Merge remote-tracking branch 'wireless-next/master' into HEAD

518 files changed, 18896 insertions, 5239 deletions

diff --git a/Documentation/filesystems/vfs.txt b/Documentation/filesystems/vfs.txt
index f93a88250a44..deb48b5fd883 100644
--- a/Documentation/filesystems/vfs.txt
+++ b/Documentation/filesystems/vfs.txt
@@ -359,11 +359,9 @@ struct inode_operations {
         ssize_t (*listxattr) (struct dentry *, char *, size_t);
         int (*removexattr) (struct dentry *, const char *);
         void (*update_time)(struct inode *, struct timespec *, int);
-        int (*atomic_open)(struct inode *, struct dentry *,
+        int (*atomic_open)(struct inode *, struct dentry *, struct file *,
+                        unsigned open_flag, umode_t create_mode, int *opened);
         int (*tmpfile) (struct inode *, struct dentry *, umode_t);
-} ____cacheline_aligned;
-                                struct file *, unsigned open_flag,
-                                umode_t create_mode, int *opened);
 };
 
 Again, all methods are called without any locks being held, unless
@@ -470,9 +468,11 @@ otherwise noted.
         method the filesystem can look up, possibly create and open the file in
         one atomic operation.  If it cannot perform this (e.g. the file type
         turned out to be wrong) it may signal this by returning 1 instead of
-        usual 0 or -ve .  This method is only called if the last
-        component is negative or needs lookup.  Cached positive dentries are
-        still handled by f_op->open().
+        usual 0 or -ve .  This method is only called if the last component is
+        negative or needs lookup.  Cached positive dentries are still handled by
+        f_op->open().  If the file was created, the FILE_CREATED flag should be
+        set in "opened".  In case of O_EXCL the method must only succeed if the
+        file didn't exist and hence FILE_CREATED shall always be set on success.
 
   tmpfile: called in the end of O_TMPFILE open().  Optional, equivalent to
         atomically creating, opening and unlinking a file in given directory.
diff --git a/Documentation/networking/bonding.txt b/Documentation/networking/bonding.txt
index 87bbcfee2e06..9b28e714831a 100644
--- a/Documentation/networking/bonding.txt
+++ b/Documentation/networking/bonding.txt
@@ -1362,6 +1362,12 @@ To add ARP targets:
 To remove an ARP target:
 # echo -192.168.0.100 > /sys/class/net/bond0/bonding/arp_ip_target
 
+To configure the interval between learning packet transmits:
+# echo 12 > /sys/class/net/bond0/bonding/lp_interval
+        NOTE: the lp_inteval is the number of seconds between instances where
+the bonding driver sends learning packets to each slaves peer switch.  The
+default interval is 1 second.
+
 Example Configuration
 ---------------------
         We begin with the same example that is shown in section 3.3,
diff --git a/Documentation/scheduler/sched-design-CFS.txt b/Documentation/scheduler/sched-design-CFS.txt
index d529e02d928d..f14f49304222 100644
--- a/Documentation/scheduler/sched-design-CFS.txt
+++ b/Documentation/scheduler/sched-design-CFS.txt
@@ -66,9 +66,7 @@ rq->cfs.load value, which is the sum of the weights of the tasks queued on the
 runqueue.
 
 CFS maintains a time-ordered rbtree, where all runnable tasks are sorted by the
-p->se.vruntime key (there is a subtraction using rq->cfs.min_vruntime to
-account for possible wraparounds).  CFS picks the "leftmost" task from this
-tree and sticks to it.
+p->se.vruntime key. CFS picks the "leftmost" task from this tree and sticks to it.
 As the system progresses forwards, the executed tasks are put into the tree
 more and more to the right --- slowly but surely giving a chance for every task
 to become the "leftmost task" and thus get on the CPU within a deterministic
diff --git a/MAINTAINERS b/MAINTAINERS
index e61c2e83fc2b..da6cf1676f2c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -6816,6 +6816,14 @@ L:	linux-hexagon@vger.kernel.org
 S:      Supported
 F:      arch/hexagon/
 
+QUALCOMM WCN36XX WIRELESS DRIVER
+M:      Eugene Krasnikov <k.eugene.e@gmail.com>
+L:      wcn36xx@lists.infradead.org
+W:      http://wireless.kernel.org/en/users/Drivers/wcn36xx
+T:      git git://github.com/KrasnikovEugene/wcn36xx.git
+S:      Supported
+F:      drivers/net/wireless/ath/wcn36xx/
+
 QUICKCAM PARALLEL PORT WEBCAMS
 M:      Hans Verkuil <hverkuil@xs4all.nl>
 L:      linux-media@vger.kernel.org
diff --git a/arch/mips/Makefile b/arch/mips/Makefile
index 75a36ad11ff5..ca8f8340d75f 100644
--- a/arch/mips/Makefile
+++ b/arch/mips/Makefile
@@ -288,9 +288,6 @@ endif
 vmlinux.32: vmlinux
         $(OBJCOPY) -O $(32bit-bfd) $(OBJCOPYFLAGS) $< $@
 
-
-#obj-$(CONFIG_KPROBES)          += kprobes.o
-
 #
 # The 64-bit ELF tools are pretty broken so at this time we generate 64-bit
 # ELF files from 32-bit files by conversion.
diff --git a/arch/mips/alchemy/common/usb.c b/arch/mips/alchemy/common/usb.c
index fcc695626117..2adc7edda49c 100644
--- a/arch/mips/alchemy/common/usb.c
+++ b/arch/mips/alchemy/common/usb.c
@@ -14,6 +14,7 @@
 #include <linux/module.h>
 #include <linux/spinlock.h>
 #include <linux/syscore_ops.h>
+#include <asm/cpu.h>
 #include <asm/mach-au1x00/au1000.h>
 
 /* control register offsets */
@@ -358,7 +359,7 @@ static inline int au1200_coherency_bug(void)
 {
 #if defined(CONFIG_DMA_COHERENT)
         /* Au1200 AB USB does not support coherent memory */
-        if (!(read_c0_prid() & 0xff)) {
+        if (!(read_c0_prid() & PRID_REV_MASK)) {
                 printk(KERN_INFO "Au1200 USB: this is chip revision AB !!\n");
                 printk(KERN_INFO "Au1200 USB: update your board or re-configure"
                                  " the kernel\n");
diff --git a/arch/mips/bcm63xx/cpu.c b/arch/mips/bcm63xx/cpu.c
index 7e17374a9ae8..b713cd64b087 100644
--- a/arch/mips/bcm63xx/cpu.c
+++ b/arch/mips/bcm63xx/cpu.c
@@ -306,14 +306,14 @@ void __init bcm63xx_cpu_init(void)
 
         switch (c->cputype) {
         case CPU_BMIPS3300:
-                if ((read_c0_prid() & 0xff00) != PRID_IMP_BMIPS3300_ALT)
+                if ((read_c0_prid() & PRID_IMP_MASK) != PRID_IMP_BMIPS3300_ALT)
                         __cpu_name[cpu] = "Broadcom BCM6338";
                 /* fall-through */
         case CPU_BMIPS32:
                 chipid_reg = BCM_6345_PERF_BASE;
                 break;
         case CPU_BMIPS4350:
-                switch ((read_c0_prid() & 0xff)) {
+                switch ((read_c0_prid() & PRID_REV_MASK)) {
                 case 0x04:
                         chipid_reg = BCM_3368_PERF_BASE;
                         break;
diff --git a/arch/mips/boot/dts/include/dt-bindings b/arch/mips/boot/dts/include/dt-bindings
index 68ae3887b3e5..08c00e4972fa 120000
--- a/arch/mips/boot/dts/include/dt-bindings
+++ b/arch/mips/boot/dts/include/dt-bindings
@@ -1 +1 @@
-../../../../../include/dt-bindings
+../../../../../include/dt-bindings
\ No newline at end of file
diff --git a/arch/mips/cavium-octeon/csrc-octeon.c b/arch/mips/cavium-octeon/csrc-octeon.c
index 02193953eb9e..b752c4ed0b79 100644
--- a/arch/mips/cavium-octeon/csrc-octeon.c
+++ b/arch/mips/cavium-octeon/csrc-octeon.c
@@ -12,6 +12,7 @@
 #include <linux/smp.h>
 
 #include <asm/cpu-info.h>
+#include <asm/cpu-type.h>
 #include <asm/time.h>
 
 #include <asm/octeon/octeon.h>
diff --git a/arch/mips/dec/prom/init.c b/arch/mips/dec/prom/init.c
index ab169046e442..468f665de7bb 100644
--- a/arch/mips/dec/prom/init.c
+++ b/arch/mips/dec/prom/init.c
@@ -13,6 +13,7 @@
 
 #include <asm/bootinfo.h>
 #include <asm/cpu.h>
+#include <asm/cpu-type.h>
 #include <asm/processor.h>
 
 #include <asm/dec/prom.h>
diff --git a/arch/mips/include/asm/cpu-features.h b/arch/mips/include/asm/cpu-features.h
index fa44f3ec5302..51680d15ca8e 100644
--- a/arch/mips/include/asm/cpu-features.h
+++ b/arch/mips/include/asm/cpu-features.h
@@ -13,12 +13,6 @@
 #include <asm/cpu-info.h>
 #include <cpu-feature-overrides.h>
 
-#ifndef current_cpu_type
-#define current_cpu_type()      current_cpu_data.cputype
-#endif
-
-#define boot_cpu_type()         cpu_data[0].cputype
-
 /*
  * SMP assumption: Options of CPU 0 are a superset of all processors.
  * This is true for all known MIPS systems.
diff --git a/arch/mips/include/asm/cpu-info.h b/arch/mips/include/asm/cpu-info.h
index 41401d8eb7d1..21c8e29c8f91 100644
--- a/arch/mips/include/asm/cpu-info.h
+++ b/arch/mips/include/asm/cpu-info.h
@@ -84,6 +84,7 @@ struct cpuinfo_mips {
 extern struct cpuinfo_mips cpu_data[];
 #define current_cpu_data cpu_data[smp_processor_id()]
 #define raw_current_cpu_data cpu_data[raw_smp_processor_id()]
+#define boot_cpu_data cpu_data[0]
 
 extern void cpu_probe(void);
 extern void cpu_report(void);
diff --git a/arch/mips/include/asm/cpu-type.h b/arch/mips/include/asm/cpu-type.h
new file mode 100644
index 000000000000..4a402cc60c03
--- /dev/null
+++ b/arch/mips/include/asm/cpu-type.h
@@ -0,0 +1,203 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2003, 2004 Ralf Baechle
+ * Copyright (C) 2004  Maciej W. Rozycki
+ */
+#ifndef __ASM_CPU_TYPE_H
+#define __ASM_CPU_TYPE_H
+
+#include <linux/smp.h>
+#include <linux/compiler.h>
+
+static inline int __pure __get_cpu_type(const int cpu_type)
+{
+        switch (cpu_type) {
+#if defined(CONFIG_SYS_HAS_CPU_LOONGSON2E) || \
+    defined(CONFIG_SYS_HAS_CPU_LOONGSON2F)
+        case CPU_LOONGSON2:
+#endif
+
+#ifdef CONFIG_SYS_HAS_CPU_LOONGSON1B
+        case CPU_LOONGSON1:
+#endif
+
+#ifdef CONFIG_SYS_HAS_CPU_MIPS32_R1
+        case CPU_4KC:
+        case CPU_ALCHEMY:
+        case CPU_BMIPS3300:
+        case CPU_BMIPS4350:
+        case CPU_PR4450:
+        case CPU_BMIPS32:
+        case CPU_JZRISC:
+#endif
+
+#if defined(CONFIG_SYS_HAS_CPU_MIPS32_R1) || \
+    defined(CONFIG_SYS_HAS_CPU_MIPS32_R2)
+        case CPU_4KEC:
+#endif
+
+#ifdef CONFIG_SYS_HAS_CPU_MIPS32_R2
+        case CPU_4KSC:
+        case CPU_24K:
+        case CPU_34K:
+        case CPU_1004K:
+        case CPU_74K:
+        case CPU_M14KC:
+        case CPU_M14KEC:
+#endif
+
+#ifdef CONFIG_SYS_HAS_CPU_MIPS64_R1
+        case CPU_5KC:
+        case CPU_5KE:
+        case CPU_20KC:
+        case CPU_25KF:
+        case CPU_SB1:
+        case CPU_SB1A:
+#endif
+
+#ifdef CONFIG_SYS_HAS_CPU_MIPS64_R2
+        /*
+         * All MIPS64 R2 processors have their own special symbols.  That is,
+         * there currently is no pure R2 core
+         */
+#endif
+
+#ifdef CONFIG_SYS_HAS_CPU_R3000
+        case CPU_R2000:
+        case CPU_R3000:
+        case CPU_R3000A:
+        case CPU_R3041:
+        case CPU_R3051:
+        case CPU_R3052:
+        case CPU_R3081:
+        case CPU_R3081E:
+#endif
+
+#ifdef CONFIG_SYS_HAS_CPU_TX39XX
+        case CPU_TX3912:
+        case CPU_TX3922:
+        case CPU_TX3927:
+#endif
+
+#ifdef CONFIG_SYS_HAS_CPU_VR41XX
+        case CPU_VR41XX:
+        case CPU_VR4111:
+        case CPU_VR4121:
+        case CPU_VR4122:
+        case CPU_VR4131:
+        case CPU_VR4133:
+        case CPU_VR4181:
+        case CPU_VR4181A:
+#endif
+
+#ifdef CONFIG_SYS_HAS_CPU_R4300
+        case CPU_R4300:
+        case CPU_R4310:
+#endif
+
+#ifdef CONFIG_SYS_HAS_CPU_R4X00
+        case CPU_R4000PC:
+        case CPU_R4000SC:
+        case CPU_R4000MC:
+        case CPU_R4200:
+        case CPU_R4400PC:
+        case CPU_R4400SC:
+        case CPU_R4400MC:
+        case CPU_R4600:
+        case CPU_R4700:
+        case CPU_R4640:
+        case CPU_R4650:
+#endif
+
+#ifdef CONFIG_SYS_HAS_CPU_TX49XX
+        case CPU_TX49XX:
+#endif
+
+#ifdef CONFIG_SYS_HAS_CPU_R5000
+        case CPU_R5000:
+#endif
+
+#ifdef CONFIG_SYS_HAS_CPU_R5432
+        case CPU_R5432:
+#endif
+
+#ifdef CONFIG_SYS_HAS_CPU_R5500
+        case CPU_R5500:
+#endif
+
+#ifdef CONFIG_SYS_HAS_CPU_R6000
+        case CPU_R6000:
+        case CPU_R6000A:
+#endif
+
+#ifdef CONFIG_SYS_HAS_CPU_NEVADA
+        case CPU_NEVADA:
+#endif
+
+#ifdef CONFIG_SYS_HAS_CPU_R8000
+        case CPU_R8000:
+#endif
+
+#ifdef CONFIG_SYS_HAS_CPU_R10000
+        case CPU_R10000:
+        case CPU_R12000:
+        case CPU_R14000:
+#endif
+#ifdef CONFIG_SYS_HAS_CPU_RM7000
+        case CPU_RM7000:
+        case CPU_SR71000:
+#endif
+#ifdef CONFIG_SYS_HAS_CPU_RM9000
+        case CPU_RM9000:
+#endif
+#ifdef CONFIG_SYS_HAS_CPU_SB1
+        case CPU_SB1:
+        case CPU_SB1A:
+#endif
+#ifdef CONFIG_SYS_HAS_CPU_CAVIUM_OCTEON
+        case CPU_CAVIUM_OCTEON:
+        case CPU_CAVIUM_OCTEON_PLUS:
+        case CPU_CAVIUM_OCTEON2:
+#endif
+
+#ifdef CONFIG_SYS_HAS_CPU_BMIPS4380
+        case CPU_BMIPS4380:
+#endif
+
+#ifdef CONFIG_SYS_HAS_CPU_BMIPS5000
+        case CPU_BMIPS5000:
+#endif
+
+#ifdef CONFIG_SYS_HAS_CPU_XLP
+        case CPU_XLP:
+#endif
+
+#ifdef CONFIG_SYS_HAS_CPU_XLR
+        case CPU_XLR:
+#endif
+                break;
+        default:
+                unreachable();
+        }
+
+        return cpu_type;
+}
+
+static inline int __pure current_cpu_type(void)
+{
+        const int cpu_type = current_cpu_data.cputype;
+
+        return __get_cpu_type(cpu_type);
+}
+
+static inline int __pure boot_cpu_type(void)
+{
+        const int cpu_type = cpu_data[0].cputype;
+
+        return __get_cpu_type(cpu_type);
+}
+
+#endif /* __ASM_CPU_TYPE_H */
diff --git a/arch/mips/include/asm/cpu.h b/arch/mips/include/asm/cpu.h
index 71b9f1998be7..d2035e16502a 100644
--- a/arch/mips/include/asm/cpu.h
+++ b/arch/mips/include/asm/cpu.h
@@ -3,15 +3,14 @@
  *        various MIPS cpu types.
  *
  * Copyright (C) 1996 David S. Miller (davem@davemloft.net)
- * Copyright (C) 2004  Maciej W. Rozycki
+ * Copyright (C) 2004, 2013  Maciej W. Rozycki
  */
 #ifndef _ASM_CPU_H
 #define _ASM_CPU_H
 
-/* Assigned Company values for bits 23:16 of the PRId Register
-   (CP0 register 15, select 0).  As of the MIPS32 and MIPS64 specs from
-   MTI, the PRId register is defined in this (backwards compatible)
-   way:
+/*
+   As of the MIPS32 and MIPS64 specs from MTI, the PRId register (CP0
+   register 15, select 0) is defined in this (backwards compatible) way:
 
   +----------------+----------------+----------------+----------------+
   | Company Options| Company ID     | Processor ID   | Revision       |
@@ -23,6 +22,14 @@
    spec.
 */
 
+#define PRID_OPT_MASK           0xff000000
+
+/*
+ * Assigned Company values for bits 23:16 of the PRId register.
+ */
+
+#define PRID_COMP_MASK          0xff0000
+
 #define PRID_COMP_LEGACY        0x000000
 #define PRID_COMP_MIPS          0x010000
 #define PRID_COMP_BROADCOM      0x020000
@@ -38,10 +45,17 @@
 #define PRID_COMP_INGENIC       0xd00000
 
 /*
- * Assigned values for the product ID register.  In order to detect a
- * certain CPU type exactly eventually additional registers may need to
- * be examined.  These are valid when 23:16 == PRID_COMP_LEGACY
+ * Assigned Processor ID (implementation) values for bits 15:8 of the PRId
+ * register.  In order to detect a certain CPU type exactly eventually
+ * additional registers may need to be examined.
  */
+
+#define PRID_IMP_MASK           0xff00
+
+/*
+ * These are valid when 23:16 == PRID_COMP_LEGACY
+ */
+
 #define PRID_IMP_R2000          0x0100
 #define PRID_IMP_AU1_REV1       0x0100
 #define PRID_IMP_AU1_REV2       0x0200
@@ -182,11 +196,15 @@
 #define PRID_IMP_NETLOGIC_XLP2XX        0x1200
 
 /*
- * Definitions for 7:0 on legacy processors
+ * Particular Revision values for bits 7:0 of the PRId register.
  */
 
 #define PRID_REV_MASK           0x00ff
 
+/*
+ * Definitions for 7:0 on legacy processors
+ */
+
 #define PRID_REV_TX4927         0x0022
 #define PRID_REV_TX4937         0x0030
 #define PRID_REV_R4400          0x0040
@@ -227,6 +245,8 @@
  *  31                             16 15             8 7              0
  */
 
+#define FPIR_IMP_MASK           0xff00
+
 #define FPIR_IMP_NONE           0x0000
 
 enum cpu_type_enum {
diff --git a/arch/mips/include/asm/mach-au1x00/au1000.h b/arch/mips/include/asm/mach-au1x00/au1000.h
index 3e11a468cdf8..54f9e84db8ac 100644
--- a/arch/mips/include/asm/mach-au1x00/au1000.h
+++ b/arch/mips/include/asm/mach-au1x00/au1000.h
@@ -43,6 +43,8 @@
 #include <linux/io.h>
 #include <linux/irq.h>
 
+#include <asm/cpu.h>
+
 /* cpu pipeline flush */
 void static inline au_sync(void)
 {
@@ -140,7 +142,7 @@ static inline int au1xxx_cpu_needs_config_od(void)
 
 static inline int alchemy_get_cputype(void)
 {
-        switch (read_c0_prid() & 0xffff0000) {
+        switch (read_c0_prid() & (PRID_OPT_MASK | PRID_COMP_MASK)) {
         case 0x00030000:
                 return ALCHEMY_CPU_AU1000;
                 break;
diff --git a/arch/mips/include/asm/mach-ip22/cpu-feature-overrides.h b/arch/mips/include/asm/mach-ip22/cpu-feature-overrides.h
index f4caacd25552..1bcb6421205e 100644
--- a/arch/mips/include/asm/mach-ip22/cpu-feature-overrides.h
+++ b/arch/mips/include/asm/mach-ip22/cpu-feature-overrides.h
@@ -8,6 +8,8 @@
 #ifndef __ASM_MACH_IP22_CPU_FEATURE_OVERRIDES_H
 #define __ASM_MACH_IP22_CPU_FEATURE_OVERRIDES_H
 
+#include <asm/cpu.h>
+
 /*
  * IP22 with a variety of processors so we can't use defaults for everything.
  */
diff --git a/arch/mips/include/asm/mach-ip27/cpu-feature-overrides.h b/arch/mips/include/asm/mach-ip27/cpu-feature-overrides.h
index 1d2b6ff60d33..d6111aa2e886 100644
--- a/arch/mips/include/asm/mach-ip27/cpu-feature-overrides.h
+++ b/arch/mips/include/asm/mach-ip27/cpu-feature-overrides.h
@@ -8,6 +8,8 @@
 #ifndef __ASM_MACH_IP27_CPU_FEATURE_OVERRIDES_H
 #define __ASM_MACH_IP27_CPU_FEATURE_OVERRIDES_H
 
+#include <asm/cpu.h>
+
 /*
  * IP27 only comes with R10000 family processors all using the same config
  */
diff --git a/arch/mips/include/asm/mach-ip28/cpu-feature-overrides.h b/arch/mips/include/asm/mach-ip28/cpu-feature-overrides.h
index 65e9c856390d..4cec06d133db 100644
--- a/arch/mips/include/asm/mach-ip28/cpu-feature-overrides.h
+++ b/arch/mips/include/asm/mach-ip28/cpu-feature-overrides.h
@@ -9,6 +9,8 @@
 #ifndef __ASM_MACH_IP28_CPU_FEATURE_OVERRIDES_H
 #define __ASM_MACH_IP28_CPU_FEATURE_OVERRIDES_H
 
+#include <asm/cpu.h>
+
 /*
  * IP28 only comes with R10000 family processors all using the same config
  */
diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h
index fed1c3e9b486..e0331414c7d6 100644
--- a/arch/mips/include/asm/mipsregs.h
+++ b/arch/mips/include/asm/mipsregs.h
@@ -603,6 +603,13 @@
 #define MIPS_CONF4_MMUEXTDEF    (_ULCAST_(3) << 14)
 #define MIPS_CONF4_MMUEXTDEF_MMUSIZEEXT (_ULCAST_(1) << 14)
 
+#define MIPS_CONF5_NF           (_ULCAST_(1) << 0)
+#define MIPS_CONF5_UFR          (_ULCAST_(1) << 2)
+#define MIPS_CONF5_MSAEN        (_ULCAST_(1) << 27)
+#define MIPS_CONF5_EVA          (_ULCAST_(1) << 28)
+#define MIPS_CONF5_CV           (_ULCAST_(1) << 29)
+#define MIPS_CONF5_K            (_ULCAST_(1) << 30)
+
 #define MIPS_CONF6_SYND         (_ULCAST_(1) << 13)
 
 #define MIPS_CONF7_WII          (_ULCAST_(1) << 31)
diff --git a/arch/mips/include/asm/pci.h b/arch/mips/include/asm/pci.h
index f194c08bd057..12d6842962be 100644
--- a/arch/mips/include/asm/pci.h
+++ b/arch/mips/include/asm/pci.h
@@ -83,6 +83,18 @@ static inline void pcibios_penalize_isa_irq(int irq, int active)
 extern int pci_mmap_page_range(struct pci_dev *dev, struct vm_area_struct *vma,
         enum pci_mmap_state mmap_state, int write_combine);
 
+#define HAVE_ARCH_PCI_RESOURCE_TO_USER
+
+static inline void pci_resource_to_user(const struct pci_dev *dev, int bar,
+                const struct resource *rsrc, resource_size_t *start,
+                resource_size_t *end)
+{
+        phys_t size = resource_size(rsrc);
+
+        *start = fixup_bigphys_addr(rsrc->start, size);
+        *end = rsrc->start + size;
+}
+
 /*
  * Dynamic DMA mapping stuff.
  * MIPS has everything mapped statically.
diff --git a/arch/mips/include/asm/timex.h b/arch/mips/include/asm/timex.h
index 6529704aa73a..c5424757da65 100644
--- a/arch/mips/include/asm/timex.h
+++ b/arch/mips/include/asm/timex.h
@@ -10,7 +10,9 @@
 
 #ifdef __KERNEL__
 
+#include <asm/cpu-features.h>
 #include <asm/mipsregs.h>
+#include <asm/cpu-type.h>
 
 /*
  * This is the clock rate of the i8253 PIT.  A MIPS system may not have
@@ -33,9 +35,38 @@
 
 typedef unsigned int cycles_t;
 
+/*
+ * On R4000/R4400 before version 5.0 an erratum exists such that if the
+ * cycle counter is read in the exact moment that it is matching the
+ * compare register, no interrupt will be generated.
+ *
+ * There is a suggested workaround and also the erratum can't strike if
+ * the compare interrupt isn't being used as the clock source device.
+ * However for now the implementaton of this function doesn't get these
+ * fine details right.
+ */
 static inline cycles_t get_cycles(void)
 {
-        return 0;
+        switch (boot_cpu_type()) {
+        case CPU_R4400PC:
+        case CPU_R4400SC:
+        case CPU_R4400MC:
+                if ((read_c0_prid() & 0xff) >= 0x0050)
+                        return read_c0_count();
+                break;
+
+        case CPU_R4000PC:
+        case CPU_R4000SC:
+        case CPU_R4000MC:
+                break;
+
+        default:
+                if (cpu_has_counter)
+                        return read_c0_count();
+                break;
+        }
+
+        return 0;       /* no usable counter */
 }
 
 #endif /* __KERNEL__ */
diff --git a/arch/mips/include/asm/vga.h b/arch/mips/include/asm/vga.h
index f4cff7e4fa8a..f82c83749a08 100644
--- a/arch/mips/include/asm/vga.h
+++ b/arch/mips/include/asm/vga.h
@@ -6,6 +6,7 @@
 #ifndef _ASM_VGA_H
 #define _ASM_VGA_H
 
+#include <asm/addrspace.h>
 #include <asm/byteorder.h>
 
 /*
@@ -13,7 +14,7 @@
  *      access the videoram directly without any black magic.
  */
 
-#define VGA_MAP_MEM(x, s)       (0xb0000000L + (unsigned long)(x))
+#define VGA_MAP_MEM(x, s)       CKSEG1ADDR(0x10000000L + (unsigned long)(x))
 
 #define vga_readb(x)    (*(x))
 #define vga_writeb(x, y)        (*(y) = (x))
diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c
index 37663c7862a5..5465dc183e5a 100644
--- a/arch/mips/kernel/cpu-probe.c
+++ b/arch/mips/kernel/cpu-probe.c
@@ -20,6 +20,7 @@
 
 #include <asm/bugs.h>
 #include <asm/cpu.h>
+#include <asm/cpu-type.h>
 #include <asm/fpu.h>
 #include <asm/mipsregs.h>
 #include <asm/watch.h>
@@ -55,7 +56,7 @@ static inline void check_errata(void)
 {
         struct cpuinfo_mips *c = &current_cpu_data;
 
-        switch (c->cputype) {
+        switch (current_cpu_type()) {
         case CPU_34K:
                 /*
                  * Erratum "RPS May Cause Incorrect Instruction Execution"
@@ -122,7 +123,7 @@ static inline unsigned long cpu_get_fpu_id(void)
  */
 static inline int __cpu_has_fpu(void)
 {
-        return ((cpu_get_fpu_id() & 0xff00) != FPIR_IMP_NONE);
+        return ((cpu_get_fpu_id() & FPIR_IMP_MASK) != FPIR_IMP_NONE);
 }
 
 static inline void cpu_probe_vmbits(struct cpuinfo_mips *c)
@@ -290,6 +291,17 @@ static inline unsigned int decode_config4(struct cpuinfo_mips *c)
         return config4 & MIPS_CONF_M;
 }
 
+static inline unsigned int decode_config5(struct cpuinfo_mips *c)
+{
+        unsigned int config5;
+
+        config5 = read_c0_config5();
+        config5 &= ~MIPS_CONF5_UFR;
+        write_c0_config5(config5);
+
+        return config5 & MIPS_CONF_M;
+}
+
 static void decode_configs(struct cpuinfo_mips *c)
 {
         int ok;
@@ -310,6 +322,8 @@ static void decode_configs(struct cpuinfo_mips *c)
                 ok = decode_config3(c);
         if (ok)
                 ok = decode_config4(c);
+        if (ok)
+                ok = decode_config5(c);
 
         mips_probe_watch_registers(c);
 
@@ -322,7 +336,7 @@ static void decode_configs(struct cpuinfo_mips *c)
 
 static inline void cpu_probe_legacy(struct cpuinfo_mips *c, unsigned int cpu)
 {
-        switch (c->processor_id & 0xff00) {
+        switch (c->processor_id & PRID_IMP_MASK) {
         case PRID_IMP_R2000:
                 c->cputype = CPU_R2000;
                 __cpu_name[cpu] = "R2000";
@@ -333,7 +347,7 @@ static inline void cpu_probe_legacy(struct cpuinfo_mips *c, unsigned int cpu)
                 c->tlbsize = 64;
                 break;
         case PRID_IMP_R3000:
-                if ((c->processor_id & 0xff) == PRID_REV_R3000A) {
+                if ((c->processor_id & PRID_REV_MASK) == PRID_REV_R3000A) {
                         if (cpu_has_confreg()) {
                                 c->cputype = CPU_R3081E;
                                 __cpu_name[cpu] = "R3081";
@@ -353,7 +367,8 @@ static inline void cpu_probe_legacy(struct cpuinfo_mips *c, unsigned int cpu)
                 break;
         case PRID_IMP_R4000:
                 if (read_c0_config() & CONF_SC) {
-                        if ((c->processor_id & 0xff) >= PRID_REV_R4400) {
+                        if ((c->processor_id & PRID_REV_MASK) >=
+                            PRID_REV_R4400) {
                                 c->cputype = CPU_R4400PC;
                                 __cpu_name[cpu] = "R4400PC";
                         } else {
@@ -361,7 +376,8 @@ static inline void cpu_probe_legacy(struct cpuinfo_mips *c, unsigned int cpu)
                                 __cpu_name[cpu] = "R4000PC";
                         }
                 } else {
-                        if ((c->processor_id & 0xff) >= PRID_REV_R4400) {
+                        if ((c->processor_id & PRID_REV_MASK) >=
+                            PRID_REV_R4400) {
                                 c->cputype = CPU_R4400SC;
                                 __cpu_name[cpu] = "R4400SC";
                         } else {
@@ -454,7 +470,7 @@ static inline void cpu_probe_legacy(struct cpuinfo_mips *c, unsigned int cpu)
                         __cpu_name[cpu] = "TX3927";
                         c->tlbsize = 64;
                 } else {
-                        switch (c->processor_id & 0xff) {
+                        switch (c->processor_id & PRID_REV_MASK) {
                         case PRID_REV_TX3912:
                                 c->cputype = CPU_TX3912;
                                 __cpu_name[cpu] = "TX3912";
@@ -640,7 +656,7 @@ static inline void cpu_probe_legacy(struct cpuinfo_mips *c, unsigned int cpu)
 static inline void cpu_probe_mips(struct cpuinfo_mips *c, unsigned int cpu)
 {
         decode_configs(c);
-        switch (c->processor_id & 0xff00) {
+        switch (c->processor_id & PRID_IMP_MASK) {
         case PRID_IMP_4KC:
                 c->cputype = CPU_4KC;
                 __cpu_name[cpu] = "MIPS 4Kc";
@@ -711,7 +727,7 @@ static inline void cpu_probe_mips(struct cpuinfo_mips *c, unsigned int cpu)
 static inline void cpu_probe_alchemy(struct cpuinfo_mips *c, unsigned int cpu)
 {
         decode_configs(c);
-        switch (c->processor_id & 0xff00) {
+        switch (c->processor_id & PRID_IMP_MASK) {
         case PRID_IMP_AU1_REV1:
         case PRID_IMP_AU1_REV2:
                 c->cputype = CPU_ALCHEMY;
@@ -730,7 +746,7 @@ static inline void cpu_probe_alchemy(struct cpuinfo_mips *c, unsigned int cpu)
                         break;
                 case 4:
                         __cpu_name[cpu] = "Au1200";
-                        if ((c->processor_id & 0xff) == 2)
+                        if ((c->processor_id & PRID_REV_MASK) == 2)
                                 __cpu_name[cpu] = "Au1250";
                         break;
                 case 5:
@@ -748,12 +764,12 @@ static inline void cpu_probe_sibyte(struct cpuinfo_mips *c, unsigned int cpu)
 {
         decode_configs(c);
 
-        switch (c->processor_id & 0xff00) {
+        switch (c->processor_id & PRID_IMP_MASK) {
         case PRID_IMP_SB1:
                 c->cputype = CPU_SB1;
                 __cpu_name[cpu] = "SiByte SB1";
                 /* FPU in pass1 is known to have issues. */
-                if ((c->processor_id & 0xff) < 0x02)
+                if ((c->processor_id & PRID_REV_MASK) < 0x02)
                         c->options &= ~(MIPS_CPU_FPU | MIPS_CPU_32FPR);
                 break;
         case PRID_IMP_SB1A:
@@ -766,7 +782,7 @@ static inline void cpu_probe_sibyte(struct cpuinfo_mips *c, unsigned int cpu)
 static inline void cpu_probe_sandcraft(struct cpuinfo_mips *c, unsigned int cpu)
 {
         decode_configs(c);
-        switch (c->processor_id & 0xff00) {
+        switch (c->processor_id & PRID_IMP_MASK) {
         case PRID_IMP_SR71000:
                 c->cputype = CPU_SR71000;
                 __cpu_name[cpu] = "Sandcraft SR71000";
@@ -779,7 +795,7 @@ static inline void cpu_probe_sandcraft(struct cpuinfo_mips *c, unsigned int cpu)
 static inline void cpu_probe_nxp(struct cpuinfo_mips *c, unsigned int cpu)
 {
         decode_configs(c);
-        switch (c->processor_id & 0xff00) {
+        switch (c->processor_id & PRID_IMP_MASK) {
         case PRID_IMP_PR4450:
                 c->cputype = CPU_PR4450;
                 __cpu_name[cpu] = "Philips PR4450";
@@ -791,7 +807,7 @@ static inline void cpu_probe_nxp(struct cpuinfo_mips *c, unsigned int cpu)
 static inline void cpu_probe_broadcom(struct cpuinfo_mips *c, unsigned int cpu)
 {
         decode_configs(c);
-        switch (c->processor_id & 0xff00) {
+        switch (c->processor_id & PRID_IMP_MASK) {
         case PRID_IMP_BMIPS32_REV4:
         case PRID_IMP_BMIPS32_REV8:
                 c->cputype = CPU_BMIPS32;
@@ -806,7 +822,7 @@ static inline void cpu_probe_broadcom(struct cpuinfo_mips *c, unsigned int cpu)
                 set_elf_platform(cpu, "bmips3300");
                 break;
         case PRID_IMP_BMIPS43XX: {
-                int rev = c->processor_id & 0xff;
+                int rev = c->processor_id & PRID_REV_MASK;
 
                 if (rev >= PRID_REV_BMIPS4380_LO &&
                                 rev <= PRID_REV_BMIPS4380_HI) {
@@ -832,7 +848,7 @@ static inline void cpu_probe_broadcom(struct cpuinfo_mips *c, unsigned int cpu)
 static inline void cpu_probe_cavium(struct cpuinfo_mips *c, unsigned int cpu)
 {
         decode_configs(c);
-        switch (c->processor_id & 0xff00) {
+        switch (c->processor_id & PRID_IMP_MASK) {
         case PRID_IMP_CAVIUM_CN38XX:
         case PRID_IMP_CAVIUM_CN31XX:
         case PRID_IMP_CAVIUM_CN30XX:
@@ -875,7 +891,7 @@ static inline void cpu_probe_ingenic(struct cpuinfo_mips *c, unsigned int cpu)
         decode_configs(c);
         /* JZRISC does not implement the CP0 counter. */
         c->options &= ~MIPS_CPU_COUNTER;
-        switch (c->processor_id & 0xff00) {
+        switch (c->processor_id & PRID_IMP_MASK) {
         case PRID_IMP_JZRISC:
                 c->cputype = CPU_JZRISC;
                 __cpu_name[cpu] = "Ingenic JZRISC";
@@ -890,7 +906,7 @@ static inline void cpu_probe_netlogic(struct cpuinfo_mips *c, int cpu)
 {
         decode_configs(c);
 
-        if ((c->processor_id & 0xff00) == PRID_IMP_NETLOGIC_AU13XX) {
+        if ((c->processor_id & PRID_IMP_MASK) == PRID_IMP_NETLOGIC_AU13XX) {
                 c->cputype = CPU_ALCHEMY;
                 __cpu_name[cpu] = "Au1300";
                 /* following stuff is not for Alchemy */
@@ -905,7 +921,7 @@ static inline void cpu_probe_netlogic(struct cpuinfo_mips *c, int cpu)
                         MIPS_CPU_EJTAG   |
                         MIPS_CPU_LLSC);
 
-        switch (c->processor_id & 0xff00) {
+        switch (c->processor_id & PRID_IMP_MASK) {
         case PRID_IMP_NETLOGIC_XLP2XX:
                 c->cputype = CPU_XLP;
                 __cpu_name[cpu] = "Broadcom XLPII";
@@ -984,7 +1000,7 @@ void cpu_probe(void)
         c->cputype      = CPU_UNKNOWN;
 
         c->processor_id = read_c0_prid();
-        switch (c->processor_id & 0xff0000) {
+        switch (c->processor_id & PRID_COMP_MASK) {
         case PRID_COMP_LEGACY:
                 cpu_probe_legacy(c, cpu);
                 break;
diff --git a/arch/mips/kernel/idle.c b/arch/mips/kernel/idle.c
index 42f8875d2444..f7991d95bff9 100644
--- a/arch/mips/kernel/idle.c
+++ b/arch/mips/kernel/idle.c
@@ -18,6 +18,7 @@
 #include <linux/sched.h>
 #include <asm/cpu.h>
 #include <asm/cpu-info.h>
+#include <asm/cpu-type.h>
 #include <asm/idle.h>
 #include <asm/mipsregs.h>
 
@@ -136,7 +137,7 @@ void __init check_wait(void)
                 return;
         }
 
-        switch (c->cputype) {
+        switch (current_cpu_type()) {
         case CPU_R3081:
         case CPU_R3081E:
                 cpu_wait = r3081_wait;
diff --git a/arch/mips/kernel/time.c b/arch/mips/kernel/time.c
index 364d26ae4215..dcb8e5d3bb8a 100644
--- a/arch/mips/kernel/time.c
+++ b/arch/mips/kernel/time.c
@@ -24,6 +24,7 @@
 #include <linux/export.h>
 
 #include <asm/cpu-features.h>
+#include <asm/cpu-type.h>
 #include <asm/div64.h>
 #include <asm/smtc_ipi.h>
 #include <asm/time.h>
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index aec3408edd4b..524841f02803 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -39,6 +39,7 @@
 #include <asm/break.h>
 #include <asm/cop2.h>
 #include <asm/cpu.h>
+#include <asm/cpu-type.h>
 #include <asm/dsp.h>
 #include <asm/fpu.h>
 #include <asm/fpu_emulator.h>
@@ -622,7 +623,7 @@ static int simulate_rdhwr(struct pt_regs *regs, int rd, int rt)
                 regs->regs[rt] = read_c0_count();
                 return 0;
         case 3:         /* Count register resolution */
-                switch (current_cpu_data.cputype) {
+                switch (current_cpu_type()) {
                 case CPU_20KC:
                 case CPU_25KF:
                         regs->regs[rt] = 1;
diff --git a/arch/mips/mm/c-octeon.c b/arch/mips/mm/c-octeon.c
index 729e7702b1de..c8efdb5b6ee0 100644
--- a/arch/mips/mm/c-octeon.c
+++ b/arch/mips/mm/c-octeon.c
@@ -19,6 +19,7 @@
 #include <asm/bootinfo.h>
 #include <asm/cacheops.h>
 #include <asm/cpu-features.h>
+#include <asm/cpu-type.h>
 #include <asm/page.h>
 #include <asm/pgtable.h>
 #include <asm/r4kcache.h>
@@ -186,9 +187,10 @@ static void probe_octeon(void)
         unsigned long dcache_size;
         unsigned int config1;
         struct cpuinfo_mips *c = &current_cpu_data;
+        int cputype = current_cpu_type();
 
         config1 = read_c0_config1();
-        switch (c->cputype) {
+        switch (cputype) {
         case CPU_CAVIUM_OCTEON:
         case CPU_CAVIUM_OCTEON_PLUS:
                 c->icache.linesz = 2 << ((config1 >> 19) & 7);
@@ -199,7 +201,7 @@ static void probe_octeon(void)
                         c->icache.sets * c->icache.ways * c->icache.linesz;
                 c->icache.waybit = ffs(icache_size / c->icache.ways) - 1;
                 c->dcache.linesz = 128;
-                if (c->cputype == CPU_CAVIUM_OCTEON_PLUS)
+                if (cputype == CPU_CAVIUM_OCTEON_PLUS)
                         c->dcache.sets = 2; /* CN5XXX has two Dcache sets */
                 else
                         c->dcache.sets = 1; /* CN3XXX has one Dcache set */
diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
index f749f687ee87..627883bc6d5f 100644
--- a/arch/mips/mm/c-r4k.c
+++ b/arch/mips/mm/c-r4k.c
@@ -12,6 +12,7 @@
 #include <linux/highmem.h>
 #include <linux/kernel.h>
 #include <linux/linkage.h>
+#include <linux/preempt.h>
 #include <linux/sched.h>
 #include <linux/smp.h>
 #include <linux/mm.h>
@@ -24,6 +25,7 @@
 #include <asm/cacheops.h>
 #include <asm/cpu.h>
 #include <asm/cpu-features.h>
+#include <asm/cpu-type.h>
 #include <asm/io.h>
 #include <asm/page.h>
 #include <asm/pgtable.h>
@@ -601,6 +603,7 @@ static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size)
         /* Catch bad driver code */
         BUG_ON(size == 0);
 
+        preempt_disable();
         if (cpu_has_inclusive_pcaches) {
                 if (size >= scache_size)
                         r4k_blast_scache();
@@ -621,6 +624,7 @@ static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size)
                 R4600_HIT_CACHEOP_WAR_IMPL;
                 blast_dcache_range(addr, addr + size);
         }
+        preempt_enable();
 
         bc_wback_inv(addr, size);
         __sync();
@@ -631,6 +635,7 @@ static void r4k_dma_cache_inv(unsigned long addr, unsigned long size)
         /* Catch bad driver code */
         BUG_ON(size == 0);
 
+        preempt_disable();
         if (cpu_has_inclusive_pcaches) {
                 if (size >= scache_size)
                         r4k_blast_scache();
@@ -655,6 +660,7 @@ static void r4k_dma_cache_inv(unsigned long addr, unsigned long size)
                 R4600_HIT_CACHEOP_WAR_IMPL;
                 blast_inv_dcache_range(addr, addr + size);
         }
+        preempt_enable();
 
         bc_inv(addr, size);
         __sync();
@@ -780,20 +786,30 @@ static inline void rm7k_erratum31(void)
 
 static inline void alias_74k_erratum(struct cpuinfo_mips *c)
 {
+        unsigned int imp = c->processor_id & PRID_IMP_MASK;
+        unsigned int rev = c->processor_id & PRID_REV_MASK;
+
         /*
          * Early versions of the 74K do not update the cache tags on a
          * vtag miss/ptag hit which can occur in the case of KSEG0/KUSEG
          * aliases. In this case it is better to treat the cache as always
          * having aliases.
          */
-        if ((c->processor_id & 0xff) <= PRID_REV_ENCODE_332(2, 4, 0))
-                c->dcache.flags |= MIPS_CACHE_VTAG;
-        if ((c->processor_id & 0xff) == PRID_REV_ENCODE_332(2, 4, 0))
-                write_c0_config6(read_c0_config6() | MIPS_CONF6_SYND);
-        if (((c->processor_id & 0xff00) == PRID_IMP_1074K) &&
-            ((c->processor_id & 0xff) <= PRID_REV_ENCODE_332(1, 1, 0))) {
-                c->dcache.flags |= MIPS_CACHE_VTAG;
-                write_c0_config6(read_c0_config6() | MIPS_CONF6_SYND);
+        switch (imp) {
+        case PRID_IMP_74K:
+                if (rev <= PRID_REV_ENCODE_332(2, 4, 0))
+                        c->dcache.flags |= MIPS_CACHE_VTAG;
+                if (rev == PRID_REV_ENCODE_332(2, 4, 0))
+                        write_c0_config6(read_c0_config6() | MIPS_CONF6_SYND);
+                break;
+        case PRID_IMP_1074K:
+                if (rev <= PRID_REV_ENCODE_332(1, 1, 0)) {
+                        c->dcache.flags |= MIPS_CACHE_VTAG;
+                        write_c0_config6(read_c0_config6() | MIPS_CONF6_SYND);
+                }
+                break;
+        default:
+                BUG();
         }
 }
 
@@ -809,7 +825,7 @@ static void probe_pcache(void)
         unsigned long config1;
         unsigned int lsize;
 
-        switch (c->cputype) {
+        switch (current_cpu_type()) {
         case CPU_R4600:                 /* QED style two way caches? */
         case CPU_R4700:
         case CPU_R5000:
@@ -1025,7 +1041,8 @@ static void probe_pcache(void)
          * presumably no vendor is shipping his hardware in the "bad"
          * configuration.
          */
-        if ((prid & 0xff00) == PRID_IMP_R4000 && (prid & 0xff) < 0x40 &&
+        if ((prid & PRID_IMP_MASK) == PRID_IMP_R4000 &&
+            (prid & PRID_REV_MASK) < PRID_REV_R4400 &&
             !(config & CONF_SC) && c->icache.linesz != 16 &&
             PAGE_SIZE <= 0x8000)
                 panic("Improper R4000SC processor configuration detected");
@@ -1045,7 +1062,7 @@ static void probe_pcache(void)
          * normally they'd suffer from aliases but magic in the hardware deals
          * with that for us so we don't need to take care ourselves.
          */
-        switch (c->cputype) {
+        switch (current_cpu_type()) {
         case CPU_20KC:
         case CPU_25KF:
         case CPU_SB1:
@@ -1065,7 +1082,7 @@ static void probe_pcache(void)
         case CPU_34K:
         case CPU_74K:
         case CPU_1004K:
-                if (c->cputype == CPU_74K)
+                if (current_cpu_type() == CPU_74K)
                         alias_74k_erratum(c);
                 if ((read_c0_config7() & (1 << 16))) {
                         /* effectively physically indexed dcache,
@@ -1078,7 +1095,7 @@ static void probe_pcache(void)
                         c->dcache.flags |= MIPS_CACHE_ALIASES;
         }
 
-        switch (c->cputype) {
+        switch (current_cpu_type()) {
         case CPU_20KC:
                 /*
                  * Some older 20Kc chips doesn't have the 'VI' bit in
@@ -1207,7 +1224,7 @@ static void setup_scache(void)
          * processors don't have a S-cache that would be relevant to the
          * Linux memory management.
          */
-        switch (c->cputype) {
+        switch (current_cpu_type()) {
         case CPU_R4000SC:
         case CPU_R4000MC:
         case CPU_R4400SC:
@@ -1384,9 +1401,8 @@ static void r4k_cache_error_setup(void)
 {
         extern char __weak except_vec2_generic;
         extern char __weak except_vec2_sb1;
-        struct cpuinfo_mips *c = &current_cpu_data;
 
-        switch (c->cputype) {
+        switch (current_cpu_type()) {
         case CPU_SB1:
         case CPU_SB1A:
                 set_uncached_handler(0x100, &except_vec2_sb1, 0x80);
diff --git a/arch/mips/mm/dma-default.c b/arch/mips/mm/dma-default.c
index 664e523653d0..f25a7e9f8cbc 100644
--- a/arch/mips/mm/dma-default.c
+++ b/arch/mips/mm/dma-default.c
@@ -18,6 +18,7 @@
 #include <linux/highmem.h>
 
 #include <asm/cache.h>
+#include <asm/cpu-type.h>
 #include <asm/io.h>
 
 #include <dma-coherence.h>
diff --git a/arch/mips/mm/page.c b/arch/mips/mm/page.c
index 218c2109a55d..cbd81d17793a 100644
--- a/arch/mips/mm/page.c
+++ b/arch/mips/mm/page.c
@@ -18,6 +18,7 @@
 
 #include <asm/bugs.h>
 #include <asm/cacheops.h>
+#include <asm/cpu-type.h>
 #include <asm/inst.h>
 #include <asm/io.h>
 #include <asm/page.h>
diff --git a/arch/mips/mm/sc-mips.c b/arch/mips/mm/sc-mips.c
index 5d01392e3518..08d05aee8788 100644
--- a/arch/mips/mm/sc-mips.c
+++ b/arch/mips/mm/sc-mips.c
@@ -6,6 +6,7 @@
 #include <linux/sched.h>
 #include <linux/mm.h>
 
+#include <asm/cpu-type.h>
 #include <asm/mipsregs.h>
 #include <asm/bcache.h>
 #include <asm/cacheops.h>
@@ -71,7 +72,7 @@ static inline int mips_sc_is_activated(struct cpuinfo_mips *c)
         unsigned int tmp;
 
         /* Check the bypass bit (L2B) */
-        switch (c->cputype) {
+        switch (current_cpu_type()) {
         case CPU_34K:
         case CPU_74K:
         case CPU_1004K:
diff --git a/arch/mips/mm/tlb-r4k.c b/arch/mips/mm/tlb-r4k.c
index 00b26a67a06d..bb3a5f643e97 100644
--- a/arch/mips/mm/tlb-r4k.c
+++ b/arch/mips/mm/tlb-r4k.c
@@ -16,6 +16,7 @@
 #include <linux/module.h>
 
 #include <asm/cpu.h>
+#include <asm/cpu-type.h>
 #include <asm/bootinfo.h>
 #include <asm/mmu_context.h>
 #include <asm/pgtable.h>
diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
index 821b45175dc1..9bb3a9363b06 100644
--- a/arch/mips/mm/tlbex.c
+++ b/arch/mips/mm/tlbex.c
@@ -30,6 +30,7 @@
 #include <linux/cache.h>
 
 #include <asm/cacheflush.h>
+#include <asm/cpu-type.h>
 #include <asm/pgtable.h>
 #include <asm/war.h>
 #include <asm/uasm.h>
diff --git a/arch/mips/mti-malta/malta-time.c b/arch/mips/mti-malta/malta-time.c
index 53aad4a35375..a18af5fce67e 100644
--- a/arch/mips/mti-malta/malta-time.c
+++ b/arch/mips/mti-malta/malta-time.c
@@ -27,6 +27,7 @@
 #include <linux/timex.h>
 #include <linux/mc146818rtc.h>
 
+#include <asm/cpu.h>
 #include <asm/mipsregs.h>
 #include <asm/mipsmtregs.h>
 #include <asm/hardirq.h>
@@ -76,7 +77,7 @@ static void __init estimate_frequencies(void)
 #endif
 
 #if defined (CONFIG_KVM_GUEST) && defined (CONFIG_KVM_HOST_FREQ)
-        unsigned int prid = read_c0_prid() & 0xffff00;
+        unsigned int prid = read_c0_prid() & (PRID_COMP_MASK | PRID_IMP_MASK);
 
         /*
          * XXXKYMA: hardwire the CPU frequency to Host Freq/4
@@ -169,7 +170,7 @@ unsigned int get_c0_compare_int(void)
 
 void __init plat_time_init(void)
 {
-        unsigned int prid = read_c0_prid() & 0xffff00;
+        unsigned int prid = read_c0_prid() & (PRID_COMP_MASK | PRID_IMP_MASK);
         unsigned int freq;
 
         estimate_frequencies();
diff --git a/arch/mips/mti-sead3/sead3-time.c b/arch/mips/mti-sead3/sead3-time.c
index a43ea3cc0a3b..552d26c34386 100644
--- a/arch/mips/mti-sead3/sead3-time.c
+++ b/arch/mips/mti-sead3/sead3-time.c
@@ -7,6 +7,7 @@
  */
 #include <linux/init.h>
 
+#include <asm/cpu.h>
 #include <asm/setup.h>
 #include <asm/time.h>
 #include <asm/irq.h>
@@ -34,7 +35,7 @@ static void __iomem *status_reg = (void __iomem *)0xbf000410;
  */
 static unsigned int __init estimate_cpu_frequency(void)
 {
-        unsigned int prid = read_c0_prid() & 0xffff00;
+        unsigned int prid = read_c0_prid() & (PRID_COMP_MASK | PRID_IMP_MASK);
         unsigned int tick = 0;
         unsigned int freq;
         unsigned int orig;
diff --git a/arch/mips/netlogic/xlr/fmn-config.c b/arch/mips/netlogic/xlr/fmn-config.c
index ed3bf0e3f309..c7622c6e5f67 100644
--- a/arch/mips/netlogic/xlr/fmn-config.c
+++ b/arch/mips/netlogic/xlr/fmn-config.c
@@ -36,6 +36,7 @@
 #include <linux/irq.h>
 #include <linux/interrupt.h>
 
+#include <asm/cpu.h>
 #include <asm/mipsregs.h>
 #include <asm/netlogic/xlr/fmn.h>
 #include <asm/netlogic/xlr/xlr.h>
@@ -187,7 +188,7 @@ void xlr_board_info_setup(void)
         int processor_id, num_core;
 
         num_core = hweight32(nlm_current_node()->coremask);
-        processor_id = read_c0_prid() & 0xff00;
+        processor_id = read_c0_prid() & PRID_IMP_MASK;
 
         setup_cpu_fmninfo(cpu, num_core);
         switch (processor_id) {
diff --git a/arch/mips/oprofile/common.c b/arch/mips/oprofile/common.c
index 5e5424753b56..4d1736fc1955 100644
--- a/arch/mips/oprofile/common.c
+++ b/arch/mips/oprofile/common.c
@@ -12,6 +12,7 @@
 #include <linux/oprofile.h>
 #include <linux/smp.h>
 #include <asm/cpu-info.h>
+#include <asm/cpu-type.h>
 
 #include "op_impl.h"
 
diff --git a/arch/mips/pci/pci-bcm1480.c b/arch/mips/pci/pci-bcm1480.c
index 44dd5aa2e36f..5ec2a7bae02c 100644
--- a/arch/mips/pci/pci-bcm1480.c
+++ b/arch/mips/pci/pci-bcm1480.c
@@ -39,6 +39,7 @@
 #include <linux/mm.h>
 #include <linux/console.h>
 #include <linux/tty.h>
+#include <linux/vt.h>
 
 #include <asm/sibyte/bcm1480_regs.h>
 #include <asm/sibyte/bcm1480_scd.h>
diff --git a/arch/mips/sibyte/bcm1480/setup.c b/arch/mips/sibyte/bcm1480/setup.c
index 05ed92c92b69..8e2e04f77870 100644
--- a/arch/mips/sibyte/bcm1480/setup.c
+++ b/arch/mips/sibyte/bcm1480/setup.c
@@ -22,6 +22,7 @@
 #include <linux/string.h>
 
 #include <asm/bootinfo.h>
+#include <asm/cpu.h>
 #include <asm/mipsregs.h>
 #include <asm/io.h>
 #include <asm/sibyte/sb1250.h>
@@ -119,7 +120,7 @@ void __init bcm1480_setup(void)
         uint64_t sys_rev;
         int plldiv;
 
-        sb1_pass = read_c0_prid() & 0xff;
+        sb1_pass = read_c0_prid() & PRID_REV_MASK;
         sys_rev = __raw_readq(IOADDR(A_SCD_SYSTEM_REVISION));
         soc_type = SYS_SOC_TYPE(sys_rev);
         part_type = G_SYS_PART(sys_rev);
diff --git a/arch/mips/sibyte/sb1250/setup.c b/arch/mips/sibyte/sb1250/setup.c
index a14bd4cb0bc0..3c02b2a77ae9 100644
--- a/arch/mips/sibyte/sb1250/setup.c
+++ b/arch/mips/sibyte/sb1250/setup.c
@@ -22,6 +22,7 @@
 #include <linux/string.h>
 
 #include <asm/bootinfo.h>
+#include <asm/cpu.h>
 #include <asm/mipsregs.h>
 #include <asm/io.h>
 #include <asm/sibyte/sb1250.h>
@@ -182,7 +183,7 @@ void __init sb1250_setup(void)
         int plldiv;
         int bad_config = 0;
 
-        sb1_pass = read_c0_prid() & 0xff;
+        sb1_pass = read_c0_prid() & PRID_REV_MASK;
         sys_rev = __raw_readq(IOADDR(A_SCD_SYSTEM_REVISION));
         soc_type = SYS_SOC_TYPE(sys_rev);
         soc_pass = G_SYS_REVISION(sys_rev);
diff --git a/arch/mips/sni/setup.c b/arch/mips/sni/setup.c
index 5b09b3544edd..efad85c8c823 100644
--- a/arch/mips/sni/setup.c
+++ b/arch/mips/sni/setup.c
@@ -25,6 +25,7 @@
 #endif
 
 #include <asm/bootinfo.h>
+#include <asm/cpu.h>
 #include <asm/io.h>
 #include <asm/reboot.h>
 #include <asm/sni.h>
@@ -173,7 +174,7 @@ void __init plat_mem_setup(void)
                 system_type = "RM300-Cxx";
                 break;
         case SNI_BRD_PCI_DESKTOP:
-                switch (read_c0_prid() & 0xff00) {
+                switch (read_c0_prid() & PRID_IMP_MASK) {
                 case PRID_IMP_R4600:
                 case PRID_IMP_R4700:
                         system_type = "RM200-C20";
diff --git a/arch/tile/Kconfig b/arch/tile/Kconfig
index 8a7cc663b3f8..d45a2c48f185 100644
--- a/arch/tile/Kconfig
+++ b/arch/tile/Kconfig
@@ -361,7 +361,7 @@ config CMDLINE_OVERRIDE
 
 config VMALLOC_RESERVE
         hex
-        default 0x1000000
+        default 0x2000000
 
 config HARDWALL
         bool "Hardwall support to allow access to user dynamic network"
diff --git a/arch/tile/gxio/iorpc_mpipe.c b/arch/tile/gxio/iorpc_mpipe.c
index 4f8f3d619c4a..e19325c4c431 100644
--- a/arch/tile/gxio/iorpc_mpipe.c
+++ b/arch/tile/gxio/iorpc_mpipe.c
@@ -21,7 +21,7 @@ struct alloc_buffer_stacks_param {
         unsigned int flags;
 };
 
-int gxio_mpipe_alloc_buffer_stacks(gxio_mpipe_context_t * context,
+int gxio_mpipe_alloc_buffer_stacks(gxio_mpipe_context_t *context,
                                    unsigned int count, unsigned int first,
                                    unsigned int flags)
 {
@@ -45,7 +45,7 @@ struct init_buffer_stack_aux_param {
         unsigned int buffer_size_enum;
 };
 
-int gxio_mpipe_init_buffer_stack_aux(gxio_mpipe_context_t * context,
+int gxio_mpipe_init_buffer_stack_aux(gxio_mpipe_context_t *context,
                                      void *mem_va, size_t mem_size,
                                      unsigned int mem_flags, unsigned int stack,
                                      unsigned int buffer_size_enum)
@@ -80,7 +80,7 @@ struct alloc_notif_rings_param {
         unsigned int flags;
 };
 
-int gxio_mpipe_alloc_notif_rings(gxio_mpipe_context_t * context,
+int gxio_mpipe_alloc_notif_rings(gxio_mpipe_context_t *context,
                                  unsigned int count, unsigned int first,
                                  unsigned int flags)
 {
@@ -102,7 +102,7 @@ struct init_notif_ring_aux_param {
         unsigned int ring;
 };
 
-int gxio_mpipe_init_notif_ring_aux(gxio_mpipe_context_t * context, void *mem_va,
+int gxio_mpipe_init_notif_ring_aux(gxio_mpipe_context_t *context, void *mem_va,
                                    size_t mem_size, unsigned int mem_flags,
                                    unsigned int ring)
 {
@@ -133,7 +133,7 @@ struct request_notif_ring_interrupt_param {
         unsigned int ring;
 };
 
-int gxio_mpipe_request_notif_ring_interrupt(gxio_mpipe_context_t * context,
+int gxio_mpipe_request_notif_ring_interrupt(gxio_mpipe_context_t *context,
                                             int inter_x, int inter_y,
                                             int inter_ipi, int inter_event,
                                             unsigned int ring)
@@ -158,7 +158,7 @@ struct enable_notif_ring_interrupt_param {
         unsigned int ring;
 };
 
-int gxio_mpipe_enable_notif_ring_interrupt(gxio_mpipe_context_t * context,
+int gxio_mpipe_enable_notif_ring_interrupt(gxio_mpipe_context_t *context,
                                            unsigned int ring)
 {
         struct enable_notif_ring_interrupt_param temp;
@@ -179,7 +179,7 @@ struct alloc_notif_groups_param {
         unsigned int flags;
 };
 
-int gxio_mpipe_alloc_notif_groups(gxio_mpipe_context_t * context,
+int gxio_mpipe_alloc_notif_groups(gxio_mpipe_context_t *context,
                                   unsigned int count, unsigned int first,
                                   unsigned int flags)
 {
@@ -201,7 +201,7 @@ struct init_notif_group_param {
         gxio_mpipe_notif_group_bits_t bits;
 };
 
-int gxio_mpipe_init_notif_group(gxio_mpipe_context_t * context,
+int gxio_mpipe_init_notif_group(gxio_mpipe_context_t *context,
                                 unsigned int group,
                                 gxio_mpipe_notif_group_bits_t bits)
 {
@@ -223,7 +223,7 @@ struct alloc_buckets_param {
         unsigned int flags;
 };
 
-int gxio_mpipe_alloc_buckets(gxio_mpipe_context_t * context, unsigned int count,
+int gxio_mpipe_alloc_buckets(gxio_mpipe_context_t *context, unsigned int count,
                              unsigned int first, unsigned int flags)
 {
         struct alloc_buckets_param temp;
@@ -244,7 +244,7 @@ struct init_bucket_param {
         MPIPE_LBL_INIT_DAT_BSTS_TBL_t bucket_info;
 };
 
-int gxio_mpipe_init_bucket(gxio_mpipe_context_t * context, unsigned int bucket,
+int gxio_mpipe_init_bucket(gxio_mpipe_context_t *context, unsigned int bucket,
                            MPIPE_LBL_INIT_DAT_BSTS_TBL_t bucket_info)
 {
         struct init_bucket_param temp;
@@ -265,7 +265,7 @@ struct alloc_edma_rings_param {
         unsigned int flags;
 };
 
-int gxio_mpipe_alloc_edma_rings(gxio_mpipe_context_t * context,
+int gxio_mpipe_alloc_edma_rings(gxio_mpipe_context_t *context,
                                 unsigned int count, unsigned int first,
                                 unsigned int flags)
 {
@@ -288,7 +288,7 @@ struct init_edma_ring_aux_param {
         unsigned int channel;
 };
 
-int gxio_mpipe_init_edma_ring_aux(gxio_mpipe_context_t * context, void *mem_va,
+int gxio_mpipe_init_edma_ring_aux(gxio_mpipe_context_t *context, void *mem_va,
                                   size_t mem_size, unsigned int mem_flags,
                                   unsigned int ring, unsigned int channel)
 {
@@ -315,7 +315,7 @@ int gxio_mpipe_init_edma_ring_aux(gxio_mpipe_context_t * context, void *mem_va,
 EXPORT_SYMBOL(gxio_mpipe_init_edma_ring_aux);
 
 
-int gxio_mpipe_commit_rules(gxio_mpipe_context_t * context, const void *blob,
+int gxio_mpipe_commit_rules(gxio_mpipe_context_t *context, const void *blob,
                             size_t blob_size)
 {
         const void *params = blob;
@@ -332,7 +332,7 @@ struct register_client_memory_param {
         unsigned int flags;
 };
 
-int gxio_mpipe_register_client_memory(gxio_mpipe_context_t * context,
+int gxio_mpipe_register_client_memory(gxio_mpipe_context_t *context,
                                       unsigned int iotlb, HV_PTE pte,
                                       unsigned int flags)
 {
@@ -355,7 +355,7 @@ struct link_open_aux_param {
         unsigned int flags;
 };
 
-int gxio_mpipe_link_open_aux(gxio_mpipe_context_t * context,
+int gxio_mpipe_link_open_aux(gxio_mpipe_context_t *context,
                              _gxio_mpipe_link_name_t name, unsigned int flags)
 {
         struct link_open_aux_param temp;
@@ -374,7 +374,7 @@ struct link_close_aux_param {
         int mac;
 };
 
-int gxio_mpipe_link_close_aux(gxio_mpipe_context_t * context, int mac)
+int gxio_mpipe_link_close_aux(gxio_mpipe_context_t *context, int mac)
 {
         struct link_close_aux_param temp;
         struct link_close_aux_param *params = &temp;
@@ -393,7 +393,7 @@ struct link_set_attr_aux_param {
         int64_t val;
 };
 
-int gxio_mpipe_link_set_attr_aux(gxio_mpipe_context_t * context, int mac,
+int gxio_mpipe_link_set_attr_aux(gxio_mpipe_context_t *context, int mac,
                                  uint32_t attr, int64_t val)
 {
         struct link_set_attr_aux_param temp;
@@ -415,8 +415,8 @@ struct get_timestamp_aux_param {
         uint64_t cycles;
 };
 
-int gxio_mpipe_get_timestamp_aux(gxio_mpipe_context_t * context, uint64_t * sec,
-                                 uint64_t * nsec, uint64_t * cycles)
+int gxio_mpipe_get_timestamp_aux(gxio_mpipe_context_t *context, uint64_t *sec,
+                                 uint64_t *nsec, uint64_t *cycles)
 {
         int __result;
         struct get_timestamp_aux_param temp;
@@ -440,7 +440,7 @@ struct set_timestamp_aux_param {
         uint64_t cycles;
 };
 
-int gxio_mpipe_set_timestamp_aux(gxio_mpipe_context_t * context, uint64_t sec,
+int gxio_mpipe_set_timestamp_aux(gxio_mpipe_context_t *context, uint64_t sec,
                                  uint64_t nsec, uint64_t cycles)
 {
         struct set_timestamp_aux_param temp;
@@ -460,8 +460,7 @@ struct adjust_timestamp_aux_param {
         int64_t nsec;
 };
 
-int gxio_mpipe_adjust_timestamp_aux(gxio_mpipe_context_t * context,
-                                    int64_t nsec)
+int gxio_mpipe_adjust_timestamp_aux(gxio_mpipe_context_t *context, int64_t nsec)
 {
         struct adjust_timestamp_aux_param temp;
         struct adjust_timestamp_aux_param *params = &temp;
@@ -475,25 +474,6 @@ int gxio_mpipe_adjust_timestamp_aux(gxio_mpipe_context_t * context,
 
 EXPORT_SYMBOL(gxio_mpipe_adjust_timestamp_aux);
 
-struct adjust_timestamp_freq_param {
-        int32_t ppb;
-};
-
-int gxio_mpipe_adjust_timestamp_freq(gxio_mpipe_context_t * context,
-                                     int32_t ppb)
-{
-        struct adjust_timestamp_freq_param temp;
-        struct adjust_timestamp_freq_param *params = &temp;
-
-        params->ppb = ppb;
-
-        return hv_dev_pwrite(context->fd, 0, (HV_VirtAddr) params,
-                             sizeof(*params),
-                             GXIO_MPIPE_OP_ADJUST_TIMESTAMP_FREQ);
-}
-
-EXPORT_SYMBOL(gxio_mpipe_adjust_timestamp_freq);
-
 struct config_edma_ring_blks_param {
         unsigned int ering;
         unsigned int max_blks;
@@ -501,7 +481,7 @@ struct config_edma_ring_blks_param {
         unsigned int db;
 };
 
-int gxio_mpipe_config_edma_ring_blks(gxio_mpipe_context_t * context,
+int gxio_mpipe_config_edma_ring_blks(gxio_mpipe_context_t *context,
                                      unsigned int ering, unsigned int max_blks,
                                      unsigned int min_snf_blks, unsigned int db)
 {
@@ -520,11 +500,29 @@ int gxio_mpipe_config_edma_ring_blks(gxio_mpipe_context_t * context,
 
 EXPORT_SYMBOL(gxio_mpipe_config_edma_ring_blks);
 
+struct adjust_timestamp_freq_param {
+        int32_t ppb;
+};
+
+int gxio_mpipe_adjust_timestamp_freq(gxio_mpipe_context_t *context, int32_t ppb)
+{
+        struct adjust_timestamp_freq_param temp;
+        struct adjust_timestamp_freq_param *params = &temp;
+
+        params->ppb = ppb;
+
+        return hv_dev_pwrite(context->fd, 0, (HV_VirtAddr) params,
+                             sizeof(*params),
+                             GXIO_MPIPE_OP_ADJUST_TIMESTAMP_FREQ);
+}
+
+EXPORT_SYMBOL(gxio_mpipe_adjust_timestamp_freq);
+
 struct arm_pollfd_param {
         union iorpc_pollfd pollfd;
 };
 
-int gxio_mpipe_arm_pollfd(gxio_mpipe_context_t * context, int pollfd_cookie)
+int gxio_mpipe_arm_pollfd(gxio_mpipe_context_t *context, int pollfd_cookie)
 {
         struct arm_pollfd_param temp;
         struct arm_pollfd_param *params = &temp;
@@ -541,7 +539,7 @@ struct close_pollfd_param {
         union iorpc_pollfd pollfd;
 };
 
-int gxio_mpipe_close_pollfd(gxio_mpipe_context_t * context, int pollfd_cookie)
+int gxio_mpipe_close_pollfd(gxio_mpipe_context_t *context, int pollfd_cookie)
 {
         struct close_pollfd_param temp;
         struct close_pollfd_param *params = &temp;
@@ -558,7 +556,7 @@ struct get_mmio_base_param {
         HV_PTE base;
 };
 
-int gxio_mpipe_get_mmio_base(gxio_mpipe_context_t * context, HV_PTE *base)
+int gxio_mpipe_get_mmio_base(gxio_mpipe_context_t *context, HV_PTE *base)
 {
         int __result;
         struct get_mmio_base_param temp;
@@ -579,7 +577,7 @@ struct check_mmio_offset_param {
         unsigned long size;
 };
 
-int gxio_mpipe_check_mmio_offset(gxio_mpipe_context_t * context,
+int gxio_mpipe_check_mmio_offset(gxio_mpipe_context_t *context,
                                  unsigned long offset, unsigned long size)
 {
         struct check_mmio_offset_param temp;
diff --git a/arch/tile/gxio/iorpc_mpipe_info.c b/arch/tile/gxio/iorpc_mpipe_info.c
index 64883aabeb9c..77019c6e9b4a 100644
--- a/arch/tile/gxio/iorpc_mpipe_info.c
+++ b/arch/tile/gxio/iorpc_mpipe_info.c
@@ -15,12 +15,11 @@
 /* This file is machine-generated; DO NOT EDIT! */
 #include "gxio/iorpc_mpipe_info.h"
 
-
 struct instance_aux_param {
         _gxio_mpipe_link_name_t name;
 };
 
-int gxio_mpipe_info_instance_aux(gxio_mpipe_info_context_t * context,
+int gxio_mpipe_info_instance_aux(gxio_mpipe_info_context_t *context,
                                  _gxio_mpipe_link_name_t name)
 {
         struct instance_aux_param temp;
@@ -39,10 +38,10 @@ struct enumerate_aux_param {
         _gxio_mpipe_link_mac_t mac;
 };
 
-int gxio_mpipe_info_enumerate_aux(gxio_mpipe_info_context_t * context,
+int gxio_mpipe_info_enumerate_aux(gxio_mpipe_info_context_t *context,
                                   unsigned int idx,
-                                  _gxio_mpipe_link_name_t * name,
-                                  _gxio_mpipe_link_mac_t * mac)
+                                  _gxio_mpipe_link_name_t *name,
+                                  _gxio_mpipe_link_mac_t *mac)
 {
         int __result;
         struct enumerate_aux_param temp;
@@ -50,7 +49,7 @@ int gxio_mpipe_info_enumerate_aux(gxio_mpipe_info_context_t * context,
 
         __result =
             hv_dev_pread(context->fd, 0, (HV_VirtAddr) params, sizeof(*params),
-                         (((uint64_t) idx << 32) |
+                         (((uint64_t)idx << 32) |
                           GXIO_MPIPE_INFO_OP_ENUMERATE_AUX));
         *name = params->name;
         *mac = params->mac;
@@ -64,7 +63,7 @@ struct get_mmio_base_param {
         HV_PTE base;
 };
 
-int gxio_mpipe_info_get_mmio_base(gxio_mpipe_info_context_t * context,
+int gxio_mpipe_info_get_mmio_base(gxio_mpipe_info_context_t *context,
                                   HV_PTE *base)
 {
         int __result;
@@ -86,7 +85,7 @@ struct check_mmio_offset_param {
         unsigned long size;
 };
 
-int gxio_mpipe_info_check_mmio_offset(gxio_mpipe_info_context_t * context,
+int gxio_mpipe_info_check_mmio_offset(gxio_mpipe_info_context_t *context,
                                       unsigned long offset, unsigned long size)
 {
         struct check_mmio_offset_param temp;
diff --git a/arch/tile/gxio/iorpc_trio.c b/arch/tile/gxio/iorpc_trio.c
index da6e18e049c3..1d3cedb9aeb4 100644
--- a/arch/tile/gxio/iorpc_trio.c
+++ b/arch/tile/gxio/iorpc_trio.c
@@ -21,7 +21,7 @@ struct alloc_asids_param {
         unsigned int flags;
 };
 
-int gxio_trio_alloc_asids(gxio_trio_context_t * context, unsigned int count,
+int gxio_trio_alloc_asids(gxio_trio_context_t *context, unsigned int count,
                           unsigned int first, unsigned int flags)
 {
         struct alloc_asids_param temp;
@@ -44,7 +44,7 @@ struct alloc_memory_maps_param {
         unsigned int flags;
 };
 
-int gxio_trio_alloc_memory_maps(gxio_trio_context_t * context,
+int gxio_trio_alloc_memory_maps(gxio_trio_context_t *context,
                                 unsigned int count, unsigned int first,
                                 unsigned int flags)
 {
@@ -67,7 +67,7 @@ struct alloc_scatter_queues_param {
         unsigned int flags;
 };
 
-int gxio_trio_alloc_scatter_queues(gxio_trio_context_t * context,
+int gxio_trio_alloc_scatter_queues(gxio_trio_context_t *context,
                                    unsigned int count, unsigned int first,
                                    unsigned int flags)
 {
@@ -91,7 +91,7 @@ struct alloc_pio_regions_param {
         unsigned int flags;
 };
 
-int gxio_trio_alloc_pio_regions(gxio_trio_context_t * context,
+int gxio_trio_alloc_pio_regions(gxio_trio_context_t *context,
                                 unsigned int count, unsigned int first,
                                 unsigned int flags)
 {
@@ -115,7 +115,7 @@ struct init_pio_region_aux_param {
         unsigned int flags;
 };
 
-int gxio_trio_init_pio_region_aux(gxio_trio_context_t * context,
+int gxio_trio_init_pio_region_aux(gxio_trio_context_t *context,
                                   unsigned int pio_region, unsigned int mac,
                                   uint32_t bus_address_hi, unsigned int flags)
 {
@@ -145,7 +145,7 @@ struct init_memory_map_mmu_aux_param {
         unsigned int order_mode;
 };
 
-int gxio_trio_init_memory_map_mmu_aux(gxio_trio_context_t * context,
+int gxio_trio_init_memory_map_mmu_aux(gxio_trio_context_t *context,
                                       unsigned int map, unsigned long va,
                                       uint64_t size, unsigned int asid,
                                       unsigned int mac, uint64_t bus_address,
@@ -175,7 +175,7 @@ struct get_port_property_param {
         struct pcie_trio_ports_property trio_ports;
 };
 
-int gxio_trio_get_port_property(gxio_trio_context_t * context,
+int gxio_trio_get_port_property(gxio_trio_context_t *context,
                                 struct pcie_trio_ports_property *trio_ports)
 {
         int __result;
@@ -198,7 +198,7 @@ struct config_legacy_intr_param {
         unsigned int intx;
 };
 
-int gxio_trio_config_legacy_intr(gxio_trio_context_t * context, int inter_x,
+int gxio_trio_config_legacy_intr(gxio_trio_context_t *context, int inter_x,
                                  int inter_y, int inter_ipi, int inter_event,
                                  unsigned int mac, unsigned int intx)
 {
@@ -227,7 +227,7 @@ struct config_msi_intr_param {
         unsigned int asid;
 };
 
-int gxio_trio_config_msi_intr(gxio_trio_context_t * context, int inter_x,
+int gxio_trio_config_msi_intr(gxio_trio_context_t *context, int inter_x,
                               int inter_y, int inter_ipi, int inter_event,
                               unsigned int mac, unsigned int mem_map,
                               uint64_t mem_map_base, uint64_t mem_map_limit,
@@ -259,7 +259,7 @@ struct set_mps_mrs_param {
         unsigned int mac;
 };
 
-int gxio_trio_set_mps_mrs(gxio_trio_context_t * context, uint16_t mps,
+int gxio_trio_set_mps_mrs(gxio_trio_context_t *context, uint16_t mps,
                           uint16_t mrs, unsigned int mac)
 {
         struct set_mps_mrs_param temp;
@@ -279,7 +279,7 @@ struct force_rc_link_up_param {
         unsigned int mac;
 };
 
-int gxio_trio_force_rc_link_up(gxio_trio_context_t * context, unsigned int mac)
+int gxio_trio_force_rc_link_up(gxio_trio_context_t *context, unsigned int mac)
 {
         struct force_rc_link_up_param temp;
         struct force_rc_link_up_param *params = &temp;
@@ -296,7 +296,7 @@ struct force_ep_link_up_param {
         unsigned int mac;
 };
 
-int gxio_trio_force_ep_link_up(gxio_trio_context_t * context, unsigned int mac)
+int gxio_trio_force_ep_link_up(gxio_trio_context_t *context, unsigned int mac)
 {
         struct force_ep_link_up_param temp;
         struct force_ep_link_up_param *params = &temp;
@@ -313,7 +313,7 @@ struct get_mmio_base_param {
         HV_PTE base;
 };
 
-int gxio_trio_get_mmio_base(gxio_trio_context_t * context, HV_PTE *base)
+int gxio_trio_get_mmio_base(gxio_trio_context_t *context, HV_PTE *base)
 {
         int __result;
         struct get_mmio_base_param temp;
@@ -334,7 +334,7 @@ struct check_mmio_offset_param {
         unsigned long size;
 };
 
-int gxio_trio_check_mmio_offset(gxio_trio_context_t * context,
+int gxio_trio_check_mmio_offset(gxio_trio_context_t *context,
                                 unsigned long offset, unsigned long size)
 {
         struct check_mmio_offset_param temp;
diff --git a/arch/tile/gxio/iorpc_usb_host.c b/arch/tile/gxio/iorpc_usb_host.c
index cf3c3cc12204..9c820073bfc0 100644
--- a/arch/tile/gxio/iorpc_usb_host.c
+++ b/arch/tile/gxio/iorpc_usb_host.c
@@ -19,7 +19,7 @@ struct cfg_interrupt_param {
         union iorpc_interrupt interrupt;
 };
 
-int gxio_usb_host_cfg_interrupt(gxio_usb_host_context_t * context, int inter_x,
+int gxio_usb_host_cfg_interrupt(gxio_usb_host_context_t *context, int inter_x,
                                 int inter_y, int inter_ipi, int inter_event)
 {
         struct cfg_interrupt_param temp;
@@ -41,7 +41,7 @@ struct register_client_memory_param {
         unsigned int flags;
 };
 
-int gxio_usb_host_register_client_memory(gxio_usb_host_context_t * context,
+int gxio_usb_host_register_client_memory(gxio_usb_host_context_t *context,
                                          HV_PTE pte, unsigned int flags)
 {
         struct register_client_memory_param temp;
@@ -61,7 +61,7 @@ struct get_mmio_base_param {
         HV_PTE base;
 };
 
-int gxio_usb_host_get_mmio_base(gxio_usb_host_context_t * context, HV_PTE *base)
+int gxio_usb_host_get_mmio_base(gxio_usb_host_context_t *context, HV_PTE *base)
 {
         int __result;
         struct get_mmio_base_param temp;
@@ -82,7 +82,7 @@ struct check_mmio_offset_param {
         unsigned long size;
 };
 
-int gxio_usb_host_check_mmio_offset(gxio_usb_host_context_t * context,
+int gxio_usb_host_check_mmio_offset(gxio_usb_host_context_t *context,
                                     unsigned long offset, unsigned long size)
 {
         struct check_mmio_offset_param temp;
diff --git a/arch/tile/gxio/usb_host.c b/arch/tile/gxio/usb_host.c
index 66b002f54ecc..785afad7922e 100644
--- a/arch/tile/gxio/usb_host.c
+++ b/arch/tile/gxio/usb_host.c
@@ -26,7 +26,7 @@
 #include <gxio/kiorpc.h>
 #include <gxio/usb_host.h>
 
-int gxio_usb_host_init(gxio_usb_host_context_t * context, int usb_index,
+int gxio_usb_host_init(gxio_usb_host_context_t *context, int usb_index,
                        int is_ehci)
 {
         char file[32];
@@ -63,7 +63,7 @@ int gxio_usb_host_init(gxio_usb_host_context_t * context, int usb_index,
 
 EXPORT_SYMBOL_GPL(gxio_usb_host_init);
 
-int gxio_usb_host_destroy(gxio_usb_host_context_t * context)
+int gxio_usb_host_destroy(gxio_usb_host_context_t *context)
 {
         iounmap((void __force __iomem *)(context->mmio_base));
         hv_dev_close(context->fd);
@@ -76,14 +76,14 @@ int gxio_usb_host_destroy(gxio_usb_host_context_t * context)
 
 EXPORT_SYMBOL_GPL(gxio_usb_host_destroy);
 
-void *gxio_usb_host_get_reg_start(gxio_usb_host_context_t * context)
+void *gxio_usb_host_get_reg_start(gxio_usb_host_context_t *context)
 {
         return context->mmio_base;
 }
 
 EXPORT_SYMBOL_GPL(gxio_usb_host_get_reg_start);
 
-size_t gxio_usb_host_get_reg_len(gxio_usb_host_context_t * context)
+size_t gxio_usb_host_get_reg_len(gxio_usb_host_context_t *context)
 {
         return HV_USB_HOST_MMIO_SIZE;
 }
diff --git a/arch/tile/include/arch/mpipe.h b/arch/tile/include/arch/mpipe.h
index 8a33912fd6cc..904538e754d8 100644
--- a/arch/tile/include/arch/mpipe.h
+++ b/arch/tile/include/arch/mpipe.h
@@ -176,7 +176,18 @@ typedef union
      */
     uint_reg_t stack_idx    : 5;
     /* Reserved. */
-    uint_reg_t __reserved_2 : 5;
+    uint_reg_t __reserved_2 : 3;
+    /*
+     * Instance ID.  For devices that support automatic buffer return between
+     * mPIPE instances, this field indicates the buffer owner.  If the INST
+     * field does not match the mPIPE's instance number when a packet is
+     * egressed, buffers with HWB set will be returned to the other mPIPE
+     * instance.  Note that not all devices support multi-mPIPE buffer
+     * return.  The MPIPE_EDMA_INFO.REMOTE_BUFF_RTN_SUPPORT bit indicates
+     * whether the INST field in the buffer descriptor is populated by iDMA
+     * hardware. This field is ignored on writes.
+     */
+    uint_reg_t inst         : 2;
     /*
      * Reads as one to indicate that this is a hardware managed buffer.
      * Ignored on writes since all buffers on a given stack are the same size.
@@ -205,7 +216,8 @@ typedef union
     uint_reg_t c            : 2;
     uint_reg_t size         : 3;
     uint_reg_t hwb          : 1;
-    uint_reg_t __reserved_2 : 5;
+    uint_reg_t inst         : 2;
+    uint_reg_t __reserved_2 : 3;
     uint_reg_t stack_idx    : 5;
     uint_reg_t __reserved_1 : 6;
     int_reg_t va           : 35;
@@ -231,9 +243,9 @@ typedef union
     /* Reserved. */
     uint_reg_t __reserved_0 : 3;
     /* eDMA ring being accessed */
-    uint_reg_t ring         : 5;
+    uint_reg_t ring         : 6;
     /* Reserved. */
-    uint_reg_t __reserved_1 : 18;
+    uint_reg_t __reserved_1 : 17;
     /*
      * This field of the address selects the region (address space) to be
      * accessed.  For the egress DMA post region, this field must be 5.
@@ -250,8 +262,8 @@ typedef union
     uint_reg_t svc_dom      : 5;
     uint_reg_t __reserved_2 : 6;
     uint_reg_t region       : 3;
-    uint_reg_t __reserved_1 : 18;
-    uint_reg_t ring         : 5;
+    uint_reg_t __reserved_1 : 17;
+    uint_reg_t ring         : 6;
     uint_reg_t __reserved_0 : 3;
 #endif
   };
diff --git a/arch/tile/include/arch/mpipe_constants.h b/arch/tile/include/arch/mpipe_constants.h
index 410a0400e055..84022ac5fe82 100644
--- a/arch/tile/include/arch/mpipe_constants.h
+++ b/arch/tile/include/arch/mpipe_constants.h
@@ -16,13 +16,13 @@
 #ifndef __ARCH_MPIPE_CONSTANTS_H__
 #define __ARCH_MPIPE_CONSTANTS_H__
 
-#define MPIPE_NUM_CLASSIFIERS 10
+#define MPIPE_NUM_CLASSIFIERS 16
 #define MPIPE_CLS_MHZ 1200
 
-#define MPIPE_NUM_EDMA_RINGS 32
+#define MPIPE_NUM_EDMA_RINGS 64
 
 #define MPIPE_NUM_SGMII_MACS 16
-#define MPIPE_NUM_XAUI_MACS 4
+#define MPIPE_NUM_XAUI_MACS 16
 #define MPIPE_NUM_LOOPBACK_CHANNELS 4
 #define MPIPE_NUM_NON_LB_CHANNELS 28
 
diff --git a/arch/tile/include/arch/mpipe_shm.h b/arch/tile/include/arch/mpipe_shm.h
index f2e9e122818d..13b3c4300e50 100644
--- a/arch/tile/include/arch/mpipe_shm.h
+++ b/arch/tile/include/arch/mpipe_shm.h
@@ -44,8 +44,14 @@ typedef union
      * descriptors toggles each time the ring tail pointer wraps.
      */
     uint_reg_t gen        : 1;
+    /**
+     * For devices with EDMA reorder support, this field allows the
+     * descriptor to select the egress FIFO.  The associated DMA ring must
+     * have ALLOW_EFIFO_SEL enabled.
+     */
+    uint_reg_t efifo_sel  : 6;
     /** Reserved.  Must be zero. */
-    uint_reg_t r0         : 7;
+    uint_reg_t r0         : 1;
     /** Checksum generation enabled for this transfer. */
     uint_reg_t csum       : 1;
     /**
@@ -110,7 +116,8 @@ typedef union
     uint_reg_t notif      : 1;
     uint_reg_t ns         : 1;
     uint_reg_t csum       : 1;
-    uint_reg_t r0         : 7;
+    uint_reg_t r0         : 1;
+    uint_reg_t efifo_sel  : 6;
     uint_reg_t gen        : 1;
 #endif
 
@@ -126,14 +133,16 @@ typedef union
     /** Reserved. */
     uint_reg_t __reserved_1 : 3;
     /**
-     * Instance ID.  For devices that support more than one mPIPE instance,
-     * this field indicates the buffer owner.  If the INST field does not
-     * match the mPIPE's instance number when a packet is egressed, buffers
-     * with HWB set will be returned to the other mPIPE instance.
+     * Instance ID.  For devices that support automatic buffer return between
+     * mPIPE instances, this field indicates the buffer owner.  If the INST
+     * field does not match the mPIPE's instance number when a packet is
+     * egressed, buffers with HWB set will be returned to the other mPIPE
+     * instance.  Note that not all devices support multi-mPIPE buffer
+     * return.  The MPIPE_EDMA_INFO.REMOTE_BUFF_RTN_SUPPORT bit indicates
+     * whether the INST field in the buffer descriptor is populated by iDMA
+     * hardware.
      */
-    uint_reg_t inst         : 1;
-    /** Reserved. */
-    uint_reg_t __reserved_2 : 1;
+    uint_reg_t inst         : 2;
     /**
      * Always set to one by hardware in iDMA packet descriptors.  For eDMA,
      * indicates whether the buffer will be released to the buffer stack
@@ -166,8 +175,7 @@ typedef union
     uint_reg_t c            : 2;
     uint_reg_t size         : 3;
     uint_reg_t hwb          : 1;
-    uint_reg_t __reserved_2 : 1;
-    uint_reg_t inst         : 1;
+    uint_reg_t inst         : 2;
     uint_reg_t __reserved_1 : 3;
     uint_reg_t stack_idx    : 5;
     uint_reg_t __reserved_0 : 6;
@@ -408,7 +416,10 @@ typedef union
     /**
      * Sequence number applied when packet is distributed.   Classifier
      * selects which sequence number is to be applied by writing the 13-bit
-     * SQN-selector into this field.
+     * SQN-selector into this field.  For devices that support EXT_SQN (as
+     * indicated in IDMA_INFO.EXT_SQN_SUPPORT), the GP_SQN can be extended to
+     * 32-bits via the IDMA_CTL.EXT_SQN register.  In this case the
+     * PACKET_SQN will be reduced to 32 bits.
      */
     uint_reg_t gp_sqn     : 16;
     /**
@@ -451,14 +462,16 @@ typedef union
     /** Reserved. */
     uint_reg_t __reserved_5 : 3;
     /**
-     * Instance ID.  For devices that support more than one mPIPE instance,
-     * this field indicates the buffer owner.  If the INST field does not
-     * match the mPIPE's instance number when a packet is egressed, buffers
-     * with HWB set will be returned to the other mPIPE instance.
+     * Instance ID.  For devices that support automatic buffer return between
+     * mPIPE instances, this field indicates the buffer owner.  If the INST
+     * field does not match the mPIPE's instance number when a packet is
+     * egressed, buffers with HWB set will be returned to the other mPIPE
+     * instance.  Note that not all devices support multi-mPIPE buffer
+     * return.  The MPIPE_EDMA_INFO.REMOTE_BUFF_RTN_SUPPORT bit indicates
+     * whether the INST field in the buffer descriptor is populated by iDMA
+     * hardware.
      */
-    uint_reg_t inst         : 1;
-    /** Reserved. */
-    uint_reg_t __reserved_6 : 1;
+    uint_reg_t inst         : 2;
     /**
      * Always set to one by hardware in iDMA packet descriptors.  For eDMA,
      * indicates whether the buffer will be released to the buffer stack
@@ -491,8 +504,7 @@ typedef union
     uint_reg_t c            : 2;
     uint_reg_t size         : 3;
     uint_reg_t hwb          : 1;
-    uint_reg_t __reserved_6 : 1;
-    uint_reg_t inst         : 1;
+    uint_reg_t inst         : 2;
     uint_reg_t __reserved_5 : 3;
     uint_reg_t stack_idx    : 5;
     uint_reg_t __reserved_4 : 6;
diff --git a/arch/tile/include/arch/trio_constants.h b/arch/tile/include/arch/trio_constants.h
index 628b045436b8..85647e91a458 100644
--- a/arch/tile/include/arch/trio_constants.h
+++ b/arch/tile/include/arch/trio_constants.h
@@ -16,21 +16,21 @@
 #ifndef __ARCH_TRIO_CONSTANTS_H__
 #define __ARCH_TRIO_CONSTANTS_H__
 
-#define TRIO_NUM_ASIDS 16
+#define TRIO_NUM_ASIDS 32
 #define TRIO_NUM_TLBS_PER_ASID 16
 
 #define TRIO_NUM_TPIO_REGIONS 8
 #define TRIO_LOG2_NUM_TPIO_REGIONS 3
 
-#define TRIO_NUM_MAP_MEM_REGIONS 16
-#define TRIO_LOG2_NUM_MAP_MEM_REGIONS 4
+#define TRIO_NUM_MAP_MEM_REGIONS 32
+#define TRIO_LOG2_NUM_MAP_MEM_REGIONS 5
 #define TRIO_NUM_MAP_SQ_REGIONS 8
 #define TRIO_LOG2_NUM_MAP_SQ_REGIONS 3
 
 #define TRIO_LOG2_NUM_SQ_FIFO_ENTRIES 6
 
-#define TRIO_NUM_PUSH_DMA_RINGS 32
+#define TRIO_NUM_PUSH_DMA_RINGS 64
 
-#define TRIO_NUM_PULL_DMA_RINGS 32
+#define TRIO_NUM_PULL_DMA_RINGS 64
 
 #endif /* __ARCH_TRIO_CONSTANTS_H__ */
diff --git a/arch/tile/include/asm/page.h b/arch/tile/include/asm/page.h
index 6346888f7bdc..672768008618 100644
--- a/arch/tile/include/asm/page.h
+++ b/arch/tile/include/asm/page.h
@@ -182,10 +182,9 @@ static inline __attribute_const__ int get_order(unsigned long size)
 
 #define PAGE_OFFSET             (-(_AC(1, UL) << (MAX_VA_WIDTH - 1)))
 #define KERNEL_HIGH_VADDR       _AC(0xfffffff800000000, UL)  /* high 32GB */
-#define FIXADDR_BASE            (KERNEL_HIGH_VADDR - 0x400000000) /* 4 GB */
-#define FIXADDR_TOP             (KERNEL_HIGH_VADDR - 0x300000000) /* 4 GB */
+#define FIXADDR_BASE            (KERNEL_HIGH_VADDR - 0x300000000) /* 4 GB */
+#define FIXADDR_TOP             (KERNEL_HIGH_VADDR - 0x200000000) /* 4 GB */
 #define _VMALLOC_START          FIXADDR_TOP
-#define HUGE_VMAP_BASE          (KERNEL_HIGH_VADDR - 0x200000000) /* 4 GB */
 #define MEM_SV_START            (KERNEL_HIGH_VADDR - 0x100000000) /* 256 MB */
 #define MEM_MODULE_START        (MEM_SV_START + (256*1024*1024)) /* 256 MB */
 #define MEM_MODULE_END          (MEM_MODULE_START + (256*1024*1024))
diff --git a/arch/tile/include/asm/pgtable_32.h b/arch/tile/include/asm/pgtable_32.h
index 63142ab3b3dd..d26a42279036 100644
--- a/arch/tile/include/asm/pgtable_32.h
+++ b/arch/tile/include/asm/pgtable_32.h
@@ -55,17 +55,9 @@
 #define PKMAP_BASE   ((FIXADDR_BOOT_START - PAGE_SIZE*LAST_PKMAP) & PGDIR_MASK)
 
 #ifdef CONFIG_HIGHMEM
-# define __VMAPPING_END (PKMAP_BASE & ~(HPAGE_SIZE-1))
+# define _VMALLOC_END   (PKMAP_BASE & ~(HPAGE_SIZE-1))
 #else
-# define __VMAPPING_END (FIXADDR_START & ~(HPAGE_SIZE-1))
-#endif
-
-#ifdef CONFIG_HUGEVMAP
-#define HUGE_VMAP_END   __VMAPPING_END
-#define HUGE_VMAP_BASE  (HUGE_VMAP_END - CONFIG_NR_HUGE_VMAPS * HPAGE_SIZE)
-#define _VMALLOC_END    HUGE_VMAP_BASE
-#else
-#define _VMALLOC_END    __VMAPPING_END
+# define _VMALLOC_END   (FIXADDR_START & ~(HPAGE_SIZE-1))
 #endif
 
 /*
diff --git a/arch/tile/include/asm/pgtable_64.h b/arch/tile/include/asm/pgtable_64.h
index 3421177f7370..2c8a9cd102d3 100644
--- a/arch/tile/include/asm/pgtable_64.h
+++ b/arch/tile/include/asm/pgtable_64.h
@@ -52,12 +52,10 @@
  * memory allocation code).  The vmalloc code puts in an internal
  * guard page between each allocation.
  */
-#define _VMALLOC_END    HUGE_VMAP_BASE
+#define _VMALLOC_END    MEM_SV_START
 #define VMALLOC_END     _VMALLOC_END
 #define VMALLOC_START   _VMALLOC_START
 
-#define HUGE_VMAP_END   (HUGE_VMAP_BASE + PGDIR_SIZE)
-
 #ifndef __ASSEMBLY__
 
 /* We have no pud since we are a three-level page table. */
diff --git a/arch/tile/include/gxio/iorpc_mpipe.h b/arch/tile/include/gxio/iorpc_mpipe.h
index fdd07f88cfd7..4cda03de734f 100644
--- a/arch/tile/include/gxio/iorpc_mpipe.h
+++ b/arch/tile/include/gxio/iorpc_mpipe.h
@@ -56,89 +56,89 @@
 #define GXIO_MPIPE_OP_GET_MMIO_BASE    IORPC_OPCODE(IORPC_FORMAT_NONE_NOUSER, 0x8000)
 #define GXIO_MPIPE_OP_CHECK_MMIO_OFFSET IORPC_OPCODE(IORPC_FORMAT_NONE_NOUSER, 0x8001)
 
-int gxio_mpipe_alloc_buffer_stacks(gxio_mpipe_context_t * context,
+int gxio_mpipe_alloc_buffer_stacks(gxio_mpipe_context_t *context,
                                    unsigned int count, unsigned int first,
                                    unsigned int flags);
 
-int gxio_mpipe_init_buffer_stack_aux(gxio_mpipe_context_t * context,
+int gxio_mpipe_init_buffer_stack_aux(gxio_mpipe_context_t *context,
                                      void *mem_va, size_t mem_size,
                                      unsigned int mem_flags, unsigned int stack,
                                      unsigned int buffer_size_enum);
 
 
-int gxio_mpipe_alloc_notif_rings(gxio_mpipe_context_t * context,
+int gxio_mpipe_alloc_notif_rings(gxio_mpipe_context_t *context,
                                  unsigned int count, unsigned int first,
                                  unsigned int flags);
 
-int gxio_mpipe_init_notif_ring_aux(gxio_mpipe_context_t * context, void *mem_va,
+int gxio_mpipe_init_notif_ring_aux(gxio_mpipe_context_t *context, void *mem_va,
                                    size_t mem_size, unsigned int mem_flags,
                                    unsigned int ring);
 
-int gxio_mpipe_request_notif_ring_interrupt(gxio_mpipe_context_t * context,
+int gxio_mpipe_request_notif_ring_interrupt(gxio_mpipe_context_t *context,
                                             int inter_x, int inter_y,
                                             int inter_ipi, int inter_event,
                                             unsigned int ring);
 
-int gxio_mpipe_enable_notif_ring_interrupt(gxio_mpipe_context_t * context,
+int gxio_mpipe_enable_notif_ring_interrupt(gxio_mpipe_context_t *context,
                                            unsigned int ring);
 
-int gxio_mpipe_alloc_notif_groups(gxio_mpipe_context_t * context,
+int gxio_mpipe_alloc_notif_groups(gxio_mpipe_context_t *context,
                                   unsigned int count, unsigned int first,
                                   unsigned int flags);
 
-int gxio_mpipe_init_notif_group(gxio_mpipe_context_t * context,
+int gxio_mpipe_init_notif_group(gxio_mpipe_context_t *context,
                                 unsigned int group,
                                 gxio_mpipe_notif_group_bits_t bits);
 
-int gxio_mpipe_alloc_buckets(gxio_mpipe_context_t * context, unsigned int count,
+int gxio_mpipe_alloc_buckets(gxio_mpipe_context_t *context, unsigned int count,
                              unsigned int first, unsigned int flags);
 
-int gxio_mpipe_init_bucket(gxio_mpipe_context_t * context, unsigned int bucket,
+int gxio_mpipe_init_bucket(gxio_mpipe_context_t *context, unsigned int bucket,
                            MPIPE_LBL_INIT_DAT_BSTS_TBL_t bucket_info);
 
-int gxio_mpipe_alloc_edma_rings(gxio_mpipe_context_t * context,
+int gxio_mpipe_alloc_edma_rings(gxio_mpipe_context_t *context,
                                 unsigned int count, unsigned int first,
                                 unsigned int flags);
 
-int gxio_mpipe_init_edma_ring_aux(gxio_mpipe_context_t * context, void *mem_va,
+int gxio_mpipe_init_edma_ring_aux(gxio_mpipe_context_t *context, void *mem_va,
                                   size_t mem_size, unsigned int mem_flags,
                                   unsigned int ring, unsigned int channel);
 
 
-int gxio_mpipe_commit_rules(gxio_mpipe_context_t * context, const void *blob,
+int gxio_mpipe_commit_rules(gxio_mpipe_context_t *context, const void *blob,
                             size_t blob_size);
 
-int gxio_mpipe_register_client_memory(gxio_mpipe_context_t * context,
+int gxio_mpipe_register_client_memory(gxio_mpipe_context_t *context,
                                       unsigned int iotlb, HV_PTE pte,
                                       unsigned int flags);
 
-int gxio_mpipe_link_open_aux(gxio_mpipe_context_t * context,
+int gxio_mpipe_link_open_aux(gxio_mpipe_context_t *context,
                              _gxio_mpipe_link_name_t name, unsigned int flags);
 
-int gxio_mpipe_link_close_aux(gxio_mpipe_context_t * context, int mac);
+int gxio_mpipe_link_close_aux(gxio_mpipe_context_t *context, int mac);
 
-int gxio_mpipe_link_set_attr_aux(gxio_mpipe_context_t * context, int mac,
+int gxio_mpipe_link_set_attr_aux(gxio_mpipe_context_t *context, int mac,
                                  uint32_t attr, int64_t val);
 
-int gxio_mpipe_get_timestamp_aux(gxio_mpipe_context_t * context, uint64_t * sec,
-                                 uint64_t * nsec, uint64_t * cycles);
+int gxio_mpipe_get_timestamp_aux(gxio_mpipe_context_t *context, uint64_t *sec,
+                                 uint64_t *nsec, uint64_t *cycles);
 
-int gxio_mpipe_set_timestamp_aux(gxio_mpipe_context_t * context, uint64_t sec,
+int gxio_mpipe_set_timestamp_aux(gxio_mpipe_context_t *context, uint64_t sec,
                                  uint64_t nsec, uint64_t cycles);
 
-int gxio_mpipe_adjust_timestamp_aux(gxio_mpipe_context_t * context,
+int gxio_mpipe_adjust_timestamp_aux(gxio_mpipe_context_t *context,
                                     int64_t nsec);
 
-int gxio_mpipe_adjust_timestamp_freq(gxio_mpipe_context_t * context,
+int gxio_mpipe_adjust_timestamp_freq(gxio_mpipe_context_t *context,
                                      int32_t ppb);
 
-int gxio_mpipe_arm_pollfd(gxio_mpipe_context_t * context, int pollfd_cookie);
+int gxio_mpipe_arm_pollfd(gxio_mpipe_context_t *context, int pollfd_cookie);
 
-int gxio_mpipe_close_pollfd(gxio_mpipe_context_t * context, int pollfd_cookie);
+int gxio_mpipe_close_pollfd(gxio_mpipe_context_t *context, int pollfd_cookie);
 
-int gxio_mpipe_get_mmio_base(gxio_mpipe_context_t * context, HV_PTE *base);
+int gxio_mpipe_get_mmio_base(gxio_mpipe_context_t *context, HV_PTE *base);
 
-int gxio_mpipe_check_mmio_offset(gxio_mpipe_context_t * context,
+int gxio_mpipe_check_mmio_offset(gxio_mpipe_context_t *context,
                                  unsigned long offset, unsigned long size);
 
 #endif /* !__GXIO_MPIPE_LINUX_RPC_H__ */
diff --git a/arch/tile/include/gxio/iorpc_mpipe_info.h b/arch/tile/include/gxio/iorpc_mpipe_info.h
index 476c5e5ca22c..f0b04284468b 100644
--- a/arch/tile/include/gxio/iorpc_mpipe_info.h
+++ b/arch/tile/include/gxio/iorpc_mpipe_info.h
@@ -33,18 +33,18 @@
 #define GXIO_MPIPE_INFO_OP_CHECK_MMIO_OFFSET IORPC_OPCODE(IORPC_FORMAT_NONE_NOUSER, 0x8001)
 
 
-int gxio_mpipe_info_instance_aux(gxio_mpipe_info_context_t * context,
+int gxio_mpipe_info_instance_aux(gxio_mpipe_info_context_t *context,
                                  _gxio_mpipe_link_name_t name);
 
-int gxio_mpipe_info_enumerate_aux(gxio_mpipe_info_context_t * context,
+int gxio_mpipe_info_enumerate_aux(gxio_mpipe_info_context_t *context,
                                   unsigned int idx,
-                                  _gxio_mpipe_link_name_t * name,
-                                  _gxio_mpipe_link_mac_t * mac);
+                                  _gxio_mpipe_link_name_t *name,
+                                  _gxio_mpipe_link_mac_t *mac);
 
-int gxio_mpipe_info_get_mmio_base(gxio_mpipe_info_context_t * context,
+int gxio_mpipe_info_get_mmio_base(gxio_mpipe_info_context_t *context,
                                   HV_PTE *base);
 
-int gxio_mpipe_info_check_mmio_offset(gxio_mpipe_info_context_t * context,
+int gxio_mpipe_info_check_mmio_offset(gxio_mpipe_info_context_t *context,
                                       unsigned long offset, unsigned long size);
 
 #endif /* !__GXIO_MPIPE_INFO_LINUX_RPC_H__ */
diff --git a/arch/tile/include/gxio/iorpc_trio.h b/arch/tile/include/gxio/iorpc_trio.h
index d95b96fd6c93..376a4f771167 100644
--- a/arch/tile/include/gxio/iorpc_trio.h
+++ b/arch/tile/include/gxio/iorpc_trio.h
@@ -46,59 +46,59 @@
 #define GXIO_TRIO_OP_GET_MMIO_BASE     IORPC_OPCODE(IORPC_FORMAT_NONE_NOUSER, 0x8000)
 #define GXIO_TRIO_OP_CHECK_MMIO_OFFSET IORPC_OPCODE(IORPC_FORMAT_NONE_NOUSER, 0x8001)
 
-int gxio_trio_alloc_asids(gxio_trio_context_t * context, unsigned int count,
+int gxio_trio_alloc_asids(gxio_trio_context_t *context, unsigned int count,
                           unsigned int first, unsigned int flags);
 
 
-int gxio_trio_alloc_memory_maps(gxio_trio_context_t * context,
+int gxio_trio_alloc_memory_maps(gxio_trio_context_t *context,
                                 unsigned int count, unsigned int first,
                                 unsigned int flags);
 
 
-int gxio_trio_alloc_scatter_queues(gxio_trio_context_t * context,
+int gxio_trio_alloc_scatter_queues(gxio_trio_context_t *context,
                                    unsigned int count, unsigned int first,
                                    unsigned int flags);
 
-int gxio_trio_alloc_pio_regions(gxio_trio_context_t * context,
+int gxio_trio_alloc_pio_regions(gxio_trio_context_t *context,
                                 unsigned int count, unsigned int first,
                                 unsigned int flags);
 
-int gxio_trio_init_pio_region_aux(gxio_trio_context_t * context,
+int gxio_trio_init_pio_region_aux(gxio_trio_context_t *context,
                                   unsigned int pio_region, unsigned int mac,
                                   uint32_t bus_address_hi, unsigned int flags);
 
 
-int gxio_trio_init_memory_map_mmu_aux(gxio_trio_context_t * context,
+int gxio_trio_init_memory_map_mmu_aux(gxio_trio_context_t *context,
                                       unsigned int map, unsigned long va,
                                       uint64_t size, unsigned int asid,
                                       unsigned int mac, uint64_t bus_address,
                                       unsigned int node,
                                       unsigned int order_mode);
 
-int gxio_trio_get_port_property(gxio_trio_context_t * context,
+int gxio_trio_get_port_property(gxio_trio_context_t *context,
                                 struct pcie_trio_ports_property *trio_ports);
 
-int gxio_trio_config_legacy_intr(gxio_trio_context_t * context, int inter_x,
+int gxio_trio_config_legacy_intr(gxio_trio_context_t *context, int inter_x,
                                  int inter_y, int inter_ipi, int inter_event,
                                  unsigned int mac, unsigned int intx);
 
-int gxio_trio_config_msi_intr(gxio_trio_context_t * context, int inter_x,
+int gxio_trio_config_msi_intr(gxio_trio_context_t *context, int inter_x,
                               int inter_y, int inter_ipi, int inter_event,
                               unsigned int mac, unsigned int mem_map,
                               uint64_t mem_map_base, uint64_t mem_map_limit,
                               unsigned int asid);
 
 
-int gxio_trio_set_mps_mrs(gxio_trio_context_t * context, uint16_t mps,
+int gxio_trio_set_mps_mrs(gxio_trio_context_t *context, uint16_t mps,
                           uint16_t mrs, unsigned int mac);
 
-int gxio_trio_force_rc_link_up(gxio_trio_context_t * context, unsigned int mac);
+int gxio_trio_force_rc_link_up(gxio_trio_context_t *context, unsigned int mac);
 
-int gxio_trio_force_ep_link_up(gxio_trio_context_t * context, unsigned int mac);
+int gxio_trio_force_ep_link_up(gxio_trio_context_t *context, unsigned int mac);
 
-int gxio_trio_get_mmio_base(gxio_trio_context_t * context, HV_PTE *base);
+int gxio_trio_get_mmio_base(gxio_trio_context_t *context, HV_PTE *base);
 
-int gxio_trio_check_mmio_offset(gxio_trio_context_t * context,
+int gxio_trio_check_mmio_offset(gxio_trio_context_t *context,
                                 unsigned long offset, unsigned long size);
 
 #endif /* !__GXIO_TRIO_LINUX_RPC_H__ */
diff --git a/arch/tile/include/gxio/iorpc_usb_host.h b/arch/tile/include/gxio/iorpc_usb_host.h
index 8622e7d126ad..79962a97de8e 100644
--- a/arch/tile/include/gxio/iorpc_usb_host.h
+++ b/arch/tile/include/gxio/iorpc_usb_host.h
@@ -31,16 +31,16 @@
 #define GXIO_USB_HOST_OP_GET_MMIO_BASE IORPC_OPCODE(IORPC_FORMAT_NONE_NOUSER, 0x8000)
 #define GXIO_USB_HOST_OP_CHECK_MMIO_OFFSET IORPC_OPCODE(IORPC_FORMAT_NONE_NOUSER, 0x8001)
 
-int gxio_usb_host_cfg_interrupt(gxio_usb_host_context_t * context, int inter_x,
+int gxio_usb_host_cfg_interrupt(gxio_usb_host_context_t *context, int inter_x,
                                 int inter_y, int inter_ipi, int inter_event);
 
-int gxio_usb_host_register_client_memory(gxio_usb_host_context_t * context,
+int gxio_usb_host_register_client_memory(gxio_usb_host_context_t *context,
                                          HV_PTE pte, unsigned int flags);
 
-int gxio_usb_host_get_mmio_base(gxio_usb_host_context_t * context,
+int gxio_usb_host_get_mmio_base(gxio_usb_host_context_t *context,
                                 HV_PTE *base);
 
-int gxio_usb_host_check_mmio_offset(gxio_usb_host_context_t * context,
+int gxio_usb_host_check_mmio_offset(gxio_usb_host_context_t *context,
                                     unsigned long offset, unsigned long size);
 
 #endif /* !__GXIO_USB_HOST_LINUX_RPC_H__ */
diff --git a/arch/tile/include/gxio/usb_host.h b/arch/tile/include/gxio/usb_host.h
index 5eedec0e988e..93c9636d2dd7 100644
--- a/arch/tile/include/gxio/usb_host.h
+++ b/arch/tile/include/gxio/usb_host.h
@@ -53,7 +53,7 @@ typedef struct {
  * @return Zero if the context was successfully initialized, else a
  *  GXIO_ERR_xxx error code.
  */
-extern int gxio_usb_host_init(gxio_usb_host_context_t * context, int usb_index,
+extern int gxio_usb_host_init(gxio_usb_host_context_t *context, int usb_index,
                               int is_ehci);
 
 /* Destroy a USB context.
@@ -68,20 +68,20 @@ extern int gxio_usb_host_init(gxio_usb_host_context_t * context, int usb_index,
  * @return Zero if the context was successfully destroyed, else a
  *  GXIO_ERR_xxx error code.
  */
-extern int gxio_usb_host_destroy(gxio_usb_host_context_t * context);
+extern int gxio_usb_host_destroy(gxio_usb_host_context_t *context);
 
 /* Retrieve the address of the shim's MMIO registers.
  *
  * @param context Pointer to a properly initialized gxio_usb_host_context_t.
  * @return The address of the shim's MMIO registers.
  */
-extern void *gxio_usb_host_get_reg_start(gxio_usb_host_context_t * context);
+extern void *gxio_usb_host_get_reg_start(gxio_usb_host_context_t *context);
 
 /* Retrieve the length of the shim's MMIO registers.
  *
  * @param context Pointer to a properly initialized gxio_usb_host_context_t.
  * @return The length of the shim's MMIO registers.
  */
-extern size_t gxio_usb_host_get_reg_len(gxio_usb_host_context_t * context);
+extern size_t gxio_usb_host_get_reg_len(gxio_usb_host_context_t *context);
 
 #endif /* _GXIO_USB_H_ */
diff --git a/arch/tile/kernel/compat.c b/arch/tile/kernel/compat.c
index ed378416b86a..49120843ff96 100644
--- a/arch/tile/kernel/compat.c
+++ b/arch/tile/kernel/compat.c
@@ -84,7 +84,7 @@ COMPAT_SYSCALL_DEFINE5(llseek, unsigned int, fd, unsigned int, offset_high,
 {
         return sys_llseek(fd, offset_high, offset_low, result, origin);
 }
- 
+
 /* Provide the compat syscall number to call mapping. */
 #undef __SYSCALL
 #define __SYSCALL(nr, call) [nr] = (call),
diff --git a/arch/tile/kernel/futex_64.S b/arch/tile/kernel/futex_64.S
deleted file mode 100644
index f465d1eda20f..000000000000
--- a/arch/tile/kernel/futex_64.S
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * Copyright 2011 Tilera Corporation. All Rights Reserved.
- *
- *   This program is free software; you can redistribute it and/or
- *   modify it under the terms of the GNU General Public License
- *   as published by the Free Software Foundation, version 2.
- *
- *   This program is distributed in the hope that it will be useful, but
- *   WITHOUT ANY WARRANTY; without even the implied warranty of
- *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
- *   NON INFRINGEMENT.  See the GNU General Public License for
- *   more details.
- *
- * Atomically access user memory, but use MMU to avoid propagating
- * kernel exceptions.
- */
-
-#include <linux/linkage.h>
-#include <asm/errno.h>
-#include <asm/futex.h>
-#include <asm/page.h>
-#include <asm/processor.h>
-
-/*
- * Provide a set of atomic memory operations supporting <asm/futex.h>.
- *
- * r0: user address to manipulate
- * r1: new value to write, or for cmpxchg, old value to compare against
- * r2: (cmpxchg only) new value to write
- *
- * Return __get_user struct, r0 with value, r1 with error.
- */
-#define FUTEX_OP(name, ...) \
-STD_ENTRY(futex_##name)                 \
-        __VA_ARGS__;                    \
-        {                               \
-         move   r1, zero;               \
-         jrp    lr                      \
-        };                              \
-        STD_ENDPROC(futex_##name);      \
-        .pushsection __ex_table,"a";    \
-        .quad 1b, get_user_fault;       \
-        .popsection
-
-        .pushsection .fixup,"ax"
-get_user_fault:
-        { movei r1, -EFAULT; jrp lr }
-        ENDPROC(get_user_fault)
-        .popsection
-
-FUTEX_OP(cmpxchg, mtspr CMPEXCH_VALUE, r1; 1: cmpexch4 r0, r0, r2)
-FUTEX_OP(set, 1: exch4 r0, r0, r1)
-FUTEX_OP(add, 1: fetchadd4 r0, r0, r1)
-FUTEX_OP(or, 1: fetchor4 r0, r0, r1)
-FUTEX_OP(andn, nor r1, r1, zero; 1: fetchand4 r0, r0, r1)
diff --git a/arch/tile/kernel/setup.c b/arch/tile/kernel/setup.c
index 4c34caea9dd3..74c91729a62a 100644
--- a/arch/tile/kernel/setup.c
+++ b/arch/tile/kernel/setup.c
@@ -1268,8 +1268,7 @@ static void __init validate_va(void)
         if ((long)VMALLOC_START >= 0)
                 early_panic(
                         "Linux VMALLOC region below the 2GB line (%#lx)!\n"
-                        "Reconfigure the kernel with fewer NR_HUGE_VMAPS\n"
-                        "or smaller VMALLOC_RESERVE.\n",
+                        "Reconfigure the kernel with smaller VMALLOC_RESERVE.\n",
                         VMALLOC_START);
 #endif
 }
diff --git a/arch/tile/kernel/unaligned.c b/arch/tile/kernel/unaligned.c
index b425fb6a480d..b030b4e78845 100644
--- a/arch/tile/kernel/unaligned.c
+++ b/arch/tile/kernel/unaligned.c
@@ -551,8 +551,8 @@ static tilegx_bundle_bits  jit_x1_bnezt(int ra, int broff)
 /*
  * This function generates unalign fixup JIT.
  *
- * We fist find unalign load/store instruction's destination, source
- * reguisters: ra, rb and rd. and 3 scratch registers by calling
+ * We first find unalign load/store instruction's destination, source
+ * registers: ra, rb and rd. and 3 scratch registers by calling
  * find_regs(...). 3 scratch clobbers should not alias with any register
  * used in the fault bundle. Then analyze the fault bundle to determine
  * if it's a load or store, operand width, branch or address increment etc.
diff --git a/arch/tile/mm/fault.c b/arch/tile/mm/fault.c
index 4c288f199453..6c0571216a9d 100644
--- a/arch/tile/mm/fault.c
+++ b/arch/tile/mm/fault.c
@@ -149,8 +149,6 @@ static inline int vmalloc_fault(pgd_t *pgd, unsigned long address)
         pmd_k = vmalloc_sync_one(pgd, address);
         if (!pmd_k)
                 return -1;
-        if (pmd_huge(*pmd_k))
-                return 0;   /* support TILE huge_vmap() API */
         pte_k = pte_offset_kernel(pmd_k, address);
         if (!pte_present(*pte_k))
                 return -1;
diff --git a/arch/tile/mm/init.c b/arch/tile/mm/init.c
index 4e316deb92fd..0fa1acfac79a 100644
--- a/arch/tile/mm/init.c
+++ b/arch/tile/mm/init.c
@@ -828,10 +828,6 @@ void __init mem_init(void)
         printk(KERN_DEBUG "  PKMAP   %#lx - %#lx\n",
                PKMAP_BASE, PKMAP_ADDR(LAST_PKMAP) - 1);
 #endif
-#ifdef CONFIG_HUGEVMAP
-        printk(KERN_DEBUG "  HUGEMAP %#lx - %#lx\n",
-               HUGE_VMAP_BASE, HUGE_VMAP_END - 1);
-#endif
         printk(KERN_DEBUG "  VMALLOC %#lx - %#lx\n",
                _VMALLOC_START, _VMALLOC_END - 1);
 #ifdef __tilegx__
diff --git a/arch/tile/mm/pgtable.c b/arch/tile/mm/pgtable.c
index 2deaddf3e01f..4fd9ec0b58ed 100644
--- a/arch/tile/mm/pgtable.c
+++ b/arch/tile/mm/pgtable.c
@@ -127,8 +127,7 @@ void shatter_huge_page(unsigned long addr)
         }
 
         /* Shatter the huge page into the preallocated L2 page table. */
-        pmd_populate_kernel(&init_mm, pmd,
-                            get_prealloc_pte(pte_pfn(*(pte_t *)pmd)));
+        pmd_populate_kernel(&init_mm, pmd, get_prealloc_pte(pmd_pfn(*pmd)));
 
 #ifdef __PAGETABLE_PMD_FOLDED
         /* Walk every pgd on the system and update the pmd there. */
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index e241a1930c98..ee2fb9d37745 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -481,11 +481,12 @@ config X86_INTEL_LPSS
         bool "Intel Low Power Subsystem Support"
         depends on ACPI
         select COMMON_CLK
+        select PINCTRL
         ---help---
           Select to build support for Intel Low Power Subsystem such as
           found on Intel Lynxpoint PCH. Selecting this option enables
-          things like clock tree (common clock framework) which are needed
-          by the LPSS peripheral drivers.
+          things like clock tree (common clock framework) and pincontrol
+          which are needed by the LPSS peripheral drivers.
 
 config X86_RDC321X
         bool "RDC R-321x SoC"
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index c62d88396ad5..9db76c31b3c3 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -899,8 +899,8 @@ static __initconst const u64 atom_hw_cache_event_ids
 static struct extra_reg intel_slm_extra_regs[] __read_mostly =
 {
         /* must define OFFCORE_RSP_X first, see intel_fixup_er() */
-        INTEL_UEVENT_EXTRA_REG(0x01b7, MSR_OFFCORE_RSP_0, 0x768005ffff, RSP_0),
-        INTEL_UEVENT_EXTRA_REG(0x02b7, MSR_OFFCORE_RSP_1, 0x768005ffff, RSP_1),
+        INTEL_UEVENT_EXTRA_REG(0x01b7, MSR_OFFCORE_RSP_0, 0x768005ffffull, RSP_0),
+        INTEL_UEVENT_EXTRA_REG(0x02b7, MSR_OFFCORE_RSP_1, 0x768005ffffull, RSP_1),
         EVENT_EXTRA_END
 };
 
diff --git a/arch/x86/kernel/cpu/perf_event_intel_ds.c b/arch/x86/kernel/cpu/perf_event_intel_ds.c
index 63438aad177f..ab3ba1c1b7dd 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c
@@ -584,6 +584,7 @@ struct event_constraint intel_snb_pebs_event_constraints[] = {
         INTEL_EVENT_CONSTRAINT(0xd0, 0xf),    /* MEM_UOP_RETIRED.* */
         INTEL_EVENT_CONSTRAINT(0xd1, 0xf),    /* MEM_LOAD_UOPS_RETIRED.* */
         INTEL_EVENT_CONSTRAINT(0xd2, 0xf),    /* MEM_LOAD_UOPS_LLC_HIT_RETIRED.* */
+        INTEL_EVENT_CONSTRAINT(0xd3, 0xf),    /* MEM_LOAD_UOPS_LLC_MISS_RETIRED.* */
         INTEL_UEVENT_CONSTRAINT(0x02d4, 0xf), /* MEM_LOAD_UOPS_MISC_RETIRED.LLC_MISS */
         EVENT_CONSTRAINT_END
 };
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index 1b69951a81e2..b077f4cc225a 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -487,21 +487,6 @@ ENDPROC(native_usergs_sysret64)
         TRACE_IRQS_OFF
         .endm
 
-ENTRY(save_rest)
-        PARTIAL_FRAME 1 (REST_SKIP+8)
-        movq 5*8+16(%rsp), %r11 /* save return address */
-        movq_cfi rbx, RBX+16
-        movq_cfi rbp, RBP+16
-        movq_cfi r12, R12+16
-        movq_cfi r13, R13+16
-        movq_cfi r14, R14+16
-        movq_cfi r15, R15+16
-        movq %r11, 8(%rsp)      /* return address */
-        FIXUP_TOP_OF_STACK %r11, 16
-        ret
-        CFI_ENDPROC
-END(save_rest)
-
 /* save complete stack frame */
         .pushsection .kprobes.text, "ax"
 ENTRY(save_paranoid)
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index aecc98a93d1b..6cacab671f9b 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -653,6 +653,7 @@ static void announce_cpu(int cpu, int apicid)
 {
         static int current_node = -1;
         int node = early_cpu_to_node(cpu);
+        int max_cpu_present = find_last_bit(cpumask_bits(cpu_present_mask), NR_CPUS);
 
         if (system_state == SYSTEM_BOOTING) {
                 if (node != current_node) {
@@ -661,7 +662,7 @@ static void announce_cpu(int cpu, int apicid)
                         current_node = node;
                         pr_info("Booting Node %3d, Processors ", node);
                 }
-                pr_cont(" #%d%s", cpu, cpu == (nr_cpu_ids - 1) ? " OK\n" : "");
+                pr_cont(" #%4d%s", cpu, cpu == max_cpu_present ? " OK\n" : "");
                 return;
         } else
                 pr_info("Booting Node %d Processor %d APIC 0x%x\n",
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index 2bc1e81045b0..ddc3f3d2afdb 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -2025,6 +2025,17 @@ static int em_ret_far(struct x86_emulate_ctxt *ctxt)
         return rc;
 }
 
+static int em_ret_far_imm(struct x86_emulate_ctxt *ctxt)
+{
+        int rc;
+
+        rc = em_ret_far(ctxt);
+        if (rc != X86EMUL_CONTINUE)
+                return rc;
+        rsp_increment(ctxt, ctxt->src.val);
+        return X86EMUL_CONTINUE;
+}
+
 static int em_cmpxchg(struct x86_emulate_ctxt *ctxt)
 {
         /* Save real source value, then compare EAX against destination. */
@@ -3763,7 +3774,8 @@ static const struct opcode opcode_table[256] = {
         G(ByteOp, group11), G(0, group11),
         /* 0xC8 - 0xCF */
         I(Stack | SrcImmU16 | Src2ImmByte, em_enter), I(Stack, em_leave),
-        N, I(ImplicitOps | Stack, em_ret_far),
+        I(ImplicitOps | Stack | SrcImmU16, em_ret_far_imm),
+        I(ImplicitOps | Stack, em_ret_far),
         D(ImplicitOps), DI(SrcImmByte, intn),
         D(ImplicitOps | No64), II(ImplicitOps, em_iret, iret),
         /* 0xD0 - 0xD7 */
diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
index 043330159179..ad75d77999d0 100644
--- a/arch/x86/kvm/paging_tmpl.h
+++ b/arch/x86/kvm/paging_tmpl.h
@@ -99,6 +99,7 @@ struct guest_walker {
         pt_element_t prefetch_ptes[PTE_PREFETCH_NUM];
         gpa_t pte_gpa[PT_MAX_FULL_LEVELS];
         pt_element_t __user *ptep_user[PT_MAX_FULL_LEVELS];
+        bool pte_writable[PT_MAX_FULL_LEVELS];
         unsigned pt_access;
         unsigned pte_access;
         gfn_t gfn;
@@ -235,6 +236,22 @@ static int FNAME(update_accessed_dirty_bits)(struct kvm_vcpu *vcpu,
                 if (pte == orig_pte)
                         continue;
 
+                /*
+                 * If the slot is read-only, simply do not process the accessed
+                 * and dirty bits.  This is the correct thing to do if the slot
+                 * is ROM, and page tables in read-as-ROM/write-as-MMIO slots
+                 * are only supported if the accessed and dirty bits are already
+                 * set in the ROM (so that MMIO writes are never needed).
+                 *
+                 * Note that NPT does not allow this at all and faults, since
+                 * it always wants nested page table entries for the guest
+                 * page tables to be writable.  And EPT works but will simply
+                 * overwrite the read-only memory to set the accessed and dirty
+                 * bits.
+                 */
+                if (unlikely(!walker->pte_writable[level - 1]))
+                        continue;
+
                 ret = FNAME(cmpxchg_gpte)(vcpu, mmu, ptep_user, index, orig_pte, pte);
                 if (ret)
                         return ret;
@@ -309,7 +326,8 @@ retry_walk:
                         goto error;
                 real_gfn = gpa_to_gfn(real_gfn);
 
-                host_addr = gfn_to_hva(vcpu->kvm, real_gfn);
+                host_addr = gfn_to_hva_prot(vcpu->kvm, real_gfn,
+                                            &walker->pte_writable[walker->level - 1]);
                 if (unlikely(kvm_is_error_hva(host_addr)))
                         goto error;
 
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 1f1da43ff2a2..a1216de9ffda 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -5339,6 +5339,15 @@ static int handle_ept_violation(struct kvm_vcpu *vcpu)
                 return 0;
         }
 
+        /*
+         * EPT violation happened while executing iret from NMI,
+         * "blocked by NMI" bit has to be set before next VM entry.
+         * There are errata that may cause this bit to not be set:
+         * AAK134, BY25.
+         */
+        if (exit_qualification & INTR_INFO_UNBLOCK_NMI)
+                vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO, GUEST_INTR_STATE_NMI);
+
         gpa = vmcs_read64(GUEST_PHYSICAL_ADDRESS);
         trace_kvm_page_fault(gpa, exit_qualification);
 
@@ -7766,6 +7775,10 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
                 vmcs_write64(GUEST_PDPTR1, vmcs12->guest_pdptr1);
                 vmcs_write64(GUEST_PDPTR2, vmcs12->guest_pdptr2);
                 vmcs_write64(GUEST_PDPTR3, vmcs12->guest_pdptr3);
+                __clear_bit(VCPU_EXREG_PDPTR,
+                                (unsigned long *)&vcpu->arch.regs_avail);
+                __clear_bit(VCPU_EXREG_PDPTR,
+                                (unsigned long *)&vcpu->arch.regs_dirty);
         }
 
         kvm_register_write(vcpu, VCPU_REGS_RSP, vmcs12->guest_rsp);
diff --git a/drivers/atm/he.c b/drivers/atm/he.c
index 449f6298dc89..8557adcd34ee 100644
--- a/drivers/atm/he.c
+++ b/drivers/atm/he.c
@@ -2865,15 +2865,4 @@ static struct pci_driver he_driver = {
         .id_table =     he_pci_tbl,
 };
 
-static int __init he_init(void)
-{
-        return pci_register_driver(&he_driver);
-}
-
-static void __exit he_cleanup(void)
-{
-        pci_unregister_driver(&he_driver);
-}
-
-module_init(he_init);
-module_exit(he_cleanup);
+module_pci_driver(he_driver);
diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c
index 409502a78e7e..5aca5f4c5458 100644
--- a/drivers/atm/nicstar.c
+++ b/drivers/atm/nicstar.c
@@ -778,7 +778,7 @@ static int ns_init_card(int i, struct pci_dev *pcidev)
                 return error;
         }
 
-        if (mac[i] == NULL || mac_pton(mac[i], card->atmdev->esi)) {
+        if (mac[i] == NULL || !mac_pton(mac[i], card->atmdev->esi)) {
                 nicstar_read_eprom(card->membase, NICSTAR_EPROM_MAC_ADDR_OFFSET,
                                    card->atmdev->esi, 6);
                 if (memcmp(card->atmdev->esi, "\x00\x00\x00\x00\x00\x00", 6) ==
diff --git a/drivers/bcma/host_pci.c b/drivers/bcma/host_pci.c
index a355e63a3838..6fb98b53533f 100644
--- a/drivers/bcma/host_pci.c
+++ b/drivers/bcma/host_pci.c
@@ -188,8 +188,11 @@ static int bcma_host_pci_probe(struct pci_dev *dev,
                 pci_write_config_dword(dev, 0x40, val & 0xffff00ff);
 
         /* SSB needed additional powering up, do we have any AMBA PCI cards? */
-        if (!pci_is_pcie(dev))
-                bcma_err(bus, "PCI card detected, report problems.\n");
+        if (!pci_is_pcie(dev)) {
+                bcma_err(bus, "PCI card detected, they are not supported.\n");
+                err = -ENXIO;
+                goto err_pci_release_regions;
+        }
 
         /* Map MMIO */
         err = -ENOMEM;
@@ -269,6 +272,7 @@ static SIMPLE_DEV_PM_OPS(bcma_pm_ops, bcma_host_pci_suspend,
 
 static DEFINE_PCI_DEVICE_TABLE(bcma_pci_bridge_tbl) = {
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x0576) },
+        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4313) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43224) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4331) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4353) },
diff --git a/drivers/bcma/scan.c b/drivers/bcma/scan.c
index cd6b20fce680..37768401d113 100644
--- a/drivers/bcma/scan.c
+++ b/drivers/bcma/scan.c
@@ -269,6 +269,8 @@ static struct bcma_device *bcma_find_core_reverse(struct bcma_bus *bus, u16 core
         return NULL;
 }
 
+#define IS_ERR_VALUE_U32(x) ((x) >= (u32)-MAX_ERRNO)
+
 static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr,
                               struct bcma_device_id *match, int core_num,
                               struct bcma_device *core)
@@ -351,11 +353,11 @@ static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr,
          * the main register space for the core
          */
         tmp = bcma_erom_get_addr_desc(bus, eromptr, SCAN_ADDR_TYPE_SLAVE, 0);
-        if (tmp == 0 || IS_ERR_VALUE(tmp)) {
+        if (tmp == 0 || IS_ERR_VALUE_U32(tmp)) {
                 /* Try again to see if it is a bridge */
                 tmp = bcma_erom_get_addr_desc(bus, eromptr,
                                               SCAN_ADDR_TYPE_BRIDGE, 0);
-                if (tmp == 0 || IS_ERR_VALUE(tmp)) {
+                if (tmp == 0 || IS_ERR_VALUE_U32(tmp)) {
                         return -EILSEQ;
                 } else {
                         bcma_info(bus, "Bridge found\n");
@@ -369,7 +371,7 @@ static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr,
                 for (j = 0; ; j++) {
                         tmp = bcma_erom_get_addr_desc(bus, eromptr,
                                 SCAN_ADDR_TYPE_SLAVE, i);
-                        if (IS_ERR_VALUE(tmp)) {
+                        if (IS_ERR_VALUE_U32(tmp)) {
                                 /* no more entries for port _i_ */
                                 /* pr_debug("erom: slave port %d "
                                  * "has %d descriptors\n", i, j); */
@@ -386,7 +388,7 @@ static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr,
                 for (j = 0; ; j++) {
                         tmp = bcma_erom_get_addr_desc(bus, eromptr,
                                 SCAN_ADDR_TYPE_MWRAP, i);
-                        if (IS_ERR_VALUE(tmp)) {
+                        if (IS_ERR_VALUE_U32(tmp)) {
                                 /* no more entries for port _i_ */
                                 /* pr_debug("erom: master wrapper %d "
                                  * "has %d descriptors\n", i, j); */
@@ -404,7 +406,7 @@ static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr,
                 for (j = 0; ; j++) {
                         tmp = bcma_erom_get_addr_desc(bus, eromptr,
                                 SCAN_ADDR_TYPE_SWRAP, i + hack);
-                        if (IS_ERR_VALUE(tmp)) {
+                        if (IS_ERR_VALUE_U32(tmp)) {
                                 /* no more entries for port _i_ */
                                 /* pr_debug("erom: master wrapper %d "
                                  * has %d descriptors\n", i, j); */
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index b22a7d0fe5b7..cb1db2979d3d 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -931,12 +931,14 @@ static const char *rbd_dev_v1_snap_name(struct rbd_device *rbd_dev,
                                         u64 snap_id)
 {
         u32 which;
+        const char *snap_name;
 
         which = rbd_dev_snap_index(rbd_dev, snap_id);
         if (which == BAD_SNAP_INDEX)
-                return NULL;
+                return ERR_PTR(-ENOENT);
 
-        return _rbd_dev_v1_snap_name(rbd_dev, which);
+        snap_name = _rbd_dev_v1_snap_name(rbd_dev, which);
+        return snap_name ? snap_name : ERR_PTR(-ENOMEM);
 }
 
 static const char *rbd_snap_name(struct rbd_device *rbd_dev, u64 snap_id)
@@ -2812,7 +2814,7 @@ out_err:
         obj_request_done_set(obj_request);
 }
 
-static int rbd_obj_notify_ack(struct rbd_device *rbd_dev, u64 notify_id)
+static int rbd_obj_notify_ack_sync(struct rbd_device *rbd_dev, u64 notify_id)
 {
         struct rbd_obj_request *obj_request;
         struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc;
@@ -2827,16 +2829,17 @@ static int rbd_obj_notify_ack(struct rbd_device *rbd_dev, u64 notify_id)
         obj_request->osd_req = rbd_osd_req_create(rbd_dev, false, obj_request);
         if (!obj_request->osd_req)
                 goto out;
-        obj_request->callback = rbd_obj_request_put;
 
         osd_req_op_watch_init(obj_request->osd_req, 0, CEPH_OSD_OP_NOTIFY_ACK,
                                         notify_id, 0, 0);
         rbd_osd_req_format_read(obj_request);
 
         ret = rbd_obj_request_submit(osdc, obj_request);
-out:
         if (ret)
-                rbd_obj_request_put(obj_request);
+                goto out;
+        ret = rbd_obj_request_wait(obj_request);
+out:
+        rbd_obj_request_put(obj_request);
 
         return ret;
 }
@@ -2856,7 +2859,7 @@ static void rbd_watch_cb(u64 ver, u64 notify_id, u8 opcode, void *data)
         if (ret)
                 rbd_warn(rbd_dev, "header refresh error (%d)\n", ret);
 
-        rbd_obj_notify_ack(rbd_dev, notify_id);
+        rbd_obj_notify_ack_sync(rbd_dev, notify_id);
 }
 
 /*
@@ -3328,6 +3331,31 @@ static void rbd_exists_validate(struct rbd_device *rbd_dev)
                 clear_bit(RBD_DEV_FLAG_EXISTS, &rbd_dev->flags);
 }
 
+static void rbd_dev_update_size(struct rbd_device *rbd_dev)
+{
+        sector_t size;
+        bool removing;
+
+        /*
+         * Don't hold the lock while doing disk operations,
+         * or lock ordering will conflict with the bdev mutex via:
+         * rbd_add() -> blkdev_get() -> rbd_open()
+         */
+        spin_lock_irq(&rbd_dev->lock);
+        removing = test_bit(RBD_DEV_FLAG_REMOVING, &rbd_dev->flags);
+        spin_unlock_irq(&rbd_dev->lock);
+        /*
+         * If the device is being removed, rbd_dev->disk has
+         * been destroyed, so don't try to update its size
+         */
+        if (!removing) {
+                size = (sector_t)rbd_dev->mapping.size / SECTOR_SIZE;
+                dout("setting size to %llu sectors", (unsigned long long)size);
+                set_capacity(rbd_dev->disk, size);
+                revalidate_disk(rbd_dev->disk);
+        }
+}
+
 static int rbd_dev_refresh(struct rbd_device *rbd_dev)
 {
         u64 mapping_size;
@@ -3347,12 +3375,7 @@ static int rbd_dev_refresh(struct rbd_device *rbd_dev)
         up_write(&rbd_dev->header_rwsem);
 
         if (mapping_size != rbd_dev->mapping.size) {
-                sector_t size;
-
-                size = (sector_t)rbd_dev->mapping.size / SECTOR_SIZE;
-                dout("setting size to %llu sectors", (unsigned long long)size);
-                set_capacity(rbd_dev->disk, size);
-                revalidate_disk(rbd_dev->disk);
+                rbd_dev_update_size(rbd_dev);
         }
 
         return ret;
@@ -4061,8 +4084,13 @@ static u64 rbd_v2_snap_id_by_name(struct rbd_device *rbd_dev, const char *name)
 
                 snap_id = snapc->snaps[which];
                 snap_name = rbd_dev_v2_snap_name(rbd_dev, snap_id);
-                if (IS_ERR(snap_name))
-                        break;
+                if (IS_ERR(snap_name)) {
+                        /* ignore no-longer existing snapshots */
+                        if (PTR_ERR(snap_name) == -ENOENT)
+                                continue;
+                        else
+                                break;
+                }
                 found = !strcmp(name, snap_name);
                 kfree(snap_name);
         }
@@ -4141,8 +4169,8 @@ static int rbd_dev_spec_update(struct rbd_device *rbd_dev)
         /* Look up the snapshot name, and make a copy */
 
         snap_name = rbd_snap_name(rbd_dev, spec->snap_id);
-        if (!snap_name) {
-                ret = -ENOMEM;
+        if (IS_ERR(snap_name)) {
+                ret = PTR_ERR(snap_name);
                 goto out_err;
         }
 
@@ -5163,10 +5191,23 @@ static ssize_t rbd_remove(struct bus_type *bus,
         if (ret < 0 || already)
                 return ret;
 
-        rbd_bus_del_dev(rbd_dev);
         ret = rbd_dev_header_watch_sync(rbd_dev, false);
         if (ret)
                 rbd_warn(rbd_dev, "failed to cancel watch event (%d)\n", ret);
+
+        /*
+         * flush remaining watch callbacks - these must be complete
+         * before the osd_client is shutdown
+         */
+        dout("%s: flushing notifies", __func__);
+        ceph_osdc_flush_notifies(&rbd_dev->rbd_client->client->osdc);
+        /*
+         * Don't free anything from rbd_dev->disk until after all
+         * notifies are completely processed. Otherwise
+         * rbd_bus_del_dev() will race with rbd_watch_cb(), resulting
+         * in a potential use after free of rbd_dev->disk or rbd_dev.
+         */
+        rbd_bus_del_dev(rbd_dev);
         rbd_dev_image_release(rbd_dev);
         module_put(THIS_MODULE);
 
diff --git a/drivers/bluetooth/Makefile b/drivers/bluetooth/Makefile
index 4afae20df512..9fe8a875a827 100644
--- a/drivers/bluetooth/Makefile
+++ b/drivers/bluetooth/Makefile
@@ -30,3 +30,5 @@ hci_uart-$(CONFIG_BT_HCIUART_LL)	+= hci_ll.o
 hci_uart-$(CONFIG_BT_HCIUART_ATH3K)     += hci_ath.o
 hci_uart-$(CONFIG_BT_HCIUART_3WIRE)     += hci_h5.o
 hci_uart-objs                           := $(hci_uart-y)
+
+ccflags-y += -D__CHECK_ENDIAN__
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index a12b923bbaca..0a327f4154a2 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -85,6 +85,7 @@ static struct usb_device_id ath3k_table[] = {
         { USB_DEVICE(0x04CA, 0x3008) },
         { USB_DEVICE(0x13d3, 0x3362) },
         { USB_DEVICE(0x0CF3, 0xE004) },
+        { USB_DEVICE(0x0CF3, 0xE005) },
         { USB_DEVICE(0x0930, 0x0219) },
         { USB_DEVICE(0x0489, 0xe057) },
         { USB_DEVICE(0x13d3, 0x3393) },
@@ -126,6 +127,7 @@ static struct usb_device_id ath3k_blist_tbl[] = {
         { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bluetooth/btmrvl_drv.h b/drivers/bluetooth/btmrvl_drv.h
index 27068d149380..f9d183387f45 100644
--- a/drivers/bluetooth/btmrvl_drv.h
+++ b/drivers/bluetooth/btmrvl_drv.h
@@ -23,6 +23,8 @@
 #include <linux/bitops.h>
 #include <linux/slab.h>
 #include <net/bluetooth/bluetooth.h>
+#include <linux/ctype.h>
+#include <linux/firmware.h>
 
 #define BTM_HEADER_LEN                  4
 #define BTM_UPLD_SIZE                   2312
@@ -41,6 +43,8 @@ struct btmrvl_thread {
 struct btmrvl_device {
         void *card;
         struct hci_dev *hcidev;
+        struct device *dev;
+        const char *cal_data;
 
         u8 dev_type;
 
@@ -91,6 +95,7 @@ struct btmrvl_private {
 #define BT_CMD_HOST_SLEEP_CONFIG        0x59
 #define BT_CMD_HOST_SLEEP_ENABLE        0x5A
 #define BT_CMD_MODULE_CFG_REQ           0x5B
+#define BT_CMD_LOAD_CONFIG_DATA         0x61
 
 /* Sub-commands: Module Bringup/Shutdown Request/Response */
 #define MODULE_BRINGUP_REQ              0xF1
@@ -116,11 +121,8 @@ struct btmrvl_private {
 #define PS_SLEEP                        0x01
 #define PS_AWAKE                        0x00
 
-struct btmrvl_cmd {
-        __le16 ocf_ogf;
-        u8 length;
-        u8 data[4];
-} __packed;
+#define BT_CMD_DATA_SIZE                32
+#define BT_CAL_DATA_SIZE                28
 
 struct btmrvl_event {
         u8 ec;          /* event counter */
diff --git a/drivers/bluetooth/btmrvl_main.c b/drivers/bluetooth/btmrvl_main.c
index 9a9f51875df5..6e7bd4e4adbb 100644
--- a/drivers/bluetooth/btmrvl_main.c
+++ b/drivers/bluetooth/btmrvl_main.c
@@ -57,8 +57,7 @@ bool btmrvl_check_evtpkt(struct btmrvl_private *priv, struct sk_buff *skb)
                 ocf = hci_opcode_ocf(opcode);
                 ogf = hci_opcode_ogf(opcode);
 
-                if (ocf == BT_CMD_MODULE_CFG_REQ &&
-                                        priv->btmrvl_dev.sendcmdflag) {
+                if (priv->btmrvl_dev.sendcmdflag) {
                         priv->btmrvl_dev.sendcmdflag = false;
                         priv->adapter->cmd_complete = true;
                         wake_up_interruptible(&priv->adapter->cmd_wait_q);
@@ -116,7 +115,6 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb)
                         adapter->hs_state = HS_ACTIVATED;
                         if (adapter->psmode)
                                 adapter->ps_state = PS_SLEEP;
-                        wake_up_interruptible(&adapter->cmd_wait_q);
                         BT_DBG("HS ACTIVATED!");
                 } else {
                         BT_DBG("HS Enable failed");
@@ -168,22 +166,24 @@ exit:
 }
 EXPORT_SYMBOL_GPL(btmrvl_process_event);
 
-int btmrvl_send_module_cfg_cmd(struct btmrvl_private *priv, int subcmd)
+static int btmrvl_send_sync_cmd(struct btmrvl_private *priv, u16 cmd_no,
+                                const void *param, u8 len)
 {
         struct sk_buff *skb;
-        struct btmrvl_cmd *cmd;
-        int ret = 0;
+        struct hci_command_hdr *hdr;
 
-        skb = bt_skb_alloc(sizeof(*cmd), GFP_ATOMIC);
+        skb = bt_skb_alloc(HCI_COMMAND_HDR_SIZE + len, GFP_ATOMIC);
         if (skb == NULL) {
                 BT_ERR("No free skb");
                 return -ENOMEM;
         }
 
-        cmd = (struct btmrvl_cmd *) skb_put(skb, sizeof(*cmd));
-        cmd->ocf_ogf = cpu_to_le16(hci_opcode_pack(OGF, BT_CMD_MODULE_CFG_REQ));
-        cmd->length = 1;
-        cmd->data[0] = subcmd;
+        hdr = (struct hci_command_hdr *)skb_put(skb, HCI_COMMAND_HDR_SIZE);
+        hdr->opcode = cpu_to_le16(hci_opcode_pack(OGF, cmd_no));
+        hdr->plen = len;
+
+        if (len)
+                memcpy(skb_put(skb, len), param, len);
 
         bt_cb(skb)->pkt_type = MRVL_VENDOR_PKT;
 
@@ -194,19 +194,23 @@ int btmrvl_send_module_cfg_cmd(struct btmrvl_private *priv, int subcmd)
 
         priv->adapter->cmd_complete = false;
 
-        BT_DBG("Queue module cfg Command");
-
         wake_up_interruptible(&priv->main_thread.wait_q);
 
         if (!wait_event_interruptible_timeout(priv->adapter->cmd_wait_q,
                                 priv->adapter->cmd_complete,
-                                msecs_to_jiffies(WAIT_UNTIL_CMD_RESP))) {
-                ret = -ETIMEDOUT;
-                BT_ERR("module_cfg_cmd(%x): timeout: %d",
-                                        subcmd, priv->btmrvl_dev.sendcmdflag);
-        }
+                                msecs_to_jiffies(WAIT_UNTIL_CMD_RESP)))
+                return -ETIMEDOUT;
 
-        BT_DBG("module cfg Command done");
+        return 0;
+}
+
+int btmrvl_send_module_cfg_cmd(struct btmrvl_private *priv, int subcmd)
+{
+        int ret;
+
+        ret = btmrvl_send_sync_cmd(priv, BT_CMD_MODULE_CFG_REQ, &subcmd, 1);
+        if (ret)
+                BT_ERR("module_cfg_cmd(%x) failed\n", subcmd);
 
         return ret;
 }
@@ -214,61 +218,36 @@ EXPORT_SYMBOL_GPL(btmrvl_send_module_cfg_cmd);
 
 int btmrvl_send_hscfg_cmd(struct btmrvl_private *priv)
 {
-        struct sk_buff *skb;
-        struct btmrvl_cmd *cmd;
-
-        skb = bt_skb_alloc(sizeof(*cmd), GFP_ATOMIC);
-        if (!skb) {
-                BT_ERR("No free skb");
-                return -ENOMEM;
-        }
-
-        cmd = (struct btmrvl_cmd *) skb_put(skb, sizeof(*cmd));
-        cmd->ocf_ogf = cpu_to_le16(hci_opcode_pack(OGF,
-                                                   BT_CMD_HOST_SLEEP_CONFIG));
-        cmd->length = 2;
-        cmd->data[0] = (priv->btmrvl_dev.gpio_gap & 0xff00) >> 8;
-        cmd->data[1] = (u8) (priv->btmrvl_dev.gpio_gap & 0x00ff);
+        int ret;
+        u8 param[2];
 
-        bt_cb(skb)->pkt_type = MRVL_VENDOR_PKT;
+        param[0] = (priv->btmrvl_dev.gpio_gap & 0xff00) >> 8;
+        param[1] = (u8) (priv->btmrvl_dev.gpio_gap & 0x00ff);
 
-        skb->dev = (void *) priv->btmrvl_dev.hcidev;
-        skb_queue_head(&priv->adapter->tx_queue, skb);
+        BT_DBG("Sending HSCFG Command, gpio=0x%x, gap=0x%x",
+               param[0], param[1]);
 
-        BT_DBG("Queue HSCFG Command, gpio=0x%x, gap=0x%x", cmd->data[0],
-               cmd->data[1]);
+        ret = btmrvl_send_sync_cmd(priv, BT_CMD_HOST_SLEEP_CONFIG, param, 2);
+        if (ret)
+                BT_ERR("HSCFG command failed\n");
 
-        return 0;
+        return ret;
 }
 EXPORT_SYMBOL_GPL(btmrvl_send_hscfg_cmd);
 
 int btmrvl_enable_ps(struct btmrvl_private *priv)
 {
-        struct sk_buff *skb;
-        struct btmrvl_cmd *cmd;
-
-        skb = bt_skb_alloc(sizeof(*cmd), GFP_ATOMIC);
-        if (skb == NULL) {
-                BT_ERR("No free skb");
-                return -ENOMEM;
-        }
-
-        cmd = (struct btmrvl_cmd *) skb_put(skb, sizeof(*cmd));
-        cmd->ocf_ogf = cpu_to_le16(hci_opcode_pack(OGF,
-                                        BT_CMD_AUTO_SLEEP_MODE));
-        cmd->length = 1;
+        int ret;
+        u8 param;
 
         if (priv->btmrvl_dev.psmode)
-                cmd->data[0] = BT_PS_ENABLE;
+                param = BT_PS_ENABLE;
         else
-                cmd->data[0] = BT_PS_DISABLE;
-
-        bt_cb(skb)->pkt_type = MRVL_VENDOR_PKT;
+                param = BT_PS_DISABLE;
 
-        skb->dev = (void *) priv->btmrvl_dev.hcidev;
-        skb_queue_head(&priv->adapter->tx_queue, skb);
-
-        BT_DBG("Queue PSMODE Command:%d", cmd->data[0]);
+        ret = btmrvl_send_sync_cmd(priv, BT_CMD_AUTO_SLEEP_MODE, &param, 1);
+        if (ret)
+                BT_ERR("PSMODE command failed\n");
 
         return 0;
 }
@@ -276,37 +255,11 @@ EXPORT_SYMBOL_GPL(btmrvl_enable_ps);
 
 int btmrvl_enable_hs(struct btmrvl_private *priv)
 {
-        struct sk_buff *skb;
-        struct btmrvl_cmd *cmd;
-        int ret = 0;
-
-        skb = bt_skb_alloc(sizeof(*cmd), GFP_ATOMIC);
-        if (skb == NULL) {
-                BT_ERR("No free skb");
-                return -ENOMEM;
-        }
-
-        cmd = (struct btmrvl_cmd *) skb_put(skb, sizeof(*cmd));
-        cmd->ocf_ogf = cpu_to_le16(hci_opcode_pack(OGF, BT_CMD_HOST_SLEEP_ENABLE));
-        cmd->length = 0;
-
-        bt_cb(skb)->pkt_type = MRVL_VENDOR_PKT;
-
-        skb->dev = (void *) priv->btmrvl_dev.hcidev;
-        skb_queue_head(&priv->adapter->tx_queue, skb);
-
-        BT_DBG("Queue hs enable Command");
-
-        wake_up_interruptible(&priv->main_thread.wait_q);
+        int ret;
 
-        if (!wait_event_interruptible_timeout(priv->adapter->cmd_wait_q,
-                        priv->adapter->hs_state,
-                        msecs_to_jiffies(WAIT_UNTIL_HS_STATE_CHANGED))) {
-                ret = -ETIMEDOUT;
-                BT_ERR("timeout: %d, %d,%d", priv->adapter->hs_state,
-                                                priv->adapter->ps_state,
-                                                priv->adapter->wakeup_tries);
-        }
+        ret = btmrvl_send_sync_cmd(priv, BT_CMD_HOST_SLEEP_ENABLE, NULL, 0);
+        if (ret)
+                BT_ERR("Host sleep enable command failed\n");
 
         return ret;
 }
@@ -480,6 +433,137 @@ static int btmrvl_open(struct hci_dev *hdev)
 }
 
 /*
+ * This function parses provided calibration data input. It should contain
+ * hex bytes separated by space or new line character. Here is an example.
+ * 00 1C 01 37 FF FF FF FF 02 04 7F 01
+ * CE BA 00 00 00 2D C6 C0 00 00 00 00
+ * 00 F0 00 00
+ */
+static int btmrvl_parse_cal_cfg(const u8 *src, u32 len, u8 *dst, u32 dst_size)
+{
+        const u8 *s = src;
+        u8 *d = dst;
+        int ret;
+        u8 tmp[3];
+
+        tmp[2] = '\0';
+        while ((s - src) <= len - 2) {
+                if (isspace(*s)) {
+                        s++;
+                        continue;
+                }
+
+                if (isxdigit(*s)) {
+                        if ((d - dst) >= dst_size) {
+                                BT_ERR("calibration data file too big!!!");
+                                return -EINVAL;
+                        }
+
+                        memcpy(tmp, s, 2);
+
+                        ret = kstrtou8(tmp, 16, d++);
+                        if (ret < 0)
+                                return ret;
+
+                        s += 2;
+                } else {
+                        return -EINVAL;
+                }
+        }
+        if (d == dst)
+                return -EINVAL;
+
+        return 0;
+}
+
+static int btmrvl_load_cal_data(struct btmrvl_private *priv,
+                                u8 *config_data)
+{
+        int i, ret;
+        u8 data[BT_CMD_DATA_SIZE];
+
+        data[0] = 0x00;
+        data[1] = 0x00;
+        data[2] = 0x00;
+        data[3] = BT_CMD_DATA_SIZE - 4;
+
+        /* Swap cal-data bytes. Each four bytes are swapped. Considering 4
+         * byte SDIO header offset, mapping of input and output bytes will be
+         * {3, 2, 1, 0} -> {0+4, 1+4, 2+4, 3+4},
+         * {7, 6, 5, 4} -> {4+4, 5+4, 6+4, 7+4} */
+        for (i = 4; i < BT_CMD_DATA_SIZE; i++)
+                data[i] = config_data[(i / 4) * 8 - 1 - i];
+
+        print_hex_dump_bytes("Calibration data: ",
+                             DUMP_PREFIX_OFFSET, data, BT_CMD_DATA_SIZE);
+
+        ret = btmrvl_send_sync_cmd(priv, BT_CMD_LOAD_CONFIG_DATA, data,
+                                   BT_CMD_DATA_SIZE);
+        if (ret)
+                BT_ERR("Failed to download caibration data\n");
+
+        return 0;
+}
+
+static int
+btmrvl_process_cal_cfg(struct btmrvl_private *priv, u8 *data, u32 size)
+{
+        u8 cal_data[BT_CAL_DATA_SIZE];
+        int ret;
+
+        ret = btmrvl_parse_cal_cfg(data, size, cal_data, sizeof(cal_data));
+        if (ret)
+                return ret;
+
+        ret = btmrvl_load_cal_data(priv, cal_data);
+        if (ret) {
+                BT_ERR("Fail to load calibrate data");
+                return ret;
+        }
+
+        return 0;
+}
+
+static int btmrvl_cal_data_config(struct btmrvl_private *priv)
+{
+        const struct firmware *cfg;
+        int ret;
+        const char *cal_data = priv->btmrvl_dev.cal_data;
+
+        if (!cal_data)
+                return 0;
+
+        ret = request_firmware(&cfg, cal_data, priv->btmrvl_dev.dev);
+        if (ret < 0) {
+                BT_DBG("Failed to get %s file, skipping cal data download",
+                       cal_data);
+                return 0;
+        }
+
+        ret = btmrvl_process_cal_cfg(priv, (u8 *)cfg->data, cfg->size);
+        release_firmware(cfg);
+        return ret;
+}
+
+static int btmrvl_setup(struct hci_dev *hdev)
+{
+        struct btmrvl_private *priv = hci_get_drvdata(hdev);
+
+        btmrvl_send_module_cfg_cmd(priv, MODULE_BRINGUP_REQ);
+
+        if (btmrvl_cal_data_config(priv))
+                BT_ERR("Set cal data failed");
+
+        priv->btmrvl_dev.psmode = 1;
+        btmrvl_enable_ps(priv);
+
+        priv->btmrvl_dev.gpio_gap = 0xffff;
+        btmrvl_send_hscfg_cmd(priv);
+
+        return 0;
+}
+
+/*
  * This function handles the event generated by firmware, rx data
  * received from firmware, and tx data sent from kernel.
  */
@@ -572,8 +656,7 @@ int btmrvl_register_hdev(struct btmrvl_private *priv)
         hdev->flush = btmrvl_flush;
         hdev->send = btmrvl_send_frame;
         hdev->ioctl = btmrvl_ioctl;
-
-        btmrvl_send_module_cfg_cmd(priv, MODULE_BRINGUP_REQ);
+        hdev->setup = btmrvl_setup;
 
         hdev->dev_type = priv->btmrvl_dev.dev_type;
 
diff --git a/drivers/bluetooth/btmrvl_sdio.c b/drivers/bluetooth/btmrvl_sdio.c
index 00da6df9f71e..332475e400cf 100644
--- a/drivers/bluetooth/btmrvl_sdio.c
+++ b/drivers/bluetooth/btmrvl_sdio.c
@@ -18,7 +18,6 @@
  * this warranty disclaimer.
  **/
 
-#include <linux/firmware.h>
 #include <linux/slab.h>
 
 #include <linux/mmc/sdio_ids.h>
@@ -102,6 +101,7 @@ static const struct btmrvl_sdio_card_reg btmrvl_reg_88xx = {
 static const struct btmrvl_sdio_device btmrvl_sdio_sd8688 = {
         .helper         = "mrvl/sd8688_helper.bin",
         .firmware       = "mrvl/sd8688.bin",
+        .cal_data       = NULL,
         .reg            = &btmrvl_reg_8688,
         .sd_blksz_fw_dl = 64,
 };
@@ -109,6 +109,7 @@ static const struct btmrvl_sdio_device btmrvl_sdio_sd8688 = {
 static const struct btmrvl_sdio_device btmrvl_sdio_sd8787 = {
         .helper         = NULL,
         .firmware       = "mrvl/sd8787_uapsta.bin",
+        .cal_data       = NULL,
         .reg            = &btmrvl_reg_87xx,
         .sd_blksz_fw_dl = 256,
 };
@@ -116,6 +117,7 @@ static const struct btmrvl_sdio_device btmrvl_sdio_sd8787 = {
 static const struct btmrvl_sdio_device btmrvl_sdio_sd8797 = {
         .helper         = NULL,
         .firmware       = "mrvl/sd8797_uapsta.bin",
+        .cal_data       = "mrvl/sd8797_caldata.conf",
         .reg            = &btmrvl_reg_87xx,
         .sd_blksz_fw_dl = 256,
 };
@@ -123,6 +125,7 @@ static const struct btmrvl_sdio_device btmrvl_sdio_sd8797 = {
 static const struct btmrvl_sdio_device btmrvl_sdio_sd8897 = {
         .helper         = NULL,
         .firmware       = "mrvl/sd8897_uapsta.bin",
+        .cal_data       = NULL,
         .reg            = &btmrvl_reg_88xx,
         .sd_blksz_fw_dl = 256,
 };
@@ -1006,6 +1009,7 @@ static int btmrvl_sdio_probe(struct sdio_func *func,
                 struct btmrvl_sdio_device *data = (void *) id->driver_data;
                 card->helper = data->helper;
                 card->firmware = data->firmware;
+                card->cal_data = data->cal_data;
                 card->reg = data->reg;
                 card->sd_blksz_fw_dl = data->sd_blksz_fw_dl;
         }
@@ -1034,6 +1038,8 @@ static int btmrvl_sdio_probe(struct sdio_func *func,
         }
 
         card->priv = priv;
+        priv->btmrvl_dev.dev = &card->func->dev;
+        priv->btmrvl_dev.cal_data = card->cal_data;
 
         /* Initialize the interface specific function pointers */
         priv->hw_host_to_card = btmrvl_sdio_host_to_card;
@@ -1046,12 +1052,6 @@ static int btmrvl_sdio_probe(struct sdio_func *func,
                 goto disable_host_int;
         }
 
-        priv->btmrvl_dev.psmode = 1;
-        btmrvl_enable_ps(priv);
-
-        priv->btmrvl_dev.gpio_gap = 0xffff;
-        btmrvl_send_hscfg_cmd(priv);
-
         return 0;
 
 disable_host_int:
@@ -1222,4 +1222,5 @@ MODULE_FIRMWARE("mrvl/sd8688_helper.bin");
 MODULE_FIRMWARE("mrvl/sd8688.bin");
 MODULE_FIRMWARE("mrvl/sd8787_uapsta.bin");
 MODULE_FIRMWARE("mrvl/sd8797_uapsta.bin");
+MODULE_FIRMWARE("mrvl/sd8797_caldata.conf");
 MODULE_FIRMWARE("mrvl/sd8897_uapsta.bin");
diff --git a/drivers/bluetooth/btmrvl_sdio.h b/drivers/bluetooth/btmrvl_sdio.h
index 43d35a609ca9..6872d9ecac07 100644
--- a/drivers/bluetooth/btmrvl_sdio.h
+++ b/drivers/bluetooth/btmrvl_sdio.h
@@ -85,6 +85,7 @@ struct btmrvl_sdio_card {
         u32 ioport;
         const char *helper;
         const char *firmware;
+        const char *cal_data;
         const struct btmrvl_sdio_card_reg *reg;
         u16 sd_blksz_fw_dl;
         u8 rx_unit;
@@ -94,6 +95,7 @@ struct btmrvl_sdio_card {
 struct btmrvl_sdio_device {
         const char *helper;
         const char *firmware;
+        const char *cal_data;
         const struct btmrvl_sdio_card_reg *reg;
         u16 sd_blksz_fw_dl;
 };
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 8e16f0af6358..f3dfc0a88fdc 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -102,6 +102,7 @@ static struct usb_device_id btusb_table[] = {
 
         /* Broadcom BCM20702A0 */
         { USB_DEVICE(0x0b05, 0x17b5) },
+        { USB_DEVICE(0x0b05, 0x17cb) },
         { USB_DEVICE(0x04ca, 0x2003) },
         { USB_DEVICE(0x0489, 0xe042) },
         { USB_DEVICE(0x413c, 0x8197) },
@@ -112,6 +113,9 @@ static struct usb_device_id btusb_table[] = {
         /*Broadcom devices with vendor specific id */
         { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01) },
 
+        /* Belkin F8065bf - Broadcom based */
+        { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01) },
+
         { }     /* Terminating entry */
 };
 
@@ -148,6 +152,7 @@ static struct usb_device_id blacklist_table[] = {
         { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c
index d8b7aed6e4a9..c04a3e6fb37c 100644
--- a/drivers/bluetooth/hci_vhci.c
+++ b/drivers/bluetooth/hci_vhci.c
@@ -24,6 +24,7 @@
  */
 
 #include <linux/module.h>
+#include <asm/unaligned.h>
 
 #include <linux/kernel.h>
 #include <linux/init.h>
@@ -39,17 +40,17 @@
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
 
-#define VERSION "1.3"
+#define VERSION "1.4"
 
 static bool amp;
 
 struct vhci_data {
         struct hci_dev *hdev;
 
-        unsigned long flags;
-
         wait_queue_head_t read_wait;
         struct sk_buff_head readq;
+
+        struct delayed_work open_timeout;
 };
 
 static int vhci_open_dev(struct hci_dev *hdev)
@@ -99,16 +100,62 @@ static int vhci_send_frame(struct sk_buff *skb)
         skb_queue_tail(&data->readq, skb);
 
         wake_up_interruptible(&data->read_wait);
+        return 0;
+}
+
+static int vhci_create_device(struct vhci_data *data, __u8 dev_type)
+{
+        struct hci_dev *hdev;
+        struct sk_buff *skb;
+
+        skb = bt_skb_alloc(4, GFP_KERNEL);
+        if (!skb)
+                return -ENOMEM;
+
+        hdev = hci_alloc_dev();
+        if (!hdev) {
+                kfree_skb(skb);
+                return -ENOMEM;
+        }
+
+        data->hdev = hdev;
+
+        hdev->bus = HCI_VIRTUAL;
+        hdev->dev_type = dev_type;
+        hci_set_drvdata(hdev, data);
+
+        hdev->open  = vhci_open_dev;
+        hdev->close = vhci_close_dev;
+        hdev->flush = vhci_flush;
+        hdev->send  = vhci_send_frame;
 
+        if (hci_register_dev(hdev) < 0) {
+                BT_ERR("Can't register HCI device");
+                hci_free_dev(hdev);
+                data->hdev = NULL;
+                kfree_skb(skb);
+                return -EBUSY;
+        }
+
+        bt_cb(skb)->pkt_type = HCI_VENDOR_PKT;
+
+        *skb_put(skb, 1) = 0xff;
+        *skb_put(skb, 1) = dev_type;
+        put_unaligned_le16(hdev->id, skb_put(skb, 2));
+        skb_queue_tail(&data->readq, skb);
+
+        wake_up_interruptible(&data->read_wait);
         return 0;
 }
 
 static inline ssize_t vhci_get_user(struct vhci_data *data,
-                                        const char __user *buf, size_t count)
+                                    const char __user *buf, size_t count)
 {
         struct sk_buff *skb;
+        __u8 pkt_type, dev_type;
+        int ret;
 
-        if (count > HCI_MAX_FRAME_SIZE)
+        if (count < 2 || count > HCI_MAX_FRAME_SIZE)
                 return -EINVAL;
 
         skb = bt_skb_alloc(count, GFP_KERNEL);
@@ -120,27 +167,70 @@ static inline ssize_t vhci_get_user(struct vhci_data *data,
                 return -EFAULT;
         }
 
-        skb->dev = (void *) data->hdev;
-        bt_cb(skb)->pkt_type = *((__u8 *) skb->data);
+        pkt_type = *((__u8 *) skb->data);
         skb_pull(skb, 1);
 
-        hci_recv_frame(skb);
+        switch (pkt_type) {
+        case HCI_EVENT_PKT:
+        case HCI_ACLDATA_PKT:
+        case HCI_SCODATA_PKT:
+                if (!data->hdev) {
+                        kfree_skb(skb);
+                        return -ENODEV;
+                }
+
+                skb->dev = (void *) data->hdev;
+                bt_cb(skb)->pkt_type = pkt_type;
+
+                ret = hci_recv_frame(skb);
+                break;
+
+        case HCI_VENDOR_PKT:
+                if (data->hdev) {
+                        kfree_skb(skb);
+                        return -EBADFD;
+                }
 
-        return count;
+                cancel_delayed_work_sync(&data->open_timeout);
+
+                dev_type = *((__u8 *) skb->data);
+                skb_pull(skb, 1);
+
+                if (skb->len > 0) {
+                        kfree_skb(skb);
+                        return -EINVAL;
+                }
+
+                kfree_skb(skb);
+
+                if (dev_type != HCI_BREDR && dev_type != HCI_AMP)
+                        return -EINVAL;
+
+                ret = vhci_create_device(data, dev_type);
+                break;
+
+        default:
+                kfree_skb(skb);
+                return -EINVAL;
+        }
+
+        return (ret < 0) ? ret : count;
 }
 
 static inline ssize_t vhci_put_user(struct vhci_data *data,
-                        struct sk_buff *skb, char __user *buf, int count)
+                                    struct sk_buff *skb,
+                                    char __user *buf, int count)
 {
         char __user *ptr = buf;
-        int len, total = 0;
+        int len;
 
         len = min_t(unsigned int, skb->len, count);
 
         if (copy_to_user(ptr, skb->data, len))
                 return -EFAULT;
 
-        total += len;
+        if (!data->hdev)
+                return len;
 
         data->hdev->stat.byte_tx += len;
 
@@ -148,21 +238,19 @@ static inline ssize_t vhci_put_user(struct vhci_data *data,
         case HCI_COMMAND_PKT:
                 data->hdev->stat.cmd_tx++;
                 break;
-
         case HCI_ACLDATA_PKT:
                 data->hdev->stat.acl_tx++;
                 break;
-
         case HCI_SCODATA_PKT:
                 data->hdev->stat.sco_tx++;
                 break;
         }
 
-        return total;
+        return len;
 }
 
 static ssize_t vhci_read(struct file *file,
-                                char __user *buf, size_t count, loff_t *pos)
+                         char __user *buf, size_t count, loff_t *pos)
 {
         struct vhci_data *data = file->private_data;
         struct sk_buff *skb;
@@ -185,7 +273,7 @@ static ssize_t vhci_read(struct file *file,
                 }
 
                 ret = wait_event_interruptible(data->read_wait,
-                                        !skb_queue_empty(&data->readq));
+                                               !skb_queue_empty(&data->readq));
                 if (ret < 0)
                         break;
         }
@@ -194,7 +282,7 @@ static ssize_t vhci_read(struct file *file,
 }
 
 static ssize_t vhci_write(struct file *file,
-                        const char __user *buf, size_t count, loff_t *pos)
+                          const char __user *buf, size_t count, loff_t *pos)
 {
         struct vhci_data *data = file->private_data;
 
@@ -213,10 +301,17 @@ static unsigned int vhci_poll(struct file *file, poll_table *wait)
         return POLLOUT | POLLWRNORM;
 }
 
+static void vhci_open_timeout(struct work_struct *work)
+{
+        struct vhci_data *data = container_of(work, struct vhci_data,
+                                              open_timeout.work);
+
+        vhci_create_device(data, amp ? HCI_AMP : HCI_BREDR);
+}
+
 static int vhci_open(struct inode *inode, struct file *file)
 {
         struct vhci_data *data;
-        struct hci_dev *hdev;
 
         data = kzalloc(sizeof(struct vhci_data), GFP_KERNEL);
         if (!data)
@@ -225,35 +320,13 @@ static int vhci_open(struct inode *inode, struct file *file)
         skb_queue_head_init(&data->readq);
         init_waitqueue_head(&data->read_wait);
 
-        hdev = hci_alloc_dev();
-        if (!hdev) {
-                kfree(data);
-                return -ENOMEM;
-        }
-
-        data->hdev = hdev;
-
-        hdev->bus = HCI_VIRTUAL;
-        hci_set_drvdata(hdev, data);
-
-        if (amp)
-                hdev->dev_type = HCI_AMP;
-
-        hdev->open     = vhci_open_dev;
-        hdev->close    = vhci_close_dev;
-        hdev->flush    = vhci_flush;
-        hdev->send     = vhci_send_frame;
-
-        if (hci_register_dev(hdev) < 0) {
-                BT_ERR("Can't register HCI device");
-                kfree(data);
-                hci_free_dev(hdev);
-                return -EBUSY;
-        }
+        INIT_DELAYED_WORK(&data->open_timeout, vhci_open_timeout);
 
         file->private_data = data;
         nonseekable_open(inode, file);
 
+        schedule_delayed_work(&data->open_timeout, msecs_to_jiffies(1000));
+
         return 0;
 }
 
@@ -262,8 +335,12 @@ static int vhci_release(struct inode *inode, struct file *file)
         struct vhci_data *data = file->private_data;
         struct hci_dev *hdev = data->hdev;
 
-        hci_unregister_dev(hdev);
-        hci_free_dev(hdev);
+        cancel_delayed_work_sync(&data->open_timeout);
+
+        if (hdev) {
+                hci_unregister_dev(hdev);
+                hci_free_dev(hdev);
+        }
 
         file->private_data = NULL;
         kfree(data);
@@ -309,3 +386,4 @@ MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
 MODULE_DESCRIPTION("Bluetooth virtual HCI driver ver " VERSION);
 MODULE_VERSION(VERSION);
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("devname:vhci");
diff --git a/drivers/gpu/drm/ast/ast_drv.h b/drivers/gpu/drm/ast/ast_drv.h
index 796dbb212a41..8492b68e873c 100644
--- a/drivers/gpu/drm/ast/ast_drv.h
+++ b/drivers/gpu/drm/ast/ast_drv.h
@@ -177,7 +177,7 @@ uint8_t ast_get_index_reg_mask(struct ast_private *ast,
 
 static inline void ast_open_key(struct ast_private *ast)
 {
-        ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xA1, 0xFF, 0x04);
+        ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0x80, 0xA8);
 }
 
 #define AST_VIDMEM_SIZE_8M    0x00800000
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 3d13ca6e257f..f6f6cc7fc133 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -416,6 +416,14 @@ static void drm_fb_helper_dpms(struct fb_info *info, int dpms_mode)
                 return;
 
         /*
+         * fbdev->blank can be called from irq context in case of a panic.
+         * Since we already have our own special panic handler which will
+         * restore the fbdev console mode completely, just bail out early.
+         */
+        if (oops_in_progress)
+                return;
+
+        /*
          * For each CRTC in this fb, turn the connectors on/off.
          */
         drm_modeset_lock_all(dev);
diff --git a/drivers/gpu/drm/nouveau/core/subdev/bios/init.c b/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
index 2e11ea02cf87..57cda2a1437b 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
@@ -579,8 +579,22 @@ static void
 init_reserved(struct nvbios_init *init)
 {
         u8 opcode = nv_ro08(init->bios, init->offset);
-        trace("RESERVED\t0x%02x\n", opcode);
-        init->offset += 1;
+        u8 length, i;
+
+        switch (opcode) {
+        case 0xaa:
+                length = 4;
+                break;
+        default:
+                length = 1;
+                break;
+        }
+
+        trace("RESERVED 0x%02x\t", opcode);
+        for (i = 1; i < length; i++)
+                cont(" 0x%02x", nv_ro08(init->bios, init->offset + i));
+        cont("\n");
+        init->offset += length;
 }
 
 /**
@@ -1437,7 +1451,7 @@ init_configure_mem(struct nvbios_init *init)
         data = init_rdvgai(init, 0x03c4, 0x01);
         init_wrvgai(init, 0x03c4, 0x01, data | 0x20);
 
-        while ((addr = nv_ro32(bios, sdata)) != 0xffffffff) {
+        for (; (addr = nv_ro32(bios, sdata)) != 0xffffffff; sdata += 4) {
                 switch (addr) {
                 case 0x10021c: /* CKE_NORMAL */
                 case 0x1002d0: /* CMD_REFRESH */
@@ -2135,6 +2149,7 @@ static struct nvbios_init_opcode {
         [0x99] = { init_zm_auxch },
         [0x9a] = { init_i2c_long_if },
         [0xa9] = { init_gpio_ne },
+        [0xaa] = { init_reserved },
 };
 
 #define init_opcode_nr (sizeof(init_opcode) / sizeof(init_opcode[0]))
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index d2712e6e5d31..7848590f5568 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -278,7 +278,6 @@ nouveau_display_create(struct drm_device *dev)
 {
         struct nouveau_drm *drm = nouveau_drm(dev);
         struct nouveau_display *disp;
-        u32 pclass = dev->pdev->class >> 8;
         int ret, gen;
 
         disp = drm->display = kzalloc(sizeof(*disp), GFP_KERNEL);
@@ -340,29 +339,25 @@ nouveau_display_create(struct drm_device *dev)
         drm_kms_helper_poll_init(dev);
         drm_kms_helper_poll_disable(dev);
 
-        if (nouveau_modeset == 1 ||
-            (nouveau_modeset < 0 && pclass == PCI_CLASS_DISPLAY_VGA)) {
-                if (drm->vbios.dcb.entries) {
-                        if (nv_device(drm->device)->card_type < NV_50)
-                                ret = nv04_display_create(dev);
-                        else
-                                ret = nv50_display_create(dev);
-                } else {
-                        ret = 0;
-                }
-
-                if (ret)
-                        goto disp_create_err;
+        if (drm->vbios.dcb.entries) {
+                if (nv_device(drm->device)->card_type < NV_50)
+                        ret = nv04_display_create(dev);
+                else
+                        ret = nv50_display_create(dev);
+        } else {
+                ret = 0;
+        }
 
-                if (dev->mode_config.num_crtc) {
-                        ret = drm_vblank_init(dev, dev->mode_config.num_crtc);
-                        if (ret)
-                                goto vblank_err;
-                }
+        if (ret)
+                goto disp_create_err;
 
-                nouveau_backlight_init(dev);
+        if (dev->mode_config.num_crtc) {
+                ret = drm_vblank_init(dev, dev->mode_config.num_crtc);
+                if (ret)
+                        goto vblank_err;
         }
 
+        nouveau_backlight_init(dev);
         return 0;
 
 vblank_err:
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index 8f6d63d7edd3..a86ecf65c164 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -454,7 +454,8 @@ nouveau_fbcon_init(struct drm_device *dev)
         int preferred_bpp;
         int ret;
 
-        if (!dev->mode_config.num_crtc)
+        if (!dev->mode_config.num_crtc ||
+            (dev->pdev->class >> 8) != PCI_CLASS_DISPLAY_VGA)
                 return 0;
 
         fbcon = kzalloc(sizeof(struct nouveau_fbdev), GFP_KERNEL);
diff --git a/drivers/gpu/drm/nouveau/nouveau_sgdma.c b/drivers/gpu/drm/nouveau/nouveau_sgdma.c
index ca5492ac2da5..0843ebc910d4 100644
--- a/drivers/gpu/drm/nouveau/nouveau_sgdma.c
+++ b/drivers/gpu/drm/nouveau/nouveau_sgdma.c
@@ -104,9 +104,7 @@ nouveau_sgdma_create_ttm(struct ttm_bo_device *bdev,
         else
                 nvbe->ttm.ttm.func = &nv50_sgdma_backend;
 
-        if (ttm_dma_tt_init(&nvbe->ttm, bdev, size, page_flags, dummy_read_page)) {
-                kfree(nvbe);
+        if (ttm_dma_tt_init(&nvbe->ttm, bdev, size, page_flags, dummy_read_page))
                 return NULL;
-        }
         return &nvbe->ttm.ttm;
 }
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
index dfac7965ea28..32923d2f6002 100644
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -707,8 +707,9 @@ atombios_get_encoder_mode(struct drm_encoder *encoder)
         switch (connector->connector_type) {
         case DRM_MODE_CONNECTOR_DVII:
         case DRM_MODE_CONNECTOR_HDMIB: /* HDMI-B is basically DL-DVI; analog works fine */
-                if (drm_detect_hdmi_monitor(radeon_connector->edid) &&
-                    radeon_audio)
+                if ((radeon_connector->audio == RADEON_AUDIO_ENABLE) ||
+                    (drm_detect_hdmi_monitor(radeon_connector->edid) &&
+                     (radeon_connector->audio == RADEON_AUDIO_AUTO)))
                         return ATOM_ENCODER_MODE_HDMI;
                 else if (radeon_connector->use_digital)
                         return ATOM_ENCODER_MODE_DVI;
@@ -718,8 +719,9 @@ atombios_get_encoder_mode(struct drm_encoder *encoder)
         case DRM_MODE_CONNECTOR_DVID:
         case DRM_MODE_CONNECTOR_HDMIA:
         default:
-                if (drm_detect_hdmi_monitor(radeon_connector->edid) &&
-                    radeon_audio)
+                if ((radeon_connector->audio == RADEON_AUDIO_ENABLE) ||
+                    (drm_detect_hdmi_monitor(radeon_connector->edid) &&
+                     (radeon_connector->audio == RADEON_AUDIO_AUTO)))
                         return ATOM_ENCODER_MODE_HDMI;
                 else
                         return ATOM_ENCODER_MODE_DVI;
@@ -732,8 +734,9 @@ atombios_get_encoder_mode(struct drm_encoder *encoder)
                 if ((dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT) ||
                     (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_eDP))
                         return ATOM_ENCODER_MODE_DP;
-                else if (drm_detect_hdmi_monitor(radeon_connector->edid) &&
-                         radeon_audio)
+                else if ((radeon_connector->audio == RADEON_AUDIO_ENABLE) ||
+                         (drm_detect_hdmi_monitor(radeon_connector->edid) &&
+                          (radeon_connector->audio == RADEON_AUDIO_AUTO)))
                         return ATOM_ENCODER_MODE_HDMI;
                 else
                         return ATOM_ENCODER_MODE_DVI;
@@ -1647,8 +1650,12 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
                         atombios_dig_encoder_setup(encoder, ATOM_ENABLE, 0);
                         atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_SETUP, 0, 0);
                         atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
-                        /* some early dce3.2 boards have a bug in their transmitter control table */
-                        if ((rdev->family != CHIP_RV710) && (rdev->family != CHIP_RV730))
+                        /* some dce3.x boards have a bug in their transmitter control table.
+                         * ACTION_ENABLE_OUTPUT can probably be dropped since ACTION_ENABLE
+                         * does the same thing and more.
+                         */
+                        if ((rdev->family != CHIP_RV710) && (rdev->family != CHIP_RV730) &&
+                            (rdev->family != CHIP_RS880))
                                 atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
                 }
                 if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(encoder)) && connector) {
diff --git a/drivers/gpu/drm/radeon/btc_dpm.c b/drivers/gpu/drm/radeon/btc_dpm.c
index 084e69414fd1..05ff315e8e9e 100644
--- a/drivers/gpu/drm/radeon/btc_dpm.c
+++ b/drivers/gpu/drm/radeon/btc_dpm.c
@@ -2340,12 +2340,6 @@ int btc_dpm_set_power_state(struct radeon_device *rdev)
                 return ret;
         }
 
-        ret = rv770_dpm_force_performance_level(rdev, RADEON_DPM_FORCED_LEVEL_AUTO);
-        if (ret) {
-                DRM_ERROR("rv770_dpm_force_performance_level failed\n");
-                return ret;
-        }
-
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
index 3cce533397c6..899627443030 100644
--- a/drivers/gpu/drm/radeon/ci_dpm.c
+++ b/drivers/gpu/drm/radeon/ci_dpm.c
@@ -4748,12 +4748,6 @@ int ci_dpm_set_power_state(struct radeon_device *rdev)
         if (pi->pcie_performance_request)
                 ci_notify_link_speed_change_after_state_change(rdev, new_ps, old_ps);
 
-        ret = ci_dpm_force_performance_level(rdev, RADEON_DPM_FORCED_LEVEL_AUTO);
-        if (ret) {
-                DRM_ERROR("ci_dpm_force_performance_level failed\n");
-                return ret;
-        }
-
         cik_update_cg(rdev, (RADEON_CG_BLOCK_GFX |
                              RADEON_CG_BLOCK_MC |
                              RADEON_CG_BLOCK_SDMA |
diff --git a/drivers/gpu/drm/radeon/ci_smc.c b/drivers/gpu/drm/radeon/ci_smc.c
index 53b43dd3cf1e..252e10a41cf5 100644
--- a/drivers/gpu/drm/radeon/ci_smc.c
+++ b/drivers/gpu/drm/radeon/ci_smc.c
@@ -47,10 +47,11 @@ int ci_copy_bytes_to_smc(struct radeon_device *rdev,
                          u32 smc_start_address,
                          const u8 *src, u32 byte_count, u32 limit)
 {
+        unsigned long flags;
         u32 data, original_data;
         u32 addr;
         u32 extra_shift;
-        int ret;
+        int ret = 0;
 
         if (smc_start_address & 3)
                 return -EINVAL;
@@ -59,13 +60,14 @@ int ci_copy_bytes_to_smc(struct radeon_device *rdev,
 
         addr = smc_start_address;
 
+        spin_lock_irqsave(&rdev->smc_idx_lock, flags);
         while (byte_count >= 4) {
                 /* SMC address space is BE */
                 data = (src[0] << 24) | (src[1] << 16) | (src[2] << 8) | src[3];
 
                 ret = ci_set_smc_sram_address(rdev, addr, limit);
                 if (ret)
-                        return ret;
+                        goto done;
 
                 WREG32(SMC_IND_DATA_0, data);
 
@@ -80,7 +82,7 @@ int ci_copy_bytes_to_smc(struct radeon_device *rdev,
 
                 ret = ci_set_smc_sram_address(rdev, addr, limit);
                 if (ret)
-                        return ret;
+                        goto done;
 
                 original_data = RREG32(SMC_IND_DATA_0);
 
@@ -97,11 +99,15 @@ int ci_copy_bytes_to_smc(struct radeon_device *rdev,
 
                 ret = ci_set_smc_sram_address(rdev, addr, limit);
                 if (ret)
-                        return ret;
+                        goto done;
 
                 WREG32(SMC_IND_DATA_0, data);
         }
-        return 0;
+
+done:
+        spin_unlock_irqrestore(&rdev->smc_idx_lock, flags);
+
+        return ret;
 }
 
 void ci_start_smc(struct radeon_device *rdev)
@@ -197,6 +203,7 @@ PPSMC_Result ci_wait_for_smc_inactive(struct radeon_device *rdev)
 
 int ci_load_smc_ucode(struct radeon_device *rdev, u32 limit)
 {
+        unsigned long flags;
         u32 ucode_start_address;
         u32 ucode_size;
         const u8 *src;
@@ -219,6 +226,7 @@ int ci_load_smc_ucode(struct radeon_device *rdev, u32 limit)
                 return -EINVAL;
 
         src = (const u8 *)rdev->smc_fw->data;
+        spin_lock_irqsave(&rdev->smc_idx_lock, flags);
         WREG32(SMC_IND_INDEX_0, ucode_start_address);
         WREG32_P(SMC_IND_ACCESS_CNTL, AUTO_INCREMENT_IND_0, ~AUTO_INCREMENT_IND_0);
         while (ucode_size >= 4) {
@@ -231,6 +239,7 @@ int ci_load_smc_ucode(struct radeon_device *rdev, u32 limit)
                 ucode_size -= 4;
         }
         WREG32_P(SMC_IND_ACCESS_CNTL, 0, ~AUTO_INCREMENT_IND_0);
+        spin_unlock_irqrestore(&rdev->smc_idx_lock, flags);
 
         return 0;
 }
@@ -238,25 +247,29 @@ int ci_load_smc_ucode(struct radeon_device *rdev, u32 limit)
 int ci_read_smc_sram_dword(struct radeon_device *rdev,
                            u32 smc_address, u32 *value, u32 limit)
 {
+        unsigned long flags;
         int ret;
 
+        spin_lock_irqsave(&rdev->smc_idx_lock, flags);
         ret = ci_set_smc_sram_address(rdev, smc_address, limit);
-        if (ret)
-                return ret;
+        if (ret == 0)
+                *value = RREG32(SMC_IND_DATA_0);
+        spin_unlock_irqrestore(&rdev->smc_idx_lock, flags);
 
-        *value = RREG32(SMC_IND_DATA_0);
-        return 0;
+        return ret;
 }
 
 int ci_write_smc_sram_dword(struct radeon_device *rdev,
                             u32 smc_address, u32 value, u32 limit)
 {
+        unsigned long flags;
         int ret;
 
+        spin_lock_irqsave(&rdev->smc_idx_lock, flags);
         ret = ci_set_smc_sram_address(rdev, smc_address, limit);
-        if (ret)
-                return ret;
+        if (ret == 0)
+                WREG32(SMC_IND_DATA_0, value);
+        spin_unlock_irqrestore(&rdev->smc_idx_lock, flags);
 
-        WREG32(SMC_IND_DATA_0, value);
-        return 0;
+        return ret;
 }
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index a3bba0587276..adbdb6503b05 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -77,6 +77,8 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev);
 static void cik_program_aspm(struct radeon_device *rdev);
 static void cik_init_pg(struct radeon_device *rdev);
 static void cik_init_cg(struct radeon_device *rdev);
+static void cik_enable_gui_idle_interrupt(struct radeon_device *rdev,
+                                          bool enable);
 
 /* get temperature in millidegrees */
 int ci_get_temp(struct radeon_device *rdev)
@@ -120,20 +122,27 @@ int kv_get_temp(struct radeon_device *rdev)
  */
 u32 cik_pciep_rreg(struct radeon_device *rdev, u32 reg)
 {
+        unsigned long flags;
         u32 r;
 
+        spin_lock_irqsave(&rdev->pciep_idx_lock, flags);
         WREG32(PCIE_INDEX, reg);
         (void)RREG32(PCIE_INDEX);
         r = RREG32(PCIE_DATA);
+        spin_unlock_irqrestore(&rdev->pciep_idx_lock, flags);
         return r;
 }
 
 void cik_pciep_wreg(struct radeon_device *rdev, u32 reg, u32 v)
 {
+        unsigned long flags;
+
+        spin_lock_irqsave(&rdev->pciep_idx_lock, flags);
         WREG32(PCIE_INDEX, reg);
         (void)RREG32(PCIE_INDEX);
         WREG32(PCIE_DATA, v);
         (void)RREG32(PCIE_DATA);
+        spin_unlock_irqrestore(&rdev->pciep_idx_lock, flags);
 }
 
 static const u32 spectre_rlc_save_restore_register_list[] =
@@ -2722,7 +2731,8 @@ static void cik_gpu_init(struct radeon_device *rdev)
                 } else if ((rdev->pdev->device == 0x1309) ||
                            (rdev->pdev->device == 0x130A) ||
                            (rdev->pdev->device == 0x130D) ||
-                           (rdev->pdev->device == 0x1313)) {
+                           (rdev->pdev->device == 0x1313) ||
+                           (rdev->pdev->device == 0x131D)) {
                         rdev->config.cik.max_cu_per_sh = 6;
                         rdev->config.cik.max_backends_per_se = 2;
                 } else if ((rdev->pdev->device == 0x1306) ||
@@ -4013,6 +4023,8 @@ static int cik_cp_resume(struct radeon_device *rdev)
 {
         int r;
 
+        cik_enable_gui_idle_interrupt(rdev, false);
+
         r = cik_cp_load_microcode(rdev);
         if (r)
                 return r;
@@ -4024,6 +4036,8 @@ static int cik_cp_resume(struct radeon_device *rdev)
         if (r)
                 return r;
 
+        cik_enable_gui_idle_interrupt(rdev, true);
+
         return 0;
 }
 
@@ -5376,7 +5390,9 @@ static void cik_enable_hdp_ls(struct radeon_device *rdev,
 void cik_update_cg(struct radeon_device *rdev,
                    u32 block, bool enable)
 {
+
         if (block & RADEON_CG_BLOCK_GFX) {
+                cik_enable_gui_idle_interrupt(rdev, false);
                 /* order matters! */
                 if (enable) {
                         cik_enable_mgcg(rdev, true);
@@ -5385,6 +5401,7 @@ void cik_update_cg(struct radeon_device *rdev,
                         cik_enable_cgcg(rdev, false);
                         cik_enable_mgcg(rdev, false);
                 }
+                cik_enable_gui_idle_interrupt(rdev, true);
         }
 
         if (block & RADEON_CG_BLOCK_MC) {
@@ -5541,7 +5558,7 @@ static void cik_enable_gfx_cgpg(struct radeon_device *rdev,
 {
         u32 data, orig;
 
-        if (enable && (rdev->pg_flags & RADEON_PG_SUPPORT_GFX_CG)) {
+        if (enable && (rdev->pg_flags & RADEON_PG_SUPPORT_GFX_PG)) {
                 orig = data = RREG32(RLC_PG_CNTL);
                 data |= GFX_PG_ENABLE;
                 if (orig != data)
@@ -5805,7 +5822,7 @@ static void cik_init_pg(struct radeon_device *rdev)
         if (rdev->pg_flags) {
                 cik_enable_sck_slowdown_on_pu(rdev, true);
                 cik_enable_sck_slowdown_on_pd(rdev, true);
-                if (rdev->pg_flags & RADEON_PG_SUPPORT_GFX_CG) {
+                if (rdev->pg_flags & RADEON_PG_SUPPORT_GFX_PG) {
                         cik_init_gfx_cgpg(rdev);
                         cik_enable_cp_pg(rdev, true);
                         cik_enable_gds_pg(rdev, true);
@@ -5819,7 +5836,7 @@ static void cik_fini_pg(struct radeon_device *rdev)
 {
         if (rdev->pg_flags) {
                 cik_update_gfx_pg(rdev, false);
-                if (rdev->pg_flags & RADEON_PG_SUPPORT_GFX_CG) {
+                if (rdev->pg_flags & RADEON_PG_SUPPORT_GFX_PG) {
                         cik_enable_cp_pg(rdev, false);
                         cik_enable_gds_pg(rdev, false);
                 }
@@ -5895,7 +5912,9 @@ static void cik_disable_interrupt_state(struct radeon_device *rdev)
         u32 tmp;
 
         /* gfx ring */
-        WREG32(CP_INT_CNTL_RING0, CNTX_BUSY_INT_ENABLE | CNTX_EMPTY_INT_ENABLE);
+        tmp = RREG32(CP_INT_CNTL_RING0) &
+                (CNTX_BUSY_INT_ENABLE | CNTX_EMPTY_INT_ENABLE);
+        WREG32(CP_INT_CNTL_RING0, tmp);
         /* sdma */
         tmp = RREG32(SDMA0_CNTL + SDMA0_REGISTER_OFFSET) & ~TRAP_ENABLE;
         WREG32(SDMA0_CNTL + SDMA0_REGISTER_OFFSET, tmp);
@@ -6036,8 +6055,7 @@ static int cik_irq_init(struct radeon_device *rdev)
  */
 int cik_irq_set(struct radeon_device *rdev)
 {
-        u32 cp_int_cntl = CNTX_BUSY_INT_ENABLE | CNTX_EMPTY_INT_ENABLE |
-                PRIV_INSTR_INT_ENABLE | PRIV_REG_INT_ENABLE;
+        u32 cp_int_cntl;
         u32 cp_m1p0, cp_m1p1, cp_m1p2, cp_m1p3;
         u32 cp_m2p0, cp_m2p1, cp_m2p2, cp_m2p3;
         u32 crtc1 = 0, crtc2 = 0, crtc3 = 0, crtc4 = 0, crtc5 = 0, crtc6 = 0;
@@ -6058,6 +6076,10 @@ int cik_irq_set(struct radeon_device *rdev)
                 return 0;
         }
 
+        cp_int_cntl = RREG32(CP_INT_CNTL_RING0) &
+                (CNTX_BUSY_INT_ENABLE | CNTX_EMPTY_INT_ENABLE);
+        cp_int_cntl |= PRIV_INSTR_INT_ENABLE | PRIV_REG_INT_ENABLE;
+
         hpd1 = RREG32(DC_HPD1_INT_CONTROL) & ~DC_HPDx_INT_EN;
         hpd2 = RREG32(DC_HPD2_INT_CONTROL) & ~DC_HPDx_INT_EN;
         hpd3 = RREG32(DC_HPD3_INT_CONTROL) & ~DC_HPDx_INT_EN;
diff --git a/drivers/gpu/drm/radeon/cypress_dpm.c b/drivers/gpu/drm/radeon/cypress_dpm.c
index 95a66db08d9b..91bb470de0a3 100644
--- a/drivers/gpu/drm/radeon/cypress_dpm.c
+++ b/drivers/gpu/drm/radeon/cypress_dpm.c
@@ -2014,12 +2014,6 @@ int cypress_dpm_set_power_state(struct radeon_device *rdev)
         if (eg_pi->pcie_performance_request)
                 cypress_notify_link_speed_change_after_state_change(rdev, new_ps, old_ps);
 
-        ret = rv770_dpm_force_performance_level(rdev, RADEON_DPM_FORCED_LEVEL_AUTO);
-        if (ret) {
-                DRM_ERROR("rv770_dpm_force_performance_level failed\n");
-                return ret;
-        }
-
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/dce6_afmt.c b/drivers/gpu/drm/radeon/dce6_afmt.c
index 8953255e894b..85a69d2ea3d2 100644
--- a/drivers/gpu/drm/radeon/dce6_afmt.c
+++ b/drivers/gpu/drm/radeon/dce6_afmt.c
@@ -28,22 +28,30 @@
 static u32 dce6_endpoint_rreg(struct radeon_device *rdev,
                               u32 block_offset, u32 reg)
 {
+        unsigned long flags;
         u32 r;
 
+        spin_lock_irqsave(&rdev->end_idx_lock, flags);
         WREG32(AZ_F0_CODEC_ENDPOINT_INDEX + block_offset, reg);
         r = RREG32(AZ_F0_CODEC_ENDPOINT_DATA + block_offset);
+        spin_unlock_irqrestore(&rdev->end_idx_lock, flags);
+
         return r;
 }
 
 static void dce6_endpoint_wreg(struct radeon_device *rdev,
                                u32 block_offset, u32 reg, u32 v)
 {
+        unsigned long flags;
+
+        spin_lock_irqsave(&rdev->end_idx_lock, flags);
         if (ASIC_IS_DCE8(rdev))
                 WREG32(AZ_F0_CODEC_ENDPOINT_INDEX + block_offset, reg);
         else
                 WREG32(AZ_F0_CODEC_ENDPOINT_INDEX + block_offset,
                        AZ_ENDPOINT_REG_WRITE_EN | AZ_ENDPOINT_REG_INDEX(reg));
         WREG32(AZ_F0_CODEC_ENDPOINT_DATA + block_offset, v);
+        spin_unlock_irqrestore(&rdev->end_idx_lock, flags);
 }
 
 #define RREG32_ENDPOINT(block, reg) dce6_endpoint_rreg(rdev, (block), (reg))
@@ -86,12 +94,12 @@ void dce6_afmt_select_pin(struct drm_encoder *encoder)
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
         u32 offset = dig->afmt->offset;
-        u32 id = dig->afmt->pin->id;
 
         if (!dig->afmt->pin)
                 return;
 
-        WREG32(AFMT_AUDIO_SRC_CONTROL + offset, AFMT_AUDIO_SRC_SELECT(id));
+        WREG32(AFMT_AUDIO_SRC_CONTROL + offset,
+               AFMT_AUDIO_SRC_SELECT(dig->afmt->pin->id));
 }
 
 void dce6_afmt_write_speaker_allocation(struct drm_encoder *encoder)
diff --git a/drivers/gpu/drm/radeon/kv_dpm.c b/drivers/gpu/drm/radeon/kv_dpm.c
index ecd60809db4e..71399065db04 100644
--- a/drivers/gpu/drm/radeon/kv_dpm.c
+++ b/drivers/gpu/drm/radeon/kv_dpm.c
@@ -40,6 +40,7 @@ static int kv_calculate_dpm_settings(struct radeon_device *rdev);
 static void kv_enable_new_levels(struct radeon_device *rdev);
 static void kv_program_nbps_index_settings(struct radeon_device *rdev,
                                            struct radeon_ps *new_rps);
+static int kv_set_enabled_level(struct radeon_device *rdev, u32 level);
 static int kv_set_enabled_levels(struct radeon_device *rdev);
 static int kv_force_dpm_highest(struct radeon_device *rdev);
 static int kv_force_dpm_lowest(struct radeon_device *rdev);
@@ -519,7 +520,7 @@ static int kv_set_dpm_boot_state(struct radeon_device *rdev)
 
 static void kv_program_vc(struct radeon_device *rdev)
 {
-        WREG32_SMC(CG_FTV_0, 0x3FFFC000);
+        WREG32_SMC(CG_FTV_0, 0x3FFFC100);
 }
 
 static void kv_clear_vc(struct radeon_device *rdev)
@@ -638,7 +639,10 @@ static int kv_force_lowest_valid(struct radeon_device *rdev)
 
 static int kv_unforce_levels(struct radeon_device *rdev)
 {
-        return kv_notify_message_to_smu(rdev, PPSMC_MSG_NoForcedLevel);
+        if (rdev->family == CHIP_KABINI)
+                return kv_notify_message_to_smu(rdev, PPSMC_MSG_NoForcedLevel);
+        else
+                return kv_set_enabled_levels(rdev);
 }
 
 static int kv_update_sclk_t(struct radeon_device *rdev)
@@ -667,9 +671,8 @@ static int kv_program_bootup_state(struct radeon_device *rdev)
                 &rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk;
 
         if (table && table->count) {
-                for (i = pi->graphics_dpm_level_count - 1; i >= 0; i--) {
-                        if ((table->entries[i].clk == pi->boot_pl.sclk) ||
-                            (i == 0))
+                for (i = pi->graphics_dpm_level_count - 1; i > 0; i--) {
+                        if (table->entries[i].clk == pi->boot_pl.sclk)
                                 break;
                 }
 
