Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next

John W. Linville says:

====================
Please pull this batch of wireless updates intended for 3.15!

For the mac80211 bits, Johannes says:

"This has a whole bunch of bugfixes for things that went into -next
previously as well as some other bugfixes I didn't want to rush into
3.14 at this point. The rest of it is some cleanups and a few small
features, the biggest of which is probably Janusz's regulatory DFS CAC
time code."

For the Bluetooth bits, Gustavo says:

"One more pull request to 3.15. This is mostly and bug fix pull request, it
contains several fixes and clean up all over the tree, plus some small new
features."

For the NFC bits, Samuel says:

"This is the NFC pull request for 3.15. With this one we have:

- Support for ISO 15693 a.k.a. NFC vicinity a.k.a. Type 5 tags. ISO
  15693 are long range (1 - 2 meters) vicinity tags/cards. The kernel
  now supports those through the NFC netlink and digital APIs.

- Support for TI's trf7970a chipset. This chipset relies on the NFC
  digital layer and the driver currently supports type 2, 4A and 5 tags.

- Support for NXP's pn544 secure firmare download. The pn544 C3 chipsets
  relies on a different firmware download protocal than the C2 one. We
  now support both and use the right one depending on the version we
  detect at runtime.

- Support for 4A tags from the NFC digital layer.

- A bunch of cleanups and minor fixes from Axel Lin and Thierry Escande."

For the iwlwifi bits, Emmanuel says:

"We were sending a host command while the mutex wasn't held. This
led to hard-to-catch races."

And...

"I have a fix for a "merge damage" which is not really a merge
damage: it enables scheduled scan which has been disabled in
wireless.git. Since you merged wireless.git into wireless-next.git,
this can now be fixed in wireless-next.git.

Besides this, Alex made a workaround for a hardware bug. This fix
allows us to consume less power in S3. Arik and Eliad continue to
work on D0i3 which is a run-time power saving feature. Eliad also
contributes a few bits to the rate scaling logic to which Eyal adds his
own contribution. Avri dives deep in the power code - newer firmware
will allow to enable power save in newer scenarios. Johannes made a few
clean-ups. I have the regular amount of BT Coex boring stuff. I disable
uAPSD since we identified firmware bugs that cause packet loss. One
thing that do stand out is the udev event that we now send when the
FW asserts. I hope it will allow us to debug the FW more easily."

Also included is one last iwlwifi pull for a build breakage fix...

For the Atheros bits, Kalle says:

"Michal now did some optimisations and was able to improve throughput by
100 Mbps on our MIPS based AP135 platform. Chun-Yeow added some
workarounds to be able to better use ad-hoc mode. Ben improved log
messages and added support for MSDU chaining. And, as usual, also some
smaller fixes."

Beyond that...

Andrea Merello continues his rtl8180 refactoring, in preparation for
a long-awaited rtl8187 driver.  We get a new driver (rsi) for the
RS9113 chip, from Fariya Fatima.  And, of course, we get the usual
round of updates for ath9k, brcmfmac, mwifiex, wil6210, etc. as well.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

215 files changed, 13523 insertions, 2758 deletions

diff --git a/Documentation/devicetree/bindings/net/nfc/trf7970a.txt b/Documentation/devicetree/bindings/net/nfc/trf7970a.txt
new file mode 100644
index 000000000000..8dd3ef7bc56b
--- /dev/null
+++ b/Documentation/devicetree/bindings/net/nfc/trf7970a.txt
@@ -0,0 +1,34 @@
+* Texas Instruments TRF7970A RFID/NFC/15693 Transceiver
+
+Required properties:
+- compatible: Should be "ti,trf7970a".
+- spi-max-frequency: Maximum SPI frequency (<= 2000000).
+- interrupt-parent: phandle of parent interrupt handler.
+- interrupts: A single interrupt specifier.
+- ti,enable-gpios: Two GPIO entries used for 'EN' and 'EN2' pins on the
+  TRF7970A.
+- vin-supply: Regulator for supply voltage to VIN pin
+
+Optional SoC Specific Properties:
+- pinctrl-names: Contains only one value - "default".
+- pintctrl-0: Specifies the pin control groups used for this controller.
+
+Example (for ARM-based BeagleBone with TRF7970A on SPI1):
+
+&spi1 {
+        status = "okay";
+
+        nfc@0 {
+                compatible = "ti,trf7970a";
+                reg = <0>;
+                pinctrl-names = "default";
+                pinctrl-0 = <&trf7970a_default>;
+                spi-max-frequency = <2000000>;
+                interrupt-parent = <&gpio2>;
+                interrupts = <14 0>;
+                ti,enable-gpios = <&gpio2 2 GPIO_ACTIVE_LOW>,
+                                  <&gpio2 5 GPIO_ACTIVE_LOW>;
+                vin-supply = <&ldo3_reg>;
+                status = "okay";
+        };
+};
diff --git a/MAINTAINERS b/MAINTAINERS
index 9109eab722f5..71663f8178ea 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -6117,6 +6117,7 @@ F:	include/net/nfc/
 F:      include/uapi/linux/nfc.h
 F:      drivers/nfc/
 F:      include/linux/platform_data/pn544.h
+F:      Documentation/devicetree/bindings/net/nfc/
 
 NFS, SUNRPC, AND LOCKD CLIENTS
 M:      Trond Myklebust <trond.myklebust@primarydata.com>
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index 4f78a9d39dc8..be571fef185d 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -89,6 +89,7 @@ static const struct usb_device_id ath3k_table[] = {
         { USB_DEVICE(0x0b05, 0x17d0) },
         { USB_DEVICE(0x0CF3, 0x0036) },
         { USB_DEVICE(0x0CF3, 0x3004) },
+        { USB_DEVICE(0x0CF3, 0x3005) },
         { USB_DEVICE(0x0CF3, 0x3008) },
         { USB_DEVICE(0x0CF3, 0x311D) },
         { USB_DEVICE(0x0CF3, 0x311E) },
@@ -137,6 +138,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
         { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0CF3, 0x0036), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0x3005), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0x311E), .driver_info = BTUSB_ATH3012 },
@@ -180,10 +182,9 @@ static int ath3k_load_firmware(struct usb_device *udev,
         }
 
         memcpy(send_buf, firmware->data, 20);
-        if ((err = usb_control_msg(udev, pipe,
-                                USB_REQ_DFU_DNLOAD,
-                                USB_TYPE_VENDOR, 0, 0,
-                                send_buf, 20, USB_CTRL_SET_TIMEOUT)) < 0) {
+        err = usb_control_msg(udev, pipe, USB_REQ_DFU_DNLOAD, USB_TYPE_VENDOR,
+                              0, 0, send_buf, 20, USB_CTRL_SET_TIMEOUT);
+        if (err < 0) {
                 BT_ERR("Can't change to loading configuration err");
                 goto error;
         }
@@ -366,7 +367,7 @@ static int ath3k_load_patch(struct usb_device *udev)
         }
 
         snprintf(filename, ATH3K_NAME_LEN, "ar3k/AthrBT_0x%08x.dfu",
-                fw_version.rom_version);
+                le32_to_cpu(fw_version.rom_version));
 
         ret = request_firmware(&firmware, filename, &udev->dev);
         if (ret < 0) {
@@ -428,7 +429,7 @@ static int ath3k_load_syscfg(struct usb_device *udev)
         }
 
         snprintf(filename, ATH3K_NAME_LEN, "ar3k/ramps_0x%08x_%d%s",
-                fw_version.rom_version, clk_value, ".dfu");
+                le32_to_cpu(fw_version.rom_version), clk_value, ".dfu");
 
         ret = request_firmware(&firmware, filename, &udev->dev);
         if (ret < 0) {
diff --git a/drivers/bluetooth/bfusb.c b/drivers/bluetooth/bfusb.c
index 31386998c9a7..b2e7e94a6771 100644
--- a/drivers/bluetooth/bfusb.c
+++ b/drivers/bluetooth/bfusb.c
@@ -131,8 +131,11 @@ static int bfusb_send_bulk(struct bfusb_data *data, struct sk_buff *skb)
 
         BT_DBG("bfusb %p skb %p len %d", data, skb, skb->len);
 
-        if (!urb && !(urb = usb_alloc_urb(0, GFP_ATOMIC)))
-                return -ENOMEM;
+        if (!urb) {
+                urb = usb_alloc_urb(0, GFP_ATOMIC);
+                if (!urb)
+                        return -ENOMEM;
+        }
 
         pipe = usb_sndbulkpipe(data->udev, data->bulk_out_ep);
 
@@ -218,8 +221,11 @@ static int bfusb_rx_submit(struct bfusb_data *data, struct urb *urb)
 
         BT_DBG("bfusb %p urb %p", data, urb);
 
-        if (!urb && !(urb = usb_alloc_urb(0, GFP_ATOMIC)))
-                return -ENOMEM;
+        if (!urb) {
+                urb = usb_alloc_urb(0, GFP_ATOMIC);
+                if (!urb)
+                        return -ENOMEM;
+        }
 
         skb = bt_skb_alloc(size, GFP_ATOMIC);
         if (!skb) {
diff --git a/drivers/bluetooth/bluecard_cs.c b/drivers/bluetooth/bluecard_cs.c
index 57427de864a6..a9a989e5ee88 100644
--- a/drivers/bluetooth/bluecard_cs.c
+++ b/drivers/bluetooth/bluecard_cs.c
@@ -257,7 +257,8 @@ static void bluecard_write_wakeup(bluecard_info_t *info)
                         ready_bit = XMIT_BUF_ONE_READY;
                 }
 
-                if (!(skb = skb_dequeue(&(info->txq))))
+                skb = skb_dequeue(&(info->txq));
+                if (!skb)
                         break;
 
                 if (bt_cb(skb)->pkt_type & 0x80) {
@@ -391,7 +392,8 @@ static void bluecard_receive(bluecard_info_t *info, unsigned int offset)
                 if (info->rx_skb == NULL) {
                         info->rx_state = RECV_WAIT_PACKET_TYPE;
                         info->rx_count = 0;
-                        if (!(info->rx_skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC))) {
+                        info->rx_skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC);
+                        if (!info->rx_skb) {
                                 BT_ERR("Can't allocate mem for new packet");
                                 return;
                         }
@@ -566,7 +568,8 @@ static int bluecard_hci_set_baud_rate(struct hci_dev *hdev, int baud)
         /* Ericsson baud rate command */
         unsigned char cmd[] = { HCI_COMMAND_PKT, 0x09, 0xfc, 0x01, 0x03 };
 
-        if (!(skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC))) {
+        skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC);
+        if (!skb) {
                 BT_ERR("Can't allocate mem for new packet");
                 return -1;
         }
diff --git a/drivers/bluetooth/bt3c_cs.c b/drivers/bluetooth/bt3c_cs.c
index 73d87994d028..1d82721cf9c6 100644
--- a/drivers/bluetooth/bt3c_cs.c
+++ b/drivers/bluetooth/bt3c_cs.c
@@ -193,8 +193,8 @@ static void bt3c_write_wakeup(bt3c_info_t *info)
                 if (!pcmcia_dev_present(info->p_dev))
                         break;
 
-
-                if (!(skb = skb_dequeue(&(info->txq)))) {
+                skb = skb_dequeue(&(info->txq));
+                if (!skb) {
                         clear_bit(XMIT_SENDING, &(info->tx_state));
                         break;
                 }
@@ -238,7 +238,8 @@ static void bt3c_receive(bt3c_info_t *info)
                 if (info->rx_skb == NULL) {
                         info->rx_state = RECV_WAIT_PACKET_TYPE;
                         info->rx_count = 0;
-                        if (!(info->rx_skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC))) {
+                        info->rx_skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC);
+                        if (!info->rx_skb) {
                                 BT_ERR("Can't allocate mem for new packet");
                                 return;
                         }
diff --git a/drivers/bluetooth/btuart_cs.c b/drivers/bluetooth/btuart_cs.c
index a03ecc22a561..fb948f02eda5 100644
--- a/drivers/bluetooth/btuart_cs.c
+++ b/drivers/bluetooth/btuart_cs.c
@@ -149,7 +149,8 @@ static void btuart_write_wakeup(btuart_info_t *info)
                 if (!pcmcia_dev_present(info->p_dev))
                         return;
 
-                if (!(skb = skb_dequeue(&(info->txq))))
+                skb = skb_dequeue(&(info->txq));
+                if (!skb)
                         break;
 
                 /* Send frame */
@@ -190,7 +191,8 @@ static void btuart_receive(btuart_info_t *info)
                 if (info->rx_skb == NULL) {
                         info->rx_state = RECV_WAIT_PACKET_TYPE;
                         info->rx_count = 0;
-                        if (!(info->rx_skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC))) {
+                        info->rx_skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC);
+                        if (!info->rx_skb) {
                                 BT_ERR("Can't allocate mem for new packet");
                                 return;
                         }
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 199b9d42489c..f338b0c5a8de 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -159,6 +159,7 @@ static const struct usb_device_id blacklist_table[] = {
         { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0x3005), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bluetooth/dtl1_cs.c b/drivers/bluetooth/dtl1_cs.c
index 52eed1f3565d..2bd8fad17206 100644
--- a/drivers/bluetooth/dtl1_cs.c
+++ b/drivers/bluetooth/dtl1_cs.c
@@ -153,7 +153,8 @@ static void dtl1_write_wakeup(dtl1_info_t *info)
                 if (!pcmcia_dev_present(info->p_dev))
                         return;
 
-                if (!(skb = skb_dequeue(&(info->txq))))
+                skb = skb_dequeue(&(info->txq));
+                if (!skb)
                         break;
 
                 /* Send frame */
@@ -215,13 +216,15 @@ static void dtl1_receive(dtl1_info_t *info)
                 info->hdev->stat.byte_rx++;
 
                 /* Allocate packet */
-                if (info->rx_skb == NULL)
-                        if (!(info->rx_skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC))) {
+                if (info->rx_skb == NULL) {
+                        info->rx_skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC);
+                        if (!info->rx_skb) {
                                 BT_ERR("Can't allocate mem for new packet");
                                 info->rx_state = RECV_WAIT_NSH;
                                 info->rx_count = NSHL;
                                 return;
                         }
+                }
 
                 *skb_put(info->rx_skb, 1) = inb(iobase + UART_RX);
                 nsh = (nsh_t *)info->rx_skb->data;
diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c
index 0bc87f7abd95..21cc45b34f13 100644
--- a/drivers/bluetooth/hci_bcsp.c
+++ b/drivers/bluetooth/hci_bcsp.c
@@ -291,7 +291,8 @@ static struct sk_buff *bcsp_dequeue(struct hci_uart *hu)
         /* First of all, check for unreliable messages in the queue,
            since they have priority */
 
-        if ((skb = skb_dequeue(&bcsp->unrel)) != NULL) {
+        skb = skb_dequeue(&bcsp->unrel);
+        if (skb != NULL) {
                 struct sk_buff *nskb = bcsp_prepare_pkt(bcsp, skb->data, skb->len, bt_cb(skb)->pkt_type);
                 if (nskb) {
                         kfree_skb(skb);
@@ -308,16 +309,20 @@ static struct sk_buff *bcsp_dequeue(struct hci_uart *hu)
 
         spin_lock_irqsave_nested(&bcsp->unack.lock, flags, SINGLE_DEPTH_NESTING);
 
-        if (bcsp->unack.qlen < BCSP_TXWINSIZE && (skb = skb_dequeue(&bcsp->rel)) != NULL) {
-                struct sk_buff *nskb = bcsp_prepare_pkt(bcsp, skb->data, skb->len, bt_cb(skb)->pkt_type);
-                if (nskb) {
-                        __skb_queue_tail(&bcsp->unack, skb);
-                        mod_timer(&bcsp->tbcsp, jiffies + HZ / 4);
-                        spin_unlock_irqrestore(&bcsp->unack.lock, flags);
-                        return nskb;
-                } else {
-                        skb_queue_head(&bcsp->rel, skb);
-                        BT_ERR("Could not dequeue pkt because alloc_skb failed");
+        if (bcsp->unack.qlen < BCSP_TXWINSIZE) {
+                skb = skb_dequeue(&bcsp->rel);
+                if (skb != NULL) {
+                        struct sk_buff *nskb = bcsp_prepare_pkt(bcsp, skb->data, skb->len,
+                                                                bt_cb(skb)->pkt_type);
+                        if (nskb) {
+                                __skb_queue_tail(&bcsp->unack, skb);
+                                mod_timer(&bcsp->tbcsp, jiffies + HZ / 4);
+                                spin_unlock_irqrestore(&bcsp->unack.lock, flags);
+                                return nskb;
+                        } else {
+                                skb_queue_head(&bcsp->rel, skb);
+                                BT_ERR("Could not dequeue pkt because alloc_skb failed");
+                        }
                 }
         }
 
@@ -715,6 +720,9 @@ static int bcsp_open(struct hci_uart *hu)
 static int bcsp_close(struct hci_uart *hu)
 {
         struct bcsp_struct *bcsp = hu->priv;
+
+        del_timer_sync(&bcsp->tbcsp);
+
         hu->priv = NULL;
 
         BT_DBG("hu %p", hu);
@@ -722,7 +730,6 @@ static int bcsp_close(struct hci_uart *hu)
         skb_queue_purge(&bcsp->unack);
         skb_queue_purge(&bcsp->rel);
         skb_queue_purge(&bcsp->unrel);
-        del_timer(&bcsp->tbcsp);
 
         kfree(bcsp);
         return 0;
diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c
index f6f497450560..04680ead9275 100644
--- a/drivers/bluetooth/hci_h5.c
+++ b/drivers/bluetooth/hci_h5.c
@@ -206,12 +206,12 @@ static int h5_close(struct hci_uart *hu)
 {
         struct h5 *h5 = hu->priv;
 
+        del_timer_sync(&h5->timer);
+
         skb_queue_purge(&h5->unack);
         skb_queue_purge(&h5->rel);
         skb_queue_purge(&h5->unrel);
 
-        del_timer(&h5->timer);
-
         kfree(h5);
 
         return 0;
@@ -673,7 +673,8 @@ static struct sk_buff *h5_dequeue(struct hci_uart *hu)
                 return h5_prepare_pkt(hu, HCI_3WIRE_LINK_PKT, wakeup_req, 2);
         }
 
-        if ((skb = skb_dequeue(&h5->unrel)) != NULL) {
+        skb = skb_dequeue(&h5->unrel);
+        if (skb != NULL) {
                 nskb = h5_prepare_pkt(hu, bt_cb(skb)->pkt_type,
                                       skb->data, skb->len);
                 if (nskb) {
@@ -690,7 +691,8 @@ static struct sk_buff *h5_dequeue(struct hci_uart *hu)
         if (h5->unack.qlen >= h5->tx_win)
                 goto unlock;
 
-        if ((skb = skb_dequeue(&h5->rel)) != NULL) {
+        skb = skb_dequeue(&h5->rel);
+        if (skb != NULL) {
                 nskb = h5_prepare_pkt(hu, bt_cb(skb)->pkt_type,
                                       skb->data, skb->len);
                 if (nskb) {
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 6e06f6f69152..f1fbf4f1e5be 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -271,7 +271,8 @@ static int hci_uart_tty_open(struct tty_struct *tty)
         if (tty->ops->write == NULL)
                 return -EOPNOTSUPP;
 
-        if (!(hu = kzalloc(sizeof(struct hci_uart), GFP_KERNEL))) {
+        hu = kzalloc(sizeof(struct hci_uart), GFP_KERNEL);
+        if (!hu) {
                 BT_ERR("Can't allocate control structure");
                 return -ENFILE;
         }
@@ -569,7 +570,8 @@ static int __init hci_uart_init(void)
         hci_uart_ldisc.write_wakeup     = hci_uart_tty_wakeup;
         hci_uart_ldisc.owner            = THIS_MODULE;
 
-        if ((err = tty_register_ldisc(N_HCI, &hci_uart_ldisc))) {
+        err = tty_register_ldisc(N_HCI, &hci_uart_ldisc);
+        if (err) {
                 BT_ERR("HCI line discipline registration failed. (%d)", err);
                 return err;
         }
@@ -614,7 +616,8 @@ static void __exit hci_uart_exit(void)
 #endif
 
         /* Release tty registration of line discipline */
-        if ((err = tty_unregister_ldisc(N_HCI)))
+        err = tty_unregister_ldisc(N_HCI);
+        if (err)
                 BT_ERR("Can't unregister HCI line discipline (%d)", err);
 }
 
diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index d1fab435f5a3..b2137e8f7ca6 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -116,7 +116,7 @@ config AT76C50X_USB
 
 config AIRO_CS
         tristate "Cisco/Aironet 34X/35X/4500/4800 PCMCIA cards"
-        depends on PCMCIA && (BROKEN || !M32R)
+        depends on CFG80211 && PCMCIA && (BROKEN || !M32R)
         select WIRELESS_EXT
         select WEXT_SPY
         select WEXT_PRIV
@@ -281,5 +281,6 @@ source "drivers/net/wireless/ti/Kconfig"
 source "drivers/net/wireless/zd1211rw/Kconfig"
 source "drivers/net/wireless/mwifiex/Kconfig"
 source "drivers/net/wireless/cw1200/Kconfig"
+source "drivers/net/wireless/rsi/Kconfig"
 
 endif # WLAN
diff --git a/drivers/net/wireless/Makefile b/drivers/net/wireless/Makefile
index 0fab227025be..0c8891686718 100644
--- a/drivers/net/wireless/Makefile
+++ b/drivers/net/wireless/Makefile
@@ -59,3 +59,4 @@ obj-$(CONFIG_BRCMFMAC)	+= brcm80211/
 obj-$(CONFIG_BRCMSMAC)  += brcm80211/
 
 obj-$(CONFIG_CW1200)    += cw1200/
+obj-$(CONFIG_RSI_91X)   += rsi/
diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
index d239acc26125..a889fd66fc63 100644
--- a/drivers/net/wireless/ath/ath.h
+++ b/drivers/net/wireless/ath/ath.h
@@ -56,6 +56,15 @@ enum ath_device_state {
         ATH_HW_INITIALIZED,
 };
 
+enum ath_op_flags {
+        ATH_OP_INVALID,
+        ATH_OP_BEACONS,
+        ATH_OP_ANI_RUN,
+        ATH_OP_PRIM_STA_VIF,
+        ATH_OP_HW_RESET,
+        ATH_OP_SCANNING,
+};
+
 enum ath_bus_type {
         ATH_PCI,
         ATH_AHB,
@@ -130,6 +139,7 @@ struct ath_common {
         struct ieee80211_hw *hw;
         int debug_mask;
         enum ath_device_state state;
+        unsigned long op_flags;
 
         struct ath_ani ani;
 
diff --git a/drivers/net/wireless/ath/ath10k/ce.c b/drivers/net/wireless/ath/ath10k/ce.c
index d44d618b05f9..a79499c82350 100644
--- a/drivers/net/wireless/ath/ath10k/ce.c
+++ b/drivers/net/wireless/ath/ath10k/ce.c
@@ -266,12 +266,12 @@ static inline void ath10k_ce_engine_int_status_clear(struct ath10k *ar,
  * ath10k_ce_sendlist_send.
  * The caller takes responsibility for any needed locking.
  */
-static int ath10k_ce_send_nolock(struct ath10k_ce_pipe *ce_state,
-                                 void *per_transfer_context,
-                                 u32 buffer,
-                                 unsigned int nbytes,
-                                 unsigned int transfer_id,
-                                 unsigned int flags)
+int ath10k_ce_send_nolock(struct ath10k_ce_pipe *ce_state,
+                          void *per_transfer_context,
+                          u32 buffer,
+                          unsigned int nbytes,
+                          unsigned int transfer_id,
+                          unsigned int flags)
 {
         struct ath10k *ar = ce_state->ar;
         struct ath10k_ce_ring *src_ring = ce_state->src_ring;
@@ -1067,9 +1067,9 @@ struct ath10k_ce_pipe *ath10k_ce_init(struct ath10k *ar,
          *
          * For the lack of a better place do the check here.
          */
-        BUILD_BUG_ON(TARGET_NUM_MSDU_DESC >
+        BUILD_BUG_ON(2*TARGET_NUM_MSDU_DESC >
                      (CE_HTT_H2T_MSG_SRC_NENTRIES - 1));
-        BUILD_BUG_ON(TARGET_10X_NUM_MSDU_DESC >
+        BUILD_BUG_ON(2*TARGET_10X_NUM_MSDU_DESC >
                      (CE_HTT_H2T_MSG_SRC_NENTRIES - 1));
 
         ret = ath10k_pci_wake(ar);
diff --git a/drivers/net/wireless/ath/ath10k/ce.h b/drivers/net/wireless/ath/ath10k/ce.h
index 67dbde6a5c74..8eb7f99ed992 100644
--- a/drivers/net/wireless/ath/ath10k/ce.h
+++ b/drivers/net/wireless/ath/ath10k/ce.h
@@ -23,7 +23,7 @@
 
 /* Maximum number of Copy Engine's supported */
 #define CE_COUNT_MAX 8
-#define CE_HTT_H2T_MSG_SRC_NENTRIES 2048
+#define CE_HTT_H2T_MSG_SRC_NENTRIES 4096
 
 /* Descriptor rings must be aligned to this boundary */
 #define CE_DESC_RING_ALIGN      8
@@ -152,6 +152,13 @@ int ath10k_ce_send(struct ath10k_ce_pipe *ce_state,
                    unsigned int transfer_id,
                    unsigned int flags);
 
+int ath10k_ce_send_nolock(struct ath10k_ce_pipe *ce_state,
+                          void *per_transfer_context,
+                          u32 buffer,
+                          unsigned int nbytes,
+                          unsigned int transfer_id,
+                          unsigned int flags);
+
 void ath10k_ce_send_cb_register(struct ath10k_ce_pipe *ce_state,
                                 void (*send_cb)(struct ath10k_ce_pipe *),
                                 int disable_interrupts);
diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h
index 1fc26fe057e8..0e71979d837c 100644
--- a/drivers/net/wireless/ath/ath10k/core.h
+++ b/drivers/net/wireless/ath/ath10k/core.h
@@ -62,16 +62,13 @@ struct ath10k;
 
 struct ath10k_skb_cb {
         dma_addr_t paddr;
-        bool is_mapped;
-        bool is_aborted;
         u8 vdev_id;
 
         struct {
                 u8 tid;
                 bool is_offchan;
-
-                u8 frag_len;
-                u8 pad_len;
+                struct ath10k_htt_txbuf *txbuf;
+                u32 txbuf_paddr;
         } __packed htt;
 
         struct {
@@ -87,32 +84,6 @@ static inline struct ath10k_skb_cb *ATH10K_SKB_CB(struct sk_buff *skb)
         return (struct ath10k_skb_cb *)&IEEE80211_SKB_CB(skb)->driver_data;
 }
 
-static inline int ath10k_skb_map(struct device *dev, struct sk_buff *skb)
-{
-        if (ATH10K_SKB_CB(skb)->is_mapped)
-                return -EINVAL;
-
-        ATH10K_SKB_CB(skb)->paddr = dma_map_single(dev, skb->data, skb->len,
-                                                   DMA_TO_DEVICE);
-
-        if (unlikely(dma_mapping_error(dev, ATH10K_SKB_CB(skb)->paddr)))
-                return -EIO;
-
-        ATH10K_SKB_CB(skb)->is_mapped = true;
-        return 0;
-}
-
-static inline int ath10k_skb_unmap(struct device *dev, struct sk_buff *skb)
-{
-        if (!ATH10K_SKB_CB(skb)->is_mapped)
-                return -EINVAL;
-
-        dma_unmap_single(dev, ATH10K_SKB_CB(skb)->paddr, skb->len,
-                         DMA_TO_DEVICE);
-        ATH10K_SKB_CB(skb)->is_mapped = false;
-        return 0;
-}
-
 static inline u32 host_interest_item_address(u32 item_offset)
 {
         return QCA988X_HOST_INTEREST_ADDRESS + item_offset;
@@ -288,6 +259,7 @@ struct ath10k_vif {
 
         u8 fixed_rate;
         u8 fixed_nss;
+        u8 force_sgi;
 };
 
 struct ath10k_vif_iter {
diff --git a/drivers/net/wireless/ath/ath10k/hif.h b/drivers/net/wireless/ath/ath10k/hif.h
index dcdea68bcc0a..2ac7beacddca 100644
--- a/drivers/net/wireless/ath/ath10k/hif.h
+++ b/drivers/net/wireless/ath/ath10k/hif.h
@@ -21,6 +21,14 @@
 #include <linux/kernel.h>
 #include "core.h"
 
+struct ath10k_hif_sg_item {
+        u16 transfer_id;
+        void *transfer_context; /* NULL = tx completion callback not called */
+        void *vaddr; /* for debugging mostly */
+        u32 paddr;
+        u16 len;
+};
+
 struct ath10k_hif_cb {
         int (*tx_completion)(struct ath10k *ar,
                              struct sk_buff *wbuf,
@@ -31,11 +39,9 @@ struct ath10k_hif_cb {
 };
 
 struct ath10k_hif_ops {
-        /* Send the head of a buffer to HIF for transmission to the target. */
-        int (*send_head)(struct ath10k *ar, u8 pipe_id,
-                         unsigned int transfer_id,
-                         unsigned int nbytes,
-                         struct sk_buff *buf);
+        /* send a scatter-gather list to the target */
+        int (*tx_sg)(struct ath10k *ar, u8 pipe_id,
+                     struct ath10k_hif_sg_item *items, int n_items);
 
         /*
          * API to handle HIF-specific BMI message exchanges, this API is
@@ -86,12 +92,11 @@ struct ath10k_hif_ops {
 };
 
 
-static inline int ath10k_hif_send_head(struct ath10k *ar, u8 pipe_id,
-                                       unsigned int transfer_id,
-                                       unsigned int nbytes,
-                                       struct sk_buff *buf)
+static inline int ath10k_hif_tx_sg(struct ath10k *ar, u8 pipe_id,
+                                   struct ath10k_hif_sg_item *items,
+                                   int n_items)
 {
-        return ar->hif.ops->send_head(ar, pipe_id, transfer_id, nbytes, buf);
+        return ar->hif.ops->tx_sg(ar, pipe_id, items, n_items);
 }
 
 static inline int ath10k_hif_exchange_bmi_msg(struct ath10k *ar,
diff --git a/drivers/net/wireless/ath/ath10k/htc.c b/drivers/net/wireless/ath/ath10k/htc.c
index edc57ab505c8..7f1bccd3597f 100644
--- a/drivers/net/wireless/ath/ath10k/htc.c
+++ b/drivers/net/wireless/ath/ath10k/htc.c
@@ -63,7 +63,9 @@ static struct sk_buff *ath10k_htc_build_tx_ctrl_skb(void *ar)
 static inline void ath10k_htc_restore_tx_skb(struct ath10k_htc *htc,
                                              struct sk_buff *skb)
 {
-        ath10k_skb_unmap(htc->ar->dev, skb);
+        struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(skb);
+
+        dma_unmap_single(htc->ar->dev, skb_cb->paddr, skb->len, DMA_TO_DEVICE);
         skb_pull(skb, sizeof(struct ath10k_htc_hdr));
 }
 
@@ -122,6 +124,9 @@ int ath10k_htc_send(struct ath10k_htc *htc,
                     struct sk_buff *skb)
 {
         struct ath10k_htc_ep *ep = &htc->endpoint[eid];
+        struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(skb);
+        struct ath10k_hif_sg_item sg_item;
+        struct device *dev = htc->ar->dev;
         int credits = 0;
         int ret;
 
@@ -157,19 +162,25 @@ int ath10k_htc_send(struct ath10k_htc *htc,
 
         ath10k_htc_prepare_tx_skb(ep, skb);
 
-        ret = ath10k_skb_map(htc->ar->dev, skb);
+        skb_cb->paddr = dma_map_single(dev, skb->data, skb->len, DMA_TO_DEVICE);
+        ret = dma_mapping_error(dev, skb_cb->paddr);
         if (ret)
                 goto err_credits;
 
-        ret = ath10k_hif_send_head(htc->ar, ep->ul_pipe_id, ep->eid,
-                                   skb->len, skb);
+        sg_item.transfer_id = ep->eid;
+        sg_item.transfer_context = skb;
+        sg_item.vaddr = skb->data;
+        sg_item.paddr = skb_cb->paddr;
+        sg_item.len = skb->len;
+
+        ret = ath10k_hif_tx_sg(htc->ar, ep->ul_pipe_id, &sg_item, 1);
         if (ret)
                 goto err_unmap;
 
         return 0;
 
 err_unmap:
-        ath10k_skb_unmap(htc->ar->dev, skb);
+        dma_unmap_single(dev, skb_cb->paddr, skb->len, DMA_TO_DEVICE);
 err_credits:
         if (ep->tx_credit_flow_enabled) {
                 spin_lock_bh(&htc->tx_lock);
@@ -191,10 +202,8 @@ static int ath10k_htc_tx_completion_handler(struct ath10k *ar,
         struct ath10k_htc *htc = &ar->htc;
         struct ath10k_htc_ep *ep = &htc->endpoint[eid];
 
-        if (!skb) {
-                ath10k_warn("invalid sk_buff completion - NULL pointer. firmware crashed?\n");
+        if (WARN_ON_ONCE(!skb))
                 return 0;
-        }
 
         ath10k_htc_notify_tx_completion(ep, skb);
         /* the skb now belongs to the completion handler */
diff --git a/drivers/net/wireless/ath/ath10k/htt.h b/drivers/net/wireless/ath/ath10k/htt.h
index b93ae355bc08..654867fc1ae7 100644
--- a/drivers/net/wireless/ath/ath10k/htt.h
+++ b/drivers/net/wireless/ath/ath10k/htt.h
@@ -20,6 +20,7 @@
 
 #include <linux/bug.h>
 #include <linux/interrupt.h>
+#include <linux/dmapool.h>
 
 #include "htc.h"
 #include "rx_desc.h"
@@ -1181,11 +1182,20 @@ struct htt_rx_info {
                 u32 info1;
                 u32 info2;
         } rate;
+
+        u32 tsf;
         bool fcs_err;
         bool amsdu_more;
         bool mic_err;
 };
 
+struct ath10k_htt_txbuf {
+        struct htt_data_tx_desc_frag frags[2];
+        struct ath10k_htc_hdr htc_hdr;
+        struct htt_cmd_hdr cmd_hdr;
+        struct htt_data_tx_desc cmd_tx;
+} __packed;
+
 struct ath10k_htt {
         struct ath10k *ar;
         enum ath10k_htc_ep_id eid;
@@ -1267,11 +1277,18 @@ struct ath10k_htt {
         struct sk_buff **pending_tx;
         unsigned long *used_msdu_ids; /* bitmap */
         wait_queue_head_t empty_tx_wq;
+        struct dma_pool *tx_pool;
 
         /* set if host-fw communication goes haywire
          * used to avoid further failures */
         bool rx_confused;
         struct tasklet_struct rx_replenish_task;
+
+        /* This is used to group tx/rx completions separately and process them
+         * in batches to reduce cache stalls */
+        struct tasklet_struct txrx_compl_task;
+        struct sk_buff_head tx_compl_q;
+        struct sk_buff_head rx_compl_q;
 };
 
 #define RX_HTT_HDR_STATUS_LEN 64
@@ -1343,4 +1360,5 @@ int ath10k_htt_tx_alloc_msdu_id(struct ath10k_htt *htt);
 void ath10k_htt_tx_free_msdu_id(struct ath10k_htt *htt, u16 msdu_id);
 int ath10k_htt_mgmt_tx(struct ath10k_htt *htt, struct sk_buff *);
 int ath10k_htt_tx(struct ath10k_htt *htt, struct sk_buff *);
+
 #endif
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index 4767c24bf819..cdcbe2de95f9 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -43,7 +43,7 @@
 
 
 static int ath10k_htt_rx_get_csum_state(struct sk_buff *skb);
-
+static void ath10k_htt_txrx_compl_task(unsigned long ptr);
 
 static int ath10k_htt_rx_ring_size(struct ath10k_htt *htt)
 {
@@ -225,18 +225,16 @@ static void ath10k_htt_rx_ring_refill_retry(unsigned long arg)
         ath10k_htt_rx_msdu_buff_replenish(htt);
 }
 
-static unsigned ath10k_htt_rx_ring_elems(struct ath10k_htt *htt)
-{
-        return (__le32_to_cpu(*htt->rx_ring.alloc_idx.vaddr) -
-                htt->rx_ring.sw_rd_idx.msdu_payld) & htt->rx_ring.size_mask;
-}
-
 void ath10k_htt_rx_detach(struct ath10k_htt *htt)
 {
         int sw_rd_idx = htt->rx_ring.sw_rd_idx.msdu_payld;
 
         del_timer_sync(&htt->rx_ring.refill_retry_timer);
         tasklet_kill(&htt->rx_replenish_task);
+        tasklet_kill(&htt->txrx_compl_task);
+
+        skb_queue_purge(&htt->tx_compl_q);
+        skb_queue_purge(&htt->rx_compl_q);
 
         while (sw_rd_idx != __le32_to_cpu(*(htt->rx_ring.alloc_idx.vaddr))) {
                 struct sk_buff *skb =
@@ -270,10 +268,12 @@ static inline struct sk_buff *ath10k_htt_rx_netbuf_pop(struct ath10k_htt *htt)
         int idx;
         struct sk_buff *msdu;
 
-        spin_lock_bh(&htt->rx_ring.lock);
+        lockdep_assert_held(&htt->rx_ring.lock);
 
-        if (ath10k_htt_rx_ring_elems(htt) == 0)
-                ath10k_warn("htt rx ring is empty!\n");
+        if (htt->rx_ring.fill_cnt == 0) {
+                ath10k_warn("tried to pop sk_buff from an empty rx ring\n");
+                return NULL;
+        }
 
         idx = htt->rx_ring.sw_rd_idx.msdu_payld;
         msdu = htt->rx_ring.netbufs_ring[idx];
@@ -283,7 +283,6 @@ static inline struct sk_buff *ath10k_htt_rx_netbuf_pop(struct ath10k_htt *htt)
         htt->rx_ring.sw_rd_idx.msdu_payld = idx;
         htt->rx_ring.fill_cnt--;
 
-        spin_unlock_bh(&htt->rx_ring.lock);
         return msdu;
 }
 
@@ -307,8 +306,7 @@ static int ath10k_htt_rx_amsdu_pop(struct ath10k_htt *htt,
         struct sk_buff *msdu;
         struct htt_rx_desc *rx_desc;
 
-        if (ath10k_htt_rx_ring_elems(htt) == 0)
-                ath10k_warn("htt rx ring is empty!\n");
+        lockdep_assert_held(&htt->rx_ring.lock);
 
         if (htt->rx_confused) {
                 ath10k_warn("htt is confused. refusing rx\n");
@@ -400,6 +398,7 @@ static int ath10k_htt_rx_amsdu_pop(struct ath10k_htt *htt,
                 msdu_len = MS(__le32_to_cpu(rx_desc->msdu_start.info0),
                               RX_MSDU_START_INFO0_MSDU_LENGTH);
                 msdu_chained = rx_desc->frag_info.ring2_more_count;
+                msdu_chaining = msdu_chained;
 
                 if (msdu_len_invalid)
                         msdu_len = 0;
@@ -427,7 +426,6 @@ static int ath10k_htt_rx_amsdu_pop(struct ath10k_htt *htt,
 
                         msdu->next = next;
                         msdu = next;
-                        msdu_chaining = 1;
                 }
 
                 last_msdu = __le32_to_cpu(rx_desc->msdu_end.info0) &
@@ -529,6 +527,12 @@ int ath10k_htt_rx_attach(struct ath10k_htt *htt)
         tasklet_init(&htt->rx_replenish_task, ath10k_htt_rx_replenish_task,
                      (unsigned long)htt);
 
+        skb_queue_head_init(&htt->tx_compl_q);
+        skb_queue_head_init(&htt->rx_compl_q);
+
+        tasklet_init(&htt->txrx_compl_task, ath10k_htt_txrx_compl_task,
+                     (unsigned long)htt);
+
         ath10k_dbg(ATH10K_DBG_BOOT, "htt rx ring size %d fill_level %d\n",
                    htt->rx_ring.size, htt->rx_ring.fill_level);
         return 0;
@@ -632,6 +636,12 @@ struct amsdu_subframe_hdr {
         __be16 len;
 } __packed;
 
+static int ath10k_htt_rx_nwifi_hdrlen(struct ieee80211_hdr *hdr)
+{
+        /* nwifi header is padded to 4 bytes. this fixes 4addr rx */
+        return round_up(ieee80211_hdrlen(hdr->frame_control), 4);
+}
+
 static void ath10k_htt_rx_amsdu(struct ath10k_htt *htt,
                                 struct htt_rx_info *info)
 {
@@ -681,7 +691,7 @@ static void ath10k_htt_rx_amsdu(struct ath10k_htt *htt,
                 case RX_MSDU_DECAP_NATIVE_WIFI:
                         /* pull decapped header and copy DA */
                         hdr = (struct ieee80211_hdr *)skb->data;
-                        hdr_len = ieee80211_hdrlen(hdr->frame_control);
+                        hdr_len = ath10k_htt_rx_nwifi_hdrlen(hdr);
                         memcpy(addr, ieee80211_get_DA(hdr), ETH_ALEN);
                         skb_pull(skb, hdr_len);
 
@@ -768,7 +778,7 @@ static void ath10k_htt_rx_msdu(struct ath10k_htt *htt, struct htt_rx_info *info)
         case RX_MSDU_DECAP_NATIVE_WIFI:
                 /* Pull decapped header */
                 hdr = (struct ieee80211_hdr *)skb->data;
-                hdr_len = ieee80211_hdrlen(hdr->frame_control);
+                hdr_len = ath10k_htt_rx_nwifi_hdrlen(hdr);
                 skb_pull(skb, hdr_len);
 
                 /* Push original header */
@@ -846,6 +856,20 @@ static bool ath10k_htt_rx_has_mic_err(struct sk_buff *skb)
         return false;
 }
 
+static bool ath10k_htt_rx_is_mgmt(struct sk_buff *skb)
+{
+        struct htt_rx_desc *rxd;
+        u32 flags;
+
+        rxd = (void *)skb->data - sizeof(*rxd);
+        flags = __le32_to_cpu(rxd->attention.flags);
+
+        if (flags & RX_ATTENTION_FLAGS_MGMT_TYPE)
+                return true;
+
+        return false;
+}
+
 static int ath10k_htt_rx_get_csum_state(struct sk_buff *skb)
 {
         struct htt_rx_desc *rxd;
@@ -877,6 +901,57 @@ static int ath10k_htt_rx_get_csum_state(struct sk_buff *skb)
         return CHECKSUM_UNNECESSARY;
 }
 
+static int ath10k_unchain_msdu(struct sk_buff *msdu_head)
+{
+        struct sk_buff *next = msdu_head->next;
+        struct sk_buff *to_free = next;
+        int space;
+        int total_len = 0;
+
+        /* TODO:  Might could optimize this by using
+         * skb_try_coalesce or similar method to
+         * decrease copying, or maybe get mac80211 to
+         * provide a way to just receive a list of
+         * skb?
+         */
+
+        msdu_head->next = NULL;
+
+        /* Allocate total length all at once. */
+        while (next) {
+                total_len += next->len;
+                next = next->next;
+        }
+
+        space = total_len - skb_tailroom(msdu_head);
+        if ((space > 0) &&
+            (pskb_expand_head(msdu_head, 0, space, GFP_ATOMIC) < 0)) {
+                /* TODO:  bump some rx-oom error stat */
+                /* put it back together so we can free the
+                 * whole list at once.
+                 */
+                msdu_head->next = to_free;
+                return -1;
+        }
+
+        /* Walk list again, copying contents into
+         * msdu_head
+         */
+        next = to_free;
+        while (next) {
+                skb_copy_from_linear_data(next, skb_put(msdu_head, next->len),
+                                          next->len);
+                next = next->next;
+        }
+
+        /* If here, we have consolidated skb.  Free the
+         * fragments and pass the main skb on up the
+         * stack.
+         */
+        ath10k_htt_rx_free_msdu_chain(to_free);
+        return 0;
+}
+
 static void ath10k_htt_rx_handler(struct ath10k_htt *htt,
                                   struct htt_rx_indication *rx)
 {
@@ -888,6 +963,8 @@ static void ath10k_htt_rx_handler(struct ath10k_htt *htt,
         u8 *fw_desc;
         int i, j;
 
+        lockdep_assert_held(&htt->rx_ring.lock);
+
         memset(&info, 0, sizeof(info));
 
         fw_desc_len = __le16_to_cpu(rx->prefix.fw_rx_desc_bytes);
@@ -940,7 +1017,8 @@ static void ath10k_htt_rx_handler(struct ath10k_htt *htt,
                         status = info.status;
 
                         /* Skip mgmt frames while we handle this in WMI */
-                        if (status == HTT_RX_IND_MPDU_STATUS_MGMT_CTRL) {
+                        if (status == HTT_RX_IND_MPDU_STATUS_MGMT_CTRL ||
+                            ath10k_htt_rx_is_mgmt(msdu_head)) {
                                 ath10k_dbg(ATH10K_DBG_HTT, "htt rx mgmt ctrl\n");
                                 ath10k_htt_rx_free_msdu_chain(msdu_head);
                                 continue;
@@ -964,10 +1042,8 @@ static void ath10k_htt_rx_handler(struct ath10k_htt *htt,
                                 continue;
                         }
 
-                        /* FIXME: we do not support chaining yet.
-                         * this needs investigation */
-                        if (msdu_chaining) {
-                                ath10k_warn("htt rx msdu_chaining is true\n");
+                        if (msdu_chaining &&
+                            (ath10k_unchain_msdu(msdu_head) < 0)) {
                                 ath10k_htt_rx_free_msdu_chain(msdu_head);
                                 continue;
                         }
@@ -990,6 +1066,7 @@ static void ath10k_htt_rx_handler(struct ath10k_htt *htt,
                         info.rate.info0 = rx->ppdu.info0;
                         info.rate.info1 = __le32_to_cpu(rx->ppdu.info1);
                         info.rate.info2 = __le32_to_cpu(rx->ppdu.info2);
+                        info.tsf = __le32_to_cpu(rx->ppdu.tsf);
 
                         hdr = ath10k_htt_rx_skb_get_hdr(msdu_head);
 
@@ -1023,8 +1100,11 @@ static void ath10k_htt_rx_frag_handler(struct ath10k_htt *htt,
 
         msdu_head = NULL;
         msdu_tail = NULL;
+
+        spin_lock_bh(&htt->rx_ring.lock);
         msdu_chaining = ath10k_htt_rx_amsdu_pop(htt, &fw_desc, &fw_desc_len,
                                                 &msdu_head, &msdu_tail);
+        spin_unlock_bh(&htt->rx_ring.lock);
 
         ath10k_dbg(ATH10K_DBG_HTT_DUMP, "htt rx frag ahead\n");
 
@@ -1116,6 +1196,45 @@ end:
         }
 }
 
+static void ath10k_htt_rx_frm_tx_compl(struct ath10k *ar,
+                                       struct sk_buff *skb)
+{
+        struct ath10k_htt *htt = &ar->htt;
+        struct htt_resp *resp = (struct htt_resp *)skb->data;
+        struct htt_tx_done tx_done = {};
+        int status = MS(resp->data_tx_completion.flags, HTT_DATA_TX_STATUS);
+        __le16 msdu_id;
+        int i;
+
+        lockdep_assert_held(&htt->tx_lock);
+
+        switch (status) {
+        case HTT_DATA_TX_STATUS_NO_ACK:
+                tx_done.no_ack = true;
+                break;
+        case HTT_DATA_TX_STATUS_OK:
+                break;
+        case HTT_DATA_TX_STATUS_DISCARD:
+        case HTT_DATA_TX_STATUS_POSTPONE:
+        case HTT_DATA_TX_STATUS_DOWNLOAD_FAIL:
+                tx_done.discard = true;
+                break;
+        default:
+                ath10k_warn("unhandled tx completion status %d\n", status);
+                tx_done.discard = true;
+                break;
+        }
+
+        ath10k_dbg(ATH10K_DBG_HTT, "htt tx completion num_msdus %d\n",
+                   resp->data_tx_completion.num_msdus);
+
+        for (i = 0; i < resp->data_tx_completion.num_msdus; i++) {
+                msdu_id = resp->data_tx_completion.msdus[i];
+                tx_done.msdu_id = __le16_to_cpu(msdu_id);
+                ath10k_txrx_tx_unref(htt, &tx_done);
+        }
+}
+
 void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb)
 {
         struct ath10k_htt *htt = &ar->htt;
@@ -1134,10 +1253,12 @@ void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb)
                 complete(&htt->target_version_received);
                 break;
         }
-        case HTT_T2H_MSG_TYPE_RX_IND: {
-                ath10k_htt_rx_handler(htt, &resp->rx_ind);
-                break;
-        }
+        case HTT_T2H_MSG_TYPE_RX_IND:
+                spin_lock_bh(&htt->rx_ring.lock);
+                __skb_queue_tail(&htt->rx_compl_q, skb);
+                spin_unlock_bh(&htt->rx_ring.lock);
+                tasklet_schedule(&htt->txrx_compl_task);
+                return;
         case HTT_T2H_MSG_TYPE_PEER_MAP: {
                 struct htt_peer_map_event ev = {
                         .vdev_id = resp->peer_map.vdev_id,
@@ -1172,44 +1293,17 @@ void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb)
                         break;
                 }
 
+                spin_lock_bh(&htt->tx_lock);
                 ath10k_txrx_tx_unref(htt, &tx_done);
+                spin_unlock_bh(&htt->tx_lock);
                 break;
         }
-        case HTT_T2H_MSG_TYPE_TX_COMPL_IND: {
-                struct htt_tx_done tx_done = {};
-                int status = MS(resp->data_tx_completion.flags,
-                                HTT_DATA_TX_STATUS);
-                __le16 msdu_id;
-                int i;
-
-                switch (status) {
-                case HTT_DATA_TX_STATUS_NO_ACK:
-                        tx_done.no_ack = true;
-                        break;
-                case HTT_DATA_TX_STATUS_OK:
-                        break;
-                case HTT_DATA_TX_STATUS_DISCARD:
-                case HTT_DATA_TX_STATUS_POSTPONE:
-                case HTT_DATA_TX_STATUS_DOWNLOAD_FAIL:
-                        tx_done.discard = true;
-                        break;
-                default:
-                        ath10k_warn("unhandled tx completion status %d\n",
-                                    status);
-                        tx_done.discard = true;
-                        break;
-                }
-
-                ath10k_dbg(ATH10K_DBG_HTT, "htt tx completion num_msdus %d\n",
-                           resp->data_tx_completion.num_msdus);
-
-                for (i = 0; i < resp->data_tx_completion.num_msdus; i++) {
-                        msdu_id = resp->data_tx_completion.msdus[i];
-                        tx_done.msdu_id = __le16_to_cpu(msdu_id);
-                        ath10k_txrx_tx_unref(htt, &tx_done);
-                }
-                break;
-        }
+        case HTT_T2H_MSG_TYPE_TX_COMPL_IND:
+                spin_lock_bh(&htt->tx_lock);
+                __skb_queue_tail(&htt->tx_compl_q, skb);
+                spin_unlock_bh(&htt->tx_lock);
+                tasklet_schedule(&htt->txrx_compl_task);
+                return;
         case HTT_T2H_MSG_TYPE_SEC_IND: {
                 struct ath10k *ar = htt->ar;
                 struct htt_security_indication *ev = &resp->security_indication;
@@ -1249,3 +1343,25 @@ void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb)
         /* Free the indication buffer */
         dev_kfree_skb_any(skb);
 }
+
+static void ath10k_htt_txrx_compl_task(unsigned long ptr)
+{
+        struct ath10k_htt *htt = (struct ath10k_htt *)ptr;
+        struct htt_resp *resp;
+        struct sk_buff *skb;
+
+        spin_lock_bh(&htt->tx_lock);
+        while ((skb = __skb_dequeue(&htt->tx_compl_q))) {
+                ath10k_htt_rx_frm_tx_compl(htt->ar, skb);
+                dev_kfree_skb_any(skb);
+        }
+        spin_unlock_bh(&htt->tx_lock);
+
+        spin_lock_bh(&htt->rx_ring.lock);
+        while ((skb = __skb_dequeue(&htt->rx_compl_q))) {
+                resp = (struct htt_resp *)skb->data;
+                ath10k_htt_rx_handler(htt, &resp->rx_ind);
+                dev_kfree_skb_any(skb);
+        }
+        spin_unlock_bh(&htt->rx_ring.lock);
+}
diff --git a/drivers/net/wireless/ath/ath10k/htt_tx.c b/drivers/net/wireless/ath/ath10k/htt_tx.c
index acaa046dc93b..7a3e2e40dd5c 100644
--- a/drivers/net/wireless/ath/ath10k/htt_tx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_tx.c
@@ -109,6 +109,14 @@ int ath10k_htt_tx_attach(struct ath10k_htt *htt)
                 return -ENOMEM;
         }
 
+        htt->tx_pool = dma_pool_create("ath10k htt tx pool", htt->ar->dev,
+                                       sizeof(struct ath10k_htt_txbuf), 4, 0);
+        if (!htt->tx_pool) {
+                kfree(htt->used_msdu_ids);
+                kfree(htt->pending_tx);
+                return -ENOMEM;
+        }
+
         return 0;
 }
 
@@ -117,9 +125,7 @@ static void ath10k_htt_tx_cleanup_pending(struct ath10k_htt *htt)
         struct htt_tx_done tx_done = {0};
         int msdu_id;
 
-        /* No locks needed. Called after communication with the device has
-         * been stopped. */
-
+        spin_lock_bh(&htt->tx_lock);
         for (msdu_id = 0; msdu_id < htt->max_num_pending_tx; msdu_id++) {
                 if (!test_bit(msdu_id, htt->used_msdu_ids))
                         continue;
@@ -132,6 +138,7 @@ static void ath10k_htt_tx_cleanup_pending(struct ath10k_htt *htt)
 
                 ath10k_txrx_tx_unref(htt, &tx_done);
         }
+        spin_unlock_bh(&htt->tx_lock);
 }
 
 void ath10k_htt_tx_detach(struct ath10k_htt *htt)
@@ -139,6 +146,7 @@ void ath10k_htt_tx_detach(struct ath10k_htt *htt)
         ath10k_htt_tx_cleanup_pending(htt);
         kfree(htt->pending_tx);
         kfree(htt->used_msdu_ids);
+        dma_pool_destroy(htt->tx_pool);
         return;
 }
 
@@ -334,7 +342,9 @@ int ath10k_htt_mgmt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
                 goto err_free_msdu_id;
         }
 
-        res = ath10k_skb_map(dev, msdu);
+        skb_cb->paddr = dma_map_single(dev, msdu->data, msdu->len,
+                                       DMA_TO_DEVICE);
+        res = dma_mapping_error(dev, skb_cb->paddr);
         if (res)
                 goto err_free_txdesc;
 
@@ -348,8 +358,7 @@ int ath10k_htt_mgmt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
         memcpy(cmd->mgmt_tx.hdr, msdu->data,
                min_t(int, msdu->len, HTT_MGMT_FRM_HDR_DOWNLOAD_LEN));
 
-        skb_cb->htt.frag_len = 0;
-        skb_cb->htt.pad_len = 0;
+        skb_cb->htt.txbuf = NULL;
 
         res = ath10k_htc_send(&htt->ar->htc, htt->eid, txdesc);
         if (res)
@@ -358,7 +367,7 @@ int ath10k_htt_mgmt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
         return 0;
 
 err_unmap_msdu:
-        ath10k_skb_unmap(dev, msdu);
+        dma_unmap_single(dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
 err_free_txdesc:
         dev_kfree_skb_any(txdesc);
 err_free_msdu_id:
@@ -375,19 +384,19 @@ err:
 int ath10k_htt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
 {
         struct device *dev = htt->ar->dev;
-        struct htt_cmd *cmd;
-        struct htt_data_tx_desc_frag *tx_frags;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)msdu->data;
         struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(msdu);
-        struct sk_buff *txdesc = NULL;
-        bool use_frags;
-        u8 vdev_id = ATH10K_SKB_CB(msdu)->vdev_id;
-        u8 tid;
-        int prefetch_len, desc_len;
-        int msdu_id = -1;
+        struct ath10k_hif_sg_item sg_items[2];
+        struct htt_data_tx_desc_frag *frags;
+        u8 vdev_id = skb_cb->vdev_id;
+        u8 tid = skb_cb->htt.tid;
+        int prefetch_len;
         int res;
-        u8 flags0;
-        u16 flags1;
+        u8 flags0 = 0;
+        u16 msdu_id, flags1 = 0;
+        dma_addr_t paddr;
+        u32 frags_paddr;
+        bool use_frags;
 
         res = ath10k_htt_tx_inc_pending(htt);
         if (res)
@@ -406,114 +415,120 @@ int ath10k_htt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
         prefetch_len = min(htt->prefetch_len, msdu->len);
         prefetch_len = roundup(prefetch_len, 4);
 
-        desc_len = sizeof(cmd->hdr) + sizeof(cmd->data_tx) + prefetch_len;
-
-        txdesc = ath10k_htc_alloc_skb(desc_len);
-        if (!txdesc) {
-                res = -ENOMEM;
-                goto err_free_msdu_id;
-        }
-
         /* Since HTT 3.0 there is no separate mgmt tx command. However in case
          * of mgmt tx using TX_FRM there is not tx fragment list. Instead of tx
          * fragment list host driver specifies directly frame pointer. */
         use_frags = htt->target_version_major < 3 ||
                     !ieee80211_is_mgmt(hdr->frame_control);
 
-        if (!IS_ALIGNED((unsigned long)txdesc->data, 4)) {
-                ath10k_warn("htt alignment check failed. dropping packet.\n");
-                res = -EIO;
-                goto err_free_txdesc;
-        }
+        skb_cb->htt.txbuf = dma_pool_alloc(htt->tx_pool, GFP_ATOMIC,
+                                           &paddr);
+        if (!skb_cb->htt.txbuf)
+                goto err_free_msdu_id;
+        skb_cb->htt.txbuf_paddr = paddr;
 
-        if (use_frags) {
-                skb_cb->htt.frag_len = sizeof(*tx_frags) * 2;
-                skb_cb->htt.pad_len = (unsigned long)msdu->data -
-                                      round_down((unsigned long)msdu->data, 4);
+        skb_cb->paddr = dma_map_single(dev, msdu->data, msdu->len,
+                                       DMA_TO_DEVICE);
+        res = dma_mapping_error(dev, skb_cb->paddr);
+        if (res)
+                goto err_free_txbuf;
 
-                skb_push(msdu, skb_cb->htt.frag_len + skb_cb->htt.pad_len);
-        } else {
-                skb_cb->htt.frag_len = 0;
-                skb_cb->htt.pad_len = 0;
-        }
+        if (likely(use_frags)) {
+                frags = skb_cb->htt.txbuf->frags;
 
-        res = ath10k_skb_map(dev, msdu);
-        if (res)
-                goto err_pull_txfrag;
-
-        if (use_frags) {
-                dma_sync_single_for_cpu(dev, skb_cb->paddr, msdu->len,
-                                        DMA_TO_DEVICE);
-
-                /* tx fragment list must be terminated with zero-entry */
-                tx_frags = (struct htt_data_tx_desc_frag *)msdu->data;
-                tx_frags[0].paddr = __cpu_to_le32(skb_cb->paddr +
-                                                  skb_cb->htt.frag_len +
-                                                  skb_cb->htt.pad_len);
-                tx_frags[0].len   = __cpu_to_le32(msdu->len -
-                                                  skb_cb->htt.frag_len -
-                                                  skb_cb->htt.pad_len);
-                tx_frags[1].paddr = __cpu_to_le32(0);
-                tx_frags[1].len   = __cpu_to_le32(0);
-
-                dma_sync_single_for_device(dev, skb_cb->paddr, msdu->len,
-                                           DMA_TO_DEVICE);
-        }
+                frags[0].paddr = __cpu_to_le32(skb_cb->paddr);
+                frags[0].len = __cpu_to_le32(msdu->len);
+                frags[1].paddr = 0;
+                frags[1].len = 0;
 
-        ath10k_dbg(ATH10K_DBG_HTT, "tx-msdu 0x%llx\n",
-                   (unsigned long long) ATH10K_SKB_CB(msdu)->paddr);
-        ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "tx-msdu: ",
-                        msdu->data, msdu->len);
+                flags0 |= SM(ATH10K_HW_TXRX_NATIVE_WIFI,
+                             HTT_DATA_TX_DESC_FLAGS0_PKT_TYPE);
 
-        skb_put(txdesc, desc_len);
-        cmd = (struct htt_cmd *)txdesc->data;
+                frags_paddr = skb_cb->htt.txbuf_paddr;
+        } else {
+                flags0 |= SM(ATH10K_HW_TXRX_MGMT,
+                             HTT_DATA_TX_DESC_FLAGS0_PKT_TYPE);
 
-        tid = ATH10K_SKB_CB(msdu)->htt.tid;
+                frags_paddr = skb_cb->paddr;
+        }
 
-        ath10k_dbg(ATH10K_DBG_HTT, "htt data tx using tid %hhu\n", tid);
+        /* Normally all commands go through HTC which manages tx credits for
+         * each endpoint and notifies when tx is completed.
+         *
+         * HTT endpoint is creditless so there's no need to care about HTC
+         * flags. In that case it is trivial to fill the HTC header here.
+         *
+         * MSDU transmission is considered completed upon HTT event. This
+         * implies no relevant resources can be freed until after the event is
+         * received. That's why HTC tx completion handler itself is ignored by
+         * setting NULL to transfer_context for all sg items.
+         *
+         * There is simply no point in pushing HTT TX_FRM through HTC tx path
+         * as it's a waste of resources. By bypassing HTC it is possible to
+         * avoid extra memory allocations, compress data structures and thus
+         * improve performance. */
+
+        skb_cb->htt.txbuf->htc_hdr.eid = htt->eid;
+        skb_cb->htt.txbuf->htc_hdr.len = __cpu_to_le16(
+                        sizeof(skb_cb->htt.txbuf->cmd_hdr) +
+                        sizeof(skb_cb->htt.txbuf->cmd_tx) +
+                        prefetch_len);
+        skb_cb->htt.txbuf->htc_hdr.flags = 0;
 
-        flags0  = 0;
         if (!ieee80211_has_protected(hdr->frame_control))
                 flags0 |= HTT_DATA_TX_DESC_FLAGS0_NO_ENCRYPT;
-        flags0 |= HTT_DATA_TX_DESC_FLAGS0_MAC_HDR_PRESENT;
 
-        if (use_frags)
-                flags0 |= SM(ATH10K_HW_TXRX_NATIVE_WIFI,
-                             HTT_DATA_TX_DESC_FLAGS0_PKT_TYPE);
-        else
-                flags0 |= SM(ATH10K_HW_TXRX_MGMT,
-                             HTT_DATA_TX_DESC_FLAGS0_PKT_TYPE);
+        flags0 |= HTT_DATA_TX_DESC_FLAGS0_MAC_HDR_PRESENT;
 
-        flags1  = 0;
         flags1 |= SM((u16)vdev_id, HTT_DATA_TX_DESC_FLAGS1_VDEV_ID);
         flags1 |= SM((u16)tid, HTT_DATA_TX_DESC_FLAGS1_EXT_TID);
         flags1 |= HTT_DATA_TX_DESC_FLAGS1_CKSUM_L3_OFFLOAD;
         flags1 |= HTT_DATA_TX_DESC_FLAGS1_CKSUM_L4_OFFLOAD;
 
-        cmd->hdr.msg_type        = HTT_H2T_MSG_TYPE_TX_FRM;
-        cmd->data_tx.flags0      = flags0;
-        cmd->data_tx.flags1      = __cpu_to_le16(flags1);
-        cmd->data_tx.len         = __cpu_to_le16(msdu->len -
-                                                 skb_cb->htt.frag_len -
-                                                 skb_cb->htt.pad_len);
-        cmd->data_tx.id          = __cpu_to_le16(msdu_id);
-        cmd->data_tx.frags_paddr = __cpu_to_le32(skb_cb->paddr);
-        cmd->data_tx.peerid      = __cpu_to_le32(HTT_INVALID_PEERID);
-
-        memcpy(cmd->data_tx.prefetch, hdr, prefetch_len);
+        skb_cb->htt.txbuf->cmd_hdr.msg_type = HTT_H2T_MSG_TYPE_TX_FRM;
+        skb_cb->htt.txbuf->cmd_tx.flags0 = flags0;
+        skb_cb->htt.txbuf->cmd_tx.flags1 = __cpu_to_le16(flags1);
+        skb_cb->htt.txbuf->cmd_tx.len = __cpu_to_le16(msdu->len);
+        skb_cb->htt.txbuf->cmd_tx.id = __cpu_to_le16(msdu_id);
+        skb_cb->htt.txbuf->cmd_tx.frags_paddr = __cpu_to_le32(frags_paddr);
+        skb_cb->htt.txbuf->cmd_tx.peerid = __cpu_to_le32(HTT_INVALID_PEERID);
+
+        ath10k_dbg(ATH10K_DBG_HTT,
+                   "htt tx flags0 %hhu flags1 %hu len %d id %hu frags_paddr %08x, msdu_paddr %08x vdev %hhu tid %hhu\n",
+                   flags0, flags1, msdu->len, msdu_id, frags_paddr,
+                   (u32)skb_cb->paddr, vdev_id, tid);
+        ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "htt tx msdu: ",
+                        msdu->data, msdu->len);
 
-        res = ath10k_htc_send(&htt->ar->htc, htt->eid, txdesc);
+        sg_items[0].transfer_id = 0;
+        sg_items[0].transfer_context = NULL;
+        sg_items[0].vaddr = &skb_cb->htt.txbuf->htc_hdr;
+        sg_items[0].paddr = skb_cb->htt.txbuf_paddr +
+                            sizeof(skb_cb->htt.txbuf->frags);
+        sg_items[0].len = sizeof(skb_cb->htt.txbuf->htc_hdr) +
+                          sizeof(skb_cb->htt.txbuf->cmd_hdr) +
+                          sizeof(skb_cb->htt.txbuf->cmd_tx);
+
+        sg_items[1].transfer_id = 0;
+        sg_items[1].transfer_context = NULL;
+        sg_items[1].vaddr = msdu->data;
+        sg_items[1].paddr = skb_cb->paddr;
+        sg_items[1].len = prefetch_len;
+
+        res = ath10k_hif_tx_sg(htt->ar,
+                               htt->ar->htc.endpoint[htt->eid].ul_pipe_id,
+                               sg_items, ARRAY_SIZE(sg_items));
         if (res)
                 goto err_unmap_msdu;
 
         return 0;
 
 err_unmap_msdu:
-        ath10k_skb_unmap(dev, msdu);
-err_pull_txfrag:
-        skb_pull(msdu, skb_cb->htt.frag_len + skb_cb->htt.pad_len);
-err_free_txdesc:
-        dev_kfree_skb_any(txdesc);
+        dma_unmap_single(dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
+err_free_txbuf:
+        dma_pool_free(htt->tx_pool,
+                      skb_cb->htt.txbuf,
+                      skb_cb->htt.txbuf_paddr);
 err_free_msdu_id:
         spin_lock_bh(&htt->tx_lock);
         htt->pending_tx[msdu_id] = NULL;
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index e17f5d732b5a..511a2f81e7af 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -323,13 +323,15 @@ static int ath10k_peer_create(struct ath10k *ar, u32 vdev_id, const u8 *addr)
 
         ret = ath10k_wmi_peer_create(ar, vdev_id, addr);
         if (ret) {
-                ath10k_warn("Failed to create wmi peer: %i\n", ret);
+                ath10k_warn("Failed to create wmi peer %pM on vdev %i: %i\n",
+                            addr, vdev_id, ret);
                 return ret;
         }
 
         ret = ath10k_wait_for_peer_created(ar, vdev_id, addr);
         if (ret) {
-                ath10k_warn("Failed to wait for created wmi peer: %i\n", ret);
+                ath10k_warn("Failed to wait for created wmi peer %pM on vdev %i: %i\n",
+                            addr, vdev_id, ret);
                 return ret;
         }
         spin_lock_bh(&ar->data_lock);
@@ -349,7 +351,8 @@ static int ath10k_mac_set_kickout(struct ath10k_vif *arvif)
         ret = ath10k_wmi_pdev_set_param(ar, param,
                                         ATH10K_KICKOUT_THRESHOLD);
         if (ret) {
-                ath10k_warn("Failed to set kickout threshold: %d\n", ret);
+                ath10k_warn("Failed to set kickout threshold on vdev %i: %d\n",
+                            arvif->vdev_id, ret);
                 return ret;
         }
 
@@ -357,8 +360,8 @@ static int ath10k_mac_set_kickout(struct ath10k_vif *arvif)
         ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, param,
                                         ATH10K_KEEPALIVE_MIN_IDLE);
         if (ret) {
-                ath10k_warn("Failed to set keepalive minimum idle time : %d\n",
-                            ret);
+                ath10k_warn("Failed to set keepalive minimum idle time on vdev %i : %d\n",
+                            arvif->vdev_id, ret);
                 return ret;
         }
 
@@ -366,8 +369,8 @@ static int ath10k_mac_set_kickout(struct ath10k_vif *arvif)
         ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, param,
                                         ATH10K_KEEPALIVE_MAX_IDLE);
         if (ret) {
-                ath10k_warn("Failed to set keepalive maximum idle time: %d\n",
-                            ret);
+                ath10k_warn("Failed to set keepalive maximum idle time on vdev %i: %d\n",
+                            arvif->vdev_id, ret);
                 return ret;
         }
 
@@ -375,8 +378,8 @@ static int ath10k_mac_set_kickout(struct ath10k_vif *arvif)
         ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, param,
                                         ATH10K_KEEPALIVE_MAX_UNRESPONSIVE);
         if (ret) {
-                ath10k_warn("Failed to set keepalive maximum unresponsive time: %d\n",
-                            ret);
+                ath10k_warn("Failed to set keepalive maximum unresponsive time on vdev %i: %d\n",
+                            arvif->vdev_id, ret);
                 return ret;
         }
 
@@ -529,13 +532,15 @@ static int ath10k_vdev_start(struct ath10k_vif *arvif)
 
         ret = ath10k_wmi_vdev_start(ar, &arg);
         if (ret) {
-                ath10k_warn("WMI vdev start failed: ret %d\n", ret);
+                ath10k_warn("WMI vdev %i start failed: ret %d\n",
+                            arg.vdev_id, ret);
                 return ret;
         }
 
         ret = ath10k_vdev_setup_sync(ar);
         if (ret) {
-                ath10k_warn("vdev setup failed %d\n", ret);
+                ath10k_warn("vdev %i setup failed %d\n",
+                            arg.vdev_id, ret);
                 return ret;
         }
 
@@ -553,13 +558,15 @@ static int ath10k_vdev_stop(struct ath10k_vif *arvif)
 
         ret = ath10k_wmi_vdev_stop(ar, arvif->vdev_id);
         if (ret) {
-                ath10k_warn("WMI vdev stop failed: ret %d\n", ret);
+                ath10k_warn("WMI vdev %i stop failed: ret %d\n",
+                            arvif->vdev_id, ret);
                 return ret;
         }
 
         ret = ath10k_vdev_setup_sync(ar);
         if (ret) {
-                ath10k_warn("vdev setup failed %d\n", ret);
+                ath10k_warn("vdev %i setup sync failed %d\n",
+                            arvif->vdev_id, ret);
                 return ret;
         }
 
@@ -597,19 +604,22 @@ static int ath10k_monitor_start(struct ath10k *ar, int vdev_id)
 
         ret = ath10k_wmi_vdev_start(ar, &arg);
         if (ret) {
-                ath10k_warn("Monitor vdev start failed: ret %d\n", ret);
+                ath10k_warn("Monitor vdev %i start failed: ret %d\n",
+                            vdev_id, ret);
                 return ret;
         }
 
         ret = ath10k_vdev_setup_sync(ar);
         if (ret) {
-                ath10k_warn("Monitor vdev setup failed %d\n", ret);
+                ath10k_warn("Monitor vdev %i setup failed %d\n",
+                            vdev_id, ret);
                 return ret;
         }
 
         ret = ath10k_wmi_vdev_up(ar, vdev_id, 0, ar->mac_addr);
         if (ret) {
-                ath10k_warn("Monitor vdev up failed: %d\n", ret);
+                ath10k_warn("Monitor vdev %i up failed: %d\n",
+                            vdev_id, ret);
                 goto vdev_stop;
         }
 
@@ -621,7 +631,8 @@ static int ath10k_monitor_start(struct ath10k *ar, int vdev_id)
 vdev_stop:
         ret = ath10k_wmi_vdev_stop(ar, ar->monitor_vdev_id);
         if (ret)
-                ath10k_warn("Monitor vdev stop failed: %d\n", ret);
+                ath10k_warn("Monitor vdev %i stop failed: %d\n",
+                            ar->monitor_vdev_id, ret);
 
         return ret;
 }
@@ -644,15 +655,18 @@ static int ath10k_monitor_stop(struct ath10k *ar)
 
         ret = ath10k_wmi_vdev_down(ar, ar->monitor_vdev_id);
         if (ret)
-                ath10k_warn("Monitor vdev down failed: %d\n", ret);
+                ath10k_warn("Monitor vdev %i down failed: %d\n",
+                            ar->monitor_vdev_id, ret);
 
         ret = ath10k_wmi_vdev_stop(ar, ar->monitor_vdev_id);
         if (ret)
-                ath10k_warn("Monitor vdev stop failed: %d\n", ret);
+                ath10k_warn("Monitor vdev %i stop failed: %d\n",
+                            ar->monitor_vdev_id, ret);
 
         ret = ath10k_vdev_setup_sync(ar);
         if (ret)
-                ath10k_warn("Monitor_down sync failed: %d\n", ret);
+                ath10k_warn("Monitor_down sync failed, vdev %i: %d\n",
+                            ar->monitor_vdev_id, ret);
 
         ar->monitor_enabled = false;
         return ret;
@@ -682,7 +696,8 @@ static int ath10k_monitor_create(struct ath10k *ar)
                                      WMI_VDEV_TYPE_MONITOR,
                                      0, ar->mac_addr);
         if (ret) {
-                ath10k_warn("WMI vdev monitor create failed: ret %d\n", ret);
+                ath10k_warn("WMI vdev %i monitor create failed: ret %d\n",
+                            ar->monitor_vdev_id, ret);
                 goto vdev_fail;
         }
 
@@ -711,7 +726,8 @@ static int ath10k_monitor_destroy(struct ath10k *ar)
 
         ret = ath10k_wmi_vdev_delete(ar, ar->monitor_vdev_id);
         if (ret) {
-                ath10k_warn("WMI vdev monitor delete failed: %d\n", ret);
+                ath10k_warn("WMI vdev %i monitor delete failed: %d\n",
+                            ar->monitor_vdev_id, ret);
                 return ret;
         }
 
@@ -839,7 +855,9 @@ static void ath10k_control_beaconing(struct ath10k_vif *arvif,
 
                 spin_lock_bh(&arvif->ar->data_lock);
                 if (arvif->beacon) {
-                        ath10k_skb_unmap(arvif->ar->dev, arvif->beacon);
+                        dma_unmap_single(arvif->ar->dev,
+                                         ATH10K_SKB_CB(arvif->beacon)->paddr,
+                                         arvif->beacon->len, DMA_TO_DEVICE);
                         dev_kfree_skb_any(arvif->beacon);
 
                         arvif->beacon = NULL;
@@ -862,8 +880,8 @@ static void ath10k_control_beaconing(struct ath10k_vif *arvif,
         ret = ath10k_wmi_vdev_up(arvif->ar, arvif->vdev_id, arvif->aid,
                                  arvif->bssid);
         if (ret) {
-                ath10k_warn("Failed to bring up VDEV: %d\n",
-                            arvif->vdev_id);
+                ath10k_warn("Failed to bring up vdev %d: %i\n",
+                            arvif->vdev_id, ret);
                 ath10k_vdev_stop(arvif);
                 return;
         }
@@ -943,8 +961,8 @@ static int ath10k_mac_vif_setup_ps(struct ath10k_vif *arvif)
                 ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id, param,
                                                   conf->dynamic_ps_timeout);
                 if (ret) {
-                        ath10k_warn("Failed to set inactivity time for VDEV: %d\n",
-                                    arvif->vdev_id);
+                        ath10k_warn("Failed to set inactivity time for vdev %d: %i\n",
+                                    arvif->vdev_id, ret);
                         return ret;
                 }
         } else {
@@ -1196,8 +1214,8 @@ static int ath10k_peer_assoc_qos_ap(struct ath10k *ar,
                                                  WMI_AP_PS_PEER_PARAM_UAPSD,
                                                  uapsd);
                 if (ret) {
-                        ath10k_warn("failed to set ap ps peer param uapsd: %d\n",
-                                    ret);
+                        ath10k_warn("failed to set ap ps peer param uapsd for vdev %i: %d\n",
+                                    arvif->vdev_id, ret);
                         return ret;
                 }
 
@@ -1206,8 +1224,8 @@ static int ath10k_peer_assoc_qos_ap(struct ath10k *ar,
                                                  WMI_AP_PS_PEER_PARAM_MAX_SP,
                                                  max_sp);
                 if (ret) {
-                        ath10k_warn("failed to set ap ps peer param max sp: %d\n",
-                                    ret);
+                        ath10k_warn("failed to set ap ps peer param max sp for vdev %i: %d\n",
+                                    arvif->vdev_id, ret);
                         return ret;
                 }
 
@@ -1218,8 +1236,8 @@ static int ath10k_peer_assoc_qos_ap(struct ath10k *ar,
                 ret = ath10k_wmi_set_ap_ps_param(ar, arvif->vdev_id, sta->addr,
                                         WMI_AP_PS_PEER_PARAM_AGEOUT_TIME, 10);
                 if (ret) {
-                        ath10k_warn("failed to set ap ps peer param ageout time: %d\n",
-                                    ret);
+                        ath10k_warn("failed to set ap ps peer param ageout time for vdev %i: %d\n",
+                                    arvif->vdev_id, ret);
                         return ret;
                 }
         }
@@ -1411,8 +1429,8 @@ static void ath10k_bss_assoc(struct ieee80211_hw *hw,
 
         ap_sta = ieee80211_find_sta(vif, bss_conf->bssid);
         if (!ap_sta) {
-                ath10k_warn("Failed to find station entry for %pM\n",
-                            bss_conf->bssid);
+                ath10k_warn("Failed to find station entry for %pM, vdev %i\n",
+                            bss_conf->bssid, arvif->vdev_id);
                 rcu_read_unlock();
                 return;
         }
@@ -1424,8 +1442,8 @@ static void ath10k_bss_assoc(struct ieee80211_hw *hw,
         ret = ath10k_peer_assoc_prepare(ar, arvif, ap_sta,
                                         bss_conf, &peer_arg);
         if (ret) {
-                ath10k_warn("Peer assoc prepare failed for %pM\n: %d",
-                            bss_conf->bssid, ret);
+                ath10k_warn("Peer assoc prepare failed for %pM vdev %i\n: %d",
+                            bss_conf->bssid, arvif->vdev_id, ret);
                 rcu_read_unlock();
                 return;
         }
@@ -1434,14 +1452,15 @@ static void ath10k_bss_assoc(struct ieee80211_hw *hw,
 
         ret = ath10k_wmi_peer_assoc(ar, &peer_arg);
         if (ret) {
-                ath10k_warn("Peer assoc failed for %pM\n: %d",
-                            bss_conf->bssid, ret);
+                ath10k_warn("Peer assoc failed for %pM vdev %i\n: %d",
+                            bss_conf->bssid, arvif->vdev_id, ret);
                 return;
         }
 
         ret = ath10k_setup_peer_smps(ar, arvif, bss_conf->bssid, &ht_cap);
         if (ret) {
-                ath10k_warn("failed to setup peer SMPS: %d\n", ret);
+                ath10k_warn("failed to setup peer SMPS for vdev %i: %d\n",
+                            arvif->vdev_id, ret);
                 return;
         }
 
@@ -1514,34 +1533,35 @@ static int ath10k_station_assoc(struct ath10k *ar, struct ath10k_vif *arvif,
 
         ret = ath10k_peer_assoc_prepare(ar, arvif, sta, NULL, &peer_arg);
         if (ret) {
-                ath10k_warn("WMI peer assoc prepare failed for %pM\n",
-                            sta->addr);
+                ath10k_warn("WMI peer assoc prepare failed for %pM vdev %i: %i\n",
+                            sta->addr, arvif->vdev_id, ret);
                 return ret;
         }
 
         ret = ath10k_wmi_peer_assoc(ar, &peer_arg);
         if (ret) {
-                ath10k_warn("Peer assoc failed for STA %pM\n: %d",
-                            sta->addr, ret);
+                ath10k_warn("Peer assoc failed for STA %pM vdev %i: %d\n",
+                            sta->addr, arvif->vdev_id, ret);
                 return ret;
         }
 
         ret = ath10k_setup_peer_smps(ar, arvif, sta->addr, &sta->ht_cap);
         if (ret) {
-                ath10k_warn("failed to setup peer SMPS: %d\n", ret);
+                ath10k_warn("failed to setup peer SMPS for vdev: %d\n", ret);
                 return ret;
         }
 
         ret = ath10k_install_peer_wep_keys(arvif, sta->addr);
         if (ret) {
-                ath10k_warn("could not install peer wep keys (%d)\n", ret);
+                ath10k_warn("could not install peer wep keys for vdev %i: %d\n",
+                            arvif->vdev_id, ret);
                 return ret;
         }
 
         ret = ath10k_peer_assoc_qos_ap(ar, arvif, sta);
         if (ret) {
-                ath10k_warn("could not set qos params for STA %pM, %d\n",
-                            sta->addr, ret);
+                ath10k_warn("could not set qos params for STA %pM for vdev %i: %d\n",
+                            sta->addr, arvif->vdev_id, ret);
                 return ret;
         }
 
@@ -1557,7 +1577,8 @@ static int ath10k_station_disassoc(struct ath10k *ar, struct ath10k_vif *arvif,
 
         ret = ath10k_clear_peer_keys(arvif, sta->addr);
         if (ret) {
-                ath10k_warn("could not clear all peer wep keys (%d)\n", ret);
+                ath10k_warn("could not clear all peer wep keys for vdev %i: %d\n",
+                            arvif->vdev_id, ret);
                 return ret;
         }
 
@@ -2524,7 +2545,8 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
         ret = ath10k_wmi_vdev_create(ar, arvif->vdev_id, arvif->vdev_type,
                                      arvif->vdev_subtype, vif->addr);
         if (ret) {
-                ath10k_warn("WMI vdev create failed: ret %d\n", ret);
+                ath10k_warn("WMI vdev %i create failed: ret %d\n",
+                            arvif->vdev_id, ret);
                 goto err;
         }
 
@@ -2535,7 +2557,8 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
         ret = ath10k_wmi_vdev_set_param(ar, 0, vdev_param,
                                         arvif->def_wep_key_idx);
         if (ret) {
-                ath10k_warn("Failed to set default keyid: %d\n", ret);
+                ath10k_warn("Failed to set vdev %i default keyid: %d\n",
+                            arvif->vdev_id, ret);
                 goto err_vdev_delete;
         }
 
