
+                                                   hal_ind_msg->msg_len);
+                break;
+        default:
+                wcn36xx_err("SMD_EVENT (%d) not supported\n",
+                              msg_header->msg_type);
+        }
+        list_del(wcn->hal_ind_queue.next);
+        kfree(hal_ind_msg->msg);
+        kfree(hal_ind_msg);
+        mutex_unlock(&wcn->hal_ind_mutex);
+}
+int wcn36xx_smd_open(struct wcn36xx *wcn)
+{
+        int ret = 0;
+        wcn->hal_ind_wq = create_freezable_workqueue("wcn36xx_smd_ind");
+        if (!wcn->hal_ind_wq) {
+                wcn36xx_err("failed to allocate wq\n");
+                ret = -ENOMEM;
+                goto out;
+        }
+        INIT_WORK(&wcn->hal_ind_work, wcn36xx_ind_smd_work);
+        INIT_LIST_HEAD(&wcn->hal_ind_queue);
+        mutex_init(&wcn->hal_ind_mutex);
+
+        ret = wcn->ctrl_ops->open(wcn, wcn36xx_smd_rsp_process);
+        if (ret) {
+                wcn36xx_err("failed to open control channel\n");
+                goto free_wq;
+        }
+
+        return ret;
+
+free_wq:
+        destroy_workqueue(wcn->hal_ind_wq);
+out:
+        return ret;
+}
+
+void wcn36xx_smd_close(struct wcn36xx *wcn)
+{
+        wcn->ctrl_ops->close();
+        destroy_workqueue(wcn->hal_ind_wq);
+        mutex_destroy(&wcn->hal_ind_mutex);
+}
diff --git a/drivers/net/wireless/ath/wcn36xx/smd.h b/drivers/net/wireless/ath/wcn36xx/smd.h
new file mode 100644
index 000000000000..e7c39019c6f1
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/smd.h
@@ -0,0 +1,127 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _SMD_H_
+#define _SMD_H_
+
+#include "wcn36xx.h"
+
+/* Max shared size is 4k but we take less.*/
+#define WCN36XX_NV_FRAGMENT_SIZE                        3072
+
+#define WCN36XX_HAL_BUF_SIZE                            4096
+
+#define HAL_MSG_TIMEOUT 200
+#define WCN36XX_SMSM_WLAN_TX_ENABLE                     0x00000400
+#define WCN36XX_SMSM_WLAN_TX_RINGS_EMPTY                0x00000200
+/* The PNO version info be contained in the rsp msg */
+#define WCN36XX_FW_MSG_PNO_VERSION_MASK                 0x8000
+
+enum wcn36xx_fw_msg_result {
+        WCN36XX_FW_MSG_RESULT_SUCCESS                   = 0,
+        WCN36XX_FW_MSG_RESULT_SUCCESS_SYNC              = 1,
+
+        WCN36XX_FW_MSG_RESULT_MEM_FAIL                  = 5,
+};
+
+/******************************/
+/* SMD requests and responses */
+/******************************/
+struct wcn36xx_fw_msg_status_rsp {
+        u32     status;
+} __packed;
+
+struct wcn36xx_hal_ind_msg {
+        struct list_head list;
+        u8 *msg;
+        size_t msg_len;
+};
+
+struct wcn36xx;
+
+int wcn36xx_smd_open(struct wcn36xx *wcn);
+void wcn36xx_smd_close(struct wcn36xx *wcn);
+
+int wcn36xx_smd_load_nv(struct wcn36xx *wcn);
+int wcn36xx_smd_start(struct wcn36xx *wcn);
+int wcn36xx_smd_stop(struct wcn36xx *wcn);
+int wcn36xx_smd_init_scan(struct wcn36xx *wcn, enum wcn36xx_hal_sys_mode mode);
+int wcn36xx_smd_start_scan(struct wcn36xx *wcn);
+int wcn36xx_smd_end_scan(struct wcn36xx *wcn);
+int wcn36xx_smd_finish_scan(struct wcn36xx *wcn,
+                            enum wcn36xx_hal_sys_mode mode);
+int wcn36xx_smd_update_scan_params(struct wcn36xx *wcn);
+int wcn36xx_smd_add_sta_self(struct wcn36xx *wcn, struct ieee80211_vif *vif);
+int wcn36xx_smd_delete_sta_self(struct wcn36xx *wcn, u8 *addr);
+int wcn36xx_smd_delete_sta(struct wcn36xx *wcn, u8 sta_index);
+int wcn36xx_smd_join(struct wcn36xx *wcn, const u8 *bssid, u8 *vif, u8 ch);
+int wcn36xx_smd_set_link_st(struct wcn36xx *wcn, const u8 *bssid,
+                            const u8 *sta_mac,
+                            enum wcn36xx_hal_link_state state);
+int wcn36xx_smd_config_bss(struct wcn36xx *wcn, struct ieee80211_vif *vif,
+                           struct ieee80211_sta *sta, const u8 *bssid,
+                           bool update);
+int wcn36xx_smd_delete_bss(struct wcn36xx *wcn, struct ieee80211_vif *vif);
+int wcn36xx_smd_config_sta(struct wcn36xx *wcn, struct ieee80211_vif *vif,
+                           struct ieee80211_sta *sta);
+int wcn36xx_smd_send_beacon(struct wcn36xx *wcn, struct ieee80211_vif *vif,
+                            struct sk_buff *skb_beacon, u16 tim_off,
+                            u16 p2p_off);
+int wcn36xx_smd_switch_channel(struct wcn36xx *wcn,
+                               struct ieee80211_vif *vif, int ch);
+int wcn36xx_smd_update_proberesp_tmpl(struct wcn36xx *wcn,
+                                      struct ieee80211_vif *vif,
+                                      struct sk_buff *skb);
+int wcn36xx_smd_set_stakey(struct wcn36xx *wcn,
+                           enum ani_ed_type enc_type,
+                           u8 keyidx,
+                           u8 keylen,
+                           u8 *key,
+                           u8 sta_index);
+int wcn36xx_smd_set_bsskey(struct wcn36xx *wcn,
+                           enum ani_ed_type enc_type,
+                           u8 keyidx,
+                           u8 keylen,
+                           u8 *key);
+int wcn36xx_smd_remove_stakey(struct wcn36xx *wcn,
+                              enum ani_ed_type enc_type,
+                              u8 keyidx,
+                              u8 sta_index);
+int wcn36xx_smd_remove_bsskey(struct wcn36xx *wcn,
+                              enum ani_ed_type enc_type,
+                              u8 keyidx);
+int wcn36xx_smd_enter_bmps(struct wcn36xx *wcn, struct ieee80211_vif *vif);
+int wcn36xx_smd_exit_bmps(struct wcn36xx *wcn, struct ieee80211_vif *vif);
+int wcn36xx_smd_set_power_params(struct wcn36xx *wcn, bool ignore_dtim);
+int wcn36xx_smd_keep_alive_req(struct wcn36xx *wcn,
+                               struct ieee80211_vif *vif,
+                               int packet_type);
+int wcn36xx_smd_dump_cmd_req(struct wcn36xx *wcn, u32 arg1, u32 arg2,
+                             u32 arg3, u32 arg4, u32 arg5);
+int wcn36xx_smd_feature_caps_exchange(struct wcn36xx *wcn);
+
+int wcn36xx_smd_add_ba_session(struct wcn36xx *wcn,
+                struct ieee80211_sta *sta,
+                u16 tid,
+                u16 *ssn,
+                u8 direction,
+                u8 sta_index);
+int wcn36xx_smd_add_ba(struct wcn36xx *wcn);
+int wcn36xx_smd_del_ba(struct wcn36xx *wcn, u16 tid, u8 sta_index);
+int wcn36xx_smd_trigger_ba(struct wcn36xx *wcn, u8 sta_index);
+
+int wcn36xx_smd_update_cfg(struct wcn36xx *wcn, u32 cfg_id, u32 value);
+#endif  /* _SMD_H_ */
diff --git a/drivers/net/wireless/ath/wcn36xx/txrx.c b/drivers/net/wireless/ath/wcn36xx/txrx.c
new file mode 100644
index 000000000000..b2b60e30caaf
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/txrx.c
@@ -0,0 +1,284 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include "txrx.h"
+
+static inline int get_rssi0(struct wcn36xx_rx_bd *bd)
+{
+        return 100 - ((bd->phy_stat0 >> 24) & 0xff);
+}
+
+int wcn36xx_rx_skb(struct wcn36xx *wcn, struct sk_buff *skb)
+{
+        struct ieee80211_rx_status status;
+        struct ieee80211_hdr *hdr;
+        struct wcn36xx_rx_bd *bd;
+        u16 fc, sn;
+
+        /*
+         * All fields must be 0, otherwise it can lead to
+         * unexpected consequences.
+         */
+        memset(&status, 0, sizeof(status));
+
+        bd = (struct wcn36xx_rx_bd *)skb->data;
+        buff_to_be((u32 *)bd, sizeof(*bd)/sizeof(u32));
+        wcn36xx_dbg_dump(WCN36XX_DBG_RX_DUMP,
+                         "BD   <<< ", (char *)bd,
+                         sizeof(struct wcn36xx_rx_bd));
+
+        skb_put(skb, bd->pdu.mpdu_header_off + bd->pdu.mpdu_len);
+        skb_pull(skb, bd->pdu.mpdu_header_off);
+
+        status.mactime = 10;
+        status.freq = WCN36XX_CENTER_FREQ(wcn);
+        status.band = WCN36XX_BAND(wcn);
+        status.signal = -get_rssi0(bd);
+        status.antenna = 1;
+        status.rate_idx = 1;
+        status.flag = 0;
+        status.rx_flags = 0;
+        status.flag |= RX_FLAG_IV_STRIPPED |
+                       RX_FLAG_MMIC_STRIPPED |
+                       RX_FLAG_DECRYPTED;
+
+        wcn36xx_dbg(WCN36XX_DBG_RX, "status.flags=%x status->vendor_radiotap_len=%x\n",
+                    status.flag,  status.vendor_radiotap_len);
+
+        memcpy(IEEE80211_SKB_RXCB(skb), &status, sizeof(status));
+
+        hdr = (struct ieee80211_hdr *) skb->data;
+        fc = __le16_to_cpu(hdr->frame_control);
+        sn = IEEE80211_SEQ_TO_SN(__le16_to_cpu(hdr->seq_ctrl));
+
+        if (ieee80211_is_beacon(hdr->frame_control)) {
+                wcn36xx_dbg(WCN36XX_DBG_BEACON, "beacon skb %p len %d fc %04x sn %d\n",
+                            skb, skb->len, fc, sn);
+                wcn36xx_dbg_dump(WCN36XX_DBG_BEACON_DUMP, "SKB <<< ",
+                                 (char *)skb->data, skb->len);
+        } else {
+                wcn36xx_dbg(WCN36XX_DBG_RX, "rx skb %p len %d fc %04x sn %d\n",
+                            skb, skb->len, fc, sn);
+                wcn36xx_dbg_dump(WCN36XX_DBG_RX_DUMP, "SKB <<< ",
+                                 (char *)skb->data, skb->len);
+        }
+
+        ieee80211_rx_irqsafe(wcn->hw, skb);
+
+        return 0;
+}
+
+static void wcn36xx_set_tx_pdu(struct wcn36xx_tx_bd *bd,
+                               u32 mpdu_header_len,
+                               u32 len,
+                               u16 tid)
+{
+        bd->pdu.mpdu_header_len = mpdu_header_len;
+        bd->pdu.mpdu_header_off = sizeof(*bd);
+        bd->pdu.mpdu_data_off = bd->pdu.mpdu_header_len +
+                bd->pdu.mpdu_header_off;
+        bd->pdu.mpdu_len = len;
+        bd->pdu.tid = tid;
+}
+
+static inline struct wcn36xx_vif *get_vif_by_addr(struct wcn36xx *wcn,
+                                                  u8 *addr)
+{
+        struct wcn36xx_vif *vif_priv = NULL;
+        struct ieee80211_vif *vif = NULL;
+        list_for_each_entry(vif_priv, &wcn->vif_list, list) {
+                        vif = container_of((void *)vif_priv,
+                                   struct ieee80211_vif,
+                                   drv_priv);
+                        if (memcmp(vif->addr, addr, ETH_ALEN) == 0)
+                                return vif_priv;
+        }
+        wcn36xx_warn("vif %pM not found\n", addr);
+        return NULL;
+}
+static void wcn36xx_set_tx_data(struct wcn36xx_tx_bd *bd,
+                                struct wcn36xx *wcn,
+                                struct wcn36xx_vif **vif_priv,
+                                struct wcn36xx_sta *sta_priv,
+                                struct ieee80211_hdr *hdr,
+                                bool bcast)
+{
+        struct ieee80211_vif *vif = NULL;
+        struct wcn36xx_vif *__vif_priv = NULL;
+        bd->bd_rate = WCN36XX_BD_RATE_DATA;
+
+        /*
+         * For not unicast frames mac80211 will not set sta pointer so use
+         * self_sta_index instead.
+         */
+        if (sta_priv) {
+                __vif_priv = sta_priv->vif;
+                vif = container_of((void *)__vif_priv,
+                                   struct ieee80211_vif,
+                                   drv_priv);
+
+                if (vif->type == NL80211_IFTYPE_STATION) {
+                        bd->sta_index = sta_priv->bss_sta_index;
+                        bd->dpu_desc_idx = sta_priv->bss_dpu_desc_index;
+                } else if (vif->type == NL80211_IFTYPE_AP ||
+                           vif->type == NL80211_IFTYPE_ADHOC ||
+                           vif->type == NL80211_IFTYPE_MESH_POINT) {
+                        bd->sta_index = sta_priv->sta_index;
+                        bd->dpu_desc_idx = sta_priv->dpu_desc_index;
+                }
+        } else {
+                __vif_priv = get_vif_by_addr(wcn, hdr->addr2);
+                bd->sta_index = __vif_priv->self_sta_index;
+                bd->dpu_desc_idx = __vif_priv->self_dpu_desc_index;
+        }
+
+        bd->dpu_sign = __vif_priv->ucast_dpu_signature;
+
+        if (ieee80211_is_nullfunc(hdr->frame_control) ||
+           (sta_priv && !sta_priv->is_data_encrypted))
+                bd->dpu_ne = 1;
+
+        if (bcast) {
+                bd->ub = 1;
+                bd->ack_policy = 1;
+        }
+        *vif_priv = __vif_priv;
+}
+
+static void wcn36xx_set_tx_mgmt(struct wcn36xx_tx_bd *bd,
+                                struct wcn36xx *wcn,
+                                struct wcn36xx_vif **vif_priv,
+                                struct ieee80211_hdr *hdr,
+                                bool bcast)
+{
+        struct wcn36xx_vif *__vif_priv =
+                get_vif_by_addr(wcn, hdr->addr2);
+        bd->sta_index = __vif_priv->self_sta_index;
+        bd->dpu_desc_idx = __vif_priv->self_dpu_desc_index;
+        bd->dpu_ne = 1;
+
+        /* default rate for unicast */
+        if (ieee80211_is_mgmt(hdr->frame_control))
+                bd->bd_rate = (WCN36XX_BAND(wcn) == IEEE80211_BAND_5GHZ) ?
+                        WCN36XX_BD_RATE_CTRL :
+                        WCN36XX_BD_RATE_MGMT;
+        else if (ieee80211_is_ctl(hdr->frame_control))
+                bd->bd_rate = WCN36XX_BD_RATE_CTRL;
+        else
+                wcn36xx_warn("frame control type unknown\n");
+
+        /*
+         * In joining state trick hardware that probe is sent as
+         * unicast even if address is broadcast.
+         */
+        if (__vif_priv->is_joining &&
+            ieee80211_is_probe_req(hdr->frame_control))
+                bcast = false;
+
+        if (bcast) {
+                /* broadcast */
+                bd->ub = 1;
+                /* No ack needed not unicast */
+                bd->ack_policy = 1;
+                bd->queue_id = WCN36XX_TX_B_WQ_ID;
+        } else
+                bd->queue_id = WCN36XX_TX_U_WQ_ID;
+        *vif_priv = __vif_priv;
+}
+
+int wcn36xx_start_tx(struct wcn36xx *wcn,
+                     struct wcn36xx_sta *sta_priv,
+                     struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        struct wcn36xx_vif *vif_priv = NULL;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        unsigned long flags;
+        bool is_low = ieee80211_is_data(hdr->frame_control);
+        bool bcast = is_broadcast_ether_addr(hdr->addr1) ||
+                is_multicast_ether_addr(hdr->addr1);
+        struct wcn36xx_tx_bd *bd = wcn36xx_dxe_get_next_bd(wcn, is_low);
+
+        if (!bd) {
+                /*
+                 * TX DXE are used in pairs. One for the BD and one for the
+                 * actual frame. The BD DXE's has a preallocated buffer while
+                 * the skb ones does not. If this isn't true something is really
+                 * wierd. TODO: Recover from this situation
+                 */
+
+                wcn36xx_err("bd address may not be NULL for BD DXE\n");
+                return -EINVAL;
+        }
+
+        memset(bd, 0, sizeof(*bd));
+
+        wcn36xx_dbg(WCN36XX_DBG_TX,
+                    "tx skb %p len %d fc %04x sn %d %s %s\n",
+                    skb, skb->len, __le16_to_cpu(hdr->frame_control),
+                    IEEE80211_SEQ_TO_SN(__le16_to_cpu(hdr->seq_ctrl)),
+                    is_low ? "low" : "high", bcast ? "bcast" : "ucast");
+
+        wcn36xx_dbg_dump(WCN36XX_DBG_TX_DUMP, "", skb->data, skb->len);
+
+        bd->dpu_rf = WCN36XX_BMU_WQ_TX;
+
+        bd->tx_comp = info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS;
+        if (bd->tx_comp) {
+                wcn36xx_dbg(WCN36XX_DBG_DXE, "TX_ACK status requested\n");
+                spin_lock_irqsave(&wcn->dxe_lock, flags);
+                if (wcn->tx_ack_skb) {
+                        spin_unlock_irqrestore(&wcn->dxe_lock, flags);
+                        wcn36xx_warn("tx_ack_skb already set\n");
+                        return -EINVAL;
+                }
+
+                wcn->tx_ack_skb = skb;
+                spin_unlock_irqrestore(&wcn->dxe_lock, flags);
+
+                /* Only one at a time is supported by fw. Stop the TX queues
+                 * until the ack status gets back.
+                 *
+                 * TODO: Add watchdog in case FW does not answer
+                 */
+                ieee80211_stop_queues(wcn->hw);
+        }
+
+        /* Data frames served first*/
+        if (is_low) {
+                wcn36xx_set_tx_data(bd, wcn, &vif_priv, sta_priv, hdr, bcast);
+                wcn36xx_set_tx_pdu(bd,
+                           ieee80211_is_data_qos(hdr->frame_control) ?
+                           sizeof(struct ieee80211_qos_hdr) :
+                           sizeof(struct ieee80211_hdr_3addr),
+                           skb->len, sta_priv ? sta_priv->tid : 0);
+        } else {
+                /* MGMT and CTRL frames are handeld here*/
+                wcn36xx_set_tx_mgmt(bd, wcn, &vif_priv, hdr, bcast);
+                wcn36xx_set_tx_pdu(bd,
+                           ieee80211_is_data_qos(hdr->frame_control) ?
+                           sizeof(struct ieee80211_qos_hdr) :
+                           sizeof(struct ieee80211_hdr_3addr),
+                           skb->len, WCN36XX_TID);
+        }
+
+        buff_to_be((u32 *)bd, sizeof(*bd)/sizeof(u32));
+        bd->tx_bd_sign = 0xbdbdbdbd;
+
+        return wcn36xx_dxe_tx_frame(wcn, vif_priv, skb, is_low);
+}
diff --git a/drivers/net/wireless/ath/wcn36xx/txrx.h b/drivers/net/wireless/ath/wcn36xx/txrx.h
new file mode 100644
index 000000000000..bbfbcf808c77
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/txrx.h
@@ -0,0 +1,160 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _TXRX_H_
+#define _TXRX_H_
+
+#include <linux/etherdevice.h>
+#include "wcn36xx.h"
+
+/* TODO describe all properties */
+#define WCN36XX_802_11_HEADER_LEN       24
+#define WCN36XX_BMU_WQ_TX               25
+#define WCN36XX_TID                     7
+/* broadcast wq ID */
+#define WCN36XX_TX_B_WQ_ID              0xA
+#define WCN36XX_TX_U_WQ_ID              0x9
+/* bd_rate */
+#define WCN36XX_BD_RATE_DATA 0
+#define WCN36XX_BD_RATE_MGMT 2
+#define WCN36XX_BD_RATE_CTRL 3
+
+struct wcn36xx_pdu {
+        u32     dpu_fb:8;
+        u32     adu_fb:8;
+        u32     pdu_id:16;
+
+        /* 0x04*/
+        u32     tail_pdu_idx:16;
+        u32     head_pdu_idx:16;
+
+        /* 0x08*/
+        u32     pdu_count:7;
+        u32     mpdu_data_off:9;
+        u32     mpdu_header_off:8;
+        u32     mpdu_header_len:8;
+
+        /* 0x0c*/
+        u32     reserved4:8;
+        u32     tid:4;
+        u32     reserved3:4;
+        u32     mpdu_len:16;
+};
+
+struct wcn36xx_rx_bd {
+        u32     bdt:2;
+        u32     ft:1;
+        u32     dpu_ne:1;
+        u32     rx_key_id:3;
+        u32     ub:1;
+        u32     rmf:1;
+        u32     uma_bypass:1;
+        u32     csr11:1;
+        u32     reserved0:1;
+        u32     scan_learn:1;
+        u32     rx_ch:4;
+        u32     rtsf:1;
+        u32     bsf:1;
+        u32     a2hf:1;
+        u32     st_auf:1;
+        u32     dpu_sign:3;
+        u32     dpu_rf:8;
+
+        struct wcn36xx_pdu pdu;
+
+        /* 0x14*/
+        u32     addr3:8;
+        u32     addr2:8;
+        u32     addr1:8;
+        u32     dpu_desc_idx:8;
+
+        /* 0x18*/
+        u32     rxp_flags:23;
+        u32     rate_id:9;
+
+        u32     phy_stat0;
+        u32     phy_stat1;
+
+        /* 0x24 */
+        u32     rx_times;
+
+        u32     pmi_cmd[6];
+
+        /* 0x40 */
+        u32     reserved7:4;
+        u32     reorder_slot_id:6;
+        u32     reorder_fwd_id:6;
+        u32     reserved6:12;
+        u32     reorder_code:4;
+
+        /* 0x44 */
+        u32     exp_seq_num:12;
+        u32     cur_seq_num:12;
+        u32     fr_type_subtype:8;
+
+        /* 0x48 */
+        u32     msdu_size:16;
+        u32     sub_fr_id:4;
+        u32     proc_order:4;
+        u32     reserved9:4;
+        u32     aef:1;
+        u32     lsf:1;
+        u32     esf:1;
+        u32     asf:1;
+};
+
+struct wcn36xx_tx_bd {
+        u32     bdt:2;
+        u32     ft:1;
+        u32     dpu_ne:1;
+        u32     fw_tx_comp:1;
+        u32     tx_comp:1;
+        u32     reserved1:1;
+        u32     ub:1;
+        u32     rmf:1;
+        u32     reserved0:12;
+        u32     dpu_sign:3;
+        u32     dpu_rf:8;
+
+        struct wcn36xx_pdu pdu;
+
+        /* 0x14*/
+        u32     reserved5:7;
+        u32     queue_id:5;
+        u32     bd_rate:2;
+        u32     ack_policy:2;
+        u32     sta_index:8;
+        u32     dpu_desc_idx:8;
+
+        u32     tx_bd_sign;
+        u32     reserved6;
+        u32     dxe_start_time;
+        u32     dxe_end_time;
+
+        /*u32   tcp_udp_start_off:10;
+        u32     header_cks:16;
+        u32     reserved7:6;*/
+};
+
+struct wcn36xx_sta;
+struct wcn36xx;
+
+int  wcn36xx_rx_skb(struct wcn36xx *wcn, struct sk_buff *skb);
+int wcn36xx_start_tx(struct wcn36xx *wcn,
+                     struct wcn36xx_sta *sta_priv,
+                     struct sk_buff *skb);
+
+#endif  /* _TXRX_H_ */
diff --git a/drivers/net/wireless/ath/wcn36xx/wcn36xx.h b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
new file mode 100644
index 000000000000..58b63833e8e7
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
@@ -0,0 +1,238 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _WCN36XX_H_
+#define _WCN36XX_H_
+
+#include <linux/completion.h>
+#include <linux/printk.h>
+#include <linux/spinlock.h>
+#include <net/mac80211.h>
+
+#include "hal.h"
+#include "smd.h"
+#include "txrx.h"
+#include "dxe.h"
+#include "pmc.h"
+#include "debug.h"
+
+#define WLAN_NV_FILE               "wlan/prima/WCNSS_qcom_wlan_nv.bin"
+#define WCN36XX_AGGR_BUFFER_SIZE 64
+
+extern unsigned int wcn36xx_dbg_mask;
+
+enum wcn36xx_debug_mask {
+        WCN36XX_DBG_DXE         = 0x00000001,
+        WCN36XX_DBG_DXE_DUMP    = 0x00000002,
+        WCN36XX_DBG_SMD         = 0x00000004,
+        WCN36XX_DBG_SMD_DUMP    = 0x00000008,
+        WCN36XX_DBG_RX          = 0x00000010,
+        WCN36XX_DBG_RX_DUMP     = 0x00000020,
+        WCN36XX_DBG_TX          = 0x00000040,
+        WCN36XX_DBG_TX_DUMP     = 0x00000080,
+        WCN36XX_DBG_HAL         = 0x00000100,
+        WCN36XX_DBG_HAL_DUMP    = 0x00000200,
+        WCN36XX_DBG_MAC         = 0x00000400,
+        WCN36XX_DBG_BEACON      = 0x00000800,
+        WCN36XX_DBG_BEACON_DUMP = 0x00001000,
+        WCN36XX_DBG_PMC         = 0x00002000,
+        WCN36XX_DBG_PMC_DUMP    = 0x00004000,
+        WCN36XX_DBG_ANY         = 0xffffffff,
+};
+
+#define wcn36xx_err(fmt, arg...)                                \
+        printk(KERN_ERR pr_fmt("ERROR " fmt), ##arg);
+
+#define wcn36xx_warn(fmt, arg...)                               \
+        printk(KERN_WARNING pr_fmt("WARNING " fmt), ##arg)
+
+#define wcn36xx_info(fmt, arg...)               \
+        printk(KERN_INFO pr_fmt(fmt), ##arg)
+
+#define wcn36xx_dbg(mask, fmt, arg...) do {                     \
+        if (wcn36xx_dbg_mask & mask)                                    \
+                printk(KERN_DEBUG pr_fmt(fmt), ##arg);  \
+} while (0)
+
+#define wcn36xx_dbg_dump(mask, prefix_str, buf, len) do {       \
+        if (wcn36xx_dbg_mask & mask)                                    \
+                print_hex_dump(KERN_DEBUG, pr_fmt(prefix_str),  \
+                               DUMP_PREFIX_OFFSET, 32, 1,       \
+                               buf, len, false);                \
+} while (0)
+
+#define WCN36XX_HW_CHANNEL(__wcn) (__wcn->hw->conf.chandef.chan->hw_value)
+#define WCN36XX_BAND(__wcn) (__wcn->hw->conf.chandef.chan->band)
+#define WCN36XX_CENTER_FREQ(__wcn) (__wcn->hw->conf.chandef.chan->center_freq)
+#define WCN36XX_LISTEN_INTERVAL(__wcn) (__wcn->hw->conf.listen_interval)
+#define WCN36XX_FLAGS(__wcn) (__wcn->hw->flags)
+#define WCN36XX_MAX_POWER(__wcn) (__wcn->hw->conf.chandef.chan->max_power)
+
+static inline void buff_to_be(u32 *buf, size_t len)
+{
+        int i;
+        for (i = 0; i < len; i++)
+                buf[i] = cpu_to_be32(buf[i]);
+}
+
+struct nv_data {
+        int     is_valid;
+        u8      table;
+};
+
+/* Interface for platform control path
+ *
+ * @open: hook must be called when wcn36xx wants to open control channel.
+ * @tx: sends a buffer.
+ */
+struct wcn36xx_platform_ctrl_ops {
+        int (*open)(void *drv_priv, void *rsp_cb);
+        void (*close)(void);
+        int (*tx)(char *buf, size_t len);
+        int (*get_hw_mac)(u8 *addr);
+        int (*smsm_change_state)(u32 clear_mask, u32 set_mask);
+};
+
+/**
+ * struct wcn36xx_vif - holds VIF related fields
+ *
+ * @bss_index: bss_index is initially set to 0xFF. bss_index is received from
+ * HW after first config_bss call and must be used in delete_bss and
+ * enter/exit_bmps.
+ */
+struct wcn36xx_vif {
+        struct list_head list;
+        struct wcn36xx_sta *sta;
+        u8 dtim_period;
+        enum ani_ed_type encrypt_type;
+        bool is_joining;
+        struct wcn36xx_hal_mac_ssid ssid;
+
+        /* Power management */
+        enum wcn36xx_power_state pw_state;
+
+        u8 bss_index;
+        u8 ucast_dpu_signature;
+        /* Returned from WCN36XX_HAL_ADD_STA_SELF_RSP */
+        u8 self_sta_index;
+        u8 self_dpu_desc_index;
+};
+
+/**
+ * struct wcn36xx_sta - holds STA related fields
+ *
+ * @tid: traffic ID that is used during AMPDU and in TX BD.
+ * @sta_index: STA index is returned from HW after config_sta call and is
+ * used in both SMD channel and TX BD.
+ * @dpu_desc_index: DPU descriptor index is returned from HW after config_sta
+ * call and is used in TX BD.
+ * @bss_sta_index: STA index is returned from HW after config_bss call and is
+ * used in both SMD channel and TX BD. See table bellow when it is used.
+ * @bss_dpu_desc_index: DPU descriptor index is returned from HW after
+ * config_bss call and is used in TX BD.
+ * ______________________________________________
+ * |              |     STA     |       AP      |
+ * |______________|_____________|_______________|
+ * |    TX BD     |bss_sta_index|   sta_index   |
+ * |______________|_____________|_______________|
+ * |all SMD calls |bss_sta_index|   sta_index   |
+ * |______________|_____________|_______________|
+ * |smd_delete_sta|  sta_index  |   sta_index   |
+ * |______________|_____________|_______________|
+ */
+struct wcn36xx_sta {
+        struct wcn36xx_vif *vif;
+        u16 aid;
+        u16 tid;
+        u8 sta_index;
+        u8 dpu_desc_index;
+        u8 bss_sta_index;
+        u8 bss_dpu_desc_index;
+        bool is_data_encrypted;
+        /* Rates */
+        struct wcn36xx_hal_supported_rates supported_rates;
+};
+struct wcn36xx_dxe_ch;
+struct wcn36xx {
+        struct ieee80211_hw     *hw;
+        struct device           *dev;
+        struct list_head        vif_list;
+
+        u8                      fw_revision;
+        u8                      fw_version;
+        u8                      fw_minor;
+        u8                      fw_major;
+
+        /* extra byte for the NULL termination */
+        u8                      crm_version[WCN36XX_HAL_VERSION_LENGTH + 1];
+        u8                      wlan_version[WCN36XX_HAL_VERSION_LENGTH + 1];
+
+        /* IRQs */
+        int                     tx_irq;
+        int                     rx_irq;
+        void __iomem            *mmio;
+
+        struct wcn36xx_platform_ctrl_ops *ctrl_ops;
+        /*
+         * smd_buf must be protected with smd_mutex to garantee
+         * that all messages are sent one after another
+         */
+        u8                      *hal_buf;
+        size_t                  hal_rsp_len;
+        struct mutex            hal_mutex;
+        struct completion       hal_rsp_compl;
+        struct workqueue_struct *hal_ind_wq;
+        struct work_struct      hal_ind_work;
+        struct mutex            hal_ind_mutex;
+        struct list_head        hal_ind_queue;
+
+        /* DXE channels */
+        struct wcn36xx_dxe_ch   dxe_tx_l_ch;    /* TX low */
+        struct wcn36xx_dxe_ch   dxe_tx_h_ch;    /* TX high */
+        struct wcn36xx_dxe_ch   dxe_rx_l_ch;    /* RX low */
+        struct wcn36xx_dxe_ch   dxe_rx_h_ch;    /* RX high */
+
+        /* For synchronization of DXE resources from BH, IRQ and WQ contexts */
+        spinlock_t      dxe_lock;
+        bool                    queues_stopped;
+
+        /* Memory pools */
+        struct wcn36xx_dxe_mem_pool mgmt_mem_pool;
+        struct wcn36xx_dxe_mem_pool data_mem_pool;
+
+        struct sk_buff          *tx_ack_skb;
+
+#ifdef CONFIG_WCN36XX_DEBUGFS
+        /* Debug file system entry */
+        struct wcn36xx_dfs_entry    dfs;
+#endif /* CONFIG_WCN36XX_DEBUGFS */
+
+};
+
+static inline bool wcn36xx_is_fw_version(struct wcn36xx *wcn,
+                                         u8 major,
+                                         u8 minor,
+                                         u8 version,
+                                         u8 revision)
+{
+        return (wcn->fw_major == major &&
+                wcn->fw_minor == minor &&
+                wcn->fw_version == version &&
+                wcn->fw_revision == revision);
+}
+void wcn36xx_set_default_rates(struct wcn36xx_hal_supported_rates *rates);
+
+#endif  /* _WCN36XX_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index 69b14dc4dd55..8138f1cff4e5 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -5695,7 +5695,7 @@ static bool brcms_c_chipmatch_pci(struct bcma_device *core)
                 return true;
         if ((device == BCM43224_D11N_ID) || (device == BCM43225_D11N2G_ID))
                 return true;
-        if (device == BCM4313_D11N2G_ID)
+        if (device == BCM4313_D11N2G_ID || device == BCM4313_CHIP_ID)
                 return true;
         if ((device == BCM43236_D11N_ID) || (device == BCM43236_D11N2G_ID))
                 return true;
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index a6c46f3b6e3a..e47f4e3012b8 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -1048,7 +1048,7 @@ mwifiex_cancel_pending_ioctl(struct mwifiex_adapter *adapter)
         struct cmd_ctrl_node *cmd_node = NULL, *tmp_node = NULL;
         unsigned long cmd_flags;
         unsigned long scan_pending_q_flags;
-        uint16_t cancel_scan_cmd = false;
+        bool cancel_scan_cmd = false;
 