@@ -682,9 +685,8 @@ static int kv_program_bootup_state(struct radeon_device *rdev)
                 if (table->num_max_dpm_entries == 0)
                         return -EINVAL;
 
-                for (i = pi->graphics_dpm_level_count - 1; i >= 0; i--) {
-                        if ((table->entries[i].sclk_frequency == pi->boot_pl.sclk) ||
-                            (i == 0))
+                for (i = pi->graphics_dpm_level_count - 1; i > 0; i--) {
+                        if (table->entries[i].sclk_frequency == pi->boot_pl.sclk)
                                 break;
                 }
 
@@ -1078,6 +1080,13 @@ static int kv_enable_ulv(struct radeon_device *rdev, bool enable)
                                         PPSMC_MSG_EnableULV : PPSMC_MSG_DisableULV);
 }
 
+static void kv_reset_acp_boot_level(struct radeon_device *rdev)
+{
+        struct kv_power_info *pi = kv_get_pi(rdev);
+
+        pi->acp_boot_level = 0xff;
+}
+
 static void kv_update_current_ps(struct radeon_device *rdev,
                                  struct radeon_ps *rps)
 {
@@ -1100,6 +1109,18 @@ static void kv_update_requested_ps(struct radeon_device *rdev,
         pi->requested_rps.ps_priv = &pi->requested_ps;
 }
 
+void kv_dpm_enable_bapm(struct radeon_device *rdev, bool enable)
+{
+        struct kv_power_info *pi = kv_get_pi(rdev);
+        int ret;
+
+        if (pi->bapm_enable) {
+                ret = kv_smc_bapm_enable(rdev, enable);
+                if (ret)
+                        DRM_ERROR("kv_smc_bapm_enable failed\n");
+        }
+}
+
 int kv_dpm_enable(struct radeon_device *rdev)
 {
         struct kv_power_info *pi = kv_get_pi(rdev);
@@ -1192,6 +1213,8 @@ int kv_dpm_enable(struct radeon_device *rdev)
                 return ret;
         }
 
+        kv_reset_acp_boot_level(rdev);
+
         if (rdev->irq.installed &&
             r600_is_internal_thermal_sensor(rdev->pm.int_thermal_type)) {
                 ret = kv_set_thermal_temperature_range(rdev, R600_TEMP_RANGE_MIN, R600_TEMP_RANGE_MAX);
@@ -1203,6 +1226,12 @@ int kv_dpm_enable(struct radeon_device *rdev)
                 radeon_irq_set(rdev);
         }
 
+        ret = kv_smc_bapm_enable(rdev, false);
+        if (ret) {
+                DRM_ERROR("kv_smc_bapm_enable failed\n");
+                return ret;
+        }
+
         /* powerdown unused blocks for now */
         kv_dpm_powergate_acp(rdev, true);
         kv_dpm_powergate_samu(rdev, true);
@@ -1226,6 +1255,8 @@ void kv_dpm_disable(struct radeon_device *rdev)
                              RADEON_CG_BLOCK_BIF |
                              RADEON_CG_BLOCK_HDP), false);
 
+        kv_smc_bapm_enable(rdev, false);
+
         /* powerup blocks */
         kv_dpm_powergate_acp(rdev, false);
         kv_dpm_powergate_samu(rdev, false);
@@ -1450,6 +1481,39 @@ static int kv_update_samu_dpm(struct radeon_device *rdev, bool gate)
         return kv_enable_samu_dpm(rdev, !gate);
 }
 
+static u8 kv_get_acp_boot_level(struct radeon_device *rdev)
+{
+        u8 i;
+        struct radeon_clock_voltage_dependency_table *table =
+                &rdev->pm.dpm.dyn_state.acp_clock_voltage_dependency_table;
+
+        for (i = 0; i < table->count; i++) {
+                if (table->entries[i].clk >= 0) /* XXX */
+                        break;
+        }
+
+        if (i >= table->count)
+                i = table->count - 1;
+
+        return i;
+}
+
+static void kv_update_acp_boot_level(struct radeon_device *rdev)
+{
+        struct kv_power_info *pi = kv_get_pi(rdev);
+        u8 acp_boot_level;
+
+        if (!pi->caps_stable_p_state) {
+                acp_boot_level = kv_get_acp_boot_level(rdev);
+                if (acp_boot_level != pi->acp_boot_level) {
+                        pi->acp_boot_level = acp_boot_level;
+                        kv_send_msg_to_smc_with_parameter(rdev,
+                                                          PPSMC_MSG_ACPDPM_SetEnabledMask,
+                                                          (1 << pi->acp_boot_level));
+                }
+        }
+}
+
 static int kv_update_acp_dpm(struct radeon_device *rdev, bool gate)
 {
         struct kv_power_info *pi = kv_get_pi(rdev);
@@ -1461,7 +1525,7 @@ static int kv_update_acp_dpm(struct radeon_device *rdev, bool gate)
                 if (pi->caps_stable_p_state)
                         pi->acp_boot_level = table->count - 1;
                 else
-                        pi->acp_boot_level = 0;
+                        pi->acp_boot_level = kv_get_acp_boot_level(rdev);
 
                 ret = kv_copy_bytes_to_smc(rdev,
                                            pi->dpm_table_start +
@@ -1588,13 +1652,11 @@ static void kv_set_valid_clock_range(struct radeon_device *rdev,
                         }
                 }
 
-                for (i = pi->graphics_dpm_level_count - 1; i >= 0; i--) {
-                        if ((table->entries[i].clk <= new_ps->levels[new_ps->num_levels -1].sclk) ||
-                            (i == 0)) {
-                                pi->highest_valid = i;
+                for (i = pi->graphics_dpm_level_count - 1; i > 0; i--) {
+                        if (table->entries[i].clk <= new_ps->levels[new_ps->num_levels - 1].sclk)
                                 break;
-                        }
                 }
+                pi->highest_valid = i;
 
                 if (pi->lowest_valid > pi->highest_valid) {
                         if ((new_ps->levels[0].sclk - table->entries[pi->highest_valid].clk) >
@@ -1615,14 +1677,12 @@ static void kv_set_valid_clock_range(struct radeon_device *rdev,
                         }
                 }
 
-                for (i = pi->graphics_dpm_level_count - 1; i >= 0; i--) {
+                for (i = pi->graphics_dpm_level_count - 1; i > 0; i--) {
                         if (table->entries[i].sclk_frequency <=
-                            new_ps->levels[new_ps->num_levels - 1].sclk ||
-                            i == 0) {
-                                pi->highest_valid = i;
+                            new_ps->levels[new_ps->num_levels - 1].sclk)
                                 break;
-                        }
                 }
+                pi->highest_valid = i;
 
                 if (pi->lowest_valid > pi->highest_valid) {
                         if ((new_ps->levels[0].sclk -
@@ -1724,6 +1784,14 @@ int kv_dpm_set_power_state(struct radeon_device *rdev)
                              RADEON_CG_BLOCK_BIF |
                              RADEON_CG_BLOCK_HDP), false);
 
+        if (pi->bapm_enable) {
+                ret = kv_smc_bapm_enable(rdev, rdev->pm.dpm.ac_power);
+                if (ret) {
+                        DRM_ERROR("kv_smc_bapm_enable failed\n");
+                        return ret;
+                }
+        }
+
         if (rdev->family == CHIP_KABINI) {
                 if (pi->enable_dpm) {
                         kv_set_valid_clock_range(rdev, new_ps);
@@ -1775,6 +1843,7 @@ int kv_dpm_set_power_state(struct radeon_device *rdev)
                                 return ret;
                         }
 #endif
+                        kv_update_acp_boot_level(rdev);
                         kv_update_sclk_t(rdev);
                         kv_enable_nb_dpm(rdev);
                 }
@@ -1785,7 +1854,6 @@ int kv_dpm_set_power_state(struct radeon_device *rdev)
                              RADEON_CG_BLOCK_BIF |
                              RADEON_CG_BLOCK_HDP), true);
 
-        rdev->pm.dpm.forced_level = RADEON_DPM_FORCED_LEVEL_AUTO;
         return 0;
 }
 
@@ -1806,12 +1874,23 @@ void kv_dpm_setup_asic(struct radeon_device *rdev)
 
 void kv_dpm_reset_asic(struct radeon_device *rdev)
 {
-        kv_force_lowest_valid(rdev);
-        kv_init_graphics_levels(rdev);
-        kv_program_bootup_state(rdev);
-        kv_upload_dpm_settings(rdev);
-        kv_force_lowest_valid(rdev);
-        kv_unforce_levels(rdev);
+        struct kv_power_info *pi = kv_get_pi(rdev);
+
+        if (rdev->family == CHIP_KABINI) {
+                kv_force_lowest_valid(rdev);
+                kv_init_graphics_levels(rdev);
+                kv_program_bootup_state(rdev);
+                kv_upload_dpm_settings(rdev);
+                kv_force_lowest_valid(rdev);
+                kv_unforce_levels(rdev);
+        } else {
+                kv_init_graphics_levels(rdev);
+                kv_program_bootup_state(rdev);
+                kv_freeze_sclk_dpm(rdev, true);
+                kv_upload_dpm_settings(rdev);
+                kv_freeze_sclk_dpm(rdev, false);
+                kv_set_enabled_level(rdev, pi->graphics_boot_level);
+        }
 }
 
 //XXX use sumo_dpm_display_configuration_changed
@@ -1871,12 +1950,15 @@ static int kv_force_dpm_highest(struct radeon_device *rdev)
         if (ret)
                 return ret;
 
-        for (i = SMU7_MAX_LEVELS_GRAPHICS - 1; i >= 0; i--) {
+        for (i = SMU7_MAX_LEVELS_GRAPHICS - 1; i > 0; i--) {
                 if (enable_mask & (1 << i))
                         break;
         }
 
-        return kv_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_DPM_ForceState, i);
+        if (rdev->family == CHIP_KABINI)
+                return kv_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_DPM_ForceState, i);
+        else
+                return kv_set_enabled_level(rdev, i);
 }
 
 static int kv_force_dpm_lowest(struct radeon_device *rdev)
@@ -1893,7 +1975,10 @@ static int kv_force_dpm_lowest(struct radeon_device *rdev)
                         break;
         }
 
-        return kv_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_DPM_ForceState, i);
+        if (rdev->family == CHIP_KABINI)
+                return kv_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_DPM_ForceState, i);
+        else
+                return kv_set_enabled_level(rdev, i);
 }
 
 static u8 kv_get_sleep_divider_id_from_clock(struct radeon_device *rdev,
@@ -1911,9 +1996,9 @@ static u8 kv_get_sleep_divider_id_from_clock(struct radeon_device *rdev,
         if (!pi->caps_sclk_ds)
                 return 0;
 
-        for (i = KV_MAX_DEEPSLEEP_DIVIDER_ID; i <= 0; i--) {
+        for (i = KV_MAX_DEEPSLEEP_DIVIDER_ID; i > 0; i--) {
                 temp = sclk / sumo_get_sleep_divider_from_id(i);
-                if ((temp >= min) || (i == 0))
+                if (temp >= min)
                         break;
         }
 
@@ -2039,12 +2124,12 @@ static void kv_apply_state_adjust_rules(struct radeon_device *rdev,
                 ps->dpmx_nb_ps_lo = 0x1;
                 ps->dpmx_nb_ps_hi = 0x0;
         } else {
-                ps->dpm0_pg_nb_ps_lo = 0x1;
+                ps->dpm0_pg_nb_ps_lo = 0x3;
                 ps->dpm0_pg_nb_ps_hi = 0x0;
-                ps->dpmx_nb_ps_lo = 0x2;
-                ps->dpmx_nb_ps_hi = 0x1;
+                ps->dpmx_nb_ps_lo = 0x3;
+                ps->dpmx_nb_ps_hi = 0x0;
 
-                if (pi->sys_info.nb_dpm_enable && pi->battery_state) {
+                if (pi->sys_info.nb_dpm_enable) {
                         force_high = (mclk >= pi->sys_info.nbp_memory_clock[3]) ||
                                 pi->video_start || (rdev->pm.dpm.new_active_crtc_count >= 3) ||
                                 pi->disable_nb_ps3_in_battery;
@@ -2210,6 +2295,15 @@ static void kv_enable_new_levels(struct radeon_device *rdev)
         }
 }
 
+static int kv_set_enabled_level(struct radeon_device *rdev, u32 level)
+{
+        u32 new_mask = (1 << level);
+
+        return kv_send_msg_to_smc_with_parameter(rdev,
+                                                 PPSMC_MSG_SCLKDPM_SetEnabledMask,
+                                                 new_mask);
+}
+
 static int kv_set_enabled_levels(struct radeon_device *rdev)
 {
         struct kv_power_info *pi = kv_get_pi(rdev);
diff --git a/drivers/gpu/drm/radeon/kv_dpm.h b/drivers/gpu/drm/radeon/kv_dpm.h
index 32bb079572d7..8cef7525d7a8 100644
--- a/drivers/gpu/drm/radeon/kv_dpm.h
+++ b/drivers/gpu/drm/radeon/kv_dpm.h
@@ -192,6 +192,7 @@ int kv_send_msg_to_smc_with_parameter(struct radeon_device *rdev,
 int kv_read_smc_sram_dword(struct radeon_device *rdev, u32 smc_address,
                            u32 *value, u32 limit);
 int kv_smc_dpm_enable(struct radeon_device *rdev, bool enable);
+int kv_smc_bapm_enable(struct radeon_device *rdev, bool enable);
 int kv_copy_bytes_to_smc(struct radeon_device *rdev,
                          u32 smc_start_address,
                          const u8 *src, u32 byte_count, u32 limit);
diff --git a/drivers/gpu/drm/radeon/kv_smc.c b/drivers/gpu/drm/radeon/kv_smc.c
index 34a226d7e34a..0000b59a6d05 100644
--- a/drivers/gpu/drm/radeon/kv_smc.c
+++ b/drivers/gpu/drm/radeon/kv_smc.c
@@ -107,6 +107,14 @@ int kv_smc_dpm_enable(struct radeon_device *rdev, bool enable)
                 return kv_notify_message_to_smu(rdev, PPSMC_MSG_DPM_Disable);
 }
 
+int kv_smc_bapm_enable(struct radeon_device *rdev, bool enable)
+{
+        if (enable)
+                return kv_notify_message_to_smu(rdev, PPSMC_MSG_EnableBAPM);
+        else
+                return kv_notify_message_to_smu(rdev, PPSMC_MSG_DisableBAPM);
+}
+
 int kv_copy_bytes_to_smc(struct radeon_device *rdev,
                          u32 smc_start_address,
                          const u8 *src, u32 byte_count, u32 limit)
diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
index f7b625c9e0e9..6c398a456d78 100644
--- a/drivers/gpu/drm/radeon/ni_dpm.c
+++ b/drivers/gpu/drm/radeon/ni_dpm.c
@@ -3865,12 +3865,6 @@ int ni_dpm_set_power_state(struct radeon_device *rdev)
                 return ret;
         }
 
-        ret = ni_dpm_force_performance_level(rdev, RADEON_DPM_FORCED_LEVEL_AUTO);
-        if (ret) {
-                DRM_ERROR("ni_dpm_force_performance_level failed\n");
-                return ret;
-        }
-
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/ppsmc.h b/drivers/gpu/drm/radeon/ppsmc.h
index 682842804bce..5670b8291285 100644
--- a/drivers/gpu/drm/radeon/ppsmc.h
+++ b/drivers/gpu/drm/radeon/ppsmc.h
@@ -163,6 +163,8 @@ typedef uint8_t PPSMC_Result;
 #define PPSMC_MSG_VCEPowerON                ((uint32_t) 0x10f)
 #define PPSMC_MSG_DCE_RemoveVoltageAdjustment   ((uint32_t) 0x11d)
 #define PPSMC_MSG_DCE_AllowVoltageAdjustment    ((uint32_t) 0x11e)
+#define PPSMC_MSG_EnableBAPM                ((uint32_t) 0x120)
+#define PPSMC_MSG_DisableBAPM               ((uint32_t) 0x121)
 #define PPSMC_MSG_UVD_DPM_Config            ((uint32_t) 0x124)
 
 
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 9fc61dd68bc0..24175717307b 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -2853,21 +2853,28 @@ static void r100_pll_errata_after_data(struct radeon_device *rdev)
 
 uint32_t r100_pll_rreg(struct radeon_device *rdev, uint32_t reg)
 {
+        unsigned long flags;
         uint32_t data;
 
+        spin_lock_irqsave(&rdev->pll_idx_lock, flags);
         WREG8(RADEON_CLOCK_CNTL_INDEX, reg & 0x3f);
         r100_pll_errata_after_index(rdev);
         data = RREG32(RADEON_CLOCK_CNTL_DATA);
         r100_pll_errata_after_data(rdev);
+        spin_unlock_irqrestore(&rdev->pll_idx_lock, flags);
         return data;
 }
 
 void r100_pll_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
 {
+        unsigned long flags;
+
+        spin_lock_irqsave(&rdev->pll_idx_lock, flags);
         WREG8(RADEON_CLOCK_CNTL_INDEX, ((reg & 0x3f) | RADEON_PLL_WR_EN));
         r100_pll_errata_after_index(rdev);
         WREG32(RADEON_CLOCK_CNTL_DATA, v);
         r100_pll_errata_after_data(rdev);
+        spin_unlock_irqrestore(&rdev->pll_idx_lock, flags);
 }
 
 static void r100_set_safe_registers(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/r420.c b/drivers/gpu/drm/radeon/r420.c
index 4e796ecf9ea4..6edf2b3a52b4 100644
--- a/drivers/gpu/drm/radeon/r420.c
+++ b/drivers/gpu/drm/radeon/r420.c
@@ -160,18 +160,25 @@ void r420_pipes_init(struct radeon_device *rdev)
 
 u32 r420_mc_rreg(struct radeon_device *rdev, u32 reg)
 {
+        unsigned long flags;
         u32 r;
 
+        spin_lock_irqsave(&rdev->mc_idx_lock, flags);
         WREG32(R_0001F8_MC_IND_INDEX, S_0001F8_MC_IND_ADDR(reg));
         r = RREG32(R_0001FC_MC_IND_DATA);
+        spin_unlock_irqrestore(&rdev->mc_idx_lock, flags);
         return r;
 }
 
 void r420_mc_wreg(struct radeon_device *rdev, u32 reg, u32 v)
 {
+        unsigned long flags;
+
+        spin_lock_irqsave(&rdev->mc_idx_lock, flags);
         WREG32(R_0001F8_MC_IND_INDEX, S_0001F8_MC_IND_ADDR(reg) |
                 S_0001F8_MC_IND_WR_EN(1));
         WREG32(R_0001FC_MC_IND_DATA, v);
+        spin_unlock_irqrestore(&rdev->mc_idx_lock, flags);
 }
 
 static void r420_debugfs(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index ea4d3734e6d9..2a1b1876b431 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -119,6 +119,11 @@ u32 r600_get_xclk(struct radeon_device *rdev)
         return rdev->clock.spll.reference_freq;
 }
 
+int r600_set_uvd_clocks(struct radeon_device *rdev, u32 vclk, u32 dclk)
+{
+        return 0;
+}
+
 /* get temperature in millidegrees */
 int rv6xx_get_temp(struct radeon_device *rdev)
 {
@@ -1045,20 +1050,27 @@ int r600_mc_wait_for_idle(struct radeon_device *rdev)
 
 uint32_t rs780_mc_rreg(struct radeon_device *rdev, uint32_t reg)
 {
+        unsigned long flags;
         uint32_t r;
 
+        spin_lock_irqsave(&rdev->mc_idx_lock, flags);
         WREG32(R_0028F8_MC_INDEX, S_0028F8_MC_IND_ADDR(reg));
         r = RREG32(R_0028FC_MC_DATA);
         WREG32(R_0028F8_MC_INDEX, ~C_0028F8_MC_IND_ADDR);
+        spin_unlock_irqrestore(&rdev->mc_idx_lock, flags);
         return r;
 }
 
 void rs780_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
 {
+        unsigned long flags;
+
+        spin_lock_irqsave(&rdev->mc_idx_lock, flags);
         WREG32(R_0028F8_MC_INDEX, S_0028F8_MC_IND_ADDR(reg) |
                 S_0028F8_MC_IND_WR_EN(1));
         WREG32(R_0028FC_MC_DATA, v);
         WREG32(R_0028F8_MC_INDEX, 0x7F);
+        spin_unlock_irqrestore(&rdev->mc_idx_lock, flags);
 }
 
 static void r600_mc_program(struct radeon_device *rdev)
@@ -2092,20 +2104,27 @@ static void r600_gpu_init(struct radeon_device *rdev)
  */
 u32 r600_pciep_rreg(struct radeon_device *rdev, u32 reg)
 {
+        unsigned long flags;
         u32 r;
 
+        spin_lock_irqsave(&rdev->pciep_idx_lock, flags);
         WREG32(PCIE_PORT_INDEX, ((reg) & 0xff));
         (void)RREG32(PCIE_PORT_INDEX);
         r = RREG32(PCIE_PORT_DATA);
+        spin_unlock_irqrestore(&rdev->pciep_idx_lock, flags);
         return r;
 }
 
 void r600_pciep_wreg(struct radeon_device *rdev, u32 reg, u32 v)
 {
+        unsigned long flags;
+
+        spin_lock_irqsave(&rdev->pciep_idx_lock, flags);
         WREG32(PCIE_PORT_INDEX, ((reg) & 0xff));
         (void)RREG32(PCIE_PORT_INDEX);
         WREG32(PCIE_PORT_DATA, (v));
         (void)RREG32(PCIE_PORT_DATA);
+        spin_unlock_irqrestore(&rdev->pciep_idx_lock, flags);
 }
 
 /*
diff --git a/drivers/gpu/drm/radeon/r600_dpm.c b/drivers/gpu/drm/radeon/r600_dpm.c
index fa0de46fcc0d..e65f211a7be0 100644
--- a/drivers/gpu/drm/radeon/r600_dpm.c
+++ b/drivers/gpu/drm/radeon/r600_dpm.c
@@ -1219,30 +1219,20 @@ int r600_parse_extended_power_table(struct radeon_device *rdev)
 
 void r600_free_extended_power_table(struct radeon_device *rdev)
 {
-        if (rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries)
-                kfree(rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries);
-        if (rdev->pm.dpm.dyn_state.vddci_dependency_on_mclk.entries)
-                kfree(rdev->pm.dpm.dyn_state.vddci_dependency_on_mclk.entries);
-        if (rdev->pm.dpm.dyn_state.vddc_dependency_on_mclk.entries)
-                kfree(rdev->pm.dpm.dyn_state.vddc_dependency_on_mclk.entries);
-        if (rdev->pm.dpm.dyn_state.mvdd_dependency_on_mclk.entries)
-                kfree(rdev->pm.dpm.dyn_state.mvdd_dependency_on_mclk.entries);
-        if (rdev->pm.dpm.dyn_state.cac_leakage_table.entries)
-                kfree(rdev->pm.dpm.dyn_state.cac_leakage_table.entries);
-        if (rdev->pm.dpm.dyn_state.phase_shedding_limits_table.entries)
-                kfree(rdev->pm.dpm.dyn_state.phase_shedding_limits_table.entries);
-        if (rdev->pm.dpm.dyn_state.ppm_table)
-                kfree(rdev->pm.dpm.dyn_state.ppm_table);
-        if (rdev->pm.dpm.dyn_state.cac_tdp_table)
-                kfree(rdev->pm.dpm.dyn_state.cac_tdp_table);
-        if (rdev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table.entries)
-                kfree(rdev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table.entries);
-        if (rdev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table.entries)
-                kfree(rdev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table.entries);
-        if (rdev->pm.dpm.dyn_state.samu_clock_voltage_dependency_table.entries)
-                kfree(rdev->pm.dpm.dyn_state.samu_clock_voltage_dependency_table.entries);
-        if (rdev->pm.dpm.dyn_state.acp_clock_voltage_dependency_table.entries)
-                kfree(rdev->pm.dpm.dyn_state.acp_clock_voltage_dependency_table.entries);
+        struct radeon_dpm_dynamic_state *dyn_state = &rdev->pm.dpm.dyn_state;
+
+        kfree(dyn_state->vddc_dependency_on_sclk.entries);
+        kfree(dyn_state->vddci_dependency_on_mclk.entries);
+        kfree(dyn_state->vddc_dependency_on_mclk.entries);
+        kfree(dyn_state->mvdd_dependency_on_mclk.entries);
+        kfree(dyn_state->cac_leakage_table.entries);
+        kfree(dyn_state->phase_shedding_limits_table.entries);
+        kfree(dyn_state->ppm_table);
+        kfree(dyn_state->cac_tdp_table);
+        kfree(dyn_state->vce_clock_voltage_dependency_table.entries);
+        kfree(dyn_state->uvd_clock_voltage_dependency_table.entries);
+        kfree(dyn_state->samu_clock_voltage_dependency_table.entries);
+        kfree(dyn_state->acp_clock_voltage_dependency_table.entries);
 }
 
 enum radeon_pcie_gen r600_get_pcie_gen_support(struct radeon_device *rdev,
diff --git a/drivers/gpu/drm/radeon/r600d.h b/drivers/gpu/drm/radeon/r600d.h
index 454f90a849e4..e673fe26ea84 100644
--- a/drivers/gpu/drm/radeon/r600d.h
+++ b/drivers/gpu/drm/radeon/r600d.h
@@ -1040,7 +1040,7 @@
 #       define HDMI0_AVI_INFO_CONT   (1 << 1)
 #       define HDMI0_AUDIO_INFO_SEND (1 << 4)
 #       define HDMI0_AUDIO_INFO_CONT (1 << 5)
-#       define HDMI0_AUDIO_INFO_SOURCE (1 << 6) /* 0 - sound block; 1 - hmdi regs */
+#       define HDMI0_AUDIO_INFO_SOURCE (1 << 6) /* 0 - sound block; 1 - hdmi regs */
 #       define HDMI0_AUDIO_INFO_UPDATE (1 << 7)
 #       define HDMI0_MPEG_INFO_SEND  (1 << 8)
 #       define HDMI0_MPEG_INFO_CONT  (1 << 9)
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index ff8b564ce2b2..a400ac1c4147 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -181,7 +181,7 @@ extern int radeon_aspm;
 #define RADEON_CG_SUPPORT_HDP_MGCG              (1 << 16)
 
 /* PG flags */
-#define RADEON_PG_SUPPORT_GFX_CG                (1 << 0)
+#define RADEON_PG_SUPPORT_GFX_PG                (1 << 0)
 #define RADEON_PG_SUPPORT_GFX_SMG               (1 << 1)
 #define RADEON_PG_SUPPORT_GFX_DMG               (1 << 2)
 #define RADEON_PG_SUPPORT_UVD                   (1 << 3)
@@ -1778,6 +1778,7 @@ struct radeon_asic {
                 int (*force_performance_level)(struct radeon_device *rdev, enum radeon_dpm_forced_level level);
                 bool (*vblank_too_short)(struct radeon_device *rdev);
                 void (*powergate_uvd)(struct radeon_device *rdev, bool gate);
+                void (*enable_bapm)(struct radeon_device *rdev, bool enable);
         } dpm;
         /* pageflipping */
         struct {
@@ -2110,6 +2111,28 @@ struct radeon_device {
         resource_size_t                 rmmio_size;
         /* protects concurrent MM_INDEX/DATA based register access */
         spinlock_t mmio_idx_lock;
+        /* protects concurrent SMC based register access */
+        spinlock_t smc_idx_lock;
+        /* protects concurrent PLL register access */
+        spinlock_t pll_idx_lock;
+        /* protects concurrent MC register access */
+        spinlock_t mc_idx_lock;
+        /* protects concurrent PCIE register access */
+        spinlock_t pcie_idx_lock;
+        /* protects concurrent PCIE_PORT register access */
+        spinlock_t pciep_idx_lock;
+        /* protects concurrent PIF register access */
+        spinlock_t pif_idx_lock;
+        /* protects concurrent CG register access */
+        spinlock_t cg_idx_lock;
+        /* protects concurrent UVD register access */
+        spinlock_t uvd_idx_lock;
+        /* protects concurrent RCU register access */
+        spinlock_t rcu_idx_lock;
+        /* protects concurrent DIDT register access */
+        spinlock_t didt_idx_lock;
+        /* protects concurrent ENDPOINT (audio) register access */
+        spinlock_t end_idx_lock;
         void __iomem                    *rmmio;
         radeon_rreg_t                   mc_rreg;
         radeon_wreg_t                   mc_wreg;
@@ -2277,123 +2300,179 @@ void cik_mm_wdoorbell(struct radeon_device *rdev, u32 offset, u32 v);
  */
 static inline uint32_t rv370_pcie_rreg(struct radeon_device *rdev, uint32_t reg)
 {
+        unsigned long flags;
         uint32_t r;
 
+        spin_lock_irqsave(&rdev->pcie_idx_lock, flags);
         WREG32(RADEON_PCIE_INDEX, ((reg) & rdev->pcie_reg_mask));
         r = RREG32(RADEON_PCIE_DATA);
+        spin_unlock_irqrestore(&rdev->pcie_idx_lock, flags);
         return r;
 }
 
 static inline void rv370_pcie_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
 {
+        unsigned long flags;
+
+        spin_lock_irqsave(&rdev->pcie_idx_lock, flags);
         WREG32(RADEON_PCIE_INDEX, ((reg) & rdev->pcie_reg_mask));
         WREG32(RADEON_PCIE_DATA, (v));
+        spin_unlock_irqrestore(&rdev->pcie_idx_lock, flags);
 }
 
 static inline u32 tn_smc_rreg(struct radeon_device *rdev, u32 reg)
 {
+        unsigned long flags;
         u32 r;
 
+        spin_lock_irqsave(&rdev->smc_idx_lock, flags);
         WREG32(TN_SMC_IND_INDEX_0, (reg));
         r = RREG32(TN_SMC_IND_DATA_0);
+        spin_unlock_irqrestore(&rdev->smc_idx_lock, flags);
         return r;
 }
 
 static inline void tn_smc_wreg(struct radeon_device *rdev, u32 reg, u32 v)
 {
+        unsigned long flags;
+
+        spin_lock_irqsave(&rdev->smc_idx_lock, flags);
         WREG32(TN_SMC_IND_INDEX_0, (reg));
         WREG32(TN_SMC_IND_DATA_0, (v));
+        spin_unlock_irqrestore(&rdev->smc_idx_lock, flags);
 }
 
 static inline u32 r600_rcu_rreg(struct radeon_device *rdev, u32 reg)
 {
+        unsigned long flags;
         u32 r;
 
+        spin_lock_irqsave(&rdev->rcu_idx_lock, flags);
         WREG32(R600_RCU_INDEX, ((reg) & 0x1fff));
         r = RREG32(R600_RCU_DATA);
+        spin_unlock_irqrestore(&rdev->rcu_idx_lock, flags);
         return r;
 }
 
 static inline void r600_rcu_wreg(struct radeon_device *rdev, u32 reg, u32 v)
 {
+        unsigned long flags;
+
+        spin_lock_irqsave(&rdev->rcu_idx_lock, flags);
         WREG32(R600_RCU_INDEX, ((reg) & 0x1fff));
         WREG32(R600_RCU_DATA, (v));
+        spin_unlock_irqrestore(&rdev->rcu_idx_lock, flags);
 }
 
 static inline u32 eg_cg_rreg(struct radeon_device *rdev, u32 reg)
 {
+        unsigned long flags;
         u32 r;
 
+        spin_lock_irqsave(&rdev->cg_idx_lock, flags);
         WREG32(EVERGREEN_CG_IND_ADDR, ((reg) & 0xffff));
         r = RREG32(EVERGREEN_CG_IND_DATA);
+        spin_unlock_irqrestore(&rdev->cg_idx_lock, flags);
         return r;
 }
 
 static inline void eg_cg_wreg(struct radeon_device *rdev, u32 reg, u32 v)
 {
+        unsigned long flags;
+
+        spin_lock_irqsave(&rdev->cg_idx_lock, flags);
         WREG32(EVERGREEN_CG_IND_ADDR, ((reg) & 0xffff));
         WREG32(EVERGREEN_CG_IND_DATA, (v));
+        spin_unlock_irqrestore(&rdev->cg_idx_lock, flags);
 }
 
 static inline u32 eg_pif_phy0_rreg(struct radeon_device *rdev, u32 reg)
 {
+        unsigned long flags;
         u32 r;
 
+        spin_lock_irqsave(&rdev->pif_idx_lock, flags);
         WREG32(EVERGREEN_PIF_PHY0_INDEX, ((reg) & 0xffff));
         r = RREG32(EVERGREEN_PIF_PHY0_DATA);
+        spin_unlock_irqrestore(&rdev->pif_idx_lock, flags);
         return r;
 }
 
 static inline void eg_pif_phy0_wreg(struct radeon_device *rdev, u32 reg, u32 v)
 {
+        unsigned long flags;
+
+        spin_lock_irqsave(&rdev->pif_idx_lock, flags);
         WREG32(EVERGREEN_PIF_PHY0_INDEX, ((reg) & 0xffff));
         WREG32(EVERGREEN_PIF_PHY0_DATA, (v));
+        spin_unlock_irqrestore(&rdev->pif_idx_lock, flags);
 }
 
 static inline u32 eg_pif_phy1_rreg(struct radeon_device *rdev, u32 reg)
 {
+        unsigned long flags;
         u32 r;
 
+        spin_lock_irqsave(&rdev->pif_idx_lock, flags);
         WREG32(EVERGREEN_PIF_PHY1_INDEX, ((reg) & 0xffff));
         r = RREG32(EVERGREEN_PIF_PHY1_DATA);
+        spin_unlock_irqrestore(&rdev->pif_idx_lock, flags);
         return r;
 }
 
 static inline void eg_pif_phy1_wreg(struct radeon_device *rdev, u32 reg, u32 v)
 {
+        unsigned long flags;
+
+        spin_lock_irqsave(&rdev->pif_idx_lock, flags);
         WREG32(EVERGREEN_PIF_PHY1_INDEX, ((reg) & 0xffff));
         WREG32(EVERGREEN_PIF_PHY1_DATA, (v));
+        spin_unlock_irqrestore(&rdev->pif_idx_lock, flags);
 }
 
 static inline u32 r600_uvd_ctx_rreg(struct radeon_device *rdev, u32 reg)
 {
+        unsigned long flags;
         u32 r;
 
+        spin_lock_irqsave(&rdev->uvd_idx_lock, flags);
         WREG32(R600_UVD_CTX_INDEX, ((reg) & 0x1ff));
         r = RREG32(R600_UVD_CTX_DATA);
+        spin_unlock_irqrestore(&rdev->uvd_idx_lock, flags);
         return r;
 }
 
 static inline void r600_uvd_ctx_wreg(struct radeon_device *rdev, u32 reg, u32 v)
 {
+        unsigned long flags;
+
+        spin_lock_irqsave(&rdev->uvd_idx_lock, flags);
         WREG32(R600_UVD_CTX_INDEX, ((reg) & 0x1ff));
         WREG32(R600_UVD_CTX_DATA, (v));
+        spin_unlock_irqrestore(&rdev->uvd_idx_lock, flags);
 }
 
 
 static inline u32 cik_didt_rreg(struct radeon_device *rdev, u32 reg)
 {
+        unsigned long flags;
         u32 r;
 
+        spin_lock_irqsave(&rdev->didt_idx_lock, flags);
         WREG32(CIK_DIDT_IND_INDEX, (reg));
         r = RREG32(CIK_DIDT_IND_DATA);
+        spin_unlock_irqrestore(&rdev->didt_idx_lock, flags);
         return r;
 }
 
 static inline void cik_didt_wreg(struct radeon_device *rdev, u32 reg, u32 v)
 {
+        unsigned long flags;
+
+        spin_lock_irqsave(&rdev->didt_idx_lock, flags);
         WREG32(CIK_DIDT_IND_INDEX, (reg));
         WREG32(CIK_DIDT_IND_DATA, (v));
+        spin_unlock_irqrestore(&rdev->didt_idx_lock, flags);
 }
 
 void r100_pll_errata_after_index(struct radeon_device *rdev);
@@ -2569,6 +2648,7 @@ void radeon_ring_write(struct radeon_ring *ring, uint32_t v);
 #define radeon_dpm_force_performance_level(rdev, l) rdev->asic->dpm.force_performance_level((rdev), (l))
 #define radeon_dpm_vblank_too_short(rdev) rdev->asic->dpm.vblank_too_short((rdev))
 #define radeon_dpm_powergate_uvd(rdev, g) rdev->asic->dpm.powergate_uvd((rdev), (g))
+#define radeon_dpm_enable_bapm(rdev, e) rdev->asic->dpm.enable_bapm((rdev), (e))
 
 /* Common functions */
 /* AGP */
diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
index 630853b96841..5003385a7512 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.c
+++ b/drivers/gpu/drm/radeon/radeon_asic.c
@@ -1037,6 +1037,7 @@ static struct radeon_asic rv6xx_asic = {
                 .set_pcie_lanes = &r600_set_pcie_lanes,
                 .set_clock_gating = NULL,
                 .get_temperature = &rv6xx_get_temp,
+                .set_uvd_clocks = &r600_set_uvd_clocks,
         },
         .dpm = {
                 .init = &rv6xx_dpm_init,
@@ -1126,6 +1127,7 @@ static struct radeon_asic rs780_asic = {
                 .set_pcie_lanes = NULL,
                 .set_clock_gating = NULL,
                 .get_temperature = &rv6xx_get_temp,
+                .set_uvd_clocks = &r600_set_uvd_clocks,
         },
         .dpm = {
                 .init = &rs780_dpm_init,
@@ -1141,6 +1143,7 @@ static struct radeon_asic rs780_asic = {
                 .get_mclk = &rs780_dpm_get_mclk,
                 .print_power_state = &rs780_dpm_print_power_state,
                 .debugfs_print_current_performance_level = &rs780_dpm_debugfs_print_current_performance_level,
+                .force_performance_level = &rs780_dpm_force_performance_level,
         },
         .pflip = {
                 .pre_page_flip = &rs600_pre_page_flip,
@@ -1791,6 +1794,7 @@ static struct radeon_asic trinity_asic = {
                 .print_power_state = &trinity_dpm_print_power_state,
                 .debugfs_print_current_performance_level = &trinity_dpm_debugfs_print_current_performance_level,
                 .force_performance_level = &trinity_dpm_force_performance_level,
+                .enable_bapm = &trinity_dpm_enable_bapm,
         },
         .pflip = {
                 .pre_page_flip = &evergreen_pre_page_flip,
@@ -2166,6 +2170,7 @@ static struct radeon_asic kv_asic = {
                 .debugfs_print_current_performance_level = &kv_dpm_debugfs_print_current_performance_level,
                 .force_performance_level = &kv_dpm_force_performance_level,
                 .powergate_uvd = &kv_dpm_powergate_uvd,
+                .enable_bapm = &kv_dpm_enable_bapm,
         },
         .pflip = {
                 .pre_page_flip = &evergreen_pre_page_flip,
@@ -2390,7 +2395,7 @@ int radeon_asic_init(struct radeon_device *rdev)
                                 RADEON_CG_SUPPORT_HDP_LS |
                                 RADEON_CG_SUPPORT_HDP_MGCG;
                         rdev->pg_flags = 0 |
-                                /*RADEON_PG_SUPPORT_GFX_CG | */
+                                /*RADEON_PG_SUPPORT_GFX_PG | */
                                 RADEON_PG_SUPPORT_SDMA;
                         break;
                 case CHIP_OLAND:
@@ -2479,7 +2484,7 @@ int radeon_asic_init(struct radeon_device *rdev)
                                 RADEON_CG_SUPPORT_HDP_LS |
                                 RADEON_CG_SUPPORT_HDP_MGCG;
                         rdev->pg_flags = 0;
-                                /*RADEON_PG_SUPPORT_GFX_CG |
+                                /*RADEON_PG_SUPPORT_GFX_PG |
                                 RADEON_PG_SUPPORT_GFX_SMG |
                                 RADEON_PG_SUPPORT_GFX_DMG |
                                 RADEON_PG_SUPPORT_UVD |
@@ -2507,7 +2512,7 @@ int radeon_asic_init(struct radeon_device *rdev)
                                 RADEON_CG_SUPPORT_HDP_LS |
                                 RADEON_CG_SUPPORT_HDP_MGCG;
                         rdev->pg_flags = 0;
-                                /*RADEON_PG_SUPPORT_GFX_CG |
+                                /*RADEON_PG_SUPPORT_GFX_PG |
                                 RADEON_PG_SUPPORT_GFX_SMG |
                                 RADEON_PG_SUPPORT_UVD |
                                 RADEON_PG_SUPPORT_VCE |
diff --git a/drivers/gpu/drm/radeon/radeon_asic.h b/drivers/gpu/drm/radeon/radeon_asic.h
index 818bbe6b884b..70c29d5e080d 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.h
+++ b/drivers/gpu/drm/radeon/radeon_asic.h
@@ -389,6 +389,7 @@ int r600_mc_wait_for_idle(struct radeon_device *rdev);
 u32 r600_get_xclk(struct radeon_device *rdev);
 uint64_t r600_get_gpu_clock_counter(struct radeon_device *rdev);
 int rv6xx_get_temp(struct radeon_device *rdev);
+int r600_set_uvd_clocks(struct radeon_device *rdev, u32 vclk, u32 dclk);
 int r600_dpm_pre_set_power_state(struct radeon_device *rdev);
 void r600_dpm_post_set_power_state(struct radeon_device *rdev);
 /* r600 dma */
@@ -428,6 +429,8 @@ void rs780_dpm_print_power_state(struct radeon_device *rdev,
                                  struct radeon_ps *ps);
 void rs780_dpm_debugfs_print_current_performance_level(struct radeon_device *rdev,
                                                        struct seq_file *m);
+int rs780_dpm_force_performance_level(struct radeon_device *rdev,
+                                      enum radeon_dpm_forced_level level);
 
 /*
  * rv770,rv730,rv710,rv740
@@ -625,6 +628,7 @@ void trinity_dpm_debugfs_print_current_performance_level(struct radeon_device *r
                                                          struct seq_file *m);
 int trinity_dpm_force_performance_level(struct radeon_device *rdev,
                                         enum radeon_dpm_forced_level level);
+void trinity_dpm_enable_bapm(struct radeon_device *rdev, bool enable);
 
 /* DCE6 - SI */
 void dce6_bandwidth_update(struct radeon_device *rdev);
@@ -781,6 +785,7 @@ void kv_dpm_debugfs_print_current_performance_level(struct radeon_device *rdev,
 int kv_dpm_force_performance_level(struct radeon_device *rdev,
                                    enum radeon_dpm_forced_level level);
 void kv_dpm_powergate_uvd(struct radeon_device *rdev, bool gate);
+void kv_dpm_enable_bapm(struct radeon_device *rdev, bool enable);
 
 /* uvd v1.0 */
 uint32_t uvd_v1_0_get_rptr(struct radeon_device *rdev,
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 2399f25ec037..79159b5da05b 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -396,6 +396,21 @@ static int radeon_connector_set_property(struct drm_connector *connector, struct
                 }
         }
 
+        if (property == rdev->mode_info.audio_property) {
+                struct radeon_connector *radeon_connector = to_radeon_connector(connector);
+                /* need to find digital encoder on connector */
+                encoder = radeon_find_encoder(connector, DRM_MODE_ENCODER_TMDS);
+                if (!encoder)
+                        return 0;
+
+                radeon_encoder = to_radeon_encoder(encoder);
+
+                if (radeon_connector->audio != val) {
+                        radeon_connector->audio = val;
+                        radeon_property_change_mode(&radeon_encoder->base);
+                }
+        }
+
         if (property == rdev->mode_info.underscan_property) {
                 /* need to find digital encoder on connector */
                 encoder = radeon_find_encoder(connector, DRM_MODE_ENCODER_TMDS);
@@ -1420,7 +1435,7 @@ radeon_dp_detect(struct drm_connector *connector, bool force)
                                 if (radeon_dp_getdpcd(radeon_connector))
                                         ret = connector_status_connected;
                         } else {
-                                /* try non-aux ddc (DP to DVI/HMDI/etc. adapter) */
+                                /* try non-aux ddc (DP to DVI/HDMI/etc. adapter) */
                                 if (radeon_ddc_probe(radeon_connector, false))
                                         ret = connector_status_connected;
                         }
@@ -1489,6 +1504,24 @@ static const struct drm_connector_funcs radeon_dp_connector_funcs = {
         .force = radeon_dvi_force,
 };
 
+static const struct drm_connector_funcs radeon_edp_connector_funcs = {
+        .dpms = drm_helper_connector_dpms,
+        .detect = radeon_dp_detect,
+        .fill_modes = drm_helper_probe_single_connector_modes,
+        .set_property = radeon_lvds_set_property,
+        .destroy = radeon_dp_connector_destroy,
+        .force = radeon_dvi_force,
+};
+
+static const struct drm_connector_funcs radeon_lvds_bridge_connector_funcs = {
+        .dpms = drm_helper_connector_dpms,
+        .detect = radeon_dp_detect,
+        .fill_modes = drm_helper_probe_single_connector_modes,
+        .set_property = radeon_lvds_set_property,
+        .destroy = radeon_dp_connector_destroy,
+        .force = radeon_dvi_force,
+};
+
 void
 radeon_add_atom_connector(struct drm_device *dev,
                           uint32_t connector_id,
@@ -1580,8 +1613,6 @@ radeon_add_atom_connector(struct drm_device *dev,
                         goto failed;
                 radeon_dig_connector->igp_lane_info = igp_lane_info;
                 radeon_connector->con_priv = radeon_dig_connector;
-                drm_connector_init(dev, &radeon_connector->base, &radeon_dp_connector_funcs, connector_type);
-                drm_connector_helper_add(&radeon_connector->base, &radeon_dp_connector_helper_funcs);
                 if (i2c_bus->valid) {
                         /* add DP i2c bus */
                         if (connector_type == DRM_MODE_CONNECTOR_eDP)
@@ -1598,6 +1629,10 @@ radeon_add_atom_connector(struct drm_device *dev,
                 case DRM_MODE_CONNECTOR_VGA:
                 case DRM_MODE_CONNECTOR_DVIA:
                 default:
+                        drm_connector_init(dev, &radeon_connector->base,
+                                           &radeon_dp_connector_funcs, connector_type);
+                        drm_connector_helper_add(&radeon_connector->base,
+                                                 &radeon_dp_connector_helper_funcs);
                         connector->interlace_allowed = true;
                         connector->doublescan_allowed = true;
                         radeon_connector->dac_load_detect = true;
@@ -1610,6 +1645,10 @@ radeon_add_atom_connector(struct drm_device *dev,
                 case DRM_MODE_CONNECTOR_HDMIA:
                 case DRM_MODE_CONNECTOR_HDMIB:
                 case DRM_MODE_CONNECTOR_DisplayPort:
+                        drm_connector_init(dev, &radeon_connector->base,
+                                           &radeon_dp_connector_funcs, connector_type);
+                        drm_connector_helper_add(&radeon_connector->base,
+                                                 &radeon_dp_connector_helper_funcs);
                         drm_object_attach_property(&radeon_connector->base.base,
                                                       rdev->mode_info.underscan_property,
                                                       UNDERSCAN_OFF);
@@ -1619,6 +1658,9 @@ radeon_add_atom_connector(struct drm_device *dev,
                         drm_object_attach_property(&radeon_connector->base.base,
                                                       rdev->mode_info.underscan_vborder_property,
                                                       0);
+                        drm_object_attach_property(&radeon_connector->base.base,
+                                                   rdev->mode_info.audio_property,
+                                                   RADEON_AUDIO_DISABLE);
                         subpixel_order = SubPixelHorizontalRGB;
                         connector->interlace_allowed = true;
                         if (connector_type == DRM_MODE_CONNECTOR_HDMIB)
@@ -1634,6 +1676,10 @@ radeon_add_atom_connector(struct drm_device *dev,
                         break;
                 case DRM_MODE_CONNECTOR_LVDS:
                 case DRM_MODE_CONNECTOR_eDP:
+                        drm_connector_init(dev, &radeon_connector->base,
+                                           &radeon_lvds_bridge_connector_funcs, connector_type);
+                        drm_connector_helper_add(&radeon_connector->base,
+                                                 &radeon_dp_connector_helper_funcs);
                         drm_object_attach_property(&radeon_connector->base.base,
                                                       dev->mode_config.scaling_mode_property,
                                                       DRM_MODE_SCALE_FULLSCREEN);
@@ -1708,6 +1754,11 @@ radeon_add_atom_connector(struct drm_device *dev,
                                                               rdev->mode_info.underscan_vborder_property,
                                                               0);
                         }
+                        if (ASIC_IS_DCE2(rdev)) {
+                                drm_object_attach_property(&radeon_connector->base.base,
+                                                              rdev->mode_info.audio_property,
+                                                              RADEON_AUDIO_DISABLE);
+                        }
                         if (connector_type == DRM_MODE_CONNECTOR_DVII) {
                                 radeon_connector->dac_load_detect = true;
                                 drm_object_attach_property(&radeon_connector->base.base,
@@ -1748,6 +1799,11 @@ radeon_add_atom_connector(struct drm_device *dev,
                                                               rdev->mode_info.underscan_vborder_property,
                                                               0);
                         }
+                        if (ASIC_IS_DCE2(rdev)) {
+                                drm_object_attach_property(&radeon_connector->base.base,
+                                                              rdev->mode_info.audio_property,
+                                                              RADEON_AUDIO_DISABLE);
+                        }
                         subpixel_order = SubPixelHorizontalRGB;
                         connector->interlace_allowed = true;
                         if (connector_type == DRM_MODE_CONNECTOR_HDMIB)
@@ -1787,6 +1843,11 @@ radeon_add_atom_connector(struct drm_device *dev,
                                                               rdev->mode_info.underscan_vborder_property,
                                                               0);
                         }
+                        if (ASIC_IS_DCE2(rdev)) {
+                                drm_object_attach_property(&radeon_connector->base.base,
+                                                              rdev->mode_info.audio_property,
+                                                              RADEON_AUDIO_DISABLE);
+                        }
                         connector->interlace_allowed = true;
                         /* in theory with a DP to VGA converter... */
                         connector->doublescan_allowed = false;
@@ -1797,7 +1858,7 @@ radeon_add_atom_connector(struct drm_device *dev,
                                 goto failed;
                         radeon_dig_connector->igp_lane_info = igp_lane_info;
                         radeon_connector->con_priv = radeon_dig_connector;
-                        drm_connector_init(dev, &radeon_connector->base, &radeon_dp_connector_funcs, connector_type);
+                        drm_connector_init(dev, &radeon_connector->base, &radeon_edp_connector_funcs, connector_type);
                         drm_connector_helper_add(&radeon_connector->base, &radeon_dp_connector_helper_funcs);
                         if (i2c_bus->valid) {
                                 /* add DP i2c bus */
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index a56084410372..ac6ece61a476 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -28,6 +28,7 @@
 #include <drm/radeon_drm.h>
 #include "radeon_reg.h"
 #include "radeon.h"
+#include "radeon_trace.h"
 
 static int radeon_cs_parser_relocs(struct radeon_cs_parser *p)
 {
@@ -80,9 +81,11 @@ static int radeon_cs_parser_relocs(struct radeon_cs_parser *p)
                 p->relocs[i].lobj.bo = p->relocs[i].robj;
                 p->relocs[i].lobj.written = !!r->write_domain;
 
-                /* the first reloc of an UVD job is the
-                   msg and that must be in VRAM */
-                if (p->ring == R600_RING_TYPE_UVD_INDEX && i == 0) {
+                /* the first reloc of an UVD job is the msg and that must be in
+                   VRAM, also but everything into VRAM on AGP cards to avoid
+                   image corruptions */
+                if (p->ring == R600_RING_TYPE_UVD_INDEX &&
+                    (i == 0 || p->rdev->flags & RADEON_IS_AGP)) {
                         /* TODO: is this still needed for NI+ ? */
                         p->relocs[i].lobj.domain =
                                 RADEON_GEM_DOMAIN_VRAM;
@@ -559,6 +562,8 @@ int radeon_cs_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
                 return r;
         }
 
+        trace_radeon_cs(&parser);
+
         r = radeon_cs_ib_chunk(rdev, &parser);
         if (r) {
                 goto out;
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 16cb8792b1e6..e29faa73b574 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1249,6 +1249,17 @@ int radeon_device_init(struct radeon_device *rdev,
         /* Registers mapping */
         /* TODO: block userspace mapping of io register */
         spin_lock_init(&rdev->mmio_idx_lock);
+        spin_lock_init(&rdev->smc_idx_lock);
+        spin_lock_init(&rdev->pll_idx_lock);
+        spin_lock_init(&rdev->mc_idx_lock);
+        spin_lock_init(&rdev->pcie_idx_lock);
+        spin_lock_init(&rdev->pciep_idx_lock);
+        spin_lock_init(&rdev->pif_idx_lock);
+        spin_lock_init(&rdev->cg_idx_lock);
+        spin_lock_init(&rdev->uvd_idx_lock);
+        spin_lock_init(&rdev->rcu_idx_lock);
+        spin_lock_init(&rdev->didt_idx_lock);
+        spin_lock_init(&rdev->end_idx_lock);
         if (rdev->family >= CHIP_BONAIRE) {
                 rdev->rmmio_base = pci_resource_start(rdev->pdev, 5);
                 rdev->rmmio_size = pci_resource_len(rdev->pdev, 5);
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index b055bddaa94c..0d1aa050d41d 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -1172,6 +1172,12 @@ static struct drm_prop_enum_list radeon_underscan_enum_list[] =
         { UNDERSCAN_AUTO, "auto" },
 };
 
+static struct drm_prop_enum_list radeon_audio_enum_list[] =
+{       { RADEON_AUDIO_DISABLE, "off" },
+        { RADEON_AUDIO_ENABLE, "on" },
+        { RADEON_AUDIO_AUTO, "auto" },
+};
+
 static int radeon_modeset_create_props(struct radeon_device *rdev)
 {
         int sz;
@@ -1222,6 +1228,12 @@ static int radeon_modeset_create_props(struct radeon_device *rdev)
         if (!rdev->mode_info.underscan_vborder_property)
                 return -ENOMEM;
 
+        sz = ARRAY_SIZE(radeon_audio_enum_list);
+        rdev->mode_info.audio_property =
+                drm_property_create_enum(rdev->ddev, 0,
+                                         "audio",
+                                         radeon_audio_enum_list, sz);
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index cb4445f55a96..cdd12dcd988b 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -153,7 +153,7 @@ int radeon_benchmarking = 0;
 int radeon_testing = 0;
 int radeon_connector_table = 0;
 int radeon_tv = 1;
-int radeon_audio = 0;
+int radeon_audio = 1;
 int radeon_disp_priority = 0;
 int radeon_hw_i2c = 0;
 int radeon_pcie_gen2 = -1;
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
index d908d8d68f6b..ef63d3f00b2f 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -247,6 +247,8 @@ struct radeon_mode_info {
         struct drm_property *underscan_property;
         struct drm_property *underscan_hborder_property;
         struct drm_property *underscan_vborder_property;
+        /* audio */
+        struct drm_property *audio_property;
         /* hardcoded DFP edid from BIOS */
         struct edid *bios_hardcoded_edid;
         int bios_hardcoded_edid_size;
@@ -471,6 +473,12 @@ struct radeon_router {
         u8 cd_mux_state;
 };
 
+enum radeon_connector_audio {
+        RADEON_AUDIO_DISABLE = 0,
+        RADEON_AUDIO_ENABLE = 1,
+        RADEON_AUDIO_AUTO = 2
+};
+
 struct radeon_connector {
         struct drm_connector base;
         uint32_t connector_id;
@@ -489,6 +497,7 @@ struct radeon_connector {
         struct radeon_hpd hpd;
         struct radeon_router router;
         struct radeon_i2c_chan *router_bus;
+        enum radeon_connector_audio audio;
 };
 
 struct radeon_framebuffer {
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index d7555369a3e5..87e1d69e8fdb 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -67,7 +67,16 @@ int radeon_pm_get_type_index(struct radeon_device *rdev,
 
 void radeon_pm_acpi_event_handler(struct radeon_device *rdev)
 {
-        if (rdev->pm.pm_method == PM_METHOD_PROFILE) {
+        if ((rdev->pm.pm_method == PM_METHOD_DPM) && rdev->pm.dpm_enabled) {
+                mutex_lock(&rdev->pm.mutex);
+                if (power_supply_is_system_supplied() > 0)
+                        rdev->pm.dpm.ac_power = true;
+                else
+                        rdev->pm.dpm.ac_power = false;
+                if (rdev->asic->dpm.enable_bapm)
+                        radeon_dpm_enable_bapm(rdev, rdev->pm.dpm.ac_power);
+                mutex_unlock(&rdev->pm.mutex);
+        } else if (rdev->pm.pm_method == PM_METHOD_PROFILE) {
                 if (rdev->pm.profile == PM_PROFILE_AUTO) {
                         mutex_lock(&rdev->pm.mutex);
                         radeon_pm_update_profile(rdev);
@@ -333,7 +342,7 @@ static ssize_t radeon_get_pm_profile(struct device *dev,
                                      struct device_attribute *attr,
                                      char *buf)
 {
-        struct drm_device *ddev = pci_get_drvdata(to_pci_dev(dev));
+        struct drm_device *ddev = dev_get_drvdata(dev);
         struct radeon_device *rdev = ddev->dev_private;
         int cp = rdev->pm.profile;
 
@@ -349,7 +358,7 @@ static ssize_t radeon_set_pm_profile(struct device *dev,
                                      const char *buf,
                                      size_t count)
 {
-        struct drm_device *ddev = pci_get_drvdata(to_pci_dev(dev));
+        struct drm_device *ddev = dev_get_drvdata(dev);
         struct radeon_device *rdev = ddev->dev_private;
 
         mutex_lock(&rdev->pm.mutex);
@@ -383,7 +392,7 @@ static ssize_t radeon_get_pm_method(struct device *dev,
                                     struct device_attribute *attr,
                                     char *buf)
 {
-        struct drm_device *ddev = pci_get_drvdata(to_pci_dev(dev));
+        struct drm_device *ddev = dev_get_drvdata(dev);
         struct radeon_device *rdev = ddev->dev_private;
         int pm = rdev->pm.pm_method;
 
@@ -397,7 +406,7 @@ static ssize_t radeon_set_pm_method(struct device *dev,
                                     const char *buf,
                                     size_t count)
 {
-        struct drm_device *ddev = pci_get_drvdata(to_pci_dev(dev));
+        struct drm_device *ddev = dev_get_drvdata(dev);
         struct radeon_device *rdev = ddev->dev_private;
 
         /* we don't support the legacy modes with dpm */
@@ -433,7 +442,7 @@ static ssize_t radeon_get_dpm_state(struct device *dev,
                                     struct device_attribute *attr,
                                     char *buf)
 {
-        struct drm_device *ddev = pci_get_drvdata(to_pci_dev(dev));
+        struct drm_device *ddev = dev_get_drvdata(dev);
         struct radeon_device *rdev = ddev->dev_private;
         enum radeon_pm_state_type pm = rdev->pm.dpm.user_state;
 
@@ -447,7 +456,7 @@ static ssize_t radeon_set_dpm_state(struct device *dev,
                                     const char *buf,
                                     size_t count)
 {
-        struct drm_device *ddev = pci_get_drvdata(to_pci_dev(dev));
+        struct drm_device *ddev = dev_get_drvdata(dev);
         struct radeon_device *rdev = ddev->dev_private;
 
         mutex_lock(&rdev->pm.mutex);
@@ -472,7 +481,7 @@ static ssize_t radeon_get_dpm_forced_performance_level(struct device *dev,
                                                        struct device_attribute *attr,
                                                        char *buf)
 {
-        struct drm_device *ddev = pci_get_drvdata(to_pci_dev(dev));
+        struct drm_device *ddev = dev_get_drvdata(dev);
         struct radeon_device *rdev = ddev->dev_private;
         enum radeon_dpm_forced_level level = rdev->pm.dpm.forced_level;
 
@@ -486,7 +495,7 @@ static ssize_t radeon_set_dpm_forced_performance_level(struct device *dev,
                                                        const char *buf,
                                                        size_t count)
 {
-        struct drm_device *ddev = pci_get_drvdata(to_pci_dev(dev));
+        struct drm_device *ddev = dev_get_drvdata(dev);
         struct radeon_device *rdev = ddev->dev_private;
         enum radeon_dpm_forced_level level;
         int ret = 0;
@@ -524,7 +533,7 @@ static ssize_t radeon_hwmon_show_temp(struct device *dev,
                                       struct device_attribute *attr,
                                       char *buf)
 {
-        struct drm_device *ddev = pci_get_drvdata(to_pci_dev(dev));
+        struct drm_device *ddev = dev_get_drvdata(dev);
         struct radeon_device *rdev = ddev->dev_private;
         int temp;
 
@@ -536,6 +545,23 @@ static ssize_t radeon_hwmon_show_temp(struct device *dev,
         return snprintf(buf, PAGE_SIZE, "%d\n", temp);
 }
 
+static ssize_t radeon_hwmon_show_temp_thresh(struct device *dev,
+                                             struct device_attribute *attr,
+                                             char *buf)
+{
+        struct drm_device *ddev = dev_get_drvdata(dev);
+        struct radeon_device *rdev = ddev->dev_private;
+        int hyst = to_sensor_dev_attr(attr)->index;
+        int temp;
+
+        if (hyst)
+                temp = rdev->pm.dpm.thermal.min_temp;
+        else
+                temp = rdev->pm.dpm.thermal.max_temp;
+
+        return snprintf(buf, PAGE_SIZE, "%d\n", temp);
+}
+
 static ssize_t radeon_hwmon_show_name(struct device *dev,
                                       struct device_attribute *attr,
                                       char *buf)
@@ -544,16 +570,37 @@ static ssize_t radeon_hwmon_show_name(struct device *dev,
 }
 
 static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO, radeon_hwmon_show_temp, NULL, 0);
+static SENSOR_DEVICE_ATTR(temp1_crit, S_IRUGO, radeon_hwmon_show_temp_thresh, NULL, 0);
+static SENSOR_DEVICE_ATTR(temp1_crit_hyst, S_IRUGO, radeon_hwmon_show_temp_thresh, NULL, 1);
 static SENSOR_DEVICE_ATTR(name, S_IRUGO, radeon_hwmon_show_name, NULL, 0);
 
 static struct attribute *hwmon_attributes[] = {
         &sensor_dev_attr_temp1_input.dev_attr.attr,
+        &sensor_dev_attr_temp1_crit.dev_attr.attr,
+        &sensor_dev_attr_temp1_crit_hyst.dev_attr.attr,
         &sensor_dev_attr_name.dev_attr.attr,
         NULL
 };
 
+static umode_t hwmon_attributes_visible(struct kobject *kobj,
+                                        struct attribute *attr, int index)
+{
+        struct device *dev = container_of(kobj, struct device, kobj);
+        struct drm_device *ddev = dev_get_drvdata(dev);
+        struct radeon_device *rdev = ddev->dev_private;
+
+        /* Skip limit attributes if DPM is not enabled */
+        if (rdev->pm.pm_method != PM_METHOD_DPM &&
+            (attr == &sensor_dev_attr_temp1_crit.dev_attr.attr ||
+             attr == &sensor_dev_attr_temp1_crit_hyst.dev_attr.attr))
+                return 0;
+
+        return attr->mode;
+}
+
 static const struct attribute_group hwmon_attrgroup = {
         .attrs = hwmon_attributes,
+        .is_visible = hwmon_attributes_visible,
 };
 
 static int radeon_hwmon_init(struct radeon_device *rdev)
@@ -870,10 +917,13 @@ static void radeon_dpm_change_power_state_locked(struct radeon_device *rdev)
 
         radeon_dpm_post_set_power_state(rdev);
 
-        /* force low perf level for thermal */
-        if (rdev->pm.dpm.thermal_active &&
-            rdev->asic->dpm.force_performance_level) {
-                radeon_dpm_force_performance_level(rdev, RADEON_DPM_FORCED_LEVEL_LOW);
+        if (rdev->asic->dpm.force_performance_level) {
+                if (rdev->pm.dpm.thermal_active)
+                        /* force low perf level for thermal */
+                        radeon_dpm_force_performance_level(rdev, RADEON_DPM_FORCED_LEVEL_LOW);
+                else
+                        /* otherwise, enable auto */
+                        radeon_dpm_force_performance_level(rdev, RADEON_DPM_FORCED_LEVEL_AUTO);
         }
 
 done:
@@ -1102,9 +1152,10 @@ static int radeon_pm_init_dpm(struct radeon_device *rdev)
 {
         int ret;
 
-        /* default to performance state */
+        /* default to balanced state */
         rdev->pm.dpm.state = POWER_STATE_TYPE_BALANCED;
         rdev->pm.dpm.user_state = POWER_STATE_TYPE_BALANCED;
+        rdev->pm.dpm.forced_level = RADEON_DPM_FORCED_LEVEL_AUTO;
         rdev->pm.default_sclk = rdev->clock.default_sclk;
         rdev->pm.default_mclk = rdev->clock.default_mclk;
         rdev->pm.current_sclk = rdev->clock.default_sclk;
diff --git a/drivers/gpu/drm/radeon/radeon_trace.h b/drivers/gpu/drm/radeon/radeon_trace.h
index eafd8160a155..f7e367815964 100644
--- a/drivers/gpu/drm/radeon/radeon_trace.h
+++ b/drivers/gpu/drm/radeon/radeon_trace.h
@@ -27,6 +27,26 @@ TRACE_EVENT(radeon_bo_create,
             TP_printk("bo=%p, pages=%u", __entry->bo, __entry->pages)
 );
 
+TRACE_EVENT(radeon_cs,
+            TP_PROTO(struct radeon_cs_parser *p),
+            TP_ARGS(p),
+            TP_STRUCT__entry(
+                             __field(u32, ring)
+                             __field(u32, dw)
+                             __field(u32, fences)
+                             ),
+
+            TP_fast_assign(
+                           __entry->ring = p->ring;
+                           __entry->dw = p->chunks[p->chunk_ib_idx].length_dw;
+                           __entry->fences = radeon_fence_count_emitted(
+                                p->rdev, p->ring);
+                           ),
+            TP_printk("ring=%u, dw=%u, fences=%u",
+                      __entry->ring, __entry->dw,
+                      __entry->fences)
+);
+
 DECLARE_EVENT_CLASS(radeon_fence_request,
 
             TP_PROTO(struct drm_device *dev, u32 seqno),
@@ -53,13 +73,6 @@ DEFINE_EVENT(radeon_fence_request, radeon_fence_emit,
             TP_ARGS(dev, seqno)
 );
 
-DEFINE_EVENT(radeon_fence_request, radeon_fence_retire,
-
-            TP_PROTO(struct drm_device *dev, u32 seqno),
-
-            TP_ARGS(dev, seqno)
-);
-
 DEFINE_EVENT(radeon_fence_request, radeon_fence_wait_begin,
 
             TP_PROTO(struct drm_device *dev, u32 seqno),
diff --git a/drivers/gpu/drm/radeon/rs400.c b/drivers/gpu/drm/radeon/rs400.c
index b8074a8ec75a..9566b5940a5a 100644
--- a/drivers/gpu/drm/radeon/rs400.c
+++ b/drivers/gpu/drm/radeon/rs400.c
@@ -274,19 +274,26 @@ static void rs400_mc_init(struct radeon_device *rdev)
 
 uint32_t rs400_mc_rreg(struct radeon_device *rdev, uint32_t reg)
 {
+        unsigned long flags;
         uint32_t r;
 
+        spin_lock_irqsave(&rdev->mc_idx_lock, flags);
         WREG32(RS480_NB_MC_INDEX, reg & 0xff);
         r = RREG32(RS480_NB_MC_DATA);
         WREG32(RS480_NB_MC_INDEX, 0xff);
+        spin_unlock_irqrestore(&rdev->mc_idx_lock, flags);
         return r;
 }
 
 void rs400_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
 {
+        unsigned long flags;
+
+        spin_lock_irqsave(&rdev->mc_idx_lock, flags);
         WREG32(RS480_NB_MC_INDEX, ((reg) & 0xff) | RS480_NB_MC_IND_WR_EN);
         WREG32(RS480_NB_MC_DATA, (v));
         WREG32(RS480_NB_MC_INDEX, 0xff);
+        spin_unlock_irqrestore(&rdev->mc_idx_lock, flags);
 }
 
 #if defined(CONFIG_DEBUG_FS)
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index 670b555d2ca2..6acba8017b9a 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -847,16 +847,26 @@ void rs600_bandwidth_update(struct radeon_device *rdev)
 
 uint32_t rs600_mc_rreg(struct radeon_device *rdev, uint32_t reg)
 {
+        unsigned long flags;
+        u32 r;
+
+        spin_lock_irqsave(&rdev->mc_idx_lock, flags);
         WREG32(R_000070_MC_IND_INDEX, S_000070_MC_IND_ADDR(reg) |
                 S_000070_MC_IND_CITF_ARB0(1));
-        return RREG32(R_000074_MC_IND_DATA);
+        r = RREG32(R_000074_MC_IND_DATA);
+        spin_unlock_irqrestore(&rdev->mc_idx_lock, flags);
+        return r;
 }
 
 void rs600_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
 {
+        unsigned long flags;
+
+        spin_lock_irqsave(&rdev->mc_idx_lock, flags);
         WREG32(R_000070_MC_IND_INDEX, S_000070_MC_IND_ADDR(reg) |
                 S_000070_MC_IND_CITF_ARB0(1) | S_000070_MC_IND_WR_EN(1));
         WREG32(R_000074_MC_IND_DATA, v);
+        spin_unlock_irqrestore(&rdev->mc_idx_lock, flags);
 }
 
 static void rs600_debugfs(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index d8ddfb34545d..1447d794c22a 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -631,20 +631,27 @@ void rs690_bandwidth_update(struct radeon_device *rdev)
 
 uint32_t rs690_mc_rreg(struct radeon_device *rdev, uint32_t reg)
 {
+        unsigned long flags;
         uint32_t r;
 
+        spin_lock_irqsave(&rdev->mc_idx_lock, flags);
         WREG32(R_000078_MC_INDEX, S_000078_MC_IND_ADDR(reg));
         r = RREG32(R_00007C_MC_DATA);
         WREG32(R_000078_MC_INDEX, ~C_000078_MC_IND_ADDR);
+        spin_unlock_irqrestore(&rdev->mc_idx_lock, flags);
         return r;
 }
 
 void rs690_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
 {
+        unsigned long flags;
+
+        spin_lock_irqsave(&rdev->mc_idx_lock, flags);
         WREG32(R_000078_MC_INDEX, S_000078_MC_IND_ADDR(reg) |
                 S_000078_MC_IND_WR_EN(1));
         WREG32(R_00007C_MC_DATA, v);
         WREG32(R_000078_MC_INDEX, 0x7F);
+        spin_unlock_irqrestore(&rdev->mc_idx_lock, flags);
 }
 
 static void rs690_mc_program(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/rs780_dpm.c b/drivers/gpu/drm/radeon/rs780_dpm.c
index d1a1ce73bd45..6af8505cf4d2 100644
--- a/drivers/gpu/drm/radeon/rs780_dpm.c
+++ b/drivers/gpu/drm/radeon/rs780_dpm.c
@@ -62,9 +62,7 @@ static void rs780_get_pm_mode_parameters(struct radeon_device *rdev)
                         radeon_crtc = to_radeon_crtc(crtc);
                         pi->crtc_id = radeon_crtc->crtc_id;
                         if (crtc->mode.htotal && crtc->mode.vtotal)
-                                pi->refresh_rate =
-                                        (crtc->mode.clock * 1000) /
-                                        (crtc->mode.htotal * crtc->mode.vtotal);
+                                pi->refresh_rate = drm_mode_vrefresh(&crtc->mode);
                         break;
                 }
         }
@@ -376,9 +374,8 @@ static void rs780_disable_vbios_powersaving(struct radeon_device *rdev)
         WREG32_P(CG_INTGFX_MISC, 0, ~0xFFF00000);
 }
 
-static void rs780_force_voltage_to_high(struct radeon_device *rdev)
+static void rs780_force_voltage(struct radeon_device *rdev, u16 voltage)
 {
-        struct igp_power_info *pi = rs780_get_pi(rdev);
         struct igp_ps *current_state = rs780_get_ps(rdev->pm.dpm.current_ps);
 
         if ((current_state->max_voltage == RS780_VDDC_LEVEL_HIGH) &&
@@ -390,7 +387,7 @@ static void rs780_force_voltage_to_high(struct radeon_device *rdev)
         udelay(1);
 
         WREG32_P(FVTHROT_PWM_CTRL_REG0,
-                 STARTING_PWM_HIGHTIME(pi->max_voltage),
+                 STARTING_PWM_HIGHTIME(voltage),
                  ~STARTING_PWM_HIGHTIME_MASK);
 
         WREG32_P(FVTHROT_PWM_CTRL_REG0,
@@ -404,6 +401,26 @@ static void rs780_force_voltage_to_high(struct radeon_device *rdev)
         WREG32_P(GFX_MACRO_BYPASS_CNTL, 0, ~SPLL_BYPASS_CNTL);
 }
 
+static void rs780_force_fbdiv(struct radeon_device *rdev, u32 fb_div)
+{
+        struct igp_ps *current_state = rs780_get_ps(rdev->pm.dpm.current_ps);
+
+        if (current_state->sclk_low == current_state->sclk_high)
+                return;
+
+        WREG32_P(GFX_MACRO_BYPASS_CNTL, SPLL_BYPASS_CNTL, ~SPLL_BYPASS_CNTL);
+
+        WREG32_P(FVTHROT_FBDIV_REG2, FORCED_FEEDBACK_DIV(fb_div),
+                 ~FORCED_FEEDBACK_DIV_MASK);
+        WREG32_P(FVTHROT_FBDIV_REG1, STARTING_FEEDBACK_DIV(fb_div),
+                 ~STARTING_FEEDBACK_DIV_MASK);
+        WREG32_P(FVTHROT_FBDIV_REG1, FORCE_FEEDBACK_DIV, ~FORCE_FEEDBACK_DIV);
+
+        udelay(100);
+
+        WREG32_P(GFX_MACRO_BYPASS_CNTL, 0, ~SPLL_BYPASS_CNTL);
+}
+
 static int rs780_set_engine_clock_scaling(struct radeon_device *rdev,
                                           struct radeon_ps *new_ps,
                                           struct radeon_ps *old_ps)
@@ -432,17 +449,13 @@ static int rs780_set_engine_clock_scaling(struct radeon_device *rdev,
         if (ret)
                 return ret;
 
-        WREG32_P(GFX_MACRO_BYPASS_CNTL, SPLL_BYPASS_CNTL, ~SPLL_BYPASS_CNTL);
-
-        WREG32_P(FVTHROT_FBDIV_REG2, FORCED_FEEDBACK_DIV(max_dividers.fb_div),
-                 ~FORCED_FEEDBACK_DIV_MASK);
-        WREG32_P(FVTHROT_FBDIV_REG1, STARTING_FEEDBACK_DIV(max_dividers.fb_div),
-                 ~STARTING_FEEDBACK_DIV_MASK);
-        WREG32_P(FVTHROT_FBDIV_REG1, FORCE_FEEDBACK_DIV, ~FORCE_FEEDBACK_DIV);
-
-        udelay(100);
+        if ((min_dividers.ref_div != max_dividers.ref_div) ||
+            (min_dividers.post_div != max_dividers.post_div) ||
+            (max_dividers.ref_div != current_max_dividers.ref_div) ||
+            (max_dividers.post_div != current_max_dividers.post_div))
+                return -EINVAL;
 
-        WREG32_P(GFX_MACRO_BYPASS_CNTL, 0, ~SPLL_BYPASS_CNTL);
+        rs780_force_fbdiv(rdev, max_dividers.fb_div);
 
         if (max_dividers.fb_div > min_dividers.fb_div) {
                 WREG32_P(FVTHROT_FBDIV_REG0,
@@ -486,6 +499,9 @@ static void rs780_activate_engine_clk_scaling(struct radeon_device *rdev,
             (new_state->sclk_low == old_state->sclk_low))
                 return;
 
+        if (new_state->sclk_high == new_state->sclk_low)
+                return;
+
         rs780_clk_scaling_enable(rdev, true);
 }
 
@@ -649,7 +665,7 @@ int rs780_dpm_set_power_state(struct radeon_device *rdev)
         rs780_set_uvd_clock_before_set_eng_clock(rdev, new_ps, old_ps);
 
         if (pi->voltage_control) {
-                rs780_force_voltage_to_high(rdev);
+                rs780_force_voltage(rdev, pi->max_voltage);
                 mdelay(5);
         }
 
@@ -717,14 +733,18 @@ static void rs780_parse_pplib_non_clock_info(struct radeon_device *rdev,
         if (ATOM_PPLIB_NONCLOCKINFO_VER1 < table_rev) {
                 rps->vclk = le32_to_cpu(non_clock_info->ulVCLK);
                 rps->dclk = le32_to_cpu(non_clock_info->ulDCLK);
-        } else if (r600_is_uvd_state(rps->class, rps->class2)) {
-                rps->vclk = RS780_DEFAULT_VCLK_FREQ;
-                rps->dclk = RS780_DEFAULT_DCLK_FREQ;
         } else {
                 rps->vclk = 0;
                 rps->dclk = 0;
         }
 
+        if (r600_is_uvd_state(rps->class, rps->class2)) {
+                if ((rps->vclk == 0) || (rps->dclk == 0)) {
+                        rps->vclk = RS780_DEFAULT_VCLK_FREQ;
+                        rps->dclk = RS780_DEFAULT_DCLK_FREQ;
+                }
+        }
+
         if (rps->class & ATOM_PPLIB_CLASSIFICATION_BOOT)
                 rdev->pm.dpm.boot_ps = rps;
         if (rps->class & ATOM_PPLIB_CLASSIFICATION_UVDSTATE)
@@ -986,3 +1006,55 @@ void rs780_dpm_debugfs_print_current_performance_level(struct radeon_device *rde
                 seq_printf(m, "power level 1    sclk: %u vddc_index: %d\n",
                            ps->sclk_high, ps->max_voltage);
 }
+
+int rs780_dpm_force_performance_level(struct radeon_device *rdev,
+                                      enum radeon_dpm_forced_level level)
+{
+        struct igp_power_info *pi = rs780_get_pi(rdev);
+        struct radeon_ps *rps = rdev->pm.dpm.current_ps;
+        struct igp_ps *ps = rs780_get_ps(rps);
+        struct atom_clock_dividers dividers;
+        int ret;
+
+        rs780_clk_scaling_enable(rdev, false);
+        rs780_voltage_scaling_enable(rdev, false);
+
+        if (level == RADEON_DPM_FORCED_LEVEL_HIGH) {
+                if (pi->voltage_control)
+                        rs780_force_voltage(rdev, pi->max_voltage);
+
+                ret = radeon_atom_get_clock_dividers(rdev, COMPUTE_ENGINE_PLL_PARAM,
+                                                     ps->sclk_high, false, &dividers);
+                if (ret)
+                        return ret;
+
+                rs780_force_fbdiv(rdev, dividers.fb_div);
+        } else if (level == RADEON_DPM_FORCED_LEVEL_LOW) {
+                ret = radeon_atom_get_clock_dividers(rdev, COMPUTE_ENGINE_PLL_PARAM,
+                                                     ps->sclk_low, false, &dividers);
+                if (ret)
+                        return ret;
+
+                rs780_force_fbdiv(rdev, dividers.fb_div);
+
+                if (pi->voltage_control)
+                        rs780_force_voltage(rdev, pi->min_voltage);
+        } else {
+                if (pi->voltage_control)
+                        rs780_force_voltage(rdev, pi->max_voltage);
+
+                if (ps->sclk_high != ps->sclk_low) {
+                        WREG32_P(FVTHROT_FBDIV_REG1, 0, ~FORCE_FEEDBACK_DIV);
+                        rs780_clk_scaling_enable(rdev, true);
+                }
+
+                if (pi->voltage_control) {
+                        rs780_voltage_scaling_enable(rdev, true);
+                        rs780_enable_voltage_scaling(rdev, rps);
+                }
+        }
+
+        rdev->pm.dpm.forced_level = level;
+
+        return 0;
+}
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index 8ea1573ae820..873eb4b193b4 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -209,19 +209,27 @@ static void rv515_mc_init(struct radeon_device *rdev)
 
 uint32_t rv515_mc_rreg(struct radeon_device *rdev, uint32_t reg)
 {
+        unsigned long flags;
         uint32_t r;
 
+        spin_lock_irqsave(&rdev->mc_idx_lock, flags);
         WREG32(MC_IND_INDEX, 0x7f0000 | (reg & 0xffff));
         r = RREG32(MC_IND_DATA);
         WREG32(MC_IND_INDEX, 0);
+        spin_unlock_irqrestore(&rdev->mc_idx_lock, flags);
+
         return r;
 }
 
 void rv515_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
 {
+        unsigned long flags;
+
+        spin_lock_irqsave(&rdev->mc_idx_lock, flags);
         WREG32(MC_IND_INDEX, 0xff0000 | ((reg) & 0xffff));
         WREG32(MC_IND_DATA, (v));
         WREG32(MC_IND_INDEX, 0);
+        spin_unlock_irqrestore(&rdev->mc_idx_lock, flags);
 }
 
 #if defined(CONFIG_DEBUG_FS)
diff --git a/drivers/gpu/drm/radeon/rv6xx_dpm.c b/drivers/gpu/drm/radeon/rv6xx_dpm.c
index ab1f2016f21e..5811d277a36a 100644
--- a/drivers/gpu/drm/radeon/rv6xx_dpm.c
+++ b/drivers/gpu/drm/radeon/rv6xx_dpm.c
@@ -1758,8 +1758,6 @@ int rv6xx_dpm_set_power_state(struct radeon_device *rdev)
 
         rv6xx_set_uvd_clock_after_set_eng_clock(rdev, new_ps, old_ps);
 
-        rdev->pm.dpm.forced_level = RADEON_DPM_FORCED_LEVEL_AUTO;
-
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/rv770_dpm.c b/drivers/gpu/drm/radeon/rv770_dpm.c
index 8cbb85dae5aa..913b025ae9b3 100644
--- a/drivers/gpu/drm/radeon/rv770_dpm.c
+++ b/drivers/gpu/drm/radeon/rv770_dpm.c
@@ -2064,12 +2064,6 @@ int rv770_dpm_set_power_state(struct radeon_device *rdev)
                 rv770_program_dcodt_after_state_switch(rdev, new_ps, old_ps);
         rv770_set_uvd_clock_after_set_eng_clock(rdev, new_ps, old_ps);
 
-        ret = rv770_dpm_force_performance_level(rdev, RADEON_DPM_FORCED_LEVEL_AUTO);
-        if (ret) {
-                DRM_ERROR("rv770_dpm_force_performance_level failed\n");
-                return ret;
-        }
-
         return 0;
 }
 
@@ -2147,14 +2141,18 @@ static void rv7xx_parse_pplib_non_clock_info(struct radeon_device *rdev,
         if (ATOM_PPLIB_NONCLOCKINFO_VER1 < table_rev) {
                 rps->vclk = le32_to_cpu(non_clock_info->ulVCLK);
                 rps->dclk = le32_to_cpu(non_clock_info->ulDCLK);
-        } else if (r600_is_uvd_state(rps->class, rps->class2)) {
-                rps->vclk = RV770_DEFAULT_VCLK_FREQ;
-                rps->dclk = RV770_DEFAULT_DCLK_FREQ;
         } else {
                 rps->vclk = 0;
                 rps->dclk = 0;
         }
 
+        if (r600_is_uvd_state(rps->class, rps->class2)) {
+                if ((rps->vclk == 0) || (rps->dclk == 0)) {
+                        rps->vclk = RV770_DEFAULT_VCLK_FREQ;
+                        rps->dclk = RV770_DEFAULT_DCLK_FREQ;
+                }
+        }
+
         if (rps->class & ATOM_PPLIB_CLASSIFICATION_BOOT)
                 rdev->pm.dpm.boot_ps = rps;
         if (rps->class & ATOM_PPLIB_CLASSIFICATION_UVDSTATE)
diff --git a/drivers/gpu/drm/radeon/rv770_smc.c b/drivers/gpu/drm/radeon/rv770_smc.c
index ab95da570215..b2a224407365 100644
--- a/drivers/gpu/drm/radeon/rv770_smc.c
+++ b/drivers/gpu/drm/radeon/rv770_smc.c
@@ -274,8 +274,8 @@ static const u8 cayman_smc_int_vectors[] =
         0x08, 0x72, 0x08, 0x72
 };
 
-int rv770_set_smc_sram_address(struct radeon_device *rdev,
-                               u16 smc_address, u16 limit)
+static int rv770_set_smc_sram_address(struct radeon_device *rdev,
+                                      u16 smc_address, u16 limit)
 {
         u32 addr;
 
@@ -296,9 +296,10 @@ int rv770_copy_bytes_to_smc(struct radeon_device *rdev,
                             u16 smc_start_address, const u8 *src,
                             u16 byte_count, u16 limit)
 {
+        unsigned long flags;
         u32 data, original_data, extra_shift;
         u16 addr;
-        int ret;
+        int ret = 0;
 
         if (smc_start_address & 3)
                 return -EINVAL;
@@ -307,13 +308,14 @@ int rv770_copy_bytes_to_smc(struct radeon_device *rdev,
 
         addr = smc_start_address;
 
+        spin_lock_irqsave(&rdev->smc_idx_lock, flags);
         while (byte_count >= 4) {
                 /* SMC address space is BE */
                 data = (src[0] << 24) | (src[1] << 16) | (src[2] << 8) | src[3];
 
                 ret = rv770_set_smc_sram_address(rdev, addr, limit);
                 if (ret)
-                        return ret;
+                        goto done;
 
                 WREG32(SMC_SRAM_DATA, data);
 
@@ -328,7 +330,7 @@ int rv770_copy_bytes_to_smc(struct radeon_device *rdev,
 
                 ret = rv770_set_smc_sram_address(rdev, addr, limit);
                 if (ret)
-                        return ret;
+                        goto done;
 
                 original_data = RREG32(SMC_SRAM_DATA);
 
@@ -346,12 +348,15 @@ int rv770_copy_bytes_to_smc(struct radeon_device *rdev,
 
                 ret = rv770_set_smc_sram_address(rdev, addr, limit);
                 if (ret)
-                        return ret;
+                        goto done;
 
                 WREG32(SMC_SRAM_DATA, data);
         }
 
-        return 0;
+done:
+        spin_unlock_irqrestore(&rdev->smc_idx_lock, flags);
+
+        return ret;
 }
 
 static int rv770_program_interrupt_vectors(struct radeon_device *rdev,
@@ -461,12 +466,15 @@ PPSMC_Result rv770_wait_for_smc_inactive(struct radeon_device *rdev)
 
 static void rv770_clear_smc_sram(struct radeon_device *rdev, u16 limit)
 {
+        unsigned long flags;
         u16 i;
 
+        spin_lock_irqsave(&rdev->smc_idx_lock, flags);
         for (i = 0;  i < limit; i += 4) {
                 rv770_set_smc_sram_address(rdev, i, limit);
                 WREG32(SMC_SRAM_DATA, 0);
         }
+        spin_unlock_irqrestore(&rdev->smc_idx_lock, flags);
 }
 
 int rv770_load_smc_ucode(struct radeon_device *rdev,
@@ -595,27 +603,29 @@ int rv770_load_smc_ucode(struct radeon_device *rdev,
 int rv770_read_smc_sram_dword(struct radeon_device *rdev,
                               u16 smc_address, u32 *value, u16 limit)
 {
+        unsigned long flags;
         int ret;
 
+        spin_lock_irqsave(&rdev->smc_idx_lock, flags);
         ret = rv770_set_smc_sram_address(rdev, smc_address, limit);
-        if (ret)
-                return ret;
-
-        *value = RREG32(SMC_SRAM_DATA);
+        if (ret == 0)
+                *value = RREG32(SMC_SRAM_DATA);
+        spin_unlock_irqrestore(&rdev->smc_idx_lock, flags);
 
-        return 0;
+        return ret;
 }
 
 int rv770_write_smc_sram_dword(struct radeon_device *rdev,
                                u16 smc_address, u32 value, u16 limit)
 {
+        unsigned long flags;
         int ret;
 
+        spin_lock_irqsave(&rdev->smc_idx_lock, flags);
         ret = rv770_set_smc_sram_address(rdev, smc_address, limit);
-        if (ret)
-                return ret;
+        if (ret == 0)
+                WREG32(SMC_SRAM_DATA, value);
+        spin_unlock_irqrestore(&rdev->smc_idx_lock, flags);
 
-        WREG32(SMC_SRAM_DATA, value);
-
-        return 0;
+        return ret;
 }
diff --git a/drivers/gpu/drm/radeon/rv770_smc.h b/drivers/gpu/drm/radeon/rv770_smc.h
index f78d92a4b325..3b2c963c4880 100644
--- a/drivers/gpu/drm/radeon/rv770_smc.h
+++ b/drivers/gpu/drm/radeon/rv770_smc.h
@@ -187,8 +187,6 @@ typedef struct RV770_SMC_STATETABLE RV770_SMC_STATETABLE;
 #define RV770_SMC_SOFT_REGISTER_uvd_enabled             0x9C
 #define RV770_SMC_SOFT_REGISTER_is_asic_lombok          0xA0
 
-int rv770_set_smc_sram_address(struct radeon_device *rdev,
-                               u16 smc_address, u16 limit);
 int rv770_copy_bytes_to_smc(struct radeon_device *rdev,
                             u16 smc_start_address, const u8 *src,
                             u16 byte_count, u16 limit);
diff --git a/drivers/gpu/drm/radeon/rv770d.h b/drivers/gpu/drm/radeon/rv770d.h
index 9fe60e542922..1ae277152cc7 100644
--- a/drivers/gpu/drm/radeon/rv770d.h
+++ b/drivers/gpu/drm/radeon/rv770d.h
@@ -852,7 +852,7 @@
 #define AFMT_VBI_PACKET_CONTROL              0x7608
 #       define AFMT_GENERIC0_UPDATE          (1 << 2)
 #define AFMT_INFOFRAME_CONTROL0              0x760c
-#       define AFMT_AUDIO_INFO_SOURCE        (1 << 6) /* 0 - sound block; 1 - hmdi regs */
+#       define AFMT_AUDIO_INFO_SOURCE        (1 << 6) /* 0 - sound block; 1 - hdmi regs */
 #       define AFMT_AUDIO_INFO_UPDATE        (1 << 7)
 #       define AFMT_MPEG_INFO_UPDATE         (1 << 10)
 #define AFMT_GENERIC0_7                      0x7610
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 3e23b757dcfa..c354c1094967 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -83,6 +83,8 @@ extern void si_dma_vm_set_page(struct radeon_device *rdev,
                                uint64_t pe,
                                uint64_t addr, unsigned count,
                                uint32_t incr, uint32_t flags);
+static void si_enable_gui_idle_interrupt(struct radeon_device *rdev,
+                                         bool enable);
 
 static const u32 verde_rlc_save_restore_register_list[] =
 {
@@ -3386,6 +3388,8 @@ static int si_cp_resume(struct radeon_device *rdev)
         u32 rb_bufsz;
         int r;
 
+        si_enable_gui_idle_interrupt(rdev, false);
+
         WREG32(CP_SEM_WAIT_TIMER, 0x0);
         WREG32(CP_SEM_INCOMPLETE_TIMER_CNTL, 0x0);
 
@@ -3501,6 +3505,8 @@ static int si_cp_resume(struct radeon_device *rdev)
                 rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX].ready = false;
         }
 
+        si_enable_gui_idle_interrupt(rdev, true);
+
         return 0;
 }
 
@@ -4888,7 +4894,7 @@ static void si_enable_gfx_cgpg(struct radeon_device *rdev,
 {
         u32 tmp;
 
-        if (enable && (rdev->pg_flags & RADEON_PG_SUPPORT_GFX_CG)) {
+        if (enable && (rdev->pg_flags & RADEON_PG_SUPPORT_GFX_PG)) {
                 tmp = RLC_PUD(0x10) | RLC_PDD(0x10) | RLC_TTPD(0x10) | RLC_MSD(0x10);
                 WREG32(RLC_TTOP_D, tmp);
 
@@ -5250,6 +5256,7 @@ void si_update_cg(struct radeon_device *rdev,
                   u32 block, bool enable)
 {
         if (block & RADEON_CG_BLOCK_GFX) {
+                si_enable_gui_idle_interrupt(rdev, false);
                 /* order matters! */
                 if (enable) {
                         si_enable_mgcg(rdev, true);
@@ -5258,6 +5265,7 @@ void si_update_cg(struct radeon_device *rdev,
                         si_enable_cgcg(rdev, false);
                         si_enable_mgcg(rdev, false);
                 }
+                si_enable_gui_idle_interrupt(rdev, true);
         }
 
         if (block & RADEON_CG_BLOCK_MC) {
@@ -5408,7 +5416,7 @@ static void si_init_pg(struct radeon_device *rdev)
                         si_init_dma_pg(rdev);
                 }
                 si_init_ao_cu_mask(rdev);
-                if (rdev->pg_flags & RADEON_PG_SUPPORT_GFX_CG) {
+                if (rdev->pg_flags & RADEON_PG_SUPPORT_GFX_PG) {
                         si_init_gfx_cgpg(rdev);
                 }
                 si_enable_dma_pg(rdev, true);
@@ -5560,7 +5568,9 @@ static void si_disable_interrupt_state(struct radeon_device *rdev)
 {
         u32 tmp;
 
-        WREG32(CP_INT_CNTL_RING0, CNTX_BUSY_INT_ENABLE | CNTX_EMPTY_INT_ENABLE);
+        tmp = RREG32(CP_INT_CNTL_RING0) &
+                (CNTX_BUSY_INT_ENABLE | CNTX_EMPTY_INT_ENABLE);
+        WREG32(CP_INT_CNTL_RING0, tmp);
         WREG32(CP_INT_CNTL_RING1, 0);
         WREG32(CP_INT_CNTL_RING2, 0);
         tmp = RREG32(DMA_CNTL + DMA0_REGISTER_OFFSET) & ~TRAP_ENABLE;
@@ -5685,7 +5695,7 @@ static int si_irq_init(struct radeon_device *rdev)
 
 int si_irq_set(struct radeon_device *rdev)
 {
-        u32 cp_int_cntl = CNTX_BUSY_INT_ENABLE | CNTX_EMPTY_INT_ENABLE;
+        u32 cp_int_cntl;
         u32 cp_int_cntl1 = 0, cp_int_cntl2 = 0;
         u32 crtc1 = 0, crtc2 = 0, crtc3 = 0, crtc4 = 0, crtc5 = 0, crtc6 = 0;
         u32 hpd1 = 0, hpd2 = 0, hpd3 = 0, hpd4 = 0, hpd5 = 0, hpd6 = 0;
@@ -5706,6 +5716,9 @@ int si_irq_set(struct radeon_device *rdev)
                 return 0;
         }
 
+        cp_int_cntl = RREG32(CP_INT_CNTL_RING0) &
+                (CNTX_BUSY_INT_ENABLE | CNTX_EMPTY_INT_ENABLE);
+
         if (!ASIC_IS_NODCE(rdev)) {
                 hpd1 = RREG32(DC_HPD1_INT_CONTROL) & ~DC_HPDx_INT_EN;
                 hpd2 = RREG32(DC_HPD2_INT_CONTROL) & ~DC_HPDx_INT_EN;
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 5be9b4e72350..cfe5d4d28915 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -6075,12 +6075,6 @@ int si_dpm_set_power_state(struct radeon_device *rdev)
                 return ret;
         }
 
-        ret = si_dpm_force_performance_level(rdev, RADEON_DPM_FORCED_LEVEL_AUTO);
-        if (ret) {
-                DRM_ERROR("si_dpm_force_performance_level failed\n");
-                return ret;
-        }
-
         si_update_cg(rdev, (RADEON_CG_BLOCK_GFX |
                             RADEON_CG_BLOCK_MC |
                             RADEON_CG_BLOCK_SDMA |
diff --git a/drivers/gpu/drm/radeon/si_smc.c b/drivers/gpu/drm/radeon/si_smc.c
index 5f524c0a541e..d422a1cbf727 100644
--- a/drivers/gpu/drm/radeon/si_smc.c
+++ b/drivers/gpu/drm/radeon/si_smc.c
@@ -29,8 +29,8 @@
 #include "ppsmc.h"
 #include "radeon_ucode.h"
 
-int si_set_smc_sram_address(struct radeon_device *rdev,
-                            u32 smc_address, u32 limit)
+static int si_set_smc_sram_address(struct radeon_device *rdev,
+                                   u32 smc_address, u32 limit)
 {
         if (smc_address & 3)
                 return -EINVAL;
@@ -47,7 +47,8 @@ int si_copy_bytes_to_smc(struct radeon_device *rdev,
                          u32 smc_start_address,
                          const u8 *src, u32 byte_count, u32 limit)
 {
-        int ret;
+        unsigned long flags;
+        int ret = 0;
         u32 data, original_data, addr, extra_shift;
 
         if (smc_start_address & 3)
@@ -57,13 +58,14 @@ int si_copy_bytes_to_smc(struct radeon_device *rdev,
 
         addr = smc_start_address;
 
+        spin_lock_irqsave(&rdev->smc_idx_lock, flags);
         while (byte_count >= 4) {
                 /* SMC address space is BE */
                 data = (src[0] << 24) | (src[1] << 16) | (src[2] << 8) | src[3];
 
                 ret = si_set_smc_sram_address(rdev, addr, limit);
                 if (ret)
-                        return ret;
+                        goto done;
 
                 WREG32(SMC_IND_DATA_0, data);
 
@@ -78,7 +80,7 @@ int si_copy_bytes_to_smc(struct radeon_device *rdev,
 
                 ret = si_set_smc_sram_address(rdev, addr, limit);
                 if (ret)
-                        return ret;
+                        goto done;
 
                 original_data = RREG32(SMC_IND_DATA_0);
 
@@ -96,11 +98,15 @@ int si_copy_bytes_to_smc(struct radeon_device *rdev,
 
                 ret = si_set_smc_sram_address(rdev, addr, limit);
                 if (ret)
-                        return ret;
+                        goto done;
 
                 WREG32(SMC_IND_DATA_0, data);
         }
-        return 0;
+
+done:
+        spin_unlock_irqrestore(&rdev->smc_idx_lock, flags);
+
+        return ret;
 }
 
 void si_start_smc(struct radeon_device *rdev)
@@ -203,6 +209,7 @@ PPSMC_Result si_wait_for_smc_inactive(struct radeon_device *rdev)
 
 int si_load_smc_ucode(struct radeon_device *rdev, u32 limit)
 {
+        unsigned long flags;
         u32 ucode_start_address;
         u32 ucode_size;
         const u8 *src;
@@ -241,6 +248,7 @@ int si_load_smc_ucode(struct radeon_device *rdev, u32 limit)
                 return -EINVAL;
 
         src = (const u8 *)rdev->smc_fw->data;
+        spin_lock_irqsave(&rdev->smc_idx_lock, flags);
         WREG32(SMC_IND_INDEX_0, ucode_start_address);
         WREG32_P(SMC_IND_ACCESS_CNTL, AUTO_INCREMENT_IND_0, ~AUTO_INCREMENT_IND_0);
         while (ucode_size >= 4) {
@@ -253,6 +261,7 @@ int si_load_smc_ucode(struct radeon_device *rdev, u32 limit)
                 ucode_size -= 4;
         }
         WREG32_P(SMC_IND_ACCESS_CNTL, 0, ~AUTO_INCREMENT_IND_0);
+        spin_unlock_irqrestore(&rdev->smc_idx_lock, flags);
 
         return 0;
 }
@@ -260,25 +269,29 @@ int si_load_smc_ucode(struct radeon_device *rdev, u32 limit)
 int si_read_smc_sram_dword(struct radeon_device *rdev, u32 smc_address,
                            u32 *value, u32 limit)
 {
+        unsigned long flags;
         int ret;
 
+        spin_lock_irqsave(&rdev->smc_idx_lock, flags);
         ret = si_set_smc_sram_address(rdev, smc_address, limit);
-        if (ret)
-                return ret;
+        if (ret == 0)
+                *value = RREG32(SMC_IND_DATA_0);
+        spin_unlock_irqrestore(&rdev->smc_idx_lock, flags);
 
-        *value = RREG32(SMC_IND_DATA_0);
-        return 0;
+        return ret;
 }
 
 int si_write_smc_sram_dword(struct radeon_device *rdev, u32 smc_address,
                             u32 value, u32 limit)
 {
+        unsigned long flags;
         int ret;
 
+        spin_lock_irqsave(&rdev->smc_idx_lock, flags);
         ret = si_set_smc_sram_address(rdev, smc_address, limit);
-        if (ret)
-                return ret;
+        if (ret == 0)
+                WREG32(SMC_IND_DATA_0, value);
+        spin_unlock_irqrestore(&rdev->smc_idx_lock, flags);
 
-        WREG32(SMC_IND_DATA_0, value);
-        return 0;
+        return ret;
 }
diff --git a/drivers/gpu/drm/radeon/sumo_dpm.c b/drivers/gpu/drm/radeon/sumo_dpm.c
index 864761c0120e..96ea6db8bf57 100644
--- a/drivers/gpu/drm/radeon/sumo_dpm.c
+++ b/drivers/gpu/drm/radeon/sumo_dpm.c
@@ -1319,8 +1319,6 @@ int sumo_dpm_set_power_state(struct radeon_device *rdev)
         if (pi->enable_dpm)
                 sumo_set_uvd_clock_after_set_eng_clock(rdev, new_ps, old_ps);
 
-        rdev->pm.dpm.forced_level = RADEON_DPM_FORCED_LEVEL_AUTO;
-
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/trinity_dpm.c b/drivers/gpu/drm/radeon/trinity_dpm.c
index b07b7b8f1aff..7f998bf1cc9d 100644
--- a/drivers/gpu/drm/radeon/trinity_dpm.c
+++ b/drivers/gpu/drm/radeon/trinity_dpm.c
@@ -1068,6 +1068,17 @@ static void trinity_update_requested_ps(struct radeon_device *rdev,
         pi->requested_rps.ps_priv = &pi->requested_ps;
 }
 
+void trinity_dpm_enable_bapm(struct radeon_device *rdev, bool enable)
+{
+        struct trinity_power_info *pi = trinity_get_pi(rdev);
+
+        if (pi->enable_bapm) {
+                trinity_acquire_mutex(rdev);
+                trinity_dpm_bapm_enable(rdev, enable);
+                trinity_release_mutex(rdev);
+        }
+}
+
 int trinity_dpm_enable(struct radeon_device *rdev)
 {
         struct trinity_power_info *pi = trinity_get_pi(rdev);
@@ -1091,6 +1102,7 @@ int trinity_dpm_enable(struct radeon_device *rdev)
         trinity_program_sclk_dpm(rdev);
         trinity_start_dpm(rdev);
         trinity_wait_for_dpm_enabled(rdev);
+        trinity_dpm_bapm_enable(rdev, false);
         trinity_release_mutex(rdev);
 
         if (rdev->irq.installed &&
@@ -1116,6 +1128,7 @@ void trinity_dpm_disable(struct radeon_device *rdev)
                 trinity_release_mutex(rdev);
                 return;
         }
+        trinity_dpm_bapm_enable(rdev, false);
         trinity_disable_clock_power_gating(rdev);
         sumo_clear_vc(rdev);
         trinity_wait_for_level_0(rdev);
@@ -1212,6 +1225,8 @@ int trinity_dpm_set_power_state(struct radeon_device *rdev)
 
         trinity_acquire_mutex(rdev);
         if (pi->enable_dpm) {
+                if (pi->enable_bapm)
+                        trinity_dpm_bapm_enable(rdev, rdev->pm.dpm.ac_power);
                 trinity_set_uvd_clock_before_set_eng_clock(rdev, new_ps, old_ps);
                 trinity_enable_power_level_0(rdev);
                 trinity_force_level_0(rdev);
@@ -1221,7 +1236,6 @@ int trinity_dpm_set_power_state(struct radeon_device *rdev)
                 trinity_force_level_0(rdev);
                 trinity_unforce_levels(rdev);
                 trinity_set_uvd_clock_after_set_eng_clock(rdev, new_ps, old_ps);
-                rdev->pm.dpm.forced_level = RADEON_DPM_FORCED_LEVEL_AUTO;
         }
         trinity_release_mutex(rdev);
 
@@ -1854,6 +1868,7 @@ int trinity_dpm_init(struct radeon_device *rdev)
         for (i = 0; i < SUMO_MAX_HARDWARE_POWERLEVELS; i++)
                 pi->at[i] = TRINITY_AT_DFLT;
 
+        pi->enable_bapm = true;
         pi->enable_nbps_policy = true;
         pi->enable_sclk_ds = true;
         pi->enable_gfx_power_gating = true;
diff --git a/drivers/gpu/drm/radeon/trinity_dpm.h b/drivers/gpu/drm/radeon/trinity_dpm.h
index e82df071f8b3..c261657750ca 100644
--- a/drivers/gpu/drm/radeon/trinity_dpm.h
+++ b/drivers/gpu/drm/radeon/trinity_dpm.h
@@ -108,6 +108,7 @@ struct trinity_power_info {
         bool enable_auto_thermal_throttling;
         bool enable_dpm;
         bool enable_sclk_ds;
+        bool enable_bapm;
         bool uvd_dpm;
         struct radeon_ps current_rps;
         struct trinity_ps current_ps;
@@ -118,6 +119,7 @@ struct trinity_power_info {
 #define TRINITY_AT_DFLT            30
 
 /* trinity_smc.c */
+int trinity_dpm_bapm_enable(struct radeon_device *rdev, bool enable);
 int trinity_dpm_config(struct radeon_device *rdev, bool enable);
 int trinity_uvd_dpm_config(struct radeon_device *rdev);
 int trinity_dpm_force_state(struct radeon_device *rdev, u32 n);
diff --git a/drivers/gpu/drm/radeon/trinity_smc.c b/drivers/gpu/drm/radeon/trinity_smc.c
index a42d89f1830c..9672bcbc7312 100644
--- a/drivers/gpu/drm/radeon/trinity_smc.c
+++ b/drivers/gpu/drm/radeon/trinity_smc.c
@@ -56,6 +56,14 @@ static int trinity_notify_message_to_smu(struct radeon_device *rdev, u32 id)
         return 0;
 }
 
+int trinity_dpm_bapm_enable(struct radeon_device *rdev, bool enable)
+{
+        if (enable)
+                return trinity_notify_message_to_smu(rdev, PPSMC_MSG_EnableBAPM);
+        else
+                return trinity_notify_message_to_smu(rdev, PPSMC_MSG_DisableBAPM);
+}
+
 int trinity_dpm_config(struct radeon_device *rdev, bool enable)
 {
         if (enable)
diff --git a/drivers/gpu/drm/ttm/ttm_object.c b/drivers/gpu/drm/ttm/ttm_object.c
index 58a5f3261c0b..a868176c258a 100644
--- a/drivers/gpu/drm/ttm/ttm_object.c
+++ b/drivers/gpu/drm/ttm/ttm_object.c
@@ -218,7 +218,7 @@ struct ttm_base_object *ttm_base_object_lookup(struct ttm_object_file *tfile,
                                                uint32_t key)
 {
         struct ttm_object_device *tdev = tfile->tdev;
-        struct ttm_base_object *base;
+        struct ttm_base_object *uninitialized_var(base);
         struct drm_hash_item *hash;
         int ret;
 
diff --git a/drivers/gpu/drm/ttm/ttm_tt.c b/drivers/gpu/drm/ttm/ttm_tt.c
index 5e93a52d4f2c..210d50365162 100644
--- a/drivers/gpu/drm/ttm/ttm_tt.c
+++ b/drivers/gpu/drm/ttm/ttm_tt.c
@@ -170,7 +170,7 @@ void ttm_tt_destroy(struct ttm_tt *ttm)
                 ttm_tt_unbind(ttm);
         }
 
-        if (likely(ttm->pages != NULL)) {
+        if (ttm->state == tt_unbound) {
                 ttm->bdev->driver->ttm_tt_unpopulate(ttm);
         }
 
diff --git a/drivers/gpu/drm/udl/udl_gem.c b/drivers/gpu/drm/udl/udl_gem.c
index 8dbe9d0ae9a7..8bf646183bac 100644
--- a/drivers/gpu/drm/udl/udl_gem.c
+++ b/drivers/gpu/drm/udl/udl_gem.c
@@ -97,7 +97,6 @@ int udl_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
         ret = vm_insert_page(vma, (unsigned long)vmf->virtual_address, page);
         switch (ret) {
         case -EAGAIN:
-                set_need_resched();
         case 0:
         case -ERESTARTSYS:
                 return VM_FAULT_NOPAGE;
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index ae88a97f976e..b8470b1a10fe 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -94,7 +94,6 @@ EXPORT_SYMBOL_GPL(hid_register_report);
 static struct hid_field *hid_register_field(struct hid_report *report, unsigned usages, unsigned values)
 {
         struct hid_field *field;
-        int i;
 
         if (report->maxfield == HID_MAX_FIELDS) {
                 hid_err(report->device, "too many fields in report\n");
@@ -113,9 +112,6 @@ static struct hid_field *hid_register_field(struct hid_report *report, unsigned
         field->value = (s32 *)(field->usage + usages);
         field->report = report;
 
-        for (i = 0; i < usages; i++)
-                field->usage[i].usage_index = i;
-
         return field;
 }
 
@@ -226,9 +222,9 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign
 {
         struct hid_report *report;
         struct hid_field *field;
-        int usages;
+        unsigned usages;
         unsigned offset;
-        int i;
+        unsigned i;
 
         report = hid_register_report(parser->device, report_type, parser->global.report_id);
         if (!report) {
@@ -255,7 +251,8 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign
         if (!parser->local.usage_index) /* Ignore padding fields */
                 return 0;
 
-        usages = max_t(int, parser->local.usage_index, parser->global.report_count);
+        usages = max_t(unsigned, parser->local.usage_index,
+                                 parser->global.report_count);
 
         field = hid_register_field(report, usages, parser->global.report_count);
         if (!field)
@@ -266,13 +263,14 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign
         field->application = hid_lookup_collection(parser, HID_COLLECTION_APPLICATION);
 
         for (i = 0; i < usages; i++) {
-                int j = i;
+                unsigned j = i;
                 /* Duplicate the last usage we parsed if we have excess values */
                 if (i >= parser->local.usage_index)
                         j = parser->local.usage_index - 1;
                 field->usage[i].hid = parser->local.usage[j];
                 field->usage[i].collection_index =
                         parser->local.collection_index[j];
+                field->usage[i].usage_index = i;
         }
 
         field->maxusage = usages;
@@ -801,6 +799,64 @@ int hid_parse_report(struct hid_device *hid, __u8 *start, unsigned size)
 }
 EXPORT_SYMBOL_GPL(hid_parse_report);
 
+static const char * const hid_report_names[] = {
+        "HID_INPUT_REPORT",
+        "HID_OUTPUT_REPORT",
+        "HID_FEATURE_REPORT",
+};
+/**
+ * hid_validate_values - validate existing device report's value indexes
+ *
+ * @device: hid device
+ * @type: which report type to examine
+ * @id: which report ID to examine (0 for first)
+ * @field_index: which report field to examine
+ * @report_counts: expected number of values
+ *
+ * Validate the number of values in a given field of a given report, after
+ * parsing.
+ */
+struct hid_report *hid_validate_values(struct hid_device *hid,
+                                       unsigned int type, unsigned int id,
+                                       unsigned int field_index,
+                                       unsigned int report_counts)
+{
+        struct hid_report *report;
+
+        if (type > HID_FEATURE_REPORT) {
+                hid_err(hid, "invalid HID report type %u\n", type);
+                return NULL;
+        }
+
+        if (id >= HID_MAX_IDS) {
+                hid_err(hid, "invalid HID report id %u\n", id);
+                return NULL;
+        }
+
+        /*
+         * Explicitly not using hid_get_report() here since it depends on
+         * ->numbered being checked, which may not always be the case when
+         * drivers go to access report values.
+         */
+        report = hid->report_enum[type].report_id_hash[id];
+        if (!report) {
+                hid_err(hid, "missing %s %u\n", hid_report_names[type], id);
+                return NULL;
+        }
+        if (report->maxfield <= field_index) {
+                hid_err(hid, "not enough fields in %s %u\n",
+                        hid_report_names[type], id);
+                return NULL;
+        }
+        if (report->field[field_index]->report_count < report_counts) {
+                hid_err(hid, "not enough values in %s %u field %u\n",
+                        hid_report_names[type], id, field_index);
+                return NULL;
+        }
+        return report;
+}
+EXPORT_SYMBOL_GPL(hid_validate_values);
+
 /**
  * hid_open_report - open a driver-specific device report
  *
@@ -1296,7 +1352,7 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, int size,
                         goto out;
         }
 
-        if (hid->claimed != HID_CLAIMED_HIDRAW) {
+        if (hid->claimed != HID_CLAIMED_HIDRAW && report->maxfield) {
                 for (a = 0; a < report->maxfield; a++)
                         hid_input_field(hid, report->field[a], cdata, interrupt);
                 hdrv = hid->driver;
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index b420f4a0fd28..8741d953dcc8 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -485,6 +485,10 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
         if (field->flags & HID_MAIN_ITEM_CONSTANT)
                 goto ignore;
 
+        /* Ignore if report count is out of bounds. */
+        if (field->report_count < 1)
+                goto ignore;
+
         /* only LED usages are supported in output fields */
         if (field->report_type == HID_OUTPUT_REPORT &&
                         (usage->hid & HID_USAGE_PAGE) != HID_UP_LED) {
@@ -1236,7 +1240,11 @@ static void report_features(struct hid_device *hid)
 
         rep_enum = &hid->report_enum[HID_FEATURE_REPORT];
         list_for_each_entry(rep, &rep_enum->report_list, list)
-                for (i = 0; i < rep->maxfield; i++)
+                for (i = 0; i < rep->maxfield; i++) {
+                        /* Ignore if report count is out of bounds. */
+                        if (rep->field[i]->report_count < 1)
+                                continue;
+
                         for (j = 0; j < rep->field[i]->maxusage; j++) {
                                 /* Verify if Battery Strength feature is available */
                                 hidinput_setup_battery(hid, HID_FEATURE_REPORT, rep->field[i]);
@@ -1245,6 +1253,7 @@ static void report_features(struct hid_device *hid)
                                         drv->feature_mapping(hid, rep->field[i],
                                                              rep->field[i]->usage + j);
                         }
+                }
 }
 
 static struct hid_input *hidinput_allocate(struct hid_device *hid)
diff --git a/drivers/hid/hid-lenovo-tpkbd.c b/drivers/hid/hid-lenovo-tpkbd.c
index 07837f5a4eb8..31cf29a6ba17 100644
--- a/drivers/hid/hid-lenovo-tpkbd.c
+++ b/drivers/hid/hid-lenovo-tpkbd.c
@@ -339,7 +339,15 @@ static int tpkbd_probe_tp(struct hid_device *hdev)
         struct tpkbd_data_pointer *data_pointer;
         size_t name_sz = strlen(dev_name(dev)) + 16;
         char *name_mute, *name_micmute;
-        int ret;
+        int i, ret;
+
+        /* Validate required reports. */
+        for (i = 0; i < 4; i++) {
+                if (!hid_validate_values(hdev, HID_FEATURE_REPORT, 4, i, 1))
+                        return -ENODEV;
+        }
+        if (!hid_validate_values(hdev, HID_OUTPUT_REPORT, 3, 0, 2))
+                return -ENODEV;
 
         if (sysfs_create_group(&hdev->dev.kobj,
                                 &tpkbd_attr_group_pointer)) {
@@ -406,22 +414,27 @@ static int tpkbd_probe(struct hid_device *hdev,
         ret = hid_parse(hdev);
         if (ret) {
                 hid_err(hdev, "hid_parse failed\n");
-                goto err_free;
+                goto err;
         }
 
         ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
         if (ret) {
                 hid_err(hdev, "hid_hw_start failed\n");
-                goto err_free;
+                goto err;
         }
 
         uhdev = (struct usbhid_device *) hdev->driver_data;
 
-        if (uhdev->ifnum == 1)
-                return tpkbd_probe_tp(hdev);
+        if (uhdev->ifnum == 1) {
+                ret = tpkbd_probe_tp(hdev);
+                if (ret)
+                        goto err_hid;
+        }
 
         return 0;
-err_free:
+err_hid:
+        hid_hw_stop(hdev);
+err:
         return ret;
 }
 
diff --git a/drivers/hid/hid-lg2ff.c b/drivers/hid/hid-lg2ff.c
index b3cd1507dda2..1a42eaa6ca02 100644
--- a/drivers/hid/hid-lg2ff.c
+++ b/drivers/hid/hid-lg2ff.c
@@ -64,26 +64,13 @@ int lg2ff_init(struct hid_device *hid)
         struct hid_report *report;
         struct hid_input *hidinput = list_entry(hid->inputs.next,
                                                 struct hid_input, list);
-        struct list_head *report_list =
-                        &hid->report_enum[HID_OUTPUT_REPORT].report_list;
         struct input_dev *dev = hidinput->input;
         int error;
 
-        if (list_empty(report_list)) {
-                hid_err(hid, "no output report found\n");
+        /* Check that the report looks ok */
+        report = hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 7);
+        if (!report)
                 return -ENODEV;
-        }
-
-        report = list_entry(report_list->next, struct hid_report, list);
-
-        if (report->maxfield < 1) {
-                hid_err(hid, "output report is empty\n");
-                return -ENODEV;
-        }
-        if (report->field[0]->report_count < 7) {
-                hid_err(hid, "not enough values in the field\n");
-                return -ENODEV;
-        }
 
         lg2ff = kmalloc(sizeof(struct lg2ff_device), GFP_KERNEL);
         if (!lg2ff)
diff --git a/drivers/hid/hid-lg3ff.c b/drivers/hid/hid-lg3ff.c
index e52f181f6aa1..8c2da183d3bc 100644
--- a/drivers/hid/hid-lg3ff.c
+++ b/drivers/hid/hid-lg3ff.c
@@ -66,10 +66,11 @@ static int hid_lg3ff_play(struct input_dev *dev, void *data,
         int x, y;
 
 /*
- * Maxusage should always be 63 (maximum fields)
- * likely a better way to ensure this data is clean
+ * Available values in the field should always be 63, but we only use up to
+ * 35. Instead, clear the entire area, however big it is.
  */
-        memset(report->field[0]->value, 0, sizeof(__s32)*report->field[0]->maxusage);
+        memset(report->field[0]->value, 0,
+               sizeof(__s32) * report->field[0]->report_count);
 
         switch (effect->type) {
         case FF_CONSTANT:
@@ -129,32 +130,14 @@ static const signed short ff3_joystick_ac[] = {
 int lg3ff_init(struct hid_device *hid)
 {
         struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list);
-        struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list;
         struct input_dev *dev = hidinput->input;
-        struct hid_report *report;
-        struct hid_field *field;
         const signed short *ff_bits = ff3_joystick_ac;
         int error;
         int i;
 
-        /* Find the report to use */
-        if (list_empty(report_list)) {
-                hid_err(hid, "No output report found\n");
-                return -1;
-        }
-
         /* Check that the report looks ok */
-        report = list_entry(report_list->next, struct hid_report, list);
-        if (!report) {
-                hid_err(hid, "NULL output report\n");
-                return -1;
-        }
-
-        field = report->field[0];
-        if (!field) {
-                hid_err(hid, "NULL field\n");
-                return -1;
-        }
+        if (!hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 35))
+                return -ENODEV;
 
         /* Assume single fixed device G940 */
         for (i = 0; ff_bits[i] >= 0; i++)
diff --git a/drivers/hid/hid-lg4ff.c b/drivers/hid/hid-lg4ff.c
index 0ddae2a00d59..8782fe1aaa07 100644
--- a/drivers/hid/hid-lg4ff.c
+++ b/drivers/hid/hid-lg4ff.c
@@ -484,34 +484,16 @@ static enum led_brightness lg4ff_led_get_brightness(struct led_classdev *led_cde
 int lg4ff_init(struct hid_device *hid)
 {
         struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list);
-        struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list;
         struct input_dev *dev = hidinput->input;
-        struct hid_report *report;
-        struct hid_field *field;
         struct lg4ff_device_entry *entry;
         struct lg_drv_data *drv_data;
         struct usb_device_descriptor *udesc;
         int error, i, j;
         __u16 bcdDevice, rev_maj, rev_min;
 
-        /* Find the report to use */
-        if (list_empty(report_list)) {
-                hid_err(hid, "No output report found\n");
-                return -1;
-        }
-
         /* Check that the report looks ok */
-        report = list_entry(report_list->next, struct hid_report, list);
-        if (!report) {
-                hid_err(hid, "NULL output report\n");
+        if (!hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 7))
                 return -1;
-        }
-
-        field = report->field[0];
-        if (!field) {
-                hid_err(hid, "NULL field\n");
-                return -1;
-        }
 
         /* Check what wheel has been connected */
         for (i = 0; i < ARRAY_SIZE(lg4ff_devices); i++) {
diff --git a/drivers/hid/hid-lgff.c b/drivers/hid/hid-lgff.c
index d7ea8c845b40..e1394af0ae7b 100644
--- a/drivers/hid/hid-lgff.c
+++ b/drivers/hid/hid-lgff.c
@@ -128,27 +128,14 @@ static void hid_lgff_set_autocenter(struct input_dev *dev, u16 magnitude)
 int lgff_init(struct hid_device* hid)
 {
         struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list);
-        struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list;
         struct input_dev *dev = hidinput->input;
-        struct hid_report *report;
-        struct hid_field *field;
         const signed short *ff_bits = ff_joystick;
         int error;
         int i;
 
-        /* Find the report to use */
-        if (list_empty(report_list)) {
-                hid_err(hid, "No output report found\n");
-                return -1;
-        }
-
         /* Check that the report looks ok */
-        report = list_entry(report_list->next, struct hid_report, list);
-        field = report->field[0];
-        if (!field) {
-                hid_err(hid, "NULL field\n");
-                return -1;
-        }
+        if (!hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 7))
+                return -ENODEV;
 
         for (i = 0; i < ARRAY_SIZE(devices); i++) {
                 if (dev->id.vendor == devices[i].idVendor &&
diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
index 7800b1410562..2e5302462efb 100644
--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -461,7 +461,7 @@ static int logi_dj_recv_send_report(struct dj_receiver_dev *djrcv_dev,
         struct hid_report *report;
         struct hid_report_enum *output_report_enum;
         u8 *data = (u8 *)(&dj_report->device_index);
-        int i;
+        unsigned int i;
 
         output_report_enum = &hdev->report_enum[HID_OUTPUT_REPORT];
         report = output_report_enum->report_id_hash[REPORT_ID_DJ_SHORT];
@@ -471,7 +471,7 @@ static int logi_dj_recv_send_report(struct dj_receiver_dev *djrcv_dev,
                 return -ENODEV;
         }
 
-        for (i = 0; i < report->field[0]->report_count; i++)
+        for (i = 0; i < DJREPORT_SHORT_LENGTH - 1; i++)
                 report->field[0]->value[i] = data[i];
 
         hid_hw_request(hdev, report, HID_REQ_SET_REPORT);
@@ -791,6 +791,12 @@ static int logi_dj_probe(struct hid_device *hdev,
                 goto hid_parse_fail;
         }
 
+        if (!hid_validate_values(hdev, HID_OUTPUT_REPORT, REPORT_ID_DJ_SHORT,
+                                 0, DJREPORT_SHORT_LENGTH - 1)) {
+                retval = -ENODEV;
+                goto hid_parse_fail;
+        }
+
         /* Starts the usb device and connects to upper interfaces hiddev and
          * hidraw */
         retval = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index ac28f08c3866..5e5fe1b8eebb 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -101,9 +101,9 @@ struct mt_device {
         unsigned last_slot_field;       /* the last field of a slot */
         unsigned mt_report_id;  /* the report ID of the multitouch device */
         unsigned pen_report_id; /* the report ID of the pen device */
-        __s8 inputmode;         /* InputMode HID feature, -1 if non-existent */
-        __s8 inputmode_index;   /* InputMode HID feature index in the report */
-        __s8 maxcontact_report_id;      /* Maximum Contact Number HID feature,
+        __s16 inputmode;        /* InputMode HID feature, -1 if non-existent */
+        __s16 inputmode_index;  /* InputMode HID feature index in the report */
+        __s16 maxcontact_report_id;     /* Maximum Contact Number HID feature,
                                    -1 if non-existent */
         __u8 num_received;      /* how many contacts we received */
         __u8 num_expected;      /* expected last contact index */
@@ -312,20 +312,18 @@ static void mt_feature_mapping(struct hid_device *hdev,
                 struct hid_field *field, struct hid_usage *usage)
 {
         struct mt_device *td = hid_get_drvdata(hdev);
-        int i;
 
         switch (usage->hid) {
         case HID_DG_INPUTMODE:
-                td->inputmode = field->report->id;
-                td->inputmode_index = 0; /* has to be updated below */
-
-                for (i=0; i < field->maxusage; i++) {
-                        if (field->usage[i].hid == usage->hid) {
-                                td->inputmode_index = i;
-                                break;
-                        }
+                /* Ignore if value index is out of bounds. */
+                if (usage->usage_index >= field->report_count) {
+                        dev_err(&hdev->dev, "HID_DG_INPUTMODE out of range\n");
+                        break;
                 }
 
+                td->inputmode = field->report->id;
+                td->inputmode_index = usage->usage_index;
+
                 break;
         case HID_DG_CONTACTMAX:
                 td->maxcontact_report_id = field->report->id;
@@ -511,6 +509,10 @@ static int mt_touch_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                         mt_store_field(usage, td, hi);
                         return 1;
                 case HID_DG_CONTACTCOUNT:
+                        /* Ignore if indexes are out of bounds. */
+                        if (field->index >= field->report->maxfield ||
+                            usage->usage_index >= field->report_count)
+                                return 1;
                         td->cc_index = field->index;
                         td->cc_value_index = usage->usage_index;
                         return 1;
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index 30dbb6b40bbf..b18320db5f7d 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -537,6 +537,10 @@ static int buzz_init(struct hid_device *hdev)
         drv_data = hid_get_drvdata(hdev);
         BUG_ON(!(drv_data->quirks & BUZZ_CONTROLLER));
 
+        /* Validate expected report characteristics. */
+        if (!hid_validate_values(hdev, HID_OUTPUT_REPORT, 0, 0, 7))
+                return -ENODEV;
+
         buzz = kzalloc(sizeof(*buzz), GFP_KERNEL);
         if (!buzz) {
                 hid_err(hdev, "Insufficient memory, cannot allocate driver data\n");
diff --git a/drivers/hid/hid-steelseries.c b/drivers/hid/hid-steelseries.c
index d16491192112..29f328f411fb 100644
--- a/drivers/hid/hid-steelseries.c
+++ b/drivers/hid/hid-steelseries.c
@@ -249,6 +249,11 @@ static int steelseries_srws1_probe(struct hid_device *hdev,
                 goto err_free;
         }
 
+        if (!hid_validate_values(hdev, HID_OUTPUT_REPORT, 0, 0, 16)) {
+                ret = -ENODEV;
+                goto err_free;
+        }
+
         ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
         if (ret) {
                 hid_err(hdev, "hw start failed\n");
diff --git a/drivers/hid/hid-zpff.c b/drivers/hid/hid-zpff.c
index 6ec28a37c146..a29756c6ca02 100644
--- a/drivers/hid/hid-zpff.c
+++ b/drivers/hid/hid-zpff.c
@@ -68,21 +68,13 @@ static int zpff_init(struct hid_device *hid)
         struct hid_report *report;
         struct hid_input *hidinput = list_entry(hid->inputs.next,
                                                 struct hid_input, list);
-        struct list_head *report_list =
-                        &hid->report_enum[HID_OUTPUT_REPORT].report_list;
         struct input_dev *dev = hidinput->input;
-        int error;
+        int i, error;
 
-        if (list_empty(report_list)) {
-                hid_err(hid, "no output report found\n");
-                return -ENODEV;
-        }
-
-        report = list_entry(report_list->next, struct hid_report, list);
-
-        if (report->maxfield < 4) {
-                hid_err(hid, "not enough fields in report\n");
-                return -ENODEV;
+        for (i = 0; i < 4; i++) {
+                report = hid_validate_values(hid, HID_OUTPUT_REPORT, 0, i, 1);
+                if (!report)
+                        return -ENODEV;
         }
 
         zpff = kzalloc(sizeof(struct zpff_device), GFP_KERNEL);
diff --git a/drivers/isdn/hardware/mISDN/hfcpci.c b/drivers/isdn/hardware/mISDN/hfcpci.c
index 7f910c76ca0a..3c92780bda09 100644
--- a/drivers/isdn/hardware/mISDN/hfcpci.c
+++ b/drivers/isdn/hardware/mISDN/hfcpci.c
@@ -2295,8 +2295,8 @@ _hfcpci_softirq(struct device *dev, void *arg)
 static void
 hfcpci_softirq(void *arg)
 {
-        (void) driver_for_each_device(&hfc_driver.driver, NULL, arg,
-                                      _hfcpci_softirq);
+        WARN_ON_ONCE(driver_for_each_device(&hfc_driver.driver, NULL, arg,
+                                      _hfcpci_softirq) != 0);
 
         /* if next event would be in the past ... */
         if ((s32)(hfc_jiffies + tics - jiffies) <= 0)
diff --git a/drivers/isdn/hisax/amd7930_fn.c b/drivers/isdn/hisax/amd7930_fn.c
index 1063babe1d3a..36817e0a0b94 100644
--- a/drivers/isdn/hisax/amd7930_fn.c
+++ b/drivers/isdn/hisax/amd7930_fn.c
@@ -314,7 +314,7 @@ Amd7930_empty_Dfifo(struct IsdnCardState *cs, int flag)
 
                                                         t += sprintf(t, "Amd7930: empty_Dfifo cnt: %d |", cs->rcvidx);
                                                         QuickHex(t, cs->rcvbuf, cs->rcvidx);
-                                                        debugl1(cs, cs->dlog);
+                                                        debugl1(cs, "%s", cs->dlog);
                                                 }
                                                 /* moves received data in sk-buffer */
                                                 memcpy(skb_put(skb, cs->rcvidx), cs->rcvbuf, cs->rcvidx);
@@ -406,7 +406,7 @@ Amd7930_fill_Dfifo(struct IsdnCardState *cs)
 
                 t += sprintf(t, "Amd7930: fill_Dfifo cnt: %d |", count);
                 QuickHex(t, deb_ptr, count);
-                debugl1(cs, cs->dlog);
+                debugl1(cs, "%s", cs->dlog);
         }
         /* AMD interrupts on */
         AmdIrqOn(cs);
diff --git a/drivers/isdn/hisax/avm_pci.c b/drivers/isdn/hisax/avm_pci.c
index ee9b9a03cffa..d1427bd6452d 100644
--- a/drivers/isdn/hisax/avm_pci.c
+++ b/drivers/isdn/hisax/avm_pci.c
@@ -285,7 +285,7 @@ hdlc_empty_fifo(struct BCState *bcs, int count)
                 t += sprintf(t, "hdlc_empty_fifo %c cnt %d",
                              bcs->channel ? 'B' : 'A', count);
                 QuickHex(t, p, count);
-                debugl1(cs, bcs->blog);
+                debugl1(cs, "%s", bcs->blog);
         }
 }
 
@@ -345,7 +345,7 @@ hdlc_fill_fifo(struct BCState *bcs)
                 t += sprintf(t, "hdlc_fill_fifo %c cnt %d",
                              bcs->channel ? 'B' : 'A', count);
                 QuickHex(t, p, count);
-                debugl1(cs, bcs->blog);
+                debugl1(cs, "%s", bcs->blog);
         }
 }
 
diff --git a/drivers/isdn/hisax/config.c b/drivers/isdn/hisax/config.c
index bf04d2a3cf4a..b33f53b3ca93 100644
--- a/drivers/isdn/hisax/config.c
+++ b/drivers/isdn/hisax/config.c
@@ -1896,7 +1896,7 @@ static void EChannel_proc_rcv(struct hisax_d_if *d_if)
                                 ptr--;
                                 *ptr++ = '\n';
                                 *ptr = 0;
-                                HiSax_putstatus(cs, NULL, cs->dlog);
+                                HiSax_putstatus(cs, NULL, "%s", cs->dlog);
                         } else
                                 HiSax_putstatus(cs, "LogEcho: ",
                                                 "warning Frame too big (%d)",
diff --git a/drivers/isdn/hisax/diva.c b/drivers/isdn/hisax/diva.c
index 8d0cf6e4dc00..4fc90de68d18 100644
--- a/drivers/isdn/hisax/diva.c
+++ b/drivers/isdn/hisax/diva.c
@@ -427,7 +427,7 @@ Memhscx_empty_fifo(struct BCState *bcs, int count)
                 t += sprintf(t, "hscx_empty_fifo %c cnt %d",
                              bcs->hw.hscx.hscx ? 'B' : 'A', count);
                 QuickHex(t, ptr, count);
-                debugl1(cs, bcs->blog);
+                debugl1(cs, "%s", bcs->blog);
         }
 }
 
@@ -469,7 +469,7 @@ Memhscx_fill_fifo(struct BCState *bcs)
                 t += sprintf(t, "hscx_fill_fifo %c cnt %d",
                              bcs->hw.hscx.hscx ? 'B' : 'A', count);
                 QuickHex(t, ptr, count);
-                debugl1(cs, bcs->blog);
+                debugl1(cs, "%s", bcs->blog);
         }
 }
 
diff --git a/drivers/isdn/hisax/elsa.c b/drivers/isdn/hisax/elsa.c
index 1df6f9a56ca2..2be1c8a3bb5f 100644
--- a/drivers/isdn/hisax/elsa.c
+++ b/drivers/isdn/hisax/elsa.c
@@ -535,7 +535,7 @@ check_arcofi(struct IsdnCardState *cs)
                 t = tmp;
                 t += sprintf(tmp, "Arcofi data");
                 QuickHex(t, p, cs->dc.isac.mon_rxp);
-                debugl1(cs, tmp);
+                debugl1(cs, "%s", tmp);
                 if ((cs->dc.isac.mon_rxp == 2) && (cs->dc.isac.mon_rx[0] == 0xa0)) {
                         switch (cs->dc.isac.mon_rx[1]) {
                         case 0x80:
diff --git a/drivers/isdn/hisax/elsa_ser.c b/drivers/isdn/hisax/elsa_ser.c
index d4c98d330bfe..3f84dd8f1757 100644
--- a/drivers/isdn/hisax/elsa_ser.c
+++ b/drivers/isdn/hisax/elsa_ser.c
@@ -344,7 +344,7 @@ static inline void receive_chars(struct IsdnCardState *cs,
 
                 t += sprintf(t, "modem read cnt %d", cs->hw.elsa.rcvcnt);
                 QuickHex(t, cs->hw.elsa.rcvbuf, cs->hw.elsa.rcvcnt);
-                debugl1(cs, tmp);
+                debugl1(cs, "%s", tmp);
         }
         cs->hw.elsa.rcvcnt = 0;
 }
diff --git a/drivers/isdn/hisax/hfc_pci.c b/drivers/isdn/hisax/hfc_pci.c
index 3ccd724ff8c2..497bd026c237 100644
--- a/drivers/isdn/hisax/hfc_pci.c
+++ b/drivers/isdn/hisax/hfc_pci.c
@@ -901,7 +901,7 @@ Begin:
                                         ptr--;
                                         *ptr++ = '\n';
                                         *ptr = 0;
-                                        HiSax_putstatus(cs, NULL, cs->dlog);
+                                        HiSax_putstatus(cs, NULL, "%s", cs->dlog);
                                 } else
                                         HiSax_putstatus(cs, "LogEcho: ", "warning Frame too big (%d)", total - 3);
                         }
diff --git a/drivers/isdn/hisax/hfc_sx.c b/drivers/isdn/hisax/hfc_sx.c
index dc4574f735ef..fa1fefd711cd 100644
--- a/drivers/isdn/hisax/hfc_sx.c
+++ b/drivers/isdn/hisax/hfc_sx.c
@@ -674,7 +674,7 @@ receive_emsg(struct IsdnCardState *cs)
                                         ptr--;
                                         *ptr++ = '\n';
                                         *ptr = 0;
-                                        HiSax_putstatus(cs, NULL, cs->dlog);
+                                        HiSax_putstatus(cs, NULL, "%s", cs->dlog);
                                 } else
                                         HiSax_putstatus(cs, "LogEcho: ", "warning Frame too big (%d)", skb->len);
                         }
diff --git a/drivers/isdn/hisax/hscx_irq.c b/drivers/isdn/hisax/hscx_irq.c
index f398d4838937..a8d6188402c6 100644
--- a/drivers/isdn/hisax/hscx_irq.c
+++ b/drivers/isdn/hisax/hscx_irq.c
@@ -75,7 +75,7 @@ hscx_empty_fifo(struct BCState *bcs, int count)
                 t += sprintf(t, "hscx_empty_fifo %c cnt %d",
                              bcs->hw.hscx.hscx ? 'B' : 'A', count);
                 QuickHex(t, ptr, count);
-                debugl1(cs, bcs->blog);
+                debugl1(cs, "%s", bcs->blog);
         }
 }
 
@@ -115,7 +115,7 @@ hscx_fill_fifo(struct BCState *bcs)
                 t += sprintf(t, "hscx_fill_fifo %c cnt %d",
                              bcs->hw.hscx.hscx ? 'B' : 'A', count);
                 QuickHex(t, ptr, count);
-                debugl1(cs, bcs->blog);
+                debugl1(cs, "%s", bcs->blog);
         }
 }
 
diff --git a/drivers/isdn/hisax/icc.c b/drivers/isdn/hisax/icc.c
index db5321f6379b..51dae9167238 100644
--- a/drivers/isdn/hisax/icc.c
+++ b/drivers/isdn/hisax/icc.c
@@ -134,7 +134,7 @@ icc_empty_fifo(struct IsdnCardState *cs, int count)
 
                 t += sprintf(t, "icc_empty_fifo cnt %d", count);
                 QuickHex(t, ptr, count);
-                debugl1(cs, cs->dlog);
+                debugl1(cs, "%s", cs->dlog);
         }
 }
 
@@ -176,7 +176,7 @@ icc_fill_fifo(struct IsdnCardState *cs)
 
                 t += sprintf(t, "icc_fill_fifo cnt %d", count);
                 QuickHex(t, ptr, count);
-                debugl1(cs, cs->dlog);
+                debugl1(cs, "%s", cs->dlog);
         }
 }
 
diff --git a/drivers/isdn/hisax/ipacx.c b/drivers/isdn/hisax/ipacx.c
index 74feb5c83067..5faa5de24305 100644
--- a/drivers/isdn/hisax/ipacx.c
+++ b/drivers/isdn/hisax/ipacx.c
@@ -260,7 +260,7 @@ dch_empty_fifo(struct IsdnCardState *cs, int count)
 
                 t += sprintf(t, "dch_empty_fifo() cnt %d", count);
                 QuickHex(t, ptr, count);
-                debugl1(cs, cs->dlog);
+                debugl1(cs, "%s", cs->dlog);
         }
 }
 
@@ -307,7 +307,7 @@ dch_fill_fifo(struct IsdnCardState *cs)
 
                 t += sprintf(t, "dch_fill_fifo() cnt %d", count);
                 QuickHex(t, ptr, count);
-                debugl1(cs, cs->dlog);
+                debugl1(cs, "%s", cs->dlog);
         }
 }
 
@@ -539,7 +539,7 @@ bch_empty_fifo(struct BCState *bcs, int count)
 
                 t += sprintf(t, "bch_empty_fifo() B-%d cnt %d", hscx, count);
                 QuickHex(t, ptr, count);
-                debugl1(cs, bcs->blog);
+                debugl1(cs, "%s", bcs->blog);
         }
 }
 
@@ -582,7 +582,7 @@ bch_fill_fifo(struct BCState *bcs)
 
                 t += sprintf(t, "chb_fill_fifo() B-%d cnt %d", hscx, count);
                 QuickHex(t, ptr, count);
-                debugl1(cs, bcs->blog);
+                debugl1(cs, "%s", bcs->blog);
         }
 }
 
diff --git a/drivers/isdn/hisax/isac.c b/drivers/isdn/hisax/isac.c
index a365ccc1c99c..7fdf78f46433 100644
--- a/drivers/isdn/hisax/isac.c
+++ b/drivers/isdn/hisax/isac.c
@@ -137,7 +137,7 @@ isac_empty_fifo(struct IsdnCardState *cs, int count)
 
                 t += sprintf(t, "isac_empty_fifo cnt %d", count);
                 QuickHex(t, ptr, count);
-                debugl1(cs, cs->dlog);
+                debugl1(cs, "%s", cs->dlog);
         }
 }
 
@@ -179,7 +179,7 @@ isac_fill_fifo(struct IsdnCardState *cs)
 
                 t += sprintf(t, "isac_fill_fifo cnt %d", count);
                 QuickHex(t, ptr, count);
-                debugl1(cs, cs->dlog);
+                debugl1(cs, "%s", cs->dlog);
         }
 }
 
diff --git a/drivers/isdn/hisax/isar.c b/drivers/isdn/hisax/isar.c
index 7fdf34704fe5..f4956c73aa11 100644
--- a/drivers/isdn/hisax/isar.c
+++ b/drivers/isdn/hisax/isar.c
@@ -74,7 +74,7 @@ sendmsg(struct IsdnCardState *cs, u_char his, u_char creg, u_char len,
                                 t = tmp;
                                 t += sprintf(t, "sendmbox cnt %d", len);
                                 QuickHex(t, &msg[len-i], (i > 64) ? 64 : i);
-                                debugl1(cs, tmp);
+                                debugl1(cs, "%s", tmp);
                                 i -= 64;
                         }
                 }
@@ -105,7 +105,7 @@ rcv_mbox(struct IsdnCardState *cs, struct isar_reg *ireg, u_char *msg)
                                 t = tmp;
                                 t += sprintf(t, "rcv_mbox cnt %d", ireg->clsb);
                                 QuickHex(t, &msg[ireg->clsb - i], (i > 64) ? 64 : i);
-                                debugl1(cs, tmp);
+                                debugl1(cs, "%s", tmp);
                                 i -= 64;
                         }
                 }
@@ -1248,7 +1248,7 @@ isar_int_main(struct IsdnCardState *cs)
                         tp += sprintf(debbuf, "msg iis(%x) msb(%x)",
                                       ireg->iis, ireg->cmsb);
                         QuickHex(tp, (u_char *)ireg->par, ireg->clsb);
-                        debugl1(cs, debbuf);
+                        debugl1(cs, "%s", debbuf);
                 }
                 break;
         case ISAR_IIS_INVMSG:
diff --git a/drivers/isdn/hisax/jade.c b/drivers/isdn/hisax/jade.c
index f946c58d8ab1..e2ae7871a209 100644
--- a/drivers/isdn/hisax/jade.c
+++ b/drivers/isdn/hisax/jade.c
@@ -81,10 +81,7 @@ modejade(struct BCState *bcs, int mode, int bc)
         int jade = bcs->hw.hscx.hscx;
 
         if (cs->debug & L1_DEB_HSCX) {
-                char tmp[40];
-                sprintf(tmp, "jade %c mode %d ichan %d",
-                        'A' + jade, mode, bc);
-                debugl1(cs, tmp);
+                debugl1(cs, "jade %c mode %d ichan %d", 'A' + jade, mode, bc);
         }
         bcs->mode = mode;
         bcs->channel = bc;
@@ -257,23 +254,18 @@ void
 clear_pending_jade_ints(struct IsdnCardState *cs)
 {
         int val;
-        char tmp[64];
 
         cs->BC_Write_Reg(cs, 0, jade_HDLC_IMR, 0x00);
         cs->BC_Write_Reg(cs, 1, jade_HDLC_IMR, 0x00);
 
         val = cs->BC_Read_Reg(cs, 1, jade_HDLC_ISR);
-        sprintf(tmp, "jade B ISTA %x", val);
-        debugl1(cs, tmp);
+        debugl1(cs, "jade B ISTA %x", val);
         val = cs->BC_Read_Reg(cs, 0, jade_HDLC_ISR);
-        sprintf(tmp, "jade A ISTA %x", val);
-        debugl1(cs, tmp);
+        debugl1(cs, "jade A ISTA %x", val);
         val = cs->BC_Read_Reg(cs, 1, jade_HDLC_STAR);
-        sprintf(tmp, "jade B STAR %x", val);
-        debugl1(cs, tmp);
+        debugl1(cs, "jade B STAR %x", val);
         val = cs->BC_Read_Reg(cs, 0, jade_HDLC_STAR);
-        sprintf(tmp, "jade A STAR %x", val);
-        debugl1(cs, tmp);
+        debugl1(cs, "jade A STAR %x", val);
         /* Unmask ints */
         cs->BC_Write_Reg(cs, 0, jade_HDLC_IMR, 0xF8);
         cs->BC_Write_Reg(cs, 1, jade_HDLC_IMR, 0xF8);
diff --git a/drivers/isdn/hisax/jade_irq.c b/drivers/isdn/hisax/jade_irq.c
index f521fc83dc76..b930da9b5aa6 100644
--- a/drivers/isdn/hisax/jade_irq.c
+++ b/drivers/isdn/hisax/jade_irq.c
@@ -65,7 +65,7 @@ jade_empty_fifo(struct BCState *bcs, int count)
                 t += sprintf(t, "jade_empty_fifo %c cnt %d",
                              bcs->hw.hscx.hscx ? 'B' : 'A', count);
                 QuickHex(t, ptr, count);
-                debugl1(cs, bcs->blog);
+                debugl1(cs, "%s", bcs->blog);
         }
 }
 
@@ -105,7 +105,7 @@ jade_fill_fifo(struct BCState *bcs)
                 t += sprintf(t, "jade_fill_fifo %c cnt %d",
                              bcs->hw.hscx.hscx ? 'B' : 'A', count);
                 QuickHex(t, ptr, count);
-                debugl1(cs, bcs->blog);
+                debugl1(cs, "%s", bcs->blog);
         }
 }
 
diff --git a/drivers/isdn/hisax/l3_1tr6.c b/drivers/isdn/hisax/l3_1tr6.c
index 4c1bca5caa1d..875402e76d0a 100644
--- a/drivers/isdn/hisax/l3_1tr6.c
+++ b/drivers/isdn/hisax/l3_1tr6.c
@@ -63,7 +63,7 @@ l3_1tr6_error(struct l3_process *pc, u_char *msg, struct sk_buff *skb)
 {
         dev_kfree_skb(skb);
         if (pc->st->l3.debug & L3_DEB_WARN)
-                l3_debug(pc->st, msg);
+                l3_debug(pc->st, "%s", msg);
         l3_1tr6_release_req(pc, 0, NULL);
 }
 
@@ -161,7 +161,6 @@ l3_1tr6_setup(struct l3_process *pc, u_char pr, void *arg)
 {
         u_char *p;
         int bcfound = 0;
-        char tmp[80];
         struct sk_buff *skb = arg;
 
         /* Channel Identification */
@@ -214,10 +213,9 @@ l3_1tr6_setup(struct l3_process *pc, u_char pr, void *arg)
         /* Signal all services, linklevel takes care of Service-Indicator */
         if (bcfound) {
                 if ((pc->para.setup.si1 != 7) && (pc->st->l3.debug & L3_DEB_WARN)) {
-                        sprintf(tmp, "non-digital call: %s -> %s",
+                        l3_debug(pc->st, "non-digital call: %s -> %s",
                                 pc->para.setup.phone,
                                 pc->para.setup.eazmsn);
-                        l3_debug(pc->st, tmp);
                 }
                 newl3state(pc, 6);
                 pc->st->l3.l3l4(pc->st, CC_SETUP | INDICATION, pc);
@@ -301,7 +299,7 @@ l3_1tr6_info(struct l3_process *pc, u_char pr, void *arg)
 {
         u_char *p;
         int i, tmpcharge = 0;
-        char a_charge[8], tmp[32];
+        char a_charge[8];
         struct sk_buff *skb = arg;
 
         p = skb->data;
@@ -316,8 +314,8 @@ l3_1tr6_info(struct l3_process *pc, u_char pr, void *arg)
                         pc->st->l3.l3l4(pc->st, CC_CHARGE | INDICATION, pc);
                 }
                 if (pc->st->l3.debug & L3_DEB_CHARGE) {
-                        sprintf(tmp, "charging info %d", pc->para.chargeinfo);
-                        l3_debug(pc->st, tmp);
+                        l3_debug(pc->st, "charging info %d",
+                                 pc->para.chargeinfo);
                 }
         } else if (pc->st->l3.debug & L3_DEB_CHARGE)
                 l3_debug(pc->st, "charging info not found");
@@ -399,7 +397,7 @@ l3_1tr6_disc(struct l3_process *pc, u_char pr, void *arg)
         struct sk_buff *skb = arg;
         u_char *p;
         int i, tmpcharge = 0;
-        char a_charge[8], tmp[32];
+        char a_charge[8];
 
         StopAllL3Timer(pc);
         p = skb->data;
@@ -414,8 +412,8 @@ l3_1tr6_disc(struct l3_process *pc, u_char pr, void *arg)
                         pc->st->l3.l3l4(pc->st, CC_CHARGE | INDICATION, pc);
                 }
                 if (pc->st->l3.debug & L3_DEB_CHARGE) {
-                        sprintf(tmp, "charging info %d", pc->para.chargeinfo);
-                        l3_debug(pc->st, tmp);
+                        l3_debug(pc->st, "charging info %d",
+                                 pc->para.chargeinfo);
                 }
         } else if (pc->st->l3.debug & L3_DEB_CHARGE)
                 l3_debug(pc->st, "charging info not found");
@@ -746,7 +744,6 @@ up1tr6(struct PStack *st, int pr, void *arg)
         int i, mt, cr;
         struct l3_process *proc;
         struct sk_buff *skb = arg;
-        char tmp[80];
 
         switch (pr) {
         case (DL_DATA | INDICATION):
@@ -762,26 +759,23 @@ up1tr6(struct PStack *st, int pr, void *arg)
         }
         if (skb->len < 4) {
                 if (st->l3.debug & L3_DEB_PROTERR) {
-                        sprintf(tmp, "up1tr6 len only %d", skb->len);
-                        l3_debug(st, tmp);
+                        l3_debug(st, "up1tr6 len only %d", skb->len);
                 }
                 dev_kfree_skb(skb);
                 return;
         }
         if ((skb->data[0] & 0xfe) != PROTO_DIS_N0) {
                 if (st->l3.debug & L3_DEB_PROTERR) {
-                        sprintf(tmp, "up1tr6%sunexpected discriminator %x message len %d",
+                        l3_debug(st, "up1tr6%sunexpected discriminator %x message len %d",
                                 (pr == (DL_DATA | INDICATION)) ? " " : "(broadcast) ",
                                 skb->data[0], skb->len);
-                        l3_debug(st, tmp);
                 }
                 dev_kfree_skb(skb);
                 return;
         }
         if (skb->data[1] != 1) {
                 if (st->l3.debug & L3_DEB_PROTERR) {
-                        sprintf(tmp, "up1tr6 CR len not 1");
-                        l3_debug(st, tmp);
+                        l3_debug(st, "up1tr6 CR len not 1");
                 }
                 dev_kfree_skb(skb);
                 return;
@@ -791,9 +785,8 @@ up1tr6(struct PStack *st, int pr, void *arg)
         if (skb->data[0] == PROTO_DIS_N0) {
                 dev_kfree_skb(skb);
                 if (st->l3.debug & L3_DEB_STATE) {
-                        sprintf(tmp, "up1tr6%s N0 mt %x unhandled",
+                        l3_debug(st, "up1tr6%s N0 mt %x unhandled",
                                 (pr == (DL_DATA | INDICATION)) ? " " : "(broadcast) ", mt);
-                        l3_debug(st, tmp);
                 }
         } else if (skb->data[0] == PROTO_DIS_N1) {
                 if (!(proc = getl3proc(st, cr))) {
@@ -801,8 +794,7 @@ up1tr6(struct PStack *st, int pr, void *arg)
                                 if (cr < 128) {
                                         if (!(proc = new_l3_process(st, cr))) {
                                                 if (st->l3.debug & L3_DEB_PROTERR) {
-                                                        sprintf(tmp, "up1tr6 no roc mem");
-                                                        l3_debug(st, tmp);
+                                                        l3_debug(st, "up1tr6 no roc mem");
                                                 }
                                                 dev_kfree_skb(skb);
                                                 return;
@@ -821,8 +813,7 @@ up1tr6(struct PStack *st, int pr, void *arg)
                         } else {
                                 if (!(proc = new_l3_process(st, cr))) {
                                         if (st->l3.debug & L3_DEB_PROTERR) {
-                                                sprintf(tmp, "up1tr6 no roc mem");
-                                                l3_debug(st, tmp);
+                                                l3_debug(st, "up1tr6 no roc mem");
                                         }
                                         dev_kfree_skb(skb);
                                         return;
@@ -837,18 +828,16 @@ up1tr6(struct PStack *st, int pr, void *arg)
                 if (i == ARRAY_SIZE(datastln1)) {
                         dev_kfree_skb(skb);
                         if (st->l3.debug & L3_DEB_STATE) {
-                                sprintf(tmp, "up1tr6%sstate %d mt %x unhandled",
+                                l3_debug(st, "up1tr6%sstate %d mt %x unhandled",
                                         (pr == (DL_DATA | INDICATION)) ? " " : "(broadcast) ",
                                         proc->state, mt);
-                                l3_debug(st, tmp);
                         }
                         return;
                 } else {
                         if (st->l3.debug & L3_DEB_STATE) {
-                                sprintf(tmp, "up1tr6%sstate %d mt %x",
+                                l3_debug(st, "up1tr6%sstate %d mt %x",
                                         (pr == (DL_DATA | INDICATION)) ? " " : "(broadcast) ",
                                         proc->state, mt);
-                                l3_debug(st, tmp);
                         }
                         datastln1[i].rout(proc, pr, skb);
                 }
@@ -861,7 +850,6 @@ down1tr6(struct PStack *st, int pr, void *arg)
         int i, cr;
         struct l3_process *proc;
         struct Channel *chan;
-        char tmp[80];
 
         if ((DL_ESTABLISH | REQUEST) == pr) {
                 l3_msg(st, pr, NULL);
@@ -888,15 +876,13 @@ down1tr6(struct PStack *st, int pr, void *arg)
                         break;
         if (i == ARRAY_SIZE(downstl)) {
                 if (st->l3.debug & L3_DEB_STATE) {
-                        sprintf(tmp, "down1tr6 state %d prim %d unhandled",
+                        l3_debug(st, "down1tr6 state %d prim %d unhandled",
                                 proc->state, pr);
-                        l3_debug(st, tmp);
                 }
         } else {
                 if (st->l3.debug & L3_DEB_STATE) {
-                        sprintf(tmp, "down1tr6 state %d prim %d",
+                        l3_debug(st, "down1tr6 state %d prim %d",
                                 proc->state, pr);
-                        l3_debug(st, tmp);
                 }
                 downstl[i].rout(proc, pr, arg);
         }
diff --git a/drivers/isdn/hisax/netjet.c b/drivers/isdn/hisax/netjet.c
index b646eed379df..233e432e06f6 100644
--- a/drivers/isdn/hisax/netjet.c
+++ b/drivers/isdn/hisax/netjet.c
@@ -176,7 +176,7 @@ static void printframe(struct IsdnCardState *cs, u_char *buf, int count, char *s
                 else
                         j = i;
                 QuickHex(t, p, j);
-                debugl1(cs, tmp);
+                debugl1(cs, "%s", tmp);
                 p += j;
                 i -= j;
                 t = tmp;
diff --git a/drivers/isdn/hisax/q931.c b/drivers/isdn/hisax/q931.c
index 041bf52d9d0a..af1b020a81f1 100644
--- a/drivers/isdn/hisax/q931.c
+++ b/drivers/isdn/hisax/q931.c
@@ -1179,7 +1179,7 @@ LogFrame(struct IsdnCardState *cs, u_char *buf, int size)
                 dp--;
                 *dp++ = '\n';
                 *dp = 0;
-                HiSax_putstatus(cs, NULL, cs->dlog);
+                HiSax_putstatus(cs, NULL, "%s", cs->dlog);
         } else
                 HiSax_putstatus(cs, "LogFrame: ", "warning Frame too big (%d)", size);
 }
@@ -1246,7 +1246,7 @@ dlogframe(struct IsdnCardState *cs, struct sk_buff *skb, int dir)
         }
         if (finish) {
                 *dp = 0;
-                HiSax_putstatus(cs, NULL, cs->dlog);
+                HiSax_putstatus(cs, NULL, "%s", cs->dlog);
                 return;
         }
         if ((0xfe & buf[0]) == PROTO_DIS_N0) {  /* 1TR6 */
@@ -1509,5 +1509,5 @@ dlogframe(struct IsdnCardState *cs, struct sk_buff *skb, int dir)
                 dp += sprintf(dp, "Unknown protocol %x!", buf[0]);
         }
         *dp = 0;
-        HiSax_putstatus(cs, NULL, cs->dlog);
+        HiSax_putstatus(cs, NULL, "%s", cs->dlog);
 }
diff --git a/drivers/isdn/hisax/w6692.c b/drivers/isdn/hisax/w6692.c
index d8cac6935818..a85895585d90 100644
--- a/drivers/isdn/hisax/w6692.c
+++ b/drivers/isdn/hisax/w6692.c
@@ -154,7 +154,7 @@ W6692_empty_fifo(struct IsdnCardState *cs, int count)
 
                 t += sprintf(t, "W6692_empty_fifo cnt %d", count);
                 QuickHex(t, ptr, count);
-                debugl1(cs, cs->dlog);
+                debugl1(cs, "%s", cs->dlog);
         }
 }
 
@@ -196,7 +196,7 @@ W6692_fill_fifo(struct IsdnCardState *cs)
 
                 t += sprintf(t, "W6692_fill_fifo cnt %d", count);
                 QuickHex(t, ptr, count);
-                debugl1(cs, cs->dlog);
+                debugl1(cs, "%s", cs->dlog);
         }
 }
 
@@ -226,7 +226,7 @@ W6692B_empty_fifo(struct BCState *bcs, int count)
                 t += sprintf(t, "W6692B_empty_fifo %c cnt %d",
                              bcs->channel + '1', count);
                 QuickHex(t, ptr, count);
-                debugl1(cs, bcs->blog);
+                debugl1(cs, "%s", bcs->blog);
         }
 }
 
@@ -264,7 +264,7 @@ W6692B_fill_fifo(struct BCState *bcs)
                 t += sprintf(t, "W6692B_fill_fifo %c cnt %d",
                              bcs->channel + '1', count);
                 QuickHex(t, ptr, count);
-                debugl1(cs, bcs->blog);
+                debugl1(cs, "%s", bcs->blog);
         }
 }
 
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 91f179d5135c..f428ef574372 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -1472,7 +1472,7 @@ void bond_alb_monitor(struct work_struct *work)
         bond_info->lp_counter++;
 
         /* send learning packets */
-        if (bond_info->lp_counter >= BOND_ALB_LP_TICKS) {
+        if (bond_info->lp_counter >= BOND_ALB_LP_TICKS(bond)) {
                 /* change of curr_active_slave involves swapping of mac addresses.
                  * in order to avoid this swapping from happening while
                  * sending the learning packets, the curr_slave_lock must be held for
diff --git a/drivers/net/bonding/bond_alb.h b/drivers/net/bonding/bond_alb.h
index 28d8e4c7dc06..c5eff5dafdfe 100644
--- a/drivers/net/bonding/bond_alb.h
+++ b/drivers/net/bonding/bond_alb.h
@@ -36,14 +36,15 @@ struct slave;
                                          * Used for division - never set
                                          * to zero !!!
                                          */
-#define BOND_ALB_LP_INTERVAL        1   /* In seconds, periodic send of
-                                         * learning packets to the switch
-                                         */
+#define BOND_ALB_DEFAULT_LP_INTERVAL 1
+#define BOND_ALB_LP_INTERVAL(bond) (bond->params.lp_interval)   /* In seconds, periodic send of
+                                                                 * learning packets to the switch
+                                                                 */
 
 #define BOND_TLB_REBALANCE_TICKS (BOND_TLB_REBALANCE_INTERVAL \
                                   * ALB_TIMER_TICKS_PER_SEC)
 
-#define BOND_ALB_LP_TICKS (BOND_ALB_LP_INTERVAL \
+#define BOND_ALB_LP_TICKS(bond) (BOND_ALB_LP_INTERVAL(bond) \
                            * ALB_TIMER_TICKS_PER_SEC)
 
 #define TLB_HASH_TABLE_SIZE 256 /* The size of the clients hash table.
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 72df399c4ab3..55bbb8b8200c 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4416,6 +4416,7 @@ static int bond_check_params(struct bond_params *params)
         params->all_slaves_active = all_slaves_active;
         params->resend_igmp = resend_igmp;
         params->min_links = min_links;
+        params->lp_interval = BOND_ALB_DEFAULT_LP_INTERVAL;
 
         if (primary) {
                 strncpy(params->primary, primary, IFNAMSIZ);
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index eeab40b01b7a..c29b836749b6 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -1699,6 +1699,44 @@ out:
 static DEVICE_ATTR(resend_igmp, S_IRUGO | S_IWUSR,
                    bonding_show_resend_igmp, bonding_store_resend_igmp);
 
+
+static ssize_t bonding_show_lp_interval(struct device *d,
+                                        struct device_attribute *attr,
+                                        char *buf)
+{
+        struct bonding *bond = to_bond(d);
+        return sprintf(buf, "%d\n", bond->params.lp_interval);
+}
+
+static ssize_t bonding_store_lp_interval(struct device *d,
+                                         struct device_attribute *attr,
+                                         const char *buf, size_t count)
+{
+        struct bonding *bond = to_bond(d);
+        int new_value, ret = count;
+
+        if (sscanf(buf, "%d", &new_value) != 1) {
+                pr_err("%s: no lp interval value specified.\n",
+                        bond->dev->name);
+                ret = -EINVAL;
+                goto out;
+        }
+
+        if (new_value <= 0) {
+                pr_err ("%s: lp_interval must be between 1 and %d\n",
+                        bond->dev->name, INT_MAX);
+                ret = -EINVAL;
+                goto out;
+        }
+
+        bond->params.lp_interval = new_value;
+out:
+        return ret;
+}
+
+static DEVICE_ATTR(lp_interval, S_IRUGO | S_IWUSR,
+                   bonding_show_lp_interval, bonding_store_lp_interval);
+
 static struct attribute *per_bond_attrs[] = {
         &dev_attr_slaves.attr,
         &dev_attr_mode.attr,
@@ -1729,6 +1767,7 @@ static struct attribute *per_bond_attrs[] = {
         &dev_attr_all_slaves_active.attr,
         &dev_attr_resend_igmp.attr,
         &dev_attr_min_links.attr,
+        &dev_attr_lp_interval.attr,
         NULL,
 };
 
diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
index 7ad8bd5cc947..03cf3fd14490 100644
--- a/drivers/net/bonding/bonding.h
+++ b/drivers/net/bonding/bonding.h
@@ -176,6 +176,7 @@ struct bond_params {
         int tx_queues;
         int all_slaves_active;
         int resend_igmp;
+        int lp_interval;
 };
 
 struct bond_parm_tbl {
diff --git a/drivers/net/ethernet/adi/bfin_mac.c b/drivers/net/ethernet/adi/bfin_mac.c
index e66684a438f5..75fb1d20d6fd 100644
--- a/drivers/net/ethernet/adi/bfin_mac.c
+++ b/drivers/net/ethernet/adi/bfin_mac.c
@@ -530,7 +530,7 @@ static int bfin_mac_ethtool_setwol(struct net_device *dev,
         if (lp->wol && !lp->irq_wake_requested) {
                 /* register wake irq handler */
                 rc = request_irq(IRQ_MAC_WAKEDET, bfin_mac_wake_interrupt,
-                                 IRQF_DISABLED, "EMAC_WAKE", dev);
+                                 0, "EMAC_WAKE", dev);
                 if (rc)
                         return rc;
                 lp->irq_wake_requested = true;
@@ -1686,7 +1686,7 @@ static int bfin_mac_probe(struct platform_device *pdev)
         /* now, enable interrupts */
         /* register irq handler */
         rc = request_irq(IRQ_MAC_RX, bfin_mac_interrupt,
-                        IRQF_DISABLED, "EMAC_RX", ndev);
+                        0, "EMAC_RX", ndev);
         if (rc) {
                 dev_err(&pdev->dev, "Cannot request Blackfin MAC RX IRQ!\n");
                 rc = -EBUSY;
diff --git a/drivers/net/ethernet/amd/sun3lance.c b/drivers/net/ethernet/amd/sun3lance.c
index d6b20296b8e4..3d8c6b2cdea4 100644
--- a/drivers/net/ethernet/amd/sun3lance.c
+++ b/drivers/net/ethernet/amd/sun3lance.c
@@ -358,7 +358,7 @@ static int __init lance_probe( struct net_device *dev)
 
         REGA(CSR0) = CSR0_STOP;
 
-        if (request_irq(LANCE_IRQ, lance_interrupt, IRQF_DISABLED, "SUN3 Lance", dev) < 0) {
+        if (request_irq(LANCE_IRQ, lance_interrupt, 0, "SUN3 Lance", dev) < 0) {
 #ifdef CONFIG_SUN3
                 iounmap((void __iomem *)ioaddr);
 #endif
diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
index 027398ebbba6..fc95b235e210 100644
--- a/drivers/net/ethernet/atheros/alx/main.c
+++ b/drivers/net/ethernet/atheros/alx/main.c
@@ -1188,7 +1188,7 @@ static int alx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         struct alx_priv *alx;
         struct alx_hw *hw;
         bool phy_configured;
-        int bars, pm_cap, err;
+        int bars, err;
 
         err = pci_enable_device_mem(pdev);
         if (err)
@@ -1225,18 +1225,13 @@ static int alx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         pci_enable_pcie_error_reporting(pdev);
         pci_set_master(pdev);
 
-        pm_cap = pci_find_capability(pdev, PCI_CAP_ID_PM);
-        if (pm_cap == 0) {
+        if (!pdev->pm_cap) {
                 dev_err(&pdev->dev,
                         "Can't find power management capability, aborting\n");
                 err = -EIO;
                 goto out_pci_release;
         }
 
-        err = pci_set_power_state(pdev, PCI_D0);
-        if (err)
-                goto out_pci_release;
-
         netdev = alloc_etherdev(sizeof(*alx));
         if (!netdev) {
                 err = -ENOMEM;
diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c
index eec0af45b859..249468f95365 100644
--- a/drivers/net/ethernet/broadcom/bgmac.c
+++ b/drivers/net/ethernet/broadcom/bgmac.c
@@ -157,6 +157,7 @@ static netdev_tx_t bgmac_dma_tx_add(struct bgmac *bgmac,
         if (++ring->end >= BGMAC_TX_RING_SLOTS)
                 ring->end = 0;
         bgmac_write(bgmac, ring->mmio_base + BGMAC_DMA_TX_INDEX,
+                    ring->index_base +
                     ring->end * sizeof(struct bgmac_dma_desc));
 
         /* Always keep one slot free to allow detecting bugged calls. */
@@ -181,6 +182,8 @@ static void bgmac_dma_tx_free(struct bgmac *bgmac, struct bgmac_dma_ring *ring)
         /* The last slot that hardware didn't consume yet */
         empty_slot = bgmac_read(bgmac, ring->mmio_base + BGMAC_DMA_TX_STATUS);
         empty_slot &= BGMAC_DMA_TX_STATDPTR;
+        empty_slot -= ring->index_base;
+        empty_slot &= BGMAC_DMA_TX_STATDPTR;
         empty_slot /= sizeof(struct bgmac_dma_desc);
 
         while (ring->start != empty_slot) {
@@ -274,6 +277,8 @@ static int bgmac_dma_rx_read(struct bgmac *bgmac, struct bgmac_dma_ring *ring,
 
         end_slot = bgmac_read(bgmac, ring->mmio_base + BGMAC_DMA_RX_STATUS);
         end_slot &= BGMAC_DMA_RX_STATDPTR;
+        end_slot -= ring->index_base;
+        end_slot &= BGMAC_DMA_RX_STATDPTR;
         end_slot /= sizeof(struct bgmac_dma_desc);
 
         ring->end = end_slot;
@@ -418,9 +423,6 @@ static int bgmac_dma_alloc(struct bgmac *bgmac)
                 ring = &bgmac->tx_ring[i];
                 ring->num_slots = BGMAC_TX_RING_SLOTS;
                 ring->mmio_base = ring_base[i];
-                if (bgmac_dma_unaligned(bgmac, ring, BGMAC_DMA_RING_TX))
-                        bgmac_warn(bgmac, "TX on ring 0x%X supports unaligned addressing but this feature is not implemented\n",
-                                   ring->mmio_base);
 
                 /* Alloc ring of descriptors */
                 size = ring->num_slots * sizeof(struct bgmac_dma_desc);
@@ -435,6 +437,13 @@ static int bgmac_dma_alloc(struct bgmac *bgmac)
                 if (ring->dma_base & 0xC0000000)
                         bgmac_warn(bgmac, "DMA address using 0xC0000000 bit(s), it may need translation trick\n");
 
+                ring->unaligned = bgmac_dma_unaligned(bgmac, ring,
+                                                      BGMAC_DMA_RING_TX);
+                if (ring->unaligned)
+                        ring->index_base = lower_32_bits(ring->dma_base);
+                else
+                        ring->index_base = 0;
+
                 /* No need to alloc TX slots yet */
         }
 
@@ -444,9 +453,6 @@ static int bgmac_dma_alloc(struct bgmac *bgmac)
                 ring = &bgmac->rx_ring[i];
                 ring->num_slots = BGMAC_RX_RING_SLOTS;
                 ring->mmio_base = ring_base[i];
-                if (bgmac_dma_unaligned(bgmac, ring, BGMAC_DMA_RING_RX))
-                        bgmac_warn(bgmac, "RX on ring 0x%X supports unaligned addressing but this feature is not implemented\n",
-                                   ring->mmio_base);
 
                 /* Alloc ring of descriptors */
                 size = ring->num_slots * sizeof(struct bgmac_dma_desc);
@@ -462,6 +468,13 @@ static int bgmac_dma_alloc(struct bgmac *bgmac)
                 if (ring->dma_base & 0xC0000000)
                         bgmac_warn(bgmac, "DMA address using 0xC0000000 bit(s), it may need translation trick\n");
 
+                ring->unaligned = bgmac_dma_unaligned(bgmac, ring,
+                                                      BGMAC_DMA_RING_RX);
+                if (ring->unaligned)
+                        ring->index_base = lower_32_bits(ring->dma_base);
+                else
+                        ring->index_base = 0;
+
                 /* Alloc RX slots */
                 for (j = 0; j < ring->num_slots; j++) {
                         err = bgmac_dma_rx_skb_for_slot(bgmac, &ring->slots[j]);
@@ -489,12 +502,14 @@ static void bgmac_dma_init(struct bgmac *bgmac)
         for (i = 0; i < BGMAC_MAX_TX_RINGS; i++) {
                 ring = &bgmac->tx_ring[i];
 
-                /* We don't implement unaligned addressing, so enable first */
-                bgmac_dma_tx_enable(bgmac, ring);
+                if (!ring->unaligned)
+                        bgmac_dma_tx_enable(bgmac, ring);
                 bgmac_write(bgmac, ring->mmio_base + BGMAC_DMA_TX_RINGLO,
                             lower_32_bits(ring->dma_base));
                 bgmac_write(bgmac, ring->mmio_base + BGMAC_DMA_TX_RINGHI,
                             upper_32_bits(ring->dma_base));
+                if (ring->unaligned)
+                        bgmac_dma_tx_enable(bgmac, ring);
 
                 ring->start = 0;
                 ring->end = 0;  /* Points the slot that should *not* be read */
@@ -505,12 +520,14 @@ static void bgmac_dma_init(struct bgmac *bgmac)
 
                 ring = &bgmac->rx_ring[i];
 
-                /* We don't implement unaligned addressing, so enable first */
-                bgmac_dma_rx_enable(bgmac, ring);
+                if (!ring->unaligned)
+                        bgmac_dma_rx_enable(bgmac, ring);
                 bgmac_write(bgmac, ring->mmio_base + BGMAC_DMA_RX_RINGLO,
                             lower_32_bits(ring->dma_base));
                 bgmac_write(bgmac, ring->mmio_base + BGMAC_DMA_RX_RINGHI,
                             upper_32_bits(ring->dma_base));
+                if (ring->unaligned)
+                        bgmac_dma_rx_enable(bgmac, ring);
 
                 for (j = 0, dma_desc = ring->cpu_base; j < ring->num_slots;
                      j++, dma_desc++) {
@@ -531,6 +548,7 @@ static void bgmac_dma_init(struct bgmac *bgmac)
                 }
 
                 bgmac_write(bgmac, ring->mmio_base + BGMAC_DMA_RX_INDEX,
+                            ring->index_base +
                             ring->num_slots * sizeof(struct bgmac_dma_desc));
 
                 ring->start = 0;
@@ -908,10 +926,10 @@ static void bgmac_chip_reset(struct bgmac *bgmac)
                 struct bcma_drv_cc *cc = &bgmac->core->bus->drv_cc;
                 u8 et_swtype = 0;
                 u8 sw_type = BGMAC_CHIPCTL_1_SW_TYPE_EPHY |
-                             BGMAC_CHIPCTL_1_IF_TYPE_RMII;
-                char buf[2];
+                             BGMAC_CHIPCTL_1_IF_TYPE_MII;
+                char buf[4];
 
-                if (bcm47xx_nvram_getenv("et_swtype", buf, 1) > 0) {
+                if (bcm47xx_nvram_getenv("et_swtype", buf, sizeof(buf)) > 0) {
                         if (kstrtou8(buf, 0, &et_swtype))
                                 bgmac_err(bgmac, "Failed to parse et_swtype (%s)\n",
                                           buf);
diff --git a/drivers/net/ethernet/broadcom/bgmac.h b/drivers/net/ethernet/broadcom/bgmac.h
index 98d4b5fcc070..66c8afbdc8c7 100644
--- a/drivers/net/ethernet/broadcom/bgmac.h
+++ b/drivers/net/ethernet/broadcom/bgmac.h
@@ -333,7 +333,7 @@
 
 #define BGMAC_CHIPCTL_1_IF_TYPE_MASK            0x00000030
 #define BGMAC_CHIPCTL_1_IF_TYPE_RMII            0x00000000
-#define BGMAC_CHIPCTL_1_IF_TYPE_MI              0x00000010
+#define BGMAC_CHIPCTL_1_IF_TYPE_MII             0x00000010
 #define BGMAC_CHIPCTL_1_IF_TYPE_RGMII           0x00000020
 #define BGMAC_CHIPCTL_1_SW_TYPE_MASK            0x000000C0
 #define BGMAC_CHIPCTL_1_SW_TYPE_EPHY            0x00000000
@@ -384,6 +384,8 @@ struct bgmac_dma_ring {
         u16 mmio_base;
         struct bgmac_dma_desc *cpu_base;
         dma_addr_t dma_base;
+        u32 index_base; /* Used for unaligned rings only, otherwise 0 */
+        bool unaligned;
 
         struct bgmac_slot_info slots[BGMAC_RX_RING_SLOTS];
 };
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index 0c338026ce01..97b3d32a98bd 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -246,8 +246,37 @@ enum {
         BNX2X_MAX_CNIC_ETH_CL_ID_IDX,
 };
 
-#define BNX2X_CNIC_START_ETH_CID(bp)    (BNX2X_NUM_NON_CNIC_QUEUES(bp) *\
+/* use a value high enough to be above all the PFs, which has least significant
+ * nibble as 8, so when cnic needs to come up with a CID for UIO to use to
+ * calculate doorbell address according to old doorbell configuration scheme
+ * (db_msg_sz 1 << 7 * cid + 0x40 DPM offset) it can come up with a valid number
+ * We must avoid coming up with cid 8 for iscsi since according to this method
+ * the designated UIO cid will come out 0 and it has a special handling for that
+ * case which doesn't suit us. Therefore will will cieling to closes cid which
+ * has least signigifcant nibble 8 and if it is 8 we will move forward to 0x18.
+ */
+
+#define BNX2X_1st_NON_L2_ETH_CID(bp)    (BNX2X_NUM_NON_CNIC_QUEUES(bp) * \
                                          (bp)->max_cos)
+/* amount of cids traversed by UIO's DPM addition to doorbell */
+#define UIO_DPM                         8
+/* roundup to DPM offset */
+#define UIO_ROUNDUP(bp)                 (roundup(BNX2X_1st_NON_L2_ETH_CID(bp), \
+                                         UIO_DPM))
+/* offset to nearest value which has lsb nibble matching DPM */
+#define UIO_CID_OFFSET(bp)              ((UIO_ROUNDUP(bp) + UIO_DPM) % \
+                                         (UIO_DPM * 2))
+/* add offset to rounded-up cid to get a value which could be used with UIO */
+#define UIO_DPM_ALIGN(bp)               (UIO_ROUNDUP(bp) + UIO_CID_OFFSET(bp))
+/* but wait - avoid UIO special case for cid 0 */
+#define UIO_DPM_CID0_OFFSET(bp)         ((UIO_DPM * 2) * \
+                                         (UIO_DPM_ALIGN(bp) == UIO_DPM))
+/* Properly DPM aligned CID dajusted to cid 0 secal case */
+#define BNX2X_CNIC_START_ETH_CID(bp)    (UIO_DPM_ALIGN(bp) + \
+                                         (UIO_DPM_CID0_OFFSET(bp)))
+/* how many cids were wasted  - need this value for cid allocation */
+#define UIO_CID_PAD(bp)                 (BNX2X_CNIC_START_ETH_CID(bp) - \
+                                         BNX2X_1st_NON_L2_ETH_CID(bp))
         /* iSCSI L2 */
 #define BNX2X_ISCSI_ETH_CID(bp)         (BNX2X_CNIC_START_ETH_CID(bp))
         /* FCoE L2 */
@@ -1542,7 +1571,6 @@ struct bnx2x {
          */
         bool                    fcoe_init;
 
-        int                     pm_cap;
         int                     mrrs;
 
         struct delayed_work     sp_task;
@@ -1681,10 +1709,11 @@ struct bnx2x {
  * Maximum CID count that might be required by the bnx2x:
  * Max RSS * Max_Tx_Multi_Cos + FCoE + iSCSI
  */
+
 #define BNX2X_L2_CID_COUNT(bp)  (BNX2X_NUM_ETH_QUEUES(bp) * BNX2X_MULTI_TX_COS \
-                                + 2 * CNIC_SUPPORT(bp))
+                                + CNIC_SUPPORT(bp) * (2 + UIO_CID_PAD(bp)))
 #define BNX2X_L2_MAX_CID(bp)    (BNX2X_MAX_RSS_COUNT(bp) * BNX2X_MULTI_TX_COS \
-                                + 2 * CNIC_SUPPORT(bp))
+                                + CNIC_SUPPORT(bp) * (2 + UIO_CID_PAD(bp)))
 #define L2_ILT_LINES(bp)        (DIV_ROUND_UP(BNX2X_L2_CID_COUNT(bp),\
                                         ILT_PAGE_CIDS))
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 90045c920d09..61726af1de6e 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -3008,16 +3008,16 @@ int bnx2x_set_power_state(struct bnx2x *bp, pci_power_t state)
         u16 pmcsr;
 
         /* If there is no power capability, silently succeed */
-        if (!bp->pm_cap) {
+        if (!bp->pdev->pm_cap) {
                 BNX2X_DEV_INFO("No power capability. Breaking.\n");
                 return 0;
         }
 
-        pci_read_config_word(bp->pdev, bp->pm_cap + PCI_PM_CTRL, &pmcsr);
+        pci_read_config_word(bp->pdev, bp->pdev->pm_cap + PCI_PM_CTRL, &pmcsr);
 
         switch (state) {
         case PCI_D0:
-                pci_write_config_word(bp->pdev, bp->pm_cap + PCI_PM_CTRL,
+                pci_write_config_word(bp->pdev, bp->pdev->pm_cap + PCI_PM_CTRL,
                                       ((pmcsr & ~PCI_PM_CTRL_STATE_MASK) |
                                        PCI_PM_CTRL_PME_STATUS));
 
@@ -3041,7 +3041,7 @@ int bnx2x_set_power_state(struct bnx2x *bp, pci_power_t state)
                 if (bp->wol)
                         pmcsr |= PCI_PM_CTRL_PME_ENABLE;
 
-                pci_write_config_word(bp->pdev, bp->pm_cap + PCI_PM_CTRL,
+                pci_write_config_word(bp->pdev, bp->pdev->pm_cap + PCI_PM_CTRL,
                                       pmcsr);
 
                 /* No more memory access after this point until
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
index 2612e3c715d4..324de5f05332 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
@@ -1387,9 +1387,9 @@ static bool bnx2x_is_nvm_accessible(struct bnx2x *bp)
         u16 pm = 0;
         struct net_device *dev = pci_get_drvdata(bp->pdev);
 
-        if (bp->pm_cap)
+        if (bp->pdev->pm_cap)
                 rc = pci_read_config_word(bp->pdev,
-                                          bp->pm_cap + PCI_PM_CTRL, &pm);
+                                          bp->pdev->pm_cap + PCI_PM_CTRL, &pm);
 
         if ((rc && !netif_running(dev)) ||
             (!rc && ((pm & PCI_PM_CTRL_STATE_MASK) != (__force u16)PCI_D0)))
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 2f8dbbbd7a86..a6704b555042 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -8652,6 +8652,7 @@ u32 bnx2x_send_unload_req(struct bnx2x *bp, int unload_mode)
         else if (bp->wol) {
                 u32 emac_base = port ? GRCBASE_EMAC1 : GRCBASE_EMAC0;
                 u8 *mac_addr = bp->dev->dev_addr;
+                struct pci_dev *pdev = bp->pdev;
                 u32 val;
                 u16 pmc;
 
@@ -8668,9 +8669,9 @@ u32 bnx2x_send_unload_req(struct bnx2x *bp, int unload_mode)
                 EMAC_WR(bp, EMAC_REG_EMAC_MAC_MATCH + entry + 4, val);
 
                 /* Enable the PME and clear the status */
-                pci_read_config_word(bp->pdev, bp->pm_cap + PCI_PM_CTRL, &pmc);
+                pci_read_config_word(pdev, pdev->pm_cap + PCI_PM_CTRL, &pmc);
                 pmc |= PCI_PM_CTRL_PME_ENABLE | PCI_PM_CTRL_PME_STATUS;
-                pci_write_config_word(bp->pdev, bp->pm_cap + PCI_PM_CTRL, pmc);
+                pci_write_config_word(pdev, pdev->pm_cap + PCI_PM_CTRL, pmc);
 
                 reset_code = DRV_MSG_CODE_UNLOAD_REQ_WOL_EN;
 
@@ -10399,7 +10400,7 @@ static void bnx2x_get_common_hwinfo(struct bnx2x *bp)
                 break;
         }
 
-        pci_read_config_word(bp->pdev, bp->pm_cap + PCI_PM_PMC, &pmc);
+        pci_read_config_word(bp->pdev, bp->pdev->pm_cap + PCI_PM_PMC, &pmc);
         bp->flags |= (pmc & PCI_PM_CAP_PME_D3cold) ? 0 : NO_WOL_FLAG;
 
         BNX2X_DEV_INFO("%sWoL capable\n",
@@ -12141,8 +12142,7 @@ static int bnx2x_init_dev(struct bnx2x *bp, struct pci_dev *pdev,
         }
 
         if (IS_PF(bp)) {
-                bp->pm_cap = pdev->pm_cap;
-                if (bp->pm_cap == 0) {
+                if (!pdev->pm_cap) {
                         dev_err(&bp->pdev->dev,
                                 "Cannot find power management capability, aborting\n");
                         rc = -EIO;
@@ -13632,6 +13632,10 @@ void bnx2x_setup_cnic_info(struct bnx2x *bp)
         cp->fcoe_init_cid = BNX2X_FCOE_ETH_CID(bp);
         cp->iscsi_l2_cid = BNX2X_ISCSI_ETH_CID(bp);
 
+        DP(NETIF_MSG_IFUP, "BNX2X_1st_NON_L2_ETH_CID(bp) %x, cp->starting_cid %x, cp->fcoe_init_cid %x, cp->iscsi_l2_cid %x\n",
+           BNX2X_1st_NON_L2_ETH_CID(bp), cp->starting_cid, cp->fcoe_init_cid,
+           cp->iscsi_l2_cid);
+
         if (NO_ISCSI_OOO(bp))
                 cp->drv_state |= CNIC_DRV_STATE_NO_ISCSI_OOO;
 }
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index 8142480d9770..99394bd49a13 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -3135,6 +3135,7 @@ static void cnic_service_bnx2x_bh(unsigned long data)
 {
         struct cnic_dev *dev = (struct cnic_dev *) data;
         struct cnic_local *cp = dev->cnic_priv;
+        struct bnx2x *bp = netdev_priv(dev->netdev);
         u32 status_idx, new_status_idx;
 
         if (unlikely(!test_bit(CNIC_F_CNIC_UP, &dev->flags)))
@@ -3146,7 +3147,7 @@ static void cnic_service_bnx2x_bh(unsigned long data)
                 CNIC_WR16(dev, cp->kcq1.io_addr,
                           cp->kcq1.sw_prod_idx + MAX_KCQ_IDX);
 
-                if (cp->ethdev->drv_state & CNIC_DRV_STATE_NO_FCOE) {
+                if (!CNIC_SUPPORTS_FCOE(bp)) {
                         cp->arm_int(dev, status_idx);
                         break;
                 }
@@ -5217,7 +5218,8 @@ static void cnic_init_rings(struct cnic_dev *dev)
                                 "iSCSI CLIENT_SETUP did not complete\n");
                 cnic_spq_completion(dev, DRV_CTL_RET_L2_SPQ_CREDIT_CMD, 1);
                 cnic_ring_ctl(dev, cid, cli, 1);
-                *cid_ptr = cid;
+                *cid_ptr = cid >> 4;
+                *(cid_ptr + 1) = cid * bp->db_size;
         }
 }
 
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 5701f3d1a169..12d961c4ebca 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -3034,6 +3034,7 @@ static bool tg3_phy_led_bug(struct tg3 *tp)
 {
         switch (tg3_asic_rev(tp)) {
         case ASIC_REV_5719:
+        case ASIC_REV_5720:
                 if ((tp->phy_flags & TG3_PHYFLG_MII_SERDES) &&
                     !tp->pci_fn)
                         return true;
@@ -16192,12 +16193,12 @@ static int tg3_get_invariants(struct tg3 *tp, const struct pci_device_id *ent)
                          * So explicitly force the chip into D0 here.
                          */
                         pci_read_config_dword(tp->pdev,
-                                              tp->pm_cap + PCI_PM_CTRL,
+                                              tp->pdev->pm_cap + PCI_PM_CTRL,
                                               &pm_reg);
                         pm_reg &= ~PCI_PM_CTRL_STATE_MASK;
                         pm_reg |= PCI_PM_CTRL_PME_ENABLE | 0 /* D0 */;
                         pci_write_config_dword(tp->pdev,
-                                               tp->pm_cap + PCI_PM_CTRL,
+                                               tp->pdev->pm_cap + PCI_PM_CTRL,
                                                pm_reg);
 
                         /* Also, force SERR#/PERR# in PCI command. */
@@ -17346,7 +17347,6 @@ static int tg3_init_one(struct pci_dev *pdev,
         tp = netdev_priv(dev);
         tp->pdev = pdev;
         tp->dev = dev;
-        tp->pm_cap = pdev->pm_cap;
         tp->rx_mode = TG3_DEF_RX_MODE;
         tp->tx_mode = TG3_DEF_TX_MODE;
         tp->irq_sync = 1;
diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
index ddb8be1298ea..70257808aa37 100644
--- a/drivers/net/ethernet/broadcom/tg3.h
+++ b/drivers/net/ethernet/broadcom/tg3.h
@@ -3234,7 +3234,6 @@ struct tg3 {
         u8                              pci_lat_timer;
 
         int                             pci_fn;
-        int                             pm_cap;
         int                             msi_cap;
         int                             pcix_cap;
         int                             pcie_readrq;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 0d0665ca6f19..c73cabdbd4c0 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -6149,8 +6149,10 @@ static int __init cxgb4_init_module(void)
                 pr_warn("could not create debugfs entry, continuing\n");
 
         ret = pci_register_driver(&cxgb4_driver);
-        if (ret < 0)
+        if (ret < 0) {
                 debugfs_remove(cxgb4_debugfs_root);
+                destroy_workqueue(workq);
+        }
 
         register_inet6addr_notifier(&cxgb4_inet6addr_notifier);
 
diff --git a/drivers/net/ethernet/dec/tulip/de4x5.c b/drivers/net/ethernet/dec/tulip/de4x5.c
index 2db6c573cec7..263b92c00cbf 100644
--- a/drivers/net/ethernet/dec/tulip/de4x5.c
+++ b/drivers/net/ethernet/dec/tulip/de4x5.c
@@ -1321,7 +1321,7 @@ de4x5_open(struct net_device *dev)
     if (request_irq(dev->irq, de4x5_interrupt, IRQF_SHARED,
                                                      lp->adapter_name, dev)) {
         printk("de4x5_open(): Requested IRQ%d is busy - attemping FAST/SHARE...", dev->irq);
-        if (request_irq(dev->irq, de4x5_interrupt, IRQF_DISABLED | IRQF_SHARED,
+        if (request_irq(dev->irq, de4x5_interrupt, IRQF_SHARED,
                                                      lp->adapter_name, dev)) {
             printk("\n              Cannot get IRQ- reconfigure your hardware.\n");
             disable_ast(dev);
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 3224d28cdad4..100b528b9bd0 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -2802,7 +2802,7 @@ static int be_vfs_if_create(struct be_adapter *adapter)
         struct be_resources res = {0};
         struct be_vf_cfg *vf_cfg;
         u32 cap_flags, en_flags, vf;
-        int status;
+        int status = 0;
 
         cap_flags = BE_IF_FLAGS_UNTAGGED | BE_IF_FLAGS_BROADCAST |
                     BE_IF_FLAGS_MULTICAST;
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index f9aacf5d8523..b2793b91cc55 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -2199,7 +2199,7 @@ fec_probe(struct platform_device *pdev)
                         goto failed_irq;
                 }
                 ret = devm_request_irq(&pdev->dev, irq, fec_enet_interrupt,
-                                       IRQF_DISABLED, pdev->name, ndev);
+                                       0, pdev->name, ndev);
                 if (ret)
                         goto failed_irq;
         }
diff --git a/drivers/net/ethernet/hp/hp100.c b/drivers/net/ethernet/hp/hp100.c
index e3c7c697fc45..91227d03274e 100644
--- a/drivers/net/ethernet/hp/hp100.c
+++ b/drivers/net/ethernet/hp/hp100.c
@@ -1097,7 +1097,7 @@ static int hp100_open(struct net_device *dev)
         /* New: if bus is PCI or EISA, interrupts might be shared interrupts */
         if (request_irq(dev->irq, hp100_interrupt,
                         lp->bus == HP100_BUS_PCI || lp->bus ==
-                        HP100_BUS_EISA ? IRQF_SHARED : IRQF_DISABLED,
+                        HP100_BUS_EISA ? IRQF_SHARED : 0,
                         "hp100", dev)) {
                 printk("hp100: %s: unable to get IRQ %d\n", dev->name, dev->irq);
                 return -EAGAIN;
diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
index 35853b43d66e..2d1c6bdd3618 100644
--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
+++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
@@ -102,6 +102,19 @@ static int ehea_probe_adapter(struct platform_device *dev);
 
 static int ehea_remove(struct platform_device *dev);
 
+static struct of_device_id ehea_module_device_table[] = {
+        {
+                .name = "lhea",
+                .compatible = "IBM,lhea",
+        },
+        {
+                .type = "network",
+                .compatible = "IBM,lhea-ethernet",
+        },
+        {},
+};
+MODULE_DEVICE_TABLE(of, ehea_module_device_table);
+
 static struct of_device_id ehea_device_table[] = {
         {
                 .name = "lhea",
@@ -109,7 +122,6 @@ static struct of_device_id ehea_device_table[] = {
         },
         {},
 };
-MODULE_DEVICE_TABLE(of, ehea_device_table);
 
 static struct platform_driver ehea_driver = {
         .driver = {
@@ -1285,7 +1297,7 @@ static int ehea_reg_interrupts(struct net_device *dev)
 
         ret = ibmebus_request_irq(port->qp_eq->attr.ist1,
                                   ehea_qp_aff_irq_handler,
-                                  IRQF_DISABLED, port->int_aff_name, port);
+                                  0, port->int_aff_name, port);
         if (ret) {
                 netdev_err(dev, "failed registering irq for qp_aff_irq_handler:ist=%X\n",
                            port->qp_eq->attr.ist1);
@@ -1303,8 +1315,7 @@ static int ehea_reg_interrupts(struct net_device *dev)
                          "%s-queue%d", dev->name, i);
                 ret = ibmebus_request_irq(pr->eq->attr.ist1,
                                           ehea_recv_irq_handler,
-                                          IRQF_DISABLED, pr->int_send_name,
-                                          pr);
+                                          0, pr->int_send_name, pr);
                 if (ret) {
                         netdev_err(dev, "failed registering irq for ehea_queue port_res_nr:%d, ist=%X\n",
                                    i, pr->eq->attr.ist1);
@@ -3320,7 +3331,7 @@ static int ehea_probe_adapter(struct platform_device *dev)
         }
 
         ret = ibmebus_request_irq(adapter->neq->attr.ist1,
-                                  ehea_interrupt_neq, IRQF_DISABLED,
+                                  ehea_interrupt_neq, 0,
                                   "ehea_neq", adapter);
         if (ret) {
                 dev_err(&dev->dev, "requesting NEQ IRQ failed\n");
diff --git a/drivers/net/ethernet/intel/e1000e/ethtool.c b/drivers/net/ethernet/intel/e1000e/ethtool.c
index a8633b8f0ac5..d14c8f53384c 100644
--- a/drivers/net/ethernet/intel/e1000e/ethtool.c
+++ b/drivers/net/ethernet/intel/e1000e/ethtool.c
@@ -922,6 +922,14 @@ static int e1000_reg_test(struct e1000_adapter *adapter, u64 *data)
                         else
                                 mask &= ~(1 << 30);
                 }
+                if (mac->type == e1000_pch2lan) {
+                        /* SHRAH[0,1,2] different than previous */
+                        if (i == 7)
+                                mask &= 0xFFF4FFFF;
+                        /* SHRAH[3] different than SHRAH[0,1,2] */
+                        if (i == 10)
+                                mask |= (1 << 30);
+                }
 
                 REG_PATTERN_TEST_ARRAY(E1000_RA, ((i << 1) + 1), mask,
                                        0xFFFFFFFF);
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index af08188d7e62..42f0f6717511 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -1371,7 +1371,10 @@ static void e1000_rar_set_pch2lan(struct e1000_hw *hw, u8 *addr, u32 index)
                 return;
         }
 
-        if (index < hw->mac.rar_entry_count) {
+        /* RAR[1-6] are owned by manageability.  Skip those and program the
+         * next address into the SHRA register array.
+         */
+        if (index < (u32)(hw->mac.rar_entry_count - 6)) {
                 s32 ret_val;
 
                 ret_val = e1000_acquire_swflag_ich8lan(hw);
@@ -1962,8 +1965,8 @@ void e1000_copy_rx_addrs_to_phy_ich8lan(struct e1000_hw *hw)
         if (ret_val)
                 goto release;
 
-        /* Copy both RAL/H (rar_entry_count) and SHRAL/H (+4) to PHY */
-        for (i = 0; i < (hw->mac.rar_entry_count + 4); i++) {
+        /* Copy both RAL/H (rar_entry_count) and SHRAL/H to PHY */
+        for (i = 0; i < (hw->mac.rar_entry_count); i++) {
                 mac_reg = er32(RAL(i));
                 hw->phy.ops.write_reg_page(hw, BM_RAR_L(i),
                                            (u16)(mac_reg & 0xFFFF));
@@ -2007,10 +2010,10 @@ s32 e1000_lv_jumbo_workaround_ich8lan(struct e1000_hw *hw, bool enable)
                 return ret_val;
 
         if (enable) {
-                /* Write Rx addresses (rar_entry_count for RAL/H, +4 for
+                /* Write Rx addresses (rar_entry_count for RAL/H, and
                  * SHRAL/H) and initial CRC values to the MAC
                  */
-                for (i = 0; i < (hw->mac.rar_entry_count + 4); i++) {
+                for (i = 0; i < hw->mac.rar_entry_count; i++) {
                         u8 mac_addr[ETH_ALEN] = { 0 };
                         u32 addr_high, addr_low;
 
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h
index 59865695b282..217090df33e7 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h
@@ -98,7 +98,7 @@
 #define PCIE_ICH8_SNOOP_ALL     PCIE_NO_SNOOP_ALL
 
 #define E1000_ICH_RAR_ENTRIES   7
-#define E1000_PCH2_RAR_ENTRIES  5       /* RAR[0], SHRA[0-3] */
+#define E1000_PCH2_RAR_ENTRIES  11      /* RAR[0-6], SHRA[0-3] */
 #define E1000_PCH_LPT_RAR_ENTRIES       12      /* RAR[0], SHRA[0-10] */
 
 #define PHY_PAGE_SHIFT          5
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index e87e9b01f404..4ef786775acb 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -4868,7 +4868,7 @@ static void e1000_watchdog_task(struct work_struct *work)
                          */
                         if ((hw->phy.type == e1000_phy_igp_3 ||
                              hw->phy.type == e1000_phy_bm) &&
-                            (hw->mac.autoneg == true) &&
+                            hw->mac.autoneg &&
                             (adapter->link_speed == SPEED_10 ||
                              adapter->link_speed == SPEED_100) &&
                             (adapter->link_duplex == HALF_DUPLEX)) {
diff --git a/drivers/net/ethernet/intel/igb/e1000_82575.c b/drivers/net/ethernet/intel/igb/e1000_82575.c
index 79b58353d849..47c2d10df826 100644
--- a/drivers/net/ethernet/intel/igb/e1000_82575.c
+++ b/drivers/net/ethernet/intel/igb/e1000_82575.c
@@ -719,6 +719,10 @@ static s32 igb_get_phy_id_82575(struct e1000_hw *hw)
         u32 ctrl_ext;
         u32 mdic;
 
+        /* Extra read required for some PHY's on i354 */
+        if (hw->mac.type == e1000_i354)
+                igb_get_phy_id(hw);
+
         /* For SGMII PHYs, we try the list of possible addresses until
          * we find one that works.  For non-SGMII PHYs
          * (e.g. integrated copper PHYs), an address of 1 should
diff --git a/drivers/net/ethernet/intel/igb/e1000_mac.c b/drivers/net/ethernet/intel/igb/e1000_mac.c
index f0dfd41dd4bd..298f0ed50670 100644
--- a/drivers/net/ethernet/intel/igb/e1000_mac.c
+++ b/drivers/net/ethernet/intel/igb/e1000_mac.c
@@ -712,6 +712,7 @@ static s32 igb_set_fc_watermarks(struct e1000_hw *hw)
 static s32 igb_set_default_fc(struct e1000_hw *hw)
 {
         s32 ret_val = 0;
+        u16 lan_offset;
         u16 nvm_data;
 
         /* Read and store word 0x0F of the EEPROM. This word contains bits
@@ -722,7 +723,14 @@ static s32 igb_set_default_fc(struct e1000_hw *hw)
          * control setting, then the variable hw->fc will
          * be initialized based on a value in the EEPROM.
          */
-        ret_val = hw->nvm.ops.read(hw, NVM_INIT_CONTROL2_REG, 1, &nvm_data);
+        if (hw->mac.type == e1000_i350) {
+                lan_offset = NVM_82580_LAN_FUNC_OFFSET(hw->bus.func);
+                ret_val = hw->nvm.ops.read(hw, NVM_INIT_CONTROL2_REG
+                                           + lan_offset, 1, &nvm_data);
+         } else {
+                ret_val = hw->nvm.ops.read(hw, NVM_INIT_CONTROL2_REG,
+                                           1, &nvm_data);
+         }
 
         if (ret_val) {
                 hw_dbg("NVM Read Error\n");
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
index 0e1b973659b0..e8649abf97c0 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
@@ -160,6 +160,13 @@ static int ixgbe_get_settings(struct net_device *netdev,
         bool autoneg = false;
         bool link_up;
 
+        /* SFP type is needed for get_link_capabilities */
+        if (hw->phy.media_type & (ixgbe_media_type_fiber |
+                                  ixgbe_media_type_fiber_qsfp)) {
+                if (hw->phy.sfp_type == ixgbe_sfp_type_not_present)
+                                hw->phy.ops.identify_sfp(hw);
+        }
+
         hw->mac.ops.get_link_capabilities(hw, &supported_link, &autoneg);
 
         /* set the supported link speeds */
@@ -186,6 +193,11 @@ static int ixgbe_get_settings(struct net_device *netdev,
                         ecmd->advertising |= ADVERTISED_1000baseT_Full;
                 if (supported_link & IXGBE_LINK_SPEED_100_FULL)
                         ecmd->advertising |= ADVERTISED_100baseT_Full;
+
+                if (hw->phy.multispeed_fiber && !autoneg) {
+                        if (supported_link & IXGBE_LINK_SPEED_10GB_FULL)
+                                ecmd->advertising = ADVERTISED_10000baseT_Full;
+                }
         }
 
         if (autoneg) {
@@ -314,6 +326,14 @@ static int ixgbe_set_settings(struct net_device *netdev,
                 if (ecmd->advertising & ~ecmd->supported)
                         return -EINVAL;
 
+                /* only allow one speed at a time if no autoneg */
+                if (!ecmd->autoneg && hw->phy.multispeed_fiber) {
+                        if (ecmd->advertising ==
+                            (ADVERTISED_10000baseT_Full |
+                             ADVERTISED_1000baseT_Full))
+                                return -EINVAL;
+                }
+
                 old = hw->phy.autoneg_advertised;
                 advertised = 0;
                 if (ecmd->advertising & ADVERTISED_10000baseT_Full)
@@ -1805,6 +1825,10 @@ static int ixgbe_run_loopback_test(struct ixgbe_adapter *adapter)
         unsigned int size = 1024;
         netdev_tx_t tx_ret_val;
         struct sk_buff *skb;
+        u32 flags_orig = adapter->flags;
+
+        /* DCB can modify the frames on Tx */
+        adapter->flags &= ~IXGBE_FLAG_DCB_ENABLED;
 
         /* allocate test skb */
         skb = alloc_skb(size, GFP_KERNEL);
@@ -1857,6 +1881,7 @@ static int ixgbe_run_loopback_test(struct ixgbe_adapter *adapter)
 
         /* free the original skb */
         kfree_skb(skb);
+        adapter->flags = flags_orig;
 
         return ret_val;
 }
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 7aba452833e5..0ade0cd5ef53 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -3571,7 +3571,7 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
 {
         struct ixgbe_hw *hw = &adapter->hw;
         int i;
-        u32 rxctrl;
+        u32 rxctrl, rfctl;
 
         /* disable receives while setting up the descriptors */
         rxctrl = IXGBE_READ_REG(hw, IXGBE_RXCTRL);
@@ -3580,6 +3580,13 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
         ixgbe_setup_psrtype(adapter);
         ixgbe_setup_rdrxctl(adapter);
 
+        /* RSC Setup */
+        rfctl = IXGBE_READ_REG(hw, IXGBE_RFCTL);
+        rfctl &= ~IXGBE_RFCTL_RSC_DIS;
+        if (!(adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED))
+                rfctl |= IXGBE_RFCTL_RSC_DIS;
+        IXGBE_WRITE_REG(hw, IXGBE_RFCTL, rfctl);
+
         /* Program registers for the distribution of queues */
         ixgbe_setup_mrqc(adapter);
 
@@ -5993,8 +6000,16 @@ static void ixgbe_sfp_link_config_subtask(struct ixgbe_adapter *adapter)
         adapter->flags &= ~IXGBE_FLAG_NEED_LINK_CONFIG;
 
         speed = hw->phy.autoneg_advertised;
-        if ((!speed) && (hw->mac.ops.get_link_capabilities))
+        if ((!speed) && (hw->mac.ops.get_link_capabilities)) {
                 hw->mac.ops.get_link_capabilities(hw, &speed, &autoneg);
+
+                /* setup the highest link when no autoneg */
+                if (!autoneg) {
+                        if (speed & IXGBE_LINK_SPEED_10GB_FULL)
+                                speed = IXGBE_LINK_SPEED_10GB_FULL;
+                }
+        }
+
         if (hw->mac.ops.setup_link)
                 hw->mac.ops.setup_link(hw, speed, true);
 
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
index 6442cf8f9dce..10775cb9b6d8 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
@@ -1861,6 +1861,7 @@ enum {
 #define IXGBE_RFCTL_ISCSI_DIS       0x00000001
 #define IXGBE_RFCTL_ISCSI_DWC_MASK  0x0000003E
 #define IXGBE_RFCTL_ISCSI_DWC_SHIFT 1
+#define IXGBE_RFCTL_RSC_DIS             0x00000020
 #define IXGBE_RFCTL_NFSW_DIS        0x00000040
 #define IXGBE_RFCTL_NFSR_DIS        0x00000080
 #define IXGBE_RFCTL_NFS_VER_MASK    0x00000300
diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c
index bfdb06860397..6a6c1f76d8e0 100644
--- a/drivers/net/ethernet/lantiq_etop.c
+++ b/drivers/net/ethernet/lantiq_etop.c
@@ -282,8 +282,7 @@ ltq_etop_hw_init(struct net_device *dev)
 
                 if (IS_TX(i)) {
                         ltq_dma_alloc_tx(&ch->dma);
-                        request_irq(irq, ltq_etop_dma_irq, IRQF_DISABLED,
-                                "etop_tx", priv);
+                        request_irq(irq, ltq_etop_dma_irq, 0, "etop_tx", priv);
                 } else if (IS_RX(i)) {
                         ltq_dma_alloc_rx(&ch->dma);
                         for (ch->dma.desc = 0; ch->dma.desc < LTQ_DESC_NUM;
@@ -291,8 +290,7 @@ ltq_etop_hw_init(struct net_device *dev)
                                 if (ltq_etop_alloc_skb(ch))
                                         return -ENOMEM;
                         ch->dma.desc = 0;
-                        request_irq(irq, ltq_etop_dma_irq, IRQF_DISABLED,
-                                "etop_rx", priv);
+                        request_irq(irq, ltq_etop_dma_irq, 0, "etop_rx", priv);
                 }
                 ch->dma.irq = irq;
         }
diff --git a/drivers/net/ethernet/marvell/pxa168_eth.c b/drivers/net/ethernet/marvell/pxa168_eth.c
index 4ae0c7426010..fff62460185c 100644
--- a/drivers/net/ethernet/marvell/pxa168_eth.c
+++ b/drivers/net/ethernet/marvell/pxa168_eth.c
@@ -1123,8 +1123,7 @@ static int pxa168_eth_open(struct net_device *dev)
         struct pxa168_eth_private *pep = netdev_priv(dev);
         int err;
 
-        err = request_irq(dev->irq, pxa168_eth_int_handler,
-                          IRQF_DISABLED, dev->name, dev);
+        err = request_irq(dev->irq, pxa168_eth_int_handler, 0, dev->name, dev);
         if (err) {
                 dev_err(&dev->dev, "can't assign irq\n");
                 return -EAGAIN;
diff --git a/drivers/net/ethernet/marvell/skge.c b/drivers/net/ethernet/marvell/skge.c
index ef94a591f9e5..1a9c4f6269ea 100644
--- a/drivers/net/ethernet/marvell/skge.c
+++ b/drivers/net/ethernet/marvell/skge.c
@@ -3092,6 +3092,9 @@ static struct sk_buff *skge_rx_get(struct net_device *dev,
                 if (!nskb)
                         goto resubmit;
 
+                skb = e->skb;
+                prefetch(skb->data);
+
                 if (skge_rx_setup(skge, e, nskb, skge->rx_buf_size) < 0) {
                         dev_kfree_skb(nskb);
                         goto resubmit;
@@ -3101,8 +3104,6 @@ static struct sk_buff *skge_rx_get(struct net_device *dev,
                                  dma_unmap_addr(e, mapaddr),
                                  dma_unmap_len(e, maplen),
                                  PCI_DMA_FROMDEVICE);
-                skb = e->skb;
-                prefetch(skb->data);
         }
 
         skb_put(skb, len);
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
index a28cd801a236..0c750985f47e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
@@ -53,9 +53,11 @@ static int mlx4_en_moderation_update(struct mlx4_en_priv *priv)
         for (i = 0; i < priv->tx_ring_num; i++) {
                 priv->tx_cq[i].moder_cnt = priv->tx_frames;
                 priv->tx_cq[i].moder_time = priv->tx_usecs;
-                err = mlx4_en_set_cq_moder(priv, &priv->tx_cq[i]);
-                if (err)
-                        return err;
+                if (priv->port_up) {
+                        err = mlx4_en_set_cq_moder(priv, &priv->tx_cq[i]);
+                        if (err)
+                                return err;
+                }
         }
 
         if (priv->adaptive_rx_coal)
@@ -65,9 +67,11 @@ static int mlx4_en_moderation_update(struct mlx4_en_priv *priv)
                 priv->rx_cq[i].moder_cnt = priv->rx_frames;
                 priv->rx_cq[i].moder_time = priv->rx_usecs;
                 priv->last_moder_time[i] = MLX4_EN_AUTO_CONF;
-                err = mlx4_en_set_cq_moder(priv, &priv->rx_cq[i]);
-                if (err)
-                        return err;
+                if (priv->port_up) {
+                        err = mlx4_en_set_cq_moder(priv, &priv->rx_cq[i]);
+                        if (err)
+                                return err;
+                }
         }
 
         return err;
diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c
index 0fba1532d326..075f4e21d33d 100644
--- a/drivers/net/ethernet/micrel/ks8851_mll.c
+++ b/drivers/net/ethernet/micrel/ks8851_mll.c
@@ -915,7 +915,7 @@ static int ks_net_open(struct net_device *netdev)
         struct ks_net *ks = netdev_priv(netdev);
         int err;
 
-#define KS_INT_FLAGS    (IRQF_DISABLED|IRQF_TRIGGER_LOW)
+#define KS_INT_FLAGS    IRQF_TRIGGER_LOW
         /* lock the card, even if we may not actually do anything
          * else at the moment.
          */
diff --git a/drivers/net/ethernet/natsemi/jazzsonic.c b/drivers/net/ethernet/natsemi/jazzsonic.c
index c20766c2f65b..79257f71c5d9 100644
--- a/drivers/net/ethernet/natsemi/jazzsonic.c
+++ b/drivers/net/ethernet/natsemi/jazzsonic.c
@@ -83,8 +83,7 @@ static int jazzsonic_open(struct net_device* dev)
 {
         int retval;
 
-        retval = request_irq(dev->irq, sonic_interrupt, IRQF_DISABLED,
-                                "sonic", dev);
+        retval = request_irq(dev->irq, sonic_interrupt, 0, "sonic", dev);
         if (retval) {
                 printk(KERN_ERR "%s: unable to get IRQ %d.\n",
                                 dev->name, dev->irq);
diff --git a/drivers/net/ethernet/natsemi/xtsonic.c b/drivers/net/ethernet/natsemi/xtsonic.c
index c2e0256fe3df..4da172ac5599 100644
--- a/drivers/net/ethernet/natsemi/xtsonic.c
+++ b/drivers/net/ethernet/natsemi/xtsonic.c
@@ -95,8 +95,7 @@ static int xtsonic_open(struct net_device *dev)
 {
         int retval;
 
-        retval = request_irq(dev->irq, sonic_interrupt, IRQF_DISABLED,
-                                "sonic", dev);
+        retval = request_irq(dev->irq, sonic_interrupt, 0, "sonic", dev);
         if (retval) {
                 printk(KERN_ERR "%s: unable to get IRQ %d.\n",
                        dev->name, dev->irq);
diff --git a/drivers/net/ethernet/pasemi/pasemi_mac.c b/drivers/net/ethernet/pasemi/pasemi_mac.c
index c498181a9aa8..5b65356e7568 100644
--- a/drivers/net/ethernet/pasemi/pasemi_mac.c
+++ b/drivers/net/ethernet/pasemi/pasemi_mac.c
@@ -1219,7 +1219,7 @@ static int pasemi_mac_open(struct net_device *dev)
         snprintf(mac->tx_irq_name, sizeof(mac->tx_irq_name), "%s tx",
                  dev->name);
 
-        ret = request_irq(mac->tx->chan.irq, pasemi_mac_tx_intr, IRQF_DISABLED,
+        ret = request_irq(mac->tx->chan.irq, pasemi_mac_tx_intr, 0,
                           mac->tx_irq_name, mac->tx);
         if (ret) {
                 dev_err(&mac->pdev->dev, "request_irq of irq %d failed: %d\n",
@@ -1230,7 +1230,7 @@ static int pasemi_mac_open(struct net_device *dev)
         snprintf(mac->rx_irq_name, sizeof(mac->rx_irq_name), "%s rx",
                  dev->name);
 
-        ret = request_irq(mac->rx->chan.irq, pasemi_mac_rx_intr, IRQF_DISABLED,
+        ret = request_irq(mac->rx->chan.irq, pasemi_mac_rx_intr, 0,
                           mac->rx_irq_name, mac->rx);
         if (ret) {
                 dev_err(&mac->pdev->dev, "request_irq of irq %d failed: %d\n",
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
index 652cc13c5023..392b9bd12b4f 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
@@ -1561,6 +1561,7 @@ static int qlcnic_sriov_vf_reinit_driver(struct qlcnic_adapter *adapter)
 {
         int err;
 
+        adapter->need_fw_reset = 0;
         qlcnic_83xx_reinit_mbx_work(adapter->ahw->mailbox);
         qlcnic_83xx_enable_mbx_interrupt(adapter);
 
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 6f87f2cde647..3397cee89777 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -4231,6 +4231,7 @@ static void rtl_init_rxcfg(struct rtl8169_private *tp)
         case RTL_GIGA_MAC_VER_23:
         case RTL_GIGA_MAC_VER_24:
         case RTL_GIGA_MAC_VER_34:
+        case RTL_GIGA_MAC_VER_35:
                 RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST);
                 break;
         case RTL_GIGA_MAC_VER_40:
diff --git a/drivers/net/ethernet/sfc/Kconfig b/drivers/net/ethernet/sfc/Kconfig
index 8b7152565c5e..088921294448 100644
--- a/drivers/net/ethernet/sfc/Kconfig
+++ b/drivers/net/ethernet/sfc/Kconfig
@@ -7,7 +7,7 @@ config SFC
         select I2C_ALGOBIT
         select PTP_1588_CLOCK
         ---help---
-          This driver supports 10-gigabit Ethernet cards based on
+          This driver supports 10/40-gigabit Ethernet cards based on
           the Solarflare SFC4000, SFC9000-family and SFC9100-family
           controllers.
 