@@ -2544,21 +2567,23 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
                                         ATH10K_HW_TXRX_NATIVE_WIFI);
         /* 10.X firmware does not support this VDEV parameter. Do not warn */
         if (ret && ret != -EOPNOTSUPP) {
-                ath10k_warn("Failed to set TX encap: %d\n", ret);
+                ath10k_warn("Failed to set vdev %i TX encap: %d\n",
+                            arvif->vdev_id, ret);
                 goto err_vdev_delete;
         }
 
         if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
                 ret = ath10k_peer_create(ar, arvif->vdev_id, vif->addr);
                 if (ret) {
-                        ath10k_warn("Failed to create peer for AP: %d\n", ret);
+                        ath10k_warn("Failed to create vdev %i peer for AP: %d\n",
+                                    arvif->vdev_id, ret);
                         goto err_vdev_delete;
                 }
 
                 ret = ath10k_mac_set_kickout(arvif);
                 if (ret) {
-                        ath10k_warn("Failed to set kickout parameters: %d\n",
-                                    ret);
+                        ath10k_warn("Failed to set vdev %i kickout parameters: %d\n",
+                                    arvif->vdev_id, ret);
                         goto err_peer_delete;
                 }
         }
@@ -2569,7 +2594,8 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
                 ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id,
                                                   param, value);
                 if (ret) {
-                        ath10k_warn("Failed to set RX wake policy: %d\n", ret);
+                        ath10k_warn("Failed to set vdev %i RX wake policy: %d\n",
+                                    arvif->vdev_id, ret);
                         goto err_peer_delete;
                 }
 
@@ -2578,7 +2604,8 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
                 ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id,
                                                   param, value);
                 if (ret) {
-                        ath10k_warn("Failed to set TX wake thresh: %d\n", ret);
+                        ath10k_warn("Failed to set vdev %i TX wake thresh: %d\n",
+                                    arvif->vdev_id, ret);
                         goto err_peer_delete;
                 }
 
@@ -2587,7 +2614,8 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
                 ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id,
                                                   param, value);
                 if (ret) {
-                        ath10k_warn("Failed to set PSPOLL count: %d\n", ret);
+                        ath10k_warn("Failed to set vdev %i PSPOLL count: %d\n",
+                                    arvif->vdev_id, ret);
                         goto err_peer_delete;
                 }
         }
@@ -2651,17 +2679,19 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw,
         if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
                 ret = ath10k_peer_delete(arvif->ar, arvif->vdev_id, vif->addr);
                 if (ret)
-                        ath10k_warn("Failed to remove peer for AP: %d\n", ret);
+                        ath10k_warn("Failed to remove peer for AP vdev %i: %d\n",
+                                    arvif->vdev_id, ret);
 
                 kfree(arvif->u.ap.noa_data);
         }
 
-        ath10k_dbg(ATH10K_DBG_MAC, "mac vdev delete %d (remove interface)\n",
+        ath10k_dbg(ATH10K_DBG_MAC, "mac vdev %i delete (remove interface)\n",
                    arvif->vdev_id);
 
         ret = ath10k_wmi_vdev_delete(ar, arvif->vdev_id);
         if (ret)
-                ath10k_warn("WMI vdev delete failed: %d\n", ret);
+                ath10k_warn("WMI vdev %i delete failed: %d\n",
+                            arvif->vdev_id, ret);
 
         if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR)
                 ar->monitor_present = false;
@@ -2750,8 +2780,8 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                            arvif->vdev_id, arvif->beacon_interval);
 
                 if (ret)
-                        ath10k_warn("Failed to set beacon interval for VDEV: %d\n",
-                                    arvif->vdev_id);
+                        ath10k_warn("Failed to set beacon interval for vdev %d: %i\n",
+                                    arvif->vdev_id, ret);
         }
 
         if (changed & BSS_CHANGED_BEACON) {
@@ -2763,8 +2793,8 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                 ret = ath10k_wmi_pdev_set_param(ar, pdev_param,
                                                 WMI_BEACON_STAGGERED_MODE);
                 if (ret)
-                        ath10k_warn("Failed to set beacon mode for VDEV: %d\n",
-                                    arvif->vdev_id);
+                        ath10k_warn("Failed to set beacon mode for vdev %d: %i\n",
+                                    arvif->vdev_id, ret);
         }
 
         if (changed & BSS_CHANGED_BEACON_INFO) {
@@ -2778,8 +2808,8 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                 ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
                                                 arvif->dtim_period);
                 if (ret)
-                        ath10k_warn("Failed to set dtim period for VDEV: %d\n",
-                                    arvif->vdev_id);
+                        ath10k_warn("Failed to set dtim period for vdev %d: %i\n",
+                                    arvif->vdev_id, ret);
         }
 
         if (changed & BSS_CHANGED_SSID &&
@@ -2799,7 +2829,7 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                         ret = ath10k_peer_create(ar, arvif->vdev_id,
                                                  info->bssid);
                         if (ret)
-                                ath10k_warn("Failed to add peer %pM for vdev %d when changin bssid: %i\n",
+                                ath10k_warn("Failed to add peer %pM for vdev %d when changing bssid: %i\n",
                                             info->bssid, arvif->vdev_id, ret);
 
                         if (vif->type == NL80211_IFTYPE_STATION) {
@@ -2815,8 +2845,8 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
 
                                 ret = ath10k_vdev_start(arvif);
                                 if (ret) {
-                                        ath10k_warn("failed to start vdev: %d\n",
-                                                    ret);
+                                        ath10k_warn("failed to start vdev %i: %d\n",
+                                                    arvif->vdev_id, ret);
                                         goto exit;
                                 }
 
@@ -2851,8 +2881,8 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                 ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
                                                 cts_prot);
                 if (ret)
-                        ath10k_warn("Failed to set CTS prot for VDEV: %d\n",
-                                    arvif->vdev_id);
+                        ath10k_warn("Failed to set CTS prot for vdev %d: %d\n",
+                                    arvif->vdev_id, ret);
         }
 
         if (changed & BSS_CHANGED_ERP_SLOT) {
@@ -2870,8 +2900,8 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                 ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
                                                 slottime);
                 if (ret)
-                        ath10k_warn("Failed to set erp slot for VDEV: %d\n",
-                                    arvif->vdev_id);
+                        ath10k_warn("Failed to set erp slot for vdev %d: %i\n",
+                                    arvif->vdev_id, ret);
         }
 
         if (changed & BSS_CHANGED_ERP_PREAMBLE) {
@@ -2889,8 +2919,8 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                 ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
                                                 preamble);
                 if (ret)
-                        ath10k_warn("Failed to set preamble for VDEV: %d\n",
-                                    arvif->vdev_id);
+                        ath10k_warn("Failed to set preamble for vdev %d: %i\n",
+                                    arvif->vdev_id, ret);
         }
 
         if (changed & BSS_CHANGED_ASSOC) {
@@ -3021,8 +3051,8 @@ static void ath10k_set_key_h_def_keyidx(struct ath10k *ar,
         ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
                                         key->keyidx);
         if (ret)
-                ath10k_warn("failed to set group key as default key: %d\n",
-                            ret);
+                ath10k_warn("failed to set vdev %i group key as default key: %d\n",
+                            arvif->vdev_id, ret);
 }
 
 static int ath10k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
@@ -3082,7 +3112,8 @@ static int ath10k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 
         ret = ath10k_install_key(arvif, key, cmd, peer_addr);
         if (ret) {
-                ath10k_warn("ath10k_install_key failed (%d)\n", ret);
+                ath10k_warn("key installation failed for vdev %i peer %pM: %d\n",
+                            arvif->vdev_id, peer_addr, ret);
                 goto exit;
         }
 
@@ -3179,6 +3210,13 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
         int max_num_peers;
         int ret = 0;
 
+        if (old_state == IEEE80211_STA_NOTEXIST &&
+            new_state == IEEE80211_STA_NONE) {
+                memset(arsta, 0, sizeof(*arsta));
+                arsta->arvif = arvif;
+                INIT_WORK(&arsta->update_wk, ath10k_sta_rc_update_wk);
+        }
+
         /* cancel must be done outside the mutex to avoid deadlock */
         if ((old_state == IEEE80211_STA_NONE &&
              new_state == IEEE80211_STA_NOTEXIST))
@@ -3208,10 +3246,6 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                            "mac vdev %d peer create %pM (new sta) num_peers %d\n",
                            arvif->vdev_id, sta->addr, ar->num_peers);
 
-                memset(arsta, 0, sizeof(*arsta));
-                arsta->arvif = arvif;
-                INIT_WORK(&arsta->update_wk, ath10k_sta_rc_update_wk);
-
                 ret = ath10k_peer_create(ar, arvif->vdev_id, sta->addr);
                 if (ret)
                         ath10k_warn("Failed to add peer %pM for vdev %d when adding a new sta: %i\n",
@@ -3226,8 +3260,8 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                            arvif->vdev_id, sta->addr);
                 ret = ath10k_peer_delete(ar, arvif->vdev_id, sta->addr);
                 if (ret)
-                        ath10k_warn("Failed to delete peer: %pM for VDEV: %d\n",
-                                    sta->addr, arvif->vdev_id);
+                        ath10k_warn("Failed to delete peer %pM for vdev %d: %i\n",
+                                    sta->addr, arvif->vdev_id, ret);
 
                 if (vif->type == NL80211_IFTYPE_STATION)
                         ath10k_bss_disassoc(hw, vif);
@@ -3243,8 +3277,8 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
 
                 ret = ath10k_station_assoc(ar, arvif, sta);
                 if (ret)
-                        ath10k_warn("Failed to associate station: %pM\n",
-                                    sta->addr);
+                        ath10k_warn("Failed to associate station %pM for vdev %i: %i\n",
+                                    sta->addr, arvif->vdev_id, ret);
         } else if (old_state == IEEE80211_STA_ASSOC &&
                    new_state == IEEE80211_STA_AUTH &&
                    (vif->type == NL80211_IFTYPE_AP ||
@@ -3257,8 +3291,8 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
 
                 ret = ath10k_station_disassoc(ar, arvif, sta);
                 if (ret)
-                        ath10k_warn("Failed to disassociate station: %pM\n",
-                                    sta->addr);
+                        ath10k_warn("Failed to disassociate station: %pM vdev %i ret %i\n",
+                                    sta->addr, arvif->vdev_id, ret);
         }
 exit:
         mutex_unlock(&ar->conf_mutex);
@@ -3539,7 +3573,8 @@ static void ath10k_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
                 }), ATH10K_FLUSH_TIMEOUT_HZ);
 
         if (ret <= 0 || skip)
-                ath10k_warn("tx not flushed\n");
+                ath10k_warn("tx not flushed (skip %i ar-state %i): %i\n",
+                            skip, ar->state, ret);
 
 skip:
         mutex_unlock(&ar->conf_mutex);
@@ -3905,7 +3940,8 @@ static bool ath10k_get_fixed_rate_nss(const struct cfg80211_bitrate_mask *mask,
 
 static int ath10k_set_fixed_rate_param(struct ath10k_vif *arvif,
                                        u8 fixed_rate,
-                                       u8 fixed_nss)
+                                       u8 fixed_nss,
+                                       u8 force_sgi)
 {
         struct ath10k *ar = arvif->ar;
         u32 vdev_param;
@@ -3914,12 +3950,16 @@ static int ath10k_set_fixed_rate_param(struct ath10k_vif *arvif,
         mutex_lock(&ar->conf_mutex);
 
         if (arvif->fixed_rate == fixed_rate &&
-            arvif->fixed_nss == fixed_nss)
+            arvif->fixed_nss == fixed_nss &&
+            arvif->force_sgi == force_sgi)
                 goto exit;
 
         if (fixed_rate == WMI_FIXED_RATE_NONE)
                 ath10k_dbg(ATH10K_DBG_MAC, "mac disable fixed bitrate mask\n");
 
+        if (force_sgi)
+                ath10k_dbg(ATH10K_DBG_MAC, "mac force sgi\n");
+
         vdev_param = ar->wmi.vdev_param->fixed_rate;
         ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id,
                                         vdev_param, fixed_rate);
@@ -3945,6 +3985,19 @@ static int ath10k_set_fixed_rate_param(struct ath10k_vif *arvif,
 
         arvif->fixed_nss = fixed_nss;
 
+        vdev_param = ar->wmi.vdev_param->sgi;
+        ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
+                                        force_sgi);
+
+        if (ret) {
+                ath10k_warn("Could not set sgi param %d: %d\n",
+                            force_sgi, ret);
+                ret = -EINVAL;
+                goto exit;
+        }
+
+        arvif->force_sgi = force_sgi;
+
 exit:
         mutex_unlock(&ar->conf_mutex);
         return ret;
@@ -3959,6 +4012,11 @@ static int ath10k_set_bitrate_mask(struct ieee80211_hw *hw,
         enum ieee80211_band band = ar->hw->conf.chandef.chan->band;
         u8 fixed_rate = WMI_FIXED_RATE_NONE;
         u8 fixed_nss = ar->num_rf_chains;
+        u8 force_sgi;
+
+        force_sgi = mask->control[band].gi;
+        if (force_sgi == NL80211_TXRATE_FORCE_LGI)
+                return -EINVAL;
 
         if (!ath10k_default_bitrate_mask(ar, band, mask)) {
                 if (!ath10k_get_fixed_rate_nss(mask, band,
@@ -3967,7 +4025,13 @@ static int ath10k_set_bitrate_mask(struct ieee80211_hw *hw,
                         return -EINVAL;
         }
 
-        return ath10k_set_fixed_rate_param(arvif, fixed_rate, fixed_nss);
+        if (fixed_rate == WMI_FIXED_RATE_NONE && force_sgi) {
+                ath10k_warn("Could not force SGI usage for default rate settings\n");
+                return -EINVAL;
+        }
+
+        return ath10k_set_fixed_rate_param(arvif, fixed_rate,
+                                           fixed_nss, force_sgi);
 }
 
 static void ath10k_channel_switch_beacon(struct ieee80211_hw *hw,
@@ -4060,6 +4124,16 @@ static void ath10k_sta_rc_update(struct ieee80211_hw *hw,
         ieee80211_queue_work(hw, &arsta->update_wk);
 }
 
+static u64 ath10k_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+{
+        /*
+         * FIXME: Return 0 for time being. Need to figure out whether FW
+         * has the API to fetch 64-bit local TSF
+         */
+
+        return 0;
+}
+
 static const struct ieee80211_ops ath10k_ops = {
         .tx                             = ath10k_tx,
         .start                          = ath10k_start,
@@ -4085,6 +4159,7 @@ static const struct ieee80211_ops ath10k_ops = {
         .set_bitrate_mask               = ath10k_set_bitrate_mask,
         .channel_switch_beacon          = ath10k_channel_switch_beacon,
         .sta_rc_update                  = ath10k_sta_rc_update,
+        .get_tsf                        = ath10k_get_tsf,
 #ifdef CONFIG_PM
         .suspend                        = ath10k_suspend,
         .resume                         = ath10k_resume,
@@ -4361,7 +4436,7 @@ struct ath10k_vif *ath10k_get_arvif(struct ath10k *ar, u32 vdev_id)
                                                    ath10k_get_arvif_iter,
                                                    &arvif_iter);
         if (!arvif_iter.arvif) {
-                ath10k_warn("No VIF found for VDEV: %d\n", vdev_id);
+                ath10k_warn("No VIF found for vdev %d\n", vdev_id);
                 return NULL;
         }
 
@@ -4442,7 +4517,8 @@ int ath10k_mac_register(struct ath10k *ar)
                         IEEE80211_HW_HAS_RATE_CONTROL |
                         IEEE80211_HW_SUPPORTS_STATIC_SMPS |
                         IEEE80211_HW_WANT_MONITOR_VIF |
-                        IEEE80211_HW_AP_LINK_PS;
+                        IEEE80211_HW_AP_LINK_PS |
+                        IEEE80211_HW_SPECTRUM_MGMT;
 
         /* MSDU can have HTT TX fragment pushed in front. The additional 4
          * bytes is used for padding/alignment if necessary. */
@@ -4500,7 +4576,7 @@ int ath10k_mac_register(struct ath10k *ar)
         ret = ath_regd_init(&ar->ath_common.regulatory, ar->hw->wiphy,
                             ath10k_reg_notifier);
         if (ret) {
-                ath10k_err("Regulatory initialization failed\n");
+                ath10k_err("Regulatory initialization failed: %i\n", ret);
                 goto err_free;
         }
 
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index 34f09106f423..9d242d801d9d 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -58,12 +58,10 @@ static DEFINE_PCI_DEVICE_TABLE(ath10k_pci_id_table) = {
 static int ath10k_pci_diag_read_access(struct ath10k *ar, u32 address,
                                        u32 *data);
 
-static void ath10k_pci_process_ce(struct ath10k *ar);
 static int ath10k_pci_post_rx(struct ath10k *ar);
 static int ath10k_pci_post_rx_pipe(struct ath10k_pci_pipe *pipe_info,
                                              int num);
 static void ath10k_pci_rx_pipe_cleanup(struct ath10k_pci_pipe *pipe_info);
-static void ath10k_pci_stop_ce(struct ath10k *ar);
 static int ath10k_pci_cold_reset(struct ath10k *ar);
 static int ath10k_pci_warm_reset(struct ath10k *ar);
 static int ath10k_pci_wait_for_target_init(struct ath10k *ar);
@@ -74,7 +72,6 @@ static void ath10k_pci_free_irq(struct ath10k *ar);
 static int ath10k_pci_bmi_wait(struct ath10k_ce_pipe *tx_pipe,
                                struct ath10k_ce_pipe *rx_pipe,
                                struct bmi_xfer *xfer);
-static void ath10k_pci_cleanup_ce(struct ath10k *ar);
 
 static const struct ce_attr host_ce_config_wlan[] = {
         /* CE0: host->target HTC control and raw streams */
@@ -679,34 +676,12 @@ void ath10k_do_pci_sleep(struct ath10k *ar)
         }
 }
 
-/*
- * FIXME: Handle OOM properly.
- */
-static inline
-struct ath10k_pci_compl *get_free_compl(struct ath10k_pci_pipe *pipe_info)
-{
-        struct ath10k_pci_compl *compl = NULL;
-
-        spin_lock_bh(&pipe_info->pipe_lock);
-        if (list_empty(&pipe_info->compl_free)) {
-                ath10k_warn("Completion buffers are full\n");
-                goto exit;
-        }
-        compl = list_first_entry(&pipe_info->compl_free,
-                                 struct ath10k_pci_compl, list);
-        list_del(&compl->list);
-exit:
-        spin_unlock_bh(&pipe_info->pipe_lock);
-        return compl;
-}
-
 /* Called by lower (CE) layer when a send to Target completes. */
 static void ath10k_pci_ce_send_done(struct ath10k_ce_pipe *ce_state)
 {
         struct ath10k *ar = ce_state->ar;
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct ath10k_pci_pipe *pipe_info =  &ar_pci->pipe_info[ce_state->id];
-        struct ath10k_pci_compl *compl;
+        struct ath10k_hif_cb *cb = &ar_pci->msg_callbacks_current;
         void *transfer_context;
         u32 ce_data;
         unsigned int nbytes;
@@ -715,27 +690,12 @@ static void ath10k_pci_ce_send_done(struct ath10k_ce_pipe *ce_state)
         while (ath10k_ce_completed_send_next(ce_state, &transfer_context,
                                              &ce_data, &nbytes,
                                              &transfer_id) == 0) {
-                compl = get_free_compl(pipe_info);
-                if (!compl)
-                        break;
-
-                compl->state = ATH10K_PCI_COMPL_SEND;
-                compl->ce_state = ce_state;
-                compl->pipe_info = pipe_info;
-                compl->skb = transfer_context;
-                compl->nbytes = nbytes;
-                compl->transfer_id = transfer_id;
-                compl->flags = 0;
+                /* no need to call tx completion for NULL pointers */
+                if (transfer_context == NULL)
+                        continue;
 
-                /*
-                 * Add the completion to the processing queue.
-                 */
-                spin_lock_bh(&ar_pci->compl_lock);
-                list_add_tail(&compl->list, &ar_pci->compl_process);
-                spin_unlock_bh(&ar_pci->compl_lock);
+                cb->tx_completion(ar, transfer_context, transfer_id);
         }
-
-        ath10k_pci_process_ce(ar);
 }
 
 /* Called by lower (CE) layer when data is received from the Target. */
@@ -744,77 +704,100 @@ static void ath10k_pci_ce_recv_data(struct ath10k_ce_pipe *ce_state)
         struct ath10k *ar = ce_state->ar;
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         struct ath10k_pci_pipe *pipe_info =  &ar_pci->pipe_info[ce_state->id];
-        struct ath10k_pci_compl *compl;
+        struct ath10k_hif_cb *cb = &ar_pci->msg_callbacks_current;
         struct sk_buff *skb;
         void *transfer_context;
         u32 ce_data;
-        unsigned int nbytes;
+        unsigned int nbytes, max_nbytes;
         unsigned int transfer_id;
         unsigned int flags;
+        int err;
 
         while (ath10k_ce_completed_recv_next(ce_state, &transfer_context,
                                              &ce_data, &nbytes, &transfer_id,
                                              &flags) == 0) {
-                compl = get_free_compl(pipe_info);
-                if (!compl)
-                        break;
-
-                compl->state = ATH10K_PCI_COMPL_RECV;
-                compl->ce_state = ce_state;
-                compl->pipe_info = pipe_info;
-                compl->skb = transfer_context;
-                compl->nbytes = nbytes;
-                compl->transfer_id = transfer_id;
-                compl->flags = flags;
+                err = ath10k_pci_post_rx_pipe(pipe_info, 1);
+                if (unlikely(err)) {
+                        /* FIXME: retry */
+                        ath10k_warn("failed to replenish CE rx ring %d: %d\n",
+                                    pipe_info->pipe_num, err);
+                }
 
                 skb = transfer_context;
+                max_nbytes = skb->len + skb_tailroom(skb);
                 dma_unmap_single(ar->dev, ATH10K_SKB_CB(skb)->paddr,
-                                 skb->len + skb_tailroom(skb),
-                                 DMA_FROM_DEVICE);
-                /*
-                 * Add the completion to the processing queue.
-                 */
-                spin_lock_bh(&ar_pci->compl_lock);
-                list_add_tail(&compl->list, &ar_pci->compl_process);
-                spin_unlock_bh(&ar_pci->compl_lock);
-        }
+                                 max_nbytes, DMA_FROM_DEVICE);
 
-        ath10k_pci_process_ce(ar);
+                if (unlikely(max_nbytes < nbytes)) {
+                        ath10k_warn("rxed more than expected (nbytes %d, max %d)",
+                                    nbytes, max_nbytes);
+                        dev_kfree_skb_any(skb);
+                        continue;
+                }
+
+                skb_put(skb, nbytes);
+                cb->rx_completion(ar, skb, pipe_info->pipe_num);
+        }
 }
 
-/* Send the first nbytes bytes of the buffer */
-static int ath10k_pci_hif_send_head(struct ath10k *ar, u8 pipe_id,
-                                    unsigned int transfer_id,
-                                    unsigned int bytes, struct sk_buff *nbuf)
+static int ath10k_pci_hif_tx_sg(struct ath10k *ar, u8 pipe_id,
+                                struct ath10k_hif_sg_item *items, int n_items)
 {
-        struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(nbuf);
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct ath10k_pci_pipe *pipe_info = &(ar_pci->pipe_info[pipe_id]);
-        struct ath10k_ce_pipe *ce_hdl = pipe_info->ce_hdl;
-        unsigned int len;
-        u32 flags = 0;
-        int ret;
+        struct ath10k_pci_pipe *pci_pipe = &ar_pci->pipe_info[pipe_id];
+        struct ath10k_ce_pipe *ce_pipe = pci_pipe->ce_hdl;
+        struct ath10k_ce_ring *src_ring = ce_pipe->src_ring;
+        unsigned int nentries_mask = src_ring->nentries_mask;
+        unsigned int sw_index = src_ring->sw_index;
+        unsigned int write_index = src_ring->write_index;
+        int err, i;
 
-        len = min(bytes, nbuf->len);
-        bytes -= len;
+        spin_lock_bh(&ar_pci->ce_lock);
 
-        if (len & 3)
-                ath10k_warn("skb not aligned to 4-byte boundary (%d)\n", len);
+        if (unlikely(CE_RING_DELTA(nentries_mask,
+                                   write_index, sw_index - 1) < n_items)) {
+                err = -ENOBUFS;
+                goto unlock;
+        }
 
-        ath10k_dbg(ATH10K_DBG_PCI,
-                   "pci send data vaddr %p paddr 0x%llx len %d as %d bytes\n",
-                   nbuf->data, (unsigned long long) skb_cb->paddr,
-                   nbuf->len, len);
-        ath10k_dbg_dump(ATH10K_DBG_PCI_DUMP, NULL,
-                        "ath10k tx: data: ",
-                        nbuf->data, nbuf->len);
-
-        ret = ath10k_ce_send(ce_hdl, nbuf, skb_cb->paddr, len, transfer_id,
-                             flags);
-        if (ret)
-                ath10k_warn("failed to send sk_buff to CE: %p\n", nbuf);
+        for (i = 0; i < n_items - 1; i++) {
+                ath10k_dbg(ATH10K_DBG_PCI,
+                           "pci tx item %d paddr 0x%08x len %d n_items %d\n",
+                           i, items[i].paddr, items[i].len, n_items);
+                ath10k_dbg_dump(ATH10K_DBG_PCI_DUMP, NULL, "item data: ",
+                                items[i].vaddr, items[i].len);
 
-        return ret;
+                err = ath10k_ce_send_nolock(ce_pipe,
+                                            items[i].transfer_context,
+                                            items[i].paddr,
+                                            items[i].len,
+                                            items[i].transfer_id,
+                                            CE_SEND_FLAG_GATHER);
+                if (err)
+                        goto unlock;
+        }
+
+        /* `i` is equal to `n_items -1` after for() */
+
+        ath10k_dbg(ATH10K_DBG_PCI,
+                   "pci tx item %d paddr 0x%08x len %d n_items %d\n",
+                   i, items[i].paddr, items[i].len, n_items);
+        ath10k_dbg_dump(ATH10K_DBG_PCI_DUMP, NULL, "item data: ",
+                        items[i].vaddr, items[i].len);
+
+        err = ath10k_ce_send_nolock(ce_pipe,
+                                    items[i].transfer_context,
+                                    items[i].paddr,
+                                    items[i].len,
+                                    items[i].transfer_id,
+                                    0);
+        if (err)
+                goto unlock;
+
+        err = 0;
+unlock:
+        spin_unlock_bh(&ar_pci->ce_lock);
+        return err;
 }
 
 static u16 ath10k_pci_hif_get_free_queue_number(struct ath10k *ar, u8 pipe)
@@ -903,52 +886,6 @@ static void ath10k_pci_hif_set_callbacks(struct ath10k *ar,
                sizeof(ar_pci->msg_callbacks_current));
 }
 
-static int ath10k_pci_alloc_compl(struct ath10k *ar)
-{
-        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        const struct ce_attr *attr;
-        struct ath10k_pci_pipe *pipe_info;
-        struct ath10k_pci_compl *compl;
-        int i, pipe_num, completions;
-
-        spin_lock_init(&ar_pci->compl_lock);
-        INIT_LIST_HEAD(&ar_pci->compl_process);
-
-        for (pipe_num = 0; pipe_num < CE_COUNT; pipe_num++) {
-                pipe_info = &ar_pci->pipe_info[pipe_num];
-
-                spin_lock_init(&pipe_info->pipe_lock);
-                INIT_LIST_HEAD(&pipe_info->compl_free);
-
-                /* Handle Diagnostic CE specially */
-                if (pipe_info->ce_hdl == ar_pci->ce_diag)
-                        continue;
-
-                attr = &host_ce_config_wlan[pipe_num];
-                completions = 0;
-
-                if (attr->src_nentries)
-                        completions += attr->src_nentries;
-
-                if (attr->dest_nentries)
-                        completions += attr->dest_nentries;
-
-                for (i = 0; i < completions; i++) {
-                        compl = kmalloc(sizeof(*compl), GFP_KERNEL);
-                        if (!compl) {
-                                ath10k_warn("No memory for completion state\n");
-                                ath10k_pci_cleanup_ce(ar);
-                                return -ENOMEM;
-                        }
-
-                        compl->state = ATH10K_PCI_COMPL_FREE;
-                        list_add_tail(&compl->list, &pipe_info->compl_free);
-                }
-        }
-
-        return 0;
-}
-
 static int ath10k_pci_setup_ce_irq(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
@@ -993,147 +930,6 @@ static void ath10k_pci_kill_tasklet(struct ath10k *ar)
                 tasklet_kill(&ar_pci->pipe_info[i].intr);
 }
 
-static void ath10k_pci_stop_ce(struct ath10k *ar)
-{
-        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct ath10k_pci_compl *compl;
-        struct sk_buff *skb;
-
-        /* Mark pending completions as aborted, so that upper layers free up
-         * their associated resources */
-        spin_lock_bh(&ar_pci->compl_lock);
-        list_for_each_entry(compl, &ar_pci->compl_process, list) {
-                skb = compl->skb;
-                ATH10K_SKB_CB(skb)->is_aborted = true;
-        }
-        spin_unlock_bh(&ar_pci->compl_lock);
-}
-
-static void ath10k_pci_cleanup_ce(struct ath10k *ar)
-{
-        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct ath10k_pci_compl *compl, *tmp;
-        struct ath10k_pci_pipe *pipe_info;
-        struct sk_buff *netbuf;
-        int pipe_num;
-
-        /* Free pending completions. */
-        spin_lock_bh(&ar_pci->compl_lock);
-        if (!list_empty(&ar_pci->compl_process))
-                ath10k_warn("pending completions still present! possible memory leaks.\n");
-
-        list_for_each_entry_safe(compl, tmp, &ar_pci->compl_process, list) {
-                list_del(&compl->list);
-                netbuf = compl->skb;
-                dev_kfree_skb_any(netbuf);
-                kfree(compl);
-        }
-        spin_unlock_bh(&ar_pci->compl_lock);
-
-        /* Free unused completions for each pipe. */
-        for (pipe_num = 0; pipe_num < CE_COUNT; pipe_num++) {
-                pipe_info = &ar_pci->pipe_info[pipe_num];
-
-                spin_lock_bh(&pipe_info->pipe_lock);
-                list_for_each_entry_safe(compl, tmp,
-                                         &pipe_info->compl_free, list) {
-                        list_del(&compl->list);
-                        kfree(compl);
-                }
-                spin_unlock_bh(&pipe_info->pipe_lock);
-        }
-}
-
-static void ath10k_pci_process_ce(struct ath10k *ar)
-{
-        struct ath10k_pci *ar_pci = ar->hif.priv;
-        struct ath10k_hif_cb *cb = &ar_pci->msg_callbacks_current;
-        struct ath10k_pci_compl *compl;
-        struct sk_buff *skb;
-        unsigned int nbytes;
-        int ret, send_done = 0;
-
-        /* Upper layers aren't ready to handle tx/rx completions in parallel so
-         * we must serialize all completion processing. */
-
-        spin_lock_bh(&ar_pci->compl_lock);
-        if (ar_pci->compl_processing) {
-                spin_unlock_bh(&ar_pci->compl_lock);
-                return;
-        }
-        ar_pci->compl_processing = true;
-        spin_unlock_bh(&ar_pci->compl_lock);
-
-        for (;;) {
-                spin_lock_bh(&ar_pci->compl_lock);
-                if (list_empty(&ar_pci->compl_process)) {
-                        spin_unlock_bh(&ar_pci->compl_lock);
-                        break;
-                }
-                compl = list_first_entry(&ar_pci->compl_process,
-                                         struct ath10k_pci_compl, list);
-                list_del(&compl->list);
-                spin_unlock_bh(&ar_pci->compl_lock);
-
-                switch (compl->state) {
-                case ATH10K_PCI_COMPL_SEND:
-                        cb->tx_completion(ar,
-                                          compl->skb,
-                                          compl->transfer_id);
-                        send_done = 1;
-                        break;
-                case ATH10K_PCI_COMPL_RECV:
-                        ret = ath10k_pci_post_rx_pipe(compl->pipe_info, 1);
-                        if (ret) {
-                                ath10k_warn("failed to post RX buffer for pipe %d: %d\n",
-                                            compl->pipe_info->pipe_num, ret);
-                                break;
-                        }
-
-                        skb = compl->skb;
-                        nbytes = compl->nbytes;
-
-                        ath10k_dbg(ATH10K_DBG_PCI,
-                                   "ath10k_pci_ce_recv_data netbuf=%p  nbytes=%d\n",
-                                   skb, nbytes);
-                        ath10k_dbg_dump(ATH10K_DBG_PCI_DUMP, NULL,
-                                        "ath10k rx: ", skb->data, nbytes);
-
-                        if (skb->len + skb_tailroom(skb) >= nbytes) {
-                                skb_trim(skb, 0);
-                                skb_put(skb, nbytes);
-                                cb->rx_completion(ar, skb,
-                                                  compl->pipe_info->pipe_num);
-                        } else {
-                                ath10k_warn("rxed more than expected (nbytes %d, max %d)",
-                                            nbytes,
-                                            skb->len + skb_tailroom(skb));
-                        }
-                        break;
-                case ATH10K_PCI_COMPL_FREE:
-                        ath10k_warn("free completion cannot be processed\n");
-                        break;
-                default:
-                        ath10k_warn("invalid completion state (%d)\n",
-                                    compl->state);
-                        break;
-                }
-
-                compl->state = ATH10K_PCI_COMPL_FREE;
-
-                /*
-                 * Add completion back to the pipe's free list.
-                 */
-                spin_lock_bh(&compl->pipe_info->pipe_lock);
-                list_add_tail(&compl->list, &compl->pipe_info->compl_free);
-                spin_unlock_bh(&compl->pipe_info->pipe_lock);
-        }
-
-        spin_lock_bh(&ar_pci->compl_lock);
-        ar_pci->compl_processing = false;
-        spin_unlock_bh(&ar_pci->compl_lock);
-}
-
 /* TODO - temporary mapping while we have too few CE's */
 static int ath10k_pci_hif_map_service_to_pipe(struct ath10k *ar,
                                               u16 service_id, u8 *ul_pipe,
@@ -1305,17 +1101,11 @@ static int ath10k_pci_hif_start(struct ath10k *ar)
         ath10k_pci_free_early_irq(ar);
         ath10k_pci_kill_tasklet(ar);
 
-        ret = ath10k_pci_alloc_compl(ar);
-        if (ret) {
-                ath10k_warn("failed to allocate CE completions: %d\n", ret);
-                goto err_early_irq;
-        }
-
         ret = ath10k_pci_request_irq(ar);
         if (ret) {
                 ath10k_warn("failed to post RX buffers for all pipes: %d\n",
                             ret);
-                goto err_free_compl;
+                goto err_early_irq;
         }
 
         ret = ath10k_pci_setup_ce_irq(ar);
@@ -1339,10 +1129,6 @@ err_stop:
         ath10k_ce_disable_interrupts(ar);
         ath10k_pci_free_irq(ar);
         ath10k_pci_kill_tasklet(ar);
-        ath10k_pci_stop_ce(ar);
-        ath10k_pci_process_ce(ar);
-err_free_compl:
-        ath10k_pci_cleanup_ce(ar);
 err_early_irq:
         /* Though there should be no interrupts (device was reset)
          * power_down() expects the early IRQ to be installed as per the
@@ -1413,18 +1199,10 @@ static void ath10k_pci_tx_pipe_cleanup(struct ath10k_pci_pipe *pipe_info)
 
         while (ath10k_ce_cancel_send_next(ce_hdl, (void **)&netbuf,
                                           &ce_data, &nbytes, &id) == 0) {
-                /*
-                 * Indicate the completion to higer layer to free
-                 * the buffer
-                 */
-
-                if (!netbuf) {
-                        ath10k_warn("invalid sk_buff on CE %d - NULL pointer. firmware crashed?\n",
-                                    ce_hdl->id);
+                /* no need to call tx completion for NULL pointers */
+                if (!netbuf)
                         continue;
-                }
 
-                ATH10K_SKB_CB(netbuf)->is_aborted = true;
                 ar_pci->msg_callbacks_current.tx_completion(ar,
                                                             netbuf,
                                                             id);
@@ -1482,7 +1260,6 @@ static void ath10k_pci_hif_stop(struct ath10k *ar)
 
         ath10k_pci_free_irq(ar);
         ath10k_pci_kill_tasklet(ar);
-        ath10k_pci_stop_ce(ar);
 
         ret = ath10k_pci_request_early_irq(ar);
         if (ret)
@@ -1492,8 +1269,6 @@ static void ath10k_pci_hif_stop(struct ath10k *ar)
          * not DMA nor interrupt. We process the leftovers and then free
          * everything else up. */
 
-        ath10k_pci_process_ce(ar);
-        ath10k_pci_cleanup_ce(ar);
         ath10k_pci_buffer_cleanup(ar);
 
         /* Make the sure the device won't access any structures on the host by
@@ -2269,7 +2044,7 @@ static int ath10k_pci_hif_resume(struct ath10k *ar)
 #endif
 
 static const struct ath10k_hif_ops ath10k_pci_hif_ops = {
-        .send_head              = ath10k_pci_hif_send_head,
+        .tx_sg                  = ath10k_pci_hif_tx_sg,
         .exchange_bmi_msg       = ath10k_pci_hif_exchange_bmi_msg,
         .start                  = ath10k_pci_hif_start,
         .stop                   = ath10k_pci_hif_stop,
diff --git a/drivers/net/wireless/ath/ath10k/pci.h b/drivers/net/wireless/ath/ath10k/pci.h
index a4f32038c440..b43fdb4f7319 100644
--- a/drivers/net/wireless/ath/ath10k/pci.h
+++ b/drivers/net/wireless/ath/ath10k/pci.h
@@ -43,23 +43,6 @@ struct bmi_xfer {
         u32 resp_len;
 };
 
-enum ath10k_pci_compl_state {
-        ATH10K_PCI_COMPL_FREE = 0,
-        ATH10K_PCI_COMPL_SEND,
-        ATH10K_PCI_COMPL_RECV,
-};
-
-struct ath10k_pci_compl {
-        struct list_head list;
-        enum ath10k_pci_compl_state state;
-        struct ath10k_ce_pipe *ce_state;
-        struct ath10k_pci_pipe *pipe_info;
-        struct sk_buff *skb;
-        unsigned int nbytes;
-        unsigned int transfer_id;
-        unsigned int flags;
-};
-
 /*
  * PCI-specific Target state
  *
@@ -175,9 +158,6 @@ struct ath10k_pci_pipe {
         /* protects compl_free and num_send_allowed */
         spinlock_t pipe_lock;
 
-        /* List of free CE completion slots */
-        struct list_head compl_free;
-
         struct ath10k_pci *ar_pci;
         struct tasklet_struct intr;
 };
@@ -205,14 +185,6 @@ struct ath10k_pci {
         atomic_t keep_awake_count;
         bool verified_awake;
 
-        /* List of CE completions to be processed */
-        struct list_head compl_process;
-
-        /* protects compl_processing and compl_process */
-        spinlock_t compl_lock;
-
-        bool compl_processing;
-
         struct ath10k_pci_pipe pipe_info[CE_COUNT_MAX];
 
         struct ath10k_hif_cb msg_callbacks_current;
diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c
index ec6f82521b0e..0541dd939ce9 100644
--- a/drivers/net/wireless/ath/ath10k/txrx.c
+++ b/drivers/net/wireless/ath/ath10k/txrx.c
@@ -51,7 +51,8 @@ void ath10k_txrx_tx_unref(struct ath10k_htt *htt,
         struct ieee80211_tx_info *info;
         struct ath10k_skb_cb *skb_cb;
         struct sk_buff *msdu;
-        int ret;
+
+        lockdep_assert_held(&htt->tx_lock);
 
         ath10k_dbg(ATH10K_DBG_HTT, "htt tx completion msdu_id %u discard %d no_ack %d\n",
                    tx_done->msdu_id, !!tx_done->discard, !!tx_done->no_ack);
@@ -65,12 +66,12 @@ void ath10k_txrx_tx_unref(struct ath10k_htt *htt,
         msdu = htt->pending_tx[tx_done->msdu_id];
         skb_cb = ATH10K_SKB_CB(msdu);
 
-        ret = ath10k_skb_unmap(dev, msdu);
-        if (ret)
-                ath10k_warn("data skb unmap failed (%d)\n", ret);
+        dma_unmap_single(dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
 
-        if (skb_cb->htt.frag_len)
-                skb_pull(msdu, skb_cb->htt.frag_len + skb_cb->htt.pad_len);
+        if (skb_cb->htt.txbuf)
+                dma_pool_free(htt->tx_pool,
+                              skb_cb->htt.txbuf,
+                              skb_cb->htt.txbuf_paddr);
 
         ath10k_report_offchan_tx(htt->ar, msdu);
 
@@ -92,13 +93,11 @@ void ath10k_txrx_tx_unref(struct ath10k_htt *htt,
         /* we do not own the msdu anymore */
 
 exit:
-        spin_lock_bh(&htt->tx_lock);
         htt->pending_tx[tx_done->msdu_id] = NULL;
         ath10k_htt_tx_free_msdu_id(htt, tx_done->msdu_id);
         __ath10k_htt_tx_dec_pending(htt);
         if (htt->num_pending_tx == 0)
                 wake_up(&htt->empty_tx_wq);
-        spin_unlock_bh(&htt->tx_lock);
 }
 
 static const u8 rx_legacy_rate_idx[] = {
@@ -258,6 +257,12 @@ void ath10k_process_rx(struct ath10k *ar, struct htt_rx_info *info)
         status->band = ch->band;
         status->freq = ch->center_freq;
 
+        if (info->rate.info0 & HTT_RX_INDICATION_INFO0_END_VALID) {
+                /* TSF available only in 32-bit */
+                status->mactime = info->tsf & 0xffffffff;
+                status->flag |= RX_FLAG_MACTIME_END;
+        }
+
         ath10k_dbg(ATH10K_DBG_DATA,
                    "rx skb %p len %u %s%s%s%s%s %srate_idx %u vht_nss %u freq %u band %u flag 0x%x fcs-err %i\n",
                    info->skb,
@@ -378,7 +383,8 @@ void ath10k_peer_unmap_event(struct ath10k_htt *htt,
         spin_lock_bh(&ar->data_lock);
         peer = ath10k_peer_find_by_id(ar, ev->peer_id);
         if (!peer) {
-                ath10k_warn("unknown peer id %d\n", ev->peer_id);
+                ath10k_warn("peer-unmap-event: unknown peer id %d\n",
+                            ev->peer_id);
                 goto exit;
         }
 
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index 91e501b5499e..cb1f7b5bcf4c 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -1360,7 +1360,7 @@ static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
         struct wmi_bcn_info *bcn_info;
         struct ath10k_vif *arvif;
         struct sk_buff *bcn;
-        int vdev_id = 0;
+        int ret, vdev_id = 0;
 
         ath10k_dbg(ATH10K_DBG_MGMT, "WMI_HOST_SWBA_EVENTID\n");
 
@@ -1435,16 +1435,27 @@ static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
                                 ath10k_warn("SWBA overrun on vdev %d\n",
                                             arvif->vdev_id);
 
-                        ath10k_skb_unmap(ar->dev, arvif->beacon);
+                        dma_unmap_single(arvif->ar->dev,
+                                         ATH10K_SKB_CB(arvif->beacon)->paddr,
+                                         arvif->beacon->len, DMA_TO_DEVICE);
                         dev_kfree_skb_any(arvif->beacon);
                 }
 
-                ath10k_skb_map(ar->dev, bcn);
+                ATH10K_SKB_CB(bcn)->paddr = dma_map_single(arvif->ar->dev,
+                                                           bcn->data, bcn->len,
+                                                           DMA_TO_DEVICE);
+                ret = dma_mapping_error(arvif->ar->dev,
+                                        ATH10K_SKB_CB(bcn)->paddr);
+                if (ret) {
+                        ath10k_warn("failed to map beacon: %d\n", ret);
+                        goto skip;
+                }
 
                 arvif->beacon = bcn;
                 arvif->beacon_sent = false;
 
                 ath10k_wmi_tx_beacon_nowait(arvif);
+skip:
                 spin_unlock_bh(&ar->data_lock);
         }
 }
@@ -3382,7 +3393,6 @@ int ath10k_wmi_scan_chan_list(struct ath10k *ar,
                 ci->max_power         = ch->max_power;
                 ci->reg_power         = ch->max_reg_power;
                 ci->antenna_max       = ch->max_antenna_gain;
-                ci->antenna_max       = 0;
 
                 /* mode & flags share storage */
                 ci->mode              = ch->mode;
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index ef35da84f63b..4b18434ba697 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -751,6 +751,9 @@ ath5k_txbuf_setup(struct ath5k_hw *ah, struct ath5k_buf *bf,
         bf->skbaddr = dma_map_single(ah->dev, skb->data, skb->len,
                         DMA_TO_DEVICE);
 
+        if (dma_mapping_error(ah->dev, bf->skbaddr))
+                return -ENOSPC;
+
         ieee80211_get_tx_rates(info->control.vif, (control) ? control->sta : NULL, skb, bf->rates,
                                ARRAY_SIZE(bf->rates));
 
diff --git a/drivers/net/wireless/ath/ath9k/Makefile b/drivers/net/wireless/ath/ath9k/Makefile
index b58fe99ef745..8e1c7b0fe76c 100644
--- a/drivers/net/wireless/ath/ath9k/Makefile
+++ b/drivers/net/wireless/ath/ath9k/Makefile
@@ -52,7 +52,8 @@ obj-$(CONFIG_ATH9K_HW) += ath9k_hw.o
 
 obj-$(CONFIG_ATH9K_COMMON) += ath9k_common.o
 ath9k_common-y:=        common.o \
-                        common-init.o
+                        common-init.o \
+                        common-beacon.o
 
 ath9k_htc-y +=  htc_hst.o \
                 hif_usb.o \
diff --git a/drivers/net/wireless/ath/ath9k/ahb.c b/drivers/net/wireless/ath/ath9k/ahb.c
index 2dff2765769b..a0398fe3eb28 100644
--- a/drivers/net/wireless/ath/ath9k/ahb.c
+++ b/drivers/net/wireless/ath/ath9k/ahb.c
@@ -39,6 +39,10 @@ static const struct platform_device_id ath9k_platform_id_table[] = {
                 .name = "qca955x_wmac",
                 .driver_data = AR9300_DEVID_QCA955X,
         },
+        {
+                .name = "qca953x_wmac",
+                .driver_data = AR9300_DEVID_AR953X,
+        },
         {},
 };
 
@@ -82,6 +86,7 @@ static int ath_ahb_probe(struct platform_device *pdev)
         int irq;
         int ret = 0;
         struct ath_hw *ah;
+        struct ath_common *common;
         char hw_name[64];
 
         if (!dev_get_platdata(&pdev->dev)) {
@@ -124,9 +129,6 @@ static int ath_ahb_probe(struct platform_device *pdev)
         sc->mem = mem;
         sc->irq = irq;
 
-        /* Will be cleared in ath9k_start() */
-        set_bit(SC_OP_INVALID, &sc->sc_flags);
-
         ret = request_irq(irq, ath_isr, IRQF_SHARED, "ath9k", sc);
         if (ret) {
                 dev_err(&pdev->dev, "request_irq failed\n");
@@ -144,6 +146,9 @@ static int ath_ahb_probe(struct platform_device *pdev)
         wiphy_info(hw->wiphy, "%s mem=0x%lx, irq=%d\n",
                    hw_name, (unsigned long)mem, irq);
 
+        common = ath9k_hw_common(sc->sc_ah);
+        /* Will be cleared in ath9k_start() */
+        set_bit(ATH_OP_INVALID, &common->op_flags);
         return 0;
 
  err_irq:
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index 2ce5079007b6..6d47783f2e5b 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -318,17 +318,6 @@ void ath9k_ani_reset(struct ath_hw *ah, bool is_scanning)
         BUG_ON(aniState == NULL);
         ah->stats.ast_ani_reset++;
 
-        /* only allow a subset of functions in AP mode */
-        if (ah->opmode == NL80211_IFTYPE_AP) {
-                if (IS_CHAN_2GHZ(chan)) {
-                        ah->ani_function = (ATH9K_ANI_SPUR_IMMUNITY_LEVEL |
-                                            ATH9K_ANI_FIRSTEP_LEVEL);
-                        if (AR_SREV_9300_20_OR_LATER(ah))
-                                ah->ani_function |= ATH9K_ANI_MRC_CCK;
-                } else
-                        ah->ani_function = 0;
-        }
-
         ofdm_nil = max_t(int, ATH9K_ANI_OFDM_DEF_LEVEL,
                          aniState->ofdmNoiseImmunityLevel);
         cck_nil = max_t(int, ATH9K_ANI_CCK_DEF_LEVEL,
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index ff415e863ee9..3b3e91057a4c 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -26,10 +26,6 @@ static const int firstep_table[] =
 /* level:  0   1   2   3   4   5   6   7   8  */
         { -4, -2,  0,  2,  4,  6,  8, 10, 12 }; /* lvl 0-8, default 2 */
 
-static const int cycpwrThr1_table[] =
-/* level:  0   1   2   3   4   5   6   7   8  */
-        { -6, -4, -2,  0,  2,  4,  6,  8 };     /* lvl 0-7, default 3 */
-
 /*
  * register values to turn OFDM weak signal detection OFF
  */
@@ -921,7 +917,7 @@ static bool ar5008_hw_ani_control_new(struct ath_hw *ah,
         struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_channel *chan = ah->curchan;
         struct ar5416AniState *aniState = &ah->ani;
-        s32 value, value2;
+        s32 value;
 
         switch (cmd & ah->ani_function) {
         case ATH9K_ANI_OFDM_WEAK_SIGNAL_DETECTION:{
@@ -1008,42 +1004,11 @@ static bool ar5008_hw_ani_control_new(struct ath_hw *ah,
         case ATH9K_ANI_FIRSTEP_LEVEL:{
                 u32 level = param;
 
-                if (level >= ARRAY_SIZE(firstep_table)) {
-                        ath_dbg(common, ANI,
-                                "ATH9K_ANI_FIRSTEP_LEVEL: level out of range (%u > %zu)\n",
-                                level, ARRAY_SIZE(firstep_table));
-                        return false;
-                }
-
-                /*
-                 * make register setting relative to default
-                 * from INI file & cap value
-                 */
-                value = firstep_table[level] -
-                        firstep_table[ATH9K_ANI_FIRSTEP_LVL] +
-                        aniState->iniDef.firstep;
-                if (value < ATH9K_SIG_FIRSTEP_SETTING_MIN)
-                        value = ATH9K_SIG_FIRSTEP_SETTING_MIN;
-                if (value > ATH9K_SIG_FIRSTEP_SETTING_MAX)
-                        value = ATH9K_SIG_FIRSTEP_SETTING_MAX;
+                value = level * 2;
                 REG_RMW_FIELD(ah, AR_PHY_FIND_SIG,
-                              AR_PHY_FIND_SIG_FIRSTEP,
-                              value);
-                /*
-                 * we need to set first step low register too
-                 * make register setting relative to default
-                 * from INI file & cap value
-                 */
-                value2 = firstep_table[level] -
-                         firstep_table[ATH9K_ANI_FIRSTEP_LVL] +
-                         aniState->iniDef.firstepLow;
-                if (value2 < ATH9K_SIG_FIRSTEP_SETTING_MIN)
-                        value2 = ATH9K_SIG_FIRSTEP_SETTING_MIN;
-                if (value2 > ATH9K_SIG_FIRSTEP_SETTING_MAX)
-                        value2 = ATH9K_SIG_FIRSTEP_SETTING_MAX;
-
+                              AR_PHY_FIND_SIG_FIRSTEP, value);
                 REG_RMW_FIELD(ah, AR_PHY_FIND_SIG_LOW,
-                              AR_PHY_FIND_SIG_FIRSTEP_LOW, value2);
+                              AR_PHY_FIND_SIG_FIRSTEP_LOW, value);
 
                 if (level != aniState->firstepLevel) {
                         ath_dbg(common, ANI,
@@ -1060,7 +1025,7 @@ static bool ar5008_hw_ani_control_new(struct ath_hw *ah,
                                 aniState->firstepLevel,
                                 level,
                                 ATH9K_ANI_FIRSTEP_LVL,
-                                value2,
+                                value,
                                 aniState->iniDef.firstepLow);
                         if (level > aniState->firstepLevel)
                                 ah->stats.ast_ani_stepup++;
@@ -1073,41 +1038,13 @@ static bool ar5008_hw_ani_control_new(struct ath_hw *ah,
         case ATH9K_ANI_SPUR_IMMUNITY_LEVEL:{
                 u32 level = param;
 
-                if (level >= ARRAY_SIZE(cycpwrThr1_table)) {
-                        ath_dbg(common, ANI,
-                                "ATH9K_ANI_SPUR_IMMUNITY_LEVEL: level out of range (%u > %zu)\n",
-                                level, ARRAY_SIZE(cycpwrThr1_table));
-                        return false;
-                }
-                /*
-                 * make register setting relative to default
-                 * from INI file & cap value
-                 */
-                value = cycpwrThr1_table[level] -
-                        cycpwrThr1_table[ATH9K_ANI_SPUR_IMMUNE_LVL] +
-                        aniState->iniDef.cycpwrThr1;
-                if (value < ATH9K_SIG_SPUR_IMM_SETTING_MIN)
-                        value = ATH9K_SIG_SPUR_IMM_SETTING_MIN;
-                if (value > ATH9K_SIG_SPUR_IMM_SETTING_MAX)
-                        value = ATH9K_SIG_SPUR_IMM_SETTING_MAX;
+                value = (level + 1) * 2;
                 REG_RMW_FIELD(ah, AR_PHY_TIMING5,
-                              AR_PHY_TIMING5_CYCPWR_THR1,
-                              value);
+                              AR_PHY_TIMING5_CYCPWR_THR1, value);
 
-                /*
-                 * set AR_PHY_EXT_CCA for extension channel
-                 * make register setting relative to default
-                 * from INI file & cap value
-                 */
-                value2 = cycpwrThr1_table[level] -
-                         cycpwrThr1_table[ATH9K_ANI_SPUR_IMMUNE_LVL] +
-                         aniState->iniDef.cycpwrThr1Ext;
-                if (value2 < ATH9K_SIG_SPUR_IMM_SETTING_MIN)
-                        value2 = ATH9K_SIG_SPUR_IMM_SETTING_MIN;
-                if (value2 > ATH9K_SIG_SPUR_IMM_SETTING_MAX)
-                        value2 = ATH9K_SIG_SPUR_IMM_SETTING_MAX;
-                REG_RMW_FIELD(ah, AR_PHY_EXT_CCA,
-                              AR_PHY_EXT_TIMING5_CYCPWR_THR1, value2);
+                if (IS_CHAN_HT40(ah->curchan))
+                        REG_RMW_FIELD(ah, AR_PHY_EXT_CCA,
+                                      AR_PHY_EXT_TIMING5_CYCPWR_THR1, value);
 
                 if (level != aniState->spurImmunityLevel) {
                         ath_dbg(common, ANI,
@@ -1124,7 +1061,7 @@ static bool ar5008_hw_ani_control_new(struct ath_hw *ah,
                                 aniState->spurImmunityLevel,
                                 level,
                                 ATH9K_ANI_SPUR_IMMUNE_LVL,
-                                value2,
+                                value,
                                 aniState->iniDef.cycpwrThr1Ext);
                         if (level > aniState->spurImmunityLevel)
                                 ah->stats.ast_ani_spurup++;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index b8daff78b9d1..235053ba7737 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -23,8 +23,8 @@
 #define COMP_HDR_LEN 4
 #define COMP_CKSUM_LEN 2
 
-#define LE16(x) __constant_cpu_to_le16(x)
-#define LE32(x) __constant_cpu_to_le32(x)
+#define LE16(x) cpu_to_le16(x)
+#define LE32(x) cpu_to_le32(x)
 
 /* Local defines to distinguish between extension and control CTL's */
 #define EXT_ADDITIVE (0x8000)
@@ -4792,43 +4792,54 @@ static void ar9003_hw_power_control_override(struct ath_hw *ah,
 
 tempslope:
         if (AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
+                u8 txmask = (eep->baseEepHeader.txrxMask & 0xf0) >> 4;
+
                 /*
                  * AR955x has tempSlope register for each chain.
                  * Check whether temp_compensation feature is enabled or not.
                  */
                 if (eep->baseEepHeader.featureEnable & 0x1) {
                         if (frequency < 4000) {
-                                REG_RMW_FIELD(ah, AR_PHY_TPC_19,
-                                              AR_PHY_TPC_19_ALPHA_THERM,
-                                              eep->base_ext2.tempSlopeLow);
-                                REG_RMW_FIELD(ah, AR_PHY_TPC_19_B1,
-                                              AR_PHY_TPC_19_ALPHA_THERM,
-                                              temp_slope);
-                                REG_RMW_FIELD(ah, AR_PHY_TPC_19_B2,
-                                              AR_PHY_TPC_19_ALPHA_THERM,
-                                              eep->base_ext2.tempSlopeHigh);
+                                if (txmask & BIT(0))
+                                        REG_RMW_FIELD(ah, AR_PHY_TPC_19,
+                                                      AR_PHY_TPC_19_ALPHA_THERM,
+                                                      eep->base_ext2.tempSlopeLow);
+                                if (txmask & BIT(1))
+                                        REG_RMW_FIELD(ah, AR_PHY_TPC_19_B1,
+                                                      AR_PHY_TPC_19_ALPHA_THERM,
+                                                      temp_slope);
+                                if (txmask & BIT(2))
+                                        REG_RMW_FIELD(ah, AR_PHY_TPC_19_B2,
+                                                      AR_PHY_TPC_19_ALPHA_THERM,
+                                                      eep->base_ext2.tempSlopeHigh);
                         } else {
-                                REG_RMW_FIELD(ah, AR_PHY_TPC_19,
-                                              AR_PHY_TPC_19_ALPHA_THERM,
-                                              temp_slope);
-                                REG_RMW_FIELD(ah, AR_PHY_TPC_19_B1,
-                                              AR_PHY_TPC_19_ALPHA_THERM,
-                                              temp_slope1);
-                                REG_RMW_FIELD(ah, AR_PHY_TPC_19_B2,
-                                              AR_PHY_TPC_19_ALPHA_THERM,
-                                              temp_slope2);
+                                if (txmask & BIT(0))
+                                        REG_RMW_FIELD(ah, AR_PHY_TPC_19,
+                                                      AR_PHY_TPC_19_ALPHA_THERM,
+                                                      temp_slope);
+                                if (txmask & BIT(1))
+                                        REG_RMW_FIELD(ah, AR_PHY_TPC_19_B1,
+                                                      AR_PHY_TPC_19_ALPHA_THERM,
+                                                      temp_slope1);
+                                if (txmask & BIT(2))
+                                        REG_RMW_FIELD(ah, AR_PHY_TPC_19_B2,
+                                                      AR_PHY_TPC_19_ALPHA_THERM,
+                                                      temp_slope2);
                         }
                 } else {
                         /*
                          * If temp compensation is not enabled,
                          * set all registers to 0.
                          */
-                        REG_RMW_FIELD(ah, AR_PHY_TPC_19,
-                                      AR_PHY_TPC_19_ALPHA_THERM, 0);
-                        REG_RMW_FIELD(ah, AR_PHY_TPC_19_B1,
-                                      AR_PHY_TPC_19_ALPHA_THERM, 0);
-                        REG_RMW_FIELD(ah, AR_PHY_TPC_19_B2,
-                                      AR_PHY_TPC_19_ALPHA_THERM, 0);
+                        if (txmask & BIT(0))
+                                REG_RMW_FIELD(ah, AR_PHY_TPC_19,
+                                              AR_PHY_TPC_19_ALPHA_THERM, 0);
+                        if (txmask & BIT(1))
+                                REG_RMW_FIELD(ah, AR_PHY_TPC_19_B1,
+                                              AR_PHY_TPC_19_ALPHA_THERM, 0);
+                        if (txmask & BIT(2))
+                                REG_RMW_FIELD(ah, AR_PHY_TPC_19_B2,
+                                              AR_PHY_TPC_19_ALPHA_THERM, 0);
                 }
         } else {
                 REG_RMW_FIELD(ah, AR_PHY_TPC_19,
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index f995c374a9b4..44d74495c4de 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -403,20 +403,10 @@ void ath9k_calculate_iter_data(struct ieee80211_hw *hw,
 #define ATH_BCBUF                       8
 #define ATH_DEFAULT_BINTVAL             100 /* TU */
 #define ATH_DEFAULT_BMISS_LIMIT         10
-#define IEEE80211_MS_TO_TU(x)           (((x) * 1000) / 1024)
 
 #define TSF_TO_TU(_h,_l) \
         ((((u32)(_h)) << 22) | (((u32)(_l)) >> 10))
 
-struct ath_beacon_config {
-        int beacon_interval;
-        u16 dtim_period;
-        u16 bmiss_timeout;
-        u8 dtim_count;
-        bool enable_beacon;
-        bool ibss_creator;
-};
-
 struct ath_beacon {
         enum {
                 OK,             /* no change needed */
@@ -426,11 +416,9 @@ struct ath_beacon {
 
         u32 beaconq;
         u32 bmisscnt;
-        u32 bc_tstamp;
         struct ieee80211_vif *bslot[ATH_BCBUF];
         int slottime;
         int slotupdate;
-        struct ath9k_tx_queue_info beacon_qi;
         struct ath_descdma bdma;
         struct ath_txq *cabq;
         struct list_head bbuf;
@@ -697,15 +685,6 @@ void ath_ant_comb_scan(struct ath_softc *sc, struct ath_rx_status *rs);
 #define ATH_TXPOWER_MAX         100     /* .5 dBm units */
 #define MAX_GTT_CNT             5
 
-enum sc_op_flags {
-        SC_OP_INVALID,
-        SC_OP_BEACONS,
-        SC_OP_ANI_RUN,
-        SC_OP_PRIM_STA_VIF,
-        SC_OP_HW_RESET,
-        SC_OP_SCANNING,
-};
-
 /* Powersave flags */
 #define PS_WAIT_FOR_BEACON        BIT(0)
 #define PS_WAIT_FOR_CAB           BIT(1)
@@ -735,7 +714,6 @@ struct ath_softc {
         struct completion paprd_complete;
         wait_queue_head_t tx_wait;
 
-        unsigned long sc_flags;
         unsigned long driver_data;
 
         u8 gtt_cnt;
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index 02eb4f10332b..471e0f624e81 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -328,7 +328,7 @@ void ath9k_beacon_tasklet(unsigned long data)
         bool edma = !!(ah->caps.hw_caps & ATH9K_HW_CAP_EDMA);
         int slot;
 
-        if (test_bit(SC_OP_HW_RESET, &sc->sc_flags)) {
+        if (test_bit(ATH_OP_HW_RESET, &common->op_flags)) {
                 ath_dbg(common, RESET,
                         "reset work is pending, skip beaconing now\n");
                 return;
@@ -447,33 +447,6 @@ static void ath9k_beacon_init(struct ath_softc *sc, u32 nexttbtt,
         ath9k_hw_enable_interrupts(ah);
 }
 
-/* Calculate the modulo of a 64 bit TSF snapshot with a TU divisor */
-static u32 ath9k_mod_tsf64_tu(u64 tsf, u32 div_tu)
-{
-        u32 tsf_mod, tsf_hi, tsf_lo, mod_hi, mod_lo;
-
-        tsf_mod = tsf & (BIT(10) - 1);
-        tsf_hi = tsf >> 32;
-        tsf_lo = ((u32) tsf) >> 10;
-
-        mod_hi = tsf_hi % div_tu;
-        mod_lo = ((mod_hi << 22) + tsf_lo) % div_tu;
-
-        return (mod_lo << 10) | tsf_mod;
-}
-
-static u32 ath9k_get_next_tbtt(struct ath_softc *sc, u64 tsf,
-                               unsigned int interval)
-{
-        struct ath_hw *ah = sc->sc_ah;
-        unsigned int offset;
-
-        tsf += TU_TO_USEC(FUDGE + ah->config.sw_beacon_response_time);
-        offset = ath9k_mod_tsf64_tu(tsf, interval);
-
-        return (u32) tsf + TU_TO_USEC(interval) - offset;
-}
-
 /*
  * For multi-bss ap support beacons are either staggered evenly over N slots or
  * burst together.  For the former arrange for the SWBA to be delivered for each
@@ -483,109 +456,18 @@ static void ath9k_beacon_config_ap(struct ath_softc *sc,
                                    struct ath_beacon_config *conf)
 {
         struct ath_hw *ah = sc->sc_ah;
-        struct ath_common *common = ath9k_hw_common(ah);
-        u32 nexttbtt, intval;
-
-        /* NB: the beacon interval is kept internally in TU's */
-        intval = TU_TO_USEC(conf->beacon_interval);
-        intval /= ATH_BCBUF;
-        nexttbtt = ath9k_get_next_tbtt(sc, ath9k_hw_gettsf64(ah),
-                                       conf->beacon_interval);
-
-        if (conf->enable_beacon)
-                ah->imask |= ATH9K_INT_SWBA;
-        else
-                ah->imask &= ~ATH9K_INT_SWBA;
 
-        ath_dbg(common, BEACON,
-                "AP (%s) nexttbtt: %u intval: %u conf_intval: %u\n",
-                (conf->enable_beacon) ? "Enable" : "Disable",
-                nexttbtt, intval, conf->beacon_interval);
-
-        ath9k_beacon_init(sc, nexttbtt, intval, false);
+        ath9k_cmn_beacon_config_ap(ah, conf, ATH_BCBUF);
+        ath9k_beacon_init(sc, conf->nexttbtt, conf->intval, false);
 }
 
-/*
- * This sets up the beacon timers according to the timestamp of the last
- * received beacon and the current TSF, configures PCF and DTIM
- * handling, programs the sleep registers so the hardware will wakeup in
- * time to receive beacons, and configures the beacon miss handling so
- * we'll receive a BMISS interrupt when we stop seeing beacons from the AP
- * we've associated with.
- */
-static void ath9k_beacon_config_sta(struct ath_softc *sc,
+static void ath9k_beacon_config_sta(struct ath_hw *ah,
                                     struct ath_beacon_config *conf)
 {
-        struct ath_hw *ah = sc->sc_ah;
-        struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_beacon_state bs;
-        int dtim_intval;
-        u32 nexttbtt = 0, intval;
-        u64 tsf;
 
-        /* No need to configure beacon if we are not associated */
-        if (!test_bit(SC_OP_PRIM_STA_VIF, &sc->sc_flags)) {
-                ath_dbg(common, BEACON,
-                        "STA is not yet associated..skipping beacon config\n");
+        if (ath9k_cmn_beacon_config_sta(ah, conf, &bs) == -EPERM)
                 return;
-        }
-
-        memset(&bs, 0, sizeof(bs));
-        intval = conf->beacon_interval;
-
-        /*
-         * Setup dtim parameters according to
-         * last beacon we received (which may be none).
-         */
-        dtim_intval = intval * conf->dtim_period;
-
-        /*
-         * Pull nexttbtt forward to reflect the current
-         * TSF and calculate dtim state for the result.
-         */
-        tsf = ath9k_hw_gettsf64(ah);
-        nexttbtt = ath9k_get_next_tbtt(sc, tsf, intval);
-
-        bs.bs_intval = TU_TO_USEC(intval);
-        bs.bs_dtimperiod = conf->dtim_period * bs.bs_intval;
-        bs.bs_nexttbtt = nexttbtt;
-        bs.bs_nextdtim = nexttbtt;
-        if (conf->dtim_period > 1)
-                bs.bs_nextdtim = ath9k_get_next_tbtt(sc, tsf, dtim_intval);
-
-        /*
-         * Calculate the number of consecutive beacons to miss* before taking
-         * a BMISS interrupt. The configuration is specified in TU so we only
-         * need calculate based on the beacon interval.  Note that we clamp the
-         * result to at most 15 beacons.
-         */
-        bs.bs_bmissthreshold = DIV_ROUND_UP(conf->bmiss_timeout, intval);
-        if (bs.bs_bmissthreshold > 15)
-                bs.bs_bmissthreshold = 15;
-        else if (bs.bs_bmissthreshold <= 0)
-                bs.bs_bmissthreshold = 1;
-
-        /*
-         * Calculate sleep duration. The configuration is given in ms.
-         * We ensure a multiple of the beacon period is used. Also, if the sleep
-         * duration is greater than the DTIM period then it makes senses
-         * to make it a multiple of that.
-         *
-         * XXX fixed at 100ms
-         */
-
-        bs.bs_sleepduration = TU_TO_USEC(roundup(IEEE80211_MS_TO_TU(100),
-                                                 intval));
-        if (bs.bs_sleepduration > bs.bs_dtimperiod)
-                bs.bs_sleepduration = bs.bs_dtimperiod;
-
-        /* TSF out of range threshold fixed at 1 second */
-        bs.bs_tsfoor_threshold = ATH9K_TSFOOR_THRESHOLD;
-
-        ath_dbg(common, BEACON, "bmiss: %u sleep: %u\n",
-                bs.bs_bmissthreshold, bs.bs_sleepduration);
-
-        /* Set the computed STA beacon timers */
 
         ath9k_hw_disable_interrupts(ah);
         ath9k_hw_set_sta_beacon_timers(ah, &bs);
@@ -600,36 +482,19 @@ static void ath9k_beacon_config_adhoc(struct ath_softc *sc,
 {
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
-        u32 intval, nexttbtt;
 
         ath9k_reset_beacon_status(sc);
 
-        intval = TU_TO_USEC(conf->beacon_interval);
-
-        if (conf->ibss_creator)
-                nexttbtt = intval;
-        else
-                nexttbtt = ath9k_get_next_tbtt(sc, ath9k_hw_gettsf64(ah),
-                                               conf->beacon_interval);
-
-        if (conf->enable_beacon)
-                ah->imask |= ATH9K_INT_SWBA;
-        else
-                ah->imask &= ~ATH9K_INT_SWBA;
-
-        ath_dbg(common, BEACON,
-                "IBSS (%s) nexttbtt: %u intval: %u conf_intval: %u\n",
-                (conf->enable_beacon) ? "Enable" : "Disable",
-                nexttbtt, intval, conf->beacon_interval);
+        ath9k_cmn_beacon_config_adhoc(ah, conf);
 
-        ath9k_beacon_init(sc, nexttbtt, intval, conf->ibss_creator);
+        ath9k_beacon_init(sc, conf->nexttbtt, conf->intval, conf->ibss_creator);
 
         /*
          * Set the global 'beacon has been configured' flag for the
          * joiner case in IBSS mode.
          */
         if (!conf->ibss_creator && conf->enable_beacon)
-                set_bit(SC_OP_BEACONS, &sc->sc_flags);
+                set_bit(ATH_OP_BEACONS, &common->op_flags);
 }
 
 static bool ath9k_allow_beacon_config(struct ath_softc *sc,
@@ -649,7 +514,7 @@ static bool ath9k_allow_beacon_config(struct ath_softc *sc,
 
         if (sc->sc_ah->opmode == NL80211_IFTYPE_STATION) {
                 if ((vif->type == NL80211_IFTYPE_STATION) &&
-                    test_bit(SC_OP_BEACONS, &sc->sc_flags) &&
+                    test_bit(ATH_OP_BEACONS, &common->op_flags) &&
                     !avp->primary_sta_vif) {
                         ath_dbg(common, CONFIG,
                                 "Beacon already configured for a station interface\n");
@@ -700,6 +565,8 @@ void ath9k_beacon_config(struct ath_softc *sc, struct ieee80211_vif *vif,
 {
         struct ieee80211_bss_conf *bss_conf = &vif->bss_conf;
         struct ath_beacon_config *cur_conf = &sc->cur_beacon_conf;
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
         unsigned long flags;
         bool skip_beacon = false;
 
@@ -712,7 +579,7 @@ void ath9k_beacon_config(struct ath_softc *sc, struct ieee80211_vif *vif,
         if (sc->sc_ah->opmode == NL80211_IFTYPE_STATION) {
                 ath9k_cache_beacon_config(sc, bss_conf);
                 ath9k_set_beacon(sc);
-                set_bit(SC_OP_BEACONS, &sc->sc_flags);
+                set_bit(ATH_OP_BEACONS, &common->op_flags);
                 return;
         }
 
@@ -751,13 +618,13 @@ void ath9k_beacon_config(struct ath_softc *sc, struct ieee80211_vif *vif,
                 }
 
                 /*
-                 * Do not set the SC_OP_BEACONS flag for IBSS joiner mode
+                 * Do not set the ATH_OP_BEACONS flag for IBSS joiner mode
                  * here, it is done in ath9k_beacon_config_adhoc().
                  */
                 if (cur_conf->enable_beacon && !skip_beacon)
-                        set_bit(SC_OP_BEACONS, &sc->sc_flags);
+                        set_bit(ATH_OP_BEACONS, &common->op_flags);
                 else
-                        clear_bit(SC_OP_BEACONS, &sc->sc_flags);
+                        clear_bit(ATH_OP_BEACONS, &common->op_flags);
         }
 }
 
@@ -775,7 +642,7 @@ void ath9k_set_beacon(struct ath_softc *sc)
                 ath9k_beacon_config_adhoc(sc, cur_conf);
                 break;
         case NL80211_IFTYPE_STATION:
-                ath9k_beacon_config_sta(sc, cur_conf);
+                ath9k_beacon_config_sta(sc->sc_ah, cur_conf);
                 break;
         default:
                 ath_dbg(common, CONFIG, "Unsupported beaconing mode\n");
diff --git a/drivers/net/wireless/ath/ath9k/common-beacon.c b/drivers/net/wireless/ath/ath9k/common-beacon.c
new file mode 100644
index 000000000000..775d1d20ce0b
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/common-beacon.c
@@ -0,0 +1,180 @@
+/*
+ * Copyright (c) 2008-2011 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "common.h"
+
+#define FUDGE 2
+
+/* Calculate the modulo of a 64 bit TSF snapshot with a TU divisor */
+static u32 ath9k_mod_tsf64_tu(u64 tsf, u32 div_tu)
+{
+        u32 tsf_mod, tsf_hi, tsf_lo, mod_hi, mod_lo;
+
+        tsf_mod = tsf & (BIT(10) - 1);
+        tsf_hi = tsf >> 32;
+        tsf_lo = ((u32) tsf) >> 10;
+
+        mod_hi = tsf_hi % div_tu;
+        mod_lo = ((mod_hi << 22) + tsf_lo) % div_tu;
+
+        return (mod_lo << 10) | tsf_mod;
+}
+
+static u32 ath9k_get_next_tbtt(struct ath_hw *ah, u64 tsf,
+                               unsigned int interval)
+{
+        unsigned int offset;
+
+        tsf += TU_TO_USEC(FUDGE + ah->config.sw_beacon_response_time);
+        offset = ath9k_mod_tsf64_tu(tsf, interval);
+
+        return (u32) tsf + TU_TO_USEC(interval) - offset;
+}
+
+/*
+ * This sets up the beacon timers according to the timestamp of the last
+ * received beacon and the current TSF, configures PCF and DTIM
+ * handling, programs the sleep registers so the hardware will wakeup in
+ * time to receive beacons, and configures the beacon miss handling so
+ * we'll receive a BMISS interrupt when we stop seeing beacons from the AP
+ * we've associated with.
+ */
+int ath9k_cmn_beacon_config_sta(struct ath_hw *ah,
+                                 struct ath_beacon_config *conf,
+                                 struct ath9k_beacon_state *bs)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        int dtim_intval;
+        u64 tsf;
+
+        /* No need to configure beacon if we are not associated */
+        if (!test_bit(ATH_OP_PRIM_STA_VIF, &common->op_flags)) {
+                ath_dbg(common, BEACON,
+                        "STA is not yet associated..skipping beacon config\n");
+                return -EPERM;
+        }
+
+        memset(bs, 0, sizeof(*bs));
+        conf->intval = conf->beacon_interval;
+
+        /*
+         * Setup dtim parameters according to
+         * last beacon we received (which may be none).
+         */
+        dtim_intval = conf->intval * conf->dtim_period;
+
+        /*
+         * Pull nexttbtt forward to reflect the current
+         * TSF and calculate dtim state for the result.
+         */
+        tsf = ath9k_hw_gettsf64(ah);
+        conf->nexttbtt = ath9k_get_next_tbtt(ah, tsf, conf->intval);
+
+        bs->bs_intval = TU_TO_USEC(conf->intval);
+        bs->bs_dtimperiod = conf->dtim_period * bs->bs_intval;
+        bs->bs_nexttbtt = conf->nexttbtt;
+        bs->bs_nextdtim = conf->nexttbtt;
+        if (conf->dtim_period > 1)
+                bs->bs_nextdtim = ath9k_get_next_tbtt(ah, tsf, dtim_intval);
+
+        /*
+         * Calculate the number of consecutive beacons to miss* before taking
+         * a BMISS interrupt. The configuration is specified in TU so we only
+         * need calculate based on the beacon interval.  Note that we clamp the
+         * result to at most 15 beacons.
+         */
+        bs->bs_bmissthreshold = DIV_ROUND_UP(conf->bmiss_timeout, conf->intval);
+        if (bs->bs_bmissthreshold > 15)
+                bs->bs_bmissthreshold = 15;
+        else if (bs->bs_bmissthreshold <= 0)
+                bs->bs_bmissthreshold = 1;
+
+        /*
+         * Calculate sleep duration. The configuration is given in ms.
+         * We ensure a multiple of the beacon period is used. Also, if the sleep
+         * duration is greater than the DTIM period then it makes senses
+         * to make it a multiple of that.
+         *
+         * XXX fixed at 100ms
+         */
+
+        bs->bs_sleepduration = TU_TO_USEC(roundup(IEEE80211_MS_TO_TU(100),
+                                                 conf->intval));
+        if (bs->bs_sleepduration > bs->bs_dtimperiod)
+                bs->bs_sleepduration = bs->bs_dtimperiod;
+
+        /* TSF out of range threshold fixed at 1 second */
+        bs->bs_tsfoor_threshold = ATH9K_TSFOOR_THRESHOLD;
+
+        ath_dbg(common, BEACON, "bmiss: %u sleep: %u\n",
+                bs->bs_bmissthreshold, bs->bs_sleepduration);
+        return 0;
+}
+EXPORT_SYMBOL(ath9k_cmn_beacon_config_sta);
+
+void ath9k_cmn_beacon_config_adhoc(struct ath_hw *ah,
+                                   struct ath_beacon_config *conf)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        conf->intval = TU_TO_USEC(conf->beacon_interval);
+
+        if (conf->ibss_creator)
+                conf->nexttbtt = conf->intval;
+        else
+                conf->nexttbtt = ath9k_get_next_tbtt(ah, ath9k_hw_gettsf64(ah),
+                                               conf->beacon_interval);
+
+        if (conf->enable_beacon)
+                ah->imask |= ATH9K_INT_SWBA;
+        else
+                ah->imask &= ~ATH9K_INT_SWBA;
+
+        ath_dbg(common, BEACON,
+                "IBSS (%s) nexttbtt: %u intval: %u conf_intval: %u\n",
+                (conf->enable_beacon) ? "Enable" : "Disable",
+                conf->nexttbtt, conf->intval, conf->beacon_interval);
+}
+EXPORT_SYMBOL(ath9k_cmn_beacon_config_adhoc);
+
+/*
+ * For multi-bss ap support beacons are either staggered evenly over N slots or
+ * burst together.  For the former arrange for the SWBA to be delivered for each
+ * slot. Slots that are not occupied will generate nothing.
+ */
+void ath9k_cmn_beacon_config_ap(struct ath_hw *ah,
+                                struct ath_beacon_config *conf,
+                                unsigned int bc_buf)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        /* NB: the beacon interval is kept internally in TU's */
+        conf->intval = TU_TO_USEC(conf->beacon_interval);
+        conf->intval /= bc_buf;
+        conf->nexttbtt = ath9k_get_next_tbtt(ah, ath9k_hw_gettsf64(ah),
+                                       conf->beacon_interval);
+
+        if (conf->enable_beacon)
+                ah->imask |= ATH9K_INT_SWBA;
+        else
+                ah->imask &= ~ATH9K_INT_SWBA;
+
+        ath_dbg(common, BEACON,
+                "AP (%s) nexttbtt: %u intval: %u conf_intval: %u\n",
+                (conf->enable_beacon) ? "Enable" : "Disable",
+                conf->nexttbtt, conf->intval, conf->beacon_interval);
+}
+EXPORT_SYMBOL(ath9k_cmn_beacon_config_ap);
diff --git a/drivers/net/wireless/ath/ath9k/common-beacon.h b/drivers/net/wireless/ath/ath9k/common-beacon.h
new file mode 100644
index 000000000000..3665d27f0dc7
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/common-beacon.h
@@ -0,0 +1,26 @@
+/*
+ * Copyright (c) 2009-2011 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+struct ath_beacon_config;
+
+int ath9k_cmn_beacon_config_sta(struct ath_hw *ah,
+                                struct ath_beacon_config *conf,
+                                struct ath9k_beacon_state *bs);
+void ath9k_cmn_beacon_config_adhoc(struct ath_hw *ah,
+                                   struct ath_beacon_config *conf);
+void ath9k_cmn_beacon_config_ap(struct ath_hw *ah,
+                                struct ath_beacon_config *conf,
+                                unsigned int bc_buf);
diff --git a/drivers/net/wireless/ath/ath9k/common.h b/drivers/net/wireless/ath/ath9k/common.h
index 4c449e35bd65..ca38116838f0 100644
--- a/drivers/net/wireless/ath/ath9k/common.h
+++ b/drivers/net/wireless/ath/ath9k/common.h
@@ -22,6 +22,7 @@
 #include "hw-ops.h"
 
 #include "common-init.h"
+#include "common-beacon.h"
 
 /* Common header for Atheros 802.11n base driver cores */
 
@@ -44,6 +45,19 @@
 #define ATH_EP_RND(x, mul)                                              \
         (((x) + ((mul)/2)) / (mul))
 
+#define IEEE80211_MS_TO_TU(x)   (((x) * 1000) / 1024)
+
+struct ath_beacon_config {
+        int beacon_interval;
+        u16 dtim_period;
+        u16 bmiss_timeout;
+        u8 dtim_count;
+        bool enable_beacon;
+        bool ibss_creator;
+        u32 nexttbtt;
+        u32 intval;
+};
+
 bool ath9k_cmn_rx_accept(struct ath_common *common,
                          struct ieee80211_hdr *hdr,
                          struct ieee80211_rx_status *rxs,
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index f8924efdad55..780ff1bee6f6 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -139,43 +139,41 @@ static ssize_t read_file_ani(struct file *file, char __user *user_buf,
         const unsigned int size = 1024;
         ssize_t retval = 0;
         char *buf;
+        int i;
+        struct {
+                const char *name;
+                unsigned int val;
+        } ani_info[] = {
+                { "ANI RESET", ah->stats.ast_ani_reset },
+                { "OFDM LEVEL", ah->ani.ofdmNoiseImmunityLevel },
+                { "CCK LEVEL", ah->ani.cckNoiseImmunityLevel },
+                { "SPUR UP", ah->stats.ast_ani_spurup },
+                { "SPUR DOWN", ah->stats.ast_ani_spurup },
+                { "OFDM WS-DET ON", ah->stats.ast_ani_ofdmon },
+                { "OFDM WS-DET OFF", ah->stats.ast_ani_ofdmoff },
+                { "MRC-CCK ON", ah->stats.ast_ani_ccklow },
+                { "MRC-CCK OFF", ah->stats.ast_ani_cckhigh },
+                { "FIR-STEP UP", ah->stats.ast_ani_stepup },
+                { "FIR-STEP DOWN", ah->stats.ast_ani_stepdown },
+                { "INV LISTENTIME", ah->stats.ast_ani_lneg_or_lzero },
+                { "OFDM ERRORS", ah->stats.ast_ani_ofdmerrs },
+                { "CCK ERRORS", ah->stats.ast_ani_cckerrs },
+        };
 
         buf = kzalloc(size, GFP_KERNEL);
         if (buf == NULL)
                 return -ENOMEM;
 