         if ((adapter->curr_cmd) &&
             (adapter->curr_cmd->wait_q_enabled)) {
diff --git a/drivers/net/wireless/mwifiex/join.c b/drivers/net/wireless/mwifiex/join.c
index 9d7c0e6c4fc7..717fbe2e0e5a 100644
--- a/drivers/net/wireless/mwifiex/join.c
+++ b/drivers/net/wireless/mwifiex/join.c
@@ -621,7 +621,7 @@ int mwifiex_ret_802_11_associate(struct mwifiex_private *priv,
         int ret = 0;
         struct ieee_types_assoc_rsp *assoc_rsp;
         struct mwifiex_bssdescriptor *bss_desc;
-        u8 enable_data = true;
+        bool enable_data = true;
         u16 cap_info, status_code;
 
         assoc_rsp = (struct ieee_types_assoc_rsp *) &resp->params;
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index c2b91f566e05..9d7c9d354d34 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -882,7 +882,9 @@ mwifiex_add_card(void *card, struct semaphore *sem,
         adapter->cmd_wait_q.status = 0;
         adapter->scan_wait_q_woken = false;
 
-        adapter->workqueue = create_workqueue("MWIFIEX_WORK_QUEUE");
+        adapter->workqueue =
+                alloc_workqueue("MWIFIEX_WORK_QUEUE",
+                                WQ_HIGHPRI | WQ_MEM_RECLAIM | WQ_UNBOUND, 1);
         if (!adapter->workqueue)
                 goto err_kmalloc;
 
diff --git a/drivers/net/wireless/mwifiex/sta_cmd.c b/drivers/net/wireless/mwifiex/sta_cmd.c
index c0268b597748..7d66018a2e33 100644
--- a/drivers/net/wireless/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/mwifiex/sta_cmd.c
@@ -327,7 +327,7 @@ mwifiex_cmd_802_11_hs_cfg(struct mwifiex_private *priv,
 {
         struct mwifiex_adapter *adapter = priv->adapter;
         struct host_cmd_ds_802_11_hs_cfg_enh *hs_cfg = &cmd->params.opt_hs_cfg;
-        u16 hs_activate = false;
+        bool hs_activate = false;
 
         if (!hscfg_param)
                 /* New Activate command */
diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c
index 95fa3599b407..5dd0ccc70b86 100644
--- a/drivers/net/wireless/mwifiex/wmm.c
+++ b/drivers/net/wireless/mwifiex/wmm.c
@@ -708,7 +708,7 @@ int mwifiex_ret_wmm_get_status(struct mwifiex_private *priv,
 {
         u8 *curr = (u8 *) &resp->params.get_wmm_status;
         uint16_t resp_len = le16_to_cpu(resp->size), tlv_len;
-        int valid = true;
+        bool valid = true;
 
         struct mwifiex_ie_types_data *tlv_hdr;
         struct mwifiex_ie_types_wmm_queue_status *tlv_wmm_qstatus;
diff --git a/drivers/net/wireless/p54/p54spi.c b/drivers/net/wireless/p54/p54spi.c
index 7fc46f26cf2b..de15171e2cd8 100644
--- a/drivers/net/wireless/p54/p54spi.c
+++ b/drivers/net/wireless/p54/p54spi.c
@@ -636,7 +636,7 @@ static int p54spi_probe(struct spi_device *spi)
         gpio_direction_input(p54spi_gpio_irq);
 
         ret = request_irq(gpio_to_irq(p54spi_gpio_irq),
-                          p54spi_interrupt, IRQF_DISABLED, "p54spi",
+                          p54spi_interrupt, 0, "p54spi",
                           priv->spi);
         if (ret < 0) {
                 dev_err(&priv->spi->dev, "request_irq() failed");
diff --git a/drivers/net/wireless/rt2x00/Kconfig b/drivers/net/wireless/rt2x00/Kconfig
index 68dbbb9c6d12..a18b0051a745 100644
--- a/drivers/net/wireless/rt2x00/Kconfig
+++ b/drivers/net/wireless/rt2x00/Kconfig
@@ -219,6 +219,7 @@ config RT2X00_LIB_USB
 
 config RT2X00_LIB
         tristate
+        select AVERAGE
 
 config RT2X00_LIB_FIRMWARE
         boolean
diff --git a/drivers/net/wireless/rt2x00/rt2800.h b/drivers/net/wireless/rt2x00/rt2800.h
index e3eb95292a7f..aab6b5e4f5dd 100644
--- a/drivers/net/wireless/rt2x00/rt2800.h
+++ b/drivers/net/wireless/rt2x00/rt2800.h
@@ -124,7 +124,7 @@
 /*
  * MAC_CSR0_3290: MAC_CSR0 for RT3290 to identity MAC version number.
  */
-#define MAC_CSR0_3290                           0x0000
+#define MAC_CSR0_3290                   0x0000
 
 /*
  * E2PROM_CSR: PCI EEPROM control register.
@@ -213,17 +213,17 @@
 /*
  * COEX_CFG_0
  */
-#define COEX_CFG0                       0x0040
+#define COEX_CFG0               0x0040
 #define COEX_CFG_ANT            FIELD32(0xff000000)
 /*
  * COEX_CFG_1
  */
-#define COEX_CFG1                       0x0044
+#define COEX_CFG1               0x0044
 
 /*
  * COEX_CFG_2
  */
-#define COEX_CFG2                       0x0048
+#define COEX_CFG2               0x0048
 #define BT_COEX_CFG1            FIELD32(0xff000000)
 #define BT_COEX_CFG0            FIELD32(0x00ff0000)
 #define WL_COEX_CFG1            FIELD32(0x0000ff00)
@@ -237,8 +237,8 @@
 #define PLL_RESERVED_INPUT2     FIELD32(0x0000ff00)
 #define PLL_CONTROL             FIELD32(0x00070000)
 #define PLL_LPF_R1              FIELD32(0x00080000)
-#define PLL_LPF_C1_CTRL FIELD32(0x00300000)
-#define PLL_LPF_C2_CTRL FIELD32(0x00c00000)
+#define PLL_LPF_C1_CTRL         FIELD32(0x00300000)
+#define PLL_LPF_C2_CTRL         FIELD32(0x00c00000)
 #define PLL_CP_CURRENT_CTRL     FIELD32(0x03000000)
 #define PLL_PFD_DELAY_CTRL      FIELD32(0x0c000000)
 #define PLL_LOCK_CTRL           FIELD32(0x70000000)
@@ -2166,7 +2166,7 @@ struct mac_iveiv_entry {
  */
 #define RFCSR6_R1                       FIELD8(0x03)
 #define RFCSR6_R2                       FIELD8(0x40)
-#define RFCSR6_TXDIV            FIELD8(0x0c)
+#define RFCSR6_TXDIV                    FIELD8(0x0c)
 /* bits for RF3053 */
 #define RFCSR6_VCO_IC                   FIELD8(0xc0)
 
@@ -2204,13 +2204,13 @@ struct mac_iveiv_entry {
  * RFCSR 12:
  */
 #define RFCSR12_TX_POWER                FIELD8(0x1f)
-#define RFCSR12_DR0                             FIELD8(0xe0)
+#define RFCSR12_DR0                     FIELD8(0xe0)
 
 /*
  * RFCSR 13:
  */
 #define RFCSR13_TX_POWER                FIELD8(0x1f)
-#define RFCSR13_DR0                             FIELD8(0xe0)
+#define RFCSR13_DR0                     FIELD8(0xe0)
 
 /*
  * RFCSR 15:
@@ -2228,7 +2228,7 @@ struct mac_iveiv_entry {
 #define RFCSR17_TXMIXER_GAIN            FIELD8(0x07)
 #define RFCSR17_TX_LO1_EN               FIELD8(0x08)
 #define RFCSR17_R                       FIELD8(0x20)
-#define RFCSR17_CODE                   FIELD8(0x7f)
+#define RFCSR17_CODE                    FIELD8(0x7f)
 
 /* RFCSR 18 */
 #define RFCSR18_XO_TUNE_BYPASS          FIELD8(0x40)
@@ -2451,7 +2451,7 @@ enum rt2800_eeprom_word {
  */
 #define EEPROM_NIC_CONF0_RXPATH         FIELD16(0x000f)
 #define EEPROM_NIC_CONF0_TXPATH         FIELD16(0x00f0)
-#define EEPROM_NIC_CONF0_RF_TYPE                FIELD16(0x0f00)
+#define EEPROM_NIC_CONF0_RF_TYPE        FIELD16(0x0f00)
 
 /*
  * EEPROM NIC Configuration 1
@@ -2473,18 +2473,18 @@ enum rt2800_eeprom_word {
  * DAC_TEST: 0: disable, 1: enable
  */
 #define EEPROM_NIC_CONF1_HW_RADIO               FIELD16(0x0001)
-#define EEPROM_NIC_CONF1_EXTERNAL_TX_ALC                FIELD16(0x0002)
-#define EEPROM_NIC_CONF1_EXTERNAL_LNA_2G                FIELD16(0x0004)
-#define EEPROM_NIC_CONF1_EXTERNAL_LNA_5G                FIELD16(0x0008)
+#define EEPROM_NIC_CONF1_EXTERNAL_TX_ALC        FIELD16(0x0002)
+#define EEPROM_NIC_CONF1_EXTERNAL_LNA_2G        FIELD16(0x0004)
+#define EEPROM_NIC_CONF1_EXTERNAL_LNA_5G        FIELD16(0x0008)
 #define EEPROM_NIC_CONF1_CARDBUS_ACCEL          FIELD16(0x0010)
 #define EEPROM_NIC_CONF1_BW40M_SB_2G            FIELD16(0x0020)
 #define EEPROM_NIC_CONF1_BW40M_SB_5G            FIELD16(0x0040)
 #define EEPROM_NIC_CONF1_WPS_PBC                FIELD16(0x0080)
 #define EEPROM_NIC_CONF1_BW40M_2G               FIELD16(0x0100)
 #define EEPROM_NIC_CONF1_BW40M_5G               FIELD16(0x0200)
-#define EEPROM_NIC_CONF1_BROADBAND_EXT_LNA              FIELD16(0x400)
+#define EEPROM_NIC_CONF1_BROADBAND_EXT_LNA      FIELD16(0x400)
 #define EEPROM_NIC_CONF1_ANT_DIVERSITY          FIELD16(0x1800)
-#define EEPROM_NIC_CONF1_INTERNAL_TX_ALC                FIELD16(0x2000)
+#define EEPROM_NIC_CONF1_INTERNAL_TX_ALC        FIELD16(0x2000)
 #define EEPROM_NIC_CONF1_BT_COEXIST             FIELD16(0x4000)
 #define EEPROM_NIC_CONF1_DAC_TEST               FIELD16(0x8000)
 
@@ -2523,9 +2523,9 @@ enum rt2800_eeprom_word {
  * TX_STREAM: 0: Reserved, 1: 1 Stream, 2: 2 Stream
  * CRYSTAL: 00: Reserved, 01: One crystal, 10: Two crystal, 11: Reserved
  */
-#define EEPROM_NIC_CONF2_RX_STREAM              FIELD16(0x000f)
-#define EEPROM_NIC_CONF2_TX_STREAM              FIELD16(0x00f0)
-#define EEPROM_NIC_CONF2_CRYSTAL                FIELD16(0x0600)
+#define EEPROM_NIC_CONF2_RX_STREAM      FIELD16(0x000f)
+#define EEPROM_NIC_CONF2_TX_STREAM      FIELD16(0x00f0)
+#define EEPROM_NIC_CONF2_CRYSTAL        FIELD16(0x0600)
 
 /*
  * EEPROM LNA
@@ -2792,7 +2792,7 @@ enum rt2800_eeprom_word {
 #define MCU_CURRENT                     0x36
 #define MCU_LED                         0x50
 #define MCU_LED_STRENGTH                0x51
-#define MCU_LED_AG_CONF         0x52
+#define MCU_LED_AG_CONF                 0x52
 #define MCU_LED_ACT_CONF                0x53
 #define MCU_LED_LED_POLARITY            0x54
 #define MCU_RADAR                       0x60
@@ -2801,7 +2801,7 @@ enum rt2800_eeprom_word {
 #define MCU_FREQ_OFFSET                 0x74
 #define MCU_BBP_SIGNAL                  0x80
 #define MCU_POWER_SAVE                  0x83
-#define MCU_BAND_SELECT         0x91
+#define MCU_BAND_SELECT                 0x91
 
 /*
  * MCU mailbox tokens
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 25aaa5e12d4e..aa8789423937 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -278,12 +278,9 @@ static const unsigned int rt2800_eeprom_map_ext[EEPROM_WORD_COUNT] = {
         [EEPROM_LNA]                    = 0x0026,
         [EEPROM_EXT_LNA2]               = 0x0027,
         [EEPROM_RSSI_BG]                = 0x0028,
-        [EEPROM_TXPOWER_DELTA]          = 0x0028, /* Overlaps with RSSI_BG */
         [EEPROM_RSSI_BG2]               = 0x0029,
-        [EEPROM_TXMIXER_GAIN_BG]        = 0x0029, /* Overlaps with RSSI_BG2 */
         [EEPROM_RSSI_A]                 = 0x002a,
         [EEPROM_RSSI_A2]                = 0x002b,
-        [EEPROM_TXMIXER_GAIN_A]         = 0x002b, /* Overlaps with RSSI_A2 */
         [EEPROM_TXPOWER_BG1]            = 0x0030,
         [EEPROM_TXPOWER_BG2]            = 0x0037,
         [EEPROM_EXT_TXPOWER_BG3]        = 0x003e,
@@ -1783,7 +1780,7 @@ void rt2800_config_ant(struct rt2x00_dev *rt2x00dev, struct antenna_setup *ant)
         rt2800_bbp_read(rt2x00dev, 3, &r3);
 
         if (rt2x00_rt(rt2x00dev, RT3572) &&
-            test_bit(CAPABILITY_BT_COEXIST, &rt2x00dev->cap_flags))
+            rt2x00_has_cap_bt_coexist(rt2x00dev))
                 rt2800_config_3572bt_ant(rt2x00dev);
 
         /*
@@ -1795,7 +1792,7 @@ void rt2800_config_ant(struct rt2x00_dev *rt2x00dev, struct antenna_setup *ant)
                 break;
         case 2:
                 if (rt2x00_rt(rt2x00dev, RT3572) &&
-                    test_bit(CAPABILITY_BT_COEXIST, &rt2x00dev->cap_flags))
+                    rt2x00_has_cap_bt_coexist(rt2x00dev))
                         rt2x00_set_field8(&r1, BBP1_TX_ANTENNA, 1);
                 else
                         rt2x00_set_field8(&r1, BBP1_TX_ANTENNA, 2);
@@ -1825,7 +1822,7 @@ void rt2800_config_ant(struct rt2x00_dev *rt2x00dev, struct antenna_setup *ant)
                 break;
         case 2:
                 if (rt2x00_rt(rt2x00dev, RT3572) &&
-                    test_bit(CAPABILITY_BT_COEXIST, &rt2x00dev->cap_flags)) {
+                    rt2x00_has_cap_bt_coexist(rt2x00dev)) {
                         rt2x00_set_field8(&r3, BBP3_RX_ADC, 1);
                         rt2x00_set_field8(&r3, BBP3_RX_ANTENNA,
                                 rt2x00dev->curr_band == IEEE80211_BAND_5GHZ);
@@ -2029,13 +2026,6 @@ static void rt2800_config_channel_rf3xxx(struct rt2x00_dev *rt2x00dev,
                           rt2x00dev->default_ant.tx_chain_num <= 2);
         rt2800_rfcsr_write(rt2x00dev, 1, rfcsr);
 