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 5f42313b4965..9f18ae984f9e 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -94,7 +94,7 @@ static unsigned int efx_ef10_mem_map_size(struct efx_nic *efx)
         return resource_size(&efx->pci_dev->resource[EFX_MEM_BAR]);
 }
 
-static int efx_ef10_init_capabilities(struct efx_nic *efx)
+static int efx_ef10_init_datapath_caps(struct efx_nic *efx)
 {
         MCDI_DECLARE_BUF(outbuf, MC_CMD_GET_CAPABILITIES_OUT_LEN);
         struct efx_ef10_nic_data *nic_data = efx->nic_data;
@@ -107,16 +107,27 @@ static int efx_ef10_init_capabilities(struct efx_nic *efx)
                           outbuf, sizeof(outbuf), &outlen);
         if (rc)
                 return rc;
+        if (outlen < sizeof(outbuf)) {
+                netif_err(efx, drv, efx->net_dev,
+                          "unable to read datapath firmware capabilities\n");
+                return -EIO;
+        }
 
-        if (outlen >= sizeof(outbuf)) {
-                nic_data->datapath_caps =
-                        MCDI_DWORD(outbuf, GET_CAPABILITIES_OUT_FLAGS1);
-                if (!(nic_data->datapath_caps &
-                     (1 << MC_CMD_GET_CAPABILITIES_OUT_TX_TSO_LBN))) {
-                        netif_err(efx, drv, efx->net_dev,
-                                  "Capabilities don't indicate TSO support.\n");
-                        return -ENODEV;
-                }
+        nic_data->datapath_caps =
+                MCDI_DWORD(outbuf, GET_CAPABILITIES_OUT_FLAGS1);
+
+        if (!(nic_data->datapath_caps &
+              (1 << MC_CMD_GET_CAPABILITIES_OUT_TX_TSO_LBN))) {
+                netif_err(efx, drv, efx->net_dev,
+                          "current firmware does not support TSO\n");
+                return -ENODEV;
+        }
+
+        if (!(nic_data->datapath_caps &
+              (1 << MC_CMD_GET_CAPABILITIES_OUT_RX_PREFIX_LEN_14_LBN))) {
+                netif_err(efx, probe, efx->net_dev,
+                          "current firmware does not support an RX prefix\n");
+                return -ENODEV;
         }
 
         return 0;
@@ -217,21 +228,13 @@ static int efx_ef10_probe(struct efx_nic *efx)
         if (rc)
                 goto fail3;
 
-        rc = efx_ef10_init_capabilities(efx);
+        rc = efx_ef10_init_datapath_caps(efx);
         if (rc < 0)
                 goto fail3;
 
         efx->rx_packet_len_offset =
                 ES_DZ_RX_PREFIX_PKTLEN_OFST - ES_DZ_RX_PREFIX_SIZE;
 
-        if (!(nic_data->datapath_caps &
-              (1 << MC_CMD_GET_CAPABILITIES_OUT_RX_PREFIX_LEN_14_LBN))) {
-                netif_err(efx, probe, efx->net_dev,
-                          "current firmware does not support an RX prefix\n");
-                rc = -ENODEV;
-                goto fail3;
-        }
-
         rc = efx_mcdi_port_get_number(efx);
         if (rc < 0)
                 goto fail3;
@@ -260,8 +263,6 @@ static int efx_ef10_probe(struct efx_nic *efx)
         if (rc)
                 goto fail3;
 
-        efx_ptp_probe(efx);
-
         return 0;
 
 fail3:
@@ -342,6 +343,13 @@ static int efx_ef10_init_nic(struct efx_nic *efx)
         struct efx_ef10_nic_data *nic_data = efx->nic_data;
         int rc;
 
+        if (nic_data->must_check_datapath_caps) {
+                rc = efx_ef10_init_datapath_caps(efx);
+                if (rc)
+                        return rc;
+                nic_data->must_check_datapath_caps = false;
+        }
+
         if (nic_data->must_realloc_vis) {
                 /* We cannot let the number of VIs change now */
                 rc = efx_ef10_alloc_vis(efx, nic_data->n_allocated_vis,
@@ -710,6 +718,14 @@ static int efx_ef10_mcdi_poll_reboot(struct efx_nic *efx)
         nic_data->must_restore_filters = true;
         nic_data->rx_rss_context = EFX_EF10_RSS_CONTEXT_INVALID;
 
+        /* The datapath firmware might have been changed */
+        nic_data->must_check_datapath_caps = true;
+
+        /* MAC statistics have been cleared on the NIC; clear the local
+         * statistic that we update with efx_update_diff_stat().
+         */
+        nic_data->stats[EF10_STAT_rx_bad_bytes] = 0;
+
         return -EIO;
 }
 
diff --git a/drivers/net/ethernet/sfc/mcdi_port.c b/drivers/net/ethernet/sfc/mcdi_port.c
index 8d33da6697fb..7b6be61d549f 100644
--- a/drivers/net/ethernet/sfc/mcdi_port.c
+++ b/drivers/net/ethernet/sfc/mcdi_port.c
@@ -556,6 +556,7 @@ static int efx_mcdi_phy_set_settings(struct efx_nic *efx, struct ethtool_cmd *ec
                 case 100:   caps = 1 << MC_CMD_PHY_CAP_100FDX_LBN;   break;
                 case 1000:  caps = 1 << MC_CMD_PHY_CAP_1000FDX_LBN;  break;
                 case 10000: caps = 1 << MC_CMD_PHY_CAP_10000FDX_LBN; break;
+                case 40000: caps = 1 << MC_CMD_PHY_CAP_40000FDX_LBN; break;
                 default:    return -EINVAL;
                 }
         } else {
@@ -841,6 +842,7 @@ static unsigned int efx_mcdi_event_link_speed[] = {
         [MCDI_EVENT_LINKCHANGE_SPEED_100M] = 100,
         [MCDI_EVENT_LINKCHANGE_SPEED_1G] = 1000,
         [MCDI_EVENT_LINKCHANGE_SPEED_10G] = 10000,
+        [MCDI_EVENT_LINKCHANGE_SPEED_40G] = 40000,
 };
 
 void efx_mcdi_process_link_change(struct efx_nic *efx, efx_qword_t *ev)
diff --git a/drivers/net/ethernet/sfc/nic.h b/drivers/net/ethernet/sfc/nic.h
index 4b1e188f7a2f..fda29d39032f 100644
--- a/drivers/net/ethernet/sfc/nic.h
+++ b/drivers/net/ethernet/sfc/nic.h
@@ -400,6 +400,8 @@ enum {
  * @rx_rss_context: Firmware handle for our RSS context
  * @stats: Hardware statistics
  * @workaround_35388: Flag: firmware supports workaround for bug 35388
+ * @must_check_datapath_caps: Flag: @datapath_caps needs to be revalidated
+ *      after MC reboot
  * @datapath_caps: Capabilities of datapath firmware (FLAGS1 field of
  *      %MC_CMD_GET_CAPABILITIES response)
  */
@@ -413,6 +415,7 @@ struct efx_ef10_nic_data {
         u32 rx_rss_context;
         u64 stats[EF10_STAT_COUNT];
         bool workaround_35388;
+        bool must_check_datapath_caps;
         u32 datapath_caps;
 };
 
diff --git a/drivers/net/ethernet/smsc/smc91x.h b/drivers/net/ethernet/smsc/smc91x.h
index 370e13dde115..5730fe2445a6 100644
--- a/drivers/net/ethernet/smsc/smc91x.h
+++ b/drivers/net/ethernet/smsc/smc91x.h
@@ -271,7 +271,7 @@ static inline void mcf_outsw(void *a, unsigned char *p, int l)
 #define SMC_insw(a, r, p, l)    mcf_insw(a + r, p, l)
 #define SMC_outsw(a, r, p, l)   mcf_outsw(a + r, p, l)
 
-#define SMC_IRQ_FLAGS           (IRQF_DISABLED)
+#define SMC_IRQ_FLAGS           0
 
 #else
 
diff --git a/drivers/net/ethernet/smsc/smsc9420.c b/drivers/net/ethernet/smsc/smsc9420.c
index ffa5c4ad1210..5f9e79f7f2df 100644
--- a/drivers/net/ethernet/smsc/smsc9420.c
+++ b/drivers/net/ethernet/smsc/smsc9420.c
@@ -1356,8 +1356,7 @@ static int smsc9420_open(struct net_device *dev)
         smsc9420_reg_write(pd, INT_STAT, 0xFFFFFFFF);
         smsc9420_pci_flush_write(pd);
 
-        result = request_irq(irq, smsc9420_isr, IRQF_SHARED | IRQF_DISABLED,
-                             DRV_NAME, pd);
+        result = request_irq(irq, smsc9420_isr, IRQF_SHARED, DRV_NAME, pd);
         if (result) {
                 smsc_warn(IFUP, "Unable to use IRQ = %d", irq);
                 result = -ENODEV;
diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.c b/drivers/net/ethernet/toshiba/ps3_gelic_net.c
index 9c805e0c0cae..f7f2ef49c0c1 100644
--- a/drivers/net/ethernet/toshiba/ps3_gelic_net.c
+++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.c
@@ -1726,7 +1726,7 @@ static int ps3_gelic_driver_probe(struct ps3_system_bus_device *dev)
                 goto fail_alloc_irq;
         }
         result = request_irq(card->irq, gelic_card_interrupt,
-                             IRQF_DISABLED, netdev->name, card);
+                             0, netdev->name, card);
 
         if (result) {
                 dev_info(ctodev(card), "%s:request_irq failed (%d)\n",
diff --git a/drivers/net/irda/mcs7780.c b/drivers/net/irda/mcs7780.c
index f07c340990da..3f138ca88670 100644
--- a/drivers/net/irda/mcs7780.c
+++ b/drivers/net/irda/mcs7780.c
@@ -191,8 +191,8 @@ static inline int mcs_setup_transceiver_vishay(struct mcs_cb *mcs)
                 goto error;
 
         ret = 0;
-        error:
-                return ret;
+error:
+        return ret;
 }
 
 /* Setup a communication between mcs7780 and agilent chip. */
@@ -501,8 +501,11 @@ static inline int mcs_setup_urbs(struct mcs_cb *mcs)
                 return 0;
 
         mcs->rx_urb = usb_alloc_urb(0, GFP_KERNEL);
-        if (!mcs->rx_urb)
+        if (!mcs->rx_urb) {
+                usb_free_urb(mcs->tx_urb);
+                mcs->tx_urb = NULL;
                 return 0;
+        }
 
         return 1;
 }
@@ -643,9 +646,9 @@ static int mcs_speed_change(struct mcs_cb *mcs)
         ret = mcs_set_reg(mcs, MCS_MODE_REG, rval);
 
         mcs->speed = mcs->new_speed;
-        error:
-                mcs->new_speed = 0;
-                return ret;
+error:
+        mcs->new_speed = 0;
+        return ret;
 }
 
 /* Ioctl calls not supported at this time.  Can be an area of future work. */
@@ -738,17 +741,20 @@ static int mcs_net_open(struct net_device *netdev)
 
         ret = mcs_receive_start(mcs);
         if (ret)
-                goto error3;
+                goto error4;
 
         netif_start_queue(netdev);
         return 0;
 
-        error3:
-                irlap_close(mcs->irlap);
-        error2:
-                kfree_skb(mcs->rx_buff.skb);
-        error1:
-                return ret;
+error4:
+        usb_free_urb(mcs->rx_urb);
+        usb_free_urb(mcs->tx_urb);
+error3:
+        irlap_close(mcs->irlap);
+error2:
+        kfree_skb(mcs->rx_buff.skb);
+error1:
+        return ret;
 }
 
 /* Receive callback function.  */
@@ -946,11 +952,11 @@ static int mcs_probe(struct usb_interface *intf,
         usb_set_intfdata(intf, mcs);
         return 0;
 
-        error2:
-                free_netdev(ndev);
+error2:
+        free_netdev(ndev);
 
-        error1:
-                return ret;
+error1:
+        return ret;
 }
 
 /* The current device is removed, the USB layer tells us to shut down. */
diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
index fcbf680c3e62..a17d85a331f1 100644
--- a/drivers/net/loopback.c
+++ b/drivers/net/loopback.c
@@ -146,6 +146,7 @@ static int loopback_dev_init(struct net_device *dev)
 
 static void loopback_dev_free(struct net_device *dev)
 {
+        dev_net(dev)->loopback_dev = NULL;
         free_percpu(dev->lstats);
         free_netdev(dev);
 }
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index dcb21347c670..adeee615dd19 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -684,15 +684,12 @@ restart:
                         case NETDEV_RELEASE:
                         case NETDEV_JOIN:
                         case NETDEV_UNREGISTER:
-                                /*
-                                 * rtnl_lock already held
+                                /* rtnl_lock already held
                                  * we might sleep in __netpoll_cleanup()
                                  */
                                 spin_unlock_irqrestore(&target_list_lock, flags);
 
-                                mutex_lock(&nt->mutex);
                                 __netpoll_cleanup(&nt->np);
-                                mutex_unlock(&nt->mutex);
 
                                 spin_lock_irqsave(&target_list_lock, flags);
                                 dev_put(nt->np.dev);
diff --git a/drivers/net/phy/cicada.c b/drivers/net/phy/cicada.c
index db472ffb6e89..313a0377f68f 100644
--- a/drivers/net/phy/cicada.c
+++ b/drivers/net/phy/cicada.c
@@ -30,9 +30,9 @@
 #include <linux/ethtool.h>
 #include <linux/phy.h>
 
-#include <asm/io.h>
+#include <linux/io.h>
 #include <asm/irq.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 
 /* Cicada Extended Control Register 1 */
 #define MII_CIS8201_EXT_CON1           0x17
diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
index 6fa5ae00039f..01805319e1e0 100644
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -281,7 +281,7 @@ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
         nf_reset(skb);
 
         skb->ip_summed = CHECKSUM_NONE;
-        ip_select_ident(iph, &rt->dst, NULL);
+        ip_select_ident(skb, &rt->dst, NULL);
         ip_send_check(iph);
 
         ip_local_out(skb);
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index a639de8401f8..807815fc9968 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1641,11 +1641,11 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
                 INIT_LIST_HEAD(&tun->disabled);
                 err = tun_attach(tun, file, false);
                 if (err < 0)
-                        goto err_free_dev;
+                        goto err_free_flow;
 
                 err = register_netdevice(tun->dev);
                 if (err < 0)
-                        goto err_free_dev;
+                        goto err_detach;
 
                 if (device_create_file(&tun->dev->dev, &dev_attr_tun_flags) ||
                     device_create_file(&tun->dev->dev, &dev_attr_owner) ||
@@ -1689,7 +1689,12 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
         strcpy(ifr->ifr_name, tun->dev->name);
         return 0;
 
- err_free_dev:
+err_detach:
+        tun_detach_all(dev);
+err_free_flow:
+        tun_flow_uninit(tun);
+        security_tun_dev_free_security(tun->security);
+err_free_dev:
         free_netdev(dev);
         return err;
 }
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 03ad4dc293aa..2023f3ea891e 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -33,7 +33,7 @@
 #include <linux/usb/usbnet.h>
 
 
-#if defined(CONFIG_USB_NET_RNDIS_HOST) || defined(CONFIG_USB_NET_RNDIS_HOST_MODULE)
+#if IS_ENABLED(CONFIG_USB_NET_RNDIS_HOST)
 
 static int is_rndis(struct usb_interface_descriptor *desc)
 {
@@ -69,8 +69,7 @@ static const u8 mbm_guid[16] = {
         0xa6, 0x07, 0xc0, 0xff, 0xcb, 0x7e, 0x39, 0x2a,
 };
 
-/*
- * probes control interface, claims data interface, collects the bulk
+/* probes control interface, claims data interface, collects the bulk
  * endpoints, activates data interface (if needed), maybe sets MTU.
  * all pure cdc, except for certain firmware workarounds, and knowing
  * that rndis uses one different rule.
@@ -88,7 +87,7 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
         struct usb_cdc_mdlm_desc        *desc = NULL;
         struct usb_cdc_mdlm_detail_desc *detail = NULL;
 
-        if (sizeof dev->data < sizeof *info)
+        if (sizeof(dev->data) < sizeof(*info))
                 return -EDOM;
 
         /* expect strict spec conformance for the descriptors, but
@@ -126,10 +125,10 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
                  is_activesync(&intf->cur_altsetting->desc) ||
                  is_wireless_rndis(&intf->cur_altsetting->desc));
 
-        memset(info, 0, sizeof *info);
+        memset(info, 0, sizeof(*info));
         info->control = intf;
         while (len > 3) {
-                if (buf [1] != USB_DT_CS_INTERFACE)
+                if (buf[1] != USB_DT_CS_INTERFACE)
                         goto next_desc;
 
                 /* use bDescriptorSubType to identify the CDC descriptors.
@@ -139,14 +138,14 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
                  * in favor of a complicated OID-based RPC scheme doing what
                  * CDC Ethernet achieves with a simple descriptor.
                  */
-                switch (buf [2]) {
+                switch (buf[2]) {
                 case USB_CDC_HEADER_TYPE:
                         if (info->header) {
                                 dev_dbg(&intf->dev, "extra CDC header\n");
                                 goto bad_desc;
                         }
                         info->header = (void *) buf;
-                        if (info->header->bLength != sizeof *info->header) {
+                        if (info->header->bLength != sizeof(*info->header)) {
                                 dev_dbg(&intf->dev, "CDC header len %u\n",
                                         info->header->bLength);
                                 goto bad_desc;
@@ -175,7 +174,7 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
                                 goto bad_desc;
                         }
                         info->u = (void *) buf;
-                        if (info->u->bLength != sizeof *info->u) {
+                        if (info->u->bLength != sizeof(*info->u)) {
                                 dev_dbg(&intf->dev, "CDC union len %u\n",
                                         info->u->bLength);
                                 goto bad_desc;
@@ -233,7 +232,7 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
                                 goto bad_desc;
                         }
                         info->ether = (void *) buf;
-                        if (info->ether->bLength != sizeof *info->ether) {
+                        if (info->ether->bLength != sizeof(*info->ether)) {
                                 dev_dbg(&intf->dev, "CDC ether len %u\n",
                                         info->ether->bLength);
                                 goto bad_desc;
@@ -274,8 +273,8 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
                         break;
                 }
 next_desc:
-                len -= buf [0]; /* bLength */
-                buf += buf [0];
+                len -= buf[0];  /* bLength */
+                buf += buf[0];
         }
 
         /* Microsoft ActiveSync based and some regular RNDIS devices lack the
@@ -379,9 +378,7 @@ void usbnet_cdc_unbind(struct usbnet *dev, struct usb_interface *intf)
 }
 EXPORT_SYMBOL_GPL(usbnet_cdc_unbind);
 
-/*-------------------------------------------------------------------------
- *
- * Communications Device Class, Ethernet Control model
+/* Communications Device Class, Ethernet Control model
  *
  * Takes two interfaces.  The DATA interface is inactive till an altsetting
  * is selected.  Configuration data includes class descriptors.  There's
@@ -389,8 +386,7 @@ EXPORT_SYMBOL_GPL(usbnet_cdc_unbind);
  *
  * This should interop with whatever the 2.4 "CDCEther.c" driver
  * (by Brad Hards) talked with, with more functionality.
- *
- *-------------------------------------------------------------------------*/
+ */
 
 static void dumpspeed(struct usbnet *dev, __le32 *speeds)
 {
@@ -404,7 +400,7 @@ void usbnet_cdc_status(struct usbnet *dev, struct urb *urb)
 {
         struct usb_cdc_notification     *event;
 
-        if (urb->actual_length < sizeof *event)
+        if (urb->actual_length < sizeof(*event))
                 return;
 
         /* SPEED_CHANGE can get split into two 8-byte packets */
@@ -423,7 +419,7 @@ void usbnet_cdc_status(struct usbnet *dev, struct urb *urb)
         case USB_CDC_NOTIFY_SPEED_CHANGE:       /* tx/rx rates */
                 netif_dbg(dev, timer, dev->net, "CDC: speed change (len %d)\n",
                           urb->actual_length);
-                if (urb->actual_length != (sizeof *event + 8))
+                if (urb->actual_length != (sizeof(*event) + 8))
                         set_bit(EVENT_STS_SPLIT, &dev->flags);
                 else
                         dumpspeed(dev, (__le32 *) &event[1]);
@@ -469,7 +465,6 @@ EXPORT_SYMBOL_GPL(usbnet_cdc_bind);
 static const struct driver_info cdc_info = {
         .description =  "CDC Ethernet Device",
         .flags =        FLAG_ETHER | FLAG_POINTTOPOINT,
-        // .check_connect = cdc_check_connect,
         .bind =         usbnet_cdc_bind,
         .unbind =       usbnet_cdc_unbind,
         .status =       usbnet_cdc_status,
@@ -493,9 +488,8 @@ static const struct driver_info wwan_info = {
 #define DELL_VENDOR_ID          0x413C
 #define REALTEK_VENDOR_ID       0x0bda
 
-static const struct usb_device_id       products [] = {
-/*
- * BLACKLIST !!
+static const struct usb_device_id       products[] = {
+/* BLACKLIST !!
  *
  * First blacklist any products that are egregiously nonconformant
  * with the CDC Ethernet specs.  Minor braindamage we cope with; when
@@ -542,7 +536,7 @@ static const struct usb_device_id	products [] = {
         .driver_info            = 0,
 }, {
         .match_flags    =   USB_DEVICE_ID_MATCH_INT_INFO
-                  | USB_DEVICE_ID_MATCH_DEVICE,
+                          | USB_DEVICE_ID_MATCH_DEVICE,
         .idVendor               = 0x04DD,
         .idProduct              = 0x8007,       /* C-700 */
         ZAURUS_MASTER_INTERFACE,
@@ -659,8 +653,7 @@ static const struct usb_device_id	products [] = {
         .driver_info = 0,
 },
 
-/*
- * WHITELIST!!!
+/* WHITELIST!!!
  *
  * CDC Ether uses two interfaces, not necessarily consecutive.
  * We match the main interface, ignoring the optional device
@@ -672,60 +665,40 @@ static const struct usb_device_id	products [] = {
  */
 {
         /* ZTE (Vodafone) K3805-Z */
-        .match_flags    =   USB_DEVICE_ID_MATCH_VENDOR
-                 | USB_DEVICE_ID_MATCH_PRODUCT
-                 | USB_DEVICE_ID_MATCH_INT_INFO,
-        .idVendor               = ZTE_VENDOR_ID,
-        .idProduct              = 0x1003,
-        .bInterfaceClass        = USB_CLASS_COMM,
-        .bInterfaceSubClass     = USB_CDC_SUBCLASS_ETHERNET,
-        .bInterfaceProtocol     = USB_CDC_PROTO_NONE,
+        USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1003, USB_CLASS_COMM,
+                                      USB_CDC_SUBCLASS_ETHERNET,
+                                      USB_CDC_PROTO_NONE),
         .driver_info = (unsigned long)&wwan_info,
 }, {
         /* ZTE (Vodafone) K3806-Z */
-        .match_flags    =   USB_DEVICE_ID_MATCH_VENDOR
-                 | USB_DEVICE_ID_MATCH_PRODUCT
-                 | USB_DEVICE_ID_MATCH_INT_INFO,
-        .idVendor               = ZTE_VENDOR_ID,
-        .idProduct              = 0x1015,
-        .bInterfaceClass        = USB_CLASS_COMM,
-        .bInterfaceSubClass     = USB_CDC_SUBCLASS_ETHERNET,
-        .bInterfaceProtocol     = USB_CDC_PROTO_NONE,
+        USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1015, USB_CLASS_COMM,
+                                      USB_CDC_SUBCLASS_ETHERNET,
+                                      USB_CDC_PROTO_NONE),
         .driver_info = (unsigned long)&wwan_info,
 }, {
         /* ZTE (Vodafone) K4510-Z */
-        .match_flags    =   USB_DEVICE_ID_MATCH_VENDOR
-                 | USB_DEVICE_ID_MATCH_PRODUCT
-                 | USB_DEVICE_ID_MATCH_INT_INFO,
-        .idVendor               = ZTE_VENDOR_ID,
-        .idProduct              = 0x1173,
-        .bInterfaceClass        = USB_CLASS_COMM,
-        .bInterfaceSubClass     = USB_CDC_SUBCLASS_ETHERNET,
-        .bInterfaceProtocol     = USB_CDC_PROTO_NONE,
+        USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1173, USB_CLASS_COMM,
+                                      USB_CDC_SUBCLASS_ETHERNET,
+                                      USB_CDC_PROTO_NONE),
         .driver_info = (unsigned long)&wwan_info,
 }, {
         /* ZTE (Vodafone) K3770-Z */
-        .match_flags    =   USB_DEVICE_ID_MATCH_VENDOR
-                 | USB_DEVICE_ID_MATCH_PRODUCT
-                 | USB_DEVICE_ID_MATCH_INT_INFO,
-        .idVendor               = ZTE_VENDOR_ID,
-        .idProduct              = 0x1177,
-        .bInterfaceClass        = USB_CLASS_COMM,
-        .bInterfaceSubClass     = USB_CDC_SUBCLASS_ETHERNET,
-        .bInterfaceProtocol     = USB_CDC_PROTO_NONE,
+        USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1177, USB_CLASS_COMM,
+                                      USB_CDC_SUBCLASS_ETHERNET,
+                                      USB_CDC_PROTO_NONE),
         .driver_info = (unsigned long)&wwan_info,
 }, {
         /* ZTE (Vodafone) K3772-Z */
-        .match_flags    =   USB_DEVICE_ID_MATCH_VENDOR
-                 | USB_DEVICE_ID_MATCH_PRODUCT
-                 | USB_DEVICE_ID_MATCH_INT_INFO,
-        .idVendor               = ZTE_VENDOR_ID,
-        .idProduct              = 0x1181,
-        .bInterfaceClass        = USB_CLASS_COMM,
-        .bInterfaceSubClass     = USB_CDC_SUBCLASS_ETHERNET,
-        .bInterfaceProtocol     = USB_CDC_PROTO_NONE,
+        USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1181, USB_CLASS_COMM,
+                                      USB_CDC_SUBCLASS_ETHERNET,
+                                      USB_CDC_PROTO_NONE),
         .driver_info = (unsigned long)&wwan_info,
 }, {
+        /* Telit modules */
+        USB_VENDOR_AND_INTERFACE_INFO(0x1bc7, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+        .driver_info = (kernel_ulong_t) &wwan_info,
+}, {
         USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ETHERNET,
                         USB_CDC_PROTO_NONE),
         .driver_info = (unsigned long) &cdc_info,
@@ -736,15 +709,11 @@ static const struct usb_device_id	products [] = {
 
 }, {
         /* Various Huawei modems with a network port like the UMG1831 */
-        .match_flags    =   USB_DEVICE_ID_MATCH_VENDOR
-                 | USB_DEVICE_ID_MATCH_INT_INFO,
-        .idVendor               = HUAWEI_VENDOR_ID,
-        .bInterfaceClass        = USB_CLASS_COMM,
-        .bInterfaceSubClass     = USB_CDC_SUBCLASS_ETHERNET,
-        .bInterfaceProtocol     = 255,
+        USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_COMM,
+                                      USB_CDC_SUBCLASS_ETHERNET, 255),
         .driver_info = (unsigned long)&wwan_info,
 },
-        { },            // END
+        { },            /* END */
 };
 MODULE_DEVICE_TABLE(usb, products);
 
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index bf64b4191dcc..d1292fe746bc 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -564,7 +564,7 @@ static void vxlan_notify_add_rx_port(struct sock *sk)
         struct net_device *dev;
         struct net *net = sock_net(sk);
         sa_family_t sa_family = sk->sk_family;
-        u16 port = htons(inet_sk(sk)->inet_sport);
+        __be16 port = inet_sk(sk)->inet_sport;
 
         rcu_read_lock();
         for_each_netdev_rcu(net, dev) {
@@ -581,7 +581,7 @@ static void vxlan_notify_del_rx_port(struct sock *sk)
         struct net_device *dev;
         struct net *net = sock_net(sk);
         sa_family_t sa_family = sk->sk_family;
-        u16 port = htons(inet_sk(sk)->inet_sport);
+        __be16 port = inet_sk(sk)->inet_sport;
 
         rcu_read_lock();
         for_each_netdev_rcu(net, dev) {
@@ -2021,7 +2021,8 @@ static struct device_type vxlan_type = {
 };
 
 /* Calls the ndo_add_vxlan_port of the caller in order to
- * supply the listening VXLAN udp ports.
+ * supply the listening VXLAN udp ports. Callers are expected
+ * to implement the ndo_add_vxlan_port.
  */
 void vxlan_get_rx_port(struct net_device *dev)
 {
@@ -2029,16 +2030,13 @@ void vxlan_get_rx_port(struct net_device *dev)
         struct net *net = dev_net(dev);
         struct vxlan_net *vn = net_generic(net, vxlan_net_id);
         sa_family_t sa_family;
-        u16 port;
-        int i;
-
-        if (!dev || !dev->netdev_ops || !dev->netdev_ops->ndo_add_vxlan_port)
-                return;
+        __be16 port;
+        unsigned int i;
 
         spin_lock(&vn->sock_lock);
         for (i = 0; i < PORT_HASH_SIZE; ++i) {
-                hlist_for_each_entry_rcu(vs, vs_head(net, i), hlist) {
-                        port = htons(inet_sk(vs->sock->sk)->inet_sport);
+                hlist_for_each_entry_rcu(vs, &vn->sock_list[i], hlist) {
+                        port = inet_sk(vs->sock->sk)->inet_sport;
                         sa_family = vs->sock->sk->sk_family;
                         dev->netdev_ops->ndo_add_vxlan_port(dev, sa_family,
                                                             port);
@@ -2492,15 +2490,19 @@ static int vxlan_newlink(struct net *net, struct net_device *dev,
 
         SET_ETHTOOL_OPS(dev, &vxlan_ethtool_ops);
 
-        /* create an fdb entry for default destination */
-        err = vxlan_fdb_create(vxlan, all_zeros_mac,
-                               &vxlan->default_dst.remote_ip,
-                               NUD_REACHABLE|NUD_PERMANENT,
-                               NLM_F_EXCL|NLM_F_CREATE,
-                               vxlan->dst_port, vxlan->default_dst.remote_vni,
-                               vxlan->default_dst.remote_ifindex, NTF_SELF);
-        if (err)
-                return err;
+        /* create an fdb entry for a valid default destination */
+        if (!vxlan_addr_any(&vxlan->default_dst.remote_ip)) {
+                err = vxlan_fdb_create(vxlan, all_zeros_mac,
+                                       &vxlan->default_dst.remote_ip,
+                                       NUD_REACHABLE|NUD_PERMANENT,
+                                       NLM_F_EXCL|NLM_F_CREATE,
+                                       vxlan->dst_port,
+                                       vxlan->default_dst.remote_vni,
+                                       vxlan->default_dst.remote_ifindex,
+                                       NTF_SELF);
+                if (err)
+                        return err;
+        }
 
         err = register_netdevice(dev);
         if (err) {
diff --git a/drivers/net/wireless/adm8211.c b/drivers/net/wireless/adm8211.c
index f9a24e599dee..cfce83e1f273 100644
--- a/drivers/net/wireless/adm8211.c
+++ b/drivers/net/wireless/adm8211.c
@@ -1924,7 +1924,6 @@ static int adm8211_probe(struct pci_dev *pdev,
         pci_iounmap(pdev, priv->map);
 
  err_free_dev:
-        pci_set_drvdata(pdev, NULL);
         ieee80211_free_hw(dev);
 
  err_free_reg:
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index 7fe19648f10e..edf4b57c4aaa 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -5570,7 +5570,6 @@ static void airo_pci_remove(struct pci_dev *pdev)
         airo_print_info(dev->name, "Unregistering...");
         stop_airo_card(dev, 1);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
 }
 
 static int airo_pci_suspend(struct pci_dev *pdev, pm_message_t state)
diff --git a/drivers/net/wireless/ath/Kconfig b/drivers/net/wireless/ath/Kconfig
index 1abf1d421173..ba81d6292eeb 100644
--- a/drivers/net/wireless/ath/Kconfig
+++ b/drivers/net/wireless/ath/Kconfig
@@ -32,5 +32,6 @@ source "drivers/net/wireless/ath/ath6kl/Kconfig"
 source "drivers/net/wireless/ath/ar5523/Kconfig"
 source "drivers/net/wireless/ath/wil6210/Kconfig"
 source "drivers/net/wireless/ath/ath10k/Kconfig"
+source "drivers/net/wireless/ath/wcn36xx/Kconfig"
 
 endif
diff --git a/drivers/net/wireless/ath/Makefile b/drivers/net/wireless/ath/Makefile
index fb05cfd19361..363b05653c7e 100644
--- a/drivers/net/wireless/ath/Makefile
+++ b/drivers/net/wireless/ath/Makefile
@@ -5,6 +5,7 @@ obj-$(CONFIG_ATH6KL)		+= ath6kl/
 obj-$(CONFIG_AR5523)            += ar5523/
 obj-$(CONFIG_WIL6210)           += wil6210/
 obj-$(CONFIG_ATH10K)            += ath10k/
+obj-$(CONFIG_WCN36XX)           += wcn36xx/
 
 obj-$(CONFIG_ATH_COMMON)        += ath.o
 
diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c
index 17d7fece35d2..280fc3d53a36 100644
--- a/drivers/net/wireless/ath/ar5523/ar5523.c
+++ b/drivers/net/wireless/ath/ar5523/ar5523.c
@@ -1762,6 +1762,7 @@ static struct usb_device_id ar5523_id_table[] = {
         AR5523_DEVICE_UX(0x2001, 0x3a00),       /* Dlink / DWLAG132 */
         AR5523_DEVICE_UG(0x2001, 0x3a02),       /* Dlink / DWLG132 */
         AR5523_DEVICE_UX(0x2001, 0x3a04),       /* Dlink / DWLAG122 */
+        AR5523_DEVICE_UG(0x07d1, 0x3a07),       /* D-Link / WUA-2340 rev A1 */
         AR5523_DEVICE_UG(0x1690, 0x0712),       /* Gigaset / AR5523 */
         AR5523_DEVICE_UG(0x1690, 0x0710),       /* Gigaset / SMCWUSBTG */
         AR5523_DEVICE_UG(0x129b, 0x160c),       /* Gigaset / USB stick 108
diff --git a/drivers/net/wireless/ath/ath10k/bmi.c b/drivers/net/wireless/ath/ath10k/bmi.c
index 744da6d1c405..a1f099628850 100644
--- a/drivers/net/wireless/ath/ath10k/bmi.c
+++ b/drivers/net/wireless/ath/ath10k/bmi.c
@@ -22,7 +22,8 @@
 
 void ath10k_bmi_start(struct ath10k *ar)
 {
-        ath10k_dbg(ATH10K_DBG_CORE, "BMI started\n");
+        ath10k_dbg(ATH10K_DBG_BMI, "bmi start\n");
+
         ar->bmi.done_sent = false;
 }
 
@@ -32,8 +33,10 @@ int ath10k_bmi_done(struct ath10k *ar)
         u32 cmdlen = sizeof(cmd.id) + sizeof(cmd.done);
         int ret;
 
+        ath10k_dbg(ATH10K_DBG_BMI, "bmi done\n");
+
         if (ar->bmi.done_sent) {
-                ath10k_dbg(ATH10K_DBG_CORE, "%s skipped\n", __func__);
+                ath10k_dbg(ATH10K_DBG_BMI, "bmi skipped\n");
                 return 0;
         }
 
@@ -46,7 +49,6 @@ int ath10k_bmi_done(struct ath10k *ar)
                 return ret;
         }
 
-        ath10k_dbg(ATH10K_DBG_CORE, "BMI done\n");
         return 0;
 }
 
@@ -59,6 +61,8 @@ int ath10k_bmi_get_target_info(struct ath10k *ar,
         u32 resplen = sizeof(resp.get_target_info);
         int ret;
 
+        ath10k_dbg(ATH10K_DBG_BMI, "bmi get target info\n");
+
         if (ar->bmi.done_sent) {
                 ath10k_warn("BMI Get Target Info Command disallowed\n");
                 return -EBUSY;
@@ -80,6 +84,7 @@ int ath10k_bmi_get_target_info(struct ath10k *ar,
 
         target_info->version = __le32_to_cpu(resp.get_target_info.version);
         target_info->type    = __le32_to_cpu(resp.get_target_info.type);
+
         return 0;
 }
 
@@ -92,15 +97,14 @@ int ath10k_bmi_read_memory(struct ath10k *ar,
         u32 rxlen;
         int ret;
 
+        ath10k_dbg(ATH10K_DBG_BMI, "bmi read address 0x%x length %d\n",
+                   address, length);
+
         if (ar->bmi.done_sent) {
                 ath10k_warn("command disallowed\n");
                 return -EBUSY;
         }
 
-        ath10k_dbg(ATH10K_DBG_CORE,
-                   "%s: (device: 0x%p, address: 0x%x, length: %d)\n",
-                   __func__, ar, address, length);
-
         while (length) {
                 rxlen = min_t(u32, length, BMI_MAX_DATA_SIZE);
 
@@ -133,15 +137,14 @@ int ath10k_bmi_write_memory(struct ath10k *ar,
         u32 txlen;
         int ret;
 
+        ath10k_dbg(ATH10K_DBG_BMI, "bmi write address 0x%x length %d\n",
+                   address, length);
+
         if (ar->bmi.done_sent) {
                 ath10k_warn("command disallowed\n");
                 return -EBUSY;
         }
 
-        ath10k_dbg(ATH10K_DBG_CORE,
-                   "%s: (device: 0x%p, address: 0x%x, length: %d)\n",
-                   __func__, ar, address, length);
-
         while (length) {
                 txlen = min(length, BMI_MAX_DATA_SIZE - hdrlen);
 
@@ -180,15 +183,14 @@ int ath10k_bmi_execute(struct ath10k *ar, u32 address, u32 *param)
         u32 resplen = sizeof(resp.execute);
         int ret;
 
+        ath10k_dbg(ATH10K_DBG_BMI, "bmi execute address 0x%x param 0x%x\n",
+                   address, *param);
+
         if (ar->bmi.done_sent) {
                 ath10k_warn("command disallowed\n");
                 return -EBUSY;
         }
 
-        ath10k_dbg(ATH10K_DBG_CORE,
-                   "%s: (device: 0x%p, address: 0x%x, param: %d)\n",
-                   __func__, ar, address, *param);
-
         cmd.id            = __cpu_to_le32(BMI_EXECUTE);
         cmd.execute.addr  = __cpu_to_le32(address);
         cmd.execute.param = __cpu_to_le32(*param);
@@ -216,6 +218,9 @@ int ath10k_bmi_lz_data(struct ath10k *ar, const void *buffer, u32 length)
         u32 txlen;
         int ret;
 
+        ath10k_dbg(ATH10K_DBG_BMI, "bmi lz data buffer 0x%p length %d\n",
+                   buffer, length);
+
         if (ar->bmi.done_sent) {
                 ath10k_warn("command disallowed\n");
                 return -EBUSY;
@@ -250,6 +255,9 @@ int ath10k_bmi_lz_stream_start(struct ath10k *ar, u32 address)
         u32 cmdlen = sizeof(cmd.id) + sizeof(cmd.lz_start);
         int ret;
 
+        ath10k_dbg(ATH10K_DBG_BMI, "bmi lz stream start address 0x%x\n",
+                   address);
+
         if (ar->bmi.done_sent) {
                 ath10k_warn("command disallowed\n");
                 return -EBUSY;
@@ -275,6 +283,10 @@ int ath10k_bmi_fast_download(struct ath10k *ar,
         u32 trailer_len = length - head_len;
         int ret;
 
+        ath10k_dbg(ATH10K_DBG_BMI,
+                   "bmi fast download address 0x%x buffer 0x%p length %d\n",
+                   address, buffer, length);
+
         ret = ath10k_bmi_lz_stream_start(ar, address);
         if (ret)
                 return ret;
diff --git a/drivers/net/wireless/ath/ath10k/ce.c b/drivers/net/wireless/ath/ath10k/ce.c
index f8b969f518f8..834e29ea236c 100644
--- a/drivers/net/wireless/ath/ath10k/ce.c
+++ b/drivers/net/wireless/ath/ath10k/ce.c
@@ -76,36 +76,7 @@ static inline void ath10k_ce_src_ring_write_index_set(struct ath10k *ar,
                                                       u32 ce_ctrl_addr,
                                                       unsigned int n)
 {
-        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        void __iomem *indicator_addr;
-
-        if (!test_bit(ATH10K_PCI_FEATURE_HW_1_0_WORKAROUND, ar_pci->features)) {
-                ath10k_pci_write32(ar, ce_ctrl_addr + SR_WR_INDEX_ADDRESS, n);
-                return;
-        }
-
-        /* workaround for QCA988x_1.0 HW CE */
-        indicator_addr = ar_pci->mem + ce_ctrl_addr + DST_WATERMARK_ADDRESS;
-
-        if (ce_ctrl_addr == ath10k_ce_base_address(CDC_WAR_DATA_CE)) {
-                iowrite32((CDC_WAR_MAGIC_STR | n), indicator_addr);
-        } else {
-                unsigned long irq_flags;
-                local_irq_save(irq_flags);
-                iowrite32(1, indicator_addr);
-
-                /*
-                 * PCIE write waits for ACK in IPQ8K, there is no
-                 * need to read back value.
-                 */
-                (void)ioread32(indicator_addr);
-                (void)ioread32(indicator_addr); /* conservative */
-
-                ath10k_pci_write32(ar, ce_ctrl_addr + SR_WR_INDEX_ADDRESS, n);
-
-                iowrite32(0, indicator_addr);
-                local_irq_restore(irq_flags);
-        }
+        ath10k_pci_write32(ar, ce_ctrl_addr + SR_WR_INDEX_ADDRESS, n);
 }
 
 static inline u32 ath10k_ce_src_ring_write_index_get(struct ath10k *ar,
@@ -285,7 +256,7 @@ static inline void ath10k_ce_engine_int_status_clear(struct ath10k *ar,
  * ath10k_ce_sendlist_send.
  * The caller takes responsibility for any needed locking.
  */
-static int ath10k_ce_send_nolock(struct ce_state *ce_state,
+static int ath10k_ce_send_nolock(struct ath10k_ce_pipe *ce_state,
                                  void *per_transfer_context,
                                  u32 buffer,
                                  unsigned int nbytes,
@@ -293,7 +264,7 @@ static int ath10k_ce_send_nolock(struct ce_state *ce_state,
                                  unsigned int flags)
 {
         struct ath10k *ar = ce_state->ar;
-        struct ce_ring_state *src_ring = ce_state->src_ring;
+        struct ath10k_ce_ring *src_ring = ce_state->src_ring;
         struct ce_desc *desc, *sdesc;
         unsigned int nentries_mask = src_ring->nentries_mask;
         unsigned int sw_index = src_ring->sw_index;
@@ -306,7 +277,9 @@ static int ath10k_ce_send_nolock(struct ce_state *ce_state,
                 ath10k_warn("%s: send more we can (nbytes: %d, max: %d)\n",
                             __func__, nbytes, ce_state->src_sz_max);
 
-        ath10k_pci_wake(ar);
+        ret = ath10k_pci_wake(ar);
+        if (ret)
+                return ret;
 
         if (unlikely(CE_RING_DELTA(nentries_mask,
                                    write_index, sw_index - 1) <= 0)) {
@@ -346,7 +319,7 @@ exit:
         return ret;
 }
 
-int ath10k_ce_send(struct ce_state *ce_state,
+int ath10k_ce_send(struct ath10k_ce_pipe *ce_state,
                    void *per_transfer_context,
                    u32 buffer,
                    unsigned int nbytes,
@@ -365,33 +338,19 @@ int ath10k_ce_send(struct ce_state *ce_state,
         return ret;
 }
 
-void ath10k_ce_sendlist_buf_add(struct ce_sendlist *sendlist, u32 buffer,
-                                unsigned int nbytes, u32 flags)
-{
-        unsigned int num_items = sendlist->num_items;
-        struct ce_sendlist_item *item;
-
-        item = &sendlist->item[num_items];
-        item->data = buffer;
-        item->u.nbytes = nbytes;
-        item->flags = flags;
-        sendlist->num_items++;
-}
-
-int ath10k_ce_sendlist_send(struct ce_state *ce_state,
+int ath10k_ce_sendlist_send(struct ath10k_ce_pipe *ce_state,
                             void *per_transfer_context,
-                            struct ce_sendlist *sendlist,
-                            unsigned int transfer_id)
+                            unsigned int transfer_id,
+                            u32 paddr, unsigned int nbytes,
+                            u32 flags)
 {
-        struct ce_ring_state *src_ring = ce_state->src_ring;
-        struct ce_sendlist_item *item;
+        struct ath10k_ce_ring *src_ring = ce_state->src_ring;
         struct ath10k *ar = ce_state->ar;
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         unsigned int nentries_mask = src_ring->nentries_mask;
-        unsigned int num_items = sendlist->num_items;
         unsigned int sw_index;
         unsigned int write_index;
-        int i, delta, ret = -ENOMEM;
+        int delta, ret = -ENOMEM;
 
         spin_lock_bh(&ar_pci->ce_lock);
 
@@ -400,30 +359,12 @@ int ath10k_ce_sendlist_send(struct ce_state *ce_state,
 
         delta = CE_RING_DELTA(nentries_mask, write_index, sw_index - 1);
 
-        if (delta >= num_items) {
-                /*
-                 * Handle all but the last item uniformly.
-                 */
-                for (i = 0; i < num_items - 1; i++) {
-                        item = &sendlist->item[i];
-                        ret = ath10k_ce_send_nolock(ce_state,
-                                                    CE_SENDLIST_ITEM_CTXT,
-                                                    (u32) item->data,
-                                                    item->u.nbytes, transfer_id,
-                                                    item->flags |
-                                                    CE_SEND_FLAG_GATHER);
-                        if (ret)
-                                ath10k_warn("CE send failed for item: %d\n", i);
-                }
-                /*
-                 * Provide valid context pointer for final item.
-                 */
-                item = &sendlist->item[i];
+        if (delta >= 1) {
                 ret = ath10k_ce_send_nolock(ce_state, per_transfer_context,
-                                            (u32) item->data, item->u.nbytes,
-                                            transfer_id, item->flags);
+                                            paddr, nbytes,
+                                            transfer_id, flags);
                 if (ret)
-                        ath10k_warn("CE send failed for last item: %d\n", i);
+                        ath10k_warn("CE send failed: %d\n", ret);
         }
 
         spin_unlock_bh(&ar_pci->ce_lock);
@@ -431,11 +372,11 @@ int ath10k_ce_sendlist_send(struct ce_state *ce_state,
         return ret;
 }
 
-int ath10k_ce_recv_buf_enqueue(struct ce_state *ce_state,
+int ath10k_ce_recv_buf_enqueue(struct ath10k_ce_pipe *ce_state,
                                void *per_recv_context,
                                u32 buffer)
 {
-        struct ce_ring_state *dest_ring = ce_state->dest_ring;
+        struct ath10k_ce_ring *dest_ring = ce_state->dest_ring;
         u32 ctrl_addr = ce_state->ctrl_addr;
         struct ath10k *ar = ce_state->ar;
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
@@ -448,7 +389,9 @@ int ath10k_ce_recv_buf_enqueue(struct ce_state *ce_state,
         write_index = dest_ring->write_index;
         sw_index = dest_ring->sw_index;
 
-        ath10k_pci_wake(ar);
+        ret = ath10k_pci_wake(ar);
+        if (ret)
+                goto out;
 
         if (CE_RING_DELTA(nentries_mask, write_index, sw_index - 1) > 0) {
                 struct ce_desc *base = dest_ring->base_addr_owner_space;
@@ -470,6 +413,8 @@ int ath10k_ce_recv_buf_enqueue(struct ce_state *ce_state,
                 ret = -EIO;
         }
         ath10k_pci_sleep(ar);
+
+out:
         spin_unlock_bh(&ar_pci->ce_lock);
 
         return ret;
@@ -479,14 +424,14 @@ int ath10k_ce_recv_buf_enqueue(struct ce_state *ce_state,
  * Guts of ath10k_ce_completed_recv_next.
  * The caller takes responsibility for any necessary locking.
  */
-static int ath10k_ce_completed_recv_next_nolock(struct ce_state *ce_state,
+static int ath10k_ce_completed_recv_next_nolock(struct ath10k_ce_pipe *ce_state,
                                                 void **per_transfer_contextp,
                                                 u32 *bufferp,
                                                 unsigned int *nbytesp,
                                                 unsigned int *transfer_idp,
                                                 unsigned int *flagsp)
 {
-        struct ce_ring_state *dest_ring = ce_state->dest_ring;
+        struct ath10k_ce_ring *dest_ring = ce_state->dest_ring;
         unsigned int nentries_mask = dest_ring->nentries_mask;
         unsigned int sw_index = dest_ring->sw_index;
 
@@ -535,7 +480,7 @@ static int ath10k_ce_completed_recv_next_nolock(struct ce_state *ce_state,
         return 0;
 }
 
-int ath10k_ce_completed_recv_next(struct ce_state *ce_state,
+int ath10k_ce_completed_recv_next(struct ath10k_ce_pipe *ce_state,
                                   void **per_transfer_contextp,
                                   u32 *bufferp,
                                   unsigned int *nbytesp,
@@ -556,11 +501,11 @@ int ath10k_ce_completed_recv_next(struct ce_state *ce_state,
         return ret;
 }
 
-int ath10k_ce_revoke_recv_next(struct ce_state *ce_state,
+int ath10k_ce_revoke_recv_next(struct ath10k_ce_pipe *ce_state,
                                void **per_transfer_contextp,
                                u32 *bufferp)
 {
-        struct ce_ring_state *dest_ring;
+        struct ath10k_ce_ring *dest_ring;
         unsigned int nentries_mask;
         unsigned int sw_index;
         unsigned int write_index;
@@ -612,19 +557,20 @@ int ath10k_ce_revoke_recv_next(struct ce_state *ce_state,
  * Guts of ath10k_ce_completed_send_next.
  * The caller takes responsibility for any necessary locking.
  */
-static int ath10k_ce_completed_send_next_nolock(struct ce_state *ce_state,
+static int ath10k_ce_completed_send_next_nolock(struct ath10k_ce_pipe *ce_state,
                                                 void **per_transfer_contextp,
                                                 u32 *bufferp,
                                                 unsigned int *nbytesp,
                                                 unsigned int *transfer_idp)
 {
-        struct ce_ring_state *src_ring = ce_state->src_ring;
+        struct ath10k_ce_ring *src_ring = ce_state->src_ring;
         u32 ctrl_addr = ce_state->ctrl_addr;
         struct ath10k *ar = ce_state->ar;
         unsigned int nentries_mask = src_ring->nentries_mask;
         unsigned int sw_index = src_ring->sw_index;
+        struct ce_desc *sdesc, *sbase;
         unsigned int read_index;
-        int ret = -EIO;
+        int ret;
 
         if (src_ring->hw_index == sw_index) {
                 /*
@@ -634,48 +580,54 @@ static int ath10k_ce_completed_send_next_nolock(struct ce_state *ce_state,
                  * the SW has really caught up to the HW, or if the cached
                  * value of the HW index has become stale.
                  */
-                ath10k_pci_wake(ar);
+
+                ret = ath10k_pci_wake(ar);
+                if (ret)
+                        return ret;
+
                 src_ring->hw_index =
                         ath10k_ce_src_ring_read_index_get(ar, ctrl_addr);
                 src_ring->hw_index &= nentries_mask;
+
                 ath10k_pci_sleep(ar);
         }
+
         read_index = src_ring->hw_index;
 
-        if ((read_index != sw_index) && (read_index != 0xffffffff)) {
-                struct ce_desc *sbase = src_ring->shadow_base;
-                struct ce_desc *sdesc = CE_SRC_RING_TO_DESC(sbase, sw_index);
+        if ((read_index == sw_index) || (read_index == 0xffffffff))
+                return -EIO;
 
-                /* Return data from completed source descriptor */
-                *bufferp = __le32_to_cpu(sdesc->addr);
-                *nbytesp = __le16_to_cpu(sdesc->nbytes);
-                *transfer_idp = MS(__le16_to_cpu(sdesc->flags),
-                                                CE_DESC_FLAGS_META_DATA);
+        sbase = src_ring->shadow_base;
+        sdesc = CE_SRC_RING_TO_DESC(sbase, sw_index);
 
-                if (per_transfer_contextp)
-                        *per_transfer_contextp =
-                                src_ring->per_transfer_context[sw_index];
+        /* Return data from completed source descriptor */
+        *bufferp = __le32_to_cpu(sdesc->addr);
+        *nbytesp = __le16_to_cpu(sdesc->nbytes);
+        *transfer_idp = MS(__le16_to_cpu(sdesc->flags),
+                           CE_DESC_FLAGS_META_DATA);
 
-                /* sanity */
-                src_ring->per_transfer_context[sw_index] = NULL;
+        if (per_transfer_contextp)
+                *per_transfer_contextp =
+                        src_ring->per_transfer_context[sw_index];
 
-                /* Update sw_index */
-                sw_index = CE_RING_IDX_INCR(nentries_mask, sw_index);
-                src_ring->sw_index = sw_index;
-                ret = 0;
-        }
+        /* sanity */
+        src_ring->per_transfer_context[sw_index] = NULL;
 
-        return ret;
+        /* Update sw_index */
+        sw_index = CE_RING_IDX_INCR(nentries_mask, sw_index);
+        src_ring->sw_index = sw_index;
+
+        return 0;
 }
 
 /* NB: Modeled after ath10k_ce_completed_send_next */
-int ath10k_ce_cancel_send_next(struct ce_state *ce_state,
+int ath10k_ce_cancel_send_next(struct ath10k_ce_pipe *ce_state,
                                void **per_transfer_contextp,
                                u32 *bufferp,
                                unsigned int *nbytesp,
                                unsigned int *transfer_idp)
 {
-        struct ce_ring_state *src_ring;
+        struct ath10k_ce_ring *src_ring;
         unsigned int nentries_mask;
         unsigned int sw_index;
         unsigned int write_index;
@@ -727,7 +679,7 @@ int ath10k_ce_cancel_send_next(struct ce_state *ce_state,
         return ret;
 }
 
-int ath10k_ce_completed_send_next(struct ce_state *ce_state,
+int ath10k_ce_completed_send_next(struct ath10k_ce_pipe *ce_state,
                                   void **per_transfer_contextp,
                                   u32 *bufferp,
                                   unsigned int *nbytesp,
@@ -756,53 +708,29 @@ int ath10k_ce_completed_send_next(struct ce_state *ce_state,
 void ath10k_ce_per_engine_service(struct ath10k *ar, unsigned int ce_id)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct ce_state *ce_state = ar_pci->ce_id_to_state[ce_id];
+        struct ath10k_ce_pipe *ce_state = &ar_pci->ce_states[ce_id];
         u32 ctrl_addr = ce_state->ctrl_addr;
-        void *transfer_context;
-        u32 buf;
-        unsigned int nbytes;
-        unsigned int id;
-        unsigned int flags;
+        int ret;
+
+        ret = ath10k_pci_wake(ar);
+        if (ret)
+                return;
 
-        ath10k_pci_wake(ar);
         spin_lock_bh(&ar_pci->ce_lock);
 
         /* Clear the copy-complete interrupts that will be handled here. */
         ath10k_ce_engine_int_status_clear(ar, ctrl_addr,
                                           HOST_IS_COPY_COMPLETE_MASK);
 
-        if (ce_state->recv_cb) {
-                /*
-                 * Pop completed recv buffers and call the registered
-                 * recv callback for each
-                 */
-                while (ath10k_ce_completed_recv_next_nolock(ce_state,
-                                                            &transfer_context,
-                                                            &buf, &nbytes,
-                                                            &id, &flags) == 0) {
-                        spin_unlock_bh(&ar_pci->ce_lock);
-                        ce_state->recv_cb(ce_state, transfer_context, buf,
-                                          nbytes, id, flags);
-                        spin_lock_bh(&ar_pci->ce_lock);
-                }
-        }
+        spin_unlock_bh(&ar_pci->ce_lock);
 
-        if (ce_state->send_cb) {
-                /*
-                 * Pop completed send buffers and call the registered
-                 * send callback for each
-                 */
-                while (ath10k_ce_completed_send_next_nolock(ce_state,
-                                                            &transfer_context,
-                                                            &buf,
-                                                            &nbytes,
-                                                            &id) == 0) {
-                        spin_unlock_bh(&ar_pci->ce_lock);
-                        ce_state->send_cb(ce_state, transfer_context,
-                                          buf, nbytes, id);
-                        spin_lock_bh(&ar_pci->ce_lock);
-                }
-        }
+        if (ce_state->recv_cb)
+                ce_state->recv_cb(ce_state);
+
+        if (ce_state->send_cb)
+                ce_state->send_cb(ce_state);
+
+        spin_lock_bh(&ar_pci->ce_lock);
 
         /*
          * Misc CE interrupts are not being handled, but still need
@@ -823,10 +751,13 @@ void ath10k_ce_per_engine_service(struct ath10k *ar, unsigned int ce_id)
 void ath10k_ce_per_engine_service_any(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        int ce_id;
+        int ce_id, ret;
         u32 intr_summary;
 
-        ath10k_pci_wake(ar);
+        ret = ath10k_pci_wake(ar);
+        if (ret)
+                return;
+
         intr_summary = CE_INTERRUPT_SUMMARY(ar);
 
         for (ce_id = 0; intr_summary && (ce_id < ar_pci->ce_count); ce_id++) {
@@ -849,13 +780,16 @@ void ath10k_ce_per_engine_service_any(struct ath10k *ar)
  *
  * Called with ce_lock held.
  */
-static void ath10k_ce_per_engine_handler_adjust(struct ce_state *ce_state,
+static void ath10k_ce_per_engine_handler_adjust(struct ath10k_ce_pipe *ce_state,
                                                 int disable_copy_compl_intr)
 {
         u32 ctrl_addr = ce_state->ctrl_addr;
         struct ath10k *ar = ce_state->ar;
+        int ret;
 
-        ath10k_pci_wake(ar);
+        ret = ath10k_pci_wake(ar);
+        if (ret)
+                return;
 
         if ((!disable_copy_compl_intr) &&
             (ce_state->send_cb || ce_state->recv_cb))
@@ -871,11 +805,14 @@ static void ath10k_ce_per_engine_handler_adjust(struct ce_state *ce_state,
 void ath10k_ce_disable_interrupts(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        int ce_id;
+        int ce_id, ret;
+
+        ret = ath10k_pci_wake(ar);
+        if (ret)
+                return;
 
-        ath10k_pci_wake(ar);
         for (ce_id = 0; ce_id < ar_pci->ce_count; ce_id++) {
-                struct ce_state *ce_state = ar_pci->ce_id_to_state[ce_id];
+                struct ath10k_ce_pipe *ce_state = &ar_pci->ce_states[ce_id];
                 u32 ctrl_addr = ce_state->ctrl_addr;
 
                 ath10k_ce_copy_complete_intr_disable(ar, ctrl_addr);
@@ -883,12 +820,8 @@ void ath10k_ce_disable_interrupts(struct ath10k *ar)
         ath10k_pci_sleep(ar);
 }
 
-void ath10k_ce_send_cb_register(struct ce_state *ce_state,
-                                void (*send_cb) (struct ce_state *ce_state,
-                                                 void *transfer_context,
-                                                 u32 buffer,
-                                                 unsigned int nbytes,
-                                                 unsigned int transfer_id),
+void ath10k_ce_send_cb_register(struct ath10k_ce_pipe *ce_state,
+                                void (*send_cb)(struct ath10k_ce_pipe *),
                                 int disable_interrupts)
 {
         struct ath10k *ar = ce_state->ar;
@@ -900,13 +833,8 @@ void ath10k_ce_send_cb_register(struct ce_state *ce_state,
         spin_unlock_bh(&ar_pci->ce_lock);
 }
 
-void ath10k_ce_recv_cb_register(struct ce_state *ce_state,
-                                void (*recv_cb) (struct ce_state *ce_state,
-                                                 void *transfer_context,
-                                                 u32 buffer,
-                                                 unsigned int nbytes,
-                                                 unsigned int transfer_id,
-                                                 unsigned int flags))
+void ath10k_ce_recv_cb_register(struct ath10k_ce_pipe *ce_state,
+                                void (*recv_cb)(struct ath10k_ce_pipe *))
 {
         struct ath10k *ar = ce_state->ar;
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
@@ -919,11 +847,11 @@ void ath10k_ce_recv_cb_register(struct ce_state *ce_state,
 
 static int ath10k_ce_init_src_ring(struct ath10k *ar,
                                    unsigned int ce_id,
-                                   struct ce_state *ce_state,
+                                   struct ath10k_ce_pipe *ce_state,
                                    const struct ce_attr *attr)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct ce_ring_state *src_ring;
+        struct ath10k_ce_ring *src_ring;
         unsigned int nentries = attr->src_nentries;
         unsigned int ce_nbytes;
         u32 ctrl_addr = ath10k_ce_base_address(ce_id);
@@ -937,19 +865,18 @@ static int ath10k_ce_init_src_ring(struct ath10k *ar,
                 return 0;
         }
 
-        ce_nbytes = sizeof(struct ce_ring_state) + (nentries * sizeof(void *));
+        ce_nbytes = sizeof(struct ath10k_ce_ring) + (nentries * sizeof(void *));
         ptr = kzalloc(ce_nbytes, GFP_KERNEL);
         if (ptr == NULL)
                 return -ENOMEM;
 
-        ce_state->src_ring = (struct ce_ring_state *)ptr;
+        ce_state->src_ring = (struct ath10k_ce_ring *)ptr;
         src_ring = ce_state->src_ring;
 
-        ptr += sizeof(struct ce_ring_state);
+        ptr += sizeof(struct ath10k_ce_ring);
         src_ring->nentries = nentries;
         src_ring->nentries_mask = nentries - 1;
 
-        ath10k_pci_wake(ar);
         src_ring->sw_index = ath10k_ce_src_ring_read_index_get(ar, ctrl_addr);
         src_ring->sw_index &= src_ring->nentries_mask;
         src_ring->hw_index = src_ring->sw_index;
@@ -957,7 +884,6 @@ static int ath10k_ce_init_src_ring(struct ath10k *ar,
         src_ring->write_index =
                 ath10k_ce_src_ring_write_index_get(ar, ctrl_addr);
         src_ring->write_index &= src_ring->nentries_mask;
-        ath10k_pci_sleep(ar);
 
         src_ring->per_transfer_context = (void **)ptr;
 
@@ -970,6 +896,12 @@ static int ath10k_ce_init_src_ring(struct ath10k *ar,
                                      (nentries * sizeof(struct ce_desc) +
                                       CE_DESC_RING_ALIGN),
                                      &base_addr);
+        if (!src_ring->base_addr_owner_space_unaligned) {
+                kfree(ce_state->src_ring);
+                ce_state->src_ring = NULL;
+                return -ENOMEM;
+        }
+
         src_ring->base_addr_ce_space_unaligned = base_addr;
 
         src_ring->base_addr_owner_space = PTR_ALIGN(
@@ -986,12 +918,21 @@ static int ath10k_ce_init_src_ring(struct ath10k *ar,
         src_ring->shadow_base_unaligned =
                 kmalloc((nentries * sizeof(struct ce_desc) +
                          CE_DESC_RING_ALIGN), GFP_KERNEL);
+        if (!src_ring->shadow_base_unaligned) {
+                pci_free_consistent(ar_pci->pdev,
+                                    (nentries * sizeof(struct ce_desc) +
+                                     CE_DESC_RING_ALIGN),
+                                    src_ring->base_addr_owner_space,
+                                    src_ring->base_addr_ce_space);
+                kfree(ce_state->src_ring);
+                ce_state->src_ring = NULL;
+                return -ENOMEM;
+        }
 
         src_ring->shadow_base = PTR_ALIGN(
                         src_ring->shadow_base_unaligned,
                         CE_DESC_RING_ALIGN);
 
-        ath10k_pci_wake(ar);
         ath10k_ce_src_ring_base_addr_set(ar, ctrl_addr,
                                          src_ring->base_addr_ce_space);
         ath10k_ce_src_ring_size_set(ar, ctrl_addr, nentries);
@@ -999,18 +940,21 @@ static int ath10k_ce_init_src_ring(struct ath10k *ar,
         ath10k_ce_src_ring_byte_swap_set(ar, ctrl_addr, 0);
         ath10k_ce_src_ring_lowmark_set(ar, ctrl_addr, 0);
         ath10k_ce_src_ring_highmark_set(ar, ctrl_addr, nentries);
-        ath10k_pci_sleep(ar);
+
+        ath10k_dbg(ATH10K_DBG_BOOT,
+                   "boot ce src ring id %d entries %d base_addr %p\n",
+                   ce_id, nentries, src_ring->base_addr_owner_space);
 
         return 0;
 }
 
 static int ath10k_ce_init_dest_ring(struct ath10k *ar,
                                     unsigned int ce_id,
-                                    struct ce_state *ce_state,
+                                    struct ath10k_ce_pipe *ce_state,
                                     const struct ce_attr *attr)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct ce_ring_state *dest_ring;
+        struct ath10k_ce_ring *dest_ring;
         unsigned int nentries = attr->dest_nentries;
         unsigned int ce_nbytes;
         u32 ctrl_addr = ath10k_ce_base_address(ce_id);
@@ -1024,25 +968,23 @@ static int ath10k_ce_init_dest_ring(struct ath10k *ar,
                 return 0;
         }
 
-        ce_nbytes = sizeof(struct ce_ring_state) + (nentries * sizeof(void *));
+        ce_nbytes = sizeof(struct ath10k_ce_ring) + (nentries * sizeof(void *));
         ptr = kzalloc(ce_nbytes, GFP_KERNEL);
         if (ptr == NULL)
                 return -ENOMEM;
 
-        ce_state->dest_ring = (struct ce_ring_state *)ptr;
+        ce_state->dest_ring = (struct ath10k_ce_ring *)ptr;
         dest_ring = ce_state->dest_ring;
 
-        ptr += sizeof(struct ce_ring_state);
+        ptr += sizeof(struct ath10k_ce_ring);
         dest_ring->nentries = nentries;
         dest_ring->nentries_mask = nentries - 1;
 
-        ath10k_pci_wake(ar);
         dest_ring->sw_index = ath10k_ce_dest_ring_read_index_get(ar, ctrl_addr);
         dest_ring->sw_index &= dest_ring->nentries_mask;
         dest_ring->write_index =
                 ath10k_ce_dest_ring_write_index_get(ar, ctrl_addr);
         dest_ring->write_index &= dest_ring->nentries_mask;
-        ath10k_pci_sleep(ar);
 
         dest_ring->per_transfer_context = (void **)ptr;
 
@@ -1055,6 +997,12 @@ static int ath10k_ce_init_dest_ring(struct ath10k *ar,
                                      (nentries * sizeof(struct ce_desc) +
                                       CE_DESC_RING_ALIGN),
                                      &base_addr);
+        if (!dest_ring->base_addr_owner_space_unaligned) {
+                kfree(ce_state->dest_ring);
+                ce_state->dest_ring = NULL;
+                return -ENOMEM;
+        }
+
         dest_ring->base_addr_ce_space_unaligned = base_addr;
 
         /*
@@ -1071,44 +1019,35 @@ static int ath10k_ce_init_dest_ring(struct ath10k *ar,
                         dest_ring->base_addr_ce_space_unaligned,
                         CE_DESC_RING_ALIGN);
 
-        ath10k_pci_wake(ar);
         ath10k_ce_dest_ring_base_addr_set(ar, ctrl_addr,
                                           dest_ring->base_addr_ce_space);
         ath10k_ce_dest_ring_size_set(ar, ctrl_addr, nentries);
         ath10k_ce_dest_ring_byte_swap_set(ar, ctrl_addr, 0);
         ath10k_ce_dest_ring_lowmark_set(ar, ctrl_addr, 0);
         ath10k_ce_dest_ring_highmark_set(ar, ctrl_addr, nentries);
-        ath10k_pci_sleep(ar);
+
+        ath10k_dbg(ATH10K_DBG_BOOT,
+                   "boot ce dest ring id %d entries %d base_addr %p\n",
+                   ce_id, nentries, dest_ring->base_addr_owner_space);
 
         return 0;
 }
 
-static struct ce_state *ath10k_ce_init_state(struct ath10k *ar,
+static struct ath10k_ce_pipe *ath10k_ce_init_state(struct ath10k *ar,
                                              unsigned int ce_id,
                                              const struct ce_attr *attr)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct ce_state *ce_state = NULL;
+        struct ath10k_ce_pipe *ce_state = &ar_pci->ce_states[ce_id];
         u32 ctrl_addr = ath10k_ce_base_address(ce_id);
 
         spin_lock_bh(&ar_pci->ce_lock);
 
-        if (!ar_pci->ce_id_to_state[ce_id]) {
-                ce_state = kzalloc(sizeof(*ce_state), GFP_ATOMIC);
-                if (ce_state == NULL) {
-                        spin_unlock_bh(&ar_pci->ce_lock);
-                        return NULL;
-                }
-
-                ar_pci->ce_id_to_state[ce_id] = ce_state;
-                ce_state->ar = ar;
-                ce_state->id = ce_id;
-                ce_state->ctrl_addr = ctrl_addr;
-                ce_state->state = CE_RUNNING;
-                /* Save attribute flags */
-                ce_state->attr_flags = attr->flags;
-                ce_state->src_sz_max = attr->src_sz_max;
-        }
+        ce_state->ar = ar;
+        ce_state->id = ce_id;
+        ce_state->ctrl_addr = ctrl_addr;
+        ce_state->attr_flags = attr->flags;
+        ce_state->src_sz_max = attr->src_sz_max;
 
         spin_unlock_bh(&ar_pci->ce_lock);
 
@@ -1122,12 +1061,17 @@ static struct ce_state *ath10k_ce_init_state(struct ath10k *ar,
  * initialization. It may be that only one side or the other is
  * initialized by software/firmware.
  */
-struct ce_state *ath10k_ce_init(struct ath10k *ar,
+struct ath10k_ce_pipe *ath10k_ce_init(struct ath10k *ar,
                                 unsigned int ce_id,
                                 const struct ce_attr *attr)
 {
-        struct ce_state *ce_state;
+        struct ath10k_ce_pipe *ce_state;
         u32 ctrl_addr = ath10k_ce_base_address(ce_id);
+        int ret;
+
+        ret = ath10k_pci_wake(ar);
+        if (ret)
+                return NULL;
 
         ce_state = ath10k_ce_init_state(ar, ce_id, attr);
         if (!ce_state) {
@@ -1136,40 +1080,38 @@ struct ce_state *ath10k_ce_init(struct ath10k *ar,
         }
 
         if (attr->src_nentries) {
-                if (ath10k_ce_init_src_ring(ar, ce_id, ce_state, attr)) {
-                        ath10k_err("Failed to initialize CE src ring for ID: %d\n",
-                                   ce_id);
+                ret = ath10k_ce_init_src_ring(ar, ce_id, ce_state, attr);
+                if (ret) {
+                        ath10k_err("Failed to initialize CE src ring for ID: %d (%d)\n",
+                                   ce_id, ret);
                         ath10k_ce_deinit(ce_state);
                         return NULL;
                 }
         }
 
         if (attr->dest_nentries) {
-                if (ath10k_ce_init_dest_ring(ar, ce_id, ce_state, attr)) {
-                        ath10k_err("Failed to initialize CE dest ring for ID: %d\n",
-                                   ce_id);
+                ret = ath10k_ce_init_dest_ring(ar, ce_id, ce_state, attr);
+                if (ret) {
+                        ath10k_err("Failed to initialize CE dest ring for ID: %d (%d)\n",
+                                   ce_id, ret);
                         ath10k_ce_deinit(ce_state);
                         return NULL;
                 }
         }
 
         /* Enable CE error interrupts */
-        ath10k_pci_wake(ar);
         ath10k_ce_error_intr_enable(ar, ctrl_addr);
+
         ath10k_pci_sleep(ar);
 
         return ce_state;
 }
 
-void ath10k_ce_deinit(struct ce_state *ce_state)
+void ath10k_ce_deinit(struct ath10k_ce_pipe *ce_state)
 {
-        unsigned int ce_id = ce_state->id;
         struct ath10k *ar = ce_state->ar;
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
 
-        ce_state->state = CE_UNUSED;
-        ar_pci->ce_id_to_state[ce_id] = NULL;
-
         if (ce_state->src_ring) {
                 kfree(ce_state->src_ring->shadow_base_unaligned);
                 pci_free_consistent(ar_pci->pdev,
@@ -1190,5 +1132,7 @@ void ath10k_ce_deinit(struct ce_state *ce_state)
                                     ce_state->dest_ring->base_addr_ce_space);
                 kfree(ce_state->dest_ring);
         }
-        kfree(ce_state);
+
+        ce_state->src_ring = NULL;
+        ce_state->dest_ring = NULL;
 }
diff --git a/drivers/net/wireless/ath/ath10k/ce.h b/drivers/net/wireless/ath/ath10k/ce.h
index c17f07c026f4..aec802868341 100644
--- a/drivers/net/wireless/ath/ath10k/ce.h
+++ b/drivers/net/wireless/ath/ath10k/ce.h
@@ -27,7 +27,6 @@
 
 /* Descriptor rings must be aligned to this boundary */
 #define CE_DESC_RING_ALIGN      8
-#define CE_SENDLIST_ITEMS_MAX   12
 #define CE_SEND_FLAG_GATHER     0x00010000
 
 /*
@@ -36,16 +35,9 @@
  * how to use copy engines.
  */
 
-struct ce_state;
+struct ath10k_ce_pipe;
 
 
-/* Copy Engine operational state */
-enum ce_op_state {
-        CE_UNUSED,
-        CE_PAUSED,
-        CE_RUNNING,
-};
-
 #define CE_DESC_FLAGS_GATHER         (1 << 0)
 #define CE_DESC_FLAGS_BYTE_SWAP      (1 << 1)
 #define CE_DESC_FLAGS_META_DATA_MASK 0xFFFC
@@ -57,8 +49,7 @@ struct ce_desc {
         __le16 flags; /* %CE_DESC_FLAGS_ */
 };
 
-/* Copy Engine Ring internal state */
-struct ce_ring_state {
+struct ath10k_ce_ring {
         /* Number of entries in this ring; must be power of 2 */
         unsigned int nentries;
         unsigned int nentries_mask;
@@ -116,49 +107,20 @@ struct ce_ring_state {
         void **per_transfer_context;
 };
 
-/* Copy Engine internal state */
-struct ce_state {
+struct ath10k_ce_pipe {
         struct ath10k *ar;
         unsigned int id;
 
         unsigned int attr_flags;
 
         u32 ctrl_addr;
-        enum ce_op_state state;
-
-        void (*send_cb) (struct ce_state *ce_state,
-                         void *per_transfer_send_context,
-                         u32 buffer,
-                         unsigned int nbytes,
-                         unsigned int transfer_id);
-        void (*recv_cb) (struct ce_state *ce_state,
-                         void *per_transfer_recv_context,
-                         u32 buffer,
-                         unsigned int nbytes,
-                         unsigned int transfer_id,
-                         unsigned int flags);
 
-        unsigned int src_sz_max;
-        struct ce_ring_state *src_ring;
-        struct ce_ring_state *dest_ring;
-};
+        void (*send_cb)(struct ath10k_ce_pipe *);
+        void (*recv_cb)(struct ath10k_ce_pipe *);
 
-struct ce_sendlist_item {
-        /* e.g. buffer or desc list */
-        dma_addr_t data;
-        union {
-                /* simple buffer */
-                unsigned int nbytes;
-                /* Rx descriptor list */
-                unsigned int ndesc;
-        } u;
-        /* externally-specified flags; OR-ed with internal flags */
-        u32 flags;
-};
-
-struct ce_sendlist {
-        unsigned int num_items;
-        struct ce_sendlist_item item[CE_SENDLIST_ITEMS_MAX];
+        unsigned int src_sz_max;
+        struct ath10k_ce_ring *src_ring;
+        struct ath10k_ce_ring *dest_ring;
 };
 
 /* Copy Engine settable attributes */
@@ -182,7 +144,7 @@ struct ce_attr;
  *
  * Implementation note: pushes 1 buffer to Source ring
  */
-int ath10k_ce_send(struct ce_state *ce_state,
+int ath10k_ce_send(struct ath10k_ce_pipe *ce_state,
                    void *per_transfer_send_context,
                    u32 buffer,
                    unsigned int nbytes,
@@ -190,21 +152,10 @@ int ath10k_ce_send(struct ce_state *ce_state,
                    unsigned int transfer_id,
                    unsigned int flags);
 
-void ath10k_ce_send_cb_register(struct ce_state *ce_state,
-                                void (*send_cb) (struct ce_state *ce_state,
-                                                 void *transfer_context,
-                                                 u32 buffer,
-                                                 unsigned int nbytes,
-                                                 unsigned int transfer_id),
+void ath10k_ce_send_cb_register(struct ath10k_ce_pipe *ce_state,
+                                void (*send_cb)(struct ath10k_ce_pipe *),
                                 int disable_interrupts);
 
-/* Append a simple buffer (address/length) to a sendlist. */
-void ath10k_ce_sendlist_buf_add(struct ce_sendlist *sendlist,
-                                u32 buffer,
-                                unsigned int nbytes,
-                                /* OR-ed with internal flags */
-                                u32 flags);
-
 /*
  * Queue a "sendlist" of buffers to be sent using gather to a single
  * anonymous destination buffer
@@ -215,11 +166,11 @@ void ath10k_ce_sendlist_buf_add(struct ce_sendlist *sendlist,
  *
  * Implemenation note: Pushes multiple buffers with Gather to Source ring.
  */
-int ath10k_ce_sendlist_send(struct ce_state *ce_state,
-                            void *per_transfer_send_context,
-                            struct ce_sendlist *sendlist,
-                            /* 14 bits */
-                            unsigned int transfer_id);
+int ath10k_ce_sendlist_send(struct ath10k_ce_pipe *ce_state,
+                            void *per_transfer_context,
+                            unsigned int transfer_id,
+                            u32 paddr, unsigned int nbytes,
+                            u32 flags);
 
 /*==================Recv=======================*/
 
@@ -233,17 +184,12 @@ int ath10k_ce_sendlist_send(struct ce_state *ce_state,
  *
  * Implemenation note: Pushes a buffer to Dest ring.
  */
-int ath10k_ce_recv_buf_enqueue(struct ce_state *ce_state,
+int ath10k_ce_recv_buf_enqueue(struct ath10k_ce_pipe *ce_state,
                                void *per_transfer_recv_context,
                                u32 buffer);
 
-void ath10k_ce_recv_cb_register(struct ce_state *ce_state,
-                                void (*recv_cb) (struct ce_state *ce_state,
-                                                 void *transfer_context,
-                                                 u32 buffer,
-                                                 unsigned int nbytes,
-                                                 unsigned int transfer_id,
-                                                 unsigned int flags));
+void ath10k_ce_recv_cb_register(struct ath10k_ce_pipe *ce_state,
+                                void (*recv_cb)(struct ath10k_ce_pipe *));
 
 /* recv flags */
 /* Data is byte-swapped */
@@ -253,7 +199,7 @@ void ath10k_ce_recv_cb_register(struct ce_state *ce_state,
  * Supply data for the next completed unprocessed receive descriptor.
  * Pops buffer from Dest ring.
  */
-int ath10k_ce_completed_recv_next(struct ce_state *ce_state,
+int ath10k_ce_completed_recv_next(struct ath10k_ce_pipe *ce_state,
                                   void **per_transfer_contextp,
                                   u32 *bufferp,
                                   unsigned int *nbytesp,
@@ -263,7 +209,7 @@ int ath10k_ce_completed_recv_next(struct ce_state *ce_state,
  * Supply data for the next completed unprocessed send descriptor.
  * Pops 1 completed send buffer from Source ring.
  */
-int ath10k_ce_completed_send_next(struct ce_state *ce_state,
+int ath10k_ce_completed_send_next(struct ath10k_ce_pipe *ce_state,
                            void **per_transfer_contextp,
                            u32 *bufferp,
                            unsigned int *nbytesp,
@@ -272,7 +218,7 @@ int ath10k_ce_completed_send_next(struct ce_state *ce_state,
 /*==================CE Engine Initialization=======================*/
 
 /* Initialize an instance of a CE */
-struct ce_state *ath10k_ce_init(struct ath10k *ar,
+struct ath10k_ce_pipe *ath10k_ce_init(struct ath10k *ar,
                                 unsigned int ce_id,
                                 const struct ce_attr *attr);
 
@@ -282,7 +228,7 @@ struct ce_state *ath10k_ce_init(struct ath10k *ar,
  * receive buffers.  Target DMA must be stopped before using
  * this API.
  */
-int ath10k_ce_revoke_recv_next(struct ce_state *ce_state,
+int ath10k_ce_revoke_recv_next(struct ath10k_ce_pipe *ce_state,
                                void **per_transfer_contextp,
                                u32 *bufferp);
 
@@ -291,13 +237,13 @@ int ath10k_ce_revoke_recv_next(struct ce_state *ce_state,
  * pending sends.  Target DMA must be stopped before using
  * this API.
  */
-int ath10k_ce_cancel_send_next(struct ce_state *ce_state,
+int ath10k_ce_cancel_send_next(struct ath10k_ce_pipe *ce_state,
                                void **per_transfer_contextp,
                                u32 *bufferp,
                                unsigned int *nbytesp,
                                unsigned int *transfer_idp);
 
-void ath10k_ce_deinit(struct ce_state *ce_state);
+void ath10k_ce_deinit(struct ath10k_ce_pipe *ce_state);
 
 /*==================CE Interrupt Handlers====================*/
 void ath10k_ce_per_engine_service_any(struct ath10k *ar);
@@ -322,9 +268,6 @@ struct ce_attr {
         /* CE_ATTR_* values */
         unsigned int flags;
 
-        /* currently not in use */
-        unsigned int priority;
-
         /* #entries in source ring - Must be a power of 2 */
         unsigned int src_nentries;
 
@@ -336,21 +279,8 @@ struct ce_attr {
 
         /* #entries in destination ring - Must be a power of 2 */
         unsigned int dest_nentries;
-
-        /* Future use */
-        void *reserved;
 };
 
-/*
- * When using sendlist_send to transfer multiple buffer fragments, the
- * transfer context of each fragment, except last one, will be filled
- * with CE_SENDLIST_ITEM_CTXT. ce_completed_send will return success for
- * each fragment done with send and the transfer context would be
- * CE_SENDLIST_ITEM_CTXT. Upper layer could use this to identify the
- * status of a send completion.
- */
-#define CE_SENDLIST_ITEM_CTXT   ((void *)0xcecebeef)
-
 #define SR_BA_ADDRESS           0x0000
 #define SR_SIZE_ADDRESS         0x0004
 #define DR_BA_ADDRESS           0x0008
diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
index 7226c23b9569..76906d5a082e 100644
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -39,17 +39,6 @@ MODULE_PARM_DESC(p2p, "Enable ath10k P2P support");
 
 static const struct ath10k_hw_params ath10k_hw_params_list[] = {
         {
-                .id = QCA988X_HW_1_0_VERSION,
-                .name = "qca988x hw1.0",
-                .patch_load_addr = QCA988X_HW_1_0_PATCH_LOAD_ADDR,
-                .fw = {
-                        .dir = QCA988X_HW_1_0_FW_DIR,
-                        .fw = QCA988X_HW_1_0_FW_FILE,
-                        .otp = QCA988X_HW_1_0_OTP_FILE,
-                        .board = QCA988X_HW_1_0_BOARD_DATA_FILE,
-                },
-        },
-        {
                 .id = QCA988X_HW_2_0_VERSION,
                 .name = "qca988x hw2.0",
                 .patch_load_addr = QCA988X_HW_2_0_PATCH_LOAD_ADDR,
@@ -64,7 +53,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
 
 static void ath10k_send_suspend_complete(struct ath10k *ar)
 {
-        ath10k_dbg(ATH10K_DBG_CORE, "%s\n", __func__);
+        ath10k_dbg(ATH10K_DBG_BOOT, "boot suspend complete\n");
 
         ar->is_target_paused = true;
         wake_up(&ar->event_queue);
@@ -112,7 +101,7 @@ static int ath10k_init_connect_htc(struct ath10k *ar)
                 goto timeout;
         }
 
-        ath10k_dbg(ATH10K_DBG_CORE, "core wmi ready\n");
+        ath10k_dbg(ATH10K_DBG_BOOT, "boot wmi ready\n");
         return 0;
 
 timeout:
@@ -214,8 +203,8 @@ static int ath10k_push_board_ext_data(struct ath10k *ar,
                 return ret;
         }
 
-        ath10k_dbg(ATH10K_DBG_CORE,
-                   "ath10k: Board extended Data download addr: 0x%x\n",
+        ath10k_dbg(ATH10K_DBG_BOOT,
+                   "boot push board extended data addr 0x%x\n",
                    board_ext_data_addr);
 
         if (board_ext_data_addr == 0)
@@ -446,6 +435,13 @@ static int ath10k_init_uart(struct ath10k *ar)
                 return ret;
         }
 
+        /* Set the UART baud rate to 19200. */
+        ret = ath10k_bmi_write32(ar, hi_desired_baud_rate, 19200);
+        if (ret) {
+                ath10k_warn("could not set the baud rate (%d)\n", ret);
+                return ret;
+        }
+
         ath10k_info("UART prints enabled\n");
         return 0;
 }
@@ -641,6 +637,10 @@ int ath10k_core_start(struct ath10k *ar)
         if (status)
                 goto err_disconnect_htc;
 
+        status = ath10k_debug_start(ar);
+        if (status)
+                goto err_disconnect_htc;
+
         ar->free_vdev_map = (1 << TARGET_NUM_VDEVS) - 1;
 
         return 0;
@@ -658,6 +658,7 @@ EXPORT_SYMBOL(ath10k_core_start);
 
 void ath10k_core_stop(struct ath10k *ar)
 {
+        ath10k_debug_stop(ar);
         ath10k_htc_stop(&ar->htc);
         ath10k_htt_detach(&ar->htt);
         ath10k_wmi_detach(ar);
@@ -717,10 +718,46 @@ static int ath10k_core_probe_fw(struct ath10k *ar)
         return 0;
 }
 
-int ath10k_core_register(struct ath10k *ar)
+static int ath10k_core_check_chip_id(struct ath10k *ar)
+{
+        u32 hw_revision = MS(ar->chip_id, SOC_CHIP_ID_REV);
+
+        ath10k_dbg(ATH10K_DBG_BOOT, "boot chip_id 0x%08x hw_revision 0x%x\n",
+                   ar->chip_id, hw_revision);
+
+        /* Check that we are not using hw1.0 (some of them have same pci id
+         * as hw2.0) before doing anything else as ath10k crashes horribly
+         * due to missing hw1.0 workarounds. */
+        switch (hw_revision) {
+        case QCA988X_HW_1_0_CHIP_ID_REV:
+                ath10k_err("ERROR: qca988x hw1.0 is not supported\n");
+                return -EOPNOTSUPP;
+
+        case QCA988X_HW_2_0_CHIP_ID_REV:
+                /* known hardware revision, continue normally */
+                return 0;
+
+        default:
+                ath10k_warn("Warning: hardware revision unknown (0x%x), expect problems\n",
+                            ar->chip_id);
+                return 0;
+        }
+
+        return 0;
+}
+
+int ath10k_core_register(struct ath10k *ar, u32 chip_id)
 {
         int status;
 
+        ar->chip_id = chip_id;
+
+        status = ath10k_core_check_chip_id(ar);
+        if (status) {
+                ath10k_err("Unsupported chip id 0x%08x\n", ar->chip_id);
+                return status;
+        }
+
         status = ath10k_core_probe_fw(ar);
         if (status) {
                 ath10k_err("could not probe fw (%d)\n", status);
@@ -755,6 +792,7 @@ void ath10k_core_unregister(struct ath10k *ar)
          * Otherwise we will fail to submit commands to FW and mac80211 will be
          * unhappy about callback failures. */
         ath10k_mac_unregister(ar);
+
         ath10k_core_free_firmware_files(ar);
 }
 EXPORT_SYMBOL(ath10k_core_unregister);
diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h
index e4bba563ed42..292ad4577c98 100644
--- a/drivers/net/wireless/ath/ath10k/core.h
+++ b/drivers/net/wireless/ath/ath10k/core.h
@@ -52,18 +52,12 @@ struct ath10k_skb_cb {
 
         struct {
                 u8 vdev_id;
-                u16 msdu_id;
                 u8 tid;
                 bool is_offchan;
-                bool is_conf;
-                bool discard;
-                bool no_ack;
-                u8 refcount;
-                struct sk_buff *txfrag;
-                struct sk_buff *msdu;
-        } __packed htt;
 
-        /* 4 bytes left on 64bit arch */
+                u8 frag_len;
+                u8 pad_len;
+        } __packed htt;
 } __packed;
 
 static inline struct ath10k_skb_cb *ATH10K_SKB_CB(struct sk_buff *skb)
@@ -112,11 +106,7 @@ struct ath10k_wmi {
         enum ath10k_htc_ep_id eid;
         struct completion service_ready;
         struct completion unified_ready;
-        atomic_t pending_tx_count;
-        wait_queue_head_t wq;
-
-        struct sk_buff_head wmi_event_list;
-        struct work_struct wmi_event_work;
+        wait_queue_head_t tx_credits_wq;
 };
 
 struct ath10k_peer_stat {
@@ -203,6 +193,7 @@ struct ath10k_vif {
         enum wmi_vdev_subtype vdev_subtype;
         u32 beacon_interval;
         u32 dtim_period;
+        struct sk_buff *beacon;
 
         struct ath10k *ar;
         struct ieee80211_vif *vif;
@@ -246,6 +237,9 @@ struct ath10k_debug {
         u32 wmi_service_bitmap[WMI_SERVICE_BM_SIZE];
 
         struct completion event_stats_compl;
+
+        unsigned long htt_stats_mask;
+        struct delayed_work htt_stats_dwork;
 };
 
 enum ath10k_state {
@@ -270,12 +264,21 @@ enum ath10k_state {
         ATH10K_STATE_WEDGED,
 };
 
+enum ath10k_fw_features {
+        /* wmi_mgmt_rx_hdr contains extra RSSI information */
+        ATH10K_FW_FEATURE_EXT_WMI_MGMT_RX = 0,
+
+        /* keep last */
+        ATH10K_FW_FEATURE_COUNT,
+};
+
 struct ath10k {
         struct ath_common ath_common;
         struct ieee80211_hw *hw;
         struct device *dev;
         u8 mac_addr[ETH_ALEN];
 
+        u32 chip_id;
         u32 target_version;
         u8 fw_version_major;
         u32 fw_version_minor;
@@ -288,6 +291,8 @@ struct ath10k {
         u32 vht_cap_info;
         u32 num_rf_chains;
 
+        DECLARE_BITMAP(fw_features, ATH10K_FW_FEATURE_COUNT);
+
         struct targetdef *targetdef;
         struct hostdef *hostdef;
 
@@ -393,7 +398,7 @@ void ath10k_core_destroy(struct ath10k *ar);
 
 int ath10k_core_start(struct ath10k *ar);
 void ath10k_core_stop(struct ath10k *ar);
-int ath10k_core_register(struct ath10k *ar);
+int ath10k_core_register(struct ath10k *ar, u32 chip_id);
 void ath10k_core_unregister(struct ath10k *ar);
 
 #endif /* _CORE_H_ */
diff --git a/drivers/net/wireless/ath/ath10k/debug.c b/drivers/net/wireless/ath/ath10k/debug.c
index 3d65594fa098..59615c7f217e 100644
--- a/drivers/net/wireless/ath/ath10k/debug.c
+++ b/drivers/net/wireless/ath/ath10k/debug.c
@@ -21,6 +21,9 @@
 #include "core.h"
 #include "debug.h"
 
+/* ms */
+#define ATH10K_DEBUG_HTT_STATS_INTERVAL 1000
+
 static int ath10k_printk(const char *level, const char *fmt, ...)
 {
         struct va_format vaf;
@@ -260,7 +263,6 @@ void ath10k_debug_read_target_stats(struct ath10k *ar,
         }
 
         spin_unlock_bh(&ar->data_lock);
-        mutex_unlock(&ar->conf_mutex);
         complete(&ar->debug.event_stats_compl);
 }
 
@@ -499,6 +501,136 @@ static const struct file_operations fops_simulate_fw_crash = {
         .llseek = default_llseek,
 };
 
+static ssize_t ath10k_read_chip_id(struct file *file, char __user *user_buf,
+                                   size_t count, loff_t *ppos)
+{
+        struct ath10k *ar = file->private_data;
+        unsigned int len;
+        char buf[50];
+
+        len = scnprintf(buf, sizeof(buf), "0x%08x\n", ar->chip_id);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static const struct file_operations fops_chip_id = {
+        .read = ath10k_read_chip_id,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+static int ath10k_debug_htt_stats_req(struct ath10k *ar)
+{
+        u64 cookie;
+        int ret;
+
+        lockdep_assert_held(&ar->conf_mutex);
+
+        if (ar->debug.htt_stats_mask == 0)
+                /* htt stats are disabled */
+                return 0;
+
+        if (ar->state != ATH10K_STATE_ON)
+                return 0;
+
+        cookie = get_jiffies_64();
+
+        ret = ath10k_htt_h2t_stats_req(&ar->htt, ar->debug.htt_stats_mask,
+                                       cookie);
+        if (ret) {
+                ath10k_warn("failed to send htt stats request: %d\n", ret);
+                return ret;
+        }
+
+        queue_delayed_work(ar->workqueue, &ar->debug.htt_stats_dwork,
+                           msecs_to_jiffies(ATH10K_DEBUG_HTT_STATS_INTERVAL));
+
+        return 0;
+}
+
+static void ath10k_debug_htt_stats_dwork(struct work_struct *work)
+{
+        struct ath10k *ar = container_of(work, struct ath10k,
+                                         debug.htt_stats_dwork.work);
+
+        mutex_lock(&ar->conf_mutex);
+
+        ath10k_debug_htt_stats_req(ar);
+
+        mutex_unlock(&ar->conf_mutex);
+}
+
+static ssize_t ath10k_read_htt_stats_mask(struct file *file,
+                                            char __user *user_buf,
+                                            size_t count, loff_t *ppos)
+{
+        struct ath10k *ar = file->private_data;
+        char buf[32];
+        unsigned int len;
+
+        len = scnprintf(buf, sizeof(buf), "%lu\n", ar->debug.htt_stats_mask);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t ath10k_write_htt_stats_mask(struct file *file,
+                                             const char __user *user_buf,
+                                             size_t count, loff_t *ppos)
+{
+        struct ath10k *ar = file->private_data;
+        unsigned long mask;
+        int ret;
+
+        ret = kstrtoul_from_user(user_buf, count, 0, &mask);
+        if (ret)
+                return ret;
+
+        /* max 8 bit masks (for now) */
+        if (mask > 0xff)
+                return -E2BIG;
+
+        mutex_lock(&ar->conf_mutex);
+
+        ar->debug.htt_stats_mask = mask;
+
+        ret = ath10k_debug_htt_stats_req(ar);
+        if (ret)
+                goto out;
+
+        ret = count;
+
+out:
+        mutex_unlock(&ar->conf_mutex);
+
+        return ret;
+}
+
+static const struct file_operations fops_htt_stats_mask = {
+        .read = ath10k_read_htt_stats_mask,
+        .write = ath10k_write_htt_stats_mask,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+int ath10k_debug_start(struct ath10k *ar)
+{
+        int ret;
+
+        ret = ath10k_debug_htt_stats_req(ar);
+        if (ret)
+                /* continue normally anyway, this isn't serious */
+                ath10k_warn("failed to start htt stats workqueue: %d\n", ret);
+
+        return 0;
+}
+
+void ath10k_debug_stop(struct ath10k *ar)
+{
+        cancel_delayed_work_sync(&ar->debug.htt_stats_dwork);
+}
+
 int ath10k_debug_create(struct ath10k *ar)
 {
         ar->debug.debugfs_phy = debugfs_create_dir("ath10k",
@@ -507,6 +639,9 @@ int ath10k_debug_create(struct ath10k *ar)
         if (!ar->debug.debugfs_phy)
                 return -ENOMEM;
 
+        INIT_DELAYED_WORK(&ar->debug.htt_stats_dwork,
+                          ath10k_debug_htt_stats_dwork);
+
         init_completion(&ar->debug.event_stats_compl);
 
         debugfs_create_file("fw_stats", S_IRUSR, ar->debug.debugfs_phy, ar,
@@ -518,8 +653,15 @@ int ath10k_debug_create(struct ath10k *ar)
         debugfs_create_file("simulate_fw_crash", S_IRUSR, ar->debug.debugfs_phy,
                             ar, &fops_simulate_fw_crash);
 
+        debugfs_create_file("chip_id", S_IRUSR, ar->debug.debugfs_phy,
+                            ar, &fops_chip_id);
+
+        debugfs_create_file("htt_stats_mask", S_IRUSR, ar->debug.debugfs_phy,
+                            ar, &fops_htt_stats_mask);
+
         return 0;
 }
+
 #endif /* CONFIG_ATH10K_DEBUGFS */
 
 #ifdef CONFIG_ATH10K_DEBUG
diff --git a/drivers/net/wireless/ath/ath10k/debug.h b/drivers/net/wireless/ath/ath10k/debug.h
index 168140c54028..fa581486626f 100644
--- a/drivers/net/wireless/ath/ath10k/debug.h
+++ b/drivers/net/wireless/ath/ath10k/debug.h
@@ -27,11 +27,12 @@ enum ath10k_debug_mask {
         ATH10K_DBG_HTC          = 0x00000004,
         ATH10K_DBG_HTT          = 0x00000008,
         ATH10K_DBG_MAC          = 0x00000010,
-        ATH10K_DBG_CORE         = 0x00000020,
+        ATH10K_DBG_BOOT         = 0x00000020,
         ATH10K_DBG_PCI_DUMP     = 0x00000040,
         ATH10K_DBG_HTT_DUMP     = 0x00000080,
         ATH10K_DBG_MGMT         = 0x00000100,
         ATH10K_DBG_DATA         = 0x00000200,
+        ATH10K_DBG_BMI          = 0x00000400,
         ATH10K_DBG_ANY          = 0xffffffff,
 };
 
@@ -42,6 +43,8 @@ extern __printf(1, 2) int ath10k_err(const char *fmt, ...);
 extern __printf(1, 2) int ath10k_warn(const char *fmt, ...);
 
 #ifdef CONFIG_ATH10K_DEBUGFS
+int ath10k_debug_start(struct ath10k *ar);
+void ath10k_debug_stop(struct ath10k *ar);
 int ath10k_debug_create(struct ath10k *ar);
 void ath10k_debug_read_service_map(struct ath10k *ar,
                                    void *service_map,
@@ -50,6 +53,15 @@ void ath10k_debug_read_target_stats(struct ath10k *ar,
                                     struct wmi_stats_event *ev);
 
 #else
+static inline int ath10k_debug_start(struct ath10k *ar)
+{
+        return 0;
+}
+
+static inline void ath10k_debug_stop(struct ath10k *ar)
+{
+}
+
 static inline int ath10k_debug_create(struct ath10k *ar)
 {
         return 0;
diff --git a/drivers/net/wireless/ath/ath10k/htc.c b/drivers/net/wireless/ath/ath10k/htc.c
index ef3329ef52f3..3118d7506734 100644
--- a/drivers/net/wireless/ath/ath10k/htc.c
+++ b/drivers/net/wireless/ath/ath10k/htc.c
@@ -103,10 +103,10 @@ static void ath10k_htc_prepare_tx_skb(struct ath10k_htc_ep *ep,
         struct ath10k_htc_hdr *hdr;
 
         hdr = (struct ath10k_htc_hdr *)skb->data;
-        memset(hdr, 0, sizeof(*hdr));
 
         hdr->eid = ep->eid;
         hdr->len = __cpu_to_le16(skb->len - sizeof(*hdr));
+        hdr->flags = 0;
 
         spin_lock_bh(&ep->htc->tx_lock);
         hdr->seq_no = ep->seq_no++;
@@ -117,134 +117,13 @@ static void ath10k_htc_prepare_tx_skb(struct ath10k_htc_ep *ep,
         spin_unlock_bh(&ep->htc->tx_lock);
 }
 
-static int ath10k_htc_issue_skb(struct ath10k_htc *htc,
-                                struct ath10k_htc_ep *ep,
-                                struct sk_buff *skb,
-                                u8 credits)
-{
-        struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(skb);
-        int ret;
-
-        ath10k_dbg(ATH10K_DBG_HTC, "%s: ep %d skb %p\n", __func__,
-                   ep->eid, skb);
-
-        ath10k_htc_prepare_tx_skb(ep, skb);
-
-        ret = ath10k_skb_map(htc->ar->dev, skb);
-        if (ret)
-                goto err;
-
-        ret = ath10k_hif_send_head(htc->ar,
-                                   ep->ul_pipe_id,
-                                   ep->eid,
-                                   skb->len,
-                                   skb);
-        if (unlikely(ret))
-                goto err;
-
-        return 0;
-err:
-        ath10k_warn("HTC issue failed: %d\n", ret);
-
-        spin_lock_bh(&htc->tx_lock);
-        ep->tx_credits += credits;
-        spin_unlock_bh(&htc->tx_lock);
-
-        /* this is the simplest way to handle out-of-resources for non-credit
-         * based endpoints. credit based endpoints can still get -ENOSR, but
-         * this is highly unlikely as credit reservation should prevent that */
-        if (ret == -ENOSR) {
-                spin_lock_bh(&htc->tx_lock);
-                __skb_queue_head(&ep->tx_queue, skb);
-                spin_unlock_bh(&htc->tx_lock);
-
-                return ret;
-        }
-
-        skb_cb->is_aborted = true;
-        ath10k_htc_notify_tx_completion(ep, skb);
-
-        return ret;
-}
-
-static struct sk_buff *ath10k_htc_get_skb_credit_based(struct ath10k_htc *htc,
-                                                       struct ath10k_htc_ep *ep,
-                                                       u8 *credits)
-{
-        struct sk_buff *skb;
-        struct ath10k_skb_cb *skb_cb;
-        int credits_required;
-        int remainder;
-        unsigned int transfer_len;
-
-        lockdep_assert_held(&htc->tx_lock);
-
-        skb = __skb_dequeue(&ep->tx_queue);
-        if (!skb)
-                return NULL;
-
-        skb_cb = ATH10K_SKB_CB(skb);
-        transfer_len = skb->len;
-
-        if (likely(transfer_len <= htc->target_credit_size)) {
-                credits_required = 1;
-        } else {
-                /* figure out how many credits this message requires */
-                credits_required = transfer_len / htc->target_credit_size;
-                remainder = transfer_len % htc->target_credit_size;
-
-                if (remainder)
-                        credits_required++;
-        }
-
-        ath10k_dbg(ATH10K_DBG_HTC, "Credits required %d got %d\n",
-                   credits_required, ep->tx_credits);
-
-        if (ep->tx_credits < credits_required) {
-                __skb_queue_head(&ep->tx_queue, skb);
-                return NULL;
-        }
-
-        ep->tx_credits -= credits_required;
-        *credits = credits_required;
-        return skb;
-}
-
-static void ath10k_htc_send_work(struct work_struct *work)
-{
-        struct ath10k_htc_ep *ep = container_of(work,
-                                        struct ath10k_htc_ep, send_work);
-        struct ath10k_htc *htc = ep->htc;
-        struct sk_buff *skb;
-        u8 credits = 0;
-        int ret;
-
-        while (true) {
-                if (ep->ul_is_polled)
-                        ath10k_htc_send_complete_check(ep, 0);
-
-                spin_lock_bh(&htc->tx_lock);
-                if (ep->tx_credit_flow_enabled)
-                        skb = ath10k_htc_get_skb_credit_based(htc, ep,
-                                                              &credits);
-                else
-                        skb = __skb_dequeue(&ep->tx_queue);
-                spin_unlock_bh(&htc->tx_lock);
-
-                if (!skb)
-                        break;
-
-                ret = ath10k_htc_issue_skb(htc, ep, skb, credits);
-                if (ret == -ENOSR)
-                        break;
-        }
-}
-
 int ath10k_htc_send(struct ath10k_htc *htc,
                     enum ath10k_htc_ep_id eid,
                     struct sk_buff *skb)
 {
         struct ath10k_htc_ep *ep = &htc->endpoint[eid];
+        int credits = 0;
+        int ret;
 
         if (htc->ar->state == ATH10K_STATE_WEDGED)
                 return -ECOMM;
@@ -254,18 +133,55 @@ int ath10k_htc_send(struct ath10k_htc *htc,
                 return -ENOENT;
         }
 
+        /* FIXME: This looks ugly, can we fix it? */
         spin_lock_bh(&htc->tx_lock);
         if (htc->stopped) {
                 spin_unlock_bh(&htc->tx_lock);
                 return -ESHUTDOWN;
         }
+        spin_unlock_bh(&htc->tx_lock);
 
-        __skb_queue_tail(&ep->tx_queue, skb);
         skb_push(skb, sizeof(struct ath10k_htc_hdr));
-        spin_unlock_bh(&htc->tx_lock);
 
-        queue_work(htc->ar->workqueue, &ep->send_work);
+        if (ep->tx_credit_flow_enabled) {
+                credits = DIV_ROUND_UP(skb->len, htc->target_credit_size);
+                spin_lock_bh(&htc->tx_lock);
+                if (ep->tx_credits < credits) {
+                        spin_unlock_bh(&htc->tx_lock);
+                        ret = -EAGAIN;
+                        goto err_pull;
+                }
+                ep->tx_credits -= credits;
+                spin_unlock_bh(&htc->tx_lock);
+        }
+
+        ath10k_htc_prepare_tx_skb(ep, skb);
+
+        ret = ath10k_skb_map(htc->ar->dev, skb);
+        if (ret)
+                goto err_credits;
+
+        ret = ath10k_hif_send_head(htc->ar, ep->ul_pipe_id, ep->eid,
+                                   skb->len, skb);
+        if (ret)
+                goto err_unmap;
+
         return 0;
+
+err_unmap:
+        ath10k_skb_unmap(htc->ar->dev, skb);
+err_credits:
+        if (ep->tx_credit_flow_enabled) {
+                spin_lock_bh(&htc->tx_lock);
+                ep->tx_credits += credits;
+                spin_unlock_bh(&htc->tx_lock);
+
+                if (ep->ep_ops.ep_tx_credits)
+                        ep->ep_ops.ep_tx_credits(htc->ar);
+        }
+err_pull:
+        skb_pull(skb, sizeof(struct ath10k_htc_hdr));
+        return ret;
 }
 
 static int ath10k_htc_tx_completion_handler(struct ath10k *ar,
@@ -278,39 +194,9 @@ static int ath10k_htc_tx_completion_handler(struct ath10k *ar,
         ath10k_htc_notify_tx_completion(ep, skb);
         /* the skb now belongs to the completion handler */
 
-        /* note: when using TX credit flow, the re-checking of queues happens
-         * when credits flow back from the target.  in the non-TX credit case,
-         * we recheck after the packet completes */
-        spin_lock_bh(&htc->tx_lock);
-        if (!ep->tx_credit_flow_enabled && !htc->stopped)
-                queue_work(ar->workqueue, &ep->send_work);
-        spin_unlock_bh(&htc->tx_lock);
-
         return 0;
 }
 
-/* flush endpoint TX queue */
-static void ath10k_htc_flush_endpoint_tx(struct ath10k_htc *htc,
-                                         struct ath10k_htc_ep *ep)
-{
-        struct sk_buff *skb;
-        struct ath10k_skb_cb *skb_cb;
-
-        spin_lock_bh(&htc->tx_lock);
-        for (;;) {
-                skb = __skb_dequeue(&ep->tx_queue);
-                if (!skb)
-                        break;
-
-                skb_cb = ATH10K_SKB_CB(skb);
-                skb_cb->is_aborted = true;
-                ath10k_htc_notify_tx_completion(ep, skb);
-        }
-        spin_unlock_bh(&htc->tx_lock);
-
-        cancel_work_sync(&ep->send_work);
-}
-
 /***********/
 /* Receive */
 /***********/
@@ -340,8 +226,11 @@ ath10k_htc_process_credit_report(struct ath10k_htc *htc,
                 ep = &htc->endpoint[report->eid];
                 ep->tx_credits += report->credits;
 
-                if (ep->tx_credits && !skb_queue_empty(&ep->tx_queue))
-                        queue_work(htc->ar->workqueue, &ep->send_work);
+                if (ep->ep_ops.ep_tx_credits) {
+                        spin_unlock_bh(&htc->tx_lock);
+                        ep->ep_ops.ep_tx_credits(htc->ar);
+                        spin_lock_bh(&htc->tx_lock);
+                }
         }
         spin_unlock_bh(&htc->tx_lock);
 }
@@ -599,10 +488,8 @@ static void ath10k_htc_reset_endpoint_states(struct ath10k_htc *htc)
                 ep->max_ep_message_len = 0;
                 ep->max_tx_queue_depth = 0;
                 ep->eid = i;
-                skb_queue_head_init(&ep->tx_queue);
                 ep->htc = htc;
                 ep->tx_credit_flow_enabled = true;
-                INIT_WORK(&ep->send_work, ath10k_htc_send_work);
         }
 }
 
@@ -752,8 +639,8 @@ int ath10k_htc_connect_service(struct ath10k_htc *htc,
         tx_alloc = ath10k_htc_get_credit_allocation(htc,
                                                     conn_req->service_id);
         if (!tx_alloc)
-                ath10k_dbg(ATH10K_DBG_HTC,
-                           "HTC Service %s does not allocate target credits\n",
+                ath10k_dbg(ATH10K_DBG_BOOT,
+                           "boot htc service %s does not allocate target credits\n",
                            htc_service_name(conn_req->service_id));
 
         skb = ath10k_htc_build_tx_ctrl_skb(htc->ar);
@@ -772,16 +659,16 @@ int ath10k_htc_connect_service(struct ath10k_htc *htc,
 
         flags |= SM(tx_alloc, ATH10K_HTC_CONN_FLAGS_RECV_ALLOC);
 
-        req_msg = &msg->connect_service;
-        req_msg->flags = __cpu_to_le16(flags);
-        req_msg->service_id = __cpu_to_le16(conn_req->service_id);
-
         /* Only enable credit flow control for WMI ctrl service */
         if (conn_req->service_id != ATH10K_HTC_SVC_ID_WMI_CONTROL) {
                 flags |= ATH10K_HTC_CONN_FLAGS_DISABLE_CREDIT_FLOW_CTRL;
                 disable_credit_flow_ctrl = true;
         }
 
+        req_msg = &msg->connect_service;
+        req_msg->flags = __cpu_to_le16(flags);
+        req_msg->service_id = __cpu_to_le16(conn_req->service_id);
+
         INIT_COMPLETION(htc->ctl_resp);
 
         status = ath10k_htc_send(htc, ATH10K_HTC_EP_0, skb);
@@ -873,19 +760,19 @@ setup:
         if (status)
                 return status;
 
-        ath10k_dbg(ATH10K_DBG_HTC,
-                   "HTC service: %s UL pipe: %d DL pipe: %d eid: %d ready\n",
+        ath10k_dbg(ATH10K_DBG_BOOT,
+                   "boot htc service '%s' ul pipe %d dl pipe %d eid %d ready\n",
                    htc_service_name(ep->service_id), ep->ul_pipe_id,
                    ep->dl_pipe_id, ep->eid);
 
-        ath10k_dbg(ATH10K_DBG_HTC,
-                   "EP %d UL polled: %d, DL polled: %d\n",
+        ath10k_dbg(ATH10K_DBG_BOOT,
+                   "boot htc ep %d ul polled %d dl polled %d\n",
                    ep->eid, ep->ul_is_polled, ep->dl_is_polled);
 
         if (disable_credit_flow_ctrl && ep->tx_credit_flow_enabled) {
                 ep->tx_credit_flow_enabled = false;
-                ath10k_dbg(ATH10K_DBG_HTC,
-                           "HTC service: %s eid: %d TX flow control disabled\n",
+                ath10k_dbg(ATH10K_DBG_BOOT,
+                           "boot htc service '%s' eid %d TX flow control disabled\n",
                            htc_service_name(ep->service_id), assigned_eid);
         }
 
@@ -945,18 +832,10 @@ int ath10k_htc_start(struct ath10k_htc *htc)
  */
 void ath10k_htc_stop(struct ath10k_htc *htc)
 {
-        int i;
-        struct ath10k_htc_ep *ep;
-
         spin_lock_bh(&htc->tx_lock);
         htc->stopped = true;
         spin_unlock_bh(&htc->tx_lock);
 
-        for (i = ATH10K_HTC_EP_0; i < ATH10K_HTC_EP_COUNT; i++) {
-                ep = &htc->endpoint[i];
-                ath10k_htc_flush_endpoint_tx(htc, ep);
-        }
-
         ath10k_hif_stop(htc->ar);
 }
 
diff --git a/drivers/net/wireless/ath/ath10k/htc.h b/drivers/net/wireless/ath/ath10k/htc.h
index e1dd8c761853..4716d331e6b6 100644
--- a/drivers/net/wireless/ath/ath10k/htc.h
+++ b/drivers/net/wireless/ath/ath10k/htc.h
@@ -276,6 +276,7 @@ struct ath10k_htc_ops {
 struct ath10k_htc_ep_ops {
         void (*ep_tx_complete)(struct ath10k *, struct sk_buff *);
         void (*ep_rx_complete)(struct ath10k *, struct sk_buff *);
+        void (*ep_tx_credits)(struct ath10k *);
 };
 
 /* service connection information */
@@ -315,15 +316,11 @@ struct ath10k_htc_ep {
         int ul_is_polled; /* call HIF to get tx completions */
         int dl_is_polled; /* call HIF to fetch rx (not implemented) */
 
-        struct sk_buff_head tx_queue;
-
         u8 seq_no; /* for debugging */
         int tx_credits;
         int tx_credit_size;
         int tx_credits_per_max_message;
         bool tx_credit_flow_enabled;
-
-        struct work_struct send_work;
 };
 
 struct ath10k_htc_svc_tx_credits {
diff --git a/drivers/net/wireless/ath/ath10k/htt.c b/drivers/net/wireless/ath/ath10k/htt.c
index 39342c5cfcb2..5f7eeebc5432 100644
--- a/drivers/net/wireless/ath/ath10k/htt.c
+++ b/drivers/net/wireless/ath/ath10k/htt.c
@@ -104,21 +104,16 @@ err_htc_attach:
 
 static int ath10k_htt_verify_version(struct ath10k_htt *htt)
 {
-        ath10k_dbg(ATH10K_DBG_HTT,
-                   "htt target version %d.%d; host version %d.%d\n",
-                    htt->target_version_major,
-                    htt->target_version_minor,
-                    HTT_CURRENT_VERSION_MAJOR,
-                    HTT_CURRENT_VERSION_MINOR);
-
-        if (htt->target_version_major != HTT_CURRENT_VERSION_MAJOR) {
-                ath10k_err("htt major versions are incompatible!\n");
+        ath10k_info("htt target version %d.%d\n",
+                    htt->target_version_major, htt->target_version_minor);
+
+        if (htt->target_version_major != 2 &&
+            htt->target_version_major != 3) {
+                ath10k_err("unsupported htt major version %d. supported versions are 2 and 3\n",
+                           htt->target_version_major);
                 return -ENOTSUPP;
         }
 
-        if (htt->target_version_minor != HTT_CURRENT_VERSION_MINOR)
-                ath10k_warn("htt minor version differ but still compatible\n");
-
         return 0;
 }
 
diff --git a/drivers/net/wireless/ath/ath10k/htt.h b/drivers/net/wireless/ath/ath10k/htt.h
index 318be4629cde..1a337e93b7e9 100644
--- a/drivers/net/wireless/ath/ath10k/htt.h
+++ b/drivers/net/wireless/ath/ath10k/htt.h
@@ -19,13 +19,11 @@
 #define _HTT_H_
 
 #include <linux/bug.h>
+#include <linux/interrupt.h>
 
 #include "htc.h"
 #include "rx_desc.h"
 
-#define HTT_CURRENT_VERSION_MAJOR       2
-#define HTT_CURRENT_VERSION_MINOR       1
-
 enum htt_dbg_stats_type {
         HTT_DBG_STATS_WAL_PDEV_TXRX = 1 << 0,
         HTT_DBG_STATS_RX_REORDER    = 1 << 1,
@@ -45,6 +43,9 @@ enum htt_h2t_msg_type { /* host-to-target */
         HTT_H2T_MSG_TYPE_SYNC               = 4,
         HTT_H2T_MSG_TYPE_AGGR_CFG           = 5,
         HTT_H2T_MSG_TYPE_FRAG_DESC_BANK_CFG = 6,
+
+        /* This command is used for sending management frames in HTT < 3.0.
+         * HTT >= 3.0 uses TX_FRM for everything. */
         HTT_H2T_MSG_TYPE_MGMT_TX            = 7,
 
         HTT_H2T_NUM_MSGS /* keep this last */
@@ -1268,6 +1269,7 @@ struct ath10k_htt {
         /* set if host-fw communication goes haywire
          * used to avoid further failures */
         bool rx_confused;
+        struct tasklet_struct rx_replenish_task;
 };
 
 #define RX_HTT_HDR_STATUS_LEN 64
@@ -1308,6 +1310,10 @@ struct htt_rx_desc {
 #define HTT_RX_BUF_SIZE 1920
 #define HTT_RX_MSDU_SIZE (HTT_RX_BUF_SIZE - (int)sizeof(struct htt_rx_desc))
 
+/* Refill a bunch of RX buffers for each refill round so that FW/HW can handle
+ * aggregated traffic more nicely. */
+#define ATH10K_HTT_MAX_NUM_REFILL 16
+
 /*
  * DMA_MAP expects the buffer to be an integral number of cache lines.
  * Rather than checking the actual cache line size, this code makes a
@@ -1327,6 +1333,7 @@ void ath10k_htt_rx_detach(struct ath10k_htt *htt);
 void ath10k_htt_htc_tx_complete(struct ath10k *ar, struct sk_buff *skb);
 void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb);
 int ath10k_htt_h2t_ver_req_msg(struct ath10k_htt *htt);
+int ath10k_htt_h2t_stats_req(struct ath10k_htt *htt, u8 mask, u64 cookie);
 int ath10k_htt_send_rx_ring_cfg_ll(struct ath10k_htt *htt);
 
 void __ath10k_htt_tx_dec_pending(struct ath10k_htt *htt);
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index e784c40b904b..90d4f74c28d7 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -20,6 +20,7 @@
 #include "htt.h"
 #include "txrx.h"
 #include "debug.h"
+#include "trace.h"
 
 #include <linux/log2.h>
 
@@ -40,6 +41,10 @@
 /* when under memory pressure rx ring refill may fail and needs a retry */
 #define HTT_RX_RING_REFILL_RETRY_MS 50
 
+
+static int ath10k_htt_rx_get_csum_state(struct sk_buff *skb);
+
+
 static int ath10k_htt_rx_ring_size(struct ath10k_htt *htt)
 {
         int size;
@@ -177,10 +182,27 @@ static int ath10k_htt_rx_ring_fill_n(struct ath10k_htt *htt, int num)
 
 static void ath10k_htt_rx_msdu_buff_replenish(struct ath10k_htt *htt)
 {
-        int ret, num_to_fill;
+        int ret, num_deficit, num_to_fill;
 
+        /* Refilling the whole RX ring buffer proves to be a bad idea. The
+         * reason is RX may take up significant amount of CPU cycles and starve
+         * other tasks, e.g. TX on an ethernet device while acting as a bridge
+         * with ath10k wlan interface. This ended up with very poor performance
+         * once CPU the host system was overwhelmed with RX on ath10k.
+         *
+         * By limiting the number of refills the replenishing occurs
+         * progressively. This in turns makes use of the fact tasklets are
+         * processed in FIFO order. This means actual RX processing can starve
+         * out refilling. If there's not enough buffers on RX ring FW will not
+         * report RX until it is refilled with enough buffers. This
+         * automatically balances load wrt to CPU power.
+         *
+         * This probably comes at a cost of lower maximum throughput but
+         * improves the avarage and stability. */
         spin_lock_bh(&htt->rx_ring.lock);
-        num_to_fill = htt->rx_ring.fill_level - htt->rx_ring.fill_cnt;
+        num_deficit = htt->rx_ring.fill_level - htt->rx_ring.fill_cnt;
+        num_to_fill = min(ATH10K_HTT_MAX_NUM_REFILL, num_deficit);
+        num_deficit -= num_to_fill;
         ret = ath10k_htt_rx_ring_fill_n(htt, num_to_fill);
         if (ret == -ENOMEM) {
                 /*
@@ -191,6 +213,8 @@ static void ath10k_htt_rx_msdu_buff_replenish(struct ath10k_htt *htt)
                  */
                 mod_timer(&htt->rx_ring.refill_retry_timer, jiffies +
                           msecs_to_jiffies(HTT_RX_RING_REFILL_RETRY_MS));
+        } else if (num_deficit > 0) {
+                tasklet_schedule(&htt->rx_replenish_task);
         }
         spin_unlock_bh(&htt->rx_ring.lock);
 }
@@ -212,6 +236,7 @@ void ath10k_htt_rx_detach(struct ath10k_htt *htt)
         int sw_rd_idx = htt->rx_ring.sw_rd_idx.msdu_payld;
 
         del_timer_sync(&htt->rx_ring.refill_retry_timer);
+        tasklet_kill(&htt->rx_replenish_task);
 
         while (sw_rd_idx != __le32_to_cpu(*(htt->rx_ring.alloc_idx.vaddr))) {
                 struct sk_buff *skb =
@@ -441,6 +466,12 @@ static int ath10k_htt_rx_amsdu_pop(struct ath10k_htt *htt,
         return msdu_chaining;
 }
 
+static void ath10k_htt_rx_replenish_task(unsigned long ptr)
+{
+        struct ath10k_htt *htt = (struct ath10k_htt *)ptr;
+        ath10k_htt_rx_msdu_buff_replenish(htt);
+}
+
 int ath10k_htt_rx_attach(struct ath10k_htt *htt)
 {
         dma_addr_t paddr;
@@ -501,7 +532,10 @@ int ath10k_htt_rx_attach(struct ath10k_htt *htt)
         if (__ath10k_htt_rx_ring_fill_n(htt, htt->rx_ring.fill_level))
                 goto err_fill_ring;
 
-        ath10k_dbg(ATH10K_DBG_HTT, "HTT RX ring size: %d, fill_level: %d\n",
+        tasklet_init(&htt->rx_replenish_task, ath10k_htt_rx_replenish_task,
+                     (unsigned long)htt);
+
+        ath10k_dbg(ATH10K_DBG_BOOT, "htt rx ring size %d fill_level %d\n",
                    htt->rx_ring.size, htt->rx_ring.fill_level);
         return 0;
 
@@ -590,134 +624,144 @@ static bool ath10k_htt_rx_hdr_is_amsdu(struct ieee80211_hdr *hdr)
         return false;
 }
 
-static int ath10k_htt_rx_amsdu(struct ath10k_htt *htt,
-                        struct htt_rx_info *info)
+struct rfc1042_hdr {
+        u8 llc_dsap;
+        u8 llc_ssap;
+        u8 llc_ctrl;
+        u8 snap_oui[3];
+        __be16 snap_type;
+} __packed;
+
+struct amsdu_subframe_hdr {
+        u8 dst[ETH_ALEN];
+        u8 src[ETH_ALEN];
+        __be16 len;
+} __packed;
+
+static void ath10k_htt_rx_amsdu(struct ath10k_htt *htt,
+                                struct htt_rx_info *info)
 {
         struct htt_rx_desc *rxd;
-        struct sk_buff *amsdu;
         struct sk_buff *first;
-        struct ieee80211_hdr *hdr;
         struct sk_buff *skb = info->skb;
         enum rx_msdu_decap_format fmt;
         enum htt_rx_mpdu_encrypt_type enctype;
+        struct ieee80211_hdr *hdr;
+        u8 hdr_buf[64], addr[ETH_ALEN], *qos;
         unsigned int hdr_len;
-        int crypto_len;
 
         rxd = (void *)skb->data - sizeof(*rxd);
-        fmt = MS(__le32_to_cpu(rxd->msdu_start.info1),
-                        RX_MSDU_START_INFO1_DECAP_FORMAT);
         enctype = MS(__le32_to_cpu(rxd->mpdu_start.info0),
                         RX_MPDU_START_INFO0_ENCRYPT_TYPE);
 
-        /* FIXME: No idea what assumptions are safe here. Need logs */
-        if ((fmt == RX_MSDU_DECAP_RAW && skb->next) ||
-            (fmt == RX_MSDU_DECAP_8023_SNAP_LLC)) {
-                ath10k_htt_rx_free_msdu_chain(skb->next);
-                skb->next = NULL;
-                return -ENOTSUPP;
-        }
+        hdr = (struct ieee80211_hdr *)rxd->rx_hdr_status;
+        hdr_len = ieee80211_hdrlen(hdr->frame_control);
+        memcpy(hdr_buf, hdr, hdr_len);
+        hdr = (struct ieee80211_hdr *)hdr_buf;
 
-        /* A-MSDU max is a little less than 8K */
-        amsdu = dev_alloc_skb(8*1024);
-        if (!amsdu) {
-                ath10k_warn("A-MSDU allocation failed\n");
-                ath10k_htt_rx_free_msdu_chain(skb->next);
-                skb->next = NULL;
-                return -ENOMEM;
-        }
-
-        if (fmt >= RX_MSDU_DECAP_NATIVE_WIFI) {
-                int hdrlen;
-
-                hdr = (void *)rxd->rx_hdr_status;
-                hdrlen = ieee80211_hdrlen(hdr->frame_control);
-                memcpy(skb_put(amsdu, hdrlen), hdr, hdrlen);
-        }
+        /* FIXME: Hopefully this is a temporary measure.
+         *
+         * Reporting individual A-MSDU subframes means each reported frame
+         * shares the same sequence number.
+         *
+         * mac80211 drops frames it recognizes as duplicates, i.e.
+         * retransmission flag is set and sequence number matches sequence
+         * number from a previous frame (as per IEEE 802.11-2012: 9.3.2.10
+         * "Duplicate detection and recovery")
+         *
+         * To avoid frames being dropped clear retransmission flag for all
+         * received A-MSDUs.
+         *
+         * Worst case: actual duplicate frames will be reported but this should
+         * still be handled gracefully by other OSI/ISO layers. */
+        hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_RETRY);
 
         first = skb;
         while (skb) {
                 void *decap_hdr;
-                int decap_len = 0;
+                int len;
 
                 rxd = (void *)skb->data - sizeof(*rxd);
                 fmt = MS(__le32_to_cpu(rxd->msdu_start.info1),
-                                RX_MSDU_START_INFO1_DECAP_FORMAT);
+                         RX_MSDU_START_INFO1_DECAP_FORMAT);
                 decap_hdr = (void *)rxd->rx_hdr_status;
 
-                if (skb == first) {
-                        /* We receive linked A-MSDU subframe skbuffs. The
-                         * first one contains the original 802.11 header (and
-                         * possible crypto param) in the RX descriptor. The
-                         * A-MSDU subframe header follows that. Each part is
-                         * aligned to 4 byte boundary. */
-
-                        hdr = (void *)amsdu->data;
-                        hdr_len = ieee80211_hdrlen(hdr->frame_control);
-                        crypto_len = ath10k_htt_rx_crypto_param_len(enctype);
-
-                        decap_hdr += roundup(hdr_len, 4);
-                        decap_hdr += roundup(crypto_len, 4);
-                }
+                skb->ip_summed = ath10k_htt_rx_get_csum_state(skb);
 
-                if (fmt == RX_MSDU_DECAP_ETHERNET2_DIX) {
-                        /* Ethernet2 decap inserts ethernet header in place of
-                         * A-MSDU subframe header. */
-                        skb_pull(skb, 6 + 6 + 2);
-
-                        /* A-MSDU subframe header length */
-                        decap_len += 6 + 6 + 2;
-
-                        /* Ethernet2 decap also strips the LLC/SNAP so we need
-                         * to re-insert it. The LLC/SNAP follows A-MSDU
-                         * subframe header. */
-                        /* FIXME: Not all LLCs are 8 bytes long */
-                        decap_len += 8;
-
-                        memcpy(skb_put(amsdu, decap_len), decap_hdr, decap_len);
+                /* First frame in an A-MSDU chain has more decapped data. */
+                if (skb == first) {
+                        len = round_up(ieee80211_hdrlen(hdr->frame_control), 4);
+                        len += round_up(ath10k_htt_rx_crypto_param_len(enctype),
+                                        4);
+                        decap_hdr += len;
                 }
 
-                if (fmt == RX_MSDU_DECAP_NATIVE_WIFI) {
-                        /* Native Wifi decap inserts regular 802.11 header
-                         * in place of A-MSDU subframe header. */
+                switch (fmt) {
+                case RX_MSDU_DECAP_RAW:
+                        /* remove trailing FCS */
+                        skb_trim(skb, skb->len - FCS_LEN);
+                        break;
+                case RX_MSDU_DECAP_NATIVE_WIFI:
+                        /* pull decapped header and copy DA */
                         hdr = (struct ieee80211_hdr *)skb->data;
-                        skb_pull(skb, ieee80211_hdrlen(hdr->frame_control));
+                        hdr_len = ieee80211_hdrlen(hdr->frame_control);
+                        memcpy(addr, ieee80211_get_DA(hdr), ETH_ALEN);
+                        skb_pull(skb, hdr_len);
 
-                        /* A-MSDU subframe header length */
-                        decap_len += 6 + 6 + 2;
+                        /* push original 802.11 header */
+                        hdr = (struct ieee80211_hdr *)hdr_buf;
+                        hdr_len = ieee80211_hdrlen(hdr->frame_control);
+                        memcpy(skb_push(skb, hdr_len), hdr, hdr_len);
 
-                        memcpy(skb_put(amsdu, decap_len), decap_hdr, decap_len);
-                }
+                        /* original A-MSDU header has the bit set but we're
+                         * not including A-MSDU subframe header */
+                        hdr = (struct ieee80211_hdr *)skb->data;
+                        qos = ieee80211_get_qos_ctl(hdr);
+                        qos[0] &= ~IEEE80211_QOS_CTL_A_MSDU_PRESENT;
 
-                if (fmt == RX_MSDU_DECAP_RAW)
-                        skb_trim(skb, skb->len - 4); /* remove FCS */
+                        /* original 802.11 header has a different DA */
+                        memcpy(ieee80211_get_DA(hdr), addr, ETH_ALEN);
+                        break;
+                case RX_MSDU_DECAP_ETHERNET2_DIX:
+                        /* strip ethernet header and insert decapped 802.11
+                         * header, amsdu subframe header and rfc1042 header */
 
-                memcpy(skb_put(amsdu, skb->len), skb->data, skb->len);
+                        len = 0;
+                        len += sizeof(struct rfc1042_hdr);
+                        len += sizeof(struct amsdu_subframe_hdr);
 
-                /* A-MSDU subframes are padded to 4bytes
-                 * but relative to first subframe, not the whole MPDU */
-                if (skb->next && ((decap_len + skb->len) & 3)) {
-                        int padlen = 4 - ((decap_len + skb->len) & 3);
-                        memset(skb_put(amsdu, padlen), 0, padlen);
+                        skb_pull(skb, sizeof(struct ethhdr));
+                        memcpy(skb_push(skb, len), decap_hdr, len);
+                        memcpy(skb_push(skb, hdr_len), hdr, hdr_len);
+                        break;
+                case RX_MSDU_DECAP_8023_SNAP_LLC:
+                        /* insert decapped 802.11 header making a singly
+                         * A-MSDU */
+                        memcpy(skb_push(skb, hdr_len), hdr, hdr_len);
+                        break;
                 }
 
+                info->skb = skb;
+                info->encrypt_type = enctype;
                 skb = skb->next;
-        }
+                info->skb->next = NULL;
 
-        info->skb = amsdu;
-        info->encrypt_type = enctype;
-
-        ath10k_htt_rx_free_msdu_chain(first);
+                ath10k_process_rx(htt->ar, info);
+        }
 
-        return 0;
+        /* FIXME: It might be nice to re-assemble the A-MSDU when there's a
+         * monitor interface active for sniffing purposes. */
 }
 
-static int ath10k_htt_rx_msdu(struct ath10k_htt *htt, struct htt_rx_info *info)
+static void ath10k_htt_rx_msdu(struct ath10k_htt *htt, struct htt_rx_info *info)
 {
         struct sk_buff *skb = info->skb;
         struct htt_rx_desc *rxd;
         struct ieee80211_hdr *hdr;
         enum rx_msdu_decap_format fmt;
         enum htt_rx_mpdu_encrypt_type enctype;
+        int hdr_len;
+        void *rfc1042;
 
         /* This shouldn't happen. If it does than it may be a FW bug. */
         if (skb->next) {
@@ -731,49 +775,53 @@ static int ath10k_htt_rx_msdu(struct ath10k_htt *htt, struct htt_rx_info *info)
                         RX_MSDU_START_INFO1_DECAP_FORMAT);
         enctype = MS(__le32_to_cpu(rxd->mpdu_start.info0),
                         RX_MPDU_START_INFO0_ENCRYPT_TYPE);
-        hdr = (void *)skb->data - RX_HTT_HDR_STATUS_LEN;
+        hdr = (struct ieee80211_hdr *)rxd->rx_hdr_status;
+        hdr_len = ieee80211_hdrlen(hdr->frame_control);
+
+        skb->ip_summed = ath10k_htt_rx_get_csum_state(skb);
 
         switch (fmt) {
         case RX_MSDU_DECAP_RAW:
                 /* remove trailing FCS */
-                skb_trim(skb, skb->len - 4);
+                skb_trim(skb, skb->len - FCS_LEN);
                 break;
         case RX_MSDU_DECAP_NATIVE_WIFI:
-                /* nothing to do here */
+                /* Pull decapped header */
+                hdr = (struct ieee80211_hdr *)skb->data;
+                hdr_len = ieee80211_hdrlen(hdr->frame_control);
+                skb_pull(skb, hdr_len);
+
+                /* Push original header */
+                hdr = (struct ieee80211_hdr *)rxd->rx_hdr_status;
+                hdr_len = ieee80211_hdrlen(hdr->frame_control);
+                memcpy(skb_push(skb, hdr_len), hdr, hdr_len);
                 break;
         case RX_MSDU_DECAP_ETHERNET2_DIX:
-                /* macaddr[6] + macaddr[6] + ethertype[2] */
-                skb_pull(skb, 6 + 6 + 2);
-                break;
-        case RX_MSDU_DECAP_8023_SNAP_LLC:
-                /* macaddr[6] + macaddr[6] + len[2] */
-                /* we don't need this for non-A-MSDU */
-                skb_pull(skb, 6 + 6 + 2);
-                break;
-        }
+                /* strip ethernet header and insert decapped 802.11 header and
+                 * rfc1042 header */
 
-        if (fmt == RX_MSDU_DECAP_ETHERNET2_DIX) {
-                void *llc;
-                int llclen;
+                rfc1042 = hdr;
+                rfc1042 += roundup(hdr_len, 4);
+                rfc1042 += roundup(ath10k_htt_rx_crypto_param_len(enctype), 4);
 
-                llclen = 8;
-                llc  = hdr;
-                llc += roundup(ieee80211_hdrlen(hdr->frame_control), 4);
-                llc += roundup(ath10k_htt_rx_crypto_param_len(enctype), 4);
-
-                skb_push(skb, llclen);
-                memcpy(skb->data, llc, llclen);
-        }
+                skb_pull(skb, sizeof(struct ethhdr));
+                memcpy(skb_push(skb, sizeof(struct rfc1042_hdr)),
+                       rfc1042, sizeof(struct rfc1042_hdr));
+                memcpy(skb_push(skb, hdr_len), hdr, hdr_len);
+                break;
+        case RX_MSDU_DECAP_8023_SNAP_LLC:
+                /* remove A-MSDU subframe header and insert
+                 * decapped 802.11 header. rfc1042 header is already there */
 
-        if (fmt >= RX_MSDU_DECAP_ETHERNET2_DIX) {
-                int len = ieee80211_hdrlen(hdr->frame_control);
-                skb_push(skb, len);
-                memcpy(skb->data, hdr, len);
+                skb_pull(skb, sizeof(struct amsdu_subframe_hdr));
+                memcpy(skb_push(skb, hdr_len), hdr, hdr_len);
+                break;
         }
 
         info->skb = skb;
         info->encrypt_type = enctype;
-        return 0;
+
+        ath10k_process_rx(htt->ar, info);
 }
 
 static bool ath10k_htt_rx_has_decrypt_err(struct sk_buff *skb)
@@ -845,8 +893,6 @@ static void ath10k_htt_rx_handler(struct ath10k_htt *htt,
         int fw_desc_len;
         u8 *fw_desc;
         int i, j;
-        int ret;
-        int ip_summed;
 
         memset(&info, 0, sizeof(info));
 
@@ -921,11 +967,6 @@ static void ath10k_htt_rx_handler(struct ath10k_htt *htt,
                                 continue;
                         }
 
-                        /* The skb is not yet processed and it may be
-                         * reallocated. Since the offload is in the original
-                         * skb extract the checksum now and assign it later */
-                        ip_summed = ath10k_htt_rx_get_csum_state(msdu_head);
-
                         info.skb     = msdu_head;
                         info.fcs_err = ath10k_htt_rx_has_fcs_err(msdu_head);
                         info.signal  = ATH10K_DEFAULT_NOISE_FLOOR;
@@ -938,28 +979,13 @@ static void ath10k_htt_rx_handler(struct ath10k_htt *htt,
                         hdr = ath10k_htt_rx_skb_get_hdr(msdu_head);
 
                         if (ath10k_htt_rx_hdr_is_amsdu(hdr))
-                                ret = ath10k_htt_rx_amsdu(htt, &info);
+                                ath10k_htt_rx_amsdu(htt, &info);
                         else
-                                ret = ath10k_htt_rx_msdu(htt, &info);
-
-                        if (ret && !info.fcs_err) {
-                                ath10k_warn("error processing msdus %d\n", ret);
-                                dev_kfree_skb_any(info.skb);
-                                continue;
-                        }
-
-                        if (ath10k_htt_rx_hdr_is_amsdu((void *)info.skb->data))
-                                ath10k_dbg(ATH10K_DBG_HTT, "htt mpdu is amsdu\n");
-
-                        info.skb->ip_summed = ip_summed;
-
-                        ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "htt mpdu: ",
-                                        info.skb->data, info.skb->len);
-                        ath10k_process_rx(htt->ar, &info);
+                                ath10k_htt_rx_msdu(htt, &info);
                 }
         }
 
-        ath10k_htt_rx_msdu_buff_replenish(htt);
+        tasklet_schedule(&htt->rx_replenish_task);
 }
 
 static void ath10k_htt_rx_frag_handler(struct ath10k_htt *htt,
@@ -1131,7 +1157,7 @@ void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb)
                         break;
                 }
 
-                ath10k_txrx_tx_completed(htt, &tx_done);
+                ath10k_txrx_tx_unref(htt, &tx_done);
                 break;
         }
         case HTT_T2H_MSG_TYPE_TX_COMPL_IND: {
@@ -1165,7 +1191,7 @@ void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb)
                 for (i = 0; i < resp->data_tx_completion.num_msdus; i++) {
                         msdu_id = resp->data_tx_completion.msdus[i];
                         tx_done.msdu_id = __le16_to_cpu(msdu_id);
-                        ath10k_txrx_tx_completed(htt, &tx_done);
+                        ath10k_txrx_tx_unref(htt, &tx_done);
                 }
                 break;
         }
@@ -1190,8 +1216,10 @@ void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb)
         case HTT_T2H_MSG_TYPE_TEST:
                 /* FIX THIS */
                 break;
-        case HTT_T2H_MSG_TYPE_TX_INSPECT_IND:
         case HTT_T2H_MSG_TYPE_STATS_CONF:
+                trace_ath10k_htt_stats(skb->data, skb->len);
+                break;
+        case HTT_T2H_MSG_TYPE_TX_INSPECT_IND:
         case HTT_T2H_MSG_TYPE_RX_ADDBA:
         case HTT_T2H_MSG_TYPE_RX_DELBA:
         case HTT_T2H_MSG_TYPE_RX_FLUSH:
diff --git a/drivers/net/wireless/ath/ath10k/htt_tx.c b/drivers/net/wireless/ath/ath10k/htt_tx.c
index 656c2546b294..3b93c6a01c6c 100644
--- a/drivers/net/wireless/ath/ath10k/htt_tx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_tx.c
@@ -96,7 +96,7 @@ int ath10k_htt_tx_attach(struct ath10k_htt *htt)
         htt->max_num_pending_tx = ath10k_hif_get_free_queue_number(htt->ar,
                                                                    pipe);
 
-        ath10k_dbg(ATH10K_DBG_HTT, "htt tx max num pending tx %d\n",
+        ath10k_dbg(ATH10K_DBG_BOOT, "htt tx max num pending tx %d\n",
                    htt->max_num_pending_tx);
 
         htt->pending_tx = kzalloc(sizeof(*htt->pending_tx) *
@@ -117,7 +117,7 @@ int ath10k_htt_tx_attach(struct ath10k_htt *htt)
 
 static void ath10k_htt_tx_cleanup_pending(struct ath10k_htt *htt)
 {
-        struct sk_buff *txdesc;
+        struct htt_tx_done tx_done = {0};
         int msdu_id;
 
         /* No locks needed. Called after communication with the device has
@@ -127,18 +127,13 @@ static void ath10k_htt_tx_cleanup_pending(struct ath10k_htt *htt)
                 if (!test_bit(msdu_id, htt->used_msdu_ids))
                         continue;
 
-                txdesc = htt->pending_tx[msdu_id];
-                if (!txdesc)
-                        continue;
-
                 ath10k_dbg(ATH10K_DBG_HTT, "force cleanup msdu_id %hu\n",
                            msdu_id);
 
-                if (ATH10K_SKB_CB(txdesc)->htt.refcount > 0)
-                        ATH10K_SKB_CB(txdesc)->htt.refcount = 1;
+                tx_done.discard = 1;
+                tx_done.msdu_id = msdu_id;
 
-                ATH10K_SKB_CB(txdesc)->htt.discard = true;
-                ath10k_txrx_tx_unref(htt, txdesc);
+                ath10k_txrx_tx_unref(htt, &tx_done);
         }
 }
 
@@ -152,26 +147,7 @@ void ath10k_htt_tx_detach(struct ath10k_htt *htt)
 
 void ath10k_htt_htc_tx_complete(struct ath10k *ar, struct sk_buff *skb)
 {
-        struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(skb);
-        struct ath10k_htt *htt = &ar->htt;
-
-        if (skb_cb->htt.is_conf) {
-                dev_kfree_skb_any(skb);
-                return;
-        }
-
-        if (skb_cb->is_aborted) {
-                skb_cb->htt.discard = true;
-
-                /* if the skbuff is aborted we need to make sure we'll free up
-                 * the tx resources, we can't simply run tx_unref() 2 times
-                 * because if htt tx completion came in earlier we'd access
-                 * unallocated memory */
-                if (skb_cb->htt.refcount > 1)
-                        skb_cb->htt.refcount = 1;
-        }
-
-        ath10k_txrx_tx_unref(htt, skb);
+        dev_kfree_skb_any(skb);
 }
 
 int ath10k_htt_h2t_ver_req_msg(struct ath10k_htt *htt)
@@ -192,10 +168,48 @@ int ath10k_htt_h2t_ver_req_msg(struct ath10k_htt *htt)
         cmd = (struct htt_cmd *)skb->data;
         cmd->hdr.msg_type = HTT_H2T_MSG_TYPE_VERSION_REQ;
 
-        ATH10K_SKB_CB(skb)->htt.is_conf = true;
+        ret = ath10k_htc_send(&htt->ar->htc, htt->eid, skb);
+        if (ret) {
+                dev_kfree_skb_any(skb);
+                return ret;
+        }
+
+        return 0;
+}
+
+int ath10k_htt_h2t_stats_req(struct ath10k_htt *htt, u8 mask, u64 cookie)
+{
+        struct htt_stats_req *req;
+        struct sk_buff *skb;
+        struct htt_cmd *cmd;
+        int len = 0, ret;
+
+        len += sizeof(cmd->hdr);
+        len += sizeof(cmd->stats_req);
+
+        skb = ath10k_htc_alloc_skb(len);
+        if (!skb)
+                return -ENOMEM;
+
+        skb_put(skb, len);
+        cmd = (struct htt_cmd *)skb->data;
+        cmd->hdr.msg_type = HTT_H2T_MSG_TYPE_STATS_REQ;
+
+        req = &cmd->stats_req;
+
+        memset(req, 0, sizeof(*req));
+
+        /* currently we support only max 8 bit masks so no need to worry
+         * about endian support */
+        req->upload_types[0] = mask;
+        req->reset_types[0] = mask;
+        req->stat_type = HTT_STATS_REQ_CFG_STAT_TYPE_INVALID;
+        req->cookie_lsb = cpu_to_le32(cookie & 0xffffffff);
+        req->cookie_msb = cpu_to_le32((cookie & 0xffffffff00000000ULL) >> 32);
 
         ret = ath10k_htc_send(&htt->ar->htc, htt->eid, skb);
         if (ret) {
+                ath10k_warn("failed to send htt type stats request: %d", ret);
                 dev_kfree_skb_any(skb);
                 return ret;
         }
@@ -279,8 +293,6 @@ int ath10k_htt_send_rx_ring_cfg_ll(struct ath10k_htt *htt)
 
 #undef desc_offset
 
-        ATH10K_SKB_CB(skb)->htt.is_conf = true;
-
         ret = ath10k_htc_send(&htt->ar->htc, htt->eid, skb);
         if (ret) {
                 dev_kfree_skb_any(skb);
@@ -293,10 +305,10 @@ int ath10k_htt_send_rx_ring_cfg_ll(struct ath10k_htt *htt)
 int ath10k_htt_mgmt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
 {
         struct device *dev = htt->ar->dev;
-        struct ath10k_skb_cb *skb_cb;
         struct sk_buff *txdesc = NULL;
         struct htt_cmd *cmd;
-        u8 vdev_id = ATH10K_SKB_CB(msdu)->htt.vdev_id;
+        struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(msdu);
+        u8 vdev_id = skb_cb->htt.vdev_id;
         int len = 0;
         int msdu_id = -1;
         int res;
@@ -304,30 +316,30 @@ int ath10k_htt_mgmt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
 
         res = ath10k_htt_tx_inc_pending(htt);
         if (res)
-                return res;
+                goto err;
 
         len += sizeof(cmd->hdr);
         len += sizeof(cmd->mgmt_tx);
 
-        txdesc = ath10k_htc_alloc_skb(len);
-        if (!txdesc) {
-                res = -ENOMEM;
-                goto err;
-        }
-
         spin_lock_bh(&htt->tx_lock);
-        msdu_id = ath10k_htt_tx_alloc_msdu_id(htt);
-        if (msdu_id < 0) {
+        res = ath10k_htt_tx_alloc_msdu_id(htt);
+        if (res < 0) {
                 spin_unlock_bh(&htt->tx_lock);
-                res = msdu_id;
-                goto err;
+                goto err_tx_dec;
         }
-        htt->pending_tx[msdu_id] = txdesc;
+        msdu_id = res;
+        htt->pending_tx[msdu_id] = msdu;
         spin_unlock_bh(&htt->tx_lock);
 
+        txdesc = ath10k_htc_alloc_skb(len);
+        if (!txdesc) {
+                res = -ENOMEM;
+                goto err_free_msdu_id;
+        }
+
         res = ath10k_skb_map(dev, msdu);
         if (res)
-                goto err;
+                goto err_free_txdesc;
 
         skb_put(txdesc, len);
         cmd = (struct htt_cmd *)txdesc->data;
@@ -339,31 +351,27 @@ int ath10k_htt_mgmt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
         memcpy(cmd->mgmt_tx.hdr, msdu->data,
                min_t(int, msdu->len, HTT_MGMT_FRM_HDR_DOWNLOAD_LEN));
 
-        /* refcount is decremented by HTC and HTT completions until it reaches
-         * zero and is freed */
-        skb_cb = ATH10K_SKB_CB(txdesc);
-        skb_cb->htt.msdu_id = msdu_id;
-        skb_cb->htt.refcount = 2;
-        skb_cb->htt.msdu = msdu;
+        skb_cb->htt.frag_len = 0;
+        skb_cb->htt.pad_len = 0;
 
         res = ath10k_htc_send(&htt->ar->htc, htt->eid, txdesc);
         if (res)
-                goto err;
+                goto err_unmap_msdu;
 
         return 0;
 
-err:
+err_unmap_msdu:
         ath10k_skb_unmap(dev, msdu);
-
-        if (txdesc)
-                dev_kfree_skb_any(txdesc);
-        if (msdu_id >= 0) {
-                spin_lock_bh(&htt->tx_lock);
-                htt->pending_tx[msdu_id] = NULL;
-                ath10k_htt_tx_free_msdu_id(htt, msdu_id);
-                spin_unlock_bh(&htt->tx_lock);
-        }
+err_free_txdesc:
+        dev_kfree_skb_any(txdesc);
+err_free_msdu_id:
+        spin_lock_bh(&htt->tx_lock);
+        htt->pending_tx[msdu_id] = NULL;
+        ath10k_htt_tx_free_msdu_id(htt, msdu_id);
+        spin_unlock_bh(&htt->tx_lock);
+err_tx_dec:
         ath10k_htt_tx_dec_pending(htt);
+err:
         return res;
 }
 
@@ -373,13 +381,12 @@ int ath10k_htt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
         struct htt_cmd *cmd;
         struct htt_data_tx_desc_frag *tx_frags;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)msdu->data;
-        struct ath10k_skb_cb *skb_cb;
+        struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(msdu);
         struct sk_buff *txdesc = NULL;
-        struct sk_buff *txfrag = NULL;
+        bool use_frags;
         u8 vdev_id = ATH10K_SKB_CB(msdu)->htt.vdev_id;
         u8 tid;
-        int prefetch_len, desc_len, frag_len;
-        dma_addr_t frags_paddr;
+        int prefetch_len, desc_len;
         int msdu_id = -1;
         int res;
         u8 flags0;
@@ -387,69 +394,82 @@ int ath10k_htt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
 
         res = ath10k_htt_tx_inc_pending(htt);
         if (res)
-                return res;
+                goto err;
+
+        spin_lock_bh(&htt->tx_lock);
+        res = ath10k_htt_tx_alloc_msdu_id(htt);
+        if (res < 0) {
+                spin_unlock_bh(&htt->tx_lock);
+                goto err_tx_dec;
+        }
+        msdu_id = res;
+        htt->pending_tx[msdu_id] = msdu;
+        spin_unlock_bh(&htt->tx_lock);
 
         prefetch_len = min(htt->prefetch_len, msdu->len);
         prefetch_len = roundup(prefetch_len, 4);
 
         desc_len = sizeof(cmd->hdr) + sizeof(cmd->data_tx) + prefetch_len;
-        frag_len = sizeof(*tx_frags) * 2;
 
         txdesc = ath10k_htc_alloc_skb(desc_len);
         if (!txdesc) {
                 res = -ENOMEM;
-                goto err;
+                goto err_free_msdu_id;
         }
 
-        txfrag = dev_alloc_skb(frag_len);
-        if (!txfrag) {
-                res = -ENOMEM;
-                goto err;
-        }
+        /* Since HTT 3.0 there is no separate mgmt tx command. However in case
+         * of mgmt tx using TX_FRM there is not tx fragment list. Instead of tx
+         * fragment list host driver specifies directly frame pointer. */
+        use_frags = htt->target_version_major < 3 ||
+                    !ieee80211_is_mgmt(hdr->frame_control);
 
         if (!IS_ALIGNED((unsigned long)txdesc->data, 4)) {
                 ath10k_warn("htt alignment check failed. dropping packet.\n");
                 res = -EIO;
-                goto err;
+                goto err_free_txdesc;
         }
 
-        spin_lock_bh(&htt->tx_lock);
-        msdu_id = ath10k_htt_tx_alloc_msdu_id(htt);
-        if (msdu_id < 0) {
-                spin_unlock_bh(&htt->tx_lock);
-                res = msdu_id;
-                goto err;
+        if (use_frags) {
+                skb_cb->htt.frag_len = sizeof(*tx_frags) * 2;
+                skb_cb->htt.pad_len = (unsigned long)msdu->data -
+                                      round_down((unsigned long)msdu->data, 4);
+
+                skb_push(msdu, skb_cb->htt.frag_len + skb_cb->htt.pad_len);
+        } else {
+                skb_cb->htt.frag_len = 0;
+                skb_cb->htt.pad_len = 0;
         }
-        htt->pending_tx[msdu_id] = txdesc;
-        spin_unlock_bh(&htt->tx_lock);
 
         res = ath10k_skb_map(dev, msdu);
         if (res)
-                goto err;
-
-        /* tx fragment list must be terminated with zero-entry */
-        skb_put(txfrag, frag_len);
-        tx_frags = (struct htt_data_tx_desc_frag *)txfrag->data;
-        tx_frags[0].paddr = __cpu_to_le32(ATH10K_SKB_CB(msdu)->paddr);
-        tx_frags[0].len   = __cpu_to_le32(msdu->len);
-        tx_frags[1].paddr = __cpu_to_le32(0);
-        tx_frags[1].len   = __cpu_to_le32(0);
-
-        res = ath10k_skb_map(dev, txfrag);
-        if (res)
-                goto err;
+                goto err_pull_txfrag;
+
+        if (use_frags) {
+                dma_sync_single_for_cpu(dev, skb_cb->paddr, msdu->len,
+                                        DMA_TO_DEVICE);
+
+                /* tx fragment list must be terminated with zero-entry */
+                tx_frags = (struct htt_data_tx_desc_frag *)msdu->data;
+                tx_frags[0].paddr = __cpu_to_le32(skb_cb->paddr +
+                                                  skb_cb->htt.frag_len +
+                                                  skb_cb->htt.pad_len);
+                tx_frags[0].len   = __cpu_to_le32(msdu->len -
+                                                  skb_cb->htt.frag_len -
+                                                  skb_cb->htt.pad_len);
+                tx_frags[1].paddr = __cpu_to_le32(0);
+                tx_frags[1].len   = __cpu_to_le32(0);
+
+                dma_sync_single_for_device(dev, skb_cb->paddr, msdu->len,
+                                           DMA_TO_DEVICE);
+        }
 
-        ath10k_dbg(ATH10K_DBG_HTT, "txfrag 0x%llx msdu 0x%llx\n",
-                   (unsigned long long) ATH10K_SKB_CB(txfrag)->paddr,
+        ath10k_dbg(ATH10K_DBG_HTT, "msdu 0x%llx\n",
                    (unsigned long long) ATH10K_SKB_CB(msdu)->paddr);
-        ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "txfrag: ",
-                        txfrag->data, frag_len);
         ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "msdu: ",
                         msdu->data, msdu->len);
 
         skb_put(txdesc, desc_len);
         cmd = (struct htt_cmd *)txdesc->data;
-        memset(cmd, 0, desc_len);
 
         tid = ATH10K_SKB_CB(msdu)->htt.tid;
 
@@ -459,8 +479,13 @@ int ath10k_htt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
         if (!ieee80211_has_protected(hdr->frame_control))
                 flags0 |= HTT_DATA_TX_DESC_FLAGS0_NO_ENCRYPT;
         flags0 |= HTT_DATA_TX_DESC_FLAGS0_MAC_HDR_PRESENT;
-        flags0 |= SM(ATH10K_HW_TXRX_NATIVE_WIFI,
-                     HTT_DATA_TX_DESC_FLAGS0_PKT_TYPE);
+
+        if (use_frags)
+                flags0 |= SM(ATH10K_HW_TXRX_NATIVE_WIFI,
+                             HTT_DATA_TX_DESC_FLAGS0_PKT_TYPE);
+        else
+                flags0 |= SM(ATH10K_HW_TXRX_MGMT,
+                             HTT_DATA_TX_DESC_FLAGS0_PKT_TYPE);
 
         flags1  = 0;
         flags1 |= SM((u16)vdev_id, HTT_DATA_TX_DESC_FLAGS1_VDEV_ID);
@@ -468,45 +493,37 @@ int ath10k_htt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
         flags1 |= HTT_DATA_TX_DESC_FLAGS1_CKSUM_L3_OFFLOAD;
         flags1 |= HTT_DATA_TX_DESC_FLAGS1_CKSUM_L4_OFFLOAD;
 
-        frags_paddr = ATH10K_SKB_CB(txfrag)->paddr;
-
         cmd->hdr.msg_type        = HTT_H2T_MSG_TYPE_TX_FRM;
         cmd->data_tx.flags0      = flags0;
         cmd->data_tx.flags1      = __cpu_to_le16(flags1);
-        cmd->data_tx.len         = __cpu_to_le16(msdu->len);
+        cmd->data_tx.len         = __cpu_to_le16(msdu->len -
+                                                 skb_cb->htt.frag_len -
+                                                 skb_cb->htt.pad_len);
         cmd->data_tx.id          = __cpu_to_le16(msdu_id);
-        cmd->data_tx.frags_paddr = __cpu_to_le32(frags_paddr);
+        cmd->data_tx.frags_paddr = __cpu_to_le32(skb_cb->paddr);
         cmd->data_tx.peerid      = __cpu_to_le32(HTT_INVALID_PEERID);
 
-        memcpy(cmd->data_tx.prefetch, msdu->data, prefetch_len);
-
-        /* refcount is decremented by HTC and HTT completions until it reaches
-         * zero and is freed */
-        skb_cb = ATH10K_SKB_CB(txdesc);
-        skb_cb->htt.msdu_id = msdu_id;
-        skb_cb->htt.refcount = 2;
-        skb_cb->htt.txfrag = txfrag;
-        skb_cb->htt.msdu = msdu;
+        memcpy(cmd->data_tx.prefetch, hdr, prefetch_len);
 
         res = ath10k_htc_send(&htt->ar->htc, htt->eid, txdesc);
         if (res)
-                goto err;
+                goto err_unmap_msdu;
 
         return 0;
-err:
-        if (txfrag)
-                ath10k_skb_unmap(dev, txfrag);
-        if (txdesc)
-                dev_kfree_skb_any(txdesc);
-        if (txfrag)
-                dev_kfree_skb_any(txfrag);
-        if (msdu_id >= 0) {
-                spin_lock_bh(&htt->tx_lock);
-                htt->pending_tx[msdu_id] = NULL;
-                ath10k_htt_tx_free_msdu_id(htt, msdu_id);
-                spin_unlock_bh(&htt->tx_lock);
-        }
-        ath10k_htt_tx_dec_pending(htt);
+
+err_unmap_msdu:
         ath10k_skb_unmap(dev, msdu);
+err_pull_txfrag:
+        skb_pull(msdu, skb_cb->htt.frag_len + skb_cb->htt.pad_len);
+err_free_txdesc:
+        dev_kfree_skb_any(txdesc);
+err_free_msdu_id:
+        spin_lock_bh(&htt->tx_lock);
+        htt->pending_tx[msdu_id] = NULL;
+        ath10k_htt_tx_free_msdu_id(htt, msdu_id);
+        spin_unlock_bh(&htt->tx_lock);
+err_tx_dec:
+        ath10k_htt_tx_dec_pending(htt);
+err:
         return res;
 }
diff --git a/drivers/net/wireless/ath/ath10k/hw.h b/drivers/net/wireless/ath/ath10k/hw.h
index 44ed5af0a204..8c1be7685922 100644
--- a/drivers/net/wireless/ath/ath10k/hw.h
+++ b/drivers/net/wireless/ath/ath10k/hw.h
@@ -24,18 +24,14 @@
 #define SUPPORTED_FW_MAJOR      1
 #define SUPPORTED_FW_MINOR      0
 #define SUPPORTED_FW_RELEASE    0
-#define SUPPORTED_FW_BUILD      629
+#define SUPPORTED_FW_BUILD      636
 
-/* QCA988X 1.0 definitions */
-#define QCA988X_HW_1_0_VERSION          0x4000002c
-#define QCA988X_HW_1_0_FW_DIR           "ath10k/QCA988X/hw1.0"
-#define QCA988X_HW_1_0_FW_FILE          "firmware.bin"
-#define QCA988X_HW_1_0_OTP_FILE         "otp.bin"
-#define QCA988X_HW_1_0_BOARD_DATA_FILE  "board.bin"
-#define QCA988X_HW_1_0_PATCH_LOAD_ADDR  0x1234
+/* QCA988X 1.0 definitions (unsupported) */
+#define QCA988X_HW_1_0_CHIP_ID_REV      0x0
 
 /* QCA988X 2.0 definitions */
 #define QCA988X_HW_2_0_VERSION          0x4100016c
+#define QCA988X_HW_2_0_CHIP_ID_REV      0x2
 #define QCA988X_HW_2_0_FW_DIR           "ath10k/QCA988X/hw2.0"
 #define QCA988X_HW_2_0_FW_FILE          "firmware.bin"
 #define QCA988X_HW_2_0_OTP_FILE         "otp.bin"
@@ -53,6 +49,9 @@ enum ath10k_hw_txrx_mode {
         ATH10K_HW_TXRX_RAW = 0,
         ATH10K_HW_TXRX_NATIVE_WIFI = 1,
         ATH10K_HW_TXRX_ETHERNET = 2,
+
+        /* Valid for HTT >= 3.0. Used for management frames in TX_FRM. */
+        ATH10K_HW_TXRX_MGMT = 3,
 };
 
 enum ath10k_mcast2ucast_mode {
@@ -75,7 +74,11 @@ enum ath10k_mcast2ucast_mode {
 #define TARGET_RX_CHAIN_MASK                    (BIT(0) | BIT(1) | BIT(2))
 #define TARGET_RX_TIMEOUT_LO_PRI                100
 #define TARGET_RX_TIMEOUT_HI_PRI                40
-#define TARGET_RX_DECAP_MODE                    ATH10K_HW_TXRX_ETHERNET
+
+/* Native Wifi decap mode is used to align IP frames to 4-byte boundaries and
+ * avoid a very expensive re-alignment in mac80211. */
+#define TARGET_RX_DECAP_MODE                    ATH10K_HW_TXRX_NATIVE_WIFI
+
 #define TARGET_SCAN_MAX_PENDING_REQS            4
 #define TARGET_BMISS_OFFLOAD_MAX_VDEV           3
 #define TARGET_ROAM_OFFLOAD_MAX_VDEV            3
@@ -169,6 +172,10 @@ enum ath10k_mcast2ucast_mode {
 #define SOC_LPO_CAL_ENABLE_LSB                  20
 #define SOC_LPO_CAL_ENABLE_MASK                 0x00100000
 
+#define SOC_CHIP_ID_ADDRESS                     0x000000ec
+#define SOC_CHIP_ID_REV_LSB                     8
+#define SOC_CHIP_ID_REV_MASK                    0x00000f00
+
 #define WLAN_RESET_CONTROL_COLD_RST_MASK        0x00000008
 #define WLAN_RESET_CONTROL_WARM_RST_MASK        0x00000004
 #define WLAN_SYSTEM_SLEEP_DISABLE_LSB           0
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index cf2ba4d850c9..99a9bad3f398 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -460,6 +460,11 @@ static int ath10k_vdev_start(struct ath10k_vif *arvif)
                 arg.ssid_len = arvif->vif->bss_conf.ssid_len;
         }
 
+        ath10k_dbg(ATH10K_DBG_MAC,
+                   "mac vdev %d start center_freq %d phymode %s\n",
+                   arg.vdev_id, arg.channel.freq,
+                   ath10k_wmi_phymode_str(arg.channel.mode));
+
         ret = ath10k_wmi_vdev_start(ar, &arg);
         if (ret) {
                 ath10k_warn("WMI vdev start failed: ret %d\n", ret);
@@ -503,13 +508,10 @@ static int ath10k_monitor_start(struct ath10k *ar, int vdev_id)
 {
         struct ieee80211_channel *channel = ar->hw->conf.chandef.chan;
         struct wmi_vdev_start_request_arg arg = {};
-        enum nl80211_channel_type type;
         int ret = 0;
 
         lockdep_assert_held(&ar->conf_mutex);
 
-        type = cfg80211_get_chandef_type(&ar->hw->conf.chandef);
-
         arg.vdev_id = vdev_id;
         arg.channel.freq = channel->center_freq;
         arg.channel.band_center_freq1 = ar->hw->conf.chandef.center_freq1;
@@ -607,7 +609,7 @@ static int ath10k_monitor_create(struct ath10k *ar)
                 goto vdev_fail;
         }
 
-        ath10k_dbg(ATH10K_DBG_MAC, "Monitor interface created, vdev id: %d\n",
+        ath10k_dbg(ATH10K_DBG_MAC, "mac monitor vdev %d created\n",
                    ar->monitor_vdev_id);
 
         ar->monitor_present = true;
@@ -639,7 +641,7 @@ static int ath10k_monitor_destroy(struct ath10k *ar)
         ar->free_vdev_map |= 1 << (ar->monitor_vdev_id);
         ar->monitor_present = false;
 
-        ath10k_dbg(ATH10K_DBG_MAC, "Monitor interface destroyed, vdev id: %d\n",
+        ath10k_dbg(ATH10K_DBG_MAC, "mac monitor vdev %d deleted\n",
                    ar->monitor_vdev_id);
         return ret;
 }
@@ -668,7 +670,7 @@ static void ath10k_control_beaconing(struct ath10k_vif *arvif,
                             arvif->vdev_id);
                 return;
         }
-        ath10k_dbg(ATH10K_DBG_MAC, "VDEV: %d up\n", arvif->vdev_id);
+        ath10k_dbg(ATH10K_DBG_MAC, "mac vdev %d up\n", arvif->vdev_id);
 }
 
 static void ath10k_control_ibss(struct ath10k_vif *arvif,
@@ -752,14 +754,14 @@ static void ath10k_ps_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
                 psmode = WMI_STA_PS_MODE_DISABLED;
         }
 
+        ath10k_dbg(ATH10K_DBG_MAC, "mac vdev %d psmode %s\n",
+                   arvif->vdev_id, psmode ? "enable" : "disable");
+
         ar_iter->ret = ath10k_wmi_set_psmode(ar_iter->ar, arvif->vdev_id,
                                              psmode);
         if (ar_iter->ret)
                 ath10k_warn("Failed to set PS Mode: %d for VDEV: %d\n",
                             psmode, arvif->vdev_id);
-        else
-                ath10k_dbg(ATH10K_DBG_MAC, "Set PS Mode: %d for VDEV: %d\n",
-                           psmode, arvif->vdev_id);
 }
 
 /**********************/
@@ -949,7 +951,8 @@ static void ath10k_peer_assoc_h_ht(struct ath10k *ar,
         arg->peer_ht_rates.num_rates = n;
         arg->peer_num_spatial_streams = max((n+7) / 8, 1);
 
-        ath10k_dbg(ATH10K_DBG_MAC, "mcs cnt %d nss %d\n",
+        ath10k_dbg(ATH10K_DBG_MAC, "mac ht peer %pM mcs cnt %d nss %d\n",
+                   arg->addr,
                    arg->peer_ht_rates.num_rates,
                    arg->peer_num_spatial_streams);
 }
@@ -969,11 +972,11 @@ static void ath10k_peer_assoc_h_qos_ap(struct ath10k *ar,
                 arg->peer_flags |= WMI_PEER_QOS;
 
         if (sta->wme && sta->uapsd_queues) {
-                ath10k_dbg(ATH10K_DBG_MAC, "uapsd_queues: 0x%X, max_sp: %d\n",
+                ath10k_dbg(ATH10K_DBG_MAC, "mac uapsd_queues 0x%x max_sp %d\n",
                            sta->uapsd_queues, sta->max_sp);
 
                 arg->peer_flags |= WMI_PEER_APSD;
-                arg->peer_flags |= WMI_RC_UAPSD_FLAG;
+                arg->peer_rate_caps |= WMI_RC_UAPSD_FLAG;
 
                 if (sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
                         uapsd |= WMI_AP_PS_UAPSD_AC3_DELIVERY_EN |
@@ -1048,7 +1051,8 @@ static void ath10k_peer_assoc_h_vht(struct ath10k *ar,
         arg->peer_vht_rates.tx_mcs_set =
                 __le16_to_cpu(vht_cap->vht_mcs.tx_mcs_map);
 
-        ath10k_dbg(ATH10K_DBG_MAC, "mac vht peer\n");
+        ath10k_dbg(ATH10K_DBG_MAC, "mac vht peer %pM max_mpdu %d flags 0x%x\n",
+                   sta->addr, arg->peer_max_mpdu, arg->peer_flags);
 }
 
 static void ath10k_peer_assoc_h_qos(struct ath10k *ar,
@@ -1076,8 +1080,6 @@ static void ath10k_peer_assoc_h_phymode(struct ath10k *ar,
 {
         enum wmi_phy_mode phymode = MODE_UNKNOWN;
 
-        /* FIXME: add VHT */
-
         switch (ar->hw->conf.chandef.chan->band) {
         case IEEE80211_BAND_2GHZ:
                 if (sta->ht_cap.ht_supported) {
@@ -1091,7 +1093,17 @@ static void ath10k_peer_assoc_h_phymode(struct ath10k *ar,
 
                 break;
         case IEEE80211_BAND_5GHZ:
-                if (sta->ht_cap.ht_supported) {
+                /*
+                 * Check VHT first.
+                 */
+                if (sta->vht_cap.vht_supported) {
+                        if (sta->bandwidth == IEEE80211_STA_RX_BW_80)
+                                phymode = MODE_11AC_VHT80;
+                        else if (sta->bandwidth == IEEE80211_STA_RX_BW_40)
+                                phymode = MODE_11AC_VHT40;
+                        else if (sta->bandwidth == IEEE80211_STA_RX_BW_20)
+                                phymode = MODE_11AC_VHT20;
+                } else if (sta->ht_cap.ht_supported) {
                         if (sta->bandwidth == IEEE80211_STA_RX_BW_40)
                                 phymode = MODE_11NA_HT40;
                         else
@@ -1105,6 +1117,9 @@ static void ath10k_peer_assoc_h_phymode(struct ath10k *ar,
                 break;
         }
 
+        ath10k_dbg(ATH10K_DBG_MAC, "mac peer %pM phymode %s\n",
+                   sta->addr, ath10k_wmi_phymode_str(phymode));
+
         arg->peer_phymode = phymode;
         WARN_ON(phymode == MODE_UNKNOWN);
 }
@@ -1162,15 +1177,15 @@ static void ath10k_bss_assoc(struct ieee80211_hw *hw,
 
         rcu_read_unlock();
 
+        ath10k_dbg(ATH10K_DBG_MAC,
+                   "mac vdev %d up (associated) bssid %pM aid %d\n",
+                   arvif->vdev_id, bss_conf->bssid, bss_conf->aid);
+
         ret = ath10k_wmi_vdev_up(ar, arvif->vdev_id, bss_conf->aid,
                                  bss_conf->bssid);
         if (ret)
                 ath10k_warn("VDEV: %d up failed: ret %d\n",
                             arvif->vdev_id, ret);
-        else
-                ath10k_dbg(ATH10K_DBG_MAC,
-                           "VDEV: %d associated, BSSID: %pM, AID: %d\n",
-                           arvif->vdev_id, bss_conf->bssid, bss_conf->aid);
 }
 
 /*
@@ -1191,10 +1206,11 @@ static void ath10k_bss_disassoc(struct ieee80211_hw *hw,
          * No idea why this happens, even though VDEV-DOWN is supposed
          * to be analogous to link down, so just stop the VDEV.
          */
+        ath10k_dbg(ATH10K_DBG_MAC, "mac vdev %d stop (disassociated\n",
+                   arvif->vdev_id);
+
+        /* FIXME: check return value */
         ret = ath10k_vdev_stop(arvif);
-        if (!ret)
-                ath10k_dbg(ATH10K_DBG_MAC, "VDEV: %d stopped\n",
-                           arvif->vdev_id);
 
         /*
          * If we don't call VDEV-DOWN after VDEV-STOP FW will remain active and
@@ -1203,12 +1219,10 @@ static void ath10k_bss_disassoc(struct ieee80211_hw *hw,
          * interfaces as it expects there is no rx when no interface is
          * running.
          */
-        ret = ath10k_wmi_vdev_down(ar, arvif->vdev_id);
-        if (ret)
-                ath10k_dbg(ATH10K_DBG_MAC, "VDEV: %d ath10k_wmi_vdev_down failed (%d)\n",
-                           arvif->vdev_id, ret);
+        ath10k_dbg(ATH10K_DBG_MAC, "mac vdev %d down\n", arvif->vdev_id);
 
-        ath10k_wmi_flush_tx(ar);
+        /* FIXME: why don't we print error if wmi call fails? */
+        ret = ath10k_wmi_vdev_down(ar, arvif->vdev_id);
 
         arvif->def_wep_key_index = 0;
 }
@@ -1333,8 +1347,8 @@ static int ath10k_update_channel_list(struct ath10k *ar)
                                 continue;
 
                         ath10k_dbg(ATH10K_DBG_WMI,
-                                   "%s: [%zd/%d] freq %d maxpower %d regpower %d antenna %d mode %d\n",
-                                   __func__, ch - arg.channels, arg.n_channels,
+                                   "mac channel [%zd/%d] freq %d maxpower %d regpower %d antenna %d mode %d\n",
+                                    ch - arg.channels, arg.n_channels,
                                    ch->freq, ch->max_power, ch->max_reg_power,
                                    ch->max_antenna_gain, ch->mode);
 
@@ -1421,10 +1435,6 @@ static void ath10k_tx_h_update_wep_key(struct sk_buff *skb)
         struct ieee80211_key_conf *key = info->control.hw_key;
         int ret;
 
-        /* TODO AP mode should be implemented */
-        if (vif->type != NL80211_IFTYPE_STATION)
-                return;
-
         if (!ieee80211_has_protected(hdr->frame_control))
                 return;
 
@@ -1438,7 +1448,8 @@ static void ath10k_tx_h_update_wep_key(struct sk_buff *skb)
         if (key->keyidx == arvif->def_wep_key_index)
                 return;
 
-        ath10k_dbg(ATH10K_DBG_MAC, "new wep keyidx will be %d\n", key->keyidx);
+        ath10k_dbg(ATH10K_DBG_MAC, "mac vdev %d keyidx %d\n",
+                   arvif->vdev_id, key->keyidx);
 
         ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id,
                                         WMI_VDEV_PARAM_DEF_KEYID,
@@ -1480,6 +1491,12 @@ static void ath10k_tx_htt(struct ath10k *ar, struct sk_buff *skb)
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         int ret;
 
+        if (ar->htt.target_version_major >= 3) {
+                /* Since HTT 3.0 there is no separate mgmt tx command */
+                ret = ath10k_htt_tx(&ar->htt, skb);
+                goto exit;
+        }
+
         if (ieee80211_is_mgmt(hdr->frame_control))
                 ret = ath10k_htt_mgmt_tx(&ar->htt, skb);
         else if (ieee80211_is_nullfunc(hdr->frame_control))
@@ -1491,6 +1508,7 @@ static void ath10k_tx_htt(struct ath10k *ar, struct sk_buff *skb)
         else
                 ret = ath10k_htt_tx(&ar->htt, skb);
 
+exit:
         if (ret) {
                 ath10k_warn("tx failed (%d). dropping packet.\n", ret);
                 ieee80211_free_txskb(ar->hw, skb);
@@ -1534,7 +1552,7 @@ void ath10k_offchan_tx_work(struct work_struct *work)
 
                 mutex_lock(&ar->conf_mutex);
 
-                ath10k_dbg(ATH10K_DBG_MAC, "processing offchannel skb %p\n",
+                ath10k_dbg(ATH10K_DBG_MAC, "mac offchannel skb %p\n",
                            skb);
 
                 hdr = (struct ieee80211_hdr *)skb->data;
@@ -1546,6 +1564,7 @@ void ath10k_offchan_tx_work(struct work_struct *work)
                 spin_unlock_bh(&ar->data_lock);
 
                 if (peer)
+                        /* FIXME: should this use ath10k_warn()? */
                         ath10k_dbg(ATH10K_DBG_MAC, "peer %pM on vdev %d already present\n",
                                    peer_addr, vdev_id);
 
@@ -1643,8 +1662,6 @@ static int ath10k_abort_scan(struct ath10k *ar)
                 return -EIO;
         }
 
-        ath10k_wmi_flush_tx(ar);
-
         ret = wait_for_completion_timeout(&ar->scan.completed, 3*HZ);
         if (ret == 0)
                 ath10k_warn("timed out while waiting for scan to stop\n");
@@ -1678,10 +1695,6 @@ static int ath10k_start_scan(struct ath10k *ar,
         if (ret)
                 return ret;
 
-        /* make sure we submit the command so the completion
-        * timeout makes sense */
-        ath10k_wmi_flush_tx(ar);
-
         ret = wait_for_completion_timeout(&ar->scan.started, 1*HZ);
         if (ret == 0) {
                 ath10k_abort_scan(ar);
@@ -1727,8 +1740,10 @@ static void ath10k_tx(struct ieee80211_hw *hw,
         /* we must calculate tid before we apply qos workaround
          * as we'd lose the qos control field */
         tid = HTT_DATA_TX_EXT_TID_NON_QOS_MCAST_BCAST;
-        if (ieee80211_is_data_qos(hdr->frame_control) &&
-            is_unicast_ether_addr(ieee80211_get_DA(hdr))) {
+        if (ieee80211_is_mgmt(hdr->frame_control)) {
+                tid = HTT_DATA_TX_EXT_TID_MGMT;
+        } else if (ieee80211_is_data_qos(hdr->frame_control) &&
+                   is_unicast_ether_addr(ieee80211_get_DA(hdr))) {
                 u8 *qc = ieee80211_get_qos_ctl(hdr);
                 tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
         }
@@ -1742,7 +1757,7 @@ static void ath10k_tx(struct ieee80211_hw *hw,
                 ath10k_tx_h_seq_no(skb);
         }
 
-        memset(ATH10K_SKB_CB(skb), 0, sizeof(*ATH10K_SKB_CB(skb)));
+        ATH10K_SKB_CB(skb)->htt.is_offchan = false;
         ATH10K_SKB_CB(skb)->htt.vdev_id = vdev_id;
         ATH10K_SKB_CB(skb)->htt.tid = tid;
 
@@ -1884,7 +1899,7 @@ static int ath10k_config(struct ieee80211_hw *hw, u32 changed)
         mutex_lock(&ar->conf_mutex);
 
         if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
-                ath10k_dbg(ATH10K_DBG_MAC, "Config channel %d mhz\n",
+                ath10k_dbg(ATH10K_DBG_MAC, "mac config channel %d mhz\n",
                            conf->chandef.chan->center_freq);
                 spin_lock_bh(&ar->data_lock);
                 ar->rx_channel = conf->chandef.chan;
@@ -1901,7 +1916,6 @@ static int ath10k_config(struct ieee80211_hw *hw, u32 changed)
                         ret = ath10k_monitor_destroy(ar);
         }
 
-        ath10k_wmi_flush_tx(ar);
         mutex_unlock(&ar->conf_mutex);
         return ret;
 }
@@ -1973,7 +1987,7 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
                 break;
         }
 
-        ath10k_dbg(ATH10K_DBG_MAC, "Add interface: id %d type %d subtype %d\n",
+        ath10k_dbg(ATH10K_DBG_MAC, "mac vdev create %d (add interface) type %d subtype %d\n",
                    arvif->vdev_id, arvif->vdev_type, arvif->vdev_subtype);
 
         ret = ath10k_wmi_vdev_create(ar, arvif->vdev_id, arvif->vdev_type,
@@ -2052,7 +2066,12 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw,
 
         mutex_lock(&ar->conf_mutex);
 
-        ath10k_dbg(ATH10K_DBG_MAC, "Remove interface: id %d\n", arvif->vdev_id);
+        spin_lock_bh(&ar->data_lock);
+        if (arvif->beacon) {
+                dev_kfree_skb_any(arvif->beacon);
+                arvif->beacon = NULL;
+        }
+        spin_unlock_bh(&ar->data_lock);
 
         ar->free_vdev_map |= 1 << (arvif->vdev_id);
 
@@ -2064,6 +2083,9 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw,
                 kfree(arvif->u.ap.noa_data);
         }
 
+        ath10k_dbg(ATH10K_DBG_MAC, "mac vdev delete %d (remove interface)\n",
+                   arvif->vdev_id);
+
         ret = ath10k_wmi_vdev_delete(ar, arvif->vdev_id);
         if (ret)
                 ath10k_warn("WMI vdev delete failed: %d\n", ret);
@@ -2105,18 +2127,20 @@ static void ath10k_configure_filter(struct ieee80211_hw *hw,
 
         if ((ar->filter_flags & FIF_PROMISC_IN_BSS) &&
             !ar->monitor_enabled) {
+                ath10k_dbg(ATH10K_DBG_MAC, "mac monitor %d start\n",
+                           ar->monitor_vdev_id);
+
                 ret = ath10k_monitor_start(ar, ar->monitor_vdev_id);
                 if (ret)
                         ath10k_warn("Unable to start monitor mode\n");
-                else
-                        ath10k_dbg(ATH10K_DBG_MAC, "Monitor mode started\n");
         } else if (!(ar->filter_flags & FIF_PROMISC_IN_BSS) &&
                    ar->monitor_enabled) {
+                ath10k_dbg(ATH10K_DBG_MAC, "mac monitor %d stop\n",
+                           ar->monitor_vdev_id);
+
                 ret = ath10k_monitor_stop(ar);
                 if (ret)
                         ath10k_warn("Unable to stop monitor mode\n");
-                else
-                        ath10k_dbg(ATH10K_DBG_MAC, "Monitor mode stopped\n");
         }
 
         mutex_unlock(&ar->conf_mutex);
@@ -2141,41 +2165,41 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                 ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id,
                                                 WMI_VDEV_PARAM_BEACON_INTERVAL,
                                                 arvif->beacon_interval);
+                ath10k_dbg(ATH10K_DBG_MAC,
+                           "mac vdev %d beacon_interval %d\n",
+                           arvif->vdev_id, arvif->beacon_interval);
+
                 if (ret)
                         ath10k_warn("Failed to set beacon interval for VDEV: %d\n",
                                     arvif->vdev_id);
-                else
-                        ath10k_dbg(ATH10K_DBG_MAC,
-                                   "Beacon interval: %d set for VDEV: %d\n",
-                                   arvif->beacon_interval, arvif->vdev_id);
         }
 
         if (changed & BSS_CHANGED_BEACON) {
+                ath10k_dbg(ATH10K_DBG_MAC,
+                           "vdev %d set beacon tx mode to staggered\n",
+                           arvif->vdev_id);
+
                 ret = ath10k_wmi_pdev_set_param(ar,
                                                 WMI_PDEV_PARAM_BEACON_TX_MODE,
                                                 WMI_BEACON_STAGGERED_MODE);
                 if (ret)
                         ath10k_warn("Failed to set beacon mode for VDEV: %d\n",
                                     arvif->vdev_id);
-                else
-                        ath10k_dbg(ATH10K_DBG_MAC,
-                                   "Set staggered beacon mode for VDEV: %d\n",
-                                   arvif->vdev_id);
         }
 
         if (changed & BSS_CHANGED_BEACON_INFO) {
                 arvif->dtim_period = info->dtim_period;
 
+                ath10k_dbg(ATH10K_DBG_MAC,
+                           "mac vdev %d dtim_period %d\n",
+                           arvif->vdev_id, arvif->dtim_period);
+
                 ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id,
                                                 WMI_VDEV_PARAM_DTIM_PERIOD,
                                                 arvif->dtim_period);
                 if (ret)
                         ath10k_warn("Failed to set dtim period for VDEV: %d\n",
                                     arvif->vdev_id);
-                else
-                        ath10k_dbg(ATH10K_DBG_MAC,
-                                   "Set dtim period: %d for VDEV: %d\n",
-                                   arvif->dtim_period, arvif->vdev_id);
         }
 
         if (changed & BSS_CHANGED_SSID &&
@@ -2188,16 +2212,15 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
 
         if (changed & BSS_CHANGED_BSSID) {
                 if (!is_zero_ether_addr(info->bssid)) {
+                        ath10k_dbg(ATH10K_DBG_MAC,
+                                   "mac vdev %d create peer %pM\n",
+                                   arvif->vdev_id, info->bssid);
+
                         ret = ath10k_peer_create(ar, arvif->vdev_id,
                                                  info->bssid);
                         if (ret)
                                 ath10k_warn("Failed to add peer: %pM for VDEV: %d\n",
                                             info->bssid, arvif->vdev_id);
-                        else
-                                ath10k_dbg(ATH10K_DBG_MAC,
-                                           "Added peer: %pM for VDEV: %d\n",
-                                           info->bssid, arvif->vdev_id);
-
 
                         if (vif->type == NL80211_IFTYPE_STATION) {
                                 /*
@@ -2207,11 +2230,12 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                                 memcpy(arvif->u.sta.bssid, info->bssid,
                                        ETH_ALEN);
 
+                                ath10k_dbg(ATH10K_DBG_MAC,
+                                           "mac vdev %d start %pM\n",
+                                           arvif->vdev_id, info->bssid);
+
+                                /* FIXME: check return value */
                                 ret = ath10k_vdev_start(arvif);
-                                if (!ret)
-                                        ath10k_dbg(ATH10K_DBG_MAC,
-                                                   "VDEV: %d started with BSSID: %pM\n",
-                                                   arvif->vdev_id, info->bssid);
                         }
 
                         /*
@@ -2235,16 +2259,15 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                 else
                         cts_prot = 0;
 