-        if (common->disable_ani) {
-                len += scnprintf(buf + len, size - len, "%s: %s\n",
-                                 "ANI", "DISABLED");
+        len += scnprintf(buf + len, size - len, "%15s: %s\n", "ANI",
+                         common->disable_ani ? "DISABLED" : "ENABLED");
+
+        if (common->disable_ani)
                 goto exit;
-        }
 
-        len += scnprintf(buf + len, size - len, "%15s: %s\n",
-                         "ANI", "ENABLED");
-        len += scnprintf(buf + len, size - len, "%15s: %u\n",
-                         "ANI RESET", ah->stats.ast_ani_reset);
-        len += scnprintf(buf + len, size - len, "%15s: %u\n",
-                         "SPUR UP", ah->stats.ast_ani_spurup);
-        len += scnprintf(buf + len, size - len, "%15s: %u\n",
-                         "SPUR DOWN", ah->stats.ast_ani_spurup);
-        len += scnprintf(buf + len, size - len, "%15s: %u\n",
-                         "OFDM WS-DET ON", ah->stats.ast_ani_ofdmon);
-        len += scnprintf(buf + len, size - len, "%15s: %u\n",
-                         "OFDM WS-DET OFF", ah->stats.ast_ani_ofdmoff);
-        len += scnprintf(buf + len, size - len, "%15s: %u\n",
-                         "MRC-CCK ON", ah->stats.ast_ani_ccklow);
-        len += scnprintf(buf + len, size - len, "%15s: %u\n",
-                         "MRC-CCK OFF", ah->stats.ast_ani_cckhigh);
-        len += scnprintf(buf + len, size - len, "%15s: %u\n",
-                         "FIR-STEP UP", ah->stats.ast_ani_stepup);
-        len += scnprintf(buf + len, size - len, "%15s: %u\n",
-                         "FIR-STEP DOWN", ah->stats.ast_ani_stepdown);
-        len += scnprintf(buf + len, size - len, "%15s: %u\n",
-                         "INV LISTENTIME", ah->stats.ast_ani_lneg_or_lzero);
-        len += scnprintf(buf + len, size - len, "%15s: %u\n",
-                         "OFDM ERRORS", ah->stats.ast_ani_ofdmerrs);
-        len += scnprintf(buf + len, size - len, "%15s: %u\n",
-                         "CCK ERRORS", ah->stats.ast_ani_cckerrs);
+        for (i = 0; i < ARRAY_SIZE(ani_info); i++)
+                len += scnprintf(buf + len, size - len, "%15s: %u\n",
+                                 ani_info[i].name, ani_info[i].val);
+
 exit:
         if (len > size)
                 len = size;
@@ -210,7 +208,7 @@ static ssize_t write_file_ani(struct file *file,
         common->disable_ani = !ani;
 
         if (common->disable_ani) {
-                clear_bit(SC_OP_ANI_RUN, &sc->sc_flags);
+                clear_bit(ATH_OP_ANI_RUN, &common->op_flags);
                 ath_stop_ani(sc);
         } else {
                 ath_check_ani(sc);
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index 3baf9ceae601..dab1f0cab993 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -39,7 +39,6 @@
 #define ATH_RESTART_CALINTERVAL   1200000 /* 20 minutes */
 
 #define ATH_DEFAULT_BMISS_LIMIT 10
-#define IEEE80211_MS_TO_TU(x)   (((x) * 1000) / 1024)
 #define TSF_TO_TU(_h, _l) \
         ((((u32)(_h)) << 22) | (((u32)(_l)) >> 10))
 
@@ -406,12 +405,18 @@ static inline void ath9k_htc_err_stat_rx(struct ath9k_htc_priv *priv,
 #define DEFAULT_SWBA_RESPONSE 40 /* in TUs */
 #define MIN_SWBA_RESPONSE     10 /* in TUs */
 
-struct htc_beacon_config {
+struct htc_beacon {
+        enum {
+                OK,             /* no change needed */
+                UPDATE,         /* update pending */
+                COMMIT          /* beacon sent, commit change */
+        } updateslot;           /* slot time update fsm */
+
         struct ieee80211_vif *bslot[ATH9K_HTC_MAX_BCN_VIF];
-        u16 beacon_interval;
-        u16 dtim_period;
-        u16 bmiss_timeout;
-        u32 bmiss_cnt;
+        u32 bmisscnt;
+        u32 beaconq;
+        int slottime;
+        int slotupdate;
 };
 
 struct ath_btcoex {
@@ -439,12 +444,8 @@ static inline void ath9k_htc_stop_btcoex(struct ath9k_htc_priv *priv)
 }
 #endif /* CONFIG_ATH9K_BTCOEX_SUPPORT */
 
-#define OP_INVALID                 BIT(0)
-#define OP_SCANNING                BIT(1)
-#define OP_ENABLE_BEACON           BIT(2)
 #define OP_BT_PRIORITY_DETECTED    BIT(3)
 #define OP_BT_SCAN                 BIT(4)
-#define OP_ANI_RUNNING             BIT(5)
 #define OP_TSF_RESET               BIT(6)
 
 struct ath9k_htc_priv {
@@ -489,7 +490,8 @@ struct ath9k_htc_priv {
         struct ath9k_hw_cal_data caldata;
 
         spinlock_t beacon_lock;
-        struct htc_beacon_config cur_beacon_conf;
+        struct ath_beacon_config cur_beacon_conf;
+        struct htc_beacon beacon;
 
         struct ath9k_htc_rx rx;
         struct ath9k_htc_tx tx;
@@ -514,7 +516,6 @@ struct ath9k_htc_priv {
         struct work_struct led_work;
 #endif
 
-        int beaconq;
         int cabq;
         int hwq_map[IEEE80211_NUM_ACS];
 
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c b/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
index a00ddb9e737e..e8b6ec3c1dbb 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
@@ -26,7 +26,7 @@ void ath9k_htc_beaconq_config(struct ath9k_htc_priv *priv)
         memset(&qi, 0, sizeof(struct ath9k_tx_queue_info));
         memset(&qi_be, 0, sizeof(struct ath9k_tx_queue_info));
 
-        ath9k_hw_get_txq_props(ah, priv->beaconq, &qi);
+        ath9k_hw_get_txq_props(ah, priv->beacon.beaconq, &qi);
 
         if (priv->ah->opmode == NL80211_IFTYPE_AP ||
             priv->ah->opmode == NL80211_IFTYPE_MESH_POINT) {
@@ -54,212 +54,78 @@ void ath9k_htc_beaconq_config(struct ath9k_htc_priv *priv)
 
         }
 
-        if (!ath9k_hw_set_txq_props(ah, priv->beaconq, &qi)) {
+        if (!ath9k_hw_set_txq_props(ah, priv->beacon.beaconq, &qi)) {
                 ath_err(ath9k_hw_common(ah),
-                        "Unable to update beacon queue %u!\n", priv->beaconq);
+                        "Unable to update beacon queue %u!\n", priv->beacon.beaconq);
         } else {
-                ath9k_hw_resettxqueue(ah, priv->beaconq);
+                ath9k_hw_resettxqueue(ah, priv->beacon.beaconq);
         }
 }
 
-
-static void ath9k_htc_beacon_config_sta(struct ath9k_htc_priv *priv,
-                                        struct htc_beacon_config *bss_conf)
+/*
+ * Both nexttbtt and intval have to be in usecs.
+ */
+static void ath9k_htc_beacon_init(struct ath9k_htc_priv *priv,
+                                  struct ath_beacon_config *conf,
+                                  bool reset_tsf)
 {
-        struct ath_common *common = ath9k_hw_common(priv->ah);
-        struct ath9k_beacon_state bs;
-        enum ath9k_int imask = 0;
-        int dtimperiod, dtimcount;
-        int bmiss_timeout;
-        u32 nexttbtt = 0, intval, tsftu;
-        __be32 htc_imask = 0;
-        u64 tsf;
-        int num_beacons, offset, dtim_dec_count;
+        struct ath_hw *ah = priv->ah;
         int ret __attribute__ ((unused));
+        __be32 htc_imask = 0;
         u8 cmd_rsp;
 
-        memset(&bs, 0, sizeof(bs));
-
-        intval = bss_conf->beacon_interval;
-        bmiss_timeout = (ATH_DEFAULT_BMISS_LIMIT * bss_conf->beacon_interval);
-
-        /*
-         * Setup dtim parameters according to
-         * last beacon we received (which may be none).
-         */
-        dtimperiod = bss_conf->dtim_period;
-        if (dtimperiod <= 0)            /* NB: 0 if not known */
-                dtimperiod = 1;
-        dtimcount = 1;
-        if (dtimcount >= dtimperiod)    /* NB: sanity check */
-                dtimcount = 0;
-
-        /*
-         * Pull nexttbtt forward to reflect the current
-         * TSF and calculate dtim state for the result.
-         */
-        tsf = ath9k_hw_gettsf64(priv->ah);
-        tsftu = TSF_TO_TU(tsf>>32, tsf) + FUDGE;
-
-        num_beacons = tsftu / intval + 1;
-        offset = tsftu % intval;
-        nexttbtt = tsftu - offset;
-        if (offset)
-                nexttbtt += intval;
-
-        /* DTIM Beacon every dtimperiod Beacon */
-        dtim_dec_count = num_beacons % dtimperiod;
-        dtimcount -= dtim_dec_count;
-        if (dtimcount < 0)
-                dtimcount += dtimperiod;
-
-        bs.bs_intval = TU_TO_USEC(intval);
-        bs.bs_nexttbtt = TU_TO_USEC(nexttbtt);
-        bs.bs_dtimperiod = dtimperiod * bs.bs_intval;
-        bs.bs_nextdtim = bs.bs_nexttbtt + dtimcount * bs.bs_intval;
-
-        /*
-         * Calculate the number of consecutive beacons to miss* before taking
-         * a BMISS interrupt. The configuration is specified in TU so we only
-         * need calculate based on the beacon interval.  Note that we clamp the
-         * result to at most 15 beacons.
-         */
-        bs.bs_bmissthreshold = DIV_ROUND_UP(bmiss_timeout, intval);
-        if (bs.bs_bmissthreshold > 15)
-                bs.bs_bmissthreshold = 15;
-        else if (bs.bs_bmissthreshold <= 0)
-                bs.bs_bmissthreshold = 1;
-
-        /*
-         * Calculate sleep duration. The configuration is given in ms.
-         * We ensure a multiple of the beacon period is used. Also, if the sleep
-         * duration is greater than the DTIM period then it makes senses
-         * to make it a multiple of that.
-         *
-         * XXX fixed at 100ms
-         */
-
-        bs.bs_sleepduration = TU_TO_USEC(roundup(IEEE80211_MS_TO_TU(100),
-                                                 intval));
-        if (bs.bs_sleepduration > bs.bs_dtimperiod)
-                bs.bs_sleepduration = bs.bs_dtimperiod;
-
-        /* TSF out of range threshold fixed at 1 second */
-        bs.bs_tsfoor_threshold = ATH9K_TSFOOR_THRESHOLD;
-
-        ath_dbg(common, CONFIG, "intval: %u tsf: %llu tsftu: %u\n",
-                intval, tsf, tsftu);
-        ath_dbg(common, CONFIG, "bmiss: %u sleep: %u\n",
-                bs.bs_bmissthreshold, bs.bs_sleepduration);
-
-        /* Set the computed STA beacon timers */
+        if (conf->intval >= TU_TO_USEC(DEFAULT_SWBA_RESPONSE))
+                ah->config.sw_beacon_response_time = DEFAULT_SWBA_RESPONSE;
+        else
+                ah->config.sw_beacon_response_time = MIN_SWBA_RESPONSE;
 
         WMI_CMD(WMI_DISABLE_INTR_CMDID);
-        ath9k_hw_set_sta_beacon_timers(priv->ah, &bs);
-        imask |= ATH9K_INT_BMISS;
-        htc_imask = cpu_to_be32(imask);
+        if (reset_tsf)
+                ath9k_hw_reset_tsf(ah);
+        ath9k_htc_beaconq_config(priv);
+        ath9k_hw_beaconinit(ah, conf->nexttbtt, conf->intval);
+        priv->beacon.bmisscnt = 0;
+        htc_imask = cpu_to_be32(ah->imask);
         WMI_CMD_BUF(WMI_ENABLE_INTR_CMDID, &htc_imask);
 }
 
-static void ath9k_htc_beacon_config_ap(struct ath9k_htc_priv *priv,
-                                       struct htc_beacon_config *bss_conf)
+static void ath9k_htc_beacon_config_sta(struct ath9k_htc_priv *priv,
+                                        struct ath_beacon_config *bss_conf)
 {
-        struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct ath9k_beacon_state bs;
         enum ath9k_int imask = 0;
-        u32 nexttbtt, intval, tsftu;
         __be32 htc_imask = 0;
         int ret __attribute__ ((unused));
         u8 cmd_rsp;
-        u64 tsf;
-
-        intval = bss_conf->beacon_interval;
-        intval /= ATH9K_HTC_MAX_BCN_VIF;
-        nexttbtt = intval;
 
-        /*
-         * To reduce beacon misses under heavy TX load,
-         * set the beacon response time to a larger value.
-         */
-        if (intval > DEFAULT_SWBA_RESPONSE)
-                priv->ah->config.sw_beacon_response_time = DEFAULT_SWBA_RESPONSE;
-        else
-                priv->ah->config.sw_beacon_response_time = MIN_SWBA_RESPONSE;
-
-        if (test_bit(OP_TSF_RESET, &priv->op_flags)) {
-                ath9k_hw_reset_tsf(priv->ah);
-                clear_bit(OP_TSF_RESET, &priv->op_flags);
-        } else {
-                /*
-                 * Pull nexttbtt forward to reflect the current TSF.
-                 */
-                tsf = ath9k_hw_gettsf64(priv->ah);
-                tsftu = TSF_TO_TU(tsf >> 32, tsf) + FUDGE;
-                do {
-                        nexttbtt += intval;
-                } while (nexttbtt < tsftu);
-        }
-
-        if (test_bit(OP_ENABLE_BEACON, &priv->op_flags))
-                imask |= ATH9K_INT_SWBA;
-
-        ath_dbg(common, CONFIG,
-                "AP Beacon config, intval: %d, nexttbtt: %u, resp_time: %d imask: 0x%x\n",
-                bss_conf->beacon_interval, nexttbtt,
-                priv->ah->config.sw_beacon_response_time, imask);
-
-        ath9k_htc_beaconq_config(priv);
+        if (ath9k_cmn_beacon_config_sta(priv->ah, bss_conf, &bs) == -EPERM)
+                return;
 
         WMI_CMD(WMI_DISABLE_INTR_CMDID);
-        ath9k_hw_beaconinit(priv->ah, TU_TO_USEC(nexttbtt), TU_TO_USEC(intval));
-        priv->cur_beacon_conf.bmiss_cnt = 0;
+        ath9k_hw_set_sta_beacon_timers(priv->ah, &bs);
+        imask |= ATH9K_INT_BMISS;
         htc_imask = cpu_to_be32(imask);
         WMI_CMD_BUF(WMI_ENABLE_INTR_CMDID, &htc_imask);
 }
 
-static void ath9k_htc_beacon_config_adhoc(struct ath9k_htc_priv *priv,
-                                          struct htc_beacon_config *bss_conf)
+static void ath9k_htc_beacon_config_ap(struct ath9k_htc_priv *priv,
+                                       struct ath_beacon_config *conf)
 {
-        struct ath_common *common = ath9k_hw_common(priv->ah);
-        enum ath9k_int imask = 0;
-        u32 nexttbtt, intval, tsftu;
-        __be32 htc_imask = 0;
-        int ret __attribute__ ((unused));
-        u8 cmd_rsp;
-        u64 tsf;
-
-        intval = bss_conf->beacon_interval;
-        nexttbtt = intval;
-
-        /*
-         * Pull nexttbtt forward to reflect the current TSF.
-         */
-        tsf = ath9k_hw_gettsf64(priv->ah);
-        tsftu = TSF_TO_TU(tsf >> 32, tsf) + FUDGE;
-        do {
-                nexttbtt += intval;
-        } while (nexttbtt < tsftu);
-
-        /*
-         * Only one IBSS interfce is allowed.
-         */
-        if (intval > DEFAULT_SWBA_RESPONSE)
-                priv->ah->config.sw_beacon_response_time = DEFAULT_SWBA_RESPONSE;
-        else
-                priv->ah->config.sw_beacon_response_time = MIN_SWBA_RESPONSE;
+        struct ath_hw *ah = priv->ah;
+        ah->imask = 0;
 
-        if (test_bit(OP_ENABLE_BEACON, &priv->op_flags))
-                imask |= ATH9K_INT_SWBA;
+        ath9k_cmn_beacon_config_ap(ah, conf, ATH9K_HTC_MAX_BCN_VIF);
+        ath9k_htc_beacon_init(priv, conf, false);
+}
 
-        ath_dbg(common, CONFIG,
-                "IBSS Beacon config, intval: %d, nexttbtt: %u, resp_time: %d, imask: 0x%x\n",
-                bss_conf->beacon_interval, nexttbtt,
-                priv->ah->config.sw_beacon_response_time, imask);
+static void ath9k_htc_beacon_config_adhoc(struct ath9k_htc_priv *priv,
+                                          struct ath_beacon_config *conf)
+{
+        struct ath_hw *ah = priv->ah;
+        ah->imask = 0;
 
-        WMI_CMD(WMI_DISABLE_INTR_CMDID);
-        ath9k_hw_beaconinit(priv->ah, TU_TO_USEC(nexttbtt), TU_TO_USEC(intval));
-        priv->cur_beacon_conf.bmiss_cnt = 0;
-        htc_imask = cpu_to_be32(imask);
-        WMI_CMD_BUF(WMI_ENABLE_INTR_CMDID, &htc_imask);
+        ath9k_cmn_beacon_config_adhoc(ah, conf);
+        ath9k_htc_beacon_init(priv, conf, conf->ibss_creator);
 }
 
 void ath9k_htc_beaconep(void *drv_priv, struct sk_buff *skb,
@@ -279,7 +145,7 @@ static void ath9k_htc_send_buffered(struct ath9k_htc_priv *priv,
 
         spin_lock_bh(&priv->beacon_lock);
 
-        vif = priv->cur_beacon_conf.bslot[slot];
+        vif = priv->beacon.bslot[slot];
 
         skb = ieee80211_get_buffered_bc(priv->hw, vif);
 
@@ -340,10 +206,10 @@ static void ath9k_htc_send_beacon(struct ath9k_htc_priv *priv,
 
         spin_lock_bh(&priv->beacon_lock);
 
-        vif = priv->cur_beacon_conf.bslot[slot];
+        vif = priv->beacon.bslot[slot];
         avp = (struct ath9k_htc_vif *)vif->drv_priv;
 
-        if (unlikely(test_bit(OP_SCANNING, &priv->op_flags))) {
+        if (unlikely(test_bit(ATH_OP_SCANNING, &common->op_flags))) {
                 spin_unlock_bh(&priv->beacon_lock);
                 return;
         }
@@ -423,8 +289,8 @@ void ath9k_htc_swba(struct ath9k_htc_priv *priv,
         int slot;
 
         if (swba->beacon_pending != 0) {
-                priv->cur_beacon_conf.bmiss_cnt++;
-                if (priv->cur_beacon_conf.bmiss_cnt > BSTUCK_THRESHOLD) {
+                priv->beacon.bmisscnt++;
+                if (priv->beacon.bmisscnt > BSTUCK_THRESHOLD) {
                         ath_dbg(common, BSTUCK, "Beacon stuck, HW reset\n");
                         ieee80211_queue_work(priv->hw,
                                              &priv->fatal_work);
@@ -432,16 +298,16 @@ void ath9k_htc_swba(struct ath9k_htc_priv *priv,
                 return;
         }
 
-        if (priv->cur_beacon_conf.bmiss_cnt) {
+        if (priv->beacon.bmisscnt) {
                 ath_dbg(common, BSTUCK,
                         "Resuming beacon xmit after %u misses\n",
-                        priv->cur_beacon_conf.bmiss_cnt);
-                priv->cur_beacon_conf.bmiss_cnt = 0;
+                        priv->beacon.bmisscnt);
+                priv->beacon.bmisscnt = 0;
         }
 
         slot = ath9k_htc_choose_bslot(priv, swba);
         spin_lock_bh(&priv->beacon_lock);
-        if (priv->cur_beacon_conf.bslot[slot] == NULL) {
+        if (priv->beacon.bslot[slot] == NULL) {
                 spin_unlock_bh(&priv->beacon_lock);
                 return;
         }
@@ -460,13 +326,13 @@ void ath9k_htc_assign_bslot(struct ath9k_htc_priv *priv,
 
         spin_lock_bh(&priv->beacon_lock);
         for (i = 0; i < ATH9K_HTC_MAX_BCN_VIF; i++) {
-                if (priv->cur_beacon_conf.bslot[i] == NULL) {
+                if (priv->beacon.bslot[i] == NULL) {
                         avp->bslot = i;
                         break;
                 }
         }
 
-        priv->cur_beacon_conf.bslot[avp->bslot] = vif;
+        priv->beacon.bslot[avp->bslot] = vif;
         spin_unlock_bh(&priv->beacon_lock);
 
         ath_dbg(common, CONFIG, "Added interface at beacon slot: %d\n",
@@ -480,7 +346,7 @@ void ath9k_htc_remove_bslot(struct ath9k_htc_priv *priv,
         struct ath9k_htc_vif *avp = (struct ath9k_htc_vif *)vif->drv_priv;
 
         spin_lock_bh(&priv->beacon_lock);
-        priv->cur_beacon_conf.bslot[avp->bslot] = NULL;
+        priv->beacon.bslot[avp->bslot] = NULL;
         spin_unlock_bh(&priv->beacon_lock);
 
         ath_dbg(common, CONFIG, "Removed interface at beacon slot: %d\n",
@@ -496,7 +362,7 @@ void ath9k_htc_set_tsfadjust(struct ath9k_htc_priv *priv,
 {
         struct ath_common *common = ath9k_hw_common(priv->ah);
         struct ath9k_htc_vif *avp = (struct ath9k_htc_vif *)vif->drv_priv;
-        struct htc_beacon_config *cur_conf = &priv->cur_beacon_conf;
+        struct ath_beacon_config *cur_conf = &priv->cur_beacon_conf;
         u64 tsfadjust;
 
         if (avp->bslot == 0)
@@ -528,7 +394,7 @@ static bool ath9k_htc_check_beacon_config(struct ath9k_htc_priv *priv,
                                           struct ieee80211_vif *vif)
 {
         struct ath_common *common = ath9k_hw_common(priv->ah);
-        struct htc_beacon_config *cur_conf = &priv->cur_beacon_conf;
+        struct ath_beacon_config *cur_conf = &priv->cur_beacon_conf;
         struct ieee80211_bss_conf *bss_conf = &vif->bss_conf;
         bool beacon_configured;
 
@@ -583,7 +449,7 @@ void ath9k_htc_beacon_config(struct ath9k_htc_priv *priv,
                              struct ieee80211_vif *vif)
 {
         struct ath_common *common = ath9k_hw_common(priv->ah);
-        struct htc_beacon_config *cur_conf = &priv->cur_beacon_conf;
+        struct ath_beacon_config *cur_conf = &priv->cur_beacon_conf;
         struct ieee80211_bss_conf *bss_conf = &vif->bss_conf;
         struct ath9k_htc_vif *avp = (struct ath9k_htc_vif *) vif->drv_priv;
 
@@ -619,7 +485,7 @@ void ath9k_htc_beacon_config(struct ath9k_htc_priv *priv,
 void ath9k_htc_beacon_reconfig(struct ath9k_htc_priv *priv)
 {
         struct ath_common *common = ath9k_hw_common(priv->ah);
-        struct htc_beacon_config *cur_conf = &priv->cur_beacon_conf;
+        struct ath_beacon_config *cur_conf = &priv->cur_beacon_conf;
 
         switch (priv->ah->opmode) {
         case NL80211_IFTYPE_STATION:
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index b22fb64403d9..8a3bd5fe3a54 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -405,8 +405,8 @@ static int ath9k_init_queues(struct ath9k_htc_priv *priv)
         for (i = 0; i < ARRAY_SIZE(priv->hwq_map); i++)
                 priv->hwq_map[i] = -1;
 
-        priv->beaconq = ath9k_hw_beaconq_setup(priv->ah);
-        if (priv->beaconq == -1) {
+        priv->beacon.beaconq = ath9k_hw_beaconq_setup(priv->ah);
+        if (priv->beacon.beaconq == -1) {
                 ath_err(common, "Unable to setup BEACON xmit queue\n");
                 goto err;
         }
@@ -459,8 +459,6 @@ static int ath9k_init_priv(struct ath9k_htc_priv *priv,
         struct ath_common *common;
         int i, ret = 0, csz = 0;
 
-        set_bit(OP_INVALID, &priv->op_flags);
-
         ah = kzalloc(sizeof(struct ath_hw), GFP_KERNEL);
         if (!ah)
                 return -ENOMEM;
@@ -485,6 +483,7 @@ static int ath9k_init_priv(struct ath9k_htc_priv *priv,
         common->priv = priv;
         common->debug_mask = ath9k_debug;
         common->btcoex_enabled = ath9k_htc_btcoex_enable == 1;
+        set_bit(ATH_OP_INVALID, &common->op_flags);
 
         spin_lock_init(&priv->beacon_lock);
         spin_lock_init(&priv->tx.tx_lock);
@@ -520,7 +519,8 @@ static int ath9k_init_priv(struct ath9k_htc_priv *priv,
                 goto err_queues;
 
         for (i = 0; i < ATH9K_HTC_MAX_BCN_VIF; i++)
-                priv->cur_beacon_conf.bslot[i] = NULL;
+                priv->beacon.bslot[i] = NULL;
+        priv->beacon.slottime = ATH9K_SLOT_TIME_9;
 
         ath9k_cmn_init_channels_rates(common);
         ath9k_cmn_init_crypto(ah);
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index 90dad4172b0a..f46cd0250e48 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -250,7 +250,7 @@ static int ath9k_htc_set_channel(struct ath9k_htc_priv *priv,
         u8 cmd_rsp;
         int ret;
 
-        if (test_bit(OP_INVALID, &priv->op_flags))
+        if (test_bit(ATH_OP_INVALID, &common->op_flags))
                 return -EIO;
 
         fastcc = !!(hw->conf.flags & IEEE80211_CONF_OFFCHANNEL);
@@ -304,7 +304,7 @@ static int ath9k_htc_set_channel(struct ath9k_htc_priv *priv,
 
         htc_start(priv->htc);
 
-        if (!test_bit(OP_SCANNING, &priv->op_flags) &&
+        if (!test_bit(ATH_OP_SCANNING, &common->op_flags) &&
             !(hw->conf.flags & IEEE80211_CONF_OFFCHANNEL))
                 ath9k_htc_vif_reconfig(priv);
 
@@ -748,7 +748,7 @@ void ath9k_htc_start_ani(struct ath9k_htc_priv *priv)
         common->ani.shortcal_timer = timestamp;
         common->ani.checkani_timer = timestamp;
 
-        set_bit(OP_ANI_RUNNING, &priv->op_flags);
+        set_bit(ATH_OP_ANI_RUN, &common->op_flags);
 
         ieee80211_queue_delayed_work(common->hw, &priv->ani_work,
                                      msecs_to_jiffies(ATH_ANI_POLLINTERVAL));
@@ -756,8 +756,9 @@ void ath9k_htc_start_ani(struct ath9k_htc_priv *priv)
 
 void ath9k_htc_stop_ani(struct ath9k_htc_priv *priv)
 {
+        struct ath_common *common = ath9k_hw_common(priv->ah);
         cancel_delayed_work_sync(&priv->ani_work);
-        clear_bit(OP_ANI_RUNNING, &priv->op_flags);
+        clear_bit(ATH_OP_ANI_RUN, &common->op_flags);
 }
 
 void ath9k_htc_ani_work(struct work_struct *work)
@@ -942,7 +943,7 @@ static int ath9k_htc_start(struct ieee80211_hw *hw)
                 ath_dbg(common, CONFIG,
                         "Failed to update capability in target\n");
 
-        clear_bit(OP_INVALID, &priv->op_flags);
+        clear_bit(ATH_OP_INVALID, &common->op_flags);
         htc_start(priv->htc);
 
         spin_lock_bh(&priv->tx.tx_lock);
@@ -971,7 +972,7 @@ static void ath9k_htc_stop(struct ieee80211_hw *hw)
 
         mutex_lock(&priv->mutex);
 
-        if (test_bit(OP_INVALID, &priv->op_flags)) {
+        if (test_bit(ATH_OP_INVALID, &common->op_flags)) {
                 ath_dbg(common, ANY, "Device not present\n");
                 mutex_unlock(&priv->mutex);
                 return;
@@ -1013,7 +1014,7 @@ static void ath9k_htc_stop(struct ieee80211_hw *hw)
         ath9k_htc_ps_restore(priv);
         ath9k_htc_setpower(priv, ATH9K_PM_FULL_SLEEP);
 
-        set_bit(OP_INVALID, &priv->op_flags);
+        set_bit(ATH_OP_INVALID, &common->op_flags);
 
         ath_dbg(common, CONFIG, "Driver halt\n");
         mutex_unlock(&priv->mutex);
@@ -1087,7 +1088,7 @@ static int ath9k_htc_add_interface(struct ieee80211_hw *hw,
         ath9k_htc_set_opmode(priv);
 
         if ((priv->ah->opmode == NL80211_IFTYPE_AP) &&
-            !test_bit(OP_ANI_RUNNING, &priv->op_flags)) {
+            !test_bit(ATH_OP_ANI_RUN, &common->op_flags)) {
                 ath9k_hw_set_tsfadjust(priv->ah, true);
                 ath9k_htc_start_ani(priv);
         }
@@ -1245,13 +1246,14 @@ static void ath9k_htc_configure_filter(struct ieee80211_hw *hw,
                                        u64 multicast)
 {
         struct ath9k_htc_priv *priv = hw->priv;
+        struct ath_common *common = ath9k_hw_common(priv->ah);
         u32 rfilt;
 
         mutex_lock(&priv->mutex);
         changed_flags &= SUPPORTED_FILTERS;
         *total_flags &= SUPPORTED_FILTERS;
 
-        if (test_bit(OP_INVALID, &priv->op_flags)) {
+        if (test_bit(ATH_OP_INVALID, &common->op_flags)) {
                 ath_dbg(ath9k_hw_common(priv->ah), ANY,
                         "Unable to configure filter on invalid state\n");
                 mutex_unlock(&priv->mutex);
@@ -1476,6 +1478,7 @@ static void ath9k_htc_bss_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
                 common->curaid = bss_conf->aid;
                 common->last_rssi = ATH_RSSI_DUMMY_MARKER;
                 memcpy(common->curbssid, bss_conf->bssid, ETH_ALEN);
+                set_bit(ATH_OP_PRIM_STA_VIF, &common->op_flags);
         }
 }
 
@@ -1497,6 +1500,7 @@ static void ath9k_htc_bss_info_changed(struct ieee80211_hw *hw,
         struct ath9k_htc_priv *priv = hw->priv;
         struct ath_hw *ah = priv->ah;
         struct ath_common *common = ath9k_hw_common(ah);
+        int slottime;
 
         mutex_lock(&priv->mutex);
         ath9k_htc_ps_wakeup(priv);
@@ -1508,6 +1512,9 @@ static void ath9k_htc_bss_info_changed(struct ieee80211_hw *hw,
                 bss_conf->assoc ?
                         priv->num_sta_assoc_vif++ : priv->num_sta_assoc_vif--;
 
+                if (!bss_conf->assoc)
+                        clear_bit(ATH_OP_PRIM_STA_VIF, &common->op_flags);
+
                 if (priv->ah->opmode == NL80211_IFTYPE_STATION) {
                         ath9k_htc_choose_set_bssid(priv);
                         if (bss_conf->assoc && (priv->num_sta_assoc_vif == 1))
@@ -1529,7 +1536,7 @@ static void ath9k_htc_bss_info_changed(struct ieee80211_hw *hw,
                 ath_dbg(common, CONFIG, "Beacon enabled for BSS: %pM\n",
                         bss_conf->bssid);
                 ath9k_htc_set_tsfadjust(priv, vif);
-                set_bit(OP_ENABLE_BEACON, &priv->op_flags);
+                priv->cur_beacon_conf.enable_beacon = 1;
                 ath9k_htc_beacon_config(priv, vif);
         }
 
@@ -1543,7 +1550,7 @@ static void ath9k_htc_bss_info_changed(struct ieee80211_hw *hw,
                         ath_dbg(common, CONFIG,
                                 "Beacon disabled for BSS: %pM\n",
                                 bss_conf->bssid);
-                        clear_bit(OP_ENABLE_BEACON, &priv->op_flags);
+                        priv->cur_beacon_conf.enable_beacon = 0;
                         ath9k_htc_beacon_config(priv, vif);
                 }
         }
@@ -1569,11 +1576,21 @@ static void ath9k_htc_bss_info_changed(struct ieee80211_hw *hw,
 
         if (changed & BSS_CHANGED_ERP_SLOT) {
                 if (bss_conf->use_short_slot)
-                        ah->slottime = 9;
+                        slottime = 9;
                 else
-                        ah->slottime = 20;
-
-                ath9k_hw_init_global_settings(ah);
+                        slottime = 20;
+                if (vif->type == NL80211_IFTYPE_AP) {
+                        /*
+                         * Defer update, so that connected stations can adjust
+                         * their settings at the same time.
+                         * See beacon.c for more details
+                         */
+                        priv->beacon.slottime = slottime;
+                        priv->beacon.updateslot = UPDATE;
+                } else {
+                        ah->slottime = slottime;
+                        ath9k_hw_init_global_settings(ah);
+                }
         }
 
         if (changed & BSS_CHANGED_HT)
@@ -1670,10 +1687,11 @@ static int ath9k_htc_ampdu_action(struct ieee80211_hw *hw,
 static void ath9k_htc_sw_scan_start(struct ieee80211_hw *hw)
 {
         struct ath9k_htc_priv *priv = hw->priv;
+        struct ath_common *common = ath9k_hw_common(priv->ah);
 
         mutex_lock(&priv->mutex);
         spin_lock_bh(&priv->beacon_lock);
-        set_bit(OP_SCANNING, &priv->op_flags);
+        set_bit(ATH_OP_SCANNING, &common->op_flags);
         spin_unlock_bh(&priv->beacon_lock);
         cancel_work_sync(&priv->ps_work);
         ath9k_htc_stop_ani(priv);
@@ -1683,10 +1701,11 @@ static void ath9k_htc_sw_scan_start(struct ieee80211_hw *hw)
 static void ath9k_htc_sw_scan_complete(struct ieee80211_hw *hw)
 {
         struct ath9k_htc_priv *priv = hw->priv;
+        struct ath_common *common = ath9k_hw_common(priv->ah);
 
         mutex_lock(&priv->mutex);
         spin_lock_bh(&priv->beacon_lock);
-        clear_bit(OP_SCANNING, &priv->op_flags);
+        clear_bit(ATH_OP_SCANNING, &common->op_flags);
         spin_unlock_bh(&priv->beacon_lock);
         ath9k_htc_ps_wakeup(priv);
         ath9k_htc_vif_reconfig(priv);
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index 47b2bfcd8223..e8149e3dbdd5 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -924,9 +924,10 @@ static void ath9k_htc_opmode_init(struct ath9k_htc_priv *priv)
 
 void ath9k_host_rx_init(struct ath9k_htc_priv *priv)
 {
+        struct ath_common *common = ath9k_hw_common(priv->ah);
         ath9k_hw_rxena(priv->ah);
         ath9k_htc_opmode_init(priv);
-        ath9k_hw_startpcureceive(priv->ah, test_bit(OP_SCANNING, &priv->op_flags));
+        ath9k_hw_startpcureceive(priv->ah, test_bit(ATH_OP_SCANNING, &common->op_flags));
 }
 
 static inline void convert_htc_flag(struct ath_rx_status *rx_stats,
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 2509c2ff0828..0992f7c70e1a 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -882,7 +882,7 @@ static void ath9k_hw_init_interrupt_masks(struct ath_hw *ah,
                 AR_IMR_RXORN |
                 AR_IMR_BCNMISC;
 
-        if (AR_SREV_9340(ah) || AR_SREV_9550(ah))
+        if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah))
                 sync_default &= ~AR_INTR_SYNC_HOST1_FATAL;
 
         if (AR_SREV_9300_20_OR_LATER(ah)) {
@@ -3048,6 +3048,7 @@ static struct {
         { AR_SREV_VERSION_9462,         "9462" },
         { AR_SREV_VERSION_9550,         "9550" },
         { AR_SREV_VERSION_9565,         "9565" },
+        { AR_SREV_VERSION_9531,         "9531" },
 };
 
 /* For devices with external radios */
diff --git a/drivers/net/wireless/ath/ath9k/link.c b/drivers/net/wireless/ath/ath9k/link.c
index 30dcef5aba10..72a715fe8f24 100644
--- a/drivers/net/wireless/ath/ath9k/link.c
+++ b/drivers/net/wireless/ath/ath9k/link.c
@@ -115,13 +115,14 @@ void ath_hw_pll_work(struct work_struct *work)
         u32 pll_sqsum;
         struct ath_softc *sc = container_of(work, struct ath_softc,
                                             hw_pll_work.work);
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         /*
          * ensure that the PLL WAR is executed only
          * after the STA is associated (or) if the
          * beaconing had started in interfaces that
          * uses beacons.
          */
-        if (!test_bit(SC_OP_BEACONS, &sc->sc_flags))
+        if (!test_bit(ATH_OP_BEACONS, &common->op_flags))
                 return;
 
         if (sc->tx99_state)
@@ -414,7 +415,7 @@ void ath_start_ani(struct ath_softc *sc)
         unsigned long timestamp = jiffies_to_msecs(jiffies);
 
         if (common->disable_ani ||
-            !test_bit(SC_OP_ANI_RUN, &sc->sc_flags) ||
+            !test_bit(ATH_OP_ANI_RUN, &common->op_flags) ||
             (sc->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL))
                 return;
 
@@ -438,6 +439,7 @@ void ath_stop_ani(struct ath_softc *sc)
 void ath_check_ani(struct ath_softc *sc)
 {
         struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath_beacon_config *cur_conf = &sc->cur_beacon_conf;
 
         /*
@@ -453,23 +455,23 @@ void ath_check_ani(struct ath_softc *sc)
                          * Disable ANI only when there are no
                          * associated stations.
                          */
-                        if (!test_bit(SC_OP_PRIM_STA_VIF, &sc->sc_flags))
+                        if (!test_bit(ATH_OP_PRIM_STA_VIF, &common->op_flags))
                                 goto stop_ani;
                 }
         } else if (ah->opmode == NL80211_IFTYPE_STATION) {
-                if (!test_bit(SC_OP_PRIM_STA_VIF, &sc->sc_flags))
+                if (!test_bit(ATH_OP_PRIM_STA_VIF, &common->op_flags))
                         goto stop_ani;
         }
 
-        if (!test_bit(SC_OP_ANI_RUN, &sc->sc_flags)) {
-                set_bit(SC_OP_ANI_RUN, &sc->sc_flags);
+        if (!test_bit(ATH_OP_ANI_RUN, &common->op_flags)) {
+                set_bit(ATH_OP_ANI_RUN, &common->op_flags);
                 ath_start_ani(sc);
         }
 
         return;
 
 stop_ani:
-        clear_bit(SC_OP_ANI_RUN, &sc->sc_flags);
+        clear_bit(ATH_OP_ANI_RUN, &common->op_flags);
         ath_stop_ani(sc);
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 5f727588ca27..51ce36f108f9 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -827,7 +827,7 @@ void ath9k_hw_enable_interrupts(struct ath_hw *ah)
                 return;
         }
 
-        if (AR_SREV_9340(ah) || AR_SREV_9550(ah))
+        if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah))
                 sync_default &= ~AR_INTR_SYNC_HOST1_FATAL;
 
         async_mask = AR_INTR_MAC_IRQ;
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 42a18037004e..d69853b848ce 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -229,16 +229,16 @@ static bool ath_complete_reset(struct ath_softc *sc, bool start)
         ath9k_cmn_update_txpow(ah, sc->curtxpow,
                                sc->config.txpowlimit, &sc->curtxpow);
 
-        clear_bit(SC_OP_HW_RESET, &sc->sc_flags);
+        clear_bit(ATH_OP_HW_RESET, &common->op_flags);
         ath9k_hw_set_interrupts(ah);
         ath9k_hw_enable_interrupts(ah);
 
         if (!(sc->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL) && start) {
-                if (!test_bit(SC_OP_BEACONS, &sc->sc_flags))
+                if (!test_bit(ATH_OP_BEACONS, &common->op_flags))
                         goto work;
 
                 if (ah->opmode == NL80211_IFTYPE_STATION &&
-                    test_bit(SC_OP_PRIM_STA_VIF, &sc->sc_flags)) {
+                    test_bit(ATH_OP_PRIM_STA_VIF, &common->op_flags)) {
                         spin_lock_irqsave(&sc->sc_pm_lock, flags);
                         sc->ps_flags |= PS_BEACON_SYNC | PS_WAIT_FOR_BEACON;
                         spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
@@ -336,7 +336,7 @@ static int ath_set_channel(struct ath_softc *sc, struct cfg80211_chan_def *chand
         int old_pos = -1;
         int r;
 
-        if (test_bit(SC_OP_INVALID, &sc->sc_flags))
+        if (test_bit(ATH_OP_INVALID, &common->op_flags))
                 return -EIO;
 
         offchannel = !!(hw->conf.flags & IEEE80211_CONF_OFFCHANNEL);
@@ -402,7 +402,7 @@ static int ath_set_channel(struct ath_softc *sc, struct cfg80211_chan_def *chand
                         chan->center_freq);
         } else {
                 /* perform spectral scan if requested. */
-                if (test_bit(SC_OP_SCANNING, &sc->sc_flags) &&
+                if (test_bit(ATH_OP_SCANNING, &common->op_flags) &&
                         sc->spectral_mode == SPECTRAL_CHANSCAN)
                         ath9k_spectral_scan_trigger(hw);
         }
@@ -566,6 +566,7 @@ irqreturn_t ath_isr(int irq, void *dev)
 
         struct ath_softc *sc = dev;
         struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
         enum ath9k_int status;
         u32 sync_cause = 0;
         bool sched = false;
@@ -575,7 +576,7 @@ irqreturn_t ath_isr(int irq, void *dev)
          * touch anything. Note this can happen early
          * on if the IRQ is shared.
          */
-        if (test_bit(SC_OP_INVALID, &sc->sc_flags))
+        if (test_bit(ATH_OP_INVALID, &common->op_flags))
                 return IRQ_NONE;
 
         /* shared irq, not for us */
@@ -583,7 +584,7 @@ irqreturn_t ath_isr(int irq, void *dev)
         if (!ath9k_hw_intrpend(ah))
                 return IRQ_NONE;
 
-        if (test_bit(SC_OP_HW_RESET, &sc->sc_flags)) {
+        if (test_bit(ATH_OP_HW_RESET, &common->op_flags)) {
                 ath9k_hw_kill_interrupts(ah);
                 return IRQ_HANDLED;
         }
@@ -684,10 +685,11 @@ int ath_reset(struct ath_softc *sc)
 
 void ath9k_queue_reset(struct ath_softc *sc, enum ath_reset_type type)
 {
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
 #ifdef CONFIG_ATH9K_DEBUGFS
         RESET_STAT_INC(sc, type);
 #endif
-        set_bit(SC_OP_HW_RESET, &sc->sc_flags);
+        set_bit(ATH_OP_HW_RESET, &common->op_flags);
         ieee80211_queue_work(sc->hw, &sc->hw_reset_work);
 }
 
@@ -768,7 +770,7 @@ static int ath9k_start(struct ieee80211_hw *hw)
 
         ath_mci_enable(sc);
 
-        clear_bit(SC_OP_INVALID, &sc->sc_flags);
+        clear_bit(ATH_OP_INVALID, &common->op_flags);
         sc->sc_ah->is_monitoring = false;
 
         if (!ath_complete_reset(sc, false))
@@ -885,7 +887,7 @@ static void ath9k_stop(struct ieee80211_hw *hw)
 
         ath_cancel_work(sc);
 
-        if (test_bit(SC_OP_INVALID, &sc->sc_flags)) {
+        if (test_bit(ATH_OP_INVALID, &common->op_flags)) {
                 ath_dbg(common, ANY, "Device not present\n");
                 mutex_unlock(&sc->mutex);
                 return;
@@ -940,7 +942,7 @@ static void ath9k_stop(struct ieee80211_hw *hw)
 
         ath9k_ps_restore(sc);
 
-        set_bit(SC_OP_INVALID, &sc->sc_flags);
+        set_bit(ATH_OP_INVALID, &common->op_flags);
         sc->ps_idle = prev_idle;
 
         mutex_unlock(&sc->mutex);
@@ -1081,7 +1083,7 @@ static void ath9k_calculate_summary_state(struct ieee80211_hw *hw,
          */
         if (ah->opmode == NL80211_IFTYPE_STATION &&
             old_opmode == NL80211_IFTYPE_AP &&
-            test_bit(SC_OP_PRIM_STA_VIF, &sc->sc_flags)) {
+            test_bit(ATH_OP_PRIM_STA_VIF, &common->op_flags)) {
                 ieee80211_iterate_active_interfaces_atomic(
                         sc->hw, IEEE80211_IFACE_ITER_RESUME_ALL,
                         ath9k_sta_vif_iter, sc);
@@ -1590,7 +1592,7 @@ static void ath9k_set_assoc_state(struct ath_softc *sc,
         struct ieee80211_bss_conf *bss_conf = &vif->bss_conf;
         unsigned long flags;
 
-        set_bit(SC_OP_PRIM_STA_VIF, &sc->sc_flags);
+        set_bit(ATH_OP_PRIM_STA_VIF, &common->op_flags);
         avp->primary_sta_vif = true;
 
         /*
@@ -1625,8 +1627,9 @@ static void ath9k_bss_assoc_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
 {
         struct ath_softc *sc = data;
         struct ieee80211_bss_conf *bss_conf = &vif->bss_conf;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
 
-        if (test_bit(SC_OP_PRIM_STA_VIF, &sc->sc_flags))
+        if (test_bit(ATH_OP_PRIM_STA_VIF, &common->op_flags))
                 return;
 
         if (bss_conf->assoc)
@@ -1657,18 +1660,18 @@ static void ath9k_bss_info_changed(struct ieee80211_hw *hw,
                         bss_conf->bssid, bss_conf->assoc);
 
                 if (avp->primary_sta_vif && !bss_conf->assoc) {
-                        clear_bit(SC_OP_PRIM_STA_VIF, &sc->sc_flags);
+                        clear_bit(ATH_OP_PRIM_STA_VIF, &common->op_flags);
                         avp->primary_sta_vif = false;
 
                         if (ah->opmode == NL80211_IFTYPE_STATION)
-                                clear_bit(SC_OP_BEACONS, &sc->sc_flags);
+                                clear_bit(ATH_OP_BEACONS, &common->op_flags);
                 }
 
                 ieee80211_iterate_active_interfaces_atomic(
                         sc->hw, IEEE80211_IFACE_ITER_RESUME_ALL,
                         ath9k_bss_assoc_iter, sc);
 
-                if (!test_bit(SC_OP_PRIM_STA_VIF, &sc->sc_flags) &&
+                if (!test_bit(ATH_OP_PRIM_STA_VIF, &common->op_flags) &&
                     ah->opmode == NL80211_IFTYPE_STATION) {
                         memset(common->curbssid, 0, ETH_ALEN);
                         common->curaid = 0;
@@ -1897,7 +1900,7 @@ static void ath9k_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
                 return;
         }
 
-        if (test_bit(SC_OP_INVALID, &sc->sc_flags)) {
+        if (test_bit(ATH_OP_INVALID, &common->op_flags)) {
                 ath_dbg(common, ANY, "Device not present\n");
                 mutex_unlock(&sc->mutex);
                 return;
@@ -2070,13 +2073,15 @@ static int ath9k_get_antenna(struct ieee80211_hw *hw, u32 *tx_ant, u32 *rx_ant)
 static void ath9k_sw_scan_start(struct ieee80211_hw *hw)
 {
         struct ath_softc *sc = hw->priv;
-        set_bit(SC_OP_SCANNING, &sc->sc_flags);
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        set_bit(ATH_OP_SCANNING, &common->op_flags);
 }
 
 static void ath9k_sw_scan_complete(struct ieee80211_hw *hw)
 {
         struct ath_softc *sc = hw->priv;
-        clear_bit(SC_OP_SCANNING, &sc->sc_flags);
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        clear_bit(ATH_OP_SCANNING, &common->op_flags);
 }
 
 static void ath9k_channel_switch_beacon(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/ath/ath9k/mci.c b/drivers/net/wireless/ath/ath9k/mci.c
index 71799fcade54..a0dbcc412384 100644
--- a/drivers/net/wireless/ath/ath9k/mci.c
+++ b/drivers/net/wireless/ath/ath9k/mci.c
@@ -555,7 +555,7 @@ void ath_mci_intr(struct ath_softc *sc)
                 mci_int_rxmsg &= ~AR_MCI_INTERRUPT_RX_MSG_GPM;
 
                 while (more_data == MCI_GPM_MORE) {
-                        if (test_bit(SC_OP_HW_RESET, &sc->sc_flags))
+                        if (test_bit(ATH_OP_HW_RESET, &common->op_flags))
                                 return;
 
                         pgpm = mci->gpm_buf.bf_addr;
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index 55724b02316b..25304adece57 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -784,6 +784,7 @@ static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 {
         struct ath_softc *sc;
         struct ieee80211_hw *hw;
+        struct ath_common *common;
         u8 csz;
         u32 val;
         int ret = 0;
@@ -858,9 +859,6 @@ static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         sc->mem = pcim_iomap_table(pdev)[0];
         sc->driver_data = id->driver_data;
 
-        /* Will be cleared in ath9k_start() */
-        set_bit(SC_OP_INVALID, &sc->sc_flags);
-
         ret = request_irq(pdev->irq, ath_isr, IRQF_SHARED, "ath9k", sc);
         if (ret) {
                 dev_err(&pdev->dev, "request_irq failed\n");
@@ -879,6 +877,10 @@ static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         wiphy_info(hw->wiphy, "%s mem=0x%lx, irq=%d\n",
                    hw_name, (unsigned long)sc->mem, pdev->irq);
 
+        /* Will be cleared in ath9k_start() */
+        common = ath9k_hw_common(sc->sc_ah);
+        set_bit(ATH_OP_INVALID, &common->op_flags);
+
         return 0;
 
 err_init:
diff --git a/drivers/net/wireless/ath/ath9k/tx99.c b/drivers/net/wireless/ath/ath9k/tx99.c
index b686a7498450..a65cfb91adca 100644
--- a/drivers/net/wireless/ath/ath9k/tx99.c
+++ b/drivers/net/wireless/ath/ath9k/tx99.c
@@ -108,7 +108,7 @@ static int ath9k_tx99_init(struct ath_softc *sc)
         struct ath_tx_control txctl;
         int r;
 
-        if (test_bit(SC_OP_INVALID, &sc->sc_flags)) {
+        if (test_bit(ATH_OP_INVALID, &common->op_flags)) {
                 ath_err(common,
                         "driver is in invalid state unable to use TX99");
                 return -EINVAL;
diff --git a/drivers/net/wireless/ath/ath9k/wow.c b/drivers/net/wireless/ath/ath9k/wow.c
index 1b3230fa3651..2879887f5691 100644
--- a/drivers/net/wireless/ath/ath9k/wow.c
+++ b/drivers/net/wireless/ath/ath9k/wow.c
@@ -198,7 +198,7 @@ int ath9k_suspend(struct ieee80211_hw *hw,
         ath_cancel_work(sc);
         ath_stop_ani(sc);
 
-        if (test_bit(SC_OP_INVALID, &sc->sc_flags)) {
+        if (test_bit(ATH_OP_INVALID, &common->op_flags)) {
                 ath_dbg(common, ANY, "Device not present\n");
                 ret = -EINVAL;
                 goto fail_wow;
@@ -224,7 +224,7 @@ int ath9k_suspend(struct ieee80211_hw *hw,
          * STA.
          */
 
-        if (!test_bit(SC_OP_PRIM_STA_VIF, &sc->sc_flags)) {
+        if (!test_bit(ATH_OP_PRIM_STA_VIF, &common->op_flags)) {
                 ath_dbg(common, WOW, "None of the STA vifs are associated\n");
                 ret = 1;
                 goto fail_wow;
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index fafacfed44ea..f76e6b9bb8e6 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1699,7 +1699,7 @@ int ath_cabq_update(struct ath_softc *sc)
 
         ath9k_hw_get_txq_props(sc->sc_ah, qnum, &qi);
 
-        qi.tqi_readyTime = (cur_conf->beacon_interval *
+        qi.tqi_readyTime = (TU_TO_USEC(cur_conf->beacon_interval) *
                             ATH_CABQ_READY_TIME) / 100;
         ath_txq_update(sc, qnum, &qi);
 
@@ -1769,7 +1769,7 @@ bool ath_drain_all_txq(struct ath_softc *sc)
         int i;
         u32 npend = 0;
 
-        if (test_bit(SC_OP_INVALID, &sc->sc_flags))
+        if (test_bit(ATH_OP_INVALID, &common->op_flags))
                 return true;
 
         ath9k_hw_abort_tx_dma(ah);
@@ -1817,11 +1817,12 @@ void ath_tx_cleanupq(struct ath_softc *sc, struct ath_txq *txq)
  */
 void ath_txq_schedule(struct ath_softc *sc, struct ath_txq *txq)
 {
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath_atx_ac *ac, *last_ac;
         struct ath_atx_tid *tid, *last_tid;
         bool sent = false;
 
-        if (test_bit(SC_OP_HW_RESET, &sc->sc_flags) ||
+        if (test_bit(ATH_OP_HW_RESET, &common->op_flags) ||
             list_empty(&txq->axq_acq))
                 return;
 
@@ -2471,7 +2472,7 @@ static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
 
         ath_txq_lock(sc, txq);
         for (;;) {
-                if (test_bit(SC_OP_HW_RESET, &sc->sc_flags))
+                if (test_bit(ATH_OP_HW_RESET, &common->op_flags))
                         break;
 
                 if (list_empty(&txq->axq_q)) {
@@ -2554,7 +2555,7 @@ void ath_tx_edma_tasklet(struct ath_softc *sc)
         int status;
 
         for (;;) {
-                if (test_bit(SC_OP_HW_RESET, &sc->sc_flags))
+                if (test_bit(ATH_OP_HW_RESET, &common->op_flags))
                         break;
 
                 status = ath9k_hw_txprocdesc(ah, NULL, (void *)&ts);
diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c
index 743930357061..4806a49cb61b 100644
--- a/drivers/net/wireless/ath/wil6210/cfg80211.c
+++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
@@ -179,7 +179,7 @@ static int wil_cfg80211_get_station(struct wiphy *wiphy,
 
         int cid = wil_find_cid(wil, mac);
 
-        wil_info(wil, "%s(%pM) CID %d\n", __func__, mac, cid);
+        wil_dbg_misc(wil, "%s(%pM) CID %d\n", __func__, mac, cid);
         if (cid < 0)
                 return cid;
 
@@ -218,7 +218,7 @@ static int wil_cfg80211_dump_station(struct wiphy *wiphy,
                 return -ENOENT;
 
         memcpy(mac, wil->sta[cid].addr, ETH_ALEN);
-        wil_info(wil, "%s(%pM) CID %d\n", __func__, mac, cid);
+        wil_dbg_misc(wil, "%s(%pM) CID %d\n", __func__, mac, cid);
 
         rc = wil_cid_fill_sinfo(wil, cid, sinfo);
 
@@ -265,6 +265,7 @@ static int wil_cfg80211_scan(struct wiphy *wiphy,
                 u16 chnl[4];
         } __packed cmd;
         uint i, n;
+        int rc;
 
         if (wil->scan_request) {
                 wil_err(wil, "Already scanning\n");
@@ -282,7 +283,7 @@ static int wil_cfg80211_scan(struct wiphy *wiphy,
 
         /* FW don't support scan after connection attempt */
         if (test_bit(wil_status_dontscan, &wil->status)) {
-                wil_err(wil, "Scan after connect attempt not supported\n");
+                wil_err(wil, "Can't scan now\n");
                 return -EBUSY;
         }
 
@@ -305,8 +306,13 @@ static int wil_cfg80211_scan(struct wiphy *wiphy,
                              request->channels[i]->center_freq);
         }
 
-        return wmi_send(wil, WMI_START_SCAN_CMDID, &cmd, sizeof(cmd.cmd) +
+        rc = wmi_send(wil, WMI_START_SCAN_CMDID, &cmd, sizeof(cmd.cmd) +
                         cmd.cmd.num_channels * sizeof(cmd.cmd.channel_list[0]));
+
+        if (rc)
+                wil->scan_request = NULL;
+
+        return rc;
 }
 
 static int wil_cfg80211_connect(struct wiphy *wiphy,
@@ -321,6 +327,10 @@ static int wil_cfg80211_connect(struct wiphy *wiphy,
         int ch;
         int rc = 0;
 
+        if (test_bit(wil_status_fwconnecting, &wil->status) ||
+            test_bit(wil_status_fwconnected, &wil->status))
+                return -EALREADY;
+
         bss = cfg80211_get_bss(wiphy, sme->channel, sme->bssid,
                                sme->ssid, sme->ssid_len,
                                WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
@@ -402,10 +412,7 @@ static int wil_cfg80211_connect(struct wiphy *wiphy,
 
         memcpy(conn.bssid, bss->bssid, ETH_ALEN);
         memcpy(conn.dst_mac, bss->bssid, ETH_ALEN);
-        /*
-         * FW don't support scan after connection attempt
-         */
-        set_bit(wil_status_dontscan, &wil->status);
+
         set_bit(wil_status_fwconnecting, &wil->status);
 
         rc = wmi_send(wil, WMI_CONNECT_CMDID, &conn, sizeof(conn));
@@ -414,7 +421,6 @@ static int wil_cfg80211_connect(struct wiphy *wiphy,
                 mod_timer(&wil->connect_timer,
                           jiffies + msecs_to_jiffies(2000));
         } else {
-                clear_bit(wil_status_dontscan, &wil->status);
                 clear_bit(wil_status_fwconnecting, &wil->status);
         }
 
@@ -603,18 +609,20 @@ static int wil_cfg80211_start_ap(struct wiphy *wiphy,
         if (wil_fix_bcon(wil, bcon))
                 wil_dbg_misc(wil, "Fixed bcon\n");
 
+        mutex_lock(&wil->mutex);
+
         rc = wil_reset(wil);
         if (rc)
-                return rc;
+                goto out;
 
         /* Rx VRING. */
         rc = wil_rx_init(wil);
         if (rc)
-                return rc;
+                goto out;
 
         rc = wmi_set_ssid(wil, info->ssid_len, info->ssid);
         if (rc)
-                return rc;
+                goto out;
 
         /* MAC address - pre-requisite for other commands */
         wmi_set_mac_address(wil, ndev->dev_addr);
@@ -638,11 +646,13 @@ static int wil_cfg80211_start_ap(struct wiphy *wiphy,
         rc = wmi_pcp_start(wil, info->beacon_interval, wmi_nettype,
                            channel->hw_value);
         if (rc)
-                return rc;
+                goto out;
 
 
         netif_carrier_on(ndev);
 
+out:
+        mutex_unlock(&wil->mutex);
         return rc;
 }
 
@@ -652,8 +662,11 @@ static int wil_cfg80211_stop_ap(struct wiphy *wiphy,
         int rc = 0;
         struct wil6210_priv *wil = wiphy_to_wil(wiphy);
 
+        mutex_lock(&wil->mutex);
+
         rc = wmi_pcp_stop(wil);
 
+        mutex_unlock(&wil->mutex);
         return rc;
 }
 
@@ -661,7 +674,11 @@ static int wil_cfg80211_del_station(struct wiphy *wiphy,
                                     struct net_device *dev, u8 *mac)
 {
         struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+
+        mutex_lock(&wil->mutex);
         wil6210_disconnect(wil, mac);
+        mutex_unlock(&wil->mutex);
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
index 1d09a4b0a0f4..ecdabe4adec3 100644
--- a/drivers/net/wireless/ath/wil6210/debugfs.c
+++ b/drivers/net/wireless/ath/wil6210/debugfs.c
@@ -398,6 +398,44 @@ static const struct file_operations fops_reset = {
         .open  = simple_open,
 };
 
+static void wil_seq_hexdump(struct seq_file *s, void *p, int len,
+                            const char *prefix)
+{
+        char printbuf[16 * 3 + 2];
+        int i = 0;
+        while (i < len) {
+                int l = min(len - i, 16);
+                hex_dump_to_buffer(p + i, l, 16, 1, printbuf,
+                                   sizeof(printbuf), false);
+                seq_printf(s, "%s%s\n", prefix, printbuf);
+                i += l;
+        }
+}
+
+static void wil_seq_print_skb(struct seq_file *s, struct sk_buff *skb)
+{
+        int i = 0;
+        int len = skb_headlen(skb);
+        void *p = skb->data;
+        int nr_frags = skb_shinfo(skb)->nr_frags;
+
+        seq_printf(s, "    len = %d\n", len);
+        wil_seq_hexdump(s, p, len, "      : ");
+
+        if (nr_frags) {
+                seq_printf(s, "    nr_frags = %d\n", nr_frags);
+                for (i = 0; i < nr_frags; i++) {
+                        const struct skb_frag_struct *frag =
+                                        &skb_shinfo(skb)->frags[i];
+
+                        len = skb_frag_size(frag);
+                        p = skb_frag_address_safe(frag);
+                        seq_printf(s, "    [%2d] : len = %d\n", i, len);
+                        wil_seq_hexdump(s, p, len, "      : ");
+                }
+        }
+}
+
 /*---------Tx/Rx descriptor------------*/
 static int wil_txdesc_debugfs_show(struct seq_file *s, void *data)
 {
@@ -438,26 +476,9 @@ static int wil_txdesc_debugfs_show(struct seq_file *s, void *data)
                 seq_printf(s, "  SKB = %p\n", skb);
 
                 if (skb) {
-                        char printbuf[16 * 3 + 2];
-                        int i = 0;
-                        int len = le16_to_cpu(d->dma.length);
-                        void *p = skb->data;
-
-                        if (len != skb_headlen(skb)) {
-                                seq_printf(s, "!!! len: desc = %d skb = %d\n",
-                                           len, skb_headlen(skb));
-                                len = min_t(int, len, skb_headlen(skb));
-                        }
-
-                        seq_printf(s, "    len = %d\n", len);
-
-                        while (i < len) {
-                                int l = min(len - i, 16);
-                                hex_dump_to_buffer(p + i, l, 16, 1, printbuf,
-                                                   sizeof(printbuf), false);
-                                seq_printf(s, "      : %s\n", printbuf);
-                                i += l;
-                        }
+                        skb_get(skb);
+                        wil_seq_print_skb(s, skb);
+                        kfree_skb(skb);
                 }
                 seq_printf(s, "}\n");
         } else {
@@ -631,7 +652,8 @@ static int wil_sta_debugfs_show(struct seq_file *s, void *data)
                         status = "connected";
                         break;
                 }
-                seq_printf(s, "[%d] %pM %s\n", i, p->addr, status);
+                seq_printf(s, "[%d] %pM %s%s\n", i, p->addr, status,
+                           (p->data_port_open ? " data_port_open" : ""));
 
                 if (p->status == wil_sta_connected) {
                         for (tid = 0; tid < WIL_STA_TID_NUM; tid++) {
diff --git a/drivers/net/wireless/ath/wil6210/interrupt.c b/drivers/net/wireless/ath/wil6210/interrupt.c
index 10919f95a83c..5824cd41e4ba 100644
--- a/drivers/net/wireless/ath/wil6210/interrupt.c
+++ b/drivers/net/wireless/ath/wil6210/interrupt.c
@@ -195,8 +195,12 @@ static irqreturn_t wil6210_irq_rx(int irq, void *cookie)
         if (isr & BIT_DMA_EP_RX_ICR_RX_DONE) {
                 wil_dbg_irq(wil, "RX done\n");
                 isr &= ~BIT_DMA_EP_RX_ICR_RX_DONE;
-                wil_dbg_txrx(wil, "NAPI schedule\n");
-                napi_schedule(&wil->napi_rx);
+                if (test_bit(wil_status_reset_done, &wil->status)) {
+                        wil_dbg_txrx(wil, "NAPI(Rx) schedule\n");
+                        napi_schedule(&wil->napi_rx);
+                } else {
+                        wil_err(wil, "Got Rx interrupt while in reset\n");
+                }
         }
 
         if (isr)
@@ -226,10 +230,15 @@ static irqreturn_t wil6210_irq_tx(int irq, void *cookie)
 
         if (isr & BIT_DMA_EP_TX_ICR_TX_DONE) {
                 wil_dbg_irq(wil, "TX done\n");
-                napi_schedule(&wil->napi_tx);
                 isr &= ~BIT_DMA_EP_TX_ICR_TX_DONE;
                 /* clear also all VRING interrupts */
                 isr &= ~(BIT(25) - 1UL);
+                if (test_bit(wil_status_reset_done, &wil->status)) {
+                        wil_dbg_txrx(wil, "NAPI(Tx) schedule\n");
+                        napi_schedule(&wil->napi_tx);
+                } else {
+                        wil_err(wil, "Got Tx interrupt while in reset\n");
+                }
         }
 
         if (isr)
@@ -319,6 +328,7 @@ static irqreturn_t wil6210_irq_misc_thread(int irq, void *cookie)
         if (isr & ISR_MISC_FW_ERROR) {
                 wil_notify_fw_error(wil);
                 isr &= ~ISR_MISC_FW_ERROR;
+                wil_fw_error_recovery(wil);
         }
 
         if (isr & ISR_MISC_MBOX_EVT) {
@@ -493,6 +503,23 @@ free0:
 
         return rc;
 }
+/* can't use wil_ioread32_and_clear because ICC value is not ser yet */
+static inline void wil_clear32(void __iomem *addr)
+{
+        u32 x = ioread32(addr);
+
+        iowrite32(x, addr);
+}
+
+void wil6210_clear_irq(struct wil6210_priv *wil)
+{
+        wil_clear32(wil->csr + HOSTADDR(RGF_DMA_EP_RX_ICR) +
+                    offsetof(struct RGF_ICR, ICR));
+        wil_clear32(wil->csr + HOSTADDR(RGF_DMA_EP_TX_ICR) +
+                    offsetof(struct RGF_ICR, ICR));
+        wil_clear32(wil->csr + HOSTADDR(RGF_DMA_EP_MISC_ICR) +
+                    offsetof(struct RGF_ICR, ICR));
+}
 
 int wil6210_init_irq(struct wil6210_priv *wil, int irq)
 {
diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c
index 41c362dee032..95f4efe9ef37 100644
--- a/drivers/net/wireless/ath/wil6210/main.c
+++ b/drivers/net/wireless/ath/wil6210/main.c
@@ -21,6 +21,10 @@
 #include "wil6210.h"
 #include "txrx.h"
 
+static bool no_fw_recovery;
+module_param(no_fw_recovery, bool, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(no_fw_recovery, " disable FW error recovery");
+
 /*
  * Due to a hardware issue,
  * one has to read/write to/from NIC in 32-bit chunks;
@@ -59,6 +63,7 @@ static void wil_disconnect_cid(struct wil6210_priv *wil, int cid)
         uint i;
         struct wil_sta_info *sta = &wil->sta[cid];
 
+        sta->data_port_open = false;
         if (sta->status != wil_sta_unused) {
                 wmi_disconnect_sta(wil, sta->addr, WLAN_REASON_DEAUTH_LEAVING);
                 sta->status = wil_sta_unused;
@@ -112,8 +117,6 @@ static void _wil6210_disconnect(struct wil6210_priv *wil, void *bssid)
                                                 GFP_KERNEL);
                 }
                 clear_bit(wil_status_fwconnecting, &wil->status);
-                wil_dbg_misc(wil, "clear_bit(wil_status_dontscan)\n");
-                clear_bit(wil_status_dontscan, &wil->status);
                 break;
         default:
                 /* AP-like interface and monitor:
@@ -130,7 +133,9 @@ static void wil_disconnect_worker(struct work_struct *work)
         struct wil6210_priv *wil = container_of(work,
                         struct wil6210_priv, disconnect_worker);
 
+        mutex_lock(&wil->mutex);
         _wil6210_disconnect(wil, NULL);
+        mutex_unlock(&wil->mutex);
 }
 
 static void wil_connect_timer_fn(ulong x)
@@ -145,6 +150,38 @@ static void wil_connect_timer_fn(ulong x)
         schedule_work(&wil->disconnect_worker);
 }
 
+static void wil_fw_error_worker(struct work_struct *work)
+{
+        struct wil6210_priv *wil = container_of(work,
+                        struct wil6210_priv, fw_error_worker);
+        struct wireless_dev *wdev = wil->wdev;
+
+        wil_dbg_misc(wil, "fw error worker\n");
+
+        if (no_fw_recovery)
+                return;
+
+        mutex_lock(&wil->mutex);
+        switch (wdev->iftype) {
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_P2P_CLIENT:
+        case NL80211_IFTYPE_MONITOR:
+                wil_info(wil, "fw error recovery started...\n");
+                wil_reset(wil);
+
+                /* need to re-allocate Rx ring after reset */
+                wil_rx_init(wil);
+                break;
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_P2P_GO:
+                /* recovery in these modes is done by upper layers */
+                break;
+        default:
+                break;
+        }
+        mutex_unlock(&wil->mutex);
+}
+
 static int wil_find_free_vring(struct wil6210_priv *wil)
 {
         int i;
@@ -197,6 +234,7 @@ int wil_priv_init(struct wil6210_priv *wil)
         INIT_WORK(&wil->connect_worker, wil_connect_worker);
         INIT_WORK(&wil->disconnect_worker, wil_disconnect_worker);
         INIT_WORK(&wil->wmi_event_worker, wmi_event_worker);
+        INIT_WORK(&wil->fw_error_worker, wil_fw_error_worker);
 
         INIT_LIST_HEAD(&wil->pending_wmi_ev);
         spin_lock_init(&wil->wmi_ev_lock);
@@ -223,7 +261,10 @@ void wil6210_disconnect(struct wil6210_priv *wil, void *bssid)
 void wil_priv_deinit(struct wil6210_priv *wil)
 {
         cancel_work_sync(&wil->disconnect_worker);
+        cancel_work_sync(&wil->fw_error_worker);
+        mutex_lock(&wil->mutex);
         wil6210_disconnect(wil, NULL);
+        mutex_unlock(&wil->mutex);
         wmi_event_flush(wil);
         destroy_workqueue(wil->wmi_wq_conn);
         destroy_workqueue(wil->wmi_wq);
@@ -231,40 +272,78 @@ void wil_priv_deinit(struct wil6210_priv *wil)
 
 static void wil_target_reset(struct wil6210_priv *wil)
 {
+        int delay = 0;
+        u32 hw_state;
+        u32 rev_id;
+
         wil_dbg_misc(wil, "Resetting...\n");
 
+        /* register read */
+#define R(a) ioread32(wil->csr + HOSTADDR(a))
         /* register write */
 #define W(a, v) iowrite32(v, wil->csr + HOSTADDR(a))
         /* register set = read, OR, write */
-#define S(a, v) iowrite32(ioread32(wil->csr + HOSTADDR(a)) | v, \
-                wil->csr + HOSTADDR(a))
+#define S(a, v) W(a, R(a) | v)
+        /* register clear = read, AND with inverted, write */
+#define C(a, v) W(a, R(a) & ~v)
 
+        wil->hw_version = R(RGF_USER_FW_REV_ID);
+        rev_id = wil->hw_version & 0xff;
         /* hpal_perst_from_pad_src_n_mask */
         S(RGF_USER_CLKS_CTL_SW_RST_MASK_0, BIT(6));
         /* car_perst_rst_src_n_mask */
         S(RGF_USER_CLKS_CTL_SW_RST_MASK_0, BIT(7));
+        wmb(); /* order is important here */
 
         W(RGF_USER_MAC_CPU_0,  BIT(1)); /* mac_cpu_man_rst */
         W(RGF_USER_USER_CPU_0, BIT(1)); /* user_cpu_man_rst */
+        wmb(); /* order is important here */
 
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0xFE000000);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_1, 0x0000003F);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0x00000170);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_0, 0xFFE7FC00);
+        wmb(); /* order is important here */
 
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_1, 0);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_0, 0);
+        wmb(); /* order is important here */
 
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0x00000001);
-        W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0x00000080);
+        if (rev_id == 1) {
+                W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0x00000080);
+        } else {
+                W(RGF_PCIE_LOS_COUNTER_CTL, BIT(6) | BIT(8));
+                W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0x00008000);
+        }
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_0, 0);
+        wmb(); /* order is important here */
+
+        /* wait until device ready */
+        do {
+                msleep(1);
+                hw_state = R(RGF_USER_HW_MACHINE_STATE);
+                if (delay++ > 100) {
+                        wil_err(wil, "Reset not completed, hw_state 0x%08x\n",
+                                hw_state);
+                        return;
+                }
+        } while (hw_state != HW_MACHINE_BOOT_DONE);
+
+        if (rev_id == 2)
+                W(RGF_PCIE_LOS_COUNTER_CTL, BIT(8));
 
-        wil_dbg_misc(wil, "Reset completed\n");
+        C(RGF_USER_CLKS_CTL_0, BIT_USER_CLKS_RST_PWGD);
+        wmb(); /* order is important here */
 
+        wil_dbg_misc(wil, "Reset completed in %d ms\n", delay);
+
+#undef R
 #undef W
 #undef S
+#undef C
 }
 
 void wil_mbox_ring_le2cpus(struct wil6210_mbox_ring *r)
@@ -299,11 +378,24 @@ int wil_reset(struct wil6210_priv *wil)
 {
         int rc;
 
+        WARN_ON(!mutex_is_locked(&wil->mutex));
+
         cancel_work_sync(&wil->disconnect_worker);
         wil6210_disconnect(wil, NULL);
 
+        wil->status = 0; /* prevent NAPI from being scheduled */
+        if (test_bit(wil_status_napi_en, &wil->status)) {
+                napi_synchronize(&wil->napi_rx);
+        }
+
+        if (wil->scan_request) {
+                wil_dbg_misc(wil, "Abort scan_request 0x%p\n",
+                             wil->scan_request);
+                cfg80211_scan_done(wil->scan_request, true);
+                wil->scan_request = NULL;
+        }
+
         wil6210_disable_irq(wil);
-        wil->status = 0;
 
         wmi_event_flush(wil);
 
@@ -313,6 +405,8 @@ int wil_reset(struct wil6210_priv *wil)
         /* TODO: put MAC in reset */
         wil_target_reset(wil);
 
+        wil_rx_fini(wil);
+
         /* init after reset */
         wil->pending_connect_cid = -1;
         reinit_completion(&wil->wmi_ready);
@@ -326,6 +420,11 @@ int wil_reset(struct wil6210_priv *wil)
         return rc;
 }
 
+void wil_fw_error_recovery(struct wil6210_priv *wil)
+{
+        wil_dbg_misc(wil, "starting fw error recovery\n");
+        schedule_work(&wil->fw_error_worker);
+}
 
 void wil_link_on(struct wil6210_priv *wil)
 {
@@ -353,6 +452,8 @@ static int __wil_up(struct wil6210_priv *wil)
         struct wireless_dev *wdev = wil->wdev;
         int rc;
 
+        WARN_ON(!mutex_is_locked(&wil->mutex));
+
         rc = wil_reset(wil);
         if (rc)
                 return rc;
@@ -394,6 +495,7 @@ static int __wil_up(struct wil6210_priv *wil)
 
         napi_enable(&wil->napi_rx);
         napi_enable(&wil->napi_tx);
+        set_bit(wil_status_napi_en, &wil->status);
 
         return 0;
 }
@@ -411,6 +513,9 @@ int wil_up(struct wil6210_priv *wil)
 
 static int __wil_down(struct wil6210_priv *wil)
 {
+        WARN_ON(!mutex_is_locked(&wil->mutex));
+
+        clear_bit(wil_status_napi_en, &wil->status);
         napi_disable(&wil->napi_rx);
         napi_disable(&wil->napi_tx);
 
diff --git a/drivers/net/wireless/ath/wil6210/netdev.c b/drivers/net/wireless/ath/wil6210/netdev.c
index 717178f09aa8..fdcaeb820e75 100644
--- a/drivers/net/wireless/ath/wil6210/netdev.c
+++ b/drivers/net/wireless/ath/wil6210/netdev.c
@@ -127,8 +127,9 @@ void *wil_if_alloc(struct device *dev, void __iomem *csr)
 
         ndev->netdev_ops = &wil_netdev_ops;
         ndev->ieee80211_ptr = wdev;
-        ndev->hw_features = NETIF_F_HW_CSUM | NETIF_F_RXCSUM;
-        ndev->features |= NETIF_F_HW_CSUM | NETIF_F_RXCSUM;
+        ndev->hw_features = NETIF_F_HW_CSUM | NETIF_F_RXCSUM |
+                            NETIF_F_SG | NETIF_F_GRO;
+        ndev->features |= ndev->hw_features;
         SET_NETDEV_DEV(ndev, wiphy_dev(wdev->wiphy));
         wdev->netdev = ndev;
 
diff --git a/drivers/net/wireless/ath/wil6210/pcie_bus.c b/drivers/net/wireless/ath/wil6210/pcie_bus.c
index e1c8cc4a4b92..f1e1bb338d68 100644
--- a/drivers/net/wireless/ath/wil6210/pcie_bus.c
+++ b/drivers/net/wireless/ath/wil6210/pcie_bus.c
@@ -68,10 +68,14 @@ static int wil_if_pcie_enable(struct wil6210_priv *wil)
                 goto stop_master;
 
         /* need reset here to obtain MAC */
+        mutex_lock(&wil->mutex);
         rc = wil_reset(wil);
+        mutex_unlock(&wil->mutex);
         if (rc)
                 goto release_irq;
 
+        wil_info(wil, "HW version: 0x%08x\n", wil->hw_version);
+
         return 0;
 
  release_irq:
@@ -149,6 +153,7 @@ static int wil_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         pci_set_drvdata(pdev, wil);
         wil->pdev = pdev;
 
+        wil6210_clear_irq(wil);
         /* FW should raise IRQ when ready */
         rc = wil_if_pcie_enable(wil);
         if (rc) {
diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
index 092081e209da..c8c547457eb4 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.c
+++ b/drivers/net/wireless/ath/wil6210/txrx.c
@@ -104,6 +104,23 @@ static int wil_vring_alloc(struct wil6210_priv *wil, struct vring *vring)
         return 0;
 }
 
+static void wil_txdesc_unmap(struct device *dev, struct vring_tx_desc *d,
+                             struct wil_ctx *ctx)
+{
+        dma_addr_t pa = wil_desc_addr(&d->dma.addr);
+        u16 dmalen = le16_to_cpu(d->dma.length);
+        switch (ctx->mapped_as) {
+        case wil_mapped_as_single:
+                dma_unmap_single(dev, pa, dmalen, DMA_TO_DEVICE);
+                break;
+        case wil_mapped_as_page:
+                dma_unmap_page(dev, pa, dmalen, DMA_TO_DEVICE);
+                break;
+        default:
+                break;
+        }
+}
+
 static void wil_vring_free(struct wil6210_priv *wil, struct vring *vring,
                            int tx)
 {
@@ -122,15 +139,7 @@ static void wil_vring_free(struct wil6210_priv *wil, struct vring *vring,
 
                         ctx = &vring->ctx[vring->swtail];
                         *d = *_d;
-                        pa = wil_desc_addr(&d->dma.addr);
-                        dmalen = le16_to_cpu(d->dma.length);
-                        if (vring->ctx[vring->swtail].mapped_as_page) {
-                                dma_unmap_page(dev, pa, dmalen,
-                                               DMA_TO_DEVICE);
-                        } else {
-                                dma_unmap_single(dev, pa, dmalen,
-                                                 DMA_TO_DEVICE);
-                        }
+                        wil_txdesc_unmap(dev, d, ctx);
                         if (ctx->skb)
                                 dev_kfree_skb_any(ctx->skb);
                         vring->swtail = wil_vring_next_tail(vring);
@@ -479,7 +488,7 @@ static int wil_rx_refill(struct wil6210_priv *wil, int count)
  */
 void wil_netif_rx_any(struct sk_buff *skb, struct net_device *ndev)
 {
-        int rc;
+        gro_result_t rc;
         struct wil6210_priv *wil = ndev_to_wil(ndev);
         unsigned int len = skb->len;
         struct vring_rx_desc *d = wil_skb_rxdesc(skb);
@@ -488,17 +497,17 @@ void wil_netif_rx_any(struct sk_buff *skb, struct net_device *ndev)
 
         skb_orphan(skb);
 
-        rc = netif_receive_skb(skb);
+        rc = napi_gro_receive(&wil->napi_rx, skb);
 
-        if (likely(rc == NET_RX_SUCCESS)) {
+        if (unlikely(rc == GRO_DROP)) {
+                ndev->stats.rx_dropped++;
+                stats->rx_dropped++;
+                wil_dbg_txrx(wil, "Rx drop %d bytes\n", len);
+        } else {
                 ndev->stats.rx_packets++;
                 stats->rx_packets++;
                 ndev->stats.rx_bytes += len;
                 stats->rx_bytes += len;
-
-        } else {
-                ndev->stats.rx_dropped++;
-                stats->rx_dropped++;
         }
 }
 
@@ -548,6 +557,11 @@ int wil_rx_init(struct wil6210_priv *wil)
         struct vring *vring = &wil->vring_rx;
         int rc;
 
+        if (vring->va) {
+                wil_err(wil, "Rx ring already allocated\n");
+                return -EINVAL;
+        }
+
         vring->size = WIL6210_RX_RING_SIZE;
         rc = wil_vring_alloc(wil, vring);
         if (rc)
@@ -588,7 +602,7 @@ int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
                                 .ring_size = cpu_to_le16(size),
                         },
                         .ringid = id,
-                        .cidxtid = (cid & 0xf) | ((tid & 0xf) << 4),
+                        .cidxtid = mk_cidxtid(cid, tid),
                         .encap_trans_type = WMI_VRING_ENC_TYPE_802_3,
                         .mac_ctrl = 0,
                         .to_resolution = 0,
@@ -604,6 +618,7 @@ int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
                 struct wmi_vring_cfg_done_event cmd;
         } __packed reply;
         struct vring *vring = &wil->vring_tx[id];
+        struct vring_tx_data *txdata = &wil->vring_tx_data[id];
 
         if (vring->va) {
                 wil_err(wil, "Tx ring [%d] already allocated\n", id);
@@ -611,6 +626,7 @@ int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
                 goto out;
         }
 