-        rt2800_rfcsr_read(rt2x00dev, 30, &rfcsr);
-        rt2x00_set_field8(&rfcsr, RFCSR30_RF_CALIBRATION, 1);
-        rt2800_rfcsr_write(rt2x00dev, 30, rfcsr);
-        msleep(1);
-        rt2x00_set_field8(&rfcsr, RFCSR30_RF_CALIBRATION, 0);
-        rt2800_rfcsr_write(rt2x00dev, 30, rfcsr);
-
         rt2800_rfcsr_read(rt2x00dev, 23, &rfcsr);
         rt2x00_set_field8(&rfcsr, RFCSR23_FREQ_OFFSET, rt2x00dev->freq_offset);
         rt2800_rfcsr_write(rt2x00dev, 23, rfcsr);
@@ -2141,7 +2131,7 @@ static void rt2800_config_channel_rf3052(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field8(&rfcsr, RFCSR1_TX1_PD, 0);
         rt2x00_set_field8(&rfcsr, RFCSR1_RX2_PD, 0);
         rt2x00_set_field8(&rfcsr, RFCSR1_TX2_PD, 0);
-        if (test_bit(CAPABILITY_BT_COEXIST, &rt2x00dev->cap_flags)) {
+        if (rt2x00_has_cap_bt_coexist(rt2x00dev)) {
                 if (rf->channel <= 14) {
                         rt2x00_set_field8(&rfcsr, RFCSR1_RX0_PD, 1);
                         rt2x00_set_field8(&rfcsr, RFCSR1_TX0_PD, 1);
@@ -2674,7 +2664,7 @@ static void rt2800_config_channel_rf53xx(struct rt2x00_dev *rt2x00dev,
         if (rf->channel <= 14) {
                 int idx = rf->channel-1;
 
-                if (test_bit(CAPABILITY_BT_COEXIST, &rt2x00dev->cap_flags)) {
+                if (rt2x00_has_cap_bt_coexist(rt2x00dev)) {
                         if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F)) {
                                 /* r55/r59 value array of channel 1~14 */
                                 static const char r55_bt_rev[] = {0x83, 0x83,
@@ -3220,8 +3210,7 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
         if (rf->channel <= 14) {
                 if (!rt2x00_rt(rt2x00dev, RT5390) &&
                     !rt2x00_rt(rt2x00dev, RT5392)) {
-                        if (test_bit(CAPABILITY_EXTERNAL_LNA_BG,
-                                     &rt2x00dev->cap_flags)) {
+                        if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
                                 rt2800_bbp_write(rt2x00dev, 82, 0x62);
                                 rt2800_bbp_write(rt2x00dev, 75, 0x46);
                         } else {
@@ -3246,7 +3235,7 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
                 if (rt2x00_rt(rt2x00dev, RT3593))
                         rt2800_bbp_write(rt2x00dev, 83, 0x9a);
 
-                if (test_bit(CAPABILITY_EXTERNAL_LNA_A, &rt2x00dev->cap_flags))
+                if (rt2x00_has_cap_external_lna_a(rt2x00dev))
                         rt2800_bbp_write(rt2x00dev, 75, 0x46);
                 else
                         rt2800_bbp_write(rt2x00dev, 75, 0x50);
@@ -3282,7 +3271,7 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
                 /* Turn on primary PAs */
                 rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_A0_EN,
                                    rf->channel > 14);
-                if (test_bit(CAPABILITY_BT_COEXIST, &rt2x00dev->cap_flags))
+                if (rt2x00_has_cap_bt_coexist(rt2x00dev))
                         rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_G0_EN, 1);
                 else
                         rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_G0_EN,
@@ -3313,9 +3302,18 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
 
         rt2800_register_write(rt2x00dev, TX_PIN_CFG, tx_pin);
 
-        if (rt2x00_rt(rt2x00dev, RT3572))
+        if (rt2x00_rt(rt2x00dev, RT3572)) {
                 rt2800_rfcsr_write(rt2x00dev, 8, 0x80);
 
+                /* AGC init */
+                if (rf->channel <= 14)
+                        reg = 0x1c + (2 * rt2x00dev->lna_gain);
+                else
+                        reg = 0x22 + ((rt2x00dev->lna_gain * 5) / 3);
+
+                rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, reg);
+        }
+
         if (rt2x00_rt(rt2x00dev, RT3593)) {
                 rt2800_register_read(rt2x00dev, GPIO_CTRL, &reg);
 
@@ -3575,7 +3573,7 @@ static int rt2800_get_txpower_reg_delta(struct rt2x00_dev *rt2x00dev,
 {
         int delta;
 
-        if (test_bit(CAPABILITY_POWER_LIMIT, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_power_limit(rt2x00dev))
                 return 0;
 
         /*
@@ -3604,7 +3602,7 @@ static u8 rt2800_compensate_txpower(struct rt2x00_dev *rt2x00dev, int is_rate_b,
         if (rt2x00_rt(rt2x00dev, RT3593))
                 return min_t(u8, txpower, 0xc);
 
-        if (test_bit(CAPABILITY_POWER_LIMIT, &rt2x00dev->cap_flags)) {
+        if (rt2x00_has_cap_power_limit(rt2x00dev)) {
                 /*
                  * Check if eirp txpower exceed txpower_limit.
                  * We use OFDM 6M as criterion and its eirp txpower
@@ -4416,6 +4414,7 @@ static u8 rt2800_get_default_vgc(struct rt2x00_dev *rt2x00dev)
                     rt2x00_rt(rt2x00dev, RT3290) ||
                     rt2x00_rt(rt2x00dev, RT3390) ||
                     rt2x00_rt(rt2x00dev, RT3572) ||
+                    rt2x00_rt(rt2x00dev, RT3593) ||
                     rt2x00_rt(rt2x00dev, RT5390) ||
                     rt2x00_rt(rt2x00dev, RT5392) ||
                     rt2x00_rt(rt2x00dev, RT5592))
@@ -4423,8 +4422,8 @@ static u8 rt2800_get_default_vgc(struct rt2x00_dev *rt2x00dev)
                 else
                         vgc = 0x2e + rt2x00dev->lna_gain;
         } else { /* 5GHZ band */
-                if (rt2x00_rt(rt2x00dev, RT3572))
-                        vgc = 0x22 + (rt2x00dev->lna_gain * 5) / 3;
+                if (rt2x00_rt(rt2x00dev, RT3593))
+                        vgc = 0x20 + (rt2x00dev->lna_gain * 5) / 3;
                 else if (rt2x00_rt(rt2x00dev, RT5592))
                         vgc = 0x24 + (2 * rt2x00dev->lna_gain);
                 else {
@@ -4442,11 +4441,17 @@ static inline void rt2800_set_vgc(struct rt2x00_dev *rt2x00dev,
                                   struct link_qual *qual, u8 vgc_level)
 {
         if (qual->vgc_level != vgc_level) {
-                if (rt2x00_rt(rt2x00dev, RT5592)) {
+                if (rt2x00_rt(rt2x00dev, RT3572) ||
+                    rt2x00_rt(rt2x00dev, RT3593)) {
+                        rt2800_bbp_write_with_rx_chain(rt2x00dev, 66,
+                                                       vgc_level);
+                } else if (rt2x00_rt(rt2x00dev, RT5592)) {
                         rt2800_bbp_write(rt2x00dev, 83, qual->rssi > -65 ? 0x4a : 0x7a);
                         rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, vgc_level);
-                } else
+                } else {
                         rt2800_bbp_write(rt2x00dev, 66, vgc_level);
+                }
+
                 qual->vgc_level = vgc_level;
                 qual->vgc_level_reg = vgc_level;
         }
@@ -4465,17 +4470,35 @@ void rt2800_link_tuner(struct rt2x00_dev *rt2x00dev, struct link_qual *qual,
 
         if (rt2x00_rt_rev(rt2x00dev, RT2860, REV_RT2860C))
                 return;
-        /*
-         * When RSSI is better then -80 increase VGC level with 0x10, except
-         * for rt5592 chip.
+
+        /* When RSSI is better than a certain threshold, increase VGC
+         * with a chip specific value in order to improve the balance
+         * between sensibility and noise isolation.
          */
 
         vgc = rt2800_get_default_vgc(rt2x00dev);
 
-        if (rt2x00_rt(rt2x00dev, RT5592) && qual->rssi > -65)
-                vgc += 0x20;
-        else if (qual->rssi > -80)
-                vgc += 0x10;
+        switch (rt2x00dev->chip.rt) {
+        case RT3572:
+        case RT3593:
+                if (qual->rssi > -65) {
+                        if (rt2x00dev->curr_band == IEEE80211_BAND_2GHZ)
+                                vgc += 0x20;
+                        else
+                                vgc += 0x10;
+                }
+                break;
+
+        case RT5592:
+                if (qual->rssi > -65)
+                        vgc += 0x20;
+                break;
+
+        default:
+                if (qual->rssi > -80)
+                        vgc += 0x10;
+                break;
+        }
 
         rt2800_set_vgc(rt2x00dev, qual, vgc);
 }
@@ -5500,7 +5523,7 @@ static void rt2800_init_bbp_53xx(struct rt2x00_dev *rt2x00dev)
         ant = (div_mode == 3) ? 1 : 0;
 
         /* check if this is a Bluetooth combo card */
-        if (test_bit(CAPABILITY_BT_COEXIST, &rt2x00dev->cap_flags)) {
+        if (rt2x00_has_cap_bt_coexist(rt2x00dev)) {
                 u32 reg;
 
                 rt2800_register_read(rt2x00dev, GPIO_CTRL, &reg);
@@ -5809,7 +5832,7 @@ static void rt2800_normal_mode_setup_3xxx(struct rt2x00_dev *rt2x00dev)
             rt2x00_rt_rev_lt(rt2x00dev, RT3071, REV_RT3071E) ||
             rt2x00_rt_rev_lt(rt2x00dev, RT3090, REV_RT3090E) ||
             rt2x00_rt_rev_lt(rt2x00dev, RT3390, REV_RT3390E)) {
-                if (!test_bit(CAPABILITY_EXTERNAL_LNA_BG, &rt2x00dev->cap_flags))
+                if (!rt2x00_has_cap_external_lna_bg(rt2x00dev))
                         rt2x00_set_field8(&rfcsr, RFCSR17_R, 1);
         }
 
@@ -6452,7 +6475,7 @@ static void rt2800_init_rfcsr_5390(struct rt2x00_dev *rt2x00dev)
         rt2800_rfcsr_write(rt2x00dev, 28, 0x00);
         rt2800_rfcsr_write(rt2x00dev, 29, 0x10);
 
-        rt2800_rfcsr_write(rt2x00dev, 30, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 30, 0x10);
         rt2800_rfcsr_write(rt2x00dev, 31, 0x80);
         rt2800_rfcsr_write(rt2x00dev, 32, 0x80);
         rt2800_rfcsr_write(rt2x00dev, 33, 0x00);
@@ -6490,7 +6513,7 @@ static void rt2800_init_rfcsr_5390(struct rt2x00_dev *rt2x00dev)
         rt2800_rfcsr_write(rt2x00dev, 56, 0x22);
         rt2800_rfcsr_write(rt2x00dev, 57, 0x80);
         rt2800_rfcsr_write(rt2x00dev, 58, 0x7f);
-        rt2800_rfcsr_write(rt2x00dev, 59, 0x63);
+        rt2800_rfcsr_write(rt2x00dev, 59, 0x8f);
 
         rt2800_rfcsr_write(rt2x00dev, 60, 0x45);
         if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F))
@@ -6510,7 +6533,6 @@ static void rt2800_init_rfcsr_5392(struct rt2x00_dev *rt2x00dev)
         rt2800_rf_init_calibration(rt2x00dev, 2);
 
         rt2800_rfcsr_write(rt2x00dev, 1, 0x17);
-        rt2800_rfcsr_write(rt2x00dev, 2, 0x80);
         rt2800_rfcsr_write(rt2x00dev, 3, 0x88);
         rt2800_rfcsr_write(rt2x00dev, 5, 0x10);
         rt2800_rfcsr_write(rt2x00dev, 6, 0xe0);
@@ -7224,7 +7246,7 @@ static const struct rf_channel rf_vals[] = {
 
 /*
  * RF value list for rt3xxx
- * Supports: 2.4 GHz (all) & 5.2 GHz (RF3052)
+ * Supports: 2.4 GHz (all) & 5.2 GHz (RF3052 & RF3053)
  */
 static const struct rf_channel rf_vals_3x[] = {
         {1,  241, 2, 2 },
@@ -7420,72 +7442,6 @@ static const struct rf_channel rf_vals_5592_xtal40[] = {
         {196, 83, 0, 12, 1},
 };
 
-static const struct rf_channel rf_vals_3053[] = {
-        /* Channel, N, R, K */
-        {1, 241, 2, 2},
-        {2, 241, 2, 7},
-        {3, 242, 2, 2},
-        {4, 242, 2, 7},
-        {5, 243, 2, 2},
-        {6, 243, 2, 7},
-        {7, 244, 2, 2},
-        {8, 244, 2, 7},
-        {9, 245, 2, 2},
-        {10, 245, 2, 7},
-        {11, 246, 2, 2},
-        {12, 246, 2, 7},
-        {13, 247, 2, 2},
-        {14, 248, 2, 4},
-
-        {36, 0x56, 0, 4},
-        {38, 0x56, 0, 6},
-        {40, 0x56, 0, 8},
-        {44, 0x57, 0, 0},
-        {46, 0x57, 0, 2},
-        {48, 0x57, 0, 4},
-        {52, 0x57, 0, 8},
-        {54, 0x57, 0, 10},
-        {56, 0x58, 0, 0},
-        {60, 0x58, 0, 4},
-        {62, 0x58, 0, 6},
-        {64, 0x58, 0, 8},
-
-        {100, 0x5B, 0, 8},
-        {102, 0x5B, 0, 10},
-        {104, 0x5C, 0, 0},
-        {108, 0x5C, 0, 4},
-        {110, 0x5C, 0, 6},
-        {112, 0x5C, 0, 8},
-
-        /* NOTE: Channel 114 has been removed intentionally.
-         * The EEPROM contains no TX power values for that,
-         * and it is disabled in the vendor driver as well.
-         */
-
-        {116, 0x5D, 0, 0},
-        {118, 0x5D, 0, 2},
-        {120, 0x5D, 0, 4},
-        {124, 0x5D, 0, 8},
-        {126, 0x5D, 0, 10},
-        {128, 0x5E, 0, 0},
-        {132, 0x5E, 0, 4},
-        {134, 0x5E, 0, 6},
-        {136, 0x5E, 0, 8},
-        {140, 0x5F, 0, 0},
-
-        {149, 0x5F, 0, 9},
-        {151, 0x5F, 0, 11},
-        {153, 0x60, 0, 1},
-        {157, 0x60, 0, 5},
-        {159, 0x60, 0, 7},
-        {161, 0x60, 0, 9},
-        {165, 0x61, 0, 1},
-        {167, 0x61, 0, 3},
-        {169, 0x61, 0, 5},
-        {171, 0x61, 0, 7},
-        {173, 0x61, 0, 9},
-};
-
 static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 {
         struct hw_mode_spec *spec = &rt2x00dev->spec;
@@ -7575,14 +7531,11 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
                    rt2x00_rf(rt2x00dev, RF5392)) {
                 spec->num_channels = 14;
                 spec->channels = rf_vals_3x;
-        } else if (rt2x00_rf(rt2x00dev, RF3052)) {
+        } else if (rt2x00_rf(rt2x00dev, RF3052) ||
+                   rt2x00_rf(rt2x00dev, RF3053)) {
                 spec->supported_bands |= SUPPORT_BAND_5GHZ;
                 spec->num_channels = ARRAY_SIZE(rf_vals_3x);
                 spec->channels = rf_vals_3x;
-        } else if (rt2x00_rf(rt2x00dev, RF3053)) {
-                spec->supported_bands |= SUPPORT_BAND_5GHZ;
-                spec->num_channels = ARRAY_SIZE(rf_vals_3053);
-                spec->channels = rf_vals_3053;
         } else if (rt2x00_rf(rt2x00dev, RF5592)) {
                 spec->supported_bands |= SUPPORT_BAND_5GHZ;
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index fe4c572db52c..e4ba2ce0f212 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -39,6 +39,7 @@
 #include <linux/input-polldev.h>
 #include <linux/kfifo.h>
 #include <linux/hrtimer.h>
+#include <linux/average.h>
 
 #include <net/mac80211.h>
 
@@ -138,17 +139,6 @@
 #define SHORT_EIFS              ( SIFS + SHORT_DIFS + \
                                   GET_DURATION(IEEE80211_HEADER + ACK_SIZE, 10) )
 
-/*
- * Structure for average calculation
- * The avg field contains the actual average value,
- * but avg_weight is internally used during calculations
- * to prevent rounding errors.
- */
-struct avg_val {
-        int avg;
-        int avg_weight;
-};
-
 enum rt2x00_chip_intf {
         RT2X00_CHIP_INTF_PCI,
         RT2X00_CHIP_INTF_PCIE,
@@ -297,7 +287,7 @@ struct link_ant {
          * Similar to the avg_rssi in the link_qual structure
          * this value is updated by using the walking average.
          */
-        struct avg_val rssi_ant;
+        struct ewma rssi_ant;
 };
 
 /*
@@ -326,7 +316,7 @@ struct link {
         /*
          * Currently active average RSSI value
          */
-        struct avg_val avg_rssi;
+        struct ewma avg_rssi;
 
         /*
          * Work structure for scheduling periodic link tuning.
@@ -1179,6 +1169,93 @@ static inline bool rt2x00_is_soc(struct rt2x00_dev *rt2x00dev)
         return rt2x00_intf(rt2x00dev, RT2X00_CHIP_INTF_SOC);
 }
 
+/* Helpers for capability flags */
+
+static inline bool
+rt2x00_has_cap_flag(struct rt2x00_dev *rt2x00dev,
+                    enum rt2x00_capability_flags cap_flag)
+{
+        return test_bit(cap_flag, &rt2x00dev->cap_flags);
+}
+
+static inline bool
+rt2x00_has_cap_hw_crypto(struct rt2x00_dev *rt2x00dev)
+{
+        return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_HW_CRYPTO);
+}
+
+static inline bool
+rt2x00_has_cap_power_limit(struct rt2x00_dev *rt2x00dev)
+{
+        return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_POWER_LIMIT);
+}
+
+static inline bool
+rt2x00_has_cap_control_filters(struct rt2x00_dev *rt2x00dev)
+{
+        return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_CONTROL_FILTERS);
+}
+
+static inline bool
+rt2x00_has_cap_control_filter_pspoll(struct rt2x00_dev *rt2x00dev)
+{
+        return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_CONTROL_FILTER_PSPOLL);
+}
+
+static inline bool
+rt2x00_has_cap_pre_tbtt_interrupt(struct rt2x00_dev *rt2x00dev)
+{
+        return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_PRE_TBTT_INTERRUPT);
+}
+
+static inline bool
+rt2x00_has_cap_link_tuning(struct rt2x00_dev *rt2x00dev)
+{
+        return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_LINK_TUNING);
+}
+
+static inline bool
+rt2x00_has_cap_frame_type(struct rt2x00_dev *rt2x00dev)
+{
+        return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_FRAME_TYPE);
+}
+
+static inline bool
+rt2x00_has_cap_rf_sequence(struct rt2x00_dev *rt2x00dev)
+{
+        return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_RF_SEQUENCE);
+}
+
+static inline bool
+rt2x00_has_cap_external_lna_a(struct rt2x00_dev *rt2x00dev)
+{
+        return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_EXTERNAL_LNA_A);
+}
+
+static inline bool
+rt2x00_has_cap_external_lna_bg(struct rt2x00_dev *rt2x00dev)
+{
+        return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_EXTERNAL_LNA_BG);
+}
+
+static inline bool
+rt2x00_has_cap_double_antenna(struct rt2x00_dev *rt2x00dev)
+{
+        return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_DOUBLE_ANTENNA);
+}
+
+static inline bool
+rt2x00_has_cap_bt_coexist(struct rt2x00_dev *rt2x00dev)
+{
+        return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_BT_COEXIST);
+}
+
+static inline bool
+rt2x00_has_cap_vco_recalibration(struct rt2x00_dev *rt2x00dev)
+{
+        return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_VCO_RECALIBRATION);
+}
+
 /**
  * rt2x00queue_map_txskb - Map a skb into DMA for TX purposes.
  * @entry: Pointer to &struct queue_entry
diff --git a/drivers/net/wireless/rt2x00/rt2x00crypto.c b/drivers/net/wireless/rt2x00/rt2x00crypto.c
index 1ca4c7ffc189..3db0d99d9da7 100644
--- a/drivers/net/wireless/rt2x00/rt2x00crypto.c
+++ b/drivers/net/wireless/rt2x00/rt2x00crypto.c
@@ -52,7 +52,7 @@ void rt2x00crypto_create_tx_descriptor(struct rt2x00_dev *rt2x00dev,
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
         struct ieee80211_key_conf *hw_key = tx_info->control.hw_key;
 
-        if (!test_bit(CAPABILITY_HW_CRYPTO, &rt2x00dev->cap_flags) || !hw_key)
+        if (!rt2x00_has_cap_hw_crypto(rt2x00dev) || !hw_key)
                 return;
 
         __set_bit(ENTRY_TXD_ENCRYPT, &txdesc->flags);
@@ -80,7 +80,7 @@ unsigned int rt2x00crypto_tx_overhead(struct rt2x00_dev *rt2x00dev,
         struct ieee80211_key_conf *key = tx_info->control.hw_key;
         unsigned int overhead = 0;
 
-        if (!test_bit(CAPABILITY_HW_CRYPTO, &rt2x00dev->cap_flags) || !key)
+        if (!rt2x00_has_cap_hw_crypto(rt2x00dev) || !key)
                 return overhead;
 
         /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00debug.c b/drivers/net/wireless/rt2x00/rt2x00debug.c
index fe7a7f63a9ed..7f7baae5ae02 100644
--- a/drivers/net/wireless/rt2x00/rt2x00debug.c
+++ b/drivers/net/wireless/rt2x00/rt2x00debug.c
@@ -750,7 +750,7 @@ void rt2x00debug_register(struct rt2x00_dev *rt2x00dev)
                                 intf, &rt2x00debug_fop_queue_stats);
 
 #ifdef CONFIG_RT2X00_LIB_CRYPTO
-        if (test_bit(CAPABILITY_HW_CRYPTO, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_hw_crypto(rt2x00dev))
                 intf->crypto_stats_entry =
                     debugfs_create_file("crypto", S_IRUGO, intf->queue_folder,
                                         intf, &rt2x00debug_fop_crypto_stats);
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 712eea9d398f..080b1fcae5fa 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -88,7 +88,7 @@ int rt2x00lib_enable_radio(struct rt2x00_dev *rt2x00dev)
         rt2x00queue_start_queues(rt2x00dev);
         rt2x00link_start_tuner(rt2x00dev);
         rt2x00link_start_agc(rt2x00dev);
-        if (test_bit(CAPABILITY_VCO_RECALIBRATION, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_vco_recalibration(rt2x00dev))
                 rt2x00link_start_vcocal(rt2x00dev);
 
         /*
@@ -113,7 +113,7 @@ void rt2x00lib_disable_radio(struct rt2x00_dev *rt2x00dev)
          * Stop all queues
          */
         rt2x00link_stop_agc(rt2x00dev);
-        if (test_bit(CAPABILITY_VCO_RECALIBRATION, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_vco_recalibration(rt2x00dev))
                 rt2x00link_stop_vcocal(rt2x00dev);
         rt2x00link_stop_tuner(rt2x00dev);
         rt2x00queue_stop_queues(rt2x00dev);
@@ -234,7 +234,7 @@ void rt2x00lib_beacondone(struct rt2x00_dev *rt2x00dev)
          * here as they will fetch the next beacon directly prior to
          * transmission.
          */
-        if (test_bit(CAPABILITY_PRE_TBTT_INTERRUPT, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_pre_tbtt_interrupt(rt2x00dev))
                 return;
 
         /* fetch next beacon */
@@ -358,7 +358,7 @@ void rt2x00lib_txdone(struct queue_entry *entry,
          * mac80211 will expect the same data to be present it the
          * frame as it was passed to us.
          */
-        if (test_bit(CAPABILITY_HW_CRYPTO, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_hw_crypto(rt2x00dev))
                 rt2x00crypto_tx_insert_iv(entry->skb, header_length);
 
         /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00link.c b/drivers/net/wireless/rt2x00/rt2x00link.c
index 8368aab86f28..c2b3b6629188 100644
--- a/drivers/net/wireless/rt2x00/rt2x00link.c
+++ b/drivers/net/wireless/rt2x00/rt2x00link.c
@@ -35,50 +35,28 @@
  */
 #define DEFAULT_RSSI            -128
 