+                ath10k_dbg(ATH10K_DBG_MAC, "mac vdev %d cts_prot %d\n",
+                           arvif->vdev_id, cts_prot);
+
                 ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id,
                                                 WMI_VDEV_PARAM_ENABLE_RTSCTS,
                                                 cts_prot);
                 if (ret)
                         ath10k_warn("Failed to set CTS prot for VDEV: %d\n",
                                     arvif->vdev_id);
-                else
-                        ath10k_dbg(ATH10K_DBG_MAC,
-                                   "Set CTS prot: %d for VDEV: %d\n",
-                                   cts_prot, arvif->vdev_id);
         }
 
         if (changed & BSS_CHANGED_ERP_SLOT) {
@@ -2255,16 +2278,15 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                 else
                         slottime = WMI_VDEV_SLOT_TIME_LONG; /* 20us */
 
+                ath10k_dbg(ATH10K_DBG_MAC, "mac vdev %d slot_time %d\n",
+                           arvif->vdev_id, slottime);
+
                 ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id,
                                                 WMI_VDEV_PARAM_SLOT_TIME,
                                                 slottime);
                 if (ret)
                         ath10k_warn("Failed to set erp slot for VDEV: %d\n",
                                     arvif->vdev_id);
-                else
-                        ath10k_dbg(ATH10K_DBG_MAC,
-                                   "Set slottime: %d for VDEV: %d\n",
-                                   slottime, arvif->vdev_id);
         }
 
         if (changed & BSS_CHANGED_ERP_PREAMBLE) {
@@ -2274,16 +2296,16 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                 else
                         preamble = WMI_VDEV_PREAMBLE_LONG;
 
+                ath10k_dbg(ATH10K_DBG_MAC,
+                           "mac vdev %d preamble %dn",
+                           arvif->vdev_id, preamble);
+
                 ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id,
                                                 WMI_VDEV_PARAM_PREAMBLE,
                                                 preamble);
                 if (ret)
                         ath10k_warn("Failed to set preamble for VDEV: %d\n",
                                     arvif->vdev_id);
-                else
-                        ath10k_dbg(ATH10K_DBG_MAC,
-                                   "Set preamble: %d for VDEV: %d\n",
-                                   preamble, arvif->vdev_id);
         }
 
         if (changed & BSS_CHANGED_ASSOC) {
@@ -2474,27 +2496,26 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                 /*
                  * New station addition.
                  */
+                ath10k_dbg(ATH10K_DBG_MAC,
+                           "mac vdev %d peer create %pM (new sta)\n",
+                           arvif->vdev_id, sta->addr);
+
                 ret = ath10k_peer_create(ar, arvif->vdev_id, sta->addr);
                 if (ret)
                         ath10k_warn("Failed to add peer: %pM for VDEV: %d\n",
                                     sta->addr, arvif->vdev_id);
-                else
-                        ath10k_dbg(ATH10K_DBG_MAC,
-                                   "Added peer: %pM for VDEV: %d\n",
-                                   sta->addr, arvif->vdev_id);
         } else if ((old_state == IEEE80211_STA_NONE &&
                     new_state == IEEE80211_STA_NOTEXIST)) {
                 /*
                  * Existing station deletion.
                  */
+                ath10k_dbg(ATH10K_DBG_MAC,
+                           "mac vdev %d peer delete %pM (sta gone)\n",
+                           arvif->vdev_id, sta->addr);
                 ret = ath10k_peer_delete(ar, arvif->vdev_id, sta->addr);
                 if (ret)
                         ath10k_warn("Failed to delete peer: %pM for VDEV: %d\n",
                                     sta->addr, arvif->vdev_id);
-                else
-                        ath10k_dbg(ATH10K_DBG_MAC,
-                                   "Removed peer: %pM for VDEV: %d\n",
-                                   sta->addr, arvif->vdev_id);
 
                 if (vif->type == NL80211_IFTYPE_STATION)
                         ath10k_bss_disassoc(hw, vif);
@@ -2505,14 +2526,13 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                 /*
                  * New association.
                  */
+                ath10k_dbg(ATH10K_DBG_MAC, "mac sta %pM associated\n",
+                           sta->addr);
+
                 ret = ath10k_station_assoc(ar, arvif, sta);
                 if (ret)
                         ath10k_warn("Failed to associate station: %pM\n",
                                     sta->addr);
-                else
-                        ath10k_dbg(ATH10K_DBG_MAC,
-                                   "Station %pM moved to assoc state\n",
-                                   sta->addr);
         } else if (old_state == IEEE80211_STA_ASSOC &&
                    new_state == IEEE80211_STA_AUTH &&
                    (vif->type == NL80211_IFTYPE_AP ||
@@ -2520,14 +2540,13 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                 /*
                  * Disassociation.
                  */
+                ath10k_dbg(ATH10K_DBG_MAC, "mac sta %pM disassociated\n",
+                           sta->addr);
+
                 ret = ath10k_station_disassoc(ar, arvif, sta);
                 if (ret)
                         ath10k_warn("Failed to disassociate station: %pM\n",
                                     sta->addr);
-                else
-                        ath10k_dbg(ATH10K_DBG_MAC,
-                                   "Station %pM moved to disassociated state\n",
-                                   sta->addr);
         }
 
         mutex_unlock(&ar->conf_mutex);
@@ -2747,14 +2766,13 @@ static void ath10k_set_rts_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
         if (ar_iter->ar->state == ATH10K_STATE_RESTARTED)
                 return;
 
+        ath10k_dbg(ATH10K_DBG_MAC, "mac vdev %d rts_threshold %d\n",
+                   arvif->vdev_id, rts);
+
         ar_iter->ret = ath10k_mac_set_rts(arvif, rts);
         if (ar_iter->ret)
                 ath10k_warn("Failed to set RTS threshold for VDEV: %d\n",
                             arvif->vdev_id);
-        else
-                ath10k_dbg(ATH10K_DBG_MAC,
-                           "Set RTS threshold: %d for VDEV: %d\n",
-                           rts, arvif->vdev_id);
 }
 
 static int ath10k_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
@@ -2789,14 +2807,13 @@ static void ath10k_set_frag_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
         if (ar_iter->ar->state == ATH10K_STATE_RESTARTED)
                 return;
 
+        ath10k_dbg(ATH10K_DBG_MAC, "mac vdev %d fragmentation_threshold %d\n",
+                   arvif->vdev_id, frag);
+
         ar_iter->ret = ath10k_mac_set_frag(arvif, frag);
         if (ar_iter->ret)
                 ath10k_warn("Failed to set frag threshold for VDEV: %d\n",
                             arvif->vdev_id);
-        else
-                ath10k_dbg(ATH10K_DBG_MAC,
-                           "Set frag threshold: %d for VDEV: %d\n",
-                           frag, arvif->vdev_id);
 }
 
 static int ath10k_set_frag_threshold(struct ieee80211_hw *hw, u32 value)
@@ -2836,8 +2853,7 @@ static void ath10k_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
                         bool empty;
 
                         spin_lock_bh(&ar->htt.tx_lock);
-                        empty = bitmap_empty(ar->htt.used_msdu_ids,
-                                             ar->htt.max_num_pending_tx);
+                        empty = (ar->htt.num_pending_tx == 0);
                         spin_unlock_bh(&ar->htt.tx_lock);
 
                         skip = (ar->state == ATH10K_STATE_WEDGED);
@@ -3326,6 +3342,10 @@ int ath10k_mac_register(struct ath10k *ar)
                         IEEE80211_HW_WANT_MONITOR_VIF |
                         IEEE80211_HW_AP_LINK_PS;
 
+        /* MSDU can have HTT TX fragment pushed in front. The additional 4
+         * bytes is used for padding/alignment if necessary. */
+        ar->hw->extra_tx_headroom += sizeof(struct htt_data_tx_desc_frag)*2 + 4;
+
         if (ar->ht_cap_info & WMI_HT_CAP_DYNAMIC_SMPS)
                 ar->hw->flags |= IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS;
 
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index e2f9ef50b1bd..dff23d97bed0 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -36,11 +36,9 @@ static unsigned int ath10k_target_ps;
 module_param(ath10k_target_ps, uint, 0644);
 MODULE_PARM_DESC(ath10k_target_ps, "Enable ath10k Target (SoC) PS option");
 
-#define QCA988X_1_0_DEVICE_ID   (0xabcd)
 #define QCA988X_2_0_DEVICE_ID   (0x003c)
 
 static DEFINE_PCI_DEVICE_TABLE(ath10k_pci_id_table) = {
-        { PCI_VDEVICE(ATHEROS, QCA988X_1_0_DEVICE_ID) }, /* PCI-E QCA988X V1 */
         { PCI_VDEVICE(ATHEROS, QCA988X_2_0_DEVICE_ID) }, /* PCI-E QCA988X V2 */
         {0}
 };
@@ -50,9 +48,9 @@ static int ath10k_pci_diag_read_access(struct ath10k *ar, u32 address,
 
 static void ath10k_pci_process_ce(struct ath10k *ar);
 static int ath10k_pci_post_rx(struct ath10k *ar);
-static int ath10k_pci_post_rx_pipe(struct hif_ce_pipe_info *pipe_info,
+static int ath10k_pci_post_rx_pipe(struct ath10k_pci_pipe *pipe_info,
                                              int num);
-static void ath10k_pci_rx_pipe_cleanup(struct hif_ce_pipe_info *pipe_info);
+static void ath10k_pci_rx_pipe_cleanup(struct ath10k_pci_pipe *pipe_info);
 static void ath10k_pci_stop_ce(struct ath10k *ar);
 static void ath10k_pci_device_reset(struct ath10k *ar);
 static int ath10k_pci_reset_target(struct ath10k *ar);
@@ -60,43 +58,145 @@ static int ath10k_pci_start_intr(struct ath10k *ar);
 static void ath10k_pci_stop_intr(struct ath10k *ar);
 
 static const struct ce_attr host_ce_config_wlan[] = {
-        /* host->target HTC control and raw streams */
-        { /* CE0 */ CE_ATTR_FLAGS, 0, 16, 256, 0, NULL,},
-        /* could be moved to share CE3 */
-        /* target->host HTT + HTC control */
-        { /* CE1 */ CE_ATTR_FLAGS, 0, 0, 512, 512, NULL,},
-        /* target->host WMI */
-        { /* CE2 */ CE_ATTR_FLAGS, 0, 0, 2048, 32, NULL,},
-        /* host->target WMI */
-        { /* CE3 */ CE_ATTR_FLAGS, 0, 32, 2048, 0, NULL,},
-        /* host->target HTT */
-        { /* CE4 */ CE_ATTR_FLAGS | CE_ATTR_DIS_INTR, 0,
-                    CE_HTT_H2T_MSG_SRC_NENTRIES, 256, 0, NULL,},
-        /* unused */
-        { /* CE5 */ CE_ATTR_FLAGS, 0, 0, 0, 0, NULL,},
-        /* Target autonomous hif_memcpy */
-        { /* CE6 */ CE_ATTR_FLAGS, 0, 0, 0, 0, NULL,},
-        /* ce_diag, the Diagnostic Window */
-        { /* CE7 */ CE_ATTR_FLAGS, 0, 2, DIAG_TRANSFER_LIMIT, 2, NULL,},
+        /* CE0: host->target HTC control and raw streams */
+        {
+                .flags = CE_ATTR_FLAGS,
+                .src_nentries = 16,
+                .src_sz_max = 256,
+                .dest_nentries = 0,
+        },
+
+        /* CE1: target->host HTT + HTC control */
+        {
+                .flags = CE_ATTR_FLAGS,
+                .src_nentries = 0,
+                .src_sz_max = 512,
+                .dest_nentries = 512,
+        },
+
+        /* CE2: target->host WMI */
+        {
+                .flags = CE_ATTR_FLAGS,
+                .src_nentries = 0,
+                .src_sz_max = 2048,
+                .dest_nentries = 32,
+        },
+
+        /* CE3: host->target WMI */
+        {
+                .flags = CE_ATTR_FLAGS,
+                .src_nentries = 32,
+                .src_sz_max = 2048,
+                .dest_nentries = 0,
+        },
+
+        /* CE4: host->target HTT */
+        {
+                .flags = CE_ATTR_FLAGS | CE_ATTR_DIS_INTR,
+                .src_nentries = CE_HTT_H2T_MSG_SRC_NENTRIES,
+                .src_sz_max = 256,
+                .dest_nentries = 0,
+        },
+
+        /* CE5: unused */
+        {
+                .flags = CE_ATTR_FLAGS,
+                .src_nentries = 0,
+                .src_sz_max = 0,
+                .dest_nentries = 0,
+        },
+
+        /* CE6: target autonomous hif_memcpy */
+        {
+                .flags = CE_ATTR_FLAGS,
+                .src_nentries = 0,
+                .src_sz_max = 0,
+                .dest_nentries = 0,
+        },
+
+        /* CE7: ce_diag, the Diagnostic Window */
+        {
+                .flags = CE_ATTR_FLAGS,
+                .src_nentries = 2,
+                .src_sz_max = DIAG_TRANSFER_LIMIT,
+                .dest_nentries = 2,
+        },
 };
 
 /* Target firmware's Copy Engine configuration. */
 static const struct ce_pipe_config target_ce_config_wlan[] = {
-        /* host->target HTC control and raw streams */
-        { /* CE0 */ 0, PIPEDIR_OUT, 32, 256, CE_ATTR_FLAGS, 0,},
-        /* target->host HTT + HTC control */
-        { /* CE1 */ 1, PIPEDIR_IN, 32, 512, CE_ATTR_FLAGS, 0,},
-        /* target->host WMI */
-        { /* CE2 */ 2, PIPEDIR_IN, 32, 2048, CE_ATTR_FLAGS, 0,},
-        /* host->target WMI */
-        { /* CE3 */ 3, PIPEDIR_OUT, 32, 2048, CE_ATTR_FLAGS, 0,},
-        /* host->target HTT */
-        { /* CE4 */ 4, PIPEDIR_OUT, 256, 256, CE_ATTR_FLAGS, 0,},
+        /* CE0: host->target HTC control and raw streams */
+        {
+                .pipenum = 0,
+                .pipedir = PIPEDIR_OUT,
+                .nentries = 32,
+                .nbytes_max = 256,
+                .flags = CE_ATTR_FLAGS,
+                .reserved = 0,
+        },
+
+        /* CE1: target->host HTT + HTC control */
+        {
+                .pipenum = 1,
+                .pipedir = PIPEDIR_IN,
+                .nentries = 32,
+                .nbytes_max = 512,
+                .flags = CE_ATTR_FLAGS,
+                .reserved = 0,
+        },
+
+        /* CE2: target->host WMI */
+        {
+                .pipenum = 2,
+                .pipedir = PIPEDIR_IN,
+                .nentries = 32,
+                .nbytes_max = 2048,
+                .flags = CE_ATTR_FLAGS,
+                .reserved = 0,
+        },
+
+        /* CE3: host->target WMI */
+        {
+                .pipenum = 3,
+                .pipedir = PIPEDIR_OUT,
+                .nentries = 32,
+                .nbytes_max = 2048,
+                .flags = CE_ATTR_FLAGS,
+                .reserved = 0,
+        },
+
+        /* CE4: host->target HTT */
+        {
+                .pipenum = 4,
+                .pipedir = PIPEDIR_OUT,
+                .nentries = 256,
+                .nbytes_max = 256,
+                .flags = CE_ATTR_FLAGS,
+                .reserved = 0,
+        },
+
         /* NB: 50% of src nentries, since tx has 2 frags */
-        /* unused */
-        { /* CE5 */ 5, PIPEDIR_OUT, 32, 2048, CE_ATTR_FLAGS, 0,},
-        /* Reserved for target autonomous hif_memcpy */
-        { /* CE6 */ 6, PIPEDIR_INOUT, 32, 4096, CE_ATTR_FLAGS, 0,},
+
+        /* CE5: unused */
+        {
+                .pipenum = 5,
+                .pipedir = PIPEDIR_OUT,
+                .nentries = 32,
+                .nbytes_max = 2048,
+                .flags = CE_ATTR_FLAGS,
+                .reserved = 0,
+        },
+
+        /* CE6: Reserved for target autonomous hif_memcpy */
+        {
+                .pipenum = 6,
+                .pipedir = PIPEDIR_INOUT,
+                .nentries = 32,
+                .nbytes_max = 4096,
+                .flags = CE_ATTR_FLAGS,
+                .reserved = 0,
+        },
+
         /* CE7 used only by Host */
 };
 
@@ -114,7 +214,7 @@ static int ath10k_pci_diag_read_mem(struct ath10k *ar, u32 address, void *data,
         unsigned int completed_nbytes, orig_nbytes, remaining_bytes;
         unsigned int id;
         unsigned int flags;
-        struct ce_state *ce_diag;
+        struct ath10k_ce_pipe *ce_diag;
         /* Host buffer address in CE space */
         u32 ce_data;
         dma_addr_t ce_data_base = 0;
@@ -278,7 +378,7 @@ static int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
         unsigned int completed_nbytes, orig_nbytes, remaining_bytes;
         unsigned int id;
         unsigned int flags;
-        struct ce_state *ce_diag;
+        struct ath10k_ce_pipe *ce_diag;
         void *data_buf = NULL;
         u32 ce_data;    /* Host buffer address in CE space */
         dma_addr_t ce_data_base = 0;
@@ -437,7 +537,7 @@ static void ath10k_pci_wait(struct ath10k *ar)
                 ath10k_warn("Unable to wakeup target\n");
 }
 
-void ath10k_do_pci_wake(struct ath10k *ar)
+int ath10k_do_pci_wake(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         void __iomem *pci_addr = ar_pci->mem;
@@ -453,18 +553,19 @@ void ath10k_do_pci_wake(struct ath10k *ar)
         atomic_inc(&ar_pci->keep_awake_count);
 
         if (ar_pci->verified_awake)
-                return;
+                return 0;
 
         for (;;) {
                 if (ath10k_pci_target_is_awake(ar)) {
                         ar_pci->verified_awake = true;
-                        break;
+                        return 0;
                 }
 
                 if (tot_delay > PCIE_WAKE_TIMEOUT) {
-                        ath10k_warn("target takes too long to wake up (awake count %d)\n",
+                        ath10k_warn("target took longer %d us to wake up (awake count %d)\n",
+                                    PCIE_WAKE_TIMEOUT,
                                     atomic_read(&ar_pci->keep_awake_count));
-                        break;
+                        return -ETIMEDOUT;
                 }
 
                 udelay(curr_delay);
@@ -493,7 +594,7 @@ void ath10k_do_pci_sleep(struct ath10k *ar)
  * FIXME: Handle OOM properly.
  */
 static inline
-struct ath10k_pci_compl *get_free_compl(struct hif_ce_pipe_info *pipe_info)
+struct ath10k_pci_compl *get_free_compl(struct ath10k_pci_pipe *pipe_info)
 {
         struct ath10k_pci_compl *compl = NULL;
 
@@ -511,39 +612,28 @@ exit:
 }
 
 /* Called by lower (CE) layer when a send to Target completes. */
-static void ath10k_pci_ce_send_done(struct ce_state *ce_state,
-                                    void *transfer_context,
-                                    u32 ce_data,
-                                    unsigned int nbytes,
-                                    unsigned int transfer_id)
+static void ath10k_pci_ce_send_done(struct ath10k_ce_pipe *ce_state)
 {
         struct ath10k *ar = ce_state->ar;
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct hif_ce_pipe_info *pipe_info =  &ar_pci->pipe_info[ce_state->id];
+        struct ath10k_pci_pipe *pipe_info =  &ar_pci->pipe_info[ce_state->id];
         struct ath10k_pci_compl *compl;
-        bool process = false;
-
-        do {
-                /*
-                 * For the send completion of an item in sendlist, just
-                 * increment num_sends_allowed. The upper layer callback will
-                 * be triggered when last fragment is done with send.
-                 */
-                if (transfer_context == CE_SENDLIST_ITEM_CTXT) {
-                        spin_lock_bh(&pipe_info->pipe_lock);
-                        pipe_info->num_sends_allowed++;
-                        spin_unlock_bh(&pipe_info->pipe_lock);
-                        continue;
-                }
+        void *transfer_context;
+        u32 ce_data;
+        unsigned int nbytes;
+        unsigned int transfer_id;
 
+        while (ath10k_ce_completed_send_next(ce_state, &transfer_context,
+                                             &ce_data, &nbytes,
+                                             &transfer_id) == 0) {
                 compl = get_free_compl(pipe_info);
                 if (!compl)
                         break;
 
-                compl->send_or_recv = HIF_CE_COMPLETE_SEND;
+                compl->state = ATH10K_PCI_COMPL_SEND;
                 compl->ce_state = ce_state;
                 compl->pipe_info = pipe_info;
-                compl->transfer_context = transfer_context;
+                compl->skb = transfer_context;
                 compl->nbytes = nbytes;
                 compl->transfer_id = transfer_id;
                 compl->flags = 0;
@@ -554,46 +644,36 @@ static void ath10k_pci_ce_send_done(struct ce_state *ce_state,
                 spin_lock_bh(&ar_pci->compl_lock);
                 list_add_tail(&compl->list, &ar_pci->compl_process);
                 spin_unlock_bh(&ar_pci->compl_lock);
-
-                process = true;
-        } while (ath10k_ce_completed_send_next(ce_state,
-                                                           &transfer_context,
-                                                           &ce_data, &nbytes,
-                                                           &transfer_id) == 0);
-
-        /*
-         * If only some of the items within a sendlist have completed,
-         * don't invoke completion processing until the entire sendlist
-         * has been sent.
-         */
-        if (!process)
-                return;
+        }
 
         ath10k_pci_process_ce(ar);
 }
 
 /* Called by lower (CE) layer when data is received from the Target. */
-static void ath10k_pci_ce_recv_data(struct ce_state *ce_state,
-                                    void *transfer_context, u32 ce_data,
-                                    unsigned int nbytes,
-                                    unsigned int transfer_id,
-                                    unsigned int flags)
+static void ath10k_pci_ce_recv_data(struct ath10k_ce_pipe *ce_state)
 {
         struct ath10k *ar = ce_state->ar;
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct hif_ce_pipe_info *pipe_info =  &ar_pci->pipe_info[ce_state->id];
+        struct ath10k_pci_pipe *pipe_info =  &ar_pci->pipe_info[ce_state->id];
         struct ath10k_pci_compl *compl;
         struct sk_buff *skb;
+        void *transfer_context;
+        u32 ce_data;
+        unsigned int nbytes;
+        unsigned int transfer_id;
+        unsigned int flags;
 
-        do {
+        while (ath10k_ce_completed_recv_next(ce_state, &transfer_context,
+                                             &ce_data, &nbytes, &transfer_id,
+                                             &flags) == 0) {
                 compl = get_free_compl(pipe_info);
                 if (!compl)
                         break;
 
-                compl->send_or_recv = HIF_CE_COMPLETE_RECV;
+                compl->state = ATH10K_PCI_COMPL_RECV;
                 compl->ce_state = ce_state;
                 compl->pipe_info = pipe_info;
-                compl->transfer_context = transfer_context;
+                compl->skb = transfer_context;
                 compl->nbytes = nbytes;
                 compl->transfer_id = transfer_id;
                 compl->flags = flags;
@@ -608,12 +688,7 @@ static void ath10k_pci_ce_recv_data(struct ce_state *ce_state,
                 spin_lock_bh(&ar_pci->compl_lock);
                 list_add_tail(&compl->list, &ar_pci->compl_process);
                 spin_unlock_bh(&ar_pci->compl_lock);
-
-        } while (ath10k_ce_completed_recv_next(ce_state,
-                                                           &transfer_context,
-                                                           &ce_data, &nbytes,
-                                                           &transfer_id,
-                                                           &flags) == 0);
+        }
 
         ath10k_pci_process_ce(ar);
 }
@@ -625,15 +700,12 @@ static int ath10k_pci_hif_send_head(struct ath10k *ar, u8 pipe_id,
 {
         struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(nbuf);
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct hif_ce_pipe_info *pipe_info = &(ar_pci->pipe_info[pipe_id]);
-        struct ce_state *ce_hdl = pipe_info->ce_hdl;
-        struct ce_sendlist sendlist;
+        struct ath10k_pci_pipe *pipe_info = &(ar_pci->pipe_info[pipe_id]);
+        struct ath10k_ce_pipe *ce_hdl = pipe_info->ce_hdl;
         unsigned int len;
         u32 flags = 0;
         int ret;
 
-        memset(&sendlist, 0, sizeof(struct ce_sendlist));
-
         len = min(bytes, nbuf->len);
         bytes -= len;
 
@@ -648,8 +720,6 @@ static int ath10k_pci_hif_send_head(struct ath10k *ar, u8 pipe_id,
                         "ath10k tx: data: ",
                         nbuf->data, nbuf->len);
 
-        ath10k_ce_sendlist_buf_add(&sendlist, skb_cb->paddr, len, flags);
-
         /* Make sure we have resources to handle this request */
         spin_lock_bh(&pipe_info->pipe_lock);
         if (!pipe_info->num_sends_allowed) {
@@ -660,7 +730,8 @@ static int ath10k_pci_hif_send_head(struct ath10k *ar, u8 pipe_id,
         pipe_info->num_sends_allowed--;
         spin_unlock_bh(&pipe_info->pipe_lock);
 
-        ret = ath10k_ce_sendlist_send(ce_hdl, nbuf, &sendlist, transfer_id);
+        ret = ath10k_ce_sendlist_send(ce_hdl, nbuf, transfer_id,
+                                      skb_cb->paddr, len, flags);
         if (ret)
                 ath10k_warn("CE send failed: %p\n", nbuf);
 
@@ -670,7 +741,7 @@ static int ath10k_pci_hif_send_head(struct ath10k *ar, u8 pipe_id,
 static u16 ath10k_pci_hif_get_free_queue_number(struct ath10k *ar, u8 pipe)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct hif_ce_pipe_info *pipe_info = &(ar_pci->pipe_info[pipe]);
+        struct ath10k_pci_pipe *pipe_info = &(ar_pci->pipe_info[pipe]);
         int ret;
 
         spin_lock_bh(&pipe_info->pipe_lock);
@@ -764,9 +835,9 @@ static void ath10k_pci_hif_set_callbacks(struct ath10k *ar,
 static int ath10k_pci_start_ce(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct ce_state *ce_diag = ar_pci->ce_diag;
+        struct ath10k_ce_pipe *ce_diag = ar_pci->ce_diag;
         const struct ce_attr *attr;
-        struct hif_ce_pipe_info *pipe_info;
+        struct ath10k_pci_pipe *pipe_info;
         struct ath10k_pci_compl *compl;
         int i, pipe_num, completions, disable_interrupts;
 
@@ -805,15 +876,14 @@ static int ath10k_pci_start_ce(struct ath10k *ar)
                         continue;
 
                 for (i = 0; i < completions; i++) {
-                        compl = kmalloc(sizeof(struct ath10k_pci_compl),
-                                        GFP_KERNEL);
+                        compl = kmalloc(sizeof(*compl), GFP_KERNEL);
                         if (!compl) {
                                 ath10k_warn("No memory for completion state\n");
                                 ath10k_pci_stop_ce(ar);
                                 return -ENOMEM;
                         }
 
-                        compl->send_or_recv = HIF_CE_COMPLETE_FREE;
+                        compl->state = ATH10K_PCI_COMPL_FREE;
                         list_add_tail(&compl->list, &pipe_info->compl_free);
                 }
         }
@@ -840,7 +910,7 @@ static void ath10k_pci_stop_ce(struct ath10k *ar)
          * their associated resources */
         spin_lock_bh(&ar_pci->compl_lock);
         list_for_each_entry(compl, &ar_pci->compl_process, list) {
-                skb = (struct sk_buff *)compl->transfer_context;
+                skb = compl->skb;
                 ATH10K_SKB_CB(skb)->is_aborted = true;
         }
         spin_unlock_bh(&ar_pci->compl_lock);
@@ -850,7 +920,7 @@ static void ath10k_pci_cleanup_ce(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         struct ath10k_pci_compl *compl, *tmp;
-        struct hif_ce_pipe_info *pipe_info;
+        struct ath10k_pci_pipe *pipe_info;
         struct sk_buff *netbuf;
         int pipe_num;
 
@@ -861,7 +931,7 @@ static void ath10k_pci_cleanup_ce(struct ath10k *ar)
 
         list_for_each_entry_safe(compl, tmp, &ar_pci->compl_process, list) {
                 list_del(&compl->list);
-                netbuf = (struct sk_buff *)compl->transfer_context;
+                netbuf = compl->skb;
                 dev_kfree_skb_any(netbuf);
                 kfree(compl);
         }
@@ -912,12 +982,14 @@ static void ath10k_pci_process_ce(struct ath10k *ar)
                 list_del(&compl->list);
                 spin_unlock_bh(&ar_pci->compl_lock);
 
-                if (compl->send_or_recv == HIF_CE_COMPLETE_SEND) {
+                switch (compl->state) {
+                case ATH10K_PCI_COMPL_SEND:
                         cb->tx_completion(ar,
-                                          compl->transfer_context,
+                                          compl->skb,
                                           compl->transfer_id);
                         send_done = 1;
-                } else {
+                        break;
+                case ATH10K_PCI_COMPL_RECV:
                         ret = ath10k_pci_post_rx_pipe(compl->pipe_info, 1);
                         if (ret) {
                                 ath10k_warn("Unable to post recv buffer for pipe: %d\n",
@@ -925,7 +997,7 @@ static void ath10k_pci_process_ce(struct ath10k *ar)
                                 break;
                         }
 
-                        skb = (struct sk_buff *)compl->transfer_context;
+                        skb = compl->skb;
                         nbytes = compl->nbytes;
 
                         ath10k_dbg(ATH10K_DBG_PCI,
@@ -944,9 +1016,17 @@ static void ath10k_pci_process_ce(struct ath10k *ar)
                                             nbytes,
                                             skb->len + skb_tailroom(skb));
                         }
+                        break;
+                case ATH10K_PCI_COMPL_FREE:
+                        ath10k_warn("free completion cannot be processed\n");
+                        break;
+                default:
+                        ath10k_warn("invalid completion state (%d)\n",
+                                    compl->state);
+                        break;
                 }
 
-                compl->send_or_recv = HIF_CE_COMPLETE_FREE;
+                compl->state = ATH10K_PCI_COMPL_FREE;
 
                 /*
                  * Add completion back to the pipe's free list.
@@ -1037,12 +1117,12 @@ static void ath10k_pci_hif_get_default_pipe(struct ath10k *ar,
                                                  &dl_is_polled);
 }
 
-static int ath10k_pci_post_rx_pipe(struct hif_ce_pipe_info *pipe_info,
+static int ath10k_pci_post_rx_pipe(struct ath10k_pci_pipe *pipe_info,
                                    int num)
 {
         struct ath10k *ar = pipe_info->hif_ce_state;
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct ce_state *ce_state = pipe_info->ce_hdl;
+        struct ath10k_ce_pipe *ce_state = pipe_info->ce_hdl;
         struct sk_buff *skb;
         dma_addr_t ce_data;
         int i, ret = 0;
@@ -1097,7 +1177,7 @@ err:
 static int ath10k_pci_post_rx(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct hif_ce_pipe_info *pipe_info;
+        struct ath10k_pci_pipe *pipe_info;
         const struct ce_attr *attr;
         int pipe_num, ret = 0;
 
@@ -1147,11 +1227,11 @@ static int ath10k_pci_hif_start(struct ath10k *ar)
         return 0;
 }
 
-static void ath10k_pci_rx_pipe_cleanup(struct hif_ce_pipe_info *pipe_info)
+static void ath10k_pci_rx_pipe_cleanup(struct ath10k_pci_pipe *pipe_info)
 {
         struct ath10k *ar;
         struct ath10k_pci *ar_pci;
-        struct ce_state *ce_hdl;
+        struct ath10k_ce_pipe *ce_hdl;
         u32 buf_sz;
         struct sk_buff *netbuf;
         u32 ce_data;
@@ -1179,11 +1259,11 @@ static void ath10k_pci_rx_pipe_cleanup(struct hif_ce_pipe_info *pipe_info)
         }
 }
 
-static void ath10k_pci_tx_pipe_cleanup(struct hif_ce_pipe_info *pipe_info)
+static void ath10k_pci_tx_pipe_cleanup(struct ath10k_pci_pipe *pipe_info)
 {
         struct ath10k *ar;
         struct ath10k_pci *ar_pci;
-        struct ce_state *ce_hdl;
+        struct ath10k_ce_pipe *ce_hdl;
         struct sk_buff *netbuf;
         u32 ce_data;
         unsigned int nbytes;
@@ -1206,15 +1286,14 @@ static void ath10k_pci_tx_pipe_cleanup(struct hif_ce_pipe_info *pipe_info)
 
         while (ath10k_ce_cancel_send_next(ce_hdl, (void **)&netbuf,
                                           &ce_data, &nbytes, &id) == 0) {
-                if (netbuf != CE_SENDLIST_ITEM_CTXT)
-                        /*
-                         * Indicate the completion to higer layer to free
-                         * the buffer
-                         */
-                        ATH10K_SKB_CB(netbuf)->is_aborted = true;
-                        ar_pci->msg_callbacks_current.tx_completion(ar,
-                                                                    netbuf,
-                                                                    id);
+                /*
+                 * Indicate the completion to higer layer to free
+                 * the buffer
+                 */
+                ATH10K_SKB_CB(netbuf)->is_aborted = true;
+                ar_pci->msg_callbacks_current.tx_completion(ar,
+                                                            netbuf,
+                                                            id);
         }
 }
 
@@ -1232,7 +1311,7 @@ static void ath10k_pci_buffer_cleanup(struct ath10k *ar)
         int pipe_num;
 
         for (pipe_num = 0; pipe_num < ar_pci->ce_count; pipe_num++) {
-                struct hif_ce_pipe_info *pipe_info;
+                struct ath10k_pci_pipe *pipe_info;
 
                 pipe_info = &ar_pci->pipe_info[pipe_num];
                 ath10k_pci_rx_pipe_cleanup(pipe_info);
@@ -1243,7 +1322,7 @@ static void ath10k_pci_buffer_cleanup(struct ath10k *ar)
 static void ath10k_pci_ce_deinit(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct hif_ce_pipe_info *pipe_info;
+        struct ath10k_pci_pipe *pipe_info;
         int pipe_num;
 
         for (pipe_num = 0; pipe_num < ar_pci->ce_count; pipe_num++) {
@@ -1293,8 +1372,10 @@ static int ath10k_pci_hif_exchange_bmi_msg(struct ath10k *ar,
                                            void *resp, u32 *resp_len)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct ce_state *ce_tx = ar_pci->pipe_info[BMI_CE_NUM_TO_TARG].ce_hdl;
-        struct ce_state *ce_rx = ar_pci->pipe_info[BMI_CE_NUM_TO_HOST].ce_hdl;
+        struct ath10k_pci_pipe *pci_tx = &ar_pci->pipe_info[BMI_CE_NUM_TO_TARG];
+        struct ath10k_pci_pipe *pci_rx = &ar_pci->pipe_info[BMI_CE_NUM_TO_HOST];
+        struct ath10k_ce_pipe *ce_tx = pci_tx->ce_hdl;
+        struct ath10k_ce_pipe *ce_rx = pci_rx->ce_hdl;
         dma_addr_t req_paddr = 0;
         dma_addr_t resp_paddr = 0;
         struct bmi_xfer xfer = {};
@@ -1378,13 +1459,16 @@ err_dma:
         return ret;
 }
 
-static void ath10k_pci_bmi_send_done(struct ce_state *ce_state,
-                                     void *transfer_context,
-                                     u32 data,
-                                     unsigned int nbytes,
-                                     unsigned int transfer_id)
+static void ath10k_pci_bmi_send_done(struct ath10k_ce_pipe *ce_state)
 {
-        struct bmi_xfer *xfer = transfer_context;
+        struct bmi_xfer *xfer;
+        u32 ce_data;
+        unsigned int nbytes;
+        unsigned int transfer_id;
+
+        if (ath10k_ce_completed_send_next(ce_state, (void **)&xfer, &ce_data,
+                                          &nbytes, &transfer_id))
+                return;
 
         if (xfer->wait_for_resp)
                 return;
@@ -1392,14 +1476,17 @@ static void ath10k_pci_bmi_send_done(struct ce_state *ce_state,
         complete(&xfer->done);
 }
 
-static void ath10k_pci_bmi_recv_data(struct ce_state *ce_state,
-                                     void *transfer_context,
-                                     u32 data,
-                                     unsigned int nbytes,
-                                     unsigned int transfer_id,
-                                     unsigned int flags)
+static void ath10k_pci_bmi_recv_data(struct ath10k_ce_pipe *ce_state)
 {
-        struct bmi_xfer *xfer = transfer_context;
+        struct bmi_xfer *xfer;
+        u32 ce_data;
+        unsigned int nbytes;
+        unsigned int transfer_id;
+        unsigned int flags;
+
+        if (ath10k_ce_completed_recv_next(ce_state, (void **)&xfer, &ce_data,
+                                          &nbytes, &transfer_id, &flags))
+                return;
 
         if (!xfer->wait_for_resp) {
                 ath10k_warn("unexpected: BMI data received; ignoring\n");
@@ -1679,7 +1766,7 @@ static int ath10k_pci_init_config(struct ath10k *ar)
 static int ath10k_pci_ce_init(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct hif_ce_pipe_info *pipe_info;
+        struct ath10k_pci_pipe *pipe_info;
         const struct ce_attr *attr;
         int pipe_num;
 
@@ -1895,7 +1982,7 @@ static const struct ath10k_hif_ops ath10k_pci_hif_ops = {
 
 static void ath10k_pci_ce_tasklet(unsigned long ptr)
 {
-        struct hif_ce_pipe_info *pipe = (struct hif_ce_pipe_info *)ptr;
+        struct ath10k_pci_pipe *pipe = (struct ath10k_pci_pipe *)ptr;
         struct ath10k_pci *ar_pci = pipe->ar_pci;
 
         ath10k_ce_per_engine_service(ar_pci->ar, pipe->pipe_num);
@@ -2212,18 +2299,13 @@ static int ath10k_pci_reset_target(struct ath10k *ar)
 
 static void ath10k_pci_device_reset(struct ath10k *ar)
 {
-        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        void __iomem *mem = ar_pci->mem;
         int i;
         u32 val;
 
         if (!SOC_GLOBAL_RESET_ADDRESS)
                 return;
 
-        if (!mem)
-                return;
-
-        ath10k_pci_reg_write32(mem, PCIE_SOC_WAKE_ADDRESS,
+        ath10k_pci_reg_write32(ar, PCIE_SOC_WAKE_ADDRESS,
                                PCIE_SOC_WAKE_V_MASK);
         for (i = 0; i < ATH_PCI_RESET_WAIT_MAX; i++) {
                 if (ath10k_pci_target_is_awake(ar))
@@ -2232,12 +2314,12 @@ static void ath10k_pci_device_reset(struct ath10k *ar)
         }
 
         /* Put Target, including PCIe, into RESET. */
-        val = ath10k_pci_reg_read32(mem, SOC_GLOBAL_RESET_ADDRESS);
+        val = ath10k_pci_reg_read32(ar, SOC_GLOBAL_RESET_ADDRESS);
         val |= 1;
-        ath10k_pci_reg_write32(mem, SOC_GLOBAL_RESET_ADDRESS, val);
+        ath10k_pci_reg_write32(ar, SOC_GLOBAL_RESET_ADDRESS, val);
 
         for (i = 0; i < ATH_PCI_RESET_WAIT_MAX; i++) {
-                if (ath10k_pci_reg_read32(mem, RTC_STATE_ADDRESS) &
+                if (ath10k_pci_reg_read32(ar, RTC_STATE_ADDRESS) &
                                           RTC_STATE_COLD_RESET_MASK)
                         break;
                 msleep(1);
@@ -2245,16 +2327,16 @@ static void ath10k_pci_device_reset(struct ath10k *ar)
 
         /* Pull Target, including PCIe, out of RESET. */
         val &= ~1;
-        ath10k_pci_reg_write32(mem, SOC_GLOBAL_RESET_ADDRESS, val);
+        ath10k_pci_reg_write32(ar, SOC_GLOBAL_RESET_ADDRESS, val);
 
         for (i = 0; i < ATH_PCI_RESET_WAIT_MAX; i++) {
-                if (!(ath10k_pci_reg_read32(mem, RTC_STATE_ADDRESS) &
+                if (!(ath10k_pci_reg_read32(ar, RTC_STATE_ADDRESS) &
                                             RTC_STATE_COLD_RESET_MASK))
                         break;
                 msleep(1);
         }
 
-        ath10k_pci_reg_write32(mem, PCIE_SOC_WAKE_ADDRESS, PCIE_SOC_WAKE_RESET);
+        ath10k_pci_reg_write32(ar, PCIE_SOC_WAKE_ADDRESS, PCIE_SOC_WAKE_RESET);
 }
 
 static void ath10k_pci_dump_features(struct ath10k_pci *ar_pci)
@@ -2267,13 +2349,10 @@ static void ath10k_pci_dump_features(struct ath10k_pci *ar_pci)
 
                 switch (i) {
                 case ATH10K_PCI_FEATURE_MSI_X:
-                        ath10k_dbg(ATH10K_DBG_PCI, "device supports MSI-X\n");
-                        break;
-                case ATH10K_PCI_FEATURE_HW_1_0_WORKAROUND:
-                        ath10k_dbg(ATH10K_DBG_PCI, "QCA988X_1.0 workaround enabled\n");
+                        ath10k_dbg(ATH10K_DBG_BOOT, "device supports MSI-X\n");
                         break;
                 case ATH10K_PCI_FEATURE_SOC_POWER_SAVE:
-                        ath10k_dbg(ATH10K_DBG_PCI, "QCA98XX SoC power save enabled\n");
+                        ath10k_dbg(ATH10K_DBG_BOOT, "QCA98XX SoC power save enabled\n");
                         break;
                 }
         }
@@ -2286,7 +2365,7 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
         int ret = 0;
         struct ath10k *ar;
         struct ath10k_pci *ar_pci;
-        u32 lcr_val;
+        u32 lcr_val, chip_id;
 
         ath10k_dbg(ATH10K_DBG_PCI, "%s\n", __func__);
 
@@ -2298,9 +2377,6 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
         ar_pci->dev = &pdev->dev;
 
         switch (pci_dev->device) {
-        case QCA988X_1_0_DEVICE_ID:
-                set_bit(ATH10K_PCI_FEATURE_HW_1_0_WORKAROUND, ar_pci->features);
-                break;
         case QCA988X_2_0_DEVICE_ID:
                 set_bit(ATH10K_PCI_FEATURE_MSI_X, ar_pci->features);
                 break;
@@ -2322,10 +2398,6 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
                 goto err_ar_pci;
         }
 
-        /* Enable QCA988X_1.0 HW workarounds */
-        if (test_bit(ATH10K_PCI_FEATURE_HW_1_0_WORKAROUND, ar_pci->features))
-                spin_lock_init(&ar_pci->hw_v1_workaround_lock);
-
         ar_pci->ar = ar;
         ar_pci->fw_indicator_address = FW_INDICATOR_ADDRESS;
         atomic_set(&ar_pci->keep_awake_count, 0);
@@ -2395,9 +2467,20 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
 
         spin_lock_init(&ar_pci->ce_lock);
 
-        ar_pci->cacheline_sz = dma_get_cache_alignment();
+        ret = ath10k_do_pci_wake(ar);
+        if (ret) {
+                ath10k_err("Failed to get chip id: %d\n", ret);
+                return ret;
+        }
+
+        chip_id = ath10k_pci_read32(ar,
+                                    RTC_SOC_BASE_ADDRESS + SOC_CHIP_ID_ADDRESS);
+
+        ath10k_do_pci_sleep(ar);
+
+        ath10k_dbg(ATH10K_DBG_BOOT, "boot pci_mem 0x%p\n", ar_pci->mem);
 
-        ret = ath10k_core_register(ar);
+        ret = ath10k_core_register(ar, chip_id);
         if (ret) {
                 ath10k_err("could not register driver core (%d)\n", ret);
                 goto err_iomap;
@@ -2414,7 +2497,6 @@ err_region:
 err_device:
         pci_disable_device(pdev);
 err_ar:
-        pci_set_drvdata(pdev, NULL);
         ath10k_core_destroy(ar);
 err_ar_pci:
         /* call HIF PCI free here */
@@ -2442,7 +2524,6 @@ static void ath10k_pci_remove(struct pci_dev *pdev)
 
         ath10k_core_unregister(ar);
 
-        pci_set_drvdata(pdev, NULL);
         pci_iounmap(pdev, ar_pci->mem);
         pci_release_region(pdev, BAR_NUM);
         pci_clear_master(pdev);
@@ -2483,9 +2564,6 @@ module_exit(ath10k_pci_exit);
 MODULE_AUTHOR("Qualcomm Atheros");
 MODULE_DESCRIPTION("Driver support for Atheros QCA988X PCIe devices");
 MODULE_LICENSE("Dual BSD/GPL");
-MODULE_FIRMWARE(QCA988X_HW_1_0_FW_DIR "/" QCA988X_HW_1_0_FW_FILE);
-MODULE_FIRMWARE(QCA988X_HW_1_0_FW_DIR "/" QCA988X_HW_1_0_OTP_FILE);
-MODULE_FIRMWARE(QCA988X_HW_1_0_FW_DIR "/" QCA988X_HW_1_0_BOARD_DATA_FILE);
 MODULE_FIRMWARE(QCA988X_HW_2_0_FW_DIR "/" QCA988X_HW_2_0_FW_FILE);
 MODULE_FIRMWARE(QCA988X_HW_2_0_FW_DIR "/" QCA988X_HW_2_0_OTP_FILE);
 MODULE_FIRMWARE(QCA988X_HW_2_0_FW_DIR "/" QCA988X_HW_2_0_BOARD_DATA_FILE);
diff --git a/drivers/net/wireless/ath/ath10k/pci.h b/drivers/net/wireless/ath/ath10k/pci.h
index 871bb339d56d..7c49f6f96f70 100644
--- a/drivers/net/wireless/ath/ath10k/pci.h
+++ b/drivers/net/wireless/ath/ath10k/pci.h
@@ -43,22 +43,23 @@ struct bmi_xfer {
         u32 resp_len;
 };
 
+enum ath10k_pci_compl_state {
+        ATH10K_PCI_COMPL_FREE = 0,
+        ATH10K_PCI_COMPL_SEND,
+        ATH10K_PCI_COMPL_RECV,
+};
+
 struct ath10k_pci_compl {
         struct list_head list;
-        int send_or_recv;
-        struct ce_state *ce_state;
-        struct hif_ce_pipe_info *pipe_info;
-        void *transfer_context;
+        enum ath10k_pci_compl_state state;
+        struct ath10k_ce_pipe *ce_state;
+        struct ath10k_pci_pipe *pipe_info;
+        struct sk_buff *skb;
         unsigned int nbytes;
         unsigned int transfer_id;
         unsigned int flags;
 };
 
-/* compl_state.send_or_recv */
-#define HIF_CE_COMPLETE_FREE 0
-#define HIF_CE_COMPLETE_SEND 1
-#define HIF_CE_COMPLETE_RECV 2
-
 /*
  * PCI-specific Target state
  *
@@ -152,17 +153,16 @@ struct service_to_pipe {
 
 enum ath10k_pci_features {
         ATH10K_PCI_FEATURE_MSI_X                = 0,
-        ATH10K_PCI_FEATURE_HW_1_0_WORKAROUND    = 1,
-        ATH10K_PCI_FEATURE_SOC_POWER_SAVE       = 2,
+        ATH10K_PCI_FEATURE_SOC_POWER_SAVE       = 1,
 
         /* keep last */
         ATH10K_PCI_FEATURE_COUNT
 };
 
 /* Per-pipe state. */
-struct hif_ce_pipe_info {
+struct ath10k_pci_pipe {
         /* Handle of underlying Copy Engine */
-        struct ce_state *ce_hdl;
+        struct ath10k_ce_pipe *ce_hdl;
 
         /* Our pipe number; facilitiates use of pipe_info ptrs. */
         u8 pipe_num;
@@ -190,7 +190,6 @@ struct ath10k_pci {
         struct device *dev;
         struct ath10k *ar;
         void __iomem *mem;
-        int cacheline_sz;
 
         DECLARE_BITMAP(features, ATH10K_PCI_FEATURE_COUNT);
 
@@ -219,7 +218,7 @@ struct ath10k_pci {
 
         bool compl_processing;
 
-        struct hif_ce_pipe_info pipe_info[CE_COUNT_MAX];
+        struct ath10k_pci_pipe pipe_info[CE_COUNT_MAX];
 
         struct ath10k_hif_cb msg_callbacks_current;
 
@@ -227,16 +226,13 @@ struct ath10k_pci {
         u32 fw_indicator_address;
 
         /* Copy Engine used for Diagnostic Accesses */
-        struct ce_state *ce_diag;
+        struct ath10k_ce_pipe *ce_diag;
 
         /* FIXME: document what this really protects */
         spinlock_t ce_lock;
 
         /* Map CE id to ce_state */
-        struct ce_state *ce_id_to_state[CE_COUNT_MAX];
-
-        /* makes sure that dummy reads are atomic */
-        spinlock_t hw_v1_workaround_lock;
+        struct ath10k_ce_pipe ce_states[CE_COUNT_MAX];
 };
 
 static inline struct ath10k_pci *ath10k_pci_priv(struct ath10k *ar)
@@ -244,14 +240,18 @@ static inline struct ath10k_pci *ath10k_pci_priv(struct ath10k *ar)
         return ar->hif.priv;
 }
 
-static inline u32 ath10k_pci_reg_read32(void __iomem *mem, u32 addr)
+static inline u32 ath10k_pci_reg_read32(struct ath10k *ar, u32 addr)
 {
-        return ioread32(mem + PCIE_LOCAL_BASE_ADDRESS + addr);
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+
+        return ioread32(ar_pci->mem + PCIE_LOCAL_BASE_ADDRESS + addr);
 }
 
-static inline void ath10k_pci_reg_write32(void __iomem *mem, u32 addr, u32 val)
+static inline void ath10k_pci_reg_write32(struct ath10k *ar, u32 addr, u32 val)
 {
-        iowrite32(val, mem + PCIE_LOCAL_BASE_ADDRESS + addr);
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+
+        iowrite32(val, ar_pci->mem + PCIE_LOCAL_BASE_ADDRESS + addr);
 }
 
 #define ATH_PCI_RESET_WAIT_MAX 10 /* ms */
@@ -310,23 +310,8 @@ static inline void ath10k_pci_write32(struct ath10k *ar, u32 offset,
                                       u32 value)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        void __iomem *addr = ar_pci->mem;
-
-        if (test_bit(ATH10K_PCI_FEATURE_HW_1_0_WORKAROUND, ar_pci->features)) {
-                unsigned long irq_flags;
 
-                spin_lock_irqsave(&ar_pci->hw_v1_workaround_lock, irq_flags);
-
-                ioread32(addr+offset+4); /* 3rd read prior to write */
-                ioread32(addr+offset+4); /* 2nd read prior to write */
-                ioread32(addr+offset+4); /* 1st read prior to write */
-                iowrite32(value, addr+offset);
-
-                spin_unlock_irqrestore(&ar_pci->hw_v1_workaround_lock,
-                                       irq_flags);
-        } else {
-                iowrite32(value, addr+offset);
-        }
+        iowrite32(value, ar_pci->mem + offset);
 }
 
 static inline u32 ath10k_pci_read32(struct ath10k *ar, u32 offset)
@@ -336,15 +321,17 @@ static inline u32 ath10k_pci_read32(struct ath10k *ar, u32 offset)
         return ioread32(ar_pci->mem + offset);
 }
 
-void ath10k_do_pci_wake(struct ath10k *ar);
+int ath10k_do_pci_wake(struct ath10k *ar);
 void ath10k_do_pci_sleep(struct ath10k *ar);
 
-static inline void ath10k_pci_wake(struct ath10k *ar)
+static inline int ath10k_pci_wake(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
 
         if (test_bit(ATH10K_PCI_FEATURE_SOC_POWER_SAVE, ar_pci->features))
-                ath10k_do_pci_wake(ar);
+                return ath10k_do_pci_wake(ar);
+
+        return 0;
 }
 
 static inline void ath10k_pci_sleep(struct ath10k *ar)
diff --git a/drivers/net/wireless/ath/ath10k/rx_desc.h b/drivers/net/wireless/ath/ath10k/rx_desc.h
index bfec6c8f2ecb..1c584c4b019c 100644
--- a/drivers/net/wireless/ath/ath10k/rx_desc.h
+++ b/drivers/net/wireless/ath/ath10k/rx_desc.h
@@ -422,10 +422,30 @@ struct rx_mpdu_end {
 #define RX_MSDU_START_INFO1_IP_FRAG             (1 << 14)
 #define RX_MSDU_START_INFO1_TCP_ONLY_ACK        (1 << 15)
 
+/* The decapped header (rx_hdr_status) contains the following:
+ *  a) 802.11 header
+ *  [padding to 4 bytes]
+ *  b) HW crypto parameter
+ *     - 0 bytes for no security
+ *     - 4 bytes for WEP
+ *     - 8 bytes for TKIP, AES
+ *  [padding to 4 bytes]
+ *  c) A-MSDU subframe header (14 bytes) if appliable
+ *  d) LLC/SNAP (RFC1042, 8 bytes)
+ *
+ * In case of A-MSDU only first frame in sequence contains (a) and (b). */
 enum rx_msdu_decap_format {
-        RX_MSDU_DECAP_RAW           = 0,
-        RX_MSDU_DECAP_NATIVE_WIFI   = 1,
+        RX_MSDU_DECAP_RAW = 0,
+
+        /* Note: QoS frames are reported as non-QoS. The rx_hdr_status in
+         * htt_rx_desc contains the original decapped 802.11 header. */
+        RX_MSDU_DECAP_NATIVE_WIFI = 1,
+
+        /* Payload contains an ethernet header (struct ethhdr). */
         RX_MSDU_DECAP_ETHERNET2_DIX = 2,
+
+        /* Payload contains two 48-bit addresses and 2-byte length (14 bytes
+         * total), followed by an RFC1042 header (8 bytes). */
         RX_MSDU_DECAP_8023_SNAP_LLC = 3
 };
 
diff --git a/drivers/net/wireless/ath/ath10k/trace.h b/drivers/net/wireless/ath/ath10k/trace.h
index 85e806bf7257..90817ddc92ba 100644
--- a/drivers/net/wireless/ath/ath10k/trace.h
+++ b/drivers/net/wireless/ath/ath10k/trace.h
@@ -111,26 +111,29 @@ TRACE_EVENT(ath10k_log_dbg_dump,
 );
 
 TRACE_EVENT(ath10k_wmi_cmd,
-        TP_PROTO(int id, void *buf, size_t buf_len),
+        TP_PROTO(int id, void *buf, size_t buf_len, int ret),
 
-        TP_ARGS(id, buf, buf_len),
+        TP_ARGS(id, buf, buf_len, ret),
 
         TP_STRUCT__entry(
                 __field(unsigned int, id)
                 __field(size_t, buf_len)
                 __dynamic_array(u8, buf, buf_len)
+                __field(int, ret)
         ),
 
         TP_fast_assign(
                 __entry->id = id;
                 __entry->buf_len = buf_len;
+                __entry->ret = ret;
                 memcpy(__get_dynamic_array(buf), buf, buf_len);
         ),
 
         TP_printk(
-                "id %d len %zu",
+                "id %d len %zu ret %d",
                 __entry->id,
-                __entry->buf_len
+                __entry->buf_len,
+                __entry->ret
         )
 );
 
@@ -158,6 +161,27 @@ TRACE_EVENT(ath10k_wmi_event,
         )
 );
 
+TRACE_EVENT(ath10k_htt_stats,
+        TP_PROTO(void *buf, size_t buf_len),
+
+        TP_ARGS(buf, buf_len),
+
+        TP_STRUCT__entry(
+                __field(size_t, buf_len)
+                __dynamic_array(u8, buf, buf_len)
+        ),
+
+        TP_fast_assign(
+                __entry->buf_len = buf_len;
+                memcpy(__get_dynamic_array(buf), buf, buf_len);
+        ),
+
+        TP_printk(
+                "len %zu",
+                __entry->buf_len
+        )
+);
+
 #endif /* _TRACE_H_ || TRACE_HEADER_MULTI_READ*/
 
 /* we don't want to use include/trace/events */
diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c
index 68b6faefd1d8..5ae373a1e294 100644
--- a/drivers/net/wireless/ath/ath10k/txrx.c
+++ b/drivers/net/wireless/ath/ath10k/txrx.c
@@ -44,40 +44,39 @@ out:
         spin_unlock_bh(&ar->data_lock);
 }
 
-void ath10k_txrx_tx_unref(struct ath10k_htt *htt, struct sk_buff *txdesc)
+void ath10k_txrx_tx_unref(struct ath10k_htt *htt,
+                          const struct htt_tx_done *tx_done)
 {
         struct device *dev = htt->ar->dev;
         struct ieee80211_tx_info *info;
-        struct sk_buff *txfrag = ATH10K_SKB_CB(txdesc)->htt.txfrag;
-        struct sk_buff *msdu = ATH10K_SKB_CB(txdesc)->htt.msdu;
+        struct ath10k_skb_cb *skb_cb;
+        struct sk_buff *msdu;
         int ret;
 
-        if (ATH10K_SKB_CB(txdesc)->htt.refcount == 0)
-                return;
-
-        ATH10K_SKB_CB(txdesc)->htt.refcount--;
+        ath10k_dbg(ATH10K_DBG_HTT, "htt tx completion msdu_id %u discard %d no_ack %d\n",
+                   tx_done->msdu_id, !!tx_done->discard, !!tx_done->no_ack);
 
-        if (ATH10K_SKB_CB(txdesc)->htt.refcount > 0)
+        if (tx_done->msdu_id >= htt->max_num_pending_tx) {
+                ath10k_warn("warning: msdu_id %d too big, ignoring\n",
+                            tx_done->msdu_id);
                 return;
-
-        if (txfrag) {
-                ret = ath10k_skb_unmap(dev, txfrag);
-                if (ret)
-                        ath10k_warn("txfrag unmap failed (%d)\n", ret);
-
-                dev_kfree_skb_any(txfrag);
         }
 
+        msdu = htt->pending_tx[tx_done->msdu_id];
+        skb_cb = ATH10K_SKB_CB(msdu);
+
         ret = ath10k_skb_unmap(dev, msdu);
         if (ret)
                 ath10k_warn("data skb unmap failed (%d)\n", ret);
 
+        if (skb_cb->htt.frag_len)
+                skb_pull(msdu, skb_cb->htt.frag_len + skb_cb->htt.pad_len);
+
         ath10k_report_offchan_tx(htt->ar, msdu);
 
         info = IEEE80211_SKB_CB(msdu);
-        memset(&info->status, 0, sizeof(info->status));
 
-        if (ATH10K_SKB_CB(txdesc)->htt.discard) {
+        if (tx_done->discard) {
                 ieee80211_free_txskb(htt->ar->hw, msdu);
                 goto exit;
         }
@@ -85,7 +84,7 @@ void ath10k_txrx_tx_unref(struct ath10k_htt *htt, struct sk_buff *txdesc)
         if (!(info->flags & IEEE80211_TX_CTL_NO_ACK))
                 info->flags |= IEEE80211_TX_STAT_ACK;
 
-        if (ATH10K_SKB_CB(txdesc)->htt.no_ack)
+        if (tx_done->no_ack)
                 info->flags &= ~IEEE80211_TX_STAT_ACK;
 
         ieee80211_tx_status(htt->ar->hw, msdu);
@@ -93,36 +92,12 @@ void ath10k_txrx_tx_unref(struct ath10k_htt *htt, struct sk_buff *txdesc)
 
 exit:
         spin_lock_bh(&htt->tx_lock);
-        htt->pending_tx[ATH10K_SKB_CB(txdesc)->htt.msdu_id] = NULL;
-        ath10k_htt_tx_free_msdu_id(htt, ATH10K_SKB_CB(txdesc)->htt.msdu_id);
+        htt->pending_tx[tx_done->msdu_id] = NULL;
+        ath10k_htt_tx_free_msdu_id(htt, tx_done->msdu_id);
         __ath10k_htt_tx_dec_pending(htt);
-        if (bitmap_empty(htt->used_msdu_ids, htt->max_num_pending_tx))
+        if (htt->num_pending_tx == 0)
                 wake_up(&htt->empty_tx_wq);
         spin_unlock_bh(&htt->tx_lock);
-
-        dev_kfree_skb_any(txdesc);
-}
-
-void ath10k_txrx_tx_completed(struct ath10k_htt *htt,
-                              const struct htt_tx_done *tx_done)
-{
-        struct sk_buff *txdesc;
-
-        ath10k_dbg(ATH10K_DBG_HTT, "htt tx completion msdu_id %u discard %d no_ack %d\n",
-                   tx_done->msdu_id, !!tx_done->discard, !!tx_done->no_ack);
-
-        if (tx_done->msdu_id >= htt->max_num_pending_tx) {
-                ath10k_warn("warning: msdu_id %d too big, ignoring\n",
-                            tx_done->msdu_id);
-                return;
-        }
-
-        txdesc = htt->pending_tx[tx_done->msdu_id];
-
-        ATH10K_SKB_CB(txdesc)->htt.discard = tx_done->discard;
-        ATH10K_SKB_CB(txdesc)->htt.no_ack = tx_done->no_ack;
-
-        ath10k_txrx_tx_unref(htt, txdesc);
 }
 
 static const u8 rx_legacy_rate_idx[] = {
@@ -293,6 +268,8 @@ void ath10k_process_rx(struct ath10k *ar, struct htt_rx_info *info)
                    status->vht_nss,
                    status->freq,
                    status->band);
+        ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "rx skb: ",
+                        info->skb->data, info->skb->len);
 
         ieee80211_rx(ar->hw, info->skb);
 }
diff --git a/drivers/net/wireless/ath/ath10k/txrx.h b/drivers/net/wireless/ath/ath10k/txrx.h
index e78632a76df7..356dc9c04c9e 100644
--- a/drivers/net/wireless/ath/ath10k/txrx.h
+++ b/drivers/net/wireless/ath/ath10k/txrx.h
@@ -19,9 +19,8 @@
 
 #include "htt.h"
 
-void ath10k_txrx_tx_unref(struct ath10k_htt *htt, struct sk_buff *txdesc);
-void ath10k_txrx_tx_completed(struct ath10k_htt *htt,
-                              const struct htt_tx_done *tx_done);
+void ath10k_txrx_tx_unref(struct ath10k_htt *htt,
+                          const struct htt_tx_done *tx_done);
 void ath10k_process_rx(struct ath10k *ar, struct htt_rx_info *info);
 
 struct ath10k_peer *ath10k_peer_find(struct ath10k *ar, int vdev_id,
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index 55f90c761868..6803ead9b9cf 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -23,30 +23,6 @@
 #include "wmi.h"
 #include "mac.h"
 
-void ath10k_wmi_flush_tx(struct ath10k *ar)
-{
-        int ret;
-
-        lockdep_assert_held(&ar->conf_mutex);
-
-        if (ar->state == ATH10K_STATE_WEDGED) {
-                ath10k_warn("wmi flush skipped - device is wedged anyway\n");
-                return;
-        }
-
-        ret = wait_event_timeout(ar->wmi.wq,
-                                 atomic_read(&ar->wmi.pending_tx_count) == 0,
-                                 5*HZ);
-        if (atomic_read(&ar->wmi.pending_tx_count) == 0)
-                return;
-
-        if (ret == 0)
-                ret = -ETIMEDOUT;
-
-        if (ret < 0)
-                ath10k_warn("wmi flush failed (%d)\n", ret);
-}
-
 int ath10k_wmi_wait_for_service_ready(struct ath10k *ar)
 {
         int ret;
@@ -85,18 +61,14 @@ static struct sk_buff *ath10k_wmi_alloc_skb(u32 len)
 static void ath10k_wmi_htc_tx_complete(struct ath10k *ar, struct sk_buff *skb)
 {
         dev_kfree_skb(skb);
-
-        if (atomic_sub_return(1, &ar->wmi.pending_tx_count) == 0)
-                wake_up(&ar->wmi.wq);
 }
 
-/* WMI command API */
-static int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb,
-                               enum wmi_cmd_id cmd_id)
+static int ath10k_wmi_cmd_send_nowait(struct ath10k *ar, struct sk_buff *skb,
+                                      enum wmi_cmd_id cmd_id)
 {
         struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(skb);
         struct wmi_cmd_hdr *cmd_hdr;
-        int status;
+        int ret;
         u32 cmd = 0;
 
         if (skb_push(skb, sizeof(struct wmi_cmd_hdr)) == NULL)
@@ -107,25 +79,87 @@ static int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb,
         cmd_hdr = (struct wmi_cmd_hdr *)skb->data;
         cmd_hdr->cmd_id = __cpu_to_le32(cmd);
 
-        if (atomic_add_return(1, &ar->wmi.pending_tx_count) >
-            WMI_MAX_PENDING_TX_COUNT) {
-                /* avoid using up memory when FW hangs */
-                atomic_dec(&ar->wmi.pending_tx_count);
-                return -EBUSY;
-        }
-
         memset(skb_cb, 0, sizeof(*skb_cb));
+        ret = ath10k_htc_send(&ar->htc, ar->wmi.eid, skb);
+        trace_ath10k_wmi_cmd(cmd_id, skb->data, skb->len, ret);
 
-        trace_ath10k_wmi_cmd(cmd_id, skb->data, skb->len);
+        if (ret)
+                goto err_pull;
 
-        status = ath10k_htc_send(&ar->htc, ar->wmi.eid, skb);
-        if (status) {
+        return 0;
+
+err_pull:
+        skb_pull(skb, sizeof(struct wmi_cmd_hdr));
+        return ret;
+}
+
+static void ath10k_wmi_tx_beacon_nowait(struct ath10k_vif *arvif)
+{
+        struct wmi_bcn_tx_arg arg = {0};
+        int ret;
+
+        lockdep_assert_held(&arvif->ar->data_lock);
+
+        if (arvif->beacon == NULL)
+                return;
+
+        arg.vdev_id = arvif->vdev_id;
+        arg.tx_rate = 0;
+        arg.tx_power = 0;
+        arg.bcn = arvif->beacon->data;
+        arg.bcn_len = arvif->beacon->len;
+
+        ret = ath10k_wmi_beacon_send_nowait(arvif->ar, &arg);
+        if (ret)
+                return;
+
+        dev_kfree_skb_any(arvif->beacon);
+        arvif->beacon = NULL;
+}
+
+static void ath10k_wmi_tx_beacons_iter(void *data, u8 *mac,
+                                       struct ieee80211_vif *vif)
+{
+        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
+
+        ath10k_wmi_tx_beacon_nowait(arvif);
+}
+
+static void ath10k_wmi_tx_beacons_nowait(struct ath10k *ar)
+{
+        spin_lock_bh(&ar->data_lock);
+        ieee80211_iterate_active_interfaces_atomic(ar->hw,
+                                                   IEEE80211_IFACE_ITER_NORMAL,
+                                                   ath10k_wmi_tx_beacons_iter,
+                                                   NULL);
+        spin_unlock_bh(&ar->data_lock);
+}
+
+static void ath10k_wmi_op_ep_tx_credits(struct ath10k *ar)
+{
+        /* try to send pending beacons first. they take priority */
+        ath10k_wmi_tx_beacons_nowait(ar);
+
+        wake_up(&ar->wmi.tx_credits_wq);
+}
+
+static int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb,
+                               enum wmi_cmd_id cmd_id)
+{
+        int ret = -EINVAL;
+
+        wait_event_timeout(ar->wmi.tx_credits_wq, ({
+                /* try to send pending beacons first. they take priority */
+                ath10k_wmi_tx_beacons_nowait(ar);
+
+                ret = ath10k_wmi_cmd_send_nowait(ar, skb, cmd_id);
+                (ret != -EAGAIN);
+        }), 3*HZ);
+
+        if (ret)
                 dev_kfree_skb_any(skb);
-                atomic_dec(&ar->wmi.pending_tx_count);
-                return status;
-        }
 
-        return 0;
+        return ret;
 }
 
 static int ath10k_wmi_event_scan(struct ath10k *ar, struct sk_buff *skb)
@@ -315,7 +349,9 @@ static inline u8 get_rate_idx(u32 rate, enum ieee80211_band band)
 
 static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
 {
-        struct wmi_mgmt_rx_event *event = (struct wmi_mgmt_rx_event *)skb->data;
+        struct wmi_mgmt_rx_event_v1 *ev_v1;
+        struct wmi_mgmt_rx_event_v2 *ev_v2;
+        struct wmi_mgmt_rx_hdr_v1 *ev_hdr;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_hdr *hdr;
         u32 rx_status;
@@ -325,13 +361,24 @@ static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
         u32 rate;
         u32 buf_len;
         u16 fc;
+        int pull_len;
+
+        if (test_bit(ATH10K_FW_FEATURE_EXT_WMI_MGMT_RX, ar->fw_features)) {
+                ev_v2 = (struct wmi_mgmt_rx_event_v2 *)skb->data;
+                ev_hdr = &ev_v2->hdr.v1;
+                pull_len = sizeof(*ev_v2);
+        } else {
+                ev_v1 = (struct wmi_mgmt_rx_event_v1 *)skb->data;
+                ev_hdr = &ev_v1->hdr;
+                pull_len = sizeof(*ev_v1);
+        }
 
-        channel   = __le32_to_cpu(event->hdr.channel);
-        buf_len   = __le32_to_cpu(event->hdr.buf_len);
-        rx_status = __le32_to_cpu(event->hdr.status);
-        snr       = __le32_to_cpu(event->hdr.snr);
-        phy_mode  = __le32_to_cpu(event->hdr.phy_mode);
-        rate      = __le32_to_cpu(event->hdr.rate);
+        channel   = __le32_to_cpu(ev_hdr->channel);
+        buf_len   = __le32_to_cpu(ev_hdr->buf_len);
+        rx_status = __le32_to_cpu(ev_hdr->status);
+        snr       = __le32_to_cpu(ev_hdr->snr);
+        phy_mode  = __le32_to_cpu(ev_hdr->phy_mode);
+        rate      = __le32_to_cpu(ev_hdr->rate);
 
         memset(status, 0, sizeof(*status));
 
@@ -358,7 +405,7 @@ static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
         status->signal = snr + ATH10K_DEFAULT_NOISE_FLOOR;
         status->rate_idx = get_rate_idx(rate, status->band);
 
-        skb_pull(skb, sizeof(event->hdr));
+        skb_pull(skb, pull_len);
 
         hdr = (struct ieee80211_hdr *)skb->data;
         fc = le16_to_cpu(hdr->frame_control);
@@ -734,10 +781,8 @@ static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
         int i = -1;
         struct wmi_bcn_info *bcn_info;
         struct ath10k_vif *arvif;
-        struct wmi_bcn_tx_arg arg;
         struct sk_buff *bcn;
         int vdev_id = 0;
-        int ret;
 
         ath10k_dbg(ATH10K_DBG_MGMT, "WMI_HOST_SWBA_EVENTID\n");
 
@@ -794,17 +839,17 @@ static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
                 ath10k_wmi_update_tim(ar, arvif, bcn, bcn_info);
                 ath10k_wmi_update_noa(ar, arvif, bcn, bcn_info);
 
-                arg.vdev_id = arvif->vdev_id;
-                arg.tx_rate = 0;
-                arg.tx_power = 0;
-                arg.bcn = bcn->data;
-                arg.bcn_len = bcn->len;
+                spin_lock_bh(&ar->data_lock);
+                if (arvif->beacon) {
+                        ath10k_warn("SWBA overrun on vdev %d\n",
+                                    arvif->vdev_id);
+                        dev_kfree_skb_any(arvif->beacon);
+                }
 
-                ret = ath10k_wmi_beacon_send(ar, &arg);
-                if (ret)
-                        ath10k_warn("could not send beacon (%d)\n", ret);
+                arvif->beacon = bcn;
 
-                dev_kfree_skb_any(bcn);
+                ath10k_wmi_tx_beacon_nowait(arvif);
+                spin_unlock_bh(&ar->data_lock);
         }
 }
 
@@ -943,6 +988,9 @@ static void ath10k_wmi_service_ready_event_rx(struct ath10k *ar,
         ar->phy_capability = __le32_to_cpu(ev->phy_capability);
         ar->num_rf_chains = __le32_to_cpu(ev->num_rf_chains);
 
+        if (ar->fw_version_build > 636)
+                set_bit(ATH10K_FW_FEATURE_EXT_WMI_MGMT_RX, ar->fw_features);
+
         if (ar->num_rf_chains > WMI_MAX_SPATIAL_STREAM) {
                 ath10k_warn("hardware advertises support for more spatial streams than it should (%d > %d)\n",
                             ar->num_rf_chains, WMI_MAX_SPATIAL_STREAM);
@@ -1007,7 +1055,7 @@ static int ath10k_wmi_ready_event_rx(struct ath10k *ar, struct sk_buff *skb)
         return 0;
 }
 
-static void ath10k_wmi_event_process(struct ath10k *ar, struct sk_buff *skb)
+static void ath10k_wmi_process_rx(struct ath10k *ar, struct sk_buff *skb)
 {
         struct wmi_cmd_hdr *cmd_hdr;
         enum wmi_event_id id;
@@ -1126,64 +1174,18 @@ static void ath10k_wmi_event_process(struct ath10k *ar, struct sk_buff *skb)
         dev_kfree_skb(skb);
 }
 
-static void ath10k_wmi_event_work(struct work_struct *work)
-{
-        struct ath10k *ar = container_of(work, struct ath10k,
-                                         wmi.wmi_event_work);
-        struct sk_buff *skb;
-
-        for (;;) {
-                skb = skb_dequeue(&ar->wmi.wmi_event_list);
-                if (!skb)
-                        break;
-
-                ath10k_wmi_event_process(ar, skb);
-        }
-}
-
-static void ath10k_wmi_process_rx(struct ath10k *ar, struct sk_buff *skb)
-{
-        struct wmi_cmd_hdr *cmd_hdr = (struct wmi_cmd_hdr *)skb->data;
-        enum wmi_event_id event_id;
-
-        event_id = MS(__le32_to_cpu(cmd_hdr->cmd_id), WMI_CMD_HDR_CMD_ID);
-
-        /* some events require to be handled ASAP
-         * thus can't be defered to a worker thread */
-        switch (event_id) {
-        case WMI_HOST_SWBA_EVENTID:
-        case WMI_MGMT_RX_EVENTID:
-                ath10k_wmi_event_process(ar, skb);
-                return;
-        default:
-                break;
-        }
-
-        skb_queue_tail(&ar->wmi.wmi_event_list, skb);
-        queue_work(ar->workqueue, &ar->wmi.wmi_event_work);
-}
-
 /* WMI Initialization functions */
 int ath10k_wmi_attach(struct ath10k *ar)
 {
         init_completion(&ar->wmi.service_ready);
         init_completion(&ar->wmi.unified_ready);
-        init_waitqueue_head(&ar->wmi.wq);
-
-        skb_queue_head_init(&ar->wmi.wmi_event_list);
-        INIT_WORK(&ar->wmi.wmi_event_work, ath10k_wmi_event_work);
+        init_waitqueue_head(&ar->wmi.tx_credits_wq);
 
         return 0;
 }
 
 void ath10k_wmi_detach(struct ath10k *ar)
 {
-        /* HTC should've drained the packets already */
-        if (WARN_ON(atomic_read(&ar->wmi.pending_tx_count) > 0))
-                ath10k_warn("there are still pending packets\n");
-
-        cancel_work_sync(&ar->wmi.wmi_event_work);
-        skb_queue_purge(&ar->wmi.wmi_event_list);
 }
 
 int ath10k_wmi_connect_htc_service(struct ath10k *ar)
@@ -1198,6 +1200,7 @@ int ath10k_wmi_connect_htc_service(struct ath10k *ar)
         /* these fields are the same for all service endpoints */
         conn_req.ep_ops.ep_tx_complete = ath10k_wmi_htc_tx_complete;
         conn_req.ep_ops.ep_rx_complete = ath10k_wmi_process_rx;
+        conn_req.ep_ops.ep_tx_credits = ath10k_wmi_op_ep_tx_credits;
 
         /* connect to control service */
         conn_req.service_id = ATH10K_HTC_SVC_ID_WMI_CONTROL;
@@ -2108,7 +2111,8 @@ int ath10k_wmi_peer_assoc(struct ath10k *ar,
         return ath10k_wmi_cmd_send(ar, skb, WMI_PEER_ASSOC_CMDID);
 }
 
-int ath10k_wmi_beacon_send(struct ath10k *ar, const struct wmi_bcn_tx_arg *arg)
+int ath10k_wmi_beacon_send_nowait(struct ath10k *ar,
+                                  const struct wmi_bcn_tx_arg *arg)
 {
         struct wmi_bcn_tx_cmd *cmd;
         struct sk_buff *skb;
@@ -2124,7 +2128,7 @@ int ath10k_wmi_beacon_send(struct ath10k *ar, const struct wmi_bcn_tx_arg *arg)
         cmd->hdr.bcn_len  = __cpu_to_le32(arg->bcn_len);
         memcpy(cmd->bcn, arg->bcn, arg->bcn_len);
 
-        return ath10k_wmi_cmd_send(ar, skb, WMI_BCN_TX_CMDID);
+        return ath10k_wmi_cmd_send_nowait(ar, skb, WMI_BCN_TX_CMDID);
 }
 
 static void ath10k_wmi_pdev_set_wmm_param(struct wmi_wmm_params *params,
diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h
index 2c5a4f8daf2e..2c52c23107dd 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.h
+++ b/drivers/net/wireless/ath/ath10k/wmi.h
@@ -508,6 +508,48 @@ enum wmi_phy_mode {
         MODE_MAX        = 14
 };
 
+static inline const char *ath10k_wmi_phymode_str(enum wmi_phy_mode mode)
+{
+        switch (mode) {
+        case MODE_11A:
+                return "11a";
+        case MODE_11G:
+                return "11g";
+        case MODE_11B:
+                return "11b";
+        case MODE_11GONLY:
+                return "11gonly";
+        case MODE_11NA_HT20:
+                return "11na-ht20";
+        case MODE_11NG_HT20:
+                return "11ng-ht20";
+        case MODE_11NA_HT40:
+                return "11na-ht40";
+        case MODE_11NG_HT40:
+                return "11ng-ht40";
+        case MODE_11AC_VHT20:
+                return "11ac-vht20";
+        case MODE_11AC_VHT40:
+                return "11ac-vht40";
+        case MODE_11AC_VHT80:
+                return "11ac-vht80";
+        case MODE_11AC_VHT20_2G:
+                return "11ac-vht20-2g";
+        case MODE_11AC_VHT40_2G:
+                return "11ac-vht40-2g";
+        case MODE_11AC_VHT80_2G:
+                return "11ac-vht80-2g";
+        case MODE_UNKNOWN:
+                /* skip */
+                break;
+
+                /* no default handler to allow compiler to check that the
+                 * enum is fully handled */
+        };
+
+        return "<unknown>";
+}
+
 #define WMI_CHAN_LIST_TAG       0x1
 #define WMI_SSID_LIST_TAG       0x2
 #define WMI_BSSID_LIST_TAG      0x3
@@ -763,14 +805,6 @@ struct wmi_service_ready_event {
         struct wlan_host_mem_req mem_reqs[1];
 } __packed;
 
-/*
- * status consists of  upper 16 bits fo int status and lower 16 bits of
- * module ID that retuned status
- */
-#define WLAN_INIT_STATUS_SUCCESS   0x0
-#define WLAN_GET_INIT_STATUS_REASON(status)    ((status) & 0xffff)
-#define WLAN_GET_INIT_STATUS_MODULE_ID(status) (((status) >> 16) & 0xffff)
-
 #define WMI_SERVICE_READY_TIMEOUT_HZ (5*HZ)
 #define WMI_UNIFIED_READY_TIMEOUT_HZ (5*HZ)
 
@@ -1268,7 +1302,7 @@ struct wmi_scan_event {
  * good idea to pass all the fields in the RX status
  * descriptor up to the host.
  */
-struct wmi_mgmt_rx_hdr {
+struct wmi_mgmt_rx_hdr_v1 {
         __le32 channel;
         __le32 snr;
         __le32 rate;
@@ -1277,8 +1311,18 @@ struct wmi_mgmt_rx_hdr {
         __le32 status; /* %WMI_RX_STATUS_ */
 } __packed;
 
-struct wmi_mgmt_rx_event {
-        struct wmi_mgmt_rx_hdr hdr;
+struct wmi_mgmt_rx_hdr_v2 {
+        struct wmi_mgmt_rx_hdr_v1 v1;
+        __le32 rssi_ctl[4];
+} __packed;
+
+struct wmi_mgmt_rx_event_v1 {
+        struct wmi_mgmt_rx_hdr_v1 hdr;
+        u8 buf[0];
+} __packed;
+
+struct wmi_mgmt_rx_event_v2 {
+        struct wmi_mgmt_rx_hdr_v2 hdr;
         u8 buf[0];
 } __packed;
 
@@ -3000,7 +3044,6 @@ struct wmi_force_fw_hang_cmd {
 
 #define WMI_MAX_EVENT 0x1000
 /* Maximum number of pending TXed WMI packets */
-#define WMI_MAX_PENDING_TX_COUNT 128
 #define WMI_SKB_HEADROOM sizeof(struct wmi_cmd_hdr)
 
 /* By default disable power save for IBSS */
@@ -3013,7 +3056,6 @@ int ath10k_wmi_attach(struct ath10k *ar);
 void ath10k_wmi_detach(struct ath10k *ar);
 int ath10k_wmi_wait_for_service_ready(struct ath10k *ar);
 int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar);
-void ath10k_wmi_flush_tx(struct ath10k *ar);
 
 int ath10k_wmi_connect_htc_service(struct ath10k *ar);
 int ath10k_wmi_pdev_set_channel(struct ath10k *ar,
@@ -3066,7 +3108,8 @@ int ath10k_wmi_set_ap_ps_param(struct ath10k *ar, u32 vdev_id, const u8 *mac,
                                enum wmi_ap_ps_peer_param param_id, u32 value);
 int ath10k_wmi_scan_chan_list(struct ath10k *ar,
                               const struct wmi_scan_chan_list_arg *arg);
-int ath10k_wmi_beacon_send(struct ath10k *ar, const struct wmi_bcn_tx_arg *arg);
+int ath10k_wmi_beacon_send_nowait(struct ath10k *ar,
+                                  const struct wmi_bcn_tx_arg *arg);
 int ath10k_wmi_pdev_set_wmm_params(struct ath10k *ar,
                         const struct wmi_pdev_set_wmm_params_arg *arg);
 int ath10k_wmi_request_stats(struct ath10k *ar, enum wmi_stats_id stats_id);
diff --git a/drivers/net/wireless/ath/ath5k/ahb.c b/drivers/net/wireless/ath/ath5k/ahb.c
index e9bc9e616b69..79bffe165cab 100644
--- a/drivers/net/wireless/ath/ath5k/ahb.c
+++ b/drivers/net/wireless/ath/ath5k/ahb.c
@@ -37,12 +37,9 @@ ath5k_ahb_eeprom_read(struct ath_common *common, u32 off, u16 *data)
 {
         struct ath5k_hw *ah = common->priv;
         struct platform_device *pdev = to_platform_device(ah->dev);
-        struct ar231x_board_config *bcfg = pdev->dev.platform_data;
+        struct ar231x_board_config *bcfg = dev_get_platdata(&pdev->dev);
         u16 *eeprom, *eeprom_end;
 
-
-
-        bcfg = pdev->dev.platform_data;
         eeprom = (u16 *) bcfg->radio;
         eeprom_end = ((void *) bcfg->config) + BOARD_CONFIG_BUFSZ;
 
@@ -57,7 +54,7 @@ ath5k_ahb_eeprom_read(struct ath_common *common, u32 off, u16 *data)
 int ath5k_hw_read_srev(struct ath5k_hw *ah)
 {
         struct platform_device *pdev = to_platform_device(ah->dev);
-        struct ar231x_board_config *bcfg = pdev->dev.platform_data;
+        struct ar231x_board_config *bcfg = dev_get_platdata(&pdev->dev);
         ah->ah_mac_srev = bcfg->devid;
         return 0;
 }
@@ -65,7 +62,7 @@ int ath5k_hw_read_srev(struct ath5k_hw *ah)
 static int ath5k_ahb_eeprom_read_mac(struct ath5k_hw *ah, u8 *mac)
 {
         struct platform_device *pdev = to_platform_device(ah->dev);
-        struct ar231x_board_config *bcfg = pdev->dev.platform_data;
+        struct ar231x_board_config *bcfg = dev_get_platdata(&pdev->dev);
         u8 *cfg_mac;
 
         if (to_platform_device(ah->dev)->id == 0)
@@ -87,7 +84,7 @@ static const struct ath_bus_ops ath_ahb_bus_ops = {
 /*Initialization*/
 static int ath_ahb_probe(struct platform_device *pdev)
 {
-        struct ar231x_board_config *bcfg = pdev->dev.platform_data;
+        struct ar231x_board_config *bcfg = dev_get_platdata(&pdev->dev);
         struct ath5k_hw *ah;
         struct ieee80211_hw *hw;
         struct resource *res;
@@ -96,7 +93,7 @@ static int ath_ahb_probe(struct platform_device *pdev)
         int ret = 0;
         u32 reg;
 
-        if (!pdev->dev.platform_data) {
+        if (!dev_get_platdata(&pdev->dev)) {
                 dev_err(&pdev->dev, "no platform data specified\n");
                 ret = -EINVAL;
                 goto err_out;
@@ -193,7 +190,7 @@ static int ath_ahb_probe(struct platform_device *pdev)
 
 static int ath_ahb_remove(struct platform_device *pdev)
 {
-        struct ar231x_board_config *bcfg = pdev->dev.platform_data;
+        struct ar231x_board_config *bcfg = dev_get_platdata(&pdev->dev);
         struct ieee80211_hw *hw = platform_get_drvdata(pdev);
         struct ath5k_hw *ah;
         u32 reg;
diff --git a/drivers/net/wireless/ath/ath9k/ahb.c b/drivers/net/wireless/ath/ath9k/ahb.c
index 072e4b531067..2dff2765769b 100644
--- a/drivers/net/wireless/ath/ath9k/ahb.c
+++ b/drivers/net/wireless/ath/ath9k/ahb.c
@@ -54,7 +54,7 @@ static bool ath_ahb_eeprom_read(struct ath_common *common, u32 off, u16 *data)
         struct platform_device *pdev = to_platform_device(sc->dev);
         struct ath9k_platform_data *pdata;
 
-        pdata = (struct ath9k_platform_data *) pdev->dev.platform_data;
+        pdata = dev_get_platdata(&pdev->dev);
         if (off >= (ARRAY_SIZE(pdata->eeprom_data))) {
                 ath_err(common,
                         "%s: flash read failed, offset %08x is out of range\n",
@@ -84,7 +84,7 @@ static int ath_ahb_probe(struct platform_device *pdev)
         struct ath_hw *ah;
         char hw_name[64];
 
-        if (!pdev->dev.platform_data) {
+        if (!dev_get_platdata(&pdev->dev)) {
                 dev_err(&pdev->dev, "no platform data specified\n");
                 return -EINVAL;
         }
diff --git a/drivers/net/wireless/ath/ath9k/antenna.c b/drivers/net/wireless/ath/ath9k/antenna.c
index dd1cc73d7946..bd048cc69a33 100644
--- a/drivers/net/wireless/ath/ath9k/antenna.c
+++ b/drivers/net/wireless/ath/ath9k/antenna.c
@@ -332,7 +332,7 @@ static void ath_select_ant_div_from_quick_scan(struct ath_ant_comb *antcomb,
                 }
 
                 if (antcomb->rssi_lna2 > antcomb->rssi_lna1 +
-                    ATH_ANT_DIV_COMB_LNA1_LNA2_SWITCH_DELTA)
+                    div_ant_conf->lna1_lna2_switch_delta)
                         div_ant_conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA2;
                 else
                         div_ant_conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA1;
@@ -554,42 +554,22 @@ static void ath_ant_div_conf_fast_divbias(struct ath_hw_antcomb_conf *ant_conf,
                         ant_conf->fast_div_bias = 0x1;
                         break;
                 case 0x10: /* LNA2 A-B */
-                        if ((antcomb->scan == 0) &&
-                            (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO)) {
-                                ant_conf->fast_div_bias = 0x3f;
-                        } else {
-                                ant_conf->fast_div_bias = 0x1;
-                        }
+                        ant_conf->fast_div_bias = 0x2;
                         break;
                 case 0x12: /* LNA2 LNA1 */
-                        ant_conf->fast_div_bias = 0x39;
+                        ant_conf->fast_div_bias = 0x3f;
                         break;
                 case 0x13: /* LNA2 A+B */
-                        if ((antcomb->scan == 0) &&
-                            (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO)) {
-                                ant_conf->fast_div_bias = 0x3f;
-                        } else {
-                                ant_conf->fast_div_bias = 0x1;
-                        }
+                        ant_conf->fast_div_bias = 0x2;
                         break;
                 case 0x20: /* LNA1 A-B */
-                        if ((antcomb->scan == 0) &&
-                            (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO)) {
-                                ant_conf->fast_div_bias = 0x3f;
-                        } else {
-                                ant_conf->fast_div_bias = 0x4;
-                        }
+                        ant_conf->fast_div_bias = 0x3;
                         break;
                 case 0x21: /* LNA1 LNA2 */
-                        ant_conf->fast_div_bias = 0x6;
+                        ant_conf->fast_div_bias = 0x3;
                         break;
                 case 0x23: /* LNA1 A+B */
-                        if ((antcomb->scan == 0) &&
-                            (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO)) {
-                                ant_conf->fast_div_bias = 0x3f;
-                        } else {
-                                ant_conf->fast_div_bias = 0x6;
-                        }
+                        ant_conf->fast_div_bias = 0x3;
                         break;
                 case 0x30: /* A+B A-B */
                         ant_conf->fast_div_bias = 0x1;
@@ -638,7 +618,7 @@ static void ath_ant_try_scan(struct ath_ant_comb *antcomb,
                 antcomb->rssi_sub = alt_rssi_avg;
                 antcomb->scan = false;
                 if (antcomb->rssi_lna2 >
-                    (antcomb->rssi_lna1 + ATH_ANT_DIV_COMB_LNA1_LNA2_SWITCH_DELTA)) {
+                    (antcomb->rssi_lna1 + conf->lna1_lna2_switch_delta)) {
                         /* use LNA2 as main LNA */
                         if ((antcomb->rssi_add > antcomb->rssi_lna1) &&
                             (antcomb->rssi_add > antcomb->rssi_sub)) {
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index 08656473c63e..cb6435e7c6f5 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -626,12 +626,11 @@ static void ar5008_hw_override_ini(struct ath_hw *ah,
                 if (AR_SREV_9287_11_OR_LATER(ah))
                         val = val & (~AR_PCU_MISC_MODE2_HWWAR2);
 
+                val |= AR_PCU_MISC_MODE2_CFP_IGNORE;
+
                 REG_WRITE(ah, AR_PCU_MISC_MODE2, val);
         }
 
-        REG_SET_BIT(ah, AR_PHY_CCK_DETECT,
-                    AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV);
-
         if (AR_SREV_9280_20_OR_LATER(ah))
                 return;
         /*
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_calib.c b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
index 9f589744a9f9..32376ad74011 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
@@ -671,7 +671,7 @@ static bool ar9002_hw_calibrate(struct ath_hw *ah,
 
         nfcal = !!(REG_READ(ah, AR_PHY_AGC_CONTROL) & AR_PHY_AGC_CONTROL_NF);
         if (ah->caldata)
-                nfcal_pending = ah->caldata->nfcal_pending;
+                nfcal_pending = test_bit(NFCAL_PENDING, &ah->caldata->cal_flags);
 
         if (currCal && !nfcal &&
             (currCal->calState == CAL_RUNNING ||
@@ -861,7 +861,7 @@ static bool ar9002_hw_init_cal(struct ath_hw *ah, struct ath9k_channel *chan)
         ar9002_hw_pa_cal(ah, true);
 
         if (ah->caldata)
-                ah->caldata->nfcal_pending = true;
+                set_bit(NFCAL_PENDING, &ah->caldata->cal_flags);
 
         ah->cal_list = ah->cal_list_last = ah->cal_list_curr = NULL;
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_phy.c b/drivers/net/wireless/ath/ath9k/ar9002_phy.c
index 1fc1fa955d44..17970d49d858 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_phy.c
@@ -485,7 +485,7 @@ static void ar9002_hw_do_getnf(struct ath_hw *ah,
         if (IS_CHAN_HT40(ah->curchan))
                 nfarray[3] = sign_extend32(nf, 8);
 
-        if (AR_SREV_9285(ah) || AR_SREV_9271(ah))
+        if (!(ah->rxchainmask & BIT(1)))
                 return;
 
         nf = MS(REG_READ(ah, AR_PHY_CH1_CCA), AR9280_PHY_CH1_MINCCA_PWR);
@@ -532,6 +532,7 @@ static void ar9002_hw_antdiv_comb_conf_get(struct ath_hw *ah,
                                  AR_PHY_9285_ANT_DIV_ALT_LNACONF_S;
         antconf->fast_div_bias = (regval & AR_PHY_9285_FAST_DIV_BIAS) >>
                                   AR_PHY_9285_FAST_DIV_BIAS_S;
+        antconf->lna1_lna2_switch_delta = -1;
         antconf->lna1_lna2_delta = -3;
         antconf->div_group = 0;
 }
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
index 6988e1d081f2..22934d3ca544 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
@@ -727,8 +727,12 @@ static void ar9003_hw_tx_iqcal_load_avg_2_passes(struct ath_hw *ah,
         REG_RMW_FIELD(ah, AR_PHY_RX_IQCAL_CORR_B0,
                       AR_PHY_RX_IQCAL_CORR_B0_LOOPBACK_IQCORR_EN, 0x1);
 
-        if (caldata)
-                caldata->done_txiqcal_once = is_reusable;
+        if (caldata) {
+                if (is_reusable)
+                        set_bit(TXIQCAL_DONE, &caldata->cal_flags);
+                else
+                        clear_bit(TXIQCAL_DONE, &caldata->cal_flags);
+        }
 
         return;
 }
@@ -961,18 +965,44 @@ static void ar9003_hw_manual_peak_cal(struct ath_hw *ah, u8 chain, bool is_2g)
 }
 
 static void ar9003_hw_do_manual_peak_cal(struct ath_hw *ah,
-                                         struct ath9k_channel *chan)
+                                         struct ath9k_channel *chan,
+                                         bool run_rtt_cal)
 {
+        struct ath9k_hw_cal_data *caldata = ah->caldata;
         int i;
 
         if (!AR_SREV_9462(ah) && !AR_SREV_9565(ah) && !AR_SREV_9485(ah))
                 return;
 
+        if ((ah->caps.hw_caps & ATH9K_HW_CAP_RTT) && !run_rtt_cal)
+                return;
+
         for (i = 0; i < AR9300_MAX_CHAINS; i++) {
                 if (!(ah->rxchainmask & (1 << i)))
                         continue;
                 ar9003_hw_manual_peak_cal(ah, i, IS_CHAN_2GHZ(chan));
         }
+
+        if (caldata)
+                set_bit(SW_PKDET_DONE, &caldata->cal_flags);
+
+        if ((ah->caps.hw_caps & ATH9K_HW_CAP_RTT) && caldata) {
+                if (IS_CHAN_2GHZ(chan)){
+                        caldata->caldac[0] = REG_READ_FIELD(ah,
+                                                    AR_PHY_65NM_RXRF_AGC(0),
+                                                    AR_PHY_65NM_RXRF_AGC_AGC2G_CALDAC_OVR);
+                        caldata->caldac[1] = REG_READ_FIELD(ah,
+                                                    AR_PHY_65NM_RXRF_AGC(1),
+                                                    AR_PHY_65NM_RXRF_AGC_AGC2G_CALDAC_OVR);
+                } else {
+                        caldata->caldac[0] = REG_READ_FIELD(ah,
+                                                    AR_PHY_65NM_RXRF_AGC(0),
+                                                    AR_PHY_65NM_RXRF_AGC_AGC5G_CALDAC_OVR);
+                        caldata->caldac[1] = REG_READ_FIELD(ah,
+                                                    AR_PHY_65NM_RXRF_AGC(1),
+                                                    AR_PHY_65NM_RXRF_AGC_AGC5G_CALDAC_OVR);
+                }
+        }
 }
 
 static void ar9003_hw_cl_cal_post_proc(struct ath_hw *ah, bool is_reusable)
@@ -990,7 +1020,7 @@ static void ar9003_hw_cl_cal_post_proc(struct ath_hw *ah, bool is_reusable)
         txclcal_done = !!(REG_READ(ah, AR_PHY_AGC_CONTROL) &
                           AR_PHY_AGC_CONTROL_CLC_SUCCESS);
 
-        if (caldata->done_txclcal_once) {
+        if (test_bit(TXCLCAL_DONE, &caldata->cal_flags)) {
                 for (i = 0; i < AR9300_MAX_CHAINS; i++) {
                         if (!(ah->txchainmask & (1 << i)))
                                 continue;
@@ -1006,7 +1036,7 @@ static void ar9003_hw_cl_cal_post_proc(struct ath_hw *ah, bool is_reusable)
                                 caldata->tx_clcal[i][j] =
                                         REG_READ(ah, CL_TAB_ENTRY(cl_idx[i]));
                 }
-                caldata->done_txclcal_once = true;
+                set_bit(TXCLCAL_DONE, &caldata->cal_flags);
         }
 }
 
@@ -1019,6 +1049,7 @@ static bool ar9003_hw_init_cal(struct ath_hw *ah,
         bool is_reusable = true, status = true;
         bool run_rtt_cal = false, run_agc_cal, sep_iq_cal = false;
         bool rtt = !!(ah->caps.hw_caps & ATH9K_HW_CAP_RTT);
+        u32 rx_delay = 0;
         u32 agc_ctrl = 0, agc_supp_cals = AR_PHY_AGC_CONTROL_OFFSET_CAL |
                                           AR_PHY_AGC_CONTROL_FLTR_CAL   |
                                           AR_PHY_AGC_CONTROL_PKDET_CAL;
@@ -1042,17 +1073,22 @@ static bool ar9003_hw_init_cal(struct ath_hw *ah,
                 ar9003_hw_rtt_clear_hist(ah);
         }
 
-        if (rtt && !run_rtt_cal) {
-                agc_ctrl = REG_READ(ah, AR_PHY_AGC_CONTROL);
-                agc_supp_cals &= agc_ctrl;
-                agc_ctrl &= ~(AR_PHY_AGC_CONTROL_OFFSET_CAL |
-                             AR_PHY_AGC_CONTROL_FLTR_CAL |
-                             AR_PHY_AGC_CONTROL_PKDET_CAL);
-                REG_WRITE(ah, AR_PHY_AGC_CONTROL, agc_ctrl);
+        if (rtt) {
+                if (!run_rtt_cal) {
+                        agc_ctrl = REG_READ(ah, AR_PHY_AGC_CONTROL);
+                        agc_supp_cals &= agc_ctrl;
+                        agc_ctrl &= ~(AR_PHY_AGC_CONTROL_OFFSET_CAL |
+                                      AR_PHY_AGC_CONTROL_FLTR_CAL |
+                                      AR_PHY_AGC_CONTROL_PKDET_CAL);
+                        REG_WRITE(ah, AR_PHY_AGC_CONTROL, agc_ctrl);
+                } else {
+                        if (ah->ah_flags & AH_FASTCC)
+                                run_agc_cal = true;
+                }
         }
 
         if (ah->enabled_cals & TX_CL_CAL) {
-                if (caldata && caldata->done_txclcal_once)
+                if (caldata && test_bit(TXCLCAL_DONE, &caldata->cal_flags))
                         REG_CLR_BIT(ah, AR_PHY_CL_CAL_CTL,
                                     AR_PHY_CL_CAL_ENABLE);
                 else {
@@ -1076,14 +1112,14 @@ static bool ar9003_hw_init_cal(struct ath_hw *ah,
          * AGC calibration
          */
         if (ah->enabled_cals & TX_IQ_ON_AGC_CAL) {
-                if (caldata && !caldata->done_txiqcal_once)
+                if (caldata && !test_bit(TXIQCAL_DONE, &caldata->cal_flags))
                         REG_SET_BIT(ah, AR_PHY_TX_IQCAL_CONTROL_0,
                                     AR_PHY_TX_IQCAL_CONTROL_0_ENABLE_TXIQ_CAL);
                 else
                         REG_CLR_BIT(ah, AR_PHY_TX_IQCAL_CONTROL_0,
                                     AR_PHY_TX_IQCAL_CONTROL_0_ENABLE_TXIQ_CAL);
                 txiqcal_done = run_agc_cal = true;
-        } else if (caldata && !caldata->done_txiqcal_once) {
+        } else if (caldata && !test_bit(TXIQCAL_DONE, &caldata->cal_flags)) {
                 run_agc_cal = true;
                 sep_iq_cal = true;
         }
@@ -1099,6 +1135,15 @@ skip_tx_iqcal:
                 REG_WRITE(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_EN);
         }
 
+        if (REG_READ(ah, AR_PHY_CL_CAL_CTL) & AR_PHY_CL_CAL_ENABLE) {
+                rx_delay = REG_READ(ah, AR_PHY_RX_DELAY);
+                /* Disable BB_active */
+                REG_WRITE(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_DIS);
+                udelay(5);
+                REG_WRITE(ah, AR_PHY_RX_DELAY, AR_PHY_RX_DELAY_DELAY);
+                REG_WRITE(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_EN);
+        }
+
         if (run_agc_cal || !(ah->ah_flags & AH_FASTCC)) {
                 /* Calibrate the AGC */
                 REG_WRITE(ah, AR_PHY_AGC_CONTROL,
@@ -1110,7 +1155,12 @@ skip_tx_iqcal:
                                        AR_PHY_AGC_CONTROL_CAL,
                                        0, AH_WAIT_TIMEOUT);
 
-                ar9003_hw_do_manual_peak_cal(ah, chan);
+                ar9003_hw_do_manual_peak_cal(ah, chan, run_rtt_cal);
+        }
+
+        if (REG_READ(ah, AR_PHY_CL_CAL_CTL) & AR_PHY_CL_CAL_ENABLE) {
+                REG_WRITE(ah, AR_PHY_RX_DELAY, rx_delay);
+                udelay(5);
         }
 
         if (ath9k_hw_mci_is_enabled(ah) && IS_CHAN_2GHZ(chan) && run_agc_cal)
@@ -1133,19 +1183,23 @@ skip_tx_iqcal:
 
         if (txiqcal_done)
                 ar9003_hw_tx_iq_cal_post_proc(ah, is_reusable);
-        else if (caldata && caldata->done_txiqcal_once)
+        else if (caldata && test_bit(TXIQCAL_DONE, &caldata->cal_flags))
                 ar9003_hw_tx_iq_cal_reload(ah);
 
         ar9003_hw_cl_cal_post_proc(ah, is_reusable);
 
         if (run_rtt_cal && caldata) {
                 if (is_reusable) {
-                        if (!ath9k_hw_rfbus_req(ah))
+                        if (!ath9k_hw_rfbus_req(ah)) {
                                 ath_err(ath9k_hw_common(ah),
                                         "Could not stop baseband\n");
-                        else
+                        } else {
                                 ar9003_hw_rtt_fill_hist(ah);
 
+                                if (test_bit(SW_PKDET_DONE, &caldata->cal_flags))
+                                        ar9003_hw_rtt_load_hist(ah);
+                        }
+
                         ath9k_hw_rfbus_done(ah);
                 }
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index f4864807e15b..1ec52356b5a1 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -2991,7 +2991,10 @@ static u32 ath9k_hw_ar9300_get_eeprom(struct ath_hw *ah,
         case EEP_CHAIN_MASK_REDUCE:
                 return (pBase->miscConfiguration >> 0x3) & 0x1;
         case EEP_ANT_DIV_CTL1:
-                return eep->base_ext1.ant_div_control;
+                if (AR_SREV_9565(ah))
+                        return AR9300_EEP_ANTDIV_CONTROL_DEFAULT_VALUE;
+                else
+                        return eep->base_ext1.ant_div_control;
         case EEP_ANTENNA_GAIN_5G:
                 return eep->modalHeader5G.antennaGain;
         case EEP_ANTENNA_GAIN_2G:
@@ -3424,12 +3427,12 @@ static u32 ath9k_hw_ar9003_dump_eeprom(struct ath_hw *ah, bool dump_base_hdr,
         struct ar9300_base_eep_hdr *pBase;
 
         if (!dump_base_hdr) {
-                len += snprintf(buf + len, size - len,
-                                "%20s :\n", "2GHz modal Header");
+                len += scnprintf(buf + len, size - len,
+                                 "%20s :\n", "2GHz modal Header");
                 len = ar9003_dump_modal_eeprom(buf, len, size,
                                                 &eep->modalHeader2G);
-                len += snprintf(buf + len, size - len,
-                                "%20s :\n", "5GHz modal Header");
+                len += scnprintf(buf + len, size - len,
+                                 "%20s :\n", "5GHz modal Header");
                 len = ar9003_dump_modal_eeprom(buf, len, size,
                                                 &eep->modalHeader5G);
                 goto out;
@@ -3479,8 +3482,8 @@ static u32 ath9k_hw_ar9003_dump_eeprom(struct ath_hw *ah, bool dump_base_hdr,
         PR_EEP("Rx Gain", pBase->txrxgain & 0xf);
         PR_EEP("SW Reg", le32_to_cpu(pBase->swreg));
 
-        len += snprintf(buf + len, size - len, "%20s : %pM\n", "MacAddress",
-                        ah->eeprom.ar9300_eep.macAddr);
+        len += scnprintf(buf + len, size - len, "%20s : %pM\n", "MacAddress",
+                         ah->eeprom.ar9300_eep.macAddr);
 out:
         if (len > size)
                 len = size;
@@ -3656,9 +3659,23 @@ static void ar9003_hw_ant_ctrl_apply(struct ath_hw *ah, bool is2ghz)
                 if (AR_SREV_9565(ah)) {
                         if (common->bt_ant_diversity) {
                                 regval |= (1 << AR_PHY_ANT_SW_RX_PROT_S);
+
+                                REG_SET_BIT(ah, AR_PHY_RESTART,
+                                            AR_PHY_RESTART_ENABLE_DIV_M2FLAG);
+
+                                /* Force WLAN LNA diversity ON */
+                                REG_SET_BIT(ah, AR_BTCOEX_WL_LNADIV,
+                                            AR_BTCOEX_WL_LNADIV_FORCE_ON);
                         } else {
                                 regval &= ~(1 << AR_PHY_ANT_DIV_LNADIV_S);
                                 regval &= ~(1 << AR_PHY_ANT_SW_RX_PROT_S);
+
+                                REG_CLR_BIT(ah, AR_PHY_MC_GAIN_CTRL,
+                                            (1 << AR_PHY_ANT_SW_RX_PROT_S));
+
+                                /* Force WLAN LNA diversity OFF */
+                                REG_CLR_BIT(ah, AR_BTCOEX_WL_LNADIV,
+                                            AR_BTCOEX_WL_LNADIV_FORCE_ON);
                         }
                 }
 
@@ -3669,7 +3686,8 @@ static void ar9003_hw_ant_ctrl_apply(struct ath_hw *ah, bool is2ghz)
                 regval &= (~AR_FAST_DIV_ENABLE);
                 regval |= ((value >> 7) & 0x1) << AR_FAST_DIV_ENABLE_S;
 
-                if (AR_SREV_9485(ah) && common->bt_ant_diversity)
+                if ((AR_SREV_9485(ah) || AR_SREV_9565(ah))
+                    && common->bt_ant_diversity)
                         regval |= AR_FAST_DIV_ENABLE;
 
                 REG_WRITE(ah, AR_PHY_CCK_DETECT, regval);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
index 75d4fb41962f..0e5daa58a4fc 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
@@ -52,6 +52,8 @@
 #define AR9300_PAPRD_SCALE_2            0x70000000
 #define AR9300_PAPRD_SCALE_2_S          28
 
+#define AR9300_EEP_ANTDIV_CONTROL_DEFAULT_VALUE 0xc9
+
 /* Delta from which to start power to pdadc table */
 /* This offset is used in both open loop and closed loop power control
  * schemes. In open loop power control, it is not really needed, but for
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_hw.c b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
index 608bb4824e2a..b07f164d65cf 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
@@ -364,6 +364,8 @@ static void ar9003_hw_init_mode_regs(struct ath_hw *ah)
 
                 INIT_INI_ARRAY(&ah->iniModesFastClock,
                                 ar9565_1p0_modes_fast_clock);
+                INIT_INI_ARRAY(&ah->iniCckfirJapan2484,
+                               ar9565_1p0_baseband_core_txfir_coeff_japan_2484);
         } else {
                 /* mac */
                 INIT_INI_ARRAY(&ah->iniMac[ATH_INI_CORE],
@@ -628,6 +630,9 @@ static void ar9003_rx_gain_table_mode0(struct ath_hw *ah)
         else if (AR_SREV_9462_20(ah))
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                                 ar9462_common_rx_gain_table_2p0);
+        else if (AR_SREV_9565(ah))
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                               ar9565_1p0_Common_rx_gain_table);
         else
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                                 ar9300Common_rx_gain_table_2p2);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mci.c b/drivers/net/wireless/ath/ath9k/ar9003_mci.c
index 8dd069259e7b..7b94a6c7db3d 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_mci.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_mci.c
@@ -753,9 +753,9 @@ int ar9003_mci_end_reset(struct ath_hw *ah, struct ath9k_channel *chan,
                     1 << AR_PHY_TIMING_CONTROL4_DO_GAIN_DC_IQ_CAL_SHIFT);
 
         if (caldata) {
-                caldata->done_txiqcal_once = false;
-                caldata->done_txclcal_once = false;
-                caldata->rtt_done = false;
+                clear_bit(TXIQCAL_DONE, &caldata->cal_flags);
+                clear_bit(TXCLCAL_DONE, &caldata->cal_flags);
+                clear_bit(RTT_DONE, &caldata->cal_flags);
         }
 
         if (!ath9k_hw_init_cal(ah, chan))
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index e897648d3233..0131ba2f5d51 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -627,11 +627,10 @@ static void ar9003_hw_override_ini(struct ath_hw *ah)
          * MAC addr only will fail.
          */
         val = REG_READ(ah, AR_PCU_MISC_MODE2) & (~AR_ADHOC_MCAST_KEYID_ENABLE);
-        REG_WRITE(ah, AR_PCU_MISC_MODE2,
-                  val | AR_AGG_WEP_ENABLE_FIX | AR_AGG_WEP_ENABLE);
-
-        REG_SET_BIT(ah, AR_PHY_CCK_DETECT,
-                    AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV);
+        val |= AR_AGG_WEP_ENABLE_FIX |
+               AR_AGG_WEP_ENABLE |
+               AR_PCU_MISC_MODE2_CFP_IGNORE;
+        REG_WRITE(ah, AR_PCU_MISC_MODE2, val);
 
         if (AR_SREV_9462(ah) || AR_SREV_9565(ah)) {
                 REG_WRITE(ah, AR_GLB_SWREG_DISCONT_MODE,
@@ -1375,15 +1374,19 @@ static void ar9003_hw_antdiv_comb_conf_get(struct ath_hw *ah,
                                   AR_PHY_ANT_FAST_DIV_BIAS_S;
 
         if (AR_SREV_9330_11(ah)) {
+                antconf->lna1_lna2_switch_delta = -1;
                 antconf->lna1_lna2_delta = -9;
                 antconf->div_group = 1;
         } else if (AR_SREV_9485(ah)) {
+                antconf->lna1_lna2_switch_delta = -1;
                 antconf->lna1_lna2_delta = -9;
                 antconf->div_group = 2;
         } else if (AR_SREV_9565(ah)) {
-                antconf->lna1_lna2_delta = -3;
+                antconf->lna1_lna2_switch_delta = 3;
+                antconf->lna1_lna2_delta = -9;
                 antconf->div_group = 3;
         } else {
+                antconf->lna1_lna2_switch_delta = -1;
                 antconf->lna1_lna2_delta = -3;
                 antconf->div_group = 0;
         }
@@ -1489,17 +1492,24 @@ static void ar9003_hw_set_bt_ant_diversity(struct ath_hw *ah, bool enable)
         } else if (AR_SREV_9565(ah)) {
                 if (enable) {
                         REG_SET_BIT(ah, AR_PHY_MC_GAIN_CTRL,
+                                    AR_ANT_DIV_ENABLE);
+                        REG_SET_BIT(ah, AR_PHY_MC_GAIN_CTRL,
                                     (1 << AR_PHY_ANT_SW_RX_PROT_S));
-                        if (ah->curchan && IS_CHAN_2GHZ(ah->curchan))
-                                REG_SET_BIT(ah, AR_PHY_RESTART,
-                                            AR_PHY_RESTART_ENABLE_DIV_M2FLAG);
+                        REG_SET_BIT(ah, AR_PHY_CCK_DETECT,
+                                    AR_FAST_DIV_ENABLE);
+                        REG_SET_BIT(ah, AR_PHY_RESTART,
+                                    AR_PHY_RESTART_ENABLE_DIV_M2FLAG);
                         REG_SET_BIT(ah, AR_BTCOEX_WL_LNADIV,
                                     AR_BTCOEX_WL_LNADIV_FORCE_ON);
                 } else {
-                        REG_CLR_BIT(ah, AR_PHY_MC_GAIN_CTRL, AR_ANT_DIV_ENABLE);
+                        REG_CLR_BIT(ah, AR_PHY_MC_GAIN_CTRL,
+                                    AR_ANT_DIV_ENABLE);
                         REG_CLR_BIT(ah, AR_PHY_MC_GAIN_CTRL,
                                     (1 << AR_PHY_ANT_SW_RX_PROT_S));
-                        REG_CLR_BIT(ah, AR_PHY_CCK_DETECT, AR_FAST_DIV_ENABLE);
+                        REG_CLR_BIT(ah, AR_PHY_CCK_DETECT,
+                                    AR_FAST_DIV_ENABLE);
+                        REG_CLR_BIT(ah, AR_PHY_RESTART,
+                                    AR_PHY_RESTART_ENABLE_DIV_M2FLAG);
                         REG_CLR_BIT(ah, AR_BTCOEX_WL_LNADIV,
                                     AR_BTCOEX_WL_LNADIV_FORCE_ON);
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
index 6fd752321e36..fca624322dc8 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
@@ -343,8 +343,12 @@
 
 #define AR_PHY_CCA_NOM_VAL_9462_2GHZ          -127
 #define AR_PHY_CCA_MIN_GOOD_VAL_9462_2GHZ     -127
+#define AR_PHY_CCA_MAX_GOOD_VAL_9462_2GHZ     -60
+#define AR_PHY_CCA_MAX_GOOD_VAL_9462_FCC_2GHZ -95
 #define AR_PHY_CCA_NOM_VAL_9462_5GHZ          -127
 #define AR_PHY_CCA_MIN_GOOD_VAL_9462_5GHZ     -127
+#define AR_PHY_CCA_MAX_GOOD_VAL_9462_5GHZ     -60
+#define AR_PHY_CCA_MAX_GOOD_VAL_9462_FCC_5GHZ -100
 
 #define AR_PHY_CCA_NOM_VAL_9330_2GHZ          -118
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_rtt.c b/drivers/net/wireless/ath/ath9k/ar9003_rtt.c
index 74de3539c2c8..934418872e8e 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_rtt.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_rtt.c
@@ -118,6 +118,27 @@ void ar9003_hw_rtt_load_hist(struct ath_hw *ah)
         }
 }
 
+static void ar9003_hw_patch_rtt(struct ath_hw *ah, int index, int chain)
+{
+        int agc, caldac;
+
+        if (!test_bit(SW_PKDET_DONE, &ah->caldata->cal_flags))
+                return;
+
+        if ((index != 5) || (chain >= 2))
+                return;
+
+        agc = REG_READ_FIELD(ah, AR_PHY_65NM_RXRF_AGC(chain),
+                             AR_PHY_65NM_RXRF_AGC_AGC_OVERRIDE);
+        if (!agc)
+                return;
+
+        caldac = ah->caldata->caldac[chain];
+        ah->caldata->rtt_table[chain][index] &= 0xFFFF05FF;
+        caldac = (caldac & 0x20) | ((caldac & 0x1F) << 7);
+        ah->caldata->rtt_table[chain][index] |= (caldac << 4);
+}
+
 static int ar9003_hw_rtt_fill_hist_entry(struct ath_hw *ah, u8 chain, u32 index)
 {
         u32 val;
@@ -155,13 +176,16 @@ void ar9003_hw_rtt_fill_hist(struct ath_hw *ah)
                 for (i = 0; i < MAX_RTT_TABLE_ENTRY; i++) {
                         ah->caldata->rtt_table[chain][i] =
                                 ar9003_hw_rtt_fill_hist_entry(ah, chain, i);
+
+                        ar9003_hw_patch_rtt(ah, i, chain);
+
                         ath_dbg(ath9k_hw_common(ah), CALIBRATE,
                                 "RTT value at idx %d, chain %d is: 0x%x\n",
                                 i, chain, ah->caldata->rtt_table[chain][i]);
                 }
         }
 
-        ah->caldata->rtt_done = true;
+        set_bit(RTT_DONE, &ah->caldata->cal_flags);
 }
 
 void ar9003_hw_rtt_clear_hist(struct ath_hw *ah)
@@ -176,7 +200,7 @@ void ar9003_hw_rtt_clear_hist(struct ath_hw *ah)
         }
 
         if (ah->caldata)
-                ah->caldata->rtt_done = false;
+                clear_bit(RTT_DONE, &ah->caldata->cal_flags);
 }
 
 bool ar9003_hw_rtt_restore(struct ath_hw *ah, struct ath9k_channel *chan)
@@ -186,11 +210,37 @@ bool ar9003_hw_rtt_restore(struct ath_hw *ah, struct ath9k_channel *chan)
         if (!ah->caldata)
                 return false;
 
-        if (!ah->caldata->rtt_done)
+        if (test_bit(SW_PKDET_DONE, &ah->caldata->cal_flags)) {
+                if (IS_CHAN_2GHZ(chan)){
+                        REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(0),
+                                      AR_PHY_65NM_RXRF_AGC_AGC2G_CALDAC_OVR,
+                                      ah->caldata->caldac[0]);
+                        REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(1),
+                                      AR_PHY_65NM_RXRF_AGC_AGC2G_CALDAC_OVR,
+                                      ah->caldata->caldac[1]);
+                } else {
+                        REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(0),
+                                      AR_PHY_65NM_RXRF_AGC_AGC5G_CALDAC_OVR,
+                                      ah->caldata->caldac[0]);
+                        REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(1),
+                                      AR_PHY_65NM_RXRF_AGC_AGC5G_CALDAC_OVR,
+                                      ah->caldata->caldac[1]);
+                }
+                REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(1),
+                              AR_PHY_65NM_RXRF_AGC_AGC_OVERRIDE, 0x1);
+                REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(0),
+                              AR_PHY_65NM_RXRF_AGC_AGC_OVERRIDE, 0x1);
+        }
+
+        if (!test_bit(RTT_DONE, &ah->caldata->cal_flags))
                 return false;
 
         ar9003_hw_rtt_enable(ah);
-        ar9003_hw_rtt_set_mask(ah, 0x10);
+
+        if (test_bit(SW_PKDET_DONE, &ah->caldata->cal_flags))
+                ar9003_hw_rtt_set_mask(ah, 0x30);
+        else
+                ar9003_hw_rtt_set_mask(ah, 0x10);
 
         if (!ath9k_hw_rfbus_req(ah)) {
                 ath_err(ath9k_hw_common(ah), "Could not stop baseband\n");
diff --git a/drivers/net/wireless/ath/ath9k/ar9485_initvals.h b/drivers/net/wireless/ath/ath9k/ar9485_initvals.h
index 88ff1d7b53ab..6f899c692647 100644
--- a/drivers/net/wireless/ath/ath9k/ar9485_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9485_initvals.h
@@ -20,7 +20,17 @@
 
 /* AR9485 1.1 */
 
-#define ar9485_1_1_mac_postamble ar9300_2p2_mac_postamble
+static const u32 ar9485_1_1_mac_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160},
+        {0x00001070, 0x00000168, 0x000002d0, 0x00000318, 0x0000018c},
+        {0x000010b0, 0x00000e60, 0x00001cc0, 0x00007c70, 0x00003e38},
+        {0x00008014, 0x03e803e8, 0x07d007d0, 0x10801600, 0x08400b00},
+        {0x0000801c, 0x128d8027, 0x128d804f, 0x12e00057, 0x12e0002b},
+        {0x00008120, 0x08f04800, 0x08f04800, 0x08f04810, 0x08f04810},
+        {0x000081d0, 0x00003210, 0x00003210, 0x0000320a, 0x0000320a},
+        {0x00008318, 0x00003e80, 0x00007d00, 0x00006880, 0x00003440},
+};
 
 static const u32 ar9485_1_1_pcie_phy_pll_on_clkreq_disable_L1[][2] = {
         /* Addr      allmodes  */
@@ -34,6 +44,7 @@ static const u32 ar9485Common_wo_xlna_rx_gain_1_1[][2] = {
         {0x00009e00, 0x037216a0},
         {0x00009e04, 0x00182020},
         {0x00009e18, 0x00000000},
+        {0x00009e20, 0x000003a8},
         {0x00009e2c, 0x00004121},
         {0x00009e44, 0x02282324},
         {0x0000a000, 0x00060005},
@@ -174,7 +185,7 @@ static const u32 ar9485Modes_high_power_tx_gain_1_1[][5] = {
         {0x0000a2e0, 0x00000000, 0x00000000, 0xfe2d3552, 0xfe2d3552},
         {0x0000a2e4, 0x00000000, 0x00000000, 0xfe2d3552, 0xfe2d3552},
         {0x0000a2e8, 0x00000000, 0x00000000, 0xfe2d3552, 0xfe2d3552},
-        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d8, 0x000050d8},
+        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050da, 0x000050da},
         {0x0000a458, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a500, 0x00022200, 0x00022200, 0x00000000, 0x00000000},
         {0x0000a504, 0x05062002, 0x05062002, 0x04000002, 0x04000002},
@@ -200,14 +211,14 @@ static const u32 ar9485Modes_high_power_tx_gain_1_1[][5] = {
         {0x0000a554, 0x7d06ffcb, 0x7d06ffcb, 0x57001ce9, 0x57001ce9},
         {0x0000a558, 0x8407ff0b, 0x8407ff0b, 0x5a001ceb, 0x5a001ceb},
         {0x0000a55c, 0x8907ffcb, 0x8907ffcb, 0x5e001eeb, 0x5e001eeb},
-        {0x0000a560, 0x900fff0b, 0x900fff0b, 0x5e001eeb, 0x5e001eeb},
-        {0x0000a564, 0x960fffcb, 0x960fffcb, 0x5e001eeb, 0x5e001eeb},
-        {0x0000a568, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
-        {0x0000a56c, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
-        {0x0000a570, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
-        {0x0000a574, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
-        {0x0000a578, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
-        {0x0000a57c, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
+        {0x0000a560, 0x900fff0b, 0x900fff0b, 0x62001eee, 0x62001eee},
+        {0x0000a564, 0x960fffcb, 0x960fffcb, 0x66001ff6, 0x66001ff6},
+        {0x0000a568, 0x9c1fff0b, 0x9c1fff0b, 0x66001ff6, 0x66001ff6},
+        {0x0000a56c, 0x9c1fff0b, 0x9c1fff0b, 0x66001ff6, 0x66001ff6},
+        {0x0000a570, 0x9c1fff0b, 0x9c1fff0b, 0x66001ff6, 0x66001ff6},
+        {0x0000a574, 0x9c1fff0b, 0x9c1fff0b, 0x66001ff6, 0x66001ff6},
+        {0x0000a578, 0x9c1fff0b, 0x9c1fff0b, 0x66001ff6, 0x66001ff6},
+        {0x0000a57c, 0x9c1fff0b, 0x9c1fff0b, 0x66001ff6, 0x66001ff6},
         {0x0000a580, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a584, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a588, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
@@ -263,6 +274,11 @@ static const u32 ar9485Modes_high_power_tx_gain_1_1[][5] = {
 static const u32 ar9485Modes_green_ob_db_tx_gain_1_1[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x000098bc, 0x00000003, 0x00000003, 0x00000003, 0x00000003},
+        {0x0000a2d8, 0xf999a83a, 0xf999a83a, 0x7999a83a, 0x7999a83a},
+        {0x0000a2dc, 0x00000000, 0x00000000, 0xfe2d3552, 0xfe2d3552},
+        {0x0000a2e0, 0x00000000, 0x00000000, 0xfe2d3552, 0xfe2d3552},
+        {0x0000a2e4, 0x00000000, 0x00000000, 0xfe2d3552, 0xfe2d3552},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0xfe2d3552, 0xfe2d3552},
         {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d8, 0x000050d8},
         {0x0000a458, 0x80000000, 0x80000000, 0x80000000, 0x80000000},
         {0x0000a500, 0x00022200, 0x00022200, 0x00000006, 0x00000006},
@@ -297,6 +313,22 @@ static const u32 ar9485Modes_green_ob_db_tx_gain_1_1[][5] = {
         {0x0000a574, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
         {0x0000a578, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
         {0x0000a57c, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
+        {0x0000a580, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a584, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a588, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a58c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a590, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a594, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a598, 0x00000000, 0x00000000, 0x01404501, 0x01404501},
+        {0x0000a59c, 0x00000000, 0x00000000, 0x02808a02, 0x02808a02},
+        {0x0000a5a0, 0x00000000, 0x00000000, 0x02808a02, 0x02808a02},
+        {0x0000a5a4, 0x00000000, 0x00000000, 0x02808803, 0x02808803},
+        {0x0000a5a8, 0x00000000, 0x00000000, 0x04c14b04, 0x04c14b04},
+        {0x0000a5ac, 0x00000000, 0x00000000, 0x04c15305, 0x04c15305},
+        {0x0000a5b0, 0x00000000, 0x00000000, 0x04c15305, 0x04c15305},
+        {0x0000a5b4, 0x00000000, 0x00000000, 0x04c15305, 0x04c15305},
+        {0x0000a5b8, 0x00000000, 0x00000000, 0x04c15305, 0x04c15305},
+        {0x0000a5bc, 0x00000000, 0x00000000, 0x04c15305, 0x04c15305},
         {0x0000b500, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
         {0x0000b504, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
         {0x0000b508, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
@@ -341,6 +373,100 @@ static const u32 ar9485Modes_high_ob_db_tx_gain_1_1[][5] = {
         {0x0000a2e0, 0x00000000, 0x00000000, 0xffc63a84, 0xffc63a84},
         {0x0000a2e4, 0x00000000, 0x00000000, 0xfe0fc000, 0xfe0fc000},
         {0x0000a2e8, 0x00000000, 0x00000000, 0xfff00000, 0xfff00000},
+        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050da, 0x000050da},
+        {0x0000a458, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a500, 0x00022200, 0x00022200, 0x00000000, 0x00000000},
+        {0x0000a504, 0x05062002, 0x05062002, 0x04000002, 0x04000002},
+        {0x0000a508, 0x0c002e00, 0x0c002e00, 0x08000004, 0x08000004},
+        {0x0000a50c, 0x11062202, 0x11062202, 0x0d000200, 0x0d000200},
+        {0x0000a510, 0x17022e00, 0x17022e00, 0x11000202, 0x11000202},
+        {0x0000a514, 0x1d000ec2, 0x1d000ec2, 0x15000400, 0x15000400},
+        {0x0000a518, 0x25020ec0, 0x25020ec0, 0x19000402, 0x19000402},
+        {0x0000a51c, 0x2b020ec3, 0x2b020ec3, 0x1d000404, 0x1d000404},
+        {0x0000a520, 0x2f001f04, 0x2f001f04, 0x21000603, 0x21000603},
+        {0x0000a524, 0x35001fc4, 0x35001fc4, 0x25000605, 0x25000605},
+        {0x0000a528, 0x3c022f04, 0x3c022f04, 0x2a000a03, 0x2a000a03},
+        {0x0000a52c, 0x41023e85, 0x41023e85, 0x2c000a04, 0x2c000a04},
+        {0x0000a530, 0x48023ec6, 0x48023ec6, 0x34000e20, 0x34000e20},
+        {0x0000a534, 0x4d023f01, 0x4d023f01, 0x35000e21, 0x35000e21},
+        {0x0000a538, 0x53023f4b, 0x53023f4b, 0x43000e62, 0x43000e62},
+        {0x0000a53c, 0x5a027f09, 0x5a027f09, 0x45000e63, 0x45000e63},
+        {0x0000a540, 0x5f027fc9, 0x5f027fc9, 0x49000e65, 0x49000e65},
+        {0x0000a544, 0x6502feca, 0x6502feca, 0x4b000e66, 0x4b000e66},
+        {0x0000a548, 0x6b02ff4a, 0x6b02ff4a, 0x4d001645, 0x4d001645},
+        {0x0000a54c, 0x7203feca, 0x7203feca, 0x51001865, 0x51001865},
+        {0x0000a550, 0x7703ff0b, 0x7703ff0b, 0x55001a86, 0x55001a86},
+        {0x0000a554, 0x7d06ffcb, 0x7d06ffcb, 0x57001ce9, 0x57001ce9},
+        {0x0000a558, 0x8407ff0b, 0x8407ff0b, 0x5a001ceb, 0x5a001ceb},
+        {0x0000a55c, 0x8907ffcb, 0x8907ffcb, 0x5e001eeb, 0x5e001eeb},
+        {0x0000a560, 0x900fff0b, 0x900fff0b, 0x62001eee, 0x62001eee},
+        {0x0000a564, 0x960fffcb, 0x960fffcb, 0x66001ff6, 0x66001ff6},
+        {0x0000a568, 0x9c1fff0b, 0x9c1fff0b, 0x66001ff6, 0x66001ff6},
+        {0x0000a56c, 0x9c1fff0b, 0x9c1fff0b, 0x66001ff6, 0x66001ff6},
+        {0x0000a570, 0x9c1fff0b, 0x9c1fff0b, 0x66001ff6, 0x66001ff6},
+        {0x0000a574, 0x9c1fff0b, 0x9c1fff0b, 0x66001ff6, 0x66001ff6},
+        {0x0000a578, 0x9c1fff0b, 0x9c1fff0b, 0x66001ff6, 0x66001ff6},
+        {0x0000a57c, 0x9c1fff0b, 0x9c1fff0b, 0x66001ff6, 0x66001ff6},
+        {0x0000a580, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a584, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a588, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a58c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a590, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a594, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a598, 0x00000000, 0x00000000, 0x01404501, 0x01404501},
+        {0x0000a59c, 0x00000000, 0x00000000, 0x02808a02, 0x02808a02},
+        {0x0000a5a0, 0x00000000, 0x00000000, 0x02808a02, 0x02808a02},
+        {0x0000a5a4, 0x00000000, 0x00000000, 0x02808803, 0x02808803},
+        {0x0000a5a8, 0x00000000, 0x00000000, 0x04c14b04, 0x04c14b04},
+        {0x0000a5ac, 0x00000000, 0x00000000, 0x04c15305, 0x04c15305},
+        {0x0000a5b0, 0x00000000, 0x00000000, 0x04c15305, 0x04c15305},
+        {0x0000a5b4, 0x00000000, 0x00000000, 0x04c15305, 0x04c15305},
+        {0x0000a5b8, 0x00000000, 0x00000000, 0x04c15305, 0x04c15305},
+        {0x0000a5bc, 0x00000000, 0x00000000, 0x04c15305, 0x04c15305},
+        {0x0000b500, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b504, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b508, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b50c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b510, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b514, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b518, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b51c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b520, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b524, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b528, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b52c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b530, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b534, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b538, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b53c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b540, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b544, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b548, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b54c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b550, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b554, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b558, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b55c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b560, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b564, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b568, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b56c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b570, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b574, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b578, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b57c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x00016044, 0x05d6b2db, 0x05d6b2db, 0x05d6b2db, 0x05d6b2db},
+        {0x00016048, 0x6c924260, 0x6c924260, 0x6c924260, 0x6c924260},
+};
+
+static const u32 ar9485Modes_low_ob_db_tx_gain_1_1[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x000098bc, 0x00000002, 0x00000002, 0x00000002, 0x00000002},
+        {0x0000a2d8, 0xf999a83a, 0xf999a83a, 0x7999a83a, 0x7999a83a},
+        {0x0000a2dc, 0x00000000, 0x00000000, 0xfe2d3552, 0xfe2d3552},
+        {0x0000a2e0, 0x00000000, 0x00000000, 0xfe2d3552, 0xfe2d3552},
+        {0x0000a2e4, 0x00000000, 0x00000000, 0xfe2d3552, 0xfe2d3552},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0xfe2d3552, 0xfe2d3552},
         {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d8, 0x000050d8},
         {0x0000a458, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a500, 0x00022200, 0x00022200, 0x00000000, 0x00000000},
@@ -427,7 +553,7 @@ static const u32 ar9485Modes_high_ob_db_tx_gain_1_1[][5] = {
         {0x00016048, 0x6c924260, 0x6c924260, 0x6c924260, 0x6c924260},
 };
 
-static const u32 ar9485Modes_low_ob_db_tx_gain_1_1[][5] = {
+static const u32 ar9485_modes_lowest_ob_db_tx_gain_1_1[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x000098bc, 0x00000002, 0x00000002, 0x00000002, 0x00000002},
         {0x0000a2d8, 0xf999a83a, 0xf999a83a, 0x7999a83a, 0x7999a83a},
@@ -521,12 +647,15 @@ static const u32 ar9485Modes_low_ob_db_tx_gain_1_1[][5] = {
         {0x00016048, 0x6c924260, 0x6c924260, 0x6c924260, 0x6c924260},
 };
 
-#define ar9485_modes_lowest_ob_db_tx_gain_1_1 ar9485Modes_low_ob_db_tx_gain_1_1
-
 static const u32 ar9485Modes_green_spur_ob_db_tx_gain_1_1[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x000098bc, 0x00000003, 0x00000003, 0x00000003, 0x00000003},
-        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d8, 0x000050d8},
+        {0x0000a2d8, 0xf999a83a, 0xf999a83a, 0x7999a83a, 0x7999a83a},
+        {0x0000a2dc, 0x00000000, 0x00000000, 0xffad452a, 0xffad452a},
+        {0x0000a2e0, 0x00000000, 0x00000000, 0xffc98634, 0xffc98634},
+        {0x0000a2e4, 0x00000000, 0x00000000, 0xfff60780, 0xfff60780},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0xfffff800, 0xfffff800},
+        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
         {0x0000a458, 0x80000000, 0x80000000, 0x80000000, 0x80000000},
         {0x0000a500, 0x00022200, 0x00022200, 0x00000006, 0x00000006},
         {0x0000a504, 0x05062002, 0x05062002, 0x03000201, 0x03000201},
@@ -543,23 +672,39 @@ static const u32 ar9485Modes_green_spur_ob_db_tx_gain_1_1[][5] = {
         {0x0000a530, 0x48023ec6, 0x48023ec6, 0x310006e0, 0x310006e0},
         {0x0000a534, 0x4d023f01, 0x4d023f01, 0x330006e0, 0x330006e0},
         {0x0000a538, 0x53023f4b, 0x53023f4b, 0x3e0008e3, 0x3e0008e3},
-        {0x0000a53c, 0x5a027f09, 0x5a027f09, 0x410008e5, 0x410008e5},
-        {0x0000a540, 0x5f027fc9, 0x5f027fc9, 0x430008e6, 0x430008e6},
-        {0x0000a544, 0x6502feca, 0x6502feca, 0x4a0008ec, 0x4a0008ec},
-        {0x0000a548, 0x6b02ff4a, 0x6b02ff4a, 0x4e0008f1, 0x4e0008f1},
-        {0x0000a54c, 0x7203feca, 0x7203feca, 0x520008f3, 0x520008f3},
-        {0x0000a550, 0x7703ff0b, 0x7703ff0b, 0x54000eed, 0x54000eed},
-        {0x0000a554, 0x7d06ffcb, 0x7d06ffcb, 0x58000ef1, 0x58000ef1},
-        {0x0000a558, 0x8407ff0b, 0x8407ff0b, 0x5c000ef3, 0x5c000ef3},
-        {0x0000a55c, 0x8907ffcb, 0x8907ffcb, 0x60000ef5, 0x60000ef5},
-        {0x0000a560, 0x900fff0b, 0x900fff0b, 0x62000ef6, 0x62000ef6},
-        {0x0000a564, 0x960fffcb, 0x960fffcb, 0x62000ef6, 0x62000ef6},
-        {0x0000a568, 0x9c1fff0b, 0x9c1fff0b, 0x62000ef6, 0x62000ef6},
-        {0x0000a56c, 0x9c1fff0b, 0x9c1fff0b, 0x62000ef6, 0x62000ef6},
-        {0x0000a570, 0x9c1fff0b, 0x9c1fff0b, 0x62000ef6, 0x62000ef6},
-        {0x0000a574, 0x9c1fff0b, 0x9c1fff0b, 0x62000ef6, 0x62000ef6},
-        {0x0000a578, 0x9c1fff0b, 0x9c1fff0b, 0x62000ef6, 0x62000ef6},
-        {0x0000a57c, 0x9c1fff0b, 0x9c1fff0b, 0x62000ef6, 0x62000ef6},
+        {0x0000a53c, 0x5a027f09, 0x5a027f09, 0x430008e6, 0x430008e6},
+        {0x0000a540, 0x5f027fc9, 0x5f027fc9, 0x4a0008ec, 0x4a0008ec},
+        {0x0000a544, 0x6502feca, 0x6502feca, 0x4e0008f1, 0x4e0008f1},
+        {0x0000a548, 0x6b02ff4a, 0x6b02ff4a, 0x520008f3, 0x520008f3},
+        {0x0000a54c, 0x7203feca, 0x7203feca, 0x54000eed, 0x54000eed},
+        {0x0000a550, 0x7703ff0b, 0x7703ff0b, 0x58000ef1, 0x58000ef1},
+        {0x0000a554, 0x7d06ffcb, 0x7d06ffcb, 0x5c000ef3, 0x5c000ef3},
+        {0x0000a558, 0x8407ff0b, 0x8407ff0b, 0x62000ef6, 0x62000ef6},
+        {0x0000a55c, 0x8907ffcb, 0x8907ffcb, 0x66001ff0, 0x66001ff0},
+        {0x0000a560, 0x900fff0b, 0x900fff0b, 0x68001ff6, 0x68001ff6},
+        {0x0000a564, 0x960fffcb, 0x960fffcb, 0x68001ff6, 0x68001ff6},
+        {0x0000a568, 0x9c1fff0b, 0x9c1fff0b, 0x68001ff6, 0x68001ff6},
+        {0x0000a56c, 0x9c1fff0b, 0x9c1fff0b, 0x68001ff6, 0x68001ff6},
+        {0x0000a570, 0x9c1fff0b, 0x9c1fff0b, 0x68001ff6, 0x68001ff6},
+        {0x0000a574, 0x9c1fff0b, 0x9c1fff0b, 0x68001ff6, 0x68001ff6},
+        {0x0000a578, 0x9c1fff0b, 0x9c1fff0b, 0x68001ff6, 0x68001ff6},
+        {0x0000a57c, 0x9c1fff0b, 0x9c1fff0b, 0x68001ff6, 0x68001ff6},
+        {0x0000a580, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a584, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a588, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a58c, 0x00000000, 0x00000000, 0x01804000, 0x01804000},
+        {0x0000a590, 0x00000000, 0x00000000, 0x02808a02, 0x02808a02},
+        {0x0000a594, 0x00000000, 0x00000000, 0x0340ca02, 0x0340ca02},
+        {0x0000a598, 0x00000000, 0x00000000, 0x0340cd03, 0x0340cd03},
+        {0x0000a59c, 0x00000000, 0x00000000, 0x0340cd03, 0x0340cd03},
+        {0x0000a5a0, 0x00000000, 0x00000000, 0x06415304, 0x06415304},
+        {0x0000a5a4, 0x00000000, 0x00000000, 0x04c11905, 0x04c11905},
+        {0x0000a5a8, 0x00000000, 0x00000000, 0x06415905, 0x06415905},
+        {0x0000a5ac, 0x00000000, 0x00000000, 0x06415905, 0x06415905},
+        {0x0000a5b0, 0x00000000, 0x00000000, 0x06415905, 0x06415905},
+        {0x0000a5b4, 0x00000000, 0x00000000, 0x06415905, 0x06415905},
+        {0x0000a5b8, 0x00000000, 0x00000000, 0x06415905, 0x06415905},
+        {0x0000a5bc, 0x00000000, 0x00000000, 0x06415905, 0x06415905},
         {0x0000b500, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
         {0x0000b504, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
         {0x0000b508, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
@@ -823,6 +968,7 @@ static const u32 ar9485_common_rx_gain_1_1[][2] = {
         {0x00009e00, 0x03721b20},
         {0x00009e04, 0x00082020},
         {0x00009e18, 0x0300501e},
+        {0x00009e20, 0x000003ba},
         {0x00009e2c, 0x00002e21},
         {0x00009e44, 0x02182324},
         {0x0000a000, 0x00060005},
@@ -1001,7 +1147,6 @@ static const u32 ar9485_1_1_baseband_postamble[][5] = {
         {0x00009e10, 0x7ec88d2e, 0x7ec88d2e, 0x7ec80d2e, 0x7ec80d2e},
         {0x00009e14, 0x31395d53, 0x31396053, 0x312e6053, 0x312e5d53},
         {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
-        {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
         {0x00009e3c, 0xcf946220, 0xcf946220, 0xcf946222, 0xcf946222},
         {0x00009e48, 0x5030201a, 0x5030201a, 0x50302010, 0x50302010},
         {0x00009fc8, 0x0003f000, 0x0003f000, 0x0001a000, 0x0001a000},
@@ -1020,7 +1165,7 @@ static const u32 ar9485_1_1_baseband_postamble[][5] = {
         {0x0000a284, 0x00000000, 0x00000000, 0x000002a0, 0x000002a0},
         {0x0000a288, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a28c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00058d18, 0x00058d18},
+        {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00158d18, 0x00158d18},
         {0x0000a2d0, 0x00071981, 0x00071981, 0x00071982, 0x00071982},
         {0x0000a2d8, 0xf999a83a, 0xf999a83a, 0xf999a83a, 0xf999a83a},
         {0x0000a358, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
@@ -1206,6 +1351,11 @@ static const u32 ar9485_1_1_mac_core[][2] = {
         {0x000083d0, 0x000301ff},
 };
 
-#define ar9485_1_1_baseband_core_txfir_coeff_japan_2484 ar9462_2p0_baseband_core_txfir_coeff_japan_2484
+static const u32 ar9485_1_1_baseband_core_txfir_coeff_japan_2484[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a398, 0x00000000},
+        {0x0000a39c, 0x6f7f0301},
+        {0x0000a3a0, 0xca9228ee},
+};
 
 #endif /* INITVALS_9485_H */
diff --git a/drivers/net/wireless/ath/ath9k/ar9565_1p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9565_1p0_initvals.h
index e85a8b076c22..a8c757b6124f 100644
--- a/drivers/net/wireless/ath/ath9k/ar9565_1p0_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9565_1p0_initvals.h
@@ -272,9 +272,9 @@ static const u32 ar9565_1p0_baseband_core[][2] = {
         {0x0000a398, 0x001f0e0f},
         {0x0000a39c, 0x0075393f},
         {0x0000a3a0, 0xb79f6427},
-        {0x0000a3a4, 0x00000000},
-        {0x0000a3a8, 0xaaaaaaaa},
-        {0x0000a3ac, 0x3c466478},
+        {0x0000a3a4, 0x00000011},
+        {0x0000a3a8, 0xaaaaaa6e},
+        {0x0000a3ac, 0x3c466455},
         {0x0000a3c0, 0x20202020},
         {0x0000a3c4, 0x22222220},
         {0x0000a3c8, 0x20200020},
@@ -295,11 +295,11 @@ static const u32 ar9565_1p0_baseband_core[][2] = {
         {0x0000a404, 0x00000000},
         {0x0000a408, 0x0e79e5c6},
         {0x0000a40c, 0x00820820},
-        {0x0000a414, 0x1ce739ce},
+        {0x0000a414, 0x1ce739c5},
         {0x0000a418, 0x2d001dce},
-        {0x0000a41c, 0x1ce739ce},
+        {0x0000a41c, 0x1ce739c5},
         {0x0000a420, 0x000001ce},
-        {0x0000a424, 0x1ce739ce},
+        {0x0000a424, 0x1ce739c5},
         {0x0000a428, 0x000001ce},
         {0x0000a42c, 0x1ce739ce},
         {0x0000a430, 0x1ce739ce},
@@ -351,9 +351,9 @@ static const u32 ar9565_1p0_baseband_postamble[][5] = {
         {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3379605e, 0x33795d5e},
         {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
-        {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
+        {0x00009e20, 0x000003b5, 0x000003b5, 0x000003a4, 0x000003a4},
         {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
-        {0x00009e3c, 0xcf946222, 0xcf946222, 0xcf946222, 0xcf946222},
+        {0x00009e3c, 0xcf946222, 0xcf946222, 0xcf946220, 0xcf946220},
         {0x00009e44, 0xfe321e27, 0xfe321e27, 0xfe291e27, 0xfe291e27},
         {0x00009e48, 0x5030201a, 0x5030201a, 0x50302012, 0x50302012},
         {0x00009fc8, 0x0003f000, 0x0003f000, 0x0001a000, 0x0001a000},
@@ -452,6 +452,7 @@ static const u32 ar9565_1p0_Common_rx_gain_table[][2] = {
         /* Addr      allmodes  */
         {0x00004050, 0x00300300},
         {0x0000406c, 0x00100000},
+        {0x00009e20, 0x000003b6},
         {0x0000a000, 0x00010000},
         {0x0000a004, 0x00030002},
         {0x0000a008, 0x00050004},
@@ -1230,4 +1231,11 @@ static const u32 ar9565_1p0_modes_high_power_tx_gain_table[][5] = {
         {0x00016054, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
 };
 
+static const u32 ar9565_1p0_baseband_core_txfir_coeff_japan_2484[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a398, 0x00000000},
+        {0x0000a39c, 0x6f7f0301},
+        {0x0000a3a0, 0xca9228ee},
+};
+
 #endif /* INITVALS_9565_1P0_H */
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 2ee35f677c0e..8878f2dada2d 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -459,8 +459,8 @@ void ath9k_queue_reset(struct ath_softc *sc, enum ath_reset_type type);
 
 #define ATH_DUMP_BTCOEX(_s, _val)                               \
         do {                                                    \
-                len += snprintf(buf + len, size - len,          \
-                                "%20s : %10d\n", _s, (_val));   \
+                len += scnprintf(buf + len, size - len,         \
+                                 "%20s : %10d\n", _s, (_val));  \
         } while (0)
 
 enum bt_op_flags {
@@ -581,7 +581,6 @@ static inline void ath_fill_led_pin(struct ath_softc *sc)
 #define ATH_ANT_DIV_COMB_ALT_ANT_RATIO_LOW_RSSI 50
 #define ATH_ANT_DIV_COMB_ALT_ANT_RATIO2_LOW_RSSI 50
 
-#define ATH_ANT_DIV_COMB_LNA1_LNA2_SWITCH_DELTA -1
 #define ATH_ANT_DIV_COMB_LNA1_DELTA_HI -4
 #define ATH_ANT_DIV_COMB_LNA1_DELTA_MID -2
 #define ATH_ANT_DIV_COMB_LNA1_DELTA_LOW 2
@@ -626,12 +625,15 @@ void ath_ant_comb_scan(struct ath_softc *sc, struct ath_rx_status *rs);
 /* Main driver core */
 /********************/
 
-#define ATH9K_PCI_CUS198     0x0001
-#define ATH9K_PCI_CUS230     0x0002
-#define ATH9K_PCI_CUS217     0x0004
-#define ATH9K_PCI_WOW        0x0008
-#define ATH9K_PCI_BT_ANT_DIV 0x0010
-#define ATH9K_PCI_D3_L1_WAR  0x0020
+#define ATH9K_PCI_CUS198      0x0001
+#define ATH9K_PCI_CUS230      0x0002
+#define ATH9K_PCI_CUS217      0x0004
+#define ATH9K_PCI_CUS252      0x0008
+#define ATH9K_PCI_WOW         0x0010
+#define ATH9K_PCI_BT_ANT_DIV  0x0020
+#define ATH9K_PCI_D3_L1_WAR   0x0040
+#define ATH9K_PCI_AR9565_1ANT 0x0080
+#define ATH9K_PCI_AR9565_2ANT 0x0100
 
 /*
  * Default cache line size, in bytes.
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index b5c16b3a37b9..17be35392bb4 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -334,6 +334,8 @@ void ath9k_beacon_tasklet(unsigned long data)
         if (ath9k_hw_numtxpending(ah, sc->beacon.beaconq) != 0) {
                 sc->beacon.bmisscnt++;
 
+                ath9k_hw_check_nav(ah);
+
                 if (!ath9k_hw_check_alive(ah))
                         ieee80211_queue_work(sc->hw, &sc->hw_check_work);
 
diff --git a/drivers/net/wireless/ath/ath9k/calib.c b/drivers/net/wireless/ath/ath9k/calib.c
index 5e8219a91e25..d438a0341e68 100644
--- a/drivers/net/wireless/ath/ath9k/calib.c
+++ b/drivers/net/wireless/ath/ath9k/calib.c
@@ -119,7 +119,7 @@ static void ath9k_hw_update_nfcal_hist_buffer(struct ath_hw *ah,
                         ath_dbg(common, CALIBRATE,
                                 "NFmid[%d] (%d) > MAX (%d), %s\n",
                                 i, h[i].privNF, limit->max,
-                                (cal->nfcal_interference ?
+                                (test_bit(NFCAL_INTF, &cal->cal_flags) ?
                                  "not corrected (due to interference)" :
                                  "correcting to MAX"));
 
@@ -130,7 +130,7 @@ static void ath9k_hw_update_nfcal_hist_buffer(struct ath_hw *ah,
                          * we bypass this limit here in order to better deal
                          * with our environment.
                          */
-                        if (!cal->nfcal_interference)
+                        if (!test_bit(NFCAL_INTF, &cal->cal_flags))
                                 h[i].privNF = limit->max;
                 }
         }
@@ -141,7 +141,7 @@ static void ath9k_hw_update_nfcal_hist_buffer(struct ath_hw *ah,
          * Re-enable the enforcement of the NF maximum again.
          */
         if (!high_nf_mid)
-                cal->nfcal_interference = false;
+                clear_bit(NFCAL_INTF, &cal->cal_flags);
 }
 
 static bool ath9k_hw_get_nf_thresh(struct ath_hw *ah,
@@ -220,7 +220,7 @@ EXPORT_SYMBOL(ath9k_hw_reset_calvalid);
 void ath9k_hw_start_nfcal(struct ath_hw *ah, bool update)
 {
         if (ah->caldata)
-                ah->caldata->nfcal_pending = true;
+                set_bit(NFCAL_PENDING, &ah->caldata->cal_flags);
 
         REG_SET_BIT(ah, AR_PHY_AGC_CONTROL,
                     AR_PHY_AGC_CONTROL_ENABLE_NF);
@@ -391,7 +391,7 @@ bool ath9k_hw_getnf(struct ath_hw *ah, struct ath9k_channel *chan)
         }
 
         h = caldata->nfCalHist;
-        caldata->nfcal_pending = false;
+        clear_bit(NFCAL_PENDING, &caldata->cal_flags);
         ath9k_hw_update_nfcal_hist_buffer(ah, caldata, nfarray);
         chan->noisefloor = h[0].privNF;
         ah->noise = ath9k_hw_getchan_noise(ah, chan);
@@ -437,12 +437,12 @@ void ath9k_hw_bstuck_nfcal(struct ath_hw *ah)
          * the baseband update the internal NF value itself, similar to
          * what is being done after a full reset.
          */
-        if (!caldata->nfcal_pending)
+        if (!test_bit(NFCAL_PENDING, &caldata->cal_flags))
                 ath9k_hw_start_nfcal(ah, true);
         else if (!(REG_READ(ah, AR_PHY_AGC_CONTROL) & AR_PHY_AGC_CONTROL_NF))
                 ath9k_hw_getnf(ah, ah->curchan);
 
-        caldata->nfcal_interference = true;
+        set_bit(NFCAL_INTF, &caldata->cal_flags);
 }
 EXPORT_SYMBOL(ath9k_hw_bstuck_nfcal);
 
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index c088744a6bfb..1be2c787aac9 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -104,37 +104,37 @@ static ssize_t read_file_ani(struct file *file, char __user *user_buf,
                 return -ENOMEM;
 
         if (common->disable_ani) {
-                len += snprintf(buf + len, size - len, "%s: %s\n",
-                                "ANI", "DISABLED");
+                len += scnprintf(buf + len, size - len, "%s: %s\n",
+                                 "ANI", "DISABLED");
                 goto exit;
         }
 
-        len += snprintf(buf + len, size - len, "%15s: %s\n",
-                        "ANI", "ENABLED");
-        len += snprintf(buf + len, size - len, "%15s: %u\n",
-                        "ANI RESET", ah->stats.ast_ani_reset);
-        len += snprintf(buf + len, size - len, "%15s: %u\n",
-                        "SPUR UP", ah->stats.ast_ani_spurup);
-        len += snprintf(buf + len, size - len, "%15s: %u\n",
-                        "SPUR DOWN", ah->stats.ast_ani_spurup);
-        len += snprintf(buf + len, size - len, "%15s: %u\n",
-                        "OFDM WS-DET ON", ah->stats.ast_ani_ofdmon);
-        len += snprintf(buf + len, size - len, "%15s: %u\n",
-                        "OFDM WS-DET OFF", ah->stats.ast_ani_ofdmoff);
-        len += snprintf(buf + len, size - len, "%15s: %u\n",
-                        "MRC-CCK ON", ah->stats.ast_ani_ccklow);
-        len += snprintf(buf + len, size - len, "%15s: %u\n",
-                        "MRC-CCK OFF", ah->stats.ast_ani_cckhigh);
-        len += snprintf(buf + len, size - len, "%15s: %u\n",
-                        "FIR-STEP UP", ah->stats.ast_ani_stepup);
-        len += snprintf(buf + len, size - len, "%15s: %u\n",
-                        "FIR-STEP DOWN", ah->stats.ast_ani_stepdown);
-        len += snprintf(buf + len, size - len, "%15s: %u\n",
-                        "INV LISTENTIME", ah->stats.ast_ani_lneg_or_lzero);
-        len += snprintf(buf + len, size - len, "%15s: %u\n",
-                        "OFDM ERRORS", ah->stats.ast_ani_ofdmerrs);
-        len += snprintf(buf + len, size - len, "%15s: %u\n",
-                        "CCK ERRORS", ah->stats.ast_ani_cckerrs);
+        len += scnprintf(buf + len, size - len, "%15s: %s\n",
+                         "ANI", "ENABLED");
+        len += scnprintf(buf + len, size - len, "%15s: %u\n",
+                         "ANI RESET", ah->stats.ast_ani_reset);
+        len += scnprintf(buf + len, size - len, "%15s: %u\n",
+                         "SPUR UP", ah->stats.ast_ani_spurup);
+        len += scnprintf(buf + len, size - len, "%15s: %u\n",
+                         "SPUR DOWN", ah->stats.ast_ani_spurup);
+        len += scnprintf(buf + len, size - len, "%15s: %u\n",
+                         "OFDM WS-DET ON", ah->stats.ast_ani_ofdmon);
+        len += scnprintf(buf + len, size - len, "%15s: %u\n",
+                         "OFDM WS-DET OFF", ah->stats.ast_ani_ofdmoff);
+        len += scnprintf(buf + len, size - len, "%15s: %u\n",
+                         "MRC-CCK ON", ah->stats.ast_ani_ccklow);
+        len += scnprintf(buf + len, size - len, "%15s: %u\n",
+                         "MRC-CCK OFF", ah->stats.ast_ani_cckhigh);
+        len += scnprintf(buf + len, size - len, "%15s: %u\n",
+                         "FIR-STEP UP", ah->stats.ast_ani_stepup);
+        len += scnprintf(buf + len, size - len, "%15s: %u\n",
+                         "FIR-STEP DOWN", ah->stats.ast_ani_stepdown);
+        len += scnprintf(buf + len, size - len, "%15s: %u\n",
+                         "INV LISTENTIME", ah->stats.ast_ani_lneg_or_lzero);
+        len += scnprintf(buf + len, size - len, "%15s: %u\n",
+                         "OFDM ERRORS", ah->stats.ast_ani_ofdmerrs);
+        len += scnprintf(buf + len, size - len, "%15s: %u\n",
+                         "CCK ERRORS", ah->stats.ast_ani_cckerrs);
 exit:
         if (len > size)
                 len = size;
@@ -280,70 +280,70 @@ static ssize_t read_file_antenna_diversity(struct file *file,
                 return -ENOMEM;
 
         if (!(pCap->hw_caps & ATH9K_HW_CAP_ANT_DIV_COMB)) {
-                len += snprintf(buf + len, size - len, "%s\n",
-                                "Antenna Diversity Combining is disabled");
+                len += scnprintf(buf + len, size - len, "%s\n",
+                                 "Antenna Diversity Combining is disabled");
                 goto exit;
         }
 
         ath9k_ps_wakeup(sc);
         ath9k_hw_antdiv_comb_conf_get(ah, &div_ant_conf);
-        len += snprintf(buf + len, size - len, "Current MAIN config : %s\n",
-                        lna_conf_str[div_ant_conf.main_lna_conf]);
-        len += snprintf(buf + len, size - len, "Current ALT config  : %s\n",
-                        lna_conf_str[div_ant_conf.alt_lna_conf]);
-        len += snprintf(buf + len, size - len, "Average MAIN RSSI   : %d\n",
-                        as_main->rssi_avg);
-        len += snprintf(buf + len, size - len, "Average ALT RSSI    : %d\n\n",
-                        as_alt->rssi_avg);
+        len += scnprintf(buf + len, size - len, "Current MAIN config : %s\n",
+                         lna_conf_str[div_ant_conf.main_lna_conf]);
+        len += scnprintf(buf + len, size - len, "Current ALT config  : %s\n",
+                         lna_conf_str[div_ant_conf.alt_lna_conf]);
+        len += scnprintf(buf + len, size - len, "Average MAIN RSSI   : %d\n",
+                         as_main->rssi_avg);
+        len += scnprintf(buf + len, size - len, "Average ALT RSSI    : %d\n\n",
+                         as_alt->rssi_avg);
         ath9k_ps_restore(sc);
 
-        len += snprintf(buf + len, size - len, "Packet Receive Cnt:\n");
-        len += snprintf(buf + len, size - len, "-------------------\n");
-
-        len += snprintf(buf + len, size - len, "%30s%15s\n",
-                        "MAIN", "ALT");
-        len += snprintf(buf + len, size - len, "%-14s:%15d%15d\n",
-                        "TOTAL COUNT",
-                        as_main->recv_cnt,
-                        as_alt->recv_cnt);
-        len += snprintf(buf + len, size - len, "%-14s:%15d%15d\n",
-                        "LNA1",
-                        as_main->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1],
-                        as_alt->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1]);
-        len += snprintf(buf + len, size - len, "%-14s:%15d%15d\n",
-                        "LNA2",
-                        as_main->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA2],
-                        as_alt->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA2]);
-        len += snprintf(buf + len, size - len, "%-14s:%15d%15d\n",
-                        "LNA1 + LNA2",
-                        as_main->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2],
-                        as_alt->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2]);
-        len += snprintf(buf + len, size - len, "%-14s:%15d%15d\n",
-                        "LNA1 - LNA2",
-                        as_main->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2],
-                        as_alt->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2]);
-
-        len += snprintf(buf + len, size - len, "\nLNA Config Attempts:\n");
-        len += snprintf(buf + len, size - len, "--------------------\n");
-
-        len += snprintf(buf + len, size - len, "%30s%15s\n",
-                        "MAIN", "ALT");
-        len += snprintf(buf + len, size - len, "%-14s:%15d%15d\n",
-                        "LNA1",
-                        as_main->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1],
-                        as_alt->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1]);
-        len += snprintf(buf + len, size - len, "%-14s:%15d%15d\n",
-                        "LNA2",
-                        as_main->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA2],
-                        as_alt->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA2]);
-        len += snprintf(buf + len, size - len, "%-14s:%15d%15d\n",
-                        "LNA1 + LNA2",
-                        as_main->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2],
-                        as_alt->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2]);
-        len += snprintf(buf + len, size - len, "%-14s:%15d%15d\n",
-                        "LNA1 - LNA2",
-                        as_main->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2],
-                        as_alt->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2]);
+        len += scnprintf(buf + len, size - len, "Packet Receive Cnt:\n");
+        len += scnprintf(buf + len, size - len, "-------------------\n");
+
+        len += scnprintf(buf + len, size - len, "%30s%15s\n",
+                         "MAIN", "ALT");
+        len += scnprintf(buf + len, size - len, "%-14s:%15d%15d\n",
+                         "TOTAL COUNT",
+                         as_main->recv_cnt,
+                         as_alt->recv_cnt);
+        len += scnprintf(buf + len, size - len, "%-14s:%15d%15d\n",
+                         "LNA1",
+                         as_main->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1],
+                         as_alt->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1]);
+        len += scnprintf(buf + len, size - len, "%-14s:%15d%15d\n",
+                         "LNA2",
+                         as_main->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA2],
+                         as_alt->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA2]);
+        len += scnprintf(buf + len, size - len, "%-14s:%15d%15d\n",
+                         "LNA1 + LNA2",
+                         as_main->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2],
+                         as_alt->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2]);
+        len += scnprintf(buf + len, size - len, "%-14s:%15d%15d\n",
+                         "LNA1 - LNA2",
+                         as_main->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2],
+                         as_alt->lna_recv_cnt[ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2]);
+
+        len += scnprintf(buf + len, size - len, "\nLNA Config Attempts:\n");
+        len += scnprintf(buf + len, size - len, "--------------------\n");
+
+        len += scnprintf(buf + len, size - len, "%30s%15s\n",
+                         "MAIN", "ALT");
+        len += scnprintf(buf + len, size - len, "%-14s:%15d%15d\n",
+                         "LNA1",
+                         as_main->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1],
+                         as_alt->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1]);
+        len += scnprintf(buf + len, size - len, "%-14s:%15d%15d\n",
+                         "LNA2",
+                         as_main->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA2],
+                         as_alt->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA2]);
+        len += scnprintf(buf + len, size - len, "%-14s:%15d%15d\n",
+                         "LNA1 + LNA2",
+                         as_main->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2],
+                         as_alt->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2]);
+        len += scnprintf(buf + len, size - len, "%-14s:%15d%15d\n",
+                         "LNA1 - LNA2",
+                         as_main->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2],
+                         as_alt->lna_attempt_cnt[ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2]);
 
 exit:
         if (len > size)
@@ -385,21 +385,21 @@ static ssize_t read_file_dma(struct file *file, char __user *user_buf,
                    (AR_MACMISC_MISC_OBS_BUS_1 <<
                     AR_MACMISC_MISC_OBS_BUS_MSB_S)));
 
-        len += snprintf(buf + len, DMA_BUF_LEN - len,
-                        "Raw DMA Debug values:\n");
+        len += scnprintf(buf + len, DMA_BUF_LEN - len,
+                         "Raw DMA Debug values:\n");
 
         for (i = 0; i < ATH9K_NUM_DMA_DEBUG_REGS; i++) {
                 if (i % 4 == 0)
-                        len += snprintf(buf + len, DMA_BUF_LEN - len, "\n");
+                        len += scnprintf(buf + len, DMA_BUF_LEN - len, "\n");
 
                 val[i] = REG_READ_D(ah, AR_DMADBG_0 + (i * sizeof(u32)));
-                len += snprintf(buf + len, DMA_BUF_LEN - len, "%d: %08x ",
-                                i, val[i]);
+                len += scnprintf(buf + len, DMA_BUF_LEN - len, "%d: %08x ",
+                                 i, val[i]);
         }
 
-        len += snprintf(buf + len, DMA_BUF_LEN - len, "\n\n");
-        len += snprintf(buf + len, DMA_BUF_LEN - len,
-                        "Num QCU: chain_st fsp_ok fsp_st DCU: chain_st\n");
+        len += scnprintf(buf + len, DMA_BUF_LEN - len, "\n\n");
+        len += scnprintf(buf + len, DMA_BUF_LEN - len,
+                         "Num QCU: chain_st fsp_ok fsp_st DCU: chain_st\n");
 
         for (i = 0; i < ATH9K_NUM_QUEUES; i++, qcuOffset += 4, dcuOffset += 5) {
                 if (i == 8) {
@@ -412,39 +412,39 @@ static ssize_t read_file_dma(struct file *file, char __user *user_buf,
                         dcuBase++;
                 }
 
-                len += snprintf(buf + len, DMA_BUF_LEN - len,
-                        "%2d          %2x      %1x     %2x           %2x\n",
-                        i, (*qcuBase & (0x7 << qcuOffset)) >> qcuOffset,
-                        (*qcuBase & (0x8 << qcuOffset)) >> (qcuOffset + 3),
-                        val[2] & (0x7 << (i * 3)) >> (i * 3),
-                        (*dcuBase & (0x1f << dcuOffset)) >> dcuOffset);
+                len += scnprintf(buf + len, DMA_BUF_LEN - len,
+                         "%2d          %2x      %1x     %2x           %2x\n",
+                         i, (*qcuBase & (0x7 << qcuOffset)) >> qcuOffset,
+                         (*qcuBase & (0x8 << qcuOffset)) >> (qcuOffset + 3),
+                         val[2] & (0x7 << (i * 3)) >> (i * 3),
+                         (*dcuBase & (0x1f << dcuOffset)) >> dcuOffset);
         }
 
-        len += snprintf(buf + len, DMA_BUF_LEN - len, "\n");
+        len += scnprintf(buf + len, DMA_BUF_LEN - len, "\n");
 
-        len += snprintf(buf + len, DMA_BUF_LEN - len,
+        len += scnprintf(buf + len, DMA_BUF_LEN - len,
                 "qcu_stitch state:   %2x    qcu_fetch state:        %2x\n",
                 (val[3] & 0x003c0000) >> 18, (val[3] & 0x03c00000) >> 22);
-        len += snprintf(buf + len, DMA_BUF_LEN - len,
+        len += scnprintf(buf + len, DMA_BUF_LEN - len,
                 "qcu_complete state: %2x    dcu_complete state:     %2x\n",
                 (val[3] & 0x1c000000) >> 26, (val[6] & 0x3));
-        len += snprintf(buf + len, DMA_BUF_LEN - len,
+        len += scnprintf(buf + len, DMA_BUF_LEN - len,
                 "dcu_arb state:      %2x    dcu_fp state:           %2x\n",
                 (val[5] & 0x06000000) >> 25, (val[5] & 0x38000000) >> 27);
-        len += snprintf(buf + len, DMA_BUF_LEN - len,
+        len += scnprintf(buf + len, DMA_BUF_LEN - len,
                 "chan_idle_dur:     %3d    chan_idle_dur_valid:     %1d\n",
                 (val[6] & 0x000003fc) >> 2, (val[6] & 0x00000400) >> 10);
-        len += snprintf(buf + len, DMA_BUF_LEN - len,
+        len += scnprintf(buf + len, DMA_BUF_LEN - len,
                 "txfifo_valid_0:      %1d    txfifo_valid_1:          %1d\n",
                 (val[6] & 0x00000800) >> 11, (val[6] & 0x00001000) >> 12);
-        len += snprintf(buf + len, DMA_BUF_LEN - len,
+        len += scnprintf(buf + len, DMA_BUF_LEN - len,
                 "txfifo_dcu_num_0:   %2d    txfifo_dcu_num_1:       %2d\n",
                 (val[6] & 0x0001e000) >> 13, (val[6] & 0x001e0000) >> 17);
 
-        len += snprintf(buf + len, DMA_BUF_LEN - len, "pcu observe: 0x%x\n",
-                        REG_READ_D(ah, AR_OBS_BUS_1));
-        len += snprintf(buf + len, DMA_BUF_LEN - len,
-                        "AR_CR: 0x%x\n", REG_READ_D(ah, AR_CR));
+        len += scnprintf(buf + len, DMA_BUF_LEN - len, "pcu observe: 0x%x\n",
+                         REG_READ_D(ah, AR_OBS_BUS_1));
+        len += scnprintf(buf + len, DMA_BUF_LEN - len,
+                         "AR_CR: 0x%x\n", REG_READ_D(ah, AR_CR));
 
         ath9k_ps_restore(sc);
 
@@ -530,9 +530,9 @@ static ssize_t read_file_interrupt(struct file *file, char __user *user_buf,
 
 #define PR_IS(a, s)                                             \
         do {                                                    \
-                len += snprintf(buf + len, mxlen - len,         \
-                                "%21s: %10u\n", a,              \
-                                sc->debug.stats.istats.s);      \
+                len += scnprintf(buf + len, mxlen - len,        \
+                                 "%21s: %10u\n", a,             \
+                                 sc->debug.stats.istats.s);     \
         } while (0)
 
         if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
@@ -563,8 +563,8 @@ static ssize_t read_file_interrupt(struct file *file, char __user *user_buf,
         PR_IS("GENTIMER", gen_timer);
         PR_IS("TOTAL", total);
 
-        len += snprintf(buf + len, mxlen - len,
-                        "SYNC_CAUSE stats:\n");
+        len += scnprintf(buf + len, mxlen - len,
+                         "SYNC_CAUSE stats:\n");
 
         PR_IS("Sync-All", sync_cause_all);
         PR_IS("RTC-IRQ", sync_rtc_irq);
@@ -655,16 +655,16 @@ static ssize_t print_queue(struct ath_softc *sc, struct ath_txq *txq,
 
         ath_txq_lock(sc, txq);
 
-        len += snprintf(buf + len, size - len, "%s: %d ",
-                        "qnum", txq->axq_qnum);
-        len += snprintf(buf + len, size - len, "%s: %2d ",
-                        "qdepth", txq->axq_depth);
-        len += snprintf(buf + len, size - len, "%s: %2d ",
-                        "ampdu-depth", txq->axq_ampdu_depth);
-        len += snprintf(buf + len, size - len, "%s: %3d ",
-                        "pending", txq->pending_frames);
-        len += snprintf(buf + len, size - len, "%s: %d\n",
-                        "stopped", txq->stopped);
+        len += scnprintf(buf + len, size - len, "%s: %d ",
+                         "qnum", txq->axq_qnum);
+        len += scnprintf(buf + len, size - len, "%s: %2d ",
+                         "qdepth", txq->axq_depth);
+        len += scnprintf(buf + len, size - len, "%s: %2d ",
+                         "ampdu-depth", txq->axq_ampdu_depth);
+        len += scnprintf(buf + len, size - len, "%s: %3d ",
+                         "pending", txq->pending_frames);
+        len += scnprintf(buf + len, size - len, "%s: %d\n",
+                         "stopped", txq->stopped);
 
         ath_txq_unlock(sc, txq);
         return len;
@@ -687,11 +687,11 @@ static ssize_t read_file_queues(struct file *file, char __user *user_buf,
 
         for (i = 0; i < IEEE80211_NUM_ACS; i++) {
                 txq = sc->tx.txq_map[i];
-                len += snprintf(buf + len, size - len, "(%s):  ", qname[i]);
+                len += scnprintf(buf + len, size - len, "(%s):  ", qname[i]);
                 len += print_queue(sc, txq, buf + len, size - len);
         }
 
-        len += snprintf(buf + len, size - len, "(CAB): ");
+        len += scnprintf(buf + len, size - len, "(CAB): ");
         len += print_queue(sc, sc->beacon.cabq, buf + len, size - len);
 
         if (len > size)
@@ -716,80 +716,82 @@ static ssize_t read_file_misc(struct file *file, char __user *user_buf,
         unsigned int reg;
         u32 rxfilter;
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "BSSID: %pM\n", common->curbssid);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "BSSID-MASK: %pM\n", common->bssidmask);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "OPMODE: %s\n", ath_opmode_to_string(sc->sc_ah->opmode));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "BSSID: %pM\n", common->curbssid);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "BSSID-MASK: %pM\n", common->bssidmask);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "OPMODE: %s\n",
+                         ath_opmode_to_string(sc->sc_ah->opmode));
 
         ath9k_ps_wakeup(sc);
         rxfilter = ath9k_hw_getrxfilter(sc->sc_ah);
         ath9k_ps_restore(sc);
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "RXFILTER: 0x%x", rxfilter);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "RXFILTER: 0x%x", rxfilter);
 
         if (rxfilter & ATH9K_RX_FILTER_UCAST)
-                len += snprintf(buf + len, sizeof(buf) - len, " UCAST");
+                len += scnprintf(buf + len, sizeof(buf) - len, " UCAST");
         if (rxfilter & ATH9K_RX_FILTER_MCAST)
-                len += snprintf(buf + len, sizeof(buf) - len, " MCAST");
+                len += scnprintf(buf + len, sizeof(buf) - len, " MCAST");
         if (rxfilter & ATH9K_RX_FILTER_BCAST)
-                len += snprintf(buf + len, sizeof(buf) - len, " BCAST");
+                len += scnprintf(buf + len, sizeof(buf) - len, " BCAST");
         if (rxfilter & ATH9K_RX_FILTER_CONTROL)
-                len += snprintf(buf + len, sizeof(buf) - len, " CONTROL");
+                len += scnprintf(buf + len, sizeof(buf) - len, " CONTROL");
         if (rxfilter & ATH9K_RX_FILTER_BEACON)
-                len += snprintf(buf + len, sizeof(buf) - len, " BEACON");
+                len += scnprintf(buf + len, sizeof(buf) - len, " BEACON");
         if (rxfilter & ATH9K_RX_FILTER_PROM)
-                len += snprintf(buf + len, sizeof(buf) - len, " PROM");
+                len += scnprintf(buf + len, sizeof(buf) - len, " PROM");
         if (rxfilter & ATH9K_RX_FILTER_PROBEREQ)
-                len += snprintf(buf + len, sizeof(buf) - len, " PROBEREQ");
+                len += scnprintf(buf + len, sizeof(buf) - len, " PROBEREQ");
         if (rxfilter & ATH9K_RX_FILTER_PHYERR)
-                len += snprintf(buf + len, sizeof(buf) - len, " PHYERR");
+                len += scnprintf(buf + len, sizeof(buf) - len, " PHYERR");
         if (rxfilter & ATH9K_RX_FILTER_MYBEACON)
-                len += snprintf(buf + len, sizeof(buf) - len, " MYBEACON");
+                len += scnprintf(buf + len, sizeof(buf) - len, " MYBEACON");
         if (rxfilter & ATH9K_RX_FILTER_COMP_BAR)
-                len += snprintf(buf + len, sizeof(buf) - len, " COMP_BAR");
+                len += scnprintf(buf + len, sizeof(buf) - len, " COMP_BAR");
         if (rxfilter & ATH9K_RX_FILTER_PSPOLL)
-                len += snprintf(buf + len, sizeof(buf) - len, " PSPOLL");
+                len += scnprintf(buf + len, sizeof(buf) - len, " PSPOLL");
         if (rxfilter & ATH9K_RX_FILTER_PHYRADAR)
-                len += snprintf(buf + len, sizeof(buf) - len, " PHYRADAR");
+                len += scnprintf(buf + len, sizeof(buf) - len, " PHYRADAR");
         if (rxfilter & ATH9K_RX_FILTER_MCAST_BCAST_ALL)
-                len += snprintf(buf + len, sizeof(buf) - len, " MCAST_BCAST_ALL");
+                len += scnprintf(buf + len, sizeof(buf) - len, " MCAST_BCAST_ALL");
         if (rxfilter & ATH9K_RX_FILTER_CONTROL_WRAPPER)
-                len += snprintf(buf + len, sizeof(buf) - len, " CONTROL_WRAPPER");
+                len += scnprintf(buf + len, sizeof(buf) - len, " CONTROL_WRAPPER");
 
-        len += snprintf(buf + len, sizeof(buf) - len, "\n");
+        len += scnprintf(buf + len, sizeof(buf) - len, "\n");
 
         reg = sc->sc_ah->imask;
 
-        len += snprintf(buf + len, sizeof(buf) - len, "INTERRUPT-MASK: 0x%x", reg);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "INTERRUPT-MASK: 0x%x", reg);
 
         if (reg & ATH9K_INT_SWBA)
-                len += snprintf(buf + len, sizeof(buf) - len, " SWBA");
+                len += scnprintf(buf + len, sizeof(buf) - len, " SWBA");
         if (reg & ATH9K_INT_BMISS)
-                len += snprintf(buf + len, sizeof(buf) - len, " BMISS");
+                len += scnprintf(buf + len, sizeof(buf) - len, " BMISS");
         if (reg & ATH9K_INT_CST)
-                len += snprintf(buf + len, sizeof(buf) - len, " CST");
+                len += scnprintf(buf + len, sizeof(buf) - len, " CST");
         if (reg & ATH9K_INT_RX)
-                len += snprintf(buf + len, sizeof(buf) - len, " RX");
+                len += scnprintf(buf + len, sizeof(buf) - len, " RX");
         if (reg & ATH9K_INT_RXHP)
-                len += snprintf(buf + len, sizeof(buf) - len, " RXHP");
+                len += scnprintf(buf + len, sizeof(buf) - len, " RXHP");
         if (reg & ATH9K_INT_RXLP)
-                len += snprintf(buf + len, sizeof(buf) - len, " RXLP");
+                len += scnprintf(buf + len, sizeof(buf) - len, " RXLP");
         if (reg & ATH9K_INT_BB_WATCHDOG)
-                len += snprintf(buf + len, sizeof(buf) - len, " BB_WATCHDOG");
+                len += scnprintf(buf + len, sizeof(buf) - len, " BB_WATCHDOG");
 
-        len += snprintf(buf + len, sizeof(buf) - len, "\n");
+        len += scnprintf(buf + len, sizeof(buf) - len, "\n");
 
         ath9k_calculate_iter_data(hw, NULL, &iter_data);
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "VIF-COUNTS: AP: %i STA: %i MESH: %i WDS: %i"
-                        " ADHOC: %i TOTAL: %hi BEACON-VIF: %hi\n",
-                        iter_data.naps, iter_data.nstations, iter_data.nmeshes,
-                        iter_data.nwds, iter_data.nadhocs,
-                        sc->nvifs, sc->nbcnvifs);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "VIF-COUNTS: AP: %i STA: %i MESH: %i WDS: %i"
+                         " ADHOC: %i TOTAL: %hi BEACON-VIF: %hi\n",
+                         iter_data.naps, iter_data.nstations, iter_data.nmeshes,
+                         iter_data.nwds, iter_data.nadhocs,
+                         sc->nvifs, sc->nbcnvifs);
 
         if (len > sizeof(buf))
                 len = sizeof(buf);
@@ -805,27 +807,27 @@ static ssize_t read_file_reset(struct file *file, char __user *user_buf,
         char buf[512];
         unsigned int len = 0;
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%17s: %2d\n", "Baseband Hang",
-                        sc->debug.stats.reset[RESET_TYPE_BB_HANG]);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%17s: %2d\n", "Baseband Watchdog",
-                        sc->debug.stats.reset[RESET_TYPE_BB_WATCHDOG]);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%17s: %2d\n", "Fatal HW Error",
-                        sc->debug.stats.reset[RESET_TYPE_FATAL_INT]);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%17s: %2d\n", "TX HW error",
-                        sc->debug.stats.reset[RESET_TYPE_TX_ERROR]);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%17s: %2d\n", "TX Path Hang",
-                        sc->debug.stats.reset[RESET_TYPE_TX_HANG]);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%17s: %2d\n", "PLL RX Hang",
-                        sc->debug.stats.reset[RESET_TYPE_PLL_HANG]);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%17s: %2d\n", "MCI Reset",
-                        sc->debug.stats.reset[RESET_TYPE_MCI]);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%17s: %2d\n", "Baseband Hang",
+                         sc->debug.stats.reset[RESET_TYPE_BB_HANG]);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%17s: %2d\n", "Baseband Watchdog",
+                         sc->debug.stats.reset[RESET_TYPE_BB_WATCHDOG]);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%17s: %2d\n", "Fatal HW Error",
+                         sc->debug.stats.reset[RESET_TYPE_FATAL_INT]);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%17s: %2d\n", "TX HW error",
+                         sc->debug.stats.reset[RESET_TYPE_TX_ERROR]);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%17s: %2d\n", "TX Path Hang",
+                         sc->debug.stats.reset[RESET_TYPE_TX_HANG]);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%17s: %2d\n", "PLL RX Hang",
+                         sc->debug.stats.reset[RESET_TYPE_PLL_HANG]);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%17s: %2d\n", "MCI Reset",
+                         sc->debug.stats.reset[RESET_TYPE_MCI]);
 
         if (len > sizeof(buf))
                 len = sizeof(buf);
@@ -902,14 +904,14 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
                               size_t count, loff_t *ppos)
 {
 #define PHY_ERR(s, p) \
-        len += snprintf(buf + len, size - len, "%22s : %10u\n", s, \
-                        sc->debug.stats.rxstats.phy_err_stats[p]);
+        len += scnprintf(buf + len, size - len, "%22s : %10u\n", s, \
+                         sc->debug.stats.rxstats.phy_err_stats[p]);
 
 #define RXS_ERR(s, e)                                       \
         do {                                                \
-                len += snprintf(buf + len, size - len,      \
-                                "%22s : %10u\n", s,         \
-                                sc->debug.stats.rxstats.e); \
+                len += scnprintf(buf + len, size - len,     \
+                                 "%22s : %10u\n", s,        \
+                                 sc->debug.stats.rxstats.e);\
         } while (0)
 
         struct ath_softc *sc = file->private_data;
@@ -1439,22 +1441,22 @@ static ssize_t read_file_dump_nfcal(struct file *file, char __user *user_buf,
         if (!buf)
                 return -ENOMEM;
 
-        len += snprintf(buf + len, size - len,
-                        "Channel Noise Floor : %d\n", ah->noise);
-        len += snprintf(buf + len, size - len,
-                        "Chain | privNF | # Readings | NF Readings\n");
+        len += scnprintf(buf + len, size - len,
+                         "Channel Noise Floor : %d\n", ah->noise);
+        len += scnprintf(buf + len, size - len,
+                         "Chain | privNF | # Readings | NF Readings\n");
         for (i = 0; i < NUM_NF_READINGS; i++) {
                 if (!(chainmask & (1 << i)) ||
                     ((i >= AR5416_MAX_CHAINS) && !conf_is_ht40(conf)))
                         continue;
 
                 nread = AR_PHY_CCA_FILTERWINDOW_LENGTH - h[i].invalidNFcount;
-                len += snprintf(buf + len, size - len, " %d\t %d\t %d\t\t",
-                                i, h[i].privNF, nread);
+                len += scnprintf(buf + len, size - len, " %d\t %d\t %d\t\t",
+                                 i, h[i].privNF, nread);
                 for (j = 0; j < nread; j++)
-                        len += snprintf(buf + len, size - len,
-                                        " %d", h[i].nfCalBuffer[j]);
-                len += snprintf(buf + len, size - len, "\n");
+                        len += scnprintf(buf + len, size - len,
+                                         " %d", h[i].nfCalBuffer[j]);
+                len += scnprintf(buf + len, size - len, "\n");
         }
 
         if (len > size)
@@ -1543,8 +1545,8 @@ static ssize_t read_file_btcoex(struct file *file, char __user *user_buf,
                 return -ENOMEM;
 
         if (!sc->sc_ah->common.btcoex_enabled) {
-                len = snprintf(buf, size, "%s\n",
-                               "BTCOEX is disabled");
+                len = scnprintf(buf, size, "%s\n",
+                                "BTCOEX is disabled");
                 goto exit;
         }
 
@@ -1582,43 +1584,43 @@ static ssize_t read_file_node_stat(struct file *file, char __user *user_buf,
                 return -ENOMEM;
 
         if (!an->sta->ht_cap.ht_supported) {
-                len = snprintf(buf, size, "%s\n",
-                               "HT not supported");
+                len = scnprintf(buf, size, "%s\n",
+                                "HT not supported");
                 goto exit;
         }
 
-        len = snprintf(buf, size, "Max-AMPDU: %d\n",
-                       an->maxampdu);
-        len += snprintf(buf + len, size - len, "MPDU Density: %d\n\n",
-                        an->mpdudensity);
+        len = scnprintf(buf, size, "Max-AMPDU: %d\n",
+                        an->maxampdu);
+        len += scnprintf(buf + len, size - len, "MPDU Density: %d\n\n",
+                         an->mpdudensity);
 
-        len += snprintf(buf + len, size - len,
-                        "%2s%7s\n", "AC", "SCHED");
+        len += scnprintf(buf + len, size - len,
+                         "%2s%7s\n", "AC", "SCHED");
 
         for (acno = 0, ac = &an->ac[acno];
              acno < IEEE80211_NUM_ACS; acno++, ac++) {
                 txq = ac->txq;
                 ath_txq_lock(sc, txq);
-                len += snprintf(buf + len, size - len,
-                                "%2d%7d\n",
-                                acno, ac->sched);
+                len += scnprintf(buf + len, size - len,
+                                 "%2d%7d\n",
+                                 acno, ac->sched);
                 ath_txq_unlock(sc, txq);
         }
 
-        len += snprintf(buf + len, size - len,
-                        "\n%3s%11s%10s%10s%10s%10s%9s%6s%8s\n",
-                        "TID", "SEQ_START", "SEQ_NEXT", "BAW_SIZE",
-                        "BAW_HEAD", "BAW_TAIL", "BAR_IDX", "SCHED", "PAUSED");
+        len += scnprintf(buf + len, size - len,
+                         "\n%3s%11s%10s%10s%10s%10s%9s%6s%8s\n",
+                         "TID", "SEQ_START", "SEQ_NEXT", "BAW_SIZE",
+                         "BAW_HEAD", "BAW_TAIL", "BAR_IDX", "SCHED", "PAUSED");
 
         for (tidno = 0, tid = &an->tid[tidno];
              tidno < IEEE80211_NUM_TIDS; tidno++, tid++) {
                 txq = tid->ac->txq;
                 ath_txq_lock(sc, txq);
-                len += snprintf(buf + len, size - len,
-                                "%3d%11d%10d%10d%10d%10d%9d%6d%8d\n",
-                                tid->tidno, tid->seq_start, tid->seq_next,
-                                tid->baw_size, tid->baw_head, tid->baw_tail,
-                                tid->bar_index, tid->sched, tid->paused);
+                len += scnprintf(buf + len, size - len,
+                                 "%3d%11d%10d%10d%10d%10d%9d%6d%8d\n",
+                                 tid->tidno, tid->seq_start, tid->seq_next,
+                                 tid->baw_size, tid->baw_head, tid->baw_tail,
+                                 tid->bar_index, tid->sched, tid->paused);
                 ath_txq_unlock(sc, txq);
         }
 exit:
diff --git a/drivers/net/wireless/ath/ath9k/debug.h b/drivers/net/wireless/ath/ath9k/debug.h
index 6e1556fa2f3e..d6e3fa4299a4 100644
--- a/drivers/net/wireless/ath/ath9k/debug.h
+++ b/drivers/net/wireless/ath/ath9k/debug.h
@@ -193,12 +193,12 @@ struct ath_tx_stats {
 #define TXSTATS sc->debug.stats.txstats
 #define PR(str, elem)                                                   \
         do {                                                            \
-                len += snprintf(buf + len, size - len,                  \
-                                "%s%13u%11u%10u%10u\n", str,            \
-                                TXSTATS[PR_QNUM(IEEE80211_AC_BE)].elem, \
-                                TXSTATS[PR_QNUM(IEEE80211_AC_BK)].elem, \
-                                TXSTATS[PR_QNUM(IEEE80211_AC_VI)].elem, \
-                                TXSTATS[PR_QNUM(IEEE80211_AC_VO)].elem); \
+                len += scnprintf(buf + len, size - len,                 \
+                                 "%s%13u%11u%10u%10u\n", str,           \
+                                 TXSTATS[PR_QNUM(IEEE80211_AC_BE)].elem,\
+                                 TXSTATS[PR_QNUM(IEEE80211_AC_BK)].elem,\
+                                 TXSTATS[PR_QNUM(IEEE80211_AC_VI)].elem,\
+                                 TXSTATS[PR_QNUM(IEEE80211_AC_VO)].elem); \
         } while(0)
 
 #define RX_STAT_INC(c) (sc->debug.stats.rxstats.c++)
diff --git a/drivers/net/wireless/ath/ath9k/dfs_debug.c b/drivers/net/wireless/ath/ath9k/dfs_debug.c
index 3c6e4138a95d..821599135d8a 100644
--- a/drivers/net/wireless/ath/ath9k/dfs_debug.c
+++ b/drivers/net/wireless/ath/ath9k/dfs_debug.c
@@ -25,11 +25,11 @@
 struct ath_dfs_pool_stats global_dfs_pool_stats = { 0 };
 
 #define ATH9K_DFS_STAT(s, p) \
-        len += snprintf(buf + len, size - len, "%28s : %10u\n", s, \
-                        sc->debug.stats.dfs_stats.p);
+        len += scnprintf(buf + len, size - len, "%28s : %10u\n", s, \
+                         sc->debug.stats.dfs_stats.p);
 #define ATH9K_DFS_POOL_STAT(s, p) \
-        len += snprintf(buf + len, size - len, "%28s : %10u\n", s, \
-                        global_dfs_pool_stats.p);
+        len += scnprintf(buf + len, size - len, "%28s : %10u\n", s, \
+                         global_dfs_pool_stats.p);
 
 static ssize_t read_file_dfs(struct file *file, char __user *user_buf,
                              size_t count, loff_t *ppos)
@@ -44,12 +44,12 @@ static ssize_t read_file_dfs(struct file *file, char __user *user_buf,
         if (buf == NULL)
                 return -ENOMEM;
 
-        len += snprintf(buf + len, size - len, "DFS support for "
-                        "macVersion = 0x%x, macRev = 0x%x: %s\n",
-                        hw_ver->macVersion, hw_ver->macRev,
-                        (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_DFS) ?
+        len += scnprintf(buf + len, size - len, "DFS support for "
+                         "macVersion = 0x%x, macRev = 0x%x: %s\n",
+                         hw_ver->macVersion, hw_ver->macRev,
+                         (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_DFS) ?
                                         "enabled" : "disabled");
-        len += snprintf(buf + len, size - len, "Pulse detector statistics:\n");
+        len += scnprintf(buf + len, size - len, "Pulse detector statistics:\n");
         ATH9K_DFS_STAT("pulse events reported   ", pulses_total);
         ATH9K_DFS_STAT("invalid pulse events    ", pulses_no_dfs);
         ATH9K_DFS_STAT("DFS pulses detected     ", pulses_detected);
@@ -59,11 +59,12 @@ static ssize_t read_file_dfs(struct file *file, char __user *user_buf,
         ATH9K_DFS_STAT("Primary channel pulses  ", pri_phy_errors);
         ATH9K_DFS_STAT("Secondary channel pulses", ext_phy_errors);
         ATH9K_DFS_STAT("Dual channel pulses     ", dc_phy_errors);
-        len += snprintf(buf + len, size - len, "Radar detector statistics "
-                        "(current DFS region: %d)\n", sc->dfs_detector->region);
+        len += scnprintf(buf + len, size - len, "Radar detector statistics "
+                         "(current DFS region: %d)\n",
+                         sc->dfs_detector->region);
         ATH9K_DFS_STAT("Pulse events processed  ", pulses_processed);
         ATH9K_DFS_STAT("Radars detected         ", radar_detected);
-        len += snprintf(buf + len, size - len, "Global Pool statistics:\n");
+        len += scnprintf(buf + len, size - len, "Global Pool statistics:\n");
         ATH9K_DFS_POOL_STAT("Pool references         ", pool_reference);
         ATH9K_DFS_POOL_STAT("Pulses allocated        ", pulse_allocated);
         ATH9K_DFS_POOL_STAT("Pulses alloc error      ", pulse_alloc_error);
diff --git a/drivers/net/wireless/ath/ath9k/dfs_pri_detector.c b/drivers/net/wireless/ath/ath9k/dfs_pri_detector.c
index 5ba4b6fe37c0..c718fc379a10 100644
--- a/drivers/net/wireless/ath/ath9k/dfs_pri_detector.c
+++ b/drivers/net/wireless/ath/ath9k/dfs_pri_detector.c
@@ -392,7 +392,7 @@ static struct pri_sequence *pri_detector_add_pulse(struct pri_detector *de,
 
         if (!pseq_handler_create_sequences(de, ts, max_updated_seq)) {
                 pri_detector_reset(de, ts);
-                return false;
+                return NULL;
         }
 
         ps = pseq_handler_check_detection(de);
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_4k.c b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
index 9ea8e4b779c9..b4091716e9b3 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_4k.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
@@ -129,10 +129,10 @@ static u32 ath9k_hw_4k_dump_eeprom(struct ath_hw *ah, bool dump_base_hdr,
         struct base_eep_header_4k *pBase = &eep->baseEepHeader;
 
         if (!dump_base_hdr) {
-                len += snprintf(buf + len, size - len,
-                                "%20s :\n", "2GHz modal Header");
+                len += scnprintf(buf + len, size - len,
+                                 "%20s :\n", "2GHz modal Header");
                 len = ath9k_dump_4k_modal_eeprom(buf, len, size,
-                                                  &eep->modalHeader);
+                                                 &eep->modalHeader);
                 goto out;
         }
 
@@ -160,8 +160,8 @@ static u32 ath9k_hw_4k_dump_eeprom(struct ath_hw *ah, bool dump_base_hdr,
         PR_EEP("Cal Bin Build", (pBase->binBuildNumber >> 8) & 0xFF);
         PR_EEP("TX Gain type", pBase->txGainType);
 
-        len += snprintf(buf + len, size - len, "%20s : %pM\n", "MacAddress",
-                        pBase->macAddr);
+        len += scnprintf(buf + len, size - len, "%20s : %pM\n", "MacAddress",
+                         pBase->macAddr);
 
 out:
         if (len > size)
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_9287.c b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
index 3ae1f3df0637..e1d0c217c104 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
@@ -125,8 +125,8 @@ static u32 ath9k_hw_ar9287_dump_eeprom(struct ath_hw *ah, bool dump_base_hdr,
         struct base_eep_ar9287_header *pBase = &eep->baseEepHeader;
 
         if (!dump_base_hdr) {
-                len += snprintf(buf + len, size - len,
-                                "%20s :\n", "2GHz modal Header");
+                len += scnprintf(buf + len, size - len,
+                                 "%20s :\n", "2GHz modal Header");
                 len = ar9287_dump_modal_eeprom(buf, len, size,
                                                 &eep->modalHeader);
                 goto out;
@@ -157,8 +157,8 @@ static u32 ath9k_hw_ar9287_dump_eeprom(struct ath_hw *ah, bool dump_base_hdr,
         PR_EEP("Power Table Offset", pBase->pwrTableOffset);
         PR_EEP("OpenLoop Power Ctrl", pBase->openLoopPwrCntl);
 
-        len += snprintf(buf + len, size - len, "%20s : %pM\n", "MacAddress",
-                        pBase->macAddr);
+        len += scnprintf(buf + len, size - len, "%20s : %pM\n", "MacAddress",
+                         pBase->macAddr);
 
 out:
         if (len > size)
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_def.c b/drivers/net/wireless/ath/ath9k/eeprom_def.c
index 1c25368b3836..39107e31e79a 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_def.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c
@@ -205,12 +205,12 @@ static u32 ath9k_hw_def_dump_eeprom(struct ath_hw *ah, bool dump_base_hdr,
         struct base_eep_header *pBase = &eep->baseEepHeader;
 
         if (!dump_base_hdr) {
-                len += snprintf(buf + len, size - len,
-                                "%20s :\n", "2GHz modal Header");
+                len += scnprintf(buf + len, size - len,
+                                 "%20s :\n", "2GHz modal Header");
                 len = ath9k_def_dump_modal_eeprom(buf, len, size,
                                                    &eep->modalHeader[0]);
-                len += snprintf(buf + len, size - len,
-                                "%20s :\n", "5GHz modal Header");
+                len += scnprintf(buf + len, size - len,
+                                 "%20s :\n", "5GHz modal Header");
                 len = ath9k_def_dump_modal_eeprom(buf, len, size,
                                                    &eep->modalHeader[1]);
                 goto out;
@@ -240,8 +240,8 @@ static u32 ath9k_hw_def_dump_eeprom(struct ath_hw *ah, bool dump_base_hdr,
         PR_EEP("Cal Bin Build", (pBase->binBuildNumber >> 8) & 0xFF);
         PR_EEP("OpenLoop Power Ctrl", pBase->openLoopPwrCntl);
 
-        len += snprintf(buf + len, size - len, "%20s : %pM\n", "MacAddress",
-                        pBase->macAddr);
+        len += scnprintf(buf + len, size - len, "%20s : %pM\n", "MacAddress",
+                         pBase->macAddr);
 
 out:
         if (len > size)
diff --git a/drivers/net/wireless/ath/ath9k/gpio.c b/drivers/net/wireless/ath/ath9k/gpio.c
index 4b412aaf4f36..c34f21241da9 100644
--- a/drivers/net/wireless/ath/ath9k/gpio.c
+++ b/drivers/net/wireless/ath/ath9k/gpio.c
@@ -522,22 +522,22 @@ static int ath9k_dump_mci_btcoex(struct ath_softc *sc, u8 *buf, u32 size)
         ATH_DUMP_BTCOEX("Concurrent Tx", btcoex_hw->mci.concur_tx);
         ATH_DUMP_BTCOEX("Concurrent RSSI cnt", btcoex->rssi_count);
 
-        len += snprintf(buf + len, size - len, "BT Weights: ");
+        len += scnprintf(buf + len, size - len, "BT Weights: ");
         for (i = 0; i < AR9300_NUM_BT_WEIGHTS; i++)
-                len += snprintf(buf + len, size - len, "%08x ",
-                                btcoex_hw->bt_weight[i]);
-        len += snprintf(buf + len, size - len, "\n");
-        len += snprintf(buf + len, size - len, "WLAN Weights: ");
+                len += scnprintf(buf + len, size - len, "%08x ",
+                                 btcoex_hw->bt_weight[i]);
+        len += scnprintf(buf + len, size - len, "\n");
+        len += scnprintf(buf + len, size - len, "WLAN Weights: ");
         for (i = 0; i < AR9300_NUM_BT_WEIGHTS; i++)
-                len += snprintf(buf + len, size - len, "%08x ",
-                                btcoex_hw->wlan_weight[i]);
-        len += snprintf(buf + len, size - len, "\n");
-        len += snprintf(buf + len, size - len, "Tx Priorities: ");
+                len += scnprintf(buf + len, size - len, "%08x ",
+                                 btcoex_hw->wlan_weight[i]);
+        len += scnprintf(buf + len, size - len, "\n");
+        len += scnprintf(buf + len, size - len, "Tx Priorities: ");
         for (i = 0; i < ATH_BTCOEX_STOMP_MAX; i++)
-                len += snprintf(buf + len, size - len, "%08x ",
+                len += scnprintf(buf + len, size - len, "%08x ",
                                 btcoex_hw->tx_prio[i]);
 