+        memset(txdata, 0, sizeof(*txdata));
         vring->size = size;
         rc = wil_vring_alloc(wil, vring);
         if (rc)
@@ -634,6 +650,8 @@ int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
         }
         vring->hwtail = le32_to_cpu(reply.cmd.tx_vring_tail_ptr);
 
+        txdata->enabled = 1;
+
         return 0;
  out_free:
         wil_vring_free(wil, vring, 1);
@@ -646,9 +664,16 @@ void wil_vring_fini_tx(struct wil6210_priv *wil, int id)
 {
         struct vring *vring = &wil->vring_tx[id];
 
+        WARN_ON(!mutex_is_locked(&wil->mutex));
+
         if (!vring->va)
                 return;
 
+        /* make sure NAPI won't touch this vring */
+        wil->vring_tx_data[id].enabled = 0;
+        if (test_bit(wil_status_napi_en, &wil->status))
+                napi_synchronize(&wil->napi_tx);
+
         wil_vring_free(wil, vring, 1);
 }
 
@@ -662,6 +687,10 @@ static struct vring *wil_find_tx_vring(struct wil6210_priv *wil,
         if (cid < 0)
                 return NULL;
 
+        if (!wil->sta[cid].data_port_open &&
+            (skb->protocol != cpu_to_be16(ETH_P_PAE)))
+                return NULL;
+
         /* TODO: fix for multiple TID */
         for (i = 0; i < ARRAY_SIZE(wil->vring2cid_tid); i++) {
                 if (wil->vring2cid_tid[i][0] == cid) {
@@ -700,12 +729,19 @@ static struct vring *wil_tx_bcast(struct wil6210_priv *wil,
         struct vring *v, *v2;
         struct sk_buff *skb2;
         int i;
+        u8 cid;
 
-        /* find 1-st vring */
+        /* find 1-st vring eligible for data */
         for (i = 0; i < WIL6210_MAX_TX_RINGS; i++) {
                 v = &wil->vring_tx[i];
-                if (v->va)
-                        goto found;
+                if (!v->va)
+                        continue;
+
+                cid = wil->vring2cid_tid[i][0];
+                if (!wil->sta[cid].data_port_open)
+                        continue;
+
+                goto found;
         }
 
         wil_err(wil, "Tx while no vrings active?\n");
@@ -721,6 +757,10 @@ found:
                 v2 = &wil->vring_tx[i];
                 if (!v2->va)
                         continue;
+                cid = wil->vring2cid_tid[i][0];
+                if (!wil->sta[cid].data_port_open)
+                        continue;
+
                 skb2 = skb_copy(skb, GFP_ATOMIC);
                 if (skb2) {
                         wil_dbg_txrx(wil, "BCAST DUP -> ring %d\n", i);
@@ -759,6 +799,13 @@ static int wil_tx_desc_map(struct vring_tx_desc *d, dma_addr_t pa, u32 len,
         return 0;
 }
 
+static inline
+void wil_tx_desc_set_nr_frags(struct vring_tx_desc *d, int nr_frags)
+{
+        d->mac.d[2] |= ((nr_frags + 1) <<
+                       MAC_CFG_DESC_TX_2_NUM_OF_DESCRIPTORS_POS);
+}
+
 static int wil_tx_desc_offload_cksum_set(struct wil6210_priv *wil,
                                 struct vring_tx_desc *d,
                                 struct sk_buff *skb)
@@ -823,8 +870,6 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
 
         wil_dbg_txrx(wil, "%s()\n", __func__);
 
-        if (avail < vring->size/8)
-                netif_tx_stop_all_queues(wil_to_ndev(wil));
         if (avail < 1 + nr_frags) {
                 wil_err(wil, "Tx ring full. No space for %d fragments\n",
                         1 + nr_frags);
@@ -842,6 +887,7 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
 
         if (unlikely(dma_mapping_error(dev, pa)))
                 return -EINVAL;
+        vring->ctx[i].mapped_as = wil_mapped_as_single;
         /* 1-st segment */
         wil_tx_desc_map(d, pa, skb_headlen(skb), vring_index);
         /* Process TCP/UDP checksum offloading */
@@ -851,8 +897,8 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
                 goto dma_error;
         }
 
-        d->mac.d[2] |= ((nr_frags + 1) <<
-                       MAC_CFG_DESC_TX_2_NUM_OF_DESCRIPTORS_POS);
+        vring->ctx[i].nr_frags = nr_frags;
+        wil_tx_desc_set_nr_frags(d, nr_frags);
         if (nr_frags)
                 *_d = *d;
 
@@ -867,8 +913,13 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
                                 DMA_TO_DEVICE);
                 if (unlikely(dma_mapping_error(dev, pa)))
                         goto dma_error;
+                vring->ctx[i].mapped_as = wil_mapped_as_page;
                 wil_tx_desc_map(d, pa, len, vring_index);
-                vring->ctx[i].mapped_as_page = 1;
+                /* no need to check return code -
+                 * if it succeeded for 1-st descriptor,
+                 * it will succeed here too
+                 */
+                wil_tx_desc_offload_cksum_set(wil, d, skb);
                 *_d = *d;
         }
         /* for the last seg only */
@@ -897,7 +948,6 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
         /* unmap what we have mapped */
         nr_frags = f + 1; /* frags mapped + one for skb head */
         for (f = 0; f < nr_frags; f++) {
-                u16 dmalen;
                 struct wil_ctx *ctx;
 
                 i = (swhead + f) % vring->size;
@@ -905,12 +955,7 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
                 _d = &(vring->va[i].tx);
                 *d = *_d;
                 _d->dma.status = TX_DMA_STATUS_DU;
-                pa = wil_desc_addr(&d->dma.addr);
-                dmalen = le16_to_cpu(d->dma.length);
-                if (ctx->mapped_as_page)
-                        dma_unmap_page(dev, pa, dmalen, DMA_TO_DEVICE);
-                else
-                        dma_unmap_single(dev, pa, dmalen, DMA_TO_DEVICE);
+                wil_txdesc_unmap(dev, d, ctx);
 
                 if (ctx->skb)
                         dev_kfree_skb_any(ctx->skb);
@@ -927,11 +972,15 @@ netdev_tx_t wil_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         struct wil6210_priv *wil = ndev_to_wil(ndev);
         struct ethhdr *eth = (void *)skb->data;
         struct vring *vring;
+        static bool pr_once_fw;
         int rc;
 
         wil_dbg_txrx(wil, "%s()\n", __func__);
         if (!test_bit(wil_status_fwready, &wil->status)) {
-                wil_err(wil, "FW not ready\n");
+                if (!pr_once_fw) {
+                        wil_err(wil, "FW not ready\n");
+                        pr_once_fw = true;
+                }
                 goto drop;
         }
         if (!test_bit(wil_status_fwconnected, &wil->status)) {
@@ -942,6 +991,7 @@ netdev_tx_t wil_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                 wil_err(wil, "Xmit in monitor mode not supported\n");
                 goto drop;
         }
+        pr_once_fw = false;
 
         /* find vring */
         if (is_unicast_ether_addr(eth->h_dest)) {
@@ -956,6 +1006,10 @@ netdev_tx_t wil_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         /* set up vring entry */
         rc = wil_tx_vring(wil, vring, skb);
 
+        /* do we still have enough room in the vring? */
+        if (wil_vring_avail_tx(vring) < vring->size/8)
+                netif_tx_stop_all_queues(wil_to_ndev(wil));
+
         switch (rc) {
         case 0:
                 /* statistics will be updated on the tx_complete */
@@ -985,69 +1039,82 @@ int wil_tx_complete(struct wil6210_priv *wil, int ringid)
         struct net_device *ndev = wil_to_ndev(wil);
         struct device *dev = wil_to_dev(wil);
         struct vring *vring = &wil->vring_tx[ringid];
+        struct vring_tx_data *txdata = &wil->vring_tx_data[ringid];
         int done = 0;
         int cid = wil->vring2cid_tid[ringid][0];
         struct wil_net_stats *stats = &wil->sta[cid].stats;
+        volatile struct vring_tx_desc *_d;
 
         if (!vring->va) {
                 wil_err(wil, "Tx irq[%d]: vring not initialized\n", ringid);
                 return 0;
         }
 
+        if (!txdata->enabled) {
+                wil_info(wil, "Tx irq[%d]: vring disabled\n", ringid);
+                return 0;
+        }
+
         wil_dbg_txrx(wil, "%s(%d)\n", __func__, ringid);
 
         while (!wil_vring_is_empty(vring)) {
-                volatile struct vring_tx_desc *_d =
-                                              &vring->va[vring->swtail].tx;
-                struct vring_tx_desc dd, *d = &dd;
-                dma_addr_t pa;
-                u16 dmalen;
+                int new_swtail;
                 struct wil_ctx *ctx = &vring->ctx[vring->swtail];
-                struct sk_buff *skb = ctx->skb;
-
-                *d = *_d;
+                /**
+                 * For the fragmented skb, HW will set DU bit only for the
+                 * last fragment. look for it
+                 */
+                int lf = (vring->swtail + ctx->nr_frags) % vring->size;
+                /* TODO: check we are not past head */
 
-                if (!(d->dma.status & TX_DMA_STATUS_DU))
+                _d = &vring->va[lf].tx;
+                if (!(_d->dma.status & TX_DMA_STATUS_DU))
                         break;
 
-                dmalen = le16_to_cpu(d->dma.length);
-                trace_wil6210_tx_done(ringid, vring->swtail, dmalen,
-                                      d->dma.error);
-                wil_dbg_txrx(wil,
-                             "Tx[%3d] : %d bytes, status 0x%02x err 0x%02x\n",
-                             vring->swtail, dmalen, d->dma.status,
-                             d->dma.error);
-                wil_hex_dump_txrx("TxC ", DUMP_PREFIX_NONE, 32, 4,
-                                  (const void *)d, sizeof(*d), false);
-
-                pa = wil_desc_addr(&d->dma.addr);
-                if (ctx->mapped_as_page)
-                        dma_unmap_page(dev, pa, dmalen, DMA_TO_DEVICE);
-                else
-                        dma_unmap_single(dev, pa, dmalen, DMA_TO_DEVICE);
-
-                if (skb) {
-                        if (d->dma.error == 0) {
-                                ndev->stats.tx_packets++;
-                                stats->tx_packets++;
-                                ndev->stats.tx_bytes += skb->len;
-                                stats->tx_bytes += skb->len;
-                        } else {
-                                ndev->stats.tx_errors++;
-                                stats->tx_errors++;
-                        }
+                new_swtail = (lf + 1) % vring->size;
+                while (vring->swtail != new_swtail) {
+                        struct vring_tx_desc dd, *d = &dd;
+                        u16 dmalen;
+                        struct wil_ctx *ctx = &vring->ctx[vring->swtail];
+                        struct sk_buff *skb = ctx->skb;
+                        _d = &vring->va[vring->swtail].tx;
+
+                        *d = *_d;
 
-                        dev_kfree_skb_any(skb);
+                        dmalen = le16_to_cpu(d->dma.length);
+                        trace_wil6210_tx_done(ringid, vring->swtail, dmalen,
+                                              d->dma.error);
+                        wil_dbg_txrx(wil,
+                                     "Tx[%3d] : %d bytes, status 0x%02x err 0x%02x\n",
+                                     vring->swtail, dmalen, d->dma.status,
+                                     d->dma.error);
+                        wil_hex_dump_txrx("TxC ", DUMP_PREFIX_NONE, 32, 4,
+                                          (const void *)d, sizeof(*d), false);
+
+                        wil_txdesc_unmap(dev, d, ctx);
+
+                        if (skb) {
+                                if (d->dma.error == 0) {
+                                        ndev->stats.tx_packets++;
+                                        stats->tx_packets++;
+                                        ndev->stats.tx_bytes += skb->len;
+                                        stats->tx_bytes += skb->len;
+                                } else {
+                                        ndev->stats.tx_errors++;
+                                        stats->tx_errors++;
+                                }
+
+                                dev_kfree_skb_any(skb);
+                        }
+                        memset(ctx, 0, sizeof(*ctx));
+                        /* There is no need to touch HW descriptor:
+                         * - ststus bit TX_DMA_STATUS_DU is set by design,
+                         *   so hardware will not try to process this desc.,
+                         * - rest of descriptor will be initialized on Tx.
+                         */
+                        vring->swtail = wil_vring_next_tail(vring);
+                        done++;
                 }
-                memset(ctx, 0, sizeof(*ctx));
-                /*
-                 * There is no need to touch HW descriptor:
-                 * - ststus bit TX_DMA_STATUS_DU is set by design,
-                 *   so hardware will not try to process this desc.,
-                 * - rest of descriptor will be initialized on Tx.
-                 */
-                vring->swtail = wil_vring_next_tail(vring);
-                done++;
         }
         if (wil_vring_avail_tx(vring) > vring->size/4)
                 netif_tx_wake_all_queues(wil_to_ndev(wil));
diff --git a/drivers/net/wireless/ath/wil6210/wil6210.h b/drivers/net/wireless/ath/wil6210/wil6210.h
index 980dccc82b32..2a2dec75f026 100644
--- a/drivers/net/wireless/ath/wil6210/wil6210.h
+++ b/drivers/net/wireless/ath/wil6210/wil6210.h
@@ -74,23 +74,21 @@ struct RGF_ICR {
 } __packed;
 
 /* registers - FW addresses */
-#define RGF_USER_USER_SCRATCH_PAD       (0x8802bc)
-#define RGF_USER_USER_ICR               (0x880b4c) /* struct RGF_ICR */
-        #define BIT_USER_USER_ICR_SW_INT_2      BIT(18)
-#define RGF_USER_CLKS_CTL_SW_RST_MASK_0 (0x880b14)
-#define RGF_USER_MAC_CPU_0              (0x8801fc)
+#define RGF_USER_HW_MACHINE_STATE       (0x8801dc)
+        #define HW_MACHINE_BOOT_DONE    (0x3fffffd)
 #define RGF_USER_USER_CPU_0             (0x8801e0)
+#define RGF_USER_MAC_CPU_0              (0x8801fc)
+#define RGF_USER_USER_SCRATCH_PAD       (0x8802bc)
+#define RGF_USER_FW_REV_ID              (0x880a8c) /* chip revision */
+#define RGF_USER_CLKS_CTL_0             (0x880abc)
+        #define BIT_USER_CLKS_RST_PWGD  BIT(11) /* reset on "power good" */
 #define RGF_USER_CLKS_CTL_SW_RST_VEC_0  (0x880b04)
 #define RGF_USER_CLKS_CTL_SW_RST_VEC_1  (0x880b08)
 #define RGF_USER_CLKS_CTL_SW_RST_VEC_2  (0x880b0c)
 #define RGF_USER_CLKS_CTL_SW_RST_VEC_3  (0x880b10)
-
-#define RGF_DMA_PSEUDO_CAUSE            (0x881c68)
-#define RGF_DMA_PSEUDO_CAUSE_MASK_SW    (0x881c6c)
-#define RGF_DMA_PSEUDO_CAUSE_MASK_FW    (0x881c70)
-        #define BIT_DMA_PSEUDO_CAUSE_RX         BIT(0)
-        #define BIT_DMA_PSEUDO_CAUSE_TX         BIT(1)
-        #define BIT_DMA_PSEUDO_CAUSE_MISC       BIT(2)
+#define RGF_USER_CLKS_CTL_SW_RST_MASK_0 (0x880b14)
+#define RGF_USER_USER_ICR               (0x880b4c) /* struct RGF_ICR */
+        #define BIT_USER_USER_ICR_SW_INT_2      BIT(18)
 
 #define RGF_DMA_EP_TX_ICR               (0x881bb4) /* struct RGF_ICR */
         #define BIT_DMA_EP_TX_ICR_TX_DONE       BIT(0)
@@ -105,13 +103,22 @@ struct RGF_ICR {
 /* Interrupt moderation control */
 #define RGF_DMA_ITR_CNT_TRSH            (0x881c5c)
 #define RGF_DMA_ITR_CNT_DATA            (0x881c60)
-#define RGF_DMA_ITR_CNT_CRL             (0x881C64)
+#define RGF_DMA_ITR_CNT_CRL             (0x881c64)
         #define BIT_DMA_ITR_CNT_CRL_EN          BIT(0)
         #define BIT_DMA_ITR_CNT_CRL_EXT_TICK    BIT(1)
         #define BIT_DMA_ITR_CNT_CRL_FOREVER     BIT(2)
         #define BIT_DMA_ITR_CNT_CRL_CLR         BIT(3)
         #define BIT_DMA_ITR_CNT_CRL_REACH_TRSH  BIT(4)
 
+#define RGF_DMA_PSEUDO_CAUSE            (0x881c68)
+#define RGF_DMA_PSEUDO_CAUSE_MASK_SW    (0x881c6c)
+#define RGF_DMA_PSEUDO_CAUSE_MASK_FW    (0x881c70)
+        #define BIT_DMA_PSEUDO_CAUSE_RX         BIT(0)
+        #define BIT_DMA_PSEUDO_CAUSE_TX         BIT(1)
+        #define BIT_DMA_PSEUDO_CAUSE_MISC       BIT(2)
+
+#define RGF_PCIE_LOS_COUNTER_CTL        (0x882dc4)
+
 /* popular locations */
 #define HOST_MBOX   HOSTADDR(RGF_USER_USER_SCRATCH_PAD)
 #define HOST_SW_INT (HOSTADDR(RGF_USER_USER_ICR) + \
@@ -125,6 +132,31 @@ struct RGF_ICR {
 
 /* Hardware definitions end */
 
+/**
+ * mk_cidxtid - construct @cidxtid field
+ * @cid: CID value
+ * @tid: TID value
+ *
+ * @cidxtid field encoded as bits 0..3 - CID; 4..7 - TID
+ */
+static inline u8 mk_cidxtid(u8 cid, u8 tid)
+{
+        return ((tid & 0xf) << 4) | (cid & 0xf);
+}
+
+/**
+ * parse_cidxtid - parse @cidxtid field
+ * @cid: store CID value here
+ * @tid: store TID value here
+ *
+ * @cidxtid field encoded as bits 0..3 - CID; 4..7 - TID
+ */
+static inline void parse_cidxtid(u8 cidxtid, u8 *cid, u8 *tid)
+{
+        *cid = cidxtid & 0xf;
+        *tid = (cidxtid >> 4) & 0xf;
+}
+
 struct wil6210_mbox_ring {
         u32 base;
         u16 entry_size; /* max. size of mbox entry, incl. all headers */
@@ -184,12 +216,19 @@ struct pending_wmi_event {
         } __packed event;
 };
 
+enum { /* for wil_ctx.mapped_as */
+        wil_mapped_as_none = 0,
+        wil_mapped_as_single = 1,
+        wil_mapped_as_page = 2,
+};
+
 /**
  * struct wil_ctx - software context for Vring descriptor
  */
 struct wil_ctx {
         struct sk_buff *skb;
-        u8 mapped_as_page:1;
+        u8 nr_frags;
+        u8 mapped_as;
 };
 
 union vring_desc;
@@ -204,6 +243,14 @@ struct vring {
         struct wil_ctx *ctx; /* ctx[size] - software context */
 };
 
+/**
+ * Additional data for Tx Vring
+ */
+struct vring_tx_data {
+        int enabled;
+
+};
+
 enum { /* for wil6210_priv.status */
         wil_status_fwready = 0,
         wil_status_fwconnecting,
@@ -211,6 +258,7 @@ enum { /* for wil6210_priv.status */
         wil_status_dontscan,
         wil_status_reset_done,
         wil_status_irqen, /* FIXME: interrupts enabled - for debug */
+        wil_status_napi_en, /* NAPI enabled protected by wil->mutex */
 };
 
 struct pci_dev;
@@ -296,6 +344,7 @@ struct wil_sta_info {
         u8 addr[ETH_ALEN];
         enum wil_sta_status status;
         struct wil_net_stats stats;
+        bool data_port_open; /* can send any data, not only EAPOL */
         /* Rx BACK */
         struct wil_tid_ampdu_rx *tid_rx[WIL_STA_TID_NUM];
         unsigned long tid_rx_timer_expired[BITS_TO_LONGS(WIL_STA_TID_NUM)];
@@ -309,6 +358,7 @@ struct wil6210_priv {
         void __iomem *csr;
         ulong status;
         u32 fw_version;
+        u32 hw_version;
         u8 n_mids; /* number of additional MIDs as reported by FW */
         /* profile */
         u32 monitor_flags;
@@ -329,6 +379,7 @@ struct wil6210_priv {
         struct workqueue_struct *wmi_wq_conn; /* for connect worker */
         struct work_struct connect_worker;
         struct work_struct disconnect_worker;
+        struct work_struct fw_error_worker;     /* for FW error recovery */
         struct timer_list connect_timer;
         int pending_connect_cid;
         struct list_head pending_wmi_ev;
@@ -343,6 +394,7 @@ struct wil6210_priv {
         /* DMA related */
         struct vring vring_rx;
         struct vring vring_tx[WIL6210_MAX_TX_RINGS];
+        struct vring_tx_data vring_tx_data[WIL6210_MAX_TX_RINGS];
         u8 vring2cid_tid[WIL6210_MAX_TX_RINGS][2]; /* [0] - CID, [1] - TID */
         struct wil_sta_info sta[WIL6210_MAX_CID];
         /* scan */
@@ -406,6 +458,7 @@ void wil_if_remove(struct wil6210_priv *wil);
 int wil_priv_init(struct wil6210_priv *wil);
 void wil_priv_deinit(struct wil6210_priv *wil);
 int wil_reset(struct wil6210_priv *wil);
+void wil_fw_error_recovery(struct wil6210_priv *wil);
 void wil_link_on(struct wil6210_priv *wil);
 void wil_link_off(struct wil6210_priv *wil);
 int wil_up(struct wil6210_priv *wil);
@@ -439,6 +492,7 @@ int wmi_rxon(struct wil6210_priv *wil, bool on);
 int wmi_get_temperature(struct wil6210_priv *wil, u32 *t_m, u32 *t_r);
 int wmi_disconnect_sta(struct wil6210_priv *wil, const u8 *mac, u16 reason);
 
+void wil6210_clear_irq(struct wil6210_priv *wil);
 int wil6210_init_irq(struct wil6210_priv *wil, int irq);
 void wil6210_fini_irq(struct wil6210_priv *wil, int irq);
 void wil6210_disable_irq(struct wil6210_priv *wil);
diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
index 24eed0963581..2ba56eef0c45 100644
--- a/drivers/net/wireless/ath/wil6210/wmi.c
+++ b/drivers/net/wireless/ath/wil6210/wmi.c
@@ -462,7 +462,9 @@ static void wmi_evt_disconnect(struct wil6210_priv *wil, int id,
 
         wil->sinfo_gen++;
 
+        mutex_lock(&wil->mutex);
         wil6210_disconnect(wil, evt->bssid);
+        mutex_unlock(&wil->mutex);
 }
 
 static void wmi_evt_notify(struct wil6210_priv *wil, int id, void *d, int len)
@@ -550,9 +552,16 @@ static void wmi_evt_linkup(struct wil6210_priv *wil, int id, void *d, int len)
 {
         struct net_device *ndev = wil_to_ndev(wil);
         struct wmi_data_port_open_event *evt = d;
+        u8 cid = evt->cid;
 
-        wil_dbg_wmi(wil, "Link UP for CID %d\n", evt->cid);
+        wil_dbg_wmi(wil, "Link UP for CID %d\n", cid);
 
+        if (cid >= ARRAY_SIZE(wil->sta)) {
+                wil_err(wil, "Link UP for invalid CID %d\n", cid);
+                return;
+        }
+
+        wil->sta[cid].data_port_open = true;
         netif_carrier_on(ndev);
 }
 
@@ -560,10 +569,17 @@ static void wmi_evt_linkdown(struct wil6210_priv *wil, int id, void *d, int len)
 {
         struct net_device *ndev = wil_to_ndev(wil);
         struct wmi_wbe_link_down_event *evt = d;
+        u8 cid = evt->cid;
 
         wil_dbg_wmi(wil, "Link DOWN for CID %d, reason %d\n",
-                    evt->cid, le32_to_cpu(evt->reason));
+                    cid, le32_to_cpu(evt->reason));
+
+        if (cid >= ARRAY_SIZE(wil->sta)) {
+                wil_err(wil, "Link DOWN for invalid CID %d\n", cid);
+                return;
+        }
 
+        wil->sta[cid].data_port_open = false;
         netif_carrier_off(ndev);
 }
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
index 4a6508e7e3a1..a16e644e7c08 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
@@ -269,26 +269,17 @@ static int brcmf_sdiod_request_data(struct brcmf_sdio_dev *sdiodev, u8 fn,
                 break;
         }
 
-        if (ret) {
-                /*
-                 * SleepCSR register access can fail when
-                 * waking up the device so reduce this noise
-                 * in the logs.
-                 */
-                if (addr != SBSDIO_FUNC1_SLEEPCSR)
-                        brcmf_err("failed to %s data F%d@0x%05x, err: %d\n",
-                                  write ? "write" : "read", fn, addr, ret);
-                else
-                        brcmf_dbg(SDIO, "failed to %s data F%d@0x%05x, err: %d\n",
-                                  write ? "write" : "read", fn, addr, ret);
-        }
+        if (ret)
+                brcmf_dbg(SDIO, "failed to %s data F%d@0x%05x, err: %d\n",
+                          write ? "write" : "read", fn, addr, ret);
+
         return ret;
 }
 
 static int brcmf_sdiod_regrw_helper(struct brcmf_sdio_dev *sdiodev, u32 addr,
                                    u8 regsz, void *data, bool write)
 {
-        u8 func_num;
+        u8 func;
         s32 retry = 0;
         int ret;
 
@@ -302,9 +293,9 @@ static int brcmf_sdiod_regrw_helper(struct brcmf_sdio_dev *sdiodev, u32 addr,
          * The rest: function 1 silicon backplane core registers
          */
         if ((addr & ~REG_F0_REG_MASK) == 0)
-                func_num = SDIO_FUNC_0;
+                func = SDIO_FUNC_0;
         else
-                func_num = SDIO_FUNC_1;
+                func = SDIO_FUNC_1;
 
         do {
                 if (!write)
@@ -312,16 +303,26 @@ static int brcmf_sdiod_regrw_helper(struct brcmf_sdio_dev *sdiodev, u32 addr,
                 /* for retry wait for 1 ms till bus get settled down */
                 if (retry)
                         usleep_range(1000, 2000);
-                ret = brcmf_sdiod_request_data(sdiodev, func_num, addr, regsz,
+                ret = brcmf_sdiod_request_data(sdiodev, func, addr, regsz,
                                                data, write);
         } while (ret != 0 && ret != -ENOMEDIUM &&
                  retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
 
         if (ret == -ENOMEDIUM)
                 brcmf_bus_change_state(sdiodev->bus_if, BRCMF_BUS_NOMEDIUM);
-        else if (ret != 0)
-                brcmf_err("failed with %d\n", ret);
-
+        else if (ret != 0) {
+                /*
+                 * SleepCSR register access can fail when
+                 * waking up the device so reduce this noise
+                 * in the logs.
+                 */
+                if (addr != SBSDIO_FUNC1_SLEEPCSR)
+                        brcmf_err("failed to %s data F%d@0x%05x, err: %d\n",
+                                  write ? "write" : "read", func, addr, ret);
+                else
+                        brcmf_dbg(SDIO, "failed to %s data F%d@0x%05x, err: %d\n",
+                                  write ? "write" : "read", func, addr, ret);
+        }
         return ret;
 }
 
@@ -988,6 +989,7 @@ static const struct sdio_device_id brcmf_sdmmc_ids[] = {
         {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_43362)},
         {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM,
                      SDIO_DEVICE_ID_BROADCOM_4335_4339)},
+        {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4354)},
         { /* end: all zeroes */ },
 };
 MODULE_DEVICE_TABLE(sdio, brcmf_sdmmc_ids);
@@ -1153,7 +1155,7 @@ static struct sdio_driver brcmf_sdmmc_driver = {
         },
 };
 
-static int brcmf_sdio_pd_probe(struct platform_device *pdev)
+static int __init brcmf_sdio_pd_probe(struct platform_device *pdev)
 {
         brcmf_dbg(SDIO, "Enter\n");
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/chip.c b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
index a07b95ef9e70..df130ef53d1c 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/chip.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
@@ -504,6 +504,7 @@ static void brcmf_chip_get_raminfo(struct brcmf_chip_priv *ci)
                 ci->pub.ramsize = 0x3c000;
                 break;
         case BCM4339_CHIP_ID:
+        case BCM4354_CHIP_ID:
                 ci->pub.ramsize = 0xc0000;
                 ci->pub.rambase = 0x180000;
                 break;
@@ -1006,6 +1007,10 @@ bool brcmf_chip_sr_capable(struct brcmf_chip *pub)
         chip = container_of(pub, struct brcmf_chip_priv, pub);
 
         switch (pub->chip) {
+        case BCM4354_CHIP_ID:
+                /* explicitly check SR engine enable bit */
+                pmu_cc3_mask = BIT(2);
+                /* fall-through */
         case BCM43241_CHIP_ID:
         case BCM4335_CHIP_ID:
         case BCM4339_CHIP_ID:
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index a111b6fbbeba..47a6f3957b7f 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -175,6 +175,7 @@ struct rte_console {
 #define SBSDIO_ALP_AVAIL                0x40
 /* Status: HT is ready */
 #define SBSDIO_HT_AVAIL                 0x80
+#define SBSDIO_CSR_MASK                 0x1F
 #define SBSDIO_AVBITS           (SBSDIO_HT_AVAIL | SBSDIO_ALP_AVAIL)
 #define SBSDIO_ALPAV(regval)    ((regval) & SBSDIO_AVBITS)
 #define SBSDIO_HTAV(regval)     (((regval) & SBSDIO_AVBITS) == SBSDIO_AVBITS)
@@ -458,10 +459,11 @@ struct brcmf_sdio {
         bool alp_only;          /* Don't use HT clock (ALP only) */
 
         u8 *ctrl_frame_buf;
-        u32 ctrl_frame_len;
+        u16 ctrl_frame_len;
         bool ctrl_frame_stat;
 
-        spinlock_t txqlock;
+        spinlock_t txq_lock;            /* protect bus->txq */
+        struct semaphore tx_seq_lock;   /* protect bus->tx_seq */
         wait_queue_head_t ctrl_wait;
         wait_queue_head_t dcmd_resp_wait;
 
@@ -578,6 +580,8 @@ static const struct sdiod_drive_str sdiod_drvstr_tab2_3v3[] = {
 #define BCM43362_NVRAM_NAME             "brcm/brcmfmac43362-sdio.txt"
 #define BCM4339_FIRMWARE_NAME           "brcm/brcmfmac4339-sdio.bin"
 #define BCM4339_NVRAM_NAME              "brcm/brcmfmac4339-sdio.txt"
+#define BCM4354_FIRMWARE_NAME           "brcm/brcmfmac4354-sdio.bin"
+#define BCM4354_NVRAM_NAME              "brcm/brcmfmac4354-sdio.txt"
 
 MODULE_FIRMWARE(BCM43143_FIRMWARE_NAME);
 MODULE_FIRMWARE(BCM43143_NVRAM_NAME);
@@ -597,6 +601,8 @@ MODULE_FIRMWARE(BCM43362_FIRMWARE_NAME);
 MODULE_FIRMWARE(BCM43362_NVRAM_NAME);
 MODULE_FIRMWARE(BCM4339_FIRMWARE_NAME);
 MODULE_FIRMWARE(BCM4339_NVRAM_NAME);
+MODULE_FIRMWARE(BCM4354_FIRMWARE_NAME);
+MODULE_FIRMWARE(BCM4354_NVRAM_NAME);
 
 struct brcmf_firmware_names {
         u32 chipid;
@@ -622,7 +628,8 @@ static const struct brcmf_firmware_names brcmf_fwname_data[] = {
         { BCM4334_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4334) },
         { BCM4335_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4335) },
         { BCM43362_CHIP_ID, 0xFFFFFFFE, BRCMF_FIRMWARE_NVRAM(BCM43362) },
-        { BCM4339_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4339) }
+        { BCM4339_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4339) },
+        { BCM4354_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4354) }
 };
 
 
@@ -714,16 +721,12 @@ brcmf_sdio_kso_control(struct brcmf_sdio *bus, bool on)
         int err = 0;
         int try_cnt = 0;
 
-        brcmf_dbg(TRACE, "Enter\n");
+        brcmf_dbg(TRACE, "Enter: on=%d\n", on);
 
         wr_val = (on << SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT);
         /* 1st KSO write goes to AOS wake up core if device is asleep  */
         brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
                           wr_val, &err);
-        if (err) {
-                brcmf_err("SDIO_AOS KSO write error: %d\n", err);
-                return err;
-        }
 
         if (on) {
                 /* device WAKEUP through KSO:
@@ -753,13 +756,19 @@ brcmf_sdio_kso_control(struct brcmf_sdio *bus, bool on)
                                            &err);
                 if (((rd_val & bmask) == cmp_val) && !err)
                         break;
-                brcmf_dbg(SDIO, "KSO wr/rd retry:%d (max: %d) ERR:%x\n",
-                          try_cnt, MAX_KSO_ATTEMPTS, err);
+
                 udelay(KSO_WAIT_US);
                 brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
                                   wr_val, &err);
         } while (try_cnt++ < MAX_KSO_ATTEMPTS);
 
+        if (try_cnt > 2)
+                brcmf_dbg(SDIO, "try_cnt=%d rd_val=0x%x err=%d\n", try_cnt,
+                          rd_val, err);
+
+        if (try_cnt > MAX_KSO_ATTEMPTS)
+                brcmf_err("max tries: rd_val=0x%x err=%d\n", rd_val, err);
+
         return err;
 }
 
@@ -960,6 +969,7 @@ static int
 brcmf_sdio_bus_sleep(struct brcmf_sdio *bus, bool sleep, bool pendok)
 {
         int err = 0;
+        u8 clkcsr;
 
         brcmf_dbg(SDIO, "Enter: request %s currently %s\n",
                   (sleep ? "SLEEP" : "WAKE"),
@@ -978,8 +988,20 @@ brcmf_sdio_bus_sleep(struct brcmf_sdio *bus, bool sleep, bool pendok)
                             atomic_read(&bus->ipend) > 0 ||
                             (!atomic_read(&bus->fcstate) &&
                             brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) &&
-                            data_ok(bus)))
-                                 return -EBUSY;
+                            data_ok(bus))) {
+                                 err = -EBUSY;
+                                 goto done;
+                        }
+
+                        clkcsr = brcmf_sdiod_regrb(bus->sdiodev,
+                                                   SBSDIO_FUNC1_CHIPCLKCSR,
+                                                   &err);
+                        if ((clkcsr & SBSDIO_CSR_MASK) == 0) {
+                                brcmf_dbg(SDIO, "no clock, set ALP\n");
+                                brcmf_sdiod_regwb(bus->sdiodev,
+                                                  SBSDIO_FUNC1_CHIPCLKCSR,
+                                                  SBSDIO_ALP_AVAIL_REQ, &err);
+                        }
                         err = brcmf_sdio_kso_control(bus, false);
                         /* disable watchdog */
                         if (!err)
@@ -996,7 +1018,7 @@ brcmf_sdio_bus_sleep(struct brcmf_sdio *bus, bool sleep, bool pendok)
                 } else {
                         brcmf_err("error while changing bus sleep state %d\n",
                                   err);
-                        return err;
+                        goto done;
                 }
         }
 
@@ -1008,7 +1030,8 @@ end:
         } else {
                 brcmf_sdio_clkctl(bus, CLK_AVAIL, pendok);
         }
-
+done:
+        brcmf_dbg(SDIO, "Exit: err=%d\n", err);
         return err;
 
 }
@@ -2311,13 +2334,15 @@ static uint brcmf_sdio_sendfromq(struct brcmf_sdio *bus, uint maxframes)
         /* Send frames until the limit or some other event */
         for (cnt = 0; (cnt < maxframes) && data_ok(bus);) {
                 pkt_num = 1;
-                __skb_queue_head_init(&pktq);
+                if (down_interruptible(&bus->tx_seq_lock))
+                        return cnt;
                 if (bus->txglom)
                         pkt_num = min_t(u8, bus->tx_max - bus->tx_seq,
                                         bus->sdiodev->txglomsz);
                 pkt_num = min_t(u32, pkt_num,
                                 brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol));
-                spin_lock_bh(&bus->txqlock);
+                __skb_queue_head_init(&pktq);
+                spin_lock_bh(&bus->txq_lock);
                 for (i = 0; i < pkt_num; i++) {
                         pkt = brcmu_pktq_mdeq(&bus->txq, tx_prec_map,
                                               &prec_out);
@@ -2325,11 +2350,15 @@ static uint brcmf_sdio_sendfromq(struct brcmf_sdio *bus, uint maxframes)
                                 break;
                         __skb_queue_tail(&pktq, pkt);
                 }
-                spin_unlock_bh(&bus->txqlock);
-                if (i == 0)
+                spin_unlock_bh(&bus->txq_lock);
+                if (i == 0) {
+                        up(&bus->tx_seq_lock);
                         break;
+                }
 
                 ret = brcmf_sdio_txpkt(bus, &pktq, SDPCM_DATA_CHANNEL);
+                up(&bus->tx_seq_lock);
+
                 cnt += i;
 
                 /* In poll mode, need to check for other events */
@@ -2358,6 +2387,68 @@ static uint brcmf_sdio_sendfromq(struct brcmf_sdio *bus, uint maxframes)
         return cnt;
 }
 
+static int brcmf_sdio_tx_ctrlframe(struct brcmf_sdio *bus, u8 *frame, u16 len)
+{
+        u8 doff;
+        u16 pad;
+        uint retries = 0;
+        struct brcmf_sdio_hdrinfo hd_info = {0};
+        int ret;
+
+        brcmf_dbg(TRACE, "Enter\n");
+
+        /* Back the pointer to make room for bus header */
+        frame -= bus->tx_hdrlen;
+        len += bus->tx_hdrlen;
+
+        /* Add alignment padding (optional for ctl frames) */
+        doff = ((unsigned long)frame % bus->head_align);
+        if (doff) {
+                frame -= doff;
+                len += doff;
+                memset(frame + bus->tx_hdrlen, 0, doff);
+        }
+
+        /* Round send length to next SDIO block */
+        pad = 0;
+        if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
+                pad = bus->blocksize - (len % bus->blocksize);
+                if ((pad > bus->roundup) || (pad >= bus->blocksize))
+                        pad = 0;
+        } else if (len % bus->head_align) {
+                pad = bus->head_align - (len % bus->head_align);
+        }
+        len += pad;
+
+        hd_info.len = len - pad;
+        hd_info.channel = SDPCM_CONTROL_CHANNEL;
+        hd_info.dat_offset = doff + bus->tx_hdrlen;
+        hd_info.seq_num = bus->tx_seq;
+        hd_info.lastfrm = true;
+        hd_info.tail_pad = pad;
+        brcmf_sdio_hdpack(bus, frame, &hd_info);
+
+        if (bus->txglom)
+                brcmf_sdio_update_hwhdr(frame, len);
+
+        brcmf_dbg_hex_dump(BRCMF_BYTES_ON() && BRCMF_CTL_ON(),
+                           frame, len, "Tx Frame:\n");
+        brcmf_dbg_hex_dump(!(BRCMF_BYTES_ON() && BRCMF_CTL_ON()) &&
+                           BRCMF_HDRS_ON(),
+                           frame, min_t(u16, len, 16), "TxHdr:\n");
+
+        do {
+                ret = brcmf_sdiod_send_buf(bus->sdiodev, frame, len);
+
+                if (ret < 0)
+                        brcmf_sdio_txfail(bus);
+                else
+                        bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQ_WRAP;
+        } while (ret < 0 && retries++ < TXRETRIES);
+
+        return ret;
+}
+
 static void brcmf_sdio_bus_stop(struct device *dev)
 {
         u32 local_hostintmask;
@@ -2591,26 +2682,23 @@ static void brcmf_sdio_dpc(struct brcmf_sdio *bus)
 
         brcmf_sdio_clrintr(bus);
 
-        if (data_ok(bus) && bus->ctrl_frame_stat &&
-            (bus->clkstate == CLK_AVAIL)) {
-
-                sdio_claim_host(bus->sdiodev->func[1]);
-                err = brcmf_sdiod_send_buf(bus->sdiodev, bus->ctrl_frame_buf,
-                                           (u32)bus->ctrl_frame_len);
-
-                if (err < 0)
-                        brcmf_sdio_txfail(bus);
-                else
-                        bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQ_WRAP;
+        if (bus->ctrl_frame_stat && (bus->clkstate == CLK_AVAIL) &&
+            (down_interruptible(&bus->tx_seq_lock) == 0)) {
+                if (data_ok(bus)) {
+                        sdio_claim_host(bus->sdiodev->func[1]);
+                        err = brcmf_sdio_tx_ctrlframe(bus,  bus->ctrl_frame_buf,
+                                                      bus->ctrl_frame_len);
+                        sdio_release_host(bus->sdiodev->func[1]);
 
-                sdio_release_host(bus->sdiodev->func[1]);
-                bus->ctrl_frame_stat = false;
-                brcmf_sdio_wait_event_wakeup(bus);
+                        bus->ctrl_frame_stat = false;
+                        brcmf_sdio_wait_event_wakeup(bus);
+                }
+                up(&bus->tx_seq_lock);
         }
         /* Send queued frames (limit 1 if rx may still be pending) */
-        else if ((bus->clkstate == CLK_AVAIL) && !atomic_read(&bus->fcstate) &&
-                 brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) && txlimit
-                 && data_ok(bus)) {
+        if ((bus->clkstate == CLK_AVAIL) && !atomic_read(&bus->fcstate) &&
+            brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) && txlimit &&
+            data_ok(bus)) {
                 framecnt = bus->rxpending ? min(txlimit, bus->txminmax) :
                                             txlimit;
                 brcmf_sdio_sendfromq(bus, framecnt);
@@ -2644,7 +2732,6 @@ static int brcmf_sdio_bus_txdata(struct device *dev, struct sk_buff *pkt)
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
         struct brcmf_sdio *bus = sdiodev->bus;
-        ulong flags;
 
         brcmf_dbg(TRACE, "Enter: pkt: data %p len %d\n", pkt->data, pkt->len);
 
@@ -2660,7 +2747,7 @@ static int brcmf_sdio_bus_txdata(struct device *dev, struct sk_buff *pkt)
         bus->sdcnt.fcqueued++;
 
         /* Priority based enq */
-        spin_lock_irqsave(&bus->txqlock, flags);
+        spin_lock_bh(&bus->txq_lock);
         /* reset bus_flags in packet cb */
         *(u16 *)(pkt->cb) = 0;
         if (!brcmf_c_prec_enq(bus->sdiodev->dev, &bus->txq, pkt, prec)) {
@@ -2675,7 +2762,7 @@ static int brcmf_sdio_bus_txdata(struct device *dev, struct sk_buff *pkt)
                 bus->txoff = true;
                 brcmf_txflowblock(bus->sdiodev->dev, true);
         }
-        spin_unlock_irqrestore(&bus->txqlock, flags);
+        spin_unlock_bh(&bus->txq_lock);
 
 #ifdef DEBUG
         if (pktq_plen(&bus->txq, prec) > qcount[prec])
@@ -2770,87 +2857,27 @@ break2:
 }
 #endif                          /* DEBUG */
 
-static int brcmf_sdio_tx_frame(struct brcmf_sdio *bus, u8 *frame, u16 len)
-{
-        int ret;
-
-        bus->ctrl_frame_stat = false;
-        ret = brcmf_sdiod_send_buf(bus->sdiodev, frame, len);
-
-        if (ret < 0)
-                brcmf_sdio_txfail(bus);
-        else
-                bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQ_WRAP;
-
-        return ret;
-}
-
 static int
 brcmf_sdio_bus_txctl(struct device *dev, unsigned char *msg, uint msglen)
 {
-        u8 *frame;
-        u16 len, pad;
-        uint retries = 0;
-        u8 doff = 0;
-        int ret = -1;
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
         struct brcmf_sdio *bus = sdiodev->bus;
-        struct brcmf_sdio_hdrinfo hd_info = {0};
+        int ret = -1;
 
         brcmf_dbg(TRACE, "Enter\n");
 
-        /* Back the pointer to make a room for bus header */
-        frame = msg - bus->tx_hdrlen;
-        len = (msglen += bus->tx_hdrlen);
-
-        /* Add alignment padding (optional for ctl frames) */
-        doff = ((unsigned long)frame % bus->head_align);
-        if (doff) {
-                frame -= doff;
-                len += doff;
-                msglen += doff;
-                memset(frame, 0, doff + bus->tx_hdrlen);
-        }
-        /* precondition: doff < bus->head_align */
-        doff += bus->tx_hdrlen;
-
-        /* Round send length to next SDIO block */
-        pad = 0;
-        if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
-                pad = bus->blocksize - (len % bus->blocksize);
-                if ((pad > bus->roundup) || (pad >= bus->blocksize))
-                        pad = 0;
-        } else if (len % bus->head_align) {
-                pad = bus->head_align - (len % bus->head_align);
-        }
-        len += pad;
-
-        /* precondition: IS_ALIGNED((unsigned long)frame, 2) */
-
-        /* Make sure backplane clock is on */
-        sdio_claim_host(bus->sdiodev->func[1]);
-        brcmf_sdio_bus_sleep(bus, false, false);
-        sdio_release_host(bus->sdiodev->func[1]);
-
-        hd_info.len = (u16)msglen;
-        hd_info.channel = SDPCM_CONTROL_CHANNEL;
-        hd_info.dat_offset = doff;
-        hd_info.seq_num = bus->tx_seq;
-        hd_info.lastfrm = true;
-        hd_info.tail_pad = pad;
-        brcmf_sdio_hdpack(bus, frame, &hd_info);
-
-        if (bus->txglom)
-                brcmf_sdio_update_hwhdr(frame, len);
+        if (down_interruptible(&bus->tx_seq_lock))
+                return -EINTR;
 
         if (!data_ok(bus)) {
                 brcmf_dbg(INFO, "No bus credit bus->tx_max %d, bus->tx_seq %d\n",
                           bus->tx_max, bus->tx_seq);
-                bus->ctrl_frame_stat = true;
+                up(&bus->tx_seq_lock);
                 /* Send from dpc */
-                bus->ctrl_frame_buf = frame;
-                bus->ctrl_frame_len = len;
+                bus->ctrl_frame_buf = msg;
+                bus->ctrl_frame_len = msglen;
+                bus->ctrl_frame_stat = true;
 
                 wait_event_interruptible_timeout(bus->ctrl_wait,
                                                  !bus->ctrl_frame_stat,
@@ -2861,22 +2888,18 @@ brcmf_sdio_bus_txctl(struct device *dev, unsigned char *msg, uint msglen)
                         ret = 0;
                 } else {
                         brcmf_dbg(SDIO, "ctrl_frame_stat == true\n");
+                        bus->ctrl_frame_stat = false;
+                        if (down_interruptible(&bus->tx_seq_lock))
+                                return -EINTR;
                         ret = -1;
                 }
         }
-
         if (ret == -1) {
-                brcmf_dbg_hex_dump(BRCMF_BYTES_ON() && BRCMF_CTL_ON(),
-                                   frame, len, "Tx Frame:\n");
-                brcmf_dbg_hex_dump(!(BRCMF_BYTES_ON() && BRCMF_CTL_ON()) &&
-                                   BRCMF_HDRS_ON(),
-                                   frame, min_t(u16, len, 16), "TxHdr:\n");
-
-                do {
-                        sdio_claim_host(bus->sdiodev->func[1]);
-                        ret = brcmf_sdio_tx_frame(bus, frame, len);
-                        sdio_release_host(bus->sdiodev->func[1]);
-                } while (ret < 0 && retries++ < TXRETRIES);
+                sdio_claim_host(bus->sdiodev->func[1]);
+                brcmf_sdio_bus_sleep(bus, false, false);
+                ret = brcmf_sdio_tx_ctrlframe(bus, msg, msglen);
+                sdio_release_host(bus->sdiodev->func[1]);
+                up(&bus->tx_seq_lock);
         }
 
         if (ret)
@@ -3971,6 +3994,7 @@ brcmf_sdio_watchdog_thread(void *data)
                         brcmf_sdio_bus_watchdog(bus);
                         /* Count the tick for reference */
                         bus->sdcnt.tickcnt++;
+                        reinit_completion(&bus->watchdog_wait);
                 } else
                         break;
         }
@@ -4047,7 +4071,8 @@ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
         }
 
         spin_lock_init(&bus->rxctl_lock);
-        spin_lock_init(&bus->txqlock);
+        spin_lock_init(&bus->txq_lock);
+        sema_init(&bus->tx_seq_lock, 1);
         init_waitqueue_head(&bus->ctrl_wait);
         init_waitqueue_head(&bus->dcmd_resp_wait);
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
index af17a5bc8b83..614e4888504f 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
@@ -48,6 +48,11 @@
 
 #define BRCMF_MAXRATES_IN_SET           16      /* max # of rates in rateset */
 
+/* OBSS Coex Auto/On/Off */
+#define BRCMF_OBSS_COEX_AUTO            (-1)
+#define BRCMF_OBSS_COEX_OFF             0
+#define BRCMF_OBSS_COEX_ON              1
+
 enum brcmf_fil_p2p_if_types {
         BRCMF_FIL_P2P_IF_CLIENT,
         BRCMF_FIL_P2P_IF_GO,
@@ -87,6 +92,11 @@ struct brcmf_fil_bss_enable_le {
         __le32 enable;
 };
 
+struct brcmf_fil_bwcap_le {
+        __le32 band;
+        __le32 bw_cap;
+};
+
 /**
  * struct tdls_iovar - common structure for tdls iovars.
  *
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
index fc4f98b275d7..f3445ac627e4 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
@@ -797,7 +797,8 @@ static s32 brcmf_p2p_run_escan(struct brcmf_cfg80211_info *cfg,
                         /* SOCIAL CHANNELS 1, 6, 11 */
                         search_state = WL_P2P_DISC_ST_SEARCH;
                         brcmf_dbg(INFO, "P2P SEARCH PHASE START\n");
-                } else if (dev != NULL && vif->mode == WL_MODE_AP) {
+                } else if (dev != NULL &&
+                           vif->wdev.iftype == NL80211_IFTYPE_P2P_GO) {
                         /* If you are already a GO, then do SEARCH only */
                         brcmf_dbg(INFO, "Already a GO. Do SEARCH Only\n");
                         search_state = WL_P2P_DISC_ST_SEARCH;
@@ -2256,7 +2257,6 @@ struct wireless_dev *brcmf_p2p_add_vif(struct wiphy *wiphy, const char *name,
         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
         struct brcmf_cfg80211_vif *vif;
         enum brcmf_fil_p2p_if_types iftype;
-        enum wl_mode mode;
         int err;
 
         if (brcmf_cfg80211_vif_event_armed(cfg))
@@ -2267,11 +2267,9 @@ struct wireless_dev *brcmf_p2p_add_vif(struct wiphy *wiphy, const char *name,
         switch (type) {
         case NL80211_IFTYPE_P2P_CLIENT:
                 iftype = BRCMF_FIL_P2P_IF_CLIENT;
-                mode = WL_MODE_BSS;
                 break;
         case NL80211_IFTYPE_P2P_GO:
                 iftype = BRCMF_FIL_P2P_IF_GO;
-                mode = WL_MODE_AP;
                 break;
         case NL80211_IFTYPE_P2P_DEVICE:
                 return brcmf_p2p_create_p2pdev(&cfg->p2p, wiphy,
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index 00bd1e16c3ce..e0e649aab8db 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -191,6 +191,7 @@ static struct ieee80211_supported_band __wl_band_2ghz = {
         .n_channels = ARRAY_SIZE(__wl_2ghz_channels),
         .bitrates = wl_g_rates,
         .n_bitrates = wl_g_rates_size,
+        .ht_cap = {IEEE80211_HT_CAP_SUP_WIDTH_20_40, true},
 };
 
 static struct ieee80211_supported_band __wl_band_5ghz_a = {
@@ -494,6 +495,19 @@ brcmf_configure_arp_offload(struct brcmf_if *ifp, bool enable)
         return err;
 }
 
+static bool brcmf_is_apmode(struct brcmf_cfg80211_vif *vif)
+{
+        enum nl80211_iftype iftype;
+
+        iftype = vif->wdev.iftype;
+        return iftype == NL80211_IFTYPE_AP || iftype == NL80211_IFTYPE_P2P_GO;
+}
+
+static bool brcmf_is_ibssmode(struct brcmf_cfg80211_vif *vif)
+{
+        return vif->wdev.iftype == NL80211_IFTYPE_ADHOC;
+}
+
 static struct wireless_dev *brcmf_cfg80211_add_iface(struct wiphy *wiphy,
                                                      const char *name,
                                                      enum nl80211_iftype type,
@@ -654,7 +668,6 @@ brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
                           type);
                 return -EOPNOTSUPP;
         case NL80211_IFTYPE_ADHOC:
-                vif->mode = WL_MODE_IBSS;
                 infra = 0;
                 break;
         case NL80211_IFTYPE_STATION:
@@ -670,12 +683,10 @@ brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
                          */
                         return 0;
                 }
-                vif->mode = WL_MODE_BSS;
                 infra = 1;
                 break;
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_P2P_GO:
-                vif->mode = WL_MODE_AP;
                 ap = 1;
                 break;
         default:
@@ -699,7 +710,7 @@ brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
                         err = -EAGAIN;
                         goto done;
                 }
-                brcmf_dbg(INFO, "IF Type = %s\n", (vif->mode == WL_MODE_IBSS) ?
+                brcmf_dbg(INFO, "IF Type = %s\n", brcmf_is_ibssmode(vif) ?
                           "Adhoc" : "Infra");
         }
         ndev->ieee80211_ptr->iftype = type;
@@ -1682,22 +1693,9 @@ brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
         ext_join_params->ssid_le.SSID_len = cpu_to_le32(profile->ssid.SSID_len);
         memcpy(&ext_join_params->ssid_le.SSID, sme->ssid,
                profile->ssid.SSID_len);
-        /*increase dwell time to receive probe response or detect Beacon
-         * from target AP at a noisy air only during connect command
-         */
-        ext_join_params->scan_le.active_time =
-                cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS);
-        ext_join_params->scan_le.passive_time =
-                cpu_to_le32(BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS);
+
         /* Set up join scan parameters */
         ext_join_params->scan_le.scan_type = -1;
-        /* to sync with presence period of VSDB GO.
-         * Send probe request more frequently. Probe request will be stopped
-         * when it gets probe response from target AP/GO.
-         */
-        ext_join_params->scan_le.nprobes =
-                cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS /
-                            BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS);
         ext_join_params->scan_le.home_time = cpu_to_le32(-1);
 
         if (sme->bssid)
@@ -1710,6 +1708,25 @@ brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
 
                 ext_join_params->assoc_le.chanspec_list[0] =
                         cpu_to_le16(chanspec);
+                /* Increase dwell time to receive probe response or detect
+                 * beacon from target AP at a noisy air only during connect
+                 * command.
+                 */
+                ext_join_params->scan_le.active_time =
+                        cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS);
+                ext_join_params->scan_le.passive_time =
+                        cpu_to_le32(BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS);
+                /* To sync with presence period of VSDB GO send probe request
+                 * more frequently. Probe request will be stopped when it gets
+                 * probe response from target AP/GO.
+                 */
+                ext_join_params->scan_le.nprobes =
+                        cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS /
+                                    BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS);
+        } else {
+                ext_join_params->scan_le.active_time = cpu_to_le32(-1);
+                ext_join_params->scan_le.passive_time = cpu_to_le32(-1);
+                ext_join_params->scan_le.nprobes = cpu_to_le32(-1);
         }
 
         err  = brcmf_fil_bsscfg_data_set(ifp, "join", ext_join_params,
@@ -1917,7 +1934,7 @@ brcmf_add_keyext(struct wiphy *wiphy, struct net_device *ndev,
                 brcmf_dbg(CONN, "Setting the key index %d\n", key.index);
                 memcpy(key.data, params->key, key.len);
 
-                if ((ifp->vif->mode != WL_MODE_AP) &&
+                if (!brcmf_is_apmode(ifp->vif) &&
                     (params->cipher == WLAN_CIPHER_SUITE_TKIP)) {
                         brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
                         memcpy(keybuf, &key.data[24], sizeof(keybuf));
@@ -2016,7 +2033,7 @@ brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
                 break;
         case WLAN_CIPHER_SUITE_TKIP:
-                if (ifp->vif->mode != WL_MODE_AP) {
+                if (!brcmf_is_apmode(ifp->vif)) {
                         brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
                         memcpy(keybuf, &key.data[24], sizeof(keybuf));
                         memcpy(&key.data[24], &key.data[16], sizeof(keybuf));
@@ -2177,7 +2194,7 @@ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
         if (!check_vif_up(ifp->vif))
                 return -EIO;
 
-        if (ifp->vif->mode == WL_MODE_AP) {
+        if (brcmf_is_apmode(ifp->vif)) {
                 memcpy(&sta_info_le, mac, ETH_ALEN);
                 err = brcmf_fil_iovar_data_get(ifp, "sta_info",
                                                &sta_info_le,
@@ -2194,7 +2211,7 @@ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
                 }
                 brcmf_dbg(TRACE, "STA idle time : %d ms, connected time :%d sec\n",
                           sinfo->inactive_time, sinfo->connected_time);
-        } else if (ifp->vif->mode == WL_MODE_BSS) {
+        } else if (ifp->vif->wdev.iftype == NL80211_IFTYPE_STATION) {
                 if (memcmp(mac, bssid, ETH_ALEN)) {
                         brcmf_err("Wrong Mac address cfg_mac-%pM wl_bssid-%pM\n",
                                   mac, bssid);
@@ -2476,11 +2493,6 @@ CleanUp:
         return err;
 }
 
-static bool brcmf_is_ibssmode(struct brcmf_cfg80211_vif *vif)
-{
-        return vif->mode == WL_MODE_IBSS;
-}
-
 static s32 brcmf_update_bss_info(struct brcmf_cfg80211_info *cfg,
                                  struct brcmf_if *ifp)
 {
@@ -4253,32 +4265,6 @@ static struct cfg80211_ops wl_cfg80211_ops = {
         CFG80211_TESTMODE_CMD(brcmf_cfg80211_testmode)
 };
 
-static s32 brcmf_nl80211_iftype_to_mode(enum nl80211_iftype type)
-{
-        switch (type) {
-        case NL80211_IFTYPE_AP_VLAN:
-        case NL80211_IFTYPE_WDS:
-        case NL80211_IFTYPE_MONITOR:
-        case NL80211_IFTYPE_MESH_POINT:
-                return -ENOTSUPP;
-        case NL80211_IFTYPE_ADHOC:
-                return WL_MODE_IBSS;
-        case NL80211_IFTYPE_STATION:
-        case NL80211_IFTYPE_P2P_CLIENT:
-                return WL_MODE_BSS;
-        case NL80211_IFTYPE_AP:
-        case NL80211_IFTYPE_P2P_GO:
-                return WL_MODE_AP;
-        case NL80211_IFTYPE_P2P_DEVICE:
-                return WL_MODE_P2P;
-        case NL80211_IFTYPE_UNSPECIFIED:
-        default:
-                break;
-        }
-
-        return -EINVAL;
-}
-
 static void brcmf_wiphy_pno_params(struct wiphy *wiphy)
 {
         /* scheduled scan settings */
@@ -4403,7 +4389,6 @@ struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
         vif->wdev.wiphy = cfg->wiphy;
         vif->wdev.iftype = type;
 
-        vif->mode = brcmf_nl80211_iftype_to_mode(type);
         vif->pm_block = pm_block;
         vif->roam_off = -1;
 
@@ -4697,7 +4682,7 @@ brcmf_notify_connect_status(struct brcmf_if *ifp,
         s32 err = 0;
         u16 reason;
 
-        if (ifp->vif->mode == WL_MODE_AP) {
+        if (brcmf_is_apmode(ifp->vif)) {
                 err = brcmf_notify_connect_status_ap(cfg, ndev, e, data);
         } else if (brcmf_is_linkup(e)) {
                 brcmf_dbg(CONN, "Linkup\n");
@@ -4945,6 +4930,30 @@ static void init_vif_event(struct brcmf_cfg80211_vif_event *event)
         mutex_init(&event->vif_event_lock);
 }
 
+static int brcmf_enable_bw40_2g(struct brcmf_if *ifp)
+{
+        struct brcmf_fil_bwcap_le band_bwcap;
+        u32 val;
+        int err;
+
+        /* verify support for bw_cap command */
+        val = WLC_BAND_5G;
+        err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &val);
+
+        if (!err) {
+                /* only set 2G bandwidth using bw_cap command */
+                band_bwcap.band = cpu_to_le32(WLC_BAND_2G);
+                band_bwcap.bw_cap = cpu_to_le32(WLC_BW_40MHZ_BIT);
+                err = brcmf_fil_iovar_data_set(ifp, "bw_cap", &band_bwcap,
+                                               sizeof(band_bwcap));
+        } else {
+                brcmf_dbg(INFO, "fallback to mimo_bw_cap\n");
+                val = WLC_N_BW_40ALL;
+                err = brcmf_fil_iovar_int_set(ifp, "mimo_bw_cap", val);
+        }
+        return err;
+}
+
 struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
                                                   struct device *busdev)
 {
@@ -5002,6 +5011,17 @@ struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
                 goto cfg80211_p2p_attach_out;
         }
 
+        /* If cfg80211 didn't disable 40MHz HT CAP in wiphy_register(),
+         * setup 40MHz in 2GHz band and enable OBSS scanning.
+         */
+        if (wiphy->bands[IEEE80211_BAND_2GHZ]->ht_cap.cap &
+            IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
+                err = brcmf_enable_bw40_2g(ifp);
+                if (!err)
+                        err = brcmf_fil_iovar_int_set(ifp, "obss_coex",
+                                                      BRCMF_OBSS_COEX_AUTO);
+        }
+
         err = brcmf_fil_iovar_int_set(ifp, "tdls_enable", 1);
         if (err) {
                 brcmf_dbg(INFO, "TDLS not enabled (%d)\n", err);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
index 5715bb0708cf..283c525a44f7 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
@@ -89,21 +89,6 @@ enum brcmf_scan_status {
         BRCMF_SCAN_STATUS_SUPPRESS,
 };
 
-/**
- * enum wl_mode - driver mode of virtual interface.
- *
- * @WL_MODE_BSS: connects to BSS.
- * @WL_MODE_IBSS: operate as ad-hoc.
- * @WL_MODE_AP: operate as access-point.
- * @WL_MODE_P2P: provide P2P discovery.
- */
-enum wl_mode {
-        WL_MODE_BSS,
-        WL_MODE_IBSS,
-        WL_MODE_AP,
-        WL_MODE_P2P
-};
-
 /* dongle configuration */
 struct brcmf_cfg80211_conf {
         u32 frag_threshold;
@@ -193,7 +178,6 @@ struct vif_saved_ie {
  * @ifp: lower layer interface pointer
  * @wdev: wireless device.
  * @profile: profile information.
- * @mode: operating mode.
  * @roam_off: roaming state.
  * @sme_state: SME state using enum brcmf_vif_status bits.
  * @pm_block: power-management blocked.
@@ -204,7 +188,6 @@ struct brcmf_cfg80211_vif {
         struct brcmf_if *ifp;
         struct wireless_dev wdev;
         struct brcmf_cfg80211_profile profile;
-        s32 mode;
         s32 roam_off;
         unsigned long sme_state;
         bool pm_block;
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index 925034b80e9c..8c5fa4e58139 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -426,6 +426,12 @@ static int brcms_ops_start(struct ieee80211_hw *hw)
         bool blocked;
         int err;
 
+        if (!wl->ucode.bcm43xx_bomminor) {
+                err = brcms_request_fw(wl, wl->wlc->hw->d11core);
+                if (err)
+                        return -ENOENT;
+        }
+
         ieee80211_wake_queues(hw);
         spin_lock_bh(&wl->lock);
         blocked = brcms_rfkill_set_hw_state(wl);
@@ -433,14 +439,6 @@ static int brcms_ops_start(struct ieee80211_hw *hw)
         if (!blocked)
                 wiphy_rfkill_stop_polling(wl->pub->ieee_hw->wiphy);
 
-        if (!wl->ucode.bcm43xx_bomminor) {
-                err = brcms_request_fw(wl, wl->wlc->hw->d11core);
-                if (err) {
-                        brcms_remove(wl->wlc->hw->d11core);
-                        return -ENOENT;
-                }
-        }
-
         spin_lock_bh(&wl->lock);
         /* avoid acknowledging frames before a non-monitor device is added */
         wl->mute_tx = true;
@@ -1094,12 +1092,6 @@ static int ieee_hw_init(struct ieee80211_hw *hw)
  * Attach to the WL device identified by vendor and device parameters.
  * regs is a host accessible memory address pointing to WL device registers.
  *
- * brcms_attach is not defined as static because in the case where no bus
- * is defined, wl_attach will never be called, and thus, gcc will issue
- * a warning that this function is defined but not used if we declare
- * it as static.
- *
- *
  * is called in brcms_bcma_probe() context, therefore no locking required.
  */
 static struct brcms_info *brcms_attach(struct bcma_device *pdev)
diff --git a/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h b/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
index 6fa5d4863782..d816270db3be 100644
--- a/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
+++ b/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
@@ -43,5 +43,6 @@
 #define BCM4335_CHIP_ID         0x4335
 #define BCM43362_CHIP_ID        43362
 #define BCM4339_CHIP_ID         0x4339
+#define BCM4354_CHIP_ID         0x4354
 
 #endif                          /* _BRCM_HW_IDS_H_ */
diff --git a/drivers/net/wireless/iwlwifi/dvm/main.c b/drivers/net/wireless/iwlwifi/dvm/main.c
index ba1b1ea54252..6a6df71af1d7 100644
--- a/drivers/net/wireless/iwlwifi/dvm/main.c
+++ b/drivers/net/wireless/iwlwifi/dvm/main.c
@@ -252,13 +252,17 @@ static void iwl_bg_bt_runtime_config(struct work_struct *work)
         struct iwl_priv *priv =
                 container_of(work, struct iwl_priv, bt_runtime_config);
 
+        mutex_lock(&priv->mutex);
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
-                return;
+                goto out;
 
         /* dont send host command if rf-kill is on */
         if (!iwl_is_ready_rf(priv))
-                return;
+                goto out;
+
         iwlagn_send_advance_bt_config(priv);
+out:
+        mutex_unlock(&priv->mutex);
 }
 
 static void iwl_bg_bt_full_concurrency(struct work_struct *work)
@@ -2035,7 +2039,7 @@ static void iwl_free_skb(struct iwl_op_mode *op_mode, struct sk_buff *skb)
         ieee80211_free_txskb(priv->hw, skb);
 }
 
-static void iwl_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
+static bool iwl_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
 {
         struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);
 
@@ -2045,6 +2049,8 @@ static void iwl_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
                 clear_bit(STATUS_RF_KILL_HW, &priv->status);
 
         wiphy_rfkill_set_hw_state(priv->hw->wiphy, state);
+
+        return false;
 }
 
 static const struct iwl_op_mode_ops iwl_dvm_ops = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c
index fbd262ffa497..003a546571d4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
@@ -134,6 +134,7 @@ const struct iwl_cfg iwl7260_2ac_cfg = {
         .nvm_ver = IWL7260_NVM_VERSION,
         .nvm_calib_ver = IWL7260_TX_POWER_VERSION,
         .host_interrupt_operation_mode = true,
+        .lp_xtal_workaround = true,
 };
 
 const struct iwl_cfg iwl7260_2ac_cfg_high_temp = {
@@ -145,6 +146,7 @@ const struct iwl_cfg iwl7260_2ac_cfg_high_temp = {
         .nvm_calib_ver = IWL7260_TX_POWER_VERSION,
         .high_temp = true,
         .host_interrupt_operation_mode = true,
+        .lp_xtal_workaround = true,
 };
 
 const struct iwl_cfg iwl7260_2n_cfg = {
@@ -155,6 +157,7 @@ const struct iwl_cfg iwl7260_2n_cfg = {
         .nvm_ver = IWL7260_NVM_VERSION,
         .nvm_calib_ver = IWL7260_TX_POWER_VERSION,
         .host_interrupt_operation_mode = true,
+        .lp_xtal_workaround = true,
 };
 
 const struct iwl_cfg iwl7260_n_cfg = {
@@ -165,6 +168,7 @@ const struct iwl_cfg iwl7260_n_cfg = {
         .nvm_ver = IWL7260_NVM_VERSION,
         .nvm_calib_ver = IWL7260_TX_POWER_VERSION,
         .host_interrupt_operation_mode = true,
+        .lp_xtal_workaround = true,
 };
 
 const struct iwl_cfg iwl3160_2ac_cfg = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-config.h b/drivers/net/wireless/iwlwifi/iwl-config.h
index 13ec56607d10..3f17dc3f2c8a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/iwlwifi/iwl-config.h
@@ -262,6 +262,7 @@ struct iwl_cfg {
         bool high_temp;
         bool d0i3;
         u8   nvm_hw_section_num;
+        bool lp_xtal_workaround;
         const struct iwl_pwr_tx_backoff *pwr_tx_backoffs;
 };
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h
index f13dec9ad9c9..fe129c94ae3e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/iwlwifi/iwl-csr.h
@@ -139,6 +139,13 @@
 #define CSR_ANA_PLL_CFG         (CSR_BASE+0x20c)
 
 /*
+ * CSR HW resources monitor registers
+ */
+#define CSR_MONITOR_CFG_REG             (CSR_BASE+0x214)
+#define CSR_MONITOR_STATUS_REG          (CSR_BASE+0x228)
+#define CSR_MONITOR_XTAL_RESOURCES      (0x00000010)
+
+/*
  * CSR Hardware Revision Workaround Register.  Indicates hardware rev;
  * "step" determines CCK backoff for txpower calculation.  Used for 4965 only.
  * See also CSR_HW_REV register.
@@ -173,6 +180,7 @@
 #define CSR_HW_IF_CONFIG_REG_BIT_NIC_READY      (0x00400000) /* PCI_OWN_SEM */
 #define CSR_HW_IF_CONFIG_REG_BIT_NIC_PREPARE_DONE (0x02000000) /* ME_OWN */
 #define CSR_HW_IF_CONFIG_REG_PREPARE              (0x08000000) /* WAKE_ME */
+#define CSR_HW_IF_CONFIG_REG_PERSIST_MODE         (0x40000000) /* PERSISTENCE */
 
 #define CSR_INT_PERIODIC_DIS                    (0x00) /* disable periodic int*/
 #define CSR_INT_PERIODIC_ENA                    (0xFF) /* 255*32 usec ~ 8 msec*/
@@ -240,6 +248,7 @@
  *         001 -- MAC power-down
  *         010 -- PHY (radio) power-down
  *         011 -- Error
+ *    10:  XTAL ON request
  *   9-6:  SYS_CONFIG
  *         Indicates current system configuration, reflecting pins on chip
  *         as forced high/low by device circuit board.
@@ -271,6 +280,7 @@
 #define CSR_GP_CNTRL_REG_FLAG_INIT_DONE              (0x00000004)
 #define CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ         (0x00000008)
 #define CSR_GP_CNTRL_REG_FLAG_GOING_TO_SLEEP         (0x00000010)
+#define CSR_GP_CNTRL_REG_FLAG_XTAL_ON                (0x00000400)
 
 #define CSR_GP_CNTRL_REG_VAL_MAC_ACCESS_EN           (0x00000001)
 
@@ -396,6 +406,34 @@
 #define CSR_DRAM_INIT_TBL_WRAP_CHECK    (1 << 27)
 
 /*
+ * SHR target access (Shared block memory space)
+ *
+ * Shared internal registers can be accessed directly from PCI bus through SHR
+ * arbiter without need for the MAC HW to be powered up. This is possible due to
+ * indirect read/write via HEEP_CTRL_WRD_PCIEX_CTRL (0xEC) and
+ * HEEP_CTRL_WRD_PCIEX_DATA (0xF4) registers.
+ *
+ * Use iwl_write32()/iwl_read32() family to access these registers. The MAC HW
+ * need not be powered up so no "grab inc access" is required.
+ */
+
+/*
+ * Registers for accessing shared registers (e.g. SHR_APMG_GP1,
+ * SHR_APMG_XTAL_CFG). For example, to read from SHR_APMG_GP1 register (0x1DC),
+ * first, write to the control register:
+ * HEEP_CTRL_WRD_PCIEX_CTRL[15:0] = 0x1DC (offset of the SHR_APMG_GP1 register)
+ * HEEP_CTRL_WRD_PCIEX_CTRL[29:28] = 2 (read access)
+ * second, read from the data register HEEP_CTRL_WRD_PCIEX_DATA[31:0].
+ *
+ * To write the register, first, write to the data register
+ * HEEP_CTRL_WRD_PCIEX_DATA[31:0] and then:
+ * HEEP_CTRL_WRD_PCIEX_CTRL[15:0] = 0x1DC (offset of the SHR_APMG_GP1 register)
+ * HEEP_CTRL_WRD_PCIEX_CTRL[29:28] = 3 (write access)
+ */
+#define HEEP_CTRL_WRD_PCIEX_CTRL_REG    (CSR_BASE+0x0ec)
+#define HEEP_CTRL_WRD_PCIEX_DATA_REG    (CSR_BASE+0x0f4)
+
+/*
  * HBUS (Host-side Bus)
  *
  * HBUS registers are mapped directly into PCI bus space, but are used
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw.h b/drivers/net/wireless/iwlwifi/iwl-fw.h
index f04ff871dc6d..d14f19339d61 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw.h
@@ -125,6 +125,22 @@ enum iwl_ucode_tlv_flag {
         IWL_UCODE_TLV_FLAGS_GO_UAPSD            = BIT(30),
 };
 
+/**
+ * enum iwl_ucode_tlv_api - ucode api
+ * @IWL_UCODE_TLV_API_WOWLAN_CONFIG_TID: wowlan config includes tid field.
+ */
+enum iwl_ucode_tlv_api {
+        IWL_UCODE_TLV_API_WOWLAN_CONFIG_TID     = BIT(0),
+};
+
+/**
+ * enum iwl_ucode_tlv_capa - ucode capabilities
+ * @IWL_UCODE_TLV_CAPA_D0I3_SUPPORT: supports D0i3
+ */
+enum iwl_ucode_tlv_capa {
+        IWL_UCODE_TLV_CAPA_D0I3_SUPPORT         = BIT(0),
+};
+
 /* The default calibrate table size if not specified by firmware file */
 #define IWL_DEFAULT_STANDARD_PHY_CALIBRATE_TBL_SIZE     18
 #define IWL_MAX_STANDARD_PHY_CALIBRATE_TBL_SIZE         19
diff --git a/drivers/net/wireless/iwlwifi/iwl-io.c b/drivers/net/wireless/iwlwifi/iwl-io.c
index 07372f2b0250..44cc3cf45762 100644
--- a/drivers/net/wireless/iwlwifi/iwl-io.c
+++ b/drivers/net/wireless/iwlwifi/iwl-io.c
@@ -93,14 +93,14 @@ int iwl_poll_direct_bit(struct iwl_trans *trans, u32 addr, u32 mask,
 }
 IWL_EXPORT_SYMBOL(iwl_poll_direct_bit);
 
-static inline u32 __iwl_read_prph(struct iwl_trans *trans, u32 ofs)
+u32 __iwl_read_prph(struct iwl_trans *trans, u32 ofs)
 {
         u32 val = iwl_trans_read_prph(trans, ofs);
         trace_iwlwifi_dev_ioread_prph32(trans->dev, ofs, val);
         return val;
 }
 
-static inline void __iwl_write_prph(struct iwl_trans *trans, u32 ofs, u32 val)
+void __iwl_write_prph(struct iwl_trans *trans, u32 ofs, u32 val)
 {
         trace_iwlwifi_dev_iowrite_prph32(trans->dev, ofs, val);
         iwl_trans_write_prph(trans, ofs, val);
diff --git a/drivers/net/wireless/iwlwifi/iwl-io.h b/drivers/net/wireless/iwlwifi/iwl-io.h
index 9e81b23d738b..665ddd9dbbc4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-io.h
+++ b/drivers/net/wireless/iwlwifi/iwl-io.h
@@ -70,7 +70,9 @@ u32 iwl_read_direct32(struct iwl_trans *trans, u32 reg);
 void iwl_write_direct32(struct iwl_trans *trans, u32 reg, u32 value);
 
 
+u32 __iwl_read_prph(struct iwl_trans *trans, u32 ofs);
 u32 iwl_read_prph(struct iwl_trans *trans, u32 ofs);
+void __iwl_write_prph(struct iwl_trans *trans, u32 ofs, u32 val);
 void iwl_write_prph(struct iwl_trans *trans, u32 ofs, u32 val);
 int iwl_poll_prph_bit(struct iwl_trans *trans, u32 addr,
                       u32 bits, u32 mask, int timeout);
diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
index 2f962ec0b750..6be30c698506 100644
--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
@@ -299,9 +299,11 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg,
 
 static void iwl_init_vht_hw_capab(const struct iwl_cfg *cfg,
                                   struct iwl_nvm_data *data,
-                                  struct ieee80211_sta_vht_cap *vht_cap)
+                                  struct ieee80211_sta_vht_cap *vht_cap,
+                                  u8 tx_chains, u8 rx_chains)
 {
-        int num_ants = num_of_ant(data->valid_rx_ant);
+        int num_rx_ants = num_of_ant(rx_chains);
+        int num_tx_ants = num_of_ant(tx_chains);
 
         vht_cap->vht_supported = true;
 
@@ -311,8 +313,10 @@ static void iwl_init_vht_hw_capab(const struct iwl_cfg *cfg,
                        3 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT |
                        7 << IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT;
 
-        if (num_ants > 1)
+        if (num_tx_ants > 1)
                 vht_cap->cap |= IEEE80211_VHT_CAP_TXSTBC;
+        else
+                vht_cap->cap |= IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN;
 
         if (iwlwifi_mod_params.amsdu_size_8K)
                 vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
@@ -327,10 +331,8 @@ static void iwl_init_vht_hw_capab(const struct iwl_cfg *cfg,
                             IEEE80211_VHT_MCS_NOT_SUPPORTED << 12 |
                             IEEE80211_VHT_MCS_NOT_SUPPORTED << 14);
 
-        if (num_ants == 1 ||
-            cfg->rx_with_siso_diversity) {
-                vht_cap->cap |= IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN |
-                                IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN;
+        if (num_rx_ants == 1 || cfg->rx_with_siso_diversity) {
+                vht_cap->cap |= IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN;
                 /* this works because NOT_SUPPORTED == 3 */
                 vht_cap->vht_mcs.rx_mcs_map |=
                         cpu_to_le16(IEEE80211_VHT_MCS_NOT_SUPPORTED << 2);
@@ -375,7 +377,8 @@ static void iwl_init_sbands(struct device *dev, const struct iwl_cfg *cfg,
         iwl_init_ht_hw_capab(cfg, data, &sband->ht_cap, IEEE80211_BAND_5GHZ,
                              tx_chains, rx_chains);
         if (enable_vht)
-                iwl_init_vht_hw_capab(cfg, data, &sband->vht_cap);
+                iwl_init_vht_hw_capab(cfg, data, &sband->vht_cap,
+                                      tx_chains, rx_chains);
 
         if (n_channels != n_used)
                 IWL_ERR_DEV(dev, "NVM: used only %d of %d channels\n",
diff --git a/drivers/net/wireless/iwlwifi/iwl-op-mode.h b/drivers/net/wireless/iwlwifi/iwl-op-mode.h
index 5d78207040b0..ea29504ac617 100644
--- a/drivers/net/wireless/iwlwifi/iwl-op-mode.h
+++ b/drivers/net/wireless/iwlwifi/iwl-op-mode.h
@@ -119,7 +119,8 @@ struct iwl_cfg;
  * @queue_not_full: notifies that a HW queue is not full any more.
  *      Must be atomic and called with BH disabled.
  * @hw_rf_kill:notifies of a change in the HW rf kill switch. True means that
- *      the radio is killed. May sleep.
+ *      the radio is killed. Return %true if the device should be stopped by
+ *      the transport immediately after the call. May sleep.
  * @free_skb: allows the transport layer to free skbs that haven't been
  *      reclaimed by the op_mode. This can happen when the driver is freed and
  *      there are Tx packets pending in the transport layer.
@@ -144,7 +145,7 @@ struct iwl_op_mode_ops {
                   struct iwl_device_cmd *cmd);
         void (*queue_full)(struct iwl_op_mode *op_mode, int queue);
         void (*queue_not_full)(struct iwl_op_mode *op_mode, int queue);
-        void (*hw_rf_kill)(struct iwl_op_mode *op_mode, bool state);
+        bool (*hw_rf_kill)(struct iwl_op_mode *op_mode, bool state);
         void (*free_skb)(struct iwl_op_mode *op_mode, struct sk_buff *skb);
         void (*nic_error)(struct iwl_op_mode *op_mode);
         void (*cmd_queue_full)(struct iwl_op_mode *op_mode);
@@ -195,11 +196,11 @@ static inline void iwl_op_mode_queue_not_full(struct iwl_op_mode *op_mode,
         op_mode->ops->queue_not_full(op_mode, queue);
 }
 
-static inline void iwl_op_mode_hw_rf_kill(struct iwl_op_mode *op_mode,
-                                          bool state)
+static inline bool __must_check
+iwl_op_mode_hw_rf_kill(struct iwl_op_mode *op_mode, bool state)
 {
         might_sleep();
-        op_mode->ops->hw_rf_kill(op_mode, state);
+        return op_mode->ops->hw_rf_kill(op_mode, state);
 }
 
 static inline void iwl_op_mode_free_skb(struct iwl_op_mode *op_mode,
diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
index 9c90186d1744..5f657c501406 100644
--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
@@ -95,7 +95,8 @@
 #define APMG_SVR_VOLTAGE_CONFIG_BIT_MSK (0x000001E0) /* bit 8:5 */
 #define APMG_SVR_DIGITAL_VOLTAGE_1_32           (0x00000060)
 
-#define APMG_PCIDEV_STT_VAL_L1_ACT_DIS          (0x00000800)
+#define APMG_PCIDEV_STT_VAL_PERSIST_DIS (0x00000200)
+#define APMG_PCIDEV_STT_VAL_L1_ACT_DIS  (0x00000800)
 
 #define APMG_RTC_INT_STT_RFKILL         (0x10000000)
 
@@ -105,6 +106,26 @@
 /* Device NMI register */
 #define DEVICE_SET_NMI_REG 0x00a01c30
 