-/*
- * Helper struct and macro to work with moving/walking averages.
- * When adding a value to the average value the following calculation
- * is needed:
- *
- *        avg_rssi = ((avg_rssi * 7) + rssi) / 8;
- *
- * The advantage of this approach is that we only need 1 variable
- * to store the average in (No need for a count and a total).
- * But more importantly, normal average values will over time
- * move less and less towards newly added values this results
- * that with link tuning, the device can have a very good RSSI
- * for a few minutes but when the device is moved away from the AP
- * the average will not decrease fast enough to compensate.
- * The walking average compensates this and will move towards
- * the new values correctly allowing a effective link tuning,
- * the speed of the average moving towards other values depends
- * on the value for the number of samples. The higher the number
- * of samples, the slower the average will move.
- * We use two variables to keep track of the average value to
- * compensate for the rounding errors. This can be a significant
- * error (>5dBm) if the factor is too low.
- */
-#define AVG_SAMPLES     8
-#define AVG_FACTOR      1000
-#define MOVING_AVERAGE(__avg, __val) \
-({ \
-        struct avg_val __new; \
-        __new.avg_weight = \
-            (__avg).avg_weight  ? \
-                ((((__avg).avg_weight * ((AVG_SAMPLES) - 1)) + \
-                  ((__val) * (AVG_FACTOR))) / \
-                 (AVG_SAMPLES)) : \
-                ((__val) * (AVG_FACTOR)); \
-        __new.avg = __new.avg_weight / (AVG_FACTOR); \
-        __new; \
-})
+/* Constants for EWMA calculations. */
+#define RT2X00_EWMA_FACTOR      1024
+#define RT2X00_EWMA_WEIGHT      8
+
+static inline int rt2x00link_get_avg_rssi(struct ewma *ewma)
+{
+        unsigned long avg;
+
+        avg = ewma_read(ewma);
+        if (avg)
+                return -avg;
+
+        return DEFAULT_RSSI;
+}
 
 static int rt2x00link_antenna_get_link_rssi(struct rt2x00_dev *rt2x00dev)
 {
         struct link_ant *ant = &rt2x00dev->link.ant;
 
-        if (ant->rssi_ant.avg && rt2x00dev->link.qual.rx_success)
-                return ant->rssi_ant.avg;
+        if (rt2x00dev->link.qual.rx_success)
+                return rt2x00link_get_avg_rssi(&ant->rssi_ant);
+
         return DEFAULT_RSSI;
 }
 
@@ -100,8 +78,8 @@ static void rt2x00link_antenna_update_rssi_history(struct rt2x00_dev *rt2x00dev,
 
 static void rt2x00link_antenna_reset(struct rt2x00_dev *rt2x00dev)
 {
-        rt2x00dev->link.ant.rssi_ant.avg = 0;
-        rt2x00dev->link.ant.rssi_ant.avg_weight = 0;
+        ewma_init(&rt2x00dev->link.ant.rssi_ant, RT2X00_EWMA_FACTOR,
+                  RT2X00_EWMA_WEIGHT);
 }
 
 static void rt2x00lib_antenna_diversity_sample(struct rt2x00_dev *rt2x00dev)
@@ -249,12 +227,12 @@ void rt2x00link_update_stats(struct rt2x00_dev *rt2x00dev,
         /*
          * Update global RSSI
          */
-        link->avg_rssi = MOVING_AVERAGE(link->avg_rssi, rxdesc->rssi);
+        ewma_add(&link->avg_rssi, -rxdesc->rssi);
 
         /*
          * Update antenna RSSI
          */
-        ant->rssi_ant = MOVING_AVERAGE(ant->rssi_ant, rxdesc->rssi);
+        ewma_add(&ant->rssi_ant, -rxdesc->rssi);
 }
 
 void rt2x00link_start_tuner(struct rt2x00_dev *rt2x00dev)
@@ -309,6 +287,8 @@ void rt2x00link_reset_tuner(struct rt2x00_dev *rt2x00dev, bool antenna)
          */
         rt2x00dev->link.count = 0;
         memset(qual, 0, sizeof(*qual));
+        ewma_init(&rt2x00dev->link.avg_rssi, RT2X00_EWMA_FACTOR,
+                  RT2X00_EWMA_WEIGHT);
 
         /*
          * Restore the VGC level as stored in the registers,
@@ -363,17 +343,17 @@ static void rt2x00link_tuner(struct work_struct *work)
          * collect the RSSI data we could use this. Otherwise we
          * must fallback to the default RSSI value.
          */
-        if (!link->avg_rssi.avg || !qual->rx_success)
+        if (!qual->rx_success)
                 qual->rssi = DEFAULT_RSSI;
         else
-                qual->rssi = link->avg_rssi.avg;
+                qual->rssi = rt2x00link_get_avg_rssi(&link->avg_rssi);
 
         /*
          * Check if link tuning is supported by the hardware, some hardware
          * do not support link tuning at all, while other devices can disable
          * the feature from the EEPROM.
          */
-        if (test_bit(CAPABILITY_LINK_TUNING, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_link_tuning(rt2x00dev))
                 rt2x00dev->ops->lib->link_tuner(rt2x00dev, qual, link->count);
 
         /*
@@ -513,7 +493,7 @@ static void rt2x00link_vcocal(struct work_struct *work)
 void rt2x00link_register(struct rt2x00_dev *rt2x00dev)
 {
         INIT_DELAYED_WORK(&rt2x00dev->link.agc_work, rt2x00link_agc);
-        if (test_bit(CAPABILITY_VCO_RECALIBRATION, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_vco_recalibration(rt2x00dev))
                 INIT_DELAYED_WORK(&rt2x00dev->link.vco_work, rt2x00link_vcocal);
         INIT_DELAYED_WORK(&rt2x00dev->link.watchdog_work, rt2x00link_watchdog);
         INIT_DELAYED_WORK(&rt2x00dev->link.work, rt2x00link_tuner);
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index f883802f3505..51f17cfb93f9 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -382,11 +382,11 @@ void rt2x00mac_configure_filter(struct ieee80211_hw *hw,
          * of different types, but has no a separate filter for PS Poll frames,
          * FIF_CONTROL flag implies FIF_PSPOLL.
          */
-        if (!test_bit(CAPABILITY_CONTROL_FILTERS, &rt2x00dev->cap_flags)) {
+        if (!rt2x00_has_cap_control_filters(rt2x00dev)) {
                 if (*total_flags & FIF_CONTROL || *total_flags & FIF_PSPOLL)
                         *total_flags |= FIF_CONTROL | FIF_PSPOLL;
         }
-        if (!test_bit(CAPABILITY_CONTROL_FILTER_PSPOLL, &rt2x00dev->cap_flags)) {
+        if (!rt2x00_has_cap_control_filter_pspoll(rt2x00dev)) {
                 if (*total_flags & FIF_CONTROL)
                         *total_flags |= FIF_PSPOLL;
         }
@@ -469,7 +469,7 @@ int rt2x00mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
                 return 0;
 
-        if (!test_bit(CAPABILITY_HW_CRYPTO, &rt2x00dev->cap_flags))
+        if (!rt2x00_has_cap_hw_crypto(rt2x00dev))
                 return -EOPNOTSUPP;
 
         /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
index dc49e525ae5e..25da20e7e1f3 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.c
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
@@ -119,7 +119,7 @@ int rt2x00pci_probe(struct pci_dev *pci_dev, const struct rt2x00_ops *ops)
         rt2x00dev->ops = ops;
         rt2x00dev->hw = hw;
         rt2x00dev->irq = pci_dev->irq;
-        rt2x00dev->name = pci_name(pci_dev);
+        rt2x00dev->name = ops->name;
 
         if (pci_is_pcie(pci_dev))
                 rt2x00_set_chip_intf(rt2x00dev, RT2X00_CHIP_INTF_PCIE);
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 6c8a33b6ee22..50590b1420a5 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -61,7 +61,7 @@ struct sk_buff *rt2x00queue_alloc_rxskb(struct queue_entry *entry, gfp_t gfp)
          * at least 8 bytes bytes available in headroom for IV/EIV
          * and 8 bytes for ICV data as tailroon.
          */
-        if (test_bit(CAPABILITY_HW_CRYPTO, &rt2x00dev->cap_flags)) {
+        if (rt2x00_has_cap_hw_crypto(rt2x00dev)) {
                 head_size += 8;
                 tail_size += 8;
         }
@@ -1033,38 +1033,21 @@ EXPORT_SYMBOL_GPL(rt2x00queue_stop_queue);
 
 void rt2x00queue_flush_queue(struct data_queue *queue, bool drop)
 {
-        bool started;
         bool tx_queue =
                 (queue->qid == QID_AC_VO) ||
                 (queue->qid == QID_AC_VI) ||
                 (queue->qid == QID_AC_BE) ||
                 (queue->qid == QID_AC_BK);
 
-        mutex_lock(&queue->status_lock);
 
         /*
-         * If the queue has been started, we must stop it temporarily
-         * to prevent any new frames to be queued on the device. If
-         * we are not dropping the pending frames, the queue must
-         * only be stopped in the software and not the hardware,
-         * otherwise the queue will never become empty on its own.
+         * If we are not supposed to drop any pending
+         * frames, this means we must force a start (=kick)
+         * to the queue to make sure the hardware will
+         * start transmitting.
          */
-        started = test_bit(QUEUE_STARTED, &queue->flags);
-        if (started) {
-                /*
-                 * Pause the queue
-                 */
-                rt2x00queue_pause_queue(queue);
-
-                /*
-                 * If we are not supposed to drop any pending
-                 * frames, this means we must force a start (=kick)
-                 * to the queue to make sure the hardware will
-                 * start transmitting.
-                 */
-                if (!drop && tx_queue)
-                        queue->rt2x00dev->ops->lib->kick_queue(queue);
-        }
+        if (!drop && tx_queue)
+                queue->rt2x00dev->ops->lib->kick_queue(queue);
 
         /*
          * Check if driver supports flushing, if that is the case we can
@@ -1080,14 +1063,6 @@ void rt2x00queue_flush_queue(struct data_queue *queue, bool drop)
         if (unlikely(!rt2x00queue_empty(queue)))
                 rt2x00_warn(queue->rt2x00dev, "Queue %d failed to flush\n",
                             queue->qid);
-
-        /*
-         * Restore the queue to the previous status
-         */
-        if (started)
-                rt2x00queue_unpause_queue(queue);
-
-        mutex_unlock(&queue->status_lock);
 }
 EXPORT_SYMBOL_GPL(rt2x00queue_flush_queue);
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index 88289873c0cf..4e121627925d 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -523,7 +523,9 @@ static void rt2x00usb_watchdog_tx_dma(struct data_queue *queue)
         rt2x00_warn(queue->rt2x00dev, "TX queue %d DMA timed out, invoke forced forced reset\n",
                     queue->qid);
 
+        rt2x00queue_stop_queue(queue);
         rt2x00queue_flush_queue(queue, true);
+        rt2x00queue_start_queue(queue);
 }
 
 static int rt2x00usb_dma_timeout(struct data_queue *queue)
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index 54d3ddfc9888..a5b69cb49012 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -685,7 +685,7 @@ static void rt61pci_config_antenna_2x(struct rt2x00_dev *rt2x00dev,
 
         rt2x00_set_field8(&r3, BBP_R3_SMART_MODE, rt2x00_rf(rt2x00dev, RF2529));
         rt2x00_set_field8(&r4, BBP_R4_RX_FRAME_END,
-                          !test_bit(CAPABILITY_FRAME_TYPE, &rt2x00dev->cap_flags));
+                          !rt2x00_has_cap_frame_type(rt2x00dev));
 
         /*
          * Configure the RX antenna.
@@ -813,10 +813,10 @@ static void rt61pci_config_ant(struct rt2x00_dev *rt2x00dev,
 
         if (rt2x00dev->curr_band == IEEE80211_BAND_5GHZ) {
                 sel = antenna_sel_a;
-                lna = test_bit(CAPABILITY_EXTERNAL_LNA_A, &rt2x00dev->cap_flags);
+                lna = rt2x00_has_cap_external_lna_a(rt2x00dev);
         } else {
                 sel = antenna_sel_bg;
-                lna = test_bit(CAPABILITY_EXTERNAL_LNA_BG, &rt2x00dev->cap_flags);
+                lna = rt2x00_has_cap_external_lna_bg(rt2x00dev);
         }
 
         for (i = 0; i < ARRAY_SIZE(antenna_sel_a); i++)
@@ -836,7 +836,7 @@ static void rt61pci_config_ant(struct rt2x00_dev *rt2x00dev,
         else if (rt2x00_rf(rt2x00dev, RF2527))
                 rt61pci_config_antenna_2x(rt2x00dev, ant);
         else if (rt2x00_rf(rt2x00dev, RF2529)) {
-                if (test_bit(CAPABILITY_DOUBLE_ANTENNA, &rt2x00dev->cap_flags))
+                if (rt2x00_has_cap_double_antenna(rt2x00dev))
                         rt61pci_config_antenna_2x(rt2x00dev, ant);
                 else
                         rt61pci_config_antenna_2529(rt2x00dev, ant);
@@ -850,13 +850,13 @@ static void rt61pci_config_lna_gain(struct rt2x00_dev *rt2x00dev,
         short lna_gain = 0;
 
         if (libconf->conf->chandef.chan->band == IEEE80211_BAND_2GHZ) {
-                if (test_bit(CAPABILITY_EXTERNAL_LNA_BG, &rt2x00dev->cap_flags))
+                if (rt2x00_has_cap_external_lna_bg(rt2x00dev))
                         lna_gain += 14;
 
                 rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_OFFSET_BG, &eeprom);
                 lna_gain -= rt2x00_get_field16(eeprom, EEPROM_RSSI_OFFSET_BG_1);
         } else {
-                if (test_bit(CAPABILITY_EXTERNAL_LNA_A, &rt2x00dev->cap_flags))
+                if (rt2x00_has_cap_external_lna_a(rt2x00dev))
                         lna_gain += 14;
 
                 rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_OFFSET_A, &eeprom);
@@ -1054,14 +1054,14 @@ static void rt61pci_link_tuner(struct rt2x00_dev *rt2x00dev,
         if (rt2x00dev->curr_band == IEEE80211_BAND_5GHZ) {
                 low_bound = 0x28;
                 up_bound = 0x48;
-                if (test_bit(CAPABILITY_EXTERNAL_LNA_A, &rt2x00dev->cap_flags)) {
+                if (rt2x00_has_cap_external_lna_a(rt2x00dev)) {
                         low_bound += 0x10;
                         up_bound += 0x10;
                 }
         } else {
                 low_bound = 0x20;
                 up_bound = 0x40;
-                if (test_bit(CAPABILITY_EXTERNAL_LNA_BG, &rt2x00dev->cap_flags)) {
+                if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
                         low_bound += 0x10;
                         up_bound += 0x10;
                 }
@@ -2578,7 +2578,7 @@ static int rt61pci_init_eeprom(struct rt2x00_dev *rt2x00dev)
          * eeprom word.
          */
         if (rt2x00_rf(rt2x00dev, RF2529) &&
-            !test_bit(CAPABILITY_DOUBLE_ANTENNA, &rt2x00dev->cap_flags)) {
+            !rt2x00_has_cap_double_antenna(rt2x00dev)) {
                 rt2x00dev->default_ant.rx =
                     ANTENNA_A + rt2x00_get_field16(eeprom, EEPROM_NIC_RX_FIXED);
                 rt2x00dev->default_ant.tx =
@@ -2793,7 +2793,7 @@ static int rt61pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         spec->supported_bands = SUPPORT_BAND_2GHZ;
         spec->supported_rates = SUPPORT_RATE_CCK | SUPPORT_RATE_OFDM;
 
-        if (!test_bit(CAPABILITY_RF_SEQUENCE, &rt2x00dev->cap_flags)) {
+        if (!rt2x00_has_cap_rf_sequence(rt2x00dev)) {
                 spec->num_channels = 14;
                 spec->channels = rf_vals_noseq;
         } else {
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 1d3880e09a13..1baf9c896dcd 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -595,8 +595,8 @@ static void rt73usb_config_antenna_5x(struct rt2x00_dev *rt2x00dev,
         switch (ant->rx) {
         case ANTENNA_HW_DIVERSITY:
                 rt2x00_set_field8(&r4, BBP_R4_RX_ANTENNA_CONTROL, 2);
-                temp = !test_bit(CAPABILITY_FRAME_TYPE, &rt2x00dev->cap_flags)
-                       && (rt2x00dev->curr_band != IEEE80211_BAND_5GHZ);
+                temp = !rt2x00_has_cap_frame_type(rt2x00dev) &&
+                       (rt2x00dev->curr_band != IEEE80211_BAND_5GHZ);
                 rt2x00_set_field8(&r4, BBP_R4_RX_FRAME_END, temp);
                 break;
         case ANTENNA_A:
@@ -636,7 +636,7 @@ static void rt73usb_config_antenna_2x(struct rt2x00_dev *rt2x00dev,
 
         rt2x00_set_field8(&r3, BBP_R3_SMART_MODE, 0);
         rt2x00_set_field8(&r4, BBP_R4_RX_FRAME_END,
-                          !test_bit(CAPABILITY_FRAME_TYPE, &rt2x00dev->cap_flags));
+                          !rt2x00_has_cap_frame_type(rt2x00dev));
 
         /*
          * Configure the RX antenna.
@@ -709,10 +709,10 @@ static void rt73usb_config_ant(struct rt2x00_dev *rt2x00dev,
 
         if (rt2x00dev->curr_band == IEEE80211_BAND_5GHZ) {
                 sel = antenna_sel_a;
-                lna = test_bit(CAPABILITY_EXTERNAL_LNA_A, &rt2x00dev->cap_flags);
+                lna = rt2x00_has_cap_external_lna_a(rt2x00dev);
         } else {
                 sel = antenna_sel_bg;
-                lna = test_bit(CAPABILITY_EXTERNAL_LNA_BG, &rt2x00dev->cap_flags);
+                lna = rt2x00_has_cap_external_lna_bg(rt2x00dev);
         }
 
         for (i = 0; i < ARRAY_SIZE(antenna_sel_a); i++)
@@ -740,7 +740,7 @@ static void rt73usb_config_lna_gain(struct rt2x00_dev *rt2x00dev,
         short lna_gain = 0;
 
         if (libconf->conf->chandef.chan->band == IEEE80211_BAND_2GHZ) {
-                if (test_bit(CAPABILITY_EXTERNAL_LNA_BG, &rt2x00dev->cap_flags))
+                if (rt2x00_has_cap_external_lna_bg(rt2x00dev))
                         lna_gain += 14;
 
                 rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_OFFSET_BG, &eeprom);
@@ -930,7 +930,7 @@ static void rt73usb_link_tuner(struct rt2x00_dev *rt2x00dev,
                 low_bound = 0x28;
                 up_bound = 0x48;
 
-                if (test_bit(CAPABILITY_EXTERNAL_LNA_A, &rt2x00dev->cap_flags)) {
+                if (rt2x00_has_cap_external_lna_a(rt2x00dev)) {
                         low_bound += 0x10;
                         up_bound += 0x10;
                 }
@@ -946,7 +946,7 @@ static void rt73usb_link_tuner(struct rt2x00_dev *rt2x00dev,
                         up_bound = 0x1c;
                 }
 
-                if (test_bit(CAPABILITY_EXTERNAL_LNA_BG, &rt2x00dev->cap_flags)) {
+                if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
                         low_bound += 0x14;
                         up_bound += 0x10;
                 }
@@ -1661,7 +1661,7 @@ static int rt73usb_agc_to_rssi(struct rt2x00_dev *rt2x00dev, int rxd_w1)
         }
 
         if (rt2x00dev->curr_band == IEEE80211_BAND_5GHZ) {
-                if (test_bit(CAPABILITY_EXTERNAL_LNA_A, &rt2x00dev->cap_flags)) {
+                if (rt2x00_has_cap_external_lna_a(rt2x00dev)) {
                         if (lna == 3 || lna == 2)
                                 offset += 10;
                 } else {
diff --git a/drivers/net/wireless/ti/wl1251/wl1251.h b/drivers/net/wireless/ti/wl1251/wl1251.h
index fd02060038de..2c3bd1bff3f6 100644
--- a/drivers/net/wireless/ti/wl1251/wl1251.h
+++ b/drivers/net/wireless/ti/wl1251/wl1251.h
@@ -424,8 +424,8 @@ void wl1251_disable_interrupts(struct wl1251 *wl);
 #define CHIP_ID_1271_PG10                  (0x4030101)
 #define CHIP_ID_1271_PG20                  (0x4030111)
 
-#define WL1251_FW_NAME "wl1251-fw.bin"
-#define WL1251_NVS_NAME "wl1251-nvs.bin"
+#define WL1251_FW_NAME "ti-connectivity/wl1251-fw.bin"
+#define WL1251_NVS_NAME "ti-connectivity/wl1251-nvs.bin"
 
 #define WL1251_POWER_ON_SLEEP 10 /* in milliseconds */
 
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index a5b598a79bec..7c1e1ebc0e23 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -1391,8 +1391,8 @@ struct ieee80211_vht_operation {
 #define IEEE80211_VHT_CAP_RXSTBC_MASK                           0x00000700
 #define IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE                 0x00000800
 #define IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE                 0x00001000
-#define IEEE80211_VHT_CAP_BEAMFORMER_ANTENNAS_MAX               0x00006000
-#define IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MAX               0x00030000
+#define IEEE80211_VHT_CAP_BEAMFORMEE_STS_MAX                    0x0000e000
+#define IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MAX               0x00070000
 #define IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE                 0x00080000
 #define IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE                 0x00100000
 #define IEEE80211_VHT_CAP_VHT_TXOP_PS                           0x00200000
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index cb710913d5c8..45f6bf591104 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -437,6 +437,15 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
                              u32 prohibited_flags);
 
 /**
+ * cfg80211_chandef_dfs_required - checks if radar detection is required
+ * @wiphy: the wiphy to validate against
+ * @chandef: the channel definition to check
+ * Return: 1 if radar detection is required, 0 if it is not, < 0 on error
+ */
+int cfg80211_chandef_dfs_required(struct wiphy *wiphy,
+                                  const struct cfg80211_chan_def *chandef);
+
+/**
  * ieee80211_chandef_rate_flags - returns rate flags for a channel
  *
  * In some channel types, not all rates may be used - for example CCK
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index cc6035f1a2f1..f386c480e134 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -829,6 +829,15 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
  * @RX_FLAG_STBC_MASK: STBC 2 bit bitmask. 1 - Nss=1, 2 - Nss=2, 3 - Nss=3
  * @RX_FLAG_10MHZ: 10 MHz (half channel) was used
  * @RX_FLAG_5MHZ: 5 MHz (quarter channel) was used
+ * @RX_FLAG_AMSDU_MORE: Some drivers may prefer to report separate A-MSDU
+ *      subframes instead of a one huge frame for performance reasons.
+ *      All, but the last MSDU from an A-MSDU should have this flag set. E.g.
+ *      if an A-MSDU has 3 frames, the first 2 must have the flag set, while
+ *      the 3rd (last) one must not have this flag set. The flag is used to
+ *      deal with retransmission/duplication recovery properly since A-MSDU
+ *      subframes share the same sequence number. Reported subframes can be
+ *      either regular MSDU or singly A-MSDUs. Subframes must not be
+ *      interleaved with other frames.
  */
 enum mac80211_rx_flags {
         RX_FLAG_MMIC_ERROR              = BIT(0),
@@ -859,6 +868,7 @@ enum mac80211_rx_flags {
         RX_FLAG_STBC_MASK               = BIT(26) | BIT(27),
         RX_FLAG_10MHZ                   = BIT(28),
         RX_FLAG_5MHZ                    = BIT(29),
+        RX_FLAG_AMSDU_MORE              = BIT(30),
 };
 
 #define RX_FLAG_STBC_SHIFT              26
@@ -1492,6 +1502,11 @@ struct ieee80211_tx_control {
  *
  * @IEEE80211_HW_TIMING_BEACON_ONLY: Use sync timing from beacon frames
  *      only, to allow getting TBTT of a DTIM beacon.
+ *
+ * @IEEE80211_HW_CHANCTX_STA_CSA: Support 802.11h based channel-switch (CSA)
+ *      for a single active channel while using channel contexts. When support
+ *      is not enabled the default action is to disconnect when getting the
+ *      CSA frame.
  */
 enum ieee80211_hw_flags {
         IEEE80211_HW_HAS_RATE_CONTROL                   = 1<<0,
@@ -1522,6 +1537,7 @@ enum ieee80211_hw_flags {
         IEEE80211_HW_P2P_DEV_ADDR_FOR_INTF              = 1<<25,
         IEEE80211_HW_TIMING_BEACON_ONLY                 = 1<<26,
         IEEE80211_HW_SUPPORTS_HT_CCK_RATES              = 1<<27,
+        IEEE80211_HW_CHANCTX_STA_CSA                    = 1<<28,
 };
 
 /**
@@ -2666,6 +2682,10 @@ enum ieee80211_roc_type {
  *      zero using ieee80211_csa_is_complete() after the beacon has been
  *      transmitted and then call ieee80211_csa_finish().
  *
+ * @join_ibss: Join an IBSS (on an IBSS interface); this is called after all
+ *      information in bss_conf is set up and the beacon can be retrieved. A
+ *      channel context is bound before this is called.
+ * @leave_ibss: Leave the IBSS again.
  */
 struct ieee80211_ops {
         void (*tx)(struct ieee80211_hw *hw,
@@ -2857,6 +2877,9 @@ struct ieee80211_ops {
         void (*channel_switch_beacon)(struct ieee80211_hw *hw,
                                       struct ieee80211_vif *vif,
                                       struct cfg80211_chan_def *chandef);
+
+        int (*join_ibss)(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
+        void (*leave_ibss)(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
 };
 
 /**
@@ -3920,6 +3943,25 @@ void ieee80211_iterate_active_interfaces_atomic(struct ieee80211_hw *hw,
                                                 void *data);
 