-        len += snprintf(buf + len, size - len, "\n");
+        len += scnprintf(buf + len, size - len, "\n");
 
         return len;
 }
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
index c1b45e2f8481..fb071ee4fcfb 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
@@ -37,29 +37,29 @@ static ssize_t read_file_tgt_int_stats(struct file *file, char __user *user_buf,
 
         ath9k_htc_ps_restore(priv);
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "RX",
-                        be32_to_cpu(cmd_rsp.rx));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "RX",
+                         be32_to_cpu(cmd_rsp.rx));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "RXORN",
-                        be32_to_cpu(cmd_rsp.rxorn));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "RXORN",
+                         be32_to_cpu(cmd_rsp.rxorn));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "RXEOL",
-                        be32_to_cpu(cmd_rsp.rxeol));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "RXEOL",
+                         be32_to_cpu(cmd_rsp.rxeol));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "TXURN",
-                        be32_to_cpu(cmd_rsp.txurn));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "TXURN",
+                         be32_to_cpu(cmd_rsp.txurn));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "TXTO",
-                        be32_to_cpu(cmd_rsp.txto));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "TXTO",
+                         be32_to_cpu(cmd_rsp.txto));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "CST",
-                        be32_to_cpu(cmd_rsp.cst));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "CST",
+                         be32_to_cpu(cmd_rsp.cst));
 
         if (len > sizeof(buf))
                 len = sizeof(buf);
@@ -95,41 +95,41 @@ static ssize_t read_file_tgt_tx_stats(struct file *file, char __user *user_buf,
 
         ath9k_htc_ps_restore(priv);
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "Xretries",
-                        be32_to_cpu(cmd_rsp.xretries));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "Xretries",
+                         be32_to_cpu(cmd_rsp.xretries));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "FifoErr",
-                        be32_to_cpu(cmd_rsp.fifoerr));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "FifoErr",
+                         be32_to_cpu(cmd_rsp.fifoerr));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "Filtered",
-                        be32_to_cpu(cmd_rsp.filtered));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "Filtered",
+                         be32_to_cpu(cmd_rsp.filtered));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "TimerExp",
-                        be32_to_cpu(cmd_rsp.timer_exp));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "TimerExp",
+                         be32_to_cpu(cmd_rsp.timer_exp));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "ShortRetries",
-                        be32_to_cpu(cmd_rsp.shortretries));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "ShortRetries",
+                         be32_to_cpu(cmd_rsp.shortretries));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "LongRetries",
-                        be32_to_cpu(cmd_rsp.longretries));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "LongRetries",
+                         be32_to_cpu(cmd_rsp.longretries));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "QueueNull",
-                        be32_to_cpu(cmd_rsp.qnull));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "QueueNull",
+                         be32_to_cpu(cmd_rsp.qnull));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "EncapFail",
-                        be32_to_cpu(cmd_rsp.encap_fail));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "EncapFail",
+                         be32_to_cpu(cmd_rsp.encap_fail));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "NoBuf",
-                        be32_to_cpu(cmd_rsp.nobuf));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "NoBuf",
+                         be32_to_cpu(cmd_rsp.nobuf));
 
         if (len > sizeof(buf))
                 len = sizeof(buf);
@@ -165,17 +165,17 @@ static ssize_t read_file_tgt_rx_stats(struct file *file, char __user *user_buf,
 
         ath9k_htc_ps_restore(priv);
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "NoBuf",
-                        be32_to_cpu(cmd_rsp.nobuf));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "NoBuf",
+                         be32_to_cpu(cmd_rsp.nobuf));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "HostSend",
-                        be32_to_cpu(cmd_rsp.host_send));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "HostSend",
+                         be32_to_cpu(cmd_rsp.host_send));
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "HostDone",
-                        be32_to_cpu(cmd_rsp.host_done));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "HostDone",
+                         be32_to_cpu(cmd_rsp.host_done));
 
         if (len > sizeof(buf))
                 len = sizeof(buf);
@@ -197,37 +197,37 @@ static ssize_t read_file_xmit(struct file *file, char __user *user_buf,
         char buf[512];
         unsigned int len = 0;
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "Buffers queued",
-                        priv->debug.tx_stats.buf_queued);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "Buffers completed",
-                        priv->debug.tx_stats.buf_completed);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "SKBs queued",
-                        priv->debug.tx_stats.skb_queued);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "SKBs success",
-                        priv->debug.tx_stats.skb_success);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "SKBs failed",
-                        priv->debug.tx_stats.skb_failed);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "CAB queued",
-                        priv->debug.tx_stats.cab_queued);
-
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "BE queued",
-                        priv->debug.tx_stats.queue_stats[IEEE80211_AC_BE]);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "BK queued",
-                        priv->debug.tx_stats.queue_stats[IEEE80211_AC_BK]);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "VI queued",
-                        priv->debug.tx_stats.queue_stats[IEEE80211_AC_VI]);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "VO queued",
-                        priv->debug.tx_stats.queue_stats[IEEE80211_AC_VO]);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "Buffers queued",
+                         priv->debug.tx_stats.buf_queued);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "Buffers completed",
+                         priv->debug.tx_stats.buf_completed);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "SKBs queued",
+                         priv->debug.tx_stats.skb_queued);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "SKBs success",
+                         priv->debug.tx_stats.skb_success);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "SKBs failed",
+                         priv->debug.tx_stats.skb_failed);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "CAB queued",
+                         priv->debug.tx_stats.cab_queued);
+
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "BE queued",
+                         priv->debug.tx_stats.queue_stats[IEEE80211_AC_BE]);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "BK queued",
+                         priv->debug.tx_stats.queue_stats[IEEE80211_AC_BK]);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "VI queued",
+                         priv->debug.tx_stats.queue_stats[IEEE80211_AC_VI]);
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "%20s : %10u\n", "VO queued",
+                         priv->debug.tx_stats.queue_stats[IEEE80211_AC_VO]);
 
         if (len > sizeof(buf))
                 len = sizeof(buf);
@@ -273,8 +273,8 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
                               size_t count, loff_t *ppos)
 {
 #define PHY_ERR(s, p)                                                   \
-        len += snprintf(buf + len, size - len, "%20s : %10u\n", s,      \
-                        priv->debug.rx_stats.err_phy_stats[p]);
+        len += scnprintf(buf + len, size - len, "%20s : %10u\n", s,     \
+                         priv->debug.rx_stats.err_phy_stats[p]);
 
         struct ath9k_htc_priv *priv = file->private_data;
         char *buf;
@@ -285,37 +285,37 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
         if (buf == NULL)
                 return -ENOMEM;
 
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10u\n", "SKBs allocated",
-                        priv->debug.rx_stats.skb_allocated);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10u\n", "SKBs completed",
-                        priv->debug.rx_stats.skb_completed);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10u\n", "SKBs Dropped",
-                        priv->debug.rx_stats.skb_dropped);
-
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10u\n", "CRC ERR",
-                        priv->debug.rx_stats.err_crc);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10u\n", "DECRYPT CRC ERR",
-                        priv->debug.rx_stats.err_decrypt_crc);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10u\n", "MIC ERR",
-                        priv->debug.rx_stats.err_mic);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10u\n", "PRE-DELIM CRC ERR",
-                        priv->debug.rx_stats.err_pre_delim);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10u\n", "POST-DELIM CRC ERR",
-                        priv->debug.rx_stats.err_post_delim);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10u\n", "DECRYPT BUSY ERR",
-                        priv->debug.rx_stats.err_decrypt_busy);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10u\n", "TOTAL PHY ERR",
-                        priv->debug.rx_stats.err_phy);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10u\n", "SKBs allocated",
+                         priv->debug.rx_stats.skb_allocated);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10u\n", "SKBs completed",
+                         priv->debug.rx_stats.skb_completed);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10u\n", "SKBs Dropped",
+                         priv->debug.rx_stats.skb_dropped);
+
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10u\n", "CRC ERR",
+                         priv->debug.rx_stats.err_crc);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10u\n", "DECRYPT CRC ERR",
+                         priv->debug.rx_stats.err_decrypt_crc);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10u\n", "MIC ERR",
+                         priv->debug.rx_stats.err_mic);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10u\n", "PRE-DELIM CRC ERR",
+                         priv->debug.rx_stats.err_pre_delim);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10u\n", "POST-DELIM CRC ERR",
+                         priv->debug.rx_stats.err_post_delim);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10u\n", "DECRYPT BUSY ERR",
+                         priv->debug.rx_stats.err_decrypt_busy);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10u\n", "TOTAL PHY ERR",
+                         priv->debug.rx_stats.err_phy);
 
 
         PHY_ERR("UNDERRUN", ATH9K_PHYERR_UNDERRUN);
@@ -372,16 +372,16 @@ static ssize_t read_file_slot(struct file *file, char __user *user_buf,
 
         spin_lock_bh(&priv->tx.tx_lock);
 
-        len += snprintf(buf + len, sizeof(buf) - len, "TX slot bitmap : ");
+        len += scnprintf(buf + len, sizeof(buf) - len, "TX slot bitmap : ");
 
         len += bitmap_scnprintf(buf + len, sizeof(buf) - len,
                                priv->tx.tx_slot, MAX_TX_BUF_NUM);
 
-        len += snprintf(buf + len, sizeof(buf) - len, "\n");
+        len += scnprintf(buf + len, sizeof(buf) - len, "\n");
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "Used slots     : %d\n",
-                        bitmap_weight(priv->tx.tx_slot, MAX_TX_BUF_NUM));
+        len += scnprintf(buf + len, sizeof(buf) - len,
+                         "Used slots     : %d\n",
+                         bitmap_weight(priv->tx.tx_slot, MAX_TX_BUF_NUM));
 
         spin_unlock_bh(&priv->tx.tx_lock);
 
@@ -405,30 +405,30 @@ static ssize_t read_file_queue(struct file *file, char __user *user_buf,
         char buf[512];
         unsigned int len = 0;
 
-        len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
-                        "Mgmt endpoint", skb_queue_len(&priv->tx.mgmt_ep_queue));
+        len += scnprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
+                         "Mgmt endpoint", skb_queue_len(&priv->tx.mgmt_ep_queue));
 
-        len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
-                        "Cab endpoint", skb_queue_len(&priv->tx.cab_ep_queue));
+        len += scnprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
+                         "Cab endpoint", skb_queue_len(&priv->tx.cab_ep_queue));
 
-        len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
-                        "Data BE endpoint", skb_queue_len(&priv->tx.data_be_queue));
+        len += scnprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
+                         "Data BE endpoint", skb_queue_len(&priv->tx.data_be_queue));
 
-        len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
-                        "Data BK endpoint", skb_queue_len(&priv->tx.data_bk_queue));
+        len += scnprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
+                         "Data BK endpoint", skb_queue_len(&priv->tx.data_bk_queue));
 
-        len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
-                        "Data VI endpoint", skb_queue_len(&priv->tx.data_vi_queue));
+        len += scnprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
+                         "Data VI endpoint", skb_queue_len(&priv->tx.data_vi_queue));
 
-        len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
-                        "Data VO endpoint", skb_queue_len(&priv->tx.data_vo_queue));
+        len += scnprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
+                         "Data VO endpoint", skb_queue_len(&priv->tx.data_vo_queue));
 
-        len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
-                        "Failed queue", skb_queue_len(&priv->tx.tx_failed));
+        len += scnprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
+                         "Failed queue", skb_queue_len(&priv->tx.tx_failed));
 
         spin_lock_bh(&priv->tx.tx_lock);
-        len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
-                        "Queued count", priv->tx.queued_cnt);
+        len += scnprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
+                         "Queued count", priv->tx.queued_cnt);
         spin_unlock_bh(&priv->tx.tx_lock);
 
         if (len > sizeof(buf))
@@ -507,70 +507,70 @@ static ssize_t read_file_base_eeprom(struct file *file, char __user *user_buf,
         if (buf == NULL)
                 return -ENOMEM;
 
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n", "Major Version",
-                        pBase->version >> 12);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n", "Minor Version",
-                        pBase->version & 0xFFF);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n", "Checksum",
-                        pBase->checksum);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n", "Length",
-                        pBase->length);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n", "RegDomain1",
-                        pBase->regDmn[0]);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n", "RegDomain2",
-                        pBase->regDmn[1]);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n",
-                        "TX Mask", pBase->txMask);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n",
-                        "RX Mask", pBase->rxMask);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n",
-                        "Allow 5GHz",
-                        !!(pBase->opCapFlags & AR5416_OPFLAGS_11A));
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n",
-                        "Allow 2GHz",
-                        !!(pBase->opCapFlags & AR5416_OPFLAGS_11G));
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n",
-                        "Disable 2GHz HT20",
-                        !!(pBase->opCapFlags & AR5416_OPFLAGS_N_2G_HT20));
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n",
-                        "Disable 2GHz HT40",
-                        !!(pBase->opCapFlags & AR5416_OPFLAGS_N_2G_HT40));
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n",
-                        "Disable 5Ghz HT20",
-                        !!(pBase->opCapFlags & AR5416_OPFLAGS_N_5G_HT20));
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n",
-                        "Disable 5Ghz HT40",
-                        !!(pBase->opCapFlags & AR5416_OPFLAGS_N_5G_HT40));
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n",
-                        "Big Endian",
-                        !!(pBase->eepMisc & 0x01));
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n",
-                        "Cal Bin Major Ver",
-                        (pBase->binBuildNumber >> 24) & 0xFF);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n",
-                        "Cal Bin Minor Ver",
-                        (pBase->binBuildNumber >> 16) & 0xFF);
-        len += snprintf(buf + len, size - len,
-                        "%20s : %10d\n",
-                        "Cal Bin Build",
-                        (pBase->binBuildNumber >> 8) & 0xFF);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n", "Major Version",
+                         pBase->version >> 12);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n", "Minor Version",
+                         pBase->version & 0xFFF);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n", "Checksum",
+                         pBase->checksum);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n", "Length",
+                         pBase->length);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n", "RegDomain1",
+                         pBase->regDmn[0]);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n", "RegDomain2",
+                         pBase->regDmn[1]);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n",
+                         "TX Mask", pBase->txMask);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n",
+                         "RX Mask", pBase->rxMask);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n",
+                         "Allow 5GHz",
+                         !!(pBase->opCapFlags & AR5416_OPFLAGS_11A));
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n",
+                         "Allow 2GHz",
+                         !!(pBase->opCapFlags & AR5416_OPFLAGS_11G));
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n",
+                         "Disable 2GHz HT20",
+                         !!(pBase->opCapFlags & AR5416_OPFLAGS_N_2G_HT20));
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n",
+                         "Disable 2GHz HT40",
+                         !!(pBase->opCapFlags & AR5416_OPFLAGS_N_2G_HT40));
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n",
+                         "Disable 5Ghz HT20",
+                         !!(pBase->opCapFlags & AR5416_OPFLAGS_N_5G_HT20));
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n",
+                         "Disable 5Ghz HT40",
+                         !!(pBase->opCapFlags & AR5416_OPFLAGS_N_5G_HT40));
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n",
+                         "Big Endian",
+                         !!(pBase->eepMisc & 0x01));
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n",
+                         "Cal Bin Major Ver",
+                         (pBase->binBuildNumber >> 24) & 0xFF);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n",
+                         "Cal Bin Minor Ver",
+                         (pBase->binBuildNumber >> 16) & 0xFF);
+        len += scnprintf(buf + len, size - len,
+                         "%20s : %10d\n",
+                         "Cal Bin Build",
+                         (pBase->binBuildNumber >> 8) & 0xFF);
 
         /*
          * UB91 specific data.
@@ -579,10 +579,10 @@ static ssize_t read_file_base_eeprom(struct file *file, char __user *user_buf,
                 struct base_eep_header_4k *pBase4k =
                         &priv->ah->eeprom.map4k.baseEepHeader;
 
-                len += snprintf(buf + len, size - len,
-                                "%20s : %10d\n",
-                                "TX Gain type",
-                                pBase4k->txGainType);
+                len += scnprintf(buf + len, size - len,
+                                 "%20s : %10d\n",
+                                 "TX Gain type",
+                                 pBase4k->txGainType);
         }
 
         /*
@@ -592,19 +592,19 @@ static ssize_t read_file_base_eeprom(struct file *file, char __user *user_buf,
                 struct base_eep_ar9287_header *pBase9287 =
                         &priv->ah->eeprom.map9287.baseEepHeader;
 
-                len += snprintf(buf + len, size - len,
-                                "%20s : %10ddB\n",
-                                "Power Table Offset",
-                                pBase9287->pwrTableOffset);
+                len += scnprintf(buf + len, size - len,
+                                 "%20s : %10ddB\n",
+                                 "Power Table Offset",
+                                 pBase9287->pwrTableOffset);
 
-                len += snprintf(buf + len, size - len,
-                                "%20s : %10d\n",
-                                "OpenLoop Power Ctrl",
-                                pBase9287->openLoopPwrCntl);
+                len += scnprintf(buf + len, size - len,
+                                 "%20s : %10d\n",
+                                 "OpenLoop Power Ctrl",
+                                 pBase9287->openLoopPwrCntl);
         }
 
-        len += snprintf(buf + len, size - len, "%20s : %pM\n", "MacAddress",
-                        pBase->macAddr);
+        len += scnprintf(buf + len, size - len, "%20s : %pM\n", "MacAddress",
+                         pBase->macAddr);
         if (len > size)
                 len = size;
 
@@ -627,8 +627,8 @@ static ssize_t read_4k_modal_eeprom(struct file *file,
 {
 #define PR_EEP(_s, _val)                                                \
         do {                                                            \
-                len += snprintf(buf + len, size - len, "%20s : %10d\n", \
-                                _s, (_val));                            \
+                len += scnprintf(buf + len, size - len, "%20s : %10d\n",\
+                                 _s, (_val));                           \
         } while (0)
 
         struct ath9k_htc_priv *priv = file->private_data;
@@ -708,12 +708,12 @@ static ssize_t read_def_modal_eeprom(struct file *file,
         do {                                                            \
                 if (pBase->opCapFlags & AR5416_OPFLAGS_11G) {           \
                         pModal = &priv->ah->eeprom.def.modalHeader[1];  \
-                        len += snprintf(buf + len, size - len, "%20s : %8d%7s", \
-                                        _s, (_val), "|");               \
+                        len += scnprintf(buf + len, size - len, "%20s : %8d%7s", \
+                                         _s, (_val), "|");              \
                 }                                                       \
                 if (pBase->opCapFlags & AR5416_OPFLAGS_11A) {           \
                         pModal = &priv->ah->eeprom.def.modalHeader[0];  \
-                        len += snprintf(buf + len, size - len, "%9d\n", \
+                        len += scnprintf(buf + len, size - len, "%9d\n",\
                                         (_val));                        \
                 }                                                       \
         } while (0)
@@ -729,10 +729,10 @@ static ssize_t read_def_modal_eeprom(struct file *file,
         if (buf == NULL)
                 return -ENOMEM;
 
-        len += snprintf(buf + len, size - len,
-                        "%31s %15s\n", "2G", "5G");
-        len += snprintf(buf + len, size - len,
-                        "%32s %16s\n", "====", "====\n");
+        len += scnprintf(buf + len, size - len,
+                         "%31s %15s\n", "2G", "5G");
+        len += scnprintf(buf + len, size - len,
+                         "%32s %16s\n", "====", "====\n");
 
         PR_EEP("Chain0 Ant. Control", pModal->antCtrlChain[0]);
         PR_EEP("Chain1 Ant. Control", pModal->antCtrlChain[1]);
@@ -814,8 +814,8 @@ static ssize_t read_9287_modal_eeprom(struct file *file,
 {
 #define PR_EEP(_s, _val)                                                \
         do {                                                            \
-                len += snprintf(buf + len, size - len, "%20s : %10d\n", \
-                                _s, (_val));                            \
+                len += scnprintf(buf + len, size - len, "%20s : %10d\n",\
+                                 _s, (_val));                           \
         } while (0)
 
         struct ath9k_htc_priv *priv = file->private_data;
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index ecc6ec4a1edb..f11e8389a9be 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -549,6 +549,18 @@ static int ath9k_hw_post_init(struct ath_hw *ah)
 
         ath9k_hw_ani_init(ah);
 
+        /*
+         * EEPROM needs to be initialized before we do this.
+         * This is required for regulatory compliance.
+         */
+        if (AR_SREV_9462(ah) || AR_SREV_9565(ah)) {
+                u16 regdmn = ah->eep_ops->get_eeprom(ah, EEP_REG_0);
+                if ((regdmn & 0xF0) == CTL_FCC) {
+                        ah->nf_2g.max = AR_PHY_CCA_MAX_GOOD_VAL_9462_FCC_2GHZ;
+                        ah->nf_5g.max = AR_PHY_CCA_MAX_GOOD_VAL_9462_FCC_5GHZ;
+                }
+        }
+
         return 0;
 }
 
@@ -1644,6 +1656,19 @@ hang_check_iter:
         return true;
 }
 
+void ath9k_hw_check_nav(struct ath_hw *ah)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        u32 val;
+
+        val = REG_READ(ah, AR_NAV);
+        if (val != 0xdeadbeef && val > 0x7fff) {
+                ath_dbg(common, BSTUCK, "Abnormal NAV: 0x%x\n", val);
+                REG_WRITE(ah, AR_NAV, 0);
+        }
+}
+EXPORT_SYMBOL(ath9k_hw_check_nav);
+
 bool ath9k_hw_check_alive(struct ath_hw *ah)
 {
         int count = 50;
@@ -1822,9 +1847,9 @@ static int ath9k_hw_do_fastcc(struct ath_hw *ah, struct ath9k_channel *chan)
          * re-using are present.
          */
         if (AR_SREV_9462(ah) && (ah->caldata &&
-                                 (!ah->caldata->done_txiqcal_once ||
-                                  !ah->caldata->done_txclcal_once ||
-                                  !ah->caldata->rtt_done)))
+                                 (!test_bit(TXIQCAL_DONE, &ah->caldata->cal_flags) ||
+                                  !test_bit(TXCLCAL_DONE, &ah->caldata->cal_flags) ||
+                                  !test_bit(RTT_DONE, &ah->caldata->cal_flags))))
                 goto fail;
 
         ath_dbg(common, RESET, "FastChannelChange for %d -> %d\n",
@@ -1880,7 +1905,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
                 memset(caldata, 0, sizeof(*caldata));
                 ath9k_init_nfcal_hist_buffer(ah, chan);
         } else if (caldata) {
-                caldata->paprd_packet_sent = false;
+                clear_bit(PAPRD_PACKET_SENT, &caldata->cal_flags);
         }
         ah->noise = ath9k_hw_getchan_noise(ah, chan);
 
@@ -2017,8 +2042,8 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         ath9k_hw_init_bb(ah, chan);
 
         if (caldata) {
-                caldata->done_txiqcal_once = false;
-                caldata->done_txclcal_once = false;
+                clear_bit(TXIQCAL_DONE, &caldata->cal_flags);
+                clear_bit(TXCLCAL_DONE, &caldata->cal_flags);
         }
         if (!ath9k_hw_init_cal(ah, chan))
                 return -EIO;
@@ -3240,19 +3265,19 @@ void ath9k_hw_name(struct ath_hw *ah, char *hw_name, size_t len)
 
         /* chipsets >= AR9280 are single-chip */
         if (AR_SREV_9280_20_OR_LATER(ah)) {
-                used = snprintf(hw_name, len,
-                               "Atheros AR%s Rev:%x",
-                               ath9k_hw_mac_bb_name(ah->hw_version.macVersion),
-                               ah->hw_version.macRev);
+                used = scnprintf(hw_name, len,
+                                 "Atheros AR%s Rev:%x",
+                                 ath9k_hw_mac_bb_name(ah->hw_version.macVersion),
+                                 ah->hw_version.macRev);
         }
         else {
-                used = snprintf(hw_name, len,
-                               "Atheros AR%s MAC/BB Rev:%x AR%s RF Rev:%x",
-                               ath9k_hw_mac_bb_name(ah->hw_version.macVersion),
-                               ah->hw_version.macRev,
-                               ath9k_hw_rf_name((ah->hw_version.analog5GhzRev &
-                                                AR_RADIO_SREV_MAJOR)),
-                               ah->hw_version.phyRev);
+                used = scnprintf(hw_name, len,
+                                 "Atheros AR%s MAC/BB Rev:%x AR%s RF Rev:%x",
+                                 ath9k_hw_mac_bb_name(ah->hw_version.macVersion),
+                                 ah->hw_version.macRev,
+                                 ath9k_hw_rf_name((ah->hw_version.analog5GhzRev
+                                                  & AR_RADIO_SREV_MAJOR)),
+                                 ah->hw_version.phyRev);
         }
 
         hw_name[used] = '\0';
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 69a907b55a73..2babf931b459 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -98,8 +98,8 @@
 
 #define PR_EEP(_s, _val)                                                \
         do {                                                            \
-                len += snprintf(buf + len, size - len, "%20s : %10d\n", \
-                                _s, (_val));                            \
+                len += scnprintf(buf + len, size - len, "%20s : %10d\n",\
+                                 _s, (_val));                           \
         } while (0)
 
 #define SM(_v, _f)  (((_v) << _f##_S) & _f)
@@ -404,20 +404,26 @@ enum ath9k_int {
 #define MAX_CL_TAB_ENTRY        16
 #define CL_TAB_ENTRY(reg_base)  (reg_base + (4 * j))
 
+enum ath9k_cal_flags {
+        RTT_DONE,
+        PAPRD_PACKET_SENT,
+        PAPRD_DONE,
+        NFCAL_PENDING,
+        NFCAL_INTF,
+        TXIQCAL_DONE,
+        TXCLCAL_DONE,
+        SW_PKDET_DONE,
+};
+
 struct ath9k_hw_cal_data {
         u16 channel;
         u32 channelFlags;
         u32 chanmode;
+        unsigned long cal_flags;
         int32_t CalValid;
         int8_t iCoff;
         int8_t qCoff;
-        bool rtt_done;
-        bool paprd_packet_sent;
-        bool paprd_done;
-        bool nfcal_pending;
-        bool nfcal_interference;
-        bool done_txiqcal_once;
-        bool done_txclcal_once;
+        u8 caldac[2];
         u16 small_signal_gain[AR9300_MAX_CHAINS];
         u32 pa_table[AR9300_MAX_CHAINS][PAPRD_TABLE_SZ];
         u32 num_measures[AR9300_MAX_CHAINS];
@@ -558,6 +564,7 @@ struct ath_hw_antcomb_conf {
         u8 main_gaintb;
         u8 alt_gaintb;
         int lna1_lna2_delta;
+        int lna1_lna2_switch_delta;
         u8 div_group;
 };
 
@@ -1030,6 +1037,7 @@ void ath9k_hw_set11nmac2040(struct ath_hw *ah);
 void ath9k_hw_beaconinit(struct ath_hw *ah, u32 next_beacon, u32 beacon_period);
 void ath9k_hw_set_sta_beacon_timers(struct ath_hw *ah,
                                     const struct ath9k_beacon_state *bs);
+void ath9k_hw_check_nav(struct ath_hw *ah);
 bool ath9k_hw_check_alive(struct ath_hw *ah);
 
 bool ath9k_hw_setpower(struct ath_hw *ah, enum ath9k_power_mode mode);
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 9a1f349f9260..e3d11c41a145 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -547,6 +547,26 @@ static void ath9k_init_platform(struct ath_softc *sc)
         if (sc->driver_data & ATH9K_PCI_CUS217)
                 ath_info(common, "CUS217 card detected\n");
 
+        if (sc->driver_data & ATH9K_PCI_CUS252)
+                ath_info(common, "CUS252 card detected\n");
+
+        if (sc->driver_data & ATH9K_PCI_AR9565_1ANT)
+                ath_info(common, "WB335 1-ANT card detected\n");
+
+        if (sc->driver_data & ATH9K_PCI_AR9565_2ANT)
+                ath_info(common, "WB335 2-ANT card detected\n");
+
+        /*
+         * Some WB335 cards do not support antenna diversity. Since
+         * we use a hardcoded value for AR9565 instead of using the
+         * EEPROM/OTP data, remove the combining feature from
+         * the HW capabilities bitmap.
+         */
+        if (sc->driver_data & (ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_AR9565_2ANT)) {
+                if (!(sc->driver_data & ATH9K_PCI_BT_ANT_DIV))
+                        pCap->hw_caps &= ~ATH9K_HW_CAP_ANT_DIV_COMB;
+        }
+
         if (sc->driver_data & ATH9K_PCI_BT_ANT_DIV) {
                 pCap->hw_caps |= ATH9K_HW_CAP_BT_ANT_DIV;
                 ath_info(common, "Set BT/WLAN RX diversity capability\n");
diff --git a/drivers/net/wireless/ath/ath9k/link.c b/drivers/net/wireless/ath/ath9k/link.c
index 2f831db396ac..84a60644f93a 100644
--- a/drivers/net/wireless/ath/ath9k/link.c
+++ b/drivers/net/wireless/ath/ath9k/link.c
@@ -184,7 +184,7 @@ static void ath_paprd_activate(struct ath_softc *sc)
         struct ath9k_hw_cal_data *caldata = ah->caldata;
         int chain;
 
-        if (!caldata || !caldata->paprd_done) {
+        if (!caldata || !test_bit(PAPRD_DONE, &caldata->cal_flags)) {
                 ath_dbg(common, CALIBRATE, "Failed to activate PAPRD\n");
                 return;
         }
@@ -256,7 +256,9 @@ void ath_paprd_calibrate(struct work_struct *work)
         int len = 1800;
         int ret;
 
-        if (!caldata || !caldata->paprd_packet_sent || caldata->paprd_done) {
+        if (!caldata ||
+            !test_bit(PAPRD_PACKET_SENT, &caldata->cal_flags) ||
+            test_bit(PAPRD_DONE, &caldata->cal_flags)) {
                 ath_dbg(common, CALIBRATE, "Skipping PAPRD calibration\n");
                 return;
         }
@@ -316,7 +318,7 @@ void ath_paprd_calibrate(struct work_struct *work)
         kfree_skb(skb);
 
         if (chain_ok) {
-                caldata->paprd_done = true;
+                set_bit(PAPRD_DONE, &caldata->cal_flags);
                 ath_paprd_activate(sc);
         }
 
@@ -343,7 +345,7 @@ void ath_ani_calibrate(unsigned long data)
         u32 cal_interval, short_cal_interval, long_cal_interval;
         unsigned long flags;
 
-        if (ah->caldata && ah->caldata->nfcal_interference)
+        if (ah->caldata && test_bit(NFCAL_INTF, &ah->caldata->cal_flags))
                 long_cal_interval = ATH_LONG_CALINTERVAL_INT;
         else
                 long_cal_interval = ATH_LONG_CALINTERVAL;
@@ -432,7 +434,7 @@ set_timer:
         mod_timer(&common->ani.timer, jiffies + msecs_to_jiffies(cal_interval));
 
         if (ar9003_is_paprd_enabled(ah) && ah->caldata) {
-                if (!ah->caldata->paprd_done) {
+                if (!test_bit(PAPRD_DONE, &ah->caldata->cal_flags)) {
                         ieee80211_queue_work(sc->hw, &sc->paprd_work);
                 } else if (!ah->paprd_table_write_done) {
                         ath9k_ps_wakeup(sc);
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index e4f65900132d..cdb3b1e10b95 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -362,6 +362,13 @@ void ath9k_tasklet(unsigned long data)
                         type = RESET_TYPE_BB_WATCHDOG;
 
                 ath9k_queue_reset(sc, type);
+
+                /*
+                 * Increment the ref. counter here so that
+                 * interrupts are enabled in the reset routine.
+                 */
+                atomic_inc(&ah->intr_ref_cnt);
+                ath_dbg(common, ANY, "FATAL: Skipping interrupts\n");
                 goto out;
         }
 
@@ -400,10 +407,9 @@ void ath9k_tasklet(unsigned long data)
 
         ath9k_btcoex_handle_interrupt(sc, status);
 
-out:
         /* re-enable hardware interrupt */
         ath9k_hw_enable_interrupts(ah);
-
+out:
         spin_unlock(&sc->sc_pcu_lock);
         ath9k_ps_restore(sc);
 }
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index d089a7cf01c4..7e4c2524b630 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -269,7 +269,200 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
 
         { PCI_VDEVICE(ATHEROS, 0x0034) }, /* PCI-E  AR9462 */
         { PCI_VDEVICE(ATHEROS, 0x0037) }, /* PCI-E  AR1111/AR9485 */
-        { PCI_VDEVICE(ATHEROS, 0x0036) }, /* PCI-E  AR9565 */
+
+        /* CUS252 */
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_ATHEROS,
+                         0x3028),
+          .driver_data = ATH9K_PCI_CUS252 |
+                         ATH9K_PCI_AR9565_2ANT |
+                         ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x2176),
+          .driver_data = ATH9K_PCI_CUS252 |
+                         ATH9K_PCI_AR9565_2ANT |
+                         ATH9K_PCI_BT_ANT_DIV },
+
+        /* WB335 1-ANT */
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_FOXCONN,
+                         0xE068),
+          .driver_data = ATH9K_PCI_AR9565_1ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x185F, /* WNC */
+                         0xA119),
+          .driver_data = ATH9K_PCI_AR9565_1ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
+                         0x0632),
+          .driver_data = ATH9K_PCI_AR9565_1ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
+                         0x6671),
+          .driver_data = ATH9K_PCI_AR9565_1ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x1B9A, /* XAVI */
+                         0x2811),
+          .driver_data = ATH9K_PCI_AR9565_1ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x1B9A, /* XAVI */
+                         0x2812),
+          .driver_data = ATH9K_PCI_AR9565_1ANT },
+
+        /* WB335 1-ANT / Antenna Diversity */
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_ATHEROS,
+                         0x3025),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_ATHEROS,
+                         0x3026),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_ATHEROS,
+                         0x302B),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_FOXCONN,
+                         0xE069),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x185F, /* WNC */
+                         0x3028),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
+                         0x0622),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
+                         0x0672),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
+                         0x0662),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x213A),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_LENOVO,
+                         0x3026),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_HP,
+                         0x18E3),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_HP,
+                         0x217F),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_DELL,
+                         0x020E),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+
+        /* WB335 2-ANT */
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_SAMSUNG,
+                         0x411A),
+          .driver_data = ATH9K_PCI_AR9565_2ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_SAMSUNG,
+                         0x411B),
+          .driver_data = ATH9K_PCI_AR9565_2ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_SAMSUNG,
+                         0x411C),
+          .driver_data = ATH9K_PCI_AR9565_2ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_SAMSUNG,
+                         0x411D),
+          .driver_data = ATH9K_PCI_AR9565_2ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_SAMSUNG,
+                         0x411E),
+          .driver_data = ATH9K_PCI_AR9565_2ANT },
+
+        /* WB335 2-ANT / Antenna-Diversity */
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_ATHEROS,
+                         0x3027),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_ATHEROS,
+                         0x302C),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
+                         0x0642),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
+                         0x0652),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
+                         0x0612),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x2130),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x144F, /* ASKEY */
+                         0x7202),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x1B9A, /* XAVI */
+                         0x2810),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x185F, /* WNC */
+                         0x3027),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+
+        /* PCI-E AR9565 (WB335) */
+        { PCI_VDEVICE(ATHEROS, 0x0036),
+          .driver_data = ATH9K_PCI_BT_ANT_DIV },
+
         { 0 }
 };
 
diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
index d3d7c51fa6c8..d829bb62a3fc 100644
--- a/drivers/net/wireless/ath/ath9k/rc.c
+++ b/drivers/net/wireless/ath/ath9k/rc.c
@@ -1387,31 +1387,31 @@ static ssize_t read_file_rcstat(struct file *file, char __user *user_buf,
                 int used_mcs = 0, used_htmode = 0;
 
                 if (WLAN_RC_PHY_HT(rc->rate_table->info[i].phy)) {
-                        used_mcs = snprintf(mcs, 5, "%d",
-                                rc->rate_table->info[i].ratecode);
+                        used_mcs = scnprintf(mcs, 5, "%d",
+                                             rc->rate_table->info[i].ratecode);
 
                         if (WLAN_RC_PHY_40(rc->rate_table->info[i].phy))
-                                used_htmode = snprintf(htmode, 5, "HT40");
+                                used_htmode = scnprintf(htmode, 5, "HT40");
                         else if (WLAN_RC_PHY_20(rc->rate_table->info[i].phy))
-                                used_htmode = snprintf(htmode, 5, "HT20");
+                                used_htmode = scnprintf(htmode, 5, "HT20");
                         else
-                                used_htmode = snprintf(htmode, 5, "????");
+                                used_htmode = scnprintf(htmode, 5, "????");
                 }
 
                 mcs[used_mcs] = '\0';
                 htmode[used_htmode] = '\0';
 
-                len += snprintf(buf + len, max - len,
-                        "%6s %6s %3u.%d: "
-                        "%10u %10u %10u %10u\n",
-                        htmode,
-                        mcs,
-                        ratekbps / 1000,
-                        (ratekbps % 1000) / 100,
-                        stats->success,
-                        stats->retries,
-                        stats->xretries,
-                        stats->per);
+                len += scnprintf(buf + len, max - len,
+                                 "%6s %6s %3u.%d: "
+                                 "%10u %10u %10u %10u\n",
+                                 htmode,
+                                 mcs,
+                                 ratekbps / 1000,
+                                 (ratekbps % 1000) / 100,
+                                 stats->success,
+                                 stats->retries,
+                                 stats->xretries,
+                                 stats->per);
         }
 
         if (len > max)
diff --git a/drivers/net/wireless/ath/ath9k/wmi.h b/drivers/net/wireless/ath/ath9k/wmi.h
index fde6da619f30..0db37f230018 100644
--- a/drivers/net/wireless/ath/ath9k/wmi.h
+++ b/drivers/net/wireless/ath/ath9k/wmi.h
@@ -39,7 +39,7 @@ struct wmi_fw_version {
 struct wmi_event_swba {
         __be64 tsf;
         u8 beacon_pending;
-};
+} __packed;
 
 /*
  * 64 - HTC header - WMI header - 1 / txstatus
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 35b515fe3ffa..62c93a655df9 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -2315,7 +2315,7 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
         ath_dbg(common, XMIT, "TX complete: skb: %p\n", skb);
 
         if (sc->sc_ah->caldata)
-                sc->sc_ah->caldata->paprd_packet_sent = true;
+                set_bit(PAPRD_PACKET_SENT, &sc->sc_ah->caldata->cal_flags);
 