+/* Shared registers (0x0..0x3ff, via target indirect or periphery */
+#define SHR_BASE        0x00a10000
+
+/* Shared GP1 register */
+#define SHR_APMG_GP1_REG                0x01dc
+#define SHR_APMG_GP1_REG_PRPH           (SHR_BASE + SHR_APMG_GP1_REG)
+#define SHR_APMG_GP1_WF_XTAL_LP_EN      0x00000004
+#define SHR_APMG_GP1_CHICKEN_BIT_SELECT 0x80000000
+
+/* Shared DL_CFG register */
+#define SHR_APMG_DL_CFG_REG                     0x01c4
+#define SHR_APMG_DL_CFG_REG_PRPH                (SHR_BASE + SHR_APMG_DL_CFG_REG)
+#define SHR_APMG_DL_CFG_RTCS_CLK_SELECTOR_MSK   0x000000c0
+#define SHR_APMG_DL_CFG_RTCS_CLK_INTERNAL_XTAL  0x00000080
+#define SHR_APMG_DL_CFG_DL_CLOCK_POWER_UP       0x00000100
+
+/* Shared APMG_XTAL_CFG register */
+#define SHR_APMG_XTAL_CFG_REG           0x1c0
+#define SHR_APMG_XTAL_CFG_XTAL_ON_REQ   0x80000000
+
 /*
  * Device reset for family 8000
  * write to bit 24 in order to reset the CPU
diff --git a/drivers/net/wireless/iwlwifi/mvm/Makefile b/drivers/net/wireless/iwlwifi/mvm/Makefile
index 41d390fd2ac8..ccdd3b7c4cce 100644
--- a/drivers/net/wireless/iwlwifi/mvm/Makefile
+++ b/drivers/net/wireless/iwlwifi/mvm/Makefile
@@ -2,8 +2,8 @@ obj-$(CONFIG_IWLMVM)   += iwlmvm.o
 iwlmvm-y += fw.o mac80211.o nvm.o ops.o phy-ctxt.o mac-ctxt.o
 iwlmvm-y += utils.o rx.o tx.o binding.o quota.o sta.o sf.o
 iwlmvm-y += scan.o time-event.o rs.o
-iwlmvm-y += power.o bt-coex.o
-iwlmvm-y += led.o tt.o
+iwlmvm-y += power.o coex.o
+iwlmvm-y += led.o tt.o offloading.o
 iwlmvm-$(CONFIG_IWLWIFI_DEBUGFS) += debugfs.o debugfs-vif.o
 iwlmvm-$(CONFIG_PM_SLEEP) += d3.o
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c b/drivers/net/wireless/iwlwifi/mvm/coex.c
index 2aa3ee93c68e..685f7e8e6943 100644
--- a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex.c
@@ -61,9 +61,11 @@
  *
  *****************************************************************************/
 
+#include <linux/ieee80211.h>
+#include <linux/etherdevice.h>
 #include <net/mac80211.h>
 
-#include "fw-api-bt-coex.h"
+#include "fw-api-coex.h"
 #include "iwl-modparams.h"
 #include "mvm.h"
 #include "iwl-debug.h"
@@ -305,6 +307,215 @@ static const __le32 iwl_bt_mprio_lut[BT_COEX_MULTI_PRIO_LUT_SIZE] = {
         cpu_to_le32(0x33113311),
 };
 
+struct corunning_block_luts {
+        u8 range;
+        __le32 lut20[BT_COEX_CORUN_LUT_SIZE];
+};
+
+/*
+ * Ranges for the antenna coupling calibration / co-running block LUT:
+ *              LUT0: [ 0, 12[
+ *              LUT1: [12, 20[
+ *              LUT2: [20, 21[
+ *              LUT3: [21, 23[
+ *              LUT4: [23, 27[
+ *              LUT5: [27, 30[
+ *              LUT6: [30, 32[
+ *              LUT7: [32, 33[
+ *              LUT8: [33, - [
+ */
+static const struct corunning_block_luts antenna_coupling_ranges[] = {
+        {
+                .range = 0,
+                .lut20 = {
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                },
+        },
+        {
+                .range = 12,
+                .lut20 = {
+                        cpu_to_le32(0x00000001),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                },
+        },
+        {
+                .range = 20,
+                .lut20 = {
+                        cpu_to_le32(0x00000002),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                },
+        },
+        {
+                .range = 21,
+                .lut20 = {
+                        cpu_to_le32(0x00000003),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                },
+        },
+        {
+                .range = 23,
+                .lut20 = {
+                        cpu_to_le32(0x00000004),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                },
+        },
+        {
+                .range = 27,
+                .lut20 = {
+                        cpu_to_le32(0x00000005),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                },
+        },
+        {
+                .range = 30,
+                .lut20 = {
+                        cpu_to_le32(0x00000006),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                },
+        },
+        {
+                .range = 32,
+                .lut20 = {
+                        cpu_to_le32(0x00000007),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                },
+        },
+        {
+                .range = 33,
+                .lut20 = {
+                        cpu_to_le32(0x00000008),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
+                },
+        },
+};
+
 static enum iwl_bt_coex_lut_type
 iwl_get_coex_type(struct iwl_mvm *mvm, const struct ieee80211_vif *vif)
 {
@@ -390,8 +601,6 @@ int iwl_send_bt_init_conf(struct iwl_mvm *mvm)
                                             BT_VALID_LUT |
                                             BT_VALID_WIFI_RX_SW_PRIO_BOOST |
                                             BT_VALID_WIFI_TX_SW_PRIO_BOOST |
-                                            BT_VALID_CORUN_LUT_20 |
-                                            BT_VALID_CORUN_LUT_40 |
                                             BT_VALID_ANT_ISOLATION |
                                             BT_VALID_ANT_ISOLATION_THRS |
                                             BT_VALID_TXTX_DELTA_FREQ_THRS |
@@ -401,6 +610,17 @@ int iwl_send_bt_init_conf(struct iwl_mvm *mvm)
         if (IWL_MVM_BT_COEX_SYNC2SCO)
                 bt_cmd->flags |= cpu_to_le32(BT_COEX_SYNC2SCO);
 
+        if (IWL_MVM_BT_COEX_CORUNNING) {
+                bt_cmd->valid_bit_msk = cpu_to_le32(BT_VALID_CORUN_LUT_20 |
+                                                    BT_VALID_CORUN_LUT_40);
+                bt_cmd->flags |= cpu_to_le32(BT_COEX_CORUNNING);
+        }
+
+        if (IWL_MVM_BT_COEX_MPLUT) {
+                bt_cmd->flags |= cpu_to_le32(BT_COEX_MPLUT);
+                bt_cmd->valid_bit_msk = cpu_to_le32(BT_VALID_MULTI_PRIO_LUT);
+        }
+
         if (mvm->cfg->bt_shared_single_ant)
                 memcpy(&bt_cmd->decision_lut, iwl_single_shared_ant,
                        sizeof(iwl_single_shared_ant));
@@ -408,6 +628,12 @@ int iwl_send_bt_init_conf(struct iwl_mvm *mvm)
                 memcpy(&bt_cmd->decision_lut, iwl_combined_lookup,
                        sizeof(iwl_combined_lookup));
 
+        /* Take first Co-running block LUT to get started */
+        memcpy(bt_cmd->bt4_corun_lut20, antenna_coupling_ranges[0].lut20,
+               sizeof(bt_cmd->bt4_corun_lut20));
+        memcpy(bt_cmd->bt4_corun_lut40, antenna_coupling_ranges[0].lut20,
+               sizeof(bt_cmd->bt4_corun_lut40));
+
         memcpy(&bt_cmd->bt_prio_boost, iwl_bt_prio_boost,
                sizeof(iwl_bt_prio_boost));
         memcpy(&bt_cmd->bt4_multiprio_lut, iwl_bt_mprio_lut,
@@ -498,7 +724,7 @@ int iwl_mvm_bt_coex_reduced_txp(struct iwl_mvm *mvm, u8 sta_id, bool enable)
         struct iwl_host_cmd cmd = {
                 .id = BT_CONFIG,
                 .len = { sizeof(*bt_cmd), },
-                .dataflags = { IWL_HCMD_DFL_DUP, },
+                .dataflags = { IWL_HCMD_DFL_NOCOPY, },
                 .flags = CMD_ASYNC,
         };
         struct iwl_mvm_sta *mvmsta;
@@ -952,8 +1178,8 @@ void iwl_mvm_bt_rssi_event(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 #define LINK_QUAL_AGG_TIME_LIMIT_DEF    (4000)
 #define LINK_QUAL_AGG_TIME_LIMIT_BT_ACT (1200)
 
-u16 iwl_mvm_bt_coex_agg_time_limit(struct iwl_mvm *mvm,
-                                   struct ieee80211_sta *sta)
+u16 iwl_mvm_coex_agg_time_limit(struct iwl_mvm *mvm,
+                                struct ieee80211_sta *sta)
 {
         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
         enum iwl_bt_coex_lut_type lut_type;
@@ -989,6 +1215,38 @@ bool iwl_mvm_bt_coex_is_mimo_allowed(struct iwl_mvm *mvm,
         return iwl_get_coex_type(mvm, mvmsta->vif) == BT_COEX_TIGHT_LUT;
 }
 
+u8 iwl_mvm_bt_coex_tx_prio(struct iwl_mvm *mvm, struct ieee80211_hdr *hdr,
+                           struct ieee80211_tx_info *info, u8 ac)
+{
+        __le16 fc = hdr->frame_control;
+
+        if (info->band != IEEE80211_BAND_2GHZ)
+                return 0;
+
+        if (unlikely(mvm->bt_tx_prio))
+                return mvm->bt_tx_prio - 1;
+
+        /* High prio packet (wrt. BT coex) if it is EAPOL, MCAST or MGMT */
+        if (info->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO ||
+             is_multicast_ether_addr(hdr->addr1) ||
+             ieee80211_is_ctl(fc) || ieee80211_is_mgmt(fc) ||
+             ieee80211_is_nullfunc(fc) || ieee80211_is_qos_nullfunc(fc))
+                return 3;
+
+        switch (ac) {
+        case IEEE80211_AC_BE:
+                return 1;
+        case IEEE80211_AC_VO:
+                return 3;
+        case IEEE80211_AC_VI:
+                return 2;
+        default:
+                break;
+        }
+
+        return 0;
+}
+
 void iwl_mvm_bt_coex_vif_change(struct iwl_mvm *mvm)
 {
         if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_NEWBT_COEX))
@@ -996,3 +1254,69 @@ void iwl_mvm_bt_coex_vif_change(struct iwl_mvm *mvm)
 
         iwl_mvm_bt_coex_notif_handle(mvm);
 }
+
+int iwl_mvm_rx_ant_coupling_notif(struct iwl_mvm *mvm,
+                                  struct iwl_rx_cmd_buffer *rxb,
+                                  struct iwl_device_cmd *dev_cmd)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        u32 ant_isolation = le32_to_cpup((void *)pkt->data);
+        u8 __maybe_unused lower_bound, upper_bound;
+        u8 lut;
+
+        struct iwl_bt_coex_cmd *bt_cmd;
+        struct iwl_host_cmd cmd = {
+                .id = BT_CONFIG,
+                .len = { sizeof(*bt_cmd), },
+                .dataflags = { IWL_HCMD_DFL_NOCOPY, },
+                .flags = CMD_SYNC,
+        };
+
+        if (!IWL_MVM_BT_COEX_CORUNNING)
+                return 0;
+
+        lockdep_assert_held(&mvm->mutex);
+
+        if (ant_isolation ==  mvm->last_ant_isol)
+                return 0;
+
+        for (lut = 0; lut < ARRAY_SIZE(antenna_coupling_ranges) - 1; lut++)
+                if (ant_isolation < antenna_coupling_ranges[lut + 1].range)
+                        break;
+
+        lower_bound = antenna_coupling_ranges[lut].range;
+
+        if (lut < ARRAY_SIZE(antenna_coupling_ranges) - 1)
+                upper_bound = antenna_coupling_ranges[lut + 1].range;
+        else
+                upper_bound = antenna_coupling_ranges[lut].range;
+
+        IWL_DEBUG_COEX(mvm, "Antenna isolation=%d in range [%d,%d[, lut=%d\n",
+                       ant_isolation, lower_bound, upper_bound, lut);
+
+        mvm->last_ant_isol = ant_isolation;
+
+        if (mvm->last_corun_lut == lut)
+                return 0;
+
+        mvm->last_corun_lut = lut;
+
+        bt_cmd = kzalloc(sizeof(*bt_cmd), GFP_KERNEL);
+        if (!bt_cmd)
+                return 0;
+        cmd.data[0] = bt_cmd;
+
+        bt_cmd->flags = cpu_to_le32(BT_COEX_NW);
+        bt_cmd->valid_bit_msk |= cpu_to_le32(BT_VALID_ENABLE |
+                                             BT_VALID_CORUN_LUT_20 |
+                                             BT_VALID_CORUN_LUT_40);
+
+        /* For the moment, use the same LUT for 20GHz and 40GHz */
+        memcpy(bt_cmd->bt4_corun_lut20, antenna_coupling_ranges[lut].lut20,
+               sizeof(bt_cmd->bt4_corun_lut20));
+
+        memcpy(bt_cmd->bt4_corun_lut40, antenna_coupling_ranges[lut].lut20,
+               sizeof(bt_cmd->bt4_corun_lut40));
+
+        return 0;
+}
diff --git a/drivers/net/wireless/iwlwifi/mvm/constants.h b/drivers/net/wireless/iwlwifi/mvm/constants.h
index 2d133b1b2dde..51685693af2e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/constants.h
+++ b/drivers/net/wireless/iwlwifi/mvm/constants.h
@@ -79,8 +79,8 @@
 #define IWL_MVM_PS_SNOOZE_WINDOW                50
 #define IWL_MVM_WOWLAN_PS_SNOOZE_WINDOW         25
 #define IWL_MVM_LOWLAT_QUOTA_MIN_PERCENT        64
-#define IWL_MVM_LOWLAT_SINGLE_BINDING_MAXDUR    24 /* TU */
-#define IWL_MVM_LOWLAT_DUAL_BINDING_MAXDUR      24 /* TU */
 #define IWL_MVM_BT_COEX_SYNC2SCO                1
+#define IWL_MVM_BT_COEX_CORUNNING               1
+#define IWL_MVM_BT_COEX_MPLUT                   1
 
 #endif /* __MVM_CONSTANTS_H */
diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c
index b956e2f0b631..e56f5a0edf85 100644
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -376,139 +376,6 @@ static int iwl_mvm_send_patterns(struct iwl_mvm *mvm,
         return err;
 }
 
-static int iwl_mvm_send_proto_offload(struct iwl_mvm *mvm,
-                                      struct ieee80211_vif *vif)
-{
-        union {
-                struct iwl_proto_offload_cmd_v1 v1;
-                struct iwl_proto_offload_cmd_v2 v2;
-                struct iwl_proto_offload_cmd_v3_small v3s;
-                struct iwl_proto_offload_cmd_v3_large v3l;
-        } cmd = {};
-        struct iwl_host_cmd hcmd = {
-                .id = PROT_OFFLOAD_CONFIG_CMD,
-                .flags = CMD_SYNC,
-                .data[0] = &cmd,
-                .dataflags[0] = IWL_HCMD_DFL_DUP,
-        };
-        struct iwl_proto_offload_cmd_common *common;
-        u32 enabled = 0, size;
-        u32 capa_flags = mvm->fw->ucode_capa.flags;
-#if IS_ENABLED(CONFIG_IPV6)
-        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        int i;
-
-        if (capa_flags & IWL_UCODE_TLV_FLAGS_NEW_NSOFFL_SMALL ||
-            capa_flags & IWL_UCODE_TLV_FLAGS_NEW_NSOFFL_LARGE) {
-                struct iwl_ns_config *nsc;
-                struct iwl_targ_addr *addrs;
-                int n_nsc, n_addrs;
-                int c;
-
-                if (capa_flags & IWL_UCODE_TLV_FLAGS_NEW_NSOFFL_SMALL) {
-                        nsc = cmd.v3s.ns_config;
-                        n_nsc = IWL_PROTO_OFFLOAD_NUM_NS_CONFIG_V3S;
-                        addrs = cmd.v3s.targ_addrs;
-                        n_addrs = IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS_V3S;
-                } else {
-                        nsc = cmd.v3l.ns_config;
-                        n_nsc = IWL_PROTO_OFFLOAD_NUM_NS_CONFIG_V3L;
-                        addrs = cmd.v3l.targ_addrs;
-                        n_addrs = IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS_V3L;
-                }
-
-                if (mvmvif->num_target_ipv6_addrs)
-                        enabled |= IWL_D3_PROTO_OFFLOAD_NS;
-
-                /*
-                 * For each address we have (and that will fit) fill a target
-                 * address struct and combine for NS offload structs with the
-                 * solicited node addresses.
-                 */
-                for (i = 0, c = 0;
-                     i < mvmvif->num_target_ipv6_addrs &&
-                     i < n_addrs && c < n_nsc; i++) {
-                        struct in6_addr solicited_addr;
-                        int j;
-
-                        addrconf_addr_solict_mult(&mvmvif->target_ipv6_addrs[i],
-                                                  &solicited_addr);
-                        for (j = 0; j < c; j++)
-                                if (ipv6_addr_cmp(&nsc[j].dest_ipv6_addr,
-                                                  &solicited_addr) == 0)
-                                        break;
-                        if (j == c)
-                                c++;
-                        addrs[i].addr = mvmvif->target_ipv6_addrs[i];
-                        addrs[i].config_num = cpu_to_le32(j);
-                        nsc[j].dest_ipv6_addr = solicited_addr;
-                        memcpy(nsc[j].target_mac_addr, vif->addr, ETH_ALEN);
-                }
-
-                if (capa_flags & IWL_UCODE_TLV_FLAGS_NEW_NSOFFL_SMALL)
-                        cmd.v3s.num_valid_ipv6_addrs = cpu_to_le32(i);
-                else
-                        cmd.v3l.num_valid_ipv6_addrs = cpu_to_le32(i);
-        } else if (capa_flags & IWL_UCODE_TLV_FLAGS_D3_6_IPV6_ADDRS) {
-                if (mvmvif->num_target_ipv6_addrs) {
-                        enabled |= IWL_D3_PROTO_OFFLOAD_NS;
-                        memcpy(cmd.v2.ndp_mac_addr, vif->addr, ETH_ALEN);
-                }
-
-                BUILD_BUG_ON(sizeof(cmd.v2.target_ipv6_addr[0]) !=
-                             sizeof(mvmvif->target_ipv6_addrs[0]));
-
-                for (i = 0; i < min(mvmvif->num_target_ipv6_addrs,
-                                    IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS_V2); i++)
-                        memcpy(cmd.v2.target_ipv6_addr[i],
-                               &mvmvif->target_ipv6_addrs[i],
-                               sizeof(cmd.v2.target_ipv6_addr[i]));
-        } else {
-                if (mvmvif->num_target_ipv6_addrs) {
-                        enabled |= IWL_D3_PROTO_OFFLOAD_NS;
-                        memcpy(cmd.v1.ndp_mac_addr, vif->addr, ETH_ALEN);
-                }
-
-                BUILD_BUG_ON(sizeof(cmd.v1.target_ipv6_addr[0]) !=
-                             sizeof(mvmvif->target_ipv6_addrs[0]));
-
-                for (i = 0; i < min(mvmvif->num_target_ipv6_addrs,
-                                    IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS_V1); i++)
-                        memcpy(cmd.v1.target_ipv6_addr[i],
-                               &mvmvif->target_ipv6_addrs[i],
-                               sizeof(cmd.v1.target_ipv6_addr[i]));
-        }
-#endif
-
-        if (capa_flags & IWL_UCODE_TLV_FLAGS_NEW_NSOFFL_SMALL) {
-                common = &cmd.v3s.common;
-                size = sizeof(cmd.v3s);
-        } else if (capa_flags & IWL_UCODE_TLV_FLAGS_NEW_NSOFFL_LARGE) {
-                common = &cmd.v3l.common;
-                size = sizeof(cmd.v3l);
-        } else if (capa_flags & IWL_UCODE_TLV_FLAGS_D3_6_IPV6_ADDRS) {
-                common = &cmd.v2.common;
-                size = sizeof(cmd.v2);
-        } else {
-                common = &cmd.v1.common;
-                size = sizeof(cmd.v1);
-        }
-
-        if (vif->bss_conf.arp_addr_cnt) {
-                enabled |= IWL_D3_PROTO_OFFLOAD_ARP;
-                common->host_ipv4_addr = vif->bss_conf.arp_addr_list[0];
-                memcpy(common->arp_mac_addr, vif->addr, ETH_ALEN);
-        }
-
-        if (!enabled)
-                return 0;
-
-        common->enabled = cpu_to_le32(enabled);
-
-        hcmd.len[0] = size;
-        return iwl_mvm_send_cmd(mvm, &hcmd);
-}
-
 enum iwl_mvm_tcp_packet_type {
         MVM_TCP_TX_SYN,
         MVM_TCP_RX_SYNACK,
@@ -846,8 +713,8 @@ static int iwl_mvm_d3_reprogram(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         quota_cmd.quotas[0].id_and_color =
                 cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->phy_ctxt->id,
                                                 mvmvif->phy_ctxt->color));
-        quota_cmd.quotas[0].quota = cpu_to_le32(100);
-        quota_cmd.quotas[0].max_duration = cpu_to_le32(1000);
+        quota_cmd.quotas[0].quota = cpu_to_le32(IWL_MVM_MAX_QUOTA);
+        quota_cmd.quotas[0].max_duration = cpu_to_le32(IWL_MVM_MAX_QUOTA);
 
         for (i = 1; i < MAX_BINDINGS; i++)
                 quota_cmd.quotas[i].id_and_color = cpu_to_le32(FW_CTXT_INVALID);
@@ -927,6 +794,20 @@ void iwl_mvm_set_last_nonqos_seq(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                 IWL_ERR(mvm, "failed to set non-QoS seqno\n");
 }
 
+static int
+iwl_mvm_send_wowlan_config_cmd(struct iwl_mvm *mvm,
+                               const struct iwl_wowlan_config_cmd_v3 *cmd)
+{
+        /* start only with the v2 part of the command */
+        u16 cmd_len = sizeof(cmd->common);
+
+        if (mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_WOWLAN_CONFIG_TID)
+                cmd_len = sizeof(*cmd);
+
+        return iwl_mvm_send_cmd_pdu(mvm, WOWLAN_CONFIGURATION, CMD_SYNC,
+                                    cmd_len, cmd);
+}
+
 static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
                              struct cfg80211_wowlan *wowlan,
                              bool test)
@@ -939,7 +820,7 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
         struct iwl_mvm_vif *mvmvif;
         struct ieee80211_sta *ap_sta;
         struct iwl_mvm_sta *mvm_ap_sta;
-        struct iwl_wowlan_config_cmd wowlan_config_cmd = {};
+        struct iwl_wowlan_config_cmd_v3 wowlan_config_cmd = {};
         struct iwl_wowlan_kek_kck_material_cmd kek_kck_cmd = {};
         struct iwl_wowlan_tkip_params_cmd tkip_cmd = {};
         struct iwl_d3_manager_config d3_cfg_cmd_data = {
@@ -961,7 +842,7 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
                 .tkip = &tkip_cmd,
                 .use_tkip = false,
         };
-        int ret, i;
+        int ret;
         int len __maybe_unused;
 
         if (!wowlan) {
@@ -1002,49 +883,41 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
 
         mvm_ap_sta = (struct iwl_mvm_sta *)ap_sta->drv_priv;
 
-        /* TODO: wowlan_config_cmd.wowlan_ba_teardown_tids */
+        /* TODO: wowlan_config_cmd.common.wowlan_ba_teardown_tids */
 
-        wowlan_config_cmd.is_11n_connection = ap_sta->ht_cap.ht_supported;
+        wowlan_config_cmd.common.is_11n_connection =
+                                        ap_sta->ht_cap.ht_supported;
 
         /* Query the last used seqno and set it */
         ret = iwl_mvm_get_last_nonqos_seq(mvm, vif);
         if (ret < 0)
                 goto out_noreset;
-        wowlan_config_cmd.non_qos_seq = cpu_to_le16(ret);
+        wowlan_config_cmd.common.non_qos_seq = cpu_to_le16(ret);
 
-        /*
-         * For QoS counters, we store the one to use next, so subtract 0x10
-         * since the uCode will add 0x10 *before* using the value while we
-         * increment after using the value (i.e. store the next value to use).
-         */
-        for (i = 0; i < IWL_MAX_TID_COUNT; i++) {
-                u16 seq = mvm_ap_sta->tid_data[i].seq_number;
-                seq -= 0x10;
-                wowlan_config_cmd.qos_seq[i] = cpu_to_le16(seq);
-        }
+        iwl_mvm_set_wowlan_qos_seq(mvm_ap_sta, &wowlan_config_cmd.common);
 
         if (wowlan->disconnect)
-                wowlan_config_cmd.wakeup_filter |=
+                wowlan_config_cmd.common.wakeup_filter |=
                         cpu_to_le32(IWL_WOWLAN_WAKEUP_BEACON_MISS |
                                     IWL_WOWLAN_WAKEUP_LINK_CHANGE);
         if (wowlan->magic_pkt)
-                wowlan_config_cmd.wakeup_filter |=
+                wowlan_config_cmd.common.wakeup_filter |=
                         cpu_to_le32(IWL_WOWLAN_WAKEUP_MAGIC_PACKET);
         if (wowlan->gtk_rekey_failure)
-                wowlan_config_cmd.wakeup_filter |=
+                wowlan_config_cmd.common.wakeup_filter |=
                         cpu_to_le32(IWL_WOWLAN_WAKEUP_GTK_REKEY_FAIL);
         if (wowlan->eap_identity_req)
-                wowlan_config_cmd.wakeup_filter |=
+                wowlan_config_cmd.common.wakeup_filter |=
                         cpu_to_le32(IWL_WOWLAN_WAKEUP_EAP_IDENT_REQ);
         if (wowlan->four_way_handshake)
-                wowlan_config_cmd.wakeup_filter |=
+                wowlan_config_cmd.common.wakeup_filter |=
                         cpu_to_le32(IWL_WOWLAN_WAKEUP_4WAY_HANDSHAKE);
         if (wowlan->n_patterns)
-                wowlan_config_cmd.wakeup_filter |=
+                wowlan_config_cmd.common.wakeup_filter |=
                         cpu_to_le32(IWL_WOWLAN_WAKEUP_PATTERN_MATCH);
 
         if (wowlan->rfkill_release)
-                wowlan_config_cmd.wakeup_filter |=
+                wowlan_config_cmd.common.wakeup_filter |=
                         cpu_to_le32(IWL_WOWLAN_WAKEUP_RF_KILL_DEASSERT);
 
         if (wowlan->tcp) {
@@ -1052,7 +925,7 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
                  * Set the "link change" (really "link lost") flag as well
                  * since that implies losing the TCP connection.
                  */
-                wowlan_config_cmd.wakeup_filter |=
+                wowlan_config_cmd.common.wakeup_filter |=
                         cpu_to_le32(IWL_WOWLAN_WAKEUP_REMOTE_LINK_LOSS |
                                     IWL_WOWLAN_WAKEUP_REMOTE_SIGNATURE_TABLE |
                                     IWL_WOWLAN_WAKEUP_REMOTE_WAKEUP_PACKET |
@@ -1150,9 +1023,7 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
                 }
         }
 
-        ret = iwl_mvm_send_cmd_pdu(mvm, WOWLAN_CONFIGURATION,
-                                   CMD_SYNC, sizeof(wowlan_config_cmd),
-                                   &wowlan_config_cmd);
+        ret = iwl_mvm_send_wowlan_config_cmd(mvm, &wowlan_config_cmd);
         if (ret)
                 goto out;
 
@@ -1160,7 +1031,7 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
         if (ret)
                 goto out;
 
-        ret = iwl_mvm_send_proto_offload(mvm, vif);
+        ret = iwl_mvm_send_proto_offload(mvm, vif, false, CMD_SYNC);
         if (ret)
                 goto out;
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c b/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c
index f64e972191eb..9b59e1d7ae71 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c
@@ -312,6 +312,11 @@ static ssize_t iwl_dbgfs_reduced_txp_write(struct ieee80211_vif *vif,
         mutex_lock(&mvm->mutex);
 
         mvmsta = iwl_mvm_sta_from_staid_protected(mvm, mvmvif->ap_sta_id);
+        if (IS_ERR_OR_NULL(mvmsta)) {
+                mutex_unlock(&mvm->mutex);
+                return -ENOTCONN;
+        }
+
         mvmsta->bt_reduced_txpower_dbg = false;
         ret = iwl_mvm_bt_coex_reduced_txp(mvm, mvmvif->ap_sta_id,
                                           reduced_tx_power);
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
index e0ff43ed2482..1b52deea6081 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
@@ -60,11 +60,14 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  *****************************************************************************/
+#include <linux/vmalloc.h>
+
 #include "mvm.h"
 #include "sta.h"
 #include "iwl-io.h"
 #include "iwl-prph.h"
 #include "debugfs.h"
+#include "fw-error-dump.h"
 
 static ssize_t iwl_dbgfs_tx_flush_write(struct iwl_mvm *mvm, char *buf,
                                         size_t count, loff_t *ppos)
@@ -117,6 +120,51 @@ static ssize_t iwl_dbgfs_sta_drain_write(struct iwl_mvm *mvm, char *buf,
         return ret;
 }
 
+static int iwl_dbgfs_fw_error_dump_open(struct inode *inode, struct file *file)
+{
+        struct iwl_mvm *mvm = inode->i_private;
+        int ret;
+
+        if (!mvm)
+                return -EINVAL;
+
+        mutex_lock(&mvm->mutex);
+        if (!mvm->fw_error_dump) {
+                ret = -ENODATA;
+                goto out;
+        }
+
+        file->private_data = mvm->fw_error_dump;
+        mvm->fw_error_dump = NULL;
+        kfree(mvm->fw_error_sram);
+        mvm->fw_error_sram = NULL;
+        mvm->fw_error_sram_len = 0;
+        ret = 0;
+
+out:
+        mutex_unlock(&mvm->mutex);
+        return ret;
+}
+
+static ssize_t iwl_dbgfs_fw_error_dump_read(struct file *file,
+                                            char __user *user_buf,
+                                            size_t count, loff_t *ppos)
+{
+        struct iwl_fw_error_dump_file *dump_file = file->private_data;
+
+        return simple_read_from_buffer(user_buf, count, ppos,
+                                       dump_file,
+                                       le32_to_cpu(dump_file->file_len));
+}
+
+static int iwl_dbgfs_fw_error_dump_release(struct inode *inode,
+                                           struct file *file)
+{
+        vfree(file->private_data);
+
+        return 0;
+}
+
 static ssize_t iwl_dbgfs_sram_read(struct file *file, char __user *user_buf,
                                    size_t count, loff_t *ppos)
 {
@@ -350,6 +398,9 @@ static ssize_t iwl_dbgfs_bt_notif_read(struct file *file, char __user *user_buf,
                          le32_to_cpu(notif->secondary_ch_lut));
         pos += scnprintf(buf+pos, bufsz-pos, "bt_activity_grading = %d\n",
                          le32_to_cpu(notif->bt_activity_grading));
+        pos += scnprintf(buf+pos, bufsz-pos,
+                         "antenna isolation = %d CORUN LUT index = %d\n",
+                         mvm->last_ant_isol, mvm->last_corun_lut);
 
         mutex_unlock(&mvm->mutex);
 
@@ -392,6 +443,22 @@ static ssize_t iwl_dbgfs_bt_cmd_read(struct file *file, char __user *user_buf,
         return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
 
+static ssize_t
+iwl_dbgfs_bt_tx_prio_write(struct iwl_mvm *mvm, char *buf,
+                           size_t count, loff_t *ppos)
+{
+        u32 bt_tx_prio;
+
+        if (sscanf(buf, "%u", &bt_tx_prio) != 1)
+                return -EINVAL;
+        if (bt_tx_prio > 4)
+                return -EINVAL;
+
+        mvm->bt_tx_prio = bt_tx_prio;
+
+        return count;
+}
+
 #define PRINT_STATS_LE32(_str, _val)                                    \
                          pos += scnprintf(buf + pos, bufsz - pos,       \
                                           fmt_table, _str,              \
@@ -536,56 +603,60 @@ static ssize_t iwl_dbgfs_frame_stats_read(struct iwl_mvm *mvm,
                                           loff_t *ppos,
                                           struct iwl_mvm_frame_stats *stats)
 {
-        char *buff;
-        int pos = 0, idx, i;
+        char *buff, *pos, *endpos;
+        int idx, i;
         int ret;
-        size_t bufsz = 1024;
+        static const size_t bufsz = 1024;
 
         buff = kmalloc(bufsz, GFP_KERNEL);
         if (!buff)
                 return -ENOMEM;
 
         spin_lock_bh(&mvm->drv_stats_lock);
-        pos += scnprintf(buff + pos, bufsz - pos,
+
+        pos = buff;
+        endpos = pos + bufsz;
+
+        pos += scnprintf(pos, endpos - pos,
                          "Legacy/HT/VHT\t:\t%d/%d/%d\n",
                          stats->legacy_frames,
                          stats->ht_frames,
                          stats->vht_frames);
-        pos += scnprintf(buff + pos, bufsz - pos, "20/40/80\t:\t%d/%d/%d\n",
+        pos += scnprintf(pos, endpos - pos, "20/40/80\t:\t%d/%d/%d\n",
                          stats->bw_20_frames,
                          stats->bw_40_frames,
                          stats->bw_80_frames);
-        pos += scnprintf(buff + pos, bufsz - pos, "NGI/SGI\t\t:\t%d/%d\n",
+        pos += scnprintf(pos, endpos - pos, "NGI/SGI\t\t:\t%d/%d\n",
                          stats->ngi_frames,
                          stats->sgi_frames);
-        pos += scnprintf(buff + pos, bufsz - pos, "SISO/MIMO2\t:\t%d/%d\n",
+        pos += scnprintf(pos, endpos - pos, "SISO/MIMO2\t:\t%d/%d\n",
                          stats->siso_frames,
                          stats->mimo2_frames);
-        pos += scnprintf(buff + pos, bufsz - pos, "FAIL/SCSS\t:\t%d/%d\n",
+        pos += scnprintf(pos, endpos - pos, "FAIL/SCSS\t:\t%d/%d\n",
                          stats->fail_frames,
                          stats->success_frames);
-        pos += scnprintf(buff + pos, bufsz - pos, "MPDUs agg\t:\t%d\n",
+        pos += scnprintf(pos, endpos - pos, "MPDUs agg\t:\t%d\n",
                          stats->agg_frames);
-        pos += scnprintf(buff + pos, bufsz - pos, "A-MPDUs\t\t:\t%d\n",
+        pos += scnprintf(pos, endpos - pos, "A-MPDUs\t\t:\t%d\n",
                          stats->ampdu_count);
-        pos += scnprintf(buff + pos, bufsz - pos, "Avg MPDUs/A-MPDU:\t%d\n",
+        pos += scnprintf(pos, endpos - pos, "Avg MPDUs/A-MPDU:\t%d\n",
                          stats->ampdu_count > 0 ?
                          (stats->agg_frames / stats->ampdu_count) : 0);
 
-        pos += scnprintf(buff + pos, bufsz - pos, "Last Rates\n");
+        pos += scnprintf(pos, endpos - pos, "Last Rates\n");
 
         idx = stats->last_frame_idx - 1;
         for (i = 0; i < ARRAY_SIZE(stats->last_rates); i++) {
                 idx = (idx + 1) % ARRAY_SIZE(stats->last_rates);
                 if (stats->last_rates[idx] == 0)
                         continue;
-                pos += scnprintf(buff + pos, bufsz - pos, "Rate[%d]: ",
+                pos += scnprintf(pos, endpos - pos, "Rate[%d]: ",
                                  (int)(ARRAY_SIZE(stats->last_rates) - i));
-                pos += rs_pretty_print_rate(buff + pos, stats->last_rates[idx]);
+                pos += rs_pretty_print_rate(pos, stats->last_rates[idx]);
         }
         spin_unlock_bh(&mvm->drv_stats_lock);
 
-        ret = simple_read_from_buffer(user_buf, count, ppos, buff, pos);
+        ret = simple_read_from_buffer(user_buf, count, ppos, buff, pos - buff);
         kfree(buff);
 
         return ret;
@@ -1032,9 +1103,16 @@ MVM_DEBUGFS_READ_FILE_OPS(fw_rx_stats);
 MVM_DEBUGFS_READ_FILE_OPS(drv_rx_stats);
 MVM_DEBUGFS_WRITE_FILE_OPS(fw_restart, 10);
 MVM_DEBUGFS_WRITE_FILE_OPS(fw_nmi, 10);
+MVM_DEBUGFS_WRITE_FILE_OPS(bt_tx_prio, 10);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(scan_ant_rxchain, 8);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(d0i3_refs, 8);
 
+static const struct file_operations iwl_dbgfs_fw_error_dump_ops = {
+        .open = iwl_dbgfs_fw_error_dump_open,
+        .read = iwl_dbgfs_fw_error_dump_read,
+        .release = iwl_dbgfs_fw_error_dump_release,
+};
+
 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(bcast_filters, 256);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(bcast_filters_macs, 256);
@@ -1049,12 +1127,15 @@ int iwl_mvm_dbgfs_register(struct iwl_mvm *mvm, struct dentry *dbgfs_dir)
         struct dentry *bcast_dir __maybe_unused;
         char buf[100];
 
+        spin_lock_init(&mvm->drv_stats_lock);
+
         mvm->debugfs_dir = dbgfs_dir;
 
         MVM_DEBUGFS_ADD_FILE(tx_flush, mvm->debugfs_dir, S_IWUSR);
         MVM_DEBUGFS_ADD_FILE(sta_drain, mvm->debugfs_dir, S_IWUSR);
         MVM_DEBUGFS_ADD_FILE(sram, mvm->debugfs_dir, S_IWUSR | S_IRUSR);
         MVM_DEBUGFS_ADD_FILE(stations, dbgfs_dir, S_IRUSR);
+        MVM_DEBUGFS_ADD_FILE(fw_error_dump, dbgfs_dir, S_IRUSR);
         MVM_DEBUGFS_ADD_FILE(bt_notif, dbgfs_dir, S_IRUSR);
         MVM_DEBUGFS_ADD_FILE(bt_cmd, dbgfs_dir, S_IRUSR);
         if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_DEVICE_PS_CMD)
@@ -1064,6 +1145,7 @@ int iwl_mvm_dbgfs_register(struct iwl_mvm *mvm, struct dentry *dbgfs_dir)
         MVM_DEBUGFS_ADD_FILE(drv_rx_stats, mvm->debugfs_dir, S_IRUSR);
         MVM_DEBUGFS_ADD_FILE(fw_restart, mvm->debugfs_dir, S_IWUSR);
         MVM_DEBUGFS_ADD_FILE(fw_nmi, mvm->debugfs_dir, S_IWUSR);
+        MVM_DEBUGFS_ADD_FILE(bt_tx_prio, mvm->debugfs_dir, S_IWUSR);
         MVM_DEBUGFS_ADD_FILE(scan_ant_rxchain, mvm->debugfs_dir,
                              S_IWUSR | S_IRUSR);
         MVM_DEBUGFS_ADD_FILE(prph_reg, mvm->debugfs_dir, S_IWUSR | S_IRUSR);
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-bt-coex.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-coex.h
index 20b723d6270f..21877e5966a8 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-bt-coex.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-coex.h
@@ -77,6 +77,8 @@
  * @BT_COEX_3W:
  * @BT_COEX_NW:
  * @BT_COEX_SYNC2SCO:
+ * @BT_COEX_CORUNNING:
+ * @BT_COEX_MPLUT:
  *
  * The COEX_MODE must be set for each command. Even if it is not changed.
  */
@@ -88,6 +90,8 @@ enum iwl_bt_coex_flags {
         BT_COEX_3W                      = 0x2 << BT_COEX_MODE_POS,
         BT_COEX_NW                      = 0x3 << BT_COEX_MODE_POS,
         BT_COEX_SYNC2SCO                = BIT(7),
+        BT_COEX_CORUNNING               = BIT(8),
+        BT_COEX_MPLUT                   = BIT(9),
 };
 
 /*
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h
index 521997669c99..10fcc1a79ebd 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h
@@ -239,7 +239,7 @@ enum iwl_wowlan_wakeup_filters {
         IWL_WOWLAN_WAKEUP_BCN_FILTERING                 = BIT(16),
 }; /* WOWLAN_WAKEUP_FILTER_API_E_VER_4 */
 
-struct iwl_wowlan_config_cmd {
+struct iwl_wowlan_config_cmd_v2 {
         __le32 wakeup_filter;
         __le16 non_qos_seq;
         __le16 qos_seq[8];
@@ -247,6 +247,12 @@ struct iwl_wowlan_config_cmd {
         u8 is_11n_connection;
 } __packed; /* WOWLAN_CONFIG_API_S_VER_2 */
 
+struct iwl_wowlan_config_cmd_v3 {
+        struct iwl_wowlan_config_cmd_v2 common;
+        u8 offloading_tid;
+        u8 reserved[3];
+} __packed; /* WOWLAN_CONFIG_API_S_VER_3 */
+
 /*
  * WOWLAN_TSC_RSC_PARAMS
  */
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
index b674c2a2b51c..8e122f3a7a74 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
@@ -76,6 +76,8 @@
  * @TX_CMD_FLG_VHT_NDPA: mark frame is NDPA for VHT beamformer sequence
  * @TX_CMD_FLG_HT_NDPA: mark frame is NDPA for HT beamformer sequence
  * @TX_CMD_FLG_CSI_FDBK2HOST: mark to send feedback to host (only if good CRC)
+ * @TX_CMD_FLG_BT_PRIO_POS: the position of the BT priority (bit 11 is ignored
+ *      on old firmwares).
  * @TX_CMD_FLG_BT_DIS: disable BT priority for this frame
  * @TX_CMD_FLG_SEQ_CTL: set if FW should override the sequence control.
  *      Should be set for mgmt, non-QOS data, mcast, bcast and in scan command
@@ -107,6 +109,7 @@ enum iwl_tx_flags {
         TX_CMD_FLG_VHT_NDPA             = BIT(8),
         TX_CMD_FLG_HT_NDPA              = BIT(9),
         TX_CMD_FLG_CSI_FDBK2HOST        = BIT(10),
+        TX_CMD_FLG_BT_PRIO_POS          = 11,
         TX_CMD_FLG_BT_DIS               = BIT(12),
         TX_CMD_FLG_SEQ_CTL              = BIT(13),
         TX_CMD_FLG_MORE_FRAG            = BIT(14),
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api.h b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
index 807fa525cafe..6e75b52588de 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
@@ -70,7 +70,7 @@
 #include "fw-api-mac.h"
 #include "fw-api-power.h"
 #include "fw-api-d3.h"
-#include "fw-api-bt-coex.h"
+#include "fw-api-coex.h"
 
 /* maximal number of Tx queues in any platform */
 #define IWL_MVM_MAX_QUEUES      20
@@ -95,6 +95,7 @@ enum {
         /* PHY context commands */
         PHY_CONTEXT_CMD = 0x8,
         DBG_CFG = 0x9,
+        ANTENNA_COUPLING_NOTIFICATION = 0xa,
 
         /* station table */
         ADD_STA_KEY = 0x17,
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-error-dump.h b/drivers/net/wireless/iwlwifi/mvm/fw-error-dump.h
new file mode 100644
index 000000000000..58c8941c0d95
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-error-dump.h
@@ -0,0 +1,106 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2014 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called COPYING.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2014 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *****************************************************************************/
+
+#ifndef __fw_error_dump_h__
+#define __fw_error_dump_h__
+
+#include <linux/types.h>
+
+#define IWL_FW_ERROR_DUMP_BARKER        0x14789632
+
+/**
+ * enum iwl_fw_error_dump_type - types of data in the dump file
+ * @IWL_FW_ERROR_DUMP_SRAM:
+ * @IWL_FW_ERROR_DUMP_REG:
+ */
+enum iwl_fw_error_dump_type {
+        IWL_FW_ERROR_DUMP_SRAM = 0,
+        IWL_FW_ERROR_DUMP_REG = 1,
+
+        IWL_FW_ERROR_DUMP_MAX,
+};
+
+/**
+ * struct iwl_fw_error_dump_data - data for one type
+ * @type: %enum iwl_fw_error_dump_type
+ * @len: the length starting from %data - must be a multiplier of 4.
+ * @data: the data itself padded to be a multiplier of 4.
+ */
+struct iwl_fw_error_dump_data {
+        __le32 type;
+        __le32 len;
+        __u8 data[];
+} __packed __aligned(4);
+
+/**
+ * struct iwl_fw_error_dump_file - the layout of the header of the file
+ * @barker: must be %IWL_FW_ERROR_DUMP_BARKER
+ * @file_len: the length of all the file starting from %barker
+ * @data: array of %struct iwl_fw_error_dump_data
+ */
+struct iwl_fw_error_dump_file {
+        __le32 barker;
+        __le32 file_len;
+        u8 data[0];
+} __packed __aligned(4);
+
+#endif /* __fw_error_dump_h__ */
diff --git a/drivers/net/wireless/iwlwifi/mvm/led.c b/drivers/net/wireless/iwlwifi/mvm/led.c
index 6b4ea6bf8ffe..e3b3cf4dbd77 100644
--- a/drivers/net/wireless/iwlwifi/mvm/led.c
+++ b/drivers/net/wireless/iwlwifi/mvm/led.c
@@ -94,6 +94,8 @@ int iwl_mvm_leds_init(struct iwl_mvm *mvm)
         int ret;
 
         switch (mode) {
+        case IWL_LED_BLINK:
+                IWL_ERR(mvm, "Blink led mode not supported, used default\n");
         case IWL_LED_DEFAULT:
         case IWL_LED_RF_STATE:
                 mode = IWL_LED_RF_STATE;
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index c2ab6a3318cb..4dd9ff43b8b6 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -205,7 +205,7 @@ static const struct iwl_fw_bcast_filter iwl_mvm_default_bcast_filters[] = {
 
 void iwl_mvm_ref(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type)
 {
-        if (!mvm->trans->cfg->d0i3)
+        if (!iwl_mvm_is_d0i3_supported(mvm))
                 return;
 
         IWL_DEBUG_RPM(mvm, "Take mvm reference - type %d\n", ref_type);
@@ -215,7 +215,7 @@ void iwl_mvm_ref(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type)
 
 void iwl_mvm_unref(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type)
 {
-        if (!mvm->trans->cfg->d0i3)
+        if (!iwl_mvm_is_d0i3_supported(mvm))
                 return;
 
         IWL_DEBUG_RPM(mvm, "Leave mvm reference - type %d\n", ref_type);
@@ -228,7 +228,7 @@ iwl_mvm_unref_all_except(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref)
 {
         int i;
 
-        if (!mvm->trans->cfg->d0i3)
+        if (!iwl_mvm_is_d0i3_supported(mvm))
                 return;
 
         for_each_set_bit(i, mvm->ref_bitmap, IWL_MVM_REF_COUNT) {
@@ -295,7 +295,7 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
             !iwlwifi_mod_params.sw_crypto)
                 hw->flags |= IEEE80211_HW_MFP_CAPABLE;
 
-        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT) {
+        if (0 && mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT) {
                 hw->flags |= IEEE80211_HW_SUPPORTS_UAPSD;
                 hw->uapsd_queues = IWL_UAPSD_AC_INFO;
                 hw->uapsd_max_sp_len = IWL_UAPSD_MAX_SP;
@@ -365,7 +365,7 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
         else
                 hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
 
-        if (0 && mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_SCHED_SCAN) {
+        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_SCHED_SCAN) {
                 hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
                 hw->wiphy->max_sched_scan_ssids = PROBE_OPTION_MAX;
                 hw->wiphy->max_match_sets = IWL_SCAN_MAX_PROFILES;
@@ -375,8 +375,7 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
         }
 
         hw->wiphy->features |= NL80211_FEATURE_P2P_GO_CTWIN |
-                               NL80211_FEATURE_P2P_GO_OPPPS |
-                               NL80211_FEATURE_LOW_PRIORITY_SCAN;
+                               NL80211_FEATURE_P2P_GO_OPPPS;
 
         mvm->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
 
@@ -424,6 +423,47 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
         return ret;
 }
 
+static bool iwl_mvm_defer_tx(struct iwl_mvm *mvm,
+                             struct ieee80211_sta *sta,
+                             struct sk_buff *skb)
+{
+        struct iwl_mvm_sta *mvmsta;
+        bool defer = false;
+
+        /*
+         * double check the IN_D0I3 flag both before and after
+         * taking the spinlock, in order to prevent taking
+         * the spinlock when not needed.
+         */
+        if (likely(!test_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status)))
+                return false;
+
+        spin_lock(&mvm->d0i3_tx_lock);
+        /*
+         * testing the flag again ensures the skb dequeue
+         * loop (on d0i3 exit) hasn't run yet.
+         */
+        if (!test_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status))
+                goto out;
+
+        mvmsta = iwl_mvm_sta_from_mac80211(sta);
+        if (mvmsta->sta_id == IWL_MVM_STATION_COUNT ||
+            mvmsta->sta_id != mvm->d0i3_ap_sta_id)
+                goto out;
+
+        __skb_queue_tail(&mvm->d0i3_tx, skb);
+        ieee80211_stop_queues(mvm->hw);
+
+        /* trigger wakeup */
+        iwl_mvm_ref(mvm, IWL_MVM_REF_TX);
+        iwl_mvm_unref(mvm, IWL_MVM_REF_TX);
+
+        defer = true;
+out:
+        spin_unlock(&mvm->d0i3_tx_lock);
+        return defer;
+}
+
 static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
                            struct ieee80211_tx_control *control,
                            struct sk_buff *skb)
@@ -451,6 +491,8 @@ static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
                 sta = NULL;
 
         if (sta) {
+                if (iwl_mvm_defer_tx(mvm, sta, skb))
+                        return;
                 if (iwl_mvm_tx_skb(mvm, skb, sta))
                         goto drop;
                 return;
@@ -489,6 +531,7 @@ static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
         int ret;
+        bool tx_agg_ref = false;
 
         IWL_DEBUG_HT(mvm, "A-MPDU action on addr %pM tid %d: action %d\n",
                      sta->addr, tid, action);
@@ -496,6 +539,23 @@ static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
         if (!(mvm->nvm_data->sku_cap_11n_enable))
                 return -EACCES;
 
+        /* return from D0i3 before starting a new Tx aggregation */
+        if (action == IEEE80211_AMPDU_TX_START) {
+                iwl_mvm_ref(mvm, IWL_MVM_REF_TX_AGG);
+                tx_agg_ref = true;
+
+                /*
+                 * wait synchronously until D0i3 exit to get the correct
+                 * sequence number for the tid
+                 */
+                if (!wait_event_timeout(mvm->d0i3_exit_waitq,
+                          !test_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status), HZ)) {
+                        WARN_ON_ONCE(1);
+                        iwl_mvm_unref(mvm, IWL_MVM_REF_TX_AGG);
+                        return -EIO;
+                }
+        }
+
         mutex_lock(&mvm->mutex);
 
         switch (action) {
@@ -533,6 +593,13 @@ static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
         }
         mutex_unlock(&mvm->mutex);
 
+        /*
+         * If the tid is marked as started, we won't use it for offloaded
+         * traffic on the next D0i3 entry. It's safe to unref.
+         */
+        if (tx_agg_ref)
+                iwl_mvm_unref(mvm, IWL_MVM_REF_TX_AGG);
+
         return ret;
 }
 
@@ -557,6 +624,15 @@ static void iwl_mvm_cleanup_iterator(void *data, u8 *mac,
 
 static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
 {
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        static char *env[] = { "DRIVER=iwlwifi", "EVENT=error_dump", NULL };
+
+        iwl_mvm_fw_error_dump(mvm);
+
+        /* notify the userspace about the error we had */
+        kobject_uevent_env(&mvm->hw->wiphy->dev.kobj, KOBJ_CHANGE, env);
+#endif
+
         iwl_trans_stop_device(mvm->trans);
 
         mvm->scan_status = IWL_MVM_SCAN_NONE;
@@ -610,6 +686,7 @@ static void iwl_mvm_mac_restart_complete(struct ieee80211_hw *hw)
         mutex_lock(&mvm->mutex);
 
         clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
+        iwl_mvm_d0i3_enable_tx(mvm, NULL);
         ret = iwl_mvm_update_quotas(mvm, NULL);
         if (ret)
                 IWL_ERR(mvm, "Failed to update quotas after restart (%d)\n",
@@ -1255,6 +1332,7 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
                  */
                 iwl_mvm_remove_time_event(mvm, mvmvif,
                                           &mvmvif->time_event_data);
+                WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, CMD_SYNC));
         } else if (changes & (BSS_CHANGED_PS | BSS_CHANGED_P2P_PS |
                               BSS_CHANGED_QOS)) {
                 ret = iwl_mvm_power_update_mac(mvm, vif);
@@ -1437,8 +1515,6 @@ static int iwl_mvm_mac_hw_scan(struct ieee80211_hw *hw,
                                struct cfg80211_scan_request *req)
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
-        struct iwl_notification_wait wait_scan_done;
-        static const u8 scan_done_notif[] = { SCAN_OFFLOAD_COMPLETE, };
         int ret;
 
         if (req->n_channels == 0 || req->n_channels > MAX_NUM_SCAN_CHANNELS)
@@ -1448,22 +1524,11 @@ static int iwl_mvm_mac_hw_scan(struct ieee80211_hw *hw,
 
         switch (mvm->scan_status) {
         case IWL_MVM_SCAN_SCHED:
-                iwl_init_notification_wait(&mvm->notif_wait, &wait_scan_done,
-                                           scan_done_notif,
-                                           ARRAY_SIZE(scan_done_notif),
-                                           NULL, NULL);
-                iwl_mvm_sched_scan_stop(mvm);
-                ret = iwl_wait_notification(&mvm->notif_wait,
-                                            &wait_scan_done, HZ);
+                ret = iwl_mvm_sched_scan_stop(mvm);
                 if (ret) {
                         ret = -EBUSY;
                         goto out;
                 }
-                /* iwl_mvm_rx_scan_offload_complete_notif() will be called
-                 * soon but will not reset the scan status as it won't be
-                 * IWL_MVM_SCAN_SCHED any more since we queue the next scan
-                 * immediately (below)
-                 */
                 break;
         case IWL_MVM_SCAN_NONE:
                 break;
@@ -1479,7 +1544,8 @@ static int iwl_mvm_mac_hw_scan(struct ieee80211_hw *hw,
                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
 out:
         mutex_unlock(&mvm->mutex);
-
+        /* make sure to flush the Rx handler before the next scan arrives */
+        iwl_mvm_wait_for_async_handlers(mvm);
         return ret;
 }
 
@@ -1641,7 +1707,9 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
         } else if (old_state == IEEE80211_STA_ASSOC &&
                    new_state == IEEE80211_STA_AUTHORIZED) {
                 /* enable beacon filtering */
-                WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, CMD_SYNC));
+                if (vif->bss_conf.dtim_period)
+                        WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif,
+                                                             CMD_SYNC));
                 ret = 0;
         } else if (old_state == IEEE80211_STA_AUTHORIZED &&
                    new_state == IEEE80211_STA_ASSOC) {
@@ -1738,9 +1806,26 @@ static int iwl_mvm_mac_sched_scan_start(struct ieee80211_hw *hw,
 
         mutex_lock(&mvm->mutex);
 
-        if (mvm->scan_status != IWL_MVM_SCAN_NONE) {
-                IWL_DEBUG_SCAN(mvm,
-                               "SCHED SCAN request during internal scan - abort\n");
+        switch (mvm->scan_status) {
+        case IWL_MVM_SCAN_OS:
+                IWL_DEBUG_SCAN(mvm, "Stopping previous scan for sched_scan\n");
+                ret = iwl_mvm_cancel_scan(mvm);
+                if (ret) {
+                        ret = -EBUSY;
+                        goto out;
+                }
+
+                /*
+                 * iwl_mvm_rx_scan_complete() will be called soon but will
+                 * not reset the scan status as it won't be IWL_MVM_SCAN_OS
+                 * any more since we queue the next scan immediately (below).
+                 * We make sure it is called before the next scan starts by
+                 * flushing the async-handlers work.
+                 */
+                break;
+        case IWL_MVM_SCAN_NONE:
+                break;
+        default:
                 ret = -EBUSY;
                 goto out;
         }
@@ -1762,6 +1847,8 @@ err:
         mvm->scan_status = IWL_MVM_SCAN_NONE;
 out:
         mutex_unlock(&mvm->mutex);
+        /* make sure to flush the Rx handler before the next scan arrives */
+        iwl_mvm_wait_for_async_handlers(mvm);
         return ret;
 }
 
@@ -1769,12 +1856,14 @@ static int iwl_mvm_mac_sched_scan_stop(struct ieee80211_hw *hw,
                                        struct ieee80211_vif *vif)
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+        int ret;
 
         mutex_lock(&mvm->mutex);
-        iwl_mvm_sched_scan_stop(mvm);
+        ret = iwl_mvm_sched_scan_stop(mvm);
         mutex_unlock(&mvm->mutex);
+        iwl_mvm_wait_for_async_handlers(mvm);
 
-        return 0;
+        return ret;
 }
 
 static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index 302cf779c172..d564233a65da 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -230,6 +230,8 @@ enum iwl_mvm_ref_type {
         IWL_MVM_REF_P2P_CLIENT,
         IWL_MVM_REF_AP_IBSS,
         IWL_MVM_REF_USER,
+        IWL_MVM_REF_TX,
+        IWL_MVM_REF_TX_AGG,
 
         IWL_MVM_REF_COUNT,
 };
@@ -317,13 +319,13 @@ struct iwl_mvm_vif {
 
         bool seqno_valid;
         u16 seqno;
+#endif
 
 #if IS_ENABLED(CONFIG_IPV6)
         /* IPv6 addresses for WoWLAN */
         struct in6_addr target_ipv6_addrs[IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS_MAX];
         int num_target_ipv6_addrs;
 #endif
-#endif
 
 #ifdef CONFIG_IWLWIFI_DEBUGFS
         struct iwl_mvm *mvm;
@@ -346,6 +348,8 @@ iwl_mvm_vif_from_mac80211(struct ieee80211_vif *vif)
         return (void *)vif->drv_priv;
 }
 
+extern const u8 tid_to_mac80211_ac[];
+
 enum iwl_scan_status {
         IWL_MVM_SCAN_NONE,
         IWL_MVM_SCAN_OS,
@@ -571,6 +575,9 @@ struct iwl_mvm {
 
         /* -1 for always, 0 for never, >0 for that many times */
         s8 restart_fw;
+        void *fw_error_dump;
+        void *fw_error_sram;
+        u32 fw_error_sram_len;
 
         struct led_classdev led;
 
@@ -591,12 +598,20 @@ struct iwl_mvm {
 
         /* d0i3 */
         u8 d0i3_ap_sta_id;
+        bool d0i3_offloading;
         struct work_struct d0i3_exit_work;
+        struct sk_buff_head d0i3_tx;
+        /* sync d0i3_tx queue and IWL_MVM_STATUS_IN_D0I3 status flag */
+        spinlock_t d0i3_tx_lock;
+        wait_queue_head_t d0i3_exit_waitq;
 
         /* BT-Coex */
         u8 bt_kill_msk;
         struct iwl_bt_coex_profile_notif last_bt_notif;
         struct iwl_bt_coex_ci_cmd last_bt_ci_cmd;
+        u32 last_ant_isol;
+        u8 last_corun_lut;
+        u8 bt_tx_prio;
 
         /* Thermal Throttling and CTkill */
         struct iwl_mvm_tt_mgmt thermal_throttle;
@@ -630,6 +645,7 @@ enum iwl_mvm_status {
         IWL_MVM_STATUS_HW_CTKILL,
         IWL_MVM_STATUS_ROC_RUNNING,
         IWL_MVM_STATUS_IN_HW_RESTART,
+        IWL_MVM_STATUS_IN_D0I3,
 };
 
 static inline bool iwl_mvm_is_radio_killed(struct iwl_mvm *mvm)
@@ -656,6 +672,12 @@ iwl_mvm_sta_from_staid_protected(struct iwl_mvm *mvm, u8 sta_id)
         return iwl_mvm_sta_from_mac80211(sta);
 }
 
+static inline bool iwl_mvm_is_d0i3_supported(struct iwl_mvm *mvm)
+{
+        return mvm->trans->cfg->d0i3 &&
+               (mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_D0I3_SUPPORT);
+}
+
 extern const u8 iwl_mvm_ac_to_tx_fifo[];
 
 struct iwl_rate_info {
@@ -680,7 +702,10 @@ void iwl_mvm_hwrate_to_tx_rate(u32 rate_n_flags,
                                struct ieee80211_tx_rate *r);
 u8 iwl_mvm_mac80211_idx_to_hwrate(int rate_idx);
 void iwl_mvm_dump_nic_error_log(struct iwl_mvm *mvm);
-void iwl_mvm_dump_sram(struct iwl_mvm *mvm);
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm);
+void iwl_mvm_fw_error_sram_dump(struct iwl_mvm *mvm);
+#endif
 u8 first_antenna(u8 mask);
 u8 iwl_mvm_next_antenna(struct iwl_mvm *mvm, u8 valid, u8 last_idx);
 
@@ -706,6 +731,11 @@ static inline const char *iwl_mvm_get_tx_fail_reason(u32 status) { return ""; }
 int iwl_mvm_flush_tx_path(struct iwl_mvm *mvm, u32 tfd_msk, bool sync);
 void iwl_mvm_async_handlers_purge(struct iwl_mvm *mvm);
 
+static inline void iwl_mvm_wait_for_async_handlers(struct iwl_mvm *mvm)
+{
+        flush_work(&mvm->async_handlers_wk);
+}
+
 /* Statistics */
 int iwl_mvm_rx_reply_statistics(struct iwl_mvm *mvm,
                                 struct iwl_rx_cmd_buffer *rxb,
@@ -739,6 +769,9 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
                         struct iwl_device_cmd *cmd);
 int iwl_mvm_rx_radio_ver(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
                          struct iwl_device_cmd *cmd);
+int iwl_mvm_rx_ant_coupling_notif(struct iwl_mvm *mvm,
+                                  struct iwl_rx_cmd_buffer *rxb,
+                                  struct iwl_device_cmd *cmd);
 int iwl_mvm_rx_fw_error(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
                           struct iwl_device_cmd *cmd);
 int iwl_mvm_rx_card_state_notif(struct iwl_mvm *mvm,
@@ -793,7 +826,7 @@ int iwl_mvm_rx_scan_response(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
                              struct iwl_device_cmd *cmd);
 int iwl_mvm_rx_scan_complete(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
                              struct iwl_device_cmd *cmd);
-void iwl_mvm_cancel_scan(struct iwl_mvm *mvm);
+int iwl_mvm_cancel_scan(struct iwl_mvm *mvm);
 
 /* Scheduled scan */
 int iwl_mvm_rx_scan_offload_complete_notif(struct iwl_mvm *mvm,
@@ -807,7 +840,7 @@ int iwl_mvm_config_sched_scan_profiles(struct iwl_mvm *mvm,
                                        struct cfg80211_sched_scan_request *req);
 int iwl_mvm_sched_scan_start(struct iwl_mvm *mvm,
                              struct cfg80211_sched_scan_request *req);
-void iwl_mvm_sched_scan_stop(struct iwl_mvm *mvm);
+int iwl_mvm_sched_scan_stop(struct iwl_mvm *mvm);
 int iwl_mvm_rx_sched_scan_results(struct iwl_mvm *mvm,
                                   struct iwl_rx_cmd_buffer *rxb,
                                   struct iwl_device_cmd *cmd);
@@ -878,10 +911,17 @@ iwl_mvm_set_last_nonqos_seq(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 {
 }
 #endif
+void iwl_mvm_set_wowlan_qos_seq(struct iwl_mvm_sta *mvm_ap_sta,
+                                struct iwl_wowlan_config_cmd_v2 *cmd);
+int iwl_mvm_send_proto_offload(struct iwl_mvm *mvm,
+                               struct ieee80211_vif *vif,
+                               bool disable_offloading,
+                               u32 cmd_flags);
 
 /* D0i3 */
 void iwl_mvm_ref(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type);
 void iwl_mvm_unref(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type);
+void iwl_mvm_d0i3_enable_tx(struct iwl_mvm *mvm, __le16 *qos_seq);
 
 /* BT Coex */
 int iwl_send_bt_prio_tbl(struct iwl_mvm *mvm);
@@ -892,10 +932,12 @@ int iwl_mvm_rx_bt_coex_notif(struct iwl_mvm *mvm,
 void iwl_mvm_bt_rssi_event(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                            enum ieee80211_rssi_event rssi_event);
 void iwl_mvm_bt_coex_vif_change(struct iwl_mvm *mvm);
-u16 iwl_mvm_bt_coex_agg_time_limit(struct iwl_mvm *mvm,
-                                   struct ieee80211_sta *sta);
+u16 iwl_mvm_coex_agg_time_limit(struct iwl_mvm *mvm,
+                                struct ieee80211_sta *sta);
 bool iwl_mvm_bt_coex_is_mimo_allowed(struct iwl_mvm *mvm,
                                      struct ieee80211_sta *sta);
+u8 iwl_mvm_bt_coex_tx_prio(struct iwl_mvm *mvm, struct ieee80211_hdr *hdr,
+                           struct ieee80211_tx_info *info, u8 ac);
 int iwl_mvm_bt_coex_reduced_txp(struct iwl_mvm *mvm, u8 sta_id, bool enable);
 
 enum iwl_bt_kill_msk {
@@ -942,6 +984,8 @@ void iwl_mvm_update_smps(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 /* Low latency */
 int iwl_mvm_update_low_latency(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                                bool value);
+/* get SystemLowLatencyMode - only needed for beacon threshold? */
+bool iwl_mvm_low_latency(struct iwl_mvm *mvm);
 /* get VMACLowLatencyMode */
 static inline bool iwl_mvm_vif_low_latency(struct iwl_mvm_vif *mvmvif)
 {
diff --git a/drivers/net/wireless/iwlwifi/mvm/offloading.c b/drivers/net/wireless/iwlwifi/mvm/offloading.c
new file mode 100644
index 000000000000..9bfb95e89cfb
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/mvm/offloading.c
@@ -0,0 +1,215 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called COPYING.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+#include <net/ipv6.h>
+#include <net/addrconf.h>
+#include "mvm.h"
+
+void iwl_mvm_set_wowlan_qos_seq(struct iwl_mvm_sta *mvm_ap_sta,
+                                struct iwl_wowlan_config_cmd_v2 *cmd)
+{
+        int i;
+
+        /*
+         * For QoS counters, we store the one to use next, so subtract 0x10
+         * since the uCode will add 0x10 *before* using the value while we
+         * increment after using the value (i.e. store the next value to use).
+         */
+        for (i = 0; i < IWL_MAX_TID_COUNT; i++) {
+                u16 seq = mvm_ap_sta->tid_data[i].seq_number;
+                seq -= 0x10;
+                cmd->qos_seq[i] = cpu_to_le16(seq);
+        }
+}
+
+int iwl_mvm_send_proto_offload(struct iwl_mvm *mvm,
+                               struct ieee80211_vif *vif,
+                               bool disable_offloading,
+                               u32 cmd_flags)
+{
+        union {
+                struct iwl_proto_offload_cmd_v1 v1;
+                struct iwl_proto_offload_cmd_v2 v2;
+                struct iwl_proto_offload_cmd_v3_small v3s;
+                struct iwl_proto_offload_cmd_v3_large v3l;
+        } cmd = {};
+        struct iwl_host_cmd hcmd = {
+                .id = PROT_OFFLOAD_CONFIG_CMD,
+                .flags = cmd_flags,
+                .data[0] = &cmd,
+                .dataflags[0] = IWL_HCMD_DFL_DUP,
+        };
+        struct iwl_proto_offload_cmd_common *common;
+        u32 enabled = 0, size;
+        u32 capa_flags = mvm->fw->ucode_capa.flags;
+#if IS_ENABLED(CONFIG_IPV6)
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        int i;
+
+        if (capa_flags & IWL_UCODE_TLV_FLAGS_NEW_NSOFFL_SMALL ||
+            capa_flags & IWL_UCODE_TLV_FLAGS_NEW_NSOFFL_LARGE) {
+                struct iwl_ns_config *nsc;
+                struct iwl_targ_addr *addrs;
+                int n_nsc, n_addrs;
+                int c;
+
+                if (capa_flags & IWL_UCODE_TLV_FLAGS_NEW_NSOFFL_SMALL) {
+                        nsc = cmd.v3s.ns_config;
+                        n_nsc = IWL_PROTO_OFFLOAD_NUM_NS_CONFIG_V3S;
+                        addrs = cmd.v3s.targ_addrs;
+                        n_addrs = IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS_V3S;
+                } else {
+                        nsc = cmd.v3l.ns_config;
+                        n_nsc = IWL_PROTO_OFFLOAD_NUM_NS_CONFIG_V3L;
+                        addrs = cmd.v3l.targ_addrs;
+                        n_addrs = IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS_V3L;
+                }
+
+                if (mvmvif->num_target_ipv6_addrs)
+                        enabled |= IWL_D3_PROTO_OFFLOAD_NS;
+
+                /*
+                 * For each address we have (and that will fit) fill a target
+                 * address struct and combine for NS offload structs with the
+                 * solicited node addresses.
+                 */
+                for (i = 0, c = 0;
+                     i < mvmvif->num_target_ipv6_addrs &&
+                     i < n_addrs && c < n_nsc; i++) {
+                        struct in6_addr solicited_addr;
+                        int j;
+
+                        addrconf_addr_solict_mult(&mvmvif->target_ipv6_addrs[i],
+                                                  &solicited_addr);
+                        for (j = 0; j < c; j++)
+                                if (ipv6_addr_cmp(&nsc[j].dest_ipv6_addr,
+                                                  &solicited_addr) == 0)
+                                        break;
+                        if (j == c)
+                                c++;
+                        addrs[i].addr = mvmvif->target_ipv6_addrs[i];
+                        addrs[i].config_num = cpu_to_le32(j);
+                        nsc[j].dest_ipv6_addr = solicited_addr;
+                        memcpy(nsc[j].target_mac_addr, vif->addr, ETH_ALEN);
+                }
+
+                if (capa_flags & IWL_UCODE_TLV_FLAGS_NEW_NSOFFL_SMALL)
+                        cmd.v3s.num_valid_ipv6_addrs = cpu_to_le32(i);
+                else
+                        cmd.v3l.num_valid_ipv6_addrs = cpu_to_le32(i);
+        } else if (capa_flags & IWL_UCODE_TLV_FLAGS_D3_6_IPV6_ADDRS) {
+                if (mvmvif->num_target_ipv6_addrs) {
+                        enabled |= IWL_D3_PROTO_OFFLOAD_NS;
+                        memcpy(cmd.v2.ndp_mac_addr, vif->addr, ETH_ALEN);
+                }
+
+                BUILD_BUG_ON(sizeof(cmd.v2.target_ipv6_addr[0]) !=
+                             sizeof(mvmvif->target_ipv6_addrs[0]));
+
+                for (i = 0; i < min(mvmvif->num_target_ipv6_addrs,
+                                    IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS_V2); i++)
+                        memcpy(cmd.v2.target_ipv6_addr[i],
+                               &mvmvif->target_ipv6_addrs[i],
+                               sizeof(cmd.v2.target_ipv6_addr[i]));
+        } else {
+                if (mvmvif->num_target_ipv6_addrs) {
+                        enabled |= IWL_D3_PROTO_OFFLOAD_NS;
+                        memcpy(cmd.v1.ndp_mac_addr, vif->addr, ETH_ALEN);
+                }
+
+                BUILD_BUG_ON(sizeof(cmd.v1.target_ipv6_addr[0]) !=
+                             sizeof(mvmvif->target_ipv6_addrs[0]));
+
+                for (i = 0; i < min(mvmvif->num_target_ipv6_addrs,
+                                    IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS_V1); i++)
+                        memcpy(cmd.v1.target_ipv6_addr[i],
+                               &mvmvif->target_ipv6_addrs[i],
+                               sizeof(cmd.v1.target_ipv6_addr[i]));
+        }
+#endif
+
+        if (capa_flags & IWL_UCODE_TLV_FLAGS_NEW_NSOFFL_SMALL) {
+                common = &cmd.v3s.common;
+                size = sizeof(cmd.v3s);
+        } else if (capa_flags & IWL_UCODE_TLV_FLAGS_NEW_NSOFFL_LARGE) {
+                common = &cmd.v3l.common;
+                size = sizeof(cmd.v3l);
+        } else if (capa_flags & IWL_UCODE_TLV_FLAGS_D3_6_IPV6_ADDRS) {
+                common = &cmd.v2.common;
+                size = sizeof(cmd.v2);
+        } else {
+                common = &cmd.v1.common;
+                size = sizeof(cmd.v1);
+        }
+
+        if (vif->bss_conf.arp_addr_cnt) {
+                enabled |= IWL_D3_PROTO_OFFLOAD_ARP;
+                common->host_ipv4_addr = vif->bss_conf.arp_addr_list[0];
+                memcpy(common->arp_mac_addr, vif->addr, ETH_ALEN);
+        }
+
+        if (!disable_offloading)
+                common->enabled = cpu_to_le32(enabled);
+
+        hcmd.len[0] = size;
+        return iwl_mvm_send_cmd(mvm, &hcmd);
+}
diff --git a/drivers/net/wireless/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwlwifi/mvm/ops.c
index ae347fb16a5d..9545d7fdd4bf 100644
--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
@@ -61,6 +61,7 @@
  *
  *****************************************************************************/
 #include <linux/module.h>
+#include <linux/vmalloc.h>
 #include <net/mac80211.h>
 
 #include "iwl-notif-wait.h"
@@ -78,6 +79,7 @@
 #include "iwl-prph.h"
 #include "rs.h"
 #include "fw-api-scan.h"
+#include "fw-error-dump.h"
 #include "time-event.h"
 
 /*
@@ -220,13 +222,15 @@ static const struct iwl_rx_handlers iwl_mvm_rx_handlers[] = {
         RX_HANDLER(BT_PROFILE_NOTIFICATION, iwl_mvm_rx_bt_coex_notif, true),
         RX_HANDLER(BEACON_NOTIFICATION, iwl_mvm_rx_beacon_notif, false),
         RX_HANDLER(STATISTICS_NOTIFICATION, iwl_mvm_rx_statistics, true),
+        RX_HANDLER(ANTENNA_COUPLING_NOTIFICATION,
+                   iwl_mvm_rx_ant_coupling_notif, true),
 
         RX_HANDLER(TIME_EVENT_NOTIFICATION, iwl_mvm_rx_time_event_notif, false),
 
         RX_HANDLER(EOSP_NOTIFICATION, iwl_mvm_rx_eosp_notif, false),
 
         RX_HANDLER(SCAN_REQUEST_CMD, iwl_mvm_rx_scan_response, false),
-        RX_HANDLER(SCAN_COMPLETE_NOTIFICATION, iwl_mvm_rx_scan_complete, false),
+        RX_HANDLER(SCAN_COMPLETE_NOTIFICATION, iwl_mvm_rx_scan_complete, true),
         RX_HANDLER(SCAN_OFFLOAD_COMPLETE,
                    iwl_mvm_rx_scan_offload_complete_notif, true),
         RX_HANDLER(MATCH_FOUND_NOTIFICATION, iwl_mvm_rx_sched_scan_results,
@@ -321,6 +325,7 @@ static const char *const iwl_mvm_cmd_strings[REPLY_MAX] = {
         CMD(MAC_PM_POWER_TABLE),
         CMD(BT_COEX_CI),
         CMD(PSM_UAPSD_AP_MISBEHAVING_NOTIFICATION),
+        CMD(ANTENNA_COUPLING_NOTIFICATION),
 };
 #undef CMD
 
@@ -407,6 +412,10 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         INIT_WORK(&mvm->sta_drained_wk, iwl_mvm_sta_drained_wk);
         INIT_WORK(&mvm->d0i3_exit_work, iwl_mvm_d0i3_exit_work);
 
+        spin_lock_init(&mvm->d0i3_tx_lock);
+        skb_queue_head_init(&mvm->d0i3_tx);
+        init_waitqueue_head(&mvm->d0i3_exit_waitq);
+
         SET_IEEE80211_DEV(mvm->hw, mvm->trans->dev);
 
         /*
@@ -527,6 +536,8 @@ static void iwl_op_mode_mvm_stop(struct iwl_op_mode *op_mode)
         ieee80211_unregister_hw(mvm->hw);
 
         kfree(mvm->scan_cmd);
+        vfree(mvm->fw_error_dump);
+        kfree(mvm->fw_error_sram);
         kfree(mvm->mcast_filter_cmd);
         mvm->mcast_filter_cmd = NULL;
 
@@ -690,7 +701,7 @@ void iwl_mvm_set_hw_ctkill_state(struct iwl_mvm *mvm, bool state)
         wiphy_rfkill_set_hw_state(mvm->hw->wiphy, iwl_mvm_is_radio_killed(mvm));
 }
 
-static void iwl_mvm_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
+static bool iwl_mvm_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
 {
         struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
 
@@ -699,9 +710,9 @@ static void iwl_mvm_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
         else
                 clear_bit(IWL_MVM_STATUS_HW_RFKILL, &mvm->status);
 
-        if (state && mvm->cur_ucode != IWL_UCODE_INIT)
-                iwl_trans_stop_device(mvm->trans);
         wiphy_rfkill_set_hw_state(mvm->hw->wiphy, iwl_mvm_is_radio_killed(mvm));
+
+        return state && mvm->cur_ucode != IWL_UCODE_INIT;
 }
 
 static void iwl_mvm_free_skb(struct iwl_op_mode *op_mode, struct sk_buff *skb)
@@ -797,13 +808,52 @@ static void iwl_mvm_nic_restart(struct iwl_mvm *mvm)
         }
 }
 
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm)
+{
+        struct iwl_fw_error_dump_file *dump_file;
+        struct iwl_fw_error_dump_data *dump_data;
+        u32 file_len;
+
+        lockdep_assert_held(&mvm->mutex);
+
+        if (mvm->fw_error_dump)
+                return;
+
+        file_len = mvm->fw_error_sram_len +
+                   sizeof(*dump_file) +
+                   sizeof(*dump_data);
+
+        dump_file = vmalloc(file_len);
+        if (!dump_file)
+                return;
+
+        mvm->fw_error_dump = dump_file;
+
+        dump_file->barker = cpu_to_le32(IWL_FW_ERROR_DUMP_BARKER);
+        dump_file->file_len = cpu_to_le32(file_len);
+        dump_data = (void *)dump_file->data;
+        dump_data->type = IWL_FW_ERROR_DUMP_SRAM;
+        dump_data->len = cpu_to_le32(mvm->fw_error_sram_len);
+
+        /*
+         * No need for lock since at the stage the FW isn't loaded. So it
+         * can't assert - we are the only one who can possibly be accessing
+         * mvm->fw_error_sram right now.
+         */
+        memcpy(dump_data->data, mvm->fw_error_sram, mvm->fw_error_sram_len);
+}
+#endif
+
 static void iwl_mvm_nic_error(struct iwl_op_mode *op_mode)
 {
         struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
 
         iwl_mvm_dump_nic_error_log(mvm);
-        if (!mvm->restart_fw)
-                iwl_mvm_dump_sram(mvm);
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        iwl_mvm_fw_error_sram_dump(mvm);
+#endif
 
         iwl_mvm_nic_restart(mvm);
 }
@@ -820,8 +870,62 @@ struct iwl_d0i3_iter_data {
         struct iwl_mvm *mvm;
         u8 ap_sta_id;
         u8 vif_count;
+        u8 offloading_tid;
+        bool disable_offloading;
 };
 
+static bool iwl_mvm_disallow_offloading(struct iwl_mvm *mvm,
+                                        struct ieee80211_vif *vif,
+                                        struct iwl_d0i3_iter_data *iter_data)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct ieee80211_sta *ap_sta;
+        struct iwl_mvm_sta *mvmsta;
+        u32 available_tids = 0;
+        u8 tid;
+
+        if (WARN_ON(vif->type != NL80211_IFTYPE_STATION ||
+                    mvmvif->ap_sta_id == IWL_MVM_STATION_COUNT))
+                return false;
+
+        ap_sta = rcu_dereference(mvm->fw_id_to_mac_id[mvmvif->ap_sta_id]);
+        if (IS_ERR_OR_NULL(ap_sta))
+                return false;
+
+        mvmsta = iwl_mvm_sta_from_mac80211(ap_sta);
+        spin_lock_bh(&mvmsta->lock);
+        for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++) {
+                struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
+
+                /*
+                 * in case of pending tx packets, don't use this tid
+                 * for offloading in order to prevent reuse of the same
+                 * qos seq counters.
+                 */
+                if (iwl_mvm_tid_queued(tid_data))
+                        continue;
+
+                if (tid_data->state != IWL_AGG_OFF)
+                        continue;
+
+                available_tids |= BIT(tid);
+        }
+        spin_unlock_bh(&mvmsta->lock);
+
+        /*
+         * disallow protocol offloading if we have no available tid
+         * (with no pending frames and no active aggregation,
+         * as we don't handle "holes" properly - the scheduler needs the
+         * frame's seq number and TFD index to match)
+         */
+        if (!available_tids)
+                return true;
+
+        /* for simplicity, just use the first available tid */
+        iter_data->offloading_tid = ffs(available_tids) - 1;
+        return false;
+}
+
 static void iwl_mvm_enter_d0i3_iterator(void *_data, u8 *mac,
                                         struct ieee80211_vif *vif)
 {
@@ -835,7 +939,16 @@ static void iwl_mvm_enter_d0i3_iterator(void *_data, u8 *mac,
             !vif->bss_conf.assoc)
                 return;
 
+        /*
+         * in case of pending tx packets or active aggregations,
+         * avoid offloading features in order to prevent reuse of
+         * the same qos seq counters.
+         */
+        if (iwl_mvm_disallow_offloading(mvm, vif, data))
+                data->disable_offloading = true;
+
         iwl_mvm_update_d0i3_power_mode(mvm, vif, true, flags);
+        iwl_mvm_send_proto_offload(mvm, vif, data->disable_offloading, flags);
 
         /*
          * on init/association, mvm already configures POWER_TABLE_CMD
@@ -847,6 +960,34 @@ static void iwl_mvm_enter_d0i3_iterator(void *_data, u8 *mac,
         data->vif_count++;
 }
 