 /**
+ * ieee80211_iterate_active_interfaces_rtnl - iterate active interfaces
+ *
+ * This function iterates over the interfaces associated with a given
+ * hardware that are currently active and calls the callback for them.
+ * This version can only be used while holding the RTNL.
+ *
+ * @hw: the hardware struct of which the interfaces should be iterated over
+ * @iter_flags: iteration flags, see &enum ieee80211_interface_iteration_flags
+ * @iterator: the iterator function to call, cannot sleep
+ * @data: first argument of the iterator function
+ */
+void ieee80211_iterate_active_interfaces_rtnl(struct ieee80211_hw *hw,
+                                              u32 iter_flags,
+                                              void (*iterator)(void *data,
+                                                u8 *mac,
+                                                struct ieee80211_vif *vif),
+                                              void *data);
+
+/**
  * ieee80211_queue_work - add work onto the mac80211 workqueue
  *
  * Drivers and mac80211 use this to add work onto the mac80211 workqueue.
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 2e7855a1b10d..ac28af74a414 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2865,30 +2865,43 @@ void ieee80211_csa_finalize_work(struct work_struct *work)
         if (!ieee80211_sdata_running(sdata))
                 return;
 
-        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_AP))
-                return;
-
         sdata->radar_required = sdata->csa_radar_required;
         err = ieee80211_vif_change_channel(sdata, &local->csa_chandef,
                                            &changed);
         if (WARN_ON(err < 0))
                 return;
 
-        err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon);
-        if (err < 0)
-                return;
+        if (!local->use_chanctx) {
+                local->_oper_chandef = local->csa_chandef;
+                ieee80211_hw_config(local, 0);
+        }
 
-        changed |= err;
-        kfree(sdata->u.ap.next_beacon);
-        sdata->u.ap.next_beacon = NULL;
+        ieee80211_bss_info_change_notify(sdata, changed);
+
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_AP:
+                err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon);
+                if (err < 0)
+                        return;
+                changed |= err;
+                kfree(sdata->u.ap.next_beacon);
+                sdata->u.ap.next_beacon = NULL;
+
+                ieee80211_bss_info_change_notify(sdata, err);
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                ieee80211_ibss_finish_csa(sdata);
+                break;
+        default:
+                WARN_ON(1);
+                return;
+        }
         sdata->vif.csa_active = false;
 
         ieee80211_wake_queues_by_reason(&sdata->local->hw,
                                         IEEE80211_MAX_QUEUE_MAP,
                                         IEEE80211_QUEUE_STOP_REASON_CSA);
 
-        ieee80211_bss_info_change_notify(sdata, changed);
-
         cfg80211_ch_switch_notify(sdata->dev, &local->csa_chandef);
 }
 
@@ -2936,20 +2949,56 @@ static int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
         if (sdata->vif.csa_active)
                 return -EBUSY;
 
-        /* only handle AP for now. */
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_AP:
+                sdata->csa_counter_offset_beacon =
+                        params->counter_offset_beacon;
+                sdata->csa_counter_offset_presp = params->counter_offset_presp;
+                sdata->u.ap.next_beacon =
+                        cfg80211_beacon_dup(&params->beacon_after);
+                if (!sdata->u.ap.next_beacon)
+                        return -ENOMEM;
+
+                err = ieee80211_assign_beacon(sdata, &params->beacon_csa);
+                if (err < 0) {
+                        kfree(sdata->u.ap.next_beacon);
+                        return err;
+                }
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                if (!sdata->vif.bss_conf.ibss_joined)
+                        return -EINVAL;
+
+                if (params->chandef.width != sdata->u.ibss.chandef.width)
+                        return -EINVAL;
+
+                switch (params->chandef.width) {
+                case NL80211_CHAN_WIDTH_40:
+                        if (cfg80211_get_chandef_type(&params->chandef) !=
+                            cfg80211_get_chandef_type(&sdata->u.ibss.chandef))
+                                return -EINVAL;
+                case NL80211_CHAN_WIDTH_5:
+                case NL80211_CHAN_WIDTH_10:
+                case NL80211_CHAN_WIDTH_20_NOHT:
+                case NL80211_CHAN_WIDTH_20:
+                        break;
+                default:
+                        return -EINVAL;
+                }
+
+                /* changes into another band are not supported */
+                if (sdata->u.ibss.chandef.chan->band !=
+                    params->chandef.chan->band)
+                        return -EINVAL;
+
+                err = ieee80211_ibss_csa_beacon(sdata, params);
+                if (err < 0)
+                        return err;
                 break;
         default:
                 return -EOPNOTSUPP;
         }
 
-        sdata->u.ap.next_beacon = cfg80211_beacon_dup(&params->beacon_after);
-        if (!sdata->u.ap.next_beacon)
-                return -ENOMEM;
-
-        sdata->csa_counter_offset_beacon = params->counter_offset_beacon;
-        sdata->csa_counter_offset_presp = params->counter_offset_presp;
         sdata->csa_radar_required = params->radar_required;
 
         if (params->block_tx)
@@ -2957,10 +3006,6 @@ static int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
                                 IEEE80211_MAX_QUEUE_MAP,
                                 IEEE80211_QUEUE_STOP_REASON_CSA);
 
-        err = ieee80211_assign_beacon(sdata, &params->beacon_csa);
-        if (err < 0)
-                return err;
-
         local->csa_chandef = params->chandef;
         sdata->vif.csa_active = true;
 
@@ -3014,7 +3059,8 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
                         need_offchan = true;
                 if (!ieee80211_is_action(mgmt->frame_control) ||
                     mgmt->u.action.category == WLAN_CATEGORY_PUBLIC ||
-                    mgmt->u.action.category == WLAN_CATEGORY_SELF_PROTECTED)
+                    mgmt->u.action.category == WLAN_CATEGORY_SELF_PROTECTED ||
+                    mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT)
                         break;
                 rcu_read_lock();
                 sta = sta_info_get(sdata, mgmt->da);
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 3a4764b2869e..03ba6b5c5373 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -453,11 +453,6 @@ int ieee80211_vif_change_channel(struct ieee80211_sub_if_data *sdata,
         chanctx_changed |= IEEE80211_CHANCTX_CHANGE_CHANNEL;
         drv_change_chanctx(local, ctx, chanctx_changed);
 
-        if (!local->use_chanctx) {
-                local->_oper_chandef = *chandef;
-                ieee80211_hw_config(local, 0);
-        }
-
         ieee80211_recalc_chanctx_chantype(local, ctx);
         ieee80211_recalc_smps_chanctx(local, ctx);
         ieee80211_recalc_radar_chanctx(local, ctx);
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index b0e32d628114..5c090e41d9bb 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -103,54 +103,57 @@ static ssize_t hwflags_read(struct file *file, char __user *user_buf,
         if (!buf)
                 return 0;
 
-        sf += snprintf(buf, mxln - sf, "0x%x\n", local->hw.flags);
+        sf += scnprintf(buf, mxln - sf, "0x%x\n", local->hw.flags);
         if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL)
-                sf += snprintf(buf + sf, mxln - sf, "HAS_RATE_CONTROL\n");
+                sf += scnprintf(buf + sf, mxln - sf, "HAS_RATE_CONTROL\n");
         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
-                sf += snprintf(buf + sf, mxln - sf, "RX_INCLUDES_FCS\n");
+                sf += scnprintf(buf + sf, mxln - sf, "RX_INCLUDES_FCS\n");
         if (local->hw.flags & IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING)
-                sf += snprintf(buf + sf, mxln - sf,
-                               "HOST_BCAST_PS_BUFFERING\n");
+                sf += scnprintf(buf + sf, mxln - sf,
+                                "HOST_BCAST_PS_BUFFERING\n");
         if (local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE)
-                sf += snprintf(buf + sf, mxln - sf,
-                               "2GHZ_SHORT_SLOT_INCAPABLE\n");
+                sf += scnprintf(buf + sf, mxln - sf,
+                                "2GHZ_SHORT_SLOT_INCAPABLE\n");
         if (local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE)
-                sf += snprintf(buf + sf, mxln - sf,
-                               "2GHZ_SHORT_PREAMBLE_INCAPABLE\n");
+                sf += scnprintf(buf + sf, mxln - sf,
+                                "2GHZ_SHORT_PREAMBLE_INCAPABLE\n");
         if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)
-                sf += snprintf(buf + sf, mxln - sf, "SIGNAL_UNSPEC\n");
+                sf += scnprintf(buf + sf, mxln - sf, "SIGNAL_UNSPEC\n");
         if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
-                sf += snprintf(buf + sf, mxln - sf, "SIGNAL_DBM\n");
+                sf += scnprintf(buf + sf, mxln - sf, "SIGNAL_DBM\n");
         if (local->hw.flags & IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC)
-                sf += snprintf(buf + sf, mxln - sf, "NEED_DTIM_BEFORE_ASSOC\n");
+                sf += scnprintf(buf + sf, mxln - sf,
+                                "NEED_DTIM_BEFORE_ASSOC\n");
         if (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT)
-                sf += snprintf(buf + sf, mxln - sf, "SPECTRUM_MGMT\n");
+                sf += scnprintf(buf + sf, mxln - sf, "SPECTRUM_MGMT\n");
         if (local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION)
-                sf += snprintf(buf + sf, mxln - sf, "AMPDU_AGGREGATION\n");
+                sf += scnprintf(buf + sf, mxln - sf, "AMPDU_AGGREGATION\n");
         if (local->hw.flags & IEEE80211_HW_SUPPORTS_PS)
-                sf += snprintf(buf + sf, mxln - sf, "SUPPORTS_PS\n");
+                sf += scnprintf(buf + sf, mxln - sf, "SUPPORTS_PS\n");
         if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
-                sf += snprintf(buf + sf, mxln - sf, "PS_NULLFUNC_STACK\n");
+                sf += scnprintf(buf + sf, mxln - sf, "PS_NULLFUNC_STACK\n");
         if (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)
-                sf += snprintf(buf + sf, mxln - sf, "SUPPORTS_DYNAMIC_PS\n");
+                sf += scnprintf(buf + sf, mxln - sf, "SUPPORTS_DYNAMIC_PS\n");
         if (local->hw.flags & IEEE80211_HW_MFP_CAPABLE)
-                sf += snprintf(buf + sf, mxln - sf, "MFP_CAPABLE\n");
+                sf += scnprintf(buf + sf, mxln - sf, "MFP_CAPABLE\n");
         if (local->hw.flags & IEEE80211_HW_SUPPORTS_STATIC_SMPS)
-                sf += snprintf(buf + sf, mxln - sf, "SUPPORTS_STATIC_SMPS\n");
+                sf += scnprintf(buf + sf, mxln - sf, "SUPPORTS_STATIC_SMPS\n");
         if (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS)
-                sf += snprintf(buf + sf, mxln - sf, "SUPPORTS_DYNAMIC_SMPS\n");
+                sf += scnprintf(buf + sf, mxln - sf,
+                                "SUPPORTS_DYNAMIC_SMPS\n");
         if (local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD)
-                sf += snprintf(buf + sf, mxln - sf, "SUPPORTS_UAPSD\n");
+                sf += scnprintf(buf + sf, mxln - sf, "SUPPORTS_UAPSD\n");
         if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
-                sf += snprintf(buf + sf, mxln - sf, "REPORTS_TX_ACK_STATUS\n");
+                sf += scnprintf(buf + sf, mxln - sf,
+                                "REPORTS_TX_ACK_STATUS\n");
         if (local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
-                sf += snprintf(buf + sf, mxln - sf, "CONNECTION_MONITOR\n");
+                sf += scnprintf(buf + sf, mxln - sf, "CONNECTION_MONITOR\n");
         if (local->hw.flags & IEEE80211_HW_SUPPORTS_PER_STA_GTK)
-                sf += snprintf(buf + sf, mxln - sf, "SUPPORTS_PER_STA_GTK\n");
+                sf += scnprintf(buf + sf, mxln - sf, "SUPPORTS_PER_STA_GTK\n");
         if (local->hw.flags & IEEE80211_HW_AP_LINK_PS)
-                sf += snprintf(buf + sf, mxln - sf, "AP_LINK_PS\n");
+                sf += scnprintf(buf + sf, mxln - sf, "AP_LINK_PS\n");
         if (local->hw.flags & IEEE80211_HW_TX_AMPDU_SETUP_IN_HW)
-                sf += snprintf(buf + sf, mxln - sf, "TX_AMPDU_SETUP_IN_HW\n");
+                sf += scnprintf(buf + sf, mxln - sf, "TX_AMPDU_SETUP_IN_HW\n");
 
         rv = simple_read_from_buffer(user_buf, count, ppos, buf, strlen(buf));
         kfree(buf);
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index b3ea11f3d526..5d03c47c0a4c 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -1085,4 +1085,31 @@ drv_channel_switch_beacon(struct ieee80211_sub_if_data *sdata,
         }
 }
 
+static inline int drv_join_ibss(struct ieee80211_local *local,
+                                struct ieee80211_sub_if_data *sdata)
+{
+        int ret = 0;
+
+        might_sleep();
+        check_sdata_in_driver(sdata);
+
+        trace_drv_join_ibss(local, sdata, &sdata->vif.bss_conf);
+        if (local->ops->join_ibss)
+                ret = local->ops->join_ibss(&local->hw, &sdata->vif);
+        trace_drv_return_int(local, ret);
+        return ret;
+}
+
+static inline void drv_leave_ibss(struct ieee80211_local *local,
+                                  struct ieee80211_sub_if_data *sdata)
+{
+        might_sleep();
+        check_sdata_in_driver(sdata);
+
+        trace_drv_leave_ibss(local, sdata);
+        if (local->ops->leave_ibss)
+                local->ops->leave_ibss(&local->hw, &sdata->vif);
+        trace_drv_return_void(local);
+}
+
 #endif /* __MAC80211_DRIVER_OPS */
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index a12afe77bb26..21a0b8835cb3 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -39,7 +39,8 @@ ieee80211_ibss_build_presp(struct ieee80211_sub_if_data *sdata,
                            const int beacon_int, const u32 basic_rates,
                            const u16 capability, u64 tsf,
                            struct cfg80211_chan_def *chandef,
-                           bool *have_higher_than_11mbit)
+                           bool *have_higher_than_11mbit,
+                           struct cfg80211_csa_settings *csa_settings)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
         struct ieee80211_local *local = sdata->local;
@@ -59,6 +60,7 @@ ieee80211_ibss_build_presp(struct ieee80211_sub_if_data *sdata,
                     2 + 8 /* max Supported Rates */ +
                     3 /* max DS params */ +
                     4 /* IBSS params */ +
+                    5 /* Channel Switch Announcement */ +
                     2 + (IEEE80211_MAX_SUPP_RATES - 8) +
                     2 + sizeof(struct ieee80211_ht_cap) +
                     2 + sizeof(struct ieee80211_ht_operation) +
@@ -135,6 +137,16 @@ ieee80211_ibss_build_presp(struct ieee80211_sub_if_data *sdata,
         *pos++ = 0;
         *pos++ = 0;
 
+        if (csa_settings) {
+                *pos++ = WLAN_EID_CHANNEL_SWITCH;
+                *pos++ = 3;
+                *pos++ = csa_settings->block_tx ? 1 : 0;
+                *pos++ = ieee80211_frequency_to_channel(
+                                csa_settings->chandef.chan->center_freq);
+                sdata->csa_counter_offset_beacon = (pos - presp->head);
+                *pos++ = csa_settings->count;
+        }
+
         /* put the remaining rates in WLAN_EID_EXT_SUPP_RATES */
         if (rates_n > 8) {
                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
@@ -217,6 +229,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         struct beacon_data *presp;
         enum nl80211_bss_scan_width scan_width;
         bool have_higher_than_11mbit;
+        int err;
 
         sdata_assert_lock(sdata);
 
@@ -235,6 +248,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                 ieee80211_bss_info_change_notify(sdata,
                                                  BSS_CHANGED_IBSS |
                                                  BSS_CHANGED_BEACON_ENABLED);
+                drv_leave_ibss(local, sdata);
         }
 
         presp = rcu_dereference_protected(ifibss->presp,
@@ -276,7 +290,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
 
         presp = ieee80211_ibss_build_presp(sdata, beacon_int, basic_rates,
                                            capability, tsf, &chandef,
-                                           &have_higher_than_11mbit);
+                                           &have_higher_than_11mbit, NULL);
         if (!presp)
                 return;
 
@@ -317,11 +331,26 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         else
                 sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
 
+        ieee80211_set_wmm_default(sdata, true);
+
         sdata->vif.bss_conf.ibss_joined = true;
         sdata->vif.bss_conf.ibss_creator = creator;
-        ieee80211_bss_info_change_notify(sdata, bss_change);
 
-        ieee80211_set_wmm_default(sdata, true);
+        err = drv_join_ibss(local, sdata);
+        if (err) {
+                sdata->vif.bss_conf.ibss_joined = false;
+                sdata->vif.bss_conf.ibss_creator = false;
+                sdata->vif.bss_conf.enable_beacon = false;
+                sdata->vif.bss_conf.ssid_len = 0;
+                RCU_INIT_POINTER(ifibss->presp, NULL);
+                kfree_rcu(presp, rcu_head);
+                ieee80211_vif_release_channel(sdata);
+                sdata_info(sdata, "Failed to join IBSS, driver failure: %d\n",
+                           err);
+                return;
+        }
+
+        ieee80211_bss_info_change_notify(sdata, bss_change);
 
         ifibss->state = IEEE80211_IBSS_MLME_JOINED;
         mod_timer(&ifibss->timer,
@@ -416,6 +445,169 @@ static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                                   tsf, false);
 }
 
+static int ieee80211_send_action_csa(struct ieee80211_sub_if_data *sdata,
+                                     struct cfg80211_csa_settings *csa_settings)
+{
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *mgmt;
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+        struct ieee80211_local *local = sdata->local;
+        int freq;
+        int hdr_len = offsetof(struct ieee80211_mgmt, u.action.u.chan_switch) +
+                      sizeof(mgmt->u.action.u.chan_switch);
+        u8 *pos;
+
+        skb = dev_alloc_skb(local->tx_headroom + hdr_len +
+                            5 + /* channel switch announcement element */
+                            3); /* secondary channel offset element */
+        if (!skb)
+                return -1;
+
+        skb_reserve(skb, local->tx_headroom);
+        mgmt = (struct ieee80211_mgmt *)skb_put(skb, hdr_len);
+        memset(mgmt, 0, hdr_len);
+        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                          IEEE80211_STYPE_ACTION);
+
+        eth_broadcast_addr(mgmt->da);
+        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
+        memcpy(mgmt->bssid, ifibss->bssid, ETH_ALEN);
+        mgmt->u.action.category = WLAN_CATEGORY_SPECTRUM_MGMT;
+        mgmt->u.action.u.chan_switch.action_code = WLAN_ACTION_SPCT_CHL_SWITCH;
+        pos = skb_put(skb, 5);
+        *pos++ = WLAN_EID_CHANNEL_SWITCH;                       /* EID */
+        *pos++ = 3;                                             /* IE length */
+        *pos++ = csa_settings->block_tx ? 1 : 0;                /* CSA mode */
+        freq = csa_settings->chandef.chan->center_freq;
+        *pos++ = ieee80211_frequency_to_channel(freq);          /* channel */
+        *pos++ = csa_settings->count;                           /* count */
+
+        if (csa_settings->chandef.width == NL80211_CHAN_WIDTH_40) {
+                enum nl80211_channel_type ch_type;
+
+                skb_put(skb, 3);
+                *pos++ = WLAN_EID_SECONDARY_CHANNEL_OFFSET;     /* EID */
+                *pos++ = 1;                                     /* IE length */
+                ch_type = cfg80211_get_chandef_type(&csa_settings->chandef);
+                if (ch_type == NL80211_CHAN_HT40PLUS)
+                        *pos++ = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
+                else
+                        *pos++ = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
+        }
+
+        ieee80211_tx_skb(sdata, skb);
+        return 0;
+}
+
+int ieee80211_ibss_csa_beacon(struct ieee80211_sub_if_data *sdata,
+                              struct cfg80211_csa_settings *csa_settings)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+        struct beacon_data *presp, *old_presp;
+        struct cfg80211_bss *cbss;
+        const struct cfg80211_bss_ies *ies;
+        u16 capability;
+        u64 tsf;
+        int ret = 0;
+
+        sdata_assert_lock(sdata);
+
+        capability = WLAN_CAPABILITY_IBSS;
+
+        if (ifibss->privacy)
+                capability |= WLAN_CAPABILITY_PRIVACY;
+
+        cbss = cfg80211_get_bss(sdata->local->hw.wiphy, ifibss->chandef.chan,
+                                ifibss->bssid, ifibss->ssid,
+                                ifibss->ssid_len, WLAN_CAPABILITY_IBSS |
+                                WLAN_CAPABILITY_PRIVACY,
+                                capability);
+
+        if (WARN_ON(!cbss)) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        rcu_read_lock();
+        ies = rcu_dereference(cbss->ies);
+        tsf = ies->tsf;
+        rcu_read_unlock();
+        cfg80211_put_bss(sdata->local->hw.wiphy, cbss);
+
+        old_presp = rcu_dereference_protected(ifibss->presp,
+                                          lockdep_is_held(&sdata->wdev.mtx));
+
+        presp = ieee80211_ibss_build_presp(sdata,
+                                           sdata->vif.bss_conf.beacon_int,
+                                           sdata->vif.bss_conf.basic_rates,
+                                           capability, tsf, &ifibss->chandef,
+                                           NULL, csa_settings);
+        if (!presp) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        rcu_assign_pointer(ifibss->presp, presp);
+        if (old_presp)
+                kfree_rcu(old_presp, rcu_head);
+
+        /* it might not send the beacon for a while. send an action frame
+         * immediately to announce the channel switch.
+         */
+        if (csa_settings)
+                ieee80211_send_action_csa(sdata, csa_settings);
+
+        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
+ out:
+        return ret;
+}
+
+int ieee80211_ibss_finish_csa(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+        struct cfg80211_bss *cbss;
+        int err;
+        u16 capability;
+
+        sdata_lock(sdata);
+        /* update cfg80211 bss information with the new channel */
+        if (!is_zero_ether_addr(ifibss->bssid)) {
+                capability = WLAN_CAPABILITY_IBSS;
+
+                if (ifibss->privacy)
+                        capability |= WLAN_CAPABILITY_PRIVACY;
+
+                cbss = cfg80211_get_bss(sdata->local->hw.wiphy,
+                                        ifibss->chandef.chan,
+                                        ifibss->bssid, ifibss->ssid,
+                                        ifibss->ssid_len, WLAN_CAPABILITY_IBSS |
+                                        WLAN_CAPABILITY_PRIVACY,
+                                        capability);
+                /* XXX: should not really modify cfg80211 data */
+                if (cbss) {
+                        cbss->channel = sdata->local->csa_chandef.chan;
+                        cfg80211_put_bss(sdata->local->hw.wiphy, cbss);
+                }
+        }
+
+        ifibss->chandef = sdata->local->csa_chandef;
+
+        /* generate the beacon */
+        err = ieee80211_ibss_csa_beacon(sdata, NULL);
+        sdata_unlock(sdata);
+        if (err < 0)
+                return err;
+
+        return 0;
+}
+
+void ieee80211_ibss_stop(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+
+        cancel_work_sync(&ifibss->csa_connection_drop_work);
+}
+
 static struct sta_info *ieee80211_ibss_finish_sta(struct sta_info *sta)
         __acquires(RCU)
 {
@@ -499,6 +691,295 @@ ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata, const u8 *bssid,
         return ieee80211_ibss_finish_sta(sta);
 }
 