         if (!(tx_flags & ATH_TX_ERROR))
                 /* Frame was ACKed */
diff --git a/drivers/net/wireless/ath/wcn36xx/Kconfig b/drivers/net/wireless/ath/wcn36xx/Kconfig
new file mode 100644
index 000000000000..591ebaea8265
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/Kconfig
@@ -0,0 +1,16 @@
+config WCN36XX
+        tristate "Qualcomm Atheros WCN3660/3680 support"
+        depends on MAC80211 && HAS_DMA
+        ---help---
+          This module adds support for wireless adapters based on
+          Qualcomm Atheros WCN3660 and WCN3680 mobile chipsets.
+
+          If you choose to build a module, it'll be called wcn36xx.
+
+config WCN36XX_DEBUGFS
+        bool "WCN36XX debugfs support"
+        depends on WCN36XX
+        ---help---
+          Enabled debugfs support
+
+          If unsure, say Y to make it easier to debug problems.
diff --git a/drivers/net/wireless/ath/wcn36xx/Makefile b/drivers/net/wireless/ath/wcn36xx/Makefile
new file mode 100644
index 000000000000..50c43b4382ba
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/Makefile
@@ -0,0 +1,7 @@
+obj-$(CONFIG_WCN36XX) := wcn36xx.o
+wcn36xx-y +=   main.o \
+               dxe.o \
+               txrx.o \
+               smd.o \
+               pmc.o \
+               debug.o
diff --git a/drivers/net/wireless/ath/wcn36xx/debug.c b/drivers/net/wireless/ath/wcn36xx/debug.c
new file mode 100644
index 000000000000..682bcd650f70
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/debug.c
@@ -0,0 +1,188 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/debugfs.h>
+#include <linux/uaccess.h>
+#include "wcn36xx.h"
+#include "debug.h"
+#include "pmc.h"
+
+#ifdef CONFIG_WCN36XX_DEBUGFS
+
+static int wcn36xx_debugfs_open(struct inode *inode, struct file *file)
+{
+        file->private_data = inode->i_private;
+
+        return 0;
+}
+
+static ssize_t read_file_bool_bmps(struct file *file, char __user *user_buf,
+                                   size_t count, loff_t *ppos)
+{
+        struct wcn36xx *wcn = file->private_data;
+        struct wcn36xx_vif *vif_priv = NULL;
+        struct ieee80211_vif *vif = NULL;
+        char buf[3];
+
+        list_for_each_entry(vif_priv, &wcn->vif_list, list) {
+                        vif = container_of((void *)vif_priv,
+                                   struct ieee80211_vif,
+                                   drv_priv);
+                        if (NL80211_IFTYPE_STATION == vif->type) {
+                                if (vif_priv->pw_state == WCN36XX_BMPS)
+                                        buf[0] = '1';
+                                else
+                                        buf[0] = '0';
+                                break;
+                        }
+        }
+        buf[1] = '\n';
+        buf[2] = 0x00;
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
+}
+
+static ssize_t write_file_bool_bmps(struct file *file,
+                                    const char __user *user_buf,
+                                    size_t count, loff_t *ppos)
+{
+        struct wcn36xx *wcn = file->private_data;
+        struct wcn36xx_vif *vif_priv = NULL;
+        struct ieee80211_vif *vif = NULL;
+
+        char buf[32];
+        int buf_size;
+
+        buf_size = min(count, (sizeof(buf)-1));
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+
+        switch (buf[0]) {
+        case 'y':
+        case 'Y':
+        case '1':
+                list_for_each_entry(vif_priv, &wcn->vif_list, list) {
+                        vif = container_of((void *)vif_priv,
+                                   struct ieee80211_vif,
+                                   drv_priv);
+                        if (NL80211_IFTYPE_STATION == vif->type) {
+                                wcn36xx_enable_keep_alive_null_packet(wcn, vif);
+                                wcn36xx_pmc_enter_bmps_state(wcn, vif);
+                        }
+                }
+                break;
+        case 'n':
+        case 'N':
+        case '0':
+                list_for_each_entry(vif_priv, &wcn->vif_list, list) {
+                        vif = container_of((void *)vif_priv,
+                                   struct ieee80211_vif,
+                                   drv_priv);
+                        if (NL80211_IFTYPE_STATION == vif->type)
+                                wcn36xx_pmc_exit_bmps_state(wcn, vif);
+                }
+                break;
+        }
+
+        return count;
+}
+
+static const struct file_operations fops_wcn36xx_bmps = {
+        .open  =       wcn36xx_debugfs_open,
+        .read  =       read_file_bool_bmps,
+        .write =       write_file_bool_bmps,
+};
+
+static ssize_t write_file_dump(struct file *file,
+                                    const char __user *user_buf,
+                                    size_t count, loff_t *ppos)
+{
+        struct wcn36xx *wcn = file->private_data;
+        char buf[255], *tmp;
+        int buf_size;
+        u32 arg[WCN36xx_MAX_DUMP_ARGS];
+        int i;
+
+        memset(buf, 0, sizeof(buf));
+        memset(arg, 0, sizeof(arg));
+
+        buf_size = min(count, (sizeof(buf) - 1));
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+
+        tmp = buf;
+
+        for (i = 0; i < WCN36xx_MAX_DUMP_ARGS; i++) {
+                char *begin;
+                begin = strsep(&tmp, " ");
+                if (begin == NULL)
+                        break;
+
+                if (kstrtoul(begin, 0, (unsigned long *)(arg + i)) != 0)
+                        break;
+        }
+
+        wcn36xx_info("DUMP args is %d %d %d %d %d\n", arg[0], arg[1], arg[2],
+                     arg[3], arg[4]);
+        wcn36xx_smd_dump_cmd_req(wcn, arg[0], arg[1], arg[2], arg[3], arg[4]);
+
+        return count;
+}
+
+static const struct file_operations fops_wcn36xx_dump = {
+        .open  =       wcn36xx_debugfs_open,
+        .write =       write_file_dump,
+};
+
+#define ADD_FILE(name, mode, fop, priv_data)            \
+        do {                                                    \
+                struct dentry *d;                               \
+                d = debugfs_create_file(__stringify(name),      \
+                                        mode, dfs->rootdir,     \
+                                        priv_data, fop);        \
+                dfs->file_##name.dentry = d;                    \
+                if (IS_ERR(d)) {                                \
+                        wcn36xx_warn("Create the debugfs entry failed");\
+                        dfs->file_##name.dentry = NULL;         \
+                }                                               \
+        } while (0)
+
+
+void wcn36xx_debugfs_init(struct wcn36xx *wcn)
+{
+        struct wcn36xx_dfs_entry *dfs = &wcn->dfs;
+
+        dfs->rootdir = debugfs_create_dir(KBUILD_MODNAME,
+                                          wcn->hw->wiphy->debugfsdir);
+        if (IS_ERR(dfs->rootdir)) {
+                wcn36xx_warn("Create the debugfs failed\n");
+                dfs->rootdir = NULL;
+        }
+
+        ADD_FILE(bmps_switcher, S_IRUSR | S_IWUSR,
+                 &fops_wcn36xx_bmps, wcn);
+        ADD_FILE(dump, S_IWUSR, &fops_wcn36xx_dump, wcn);
+}
+
+void wcn36xx_debugfs_exit(struct wcn36xx *wcn)
+{
+        struct wcn36xx_dfs_entry *dfs = &wcn->dfs;
+        debugfs_remove_recursive(dfs->rootdir);
+}
+
+#endif /* CONFIG_WCN36XX_DEBUGFS */
diff --git a/drivers/net/wireless/ath/wcn36xx/debug.h b/drivers/net/wireless/ath/wcn36xx/debug.h
new file mode 100644
index 000000000000..46307aa562d3
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/debug.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _WCN36XX_DEBUG_H_
+#define _WCN36XX_DEBUG_H_
+
+#include <linux/kernel.h>
+
+#define WCN36xx_MAX_DUMP_ARGS   5
+
+#ifdef CONFIG_WCN36XX_DEBUGFS
+struct wcn36xx_dfs_file {
+        struct dentry *dentry;
+        u32 value;
+};
+
+struct wcn36xx_dfs_entry {
+        struct dentry *rootdir;
+        struct wcn36xx_dfs_file file_bmps_switcher;
+        struct wcn36xx_dfs_file file_dump;
+};
+
+void wcn36xx_debugfs_init(struct wcn36xx *wcn);
+void wcn36xx_debugfs_exit(struct wcn36xx *wcn);
+
+#else
+static inline void wcn36xx_debugfs_init(struct wcn36xx *wcn)
+{
+}
+static inline void wcn36xx_debugfs_exit(struct wcn36xx *wcn)
+{
+}
+
+#endif /* CONFIG_WCN36XX_DEBUGFS */
+
+#endif  /* _WCN36XX_DEBUG_H_ */
diff --git a/drivers/net/wireless/ath/wcn36xx/dxe.c b/drivers/net/wireless/ath/wcn36xx/dxe.c
new file mode 100644
index 000000000000..ee25786b4447
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/dxe.c
@@ -0,0 +1,805 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* DXE - DMA transfer engine
+ * we have 2 channels(High prio and Low prio) for TX and 2 channels for RX.
+ * through low channels data packets are transfered
+ * through high channels managment packets are transfered
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/interrupt.h>
+#include "wcn36xx.h"
+#include "txrx.h"
+
+void *wcn36xx_dxe_get_next_bd(struct wcn36xx *wcn, bool is_low)
+{
+        struct wcn36xx_dxe_ch *ch = is_low ?
+                &wcn->dxe_tx_l_ch :
+                &wcn->dxe_tx_h_ch;
+
+        return ch->head_blk_ctl->bd_cpu_addr;
+}
+
+static void wcn36xx_dxe_write_register(struct wcn36xx *wcn, int addr, int data)
+{
+        wcn36xx_dbg(WCN36XX_DBG_DXE,
+                    "wcn36xx_dxe_write_register: addr=%x, data=%x\n",
+                    addr, data);
+
+        writel(data, wcn->mmio + addr);
+}
+
+static void wcn36xx_dxe_read_register(struct wcn36xx *wcn, int addr, int *data)
+{
+        *data = readl(wcn->mmio + addr);
+
+        wcn36xx_dbg(WCN36XX_DBG_DXE,
+                    "wcn36xx_dxe_read_register: addr=%x, data=%x\n",
+                    addr, *data);
+}
+
+static void wcn36xx_dxe_free_ctl_block(struct wcn36xx_dxe_ch *ch)
+{
+        struct wcn36xx_dxe_ctl *ctl = ch->head_blk_ctl, *next;
+        int i;
+
+        for (i = 0; i < ch->desc_num && ctl; i++) {
+                next = ctl->next;
+                kfree(ctl);
+                ctl = next;
+        }
+}
+
+static int wcn36xx_dxe_allocate_ctl_block(struct wcn36xx_dxe_ch *ch)
+{
+        struct wcn36xx_dxe_ctl *prev_ctl = NULL;
+        struct wcn36xx_dxe_ctl *cur_ctl = NULL;
+        int i;
+
+        for (i = 0; i < ch->desc_num; i++) {
+                cur_ctl = kzalloc(sizeof(*cur_ctl), GFP_KERNEL);
+                if (!cur_ctl)
+                        goto out_fail;
+
+                cur_ctl->ctl_blk_order = i;
+                if (i == 0) {
+                        ch->head_blk_ctl = cur_ctl;
+                        ch->tail_blk_ctl = cur_ctl;
+                } else if (ch->desc_num - 1 == i) {
+                        prev_ctl->next = cur_ctl;
+                        cur_ctl->next = ch->head_blk_ctl;
+                } else {
+                        prev_ctl->next = cur_ctl;
+                }
+                prev_ctl = cur_ctl;
+        }
+
+        return 0;
+
+out_fail:
+        wcn36xx_dxe_free_ctl_block(ch);
+        return -ENOMEM;
+}
+
+int wcn36xx_dxe_alloc_ctl_blks(struct wcn36xx *wcn)
+{
+        int ret;
+
+        wcn->dxe_tx_l_ch.ch_type = WCN36XX_DXE_CH_TX_L;
+        wcn->dxe_tx_h_ch.ch_type = WCN36XX_DXE_CH_TX_H;
+        wcn->dxe_rx_l_ch.ch_type = WCN36XX_DXE_CH_RX_L;
+        wcn->dxe_rx_h_ch.ch_type = WCN36XX_DXE_CH_RX_H;
+
+        wcn->dxe_tx_l_ch.desc_num = WCN36XX_DXE_CH_DESC_NUMB_TX_L;
+        wcn->dxe_tx_h_ch.desc_num = WCN36XX_DXE_CH_DESC_NUMB_TX_H;
+        wcn->dxe_rx_l_ch.desc_num = WCN36XX_DXE_CH_DESC_NUMB_RX_L;
+        wcn->dxe_rx_h_ch.desc_num = WCN36XX_DXE_CH_DESC_NUMB_RX_H;
+
+        wcn->dxe_tx_l_ch.dxe_wq =  WCN36XX_DXE_WQ_TX_L;
+        wcn->dxe_tx_h_ch.dxe_wq =  WCN36XX_DXE_WQ_TX_H;
+
+        wcn->dxe_tx_l_ch.ctrl_bd = WCN36XX_DXE_CTRL_TX_L_BD;
+        wcn->dxe_tx_h_ch.ctrl_bd = WCN36XX_DXE_CTRL_TX_H_BD;
+
+        wcn->dxe_tx_l_ch.ctrl_skb = WCN36XX_DXE_CTRL_TX_L_SKB;
+        wcn->dxe_tx_h_ch.ctrl_skb = WCN36XX_DXE_CTRL_TX_H_SKB;
+
+        wcn->dxe_tx_l_ch.reg_ctrl = WCN36XX_DXE_REG_CTL_TX_L;
+        wcn->dxe_tx_h_ch.reg_ctrl = WCN36XX_DXE_REG_CTL_TX_H;
+
+        wcn->dxe_tx_l_ch.def_ctrl = WCN36XX_DXE_CH_DEFAULT_CTL_TX_L;
+        wcn->dxe_tx_h_ch.def_ctrl = WCN36XX_DXE_CH_DEFAULT_CTL_TX_H;
+
+        /* DXE control block allocation */
+        ret = wcn36xx_dxe_allocate_ctl_block(&wcn->dxe_tx_l_ch);
+        if (ret)
+                goto out_err;
+        ret = wcn36xx_dxe_allocate_ctl_block(&wcn->dxe_tx_h_ch);
+        if (ret)
+                goto out_err;
+        ret = wcn36xx_dxe_allocate_ctl_block(&wcn->dxe_rx_l_ch);
+        if (ret)
+                goto out_err;
+        ret = wcn36xx_dxe_allocate_ctl_block(&wcn->dxe_rx_h_ch);
+        if (ret)
+                goto out_err;
+
+        /* Initialize SMSM state  Clear TX Enable RING EMPTY STATE */
+        ret = wcn->ctrl_ops->smsm_change_state(
+                WCN36XX_SMSM_WLAN_TX_ENABLE,
+                WCN36XX_SMSM_WLAN_TX_RINGS_EMPTY);
+
+        return 0;
+
+out_err:
+        wcn36xx_err("Failed to allocate DXE control blocks\n");
+        wcn36xx_dxe_free_ctl_blks(wcn);
+        return -ENOMEM;
+}
+
+void wcn36xx_dxe_free_ctl_blks(struct wcn36xx *wcn)
+{
+        wcn36xx_dxe_free_ctl_block(&wcn->dxe_tx_l_ch);
+        wcn36xx_dxe_free_ctl_block(&wcn->dxe_tx_h_ch);
+        wcn36xx_dxe_free_ctl_block(&wcn->dxe_rx_l_ch);
+        wcn36xx_dxe_free_ctl_block(&wcn->dxe_rx_h_ch);
+}
+
+static int wcn36xx_dxe_init_descs(struct wcn36xx_dxe_ch *wcn_ch)
+{
+        struct wcn36xx_dxe_desc *cur_dxe = NULL;
+        struct wcn36xx_dxe_desc *prev_dxe = NULL;
+        struct wcn36xx_dxe_ctl *cur_ctl = NULL;
+        size_t size;
+        int i;
+
+        size = wcn_ch->desc_num * sizeof(struct wcn36xx_dxe_desc);
+        wcn_ch->cpu_addr = dma_alloc_coherent(NULL, size, &wcn_ch->dma_addr,
+                                              GFP_KERNEL);
+        if (!wcn_ch->cpu_addr)
+                return -ENOMEM;
+
+        memset(wcn_ch->cpu_addr, 0, size);
+
+        cur_dxe = (struct wcn36xx_dxe_desc *)wcn_ch->cpu_addr;
+        cur_ctl = wcn_ch->head_blk_ctl;
+
+        for (i = 0; i < wcn_ch->desc_num; i++) {
+                cur_ctl->desc = cur_dxe;
+                cur_ctl->desc_phy_addr = wcn_ch->dma_addr +
+                        i * sizeof(struct wcn36xx_dxe_desc);
+
+                switch (wcn_ch->ch_type) {
+                case WCN36XX_DXE_CH_TX_L:
+                        cur_dxe->ctrl = WCN36XX_DXE_CTRL_TX_L;
+                        cur_dxe->dst_addr_l = WCN36XX_DXE_WQ_TX_L;
+                        break;
+                case WCN36XX_DXE_CH_TX_H:
+                        cur_dxe->ctrl = WCN36XX_DXE_CTRL_TX_H;
+                        cur_dxe->dst_addr_l = WCN36XX_DXE_WQ_TX_H;
+                        break;
+                case WCN36XX_DXE_CH_RX_L:
+                        cur_dxe->ctrl = WCN36XX_DXE_CTRL_RX_L;
+                        cur_dxe->src_addr_l = WCN36XX_DXE_WQ_RX_L;
+                        break;
+                case WCN36XX_DXE_CH_RX_H:
+                        cur_dxe->ctrl = WCN36XX_DXE_CTRL_RX_H;
+                        cur_dxe->src_addr_l = WCN36XX_DXE_WQ_RX_H;
+                        break;
+                }
+                if (0 == i) {
+                        cur_dxe->phy_next_l = 0;
+                } else if ((0 < i) && (i < wcn_ch->desc_num - 1)) {
+                        prev_dxe->phy_next_l =
+                                cur_ctl->desc_phy_addr;
+                } else if (i == (wcn_ch->desc_num - 1)) {
+                        prev_dxe->phy_next_l =
+                                cur_ctl->desc_phy_addr;
+                        cur_dxe->phy_next_l =
+                                wcn_ch->head_blk_ctl->desc_phy_addr;
+                }
+                cur_ctl = cur_ctl->next;
+                prev_dxe = cur_dxe;
+                cur_dxe++;
+        }
+
+        return 0;
+}
+
+static void wcn36xx_dxe_init_tx_bd(struct wcn36xx_dxe_ch *ch,
+                                   struct wcn36xx_dxe_mem_pool *pool)
+{
+        int i, chunk_size = pool->chunk_size;
+        dma_addr_t bd_phy_addr = pool->phy_addr;
+        void *bd_cpu_addr = pool->virt_addr;
+        struct wcn36xx_dxe_ctl *cur = ch->head_blk_ctl;
+
+        for (i = 0; i < ch->desc_num; i++) {
+                /* Only every second dxe needs a bd pointer,
+                   the other will point to the skb data */
+                if (!(i & 1)) {
+                        cur->bd_phy_addr = bd_phy_addr;
+                        cur->bd_cpu_addr = bd_cpu_addr;
+                        bd_phy_addr += chunk_size;
+                        bd_cpu_addr += chunk_size;
+                } else {
+                        cur->bd_phy_addr = 0;
+                        cur->bd_cpu_addr = NULL;
+                }
+                cur = cur->next;
+        }
+}
+
+static int wcn36xx_dxe_enable_ch_int(struct wcn36xx *wcn, u16 wcn_ch)
+{
+        int reg_data = 0;
+
+        wcn36xx_dxe_read_register(wcn,
+                                  WCN36XX_DXE_INT_MASK_REG,
+                                  &reg_data);
+
+        reg_data |= wcn_ch;
+
+        wcn36xx_dxe_write_register(wcn,
+                                   WCN36XX_DXE_INT_MASK_REG,
+                                   (int)reg_data);
+        return 0;
+}
+
+static int wcn36xx_dxe_fill_skb(struct wcn36xx_dxe_ctl *ctl)
+{
+        struct wcn36xx_dxe_desc *dxe = ctl->desc;
+        struct sk_buff *skb;
+
+        skb = alloc_skb(WCN36XX_PKT_SIZE, GFP_ATOMIC);
+        if (skb == NULL)
+                return -ENOMEM;
+
+        dxe->dst_addr_l = dma_map_single(NULL,
+                                         skb_tail_pointer(skb),
+                                         WCN36XX_PKT_SIZE,
+                                         DMA_FROM_DEVICE);
+        ctl->skb = skb;
+
+        return 0;
+}
+
+static int wcn36xx_dxe_ch_alloc_skb(struct wcn36xx *wcn,
+                                    struct wcn36xx_dxe_ch *wcn_ch)
+{
+        int i;
+        struct wcn36xx_dxe_ctl *cur_ctl = NULL;
+
+        cur_ctl = wcn_ch->head_blk_ctl;
+
+        for (i = 0; i < wcn_ch->desc_num; i++) {
+                wcn36xx_dxe_fill_skb(cur_ctl);
+                cur_ctl = cur_ctl->next;
+        }
+
+        return 0;
+}
+
+static void wcn36xx_dxe_ch_free_skbs(struct wcn36xx *wcn,
+                                     struct wcn36xx_dxe_ch *wcn_ch)
+{
+        struct wcn36xx_dxe_ctl *cur = wcn_ch->head_blk_ctl;
+        int i;
+
+        for (i = 0; i < wcn_ch->desc_num; i++) {
+                kfree_skb(cur->skb);
+                cur = cur->next;
+        }
+}
+
+void wcn36xx_dxe_tx_ack_ind(struct wcn36xx *wcn, u32 status)
+{
+        struct ieee80211_tx_info *info;
+        struct sk_buff *skb;
+        unsigned long flags;
+
+        spin_lock_irqsave(&wcn->dxe_lock, flags);
+        skb = wcn->tx_ack_skb;
+        wcn->tx_ack_skb = NULL;
+        spin_unlock_irqrestore(&wcn->dxe_lock, flags);
+
+        if (!skb) {
+                wcn36xx_warn("Spurious TX complete indication\n");
+                return;
+        }
+
+        info = IEEE80211_SKB_CB(skb);
+
+        if (status == 1)
+                info->flags |= IEEE80211_TX_STAT_ACK;
+
+        wcn36xx_dbg(WCN36XX_DBG_DXE, "dxe tx ack status: %d\n", status);
+
+        ieee80211_tx_status_irqsafe(wcn->hw, skb);
+        ieee80211_wake_queues(wcn->hw);
+}
+
+static void reap_tx_dxes(struct wcn36xx *wcn, struct wcn36xx_dxe_ch *ch)
+{
+        struct wcn36xx_dxe_ctl *ctl = ch->tail_blk_ctl;
+        struct ieee80211_tx_info *info;
+        unsigned long flags;
+
+        /*
+         * Make at least one loop of do-while because in case ring is
+         * completely full head and tail are pointing to the same element
+         * and while-do will not make any cycles.
+         */
+        do {
+                if (ctl->skb) {
+                        dma_unmap_single(NULL, ctl->desc->src_addr_l,
+                                         ctl->skb->len, DMA_TO_DEVICE);
+                        info = IEEE80211_SKB_CB(ctl->skb);
+                        if (!(info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS)) {
+                                /* Keep frame until TX status comes */
+                                ieee80211_free_txskb(wcn->hw, ctl->skb);
+                        }
+                        spin_lock_irqsave(&ctl->skb_lock, flags);
+                        if (wcn->queues_stopped) {
+                                wcn->queues_stopped = false;
+                                ieee80211_wake_queues(wcn->hw);
+                        }
+                        spin_unlock_irqrestore(&ctl->skb_lock, flags);
+
+                        ctl->skb = NULL;
+                }
+                ctl = ctl->next;
+        } while (ctl != ch->head_blk_ctl &&
+               !(ctl->desc->ctrl & WCN36XX_DXE_CTRL_VALID_MASK));
+
+        ch->tail_blk_ctl = ctl;
+}
+
+static irqreturn_t wcn36xx_irq_tx_complete(int irq, void *dev)
+{
+        struct wcn36xx *wcn = (struct wcn36xx *)dev;
+        int int_src, int_reason;
+
+        wcn36xx_dxe_read_register(wcn, WCN36XX_DXE_INT_SRC_RAW_REG, &int_src);
+
+        if (int_src & WCN36XX_INT_MASK_CHAN_TX_H) {
+                wcn36xx_dxe_read_register(wcn,
+                                          WCN36XX_DXE_CH_STATUS_REG_ADDR_TX_H,
+                                          &int_reason);
+
+                /* TODO: Check int_reason */
+
+                wcn36xx_dxe_write_register(wcn,
+                                           WCN36XX_DXE_0_INT_CLR,
+                                           WCN36XX_INT_MASK_CHAN_TX_H);
+
+                wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_0_INT_ED_CLR,
+                                           WCN36XX_INT_MASK_CHAN_TX_H);
+                wcn36xx_dbg(WCN36XX_DBG_DXE, "dxe tx ready high\n");
+                reap_tx_dxes(wcn, &wcn->dxe_tx_h_ch);
+        }
+
+        if (int_src & WCN36XX_INT_MASK_CHAN_TX_L) {
+                wcn36xx_dxe_read_register(wcn,
+                                          WCN36XX_DXE_CH_STATUS_REG_ADDR_TX_L,
+                                          &int_reason);
+                /* TODO: Check int_reason */
+
+                wcn36xx_dxe_write_register(wcn,
+                                           WCN36XX_DXE_0_INT_CLR,
+                                           WCN36XX_INT_MASK_CHAN_TX_L);
+
+                wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_0_INT_ED_CLR,
+                                           WCN36XX_INT_MASK_CHAN_TX_L);
+                wcn36xx_dbg(WCN36XX_DBG_DXE, "dxe tx ready low\n");
+                reap_tx_dxes(wcn, &wcn->dxe_tx_l_ch);
+        }
+
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t wcn36xx_irq_rx_ready(int irq, void *dev)
+{
+        struct wcn36xx *wcn = (struct wcn36xx *)dev;
+
+        disable_irq_nosync(wcn->rx_irq);
+        wcn36xx_dxe_rx_frame(wcn);
+        enable_irq(wcn->rx_irq);
+        return IRQ_HANDLED;
+}
+
+static int wcn36xx_dxe_request_irqs(struct wcn36xx *wcn)
+{
+        int ret;
+
+        ret = request_irq(wcn->tx_irq, wcn36xx_irq_tx_complete,
+                          IRQF_TRIGGER_HIGH, "wcn36xx_tx", wcn);
+        if (ret) {
+                wcn36xx_err("failed to alloc tx irq\n");
+                goto out_err;
+        }
+
+        ret = request_irq(wcn->rx_irq, wcn36xx_irq_rx_ready, IRQF_TRIGGER_HIGH,
+                          "wcn36xx_rx", wcn);
+        if (ret) {
+                wcn36xx_err("failed to alloc rx irq\n");
+                goto out_txirq;
+        }
+
+        enable_irq_wake(wcn->rx_irq);
+
+        return 0;
+
+out_txirq:
+        free_irq(wcn->tx_irq, wcn);
+out_err:
+        return ret;
+
+}
+
+static int wcn36xx_rx_handle_packets(struct wcn36xx *wcn,
+                                     struct wcn36xx_dxe_ch *ch)
+{
+        struct wcn36xx_dxe_ctl *ctl = ch->head_blk_ctl;
+        struct wcn36xx_dxe_desc *dxe = ctl->desc;
+        dma_addr_t  dma_addr;
+        struct sk_buff *skb;
+
+        while (!(dxe->ctrl & WCN36XX_DXE_CTRL_VALID_MASK)) {
+                skb = ctl->skb;
+                dma_addr = dxe->dst_addr_l;
+                wcn36xx_dxe_fill_skb(ctl);
+
+                switch (ch->ch_type) {
+                case WCN36XX_DXE_CH_RX_L:
+                        dxe->ctrl = WCN36XX_DXE_CTRL_RX_L;
+                        wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_ENCH_ADDR,
+                                                   WCN36XX_DXE_INT_CH1_MASK);
+                        break;
+                case WCN36XX_DXE_CH_RX_H:
+                        dxe->ctrl = WCN36XX_DXE_CTRL_RX_H;
+                        wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_ENCH_ADDR,
+                                                   WCN36XX_DXE_INT_CH3_MASK);
+                        break;
+                default:
+                        wcn36xx_warn("Unknown channel\n");
+                }
+
+                dma_unmap_single(NULL, dma_addr, WCN36XX_PKT_SIZE,
+                                 DMA_FROM_DEVICE);
+                wcn36xx_rx_skb(wcn, skb);
+                ctl = ctl->next;
+                dxe = ctl->desc;
+        }
+
+        ch->head_blk_ctl = ctl;
+
+        return 0;
+}
+
+void wcn36xx_dxe_rx_frame(struct wcn36xx *wcn)
+{
+        int int_src;
+
+        wcn36xx_dxe_read_register(wcn, WCN36XX_DXE_INT_SRC_RAW_REG, &int_src);
+
+        /* RX_LOW_PRI */
+        if (int_src & WCN36XX_DXE_INT_CH1_MASK) {
+                wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_0_INT_CLR,
+                                           WCN36XX_DXE_INT_CH1_MASK);
+                wcn36xx_rx_handle_packets(wcn, &(wcn->dxe_rx_l_ch));
+        }
+
+        /* RX_HIGH_PRI */
+        if (int_src & WCN36XX_DXE_INT_CH3_MASK) {
+                /* Clean up all the INT within this channel */
+                wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_0_INT_CLR,
+                                           WCN36XX_DXE_INT_CH3_MASK);
+                wcn36xx_rx_handle_packets(wcn, &(wcn->dxe_rx_h_ch));
+        }
+
+        if (!int_src)
+                wcn36xx_warn("No DXE interrupt pending\n");
+}
+
+int wcn36xx_dxe_allocate_mem_pools(struct wcn36xx *wcn)
+{
+        size_t s;
+        void *cpu_addr;
+
+        /* Allocate BD headers for MGMT frames */
+
+        /* Where this come from ask QC */
+        wcn->mgmt_mem_pool.chunk_size = WCN36XX_BD_CHUNK_SIZE +
+                16 - (WCN36XX_BD_CHUNK_SIZE % 8);
+
+        s = wcn->mgmt_mem_pool.chunk_size * WCN36XX_DXE_CH_DESC_NUMB_TX_H;
+        cpu_addr = dma_alloc_coherent(NULL, s, &wcn->mgmt_mem_pool.phy_addr,
+                                      GFP_KERNEL);
+        if (!cpu_addr)
+                goto out_err;
+
+        wcn->mgmt_mem_pool.virt_addr = cpu_addr;
+        memset(cpu_addr, 0, s);
+
+        /* Allocate BD headers for DATA frames */
+
+        /* Where this come from ask QC */
+        wcn->data_mem_pool.chunk_size = WCN36XX_BD_CHUNK_SIZE +
+                16 - (WCN36XX_BD_CHUNK_SIZE % 8);
+
+        s = wcn->data_mem_pool.chunk_size * WCN36XX_DXE_CH_DESC_NUMB_TX_L;
+        cpu_addr = dma_alloc_coherent(NULL, s, &wcn->data_mem_pool.phy_addr,
+                                      GFP_KERNEL);
+        if (!cpu_addr)
+                goto out_err;
+
+        wcn->data_mem_pool.virt_addr = cpu_addr;
+        memset(cpu_addr, 0, s);
+
+        return 0;
+
+out_err:
+        wcn36xx_dxe_free_mem_pools(wcn);
+        wcn36xx_err("Failed to allocate BD mempool\n");
+        return -ENOMEM;
+}
+
+void wcn36xx_dxe_free_mem_pools(struct wcn36xx *wcn)
+{
+        if (wcn->mgmt_mem_pool.virt_addr)
+                dma_free_coherent(NULL, wcn->mgmt_mem_pool.chunk_size *
+                                  WCN36XX_DXE_CH_DESC_NUMB_TX_H,
+                                  wcn->mgmt_mem_pool.virt_addr,
+                                  wcn->mgmt_mem_pool.phy_addr);
+
+        if (wcn->data_mem_pool.virt_addr) {
+                dma_free_coherent(NULL, wcn->data_mem_pool.chunk_size *
+                                  WCN36XX_DXE_CH_DESC_NUMB_TX_L,
+                                  wcn->data_mem_pool.virt_addr,
+                                  wcn->data_mem_pool.phy_addr);
+        }
+}
+
+int wcn36xx_dxe_tx_frame(struct wcn36xx *wcn,
+                         struct wcn36xx_vif *vif_priv,
+                         struct sk_buff *skb,
+                         bool is_low)
+{
+        struct wcn36xx_dxe_ctl *ctl = NULL;
+        struct wcn36xx_dxe_desc *desc = NULL;
+        struct wcn36xx_dxe_ch *ch = NULL;
+        unsigned long flags;
+
+        ch = is_low ? &wcn->dxe_tx_l_ch : &wcn->dxe_tx_h_ch;
+
+        ctl = ch->head_blk_ctl;
+
+        spin_lock_irqsave(&ctl->next->skb_lock, flags);
+
+        /*
+         * If skb is not null that means that we reached the tail of the ring
+         * hence ring is full. Stop queues to let mac80211 back off until ring
+         * has an empty slot again.
+         */
+        if (NULL != ctl->next->skb) {
+                ieee80211_stop_queues(wcn->hw);
+                wcn->queues_stopped = true;
+                spin_unlock_irqrestore(&ctl->next->skb_lock, flags);
+                return -EBUSY;
+        }
+        spin_unlock_irqrestore(&ctl->next->skb_lock, flags);
+
+        ctl->skb = NULL;
+        desc = ctl->desc;
+
+        /* Set source address of the BD we send */
+        desc->src_addr_l = ctl->bd_phy_addr;
+
+        desc->dst_addr_l = ch->dxe_wq;
+        desc->fr_len = sizeof(struct wcn36xx_tx_bd);
+        desc->ctrl = ch->ctrl_bd;
+
+        wcn36xx_dbg(WCN36XX_DBG_DXE, "DXE TX\n");
+
+        wcn36xx_dbg_dump(WCN36XX_DBG_DXE_DUMP, "DESC1 >>> ",
+                         (char *)desc, sizeof(*desc));
+        wcn36xx_dbg_dump(WCN36XX_DBG_DXE_DUMP,
+                         "BD   >>> ", (char *)ctl->bd_cpu_addr,
+                         sizeof(struct wcn36xx_tx_bd));
+
+        /* Set source address of the SKB we send */
+        ctl = ctl->next;
+        ctl->skb = skb;
+        desc = ctl->desc;
+        if (ctl->bd_cpu_addr) {
+                wcn36xx_err("bd_cpu_addr cannot be NULL for skb DXE\n");
+                return -EINVAL;
+        }
+
+        desc->src_addr_l = dma_map_single(NULL,
+                                          ctl->skb->data,
+                                          ctl->skb->len,
+                                          DMA_TO_DEVICE);
+
+        desc->dst_addr_l = ch->dxe_wq;
+        desc->fr_len = ctl->skb->len;
+
+        /* set dxe descriptor to VALID */
+        desc->ctrl = ch->ctrl_skb;
+
+        wcn36xx_dbg_dump(WCN36XX_DBG_DXE_DUMP, "DESC2 >>> ",
+                         (char *)desc, sizeof(*desc));
+        wcn36xx_dbg_dump(WCN36XX_DBG_DXE_DUMP, "SKB   >>> ",
+                         (char *)ctl->skb->data, ctl->skb->len);
+
+        /* Move the head of the ring to the next empty descriptor */
+         ch->head_blk_ctl = ctl->next;
+
+        /*
+         * When connected and trying to send data frame chip can be in sleep
+         * mode and writing to the register will not wake up the chip. Instead
+         * notify chip about new frame through SMSM bus.
+         */
+        if (is_low &&  vif_priv->pw_state == WCN36XX_BMPS) {
+                wcn->ctrl_ops->smsm_change_state(
+                                  0,
+                                  WCN36XX_SMSM_WLAN_TX_ENABLE);
+        } else {
+                /* indicate End Of Packet and generate interrupt on descriptor
+                 * done.
+                 */
+                wcn36xx_dxe_write_register(wcn,
+                        ch->reg_ctrl, ch->def_ctrl);
+        }
+
+        return 0;
+}
+
+int wcn36xx_dxe_init(struct wcn36xx *wcn)
+{
+        int reg_data = 0, ret;
+
+        reg_data = WCN36XX_DXE_REG_RESET;
+        wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_REG_CSR_RESET, reg_data);
+
+        /* Setting interrupt path */
+        reg_data = WCN36XX_DXE_CCU_INT;
+        wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_REG_CCU_INT, reg_data);
+
+        /***************************************/
+        /* Init descriptors for TX LOW channel */
+        /***************************************/
+        wcn36xx_dxe_init_descs(&wcn->dxe_tx_l_ch);
+        wcn36xx_dxe_init_tx_bd(&wcn->dxe_tx_l_ch, &wcn->data_mem_pool);
+
+        /* Write channel head to a NEXT register */
+        wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_CH_NEXT_DESC_ADDR_TX_L,
+                wcn->dxe_tx_l_ch.head_blk_ctl->desc_phy_addr);
+
+        /* Program DMA destination addr for TX LOW */
+        wcn36xx_dxe_write_register(wcn,
+                WCN36XX_DXE_CH_DEST_ADDR_TX_L,
+                WCN36XX_DXE_WQ_TX_L);
+
+        wcn36xx_dxe_read_register(wcn, WCN36XX_DXE_REG_CH_EN, &reg_data);
+        wcn36xx_dxe_enable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_TX_L);
+
+        /***************************************/
+        /* Init descriptors for TX HIGH channel */
+        /***************************************/
+        wcn36xx_dxe_init_descs(&wcn->dxe_tx_h_ch);
+        wcn36xx_dxe_init_tx_bd(&wcn->dxe_tx_h_ch, &wcn->mgmt_mem_pool);
+
+        /* Write channel head to a NEXT register */
+        wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_CH_NEXT_DESC_ADDR_TX_H,
+                wcn->dxe_tx_h_ch.head_blk_ctl->desc_phy_addr);
+
+        /* Program DMA destination addr for TX HIGH */
+        wcn36xx_dxe_write_register(wcn,
+                WCN36XX_DXE_CH_DEST_ADDR_TX_H,
+                WCN36XX_DXE_WQ_TX_H);
+
+        wcn36xx_dxe_read_register(wcn, WCN36XX_DXE_REG_CH_EN, &reg_data);
+
+        /* Enable channel interrupts */
+        wcn36xx_dxe_enable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_TX_H);
+
+        /***************************************/
+        /* Init descriptors for RX LOW channel */
+        /***************************************/
+        wcn36xx_dxe_init_descs(&wcn->dxe_rx_l_ch);
+
+        /* For RX we need to preallocated buffers */
+        wcn36xx_dxe_ch_alloc_skb(wcn, &wcn->dxe_rx_l_ch);
+
+        /* Write channel head to a NEXT register */
+        wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_CH_NEXT_DESC_ADDR_RX_L,
+                wcn->dxe_rx_l_ch.head_blk_ctl->desc_phy_addr);
+
+        /* Write DMA source address */
+        wcn36xx_dxe_write_register(wcn,
+                WCN36XX_DXE_CH_SRC_ADDR_RX_L,
+                WCN36XX_DXE_WQ_RX_L);
+
+        /* Program preallocated destination address */
+        wcn36xx_dxe_write_register(wcn,
+                WCN36XX_DXE_CH_DEST_ADDR_RX_L,
+                wcn->dxe_rx_l_ch.head_blk_ctl->desc->phy_next_l);
+
+        /* Enable default control registers */
+        wcn36xx_dxe_write_register(wcn,
+                WCN36XX_DXE_REG_CTL_RX_L,
+                WCN36XX_DXE_CH_DEFAULT_CTL_RX_L);
+
+        /* Enable channel interrupts */
+        wcn36xx_dxe_enable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_RX_L);
+
+        /***************************************/
+        /* Init descriptors for RX HIGH channel */
+        /***************************************/
+        wcn36xx_dxe_init_descs(&wcn->dxe_rx_h_ch);
+
+        /* For RX we need to prealocat buffers */
+        wcn36xx_dxe_ch_alloc_skb(wcn, &wcn->dxe_rx_h_ch);
+
+        /* Write chanel head to a NEXT register */
+        wcn36xx_dxe_write_register(wcn, WCN36XX_DXE_CH_NEXT_DESC_ADDR_RX_H,
+                wcn->dxe_rx_h_ch.head_blk_ctl->desc_phy_addr);
+
+        /* Write DMA source address */
+        wcn36xx_dxe_write_register(wcn,
+                WCN36XX_DXE_CH_SRC_ADDR_RX_H,
+                WCN36XX_DXE_WQ_RX_H);
+
+        /* Program preallocated destination address */
+        wcn36xx_dxe_write_register(wcn,
+                WCN36XX_DXE_CH_DEST_ADDR_RX_H,
+                 wcn->dxe_rx_h_ch.head_blk_ctl->desc->phy_next_l);
+
+        /* Enable default control registers */
+        wcn36xx_dxe_write_register(wcn,
+                WCN36XX_DXE_REG_CTL_RX_H,
+                WCN36XX_DXE_CH_DEFAULT_CTL_RX_H);
+
+        /* Enable channel interrupts */
+        wcn36xx_dxe_enable_ch_int(wcn, WCN36XX_INT_MASK_CHAN_RX_H);
+
+        ret = wcn36xx_dxe_request_irqs(wcn);
+        if (ret < 0)
+                goto out_err;
+
+        return 0;
+
+out_err:
+        return ret;
+}
+
+void wcn36xx_dxe_deinit(struct wcn36xx *wcn)
+{
+        free_irq(wcn->tx_irq, wcn);
+        free_irq(wcn->rx_irq, wcn);
+
+        if (wcn->tx_ack_skb) {
+                ieee80211_tx_status_irqsafe(wcn->hw, wcn->tx_ack_skb);
+                wcn->tx_ack_skb = NULL;
+        }
+
+        wcn36xx_dxe_ch_free_skbs(wcn, &wcn->dxe_rx_l_ch);
+        wcn36xx_dxe_ch_free_skbs(wcn, &wcn->dxe_rx_h_ch);
+}
diff --git a/drivers/net/wireless/ath/wcn36xx/dxe.h b/drivers/net/wireless/ath/wcn36xx/dxe.h
new file mode 100644
index 000000000000..c88562f85de1
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/dxe.h
@@ -0,0 +1,284 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _DXE_H_
+#define _DXE_H_
+
+#include "wcn36xx.h"
+
+/*
+TX_LOW  = DMA0
+TX_HIGH = DMA4
+RX_LOW  = DMA1
+RX_HIGH = DMA3
+H2H_TEST_RX_TX = DMA2
+*/
+
+/* DXE registers */
+#define WCN36XX_DXE_MEM_BASE                    0x03000000
+#define WCN36XX_DXE_MEM_REG                     0x202000
+
+#define WCN36XX_DXE_CCU_INT                     0xA0011
+#define WCN36XX_DXE_REG_CCU_INT                 0x200b10
+
+/* TODO This must calculated properly but not hardcoded */
+#define WCN36XX_DXE_CTRL_TX_L                   0x328a44
+#define WCN36XX_DXE_CTRL_TX_H                   0x32ce44
+#define WCN36XX_DXE_CTRL_RX_L                   0x12ad2f
+#define WCN36XX_DXE_CTRL_RX_H                   0x12d12f
+#define WCN36XX_DXE_CTRL_TX_H_BD                0x30ce45
+#define WCN36XX_DXE_CTRL_TX_H_SKB               0x32ce4d
+#define WCN36XX_DXE_CTRL_TX_L_BD                0x308a45
+#define WCN36XX_DXE_CTRL_TX_L_SKB               0x328a4d
+
+/* TODO This must calculated properly but not hardcoded */
+#define WCN36XX_DXE_WQ_TX_L                     0x17
+#define WCN36XX_DXE_WQ_TX_H                     0x17
+#define WCN36XX_DXE_WQ_RX_L                     0xB
+#define WCN36XX_DXE_WQ_RX_H                     0x4
+
+/* DXE descriptor control filed */
+#define WCN36XX_DXE_CTRL_VALID_MASK (0x00000001)
+
+/* TODO This must calculated properly but not hardcoded */
+/* DXE default control register values */
+#define WCN36XX_DXE_CH_DEFAULT_CTL_RX_L         0x847EAD2F
+#define WCN36XX_DXE_CH_DEFAULT_CTL_RX_H         0x84FED12F
+#define WCN36XX_DXE_CH_DEFAULT_CTL_TX_H         0x853ECF4D
+#define WCN36XX_DXE_CH_DEFAULT_CTL_TX_L         0x843e8b4d
+
+/* Common DXE registers */
+#define WCN36XX_DXE_MEM_CSR                     (WCN36XX_DXE_MEM_REG + 0x00)
+#define WCN36XX_DXE_REG_CSR_RESET               (WCN36XX_DXE_MEM_REG + 0x00)
+#define WCN36XX_DXE_ENCH_ADDR                   (WCN36XX_DXE_MEM_REG + 0x04)
+#define WCN36XX_DXE_REG_CH_EN                   (WCN36XX_DXE_MEM_REG + 0x08)
+#define WCN36XX_DXE_REG_CH_DONE                 (WCN36XX_DXE_MEM_REG + 0x0C)
+#define WCN36XX_DXE_REG_CH_ERR                  (WCN36XX_DXE_MEM_REG + 0x10)
+#define WCN36XX_DXE_INT_MASK_REG                (WCN36XX_DXE_MEM_REG + 0x18)
+#define WCN36XX_DXE_INT_SRC_RAW_REG             (WCN36XX_DXE_MEM_REG + 0x20)
+        /* #define WCN36XX_DXE_INT_CH6_MASK     0x00000040 */
+        /* #define WCN36XX_DXE_INT_CH5_MASK     0x00000020 */
+        #define WCN36XX_DXE_INT_CH4_MASK        0x00000010
+        #define WCN36XX_DXE_INT_CH3_MASK        0x00000008
+        /* #define WCN36XX_DXE_INT_CH2_MASK     0x00000004 */
+        #define WCN36XX_DXE_INT_CH1_MASK        0x00000002
+        #define WCN36XX_DXE_INT_CH0_MASK        0x00000001
+#define WCN36XX_DXE_0_INT_CLR                   (WCN36XX_DXE_MEM_REG + 0x30)
+#define WCN36XX_DXE_0_INT_ED_CLR                (WCN36XX_DXE_MEM_REG + 0x34)
+#define WCN36XX_DXE_0_INT_DONE_CLR              (WCN36XX_DXE_MEM_REG + 0x38)
+#define WCN36XX_DXE_0_INT_ERR_CLR               (WCN36XX_DXE_MEM_REG + 0x3C)
+
+#define WCN36XX_DXE_0_CH0_STATUS                (WCN36XX_DXE_MEM_REG + 0x404)
+#define WCN36XX_DXE_0_CH1_STATUS                (WCN36XX_DXE_MEM_REG + 0x444)
+#define WCN36XX_DXE_0_CH2_STATUS                (WCN36XX_DXE_MEM_REG + 0x484)
+#define WCN36XX_DXE_0_CH3_STATUS                (WCN36XX_DXE_MEM_REG + 0x4C4)
+#define WCN36XX_DXE_0_CH4_STATUS                (WCN36XX_DXE_MEM_REG + 0x504)
+
+#define WCN36XX_DXE_REG_RESET                   0x5c89
+
+/* Temporary BMU Workqueue 4 */
+#define WCN36XX_DXE_BMU_WQ_RX_LOW               0xB
+#define WCN36XX_DXE_BMU_WQ_RX_HIGH              0x4
+/* DMA channel offset */
+#define WCN36XX_DXE_TX_LOW_OFFSET               0x400
+#define WCN36XX_DXE_TX_HIGH_OFFSET              0x500
+#define WCN36XX_DXE_RX_LOW_OFFSET               0x440
+#define WCN36XX_DXE_RX_HIGH_OFFSET              0x4C0
+
+/* Address of the next DXE descriptor */
+#define WCN36XX_DXE_CH_NEXT_DESC_ADDR           0x001C
+#define WCN36XX_DXE_CH_NEXT_DESC_ADDR_TX_L      (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_TX_LOW_OFFSET + \
+                                                 WCN36XX_DXE_CH_NEXT_DESC_ADDR)
+#define WCN36XX_DXE_CH_NEXT_DESC_ADDR_TX_H      (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_TX_HIGH_OFFSET + \
+                                                 WCN36XX_DXE_CH_NEXT_DESC_ADDR)
+#define WCN36XX_DXE_CH_NEXT_DESC_ADDR_RX_L      (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_LOW_OFFSET + \
+                                                 WCN36XX_DXE_CH_NEXT_DESC_ADDR)
+#define WCN36XX_DXE_CH_NEXT_DESC_ADDR_RX_H      (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_HIGH_OFFSET + \
+                                                 WCN36XX_DXE_CH_NEXT_DESC_ADDR)
+
+/* DXE Descriptor source address */
+#define WCN36XX_DXE_CH_SRC_ADDR                 0x000C
+#define WCN36XX_DXE_CH_SRC_ADDR_RX_L            (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_LOW_OFFSET + \
+                                                 WCN36XX_DXE_CH_SRC_ADDR)
+#define WCN36XX_DXE_CH_SRC_ADDR_RX_H            (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_HIGH_OFFSET + \
+                                                 WCN36XX_DXE_CH_SRC_ADDR)
+
+/* DXE Descriptor address destination address */
+#define WCN36XX_DXE_CH_DEST_ADDR                0x0014
+#define WCN36XX_DXE_CH_DEST_ADDR_TX_L           (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_TX_LOW_OFFSET + \
+                                                 WCN36XX_DXE_CH_DEST_ADDR)
+#define WCN36XX_DXE_CH_DEST_ADDR_TX_H           (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_TX_HIGH_OFFSET + \
+                                                 WCN36XX_DXE_CH_DEST_ADDR)
+#define WCN36XX_DXE_CH_DEST_ADDR_RX_L           (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_LOW_OFFSET + \
+                                                 WCN36XX_DXE_CH_DEST_ADDR)
+#define WCN36XX_DXE_CH_DEST_ADDR_RX_H           (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_HIGH_OFFSET + \
+                                                 WCN36XX_DXE_CH_DEST_ADDR)
+
+/* Interrupt status */
+#define WCN36XX_DXE_CH_STATUS_REG_ADDR          0x0004
+#define WCN36XX_DXE_CH_STATUS_REG_ADDR_TX_L     (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_TX_LOW_OFFSET + \
+                                                 WCN36XX_DXE_CH_STATUS_REG_ADDR)
+#define WCN36XX_DXE_CH_STATUS_REG_ADDR_TX_H     (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_TX_HIGH_OFFSET + \
+                                                 WCN36XX_DXE_CH_STATUS_REG_ADDR)
+#define WCN36XX_DXE_CH_STATUS_REG_ADDR_RX_L     (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_LOW_OFFSET + \
+                                                 WCN36XX_DXE_CH_STATUS_REG_ADDR)
+#define WCN36XX_DXE_CH_STATUS_REG_ADDR_RX_H     (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_HIGH_OFFSET + \
+                                                 WCN36XX_DXE_CH_STATUS_REG_ADDR)
+
+
+/* DXE default control register */
+#define WCN36XX_DXE_REG_CTL_RX_L                (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_LOW_OFFSET)
+#define WCN36XX_DXE_REG_CTL_RX_H                (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_RX_HIGH_OFFSET)
+#define WCN36XX_DXE_REG_CTL_TX_H                (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_TX_HIGH_OFFSET)
+#define WCN36XX_DXE_REG_CTL_TX_L                (WCN36XX_DXE_MEM_REG + \
+                                                 WCN36XX_DXE_TX_LOW_OFFSET)
+
+#define WCN36XX_SMSM_WLAN_TX_ENABLE             0x00000400
+#define WCN36XX_SMSM_WLAN_TX_RINGS_EMPTY        0x00000200
+
+
+/* Interrupt control channel mask */
+#define WCN36XX_INT_MASK_CHAN_TX_L              0x00000001
+#define WCN36XX_INT_MASK_CHAN_RX_L              0x00000002
+#define WCN36XX_INT_MASK_CHAN_RX_H              0x00000008
+#define WCN36XX_INT_MASK_CHAN_TX_H              0x00000010
+
+#define WCN36XX_BD_CHUNK_SIZE                   128
+
+#define WCN36XX_PKT_SIZE                        0xF20
+enum wcn36xx_dxe_ch_type {
+        WCN36XX_DXE_CH_TX_L,
+        WCN36XX_DXE_CH_TX_H,
+        WCN36XX_DXE_CH_RX_L,
+        WCN36XX_DXE_CH_RX_H
+};
+
+/* amount of descriptors per channel */
+enum wcn36xx_dxe_ch_desc_num {
+        WCN36XX_DXE_CH_DESC_NUMB_TX_L           = 128,
+        WCN36XX_DXE_CH_DESC_NUMB_TX_H           = 10,
+        WCN36XX_DXE_CH_DESC_NUMB_RX_L           = 512,
+        WCN36XX_DXE_CH_DESC_NUMB_RX_H           = 40
+};
+
+/**
+ * struct wcn36xx_dxe_desc - describes descriptor of one DXE buffer
+ *
+ * @ctrl: is a union that consists of following bits:
+ * union {
+ *      u32     valid           :1; //0 = DMA stop, 1 = DMA continue with this
+ *                                  //descriptor
+ *      u32     transfer_type   :2; //0 = Host to Host space
+ *      u32     eop             :1; //End of Packet
+ *      u32     bd_handling     :1; //if transferType = Host to BMU, then 0
+ *                                  // means first 128 bytes contain BD, and 1
+ *                                  // means create new empty BD
+ *      u32     siq             :1; // SIQ
+ *      u32     diq             :1; // DIQ
+ *      u32     pdu_rel         :1; //0 = don't release BD and PDUs when done,
+ *                                  // 1 = release them
+ *      u32     bthld_sel       :4; //BMU Threshold Select
+ *      u32     prio            :3; //Specifies the priority level to use for
+ *                                  // the transfer
+ *      u32     stop_channel    :1; //1 = DMA stops processing further, channel
+ *                                  //requires re-enabling after this
+ *      u32     intr            :1; //Interrupt on Descriptor Done
+ *      u32     rsvd            :1; //reserved
+ *      u32     size            :14;//14 bits used - ignored for BMU transfers,
+ *                                  //only used for host to host transfers?
+ * } ctrl;
+ */
+struct wcn36xx_dxe_desc {
+        u32     ctrl;
+        u32     fr_len;
+
+        u32     src_addr_l;
+        u32     dst_addr_l;
+        u32     phy_next_l;
+        u32     src_addr_h;
+        u32     dst_addr_h;
+        u32     phy_next_h;
+} __packed;
+
+/* DXE Control block */
+struct wcn36xx_dxe_ctl {
+        struct wcn36xx_dxe_ctl  *next;
+        struct wcn36xx_dxe_desc *desc;
+        unsigned int            desc_phy_addr;
+        int                     ctl_blk_order;
+        struct sk_buff          *skb;
+        spinlock_t              skb_lock;
+        void                    *bd_cpu_addr;
+        dma_addr_t              bd_phy_addr;
+};
+
+struct wcn36xx_dxe_ch {
+        enum wcn36xx_dxe_ch_type        ch_type;
+        void                            *cpu_addr;
+        dma_addr_t                      dma_addr;
+        enum wcn36xx_dxe_ch_desc_num    desc_num;
+        /* DXE control block ring */
+        struct wcn36xx_dxe_ctl          *head_blk_ctl;
+        struct wcn36xx_dxe_ctl          *tail_blk_ctl;
+
+        /* DXE channel specific configs */
+        u32                             dxe_wq;
+        u32                             ctrl_bd;
+        u32                             ctrl_skb;
+        u32                             reg_ctrl;
+        u32                             def_ctrl;
+};
+
+/* Memory Pool for BD headers */
+struct wcn36xx_dxe_mem_pool {
+        int             chunk_size;
+        void            *virt_addr;
+        dma_addr_t      phy_addr;
+};
+
+struct wcn36xx_vif;
+int wcn36xx_dxe_allocate_mem_pools(struct wcn36xx *wcn);
+void wcn36xx_dxe_free_mem_pools(struct wcn36xx *wcn);
+void wcn36xx_dxe_rx_frame(struct wcn36xx *wcn);
+int wcn36xx_dxe_alloc_ctl_blks(struct wcn36xx *wcn);
+void wcn36xx_dxe_free_ctl_blks(struct wcn36xx *wcn);
+int wcn36xx_dxe_init(struct wcn36xx *wcn);
+void wcn36xx_dxe_deinit(struct wcn36xx *wcn);
+int wcn36xx_dxe_init_channels(struct wcn36xx *wcn);
+int wcn36xx_dxe_tx_frame(struct wcn36xx *wcn,
+                         struct wcn36xx_vif *vif_priv,
+                         struct sk_buff *skb,
+                         bool is_low);
+void wcn36xx_dxe_tx_ack_ind(struct wcn36xx *wcn, u32 status);
+void *wcn36xx_dxe_get_next_bd(struct wcn36xx *wcn, bool is_low);
+#endif  /* _DXE_H_ */
diff --git a/drivers/net/wireless/ath/wcn36xx/hal.h b/drivers/net/wireless/ath/wcn36xx/hal.h
new file mode 100644
index 000000000000..c02dbc618724
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/hal.h
@@ -0,0 +1,4657 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _HAL_H_
+#define _HAL_H_
+
+/*---------------------------------------------------------------------------
+  API VERSIONING INFORMATION
+
+  The RIVA API is versioned as MAJOR.MINOR.VERSION.REVISION
+  The MAJOR is incremented for major product/architecture changes
+      (and then MINOR/VERSION/REVISION are zeroed)
+  The MINOR is incremented for minor product/architecture changes
+      (and then VERSION/REVISION are zeroed)
+  The VERSION is incremented if a significant API change occurs
+      (and then REVISION is zeroed)
+  The REVISION is incremented if an insignificant API change occurs
+      or if a new API is added
+  All values are in the range 0..255 (ie they are 8-bit values)
+ ---------------------------------------------------------------------------*/
+#define WCN36XX_HAL_VER_MAJOR 1
+#define WCN36XX_HAL_VER_MINOR 4
+#define WCN36XX_HAL_VER_VERSION 1
+#define WCN36XX_HAL_VER_REVISION 2
+
+/* This is to force compiler to use the maximum of an int ( 4 bytes ) */
+#define WCN36XX_HAL_MAX_ENUM_SIZE    0x7FFFFFFF
+#define WCN36XX_HAL_MSG_TYPE_MAX_ENUM_SIZE    0x7FFF
+
+/* Max no. of transmit categories */
+#define STACFG_MAX_TC    8
+
+/* The maximum value of access category */
+#define WCN36XX_HAL_MAX_AC  4
+
+#define WCN36XX_HAL_IPV4_ADDR_LEN       4
+
+#define WALN_HAL_STA_INVALID_IDX 0xFF
+#define WCN36XX_HAL_BSS_INVALID_IDX 0xFF
+
+/* Default Beacon template size */
+#define BEACON_TEMPLATE_SIZE 0x180
+
+/* Param Change Bitmap sent to HAL */
+#define PARAM_BCN_INTERVAL_CHANGED                      (1 << 0)
+#define PARAM_SHORT_PREAMBLE_CHANGED                 (1 << 1)
+#define PARAM_SHORT_SLOT_TIME_CHANGED                 (1 << 2)
+#define PARAM_llACOEXIST_CHANGED                            (1 << 3)
+#define PARAM_llBCOEXIST_CHANGED                            (1 << 4)
+#define PARAM_llGCOEXIST_CHANGED                            (1 << 5)
+#define PARAM_HT20MHZCOEXIST_CHANGED                  (1<<6)
+#define PARAM_NON_GF_DEVICES_PRESENT_CHANGED (1<<7)
+#define PARAM_RIFS_MODE_CHANGED                            (1<<8)
+#define PARAM_LSIG_TXOP_FULL_SUPPORT_CHANGED   (1<<9)
+#define PARAM_OBSS_MODE_CHANGED                               (1<<10)
+#define PARAM_BEACON_UPDATE_MASK \
+        (PARAM_BCN_INTERVAL_CHANGED |                                   \
+         PARAM_SHORT_PREAMBLE_CHANGED |                                 \
+         PARAM_SHORT_SLOT_TIME_CHANGED |                                \
+         PARAM_llACOEXIST_CHANGED |                                     \
+         PARAM_llBCOEXIST_CHANGED |                                     \
+         PARAM_llGCOEXIST_CHANGED |                                     \
+         PARAM_HT20MHZCOEXIST_CHANGED |                                 \
+         PARAM_NON_GF_DEVICES_PRESENT_CHANGED |                         \
+         PARAM_RIFS_MODE_CHANGED |                                      \
+         PARAM_LSIG_TXOP_FULL_SUPPORT_CHANGED |                         \
+         PARAM_OBSS_MODE_CHANGED)
+
+/* dump command response Buffer size */
+#define DUMPCMD_RSP_BUFFER 100
+
+/* version string max length (including NULL) */
+#define WCN36XX_HAL_VERSION_LENGTH  64
+
+/* message types for messages exchanged between WDI and HAL */
+enum wcn36xx_hal_host_msg_type {
+        /* Init/De-Init */
+        WCN36XX_HAL_START_REQ = 0,
+        WCN36XX_HAL_START_RSP = 1,
+        WCN36XX_HAL_STOP_REQ = 2,
+        WCN36XX_HAL_STOP_RSP = 3,
+
+        /* Scan */
+        WCN36XX_HAL_INIT_SCAN_REQ = 4,
+        WCN36XX_HAL_INIT_SCAN_RSP = 5,
+        WCN36XX_HAL_START_SCAN_REQ = 6,
+        WCN36XX_HAL_START_SCAN_RSP = 7,
+        WCN36XX_HAL_END_SCAN_REQ = 8,
+        WCN36XX_HAL_END_SCAN_RSP = 9,
+        WCN36XX_HAL_FINISH_SCAN_REQ = 10,
+        WCN36XX_HAL_FINISH_SCAN_RSP = 11,
+
+        /* HW STA configuration/deconfiguration */
+        WCN36XX_HAL_CONFIG_STA_REQ = 12,
+        WCN36XX_HAL_CONFIG_STA_RSP = 13,
+        WCN36XX_HAL_DELETE_STA_REQ = 14,
+        WCN36XX_HAL_DELETE_STA_RSP = 15,
+        WCN36XX_HAL_CONFIG_BSS_REQ = 16,
+        WCN36XX_HAL_CONFIG_BSS_RSP = 17,
+        WCN36XX_HAL_DELETE_BSS_REQ = 18,
+        WCN36XX_HAL_DELETE_BSS_RSP = 19,
+
+        /* Infra STA asscoiation */
+        WCN36XX_HAL_JOIN_REQ = 20,
+        WCN36XX_HAL_JOIN_RSP = 21,
+        WCN36XX_HAL_POST_ASSOC_REQ = 22,
+        WCN36XX_HAL_POST_ASSOC_RSP = 23,
+
+        /* Security */
+        WCN36XX_HAL_SET_BSSKEY_REQ = 24,
+        WCN36XX_HAL_SET_BSSKEY_RSP = 25,
+        WCN36XX_HAL_SET_STAKEY_REQ = 26,
+        WCN36XX_HAL_SET_STAKEY_RSP = 27,
+        WCN36XX_HAL_RMV_BSSKEY_REQ = 28,
+        WCN36XX_HAL_RMV_BSSKEY_RSP = 29,
+        WCN36XX_HAL_RMV_STAKEY_REQ = 30,
+        WCN36XX_HAL_RMV_STAKEY_RSP = 31,
+
+        /* Qos Related */
+        WCN36XX_HAL_ADD_TS_REQ = 32,
+        WCN36XX_HAL_ADD_TS_RSP = 33,
+        WCN36XX_HAL_DEL_TS_REQ = 34,
+        WCN36XX_HAL_DEL_TS_RSP = 35,
+        WCN36XX_HAL_UPD_EDCA_PARAMS_REQ = 36,
+        WCN36XX_HAL_UPD_EDCA_PARAMS_RSP = 37,
+        WCN36XX_HAL_ADD_BA_REQ = 38,
+        WCN36XX_HAL_ADD_BA_RSP = 39,
+        WCN36XX_HAL_DEL_BA_REQ = 40,
+        WCN36XX_HAL_DEL_BA_RSP = 41,
+
+        WCN36XX_HAL_CH_SWITCH_REQ = 42,
+        WCN36XX_HAL_CH_SWITCH_RSP = 43,
+        WCN36XX_HAL_SET_LINK_ST_REQ = 44,
+        WCN36XX_HAL_SET_LINK_ST_RSP = 45,
+        WCN36XX_HAL_GET_STATS_REQ = 46,
+        WCN36XX_HAL_GET_STATS_RSP = 47,
+        WCN36XX_HAL_UPDATE_CFG_REQ = 48,
+        WCN36XX_HAL_UPDATE_CFG_RSP = 49,
+
+        WCN36XX_HAL_MISSED_BEACON_IND = 50,
+        WCN36XX_HAL_UNKNOWN_ADDR2_FRAME_RX_IND = 51,
+        WCN36XX_HAL_MIC_FAILURE_IND = 52,
+        WCN36XX_HAL_FATAL_ERROR_IND = 53,
+        WCN36XX_HAL_SET_KEYDONE_MSG = 54,
+
+        /* NV Interface */
+        WCN36XX_HAL_DOWNLOAD_NV_REQ = 55,
+        WCN36XX_HAL_DOWNLOAD_NV_RSP = 56,
+
+        WCN36XX_HAL_ADD_BA_SESSION_REQ = 57,
+        WCN36XX_HAL_ADD_BA_SESSION_RSP = 58,
+        WCN36XX_HAL_TRIGGER_BA_REQ = 59,
+        WCN36XX_HAL_TRIGGER_BA_RSP = 60,
+        WCN36XX_HAL_UPDATE_BEACON_REQ = 61,
+        WCN36XX_HAL_UPDATE_BEACON_RSP = 62,
+        WCN36XX_HAL_SEND_BEACON_REQ = 63,
+        WCN36XX_HAL_SEND_BEACON_RSP = 64,
+
+        WCN36XX_HAL_SET_BCASTKEY_REQ = 65,
+        WCN36XX_HAL_SET_BCASTKEY_RSP = 66,
+        WCN36XX_HAL_DELETE_STA_CONTEXT_IND = 67,
+        WCN36XX_HAL_UPDATE_PROBE_RSP_TEMPLATE_REQ = 68,
+        WCN36XX_HAL_UPDATE_PROBE_RSP_TEMPLATE_RSP = 69,
+
+        /* PTT interface support */
+        WCN36XX_HAL_PROCESS_PTT_REQ = 70,
+        WCN36XX_HAL_PROCESS_PTT_RSP = 71,
+
+        /* BTAMP related events */
+        WCN36XX_HAL_SIGNAL_BTAMP_EVENT_REQ = 72,
+        WCN36XX_HAL_SIGNAL_BTAMP_EVENT_RSP = 73,
+        WCN36XX_HAL_TL_HAL_FLUSH_AC_REQ = 74,
+        WCN36XX_HAL_TL_HAL_FLUSH_AC_RSP = 75,
+
+        WCN36XX_HAL_ENTER_IMPS_REQ = 76,
+        WCN36XX_HAL_EXIT_IMPS_REQ = 77,
+        WCN36XX_HAL_ENTER_BMPS_REQ = 78,
+        WCN36XX_HAL_EXIT_BMPS_REQ = 79,
+        WCN36XX_HAL_ENTER_UAPSD_REQ = 80,
+        WCN36XX_HAL_EXIT_UAPSD_REQ = 81,
+        WCN36XX_HAL_UPDATE_UAPSD_PARAM_REQ = 82,
+        WCN36XX_HAL_CONFIGURE_RXP_FILTER_REQ = 83,
+        WCN36XX_HAL_ADD_BCN_FILTER_REQ = 84,
+        WCN36XX_HAL_REM_BCN_FILTER_REQ = 85,
+        WCN36XX_HAL_ADD_WOWL_BCAST_PTRN = 86,
+        WCN36XX_HAL_DEL_WOWL_BCAST_PTRN = 87,
+        WCN36XX_HAL_ENTER_WOWL_REQ = 88,
+        WCN36XX_HAL_EXIT_WOWL_REQ = 89,
+        WCN36XX_HAL_HOST_OFFLOAD_REQ = 90,
+        WCN36XX_HAL_SET_RSSI_THRESH_REQ = 91,
+        WCN36XX_HAL_GET_RSSI_REQ = 92,
+        WCN36XX_HAL_SET_UAPSD_AC_PARAMS_REQ = 93,
+        WCN36XX_HAL_CONFIGURE_APPS_CPU_WAKEUP_STATE_REQ = 94,
+
+        WCN36XX_HAL_ENTER_IMPS_RSP = 95,
+        WCN36XX_HAL_EXIT_IMPS_RSP = 96,
+        WCN36XX_HAL_ENTER_BMPS_RSP = 97,
+        WCN36XX_HAL_EXIT_BMPS_RSP = 98,
+        WCN36XX_HAL_ENTER_UAPSD_RSP = 99,
+        WCN36XX_HAL_EXIT_UAPSD_RSP = 100,
+        WCN36XX_HAL_SET_UAPSD_AC_PARAMS_RSP = 101,
+        WCN36XX_HAL_UPDATE_UAPSD_PARAM_RSP = 102,
+        WCN36XX_HAL_CONFIGURE_RXP_FILTER_RSP = 103,
+        WCN36XX_HAL_ADD_BCN_FILTER_RSP = 104,
+        WCN36XX_HAL_REM_BCN_FILTER_RSP = 105,
+        WCN36XX_HAL_SET_RSSI_THRESH_RSP = 106,
+        WCN36XX_HAL_HOST_OFFLOAD_RSP = 107,
+        WCN36XX_HAL_ADD_WOWL_BCAST_PTRN_RSP = 108,
+        WCN36XX_HAL_DEL_WOWL_BCAST_PTRN_RSP = 109,
+        WCN36XX_HAL_ENTER_WOWL_RSP = 110,
+        WCN36XX_HAL_EXIT_WOWL_RSP = 111,
+        WCN36XX_HAL_RSSI_NOTIFICATION_IND = 112,
+        WCN36XX_HAL_GET_RSSI_RSP = 113,
+        WCN36XX_HAL_CONFIGURE_APPS_CPU_WAKEUP_STATE_RSP = 114,
+
+        /* 11k related events */
+        WCN36XX_HAL_SET_MAX_TX_POWER_REQ = 115,
+        WCN36XX_HAL_SET_MAX_TX_POWER_RSP = 116,
+
+        /* 11R related msgs */
+        WCN36XX_HAL_AGGR_ADD_TS_REQ = 117,
+        WCN36XX_HAL_AGGR_ADD_TS_RSP = 118,
+
+        /* P2P  WLAN_FEATURE_P2P */
+        WCN36XX_HAL_SET_P2P_GONOA_REQ = 119,
+        WCN36XX_HAL_SET_P2P_GONOA_RSP = 120,
+
+        /* WLAN Dump commands */
+        WCN36XX_HAL_DUMP_COMMAND_REQ = 121,
+        WCN36XX_HAL_DUMP_COMMAND_RSP = 122,
+
+        /* OEM_DATA FEATURE SUPPORT */
+        WCN36XX_HAL_START_OEM_DATA_REQ = 123,
+        WCN36XX_HAL_START_OEM_DATA_RSP = 124,
+
+        /* ADD SELF STA REQ and RSP */
+        WCN36XX_HAL_ADD_STA_SELF_REQ = 125,
+        WCN36XX_HAL_ADD_STA_SELF_RSP = 126,
+
+        /* DEL SELF STA SUPPORT */
+        WCN36XX_HAL_DEL_STA_SELF_REQ = 127,
+        WCN36XX_HAL_DEL_STA_SELF_RSP = 128,
+
+        /* Coex Indication */
+        WCN36XX_HAL_COEX_IND = 129,
+
+        /* Tx Complete Indication */
+        WCN36XX_HAL_OTA_TX_COMPL_IND = 130,
+
+        /* Host Suspend/resume messages */
+        WCN36XX_HAL_HOST_SUSPEND_IND = 131,
+        WCN36XX_HAL_HOST_RESUME_REQ = 132,
+        WCN36XX_HAL_HOST_RESUME_RSP = 133,
+
+        WCN36XX_HAL_SET_TX_POWER_REQ = 134,
+        WCN36XX_HAL_SET_TX_POWER_RSP = 135,
+        WCN36XX_HAL_GET_TX_POWER_REQ = 136,
+        WCN36XX_HAL_GET_TX_POWER_RSP = 137,
+
+        WCN36XX_HAL_P2P_NOA_ATTR_IND = 138,
+
+        WCN36XX_HAL_ENABLE_RADAR_DETECT_REQ = 139,
+        WCN36XX_HAL_ENABLE_RADAR_DETECT_RSP = 140,
+        WCN36XX_HAL_GET_TPC_REPORT_REQ = 141,
+        WCN36XX_HAL_GET_TPC_REPORT_RSP = 142,
+        WCN36XX_HAL_RADAR_DETECT_IND = 143,
+        WCN36XX_HAL_RADAR_DETECT_INTR_IND = 144,
+        WCN36XX_HAL_KEEP_ALIVE_REQ = 145,
+        WCN36XX_HAL_KEEP_ALIVE_RSP = 146,
+
+        /* PNO messages */
+        WCN36XX_HAL_SET_PREF_NETWORK_REQ = 147,
+        WCN36XX_HAL_SET_PREF_NETWORK_RSP = 148,
+        WCN36XX_HAL_SET_RSSI_FILTER_REQ = 149,
+        WCN36XX_HAL_SET_RSSI_FILTER_RSP = 150,
+        WCN36XX_HAL_UPDATE_SCAN_PARAM_REQ = 151,
+        WCN36XX_HAL_UPDATE_SCAN_PARAM_RSP = 152,
+        WCN36XX_HAL_PREF_NETW_FOUND_IND = 153,
+
+        WCN36XX_HAL_SET_TX_PER_TRACKING_REQ = 154,
+        WCN36XX_HAL_SET_TX_PER_TRACKING_RSP = 155,
+        WCN36XX_HAL_TX_PER_HIT_IND = 156,
+
+        WCN36XX_HAL_8023_MULTICAST_LIST_REQ = 157,
+        WCN36XX_HAL_8023_MULTICAST_LIST_RSP = 158,
+
+        WCN36XX_HAL_SET_PACKET_FILTER_REQ = 159,
+        WCN36XX_HAL_SET_PACKET_FILTER_RSP = 160,
+        WCN36XX_HAL_PACKET_FILTER_MATCH_COUNT_REQ = 161,
+        WCN36XX_HAL_PACKET_FILTER_MATCH_COUNT_RSP = 162,
+        WCN36XX_HAL_CLEAR_PACKET_FILTER_REQ = 163,
+        WCN36XX_HAL_CLEAR_PACKET_FILTER_RSP = 164,
+
+        /*
+         * This is temp fix. Should be removed once Host and Riva code is
+         * in sync.
+         */
+        WCN36XX_HAL_INIT_SCAN_CON_REQ = 165,
+
+        WCN36XX_HAL_SET_POWER_PARAMS_REQ = 166,
+        WCN36XX_HAL_SET_POWER_PARAMS_RSP = 167,
+
+        WCN36XX_HAL_TSM_STATS_REQ = 168,
+        WCN36XX_HAL_TSM_STATS_RSP = 169,
+
+        /* wake reason indication (WOW) */
+        WCN36XX_HAL_WAKE_REASON_IND = 170,
+
+        /* GTK offload support */
+        WCN36XX_HAL_GTK_OFFLOAD_REQ = 171,
+        WCN36XX_HAL_GTK_OFFLOAD_RSP = 172,
+        WCN36XX_HAL_GTK_OFFLOAD_GETINFO_REQ = 173,
+        WCN36XX_HAL_GTK_OFFLOAD_GETINFO_RSP = 174,
+
+        WCN36XX_HAL_FEATURE_CAPS_EXCHANGE_REQ = 175,
+        WCN36XX_HAL_FEATURE_CAPS_EXCHANGE_RSP = 176,
+        WCN36XX_HAL_EXCLUDE_UNENCRYPTED_IND = 177,
+
+        WCN36XX_HAL_SET_THERMAL_MITIGATION_REQ = 178,
+        WCN36XX_HAL_SET_THERMAL_MITIGATION_RSP = 179,
+
+        WCN36XX_HAL_UPDATE_VHT_OP_MODE_REQ = 182,
+        WCN36XX_HAL_UPDATE_VHT_OP_MODE_RSP = 183,
+
+        WCN36XX_HAL_P2P_NOA_START_IND = 184,
+
+        WCN36XX_HAL_GET_ROAM_RSSI_REQ = 185,
+        WCN36XX_HAL_GET_ROAM_RSSI_RSP = 186,
+
+        WCN36XX_HAL_CLASS_B_STATS_IND = 187,
+        WCN36XX_HAL_DEL_BA_IND = 188,
+        WCN36XX_HAL_DHCP_START_IND = 189,
+        WCN36XX_HAL_DHCP_STOP_IND = 190,
+
+        WCN36XX_HAL_MSG_MAX = WCN36XX_HAL_MSG_TYPE_MAX_ENUM_SIZE
+};
+
+/* Enumeration for Version */
+enum wcn36xx_hal_host_msg_version {
+        WCN36XX_HAL_MSG_VERSION0 = 0,
+        WCN36XX_HAL_MSG_VERSION1 = 1,
+        /* define as 2 bytes data */
+        WCN36XX_HAL_MSG_WCNSS_CTRL_VERSION = 0x7FFF,
+        WCN36XX_HAL_MSG_VERSION_MAX_FIELD = WCN36XX_HAL_MSG_WCNSS_CTRL_VERSION
+};
+
+enum driver_type {
+        DRIVER_TYPE_PRODUCTION = 0,
+        DRIVER_TYPE_MFG = 1,
+        DRIVER_TYPE_DVT = 2,
+        DRIVER_TYPE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+enum wcn36xx_hal_stop_type {
+        HAL_STOP_TYPE_SYS_RESET,
+        HAL_STOP_TYPE_SYS_DEEP_SLEEP,
+        HAL_STOP_TYPE_RF_KILL,
+        HAL_STOP_TYPE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+enum wcn36xx_hal_sys_mode {
+        HAL_SYS_MODE_NORMAL,
+        HAL_SYS_MODE_LEARN,
+        HAL_SYS_MODE_SCAN,
+        HAL_SYS_MODE_PROMISC,
+        HAL_SYS_MODE_SUSPEND_LINK,
+        HAL_SYS_MODE_ROAM_SCAN,
+        HAL_SYS_MODE_ROAM_SUSPEND_LINK,
+        HAL_SYS_MODE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+enum phy_chan_bond_state {
+        /* 20MHz IF bandwidth centered on IF carrier */
+        PHY_SINGLE_CHANNEL_CENTERED = 0,
+
+        /* 40MHz IF bandwidth with lower 20MHz supporting the primary channel */
+        PHY_DOUBLE_CHANNEL_LOW_PRIMARY = 1,
+
+        /* 40MHz IF bandwidth centered on IF carrier */
+        PHY_DOUBLE_CHANNEL_CENTERED = 2,
+
+        /* 40MHz IF bandwidth with higher 20MHz supporting the primary ch */
+        PHY_DOUBLE_CHANNEL_HIGH_PRIMARY = 3,
+
+        /* 20/40MHZ offset LOW 40/80MHZ offset CENTERED */
+        PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_CENTERED = 4,
+
+        /* 20/40MHZ offset CENTERED 40/80MHZ offset CENTERED */
+        PHY_QUADRUPLE_CHANNEL_20MHZ_CENTERED_40MHZ_CENTERED = 5,
+
+        /* 20/40MHZ offset HIGH 40/80MHZ offset CENTERED */
+        PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_CENTERED = 6,
+
+        /* 20/40MHZ offset LOW 40/80MHZ offset LOW */
+        PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_LOW = 7,
+
+        /* 20/40MHZ offset HIGH 40/80MHZ offset LOW */
+        PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_LOW = 8,
+
+        /* 20/40MHZ offset LOW 40/80MHZ offset HIGH */
+        PHY_QUADRUPLE_CHANNEL_20MHZ_LOW_40MHZ_HIGH = 9,
+
+        /* 20/40MHZ offset-HIGH 40/80MHZ offset HIGH */
+        PHY_QUADRUPLE_CHANNEL_20MHZ_HIGH_40MHZ_HIGH = 10,
+
+        PHY_CHANNEL_BONDING_STATE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+/* Spatial Multiplexing(SM) Power Save mode */
+enum wcn36xx_hal_ht_mimo_state {
+        /* Static SM Power Save mode */
+        WCN36XX_HAL_HT_MIMO_PS_STATIC = 0,
+
+        /* Dynamic SM Power Save mode */
+        WCN36XX_HAL_HT_MIMO_PS_DYNAMIC = 1,
+
+        /* reserved */
+        WCN36XX_HAL_HT_MIMO_PS_NA = 2,
+
+        /* SM Power Save disabled */
+        WCN36XX_HAL_HT_MIMO_PS_NO_LIMIT = 3,
+
+        WCN36XX_HAL_HT_MIMO_PS_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+/* each station added has a rate mode which specifies the sta attributes */
+enum sta_rate_mode {
+        STA_TAURUS = 0,
+        STA_TITAN,
+        STA_POLARIS,
+        STA_11b,
+        STA_11bg,
+        STA_11a,
+        STA_11n,
+        STA_11ac,
+        STA_INVALID_RATE_MODE = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+/* 1,2,5.5,11 */
+#define WCN36XX_HAL_NUM_DSSS_RATES           4
+
+/* 6,9,12,18,24,36,48,54 */
+#define WCN36XX_HAL_NUM_OFDM_RATES           8
+
+/* 72,96,108 */
+#define WCN36XX_HAL_NUM_POLARIS_RATES       3
+
+#define WCN36XX_HAL_MAC_MAX_SUPPORTED_MCS_SET    16
+
+enum wcn36xx_hal_bss_type {
+        WCN36XX_HAL_INFRASTRUCTURE_MODE,
+
+        /* Added for softAP support */
+        WCN36XX_HAL_INFRA_AP_MODE,
+
+        WCN36XX_HAL_IBSS_MODE,
+
+        /* Added for BT-AMP support */
+        WCN36XX_HAL_BTAMP_STA_MODE,
+
+        /* Added for BT-AMP support */
+        WCN36XX_HAL_BTAMP_AP_MODE,
+
+        WCN36XX_HAL_AUTO_MODE,
+
+        WCN36XX_HAL_DONOT_USE_BSS_TYPE = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+enum wcn36xx_hal_nw_type {
+        WCN36XX_HAL_11A_NW_TYPE,
+        WCN36XX_HAL_11B_NW_TYPE,
+        WCN36XX_HAL_11G_NW_TYPE,
+        WCN36XX_HAL_11N_NW_TYPE,
+        WCN36XX_HAL_DONOT_USE_NW_TYPE = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+#define WCN36XX_HAL_MAC_RATESET_EID_MAX            12
+
+enum wcn36xx_hal_ht_operating_mode {
+        /* No Protection */
+        WCN36XX_HAL_HT_OP_MODE_PURE,
+
+        /* Overlap Legacy device present, protection is optional */
+        WCN36XX_HAL_HT_OP_MODE_OVERLAP_LEGACY,
+
+        /* No legacy device, but 20 MHz HT present */
+        WCN36XX_HAL_HT_OP_MODE_NO_LEGACY_20MHZ_HT,
+
+        /* Protection is required */
+        WCN36XX_HAL_HT_OP_MODE_MIXED,
+
+        WCN36XX_HAL_HT_OP_MODE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+/* Encryption type enum used with peer */
+enum ani_ed_type {
+        WCN36XX_HAL_ED_NONE,
+        WCN36XX_HAL_ED_WEP40,
+        WCN36XX_HAL_ED_WEP104,
+        WCN36XX_HAL_ED_TKIP,
+        WCN36XX_HAL_ED_CCMP,
+        WCN36XX_HAL_ED_WPI,
+        WCN36XX_HAL_ED_AES_128_CMAC,
+        WCN36XX_HAL_ED_NOT_IMPLEMENTED = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+#define WLAN_MAX_KEY_RSC_LEN                16
+#define WLAN_WAPI_KEY_RSC_LEN               16
+
+/* MAX key length when ULA is used */
+#define WCN36XX_HAL_MAC_MAX_KEY_LENGTH              32
+#define WCN36XX_HAL_MAC_MAX_NUM_OF_DEFAULT_KEYS     4
+
+/*
+ * Enum to specify whether key is used for TX only, RX only or both.
+ */
+enum ani_key_direction {
+        WCN36XX_HAL_TX_ONLY,
+        WCN36XX_HAL_RX_ONLY,
+        WCN36XX_HAL_TX_RX,
+        WCN36XX_HAL_TX_DEFAULT,
+        WCN36XX_HAL_DONOT_USE_KEY_DIRECTION = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+enum ani_wep_type {
+        WCN36XX_HAL_WEP_STATIC,
+        WCN36XX_HAL_WEP_DYNAMIC,
+        WCN36XX_HAL_WEP_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+enum wcn36xx_hal_link_state {
+
+        WCN36XX_HAL_LINK_IDLE_STATE = 0,
+        WCN36XX_HAL_LINK_PREASSOC_STATE = 1,
+        WCN36XX_HAL_LINK_POSTASSOC_STATE = 2,
+        WCN36XX_HAL_LINK_AP_STATE = 3,
+        WCN36XX_HAL_LINK_IBSS_STATE = 4,
+
+        /* BT-AMP Case */
+        WCN36XX_HAL_LINK_BTAMP_PREASSOC_STATE = 5,
+        WCN36XX_HAL_LINK_BTAMP_POSTASSOC_STATE = 6,
+        WCN36XX_HAL_LINK_BTAMP_AP_STATE = 7,
+        WCN36XX_HAL_LINK_BTAMP_STA_STATE = 8,
+
+        /* Reserved for HAL Internal Use */
+        WCN36XX_HAL_LINK_LEARN_STATE = 9,
+        WCN36XX_HAL_LINK_SCAN_STATE = 10,
+        WCN36XX_HAL_LINK_FINISH_SCAN_STATE = 11,
+        WCN36XX_HAL_LINK_INIT_CAL_STATE = 12,
+        WCN36XX_HAL_LINK_FINISH_CAL_STATE = 13,
+        WCN36XX_HAL_LINK_LISTEN_STATE = 14,
+
+        WCN36XX_HAL_LINK_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+enum wcn36xx_hal_stats_mask {
+        HAL_SUMMARY_STATS_INFO = 0x00000001,
+        HAL_GLOBAL_CLASS_A_STATS_INFO = 0x00000002,
+        HAL_GLOBAL_CLASS_B_STATS_INFO = 0x00000004,
+        HAL_GLOBAL_CLASS_C_STATS_INFO = 0x00000008,
+        HAL_GLOBAL_CLASS_D_STATS_INFO = 0x00000010,
+        HAL_PER_STA_STATS_INFO = 0x00000020
+};
+
+/* BT-AMP events type */
+enum bt_amp_event_type {
+        BTAMP_EVENT_CONNECTION_START,
+        BTAMP_EVENT_CONNECTION_STOP,
+        BTAMP_EVENT_CONNECTION_TERMINATED,
+
+        /* This and beyond are invalid values */
+        BTAMP_EVENT_TYPE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE,
+};
+
+/* PE Statistics */
+enum pe_stats_mask {
+        PE_SUMMARY_STATS_INFO = 0x00000001,
+        PE_GLOBAL_CLASS_A_STATS_INFO = 0x00000002,
+        PE_GLOBAL_CLASS_B_STATS_INFO = 0x00000004,
+        PE_GLOBAL_CLASS_C_STATS_INFO = 0x00000008,
+        PE_GLOBAL_CLASS_D_STATS_INFO = 0x00000010,
+        PE_PER_STA_STATS_INFO = 0x00000020,
+
+        /* This and beyond are invalid values */
+        PE_STATS_TYPE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+/*
+ * Configuration Parameter IDs
+ */
+#define WCN36XX_HAL_CFG_STA_ID                          0
+#define WCN36XX_HAL_CFG_CURRENT_TX_ANTENNA              1
+#define WCN36XX_HAL_CFG_CURRENT_RX_ANTENNA              2
+#define WCN36XX_HAL_CFG_LOW_GAIN_OVERRIDE               3
+#define WCN36XX_HAL_CFG_POWER_STATE_PER_CHAIN           4
+#define WCN36XX_HAL_CFG_CAL_PERIOD                      5
+#define WCN36XX_HAL_CFG_CAL_CONTROL                     6
+#define WCN36XX_HAL_CFG_PROXIMITY                       7
+#define WCN36XX_HAL_CFG_NETWORK_DENSITY                 8
+#define WCN36XX_HAL_CFG_MAX_MEDIUM_TIME                 9
+#define WCN36XX_HAL_CFG_MAX_MPDUS_IN_AMPDU              10
+#define WCN36XX_HAL_CFG_RTS_THRESHOLD                   11
+#define WCN36XX_HAL_CFG_SHORT_RETRY_LIMIT               12
+#define WCN36XX_HAL_CFG_LONG_RETRY_LIMIT                13
+#define WCN36XX_HAL_CFG_FRAGMENTATION_THRESHOLD         14
+#define WCN36XX_HAL_CFG_DYNAMIC_THRESHOLD_ZERO          15
+#define WCN36XX_HAL_CFG_DYNAMIC_THRESHOLD_ONE           16
+#define WCN36XX_HAL_CFG_DYNAMIC_THRESHOLD_TWO           17
+#define WCN36XX_HAL_CFG_FIXED_RATE                      18
+#define WCN36XX_HAL_CFG_RETRYRATE_POLICY                19
+#define WCN36XX_HAL_CFG_RETRYRATE_SECONDARY             20
+#define WCN36XX_HAL_CFG_RETRYRATE_TERTIARY              21
+#define WCN36XX_HAL_CFG_FORCE_POLICY_PROTECTION         22
+#define WCN36XX_HAL_CFG_FIXED_RATE_MULTICAST_24GHZ      23
+#define WCN36XX_HAL_CFG_FIXED_RATE_MULTICAST_5GHZ       24
+#define WCN36XX_HAL_CFG_DEFAULT_RATE_INDEX_24GHZ        25
+#define WCN36XX_HAL_CFG_DEFAULT_RATE_INDEX_5GHZ         26
+#define WCN36XX_HAL_CFG_MAX_BA_SESSIONS                 27
+#define WCN36XX_HAL_CFG_PS_DATA_INACTIVITY_TIMEOUT      28
+#define WCN36XX_HAL_CFG_PS_ENABLE_BCN_FILTER            29
+#define WCN36XX_HAL_CFG_PS_ENABLE_RSSI_MONITOR          30
+#define WCN36XX_HAL_CFG_NUM_BEACON_PER_RSSI_AVERAGE     31
+#define WCN36XX_HAL_CFG_STATS_PERIOD                    32
+#define WCN36XX_HAL_CFG_CFP_MAX_DURATION                33
+#define WCN36XX_HAL_CFG_FRAME_TRANS_ENABLED             34
+#define WCN36XX_HAL_CFG_DTIM_PERIOD                     35
+#define WCN36XX_HAL_CFG_EDCA_WMM_ACBK                   36
+#define WCN36XX_HAL_CFG_EDCA_WMM_ACBE                   37
+#define WCN36XX_HAL_CFG_EDCA_WMM_ACVO                   38
+#define WCN36XX_HAL_CFG_EDCA_WMM_ACVI                   39
+#define WCN36XX_HAL_CFG_BA_THRESHOLD_HIGH               40
+#define WCN36XX_HAL_CFG_MAX_BA_BUFFERS                  41
+#define WCN36XX_HAL_CFG_RPE_POLLING_THRESHOLD           42
+#define WCN36XX_HAL_CFG_RPE_AGING_THRESHOLD_FOR_AC0_REG 43
+#define WCN36XX_HAL_CFG_RPE_AGING_THRESHOLD_FOR_AC1_REG 44
+#define WCN36XX_HAL_CFG_RPE_AGING_THRESHOLD_FOR_AC2_REG 45
+#define WCN36XX_HAL_CFG_RPE_AGING_THRESHOLD_FOR_AC3_REG 46
+#define WCN36XX_HAL_CFG_NO_OF_ONCHIP_REORDER_SESSIONS   47
+#define WCN36XX_HAL_CFG_PS_LISTEN_INTERVAL              48
+#define WCN36XX_HAL_CFG_PS_HEART_BEAT_THRESHOLD         49
+#define WCN36XX_HAL_CFG_PS_NTH_BEACON_FILTER            50
+#define WCN36XX_HAL_CFG_PS_MAX_PS_POLL                  51
+#define WCN36XX_HAL_CFG_PS_MIN_RSSI_THRESHOLD           52
+#define WCN36XX_HAL_CFG_PS_RSSI_FILTER_PERIOD           53
+#define WCN36XX_HAL_CFG_PS_BROADCAST_FRAME_FILTER_ENABLE 54
+#define WCN36XX_HAL_CFG_PS_IGNORE_DTIM                  55
+#define WCN36XX_HAL_CFG_PS_ENABLE_BCN_EARLY_TERM        56
+#define WCN36XX_HAL_CFG_DYNAMIC_PS_POLL_VALUE           57
+#define WCN36XX_HAL_CFG_PS_NULLDATA_AP_RESP_TIMEOUT     58
+#define WCN36XX_HAL_CFG_TELE_BCN_WAKEUP_EN              59
+#define WCN36XX_HAL_CFG_TELE_BCN_TRANS_LI               60
+#define WCN36XX_HAL_CFG_TELE_BCN_TRANS_LI_IDLE_BCNS     61
+#define WCN36XX_HAL_CFG_TELE_BCN_MAX_LI                 62
+#define WCN36XX_HAL_CFG_TELE_BCN_MAX_LI_IDLE_BCNS       63
+#define WCN36XX_HAL_CFG_TX_PWR_CTRL_ENABLE              64
+#define WCN36XX_HAL_CFG_VALID_RADAR_CHANNEL_LIST        65
+#define WCN36XX_HAL_CFG_TX_POWER_24_20                  66
+#define WCN36XX_HAL_CFG_TX_POWER_24_40                  67
+#define WCN36XX_HAL_CFG_TX_POWER_50_20                  68
+#define WCN36XX_HAL_CFG_TX_POWER_50_40                  69
+#define WCN36XX_HAL_CFG_MCAST_BCAST_FILTER_SETTING      70
+#define WCN36XX_HAL_CFG_BCN_EARLY_TERM_WAKEUP_INTERVAL  71
+#define WCN36XX_HAL_CFG_MAX_TX_POWER_2_4                72
+#define WCN36XX_HAL_CFG_MAX_TX_POWER_5                  73
+#define WCN36XX_HAL_CFG_INFRA_STA_KEEP_ALIVE_PERIOD     74
+#define WCN36XX_HAL_CFG_ENABLE_CLOSE_LOOP               75
+#define WCN36XX_HAL_CFG_BTC_EXECUTION_MODE              76
+#define WCN36XX_HAL_CFG_BTC_DHCP_BT_SLOTS_TO_BLOCK      77
+#define WCN36XX_HAL_CFG_BTC_A2DP_DHCP_BT_SUB_INTERVALS  78
+#define WCN36XX_HAL_CFG_PS_TX_INACTIVITY_TIMEOUT        79
+#define WCN36XX_HAL_CFG_WCNSS_API_VERSION               80
+#define WCN36XX_HAL_CFG_AP_KEEPALIVE_TIMEOUT            81
+#define WCN36XX_HAL_CFG_GO_KEEPALIVE_TIMEOUT            82
+#define WCN36XX_HAL_CFG_ENABLE_MC_ADDR_LIST             83
+#define WCN36XX_HAL_CFG_BTC_STATIC_LEN_INQ_BT           84
+#define WCN36XX_HAL_CFG_BTC_STATIC_LEN_PAGE_BT          85
+#define WCN36XX_HAL_CFG_BTC_STATIC_LEN_CONN_BT          86
+#define WCN36XX_HAL_CFG_BTC_STATIC_LEN_LE_BT            87
+#define WCN36XX_HAL_CFG_BTC_STATIC_LEN_INQ_WLAN         88
+#define WCN36XX_HAL_CFG_BTC_STATIC_LEN_PAGE_WLAN        89
+#define WCN36XX_HAL_CFG_BTC_STATIC_LEN_CONN_WLAN        90
+#define WCN36XX_HAL_CFG_BTC_STATIC_LEN_LE_WLAN          91
+#define WCN36XX_HAL_CFG_BTC_DYN_MAX_LEN_BT              92
+#define WCN36XX_HAL_CFG_BTC_DYN_MAX_LEN_WLAN            93
+#define WCN36XX_HAL_CFG_BTC_MAX_SCO_BLOCK_PERC          94
+#define WCN36XX_HAL_CFG_BTC_DHCP_PROT_ON_A2DP           95
+#define WCN36XX_HAL_CFG_BTC_DHCP_PROT_ON_SCO            96
+#define WCN36XX_HAL_CFG_ENABLE_UNICAST_FILTER           97
+#define WCN36XX_HAL_CFG_MAX_ASSOC_LIMIT                 98
+#define WCN36XX_HAL_CFG_ENABLE_LPWR_IMG_TRANSITION      99
+#define WCN36XX_HAL_CFG_ENABLE_MCC_ADAPTIVE_SCHEDULER   100
+#define WCN36XX_HAL_CFG_ENABLE_DETECT_PS_SUPPORT        101
+#define WCN36XX_HAL_CFG_AP_LINK_MONITOR_TIMEOUT         102
+#define WCN36XX_HAL_CFG_BTC_DWELL_TIME_MULTIPLIER       103
+#define WCN36XX_HAL_CFG_ENABLE_TDLS_OXYGEN_MODE         104
+#define WCN36XX_HAL_CFG_MAX_PARAMS                      105
+
+/* Message definitons - All the messages below need to be packed */
+
+/* Definition for HAL API Version. */
+struct wcnss_wlan_version {
+        u8 revision;
+        u8 version;
+        u8 minor;
+        u8 major;
+} __packed;
+
+/* Definition for Encryption Keys */
+struct wcn36xx_hal_keys {
+        u8 id;
+
+        /* 0 for multicast */
+        u8 unicast;
+
+        enum ani_key_direction direction;
+
+        /* Usage is unknown */
+        u8 rsc[WLAN_MAX_KEY_RSC_LEN];
+
+        /* =1 for authenticator,=0 for supplicant */
+        u8 pae_role;
+
+        u16 length;
+        u8 key[WCN36XX_HAL_MAC_MAX_KEY_LENGTH];
+} __packed;
+
+/*
+ * set_sta_key_params Moving here since it is shared by
+ * configbss/setstakey msgs
+ */
+struct wcn36xx_hal_set_sta_key_params {
+        /* STA Index */
+        u16 sta_index;
+
+        /* Encryption Type used with peer */
+        enum ani_ed_type enc_type;
+
+        /* STATIC/DYNAMIC - valid only for WEP */
+        enum ani_wep_type wep_type;
+
+        /* Default WEP key, valid only for static WEP, must between 0 and 3. */
+        u8 def_wep_idx;
+
+        /* valid only for non-static WEP encyrptions */
+        struct wcn36xx_hal_keys key[WCN36XX_HAL_MAC_MAX_NUM_OF_DEFAULT_KEYS];
+
+        /*
+         * Control for Replay Count, 1= Single TID based replay count on Tx
+         * 0 = Per TID based replay count on TX
+         */
+        u8 single_tid_rc;
+
+} __packed;
+
+/* 4-byte control message header used by HAL*/
+struct wcn36xx_hal_msg_header {
+        enum wcn36xx_hal_host_msg_type msg_type:16;
+        enum wcn36xx_hal_host_msg_version msg_version:16;
+        u32 len;
+} __packed;
+
+/* Config format required by HAL for each CFG item*/
+struct wcn36xx_hal_cfg {
+        /* Cfg Id. The Id required by HAL is exported by HAL
+         * in shared header file between UMAC and HAL.*/
+        u16 id;
+
+        /* Length of the Cfg. This parameter is used to go to next cfg
+         * in the TLV format.*/
+        u16 len;
+
+        /* Padding bytes for unaligned address's */
+        u16 pad_bytes;
+
+        /* Reserve bytes for making cfgVal to align address */
+        u16 reserve;
+
+        /* Following the uCfgLen field there should be a 'uCfgLen' bytes
+         * containing the uCfgValue ; u8 uCfgValue[uCfgLen] */
+} __packed;
+
+struct wcn36xx_hal_mac_start_parameters {
+        /* Drive Type - Production or FTM etc */
+        enum driver_type type;
+
+        /* Length of the config buffer */
+        u32 len;
+
+        /* Following this there is a TLV formatted buffer of length
+         * "len" bytes containing all config values.
+         * The TLV is expected to be formatted like this:
+         * 0           15            31           31+CFG_LEN-1        length-1
+         * |   CFG_ID   |   CFG_LEN   |   CFG_BODY    |  CFG_ID  |......|
+         */
+} __packed;
+
+struct wcn36xx_hal_mac_start_req_msg {
+        /* config buffer must start in TLV format just here */
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_mac_start_parameters params;
+} __packed;
+
+struct wcn36xx_hal_mac_start_rsp_params {
+        /* success or failure */
+        u16 status;
+
+        /* Max number of STA supported by the device */
+        u8 stations;
+
+        /* Max number of BSS supported by the device */
+        u8 bssids;
+
+        /* API Version */
+        struct wcnss_wlan_version version;
+
+        /* CRM build information */
+        u8 crm_version[WCN36XX_HAL_VERSION_LENGTH];
+
+        /* hardware/chipset/misc version information */
+        u8 wlan_version[WCN36XX_HAL_VERSION_LENGTH];
+
+} __packed;
+
+struct wcn36xx_hal_mac_start_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_mac_start_rsp_params start_rsp_params;
+} __packed;
+
+struct wcn36xx_hal_mac_stop_req_params {
+        /* The reason for which the device is being stopped */
+        enum wcn36xx_hal_stop_type reason;
+
+} __packed;
+
+struct wcn36xx_hal_mac_stop_req_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_mac_stop_req_params stop_req_params;
+} __packed;
+
+struct wcn36xx_hal_mac_stop_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+} __packed;
+
+struct wcn36xx_hal_update_cfg_req_msg {
+        /*
+         * Note: The length specified in tHalUpdateCfgReqMsg messages should be
+         * header.msgLen = sizeof(tHalUpdateCfgReqMsg) + uConfigBufferLen
+         */
+        struct wcn36xx_hal_msg_header header;
+
+        /* Length of the config buffer. Allows UMAC to update multiple CFGs */
+        u32 len;
+
+        /*
+         * Following this there is a TLV formatted buffer of length
+         * "uConfigBufferLen" bytes containing all config values.
+         * The TLV is expected to be formatted like this:
+         * 0           15            31           31+CFG_LEN-1        length-1
+         * |   CFG_ID   |   CFG_LEN   |   CFG_BODY    |  CFG_ID  |......|
+         */
+
+} __packed;
+
+struct wcn36xx_hal_update_cfg_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+} __packed;
+
+/* Frame control field format (2 bytes) */
+struct wcn36xx_hal_mac_frame_ctl {
+
+#ifndef ANI_LITTLE_BIT_ENDIAN
+
+        u8 subType:4;
+        u8 type:2;
+        u8 protVer:2;
+
+        u8 order:1;
+        u8 wep:1;
+        u8 moreData:1;
+        u8 powerMgmt:1;
+        u8 retry:1;
+        u8 moreFrag:1;
+        u8 fromDS:1;
+        u8 toDS:1;
+
+#else
+
+        u8 protVer:2;
+        u8 type:2;
+        u8 subType:4;
+
+        u8 toDS:1;
+        u8 fromDS:1;
+        u8 moreFrag:1;
+        u8 retry:1;
+        u8 powerMgmt:1;
+        u8 moreData:1;
+        u8 wep:1;
+        u8 order:1;
+
+#endif
+
+};
+
+/* Sequence control field */
+struct wcn36xx_hal_mac_seq_ctl {
+        u8 fragNum:4;
+        u8 seqNumLo:4;
+        u8 seqNumHi:8;
+};
+
+/* Management header format */
+struct wcn36xx_hal_mac_mgmt_hdr {
+        struct wcn36xx_hal_mac_frame_ctl fc;
+        u8 durationLo;
+        u8 durationHi;
+        u8 da[6];
+        u8 sa[6];
+        u8 bssId[6];
+        struct wcn36xx_hal_mac_seq_ctl seqControl;
+};
+
+/* FIXME: pronto v1 apparently has 4 */
+#define WCN36XX_HAL_NUM_BSSID               2
+
+/* Scan Entry to hold active BSS idx's */
+struct wcn36xx_hal_scan_entry {
+        u8 bss_index[WCN36XX_HAL_NUM_BSSID];
+        u8 active_bss_count;
+};
+
+struct wcn36xx_hal_init_scan_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* LEARN - AP Role
+           SCAN - STA Role */
+        enum wcn36xx_hal_sys_mode mode;
+
+        /* BSSID of the BSS */
+        u8 bssid[ETH_ALEN];
+
+        /* Whether BSS needs to be notified */
+        u8 notify;
+
+        /* Kind of frame to be used for notifying the BSS (Data Null, QoS
+         * Null, or CTS to Self). Must always be a valid frame type. */
+        u8 frame_type;
+
+        /* UMAC has the option of passing the MAC frame to be used for
+         * notifying the BSS. If non-zero, HAL will use the MAC frame
+         * buffer pointed to by macMgmtHdr. If zero, HAL will generate the
+         * appropriate MAC frame based on frameType. */
+        u8 frame_len;
+
+        /* Following the framelength there is a MAC frame buffer if
+         * frameLength is non-zero. */
+        struct wcn36xx_hal_mac_mgmt_hdr mac_mgmt_hdr;
+
+        /* Entry to hold number of active BSS idx's */
+        struct wcn36xx_hal_scan_entry scan_entry;
+};
+
+struct wcn36xx_hal_init_scan_con_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* LEARN - AP Role
+           SCAN - STA Role */
+        enum wcn36xx_hal_sys_mode mode;
+
+        /* BSSID of the BSS */
+        u8 bssid[ETH_ALEN];
+
+        /* Whether BSS needs to be notified */
+        u8 notify;
+
+        /* Kind of frame to be used for notifying the BSS (Data Null, QoS
+         * Null, or CTS to Self). Must always be a valid frame type. */
+        u8 frame_type;
+
+        /* UMAC has the option of passing the MAC frame to be used for
+         * notifying the BSS. If non-zero, HAL will use the MAC frame
+         * buffer pointed to by macMgmtHdr. If zero, HAL will generate the
+         * appropriate MAC frame based on frameType. */
+        u8 frame_length;
+
+        /* Following the framelength there is a MAC frame buffer if
+         * frameLength is non-zero. */
+        struct wcn36xx_hal_mac_mgmt_hdr mac_mgmt_hdr;
+
+        /* Entry to hold number of active BSS idx's */
+        struct wcn36xx_hal_scan_entry scan_entry;
+
+        /* Single NoA usage in Scanning */
+        u8 use_noa;
+
+        /* Indicates the scan duration (in ms) */
+        u16 scan_duration;
+
+};
+
+struct wcn36xx_hal_init_scan_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+} __packed;
+
+struct wcn36xx_hal_start_scan_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Indicates the channel to scan */
+        u8 scan_channel;
+} __packed;
+
+struct wcn36xx_hal_start_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        u32 start_tsf[2];
+        u8 tx_mgmt_power;
+
+} __packed;
+
+struct wcn36xx_hal_end_scan_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Indicates the channel to stop scanning. Not used really. But
+         * retained for symmetry with "start Scan" message. It can also
+         * help in error check if needed. */
+        u8 scan_channel;
+} __packed;
+
+struct wcn36xx_hal_end_scan_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+} __packed;
+
+struct wcn36xx_hal_finish_scan_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Identifies the operational state of the AP/STA
+         * LEARN - AP Role SCAN - STA Role */
+        enum wcn36xx_hal_sys_mode mode;
+
+        /* Operating channel to tune to. */
+        u8 oper_channel;
+
+        /* Channel Bonding state If 20/40 MHz is operational, this will
+         * indicate the 40 MHz extension channel in combination with the
+         * control channel */
+        enum phy_chan_bond_state cb_state;
+
+        /* BSSID of the BSS */
+        u8 bssid[ETH_ALEN];
+
+        /* Whether BSS needs to be notified */
+        u8 notify;
+
+        /* Kind of frame to be used for notifying the BSS (Data Null, QoS
+         * Null, or CTS to Self). Must always be a valid frame type. */
+        u8 frame_type;
+
+        /* UMAC has the option of passing the MAC frame to be used for
+         * notifying the BSS. If non-zero, HAL will use the MAC frame
+         * buffer pointed to by macMgmtHdr. If zero, HAL will generate the
+         * appropriate MAC frame based on frameType. */
+        u8 frame_length;
+
+        /* Following the framelength there is a MAC frame buffer if
+         * frameLength is non-zero. */
+        struct wcn36xx_hal_mac_mgmt_hdr mac_mgmt_hdr;
+
+        /* Entry to hold number of active BSS idx's */
+        struct wcn36xx_hal_scan_entry scan_entry;
+
+} __packed;
+
+struct wcn36xx_hal_finish_scan_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+} __packed;
+
+enum wcn36xx_hal_rate_index {
+        HW_RATE_INDEX_1MBPS     = 0x82,
+        HW_RATE_INDEX_2MBPS     = 0x84,
+        HW_RATE_INDEX_5_5MBPS   = 0x8B,
+        HW_RATE_INDEX_6MBPS     = 0x0C,
+        HW_RATE_INDEX_9MBPS     = 0x12,
+        HW_RATE_INDEX_11MBPS    = 0x96,
+        HW_RATE_INDEX_12MBPS    = 0x18,
+        HW_RATE_INDEX_18MBPS    = 0x24,
+        HW_RATE_INDEX_24MBPS    = 0x30,
+        HW_RATE_INDEX_36MBPS    = 0x48,
+        HW_RATE_INDEX_48MBPS    = 0x60,
+        HW_RATE_INDEX_54MBPS    = 0x6C
+};
+
+struct wcn36xx_hal_supported_rates {
+        /*
+         * For Self STA Entry: this represents Self Mode.
+         * For Peer Stations, this represents the mode of the peer.
+         * On Station:
+         *
+         * --this mode is updated when PE adds the Self Entry.
+         *
+         * -- OR when PE sends 'ADD_BSS' message and station context in BSS
+         *    is used to indicate the mode of the AP.
+         *
+         * ON AP:
+         *
+         * -- this mode is updated when PE sends 'ADD_BSS' and Sta entry
+         *     for that BSS is used to indicate the self mode of the AP.
+         *
+         * -- OR when a station is associated, PE sends 'ADD_STA' message
+         *    with this mode updated.
+         */
+
+        enum sta_rate_mode op_rate_mode;
+
+        /* 11b, 11a and aniLegacyRates are IE rates which gives rate in
+         * unit of 500Kbps */
+        u16 dsss_rates[WCN36XX_HAL_NUM_DSSS_RATES];
+        u16 ofdm_rates[WCN36XX_HAL_NUM_OFDM_RATES];
+        u16 legacy_rates[WCN36XX_HAL_NUM_POLARIS_RATES];
+        u16 reserved;
+
+        /* Taurus only supports 26 Titan Rates(no ESF/concat Rates will be
+         * supported) First 26 bits are reserved for those Titan rates and
+         * the last 4 bits(bit28-31) for Taurus, 2(bit26-27) bits are
+         * reserved. */
+        /* Titan and Taurus Rates */
+        u32 enhanced_rate_bitmap;
+
+        /*
+         * 0-76 bits used, remaining reserved
+         * bits 0-15 and 32 should be set.
+         */
+        u8 supported_mcs_set[WCN36XX_HAL_MAC_MAX_SUPPORTED_MCS_SET];
+
+        /*
+         * RX Highest Supported Data Rate defines the highest data
+         * rate that the STA is able to receive, in unites of 1Mbps.
+         * This value is derived from "Supported MCS Set field" inside
+         * the HT capability element.
+         */
+        u16 rx_highest_data_rate;
+
+} __packed;
+
+struct wcn36xx_hal_config_sta_params {
+        /* BSSID of STA */
+        u8 bssid[ETH_ALEN];
+
+        /* ASSOC ID, as assigned by UMAC */
+        u16 aid;
+
+        /* STA entry Type: 0 - Self, 1 - Other/Peer, 2 - BSSID, 3 - BCAST */
+        u8 type;
+
+        /* Short Preamble Supported. */
+        u8 short_preamble_supported;
+
+        /* MAC Address of STA */
+        u8 mac[ETH_ALEN];
+
+        /* Listen interval of the STA */
+        u16 listen_interval;
+
+        /* Support for 11e/WMM */
+        u8 wmm_enabled;
+
+        /* 11n HT capable STA */
+        u8 ht_capable;
+
+        /* TX Width Set: 0 - 20 MHz only, 1 - 20/40 MHz */
+        u8 tx_channel_width_set;
+
+        /* RIFS mode 0 - NA, 1 - Allowed */
+        u8 rifs_mode;
+
+        /* L-SIG TXOP Protection mechanism
+           0 - No Support, 1 - Supported
+           SG - there is global field */
+        u8 lsig_txop_protection;
+
+        /* Max Ampdu Size supported by STA. TPE programming.
+           0 : 8k , 1 : 16k, 2 : 32k, 3 : 64k */
+        u8 max_ampdu_size;
+
+        /* Max Ampdu density. Used by RA.  3 : 0~7 : 2^(11nAMPDUdensity -4) */
+        u8 max_ampdu_density;
+
+        /* Max AMSDU size 1 : 3839 bytes, 0 : 7935 bytes */
+        u8 max_amsdu_size;
+
+        /* Short GI support for 40Mhz packets */
+        u8 sgi_40mhz;
+
+        /* Short GI support for 20Mhz packets */
+        u8 sgi_20Mhz;
+
+        /* TODO move this parameter to the end for 3680 */
+        /* These rates are the intersection of peer and self capabilities. */
+        struct wcn36xx_hal_supported_rates supported_rates;
+
+        /* Robust Management Frame (RMF) enabled/disabled */
+        u8 rmf;
+
+        /* The unicast encryption type in the association */
+        u32 encrypt_type;
+
+        /* HAL should update the existing STA entry, if this flag is set. UMAC
+           will set this flag in case of RE-ASSOC, where we want to reuse the
+           old STA ID. 0 = Add, 1 = Update */
+        u8 action;
+
+        /* U-APSD Flags: 1b per AC.  Encoded as follows:
+           b7 b6 b5 b4 b3 b2 b1 b0 =
+           X  X  X  X  BE BK VI VO */
+        u8 uapsd;
+
+        /* Max SP Length */
+        u8 max_sp_len;
+
+        /* 11n Green Field preamble support
+           0 - Not supported, 1 - Supported */
+        u8 green_field_capable;
+
+        /* MIMO Power Save mode */
+        enum wcn36xx_hal_ht_mimo_state mimo_ps;
+
+        /* Delayed BA Support */
+        u8 delayed_ba_support;
+
+        /* Max AMPDU duration in 32us */
+        u8 max_ampdu_duration;
+
+        /* HT STA should set it to 1 if it is enabled in BSS. HT STA should
+         * set it to 0 if AP does not support it. This indication is sent
+         * to HAL and HAL uses this flag to pickup up appropriate 40Mhz
+         * rates. */
+        u8 dsss_cck_mode_40mhz;
+
+        /* Valid STA Idx when action=Update. Set to 0xFF when invalid!
+         * Retained for backward compalibity with existing HAL code */
+        u8 sta_index;
+
+        /* BSSID of BSS to which station is associated. Set to 0xFF when
+         * invalid. Retained for backward compalibity with existing HAL
+         * code */
+        u8 bssid_index;
+
+        u8 p2p;
+
+        /* TODO add this parameter for 3680. */
+        /* Reserved to align next field on a dword boundary */
+        /* u8 reserved; */
+} __packed;
+
+struct wcn36xx_hal_config_sta_req_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_config_sta_params sta_params;
+} __packed;
+
+struct wcn36xx_hal_config_sta_params_v1 {
+        /* BSSID of STA */
+        u8 bssid[ETH_ALEN];
+
+        /* ASSOC ID, as assigned by UMAC */
+        u16 aid;
+
+        /* STA entry Type: 0 - Self, 1 - Other/Peer, 2 - BSSID, 3 - BCAST */
+        u8 type;
+
+        /* Short Preamble Supported. */
+        u8 short_preamble_supported;
+
+        /* MAC Address of STA */
+        u8 mac[ETH_ALEN];
+
+        /* Listen interval of the STA */
+        u16 listen_interval;
+
+        /* Support for 11e/WMM */
+        u8 wmm_enabled;
+
+        /* 11n HT capable STA */
+        u8 ht_capable;
+
+        /* TX Width Set: 0 - 20 MHz only, 1 - 20/40 MHz */
+        u8 tx_channel_width_set;
+
+        /* RIFS mode 0 - NA, 1 - Allowed */
+        u8 rifs_mode;
+
+        /* L-SIG TXOP Protection mechanism
+           0 - No Support, 1 - Supported
+           SG - there is global field */
+        u8 lsig_txop_protection;
+
+        /* Max Ampdu Size supported by STA. TPE programming.
+           0 : 8k , 1 : 16k, 2 : 32k, 3 : 64k */
+        u8 max_ampdu_size;
+
+        /* Max Ampdu density. Used by RA.  3 : 0~7 : 2^(11nAMPDUdensity -4) */
+        u8 max_ampdu_density;
+
+        /* Max AMSDU size 1 : 3839 bytes, 0 : 7935 bytes */
+        u8 max_amsdu_size;
+
+        /* Short GI support for 40Mhz packets */
+        u8 sgi_40mhz;
+
+        /* Short GI support for 20Mhz packets */
+        u8 sgi_20Mhz;
+
+        /* Robust Management Frame (RMF) enabled/disabled */
+        u8 rmf;
+
+        /* The unicast encryption type in the association */
+        u32 encrypt_type;
+
+        /* HAL should update the existing STA entry, if this flag is set. UMAC
+           will set this flag in case of RE-ASSOC, where we want to reuse the
+           old STA ID. 0 = Add, 1 = Update */
+        u8 action;
+
+        /* U-APSD Flags: 1b per AC.  Encoded as follows:
+           b7 b6 b5 b4 b3 b2 b1 b0 =
+           X  X  X  X  BE BK VI VO */
+        u8 uapsd;
+
+        /* Max SP Length */
+        u8 max_sp_len;
+
+        /* 11n Green Field preamble support
+           0 - Not supported, 1 - Supported */
+        u8 green_field_capable;
+
+        /* MIMO Power Save mode */
+        enum wcn36xx_hal_ht_mimo_state mimo_ps;
+
+        /* Delayed BA Support */
+        u8 delayed_ba_support;
+
+        /* Max AMPDU duration in 32us */
+        u8 max_ampdu_duration;
+
+        /* HT STA should set it to 1 if it is enabled in BSS. HT STA should
+         * set it to 0 if AP does not support it. This indication is sent
+         * to HAL and HAL uses this flag to pickup up appropriate 40Mhz
+         * rates. */
+        u8 dsss_cck_mode_40mhz;
+
+        /* Valid STA Idx when action=Update. Set to 0xFF when invalid!
+         * Retained for backward compalibity with existing HAL code */
+        u8 sta_index;
+
+        /* BSSID of BSS to which station is associated. Set to 0xFF when
+         * invalid. Retained for backward compalibity with existing HAL
+         * code */
+        u8 bssid_index;
+
+        u8 p2p;
+
+        /* Reserved to align next field on a dword boundary */
+        u8 reserved;
+
+        /* These rates are the intersection of peer and self capabilities. */
+        struct wcn36xx_hal_supported_rates supported_rates;
+} __packed;
+
+struct wcn36xx_hal_config_sta_req_msg_v1 {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_config_sta_params_v1 sta_params;
+} __packed;
+
+struct config_sta_rsp_params {
+        /* success or failure */
+        u32 status;
+
+        /* Station index; valid only when 'status' field value SUCCESS */
+        u8 sta_index;
+
+        /* BSSID Index of BSS to which the station is associated */
+        u8 bssid_index;
+
+        /* DPU Index for PTK */
+        u8 dpu_index;
+
+        /* DPU Index for GTK */
+        u8 bcast_dpu_index;
+
+        /* DPU Index for IGTK  */
+        u8 bcast_mgmt_dpu_idx;
+
+        /* PTK DPU signature */
+        u8 uc_ucast_sig;
+
+        /* GTK DPU isignature */
+        u8 uc_bcast_sig;
+
+        /* IGTK DPU signature */
+        u8 uc_mgmt_sig;
+
+        u8 p2p;
+
+} __packed;
+
+struct wcn36xx_hal_config_sta_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        struct config_sta_rsp_params params;
+} __packed;
+
+/* Delete STA Request message */
+struct wcn36xx_hal_delete_sta_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Index of STA to delete */
+        u8 sta_index;
+
+} __packed;
+
+/* Delete STA Response message */
+struct wcn36xx_hal_delete_sta_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        /* Index of STA deleted */
+        u8 sta_id;
+} __packed;
+
+/* 12 Bytes long because this structure can be used to represent rate and
+ * extended rate set IEs. The parser assume this to be at least 12 */
+struct wcn36xx_hal_rate_set {
+        u8 num_rates;
+        u8 rate[WCN36XX_HAL_MAC_RATESET_EID_MAX];
+} __packed;
+
+/* access category record */
+struct wcn36xx_hal_aci_aifsn {
+#ifndef ANI_LITTLE_BIT_ENDIAN
+        u8 rsvd:1;
+        u8 aci:2;
+        u8 acm:1;
+        u8 aifsn:4;
+#else
+        u8 aifsn:4;
+        u8 acm:1;
+        u8 aci:2;
+        u8 rsvd:1;
+#endif
+} __packed;
+
+/* contention window size */
+struct wcn36xx_hal_mac_cw {
+#ifndef ANI_LITTLE_BIT_ENDIAN
+        u8 max:4;
+        u8 min:4;
+#else
+        u8 min:4;
+        u8 max:4;
+#endif
+} __packed;
+
+struct wcn36xx_hal_edca_param_record {
+        struct wcn36xx_hal_aci_aifsn aci;
+        struct wcn36xx_hal_mac_cw cw;
+        u16 txop_limit;
+} __packed;
+
+struct wcn36xx_hal_mac_ssid {
+        u8 length;
+        u8 ssid[32];
+} __packed;
+
+/* Concurrency role. These are generic IDs that identify the various roles
+ *  in the software system. */
+enum wcn36xx_hal_con_mode {
+        WCN36XX_HAL_STA_MODE = 0,
+
+        /* to support softAp mode . This is misleading.
+           It means AP MODE only. */
+        WCN36XX_HAL_STA_SAP_MODE = 1,
+
+        WCN36XX_HAL_P2P_CLIENT_MODE,
+        WCN36XX_HAL_P2P_GO_MODE,
+        WCN36XX_HAL_MONITOR_MODE,
+};
+
+/* This is a bit pattern to be set for each mode
+ * bit 0 - sta mode
+ * bit 1 - ap mode
+ * bit 2 - p2p client mode
+ * bit 3 - p2p go mode */
+enum wcn36xx_hal_concurrency_mode {
+        HAL_STA = 1,
+        HAL_SAP = 2,
+
+        /* to support sta, softAp  mode . This means STA+AP mode */
+        HAL_STA_SAP = 3,
+
+        HAL_P2P_CLIENT = 4,
+        HAL_P2P_GO = 8,
+        HAL_MAX_CONCURRENCY_PERSONA = 4
+};
+
+struct wcn36xx_hal_config_bss_params {
+        /* BSSID */
+        u8 bssid[ETH_ALEN];
+
+        /* Self Mac Address */
+        u8 self_mac_addr[ETH_ALEN];
+
+        /* BSS type */
+        enum wcn36xx_hal_bss_type bss_type;
+
+        /* Operational Mode: AP =0, STA = 1 */
+        u8 oper_mode;
+
+        /* Network Type */
+        enum wcn36xx_hal_nw_type nw_type;
+
+        /* Used to classify PURE_11G/11G_MIXED to program MTU */
+        u8 short_slot_time_supported;
+
+        /* Co-exist with 11a STA */
+        u8 lla_coexist;
+
+        /* Co-exist with 11b STA */
+        u8 llb_coexist;
+
+        /* Co-exist with 11g STA */
+        u8 llg_coexist;
+
+        /* Coexistence with 11n STA */
+        u8 ht20_coexist;
+
+        /* Non GF coexist flag */
+        u8 lln_non_gf_coexist;
+
+        /* TXOP protection support */
+        u8 lsig_tx_op_protection_full_support;
+
+        /* RIFS mode */
+        u8 rifs_mode;
+
+        /* Beacon Interval in TU */
+        u16 beacon_interval;
+
+        /* DTIM period */
+        u8 dtim_period;
+
+        /* TX Width Set: 0 - 20 MHz only, 1 - 20/40 MHz */
+        u8 tx_channel_width_set;
+
+        /* Operating channel */
+        u8 oper_channel;
+
+        /* Extension channel for channel bonding */
+        u8 ext_channel;
+
+        /* Reserved to align next field on a dword boundary */
+        u8 reserved;
+
+        /* TODO move sta to the end for 3680 */
+        /* Context of the station being added in HW
+         *  Add a STA entry for "itself" -
+         *
+         *  On AP  - Add the AP itself in an "STA context"
+         *
+         *  On STA - Add the AP to which this STA is joining in an
+         *  "STA context"
+         */
+        struct wcn36xx_hal_config_sta_params sta;
+        /* SSID of the BSS */
+        struct wcn36xx_hal_mac_ssid ssid;
+
+        /* HAL should update the existing BSS entry, if this flag is set.
+         * UMAC will set this flag in case of reassoc, where we want to
+         * resue the the old BSSID and still return success 0 = Add, 1 =
+         * Update */
+        u8 action;
+
+        /* MAC Rate Set */
+        struct wcn36xx_hal_rate_set rateset;
+
+        /* Enable/Disable HT capabilities of the BSS */
+        u8 ht;
+
+        /* Enable/Disable OBSS protection */
+        u8 obss_prot_enabled;
+
+        /* RMF enabled/disabled */
+        u8 rmf;
+
+        /* HT Operating Mode operating mode of the 802.11n STA */
+        enum wcn36xx_hal_ht_operating_mode ht_oper_mode;
+
+        /* Dual CTS Protection: 0 - Unused, 1 - Used */
+        u8 dual_cts_protection;
+
+        /* Probe Response Max retries */
+        u8 max_probe_resp_retry_limit;
+
+        /* To Enable Hidden ssid */
+        u8 hidden_ssid;
+
+        /* To Enable Disable FW Proxy Probe Resp */
+        u8 proxy_probe_resp;
+
+        /* Boolean to indicate if EDCA params are valid. UMAC might not
+         * have valid EDCA params or might not desire to apply EDCA params
+         * during config BSS. 0 implies Not Valid ; Non-Zero implies
+         * valid */
+        u8 edca_params_valid;
+
+        /* EDCA Parameters for Best Effort Access Category */
+        struct wcn36xx_hal_edca_param_record acbe;
+
+        /* EDCA Parameters forBackground Access Category */
+        struct wcn36xx_hal_edca_param_record acbk;
+
+        /* EDCA Parameters for Video Access Category */
+        struct wcn36xx_hal_edca_param_record acvi;
+
+        /* EDCA Parameters for Voice Access Category */
+        struct wcn36xx_hal_edca_param_record acvo;
+
+        /* Ext Bss Config Msg if set */
+        u8 ext_set_sta_key_param_valid;
+
+        /* SetStaKeyParams for ext bss msg */
+        struct wcn36xx_hal_set_sta_key_params ext_set_sta_key_param;
+
+        /* Persona for the BSS can be STA,AP,GO,CLIENT value same as enum
+         * wcn36xx_hal_con_mode */
+        u8 wcn36xx_hal_persona;
+
+        u8 spectrum_mgt_enable;
+
+        /* HAL fills in the tx power used for mgmt frames in txMgmtPower */
+        s8 tx_mgmt_power;
+
+        /* maxTxPower has max power to be used after applying the power
+         * constraint if any */
+        s8 max_tx_power;
+} __packed;
+
+struct wcn36xx_hal_config_bss_req_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_config_bss_params bss_params;
+} __packed;
+
+struct wcn36xx_hal_config_bss_params_v1 {
+        /* BSSID */
+        u8 bssid[ETH_ALEN];
+
+        /* Self Mac Address */
+        u8 self_mac_addr[ETH_ALEN];
+
+        /* BSS type */
+        enum wcn36xx_hal_bss_type bss_type;
+
+        /* Operational Mode: AP =0, STA = 1 */
+        u8 oper_mode;
+
+        /* Network Type */
+        enum wcn36xx_hal_nw_type nw_type;
+
+        /* Used to classify PURE_11G/11G_MIXED to program MTU */
+        u8 short_slot_time_supported;
+
+        /* Co-exist with 11a STA */
+        u8 lla_coexist;
+
+        /* Co-exist with 11b STA */
+        u8 llb_coexist;
+
+        /* Co-exist with 11g STA */
+        u8 llg_coexist;
+
+        /* Coexistence with 11n STA */
+        u8 ht20_coexist;
+
+        /* Non GF coexist flag */
+        u8 lln_non_gf_coexist;
+
+        /* TXOP protection support */
+        u8 lsig_tx_op_protection_full_support;
+
+        /* RIFS mode */
+        u8 rifs_mode;
+
+        /* Beacon Interval in TU */
+        u16 beacon_interval;
+
+        /* DTIM period */
+        u8 dtim_period;
+
+        /* TX Width Set: 0 - 20 MHz only, 1 - 20/40 MHz */
+        u8 tx_channel_width_set;
+
+        /* Operating channel */
+        u8 oper_channel;
+
+        /* Extension channel for channel bonding */
+        u8 ext_channel;
+
+        /* Reserved to align next field on a dword boundary */
+        u8 reserved;
+
+        /* SSID of the BSS */
+        struct wcn36xx_hal_mac_ssid ssid;
+
+        /* HAL should update the existing BSS entry, if this flag is set.
+         * UMAC will set this flag in case of reassoc, where we want to
+         * resue the the old BSSID and still return success 0 = Add, 1 =
+         * Update */
+        u8 action;
+
+        /* MAC Rate Set */
+        struct wcn36xx_hal_rate_set rateset;
+
+        /* Enable/Disable HT capabilities of the BSS */
+        u8 ht;
+
+        /* Enable/Disable OBSS protection */
+        u8 obss_prot_enabled;
+
+        /* RMF enabled/disabled */
+        u8 rmf;
+
+        /* HT Operating Mode operating mode of the 802.11n STA */
+        enum wcn36xx_hal_ht_operating_mode ht_oper_mode;
+
+        /* Dual CTS Protection: 0 - Unused, 1 - Used */
+        u8 dual_cts_protection;
+
+        /* Probe Response Max retries */
+        u8 max_probe_resp_retry_limit;
+
+        /* To Enable Hidden ssid */
+        u8 hidden_ssid;
+
+        /* To Enable Disable FW Proxy Probe Resp */
+        u8 proxy_probe_resp;
+
+        /* Boolean to indicate if EDCA params are valid. UMAC might not
+         * have valid EDCA params or might not desire to apply EDCA params
+         * during config BSS. 0 implies Not Valid ; Non-Zero implies
+         * valid */
+        u8 edca_params_valid;
+
+        /* EDCA Parameters for Best Effort Access Category */
+        struct wcn36xx_hal_edca_param_record acbe;
+
+        /* EDCA Parameters forBackground Access Category */
+        struct wcn36xx_hal_edca_param_record acbk;
+
+        /* EDCA Parameters for Video Access Category */
+        struct wcn36xx_hal_edca_param_record acvi;
+
+        /* EDCA Parameters for Voice Access Category */
+        struct wcn36xx_hal_edca_param_record acvo;
+
+        /* Ext Bss Config Msg if set */
+        u8 ext_set_sta_key_param_valid;
+
+        /* SetStaKeyParams for ext bss msg */
+        struct wcn36xx_hal_set_sta_key_params ext_set_sta_key_param;
+
+        /* Persona for the BSS can be STA,AP,GO,CLIENT value same as enum
+         * wcn36xx_hal_con_mode */
+        u8 wcn36xx_hal_persona;
+
+        u8 spectrum_mgt_enable;
+
+        /* HAL fills in the tx power used for mgmt frames in txMgmtPower */
+        s8 tx_mgmt_power;
+
+        /* maxTxPower has max power to be used after applying the power
+         * constraint if any */
+        s8 max_tx_power;
+
+        /* Context of the station being added in HW
+         *  Add a STA entry for "itself" -
+         *
+         *  On AP  - Add the AP itself in an "STA context"
+         *
+         *  On STA - Add the AP to which this STA is joining in an
+         *  "STA context"
+         */
+        struct wcn36xx_hal_config_sta_params_v1 sta;
+} __packed;
+
+struct wcn36xx_hal_config_bss_req_msg_v1 {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_config_bss_params_v1 bss_params;
+} __packed;
+
+struct wcn36xx_hal_config_bss_rsp_params {
+        /* Success or Failure */
+        u32 status;
+
+        /* BSS index allocated by HAL */
+        u8 bss_index;
+
+        /* DPU descriptor index for PTK */
+        u8 dpu_desc_index;
+
+        /* PTK DPU signature */
+        u8 ucast_dpu_signature;
+
+        /* DPU descriptor index for GTK */
+        u8 bcast_dpu_desc_indx;
+
+        /* GTK DPU signature */
+        u8 bcast_dpu_signature;
+
+        /* DPU descriptor for IGTK */
+        u8 mgmt_dpu_desc_index;
+
+        /* IGTK DPU signature */
+        u8 mgmt_dpu_signature;
+
+        /* Station Index for BSS entry */
+        u8 bss_sta_index;
+
+        /* Self station index for this BSS */
+        u8 bss_self_sta_index;
+
+        /* Bcast station for buffering bcast frames in AP role */
+        u8 bss_bcast_sta_idx;
+
+        /* MAC Address of STA(PEER/SELF) in staContext of configBSSReq */
+        u8 mac[ETH_ALEN];
+
+        /* HAL fills in the tx power used for mgmt frames in this field. */
+        s8 tx_mgmt_power;
+
+} __packed;
+
+struct wcn36xx_hal_config_bss_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_config_bss_rsp_params bss_rsp_params;
+} __packed;
+
+struct wcn36xx_hal_delete_bss_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* BSS index to be deleted */
+        u8 bss_index;
+
+} __packed;
+
+struct wcn36xx_hal_delete_bss_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Success or Failure */
+        u32 status;
+
+        /* BSS index that has been deleted */
+        u8 bss_index;
+
+} __packed;
+
+struct wcn36xx_hal_join_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Indicates the BSSID to which STA is going to associate */
+        u8 bssid[ETH_ALEN];
+
+        /* Indicates the channel to switch to. */
+        u8 channel;
+
+        /* Self STA MAC */
+        u8 self_sta_mac_addr[ETH_ALEN];
+
+        /* Local power constraint */
+        u8 local_power_constraint;
+
+        /* Secondary channel offset */
+        enum phy_chan_bond_state secondary_channel_offset;
+
+        /* link State */
+        enum wcn36xx_hal_link_state link_state;
+
+        /* Max TX power */
+        s8 max_tx_power;
+} __packed;
+
+struct wcn36xx_hal_join_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        /* HAL fills in the tx power used for mgmt frames in this field */
+        u8 tx_mgmt_power;
+} __packed;
+
+struct post_assoc_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        struct wcn36xx_hal_config_sta_params sta_params;
+        struct wcn36xx_hal_config_bss_params bss_params;
+};
+
+struct post_assoc_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct config_sta_rsp_params sta_rsp_params;
+        struct wcn36xx_hal_config_bss_rsp_params bss_rsp_params;
+};
+
+/* This is used to create a set of WEP keys for a given BSS. */
+struct wcn36xx_hal_set_bss_key_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* BSS Index of the BSS */
+        u8 bss_idx;
+
+        /* Encryption Type used with peer */
+        enum ani_ed_type enc_type;
+
+        /* Number of keys */
+        u8 num_keys;
+
+        /* Array of keys. */
+        struct wcn36xx_hal_keys keys[WCN36XX_HAL_MAC_MAX_NUM_OF_DEFAULT_KEYS];
+
+        /* Control for Replay Count, 1= Single TID based replay count on Tx
+         * 0 = Per TID based replay count on TX */
+        u8 single_tid_rc;
+} __packed;
+
+/* tagged version of set bss key */
+struct wcn36xx_hal_set_bss_key_req_msg_tagged {
+        struct wcn36xx_hal_set_bss_key_req_msg Msg;
+        u32 tag;
+} __packed;
+
+struct wcn36xx_hal_set_bss_key_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+} __packed;
+
+/*
+ * This is used  configure the key information on a given station.
+ * When the sec_type is WEP40 or WEP104, the def_wep_idx is used to locate
+ * a preconfigured key from a BSS the station assoicated with; otherwise
+ * a new key descriptor is created based on the key field.
+ */
+struct wcn36xx_hal_set_sta_key_req_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_set_sta_key_params set_sta_key_params;
+} __packed;
+
+struct wcn36xx_hal_set_sta_key_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+} __packed;
+
+struct wcn36xx_hal_remove_bss_key_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* BSS Index of the BSS */
+        u8 bss_idx;
+
+        /* Encryption Type used with peer */
+        enum ani_ed_type enc_type;
+
+        /* Key Id */
+        u8 key_id;
+
+        /* STATIC/DYNAMIC. Used in Nullifying in Key Descriptors for
+         * Static/Dynamic keys */
+        enum ani_wep_type wep_type;
+} __packed;
+
+struct wcn36xx_hal_remove_bss_key_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+} __packed;
+
+/*
+ * This is used by PE to Remove the key information on a given station.
+ */
+struct wcn36xx_hal_remove_sta_key_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* STA Index */
+        u16 sta_idx;
+
+        /* Encryption Type used with peer */
+        enum ani_ed_type enc_type;
+
+        /* Key Id */
+        u8 key_id;
+
+        /* Whether to invalidate the Broadcast key or Unicast key. In case
+         * of WEP, the same key is used for both broadcast and unicast. */
+        u8 unicast;
+
+} __packed;
+
+struct wcn36xx_hal_remove_sta_key_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /*success or failure */
+        u32 status;
+
+} __packed;
+
+#ifdef FEATURE_OEM_DATA_SUPPORT
+
+#ifndef OEM_DATA_REQ_SIZE
+#define OEM_DATA_REQ_SIZE 134
+#endif
+
+#ifndef OEM_DATA_RSP_SIZE
+#define OEM_DATA_RSP_SIZE 1968
+#endif
+
+struct start_oem_data_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u32 status;
+        tSirMacAddr self_mac_addr;
+        u8 oem_data_req[OEM_DATA_REQ_SIZE];
+
+};
+
+struct start_oem_data_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 oem_data_rsp[OEM_DATA_RSP_SIZE];
+};
+
+#endif
+
+struct wcn36xx_hal_switch_channel_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Channel number */
+        u8 channel_number;
+
+        /* Local power constraint */
+        u8 local_power_constraint;
+
+        /* Secondary channel offset */
+        enum phy_chan_bond_state secondary_channel_offset;
+
+        /* HAL fills in the tx power used for mgmt frames in this field. */
+        u8 tx_mgmt_power;
+
+        /* Max TX power */
+        u8 max_tx_power;
+
+        /* Self STA MAC */
+        u8 self_sta_mac_addr[ETH_ALEN];
+
+        /* VO WIFI comment: BSSID needed to identify session. As the
+         * request has power constraints, this should be applied only to
+         * that session Since MTU timing and EDCA are sessionized, this
+         * struct needs to be sessionized and bssid needs to be out of the
+         * VOWifi feature flag V IMP: Keep bssId field at the end of this
+         * msg. It is used to mantain backward compatbility by way of
+         * ignoring if using new host/old FW or old host/new FW since it is
+         * at the end of this struct
+         */
+        u8 bssid[ETH_ALEN];
+} __packed;
+
+struct wcn36xx_hal_switch_channel_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Status */
+        u32 status;
+
+        /* Channel number - same as in request */
+        u8 channel_number;
+
+        /* HAL fills in the tx power used for mgmt frames in this field */
+        u8 tx_mgmt_power;
+
+        /* BSSID needed to identify session - same as in request */
+        u8 bssid[ETH_ALEN];
+
+} __packed;
+
+struct update_edca_params_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /*BSS Index */
+        u16 bss_index;
+
+        /* Best Effort */
+        struct wcn36xx_hal_edca_param_record acbe;
+
+        /* Background */
+        struct wcn36xx_hal_edca_param_record acbk;
+
+        /* Video */
+        struct wcn36xx_hal_edca_param_record acvi;
+
+        /* Voice */
+        struct wcn36xx_hal_edca_param_record acvo;
+};
+
+struct update_edca_params_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct dpu_stats_params {
+        /* Index of STA to which the statistics */
+        u16 sta_index;
+
+        /* Encryption mode */
+        u8 enc_mode;
+
+        /* status */
+        u32 status;
+
+        /* Statistics */
+        u32 send_blocks;
+        u32 recv_blocks;
+        u32 replays;
+        u8 mic_error_cnt;
+        u32 prot_excl_cnt;
+        u16 format_err_cnt;
+        u16 un_decryptable_cnt;
+        u32 decrypt_err_cnt;
+        u32 decrypt_ok_cnt;
+};
+
+struct wcn36xx_hal_stats_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Valid STA Idx for per STA stats request */
+        u32 sta_id;
+
+        /* Categories of stats requested as specified in eHalStatsMask */
+        u32 stats_mask;
+};
+
+struct ani_summary_stats_info {
+        /* Total number of packets(per AC) that were successfully
+         * transmitted with retries */
+        u32 retry_cnt[4];
+
+        /* The number of MSDU packets and MMPDU frames per AC that the
+         * 802.11 station successfully transmitted after more than one
+         * retransmission attempt */
+        u32 multiple_retry_cnt[4];
+
+        /* Total number of packets(per AC) that were successfully
+         * transmitted (with and without retries, including multi-cast,
+         * broadcast) */
+        u32 tx_frm_cnt[4];
+
+        /* Total number of packets that were successfully received (after
+         * appropriate filter rules including multi-cast, broadcast) */
+        u32 rx_frm_cnt;
+
+        /* Total number of duplicate frames received successfully */
+        u32 frm_dup_cnt;
+
+        /* Total number packets(per AC) failed to transmit */
+        u32 fail_cnt[4];
+
+        /* Total number of RTS/CTS sequence failures for transmission of a
+         * packet */
+        u32 rts_fail_cnt;
+
+        /* Total number packets failed transmit because of no ACK from the
+         * remote entity */
+        u32 ack_fail_cnt;
+
+        /* Total number of RTS/CTS sequence success for transmission of a
+         * packet */
+        u32 rts_succ_cnt;
+
+        /* The sum of the receive error count and dropped-receive-buffer
+         * error count. HAL will provide this as a sum of (FCS error) +
+         * (Fail get BD/PDU in HW) */
+        u32 rx_discard_cnt;
+
+        /*
+         * The receive error count. HAL will provide the RxP FCS error
+         * global counter. */
+        u32 rx_error_cnt;
+
+        /* The sum of the transmit-directed byte count, transmit-multicast
+         * byte count and transmit-broadcast byte count. HAL will sum TPE
+         * UC/MC/BCAST global counters to provide this. */
+        u32 tx_byte_cnt;
+};
+
+/* defines tx_rate_flags */
+enum tx_rate_info {
+        /* Legacy rates */
+        HAL_TX_RATE_LEGACY = 0x1,
+
+        /* HT20 rates */
+        HAL_TX_RATE_HT20 = 0x2,
+
+        /* HT40 rates */
+        HAL_TX_RATE_HT40 = 0x4,
+
+        /* Rate with Short guard interval */
+        HAL_TX_RATE_SGI = 0x8,
+
+        /* Rate with Long guard interval */
+        HAL_TX_RATE_LGI = 0x10
+};
+
+struct ani_global_class_a_stats_info {
+        /* The number of MPDU frames received by the 802.11 station for
+         * MSDU packets or MMPDU frames */
+        u32 rx_frag_cnt;
+
+        /* The number of MPDU frames received by the 802.11 station for
+         * MSDU packets or MMPDU frames when a promiscuous packet filter
+         * was enabled */
+        u32 promiscuous_rx_frag_cnt;
+
+        /* The receiver input sensitivity referenced to a FER of 8% at an
+         * MPDU length of 1024 bytes at the antenna connector. Each element
+         * of the array shall correspond to a supported rate and the order
+         * shall be the same as the supporteRates parameter. */
+        u32 rx_input_sensitivity;
+
+        /* The maximum transmit power in dBm upto one decimal. for eg: if
+         * it is 10.5dBm, the value would be 105 */
+        u32 max_pwr;
+
+        /* Number of times the receiver failed to synchronize with the
+         * incoming signal after detecting the sync in the preamble of the
+         * transmitted PLCP protocol data unit. */
+        u32 sync_fail_cnt;
+
+        /* Legacy transmit rate, in units of 500 kbit/sec, for the most
+         * recently transmitted frame */
+        u32 tx_rate;
+
+        /* mcs index for HT20 and HT40 rates */
+        u32 mcs_index;
+
+        /* to differentiate between HT20 and HT40 rates; short and long
+         * guard interval */
+        u32 tx_rate_flags;
+};
+
+struct ani_global_security_stats {
+        /* The number of unencrypted received MPDU frames that the MAC
+         * layer discarded when the IEEE 802.11 dot11ExcludeUnencrypted
+         * management information base (MIB) object is enabled */
+        u32 rx_wep_unencrypted_frm_cnt;
+
+        /* The number of received MSDU packets that that the 802.11 station
+         * discarded because of MIC failures */
+        u32 rx_mic_fail_cnt;
+
+        /* The number of encrypted MPDU frames that the 802.11 station
+         * failed to decrypt because of a TKIP ICV error */
+        u32 tkip_icv_err;
+
+        /* The number of received MPDU frames that the 802.11 discarded
+         * because of an invalid AES-CCMP format */
+        u32 aes_ccmp_format_err;
+
+        /* The number of received MPDU frames that the 802.11 station
+         * discarded because of the AES-CCMP replay protection procedure */
+        u32 aes_ccmp_replay_cnt;
+
+        /* The number of received MPDU frames that the 802.11 station
+         * discarded because of errors detected by the AES-CCMP decryption
+         * algorithm */
+        u32 aes_ccmp_decrpt_err;
+
+        /* The number of encrypted MPDU frames received for which a WEP
+         * decryption key was not available on the 802.11 station */
+        u32 wep_undecryptable_cnt;
+
+        /* The number of encrypted MPDU frames that the 802.11 station
+         * failed to decrypt because of a WEP ICV error */
+        u32 wep_icv_err;
+
+        /* The number of received encrypted packets that the 802.11 station
+         * successfully decrypted */
+        u32 rx_decrypt_succ_cnt;
+
+        /* The number of encrypted packets that the 802.11 station failed
+         * to decrypt */
+        u32 rx_decrypt_fail_cnt;
+};
+
+struct ani_global_class_b_stats_info {
+        struct ani_global_security_stats uc_stats;
+        struct ani_global_security_stats mc_bc_stats;
+};
+
+struct ani_global_class_c_stats_info {
+        /* This counter shall be incremented for a received A-MSDU frame
+         * with the stations MAC address in the address 1 field or an
+         * A-MSDU frame with a group address in the address 1 field */
+        u32 rx_amsdu_cnt;
+
+        /* This counter shall be incremented when the MAC receives an AMPDU
+         * from the PHY */
+        u32 rx_ampdu_cnt;
+
+        /* This counter shall be incremented when a Frame is transmitted
+         * only on the primary channel */
+        u32 tx_20_frm_cnt;
+
+        /* This counter shall be incremented when a Frame is received only
+         * on the primary channel */
+        u32 rx_20_frm_cnt;
+
+        /* This counter shall be incremented by the number of MPDUs
+         * received in the A-MPDU when an A-MPDU is received */
+        u32 rx_mpdu_in_ampdu_cnt;
+
+        /* This counter shall be incremented when an MPDU delimiter has a
+         * CRC error when this is the first CRC error in the received AMPDU
+         * or when the previous delimiter has been decoded correctly */
+        u32 ampdu_delimiter_crc_err;
+};
+
+struct ani_per_sta_stats_info {
+        /* The number of MPDU frames that the 802.11 station transmitted
+         * and acknowledged through a received 802.11 ACK frame */
+        u32 tx_frag_cnt[4];
+
+        /* This counter shall be incremented when an A-MPDU is transmitted */
+        u32 tx_ampdu_cnt;
+
+        /* This counter shall increment by the number of MPDUs in the AMPDU
+         * when an A-MPDU is transmitted */
+        u32 tx_mpdu_in_ampdu_cnt;
+};
+
+struct wcn36xx_hal_stats_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Success or Failure */
+        u32 status;
+
+        /* STA Idx */
+        u32 sta_index;
+
+        /* Categories of STATS being returned as per eHalStatsMask */
+        u32 stats_mask;
+
+        /* message type is same as the request type */
+        u16 msg_type;
+
+        /* length of the entire request, includes the pStatsBuf length too */
+        u16 msg_len;
+};
+
+struct wcn36xx_hal_set_link_state_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 bssid[ETH_ALEN];
+        enum wcn36xx_hal_link_state state;
+        u8 self_mac_addr[ETH_ALEN];
+
+} __packed;
+
+struct set_link_state_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+/* TSPEC Params */
+struct wcn36xx_hal_ts_info_tfc {
+#ifndef ANI_LITTLE_BIT_ENDIAN
+        u16 ackPolicy:2;
+        u16 userPrio:3;
+        u16 psb:1;
+        u16 aggregation:1;
+        u16 accessPolicy:2;
+        u16 direction:2;
+        u16 tsid:4;
+        u16 trafficType:1;
+#else
+        u16 trafficType:1;
+        u16 tsid:4;
+        u16 direction:2;
+        u16 accessPolicy:2;
+        u16 aggregation:1;
+        u16 psb:1;
+        u16 userPrio:3;
+        u16 ackPolicy:2;
+#endif
+};
+
+/* Flag to schedule the traffic type */
+struct wcn36xx_hal_ts_info_sch {
+#ifndef ANI_LITTLE_BIT_ENDIAN
+        u8 rsvd:7;
+        u8 schedule:1;
+#else
+        u8 schedule:1;
+        u8 rsvd:7;
+#endif
+};
+
+/* Traffic and scheduling info */
+struct wcn36xx_hal_ts_info {
+        struct wcn36xx_hal_ts_info_tfc traffic;
+        struct wcn36xx_hal_ts_info_sch schedule;
+};
+
+/* Information elements */
+struct wcn36xx_hal_tspec_ie {
+        u8 type;
+        u8 length;
+        struct wcn36xx_hal_ts_info ts_info;
+        u16 nom_msdu_size;
+        u16 max_msdu_size;
+        u32 min_svc_interval;
+        u32 max_svc_interval;
+        u32 inact_interval;
+        u32 suspend_interval;
+        u32 svc_start_time;
+        u32 min_data_rate;
+        u32 mean_data_rate;
+        u32 peak_data_rate;
+        u32 max_burst_sz;
+        u32 delay_bound;
+        u32 min_phy_rate;
+        u16 surplus_bw;
+        u16 medium_time;
+};
+
+struct add_ts_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Station Index */
+        u16 sta_index;
+
+        /* TSPEC handler uniquely identifying a TSPEC for a STA in a BSS */
+        u16 tspec_index;
+
+        /* To program TPE with required parameters */
+        struct wcn36xx_hal_tspec_ie tspec;
+
+        /* U-APSD Flags: 1b per AC.  Encoded as follows:
+           b7 b6 b5 b4 b3 b2 b1 b0 =
+           X  X  X  X  BE BK VI VO */
+        u8 uapsd;
+
+        /* These parameters are for all the access categories */
+
+        /* Service Interval */
+        u32 service_interval[WCN36XX_HAL_MAX_AC];
+
+        /* Suspend Interval */
+        u32 suspend_interval[WCN36XX_HAL_MAX_AC];
+
+        /* Delay Interval */
+        u32 delay_interval[WCN36XX_HAL_MAX_AC];
+};
+
+struct add_rs_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct del_ts_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Station Index */
+        u16 sta_index;
+
+        /* TSPEC identifier uniquely identifying a TSPEC for a STA in a BSS */
+        u16 tspec_index;
+
+        /* To lookup station id using the mac address */
+        u8 bssid[ETH_ALEN];
+};
+
+struct del_ts_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+/* End of TSpec Parameters */
+
+/* Start of BLOCK ACK related Parameters */
+
+struct wcn36xx_hal_add_ba_session_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Station Index */
+        u16 sta_index;
+
+        /* Peer MAC Address */
+        u8 mac_addr[ETH_ALEN];
+
+        /* ADDBA Action Frame dialog token
+           HAL will not interpret this object */
+        u8 dialog_token;
+
+        /* TID for which the BA is being setup
+           This identifies the TC or TS of interest */
+        u8 tid;
+
+        /* 0 - Delayed BA (Not supported)
+           1 - Immediate BA */
+        u8 policy;
+
+        /* Indicates the number of buffers for this TID (baTID)
+           NOTE - This is the requested buffer size. When this
+           is processed by HAL and subsequently by HDD, it is
+           possible that HDD may change this buffer size. Any
+           change in the buffer size should be noted by PE and
+           advertized appropriately in the ADDBA response */
+        u16 buffer_size;
+
+        /* BA timeout in TU's 0 means no timeout will occur */
+        u16 timeout;
+
+        /* b0..b3 - Fragment Number - Always set to 0
+           b4..b15 - Starting Sequence Number of first MSDU
+           for which this BA is setup */
+        u16 ssn;
+
+        /* ADDBA direction
+           1 - Originator
+           0 - Recipient */
+        u8 direction;
+} __packed;
+
+struct wcn36xx_hal_add_ba_session_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        /* Dialog token */
+        u8 dialog_token;
+
+        /* TID for which the BA session has been setup */
+        u8 ba_tid;
+
+        /* BA Buffer Size allocated for the current BA session */
+        u8 ba_buffer_size;
+
+        u8 ba_session_id;
+
+        /* Reordering Window buffer */
+        u8 win_size;
+
+        /* Station Index to id the sta */
+        u8 sta_index;
+
+        /* Starting Sequence Number */
+        u16 ssn;
+} __packed;
+
+struct wcn36xx_hal_add_ba_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Session Id */
+        u8 session_id;
+
+        /* Reorder Window Size */
+        u8 win_size;
+/* Old FW 1.2.2.4 does not support this*/
+#ifdef FEATURE_ON_CHIP_REORDERING
+        u8 reordering_done_on_chip;
+#endif
+} __packed;
+
+struct wcn36xx_hal_add_ba_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        /* Dialog token */
+        u8 dialog_token;
+} __packed;
+
+struct add_ba_info {
+        u16 ba_enable:1;
+        u16 starting_seq_num:12;
+        u16 reserved:3;
+};
+
+struct wcn36xx_hal_trigger_ba_rsp_candidate {
+        u8 sta_addr[ETH_ALEN];
+        struct add_ba_info ba_info[STACFG_MAX_TC];
+} __packed;
+
+struct wcn36xx_hal_trigget_ba_req_candidate {
+        u8 sta_index;
+        u8 tid_bitmap;
+} __packed;
+
+struct wcn36xx_hal_trigger_ba_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Session Id */
+        u8 session_id;
+
+        /* baCandidateCnt is followed by trigger BA
+         * Candidate List(tTriggerBaCandidate)
+         */
+        u16 candidate_cnt;
+
+} __packed;
+
+struct wcn36xx_hal_trigger_ba_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* TO SUPPORT BT-AMP */
+        u8 bssid[ETH_ALEN];
+
+        /* success or failure */
+        u32 status;
+
+        /* baCandidateCnt is followed by trigger BA
+         * Rsp Candidate List(tTriggerRspBaCandidate)
+         */
+        u16 candidate_cnt;
+} __packed;
+
+struct wcn36xx_hal_del_ba_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Station Index */
+        u16 sta_index;
+
+        /* TID for which the BA session is being deleted */
+        u8 tid;
+
+        /* DELBA direction
+           1 - Originator
+           0 - Recipient */
+        u8 direction;
+} __packed;
+
+struct wcn36xx_hal_del_ba_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+} __packed;
+
+struct tsm_stats_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Traffic Id */
+        u8 tid;
+
+        u8 bssid[ETH_ALEN];
+};
+
+struct tsm_stats_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /*success or failure */
+        u32 status;
+
+        /* Uplink Packet Queue delay */
+        u16 uplink_pkt_queue_delay;
+
+        /* Uplink Packet Queue delay histogram */
+        u16 uplink_pkt_queue_delay_hist[4];
+
+        /* Uplink Packet Transmit delay */
+        u32 uplink_pkt_tx_delay;
+
+        /* Uplink Packet loss */
+        u16 uplink_pkt_loss;
+
+        /* Uplink Packet count */
+        u16 uplink_pkt_count;
+
+        /* Roaming count */
+        u8 roaming_count;
+
+        /* Roaming Delay */
+        u16 roaming_delay;
+};
+
+struct set_key_done_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /*bssid of the keys */
+        u8 bssidx;
+        u8 enc_type;
+};
+
+struct wcn36xx_hal_nv_img_download_req_msg {
+        /* Note: The length specified in wcn36xx_hal_nv_img_download_req_msg
+         * messages should be
+         * header.len = sizeof(wcn36xx_hal_nv_img_download_req_msg) +
+         * nv_img_buffer_size */
+        struct wcn36xx_hal_msg_header header;
+
+        /* Fragment sequence number of the NV Image. Note that NV Image
+         * might not fit into one message due to size limitation of the SMD
+         * channel FIFO. UMAC can hence choose to chop the NV blob into
+         * multiple fragments starting with seqeunce number 0, 1, 2 etc.
+         * The last fragment MUST be indicated by marking the
+         * isLastFragment field to 1. Note that all the NV blobs would be
+         * concatenated together by HAL without any padding bytes in
+         * between.*/
+        u16 frag_number;
+
+        /* Is this the last fragment? When set to 1 it indicates that no
+         * more fragments will be sent by UMAC and HAL can concatenate all
+         * the NV blobs rcvd & proceed with the parsing. HAL would generate
+         * a WCN36XX_HAL_DOWNLOAD_NV_RSP to the WCN36XX_HAL_DOWNLOAD_NV_REQ
+         * after it receives each fragment */
+        u16 last_fragment;
+
+        /* NV Image size (number of bytes) */
+        u32 nv_img_buffer_size;
+
+        /* Following the 'nv_img_buffer_size', there should be
+         * nv_img_buffer_size bytes of NV Image i.e.
+         * u8[nv_img_buffer_size] */
+} __packed;
+
+struct wcn36xx_hal_nv_img_download_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Success or Failure. HAL would generate a
+         * WCN36XX_HAL_DOWNLOAD_NV_RSP after each fragment */
+        u32 status;
+} __packed;
+
+struct wcn36xx_hal_nv_store_ind {
+        /* Note: The length specified in tHalNvStoreInd messages should be
+         * header.msgLen = sizeof(tHalNvStoreInd) + nvBlobSize */
+        struct wcn36xx_hal_msg_header header;
+
+        /* NV Item */
+        u32 table_id;
+
+        /* Size of NV Blob */
+        u32 nv_blob_size;
+
+        /* Following the 'nvBlobSize', there should be nvBlobSize bytes of
+         * NV blob i.e. u8[nvBlobSize] */
+};
+
+/* End of Block Ack Related Parameters */
+
+#define WCN36XX_HAL_CIPHER_SEQ_CTR_SIZE 6
+
+/* Definition for MIC failure indication MAC reports this each time a MIC
+ * failure occures on Rx TKIP packet
+ */
+struct mic_failure_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 bssid[ETH_ALEN];
+
+        /* address used to compute MIC */
+        u8 src_addr[ETH_ALEN];
+
+        /* transmitter address */
+        u8 ta_addr[ETH_ALEN];
+
+        u8 dst_addr[ETH_ALEN];
+
+        u8 multicast;
+
+        /* first byte of IV */
+        u8 iv1;
+
+        /* second byte of IV */
+        u8 key_id;
+
+        /* sequence number */
+        u8 tsc[WCN36XX_HAL_CIPHER_SEQ_CTR_SIZE];
+
+        /* receive address */
+        u8 rx_addr[ETH_ALEN];
+};
+
+struct update_vht_op_mode_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u16 op_mode;
+        u16 sta_id;
+};
+
+struct update_vht_op_mode_params_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u32 status;
+};
+
+struct update_beacon_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 bss_index;
+
+        /* shortPreamble mode. HAL should update all the STA rates when it
+         * receives this message */
+        u8 short_preamble;
+
+        /* short Slot time. */
+        u8 short_slot_time;
+
+        /* Beacon Interval */
+        u16 beacon_interval;
+
+        /* Protection related */
+        u8 lla_coexist;
+        u8 llb_coexist;
+        u8 llg_coexist;
+        u8 ht20_coexist;
+        u8 lln_non_gf_coexist;
+        u8 lsig_tx_op_protection_full_support;
+        u8 rifs_mode;
+
+        u16 param_change_bitmap;
+};
+
+struct update_beacon_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+        u32 status;
+};
+
+struct wcn36xx_hal_send_beacon_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* length of the template. */
+        u32 beacon_length;
+
+        /* Beacon data. */
+        u8 beacon[BEACON_TEMPLATE_SIZE];
+
+        u8 bssid[ETH_ALEN];
+
+        /* TIM IE offset from the beginning of the template. */
+        u32 tim_ie_offset;
+
+        /* P2P IE offset from the begining of the template */
+        u16 p2p_ie_offset;
+} __packed;
+
+struct send_beacon_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+        u32 status;
+} __packed;
+
+struct enable_radar_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 bssid[ETH_ALEN];
+        u8 channel;
+};
+
+struct enable_radar_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Link Parameters */
+        u8 bssid[ETH_ALEN];
+
+        /* success or failure */
+        u32 status;
+};
+
+struct radar_detect_intr_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 radar_det_channel;
+};
+
+struct radar_detect_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* channel number in which the RADAR detected */
+        u8 channel_number;
+
+        /* RADAR pulse width in usecond */
+        u16 radar_pulse_width;
+
+        /* Number of RADAR pulses */
+        u16 num_radar_pulse;
+};
+
+struct wcn36xx_hal_get_tpc_report_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 sta[ETH_ALEN];
+        u8 dialog_token;
+        u8 txpower;
+};
+
+struct wcn36xx_hal_get_tpc_report_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_send_probe_resp_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 probe_resp_template[BEACON_TEMPLATE_SIZE];
+        u32 probe_resp_template_len;
+        u32 proxy_probe_req_valid_ie_bmap[8];
+        u8 bssid[ETH_ALEN];
+};
+
+struct send_probe_resp_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct send_unknown_frame_rx_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_delete_sta_context_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u16 aid;
+        u16 sta_id;
+
+        /* TO SUPPORT BT-AMP */
+        u8 bssid[ETH_ALEN];
+
+        /* HAL copies bssid from the sta table. */
+        u8 addr2[ETH_ALEN];
+
+        /* To unify the keepalive / unknown A2 / tim-based disa */
+        u16 reason_code;
+} __packed;
+
+struct indicate_del_sta {
+        struct wcn36xx_hal_msg_header header;
+        u8 aid;
+        u8 sta_index;
+        u8 bss_index;
+        u8 reason_code;
+        u32 status;
+};
+
+struct bt_amp_event_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        enum bt_amp_event_type btAmpEventType;
+};
+
+struct bt_amp_event_rsp {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct tl_hal_flush_ac_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Station Index. originates from HAL */
+        u8 sta_id;
+
+        /* TID for which the transmit queue is being flushed */
+        u8 tid;
+};
+
+struct tl_hal_flush_ac_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Station Index. originates from HAL */
+        u8 sta_id;
+
+        /* TID for which the transmit queue is being flushed */
+        u8 tid;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_enter_imps_req_msg {
+        struct wcn36xx_hal_msg_header header;
+};
+
+struct wcn36xx_hal_exit_imps_req {
+        struct wcn36xx_hal_msg_header header;
+};
+
+struct wcn36xx_hal_enter_bmps_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 bss_index;
+
+        /* TBTT value derived from the last beacon */
+#ifndef BUILD_QWPTTSTATIC
+        u64 tbtt;
+#endif
+        u8 dtim_count;
+
+        /* DTIM period given to HAL during association may not be valid, if
+         * association is based on ProbeRsp instead of beacon. */
+        u8 dtim_period;
+
+        /* For CCX and 11R Roaming */
+        u32 rssi_filter_period;
+
+        u32 num_beacon_per_rssi_average;
+        u8 rssi_filter_enable;
+} __packed;
+
+struct wcn36xx_hal_exit_bmps_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 send_data_null;
+        u8 bss_index;
+} __packed;
+
+struct wcn36xx_hal_missed_beacon_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 bss_index;
+} __packed;
+
+/* Beacon Filtering data structures */
+
+/* The above structure would be followed by multiple of below mentioned
+ * structure
+ */
+struct beacon_filter_ie {
+        u8 element_id;
+        u8 check_ie_presence;
+        u8 offset;
+        u8 value;
+        u8 bitmask;
+        u8 ref;
+};
+
+struct wcn36xx_hal_add_bcn_filter_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u16 capability_info;
+        u16 capability_mask;
+        u16 beacon_interval;
+        u16 ie_num;
+        u8 bss_index;
+        u8 reserved;
+};
+
+struct wcn36xx_hal_rem_bcn_filter_req {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 ie_Count;
+        u8 rem_ie_id[1];
+};
+
+#define WCN36XX_HAL_IPV4_ARP_REPLY_OFFLOAD                  0
+#define WCN36XX_HAL_IPV6_NEIGHBOR_DISCOVERY_OFFLOAD         1
+#define WCN36XX_HAL_IPV6_NS_OFFLOAD                         2
+#define WCN36XX_HAL_IPV6_ADDR_LEN                           16
+#define WCN36XX_HAL_OFFLOAD_DISABLE                         0
+#define WCN36XX_HAL_OFFLOAD_ENABLE                          1
+#define WCN36XX_HAL_OFFLOAD_BCAST_FILTER_ENABLE             0x2
+#define WCN36XX_HAL_OFFLOAD_ARP_AND_BCAST_FILTER_ENABLE \
+        (HAL_OFFLOAD_ENABLE|HAL_OFFLOAD_BCAST_FILTER_ENABLE)
+
+struct wcn36xx_hal_ns_offload_params {
+        u8 src_ipv6_addr[WCN36XX_HAL_IPV6_ADDR_LEN];
+        u8 self_ipv6_addr[WCN36XX_HAL_IPV6_ADDR_LEN];
+
+        /* Only support 2 possible Network Advertisement IPv6 address */
+        u8 target_ipv6_addr1[WCN36XX_HAL_IPV6_ADDR_LEN];
+        u8 target_ipv6_addr2[WCN36XX_HAL_IPV6_ADDR_LEN];
+
+        u8 self_addr[ETH_ALEN];
+        u8 src_ipv6_addr_valid:1;
+        u8 target_ipv6_addr1_valid:1;
+        u8 target_ipv6_addr2_valid:1;
+        u8 reserved1:5;
+
+        /* make it DWORD aligned */
+        u8 reserved2;
+
+        /* slot index for this offload */
+        u32 slot_index;
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_host_offload_req {
+        u8 offload_Type;
+
+        /* enable or disable */
+        u8 enable;
+
+        union {
+                u8 host_ipv4_addr[4];
+                u8 host_ipv6_addr[WCN36XX_HAL_IPV6_ADDR_LEN];
+        } u;
+};
+
+struct wcn36xx_hal_host_offload_req_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_host_offload_req host_offload_params;
+        struct wcn36xx_hal_ns_offload_params ns_offload_params;
+};
+
+/* Packet Types. */
+#define WCN36XX_HAL_KEEP_ALIVE_NULL_PKT              1
+#define WCN36XX_HAL_KEEP_ALIVE_UNSOLICIT_ARP_RSP     2
+
+/* Enable or disable keep alive */
+#define WCN36XX_HAL_KEEP_ALIVE_DISABLE   0
+#define WCN36XX_HAL_KEEP_ALIVE_ENABLE    1
+#define WCN36XX_KEEP_ALIVE_TIME_PERIOD   30 /* unit: s */
+
+/* Keep Alive request. */
+struct wcn36xx_hal_keep_alive_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 packet_type;
+        u32 time_period;
+        u8 host_ipv4_addr[WCN36XX_HAL_IPV4_ADDR_LEN];
+        u8 dest_ipv4_addr[WCN36XX_HAL_IPV4_ADDR_LEN];
+        u8 dest_addr[ETH_ALEN];
+        u8 bss_index;
+} __packed;
+
+struct wcn36xx_hal_rssi_threshold_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        s8 threshold1:8;
+        s8 threshold2:8;
+        s8 threshold3:8;
+        u8 thres1_pos_notify:1;
+        u8 thres1_neg_notify:1;
+        u8 thres2_pos_notify:1;
+        u8 thres2_neg_notify:1;
+        u8 thres3_pos_notify:1;
+        u8 thres3_neg_notify:1;
+        u8 reserved10:2;
+};
+
+struct wcn36xx_hal_enter_uapsd_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 bk_delivery:1;
+        u8 be_delivery:1;
+        u8 vi_delivery:1;
+        u8 vo_delivery:1;
+        u8 bk_trigger:1;
+        u8 be_trigger:1;
+        u8 vi_trigger:1;
+        u8 vo_trigger:1;
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_exit_uapsd_req_msg {
+        struct wcn36xx_hal_msg_header header;
+        u8 bss_index;
+};
+
+#define WCN36XX_HAL_WOWL_BCAST_PATTERN_MAX_SIZE 128
+#define WCN36XX_HAL_WOWL_BCAST_MAX_NUM_PATTERNS 16
+
+struct wcn36xx_hal_wowl_add_bcast_ptrn_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Pattern ID */
+        u8 id;
+
+        /* Pattern byte offset from beginning of the 802.11 packet to start
+         * of the wake-up pattern */
+        u8 byte_Offset;
+
+        /* Non-Zero Pattern size */
+        u8 size;
+
+        /* Pattern */
+        u8 pattern[WCN36XX_HAL_WOWL_BCAST_PATTERN_MAX_SIZE];
+
+        /* Non-zero pattern mask size */
+        u8 mask_size;
+
+        /* Pattern mask */
+        u8 mask[WCN36XX_HAL_WOWL_BCAST_PATTERN_MAX_SIZE];
+
+        /* Extra pattern */
+        u8 extra[WCN36XX_HAL_WOWL_BCAST_PATTERN_MAX_SIZE];
+
+        /* Extra pattern mask */
+        u8 mask_extra[WCN36XX_HAL_WOWL_BCAST_PATTERN_MAX_SIZE];
+
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_wow_del_bcast_ptrn_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Pattern ID of the wakeup pattern to be deleted */
+        u8 id;
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_wowl_enter_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Enables/disables magic packet filtering */
+        u8 magic_packet_enable;
+
+        /* Magic pattern */
+        u8 magic_pattern[ETH_ALEN];
+
+        /* Enables/disables packet pattern filtering in firmware. Enabling
+         * this flag enables broadcast pattern matching in Firmware. If
+         * unicast pattern matching is also desired,
+         * ucUcastPatternFilteringEnable flag must be set tot true as well
+         */
+        u8 pattern_filtering_enable;
+
+        /* Enables/disables unicast packet pattern filtering. This flag
+         * specifies whether we want to do pattern match on unicast packets
+         * as well and not just broadcast packets. This flag has no effect
+         * if the ucPatternFilteringEnable (main controlling flag) is set
+         * to false
+         */
+        u8 ucast_pattern_filtering_enable;
+
+        /* This configuration is valid only when magicPktEnable=1. It
+         * requests hardware to wake up when it receives the Channel Switch
+         * Action Frame.
+         */
+        u8 wow_channel_switch_receive;
+
+        /* This configuration is valid only when magicPktEnable=1. It
+         * requests hardware to wake up when it receives the
+         * Deauthentication Frame.
+         */
+        u8 wow_deauth_receive;
+
+        /* This configuration is valid only when magicPktEnable=1. It
+         * requests hardware to wake up when it receives the Disassociation
+         * Frame.
+         */
+        u8 wow_disassoc_receive;
+
+        /* This configuration is valid only when magicPktEnable=1. It
+         * requests hardware to wake up when it has missed consecutive
+         * beacons. This is a hardware register configuration (NOT a
+         * firmware configuration).
+         */
+        u8 wow_max_missed_beacons;
+
+        /* This configuration is valid only when magicPktEnable=1. This is
+         * a timeout value in units of microsec. It requests hardware to
+         * unconditionally wake up after it has stayed in WoWLAN mode for
+         * some time. Set 0 to disable this feature.
+         */
+        u8 wow_max_sleep;
+
+        /* This configuration directs the WoW packet filtering to look for
+         * EAP-ID requests embedded in EAPOL frames and use this as a wake
+         * source.
+         */
+        u8 wow_eap_id_request_enable;
+
+        /* This configuration directs the WoW packet filtering to look for
+         * EAPOL-4WAY requests and use this as a wake source.
+         */
+        u8 wow_eapol_4way_enable;
+
+        /* This configuration allows a host wakeup on an network scan
+         * offload match.
+         */
+        u8 wow_net_scan_offload_match;
+
+        /* This configuration allows a host wakeup on any GTK rekeying
+         * error.
+         */
+        u8 wow_gtk_rekey_error;
+
+        /* This configuration allows a host wakeup on BSS connection loss.
+         */
+        u8 wow_bss_connection_loss;
+
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_wowl_exit_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_get_rssi_req_msg {
+        struct wcn36xx_hal_msg_header header;
+};
+
+struct wcn36xx_hal_get_roam_rssi_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Valid STA Idx for per STA stats request */
+        u32 sta_id;
+};
+
+struct wcn36xx_hal_set_uapsd_ac_params_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* STA index */
+        u8 sta_idx;
+
+        /* Access Category */
+        u8 ac;
+
+        /* User Priority */
+        u8 up;
+
+        /* Service Interval */
+        u32 service_interval;
+
+        /* Suspend Interval */
+        u32 suspend_interval;
+
+        /* Delay Interval */
+        u32 delay_interval;
+};
+
+struct wcn36xx_hal_configure_rxp_filter_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 set_mcst_bcst_filter_setting;
+        u8 set_mcst_bcst_filter;
+};
+
+struct wcn36xx_hal_enter_imps_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_exit_imps_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_enter_bmps_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        u8 bss_index;
+} __packed;
+
+struct wcn36xx_hal_exit_bmps_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        u8 bss_index;
+} __packed;
+
+struct wcn36xx_hal_enter_uapsd_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_exit_uapsd_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_rssi_notification_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u32 rssi_thres1_pos_cross:1;
+        u32 rssi_thres1_neg_cross:1;
+        u32 rssi_thres2_pos_cross:1;
+        u32 rssi_thres2_neg_cross:1;
+        u32 rssi_thres3_pos_cross:1;
+        u32 rssi_thres3_neg_cross:1;
+        u32 avg_rssi:8;
+        u32 reserved:18;
+
+};
+
+struct wcn36xx_hal_get_rssio_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+        s8 rssi;
+
+};
+
+struct wcn36xx_hal_get_roam_rssi_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        u8 sta_id;
+        s8 rssi;
+};
+
+struct wcn36xx_hal_wowl_enter_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_wowl_exit_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_add_bcn_filter_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_rem_bcn_filter_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_add_wowl_bcast_ptrn_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_del_wowl_bcast_ptrn_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_host_offload_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_keep_alive_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_set_rssi_thresh_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_set_uapsd_ac_params_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_configure_rxp_filter_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct set_max_tx_pwr_req {
+        struct wcn36xx_hal_msg_header header;
+
+        /* BSSID is needed to identify which session issued this request.
+         * As the request has power constraints, this should be applied
+         * only to that session */
+        u8 bssid[ETH_ALEN];
+
+        u8 self_addr[ETH_ALEN];
+
+        /* In request, power == MaxTx power to be used. */
+        u8 power;
+};
+
+struct set_max_tx_pwr_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* power == tx power used for management frames */
+        u8 power;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct set_tx_pwr_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* TX Power in milli watts */
+        u32 tx_power;
+
+        u8 bss_index;
+};
+
+struct set_tx_pwr_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct get_tx_pwr_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 sta_id;
+};
+
+struct get_tx_pwr_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        /* TX Power in milli watts */
+        u32 tx_power;
+};
+
+struct set_p2p_gonoa_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 opp_ps;
+        u32 ct_window;
+        u8 count;
+        u32 duration;
+        u32 interval;
+        u32 single_noa_duration;
+        u8 ps_selection;
+};
+
+struct set_p2p_gonoa_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_add_sta_self_req {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 self_addr[ETH_ALEN];
+        u32 status;
+} __packed;
+
+struct wcn36xx_hal_add_sta_self_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        /* Self STA Index */
+        u8 self_sta_index;
+
+        /* DPU Index (IGTK, PTK, GTK all same) */
+        u8 dpu_index;
+
+        /* DPU Signature */
+        u8 dpu_signature;
+} __packed;
+
+struct wcn36xx_hal_del_sta_self_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 self_addr[ETH_ALEN];
+} __packed;
+
+struct wcn36xx_hal_del_sta_self_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /*success or failure */
+        u32 status;
+
+        u8 self_addr[ETH_ALEN];
+} __packed;
+
+struct aggr_add_ts_req {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Station Index */
+        u16 sta_idx;
+
+        /* TSPEC handler uniquely identifying a TSPEC for a STA in a BSS.
+         * This will carry the bitmap with the bit positions representing
+         * different AC.s */
+        u16 tspec_index;
+
+        /* Tspec info per AC To program TPE with required parameters */
+        struct wcn36xx_hal_tspec_ie tspec[WCN36XX_HAL_MAX_AC];
+
+        /* U-APSD Flags: 1b per AC.  Encoded as follows:
+           b7 b6 b5 b4 b3 b2 b1 b0 =
+           X  X  X  X  BE BK VI VO */
+        u8 uapsd;
+
+        /* These parameters are for all the access categories */
+
+        /* Service Interval */
+        u32 service_interval[WCN36XX_HAL_MAX_AC];
+
+        /* Suspend Interval */
+        u32 suspend_interval[WCN36XX_HAL_MAX_AC];
+
+        /* Delay Interval */
+        u32 delay_interval[WCN36XX_HAL_MAX_AC];
+};
+
+struct aggr_add_ts_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status0;
+
+        /* FIXME PRIMA for future use for 11R */
+        u32 status1;
+};
+
+struct wcn36xx_hal_configure_apps_cpu_wakeup_state_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 is_apps_cpu_awake;
+};
+
+struct wcn36xx_hal_configure_apps_cpu_wakeup_state_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_dump_cmd_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u32 arg1;
+        u32 arg2;
+        u32 arg3;
+        u32 arg4;
+        u32 arg5;
+} __packed;
+
+struct wcn36xx_hal_dump_cmd_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        /* Length of the responce message */
+        u32 rsp_length;
+
+        /* FIXME: Currently considering the the responce will be less than
+         * 100bytes */
+        u8 rsp_buffer[DUMPCMD_RSP_BUFFER];
+} __packed;
+
+#define WLAN_COEX_IND_DATA_SIZE (4)
+#define WLAN_COEX_IND_TYPE_DISABLE_HB_MONITOR (0)
+#define WLAN_COEX_IND_TYPE_ENABLE_HB_MONITOR (1)
+
+struct coex_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Coex Indication Type */
+        u32 type;
+
+        /* Coex Indication Data */
+        u32 data[WLAN_COEX_IND_DATA_SIZE];
+};
+
+struct wcn36xx_hal_tx_compl_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Tx Complete Indication Success or Failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_wlan_host_suspend_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u32 configured_mcst_bcst_filter_setting;
+        u32 active_session_count;
+};
+
+struct wcn36xx_hal_wlan_exclude_unencrpted_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 dot11_exclude_unencrypted;
+        u8 bssid[ETH_ALEN];
+};
+
+struct noa_attr_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 index;
+        u8 opp_ps_flag;
+        u16 ctwin;
+
+        u16 noa1_interval_count;
+        u16 bss_index;
+        u32 noa1_duration;
+        u32 noa1_interval;
+        u32 noa1_starttime;
+
+        u16 noa2_interval_count;
+        u16 reserved2;
+        u32 noa2_duration;
+        u32 noa2_interval;
+        u32 noa2_start_time;
+
+        u32 status;
+};
+
+struct noa_start_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u32 status;
+        u32 bss_index;
+};
+
+struct wcn36xx_hal_wlan_host_resume_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 configured_mcst_bcst_filter_setting;
+};
+
+struct wcn36xx_hal_host_resume_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+struct wcn36xx_hal_del_ba_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u16 sta_idx;
+
+        /* Peer MAC Address, whose BA session has timed out */
+        u8 peer_addr[ETH_ALEN];
+
+        /* TID for which a BA session timeout is being triggered */
+        u8 ba_tid;
+
+        /* DELBA direction
+         * 1 - Originator
+         * 0 - Recipient
+         */
+        u8 direction;
+
+        u32 reason_code;
+
+        /* TO SUPPORT BT-AMP */
+        u8 bssid[ETH_ALEN];
+};
+
+/* PNO Messages */
+
+/* Max number of channels that a network can be found on */
+#define WCN36XX_HAL_PNO_MAX_NETW_CHANNELS  26
+
+/* Max number of channels that a network can be found on */
+#define WCN36XX_HAL_PNO_MAX_NETW_CHANNELS_EX  60
+
+/* Maximum numbers of networks supported by PNO */
+#define WCN36XX_HAL_PNO_MAX_SUPP_NETWORKS  16
+
+/* The number of scan time intervals that can be programmed into PNO */
+#define WCN36XX_HAL_PNO_MAX_SCAN_TIMERS    10
+
+/* Maximum size of the probe template */
+#define WCN36XX_HAL_PNO_MAX_PROBE_SIZE     450
+
+/* Type of PNO enabling:
+ *
+ * Immediate - scanning will start immediately and PNO procedure will be
+ * repeated based on timer
+ *
+ * Suspend - scanning will start at suspend
+ *
+ * Resume - scanning will start on system resume
+ */
+enum pno_mode {
+        PNO_MODE_IMMEDIATE,
+        PNO_MODE_ON_SUSPEND,
+        PNO_MODE_ON_RESUME,
+        PNO_MODE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+/* Authentication type */
+enum auth_type {
+        AUTH_TYPE_ANY = 0,
+        AUTH_TYPE_OPEN_SYSTEM = 1,
+
+        /* Upper layer authentication types */
+        AUTH_TYPE_WPA = 2,
+        AUTH_TYPE_WPA_PSK = 3,
+
+        AUTH_TYPE_RSN = 4,
+        AUTH_TYPE_RSN_PSK = 5,
+        AUTH_TYPE_FT_RSN = 6,
+        AUTH_TYPE_FT_RSN_PSK = 7,
+        AUTH_TYPE_WAPI_WAI_CERTIFICATE = 8,
+        AUTH_TYPE_WAPI_WAI_PSK = 9,
+
+        AUTH_TYPE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+/* Encryption type */
+enum ed_type {
+        ED_ANY = 0,
+        ED_NONE = 1,
+        ED_WEP = 2,
+        ED_TKIP = 3,
+        ED_CCMP = 4,
+        ED_WPI = 5,
+
+        ED_TYPE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+/* SSID broadcast  type */
+enum ssid_bcast_type {
+        BCAST_UNKNOWN = 0,
+        BCAST_NORMAL = 1,
+        BCAST_HIDDEN = 2,
+
+        BCAST_TYPE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE
+};
+
+/* The network description for which PNO will have to look for */
+struct network_type {
+        /* SSID of the BSS */
+        struct wcn36xx_hal_mac_ssid ssid;
+
+        /* Authentication type for the network */
+        enum auth_type authentication;
+
+        /* Encryption type for the network */
+        enum ed_type encryption;
+
+        /* Indicate the channel on which the Network can be found 0 - if
+         * all channels */
+        u8 channel_count;
+        u8 channels[WCN36XX_HAL_PNO_MAX_NETW_CHANNELS];
+
+        /* Indicates the RSSI threshold for the network to be considered */
+        u8 rssi_threshold;
+};
+
+struct scan_timer {
+        /* How much it should wait */
+        u32 value;
+
+        /* How many times it should repeat that wait value 0 - keep using
+         * this timer until PNO is disabled */
+        u32 repeat;
+
+        /* e.g: 2 3 4 0 - it will wait 2s between consecutive scans for 3
+         * times - after that it will wait 4s between consecutive scans
+         * until disabled */
+};
+
+/* The network parameters to be sent to the PNO algorithm */
+struct scan_timers_type {
+        /* set to 0 if you wish for PNO to use its default telescopic timer */
+        u8 count;
+
+        /* A set value represents the amount of time that PNO will wait
+         * between two consecutive scan procedures If the desired is for a
+         * uniform timer that fires always at the exact same interval - one
+         * single value is to be set If there is a desire for a more
+         * complex - telescopic like timer multiple values can be set -
+         * once PNO reaches the end of the array it will continue scanning
+         * at intervals presented by the last value */
+        struct scan_timer values[WCN36XX_HAL_PNO_MAX_SCAN_TIMERS];
+};
+
+/* Preferred network list request */
+struct set_pref_netw_list_req {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Enable PNO */
+        u32 enable;
+
+        /* Immediate,  On Suspend,   On Resume */
+        enum pno_mode mode;
+
+        /* Number of networks sent for PNO */
+        u32 networks_count;
+
+        /* The networks that PNO needs to look for */
+        struct network_type networks[WCN36XX_HAL_PNO_MAX_SUPP_NETWORKS];
+
+        /* The scan timers required for PNO */
+        struct scan_timers_type scan_timers;
+
+        /* Probe template for 2.4GHz band */
+        u16 band_24g_probe_size;
+        u8 band_24g_probe_template[WCN36XX_HAL_PNO_MAX_PROBE_SIZE];
+
+        /* Probe template for 5GHz band */
+        u16 band_5g_probe_size;
+        u8 band_5g_probe_template[WCN36XX_HAL_PNO_MAX_PROBE_SIZE];
+};
+
+/* The network description for which PNO will have to look for */
+struct network_type_new {
+        /* SSID of the BSS */
+        struct wcn36xx_hal_mac_ssid ssid;
+
+        /* Authentication type for the network */
+        enum auth_type authentication;
+
+        /* Encryption type for the network */
+        enum ed_type encryption;
+
+        /* SSID broadcast type, normal, hidden or unknown */
+        enum ssid_bcast_type bcast_network_type;
+
+        /* Indicate the channel on which the Network can be found 0 - if
+         * all channels */
+        u8 channel_count;
+        u8 channels[WCN36XX_HAL_PNO_MAX_NETW_CHANNELS];
+
+        /* Indicates the RSSI threshold for the network to be considered */
+        u8 rssi_threshold;
+};
+
+/* Preferred network list request new */
+struct set_pref_netw_list_req_new {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Enable PNO */
+        u32 enable;
+
+        /* Immediate,  On Suspend,   On Resume */
+        enum pno_mode mode;
+
+        /* Number of networks sent for PNO */
+        u32 networks_count;
+
+        /* The networks that PNO needs to look for */
+        struct network_type_new networks[WCN36XX_HAL_PNO_MAX_SUPP_NETWORKS];
+
+        /* The scan timers required for PNO */
+        struct scan_timers_type scan_timers;
+
+        /* Probe template for 2.4GHz band */
+        u16 band_24g_probe_size;
+        u8 band_24g_probe_template[WCN36XX_HAL_PNO_MAX_PROBE_SIZE];
+
+        /* Probe template for 5GHz band */
+        u16 band_5g_probe_size;
+        u8 band_5g_probe_template[WCN36XX_HAL_PNO_MAX_PROBE_SIZE];
+};
+
+/* Preferred network list response */
+struct set_pref_netw_list_resp {
+        struct wcn36xx_hal_msg_header header;
+
+        /* status of the request - just to indicate that PNO has
+         * acknowledged the request and will start scanning */
+        u32 status;
+};
+
+/* Preferred network found indication */
+struct pref_netw_found_ind {
+
+        struct wcn36xx_hal_msg_header header;
+
+        /* Network that was found with the highest RSSI */
+        struct wcn36xx_hal_mac_ssid ssid;
+
+        /* Indicates the RSSI */
+        u8 rssi;
+};
+
+/* RSSI Filter request */
+struct set_rssi_filter_req {
+        struct wcn36xx_hal_msg_header header;
+
+        /* RSSI Threshold */
+        u8 rssi_threshold;
+};
+
+/* Set RSSI filter resp */
+struct set_rssi_filter_resp {
+        struct wcn36xx_hal_msg_header header;
+
+        /* status of the request */
+        u32 status;
+};
+
+/* Update scan params - sent from host to PNO to be used during PNO
+ * scanningx */
+struct wcn36xx_hal_update_scan_params_req {
+
+        struct wcn36xx_hal_msg_header header;
+
+        /* Host setting for 11d */
+        u8 dot11d_enabled;
+
+        /* Lets PNO know that host has determined the regulatory domain */
+        u8 dot11d_resolved;
+
+        /* Channels on which PNO is allowed to scan */
+        u8 channel_count;
+        u8 channels[WCN36XX_HAL_PNO_MAX_NETW_CHANNELS];
+
+        /* Minimum channel time */
+        u16 active_min_ch_time;
+
+        /* Maximum channel time */
+        u16 active_max_ch_time;
+
+        /* Minimum channel time */
+        u16 passive_min_ch_time;
+
+        /* Maximum channel time */
+        u16 passive_max_ch_time;
+
+        /* Cb State */
+        enum phy_chan_bond_state state;
+} __packed;
+
+/* Update scan params - sent from host to PNO to be used during PNO
+ * scanningx */
+struct update_scan_params_req_ex {
+
+        struct wcn36xx_hal_msg_header header;
+
+        /* Host setting for 11d */
+        u8 dot11d_enabled;
+
+        /* Lets PNO know that host has determined the regulatory domain */
+        u8 dot11d_resolved;
+
+        /* Channels on which PNO is allowed to scan */
+        u8 channel_count;
+        u8 channels[WCN36XX_HAL_PNO_MAX_NETW_CHANNELS_EX];
+
+        /* Minimum channel time */
+        u16 active_min_ch_time;
+
+        /* Maximum channel time */
+        u16 active_max_ch_time;
+
+        /* Minimum channel time */
+        u16 passive_min_ch_time;
+
+        /* Maximum channel time */
+        u16 passive_max_ch_time;
+
+        /* Cb State */
+        enum phy_chan_bond_state state;
+};
+
+/* Update scan params - sent from host to PNO to be used during PNO
+ * scanningx */
+struct wcn36xx_hal_update_scan_params_resp {
+
+        struct wcn36xx_hal_msg_header header;
+
+        /* status of the request */
+        u32 status;
+} __packed;
+
+struct wcn36xx_hal_set_tx_per_tracking_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* 0: disable, 1:enable */
+        u8 tx_per_tracking_enable;
+
+        /* Check period, unit is sec. */
+        u8 tx_per_tracking_period;
+
+        /* (Fail TX packet)/(Total TX packet) ratio, the unit is 10%. */
+        u8 tx_per_tracking_ratio;
+
+        /* A watermark of check number, once the tx packet exceed this
+         * number, we do the check, default is 5 */
+        u32 tx_per_tracking_watermark;
+};
+
+struct wcn36xx_hal_set_tx_per_tracking_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+};
+
+struct tx_per_hit_ind_msg {
+        struct wcn36xx_hal_msg_header header;
+};
+
+/* Packet Filtering Definitions Begin */
+#define    WCN36XX_HAL_PROTOCOL_DATA_LEN                  8
+#define    WCN36XX_HAL_MAX_NUM_MULTICAST_ADDRESS        240
+#define    WCN36XX_HAL_MAX_NUM_FILTERS                   20
+#define    WCN36XX_HAL_MAX_CMP_PER_FILTER                10
+
+enum wcn36xx_hal_receive_packet_filter_type {
+        HAL_RCV_FILTER_TYPE_INVALID,
+        HAL_RCV_FILTER_TYPE_FILTER_PKT,
+        HAL_RCV_FILTER_TYPE_BUFFER_PKT,
+        HAL_RCV_FILTER_TYPE_MAX_ENUM_SIZE
+};
+
+enum wcn36xx_hal_rcv_pkt_flt_protocol_type {
+        HAL_FILTER_PROTO_TYPE_INVALID,
+        HAL_FILTER_PROTO_TYPE_MAC,
+        HAL_FILTER_PROTO_TYPE_ARP,
+        HAL_FILTER_PROTO_TYPE_IPV4,
+        HAL_FILTER_PROTO_TYPE_IPV6,
+        HAL_FILTER_PROTO_TYPE_UDP,
+        HAL_FILTER_PROTO_TYPE_MAX
+};
+
+enum wcn36xx_hal_rcv_pkt_flt_cmp_flag_type {
+        HAL_FILTER_CMP_TYPE_INVALID,
+        HAL_FILTER_CMP_TYPE_EQUAL,
+        HAL_FILTER_CMP_TYPE_MASK_EQUAL,
+        HAL_FILTER_CMP_TYPE_NOT_EQUAL,
+        HAL_FILTER_CMP_TYPE_MAX
+};
+
+struct wcn36xx_hal_rcv_pkt_filter_params {
+        u8 protocol_layer;
+        u8 cmp_flag;
+
+        /* Length of the data to compare */
+        u16 data_length;
+
+        /* from start of the respective frame header */
+        u8 data_offset;
+
+        /* Reserved field */
+        u8 reserved;
+
+        /* Data to compare */
+        u8 compare_data[WCN36XX_HAL_PROTOCOL_DATA_LEN];
+
+        /* Mask to be applied on the received packet data before compare */
+        u8 data_mask[WCN36XX_HAL_PROTOCOL_DATA_LEN];
+};
+
+struct wcn36xx_hal_sessionized_rcv_pkt_filter_cfg_type {
+        u8 id;
+        u8 type;
+        u8 params_count;
+        u32 coleasce_time;
+        u8 bss_index;
+        struct wcn36xx_hal_rcv_pkt_filter_params params[1];
+};
+
+struct wcn36xx_hal_set_rcv_pkt_filter_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 id;
+        u8 type;
+        u8 params_count;
+        u32 coalesce_time;
+        struct wcn36xx_hal_rcv_pkt_filter_params params[1];
+};
+
+struct wcn36xx_hal_rcv_flt_mc_addr_list_type {
+        /* from start of the respective frame header */
+        u8 data_offset;
+
+        u32 mc_addr_count;
+        u8 mc_addr[ETH_ALEN][WCN36XX_HAL_MAX_NUM_MULTICAST_ADDRESS];
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_set_pkt_filter_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_rcv_flt_pkt_match_cnt_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_rcv_flt_pkt_match_cnt {
+        u8 id;
+        u32 match_cnt;
+};
+
+struct wcn36xx_hal_rcv_flt_pkt_match_cnt_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Success or Failure */
+        u32 status;
+
+        u32 match_count;
+        struct wcn36xx_hal_rcv_flt_pkt_match_cnt
+                matches[WCN36XX_HAL_MAX_NUM_FILTERS];
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_rcv_flt_pkt_clear_param {
+        /* only valid for response message */
+        u32 status;
+        u8 id;
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_rcv_flt_pkt_clear_req_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_rcv_flt_pkt_clear_param param;
+};
+
+struct wcn36xx_hal_rcv_flt_pkt_clear_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_rcv_flt_pkt_clear_param param;
+};
+
+struct wcn36xx_hal_rcv_flt_pkt_set_mc_list_req_msg {
+        struct wcn36xx_hal_msg_header header;
+        struct wcn36xx_hal_rcv_flt_mc_addr_list_type mc_addr_list;
+};
+
+struct wcn36xx_hal_rcv_flt_pkt_set_mc_list_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+        u32 status;
+        u8 bss_index;
+};
+
+/* Packet Filtering Definitions End */
+
+struct wcn36xx_hal_set_power_params_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /*  Ignore DTIM */
+        u32 ignore_dtim;
+
+        /* DTIM Period */
+        u32 dtim_period;
+
+        /* Listen Interval */
+        u32 listen_interval;
+
+        /* Broadcast Multicast Filter  */
+        u32 bcast_mcast_filter;
+
+        /* Beacon Early Termination */
+        u32 enable_bet;
+
+        /* Beacon Early Termination Interval */
+        u32 bet_interval;
+} __packed;
+
+struct wcn36xx_hal_set_power_params_resp {
+
+        struct wcn36xx_hal_msg_header header;
+
+        /* status of the request */
+        u32 status;
+} __packed;
+
+/* Capability bitmap exchange definitions and macros starts */
+
+enum place_holder_in_cap_bitmap {
+        MCC = 0,
+        P2P = 1,
+        DOT11AC = 2,
+        SLM_SESSIONIZATION = 3,
+        DOT11AC_OPMODE = 4,
+        SAP32STA = 5,
+        TDLS = 6,
+        P2P_GO_NOA_DECOUPLE_INIT_SCAN = 7,
+        WLANACTIVE_OFFLOAD = 8,
+        BEACON_OFFLOAD = 9,
+        SCAN_OFFLOAD = 10,
+        ROAM_OFFLOAD = 11,
+        BCN_MISS_OFFLOAD = 12,
+        STA_POWERSAVE = 13,
+        STA_ADVANCED_PWRSAVE = 14,
+        AP_UAPSD = 15,
+        AP_DFS = 16,
+        BLOCKACK = 17,
+        PHY_ERR = 18,
+        BCN_FILTER = 19,
+        RTT = 20,
+        RATECTRL = 21,
+        WOW = 22,
+        MAX_FEATURE_SUPPORTED = 128,
+};
+
+struct wcn36xx_hal_feat_caps_msg {
+
+        struct wcn36xx_hal_msg_header header;
+
+        u32 feat_caps[4];
+} __packed;
+
+/* status codes to help debug rekey failures */
+enum gtk_rekey_status {
+        WCN36XX_HAL_GTK_REKEY_STATUS_SUCCESS = 0,
+
+        /* rekey detected, but not handled */
+        WCN36XX_HAL_GTK_REKEY_STATUS_NOT_HANDLED = 1,
+
+        /* MIC check error on M1 */
+        WCN36XX_HAL_GTK_REKEY_STATUS_MIC_ERROR = 2,
+
+        /* decryption error on M1  */
+        WCN36XX_HAL_GTK_REKEY_STATUS_DECRYPT_ERROR = 3,
+
+        /* M1 replay detected */
+        WCN36XX_HAL_GTK_REKEY_STATUS_REPLAY_ERROR = 4,
+
+        /* missing GTK key descriptor in M1 */
+        WCN36XX_HAL_GTK_REKEY_STATUS_MISSING_KDE = 5,
+
+        /* missing iGTK key descriptor in M1 */
+        WCN36XX_HAL_GTK_REKEY_STATUS_MISSING_IGTK_KDE = 6,
+
+        /* key installation error */
+        WCN36XX_HAL_GTK_REKEY_STATUS_INSTALL_ERROR = 7,
+
+        /* iGTK key installation error */
+        WCN36XX_HAL_GTK_REKEY_STATUS_IGTK_INSTALL_ERROR = 8,
+
+        /* GTK rekey M2 response TX error */
+        WCN36XX_HAL_GTK_REKEY_STATUS_RESP_TX_ERROR = 9,
+
+        /* non-specific general error */
+        WCN36XX_HAL_GTK_REKEY_STATUS_GEN_ERROR = 255
+};
+
+/* wake reason types */
+enum wake_reason_type {
+        WCN36XX_HAL_WAKE_REASON_NONE = 0,
+
+        /* magic packet match */
+        WCN36XX_HAL_WAKE_REASON_MAGIC_PACKET = 1,
+
+        /* host defined pattern match */
+        WCN36XX_HAL_WAKE_REASON_PATTERN_MATCH = 2,
+
+        /* EAP-ID frame detected */
+        WCN36XX_HAL_WAKE_REASON_EAPID_PACKET = 3,
+
+        /* start of EAPOL 4-way handshake detected */
+        WCN36XX_HAL_WAKE_REASON_EAPOL4WAY_PACKET = 4,
+
+        /* network scan offload match */
+        WCN36XX_HAL_WAKE_REASON_NETSCAN_OFFL_MATCH = 5,
+
+        /* GTK rekey status wakeup (see status) */
+        WCN36XX_HAL_WAKE_REASON_GTK_REKEY_STATUS = 6,
+
+        /* BSS connection lost */
+        WCN36XX_HAL_WAKE_REASON_BSS_CONN_LOST = 7,
+};
+
+/*
+  Wake Packet which is saved at tWakeReasonParams.DataStart
+  This data is sent for any wake reasons that involve a packet-based wakeup :
+
+  WCN36XX_HAL_WAKE_REASON_TYPE_MAGIC_PACKET
+  WCN36XX_HAL_WAKE_REASON_TYPE_PATTERN_MATCH
+  WCN36XX_HAL_WAKE_REASON_TYPE_EAPID_PACKET
+  WCN36XX_HAL_WAKE_REASON_TYPE_EAPOL4WAY_PACKET
+  WCN36XX_HAL_WAKE_REASON_TYPE_GTK_REKEY_STATUS
+
+  The information is provided to the host for auditing and debug purposes
+
+*/
+
+/* Wake reason indication */
+struct wcn36xx_hal_wake_reason_ind {
+        struct wcn36xx_hal_msg_header header;
+
+        /* see tWakeReasonType */
+        u32 reason;
+
+        /* argument specific to the reason type */
+        u32 reason_arg;
+
+        /* length of optional data stored in this message, in case HAL
+         * truncates the data (i.e. data packets) this length will be less
+         * than the actual length */
+        u32 stored_data_len;
+
+        /* actual length of data */
+        u32 actual_data_len;
+
+        /* variable length start of data (length == storedDataLen) see
+         * specific wake type */
+        u8 data_start[1];
+
+        u32 bss_index:8;
+        u32 reserved:24;
+};
+
+#define WCN36XX_HAL_GTK_KEK_BYTES 16
+#define WCN36XX_HAL_GTK_KCK_BYTES 16
+
+#define WCN36XX_HAL_GTK_OFFLOAD_FLAGS_DISABLE (1 << 0)
+
+#define GTK_SET_BSS_KEY_TAG  0x1234AA55
+
+struct wcn36xx_hal_gtk_offload_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* optional flags */
+        u32 flags;
+
+        /* Key confirmation key */
+        u8 kck[WCN36XX_HAL_GTK_KCK_BYTES];
+
+        /* key encryption key */
+        u8 kek[WCN36XX_HAL_GTK_KEK_BYTES];
+
+        /* replay counter */
+        u64 key_replay_counter;
+
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_gtk_offload_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_gtk_offload_get_info_req_msg {
+        struct wcn36xx_hal_msg_header header;
+        u8 bss_index;
+};
+
+struct wcn36xx_hal_gtk_offload_get_info_rsp_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+
+        /* last rekey status when the rekey was offloaded */
+        u32 last_rekey_status;
+
+        /* current replay counter value */
+        u64 key_replay_counter;
+
+        /* total rekey attempts */
+        u32 total_rekey_count;
+
+        /* successful GTK rekeys */
+        u32 gtk_rekey_count;
+
+        /* successful iGTK rekeys */
+        u32 igtk_rekey_count;
+
+        u8 bss_index;
+};
+
+struct dhcp_info {
+        /* Indicates the device mode which indicates about the DHCP activity */
+        u8 device_mode;
+
+        u8 addr[ETH_ALEN];
+};
+
+struct dhcp_ind_status {
+        struct wcn36xx_hal_msg_header header;
+
+        /* success or failure */
+        u32 status;
+};
+
+/*
+ *   Thermal Mitigation mode of operation.
+ *
+ *  WCN36XX_HAL_THERMAL_MITIGATION_MODE_0 - Based on AMPDU disabling aggregation
+ *
+ *  WCN36XX_HAL_THERMAL_MITIGATION_MODE_1 - Based on AMPDU disabling aggregation
+ *  and reducing transmit power
+ *
+ *  WCN36XX_HAL_THERMAL_MITIGATION_MODE_2 - Not supported */
+enum wcn36xx_hal_thermal_mitigation_mode_type {
+        HAL_THERMAL_MITIGATION_MODE_INVALID = -1,
+        HAL_THERMAL_MITIGATION_MODE_0,
+        HAL_THERMAL_MITIGATION_MODE_1,
+        HAL_THERMAL_MITIGATION_MODE_2,
+        HAL_THERMAL_MITIGATION_MODE_MAX = WCN36XX_HAL_MAX_ENUM_SIZE,
+};
+
+
+/*
+ *   Thermal Mitigation level.
+ * Note the levels are incremental i.e WCN36XX_HAL_THERMAL_MITIGATION_LEVEL_2 =
+ * WCN36XX_HAL_THERMAL_MITIGATION_LEVEL_0 +
+ * WCN36XX_HAL_THERMAL_MITIGATION_LEVEL_1
+ *
+ * WCN36XX_HAL_THERMAL_MITIGATION_LEVEL_0 - lowest level of thermal mitigation.
+ * This level indicates normal mode of operation
+ *
+ * WCN36XX_HAL_THERMAL_MITIGATION_LEVEL_1 - 1st level of thermal mitigation
+ *
+ * WCN36XX_HAL_THERMAL_MITIGATION_LEVEL_2 - 2nd level of thermal mitigation
+ *
+ * WCN36XX_HAL_THERMAL_MITIGATION_LEVEL_3 - 3rd level of thermal mitigation
+ *
+ * WCN36XX_HAL_THERMAL_MITIGATION_LEVEL_4 - 4th level of thermal mitigation
+ */
+enum wcn36xx_hal_thermal_mitigation_level_type {
+        HAL_THERMAL_MITIGATION_LEVEL_INVALID = -1,
+        HAL_THERMAL_MITIGATION_LEVEL_0,
+        HAL_THERMAL_MITIGATION_LEVEL_1,
+        HAL_THERMAL_MITIGATION_LEVEL_2,
+        HAL_THERMAL_MITIGATION_LEVEL_3,
+        HAL_THERMAL_MITIGATION_LEVEL_4,
+        HAL_THERMAL_MITIGATION_LEVEL_MAX = WCN36XX_HAL_MAX_ENUM_SIZE,
+};
+
+
+/* WCN36XX_HAL_SET_THERMAL_MITIGATION_REQ */
+struct set_thermal_mitigation_req_msg {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Thermal Mitigation Operation Mode */
+        enum wcn36xx_hal_thermal_mitigation_mode_type mode;
+
+        /* Thermal Mitigation Level */
+        enum wcn36xx_hal_thermal_mitigation_level_type level;
+};
+
+struct set_thermal_mitigation_resp {
+
+        struct wcn36xx_hal_msg_header header;
+
+        /* status of the request */
+        u32 status;
+};
+
+/* Per STA Class B Statistics. Class B statistics are STA TX/RX stats
+ * provided to FW from Host via periodic messages */
+struct stats_class_b_ind {
+        struct wcn36xx_hal_msg_header header;
+
+        /* Duration over which this stats was collected */
+        u32 duration;
+
+        /* Per STA Stats */
+
+        /* TX stats */
+        u32 tx_bytes_pushed;
+        u32 tx_packets_pushed;
+
+        /* RX stats */
+        u32 rx_bytes_rcvd;
+        u32 rx_packets_rcvd;
+        u32 rx_time_total;
+};
+
+#endif /* _HAL_H_ */
diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
new file mode 100644
index 000000000000..7839b31e4826
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -0,0 +1,1036 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include "wcn36xx.h"
+
+unsigned int wcn36xx_dbg_mask;
+module_param_named(debug_mask, wcn36xx_dbg_mask, uint, 0644);
+MODULE_PARM_DESC(debug_mask, "Debugging mask");
+
+#define CHAN2G(_freq, _idx) { \
+        .band = IEEE80211_BAND_2GHZ, \
+        .center_freq = (_freq), \
+        .hw_value = (_idx), \
+        .max_power = 25, \
+}
+
+#define CHAN5G(_freq, _idx) { \
+        .band = IEEE80211_BAND_5GHZ, \
+        .center_freq = (_freq), \
+        .hw_value = (_idx), \
+        .max_power = 25, \
+}
+
+/* The wcn firmware expects channel values to matching
+ * their mnemonic values. So use these for .hw_value. */
+static struct ieee80211_channel wcn_2ghz_channels[] = {
+        CHAN2G(2412, 1), /* Channel 1 */
+        CHAN2G(2417, 2), /* Channel 2 */
+        CHAN2G(2422, 3), /* Channel 3 */
+        CHAN2G(2427, 4), /* Channel 4 */
+        CHAN2G(2432, 5), /* Channel 5 */
+        CHAN2G(2437, 6), /* Channel 6 */
+        CHAN2G(2442, 7), /* Channel 7 */
+        CHAN2G(2447, 8), /* Channel 8 */
+        CHAN2G(2452, 9), /* Channel 9 */
+        CHAN2G(2457, 10), /* Channel 10 */
+        CHAN2G(2462, 11), /* Channel 11 */
+        CHAN2G(2467, 12), /* Channel 12 */
+        CHAN2G(2472, 13), /* Channel 13 */
+        CHAN2G(2484, 14)  /* Channel 14 */
+
+};
+
+static struct ieee80211_channel wcn_5ghz_channels[] = {
+        CHAN5G(5180, 36),
+        CHAN5G(5200, 40),
+        CHAN5G(5220, 44),
+        CHAN5G(5240, 48),
+        CHAN5G(5260, 52),
+        CHAN5G(5280, 56),
+        CHAN5G(5300, 60),
+        CHAN5G(5320, 64),
+        CHAN5G(5500, 100),
+        CHAN5G(5520, 104),
+        CHAN5G(5540, 108),
+        CHAN5G(5560, 112),
+        CHAN5G(5580, 116),
+        CHAN5G(5600, 120),
+        CHAN5G(5620, 124),
+        CHAN5G(5640, 128),
+        CHAN5G(5660, 132),
+        CHAN5G(5700, 140),
+        CHAN5G(5745, 149),
+        CHAN5G(5765, 153),
+        CHAN5G(5785, 157),
+        CHAN5G(5805, 161),
+        CHAN5G(5825, 165)
+};
+
+#define RATE(_bitrate, _hw_rate, _flags) { \
+        .bitrate        = (_bitrate),                   \
+        .flags          = (_flags),                     \
+        .hw_value       = (_hw_rate),                   \
+        .hw_value_short = (_hw_rate)  \
+}
+
+static struct ieee80211_rate wcn_2ghz_rates[] = {
+        RATE(10, HW_RATE_INDEX_1MBPS, 0),
+        RATE(20, HW_RATE_INDEX_2MBPS, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATE(55, HW_RATE_INDEX_5_5MBPS, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATE(110, HW_RATE_INDEX_11MBPS, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATE(60, HW_RATE_INDEX_6MBPS, 0),
+        RATE(90, HW_RATE_INDEX_9MBPS, 0),
+        RATE(120, HW_RATE_INDEX_12MBPS, 0),
+        RATE(180, HW_RATE_INDEX_18MBPS, 0),
+        RATE(240, HW_RATE_INDEX_24MBPS, 0),
+        RATE(360, HW_RATE_INDEX_36MBPS, 0),
+        RATE(480, HW_RATE_INDEX_48MBPS, 0),
+        RATE(540, HW_RATE_INDEX_54MBPS, 0)
+};
+
+static struct ieee80211_rate wcn_5ghz_rates[] = {
+        RATE(60, HW_RATE_INDEX_6MBPS, 0),
+        RATE(90, HW_RATE_INDEX_9MBPS, 0),
+        RATE(120, HW_RATE_INDEX_12MBPS, 0),
+        RATE(180, HW_RATE_INDEX_18MBPS, 0),
+        RATE(240, HW_RATE_INDEX_24MBPS, 0),
+        RATE(360, HW_RATE_INDEX_36MBPS, 0),
+        RATE(480, HW_RATE_INDEX_48MBPS, 0),
+        RATE(540, HW_RATE_INDEX_54MBPS, 0)
+};
+
+static struct ieee80211_supported_band wcn_band_2ghz = {
+        .channels       = wcn_2ghz_channels,
+        .n_channels     = ARRAY_SIZE(wcn_2ghz_channels),
+        .bitrates       = wcn_2ghz_rates,
+        .n_bitrates     = ARRAY_SIZE(wcn_2ghz_rates),
+        .ht_cap         = {
+                .cap =  IEEE80211_HT_CAP_GRN_FLD |
+                        IEEE80211_HT_CAP_SGI_20 |
+                        IEEE80211_HT_CAP_DSSSCCK40 |
+                        IEEE80211_HT_CAP_LSIG_TXOP_PROT,
+                .ht_supported = true,
+                .ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K,
+                .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16,
+                .mcs = {
+                        .rx_mask = { 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+                        .rx_highest = cpu_to_le16(72),
+                        .tx_params = IEEE80211_HT_MCS_TX_DEFINED,
+                }
+        }
+};
+
+static struct ieee80211_supported_band wcn_band_5ghz = {
+        .channels       = wcn_5ghz_channels,
+        .n_channels     = ARRAY_SIZE(wcn_5ghz_channels),
+        .bitrates       = wcn_5ghz_rates,
+        .n_bitrates     = ARRAY_SIZE(wcn_5ghz_rates),
+        .ht_cap         = {
+                .cap =  IEEE80211_HT_CAP_GRN_FLD |
+                        IEEE80211_HT_CAP_SGI_20 |
+                        IEEE80211_HT_CAP_DSSSCCK40 |
+                        IEEE80211_HT_CAP_LSIG_TXOP_PROT |
+                        IEEE80211_HT_CAP_SGI_40 |
+                        IEEE80211_HT_CAP_SUP_WIDTH_20_40,
+                .ht_supported = true,
+                .ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K,
+                .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16,
+                .mcs = {
+                        .rx_mask = { 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+                        .rx_highest = cpu_to_le16(72),
+                        .tx_params = IEEE80211_HT_MCS_TX_DEFINED,
+                }
+        }
+};
+
+#ifdef CONFIG_PM
+
+static const struct wiphy_wowlan_support wowlan_support = {
+        .flags = WIPHY_WOWLAN_ANY
+};
+
+#endif
+
+static inline u8 get_sta_index(struct ieee80211_vif *vif,
+                               struct wcn36xx_sta *sta_priv)
+{
+        return NL80211_IFTYPE_STATION == vif->type ?
+               sta_priv->bss_sta_index :
+               sta_priv->sta_index;
+}
+
+static int wcn36xx_start(struct ieee80211_hw *hw)
+{
+        struct wcn36xx *wcn = hw->priv;
+        int ret;
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac start\n");
+
+        /* SMD initialization */
+        ret = wcn36xx_smd_open(wcn);
+        if (ret) {
+                wcn36xx_err("Failed to open smd channel: %d\n", ret);
+                goto out_err;
+        }
+
+        /* Allocate memory pools for Mgmt BD headers and Data BD headers */
+        ret = wcn36xx_dxe_allocate_mem_pools(wcn);
+        if (ret) {
+                wcn36xx_err("Failed to alloc DXE mempool: %d\n", ret);
+                goto out_smd_close;
+        }
+
+        ret = wcn36xx_dxe_alloc_ctl_blks(wcn);
+        if (ret) {
+                wcn36xx_err("Failed to alloc DXE ctl blocks: %d\n", ret);
+                goto out_free_dxe_pool;
+        }
+
+        wcn->hal_buf = kmalloc(WCN36XX_HAL_BUF_SIZE, GFP_KERNEL);
+        if (!wcn->hal_buf) {
+                wcn36xx_err("Failed to allocate smd buf\n");
+                ret = -ENOMEM;
+                goto out_free_dxe_ctl;
+        }
+
+        ret = wcn36xx_smd_load_nv(wcn);
+        if (ret) {
+                wcn36xx_err("Failed to push NV to chip\n");
+                goto out_free_smd_buf;
+        }
+
+        ret = wcn36xx_smd_start(wcn);
+        if (ret) {
+                wcn36xx_err("Failed to start chip\n");
+                goto out_free_smd_buf;
+        }
+
+        /* DMA channel initialization */
+        ret = wcn36xx_dxe_init(wcn);
+        if (ret) {
+                wcn36xx_err("DXE init failed\n");
+                goto out_smd_stop;
+        }
+
+        wcn36xx_debugfs_init(wcn);
+
+        if (!wcn36xx_is_fw_version(wcn, 1, 2, 2, 24)) {
+                ret = wcn36xx_smd_feature_caps_exchange(wcn);
+                if (ret)
+                        wcn36xx_warn("Exchange feature caps failed\n");
+        }
+        INIT_LIST_HEAD(&wcn->vif_list);
+        return 0;
+
+out_smd_stop:
+        wcn36xx_smd_stop(wcn);
+out_free_smd_buf:
+        kfree(wcn->hal_buf);
+out_free_dxe_pool:
+        wcn36xx_dxe_free_mem_pools(wcn);
+out_free_dxe_ctl:
+        wcn36xx_dxe_free_ctl_blks(wcn);
+out_smd_close:
+        wcn36xx_smd_close(wcn);
+out_err:
+        return ret;
+}
+
+static void wcn36xx_stop(struct ieee80211_hw *hw)
+{
+        struct wcn36xx *wcn = hw->priv;
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac stop\n");
+
+        wcn36xx_debugfs_exit(wcn);
+        wcn36xx_smd_stop(wcn);
+        wcn36xx_dxe_deinit(wcn);
+        wcn36xx_smd_close(wcn);
+
+        wcn36xx_dxe_free_mem_pools(wcn);
+        wcn36xx_dxe_free_ctl_blks(wcn);
+
+        kfree(wcn->hal_buf);
+}
+
+static int wcn36xx_config(struct ieee80211_hw *hw, u32 changed)
+{
+        struct wcn36xx *wcn = hw->priv;
+        struct ieee80211_vif *vif = NULL;
+        struct wcn36xx_vif *tmp;
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac config changed 0x%08x\n", changed);
+
+        if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
+                int ch = WCN36XX_HW_CHANNEL(wcn);
+                wcn36xx_dbg(WCN36XX_DBG_MAC, "wcn36xx_config channel switch=%d\n",
+                            ch);
+                list_for_each_entry(tmp, &wcn->vif_list, list) {
+                        vif = container_of((void *)tmp,
+                                           struct ieee80211_vif,
+                                           drv_priv);
+                        wcn36xx_smd_switch_channel(wcn, vif, ch);
+                }
+        }
+
+        return 0;
+}
+
+#define WCN36XX_SUPPORTED_FILTERS (0)
+
+static void wcn36xx_configure_filter(struct ieee80211_hw *hw,
+                                     unsigned int changed,
+                                     unsigned int *total, u64 multicast)
+{
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac configure filter\n");
+
+        *total &= WCN36XX_SUPPORTED_FILTERS;
+}
+
+static void wcn36xx_tx(struct ieee80211_hw *hw,
+                       struct ieee80211_tx_control *control,
+                       struct sk_buff *skb)
+{
+        struct wcn36xx *wcn = hw->priv;
+        struct wcn36xx_sta *sta_priv = NULL;
+
+        if (control->sta)
+                sta_priv = (struct wcn36xx_sta *)control->sta->drv_priv;
+
+        if (wcn36xx_start_tx(wcn, sta_priv, skb))
+                ieee80211_free_txskb(wcn->hw, skb);
+}
+
+static int wcn36xx_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+                           struct ieee80211_vif *vif,
+                           struct ieee80211_sta *sta,
+                           struct ieee80211_key_conf *key_conf)
+{
+        struct wcn36xx *wcn = hw->priv;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+        struct wcn36xx_sta *sta_priv = vif_priv->sta;
+        int ret = 0;
+        u8 key[WLAN_MAX_KEY_LEN];
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac80211 set key\n");
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "Key: cmd=0x%x algo:0x%x, id:%d, len:%d flags 0x%x\n",
+                    cmd, key_conf->cipher, key_conf->keyidx,
+                    key_conf->keylen, key_conf->flags);
+        wcn36xx_dbg_dump(WCN36XX_DBG_MAC, "KEY: ",
+                         key_conf->key,
+                         key_conf->keylen);
+
+        switch (key_conf->cipher) {
+        case WLAN_CIPHER_SUITE_WEP40:
+                vif_priv->encrypt_type = WCN36XX_HAL_ED_WEP40;
+                break;
+        case WLAN_CIPHER_SUITE_WEP104:
+                vif_priv->encrypt_type = WCN36XX_HAL_ED_WEP40;
+                break;
+        case WLAN_CIPHER_SUITE_CCMP:
+                vif_priv->encrypt_type = WCN36XX_HAL_ED_CCMP;
+                break;
+        case WLAN_CIPHER_SUITE_TKIP:
+                vif_priv->encrypt_type = WCN36XX_HAL_ED_TKIP;
+                break;
+        default:
+                wcn36xx_err("Unsupported key type 0x%x\n",
+                              key_conf->cipher);
+                ret = -EOPNOTSUPP;
+                goto out;
+        }
+
+        switch (cmd) {
+        case SET_KEY:
+                if (WCN36XX_HAL_ED_TKIP == vif_priv->encrypt_type) {
+                        /*
+                         * Supplicant is sending key in the wrong order:
+                         * Temporal Key (16 b) - TX MIC (8 b) - RX MIC (8 b)
+                         * but HW expects it to be in the order as described in
+                         * IEEE 802.11 spec (see chapter 11.7) like this:
+                         * Temporal Key (16 b) - RX MIC (8 b) - TX MIC (8 b)
+                         */
+                        memcpy(key, key_conf->key, 16);
+                        memcpy(key + 16, key_conf->key + 24, 8);
+                        memcpy(key + 24, key_conf->key + 16, 8);
+                } else {
+                        memcpy(key, key_conf->key, key_conf->keylen);
+                }
+
+                if (IEEE80211_KEY_FLAG_PAIRWISE & key_conf->flags) {
+                        sta_priv->is_data_encrypted = true;
+                        /* Reconfigure bss with encrypt_type */
+                        if (NL80211_IFTYPE_STATION == vif->type)
+                                wcn36xx_smd_config_bss(wcn,
+                                                       vif,
+                                                       sta,
+                                                       sta->addr,
+                                                       true);
+
+                        wcn36xx_smd_set_stakey(wcn,
+                                vif_priv->encrypt_type,
+                                key_conf->keyidx,
+                                key_conf->keylen,
+                                key,
+                                get_sta_index(vif, sta_priv));
+                } else {
+                        wcn36xx_smd_set_bsskey(wcn,
+                                vif_priv->encrypt_type,
+                                key_conf->keyidx,
+                                key_conf->keylen,
+                                key);
+                        if ((WLAN_CIPHER_SUITE_WEP40 == key_conf->cipher) ||
+                            (WLAN_CIPHER_SUITE_WEP104 == key_conf->cipher)) {
+                                sta_priv->is_data_encrypted = true;
+                                wcn36xx_smd_set_stakey(wcn,
+                                        vif_priv->encrypt_type,
+                                        key_conf->keyidx,
+                                        key_conf->keylen,
+                                        key,
+                                        get_sta_index(vif, sta_priv));
+                        }
+                }
+                break;
+        case DISABLE_KEY:
+                if (!(IEEE80211_KEY_FLAG_PAIRWISE & key_conf->flags)) {
+                        wcn36xx_smd_remove_bsskey(wcn,
+                                vif_priv->encrypt_type,
+                                key_conf->keyidx);
+                } else {
+                        sta_priv->is_data_encrypted = false;
+                        /* do not remove key if disassociated */
+                        if (sta_priv->aid)
+                                wcn36xx_smd_remove_stakey(wcn,
+                                        vif_priv->encrypt_type,
+                                        key_conf->keyidx,
+                                        get_sta_index(vif, sta_priv));
+                }
+                break;
+        default:
+                wcn36xx_err("Unsupported key cmd 0x%x\n", cmd);
+                ret = -EOPNOTSUPP;
+                goto out;
+                break;
+        }
+
+out:
+        return ret;
+}
+
+static void wcn36xx_sw_scan_start(struct ieee80211_hw *hw)
+{
+        struct wcn36xx *wcn = hw->priv;
+
+        wcn36xx_smd_init_scan(wcn, HAL_SYS_MODE_SCAN);
+        wcn36xx_smd_start_scan(wcn);
+}
+
+static void wcn36xx_sw_scan_complete(struct ieee80211_hw *hw)
+{
+        struct wcn36xx *wcn = hw->priv;
+
+        wcn36xx_smd_end_scan(wcn);
+        wcn36xx_smd_finish_scan(wcn, HAL_SYS_MODE_SCAN);
+}
+
+static void wcn36xx_update_allowed_rates(struct ieee80211_sta *sta,
+                                         enum ieee80211_band band)
+{
+        int i, size;
+        u16 *rates_table;
+        struct wcn36xx_sta *sta_priv = (struct wcn36xx_sta *)sta->drv_priv;
+        u32 rates = sta->supp_rates[band];
+
+        memset(&sta_priv->supported_rates, 0,
+                sizeof(sta_priv->supported_rates));
+        sta_priv->supported_rates.op_rate_mode = STA_11n;
+
+        size = ARRAY_SIZE(sta_priv->supported_rates.dsss_rates);
+        rates_table = sta_priv->supported_rates.dsss_rates;
+        if (band == IEEE80211_BAND_2GHZ) {
+                for (i = 0; i < size; i++) {
+                        if (rates & 0x01) {
+                                rates_table[i] = wcn_2ghz_rates[i].hw_value;
+                                rates = rates >> 1;
+                        }
+                }
+        }
+
+        size = ARRAY_SIZE(sta_priv->supported_rates.ofdm_rates);
+        rates_table = sta_priv->supported_rates.ofdm_rates;
+        for (i = 0; i < size; i++) {
+                if (rates & 0x01) {
+                        rates_table[i] = wcn_5ghz_rates[i].hw_value;
+                        rates = rates >> 1;
+                }
+        }
+
+        if (sta->ht_cap.ht_supported) {
+                BUILD_BUG_ON(sizeof(sta->ht_cap.mcs.rx_mask) >
+                        sizeof(sta_priv->supported_rates.supported_mcs_set));
+                memcpy(sta_priv->supported_rates.supported_mcs_set,
+                       sta->ht_cap.mcs.rx_mask,
+                       sizeof(sta->ht_cap.mcs.rx_mask));
+        }
+}
+void wcn36xx_set_default_rates(struct wcn36xx_hal_supported_rates *rates)
+{
+        u16 ofdm_rates[WCN36XX_HAL_NUM_OFDM_RATES] = {
+                HW_RATE_INDEX_6MBPS,
+                HW_RATE_INDEX_9MBPS,
+                HW_RATE_INDEX_12MBPS,
+                HW_RATE_INDEX_18MBPS,
+                HW_RATE_INDEX_24MBPS,
+                HW_RATE_INDEX_36MBPS,
+                HW_RATE_INDEX_48MBPS,
+                HW_RATE_INDEX_54MBPS
+        };
+        u16 dsss_rates[WCN36XX_HAL_NUM_DSSS_RATES] = {
+                HW_RATE_INDEX_1MBPS,
+                HW_RATE_INDEX_2MBPS,
+                HW_RATE_INDEX_5_5MBPS,
+                HW_RATE_INDEX_11MBPS
+        };
+
+        rates->op_rate_mode = STA_11n;
+        memcpy(rates->dsss_rates, dsss_rates,
+                sizeof(*dsss_rates) * WCN36XX_HAL_NUM_DSSS_RATES);
+        memcpy(rates->ofdm_rates, ofdm_rates,
+                sizeof(*ofdm_rates) * WCN36XX_HAL_NUM_OFDM_RATES);
+        rates->supported_mcs_set[0] = 0xFF;
+}
+static void wcn36xx_bss_info_changed(struct ieee80211_hw *hw,
+                                     struct ieee80211_vif *vif,
+                                     struct ieee80211_bss_conf *bss_conf,
+                                     u32 changed)
+{
+        struct wcn36xx *wcn = hw->priv;
+        struct sk_buff *skb = NULL;
+        u16 tim_off, tim_len;
+        enum wcn36xx_hal_link_state link_state;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac bss info changed vif %p changed 0x%08x\n",
+                    vif, changed);
+
+        if (changed & BSS_CHANGED_BEACON_INFO) {
+                wcn36xx_dbg(WCN36XX_DBG_MAC,
+                            "mac bss changed dtim period %d\n",
+                            bss_conf->dtim_period);
+
+                vif_priv->dtim_period = bss_conf->dtim_period;
+        }
+
+        if (changed & BSS_CHANGED_PS) {
+                wcn36xx_dbg(WCN36XX_DBG_MAC,
+                            "mac bss PS set %d\n",
+                            bss_conf->ps);
+                if (bss_conf->ps) {
+                        wcn36xx_pmc_enter_bmps_state(wcn, vif);
+                } else {
+                        wcn36xx_pmc_exit_bmps_state(wcn, vif);
+                }
+        }
+
+        if (changed & BSS_CHANGED_BSSID) {
+                wcn36xx_dbg(WCN36XX_DBG_MAC, "mac bss changed_bssid %pM\n",
+                            bss_conf->bssid);
+
+                if (!is_zero_ether_addr(bss_conf->bssid)) {
+                        vif_priv->is_joining = true;
+                        vif_priv->bss_index = 0xff;
+                        wcn36xx_smd_join(wcn, bss_conf->bssid,
+                                         vif->addr, WCN36XX_HW_CHANNEL(wcn));
+                        wcn36xx_smd_config_bss(wcn, vif, NULL,
+                                               bss_conf->bssid, false);
+                } else {
+                        vif_priv->is_joining = false;
+                        wcn36xx_smd_delete_bss(wcn, vif);
+                }
+        }
+
+        if (changed & BSS_CHANGED_SSID) {
+                wcn36xx_dbg(WCN36XX_DBG_MAC,
+                            "mac bss changed ssid\n");
+                wcn36xx_dbg_dump(WCN36XX_DBG_MAC, "ssid ",
+                                 bss_conf->ssid, bss_conf->ssid_len);
+
+                vif_priv->ssid.length = bss_conf->ssid_len;
+                memcpy(&vif_priv->ssid.ssid,
+                       bss_conf->ssid,
+                       bss_conf->ssid_len);
+        }
+
+        if (changed & BSS_CHANGED_ASSOC) {
+                vif_priv->is_joining = false;
+                if (bss_conf->assoc) {
+                        struct ieee80211_sta *sta;
+                        struct wcn36xx_sta *sta_priv;
+
+                        wcn36xx_dbg(WCN36XX_DBG_MAC,
+                                    "mac assoc bss %pM vif %pM AID=%d\n",
+                                     bss_conf->bssid,
+                                     vif->addr,
+                                     bss_conf->aid);
+
+                        rcu_read_lock();
+                        sta = ieee80211_find_sta(vif, bss_conf->bssid);
+                        if (!sta) {
+                                wcn36xx_err("sta %pM is not found\n",
+                                              bss_conf->bssid);
+                                rcu_read_unlock();
+                                goto out;
+                        }
+                        sta_priv = (struct wcn36xx_sta *)sta->drv_priv;
+
+                        wcn36xx_update_allowed_rates(sta, WCN36XX_BAND(wcn));
+
+                        wcn36xx_smd_set_link_st(wcn, bss_conf->bssid,
+                                vif->addr,
+                                WCN36XX_HAL_LINK_POSTASSOC_STATE);
+                        wcn36xx_smd_config_bss(wcn, vif, sta,
+                                               bss_conf->bssid,
+                                               true);
+                        sta_priv->aid = bss_conf->aid;
+                        /*
+                         * config_sta must be called from  because this is the
+                         * place where AID is available.
+                         */
+                        wcn36xx_smd_config_sta(wcn, vif, sta);
+                        rcu_read_unlock();
+                } else {
+                        wcn36xx_dbg(WCN36XX_DBG_MAC,
+                                    "disassociated bss %pM vif %pM AID=%d\n",
+                                    bss_conf->bssid,
+                                    vif->addr,
+                                    bss_conf->aid);
+                        wcn36xx_smd_set_link_st(wcn,
+                                                bss_conf->bssid,
+                                                vif->addr,
+                                                WCN36XX_HAL_LINK_IDLE_STATE);
+                }
+        }
+
+        if (changed & BSS_CHANGED_AP_PROBE_RESP) {
+                wcn36xx_dbg(WCN36XX_DBG_MAC, "mac bss changed ap probe resp\n");
+                skb = ieee80211_proberesp_get(hw, vif);
+                if (!skb) {
+                        wcn36xx_err("failed to alloc probereq skb\n");
+                        goto out;
+                }
+
+                wcn36xx_smd_update_proberesp_tmpl(wcn, vif, skb);
+                dev_kfree_skb(skb);
+        }
+
+        if (changed & BSS_CHANGED_BEACON_ENABLED) {
+                wcn36xx_dbg(WCN36XX_DBG_MAC,
+                            "mac bss changed beacon enabled %d\n",
+                            bss_conf->enable_beacon);
+
+                if (bss_conf->enable_beacon) {
+                        vif_priv->bss_index = 0xff;
+                        wcn36xx_smd_config_bss(wcn, vif, NULL,
+                                               vif->addr, false);
+                        skb = ieee80211_beacon_get_tim(hw, vif, &tim_off,
+                                                       &tim_len);
+                        if (!skb) {
+                                wcn36xx_err("failed to alloc beacon skb\n");
+                                goto out;
+                        }
+                        wcn36xx_smd_send_beacon(wcn, vif, skb, tim_off, 0);
+                        dev_kfree_skb(skb);
+
+                        if (vif->type == NL80211_IFTYPE_ADHOC ||
+                            vif->type == NL80211_IFTYPE_MESH_POINT)
+                                link_state = WCN36XX_HAL_LINK_IBSS_STATE;
+                        else
+                                link_state = WCN36XX_HAL_LINK_AP_STATE;
+
+                        wcn36xx_smd_set_link_st(wcn, vif->addr, vif->addr,
+                                                link_state);
+                } else {
+                        wcn36xx_smd_set_link_st(wcn, vif->addr, vif->addr,
+                                                WCN36XX_HAL_LINK_IDLE_STATE);
+                        wcn36xx_smd_delete_bss(wcn, vif);
+                }
+        }
+out:
+        return;
+}
+
+/* this is required when using IEEE80211_HW_HAS_RATE_CONTROL */
+static int wcn36xx_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
+{
+        struct wcn36xx *wcn = hw->priv;
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac set RTS threshold %d\n", value);
+
+        wcn36xx_smd_update_cfg(wcn, WCN36XX_HAL_CFG_RTS_THRESHOLD, value);
+        return 0;
+}
+
+static void wcn36xx_remove_interface(struct ieee80211_hw *hw,
+                                     struct ieee80211_vif *vif)
+{
+        struct wcn36xx *wcn = hw->priv;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac remove interface vif %p\n", vif);
+
+        list_del(&vif_priv->list);
+        wcn36xx_smd_delete_sta_self(wcn, vif->addr);
+}
+
+static int wcn36xx_add_interface(struct ieee80211_hw *hw,
+                                 struct ieee80211_vif *vif)
+{
+        struct wcn36xx *wcn = hw->priv;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac add interface vif %p type %d\n",
+                    vif, vif->type);
+
+        if (!(NL80211_IFTYPE_STATION == vif->type ||
+              NL80211_IFTYPE_AP == vif->type ||
+              NL80211_IFTYPE_ADHOC == vif->type ||
+              NL80211_IFTYPE_MESH_POINT == vif->type)) {
+                wcn36xx_warn("Unsupported interface type requested: %d\n",
+                             vif->type);
+                return -EOPNOTSUPP;
+        }
+
+        list_add(&vif_priv->list, &wcn->vif_list);
+        wcn36xx_smd_add_sta_self(wcn, vif);
+
+        return 0;
+}
+
+static int wcn36xx_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                           struct ieee80211_sta *sta)
+{
+        struct wcn36xx *wcn = hw->priv;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+        struct wcn36xx_sta *sta_priv = (struct wcn36xx_sta *)sta->drv_priv;
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac sta add vif %p sta %pM\n",
+                    vif, sta->addr);
+
+        vif_priv->sta = sta_priv;
+        sta_priv->vif = vif_priv;
+        /*
+         * For STA mode HW will be configured on BSS_CHANGED_ASSOC because
+         * at this stage AID is not available yet.
+         */
+        if (NL80211_IFTYPE_STATION != vif->type) {
+                wcn36xx_update_allowed_rates(sta, WCN36XX_BAND(wcn));
+                sta_priv->aid = sta->aid;
+                wcn36xx_smd_config_sta(wcn, vif, sta);
+        }
+        return 0;
+}
+
+static int wcn36xx_sta_remove(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif,
+                              struct ieee80211_sta *sta)
+{
+        struct wcn36xx *wcn = hw->priv;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+        struct wcn36xx_sta *sta_priv = (struct wcn36xx_sta *)sta->drv_priv;
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac sta remove vif %p sta %pM index %d\n",
+                    vif, sta->addr, sta_priv->sta_index);
+
+        wcn36xx_smd_delete_sta(wcn, sta_priv->sta_index);
+        vif_priv->sta = NULL;
+        sta_priv->vif = NULL;
+        return 0;
+}
+
+#ifdef CONFIG_PM
+
+static int wcn36xx_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wow)
+{
+        struct wcn36xx *wcn = hw->priv;
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac suspend\n");
+
+        flush_workqueue(wcn->hal_ind_wq);
+        wcn36xx_smd_set_power_params(wcn, true);
+        return 0;
+}
+
+static int wcn36xx_resume(struct ieee80211_hw *hw)
+{
+        struct wcn36xx *wcn = hw->priv;
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac resume\n");
+
+        flush_workqueue(wcn->hal_ind_wq);
+        wcn36xx_smd_set_power_params(wcn, false);
+        return 0;
+}
+
+#endif
+
+static int wcn36xx_ampdu_action(struct ieee80211_hw *hw,
+                    struct ieee80211_vif *vif,
+                    enum ieee80211_ampdu_mlme_action action,
+                    struct ieee80211_sta *sta, u16 tid, u16 *ssn,
+                    u8 buf_size)
+{
+        struct wcn36xx *wcn = hw->priv;
+        struct wcn36xx_sta *sta_priv = NULL;
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "mac ampdu action action %d tid %d\n",
+                    action, tid);
+
+        sta_priv = (struct wcn36xx_sta *)sta->drv_priv;
+
+        switch (action) {
+        case IEEE80211_AMPDU_RX_START:
+                sta_priv->tid = tid;
+                wcn36xx_smd_add_ba_session(wcn, sta, tid, ssn, 0,
+                        get_sta_index(vif, sta_priv));
+                wcn36xx_smd_add_ba(wcn);
+                wcn36xx_smd_trigger_ba(wcn, get_sta_index(vif, sta_priv));
+                ieee80211_start_tx_ba_session(sta, tid, 0);
+                break;
+        case IEEE80211_AMPDU_RX_STOP:
+                wcn36xx_smd_del_ba(wcn, tid, get_sta_index(vif, sta_priv));
+                break;
+        case IEEE80211_AMPDU_TX_START:
+                ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                break;
+        case IEEE80211_AMPDU_TX_OPERATIONAL:
+                wcn36xx_smd_add_ba_session(wcn, sta, tid, ssn, 1,
+                        get_sta_index(vif, sta_priv));
+                break;
+        case IEEE80211_AMPDU_TX_STOP_FLUSH:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
+        case IEEE80211_AMPDU_TX_STOP_CONT:
+                ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                break;
+        default:
+                wcn36xx_err("Unknown AMPDU action\n");
+        }
+
+        return 0;
+}
+
+static const struct ieee80211_ops wcn36xx_ops = {
+        .start                  = wcn36xx_start,
+        .stop                   = wcn36xx_stop,
+        .add_interface          = wcn36xx_add_interface,
+        .remove_interface       = wcn36xx_remove_interface,
+#ifdef CONFIG_PM
+        .suspend                = wcn36xx_suspend,
+        .resume                 = wcn36xx_resume,
+#endif
+        .config                 = wcn36xx_config,
+        .configure_filter       = wcn36xx_configure_filter,
+        .tx                     = wcn36xx_tx,
+        .set_key                = wcn36xx_set_key,
+        .sw_scan_start          = wcn36xx_sw_scan_start,
+        .sw_scan_complete       = wcn36xx_sw_scan_complete,
+        .bss_info_changed       = wcn36xx_bss_info_changed,
+        .set_rts_threshold      = wcn36xx_set_rts_threshold,
+        .sta_add                = wcn36xx_sta_add,
+        .sta_remove             = wcn36xx_sta_remove,
+        .ampdu_action           = wcn36xx_ampdu_action,
+};
+
+static int wcn36xx_init_ieee80211(struct wcn36xx *wcn)
+{
+        int ret = 0;
+
+        static const u32 cipher_suites[] = {
+                WLAN_CIPHER_SUITE_WEP40,
+                WLAN_CIPHER_SUITE_WEP104,
+                WLAN_CIPHER_SUITE_TKIP,
+                WLAN_CIPHER_SUITE_CCMP,
+        };
+
+        wcn->hw->flags = IEEE80211_HW_SIGNAL_DBM |
+                IEEE80211_HW_HAS_RATE_CONTROL |
+                IEEE80211_HW_SUPPORTS_PS |
+                IEEE80211_HW_CONNECTION_MONITOR |
+                IEEE80211_HW_AMPDU_AGGREGATION |
+                IEEE80211_HW_TIMING_BEACON_ONLY;
+
+        wcn->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
+                BIT(NL80211_IFTYPE_AP) |
+                BIT(NL80211_IFTYPE_ADHOC) |
+                BIT(NL80211_IFTYPE_MESH_POINT);
+
+        wcn->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &wcn_band_2ghz;
+        wcn->hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &wcn_band_5ghz;
+
+        wcn->hw->wiphy->cipher_suites = cipher_suites;
+        wcn->hw->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
+
+        wcn->hw->wiphy->flags |= WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD;
+
+#ifdef CONFIG_PM
+        wcn->hw->wiphy->wowlan = &wowlan_support;
+#endif
+
+        wcn->hw->max_listen_interval = 200;
+
+        wcn->hw->queues = 4;
+
+        SET_IEEE80211_DEV(wcn->hw, wcn->dev);
+
+        wcn->hw->sta_data_size = sizeof(struct wcn36xx_sta);
+        wcn->hw->vif_data_size = sizeof(struct wcn36xx_vif);
+
+        return ret;
+}
+
+static int wcn36xx_platform_get_resources(struct wcn36xx *wcn,
+                                          struct platform_device *pdev)
+{
+        struct resource *res;
+        /* Set TX IRQ */
+        res = platform_get_resource_byname(pdev, IORESOURCE_IRQ,
+                                           "wcnss_wlantx_irq");
+        if (!res) {
+                wcn36xx_err("failed to get tx_irq\n");
+                return -ENOENT;
+        }
+        wcn->tx_irq = res->start;
+
+        /* Set RX IRQ */
+        res = platform_get_resource_byname(pdev, IORESOURCE_IRQ,
+                                           "wcnss_wlanrx_irq");
+        if (!res) {
+                wcn36xx_err("failed to get rx_irq\n");
+                return -ENOENT;
+        }
+        wcn->rx_irq = res->start;
+
+        /* Map the memory */
+        res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
+                                                 "wcnss_mmio");
+        if (!res) {
+                wcn36xx_err("failed to get mmio\n");
+                return -ENOENT;
+        }
+        wcn->mmio = ioremap(res->start, resource_size(res));
+        if (!wcn->mmio) {
+                wcn36xx_err("failed to map io memory\n");
+                return -ENOMEM;
+        }
+        return 0;
+}
+
+static int wcn36xx_probe(struct platform_device *pdev)
+{
+        struct ieee80211_hw *hw;
+        struct wcn36xx *wcn;
+        int ret;
+        u8 addr[ETH_ALEN];
+
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "platform probe\n");
+
+        hw = ieee80211_alloc_hw(sizeof(struct wcn36xx), &wcn36xx_ops);
+        if (!hw) {
+                wcn36xx_err("failed to alloc hw\n");
+                ret = -ENOMEM;
+                goto out_err;
+        }
+        platform_set_drvdata(pdev, hw);
+        wcn = hw->priv;
+        wcn->hw = hw;
+        wcn->dev = &pdev->dev;
+        wcn->ctrl_ops = pdev->dev.platform_data;
+
+        mutex_init(&wcn->hal_mutex);
+
+        if (!wcn->ctrl_ops->get_hw_mac(addr)) {
+                wcn36xx_info("mac address: %pM\n", addr);
+                SET_IEEE80211_PERM_ADDR(wcn->hw, addr);
+        }
+
+        ret = wcn36xx_platform_get_resources(wcn, pdev);
+        if (ret)
+                goto out_wq;
+
+        wcn36xx_init_ieee80211(wcn);
+        ret = ieee80211_register_hw(wcn->hw);
+        if (ret)
+                goto out_unmap;
+
+        return 0;
+
+out_unmap:
+        iounmap(wcn->mmio);
+out_wq:
+        ieee80211_free_hw(hw);
+out_err:
+        return ret;
+}
+static int wcn36xx_remove(struct platform_device *pdev)
+{
+        struct ieee80211_hw *hw = platform_get_drvdata(pdev);
+        struct wcn36xx *wcn = hw->priv;
+        wcn36xx_dbg(WCN36XX_DBG_MAC, "platform remove\n");
+
+        mutex_destroy(&wcn->hal_mutex);
+
+        ieee80211_unregister_hw(hw);
+        iounmap(wcn->mmio);
+        ieee80211_free_hw(hw);
+
+        return 0;
+}
+static const struct platform_device_id wcn36xx_platform_id_table[] = {
+        {
+                .name = "wcn36xx",
+                .driver_data = 0
+        },
+        {}
+};
+MODULE_DEVICE_TABLE(platform, wcn36xx_platform_id_table);
+
+static struct platform_driver wcn36xx_driver = {
+        .probe      = wcn36xx_probe,
+        .remove     = wcn36xx_remove,
+        .driver         = {
+                .name   = "wcn36xx",
+                .owner  = THIS_MODULE,
+        },
+        .id_table    = wcn36xx_platform_id_table,
+};
+
+static int __init wcn36xx_init(void)
+{
+        platform_driver_register(&wcn36xx_driver);
+        return 0;
+}
+module_init(wcn36xx_init);
+
+static void __exit wcn36xx_exit(void)
+{
+        platform_driver_unregister(&wcn36xx_driver);
+}
+module_exit(wcn36xx_exit);
+
+MODULE_LICENSE("Dual BSD/GPL");
+MODULE_AUTHOR("Eugene Krasnikov k.eugene.e@gmail.com");
+MODULE_FIRMWARE(WLAN_NV_FILE);
diff --git a/drivers/net/wireless/ath/wcn36xx/pmc.c b/drivers/net/wireless/ath/wcn36xx/pmc.c
new file mode 100644
index 000000000000..28b515c81b0e
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/pmc.c
@@ -0,0 +1,62 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include "wcn36xx.h"
+
+int wcn36xx_pmc_enter_bmps_state(struct wcn36xx *wcn,
+                                 struct ieee80211_vif *vif)
+{
+        int ret = 0;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+        /* TODO: Make sure the TX chain clean */
+        ret = wcn36xx_smd_enter_bmps(wcn, vif);
+        if (!ret) {
+                wcn36xx_dbg(WCN36XX_DBG_PMC, "Entered BMPS\n");
+                vif_priv->pw_state = WCN36XX_BMPS;
+        } else {
+                /*
+                 * One of the reasons why HW will not enter BMPS is because
+                 * driver is trying to enter bmps before first beacon was
+                 * received just after auth complete
+                 */
+                wcn36xx_err("Can not enter BMPS!\n");
+        }
+        return ret;
+}
+
+int wcn36xx_pmc_exit_bmps_state(struct wcn36xx *wcn,
+                                struct ieee80211_vif *vif)
+{
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+
+        if (WCN36XX_BMPS != vif_priv->pw_state) {
+                wcn36xx_err("Not in BMPS mode, no need to exit from BMPS mode!\n");
+                return -EINVAL;
+        }
+        wcn36xx_smd_exit_bmps(wcn, vif);
+        vif_priv->pw_state = WCN36XX_FULL_POWER;
+        return 0;
+}
+
+int wcn36xx_enable_keep_alive_null_packet(struct wcn36xx *wcn,
+                                          struct ieee80211_vif *vif)
+{
+        wcn36xx_dbg(WCN36XX_DBG_PMC, "%s\n", __func__);
+        return wcn36xx_smd_keep_alive_req(wcn, vif,
+                                          WCN36XX_HAL_KEEP_ALIVE_NULL_PKT);
+}
diff --git a/drivers/net/wireless/ath/wcn36xx/pmc.h b/drivers/net/wireless/ath/wcn36xx/pmc.h
new file mode 100644
index 000000000000..f72ed68b5a07
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/pmc.h
@@ -0,0 +1,33 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _WCN36XX_PMC_H_
+#define _WCN36XX_PMC_H_
+
+struct wcn36xx;
+
+enum wcn36xx_power_state {
+        WCN36XX_FULL_POWER,
+        WCN36XX_BMPS
+};
+
+int wcn36xx_pmc_enter_bmps_state(struct wcn36xx *wcn,
+                                 struct ieee80211_vif *vif);
+int wcn36xx_pmc_exit_bmps_state(struct wcn36xx *wcn,
+                                struct ieee80211_vif *vif);
+int wcn36xx_enable_keep_alive_null_packet(struct wcn36xx *wcn,
+                                          struct ieee80211_vif *vif);
+#endif  /* _WCN36XX_PMC_H_ */
diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
new file mode 100644
index 000000000000..f8c3a10510c2
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/smd.c
@@ -0,0 +1,2126 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/etherdevice.h>
+#include <linux/firmware.h>
+#include <linux/bitops.h>
+#include "smd.h"
+
+static int put_cfg_tlv_u32(struct wcn36xx *wcn, size_t *len, u32 id, u32 value)
+{
+        struct wcn36xx_hal_cfg *entry;
+        u32 *val;
+
+        if (*len + sizeof(*entry) + sizeof(u32) >= WCN36XX_HAL_BUF_SIZE) {
+                wcn36xx_err("Not enough room for TLV entry\n");
+                return -ENOMEM;
+        }
+
+        entry = (struct wcn36xx_hal_cfg *) (wcn->hal_buf + *len);
+        entry->id = id;
+        entry->len = sizeof(u32);
+        entry->pad_bytes = 0;
+        entry->reserve = 0;
+
+        val = (u32 *) (entry + 1);
+        *val = value;
+
+        *len += sizeof(*entry) + sizeof(u32);
+
+        return 0;
+}
+
+static void wcn36xx_smd_set_bss_nw_type(struct wcn36xx *wcn,
+                struct ieee80211_sta *sta,
+                struct wcn36xx_hal_config_bss_params *bss_params)
+{
+        if (IEEE80211_BAND_5GHZ == WCN36XX_BAND(wcn))
+                bss_params->nw_type = WCN36XX_HAL_11A_NW_TYPE;
+        else if (sta && sta->ht_cap.ht_supported)
+                bss_params->nw_type = WCN36XX_HAL_11N_NW_TYPE;
+        else if (sta && (sta->supp_rates[IEEE80211_BAND_2GHZ] & 0x7f))
+                bss_params->nw_type = WCN36XX_HAL_11G_NW_TYPE;
+        else
+                bss_params->nw_type = WCN36XX_HAL_11B_NW_TYPE;
+}
+
+static inline u8 is_cap_supported(unsigned long caps, unsigned long flag)
+{
+        return caps & flag ? 1 : 0;
+}
+static void wcn36xx_smd_set_bss_ht_params(struct ieee80211_vif *vif,
+                struct ieee80211_sta *sta,
+                struct wcn36xx_hal_config_bss_params *bss_params)
+{
+        if (sta && sta->ht_cap.ht_supported) {
+                unsigned long caps = sta->ht_cap.cap;
+                bss_params->ht = sta->ht_cap.ht_supported;
+                bss_params->tx_channel_width_set = is_cap_supported(caps,
+                        IEEE80211_HT_CAP_SUP_WIDTH_20_40);
+                bss_params->lsig_tx_op_protection_full_support =
+                        is_cap_supported(caps,
+                                         IEEE80211_HT_CAP_LSIG_TXOP_PROT);
+
+                bss_params->ht_oper_mode = vif->bss_conf.ht_operation_mode;
+                bss_params->lln_non_gf_coexist =
+                        !!(vif->bss_conf.ht_operation_mode &
+                           IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT);
+                /* IEEE80211_HT_STBC_PARAM_DUAL_CTS_PROT */
+                bss_params->dual_cts_protection = 0;
+                /* IEEE80211_HT_OP_MODE_PROTECTION_20MHZ */
+                bss_params->ht20_coexist = 0;
+        }
+}
+
+static void wcn36xx_smd_set_sta_ht_params(struct ieee80211_sta *sta,
+                struct wcn36xx_hal_config_sta_params *sta_params)
+{
+        if (sta->ht_cap.ht_supported) {
+                unsigned long caps = sta->ht_cap.cap;
+                sta_params->ht_capable = sta->ht_cap.ht_supported;
+                sta_params->tx_channel_width_set = is_cap_supported(caps,
+                        IEEE80211_HT_CAP_SUP_WIDTH_20_40);
+                sta_params->lsig_txop_protection = is_cap_supported(caps,
+                        IEEE80211_HT_CAP_LSIG_TXOP_PROT);
+
+                sta_params->max_ampdu_size = sta->ht_cap.ampdu_factor;
+                sta_params->max_ampdu_density = sta->ht_cap.ampdu_density;
+                sta_params->max_amsdu_size = is_cap_supported(caps,
+                        IEEE80211_HT_CAP_MAX_AMSDU);
+                sta_params->sgi_20Mhz = is_cap_supported(caps,
+                        IEEE80211_HT_CAP_SGI_20);
+                sta_params->sgi_40mhz = is_cap_supported(caps,
+                        IEEE80211_HT_CAP_SGI_40);
+                sta_params->green_field_capable = is_cap_supported(caps,
+                        IEEE80211_HT_CAP_GRN_FLD);
+                sta_params->delayed_ba_support = is_cap_supported(caps,
+                        IEEE80211_HT_CAP_DELAY_BA);
+                sta_params->dsss_cck_mode_40mhz = is_cap_supported(caps,
+                        IEEE80211_HT_CAP_DSSSCCK40);
+        }
+}
+
+static void wcn36xx_smd_set_sta_params(struct wcn36xx *wcn,
+                struct ieee80211_vif *vif,
+                struct ieee80211_sta *sta,
+                struct wcn36xx_hal_config_sta_params *sta_params)
+{
+        struct wcn36xx_vif *priv_vif = (struct wcn36xx_vif *)vif->drv_priv;
+        struct wcn36xx_sta *priv_sta = NULL;
+        if (vif->type == NL80211_IFTYPE_ADHOC ||
+            vif->type == NL80211_IFTYPE_AP ||
+            vif->type == NL80211_IFTYPE_MESH_POINT) {
+                sta_params->type = 1;
+                sta_params->sta_index = 0xFF;
+        } else {
+                sta_params->type = 0;
+                sta_params->sta_index = 1;
+        }
+
+        sta_params->listen_interval = WCN36XX_LISTEN_INTERVAL(wcn);
+
+        /*
+         * In STA mode ieee80211_sta contains bssid and ieee80211_vif
+         * contains our mac address. In  AP mode we are bssid so vif
+         * contains bssid and ieee80211_sta contains mac.
+         */
+        if (NL80211_IFTYPE_STATION == vif->type)
+                memcpy(&sta_params->mac, vif->addr, ETH_ALEN);
+        else
+                memcpy(&sta_params->bssid, vif->addr, ETH_ALEN);
+
+        sta_params->encrypt_type = priv_vif->encrypt_type;
+        sta_params->short_preamble_supported =
+                !(WCN36XX_FLAGS(wcn) &
+                  IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE);
+
+        sta_params->rifs_mode = 0;
+        sta_params->rmf = 0;
+        sta_params->action = 0;
+        sta_params->uapsd = 0;
+        sta_params->mimo_ps = WCN36XX_HAL_HT_MIMO_PS_STATIC;
+        sta_params->max_ampdu_duration = 0;
+        sta_params->bssid_index = priv_vif->bss_index;
+        sta_params->p2p = 0;
+
+        if (sta) {
+                priv_sta = (struct wcn36xx_sta *)sta->drv_priv;
+                if (NL80211_IFTYPE_STATION == vif->type)
+                        memcpy(&sta_params->bssid, sta->addr, ETH_ALEN);
+                else
+                        memcpy(&sta_params->mac, sta->addr, ETH_ALEN);
+                sta_params->wmm_enabled = sta->wme;
+                sta_params->max_sp_len = sta->max_sp;
+                sta_params->aid = priv_sta->aid;
+                wcn36xx_smd_set_sta_ht_params(sta, sta_params);
+                memcpy(&sta_params->supported_rates, &priv_sta->supported_rates,
+                        sizeof(priv_sta->supported_rates));
+        } else {
+                wcn36xx_set_default_rates(&sta_params->supported_rates);
+        }
+}
+
+static int wcn36xx_smd_send_and_wait(struct wcn36xx *wcn, size_t len)
+{
+        int ret = 0;
+        wcn36xx_dbg_dump(WCN36XX_DBG_SMD_DUMP, "HAL >>> ", wcn->hal_buf, len);
+
+        init_completion(&wcn->hal_rsp_compl);
+        ret = wcn->ctrl_ops->tx(wcn->hal_buf, len);
+        if (ret) {
+                wcn36xx_err("HAL TX failed\n");
+                goto out;
+        }
+        if (wait_for_completion_timeout(&wcn->hal_rsp_compl,
+                msecs_to_jiffies(HAL_MSG_TIMEOUT)) <= 0) {
+                wcn36xx_err("Timeout while waiting SMD response\n");
+                ret = -ETIME;
+                goto out;
+        }
+out:
+        return ret;
+}
+
+#define INIT_HAL_MSG(msg_body, type) \
+        do {                                                            \
+                memset(&msg_body, 0, sizeof(msg_body));                 \
+                msg_body.header.msg_type = type;                        \
+                msg_body.header.msg_version = WCN36XX_HAL_MSG_VERSION0; \
+                msg_body.header.len = sizeof(msg_body);                 \
+        } while (0)                                                     \
+
+#define PREPARE_HAL_BUF(send_buf, msg_body) \
+        do {                                                    \
+                memset(send_buf, 0, msg_body.header.len);       \
+                memcpy(send_buf, &msg_body, sizeof(msg_body));  \
+        } while (0)                                             \
+
+static int wcn36xx_smd_rsp_status_check(void *buf, size_t len)
+{
+        struct wcn36xx_fw_msg_status_rsp *rsp;
+
+        if (len < sizeof(struct wcn36xx_hal_msg_header) +
+            sizeof(struct wcn36xx_fw_msg_status_rsp))
+                return -EIO;
+
+        rsp = (struct wcn36xx_fw_msg_status_rsp *)
+                (buf + sizeof(struct wcn36xx_hal_msg_header));
+
+        if (WCN36XX_FW_MSG_RESULT_SUCCESS != rsp->status)
+                return rsp->status;
+
+        return 0;
+}
+
+int wcn36xx_smd_load_nv(struct wcn36xx *wcn)
+{
+        const struct firmware *nv;
+        struct nv_data *nv_d;
+        struct wcn36xx_hal_nv_img_download_req_msg msg_body;
+        int fw_bytes_left;
+        int ret;
+        u16 fm_offset = 0;
+
+        ret = request_firmware(&nv, WLAN_NV_FILE, wcn->dev);
+        if (ret) {
+                wcn36xx_err("Failed to load nv file %s: %d\n",
+                              WLAN_NV_FILE, ret);
+                goto out_free_nv;
+        }
+
+        nv_d = (struct nv_data *)nv->data;
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_DOWNLOAD_NV_REQ);
+
+        msg_body.header.len += WCN36XX_NV_FRAGMENT_SIZE;
+
+        msg_body.frag_number = 0;
+        /* hal_buf must be protected with  mutex */
+        mutex_lock(&wcn->hal_mutex);
+
+        do {
+                fw_bytes_left = nv->size - fm_offset - 4;
+                if (fw_bytes_left > WCN36XX_NV_FRAGMENT_SIZE) {
+                        msg_body.last_fragment = 0;
+                        msg_body.nv_img_buffer_size = WCN36XX_NV_FRAGMENT_SIZE;
+                } else {
+                        msg_body.last_fragment = 1;
+                        msg_body.nv_img_buffer_size = fw_bytes_left;
+
+                        /* Do not forget update general message len */
+                        msg_body.header.len = sizeof(msg_body) + fw_bytes_left;
+
+                }
+
+                /* Add load NV request message header */
+                memcpy(wcn->hal_buf, &msg_body, sizeof(msg_body));
+
+                /* Add NV body itself */
+                memcpy(wcn->hal_buf + sizeof(msg_body),
+                       &nv_d->table + fm_offset,
+                       msg_body.nv_img_buffer_size);
+
+                ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+                if (ret)
+                        goto out_unlock;
+                ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf,
+                                                   wcn->hal_rsp_len);
+                if (ret) {
+                        wcn36xx_err("hal_load_nv response failed err=%d\n",
+                                    ret);
+                        goto out_unlock;
+                }
+                msg_body.frag_number++;
+                fm_offset += WCN36XX_NV_FRAGMENT_SIZE;
+
+        } while (msg_body.last_fragment != 1);
+
+out_unlock:
+        mutex_unlock(&wcn->hal_mutex);
+out_free_nv:
+        release_firmware(nv);
+
+        return ret;
+}
+
+static int wcn36xx_smd_start_rsp(struct wcn36xx *wcn, void *buf, size_t len)
+{
+        struct wcn36xx_hal_mac_start_rsp_msg *rsp;
+
+        if (len < sizeof(*rsp))
+                return -EIO;
+
+        rsp = (struct wcn36xx_hal_mac_start_rsp_msg *)buf;
+
+        if (WCN36XX_FW_MSG_RESULT_SUCCESS != rsp->start_rsp_params.status)
+                return -EIO;
+
+        memcpy(wcn->crm_version, rsp->start_rsp_params.crm_version,
+               WCN36XX_HAL_VERSION_LENGTH);
+        memcpy(wcn->wlan_version, rsp->start_rsp_params.wlan_version,
+               WCN36XX_HAL_VERSION_LENGTH);
+
+        /* null terminate the strings, just in case */
+        wcn->crm_version[WCN36XX_HAL_VERSION_LENGTH] = '\0';
+        wcn->wlan_version[WCN36XX_HAL_VERSION_LENGTH] = '\0';
+
+        wcn->fw_revision = rsp->start_rsp_params.version.revision;
+        wcn->fw_version = rsp->start_rsp_params.version.version;
+        wcn->fw_minor = rsp->start_rsp_params.version.minor;
+        wcn->fw_major = rsp->start_rsp_params.version.major;
+
+        wcn36xx_info("firmware WLAN version '%s' and CRM version '%s'\n",
+                     wcn->wlan_version, wcn->crm_version);
+
+        wcn36xx_info("firmware API %u.%u.%u.%u, %u stations, %u bssids\n",
+                     wcn->fw_major, wcn->fw_minor,
+                     wcn->fw_version, wcn->fw_revision,
+                     rsp->start_rsp_params.stations,
+                     rsp->start_rsp_params.bssids);
+
+        return 0;
+}
+
+int wcn36xx_smd_start(struct wcn36xx *wcn)
+{
+        struct wcn36xx_hal_mac_start_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_START_REQ);
+
+        msg_body.params.type = DRIVER_TYPE_PRODUCTION;
+        msg_body.params.len = 0;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL, "hal start type %d\n",
+                    msg_body.params.type);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_start failed\n");
+                goto out;
+        }
+
+        ret = wcn36xx_smd_start_rsp(wcn, wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_start response failed err=%d\n", ret);
+                goto out;
+        }
+
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_stop(struct wcn36xx *wcn)
+{
+        struct wcn36xx_hal_mac_stop_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_STOP_REQ);
+
+        msg_body.stop_req_params.reason = HAL_STOP_TYPE_RF_KILL;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_stop failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_stop response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_init_scan(struct wcn36xx *wcn, enum wcn36xx_hal_sys_mode mode)
+{
+        struct wcn36xx_hal_init_scan_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_INIT_SCAN_REQ);
+
+        msg_body.mode = mode;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL, "hal init scan mode %d\n", msg_body.mode);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_init_scan failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_init_scan response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_start_scan(struct wcn36xx *wcn)
+{
+        struct wcn36xx_hal_start_scan_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_START_SCAN_REQ);
+
+        msg_body.scan_channel = WCN36XX_HW_CHANNEL(wcn);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL, "hal start scan channel %d\n",
+                    msg_body.scan_channel);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_start_scan failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_start_scan response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_end_scan(struct wcn36xx *wcn)
+{
+        struct wcn36xx_hal_end_scan_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_END_SCAN_REQ);
+
+        msg_body.scan_channel = WCN36XX_HW_CHANNEL(wcn);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL, "hal end scan channel %d\n",
+                    msg_body.scan_channel);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_end_scan failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_end_scan response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_finish_scan(struct wcn36xx *wcn,
+                            enum wcn36xx_hal_sys_mode mode)
+{
+        struct wcn36xx_hal_finish_scan_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_FINISH_SCAN_REQ);
+
+        msg_body.mode = mode;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL, "hal finish scan mode %d\n",
+                    msg_body.mode);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_finish_scan failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_finish_scan response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+static int wcn36xx_smd_switch_channel_rsp(void *buf, size_t len)
+{
+        struct wcn36xx_hal_switch_channel_rsp_msg *rsp;
+        int ret = 0;
+
+        ret = wcn36xx_smd_rsp_status_check(buf, len);
+        if (ret)
+                return ret;
+        rsp = (struct wcn36xx_hal_switch_channel_rsp_msg *)buf;
+        wcn36xx_dbg(WCN36XX_DBG_HAL, "channel switched to: %d, status: %d\n",
+                    rsp->channel_number, rsp->status);
+        return ret;
+}
+
+int wcn36xx_smd_switch_channel(struct wcn36xx *wcn,
+                               struct ieee80211_vif *vif, int ch)
+{
+        struct wcn36xx_hal_switch_channel_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_CH_SWITCH_REQ);
+
+        msg_body.channel_number = (u8)ch;
+        msg_body.tx_mgmt_power = 0xbf;
+        msg_body.max_tx_power = 0xbf;
+        memcpy(msg_body.self_sta_mac_addr, vif->addr, ETH_ALEN);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_switch_channel failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_switch_channel_rsp(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_switch_channel response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+static int wcn36xx_smd_update_scan_params_rsp(void *buf, size_t len)
+{
+        struct wcn36xx_hal_update_scan_params_resp *rsp;
+
+        rsp = (struct wcn36xx_hal_update_scan_params_resp *)buf;
+
+        /* Remove the PNO version bit */
+        rsp->status &= (~(WCN36XX_FW_MSG_PNO_VERSION_MASK));
+
+        if (WCN36XX_FW_MSG_RESULT_SUCCESS != rsp->status) {
+                wcn36xx_warn("error response from update scan\n");
+                return rsp->status;
+        }
+
+        return 0;
+}
+
+int wcn36xx_smd_update_scan_params(struct wcn36xx *wcn)
+{
+        struct wcn36xx_hal_update_scan_params_req msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_UPDATE_SCAN_PARAM_REQ);
+
+        msg_body.dot11d_enabled = 0;
+        msg_body.dot11d_resolved = 0;
+        msg_body.channel_count = 26;
+        msg_body.active_min_ch_time = 60;
+        msg_body.active_max_ch_time = 120;
+        msg_body.passive_min_ch_time = 60;
+        msg_body.passive_max_ch_time = 110;
+        msg_body.state = 0;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal update scan params channel_count %d\n",
+                    msg_body.channel_count);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_update_scan_params failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_update_scan_params_rsp(wcn->hal_buf,
+                                                 wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_update_scan_params response failed err=%d\n",
+                            ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+static int wcn36xx_smd_add_sta_self_rsp(struct wcn36xx *wcn,
+                                        struct ieee80211_vif *vif,
+                                        void *buf,
+                                        size_t len)
+{
+        struct wcn36xx_hal_add_sta_self_rsp_msg *rsp;
+        struct wcn36xx_vif *priv_vif = (struct wcn36xx_vif *)vif->drv_priv;
+
+        if (len < sizeof(*rsp))
+                return -EINVAL;
+
+        rsp = (struct wcn36xx_hal_add_sta_self_rsp_msg *)buf;
+
+        if (rsp->status != WCN36XX_FW_MSG_RESULT_SUCCESS) {
+                wcn36xx_warn("hal add sta self failure: %d\n",
+                             rsp->status);
+                return rsp->status;
+        }
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal add sta self status %d self_sta_index %d dpu_index %d\n",
+                    rsp->status, rsp->self_sta_index, rsp->dpu_index);
+
+        priv_vif->self_sta_index = rsp->self_sta_index;
+        priv_vif->self_dpu_desc_index = rsp->dpu_index;
+
+        return 0;
+}
+
+int wcn36xx_smd_add_sta_self(struct wcn36xx *wcn, struct ieee80211_vif *vif)
+{
+        struct wcn36xx_hal_add_sta_self_req msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_ADD_STA_SELF_REQ);
+
+        memcpy(&msg_body.self_addr, vif->addr, ETH_ALEN);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal add sta self self_addr %pM status %d\n",
+                    msg_body.self_addr, msg_body.status);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_add_sta_self failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_add_sta_self_rsp(wcn,
+                                           vif,
+                                           wcn->hal_buf,
+                                           wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_add_sta_self response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_delete_sta_self(struct wcn36xx *wcn, u8 *addr)
+{
+        struct wcn36xx_hal_del_sta_self_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_DEL_STA_SELF_REQ);
+
+        memcpy(&msg_body.self_addr, addr, ETH_ALEN);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_delete_sta_self failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_delete_sta_self response failed err=%d\n",
+                            ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_delete_sta(struct wcn36xx *wcn, u8 sta_index)
+{
+        struct wcn36xx_hal_delete_sta_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_DELETE_STA_REQ);
+
+        msg_body.sta_index = sta_index;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal delete sta sta_index %d\n",
+                    msg_body.sta_index);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_delete_sta failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_delete_sta response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+static int wcn36xx_smd_join_rsp(void *buf, size_t len)
+{
+        struct wcn36xx_hal_join_rsp_msg *rsp;
+
+        if (wcn36xx_smd_rsp_status_check(buf, len))
+                return -EIO;
+
+        rsp = (struct wcn36xx_hal_join_rsp_msg *)buf;
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal rsp join status %d tx_mgmt_power %d\n",
+                    rsp->status, rsp->tx_mgmt_power);
+
+        return 0;
+}
+
+int wcn36xx_smd_join(struct wcn36xx *wcn, const u8 *bssid, u8 *vif, u8 ch)
+{
+        struct wcn36xx_hal_join_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_JOIN_REQ);
+
+        memcpy(&msg_body.bssid, bssid, ETH_ALEN);
+        memcpy(&msg_body.self_sta_mac_addr, vif, ETH_ALEN);
+        msg_body.channel = ch;
+
+        if (conf_is_ht40_minus(&wcn->hw->conf))
+                msg_body.secondary_channel_offset =
+                        PHY_DOUBLE_CHANNEL_HIGH_PRIMARY;
+        else if (conf_is_ht40_plus(&wcn->hw->conf))
+                msg_body.secondary_channel_offset =
+                        PHY_DOUBLE_CHANNEL_LOW_PRIMARY;
+        else
+                msg_body.secondary_channel_offset =
+                        PHY_SINGLE_CHANNEL_CENTERED;
+
+        msg_body.link_state = WCN36XX_HAL_LINK_PREASSOC_STATE;
+
+        msg_body.max_tx_power = 0xbf;
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal join req bssid %pM self_sta_mac_addr %pM channel %d link_state %d\n",
+                    msg_body.bssid, msg_body.self_sta_mac_addr,
+                    msg_body.channel, msg_body.link_state);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_join failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_join_rsp(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_join response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_set_link_st(struct wcn36xx *wcn, const u8 *bssid,
+                            const u8 *sta_mac,
+                            enum wcn36xx_hal_link_state state)
+{
+        struct wcn36xx_hal_set_link_state_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_SET_LINK_ST_REQ);
+
+        memcpy(&msg_body.bssid, bssid, ETH_ALEN);
+        memcpy(&msg_body.self_mac_addr, sta_mac, ETH_ALEN);
+        msg_body.state = state;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal set link state bssid %pM self_mac_addr %pM state %d\n",
+                    msg_body.bssid, msg_body.self_mac_addr, msg_body.state);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_set_link_st failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_set_link_st response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+static void wcn36xx_smd_convert_sta_to_v1(struct wcn36xx *wcn,
+                        const struct wcn36xx_hal_config_sta_params *orig,
+                        struct wcn36xx_hal_config_sta_params_v1 *v1)
+{
+        /* convert orig to v1 format */
+        memcpy(&v1->bssid, orig->bssid, ETH_ALEN);
+        memcpy(&v1->mac, orig->mac, ETH_ALEN);
+        v1->aid = orig->aid;
+        v1->type = orig->type;
+        v1->listen_interval = orig->listen_interval;
+        v1->ht_capable = orig->ht_capable;
+
+        v1->max_ampdu_size = orig->max_ampdu_size;
+        v1->max_ampdu_density = orig->max_ampdu_density;
+        v1->sgi_40mhz = orig->sgi_40mhz;
+        v1->sgi_20Mhz = orig->sgi_20Mhz;
+
+        memcpy(&v1->supported_rates, &orig->supported_rates,
+               sizeof(orig->supported_rates));
+        v1->sta_index = orig->sta_index;
+}
+
+static int wcn36xx_smd_config_sta_rsp(struct wcn36xx *wcn,
+                                      struct ieee80211_sta *sta,
+                                      void *buf,
+                                      size_t len)
+{
+        struct wcn36xx_hal_config_sta_rsp_msg *rsp;
+        struct config_sta_rsp_params *params;
+        struct wcn36xx_sta *sta_priv = (struct wcn36xx_sta *)sta->drv_priv;
+
+        if (len < sizeof(*rsp))
+                return -EINVAL;
+
+        rsp = (struct wcn36xx_hal_config_sta_rsp_msg *)buf;
+        params = &rsp->params;
+
+        if (params->status != WCN36XX_FW_MSG_RESULT_SUCCESS) {
+                wcn36xx_warn("hal config sta response failure: %d\n",
+                             params->status);
+                return -EIO;
+        }
+
+        sta_priv->sta_index = params->sta_index;
+        sta_priv->dpu_desc_index = params->dpu_index;
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal config sta rsp status %d sta_index %d bssid_index %d p2p %d\n",
+                    params->status, params->sta_index, params->bssid_index,
+                    params->p2p);
+
+        return 0;
+}
+
+static int wcn36xx_smd_config_sta_v1(struct wcn36xx *wcn,
+                     const struct wcn36xx_hal_config_sta_req_msg *orig)
+{
+        struct wcn36xx_hal_config_sta_req_msg_v1 msg_body;
+        struct wcn36xx_hal_config_sta_params_v1 *sta = &msg_body.sta_params;
+
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_CONFIG_STA_REQ);
+
+        wcn36xx_smd_convert_sta_to_v1(wcn, &orig->sta_params,
+                                      &msg_body.sta_params);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal config sta v1 action %d sta_index %d bssid_index %d bssid %pM type %d mac %pM aid %d\n",
+                    sta->action, sta->sta_index, sta->bssid_index,
+                    sta->bssid, sta->type, sta->mac, sta->aid);
+
+        return wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+}
+
+int wcn36xx_smd_config_sta(struct wcn36xx *wcn, struct ieee80211_vif *vif,
+                           struct ieee80211_sta *sta)
+{
+        struct wcn36xx_hal_config_sta_req_msg msg;
+        struct wcn36xx_hal_config_sta_params *sta_params;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg, WCN36XX_HAL_CONFIG_STA_REQ);
+
+        sta_params = &msg.sta_params;
+
+        wcn36xx_smd_set_sta_params(wcn, vif, sta, sta_params);
+
+        if (!wcn36xx_is_fw_version(wcn, 1, 2, 2, 24)) {
+                ret = wcn36xx_smd_config_sta_v1(wcn, &msg);
+        } else {
+                PREPARE_HAL_BUF(wcn->hal_buf, msg);
+
+                wcn36xx_dbg(WCN36XX_DBG_HAL,
+                            "hal config sta action %d sta_index %d bssid_index %d bssid %pM type %d mac %pM aid %d\n",
+                            sta_params->action, sta_params->sta_index,
+                            sta_params->bssid_index, sta_params->bssid,
+                            sta_params->type, sta_params->mac, sta_params->aid);
+
+                ret = wcn36xx_smd_send_and_wait(wcn, msg.header.len);
+        }
+        if (ret) {
+                wcn36xx_err("Sending hal_config_sta failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_config_sta_rsp(wcn,
+                                         sta,
+                                         wcn->hal_buf,
+                                         wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_config_sta response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+static int wcn36xx_smd_config_bss_v1(struct wcn36xx *wcn,
+                        const struct wcn36xx_hal_config_bss_req_msg *orig)
+{
+        struct wcn36xx_hal_config_bss_req_msg_v1 msg_body;
+        struct wcn36xx_hal_config_bss_params_v1 *bss = &msg_body.bss_params;
+        struct wcn36xx_hal_config_sta_params_v1 *sta = &bss->sta;
+
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_CONFIG_BSS_REQ);
+
+        /* convert orig to v1 */
+        memcpy(&msg_body.bss_params.bssid,
+               &orig->bss_params.bssid, ETH_ALEN);
+        memcpy(&msg_body.bss_params.self_mac_addr,
+               &orig->bss_params.self_mac_addr, ETH_ALEN);
+
+        msg_body.bss_params.bss_type = orig->bss_params.bss_type;
+        msg_body.bss_params.oper_mode = orig->bss_params.oper_mode;
+        msg_body.bss_params.nw_type = orig->bss_params.nw_type;
+
+        msg_body.bss_params.short_slot_time_supported =
+                orig->bss_params.short_slot_time_supported;
+        msg_body.bss_params.lla_coexist = orig->bss_params.lla_coexist;
+        msg_body.bss_params.llb_coexist = orig->bss_params.llb_coexist;
+        msg_body.bss_params.llg_coexist = orig->bss_params.llg_coexist;
+        msg_body.bss_params.ht20_coexist = orig->bss_params.ht20_coexist;
+        msg_body.bss_params.lln_non_gf_coexist =
+                orig->bss_params.lln_non_gf_coexist;
+
+        msg_body.bss_params.lsig_tx_op_protection_full_support =
+                orig->bss_params.lsig_tx_op_protection_full_support;
+        msg_body.bss_params.rifs_mode = orig->bss_params.rifs_mode;
+        msg_body.bss_params.beacon_interval = orig->bss_params.beacon_interval;
+        msg_body.bss_params.dtim_period = orig->bss_params.dtim_period;
+        msg_body.bss_params.tx_channel_width_set =
+                orig->bss_params.tx_channel_width_set;
+        msg_body.bss_params.oper_channel = orig->bss_params.oper_channel;
+        msg_body.bss_params.ext_channel = orig->bss_params.ext_channel;
+
+        msg_body.bss_params.reserved = orig->bss_params.reserved;
+
+        memcpy(&msg_body.bss_params.ssid,
+               &orig->bss_params.ssid,
+               sizeof(orig->bss_params.ssid));
+
+        msg_body.bss_params.action = orig->bss_params.action;
+        msg_body.bss_params.rateset = orig->bss_params.rateset;
+        msg_body.bss_params.ht = orig->bss_params.ht;
+        msg_body.bss_params.obss_prot_enabled =
+                orig->bss_params.obss_prot_enabled;
+        msg_body.bss_params.rmf = orig->bss_params.rmf;
+        msg_body.bss_params.ht_oper_mode = orig->bss_params.ht_oper_mode;
+        msg_body.bss_params.dual_cts_protection =
+                orig->bss_params.dual_cts_protection;
+
+        msg_body.bss_params.max_probe_resp_retry_limit =
+                orig->bss_params.max_probe_resp_retry_limit;
+        msg_body.bss_params.hidden_ssid = orig->bss_params.hidden_ssid;
+        msg_body.bss_params.proxy_probe_resp =
+                orig->bss_params.proxy_probe_resp;
+        msg_body.bss_params.edca_params_valid =
+                orig->bss_params.edca_params_valid;
+
+        memcpy(&msg_body.bss_params.acbe,
+               &orig->bss_params.acbe,
+               sizeof(orig->bss_params.acbe));
+        memcpy(&msg_body.bss_params.acbk,
+               &orig->bss_params.acbk,
+               sizeof(orig->bss_params.acbk));
+        memcpy(&msg_body.bss_params.acvi,
+               &orig->bss_params.acvi,
+               sizeof(orig->bss_params.acvi));
+        memcpy(&msg_body.bss_params.acvo,
+               &orig->bss_params.acvo,
+               sizeof(orig->bss_params.acvo));
+
+        msg_body.bss_params.ext_set_sta_key_param_valid =
+                orig->bss_params.ext_set_sta_key_param_valid;
+
+        memcpy(&msg_body.bss_params.ext_set_sta_key_param,
+               &orig->bss_params.ext_set_sta_key_param,
+               sizeof(orig->bss_params.acvo));
+
+        msg_body.bss_params.wcn36xx_hal_persona =
+                orig->bss_params.wcn36xx_hal_persona;
+        msg_body.bss_params.spectrum_mgt_enable =
+                orig->bss_params.spectrum_mgt_enable;
+        msg_body.bss_params.tx_mgmt_power = orig->bss_params.tx_mgmt_power;
+        msg_body.bss_params.max_tx_power = orig->bss_params.max_tx_power;
+
+        wcn36xx_smd_convert_sta_to_v1(wcn, &orig->bss_params.sta,
+                                      &msg_body.bss_params.sta);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal config bss v1 bssid %pM self_mac_addr %pM bss_type %d oper_mode %d nw_type %d\n",
+                    bss->bssid, bss->self_mac_addr, bss->bss_type,
+                    bss->oper_mode, bss->nw_type);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "- sta bssid %pM action %d sta_index %d bssid_index %d aid %d type %d mac %pM\n",
+                    sta->bssid, sta->action, sta->sta_index,
+                    sta->bssid_index, sta->aid, sta->type, sta->mac);
+
+        return wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+}
+
+
+static int wcn36xx_smd_config_bss_rsp(struct wcn36xx *wcn,
+                                      struct ieee80211_vif *vif,
+                                      void *buf,
+                                      size_t len)
+{
+        struct wcn36xx_hal_config_bss_rsp_msg *rsp;
+        struct wcn36xx_hal_config_bss_rsp_params *params;
+        struct wcn36xx_vif *priv_vif = (struct wcn36xx_vif *)vif->drv_priv;
+
+        if (len < sizeof(*rsp))
+                return -EINVAL;
+
+        rsp = (struct wcn36xx_hal_config_bss_rsp_msg *)buf;
+        params = &rsp->bss_rsp_params;
+
+        if (params->status != WCN36XX_FW_MSG_RESULT_SUCCESS) {
+                wcn36xx_warn("hal config bss response failure: %d\n",
+                             params->status);
+                return -EIO;
+        }
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal config bss rsp status %d bss_idx %d dpu_desc_index %d"
+                    " sta_idx %d self_idx %d bcast_idx %d mac %pM"
+                    " power %d ucast_dpu_signature %d\n",
+                    params->status, params->bss_index, params->dpu_desc_index,
+                    params->bss_sta_index, params->bss_self_sta_index,
+                    params->bss_bcast_sta_idx, params->mac,
+                    params->tx_mgmt_power, params->ucast_dpu_signature);
+
+        priv_vif->bss_index = params->bss_index;
+
+        if (priv_vif->sta) {
+                priv_vif->sta->bss_sta_index =  params->bss_sta_index;
+                priv_vif->sta->bss_dpu_desc_index = params->dpu_desc_index;
+        }
+
+        priv_vif->ucast_dpu_signature = params->ucast_dpu_signature;
+
+        return 0;
+}
+
+int wcn36xx_smd_config_bss(struct wcn36xx *wcn, struct ieee80211_vif *vif,
+                           struct ieee80211_sta *sta, const u8 *bssid,
+                           bool update)
+{
+        struct wcn36xx_hal_config_bss_req_msg msg;
+        struct wcn36xx_hal_config_bss_params *bss;
+        struct wcn36xx_hal_config_sta_params *sta_params;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg, WCN36XX_HAL_CONFIG_BSS_REQ);
+
+        bss = &msg.bss_params;
+        sta_params = &bss->sta;
+
+        WARN_ON(is_zero_ether_addr(bssid));
+
+        memcpy(&bss->bssid, bssid, ETH_ALEN);
+
+        memcpy(bss->self_mac_addr, vif->addr, ETH_ALEN);
+
+        if (vif->type == NL80211_IFTYPE_STATION) {
+                bss->bss_type = WCN36XX_HAL_INFRASTRUCTURE_MODE;
+
+                /* STA */
+                bss->oper_mode = 1;
+                bss->wcn36xx_hal_persona = WCN36XX_HAL_STA_MODE;
+        } else if (vif->type == NL80211_IFTYPE_AP) {
+                bss->bss_type = WCN36XX_HAL_INFRA_AP_MODE;
+
+                /* AP */
+                bss->oper_mode = 0;
+                bss->wcn36xx_hal_persona = WCN36XX_HAL_STA_SAP_MODE;
+        } else if (vif->type == NL80211_IFTYPE_ADHOC ||
+                   vif->type == NL80211_IFTYPE_MESH_POINT) {
+                bss->bss_type = WCN36XX_HAL_IBSS_MODE;
+
+                /* STA */
+                bss->oper_mode = 1;
+        } else {
+                wcn36xx_warn("Unknown type for bss config: %d\n", vif->type);
+        }
+
+        if (vif->type == NL80211_IFTYPE_STATION)
+                wcn36xx_smd_set_bss_nw_type(wcn, sta, bss);
+        else
+                bss->nw_type = WCN36XX_HAL_11N_NW_TYPE;
+
+        bss->short_slot_time_supported = vif->bss_conf.use_short_slot;
+        bss->lla_coexist = 0;
+        bss->llb_coexist = 0;
+        bss->llg_coexist = 0;
+        bss->rifs_mode = 0;
+        bss->beacon_interval = vif->bss_conf.beacon_int;
+        bss->dtim_period = vif_priv->dtim_period;
+
+        wcn36xx_smd_set_bss_ht_params(vif, sta, bss);
+
+        bss->oper_channel = WCN36XX_HW_CHANNEL(wcn);
+
+        if (conf_is_ht40_minus(&wcn->hw->conf))
+                bss->ext_channel = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
+        else if (conf_is_ht40_plus(&wcn->hw->conf))
+                bss->ext_channel = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
+        else
+                bss->ext_channel = IEEE80211_HT_PARAM_CHA_SEC_NONE;
+
+        bss->reserved = 0;
+        wcn36xx_smd_set_sta_params(wcn, vif, sta, sta_params);
+
+        /* wcn->ssid is only valid in AP and IBSS mode */
+        bss->ssid.length = vif_priv->ssid.length;
+        memcpy(bss->ssid.ssid, vif_priv->ssid.ssid, vif_priv->ssid.length);
+
+        bss->obss_prot_enabled = 0;
+        bss->rmf = 0;
+        bss->max_probe_resp_retry_limit = 0;
+        bss->hidden_ssid = vif->bss_conf.hidden_ssid;
+        bss->proxy_probe_resp = 0;
+        bss->edca_params_valid = 0;
+
+        /* FIXME: set acbe, acbk, acvi and acvo */
+
+        bss->ext_set_sta_key_param_valid = 0;
+
+        /* FIXME: set ext_set_sta_key_param */
+
+        bss->spectrum_mgt_enable = 0;
+        bss->tx_mgmt_power = 0;
+        bss->max_tx_power = WCN36XX_MAX_POWER(wcn);
+
+        bss->action = update;
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal config bss bssid %pM self_mac_addr %pM bss_type %d oper_mode %d nw_type %d\n",
+                    bss->bssid, bss->self_mac_addr, bss->bss_type,
+                    bss->oper_mode, bss->nw_type);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "- sta bssid %pM action %d sta_index %d bssid_index %d aid %d type %d mac %pM\n",
+                    sta_params->bssid, sta_params->action,
+                    sta_params->sta_index, sta_params->bssid_index,
+                    sta_params->aid, sta_params->type,
+                    sta_params->mac);
+
+        if (!wcn36xx_is_fw_version(wcn, 1, 2, 2, 24)) {
+                ret = wcn36xx_smd_config_bss_v1(wcn, &msg);
+        } else {
+                PREPARE_HAL_BUF(wcn->hal_buf, msg);
+
+                ret = wcn36xx_smd_send_and_wait(wcn, msg.header.len);
+        }
+        if (ret) {
+                wcn36xx_err("Sending hal_config_bss failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_config_bss_rsp(wcn,
+                                         vif,
+                                         wcn->hal_buf,
+                                         wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_config_bss response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_delete_bss(struct wcn36xx *wcn, struct ieee80211_vif *vif)
+{
+        struct wcn36xx_hal_delete_bss_req_msg msg_body;
+        struct wcn36xx_vif *priv_vif = (struct wcn36xx_vif *)vif->drv_priv;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_DELETE_BSS_REQ);
+
+        msg_body.bss_index = priv_vif->bss_index;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL, "hal delete bss %d\n", msg_body.bss_index);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_delete_bss failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_delete_bss response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_send_beacon(struct wcn36xx *wcn, struct ieee80211_vif *vif,
+                            struct sk_buff *skb_beacon, u16 tim_off,
+                            u16 p2p_off)
+{
+        struct wcn36xx_hal_send_beacon_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_SEND_BEACON_REQ);
+
+        /* TODO need to find out why this is needed? */
+        msg_body.beacon_length = skb_beacon->len + 6;
+
+        if (BEACON_TEMPLATE_SIZE > msg_body.beacon_length) {
+                memcpy(&msg_body.beacon, &skb_beacon->len, sizeof(u32));
+                memcpy(&(msg_body.beacon[4]), skb_beacon->data,
+                       skb_beacon->len);
+        } else {
+                wcn36xx_err("Beacon is to big: beacon size=%d\n",
+                              msg_body.beacon_length);
+                return -ENOMEM;
+        }
+        memcpy(msg_body.bssid, vif->addr, ETH_ALEN);
+
+        /* TODO need to find out why this is needed? */
+        msg_body.tim_ie_offset = tim_off+4;
+        msg_body.p2p_ie_offset = p2p_off;
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal send beacon beacon_length %d\n",
+                    msg_body.beacon_length);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_send_beacon failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_send_beacon response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_update_proberesp_tmpl(struct wcn36xx *wcn,
+                                      struct ieee80211_vif *vif,
+                                      struct sk_buff *skb)
+{
+        struct wcn36xx_hal_send_probe_resp_req_msg msg;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg, WCN36XX_HAL_UPDATE_PROBE_RSP_TEMPLATE_REQ);
+
+        if (skb->len > BEACON_TEMPLATE_SIZE) {
+                wcn36xx_warn("probe response template is too big: %d\n",
+                             skb->len);
+                return -E2BIG;
+        }
+
+        msg.probe_resp_template_len = skb->len;
+        memcpy(&msg.probe_resp_template, skb->data, skb->len);
+
+        memcpy(msg.bssid, vif->addr, ETH_ALEN);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg);
+
+        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                    "hal update probe rsp len %d bssid %pM\n",
+                    msg.probe_resp_template_len, msg.bssid);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_update_proberesp_tmpl failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_update_proberesp_tmpl response failed err=%d\n",
+                            ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_set_stakey(struct wcn36xx *wcn,
+                           enum ani_ed_type enc_type,
+                           u8 keyidx,
+                           u8 keylen,
+                           u8 *key,
+                           u8 sta_index)
+{
+        struct wcn36xx_hal_set_sta_key_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_SET_STAKEY_REQ);
+
+        msg_body.set_sta_key_params.sta_index = sta_index;
+        msg_body.set_sta_key_params.enc_type = enc_type;
+
+        msg_body.set_sta_key_params.key[0].id = keyidx;
+        msg_body.set_sta_key_params.key[0].unicast = 1;
+        msg_body.set_sta_key_params.key[0].direction = WCN36XX_HAL_TX_RX;
+        msg_body.set_sta_key_params.key[0].pae_role = 0;
+        msg_body.set_sta_key_params.key[0].length = keylen;
+        memcpy(msg_body.set_sta_key_params.key[0].key, key, keylen);
+        msg_body.set_sta_key_params.single_tid_rc = 1;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_set_stakey failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_set_stakey response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_set_bsskey(struct wcn36xx *wcn,
+                           enum ani_ed_type enc_type,
+                           u8 keyidx,
+                           u8 keylen,
+                           u8 *key)
+{
+        struct wcn36xx_hal_set_bss_key_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_SET_BSSKEY_REQ);
+        msg_body.bss_idx = 0;
+        msg_body.enc_type = enc_type;
+        msg_body.num_keys = 1;
+        msg_body.keys[0].id = keyidx;
+        msg_body.keys[0].unicast = 0;
+        msg_body.keys[0].direction = WCN36XX_HAL_RX_ONLY;
+        msg_body.keys[0].pae_role = 0;
+        msg_body.keys[0].length = keylen;
+        memcpy(msg_body.keys[0].key, key, keylen);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_set_bsskey failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_set_bsskey response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_remove_stakey(struct wcn36xx *wcn,
+                              enum ani_ed_type enc_type,
+                              u8 keyidx,
+                              u8 sta_index)
+{
+        struct wcn36xx_hal_remove_sta_key_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_RMV_STAKEY_REQ);
+
+        msg_body.sta_idx = sta_index;
+        msg_body.enc_type = enc_type;
+        msg_body.key_id = keyidx;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_remove_stakey failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_remove_stakey response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_remove_bsskey(struct wcn36xx *wcn,
+                              enum ani_ed_type enc_type,
+                              u8 keyidx)
+{
+        struct wcn36xx_hal_remove_bss_key_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_RMV_BSSKEY_REQ);
+        msg_body.bss_idx = 0;
+        msg_body.enc_type = enc_type;
+        msg_body.key_id = keyidx;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_remove_bsskey failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_remove_bsskey response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_enter_bmps(struct wcn36xx *wcn, struct ieee80211_vif *vif)
+{
+        struct wcn36xx_hal_enter_bmps_req_msg msg_body;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_ENTER_BMPS_REQ);
+
+        msg_body.bss_index = vif_priv->bss_index;
+        msg_body.tbtt = vif->bss_conf.sync_tsf;
+        msg_body.dtim_period = vif_priv->dtim_period;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_enter_bmps failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_enter_bmps response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_exit_bmps(struct wcn36xx *wcn, struct ieee80211_vif *vif)
+{
+        struct wcn36xx_hal_enter_bmps_req_msg msg_body;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_EXIT_BMPS_REQ);
+
+        msg_body.bss_index = vif_priv->bss_index;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_exit_bmps failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_exit_bmps response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+int wcn36xx_smd_set_power_params(struct wcn36xx *wcn, bool ignore_dtim)
+{
+        struct wcn36xx_hal_set_power_params_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_SET_POWER_PARAMS_REQ);
+
+        /*
+         * When host is down ignore every second dtim
+         */
+        if (ignore_dtim) {
+                msg_body.ignore_dtim = 1;
+                msg_body.dtim_period = 2;
+        }
+        msg_body.listen_interval = WCN36XX_LISTEN_INTERVAL(wcn);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_set_power_params failed\n");
+                goto out;
+        }
+
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+/* Notice: This function should be called after associated, or else it
+ * will be invalid
+ */
+int wcn36xx_smd_keep_alive_req(struct wcn36xx *wcn,
+                               struct ieee80211_vif *vif,
+                               int packet_type)
+{
+        struct wcn36xx_hal_keep_alive_req_msg msg_body;
+        struct wcn36xx_vif *vif_priv = (struct wcn36xx_vif *)vif->drv_priv;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_KEEP_ALIVE_REQ);
+
+        if (packet_type == WCN36XX_HAL_KEEP_ALIVE_NULL_PKT) {
+                msg_body.bss_index = vif_priv->bss_index;
+                msg_body.packet_type = WCN36XX_HAL_KEEP_ALIVE_NULL_PKT;
+                msg_body.time_period = WCN36XX_KEEP_ALIVE_TIME_PERIOD;
+        } else if (packet_type == WCN36XX_HAL_KEEP_ALIVE_UNSOLICIT_ARP_RSP) {
+                /* TODO: it also support ARP response type */
+        } else {
+                wcn36xx_warn("unknow keep alive packet type %d\n", packet_type);
+                return -EINVAL;
+        }
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_exit_bmps failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_exit_bmps response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_dump_cmd_req(struct wcn36xx *wcn, u32 arg1, u32 arg2,
+                             u32 arg3, u32 arg4, u32 arg5)
+{
+        struct wcn36xx_hal_dump_cmd_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_DUMP_COMMAND_REQ);
+
+        msg_body.arg1 = arg1;
+        msg_body.arg2 = arg2;
+        msg_body.arg3 = arg3;
+        msg_body.arg4 = arg4;
+        msg_body.arg5 = arg5;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_dump_cmd failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_dump_cmd response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+static inline void set_feat_caps(u32 *bitmap,
+                                 enum place_holder_in_cap_bitmap cap)
+{
+        int arr_idx, bit_idx;
+
+        if (cap < 0 || cap > 127) {
+                wcn36xx_warn("error cap idx %d\n", cap);
+                return;
+        }
+
+        arr_idx = cap / 32;
+        bit_idx = cap % 32;
+        bitmap[arr_idx] |= (1 << bit_idx);
+}
+
+static inline int get_feat_caps(u32 *bitmap,
+                                enum place_holder_in_cap_bitmap cap)
+{
+        int arr_idx, bit_idx;
+        int ret = 0;
+
+        if (cap < 0 || cap > 127) {
+                wcn36xx_warn("error cap idx %d\n", cap);
+                return -EINVAL;
+        }
+
+        arr_idx = cap / 32;
+        bit_idx = cap % 32;
+        ret = (bitmap[arr_idx] & (1 << bit_idx)) ? 1 : 0;
+        return ret;
+}
+
+static inline void clear_feat_caps(u32 *bitmap,
+                                enum place_holder_in_cap_bitmap cap)
+{
+        int arr_idx, bit_idx;
+
+        if (cap < 0 || cap > 127) {
+                wcn36xx_warn("error cap idx %d\n", cap);
+                return;
+        }
+
+        arr_idx = cap / 32;
+        bit_idx = cap % 32;
+        bitmap[arr_idx] &= ~(1 << bit_idx);
+}
+
+int wcn36xx_smd_feature_caps_exchange(struct wcn36xx *wcn)
+{
+        struct wcn36xx_hal_feat_caps_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_FEATURE_CAPS_EXCHANGE_REQ);
+
+        set_feat_caps(msg_body.feat_caps, STA_POWERSAVE);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_feature_caps_exchange failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_feature_caps_exchange response failed err=%d\n",
+                            ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_add_ba_session(struct wcn36xx *wcn,
+                struct ieee80211_sta *sta,
+                u16 tid,
+                u16 *ssn,
+                u8 direction,
+                u8 sta_index)
+{
+        struct wcn36xx_hal_add_ba_session_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_ADD_BA_SESSION_REQ);
+
+        msg_body.sta_index = sta_index;
+        memcpy(&msg_body.mac_addr, sta->addr, ETH_ALEN);
+        msg_body.dialog_token = 0x10;
+        msg_body.tid = tid;
+
+        /* Immediate BA because Delayed BA is not supported */
+        msg_body.policy = 1;
+        msg_body.buffer_size = WCN36XX_AGGR_BUFFER_SIZE;
+        msg_body.timeout = 0;
+        if (ssn)
+                msg_body.ssn = *ssn;
+        msg_body.direction = direction;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_add_ba_session failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_add_ba_session response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_add_ba(struct wcn36xx *wcn)
+{
+        struct wcn36xx_hal_add_ba_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_ADD_BA_REQ);
+
+        msg_body.session_id = 0;
+        msg_body.win_size = WCN36XX_AGGR_BUFFER_SIZE;
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_add_ba failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_add_ba response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_del_ba(struct wcn36xx *wcn, u16 tid, u8 sta_index)
+{
+        struct wcn36xx_hal_del_ba_req_msg msg_body;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_DEL_BA_REQ);
+
+        msg_body.sta_index = sta_index;
+        msg_body.tid = tid;
+        msg_body.direction = 0;
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_del_ba failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_del_ba response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+int wcn36xx_smd_trigger_ba(struct wcn36xx *wcn, u8 sta_index)
+{
+        struct wcn36xx_hal_trigger_ba_req_msg msg_body;
+        struct wcn36xx_hal_trigget_ba_req_candidate *candidate;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_TRIGGER_BA_REQ);
+
+        msg_body.session_id = 0;
+        msg_body.candidate_cnt = 1;
+        msg_body.header.len += sizeof(*candidate);
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        candidate = (struct wcn36xx_hal_trigget_ba_req_candidate *)
+                (wcn->hal_buf + sizeof(msg_body));
+        candidate->sta_index = sta_index;
+        candidate->tid_bitmap = 1;
+
+        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_trigger_ba failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_trigger_ba response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+
+static int wcn36xx_smd_tx_compl_ind(struct wcn36xx *wcn, void *buf, size_t len)
+{
+        struct wcn36xx_hal_tx_compl_ind_msg *rsp = buf;
+
+        if (len != sizeof(*rsp)) {
+                wcn36xx_warn("Bad TX complete indication\n");
+                return -EIO;
+        }
+
+        wcn36xx_dxe_tx_ack_ind(wcn, rsp->status);
+
+        return 0;
+}
+
+static int wcn36xx_smd_missed_beacon_ind(struct wcn36xx *wcn,
+                                         void *buf,
+                                         size_t len)
+{
+        struct wcn36xx_hal_missed_beacon_ind_msg *rsp = buf;
+        struct ieee80211_vif *vif = NULL;
+        struct wcn36xx_vif *tmp;
+
+        /* Old FW does not have bss index */
+        if (wcn36xx_is_fw_version(wcn, 1, 2, 2, 24)) {
+                list_for_each_entry(tmp, &wcn->vif_list, list) {
+                        wcn36xx_dbg(WCN36XX_DBG_HAL, "beacon missed bss_index %d\n",
+                                    tmp->bss_index);
+                        vif = container_of((void *)tmp,
+                                                 struct ieee80211_vif,
+                                                 drv_priv);
+                        ieee80211_connection_loss(vif);
+                }
+                return 0;
+        }
+
+        if (len != sizeof(*rsp)) {
+                wcn36xx_warn("Corrupted missed beacon indication\n");
+                return -EIO;
+        }
+
+        list_for_each_entry(tmp, &wcn->vif_list, list) {
+                if (tmp->bss_index == rsp->bss_index) {
+                        wcn36xx_dbg(WCN36XX_DBG_HAL, "beacon missed bss_index %d\n",
+                                    rsp->bss_index);
+                        vif = container_of((void *)tmp,
+                                                 struct ieee80211_vif,
+                                                 drv_priv);
+                        ieee80211_connection_loss(vif);
+                        return 0;
+                }
+        }
+
+        wcn36xx_warn("BSS index %d not found\n", rsp->bss_index);
+        return -ENOENT;
+}
+
+static int wcn36xx_smd_delete_sta_context_ind(struct wcn36xx *wcn,
+                                              void *buf,
+                                              size_t len)
+{
+        struct wcn36xx_hal_delete_sta_context_ind_msg *rsp = buf;
+        struct wcn36xx_vif *tmp;
+        struct ieee80211_sta *sta = NULL;
+
+        if (len != sizeof(*rsp)) {
+                wcn36xx_warn("Corrupted delete sta indication\n");
+                return -EIO;
+        }
+
+        list_for_each_entry(tmp, &wcn->vif_list, list) {
+                if (sta && (tmp->sta->sta_index == rsp->sta_id)) {
+                        sta = container_of((void *)tmp->sta,
+                                                 struct ieee80211_sta,
+                                                 drv_priv);
+                        wcn36xx_dbg(WCN36XX_DBG_HAL,
+                                    "delete station indication %pM index %d\n",
+                                    rsp->addr2,
+                                    rsp->sta_id);
+                        ieee80211_report_low_ack(sta, 0);
+                        return 0;
+                }
+        }
+
+        wcn36xx_warn("STA with addr %pM and index %d not found\n",
+                     rsp->addr2,
+                     rsp->sta_id);
+        return -ENOENT;
+}
+
+int wcn36xx_smd_update_cfg(struct wcn36xx *wcn, u32 cfg_id, u32 value)
+{
+        struct wcn36xx_hal_update_cfg_req_msg msg_body, *body;
+        size_t len;
+        int ret = 0;
+
+        mutex_lock(&wcn->hal_mutex);
+        INIT_HAL_MSG(msg_body, WCN36XX_HAL_UPDATE_CFG_REQ);
+
+        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+
+        body = (struct wcn36xx_hal_update_cfg_req_msg *) wcn->hal_buf;
+        len = msg_body.header.len;
+
+        put_cfg_tlv_u32(wcn, &len, cfg_id, value);
+        body->header.len = len;
+        body->len = len - sizeof(*body);
+
+        ret = wcn36xx_smd_send_and_wait(wcn, body->header.len);
+        if (ret) {
+                wcn36xx_err("Sending hal_update_cfg failed\n");
+                goto out;
+        }
+        ret = wcn36xx_smd_rsp_status_check(wcn->hal_buf, wcn->hal_rsp_len);
+        if (ret) {
+                wcn36xx_err("hal_update_cfg response failed err=%d\n", ret);
+                goto out;
+        }
+out:
+        mutex_unlock(&wcn->hal_mutex);
+        return ret;
+}
+static void wcn36xx_smd_rsp_process(struct wcn36xx *wcn, void *buf, size_t len)
+{
+        struct wcn36xx_hal_msg_header *msg_header = buf;
+        struct wcn36xx_hal_ind_msg *msg_ind;
+        wcn36xx_dbg_dump(WCN36XX_DBG_SMD_DUMP, "SMD <<< ", buf, len);
+
+        switch (msg_header->msg_type) {
+        case WCN36XX_HAL_START_RSP:
+        case WCN36XX_HAL_CONFIG_STA_RSP:
+        case WCN36XX_HAL_CONFIG_BSS_RSP:
+        case WCN36XX_HAL_ADD_STA_SELF_RSP:
+        case WCN36XX_HAL_STOP_RSP:
+        case WCN36XX_HAL_DEL_STA_SELF_RSP:
+        case WCN36XX_HAL_DELETE_STA_RSP:
+        case WCN36XX_HAL_INIT_SCAN_RSP:
+        case WCN36XX_HAL_START_SCAN_RSP:
+        case WCN36XX_HAL_END_SCAN_RSP:
+        case WCN36XX_HAL_FINISH_SCAN_RSP:
+        case WCN36XX_HAL_DOWNLOAD_NV_RSP:
+        case WCN36XX_HAL_DELETE_BSS_RSP:
+        case WCN36XX_HAL_SEND_BEACON_RSP:
+        case WCN36XX_HAL_SET_LINK_ST_RSP:
+        case WCN36XX_HAL_UPDATE_PROBE_RSP_TEMPLATE_RSP:
+        case WCN36XX_HAL_SET_BSSKEY_RSP:
+        case WCN36XX_HAL_SET_STAKEY_RSP:
+        case WCN36XX_HAL_RMV_STAKEY_RSP:
+        case WCN36XX_HAL_RMV_BSSKEY_RSP:
+        case WCN36XX_HAL_ENTER_BMPS_RSP:
+        case WCN36XX_HAL_SET_POWER_PARAMS_RSP:
+        case WCN36XX_HAL_EXIT_BMPS_RSP:
+        case WCN36XX_HAL_KEEP_ALIVE_RSP:
+        case WCN36XX_HAL_DUMP_COMMAND_RSP:
+        case WCN36XX_HAL_ADD_BA_SESSION_RSP:
+        case WCN36XX_HAL_ADD_BA_RSP:
+        case WCN36XX_HAL_DEL_BA_RSP:
+        case WCN36XX_HAL_TRIGGER_BA_RSP:
+        case WCN36XX_HAL_UPDATE_CFG_RSP:
+        case WCN36XX_HAL_JOIN_RSP:
+        case WCN36XX_HAL_UPDATE_SCAN_PARAM_RSP:
+        case WCN36XX_HAL_CH_SWITCH_RSP:
+        case WCN36XX_HAL_FEATURE_CAPS_EXCHANGE_RSP:
+                memcpy(wcn->hal_buf, buf, len);
+                wcn->hal_rsp_len = len;
+                complete(&wcn->hal_rsp_compl);
+                break;
+
+        case WCN36XX_HAL_OTA_TX_COMPL_IND:
+        case WCN36XX_HAL_MISSED_BEACON_IND:
+        case WCN36XX_HAL_DELETE_STA_CONTEXT_IND:
+                mutex_lock(&wcn->hal_ind_mutex);
+                msg_ind = kmalloc(sizeof(*msg_ind), GFP_KERNEL);
+                msg_ind->msg_len = len;
+                msg_ind->msg = kmalloc(len, GFP_KERNEL);
+                memcpy(msg_ind->msg, buf, len);
+                list_add_tail(&msg_ind->list, &wcn->hal_ind_queue);
+                queue_work(wcn->hal_ind_wq, &wcn->hal_ind_work);
+                wcn36xx_dbg(WCN36XX_DBG_HAL, "indication arrived\n");
+                mutex_unlock(&wcn->hal_ind_mutex);
+                break;
+        default:
+                wcn36xx_err("SMD_EVENT (%d) not supported\n",
+                              msg_header->msg_type);
+        }
+}
+static void wcn36xx_ind_smd_work(struct work_struct *work)
+{
+        struct wcn36xx *wcn =
+                container_of(work, struct wcn36xx, hal_ind_work);
+        struct wcn36xx_hal_msg_header *msg_header;
+        struct wcn36xx_hal_ind_msg *hal_ind_msg;
+
+        mutex_lock(&wcn->hal_ind_mutex);
+
+        hal_ind_msg = list_first_entry(&wcn->hal_ind_queue,
+                                       struct wcn36xx_hal_ind_msg,
+                                       list);
+
+        msg_header = (struct wcn36xx_hal_msg_header *)hal_ind_msg->msg;
+
+        switch (msg_header->msg_type) {
+        case WCN36XX_HAL_OTA_TX_COMPL_IND:
+                wcn36xx_smd_tx_compl_ind(wcn,
+                                         hal_ind_msg->msg,
+                                         hal_ind_msg->msg_len);
+                break;
+        case WCN36XX_HAL_MISSED_BEACON_IND:
+                wcn36xx_smd_missed_beacon_ind(wcn,
+                                              hal_ind_msg->msg,
+                                              hal_ind_msg->msg_len);
+                break;
+        case WCN36XX_HAL_DELETE_STA_CONTEXT_IND:
+                wcn36xx_smd_delete_sta_context_ind(wcn,
+                                                   hal_ind_msg->msg,
+                                                   hal_ind_msg->msg_len);
+                break;
+        default:
+                wcn36xx_err("SMD_EVENT (%d) not supported\n",
+                              msg_header->msg_type);
+        }
+        list_del(wcn->hal_ind_queue.next);
+        kfree(hal_ind_msg->msg);
+        kfree(hal_ind_msg);
+        mutex_unlock(&wcn->hal_ind_mutex);
+}
+int wcn36xx_smd_open(struct wcn36xx *wcn)
+{
+        int ret = 0;
+        wcn->hal_ind_wq = create_freezable_workqueue("wcn36xx_smd_ind");
+        if (!wcn->hal_ind_wq) {
+                wcn36xx_err("failed to allocate wq\n");
+                ret = -ENOMEM;
+                goto out;
+        }
+        INIT_WORK(&wcn->hal_ind_work, wcn36xx_ind_smd_work);
+        INIT_LIST_HEAD(&wcn->hal_ind_queue);
+        mutex_init(&wcn->hal_ind_mutex);
+
+        ret = wcn->ctrl_ops->open(wcn, wcn36xx_smd_rsp_process);
+        if (ret) {
+                wcn36xx_err("failed to open control channel\n");
+                goto free_wq;
+        }
+
+        return ret;
+
+free_wq:
+        destroy_workqueue(wcn->hal_ind_wq);
+out:
+        return ret;
+}
+
+void wcn36xx_smd_close(struct wcn36xx *wcn)
+{
+        wcn->ctrl_ops->close();
+        destroy_workqueue(wcn->hal_ind_wq);
+        mutex_destroy(&wcn->hal_ind_mutex);
+}
diff --git a/drivers/net/wireless/ath/wcn36xx/smd.h b/drivers/net/wireless/ath/wcn36xx/smd.h
new file mode 100644
index 000000000000..e7c39019c6f1
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/smd.h
@@ -0,0 +1,127 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _SMD_H_
+#define _SMD_H_
+
+#include "wcn36xx.h"
+
+/* Max shared size is 4k but we take less.*/
+#define WCN36XX_NV_FRAGMENT_SIZE                        3072
+
+#define WCN36XX_HAL_BUF_SIZE                            4096
+
+#define HAL_MSG_TIMEOUT 200
+#define WCN36XX_SMSM_WLAN_TX_ENABLE                     0x00000400
+#define WCN36XX_SMSM_WLAN_TX_RINGS_EMPTY                0x00000200
+/* The PNO version info be contained in the rsp msg */
+#define WCN36XX_FW_MSG_PNO_VERSION_MASK                 0x8000
+
+enum wcn36xx_fw_msg_result {
+        WCN36XX_FW_MSG_RESULT_SUCCESS                   = 0,
+        WCN36XX_FW_MSG_RESULT_SUCCESS_SYNC              = 1,
+
+        WCN36XX_FW_MSG_RESULT_MEM_FAIL                  = 5,
+};
+
+/******************************/
+/* SMD requests and responses */
+/******************************/
+struct wcn36xx_fw_msg_status_rsp {
+        u32     status;
+} __packed;
+
+struct wcn36xx_hal_ind_msg {
+        struct list_head list;
+        u8 *msg;
+        size_t msg_len;
+};
+
+struct wcn36xx;
+
+int wcn36xx_smd_open(struct wcn36xx *wcn);
+void wcn36xx_smd_close(struct wcn36xx *wcn);
+
+int wcn36xx_smd_load_nv(struct wcn36xx *wcn);
+int wcn36xx_smd_start(struct wcn36xx *wcn);
+int wcn36xx_smd_stop(struct wcn36xx *wcn);
+int wcn36xx_smd_init_scan(struct wcn36xx *wcn, enum wcn36xx_hal_sys_mode mode);
+int wcn36xx_smd_start_scan(struct wcn36xx *wcn);
+int wcn36xx_smd_end_scan(struct wcn36xx *wcn);
+int wcn36xx_smd_finish_scan(struct wcn36xx *wcn,
+                            enum wcn36xx_hal_sys_mode mode);
+int wcn36xx_smd_update_scan_params(struct wcn36xx *wcn);
+int wcn36xx_smd_add_sta_self(struct wcn36xx *wcn, struct ieee80211_vif *vif);
+int wcn36xx_smd_delete_sta_self(struct wcn36xx *wcn, u8 *addr);
+int wcn36xx_smd_delete_sta(struct wcn36xx *wcn, u8 sta_index);
+int wcn36xx_smd_join(struct wcn36xx *wcn, const u8 *bssid, u8 *vif, u8 ch);
+int wcn36xx_smd_set_link_st(struct wcn36xx *wcn, const u8 *bssid,
+                            const u8 *sta_mac,
+                            enum wcn36xx_hal_link_state state);
+int wcn36xx_smd_config_bss(struct wcn36xx *wcn, struct ieee80211_vif *vif,
+                           struct ieee80211_sta *sta, const u8 *bssid,
+                           bool update);
+int wcn36xx_smd_delete_bss(struct wcn36xx *wcn, struct ieee80211_vif *vif);
+int wcn36xx_smd_config_sta(struct wcn36xx *wcn, struct ieee80211_vif *vif,
+                           struct ieee80211_sta *sta);
+int wcn36xx_smd_send_beacon(struct wcn36xx *wcn, struct ieee80211_vif *vif,
+                            struct sk_buff *skb_beacon, u16 tim_off,
+                            u16 p2p_off);
+int wcn36xx_smd_switch_channel(struct wcn36xx *wcn,
+                               struct ieee80211_vif *vif, int ch);
+int wcn36xx_smd_update_proberesp_tmpl(struct wcn36xx *wcn,
+                                      struct ieee80211_vif *vif,
+                                      struct sk_buff *skb);
+int wcn36xx_smd_set_stakey(struct wcn36xx *wcn,
+                           enum ani_ed_type enc_type,
+                           u8 keyidx,
+                           u8 keylen,
+                           u8 *key,
+                           u8 sta_index);
+int wcn36xx_smd_set_bsskey(struct wcn36xx *wcn,
+                           enum ani_ed_type enc_type,
+                           u8 keyidx,
+                           u8 keylen,
+                           u8 *key);
+int wcn36xx_smd_remove_stakey(struct wcn36xx *wcn,
+                              enum ani_ed_type enc_type,
+                              u8 keyidx,
+                              u8 sta_index);
+int wcn36xx_smd_remove_bsskey(struct wcn36xx *wcn,
+                              enum ani_ed_type enc_type,
+                              u8 keyidx);
+int wcn36xx_smd_enter_bmps(struct wcn36xx *wcn, struct ieee80211_vif *vif);
+int wcn36xx_smd_exit_bmps(struct wcn36xx *wcn, struct ieee80211_vif *vif);
+int wcn36xx_smd_set_power_params(struct wcn36xx *wcn, bool ignore_dtim);
+int wcn36xx_smd_keep_alive_req(struct wcn36xx *wcn,
+                               struct ieee80211_vif *vif,
+                               int packet_type);
+int wcn36xx_smd_dump_cmd_req(struct wcn36xx *wcn, u32 arg1, u32 arg2,
+                             u32 arg3, u32 arg4, u32 arg5);
+int wcn36xx_smd_feature_caps_exchange(struct wcn36xx *wcn);
+
+int wcn36xx_smd_add_ba_session(struct wcn36xx *wcn,
+                struct ieee80211_sta *sta,
+                u16 tid,
+                u16 *ssn,
+                u8 direction,
+                u8 sta_index);
+int wcn36xx_smd_add_ba(struct wcn36xx *wcn);
+int wcn36xx_smd_del_ba(struct wcn36xx *wcn, u16 tid, u8 sta_index);
+int wcn36xx_smd_trigger_ba(struct wcn36xx *wcn, u8 sta_index);
+
+int wcn36xx_smd_update_cfg(struct wcn36xx *wcn, u32 cfg_id, u32 value);
+#endif  /* _SMD_H_ */
diff --git a/drivers/net/wireless/ath/wcn36xx/txrx.c b/drivers/net/wireless/ath/wcn36xx/txrx.c
new file mode 100644
index 000000000000..b2b60e30caaf
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/txrx.c
@@ -0,0 +1,284 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include "txrx.h"
+
+static inline int get_rssi0(struct wcn36xx_rx_bd *bd)
+{
+        return 100 - ((bd->phy_stat0 >> 24) & 0xff);
+}
+
+int wcn36xx_rx_skb(struct wcn36xx *wcn, struct sk_buff *skb)
+{
+        struct ieee80211_rx_status status;
+        struct ieee80211_hdr *hdr;
+        struct wcn36xx_rx_bd *bd;
+        u16 fc, sn;
+
+        /*
+         * All fields must be 0, otherwise it can lead to
+         * unexpected consequences.
+         */
+        memset(&status, 0, sizeof(status));
+
+        bd = (struct wcn36xx_rx_bd *)skb->data;
+        buff_to_be((u32 *)bd, sizeof(*bd)/sizeof(u32));
+        wcn36xx_dbg_dump(WCN36XX_DBG_RX_DUMP,
+                         "BD   <<< ", (char *)bd,
+                         sizeof(struct wcn36xx_rx_bd));
+
+        skb_put(skb, bd->pdu.mpdu_header_off + bd->pdu.mpdu_len);
+        skb_pull(skb, bd->pdu.mpdu_header_off);
+
+        status.mactime = 10;
+        status.freq = WCN36XX_CENTER_FREQ(wcn);
+        status.band = WCN36XX_BAND(wcn);
+        status.signal = -get_rssi0(bd);
+        status.antenna = 1;
+        status.rate_idx = 1;
+        status.flag = 0;
+        status.rx_flags = 0;
+        status.flag |= RX_FLAG_IV_STRIPPED |
+                       RX_FLAG_MMIC_STRIPPED |
+                       RX_FLAG_DECRYPTED;
+
+        wcn36xx_dbg(WCN36XX_DBG_RX, "status.flags=%x status->vendor_radiotap_len=%x\n",
+                    status.flag,  status.vendor_radiotap_len);
+
+        memcpy(IEEE80211_SKB_RXCB(skb), &status, sizeof(status));
+
+        hdr = (struct ieee80211_hdr *) skb->data;
+        fc = __le16_to_cpu(hdr->frame_control);
+        sn = IEEE80211_SEQ_TO_SN(__le16_to_cpu(hdr->seq_ctrl));
+
+        if (ieee80211_is_beacon(hdr->frame_control)) {
+                wcn36xx_dbg(WCN36XX_DBG_BEACON, "beacon skb %p len %d fc %04x sn %d\n",
+                            skb, skb->len, fc, sn);
+                wcn36xx_dbg_dump(WCN36XX_DBG_BEACON_DUMP, "SKB <<< ",
+                                 (char *)skb->data, skb->len);
+        } else {
+                wcn36xx_dbg(WCN36XX_DBG_RX, "rx skb %p len %d fc %04x sn %d\n",
+                            skb, skb->len, fc, sn);
+                wcn36xx_dbg_dump(WCN36XX_DBG_RX_DUMP, "SKB <<< ",
+                                 (char *)skb->data, skb->len);
+        }
+
+        ieee80211_rx_irqsafe(wcn->hw, skb);
+
+        return 0;
+}
+
+static void wcn36xx_set_tx_pdu(struct wcn36xx_tx_bd *bd,
+                               u32 mpdu_header_len,
+                               u32 len,
+                               u16 tid)
+{
+        bd->pdu.mpdu_header_len = mpdu_header_len;
+        bd->pdu.mpdu_header_off = sizeof(*bd);
+        bd->pdu.mpdu_data_off = bd->pdu.mpdu_header_len +
+                bd->pdu.mpdu_header_off;
+        bd->pdu.mpdu_len = len;
+        bd->pdu.tid = tid;
+}
+
+static inline struct wcn36xx_vif *get_vif_by_addr(struct wcn36xx *wcn,
+                                                  u8 *addr)
+{
+        struct wcn36xx_vif *vif_priv = NULL;
+        struct ieee80211_vif *vif = NULL;
+        list_for_each_entry(vif_priv, &wcn->vif_list, list) {
+                        vif = container_of((void *)vif_priv,
+                                   struct ieee80211_vif,
+                                   drv_priv);
+                        if (memcmp(vif->addr, addr, ETH_ALEN) == 0)
+                                return vif_priv;
+        }
+        wcn36xx_warn("vif %pM not found\n", addr);
+        return NULL;
+}
+static void wcn36xx_set_tx_data(struct wcn36xx_tx_bd *bd,
+                                struct wcn36xx *wcn,
+                                struct wcn36xx_vif **vif_priv,
+                                struct wcn36xx_sta *sta_priv,
+                                struct ieee80211_hdr *hdr,
+                                bool bcast)
+{
+        struct ieee80211_vif *vif = NULL;
+        struct wcn36xx_vif *__vif_priv = NULL;
+        bd->bd_rate = WCN36XX_BD_RATE_DATA;
+
+        /*
+         * For not unicast frames mac80211 will not set sta pointer so use
+         * self_sta_index instead.
+         */
+        if (sta_priv) {
+                __vif_priv = sta_priv->vif;
+                vif = container_of((void *)__vif_priv,
+                                   struct ieee80211_vif,
+                                   drv_priv);
+
+                if (vif->type == NL80211_IFTYPE_STATION) {
+                        bd->sta_index = sta_priv->bss_sta_index;
+                        bd->dpu_desc_idx = sta_priv->bss_dpu_desc_index;
+                } else if (vif->type == NL80211_IFTYPE_AP ||
+                           vif->type == NL80211_IFTYPE_ADHOC ||
+                           vif->type == NL80211_IFTYPE_MESH_POINT) {
+                        bd->sta_index = sta_priv->sta_index;
+                        bd->dpu_desc_idx = sta_priv->dpu_desc_index;
+                }
+        } else {
+                __vif_priv = get_vif_by_addr(wcn, hdr->addr2);
+                bd->sta_index = __vif_priv->self_sta_index;
+                bd->dpu_desc_idx = __vif_priv->self_dpu_desc_index;
+        }
+
+        bd->dpu_sign = __vif_priv->ucast_dpu_signature;
+
+        if (ieee80211_is_nullfunc(hdr->frame_control) ||
+           (sta_priv && !sta_priv->is_data_encrypted))
+                bd->dpu_ne = 1;
+
+        if (bcast) {
+                bd->ub = 1;
+                bd->ack_policy = 1;
+        }
+        *vif_priv = __vif_priv;
+}
+
+static void wcn36xx_set_tx_mgmt(struct wcn36xx_tx_bd *bd,
+                                struct wcn36xx *wcn,
+                                struct wcn36xx_vif **vif_priv,
+                                struct ieee80211_hdr *hdr,
+                                bool bcast)
+{
+        struct wcn36xx_vif *__vif_priv =
+                get_vif_by_addr(wcn, hdr->addr2);
+        bd->sta_index = __vif_priv->self_sta_index;
+        bd->dpu_desc_idx = __vif_priv->self_dpu_desc_index;
+        bd->dpu_ne = 1;
+
+        /* default rate for unicast */
+        if (ieee80211_is_mgmt(hdr->frame_control))
+                bd->bd_rate = (WCN36XX_BAND(wcn) == IEEE80211_BAND_5GHZ) ?
+                        WCN36XX_BD_RATE_CTRL :
+                        WCN36XX_BD_RATE_MGMT;
+        else if (ieee80211_is_ctl(hdr->frame_control))
+                bd->bd_rate = WCN36XX_BD_RATE_CTRL;
+        else
+                wcn36xx_warn("frame control type unknown\n");
+
+        /*
+         * In joining state trick hardware that probe is sent as
+         * unicast even if address is broadcast.
+         */
+        if (__vif_priv->is_joining &&
+            ieee80211_is_probe_req(hdr->frame_control))
+                bcast = false;
+
+        if (bcast) {
+                /* broadcast */
+                bd->ub = 1;
+                /* No ack needed not unicast */
+                bd->ack_policy = 1;
+                bd->queue_id = WCN36XX_TX_B_WQ_ID;
+        } else
+                bd->queue_id = WCN36XX_TX_U_WQ_ID;
+        *vif_priv = __vif_priv;
+}
+
+int wcn36xx_start_tx(struct wcn36xx *wcn,
+                     struct wcn36xx_sta *sta_priv,
+                     struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        struct wcn36xx_vif *vif_priv = NULL;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        unsigned long flags;
+        bool is_low = ieee80211_is_data(hdr->frame_control);
+        bool bcast = is_broadcast_ether_addr(hdr->addr1) ||
+                is_multicast_ether_addr(hdr->addr1);
+        struct wcn36xx_tx_bd *bd = wcn36xx_dxe_get_next_bd(wcn, is_low);
+
+        if (!bd) {
+                /*
+                 * TX DXE are used in pairs. One for the BD and one for the
+                 * actual frame. The BD DXE's has a preallocated buffer while
+                 * the skb ones does not. If this isn't true something is really
+                 * wierd. TODO: Recover from this situation
+                 */
+
+                wcn36xx_err("bd address may not be NULL for BD DXE\n");
+                return -EINVAL;
+        }
+
+        memset(bd, 0, sizeof(*bd));
+
+        wcn36xx_dbg(WCN36XX_DBG_TX,
+                    "tx skb %p len %d fc %04x sn %d %s %s\n",
+                    skb, skb->len, __le16_to_cpu(hdr->frame_control),
+                    IEEE80211_SEQ_TO_SN(__le16_to_cpu(hdr->seq_ctrl)),
+                    is_low ? "low" : "high", bcast ? "bcast" : "ucast");
+
+        wcn36xx_dbg_dump(WCN36XX_DBG_TX_DUMP, "", skb->data, skb->len);
+
+        bd->dpu_rf = WCN36XX_BMU_WQ_TX;
+
+        bd->tx_comp = info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS;
+        if (bd->tx_comp) {
+                wcn36xx_dbg(WCN36XX_DBG_DXE, "TX_ACK status requested\n");
+                spin_lock_irqsave(&wcn->dxe_lock, flags);
+                if (wcn->tx_ack_skb) {
+                        spin_unlock_irqrestore(&wcn->dxe_lock, flags);
+                        wcn36xx_warn("tx_ack_skb already set\n");
+                        return -EINVAL;
+                }
+
+                wcn->tx_ack_skb = skb;
+                spin_unlock_irqrestore(&wcn->dxe_lock, flags);
+
+                /* Only one at a time is supported by fw. Stop the TX queues
+                 * until the ack status gets back.
+                 *
+                 * TODO: Add watchdog in case FW does not answer
+                 */
+                ieee80211_stop_queues(wcn->hw);
+        }
+
+        /* Data frames served first*/
+        if (is_low) {
+                wcn36xx_set_tx_data(bd, wcn, &vif_priv, sta_priv, hdr, bcast);
+                wcn36xx_set_tx_pdu(bd,
+                           ieee80211_is_data_qos(hdr->frame_control) ?
+                           sizeof(struct ieee80211_qos_hdr) :
+                           sizeof(struct ieee80211_hdr_3addr),
+                           skb->len, sta_priv ? sta_priv->tid : 0);
+        } else {
+                /* MGMT and CTRL frames are handeld here*/
+                wcn36xx_set_tx_mgmt(bd, wcn, &vif_priv, hdr, bcast);
+                wcn36xx_set_tx_pdu(bd,
+                           ieee80211_is_data_qos(hdr->frame_control) ?
+                           sizeof(struct ieee80211_qos_hdr) :
+                           sizeof(struct ieee80211_hdr_3addr),
+                           skb->len, WCN36XX_TID);
+        }
+
+        buff_to_be((u32 *)bd, sizeof(*bd)/sizeof(u32));
+        bd->tx_bd_sign = 0xbdbdbdbd;
+
+        return wcn36xx_dxe_tx_frame(wcn, vif_priv, skb, is_low);
+}
diff --git a/drivers/net/wireless/ath/wcn36xx/txrx.h b/drivers/net/wireless/ath/wcn36xx/txrx.h
new file mode 100644
index 000000000000..bbfbcf808c77
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/txrx.h
@@ -0,0 +1,160 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _TXRX_H_
+#define _TXRX_H_
+
+#include <linux/etherdevice.h>
+#include "wcn36xx.h"
+
+/* TODO describe all properties */
+#define WCN36XX_802_11_HEADER_LEN       24
+#define WCN36XX_BMU_WQ_TX               25
+#define WCN36XX_TID                     7
+/* broadcast wq ID */
+#define WCN36XX_TX_B_WQ_ID              0xA
+#define WCN36XX_TX_U_WQ_ID              0x9
+/* bd_rate */
+#define WCN36XX_BD_RATE_DATA 0
+#define WCN36XX_BD_RATE_MGMT 2
+#define WCN36XX_BD_RATE_CTRL 3
+
+struct wcn36xx_pdu {
+        u32     dpu_fb:8;
+        u32     adu_fb:8;
+        u32     pdu_id:16;
+
+        /* 0x04*/
+        u32     tail_pdu_idx:16;
+        u32     head_pdu_idx:16;
+
+        /* 0x08*/
+        u32     pdu_count:7;
+        u32     mpdu_data_off:9;
+        u32     mpdu_header_off:8;
+        u32     mpdu_header_len:8;
+
+        /* 0x0c*/
+        u32     reserved4:8;
+        u32     tid:4;
+        u32     reserved3:4;
+        u32     mpdu_len:16;
+};
+
+struct wcn36xx_rx_bd {
+        u32     bdt:2;
+        u32     ft:1;
+        u32     dpu_ne:1;
+        u32     rx_key_id:3;
+        u32     ub:1;
+        u32     rmf:1;
+        u32     uma_bypass:1;
+        u32     csr11:1;
+        u32     reserved0:1;
+        u32     scan_learn:1;
+        u32     rx_ch:4;
+        u32     rtsf:1;
+        u32     bsf:1;
+        u32     a2hf:1;
+        u32     st_auf:1;
+        u32     dpu_sign:3;
+        u32     dpu_rf:8;
+
+        struct wcn36xx_pdu pdu;
+
+        /* 0x14*/
+        u32     addr3:8;
+        u32     addr2:8;
+        u32     addr1:8;
+        u32     dpu_desc_idx:8;
+
+        /* 0x18*/
+        u32     rxp_flags:23;
+        u32     rate_id:9;
+
+        u32     phy_stat0;
+        u32     phy_stat1;
+
+        /* 0x24 */
+        u32     rx_times;
+
+        u32     pmi_cmd[6];
+
+        /* 0x40 */
+        u32     reserved7:4;
+        u32     reorder_slot_id:6;
+        u32     reorder_fwd_id:6;
+        u32     reserved6:12;
+        u32     reorder_code:4;
+
+        /* 0x44 */
+        u32     exp_seq_num:12;
+        u32     cur_seq_num:12;
+        u32     fr_type_subtype:8;
+
+        /* 0x48 */
+        u32     msdu_size:16;
+        u32     sub_fr_id:4;
+        u32     proc_order:4;
+        u32     reserved9:4;
+        u32     aef:1;
+        u32     lsf:1;
+        u32     esf:1;
+        u32     asf:1;
+};
+
+struct wcn36xx_tx_bd {
+        u32     bdt:2;
+        u32     ft:1;
+        u32     dpu_ne:1;
+        u32     fw_tx_comp:1;
+        u32     tx_comp:1;
+        u32     reserved1:1;
+        u32     ub:1;
+        u32     rmf:1;
+        u32     reserved0:12;
+        u32     dpu_sign:3;
+        u32     dpu_rf:8;
+
+        struct wcn36xx_pdu pdu;
+
+        /* 0x14*/
+        u32     reserved5:7;
+        u32     queue_id:5;
+        u32     bd_rate:2;
+        u32     ack_policy:2;
+        u32     sta_index:8;
+        u32     dpu_desc_idx:8;
+
+        u32     tx_bd_sign;
+        u32     reserved6;
+        u32     dxe_start_time;
+        u32     dxe_end_time;
+
+        /*u32   tcp_udp_start_off:10;
+        u32     header_cks:16;
+        u32     reserved7:6;*/
+};
+
+struct wcn36xx_sta;
+struct wcn36xx;
+
+int  wcn36xx_rx_skb(struct wcn36xx *wcn, struct sk_buff *skb);
+int wcn36xx_start_tx(struct wcn36xx *wcn,
+                     struct wcn36xx_sta *sta_priv,
+                     struct sk_buff *skb);
+
+#endif  /* _TXRX_H_ */
diff --git a/drivers/net/wireless/ath/wcn36xx/wcn36xx.h b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
new file mode 100644
index 000000000000..58b63833e8e7
--- /dev/null
+++ b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
@@ -0,0 +1,238 @@
+/*
+ * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _WCN36XX_H_
+#define _WCN36XX_H_
+
+#include <linux/completion.h>
+#include <linux/printk.h>
+#include <linux/spinlock.h>
+#include <net/mac80211.h>
+
+#include "hal.h"
+#include "smd.h"
+#include "txrx.h"
+#include "dxe.h"
+#include "pmc.h"
+#include "debug.h"
+
+#define WLAN_NV_FILE               "wlan/prima/WCNSS_qcom_wlan_nv.bin"
+#define WCN36XX_AGGR_BUFFER_SIZE 64
+
+extern unsigned int wcn36xx_dbg_mask;
+
+enum wcn36xx_debug_mask {
+        WCN36XX_DBG_DXE         = 0x00000001,
+        WCN36XX_DBG_DXE_DUMP    = 0x00000002,
+        WCN36XX_DBG_SMD         = 0x00000004,
+        WCN36XX_DBG_SMD_DUMP    = 0x00000008,
+        WCN36XX_DBG_RX          = 0x00000010,
+        WCN36XX_DBG_RX_DUMP     = 0x00000020,
+        WCN36XX_DBG_TX          = 0x00000040,
+        WCN36XX_DBG_TX_DUMP     = 0x00000080,
+        WCN36XX_DBG_HAL         = 0x00000100,
+        WCN36XX_DBG_HAL_DUMP    = 0x00000200,
+        WCN36XX_DBG_MAC         = 0x00000400,
+        WCN36XX_DBG_BEACON      = 0x00000800,
+        WCN36XX_DBG_BEACON_DUMP = 0x00001000,
+        WCN36XX_DBG_PMC         = 0x00002000,
+        WCN36XX_DBG_PMC_DUMP    = 0x00004000,
+        WCN36XX_DBG_ANY         = 0xffffffff,
+};
+
+#define wcn36xx_err(fmt, arg...)                                \
+        printk(KERN_ERR pr_fmt("ERROR " fmt), ##arg);
+
+#define wcn36xx_warn(fmt, arg...)                               \
+        printk(KERN_WARNING pr_fmt("WARNING " fmt), ##arg)
+
+#define wcn36xx_info(fmt, arg...)               \
+        printk(KERN_INFO pr_fmt(fmt), ##arg)
+
+#define wcn36xx_dbg(mask, fmt, arg...) do {                     \
+        if (wcn36xx_dbg_mask & mask)                                    \
+                printk(KERN_DEBUG pr_fmt(fmt), ##arg);  \
+} while (0)
+
+#define wcn36xx_dbg_dump(mask, prefix_str, buf, len) do {       \
+        if (wcn36xx_dbg_mask & mask)                                    \
+                print_hex_dump(KERN_DEBUG, pr_fmt(prefix_str),  \
+                               DUMP_PREFIX_OFFSET, 32, 1,       \
+                               buf, len, false);                \
+} while (0)
+
+#define WCN36XX_HW_CHANNEL(__wcn) (__wcn->hw->conf.chandef.chan->hw_value)
+#define WCN36XX_BAND(__wcn) (__wcn->hw->conf.chandef.chan->band)
+#define WCN36XX_CENTER_FREQ(__wcn) (__wcn->hw->conf.chandef.chan->center_freq)
+#define WCN36XX_LISTEN_INTERVAL(__wcn) (__wcn->hw->conf.listen_interval)
+#define WCN36XX_FLAGS(__wcn) (__wcn->hw->flags)
+#define WCN36XX_MAX_POWER(__wcn) (__wcn->hw->conf.chandef.chan->max_power)
+
+static inline void buff_to_be(u32 *buf, size_t len)
+{
+        int i;
+        for (i = 0; i < len; i++)
+                buf[i] = cpu_to_be32(buf[i]);
+}
+
+struct nv_data {
+        int     is_valid;
+        u8      table;
+};
+
+/* Interface for platform control path
+ *
+ * @open: hook must be called when wcn36xx wants to open control channel.
+ * @tx: sends a buffer.
+ */
+struct wcn36xx_platform_ctrl_ops {
+        int (*open)(void *drv_priv, void *rsp_cb);
+        void (*close)(void);
+        int (*tx)(char *buf, size_t len);
+        int (*get_hw_mac)(u8 *addr);
+        int (*smsm_change_state)(u32 clear_mask, u32 set_mask);
+};
+
+/**
+ * struct wcn36xx_vif - holds VIF related fields
+ *
+ * @bss_index: bss_index is initially set to 0xFF. bss_index is received from
+ * HW after first config_bss call and must be used in delete_bss and
+ * enter/exit_bmps.
+ */
+struct wcn36xx_vif {
+        struct list_head list;
+        struct wcn36xx_sta *sta;
+        u8 dtim_period;
+        enum ani_ed_type encrypt_type;
+        bool is_joining;
+        struct wcn36xx_hal_mac_ssid ssid;
+
+        /* Power management */
+        enum wcn36xx_power_state pw_state;
+
+        u8 bss_index;
+        u8 ucast_dpu_signature;
+        /* Returned from WCN36XX_HAL_ADD_STA_SELF_RSP */
+        u8 self_sta_index;
+        u8 self_dpu_desc_index;
+};
+
+/**
+ * struct wcn36xx_sta - holds STA related fields
+ *
+ * @tid: traffic ID that is used during AMPDU and in TX BD.
+ * @sta_index: STA index is returned from HW after config_sta call and is
+ * used in both SMD channel and TX BD.
+ * @dpu_desc_index: DPU descriptor index is returned from HW after config_sta
+ * call and is used in TX BD.
+ * @bss_sta_index: STA index is returned from HW after config_bss call and is
+ * used in both SMD channel and TX BD. See table bellow when it is used.
+ * @bss_dpu_desc_index: DPU descriptor index is returned from HW after
+ * config_bss call and is used in TX BD.
+ * ______________________________________________
+ * |              |     STA     |       AP      |
+ * |______________|_____________|_______________|
+ * |    TX BD     |bss_sta_index|   sta_index   |
+ * |______________|_____________|_______________|
+ * |all SMD calls |bss_sta_index|   sta_index   |
+ * |______________|_____________|_______________|
+ * |smd_delete_sta|  sta_index  |   sta_index   |
+ * |______________|_____________|_______________|
+ */
+struct wcn36xx_sta {
+        struct wcn36xx_vif *vif;
+        u16 aid;
+        u16 tid;
+        u8 sta_index;
+        u8 dpu_desc_index;
+        u8 bss_sta_index;
+        u8 bss_dpu_desc_index;
+        bool is_data_encrypted;
+        /* Rates */
+        struct wcn36xx_hal_supported_rates supported_rates;
+};
+struct wcn36xx_dxe_ch;
+struct wcn36xx {
+        struct ieee80211_hw     *hw;
+        struct device           *dev;
+        struct list_head        vif_list;
+
+        u8                      fw_revision;
+        u8                      fw_version;
+        u8                      fw_minor;
+        u8                      fw_major;
+
+        /* extra byte for the NULL termination */
+        u8                      crm_version[WCN36XX_HAL_VERSION_LENGTH + 1];
+        u8                      wlan_version[WCN36XX_HAL_VERSION_LENGTH + 1];
+
+        /* IRQs */
+        int                     tx_irq;
+        int                     rx_irq;
+        void __iomem            *mmio;
+
+        struct wcn36xx_platform_ctrl_ops *ctrl_ops;
+        /*
+         * smd_buf must be protected with smd_mutex to garantee
+         * that all messages are sent one after another
+         */
+        u8                      *hal_buf;
+        size_t                  hal_rsp_len;
+        struct mutex            hal_mutex;
+        struct completion       hal_rsp_compl;
+        struct workqueue_struct *hal_ind_wq;
+        struct work_struct      hal_ind_work;
+        struct mutex            hal_ind_mutex;
+        struct list_head        hal_ind_queue;
+
+        /* DXE channels */
+        struct wcn36xx_dxe_ch   dxe_tx_l_ch;    /* TX low */
+        struct wcn36xx_dxe_ch   dxe_tx_h_ch;    /* TX high */
+        struct wcn36xx_dxe_ch   dxe_rx_l_ch;    /* RX low */
+        struct wcn36xx_dxe_ch   dxe_rx_h_ch;    /* RX high */
+
+        /* For synchronization of DXE resources from BH, IRQ and WQ contexts */
+        spinlock_t      dxe_lock;
+        bool                    queues_stopped;
+
+        /* Memory pools */
+        struct wcn36xx_dxe_mem_pool mgmt_mem_pool;
+        struct wcn36xx_dxe_mem_pool data_mem_pool;
+
+        struct sk_buff          *tx_ack_skb;
+
+#ifdef CONFIG_WCN36XX_DEBUGFS
+        /* Debug file system entry */
+        struct wcn36xx_dfs_entry    dfs;
+#endif /* CONFIG_WCN36XX_DEBUGFS */
+
+};
+
+static inline bool wcn36xx_is_fw_version(struct wcn36xx *wcn,
+                                         u8 major,
+                                         u8 minor,
+                                         u8 version,
+                                         u8 revision)
+{
+        return (wcn->fw_major == major &&
+                wcn->fw_minor == minor &&
+                wcn->fw_version == version &&
+                wcn->fw_revision == revision);
+}
+void wcn36xx_set_default_rates(struct wcn36xx_hal_supported_rates *rates);
+
+#endif  /* _WCN36XX_H_ */
diff --git a/drivers/net/wireless/ath/wil6210/pcie_bus.c b/drivers/net/wireless/ath/wil6210/pcie_bus.c
index eb1dc7ad80fb..eeceab39cda2 100644
--- a/drivers/net/wireless/ath/wil6210/pcie_bus.c
+++ b/drivers/net/wireless/ath/wil6210/pcie_bus.c
@@ -197,7 +197,6 @@ static void wil_pcie_remove(struct pci_dev *pdev)
         pci_iounmap(pdev, wil->csr);
         pci_release_region(pdev, 0);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
 }
 
 static DEFINE_PCI_DEVICE_TABLE(wil6210_pcie_ids) = {
diff --git a/drivers/net/wireless/brcm80211/Kconfig b/drivers/net/wireless/brcm80211/Kconfig
index fc8a0fa6d3b2..b00a7e92225f 100644
--- a/drivers/net/wireless/brcm80211/Kconfig
+++ b/drivers/net/wireless/brcm80211/Kconfig
@@ -28,7 +28,7 @@ config BRCMFMAC
 
 config BRCMFMAC_SDIO
         bool "SDIO bus interface support for FullMAC driver"
-        depends on MMC
+        depends on (MMC = y || MMC = BRCMFMAC)
         depends on BRCMFMAC
         select FW_LOADER
         default y
@@ -39,7 +39,7 @@ config BRCMFMAC_SDIO
 
 config BRCMFMAC_USB
         bool "USB bus interface support for FullMAC driver"
-        depends on USB
+        depends on (USB = y || USB = BRCMFMAC)
         depends on BRCMFMAC
         select FW_LOADER
         ---help---
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
index 64f4a2bc8dde..091c905871cc 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
@@ -34,6 +34,7 @@
 #include <brcmu_utils.h>
 #include <brcmu_wifi.h>
 #include "sdio_host.h"
+#include "sdio_chip.h"
 #include "dhd_dbg.h"
 #include "dhd_bus.h"
 
@@ -41,13 +42,6 @@
 
 #define DMA_ALIGN_MASK  0x03
 
-#define SDIO_DEVICE_ID_BROADCOM_43143   43143
-#define SDIO_DEVICE_ID_BROADCOM_43241   0x4324
-#define SDIO_DEVICE_ID_BROADCOM_4329    0x4329
-#define SDIO_DEVICE_ID_BROADCOM_4330    0x4330
-#define SDIO_DEVICE_ID_BROADCOM_4334    0x4334
-#define SDIO_DEVICE_ID_BROADCOM_4335    0x4335
-
 #define SDIO_FUNC1_BLOCKSIZE            64
 #define SDIO_FUNC2_BLOCKSIZE            512
 
@@ -58,7 +52,8 @@ static const struct sdio_device_id brcmf_sdmmc_ids[] = {
         {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4329)},
         {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4330)},
         {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4334)},
-        {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4335)},
+        {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM,
+                     SDIO_DEVICE_ID_BROADCOM_4335_4339)},
         { /* end: all zeroes */ },
 };
 MODULE_DEVICE_TABLE(sdio, brcmf_sdmmc_ids);
@@ -468,7 +463,7 @@ static int brcmf_sdio_pd_probe(struct platform_device *pdev)
 
         brcmf_dbg(SDIO, "Enter\n");
 
-        brcmfmac_sdio_pdata = pdev->dev.platform_data;
+        brcmfmac_sdio_pdata = dev_get_platdata(&pdev->dev);
 
         if (brcmfmac_sdio_pdata->power_on)
                 brcmfmac_sdio_pdata->power_on();
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
index 2eb9e642c9bf..4de9aac6666d 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
@@ -97,8 +97,6 @@
 #define WLC_PHY_TYPE_LCN        8
 #define WLC_PHY_TYPE_NULL       0xf
 
-#define BRCMF_EVENTING_MASK_LEN 16
-
 #define TOE_TX_CSUM_OL          0x00000001
 #define TOE_RX_CSUM_OL          0x00000002
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
index f7c1985844e4..200ee9b485bf 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
@@ -136,7 +136,7 @@ extern bool brcmf_c_prec_enq(struct device *dev, struct pktq *q,
                          struct sk_buff *pkt, int prec);
 
 /* Receive frame for delivery to OS.  Callee disposes of rxp. */
-extern void brcmf_rx_frames(struct device *dev, struct sk_buff_head *rxlist);
+extern void brcmf_rx_frame(struct device *dev, struct sk_buff *rxp);
 
 /* Indication from bus module regarding presence/insertion of dongle. */
 extern int brcmf_attach(uint bus_hdrlen, struct device *dev);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
index e067aec1fbf1..42bf19a2eeee 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
@@ -509,9 +509,8 @@ netif_rx:
         }
 }
 
-void brcmf_rx_frames(struct device *dev, struct sk_buff_head *skb_list)
+void brcmf_rx_frame(struct device *dev, struct sk_buff *skb)
 {
-        struct sk_buff *skb, *pnext;
         struct brcmf_if *ifp;
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
         struct brcmf_pub *drvr = bus_if->drvr;
@@ -519,29 +518,24 @@ void brcmf_rx_frames(struct device *dev, struct sk_buff_head *skb_list)
         u8 ifidx;
         int ret;
 
-        brcmf_dbg(DATA, "Enter: %s: count=%u\n", dev_name(dev),
-                  skb_queue_len(skb_list));
+        brcmf_dbg(DATA, "Enter: %s: rxp=%p\n", dev_name(dev), skb);
 
-        skb_queue_walk_safe(skb_list, skb, pnext) {
-                skb_unlink(skb, skb_list);
-
-                /* process and remove protocol-specific header */
-                ret = brcmf_proto_hdrpull(drvr, true, &ifidx, skb);
-                ifp = drvr->iflist[ifidx];
-
-                if (ret || !ifp || !ifp->ndev) {
-                        if ((ret != -ENODATA) && ifp)
-                                ifp->stats.rx_errors++;
-                        brcmu_pkt_buf_free_skb(skb);
-                        continue;
-                }
+        /* process and remove protocol-specific header */
+        ret = brcmf_proto_hdrpull(drvr, true, &ifidx, skb);
+        ifp = drvr->iflist[ifidx];
 
-                rd = (struct brcmf_skb_reorder_data *)skb->cb;
-                if (rd->reorder)
-                        brcmf_rxreorder_process_info(ifp, rd->reorder, skb);
-                else
-                        brcmf_netif_rx(ifp, skb);
+        if (ret || !ifp || !ifp->ndev) {
+                if ((ret != -ENODATA) && ifp)
+                        ifp->stats.rx_errors++;
+                brcmu_pkt_buf_free_skb(skb);
+                return;
         }
+
+        rd = (struct brcmf_skb_reorder_data *)skb->cb;
+        if (rd->reorder)
+                brcmf_rxreorder_process_info(ifp, rd->reorder, skb);
+        else
+                brcmf_netif_rx(ifp, skb);
 }
 
 void brcmf_txfinalize(struct brcmf_pub *drvr, struct sk_buff *txp,
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index 1aa75d5951b8..67f05db4b9b8 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -275,11 +275,6 @@ struct rte_console {
 /* Flags for SDH calls */
 #define F2SYNC  (SDIO_REQ_4BYTE | SDIO_REQ_FIXED)
 
-#define BRCMF_SDIO_FW_NAME      "brcm/brcmfmac-sdio.bin"
-#define BRCMF_SDIO_NV_NAME      "brcm/brcmfmac-sdio.txt"
-MODULE_FIRMWARE(BRCMF_SDIO_FW_NAME);
-MODULE_FIRMWARE(BRCMF_SDIO_NV_NAME);
-
 #define BRCMF_IDLE_IMMEDIATE    (-1)    /* Enter idle immediately */
 #define BRCMF_IDLE_ACTIVE       0       /* Do not request any SD clock change
                                          * when idle
@@ -454,9 +449,6 @@ struct brcmf_sdio {
         struct work_struct datawork;
         atomic_t dpc_tskcnt;
 
-        const struct firmware *firmware;
-        u32 fw_ptr;
-
         bool txoff;             /* Transmit flow-controlled */
         struct brcmf_sdio_count sdcnt;
         bool sr_enabled; /* SaveRestore enabled */
@@ -493,6 +485,100 @@ enum brcmf_sdio_frmtype {
         BRCMF_SDIO_FT_SUB,
 };
 
+#define BCM43143_FIRMWARE_NAME          "brcm/brcmfmac43143-sdio.bin"
+#define BCM43143_NVRAM_NAME             "brcm/brcmfmac43143-sdio.txt"
+#define BCM43241B0_FIRMWARE_NAME        "brcm/brcmfmac43241b0-sdio.bin"
+#define BCM43241B0_NVRAM_NAME           "brcm/brcmfmac43241b0-sdio.txt"
+#define BCM43241B4_FIRMWARE_NAME        "brcm/brcmfmac43241b4-sdio.bin"
+#define BCM43241B4_NVRAM_NAME           "brcm/brcmfmac43241b4-sdio.txt"
+#define BCM4329_FIRMWARE_NAME           "brcm/brcmfmac4329-sdio.bin"
+#define BCM4329_NVRAM_NAME              "brcm/brcmfmac4329-sdio.txt"
+#define BCM4330_FIRMWARE_NAME           "brcm/brcmfmac4330-sdio.bin"
+#define BCM4330_NVRAM_NAME              "brcm/brcmfmac4330-sdio.txt"
+#define BCM4334_FIRMWARE_NAME           "brcm/brcmfmac4334-sdio.bin"
+#define BCM4334_NVRAM_NAME              "brcm/brcmfmac4334-sdio.txt"
+#define BCM4335_FIRMWARE_NAME           "brcm/brcmfmac4335-sdio.bin"
+#define BCM4335_NVRAM_NAME              "brcm/brcmfmac4335-sdio.txt"
+
+MODULE_FIRMWARE(BCM43143_FIRMWARE_NAME);
+MODULE_FIRMWARE(BCM43143_NVRAM_NAME);
+MODULE_FIRMWARE(BCM43241B0_FIRMWARE_NAME);
+MODULE_FIRMWARE(BCM43241B0_NVRAM_NAME);
+MODULE_FIRMWARE(BCM43241B4_FIRMWARE_NAME);
+MODULE_FIRMWARE(BCM43241B4_NVRAM_NAME);
+MODULE_FIRMWARE(BCM4329_FIRMWARE_NAME);
+MODULE_FIRMWARE(BCM4329_NVRAM_NAME);
+MODULE_FIRMWARE(BCM4330_FIRMWARE_NAME);
+MODULE_FIRMWARE(BCM4330_NVRAM_NAME);
+MODULE_FIRMWARE(BCM4334_FIRMWARE_NAME);
+MODULE_FIRMWARE(BCM4334_NVRAM_NAME);
+MODULE_FIRMWARE(BCM4335_FIRMWARE_NAME);
+MODULE_FIRMWARE(BCM4335_NVRAM_NAME);
+
+struct brcmf_firmware_names {
+        u32 chipid;
+        u32 revmsk;
+        const char *bin;
+        const char *nv;
+};
+
+enum brcmf_firmware_type {
+        BRCMF_FIRMWARE_BIN,
+        BRCMF_FIRMWARE_NVRAM
+};
+
+#define BRCMF_FIRMWARE_NVRAM(name) \
+        name ## _FIRMWARE_NAME, name ## _NVRAM_NAME
+
+static const struct brcmf_firmware_names brcmf_fwname_data[] = {
+        { BCM43143_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM43143) },
+        { BCM43241_CHIP_ID, 0x0000001F, BRCMF_FIRMWARE_NVRAM(BCM43241B0) },
+        { BCM43241_CHIP_ID, 0xFFFFFFE0, BRCMF_FIRMWARE_NVRAM(BCM43241B4) },
+        { BCM4329_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4329) },
+        { BCM4330_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4330) },
+        { BCM4334_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4334) },
+        { BCM4335_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4335) }
+};
+
+
+static const struct firmware *brcmf_sdbrcm_get_fw(struct brcmf_sdio *bus,
+                                                  enum brcmf_firmware_type type)
+{
+        const struct firmware *fw;
+        const char *name;
+        int err, i;
+
+        for (i = 0; i < ARRAY_SIZE(brcmf_fwname_data); i++) {
+                if (brcmf_fwname_data[i].chipid == bus->ci->chip &&
+                    brcmf_fwname_data[i].revmsk & BIT(bus->ci->chiprev)) {
+                        switch (type) {
+                        case BRCMF_FIRMWARE_BIN:
+                                name = brcmf_fwname_data[i].bin;
+                                break;
+                        case BRCMF_FIRMWARE_NVRAM:
+                                name = brcmf_fwname_data[i].nv;
+                                break;
+                        default:
+                                brcmf_err("invalid firmware type (%d)\n", type);
+                                return NULL;
+                        }
+                        goto found;
+                }
+        }
+        brcmf_err("Unknown chipid %d [%d]\n",
+                  bus->ci->chip, bus->ci->chiprev);
+        return NULL;
+
+found:
+        err = request_firmware(&fw, name, &bus->sdiodev->func[2]->dev);
+        if ((err) || (!fw)) {
+                brcmf_err("fail to request firmware %s (%d)\n", name, err);
+                return NULL;
+        }
+
+        return fw;
+}
+
 static void pkt_align(struct sk_buff *p, int len, int align)
 {
         uint datalign;
@@ -1406,13 +1492,12 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
                                            bus->glom.qlen, pfirst, pfirst->data,
                                            pfirst->len, pfirst->next,
                                            pfirst->prev);
+                        skb_unlink(pfirst, &bus->glom);
+                        brcmf_rx_frame(bus->sdiodev->dev, pfirst);
+                        bus->sdcnt.rxglompkts++;
                 }
-                /* sent any remaining packets up */
-                if (bus->glom.qlen)
-                        brcmf_rx_frames(bus->sdiodev->dev, &bus->glom);
 
                 bus->sdcnt.rxglomframes++;
-                bus->sdcnt.rxglompkts += bus->glom.qlen;
         }
         return num;
 }
@@ -1557,7 +1642,6 @@ static void brcmf_pad(struct brcmf_sdio *bus, u16 *pad, u16 *rdlen)
 static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
 {
         struct sk_buff *pkt;            /* Packet for event or data frames */
-        struct sk_buff_head pktlist;    /* needed for bus interface */
         u16 pad;                /* Number of pad bytes to read */
         uint rxleft = 0;        /* Remaining number of frames allowed */
         int ret;                /* Return code from calls */
@@ -1759,9 +1843,7 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
                         continue;
                 }
 
-                skb_queue_head_init(&pktlist);
-                skb_queue_tail(&pktlist, pkt);
-                brcmf_rx_frames(bus->sdiodev->dev, &pktlist);
+                brcmf_rx_frame(bus->sdiodev->dev, pkt);
         }
 
         rxcount = maxframes - rxleft;
@@ -1786,10 +1868,15 @@ brcmf_sdbrcm_wait_event_wakeup(struct brcmf_sdio *bus)
         return;
 }
 
+/**
+ * struct brcmf_skbuff_cb reserves first two bytes in sk_buff::cb for
+ * bus layer usage.
+ */
 /* flag marking a dummy skb added for DMA alignment requirement */
-#define DUMMY_SKB_FLAG          0x10000
+#define ALIGN_SKB_FLAG          0x8000
 /* bit mask of data length chopped from the previous packet */
-#define DUMMY_SKB_CHOP_LEN_MASK 0xffff
+#define ALIGN_SKB_CHOP_LEN_MASK 0x7fff
+
 /**
  * brcmf_sdio_txpkt_prep - packet preparation for transmit
  * @bus: brcmf_sdio structure pointer
@@ -1854,7 +1941,7 @@ brcmf_sdio_txpkt_prep(struct brcmf_sdio *bus, struct sk_buff_head *pktq,
                 memcpy(pkt_new->data,
                        pkt_next->data + pkt_next->len - tail_chop,
                        tail_chop);
-                *(u32 *)(pkt_new->cb) = DUMMY_SKB_FLAG + tail_chop;
+                *(u32 *)(pkt_new->cb) = ALIGN_SKB_FLAG + tail_chop;
                 skb_trim(pkt_next, pkt_next->len - tail_chop);
                 __skb_queue_after(pktq, pkt_next, pkt_new);
         } else {
@@ -1908,8 +1995,8 @@ brcmf_sdio_txpkt_postp(struct brcmf_sdio *bus, struct sk_buff_head *pktq)
 
         skb_queue_walk_safe(pktq, pkt_next, tmp) {
                 dummy_flags = *(u32 *)(pkt_next->cb);
-                if (dummy_flags & DUMMY_SKB_FLAG) {
-                        chop_len = dummy_flags & DUMMY_SKB_CHOP_LEN_MASK;
+                if (dummy_flags & ALIGN_SKB_FLAG) {
+                        chop_len = dummy_flags & ALIGN_SKB_CHOP_LEN_MASK;
                         if (chop_len) {
                                 pkt_prev = pkt_next->prev;
                                 memcpy(pkt_prev->data + pkt_prev->len,
@@ -3037,69 +3124,43 @@ static bool brcmf_sdbrcm_download_state(struct brcmf_sdio *bus, bool enter)
         return true;
 }
 
-static int brcmf_sdbrcm_get_image(char *buf, int len, struct brcmf_sdio *bus)
-{
-        if (bus->firmware->size < bus->fw_ptr + len)
-                len = bus->firmware->size - bus->fw_ptr;
-
-        memcpy(buf, &bus->firmware->data[bus->fw_ptr], len);
-        bus->fw_ptr += len;
-        return len;
-}
-
 static int brcmf_sdbrcm_download_code_file(struct brcmf_sdio *bus)
 {
+        const struct firmware *fw;
+        int err;
         int offset;
-        uint len;
-        u8 *memblock = NULL, *memptr;
-        int ret;
-        u8 idx;
-
-        brcmf_dbg(INFO, "Enter\n");
-
-        ret = request_firmware(&bus->firmware, BRCMF_SDIO_FW_NAME,
-                               &bus->sdiodev->func[2]->dev);
-        if (ret) {
-                brcmf_err("Fail to request firmware %d\n", ret);
-                return ret;
-        }
-        bus->fw_ptr = 0;
-
-        memptr = memblock = kmalloc(MEMBLOCK + BRCMF_SDALIGN, GFP_ATOMIC);
-        if (memblock == NULL) {
-                ret = -ENOMEM;
-                goto err;
-        }
-        if ((u32)(unsigned long)memblock % BRCMF_SDALIGN)
-                memptr += (BRCMF_SDALIGN -
-                           ((u32)(unsigned long)memblock % BRCMF_SDALIGN));
-
-        offset = bus->ci->rambase;
-
-        /* Download image */
-        len = brcmf_sdbrcm_get_image((char *)memptr, MEMBLOCK, bus);
-        idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_ARM_CR4);
-        if (BRCMF_MAX_CORENUM != idx)
-                memcpy(&bus->ci->rst_vec, memptr, sizeof(bus->ci->rst_vec));
-        while (len) {
-                ret = brcmf_sdio_ramrw(bus->sdiodev, true, offset, memptr, len);
-                if (ret) {
+        int address;
+        int len;
+
+        fw = brcmf_sdbrcm_get_fw(bus, BRCMF_FIRMWARE_BIN);
+        if (fw == NULL)
+                return -ENOENT;
+
+        if (brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_ARM_CR4) !=
+            BRCMF_MAX_CORENUM)
+                memcpy(&bus->ci->rst_vec, fw->data, sizeof(bus->ci->rst_vec));
+
+        err = 0;
+        offset = 0;
+        address = bus->ci->rambase;
+        while (offset < fw->size) {
+                len = ((offset + MEMBLOCK) < fw->size) ? MEMBLOCK :
+                      fw->size - offset;
+                err = brcmf_sdio_ramrw(bus->sdiodev, true, address,
+                                       (u8 *)&fw->data[offset], len);
+                if (err) {
                         brcmf_err("error %d on writing %d membytes at 0x%08x\n",
-                                  ret, MEMBLOCK, offset);
-                        goto err;
+                                  err, len, address);
+                        goto failure;
                 }
-
-                offset += MEMBLOCK;
-                len = brcmf_sdbrcm_get_image((char *)memptr, MEMBLOCK, bus);
+                offset += len;
+                address += len;
         }
 
-err:
-        kfree(memblock);
+failure:
+        release_firmware(fw);
 
-        release_firmware(bus->firmware);
-        bus->fw_ptr = 0;
-
-        return ret;
+        return err;
 }
 
 /*
@@ -3111,7 +3172,8 @@ err:
  * by two NULs.
 */
 
-static int brcmf_process_nvram_vars(struct brcmf_sdio *bus)
+static int brcmf_process_nvram_vars(struct brcmf_sdio *bus,
+                                    const struct firmware *nv)
 {
         char *varbuf;
         char *dp;
@@ -3120,12 +3182,12 @@ static int brcmf_process_nvram_vars(struct brcmf_sdio *bus)
         int ret = 0;
         uint buf_len, n, len;
 
-        len = bus->firmware->size;
+        len = nv->size;
         varbuf = vmalloc(len);
         if (!varbuf)
                 return -ENOMEM;
 
-        memcpy(varbuf, bus->firmware->data, len);
+        memcpy(varbuf, nv->data, len);
         dp = varbuf;
 
         findNewline = false;
@@ -3177,18 +3239,16 @@ err:
 
 static int brcmf_sdbrcm_download_nvram(struct brcmf_sdio *bus)
 {
+        const struct firmware *nv;
         int ret;
 