+static void iwl_mvm_set_wowlan_data(struct iwl_mvm *mvm,
+                                    struct iwl_wowlan_config_cmd_v3 *cmd,
+                                    struct iwl_d0i3_iter_data *iter_data)
+{
+        struct ieee80211_sta *ap_sta;
+        struct iwl_mvm_sta *mvm_ap_sta;
+
+        if (iter_data->ap_sta_id == IWL_MVM_STATION_COUNT)
+                return;
+
+        rcu_read_lock();
+
+        ap_sta = rcu_dereference(mvm->fw_id_to_mac_id[iter_data->ap_sta_id]);
+        if (IS_ERR_OR_NULL(ap_sta))
+                goto out;
+
+        mvm_ap_sta = iwl_mvm_sta_from_mac80211(ap_sta);
+        cmd->common.is_11n_connection = ap_sta->ht_cap.ht_supported;
+        cmd->offloading_tid = iter_data->offloading_tid;
+
+        /*
+         * The d0i3 uCode takes care of the nonqos counters,
+         * so configure only the qos seq ones.
+         */
+        iwl_mvm_set_wowlan_qos_seq(mvm_ap_sta, &cmd->common);
+out:
+        rcu_read_unlock();
+}
 static int iwl_mvm_enter_d0i3(struct iwl_op_mode *op_mode)
 {
         struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
@@ -855,11 +996,14 @@ static int iwl_mvm_enter_d0i3(struct iwl_op_mode *op_mode)
         struct iwl_d0i3_iter_data d0i3_iter_data = {
                 .mvm = mvm,
         };
-        struct iwl_wowlan_config_cmd wowlan_config_cmd = {
-                .wakeup_filter = cpu_to_le32(IWL_WOWLAN_WAKEUP_RX_FRAME |
-                                             IWL_WOWLAN_WAKEUP_BEACON_MISS |
-                                             IWL_WOWLAN_WAKEUP_LINK_CHANGE |
-                                             IWL_WOWLAN_WAKEUP_BCN_FILTERING),
+        struct iwl_wowlan_config_cmd_v3 wowlan_config_cmd = {
+                .common = {
+                        .wakeup_filter =
+                                cpu_to_le32(IWL_WOWLAN_WAKEUP_RX_FRAME |
+                                            IWL_WOWLAN_WAKEUP_BEACON_MISS |
+                                            IWL_WOWLAN_WAKEUP_LINK_CHANGE |
+                                            IWL_WOWLAN_WAKEUP_BCN_FILTERING),
+                },
         };
         struct iwl_d3_manager_config d3_cfg_cmd = {
                 .min_sleep_time = cpu_to_le32(1000),
@@ -867,17 +1011,24 @@ static int iwl_mvm_enter_d0i3(struct iwl_op_mode *op_mode)
 
         IWL_DEBUG_RPM(mvm, "MVM entering D0i3\n");
 
+        /* make sure we have no running tx while configuring the qos */
+        set_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status);
+        synchronize_net();
+
         ieee80211_iterate_active_interfaces_atomic(mvm->hw,
                                                    IEEE80211_IFACE_ITER_NORMAL,
                                                    iwl_mvm_enter_d0i3_iterator,
                                                    &d0i3_iter_data);
         if (d0i3_iter_data.vif_count == 1) {
                 mvm->d0i3_ap_sta_id = d0i3_iter_data.ap_sta_id;
+                mvm->d0i3_offloading = !d0i3_iter_data.disable_offloading;
         } else {
                 WARN_ON_ONCE(d0i3_iter_data.vif_count > 1);
                 mvm->d0i3_ap_sta_id = IWL_MVM_STATION_COUNT;
+                mvm->d0i3_offloading = false;
         }
 
+        iwl_mvm_set_wowlan_data(mvm, &wowlan_config_cmd, &d0i3_iter_data);
         ret = iwl_mvm_send_cmd_pdu(mvm, WOWLAN_CONFIGURATION, flags,
                                    sizeof(wowlan_config_cmd),
                                    &wowlan_config_cmd);
@@ -914,6 +1065,62 @@ static void iwl_mvm_d0i3_disconnect_iter(void *data, u8 *mac,
                 ieee80211_connection_loss(vif);
 }
 
+void iwl_mvm_d0i3_enable_tx(struct iwl_mvm *mvm, __le16 *qos_seq)
+{
+        struct ieee80211_sta *sta = NULL;
+        struct iwl_mvm_sta *mvm_ap_sta;
+        int i;
+        bool wake_queues = false;
+
+        lockdep_assert_held(&mvm->mutex);
+
+        spin_lock_bh(&mvm->d0i3_tx_lock);
+
+        if (mvm->d0i3_ap_sta_id == IWL_MVM_STATION_COUNT)
+                goto out;
+
+        IWL_DEBUG_RPM(mvm, "re-enqueue packets\n");
+
+        /* get the sta in order to update seq numbers and re-enqueue skbs */
+        sta = rcu_dereference_protected(
+                        mvm->fw_id_to_mac_id[mvm->d0i3_ap_sta_id],
+                        lockdep_is_held(&mvm->mutex));
+
+        if (IS_ERR_OR_NULL(sta)) {
+                sta = NULL;
+                goto out;
+        }
+
+        if (mvm->d0i3_offloading && qos_seq) {
+                /* update qos seq numbers if offloading was enabled */
+                mvm_ap_sta = (struct iwl_mvm_sta *)sta->drv_priv;
+                for (i = 0; i < IWL_MAX_TID_COUNT; i++) {
+                        u16 seq = le16_to_cpu(qos_seq[i]);
+                        /* firmware stores last-used one, we store next one */
+                        seq += 0x10;
+                        mvm_ap_sta->tid_data[i].seq_number = seq;
+                }
+        }
+out:
+        /* re-enqueue (or drop) all packets */
+        while (!skb_queue_empty(&mvm->d0i3_tx)) {
+                struct sk_buff *skb = __skb_dequeue(&mvm->d0i3_tx);
+
+                if (!sta || iwl_mvm_tx_skb(mvm, skb, sta))
+                        ieee80211_free_txskb(mvm->hw, skb);
+
+                /* if the skb_queue is not empty, we need to wake queues */
+                wake_queues = true;
+        }
+        clear_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status);
+        wake_up(&mvm->d0i3_exit_waitq);
+        mvm->d0i3_ap_sta_id = IWL_MVM_STATION_COUNT;
+        if (wake_queues)
+                ieee80211_wake_queues(mvm->hw);
+
+        spin_unlock_bh(&mvm->d0i3_tx_lock);
+}
+
 static void iwl_mvm_d0i3_exit_work(struct work_struct *wk)
 {
         struct iwl_mvm *mvm = container_of(wk, struct iwl_mvm, d0i3_exit_work);
@@ -924,6 +1131,7 @@ static void iwl_mvm_d0i3_exit_work(struct work_struct *wk)
         struct iwl_wowlan_status_v6 *status;
         int ret;
         u32 disconnection_reasons, wakeup_reasons;
+        __le16 *qos_seq = NULL;
 
         mutex_lock(&mvm->mutex);
         ret = iwl_mvm_send_cmd(mvm, &get_status_cmd);
@@ -935,6 +1143,7 @@ static void iwl_mvm_d0i3_exit_work(struct work_struct *wk)
 
         status = (void *)get_status_cmd.resp_pkt->data;
         wakeup_reasons = le32_to_cpu(status->wakeup_reasons);
+        qos_seq = status->qos_seq_ctr;
 
         IWL_DEBUG_RPM(mvm, "wakeup reasons: 0x%x\n", wakeup_reasons);
 
@@ -948,6 +1157,7 @@ static void iwl_mvm_d0i3_exit_work(struct work_struct *wk)
 
         iwl_free_resp(&get_status_cmd);
 out:
+        iwl_mvm_d0i3_enable_tx(mvm, qos_seq);
         mutex_unlock(&mvm->mutex);
 }
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/power.c b/drivers/net/wireless/iwlwifi/mvm/power.c
index def6ec5173b9..6b636eab3339 100644
--- a/drivers/net/wireless/iwlwifi/mvm/power.c
+++ b/drivers/net/wireless/iwlwifi/mvm/power.c
@@ -511,6 +511,7 @@ int iwl_mvm_power_uapsd_misbehaving_ap_notif(struct iwl_mvm *mvm,
 struct iwl_power_constraint {
         struct ieee80211_vif *bf_vif;
         struct ieee80211_vif *bss_vif;
+        struct ieee80211_vif *p2p_vif;
         u16 bss_phyctx_id;
         u16 p2p_phyctx_id;
         bool pm_disabled;
@@ -546,6 +547,10 @@ static void iwl_mvm_power_iterator(void *_data, u8 *mac,
                 if (mvmvif->phy_ctxt)
                         power_iterator->p2p_phyctx_id = mvmvif->phy_ctxt->id;
 
+                /* we should have only one P2P vif */
+                WARN_ON(power_iterator->p2p_vif);
+                power_iterator->p2p_vif = vif;
+
                 IWL_DEBUG_POWER(mvm, "p2p: p2p_id=%d, bss_id=%d\n",
                                 power_iterator->p2p_phyctx_id,
                                 power_iterator->bss_phyctx_id);
@@ -633,16 +638,18 @@ int iwl_mvm_power_update_mac(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                         return ret;
         }
 
-        ret = iwl_mvm_power_send_cmd(mvm, vif);
-        if (ret)
-                return ret;
-
-        if (constraint.bss_vif && vif != constraint.bss_vif) {
+        if (constraint.bss_vif) {
                 ret = iwl_mvm_power_send_cmd(mvm, constraint.bss_vif);
                 if (ret)
                         return ret;
         }
 
+        if (constraint.p2p_vif) {
+                ret = iwl_mvm_power_send_cmd(mvm, constraint.p2p_vif);
+                if (ret)
+                        return ret;
+        }
+
         if (!constraint.bf_vif)
                 return 0;
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/quota.c b/drivers/net/wireless/iwlwifi/mvm/quota.c
index 06d8429be1fb..35e86e06dffd 100644
--- a/drivers/net/wireless/iwlwifi/mvm/quota.c
+++ b/drivers/net/wireless/iwlwifi/mvm/quota.c
@@ -180,7 +180,6 @@ int iwl_mvm_update_quotas(struct iwl_mvm *mvm, struct ieee80211_vif *newvif)
                 .colors = { -1, -1, -1, -1 },
                 .new_vif = newvif,
         };
-        u32 ll_max_duration;
 
         lockdep_assert_held(&mvm->mutex);
 
@@ -199,21 +198,6 @@ int iwl_mvm_update_quotas(struct iwl_mvm *mvm, struct ieee80211_vif *newvif)
                 iwl_mvm_quota_iterator(&data, newvif->addr, newvif);
         }
 
-        switch (data.n_low_latency_bindings) {
-        case 0: /* no low latency - use default */
-                ll_max_duration = 0;
-                break;
-        case 1: /* SingleBindingLowLatencyMode */
-                ll_max_duration = IWL_MVM_LOWLAT_SINGLE_BINDING_MAXDUR;
-                break;
-        case 2: /* DualBindingLowLatencyMode */
-                ll_max_duration = IWL_MVM_LOWLAT_DUAL_BINDING_MAXDUR;
-                break;
-        default: /* MultiBindingLowLatencyMode */
-                ll_max_duration = 0;
-                break;
-        }
-
         /*
          * The FW's scheduling session consists of
          * IWL_MVM_MAX_QUOTA fragments. Divide these fragments
@@ -278,7 +262,6 @@ int iwl_mvm_update_quotas(struct iwl_mvm *mvm, struct ieee80211_vif *newvif)
                          * binding.
                          */
                         cmd.quotas[idx].quota = cpu_to_le32(QUOTA_LOWLAT_MIN);
-
                 else
                         cmd.quotas[idx].quota =
                                 cpu_to_le32(quota * data.n_interfaces[i]);
@@ -287,11 +270,7 @@ int iwl_mvm_update_quotas(struct iwl_mvm *mvm, struct ieee80211_vif *newvif)
                           "Binding=%d, quota=%u > max=%u\n",
                           idx, le32_to_cpu(cmd.quotas[idx].quota), QUOTA_100);
 
-                if (data.n_interfaces[i] && !data.low_latency[i])
-                        cmd.quotas[idx].max_duration =
-                                cpu_to_le32(ll_max_duration);
-                else
-                        cmd.quotas[idx].max_duration = cpu_to_le32(0);
+                cmd.quotas[idx].max_duration = cpu_to_le32(0);
 
                 idx++;
         }
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c
index 399709f2be2e..568abd61b14f 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
@@ -211,9 +211,9 @@ static const struct rs_tx_column rs_tx_columns[] = {
                 .next_columns = {
                         RS_COLUMN_LEGACY_ANT_B,
                         RS_COLUMN_SISO_ANT_A,
+                        RS_COLUMN_SISO_ANT_B,
                         RS_COLUMN_MIMO2,
-                        RS_COLUMN_INVALID,
-                        RS_COLUMN_INVALID,
+                        RS_COLUMN_MIMO2_SGI,
                 },
         },
         [RS_COLUMN_LEGACY_ANT_B] = {
@@ -221,10 +221,10 @@ static const struct rs_tx_column rs_tx_columns[] = {
                 .ant = ANT_B,
                 .next_columns = {
                         RS_COLUMN_LEGACY_ANT_A,
+                        RS_COLUMN_SISO_ANT_A,
                         RS_COLUMN_SISO_ANT_B,
                         RS_COLUMN_MIMO2,
-                        RS_COLUMN_INVALID,
-                        RS_COLUMN_INVALID,
+                        RS_COLUMN_MIMO2_SGI,
                 },
         },
         [RS_COLUMN_SISO_ANT_A] = {
@@ -234,8 +234,8 @@ static const struct rs_tx_column rs_tx_columns[] = {
                         RS_COLUMN_SISO_ANT_B,
                         RS_COLUMN_MIMO2,
                         RS_COLUMN_SISO_ANT_A_SGI,
-                        RS_COLUMN_INVALID,
-                        RS_COLUMN_INVALID,
+                        RS_COLUMN_SISO_ANT_B_SGI,
+                        RS_COLUMN_MIMO2_SGI,
                 },
                 .checks = {
                         rs_siso_allow,
@@ -248,8 +248,8 @@ static const struct rs_tx_column rs_tx_columns[] = {
                         RS_COLUMN_SISO_ANT_A,
                         RS_COLUMN_MIMO2,
                         RS_COLUMN_SISO_ANT_B_SGI,
-                        RS_COLUMN_INVALID,
-                        RS_COLUMN_INVALID,
+                        RS_COLUMN_SISO_ANT_A_SGI,
+                        RS_COLUMN_MIMO2_SGI,
                 },
                 .checks = {
                         rs_siso_allow,
@@ -263,8 +263,8 @@ static const struct rs_tx_column rs_tx_columns[] = {
                         RS_COLUMN_SISO_ANT_B_SGI,
                         RS_COLUMN_MIMO2_SGI,
                         RS_COLUMN_SISO_ANT_A,
-                        RS_COLUMN_INVALID,
-                        RS_COLUMN_INVALID,
+                        RS_COLUMN_SISO_ANT_B,
+                        RS_COLUMN_MIMO2,
                 },
                 .checks = {
                         rs_siso_allow,
@@ -279,8 +279,8 @@ static const struct rs_tx_column rs_tx_columns[] = {
                         RS_COLUMN_SISO_ANT_A_SGI,
                         RS_COLUMN_MIMO2_SGI,
                         RS_COLUMN_SISO_ANT_B,
-                        RS_COLUMN_INVALID,
-                        RS_COLUMN_INVALID,
+                        RS_COLUMN_SISO_ANT_A,
+                        RS_COLUMN_MIMO2,
                 },
                 .checks = {
                         rs_siso_allow,
@@ -292,10 +292,10 @@ static const struct rs_tx_column rs_tx_columns[] = {
                 .ant = ANT_AB,
                 .next_columns = {
                         RS_COLUMN_SISO_ANT_A,
+                        RS_COLUMN_SISO_ANT_B,
+                        RS_COLUMN_SISO_ANT_A_SGI,
+                        RS_COLUMN_SISO_ANT_B_SGI,
                         RS_COLUMN_MIMO2_SGI,
-                        RS_COLUMN_INVALID,
-                        RS_COLUMN_INVALID,
-                        RS_COLUMN_INVALID,
                 },
                 .checks = {
                         rs_mimo_allow,
@@ -307,10 +307,10 @@ static const struct rs_tx_column rs_tx_columns[] = {
                 .sgi = true,
                 .next_columns = {
                         RS_COLUMN_SISO_ANT_A_SGI,
+                        RS_COLUMN_SISO_ANT_B_SGI,
+                        RS_COLUMN_SISO_ANT_A,
+                        RS_COLUMN_SISO_ANT_B,
                         RS_COLUMN_MIMO2,
-                        RS_COLUMN_INVALID,
-                        RS_COLUMN_INVALID,
-                        RS_COLUMN_INVALID,
                 },
                 .checks = {
                         rs_mimo_allow,
@@ -503,6 +503,14 @@ static void rs_rate_scale_clear_window(struct iwl_rate_scale_data *window)
         window->average_tpt = IWL_INVALID_VALUE;
 }
 
+static void rs_rate_scale_clear_tbl_windows(struct iwl_scale_tbl_info *tbl)
+{
+        int i;
+
+        for (i = 0; i < IWL_RATE_COUNT; i++)
+                rs_rate_scale_clear_window(&tbl->win[i]);
+}
+
 static inline u8 rs_is_valid_ant(u8 valid_antenna, u8 ant_type)
 {
         return (ant_type & valid_antenna) == ant_type;
@@ -566,19 +574,13 @@ static s32 get_expected_tpt(struct iwl_scale_tbl_info *tbl, int rs_index)
  * at this rate.  window->data contains the bitmask of successful
  * packets.
  */
-static int rs_collect_tx_data(struct iwl_scale_tbl_info *tbl,
-                              int scale_index, int attempts, int successes)
+static int _rs_collect_tx_data(struct iwl_scale_tbl_info *tbl,
+                               int scale_index, int attempts, int successes,
+                               struct iwl_rate_scale_data *window)
 {
-        struct iwl_rate_scale_data *window = NULL;
         static const u64 mask = (((u64)1) << (IWL_RATE_MAX_WINDOW - 1));
         s32 fail_count, tpt;
 
-        if (scale_index < 0 || scale_index >= IWL_RATE_COUNT)
-                return -EINVAL;
-
-        /* Select window for current tx bit rate */
-        window = &(tbl->win[scale_index]);
-
         /* Get expected throughput */
         tpt = get_expected_tpt(tbl, scale_index);
 
@@ -636,6 +638,21 @@ static int rs_collect_tx_data(struct iwl_scale_tbl_info *tbl,
         return 0;
 }
 
+static int rs_collect_tx_data(struct iwl_scale_tbl_info *tbl,
+                              int scale_index, int attempts, int successes)
+{
+        struct iwl_rate_scale_data *window = NULL;
+
+        if (scale_index < 0 || scale_index >= IWL_RATE_COUNT)
+                return -EINVAL;
+
+        /* Select window for current tx bit rate */
+        window = &(tbl->win[scale_index]);
+
+        return _rs_collect_tx_data(tbl, scale_index, attempts, successes,
+                                   window);
+}
+
 /* Convert rs_rate object into ucode rate bitmask */
 static u32 ucode_rate_from_rs_rate(struct iwl_mvm *mvm,
                                   struct rs_rate *rate)
@@ -1361,7 +1378,6 @@ static u32 rs_bw_from_sta_bw(struct ieee80211_sta *sta)
 static void rs_stay_in_table(struct iwl_lq_sta *lq_sta, bool force_search)
 {
         struct iwl_scale_tbl_info *tbl;
-        int i;
         int active_tbl;
         int flush_interval_passed = 0;
         struct iwl_mvm *mvm;
@@ -1422,9 +1438,7 @@ static void rs_stay_in_table(struct iwl_lq_sta *lq_sta, bool force_search)
 
                                 IWL_DEBUG_RATE(mvm,
                                                "LQ: stay in table clear win\n");
-                                for (i = 0; i < IWL_RATE_COUNT; i++)
-                                        rs_rate_scale_clear_window(
-                                                &(tbl->win[i]));
+                                rs_rate_scale_clear_tbl_windows(tbl);
                         }
                 }
 
@@ -1433,8 +1447,7 @@ static void rs_stay_in_table(struct iwl_lq_sta *lq_sta, bool force_search)
                  * "search" table). */
                 if (lq_sta->rs_state == RS_STATE_SEARCH_CYCLE_STARTED) {
                         IWL_DEBUG_RATE(mvm, "Clearing up window stats\n");
-                        for (i = 0; i < IWL_RATE_COUNT; i++)
-                                rs_rate_scale_clear_window(&(tbl->win[i]));
+                        rs_rate_scale_clear_tbl_windows(tbl);
                 }
         }
 }
@@ -1724,7 +1737,6 @@ static void rs_rate_scale_perform(struct iwl_mvm *mvm,
         int low = IWL_RATE_INVALID;
         int high = IWL_RATE_INVALID;
         int index;
-        int i;
         struct iwl_rate_scale_data *window = NULL;
         int current_tpt = IWL_INVALID_VALUE;
         int low_tpt = IWL_INVALID_VALUE;
@@ -2009,8 +2021,7 @@ lq_update:
                 if (lq_sta->search_better_tbl) {
                         /* Access the "search" table, clear its history. */
                         tbl = &(lq_sta->lq_info[(1 - lq_sta->active_tbl)]);
-                        for (i = 0; i < IWL_RATE_COUNT; i++)
-                                rs_rate_scale_clear_window(&(tbl->win[i]));
+                        rs_rate_scale_clear_tbl_windows(tbl);
 
                         /* Use new "search" start rate */
                         index = tbl->rate.index;
@@ -2331,8 +2342,7 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         lq_sta->lq.sta_id = sta_priv->sta_id;
 
         for (j = 0; j < LQ_SIZE; j++)
-                for (i = 0; i < IWL_RATE_COUNT; i++)
-                        rs_rate_scale_clear_window(&lq_sta->lq_info[j].win[i]);
+                rs_rate_scale_clear_tbl_windows(&lq_sta->lq_info[j]);
 
         lq_sta->flush_timer = 0;
 
@@ -2591,7 +2601,7 @@ static void rs_fill_lq_cmd(struct iwl_mvm *mvm,
 
         if (sta)
                 lq_cmd->agg_time_limit =
-                        cpu_to_le16(iwl_mvm_bt_coex_agg_time_limit(mvm, sta));
+                        cpu_to_le16(iwl_mvm_coex_agg_time_limit(mvm, sta));
 }
 
 static void *rs_alloc(struct ieee80211_hw *hw, struct dentry *debugfsdir)
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index 713efd71efe2..c91dc8498852 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -70,9 +70,16 @@
 
 #define IWL_PLCP_QUIET_THRESH 1
 #define IWL_ACTIVE_QUIET_TIME 10
-#define LONG_OUT_TIME_PERIOD 600
-#define SHORT_OUT_TIME_PERIOD 200
-#define SUSPEND_TIME_PERIOD 100
+
+struct iwl_mvm_scan_params {
+        u32 max_out_time;
+        u32 suspend_time;
+        bool passive_fragmented;
+        struct _dwell {
+                u16 passive;
+                u16 active;
+        } dwell[IEEE80211_NUM_BANDS];
+};
 
 static inline __le16 iwl_mvm_scan_rx_chain(struct iwl_mvm *mvm)
 {
@@ -90,24 +97,6 @@ static inline __le16 iwl_mvm_scan_rx_chain(struct iwl_mvm *mvm)
         return cpu_to_le16(rx_chain);
 }
 
-static inline __le32 iwl_mvm_scan_max_out_time(struct ieee80211_vif *vif,
-                                               u32 flags, bool is_assoc)
-{
-        if (!is_assoc)
-                return 0;
-        if (flags & NL80211_SCAN_FLAG_LOW_PRIORITY)
-                return cpu_to_le32(ieee80211_tu_to_usec(SHORT_OUT_TIME_PERIOD));
-        return cpu_to_le32(ieee80211_tu_to_usec(LONG_OUT_TIME_PERIOD));
-}
-
-static inline __le32 iwl_mvm_scan_suspend_time(struct ieee80211_vif *vif,
-                                               bool is_assoc)
-{
-        if (!is_assoc)
-                return 0;
-        return cpu_to_le32(ieee80211_tu_to_usec(SUSPEND_TIME_PERIOD));
-}
-
 static inline __le32
 iwl_mvm_scan_rxon_flags(struct cfg80211_scan_request *req)
 {
@@ -181,15 +170,14 @@ static u16 iwl_mvm_get_passive_dwell(enum ieee80211_band band)
 
 static void iwl_mvm_scan_fill_channels(struct iwl_scan_cmd *cmd,
                                        struct cfg80211_scan_request *req,
-                                       bool basic_ssid)
+                                       bool basic_ssid,
+                                       struct iwl_mvm_scan_params *params)
 {
-        u16 passive_dwell = iwl_mvm_get_passive_dwell(req->channels[0]->band);
-        u16 active_dwell = iwl_mvm_get_active_dwell(req->channels[0]->band,
-                                                    req->n_ssids);
         struct iwl_scan_channel *chan = (struct iwl_scan_channel *)
                 (cmd->data + le16_to_cpu(cmd->tx_cmd.len));
         int i;
         int type = BIT(req->n_ssids) - 1;
+        enum ieee80211_band band = req->channels[0]->band;
 
         if (!basic_ssid)
                 type |= BIT(req->n_ssids);
@@ -199,8 +187,8 @@ static void iwl_mvm_scan_fill_channels(struct iwl_scan_cmd *cmd,
                 chan->type = cpu_to_le32(type);
                 if (req->channels[i]->flags & IEEE80211_CHAN_NO_IR)
                         chan->type &= cpu_to_le32(~SCAN_CHANNEL_TYPE_ACTIVE);
-                chan->active_dwell = cpu_to_le16(active_dwell);
-                chan->passive_dwell = cpu_to_le16(passive_dwell);
+                chan->active_dwell = cpu_to_le16(params->dwell[band].active);
+                chan->passive_dwell = cpu_to_le16(params->dwell[band].passive);
                 chan->iteration_count = cpu_to_le16(1);
                 chan++;
         }
@@ -267,13 +255,76 @@ static u16 iwl_mvm_fill_probe_req(struct ieee80211_mgmt *frame, const u8 *ta,
         return (u16)len;
 }
 
-static void iwl_mvm_vif_assoc_iterator(void *data, u8 *mac,
-                                       struct ieee80211_vif *vif)
+static void iwl_mvm_scan_condition_iterator(void *data, u8 *mac,
+                                            struct ieee80211_vif *vif)
 {
-        bool *is_assoc = data;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        bool *global_bound = data;
 
-        if (vif->bss_conf.assoc)
-                *is_assoc = true;
+        if (mvmvif->phy_ctxt && mvmvif->phy_ctxt->id < MAX_PHYS)
+                *global_bound = true;
+}
+
+static void iwl_mvm_scan_calc_params(struct iwl_mvm *mvm,
+                                     struct ieee80211_vif *vif,
+                                     int n_ssids,
+                                     struct iwl_mvm_scan_params *params)
+{
+        bool global_bound = false;
+        enum ieee80211_band band;
+
+        ieee80211_iterate_active_interfaces_atomic(mvm->hw,
+                                            IEEE80211_IFACE_ITER_NORMAL,
+                                            iwl_mvm_scan_condition_iterator,
+                                            &global_bound);
+        /*
+         * Under low latency traffic passive scan is fragmented meaning
+         * that dwell on a particular channel will be fragmented. Each fragment
+         * dwell time is 20ms and fragments period is 105ms. Skipping to next
+         * channel will be delayed by the same period - 105ms. So suspend_time
+         * parameter describing both fragments and channels skipping periods is
+         * set to 105ms. This value is chosen so that overall passive scan
+         * duration will not be too long. Max_out_time in this case is set to
+         * 70ms, so for active scanning operating channel will be left for 70ms
+         * while for passive still for 20ms (fragment dwell).
+         */
+        if (global_bound) {
+                if (!iwl_mvm_low_latency(mvm)) {
+                        params->suspend_time = ieee80211_tu_to_usec(100);
+                        params->max_out_time = ieee80211_tu_to_usec(600);
+                } else {
+                        params->suspend_time = ieee80211_tu_to_usec(105);
+                        /* P2P doesn't support fragmented passive scan, so
+                         * configure max_out_time to be at least longest dwell
+                         * time for passive scan.
+                         */
+                        if (vif->type == NL80211_IFTYPE_STATION && !vif->p2p) {
+                                params->max_out_time = ieee80211_tu_to_usec(70);
+                                params->passive_fragmented = true;
+                        } else {
+                                u32 passive_dwell;
+
+                                /*
+                                 * Use band G so that passive channel dwell time
+                                 * will be assigned with maximum value.
+                                 */
+                                band = IEEE80211_BAND_2GHZ;
+                                passive_dwell = iwl_mvm_get_passive_dwell(band);
+                                params->max_out_time =
+                                        ieee80211_tu_to_usec(passive_dwell);
+                        }
+                }
+        }
+
+        for (band = IEEE80211_BAND_2GHZ; band < IEEE80211_NUM_BANDS; band++) {
+                if (params->passive_fragmented)
+                        params->dwell[band].passive = 20;
+                else
+                        params->dwell[band].passive =
+                                iwl_mvm_get_passive_dwell(band);
+                params->dwell[band].active = iwl_mvm_get_active_dwell(band,
+                                                                      n_ssids);
+        }
 }
 
 int iwl_mvm_scan_request(struct iwl_mvm *mvm,
@@ -288,13 +339,13 @@ int iwl_mvm_scan_request(struct iwl_mvm *mvm,
                 .dataflags = { IWL_HCMD_DFL_NOCOPY, },
         };
         struct iwl_scan_cmd *cmd = mvm->scan_cmd;
-        bool is_assoc = false;
         int ret;
         u32 status;
         int ssid_len = 0;
         u8 *ssid = NULL;
         bool basic_ssid = !(mvm->fw->ucode_capa.flags &
                            IWL_UCODE_TLV_FLAGS_NO_BASIC_SSID);
+        struct iwl_mvm_scan_params params = {};
 
         lockdep_assert_held(&mvm->mutex);
         BUG_ON(mvm->scan_cmd == NULL);
@@ -304,17 +355,18 @@ int iwl_mvm_scan_request(struct iwl_mvm *mvm,
         memset(cmd, 0, sizeof(struct iwl_scan_cmd) +
                mvm->fw->ucode_capa.max_probe_length +
                (MAX_NUM_SCAN_CHANNELS * sizeof(struct iwl_scan_channel)));
-        ieee80211_iterate_active_interfaces_atomic(mvm->hw,
-                                            IEEE80211_IFACE_ITER_NORMAL,
-                                            iwl_mvm_vif_assoc_iterator,
-                                            &is_assoc);
+
         cmd->channel_count = (u8)req->n_channels;
         cmd->quiet_time = cpu_to_le16(IWL_ACTIVE_QUIET_TIME);
         cmd->quiet_plcp_th = cpu_to_le16(IWL_PLCP_QUIET_THRESH);
         cmd->rxchain_sel_flags = iwl_mvm_scan_rx_chain(mvm);
-        cmd->max_out_time = iwl_mvm_scan_max_out_time(vif, req->flags,
-                                                      is_assoc);
-        cmd->suspend_time = iwl_mvm_scan_suspend_time(vif, is_assoc);
+
+        iwl_mvm_scan_calc_params(mvm, vif, req->n_ssids, &params);
+        cmd->max_out_time = cpu_to_le32(params.max_out_time);
+        cmd->suspend_time = cpu_to_le32(params.suspend_time);
+        if (params.passive_fragmented)
+                cmd->scan_flags |= SCAN_FLAGS_FRAGMENTED_SCAN;
+
         cmd->rxon_flags = iwl_mvm_scan_rxon_flags(req);
         cmd->filter_flags = cpu_to_le32(MAC_FILTER_ACCEPT_GRP |
                                         MAC_FILTER_IN_BEACON);
@@ -360,7 +412,7 @@ int iwl_mvm_scan_request(struct iwl_mvm *mvm,
                             req->ie, req->ie_len,
                             mvm->fw->ucode_capa.max_probe_length));
 
-        iwl_mvm_scan_fill_channels(cmd, req, basic_ssid);
+        iwl_mvm_scan_fill_channels(cmd, req, basic_ssid, &params);
 
         cmd->len = cpu_to_le16(sizeof(struct iwl_scan_cmd) +
                 le16_to_cpu(cmd->tx_cmd.len) +
@@ -402,10 +454,13 @@ int iwl_mvm_rx_scan_complete(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
         struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_scan_complete_notif *notif = (void *)pkt->data;
 
+        lockdep_assert_held(&mvm->mutex);
+
         IWL_DEBUG_SCAN(mvm, "Scan complete: status=0x%x scanned channels=%d\n",
                        notif->status, notif->scanned_channels);
 
-        mvm->scan_status = IWL_MVM_SCAN_NONE;
+        if (mvm->scan_status == IWL_MVM_SCAN_OS)
+                mvm->scan_status = IWL_MVM_SCAN_NONE;
         ieee80211_scan_completed(mvm->hw, notif->status != SCAN_COMP_STATUS_OK);
 
         iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
@@ -466,7 +521,7 @@ static bool iwl_mvm_scan_abort_notif(struct iwl_notif_wait_data *notif_wait,
         };
 }
 
-void iwl_mvm_cancel_scan(struct iwl_mvm *mvm)
+int iwl_mvm_cancel_scan(struct iwl_mvm *mvm)
 {
         struct iwl_notification_wait wait_scan_abort;
         static const u8 scan_abort_notif[] = { SCAN_ABORT_CMD,
@@ -474,13 +529,13 @@ void iwl_mvm_cancel_scan(struct iwl_mvm *mvm)
         int ret;
 
         if (mvm->scan_status == IWL_MVM_SCAN_NONE)
-                return;
+                return 0;
 
         if (iwl_mvm_is_radio_killed(mvm)) {
                 ieee80211_scan_completed(mvm->hw, true);
                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
                 mvm->scan_status = IWL_MVM_SCAN_NONE;
-                return;
+                return 0;
         }
 
         iwl_init_notification_wait(&mvm->notif_wait, &wait_scan_abort,
@@ -495,14 +550,11 @@ void iwl_mvm_cancel_scan(struct iwl_mvm *mvm)
                 goto out_remove_notif;
         }
 
-        ret = iwl_wait_notification(&mvm->notif_wait, &wait_scan_abort, 1 * HZ);
-        if (ret)
-                IWL_ERR(mvm, "%s - failed on timeout\n", __func__);
-
-        return;
+        return iwl_wait_notification(&mvm->notif_wait, &wait_scan_abort, HZ);
 
 out_remove_notif:
         iwl_remove_notification(&mvm->notif_wait, &wait_scan_abort);
+        return ret;
 }
 
 int iwl_mvm_rx_scan_offload_complete_notif(struct iwl_mvm *mvm,
@@ -519,10 +571,11 @@ int iwl_mvm_rx_scan_offload_complete_notif(struct iwl_mvm *mvm,
                        scan_notif->status == IWL_SCAN_OFFLOAD_COMPLETED ?
                        "completed" : "aborted");
 
-        /* might already be something else again, don't reset if so */
-        if (mvm->scan_status == IWL_MVM_SCAN_SCHED)
+        /* only call mac80211 completion if the stop was initiated by FW */
+        if (mvm->scan_status == IWL_MVM_SCAN_SCHED) {
                 mvm->scan_status = IWL_MVM_SCAN_NONE;
-        ieee80211_sched_scan_stopped(mvm->hw);
+                ieee80211_sched_scan_stopped(mvm->hw);
+        }
 
         return 0;
 }
@@ -553,14 +606,9 @@ static void iwl_scan_offload_build_tx_cmd(struct iwl_mvm *mvm,
 static void iwl_build_scan_cmd(struct iwl_mvm *mvm,
                                struct ieee80211_vif *vif,
                                struct cfg80211_sched_scan_request *req,
-                               struct iwl_scan_offload_cmd *scan)
+                               struct iwl_scan_offload_cmd *scan,
+                               struct iwl_mvm_scan_params *params)
 {
-        bool is_assoc = false;
-
-        ieee80211_iterate_active_interfaces_atomic(mvm->hw,
-                                            IEEE80211_IFACE_ITER_NORMAL,
-                                            iwl_mvm_vif_assoc_iterator,
-                                            &is_assoc);
         scan->channel_count =
                 mvm->nvm_data->bands[IEEE80211_BAND_2GHZ].n_channels +
                 mvm->nvm_data->bands[IEEE80211_BAND_5GHZ].n_channels;
@@ -568,13 +616,17 @@ static void iwl_build_scan_cmd(struct iwl_mvm *mvm,
         scan->quiet_plcp_th = cpu_to_le16(IWL_PLCP_QUIET_THRESH);
         scan->good_CRC_th = IWL_GOOD_CRC_TH_DEFAULT;
         scan->rx_chain = iwl_mvm_scan_rx_chain(mvm);
-        scan->max_out_time = iwl_mvm_scan_max_out_time(vif, req->flags,
-                                                       is_assoc);
-        scan->suspend_time = iwl_mvm_scan_suspend_time(vif, is_assoc);
+
+        scan->max_out_time = cpu_to_le32(params->max_out_time);
+        scan->suspend_time = cpu_to_le32(params->suspend_time);
+
         scan->filter_flags |= cpu_to_le32(MAC_FILTER_ACCEPT_GRP |
                                           MAC_FILTER_IN_BEACON);
         scan->scan_type = cpu_to_le32(SCAN_TYPE_BACKGROUND);
         scan->rep_count = cpu_to_le32(1);
+
+        if (params->passive_fragmented)
+                scan->scan_flags |= SCAN_FLAGS_FRAGMENTED_SCAN;
 }
 
 static int iwl_ssid_exist(u8 *ssid, u8 ssid_len, struct iwl_ssid_ie *ssid_list)
@@ -639,12 +691,11 @@ static void iwl_build_channel_cfg(struct iwl_mvm *mvm,
                                   struct iwl_scan_channel_cfg *channels,
                                   enum ieee80211_band band,
                                   int *head, int *tail,
-                                  u32 ssid_bitmap)
+                                  u32 ssid_bitmap,
+                                  struct iwl_mvm_scan_params *params)
 {
         struct ieee80211_supported_band *s_band;
-        int n_probes = req->n_ssids;
         int n_channels = req->n_channels;
-        u8 active_dwell, passive_dwell;
         int i, j, index = 0;
         bool partial;
 
@@ -654,8 +705,6 @@ static void iwl_build_channel_cfg(struct iwl_mvm *mvm,
          * to scan. So add requested channels to head of the list and others to
          * the end.
         */
-        active_dwell = iwl_mvm_get_active_dwell(band, n_probes);
-        passive_dwell = iwl_mvm_get_passive_dwell(band);
         s_band = &mvm->nvm_data->bands[band];
 
         for (i = 0; i < s_band->n_channels && *head <= *tail; i++) {
@@ -679,8 +728,8 @@ static void iwl_build_channel_cfg(struct iwl_mvm *mvm,
                 channels->channel_number[index] =
                         cpu_to_le16(ieee80211_frequency_to_channel(
                                         s_band->channels[i].center_freq));
-                channels->dwell_time[index][0] = active_dwell;
-                channels->dwell_time[index][1] = passive_dwell;
+                channels->dwell_time[index][0] = params->dwell[band].active;
+                channels->dwell_time[index][1] = params->dwell[band].passive;
 
                 channels->iter_count[index] = cpu_to_le16(1);
                 channels->iter_interval[index] = 0;
@@ -709,7 +758,6 @@ int iwl_mvm_config_sched_scan(struct iwl_mvm *mvm,
                               struct cfg80211_sched_scan_request *req,
                               struct ieee80211_sched_scan_ies *ies)
 {
-        int supported_bands = 0;
         int band_2ghz = mvm->nvm_data->bands[IEEE80211_BAND_2GHZ].n_channels;
         int band_5ghz = mvm->nvm_data->bands[IEEE80211_BAND_5GHZ].n_channels;
         int head = 0;
@@ -723,22 +771,19 @@ int iwl_mvm_config_sched_scan(struct iwl_mvm *mvm,
                 .id = SCAN_OFFLOAD_CONFIG_CMD,
                 .flags = CMD_SYNC,
         };
+        struct iwl_mvm_scan_params params = {};
 
         lockdep_assert_held(&mvm->mutex);
 
-        if (band_2ghz)
-                supported_bands++;
-        if (band_5ghz)
-                supported_bands++;
-
         cmd_len = sizeof(struct iwl_scan_offload_cfg) +
-                                supported_bands * SCAN_OFFLOAD_PROBE_REQ_SIZE;
+                  2 * SCAN_OFFLOAD_PROBE_REQ_SIZE;
 
         scan_cfg = kzalloc(cmd_len, GFP_KERNEL);
         if (!scan_cfg)
                 return -ENOMEM;
 
-        iwl_build_scan_cmd(mvm, vif, req, &scan_cfg->scan_cmd);
+        iwl_mvm_scan_calc_params(mvm, vif, req->n_ssids, &params);
+        iwl_build_scan_cmd(mvm, vif, req, &scan_cfg->scan_cmd, &params);
         scan_cfg->scan_cmd.len = cpu_to_le16(cmd_len);
 
         iwl_scan_offload_build_ssid(req, &scan_cfg->scan_cmd, &ssid_bitmap);
@@ -750,7 +795,7 @@ int iwl_mvm_config_sched_scan(struct iwl_mvm *mvm,
                                               scan_cfg->data);
                 iwl_build_channel_cfg(mvm, req, &scan_cfg->channel_cfg,
                                       IEEE80211_BAND_2GHZ, &head, &tail,
-                                      ssid_bitmap);
+                                      ssid_bitmap, &params);
         }
         if (band_5ghz) {
                 iwl_scan_offload_build_tx_cmd(mvm, vif, ies,
@@ -760,7 +805,7 @@ int iwl_mvm_config_sched_scan(struct iwl_mvm *mvm,
                                                 SCAN_OFFLOAD_PROBE_REQ_SIZE);
                 iwl_build_channel_cfg(mvm, req, &scan_cfg->channel_cfg,
                                       IEEE80211_BAND_5GHZ, &head, &tail,
-                                      ssid_bitmap);
+                                      ssid_bitmap, &params);
         }
 
         cmd.data[0] = scan_cfg;
@@ -900,26 +945,49 @@ static int iwl_mvm_send_sched_scan_abort(struct iwl_mvm *mvm)
                  * microcode has notified us that a scan is completed.
                  */
                 IWL_DEBUG_SCAN(mvm, "SCAN OFFLOAD ABORT ret %d.\n", status);
-                ret = -EIO;
+                ret = -ENOENT;
         }
 
         return ret;
 }
 
-void iwl_mvm_sched_scan_stop(struct iwl_mvm *mvm)
+int iwl_mvm_sched_scan_stop(struct iwl_mvm *mvm)
 {
         int ret;
+        struct iwl_notification_wait wait_scan_done;
+        static const u8 scan_done_notif[] = { SCAN_OFFLOAD_COMPLETE, };
 
         lockdep_assert_held(&mvm->mutex);
 
         if (mvm->scan_status != IWL_MVM_SCAN_SCHED) {
                 IWL_DEBUG_SCAN(mvm, "No offloaded scan to stop\n");
-                return;
+                return 0;
         }
 
+        iwl_init_notification_wait(&mvm->notif_wait, &wait_scan_done,
+                                   scan_done_notif,
+                                   ARRAY_SIZE(scan_done_notif),
+                                   NULL, NULL);
+
         ret = iwl_mvm_send_sched_scan_abort(mvm);
-        if (ret)
+        if (ret) {
                 IWL_DEBUG_SCAN(mvm, "Send stop offload scan failed %d\n", ret);
-        else
-                IWL_DEBUG_SCAN(mvm, "Successfully sent stop offload scan\n");
+                iwl_remove_notification(&mvm->notif_wait, &wait_scan_done);
+                return ret;
+        }
+
+        IWL_DEBUG_SCAN(mvm, "Successfully sent stop offload scan\n");
+
+        ret = iwl_wait_notification(&mvm->notif_wait, &wait_scan_done, 1 * HZ);
+        if (ret)
+                return ret;
+
+        /*
+         * Clear the scan status so the next scan requests will succeed. This
+         * also ensures the Rx handler doesn't do anything, as the scan was
+         * stopped from above.
+         */
+        mvm->scan_status = IWL_MVM_SCAN_NONE;
+
+        return 0;
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
index 2677d1c0e1a1..f339ef884250 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
@@ -851,7 +851,7 @@ static int iwl_mvm_sta_tx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         return ret;
 }
 
-static const u8 tid_to_mac80211_ac[] = {
+const u8 tid_to_mac80211_ac[] = {
         IEEE80211_AC_BE,
         IEEE80211_AC_BK,
         IEEE80211_AC_BK,
@@ -902,10 +902,18 @@ int iwl_mvm_sta_tx_agg_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                 return -EIO;
         }
 
+        spin_lock_bh(&mvmsta->lock);
+
+        /* possible race condition - we entered D0i3 while starting agg */
+        if (test_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status)) {
+                spin_unlock_bh(&mvmsta->lock);
+                IWL_ERR(mvm, "Entered D0i3 while starting Tx agg\n");
+                return -EIO;
+        }
+
         /* the new tx queue is still connected to the same mac80211 queue */
         mvm->queue_to_mac80211[txq_id] = vif->hw_queue[tid_to_mac80211_ac[tid]];
 
-        spin_lock_bh(&mvmsta->lock);
         tid_data = &mvmsta->tid_data[tid];
         tid_data->ssn = IEEE80211_SEQ_TO_SN(tid_data->seq_number);
         tid_data->txq_id = txq_id;
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index 0ba96654d2c3..879aeac46cc1 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -79,6 +79,7 @@ static void iwl_mvm_set_tx_cmd(struct iwl_mvm *mvm, struct sk_buff *skb,
         __le16 fc = hdr->frame_control;
         u32 tx_flags = le32_to_cpu(tx_cmd->tx_flags);
         u32 len = skb->len + FCS_LEN;
+        u8 ac;
 
         if (!(info->flags & IEEE80211_TX_CTL_NO_ACK))
                 tx_flags |= TX_CMD_FLG_ACK;
@@ -90,13 +91,6 @@ static void iwl_mvm_set_tx_cmd(struct iwl_mvm *mvm, struct sk_buff *skb,
         else if (ieee80211_is_back_req(fc))
                 tx_flags |= TX_CMD_FLG_ACK | TX_CMD_FLG_BAR;
 
-        /* High prio packet (wrt. BT coex) if it is EAPOL, MCAST or MGMT */
-        if (info->band == IEEE80211_BAND_2GHZ &&
-            (info->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO ||
-             is_multicast_ether_addr(hdr->addr1) ||
-             ieee80211_is_back_req(fc) || ieee80211_is_mgmt(fc)))
-                tx_flags |= TX_CMD_FLG_BT_DIS;
-
         if (ieee80211_has_morefrags(fc))
                 tx_flags |= TX_CMD_FLG_MORE_FRAG;
 
@@ -112,6 +106,11 @@ static void iwl_mvm_set_tx_cmd(struct iwl_mvm *mvm, struct sk_buff *skb,
                         tx_flags &= ~TX_CMD_FLG_SEQ_CTL;
         }
 
+        /* tid_tspec will default to 0 = BE when QOS isn't enabled */
+        ac = tid_to_mac80211_ac[tx_cmd->tid_tspec];
+        tx_flags |= iwl_mvm_bt_coex_tx_prio(mvm, hdr, info, ac) <<
+                        TX_CMD_FLG_BT_PRIO_POS;
+
         if (ieee80211_is_mgmt(fc)) {
                 if (ieee80211_is_assoc_req(fc) || ieee80211_is_reassoc_req(fc))
                         tx_cmd->pm_frame_timeout = cpu_to_le16(3);
@@ -128,9 +127,6 @@ static void iwl_mvm_set_tx_cmd(struct iwl_mvm *mvm, struct sk_buff *skb,
                 tx_cmd->pm_frame_timeout = 0;
         }
 
-        if (info->flags & IEEE80211_TX_CTL_AMPDU)
-                tx_flags |= TX_CMD_FLG_PROT_REQUIRE;
-
         if (ieee80211_is_data(fc) && len > mvm->rts_threshold &&
             !is_multicast_ether_addr(ieee80211_get_DA(hdr)))
                 tx_flags |= TX_CMD_FLG_PROT_REQUIRE;
diff --git a/drivers/net/wireless/iwlwifi/mvm/utils.c b/drivers/net/wireless/iwlwifi/mvm/utils.c
index bbfe529d7b64..d619851745a1 100644
--- a/drivers/net/wireless/iwlwifi/mvm/utils.c
+++ b/drivers/net/wireless/iwlwifi/mvm/utils.c
@@ -516,33 +516,26 @@ void iwl_mvm_dump_nic_error_log(struct iwl_mvm *mvm)
                 iwl_mvm_dump_umac_error_log(mvm);
 }
 
-void iwl_mvm_dump_sram(struct iwl_mvm *mvm)
+void iwl_mvm_fw_error_sram_dump(struct iwl_mvm *mvm)
 {
         const struct fw_img *img;
-        int ofs, len = 0;
-        int i;
-        __le32 *buf;
+        u32 ofs, sram_len;
+        void *sram;
 
-        if (!mvm->ucode_loaded)
+        if (!mvm->ucode_loaded || mvm->fw_error_sram)
                 return;
 
         img = &mvm->fw->img[mvm->cur_ucode];
         ofs = img->sec[IWL_UCODE_SECTION_DATA].offset;
-        len = img->sec[IWL_UCODE_SECTION_DATA].len;
+        sram_len = img->sec[IWL_UCODE_SECTION_DATA].len;
 
-        buf = kzalloc(len, GFP_ATOMIC);
-        if (!buf)
+        sram = kzalloc(sram_len, GFP_ATOMIC);
+        if (!sram)
                 return;
 
-        iwl_trans_read_mem_bytes(mvm->trans, ofs, buf, len);
-        len = len >> 2;
-        for (i = 0; i < len; i++) {
-                IWL_ERR(mvm, "0x%08X\n", le32_to_cpu(buf[i]));
-                /* Add a small delay to let syslog catch up */
-                udelay(10);
-        }
-
-        kfree(buf);
+        iwl_trans_read_mem_bytes(mvm->trans, ofs, sram, sram_len);
+        mvm->fw_error_sram = sram;
+        mvm->fw_error_sram_len = sram_len;
 }
 
 /**
@@ -619,6 +612,9 @@ int iwl_mvm_update_low_latency(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 
         lockdep_assert_held(&mvm->mutex);
 
+        if (mvmvif->low_latency == value)
+                return 0;
+
         mvmvif->low_latency = value;
 
         res = iwl_mvm_update_quotas(mvm, NULL);
@@ -629,3 +625,22 @@ int iwl_mvm_update_low_latency(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 
         return iwl_mvm_power_update_mac(mvm, vif);
 }
+
+static void iwl_mvm_ll_iter(void *_data, u8 *mac, struct ieee80211_vif *vif)
+{
+        bool *result = _data;
+
+        if (iwl_mvm_vif_low_latency(iwl_mvm_vif_from_mac80211(vif)))
+                *result = true;
+}
+
+bool iwl_mvm_low_latency(struct iwl_mvm *mvm)
+{
+        bool result = false;
+
+        ieee80211_iterate_active_interfaces_atomic(
+                        mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
+                        iwl_mvm_ll_iter, &result);
+
+        return result;
+}
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index 1f97631a82e4..edb015c99049 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -447,7 +447,8 @@ static void set_dflt_pwr_limit(struct iwl_trans *trans, struct pci_dev *pdev)
 
         pxsx_handle = ACPI_HANDLE(&pdev->dev);
         if (!pxsx_handle) {
-                IWL_ERR(trans, "Could not retrieve root port ACPI handle");
+                IWL_DEBUG_INFO(trans,
+                               "Could not retrieve root port ACPI handle");
                 return;
         }
 
@@ -559,7 +560,7 @@ static int iwl_pci_resume(struct device *device)
         iwl_enable_rfkill_int(trans);
 
         hw_rfkill = iwl_is_rfkill_set(trans);
-        iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill);
+        iwl_trans_pcie_rf_kill(trans, hw_rfkill);
 
         return 0;
 }
diff --git a/drivers/net/wireless/iwlwifi/pcie/internal.h b/drivers/net/wireless/iwlwifi/pcie/internal.h
index 3120bc5bb12d..9091513ea738 100644
--- a/drivers/net/wireless/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/iwlwifi/pcie/internal.h
@@ -488,4 +488,6 @@ static inline void __iwl_trans_pcie_set_bit(struct iwl_trans *trans,
         __iwl_trans_pcie_set_bits_mask(trans, reg, mask, mask);
 }
 
+void iwl_trans_pcie_rf_kill(struct iwl_trans *trans, bool state);
+
 #endif /* __iwl_trans_int_pcie_h__ */
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index cf49f6ce0ff8..fdfa3969cac9 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -994,7 +994,7 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
 
                 isr_stats->rfkill++;
 
-                iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill);
+                iwl_trans_pcie_rf_kill(trans, hw_rfkill);
                 if (hw_rfkill) {
                         set_bit(STATUS_RFKILL, &trans->status);
                         if (test_and_clear_bit(STATUS_SYNC_HCMD_ACTIVE,
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 84d471299e5a..dcfd6d866d09 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -75,6 +75,20 @@
 #include "iwl-agn-hw.h"
 #include "internal.h"
 
+static u32 iwl_trans_pcie_read_shr(struct iwl_trans *trans, u32 reg)
+{
+        iwl_write32(trans, HEEP_CTRL_WRD_PCIEX_CTRL_REG,
+                    ((reg & 0x0000ffff) | (2 << 28)));
+        return iwl_read32(trans, HEEP_CTRL_WRD_PCIEX_DATA_REG);
+}
+
+static void iwl_trans_pcie_write_shr(struct iwl_trans *trans, u32 reg, u32 val)
+{
+        iwl_write32(trans, HEEP_CTRL_WRD_PCIEX_DATA_REG, val);
+        iwl_write32(trans, HEEP_CTRL_WRD_PCIEX_CTRL_REG,
+                    ((reg & 0x0000ffff) | (3 << 28)));
+}
+
 static void iwl_pcie_set_pwr(struct iwl_trans *trans, bool vaux)
 {
         if (vaux && pci_pme_capable(to_pci_dev(trans->dev), PCI_D3cold))
@@ -229,6 +243,116 @@ out:
         return ret;
 }
 
+/*
+ * Enable LP XTAL to avoid HW bug where device may consume much power if
+ * FW is not loaded after device reset. LP XTAL is disabled by default
+ * after device HW reset. Do it only if XTAL is fed by internal source.
+ * Configure device's "persistence" mode to avoid resetting XTAL again when
+ * SHRD_HW_RST occurs in S3.
+ */
+static void iwl_pcie_apm_lp_xtal_enable(struct iwl_trans *trans)
+{
+        int ret;
+        u32 apmg_gp1_reg;
+        u32 apmg_xtal_cfg_reg;
+        u32 dl_cfg_reg;
+
+        /* Force XTAL ON */
+        __iwl_trans_pcie_set_bit(trans, CSR_GP_CNTRL,
+                                 CSR_GP_CNTRL_REG_FLAG_XTAL_ON);
+
+        /* Reset entire device - do controller reset (results in SHRD_HW_RST) */
+        iwl_set_bit(trans, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
+
+        udelay(10);
+
+        /*
+         * Set "initialization complete" bit to move adapter from
+         * D0U* --> D0A* (powered-up active) state.
+         */
+        iwl_set_bit(trans, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
+
+        /*
+         * Wait for clock stabilization; once stabilized, access to
+         * device-internal resources is possible.
+         */
+        ret = iwl_poll_bit(trans, CSR_GP_CNTRL,
+                           CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
+                           CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
+                           25000);
+        if (WARN_ON(ret < 0)) {
+                IWL_ERR(trans, "Access time out - failed to enable LP XTAL\n");
+                /* Release XTAL ON request */
+                __iwl_trans_pcie_clear_bit(trans, CSR_GP_CNTRL,
+                                           CSR_GP_CNTRL_REG_FLAG_XTAL_ON);
+                return;
+        }
+
+        /*
+         * Clear "disable persistence" to avoid LP XTAL resetting when
+         * SHRD_HW_RST is applied in S3.
+         */
+        iwl_clear_bits_prph(trans, APMG_PCIDEV_STT_REG,
+                                    APMG_PCIDEV_STT_VAL_PERSIST_DIS);
+
+        /*
+         * Force APMG XTAL to be active to prevent its disabling by HW
+         * caused by APMG idle state.
+         */
+        apmg_xtal_cfg_reg = iwl_trans_pcie_read_shr(trans,
+                                                    SHR_APMG_XTAL_CFG_REG);
+        iwl_trans_pcie_write_shr(trans, SHR_APMG_XTAL_CFG_REG,
+                                 apmg_xtal_cfg_reg |
+                                 SHR_APMG_XTAL_CFG_XTAL_ON_REQ);
+
+        /*
+         * Reset entire device again - do controller reset (results in
+         * SHRD_HW_RST). Turn MAC off before proceeding.
+         */
+        iwl_set_bit(trans, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
+
+        udelay(10);
+
+        /* Enable LP XTAL by indirect access through CSR */
+        apmg_gp1_reg = iwl_trans_pcie_read_shr(trans, SHR_APMG_GP1_REG);
+        iwl_trans_pcie_write_shr(trans, SHR_APMG_GP1_REG, apmg_gp1_reg |
+                                 SHR_APMG_GP1_WF_XTAL_LP_EN |
+                                 SHR_APMG_GP1_CHICKEN_BIT_SELECT);
+
+        /* Clear delay line clock power up */
+        dl_cfg_reg = iwl_trans_pcie_read_shr(trans, SHR_APMG_DL_CFG_REG);
+        iwl_trans_pcie_write_shr(trans, SHR_APMG_DL_CFG_REG, dl_cfg_reg &
+                                 ~SHR_APMG_DL_CFG_DL_CLOCK_POWER_UP);
+
+        /*
+         * Enable persistence mode to avoid LP XTAL resetting when
+         * SHRD_HW_RST is applied in S3.
+         */
+        iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
+                    CSR_HW_IF_CONFIG_REG_PERSIST_MODE);
+
+        /*
+         * Clear "initialization complete" bit to move adapter from
+         * D0A* (powered-up Active) --> D0U* (Uninitialized) state.
+         */
+        iwl_clear_bit(trans, CSR_GP_CNTRL,
+                      CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
+
+        /* Activates XTAL resources monitor */
+        __iwl_trans_pcie_set_bit(trans, CSR_MONITOR_CFG_REG,
+                                 CSR_MONITOR_XTAL_RESOURCES);
+
+        /* Release XTAL ON request */
+        __iwl_trans_pcie_clear_bit(trans, CSR_GP_CNTRL,
+                                   CSR_GP_CNTRL_REG_FLAG_XTAL_ON);
+        udelay(10);
+
+        /* Release APMG XTAL */
+        iwl_trans_pcie_write_shr(trans, SHR_APMG_XTAL_CFG_REG,
+                                 apmg_xtal_cfg_reg &
+                                 ~SHR_APMG_XTAL_CFG_XTAL_ON_REQ);
+}
+
 static int iwl_pcie_apm_stop_master(struct iwl_trans *trans)
 {
         int ret = 0;
@@ -256,6 +380,11 @@ static void iwl_pcie_apm_stop(struct iwl_trans *trans)
         /* Stop device's DMA activity */
         iwl_pcie_apm_stop_master(trans);
 
+        if (trans->cfg->lp_xtal_workaround) {
+                iwl_pcie_apm_lp_xtal_enable(trans);
+                return;
+        }
+
         /* Reset the entire device */
         iwl_set_bit(trans, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
 
@@ -641,7 +770,7 @@ static int iwl_trans_pcie_start_fw(struct iwl_trans *trans,
                 set_bit(STATUS_RFKILL, &trans->status);
         else
                 clear_bit(STATUS_RFKILL, &trans->status);
-        iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill);
+        iwl_trans_pcie_rf_kill(trans, hw_rfkill);
         if (hw_rfkill && !run_in_rfkill)
                 return -ERFKILL;
 
@@ -756,7 +885,13 @@ static void iwl_trans_pcie_stop_device(struct iwl_trans *trans)
         else
                 clear_bit(STATUS_RFKILL, &trans->status);
         if (hw_rfkill != was_hw_rfkill)
-                iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill);
+                iwl_trans_pcie_rf_kill(trans, hw_rfkill);
+}
+
+void iwl_trans_pcie_rf_kill(struct iwl_trans *trans, bool state)
+{
+        if (iwl_op_mode_hw_rf_kill(trans->op_mode, state))
+                iwl_trans_pcie_stop_device(trans);
 }
 
 static void iwl_trans_pcie_d3_suspend(struct iwl_trans *trans, bool test)
@@ -865,7 +1000,7 @@ static int iwl_trans_pcie_start_hw(struct iwl_trans *trans)
                 set_bit(STATUS_RFKILL, &trans->status);
         else
                 clear_bit(STATUS_RFKILL, &trans->status);
-        iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill);
+        iwl_trans_pcie_rf_kill(trans, hw_rfkill);
 
         return 0;
 }
@@ -1208,6 +1343,7 @@ static const char *get_csr_string(int cmd)
         IWL_CMD(CSR_GIO_CHICKEN_BITS);
         IWL_CMD(CSR_ANA_PLL_CFG);
         IWL_CMD(CSR_HW_REV_WA_REG);
+        IWL_CMD(CSR_MONITOR_STATUS_REG);
         IWL_CMD(CSR_DBG_HPET_MEM_REG);
         default:
                 return "UNKNOWN";
@@ -1240,6 +1376,7 @@ void iwl_pcie_dump_csr(struct iwl_trans *trans)
                 CSR_DRAM_INT_TBL_REG,
                 CSR_GIO_CHICKEN_BITS,
                 CSR_ANA_PLL_CFG,
+                CSR_MONITOR_STATUS_REG,
                 CSR_HW_REV_WA_REG,
                 CSR_DBG_HPET_MEM_REG
         };
diff --git a/drivers/net/wireless/mwifiex/11n.c b/drivers/net/wireless/mwifiex/11n.c
index d9c65b60cd72..d14ead8beca8 100644
--- a/drivers/net/wireless/mwifiex/11n.c
+++ b/drivers/net/wireless/mwifiex/11n.c
@@ -159,28 +159,34 @@ int mwifiex_ret_11n_addba_req(struct mwifiex_private *priv,
         int tid;
         struct host_cmd_ds_11n_addba_rsp *add_ba_rsp = &resp->params.add_ba_rsp;
         struct mwifiex_tx_ba_stream_tbl *tx_ba_tbl;
+        u16 block_ack_param_set = le16_to_cpu(add_ba_rsp->block_ack_param_set);
 
         add_ba_rsp->ssn = cpu_to_le16((le16_to_cpu(add_ba_rsp->ssn))
                         & SSN_MASK);
 
-        tid = (le16_to_cpu(add_ba_rsp->block_ack_param_set)
-                & IEEE80211_ADDBA_PARAM_TID_MASK)
-                >> BLOCKACKPARAM_TID_POS;
-        if (le16_to_cpu(add_ba_rsp->status_code) == BA_RESULT_SUCCESS) {
-                tx_ba_tbl = mwifiex_get_ba_tbl(priv, tid,
-                                                add_ba_rsp->peer_mac_addr);
-                if (tx_ba_tbl) {
-                        dev_dbg(priv->adapter->dev, "info: BA stream complete\n");
-                        tx_ba_tbl->ba_status = BA_SETUP_COMPLETE;
-                } else {
-                        dev_err(priv->adapter->dev, "BA stream not created\n");
-                }
-        } else {
+        tid = (block_ack_param_set & IEEE80211_ADDBA_PARAM_TID_MASK)
+               >> BLOCKACKPARAM_TID_POS;
+        if (le16_to_cpu(add_ba_rsp->status_code) != BA_RESULT_SUCCESS) {
                 mwifiex_del_ba_tbl(priv, tid, add_ba_rsp->peer_mac_addr,
                                    TYPE_DELBA_SENT, true);
                 if (add_ba_rsp->add_rsp_result != BA_RESULT_TIMEOUT)
                         priv->aggr_prio_tbl[tid].ampdu_ap =
                                 BA_STREAM_NOT_ALLOWED;
+                return 0;
+        }
+
+        tx_ba_tbl = mwifiex_get_ba_tbl(priv, tid, add_ba_rsp->peer_mac_addr);
+        if (tx_ba_tbl) {
+                dev_dbg(priv->adapter->dev, "info: BA stream complete\n");
+                tx_ba_tbl->ba_status = BA_SETUP_COMPLETE;
+                if ((block_ack_param_set & BLOCKACKPARAM_AMSDU_SUPP_MASK) &&
+                    priv->add_ba_param.tx_amsdu &&
+                    (priv->aggr_prio_tbl[tid].amsdu != BA_STREAM_NOT_ALLOWED))
+                        tx_ba_tbl->amsdu = true;
+                else
+                        tx_ba_tbl->amsdu = false;
+        } else {
+                dev_err(priv->adapter->dev, "BA stream not created\n");
         }
 
         return 0;
@@ -540,6 +546,7 @@ int mwifiex_send_addba(struct mwifiex_private *priv, int tid, u8 *peer_mac)
         u32 tx_win_size = priv->add_ba_param.tx_win_size;
         static u8 dialog_tok;
         int ret;
+        u16 block_ack_param_set;
 
         dev_dbg(priv->adapter->dev, "cmd: %s: tid %d\n", __func__, tid);
 
@@ -558,10 +565,16 @@ int mwifiex_send_addba(struct mwifiex_private *priv, int tid, u8 *peer_mac)
                         tx_win_size = MWIFIEX_11AC_STA_AMPDU_DEF_TXWINSIZE;
         }
 
-        add_ba_req.block_ack_param_set = cpu_to_le16(
-                (u16) ((tid << BLOCKACKPARAM_TID_POS) |
-                       tx_win_size << BLOCKACKPARAM_WINSIZE_POS |
-                       IMMEDIATE_BLOCK_ACK));
+        block_ack_param_set = (u16)((tid << BLOCKACKPARAM_TID_POS) |
+                                    tx_win_size << BLOCKACKPARAM_WINSIZE_POS |
+                                    IMMEDIATE_BLOCK_ACK);
+
+        /* enable AMSDU inside AMPDU */
+        if (priv->add_ba_param.tx_amsdu &&
+            (priv->aggr_prio_tbl[tid].amsdu != BA_STREAM_NOT_ALLOWED))
+                block_ack_param_set |= BLOCKACKPARAM_AMSDU_SUPP_MASK;
+
+        add_ba_req.block_ack_param_set = cpu_to_le16(block_ack_param_set);
         add_ba_req.block_ack_tmo = cpu_to_le16((u16)priv->add_ba_param.timeout);
 
         ++dialog_tok;
@@ -676,6 +689,7 @@ int mwifiex_get_tx_ba_stream_tbl(struct mwifiex_private *priv,
                 dev_dbg(priv->adapter->dev, "data: %s tid=%d\n",
                         __func__, rx_reo_tbl->tid);
                 memcpy(rx_reo_tbl->ra, tx_ba_tsr_tbl->ra, ETH_ALEN);
+                rx_reo_tbl->amsdu = tx_ba_tsr_tbl->amsdu;
                 rx_reo_tbl++;
                 count++;
                 if (count >= MWIFIEX_MAX_TX_BASTREAM_SUPPORTED)
@@ -731,5 +745,8 @@ void mwifiex_set_ba_params(struct mwifiex_private *priv)
                                                 MWIFIEX_STA_AMPDU_DEF_RXWINSIZE;
         }
 
+        priv->add_ba_param.tx_amsdu = true;
+        priv->add_ba_param.rx_amsdu = true;
+
         return;
 }
diff --git a/drivers/net/wireless/mwifiex/11n.h b/drivers/net/wireless/mwifiex/11n.h
index 12bb6acbdd58..40b007a00f4b 100644
--- a/drivers/net/wireless/mwifiex/11n.h
+++ b/drivers/net/wireless/mwifiex/11n.h
@@ -76,6 +76,20 @@ mwifiex_is_station_ampdu_allowed(struct mwifiex_private *priv,
         return (node->ampdu_sta[tid] != BA_STREAM_NOT_ALLOWED) ? true : false;
 }
 
+/* This function checks whether AMSDU is allowed for BA stream. */
+static inline u8
+mwifiex_is_amsdu_in_ampdu_allowed(struct mwifiex_private *priv,
+                                  struct mwifiex_ra_list_tbl *ptr, int tid)
+{
+        struct mwifiex_tx_ba_stream_tbl *tx_tbl;
+
+        tx_tbl = mwifiex_get_ba_tbl(priv, tid, ptr->ra);
+        if (tx_tbl)
+                return tx_tbl->amsdu;
+
+        return false;
+}
+
 /* This function checks whether AMPDU is allowed or not for a particular TID. */
 static inline u8
 mwifiex_is_ampdu_allowed(struct mwifiex_private *priv,
diff --git a/drivers/net/wireless/mwifiex/11n_rxreorder.c b/drivers/net/wireless/mwifiex/11n_rxreorder.c
index c3323c492614..0c3571f830b0 100644
--- a/drivers/net/wireless/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless/mwifiex/11n_rxreorder.c
@@ -26,6 +26,56 @@
 #include "11n.h"
 #include "11n_rxreorder.h"
 
+/* This function will dispatch amsdu packet and forward it to kernel/upper
+ * layer.
+ */
+static int mwifiex_11n_dispatch_amsdu_pkt(struct mwifiex_private *priv,
+                                          struct sk_buff *skb)
+{
+        struct rxpd *local_rx_pd = (struct rxpd *)(skb->data);
+        int ret;
+
+        if (le16_to_cpu(local_rx_pd->rx_pkt_type) == PKT_TYPE_AMSDU) {
+                struct sk_buff_head list;
+                struct sk_buff *rx_skb;
+
+                __skb_queue_head_init(&list);
+
+                skb_pull(skb, le16_to_cpu(local_rx_pd->rx_pkt_offset));
+                skb_trim(skb, le16_to_cpu(local_rx_pd->rx_pkt_length));
+
+                ieee80211_amsdu_to_8023s(skb, &list, priv->curr_addr,
+                                         priv->wdev->iftype, 0, false);
+
+                while (!skb_queue_empty(&list)) {
+                        rx_skb = __skb_dequeue(&list);
+                        ret = mwifiex_recv_packet(priv, rx_skb);
+                        if (ret == -1)
+                                dev_err(priv->adapter->dev,
+                                        "Rx of A-MSDU failed");
+                }
+                return 0;
+        }
+
+        return -1;
+}
+
+/* This function will process the rx packet and forward it to kernel/upper
+ * layer.
+ */
+static int mwifiex_11n_dispatch_pkt(struct mwifiex_private *priv, void *payload)
+{
+        int ret = mwifiex_11n_dispatch_amsdu_pkt(priv, payload);
+
+        if (!ret)
+                return 0;
+
+        if (priv->bss_role == MWIFIEX_BSS_ROLE_UAP)
+                return mwifiex_handle_uap_rx_forward(priv, payload);
+
+        return mwifiex_process_rx_packet(priv, payload);
+}
+
 /*
  * This function dispatches all packets in the Rx reorder table until the
  * start window.
@@ -35,8 +85,9 @@
  * circular buffer.
  */
 static void
-mwifiex_11n_dispatch_pkt(struct mwifiex_private *priv,
-                         struct mwifiex_rx_reorder_tbl *tbl, int start_win)
+mwifiex_11n_dispatch_pkt_until_start_win(struct mwifiex_private *priv,
+                                         struct mwifiex_rx_reorder_tbl *tbl,
+                                         int start_win)
 {
         int pkt_to_send, i;
         void *rx_tmp_ptr;
@@ -54,12 +105,8 @@ mwifiex_11n_dispatch_pkt(struct mwifiex_private *priv,
                         tbl->rx_reorder_ptr[i] = NULL;
                 }
                 spin_unlock_irqrestore(&priv->rx_pkt_lock, flags);
-                if (rx_tmp_ptr) {
-                        if (priv->bss_role == MWIFIEX_BSS_ROLE_UAP)
-                                mwifiex_handle_uap_rx_forward(priv, rx_tmp_ptr);
-                        else
-                                mwifiex_process_rx_packet(priv, rx_tmp_ptr);
-                }
+                if (rx_tmp_ptr)
+                        mwifiex_11n_dispatch_pkt(priv, rx_tmp_ptr);
         }
 
         spin_lock_irqsave(&priv->rx_pkt_lock, flags);
@@ -101,11 +148,7 @@ mwifiex_11n_scan_and_dispatch(struct mwifiex_private *priv,
                 rx_tmp_ptr = tbl->rx_reorder_ptr[i];
                 tbl->rx_reorder_ptr[i] = NULL;
                 spin_unlock_irqrestore(&priv->rx_pkt_lock, flags);
-
-                if (priv->bss_role == MWIFIEX_BSS_ROLE_UAP)
-                        mwifiex_handle_uap_rx_forward(priv, rx_tmp_ptr);
-                else
-                        mwifiex_process_rx_packet(priv, rx_tmp_ptr);
+                mwifiex_11n_dispatch_pkt(priv, rx_tmp_ptr);
         }
 
         spin_lock_irqsave(&priv->rx_pkt_lock, flags);
@@ -135,12 +178,13 @@ mwifiex_del_rx_reorder_entry(struct mwifiex_private *priv,
                              struct mwifiex_rx_reorder_tbl *tbl)
 {
         unsigned long flags;
+        int start_win;
 
         if (!tbl)
                 return;
 
-        mwifiex_11n_dispatch_pkt(priv, tbl, (tbl->start_win + tbl->win_size) &
-                                            (MAX_TID_VALUE - 1));
+        start_win = (tbl->start_win + tbl->win_size) & (MAX_TID_VALUE - 1);
+        mwifiex_11n_dispatch_pkt_until_start_win(priv, tbl, start_win);
 
         del_timer_sync(&tbl->timer_context.timer);
 
@@ -228,17 +272,17 @@ mwifiex_flush_data(unsigned long context)
 {
         struct reorder_tmr_cnxt *ctx =
                 (struct reorder_tmr_cnxt *) context;
-        int start_win;
+        int start_win, seq_num;
 
-        start_win = mwifiex_11n_find_last_seq_num(ctx->ptr);
+        seq_num = mwifiex_11n_find_last_seq_num(ctx->ptr);
 
-        if (start_win < 0)
+        if (seq_num < 0)
                 return;
 
-        dev_dbg(ctx->priv->adapter->dev, "info: flush data %d\n", start_win);
-        mwifiex_11n_dispatch_pkt(ctx->priv, ctx->ptr,
-                                 (ctx->ptr->start_win + start_win + 1) &
-                                 (MAX_TID_VALUE - 1));
+        dev_dbg(ctx->priv->adapter->dev, "info: flush data %d\n", seq_num);
+        start_win = (ctx->ptr->start_win + seq_num + 1) & (MAX_TID_VALUE - 1);
+        mwifiex_11n_dispatch_pkt_until_start_win(ctx->priv, ctx->ptr,
+                                                 start_win);
 }
 
 /*
@@ -267,7 +311,7 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
          */
         tbl = mwifiex_11n_get_rx_reorder_tbl(priv, tid, ta);
         if (tbl) {
-                mwifiex_11n_dispatch_pkt(priv, tbl, seq_num);
+                mwifiex_11n_dispatch_pkt_until_start_win(priv, tbl, seq_num);
                 return;
         }
         /* if !tbl then create one */
@@ -401,8 +445,11 @@ int mwifiex_cmd_11n_addba_rsp_gen(struct mwifiex_private *priv,
                 >> BLOCKACKPARAM_TID_POS;
         add_ba_rsp->status_code = cpu_to_le16(ADDBA_RSP_STATUS_ACCEPT);
         block_ack_param_set &= ~IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK;
-        /* We donot support AMSDU inside AMPDU, hence reset the bit */
-        block_ack_param_set &= ~BLOCKACKPARAM_AMSDU_SUPP_MASK;
+
+        /* If we don't support AMSDU inside AMPDU, reset the bit */
+        if (!priv->add_ba_param.rx_amsdu ||
+            (priv->aggr_prio_tbl[tid].amsdu == BA_STREAM_NOT_ALLOWED))
+                block_ack_param_set &= ~BLOCKACKPARAM_AMSDU_SUPP_MASK;
         block_ack_param_set |= rx_win_size << BLOCKACKPARAM_WINSIZE_POS;
         add_ba_rsp->block_ack_param_set = cpu_to_le16(block_ack_param_set);
         win_size = (le16_to_cpu(add_ba_rsp->block_ack_param_set)
@@ -459,14 +506,16 @@ int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *priv,
 
         tbl = mwifiex_11n_get_rx_reorder_tbl(priv, tid, ta);
         if (!tbl) {
-                if (pkt_type != PKT_TYPE_BAR) {
-                        if (priv->bss_role == MWIFIEX_BSS_ROLE_UAP)
-                                mwifiex_handle_uap_rx_forward(priv, payload);
-                        else
-                                mwifiex_process_rx_packet(priv, payload);
-                }
+                if (pkt_type != PKT_TYPE_BAR)
+                        mwifiex_11n_dispatch_pkt(priv, payload);
                 return 0;
         }
+
+        if ((pkt_type == PKT_TYPE_AMSDU) && !tbl->amsdu) {
+                mwifiex_11n_dispatch_pkt(priv, payload);
+                return 0;
+        }
+
         start_win = tbl->start_win;
         win_size = tbl->win_size;
         end_win = ((start_win + win_size) - 1) & (MAX_TID_VALUE - 1);
@@ -520,7 +569,7 @@ int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *priv,
                         start_win = (end_win - win_size) + 1;
                 else
                         start_win = (MAX_TID_VALUE - (win_size - seq_num)) + 1;
-                mwifiex_11n_dispatch_pkt(priv, tbl, start_win);
+                mwifiex_11n_dispatch_pkt_until_start_win(priv, tbl, start_win);
         }
 
         if (pkt_type != PKT_TYPE_BAR) {
@@ -611,16 +660,7 @@ int mwifiex_ret_11n_addba_resp(struct mwifiex_private *priv,
          * Check if we had rejected the ADDBA, if yes then do not create
          * the stream
          */
-        if (le16_to_cpu(add_ba_rsp->status_code) == BA_RESULT_SUCCESS) {
-                win_size = (block_ack_param_set &
-                        IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK)
-                        >> BLOCKACKPARAM_WINSIZE_POS;
-
-                dev_dbg(priv->adapter->dev,
-                        "cmd: ADDBA RSP: %pM tid=%d ssn=%d win_size=%d\n",
-                        add_ba_rsp->peer_mac_addr, tid,
-                        add_ba_rsp->ssn, win_size);
-        } else {
+        if (le16_to_cpu(add_ba_rsp->status_code) != BA_RESULT_SUCCESS) {
                 dev_err(priv->adapter->dev, "ADDBA RSP: failed %pM tid=%d)\n",
                         add_ba_rsp->peer_mac_addr, tid);
 
@@ -628,8 +668,28 @@ int mwifiex_ret_11n_addba_resp(struct mwifiex_private *priv,
                                                      add_ba_rsp->peer_mac_addr);
                 if (tbl)
                         mwifiex_del_rx_reorder_entry(priv, tbl);
+
+                return 0;
         }
 
+        win_size = (block_ack_param_set & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK)
+                    >> BLOCKACKPARAM_WINSIZE_POS;
+
+        tbl = mwifiex_11n_get_rx_reorder_tbl(priv, tid,
+                                             add_ba_rsp->peer_mac_addr);
+        if (tbl) {
+                if ((block_ack_param_set & BLOCKACKPARAM_AMSDU_SUPP_MASK) &&
+                    priv->add_ba_param.rx_amsdu &&
+                    (priv->aggr_prio_tbl[tid].amsdu != BA_STREAM_NOT_ALLOWED))
+                        tbl->amsdu = true;
+                else
+                        tbl->amsdu = false;
+        }
+
+        dev_dbg(priv->adapter->dev,
+                "cmd: ADDBA RSP: %pM tid=%d ssn=%d win_size=%d\n",
+                add_ba_rsp->peer_mac_addr, tid, add_ba_rsp->ssn, win_size);
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index 51ce99cfcfb9..21ee27ab7b74 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -1158,9 +1158,10 @@ static int mwifiex_cfg80211_set_bitrate_mask(struct wiphy *wiphy,
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
         u16 bitmap_rates[MAX_BITMAP_RATES_SIZE];
         enum ieee80211_band band;
+        struct mwifiex_adapter *adapter = priv->adapter;
 
         if (!priv->media_connected) {
-                dev_err(priv->adapter->dev,
+                dev_err(adapter->dev,
                         "Can not set Tx data rate in disconnected state\n");
                 return -EINVAL;
         }
@@ -1181,9 +1182,16 @@ static int mwifiex_cfg80211_set_bitrate_mask(struct wiphy *wiphy,
 
         /* Fill HT MCS rates */
         bitmap_rates[2] = mask->control[band].ht_mcs[0];
-        if (priv->adapter->hw_dev_mcs_support == HT_STREAM_2X2)
+        if (adapter->hw_dev_mcs_support == HT_STREAM_2X2)
                 bitmap_rates[2] |= mask->control[band].ht_mcs[1] << 8;
 
+       /* Fill VHT MCS rates */
+        if (adapter->fw_api_ver == MWIFIEX_FW_V15) {
+                bitmap_rates[10] = mask->control[band].vht_mcs[0];
+                if (adapter->hw_dev_mcs_support == HT_STREAM_2X2)
+                        bitmap_rates[11] = mask->control[band].vht_mcs[1];
+        }
+
         return mwifiex_send_cmd(priv, HostCmd_CMD_TX_RATE_CFG,
                                 HostCmd_ACT_GEN_SET, 0, bitmap_rates, true);
 }
@@ -2092,10 +2100,10 @@ mwifiex_setup_ht_caps(struct ieee80211_sta_ht_cap *ht_info,
         else
                 ht_info->cap &= ~IEEE80211_HT_CAP_SGI_40;
 
-        if (ISSUPP_RXSTBC(adapter->hw_dot_11n_dev_cap))
-                ht_info->cap |= 1 << IEEE80211_HT_CAP_RX_STBC_SHIFT;
+        if (adapter->user_dev_mcs_support == HT_STREAM_2X2)
+                ht_info->cap |= 3 << IEEE80211_HT_CAP_RX_STBC_SHIFT;
         else
-                ht_info->cap &= ~(3 << IEEE80211_HT_CAP_RX_STBC_SHIFT);
+                ht_info->cap |= 1 << IEEE80211_HT_CAP_RX_STBC_SHIFT;
 
         if (ISSUPP_TXSTBC(adapter->hw_dot_11n_dev_cap))
                 ht_info->cap |= IEEE80211_HT_CAP_TX_STBC;
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index 14e05c9f4663..b41155829220 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -1502,6 +1502,7 @@ int mwifiex_ret_get_hw_spec(struct mwifiex_private *priv,
         }
 
         adapter->fw_release_number = le32_to_cpu(hw_spec->fw_release_number);
+        adapter->fw_api_ver = (adapter->fw_release_number >> 16) & 0xff;
         adapter->number_of_antenna = le16_to_cpu(hw_spec->number_of_antenna);
 
         if (le32_to_cpu(hw_spec->dot_11ac_dev_cap)) {
diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
index 39cb3542f79c..b485dc1ae5eb 100644
--- a/drivers/net/wireless/mwifiex/fw.h
+++ b/drivers/net/wireless/mwifiex/fw.h
@@ -202,6 +202,11 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 
 #define MWIFIEX_DEF_AMPDU       IEEE80211_HT_AMPDU_PARM_FACTOR
 
+#define GET_RXSTBC(x) (x & IEEE80211_HT_CAP_RX_STBC)
+#define MWIFIEX_RX_STBC1        0x0100
+#define MWIFIEX_RX_STBC12       0x0200
+#define MWIFIEX_RX_STBC123      0x0300
+
 /* dev_cap bitmap
  * BIT
  * 0-16         reserved
@@ -515,6 +520,8 @@ enum P2P_MODES {
 #define ACT_TDLS_CREATE            0x01
 #define ACT_TDLS_CONFIG            0x02
 