+static int ieee80211_sta_active_ibss(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        int active = 0;
+        struct sta_info *sta;
+
+        sdata_assert_lock(sdata);
+
+        rcu_read_lock();
+
+        list_for_each_entry_rcu(sta, &local->sta_list, list) {
+                if (sta->sdata == sdata &&
+                    time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
+                               jiffies)) {
+                        active++;
+                        break;
+                }
+        }
+
+        rcu_read_unlock();
+
+        return active;
+}
+
+static void ieee80211_ibss_disconnect(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+        struct ieee80211_local *local = sdata->local;
+        struct cfg80211_bss *cbss;
+        struct beacon_data *presp;
+        struct sta_info *sta;
+        int active_ibss;
+        u16 capability;
+
+        active_ibss = ieee80211_sta_active_ibss(sdata);
+
+        if (!active_ibss && !is_zero_ether_addr(ifibss->bssid)) {
+                capability = WLAN_CAPABILITY_IBSS;
+
+                if (ifibss->privacy)
+                        capability |= WLAN_CAPABILITY_PRIVACY;
+
+                cbss = cfg80211_get_bss(local->hw.wiphy, ifibss->chandef.chan,
+                                        ifibss->bssid, ifibss->ssid,
+                                        ifibss->ssid_len, WLAN_CAPABILITY_IBSS |
+                                        WLAN_CAPABILITY_PRIVACY,
+                                        capability);
+
+                if (cbss) {
+                        cfg80211_unlink_bss(local->hw.wiphy, cbss);
+                        cfg80211_put_bss(sdata->local->hw.wiphy, cbss);
+                }
+        }
+
+        ifibss->state = IEEE80211_IBSS_MLME_SEARCH;
+
+        sta_info_flush(sdata);
+
+        spin_lock_bh(&ifibss->incomplete_lock);
+        while (!list_empty(&ifibss->incomplete_stations)) {
+                sta = list_first_entry(&ifibss->incomplete_stations,
+                                       struct sta_info, list);
+                list_del(&sta->list);
+                spin_unlock_bh(&ifibss->incomplete_lock);
+
+                sta_info_free(local, sta);
+                spin_lock_bh(&ifibss->incomplete_lock);
+        }
+        spin_unlock_bh(&ifibss->incomplete_lock);
+
+        netif_carrier_off(sdata->dev);
+
+        sdata->vif.bss_conf.ibss_joined = false;
+        sdata->vif.bss_conf.ibss_creator = false;
+        sdata->vif.bss_conf.enable_beacon = false;
+        sdata->vif.bss_conf.ssid_len = 0;
+
+        /* remove beacon */
+        presp = rcu_dereference_protected(ifibss->presp,
+                                          lockdep_is_held(&sdata->wdev.mtx));
+        RCU_INIT_POINTER(sdata->u.ibss.presp, NULL);
+        if (presp)
+                kfree_rcu(presp, rcu_head);
+
+        clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
+        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED |
+                                                BSS_CHANGED_IBSS);
+        drv_leave_ibss(local, sdata);
+        ieee80211_vif_release_channel(sdata);
+}
+
+static void ieee80211_csa_connection_drop_work(struct work_struct *work)
+{
+        struct ieee80211_sub_if_data *sdata =
+                container_of(work, struct ieee80211_sub_if_data,
+                             u.ibss.csa_connection_drop_work);
+
+        ieee80211_ibss_disconnect(sdata);
+        synchronize_rcu();
+        skb_queue_purge(&sdata->skb_queue);
+
+        /* trigger a scan to find another IBSS network to join */
+        ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+}
+
+static bool
+ieee80211_ibss_process_chanswitch(struct ieee80211_sub_if_data *sdata,
+                                  struct ieee802_11_elems *elems,
+                                  bool beacon)
+{
+        struct cfg80211_csa_settings params;
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+        struct ieee80211_chanctx_conf *chanctx_conf;
+        struct ieee80211_chanctx *chanctx;
+        enum nl80211_channel_type ch_type;
+        int err, num_chanctx;
+        u32 sta_flags;
+        u8 mode;
+
+        if (sdata->vif.csa_active)
+                return true;
+
+        if (!sdata->vif.bss_conf.ibss_joined)
+                return false;
+
+        sta_flags = IEEE80211_STA_DISABLE_VHT;
+        switch (ifibss->chandef.width) {
+        case NL80211_CHAN_WIDTH_5:
+        case NL80211_CHAN_WIDTH_10:
+        case NL80211_CHAN_WIDTH_20_NOHT:
+                sta_flags |= IEEE80211_STA_DISABLE_HT;
+                /* fall through */
+        case NL80211_CHAN_WIDTH_20:
+                sta_flags |= IEEE80211_STA_DISABLE_40MHZ;
+                break;
+        default:
+                break;
+        }
+
+        memset(&params, 0, sizeof(params));
+        err = ieee80211_parse_ch_switch_ie(sdata, elems, beacon,
+                                           ifibss->chandef.chan->band,
+                                           sta_flags, ifibss->bssid,
+                                           &params.count, &mode,
+                                           &params.chandef);
+
+        /* can't switch to destination channel, fail */
+        if (err < 0)
+                goto disconnect;
+
+        /* did not contain a CSA */
+        if (err)
+                return false;
+
+        if (ifibss->chandef.chan->band != params.chandef.chan->band)
+                goto disconnect;
+
+        switch (ifibss->chandef.width) {
+        case NL80211_CHAN_WIDTH_20_NOHT:
+        case NL80211_CHAN_WIDTH_20:
+        case NL80211_CHAN_WIDTH_40:
+                /* keep our current HT mode (HT20/HT40+/HT40-), even if
+                 * another mode  has been announced. The mode is not adopted
+                 * within the beacon while doing CSA and we should therefore
+                 * keep the mode which we announce.
+                 */
+                ch_type = cfg80211_get_chandef_type(&ifibss->chandef);
+                cfg80211_chandef_create(&params.chandef, params.chandef.chan,
+                                        ch_type);
+                break;
+        case NL80211_CHAN_WIDTH_5:
+        case NL80211_CHAN_WIDTH_10:
+                if (params.chandef.width != ifibss->chandef.width) {
+                        sdata_info(sdata,
+                                   "IBSS %pM received channel switch from incompatible channel width (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
+                                   ifibss->bssid,
+                                   params.chandef.chan->center_freq,
+                                   params.chandef.width,
+                                   params.chandef.center_freq1,
+                                   params.chandef.center_freq2);
+                        goto disconnect;
+                }
+                break;
+        default:
+                /* should not happen, sta_flags should prevent VHT modes. */
+                WARN_ON(1);
+                goto disconnect;
+        }
+
+        if (!cfg80211_chandef_usable(sdata->local->hw.wiphy, &params.chandef,
+                                     IEEE80211_CHAN_DISABLED)) {
+                sdata_info(sdata,
+                           "IBSS %pM switches to unsupported channel (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
+                           ifibss->bssid,
+                           params.chandef.chan->center_freq,
+                           params.chandef.width,
+                           params.chandef.center_freq1,
+                           params.chandef.center_freq2);
+                goto disconnect;
+        }
+
+        err = cfg80211_chandef_dfs_required(sdata->local->hw.wiphy,
+                                            &params.chandef);
+        if (err < 0)
+                goto disconnect;
+        if (err) {
+                params.radar_required = true;
+
+                /* TODO: IBSS-DFS not (yet) supported, disconnect. */
+                goto disconnect;
+        }
+
+        rcu_read_lock();
+        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
+        if (!chanctx_conf) {
+                rcu_read_unlock();
+                goto disconnect;
+        }
+
+        /* don't handle for multi-VIF cases */
+        chanctx = container_of(chanctx_conf, struct ieee80211_chanctx, conf);
+        if (chanctx->refcount > 1) {
+                rcu_read_unlock();
+                goto disconnect;
+        }
+        num_chanctx = 0;
+        list_for_each_entry_rcu(chanctx, &sdata->local->chanctx_list, list)
+                num_chanctx++;
+
+        if (num_chanctx > 1) {
+                rcu_read_unlock();
+                goto disconnect;
+        }
+        rcu_read_unlock();
+
+        /* all checks done, now perform the channel switch. */
+        ibss_dbg(sdata,
+                 "received channel switch announcement to go to channel %d MHz\n",
+                 params.chandef.chan->center_freq);
+
+        params.block_tx = !!mode;
+
+        ieee80211_ibss_csa_beacon(sdata, &params);
+        sdata->csa_radar_required = params.radar_required;
+
+        if (params.block_tx)
+                ieee80211_stop_queues_by_reason(&sdata->local->hw,
+                                IEEE80211_MAX_QUEUE_MAP,
+                                IEEE80211_QUEUE_STOP_REASON_CSA);
+
+        sdata->local->csa_chandef = params.chandef;
+        sdata->vif.csa_active = true;
+
+        ieee80211_bss_info_change_notify(sdata, err);
+        drv_channel_switch_beacon(sdata, &params.chandef);
+
+        return true;
+disconnect:
+        ibss_dbg(sdata, "Can't handle channel switch, disconnect\n");
+        ieee80211_queue_work(&sdata->local->hw,
+                             &ifibss->csa_connection_drop_work);
+
+        return true;
+}
+
+static void
+ieee80211_rx_mgmt_spectrum_mgmt(struct ieee80211_sub_if_data *sdata,
+                                struct ieee80211_mgmt *mgmt, size_t len,
+                                struct ieee80211_rx_status *rx_status,
+                                struct ieee802_11_elems *elems)
+{
+        int required_len;
+
+        if (len < IEEE80211_MIN_ACTION_SIZE + 1)
+                return;
+
+        /* CSA is the only action we handle for now */
+        if (mgmt->u.action.u.measurement.action_code !=
+            WLAN_ACTION_SPCT_CHL_SWITCH)
+                return;
+
+        required_len = IEEE80211_MIN_ACTION_SIZE +
+                       sizeof(mgmt->u.action.u.chan_switch);
+        if (len < required_len)
+                return;
+
+        ieee80211_ibss_process_chanswitch(sdata, elems, false);
+}
+
 static void ieee80211_rx_mgmt_deauth_ibss(struct ieee80211_sub_if_data *sdata,
                                           struct ieee80211_mgmt *mgmt,
                                           size_t len)
@@ -661,10 +1142,6 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
 
         /* check if we need to merge IBSS */
 
-        /* we use a fixed BSSID */
-        if (sdata->u.ibss.fixed_bssid)
-                goto put_bss;
-
         /* not an IBSS */
         if (!(cbss->capability & WLAN_CAPABILITY_IBSS))
                 goto put_bss;
@@ -680,10 +1157,18 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                                 sdata->u.ibss.ssid_len))
                 goto put_bss;
 
+        /* process channel switch */
+        if (ieee80211_ibss_process_chanswitch(sdata, elems, true))
+                goto put_bss;
+
         /* same BSSID */
         if (ether_addr_equal(cbss->bssid, sdata->u.ibss.bssid))
                 goto put_bss;
 
+        /* we use a fixed BSSID */
+        if (sdata->u.ibss.fixed_bssid)
+                goto put_bss;
+
         if (ieee80211_have_rx_timestamp(rx_status)) {
                 /* time when timestamp field was received */
                 rx_timestamp =
@@ -775,30 +1260,6 @@ void ieee80211_ibss_rx_no_sta(struct ieee80211_sub_if_data *sdata,
         ieee80211_queue_work(&local->hw, &sdata->work);
 }
 
-static int ieee80211_sta_active_ibss(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_local *local = sdata->local;
-        int active = 0;
-        struct sta_info *sta;
-
-        sdata_assert_lock(sdata);
-
-        rcu_read_lock();
-
-        list_for_each_entry_rcu(sta, &local->sta_list, list) {
-                if (sta->sdata == sdata &&
-                    time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
-                               jiffies)) {
-                        active++;
-                        break;
-                }
-        }
-
-        rcu_read_unlock();
-
-        return active;
-}
-
 static void ieee80211_ibss_sta_expire(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
@@ -1076,6 +1537,8 @@ void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_rx_status *rx_status;
         struct ieee80211_mgmt *mgmt;
         u16 fc;
+        struct ieee802_11_elems elems;
+        int ies_len;
 
         rx_status = IEEE80211_SKB_RXCB(skb);
         mgmt = (struct ieee80211_mgmt *) skb->data;
@@ -1101,6 +1564,27 @@ void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
         case IEEE80211_STYPE_DEAUTH:
                 ieee80211_rx_mgmt_deauth_ibss(sdata, mgmt, skb->len);
                 break;
+        case IEEE80211_STYPE_ACTION:
+                switch (mgmt->u.action.category) {
+                case WLAN_CATEGORY_SPECTRUM_MGMT:
+                        ies_len = skb->len -
+                                  offsetof(struct ieee80211_mgmt,
+                                           u.action.u.chan_switch.variable);
+
+                        if (ies_len < 0)
+                                break;
+
+                        ieee802_11_parse_elems(
+                                mgmt->u.action.u.chan_switch.variable,
+                                ies_len, true, &elems);
+
+                        if (elems.parse_error)
+                                break;
+
+                        ieee80211_rx_mgmt_spectrum_mgmt(sdata, mgmt, skb->len,
+                                                        rx_status, &elems);
+                        break;
+                }
         }
 
  mgmt_out:
@@ -1167,6 +1651,8 @@ void ieee80211_ibss_setup_sdata(struct ieee80211_sub_if_data *sdata)
                     (unsigned long) sdata);
         INIT_LIST_HEAD(&ifibss->incomplete_stations);
         spin_lock_init(&ifibss->incomplete_lock);
+        INIT_WORK(&ifibss->csa_connection_drop_work,
+                  ieee80211_csa_connection_drop_work);
 }
 
 /* scan finished notification */
@@ -1265,73 +1751,19 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
 int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
-        struct ieee80211_local *local = sdata->local;
-        struct cfg80211_bss *cbss;
-        u16 capability;
-        int active_ibss;
-        struct sta_info *sta;
-        struct beacon_data *presp;
-
-        active_ibss = ieee80211_sta_active_ibss(sdata);
-
-        if (!active_ibss && !is_zero_ether_addr(ifibss->bssid)) {
-                capability = WLAN_CAPABILITY_IBSS;
-
-                if (ifibss->privacy)
-                        capability |= WLAN_CAPABILITY_PRIVACY;
-
-                cbss = cfg80211_get_bss(local->hw.wiphy, ifibss->chandef.chan,
-                                        ifibss->bssid, ifibss->ssid,
-                                        ifibss->ssid_len, WLAN_CAPABILITY_IBSS |
-                                        WLAN_CAPABILITY_PRIVACY,
-                                        capability);
 
-                if (cbss) {
-                        cfg80211_unlink_bss(local->hw.wiphy, cbss);
-                        cfg80211_put_bss(local->hw.wiphy, cbss);
-                }
-        }
-
-        ifibss->state = IEEE80211_IBSS_MLME_SEARCH;
-        memset(ifibss->bssid, 0, ETH_ALEN);
+        ieee80211_ibss_disconnect(sdata);
         ifibss->ssid_len = 0;
-
-        sta_info_flush(sdata);
-
-        spin_lock_bh(&ifibss->incomplete_lock);
-        while (!list_empty(&ifibss->incomplete_stations)) {
-                sta = list_first_entry(&ifibss->incomplete_stations,
-                                       struct sta_info, list);
-                list_del(&sta->list);
-                spin_unlock_bh(&ifibss->incomplete_lock);
-
-                sta_info_free(local, sta);
-                spin_lock_bh(&ifibss->incomplete_lock);
-        }
-        spin_unlock_bh(&ifibss->incomplete_lock);
-
-        netif_carrier_off(sdata->dev);
+        memset(ifibss->bssid, 0, ETH_ALEN);
 
         /* remove beacon */
         kfree(sdata->u.ibss.ie);
-        presp = rcu_dereference_protected(ifibss->presp,
-                                          lockdep_is_held(&sdata->wdev.mtx));
-        RCU_INIT_POINTER(sdata->u.ibss.presp, NULL);
 
         /* on the next join, re-program HT parameters */
         memset(&ifibss->ht_capa, 0, sizeof(ifibss->ht_capa));
         memset(&ifibss->ht_capa_mask, 0, sizeof(ifibss->ht_capa_mask));
 
-        sdata->vif.bss_conf.ibss_joined = false;
-        sdata->vif.bss_conf.ibss_creator = false;
-        sdata->vif.bss_conf.enable_beacon = false;
-        sdata->vif.bss_conf.ssid_len = 0;
-        clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
-        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED |
-                                                BSS_CHANGED_IBSS);
-        ieee80211_vif_release_channel(sdata);
         synchronize_rcu();
-        kfree(presp);
 
         skb_queue_purge(&sdata->skb_queue);
 
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index b6186517ec56..3a87c8976a32 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -322,7 +322,6 @@ struct ieee80211_roc_work {
 
 /* flags used in struct ieee80211_if_managed.flags */
 enum ieee80211_sta_flags {
-        IEEE80211_STA_BEACON_POLL       = BIT(0),
         IEEE80211_STA_CONNECTION_POLL   = BIT(1),
         IEEE80211_STA_CONTROL_PORT      = BIT(2),
         IEEE80211_STA_DISABLE_HT        = BIT(4),
@@ -487,6 +486,7 @@ struct ieee80211_if_managed {
 
 struct ieee80211_if_ibss {
         struct timer_list timer;
+        struct work_struct csa_connection_drop_work;
 
         unsigned long last_scan_completed;
 
@@ -1330,6 +1330,10 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata);
 void ieee80211_ibss_work(struct ieee80211_sub_if_data *sdata);
 void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                                    struct sk_buff *skb);
+int ieee80211_ibss_csa_beacon(struct ieee80211_sub_if_data *sdata,
+                              struct cfg80211_csa_settings *csa_settings);
+int ieee80211_ibss_finish_csa(struct ieee80211_sub_if_data *sdata);
+void ieee80211_ibss_stop(struct ieee80211_sub_if_data *sdata);
 
 /* mesh code */
 void ieee80211_mesh_work(struct ieee80211_sub_if_data *sdata);
@@ -1481,6 +1485,29 @@ void ieee80211_apply_vhtcap_overrides(struct ieee80211_sub_if_data *sdata,
 void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
                                        struct ieee80211_mgmt *mgmt,
                                        size_t len);
+/**
+ * ieee80211_parse_ch_switch_ie - parses channel switch IEs
+ * @sdata: the sdata of the interface which has received the frame
+ * @elems: parsed 802.11 elements received with the frame
+ * @beacon: indicates if the frame was a beacon or probe response
+ * @current_band: indicates the current band
+ * @sta_flags: contains information about own capabilities and restrictions
+ *      to decide which channel switch announcements can be accepted. Only the
+ *      following subset of &enum ieee80211_sta_flags are evaluated:
+ *      %IEEE80211_STA_DISABLE_HT, %IEEE80211_STA_DISABLE_VHT,
+ *      %IEEE80211_STA_DISABLE_40MHZ, %IEEE80211_STA_DISABLE_80P80MHZ,
+ *      %IEEE80211_STA_DISABLE_160MHZ.
+ * @count: to be filled with the counter until the switch (on success only)
+ * @bssid: the currently connected bssid (for reporting)
+ * @mode: to be filled with CSA mode (on success only)
+ * @new_chandef: to be filled with destination chandef (on success only)
+ * Return: 0 on success, <0 on error and >0 if there is nothing to parse.
+ */
+int ieee80211_parse_ch_switch_ie(struct ieee80211_sub_if_data *sdata,
+                                 struct ieee802_11_elems *elems, bool beacon,
+                                 enum ieee80211_band current_band,
+                                 u32 sta_flags, u8 *bssid, u8 *count, u8 *mode,
+                                 struct cfg80211_chan_def *new_chandef);
 
 /* Suspend/resume and hw reconfiguration */
 int ieee80211_reconfig(struct ieee80211_local *local);
@@ -1654,6 +1681,7 @@ int ieee80211_add_ext_srates_ie(struct ieee80211_sub_if_data *sdata,
 void ieee80211_ht_oper_to_chandef(struct ieee80211_channel *control_chan,
                                   const struct ieee80211_ht_operation *ht_oper,
                                   struct cfg80211_chan_def *chandef);
+u32 ieee80211_chandef_downgrade(struct cfg80211_chan_def *c);
 
 int __must_check
 ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index fcecd633514e..e48f103b9ade 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -766,6 +766,10 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         if (sdata->vif.type == NL80211_IFTYPE_STATION)
                 ieee80211_mgd_stop(sdata);
 
+        if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                ieee80211_ibss_stop(sdata);
+
+
         /*
          * Remove all stations associated with this interface.
          *
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 620677e897bd..3e51dd7d98b3 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -879,7 +879,7 @@ ieee80211_gtk_rekey_add(struct ieee80211_vif *vif,
                                   keyconf->keylen, keyconf->key,
                                   0, NULL);
         if (IS_ERR(key))
-                return ERR_PTR(PTR_ERR(key));
+                return ERR_CAST(key);
 
         if (sdata->u.mgd.mfp != IEEE80211_MFP_DISABLED)
                 key->conf.flags |= IEEE80211_KEY_FLAG_RX_MGMT;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 86e4ad56b573..91cc8281e266 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -145,66 +145,6 @@ static int ecw2cw(int ecw)
         return (1 << ecw) - 1;
 }
 
-static u32 chandef_downgrade(struct cfg80211_chan_def *c)
-{
-        u32 ret;
-        int tmp;
-
-        switch (c->width) {
-        case NL80211_CHAN_WIDTH_20:
-                c->width = NL80211_CHAN_WIDTH_20_NOHT;
-                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
-                break;
-        case NL80211_CHAN_WIDTH_40:
-                c->width = NL80211_CHAN_WIDTH_20;
-                c->center_freq1 = c->chan->center_freq;
-                ret = IEEE80211_STA_DISABLE_40MHZ |
-                      IEEE80211_STA_DISABLE_VHT;
-                break;
-        case NL80211_CHAN_WIDTH_80:
-                tmp = (30 + c->chan->center_freq - c->center_freq1)/20;
-                /* n_P40 */
-                tmp /= 2;
-                /* freq_P40 */
-                c->center_freq1 = c->center_freq1 - 20 + 40 * tmp;
-                c->width = NL80211_CHAN_WIDTH_40;
-                ret = IEEE80211_STA_DISABLE_VHT;
-                break;
-        case NL80211_CHAN_WIDTH_80P80:
-                c->center_freq2 = 0;
-                c->width = NL80211_CHAN_WIDTH_80;
-                ret = IEEE80211_STA_DISABLE_80P80MHZ |
-                      IEEE80211_STA_DISABLE_160MHZ;
-                break;
-        case NL80211_CHAN_WIDTH_160:
-                /* n_P20 */
-                tmp = (70 + c->chan->center_freq - c->center_freq1)/20;
-                /* n_P80 */
-                tmp /= 4;
-                c->center_freq1 = c->center_freq1 - 40 + 80 * tmp;
-                c->width = NL80211_CHAN_WIDTH_80;
-                ret = IEEE80211_STA_DISABLE_80P80MHZ |
-                      IEEE80211_STA_DISABLE_160MHZ;
-                break;
-        default:
-        case NL80211_CHAN_WIDTH_20_NOHT:
-                WARN_ON_ONCE(1);
-                c->width = NL80211_CHAN_WIDTH_20_NOHT;
-                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
-                break;
-        case NL80211_CHAN_WIDTH_5:
-        case NL80211_CHAN_WIDTH_10:
-                WARN_ON_ONCE(1);
-                /* keep c->width */
-                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
-                break;
-        }
-
-        WARN_ON_ONCE(!cfg80211_chandef_valid(c));
-
-        return ret;
-}
-
 static u32
 ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
                              struct ieee80211_supported_band *sband,
@@ -352,7 +292,7 @@ out:
                         break;
                 }
 
-                ret |= chandef_downgrade(chandef);
+                ret |= ieee80211_chandef_downgrade(chandef);
         }
 
         if (chandef->width != vht_chandef.width && !tracking)
@@ -406,13 +346,13 @@ static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
          */
         if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
             chandef.width == NL80211_CHAN_WIDTH_80P80)
-                flags |= chandef_downgrade(&chandef);
+                flags |= ieee80211_chandef_downgrade(&chandef);
         if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
             chandef.width == NL80211_CHAN_WIDTH_160)
-                flags |= chandef_downgrade(&chandef);
+                flags |= ieee80211_chandef_downgrade(&chandef);
         if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
             chandef.width > NL80211_CHAN_WIDTH_20)
-                flags |= chandef_downgrade(&chandef);
+                flags |= ieee80211_chandef_downgrade(&chandef);
 
         if (cfg80211_chandef_identical(&chandef, &sdata->vif.bss_conf.chandef))
                 return 0;
@@ -893,8 +833,7 @@ void ieee80211_send_nullfunc(struct ieee80211_local *local,
         if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
 
-        if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
-                            IEEE80211_STA_CONNECTION_POLL))
+        if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
 
         ieee80211_tx_skb(sdata, skb);
@@ -937,6 +876,8 @@ static void ieee80211_chswitch_work(struct work_struct *work)
                 container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        u32 changed = 0;
+        int ret;
 
         if (!ieee80211_sdata_running(sdata))
                 return;
@@ -945,24 +886,39 @@ static void ieee80211_chswitch_work(struct work_struct *work)
         if (!ifmgd->associated)
                 goto out;
 
-        local->_oper_chandef = local->csa_chandef;
+        ret = ieee80211_vif_change_channel(sdata, &local->csa_chandef,
+                                           &changed);
+        if (ret) {
+                sdata_info(sdata,
+                           "vif channel switch failed, disconnecting\n");
+                ieee80211_queue_work(&sdata->local->hw,
+                                     &ifmgd->csa_connection_drop_work);
+                goto out;
+        }
 
-        if (!local->ops->channel_switch) {
-                /* call "hw_config" only if doing sw channel switch */
-                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
-        } else {
-                /* update the device channel directly */
-                local->hw.conf.chandef = local->_oper_chandef;
+        if (!local->use_chanctx) {
+                local->_oper_chandef = local->csa_chandef;
+                /* Call "hw_config" only if doing sw channel switch.
+                 * Otherwise update the channel directly
+                 */
+                if (!local->ops->channel_switch)
+                        ieee80211_hw_config(local, 0);
+                else
+                        local->hw.conf.chandef = local->_oper_chandef;
         }
 
         /* XXX: shouldn't really modify cfg80211-owned data! */
-        ifmgd->associated->channel = local->_oper_chandef.chan;
+        ifmgd->associated->channel = local->csa_chandef.chan;
 