-        ret = request_firmware(&bus->firmware, BRCMF_SDIO_NV_NAME,
-                               &bus->sdiodev->func[2]->dev);
-        if (ret) {
-                brcmf_err("Fail to request nvram %d\n", ret);
-                return ret;
-        }
+        nv = brcmf_sdbrcm_get_fw(bus, BRCMF_FIRMWARE_NVRAM);
+        if (nv == NULL)
+                return -ENOENT;
 
-        ret = brcmf_process_nvram_vars(bus);
+        ret = brcmf_process_nvram_vars(bus, nv);
 
-        release_firmware(bus->firmware);
+        release_firmware(nv);
 
         return ret;
 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fweh.h b/drivers/net/wireless/brcm80211/brcmfmac/fweh.h
index e679214b3c98..14bc24dc5bae 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.h
@@ -102,7 +102,8 @@ struct brcmf_event;
         BRCMF_ENUM_DEF(DCS_REQUEST, 73) \
         BRCMF_ENUM_DEF(FIFO_CREDIT_MAP, 74) \
         BRCMF_ENUM_DEF(ACTION_FRAME_RX, 75) \
-        BRCMF_ENUM_DEF(BCMC_CREDIT_SUPPORT, 127)
+        BRCMF_ENUM_DEF(BCMC_CREDIT_SUPPORT, 127) \
+        BRCMF_ENUM_DEF(PSTA_PRIMARY_INTF_IND, 128)
 
 #define BRCMF_ENUM_DEF(id, val) \
         BRCMF_E_##id = (val),
@@ -114,6 +115,8 @@ enum brcmf_fweh_event_code {
 };
 #undef BRCMF_ENUM_DEF
 
+#define BRCMF_EVENTING_MASK_LEN         DIV_ROUND_UP(BRCMF_E_LAST, 8)
+
 /* flags field values in struct brcmf_event_msg */
 #define BRCMF_EVENT_MSG_LINK            0x01
 #define BRCMF_EVENT_MSG_FLUSHTXQ        0x02
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
index 82f9140f3d35..d0cd0bf95c5a 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
@@ -168,6 +168,7 @@ enum brcmf_fws_skb_state {
 /**
  * struct brcmf_skbuff_cb - control buffer associated with skbuff.
  *
+ * @bus_flags: 2 bytes reserved for bus specific parameters
  * @if_flags: holds interface index and packet related flags.
  * @htod: host to device packet identifier (used in PKTTAG tlv).
  * @state: transmit state of the packet.
@@ -177,6 +178,7 @@ enum brcmf_fws_skb_state {
  * provides 48 bytes of storage so this structure should not exceed that.
  */
 struct brcmf_skbuff_cb {
+        u16 bus_flags;
         u16 if_flags;
         u32 htod;
         enum brcmf_fws_skb_state state;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
index ca72177388b9..2096a14ef1fb 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
@@ -18,6 +18,7 @@
 #include <linux/types.h>
 #include <linux/netdevice.h>
 #include <linux/mmc/card.h>
+#include <linux/mmc/sdio_func.h>
 #include <linux/ssb/ssb_regs.h>
 #include <linux/bcma/bcma.h>
 
@@ -136,6 +137,8 @@ brcmf_sdio_sb_iscoreup(struct brcmf_sdio_dev *sdiodev,
         u8 idx;
 
         idx = brcmf_sdio_chip_getinfidx(ci, coreid);
+        if (idx == BRCMF_MAX_CORENUM)
+                return false;
 
         regdata = brcmf_sdio_regrl(sdiodev,
                                    CORE_SB(ci->c_inf[idx].base, sbtmstatelow),
@@ -154,6 +157,8 @@ brcmf_sdio_ai_iscoreup(struct brcmf_sdio_dev *sdiodev,
         bool ret;
 
         idx = brcmf_sdio_chip_getinfidx(ci, coreid);
+        if (idx == BRCMF_MAX_CORENUM)
+                return false;
 
         regdata = brcmf_sdio_regrl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
                                    NULL);
@@ -261,6 +266,8 @@ brcmf_sdio_ai_coredisable(struct brcmf_sdio_dev *sdiodev,
         u32 regdata;
 
         idx = brcmf_sdio_chip_getinfidx(ci, coreid);
+        if (idx == BRCMF_MAX_CORENUM)
+                return;
 
         /* if core is already in reset, just return */
         regdata = brcmf_sdio_regrl(sdiodev,
@@ -304,6 +311,8 @@ brcmf_sdio_sb_resetcore(struct brcmf_sdio_dev *sdiodev,
         u8 idx;
 
         idx = brcmf_sdio_chip_getinfidx(ci, coreid);
+        if (idx == BRCMF_MAX_CORENUM)
+                return;
 
         /*
          * Must do the disable sequence first to work for
@@ -368,6 +377,8 @@ brcmf_sdio_ai_resetcore(struct brcmf_sdio_dev *sdiodev,
         u32 regdata;
 
         idx = brcmf_sdio_chip_getinfidx(ci, coreid);
+        if (idx == BRCMF_MAX_CORENUM)
+                return;
 
         /* must disable first to work for arbitrary current core state */
         brcmf_sdio_ai_coredisable(sdiodev, ci, coreid, core_bits);
@@ -444,6 +455,9 @@ static int brcmf_sdio_chip_recognition(struct brcmf_sdio_dev *sdiodev,
                                    NULL);
         ci->chip = regdata & CID_ID_MASK;
         ci->chiprev = (regdata & CID_REV_MASK) >> CID_REV_SHIFT;
+        if (sdiodev->func[0]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339 &&
+            ci->chiprev >= 2)
+                ci->chip = BCM4339_CHIP_ID;
         ci->socitype = (regdata & CID_TYPE_MASK) >> CID_TYPE_SHIFT;
 
         brcmf_dbg(INFO, "chipid=0x%x chiprev=%d\n", ci->chip, ci->chiprev);
@@ -541,6 +555,20 @@ static int brcmf_sdio_chip_recognition(struct brcmf_sdio_dev *sdiodev,
                 ci->ramsize = 0xc0000;
                 ci->rambase = 0x180000;
                 break;
+        case BCM4339_CHIP_ID:
+                ci->c_inf[0].wrapbase = 0x18100000;
+                ci->c_inf[0].cib = 0x2e084411;
+                ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
+                ci->c_inf[1].base = 0x18005000;
+                ci->c_inf[1].wrapbase = 0x18105000;
+                ci->c_inf[1].cib = 0x15004211;
+                ci->c_inf[2].id = BCMA_CORE_ARM_CR4;
+                ci->c_inf[2].base = 0x18002000;
+                ci->c_inf[2].wrapbase = 0x18102000;
+                ci->c_inf[2].cib = 0x04084411;
+                ci->ramsize = 0xc0000;
+                ci->rambase = 0x180000;
+                break;
         default:
                 brcmf_err("chipid 0x%x is not supported\n", ci->chip);
                 return -ENODEV;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.h b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.h
index 83c041f1bf4a..076b83c7c896 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.h
@@ -54,6 +54,14 @@
 
 #define BRCMF_MAX_CORENUM       6
 
+/* SDIO device ID */
+#define SDIO_DEVICE_ID_BROADCOM_43143           43143
+#define SDIO_DEVICE_ID_BROADCOM_43241           0x4324
+#define SDIO_DEVICE_ID_BROADCOM_4329            0x4329
+#define SDIO_DEVICE_ID_BROADCOM_4330            0x4330
+#define SDIO_DEVICE_ID_BROADCOM_4334            0x4334
+#define SDIO_DEVICE_ID_BROADCOM_4335_4339       0x4335
+
 struct chip_core_info {
         u16 id;
         u16 rev;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index 39e01a7c8556..bf6758d95600 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -435,7 +435,6 @@ static void brcmf_usb_rx_complete(struct urb *urb)
         struct brcmf_usbreq  *req = (struct brcmf_usbreq *)urb->context;
         struct brcmf_usbdev_info *devinfo = req->devinfo;
         struct sk_buff *skb;
-        struct sk_buff_head skbq;
 
         brcmf_dbg(USB, "Enter, urb->status=%d\n", urb->status);
         brcmf_usb_del_fromq(devinfo, req);
@@ -450,10 +449,8 @@ static void brcmf_usb_rx_complete(struct urb *urb)
         }
 
         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP) {
-                skb_queue_head_init(&skbq);
-                skb_queue_tail(&skbq, skb);
                 skb_put(skb, urb->actual_length);
-                brcmf_rx_frames(devinfo->dev, &skbq);
+                brcmf_rx_frame(devinfo->dev, skb);
                 brcmf_usb_rx_refill(devinfo, req);
         } else {
                 brcmu_pkt_buf_free_skb(skb);
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index 4608e0eb1493..df6229ed52c8 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -5695,7 +5695,7 @@ static bool brcms_c_chipmatch_pci(struct bcma_device *core)
                 return true;
         if ((device == BCM43224_D11N_ID) || (device == BCM43225_D11N2G_ID))
                 return true;
-        if (device == BCM4313_D11N2G_ID)
+        if (device == BCM4313_D11N2G_ID || device == BCM4313_CHIP_ID)
                 return true;
         if ((device == BCM43236_D11N_ID) || (device == BCM43236_D11N2G_ID))
                 return true;
diff --git a/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h b/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
index c1fe245bb07e..84113ea16f84 100644
--- a/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
+++ b/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
@@ -41,5 +41,6 @@
 #define BCM4331_CHIP_ID         0x4331
 #define BCM4334_CHIP_ID         0x4334
 #define BCM4335_CHIP_ID         0x4335
+#define BCM4339_CHIP_ID         0x4339
 
 #endif                          /* _BRCM_HW_IDS_H_ */
diff --git a/drivers/net/wireless/cw1200/cw1200_spi.c b/drivers/net/wireless/cw1200/cw1200_spi.c
index d06376014bcd..e310752f0e33 100644
--- a/drivers/net/wireless/cw1200/cw1200_spi.c
+++ b/drivers/net/wireless/cw1200/cw1200_spi.c
@@ -40,7 +40,9 @@ struct hwbus_priv {
         struct cw1200_common    *core;
         const struct cw1200_platform_data_spi *pdata;
         spinlock_t              lock; /* Serialize all bus operations */
+        wait_queue_head_t       wq;
         int claimed;
+        int irq_disabled;
 };
 
 #define SDIO_TO_SPI_ADDR(addr) ((addr & 0x1f)>>2)
@@ -197,8 +199,11 @@ static void cw1200_spi_lock(struct hwbus_priv *self)
 {
         unsigned long flags;
 
+        DECLARE_WAITQUEUE(wait, current);
+
         might_sleep();
 
+        add_wait_queue(&self->wq, &wait);
         spin_lock_irqsave(&self->lock, flags);
         while (1) {
                 set_current_state(TASK_UNINTERRUPTIBLE);
@@ -211,6 +216,7 @@ static void cw1200_spi_lock(struct hwbus_priv *self)
         set_current_state(TASK_RUNNING);
         self->claimed = 1;
         spin_unlock_irqrestore(&self->lock, flags);
+        remove_wait_queue(&self->wq, &wait);
 
         return;
 }
@@ -222,6 +228,8 @@ static void cw1200_spi_unlock(struct hwbus_priv *self)
         spin_lock_irqsave(&self->lock, flags);
         self->claimed = 0;
         spin_unlock_irqrestore(&self->lock, flags);
+        wake_up(&self->wq);
+
         return;
 }
 
@@ -230,6 +238,8 @@ static irqreturn_t cw1200_spi_irq_handler(int irq, void *dev_id)
         struct hwbus_priv *self = dev_id;
 
         if (self->core) {
+                disable_irq_nosync(self->func->irq);
+                self->irq_disabled = 1;
                 cw1200_irq_handler(self->core);
                 return IRQ_HANDLED;
         } else {
@@ -263,13 +273,22 @@ exit:
 
 static int cw1200_spi_irq_unsubscribe(struct hwbus_priv *self)
 {
-        int ret = 0;
-
         pr_debug("SW IRQ unsubscribe\n");
         disable_irq_wake(self->func->irq);
         free_irq(self->func->irq, self);
 
-        return ret;
+        return 0;
+}
+
+static int cw1200_spi_irq_enable(struct hwbus_priv *self, int enable)
+{
+        /* Disables are handled by the interrupt handler */
+        if (enable && self->irq_disabled) {
+                enable_irq(self->func->irq);
+                self->irq_disabled = 0;
+        }
+
+        return 0;
 }
 
 static int cw1200_spi_off(const struct cw1200_platform_data_spi *pdata)
@@ -349,13 +368,14 @@ static struct hwbus_ops cw1200_spi_hwbus_ops = {
         .unlock                 = cw1200_spi_unlock,
         .align_size             = cw1200_spi_align_size,
         .power_mgmt             = cw1200_spi_pm,
+        .irq_enable             = cw1200_spi_irq_enable,
 };
 
 /* Probe Function to be called by SPI stack when device is discovered */
 static int cw1200_spi_probe(struct spi_device *func)
 {
         const struct cw1200_platform_data_spi *plat_data =
-                func->dev.platform_data;
+                dev_get_platdata(&func->dev);
         struct hwbus_priv *self;
         int status;
 
@@ -400,6 +420,8 @@ static int cw1200_spi_probe(struct spi_device *func)
 
         spi_set_drvdata(func, self);
 
+        init_waitqueue_head(&self->wq);
+
         status = cw1200_spi_irq_subscribe(self);
 
         status = cw1200_core_probe(&cw1200_spi_hwbus_ops,
@@ -431,7 +453,7 @@ static int cw1200_spi_disconnect(struct spi_device *func)
                 }
                 kfree(self);
         }
-        cw1200_spi_off(func->dev.platform_data);
+        cw1200_spi_off(dev_get_platdata(&func->dev));
 
         return 0;
 }
diff --git a/drivers/net/wireless/cw1200/fwio.c b/drivers/net/wireless/cw1200/fwio.c
index acdff0f7f952..0b2061bbc68b 100644
--- a/drivers/net/wireless/cw1200/fwio.c
+++ b/drivers/net/wireless/cw1200/fwio.c
@@ -485,7 +485,7 @@ int cw1200_load_firmware(struct cw1200_common *priv)
 
         /* Enable interrupt signalling */
         priv->hwbus_ops->lock(priv->hwbus_priv);
-        ret = __cw1200_irq_enable(priv, 1);
+        ret = __cw1200_irq_enable(priv, 2);
         priv->hwbus_ops->unlock(priv->hwbus_priv);
         if (ret < 0)
                 goto unsubscribe;
diff --git a/drivers/net/wireless/cw1200/hwbus.h b/drivers/net/wireless/cw1200/hwbus.h
index 8b2fc831c3de..51dfb3a90735 100644
--- a/drivers/net/wireless/cw1200/hwbus.h
+++ b/drivers/net/wireless/cw1200/hwbus.h
@@ -28,6 +28,7 @@ struct hwbus_ops {
         void (*unlock)(struct hwbus_priv *self);
         size_t (*align_size)(struct hwbus_priv *self, size_t size);
         int (*power_mgmt)(struct hwbus_priv *self, bool suspend);
+        int (*irq_enable)(struct hwbus_priv *self, int enable);
 };
 
 #endif /* CW1200_HWBUS_H */
diff --git a/drivers/net/wireless/cw1200/hwio.c b/drivers/net/wireless/cw1200/hwio.c
index ff230b7aeedd..41bd7615ccaa 100644
--- a/drivers/net/wireless/cw1200/hwio.c
+++ b/drivers/net/wireless/cw1200/hwio.c
@@ -273,6 +273,21 @@ int __cw1200_irq_enable(struct cw1200_common *priv, int enable)
         u16 val16;
         int ret;
 
+        /* We need to do this hack because the SPI layer can sleep on I/O
+           and the general path involves I/O to the device in interrupt
+           context.
+
+           However, the initial enable call needs to go to the hardware.
+
+           We don't worry about shutdown because we do a full reset which
+           clears the interrupt enabled bits.
+        */
+        if (priv->hwbus_ops->irq_enable) {
+                ret = priv->hwbus_ops->irq_enable(priv->hwbus_priv, enable);
+                if (ret || enable < 2)
+                        return ret;
+        }
+
         if (HIF_8601_SILICON == priv->hw_type) {
                 ret = __cw1200_reg_read_32(priv, ST90TDS_CONFIG_REG_ID, &val32);
                 if (ret < 0) {
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 6b823a1ab789..f394af777cf5 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -11885,7 +11885,6 @@ static int ipw_pci_probe(struct pci_dev *pdev,
         pci_release_regions(pdev);
       out_pci_disable_device:
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
       out_free_libipw:
         free_libipw(priv->net_dev, 0);
       out:
@@ -11966,7 +11965,6 @@ static void ipw_pci_remove(struct pci_dev *pdev)
         iounmap(priv->hw_base);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
         /* wiphy_unregister needs to be here, before free_libipw */
         wiphy_unregister(priv->ieee->wdev.wiphy);
         kfree(priv->ieee->a_band.channels);
diff --git a/drivers/net/wireless/iwlegacy/3945-mac.c b/drivers/net/wireless/iwlegacy/3945-mac.c
index 9581d07a4242..dea3b50d68b9 100644
--- a/drivers/net/wireless/iwlegacy/3945-mac.c
+++ b/drivers/net/wireless/iwlegacy/3945-mac.c
@@ -3811,7 +3811,6 @@ out_iounmap:
 out_pci_release_regions:
         pci_release_regions(pdev);
 out_pci_disable_device:
-        pci_set_drvdata(pdev, NULL);
         pci_disable_device(pdev);
 out_ieee80211_free_hw:
         ieee80211_free_hw(il->hw);
@@ -3888,7 +3887,6 @@ il3945_pci_remove(struct pci_dev *pdev)
         iounmap(il->hw_base);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
 
         il_free_channel_map(il);
         il_free_geos(il);
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
index 5ab50a5b48b1..3982ab76f375 100644
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
@@ -6706,7 +6706,6 @@ out_free_eeprom:
 out_iounmap:
         iounmap(il->hw_base);
 out_pci_release_regions:
-        pci_set_drvdata(pdev, NULL);
         pci_release_regions(pdev);
 out_pci_disable_device:
         pci_disable_device(pdev);
@@ -6787,7 +6786,6 @@ il4965_pci_remove(struct pci_dev *pdev)
         iounmap(il->hw_base);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
 
         il4965_uninit_drv(il);
 
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index e66c7e378a3e..6392f67dc1af 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -1404,6 +1404,10 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
         spin_lock_init(&trans_pcie->reg_lock);
         init_waitqueue_head(&trans_pcie->ucode_write_waitq);
 
+        err = pci_enable_device(pdev);
+        if (err)
+                goto out_no_pci;
+
         if (!cfg->base_params->pcie_l1_allowed) {
                 /*
                  * W/A - seems to solve weird behavior. We need to remove this
@@ -1415,10 +1419,6 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
                                        PCIE_LINK_STATE_CLKPM);
         }
 
-        err = pci_enable_device(pdev);
-        if (err)
-                goto out_no_pci;
-
         pci_set_master(pdev);
 
         err = pci_set_dma_mask(pdev, DMA_BIT_MASK(36));
diff --git a/drivers/net/wireless/libertas/if_spi.c b/drivers/net/wireless/libertas/if_spi.c
index 4bb6574f4073..5d39ec880d84 100644
--- a/drivers/net/wireless/libertas/if_spi.c
+++ b/drivers/net/wireless/libertas/if_spi.c
@@ -1128,7 +1128,7 @@ static int if_spi_probe(struct spi_device *spi)
 {
         struct if_spi_card *card;
         struct lbs_private *priv = NULL;
-        struct libertas_spi_platform_data *pdata = spi->dev.platform_data;
+        struct libertas_spi_platform_data *pdata = dev_get_platdata(&spi->dev);
         int err = 0;
 
         lbs_deb_enter(LBS_DEB_SPI);
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index 2d761477d15e..fb3fa18390b8 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -1048,7 +1048,7 @@ mwifiex_cancel_pending_ioctl(struct mwifiex_adapter *adapter)
         struct cmd_ctrl_node *cmd_node = NULL, *tmp_node = NULL;
         unsigned long cmd_flags;
         unsigned long scan_pending_q_flags;
-        uint16_t cancel_scan_cmd = false;
+        bool cancel_scan_cmd = false;
 
         if ((adapter->curr_cmd) &&
             (adapter->curr_cmd->wait_q_enabled)) {
diff --git a/drivers/net/wireless/mwifiex/join.c b/drivers/net/wireless/mwifiex/join.c
index 9d7c0e6c4fc7..717fbe2e0e5a 100644
--- a/drivers/net/wireless/mwifiex/join.c
+++ b/drivers/net/wireless/mwifiex/join.c
@@ -621,7 +621,7 @@ int mwifiex_ret_802_11_associate(struct mwifiex_private *priv,
         int ret = 0;
         struct ieee_types_assoc_rsp *assoc_rsp;
         struct mwifiex_bssdescriptor *bss_desc;
-        u8 enable_data = true;
+        bool enable_data = true;
         u16 cap_info, status_code;
 
         assoc_rsp = (struct ieee_types_assoc_rsp *) &resp->params;
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index 52da8ee7599a..33fa9432b241 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -93,7 +93,7 @@ static int mwifiex_pcie_suspend(struct device *dev)
         struct pci_dev *pdev = to_pci_dev(dev);
 
         if (pdev) {
-                card = (struct pcie_service_card *) pci_get_drvdata(pdev);
+                card = pci_get_drvdata(pdev);
                 if (!card || !card->adapter) {
                         pr_err("Card or adapter structure is not valid\n");
                         return 0;
@@ -128,7 +128,7 @@ static int mwifiex_pcie_resume(struct device *dev)
         struct pci_dev *pdev = to_pci_dev(dev);
 
         if (pdev) {
-                card = (struct pcie_service_card *) pci_get_drvdata(pdev);
+                card = pci_get_drvdata(pdev);
                 if (!card || !card->adapter) {
                         pr_err("Card or adapter structure is not valid\n");
                         return 0;
@@ -2037,7 +2037,7 @@ static irqreturn_t mwifiex_pcie_interrupt(int irq, void *context)
                 goto exit;
         }
 
-        card = (struct pcie_service_card *) pci_get_drvdata(pdev);
+        card = pci_get_drvdata(pdev);
         if (!card || !card->adapter) {
                 pr_debug("info: %s: card=%p adapter=%p\n", __func__, card,
                          card ? card->adapter : NULL);
diff --git a/drivers/net/wireless/mwifiex/sta_cmd.c b/drivers/net/wireless/mwifiex/sta_cmd.c
index c0268b597748..7d66018a2e33 100644
--- a/drivers/net/wireless/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/mwifiex/sta_cmd.c
@@ -327,7 +327,7 @@ mwifiex_cmd_802_11_hs_cfg(struct mwifiex_private *priv,
 {
         struct mwifiex_adapter *adapter = priv->adapter;
         struct host_cmd_ds_802_11_hs_cfg_enh *hs_cfg = &cmd->params.opt_hs_cfg;
-        u16 hs_activate = false;
+        bool hs_activate = false;
 
         if (!hscfg_param)
                 /* New Activate command */
diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c
index 2e8f9cdea54d..8f8fea015cb4 100644
--- a/drivers/net/wireless/mwifiex/wmm.c
+++ b/drivers/net/wireless/mwifiex/wmm.c
@@ -708,7 +708,7 @@ int mwifiex_ret_wmm_get_status(struct mwifiex_private *priv,
 {
         u8 *curr = (u8 *) &resp->params.get_wmm_status;
         uint16_t resp_len = le16_to_cpu(resp->size), tlv_len;
-        int valid = true;
+        bool valid = true;
 
         struct mwifiex_ie_types_data *tlv_hdr;
         struct mwifiex_ie_types_wmm_queue_status *tlv_wmm_qstatus;
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index a3707fd4ef62..b953ad621e0b 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -6093,7 +6093,6 @@ err_iounmap:
         if (priv->sram != NULL)
                 pci_iounmap(pdev, priv->sram);
 
-        pci_set_drvdata(pdev, NULL);
         ieee80211_free_hw(hw);
 
 err_free_reg:
@@ -6147,7 +6146,6 @@ static void mwl8k_remove(struct pci_dev *pdev)
 unmap:
         pci_iounmap(pdev, priv->regs);
         pci_iounmap(pdev, priv->sram);
-        pci_set_drvdata(pdev, NULL);
         ieee80211_free_hw(hw);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
diff --git a/drivers/net/wireless/orinoco/orinoco_nortel.c b/drivers/net/wireless/orinoco/orinoco_nortel.c
index d73fdf6185a2..ffb2469eb679 100644
--- a/drivers/net/wireless/orinoco/orinoco_nortel.c
+++ b/drivers/net/wireless/orinoco/orinoco_nortel.c
@@ -234,7 +234,6 @@ static int orinoco_nortel_init_one(struct pci_dev *pdev,
         free_irq(pdev->irq, priv);
 
  fail_irq:
-        pci_set_drvdata(pdev, NULL);
         free_orinocodev(priv);
 
  fail_alloc:
@@ -265,7 +264,6 @@ static void orinoco_nortel_remove_one(struct pci_dev *pdev)
 
         orinoco_if_del(priv);
         free_irq(pdev->irq, priv);
-        pci_set_drvdata(pdev, NULL);
         free_orinocodev(priv);
         pci_iounmap(pdev, priv->hw.iobase);
         pci_iounmap(pdev, card->attr_io);
diff --git a/drivers/net/wireless/orinoco/orinoco_pci.c b/drivers/net/wireless/orinoco/orinoco_pci.c
index 677bf14eca84..5ae1191d2532 100644
--- a/drivers/net/wireless/orinoco/orinoco_pci.c
+++ b/drivers/net/wireless/orinoco/orinoco_pci.c
@@ -184,7 +184,6 @@ static int orinoco_pci_init_one(struct pci_dev *pdev,
         free_irq(pdev->irq, priv);
 
  fail_irq:
-        pci_set_drvdata(pdev, NULL);
         free_orinocodev(priv);
 
  fail_alloc:
@@ -205,7 +204,6 @@ static void orinoco_pci_remove_one(struct pci_dev *pdev)
 
         orinoco_if_del(priv);
         free_irq(pdev->irq, priv);
-        pci_set_drvdata(pdev, NULL);
         free_orinocodev(priv);
         pci_iounmap(pdev, priv->hw.iobase);
         pci_release_regions(pdev);
diff --git a/drivers/net/wireless/orinoco/orinoco_plx.c b/drivers/net/wireless/orinoco/orinoco_plx.c
index 2559dbd6184b..bbd36d1676ff 100644
--- a/drivers/net/wireless/orinoco/orinoco_plx.c
+++ b/drivers/net/wireless/orinoco/orinoco_plx.c
@@ -273,7 +273,6 @@ static int orinoco_plx_init_one(struct pci_dev *pdev,
         free_irq(pdev->irq, priv);
 
  fail_irq:
-        pci_set_drvdata(pdev, NULL);
         free_orinocodev(priv);
 
  fail_alloc:
@@ -301,7 +300,6 @@ static void orinoco_plx_remove_one(struct pci_dev *pdev)
 
         orinoco_if_del(priv);
         free_irq(pdev->irq, priv);
-        pci_set_drvdata(pdev, NULL);
         free_orinocodev(priv);
         pci_iounmap(pdev, priv->hw.iobase);
         pci_iounmap(pdev, card->attr_io);
diff --git a/drivers/net/wireless/orinoco/orinoco_tmd.c b/drivers/net/wireless/orinoco/orinoco_tmd.c
index 42afeeea2c40..04b08de5fd5d 100644
--- a/drivers/net/wireless/orinoco/orinoco_tmd.c
+++ b/drivers/net/wireless/orinoco/orinoco_tmd.c
@@ -170,7 +170,6 @@ static int orinoco_tmd_init_one(struct pci_dev *pdev,
         free_irq(pdev->irq, priv);
 
  fail_irq:
-        pci_set_drvdata(pdev, NULL);
         free_orinocodev(priv);
 
  fail_alloc:
@@ -195,7 +194,6 @@ static void orinoco_tmd_remove_one(struct pci_dev *pdev)
 
         orinoco_if_del(priv);
         free_irq(pdev->irq, priv);
-        pci_set_drvdata(pdev, NULL);
         free_orinocodev(priv);
         pci_iounmap(pdev, priv->hw.iobase);
         pci_iounmap(pdev, card->bridge_io);
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index 57e3af8ebb4b..f9a07b0d83ac 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -631,7 +631,6 @@ static int p54p_probe(struct pci_dev *pdev,
         iounmap(priv->map);
 
  err_free_dev:
-        pci_set_drvdata(pdev, NULL);
         p54_free_common(dev);
 
  err_free_reg:
diff --git a/drivers/net/wireless/p54/p54spi.c b/drivers/net/wireless/p54/p54spi.c
index 7fc46f26cf2b..de15171e2cd8 100644
--- a/drivers/net/wireless/p54/p54spi.c
+++ b/drivers/net/wireless/p54/p54spi.c
@@ -636,7 +636,7 @@ static int p54spi_probe(struct spi_device *spi)
         gpio_direction_input(p54spi_gpio_irq);
 
         ret = request_irq(gpio_to_irq(p54spi_gpio_irq),
-                          p54spi_interrupt, IRQF_DISABLED, "p54spi",
+                          p54spi_interrupt, 0, "p54spi",
                           priv->spi);
         if (ret < 0) {
                 dev_err(&priv->spi->dev, "request_irq() failed");
diff --git a/drivers/net/wireless/rt2x00/Kconfig b/drivers/net/wireless/rt2x00/Kconfig
index 68dbbb9c6d12..a18b0051a745 100644
--- a/drivers/net/wireless/rt2x00/Kconfig
+++ b/drivers/net/wireless/rt2x00/Kconfig
@@ -219,6 +219,7 @@ config RT2X00_LIB_USB
 
 config RT2X00_LIB
         tristate
+        select AVERAGE
 
 config RT2X00_LIB_FIRMWARE
         boolean
diff --git a/drivers/net/wireless/rt2x00/rt2800.h b/drivers/net/wireless/rt2x00/rt2800.h
index fa33b5edf931..e3eb95292a7f 100644
--- a/drivers/net/wireless/rt2x00/rt2800.h
+++ b/drivers/net/wireless/rt2x00/rt2800.h
@@ -52,6 +52,7 @@
  * RF3322 2.4G 2T2R(RT3352/RT3371/RT3372/RT3391/RT3392)
  * RF3053 2.4G/5G 3T3R(RT3883/RT3563/RT3573/RT3593/RT3662)
  * RF5592 2.4G/5G 2T2R
+ * RF3070 2.4G 1T1R
  * RF5360 2.4G 1T1R
  * RF5370 2.4G 1T1R
  * RF5390 2.4G 1T1R
@@ -70,6 +71,7 @@
 #define RF3322                          0x000c
 #define RF3053                          0x000d
 #define RF5592                          0x000f
+#define RF3070                          0x3070
 #define RF3290                          0x3290
 #define RF5360                          0x5360
 #define RF5370                          0x5370
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 95e6e61c3de0..a114cab413e9 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -278,12 +278,9 @@ static const unsigned int rt2800_eeprom_map_ext[EEPROM_WORD_COUNT] = {
         [EEPROM_LNA]                    = 0x0026,
         [EEPROM_EXT_LNA2]               = 0x0027,
         [EEPROM_RSSI_BG]                = 0x0028,
-        [EEPROM_TXPOWER_DELTA]          = 0x0028, /* Overlaps with RSSI_BG */
         [EEPROM_RSSI_BG2]               = 0x0029,
-        [EEPROM_TXMIXER_GAIN_BG]        = 0x0029, /* Overlaps with RSSI_BG2 */
         [EEPROM_RSSI_A]                 = 0x002a,
         [EEPROM_RSSI_A2]                = 0x002b,
-        [EEPROM_TXMIXER_GAIN_A]         = 0x002b, /* Overlaps with RSSI_A2 */
         [EEPROM_TXPOWER_BG1]            = 0x0030,
         [EEPROM_TXPOWER_BG2]            = 0x0037,
         [EEPROM_EXT_TXPOWER_BG3]        = 0x003e,
@@ -2029,13 +2026,6 @@ static void rt2800_config_channel_rf3xxx(struct rt2x00_dev *rt2x00dev,
                           rt2x00dev->default_ant.tx_chain_num <= 2);
         rt2800_rfcsr_write(rt2x00dev, 1, rfcsr);
 
-        rt2800_rfcsr_read(rt2x00dev, 30, &rfcsr);
-        rt2x00_set_field8(&rfcsr, RFCSR30_RF_CALIBRATION, 1);
-        rt2800_rfcsr_write(rt2x00dev, 30, rfcsr);
-        msleep(1);
-        rt2x00_set_field8(&rfcsr, RFCSR30_RF_CALIBRATION, 0);
-        rt2800_rfcsr_write(rt2x00dev, 30, rfcsr);
-
         rt2800_rfcsr_read(rt2x00dev, 23, &rfcsr);
         rt2x00_set_field8(&rfcsr, RFCSR23_FREQ_OFFSET, rt2x00dev->freq_offset);
         rt2800_rfcsr_write(rt2x00dev, 23, rfcsr);
@@ -3152,6 +3142,7 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
         case RF3322:
                 rt2800_config_channel_rf3322(rt2x00dev, conf, rf, info);
                 break;
+        case RF3070:
         case RF5360:
         case RF5370:
         case RF5372:
@@ -3166,7 +3157,8 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
                 rt2800_config_channel_rf2xxx(rt2x00dev, conf, rf, info);
         }
 
-        if (rt2x00_rf(rt2x00dev, RF3290) ||
+        if (rt2x00_rf(rt2x00dev, RF3070) ||
+            rt2x00_rf(rt2x00dev, RF3290) ||
             rt2x00_rf(rt2x00dev, RF3322) ||
             rt2x00_rf(rt2x00dev, RF5360) ||
             rt2x00_rf(rt2x00dev, RF5370) ||
@@ -3311,33 +3303,50 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
 
         rt2800_register_write(rt2x00dev, TX_PIN_CFG, tx_pin);
 
-        if (rt2x00_rt(rt2x00dev, RT3572))
+        if (rt2x00_rt(rt2x00dev, RT3572)) {
                 rt2800_rfcsr_write(rt2x00dev, 8, 0x80);
 
+                /* AGC init */
+                if (rf->channel <= 14)
+                        reg = 0x1c + (2 * rt2x00dev->lna_gain);
+                else
+                        reg = 0x22 + ((rt2x00dev->lna_gain * 5) / 3);
+
+                rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, reg);
+        }
+
         if (rt2x00_rt(rt2x00dev, RT3593)) {
-                if (rt2x00_is_usb(rt2x00dev)) {
-                        rt2800_register_read(rt2x00dev, GPIO_CTRL, &reg);
+                rt2800_register_read(rt2x00dev, GPIO_CTRL, &reg);
 
-                        /* Band selection. GPIO #8 controls all paths */
+                /* Band selection */
+                if (rt2x00_is_usb(rt2x00dev) ||
+                    rt2x00_is_pcie(rt2x00dev)) {
+                        /* GPIO #8 controls all paths */
                         rt2x00_set_field32(&reg, GPIO_CTRL_DIR8, 0);
                         if (rf->channel <= 14)
                                 rt2x00_set_field32(&reg, GPIO_CTRL_VAL8, 1);
                         else
                                 rt2x00_set_field32(&reg, GPIO_CTRL_VAL8, 0);
+                }
 
+                /* LNA PE control. */
+                if (rt2x00_is_usb(rt2x00dev)) {
+                        /* GPIO #4 controls PE0 and PE1,
+                         * GPIO #7 controls PE2
+                         */
                         rt2x00_set_field32(&reg, GPIO_CTRL_DIR4, 0);
                         rt2x00_set_field32(&reg, GPIO_CTRL_DIR7, 0);
 
-                        /* LNA PE control.
-                        * GPIO #4 controls PE0 and PE1,
-                        * GPIO #7 controls PE2
-                        */
                         rt2x00_set_field32(&reg, GPIO_CTRL_VAL4, 1);
                         rt2x00_set_field32(&reg, GPIO_CTRL_VAL7, 1);
-
-                        rt2800_register_write(rt2x00dev, GPIO_CTRL, reg);
+                } else if (rt2x00_is_pcie(rt2x00dev)) {
+                        /* GPIO #4 controls PE0, PE1 and PE2 */
+                        rt2x00_set_field32(&reg, GPIO_CTRL_DIR4, 0);
+                        rt2x00_set_field32(&reg, GPIO_CTRL_VAL4, 1);
                 }
 
+                rt2800_register_write(rt2x00dev, GPIO_CTRL, reg);
+
                 /* AGC init */
                 if (rf->channel <= 14)
                         reg = 0x1c + 2 * rt2x00dev->lna_gain;
@@ -4264,6 +4273,7 @@ void rt2800_vco_calibration(struct rt2x00_dev *rt2x00dev)
                 rt2800_rfcsr_write(rt2x00dev, 7, rfcsr);
                 break;
         case RF3053:
+        case RF3070:
         case RF3290:
         case RF5360:
         case RF5370:
@@ -4405,6 +4415,7 @@ static u8 rt2800_get_default_vgc(struct rt2x00_dev *rt2x00dev)
                     rt2x00_rt(rt2x00dev, RT3290) ||
                     rt2x00_rt(rt2x00dev, RT3390) ||
                     rt2x00_rt(rt2x00dev, RT3572) ||
+                    rt2x00_rt(rt2x00dev, RT3593) ||
                     rt2x00_rt(rt2x00dev, RT5390) ||
                     rt2x00_rt(rt2x00dev, RT5392) ||
                     rt2x00_rt(rt2x00dev, RT5592))
@@ -4412,8 +4423,8 @@ static u8 rt2800_get_default_vgc(struct rt2x00_dev *rt2x00dev)
                 else
                         vgc = 0x2e + rt2x00dev->lna_gain;
         } else { /* 5GHZ band */
-                if (rt2x00_rt(rt2x00dev, RT3572))
-                        vgc = 0x22 + (rt2x00dev->lna_gain * 5) / 3;
+                if (rt2x00_rt(rt2x00dev, RT3593))
+                        vgc = 0x20 + (rt2x00dev->lna_gain * 5) / 3;
                 else if (rt2x00_rt(rt2x00dev, RT5592))
                         vgc = 0x24 + (2 * rt2x00dev->lna_gain);
                 else {
@@ -4431,11 +4442,17 @@ static inline void rt2800_set_vgc(struct rt2x00_dev *rt2x00dev,
                                   struct link_qual *qual, u8 vgc_level)
 {
         if (qual->vgc_level != vgc_level) {
-                if (rt2x00_rt(rt2x00dev, RT5592)) {
+                if (rt2x00_rt(rt2x00dev, RT3572) ||
+                    rt2x00_rt(rt2x00dev, RT3593)) {
+                        rt2800_bbp_write_with_rx_chain(rt2x00dev, 66,
+                                                       vgc_level);
+                } else if (rt2x00_rt(rt2x00dev, RT5592)) {
                         rt2800_bbp_write(rt2x00dev, 83, qual->rssi > -65 ? 0x4a : 0x7a);
                         rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, vgc_level);
-                } else
+                } else {
                         rt2800_bbp_write(rt2x00dev, 66, vgc_level);
+                }
+
                 qual->vgc_level = vgc_level;
                 qual->vgc_level_reg = vgc_level;
         }
@@ -4454,17 +4471,35 @@ void rt2800_link_tuner(struct rt2x00_dev *rt2x00dev, struct link_qual *qual,
 
         if (rt2x00_rt_rev(rt2x00dev, RT2860, REV_RT2860C))
                 return;
-        /*
-         * When RSSI is better then -80 increase VGC level with 0x10, except
-         * for rt5592 chip.
+
+        /* When RSSI is better than a certain threshold, increase VGC
+         * with a chip specific value in order to improve the balance
+         * between sensibility and noise isolation.
          */
 
         vgc = rt2800_get_default_vgc(rt2x00dev);
 
-        if (rt2x00_rt(rt2x00dev, RT5592) && qual->rssi > -65)
-                vgc += 0x20;
-        else if (qual->rssi > -80)
-                vgc += 0x10;
+        switch (rt2x00dev->chip.rt) {
+        case RT3572:
+        case RT3593:
+                if (qual->rssi > -65) {
+                        if (rt2x00dev->curr_band == IEEE80211_BAND_2GHZ)
+                                vgc += 0x20;
+                        else
+                                vgc += 0x10;
+                }
+                break;
+
+        case RT5592:
+                if (qual->rssi > -65)
+                        vgc += 0x20;
+                break;
+
+        default:
+                if (qual->rssi > -80)
+                        vgc += 0x10;
+                break;
+        }
 
         rt2800_set_vgc(rt2x00dev, qual, vgc);
 }
@@ -5985,7 +6020,7 @@ static void rt2800_init_rfcsr_30xx(struct rt2x00_dev *rt2x00dev)
         rt2800_rfcsr_write(rt2x00dev, 20, 0xba);
         rt2800_rfcsr_write(rt2x00dev, 21, 0xdb);
         rt2800_rfcsr_write(rt2x00dev, 24, 0x16);
-        rt2800_rfcsr_write(rt2x00dev, 25, 0x01);
+        rt2800_rfcsr_write(rt2x00dev, 25, 0x03);
         rt2800_rfcsr_write(rt2x00dev, 29, 0x1f);
 
         if (rt2x00_rt_rev_lt(rt2x00dev, RT3070, REV_RT3070F)) {
@@ -6653,27 +6688,37 @@ int rt2800_enable_radio(struct rt2x00_dev *rt2x00dev)
         u16 word;
 
         /*
-         * Initialize all registers.
+         * Initialize MAC registers.
          */
         if (unlikely(rt2800_wait_wpdma_ready(rt2x00dev) ||
                      rt2800_init_registers(rt2x00dev)))
                 return -EIO;
 
         /*
-         * Send signal to firmware during boot time.
+         * Wait BBP/RF to wake up.
+         */
+        if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev)))
+                return -EIO;
+
+        /*
+         * Send signal during boot time to initialize firmware.
          */
         rt2800_register_write(rt2x00dev, H2M_BBP_AGENT, 0);
         rt2800_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
-        if (rt2x00_is_usb(rt2x00dev)) {
+        if (rt2x00_is_usb(rt2x00dev))
                 rt2800_register_write(rt2x00dev, H2M_INT_SRC, 0);
-                rt2800_mcu_request(rt2x00dev, MCU_BOOT_SIGNAL, 0, 0, 0);
-        }
+        rt2800_mcu_request(rt2x00dev, MCU_BOOT_SIGNAL, 0, 0, 0);
         msleep(1);
 
-        if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev) ||
-                     rt2800_wait_bbp_ready(rt2x00dev)))
+        /*
+         * Make sure BBP is up and running.
+         */
+        if (unlikely(rt2800_wait_bbp_ready(rt2x00dev)))
                 return -EIO;
 
+        /*
+         * Initialize BBP/RF registers.
+         */
         rt2800_init_bbp(rt2x00dev);
         rt2800_init_rfcsr(rt2x00dev);
 
@@ -7020,6 +7065,7 @@ static int rt2800_init_eeprom(struct rt2x00_dev *rt2x00dev)
         case RF3022:
         case RF3052:
         case RF3053:
+        case RF3070:
         case RF3290:
         case RF3320:
         case RF3322:
@@ -7542,6 +7588,7 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
                    rt2x00_rf(rt2x00dev, RF2020) ||
                    rt2x00_rf(rt2x00dev, RF3021) ||
                    rt2x00_rf(rt2x00dev, RF3022) ||
+                   rt2x00_rf(rt2x00dev, RF3070) ||
                    rt2x00_rf(rt2x00dev, RF3290) ||
                    rt2x00_rf(rt2x00dev, RF3320) ||
                    rt2x00_rf(rt2x00dev, RF3322) ||
@@ -7670,6 +7717,7 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         case RF3320:
         case RF3052:
         case RF3053:
+        case RF3070:
         case RF3290:
         case RF5360:
         case RF5370:
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 96961b9a395c..96677ce55da4 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -1176,6 +1176,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
         /* Linksys */
         { USB_DEVICE(0x13b1, 0x002f) },
         { USB_DEVICE(0x1737, 0x0079) },
+        /* Logitec */
+        { USB_DEVICE(0x0789, 0x0170) },
         /* Ralink */
         { USB_DEVICE(0x148f, 0x3572) },
         /* Sitecom */
@@ -1199,6 +1201,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x050d, 0x1103) },
         /* Cameo */
         { USB_DEVICE(0x148f, 0xf301) },
+        /* D-Link */
+        { USB_DEVICE(0x2001, 0x3c1f) },
         /* Edimax */
         { USB_DEVICE(0x7392, 0x7733) },
         /* Hawking */
@@ -1212,6 +1216,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x0789, 0x016b) },
         /* NETGEAR */
         { USB_DEVICE(0x0846, 0x9012) },
+        { USB_DEVICE(0x0846, 0x9013) },
         { USB_DEVICE(0x0846, 0x9019) },
         /* Planex */
         { USB_DEVICE(0x2019, 0xed19) },
@@ -1220,6 +1225,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
         /* Sitecom */
         { USB_DEVICE(0x0df6, 0x0067) },
         { USB_DEVICE(0x0df6, 0x006a) },
+        { USB_DEVICE(0x0df6, 0x006e) },
         /* ZyXEL */
         { USB_DEVICE(0x0586, 0x3421) },
 #endif
@@ -1236,6 +1242,9 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x2001, 0x3c1c) },
         { USB_DEVICE(0x2001, 0x3c1d) },
         { USB_DEVICE(0x2001, 0x3c1e) },
+        { USB_DEVICE(0x2001, 0x3c20) },
+        { USB_DEVICE(0x2001, 0x3c22) },
+        { USB_DEVICE(0x2001, 0x3c23) },
         /* LG innotek */
         { USB_DEVICE(0x043e, 0x7a22) },
         { USB_DEVICE(0x043e, 0x7a42) },
@@ -1258,12 +1267,17 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x043e, 0x7a32) },
         /* AVM GmbH */
         { USB_DEVICE(0x057c, 0x8501) },
-        /* D-Link DWA-160-B2 */
+        /* Buffalo */
+        { USB_DEVICE(0x0411, 0x0241) },
+        /* D-Link */
         { USB_DEVICE(0x2001, 0x3c1a) },
+        { USB_DEVICE(0x2001, 0x3c21) },
         /* Proware */
         { USB_DEVICE(0x043e, 0x7a13) },
         /* Ralink */
         { USB_DEVICE(0x148f, 0x5572) },
+        /* TRENDnet */
+        { USB_DEVICE(0x20f4, 0x724a) },
 #endif
 #ifdef CONFIG_RT2800USB_UNKNOWN
         /*
@@ -1333,6 +1347,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x1d4d, 0x0010) },
         /* Planex */
         { USB_DEVICE(0x2019, 0xab24) },
+        { USB_DEVICE(0x2019, 0xab29) },
         /* Qcom */
         { USB_DEVICE(0x18e8, 0x6259) },
         /* RadioShack */
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index fe4c572db52c..30ed92a6121e 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -39,6 +39,7 @@
 #include <linux/input-polldev.h>
 #include <linux/kfifo.h>
 #include <linux/hrtimer.h>
+#include <linux/average.h>
 
 #include <net/mac80211.h>
 
@@ -138,17 +139,6 @@
 #define SHORT_EIFS              ( SIFS + SHORT_DIFS + \
                                   GET_DURATION(IEEE80211_HEADER + ACK_SIZE, 10) )
 
-/*
- * Structure for average calculation
- * The avg field contains the actual average value,
- * but avg_weight is internally used during calculations
- * to prevent rounding errors.
- */
-struct avg_val {
-        int avg;
-        int avg_weight;
-};
-
 enum rt2x00_chip_intf {
         RT2X00_CHIP_INTF_PCI,
         RT2X00_CHIP_INTF_PCIE,
@@ -297,7 +287,7 @@ struct link_ant {
          * Similar to the avg_rssi in the link_qual structure
          * this value is updated by using the walking average.
          */
-        struct avg_val rssi_ant;
+        struct ewma rssi_ant;
 };
 
 /*
@@ -326,7 +316,7 @@ struct link {
         /*
          * Currently active average RSSI value
          */
-        struct avg_val avg_rssi;
+        struct ewma avg_rssi;
 
         /*
          * Work structure for scheduling periodic link tuning.
diff --git a/drivers/net/wireless/rt2x00/rt2x00link.c b/drivers/net/wireless/rt2x00/rt2x00link.c
index 8368aab86f28..a0e3c021c128 100644
--- a/drivers/net/wireless/rt2x00/rt2x00link.c
+++ b/drivers/net/wireless/rt2x00/rt2x00link.c
@@ -35,50 +35,28 @@
  */
 #define DEFAULT_RSSI            -128
 
-/*
- * Helper struct and macro to work with moving/walking averages.
- * When adding a value to the average value the following calculation
- * is needed:
- *
- *        avg_rssi = ((avg_rssi * 7) + rssi) / 8;
- *
- * The advantage of this approach is that we only need 1 variable
- * to store the average in (No need for a count and a total).
- * But more importantly, normal average values will over time
- * move less and less towards newly added values this results
- * that with link tuning, the device can have a very good RSSI
- * for a few minutes but when the device is moved away from the AP
- * the average will not decrease fast enough to compensate.
- * The walking average compensates this and will move towards
- * the new values correctly allowing a effective link tuning,
- * the speed of the average moving towards other values depends
- * on the value for the number of samples. The higher the number
- * of samples, the slower the average will move.
- * We use two variables to keep track of the average value to
- * compensate for the rounding errors. This can be a significant
- * error (>5dBm) if the factor is too low.
- */
-#define AVG_SAMPLES     8
-#define AVG_FACTOR      1000
-#define MOVING_AVERAGE(__avg, __val) \
-({ \
-        struct avg_val __new; \
-        __new.avg_weight = \
-            (__avg).avg_weight  ? \
-                ((((__avg).avg_weight * ((AVG_SAMPLES) - 1)) + \
-                  ((__val) * (AVG_FACTOR))) / \
-                 (AVG_SAMPLES)) : \
-                ((__val) * (AVG_FACTOR)); \
-        __new.avg = __new.avg_weight / (AVG_FACTOR); \
-        __new; \
-})
+/* Constants for EWMA calculations. */
+#define RT2X00_EWMA_FACTOR      1024
+#define RT2X00_EWMA_WEIGHT      8
+
+static inline int rt2x00link_get_avg_rssi(struct ewma *ewma)
+{
+        unsigned long avg;
+
+        avg = ewma_read(ewma);
+        if (avg)
+                return -avg;
+
+        return DEFAULT_RSSI;
+}
 
 static int rt2x00link_antenna_get_link_rssi(struct rt2x00_dev *rt2x00dev)
 {
         struct link_ant *ant = &rt2x00dev->link.ant;
 
-        if (ant->rssi_ant.avg && rt2x00dev->link.qual.rx_success)
-                return ant->rssi_ant.avg;
+        if (rt2x00dev->link.qual.rx_success)
+                return rt2x00link_get_avg_rssi(&ant->rssi_ant);
+
         return DEFAULT_RSSI;
 }
 
@@ -100,8 +78,8 @@ static void rt2x00link_antenna_update_rssi_history(struct rt2x00_dev *rt2x00dev,
 
 static void rt2x00link_antenna_reset(struct rt2x00_dev *rt2x00dev)
 {
-        rt2x00dev->link.ant.rssi_ant.avg = 0;
-        rt2x00dev->link.ant.rssi_ant.avg_weight = 0;
+        ewma_init(&rt2x00dev->link.ant.rssi_ant, RT2X00_EWMA_FACTOR,
+                  RT2X00_EWMA_WEIGHT);
 }
 
 static void rt2x00lib_antenna_diversity_sample(struct rt2x00_dev *rt2x00dev)
@@ -249,12 +227,12 @@ void rt2x00link_update_stats(struct rt2x00_dev *rt2x00dev,
         /*
          * Update global RSSI
          */
-        link->avg_rssi = MOVING_AVERAGE(link->avg_rssi, rxdesc->rssi);
+        ewma_add(&link->avg_rssi, -rxdesc->rssi);
 
         /*
          * Update antenna RSSI
          */
-        ant->rssi_ant = MOVING_AVERAGE(ant->rssi_ant, rxdesc->rssi);
+        ewma_add(&ant->rssi_ant, -rxdesc->rssi);
 }
 
 void rt2x00link_start_tuner(struct rt2x00_dev *rt2x00dev)
@@ -309,6 +287,8 @@ void rt2x00link_reset_tuner(struct rt2x00_dev *rt2x00dev, bool antenna)
          */
         rt2x00dev->link.count = 0;
         memset(qual, 0, sizeof(*qual));
+        ewma_init(&rt2x00dev->link.avg_rssi, RT2X00_EWMA_FACTOR,
+                  RT2X00_EWMA_WEIGHT);
 
         /*
          * Restore the VGC level as stored in the registers,
@@ -363,10 +343,10 @@ static void rt2x00link_tuner(struct work_struct *work)
          * collect the RSSI data we could use this. Otherwise we
          * must fallback to the default RSSI value.
          */
-        if (!link->avg_rssi.avg || !qual->rx_success)
+        if (!qual->rx_success)
                 qual->rssi = DEFAULT_RSSI;
         else
-                qual->rssi = link->avg_rssi.avg;
+                qual->rssi = rt2x00link_get_avg_rssi(&link->avg_rssi);
 
         /*
          * Check if link tuning is supported by the hardware, some hardware
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
index 76d95deb274b..6c5d667103c4 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.c
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
@@ -121,7 +121,7 @@ int rt2x00pci_probe(struct pci_dev *pci_dev, const struct rt2x00_ops *ops)
         rt2x00dev->ops = ops;
         rt2x00dev->hw = hw;
         rt2x00dev->irq = pci_dev->irq;
-        rt2x00dev->name = pci_name(pci_dev);
+        rt2x00dev->name = ops->name;
 
         if (pci_is_pcie(pci_dev))
                 rt2x00_set_chip_intf(rt2x00dev, RT2X00_CHIP_INTF_PCIE);
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 6c8a33b6ee22..218e3206ce1b 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -1033,38 +1033,21 @@ EXPORT_SYMBOL_GPL(rt2x00queue_stop_queue);
 
 void rt2x00queue_flush_queue(struct data_queue *queue, bool drop)
 {
-        bool started;
         bool tx_queue =
                 (queue->qid == QID_AC_VO) ||
                 (queue->qid == QID_AC_VI) ||
                 (queue->qid == QID_AC_BE) ||
                 (queue->qid == QID_AC_BK);
 
-        mutex_lock(&queue->status_lock);
 
         /*
-         * If the queue has been started, we must stop it temporarily
-         * to prevent any new frames to be queued on the device. If
-         * we are not dropping the pending frames, the queue must
-         * only be stopped in the software and not the hardware,
-         * otherwise the queue will never become empty on its own.
+         * If we are not supposed to drop any pending
+         * frames, this means we must force a start (=kick)
+         * to the queue to make sure the hardware will
+         * start transmitting.
          */
-        started = test_bit(QUEUE_STARTED, &queue->flags);
-        if (started) {
-                /*
-                 * Pause the queue
-                 */
-                rt2x00queue_pause_queue(queue);
-
-                /*
-                 * If we are not supposed to drop any pending
-                 * frames, this means we must force a start (=kick)
-                 * to the queue to make sure the hardware will
-                 * start transmitting.
-                 */
-                if (!drop && tx_queue)
-                        queue->rt2x00dev->ops->lib->kick_queue(queue);
-        }
+        if (!drop && tx_queue)
+                queue->rt2x00dev->ops->lib->kick_queue(queue);
 
         /*
          * Check if driver supports flushing, if that is the case we can
@@ -1080,14 +1063,6 @@ void rt2x00queue_flush_queue(struct data_queue *queue, bool drop)
         if (unlikely(!rt2x00queue_empty(queue)))
                 rt2x00_warn(queue->rt2x00dev, "Queue %d failed to flush\n",
                             queue->qid);
-
-        /*
-         * Restore the queue to the previous status
-         */
-        if (started)
-                rt2x00queue_unpause_queue(queue);
-
-        mutex_unlock(&queue->status_lock);
 }
 EXPORT_SYMBOL_GPL(rt2x00queue_flush_queue);
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index 88289873c0cf..4e121627925d 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -523,7 +523,9 @@ static void rt2x00usb_watchdog_tx_dma(struct data_queue *queue)
         rt2x00_warn(queue->rt2x00dev, "TX queue %d DMA timed out, invoke forced forced reset\n",
                     queue->qid);
 
+        rt2x00queue_stop_queue(queue);
         rt2x00queue_flush_queue(queue, true);
+        rt2x00queue_start_queue(queue);
 }
 
 static int rt2x00usb_dma_timeout(struct data_queue *queue)
diff --git a/drivers/net/wireless/rtl818x/rtl8180/dev.c b/drivers/net/wireless/rtl818x/rtl8180/dev.c
index fc207b268e4f..a91506b12a62 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8180/dev.c
@@ -1122,7 +1122,6 @@ static int rtl8180_probe(struct pci_dev *pdev,
         iounmap(priv->map);
 
  err_free_dev:
-        pci_set_drvdata(pdev, NULL);
         ieee80211_free_hw(dev);
 
  err_free_reg:
diff --git a/drivers/net/wireless/rtl818x/rtl8187/dev.c b/drivers/net/wireless/rtl818x/rtl8187/dev.c
index 841fb9dfc9da..9a6edb0c014e 100644
--- a/drivers/net/wireless/rtl818x/rtl8187/dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187/dev.c
@@ -438,17 +438,16 @@ static int rtl8187_init_urbs(struct ieee80211_hw *dev)
                 skb_queue_tail(&priv->rx_queue, skb);
                 usb_anchor_urb(entry, &priv->anchored);
                 ret = usb_submit_urb(entry, GFP_KERNEL);
+                usb_put_urb(entry);
                 if (ret) {
                         skb_unlink(skb, &priv->rx_queue);
                         usb_unanchor_urb(entry);
                         goto err;
                 }
-                usb_free_urb(entry);
         }
         return ret;
 
 err:
-        usb_free_urb(entry);
         kfree_skb(skb);
         usb_kill_anchored_urbs(&priv->anchored);
         return ret;
@@ -956,8 +955,12 @@ static int rtl8187_start(struct ieee80211_hw *dev)
                                   (RETRY_COUNT << 8  /* short retry limit */) |
                                   (RETRY_COUNT << 0  /* long retry limit */) |
                                   (7 << 21 /* MAX TX DMA */));
-                rtl8187_init_urbs(dev);
-                rtl8187b_init_status_urb(dev);
+                ret = rtl8187_init_urbs(dev);
+                if (ret)
+                        goto rtl8187_start_exit;
+                ret = rtl8187b_init_status_urb(dev);
+                if (ret)
+                        usb_kill_anchored_urbs(&priv->anchored);
                 goto rtl8187_start_exit;
         }
 
@@ -966,7 +969,9 @@ static int rtl8187_start(struct ieee80211_hw *dev)
         rtl818x_iowrite32(priv, &priv->map->MAR[0], ~0);
         rtl818x_iowrite32(priv, &priv->map->MAR[1], ~0);
 
-        rtl8187_init_urbs(dev);
+        ret = rtl8187_init_urbs(dev);
+        if (ret)
+                goto rtl8187_start_exit;
 
         reg = RTL818X_RX_CONF_ONLYERLPKT |
               RTL818X_RX_CONF_RX_AUTORESETPHY |
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 8bb4a9a01a18..9a78e3daf742 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -1613,6 +1613,35 @@ err_free:
 }
 EXPORT_SYMBOL(rtl_send_smps_action);
 
+void rtl_phy_scan_operation_backup(struct ieee80211_hw *hw, u8 operation)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        enum io_type iotype;
+
+        if (!is_hal_stop(rtlhal)) {
+                switch (operation) {
+                case SCAN_OPT_BACKUP:
+                        iotype = IO_CMD_PAUSE_DM_BY_SCAN;
+                        rtlpriv->cfg->ops->set_hw_reg(hw,
+                                                      HW_VAR_IO_CMD,
+                                                      (u8 *)&iotype);
+                        break;
+                case SCAN_OPT_RESTORE:
+                        iotype = IO_CMD_RESUME_DM_BY_SCAN;
+                        rtlpriv->cfg->ops->set_hw_reg(hw,
+                                                      HW_VAR_IO_CMD,
+                                                      (u8 *)&iotype);
+                        break;
+                default:
+                        RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                                 "Unknown Scan Backup operation.\n");
+                        break;
+                }
+        }
+}
+EXPORT_SYMBOL(rtl_phy_scan_operation_backup);
+
 /* There seem to be issues in mac80211 regarding when del ba frames can be
  * received. As a work around, we make a fake del_ba if we receive a ba_req;
  * however, rx_agg was opened to let mac80211 release some ba related
diff --git a/drivers/net/wireless/rtlwifi/base.h b/drivers/net/wireless/rtlwifi/base.h
index 0e5fe0902daf..0cd07420777a 100644
--- a/drivers/net/wireless/rtlwifi/base.h
+++ b/drivers/net/wireless/rtlwifi/base.h
@@ -114,7 +114,6 @@ void rtl_init_rfkill(struct ieee80211_hw *hw);
 void rtl_deinit_rfkill(struct ieee80211_hw *hw);
 
 void rtl_beacon_statistic(struct ieee80211_hw *hw, struct sk_buff *skb);
-void rtl_watch_dog_timer_callback(unsigned long data);
 void rtl_deinit_deferred_work(struct ieee80211_hw *hw);
 
 bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx);
@@ -153,5 +152,6 @@ int rtlwifi_rate_mapping(struct ieee80211_hw *hw,
 bool rtl_tx_mgmt_proc(struct ieee80211_hw *hw, struct sk_buff *skb);
 struct sk_buff *rtl_make_del_ba(struct ieee80211_hw *hw,
                                 u8 *sa, u8 *bssid, u16 tid);
+void rtl_phy_scan_operation_backup(struct ieee80211_hw *hw, u8 operation);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/efuse.c b/drivers/net/wireless/rtlwifi/efuse.c
index 838a1ed3f194..ae13fb94b2e8 100644
--- a/drivers/net/wireless/rtlwifi/efuse.c
+++ b/drivers/net/wireless/rtlwifi/efuse.c
@@ -1203,20 +1203,18 @@ static void efuse_power_switch(struct ieee80211_hw *hw, u8 write, u8 pwrstate)
 
 static u16 efuse_get_current_size(struct ieee80211_hw *hw)
 {
-        int continual = true;
         u16 efuse_addr = 0;
         u8 hworden;
         u8 efuse_data, word_cnts;
 
-        while (continual && efuse_one_byte_read(hw, efuse_addr, &efuse_data)
-               && (efuse_addr < EFUSE_MAX_SIZE)) {
-                if (efuse_data != 0xFF) {
-                        hworden = efuse_data & 0x0F;
-                        word_cnts = efuse_calculate_word_cnts(hworden);
-                        efuse_addr = efuse_addr + (word_cnts * 2) + 1;
-                } else {
-                        continual = false;
-                }
+        while (efuse_one_byte_read(hw, efuse_addr, &efuse_data) &&
+               efuse_addr < EFUSE_MAX_SIZE) {
+                if (efuse_data == 0xFF)
+                        break;
+
+                hworden = efuse_data & 0x0F;
+                word_cnts = efuse_calculate_word_cnts(hworden);
+                efuse_addr = efuse_addr + (word_cnts * 2) + 1;
         }
 
         return efuse_addr;
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index 703f839af6ca..0f494444bcd1 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -736,7 +736,6 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
 
         struct rtl_stats stats = {
                 .signal = 0,
-                .noise = -98,
                 .rate = 0,
         };
         int index = rtlpci->rx_ring[rx_queue_idx].idx;
@@ -2009,7 +2008,6 @@ fail2:
 fail1:
         if (hw)
                 ieee80211_free_hw(hw);
-        pci_set_drvdata(pdev, NULL);
         pci_disable_device(pdev);
 
         return err;
@@ -2064,8 +2062,6 @@ void rtl_pci_disconnect(struct pci_dev *pdev)
 
         rtl_pci_disable_aspm(hw);
 
-        pci_set_drvdata(pdev, NULL);
-
         ieee80211_free_hw(hw);
 }
 EXPORT_SYMBOL(rtl_pci_disconnect);
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
index b68cae3024fc..e06971be7df7 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
@@ -143,6 +143,7 @@ static void _rtl88ee_set_fw_clock_on(struct ieee80211_hw *hw,
                 } else {
                         rtlhal->fw_clk_change_in_progress = false;
                         spin_unlock_bh(&rtlpriv->locks.fw_ps_lock);
+                        break;
                 }
         }
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/phy.c b/drivers/net/wireless/rtlwifi/rtl8188ee/phy.c
index e655c0473225..d67f9c731cc4 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/phy.c
@@ -1136,34 +1136,6 @@ void rtl88e_phy_set_txpower_level(struct ieee80211_hw *hw, u8 channel)
                                            &bw40_pwr[0], channel);
 }
 
-void rtl88e_phy_scan_operation_backup(struct ieee80211_hw *hw, u8 operation)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
-        enum io_type iotype;
-
-        if (!is_hal_stop(rtlhal)) {
-                switch (operation) {
-                case SCAN_OPT_BACKUP:
-                        iotype = IO_CMD_PAUSE_DM_BY_SCAN;
-                        rtlpriv->cfg->ops->set_hw_reg(hw,
-                                                      HW_VAR_IO_CMD,
-                                                      (u8 *)&iotype);
-                        break;
-                case SCAN_OPT_RESTORE:
-                        iotype = IO_CMD_RESUME_DM_BY_SCAN;
-                        rtlpriv->cfg->ops->set_hw_reg(hw,
-                                                      HW_VAR_IO_CMD,
-                                                      (u8 *)&iotype);
-                        break;
-                default:
-                        RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
-                                 "Unknown Scan Backup operation.\n");
-                        break;
-                }
-        }
-}
-
 void rtl88e_phy_set_bw_mode_callback(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/phy.h b/drivers/net/wireless/rtlwifi/rtl8188ee/phy.h
index f1acd6d27e44..d4545f06e185 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/phy.h
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/phy.h
@@ -217,8 +217,6 @@ extern void rtl88e_phy_get_hw_reg_originalvalue(struct ieee80211_hw *hw);
 extern void rtl88e_phy_get_txpower_level(struct ieee80211_hw *hw,
                                          long *powerlevel);
 extern void rtl88e_phy_set_txpower_level(struct ieee80211_hw *hw, u8 channel);
-extern void rtl88e_phy_scan_operation_backup(struct ieee80211_hw *hw,
-                                             u8 operation);
 extern void rtl88e_phy_set_bw_mode_callback(struct ieee80211_hw *hw);
 extern void rtl88e_phy_set_bw_mode(struct ieee80211_hw *hw,
                                    enum nl80211_channel_type ch_type);
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c b/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c
index c254693a1e6a..347af1e4f438 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c
@@ -30,6 +30,7 @@
 #include "../wifi.h"
 #include "../core.h"
 #include "../pci.h"
+#include "../base.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -244,7 +245,7 @@ static struct rtl_hal_ops rtl8188ee_hal_ops = {
         .set_bw_mode = rtl88e_phy_set_bw_mode,
         .switch_channel = rtl88e_phy_sw_chnl,
         .dm_watchdog = rtl88e_dm_watchdog,
-        .scan_operation_backup = rtl88e_phy_scan_operation_backup,
+        .scan_operation_backup = rtl_phy_scan_operation_backup,
         .set_rf_power_state = rtl88e_phy_set_rf_power_state,
         .led_control = rtl88ee_led_control,
         .set_desc = rtl88ee_set_desc,
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c b/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
index 68685a898257..aece6c9cccf1 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
@@ -478,7 +478,6 @@ bool rtl88ee_rx_query_desc(struct ieee80211_hw *hw,
 
         /*rx_status->qual = status->signal; */
         rx_status->signal = status->recvsignalpower + 10;
-        /*rx_status->noise = -status->noise; */
         if (status->packet_report_type == TX_REPORT2) {
                 status->macid_valid_entry[0] =
                          GET_RX_RPT2_DESC_MACID_VALID_1(pdesc);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
index d2d57a27a7c1..e9caa5d4cff0 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
@@ -541,29 +541,6 @@ EXPORT_SYMBOL(rtl92c_dm_write_dig);
 
 static void rtl92c_dm_pwdb_monitor(struct ieee80211_hw *hw)
 {
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        long tmpentry_max_pwdb = 0, tmpentry_min_pwdb = 0xff;
-
-        u8 h2c_parameter[3] = { 0 };
-
-        return;
-
-        if (tmpentry_max_pwdb != 0) {
-                rtlpriv->dm.entry_max_undec_sm_pwdb = tmpentry_max_pwdb;
-        } else {
-                rtlpriv->dm.entry_max_undec_sm_pwdb = 0;
-        }
-
-        if (tmpentry_min_pwdb != 0xff) {
-                rtlpriv->dm.entry_min_undec_sm_pwdb = tmpentry_min_pwdb;
-        } else {
-                rtlpriv->dm.entry_min_undec_sm_pwdb = 0;
-        }
-
-        h2c_parameter[2] = (u8) (rtlpriv->dm.undec_sm_pwdb & 0xFF);
-        h2c_parameter[0] = 0;
-
-        rtl92c_fill_h2c_cmd(hw, H2C_RSSI_REPORT, 3, h2c_parameter);
 }
 
 void rtl92c_dm_init_edca_turbo(struct ieee80211_hw *hw)
@@ -673,7 +650,7 @@ static void rtl92c_dm_txpower_tracking_callback_thermalmeter(struct ieee80211_hw
         s8 cck_index = 0;
         int i;
         bool is2t = IS_92C_SERIAL(rtlhal->version);
-        s8 txpwr_level[2] = {0, 0};
+        s8 txpwr_level[3] = {0, 0, 0};
         u8 ofdm_min_index = 6, rf;
 
         rtlpriv->dm.txpower_trackinginit = true;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
index 246e5352f2e1..0c0e78263a66 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
@@ -592,36 +592,6 @@ long _rtl92c_phy_txpwr_idx_to_dbm(struct ieee80211_hw *hw,
 }
 EXPORT_SYMBOL(_rtl92c_phy_txpwr_idx_to_dbm);
 
-void rtl92c_phy_scan_operation_backup(struct ieee80211_hw *hw, u8 operation)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
-        enum io_type iotype;
-
-        if (!is_hal_stop(rtlhal)) {
-                switch (operation) {
-                case SCAN_OPT_BACKUP:
-                        iotype = IO_CMD_PAUSE_DM_BY_SCAN;
-                        rtlpriv->cfg->ops->set_hw_reg(hw,
-                                                      HW_VAR_IO_CMD,
-                                                      (u8 *)&iotype);
-
-                        break;
-                case SCAN_OPT_RESTORE:
-                        iotype = IO_CMD_RESUME_DM_BY_SCAN;
-                        rtlpriv->cfg->ops->set_hw_reg(hw,
-                                                      HW_VAR_IO_CMD,
-                                                      (u8 *)&iotype);
-                        break;
-                default:
-                        RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
-                                 "Unknown Scan Backup operation\n");
-                        break;
-                }
-        }
-}
-EXPORT_SYMBOL(rtl92c_phy_scan_operation_backup);
-
 void rtl92c_phy_set_bw_mode(struct ieee80211_hw *hw,
                             enum nl80211_channel_type ch_type)
 {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.h b/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.h
index cec10d696492..e79dabe9ba1d 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.h
@@ -39,9 +39,7 @@
 #define RT_CANNOT_IO(hw)                false
 #define HIGHPOWER_RADIOA_ARRAYLEN       22
 
-#define IQK_ADDA_REG_NUM                16
 #define MAX_TOLERANCE                   5
-#define IQK_DELAY_TIME                  1
 
 #define APK_BB_REG_NUM                  5
 #define APK_AFE_REG_NUM                 16
@@ -205,8 +203,6 @@ void rtl92c_phy_get_txpower_level(struct ieee80211_hw *hw,
 void rtl92c_phy_set_txpower_level(struct ieee80211_hw *hw, u8 channel);
 bool rtl92c_phy_update_txpower_dbm(struct ieee80211_hw *hw,
                                           long power_indbm);
-void rtl92c_phy_scan_operation_backup(struct ieee80211_hw *hw,
-                                             u8 operation);
 void rtl92c_phy_set_bw_mode(struct ieee80211_hw *hw,
                                    enum nl80211_channel_type ch_type);
 void rtl92c_phy_sw_chnl_callback(struct ieee80211_hw *hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/def.h b/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
index 3cfa1bb0f476..fa24de43ce79 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
@@ -152,8 +152,6 @@ enum version_8192c {
 #define IS_VENDOR_UMC_A_CUT(version)    ((IS_CHIP_VENDOR_UMC(version)) ? \
         ((GET_CVID_CUT_VERSION(version)) ? false : true) : false)
 #define IS_CHIP_VER_B(version)  ((version & CHIP_VER_B) ? true : false)
-#define IS_VENDOR_UMC_A_CUT(version)    ((IS_CHIP_VENDOR_UMC(version)) ? \
-        ((GET_CVID_CUT_VERSION(version)) ? false : true) : false)
 #define IS_92C_SERIAL(version)  ((version & CHIP_92C_BITMASK) ? true : false)
 #define IS_CHIP_VENDOR_UMC(version)             \
         ((version & CHIP_VENDOR_UMC) ? true : false)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/phy.h b/drivers/net/wireless/rtlwifi/rtl8192ce/phy.h
index d5e3b704f930..aeb268b190c6 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/phy.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/phy.h
@@ -39,9 +39,7 @@
 #define RT_CANNOT_IO(hw)                false
 #define HIGHPOWER_RADIOA_ARRAYLEN       22
 
-#define IQK_ADDA_REG_NUM                16
 #define MAX_TOLERANCE                   5
-#define IQK_DELAY_TIME                  1
 
 #define APK_BB_REG_NUM                  5
 #define APK_AFE_REG_NUM                 16
@@ -209,8 +207,6 @@ void rtl92c_phy_get_txpower_level(struct ieee80211_hw *hw,
 void rtl92c_phy_set_txpower_level(struct ieee80211_hw *hw, u8 channel);
 bool rtl92c_phy_update_txpower_dbm(struct ieee80211_hw *hw,
                                           long power_indbm);
-void rtl92c_phy_scan_operation_backup(struct ieee80211_hw *hw,
-                                             u8 operation);
 void rtl92c_phy_set_bw_mode(struct ieee80211_hw *hw,
                                    enum nl80211_channel_type ch_type);
 void rtl92c_phy_sw_chnl_callback(struct ieee80211_hw *hw);
@@ -226,7 +222,6 @@ bool rtl92c_phy_config_rf_with_headerfile(struct ieee80211_hw *hw,
                                           enum radio_path rfpath);
 bool rtl8192_phy_check_is_legal_rfpath(struct ieee80211_hw *hw,
                                               u32 rfpath);
-bool rtl92c_phy_set_io_cmd(struct ieee80211_hw *hw, enum io_type iotype);
 bool rtl92ce_phy_set_rf_power_state(struct ieee80211_hw *hw,
                                           enum rf_pwrstate rfpwr_state);
 void rtl92ce_phy_set_rf_on(struct ieee80211_hw *hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/reg.h b/drivers/net/wireless/rtlwifi/rtl8192ce/reg.h
index bd4aef74c056..8922ecb47ad2 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/reg.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/reg.h
@@ -560,7 +560,6 @@
 #define EEPROM_DEFAULT_TXPOWERLEVEL             0x22
 #define EEPROM_DEFAULT_HT40_2SDIFF              0x0
 #define EEPROM_DEFAULT_HT20_DIFF                2
-#define EEPROM_DEFAULT_LEGACYHTTXPOWERDIFF      0x3
 #define EEPROM_DEFAULT_HT40_PWRMAXOFFSET        0
 #define EEPROM_DEFAULT_HT20_PWRMAXOFFSET        0
 
@@ -639,17 +638,8 @@
 
 #define EEPROM_TXPWR_GROUP                      0x6F
 
-#define EEPROM_TSSI_A                           0x76
-#define EEPROM_TSSI_B                           0x77
-#define EEPROM_THERMAL_METER                    0x78
-
 #define EEPROM_CHANNELPLAN                      0x75
 
-#define RF_OPTION1                              0x79
-#define RF_OPTION2                              0x7A
-#define RF_OPTION3                              0x7B
-#define RF_OPTION4                              0x7C
-
 #define STOPBECON                               BIT(6)
 #define STOPHIGHT                               BIT(5)
 #define STOPMGT                                 BIT(4)
@@ -689,13 +679,6 @@
 #define RSV_CTRL                                0x001C
 #define RD_CTRL                                 0x0524
 
-#define REG_USB_INFO                            0xFE17
-#define REG_USB_SPECIAL_OPTION                  0xFE55
-
-#define REG_USB_DMA_AGG_TO                      0xFE5B
-#define REG_USB_AGG_TO                          0xFE5C
-#define REG_USB_AGG_TH                          0xFE5D
-
 #define REG_USB_VID                             0xFE60
 #define REG_USB_PID                             0xFE62
 #define REG_USB_OPTIONAL                        0xFE64
@@ -1196,9 +1179,6 @@
 #define POLLING_LLT_THRESHOLD                   20
 #define POLLING_READY_TIMEOUT_COUNT             1000
 
-#define MAX_MSS_DENSITY_2T                      0x13
-#define MAX_MSS_DENSITY_1T                      0x0A
-
 #define EPROM_CMD_OPERATING_MODE_MASK   ((1<<7)|(1<<6))
 #define EPROM_CMD_CONFIG                        0x3
 #define EPROM_CMD_LOAD                          1
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
index 14203561b6ee..b790320d2030 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
@@ -30,6 +30,7 @@
 #include "../wifi.h"
 #include "../core.h"
 #include "../pci.h"
+#include "../base.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -219,7 +220,7 @@ static struct rtl_hal_ops rtl8192ce_hal_ops = {
         .set_bw_mode = rtl92c_phy_set_bw_mode,
         .switch_channel = rtl92c_phy_sw_chnl,
         .dm_watchdog = rtl92c_dm_watchdog,
-        .scan_operation_backup = rtl92c_phy_scan_operation_backup,
+        .scan_operation_backup = rtl_phy_scan_operation_backup,
         .set_rf_power_state = rtl92c_phy_set_rf_power_state,
         .led_control = rtl92ce_led_control,
         .set_desc = rtl92ce_set_desc,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
index 6ad23b413eb3..52abf0a862fa 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
@@ -420,7 +420,6 @@ bool rtl92ce_rx_query_desc(struct ieee80211_hw *hw,
 
         /*rx_status->qual = stats->signal; */
         rx_status->signal = stats->recvsignalpower + 10;
-        /*rx_status->noise = -stats->noise; */
 
         return true;
 }
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c b/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
index da4f587199ee..393685390f3e 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
@@ -32,6 +32,7 @@
 #include "../usb.h"
 #include "../ps.h"
 #include "../cam.h"
+#include "../stats.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -738,16 +739,6 @@ static u8 _rtl92c_evm_db_to_percentage(char value)
         return ret_val;
 }
 
-static long _rtl92c_translate_todbm(struct ieee80211_hw *hw,
-                                     u8 signal_strength_index)
-{
-        long signal_power;
-
-        signal_power = (long)((signal_strength_index + 1) >> 1);
-        signal_power -= 95;
-        return signal_power;
-}
-
 static long _rtl92c_signal_scale_mapping(struct ieee80211_hw *hw,
                 long currsig)
 {
@@ -913,180 +904,6 @@ static void _rtl92c_query_rxphystatus(struct ieee80211_hw *hw,
                           (hw, total_rssi /= rf_rx_num));
 }
 
-static void _rtl92c_process_ui_rssi(struct ieee80211_hw *hw,
-                struct rtl_stats *pstats)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_phy *rtlphy = &(rtlpriv->phy);
-        u8 rfpath;
-        u32 last_rssi, tmpval;
-
-        if (pstats->packet_toself || pstats->packet_beacon) {
-                rtlpriv->stats.rssi_calculate_cnt++;
-                if (rtlpriv->stats.ui_rssi.total_num++ >=
-                    PHY_RSSI_SLID_WIN_MAX) {
-                        rtlpriv->stats.ui_rssi.total_num =
-                            PHY_RSSI_SLID_WIN_MAX;
-                        last_rssi =
-                            rtlpriv->stats.ui_rssi.elements[rtlpriv->
-                                                           stats.ui_rssi.index];
-                        rtlpriv->stats.ui_rssi.total_val -= last_rssi;
-                }
-                rtlpriv->stats.ui_rssi.total_val += pstats->signalstrength;
-                rtlpriv->stats.ui_rssi.elements[rtlpriv->stats.ui_rssi.
-                                        index++] = pstats->signalstrength;
-                if (rtlpriv->stats.ui_rssi.index >= PHY_RSSI_SLID_WIN_MAX)
-                        rtlpriv->stats.ui_rssi.index = 0;
-                tmpval = rtlpriv->stats.ui_rssi.total_val /
-                    rtlpriv->stats.ui_rssi.total_num;
-                rtlpriv->stats.signal_strength =
-                    _rtl92c_translate_todbm(hw, (u8) tmpval);
-                pstats->rssi = rtlpriv->stats.signal_strength;
-        }
-        if (!pstats->is_cck && pstats->packet_toself) {
-                for (rfpath = RF90_PATH_A; rfpath < rtlphy->num_total_rfpath;
-                     rfpath++) {
-                        if (!rtl8192_phy_check_is_legal_rfpath(hw, rfpath))
-                                continue;
-                        if (rtlpriv->stats.rx_rssi_percentage[rfpath] == 0) {
-                                rtlpriv->stats.rx_rssi_percentage[rfpath] =
-                                    pstats->rx_mimo_signalstrength[rfpath];
-                        }
-                        if (pstats->rx_mimo_signalstrength[rfpath] >
-                            rtlpriv->stats.rx_rssi_percentage[rfpath]) {
-                                rtlpriv->stats.rx_rssi_percentage[rfpath] =
-                                    ((rtlpriv->stats.
-                                      rx_rssi_percentage[rfpath] *
-                                      (RX_SMOOTH_FACTOR - 1)) +
-                                     (pstats->rx_mimo_signalstrength[rfpath])) /
-                                    (RX_SMOOTH_FACTOR);
-
-                                rtlpriv->stats.rx_rssi_percentage[rfpath] =
-                                    rtlpriv->stats.rx_rssi_percentage[rfpath] +
-                                    1;
-                        } else {
-                                rtlpriv->stats.rx_rssi_percentage[rfpath] =
-                                    ((rtlpriv->stats.
-                                      rx_rssi_percentage[rfpath] *
-                                      (RX_SMOOTH_FACTOR - 1)) +
-                                     (pstats->rx_mimo_signalstrength[rfpath])) /
-                                    (RX_SMOOTH_FACTOR);
-                        }
-                }
-        }
-}
-
-static void _rtl92c_update_rxsignalstatistics(struct ieee80211_hw *hw,
-                                               struct rtl_stats *pstats)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        int weighting = 0;
-
-        if (rtlpriv->stats.recv_signal_power == 0)
-                rtlpriv->stats.recv_signal_power = pstats->recvsignalpower;
-        if (pstats->recvsignalpower > rtlpriv->stats.recv_signal_power)
-                weighting = 5;
-        else if (pstats->recvsignalpower < rtlpriv->stats.recv_signal_power)
-                weighting = (-5);
-        rtlpriv->stats.recv_signal_power =
-            (rtlpriv->stats.recv_signal_power * 5 +
-             pstats->recvsignalpower + weighting) / 6;
-}
-
-static void _rtl92c_process_pwdb(struct ieee80211_hw *hw,
-                struct rtl_stats *pstats)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
-        long undec_sm_pwdb = 0;
-
-        if (mac->opmode == NL80211_IFTYPE_ADHOC) {
-                return;
-        } else {
-                undec_sm_pwdb = rtlpriv->dm.undec_sm_pwdb;
-        }
-        if (pstats->packet_toself || pstats->packet_beacon) {
-                if (undec_sm_pwdb < 0)
-                        undec_sm_pwdb = pstats->rx_pwdb_all;
-                if (pstats->rx_pwdb_all > (u32) undec_sm_pwdb) {
-                        undec_sm_pwdb = (((undec_sm_pwdb) *
-                              (RX_SMOOTH_FACTOR - 1)) +
-                             (pstats->rx_pwdb_all)) / (RX_SMOOTH_FACTOR);
-                        undec_sm_pwdb += 1;
-                } else {
-                        undec_sm_pwdb = (((undec_sm_pwdb) *
-                              (RX_SMOOTH_FACTOR - 1)) +
-                             (pstats->rx_pwdb_all)) / (RX_SMOOTH_FACTOR);
-                }
-                rtlpriv->dm.undec_sm_pwdb = undec_sm_pwdb;
-                _rtl92c_update_rxsignalstatistics(hw, pstats);
-        }
-}
-
-static void _rtl92c_process_LINK_Q(struct ieee80211_hw *hw,
-                                             struct rtl_stats *pstats)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        u32 last_evm = 0, n_stream, tmpval;
-
-        if (pstats->signalquality != 0) {
-                if (pstats->packet_toself || pstats->packet_beacon) {
-                        if (rtlpriv->stats.LINK_Q.total_num++ >=
-                            PHY_LINKQUALITY_SLID_WIN_MAX) {
-                                rtlpriv->stats.LINK_Q.total_num =
-                                    PHY_LINKQUALITY_SLID_WIN_MAX;
-                                last_evm =
-                                    rtlpriv->stats.LINK_Q.elements
-                                    [rtlpriv->stats.LINK_Q.index];
-                                rtlpriv->stats.LINK_Q.total_val -=
-                                    last_evm;
-                        }
-                        rtlpriv->stats.LINK_Q.total_val +=
-                            pstats->signalquality;
-                        rtlpriv->stats.LINK_Q.elements
-                           [rtlpriv->stats.LINK_Q.index++] =
-                            pstats->signalquality;
-                        if (rtlpriv->stats.LINK_Q.index >=
-                            PHY_LINKQUALITY_SLID_WIN_MAX)
-                                rtlpriv->stats.LINK_Q.index = 0;
-                        tmpval = rtlpriv->stats.LINK_Q.total_val /
-                            rtlpriv->stats.LINK_Q.total_num;
-                        rtlpriv->stats.signal_quality = tmpval;
-                        rtlpriv->stats.last_sigstrength_inpercent = tmpval;
-                        for (n_stream = 0; n_stream < 2;
-                             n_stream++) {
-                                if (pstats->RX_SIGQ[n_stream] != -1) {
-                                        if (!rtlpriv->stats.RX_EVM[n_stream]) {
-                                                rtlpriv->stats.RX_EVM[n_stream]
-                                                 = pstats->RX_SIGQ[n_stream];
-                                        }
-                                        rtlpriv->stats.RX_EVM[n_stream] =
-                                            ((rtlpriv->stats.RX_EVM
-                                            [n_stream] *
-                                            (RX_SMOOTH_FACTOR - 1)) +
-                                            (pstats->RX_SIGQ
-                                            [n_stream] * 1)) /
-                                            (RX_SMOOTH_FACTOR);
-                                }
-                        }
-                }
-        } else {
-                ;
-        }
-}
-
-static void _rtl92c_process_phyinfo(struct ieee80211_hw *hw,
-                                     u8 *buffer,
-                                     struct rtl_stats *pcurrent_stats)
-{
-        if (!pcurrent_stats->packet_matchbssid &&
-            !pcurrent_stats->packet_beacon)
-                return;
-        _rtl92c_process_ui_rssi(hw, pcurrent_stats);
-        _rtl92c_process_pwdb(hw, pcurrent_stats);
-        _rtl92c_process_LINK_Q(hw, pcurrent_stats);
-}
-
 void rtl92c_translate_rx_signal_stuff(struct ieee80211_hw *hw,
                                                struct sk_buff *skb,
                                                struct rtl_stats *pstats,
@@ -1123,5 +940,5 @@ void rtl92c_translate_rx_signal_stuff(struct ieee80211_hw *hw,
         _rtl92c_query_rxphystatus(hw, pstats, pdesc, p_drvinfo,
                                    packet_matchbssid, packet_toself,
                                    packet_beacon);
-        _rtl92c_process_phyinfo(hw, tmp_buf, pstats);
+        rtl_process_phyinfo(hw, tmp_buf, pstats);
 }
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
index 2bd598526217..9936de716ad5 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -31,6 +31,7 @@
 #include "../core.h"
 #include "../usb.h"
 #include "../efuse.h"
+#include "../base.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -117,7 +118,7 @@ static struct rtl_hal_ops rtl8192cu_hal_ops = {
         .set_bw_mode = rtl92c_phy_set_bw_mode,
         .switch_channel = rtl92c_phy_sw_chnl,
         .dm_watchdog = rtl92c_dm_watchdog,
-        .scan_operation_backup = rtl92c_phy_scan_operation_backup,
+        .scan_operation_backup = rtl_phy_scan_operation_backup,
         .set_rf_power_state = rtl92cu_phy_set_rf_power_state,
         .led_control = rtl92cu_led_control,
         .enable_hw_sec = rtl92cu_enable_hw_security_config,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
index 763cf1defab5..04c7e57dbce2 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
@@ -349,7 +349,6 @@ bool rtl92cu_rx_query_desc(struct ieee80211_hw *hw,
         }
         /*rx_status->qual = stats->signal; */
         rx_status->signal = stats->rssi + 10;
-        /*rx_status->noise = -stats->noise; */
         return true;
 }
 
@@ -364,7 +363,6 @@ static void _rtl_rx_process(struct ieee80211_hw *hw, struct sk_buff *skb)
         u8 *rxdesc;
         struct rtl_stats stats = {
                 .signal = 0,
-                .noise = -98,
                 .rate = 0,
         };
         struct rx_fwinfo_92c *p_drvinfo;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/dm.c b/drivers/net/wireless/rtlwifi/rtl8192de/dm.c
index f700f7a614b2..7908e1c85819 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/dm.c
@@ -840,9 +840,9 @@ static void rtl92d_dm_txpower_tracking_callback_thermalmeter(
         bool internal_pa = false;
         long ele_a = 0, ele_d, temp_cck, val_x, value32;
         long val_y, ele_c = 0;
-        u8 ofdm_index[2];
+        u8 ofdm_index[3];
         s8 cck_index = 0;
-        u8 ofdm_index_old[2] = {0, 0};
+        u8 ofdm_index_old[3] = {0, 0, 0};
         s8 cck_index_old = 0;
         u8 index;
         int i;
@@ -1118,6 +1118,10 @@ static void rtl92d_dm_txpower_tracking_callback_thermalmeter(
                                  val_x, val_y, ele_a, ele_c, ele_d,
                                  val_x, val_y);
 
+                        if (cck_index >= CCK_TABLE_SIZE)
+                                cck_index = CCK_TABLE_SIZE - 1;
+                        if (cck_index < 0)
+                                cck_index = 0;
                         if (rtlhal->current_bandtype == BAND_ON_2_4G) {
                                 /* Adjust CCK according to IQK result */
                                 if (!rtlpriv->dm.cck_inch14) {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/hw.c b/drivers/net/wireless/rtlwifi/rtl8192de/hw.c
index 7dd8f6de0550..c4a7db9135d6 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/hw.c
@@ -1194,25 +1194,7 @@ void rtl92d_linked_set_reg(struct ieee80211_hw *hw)
  * mac80211 will send pkt when scan */
 void rtl92de_set_qos(struct ieee80211_hw *hw, int aci)
 {
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
         rtl92d_dm_init_edca_turbo(hw);
-        return;
-        switch (aci) {
-        case AC1_BK:
-                rtl_write_dword(rtlpriv, REG_EDCA_BK_PARAM, 0xa44f);
-                break;
-        case AC0_BE:
-                break;
-        case AC2_VI:
-                rtl_write_dword(rtlpriv, REG_EDCA_VI_PARAM, 0x5e4322);
-                break;
-        case AC3_VO:
-                rtl_write_dword(rtlpriv, REG_EDCA_VO_PARAM, 0x2f3222);
-                break;
-        default:
-                RT_ASSERT(false, "invalid aci: %d !\n", aci);
-                break;
-        }
 }
 
 void rtl92de_enable_interrupt(struct ieee80211_hw *hw)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/phy.c b/drivers/net/wireless/rtlwifi/rtl8192de/phy.c
index 840bac5fa2f8..13196cc4b1d3 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/phy.c
@@ -1022,34 +1022,6 @@ void rtl92d_phy_set_txpower_level(struct ieee80211_hw *hw, u8 channel)
         rtl92d_phy_rf6052_set_ofdm_txpower(hw, &ofdmpowerlevel[0], channel);
 }
 
-void rtl92d_phy_scan_operation_backup(struct ieee80211_hw *hw, u8 operation)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
-        enum io_type iotype;
-
-        if (!is_hal_stop(rtlhal)) {
-                switch (operation) {
-                case SCAN_OPT_BACKUP:
-                        rtlhal->current_bandtypebackup =
-                                                 rtlhal->current_bandtype;
-                        iotype = IO_CMD_PAUSE_DM_BY_SCAN;
-                        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_IO_CMD,
-                                                      (u8 *)&iotype);
-                        break;
-                case SCAN_OPT_RESTORE:
-                        iotype = IO_CMD_RESUME_DM_BY_SCAN;
-                        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_IO_CMD,
-                                                      (u8 *)&iotype);
-                        break;
-                default:
-                        RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
-                                 "Unknown Scan Backup operation\n");
-                        break;
-                }
-        }
-}
-
 void rtl92d_phy_set_bw_mode(struct ieee80211_hw *hw,
                             enum nl80211_channel_type ch_type)
 {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/phy.h b/drivers/net/wireless/rtlwifi/rtl8192de/phy.h
index f074952bf25c..bef3040555dd 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/phy.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/phy.h
@@ -39,9 +39,7 @@
 #define RT_CANNOT_IO(hw)                        false
 #define HIGHPOWER_RADIOA_ARRAYLEN               22
 
-#define IQK_ADDA_REG_NUM                        16
 #define MAX_TOLERANCE                           5
-#define IQK_DELAY_TIME                          1
 
 #define APK_BB_REG_NUM                          5
 #define APK_AFE_REG_NUM                         16
@@ -144,8 +142,6 @@ extern bool rtl92c_phy_config_rf_with_feaderfile(struct ieee80211_hw *hw,
                                                  enum radio_path rfpath);
 extern void rtl92d_phy_get_hw_reg_originalvalue(struct ieee80211_hw *hw);
 extern void rtl92d_phy_set_txpower_level(struct ieee80211_hw *hw, u8 channel);
-extern void rtl92d_phy_scan_operation_backup(struct ieee80211_hw *hw,
-                                             u8 operation);
 extern void rtl92d_phy_set_bw_mode(struct ieee80211_hw *hw,
                                    enum nl80211_channel_type ch_type);
 extern u8 rtl92d_phy_sw_chnl(struct ieee80211_hw *hw);
@@ -173,6 +169,5 @@ void rtl92d_acquire_cckandrw_pagea_ctl(struct ieee80211_hw *hw,
                                        unsigned long *flag);
 u8 rtl92d_get_rightchnlplace_for_iqk(u8 chnl);
 void rtl92d_phy_reload_iqk_setting(struct ieee80211_hw *hw, u8 channel);
-void rtl92d_phy_iq_calibrate(struct ieee80211_hw *hw);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/sw.c b/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
index c18c04bf0c13..edab5a5351b5 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
@@ -30,6 +30,7 @@
 #include "../wifi.h"
 #include "../core.h"
 #include "../pci.h"
+#include "../base.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -236,7 +237,7 @@ static struct rtl_hal_ops rtl8192de_hal_ops = {
         .set_bw_mode = rtl92d_phy_set_bw_mode,
         .switch_channel = rtl92d_phy_sw_chnl,
         .dm_watchdog = rtl92d_dm_watchdog,
-        .scan_operation_backup = rtl92d_phy_scan_operation_backup,
+        .scan_operation_backup = rtl_phy_scan_operation_backup,
         .set_rf_power_state = rtl92d_phy_set_rf_power_state,
         .led_control = rtl92de_led_control,
         .set_desc = rtl92de_set_desc,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
index b8ec718a0fab..945ddecf90c9 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
@@ -526,7 +526,6 @@ bool rtl92de_rx_query_desc(struct ieee80211_hw *hw,	struct rtl_stats *stats,
         }
         /*rx_status->qual = stats->signal; */
         rx_status->signal = stats->rssi + 10;
-        /*rx_status->noise = -stats->noise; */
         return true;
 }
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/reg.h b/drivers/net/wireless/rtlwifi/rtl8192se/reg.h
index 84d1181795b8..c81c83591940 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/reg.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/reg.h
@@ -425,14 +425,9 @@
 #define EXT_IMEM_CODE_DONE                      BIT(2)
 #define IMEM_CHK_RPT                            BIT(1)
 #define IMEM_CODE_DONE                          BIT(0)
-#define IMEM_CODE_DONE                          BIT(0)
-#define IMEM_CHK_RPT                            BIT(1)
 #define EMEM_CODE_DONE                          BIT(2)
 #define EMEM_CHK_RPT                            BIT(3)
-#define DMEM_CODE_DONE                          BIT(4)
 #define IMEM_RDY                                BIT(5)
-#define BASECHG                                 BIT(6)
-#define FWRDY                                   BIT(7)
 #define LOAD_FW_READY                           (IMEM_CODE_DONE | \
                                                 IMEM_CHK_RPT | \
                                                 EMEM_CODE_DONE | \
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
index c7095118de6e..222d2e792ca6 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
@@ -330,7 +330,6 @@ bool rtl92se_rx_query_desc(struct ieee80211_hw *hw, struct rtl_stats *stats,
 
         /*rx_status->qual = stats->signal; */
         rx_status->signal = stats->rssi + 10;
-        /*rx_status->noise = -stats->noise; */
 
         return true;
 }
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/phy.c b/drivers/net/wireless/rtlwifi/rtl8723ae/phy.c
index eafbb18dd48e..5d318a85eda4 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/phy.c
@@ -934,35 +934,6 @@ static long _phy_txpwr_idx_to_dbm(struct ieee80211_hw *hw,
         return pwrout_dbm;
 }
 
-void rtl8723ae_phy_scan_operation_backup(struct ieee80211_hw *hw, u8 operation)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
-        enum io_type iotype;
-
-        if (!is_hal_stop(rtlhal)) {
-                switch (operation) {
-                case SCAN_OPT_BACKUP:
-                        iotype = IO_CMD_PAUSE_DM_BY_SCAN;
-                        rtlpriv->cfg->ops->set_hw_reg(hw,
-                                                      HW_VAR_IO_CMD,
-                                                      (u8 *)&iotype);
-
-                        break;
-                case SCAN_OPT_RESTORE:
-                        iotype = IO_CMD_RESUME_DM_BY_SCAN;
-                        rtlpriv->cfg->ops->set_hw_reg(hw,
-                                                      HW_VAR_IO_CMD,
-                                                      (u8 *)&iotype);
-                        break;
-                default:
-                        RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
-                                 "Unknown Scan Backup operation.\n");
-                        break;
-                }
-        }
-}
-
 void rtl8723ae_phy_set_bw_mode_callback(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/phy.h b/drivers/net/wireless/rtlwifi/rtl8723ae/phy.h
index e7a59eba351a..3d8f9e3aad76 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/phy.h
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/phy.h
@@ -205,8 +205,6 @@ extern void rtl8723ae_phy_set_txpower_level(struct ieee80211_hw *hw,
                                             u8 channel);
 extern bool rtl8723ae_phy_update_txpower_dbm(struct ieee80211_hw *hw,
                                              long power_indbm);
-extern void rtl8723ae_phy_scan_operation_backup(struct ieee80211_hw *hw,
-                                                u8 operation);
 extern void rtl8723ae_phy_set_bw_mode_callback(struct ieee80211_hw *hw);
 extern void rtl8723ae_phy_set_bw_mode(struct ieee80211_hw *hw,
                                       enum nl80211_channel_type ch_type);
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c b/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c
index d9ee2efffe5f..62b204faf773 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c
@@ -33,6 +33,7 @@
 
 #include "../core.h"
 #include "../pci.h"
+#include "../base.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -220,7 +221,7 @@ static struct rtl_hal_ops rtl8723ae_hal_ops = {
         .set_bw_mode = rtl8723ae_phy_set_bw_mode,
         .switch_channel = rtl8723ae_phy_sw_chnl,
         .dm_watchdog = rtl8723ae_dm_watchdog,
-        .scan_operation_backup = rtl8723ae_phy_scan_operation_backup,
+        .scan_operation_backup = rtl_phy_scan_operation_backup,
         .set_rf_power_state = rtl8723ae_phy_set_rf_power_state,
         .led_control = rtl8723ae_led_control,
         .set_desc = rtl8723ae_set_desc,
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c b/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
index bcd82a1020a5..50b7be3f3a60 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
@@ -359,7 +359,6 @@ bool rtl8723ae_rx_query_desc(struct ieee80211_hw *hw,
 
         /*rx_status->qual = status->signal; */
         rx_status->signal = status->recvsignalpower + 10;
-        /*rx_status->noise = -status->noise; */
 
         return true;
 }
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index e56778cac9bf..6e2b5c5c83c8 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -455,7 +455,6 @@ static void _rtl_usb_rx_process_agg(struct ieee80211_hw *hw,
         struct ieee80211_rx_status rx_status = {0};
         struct rtl_stats stats = {
                 .signal = 0,
-                .noise = -98,
                 .rate = 0,
         };
 
@@ -498,7 +497,6 @@ static void _rtl_usb_rx_process_noagg(struct ieee80211_hw *hw,
         struct ieee80211_rx_status rx_status = {0};
         struct rtl_stats stats = {
                 .signal = 0,
-                .noise = -98,
                 .rate = 0,
         };
 
@@ -582,12 +580,15 @@ static void _rtl_rx_work(unsigned long param)
 static unsigned int _rtl_rx_get_padding(struct ieee80211_hdr *hdr,
                                         unsigned int len)
 {
+#if NET_IP_ALIGN != 0
         unsigned int padding = 0;
+#endif
 
         /* make function no-op when possible */
         if (NET_IP_ALIGN == 0 || len < sizeof(*hdr))
                 return 0;
 
+#if NET_IP_ALIGN != 0
         /* alignment calculation as in lbtf_rx() / carl9170_rx_copy_data() */
         /* TODO: deduplicate common code, define helper function instead? */
 
@@ -608,6 +609,7 @@ static unsigned int _rtl_rx_get_padding(struct ieee80211_hdr *hdr,
                 padding ^= NET_IP_ALIGN;
 
         return padding;
+#endif
 }
 
 #define __RADIO_TAP_SIZE_RSV    32
diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
index cc03e7c87cbe..96763dcff5ae 100644
--- a/drivers/net/wireless/rtlwifi/wifi.h
+++ b/drivers/net/wireless/rtlwifi/wifi.h
@@ -192,8 +192,6 @@ enum hardware_type {
 (IS_HARDWARE_TYPE_8192DE(rtlhal) || IS_HARDWARE_TYPE_8192DU(rtlhal))
 #define IS_HARDWARE_TYPE_8723(rtlhal)                   \
 (IS_HARDWARE_TYPE_8723E(rtlhal) || IS_HARDWARE_TYPE_8723U(rtlhal))
-#define IS_HARDWARE_TYPE_8723U(rtlhal)                  \
-        (rtlhal->hw_type == HARDWARE_TYPE_RTL8723U)
 
 #define RX_HAL_IS_CCK_RATE(_pdesc)\
         (_pdesc->rxmcs == DESC92_RATE1M ||              \
diff --git a/drivers/net/wireless/ti/wl1251/spi.c b/drivers/net/wireless/ti/wl1251/spi.c
index c7dc6feab2ff..1342f81e683d 100644
--- a/drivers/net/wireless/ti/wl1251/spi.c
+++ b/drivers/net/wireless/ti/wl1251/spi.c
@@ -243,7 +243,7 @@ static int wl1251_spi_probe(struct spi_device *spi)
         struct wl1251 *wl;
         int ret;
 
-        pdata = spi->dev.platform_data;
+        pdata = dev_get_platdata(&spi->dev);
         if (!pdata) {
                 wl1251_error("no platform data");
                 return -ENODEV;
diff --git a/drivers/net/wireless/ti/wl1251/wl1251.h b/drivers/net/wireless/ti/wl1251/wl1251.h
index fd02060038de..2c3bd1bff3f6 100644
--- a/drivers/net/wireless/ti/wl1251/wl1251.h
+++ b/drivers/net/wireless/ti/wl1251/wl1251.h
@@ -424,8 +424,8 @@ void wl1251_disable_interrupts(struct wl1251 *wl);
 #define CHIP_ID_1271_PG10                  (0x4030101)
 #define CHIP_ID_1271_PG20                  (0x4030111)
 
-#define WL1251_FW_NAME "wl1251-fw.bin"
-#define WL1251_NVS_NAME "wl1251-nvs.bin"
+#define WL1251_FW_NAME "ti-connectivity/wl1251-fw.bin"
+#define WL1251_NVS_NAME "ti-connectivity/wl1251-nvs.bin"
 
 #define WL1251_POWER_ON_SLEEP 10 /* in milliseconds */
 
diff --git a/drivers/net/wireless/ti/wl12xx/main.c b/drivers/net/wireless/ti/wl12xx/main.c
index 1c627da85083..591526b99154 100644
--- a/drivers/net/wireless/ti/wl12xx/main.c
+++ b/drivers/net/wireless/ti/wl12xx/main.c
@@ -1704,7 +1704,7 @@ static struct ieee80211_sta_ht_cap wl12xx_ht_cap = {
 static int wl12xx_setup(struct wl1271 *wl)
 {
         struct wl12xx_priv *priv = wl->priv;
-        struct wlcore_platdev_data *pdev_data = wl->pdev->dev.platform_data;
+        struct wlcore_platdev_data *pdev_data = dev_get_platdata(&wl->pdev->dev);
         struct wl12xx_platform_data *pdata = pdev_data->pdata;
 
         wl->rtable = wl12xx_rtable;
diff --git a/drivers/net/wireless/ti/wl18xx/main.c b/drivers/net/wireless/ti/wl18xx/main.c
index 7aa0eb848c5a..d0daca1d23bc 100644
--- a/drivers/net/wireless/ti/wl18xx/main.c
+++ b/drivers/net/wireless/ti/wl18xx/main.c
@@ -623,6 +623,18 @@ static const int wl18xx_rtable[REG_TABLE_LEN] = {
         [REG_RAW_FW_STATUS_ADDR]        = WL18XX_FW_STATUS_ADDR,
 };
 
+static const struct wl18xx_clk_cfg wl18xx_clk_table_coex[NUM_CLOCK_CONFIGS] = {
+        [CLOCK_CONFIG_16_2_M]   = { 8,  121, 0, 0, false },
+        [CLOCK_CONFIG_16_368_M] = { 8,  120, 0, 0, false },
+        [CLOCK_CONFIG_16_8_M]   = { 8,  117, 0, 0, false },
+        [CLOCK_CONFIG_19_2_M]   = { 10, 128, 0, 0, false },
+        [CLOCK_CONFIG_26_M]     = { 11, 104, 0, 0, false },
+        [CLOCK_CONFIG_32_736_M] = { 8,  120, 0, 0, false },
+        [CLOCK_CONFIG_33_6_M]   = { 8,  117, 0, 0, false },
+        [CLOCK_CONFIG_38_468_M] = { 10, 128, 0, 0, false },
+        [CLOCK_CONFIG_52_M]     = { 11, 104, 0, 0, false },
+};
+
 static const struct wl18xx_clk_cfg wl18xx_clk_table[NUM_CLOCK_CONFIGS] = {
         [CLOCK_CONFIG_16_2_M]   = { 7,  104,  801, 4,  true },
         [CLOCK_CONFIG_16_368_M] = { 9,  132, 3751, 4,  true },
@@ -704,6 +716,23 @@ static int wl18xx_set_clk(struct wl1271 *wl)
                      wl18xx_clk_table[clk_freq].p, wl18xx_clk_table[clk_freq].q,
                      wl18xx_clk_table[clk_freq].swallow ? "swallow" : "spit");
 
+        /* coex PLL configuration */
+        ret = wl18xx_top_reg_write(wl, PLLSH_COEX_PLL_N,
+                                   wl18xx_clk_table_coex[clk_freq].n);
+        if (ret < 0)
+                goto out;
+
+        ret = wl18xx_top_reg_write(wl, PLLSH_COEX_PLL_M,
+                                   wl18xx_clk_table_coex[clk_freq].m);
+        if (ret < 0)
+                goto out;
+
+        /* bypass the swallowing logic */
+        ret = wl18xx_top_reg_write(wl, PLLSH_COEX_PLL_SWALLOW_EN,
+                                   PLLSH_COEX_PLL_SWALLOW_EN_VAL1);
+        if (ret < 0)
+                goto out;
+
         ret = wl18xx_top_reg_write(wl, PLLSH_WCS_PLL_N,
                                    wl18xx_clk_table[clk_freq].n);
         if (ret < 0)
@@ -745,6 +774,30 @@ static int wl18xx_set_clk(struct wl1271 *wl)
                                            PLLSH_WCS_PLL_SWALLOW_EN_VAL2);
         }
 
+        /* choose WCS PLL */
+        ret = wl18xx_top_reg_write(wl, PLLSH_WL_PLL_SEL,
+                                   PLLSH_WL_PLL_SEL_WCS_PLL);
+        if (ret < 0)
+                goto out;
+
+        /* enable both PLLs */
+        ret = wl18xx_top_reg_write(wl, PLLSH_WL_PLL_EN, PLLSH_WL_PLL_EN_VAL1);
+        if (ret < 0)
+                goto out;
+
+        udelay(1000);
+
+        /* disable coex PLL */
+        ret = wl18xx_top_reg_write(wl, PLLSH_WL_PLL_EN, PLLSH_WL_PLL_EN_VAL2);
+        if (ret < 0)
+                goto out;
+
+        /* reset the swallowing logic */
+        ret = wl18xx_top_reg_write(wl, PLLSH_COEX_PLL_SWALLOW_EN,
+                                   PLLSH_COEX_PLL_SWALLOW_EN_VAL2);
+        if (ret < 0)
+                goto out;
+
 out:
         return ret;
 }
@@ -1175,16 +1228,48 @@ static u32 wl18xx_ap_get_mimo_wide_rate_mask(struct wl1271 *wl,
         }
 }
 
+static const char *wl18xx_rdl_name(enum wl18xx_rdl_num rdl_num)
+{
+        switch (rdl_num) {
+        case RDL_1_HP:
+                return "183xH";
+        case RDL_2_SP:
+                return "183x or 180x";
+        case RDL_3_HP:
+                return "187xH";
+        case RDL_4_SP:
+                return "187x";
+        case RDL_5_SP:
+                return "RDL11 - Not Supported";
+        case RDL_6_SP:
+                return "180xD";
+        case RDL_7_SP:
+                return "RDL13 - Not Supported (1893Q)";
+        case RDL_8_SP:
+                return "18xxQ";
+        case RDL_NONE:
+                return "UNTRIMMED";
+        default:
+                return "UNKNOWN";
+        }
+}
+
 static int wl18xx_get_pg_ver(struct wl1271 *wl, s8 *ver)
 {
         u32 fuse;
-        s8 rom = 0, metal = 0, pg_ver = 0, rdl_ver = 0;
+        s8 rom = 0, metal = 0, pg_ver = 0, rdl_ver = 0, package_type = 0;
         int ret;
 
         ret = wlcore_set_partition(wl, &wl->ptable[PART_TOP_PRCM_ELP_SOC]);
         if (ret < 0)
                 goto out;
 
+        ret = wlcore_read32(wl, WL18XX_REG_FUSE_DATA_2_3, &fuse);
+        if (ret < 0)
+                goto out;
+
+        package_type = (fuse >> WL18XX_PACKAGE_TYPE_OFFSET) & 1;
+
         ret = wlcore_read32(wl, WL18XX_REG_FUSE_DATA_1_3, &fuse);
         if (ret < 0)
                 goto out;
@@ -1192,7 +1277,7 @@ static int wl18xx_get_pg_ver(struct wl1271 *wl, s8 *ver)
         pg_ver = (fuse & WL18XX_PG_VER_MASK) >> WL18XX_PG_VER_OFFSET;
         rom = (fuse & WL18XX_ROM_VER_MASK) >> WL18XX_ROM_VER_OFFSET;
 
-        if (rom <= 0xE)
+        if ((rom <= 0xE) && (package_type == WL18XX_PACKAGE_TYPE_WSP))
                 metal = (fuse & WL18XX_METAL_VER_MASK) >>
                         WL18XX_METAL_VER_OFFSET;
         else
@@ -1204,11 +1289,9 @@ static int wl18xx_get_pg_ver(struct wl1271 *wl, s8 *ver)
                 goto out;
 
         rdl_ver = (fuse & WL18XX_RDL_VER_MASK) >> WL18XX_RDL_VER_OFFSET;
-        if (rdl_ver > RDL_MAX)
-                rdl_ver = RDL_NONE;
 
-        wl1271_info("wl18xx HW: RDL %d, %s, PG %x.%x (ROM %x)",
-                    rdl_ver, rdl_names[rdl_ver], pg_ver, metal, rom);
+        wl1271_info("wl18xx HW: %s, PG %d.%d (ROM 0x%x)",
+                    wl18xx_rdl_name(rdl_ver), pg_ver, metal, rom);
 
         if (ver)
                 *ver = pg_ver;
diff --git a/drivers/net/wireless/ti/wl18xx/reg.h b/drivers/net/wireless/ti/wl18xx/reg.h
index 05dd8bad2746..a433a75f3cd7 100644
--- a/drivers/net/wireless/ti/wl18xx/reg.h
+++ b/drivers/net/wireless/ti/wl18xx/reg.h
@@ -114,6 +114,11 @@
 #define PLATFORM_DETECTION              0xA0E3E0
 #define OCS_EN                          0xA02080
 #define PRIMARY_CLK_DETECT              0xA020A6
+#define PLLSH_COEX_PLL_N                0xA02384
+#define PLLSH_COEX_PLL_M                0xA02382
+#define PLLSH_COEX_PLL_SWALLOW_EN       0xA0238E
+#define PLLSH_WL_PLL_SEL                0xA02398
+
 #define PLLSH_WCS_PLL_N                 0xA02362
 #define PLLSH_WCS_PLL_M                 0xA02360
 #define PLLSH_WCS_PLL_Q_FACTOR_CFG_1    0xA02364
@@ -128,19 +133,30 @@
 #define PLLSH_WCS_PLL_P_FACTOR_CFG_1_MASK       0xFFFF
 #define PLLSH_WCS_PLL_P_FACTOR_CFG_2_MASK       0x000F
 
+#define PLLSH_WL_PLL_EN_VAL1            0x7
+#define PLLSH_WL_PLL_EN_VAL2            0x2
+#define PLLSH_COEX_PLL_SWALLOW_EN_VAL1  0x2
+#define PLLSH_COEX_PLL_SWALLOW_EN_VAL2  0x11
+
 #define PLLSH_WCS_PLL_SWALLOW_EN_VAL1   0x1
 #define PLLSH_WCS_PLL_SWALLOW_EN_VAL2   0x12
 
+#define PLLSH_WL_PLL_SEL_WCS_PLL        0x0
+#define PLLSH_WL_PLL_SEL_COEX_PLL       0x1
+
 #define WL18XX_REG_FUSE_DATA_1_3        0xA0260C
 #define WL18XX_PG_VER_MASK              0x70
 #define WL18XX_PG_VER_OFFSET            4
-#define WL18XX_ROM_VER_MASK             0x3
-#define WL18XX_ROM_VER_OFFSET           0
+#define WL18XX_ROM_VER_MASK             0x3e00
+#define WL18XX_ROM_VER_OFFSET           9
 #define WL18XX_METAL_VER_MASK           0xC
 #define WL18XX_METAL_VER_OFFSET         2
 #define WL18XX_NEW_METAL_VER_MASK       0x180
 #define WL18XX_NEW_METAL_VER_OFFSET     7
 
+#define WL18XX_PACKAGE_TYPE_OFFSET      13
+#define WL18XX_PACKAGE_TYPE_WSP         0
+
 #define WL18XX_REG_FUSE_DATA_2_3        0xA02614
 #define WL18XX_RDL_VER_MASK             0x1f00
 #define WL18XX_RDL_VER_OFFSET           8
@@ -201,24 +217,21 @@ enum {
         NUM_BOARD_TYPES,
 };
 
-enum {
+enum wl18xx_rdl_num {
         RDL_NONE        = 0,
         RDL_1_HP        = 1,
         RDL_2_SP        = 2,
         RDL_3_HP        = 3,
         RDL_4_SP        = 4,
+        RDL_5_SP        = 0x11,
+        RDL_6_SP        = 0x12,
+        RDL_7_SP        = 0x13,
+        RDL_8_SP        = 0x14,
 
         _RDL_LAST,
         RDL_MAX = _RDL_LAST - 1,
 };
 
-static const char * const rdl_names[] = {
-        [RDL_NONE]      = "",
-        [RDL_1_HP]      = "1853 SISO",
-        [RDL_2_SP]      = "1857 MIMO",
-        [RDL_3_HP]      = "1893 SISO",
-        [RDL_4_SP]      = "1897 MIMO",
-};
 
 /* FPGA_SPARE_1 register - used to change the PHY ATPG clock at boot time */
 #define WL18XX_PHY_FPGA_SPARE_1         0x8093CA40
diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c
index c9e060795d13..9e5416f8764d 100644
--- a/drivers/net/wireless/ti/wlcore/cmd.c
+++ b/drivers/net/wireless/ti/wlcore/cmd.c
@@ -1126,6 +1126,8 @@ int wl12xx_cmd_build_probe_req(struct wl1271 *wl, struct wl12xx_vif *wlvif,
         u16 template_id_2_4 = wl->scan_templ_id_2_4;
         u16 template_id_5 = wl->scan_templ_id_5;
 
+        wl1271_debug(DEBUG_SCAN, "build probe request band %d", band);
+
         skb = ieee80211_probereq_get(wl->hw, vif, ssid, ssid_len,
                                      ie_len);
         if (!skb) {
@@ -1135,8 +1137,6 @@ int wl12xx_cmd_build_probe_req(struct wl1271 *wl, struct wl12xx_vif *wlvif,
         if (ie_len)
                 memcpy(skb_put(skb, ie_len), ie, ie_len);
 
-        wl1271_dump(DEBUG_SCAN, "PROBE REQ: ", skb->data, skb->len);
-
         if (sched_scan &&
             (wl->quirks & WLCORE_QUIRK_DUAL_PROBE_TMPL)) {
                 template_id_2_4 = wl->sched_scan_templ_id_2_4;
@@ -1172,7 +1172,7 @@ struct sk_buff *wl1271_cmd_build_ap_probe_req(struct wl1271 *wl,
         if (!skb)
                 goto out;
 
-        wl1271_dump(DEBUG_SCAN, "AP PROBE REQ: ", skb->data, skb->len);
+        wl1271_debug(DEBUG_SCAN, "set ap probe request template");
 
         rate = wl1271_tx_min_rate_get(wl, wlvif->bitrate_masks[wlvif->band]);
         if (wlvif->band == IEEE80211_BAND_2GHZ)
@@ -1607,33 +1607,43 @@ out:
 
 static int wlcore_get_reg_conf_ch_idx(enum ieee80211_band band, u16 ch)
 {
-        int idx = -1;
-
+        /*
+         * map the given band/channel to the respective predefined
+         * bit expected by the fw
+         */
         switch (band) {
-        case IEEE80211_BAND_5GHZ:
-                if (ch >= 8 && ch <= 16)
-                        idx = ((ch-8)/4 + 18);
-                else if (ch >= 34 && ch <= 64)
-                        idx = ((ch-34)/2 + 3 + 18);
-                else if (ch >= 100 && ch <= 140)
-                        idx = ((ch-100)/4 + 15 + 18);
-                else if (ch >= 149 && ch <= 165)
-                        idx = ((ch-149)/4 + 26 + 18);
-                else
-                        idx = -1;
-                break;
         case IEEE80211_BAND_2GHZ:
+                /* channels 1..14 are mapped to 0..13 */
                 if (ch >= 1 && ch <= 14)
-                        idx = ch - 1;
-                else
-                        idx = -1;
+                        return ch - 1;
+                break;
+        case IEEE80211_BAND_5GHZ:
+                switch (ch) {
+                case 8 ... 16:
+                        /* channels 8,12,16 are mapped to 18,19,20 */
+                        return 18 + (ch-8)/4;
+                case 34 ... 48:
+                        /* channels 34,36..48 are mapped to 21..28 */
+                        return 21 + (ch-34)/2;
+                case 52 ... 64:
+                        /* channels 52,56..64 are mapped to 29..32 */
+                        return 29 + (ch-52)/4;
+                case 100 ... 140:
+                        /* channels 100,104..140 are mapped to 33..43 */
+                        return 33 + (ch-100)/4;
+                case 149 ... 165:
+                        /* channels 149,153..165 are mapped to 44..48 */
+                        return 44 + (ch-149)/4;
+                default:
+                        break;
+                }
                 break;
         default:
-                wl1271_error("get reg conf ch idx - unknown band: %d",
-                             (int)band);
+                break;
         }
 
-        return idx;
+        wl1271_error("%s: unknown band/channel: %d/%d", __func__, band, ch);
+        return -1;
 }
 
 void wlcore_set_pending_regdomain_ch(struct wl1271 *wl, u16 channel,
@@ -1646,7 +1656,7 @@ void wlcore_set_pending_regdomain_ch(struct wl1271 *wl, u16 channel,
 
         ch_bit_idx = wlcore_get_reg_conf_ch_idx(band, channel);
 
-        if (ch_bit_idx > 0 && ch_bit_idx <= WL1271_MAX_CHANNELS)
+        if (ch_bit_idx >= 0 && ch_bit_idx <= WL1271_MAX_CHANNELS)
                 set_bit(ch_bit_idx, (long *)wl->reg_ch_conf_pending);
 }
 
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index 38995f90040d..bbdd10632373 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -1062,7 +1062,8 @@ int wl1271_plt_start(struct wl1271 *wl, const enum plt_mode plt_mode)
         static const char* const PLT_MODE[] = {
                 "PLT_OFF",
                 "PLT_ON",
-                "PLT_FEM_DETECT"
+                "PLT_FEM_DETECT",
+                "PLT_CHIP_AWAKE"
         };
 
         int ret;
@@ -1088,9 +1089,11 @@ int wl1271_plt_start(struct wl1271 *wl, const enum plt_mode plt_mode)
                 if (ret < 0)
                         goto power_off;
 
-                ret = wl->ops->plt_init(wl);
-                if (ret < 0)
-                        goto power_off;
+                if (plt_mode != PLT_CHIP_AWAKE) {
+                        ret = wl->ops->plt_init(wl);
+                        if (ret < 0)
+                                goto power_off;
+                }
 
                 wl->state = WLCORE_STATE_ON;
                 wl1271_notice("firmware booted in PLT mode %s (%s)",
@@ -2008,6 +2011,47 @@ out:
         mutex_unlock(&wl->mutex);
 }
 
+static void wlcore_pending_auth_complete_work(struct work_struct *work)
+{
+        struct delayed_work *dwork;
+        struct wl1271 *wl;
+        struct wl12xx_vif *wlvif;
+        unsigned long time_spare;
+        int ret;
+
+        dwork = container_of(work, struct delayed_work, work);
+        wlvif = container_of(dwork, struct wl12xx_vif,
+                             pending_auth_complete_work);
+        wl = wlvif->wl;
+
+        mutex_lock(&wl->mutex);
+
+        if (unlikely(wl->state != WLCORE_STATE_ON))
+                goto out;
+
+        /*
+         * Make sure a second really passed since the last auth reply. Maybe
+         * a second auth reply arrived while we were stuck on the mutex.
+         * Check for a little less than the timeout to protect from scheduler
+         * irregularities.
+         */
+        time_spare = jiffies +
+                        msecs_to_jiffies(WLCORE_PEND_AUTH_ROC_TIMEOUT - 50);
+        if (!time_after(time_spare, wlvif->pending_auth_reply_time))
+                goto out;
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
+        /* cancel the ROC if active */
+        wlcore_update_inconn_sta(wl, wlvif, NULL, false);
+
+        wl1271_ps_elp_sleep(wl);
+out:
+        mutex_unlock(&wl->mutex);
+}
+
 static int wl12xx_allocate_rate_policy(struct wl1271 *wl, u8 *idx)
 {
         u8 policy = find_first_zero_bit(wl->rate_policies_map,
@@ -2159,6 +2203,8 @@ static int wl12xx_init_vif_data(struct wl1271 *wl, struct ieee80211_vif *vif)
                           wlcore_channel_switch_work);
         INIT_DELAYED_WORK(&wlvif->connection_loss_work,
                           wlcore_connection_loss_work);
+        INIT_DELAYED_WORK(&wlvif->pending_auth_complete_work,
+                          wlcore_pending_auth_complete_work);
         INIT_LIST_HEAD(&wlvif->list);
 
         setup_timer(&wlvif->rx_streaming_timer, wl1271_rx_streaming_timer,
@@ -2376,6 +2422,11 @@ static int wl1271_op_add_interface(struct ieee80211_hw *hw,
         int ret = 0;
         u8 role_type;
 
+        if (wl->plt) {
+                wl1271_error("Adding Interface not allowed while in PLT mode");
+                return -EBUSY;
+        }
+
         vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER |
                              IEEE80211_VIF_SUPPORTS_CQM_RSSI;
 
@@ -2590,6 +2641,7 @@ unlock:
         cancel_work_sync(&wlvif->rx_streaming_disable_work);
         cancel_delayed_work_sync(&wlvif->connection_loss_work);
         cancel_delayed_work_sync(&wlvif->channel_switch_work);
+        cancel_delayed_work_sync(&wlvif->pending_auth_complete_work);
 
         mutex_lock(&wl->mutex);
 }
@@ -2875,6 +2927,25 @@ static void wl1271_set_band_rate(struct wl1271 *wl, struct wl12xx_vif *wlvif)
         wlvif->rate_set = wlvif->basic_rate_set;
 }
 
+static void wl1271_sta_handle_idle(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                                   bool idle)
+{
+        bool cur_idle = !test_bit(WLVIF_FLAG_ACTIVE, &wlvif->flags);
+
+        if (idle == cur_idle)
+                return;
+
+        if (idle) {
+                clear_bit(WLVIF_FLAG_ACTIVE, &wlvif->flags);
+        } else {
+                /* The current firmware only supports sched_scan in idle */
+                if (wl->sched_vif == wlvif)
+                        wl->ops->sched_scan_stop(wl, wlvif);
+
+                set_bit(WLVIF_FLAG_ACTIVE, &wlvif->flags);
+        }
+}
+
 static int wl12xx_config_vif(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                              struct ieee80211_conf *conf, u32 changed)
 {
@@ -3969,6 +4040,13 @@ static void wl1271_bss_info_changed_ap(struct wl1271 *wl,
                         }
                 } else {
                         if (test_bit(WLVIF_FLAG_AP_STARTED, &wlvif->flags)) {
+                                /*
+                                 * AP might be in ROC in case we have just
+                                 * sent auth reply. handle it.
+                                 */
+                                if (test_bit(wlvif->role_id, wl->roc_map))
+                                        wl12xx_croc(wl, wlvif->role_id);
+
                                 ret = wl12xx_cmd_role_stop_ap(wl, wlvif);
                                 if (ret < 0)
                                         goto out;
@@ -4120,6 +4198,9 @@ static void wl1271_bss_info_changed_sta(struct wl1271 *wl,
                 do_join = true;
         }
 
+        if (changed & BSS_CHANGED_IDLE && !is_ibss)
+                wl1271_sta_handle_idle(wl, wlvif, bss_conf->idle);
+
         if (changed & BSS_CHANGED_CQM) {
                 bool enable = false;
                 if (bss_conf->cqm_rssi_thold)
@@ -4656,29 +4737,49 @@ static void wlcore_roc_if_possible(struct wl1271 *wl,
         wl12xx_roc(wl, wlvif, wlvif->role_id, wlvif->band, wlvif->channel);
 }
 
-static void wlcore_update_inconn_sta(struct wl1271 *wl,
-                                     struct wl12xx_vif *wlvif,
-                                     struct wl1271_station *wl_sta,
-                                     bool in_connection)
+/*
+ * when wl_sta is NULL, we treat this call as if coming from a
+ * pending auth reply.
+ * wl->mutex must be taken and the FW must be awake when the call
+ * takes place.
+ */
+void wlcore_update_inconn_sta(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                              struct wl1271_station *wl_sta, bool in_conn)
 {
-        if (in_connection) {
-                if (WARN_ON(wl_sta->in_connection))
+        if (in_conn) {
+                if (WARN_ON(wl_sta && wl_sta->in_connection))
                         return;
-                wl_sta->in_connection = true;
-                if (!wlvif->inconn_count++)
+
+                if (!wlvif->ap_pending_auth_reply &&
+                    !wlvif->inconn_count)
                         wlcore_roc_if_possible(wl, wlvif);
+
+                if (wl_sta) {
+                        wl_sta->in_connection = true;
+                        wlvif->inconn_count++;
+                } else {
+                        wlvif->ap_pending_auth_reply = true;
+                }
         } else {
-                if (!wl_sta->in_connection)
+                if (wl_sta && !wl_sta->in_connection)
+                        return;
+
+                if (WARN_ON(!wl_sta && !wlvif->ap_pending_auth_reply))
                         return;
 
-                wl_sta->in_connection = false;
-                wlvif->inconn_count--;
-                if (WARN_ON(wlvif->inconn_count < 0))
+                if (WARN_ON(wl_sta && !wlvif->inconn_count))
                         return;
 
-                if (!wlvif->inconn_count)
-                        if (test_bit(wlvif->role_id, wl->roc_map))
-                                wl12xx_croc(wl, wlvif->role_id);
+                if (wl_sta) {
+                        wl_sta->in_connection = false;
+                        wlvif->inconn_count--;
+                } else {
+                        wlvif->ap_pending_auth_reply = false;
+                }
+
+                if (!wlvif->inconn_count && !wlvif->ap_pending_auth_reply &&
+                    test_bit(wlvif->role_id, wl->roc_map))
+                        wl12xx_croc(wl, wlvif->role_id);
         }
 }
 
@@ -5313,10 +5414,7 @@ static struct ieee80211_rate wl1271_rates_5ghz[] = {
 
 /* 5 GHz band channels for WL1273 */
 static struct ieee80211_channel wl1271_channels_5ghz[] = {
-        { .hw_value = 7, .center_freq = 5035, .max_power = WLCORE_MAX_TXPWR },
         { .hw_value = 8, .center_freq = 5040, .max_power = WLCORE_MAX_TXPWR },
-        { .hw_value = 9, .center_freq = 5045, .max_power = WLCORE_MAX_TXPWR },
-        { .hw_value = 11, .center_freq = 5055, .max_power = WLCORE_MAX_TXPWR },
         { .hw_value = 12, .center_freq = 5060, .max_power = WLCORE_MAX_TXPWR },
         { .hw_value = 16, .center_freq = 5080, .max_power = WLCORE_MAX_TXPWR },
         { .hw_value = 34, .center_freq = 5170, .max_power = WLCORE_MAX_TXPWR },
@@ -5896,14 +5994,20 @@ static const struct wiphy_wowlan_support wlcore_wowlan_support = {
 };
 #endif
 
+static irqreturn_t wlcore_hardirq(int irq, void *cookie)
+{
+        return IRQ_WAKE_THREAD;
+}
+
 static void wlcore_nvs_cb(const struct firmware *fw, void *context)
 {
         struct wl1271 *wl = context;
         struct platform_device *pdev = wl->pdev;
-        struct wlcore_platdev_data *pdev_data = pdev->dev.platform_data;
+        struct wlcore_platdev_data *pdev_data = dev_get_platdata(&pdev->dev);
         struct wl12xx_platform_data *pdata = pdev_data->pdata;
         unsigned long irqflags;
         int ret;
+        irq_handler_t hardirq_fn = NULL;
 
         if (fw) {
                 wl->nvs = kmemdup(fw->data, fw->size, GFP_KERNEL);
@@ -5932,12 +6036,14 @@ static void wlcore_nvs_cb(const struct firmware *fw, void *context)
         wl->platform_quirks = pdata->platform_quirks;
         wl->if_ops = pdev_data->if_ops;
 
-        if (wl->platform_quirks & WL12XX_PLATFORM_QUIRK_EDGE_IRQ)
+        if (wl->platform_quirks & WL12XX_PLATFORM_QUIRK_EDGE_IRQ) {
                 irqflags = IRQF_TRIGGER_RISING;
-        else
+                hardirq_fn = wlcore_hardirq;
+        } else {
                 irqflags = IRQF_TRIGGER_HIGH | IRQF_ONESHOT;
+        }
 
-        ret = request_threaded_irq(wl->irq, NULL, wlcore_irq,
+        ret = request_threaded_irq(wl->irq, hardirq_fn, wlcore_irq,
                                    irqflags, pdev->name, wl);
         if (ret < 0) {
                 wl1271_error("request_irq() failed: %d", ret);
diff --git a/drivers/net/wireless/ti/wlcore/ps.c b/drivers/net/wireless/ti/wlcore/ps.c
index 98066d40c2ad..26bfc365ba70 100644
--- a/drivers/net/wireless/ti/wlcore/ps.c
+++ b/drivers/net/wireless/ti/wlcore/ps.c
@@ -83,6 +83,10 @@ void wl1271_ps_elp_sleep(struct wl1271 *wl)
         struct wl12xx_vif *wlvif;
         u32 timeout;
 
+        /* We do not enter elp sleep in PLT mode */
+        if (wl->plt)
+                return;
+
         if (wl->sleep_auth != WL1271_PSM_ELP)
                 return;
 
diff --git a/drivers/net/wireless/ti/wlcore/scan.c b/drivers/net/wireless/ti/wlcore/scan.c
index f407101e525b..13e743df2e31 100644
--- a/drivers/net/wireless/ti/wlcore/scan.c
+++ b/drivers/net/wireless/ti/wlcore/scan.c
@@ -174,17 +174,7 @@ wlcore_scan_get_channels(struct wl1271 *wl,
                     /* if radar is set, we ignore the passive flag */
                     (radar ||
                      !!(flags & IEEE80211_CHAN_PASSIVE_SCAN) == passive)) {
-                        wl1271_debug(DEBUG_SCAN, "band %d, center_freq %d ",
-                                     req_channels[i]->band,
-                                     req_channels[i]->center_freq);
-                        wl1271_debug(DEBUG_SCAN, "hw_value %d, flags %X",
-                                     req_channels[i]->hw_value,
-                                     req_channels[i]->flags);
-                        wl1271_debug(DEBUG_SCAN, "max_power %d",
-                                     req_channels[i]->max_power);
-                        wl1271_debug(DEBUG_SCAN, "min_dwell_time %d max dwell time %d",
-                                     min_dwell_time_active,
-                                     max_dwell_time_active);
+
 
                         if (flags & IEEE80211_CHAN_RADAR) {
                                 channels[j].flags |= SCAN_CHANNEL_FLAGS_DFS;
@@ -222,6 +212,17 @@ wlcore_scan_get_channels(struct wl1271 *wl,
                                              *n_pactive_ch);
                         }
 
+                        wl1271_debug(DEBUG_SCAN, "freq %d, ch. %d, flags 0x%x, power %d, min/max_dwell %d/%d%s%s",
+                                     req_channels[i]->center_freq,
+                                     req_channels[i]->hw_value,
+                                     req_channels[i]->flags,
+                                     req_channels[i]->max_power,
+                                     min_dwell_time_active,
+                                     max_dwell_time_active,
+                                     flags & IEEE80211_CHAN_RADAR ?
+                                        ", DFS" : "",
+                                     flags & IEEE80211_CHAN_PASSIVE_SCAN ?
+                                        ", PASSIVE" : "");
                         j++;
                 }
         }
@@ -364,7 +365,7 @@ wlcore_scan_sched_scan_ssid_list(struct wl1271 *wl,
         struct cfg80211_ssid *ssids = req->ssids;
         int ret = 0, type, i, j, n_match_ssids = 0;
 
-        wl1271_debug(DEBUG_CMD, "cmd sched scan ssid list");
+        wl1271_debug((DEBUG_CMD | DEBUG_SCAN), "cmd sched scan ssid list");
 
         /* count the match sets that contain SSIDs */
         for (i = 0; i < req->n_match_sets; i++)
@@ -442,8 +443,6 @@ wlcore_scan_sched_scan_ssid_list(struct wl1271 *wl,
                 }
         }
 
-        wl1271_dump(DEBUG_SCAN, "SSID_LIST: ", cmd, sizeof(*cmd));
-
         ret = wl1271_cmd_send(wl, CMD_CONNECTION_SCAN_SSID_CFG, cmd,
                               sizeof(*cmd), 0);
         if (ret < 0) {
diff --git a/drivers/net/wireless/ti/wlcore/spi.c b/drivers/net/wireless/ti/wlcore/spi.c
index 1b0cd98e35f1..b2c018dccf18 100644
--- a/drivers/net/wireless/ti/wlcore/spi.c
+++ b/drivers/net/wireless/ti/wlcore/spi.c
@@ -335,7 +335,7 @@ static int wl1271_probe(struct spi_device *spi)
         if (!pdev_data)
                 goto out;
 
-        pdev_data->pdata = spi->dev.platform_data;
+        pdev_data->pdata = dev_get_platdata(&spi->dev);
         if (!pdev_data->pdata) {
                 dev_err(&spi->dev, "no platform data\n");
                 ret = -ENODEV;
diff --git a/drivers/net/wireless/ti/wlcore/testmode.c b/drivers/net/wireless/ti/wlcore/testmode.c
index 527590f2adfb..a3b7d950d8e9 100644
--- a/drivers/net/wireless/ti/wlcore/testmode.c
+++ b/drivers/net/wireless/ti/wlcore/testmode.c
@@ -297,7 +297,8 @@ static int wl1271_tm_cmd_set_plt_mode(struct wl1271 *wl, struct nlattr *tb[])
                 ret = wl1271_plt_stop(wl);
                 break;
         case PLT_ON:
-                ret = wl1271_plt_start(wl, PLT_ON);
+        case PLT_CHIP_AWAKE:
+                ret = wl1271_plt_start(wl, val);
                 break;
         case PLT_FEM_DETECT:
                 ret = wl1271_tm_detect_fem(wl, tb);
@@ -361,6 +362,7 @@ int wl1271_tm_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 {
         struct wl1271 *wl = hw->priv;
         struct nlattr *tb[WL1271_TM_ATTR_MAX + 1];
+        u32 nla_cmd;
         int err;
 
         err = nla_parse(tb, WL1271_TM_ATTR_MAX, data, len, wl1271_tm_policy);
@@ -370,7 +372,14 @@ int wl1271_tm_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
         if (!tb[WL1271_TM_ATTR_CMD_ID])
                 return -EINVAL;
 
-        switch (nla_get_u32(tb[WL1271_TM_ATTR_CMD_ID])) {
+        nla_cmd = nla_get_u32(tb[WL1271_TM_ATTR_CMD_ID]);
+
+        /* Only SET_PLT_MODE is allowed in case of mode PLT_CHIP_AWAKE */
+        if (wl->plt_mode == PLT_CHIP_AWAKE &&
+            nla_cmd != WL1271_TM_CMD_SET_PLT_MODE)
+                return -EOPNOTSUPP;
+
+        switch (nla_cmd) {
         case WL1271_TM_CMD_TEST:
                 return wl1271_tm_cmd_test(wl, tb);
         case WL1271_TM_CMD_INTERROGATE:
diff --git a/drivers/net/wireless/ti/wlcore/tx.c b/drivers/net/wireless/ti/wlcore/tx.c
index 7e93fe63a2c7..87cd707affa2 100644
--- a/drivers/net/wireless/ti/wlcore/tx.c
+++ b/drivers/net/wireless/ti/wlcore/tx.c
@@ -86,19 +86,34 @@ void wl1271_free_tx_id(struct wl1271 *wl, int id)
 EXPORT_SYMBOL(wl1271_free_tx_id);
 
 static void wl1271_tx_ap_update_inconnection_sta(struct wl1271 *wl,
+                                                 struct wl12xx_vif *wlvif,
                                                  struct sk_buff *skb)
 {
         struct ieee80211_hdr *hdr;
 
+        hdr = (struct ieee80211_hdr *)(skb->data +
+                                       sizeof(struct wl1271_tx_hw_descr));
+        if (!ieee80211_is_auth(hdr->frame_control))
+                return;
+
         /*
          * add the station to the known list before transmitting the
          * authentication response. this way it won't get de-authed by FW
          * when transmitting too soon.
          */
-        hdr = (struct ieee80211_hdr *)(skb->data +
-                                       sizeof(struct wl1271_tx_hw_descr));
-        if (ieee80211_is_auth(hdr->frame_control))
-                wl1271_acx_set_inconnection_sta(wl, hdr->addr1);
+        wl1271_acx_set_inconnection_sta(wl, hdr->addr1);
+
+        /*
+         * ROC for 1 second on the AP channel for completing the connection.
+         * Note the ROC will be continued by the update_sta_state callbacks
+         * once the station reaches the associated state.
+         */
+        wlcore_update_inconn_sta(wl, wlvif, NULL, true);
+        wlvif->pending_auth_reply_time = jiffies;
+        cancel_delayed_work(&wlvif->pending_auth_complete_work);
+        ieee80211_queue_delayed_work(wl->hw,
+                                &wlvif->pending_auth_complete_work,
+                                msecs_to_jiffies(WLCORE_PEND_AUTH_ROC_TIMEOUT));
 }
 
 static void wl1271_tx_regulate_link(struct wl1271 *wl,
@@ -386,7 +401,7 @@ static int wl1271_prepare_tx_frame(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                 is_wep = (cipher == WLAN_CIPHER_SUITE_WEP40) ||
                          (cipher == WLAN_CIPHER_SUITE_WEP104);
 
-                if (WARN_ON(is_wep && wlvif->default_key != idx)) {
+                if (WARN_ON(is_wep && wlvif && wlvif->default_key != idx)) {
                         ret = wl1271_set_default_wep_key(wl, wlvif, idx);
                         if (ret < 0)
                                 return ret;
@@ -404,7 +419,7 @@ static int wl1271_prepare_tx_frame(struct wl1271 *wl, struct wl12xx_vif *wlvif,
         wl1271_tx_fill_hdr(wl, wlvif, skb, extra, info, hlid);
 
         if (!is_dummy && wlvif && wlvif->bss_type == BSS_TYPE_AP_BSS) {
-                wl1271_tx_ap_update_inconnection_sta(wl, skb);
+                wl1271_tx_ap_update_inconnection_sta(wl, wlvif, skb);
                 wl1271_tx_regulate_link(wl, wlvif, hlid);
         }
 
diff --git a/drivers/net/wireless/ti/wlcore/tx.h b/drivers/net/wireless/ti/wlcore/tx.h
index 55aa4acf9105..35489c300da1 100644
--- a/drivers/net/wireless/ti/wlcore/tx.h
+++ b/drivers/net/wireless/ti/wlcore/tx.h
@@ -56,6 +56,9 @@
 /* Used for management frames and dummy packets */
 #define WL1271_TID_MGMT 7
 
+/* stop a ROC for pending authentication reply after this time (ms) */
+#define WLCORE_PEND_AUTH_ROC_TIMEOUT     1000
+
 struct wl127x_tx_mem {
         /*
          * Number of extra memory blocks to allocate for this packet
diff --git a/drivers/net/wireless/ti/wlcore/wlcore.h b/drivers/net/wireless/ti/wlcore/wlcore.h
index 0034979e97cb..54ce5d5e84db 100644
--- a/drivers/net/wireless/ti/wlcore/wlcore.h
+++ b/drivers/net/wireless/ti/wlcore/wlcore.h
@@ -481,6 +481,8 @@ int wlcore_set_key(struct wl1271 *wl, enum set_key_cmd cmd,
                    struct ieee80211_sta *sta,
                    struct ieee80211_key_conf *key_conf);
 void wlcore_regdomain_config(struct wl1271 *wl);
+void wlcore_update_inconn_sta(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                              struct wl1271_station *wl_sta, bool in_conn);
 
 static inline void
 wlcore_set_ht_cap(struct wl1271 *wl, enum ieee80211_band band,
diff --git a/drivers/net/wireless/ti/wlcore/wlcore_i.h b/drivers/net/wireless/ti/wlcore/wlcore_i.h
index e5e146435fe7..2a50e089b0e7 100644
--- a/drivers/net/wireless/ti/wlcore/wlcore_i.h
+++ b/drivers/net/wireless/ti/wlcore/wlcore_i.h
@@ -255,6 +255,7 @@ enum wl12xx_vif_flags {
         WLVIF_FLAG_CS_PROGRESS,
         WLVIF_FLAG_AP_PROBE_RESP_SET,
         WLVIF_FLAG_IN_USE,
+        WLVIF_FLAG_ACTIVE,
 };
 
 struct wl12xx_vif;
@@ -307,6 +308,7 @@ enum plt_mode {
         PLT_OFF = 0,
         PLT_ON = 1,
         PLT_FEM_DETECT = 2,
+        PLT_CHIP_AWAKE = 3
 };
 
 struct wl12xx_rx_filter_field {
@@ -456,6 +458,15 @@ struct wl12xx_vif {
          */
         int hw_queue_base;
 
+        /* do we have a pending auth reply? (and ROC) */
+        bool ap_pending_auth_reply;
+
+        /* time when we sent the pending auth reply */
+        unsigned long pending_auth_reply_time;
+
+        /* work for canceling ROC after pending auth reply */
+        struct delayed_work pending_auth_complete_work;
+
         /*
          * This struct must be last!
          * data that has to be saved acrossed reconfigs (e.g. recovery)
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index a1977430ddfb..5715318d6bab 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -184,6 +184,7 @@ int xenvif_connect(struct xenvif *vif, unsigned long tx_ring_ref,
                    unsigned long rx_ring_ref, unsigned int tx_evtchn,
                    unsigned int rx_evtchn);
 void xenvif_disconnect(struct xenvif *vif);
+void xenvif_free(struct xenvif *vif);
 
 int xenvif_xenbus_init(void);
 void xenvif_xenbus_fini(void);
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 625c6f49cfba..01bb854c7f62 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -353,6 +353,9 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
         }
 
         netdev_dbg(dev, "Successfully created xenvif\n");
+
+        __module_get(THIS_MODULE);
+
         return vif;
 }
 
@@ -366,8 +369,6 @@ int xenvif_connect(struct xenvif *vif, unsigned long tx_ring_ref,
         if (vif->tx_irq)
                 return 0;
 
-        __module_get(THIS_MODULE);
-
         err = xenvif_map_frontend_rings(vif, tx_ring_ref, rx_ring_ref);
         if (err < 0)
                 goto err;
@@ -406,7 +407,7 @@ int xenvif_connect(struct xenvif *vif, unsigned long tx_ring_ref,
 
         init_waitqueue_head(&vif->wq);
         vif->task = kthread_create(xenvif_kthread,
-                                   (void *)vif, vif->dev->name);
+                                   (void *)vif, "%s", vif->dev->name);
         if (IS_ERR(vif->task)) {
                 pr_warn("Could not allocate kthread for %s\n", vif->dev->name);
                 err = PTR_ERR(vif->task);
@@ -452,12 +453,6 @@ void xenvif_carrier_off(struct xenvif *vif)
 
 void xenvif_disconnect(struct xenvif *vif)
 {
-        /* Disconnect funtion might get called by generic framework
-         * even before vif connects, so we need to check if we really
-         * need to do a module_put.
-         */
-        int need_module_put = 0;
-
         if (netif_carrier_ok(vif->dev))
                 xenvif_carrier_off(vif);
 
@@ -468,23 +463,22 @@ void xenvif_disconnect(struct xenvif *vif)
                         unbind_from_irqhandler(vif->tx_irq, vif);
                         unbind_from_irqhandler(vif->rx_irq, vif);
                 }
-                /* vif->irq is valid, we had a module_get in
-                 * xenvif_connect.
-                 */
-                need_module_put = 1;
+                vif->tx_irq = 0;
         }
 
         if (vif->task)
                 kthread_stop(vif->task);
 
+        xenvif_unmap_frontend_rings(vif);
+}
+
+void xenvif_free(struct xenvif *vif)
+{
         netif_napi_del(&vif->napi);
 
         unregister_netdev(vif->dev);
 
-        xenvif_unmap_frontend_rings(vif);
-
         free_netdev(vif->dev);
 
-        if (need_module_put)
-                module_put(THIS_MODULE);
+        module_put(THIS_MODULE);
 }
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 956130c70036..f3e591c611de 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -212,6 +212,49 @@ static bool start_new_rx_buffer(int offset, unsigned long size, int head)
         return false;
 }
 
+struct xenvif_count_slot_state {
+        unsigned long copy_off;
+        bool head;
+};
+
+unsigned int xenvif_count_frag_slots(struct xenvif *vif,
+                                     unsigned long offset, unsigned long size,
+                                     struct xenvif_count_slot_state *state)
+{
+        unsigned count = 0;
+
+        offset &= ~PAGE_MASK;
+
+        while (size > 0) {
+                unsigned long bytes;
+
+                bytes = PAGE_SIZE - offset;
+
+                if (bytes > size)
+                        bytes = size;
+
+                if (start_new_rx_buffer(state->copy_off, bytes, state->head)) {
+                        count++;
+                        state->copy_off = 0;
+                }
+
+                if (state->copy_off + bytes > MAX_BUFFER_OFFSET)
+                        bytes = MAX_BUFFER_OFFSET - state->copy_off;
+
+                state->copy_off += bytes;
+
+                offset += bytes;
+                size -= bytes;
+
+                if (offset == PAGE_SIZE)
+                        offset = 0;
+
+                state->head = false;
+        }
+
+        return count;
+}
+
 /*
  * Figure out how many ring slots we're going to need to send @skb to
  * the guest. This function is essentially a dry run of
@@ -219,48 +262,39 @@ static bool start_new_rx_buffer(int offset, unsigned long size, int head)
  */
 unsigned int xenvif_count_skb_slots(struct xenvif *vif, struct sk_buff *skb)
 {
+        struct xenvif_count_slot_state state;
         unsigned int count;
-        int i, copy_off;
+        unsigned char *data;
+        unsigned i;
 
-        count = DIV_ROUND_UP(skb_headlen(skb), PAGE_SIZE);
+        state.head = true;
+        state.copy_off = 0;
 
-        copy_off = skb_headlen(skb) % PAGE_SIZE;
+        /* Slot for the first (partial) page of data. */
+        count = 1;
 
+        /* Need a slot for the GSO prefix for GSO extra data? */
         if (skb_shinfo(skb)->gso_size)
                 count++;
 
-        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
-                unsigned long size = skb_frag_size(&skb_shinfo(skb)->frags[i]);
-                unsigned long offset = skb_shinfo(skb)->frags[i].page_offset;
-                unsigned long bytes;
-
-                offset &= ~PAGE_MASK;
-
-                while (size > 0) {
-                        BUG_ON(offset >= PAGE_SIZE);
-                        BUG_ON(copy_off > MAX_BUFFER_OFFSET);
-
-                        bytes = PAGE_SIZE - offset;
-
-                        if (bytes > size)
-                                bytes = size;
+        data = skb->data;
+        while (data < skb_tail_pointer(skb)) {
+                unsigned long offset = offset_in_page(data);
+                unsigned long size = PAGE_SIZE - offset;
 
-                        if (start_new_rx_buffer(copy_off, bytes, 0)) {
-                                count++;
-                                copy_off = 0;
-                        }
+                if (data + size > skb_tail_pointer(skb))
+                        size = skb_tail_pointer(skb) - data;
 
-                        if (copy_off + bytes > MAX_BUFFER_OFFSET)
-                                bytes = MAX_BUFFER_OFFSET - copy_off;
+                count += xenvif_count_frag_slots(vif, offset, size, &state);
 
-                        copy_off += bytes;
+                data += size;
+        }
 
-                        offset += bytes;
-                        size -= bytes;
+        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+                unsigned long size = skb_frag_size(&skb_shinfo(skb)->frags[i]);
+                unsigned long offset = skb_shinfo(skb)->frags[i].page_offset;
 
-                        if (offset == PAGE_SIZE)
-                                offset = 0;
-                }
+                count += xenvif_count_frag_slots(vif, offset, size, &state);
         }
         return count;
 }
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index 1fe48fe364ed..a53782ef1540 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -42,7 +42,7 @@ static int netback_remove(struct xenbus_device *dev)
         if (be->vif) {
                 kobject_uevent(&dev->dev.kobj, KOBJ_OFFLINE);
                 xenbus_rm(XBT_NIL, dev->nodename, "hotplug-status");
-                xenvif_disconnect(be->vif);
+                xenvif_free(be->vif);
                 be->vif = NULL;
         }
         kfree(be);
@@ -213,9 +213,18 @@ static void disconnect_backend(struct xenbus_device *dev)
 {
         struct backend_info *be = dev_get_drvdata(&dev->dev);
 
+        if (be->vif)
+                xenvif_disconnect(be->vif);
+}
+
+static void destroy_backend(struct xenbus_device *dev)
+{
+        struct backend_info *be = dev_get_drvdata(&dev->dev);
+
         if (be->vif) {
+                kobject_uevent(&dev->dev.kobj, KOBJ_OFFLINE);
                 xenbus_rm(XBT_NIL, dev->nodename, "hotplug-status");
-                xenvif_disconnect(be->vif);
+                xenvif_free(be->vif);
                 be->vif = NULL;
         }
 }
@@ -246,14 +255,11 @@ static void frontend_changed(struct xenbus_device *dev,
         case XenbusStateConnected:
                 if (dev->state == XenbusStateConnected)
                         break;
-                backend_create_xenvif(be);
                 if (be->vif)
                         connect(be);
                 break;
 
         case XenbusStateClosing:
-                if (be->vif)
-                        kobject_uevent(&dev->dev.kobj, KOBJ_OFFLINE);
                 disconnect_backend(dev);
                 xenbus_switch_state(dev, XenbusStateClosing);
                 break;
@@ -262,6 +268,7 @@ static void frontend_changed(struct xenbus_device *dev,
                 xenbus_switch_state(dev, XenbusStateClosed);
                 if (xenbus_dev_is_online(dev))
                         break;
+                destroy_backend(dev);
                 /* fall through if not online */
         case XenbusStateUnknown:
                 device_unregister(&dev->dev);
diff --git a/drivers/scsi/bnx2fc/bnx2fc.h b/drivers/scsi/bnx2fc/bnx2fc.h
index 08b22a901c25..d7ca9305ff45 100644
--- a/drivers/scsi/bnx2fc/bnx2fc.h
+++ b/drivers/scsi/bnx2fc/bnx2fc.h
@@ -105,7 +105,7 @@
 #define BNX2FC_RQ_WQE_SIZE              (BNX2FC_RQ_BUF_SZ)
 #define BNX2FC_XFERQ_WQE_SIZE           (sizeof(struct fcoe_xfrqe))
 #define BNX2FC_CONFQ_WQE_SIZE           (sizeof(struct fcoe_confqe))
-#define BNX2FC_5771X_DB_PAGE_SIZE       128
+#define BNX2X_DB_SHIFT                  3
 
 #define BNX2FC_TASK_SIZE                128
 #define BNX2FC_TASKS_PER_PAGE           (PAGE_SIZE/BNX2FC_TASK_SIZE)
diff --git a/drivers/scsi/bnx2fc/bnx2fc_hwi.c b/drivers/scsi/bnx2fc/bnx2fc_hwi.c
index c0d035a8f8f9..46a37657307f 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_hwi.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_hwi.c
@@ -1421,8 +1421,7 @@ int bnx2fc_map_doorbell(struct bnx2fc_rport *tgt)
 
         reg_base = pci_resource_start(hba->pcidev,
                                         BNX2X_DOORBELL_PCI_BAR);
-        reg_off = BNX2FC_5771X_DB_PAGE_SIZE *
-                        (context_id & 0x1FFFF) + DPM_TRIGER_TYPE;
+        reg_off = (1 << BNX2X_DB_SHIFT) * (context_id & 0x1FFFF);
         tgt->ctx_base = ioremap_nocache(reg_base + reg_off, 4);
         if (!tgt->ctx_base)
                 return -ENOMEM;
diff --git a/drivers/scsi/bnx2i/bnx2i.h b/drivers/scsi/bnx2i/bnx2i.h
index 6940f0930a84..c73bbcb63c02 100644
--- a/drivers/scsi/bnx2i/bnx2i.h
+++ b/drivers/scsi/bnx2i/bnx2i.h
@@ -64,7 +64,7 @@
 #define MAX_PAGES_PER_CTRL_STRUCT_POOL  8
 #define BNX2I_RESERVED_SLOW_PATH_CMD_SLOTS      4
 
-#define BNX2I_5771X_DBELL_PAGE_SIZE     128
+#define BNX2X_DB_SHIFT                  3
 
 /* 5706/08 hardware has limit on maximum buffer size per BD it can handle */
 #define MAX_BD_LENGTH                   65535
diff --git a/drivers/scsi/bnx2i/bnx2i_hwi.c b/drivers/scsi/bnx2i/bnx2i_hwi.c
index af3e675d4d48..5be718c241c4 100644
--- a/drivers/scsi/bnx2i/bnx2i_hwi.c
+++ b/drivers/scsi/bnx2i/bnx2i_hwi.c
@@ -2738,8 +2738,7 @@ int bnx2i_map_ep_dbell_regs(struct bnx2i_endpoint *ep)
         if (test_bit(BNX2I_NX2_DEV_57710, &ep->hba->cnic_dev_type)) {
                 reg_base = pci_resource_start(ep->hba->pcidev,
                                               BNX2X_DOORBELL_PCI_BAR);
-                reg_off = BNX2I_5771X_DBELL_PAGE_SIZE * (cid_num & 0x1FFFF) +
-                          DPM_TRIGER_TYPE;
+                reg_off = (1 << BNX2X_DB_SHIFT) * (cid_num & 0x1FFFF);
                 ep->qp.ctx_base = ioremap_nocache(reg_base + reg_off, 4);
                 goto arm_cq;
         }
diff --git a/drivers/staging/octeon/ethernet-mem.c b/drivers/staging/octeon/ethernet-mem.c
index 78b6cb743769..199059d64c9b 100644
--- a/drivers/staging/octeon/ethernet-mem.c
+++ b/drivers/staging/octeon/ethernet-mem.c
@@ -48,13 +48,8 @@ static int cvm_oct_fill_hw_skbuff(int pool, int size, int elements)
         while (freed) {
 
                 struct sk_buff *skb = dev_alloc_skb(size + 256);
-                if (unlikely(skb == NULL)) {
-                        pr_warning
-                            ("Failed to allocate skb for hardware pool %d\n",
-                             pool);
+                if (unlikely(skb == NULL))
                         break;
-                }
-
                 skb_reserve(skb, 256 - (((unsigned long)skb->data) & 0x7f));
                 *(struct sk_buff **)(skb->data - sizeof(void *)) = skb;
                 cvmx_fpa_free(skb->data, pool, DONT_WRITEBACK(size / 128));
diff --git a/drivers/staging/octeon/ethernet-rgmii.c b/drivers/staging/octeon/ethernet-rgmii.c
index d8f5f694ec35..ea53af30dfa7 100644
--- a/drivers/staging/octeon/ethernet-rgmii.c
+++ b/drivers/staging/octeon/ethernet-rgmii.c
@@ -373,9 +373,7 @@ int cvm_oct_rgmii_init(struct net_device *dev)
                          * Enable interrupts on inband status changes
                          * for this port.
                          */
-                        gmx_rx_int_en.u64 =
-                            cvmx_read_csr(CVMX_GMXX_RXX_INT_EN
-                                          (index, interface));
+                        gmx_rx_int_en.u64 = 0;
                         gmx_rx_int_en.s.phy_dupx = 1;
                         gmx_rx_int_en.s.phy_link = 1;
                         gmx_rx_int_en.s.phy_spd = 1;
diff --git a/drivers/staging/octeon/ethernet-rx.c b/drivers/staging/octeon/ethernet-rx.c
index 34afc16bc493..e14a1bb04361 100644
--- a/drivers/staging/octeon/ethernet-rx.c
+++ b/drivers/staging/octeon/ethernet-rx.c
@@ -303,6 +303,7 @@ static int cvm_oct_napi_poll(struct napi_struct *napi, int budget)
                         if (backlog > budget * cores_in_use && napi != NULL)
                                 cvm_oct_enable_one_cpu();
                 }
+                rx_count++;
 
                 skb_in_hw = USE_SKBUFFS_IN_HW && work->word2.s.bufs == 1;
                 if (likely(skb_in_hw)) {
@@ -336,9 +337,6 @@ static int cvm_oct_napi_poll(struct napi_struct *napi, int budget)
                          */
                         skb = dev_alloc_skb(work->len);
                         if (!skb) {
-                                printk_ratelimited("Port %d failed to allocate "
-                                                   "skbuff, packet dropped\n",
-                                                   work->ipprt);
                                 cvm_oct_free_work(work);
                                 continue;
                         }
@@ -429,7 +427,6 @@ static int cvm_oct_napi_poll(struct napi_struct *napi, int budget)
 #endif
                                 }
                                 netif_receive_skb(skb);
-                                rx_count++;
                         } else {
                                 /* Drop any packet received for a device that isn't up */
                                 /*
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index a9355ce1c6d5..3a1a01af9a80 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -854,7 +854,8 @@ void disassociate_ctty(int on_exit)
                         struct pid *tty_pgrp = tty_get_pgrp(tty);
                         if (tty_pgrp) {
                                 kill_pgrp(tty_pgrp, SIGHUP, on_exit);
-                                kill_pgrp(tty_pgrp, SIGCONT, on_exit);
+                                if (!on_exit)
+                                        kill_pgrp(tty_pgrp, SIGCONT, on_exit);
                                 put_pid(tty_pgrp);
                         }
                 }
diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
index 58e6cbce4156..08f2e1e9a7e6 100644
--- a/fs/9p/v9fs.c
+++ b/fs/9p/v9fs.c
@@ -603,10 +603,11 @@ static int v9fs_cache_register(void)
         if (ret < 0)
                 return ret;
 #ifdef CONFIG_9P_FSCACHE
-        return fscache_register_netfs(&v9fs_cache_netfs);
-#else
-        return ret;
+        ret = fscache_register_netfs(&v9fs_cache_netfs);
+        if (ret < 0)
+                v9fs_destroy_inode_cache();
 #endif
+        return ret;
 }
 
 static void v9fs_cache_unregister(void)
diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
index 53687bbf2296..a7c481402c46 100644
--- a/fs/9p/vfs_inode_dotl.c
+++ b/fs/9p/vfs_inode_dotl.c
@@ -267,14 +267,8 @@ v9fs_vfs_atomic_open_dotl(struct inode *dir, struct dentry *dentry,
         }
 
         /* Only creates */
-        if (!(flags & O_CREAT))
+        if (!(flags & O_CREAT) || dentry->d_inode)
                 return  finish_no_open(file, res);
-        else if (dentry->d_inode) {
-                if ((flags & (O_CREAT | O_EXCL)) == (O_CREAT | O_EXCL))
-                        return -EEXIST;
-                else
-                        return finish_no_open(file, res);
-        }
 
         v9ses = v9fs_inode2v9ses(dir);
 
diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
index 3db70dae40d3..689e40d983ad 100644
--- a/fs/autofs4/waitq.c
+++ b/fs/autofs4/waitq.c
@@ -109,13 +109,7 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
 
         pkt.hdr.proto_version = sbi->version;
         pkt.hdr.type = type;
-        mutex_lock(&sbi->wq_mutex);
 
-        /* Check if we have become catatonic */
-        if (sbi->catatonic) {
-                mutex_unlock(&sbi->wq_mutex);
-                return;
-        }
         switch (type) {
         /* Kernel protocol v4 missing and expire packets */
         case autofs_ptype_missing:
@@ -427,7 +421,6 @@ int autofs4_wait(struct autofs_sb_info *sbi, struct dentry *dentry,
                 wq->tgid = current->tgid;
                 wq->status = -EINTR; /* Status return if interrupted */
                 wq->wait_ctr = 2;
-                mutex_unlock(&sbi->wq_mutex);
 
                 if (sbi->version < 5) {
                         if (notify == NFY_MOUNT)
@@ -449,15 +442,15 @@ int autofs4_wait(struct autofs_sb_info *sbi, struct dentry *dentry,
                         (unsigned long) wq->wait_queue_token, wq->name.len,
                         wq->name.name, notify);
 
-                /* autofs4_notify_daemon() may block */
+                /* autofs4_notify_daemon() may block; it will unlock ->wq_mutex */
                 autofs4_notify_daemon(sbi, wq, type);
         } else {
                 wq->wait_ctr++;
-                mutex_unlock(&sbi->wq_mutex);
-                kfree(qstr.name);
                 DPRINTK("existing wait id = 0x%08lx, name = %.*s, nfy=%d",
                         (unsigned long) wq->wait_queue_token, wq->name.len,
                         wq->name.name, notify);
+                mutex_unlock(&sbi->wq_mutex);
+                kfree(qstr.name);
         }
 
         /*
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index d3e2eaa503a6..5384c2a640ca 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -500,6 +500,7 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry,
                 if (server->ops->close)
                         server->ops->close(xid, tcon, &fid);
                 cifs_del_pending_open(&open);
+                fput(file);
                 rc = -ENOMEM;
         }
 
diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
index 318e8433527c..b2a86e324aac 100644
--- a/fs/fscache/cookie.c
+++ b/fs/fscache/cookie.c
@@ -586,7 +586,8 @@ int __fscache_check_consistency(struct fscache_cookie *cookie)
 
         fscache_operation_init(op, NULL, NULL);
         op->flags = FSCACHE_OP_MYTHREAD |
-                (1 << FSCACHE_OP_WAITING);
+                (1 << FSCACHE_OP_WAITING) |
+                (1 << FSCACHE_OP_UNUSE_COOKIE);
 
         spin_lock(&cookie->lock);
 
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 64915eeae5a7..ced3257f06e8 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -694,8 +694,10 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
 
         mark_inode_dirty(inode);
         d_instantiate(dentry, inode);
-        if (file)
+        if (file) {
+                *opened |= FILE_CREATED;
                 error = finish_open(file, dentry, gfs2_open_common, opened);
+        }
         gfs2_glock_dq_uninit(ghs);
         gfs2_glock_dq_uninit(ghs + 1);
         return error;
diff --git a/fs/namei.c b/fs/namei.c
index 0dc4cbf21f37..645268f23eb6 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2656,6 +2656,7 @@ static int atomic_open(struct nameidata *nd, struct dentry *dentry,
         int acc_mode;
         int create_error = 0;
         struct dentry *const DENTRY_NOT_SET = (void *) -1UL;
+        bool excl;
 
         BUG_ON(dentry->d_inode);
 
@@ -2669,10 +2670,9 @@ static int atomic_open(struct nameidata *nd, struct dentry *dentry,
         if ((open_flag & O_CREAT) && !IS_POSIXACL(dir))
                 mode &= ~current_umask();
 
-        if ((open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT)) {
+        excl = (open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT);
+        if (excl)
                 open_flag &= ~O_TRUNC;
-                *opened |= FILE_CREATED;
-        }
 
         /*
          * Checking write permission is tricky, bacuse we don't know if we are
@@ -2725,12 +2725,6 @@ static int atomic_open(struct nameidata *nd, struct dentry *dentry,
                 goto out;
         }
 
-        acc_mode = op->acc_mode;
-        if (*opened & FILE_CREATED) {
-                fsnotify_create(dir, dentry);
-                acc_mode = MAY_OPEN;
-        }
-
         if (error) {    /* returned 1, that is */
                 if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) {
                         error = -EIO;
@@ -2740,9 +2734,19 @@ static int atomic_open(struct nameidata *nd, struct dentry *dentry,
                         dput(dentry);
                         dentry = file->f_path.dentry;
                 }
-                if (create_error && dentry->d_inode == NULL) {
-                        error = create_error;
-                        goto out;
+                if (*opened & FILE_CREATED)
+                        fsnotify_create(dir, dentry);
+                if (!dentry->d_inode) {
+                        WARN_ON(*opened & FILE_CREATED);
+                        if (create_error) {
+                                error = create_error;
+                                goto out;
+                        }
+                } else {
+                        if (excl && !(*opened & FILE_CREATED)) {
+                                error = -EEXIST;
+                                goto out;
+                        }
                 }
                 goto looked_up;
         }
@@ -2751,6 +2755,12 @@ static int atomic_open(struct nameidata *nd, struct dentry *dentry,
          * We didn't have the inode before the open, so check open permission
          * here.
          */
+        acc_mode = op->acc_mode;
+        if (*opened & FILE_CREATED) {
+                WARN_ON(!(open_flag & O_CREAT));
+                fsnotify_create(dir, dentry);
+                acc_mode = MAY_OPEN;
+        }
         error = may_open(&file->f_path, acc_mode, open_flag);
         if (error)
                 fput(file);
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index de434f309af0..854a8f05a610 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1392,6 +1392,9 @@ static int nfs_finish_open(struct nfs_open_context *ctx,
 {
         int err;
 
+        if ((open_flags & (O_CREAT | O_EXCL)) == (O_CREAT | O_EXCL))
+                *opened |= FILE_CREATED;
+
         err = finish_open(file, dentry, do_open, opened);
         if (err)
                 goto out;
diff --git a/fs/open.c b/fs/open.c
index 2a731b0d08bc..d420331ca32a 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -744,14 +744,24 @@ cleanup_file:
 
 /**
  * finish_open - finish opening a file
- * @od: opaque open data
+ * @file: file pointer
  * @dentry: pointer to dentry
  * @open: open callback
+ * @opened: state of open
  *
  * This can be used to finish opening a file passed to i_op->atomic_open().
  *
  * If the open callback is set to NULL, then the standard f_op->open()
  * filesystem callback is substituted.
+ *
+ * NB: the dentry reference is _not_ consumed.  If, for example, the dentry is
+ * the return value of d_splice_alias(), then the caller needs to perform dput()
+ * on it after finish_open().
+ *
+ * On successful return @file is a fully instantiated open file.  After this, if
+ * an error occurs in ->atomic_open(), it needs to clean up with fput().
+ *
+ * Returns zero on success or -errno if the open failed.
  */
 int finish_open(struct file *file, struct dentry *dentry,
                 int (*open)(struct inode *, struct file *),
@@ -772,11 +782,16 @@ EXPORT_SYMBOL(finish_open);
 /**
  * finish_no_open - finish ->atomic_open() without opening the file
  *
- * @od: opaque open data
+ * @file: file pointer
  * @dentry: dentry or NULL (as returned from ->lookup())
  *
  * This can be used to set the result of a successful lookup in ->atomic_open().
- * The filesystem's atomic_open() method shall return NULL after calling this.
+ *
+ * NB: unlike finish_open() this function does consume the dentry reference and
+ * the caller need not dput() it.
+ *
+ * Returns "1" which must be the return value of ->atomic_open() after having
+ * called this function.
  */
 int finish_no_open(struct file *file, struct dentry *dentry)
 {
diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c
index 4ffb7ab5e397..b8e93a40a5d3 100644
--- a/fs/pstore/platform.c
+++ b/fs/pstore/platform.c
@@ -168,7 +168,7 @@ static int pstore_decompress(void *in, void *out, size_t inlen, size_t outlen)
         int err, ret;
 
         ret = -EIO;
-        err = zlib_inflateInit(&stream);
+        err = zlib_inflateInit2(&stream, WINDOW_BITS);
         if (err != Z_OK)
                 goto error;
 
@@ -195,8 +195,29 @@ error:
 static void allocate_buf_for_compression(void)
 {
         size_t size;
+        size_t cmpr;
+
+        switch (psinfo->bufsize) {
+        /* buffer range for efivars */
+        case 1000 ... 2000:
+                cmpr = 56;
+                break;
+        case 2001 ... 3000:
+                cmpr = 54;
+                break;
+        case 3001 ... 3999:
+                cmpr = 52;
+                break;
+        /* buffer range for nvram, erst */
+        case 4000 ... 10000:
+                cmpr = 45;
+                break;
+        default:
+                cmpr = 60;
+                break;
+        }
 
-        big_oops_buf_sz = (psinfo->bufsize * 100) / 45;
+        big_oops_buf_sz = (psinfo->bufsize * 100) / cmpr;
         big_oops_buf = kmalloc(big_oops_buf_sz, GFP_KERNEL);
         if (big_oops_buf) {
                 size = max(zlib_deflate_workspacesize(WINDOW_BITS, MEM_LEVEL),
@@ -295,10 +316,6 @@ static void pstore_dump(struct kmsg_dumper *dumper,
                                 compressed = true;
                                 total_len = zipped_len;
                         } else {
-                                pr_err("pstore: compression failed for Part %d"
-                                        " returned %d\n", part, zipped_len);
-                                pr_err("pstore: Capture uncompressed"
-                                        " oops/panic report of Part %d\n", part);
                                 compressed = false;
                                 total_len = copy_kmsg_to_buffer(hsize, len);
                         }
diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
index fd54a14a7c2a..3d79e513c0b3 100644
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -12,11 +12,14 @@
         {0x1002, 0x130F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KAVERI|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x1310, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KAVERI|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x1311, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KAVERI|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x1312, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KAVERI|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x1313, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KAVERI|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x1315, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KAVERI|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x1316, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KAVERI|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x1317, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KAVERI|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x131B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KAVERI|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x131C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KAVERI|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x131D, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_KAVERI|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x3150, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|RADEON_IS_MOBILITY}, \
         {0x1002, 0x3151, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x3152, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
diff --git a/include/linux/ceph/osd_client.h b/include/linux/ceph/osd_client.h
index ce6df39f60ff..8f47625a0661 100644
--- a/include/linux/ceph/osd_client.h
+++ b/include/linux/ceph/osd_client.h
@@ -335,6 +335,8 @@ extern int ceph_osdc_wait_request(struct ceph_osd_client *osdc,
                                   struct ceph_osd_request *req);
 extern void ceph_osdc_sync(struct ceph_osd_client *osdc);
 
+extern void ceph_osdc_flush_notifies(struct ceph_osd_client *osdc);
+
 extern int ceph_osdc_readpages(struct ceph_osd_client *osdc,
                                struct ceph_vino vino,
                                struct ceph_file_layout *layout,
diff --git a/include/linux/hid.h b/include/linux/hid.h
index ee1ffc5e19c9..31b9d299ef6c 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -756,6 +756,10 @@ u8 *hid_alloc_report_buf(struct hid_report *report, gfp_t flags);
 struct hid_device *hid_allocate_device(void);
 struct hid_report *hid_register_report(struct hid_device *device, unsigned type, unsigned id);
 int hid_parse_report(struct hid_device *hid, __u8 *start, unsigned size);
+struct hid_report *hid_validate_values(struct hid_device *hid,
+                                       unsigned int type, unsigned int id,
+                                       unsigned int field_index,
+                                       unsigned int report_counts);
 int hid_open_report(struct hid_device *device);
 int hid_check_keys_pressed(struct hid_device *hid);
 int hid_connect(struct hid_device *hid, unsigned int connect_mask);
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index a5b598a79bec..7c1e1ebc0e23 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -1391,8 +1391,8 @@ struct ieee80211_vht_operation {
 #define IEEE80211_VHT_CAP_RXSTBC_MASK                           0x00000700
 #define IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE                 0x00000800
 #define IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE                 0x00001000
-#define IEEE80211_VHT_CAP_BEAMFORMER_ANTENNAS_MAX               0x00006000
-#define IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MAX               0x00030000
+#define IEEE80211_VHT_CAP_BEAMFORMEE_STS_MAX                    0x0000e000
+#define IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MAX               0x00070000
 #define IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE                 0x00080000
 #define IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE                 0x00100000
 #define IEEE80211_VHT_CAP_VHT_TXOP_PS                           0x00200000
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index ca645a01d37a..0fbbc7aa02cb 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -533,6 +533,7 @@ int gfn_to_page_many_atomic(struct kvm *kvm, gfn_t gfn, struct page **pages,
 
 struct page *gfn_to_page(struct kvm *kvm, gfn_t gfn);
 unsigned long gfn_to_hva(struct kvm *kvm, gfn_t gfn);
+unsigned long gfn_to_hva_prot(struct kvm *kvm, gfn_t gfn, bool *writable);
 unsigned long gfn_to_hva_memslot(struct kvm_memory_slot *slot, gfn_t gfn);
 void kvm_release_page_clean(struct page *page);
 void kvm_release_page_dirty(struct page *page);
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 041b42a305f6..3de49aca4519 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -950,14 +950,14 @@ struct netdev_phys_port_id {
  *      multiple net devices on single physical port.
  *
  * void (*ndo_add_vxlan_port)(struct  net_device *dev,
- *                            sa_family_t sa_family, __u16 port);
+ *                            sa_family_t sa_family, __be16 port);
  *      Called by vxlan to notiy a driver about the UDP port and socket
  *      address family that vxlan is listnening to. It is called only when
  *      a new port starts listening. The operation is protected by the
  *      vxlan_net->sock_lock.
  *
  * void (*ndo_del_vxlan_port)(struct  net_device *dev,
- *                            sa_family_t sa_family, __u16 port);
+ *                            sa_family_t sa_family, __be16 port);
  *      Called by vxlan to notify the driver about a UDP port and socket
  *      address family that vxlan is not listening to anymore. The operation
  *      is protected by the vxlan_net->sock_lock.
@@ -1093,10 +1093,10 @@ struct net_device_ops {
                                                         struct netdev_phys_port_id *ppid);
         void                    (*ndo_add_vxlan_port)(struct  net_device *dev,
                                                       sa_family_t sa_family,
-                                                      __u16 port);
+                                                      __be16 port);
         void                    (*ndo_del_vxlan_port)(struct  net_device *dev,
                                                       sa_family_t sa_family,
-                                                      __u16 port);
+                                                      __be16 port);
 };
 
 /*
diff --git a/include/linux/netfilter/ipset/ip_set.h b/include/linux/netfilter/ipset/ip_set.h
index d80e2753847c..9ac9fbde7b61 100644
--- a/include/linux/netfilter/ipset/ip_set.h
+++ b/include/linux/netfilter/ipset/ip_set.h
@@ -296,10 +296,12 @@ ip_set_eexist(int ret, u32 flags)
 
 /* Match elements marked with nomatch */
 static inline bool
-ip_set_enomatch(int ret, u32 flags, enum ipset_adt adt)
+ip_set_enomatch(int ret, u32 flags, enum ipset_adt adt, struct ip_set *set)
 {
         return adt == IPSET_TEST &&
-               ret == -ENOTEMPTY && ((flags >> 16) & IPSET_FLAG_NOMATCH);
+               (set->type->features & IPSET_TYPE_NOMATCH) &&
+               ((flags >> 16) & IPSET_FLAG_NOMATCH) &&
+               (ret > 0 || ret == -ENOTEMPTY);
 }
 
 /* Check the NLA_F_NET_BYTEORDER flag */
diff --git a/include/linux/timex.h b/include/linux/timex.h
index b3726e61368e..dd3edd7dfc94 100644
--- a/include/linux/timex.h
+++ b/include/linux/timex.h
@@ -141,6 +141,7 @@ extern int do_adjtimex(struct timex *);
 extern void hardpps(const struct timespec *, const struct timespec *);
 
 int read_current_timer(unsigned long *timer_val);
+void ntp_notify_cmos_timer(void);
 
 /* The clock frequency of the i8253/i8254 PIT */
 #define PIT_TICK_RATE 1193182ul
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 10d43d8c7037..5fd510675cfa 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -197,8 +197,8 @@ static inline bool bdaddr_type_is_le(__u8 type)
         return false;
 }
 
-#define BDADDR_ANY   (&(bdaddr_t) {{0, 0, 0, 0, 0, 0} })
-#define BDADDR_LOCAL (&(bdaddr_t) {{0, 0, 0, 0xff, 0xff, 0xff} })
+#define BDADDR_ANY  (&(bdaddr_t) {{0, 0, 0, 0, 0, 0}})
+#define BDADDR_NONE (&(bdaddr_t) {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff}})
 
 /* Copy, swap, convert BD Address */
 static inline int bacmp(const bdaddr_t *ba1, const bdaddr_t *ba2)
@@ -249,6 +249,7 @@ int  bt_sock_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
 uint bt_sock_poll(struct file *file, struct socket *sock, poll_table *wait);
 int  bt_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
 int  bt_sock_wait_state(struct sock *sk, int state, unsigned long timeo);
+int  bt_sock_wait_ready(struct sock *sk, unsigned long flags);
 
 void bt_accept_enqueue(struct sock *parent, struct sock *sk);
 void bt_accept_unlink(struct sock *sk);
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index aaeaf0938ec0..b90eec5e9c06 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -35,6 +35,8 @@
 
 #define HCI_MAX_AMP_ASSOC_SIZE  672
 
+#define HCI_MAX_CSB_DATA_SIZE   252
+
 /* HCI dev events */
 #define HCI_DEV_REG                     1
 #define HCI_DEV_UNREG                   2
@@ -104,11 +106,13 @@ enum {
 enum {
         HCI_SETUP,
         HCI_AUTO_OFF,
+        HCI_RFKILLED,
         HCI_MGMT,
         HCI_PAIRABLE,
         HCI_SERVICE_CACHE,
         HCI_DEBUG_KEYS,
         HCI_UNREGISTER,
+        HCI_USER_CHANNEL,
 
         HCI_LE_SCAN,
         HCI_SSP_ENABLED,
@@ -120,6 +124,7 @@ enum {
         HCI_LINK_SECURITY,
         HCI_PERIODIC_INQ,
         HCI_FAST_CONNECTABLE,
+        HCI_BREDR_ENABLED,
 };
 
 /* A mask for the flags that are supposed to remain when a reset happens
@@ -623,6 +628,24 @@ struct hci_rp_logical_link_cancel {
         __u8     flow_spec_id;
 } __packed;
 
+#define HCI_OP_SET_CSB                  0x0441
+struct hci_cp_set_csb {
+        __u8    enable;
+        __u8    lt_addr;
+        __u8    lpo_allowed;
+        __le16  packet_type;
+        __le16  interval_min;
+        __le16  interval_max;
+        __le16  csb_sv_tout;
+} __packed;
+struct hci_rp_set_csb {
+        __u8    status;
+        __u8    lt_addr;
+        __le16  interval;
+} __packed;
+
+#define HCI_OP_START_SYNC_TRAIN         0x0443
+
 #define HCI_OP_SNIFF_MODE               0x0803
 struct hci_cp_sniff_mode {
         __le16   handle;
@@ -693,9 +716,6 @@ struct hci_cp_sniff_subrate {
 } __packed;
 
 #define HCI_OP_SET_EVENT_MASK           0x0c01
-struct hci_cp_set_event_mask {
-        __u8     mask[8];
-} __packed;
 
 #define HCI_OP_RESET                    0x0c03
 
@@ -825,6 +845,8 @@ struct hci_rp_read_inq_rsp_tx_power {
         __s8     tx_power;
 } __packed;
 
+#define HCI_OP_SET_EVENT_MASK_PAGE_2    0x0c63
+
 #define HCI_OP_READ_FLOW_CONTROL_MODE   0x0c66
 struct hci_rp_read_flow_control_mode {
         __u8     status;
@@ -837,6 +859,50 @@ struct hci_cp_write_le_host_supported {
         __u8    simul;
 } __packed;
 
+#define HCI_OP_SET_RESERVED_LT_ADDR     0x0c74
+struct hci_cp_set_reserved_lt_addr {
+        __u8    lt_addr;
+} __packed;
+struct hci_rp_set_reserved_lt_addr {
+        __u8    status;
+        __u8    lt_addr;
+} __packed;
+
+#define HCI_OP_DELETE_RESERVED_LT_ADDR  0x0c75
+struct hci_cp_delete_reserved_lt_addr {
+        __u8    lt_addr;
+} __packed;
+struct hci_rp_delete_reserved_lt_addr {
+        __u8    status;
+        __u8    lt_addr;
+} __packed;
+
+#define HCI_OP_SET_CSB_DATA             0x0c76
+struct hci_cp_set_csb_data {
+        __u8    lt_addr;
+        __u8    fragment;
+        __u8    data_length;
+        __u8    data[HCI_MAX_CSB_DATA_SIZE];
+} __packed;
+struct hci_rp_set_csb_data {
+        __u8    status;
+        __u8    lt_addr;
+} __packed;
+
+#define HCI_OP_READ_SYNC_TRAIN_PARAMS   0x0c77
+
+#define HCI_OP_WRITE_SYNC_TRAIN_PARAMS  0x0c78
+struct hci_cp_write_sync_train_params {
+        __le16  interval_min;
+        __le16  interval_max;
+        __le32  sync_train_tout;
+        __u8    service_data;
+} __packed;
+struct hci_rp_write_sync_train_params {
+        __u8    status;
+        __le16  sync_train_int;
+} __packed;
+
 #define HCI_OP_READ_LOCAL_VERSION       0x1001
 struct hci_rp_read_local_version {
         __u8     status;
@@ -974,6 +1040,8 @@ struct hci_rp_le_read_local_features {
         __u8     features[8];
 } __packed;
 
+#define HCI_OP_LE_SET_RANDOM_ADDR       0x2005
+
 #define HCI_OP_LE_READ_ADV_TX_POWER     0x2007
 struct hci_rp_le_read_adv_tx_power {
         __u8    status;
@@ -1437,6 +1505,13 @@ struct hci_ev_num_comp_blocks {
         struct hci_comp_blocks_info handles[0];
 } __packed;
 
+#define HCI_EV_SYNC_TRAIN_COMPLETE      0x4F
+struct hci_ev_sync_train_complete {
+        __u8    status;
+} __packed;
+
+#define HCI_EV_SLAVE_PAGE_RESP_TIMEOUT  0x54
+
 /* Low energy meta events */
 #define LE_CONN_ROLE_MASTER     0x00
 
@@ -1570,6 +1645,7 @@ struct sockaddr_hci {
 #define HCI_DEV_NONE    0xffff
 
 #define HCI_CHANNEL_RAW         0
+#define HCI_CHANNEL_USER        1
 #define HCI_CHANNEL_MONITOR     2
 #define HCI_CHANNEL_CONTROL     3
 
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 3ede820d328f..e09c30577b3a 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -140,6 +140,7 @@ struct hci_dev {
         __u8            bus;
         __u8            dev_type;
         bdaddr_t        bdaddr;
+        bdaddr_t        static_addr;
         __u8            dev_name[HCI_MAX_NAME_LENGTH];
         __u8            short_name[HCI_MAX_SHORT_NAME_LENGTH];
         __u8            eir[HCI_MAX_EIR_LENGTH];
@@ -1168,7 +1169,6 @@ int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status);
 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
                                             u8 *randomizer, u8 status);
-int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status);
 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name,
                       u8 ssp, u8 *eir, u16 eir_len);
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 1a966afbbfa8..f141b5f6e4f1 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -564,6 +564,7 @@ struct l2cap_conn {
 
         __u32                   feat_mask;
         __u8                    fixed_chan_mask;
+        bool                    hs_enabled;
 
         __u8                    info_state;
         __u8                    info_ident;
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index 9944c3e68c5d..2ad433bb9a2e 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -93,6 +93,7 @@ struct mgmt_rp_read_index_list {
 #define MGMT_SETTING_BREDR              0x00000080
 #define MGMT_SETTING_HS                 0x00000100
 #define MGMT_SETTING_LE                 0x00000200
+#define MGMT_SETTING_ADVERTISING        0x00000400
 
 #define MGMT_OP_READ_INFO               0x0004
 #define MGMT_READ_INFO_SIZE             0
@@ -351,6 +352,16 @@ struct mgmt_cp_set_device_id {
 } __packed;
 #define MGMT_SET_DEVICE_ID_SIZE         8
 
+#define MGMT_OP_SET_ADVERTISING         0x0029
+
+#define MGMT_OP_SET_BREDR               0x002A
+
+#define MGMT_OP_SET_STATIC_ADDRESS      0x002B
+struct mgmt_cp_set_static_address {
+        bdaddr_t bdaddr;
+} __packed;
+#define MGMT_SET_STATIC_ADDRESS_SIZE    6
+
 #define MGMT_EV_CMD_COMPLETE            0x0001
 struct mgmt_ev_cmd_complete {
         __le16  opcode;
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index cb710913d5c8..45f6bf591104 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -437,6 +437,15 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
                              u32 prohibited_flags);
 
 /**
+ * cfg80211_chandef_dfs_required - checks if radar detection is required
+ * @wiphy: the wiphy to validate against
+ * @chandef: the channel definition to check
+ * Return: 1 if radar detection is required, 0 if it is not, < 0 on error
+ */
+int cfg80211_chandef_dfs_required(struct wiphy *wiphy,
+                                  const struct cfg80211_chan_def *chandef);
+
+/**
  * ieee80211_chandef_rate_flags - returns rate flags for a channel
  *
  * In some channel types, not all rates may be used - for example CCK
diff --git a/include/net/ip.h b/include/net/ip.h
index 48f55979d842..5e5268807a1c 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -264,9 +264,11 @@ int ip_dont_fragment(struct sock *sk, struct dst_entry *dst)
 
 extern void __ip_select_ident(struct iphdr *iph, struct dst_entry *dst, int more);
 
-static inline void ip_select_ident(struct iphdr *iph, struct dst_entry *dst, struct sock *sk)
+static inline void ip_select_ident(struct sk_buff *skb, struct dst_entry *dst, struct sock *sk)
 {
-        if (iph->frag_off & htons(IP_DF)) {
+        struct iphdr *iph = ip_hdr(skb);
+
+        if ((iph->frag_off & htons(IP_DF)) && !skb->local_df) {
                 /* This is only to work around buggy Windows95/2000
                  * VJ compression implementations.  If the ID field
                  * does not change, they drop every other packet in
@@ -278,9 +280,11 @@ static inline void ip_select_ident(struct iphdr *iph, struct dst_entry *dst, str
                 __ip_select_ident(iph, dst, 0);
 }
 
-static inline void ip_select_ident_more(struct iphdr *iph, struct dst_entry *dst, struct sock *sk, int more)
+static inline void ip_select_ident_more(struct sk_buff *skb, struct dst_entry *dst, struct sock *sk, int more)
 {
-        if (iph->frag_off & htons(IP_DF)) {
+        struct iphdr *iph = ip_hdr(skb);
+
+        if ((iph->frag_off & htons(IP_DF)) && !skb->local_df) {
                 if (sk && inet_sk(sk)->inet_daddr) {
                         iph->id = htons(inet_sk(sk)->inet_id);
                         inet_sk(sk)->inet_id += 1 + more;
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index cc6035f1a2f1..f386c480e134 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -829,6 +829,15 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
  * @RX_FLAG_STBC_MASK: STBC 2 bit bitmask. 1 - Nss=1, 2 - Nss=2, 3 - Nss=3
  * @RX_FLAG_10MHZ: 10 MHz (half channel) was used
  * @RX_FLAG_5MHZ: 5 MHz (quarter channel) was used
+ * @RX_FLAG_AMSDU_MORE: Some drivers may prefer to report separate A-MSDU
+ *      subframes instead of a one huge frame for performance reasons.
+ *      All, but the last MSDU from an A-MSDU should have this flag set. E.g.
+ *      if an A-MSDU has 3 frames, the first 2 must have the flag set, while
+ *      the 3rd (last) one must not have this flag set. The flag is used to
+ *      deal with retransmission/duplication recovery properly since A-MSDU
+ *      subframes share the same sequence number. Reported subframes can be
+ *      either regular MSDU or singly A-MSDUs. Subframes must not be
+ *      interleaved with other frames.
  */
 enum mac80211_rx_flags {
         RX_FLAG_MMIC_ERROR              = BIT(0),
@@ -859,6 +868,7 @@ enum mac80211_rx_flags {
         RX_FLAG_STBC_MASK               = BIT(26) | BIT(27),
         RX_FLAG_10MHZ                   = BIT(28),
         RX_FLAG_5MHZ                    = BIT(29),
+        RX_FLAG_AMSDU_MORE              = BIT(30),
 };
 
 #define RX_FLAG_STBC_SHIFT              26
@@ -1492,6 +1502,11 @@ struct ieee80211_tx_control {
  *
  * @IEEE80211_HW_TIMING_BEACON_ONLY: Use sync timing from beacon frames
  *      only, to allow getting TBTT of a DTIM beacon.
+ *
+ * @IEEE80211_HW_CHANCTX_STA_CSA: Support 802.11h based channel-switch (CSA)
+ *      for a single active channel while using channel contexts. When support
+ *      is not enabled the default action is to disconnect when getting the
+ *      CSA frame.
  */
 enum ieee80211_hw_flags {
         IEEE80211_HW_HAS_RATE_CONTROL                   = 1<<0,
@@ -1522,6 +1537,7 @@ enum ieee80211_hw_flags {
         IEEE80211_HW_P2P_DEV_ADDR_FOR_INTF              = 1<<25,
         IEEE80211_HW_TIMING_BEACON_ONLY                 = 1<<26,
         IEEE80211_HW_SUPPORTS_HT_CCK_RATES              = 1<<27,
+        IEEE80211_HW_CHANCTX_STA_CSA                    = 1<<28,
 };
 
 /**
@@ -2666,6 +2682,10 @@ enum ieee80211_roc_type {
  *      zero using ieee80211_csa_is_complete() after the beacon has been
  *      transmitted and then call ieee80211_csa_finish().
  *
+ * @join_ibss: Join an IBSS (on an IBSS interface); this is called after all
+ *      information in bss_conf is set up and the beacon can be retrieved. A
+ *      channel context is bound before this is called.
+ * @leave_ibss: Leave the IBSS again.
  */
 struct ieee80211_ops {
         void (*tx)(struct ieee80211_hw *hw,
@@ -2857,6 +2877,9 @@ struct ieee80211_ops {
         void (*channel_switch_beacon)(struct ieee80211_hw *hw,
                                       struct ieee80211_vif *vif,
                                       struct cfg80211_chan_def *chandef);
+
+        int (*join_ibss)(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
+        void (*leave_ibss)(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
 };
 
 /**
@@ -3920,6 +3943,25 @@ void ieee80211_iterate_active_interfaces_atomic(struct ieee80211_hw *hw,
                                                 void *data);
 
 /**
+ * ieee80211_iterate_active_interfaces_rtnl - iterate active interfaces
+ *
+ * This function iterates over the interfaces associated with a given
+ * hardware that are currently active and calls the callback for them.
+ * This version can only be used while holding the RTNL.
+ *
+ * @hw: the hardware struct of which the interfaces should be iterated over
+ * @iter_flags: iteration flags, see &enum ieee80211_interface_iteration_flags
+ * @iterator: the iterator function to call, cannot sleep
+ * @data: first argument of the iterator function
+ */
+void ieee80211_iterate_active_interfaces_rtnl(struct ieee80211_hw *hw,
+                                              u32 iter_flags,
+                                              void (*iterator)(void *data,
+                                                u8 *mac,
+                                                struct ieee80211_vif *vif),
+                                              void *data);
+
+/**
  * ieee80211_queue_work - add work onto the mac80211 workqueue
  *
  * Drivers and mac80211 use this to add work onto the mac80211 workqueue.
diff --git a/include/net/netfilter/nf_conntrack_extend.h b/include/net/netfilter/nf_conntrack_extend.h
index ff95434e50ca..88a1d4060d52 100644
--- a/include/net/netfilter/nf_conntrack_extend.h
+++ b/include/net/netfilter/nf_conntrack_extend.h
@@ -86,7 +86,7 @@ static inline void nf_ct_ext_destroy(struct nf_conn *ct)
 static inline void nf_ct_ext_free(struct nf_conn *ct)
 {
         if (ct->ext)
-                kfree(ct->ext);
+                kfree_rcu(ct->ext, rcu);
 }
 
 /* Add this type, returns pointer to data or NULL. */
diff --git a/include/uapi/linux/perf_event.h b/include/uapi/linux/perf_event.h
index ca1d90bcb74d..40a1fb807396 100644
--- a/include/uapi/linux/perf_event.h
+++ b/include/uapi/linux/perf_event.h
@@ -324,7 +324,7 @@ struct perf_event_attr {
 #define PERF_EVENT_IOC_PERIOD           _IOW('$', 4, __u64)
 #define PERF_EVENT_IOC_SET_OUTPUT       _IO ('$', 5)
 #define PERF_EVENT_IOC_SET_FILTER       _IOW('$', 6, char *)
-#define PERF_EVENT_IOC_ID               _IOR('$', 7, u64 *)
+#define PERF_EVENT_IOC_ID               _IOR('$', 7, __u64 *)
 
 enum perf_event_ioc_flags {
         PERF_IOC_FLAG_GROUP             = 1U << 0,
diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
index e076bddd4c66..196559994f7c 100644
--- a/kernel/sched/debug.c
+++ b/kernel/sched/debug.c
@@ -124,7 +124,7 @@ print_task(struct seq_file *m, struct rq *rq, struct task_struct *p)
                 SEQ_printf(m, " ");
 
         SEQ_printf(m, "%15s %5d %9Ld.%06ld %9Ld %5d ",
-                p->comm, p->pid,
+                p->comm, task_pid_nr(p),
                 SPLIT_NS(p->se.vruntime),
                 (long long)(p->nvcsw + p->nivcsw),
                 p->prio);
@@ -289,7 +289,7 @@ do {									\
         P(nr_load_updates);
         P(nr_uninterruptible);
         PN(next_balance);
-        P(curr->pid);
+        SEQ_printf(m, "  .%-30s: %ld\n", "curr->pid", (long)(task_pid_nr(rq->curr)));
         PN(clock);
         P(cpu_load[0]);
         P(cpu_load[1]);
@@ -492,7 +492,7 @@ void proc_sched_show_task(struct task_struct *p, struct seq_file *m)
 {
         unsigned long nr_switches;
 
-        SEQ_printf(m, "%s (%d, #threads: %d)\n", p->comm, p->pid,
+        SEQ_printf(m, "%s (%d, #threads: %d)\n", p->comm, task_pid_nr(p),
                                                 get_nr_threads(p));
         SEQ_printf(m,
                 "---------------------------------------------------------"
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 9b3fe1cd8f40..11cd13667359 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -5928,11 +5928,15 @@ static void task_fork_fair(struct task_struct *p)
         cfs_rq = task_cfs_rq(current);
         curr = cfs_rq->curr;
 
-        if (unlikely(task_cpu(p) != this_cpu)) {
-                rcu_read_lock();
-                __set_task_cpu(p, this_cpu);
-                rcu_read_unlock();
-        }
+        /*
+         * Not only the cpu but also the task_group of the parent might have
+         * been changed after parent->se.parent,cfs_rq were copied to
+         * child->se.parent,cfs_rq. So call __set_task_cpu() to make those
+         * of child point to valid ones.
+         */
+        rcu_read_lock();
+        __set_task_cpu(p, this_cpu);
+        rcu_read_unlock();
 
         update_curr(cfs_rq);
 
diff --git a/kernel/sched/stats.h b/kernel/sched/stats.h
index 5aef494fc8b4..c7edee71bce8 100644
--- a/kernel/sched/stats.h
+++ b/kernel/sched/stats.h
@@ -104,8 +104,9 @@ static inline void sched_info_queued(struct task_struct *t)
 }
 
 /*
- * Called when a process ceases being the active-running process, either
- * voluntarily or involuntarily.  Now we can calculate how long we ran.
+ * Called when a process ceases being the active-running process involuntarily
+ * due, typically, to expiring its time slice (this may also be called when
+ * switching to the idle task).  Now we can calculate how long we ran.
  * Also, if the process is still in the TASK_RUNNING state, call
  * sched_info_queued() to mark that it has now again started waiting on
  * the runqueue.
diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
index 8f5b3b98577b..bb2215174f05 100644
--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -516,13 +516,13 @@ static void sync_cmos_clock(struct work_struct *work)
         schedule_delayed_work(&sync_cmos_work, timespec_to_jiffies(&next));
 }
 
-static void notify_cmos_timer(void)
+void ntp_notify_cmos_timer(void)
 {
         schedule_delayed_work(&sync_cmos_work, 0);
 }
 
 #else
-static inline void notify_cmos_timer(void) { }
+void ntp_notify_cmos_timer(void) { }
 #endif
 
 
@@ -687,8 +687,6 @@ int __do_adjtimex(struct timex *txc, struct timespec *ts, s32 *time_tai)
         if (!(time_status & STA_NANO))
                 txc->time.tv_usec /= NSEC_PER_USEC;
 
-        notify_cmos_timer();
-
         return result;
 }
 
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 48b9fffabdc2..947ba25a95a0 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -1703,6 +1703,8 @@ int do_adjtimex(struct timex *txc)
         write_seqcount_end(&timekeeper_seq);
         raw_spin_unlock_irqrestore(&timekeeper_lock, flags);
 