+#define MWIFIEX_FW_V15             15
+
 struct mwifiex_ie_types_header {
         __le16 type;
         __le16 len;
@@ -1103,6 +1110,7 @@ struct mwifiex_rate_scope {
         __le16 hr_dsss_rate_bitmap;
         __le16 ofdm_rate_bitmap;
         __le16 ht_mcs_rate_bitmap[8];
+        __le16 vht_mcs_rate_bitmap[8];
 } __packed;
 
 struct mwifiex_rate_drop_pattern {
diff --git a/drivers/net/wireless/mwifiex/ioctl.h b/drivers/net/wireless/mwifiex/ioctl.h
index 1fb2212079ae..ee494db54060 100644
--- a/drivers/net/wireless/mwifiex/ioctl.h
+++ b/drivers/net/wireless/mwifiex/ioctl.h
@@ -177,6 +177,7 @@ struct mwifiex_ds_rx_reorder_tbl {
 struct mwifiex_ds_tx_ba_stream_tbl {
         u16 tid;
         u8 ra[ETH_ALEN];
+        u8 amsdu;
 };
 
 #define DBG_CMD_NUM     5
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index f0289c12e041..a67f7da12b30 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -116,7 +116,7 @@ enum {
 #define MWIFIEX_TYPE_DATA                               0
 #define MWIFIEX_TYPE_EVENT                              3
 
-#define MAX_BITMAP_RATES_SIZE                   10
+#define MAX_BITMAP_RATES_SIZE                   18
 
 #define MAX_CHANNEL_BAND_BG     14
 #define MAX_CHANNEL_BAND_A      165
@@ -192,6 +192,8 @@ struct mwifiex_add_ba_param {
         u32 tx_win_size;
         u32 rx_win_size;
         u32 timeout;
+        u8 tx_amsdu;
+        u8 rx_amsdu;
 };
 
 struct mwifiex_tx_aggr {
@@ -560,6 +562,7 @@ struct mwifiex_tx_ba_stream_tbl {
         int tid;
         u8 ra[ETH_ALEN];
         enum mwifiex_ba_status ba_status;
+        u8 amsdu;
 };
 
 struct mwifiex_rx_reorder_tbl;
@@ -579,6 +582,7 @@ struct mwifiex_rx_reorder_tbl {
         int win_size;
         void **rx_reorder_ptr;
         struct reorder_tmr_cnxt timer_context;
+        u8 amsdu;
         u8 flags;
 };
 
@@ -802,6 +806,7 @@ struct mwifiex_adapter {
         atomic_t pending_bridged_pkts;
         struct semaphore *card_sem;
         bool ext_scan;
+        u8 fw_api_ver;
         u8 fw_key_api_major_ver, fw_key_api_minor_ver;
 };
 
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index 9f1683b5f28f..57c353a94b29 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -327,6 +327,30 @@ static void mwifiex_pcie_dev_wakeup_delay(struct mwifiex_adapter *adapter)
         return;
 }
 
+static void mwifiex_delay_for_sleep_cookie(struct mwifiex_adapter *adapter,
+                                           u32 max_delay_loop_cnt)
+{
+        struct pcie_service_card *card = adapter->card;
+        u8 *buffer;
+        u32 sleep_cookie, count;
+
+        for (count = 0; count < max_delay_loop_cnt; count++) {
+                buffer = card->cmdrsp_buf->data - INTF_HEADER_LEN;
+                sleep_cookie = *(u32 *)buffer;
+
+                if (sleep_cookie == MWIFIEX_DEF_SLEEP_COOKIE) {
+                        dev_dbg(adapter->dev,
+                                "sleep cookie found at count %d\n", count);
+                        break;
+                }
+                usleep_range(20, 30);
+        }
+
+        if (count >= max_delay_loop_cnt)
+                dev_dbg(adapter->dev,
+                        "max count reached while accessing sleep cookie\n");
+}
+
 /* This function wakes up the card by reading fw_status register. */
 static int mwifiex_pm_wakeup_card(struct mwifiex_adapter *adapter)
 {
@@ -1539,6 +1563,8 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter)
                                          "Write register failed\n");
                                 return -1;
                         }
+                        mwifiex_delay_for_sleep_cookie(adapter,
+                                                       MWIFIEX_MAX_DELAY_COUNT);
                         while (reg->sleep_cookie && (count++ < 10) &&
                                mwifiex_pcie_ok_to_access_hw(adapter))
                                 usleep_range(50, 60);
diff --git a/drivers/net/wireless/mwifiex/pcie.h b/drivers/net/wireless/mwifiex/pcie.h
index 193af75bf582..e8ec561f8a64 100644
--- a/drivers/net/wireless/mwifiex/pcie.h
+++ b/drivers/net/wireless/mwifiex/pcie.h
@@ -97,6 +97,8 @@
 #define MWIFIEX_PCIE_BLOCK_SIZE_FW_DNLD         256
 /* FW awake cookie after FW ready */
 #define FW_AWAKE_COOKIE                                         (0xAA55AA55)
+#define MWIFIEX_DEF_SLEEP_COOKIE                        0xBEEFBEEF
+#define MWIFIEX_MAX_DELAY_COUNT                         5
 
 struct mwifiex_pcie_card_reg {
         u16 cmd_addr_lo;
diff --git a/drivers/net/wireless/mwifiex/sta_cmd.c b/drivers/net/wireless/mwifiex/sta_cmd.c
index 4315a3ba3b92..e3cac1495cc7 100644
--- a/drivers/net/wireless/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/mwifiex/sta_cmd.c
@@ -185,6 +185,13 @@ static int mwifiex_cmd_tx_rate_cfg(struct mwifiex_private *priv,
                      i++)
                         rate_scope->ht_mcs_rate_bitmap[i] =
                                 cpu_to_le16(pbitmap_rates[2 + i]);
+                if (priv->adapter->fw_api_ver == MWIFIEX_FW_V15) {
+                        for (i = 0;
+                             i < ARRAY_SIZE(rate_scope->vht_mcs_rate_bitmap);
+                             i++)
+                                rate_scope->vht_mcs_rate_bitmap[i] =
+                                        cpu_to_le16(pbitmap_rates[10 + i]);
+                }
         } else {
                 rate_scope->hr_dsss_rate_bitmap =
                         cpu_to_le16(priv->bitmap_rates[0]);
@@ -195,6 +202,13 @@ static int mwifiex_cmd_tx_rate_cfg(struct mwifiex_private *priv,
                      i++)
                         rate_scope->ht_mcs_rate_bitmap[i] =
                                 cpu_to_le16(priv->bitmap_rates[2 + i]);
+                if (priv->adapter->fw_api_ver == MWIFIEX_FW_V15) {
+                        for (i = 0;
+                             i < ARRAY_SIZE(rate_scope->vht_mcs_rate_bitmap);
+                             i++)
+                                rate_scope->vht_mcs_rate_bitmap[i] =
+                                        cpu_to_le16(priv->bitmap_rates[10 + i]);
+                }
         }
 
         rate_drop = (struct mwifiex_rate_drop_pattern *) ((u8 *) rate_scope +
diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c
index a8f7d545e22a..bfebb0144df5 100644
--- a/drivers/net/wireless/mwifiex/sta_cmdresp.c
+++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c
@@ -304,6 +304,15 @@ static int mwifiex_ret_tx_rate_cfg(struct mwifiex_private *priv,
                                 priv->bitmap_rates[2 + i] =
                                         le16_to_cpu(rate_scope->
                                                     ht_mcs_rate_bitmap[i]);
+
+                        if (priv->adapter->fw_api_ver == MWIFIEX_FW_V15) {
+                                for (i = 0; i < ARRAY_SIZE(rate_scope->
+                                                           vht_mcs_rate_bitmap);
+                                     i++)
+                                        priv->bitmap_rates[10 + i] =
+                                            le16_to_cpu(rate_scope->
+                                                        vht_mcs_rate_bitmap[i]);
+                        }
                         break;
                         /* Add RATE_DROP tlv here */
                 }
diff --git a/drivers/net/wireless/mwifiex/sta_rx.c b/drivers/net/wireless/mwifiex/sta_rx.c
index b6aa958bd6e4..ed26387eccf5 100644
--- a/drivers/net/wireless/mwifiex/sta_rx.c
+++ b/drivers/net/wireless/mwifiex/sta_rx.c
@@ -201,26 +201,7 @@ int mwifiex_process_sta_rx_packet(struct mwifiex_private *priv,
                 return ret;
         }
 
-        if (rx_pkt_type == PKT_TYPE_AMSDU) {
-                struct sk_buff_head list;
-                struct sk_buff *rx_skb;
-
-                __skb_queue_head_init(&list);
-
-                skb_pull(skb, rx_pkt_offset);
-                skb_trim(skb, rx_pkt_length);
-
-                ieee80211_amsdu_to_8023s(skb, &list, priv->curr_addr,
-                                         priv->wdev->iftype, 0, false);
-
-                while (!skb_queue_empty(&list)) {
-                        rx_skb = __skb_dequeue(&list);
-                        ret = mwifiex_recv_packet(priv, rx_skb);
-                        if (ret == -1)
-                                dev_err(adapter->dev, "Rx of A-MSDU failed");
-                }
-                return 0;
-        } else if (rx_pkt_type == PKT_TYPE_MGMT) {
+        if (rx_pkt_type == PKT_TYPE_MGMT) {
                 ret = mwifiex_process_mgmt_packet(priv, skb);
                 if (ret)
                         dev_err(adapter->dev, "Rx of mgmt packet failed");
diff --git a/drivers/net/wireless/mwifiex/uap_cmd.c b/drivers/net/wireless/mwifiex/uap_cmd.c
index a6a6a53cda40..9be6544bdded 100644
--- a/drivers/net/wireless/mwifiex/uap_cmd.c
+++ b/drivers/net/wireless/mwifiex/uap_cmd.c
@@ -159,6 +159,7 @@ mwifiex_set_ht_params(struct mwifiex_private *priv,
                       struct cfg80211_ap_settings *params)
 {
         const u8 *ht_ie;
+        u16 cap_info;
 
         if (!ISSUPP_11NENABLED(priv->adapter->fw_cap_info))
                 return;
@@ -168,6 +169,25 @@ mwifiex_set_ht_params(struct mwifiex_private *priv,
         if (ht_ie) {
                 memcpy(&bss_cfg->ht_cap, ht_ie + 2,
                        sizeof(struct ieee80211_ht_cap));
+                cap_info = le16_to_cpu(bss_cfg->ht_cap.cap_info);
+                memset(&bss_cfg->ht_cap.mcs, 0,
+                       priv->adapter->number_of_antenna);
+                switch (GET_RXSTBC(cap_info)) {
+                case MWIFIEX_RX_STBC1:
+                        /* HT_CAP 1X1 mode */
+                        memset(&bss_cfg->ht_cap.mcs, 0xff, 1);
+                        break;
+                case MWIFIEX_RX_STBC12: /* fall through */
+                case MWIFIEX_RX_STBC123:
+                        /* HT_CAP 2X2 mode */
+                        memset(&bss_cfg->ht_cap.mcs, 0xff, 2);
+                        break;
+                default:
+                        dev_warn(priv->adapter->dev,
+                                 "Unsupported RX-STBC, default to 2x2\n");
+                        memset(&bss_cfg->ht_cap.mcs, 0xff, 2);
+                        break;
+                }
                 priv->ap_11n_enabled = 1;
         } else {
                 memset(&bss_cfg->ht_cap , 0, sizeof(struct ieee80211_ht_cap));
diff --git a/drivers/net/wireless/mwifiex/uap_event.c b/drivers/net/wireless/mwifiex/uap_event.c
index ae50e916d8f2..92e77a398ecf 100644
--- a/drivers/net/wireless/mwifiex/uap_event.c
+++ b/drivers/net/wireless/mwifiex/uap_event.c
@@ -166,6 +166,12 @@ int mwifiex_process_uap_event(struct mwifiex_private *priv)
                         mwifiex_11n_ba_stream_timeout(priv, ba_timeout);
                 }
                 break;
+        case EVENT_EXT_SCAN_REPORT:
+                dev_dbg(adapter->dev, "event: EXT_SCAN Report\n");
+                if (adapter->ext_scan)
+                        return mwifiex_handle_event_ext_scan_report(priv,
+                                                adapter->event_skb->data);
+                break;
         default:
                 dev_dbg(adapter->dev, "event: unknown event id: %#x\n",
                         eventcause);
diff --git a/drivers/net/wireless/mwifiex/uap_txrx.c b/drivers/net/wireless/mwifiex/uap_txrx.c
index 3c74eb254927..9a56bc61cb1d 100644
--- a/drivers/net/wireless/mwifiex/uap_txrx.c
+++ b/drivers/net/wireless/mwifiex/uap_txrx.c
@@ -284,27 +284,7 @@ int mwifiex_process_uap_rx_packet(struct mwifiex_private *priv,
                 return 0;
         }
 
-        if (le16_to_cpu(uap_rx_pd->rx_pkt_type) == PKT_TYPE_AMSDU) {
-                struct sk_buff_head list;
-                struct sk_buff *rx_skb;
-
-                __skb_queue_head_init(&list);
-                skb_pull(skb, le16_to_cpu(uap_rx_pd->rx_pkt_offset));
-                skb_trim(skb, le16_to_cpu(uap_rx_pd->rx_pkt_length));
-
-                ieee80211_amsdu_to_8023s(skb, &list, priv->curr_addr,
-                                         priv->wdev->iftype, 0, false);
-
-                while (!skb_queue_empty(&list)) {
-                        rx_skb = __skb_dequeue(&list);
-                        ret = mwifiex_recv_packet(priv, rx_skb);
-                        if (ret)
-                                dev_err(adapter->dev,
-                                        "AP:Rx A-MSDU failed");
-                }
-
-                return 0;
-        } else if (rx_pkt_type == PKT_TYPE_MGMT) {
+        if (rx_pkt_type == PKT_TYPE_MGMT) {
                 ret = mwifiex_process_mgmt_packet(priv, skb);
                 if (ret)
                         dev_err(adapter->dev, "Rx of mgmt packet failed");
diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c
index 1c5f2b66f057..0a7cc742aed7 100644
--- a/drivers/net/wireless/mwifiex/wmm.c
+++ b/drivers/net/wireless/mwifiex/wmm.c
@@ -37,8 +37,8 @@
 /* Offset for TOS field in the IP header */
 #define IPTOS_OFFSET 5
 
-static bool enable_tx_amsdu;
-module_param(enable_tx_amsdu, bool, 0644);
+static bool disable_tx_amsdu;
+module_param(disable_tx_amsdu, bool, 0644);
 
 /* WMM information IE */
 static const u8 wmm_info_ie[] = { WLAN_EID_VENDOR_SPECIFIC, 0x07,
@@ -413,7 +413,13 @@ mwifiex_wmm_init(struct mwifiex_adapter *adapter)
                         continue;
 
                 for (i = 0; i < MAX_NUM_TID; ++i) {
-                        priv->aggr_prio_tbl[i].amsdu = priv->tos_to_tid_inv[i];
+                        if (!disable_tx_amsdu &&
+                            adapter->tx_buf_size > MWIFIEX_TX_DATA_BUF_SIZE_2K)
+                                priv->aggr_prio_tbl[i].amsdu =
+                                                        priv->tos_to_tid_inv[i];
+                        else
+                                priv->aggr_prio_tbl[i].amsdu =
+                                                        BA_STREAM_NOT_ALLOWED;
                         priv->aggr_prio_tbl[i].ampdu_ap =
                                                         priv->tos_to_tid_inv[i];
                         priv->aggr_prio_tbl[i].ampdu_user =
@@ -1247,13 +1253,22 @@ mwifiex_dequeue_tx_packet(struct mwifiex_adapter *adapter)
 
         if (!ptr->is_11n_enabled ||
             mwifiex_is_ba_stream_setup(priv, ptr, tid) ||
-            priv->wps.session_enable ||
-            ((priv->sec_info.wpa_enabled ||
-              priv->sec_info.wpa2_enabled) &&
-             !priv->wpa_is_gtk_set)) {
-                mwifiex_send_single_packet(priv, ptr, ptr_index, flags);
-                /* ra_list_spinlock has been freed in
-                   mwifiex_send_single_packet() */
+            priv->wps.session_enable) {
+                if (ptr->is_11n_enabled &&
+                    mwifiex_is_ba_stream_setup(priv, ptr, tid) &&
+                    mwifiex_is_amsdu_in_ampdu_allowed(priv, ptr, tid) &&
+                    mwifiex_is_amsdu_allowed(priv, tid) &&
+                    mwifiex_is_11n_aggragation_possible(priv, ptr,
+                                                        adapter->tx_buf_size))
+                        mwifiex_11n_aggregate_pkt(priv, ptr, ptr_index, flags);
+                        /* ra_list_spinlock has been freed in
+                         * mwifiex_11n_aggregate_pkt()
+                         */
+                else
+                        mwifiex_send_single_packet(priv, ptr, ptr_index, flags);
+                        /* ra_list_spinlock has been freed in
+                         * mwifiex_send_single_packet()
+                         */
         } else {
                 if (mwifiex_is_ampdu_allowed(priv, ptr, tid) &&
                     ptr->ba_pkt_count > ptr->ba_packet_thr) {
@@ -1268,7 +1283,7 @@ mwifiex_dequeue_tx_packet(struct mwifiex_adapter *adapter)
                                 mwifiex_send_delba(priv, tid_del, ra, 1);
                         }
                 }
-                if (enable_tx_amsdu && mwifiex_is_amsdu_allowed(priv, tid) &&
+                if (mwifiex_is_amsdu_allowed(priv, tid) &&
                     mwifiex_is_11n_aggragation_possible(priv, ptr,
                                                         adapter->tx_buf_size))
                         mwifiex_11n_aggregate_pkt(priv, ptr, ptr_index, flags);
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index b7ab3dfb3de8..043bd1c23c19 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -1053,6 +1053,10 @@ static int p54u_probe(struct usb_interface *intf,
                 priv->upload_fw = p54u_upload_firmware_net2280;
         }
         err = p54u_load_firmware(dev, intf);
+        if (err) {
+                usb_put_dev(udev);
+                p54_free_common(dev);
+        }
         return err;
 }
 