         /* XXX: wait for a beacon first? */
         ieee80211_wake_queues_by_reason(&local->hw,
                                         IEEE80211_MAX_QUEUE_MAP,
                                         IEEE80211_QUEUE_STOP_REASON_CSA);
+
+        ieee80211_bss_info_change_notify(sdata, changed);
+
  out:
+        sdata->vif.csa_active = false;
         ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
         sdata_unlock(sdata);
 }
@@ -1000,20 +956,12 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct cfg80211_bss *cbss = ifmgd->associated;
-        struct ieee80211_bss *bss;
         struct ieee80211_chanctx *chanctx;
-        enum ieee80211_band new_band;
-        int new_freq;
-        u8 new_chan_no;
+        enum ieee80211_band current_band;
         u8 count;
         u8 mode;
-        struct ieee80211_channel *new_chan;
         struct cfg80211_chan_def new_chandef = {};
-        struct cfg80211_chan_def new_vht_chandef = {};
-        const struct ieee80211_sec_chan_offs_ie *sec_chan_offs;
-        const struct ieee80211_wide_bw_chansw_ie *wide_bw_chansw_ie;
-        const struct ieee80211_ht_operation *ht_oper;
-        int secondary_channel_offset = -1;
+        int res;
 
         sdata_assert_lock(sdata);
 
@@ -1027,162 +975,23 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         if (ifmgd->flags & IEEE80211_STA_CSA_RECEIVED)
                 return;
 
-        sec_chan_offs = elems->sec_chan_offs;
-        wide_bw_chansw_ie = elems->wide_bw_chansw_ie;
-        ht_oper = elems->ht_operation;
-
-        if (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
-                            IEEE80211_STA_DISABLE_40MHZ)) {
-                sec_chan_offs = NULL;
-                wide_bw_chansw_ie = NULL;
-                /* only used for bandwidth here */
-                ht_oper = NULL;
-        }
-
-        if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
-                wide_bw_chansw_ie = NULL;
-
-        if (elems->ext_chansw_ie) {
-                if (!ieee80211_operating_class_to_band(
-                                elems->ext_chansw_ie->new_operating_class,
-                                &new_band)) {
-                        sdata_info(sdata,
-                                   "cannot understand ECSA IE operating class %d, disconnecting\n",
-                                   elems->ext_chansw_ie->new_operating_class);
-                        ieee80211_queue_work(&local->hw,
-                                             &ifmgd->csa_connection_drop_work);
-                }
-                new_chan_no = elems->ext_chansw_ie->new_ch_num;
-                count = elems->ext_chansw_ie->count;
-                mode = elems->ext_chansw_ie->mode;
-        } else if (elems->ch_switch_ie) {
-                new_band = cbss->channel->band;
-                new_chan_no = elems->ch_switch_ie->new_ch_num;
-                count = elems->ch_switch_ie->count;
-                mode = elems->ch_switch_ie->mode;
-        } else {
-                /* nothing here we understand */
-                return;
-        }
-
-        bss = (void *)cbss->priv;
-
-        new_freq = ieee80211_channel_to_frequency(new_chan_no, new_band);
-        new_chan = ieee80211_get_channel(sdata->local->hw.wiphy, new_freq);
-        if (!new_chan || new_chan->flags & IEEE80211_CHAN_DISABLED) {
-                sdata_info(sdata,
-                           "AP %pM switches to unsupported channel (%d MHz), disconnecting\n",
-                           ifmgd->associated->bssid, new_freq);
+        current_band = cbss->channel->band;
+        res = ieee80211_parse_ch_switch_ie(sdata, elems, beacon, current_band,
+                                           ifmgd->flags,
+                                           ifmgd->associated->bssid, &count,
+                                           &mode, &new_chandef);
+        if (res < 0)
                 ieee80211_queue_work(&local->hw,
                                      &ifmgd->csa_connection_drop_work);
+        if (res)
                 return;
-        }
-
-        if (!beacon && sec_chan_offs) {
-                secondary_channel_offset = sec_chan_offs->sec_chan_offs;
-        } else if (beacon && ht_oper) {
-                secondary_channel_offset =
-                        ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET;
-        } else if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
-                /*
-                 * If it's not a beacon, HT is enabled and the IE not present,
-                 * it's 20 MHz, 802.11-2012 8.5.2.6:
-                 *      This element [the Secondary Channel Offset Element] is
-                 *      present when switching to a 40 MHz channel. It may be
-                 *      present when switching to a 20 MHz channel (in which
-                 *      case the secondary channel offset is set to SCN).
-                 */
-                secondary_channel_offset = IEEE80211_HT_PARAM_CHA_SEC_NONE;
-        }
-
-        switch (secondary_channel_offset) {
-        default:
-                /* secondary_channel_offset was present but is invalid */
-        case IEEE80211_HT_PARAM_CHA_SEC_NONE:
-                cfg80211_chandef_create(&new_chandef, new_chan,
-                                        NL80211_CHAN_HT20);
-                break;
-        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
-                cfg80211_chandef_create(&new_chandef, new_chan,
-                                        NL80211_CHAN_HT40PLUS);
-                break;
-        case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
-                cfg80211_chandef_create(&new_chandef, new_chan,
-                                        NL80211_CHAN_HT40MINUS);
-                break;
-        case -1:
-                cfg80211_chandef_create(&new_chandef, new_chan,
-                                        NL80211_CHAN_NO_HT);
-                /* keep width for 5/10 MHz channels */
-                switch (sdata->vif.bss_conf.chandef.width) {
-                case NL80211_CHAN_WIDTH_5:
-                case NL80211_CHAN_WIDTH_10:
-                        new_chandef.width = sdata->vif.bss_conf.chandef.width;
-                        break;
-                default:
-                        break;
-                }
-                break;
-        }
-
-        if (wide_bw_chansw_ie) {
-                new_vht_chandef.chan = new_chan;
-                new_vht_chandef.center_freq1 =
-                        ieee80211_channel_to_frequency(
-                                wide_bw_chansw_ie->new_center_freq_seg0,
-                                new_band);
-
-                switch (wide_bw_chansw_ie->new_channel_width) {
-                default:
-                        /* hmmm, ignore VHT and use HT if present */
-                case IEEE80211_VHT_CHANWIDTH_USE_HT:
-                        new_vht_chandef.chan = NULL;
-                        break;
-                case IEEE80211_VHT_CHANWIDTH_80MHZ:
-                        new_vht_chandef.width = NL80211_CHAN_WIDTH_80;
-                        break;
-                case IEEE80211_VHT_CHANWIDTH_160MHZ:
-                        new_vht_chandef.width = NL80211_CHAN_WIDTH_160;
-                        break;
-                case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
-                        /* field is otherwise reserved */
-                        new_vht_chandef.center_freq2 =
-                                ieee80211_channel_to_frequency(
-                                        wide_bw_chansw_ie->new_center_freq_seg1,
-                                        new_band);
-                        new_vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
-                        break;
-                }
-                if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
-                    new_vht_chandef.width == NL80211_CHAN_WIDTH_80P80)
-                        chandef_downgrade(&new_vht_chandef);
-                if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
-                    new_vht_chandef.width == NL80211_CHAN_WIDTH_160)
-                        chandef_downgrade(&new_vht_chandef);
-                if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
-                    new_vht_chandef.width > NL80211_CHAN_WIDTH_20)
-                        chandef_downgrade(&new_vht_chandef);
-        }
-
-        /* if VHT data is there validate & use it */
-        if (new_vht_chandef.chan) {
-                if (!cfg80211_chandef_compatible(&new_vht_chandef,
-                                                 &new_chandef)) {
-                        sdata_info(sdata,
-                                   "AP %pM CSA has inconsistent channel data, disconnecting\n",
-                                   ifmgd->associated->bssid);
-                        ieee80211_queue_work(&local->hw,
-                                             &ifmgd->csa_connection_drop_work);
-                        return;
-                }
-                new_chandef = new_vht_chandef;
-        }
 
         if (!cfg80211_chandef_usable(local->hw.wiphy, &new_chandef,
                                      IEEE80211_CHAN_DISABLED)) {
                 sdata_info(sdata,
                            "AP %pM switches to unsupported channel (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
-                           ifmgd->associated->bssid, new_freq,
+                           ifmgd->associated->bssid,
+                           new_chandef.chan->center_freq,
                            new_chandef.width, new_chandef.center_freq1,
                            new_chandef.center_freq2);
                 ieee80211_queue_work(&local->hw,
@@ -1191,17 +1000,28 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         }
 
         ifmgd->flags |= IEEE80211_STA_CSA_RECEIVED;
+        sdata->vif.csa_active = true;
 
+        mutex_lock(&local->chanctx_mtx);
         if (local->use_chanctx) {
-                sdata_info(sdata,
-                           "not handling channel switch with channel contexts\n");
-                ieee80211_queue_work(&local->hw,
-                                     &ifmgd->csa_connection_drop_work);
-                return;
+                u32 num_chanctx = 0;
+                list_for_each_entry(chanctx, &local->chanctx_list, list)
+                       num_chanctx++;
+
+                if (num_chanctx > 1 ||
+                    !(local->hw.flags & IEEE80211_HW_CHANCTX_STA_CSA)) {
+                        sdata_info(sdata,
+                                   "not handling chan-switch with channel contexts\n");
+                        ieee80211_queue_work(&local->hw,
+                                             &ifmgd->csa_connection_drop_work);
+                        mutex_unlock(&local->chanctx_mtx);
+                        return;
+                }
         }
 
-        mutex_lock(&local->chanctx_mtx);
         if (WARN_ON(!rcu_access_pointer(sdata->vif.chanctx_conf))) {
+                ieee80211_queue_work(&local->hw,
+                                     &ifmgd->csa_connection_drop_work);
                 mutex_unlock(&local->chanctx_mtx);
                 return;
         }
@@ -1374,8 +1194,7 @@ static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
         if (!mgd->associated)
                 return false;
 
-        if (mgd->flags & (IEEE80211_STA_BEACON_POLL |
-                          IEEE80211_STA_CONNECTION_POLL))
+        if (mgd->flags & IEEE80211_STA_CONNECTION_POLL)
                 return false;
 
         if (!mgd->have_beacon)
@@ -1691,8 +1510,7 @@ static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
 {
         lockdep_assert_held(&sdata->local->mtx);
 
-        sdata->u.mgd.flags &= ~(IEEE80211_STA_CONNECTION_POLL |
-                                IEEE80211_STA_BEACON_POLL);
+        sdata->u.mgd.flags &= ~IEEE80211_STA_CONNECTION_POLL;
         ieee80211_run_deferred_scan(sdata->local);
 }
 
@@ -1954,11 +1772,8 @@ static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_local *local = sdata->local;
 
         mutex_lock(&local->mtx);
-        if (!(ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
-                              IEEE80211_STA_CONNECTION_POLL))) {
-                mutex_unlock(&local->mtx);
-                return;
-        }
+        if (!(ifmgd->flags & IEEE80211_STA_CONNECTION_POLL))
+                goto out;
 
         __ieee80211_stop_poll(sdata);
 
@@ -2094,15 +1909,9 @@ static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
          * because otherwise we would reset the timer every time and
          * never check whether we received a probe response!
          */
-        if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
-                            IEEE80211_STA_CONNECTION_POLL))
+        if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
                 already = true;
 
-        if (beacon)
-                ifmgd->flags |= IEEE80211_STA_BEACON_POLL;
-        else
-                ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;
-
         mutex_unlock(&sdata->local->mtx);
 
         if (already)
@@ -2174,6 +1983,7 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
                                WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
                                true, frame_buf);
         ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
+        sdata->vif.csa_active = false;
         ieee80211_wake_queues_by_reason(&sdata->local->hw,
                                         IEEE80211_MAX_QUEUE_MAP,
                                         IEEE80211_QUEUE_STOP_REASON_CSA);
@@ -3061,17 +2871,10 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                 }
         }
 
-        if (ifmgd->flags & IEEE80211_STA_BEACON_POLL) {
+        if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL) {
                 mlme_dbg_ratelimited(sdata,
                                      "cancelling AP probe due to a received beacon\n");
-                mutex_lock(&local->mtx);
-                ifmgd->flags &= ~IEEE80211_STA_BEACON_POLL;
-                ieee80211_run_deferred_scan(local);
-                mutex_unlock(&local->mtx);
-
-                mutex_lock(&local->iflist_mtx);
-                ieee80211_recalc_ps(local, -1);
-                mutex_unlock(&local->iflist_mtx);
+                ieee80211_reset_ap_probe(sdata);
         }
 
         /*
@@ -3543,8 +3346,7 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
         } else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
                 run_again(sdata, ifmgd->assoc_data->timeout);
 
-        if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
-                            IEEE80211_STA_CONNECTION_POLL) &&
+        if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL &&
             ifmgd->associated) {
                 u8 bssid[ETH_ALEN];
                 int max_tries;
@@ -3876,7 +3678,7 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
                 return ret;
 
         while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
-                ifmgd->flags |= chandef_downgrade(&chandef);
+                ifmgd->flags |= ieee80211_chandef_downgrade(&chandef);
                 ret = ieee80211_vif_use_channel(sdata, &chandef,
                                                 IEEE80211_CHANCTX_SHARED);
         }
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 8b5f7ef7c0c9..7fa1b36e6202 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -203,6 +203,15 @@ minstrel_update_stats(struct minstrel_priv *mp, struct minstrel_sta_info *mi)
         memcpy(mi->max_tp_rate, tmp_tp_rate, sizeof(mi->max_tp_rate));
         mi->max_prob_rate = tmp_prob_rate;
 
+#ifdef CONFIG_MAC80211_DEBUGFS
+        /* use fixed index if set */
+        if (mp->fixed_rate_idx != -1) {
+                mi->max_tp_rate[0] = mp->fixed_rate_idx;
+                mi->max_tp_rate[1] = mp->fixed_rate_idx;
+                mi->max_prob_rate = mp->fixed_rate_idx;
+        }
+#endif
+
         /* Reset update timer */
         mi->stats_update = jiffies;
 
@@ -310,6 +319,11 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
         /* increase sum packet counter */
         mi->packet_count++;
 
+#ifdef CONFIG_MAC80211_DEBUGFS
+        if (mp->fixed_rate_idx != -1)
+                return;
+#endif
+
         delta = (mi->packet_count * sampling_ratio / 100) -
                         (mi->sample_count + mi->sample_deferred / 2);
 
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index 7c323f27ba23..5d60779a0c1b 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -365,6 +365,14 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
                 }
         }
 
+#ifdef CONFIG_MAC80211_DEBUGFS
+        /* use fixed index if set */
+        if (mp->fixed_rate_idx != -1) {
+                mi->max_tp_rate = mp->fixed_rate_idx;
+                mi->max_tp_rate2 = mp->fixed_rate_idx;
+                mi->max_prob_rate = mp->fixed_rate_idx;
+        }
+#endif
 
         mi->stats_update = jiffies;
 }
@@ -774,6 +782,11 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
         info->flags |= mi->tx_flags;
         minstrel_ht_check_cck_shortpreamble(mp, mi, txrc->short_preamble);
 
+#ifdef CONFIG_MAC80211_DEBUGFS
+        if (mp->fixed_rate_idx != -1)
+                return;
+#endif
+
         /* Don't use EAPOL frames for sampling on non-mrr hw */
         if (mp->hw->max_rates == 1 &&
             (info->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO))
@@ -781,16 +794,6 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
         else
                 sample_idx = minstrel_get_sample_rate(mp, mi);
 
-#ifdef CONFIG_MAC80211_DEBUGFS
-        /* use fixed index if set */
-        if (mp->fixed_rate_idx != -1) {
-                mi->max_tp_rate = mp->fixed_rate_idx;
-                mi->max_tp_rate2 = mp->fixed_rate_idx;
-                mi->max_prob_rate = mp->fixed_rate_idx;
-                sample_idx = -1;
-        }
-#endif
-
         mi->total_packets++;
 
         /* wraparound */
diff --git a/net/mac80211/rc80211_pid_debugfs.c b/net/mac80211/rc80211_pid_debugfs.c
index c97a0657c043..6ff134650a84 100644
--- a/net/mac80211/rc80211_pid_debugfs.c
+++ b/net/mac80211/rc80211_pid_debugfs.c
@@ -167,29 +167,29 @@ static ssize_t rate_control_pid_events_read(struct file *file, char __user *buf,
          * provide large enough buffers. */
         length = length < RC_PID_PRINT_BUF_SIZE ?
                  length : RC_PID_PRINT_BUF_SIZE;
-        p = snprintf(pb, length, "%u %lu ", ev->id, ev->timestamp);
+        p = scnprintf(pb, length, "%u %lu ", ev->id, ev->timestamp);
         switch (ev->type) {
         case RC_PID_EVENT_TYPE_TX_STATUS:
-                p += snprintf(pb + p, length - p, "tx_status %u %u",
-                              !(ev->data.flags & IEEE80211_TX_STAT_ACK),
-                              ev->data.tx_status.status.rates[0].idx);
+                p += scnprintf(pb + p, length - p, "tx_status %u %u",
+                               !(ev->data.flags & IEEE80211_TX_STAT_ACK),
+                               ev->data.tx_status.status.rates[0].idx);
                 break;
         case RC_PID_EVENT_TYPE_RATE_CHANGE:
-                p += snprintf(pb + p, length - p, "rate_change %d %d",
-                              ev->data.index, ev->data.rate);
+                p += scnprintf(pb + p, length - p, "rate_change %d %d",
+                               ev->data.index, ev->data.rate);
                 break;
         case RC_PID_EVENT_TYPE_TX_RATE:
-                p += snprintf(pb + p, length - p, "tx_rate %d %d",
-                              ev->data.index, ev->data.rate);
+                p += scnprintf(pb + p, length - p, "tx_rate %d %d",
+                               ev->data.index, ev->data.rate);
                 break;
         case RC_PID_EVENT_TYPE_PF_SAMPLE:
-                p += snprintf(pb + p, length - p,
-                              "pf_sample %d %d %d %d",
-                              ev->data.pf_sample, ev->data.prop_err,
-                              ev->data.int_err, ev->data.der_err);
+                p += scnprintf(pb + p, length - p,
+                               "pf_sample %d %d %d %d",
+                               ev->data.pf_sample, ev->data.prop_err,
+                               ev->data.int_err, ev->data.der_err);
                 break;
         }
-        p += snprintf(pb + p, length - p, "\n");
+        p += scnprintf(pb + p, length - p, "\n");
 
         spin_unlock_irqrestore(&events->lock, status);
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 674eac1f996c..0011ac815097 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -995,8 +995,9 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
                                 rx->sta->num_duplicates++;
                         }
                         return RX_DROP_UNUSABLE;
-                } else
+                } else if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
                         rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;
+                }
         }
 
         if (unlikely(rx->skb->len < 16)) {
@@ -2402,7 +2403,8 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                 return RX_DROP_UNUSABLE;
 
         if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
-            mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED)
+            mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED &&
+            mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
                 return RX_DROP_UNUSABLE;
 
         if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
@@ -2566,31 +2568,46 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
 
                 goto queue;
         case WLAN_CATEGORY_SPECTRUM_MGMT:
-                if (status->band != IEEE80211_BAND_5GHZ)
-                        break;
-
-                if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                        break;
-
                 /* verify action_code is present */
                 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
                         break;
 
                 switch (mgmt->u.action.u.measurement.action_code) {
                 case WLAN_ACTION_SPCT_MSR_REQ:
+                        if (status->band != IEEE80211_BAND_5GHZ)
+                                break;
+
                         if (len < (IEEE80211_MIN_ACTION_SIZE +
                                    sizeof(mgmt->u.action.u.measurement)))
                                 break;
+
+                        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                                break;
+
                         ieee80211_process_measurement_req(sdata, mgmt, len);
                         goto handled;
-                case WLAN_ACTION_SPCT_CHL_SWITCH:
-                        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                case WLAN_ACTION_SPCT_CHL_SWITCH: {
+                        u8 *bssid;
+                        if (len < (IEEE80211_MIN_ACTION_SIZE +
+                                   sizeof(mgmt->u.action.u.chan_switch)))
+                                break;
+
+                        if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+                            sdata->vif.type != NL80211_IFTYPE_ADHOC)
                                 break;
 
-                        if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid))
+                        if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                                bssid = sdata->u.mgd.bssid;
+                        else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                                bssid = sdata->u.ibss.bssid;
+                        else
+                                break;
+
+                        if (!ether_addr_equal(mgmt->bssid, bssid))
                                 break;
 
                         goto queue;
+                        }
                 }
                 break;
         case WLAN_CATEGORY_SA_QUERY:
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 08afe74b98f4..ecb57b0bf74a 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -391,8 +391,7 @@ static bool ieee80211_can_scan(struct ieee80211_local *local,
                 return false;
 
         if (sdata->vif.type == NL80211_IFTYPE_STATION &&
-            sdata->u.mgd.flags & (IEEE80211_STA_BEACON_POLL |
-                                  IEEE80211_STA_CONNECTION_POLL))
+            sdata->u.mgd.flags & IEEE80211_STA_CONNECTION_POLL)
                 return false;
 
         return true;
diff --git a/net/mac80211/spectmgmt.c b/net/mac80211/spectmgmt.c
index 578eea3fc04d..921597e279a3 100644
--- a/net/mac80211/spectmgmt.c
+++ b/net/mac80211/spectmgmt.c
@@ -21,6 +21,168 @@
 #include "sta_info.h"
 #include "wme.h"
 
+int ieee80211_parse_ch_switch_ie(struct ieee80211_sub_if_data *sdata,
+                                 struct ieee802_11_elems *elems, bool beacon,
+                                 enum ieee80211_band current_band,
+                                 u32 sta_flags, u8 *bssid, u8 *count, u8 *mode,
+                                 struct cfg80211_chan_def *new_chandef)
+{
+        enum ieee80211_band new_band;
+        int new_freq;
+        u8 new_chan_no;
+        struct ieee80211_channel *new_chan;
+        struct cfg80211_chan_def new_vht_chandef = {};
+        const struct ieee80211_sec_chan_offs_ie *sec_chan_offs;
+        const struct ieee80211_wide_bw_chansw_ie *wide_bw_chansw_ie;
+        const struct ieee80211_ht_operation *ht_oper;
+        int secondary_channel_offset = -1;
+
+        sec_chan_offs = elems->sec_chan_offs;
+        wide_bw_chansw_ie = elems->wide_bw_chansw_ie;
+        ht_oper = elems->ht_operation;
+
+        if (sta_flags & (IEEE80211_STA_DISABLE_HT |
+                         IEEE80211_STA_DISABLE_40MHZ)) {
+                sec_chan_offs = NULL;
+                wide_bw_chansw_ie = NULL;
+                /* only used for bandwidth here */
+                ht_oper = NULL;
+        }
+
+        if (sta_flags & IEEE80211_STA_DISABLE_VHT)
+                wide_bw_chansw_ie = NULL;
+
+        if (elems->ext_chansw_ie) {
+                if (!ieee80211_operating_class_to_band(
+                                elems->ext_chansw_ie->new_operating_class,
+                                &new_band)) {
+                        sdata_info(sdata,
+                                   "cannot understand ECSA IE operating class %d, disconnecting\n",
+                                   elems->ext_chansw_ie->new_operating_class);
+                        return -EINVAL;
+                }
+                new_chan_no = elems->ext_chansw_ie->new_ch_num;
+                *count = elems->ext_chansw_ie->count;
+                *mode = elems->ext_chansw_ie->mode;
+        } else if (elems->ch_switch_ie) {
+                new_band = current_band;
+                new_chan_no = elems->ch_switch_ie->new_ch_num;
+                *count = elems->ch_switch_ie->count;
+                *mode = elems->ch_switch_ie->mode;
+        } else {
+                /* nothing here we understand */
+                return 1;
+        }
+
+        new_freq = ieee80211_channel_to_frequency(new_chan_no, new_band);
+        new_chan = ieee80211_get_channel(sdata->local->hw.wiphy, new_freq);
+        if (!new_chan || new_chan->flags & IEEE80211_CHAN_DISABLED) {
+                sdata_info(sdata,
+                           "BSS %pM switches to unsupported channel (%d MHz), disconnecting\n",
+                           bssid, new_freq);
+                return -EINVAL;
+        }
+
+        if (!beacon && sec_chan_offs) {
+                secondary_channel_offset = sec_chan_offs->sec_chan_offs;
+        } else if (beacon && ht_oper) {
+                secondary_channel_offset =
+                        ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET;
+        } else if (!(sta_flags & IEEE80211_STA_DISABLE_HT)) {
+                /* If it's not a beacon, HT is enabled and the IE not present,
+                 * it's 20 MHz, 802.11-2012 8.5.2.6:
+                 *      This element [the Secondary Channel Offset Element] is
+                 *      present when switching to a 40 MHz channel. It may be
+                 *      present when switching to a 20 MHz channel (in which
+                 *      case the secondary channel offset is set to SCN).
+                 */
+                secondary_channel_offset = IEEE80211_HT_PARAM_CHA_SEC_NONE;
+        }
+
+        switch (secondary_channel_offset) {
+        default:
+                /* secondary_channel_offset was present but is invalid */
+        case IEEE80211_HT_PARAM_CHA_SEC_NONE:
+                cfg80211_chandef_create(new_chandef, new_chan,
+                                        NL80211_CHAN_HT20);
+                break;
+        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
+                cfg80211_chandef_create(new_chandef, new_chan,
+                                        NL80211_CHAN_HT40PLUS);
+                break;
+        case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
+                cfg80211_chandef_create(new_chandef, new_chan,
+                                        NL80211_CHAN_HT40MINUS);
+                break;
+        case -1:
+                cfg80211_chandef_create(new_chandef, new_chan,
+                                        NL80211_CHAN_NO_HT);
+                /* keep width for 5/10 MHz channels */
+                switch (sdata->vif.bss_conf.chandef.width) {
+                case NL80211_CHAN_WIDTH_5:
+                case NL80211_CHAN_WIDTH_10:
+                        new_chandef->width = sdata->vif.bss_conf.chandef.width;
+                        break;
+                default:
+                        break;
+                }
+                break;
+        }
+
+        if (wide_bw_chansw_ie) {
+                new_vht_chandef.chan = new_chan;
+                new_vht_chandef.center_freq1 =
+                        ieee80211_channel_to_frequency(
+                                wide_bw_chansw_ie->new_center_freq_seg0,
+                                new_band);
+
+                switch (wide_bw_chansw_ie->new_channel_width) {
+                default:
+                        /* hmmm, ignore VHT and use HT if present */
+                case IEEE80211_VHT_CHANWIDTH_USE_HT:
+                        new_vht_chandef.chan = NULL;
+                        break;
+                case IEEE80211_VHT_CHANWIDTH_80MHZ:
+                        new_vht_chandef.width = NL80211_CHAN_WIDTH_80;
+                        break;
+                case IEEE80211_VHT_CHANWIDTH_160MHZ:
+                        new_vht_chandef.width = NL80211_CHAN_WIDTH_160;
+                        break;
+                case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
+                        /* field is otherwise reserved */
+                        new_vht_chandef.center_freq2 =
+                                ieee80211_channel_to_frequency(
+                                        wide_bw_chansw_ie->new_center_freq_seg1,
+                                        new_band);
+                        new_vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
+                        break;
+                }
+                if (sta_flags & IEEE80211_STA_DISABLE_80P80MHZ &&
+                    new_vht_chandef.width == NL80211_CHAN_WIDTH_80P80)
+                        ieee80211_chandef_downgrade(&new_vht_chandef);
+                if (sta_flags & IEEE80211_STA_DISABLE_160MHZ &&
+                    new_vht_chandef.width == NL80211_CHAN_WIDTH_160)
+                        ieee80211_chandef_downgrade(&new_vht_chandef);
+                if (sta_flags & IEEE80211_STA_DISABLE_40MHZ &&
+                    new_vht_chandef.width > NL80211_CHAN_WIDTH_20)
+                        ieee80211_chandef_downgrade(&new_vht_chandef);
+        }
+
+        /* if VHT data is there validate & use it */
+        if (new_vht_chandef.chan) {
+                if (!cfg80211_chandef_compatible(&new_vht_chandef,
+                                                 new_chandef)) {
+                        sdata_info(sdata,
+                                   "BSS %pM: CSA has inconsistent channel data, disconnecting\n",
+                                   bssid);
+                        return -EINVAL;
+                }
+                *new_chandef = new_vht_chandef;
+        }
+
+        return 0;
+}
+
 static void ieee80211_send_refuse_measurement_request(struct ieee80211_sub_if_data *sdata,
                                         struct ieee80211_msrment_ie *request_ie,
                                         const u8 *da, const u8 *bssid,
diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
index 3fb9dd6d02fc..d4cee98533fd 100644
--- a/net/mac80211/trace.h
+++ b/net/mac80211/trace.h
@@ -1475,6 +1475,41 @@ DEFINE_EVENT(local_sdata_evt, drv_ipv6_addr_change,
 );
 #endif
 