+        ntp_notify_cmos_timer();
+
         return ret;
 }
 
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 4493913f0d5c..813db4e64602 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -168,6 +168,7 @@ static int batadv_interface_tx(struct sk_buff *skb,
         case ETH_P_8021Q:
                 vhdr = (struct vlan_ethhdr *)skb->data;
                 vid = ntohs(vhdr->h_vlan_TCI) & VLAN_VID_MASK;
+                vid |= BATADV_VLAN_HAS_TAG;
 
                 if (vhdr->h_vlan_encapsulated_proto != ethertype)
                         break;
@@ -331,6 +332,7 @@ void batadv_interface_rx(struct net_device *soft_iface,
         case ETH_P_8021Q:
                 vhdr = (struct vlan_ethhdr *)skb->data;
                 vid = ntohs(vhdr->h_vlan_TCI) & VLAN_VID_MASK;
+                vid |= BATADV_VLAN_HAS_TAG;
 
                 if (vhdr->h_vlan_encapsulated_proto != ethertype)
                         break;
diff --git a/net/bluetooth/Makefile b/net/bluetooth/Makefile
index dea6a287daca..6a791e73e39d 100644
--- a/net/bluetooth/Makefile
+++ b/net/bluetooth/Makefile
@@ -11,3 +11,5 @@ obj-$(CONFIG_BT_HIDP)	+= hidp/
 bluetooth-y := af_bluetooth.o hci_core.o hci_conn.o hci_event.o mgmt.o \
         hci_sock.o hci_sysfs.o l2cap_core.o l2cap_sock.o smp.o sco.o lib.o \
         a2mp.o amp.o
+
+subdir-ccflags-y += -D__CHECK_ENDIAN__
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 9096137c889c..e6e1278dca89 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -490,6 +490,7 @@ int bt_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 }
 EXPORT_SYMBOL(bt_sock_ioctl);
 
+/* This function expects the sk lock to be held when called */
 int bt_sock_wait_state(struct sock *sk, int state, unsigned long timeo)
 {
         DECLARE_WAITQUEUE(wait, current);
@@ -525,6 +526,46 @@ int bt_sock_wait_state(struct sock *sk, int state, unsigned long timeo)
 }
 EXPORT_SYMBOL(bt_sock_wait_state);
 
+/* This function expects the sk lock to be held when called */
+int bt_sock_wait_ready(struct sock *sk, unsigned long flags)
+{
+        DECLARE_WAITQUEUE(wait, current);
+        unsigned long timeo;
+        int err = 0;
+
+        BT_DBG("sk %p", sk);
+
+        timeo = sock_sndtimeo(sk, flags & O_NONBLOCK);
+
+        add_wait_queue(sk_sleep(sk), &wait);
+        set_current_state(TASK_INTERRUPTIBLE);
+        while (test_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags)) {
+                if (!timeo) {
+                        err = -EAGAIN;
+                        break;
+                }
+
+                if (signal_pending(current)) {
+                        err = sock_intr_errno(timeo);
+                        break;
+                }
+
+                release_sock(sk);
+                timeo = schedule_timeout(timeo);
+                lock_sock(sk);
+                set_current_state(TASK_INTERRUPTIBLE);
+
+                err = sock_error(sk);
+                if (err)
+                        break;
+        }
+        __set_current_state(TASK_RUNNING);
+        remove_wait_queue(sk_sleep(sk), &wait);
+
+        return err;
+}
+EXPORT_SYMBOL(bt_sock_wait_ready);
+
 #ifdef CONFIG_PROC_FS
 struct bt_seq_state {
         struct bt_sock_list *l;
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index f0817121ec5e..514148b7a66b 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -518,6 +518,7 @@ struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
         list_for_each_entry(d, &hci_dev_list, list) {
                 if (!test_bit(HCI_UP, &d->flags) ||
                     test_bit(HCI_RAW, &d->flags) ||
+                    test_bit(HCI_USER_CHANNEL, &d->dev_flags) ||
                     d->dev_type != HCI_BREDR)
                         continue;
 
@@ -580,6 +581,9 @@ static struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
 {
         struct hci_conn *acl;
 
+        if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
+                return ERR_PTR(-ENOTSUPP);
+
         acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
         if (!acl) {
                 acl = hci_conn_add(hdev, ACL_LINK, dst);
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 634debab4d54..82dbdc6a7e9e 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -519,6 +519,8 @@ static void hci_init2_req(struct hci_request *req, unsigned long opt)
 
         if (lmp_bredr_capable(hdev))
                 bredr_setup(req);
+        else
+                clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
 
         if (lmp_le_capable(hdev))
                 le_setup(req);
@@ -607,6 +609,34 @@ static void hci_set_le_support(struct hci_request *req)
                             &cp);
 }
 
+static void hci_set_event_mask_page_2(struct hci_request *req)
+{
+        struct hci_dev *hdev = req->hdev;
+        u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+
+        /* If Connectionless Slave Broadcast master role is supported
+         * enable all necessary events for it.
+         */
+        if (hdev->features[2][0] & 0x01) {
+                events[1] |= 0x40;      /* Triggered Clock Capture */
+                events[1] |= 0x80;      /* Synchronization Train Complete */
+                events[2] |= 0x10;      /* Slave Page Response Timeout */
+                events[2] |= 0x20;      /* CSB Channel Map Change */
+        }
+
+        /* If Connectionless Slave Broadcast slave role is supported
+         * enable all necessary events for it.
+         */
+        if (hdev->features[2][0] & 0x02) {
+                events[2] |= 0x01;      /* Synchronization Train Received */
+                events[2] |= 0x02;      /* CSB Receive */
+                events[2] |= 0x04;      /* CSB Timeout */
+                events[2] |= 0x08;      /* Truncated Page Complete */
+        }
+
+        hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2, sizeof(events), events);
+}
+
 static void hci_init3_req(struct hci_request *req, unsigned long opt)
 {
         struct hci_dev *hdev = req->hdev;
@@ -648,6 +678,19 @@ static void hci_init3_req(struct hci_request *req, unsigned long opt)
         }
 }
 
+static void hci_init4_req(struct hci_request *req, unsigned long opt)
+{
+        struct hci_dev *hdev = req->hdev;
+
+        /* Set event mask page 2 if the HCI command for it is supported */
+        if (hdev->commands[22] & 0x04)
+                hci_set_event_mask_page_2(req);
+
+        /* Check for Synchronization Train support */
+        if (hdev->features[2][0] & 0x04)
+                hci_req_add(req, HCI_OP_READ_SYNC_TRAIN_PARAMS, 0, NULL);
+}
+
 static int __hci_init(struct hci_dev *hdev)
 {
         int err;
@@ -667,7 +710,11 @@ static int __hci_init(struct hci_dev *hdev)
         if (err < 0)
                 return err;
 
-        return __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT);
+        err = __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT);
+        if (err < 0)
+                return err;
+
+        return __hci_req_sync(hdev, hci_init4_req, 0, HCI_INIT_TIMEOUT);
 }
 
 static void hci_scan_req(struct hci_request *req, unsigned long opt)
@@ -984,6 +1031,16 @@ int hci_inquiry(void __user *arg)
         if (!hdev)
                 return -ENODEV;
 
+        if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
+                err = -EBUSY;
+                goto done;
+        }
+
+        if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
+                err = -EOPNOTSUPP;
+                goto done;
+        }
+
         hci_dev_lock(hdev);
         if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
             inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
@@ -1051,14 +1108,14 @@ static u8 create_ad(struct hci_dev *hdev, u8 *ptr)
         if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags))
                 flags |= LE_AD_GENERAL;
 
-        if (!lmp_bredr_capable(hdev))
+        if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
+                if (lmp_le_br_capable(hdev))
+                        flags |= LE_AD_SIM_LE_BREDR_CTRL;
+                if (lmp_host_le_br_capable(hdev))
+                        flags |= LE_AD_SIM_LE_BREDR_HOST;
+        } else {
                 flags |= LE_AD_NO_BREDR;
-
-        if (lmp_le_br_capable(hdev))
-                flags |= LE_AD_SIM_LE_BREDR_CTRL;
-
-        if (lmp_host_le_br_capable(hdev))
-                flags |= LE_AD_SIM_LE_BREDR_HOST;
+        }
 
         if (flags) {
                 BT_DBG("adv flags 0x%02x", flags);
@@ -1126,17 +1183,10 @@ void hci_update_ad(struct hci_request *req)
         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 }
 
-/* ---- HCI ioctl helpers ---- */
-
-int hci_dev_open(__u16 dev)
+static int hci_dev_do_open(struct hci_dev *hdev)
 {
-        struct hci_dev *hdev;
         int ret = 0;
 
-        hdev = hci_dev_get(dev);
-        if (!hdev)
-                return -ENODEV;
-
         BT_DBG("%s %p", hdev->name, hdev);
 
         hci_req_lock(hdev);
@@ -1146,7 +1196,11 @@ int hci_dev_open(__u16 dev)
                 goto done;
         }
 
-        if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
+        /* Check for rfkill but allow the HCI setup stage to proceed
+         * (which in itself doesn't cause any RF activity).
+         */
+        if (test_bit(HCI_RFKILLED, &hdev->dev_flags) &&
+            !test_bit(HCI_SETUP, &hdev->dev_flags)) {
                 ret = -ERFKILL;
                 goto done;
         }
@@ -1168,16 +1222,11 @@ int hci_dev_open(__u16 dev)
                 ret = hdev->setup(hdev);
 
         if (!ret) {
-                /* Treat all non BR/EDR controllers as raw devices if
-                 * enable_hs is not set.
-                 */
-                if (hdev->dev_type != HCI_BREDR && !enable_hs)
-                        set_bit(HCI_RAW, &hdev->flags);
-
                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
                         set_bit(HCI_RAW, &hdev->flags);
 
-                if (!test_bit(HCI_RAW, &hdev->flags))
+                if (!test_bit(HCI_RAW, &hdev->flags) &&
+                    !test_bit(HCI_USER_CHANNEL, &hdev->dev_flags))
                         ret = __hci_init(hdev);
         }
 
@@ -1188,6 +1237,7 @@ int hci_dev_open(__u16 dev)
                 set_bit(HCI_UP, &hdev->flags);
                 hci_notify(hdev, HCI_DEV_UP);
                 if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
+                    !test_bit(HCI_USER_CHANNEL, &hdev->dev_flags) &&
                     mgmt_valid_hdev(hdev)) {
                         hci_dev_lock(hdev);
                         mgmt_powered(hdev, 1);
@@ -1216,10 +1266,37 @@ int hci_dev_open(__u16 dev)
 
 done:
         hci_req_unlock(hdev);
-        hci_dev_put(hdev);
         return ret;
 }
 
+/* ---- HCI ioctl helpers ---- */
+
+int hci_dev_open(__u16 dev)
+{
+        struct hci_dev *hdev;
+        int err;
+
+        hdev = hci_dev_get(dev);
+        if (!hdev)
+                return -ENODEV;
+
+        /* We need to ensure that no other power on/off work is pending
+         * before proceeding to call hci_dev_do_open. This is
+         * particularly important if the setup procedure has not yet
+         * completed.
+         */
+        if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
+                cancel_delayed_work(&hdev->power_off);
+
+        flush_workqueue(hdev->req_workqueue);
+
+        err = hci_dev_do_open(hdev);
+
+        hci_dev_put(hdev);
+
+        return err;
+}
+
 static int hci_dev_do_close(struct hci_dev *hdev)
 {
         BT_DBG("%s %p", hdev->name, hdev);
@@ -1324,11 +1401,17 @@ int hci_dev_close(__u16 dev)
         if (!hdev)
                 return -ENODEV;
 
+        if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
+                err = -EBUSY;
+                goto done;
+        }
+
         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
                 cancel_delayed_work(&hdev->power_off);
 
         err = hci_dev_do_close(hdev);
 
+done:
         hci_dev_put(hdev);
         return err;
 }
@@ -1344,8 +1427,15 @@ int hci_dev_reset(__u16 dev)
 
         hci_req_lock(hdev);
 
-        if (!test_bit(HCI_UP, &hdev->flags))
+        if (!test_bit(HCI_UP, &hdev->flags)) {
+                ret = -ENETDOWN;
+                goto done;
+        }
+
+        if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
+                ret = -EBUSY;
                 goto done;
+        }
 
         /* Drop queues */
         skb_queue_purge(&hdev->rx_q);
@@ -1380,10 +1470,15 @@ int hci_dev_reset_stat(__u16 dev)
         if (!hdev)
                 return -ENODEV;
 
+        if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
+                ret = -EBUSY;
+                goto done;
+        }
+
         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
 
+done:
         hci_dev_put(hdev);
-
         return ret;
 }
 
@@ -1400,6 +1495,16 @@ int hci_dev_cmd(unsigned int cmd, void __user *arg)
         if (!hdev)
                 return -ENODEV;
 
+        if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
+                err = -EBUSY;
+                goto done;
+        }
+
+        if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
+                err = -EOPNOTSUPP;
+                goto done;
+        }
+
         switch (cmd) {
         case HCISETAUTH:
                 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
@@ -1458,6 +1563,7 @@ int hci_dev_cmd(unsigned int cmd, void __user *arg)
                 break;
         }
 
+done:
         hci_dev_put(hdev);
         return err;
 }
@@ -1530,7 +1636,7 @@ int hci_get_dev_info(void __user *arg)
 
         strcpy(di.name, hdev->name);
         di.bdaddr   = hdev->bdaddr;
-        di.type     = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
+        di.type     = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
         di.flags    = hdev->flags;
         di.pkt_type = hdev->pkt_type;
         if (lmp_bredr_capable(hdev)) {
@@ -1566,10 +1672,16 @@ static int hci_rfkill_set_block(void *data, bool blocked)
 
         BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
 
-        if (!blocked)
-                return 0;
+        if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags))
+                return -EBUSY;
 
-        hci_dev_do_close(hdev);
+        if (blocked) {
+                set_bit(HCI_RFKILLED, &hdev->dev_flags);
+                if (!test_bit(HCI_SETUP, &hdev->dev_flags))
+                        hci_dev_do_close(hdev);
+        } else {
+                clear_bit(HCI_RFKILLED, &hdev->dev_flags);
+        }
 
         return 0;
 }
@@ -1585,15 +1697,19 @@ static void hci_power_on(struct work_struct *work)
 
         BT_DBG("%s", hdev->name);
 
-        err = hci_dev_open(hdev->id);
+        err = hci_dev_do_open(hdev);
         if (err < 0) {
                 mgmt_set_powered_failed(hdev, err);
                 return;
         }
 
-        if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
+        if (test_bit(HCI_RFKILLED, &hdev->dev_flags)) {
+                clear_bit(HCI_AUTO_OFF, &hdev->dev_flags);
+                hci_dev_do_close(hdev);
+        } else if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
                 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
                                    HCI_AUTO_OFF_TIMEOUT);
+        }
 
         if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags))
                 mgmt_index_added(hdev);
@@ -2209,10 +2325,18 @@ int hci_register_dev(struct hci_dev *hdev)
                 }
         }
 
+        if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
+                set_bit(HCI_RFKILLED, &hdev->dev_flags);
+
         set_bit(HCI_SETUP, &hdev->dev_flags);
 
-        if (hdev->dev_type != HCI_AMP)
+        if (hdev->dev_type != HCI_AMP) {
                 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
+                /* Assume BR/EDR support until proven otherwise (such as
+                 * through reading supported features during init.
+                 */
+                set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
+        }
 
         write_lock(&hci_dev_list_lock);
         list_add(&hdev->list, &hci_dev_list);
@@ -3258,15 +3382,13 @@ static void hci_tx_work(struct work_struct *work)
         BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
                hdev->sco_cnt, hdev->le_cnt);
 
-        /* Schedule queues and send stuff to HCI driver */
-
-        hci_sched_acl(hdev);
-
-        hci_sched_sco(hdev);
-
-        hci_sched_esco(hdev);
-
-        hci_sched_le(hdev);
+        if (!test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
+                /* Schedule queues and send stuff to HCI driver */
+                hci_sched_acl(hdev);
+                hci_sched_sco(hdev);
+                hci_sched_esco(hdev);
+                hci_sched_le(hdev);
+        }
 
         /* Send next queued raw (unknown type) packet */
         while ((skb = skb_dequeue(&hdev->raw_q)))
@@ -3457,7 +3579,8 @@ static void hci_rx_work(struct work_struct *work)
                         hci_send_to_sock(hdev, skb);
                 }
 
-                if (test_bit(HCI_RAW, &hdev->flags)) {
+                if (test_bit(HCI_RAW, &hdev->flags) ||
+                    test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
                         kfree_skb(skb);
                         continue;
                 }
@@ -3512,7 +3635,7 @@ static void hci_cmd_work(struct work_struct *work)
 
                 kfree_skb(hdev->sent_cmd);
 
-                hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
+                hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
                 if (hdev->sent_cmd) {
                         atomic_dec(&hdev->cmd_cnt);
                         hci_send_frame(skb);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 94aab73f89d4..4785ab0795f5 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -297,6 +297,11 @@ static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
                 goto done;
         }
 
+        /* We need to ensure that we set this back on if someone changed
+         * the scan mode through a raw HCI socket.
+         */
+        set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
+
         old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
         old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
 
@@ -994,20 +999,20 @@ static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
                 return;
 
         if (!status) {
-                if (sent->le)
+                if (sent->le) {
                         hdev->features[1][0] |= LMP_HOST_LE;
-                else
+                        set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
+                } else {
                         hdev->features[1][0] &= ~LMP_HOST_LE;
+                        clear_bit(HCI_LE_ENABLED, &hdev->dev_flags);
+                        clear_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags);
+                }
 
                 if (sent->simul)
                         hdev->features[1][0] |= LMP_HOST_LE_BREDR;
                 else
                         hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
         }
-
-        if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
-            !test_bit(HCI_INIT, &hdev->flags))
-                mgmt_le_enable_complete(hdev, sent->le, status);
 }
 
 static void hci_cc_write_remote_amp_assoc(struct hci_dev *hdev,
@@ -3557,7 +3562,11 @@ static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
         cp.handle = cpu_to_le16(conn->handle);
 
         if (ltk->authenticated)
-                conn->sec_level = BT_SECURITY_HIGH;
+                conn->pending_sec_level = BT_SECURITY_HIGH;
+        else
+                conn->pending_sec_level = BT_SECURITY_MEDIUM;
+
+        conn->enc_key_size = ltk->enc_size;
 
         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
 
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 9bd7d959e384..579886186c3a 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -66,6 +66,46 @@ static struct bt_sock_list hci_sk_list = {
         .lock = __RW_LOCK_UNLOCKED(hci_sk_list.lock)
 };
 
+static bool is_filtered_packet(struct sock *sk, struct sk_buff *skb)
+{
+        struct hci_filter *flt;
+        int flt_type, flt_event;
+
+        /* Apply filter */
+        flt = &hci_pi(sk)->filter;
+
+        if (bt_cb(skb)->pkt_type == HCI_VENDOR_PKT)
+                flt_type = 0;
+        else
+                flt_type = bt_cb(skb)->pkt_type & HCI_FLT_TYPE_BITS;
+
+        if (!test_bit(flt_type, &flt->type_mask))
+                return true;
+
+        /* Extra filter for event packets only */
+        if (bt_cb(skb)->pkt_type != HCI_EVENT_PKT)
+                return false;
+
+        flt_event = (*(__u8 *)skb->data & HCI_FLT_EVENT_BITS);
+
+        if (!hci_test_bit(flt_event, &flt->event_mask))
+                return true;
+
+        /* Check filter only when opcode is set */
+        if (!flt->opcode)
+                return false;
+
+        if (flt_event == HCI_EV_CMD_COMPLETE &&
+            flt->opcode != get_unaligned((__le16 *)(skb->data + 3)))
+                return true;
+
+        if (flt_event == HCI_EV_CMD_STATUS &&
+            flt->opcode != get_unaligned((__le16 *)(skb->data + 4)))
+                return true;
+
+        return false;
+}
+
 /* Send frame to RAW socket */
 void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
 {
@@ -77,7 +117,6 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
         read_lock(&hci_sk_list.lock);
 
         sk_for_each(sk, &hci_sk_list.head) {
-                struct hci_filter *flt;
                 struct sk_buff *nskb;
 
                 if (sk->sk_state != BT_BOUND || hci_pi(sk)->hdev != hdev)
@@ -87,31 +126,19 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
                 if (skb->sk == sk)
                         continue;
 
-                if (hci_pi(sk)->channel != HCI_CHANNEL_RAW)
-                        continue;
-
-                /* Apply filter */
-                flt = &hci_pi(sk)->filter;
-
-                if (!test_bit((bt_cb(skb)->pkt_type == HCI_VENDOR_PKT) ?
-                              0 : (bt_cb(skb)->pkt_type & HCI_FLT_TYPE_BITS),
-                              &flt->type_mask))
-                        continue;
-
-                if (bt_cb(skb)->pkt_type == HCI_EVENT_PKT) {
-                        int evt = (*(__u8 *)skb->data & HCI_FLT_EVENT_BITS);
-
-                        if (!hci_test_bit(evt, &flt->event_mask))
+                if (hci_pi(sk)->channel == HCI_CHANNEL_RAW) {
+                        if (is_filtered_packet(sk, skb))
                                 continue;
-
-                        if (flt->opcode &&
-                            ((evt == HCI_EV_CMD_COMPLETE &&
-                              flt->opcode !=
-                              get_unaligned((__le16 *)(skb->data + 3))) ||
-                             (evt == HCI_EV_CMD_STATUS &&
-                              flt->opcode !=
-                              get_unaligned((__le16 *)(skb->data + 4)))))
+                } else if (hci_pi(sk)->channel == HCI_CHANNEL_USER) {
+                        if (!bt_cb(skb)->incoming)
+                                continue;
+                        if (bt_cb(skb)->pkt_type != HCI_EVENT_PKT &&
+                            bt_cb(skb)->pkt_type != HCI_ACLDATA_PKT &&
+                            bt_cb(skb)->pkt_type != HCI_SCODATA_PKT)
                                 continue;
+                } else {
+                        /* Don't send frame to other channel types */
+                        continue;
                 }
 
                 if (!skb_copy) {
@@ -426,6 +453,12 @@ static int hci_sock_release(struct socket *sock)
         bt_sock_unlink(&hci_sk_list, sk);
 
         if (hdev) {
+                if (hci_pi(sk)->channel == HCI_CHANNEL_USER) {
+                        mgmt_index_added(hdev);
+                        clear_bit(HCI_USER_CHANNEL, &hdev->dev_flags);
+                        hci_dev_close(hdev->id);
+                }
+
                 atomic_dec(&hdev->promisc);
                 hci_dev_put(hdev);
         }
@@ -482,6 +515,9 @@ static int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd,
         if (!hdev)
                 return -EBADFD;
 
+        if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags))
+                return -EBUSY;
+
         switch (cmd) {
         case HCISETRAW:
                 if (!capable(CAP_NET_ADMIN))
@@ -512,23 +548,32 @@ static int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd,
                 if (!capable(CAP_NET_ADMIN))
                         return -EPERM;
                 return hci_sock_blacklist_del(hdev, (void __user *) arg);
-
-        default:
-                if (hdev->ioctl)
-                        return hdev->ioctl(hdev, cmd, arg);
-                return -EINVAL;
         }
+
+        if (hdev->ioctl)
+                return hdev->ioctl(hdev, cmd, arg);
+
+        return -EINVAL;
 }
 
 static int hci_sock_ioctl(struct socket *sock, unsigned int cmd,
                           unsigned long arg)
 {
-        struct sock *sk = sock->sk;
         void __user *argp = (void __user *) arg;
+        struct sock *sk = sock->sk;
         int err;
 
         BT_DBG("cmd %x arg %lx", cmd, arg);
 
+        lock_sock(sk);
+
+        if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) {
+                err = -EBADFD;
+                goto done;
+        }
+
+        release_sock(sk);
+
         switch (cmd) {
         case HCIGETDEVLIST:
                 return hci_get_dev_list(argp);
@@ -573,13 +618,15 @@ static int hci_sock_ioctl(struct socket *sock, unsigned int cmd,
 
         case HCIINQUIRY:
                 return hci_inquiry(argp);
-
-        default:
-                lock_sock(sk);
-                err = hci_sock_bound_ioctl(sk, cmd, arg);
-                release_sock(sk);
-                return err;
         }
+
+        lock_sock(sk);
+
+        err = hci_sock_bound_ioctl(sk, cmd, arg);
+
+done:
+        release_sock(sk);
+        return err;
 }
 
 static int hci_sock_bind(struct socket *sock, struct sockaddr *addr,
@@ -629,6 +676,56 @@ static int hci_sock_bind(struct socket *sock, struct sockaddr *addr,
                 hci_pi(sk)->hdev = hdev;
                 break;
 
+        case HCI_CHANNEL_USER:
+                if (hci_pi(sk)->hdev) {
+                        err = -EALREADY;
+                        goto done;
+                }
+
+                if (haddr.hci_dev == HCI_DEV_NONE) {
+                        err = -EINVAL;
+                        goto done;
+                }
+
+                if (!capable(CAP_NET_ADMIN)) {
+                        err = -EPERM;
+                        goto done;
+                }
+
+                hdev = hci_dev_get(haddr.hci_dev);
+                if (!hdev) {
+                        err = -ENODEV;
+                        goto done;
+                }
+
+                if (test_bit(HCI_UP, &hdev->flags) ||
+                    test_bit(HCI_INIT, &hdev->flags) ||
+                    test_bit(HCI_SETUP, &hdev->dev_flags)) {
+                        err = -EBUSY;
+                        hci_dev_put(hdev);
+                        goto done;
+                }
+
+                if (test_and_set_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
+                        err = -EUSERS;
+                        hci_dev_put(hdev);
+                        goto done;
+                }
+
+                mgmt_index_removed(hdev);
+
+                err = hci_dev_open(hdev->id);
+                if (err) {
+                        clear_bit(HCI_USER_CHANNEL, &hdev->dev_flags);
+                        hci_dev_put(hdev);
+                        goto done;
+                }
+
+                atomic_inc(&hdev->promisc);
+
+                hci_pi(sk)->hdev = hdev;
+                break;
+
         case HCI_CHANNEL_CONTROL:
                 if (haddr.hci_dev != HCI_DEV_NONE) {
                         err = -EINVAL;
@@ -677,22 +774,30 @@ static int hci_sock_getname(struct socket *sock, struct sockaddr *addr,
 {
         struct sockaddr_hci *haddr = (struct sockaddr_hci *) addr;
         struct sock *sk = sock->sk;
-        struct hci_dev *hdev = hci_pi(sk)->hdev;
+        struct hci_dev *hdev;
+        int err = 0;
 
         BT_DBG("sock %p sk %p", sock, sk);
 
-        if (!hdev)
-                return -EBADFD;
+        if (peer)
+                return -EOPNOTSUPP;
 
         lock_sock(sk);
 
+        hdev = hci_pi(sk)->hdev;
+        if (!hdev) {
+                err = -EBADFD;
+                goto done;
+        }
+
         *addr_len = sizeof(*haddr);
         haddr->hci_family = AF_BLUETOOTH;
         haddr->hci_dev    = hdev->id;
-        haddr->hci_channel= 0;
+        haddr->hci_channel= hci_pi(sk)->channel;
 
+done:
         release_sock(sk);
-        return 0;
+        return err;
 }
 
 static void hci_sock_cmsg(struct sock *sk, struct msghdr *msg,
@@ -767,6 +872,7 @@ static int hci_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
         case HCI_CHANNEL_RAW:
                 hci_sock_cmsg(sk, msg, skb);
                 break;
+        case HCI_CHANNEL_USER:
         case HCI_CHANNEL_CONTROL:
         case HCI_CHANNEL_MONITOR:
                 sock_recv_timestamp(msg, sk, skb);
@@ -801,6 +907,7 @@ static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         switch (hci_pi(sk)->channel) {
         case HCI_CHANNEL_RAW:
+        case HCI_CHANNEL_USER:
                 break;
         case HCI_CHANNEL_CONTROL:
                 err = mgmt_control(sk, msg, len);
@@ -837,7 +944,8 @@ static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
         skb_pull(skb, 1);
         skb->dev = (void *) hdev;
 
-        if (bt_cb(skb)->pkt_type == HCI_COMMAND_PKT) {
+        if (hci_pi(sk)->channel == HCI_CHANNEL_RAW &&
+            bt_cb(skb)->pkt_type == HCI_COMMAND_PKT) {
                 u16 opcode = get_unaligned_le16(skb->data);
                 u16 ogf = hci_opcode_ogf(opcode);
                 u16 ocf = hci_opcode_ocf(opcode);
@@ -868,6 +976,14 @@ static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                         goto drop;
                 }
 
+                if (hci_pi(sk)->channel == HCI_CHANNEL_USER &&
+                    bt_cb(skb)->pkt_type != HCI_COMMAND_PKT &&
+                    bt_cb(skb)->pkt_type != HCI_ACLDATA_PKT &&
+                    bt_cb(skb)->pkt_type != HCI_SCODATA_PKT) {
+                        err = -EINVAL;
+                        goto drop;
+                }
+
                 skb_queue_tail(&hdev->raw_q, skb);
                 queue_work(hdev->workqueue, &hdev->tx_work);
         }
@@ -895,7 +1011,7 @@ static int hci_sock_setsockopt(struct socket *sock, int level, int optname,
         lock_sock(sk);
 
         if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) {
-                err = -EINVAL;
+                err = -EBADFD;
                 goto done;
         }
 
@@ -981,7 +1097,7 @@ static int hci_sock_getsockopt(struct socket *sock, int level, int optname,
         lock_sock(sk);
 
         if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) {
-                err = -EINVAL;
+                err = -EBADFD;
                 goto done;
         }
 
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index b3bb7bca8e60..02dba4e6df96 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1016,13 +1016,12 @@ static bool __amp_capable(struct l2cap_chan *chan)
 {
         struct l2cap_conn *conn = chan->conn;
 
-        if (enable_hs &&
-            hci_amp_capable() &&
+        if (conn->hs_enabled && hci_amp_capable() &&
             chan->chan_policy == BT_CHANNEL_POLICY_AMP_PREFERRED &&
             conn->fixed_chan_mask & L2CAP_FC_A2MP)
                 return true;
-        else
-                return false;
+
+        return false;
 }
 
 static bool l2cap_check_efs(struct l2cap_chan *chan)
@@ -1638,6 +1637,10 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon)
 
         conn->feat_mask = 0;
 
+        if (hcon->type == ACL_LINK)
+                conn->hs_enabled = test_bit(HCI_HS_ENABLED,
+                                            &hcon->hdev->dev_flags);
+
         spin_lock_init(&conn->lock);
         mutex_init(&conn->chan_lock);
 
@@ -3084,14 +3087,14 @@ static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
         }
 }
 
-static inline bool __l2cap_ews_supported(struct l2cap_chan *chan)
+static inline bool __l2cap_ews_supported(struct l2cap_conn *conn)
 {
-        return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_WINDOW;
+        return conn->hs_enabled && conn->feat_mask & L2CAP_FEAT_EXT_WINDOW;
 }
 
-static inline bool __l2cap_efs_supported(struct l2cap_chan *chan)
+static inline bool __l2cap_efs_supported(struct l2cap_conn *conn)
 {
-        return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_FLOW;
+        return conn->hs_enabled && conn->feat_mask & L2CAP_FEAT_EXT_FLOW;
 }
 
 static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,
@@ -3135,7 +3138,7 @@ static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,
 static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
 {
         if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&
-            __l2cap_ews_supported(chan)) {
+            __l2cap_ews_supported(chan->conn)) {
                 /* use extended control field */
                 set_bit(FLAG_EXT_CTRL, &chan->flags);
                 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
@@ -3165,7 +3168,7 @@ static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)
                 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))
                         break;
 
-                if (__l2cap_efs_supported(chan))
+                if (__l2cap_efs_supported(chan->conn))
                         set_bit(FLAG_EFS_ENABLE, &chan->flags);
 
                 /* fall through */
@@ -3317,7 +3320,7 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)
                         break;
 
                 case L2CAP_CONF_EWS:
-                        if (!enable_hs)
+                        if (!chan->conn->hs_enabled)
                                 return -ECONNREFUSED;
 
                         set_bit(FLAG_EXT_CTRL, &chan->flags);
@@ -3349,7 +3352,7 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)
                 }
 
                 if (remote_efs) {
-                        if (__l2cap_efs_supported(chan))
+                        if (__l2cap_efs_supported(chan->conn))
                                 set_bit(FLAG_EFS_ENABLE, &chan->flags);
                         else
                                 return -ECONNREFUSED;
@@ -3755,6 +3758,13 @@ static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
 
         sk = chan->sk;
 
+        /* For certain devices (ex: HID mouse), support for authentication,
+         * pairing and bonding is optional. For such devices, inorder to avoid
+         * the ACL alive for too long after L2CAP disconnection, reset the ACL
+         * disc_timeout back to HCI_DISCONN_TIMEOUT during L2CAP connect.
+         */
+        conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
+
         bacpy(&bt_sk(sk)->src, conn->src);
         bacpy(&bt_sk(sk)->dst, conn->dst);
         chan->psm  = psm;
@@ -3884,13 +3894,13 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
         if (scid) {
                 chan = __l2cap_get_chan_by_scid(conn, scid);
                 if (!chan) {
-                        err = -EFAULT;
+                        err = -EBADSLT;
                         goto unlock;
                 }
         } else {
                 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
                 if (!chan) {
-                        err = -EFAULT;
+                        err = -EBADSLT;
                         goto unlock;
                 }
         }
@@ -3978,7 +3988,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn,
 
         chan = l2cap_get_chan_by_scid(conn, dcid);
         if (!chan)
-                return -ENOENT;
+                return -EBADSLT;
 
         if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) {
                 struct l2cap_cmd_rej_cid rej;
@@ -4206,7 +4216,7 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
         chan = __l2cap_get_chan_by_scid(conn, dcid);
         if (!chan) {
                 mutex_unlock(&conn->chan_lock);
-                return 0;
+                return -EBADSLT;
         }
 
         l2cap_chan_lock(chan);
@@ -4296,7 +4306,7 @@ static inline int l2cap_information_req(struct l2cap_conn *conn,
                 if (!disable_ertm)
                         feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
                                 | L2CAP_FEAT_FCS;
-                if (enable_hs)
+                if (conn->hs_enabled)
                         feat_mask |= L2CAP_FEAT_EXT_FLOW
                                 | L2CAP_FEAT_EXT_WINDOW;
 
@@ -4307,7 +4317,7 @@ static inline int l2cap_information_req(struct l2cap_conn *conn,
                 u8 buf[12];
                 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
 
-                if (enable_hs)
+                if (conn->hs_enabled)
                         l2cap_fixed_chan[0] |= L2CAP_FC_A2MP;
                 else
                         l2cap_fixed_chan[0] &= ~L2CAP_FC_A2MP;
@@ -4404,7 +4414,7 @@ static int l2cap_create_channel_req(struct l2cap_conn *conn,
         if (cmd_len != sizeof(*req))
                 return -EPROTO;
 
-        if (!enable_hs)
+        if (!conn->hs_enabled)
                 return -EINVAL;
 
         psm = le16_to_cpu(req->psm);
@@ -4438,7 +4448,7 @@ static int l2cap_create_channel_req(struct l2cap_conn *conn,
                 hs_hcon = hci_conn_hash_lookup_ba(hdev, AMP_LINK, conn->dst);
                 if (!hs_hcon) {
                         hci_dev_put(hdev);
-                        return -EFAULT;
+                        return -EBADSLT;
                 }
 
                 BT_DBG("mgr %p bredr_chan %p hs_hcon %p", mgr, chan, hs_hcon);
@@ -4462,7 +4472,7 @@ error:
         l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP,
                        sizeof(rsp), &rsp);
 
-        return -EFAULT;
+        return 0;
 }
 
 static void l2cap_send_move_chan_req(struct l2cap_chan *chan, u8 dest_amp_id)
@@ -4831,7 +4841,7 @@ static inline int l2cap_move_channel_req(struct l2cap_conn *conn,
 
         BT_DBG("icid 0x%4.4x, dest_amp_id %d", icid, req->dest_amp_id);
 
-        if (!enable_hs)
+        if (!conn->hs_enabled)
                 return -EINVAL;
 
         chan = l2cap_get_chan_by_dcid(conn, icid);
@@ -5212,7 +5222,7 @@ static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
 
         case L2CAP_CONN_RSP:
         case L2CAP_CREATE_CHAN_RSP:
-                err = l2cap_connect_create_rsp(conn, cmd, cmd_len, data);
+                l2cap_connect_create_rsp(conn, cmd, cmd_len, data);
                 break;
 
         case L2CAP_CONF_REQ:
@@ -5220,7 +5230,7 @@ static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
                 break;
 
         case L2CAP_CONF_RSP:
-                err = l2cap_config_rsp(conn, cmd, cmd_len, data);
+                l2cap_config_rsp(conn, cmd, cmd_len, data);
                 break;
 
         case L2CAP_DISCONN_REQ:
@@ -5228,7 +5238,7 @@ static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
                 break;
 
         case L2CAP_DISCONN_RSP:
-                err = l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
+                l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
                 break;
 
         case L2CAP_ECHO_REQ:
@@ -5243,7 +5253,7 @@ static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
                 break;
 
         case L2CAP_INFO_RSP:
-                err = l2cap_information_rsp(conn, cmd, cmd_len, data);
+                l2cap_information_rsp(conn, cmd, cmd_len, data);
                 break;
 
         case L2CAP_CREATE_CHAN_REQ:
@@ -5255,7 +5265,7 @@ static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
                 break;
 
         case L2CAP_MOVE_CHAN_RSP:
-                err = l2cap_move_channel_rsp(conn, cmd, cmd_len, data);
+                l2cap_move_channel_rsp(conn, cmd, cmd_len, data);
                 break;
 
         case L2CAP_MOVE_CHAN_CFM:
@@ -5263,7 +5273,7 @@ static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
                 break;
 
         case L2CAP_MOVE_CHAN_CFM_RSP:
-                err = l2cap_move_channel_confirm_rsp(conn, cmd, cmd_len, data);
+                l2cap_move_channel_confirm_rsp(conn, cmd, cmd_len, data);
                 break;
 
         default:
@@ -5294,54 +5304,65 @@ static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
         }
 }
 
+static __le16 l2cap_err_to_reason(int err)
+{
+        switch (err) {
+        case -EBADSLT:
+                return __constant_cpu_to_le16(L2CAP_REJ_INVALID_CID);
+        case -EMSGSIZE:
+                return __constant_cpu_to_le16(L2CAP_REJ_MTU_EXCEEDED);
+        case -EINVAL:
+        case -EPROTO:
+        default:
+                return __constant_cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
+        }
+}
+
 static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
                                         struct sk_buff *skb)
 {
-        u8 *data = skb->data;
-        int len = skb->len;
-        struct l2cap_cmd_hdr cmd;
+        struct hci_conn *hcon = conn->hcon;
+        struct l2cap_cmd_hdr *cmd;
+        u16 len;
         int err;
 
-        l2cap_raw_recv(conn, skb);
+        if (hcon->type != LE_LINK)
+                goto drop;
 
-        while (len >= L2CAP_CMD_HDR_SIZE) {
-                u16 cmd_len;
-                memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
-                data += L2CAP_CMD_HDR_SIZE;
-                len  -= L2CAP_CMD_HDR_SIZE;
+        if (skb->len < L2CAP_CMD_HDR_SIZE)
+                goto drop;
 
-                cmd_len = le16_to_cpu(cmd.len);
+        cmd = (void *) skb->data;
+        skb_pull(skb, L2CAP_CMD_HDR_SIZE);
 
-                BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len,
-                       cmd.ident);
+        len = le16_to_cpu(cmd->len);
 
-                if (cmd_len > len || !cmd.ident) {
-                        BT_DBG("corrupted command");
-                        break;
-                }
+        BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, cmd->ident);
 
-                err = l2cap_le_sig_cmd(conn, &cmd, data);
-                if (err) {
-                        struct l2cap_cmd_rej_unk rej;
+        if (len != skb->len || !cmd->ident) {
+                BT_DBG("corrupted command");
+                goto drop;
+        }
 
-                        BT_ERR("Wrong link type (%d)", err);
+        err = l2cap_le_sig_cmd(conn, cmd, skb->data);
+        if (err) {
+                struct l2cap_cmd_rej_unk rej;
 
-                        /* FIXME: Map err to a valid reason */
-                        rej.reason = __constant_cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
-                        l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ,
-                                       sizeof(rej), &rej);
-                }
+                BT_ERR("Wrong link type (%d)", err);
 
-                data += cmd_len;
-                len  -= cmd_len;
+                rej.reason = l2cap_err_to_reason(err);
+                l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
+                               sizeof(rej), &rej);
         }
 
+drop:
         kfree_skb(skb);
 }
 
 static inline void l2cap_sig_channel(struct l2cap_conn *conn,
                                      struct sk_buff *skb)
 {
+        struct hci_conn *hcon = conn->hcon;
         u8 *data = skb->data;
         int len = skb->len;
         struct l2cap_cmd_hdr cmd;
@@ -5349,6 +5370,9 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn,
 
         l2cap_raw_recv(conn, skb);
 
+        if (hcon->type != ACL_LINK)
+                goto drop;
+
         while (len >= L2CAP_CMD_HDR_SIZE) {
                 u16 cmd_len;
                 memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
@@ -5371,8 +5395,7 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn,
 
                         BT_ERR("Wrong link type (%d)", err);
 
-                        /* FIXME: Map err to a valid reason */
-                        rej.reason = __constant_cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
+                        rej.reason = l2cap_err_to_reason(err);
                         l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ,
                                        sizeof(rej), &rej);
                 }
@@ -5381,6 +5404,7 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn,
                 len  -= cmd_len;
         }
 
+drop:
         kfree_skb(skb);
 }
 
@@ -5777,7 +5801,7 @@ static int l2cap_rx_state_recv(struct l2cap_chan *chan,
                                struct sk_buff *skb, u8 event)
 {
         int err = 0;
-        bool skb_in_use = 0;
+        bool skb_in_use = false;
 
         BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
                event);
@@ -5798,7 +5822,7 @@ static int l2cap_rx_state_recv(struct l2cap_chan *chan,
                                                            control->txseq);
 
                         chan->buffer_seq = chan->expected_tx_seq;
-                        skb_in_use = 1;
+                        skb_in_use = true;
 
                         err = l2cap_reassemble_sdu(chan, skb, control);
                         if (err)
@@ -5834,7 +5858,7 @@ static int l2cap_rx_state_recv(struct l2cap_chan *chan,
                          * current frame is stored for later use.
                          */
                         skb_queue_tail(&chan->srej_q, skb);
-                        skb_in_use = 1;
+                        skb_in_use = true;
                         BT_DBG("Queued %p (queue len %d)", skb,
                                skb_queue_len(&chan->srej_q));
 
@@ -5912,7 +5936,7 @@ static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,
 {
         int err = 0;
         u16 txseq = control->txseq;
-        bool skb_in_use = 0;
+        bool skb_in_use = false;
 
         BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
                event);
@@ -5924,7 +5948,7 @@ static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,
                         /* Keep frame for reassembly later */
                         l2cap_pass_to_tx(chan, control);
                         skb_queue_tail(&chan->srej_q, skb);
-                        skb_in_use = 1;
+                        skb_in_use = true;
                         BT_DBG("Queued %p (queue len %d)", skb,
                                skb_queue_len(&chan->srej_q));
 
@@ -5935,7 +5959,7 @@ static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,
 
                         l2cap_pass_to_tx(chan, control);
                         skb_queue_tail(&chan->srej_q, skb);
-                        skb_in_use = 1;
+                        skb_in_use = true;
                         BT_DBG("Queued %p (queue len %d)", skb,
                                skb_queue_len(&chan->srej_q));
 
@@ -5950,7 +5974,7 @@ static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,
                          * the missing frames.
                          */
                         skb_queue_tail(&chan->srej_q, skb);
-                        skb_in_use = 1;
+                        skb_in_use = true;
                         BT_DBG("Queued %p (queue len %d)", skb,
                                skb_queue_len(&chan->srej_q));
 
@@ -5964,7 +5988,7 @@ static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,
                          * SREJ'd frames.
                          */
                         skb_queue_tail(&chan->srej_q, skb);
-                        skb_in_use = 1;
+                        skb_in_use = true;
                         BT_DBG("Queued %p (queue len %d)", skb,
                                skb_queue_len(&chan->srej_q));
 
@@ -6373,8 +6397,12 @@ done:
 static void l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm,
                                   struct sk_buff *skb)
 {
+        struct hci_conn *hcon = conn->hcon;
         struct l2cap_chan *chan;
 
+        if (hcon->type != ACL_LINK)
+                goto drop;
+
         chan = l2cap_global_chan_by_psm(0, psm, conn->src, conn->dst);
         if (!chan)
                 goto drop;
@@ -6397,8 +6425,12 @@ drop:
 static void l2cap_att_channel(struct l2cap_conn *conn,
                               struct sk_buff *skb)
 {
+        struct hci_conn *hcon = conn->hcon;
         struct l2cap_chan *chan;
 
+        if (hcon->type != LE_LINK)
+                goto drop;
+
         chan = l2cap_global_chan_by_scid(BT_CONNECTED, L2CAP_CID_ATT,
                                          conn->src, conn->dst);
         if (!chan)
@@ -6434,9 +6466,6 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
         BT_DBG("len %d, cid 0x%4.4x", len, cid);
 
         switch (cid) {
-        case L2CAP_CID_LE_SIGNALING:
-                l2cap_le_sig_channel(conn, skb);
-                break;
         case L2CAP_CID_SIGNALING:
                 l2cap_sig_channel(conn, skb);
                 break;
@@ -6451,6 +6480,10 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
                 l2cap_att_channel(conn, skb);
                 break;
 
+        case L2CAP_CID_LE_SIGNALING:
+                l2cap_le_sig_channel(conn, skb);
+                break;
+
         case L2CAP_CID_SMP:
                 if (smp_sig_channel(conn, skb))
                         l2cap_conn_del(conn->hcon, EACCES);
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 0098af80b213..9119898ef040 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -445,11 +445,6 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
                 break;
 
         case BT_CHANNEL_POLICY:
-                if (!enable_hs) {
-                        err = -ENOPROTOOPT;
-                        break;
-                }
-
                 if (put_user(chan->chan_policy, (u32 __user *) optval))
                         err = -EFAULT;
                 break;
@@ -720,11 +715,6 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
                 break;
 
         case BT_CHANNEL_POLICY:
-                if (!enable_hs) {
-                        err = -ENOPROTOOPT;
-                        break;
-                }
-
                 if (get_user(opt, (u32 __user *) optval)) {
                         err = -EFAULT;
                         break;
@@ -777,6 +767,12 @@ static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
         if (sk->sk_state != BT_CONNECTED)
                 return -ENOTCONN;
 
+        lock_sock(sk);
+        err = bt_sock_wait_ready(sk, msg->msg_flags);
+        release_sock(sk);
+        if (err)
+                return err;
+
         l2cap_chan_lock(chan);
         err = l2cap_chan_send(chan, msg, len, sk->sk_priority);
         l2cap_chan_unlock(chan);
@@ -799,8 +795,8 @@ static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                 pi->chan->state = BT_CONFIG;
 
                 __l2cap_connect_rsp_defer(pi->chan);
-                release_sock(sk);
-                return 0;
+                err = 0;
+                goto done;
         }
 
         release_sock(sk);
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index fedc5399d465..16125ff918f1 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -32,10 +32,8 @@
 #include <net/bluetooth/mgmt.h>
 #include <net/bluetooth/smp.h>
 
-bool enable_hs;
-
 #define MGMT_VERSION    1
-#define MGMT_REVISION   3
+#define MGMT_REVISION   4
 
 static const u16 mgmt_commands[] = {
         MGMT_OP_READ_INDEX_LIST,
@@ -76,6 +74,9 @@ static const u16 mgmt_commands[] = {
         MGMT_OP_BLOCK_DEVICE,
         MGMT_OP_UNBLOCK_DEVICE,
         MGMT_OP_SET_DEVICE_ID,
+        MGMT_OP_SET_ADVERTISING,
+        MGMT_OP_SET_BREDR,
+        MGMT_OP_SET_STATIC_ADDRESS,
 };
 
 static const u16 mgmt_events[] = {
@@ -339,6 +340,9 @@ static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
                 if (test_bit(HCI_SETUP, &d->dev_flags))
                         continue;
 
+                if (test_bit(HCI_USER_CHANNEL, &d->dev_flags))
+                        continue;
+
                 if (!mgmt_valid_hdev(d))
                         continue;
 
@@ -376,13 +380,13 @@ static u32 get_supported_settings(struct hci_dev *hdev)
                 settings |= MGMT_SETTING_DISCOVERABLE;
                 settings |= MGMT_SETTING_BREDR;
                 settings |= MGMT_SETTING_LINK_SECURITY;
-        }
-
-        if (enable_hs)
                 settings |= MGMT_SETTING_HS;
+        }
 
-        if (lmp_le_capable(hdev))
+        if (lmp_le_capable(hdev)) {
                 settings |= MGMT_SETTING_LE;
+                settings |= MGMT_SETTING_ADVERTISING;
+        }
 
         return settings;
 }
@@ -406,7 +410,7 @@ static u32 get_current_settings(struct hci_dev *hdev)
         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
                 settings |= MGMT_SETTING_PAIRABLE;
 
-        if (lmp_bredr_capable(hdev))
+        if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
                 settings |= MGMT_SETTING_BREDR;
 
         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
@@ -421,6 +425,9 @@ static u32 get_current_settings(struct hci_dev *hdev)
         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
                 settings |= MGMT_SETTING_HS;
 
+        if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags))
+                settings |= MGMT_SETTING_ADVERTISING;
+
         return settings;
 }
 
@@ -804,6 +811,12 @@ static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 
         hci_dev_lock(hdev);
 
+        if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
+                                 MGMT_STATUS_BUSY);
+                goto failed;
+        }
+
         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
                 cancel_delayed_work(&hdev->power_off);
 
@@ -820,12 +833,6 @@ static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
                 goto failed;
         }
 
-        if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
-                err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
-                                 MGMT_STATUS_BUSY);
-                goto failed;
-        }
-
         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
         if (!cmd) {
                 err = -ENOMEM;
@@ -883,20 +890,71 @@ static int new_settings(struct hci_dev *hdev, struct sock *skip)
         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 }
 
+struct cmd_lookup {
+        struct sock *sk;
+        struct hci_dev *hdev;
+        u8 mgmt_status;
+};
+
+static void settings_rsp(struct pending_cmd *cmd, void *data)
+{
+        struct cmd_lookup *match = data;
+
+        send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
+
+        list_del(&cmd->list);
+
+        if (match->sk == NULL) {
+                match->sk = cmd->sk;
+                sock_hold(match->sk);
+        }
+
+        mgmt_pending_free(cmd);
+}
+
+static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
+{
+        u8 *status = data;
+
+        cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
+        mgmt_pending_remove(cmd);
+}
+
+static u8 mgmt_bredr_support(struct hci_dev *hdev)
+{
+        if (!lmp_bredr_capable(hdev))
+                return MGMT_STATUS_NOT_SUPPORTED;
+        else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
+                return MGMT_STATUS_REJECTED;
+        else
+                return MGMT_STATUS_SUCCESS;
+}
+
+static u8 mgmt_le_support(struct hci_dev *hdev)
+{
+        if (!lmp_le_capable(hdev))
+                return MGMT_STATUS_NOT_SUPPORTED;
+        else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
+                return MGMT_STATUS_REJECTED;
+        else
+                return MGMT_STATUS_SUCCESS;
+}
+
 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
                             u16 len)
 {
         struct mgmt_cp_set_discoverable *cp = data;
         struct pending_cmd *cmd;
         u16 timeout;
-        u8 scan;
+        u8 scan, status;
         int err;
 
         BT_DBG("request for %s", hdev->name);
 
-        if (!lmp_bredr_capable(hdev))
+        status = mgmt_bredr_support(hdev);
+        if (status)
                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
-                                 MGMT_STATUS_NOT_SUPPORTED);
+                                  status);
 
         if (cp->val != 0x00 && cp->val != 0x01)
                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
@@ -1045,14 +1103,15 @@ static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
         struct mgmt_mode *cp = data;
         struct pending_cmd *cmd;
         struct hci_request req;
-        u8 scan;
+        u8 scan, status;
         int err;
 
         BT_DBG("request for %s", hdev->name);
 
-        if (!lmp_bredr_capable(hdev))
+        status = mgmt_bredr_support(hdev);
+        if (status)
                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
-                                  MGMT_STATUS_NOT_SUPPORTED);
+                                  status);
 
         if (cp->val != 0x00 && cp->val != 0x01)
                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
@@ -1168,14 +1227,15 @@ static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
 {
         struct mgmt_mode *cp = data;
         struct pending_cmd *cmd;
-        u8 val;
+        u8 val, status;
         int err;
 
         BT_DBG("request for %s", hdev->name);
 
-        if (!lmp_bredr_capable(hdev))
+        status = mgmt_bredr_support(hdev);
+        if (status)
                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
-                                  MGMT_STATUS_NOT_SUPPORTED);
+                                  status);
 
         if (cp->val != 0x00 && cp->val != 0x01)
                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
@@ -1236,11 +1296,15 @@ static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
 {
         struct mgmt_mode *cp = data;
         struct pending_cmd *cmd;
-        u8 val;
+        u8 val, status;
         int err;
 
         BT_DBG("request for %s", hdev->name);
 
+        status = mgmt_bredr_support(hdev);
+        if (status)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
+
         if (!lmp_ssp_capable(hdev))
                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
                                   MGMT_STATUS_NOT_SUPPORTED);
@@ -1302,23 +1366,64 @@ failed:
 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
 {
         struct mgmt_mode *cp = data;
+        bool changed;
+        u8 status;
+        int err;
 
         BT_DBG("request for %s", hdev->name);
 
-        if (!enable_hs)
-                return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
-                                  MGMT_STATUS_NOT_SUPPORTED);
+        status = mgmt_bredr_support(hdev);
+        if (status)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
 
         if (cp->val != 0x00 && cp->val != 0x01)
                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
                                   MGMT_STATUS_INVALID_PARAMS);
 
-        if (cp->val)
-                set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
-        else
-                clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
+        hci_dev_lock(hdev);
+
+        if (cp->val) {
+                changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
+        } else {
+                if (hdev_is_powered(hdev)) {
+                        err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
+                                         MGMT_STATUS_REJECTED);
+                        goto unlock;
+                }
+
+                changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
+        }
+
+        err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
+        if (err < 0)
+                goto unlock;
+
+        if (changed)
+                err = new_settings(hdev, sk);
+
+unlock:
+        hci_dev_unlock(hdev);
+        return err;
+}
+
+static void le_enable_complete(struct hci_dev *hdev, u8 status)
+{
+        struct cmd_lookup match = { NULL, hdev };
 
-        return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
+        if (status) {
+                u8 mgmt_err = mgmt_status(status);
+
+                mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
+                                     &mgmt_err);
+                return;
+        }
+
+        mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
+
+        new_settings(hdev, match.sk);
+
+        if (match.sk)
+                sock_put(match.sk);
 }
 
 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
@@ -1326,6 +1431,7 @@ static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
         struct mgmt_mode *cp = data;
         struct hci_cp_write_le_host_supported hci_cp;
         struct pending_cmd *cmd;
+        struct hci_request req;
         int err;
         u8 val, enabled;
 
@@ -1340,7 +1446,7 @@ static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
                                   MGMT_STATUS_INVALID_PARAMS);
 
         /* LE-only devices do not allow toggling LE on/off */
-        if (!lmp_bredr_capable(hdev))
+        if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
                                   MGMT_STATUS_REJECTED);
 
@@ -1357,6 +1463,11 @@ static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
                         changed = true;
                 }
 
+                if (!val && test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags)) {
+                        clear_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags);
+                        changed = true;
+                }
+
                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
                 if (err < 0)
                         goto unlock;
@@ -1367,7 +1478,8 @@ static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
                 goto unlock;
         }
 
-        if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
+        if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
+            mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
                                  MGMT_STATUS_BUSY);
                 goto unlock;
@@ -1386,8 +1498,15 @@ static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
                 hci_cp.simul = lmp_le_br_capable(hdev);
         }
 
-        err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
-                           &hci_cp);
+        hci_req_init(&req, hdev);
+
+        if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags) && !val)
+                hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(val), &val);
+
+        hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
+                    &hci_cp);
+
+        err = hci_req_run(&req, le_enable_complete);
         if (err < 0)
                 mgmt_pending_remove(cmd);
 
@@ -1706,6 +1825,12 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
         u16 key_count, expected_len;
         int i;
 
+        BT_DBG("request for %s", hdev->name);
+
+        if (!lmp_bredr_capable(hdev))
+                return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
+                                  MGMT_STATUS_NOT_SUPPORTED);
+
         key_count = __le16_to_cpu(cp->key_count);
 
         expected_len = sizeof(*cp) + key_count *
@@ -2685,6 +2810,7 @@ static int start_discovery(struct sock *sk, struct hci_dev *hdev,
         struct hci_request req;
         /* General inquiry access code (GIAC) */
         u8 lap[3] = { 0x33, 0x8b, 0x9e };
+        u8 status;
         int err;
 
         BT_DBG("%s", hdev->name);
@@ -2721,9 +2847,10 @@ static int start_discovery(struct sock *sk, struct hci_dev *hdev,
 
         switch (hdev->discovery.type) {
         case DISCOV_TYPE_BREDR:
-                if (!lmp_bredr_capable(hdev)) {
+                status = mgmt_bredr_support(hdev);
+                if (status) {
                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
-                                         MGMT_STATUS_NOT_SUPPORTED);
+                                         status);
                         mgmt_pending_remove(cmd);
                         goto failed;
                 }
@@ -2745,15 +2872,16 @@ static int start_discovery(struct sock *sk, struct hci_dev *hdev,
 
         case DISCOV_TYPE_LE:
         case DISCOV_TYPE_INTERLEAVED:
-                if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
+                status = mgmt_le_support(hdev);
+                if (status) {
                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
-                                         MGMT_STATUS_NOT_SUPPORTED);
+                                         status);
                         mgmt_pending_remove(cmd);
                         goto failed;
                 }
 
                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
-                    !lmp_bredr_capable(hdev)) {
+                    !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
                                          MGMT_STATUS_NOT_SUPPORTED);
                         mgmt_pending_remove(cmd);
@@ -3065,6 +3193,135 @@ static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
         return err;
 }
 
+static void set_advertising_complete(struct hci_dev *hdev, u8 status)
+{
+        struct cmd_lookup match = { NULL, hdev };
+
+        if (status) {
+                u8 mgmt_err = mgmt_status(status);
+
+                mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
+                                     cmd_status_rsp, &mgmt_err);
+                return;
+        }
+
+        mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
+                             &match);
+
+        new_settings(hdev, match.sk);
+
+        if (match.sk)
+                sock_put(match.sk);
+}
+
+static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
+{
+        struct mgmt_mode *cp = data;
+        struct pending_cmd *cmd;
+        struct hci_request req;
+        u8 val, enabled, status;
+        int err;
+
+        BT_DBG("request for %s", hdev->name);
+
+        status = mgmt_le_support(hdev);
+        if (status)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
+                                  status);
+
+        if (cp->val != 0x00 && cp->val != 0x01)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
+                                  MGMT_STATUS_INVALID_PARAMS);
+
+        hci_dev_lock(hdev);
+
+        val = !!cp->val;
+        enabled = test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags);
+
+        if (!hdev_is_powered(hdev) || val == enabled) {
+                bool changed = false;
+
+                if (val != test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags)) {
+                        change_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags);
+                        changed = true;
+                }
+
+                err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
+                if (err < 0)
+                        goto unlock;
+
+                if (changed)
+                        err = new_settings(hdev, sk);
+
+                goto unlock;
+        }
+
+        if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
+            mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
+                                 MGMT_STATUS_BUSY);
+                goto unlock;
+        }
+
+        cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
+        if (!cmd) {
+                err = -ENOMEM;
+                goto unlock;
+        }
+
+        hci_req_init(&req, hdev);
+
+        hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(val), &val);
+
+        err = hci_req_run(&req, set_advertising_complete);
+        if (err < 0)
+                mgmt_pending_remove(cmd);
+
+unlock:
+        hci_dev_unlock(hdev);
+        return err;
+}
+
+static int set_static_address(struct sock *sk, struct hci_dev *hdev,
+                              void *data, u16 len)
+{
+        struct mgmt_cp_set_static_address *cp = data;
+        int err;
+
+        BT_DBG("%s", hdev->name);
+
+        if (!lmp_le_capable(hdev))
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
+                                  MGMT_STATUS_NOT_SUPPORTED);
+
+        if (hdev_is_powered(hdev))
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
+                                  MGMT_STATUS_REJECTED);
+
+        if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
+                if (!bacmp(&cp->bdaddr, BDADDR_NONE))
+                        return cmd_status(sk, hdev->id,
+                                          MGMT_OP_SET_STATIC_ADDRESS,
+                                          MGMT_STATUS_INVALID_PARAMS);
+
+                /* Two most significant bits shall be set */
+                if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
+                        return cmd_status(sk, hdev->id,
+                                          MGMT_OP_SET_STATIC_ADDRESS,
+                                          MGMT_STATUS_INVALID_PARAMS);
+        }
+
+        hci_dev_lock(hdev);
+
+        bacpy(&hdev->static_addr, &cp->bdaddr);
+
+        err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
+
+        hci_dev_unlock(hdev);
+
+        return err;
+}
+
 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
 {
         struct pending_cmd *cmd;
@@ -3108,7 +3365,8 @@ static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
 
         BT_DBG("%s", hdev->name);
 
-        if (!lmp_bredr_capable(hdev) || hdev->hci_ver < BLUETOOTH_VER_1_2)
+        if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
+            hdev->hci_ver < BLUETOOTH_VER_1_2)
                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
                                   MGMT_STATUS_NOT_SUPPORTED);
 
@@ -3162,6 +3420,121 @@ unlock:
         return err;
 }
 
+static void set_bredr_complete(struct hci_dev *hdev, u8 status)
+{
+        struct pending_cmd *cmd;
+
+        BT_DBG("status 0x%02x", status);
+
+        hci_dev_lock(hdev);
+
+        cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
+        if (!cmd)
+                goto unlock;
+
+        if (status) {
+                u8 mgmt_err = mgmt_status(status);
+
+                /* We need to restore the flag if related HCI commands
+                 * failed.
+                 */
+                clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
+
+                cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
+        } else {
+                send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
+                new_settings(hdev, cmd->sk);
+        }
+
+        mgmt_pending_remove(cmd);
+
+unlock:
+        hci_dev_unlock(hdev);
+}
+
+static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
+{
+        struct mgmt_mode *cp = data;
+        struct pending_cmd *cmd;
+        struct hci_request req;
+        int err;
+
+        BT_DBG("request for %s", hdev->name);
+
+        if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
+                                  MGMT_STATUS_NOT_SUPPORTED);
+
+        if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
+                                  MGMT_STATUS_REJECTED);
+
+        if (cp->val != 0x00 && cp->val != 0x01)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
+                                  MGMT_STATUS_INVALID_PARAMS);
+
+        hci_dev_lock(hdev);
+
+        if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
+                err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
+                goto unlock;
+        }
+
+        if (!hdev_is_powered(hdev)) {
+                if (!cp->val) {
+                        clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
+                        clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
+                        clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
+                        clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
+                        clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
+                        clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
+                }
+
+                change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
+
+                err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
+                if (err < 0)
+                        goto unlock;
+
+                err = new_settings(hdev, sk);
+                goto unlock;
+        }
+
+        /* Reject disabling when powered on */
+        if (!cp->val) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
+                                 MGMT_STATUS_REJECTED);
+                goto unlock;
+        }
+
+        if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
+                err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
+                                 MGMT_STATUS_BUSY);
+                goto unlock;
+        }
+
+        cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
+        if (!cmd) {
+                err = -ENOMEM;
+                goto unlock;
+        }
+
+        /* We need to flip the bit already here so that hci_update_ad
+         * generates the correct flags.
+         */
+        set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
+
+        hci_req_init(&req, hdev);
+        hci_update_ad(&req);
+        err = hci_req_run(&req, set_bredr_complete);
+        if (err < 0)
+                mgmt_pending_remove(cmd);
+
+unlock:
+        hci_dev_unlock(hdev);
+        return err;
+}
+
 static bool ltk_is_valid(struct mgmt_ltk_info *key)
 {
         if (key->authenticated != 0x00 && key->authenticated != 0x01)
@@ -3180,6 +3553,12 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
         u16 key_count, expected_len;
         int i, err;
 
+        BT_DBG("request for %s", hdev->name);
+
+        if (!lmp_le_capable(hdev))
+                return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
+                                  MGMT_STATUS_NOT_SUPPORTED);
+
         key_count = __le16_to_cpu(cp->key_count);
 
         expected_len = sizeof(*cp) + key_count *
@@ -3276,6 +3655,9 @@ static const struct mgmt_handler {
         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
+        { set_advertising,        false, MGMT_SETTING_SIZE },
+        { set_bredr,              false, MGMT_SETTING_SIZE },
+        { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
 };
 
 
@@ -3320,6 +3702,12 @@ int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
                                          MGMT_STATUS_INVALID_INDEX);
                         goto done;
                 }
+
+                if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
+                        err = cmd_status(sk, index, opcode,
+                                         MGMT_STATUS_INVALID_INDEX);
+                        goto done;
+                }
         }
 
         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
@@ -3365,14 +3753,6 @@ done:
         return err;
 }
 
-static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
-{
-        u8 *status = data;
-
-        cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
-        mgmt_pending_remove(cmd);
-}
-
 int mgmt_index_added(struct hci_dev *hdev)
 {
         if (!mgmt_valid_hdev(hdev))
@@ -3393,28 +3773,6 @@ int mgmt_index_removed(struct hci_dev *hdev)
         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
 }
 
-struct cmd_lookup {
-        struct sock *sk;
-        struct hci_dev *hdev;
-        u8 mgmt_status;
-};
-
-static void settings_rsp(struct pending_cmd *cmd, void *data)
-{
-        struct cmd_lookup *match = data;
-
-        send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
-
-        list_del(&cmd->list);
-
-        if (match->sk == NULL) {
-                match->sk = cmd->sk;
-                sock_hold(match->sk);
-        }
-
-        mgmt_pending_free(cmd);
-}
-
 static void set_bredr_scan(struct hci_request *req)
 {
         struct hci_dev *hdev = req->hdev;
@@ -3481,6 +3839,22 @@ static int powered_update_hci(struct hci_dev *hdev)
                     cp.simul != lmp_host_le_br_capable(hdev))
                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
                                     sizeof(cp), &cp);
+
+                /* In case BR/EDR was toggled during the AUTO_OFF phase */
+                hci_update_ad(&req);
+        }
+
+        if (lmp_le_capable(hdev)) {
+                /* Set random address to static address if configured */
+                if (bacmp(&hdev->static_addr, BDADDR_ANY))
+                        hci_req_add(&req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
+                                    &hdev->static_addr);
+        }
+
+        if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags)) {
+                u8 adv = 0x01;
+
+                hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(adv), &adv);
         }
 
         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
@@ -3489,7 +3863,8 @@ static int powered_update_hci(struct hci_dev *hdev)
                             sizeof(link_sec), &link_sec);
 
         if (lmp_bredr_capable(hdev)) {
-                set_bredr_scan(&req);
+                if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
+                        set_bredr_scan(&req);
                 update_class(&req);
                 update_name(&req);
                 update_eir(&req);
@@ -4132,44 +4507,6 @@ int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
         return err;
 }
 
-int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
-{
-        struct cmd_lookup match = { NULL, hdev };
-        bool changed = false;
-        int err = 0;
-
-        if (status) {
-                u8 mgmt_err = mgmt_status(status);
-
-                if (enable && test_and_clear_bit(HCI_LE_ENABLED,
-                                                 &hdev->dev_flags))
-                        err = new_settings(hdev, NULL);
-
-                mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
-                                     &mgmt_err);
-
-                return err;
-        }
-
-        if (enable) {
-                if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
-                        changed = true;
-        } else {
-                if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
-                        changed = true;
-        }
-
-        mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
-
-        if (changed)
-                err = new_settings(hdev, match.sk);
-
-        if (match.sk)
-                sock_put(match.sk);
-
-        return err;
-}
-
 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
                       ssp, u8 *eir, u16 eir_len)
@@ -4286,6 +4623,3 @@ int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
                           cmd ? cmd->sk : NULL);
 }
-
-module_param(enable_hs, bool, 0644);
-MODULE_PARM_DESC(enable_hs, "Enable High Speed support");
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 30b3721dc6d7..072938dc527d 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -544,7 +544,7 @@ static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
         struct sock *sk = sock->sk;
         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
         struct sk_buff *skb;
-        int sent = 0;
+        int sent;
 
         if (test_bit(RFCOMM_DEFER_SETUP, &d->flags))
                 return -ENOTCONN;
@@ -559,6 +559,10 @@ static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         lock_sock(sk);
 
+        sent = bt_sock_wait_ready(sk, msg->msg_flags);
+        if (sent)
+                goto done;
+
         while (len) {
                 size_t size = min_t(size_t, len, d->mtu);
                 int err;
@@ -594,6 +598,7 @@ static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                 len  -= size;
         }
 
+done:
         release_sock(sk);
 
         return sent;
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index 6d126faf145f..84fcf9fff3ea 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -569,7 +569,6 @@ static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb)
 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
 {
         struct rfcomm_dev *dev = dlc->owner;
-        struct tty_struct *tty;
         if (!dev)
                 return;
 
@@ -581,38 +580,8 @@ static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
                             DPM_ORDER_DEV_AFTER_PARENT);
 
                 wake_up_interruptible(&dev->port.open_wait);
-        } else if (dlc->state == BT_CLOSED) {
-                tty = tty_port_tty_get(&dev->port);
-                if (!tty) {
-                        if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
-                                /* Drop DLC lock here to avoid deadlock
-                                 * 1. rfcomm_dev_get will take rfcomm_dev_lock
-                                 *    but in rfcomm_dev_add there's lock order:
-                                 *    rfcomm_dev_lock -> dlc lock
-                                 * 2. tty_port_put will deadlock if it's
-                                 *    the last reference
-                                 *
-                                 * FIXME: when we release the lock anything
-                                 * could happen to dev, even its destruction
-                                 */
-                                rfcomm_dlc_unlock(dlc);
-                                if (rfcomm_dev_get(dev->id) == NULL) {
-                                        rfcomm_dlc_lock(dlc);
-                                        return;
-                                }
-
-                                if (!test_and_set_bit(RFCOMM_TTY_RELEASED,
-                                                      &dev->flags))
-                                        tty_port_put(&dev->port);
-
-                                tty_port_put(&dev->port);
-                                rfcomm_dlc_lock(dlc);
-                        }
-                } else {
-                        tty_hangup(tty);
-                        tty_kref_put(tty);
-                }
-        }
+        } else if (dlc->state == BT_CLOSED)
+                tty_port_tty_hangup(&dev->port, false);
 }
 
 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig)
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index b5562abdd6e0..884b2081a262 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -847,16 +847,27 @@ static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
 
 int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
 {
-        __u8 code = skb->data[0];
-        __u8 reason;
+        struct hci_conn *hcon = conn->hcon;
+        __u8 code, reason;
         int err = 0;
 
+        if (hcon->type != LE_LINK) {
+                kfree_skb(skb);
+                return -ENOTSUPP;
+        }
+
+        if (skb->len < 1) {
+                kfree_skb(skb);
+                return -EILSEQ;
+        }
+
         if (!test_bit(HCI_LE_ENABLED, &conn->hcon->hdev->dev_flags)) {
                 err = -ENOTSUPP;
                 reason = SMP_PAIRING_NOTSUPP;
                 goto done;
         }
 
+        code = skb->data[0];
         skb_pull(skb, sizeof(code));
 
         /*
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index b9259efa636e..e74ddc1c29a8 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -207,7 +207,7 @@ int br_getlink(struct sk_buff *skb, u32 pid, u32 seq,
                struct net_device *dev, u32 filter_mask)
 {
         int err = 0;
-        struct net_bridge_port *port = br_port_get_rcu(dev);
+        struct net_bridge_port *port = br_port_get_rtnl(dev);
 
         /* not a bridge port and  */
         if (!port && !(filter_mask & RTEXT_FILTER_BRVLAN))
@@ -451,7 +451,7 @@ static size_t br_get_link_af_size(const struct net_device *dev)
         struct net_port_vlans *pv;
 
         if (br_port_exists(dev))
-                pv = nbp_get_vlan_info(br_port_get_rcu(dev));
+                pv = nbp_get_vlan_info(br_port_get_rtnl(dev));
         else if (dev->priv_flags & IFF_EBRIDGE)
                 pv = br_get_vlan_info((struct net_bridge *)netdev_priv(dev));
         else
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 598cb0b333c6..efb57d911569 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -202,13 +202,10 @@ struct net_bridge_port
 
 static inline struct net_bridge_port *br_port_get_rcu(const struct net_device *dev)
 {
-        struct net_bridge_port *port =
-                        rcu_dereference_rtnl(dev->rx_handler_data);
-
-        return br_port_exists(dev) ? port : NULL;
+        return rcu_dereference(dev->rx_handler_data);
 }
 
-static inline struct net_bridge_port *br_port_get_rtnl(struct net_device *dev)
+static inline struct net_bridge_port *br_port_get_rtnl(const struct net_device *dev)
 {
         return br_port_exists(dev) ?
                 rtnl_dereference(dev->rx_handler_data) : NULL;
@@ -746,6 +743,7 @@ extern struct net_bridge_port *br_get_port(struct net_bridge *br,
 extern void br_init_port(struct net_bridge_port *p);
 extern void br_become_designated_port(struct net_bridge_port *p);
 
+extern void __br_set_forward_delay(struct net_bridge *br, unsigned long t);
 extern int br_set_forward_delay(struct net_bridge *br, unsigned long x);
 extern int br_set_hello_time(struct net_bridge *br, unsigned long x);
 extern int br_set_max_age(struct net_bridge *br, unsigned long x);
diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
index 1c0a50f13229..3c86f0538cbb 100644
--- a/net/bridge/br_stp.c
+++ b/net/bridge/br_stp.c
@@ -209,7 +209,7 @@ static void br_record_config_information(struct net_bridge_port *p,
         p->designated_age = jiffies - bpdu->message_age;
 
         mod_timer(&p->message_age_timer, jiffies
-                  + (p->br->max_age - bpdu->message_age));
+                  + (bpdu->max_age - bpdu->message_age));
 }
 
 /* called under bridge lock */
@@ -544,18 +544,27 @@ int br_set_max_age(struct net_bridge *br, unsigned long val)
 
 }
 
+void __br_set_forward_delay(struct net_bridge *br, unsigned long t)
+{
+        br->bridge_forward_delay = t;
+        if (br_is_root_bridge(br))
+                br->forward_delay = br->bridge_forward_delay;
+}
+
 int br_set_forward_delay(struct net_bridge *br, unsigned long val)
 {
         unsigned long t = clock_t_to_jiffies(val);
+        int err = -ERANGE;
 
+        spin_lock_bh(&br->lock);
         if (br->stp_enabled != BR_NO_STP &&
             (t < BR_MIN_FORWARD_DELAY || t > BR_MAX_FORWARD_DELAY))
-                return -ERANGE;
+                goto unlock;
 
-        spin_lock_bh(&br->lock);
-        br->bridge_forward_delay = t;
-        if (br_is_root_bridge(br))
-                br->forward_delay = br->bridge_forward_delay;
+        __br_set_forward_delay(br, t);
+        err = 0;
+
+unlock:
         spin_unlock_bh(&br->lock);
-        return 0;
+        return err;
 }
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index d45e760141bb..108084a04671 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -129,6 +129,14 @@ static void br_stp_start(struct net_bridge *br)
         char *envp[] = { NULL };
 
         r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC);
+
+        spin_lock_bh(&br->lock);
+
+        if (br->bridge_forward_delay < BR_MIN_FORWARD_DELAY)
+                __br_set_forward_delay(br, BR_MIN_FORWARD_DELAY);
+        else if (br->bridge_forward_delay < BR_MAX_FORWARD_DELAY)
+                __br_set_forward_delay(br, BR_MAX_FORWARD_DELAY);
+
         if (r == 0) {
                 br->stp_enabled = BR_USER_STP;
                 br_debug(br, "userspace STP started\n");
@@ -137,10 +145,10 @@ static void br_stp_start(struct net_bridge *br)
                 br_debug(br, "using kernel STP\n");
 
                 /* To start timers on any ports left in blocking */
-                spin_lock_bh(&br->lock);
                 br_port_state_selection(br);
-                spin_unlock_bh(&br->lock);
         }
+
+        spin_unlock_bh(&br->lock);
 }
 
 static void br_stp_stop(struct net_bridge *br)
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 1606f740d6ae..2b4b32aaa893 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -2216,6 +2216,17 @@ void ceph_osdc_sync(struct ceph_osd_client *osdc)
 EXPORT_SYMBOL(ceph_osdc_sync);
 
 /*
+ * Call all pending notify callbacks - for use after a watch is
+ * unregistered, to make sure no more callbacks for it will be invoked
+ */
+extern void ceph_osdc_flush_notifies(struct ceph_osd_client *osdc)
+{
+        flush_workqueue(osdc->notify_wq);
+}
+EXPORT_SYMBOL(ceph_osdc_flush_notifies);
+
+
+/*
  * init, shutdown
  */
 int ceph_osdc_init(struct ceph_osd_client *osdc, struct ceph_client *client)
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 2c637e9a0b27..fc75c9e461b8 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -550,7 +550,7 @@ static void netpoll_neigh_reply(struct sk_buff *skb, struct netpoll_info *npinfo
                 return;
 
         proto = ntohs(eth_hdr(skb)->h_proto);
-        if (proto == ETH_P_IP) {
+        if (proto == ETH_P_ARP) {
                 struct arphdr *arp;
                 unsigned char *arp_ptr;
                 /* No arp on this interface */
@@ -1284,15 +1284,14 @@ EXPORT_SYMBOL_GPL(__netpoll_free_async);
 
 void netpoll_cleanup(struct netpoll *np)
 {
-        if (!np->dev)
-                return;
-
         rtnl_lock();
+        if (!np->dev)
+                goto out;
         __netpoll_cleanup(np);
-        rtnl_unlock();
-
         dev_put(np->dev);
         np->dev = NULL;
+out:
+        rtnl_unlock();
 }
 EXPORT_SYMBOL(netpoll_cleanup);
 
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 9c61f9c02fdb..6cf9f7782ad4 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -135,6 +135,7 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 
                 if (dst)
                         dst->ops->redirect(dst, sk, skb);
+                goto out;
         }
 
         if (type == ICMPV6_PKT_TOOBIG) {
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index d6c0e64ec97f..dace87f06e5f 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -369,7 +369,7 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
         pip->saddr    = fl4.saddr;
         pip->protocol = IPPROTO_IGMP;
         pip->tot_len  = 0;      /* filled in later */
-        ip_select_ident(pip, &rt->dst, NULL);
+        ip_select_ident(skb, &rt->dst, NULL);
         ((u8 *)&pip[1])[0] = IPOPT_RA;
         ((u8 *)&pip[1])[1] = 4;
         ((u8 *)&pip[1])[2] = 0;
@@ -714,7 +714,7 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
         iph->daddr    = dst;
         iph->saddr    = fl4.saddr;
         iph->protocol = IPPROTO_IGMP;
-        ip_select_ident(iph, &rt->dst, NULL);
+        ip_select_ident(skb, &rt->dst, NULL);
         ((u8 *)&iph[1])[0] = IPOPT_RA;
         ((u8 *)&iph[1])[1] = 4;
         ((u8 *)&iph[1])[2] = 0;
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index 000e3d239d64..33d5537881ed 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -32,8 +32,8 @@
  *  At the moment of writing this notes identifier of IP packets is generated
  *  to be unpredictable using this code only for packets subjected
  *  (actually or potentially) to defragmentation.  I.e. DF packets less than
- *  PMTU in size uses a constant ID and do not use this code (see
- *  ip_select_ident() in include/net/ip.h).
+ *  PMTU in size when local fragmentation is disabled use a constant ID and do
+ *  not use this code (see ip_select_ident() in include/net/ip.h).
  *
  *  Route cache entries hold references to our nodes.
  *  New cache entries get references via lookup by destination IP address in
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 9ee17e3d11c3..a04d872c54f9 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -148,7 +148,7 @@ int ip_build_and_send_pkt(struct sk_buff *skb, struct sock *sk,
         iph->daddr    = (opt && opt->opt.srr ? opt->opt.faddr : daddr);
         iph->saddr    = saddr;
         iph->protocol = sk->sk_protocol;
-        ip_select_ident(iph, &rt->dst, sk);
+        ip_select_ident(skb, &rt->dst, sk);
 
         if (opt && opt->opt.optlen) {
                 iph->ihl += opt->opt.optlen>>2;
@@ -386,7 +386,7 @@ packet_routed:
                 ip_options_build(skb, &inet_opt->opt, inet->inet_daddr, rt, 0);
         }
 
-        ip_select_ident_more(iph, &rt->dst, sk,
+        ip_select_ident_more(skb, &rt->dst, sk,
                              (skb_shinfo(skb)->gso_segs ?: 1) - 1);
 
         skb->priority = sk->sk_priority;
@@ -1316,7 +1316,7 @@ struct sk_buff *__ip_make_skb(struct sock *sk,
         else
                 ttl = ip_select_ttl(inet, &rt->dst);
 
-        iph = (struct iphdr *)skb->data;
+        iph = ip_hdr(skb);
         iph->version = 4;
         iph->ihl = 5;
         iph->tos = inet->tos;
@@ -1324,7 +1324,7 @@ struct sk_buff *__ip_make_skb(struct sock *sk,
         iph->ttl = ttl;
         iph->protocol = sk->sk_protocol;
         ip_copy_addrs(iph, fl4);
-        ip_select_ident(iph, &rt->dst, sk);
+        ip_select_ident(skb, &rt->dst, sk);
 
         if (opt) {
                 iph->ihl += opt->optlen>>2;
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 9ae54b09254f..62212c772a4b 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1658,7 +1658,7 @@ static void ip_encap(struct sk_buff *skb, __be32 saddr, __be32 daddr)
         iph->protocol   =       IPPROTO_IPIP;
         iph->ihl        =       5;
         iph->tot_len    =       htons(skb->len);
-        ip_select_ident(iph, skb_dst(skb), NULL);
+        ip_select_ident(skb, skb_dst(skb), NULL);
         ip_send_check(iph);
 
         memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index a86c7ae71881..bfec521c717f 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -387,7 +387,7 @@ static int raw_send_hdrinc(struct sock *sk, struct flowi4 *fl4,
                 iph->check   = 0;
                 iph->tot_len = htons(length);
                 if (!iph->id)
-                        ip_select_ident(iph, &rt->dst, NULL);
+                        ip_select_ident(skb, &rt->dst, NULL);
 
                 iph->check = ip_fast_csum((unsigned char *)iph, iph->ihl);
         }
diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
index 4a22f3e715df..52f3c6b971d2 100644
--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c
@@ -502,7 +502,9 @@ reset:
          * ACKs, wait for troubles.
          */
         if (crtt > tp->srtt) {
-                inet_csk(sk)->icsk_rto = crtt + max(crtt >> 2, tcp_rto_min(sk));
+                /* Set RTO like tcp_rtt_estimator(), but from cached RTT. */
+                crtt >>= 3;
+                inet_csk(sk)->icsk_rto = crtt + max(2 * crtt, tcp_rto_min(sk));
         } else if (tp->srtt == 0) {
                 /* RFC6298: 5.7 We've failed to get a valid RTT sample from
                  * 3WHS. This is most likely due to retransmission,
diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
index eb1dd4d643f2..b5663c37f089 100644
--- a/net/ipv4/xfrm4_mode_tunnel.c
+++ b/net/ipv4/xfrm4_mode_tunnel.c
@@ -117,7 +117,7 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
 
         top_iph->frag_off = (flags & XFRM_STATE_NOPMTUDISC) ?
                 0 : (XFRM_MODE_SKB_CB(skb)->frag_off & htons(IP_DF));
-        ip_select_ident(top_iph, dst->child, NULL);
+        ip_select_ident(skb, dst->child, NULL);
 
         top_iph->ttl = ip4_dst_hoplimit(dst->child);
 
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 61355f7f4da5..2d8f4829575b 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1656,9 +1656,9 @@ static int ip6_tnl_fill_info(struct sk_buff *skb, const struct net_device *dev)
 
         if (nla_put_u32(skb, IFLA_IPTUN_LINK, parm->link) ||
             nla_put(skb, IFLA_IPTUN_LOCAL, sizeof(struct in6_addr),
-                    &parm->raddr) ||
-            nla_put(skb, IFLA_IPTUN_REMOTE, sizeof(struct in6_addr),
                     &parm->laddr) ||
+            nla_put(skb, IFLA_IPTUN_REMOTE, sizeof(struct in6_addr),
+                    &parm->raddr) ||
             nla_put_u8(skb, IFLA_IPTUN_TTL, parm->hop_limit) ||
             nla_put_u8(skb, IFLA_IPTUN_ENCAP_LIMIT, parm->encap_limit) ||
             nla_put_be32(skb, IFLA_IPTUN_FLOWINFO, parm->flowinfo) ||
diff --git a/net/ipv6/netfilter/nf_nat_proto_icmpv6.c b/net/ipv6/netfilter/nf_nat_proto_icmpv6.c
index 61aaf70f376e..2205e8eeeacf 100644
--- a/net/ipv6/netfilter/nf_nat_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_nat_proto_icmpv6.c
@@ -69,8 +69,8 @@ icmpv6_manip_pkt(struct sk_buff *skb,
         hdr = (struct icmp6hdr *)(skb->data + hdroff);
         l3proto->csum_update(skb, iphdroff, &hdr->icmp6_cksum,
                              tuple, maniptype);
-        if (hdr->icmp6_code == ICMPV6_ECHO_REQUEST ||
-            hdr->icmp6_code == ICMPV6_ECHO_REPLY) {
+        if (hdr->icmp6_type == ICMPV6_ECHO_REQUEST ||
+            hdr->icmp6_type == ICMPV6_ECHO_REPLY) {
                 inet_proto_csum_replace2(&hdr->icmp6_cksum, skb,
                                          hdr->icmp6_identifier,
                                          tuple->src.u.icmp.id, 0);
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 2e7855a1b10d..ac28af74a414 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2865,30 +2865,43 @@ void ieee80211_csa_finalize_work(struct work_struct *work)
         if (!ieee80211_sdata_running(sdata))
                 return;
 
-        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_AP))
-                return;
-
         sdata->radar_required = sdata->csa_radar_required;
         err = ieee80211_vif_change_channel(sdata, &local->csa_chandef,
                                            &changed);
         if (WARN_ON(err < 0))
                 return;
 
-        err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon);
-        if (err < 0)
-                return;
+        if (!local->use_chanctx) {
+                local->_oper_chandef = local->csa_chandef;
+                ieee80211_hw_config(local, 0);
+        }
 
-        changed |= err;
-        kfree(sdata->u.ap.next_beacon);
-        sdata->u.ap.next_beacon = NULL;
+        ieee80211_bss_info_change_notify(sdata, changed);
+
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_AP:
+                err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon);
+                if (err < 0)
+                        return;
+                changed |= err;
+                kfree(sdata->u.ap.next_beacon);
+                sdata->u.ap.next_beacon = NULL;
+
+                ieee80211_bss_info_change_notify(sdata, err);
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                ieee80211_ibss_finish_csa(sdata);
+                break;
+        default:
+                WARN_ON(1);
+                return;
+        }
         sdata->vif.csa_active = false;
 
         ieee80211_wake_queues_by_reason(&sdata->local->hw,
                                         IEEE80211_MAX_QUEUE_MAP,
                                         IEEE80211_QUEUE_STOP_REASON_CSA);
 
-        ieee80211_bss_info_change_notify(sdata, changed);
-
         cfg80211_ch_switch_notify(sdata->dev, &local->csa_chandef);
 }
 
@@ -2936,20 +2949,56 @@ static int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
         if (sdata->vif.csa_active)
                 return -EBUSY;
 
-        /* only handle AP for now. */
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_AP:
+                sdata->csa_counter_offset_beacon =
+                        params->counter_offset_beacon;
+                sdata->csa_counter_offset_presp = params->counter_offset_presp;
+                sdata->u.ap.next_beacon =
+                        cfg80211_beacon_dup(&params->beacon_after);
+                if (!sdata->u.ap.next_beacon)
+                        return -ENOMEM;
+
+                err = ieee80211_assign_beacon(sdata, &params->beacon_csa);
+                if (err < 0) {
+                        kfree(sdata->u.ap.next_beacon);
+                        return err;
+                }
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                if (!sdata->vif.bss_conf.ibss_joined)
+                        return -EINVAL;
+
+                if (params->chandef.width != sdata->u.ibss.chandef.width)
+                        return -EINVAL;
+
+                switch (params->chandef.width) {
+                case NL80211_CHAN_WIDTH_40:
+                        if (cfg80211_get_chandef_type(&params->chandef) !=
+                            cfg80211_get_chandef_type(&sdata->u.ibss.chandef))
+                                return -EINVAL;
+                case NL80211_CHAN_WIDTH_5:
+                case NL80211_CHAN_WIDTH_10:
+                case NL80211_CHAN_WIDTH_20_NOHT:
+                case NL80211_CHAN_WIDTH_20:
+                        break;
+                default:
+                        return -EINVAL;
+                }
+
+                /* changes into another band are not supported */
+                if (sdata->u.ibss.chandef.chan->band !=
+                    params->chandef.chan->band)
+                        return -EINVAL;
+
+                err = ieee80211_ibss_csa_beacon(sdata, params);
+                if (err < 0)
+                        return err;
                 break;
         default:
                 return -EOPNOTSUPP;
         }
 
-        sdata->u.ap.next_beacon = cfg80211_beacon_dup(&params->beacon_after);
-        if (!sdata->u.ap.next_beacon)
-                return -ENOMEM;
-
-        sdata->csa_counter_offset_beacon = params->counter_offset_beacon;
-        sdata->csa_counter_offset_presp = params->counter_offset_presp;
         sdata->csa_radar_required = params->radar_required;
 
         if (params->block_tx)
@@ -2957,10 +3006,6 @@ static int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
                                 IEEE80211_MAX_QUEUE_MAP,
                                 IEEE80211_QUEUE_STOP_REASON_CSA);
 
-        err = ieee80211_assign_beacon(sdata, &params->beacon_csa);
-        if (err < 0)
-                return err;
-
         local->csa_chandef = params->chandef;
         sdata->vif.csa_active = true;
 
@@ -3014,7 +3059,8 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
                         need_offchan = true;
                 if (!ieee80211_is_action(mgmt->frame_control) ||
                     mgmt->u.action.category == WLAN_CATEGORY_PUBLIC ||
-                    mgmt->u.action.category == WLAN_CATEGORY_SELF_PROTECTED)
+                    mgmt->u.action.category == WLAN_CATEGORY_SELF_PROTECTED ||
+                    mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT)
                         break;
                 rcu_read_lock();
                 sta = sta_info_get(sdata, mgmt->da);
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 3a4764b2869e..03ba6b5c5373 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -453,11 +453,6 @@ int ieee80211_vif_change_channel(struct ieee80211_sub_if_data *sdata,
         chanctx_changed |= IEEE80211_CHANCTX_CHANGE_CHANNEL;
         drv_change_chanctx(local, ctx, chanctx_changed);
 
-        if (!local->use_chanctx) {
-                local->_oper_chandef = *chandef;
-                ieee80211_hw_config(local, 0);
-        }
-
         ieee80211_recalc_chanctx_chantype(local, ctx);
         ieee80211_recalc_smps_chanctx(local, ctx);
         ieee80211_recalc_radar_chanctx(local, ctx);
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index b0e32d628114..5c090e41d9bb 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -103,54 +103,57 @@ static ssize_t hwflags_read(struct file *file, char __user *user_buf,
         if (!buf)
                 return 0;
 
-        sf += snprintf(buf, mxln - sf, "0x%x\n", local->hw.flags);
+        sf += scnprintf(buf, mxln - sf, "0x%x\n", local->hw.flags);
         if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL)
-                sf += snprintf(buf + sf, mxln - sf, "HAS_RATE_CONTROL\n");
+                sf += scnprintf(buf + sf, mxln - sf, "HAS_RATE_CONTROL\n");
         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
-                sf += snprintf(buf + sf, mxln - sf, "RX_INCLUDES_FCS\n");
+                sf += scnprintf(buf + sf, mxln - sf, "RX_INCLUDES_FCS\n");
         if (local->hw.flags & IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING)
-                sf += snprintf(buf + sf, mxln - sf,
-                               "HOST_BCAST_PS_BUFFERING\n");
+                sf += scnprintf(buf + sf, mxln - sf,
+                                "HOST_BCAST_PS_BUFFERING\n");
         if (local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE)
-                sf += snprintf(buf + sf, mxln - sf,
-                               "2GHZ_SHORT_SLOT_INCAPABLE\n");
+                sf += scnprintf(buf + sf, mxln - sf,
+                                "2GHZ_SHORT_SLOT_INCAPABLE\n");
         if (local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE)
-                sf += snprintf(buf + sf, mxln - sf,
-                               "2GHZ_SHORT_PREAMBLE_INCAPABLE\n");
+                sf += scnprintf(buf + sf, mxln - sf,
+                                "2GHZ_SHORT_PREAMBLE_INCAPABLE\n");
         if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)
-                sf += snprintf(buf + sf, mxln - sf, "SIGNAL_UNSPEC\n");
+                sf += scnprintf(buf + sf, mxln - sf, "SIGNAL_UNSPEC\n");
         if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
-                sf += snprintf(buf + sf, mxln - sf, "SIGNAL_DBM\n");
+                sf += scnprintf(buf + sf, mxln - sf, "SIGNAL_DBM\n");
         if (local->hw.flags & IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC)
-                sf += snprintf(buf + sf, mxln - sf, "NEED_DTIM_BEFORE_ASSOC\n");
+                sf += scnprintf(buf + sf, mxln - sf,
+                                "NEED_DTIM_BEFORE_ASSOC\n");
         if (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT)
-                sf += snprintf(buf + sf, mxln - sf, "SPECTRUM_MGMT\n");
+                sf += scnprintf(buf + sf, mxln - sf, "SPECTRUM_MGMT\n");
         if (local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION)
-                sf += snprintf(buf + sf, mxln - sf, "AMPDU_AGGREGATION\n");
+                sf += scnprintf(buf + sf, mxln - sf, "AMPDU_AGGREGATION\n");
         if (local->hw.flags & IEEE80211_HW_SUPPORTS_PS)
-                sf += snprintf(buf + sf, mxln - sf, "SUPPORTS_PS\n");
+                sf += scnprintf(buf + sf, mxln - sf, "SUPPORTS_PS\n");
         if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
-                sf += snprintf(buf + sf, mxln - sf, "PS_NULLFUNC_STACK\n");
+                sf += scnprintf(buf + sf, mxln - sf, "PS_NULLFUNC_STACK\n");
         if (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)
-                sf += snprintf(buf + sf, mxln - sf, "SUPPORTS_DYNAMIC_PS\n");
+                sf += scnprintf(buf + sf, mxln - sf, "SUPPORTS_DYNAMIC_PS\n");
         if (local->hw.flags & IEEE80211_HW_MFP_CAPABLE)
-                sf += snprintf(buf + sf, mxln - sf, "MFP_CAPABLE\n");
+                sf += scnprintf(buf + sf, mxln - sf, "MFP_CAPABLE\n");
         if (local->hw.flags & IEEE80211_HW_SUPPORTS_STATIC_SMPS)
-                sf += snprintf(buf + sf, mxln - sf, "SUPPORTS_STATIC_SMPS\n");
+                sf += scnprintf(buf + sf, mxln - sf, "SUPPORTS_STATIC_SMPS\n");
         if (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS)
-                sf += snprintf(buf + sf, mxln - sf, "SUPPORTS_DYNAMIC_SMPS\n");
+                sf += scnprintf(buf + sf, mxln - sf,
+                                "SUPPORTS_DYNAMIC_SMPS\n");
         if (local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD)
-                sf += snprintf(buf + sf, mxln - sf, "SUPPORTS_UAPSD\n");
+                sf += scnprintf(buf + sf, mxln - sf, "SUPPORTS_UAPSD\n");
         if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
-                sf += snprintf(buf + sf, mxln - sf, "REPORTS_TX_ACK_STATUS\n");
+                sf += scnprintf(buf + sf, mxln - sf,
+                                "REPORTS_TX_ACK_STATUS\n");
         if (local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
-                sf += snprintf(buf + sf, mxln - sf, "CONNECTION_MONITOR\n");
+                sf += scnprintf(buf + sf, mxln - sf, "CONNECTION_MONITOR\n");
         if (local->hw.flags & IEEE80211_HW_SUPPORTS_PER_STA_GTK)
-                sf += snprintf(buf + sf, mxln - sf, "SUPPORTS_PER_STA_GTK\n");
+                sf += scnprintf(buf + sf, mxln - sf, "SUPPORTS_PER_STA_GTK\n");
         if (local->hw.flags & IEEE80211_HW_AP_LINK_PS)
-                sf += snprintf(buf + sf, mxln - sf, "AP_LINK_PS\n");
+                sf += scnprintf(buf + sf, mxln - sf, "AP_LINK_PS\n");
         if (local->hw.flags & IEEE80211_HW_TX_AMPDU_SETUP_IN_HW)
-                sf += snprintf(buf + sf, mxln - sf, "TX_AMPDU_SETUP_IN_HW\n");
+                sf += scnprintf(buf + sf, mxln - sf, "TX_AMPDU_SETUP_IN_HW\n");
 
         rv = simple_read_from_buffer(user_buf, count, ppos, buf, strlen(buf));
         kfree(buf);
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index b3ea11f3d526..5d03c47c0a4c 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -1085,4 +1085,31 @@ drv_channel_switch_beacon(struct ieee80211_sub_if_data *sdata,
         }
 }
 
+static inline int drv_join_ibss(struct ieee80211_local *local,
+                                struct ieee80211_sub_if_data *sdata)
+{
+        int ret = 0;
+
+        might_sleep();
+        check_sdata_in_driver(sdata);
+
+        trace_drv_join_ibss(local, sdata, &sdata->vif.bss_conf);
+        if (local->ops->join_ibss)
+                ret = local->ops->join_ibss(&local->hw, &sdata->vif);
+        trace_drv_return_int(local, ret);
+        return ret;
+}
+
+static inline void drv_leave_ibss(struct ieee80211_local *local,
+                                  struct ieee80211_sub_if_data *sdata)
+{
+        might_sleep();
+        check_sdata_in_driver(sdata);
+
+        trace_drv_leave_ibss(local, sdata);
+        if (local->ops->leave_ibss)
+                local->ops->leave_ibss(&local->hw, &sdata->vif);
+        trace_drv_return_void(local);
+}
+
 #endif /* __MAC80211_DRIVER_OPS */
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index a12afe77bb26..21a0b8835cb3 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -39,7 +39,8 @@ ieee80211_ibss_build_presp(struct ieee80211_sub_if_data *sdata,
                            const int beacon_int, const u32 basic_rates,
                            const u16 capability, u64 tsf,
                            struct cfg80211_chan_def *chandef,
-                           bool *have_higher_than_11mbit)
+                           bool *have_higher_than_11mbit,
+                           struct cfg80211_csa_settings *csa_settings)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
         struct ieee80211_local *local = sdata->local;
@@ -59,6 +60,7 @@ ieee80211_ibss_build_presp(struct ieee80211_sub_if_data *sdata,
                     2 + 8 /* max Supported Rates */ +
                     3 /* max DS params */ +
                     4 /* IBSS params */ +
+                    5 /* Channel Switch Announcement */ +
                     2 + (IEEE80211_MAX_SUPP_RATES - 8) +
                     2 + sizeof(struct ieee80211_ht_cap) +
                     2 + sizeof(struct ieee80211_ht_operation) +
@@ -135,6 +137,16 @@ ieee80211_ibss_build_presp(struct ieee80211_sub_if_data *sdata,
         *pos++ = 0;
         *pos++ = 0;
 
+        if (csa_settings) {
+                *pos++ = WLAN_EID_CHANNEL_SWITCH;
+                *pos++ = 3;
+                *pos++ = csa_settings->block_tx ? 1 : 0;
+                *pos++ = ieee80211_frequency_to_channel(
+                                csa_settings->chandef.chan->center_freq);
+                sdata->csa_counter_offset_beacon = (pos - presp->head);
+                *pos++ = csa_settings->count;
+        }
+
         /* put the remaining rates in WLAN_EID_EXT_SUPP_RATES */
         if (rates_n > 8) {
                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
@@ -217,6 +229,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         struct beacon_data *presp;
         enum nl80211_bss_scan_width scan_width;
         bool have_higher_than_11mbit;
+        int err;
 
         sdata_assert_lock(sdata);
 
@@ -235,6 +248,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                 ieee80211_bss_info_change_notify(sdata,
                                                  BSS_CHANGED_IBSS |
                                                  BSS_CHANGED_BEACON_ENABLED);
+                drv_leave_ibss(local, sdata);
         }
 
         presp = rcu_dereference_protected(ifibss->presp,
@@ -276,7 +290,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
 
         presp = ieee80211_ibss_build_presp(sdata, beacon_int, basic_rates,
                                            capability, tsf, &chandef,
-                                           &have_higher_than_11mbit);
+                                           &have_higher_than_11mbit, NULL);
         if (!presp)
                 return;
 
@@ -317,11 +331,26 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         else
                 sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
 
+        ieee80211_set_wmm_default(sdata, true);
+
         sdata->vif.bss_conf.ibss_joined = true;
         sdata->vif.bss_conf.ibss_creator = creator;
-        ieee80211_bss_info_change_notify(sdata, bss_change);
 
-        ieee80211_set_wmm_default(sdata, true);
+        err = drv_join_ibss(local, sdata);
+        if (err) {
+                sdata->vif.bss_conf.ibss_joined = false;
+                sdata->vif.bss_conf.ibss_creator = false;
+                sdata->vif.bss_conf.enable_beacon = false;
+                sdata->vif.bss_conf.ssid_len = 0;
+                RCU_INIT_POINTER(ifibss->presp, NULL);
+                kfree_rcu(presp, rcu_head);
+                ieee80211_vif_release_channel(sdata);
+                sdata_info(sdata, "Failed to join IBSS, driver failure: %d\n",
+                           err);
+                return;
+        }
+
+        ieee80211_bss_info_change_notify(sdata, bss_change);
 
         ifibss->state = IEEE80211_IBSS_MLME_JOINED;
         mod_timer(&ifibss->timer,
@@ -416,6 +445,169 @@ static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                                   tsf, false);
 }
 
+static int ieee80211_send_action_csa(struct ieee80211_sub_if_data *sdata,
+                                     struct cfg80211_csa_settings *csa_settings)
+{
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *mgmt;
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+        struct ieee80211_local *local = sdata->local;
+        int freq;
+        int hdr_len = offsetof(struct ieee80211_mgmt, u.action.u.chan_switch) +
+                      sizeof(mgmt->u.action.u.chan_switch);
+        u8 *pos;
+
+        skb = dev_alloc_skb(local->tx_headroom + hdr_len +
+                            5 + /* channel switch announcement element */
+                            3); /* secondary channel offset element */
+        if (!skb)
+                return -1;
+
+        skb_reserve(skb, local->tx_headroom);
+        mgmt = (struct ieee80211_mgmt *)skb_put(skb, hdr_len);
+        memset(mgmt, 0, hdr_len);
+        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                          IEEE80211_STYPE_ACTION);
+
+        eth_broadcast_addr(mgmt->da);
+        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
+        memcpy(mgmt->bssid, ifibss->bssid, ETH_ALEN);
+        mgmt->u.action.category = WLAN_CATEGORY_SPECTRUM_MGMT;
+        mgmt->u.action.u.chan_switch.action_code = WLAN_ACTION_SPCT_CHL_SWITCH;
+        pos = skb_put(skb, 5);
+        *pos++ = WLAN_EID_CHANNEL_SWITCH;                       /* EID */
+        *pos++ = 3;                                             /* IE length */
+        *pos++ = csa_settings->block_tx ? 1 : 0;                /* CSA mode */
+        freq = csa_settings->chandef.chan->center_freq;
+        *pos++ = ieee80211_frequency_to_channel(freq);          /* channel */
+        *pos++ = csa_settings->count;                           /* count */
+
+        if (csa_settings->chandef.width == NL80211_CHAN_WIDTH_40) {
+                enum nl80211_channel_type ch_type;
+
+                skb_put(skb, 3);
+                *pos++ = WLAN_EID_SECONDARY_CHANNEL_OFFSET;     /* EID */
+                *pos++ = 1;                                     /* IE length */
+                ch_type = cfg80211_get_chandef_type(&csa_settings->chandef);
+                if (ch_type == NL80211_CHAN_HT40PLUS)
+                        *pos++ = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
+                else
+                        *pos++ = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
+        }
+
+        ieee80211_tx_skb(sdata, skb);
+        return 0;
+}
+
+int ieee80211_ibss_csa_beacon(struct ieee80211_sub_if_data *sdata,
+                              struct cfg80211_csa_settings *csa_settings)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+        struct beacon_data *presp, *old_presp;
+        struct cfg80211_bss *cbss;
+        const struct cfg80211_bss_ies *ies;
+        u16 capability;
+        u64 tsf;
+        int ret = 0;
+
+        sdata_assert_lock(sdata);
+
+        capability = WLAN_CAPABILITY_IBSS;
+
+        if (ifibss->privacy)
+                capability |= WLAN_CAPABILITY_PRIVACY;
+
+        cbss = cfg80211_get_bss(sdata->local->hw.wiphy, ifibss->chandef.chan,
+                                ifibss->bssid, ifibss->ssid,
+                                ifibss->ssid_len, WLAN_CAPABILITY_IBSS |
+                                WLAN_CAPABILITY_PRIVACY,
+                                capability);
+
+        if (WARN_ON(!cbss)) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        rcu_read_lock();
+        ies = rcu_dereference(cbss->ies);
+        tsf = ies->tsf;
+        rcu_read_unlock();
+        cfg80211_put_bss(sdata->local->hw.wiphy, cbss);
+
+        old_presp = rcu_dereference_protected(ifibss->presp,
+                                          lockdep_is_held(&sdata->wdev.mtx));
+
+        presp = ieee80211_ibss_build_presp(sdata,
+                                           sdata->vif.bss_conf.beacon_int,
+                                           sdata->vif.bss_conf.basic_rates,
+                                           capability, tsf, &ifibss->chandef,
+                                           NULL, csa_settings);
+        if (!presp) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        rcu_assign_pointer(ifibss->presp, presp);
+        if (old_presp)
+                kfree_rcu(old_presp, rcu_head);
+
+        /* it might not send the beacon for a while. send an action frame
+         * immediately to announce the channel switch.
+         */
+        if (csa_settings)
+                ieee80211_send_action_csa(sdata, csa_settings);
+
+        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
+ out:
+        return ret;
+}
+
+int ieee80211_ibss_finish_csa(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+        struct cfg80211_bss *cbss;
+        int err;
+        u16 capability;
+
+        sdata_lock(sdata);
+        /* update cfg80211 bss information with the new channel */
+        if (!is_zero_ether_addr(ifibss->bssid)) {
+                capability = WLAN_CAPABILITY_IBSS;
+
+                if (ifibss->privacy)
+                        capability |= WLAN_CAPABILITY_PRIVACY;
+
+                cbss = cfg80211_get_bss(sdata->local->hw.wiphy,
+                                        ifibss->chandef.chan,
+                                        ifibss->bssid, ifibss->ssid,
+                                        ifibss->ssid_len, WLAN_CAPABILITY_IBSS |
+                                        WLAN_CAPABILITY_PRIVACY,
+                                        capability);
+                /* XXX: should not really modify cfg80211 data */
+                if (cbss) {
+                        cbss->channel = sdata->local->csa_chandef.chan;
+                        cfg80211_put_bss(sdata->local->hw.wiphy, cbss);
+                }
+        }
+
+        ifibss->chandef = sdata->local->csa_chandef;
+
+        /* generate the beacon */
+        err = ieee80211_ibss_csa_beacon(sdata, NULL);
+        sdata_unlock(sdata);
+        if (err < 0)
+                return err;
+
+        return 0;
+}
+
+void ieee80211_ibss_stop(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+
+        cancel_work_sync(&ifibss->csa_connection_drop_work);
+}
+
 static struct sta_info *ieee80211_ibss_finish_sta(struct sta_info *sta)
         __acquires(RCU)
 {
@@ -499,6 +691,295 @@ ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata, const u8 *bssid,
         return ieee80211_ibss_finish_sta(sta);
 }
 
+static int ieee80211_sta_active_ibss(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        int active = 0;
+        struct sta_info *sta;
+
+        sdata_assert_lock(sdata);
+
+        rcu_read_lock();
+
+        list_for_each_entry_rcu(sta, &local->sta_list, list) {
+                if (sta->sdata == sdata &&
+                    time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
+                               jiffies)) {
+                        active++;
+                        break;
+                }
+        }
+
+        rcu_read_unlock();
+
+        return active;
+}
+
+static void ieee80211_ibss_disconnect(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+        struct ieee80211_local *local = sdata->local;
+        struct cfg80211_bss *cbss;
+        struct beacon_data *presp;
+        struct sta_info *sta;
+        int active_ibss;
+        u16 capability;
+
+        active_ibss = ieee80211_sta_active_ibss(sdata);
+
+        if (!active_ibss && !is_zero_ether_addr(ifibss->bssid)) {
+                capability = WLAN_CAPABILITY_IBSS;
+
+                if (ifibss->privacy)
+                        capability |= WLAN_CAPABILITY_PRIVACY;
+
+                cbss = cfg80211_get_bss(local->hw.wiphy, ifibss->chandef.chan,
+                                        ifibss->bssid, ifibss->ssid,
+                                        ifibss->ssid_len, WLAN_CAPABILITY_IBSS |
+                                        WLAN_CAPABILITY_PRIVACY,
+                                        capability);
+
+                if (cbss) {
+                        cfg80211_unlink_bss(local->hw.wiphy, cbss);
+                        cfg80211_put_bss(sdata->local->hw.wiphy, cbss);
+                }
+        }
+
+        ifibss->state = IEEE80211_IBSS_MLME_SEARCH;
+
+        sta_info_flush(sdata);
+
+        spin_lock_bh(&ifibss->incomplete_lock);
+        while (!list_empty(&ifibss->incomplete_stations)) {
+                sta = list_first_entry(&ifibss->incomplete_stations,
+                                       struct sta_info, list);
+                list_del(&sta->list);
+                spin_unlock_bh(&ifibss->incomplete_lock);
+
+                sta_info_free(local, sta);
+                spin_lock_bh(&ifibss->incomplete_lock);
+        }
+        spin_unlock_bh(&ifibss->incomplete_lock);
+
+        netif_carrier_off(sdata->dev);
+
+        sdata->vif.bss_conf.ibss_joined = false;
+        sdata->vif.bss_conf.ibss_creator = false;
+        sdata->vif.bss_conf.enable_beacon = false;
+        sdata->vif.bss_conf.ssid_len = 0;
+
+        /* remove beacon */
+        presp = rcu_dereference_protected(ifibss->presp,
+                                          lockdep_is_held(&sdata->wdev.mtx));
+        RCU_INIT_POINTER(sdata->u.ibss.presp, NULL);
+        if (presp)
+                kfree_rcu(presp, rcu_head);
+
+        clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
+        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED |
+                                                BSS_CHANGED_IBSS);
+        drv_leave_ibss(local, sdata);
+        ieee80211_vif_release_channel(sdata);
+}
+
+static void ieee80211_csa_connection_drop_work(struct work_struct *work)
+{
+        struct ieee80211_sub_if_data *sdata =
+                container_of(work, struct ieee80211_sub_if_data,
+                             u.ibss.csa_connection_drop_work);
+
+        ieee80211_ibss_disconnect(sdata);
+        synchronize_rcu();
+        skb_queue_purge(&sdata->skb_queue);
+
+        /* trigger a scan to find another IBSS network to join */
+        ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+}
+
+static bool
+ieee80211_ibss_process_chanswitch(struct ieee80211_sub_if_data *sdata,
+                                  struct ieee802_11_elems *elems,
+                                  bool beacon)
+{
+        struct cfg80211_csa_settings params;
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+        struct ieee80211_chanctx_conf *chanctx_conf;
+        struct ieee80211_chanctx *chanctx;
+        enum nl80211_channel_type ch_type;
+        int err, num_chanctx;
+        u32 sta_flags;
+        u8 mode;
+
+        if (sdata->vif.csa_active)
+                return true;
+
+        if (!sdata->vif.bss_conf.ibss_joined)
+                return false;
+
+        sta_flags = IEEE80211_STA_DISABLE_VHT;
+        switch (ifibss->chandef.width) {
+        case NL80211_CHAN_WIDTH_5:
+        case NL80211_CHAN_WIDTH_10:
+        case NL80211_CHAN_WIDTH_20_NOHT:
+                sta_flags |= IEEE80211_STA_DISABLE_HT;
+                /* fall through */
+        case NL80211_CHAN_WIDTH_20:
+                sta_flags |= IEEE80211_STA_DISABLE_40MHZ;
+                break;
+        default:
+                break;
+        }
+
+        memset(&params, 0, sizeof(params));
+        err = ieee80211_parse_ch_switch_ie(sdata, elems, beacon,
+                                           ifibss->chandef.chan->band,
+                                           sta_flags, ifibss->bssid,
+                                           &params.count, &mode,
+                                           &params.chandef);
+
+        /* can't switch to destination channel, fail */
+        if (err < 0)
+                goto disconnect;
+
+        /* did not contain a CSA */
+        if (err)
+                return false;
+
+        if (ifibss->chandef.chan->band != params.chandef.chan->band)
+                goto disconnect;
+
+        switch (ifibss->chandef.width) {
+        case NL80211_CHAN_WIDTH_20_NOHT:
+        case NL80211_CHAN_WIDTH_20:
+        case NL80211_CHAN_WIDTH_40:
+                /* keep our current HT mode (HT20/HT40+/HT40-), even if
+                 * another mode  has been announced. The mode is not adopted
+                 * within the beacon while doing CSA and we should therefore
+                 * keep the mode which we announce.
+                 */
+                ch_type = cfg80211_get_chandef_type(&ifibss->chandef);
+                cfg80211_chandef_create(&params.chandef, params.chandef.chan,
+                                        ch_type);
+                break;
+        case NL80211_CHAN_WIDTH_5:
+        case NL80211_CHAN_WIDTH_10:
+                if (params.chandef.width != ifibss->chandef.width) {
+                        sdata_info(sdata,
+                                   "IBSS %pM received channel switch from incompatible channel width (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
+                                   ifibss->bssid,
+                                   params.chandef.chan->center_freq,
+                                   params.chandef.width,
+                                   params.chandef.center_freq1,
+                                   params.chandef.center_freq2);
+                        goto disconnect;
+                }
+                break;
+        default:
+                /* should not happen, sta_flags should prevent VHT modes. */
+                WARN_ON(1);
+                goto disconnect;
+        }
+
+        if (!cfg80211_chandef_usable(sdata->local->hw.wiphy, &params.chandef,
+                                     IEEE80211_CHAN_DISABLED)) {
+                sdata_info(sdata,
+                           "IBSS %pM switches to unsupported channel (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
+                           ifibss->bssid,
+                           params.chandef.chan->center_freq,
+                           params.chandef.width,
+                           params.chandef.center_freq1,
+                           params.chandef.center_freq2);
+                goto disconnect;
+        }
+
+        err = cfg80211_chandef_dfs_required(sdata->local->hw.wiphy,
+                                            &params.chandef);
+        if (err < 0)
+                goto disconnect;
+        if (err) {
+                params.radar_required = true;
+
+                /* TODO: IBSS-DFS not (yet) supported, disconnect. */
+                goto disconnect;
+        }
+
+        rcu_read_lock();
+        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
+        if (!chanctx_conf) {
+                rcu_read_unlock();
+                goto disconnect;
+        }
+
+        /* don't handle for multi-VIF cases */
+        chanctx = container_of(chanctx_conf, struct ieee80211_chanctx, conf);
+        if (chanctx->refcount > 1) {
+                rcu_read_unlock();
+                goto disconnect;
+        }
+        num_chanctx = 0;
+        list_for_each_entry_rcu(chanctx, &sdata->local->chanctx_list, list)
+                num_chanctx++;
+
+        if (num_chanctx > 1) {
+                rcu_read_unlock();
+                goto disconnect;
+        }
+        rcu_read_unlock();
+
+        /* all checks done, now perform the channel switch. */
+        ibss_dbg(sdata,
+                 "received channel switch announcement to go to channel %d MHz\n",
+                 params.chandef.chan->center_freq);
+
+        params.block_tx = !!mode;
+
+        ieee80211_ibss_csa_beacon(sdata, &params);
+        sdata->csa_radar_required = params.radar_required;
+
+        if (params.block_tx)
+                ieee80211_stop_queues_by_reason(&sdata->local->hw,
+                                IEEE80211_MAX_QUEUE_MAP,
+                                IEEE80211_QUEUE_STOP_REASON_CSA);
+
+        sdata->local->csa_chandef = params.chandef;
+        sdata->vif.csa_active = true;
+
+        ieee80211_bss_info_change_notify(sdata, err);
+        drv_channel_switch_beacon(sdata, &params.chandef);
+
+        return true;
+disconnect:
+        ibss_dbg(sdata, "Can't handle channel switch, disconnect\n");
+        ieee80211_queue_work(&sdata->local->hw,
+                             &ifibss->csa_connection_drop_work);
+
+        return true;
+}
+
+static void
+ieee80211_rx_mgmt_spectrum_mgmt(struct ieee80211_sub_if_data *sdata,
+                                struct ieee80211_mgmt *mgmt, size_t len,
+                                struct ieee80211_rx_status *rx_status,
+                                struct ieee802_11_elems *elems)
+{
+        int required_len;
+
+        if (len < IEEE80211_MIN_ACTION_SIZE + 1)
+                return;
+
+        /* CSA is the only action we handle for now */
+        if (mgmt->u.action.u.measurement.action_code !=
+            WLAN_ACTION_SPCT_CHL_SWITCH)
+                return;
+
+        required_len = IEEE80211_MIN_ACTION_SIZE +
+                       sizeof(mgmt->u.action.u.chan_switch);
+        if (len < required_len)
+                return;
+
+        ieee80211_ibss_process_chanswitch(sdata, elems, false);
+}
+
 static void ieee80211_rx_mgmt_deauth_ibss(struct ieee80211_sub_if_data *sdata,
                                           struct ieee80211_mgmt *mgmt,
                                           size_t len)
@@ -661,10 +1142,6 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
 
         /* check if we need to merge IBSS */
 
-        /* we use a fixed BSSID */
-        if (sdata->u.ibss.fixed_bssid)
-                goto put_bss;
-
         /* not an IBSS */
         if (!(cbss->capability & WLAN_CAPABILITY_IBSS))
                 goto put_bss;
@@ -680,10 +1157,18 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                                 sdata->u.ibss.ssid_len))
                 goto put_bss;
 
+        /* process channel switch */
+        if (ieee80211_ibss_process_chanswitch(sdata, elems, true))
+                goto put_bss;
+
         /* same BSSID */
         if (ether_addr_equal(cbss->bssid, sdata->u.ibss.bssid))
                 goto put_bss;
 
+        /* we use a fixed BSSID */
+        if (sdata->u.ibss.fixed_bssid)
+                goto put_bss;
+
         if (ieee80211_have_rx_timestamp(rx_status)) {
                 /* time when timestamp field was received */
                 rx_timestamp =
@@ -775,30 +1260,6 @@ void ieee80211_ibss_rx_no_sta(struct ieee80211_sub_if_data *sdata,
         ieee80211_queue_work(&local->hw, &sdata->work);
 }
 
-static int ieee80211_sta_active_ibss(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_local *local = sdata->local;
-        int active = 0;
-        struct sta_info *sta;
-
-        sdata_assert_lock(sdata);
-
-        rcu_read_lock();
-
-        list_for_each_entry_rcu(sta, &local->sta_list, list) {
-                if (sta->sdata == sdata &&
-                    time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
-                               jiffies)) {
-                        active++;
-                        break;
-                }
-        }
-
-        rcu_read_unlock();
-
-        return active;
-}
-
 static void ieee80211_ibss_sta_expire(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
@@ -1076,6 +1537,8 @@ void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_rx_status *rx_status;
         struct ieee80211_mgmt *mgmt;
         u16 fc;
+        struct ieee802_11_elems elems;
+        int ies_len;
 
         rx_status = IEEE80211_SKB_RXCB(skb);
         mgmt = (struct ieee80211_mgmt *) skb->data;
@@ -1101,6 +1564,27 @@ void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
         case IEEE80211_STYPE_DEAUTH:
                 ieee80211_rx_mgmt_deauth_ibss(sdata, mgmt, skb->len);
                 break;
+        case IEEE80211_STYPE_ACTION:
+                switch (mgmt->u.action.category) {
+                case WLAN_CATEGORY_SPECTRUM_MGMT:
+                        ies_len = skb->len -
+                                  offsetof(struct ieee80211_mgmt,
+                                           u.action.u.chan_switch.variable);
+
+                        if (ies_len < 0)
+                                break;
+
+                        ieee802_11_parse_elems(
+                                mgmt->u.action.u.chan_switch.variable,
+                                ies_len, true, &elems);
+
+                        if (elems.parse_error)
+                                break;
+
+                        ieee80211_rx_mgmt_spectrum_mgmt(sdata, mgmt, skb->len,
+                                                        rx_status, &elems);
+                        break;
+                }
         }
 
  mgmt_out:
@@ -1167,6 +1651,8 @@ void ieee80211_ibss_setup_sdata(struct ieee80211_sub_if_data *sdata)
                     (unsigned long) sdata);
         INIT_LIST_HEAD(&ifibss->incomplete_stations);
         spin_lock_init(&ifibss->incomplete_lock);
+        INIT_WORK(&ifibss->csa_connection_drop_work,
+                  ieee80211_csa_connection_drop_work);
 }
 
 /* scan finished notification */
@@ -1265,73 +1751,19 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
 int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
-        struct ieee80211_local *local = sdata->local;
-        struct cfg80211_bss *cbss;
-        u16 capability;
-        int active_ibss;
-        struct sta_info *sta;
-        struct beacon_data *presp;
-
-        active_ibss = ieee80211_sta_active_ibss(sdata);
-
-        if (!active_ibss && !is_zero_ether_addr(ifibss->bssid)) {
-                capability = WLAN_CAPABILITY_IBSS;
-
-                if (ifibss->privacy)
-                        capability |= WLAN_CAPABILITY_PRIVACY;
-
-                cbss = cfg80211_get_bss(local->hw.wiphy, ifibss->chandef.chan,
-                                        ifibss->bssid, ifibss->ssid,
-                                        ifibss->ssid_len, WLAN_CAPABILITY_IBSS |
-                                        WLAN_CAPABILITY_PRIVACY,
-                                        capability);
 
-                if (cbss) {
-                        cfg80211_unlink_bss(local->hw.wiphy, cbss);
-                        cfg80211_put_bss(local->hw.wiphy, cbss);
-                }
-        }
-
-        ifibss->state = IEEE80211_IBSS_MLME_SEARCH;
-        memset(ifibss->bssid, 0, ETH_ALEN);
+        ieee80211_ibss_disconnect(sdata);
         ifibss->ssid_len = 0;
-
-        sta_info_flush(sdata);
-
-        spin_lock_bh(&ifibss->incomplete_lock);
-        while (!list_empty(&ifibss->incomplete_stations)) {
-                sta = list_first_entry(&ifibss->incomplete_stations,
-                                       struct sta_info, list);
-                list_del(&sta->list);
-                spin_unlock_bh(&ifibss->incomplete_lock);
-
-                sta_info_free(local, sta);
-                spin_lock_bh(&ifibss->incomplete_lock);
-        }
-        spin_unlock_bh(&ifibss->incomplete_lock);
-
-        netif_carrier_off(sdata->dev);
+        memset(ifibss->bssid, 0, ETH_ALEN);
 
         /* remove beacon */
         kfree(sdata->u.ibss.ie);
-        presp = rcu_dereference_protected(ifibss->presp,
-                                          lockdep_is_held(&sdata->wdev.mtx));
-        RCU_INIT_POINTER(sdata->u.ibss.presp, NULL);
 
         /* on the next join, re-program HT parameters */
         memset(&ifibss->ht_capa, 0, sizeof(ifibss->ht_capa));
         memset(&ifibss->ht_capa_mask, 0, sizeof(ifibss->ht_capa_mask));
 
-        sdata->vif.bss_conf.ibss_joined = false;
-        sdata->vif.bss_conf.ibss_creator = false;
-        sdata->vif.bss_conf.enable_beacon = false;
-        sdata->vif.bss_conf.ssid_len = 0;
-        clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
-        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED |
-                                                BSS_CHANGED_IBSS);
-        ieee80211_vif_release_channel(sdata);
         synchronize_rcu();
-        kfree(presp);
 
         skb_queue_purge(&sdata->skb_queue);
 
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index b6186517ec56..3a87c8976a32 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -322,7 +322,6 @@ struct ieee80211_roc_work {
 
 /* flags used in struct ieee80211_if_managed.flags */
 enum ieee80211_sta_flags {
-        IEEE80211_STA_BEACON_POLL       = BIT(0),
         IEEE80211_STA_CONNECTION_POLL   = BIT(1),
         IEEE80211_STA_CONTROL_PORT      = BIT(2),
         IEEE80211_STA_DISABLE_HT        = BIT(4),
@@ -487,6 +486,7 @@ struct ieee80211_if_managed {
 
 struct ieee80211_if_ibss {
         struct timer_list timer;
+        struct work_struct csa_connection_drop_work;
 
         unsigned long last_scan_completed;
 
@@ -1330,6 +1330,10 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata);
 void ieee80211_ibss_work(struct ieee80211_sub_if_data *sdata);
 void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                                    struct sk_buff *skb);
+int ieee80211_ibss_csa_beacon(struct ieee80211_sub_if_data *sdata,
+                              struct cfg80211_csa_settings *csa_settings);
+int ieee80211_ibss_finish_csa(struct ieee80211_sub_if_data *sdata);
+void ieee80211_ibss_stop(struct ieee80211_sub_if_data *sdata);
 
 /* mesh code */
 void ieee80211_mesh_work(struct ieee80211_sub_if_data *sdata);
@@ -1481,6 +1485,29 @@ void ieee80211_apply_vhtcap_overrides(struct ieee80211_sub_if_data *sdata,
 void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
                                        struct ieee80211_mgmt *mgmt,
                                        size_t len);
+/**
+ * ieee80211_parse_ch_switch_ie - parses channel switch IEs
+ * @sdata: the sdata of the interface which has received the frame
+ * @elems: parsed 802.11 elements received with the frame
+ * @beacon: indicates if the frame was a beacon or probe response
+ * @current_band: indicates the current band
+ * @sta_flags: contains information about own capabilities and restrictions
+ *      to decide which channel switch announcements can be accepted. Only the
+ *      following subset of &enum ieee80211_sta_flags are evaluated:
+ *      %IEEE80211_STA_DISABLE_HT, %IEEE80211_STA_DISABLE_VHT,
+ *      %IEEE80211_STA_DISABLE_40MHZ, %IEEE80211_STA_DISABLE_80P80MHZ,
+ *      %IEEE80211_STA_DISABLE_160MHZ.
+ * @count: to be filled with the counter until the switch (on success only)
+ * @bssid: the currently connected bssid (for reporting)
+ * @mode: to be filled with CSA mode (on success only)
+ * @new_chandef: to be filled with destination chandef (on success only)
+ * Return: 0 on success, <0 on error and >0 if there is nothing to parse.
+ */
+int ieee80211_parse_ch_switch_ie(struct ieee80211_sub_if_data *sdata,
+                                 struct ieee802_11_elems *elems, bool beacon,
+                                 enum ieee80211_band current_band,
+                                 u32 sta_flags, u8 *bssid, u8 *count, u8 *mode,
+                                 struct cfg80211_chan_def *new_chandef);
 
 /* Suspend/resume and hw reconfiguration */
 int ieee80211_reconfig(struct ieee80211_local *local);
@@ -1654,6 +1681,7 @@ int ieee80211_add_ext_srates_ie(struct ieee80211_sub_if_data *sdata,
 void ieee80211_ht_oper_to_chandef(struct ieee80211_channel *control_chan,
                                   const struct ieee80211_ht_operation *ht_oper,
                                   struct cfg80211_chan_def *chandef);
+u32 ieee80211_chandef_downgrade(struct cfg80211_chan_def *c);
 
 int __must_check
 ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index fcecd633514e..e48f103b9ade 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -766,6 +766,10 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         if (sdata->vif.type == NL80211_IFTYPE_STATION)
                 ieee80211_mgd_stop(sdata);
 
+        if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                ieee80211_ibss_stop(sdata);
+
+
         /*
          * Remove all stations associated with this interface.
          *
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 620677e897bd..3e51dd7d98b3 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -879,7 +879,7 @@ ieee80211_gtk_rekey_add(struct ieee80211_vif *vif,
                                   keyconf->keylen, keyconf->key,
                                   0, NULL);
         if (IS_ERR(key))
-                return ERR_PTR(PTR_ERR(key));
+                return ERR_CAST(key);
 
         if (sdata->u.mgd.mfp != IEEE80211_MFP_DISABLED)
                 key->conf.flags |= IEEE80211_KEY_FLAG_RX_MGMT;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 86e4ad56b573..91cc8281e266 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -145,66 +145,6 @@ static int ecw2cw(int ecw)
         return (1 << ecw) - 1;
 }
 
-static u32 chandef_downgrade(struct cfg80211_chan_def *c)
-{
-        u32 ret;
-        int tmp;
-
-        switch (c->width) {
-        case NL80211_CHAN_WIDTH_20:
-                c->width = NL80211_CHAN_WIDTH_20_NOHT;
-                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
-                break;
-        case NL80211_CHAN_WIDTH_40:
-                c->width = NL80211_CHAN_WIDTH_20;
-                c->center_freq1 = c->chan->center_freq;
-                ret = IEEE80211_STA_DISABLE_40MHZ |
-                      IEEE80211_STA_DISABLE_VHT;
-                break;
-        case NL80211_CHAN_WIDTH_80:
-                tmp = (30 + c->chan->center_freq - c->center_freq1)/20;
-                /* n_P40 */
-                tmp /= 2;
-                /* freq_P40 */
-                c->center_freq1 = c->center_freq1 - 20 + 40 * tmp;
-                c->width = NL80211_CHAN_WIDTH_40;
-                ret = IEEE80211_STA_DISABLE_VHT;
-                break;
-        case NL80211_CHAN_WIDTH_80P80:
-                c->center_freq2 = 0;
-                c->width = NL80211_CHAN_WIDTH_80;
-                ret = IEEE80211_STA_DISABLE_80P80MHZ |
-                      IEEE80211_STA_DISABLE_160MHZ;
-                break;
-        case NL80211_CHAN_WIDTH_160:
-                /* n_P20 */
-                tmp = (70 + c->chan->center_freq - c->center_freq1)/20;
-                /* n_P80 */
-                tmp /= 4;
-                c->center_freq1 = c->center_freq1 - 40 + 80 * tmp;
-                c->width = NL80211_CHAN_WIDTH_80;
-                ret = IEEE80211_STA_DISABLE_80P80MHZ |
-                      IEEE80211_STA_DISABLE_160MHZ;
-                break;
-        default:
-        case NL80211_CHAN_WIDTH_20_NOHT:
-                WARN_ON_ONCE(1);
-                c->width = NL80211_CHAN_WIDTH_20_NOHT;
-                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
-                break;
-        case NL80211_CHAN_WIDTH_5:
-        case NL80211_CHAN_WIDTH_10:
-                WARN_ON_ONCE(1);
-                /* keep c->width */
-                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
-                break;
-        }
-
-        WARN_ON_ONCE(!cfg80211_chandef_valid(c));
-
-        return ret;
-}
-
 static u32
 ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
                              struct ieee80211_supported_band *sband,
@@ -352,7 +292,7 @@ out:
                         break;
                 }
 
-                ret |= chandef_downgrade(chandef);
+                ret |= ieee80211_chandef_downgrade(chandef);
         }
 
         if (chandef->width != vht_chandef.width && !tracking)
@@ -406,13 +346,13 @@ static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
          */
         if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
             chandef.width == NL80211_CHAN_WIDTH_80P80)
-                flags |= chandef_downgrade(&chandef);
+                flags |= ieee80211_chandef_downgrade(&chandef);
         if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
             chandef.width == NL80211_CHAN_WIDTH_160)
-                flags |= chandef_downgrade(&chandef);
+                flags |= ieee80211_chandef_downgrade(&chandef);
         if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
             chandef.width > NL80211_CHAN_WIDTH_20)
-                flags |= chandef_downgrade(&chandef);
+                flags |= ieee80211_chandef_downgrade(&chandef);
 
         if (cfg80211_chandef_identical(&chandef, &sdata->vif.bss_conf.chandef))
                 return 0;
@@ -893,8 +833,7 @@ void ieee80211_send_nullfunc(struct ieee80211_local *local,
         if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
 
-        if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
-                            IEEE80211_STA_CONNECTION_POLL))
+        if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
 
         ieee80211_tx_skb(sdata, skb);
@@ -937,6 +876,8 @@ static void ieee80211_chswitch_work(struct work_struct *work)
                 container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        u32 changed = 0;
+        int ret;
 
         if (!ieee80211_sdata_running(sdata))
                 return;
@@ -945,24 +886,39 @@ static void ieee80211_chswitch_work(struct work_struct *work)
         if (!ifmgd->associated)
                 goto out;
 
-        local->_oper_chandef = local->csa_chandef;
+        ret = ieee80211_vif_change_channel(sdata, &local->csa_chandef,
+                                           &changed);
+        if (ret) {
+                sdata_info(sdata,
+                           "vif channel switch failed, disconnecting\n");
+                ieee80211_queue_work(&sdata->local->hw,
+                                     &ifmgd->csa_connection_drop_work);
+                goto out;
+        }
 
-        if (!local->ops->channel_switch) {
-                /* call "hw_config" only if doing sw channel switch */
-                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
-        } else {
-                /* update the device channel directly */
-                local->hw.conf.chandef = local->_oper_chandef;
+        if (!local->use_chanctx) {
+                local->_oper_chandef = local->csa_chandef;
+                /* Call "hw_config" only if doing sw channel switch.
+                 * Otherwise update the channel directly
+                 */
+                if (!local->ops->channel_switch)
+                        ieee80211_hw_config(local, 0);
+                else
+                        local->hw.conf.chandef = local->_oper_chandef;
         }
 
         /* XXX: shouldn't really modify cfg80211-owned data! */
-        ifmgd->associated->channel = local->_oper_chandef.chan;
+        ifmgd->associated->channel = local->csa_chandef.chan;
 
         /* XXX: wait for a beacon first? */
         ieee80211_wake_queues_by_reason(&local->hw,
                                         IEEE80211_MAX_QUEUE_MAP,
                                         IEEE80211_QUEUE_STOP_REASON_CSA);
+
+        ieee80211_bss_info_change_notify(sdata, changed);
+
  out:
+        sdata->vif.csa_active = false;
         ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
         sdata_unlock(sdata);
 }
@@ -1000,20 +956,12 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct cfg80211_bss *cbss = ifmgd->associated;
-        struct ieee80211_bss *bss;
         struct ieee80211_chanctx *chanctx;
-        enum ieee80211_band new_band;
-        int new_freq;
-        u8 new_chan_no;
+        enum ieee80211_band current_band;
         u8 count;
         u8 mode;
-        struct ieee80211_channel *new_chan;
         struct cfg80211_chan_def new_chandef = {};
-        struct cfg80211_chan_def new_vht_chandef = {};
-        const struct ieee80211_sec_chan_offs_ie *sec_chan_offs;
-        const struct ieee80211_wide_bw_chansw_ie *wide_bw_chansw_ie;
-        const struct ieee80211_ht_operation *ht_oper;
-        int secondary_channel_offset = -1;
+        int res;
 
         sdata_assert_lock(sdata);
 
@@ -1027,162 +975,23 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         if (ifmgd->flags & IEEE80211_STA_CSA_RECEIVED)
                 return;
 
-        sec_chan_offs = elems->sec_chan_offs;
-        wide_bw_chansw_ie = elems->wide_bw_chansw_ie;
-        ht_oper = elems->ht_operation;
-
-        if (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
-                            IEEE80211_STA_DISABLE_40MHZ)) {
-                sec_chan_offs = NULL;
-                wide_bw_chansw_ie = NULL;
-                /* only used for bandwidth here */
-                ht_oper = NULL;
-        }
-
-        if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
-                wide_bw_chansw_ie = NULL;
-
-        if (elems->ext_chansw_ie) {
-                if (!ieee80211_operating_class_to_band(
-                                elems->ext_chansw_ie->new_operating_class,
-                                &new_band)) {
-                        sdata_info(sdata,
-                                   "cannot understand ECSA IE operating class %d, disconnecting\n",
-                                   elems->ext_chansw_ie->new_operating_class);
-                        ieee80211_queue_work(&local->hw,
-                                             &ifmgd->csa_connection_drop_work);
-                }
-                new_chan_no = elems->ext_chansw_ie->new_ch_num;
-                count = elems->ext_chansw_ie->count;
-                mode = elems->ext_chansw_ie->mode;
-        } else if (elems->ch_switch_ie) {
-                new_band = cbss->channel->band;
-                new_chan_no = elems->ch_switch_ie->new_ch_num;
-                count = elems->ch_switch_ie->count;
-                mode = elems->ch_switch_ie->mode;
-        } else {
-                /* nothing here we understand */
-                return;
-        }
-
-        bss = (void *)cbss->priv;
-
-        new_freq = ieee80211_channel_to_frequency(new_chan_no, new_band);
-        new_chan = ieee80211_get_channel(sdata->local->hw.wiphy, new_freq);
-        if (!new_chan || new_chan->flags & IEEE80211_CHAN_DISABLED) {
-                sdata_info(sdata,
-                           "AP %pM switches to unsupported channel (%d MHz), disconnecting\n",
-                           ifmgd->associated->bssid, new_freq);
+        current_band = cbss->channel->band;
+        res = ieee80211_parse_ch_switch_ie(sdata, elems, beacon, current_band,
+                                           ifmgd->flags,
+                                           ifmgd->associated->bssid, &count,
+                                           &mode, &new_chandef);
+        if (res < 0)
                 ieee80211_queue_work(&local->hw,
                                      &ifmgd->csa_connection_drop_work);
+        if (res)
                 return;
-        }
-
-        if (!beacon && sec_chan_offs) {
-                secondary_channel_offset = sec_chan_offs->sec_chan_offs;
-        } else if (beacon && ht_oper) {
-                secondary_channel_offset =
-                        ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET;
-        } else if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
-                /*
-                 * If it's not a beacon, HT is enabled and the IE not present,
-                 * it's 20 MHz, 802.11-2012 8.5.2.6:
-                 *      This element [the Secondary Channel Offset Element] is
-                 *      present when switching to a 40 MHz channel. It may be
-                 *      present when switching to a 20 MHz channel (in which
-                 *      case the secondary channel offset is set to SCN).
-                 */
-                secondary_channel_offset = IEEE80211_HT_PARAM_CHA_SEC_NONE;
-        }
-
-        switch (secondary_channel_offset) {
-        default:
-                /* secondary_channel_offset was present but is invalid */
-        case IEEE80211_HT_PARAM_CHA_SEC_NONE:
-                cfg80211_chandef_create(&new_chandef, new_chan,
-                                        NL80211_CHAN_HT20);
-                break;
-        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
-                cfg80211_chandef_create(&new_chandef, new_chan,
-                                        NL80211_CHAN_HT40PLUS);
-                break;
-        case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
-                cfg80211_chandef_create(&new_chandef, new_chan,
-                                        NL80211_CHAN_HT40MINUS);
-                break;
-        case -1:
-                cfg80211_chandef_create(&new_chandef, new_chan,
-                                        NL80211_CHAN_NO_HT);
-                /* keep width for 5/10 MHz channels */
-                switch (sdata->vif.bss_conf.chandef.width) {
-                case NL80211_CHAN_WIDTH_5:
-                case NL80211_CHAN_WIDTH_10:
-                        new_chandef.width = sdata->vif.bss_conf.chandef.width;
-                        break;
-                default:
-                        break;
-                }
-                break;
-        }
-
-        if (wide_bw_chansw_ie) {
-                new_vht_chandef.chan = new_chan;
-                new_vht_chandef.center_freq1 =
-                        ieee80211_channel_to_frequency(
-                                wide_bw_chansw_ie->new_center_freq_seg0,
-                                new_band);
-
-                switch (wide_bw_chansw_ie->new_channel_width) {
-                default:
-                        /* hmmm, ignore VHT and use HT if present */
-                case IEEE80211_VHT_CHANWIDTH_USE_HT:
-                        new_vht_chandef.chan = NULL;
-                        break;
-                case IEEE80211_VHT_CHANWIDTH_80MHZ:
-                        new_vht_chandef.width = NL80211_CHAN_WIDTH_80;
-                        break;
-                case IEEE80211_VHT_CHANWIDTH_160MHZ:
-                        new_vht_chandef.width = NL80211_CHAN_WIDTH_160;
-                        break;
-                case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
-                        /* field is otherwise reserved */
-                        new_vht_chandef.center_freq2 =
-                                ieee80211_channel_to_frequency(
-                                        wide_bw_chansw_ie->new_center_freq_seg1,
-                                        new_band);
-                        new_vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
-                        break;
-                }
-                if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
-                    new_vht_chandef.width == NL80211_CHAN_WIDTH_80P80)
-                        chandef_downgrade(&new_vht_chandef);
-                if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
-                    new_vht_chandef.width == NL80211_CHAN_WIDTH_160)
-                        chandef_downgrade(&new_vht_chandef);
-                if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
-                    new_vht_chandef.width > NL80211_CHAN_WIDTH_20)
-                        chandef_downgrade(&new_vht_chandef);
-        }
-
-        /* if VHT data is there validate & use it */
-        if (new_vht_chandef.chan) {
-                if (!cfg80211_chandef_compatible(&new_vht_chandef,
-                                                 &new_chandef)) {
-                        sdata_info(sdata,
-                                   "AP %pM CSA has inconsistent channel data, disconnecting\n",
-                                   ifmgd->associated->bssid);
-                        ieee80211_queue_work(&local->hw,
-                                             &ifmgd->csa_connection_drop_work);
-                        return;
-                }
-                new_chandef = new_vht_chandef;
-        }
 
         if (!cfg80211_chandef_usable(local->hw.wiphy, &new_chandef,
                                      IEEE80211_CHAN_DISABLED)) {
                 sdata_info(sdata,
                            "AP %pM switches to unsupported channel (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
-                           ifmgd->associated->bssid, new_freq,
+                           ifmgd->associated->bssid,
+                           new_chandef.chan->center_freq,
                            new_chandef.width, new_chandef.center_freq1,
                            new_chandef.center_freq2);
                 ieee80211_queue_work(&local->hw,
@@ -1191,17 +1000,28 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         }
 
         ifmgd->flags |= IEEE80211_STA_CSA_RECEIVED;
+        sdata->vif.csa_active = true;
 
+        mutex_lock(&local->chanctx_mtx);
         if (local->use_chanctx) {
-                sdata_info(sdata,
-                           "not handling channel switch with channel contexts\n");
-                ieee80211_queue_work(&local->hw,
-                                     &ifmgd->csa_connection_drop_work);
-                return;
+                u32 num_chanctx = 0;
+                list_for_each_entry(chanctx, &local->chanctx_list, list)
+                       num_chanctx++;
+
+                if (num_chanctx > 1 ||
+                    !(local->hw.flags & IEEE80211_HW_CHANCTX_STA_CSA)) {
+                        sdata_info(sdata,
+                                   "not handling chan-switch with channel contexts\n");
+                        ieee80211_queue_work(&local->hw,
+                                             &ifmgd->csa_connection_drop_work);
+                        mutex_unlock(&local->chanctx_mtx);
+                        return;
+                }
         }
 
-        mutex_lock(&local->chanctx_mtx);
         if (WARN_ON(!rcu_access_pointer(sdata->vif.chanctx_conf))) {
+                ieee80211_queue_work(&local->hw,
+                                     &ifmgd->csa_connection_drop_work);
                 mutex_unlock(&local->chanctx_mtx);
                 return;
         }
@@ -1374,8 +1194,7 @@ static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
         if (!mgd->associated)
                 return false;
 
-        if (mgd->flags & (IEEE80211_STA_BEACON_POLL |
-                          IEEE80211_STA_CONNECTION_POLL))
+        if (mgd->flags & IEEE80211_STA_CONNECTION_POLL)
                 return false;
 
         if (!mgd->have_beacon)
@@ -1691,8 +1510,7 @@ static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
 {
         lockdep_assert_held(&sdata->local->mtx);
 
-        sdata->u.mgd.flags &= ~(IEEE80211_STA_CONNECTION_POLL |
-                                IEEE80211_STA_BEACON_POLL);
+        sdata->u.mgd.flags &= ~IEEE80211_STA_CONNECTION_POLL;
         ieee80211_run_deferred_scan(sdata->local);
 }
 
@@ -1954,11 +1772,8 @@ static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_local *local = sdata->local;
 
         mutex_lock(&local->mtx);
-        if (!(ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
-                              IEEE80211_STA_CONNECTION_POLL))) {
-                mutex_unlock(&local->mtx);
-                return;
-        }
+        if (!(ifmgd->flags & IEEE80211_STA_CONNECTION_POLL))
+                goto out;
 
         __ieee80211_stop_poll(sdata);
 
@@ -2094,15 +1909,9 @@ static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
          * because otherwise we would reset the timer every time and
          * never check whether we received a probe response!
          */
-        if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
-                            IEEE80211_STA_CONNECTION_POLL))
+        if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
                 already = true;
 
-        if (beacon)
-                ifmgd->flags |= IEEE80211_STA_BEACON_POLL;
-        else
-                ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;
-
         mutex_unlock(&sdata->local->mtx);
 
         if (already)
@@ -2174,6 +1983,7 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
                                WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
                                true, frame_buf);
         ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
+        sdata->vif.csa_active = false;
         ieee80211_wake_queues_by_reason(&sdata->local->hw,
                                         IEEE80211_MAX_QUEUE_MAP,
                                         IEEE80211_QUEUE_STOP_REASON_CSA);
@@ -3061,17 +2871,10 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                 }
         }
 
-        if (ifmgd->flags & IEEE80211_STA_BEACON_POLL) {
+        if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL) {
                 mlme_dbg_ratelimited(sdata,
                                      "cancelling AP probe due to a received beacon\n");
-                mutex_lock(&local->mtx);
-                ifmgd->flags &= ~IEEE80211_STA_BEACON_POLL;
-                ieee80211_run_deferred_scan(local);
-                mutex_unlock(&local->mtx);
-
-                mutex_lock(&local->iflist_mtx);
-                ieee80211_recalc_ps(local, -1);
-                mutex_unlock(&local->iflist_mtx);
+                ieee80211_reset_ap_probe(sdata);
         }
 
         /*
@@ -3543,8 +3346,7 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
         } else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
                 run_again(sdata, ifmgd->assoc_data->timeout);
 
-        if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
-                            IEEE80211_STA_CONNECTION_POLL) &&
+        if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL &&
             ifmgd->associated) {
                 u8 bssid[ETH_ALEN];
                 int max_tries;
@@ -3876,7 +3678,7 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
                 return ret;
 
         while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
-                ifmgd->flags |= chandef_downgrade(&chandef);
+                ifmgd->flags |= ieee80211_chandef_downgrade(&chandef);
                 ret = ieee80211_vif_use_channel(sdata, &chandef,
                                                 IEEE80211_CHANCTX_SHARED);
         }
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 8b5f7ef7c0c9..7fa1b36e6202 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -203,6 +203,15 @@ minstrel_update_stats(struct minstrel_priv *mp, struct minstrel_sta_info *mi)
         memcpy(mi->max_tp_rate, tmp_tp_rate, sizeof(mi->max_tp_rate));
         mi->max_prob_rate = tmp_prob_rate;
 
+#ifdef CONFIG_MAC80211_DEBUGFS
+        /* use fixed index if set */
+        if (mp->fixed_rate_idx != -1) {
+                mi->max_tp_rate[0] = mp->fixed_rate_idx;
+                mi->max_tp_rate[1] = mp->fixed_rate_idx;
+                mi->max_prob_rate = mp->fixed_rate_idx;
+        }
+#endif
+
         /* Reset update timer */
         mi->stats_update = jiffies;
 
@@ -310,6 +319,11 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
         /* increase sum packet counter */
         mi->packet_count++;
 
+#ifdef CONFIG_MAC80211_DEBUGFS
+        if (mp->fixed_rate_idx != -1)
+                return;
+#endif
+
         delta = (mi->packet_count * sampling_ratio / 100) -
                         (mi->sample_count + mi->sample_deferred / 2);
 
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index 7c323f27ba23..5d60779a0c1b 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -365,6 +365,14 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
                 }
         }
 
+#ifdef CONFIG_MAC80211_DEBUGFS
+        /* use fixed index if set */
+        if (mp->fixed_rate_idx != -1) {
+                mi->max_tp_rate = mp->fixed_rate_idx;
+                mi->max_tp_rate2 = mp->fixed_rate_idx;
+                mi->max_prob_rate = mp->fixed_rate_idx;
+        }
+#endif
 
         mi->stats_update = jiffies;
 }
@@ -774,6 +782,11 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
         info->flags |= mi->tx_flags;
         minstrel_ht_check_cck_shortpreamble(mp, mi, txrc->short_preamble);
 
+#ifdef CONFIG_MAC80211_DEBUGFS
+        if (mp->fixed_rate_idx != -1)
+                return;
+#endif
+
         /* Don't use EAPOL frames for sampling on non-mrr hw */
         if (mp->hw->max_rates == 1 &&
             (info->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO))
@@ -781,16 +794,6 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
         else
                 sample_idx = minstrel_get_sample_rate(mp, mi);
 
-#ifdef CONFIG_MAC80211_DEBUGFS
-        /* use fixed index if set */
-        if (mp->fixed_rate_idx != -1) {
-                mi->max_tp_rate = mp->fixed_rate_idx;
-                mi->max_tp_rate2 = mp->fixed_rate_idx;
-                mi->max_prob_rate = mp->fixed_rate_idx;
-                sample_idx = -1;
-        }
-#endif
-
         mi->total_packets++;
 
         /* wraparound */
diff --git a/net/mac80211/rc80211_pid_debugfs.c b/net/mac80211/rc80211_pid_debugfs.c
index c97a0657c043..6ff134650a84 100644
--- a/net/mac80211/rc80211_pid_debugfs.c
+++ b/net/mac80211/rc80211_pid_debugfs.c
@@ -167,29 +167,29 @@ static ssize_t rate_control_pid_events_read(struct file *file, char __user *buf,
          * provide large enough buffers. */
         length = length < RC_PID_PRINT_BUF_SIZE ?
                  length : RC_PID_PRINT_BUF_SIZE;
-        p = snprintf(pb, length, "%u %lu ", ev->id, ev->timestamp);
+        p = scnprintf(pb, length, "%u %lu ", ev->id, ev->timestamp);
         switch (ev->type) {
         case RC_PID_EVENT_TYPE_TX_STATUS:
-                p += snprintf(pb + p, length - p, "tx_status %u %u",
-                              !(ev->data.flags & IEEE80211_TX_STAT_ACK),
-                              ev->data.tx_status.status.rates[0].idx);
+                p += scnprintf(pb + p, length - p, "tx_status %u %u",
+                               !(ev->data.flags & IEEE80211_TX_STAT_ACK),
+                               ev->data.tx_status.status.rates[0].idx);
                 break;
         case RC_PID_EVENT_TYPE_RATE_CHANGE:
-                p += snprintf(pb + p, length - p, "rate_change %d %d",
-                              ev->data.index, ev->data.rate);
+                p += scnprintf(pb + p, length - p, "rate_change %d %d",
+                               ev->data.index, ev->data.rate);
                 break;
         case RC_PID_EVENT_TYPE_TX_RATE:
-                p += snprintf(pb + p, length - p, "tx_rate %d %d",
-                              ev->data.index, ev->data.rate);
+                p += scnprintf(pb + p, length - p, "tx_rate %d %d",
+                               ev->data.index, ev->data.rate);
                 break;
         case RC_PID_EVENT_TYPE_PF_SAMPLE:
-                p += snprintf(pb + p, length - p,
-                              "pf_sample %d %d %d %d",
-                              ev->data.pf_sample, ev->data.prop_err,
-                              ev->data.int_err, ev->data.der_err);
+                p += scnprintf(pb + p, length - p,
+                               "pf_sample %d %d %d %d",
+                               ev->data.pf_sample, ev->data.prop_err,
+                               ev->data.int_err, ev->data.der_err);
                 break;
         }
-        p += snprintf(pb + p, length - p, "\n");
+        p += scnprintf(pb + p, length - p, "\n");
 
         spin_unlock_irqrestore(&events->lock, status);
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 54395d7583ba..f0247a43a75c 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -995,8 +995,9 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
                                 rx->sta->num_duplicates++;
                         }
                         return RX_DROP_UNUSABLE;
-                } else
+                } else if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
                         rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;
+                }
         }
 
         if (unlikely(rx->skb->len < 16)) {
@@ -2402,7 +2403,8 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                 return RX_DROP_UNUSABLE;
 
         if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
-            mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED)
+            mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED &&
+            mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
                 return RX_DROP_UNUSABLE;
 
         if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
@@ -2566,31 +2568,46 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
 
                 goto queue;
         case WLAN_CATEGORY_SPECTRUM_MGMT:
-                if (status->band != IEEE80211_BAND_5GHZ)
-                        break;
-
-                if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                        break;
-
                 /* verify action_code is present */
                 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
                         break;
 
                 switch (mgmt->u.action.u.measurement.action_code) {
                 case WLAN_ACTION_SPCT_MSR_REQ:
+                        if (status->band != IEEE80211_BAND_5GHZ)
+                                break;
+
                         if (len < (IEEE80211_MIN_ACTION_SIZE +
                                    sizeof(mgmt->u.action.u.measurement)))
                                 break;
+
+                        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                                break;
+
                         ieee80211_process_measurement_req(sdata, mgmt, len);
                         goto handled;
-                case WLAN_ACTION_SPCT_CHL_SWITCH:
-                        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                case WLAN_ACTION_SPCT_CHL_SWITCH: {
+                        u8 *bssid;
+                        if (len < (IEEE80211_MIN_ACTION_SIZE +
+                                   sizeof(mgmt->u.action.u.chan_switch)))
+                                break;
+
+                        if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+                            sdata->vif.type != NL80211_IFTYPE_ADHOC)
                                 break;
 
-                        if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid))
+                        if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                                bssid = sdata->u.mgd.bssid;
+                        else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                                bssid = sdata->u.ibss.bssid;
+                        else
+                                break;
+
+                        if (!ether_addr_equal(mgmt->bssid, bssid))
                                 break;
 
                         goto queue;
+                        }
                 }
                 break;
         case WLAN_CATEGORY_SA_QUERY:
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 08afe74b98f4..ecb57b0bf74a 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -391,8 +391,7 @@ static bool ieee80211_can_scan(struct ieee80211_local *local,
                 return false;
 
         if (sdata->vif.type == NL80211_IFTYPE_STATION &&
-            sdata->u.mgd.flags & (IEEE80211_STA_BEACON_POLL |
-                                  IEEE80211_STA_CONNECTION_POLL))
+            sdata->u.mgd.flags & IEEE80211_STA_CONNECTION_POLL)
                 return false;
 
         return true;
diff --git a/net/mac80211/spectmgmt.c b/net/mac80211/spectmgmt.c
index 578eea3fc04d..921597e279a3 100644
--- a/net/mac80211/spectmgmt.c
+++ b/net/mac80211/spectmgmt.c
@@ -21,6 +21,168 @@
 #include "sta_info.h"
 #include "wme.h"
 
+int ieee80211_parse_ch_switch_ie(struct ieee80211_sub_if_data *sdata,
+                                 struct ieee802_11_elems *elems, bool beacon,
+                                 enum ieee80211_band current_band,
+                                 u32 sta_flags, u8 *bssid, u8 *count, u8 *mode,
+                                 struct cfg80211_chan_def *new_chandef)
+{
+        enum ieee80211_band new_band;
+        int new_freq;
+        u8 new_chan_no;
+        struct ieee80211_channel *new_chan;
+        struct cfg80211_chan_def new_vht_chandef = {};
+        const struct ieee80211_sec_chan_offs_ie *sec_chan_offs;
+        const struct ieee80211_wide_bw_chansw_ie *wide_bw_chansw_ie;
+        const struct ieee80211_ht_operation *ht_oper;
+        int secondary_channel_offset = -1;
+
+        sec_chan_offs = elems->sec_chan_offs;
+        wide_bw_chansw_ie = elems->wide_bw_chansw_ie;
+        ht_oper = elems->ht_operation;
+
+        if (sta_flags & (IEEE80211_STA_DISABLE_HT |
+                         IEEE80211_STA_DISABLE_40MHZ)) {
+                sec_chan_offs = NULL;
+                wide_bw_chansw_ie = NULL;
+                /* only used for bandwidth here */
+                ht_oper = NULL;
+        }
+
+        if (sta_flags & IEEE80211_STA_DISABLE_VHT)
+                wide_bw_chansw_ie = NULL;
+
+        if (elems->ext_chansw_ie) {
+                if (!ieee80211_operating_class_to_band(
+                                elems->ext_chansw_ie->new_operating_class,
+                                &new_band)) {
+                        sdata_info(sdata,
+                                   "cannot understand ECSA IE operating class %d, disconnecting\n",
+                                   elems->ext_chansw_ie->new_operating_class);
+                        return -EINVAL;
+                }
+                new_chan_no = elems->ext_chansw_ie->new_ch_num;
+                *count = elems->ext_chansw_ie->count;
+                *mode = elems->ext_chansw_ie->mode;
+        } else if (elems->ch_switch_ie) {
+                new_band = current_band;
+                new_chan_no = elems->ch_switch_ie->new_ch_num;
+                *count = elems->ch_switch_ie->count;
+                *mode = elems->ch_switch_ie->mode;
+        } else {
+                /* nothing here we understand */
+                return 1;
+        }
+
+        new_freq = ieee80211_channel_to_frequency(new_chan_no, new_band);
+        new_chan = ieee80211_get_channel(sdata->local->hw.wiphy, new_freq);
+        if (!new_chan || new_chan->flags & IEEE80211_CHAN_DISABLED) {
+                sdata_info(sdata,
+                           "BSS %pM switches to unsupported channel (%d MHz), disconnecting\n",
+                           bssid, new_freq);
+                return -EINVAL;
+        }
+
+        if (!beacon && sec_chan_offs) {
+                secondary_channel_offset = sec_chan_offs->sec_chan_offs;
+        } else if (beacon && ht_oper) {
+                secondary_channel_offset =
+                        ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET;
+        } else if (!(sta_flags & IEEE80211_STA_DISABLE_HT)) {
+                /* If it's not a beacon, HT is enabled and the IE not present,
+                 * it's 20 MHz, 802.11-2012 8.5.2.6:
+                 *      This element [the Secondary Channel Offset Element] is
+                 *      present when switching to a 40 MHz channel. It may be
+                 *      present when switching to a 20 MHz channel (in which
+                 *      case the secondary channel offset is set to SCN).
+                 */
+                secondary_channel_offset = IEEE80211_HT_PARAM_CHA_SEC_NONE;
+        }
+
+        switch (secondary_channel_offset) {
+        default:
+                /* secondary_channel_offset was present but is invalid */
+        case IEEE80211_HT_PARAM_CHA_SEC_NONE:
+                cfg80211_chandef_create(new_chandef, new_chan,
+                                        NL80211_CHAN_HT20);
+                break;
+        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
+                cfg80211_chandef_create(new_chandef, new_chan,
+                                        NL80211_CHAN_HT40PLUS);
+                break;
+        case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
+                cfg80211_chandef_create(new_chandef, new_chan,
+                                        NL80211_CHAN_HT40MINUS);
+                break;
+        case -1:
+                cfg80211_chandef_create(new_chandef, new_chan,
+                                        NL80211_CHAN_NO_HT);
+                /* keep width for 5/10 MHz channels */
+                switch (sdata->vif.bss_conf.chandef.width) {
+                case NL80211_CHAN_WIDTH_5:
+                case NL80211_CHAN_WIDTH_10:
+                        new_chandef->width = sdata->vif.bss_conf.chandef.width;
+                        break;
+                default:
+                        break;
+                }
+                break;
+        }
+
+        if (wide_bw_chansw_ie) {
+                new_vht_chandef.chan = new_chan;
+                new_vht_chandef.center_freq1 =
+                        ieee80211_channel_to_frequency(
+                                wide_bw_chansw_ie->new_center_freq_seg0,
+                                new_band);
+
+                switch (wide_bw_chansw_ie->new_channel_width) {
+                default:
+                        /* hmmm, ignore VHT and use HT if present */
+                case IEEE80211_VHT_CHANWIDTH_USE_HT:
+                        new_vht_chandef.chan = NULL;
+                        break;
+                case IEEE80211_VHT_CHANWIDTH_80MHZ:
+                        new_vht_chandef.width = NL80211_CHAN_WIDTH_80;
+                        break;
+                case IEEE80211_VHT_CHANWIDTH_160MHZ:
+                        new_vht_chandef.width = NL80211_CHAN_WIDTH_160;
+                        break;
+                case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
+                        /* field is otherwise reserved */
+                        new_vht_chandef.center_freq2 =
+                                ieee80211_channel_to_frequency(
+                                        wide_bw_chansw_ie->new_center_freq_seg1,
+                                        new_band);
+                        new_vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
+                        break;
+                }
+                if (sta_flags & IEEE80211_STA_DISABLE_80P80MHZ &&
+                    new_vht_chandef.width == NL80211_CHAN_WIDTH_80P80)
+                        ieee80211_chandef_downgrade(&new_vht_chandef);
+                if (sta_flags & IEEE80211_STA_DISABLE_160MHZ &&
+                    new_vht_chandef.width == NL80211_CHAN_WIDTH_160)
+                        ieee80211_chandef_downgrade(&new_vht_chandef);
+                if (sta_flags & IEEE80211_STA_DISABLE_40MHZ &&
+                    new_vht_chandef.width > NL80211_CHAN_WIDTH_20)
+                        ieee80211_chandef_downgrade(&new_vht_chandef);
+        }
+
+        /* if VHT data is there validate & use it */
+        if (new_vht_chandef.chan) {
+                if (!cfg80211_chandef_compatible(&new_vht_chandef,
+                                                 new_chandef)) {
+                        sdata_info(sdata,
+                                   "BSS %pM: CSA has inconsistent channel data, disconnecting\n",
+                                   bssid);
+                        return -EINVAL;
+                }
+                *new_chandef = new_vht_chandef;
+        }
+
+        return 0;
+}
+
 static void ieee80211_send_refuse_measurement_request(struct ieee80211_sub_if_data *sdata,
                                         struct ieee80211_msrment_ie *request_ie,
                                         const u8 *da, const u8 *bssid,
diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
index 1aba645882bd..5d62c5804819 100644
--- a/net/mac80211/trace.h
+++ b/net/mac80211/trace.h
@@ -1475,6 +1475,41 @@ DEFINE_EVENT(local_sdata_evt, drv_ipv6_addr_change,
 );
 #endif
 
+TRACE_EVENT(drv_join_ibss,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
+                 struct ieee80211_bss_conf *info),
+
+        TP_ARGS(local, sdata, info),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                __field(u8, dtimper)
+                __field(u16, bcnint)
+                __dynamic_array(u8, ssid, info->ssid_len);
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                __entry->dtimper = info->dtim_period;
+                __entry->bcnint = info->beacon_int;
+                memcpy(__get_dynamic_array(ssid), info->ssid, info->ssid_len);
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT  VIF_PR_FMT,
+                LOCAL_PR_ARG, VIF_PR_ARG
+        )
+);
+
+DEFINE_EVENT(local_sdata_evt, drv_leave_ibss,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata),
+        TP_ARGS(local, sdata)
+);
+
 /*
  * Tracing for API calls that drivers call.
  */
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 3456c0486b48..4fcbf634b548 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1981,7 +1981,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
          * EAPOL frames from the local station.
          */
         if (unlikely(!ieee80211_vif_is_mesh(&sdata->vif) &&
-                     !is_multicast_ether_addr(hdr.addr1) && !authorized &&
+                     !multicast && !authorized &&
                      (cpu_to_be16(ethertype) != sdata->control_port_protocol ||
                       !ether_addr_equal(sdata->vif.addr, skb->data + ETH_ALEN)))) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
@@ -2357,15 +2357,31 @@ static void ieee80211_update_csa(struct ieee80211_sub_if_data *sdata,
         struct probe_resp *resp;
         int counter_offset_beacon = sdata->csa_counter_offset_beacon;
         int counter_offset_presp = sdata->csa_counter_offset_presp;
+        u8 *beacon_data;
+        size_t beacon_data_len;
+
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_AP:
+                beacon_data = beacon->tail;
+                beacon_data_len = beacon->tail_len;
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                beacon_data = beacon->head;
+                beacon_data_len = beacon->head_len;
+                break;
+        default:
+                return;
+        }
+        if (WARN_ON(counter_offset_beacon >= beacon_data_len))
+                return;
 
         /* warn if the driver did not check for/react to csa completeness */
-        if (WARN_ON(((u8 *)beacon->tail)[counter_offset_beacon] == 0))
+        if (WARN_ON(beacon_data[counter_offset_beacon] == 0))
                 return;
 
-        ((u8 *)beacon->tail)[counter_offset_beacon]--;
+        beacon_data[counter_offset_beacon]--;
 
-        if (sdata->vif.type == NL80211_IFTYPE_AP &&
-            counter_offset_presp) {
+        if (sdata->vif.type == NL80211_IFTYPE_AP && counter_offset_presp) {
                 rcu_read_lock();
                 resp = rcu_dereference(sdata->u.ap.probe_resp);
 
@@ -2400,6 +2416,15 @@ bool ieee80211_csa_is_complete(struct ieee80211_vif *vif)
                         goto out;
                 beacon_data = beacon->tail;
                 beacon_data_len = beacon->tail_len;
+        } else if (vif->type == NL80211_IFTYPE_ADHOC) {
+                struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+
+                beacon = rcu_dereference(ifibss->presp);
+                if (!beacon)
+                        goto out;
+
+                beacon_data = beacon->head;
+                beacon_data_len = beacon->head_len;
         } else {
                 WARN_ON(1);
                 goto out;
@@ -2484,6 +2509,10 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                 if (!presp)
                         goto out;
 
+                if (sdata->vif.csa_active)
+                        ieee80211_update_csa(sdata, presp);
+
+
                 skb = dev_alloc_skb(local->tx_headroom + presp->head_len);
                 if (!skb)
                         goto out;
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index e1b34a18b243..550a6880625d 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -567,18 +567,15 @@ void ieee80211_flush_queues(struct ieee80211_local *local,
                                         IEEE80211_QUEUE_STOP_REASON_FLUSH);
 }
 
-void ieee80211_iterate_active_interfaces(
-        struct ieee80211_hw *hw, u32 iter_flags,
-        void (*iterator)(void *data, u8 *mac,
-                         struct ieee80211_vif *vif),
-        void *data)
+static void __iterate_active_interfaces(struct ieee80211_local *local,
+                                        u32 iter_flags,
+                                        void (*iterator)(void *data, u8 *mac,
+                                                struct ieee80211_vif *vif),
+                                        void *data)
 {
-        struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_sub_if_data *sdata;
 
-        mutex_lock(&local->iflist_mtx);
-
-        list_for_each_entry(sdata, &local->interfaces, list) {
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
                 switch (sdata->vif.type) {
                 case NL80211_IFTYPE_MONITOR:
                         if (!(sdata->u.mntr_flags & MONITOR_FLAG_ACTIVE))
@@ -597,13 +594,25 @@ void ieee80211_iterate_active_interfaces(
                                  &sdata->vif);
         }
 
-        sdata = rcu_dereference_protected(local->monitor_sdata,
-                                          lockdep_is_held(&local->iflist_mtx));
+        sdata = rcu_dereference_check(local->monitor_sdata,
+                                      lockdep_is_held(&local->iflist_mtx) ||
+                                      lockdep_rtnl_is_held());
         if (sdata &&
             (iter_flags & IEEE80211_IFACE_ITER_RESUME_ALL ||
              sdata->flags & IEEE80211_SDATA_IN_DRIVER))
                 iterator(data, sdata->vif.addr, &sdata->vif);
+}
+
+void ieee80211_iterate_active_interfaces(
+        struct ieee80211_hw *hw, u32 iter_flags,
+        void (*iterator)(void *data, u8 *mac,
+                         struct ieee80211_vif *vif),
+        void *data)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
 
+        mutex_lock(&local->iflist_mtx);
+        __iterate_active_interfaces(local, iter_flags, iterator, data);
         mutex_unlock(&local->iflist_mtx);
 }
 EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces);
@@ -615,38 +624,26 @@ void ieee80211_iterate_active_interfaces_atomic(
         void *data)
 {
         struct ieee80211_local *local = hw_to_local(hw);
-        struct ieee80211_sub_if_data *sdata;
 
         rcu_read_lock();
+        __iterate_active_interfaces(local, iter_flags, iterator, data);
+        rcu_read_unlock();
+}
+EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces_atomic);
 
-        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
-                switch (sdata->vif.type) {
-                case NL80211_IFTYPE_MONITOR:
-                        if (!(sdata->u.mntr_flags & MONITOR_FLAG_ACTIVE))
-                                continue;
-                        break;
-                case NL80211_IFTYPE_AP_VLAN:
-                        continue;
-                default:
-                        break;
-                }
-                if (!(iter_flags & IEEE80211_IFACE_ITER_RESUME_ALL) &&
-                    !(sdata->flags & IEEE80211_SDATA_IN_DRIVER))
-                        continue;
-                if (ieee80211_sdata_running(sdata))
-                        iterator(data, sdata->vif.addr,
-                                 &sdata->vif);
-        }
+void ieee80211_iterate_active_interfaces_rtnl(
+        struct ieee80211_hw *hw, u32 iter_flags,
+        void (*iterator)(void *data, u8 *mac,
+                         struct ieee80211_vif *vif),
+        void *data)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
 
-        sdata = rcu_dereference(local->monitor_sdata);
-        if (sdata &&
-            (iter_flags & IEEE80211_IFACE_ITER_RESUME_ALL ||
-             sdata->flags & IEEE80211_SDATA_IN_DRIVER))
-                iterator(data, sdata->vif.addr, &sdata->vif);
+        ASSERT_RTNL();
 
-        rcu_read_unlock();
+        __iterate_active_interfaces(local, iter_flags, iterator, data);
 }
-EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces_atomic);
+EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces_rtnl);
 
 /*
  * Nothing should have been stuffed into the workqueue during
@@ -1007,14 +1004,21 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata,
          */
         enable_qos = (sdata->vif.type != NL80211_IFTYPE_STATION);
 
-        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
-                /* Set defaults according to 802.11-2007 Table 7-37 */
-                aCWmax = 1023;
-                if (use_11b)
-                        aCWmin = 31;
-                else
-                        aCWmin = 15;
+        /* Set defaults according to 802.11-2007 Table 7-37 */
+        aCWmax = 1023;
+        if (use_11b)
+                aCWmin = 31;
+        else
+                aCWmin = 15;
+
+        /* Confiure old 802.11b/g medium access rules. */
+        qparam.cw_max = aCWmax;
+        qparam.cw_min = aCWmin;
+        qparam.txop = 0;
+        qparam.aifs = 2;
 
+        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+                /* Update if QoS is enabled. */
                 if (enable_qos) {
                         switch (ac) {
                         case IEEE80211_AC_BK:
@@ -1050,12 +1054,6 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata,
                                 qparam.aifs = 2;
                                 break;
                         }
-                } else {
-                        /* Confiure old 802.11b/g medium access rules. */
-                        qparam.cw_max = aCWmax;
-                        qparam.cw_min = aCWmin;
-                        qparam.txop = 0;
-                        qparam.aifs = 2;
                 }
 
                 qparam.uapsd = false;
@@ -1084,8 +1082,8 @@ void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_mgmt *mgmt;
         int err;
 
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom +
-                            sizeof(*mgmt) + 6 + extra_len);
+        /* 24 + 6 = header + auth_algo + auth_transaction + status_code */
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 24 + 6 + extra_len);
         if (!skb)
                 return;
 
@@ -2295,3 +2293,63 @@ void ieee80211_radar_detected(struct ieee80211_hw *hw)
         ieee80211_queue_work(hw, &local->radar_detected_work);
 }
 EXPORT_SYMBOL(ieee80211_radar_detected);
+
+u32 ieee80211_chandef_downgrade(struct cfg80211_chan_def *c)
+{
+        u32 ret;
+        int tmp;
+
+        switch (c->width) {
+        case NL80211_CHAN_WIDTH_20:
+                c->width = NL80211_CHAN_WIDTH_20_NOHT;
+                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
+                break;
+        case NL80211_CHAN_WIDTH_40:
+                c->width = NL80211_CHAN_WIDTH_20;
+                c->center_freq1 = c->chan->center_freq;
+                ret = IEEE80211_STA_DISABLE_40MHZ |
+                      IEEE80211_STA_DISABLE_VHT;
+                break;
+        case NL80211_CHAN_WIDTH_80:
+                tmp = (30 + c->chan->center_freq - c->center_freq1)/20;
+                /* n_P40 */
+                tmp /= 2;
+                /* freq_P40 */
+                c->center_freq1 = c->center_freq1 - 20 + 40 * tmp;
+                c->width = NL80211_CHAN_WIDTH_40;
+                ret = IEEE80211_STA_DISABLE_VHT;
+                break;
+        case NL80211_CHAN_WIDTH_80P80:
+                c->center_freq2 = 0;
+                c->width = NL80211_CHAN_WIDTH_80;
+                ret = IEEE80211_STA_DISABLE_80P80MHZ |
+                      IEEE80211_STA_DISABLE_160MHZ;
+                break;
+        case NL80211_CHAN_WIDTH_160:
+                /* n_P20 */
+                tmp = (70 + c->chan->center_freq - c->center_freq1)/20;
+                /* n_P80 */
+                tmp /= 4;
+                c->center_freq1 = c->center_freq1 - 40 + 80 * tmp;
+                c->width = NL80211_CHAN_WIDTH_80;
+                ret = IEEE80211_STA_DISABLE_80P80MHZ |
+                      IEEE80211_STA_DISABLE_160MHZ;
+                break;
+        default:
+        case NL80211_CHAN_WIDTH_20_NOHT:
+                WARN_ON_ONCE(1);
+                c->width = NL80211_CHAN_WIDTH_20_NOHT;
+                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
+                break;
+        case NL80211_CHAN_WIDTH_5:
+        case NL80211_CHAN_WIDTH_10:
+                WARN_ON_ONCE(1);
+                /* keep c->width */
+                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
+                break;
+        }
+
+        WARN_ON_ONCE(!cfg80211_chandef_valid(c));
+
+        return ret;
+}
diff --git a/net/mac80211/vht.c b/net/mac80211/vht.c
index 97c289414e32..de0112785aae 100644
--- a/net/mac80211/vht.c
+++ b/net/mac80211/vht.c
@@ -185,13 +185,13 @@ ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata,
         if (own_cap.cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE) {
                 vht_cap->cap |= cap_info &
                                 (IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
-                                 IEEE80211_VHT_CAP_BEAMFORMER_ANTENNAS_MAX |
                                  IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MAX);
         }
 
         if (own_cap.cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)
                 vht_cap->cap |= cap_info &
-                                IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
+                                (IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
+                                 IEEE80211_VHT_CAP_BEAMFORMEE_STS_MAX);
 
         if (own_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)
                 vht_cap->cap |= cap_info &
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index f77139007983..f2e30fb31e78 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -1052,7 +1052,7 @@ ip_set_swap(struct sock *ctnl, struct sk_buff *skb,
          * Not an artificial restriction anymore, as we must prevent
          * possible loops created by swapping in setlist type of sets. */
         if (!(from->type->features == to->type->features &&
-              from->type->family == to->type->family))
+              from->family == to->family))
                 return -IPSET_ERR_TYPE_MISMATCH;
 
         strncpy(from_name, from->name, IPSET_MAXNAMELEN);
@@ -1489,8 +1489,7 @@ ip_set_utest(struct sock *ctnl, struct sk_buff *skb,
         if (ret == -EAGAIN)
                 ret = 1;
 
-        return (ret < 0 && ret != -ENOTEMPTY) ? ret :
-                ret > 0 ? 0 : -IPSET_ERR_EXIST;
+        return ret > 0 ? 0 : -IPSET_ERR_EXIST;
 }
 
 /* Get headed data of a set */
diff --git a/net/netfilter/ipset/ip_set_getport.c b/net/netfilter/ipset/ip_set_getport.c
index 6fdf88ae2353..dac156f819ac 100644
--- a/net/netfilter/ipset/ip_set_getport.c
+++ b/net/netfilter/ipset/ip_set_getport.c
@@ -116,12 +116,12 @@ ip_set_get_ip6_port(const struct sk_buff *skb, bool src,
 {
         int protoff;
         u8 nexthdr;
-        __be16 frag_off;
+        __be16 frag_off = 0;
 
         nexthdr = ipv6_hdr(skb)->nexthdr;
         protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr,
                                    &frag_off);
-        if (protoff < 0)
+        if (protoff < 0 || (frag_off & htons(~0x7)) != 0)
                 return false;
 
         return get_port(skb, nexthdr, protoff, src, port, proto);
diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
index 57beb1762b2d..707bc520d629 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -325,18 +325,22 @@ mtype_add_cidr(struct htype *h, u8 cidr, u8 nets_length)
 static void
 mtype_del_cidr(struct htype *h, u8 cidr, u8 nets_length)
 {
-        u8 i, j;
-
-        for (i = 0; i < nets_length - 1 && h->nets[i].cidr != cidr; i++)
-                ;
-        h->nets[i].nets--;
-
-        if (h->nets[i].nets != 0)
-                return;
-
-        for (j = i; j < nets_length - 1 && h->nets[j].nets; j++) {
-                h->nets[j].cidr = h->nets[j + 1].cidr;
-                h->nets[j].nets = h->nets[j + 1].nets;
+        u8 i, j, net_end = nets_length - 1;
+
+        for (i = 0; i < nets_length; i++) {
+                if (h->nets[i].cidr != cidr)
+                        continue;
+                if (h->nets[i].nets > 1 || i == net_end ||
+                    h->nets[i + 1].nets == 0) {
+                        h->nets[i].nets--;
+                        return;
+                }
+                for (j = i; j < net_end && h->nets[j].nets; j++) {
+                        h->nets[j].cidr = h->nets[j + 1].cidr;
+                        h->nets[j].nets = h->nets[j + 1].nets;
+                }
+                h->nets[j].nets = 0;
+                return;
         }
 }
 #endif
diff --git a/net/netfilter/ipset/ip_set_hash_ipportnet.c b/net/netfilter/ipset/ip_set_hash_ipportnet.c
index c6a525373be4..f15f3e28b9c3 100644
--- a/net/netfilter/ipset/ip_set_hash_ipportnet.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportnet.c
@@ -260,7 +260,7 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
                 e.ip = htonl(ip);
                 e.ip2 = htonl(ip2_from & ip_set_hostmask(e.cidr + 1));
                 ret = adtfn(set, &e, &ext, &ext, flags);
-                return ip_set_enomatch(ret, flags, adt) ? 1 :
+                return ip_set_enomatch(ret, flags, adt, set) ? -ret :
                        ip_set_eexist(ret, flags) ? 0 : ret;
         }
 
@@ -544,7 +544,7 @@ hash_ipportnet6_uadt(struct ip_set *set, struct nlattr *tb[],
 
         if (adt == IPSET_TEST || !with_ports || !tb[IPSET_ATTR_PORT_TO]) {
                 ret = adtfn(set, &e, &ext, &ext, flags);
-                return ip_set_enomatch(ret, flags, adt) ? 1 :
+                return ip_set_enomatch(ret, flags, adt, set) ? -ret :
                        ip_set_eexist(ret, flags) ? 0 : ret;
         }
 
diff --git a/net/netfilter/ipset/ip_set_hash_net.c b/net/netfilter/ipset/ip_set_hash_net.c
index da740ceb56ae..223e9f546d0f 100644
--- a/net/netfilter/ipset/ip_set_hash_net.c
+++ b/net/netfilter/ipset/ip_set_hash_net.c
@@ -199,7 +199,7 @@ hash_net4_uadt(struct ip_set *set, struct nlattr *tb[],
         if (adt == IPSET_TEST || !tb[IPSET_ATTR_IP_TO]) {
                 e.ip = htonl(ip & ip_set_hostmask(e.cidr));
                 ret = adtfn(set, &e, &ext, &ext, flags);
-                return ip_set_enomatch(ret, flags, adt) ? 1 :
+                return ip_set_enomatch(ret, flags, adt, set) ? -ret:
                        ip_set_eexist(ret, flags) ? 0 : ret;
         }
 
@@ -396,7 +396,7 @@ hash_net6_uadt(struct ip_set *set, struct nlattr *tb[],
 
         ret = adtfn(set, &e, &ext, &ext, flags);
 
-        return ip_set_enomatch(ret, flags, adt) ? 1 :
+        return ip_set_enomatch(ret, flags, adt, set) ? -ret :
                ip_set_eexist(ret, flags) ? 0 : ret;
 }
 
diff --git a/net/netfilter/ipset/ip_set_hash_netiface.c b/net/netfilter/ipset/ip_set_hash_netiface.c
index 84ae6f6ce624..7d798d5d5cd3 100644
--- a/net/netfilter/ipset/ip_set_hash_netiface.c
+++ b/net/netfilter/ipset/ip_set_hash_netiface.c
@@ -368,7 +368,7 @@ hash_netiface4_uadt(struct ip_set *set, struct nlattr *tb[],
         if (adt == IPSET_TEST || !tb[IPSET_ATTR_IP_TO]) {
                 e.ip = htonl(ip & ip_set_hostmask(e.cidr));
                 ret = adtfn(set, &e, &ext, &ext, flags);
-                return ip_set_enomatch(ret, flags, adt) ? 1 :
+                return ip_set_enomatch(ret, flags, adt, set) ? -ret :
                        ip_set_eexist(ret, flags) ? 0 : ret;
         }
 
@@ -634,7 +634,7 @@ hash_netiface6_uadt(struct ip_set *set, struct nlattr *tb[],
 
         ret = adtfn(set, &e, &ext, &ext, flags);
 
-        return ip_set_enomatch(ret, flags, adt) ? 1 :
+        return ip_set_enomatch(ret, flags, adt, set) ? -ret :
                ip_set_eexist(ret, flags) ? 0 : ret;
 }
 
diff --git a/net/netfilter/ipset/ip_set_hash_netport.c b/net/netfilter/ipset/ip_set_hash_netport.c
index 9a0869853be5..09d6690bee6f 100644
--- a/net/netfilter/ipset/ip_set_hash_netport.c
+++ b/net/netfilter/ipset/ip_set_hash_netport.c
@@ -244,7 +244,7 @@ hash_netport4_uadt(struct ip_set *set, struct nlattr *tb[],
         if (adt == IPSET_TEST || !(with_ports || tb[IPSET_ATTR_IP_TO])) {
                 e.ip = htonl(ip & ip_set_hostmask(e.cidr + 1));
                 ret = adtfn(set, &e, &ext, &ext, flags);
-                return ip_set_enomatch(ret, flags, adt) ? 1 :
+                return ip_set_enomatch(ret, flags, adt, set) ? -ret :
                        ip_set_eexist(ret, flags) ? 0 : ret;
         }
 
@@ -489,7 +489,7 @@ hash_netport6_uadt(struct ip_set *set, struct nlattr *tb[],
 
         if (adt == IPSET_TEST || !with_ports || !tb[IPSET_ATTR_PORT_TO]) {
                 ret = adtfn(set, &e, &ext, &ext, flags);
-                return ip_set_enomatch(ret, flags, adt) ? 1 :
+                return ip_set_enomatch(ret, flags, adt, set) ? -ret :
                        ip_set_eexist(ret, flags) ? 0 : ret;
         }
 
diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index b75ff6429a04..c47444e4cf8c 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -883,7 +883,7 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
         iph->daddr              =       cp->daddr.ip;
         iph->saddr              =       saddr;
         iph->ttl                =       old_iph->ttl;
-        ip_select_ident(iph, &rt->dst, NULL);
+        ip_select_ident(skb, &rt->dst, NULL);
 
         /* Another hack: avoid icmp_send in ip_fragment */
         skb->local_df = 1;
diff --git a/net/netfilter/nfnetlink_queue_core.c b/net/netfilter/nfnetlink_queue_core.c
index 95a98c8c1da6..ae2e5c11d01a 100644
--- a/net/netfilter/nfnetlink_queue_core.c
+++ b/net/netfilter/nfnetlink_queue_core.c
@@ -1009,7 +1009,7 @@ nfqnl_recv_verdict(struct sock *ctnl, struct sk_buff *skb,
                         verdict = NF_DROP;
 
                 if (ct)
-                        nfqnl_ct_seq_adjust(skb, ct, ctinfo, diff);
+                        nfqnl_ct_seq_adjust(entry->skb, ct, ctinfo, diff);
         }
 
         if (nfqa[NFQA_MARK])
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 5f2068679f83..98b69bbecdd9 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -634,8 +634,7 @@ void sctp_v4_err(struct sk_buff *skb, __u32 info)
                 break;
         case ICMP_REDIRECT:
                 sctp_icmp_redirect(sk, transport, skb);
-                err = 0;
-                break;
+                /* Fall through to out_unlock. */
         default:
                 goto out_unlock;
         }
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index da613ceae28c..e7b2d4fe2b6a 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -183,7 +183,7 @@ static void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 break;
         case NDISC_REDIRECT:
                 sctp_icmp_redirect(sk, transport, skb);
-                break;
+                goto out_unlock;
         default:
                 break;
         }
@@ -204,44 +204,23 @@ out:
                 in6_dev_put(idev);
 }
 
-/* Based on tcp_v6_xmit() in tcp_ipv6.c. */
 static int sctp_v6_xmit(struct sk_buff *skb, struct sctp_transport *transport)
 {
         struct sock *sk = skb->sk;
         struct ipv6_pinfo *np = inet6_sk(sk);
-        struct flowi6 fl6;
-
-        memset(&fl6, 0, sizeof(fl6));
-
-        fl6.flowi6_proto = sk->sk_protocol;
-
-        /* Fill in the dest address from the route entry passed with the skb
-         * and the source address from the transport.
-         */
-        fl6.daddr = transport->ipaddr.v6.sin6_addr;
-        fl6.saddr = transport->saddr.v6.sin6_addr;
-
-        fl6.flowlabel = np->flow_label;
-        IP6_ECN_flow_xmit(sk, fl6.flowlabel);
-        if (ipv6_addr_type(&fl6.saddr) & IPV6_ADDR_LINKLOCAL)
-                fl6.flowi6_oif = transport->saddr.v6.sin6_scope_id;
-        else
-                fl6.flowi6_oif = sk->sk_bound_dev_if;
-
-        if (np->opt && np->opt->srcrt) {
-                struct rt0_hdr *rt0 = (struct rt0_hdr *) np->opt->srcrt;
-                fl6.daddr = *rt0->addr;
-        }
+        struct flowi6 *fl6 = &transport->fl.u.ip6;
 
         pr_debug("%s: skb:%p, len:%d, src:%pI6 dst:%pI6\n", __func__, skb,
-                 skb->len, &fl6.saddr, &fl6.daddr);
+                 skb->len, &fl6->saddr, &fl6->daddr);
 
-        SCTP_INC_STATS(sock_net(sk), SCTP_MIB_OUTSCTPPACKS);
+        IP6_ECN_flow_xmit(sk, fl6->flowlabel);
 
         if (!(transport->param_flags & SPP_PMTUD_ENABLE))
                 skb->local_df = 1;
 
-        return ip6_xmit(sk, skb, &fl6, np->opt, np->tclass);
+        SCTP_INC_STATS(sock_net(sk), SCTP_MIB_OUTSCTPPACKS);
+
+        return ip6_xmit(sk, skb, fl6, np->opt, np->tclass);
 }
 
 /* Returns the dst cache entry for the given source and destination ip
@@ -254,10 +233,12 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
         struct dst_entry *dst = NULL;
         struct flowi6 *fl6 = &fl->u.ip6;
         struct sctp_bind_addr *bp;
+        struct ipv6_pinfo *np = inet6_sk(sk);
         struct sctp_sockaddr_entry *laddr;
         union sctp_addr *baddr = NULL;
         union sctp_addr *daddr = &t->ipaddr;
         union sctp_addr dst_saddr;
+        struct in6_addr *final_p, final;
         __u8 matchlen = 0;
         __u8 bmatchlen;
         sctp_scope_t scope;
@@ -281,7 +262,8 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
                 pr_debug("src=%pI6 - ", &fl6->saddr);
         }
 
-        dst = ip6_dst_lookup_flow(sk, fl6, NULL, false);
+        final_p = fl6_update_dst(fl6, np->opt, &final);
+        dst = ip6_dst_lookup_flow(sk, fl6, final_p, false);
         if (!asoc || saddr)
                 goto out;
 
@@ -333,10 +315,12 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
                 }
         }
         rcu_read_unlock();
+
         if (baddr) {
                 fl6->saddr = baddr->v6.sin6_addr;
                 fl6->fl6_sport = baddr->v6.sin6_port;
-                dst = ip6_dst_lookup_flow(sk, fl6, NULL, false);
+                final_p = fl6_update_dst(fl6, np->opt, &final);
+                dst = ip6_dst_lookup_flow(sk, fl6, final_p, false);
         }
 
 out:
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index 50f6195c8b70..16f3c3a7b2c1 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -328,6 +328,7 @@ int cfg80211_chandef_dfs_required(struct wiphy *wiphy,
         return cfg80211_get_chans_dfs_required(wiphy, chandef->center_freq2,
                                                width);
 }
+EXPORT_SYMBOL(cfg80211_chandef_dfs_required);
 
 static bool cfg80211_secondary_chans_ok(struct wiphy *wiphy,
                                         u32 center_freq, u32 bandwidth,
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 9ad43c619c54..b43efac4efca 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -382,15 +382,6 @@ int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
                                  enum cfg80211_chan_mode chanmode,
                                  u8 radar_detect);
 
-/**
- * cfg80211_chandef_dfs_required - checks if radar detection is required
- * @wiphy: the wiphy to validate against
- * @chandef: the channel definition to check
- * Return: 1 if radar detection is required, 0 if it is not, < 0 on error
- */
-int cfg80211_chandef_dfs_required(struct wiphy *wiphy,
-                                  const struct cfg80211_chan_def *c);
-
 void cfg80211_set_dfs_state(struct wiphy *wiphy,
                             const struct cfg80211_chan_def *chandef,
                             enum nl80211_dfs_state dfs_state);
diff --git a/net/wireless/debugfs.c b/net/wireless/debugfs.c
index 90d050036624..454157717efa 100644
--- a/net/wireless/debugfs.c
+++ b/net/wireless/debugfs.c
@@ -47,17 +47,19 @@ static int ht_print_chan(struct ieee80211_channel *chan,
                 return 0;
 
         if (chan->flags & IEEE80211_CHAN_DISABLED)
-                return snprintf(buf + offset,
-                                buf_size - offset,
-                                "%d Disabled\n",
-                                chan->center_freq);
-
-        return snprintf(buf + offset,
-                        buf_size - offset,
-                        "%d HT40 %c%c\n",
-                        chan->center_freq,
-                        (chan->flags & IEEE80211_CHAN_NO_HT40MINUS) ? ' ' : '-',
-                        (chan->flags & IEEE80211_CHAN_NO_HT40PLUS)  ? ' ' : '+');
+                return scnprintf(buf + offset,
+                                 buf_size - offset,
+                                 "%d Disabled\n",
+                                 chan->center_freq);
+
+        return scnprintf(buf + offset,
+                         buf_size - offset,
+                         "%d HT40 %c%c\n",
+                         chan->center_freq,
+                         (chan->flags & IEEE80211_CHAN_NO_HT40MINUS) ?
+                                ' ' : '-',
+                         (chan->flags & IEEE80211_CHAN_NO_HT40PLUS) ?
+                                ' ' : '+');
 }
 
 static ssize_t ht40allow_map_read(struct file *file,
diff --git a/net/wireless/genregdb.awk b/net/wireless/genregdb.awk
index 9392f8cbb901..42ed274e81f4 100644
--- a/net/wireless/genregdb.awk
+++ b/net/wireless/genregdb.awk
@@ -46,6 +46,12 @@ BEGIN {
         sub(/:/, "", country)
         printf "static const struct ieee80211_regdomain regdom_%s = {\n", country
         printf "\t.alpha2 = \"%s\",\n", country
+        if ($NF ~ /DFS-ETSI/)
+                printf "\t.dfs_region = NL80211_DFS_ETSI,\n"
+        else if ($NF ~ /DFS-FCC/)
+                printf "\t.dfs_region = NL80211_DFS_FCC,\n"
+        else if ($NF ~ /DFS-JP/)
+                printf "\t.dfs_region = NL80211_DFS_JP,\n"
         printf "\t.reg_rules = {\n"
         active = 1
         regdb = regdb "\t&regdom_" country ",\n"
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index af8d84a4a5b2..2838206ddad3 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -5591,6 +5591,9 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,
         if (err)
                 return err;
 
+        if (netif_carrier_ok(dev))
+                return -EBUSY;
+
         if (wdev->cac_started)
                 return -EBUSY;
 
@@ -5634,15 +5637,26 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
         u8 radar_detect_width = 0;
         int err;
+        bool need_new_beacon = false;
 
         if (!rdev->ops->channel_switch ||
             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
                 return -EOPNOTSUPP;
 
-        /* may add IBSS support later */
-        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
-            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
+        switch (dev->ieee80211_ptr->iftype) {
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_P2P_GO:
+                need_new_beacon = true;
+
+                /* useless if AP is not running */
+                if (!wdev->beacon_interval)
+                        return -EINVAL;
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                break;
+        default:
                 return -EOPNOTSUPP;
+        }
 
         memset(&params, 0, sizeof(params));
 
@@ -5651,15 +5665,16 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
                 return -EINVAL;
 
         /* only important for AP, IBSS and mesh create IEs internally */
-        if (!info->attrs[NL80211_ATTR_CSA_IES])
-                return -EINVAL;
-
-        /* useless if AP is not running */
-        if (!wdev->beacon_interval)
+        if (need_new_beacon &&
+            (!info->attrs[NL80211_ATTR_CSA_IES] ||
+             !info->attrs[NL80211_ATTR_CSA_C_OFF_BEACON]))
                 return -EINVAL;
 
         params.count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
 
+        if (!need_new_beacon)
+                goto skip_beacons;
+
         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
         if (err)
                 return err;
@@ -5699,6 +5714,7 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
                         return -EINVAL;
         }
 
+skip_beacons:
         err = nl80211_parse_chandef(rdev, info, &params.chandef);
         if (err)
                 return err;
@@ -5706,12 +5722,17 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
                 return -EINVAL;
 
-        err = cfg80211_chandef_dfs_required(wdev->wiphy, &params.chandef);
-        if (err < 0) {
-                return err;
-        } else if (err) {
-                radar_detect_width = BIT(params.chandef.width);
-                params.radar_required = true;
+        /* DFS channels are only supported for AP/P2P GO ... for now. */
+        if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP ||
+            dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) {
+                err = cfg80211_chandef_dfs_required(wdev->wiphy,
+                                                    &params.chandef);
+                if (err < 0) {
+                        return err;
+                } else if (err) {
+                        radar_detect_width = BIT(params.chandef.width);
+                        params.radar_required = true;
+                }
         }
 
         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
@@ -10740,7 +10761,8 @@ void cfg80211_ch_switch_notify(struct net_device *dev,
         wdev_lock(wdev);
 
         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
-                    wdev->iftype != NL80211_IFTYPE_P2P_GO))
+                    wdev->iftype != NL80211_IFTYPE_P2P_GO &&
+                    wdev->iftype != NL80211_IFTYPE_ADHOC))
                 goto out;
 
         wdev->channel = chandef->chan;
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index de06d5d1287f..d62cb1e91475 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -172,11 +172,21 @@ static const struct ieee80211_regdomain world_regdom = {
                         NL80211_RRF_NO_IBSS |
                         NL80211_RRF_NO_OFDM),
                 /* IEEE 802.11a, channel 36..48 */
-                REG_RULE(5180-10, 5240+10, 80, 6, 20,
+                REG_RULE(5180-10, 5240+10, 160, 6, 20,
                         NL80211_RRF_PASSIVE_SCAN |
                         NL80211_RRF_NO_IBSS),
 
-                /* NB: 5260 MHz - 5700 MHz requires DFS */
+                /* IEEE 802.11a, channel 52..64 - DFS required */
+                REG_RULE(5260-10, 5320+10, 160, 6, 20,
+                        NL80211_RRF_PASSIVE_SCAN |
+                        NL80211_RRF_NO_IBSS |
+                        NL80211_RRF_DFS),
+
+                /* IEEE 802.11a, channel 100..144 - DFS required */
+                REG_RULE(5500-10, 5720+10, 160, 6, 20,
+                        NL80211_RRF_PASSIVE_SCAN |
+                        NL80211_RRF_NO_IBSS |
+                        NL80211_RRF_DFS),
 
                 /* IEEE 802.11a, channel 149..165 */
                 REG_RULE(5745-10, 5825+10, 80, 6, 20,
diff --git a/net/wireless/util.c b/net/wireless/util.c
index ce090c1c5e4f..3c8be6104ba4 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -10,6 +10,7 @@
 #include <net/cfg80211.h>
 #include <net/ip.h>
 #include <net/dsfield.h>
+#include <linux/if_vlan.h>
 #include "core.h"
 #include "rdev-ops.h"
 
@@ -691,6 +692,7 @@ EXPORT_SYMBOL(ieee80211_amsdu_to_8023s);
 unsigned int cfg80211_classify8021d(struct sk_buff *skb)
 {
         unsigned int dscp;
+        unsigned char vlan_priority;
 
         /* skb->priority values from 256->263 are magic values to
          * directly indicate a specific 802.1d priority.  This is used
@@ -700,6 +702,13 @@ unsigned int cfg80211_classify8021d(struct sk_buff *skb)
         if (skb->priority >= 256 && skb->priority <= 263)
                 return skb->priority - 256;
 
+        if (vlan_tx_tag_present(skb)) {
+                vlan_priority = (vlan_tx_tag_get(skb) & VLAN_PRIO_MASK)
+                        >> VLAN_PRIO_SHIFT;
+                if (vlan_priority > 0)
+                        return vlan_priority;
+        }
+
         switch (skb->protocol) {
         case htons(ETH_P_IP):
                 dscp = ipv4_get_dsfield(ip_hdr(skb)) & 0xfc;
diff --git a/virt/kvm/async_pf.c b/virt/kvm/async_pf.c
index ea475cd03511..8a39dda7a325 100644
--- a/virt/kvm/async_pf.c
+++ b/virt/kvm/async_pf.c
@@ -101,8 +101,11 @@ void kvm_clear_async_pf_completion_queue(struct kvm_vcpu *vcpu)
                                    typeof(*work), queue);
                 cancel_work_sync(&work->work);
                 list_del(&work->queue);
-                if (!work->done) /* work was canceled */
+                if (!work->done) { /* work was canceled */
+                        mmdrop(work->mm);
+                        kvm_put_kvm(vcpu->kvm); /* == work->vcpu->kvm */
                         kmem_cache_free(async_pf_cache, work);
+                }
         }
 
         spin_lock(&vcpu->async_pf.lock);
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index bf040c4e02b3..979bff485fb0 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -1058,11 +1058,15 @@ unsigned long gfn_to_hva(struct kvm *kvm, gfn_t gfn)
 EXPORT_SYMBOL_GPL(gfn_to_hva);
 
 /*
- * The hva returned by this function is only allowed to be read.
- * It should pair with kvm_read_hva() or kvm_read_hva_atomic().
+ * If writable is set to false, the hva returned by this function is only
+ * allowed to be read.
  */
-static unsigned long gfn_to_hva_read(struct kvm *kvm, gfn_t gfn)
+unsigned long gfn_to_hva_prot(struct kvm *kvm, gfn_t gfn, bool *writable)
 {
+        struct kvm_memory_slot *slot = gfn_to_memslot(kvm, gfn);
+        if (writable)
+                *writable = !memslot_is_readonly(slot);
+
         return __gfn_to_hva_many(gfn_to_memslot(kvm, gfn), gfn, NULL, false);
 }
 
@@ -1430,7 +1434,7 @@ int kvm_read_guest_page(struct kvm *kvm, gfn_t gfn, void *data, int offset,
         int r;
         unsigned long addr;
 
-        addr = gfn_to_hva_read(kvm, gfn);
+        addr = gfn_to_hva_prot(kvm, gfn, NULL);
         if (kvm_is_error_hva(addr))
                 return -EFAULT;
         r = kvm_read_hva(data, (void __user *)addr + offset, len);
@@ -1468,7 +1472,7 @@ int kvm_read_guest_atomic(struct kvm *kvm, gpa_t gpa, void *data,
         gfn_t gfn = gpa >> PAGE_SHIFT;
         int offset = offset_in_page(gpa);
 
-        addr = gfn_to_hva_read(kvm, gfn);
+        addr = gfn_to_hva_prot(kvm, gfn, NULL);
         if (kvm_is_error_hva(addr))
                 return -EFAULT;
         pagefault_disable();