+TRACE_EVENT(drv_join_ibss,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
+                 struct ieee80211_bss_conf *info),
+
+        TP_ARGS(local, sdata, info),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                __field(u8, dtimper)
+                __field(u16, bcnint)
+                __dynamic_array(u8, ssid, info->ssid_len);
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                __entry->dtimper = info->dtim_period;
+                __entry->bcnint = info->beacon_int;
+                memcpy(__get_dynamic_array(ssid), info->ssid, info->ssid_len);
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT  VIF_PR_FMT,
+                LOCAL_PR_ARG, VIF_PR_ARG
+        )
+);
+
+DEFINE_EVENT(local_sdata_evt, drv_leave_ibss,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata),
+        TP_ARGS(local, sdata)
+);
+
 /*
  * Tracing for API calls that drivers call.
  */
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 3456c0486b48..4fcbf634b548 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1981,7 +1981,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
          * EAPOL frames from the local station.
          */
         if (unlikely(!ieee80211_vif_is_mesh(&sdata->vif) &&
-                     !is_multicast_ether_addr(hdr.addr1) && !authorized &&
+                     !multicast && !authorized &&
                      (cpu_to_be16(ethertype) != sdata->control_port_protocol ||
                       !ether_addr_equal(sdata->vif.addr, skb->data + ETH_ALEN)))) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
@@ -2357,15 +2357,31 @@ static void ieee80211_update_csa(struct ieee80211_sub_if_data *sdata,
         struct probe_resp *resp;
         int counter_offset_beacon = sdata->csa_counter_offset_beacon;
         int counter_offset_presp = sdata->csa_counter_offset_presp;
+        u8 *beacon_data;
+        size_t beacon_data_len;
+
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_AP:
+                beacon_data = beacon->tail;
+                beacon_data_len = beacon->tail_len;
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                beacon_data = beacon->head;
+                beacon_data_len = beacon->head_len;
+                break;
+        default:
+                return;
+        }
+        if (WARN_ON(counter_offset_beacon >= beacon_data_len))
+                return;
 
         /* warn if the driver did not check for/react to csa completeness */
-        if (WARN_ON(((u8 *)beacon->tail)[counter_offset_beacon] == 0))
+        if (WARN_ON(beacon_data[counter_offset_beacon] == 0))
                 return;
 
-        ((u8 *)beacon->tail)[counter_offset_beacon]--;
+        beacon_data[counter_offset_beacon]--;
 
-        if (sdata->vif.type == NL80211_IFTYPE_AP &&
-            counter_offset_presp) {
+        if (sdata->vif.type == NL80211_IFTYPE_AP && counter_offset_presp) {
                 rcu_read_lock();
                 resp = rcu_dereference(sdata->u.ap.probe_resp);
 
@@ -2400,6 +2416,15 @@ bool ieee80211_csa_is_complete(struct ieee80211_vif *vif)
                         goto out;
                 beacon_data = beacon->tail;
                 beacon_data_len = beacon->tail_len;
+        } else if (vif->type == NL80211_IFTYPE_ADHOC) {
+                struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+
+                beacon = rcu_dereference(ifibss->presp);
+                if (!beacon)
+                        goto out;
+
+                beacon_data = beacon->head;
+                beacon_data_len = beacon->head_len;
         } else {
                 WARN_ON(1);
                 goto out;
@@ -2484,6 +2509,10 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                 if (!presp)
                         goto out;
 
+                if (sdata->vif.csa_active)
+                        ieee80211_update_csa(sdata, presp);
+
+
                 skb = dev_alloc_skb(local->tx_headroom + presp->head_len);
                 if (!skb)
                         goto out;
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 9c3200bcfc02..1220f5afdb7e 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -567,18 +567,15 @@ void ieee80211_flush_queues(struct ieee80211_local *local,
                                         IEEE80211_QUEUE_STOP_REASON_FLUSH);
 }
 
-void ieee80211_iterate_active_interfaces(
-        struct ieee80211_hw *hw, u32 iter_flags,
-        void (*iterator)(void *data, u8 *mac,
-                         struct ieee80211_vif *vif),
-        void *data)
+static void __iterate_active_interfaces(struct ieee80211_local *local,
+                                        u32 iter_flags,
+                                        void (*iterator)(void *data, u8 *mac,
+                                                struct ieee80211_vif *vif),
+                                        void *data)
 {
-        struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_sub_if_data *sdata;
 
-        mutex_lock(&local->iflist_mtx);
-
-        list_for_each_entry(sdata, &local->interfaces, list) {
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
                 switch (sdata->vif.type) {
                 case NL80211_IFTYPE_MONITOR:
                         if (!(sdata->u.mntr_flags & MONITOR_FLAG_ACTIVE))
@@ -597,13 +594,25 @@ void ieee80211_iterate_active_interfaces(
                                  &sdata->vif);
         }
 
-        sdata = rcu_dereference_protected(local->monitor_sdata,
-                                          lockdep_is_held(&local->iflist_mtx));
+        sdata = rcu_dereference_check(local->monitor_sdata,
+                                      lockdep_is_held(&local->iflist_mtx) ||
+                                      lockdep_rtnl_is_held());
         if (sdata &&
             (iter_flags & IEEE80211_IFACE_ITER_RESUME_ALL ||
              sdata->flags & IEEE80211_SDATA_IN_DRIVER))
                 iterator(data, sdata->vif.addr, &sdata->vif);
+}
+
+void ieee80211_iterate_active_interfaces(
+        struct ieee80211_hw *hw, u32 iter_flags,
+        void (*iterator)(void *data, u8 *mac,
+                         struct ieee80211_vif *vif),
+        void *data)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
 
+        mutex_lock(&local->iflist_mtx);
+        __iterate_active_interfaces(local, iter_flags, iterator, data);
         mutex_unlock(&local->iflist_mtx);
 }
 EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces);
@@ -615,38 +624,26 @@ void ieee80211_iterate_active_interfaces_atomic(
         void *data)
 {
         struct ieee80211_local *local = hw_to_local(hw);
-        struct ieee80211_sub_if_data *sdata;
 
         rcu_read_lock();
+        __iterate_active_interfaces(local, iter_flags, iterator, data);
+        rcu_read_unlock();
+}
+EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces_atomic);
 
-        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
-                switch (sdata->vif.type) {
-                case NL80211_IFTYPE_MONITOR:
-                        if (!(sdata->u.mntr_flags & MONITOR_FLAG_ACTIVE))
-                                continue;
-                        break;
-                case NL80211_IFTYPE_AP_VLAN:
-                        continue;
-                default:
-                        break;
-                }
-                if (!(iter_flags & IEEE80211_IFACE_ITER_RESUME_ALL) &&
-                    !(sdata->flags & IEEE80211_SDATA_IN_DRIVER))
-                        continue;
-                if (ieee80211_sdata_running(sdata))
-                        iterator(data, sdata->vif.addr,
-                                 &sdata->vif);
-        }
+void ieee80211_iterate_active_interfaces_rtnl(
+        struct ieee80211_hw *hw, u32 iter_flags,
+        void (*iterator)(void *data, u8 *mac,
+                         struct ieee80211_vif *vif),
+        void *data)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
 
-        sdata = rcu_dereference(local->monitor_sdata);
-        if (sdata &&
-            (iter_flags & IEEE80211_IFACE_ITER_RESUME_ALL ||
-             sdata->flags & IEEE80211_SDATA_IN_DRIVER))
-                iterator(data, sdata->vif.addr, &sdata->vif);
+        ASSERT_RTNL();
 
-        rcu_read_unlock();
+        __iterate_active_interfaces(local, iter_flags, iterator, data);
 }
-EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces_atomic);
+EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces_rtnl);
 
 /*
  * Nothing should have been stuffed into the workqueue during
@@ -1007,14 +1004,21 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata,
          */
         enable_qos = (sdata->vif.type != NL80211_IFTYPE_STATION);
 
-        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
-                /* Set defaults according to 802.11-2007 Table 7-37 */
-                aCWmax = 1023;
-                if (use_11b)
-                        aCWmin = 31;
-                else
-                        aCWmin = 15;
+        /* Set defaults according to 802.11-2007 Table 7-37 */
+        aCWmax = 1023;
+        if (use_11b)
+                aCWmin = 31;
+        else
+                aCWmin = 15;
+
+        /* Confiure old 802.11b/g medium access rules. */
+        qparam.cw_max = aCWmax;
+        qparam.cw_min = aCWmin;
+        qparam.txop = 0;
+        qparam.aifs = 2;
 
+        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+                /* Update if QoS is enabled. */
                 if (enable_qos) {
                         switch (ac) {
                         case IEEE80211_AC_BK:
@@ -1050,12 +1054,6 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata,
                                 qparam.aifs = 2;
                                 break;
                         }
-                } else {
-                        /* Confiure old 802.11b/g medium access rules. */
-                        qparam.cw_max = aCWmax;
-                        qparam.cw_min = aCWmin;
-                        qparam.txop = 0;
-                        qparam.aifs = 2;
                 }
 
                 qparam.uapsd = false;
@@ -1084,8 +1082,8 @@ void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_mgmt *mgmt;
         int err;
 
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom +
-                            sizeof(*mgmt) + 6 + extra_len);
+        /* 24 + 6 = header + auth_algo + auth_transaction + status_code */
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 24 + 6 + extra_len);
         if (!skb)
                 return;
 
@@ -2292,3 +2290,63 @@ void ieee80211_radar_detected(struct ieee80211_hw *hw)
         ieee80211_queue_work(hw, &local->radar_detected_work);
 }
 EXPORT_SYMBOL(ieee80211_radar_detected);
+
+u32 ieee80211_chandef_downgrade(struct cfg80211_chan_def *c)
+{
+        u32 ret;
+        int tmp;
+
+        switch (c->width) {
+        case NL80211_CHAN_WIDTH_20:
+                c->width = NL80211_CHAN_WIDTH_20_NOHT;
+                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
+                break;
+        case NL80211_CHAN_WIDTH_40:
+                c->width = NL80211_CHAN_WIDTH_20;
+                c->center_freq1 = c->chan->center_freq;
+                ret = IEEE80211_STA_DISABLE_40MHZ |
+                      IEEE80211_STA_DISABLE_VHT;
+                break;
+        case NL80211_CHAN_WIDTH_80:
+                tmp = (30 + c->chan->center_freq - c->center_freq1)/20;
+                /* n_P40 */
+                tmp /= 2;
+                /* freq_P40 */
+                c->center_freq1 = c->center_freq1 - 20 + 40 * tmp;
+                c->width = NL80211_CHAN_WIDTH_40;
+                ret = IEEE80211_STA_DISABLE_VHT;
+                break;
+        case NL80211_CHAN_WIDTH_80P80:
+                c->center_freq2 = 0;
+                c->width = NL80211_CHAN_WIDTH_80;
+                ret = IEEE80211_STA_DISABLE_80P80MHZ |
+                      IEEE80211_STA_DISABLE_160MHZ;
+                break;
+        case NL80211_CHAN_WIDTH_160:
+                /* n_P20 */
+                tmp = (70 + c->chan->center_freq - c->center_freq1)/20;
+                /* n_P80 */
+                tmp /= 4;
+                c->center_freq1 = c->center_freq1 - 40 + 80 * tmp;
+                c->width = NL80211_CHAN_WIDTH_80;
+                ret = IEEE80211_STA_DISABLE_80P80MHZ |
+                      IEEE80211_STA_DISABLE_160MHZ;
+                break;
+        default:
+        case NL80211_CHAN_WIDTH_20_NOHT:
+                WARN_ON_ONCE(1);
+                c->width = NL80211_CHAN_WIDTH_20_NOHT;
+                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
+                break;
+        case NL80211_CHAN_WIDTH_5:
+        case NL80211_CHAN_WIDTH_10:
+                WARN_ON_ONCE(1);
+                /* keep c->width */
+                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
+                break;
+        }
+
+        WARN_ON_ONCE(!cfg80211_chandef_valid(c));
+
+        return ret;
+}
diff --git a/net/mac80211/vht.c b/net/mac80211/vht.c
index 97c289414e32..de0112785aae 100644
--- a/net/mac80211/vht.c
+++ b/net/mac80211/vht.c
@@ -185,13 +185,13 @@ ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata,
         if (own_cap.cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE) {
                 vht_cap->cap |= cap_info &
                                 (IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
-                                 IEEE80211_VHT_CAP_BEAMFORMER_ANTENNAS_MAX |
                                  IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MAX);
         }
 
         if (own_cap.cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)
                 vht_cap->cap |= cap_info &
-                                IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
+                                (IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
+                                 IEEE80211_VHT_CAP_BEAMFORMEE_STS_MAX);
 
         if (own_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)
                 vht_cap->cap |= cap_info &
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index 50f6195c8b70..16f3c3a7b2c1 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -328,6 +328,7 @@ int cfg80211_chandef_dfs_required(struct wiphy *wiphy,
         return cfg80211_get_chans_dfs_required(wiphy, chandef->center_freq2,
                                                width);
 }
+EXPORT_SYMBOL(cfg80211_chandef_dfs_required);
 
 static bool cfg80211_secondary_chans_ok(struct wiphy *wiphy,
                                         u32 center_freq, u32 bandwidth,
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 9ad43c619c54..b43efac4efca 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -382,15 +382,6 @@ int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
                                  enum cfg80211_chan_mode chanmode,
                                  u8 radar_detect);
 
-/**
- * cfg80211_chandef_dfs_required - checks if radar detection is required
- * @wiphy: the wiphy to validate against
- * @chandef: the channel definition to check
- * Return: 1 if radar detection is required, 0 if it is not, < 0 on error
- */
-int cfg80211_chandef_dfs_required(struct wiphy *wiphy,
-                                  const struct cfg80211_chan_def *c);
-
 void cfg80211_set_dfs_state(struct wiphy *wiphy,
                             const struct cfg80211_chan_def *chandef,
                             enum nl80211_dfs_state dfs_state);
diff --git a/net/wireless/debugfs.c b/net/wireless/debugfs.c
index 90d050036624..454157717efa 100644
--- a/net/wireless/debugfs.c
+++ b/net/wireless/debugfs.c
@@ -47,17 +47,19 @@ static int ht_print_chan(struct ieee80211_channel *chan,
                 return 0;
 
         if (chan->flags & IEEE80211_CHAN_DISABLED)
-                return snprintf(buf + offset,
-                                buf_size - offset,
-                                "%d Disabled\n",
-                                chan->center_freq);
-
-        return snprintf(buf + offset,
-                        buf_size - offset,
-                        "%d HT40 %c%c\n",
-                        chan->center_freq,
-                        (chan->flags & IEEE80211_CHAN_NO_HT40MINUS) ? ' ' : '-',
-                        (chan->flags & IEEE80211_CHAN_NO_HT40PLUS)  ? ' ' : '+');
+                return scnprintf(buf + offset,
+                                 buf_size - offset,
+                                 "%d Disabled\n",
+                                 chan->center_freq);
+
+        return scnprintf(buf + offset,
+                         buf_size - offset,
+                         "%d HT40 %c%c\n",
+                         chan->center_freq,
+                         (chan->flags & IEEE80211_CHAN_NO_HT40MINUS) ?
+                                ' ' : '-',
+                         (chan->flags & IEEE80211_CHAN_NO_HT40PLUS) ?
+                                ' ' : '+');
 }
 
 static ssize_t ht40allow_map_read(struct file *file,
diff --git a/net/wireless/genregdb.awk b/net/wireless/genregdb.awk
index 9392f8cbb901..42ed274e81f4 100644
--- a/net/wireless/genregdb.awk
+++ b/net/wireless/genregdb.awk
@@ -46,6 +46,12 @@ BEGIN {
         sub(/:/, "", country)
         printf "static const struct ieee80211_regdomain regdom_%s = {\n", country
         printf "\t.alpha2 = \"%s\",\n", country
+        if ($NF ~ /DFS-ETSI/)
+                printf "\t.dfs_region = NL80211_DFS_ETSI,\n"
+        else if ($NF ~ /DFS-FCC/)
+                printf "\t.dfs_region = NL80211_DFS_FCC,\n"
+        else if ($NF ~ /DFS-JP/)
+                printf "\t.dfs_region = NL80211_DFS_JP,\n"
         printf "\t.reg_rules = {\n"
         active = 1
         regdb = regdb "\t&regdom_" country ",\n"
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 626dc3b5fd8d..cbbef88a8ebd 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -5591,6 +5591,9 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,
         if (err)
                 return err;
 
+        if (netif_carrier_ok(dev))
+                return -EBUSY;
+
         if (wdev->cac_started)
                 return -EBUSY;
 
@@ -5634,15 +5637,26 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
         u8 radar_detect_width = 0;
         int err;
+        bool need_new_beacon = false;
 
         if (!rdev->ops->channel_switch ||
             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
                 return -EOPNOTSUPP;
 
-        /* may add IBSS support later */
-        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
-            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
+        switch (dev->ieee80211_ptr->iftype) {
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_P2P_GO:
+                need_new_beacon = true;
+
+                /* useless if AP is not running */
+                if (!wdev->beacon_interval)
+                        return -EINVAL;
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                break;
+        default:
                 return -EOPNOTSUPP;
+        }
 
         memset(&params, 0, sizeof(params));
 
@@ -5651,15 +5665,16 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
                 return -EINVAL;
 
         /* only important for AP, IBSS and mesh create IEs internally */
-        if (!info->attrs[NL80211_ATTR_CSA_IES])
-                return -EINVAL;
-
-        /* useless if AP is not running */
-        if (!wdev->beacon_interval)
+        if (need_new_beacon &&
+            (!info->attrs[NL80211_ATTR_CSA_IES] ||
+             !info->attrs[NL80211_ATTR_CSA_C_OFF_BEACON]))
                 return -EINVAL;
 
         params.count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
 
+        if (!need_new_beacon)
+                goto skip_beacons;
+
         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
         if (err)
                 return err;
@@ -5699,6 +5714,7 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
                         return -EINVAL;
         }
 
+skip_beacons:
         err = nl80211_parse_chandef(rdev, info, &params.chandef);
         if (err)
                 return err;
@@ -5706,12 +5722,17 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
                 return -EINVAL;
 
-        err = cfg80211_chandef_dfs_required(wdev->wiphy, &params.chandef);
-        if (err < 0) {
-                return err;
-        } else if (err) {
-                radar_detect_width = BIT(params.chandef.width);
-                params.radar_required = true;
+        /* DFS channels are only supported for AP/P2P GO ... for now. */
+        if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP ||
+            dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) {
+                err = cfg80211_chandef_dfs_required(wdev->wiphy,
+                                                    &params.chandef);
+                if (err < 0) {
+                        return err;
+                } else if (err) {
+                        radar_detect_width = BIT(params.chandef.width);
+                        params.radar_required = true;
+                }
         }
 
         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
@@ -10740,7 +10761,8 @@ void cfg80211_ch_switch_notify(struct net_device *dev,
         wdev_lock(wdev);
 
         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
-                    wdev->iftype != NL80211_IFTYPE_P2P_GO))
+                    wdev->iftype != NL80211_IFTYPE_P2P_GO &&
+                    wdev->iftype != NL80211_IFTYPE_ADHOC))
                 goto out;
 
         wdev->channel = chandef->chan;
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index de06d5d1287f..d62cb1e91475 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -172,11 +172,21 @@ static const struct ieee80211_regdomain world_regdom = {
                         NL80211_RRF_NO_IBSS |
                         NL80211_RRF_NO_OFDM),
                 /* IEEE 802.11a, channel 36..48 */
-                REG_RULE(5180-10, 5240+10, 80, 6, 20,
+                REG_RULE(5180-10, 5240+10, 160, 6, 20,
                         NL80211_RRF_PASSIVE_SCAN |
                         NL80211_RRF_NO_IBSS),
 
-                /* NB: 5260 MHz - 5700 MHz requires DFS */
+                /* IEEE 802.11a, channel 52..64 - DFS required */
+                REG_RULE(5260-10, 5320+10, 160, 6, 20,
+                        NL80211_RRF_PASSIVE_SCAN |
+                        NL80211_RRF_NO_IBSS |
+                        NL80211_RRF_DFS),
+
+                /* IEEE 802.11a, channel 100..144 - DFS required */
+                REG_RULE(5500-10, 5720+10, 160, 6, 20,
+                        NL80211_RRF_PASSIVE_SCAN |
+                        NL80211_RRF_NO_IBSS |
+                        NL80211_RRF_DFS),
 
                 /* IEEE 802.11a, channel 149..165 */
                 REG_RULE(5745-10, 5825+10, 80, 6, 20,
diff --git a/net/wireless/util.c b/net/wireless/util.c
index ce090c1c5e4f..3c8be6104ba4 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -10,6 +10,7 @@
 #include <net/cfg80211.h>
 #include <net/ip.h>
 #include <net/dsfield.h>
+#include <linux/if_vlan.h>
 #include "core.h"
 #include "rdev-ops.h"
 
@@ -691,6 +692,7 @@ EXPORT_SYMBOL(ieee80211_amsdu_to_8023s);
 unsigned int cfg80211_classify8021d(struct sk_buff *skb)
 {
         unsigned int dscp;
+        unsigned char vlan_priority;
 
         /* skb->priority values from 256->263 are magic values to
          * directly indicate a specific 802.1d priority.  This is used
@@ -700,6 +702,13 @@ unsigned int cfg80211_classify8021d(struct sk_buff *skb)
         if (skb->priority >= 256 && skb->priority <= 263)
                 return skb->priority - 256;
 
+        if (vlan_tx_tag_present(skb)) {
+                vlan_priority = (vlan_tx_tag_get(skb) & VLAN_PRIO_MASK)
+                        >> VLAN_PRIO_SHIFT;
+                if (vlan_priority > 0)
+                        return vlan_priority;
+        }
+
         switch (skb->protocol) {
         case htons(ETH_P_IP):
                 dscp = ipv4_get_dsfield(ip_hdr(skb)) & 0xfc;