diff --git a/drivers/net/wireless/rsi/Kconfig b/drivers/net/wireless/rsi/Kconfig
new file mode 100644
index 000000000000..35245f994c10
--- /dev/null
+++ b/drivers/net/wireless/rsi/Kconfig
@@ -0,0 +1,30 @@
+config RSI_91X
+        tristate "Redpine Signals Inc 91x WLAN driver support"
+        depends on MAC80211
+        ---help---
+          This option enabes support for RSI 1x1 devices.
+          Select M (recommended), if you have a RSI 1x1 wireless module.
+
+config RSI_DEBUGFS
+        bool "Redpine Signals Inc debug support"
+        depends on RSI_91X
+        default y
+        ---help---
+         Say Y, if you would like to enable debug support. This option
+         creates debugfs entries
+
+config RSI_SDIO
+        tristate "Redpine Signals SDIO bus support"
+        depends on MMC && RSI_91X
+        default m
+        ---help---
+          This option enables the SDIO bus support in rsi drivers.
+          Select M (recommended), if you have a RSI 1x1 wireless module.
+
+config RSI_USB
+        tristate "Redpine Signals USB bus support"
+        depends on USB && RSI_91X
+        default m
+        ---help---
+          This option enables the USB bus support in rsi drivers.
+          Select M (recommended), if you have a RSI 1x1 wireless module.
diff --git a/drivers/net/wireless/rsi/Makefile b/drivers/net/wireless/rsi/Makefile
new file mode 100644
index 000000000000..25828b692756
--- /dev/null
+++ b/drivers/net/wireless/rsi/Makefile
@@ -0,0 +1,12 @@
+rsi_91x-y                       += rsi_91x_main.o
+rsi_91x-y                       += rsi_91x_core.o
+rsi_91x-y                       += rsi_91x_mac80211.o
+rsi_91x-y                       += rsi_91x_mgmt.o
+rsi_91x-y                       += rsi_91x_pkt.o
+rsi_91x-$(CONFIG_RSI_DEBUGFS)   += rsi_91x_debugfs.o
+
+rsi_usb-y                       += rsi_91x_usb.o rsi_91x_usb_ops.o
+rsi_sdio-y                      += rsi_91x_sdio.o rsi_91x_sdio_ops.o
+obj-$(CONFIG_RSI_91X)           += rsi_91x.o
+obj-$(CONFIG_RSI_SDIO)          += rsi_sdio.o
+obj-$(CONFIG_RSI_USB)           += rsi_usb.o
diff --git a/drivers/net/wireless/rsi/rsi_91x_core.c b/drivers/net/wireless/rsi/rsi_91x_core.c
new file mode 100644
index 000000000000..e89535e86caf
--- /dev/null
+++ b/drivers/net/wireless/rsi/rsi_91x_core.c
@@ -0,0 +1,342 @@
+/**
+ * Copyright (c) 2014 Redpine Signals Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "rsi_mgmt.h"
+#include "rsi_common.h"
+
+/**
+ * rsi_determine_min_weight_queue() - This function determines the queue with
+ *                                    the min weight.
+ * @common: Pointer to the driver private structure.
+ *
+ * Return: q_num: Corresponding queue number.
+ */
+static u8 rsi_determine_min_weight_queue(struct rsi_common *common)
+{
+        struct wmm_qinfo *tx_qinfo = common->tx_qinfo;
+        u32 q_len = 0;
+        u8 ii = 0;
+
+        for (ii = 0; ii < NUM_EDCA_QUEUES; ii++) {
+                q_len = skb_queue_len(&common->tx_queue[ii]);
+                if ((tx_qinfo[ii].pkt_contended) && q_len) {
+                        common->min_weight = tx_qinfo[ii].weight;
+                        break;
+                }
+        }
+        return ii;
+}
+
+/**
+ * rsi_recalculate_weights() - This function recalculates the weights
+ *                             corresponding to each queue.
+ * @common: Pointer to the driver private structure.
+ *
+ * Return: recontend_queue bool variable
+ */
+static bool rsi_recalculate_weights(struct rsi_common *common)
+{
+        struct wmm_qinfo *tx_qinfo = common->tx_qinfo;
+        bool recontend_queue = false;
+        u8 ii = 0;
+        u32 q_len = 0;
+
+        for (ii = 0; ii < NUM_EDCA_QUEUES; ii++) {
+                q_len = skb_queue_len(&common->tx_queue[ii]);
+                /* Check for the need of contention */
+                if (q_len) {
+                        if (tx_qinfo[ii].pkt_contended) {
+                                tx_qinfo[ii].weight =
+                                ((tx_qinfo[ii].weight > common->min_weight) ?
+                                 tx_qinfo[ii].weight - common->min_weight : 0);
+                        } else {
+                                tx_qinfo[ii].pkt_contended = 1;
+                                tx_qinfo[ii].weight = tx_qinfo[ii].wme_params;
+                                recontend_queue = true;
+                        }
+                } else { /* No packets so no contention */
+                        tx_qinfo[ii].weight = 0;
+                        tx_qinfo[ii].pkt_contended = 0;
+                }
+        }
+
+        return recontend_queue;
+}
+
+/**
+ * rsi_core_determine_hal_queue() - This function determines the queue from
+ *                                  which packet has to be dequeued.
+ * @common: Pointer to the driver private structure.
+ *
+ * Return: q_num: Corresponding queue number on success.
+ */
+static u8 rsi_core_determine_hal_queue(struct rsi_common *common)
+{
+        bool recontend_queue = false;
+        u32 q_len = 0;
+        u8 q_num = INVALID_QUEUE;
+        u8 ii, min = 0;
+
+        if (skb_queue_len(&common->tx_queue[MGMT_SOFT_Q])) {
+                if (!common->mgmt_q_block)
+                        q_num = MGMT_SOFT_Q;
+                return q_num;
+        }
+
+        if (common->pkt_cnt != 0) {
+                --common->pkt_cnt;
+                return common->selected_qnum;
+        }
+
+get_queue_num:
+        q_num = 0;
+        recontend_queue = false;
+
+        q_num = rsi_determine_min_weight_queue(common);
+        q_len = skb_queue_len(&common->tx_queue[ii]);
+        ii = q_num;
+
+        /* Selecting the queue with least back off */
+        for (; ii < NUM_EDCA_QUEUES; ii++) {
+                if (((common->tx_qinfo[ii].pkt_contended) &&
+                     (common->tx_qinfo[ii].weight < min)) && q_len) {
+                        min = common->tx_qinfo[ii].weight;
+                        q_num = ii;
+                }
+        }
+
+        common->tx_qinfo[q_num].pkt_contended = 0;
+        /* Adjust the back off values for all queues again */
+        recontend_queue = rsi_recalculate_weights(common);
+
+        q_len = skb_queue_len(&common->tx_queue[q_num]);
+        if (!q_len) {
+                /* If any queues are freshly contended and the selected queue
+                 * doesn't have any packets
+                 * then get the queue number again with fresh values
+                 */
+                if (recontend_queue)
+                        goto get_queue_num;
+
+                q_num = INVALID_QUEUE;
+                return q_num;
+        }
+
+        common->selected_qnum = q_num;
+        q_len = skb_queue_len(&common->tx_queue[q_num]);
+
+        switch (common->selected_qnum) {
+        case VO_Q:
+                if (q_len > MAX_CONTINUOUS_VO_PKTS)
+                        common->pkt_cnt = (MAX_CONTINUOUS_VO_PKTS - 1);
+                else
+                        common->pkt_cnt = --q_len;
+                break;
+
+        case VI_Q:
+                if (q_len > MAX_CONTINUOUS_VI_PKTS)
+                        common->pkt_cnt = (MAX_CONTINUOUS_VI_PKTS - 1);
+                else
+                        common->pkt_cnt = --q_len;
+
+                break;
+
+        default:
+                common->pkt_cnt = 0;
+                break;
+        }
+
+        return q_num;
+}
+
+/**
+ * rsi_core_queue_pkt() - This functions enqueues the packet to the queue
+ *                        specified by the queue number.
+ * @common: Pointer to the driver private structure.
+ * @skb: Pointer to the socket buffer structure.
+ *
+ * Return: None.
+ */
+static void rsi_core_queue_pkt(struct rsi_common *common,
+                               struct sk_buff *skb)
+{
+        u8 q_num = skb->priority;
+        if (q_num >= NUM_SOFT_QUEUES) {
+                rsi_dbg(ERR_ZONE, "%s: Invalid Queue Number: q_num = %d\n",
+                        __func__, q_num);
+                dev_kfree_skb(skb);
+                return;
+        }
+
+        skb_queue_tail(&common->tx_queue[q_num], skb);
+}
+
+/**
+ * rsi_core_dequeue_pkt() - This functions dequeues the packet from the queue
+ *                          specified by the queue number.
+ * @common: Pointer to the driver private structure.
+ * @q_num: Queue number.
+ *
+ * Return: Pointer to sk_buff structure.
+ */
+static struct sk_buff *rsi_core_dequeue_pkt(struct rsi_common *common,
+                                            u8 q_num)
+{
+        if (q_num >= NUM_SOFT_QUEUES) {
+                rsi_dbg(ERR_ZONE, "%s: Invalid Queue Number: q_num = %d\n",
+                        __func__, q_num);
+                return NULL;
+        }
+
+        return skb_dequeue(&common->tx_queue[q_num]);
+}
+
+/**
+ * rsi_core_qos_processor() - This function is used to determine the wmm queue
+ *                            based on the backoff procedure. Data packets are
+ *                            dequeued from the selected hal queue and sent to
+ *                            the below layers.
+ * @common: Pointer to the driver private structure.
+ *
+ * Return: None.
+ */
+void rsi_core_qos_processor(struct rsi_common *common)
+{
+        struct rsi_hw *adapter = common->priv;
+        struct sk_buff *skb;
+        unsigned long tstamp_1, tstamp_2;
+        u8 q_num;
+        int status;
+
+        tstamp_1 = jiffies;
+        while (1) {
+                q_num = rsi_core_determine_hal_queue(common);
+                rsi_dbg(DATA_TX_ZONE,
+                        "%s: Queue number = %d\n", __func__, q_num);
+
+                if (q_num == INVALID_QUEUE) {
+                        rsi_dbg(DATA_TX_ZONE, "%s: No More Pkt\n", __func__);
+                        break;
+                }
+
+                mutex_lock(&common->tx_rxlock);
+
+                status = adapter->check_hw_queue_status(adapter, q_num);
+                if ((status <= 0)) {
+                        mutex_unlock(&common->tx_rxlock);
+                        break;
+                }
+
+                if ((q_num < MGMT_SOFT_Q) &&
+                    ((skb_queue_len(&common->tx_queue[q_num])) <=
+                      MIN_DATA_QUEUE_WATER_MARK)) {
+                        if (ieee80211_queue_stopped(adapter->hw, WME_AC(q_num)))
+                                ieee80211_wake_queue(adapter->hw,
+                                                     WME_AC(q_num));
+                }
+
+                skb = rsi_core_dequeue_pkt(common, q_num);
+                if (skb == NULL) {
+                        mutex_unlock(&common->tx_rxlock);
+                        break;
+                }
+
+                if (q_num == MGMT_SOFT_Q)
+                        status = rsi_send_mgmt_pkt(common, skb);
+                else
+                        status = rsi_send_data_pkt(common, skb);
+
+                if (status) {
+                        mutex_unlock(&common->tx_rxlock);
+                        break;
+                }
+
+                common->tx_stats.total_tx_pkt_send[q_num]++;
+
+                tstamp_2 = jiffies;
+                mutex_unlock(&common->tx_rxlock);
+
+                if (tstamp_2 > tstamp_1 + (300 * HZ / 1000))
+                        schedule();
+        }
+}
+
+/**
+ * rsi_core_xmit() - This function transmits the packets received from mac80211
+ * @common: Pointer to the driver private structure.
+ * @skb: Pointer to the socket buffer structure.
+ *
+ * Return: None.
+ */
+void rsi_core_xmit(struct rsi_common *common, struct sk_buff *skb)
+{
+        struct rsi_hw *adapter = common->priv;
+        struct ieee80211_tx_info *info;
+        struct skb_info *tx_params;
+        struct ieee80211_hdr *tmp_hdr = NULL;
+        u8 q_num, tid = 0;
+
+        if ((!skb) || (!skb->len)) {
+                rsi_dbg(ERR_ZONE, "%s: Null skb/zero Length packet\n",
+                        __func__);
+                goto xmit_fail;
+        }
+        info = IEEE80211_SKB_CB(skb);
+        tx_params = (struct skb_info *)info->driver_data;
+        tmp_hdr = (struct ieee80211_hdr *)&skb->data[0];
+
+        if (common->fsm_state != FSM_MAC_INIT_DONE) {
+                rsi_dbg(ERR_ZONE, "%s: FSM state not open\n", __func__);
+                goto xmit_fail;
+        }
+
+        if ((ieee80211_is_mgmt(tmp_hdr->frame_control)) ||
+            (ieee80211_is_ctl(tmp_hdr->frame_control))) {
+                q_num = MGMT_SOFT_Q;
+                skb->priority = q_num;
+        } else {
+                if (ieee80211_is_data_qos(tmp_hdr->frame_control)) {
+                        tid = (skb->data[24] & IEEE80211_QOS_TID);
+                        skb->priority = TID_TO_WME_AC(tid);
+                } else {
+                        tid = IEEE80211_NONQOS_TID;
+                        skb->priority = BE_Q;
+                }
+                q_num = skb->priority;
+                tx_params->tid = tid;
+                tx_params->sta_id = 0;
+        }
+
+        if ((q_num != MGMT_SOFT_Q) &&
+            ((skb_queue_len(&common->tx_queue[q_num]) + 1) >=
+             DATA_QUEUE_WATER_MARK)) {
+                if (!ieee80211_queue_stopped(adapter->hw, WME_AC(q_num)))
+                        ieee80211_stop_queue(adapter->hw, WME_AC(q_num));
+                rsi_set_event(&common->tx_thread.event);
+                goto xmit_fail;
+        }
+
+        rsi_core_queue_pkt(common, skb);
+        rsi_dbg(DATA_TX_ZONE, "%s: ===> Scheduling TX thead <===\n", __func__);
+        rsi_set_event(&common->tx_thread.event);
+
+        return;
+
+xmit_fail:
+        rsi_dbg(ERR_ZONE, "%s: Failed to queue packet\n", __func__);
+        /* Dropping pkt here */
+        ieee80211_free_txskb(common->priv->hw, skb);
+}
diff --git a/drivers/net/wireless/rsi/rsi_91x_debugfs.c b/drivers/net/wireless/rsi/rsi_91x_debugfs.c
new file mode 100644
index 000000000000..7e4ef4554411
--- /dev/null
+++ b/drivers/net/wireless/rsi/rsi_91x_debugfs.c
@@ -0,0 +1,339 @@
+/**
+ * Copyright (c) 2014 Redpine Signals Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "rsi_debugfs.h"
+#include "rsi_sdio.h"
+
+/**
+ * rsi_sdio_stats_read() - This function returns the sdio status of the driver.
+ * @seq: Pointer to the sequence file structure.
+ * @data: Pointer to the data.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+static int rsi_sdio_stats_read(struct seq_file *seq, void *data)
+{
+        struct rsi_common *common = seq->private;
+        struct rsi_hw *adapter = common->priv;
+        struct rsi_91x_sdiodev *dev =
+                (struct rsi_91x_sdiodev *)adapter->rsi_dev;
+
+        seq_printf(seq, "total_sdio_interrupts: %d\n",
+                   dev->rx_info.sdio_int_counter);
+        seq_printf(seq, "sdio_msdu_pending_intr_count: %d\n",
+                   dev->rx_info.total_sdio_msdu_pending_intr);
+        seq_printf(seq, "sdio_buff_full_count : %d\n",
+                   dev->rx_info.buf_full_counter);
+        seq_printf(seq, "sdio_buf_semi_full_count %d\n",
+                   dev->rx_info.buf_semi_full_counter);
+        seq_printf(seq, "sdio_unknown_intr_count: %d\n",
+                   dev->rx_info.total_sdio_unknown_intr);
+        /* RX Path Stats */
+        seq_printf(seq, "BUFFER FULL STATUS  : %d\n",
+                   dev->rx_info.buffer_full);
+        seq_printf(seq, "SEMI BUFFER FULL STATUS  : %d\n",
+                   dev->rx_info.semi_buffer_full);
+        seq_printf(seq, "MGMT BUFFER FULL STATUS  : %d\n",
+                   dev->rx_info.mgmt_buffer_full);
+        seq_printf(seq, "BUFFER FULL COUNTER  : %d\n",
+                   dev->rx_info.buf_full_counter);
+        seq_printf(seq, "BUFFER SEMI FULL COUNTER  : %d\n",
+                   dev->rx_info.buf_semi_full_counter);
+        seq_printf(seq, "MGMT BUFFER FULL COUNTER  : %d\n",
+                   dev->rx_info.mgmt_buf_full_counter);
+
+        return 0;
+}
+
+/**
+ * rsi_sdio_stats_open() - This funtion calls single open function of seq_file
+ *                         to open file and read contents from it.
+ * @inode: Pointer to the inode structure.
+ * @file: Pointer to the file structure.
+ *
+ * Return: Pointer to the opened file status: 0 on success, ENOMEM on failure.
+ */
+static int rsi_sdio_stats_open(struct inode *inode,
+                               struct file *file)
+{
+        return single_open(file, rsi_sdio_stats_read, inode->i_private);
+}
+
+/**
+ * rsi_version_read() - This function gives driver and firmware version number.
+ * @seq: Pointer to the sequence file structure.
+ * @data: Pointer to the data.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+static int rsi_version_read(struct seq_file *seq, void *data)
+{
+        struct rsi_common *common = seq->private;
+
+        common->driver_ver.major = 0;
+        common->driver_ver.minor = 1;
+        common->driver_ver.release_num = 0;
+        common->driver_ver.patch_num = 0;
+        seq_printf(seq, "Driver : %x.%d.%d.%d\nLMAC   : %d.%d.%d.%d\n",
+                   common->driver_ver.major,
+                   common->driver_ver.minor,
+                   common->driver_ver.release_num,
+                   common->driver_ver.patch_num,
+                   common->fw_ver.major,
+                   common->fw_ver.minor,
+                   common->fw_ver.release_num,
+                   common->fw_ver.patch_num);
+        return 0;
+}
+
+/**
+ * rsi_version_open() - This funtion calls single open function of seq_file to
+ *                      open file and read contents from it.
+ * @inode: Pointer to the inode structure.
+ * @file: Pointer to the file structure.
+ *
+ * Return: Pointer to the opened file status: 0 on success, ENOMEM on failure.
+ */
+static int rsi_version_open(struct inode *inode,
+                                 struct file *file)
+{
+        return single_open(file, rsi_version_read, inode->i_private);
+}
+
+/**
+ * rsi_stats_read() - This function return the status of the driver.
+ * @seq: Pointer to the sequence file structure.
+ * @data: Pointer to the data.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+static int rsi_stats_read(struct seq_file *seq, void *data)
+{
+        struct rsi_common *common = seq->private;
+
+        unsigned char fsm_state[][32] = {
+                "FSM_CARD_NOT_READY",
+                "FSM_BOOT_PARAMS_SENT",
+                "FSM_EEPROM_READ_MAC_ADDR",
+                "FSM_RESET_MAC_SENT",
+                "FSM_RADIO_CAPS_SENT",
+                "FSM_BB_RF_PROG_SENT",
+                "FSM_MAC_INIT_DONE"
+        };
+        seq_puts(seq, "==> RSI STA DRIVER STATUS <==\n");
+        seq_puts(seq, "DRIVER_FSM_STATE: ");
+
+        if (common->fsm_state <= FSM_MAC_INIT_DONE)
+                seq_printf(seq, "%s", fsm_state[common->fsm_state]);
+
+        seq_printf(seq, "(%d)\n\n", common->fsm_state);
+
+        /* Mgmt TX Path Stats */
+        seq_printf(seq, "total_mgmt_pkt_send : %d\n",
+                   common->tx_stats.total_tx_pkt_send[MGMT_SOFT_Q]);
+        seq_printf(seq, "total_mgmt_pkt_queued : %d\n",
+                   skb_queue_len(&common->tx_queue[4]));
+        seq_printf(seq, "total_mgmt_pkt_freed  : %d\n",
+                   common->tx_stats.total_tx_pkt_freed[MGMT_SOFT_Q]);
+
+        /* Data TX Path Stats */
+        seq_printf(seq, "total_data_vo_pkt_send: %8d\t",
+                   common->tx_stats.total_tx_pkt_send[VO_Q]);
+        seq_printf(seq, "total_data_vo_pkt_queued:  %8d\t",
+                   skb_queue_len(&common->tx_queue[0]));
+        seq_printf(seq, "total_vo_pkt_freed: %8d\n",
+                   common->tx_stats.total_tx_pkt_freed[VO_Q]);
+        seq_printf(seq, "total_data_vi_pkt_send: %8d\t",
+                   common->tx_stats.total_tx_pkt_send[VI_Q]);
+        seq_printf(seq, "total_data_vi_pkt_queued:  %8d\t",
+                   skb_queue_len(&common->tx_queue[1]));
+        seq_printf(seq, "total_vi_pkt_freed: %8d\n",
+                   common->tx_stats.total_tx_pkt_freed[VI_Q]);
+        seq_printf(seq,  "total_data_be_pkt_send: %8d\t",
+                   common->tx_stats.total_tx_pkt_send[BE_Q]);
+        seq_printf(seq, "total_data_be_pkt_queued:  %8d\t",
+                   skb_queue_len(&common->tx_queue[2]));
+        seq_printf(seq, "total_be_pkt_freed: %8d\n",
+                   common->tx_stats.total_tx_pkt_freed[BE_Q]);
+        seq_printf(seq, "total_data_bk_pkt_send: %8d\t",
+                   common->tx_stats.total_tx_pkt_send[BK_Q]);
+        seq_printf(seq, "total_data_bk_pkt_queued:  %8d\t",
+                   skb_queue_len(&common->tx_queue[3]));
+        seq_printf(seq, "total_bk_pkt_freed: %8d\n",
+                   common->tx_stats.total_tx_pkt_freed[BK_Q]);
+
+        seq_puts(seq, "\n");
+        return 0;
+}
+
+/**
+ * rsi_stats_open() - This funtion calls single open function of seq_file to
+ *                    open file and read contents from it.
+ * @inode: Pointer to the inode structure.
+ * @file: Pointer to the file structure.
+ *
+ * Return: Pointer to the opened file status: 0 on success, ENOMEM on failure.
+ */
+static int rsi_stats_open(struct inode *inode,
+                          struct file *file)
+{
+        return single_open(file, rsi_stats_read, inode->i_private);
+}
+
+/**
+ * rsi_debug_zone_read() - This function display the currently enabled debug zones.
+ * @seq: Pointer to the sequence file structure.
+ * @data: Pointer to the data.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+static int rsi_debug_zone_read(struct seq_file *seq, void *data)
+{
+        rsi_dbg(FSM_ZONE, "%x: rsi_enabled zone", rsi_zone_enabled);
+        seq_printf(seq, "The zones available are %#x\n",
+                   rsi_zone_enabled);
+        return 0;
+}
+
+/**
+ * rsi_debug_read() - This funtion calls single open function of seq_file to
+ *                    open file and read contents from it.
+ * @inode: Pointer to the inode structure.
+ * @file: Pointer to the file structure.
+ *
+ * Return: Pointer to the opened file status: 0 on success, ENOMEM on failure.
+ */
+static int rsi_debug_read(struct inode *inode,
+                          struct file *file)
+{
+        return single_open(file, rsi_debug_zone_read, inode->i_private);
+}
+
+/**
+ * rsi_debug_zone_write() - This function writes into hal queues as per user
+ *                          requirement.
+ * @filp: Pointer to the file structure.
+ * @buff: Pointer to the character buffer.
+ * @len: Length of the data to be written into buffer.
+ * @data: Pointer to the data.
+ *
+ * Return: len: Number of bytes read.
+ */
+static ssize_t rsi_debug_zone_write(struct file *filp,
+                                    const char __user *buff,
+                                    size_t len,
+                                    loff_t *data)
+{
+        unsigned long dbg_zone;
+        int ret;
+
+        if (!len)
+                return 0;
+
+        ret = kstrtoul_from_user(buff, len, 16, &dbg_zone);
+
+        if (ret)
+                return ret;
+
+        rsi_zone_enabled = dbg_zone;
+        return len;
+}
+
+#define FOPS(fopen) { \
+        .owner = THIS_MODULE, \
+        .open = (fopen), \
+        .read = seq_read, \
+        .llseek = seq_lseek, \
+}
+
+#define FOPS_RW(fopen, fwrite) { \
+        .owner = THIS_MODULE, \
+        .open = (fopen), \
+        .read = seq_read, \
+        .llseek = seq_lseek, \
+        .write = (fwrite), \
+}
+
+static const struct rsi_dbg_files dev_debugfs_files[] = {
+        {"version", 0644, FOPS(rsi_version_open),},
+        {"stats", 0644, FOPS(rsi_stats_open),},
+        {"debug_zone", 0666, FOPS_RW(rsi_debug_read, rsi_debug_zone_write),},
+        {"sdio_stats", 0644, FOPS(rsi_sdio_stats_open),},
+};
+
+/**
+ * rsi_init_dbgfs() - This function initializes the dbgfs entry.
+ * @adapter: Pointer to the adapter structure.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+int rsi_init_dbgfs(struct rsi_hw *adapter)
+{
+        struct rsi_common *common = adapter->priv;
+        struct rsi_debugfs *dev_dbgfs;
+        char devdir[6];
+        int ii;
+        const struct rsi_dbg_files *files;
+
+        dev_dbgfs = kzalloc(sizeof(*dev_dbgfs), GFP_KERNEL);
+        adapter->dfsentry = dev_dbgfs;
+
+        snprintf(devdir, sizeof(devdir), "%s",
+                 wiphy_name(adapter->hw->wiphy));
+        dev_dbgfs->subdir = debugfs_create_dir(devdir, NULL);
+
+        if (IS_ERR(dev_dbgfs->subdir)) {
+                if (dev_dbgfs->subdir == ERR_PTR(-ENODEV))
+                        rsi_dbg(ERR_ZONE,
+                                "%s:Debugfs has not been mounted\n", __func__);
+                else
+                        rsi_dbg(ERR_ZONE, "debugfs:%s not created\n", devdir);
+
+                adapter->dfsentry = NULL;
+                kfree(dev_dbgfs);
+                return (int)PTR_ERR(dev_dbgfs->subdir);
+        } else {
+                for (ii = 0; ii < adapter->num_debugfs_entries; ii++) {
+                        files = &dev_debugfs_files[ii];
+                        dev_dbgfs->rsi_files[ii] =
+                        debugfs_create_file(files->name,
+                                            files->perms,
+                                            dev_dbgfs->subdir,
+                                            common,
+                                            &files->fops);
+                }
+        }
+        return 0;
+}
+EXPORT_SYMBOL_GPL(rsi_init_dbgfs);
+
+/**
+ * rsi_remove_dbgfs() - Removes the previously created dbgfs file entries
+ *                      in the reverse order of creation.
+ * @adapter: Pointer to the adapter structure.
+ *
+ * Return: None.
+ */
+void rsi_remove_dbgfs(struct rsi_hw *adapter)
+{
+        struct rsi_debugfs *dev_dbgfs = adapter->dfsentry;
+
+        if (!dev_dbgfs)
+                return;
+
+        debugfs_remove_recursive(dev_dbgfs->subdir);
+}
+EXPORT_SYMBOL_GPL(rsi_remove_dbgfs);
diff --git a/drivers/net/wireless/rsi/rsi_91x_mac80211.c b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
new file mode 100644
index 000000000000..84164747ace0
--- /dev/null
+++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
@@ -0,0 +1,1008 @@
+/**
+ * Copyright (c) 2014 Redpine Signals Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/etherdevice.h>
+#include "rsi_debugfs.h"
+#include "rsi_mgmt.h"
+#include "rsi_common.h"
+
+static const struct ieee80211_channel rsi_2ghz_channels[] = {
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2412,
+          .hw_value = 1 }, /* Channel 1 */
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2417,
+          .hw_value = 2 }, /* Channel 2 */
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2422,
+          .hw_value = 3 }, /* Channel 3 */
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2427,
+          .hw_value = 4 }, /* Channel 4 */
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2432,
+          .hw_value = 5 }, /* Channel 5 */
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2437,
+          .hw_value = 6 }, /* Channel 6 */
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2442,
+          .hw_value = 7 }, /* Channel 7 */
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2447,
+          .hw_value = 8 }, /* Channel 8 */
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2452,
+          .hw_value = 9 }, /* Channel 9 */
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2457,
+          .hw_value = 10 }, /* Channel 10 */
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2462,
+          .hw_value = 11 }, /* Channel 11 */
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2467,
+          .hw_value = 12 }, /* Channel 12 */
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2472,
+          .hw_value = 13 }, /* Channel 13 */
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2484,
+          .hw_value = 14 }, /* Channel 14 */
+};
+
+static const struct ieee80211_channel rsi_5ghz_channels[] = {
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5180,
+          .hw_value = 36,  }, /* Channel 36 */
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5200,
+          .hw_value = 40, }, /* Channel 40 */
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5220,
+          .hw_value = 44, }, /* Channel 44 */
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5240,
+          .hw_value = 48, }, /* Channel 48 */
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5260,
+          .hw_value = 52, }, /* Channel 52 */
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5280,
+          .hw_value = 56, }, /* Channel 56 */
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5300,
+          .hw_value = 60, }, /* Channel 60 */
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5320,
+          .hw_value = 64, }, /* Channel 64 */
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5500,
+          .hw_value = 100, }, /* Channel 100 */
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5520,
+          .hw_value = 104, }, /* Channel 104 */
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5540,
+          .hw_value = 108, }, /* Channel 108 */
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5560,
+          .hw_value = 112, }, /* Channel 112 */
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5580,
+          .hw_value = 116, }, /* Channel 116 */
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5600,
+          .hw_value = 120, }, /* Channel 120 */
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5620,
+          .hw_value = 124, }, /* Channel 124 */
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5640,
+          .hw_value = 128, }, /* Channel 128 */
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5660,
+          .hw_value = 132, }, /* Channel 132 */
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5680,
+          .hw_value = 136, }, /* Channel 136 */
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5700,
+          .hw_value = 140, }, /* Channel 140 */
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5745,
+          .hw_value = 149, }, /* Channel 149 */
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5765,
+          .hw_value = 153, }, /* Channel 153 */
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5785,
+          .hw_value = 157, }, /* Channel 157 */
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5805,
+          .hw_value = 161, }, /* Channel 161 */
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5825,
+          .hw_value = 165, }, /* Channel 165 */
+};
+
+struct ieee80211_rate rsi_rates[12] = {
+        { .bitrate = STD_RATE_01  * 5, .hw_value = RSI_RATE_1 },
+        { .bitrate = STD_RATE_02  * 5, .hw_value = RSI_RATE_2 },
+        { .bitrate = STD_RATE_5_5 * 5, .hw_value = RSI_RATE_5_5 },
+        { .bitrate = STD_RATE_11  * 5, .hw_value = RSI_RATE_11 },
+        { .bitrate = STD_RATE_06  * 5, .hw_value = RSI_RATE_6 },
+        { .bitrate = STD_RATE_09  * 5, .hw_value = RSI_RATE_9 },
+        { .bitrate = STD_RATE_12  * 5, .hw_value = RSI_RATE_12 },
+        { .bitrate = STD_RATE_18  * 5, .hw_value = RSI_RATE_18 },
+        { .bitrate = STD_RATE_24  * 5, .hw_value = RSI_RATE_24 },
+        { .bitrate = STD_RATE_36  * 5, .hw_value = RSI_RATE_36 },
+        { .bitrate = STD_RATE_48  * 5, .hw_value = RSI_RATE_48 },
+        { .bitrate = STD_RATE_54  * 5, .hw_value = RSI_RATE_54 },
+};
+
+const u16 rsi_mcsrates[8] = {
+        RSI_RATE_MCS0, RSI_RATE_MCS1, RSI_RATE_MCS2, RSI_RATE_MCS3,
+        RSI_RATE_MCS4, RSI_RATE_MCS5, RSI_RATE_MCS6, RSI_RATE_MCS7
+};
+
+/**
+ * rsi_is_cipher_wep() -  This function determines if the cipher is WEP or not.
+ * @common: Pointer to the driver private structure.
+ *
+ * Return: If cipher type is WEP, a value of 1 is returned, else 0.
+ */
+
+bool rsi_is_cipher_wep(struct rsi_common *common)
+{
+        if (((common->secinfo.gtk_cipher == WLAN_CIPHER_SUITE_WEP104) ||
+             (common->secinfo.gtk_cipher == WLAN_CIPHER_SUITE_WEP40)) &&
+            (!common->secinfo.ptk_cipher))
+                return true;
+        else
+                return false;
+}
+
+/**
+ * rsi_register_rates_channels() - This function registers channels and rates.
+ * @adapter: Pointer to the adapter structure.
+ * @band: Operating band to be set.
+ *
+ * Return: None.
+ */
+static void rsi_register_rates_channels(struct rsi_hw *adapter, int band)
+{
+        struct ieee80211_supported_band *sbands = &adapter->sbands[band];
+        void *channels = NULL;
+
+        if (band == IEEE80211_BAND_2GHZ) {
+                channels = kmalloc(sizeof(rsi_2ghz_channels), GFP_KERNEL);
+                memcpy(channels,
+                       rsi_2ghz_channels,
+                       sizeof(rsi_2ghz_channels));
+                sbands->band = IEEE80211_BAND_2GHZ;
+                sbands->n_channels = ARRAY_SIZE(rsi_2ghz_channels);
+                sbands->bitrates = rsi_rates;
+                sbands->n_bitrates = ARRAY_SIZE(rsi_rates);
+        } else {
+                channels = kmalloc(sizeof(rsi_5ghz_channels), GFP_KERNEL);
+                memcpy(channels,
+                       rsi_5ghz_channels,
+                       sizeof(rsi_5ghz_channels));
+                sbands->band = IEEE80211_BAND_5GHZ;
+                sbands->n_channels = ARRAY_SIZE(rsi_5ghz_channels);
+                sbands->bitrates = &rsi_rates[4];
+                sbands->n_bitrates = ARRAY_SIZE(rsi_rates) - 4;
+        }
+
+        sbands->channels = channels;
+
+        memset(&sbands->ht_cap, 0, sizeof(struct ieee80211_sta_ht_cap));
+        sbands->ht_cap.ht_supported = true;
+        sbands->ht_cap.cap = (IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
+                              IEEE80211_HT_CAP_SGI_20 |
+                              IEEE80211_HT_CAP_SGI_40);
+        sbands->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_8K;
+        sbands->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_NONE;
+        sbands->ht_cap.mcs.rx_mask[0] = 0xff;
+        sbands->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
+        /* sbands->ht_cap.mcs.rx_highest = 0x82; */
+}
+
+/**
+ * rsi_mac80211_attach() - This function is used to de-initialize the
+ *                         Mac80211 stack.
+ * @adapter: Pointer to the adapter structure.
+ *
+ * Return: None.
+ */
+void rsi_mac80211_detach(struct rsi_hw *adapter)
+{
+        struct ieee80211_hw *hw = adapter->hw;
+
+        if (hw) {
+                ieee80211_stop_queues(hw);
+                ieee80211_unregister_hw(hw);
+                ieee80211_free_hw(hw);
+        }
+
+        rsi_remove_dbgfs(adapter);
+}
+EXPORT_SYMBOL_GPL(rsi_mac80211_detach);
+
+/**
+ * rsi_indicate_tx_status() - This function indicates the transmit status.
+ * @adapter: Pointer to the adapter structure.
+ * @skb: Pointer to the socket buffer structure.
+ * @status: Status
+ *
+ * Return: None.
+ */
+void rsi_indicate_tx_status(struct rsi_hw *adapter,
+                            struct sk_buff *skb,
+                            int status)
+{
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+
+        memset(info->driver_data, 0, IEEE80211_TX_INFO_DRIVER_DATA_SIZE);
+
+        if (!status)
+                info->flags |= IEEE80211_TX_STAT_ACK;
+
+        ieee80211_tx_status_irqsafe(adapter->hw, skb);
+}
+
+/**
+ * rsi_mac80211_tx() - This is the handler that 802.11 module calls for each
+ *                     transmitted frame.SKB contains the buffer starting
+ *                     from the IEEE 802.11 header.
+ * @hw: Pointer to the ieee80211_hw structure.
+ * @control: Pointer to the ieee80211_tx_control structure
+ * @skb: Pointer to the socket buffer structure.
+ *
+ * Return: None
+ */
+static void rsi_mac80211_tx(struct ieee80211_hw *hw,
+                            struct ieee80211_tx_control *control,
+                            struct sk_buff *skb)
+{
+        struct rsi_hw *adapter = hw->priv;
+        struct rsi_common *common = adapter->priv;
+
+        rsi_core_xmit(common, skb);
+}
+
+/**
+ * rsi_mac80211_start() - This is first handler that 802.11 module calls, since
+ *                        the driver init is complete by then, just
+ *                        returns success.
+ * @hw: Pointer to the ieee80211_hw structure.
+ *
+ * Return: 0 as success.
+ */
+static int rsi_mac80211_start(struct ieee80211_hw *hw)
+{
+        struct rsi_hw *adapter = hw->priv;
+        struct rsi_common *common = adapter->priv;
+
+        mutex_lock(&common->mutex);
+        common->iface_down = false;
+        mutex_unlock(&common->mutex);
+
+        return 0;
+}
+
+/**
+ * rsi_mac80211_stop() - This is the last handler that 802.11 module calls.
+ * @hw: Pointer to the ieee80211_hw structure.
+ *
+ * Return: None.
+ */
+static void rsi_mac80211_stop(struct ieee80211_hw *hw)
+{
+        struct rsi_hw *adapter = hw->priv;
+        struct rsi_common *common = adapter->priv;
+
+        mutex_lock(&common->mutex);
+        common->iface_down = true;
+        mutex_unlock(&common->mutex);
+}
+
+/**
+ * rsi_mac80211_add_interface() - This function is called when a netdevice
+ *                                attached to the hardware is enabled.
+ * @hw: Pointer to the ieee80211_hw structure.
+ * @vif: Pointer to the ieee80211_vif structure.
+ *
+ * Return: ret: 0 on success, negative error code on failure.
+ */
+static int rsi_mac80211_add_interface(struct ieee80211_hw *hw,
+                                      struct ieee80211_vif *vif)
+{
+        struct rsi_hw *adapter = hw->priv;
+        struct rsi_common *common = adapter->priv;
+        int ret = -EOPNOTSUPP;
+
+        mutex_lock(&common->mutex);
+        switch (vif->type) {
+        case NL80211_IFTYPE_STATION:
+                if (!adapter->sc_nvifs) {
+                        ++adapter->sc_nvifs;
+                        adapter->vifs[0] = vif;
+                        ret = rsi_set_vap_capabilities(common, STA_OPMODE);
+                }
+                break;
+        default:
+                rsi_dbg(ERR_ZONE,
+                        "%s: Interface type %d not supported\n", __func__,
+                        vif->type);
+        }
+        mutex_unlock(&common->mutex);
+
+        return ret;
+}
+
+/**
+ * rsi_mac80211_remove_interface() - This function notifies driver that an
+ *                                   interface is going down.
+ * @hw: Pointer to the ieee80211_hw structure.
+ * @vif: Pointer to the ieee80211_vif structure.
+ *
+ * Return: None.
+ */
+static void rsi_mac80211_remove_interface(struct ieee80211_hw *hw,
+                                          struct ieee80211_vif *vif)
+{
+        struct rsi_hw *adapter = hw->priv;
+        struct rsi_common *common = adapter->priv;
+
+        mutex_lock(&common->mutex);
+        if (vif->type == NL80211_IFTYPE_STATION)
+                adapter->sc_nvifs--;
+
+        if (!memcmp(adapter->vifs[0], vif, sizeof(struct ieee80211_vif)))
+                adapter->vifs[0] = NULL;
+        mutex_unlock(&common->mutex);
+}
+
+/**
+ * rsi_mac80211_config() - This function is a handler for configuration
+ *                         requests. The stack calls this function to
+ *                         change hardware configuration, e.g., channel.
+ * @hw: Pointer to the ieee80211_hw structure.
+ * @changed: Changed flags set.
+ *
+ * Return: 0 on success, negative error code on failure.
+ */
+static int rsi_mac80211_config(struct ieee80211_hw *hw,
+                               u32 changed)
+{
+        struct rsi_hw *adapter = hw->priv;
+        struct rsi_common *common = adapter->priv;
+        int status = -EOPNOTSUPP;
+
+        mutex_lock(&common->mutex);
+        if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
+                struct ieee80211_channel *curchan = hw->conf.chandef.chan;
+                u16 channel = curchan->hw_value;
+
+                rsi_dbg(INFO_ZONE,
+                        "%s: Set channel: %d MHz type: %d channel_no %d\n",
+                        __func__, curchan->center_freq,
+                        curchan->flags, channel);
+                common->band = curchan->band;
+                status = rsi_set_channel(adapter->priv, channel);
+        }
+        mutex_unlock(&common->mutex);
+
+        return status;
+}
+
+/**
+ * rsi_get_connected_channel() - This function is used to get the current
+ *                               connected channel number.
+ * @adapter: Pointer to the adapter structure.
+ *
+ * Return: Current connected AP's channel number is returned.
+ */
+u16 rsi_get_connected_channel(struct rsi_hw *adapter)
+{
+        struct ieee80211_vif *vif = adapter->vifs[0];
+        if (vif) {
+                struct ieee80211_bss_conf *bss = &vif->bss_conf;
+                struct ieee80211_channel *channel = bss->chandef.chan;
+                return channel->hw_value;
+        }
+
+        return 0;
+}
+
+/**
+ * rsi_mac80211_bss_info_changed() - This function is a handler for config
+ *                                   requests related to BSS parameters that
+ *                                   may vary during BSS's lifespan.
+ * @hw: Pointer to the ieee80211_hw structure.
+ * @vif: Pointer to the ieee80211_vif structure.
+ * @bss_conf: Pointer to the ieee80211_bss_conf structure.
+ * @changed: Changed flags set.
+ *
+ * Return: None.
+ */
+static void rsi_mac80211_bss_info_changed(struct ieee80211_hw *hw,
+                                          struct ieee80211_vif *vif,
+                                          struct ieee80211_bss_conf *bss_conf,
+                                          u32 changed)
+{
+        struct rsi_hw *adapter = hw->priv;
+        struct rsi_common *common = adapter->priv;
+
+        mutex_lock(&common->mutex);
+        if (changed & BSS_CHANGED_ASSOC) {
+                rsi_dbg(INFO_ZONE, "%s: Changed Association status: %d\n",
+                        __func__, bss_conf->assoc);
+                rsi_inform_bss_status(common,
+                                      bss_conf->assoc,
+                                      bss_conf->bssid,
+                                      bss_conf->qos,
+                                      bss_conf->aid);
+        }
+        mutex_unlock(&common->mutex);
+}
+
+/**
+ * rsi_mac80211_conf_filter() - This function configure the device's RX filter.
+ * @hw: Pointer to the ieee80211_hw structure.
+ * @changed: Changed flags set.
+ * @total_flags: Total initial flags set.
+ * @multicast: Multicast.
+ *
+ * Return: None.
+ */
+static void rsi_mac80211_conf_filter(struct ieee80211_hw *hw,
+                                     u32 changed_flags,
+                                     u32 *total_flags,
+                                     u64 multicast)
+{
+        /* Not doing much here as of now */
+        *total_flags &= RSI_SUPP_FILTERS;
+}
+
+/**
+ * rsi_mac80211_conf_tx() - This function configures TX queue parameters
+ *                          (EDCF (aifs, cw_min, cw_max), bursting)
+ *                          for a hardware TX queue.
+ * @hw: Pointer to the ieee80211_hw structure
+ * @vif: Pointer to the ieee80211_vif structure.
+ * @queue: Queue number.
+ * @params: Pointer to ieee80211_tx_queue_params structure.
+ *
+ * Return: 0 on success, negative error code on failure.
+ */
+static int rsi_mac80211_conf_tx(struct ieee80211_hw *hw,
+                                struct ieee80211_vif *vif, u16 queue,
+                                const struct ieee80211_tx_queue_params *params)
+{
+        struct rsi_hw *adapter = hw->priv;
+        struct rsi_common *common = adapter->priv;
+        u8 idx = 0;
+
+        if (queue >= IEEE80211_NUM_ACS)
+                return 0;
+
+        rsi_dbg(INFO_ZONE,
+                "%s: Conf queue %d, aifs: %d, cwmin: %d cwmax: %d, txop: %d\n",
+                __func__, queue, params->aifs,
+                params->cw_min, params->cw_max, params->txop);
+
+        mutex_lock(&common->mutex);
+        /* Map into the way the f/w expects */
+        switch (queue) {
+        case IEEE80211_AC_VO:
+                idx = VO_Q;
+                break;
+        case IEEE80211_AC_VI:
+                idx = VI_Q;
+                break;
+        case IEEE80211_AC_BE:
+                idx = BE_Q;
+                break;
+        case IEEE80211_AC_BK:
+                idx = BK_Q;
+                break;
+        default:
+                idx = BE_Q;
+                break;
+        }
+
+        memcpy(&common->edca_params[idx],
+               params,
+               sizeof(struct ieee80211_tx_queue_params));
+        mutex_unlock(&common->mutex);
+
+        return 0;
+}
+
+/**
+ * rsi_hal_key_config() - This function loads the keys into the firmware.
+ * @hw: Pointer to the ieee80211_hw structure.
+ * @vif: Pointer to the ieee80211_vif structure.
+ * @key: Pointer to the ieee80211_key_conf structure.
+ *
+ * Return: status: 0 on success, -1 on failure.
+ */
+static int rsi_hal_key_config(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif,
+                              struct ieee80211_key_conf *key)
+{
+        struct rsi_hw *adapter = hw->priv;
+        int status;
+        u8 key_type;
+
+        if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE)
+                key_type = RSI_PAIRWISE_KEY;
+        else
+                key_type = RSI_GROUP_KEY;
+
+        rsi_dbg(ERR_ZONE, "%s: Cipher 0x%x key_type: %d key_len: %d\n",
+                __func__, key->cipher, key_type, key->keylen);
+
+        if ((key->cipher == WLAN_CIPHER_SUITE_WEP104) ||
+            (key->cipher == WLAN_CIPHER_SUITE_WEP40)) {
+                status = rsi_hal_load_key(adapter->priv,
+                                          key->key,
+                                          key->keylen,
+                                          RSI_PAIRWISE_KEY,
+                                          key->keyidx,
+                                          key->cipher);
+                if (status)
+                        return status;
+        }
+        return rsi_hal_load_key(adapter->priv,
+                                key->key,
+                                key->keylen,
+                                key_type,
+                                key->keyidx,
+                                key->cipher);
+}
+
+/**
+ * rsi_mac80211_set_key() - This function sets type of key to be loaded.
+ * @hw: Pointer to the ieee80211_hw structure.
+ * @cmd: enum set_key_cmd.
+ * @vif: Pointer to the ieee80211_vif structure.
+ * @sta: Pointer to the ieee80211_sta structure.
+ * @key: Pointer to the ieee80211_key_conf structure.
+ *
+ * Return: status: 0 on success, negative error code on failure.
+ */
+static int rsi_mac80211_set_key(struct ieee80211_hw *hw,
+                                enum set_key_cmd cmd,
+                                struct ieee80211_vif *vif,
+                                struct ieee80211_sta *sta,
+                                struct ieee80211_key_conf *key)
+{
+        struct rsi_hw *adapter = hw->priv;
+        struct rsi_common *common = adapter->priv;
+        struct security_info *secinfo = &common->secinfo;
+        int status;
+
+        mutex_lock(&common->mutex);
+        switch (cmd) {
+        case SET_KEY:
+                secinfo->security_enable = true;
+                status = rsi_hal_key_config(hw, vif, key);
+                if (status) {
+                        mutex_unlock(&common->mutex);
+                        return status;
+                }
+
+                if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE)
+                        secinfo->ptk_cipher = key->cipher;
+                else
+                        secinfo->gtk_cipher = key->cipher;
+
+                key->hw_key_idx = key->keyidx;
+                key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
+
+                rsi_dbg(ERR_ZONE, "%s: RSI set_key\n", __func__);
+                break;
+
+        case DISABLE_KEY:
+                secinfo->security_enable = false;
+                rsi_dbg(ERR_ZONE, "%s: RSI del key\n", __func__);
+                memset(key, 0, sizeof(struct ieee80211_key_conf));
+                status = rsi_hal_key_config(hw, vif, key);
+                break;
+
+        default:
+                status = -EOPNOTSUPP;
+                break;
+        }
+
+        mutex_unlock(&common->mutex);
+        return status;
+}
+
+/**
+ * rsi_mac80211_ampdu_action() - This function selects the AMPDU action for
+ *                               the corresponding mlme_action flag and
+ *                               informs the f/w regarding this.
+ * @hw: Pointer to the ieee80211_hw structure.
+ * @vif: Pointer to the ieee80211_vif structure.
+ * @action: ieee80211_ampdu_mlme_action enum.
+ * @sta: Pointer to the ieee80211_sta structure.
+ * @tid: Traffic identifier.
+ * @ssn: Pointer to ssn value.
+ * @buf_size: Buffer size (for kernel version > 2.6.38).
+ *
+ * Return: status: 0 on success, negative error code on failure.
+ */
+static int rsi_mac80211_ampdu_action(struct ieee80211_hw *hw,
+                                     struct ieee80211_vif *vif,
+                                     enum ieee80211_ampdu_mlme_action action,
+                                     struct ieee80211_sta *sta,
+                                     unsigned short tid,
+                                     unsigned short *ssn,
+                                     unsigned char buf_size)
+{
+        int status = -EOPNOTSUPP;
+        struct rsi_hw *adapter = hw->priv;
+        struct rsi_common *common = adapter->priv;
+        u16 seq_no = 0;
+        u8 ii = 0;
+
+        for (ii = 0; ii < RSI_MAX_VIFS; ii++) {
+                if (vif == adapter->vifs[ii])
+                        break;
+        }
+
+        mutex_lock(&common->mutex);
+        rsi_dbg(INFO_ZONE, "%s: AMPDU action %d called\n", __func__, action);
+        if (ssn != NULL)
+                seq_no = *ssn;
+
+        switch (action) {
+        case IEEE80211_AMPDU_RX_START:
+                status = rsi_send_aggregation_params_frame(common,
+                                                           tid,
+                                                           seq_no,
+                                                           buf_size,
+                                                           STA_RX_ADDBA_DONE);
+                break;
+
+        case IEEE80211_AMPDU_RX_STOP:
+                status = rsi_send_aggregation_params_frame(common,
+                                                           tid,
+                                                           0,
+                                                           buf_size,
+                                                           STA_RX_DELBA);
+                break;
+
+        case IEEE80211_AMPDU_TX_START:
+                common->vif_info[ii].seq_start = seq_no;
+                ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                break;
+
+        case IEEE80211_AMPDU_TX_STOP_CONT:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
+                status = rsi_send_aggregation_params_frame(common,
+                                                           tid,
+                                                           seq_no,
+                                                           buf_size,
+                                                           STA_TX_DELBA);
+                if (!status)
+                        ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                break;
+
+        case IEEE80211_AMPDU_TX_OPERATIONAL:
+                status = rsi_send_aggregation_params_frame(common,
+                                                           tid,
+                                                           common->vif_info[ii]
+                                                                .seq_start,
+                                                           buf_size,
+                                                           STA_TX_ADDBA_DONE);
+                break;
+
+        default:
+                rsi_dbg(ERR_ZONE, "%s: Uknown AMPDU action\n", __func__);
+                break;
+        }
+
+        mutex_unlock(&common->mutex);
+        return status;
+}
+
+/**
+ * rsi_mac80211_set_rts_threshold() - This function sets rts threshold value.
+ * @hw: Pointer to the ieee80211_hw structure.
+ * @value: Rts threshold value.
+ *
+ * Return: 0 on success.
+ */
+static int rsi_mac80211_set_rts_threshold(struct ieee80211_hw *hw,
+                                          u32 value)
+{
+        struct rsi_hw *adapter = hw->priv;
+        struct rsi_common *common = adapter->priv;
+
+        mutex_lock(&common->mutex);
+        common->rts_threshold = value;
+        mutex_unlock(&common->mutex);
+
+        return 0;
+}
+
+/**
+ * rsi_mac80211_set_rate_mask() - This function sets bitrate_mask to be used.
+ * @hw: Pointer to the ieee80211_hw structure
+ * @vif: Pointer to the ieee80211_vif structure.
+ * @mask: Pointer to the cfg80211_bitrate_mask structure.
+ *
+ * Return: 0 on success.
+ */
+static int rsi_mac80211_set_rate_mask(struct ieee80211_hw *hw,
+                                      struct ieee80211_vif *vif,
+                                      const struct cfg80211_bitrate_mask *mask)
+{
+        struct rsi_hw *adapter = hw->priv;
+        struct rsi_common *common = adapter->priv;
+
+        mutex_lock(&common->mutex);
+
+        common->fixedrate_mask[IEEE80211_BAND_2GHZ] = 0;
+
+        if (mask->control[IEEE80211_BAND_2GHZ].legacy == 0xfff) {
+                common->fixedrate_mask[IEEE80211_BAND_2GHZ] =
+                        (mask->control[IEEE80211_BAND_2GHZ].ht_mcs[0] << 12);
+        } else {
+                common->fixedrate_mask[IEEE80211_BAND_2GHZ] =
+                        mask->control[IEEE80211_BAND_2GHZ].legacy;
+        }
+        mutex_unlock(&common->mutex);
+
+        return 0;
+}
+
+/**
+ * rsi_fill_rx_status() - This function fills rx status in
+ *                        ieee80211_rx_status structure.
+ * @hw: Pointer to the ieee80211_hw structure.
+ * @skb: Pointer to the socket buffer structure.
+ * @common: Pointer to the driver private structure.
+ * @rxs: Pointer to the ieee80211_rx_status structure.
+ *
+ * Return: None.
+ */
+static void rsi_fill_rx_status(struct ieee80211_hw *hw,
+                               struct sk_buff *skb,
+                               struct rsi_common *common,
+                               struct ieee80211_rx_status *rxs)
+{
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct skb_info *rx_params = (struct skb_info *)info->driver_data;
+        struct ieee80211_hdr *hdr;
+        char rssi = rx_params->rssi;
+        u8 hdrlen = 0;
+        u8 channel = rx_params->channel;
+        s32 freq;
+
+        hdr = ((struct ieee80211_hdr *)(skb->data));
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
+
+        memset(info, 0, sizeof(struct ieee80211_tx_info));
+
+        rxs->signal = -(rssi);
+
+        if (channel <= 14)
+                rxs->band = IEEE80211_BAND_2GHZ;
+        else
+                rxs->band = IEEE80211_BAND_5GHZ;
+
+        freq = ieee80211_channel_to_frequency(channel, rxs->band);
+
+        if (freq)
+                rxs->freq = freq;
+
+        if (ieee80211_has_protected(hdr->frame_control)) {
+                if (rsi_is_cipher_wep(common)) {
+                        memmove(skb->data + 4, skb->data, hdrlen);
+                        skb_pull(skb, 4);
+                } else {
+                        memmove(skb->data + 8, skb->data, hdrlen);
+                        skb_pull(skb, 8);
+                        rxs->flag |= RX_FLAG_MMIC_STRIPPED;
+                }
+                rxs->flag |= RX_FLAG_DECRYPTED;
+                rxs->flag |= RX_FLAG_IV_STRIPPED;
+        }
+}
+
+/**
+ * rsi_indicate_pkt_to_os() - This function sends recieved packet to mac80211.
+ * @common: Pointer to the driver private structure.
+ * @skb: Pointer to the socket buffer structure.
+ *
+ * Return: None.
+ */
+void rsi_indicate_pkt_to_os(struct rsi_common *common,
+                            struct sk_buff *skb)
+{
+        struct rsi_hw *adapter = common->priv;
+        struct ieee80211_hw *hw = adapter->hw;
+        struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
+
+        if ((common->iface_down) || (!adapter->sc_nvifs)) {
+                dev_kfree_skb(skb);
+                return;
+        }
+
+        /* filling in the ieee80211_rx_status flags */
+        rsi_fill_rx_status(hw, skb, common, rx_status);
+
+        ieee80211_rx_irqsafe(hw, skb);
+}
+
+static void rsi_set_min_rate(struct ieee80211_hw *hw,
+                             struct ieee80211_sta *sta,
+                             struct rsi_common *common)
+{
+        u8 band = hw->conf.chandef.chan->band;
+        u8 ii;
+        u32 rate_bitmap;
+        bool matched = false;
+
+        common->bitrate_mask[band] = sta->supp_rates[band];
+
+        rate_bitmap = (common->fixedrate_mask[band] & sta->supp_rates[band]);
+
+        if (rate_bitmap & 0xfff) {
+                /* Find out the min rate */
+                for (ii = 0; ii < ARRAY_SIZE(rsi_rates); ii++) {
+                        if (rate_bitmap & BIT(ii)) {
+                                common->min_rate = rsi_rates[ii].hw_value;
+                                matched = true;
+                                break;
+                        }
+                }
+        }
+
+        common->vif_info[0].is_ht = sta->ht_cap.ht_supported;
+
+        if ((common->vif_info[0].is_ht) && (rate_bitmap >> 12)) {
+                for (ii = 0; ii < ARRAY_SIZE(rsi_mcsrates); ii++) {
+                        if ((rate_bitmap >> 12) & BIT(ii)) {
+                                common->min_rate = rsi_mcsrates[ii];
+                                matched = true;
+                                break;
+                        }
+                }
+        }
+
+        if (!matched)
+                common->min_rate = 0xffff;
+}
+
+/**
+ * rsi_mac80211_sta_add() - This function notifies driver about a peer getting
+ *                          connected.
+ * @hw: pointer to the ieee80211_hw structure.
+ * @vif: Pointer to the ieee80211_vif structure.
+ * @sta: Pointer to the ieee80211_sta structure.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+static int rsi_mac80211_sta_add(struct ieee80211_hw *hw,
+                                struct ieee80211_vif *vif,
+                                struct ieee80211_sta *sta)
+{
+        struct rsi_hw *adapter = hw->priv;
+        struct rsi_common *common = adapter->priv;
+
+        mutex_lock(&common->mutex);
+
+        rsi_set_min_rate(hw, sta, common);
+
+        if ((sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20) ||
+            (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)) {
+                common->vif_info[0].sgi = true;
+        }
+
+        if (sta->ht_cap.ht_supported)
+                ieee80211_start_tx_ba_session(sta, 0, 0);
+
+        mutex_unlock(&common->mutex);
+
+        return 0;
+}
+
+/**
+ * rsi_mac80211_sta_remove() - This function notifies driver about a peer
+ *                             getting disconnected.
+ * @hw: Pointer to the ieee80211_hw structure.
+ * @vif: Pointer to the ieee80211_vif structure.
+ * @sta: Pointer to the ieee80211_sta structure.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+static int rsi_mac80211_sta_remove(struct ieee80211_hw *hw,
+                                   struct ieee80211_vif *vif,
+                                   struct ieee80211_sta *sta)
+{
+        struct rsi_hw *adapter = hw->priv;
+        struct rsi_common *common = adapter->priv;
+
+        mutex_lock(&common->mutex);
+        /* Resetting all the fields to default values */
+        common->bitrate_mask[IEEE80211_BAND_2GHZ] = 0;
+        common->bitrate_mask[IEEE80211_BAND_5GHZ] = 0;
+        common->min_rate = 0xffff;
+        common->vif_info[0].is_ht = false;
+        common->vif_info[0].sgi = false;
+        common->vif_info[0].seq_start = 0;
+        common->secinfo.ptk_cipher = 0;
+        common->secinfo.gtk_cipher = 0;
+        mutex_unlock(&common->mutex);
+
+        return 0;
+}
+
+static struct ieee80211_ops mac80211_ops = {
+        .tx = rsi_mac80211_tx,
+        .start = rsi_mac80211_start,
+        .stop = rsi_mac80211_stop,
+        .add_interface = rsi_mac80211_add_interface,
+        .remove_interface = rsi_mac80211_remove_interface,
+        .config = rsi_mac80211_config,
+        .bss_info_changed = rsi_mac80211_bss_info_changed,
+        .conf_tx = rsi_mac80211_conf_tx,
+        .configure_filter = rsi_mac80211_conf_filter,
+        .set_key = rsi_mac80211_set_key,
+        .set_rts_threshold = rsi_mac80211_set_rts_threshold,
+        .set_bitrate_mask = rsi_mac80211_set_rate_mask,
+        .ampdu_action = rsi_mac80211_ampdu_action,
+        .sta_add = rsi_mac80211_sta_add,
+        .sta_remove = rsi_mac80211_sta_remove,
+};
+
+/**
+ * rsi_mac80211_attach() - This function is used to initialize Mac80211 stack.
+ * @common: Pointer to the driver private structure.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+int rsi_mac80211_attach(struct rsi_common *common)
+{
+        int status = 0;
+        struct ieee80211_hw *hw = NULL;
+        struct wiphy *wiphy = NULL;
+        struct rsi_hw *adapter = common->priv;
+        u8 addr_mask[ETH_ALEN] = {0x0, 0x0, 0x0, 0x0, 0x0, 0x3};
+
+        rsi_dbg(INIT_ZONE, "%s: Performing mac80211 attach\n", __func__);
+
+        hw = ieee80211_alloc_hw(sizeof(struct rsi_hw), &mac80211_ops);
+        if (!hw) {
+                rsi_dbg(ERR_ZONE, "%s: ieee80211 hw alloc failed\n", __func__);
+                return -ENOMEM;
+        }
+
+        wiphy = hw->wiphy;
+
+        SET_IEEE80211_DEV(hw, adapter->device);
+
+        hw->priv = adapter;
+        adapter->hw = hw;
+
+        hw->flags = IEEE80211_HW_SIGNAL_DBM |
+                    IEEE80211_HW_HAS_RATE_CONTROL |
+                    IEEE80211_HW_AMPDU_AGGREGATION |
+                    0;
+
+        hw->queues = MAX_HW_QUEUES;
+        hw->extra_tx_headroom = RSI_NEEDED_HEADROOM;
+
+        hw->max_rates = 1;
+        hw->max_rate_tries = MAX_RETRIES;
+
+        hw->max_tx_aggregation_subframes = 6;
+        rsi_register_rates_channels(adapter, IEEE80211_BAND_2GHZ);
+        hw->rate_control_algorithm = "AARF";
+
+        SET_IEEE80211_PERM_ADDR(hw, common->mac_addr);
+        ether_addr_copy(hw->wiphy->addr_mask, addr_mask);
+
+        wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
+        wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
+        wiphy->retry_short = RETRY_SHORT;
+        wiphy->retry_long  = RETRY_LONG;
+        wiphy->frag_threshold = IEEE80211_MAX_FRAG_THRESHOLD;
+        wiphy->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
+        wiphy->flags = 0;
+
+        wiphy->available_antennas_rx = 1;
+        wiphy->available_antennas_tx = 1;
+        wiphy->bands[IEEE80211_BAND_2GHZ] =
+                &adapter->sbands[IEEE80211_BAND_2GHZ];
+
+        status = ieee80211_register_hw(hw);
+        if (status)
+                return status;
+
+        return rsi_init_dbgfs(adapter);
+}
diff --git a/drivers/net/wireless/rsi/rsi_91x_main.c b/drivers/net/wireless/rsi/rsi_91x_main.c
new file mode 100644
index 000000000000..8810862ae826
--- /dev/null
+++ b/drivers/net/wireless/rsi/rsi_91x_main.c
@@ -0,0 +1,295 @@
+/**
+ * Copyright (c) 2014 Redpine Signals Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/module.h>
+#include <linux/firmware.h>
+#include "rsi_mgmt.h"
+#include "rsi_common.h"
+
+u32 rsi_zone_enabled = /* INFO_ZONE |
+                        INIT_ZONE |
+                        MGMT_TX_ZONE |
+                        MGMT_RX_ZONE |
+                        DATA_TX_ZONE |
+                        DATA_RX_ZONE |
+                        FSM_ZONE |
+                        ISR_ZONE | */
+                        ERR_ZONE |
+                        0;
+EXPORT_SYMBOL_GPL(rsi_zone_enabled);
+
+/**
+ * rsi_dbg() - This function outputs informational messages.
+ * @zone: Zone of interest for output message.
+ * @fmt: printf-style format for output message.
+ *
+ * Return: none
+ */
+void rsi_dbg(u32 zone, const char *fmt, ...)
+{
+        struct va_format vaf;
+        va_list args;
+
+        va_start(args, fmt);
+
+        vaf.fmt = fmt;
+        vaf.va = &args;
+
+        if (zone & rsi_zone_enabled)
+                pr_info("%pV", &vaf);
+        va_end(args);
+}
+EXPORT_SYMBOL_GPL(rsi_dbg);
+
+/**
+ * rsi_prepare_skb() - This function prepares the skb.
+ * @common: Pointer to the driver private structure.
+ * @buffer: Pointer to the packet data.
+ * @pkt_len: Length of the packet.
+ * @extended_desc: Extended descriptor.
+ *
+ * Return: Successfully skb.
+ */
+static struct sk_buff *rsi_prepare_skb(struct rsi_common *common,
+                                       u8 *buffer,
+                                       u32 pkt_len,
+                                       u8 extended_desc)
+{
+        struct ieee80211_tx_info *info;
+        struct skb_info *rx_params;
+        struct sk_buff *skb = NULL;
+        u8 payload_offset;
+
+        if (WARN(!pkt_len, "%s: Dummy pkt received", __func__))
+                return NULL;
+
+        if (pkt_len > (RSI_RCV_BUFFER_LEN * 4)) {
+                rsi_dbg(ERR_ZONE, "%s: Pkt size > max rx buf size %d\n",
+                        __func__, pkt_len);
+                pkt_len = RSI_RCV_BUFFER_LEN * 4;
+        }
+
+        pkt_len -= extended_desc;
+        skb = dev_alloc_skb(pkt_len + FRAME_DESC_SZ);
+        if (skb == NULL)
+                return NULL;
+
+        payload_offset = (extended_desc + FRAME_DESC_SZ);
+        skb_put(skb, pkt_len);
+        memcpy((skb->data), (buffer + payload_offset), skb->len);
+
+        info = IEEE80211_SKB_CB(skb);
+        rx_params = (struct skb_info *)info->driver_data;
+        rx_params->rssi = rsi_get_rssi(buffer);
+        rx_params->channel = rsi_get_connected_channel(common->priv);
+
+        return skb;
+}
+
+/**
+ * rsi_read_pkt() - This function reads frames from the card.
+ * @common: Pointer to the driver private structure.
+ * @rcv_pkt_len: Received pkt length. In case of USB it is 0.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+int rsi_read_pkt(struct rsi_common *common, s32 rcv_pkt_len)
+{
+        u8 *frame_desc = NULL, extended_desc = 0;
+        u32 index, length = 0, queueno = 0;
+        u16 actual_length = 0, offset;
+        struct sk_buff *skb = NULL;
+
+        index = 0;
+        do {
+                frame_desc = &common->rx_data_pkt[index];
+                actual_length = *(u16 *)&frame_desc[0];
+                offset = *(u16 *)&frame_desc[2];
+
+                queueno = rsi_get_queueno(frame_desc, offset);
+                length = rsi_get_length(frame_desc, offset);
+                extended_desc = rsi_get_extended_desc(frame_desc, offset);
+
+                switch (queueno) {
+                case RSI_WIFI_DATA_Q:
+                        skb = rsi_prepare_skb(common,
+                                              (frame_desc + offset),
+                                              length,
+                                              extended_desc);
+                        if (skb == NULL)
+                                goto fail;
+
+                        rsi_indicate_pkt_to_os(common, skb);
+                        break;
+
+                case RSI_WIFI_MGMT_Q:
+                        rsi_mgmt_pkt_recv(common, (frame_desc + offset));
+                        break;
+
+                default:
+                        rsi_dbg(ERR_ZONE, "%s: pkt from invalid queue: %d\n",
+                                __func__,   queueno);
+                        goto fail;
+                }
+
+                index  += actual_length;
+                rcv_pkt_len -= actual_length;
+        } while (rcv_pkt_len > 0);
+
+        return 0;
+fail:
+        return -EINVAL;
+}
+EXPORT_SYMBOL_GPL(rsi_read_pkt);
+
+/**
+ * rsi_tx_scheduler_thread() - This function is a kernel thread to send the
+ *                             packets to the device.
+ * @common: Pointer to the driver private structure.
+ *
+ * Return: None.
+ */
+static void rsi_tx_scheduler_thread(struct rsi_common *common)
+{
+        struct rsi_hw *adapter = common->priv;
+        u32 timeout = EVENT_WAIT_FOREVER;
+
+        do {
+                if (adapter->determine_event_timeout)
+                        timeout = adapter->determine_event_timeout(adapter);
+                rsi_wait_event(&common->tx_thread.event, timeout);
+                rsi_reset_event(&common->tx_thread.event);
+
+                if (common->init_done)
+                        rsi_core_qos_processor(common);
+        } while (atomic_read(&common->tx_thread.thread_done) == 0);
+        complete_and_exit(&common->tx_thread.completion, 0);
+}
+
+/**
+ * rsi_91x_init() - This function initializes os interface operations.
+ * @void: Void.
+ *
+ * Return: Pointer to the adapter structure on success, NULL on failure .
+ */
+struct rsi_hw *rsi_91x_init(void)
+{
+        struct rsi_hw *adapter = NULL;
+        struct rsi_common *common = NULL;
+        u8 ii = 0;
+
+        adapter = kzalloc(sizeof(*adapter), GFP_KERNEL);
+        if (!adapter)
+                return NULL;
+
+        adapter->priv = kzalloc(sizeof(*common), GFP_KERNEL);
+        if (adapter->priv == NULL) {
+                rsi_dbg(ERR_ZONE, "%s: Failed in allocation of memory\n",
+                        __func__);
+                kfree(adapter);
+                return NULL;
+        } else {
+                common = adapter->priv;
+                common->priv = adapter;
+        }
+
+        for (ii = 0; ii < NUM_SOFT_QUEUES; ii++)
+                skb_queue_head_init(&common->tx_queue[ii]);
+
+        rsi_init_event(&common->tx_thread.event);
+        mutex_init(&common->mutex);
+        mutex_init(&common->tx_rxlock);
+
+        if (rsi_create_kthread(common,
+                               &common->tx_thread,
+                               rsi_tx_scheduler_thread,
+                               "Tx-Thread")) {
+                rsi_dbg(ERR_ZONE, "%s: Unable to init tx thrd\n", __func__);
+                goto err;
+        }
+
+        common->init_done = true;
+        return adapter;
+
+err:
+        kfree(common);
+        kfree(adapter);
+        return NULL;
+}
+EXPORT_SYMBOL_GPL(rsi_91x_init);
+
+/**
+ * rsi_91x_deinit() - This function de-intializes os intf operations.
+ * @adapter: Pointer to the adapter structure.
+ *
+ * Return: None.
+ */
+void rsi_91x_deinit(struct rsi_hw *adapter)
+{
+        struct rsi_common *common = adapter->priv;
+        u8 ii;
+
+        rsi_dbg(INFO_ZONE, "%s: Performing deinit os ops\n", __func__);
+
+        rsi_kill_thread(&common->tx_thread);
+
+        for (ii = 0; ii < NUM_SOFT_QUEUES; ii++)
+                skb_queue_purge(&common->tx_queue[ii]);
+
+        common->init_done = false;
+
+        kfree(common);
+        kfree(adapter->rsi_dev);
+        kfree(adapter);
+}
+EXPORT_SYMBOL_GPL(rsi_91x_deinit);
+
+/**
+ * rsi_91x_hal_module_init() - This function is invoked when the module is
+ *                             loaded into the kernel.
+ *                             It registers the client driver.
+ * @void: Void.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+static int rsi_91x_hal_module_init(void)
+{
+        rsi_dbg(INIT_ZONE, "%s: Module init called\n", __func__);
+        return 0;
+}
+
+/**
+ * rsi_91x_hal_module_exit() - This function is called at the time of
+ *                             removing/unloading the module.
+ *                             It unregisters the client driver.
+ * @void: Void.
+ *
+ * Return: None.
+ */
+static void rsi_91x_hal_module_exit(void)
+{
+        rsi_dbg(INIT_ZONE, "%s: Module exit called\n", __func__);
+}
+
+module_init(rsi_91x_hal_module_init);
+module_exit(rsi_91x_hal_module_exit);
+MODULE_AUTHOR("Redpine Signals Inc");
+MODULE_DESCRIPTION("Station driver for RSI 91x devices");
+MODULE_SUPPORTED_DEVICE("RSI-91x");
+MODULE_VERSION("0.1");
+MODULE_LICENSE("Dual BSD/GPL");
diff --git a/drivers/net/wireless/rsi/rsi_91x_mgmt.c b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
new file mode 100644
index 000000000000..ef37d4b27bd4
--- /dev/null
+++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
@@ -0,0 +1,1303 @@
+/**
+ * Copyright (c) 2014 Redpine Signals Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/etherdevice.h>
+#include "rsi_mgmt.h"
+#include "rsi_common.h"
+
+static struct bootup_params boot_params_20 = {
+        .magic_number = cpu_to_le16(0x5aa5),
+        .crystal_good_time = 0x0,
+        .valid = cpu_to_le32(VALID_20),
+        .reserved_for_valids = 0x0,
+        .bootup_mode_info = 0x0,
+        .digital_loop_back_params = 0x0,
+        .rtls_timestamp_en = 0x0,
+        .host_spi_intr_cfg = 0x0,
+        .device_clk_info = {{
+                .pll_config_g = {
+                        .tapll_info_g = {
+                                .pll_reg_1 = cpu_to_le16((TA_PLL_N_VAL_20 << 8)|
+                                              (TA_PLL_M_VAL_20)),
+                                .pll_reg_2 = cpu_to_le16(TA_PLL_P_VAL_20),
+                        },
+                        .pll960_info_g = {
+                                .pll_reg_1 = cpu_to_le16((PLL960_P_VAL_20 << 8)|
+                                                         (PLL960_N_VAL_20)),
+                                .pll_reg_2 = cpu_to_le16(PLL960_M_VAL_20),
+                                .pll_reg_3 = 0x0,
+                        },
+                        .afepll_info_g = {
+                                .pll_reg = cpu_to_le16(0x9f0),
+                        }
+                },
+                .switch_clk_g = {
+                        .switch_clk_info = cpu_to_le16(BIT(3)),
+                        .bbp_lmac_clk_reg_val = cpu_to_le16(0x121),
+                        .umac_clock_reg_config = 0x0,
+                        .qspi_uart_clock_reg_config = 0x0
+                }
+        },
+        {
+                .pll_config_g = {
+                        .tapll_info_g = {
+                                .pll_reg_1 = cpu_to_le16((TA_PLL_N_VAL_20 << 8)|
+                                                         (TA_PLL_M_VAL_20)),
+                                .pll_reg_2 = cpu_to_le16(TA_PLL_P_VAL_20),
+                        },
+                        .pll960_info_g = {
+                                .pll_reg_1 = cpu_to_le16((PLL960_P_VAL_20 << 8)|
+                                                         (PLL960_N_VAL_20)),
+                                .pll_reg_2 = cpu_to_le16(PLL960_M_VAL_20),
+                                .pll_reg_3 = 0x0,
+                        },
+                        .afepll_info_g = {
+                                .pll_reg = cpu_to_le16(0x9f0),
+                        }
+                },
+                .switch_clk_g = {
+                        .switch_clk_info = 0x0,
+                        .bbp_lmac_clk_reg_val = 0x0,
+                        .umac_clock_reg_config = 0x0,
+                        .qspi_uart_clock_reg_config = 0x0
+                }
+        },
+        {
+                .pll_config_g = {
+                        .tapll_info_g = {
+                                .pll_reg_1 = cpu_to_le16((TA_PLL_N_VAL_20 << 8)|
+                                                         (TA_PLL_M_VAL_20)),
+                                .pll_reg_2 = cpu_to_le16(TA_PLL_P_VAL_20),
+                        },
+                        .pll960_info_g = {
+                                .pll_reg_1 = cpu_to_le16((PLL960_P_VAL_20 << 8)|
+                                                         (PLL960_N_VAL_20)),
+                                .pll_reg_2 = cpu_to_le16(PLL960_M_VAL_20),
+                                .pll_reg_3 = 0x0,
+                        },
+                        .afepll_info_g = {
+                                .pll_reg = cpu_to_le16(0x9f0),
+                        }
+                },
+                .switch_clk_g = {
+                        .switch_clk_info = 0x0,
+                        .bbp_lmac_clk_reg_val = 0x0,
+                        .umac_clock_reg_config = 0x0,
+                        .qspi_uart_clock_reg_config = 0x0
+                }
+        } },
+        .buckboost_wakeup_cnt = 0x0,
+        .pmu_wakeup_wait = 0x0,
+        .shutdown_wait_time = 0x0,
+        .pmu_slp_clkout_sel = 0x0,
+        .wdt_prog_value = 0x0,
+        .wdt_soc_rst_delay = 0x0,
+        .dcdc_operation_mode = 0x0,
+        .soc_reset_wait_cnt = 0x0
+};
+
+static struct bootup_params boot_params_40 = {
+        .magic_number = cpu_to_le16(0x5aa5),
+        .crystal_good_time = 0x0,
+        .valid = cpu_to_le32(VALID_40),
+        .reserved_for_valids = 0x0,
+        .bootup_mode_info = 0x0,
+        .digital_loop_back_params = 0x0,
+        .rtls_timestamp_en = 0x0,
+        .host_spi_intr_cfg = 0x0,
+        .device_clk_info = {{
+                .pll_config_g = {
+                        .tapll_info_g = {
+                                .pll_reg_1 = cpu_to_le16((TA_PLL_N_VAL_40 << 8)|
+                                                         (TA_PLL_M_VAL_40)),
+                                .pll_reg_2 = cpu_to_le16(TA_PLL_P_VAL_40),
+                        },
+                        .pll960_info_g = {
+                                .pll_reg_1 = cpu_to_le16((PLL960_P_VAL_40 << 8)|
+                                                         (PLL960_N_VAL_40)),
+                                .pll_reg_2 = cpu_to_le16(PLL960_M_VAL_40),
+                                .pll_reg_3 = 0x0,
+                        },
+                        .afepll_info_g = {
+                                .pll_reg = cpu_to_le16(0x9f0),
+                        }
+                },
+                .switch_clk_g = {
+                        .switch_clk_info = cpu_to_le16(0x09),
+                        .bbp_lmac_clk_reg_val = cpu_to_le16(0x1121),
+                        .umac_clock_reg_config = cpu_to_le16(0x48),
+                        .qspi_uart_clock_reg_config = 0x0
+                }
+        },
+        {
+                .pll_config_g = {
+                        .tapll_info_g = {
+                                .pll_reg_1 = cpu_to_le16((TA_PLL_N_VAL_40 << 8)|
+                                                         (TA_PLL_M_VAL_40)),
+                                .pll_reg_2 = cpu_to_le16(TA_PLL_P_VAL_40),
+                        },
+                        .pll960_info_g = {
+                                .pll_reg_1 = cpu_to_le16((PLL960_P_VAL_40 << 8)|
+                                                         (PLL960_N_VAL_40)),
+                                .pll_reg_2 = cpu_to_le16(PLL960_M_VAL_40),
+                                .pll_reg_3 = 0x0,
+                        },
+                        .afepll_info_g = {
+                                .pll_reg = cpu_to_le16(0x9f0),
+                        }
+                },
+                .switch_clk_g = {
+                        .switch_clk_info = 0x0,
+                        .bbp_lmac_clk_reg_val = 0x0,
+                        .umac_clock_reg_config = 0x0,
+                        .qspi_uart_clock_reg_config = 0x0
+                }
+        },
+        {
+                .pll_config_g = {
+                        .tapll_info_g = {
+                                .pll_reg_1 = cpu_to_le16((TA_PLL_N_VAL_40 << 8)|
+                                                         (TA_PLL_M_VAL_40)),
+                                .pll_reg_2 = cpu_to_le16(TA_PLL_P_VAL_40),
+                        },
+                        .pll960_info_g = {
+                                .pll_reg_1 = cpu_to_le16((PLL960_P_VAL_40 << 8)|
+                                                         (PLL960_N_VAL_40)),
+                                .pll_reg_2 = cpu_to_le16(PLL960_M_VAL_40),
+                                .pll_reg_3 = 0x0,
+                        },
+                        .afepll_info_g = {
+                                .pll_reg = cpu_to_le16(0x9f0),
+                        }
+                },
+                .switch_clk_g = {
+                        .switch_clk_info = 0x0,
+                        .bbp_lmac_clk_reg_val = 0x0,
+                        .umac_clock_reg_config = 0x0,
+                        .qspi_uart_clock_reg_config = 0x0
+                }
+        } },
+        .buckboost_wakeup_cnt = 0x0,
+        .pmu_wakeup_wait = 0x0,
+        .shutdown_wait_time = 0x0,
+        .pmu_slp_clkout_sel = 0x0,
+        .wdt_prog_value = 0x0,
+        .wdt_soc_rst_delay = 0x0,
+        .dcdc_operation_mode = 0x0,
+        .soc_reset_wait_cnt = 0x0
+};
+
+static u16 mcs[] = {13, 26, 39, 52, 78, 104, 117, 130};
+
+/**
+ * rsi_set_default_parameters() - This function sets default parameters.
+ * @common: Pointer to the driver private structure.
+ *
+ * Return: none
+ */
+static void rsi_set_default_parameters(struct rsi_common *common)
+{
+        common->band = IEEE80211_BAND_2GHZ;
+        common->channel_width = BW_20MHZ;
+        common->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
+        common->channel = 1;
+        common->min_rate = 0xffff;
+        common->fsm_state = FSM_CARD_NOT_READY;
+        common->iface_down = true;
+}
+
+/**
+ * rsi_set_contention_vals() - This function sets the contention values for the
+ *                             backoff procedure.
+ * @common: Pointer to the driver private structure.
+ *
+ * Return: None.
+ */
+static void rsi_set_contention_vals(struct rsi_common *common)
+{
+        u8 ii = 0;
+
+        for (; ii < NUM_EDCA_QUEUES; ii++) {
+                common->tx_qinfo[ii].wme_params =
+                        (((common->edca_params[ii].cw_min / 2) +
+                          (common->edca_params[ii].aifs)) *
+                          WMM_SHORT_SLOT_TIME + SIFS_DURATION);
+                common->tx_qinfo[ii].weight = common->tx_qinfo[ii].wme_params;
+                common->tx_qinfo[ii].pkt_contended = 0;
+        }
+}
+
+/**
+ * rsi_send_internal_mgmt_frame() - This function sends management frames to
+ *                                  firmware.Also schedules packet to queue
+ *                                  for transmission.
+ * @common: Pointer to the driver private structure.
+ * @skb: Pointer to the socket buffer structure.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+static int rsi_send_internal_mgmt_frame(struct rsi_common *common,
+                                        struct sk_buff *skb)
+{
+        struct skb_info *tx_params;
+
+        if (skb == NULL) {
+                rsi_dbg(ERR_ZONE, "%s: Unable to allocate skb\n", __func__);
+                return -ENOMEM;
+        }
+        tx_params = (struct skb_info *)&IEEE80211_SKB_CB(skb)->driver_data;
+        tx_params->flags |= INTERNAL_MGMT_PKT;
+        skb_queue_tail(&common->tx_queue[MGMT_SOFT_Q], skb);
+        rsi_set_event(&common->tx_thread.event);
+        return 0;
+}
+
+/**
+ * rsi_load_radio_caps() - This function is used to send radio capabilities
+ *                         values to firmware.
+ * @common: Pointer to the driver private structure.
+ *
+ * Return: 0 on success, corresponding negative error code on failure.
+ */
+static int rsi_load_radio_caps(struct rsi_common *common)
+{
+        struct rsi_radio_caps *radio_caps;
+        struct rsi_hw *adapter = common->priv;
+        struct ieee80211_hw *hw = adapter->hw;
+        u16 inx = 0;
+        u8 ii;
+        u8 radio_id = 0;
+        u16 gc[20] = {0xf0, 0xf0, 0xf0, 0xf0,
+                      0xf0, 0xf0, 0xf0, 0xf0,
+                      0xf0, 0xf0, 0xf0, 0xf0,
+                      0xf0, 0xf0, 0xf0, 0xf0,
+                      0xf0, 0xf0, 0xf0, 0xf0};
+        struct ieee80211_conf *conf = &hw->conf;
+        struct sk_buff *skb;
+
+        rsi_dbg(INFO_ZONE, "%s: Sending rate symbol req frame\n", __func__);
+
+        skb = dev_alloc_skb(sizeof(struct rsi_radio_caps));
+
+        if (!skb) {
+                rsi_dbg(ERR_ZONE, "%s: Failed in allocation of skb\n",
+                        __func__);
+                return -ENOMEM;
+        }
+
+        memset(skb->data, 0, sizeof(struct rsi_radio_caps));
+        radio_caps = (struct rsi_radio_caps *)skb->data;
+
+        radio_caps->desc_word[1] = cpu_to_le16(RADIO_CAPABILITIES);
+        radio_caps->desc_word[4] = cpu_to_le16(RSI_RF_TYPE << 8);
+
+        if (common->channel_width == BW_40MHZ) {
+                radio_caps->desc_word[7] |= cpu_to_le16(RSI_LMAC_CLOCK_80MHZ);
+                radio_caps->desc_word[7] |= cpu_to_le16(RSI_ENABLE_40MHZ);
+                if (common->channel_width) {
+                        radio_caps->desc_word[5] =
+                                cpu_to_le16(common->channel_width << 12);
+                        radio_caps->desc_word[5] |= cpu_to_le16(FULL40M_ENABLE);
+                }
+
+                if (conf_is_ht40_minus(conf)) {
+                        radio_caps->desc_word[5] = 0;
+                        radio_caps->desc_word[5] |=
+                                cpu_to_le16(LOWER_20_ENABLE);
+                        radio_caps->desc_word[5] |=
+                                cpu_to_le16(LOWER_20_ENABLE >> 12);
+                }
+
+                if (conf_is_ht40_plus(conf)) {
+                        radio_caps->desc_word[5] = 0;
+                        radio_caps->desc_word[5] |=
+                                cpu_to_le16(UPPER_20_ENABLE);
+                        radio_caps->desc_word[5] |=
+                                cpu_to_le16(UPPER_20_ENABLE >> 12);
+                }
+        }
+
+        radio_caps->desc_word[7] |= cpu_to_le16(radio_id << 8);
+
+        for (ii = 0; ii < MAX_HW_QUEUES; ii++) {
+                radio_caps->qos_params[ii].cont_win_min_q = cpu_to_le16(3);
+                radio_caps->qos_params[ii].cont_win_max_q = cpu_to_le16(0x3f);
+                radio_caps->qos_params[ii].aifsn_val_q = cpu_to_le16(2);
+                radio_caps->qos_params[ii].txop_q = 0;
+        }
+
+        for (ii = 0; ii < MAX_HW_QUEUES - 4; ii++) {
+                radio_caps->qos_params[ii].cont_win_min_q =
+                        cpu_to_le16(common->edca_params[ii].cw_min);
+                radio_caps->qos_params[ii].cont_win_max_q =
+                        cpu_to_le16(common->edca_params[ii].cw_max);
+                radio_caps->qos_params[ii].aifsn_val_q =
+                        cpu_to_le16((common->edca_params[ii].aifs) << 8);
+                radio_caps->qos_params[ii].txop_q =
+                        cpu_to_le16(common->edca_params[ii].txop);
+        }
+
+        memcpy(&common->rate_pwr[0], &gc[0], 40);
+        for (ii = 0; ii < 20; ii++)
+                radio_caps->gcpd_per_rate[inx++] =
+                        cpu_to_le16(common->rate_pwr[ii]  & 0x00FF);
+
+        radio_caps->desc_word[0] = cpu_to_le16((sizeof(struct rsi_radio_caps) -
+                                                FRAME_DESC_SZ) |
+                                               (RSI_WIFI_MGMT_Q << 12));
+
+
+        skb_put(skb, (sizeof(struct rsi_radio_caps)));
+
+        return rsi_send_internal_mgmt_frame(common, skb);
+}
+
+/**
+ * rsi_mgmt_pkt_to_core() - This function is the entry point for Mgmt module.
+ * @common: Pointer to the driver private structure.
+ * @msg: Pointer to received packet.
+ * @msg_len: Length of the recieved packet.
+ * @type: Type of recieved packet.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+static int rsi_mgmt_pkt_to_core(struct rsi_common *common,
+                                u8 *msg,
+                                s32 msg_len,
+                                u8 type)
+{
+        struct rsi_hw *adapter = common->priv;
+        struct ieee80211_tx_info *info;
+        struct skb_info *rx_params;
+        u8 pad_bytes = msg[4];
+        u8 pkt_recv;
+        struct sk_buff *skb;
+        char *buffer;
+
+        if (type == RX_DOT11_MGMT) {
+                if (!adapter->sc_nvifs)
+                        return -ENOLINK;
+
+                msg_len -= pad_bytes;
+                if ((msg_len <= 0) || (!msg)) {
+                        rsi_dbg(MGMT_RX_ZONE,
+                                "%s: Invalid rx msg of len = %d\n",
+                                __func__, msg_len);
+                        return -EINVAL;
+                }
+
+                skb = dev_alloc_skb(msg_len);
+                if (!skb) {
+                        rsi_dbg(ERR_ZONE, "%s: Failed to allocate skb\n",
+                                __func__);
+                        return -ENOMEM;
+                }
+
+                buffer = skb_put(skb, msg_len);
+
+                memcpy(buffer,
+                       (u8 *)(msg +  FRAME_DESC_SZ + pad_bytes),
+                       msg_len);
+
+                pkt_recv = buffer[0];
+
+                info = IEEE80211_SKB_CB(skb);
+                rx_params = (struct skb_info *)info->driver_data;
+                rx_params->rssi = rsi_get_rssi(msg);
+                rx_params->channel = rsi_get_channel(msg);
+                rsi_indicate_pkt_to_os(common, skb);
+        } else {
+                rsi_dbg(MGMT_TX_ZONE, "%s: Internal Packet\n", __func__);
+        }
+
+        return 0;
+}
+
+/**
+ * rsi_hal_send_sta_notify_frame() - This function sends the station notify
+ *                                   frame to firmware.
+ * @common: Pointer to the driver private structure.
+ * @opmode: Operating mode of device.
+ * @notify_event: Notification about station connection.
+ * @bssid: bssid.
+ * @qos_enable: Qos is enabled.
+ * @aid: Aid (unique for all STA).
+ *
+ * Return: status: 0 on success, corresponding negative error code on failure.
+ */
+static int rsi_hal_send_sta_notify_frame(struct rsi_common *common,
+                                         u8 opmode,
+                                         u8 notify_event,
+                                         const unsigned char *bssid,
+                                         u8 qos_enable,
+                                         u16 aid)
+{
+        struct sk_buff *skb = NULL;
+        struct rsi_peer_notify *peer_notify;
+        u16 vap_id = 0;
+        int status;
+
+        rsi_dbg(MGMT_TX_ZONE, "%s: Sending sta notify frame\n", __func__);
+
+        skb = dev_alloc_skb(sizeof(struct rsi_peer_notify));
+
+        if (!skb) {
+                rsi_dbg(ERR_ZONE, "%s: Failed in allocation of skb\n",
+                        __func__);
+                return -ENOMEM;
+        }
+
+        memset(skb->data, 0, sizeof(struct rsi_peer_notify));
+        peer_notify = (struct rsi_peer_notify *)skb->data;
+
+        peer_notify->command = cpu_to_le16(opmode << 1);
+
+        switch (notify_event) {
+        case STA_CONNECTED:
+                peer_notify->command |= cpu_to_le16(RSI_ADD_PEER);
+                break;
+        case STA_DISCONNECTED:
+                peer_notify->command |= cpu_to_le16(RSI_DELETE_PEER);
+                break;
+        default:
+                break;
+        }
+
+        peer_notify->command |= cpu_to_le16((aid & 0xfff) << 4);
+        ether_addr_copy(peer_notify->mac_addr, bssid);
+
+        peer_notify->sta_flags = cpu_to_le32((qos_enable) ? 1 : 0);
+
+        peer_notify->desc_word[0] =
+                cpu_to_le16((sizeof(struct rsi_peer_notify) - FRAME_DESC_SZ) |
+                            (RSI_WIFI_MGMT_Q << 12));
+        peer_notify->desc_word[1] = cpu_to_le16(PEER_NOTIFY);
+        peer_notify->desc_word[7] |= cpu_to_le16(vap_id << 8);
+
+        skb_put(skb, sizeof(struct rsi_peer_notify));
+
+        status = rsi_send_internal_mgmt_frame(common, skb);
+
+        if (!status && qos_enable) {
+                rsi_set_contention_vals(common);
+                status = rsi_load_radio_caps(common);
+        }
+        return status;
+}
+
+/**
+ * rsi_send_aggregation_params_frame() - This function sends the ampdu
+ *                                       indication frame to firmware.
+ * @common: Pointer to the driver private structure.
+ * @tid: traffic identifier.
+ * @ssn: ssn.
+ * @buf_size: buffer size.
+ * @event: notification about station connection.
+ *
+ * Return: 0 on success, corresponding negative error code on failure.
+ */
+int rsi_send_aggregation_params_frame(struct rsi_common *common,
+                                      u16 tid,
+                                      u16 ssn,
+                                      u8 buf_size,
+                                      u8 event)
+{
+        struct sk_buff *skb = NULL;
+        struct rsi_mac_frame *mgmt_frame;
+        u8 peer_id = 0;
+
+        skb = dev_alloc_skb(FRAME_DESC_SZ);
+
+        if (!skb) {
+                rsi_dbg(ERR_ZONE, "%s: Failed in allocation of skb\n",
+                        __func__);
+                return -ENOMEM;
+        }
+
+        memset(skb->data, 0, FRAME_DESC_SZ);
+        mgmt_frame = (struct rsi_mac_frame *)skb->data;
+
+        rsi_dbg(MGMT_TX_ZONE, "%s: Sending AMPDU indication frame\n", __func__);
+
+        mgmt_frame->desc_word[0] = cpu_to_le16(RSI_WIFI_MGMT_Q << 12);
+        mgmt_frame->desc_word[1] = cpu_to_le16(AMPDU_IND);
+
+        if (event == STA_TX_ADDBA_DONE) {
+                mgmt_frame->desc_word[4] = cpu_to_le16(ssn);
+                mgmt_frame->desc_word[5] = cpu_to_le16(buf_size);
+                mgmt_frame->desc_word[7] =
+                cpu_to_le16((tid | (START_AMPDU_AGGR << 4) | (peer_id << 8)));
+        } else if (event == STA_RX_ADDBA_DONE) {
+                mgmt_frame->desc_word[4] = cpu_to_le16(ssn);
+                mgmt_frame->desc_word[7] = cpu_to_le16(tid |
+                                                       (START_AMPDU_AGGR << 4) |
+                                                       (RX_BA_INDICATION << 5) |
+                                                       (peer_id << 8));
+        } else if (event == STA_TX_DELBA) {
+                mgmt_frame->desc_word[7] = cpu_to_le16(tid |
+                                                       (STOP_AMPDU_AGGR << 4) |
+                                                       (peer_id << 8));
+        } else if (event == STA_RX_DELBA) {
+                mgmt_frame->desc_word[7] = cpu_to_le16(tid |
+                                                       (STOP_AMPDU_AGGR << 4) |
+                                                       (RX_BA_INDICATION << 5) |
+                                                       (peer_id << 8));
+        }
+
+        skb_put(skb, FRAME_DESC_SZ);
+
+        return rsi_send_internal_mgmt_frame(common, skb);
+}
+
+/**
+ * rsi_program_bb_rf() - This function starts base band and RF programming.
+ *                       This is called after initial configurations are done.
+ * @common: Pointer to the driver private structure.
+ *
+ * Return: 0 on success, corresponding negative error code on failure.
+ */
+static int rsi_program_bb_rf(struct rsi_common *common)
+{
+        struct sk_buff *skb;
+        struct rsi_mac_frame *mgmt_frame;
+
+        rsi_dbg(MGMT_TX_ZONE, "%s: Sending program BB/RF frame\n", __func__);
+
+        skb = dev_alloc_skb(FRAME_DESC_SZ);
+        if (!skb) {
+                rsi_dbg(ERR_ZONE, "%s: Failed in allocation of skb\n",
+                        __func__);
+                return -ENOMEM;
+        }
+
+        memset(skb->data, 0, FRAME_DESC_SZ);
+        mgmt_frame = (struct rsi_mac_frame *)skb->data;
+
+        mgmt_frame->desc_word[0] = cpu_to_le16(RSI_WIFI_MGMT_Q << 12);
+        mgmt_frame->desc_word[1] = cpu_to_le16(BBP_PROG_IN_TA);
+        mgmt_frame->desc_word[4] = cpu_to_le16(common->endpoint << 8);
+
+        if (common->rf_reset) {
+                mgmt_frame->desc_word[7] =  cpu_to_le16(RF_RESET_ENABLE);
+                rsi_dbg(MGMT_TX_ZONE, "%s: ===> RF RESET REQUEST SENT <===\n",
+                        __func__);
+                common->rf_reset = 0;
+        }
+        common->bb_rf_prog_count = 1;
+        mgmt_frame->desc_word[7] |= cpu_to_le16(PUT_BBP_RESET |
+                                     BBP_REG_WRITE | (RSI_RF_TYPE << 4));
+        skb_put(skb, FRAME_DESC_SZ);
+
+        return rsi_send_internal_mgmt_frame(common, skb);
+}
+
+/**
+ * rsi_set_vap_capabilities() - This function send vap capability to firmware.
+ * @common: Pointer to the driver private structure.
+ * @opmode: Operating mode of device.
+ *
+ * Return: 0 on success, corresponding negative error code on failure.
+ */
+int rsi_set_vap_capabilities(struct rsi_common *common, enum opmode mode)
+{
+        struct sk_buff *skb = NULL;
+        struct rsi_vap_caps *vap_caps;
+        u16 vap_id = 0;
+
+        rsi_dbg(MGMT_TX_ZONE, "%s: Sending VAP capabilities frame\n", __func__);
+
+        skb = dev_alloc_skb(sizeof(struct rsi_vap_caps));
+        if (!skb) {
+                rsi_dbg(ERR_ZONE, "%s: Failed in allocation of skb\n",
+                        __func__);
+                return -ENOMEM;
+        }
+
+        memset(skb->data, 0, sizeof(struct rsi_vap_caps));
+        vap_caps = (struct rsi_vap_caps *)skb->data;
+
+        vap_caps->desc_word[0] = cpu_to_le16((sizeof(struct rsi_vap_caps) -
+                                             FRAME_DESC_SZ) |
+                                             (RSI_WIFI_MGMT_Q << 12));
+        vap_caps->desc_word[1] = cpu_to_le16(VAP_CAPABILITIES);
+        vap_caps->desc_word[4] = cpu_to_le16(mode |
+                                             (common->channel_width << 8));
+        vap_caps->desc_word[7] = cpu_to_le16((vap_id << 8) |
+                                             (common->mac_id << 4) |
+                                             common->radio_id);
+
+        memcpy(vap_caps->mac_addr, common->mac_addr, IEEE80211_ADDR_LEN);
+        vap_caps->keep_alive_period = cpu_to_le16(90);
+        vap_caps->frag_threshold = cpu_to_le16(IEEE80211_MAX_FRAG_THRESHOLD);
+
+        vap_caps->rts_threshold = cpu_to_le16(common->rts_threshold);
+        vap_caps->default_mgmt_rate = 0;
+        if (conf_is_ht40(&common->priv->hw->conf)) {
+                vap_caps->default_ctrl_rate =
+                                cpu_to_le32(RSI_RATE_6 | FULL40M_ENABLE << 16);
+        } else {
+                vap_caps->default_ctrl_rate = cpu_to_le32(RSI_RATE_6);
+        }
+        vap_caps->default_data_rate = 0;
+        vap_caps->beacon_interval = cpu_to_le16(200);
+        vap_caps->dtim_period = cpu_to_le16(4);
+
+        skb_put(skb, sizeof(*vap_caps));
+
+        return rsi_send_internal_mgmt_frame(common, skb);
+}
+
+/**
+ * rsi_hal_load_key() - This function is used to load keys within the firmware.
+ * @common: Pointer to the driver private structure.
+ * @data: Pointer to the key data.
+ * @key_len: Key length to be loaded.
+ * @key_type: Type of key: GROUP/PAIRWISE.
+ * @key_id: Key index.
+ * @cipher: Type of cipher used.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+int rsi_hal_load_key(struct rsi_common *common,
+                     u8 *data,
+                     u16 key_len,
+                     u8 key_type,
+                     u8 key_id,
+                     u32 cipher)
+{
+        struct sk_buff *skb = NULL;
+        struct rsi_set_key *set_key;
+        u16 key_descriptor = 0;
+
+        rsi_dbg(MGMT_TX_ZONE, "%s: Sending load key frame\n", __func__);
+
+        skb = dev_alloc_skb(sizeof(struct rsi_set_key));
+        if (!skb) {
+                rsi_dbg(ERR_ZONE, "%s: Failed in allocation of skb\n",
+                        __func__);
+                return -ENOMEM;
+        }
+
+        memset(skb->data, 0, sizeof(struct rsi_set_key));
+        set_key = (struct rsi_set_key *)skb->data;
+
+        if ((cipher == WLAN_CIPHER_SUITE_WEP40) ||
+            (cipher == WLAN_CIPHER_SUITE_WEP104)) {
+                key_len += 1;
+                key_descriptor |= BIT(2);
+                if (key_len >= 13)
+                        key_descriptor |= BIT(3);
+        } else if (cipher != KEY_TYPE_CLEAR) {
+                key_descriptor |= BIT(4);
+                if (key_type == RSI_PAIRWISE_KEY)
+                        key_id = 0;
+                if (cipher == WLAN_CIPHER_SUITE_TKIP)
+                        key_descriptor |= BIT(5);
+        }
+        key_descriptor |= (key_type | BIT(13) | (key_id << 14));
+
+        set_key->desc_word[0] = cpu_to_le16((sizeof(struct rsi_set_key) -
+                                            FRAME_DESC_SZ) |
+                                            (RSI_WIFI_MGMT_Q << 12));
+        set_key->desc_word[1] = cpu_to_le16(SET_KEY_REQ);
+        set_key->desc_word[4] = cpu_to_le16(key_descriptor);
+
+        if ((cipher == WLAN_CIPHER_SUITE_WEP40) ||
+            (cipher == WLAN_CIPHER_SUITE_WEP104)) {
+                memcpy(&set_key->key[key_id][1],
+                       data,
+                       key_len * 2);
+        } else {
+                memcpy(&set_key->key[0][0], data, key_len);
+        }
+
+        memcpy(set_key->tx_mic_key, &data[16], 8);
+        memcpy(set_key->rx_mic_key, &data[24], 8);
+
+        skb_put(skb, sizeof(struct rsi_set_key));
+
+        return rsi_send_internal_mgmt_frame(common, skb);
+}
+
+/*
+ * rsi_load_bootup_params() - This function send bootup params to the firmware.
+ * @common: Pointer to the driver private structure.
+ *
+ * Return: 0 on success, corresponding error code on failure.
+ */
+static u8 rsi_load_bootup_params(struct rsi_common *common)
+{
+        struct sk_buff *skb;
+        struct rsi_boot_params *boot_params;
+
+        rsi_dbg(MGMT_TX_ZONE, "%s: Sending boot params frame\n", __func__);
+        skb = dev_alloc_skb(sizeof(struct rsi_boot_params));
+        if (!skb) {
+                rsi_dbg(ERR_ZONE, "%s: Failed in allocation of skb\n",
+                        __func__);
+                return -ENOMEM;
+        }
+
+        memset(skb->data, 0, sizeof(struct rsi_boot_params));
+        boot_params = (struct rsi_boot_params *)skb->data;
+
+        rsi_dbg(MGMT_TX_ZONE, "%s:\n", __func__);
+
+        if (common->channel_width == BW_40MHZ) {
+                memcpy(&boot_params->bootup_params,
+                       &boot_params_40,
+                       sizeof(struct bootup_params));
+                rsi_dbg(MGMT_TX_ZONE, "%s: Packet 40MHZ <=== %d\n", __func__,
+                        UMAC_CLK_40BW);
+                boot_params->desc_word[7] = cpu_to_le16(UMAC_CLK_40BW);
+        } else {
+                memcpy(&boot_params->bootup_params,
+                       &boot_params_20,
+                       sizeof(struct bootup_params));
+                if (boot_params_20.valid != cpu_to_le32(VALID_20)) {
+                        boot_params->desc_word[7] = cpu_to_le16(UMAC_CLK_20BW);
+                        rsi_dbg(MGMT_TX_ZONE,
+                                "%s: Packet 20MHZ <=== %d\n", __func__,
+                                UMAC_CLK_20BW);
+                } else {
+                        boot_params->desc_word[7] = cpu_to_le16(UMAC_CLK_40MHZ);
+                        rsi_dbg(MGMT_TX_ZONE,
+                                "%s: Packet 20MHZ <=== %d\n", __func__,
+                                UMAC_CLK_40MHZ);
+                }
+        }
+
+        /**
+         * Bit{0:11} indicates length of the Packet
+         * Bit{12:15} indicates host queue number
+         */
+        boot_params->desc_word[0] = cpu_to_le16(sizeof(struct bootup_params) |
+                                    (RSI_WIFI_MGMT_Q << 12));
+        boot_params->desc_word[1] = cpu_to_le16(BOOTUP_PARAMS_REQUEST);
+
+        skb_put(skb, sizeof(struct rsi_boot_params));
+
+        return rsi_send_internal_mgmt_frame(common, skb);
+}
+
+/**
+ * rsi_send_reset_mac() - This function prepares reset MAC request and sends an
+ *                        internal management frame to indicate it to firmware.
+ * @common: Pointer to the driver private structure.
+ *
+ * Return: 0 on success, corresponding error code on failure.
+ */
+static int rsi_send_reset_mac(struct rsi_common *common)
+{
+        struct sk_buff *skb;
+        struct rsi_mac_frame *mgmt_frame;
+
+        rsi_dbg(MGMT_TX_ZONE, "%s: Sending reset MAC frame\n", __func__);
+
+        skb = dev_alloc_skb(FRAME_DESC_SZ);
+        if (!skb) {
+                rsi_dbg(ERR_ZONE, "%s: Failed in allocation of skb\n",
+                        __func__);
+                return -ENOMEM;
+        }
+
+        memset(skb->data, 0, FRAME_DESC_SZ);
+        mgmt_frame = (struct rsi_mac_frame *)skb->data;
+
+        mgmt_frame->desc_word[0] = cpu_to_le16(RSI_WIFI_MGMT_Q << 12);
+        mgmt_frame->desc_word[1] = cpu_to_le16(RESET_MAC_REQ);
+        mgmt_frame->desc_word[4] = cpu_to_le16(RETRY_COUNT << 8);
+
+        skb_put(skb, FRAME_DESC_SZ);
+
+        return rsi_send_internal_mgmt_frame(common, skb);
+}
+
+/**
+ * rsi_set_channel() - This function programs the channel.
+ * @common: Pointer to the driver private structure.
+ * @channel: Channel value to be set.
+ *
+ * Return: 0 on success, corresponding error code on failure.
+ */
+int rsi_set_channel(struct rsi_common *common, u16 channel)
+{
+        struct sk_buff *skb = NULL;
+        struct rsi_mac_frame *mgmt_frame;
+
+        rsi_dbg(MGMT_TX_ZONE,
+                "%s: Sending scan req frame\n", __func__);
+
+        skb = dev_alloc_skb(FRAME_DESC_SZ);
+        if (!skb) {
+                rsi_dbg(ERR_ZONE, "%s: Failed in allocation of skb\n",
+                        __func__);
+                return -ENOMEM;
+        }
+
+        memset(skb->data, 0, FRAME_DESC_SZ);
+        mgmt_frame = (struct rsi_mac_frame *)skb->data;
+
+        if (common->band == IEEE80211_BAND_5GHZ) {
+                if ((channel >= 36) && (channel <= 64))
+                        channel = ((channel - 32) / 4);
+                else if ((channel > 64) && (channel <= 140))
+                        channel = ((channel - 102) / 4) + 8;
+                else if (channel >= 149)
+                        channel = ((channel - 151) / 4) + 18;
+                else
+                        return -EINVAL;
+        } else {
+                if (channel > 14) {
+                        rsi_dbg(ERR_ZONE, "%s: Invalid chno %d, band = %d\n",
+                                __func__, channel, common->band);
+                        return -EINVAL;
+                }
+        }
+
+        mgmt_frame->desc_word[0] = cpu_to_le16(RSI_WIFI_MGMT_Q << 12);
+        mgmt_frame->desc_word[1] = cpu_to_le16(SCAN_REQUEST);
+        mgmt_frame->desc_word[4] = cpu_to_le16(channel);
+
+        mgmt_frame->desc_word[7] = cpu_to_le16(PUT_BBP_RESET |
+                                               BBP_REG_WRITE |
+                                               (RSI_RF_TYPE << 4));
+
+        mgmt_frame->desc_word[5] = cpu_to_le16(0x01);
+
+        if (common->channel_width == BW_40MHZ)
+                mgmt_frame->desc_word[5] |= cpu_to_le16(0x1 << 8);
+
+        common->channel = channel;
+
+        skb_put(skb, FRAME_DESC_SZ);
+
+        return rsi_send_internal_mgmt_frame(common, skb);
+}
+
+/**
+ * rsi_compare() - This function is used to compare two integers
+ * @a: pointer to the first integer
+ * @b: pointer to the second integer
+ *
+ * Return: 0 if both are equal, -1 if the first is smaller, else 1
+ */
+static int rsi_compare(const void *a, const void *b)
+{
+        u16 _a = *(const u16 *)(a);
+        u16 _b = *(const u16 *)(b);
+
+        if (_a > _b)
+                return -1;
+
+        if (_a < _b)
+                return 1;
+
+        return 0;
+}
+
+/**
+ * rsi_map_rates() - This function is used to map selected rates to hw rates.
+ * @rate: The standard rate to be mapped.
+ * @offset: Offset that will be returned.
+ *
+ * Return: 0 if it is a mcs rate, else 1
+ */
+static bool rsi_map_rates(u16 rate, int *offset)
+{
+        int kk;
+        for (kk = 0; kk < ARRAY_SIZE(rsi_mcsrates); kk++) {
+                if (rate == mcs[kk]) {
+                        *offset = kk;
+                        return false;
+                }
+        }
+
+        for (kk = 0; kk < ARRAY_SIZE(rsi_rates); kk++) {
+                if (rate == rsi_rates[kk].bitrate / 5) {
+                        *offset = kk;
+                        break;
+                }
+        }
+        return true;
+}
+
+/**
+ * rsi_send_auto_rate_request() - This function is to set rates for connection
+ *                                and send autorate request to firmware.
+ * @common: Pointer to the driver private structure.
+ *
+ * Return: 0 on success, corresponding error code on failure.
+ */
+static int rsi_send_auto_rate_request(struct rsi_common *common)
+{
+        struct sk_buff *skb;
+        struct rsi_auto_rate *auto_rate;
+        int ii = 0, jj = 0, kk = 0;
+        struct ieee80211_hw *hw = common->priv->hw;
+        u8 band = hw->conf.chandef.chan->band;
+        u8 num_supported_rates = 0;
+        u8 rate_offset = 0;
+        u32 rate_bitmap = common->bitrate_mask[band];
+
+        u16 *selected_rates, min_rate;
+
+        skb = dev_alloc_skb(sizeof(struct rsi_auto_rate));
+        if (!skb) {
+                rsi_dbg(ERR_ZONE, "%s: Failed in allocation of skb\n",
+                        __func__);
+                return -ENOMEM;
+        }
+
+        selected_rates = kmalloc(2 * RSI_TBL_SZ, GFP_KERNEL);
+        if (!selected_rates) {
+                rsi_dbg(ERR_ZONE, "%s: Failed in allocation of mem\n",
+                        __func__);
+                return -ENOMEM;
+        }
+
+        memset(skb->data, 0, sizeof(struct rsi_auto_rate));
+        memset(selected_rates, 0, 2 * RSI_TBL_SZ);
+
+        auto_rate = (struct rsi_auto_rate *)skb->data;
+
+        auto_rate->aarf_rssi = cpu_to_le16(((u16)3 << 6) | (u16)(18 & 0x3f));
+        auto_rate->collision_tolerance = cpu_to_le16(3);
+        auto_rate->failure_limit = cpu_to_le16(3);
+        auto_rate->initial_boundary = cpu_to_le16(3);
+        auto_rate->max_threshold_limt = cpu_to_le16(27);
+
+        auto_rate->desc_word[1] = cpu_to_le16(AUTO_RATE_IND);
+
+        if (common->channel_width == BW_40MHZ)
+                auto_rate->desc_word[7] |= cpu_to_le16(1);
+
+        if (band == IEEE80211_BAND_2GHZ)
+                min_rate = STD_RATE_01;
+        else
+                min_rate = STD_RATE_06;
+
+        for (ii = 0, jj = 0; ii < ARRAY_SIZE(rsi_rates); ii++) {
+                if (rate_bitmap & BIT(ii)) {
+                        selected_rates[jj++] = (rsi_rates[ii].bitrate / 5);
+                        rate_offset++;
+                }
+        }
+        num_supported_rates = jj;
+
+        if (common->vif_info[0].is_ht) {
+                for (ii = 0; ii < ARRAY_SIZE(mcs); ii++)
+                        selected_rates[jj++] = mcs[ii];
+                num_supported_rates += ARRAY_SIZE(mcs);
+                rate_offset += ARRAY_SIZE(mcs);
+        }
+
+        if (rate_offset < (RSI_TBL_SZ / 2) - 1) {
+                for (ii = jj; ii < (RSI_TBL_SZ / 2); ii++) {
+                        selected_rates[jj++] = min_rate;
+                        rate_offset++;
+                }
+        }
+
+        sort(selected_rates, jj, sizeof(u16), &rsi_compare, NULL);
+
+        /* mapping the rates to RSI rates */
+        for (ii = 0; ii < jj; ii++) {
+                if (rsi_map_rates(selected_rates[ii], &kk)) {
+                        auto_rate->supported_rates[ii] =
+                                cpu_to_le16(rsi_rates[kk].hw_value);
+                } else {
+                        auto_rate->supported_rates[ii] =
+                                cpu_to_le16(rsi_mcsrates[kk]);
+                }
+        }
+
+        /* loading HT rates in the bottom half of the auto rate table */
+        if (common->vif_info[0].is_ht) {
+                if (common->vif_info[0].sgi)
+                        auto_rate->supported_rates[rate_offset++] =
+                                cpu_to_le16(RSI_RATE_MCS7_SG);
+
+                for (ii = rate_offset, kk = ARRAY_SIZE(rsi_mcsrates) - 1;
+                     ii < rate_offset + 2 * ARRAY_SIZE(rsi_mcsrates); ii++) {
+                        if (common->vif_info[0].sgi)
+                                auto_rate->supported_rates[ii++] =
+                                        cpu_to_le16(rsi_mcsrates[kk] | BIT(9));
+                        auto_rate->supported_rates[ii] =
+                                cpu_to_le16(rsi_mcsrates[kk--]);
+                }
+
+                for (; ii < RSI_TBL_SZ; ii++) {
+                        auto_rate->supported_rates[ii] =
+                                cpu_to_le16(rsi_mcsrates[0]);
+                }
+        }
+
+        auto_rate->num_supported_rates = cpu_to_le16(num_supported_rates * 2);
+        auto_rate->moderate_rate_inx = cpu_to_le16(num_supported_rates / 2);
+        auto_rate->desc_word[7] |= cpu_to_le16(0 << 8);
+        num_supported_rates *= 2;
+
+        auto_rate->desc_word[0] = cpu_to_le16((sizeof(*auto_rate) -
+                                               FRAME_DESC_SZ) |
+                                               (RSI_WIFI_MGMT_Q << 12));
+
+        skb_put(skb,
+                sizeof(struct rsi_auto_rate));
+        kfree(selected_rates);
+
+        return rsi_send_internal_mgmt_frame(common, skb);
+}
+
+/**
+ * rsi_inform_bss_status() - This function informs about bss status with the
+ *                           help of sta notify params by sending an internal
+ *                           management frame to firmware.
+ * @common: Pointer to the driver private structure.
+ * @status: Bss status type.
+ * @bssid: Bssid.
+ * @qos_enable: Qos is enabled.
+ * @aid: Aid (unique for all STAs).
+ *
+ * Return: None.
+ */
+void rsi_inform_bss_status(struct rsi_common *common,
+                           u8 status,
+                           const unsigned char *bssid,
+                           u8 qos_enable,
+                           u16 aid)
+{
+        if (status) {
+                rsi_hal_send_sta_notify_frame(common,
+                                              NL80211_IFTYPE_STATION,
+                                              STA_CONNECTED,
+                                              bssid,
+                                              qos_enable,
+                                              aid);
+                if (common->min_rate == 0xffff)
+                        rsi_send_auto_rate_request(common);
+        } else {
+                rsi_hal_send_sta_notify_frame(common,
+                                              NL80211_IFTYPE_STATION,
+                                              STA_DISCONNECTED,
+                                              bssid,
+                                              qos_enable,
+                                              aid);
+        }
+}
+
+/**
+ * rsi_eeprom_read() - This function sends a frame to read the mac address
+ *                     from the eeprom.
+ * @common: Pointer to the driver private structure.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+static int rsi_eeprom_read(struct rsi_common *common)
+{
+        struct rsi_mac_frame *mgmt_frame;
+        struct sk_buff *skb;
+
+        rsi_dbg(MGMT_TX_ZONE, "%s: Sending EEPROM read req frame\n", __func__);
+
+        skb = dev_alloc_skb(FRAME_DESC_SZ);
+        if (!skb) {
+                rsi_dbg(ERR_ZONE, "%s: Failed in allocation of skb\n",
+                        __func__);
+                return -ENOMEM;
+        }
+
+        memset(skb->data, 0, FRAME_DESC_SZ);
+        mgmt_frame = (struct rsi_mac_frame *)skb->data;
+
+        /* FrameType */
+        mgmt_frame->desc_word[1] = cpu_to_le16(EEPROM_READ_TYPE);
+        mgmt_frame->desc_word[0] = cpu_to_le16(RSI_WIFI_MGMT_Q << 12);
+        /* Number of bytes to read */
+        mgmt_frame->desc_word[3] = cpu_to_le16(ETH_ALEN +
+                                               WLAN_MAC_MAGIC_WORD_LEN +
+                                               WLAN_HOST_MODE_LEN +
+                                               WLAN_FW_VERSION_LEN);
+        /* Address to read */
+        mgmt_frame->desc_word[4] = cpu_to_le16(WLAN_MAC_EEPROM_ADDR);
+
+        skb_put(skb, FRAME_DESC_SZ);
+
+        return rsi_send_internal_mgmt_frame(common, skb);
+}
+
+/**
+ * rsi_handle_ta_confirm_type() - This function handles the confirm frames.
+ * @common: Pointer to the driver private structure.
+ * @msg: Pointer to received packet.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+static int rsi_handle_ta_confirm_type(struct rsi_common *common,
+                                      u8 *msg)
+{
+        u8 sub_type = (msg[15] & 0xff);
+
+        switch (sub_type) {
+        case BOOTUP_PARAMS_REQUEST:
+                rsi_dbg(FSM_ZONE, "%s: Boot up params confirm received\n",
+                        __func__);
+                if (common->fsm_state == FSM_BOOT_PARAMS_SENT) {
+                        if (rsi_eeprom_read(common)) {
+                                common->fsm_state = FSM_CARD_NOT_READY;
+                                goto out;
+                        } else {
+                                common->fsm_state = FSM_EEPROM_READ_MAC_ADDR;
+                        }
+                } else {
+                        rsi_dbg(ERR_ZONE,
+                                "%s: Received bootup params cfm in %d state\n",
+                                 __func__, common->fsm_state);
+                        return 0;
+                }
+                break;
+
+        case EEPROM_READ_TYPE:
+                if (common->fsm_state == FSM_EEPROM_READ_MAC_ADDR) {
+                        if (msg[16] == MAGIC_WORD) {
+                                u8 offset = (FRAME_DESC_SZ + WLAN_HOST_MODE_LEN
+                                             + WLAN_MAC_MAGIC_WORD_LEN);
+                                memcpy(common->mac_addr,
+                                       &msg[offset],
+                                       ETH_ALEN);
+                                memcpy(&common->fw_ver,
+                                       &msg[offset + ETH_ALEN],
+                                       sizeof(struct version_info));
+
+                        } else {
+                                common->fsm_state = FSM_CARD_NOT_READY;
+                                break;
+                        }
+                        if (rsi_send_reset_mac(common))
+                                goto out;
+                        else
+                                common->fsm_state = FSM_RESET_MAC_SENT;
+                } else {
+                        rsi_dbg(ERR_ZONE,
+                                "%s: Received eeprom mac addr in %d state\n",
+                                __func__, common->fsm_state);
+                        return 0;
+                }
+                break;
+
+        case RESET_MAC_REQ:
+                if (common->fsm_state == FSM_RESET_MAC_SENT) {
+                        rsi_dbg(FSM_ZONE, "%s: Reset MAC cfm received\n",
+                                __func__);
+
+                        if (rsi_load_radio_caps(common))
+                                goto out;
+                        else
+                                common->fsm_state = FSM_RADIO_CAPS_SENT;
+                } else {
+                        rsi_dbg(ERR_ZONE,
+                                "%s: Received reset mac cfm in %d state\n",
+                                 __func__, common->fsm_state);
+                        return 0;
+                }
+                break;
+
+        case RADIO_CAPABILITIES:
+                if (common->fsm_state == FSM_RADIO_CAPS_SENT) {
+                        common->rf_reset = 1;
+                        if (rsi_program_bb_rf(common)) {
+                                goto out;
+                        } else {
+                                common->fsm_state = FSM_BB_RF_PROG_SENT;
+                                rsi_dbg(FSM_ZONE, "%s: Radio cap cfm received\n",
+                                        __func__);
+                        }
+                } else {
+                        rsi_dbg(ERR_ZONE,
+                                "%s: Received radio caps cfm in %d state\n",
+                                 __func__, common->fsm_state);
+                        return 0;
+                }
+                break;
+
+        case BB_PROG_VALUES_REQUEST:
+        case RF_PROG_VALUES_REQUEST:
+        case BBP_PROG_IN_TA:
+                rsi_dbg(FSM_ZONE, "%s: BB/RF cfm received\n", __func__);
+                if (common->fsm_state == FSM_BB_RF_PROG_SENT) {
+                        common->bb_rf_prog_count--;
+                        if (!common->bb_rf_prog_count) {
+                                common->fsm_state = FSM_MAC_INIT_DONE;
+                                return rsi_mac80211_attach(common);
+                        }
+                } else {
+                        goto out;
+                }
+                break;
+
+        default:
+                rsi_dbg(INFO_ZONE, "%s: Invalid TA confirm pkt received\n",
+                        __func__);
+                break;
+        }
+        return 0;
+out:
+        rsi_dbg(ERR_ZONE, "%s: Unable to send pkt/Invalid frame received\n",
+                __func__);
+        return -EINVAL;
+}
+
+/**
+ * rsi_mgmt_pkt_recv() - This function processes the management packets
+ *                       recieved from the hardware.
+ * @common: Pointer to the driver private structure.
+ * @msg: Pointer to the received packet.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+int rsi_mgmt_pkt_recv(struct rsi_common *common, u8 *msg)
+{
+        s32 msg_len = (le16_to_cpu(*(__le16 *)&msg[0]) & 0x0fff);
+        u16 msg_type = (msg[2]);
+
+        rsi_dbg(FSM_ZONE, "%s: Msg Len: %d, Msg Type: %4x\n",
+                __func__, msg_len, msg_type);
+
+        if (msg_type == TA_CONFIRM_TYPE) {
+                return rsi_handle_ta_confirm_type(common, msg);
+        } else if (msg_type == CARD_READY_IND) {
+                rsi_dbg(FSM_ZONE, "%s: Card ready indication received\n",
+                        __func__);
+                if (common->fsm_state == FSM_CARD_NOT_READY) {
+                        rsi_set_default_parameters(common);
+
+                        if (rsi_load_bootup_params(common))
+                                return -ENOMEM;
+                        else
+                                common->fsm_state = FSM_BOOT_PARAMS_SENT;
+                } else {
+                        return -EINVAL;
+                }
+        } else if (msg_type == TX_STATUS_IND) {
+                if (msg[15] == PROBEREQ_CONFIRM)
+                        common->mgmt_q_block = false;
+                        rsi_dbg(FSM_ZONE, "%s: Probe confirm received\n",
+                                __func__);
+        } else {
+                return rsi_mgmt_pkt_to_core(common, msg, msg_len, msg_type);
+        }
+        return 0;
+}
diff --git a/drivers/net/wireless/rsi/rsi_91x_pkt.c b/drivers/net/wireless/rsi/rsi_91x_pkt.c
new file mode 100644
index 000000000000..8e48e72bae20
--- /dev/null
+++ b/drivers/net/wireless/rsi/rsi_91x_pkt.c
@@ -0,0 +1,196 @@
+/**
+ * Copyright (c) 2014 Redpine Signals Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "rsi_mgmt.h"
+
+/**
+ * rsi_send_data_pkt() - This function sends the recieved data packet from
+ *                       driver to device.
+ * @common: Pointer to the driver private structure.
+ * @skb: Pointer to the socket buffer structure.
+ *
+ * Return: status: 0 on success, -1 on failure.
+ */
+int rsi_send_data_pkt(struct rsi_common *common, struct sk_buff *skb)
+{
+        struct rsi_hw *adapter = common->priv;
+        struct ieee80211_hdr *tmp_hdr = NULL;
+        struct ieee80211_tx_info *info;
+        struct skb_info *tx_params;
+        struct ieee80211_bss_conf *bss = NULL;
+        int status = -EINVAL;
+        u8 ieee80211_size = MIN_802_11_HDR_LEN;
+        u8 extnd_size = 0;
+        __le16 *frame_desc;
+        u16 seq_num = 0;
+
+        info = IEEE80211_SKB_CB(skb);
+        bss = &info->control.vif->bss_conf;
+        tx_params = (struct skb_info *)info->driver_data;
+
+        if (!bss->assoc)
+                goto err;
+
+        tmp_hdr = (struct ieee80211_hdr *)&skb->data[0];
+        seq_num = (le16_to_cpu(tmp_hdr->seq_ctrl) >> 4);
+
+        extnd_size = ((uintptr_t)skb->data & 0x3);
+
+        if ((FRAME_DESC_SZ + extnd_size) > skb_headroom(skb)) {
+                rsi_dbg(ERR_ZONE, "%s: Unable to send pkt\n", __func__);
+                status = -ENOSPC;
+                goto err;
+        }
+
+        skb_push(skb, (FRAME_DESC_SZ + extnd_size));
+        frame_desc = (__le16 *)&skb->data[0];
+        memset((u8 *)frame_desc, 0, FRAME_DESC_SZ);
+
+        if (ieee80211_is_data_qos(tmp_hdr->frame_control)) {
+                ieee80211_size += 2;
+                frame_desc[6] |= cpu_to_le16(BIT(12));
+        }
+
+        if ((!(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)) &&
+            (common->secinfo.security_enable)) {
+                if (rsi_is_cipher_wep(common))
+                        ieee80211_size += 4;
+                else
+                        ieee80211_size += 8;
+                frame_desc[6] |= cpu_to_le16(BIT(15));
+        }
+
+        frame_desc[0] = cpu_to_le16((skb->len - FRAME_DESC_SZ) |
+                                    (RSI_WIFI_DATA_Q << 12));
+        frame_desc[2] = cpu_to_le16((extnd_size) | (ieee80211_size) << 8);
+
+        if (common->min_rate != 0xffff) {
+                /* Send fixed rate */
+                frame_desc[3] = cpu_to_le16(RATE_INFO_ENABLE);
+                frame_desc[4] = cpu_to_le16(common->min_rate);
+        }
+
+        frame_desc[6] |= cpu_to_le16(seq_num & 0xfff);
+        frame_desc[7] = cpu_to_le16(((tx_params->tid & 0xf) << 4) |
+                                    (skb->priority & 0xf) |
+                                    (tx_params->sta_id << 8));
+
+        status = adapter->host_intf_write_pkt(common->priv,
+                                              skb->data,
+                                              skb->len);
+        if (status)
+                rsi_dbg(ERR_ZONE, "%s: Failed to write pkt\n",
+                        __func__);
+
+err:
+        ++common->tx_stats.total_tx_pkt_freed[skb->priority];
+        rsi_indicate_tx_status(common->priv, skb, status);
+        return status;
+}
+
+/**
+ * rsi_send_mgmt_pkt() - This functions sends the received management packet
+ *                       from driver to device.
+ * @common: Pointer to the driver private structure.
+ * @skb: Pointer to the socket buffer structure.
+ *
+ * Return: status: 0 on success, -1 on failure.
+ */
+int rsi_send_mgmt_pkt(struct rsi_common *common,
+                      struct sk_buff *skb)
+{
+        struct rsi_hw *adapter = common->priv;
+        struct ieee80211_hdr *wh = NULL;
+        struct ieee80211_tx_info *info;
+        struct ieee80211_bss_conf *bss = NULL;
+        struct skb_info *tx_params;
+        int status = -E2BIG;
+        __le16 *msg = NULL;
+        u8 extnd_size = 0;
+        u8 vap_id = 0;
+
+        info = IEEE80211_SKB_CB(skb);
+        tx_params = (struct skb_info *)info->driver_data;
+        extnd_size = ((uintptr_t)skb->data & 0x3);
+
+        if (tx_params->flags & INTERNAL_MGMT_PKT) {
+                if ((extnd_size) > skb_headroom(skb)) {
+                        rsi_dbg(ERR_ZONE, "%s: Unable to send pkt\n", __func__);
+                        dev_kfree_skb(skb);
+                        return -ENOSPC;
+                }
+                skb_push(skb, extnd_size);
+                skb->data[extnd_size + 4] = extnd_size;
+                status = adapter->host_intf_write_pkt(common->priv,
+                                                      (u8 *)skb->data,
+                                                      skb->len);
+                if (status) {
+                        rsi_dbg(ERR_ZONE,
+                                "%s: Failed to write the packet\n", __func__);
+                }
+                dev_kfree_skb(skb);
+                return status;
+        }
+
+        bss = &info->control.vif->bss_conf;
+        wh = (struct ieee80211_hdr *)&skb->data[0];
+
+        if (FRAME_DESC_SZ > skb_headroom(skb))
+                goto err;
+
+        skb_push(skb, FRAME_DESC_SZ);
+        memset(skb->data, 0, FRAME_DESC_SZ);
+        msg = (__le16 *)skb->data;
+
+        if (skb->len > MAX_MGMT_PKT_SIZE) {
+                rsi_dbg(INFO_ZONE, "%s: Dropping mgmt pkt > 512\n", __func__);
+                goto err;
+        }
+
+        msg[0] = cpu_to_le16((skb->len - FRAME_DESC_SZ) |
+                            (RSI_WIFI_MGMT_Q << 12));
+        msg[1] = cpu_to_le16(TX_DOT11_MGMT);
+        msg[2] = cpu_to_le16(MIN_802_11_HDR_LEN << 8);
+        msg[3] = cpu_to_le16(RATE_INFO_ENABLE);
+        msg[6] = cpu_to_le16(le16_to_cpu(wh->seq_ctrl) >> 4);
+
+        if (wh->addr1[0] & BIT(0))
+                msg[3] |= cpu_to_le16(RSI_BROADCAST_PKT);
+
+        if (common->band == IEEE80211_BAND_2GHZ)
+                msg[4] = cpu_to_le16(RSI_11B_MODE);
+        else
+                msg[4] = cpu_to_le16((RSI_RATE_6 & 0x0f) | RSI_11G_MODE);
+
+        /* Indicate to firmware to give cfm */
+        if ((skb->data[16] == IEEE80211_STYPE_PROBE_REQ) && (!bss->assoc)) {
+                msg[1] |= cpu_to_le16(BIT(10));
+                msg[7] = cpu_to_le16(PROBEREQ_CONFIRM);
+                common->mgmt_q_block = true;
+        }
+
+        msg[7] |= cpu_to_le16(vap_id << 8);
+
+        status = adapter->host_intf_write_pkt(common->priv,
+                                              (u8 *)msg,
+                                              skb->len);
+        if (status)
+                rsi_dbg(ERR_ZONE, "%s: Failed to write the packet\n", __func__);
+
+err:
+        rsi_indicate_tx_status(common->priv, skb, status);
+        return status;
+}
diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c b/drivers/net/wireless/rsi/rsi_91x_sdio.c
new file mode 100644
index 000000000000..852453f386e2
--- /dev/null
+++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
@@ -0,0 +1,850 @@
+/**
+ * Copyright (c) 2014 Redpine Signals Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ */
+
+#include <linux/module.h>
+#include "rsi_sdio.h"
+#include "rsi_common.h"
+
+/**
+ * rsi_sdio_set_cmd52_arg() - This function prepares cmd 52 read/write arg.
+ * @rw: Read/write
+ * @func: function number
+ * @raw: indicates whether to perform read after write
+ * @address: address to which to read/write
+ * @writedata: data to write
+ *
+ * Return: argument
+ */
+static u32 rsi_sdio_set_cmd52_arg(bool rw,
+                                  u8 func,
+                                  u8 raw,
+                                  u32 address,
+                                  u8 writedata)
+{
+        return ((rw & 1) << 31) | ((func & 0x7) << 28) |
+                ((raw & 1) << 27) | (1 << 26) |
+                ((address & 0x1FFFF) << 9) | (1 << 8) |
+                (writedata & 0xFF);
+}
+
+/**
+ * rsi_cmd52writebyte() - This function issues cmd52 byte write onto the card.
+ * @card: Pointer to the mmc_card.
+ * @address: Address to write.
+ * @byte: Data to write.
+ *
+ * Return: Write status.
+ */
+static int rsi_cmd52writebyte(struct mmc_card *card,
+                              u32 address,
+                              u8 byte)
+{
+        struct mmc_command io_cmd;
+        u32 arg;
+
+        memset(&io_cmd, 0, sizeof(io_cmd));
+        arg = rsi_sdio_set_cmd52_arg(1, 0, 0, address, byte);
+        io_cmd.opcode = SD_IO_RW_DIRECT;
+        io_cmd.arg = arg;
+        io_cmd.flags = MMC_RSP_R5 | MMC_CMD_AC;
+
+        return mmc_wait_for_cmd(card->host, &io_cmd, 0);
+}
+
+/**
+ * rsi_cmd52readbyte() - This function issues cmd52 byte read onto the card.
+ * @card: Pointer to the mmc_card.
+ * @address: Address to read from.
+ * @byte: Variable to store read value.
+ *
+ * Return: Read status.
+ */
+static int rsi_cmd52readbyte(struct mmc_card *card,
+                             u32 address,
+                             u8 *byte)
+{
+        struct mmc_command io_cmd;
+        u32 arg;
+        int err;
+
+        memset(&io_cmd, 0, sizeof(io_cmd));
+        arg = rsi_sdio_set_cmd52_arg(0, 0, 0, address, 0);
+        io_cmd.opcode = SD_IO_RW_DIRECT;
+        io_cmd.arg = arg;
+        io_cmd.flags = MMC_RSP_R5 | MMC_CMD_AC;
+
+        err = mmc_wait_for_cmd(card->host, &io_cmd, 0);
+        if ((!err) && (byte))
+                *byte =  io_cmd.resp[0] & 0xFF;
+        return err;
+}
+
+/**
+ * rsi_issue_sdiocommand() - This function issues sdio commands.
+ * @func: Pointer to the sdio_func structure.
+ * @opcode: Opcode value.
+ * @arg: Arguments to pass.
+ * @flags: Flags which are set.
+ * @resp: Pointer to store response.
+ *
+ * Return: err: command status as 0 or -1.
+ */
+static int rsi_issue_sdiocommand(struct sdio_func *func,
+                                 u32 opcode,
+                                 u32 arg,
+                                 u32 flags,
+                                 u32 *resp)
+{
+        struct mmc_command cmd;
+        struct mmc_host *host;
+        int err;
+
+        host = func->card->host;
+
+        memset(&cmd, 0, sizeof(struct mmc_command));
+        cmd.opcode = opcode;
+        cmd.arg = arg;
+        cmd.flags = flags;
+        err = mmc_wait_for_cmd(host, &cmd, 3);
+
+        if ((!err) && (resp))
+                *resp = cmd.resp[0];
+
+        return err;
+}
+
+/**
+ * rsi_handle_interrupt() - This function is called upon the occurence
+ *                          of an interrupt.
+ * @function: Pointer to the sdio_func structure.
+ *
+ * Return: None.
+ */
+static void rsi_handle_interrupt(struct sdio_func *function)
+{
+        struct rsi_hw *adapter = sdio_get_drvdata(function);
+
+        sdio_release_host(function);
+        rsi_interrupt_handler(adapter);
+        sdio_claim_host(function);
+}
+
+/**
+ * rsi_reset_card() - This function resets and re-initializes the card.
+ * @pfunction: Pointer to the sdio_func structure.
+ *
+ * Return: None.
+ */
+static void rsi_reset_card(struct sdio_func *pfunction)
+{
+        int ret = 0;
+        int err;
+        struct mmc_card *card = pfunction->card;
+        struct mmc_host *host = card->host;
+        s32 bit = (fls(host->ocr_avail) - 1);
+        u8 cmd52_resp;
+        u32 clock, resp, i;
+        u16 rca;
+
+        /* Reset 9110 chip */
+        ret = rsi_cmd52writebyte(pfunction->card,
+                                 SDIO_CCCR_ABORT,
+                                 (1 << 3));
+
+        /* Card will not send any response as it is getting reset immediately
+         * Hence expect a timeout status from host controller
+         */
+        if (ret != -ETIMEDOUT)
+                rsi_dbg(ERR_ZONE, "%s: Reset failed : %d\n", __func__, ret);
+
+        /* Wait for few milli seconds to get rid of residue charges if any */
+        msleep(20);
+
+        /* Initialize the SDIO card */
+        host->ios.vdd = bit;
+        host->ios.chip_select = MMC_CS_DONTCARE;
+        host->ios.bus_mode = MMC_BUSMODE_OPENDRAIN;
+        host->ios.power_mode = MMC_POWER_UP;
+        host->ios.bus_width = MMC_BUS_WIDTH_1;
+        host->ios.timing = MMC_TIMING_LEGACY;
+        host->ops->set_ios(host, &host->ios);
+
+        /*
+         * This delay should be sufficient to allow the power supply
+         * to reach the minimum voltage.
+         */
+        msleep(20);
+
+        host->ios.clock = host->f_min;
+        host->ios.power_mode = MMC_POWER_ON;
+        host->ops->set_ios(host, &host->ios);
+
+        /*
+         * This delay must be at least 74 clock sizes, or 1 ms, or the
+         * time required to reach a stable voltage.
+         */
+        msleep(20);
+
+        /* Issue CMD0. Goto idle state */
+        host->ios.chip_select = MMC_CS_HIGH;
+        host->ops->set_ios(host, &host->ios);
+        msleep(20);
+        err = rsi_issue_sdiocommand(pfunction,
+                                    MMC_GO_IDLE_STATE,
+                                    0,
+                                    (MMC_RSP_NONE | MMC_CMD_BC),
+                                    NULL);
+        host->ios.chip_select = MMC_CS_DONTCARE;
+        host->ops->set_ios(host, &host->ios);
+        msleep(20);
+        host->use_spi_crc = 0;
+
+        if (err)
+                rsi_dbg(ERR_ZONE, "%s: CMD0 failed : %d\n", __func__, err);
+
+        if (!host->ocr_avail) {
+                /* Issue CMD5, arg = 0 */
+                err = rsi_issue_sdiocommand(pfunction,
+                                            SD_IO_SEND_OP_COND,
+                                            0,
+                                            (MMC_RSP_R4 | MMC_CMD_BCR),
+                                            &resp);
+                if (err)
+                        rsi_dbg(ERR_ZONE, "%s: CMD5 failed : %d\n",
+                                __func__, err);
+                host->ocr_avail = resp;
+        }
+
+        /* Issue CMD5, arg = ocr. Wait till card is ready  */
+        for (i = 0; i < 100; i++) {
+                err = rsi_issue_sdiocommand(pfunction,
+                                            SD_IO_SEND_OP_COND,
+                                            host->ocr_avail,
+                                            (MMC_RSP_R4 | MMC_CMD_BCR),
+                                            &resp);
+                if (err) {
+                        rsi_dbg(ERR_ZONE, "%s: CMD5 failed : %d\n",
+                                __func__, err);
+                        break;
+                }
+
+                if (resp & MMC_CARD_BUSY)
+                        break;
+                msleep(20);
+        }
+
+        if ((i == 100) || (err)) {
+                rsi_dbg(ERR_ZONE, "%s: card in not ready : %d %d\n",
+                        __func__, i, err);
+                return;
+        }
+
+        /* Issue CMD3, get RCA */
+        err = rsi_issue_sdiocommand(pfunction,
+                                    SD_SEND_RELATIVE_ADDR,
+                                    0,
+                                    (MMC_RSP_R6 | MMC_CMD_BCR),
+                                    &resp);
+        if (err) {
+                rsi_dbg(ERR_ZONE, "%s: CMD3 failed : %d\n", __func__, err);
+                return;
+        }
+        rca = resp >> 16;
+        host->ios.bus_mode = MMC_BUSMODE_PUSHPULL;
+        host->ops->set_ios(host, &host->ios);
+
+        /* Issue CMD7, select card  */
+        err = rsi_issue_sdiocommand(pfunction,
+                                    MMC_SELECT_CARD,
+                                    (rca << 16),
+                                    (MMC_RSP_R1 | MMC_CMD_AC),
+                                    NULL);
+        if (err) {
+                rsi_dbg(ERR_ZONE, "%s: CMD7 failed : %d\n", __func__, err);
+                return;
+        }
+
+        /* Enable high speed */
+        if (card->host->caps & MMC_CAP_SD_HIGHSPEED) {
+                rsi_dbg(ERR_ZONE, "%s: Set high speed mode\n", __func__);
+                err = rsi_cmd52readbyte(card, SDIO_CCCR_SPEED, &cmd52_resp);
+                if (err) {
+                        rsi_dbg(ERR_ZONE, "%s: CCCR speed reg read failed: %d\n",
+                                __func__, err);
+                        card->state &= ~MMC_STATE_HIGHSPEED;
+                } else {
+                        err = rsi_cmd52writebyte(card,
+                                                 SDIO_CCCR_SPEED,
+                                                 (cmd52_resp | SDIO_SPEED_EHS));
+                        if (err) {
+                                rsi_dbg(ERR_ZONE,
+                                        "%s: CCR speed regwrite failed %d\n",
+                                        __func__, err);
+                                return;
+                        }
+                        mmc_card_set_highspeed(card);
+                        host->ios.timing = MMC_TIMING_SD_HS;
+                        host->ops->set_ios(host, &host->ios);
+                }
+        }
+
+        /* Set clock */
+        if (mmc_card_highspeed(card))
+                clock = 50000000;
+        else
+                clock = card->cis.max_dtr;
+
+        if (clock > host->f_max)
+                clock = host->f_max;
+
+        host->ios.clock = clock;
+        host->ops->set_ios(host, &host->ios);
+
+        if (card->host->caps & MMC_CAP_4_BIT_DATA) {
+                /* CMD52: Set bus width & disable card detect resistor */
+                err = rsi_cmd52writebyte(card,
+                                         SDIO_CCCR_IF,
+                                         (SDIO_BUS_CD_DISABLE |
+                                          SDIO_BUS_WIDTH_4BIT));
+                if (err) {
+                        rsi_dbg(ERR_ZONE, "%s: Set bus mode failed : %d\n",
+                                __func__, err);
+                        return;
+                }
+                host->ios.bus_width = MMC_BUS_WIDTH_4;
+                host->ops->set_ios(host, &host->ios);
+        }
+}
+
+/**
+ * rsi_setclock() - This function sets the clock frequency.
+ * @adapter: Pointer to the adapter structure.
+ * @freq: Clock frequency.
+ *
+ * Return: None.
+ */
+static void rsi_setclock(struct rsi_hw *adapter, u32 freq)
+{
+        struct rsi_91x_sdiodev *dev =
+                (struct rsi_91x_sdiodev *)adapter->rsi_dev;
+        struct mmc_host *host = dev->pfunction->card->host;
+        u32 clock;
+
+        clock = freq * 1000;
+        if (clock > host->f_max)
+                clock = host->f_max;
+        host->ios.clock = clock;
+        host->ops->set_ios(host, &host->ios);
+}
+
+/**
+ * rsi_setblocklength() - This function sets the host block length.
+ * @adapter: Pointer to the adapter structure.
+ * @length: Block length to be set.
+ *
+ * Return: status: 0 on success, -1 on failure.
+ */
+static int rsi_setblocklength(struct rsi_hw *adapter, u32 length)
+{
+        struct rsi_91x_sdiodev *dev =
+                (struct rsi_91x_sdiodev *)adapter->rsi_dev;
+        int status;
+        rsi_dbg(INIT_ZONE, "%s: Setting the block length\n", __func__);
+
+        status = sdio_set_block_size(dev->pfunction, length);
+        dev->pfunction->max_blksize = 256;
+
+        rsi_dbg(INFO_ZONE,
+                "%s: Operational blk length is %d\n", __func__, length);
+        return status;
+}
+
+/**
+ * rsi_setupcard() - This function queries and sets the card's features.
+ * @adapter: Pointer to the adapter structure.
+ *
+ * Return: status: 0 on success, -1 on failure.
+ */
+static int rsi_setupcard(struct rsi_hw *adapter)
+{
+        struct rsi_91x_sdiodev *dev =
+                (struct rsi_91x_sdiodev *)adapter->rsi_dev;
+        int status = 0;
+
+        rsi_setclock(adapter, 50000);
+
+        dev->tx_blk_size = 256;
+        status = rsi_setblocklength(adapter, dev->tx_blk_size);
+        if (status)
+                rsi_dbg(ERR_ZONE,
+                        "%s: Unable to set block length\n", __func__);
+        return status;
+}
+
+/**
+ * rsi_sdio_read_register() - This function reads one byte of information
+ *                            from a register.
+ * @adapter: Pointer to the adapter structure.
+ * @addr: Address of the register.
+ * @data: Pointer to the data that stores the data read.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+int rsi_sdio_read_register(struct rsi_hw *adapter,
+                           u32 addr,
+                           u8 *data)
+{
+        struct rsi_91x_sdiodev *dev =
+                (struct rsi_91x_sdiodev *)adapter->rsi_dev;
+        u8 fun_num = 0;
+        int status;
+
+        sdio_claim_host(dev->pfunction);
+
+        if (fun_num == 0)
+                *data = sdio_f0_readb(dev->pfunction, addr, &status);
+        else
+                *data = sdio_readb(dev->pfunction, addr, &status);
+
+        sdio_release_host(dev->pfunction);
+
+        return status;
+}
+
+/**
+ * rsi_sdio_write_register() - This function writes one byte of information
+ *                             into a register.
+ * @adapter: Pointer to the adapter structure.
+ * @function: Function Number.
+ * @addr: Address of the register.
+ * @data: Pointer to the data tha has to be written.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+int rsi_sdio_write_register(struct rsi_hw *adapter,
+                            u8 function,
+                            u32 addr,
+                            u8 *data)
+{
+        struct rsi_91x_sdiodev *dev =
+                (struct rsi_91x_sdiodev *)adapter->rsi_dev;
+        int status = 0;
+
+        sdio_claim_host(dev->pfunction);
+
+        if (function == 0)
+                sdio_f0_writeb(dev->pfunction, *data, addr, &status);
+        else
+                sdio_writeb(dev->pfunction, *data, addr, &status);
+
+        sdio_release_host(dev->pfunction);
+
+        return status;
+}
+
+/**
+ * rsi_sdio_ack_intr() - This function acks the interrupt received.
+ * @adapter: Pointer to the adapter structure.
+ * @int_bit: Interrupt bit to write into register.
+ *
+ * Return: None.
+ */
+void rsi_sdio_ack_intr(struct rsi_hw *adapter, u8 int_bit)
+{
+        int status;
+        status = rsi_sdio_write_register(adapter,
+                                         1,
+                                         (SDIO_FUN1_INTR_CLR_REG |
+                                          RSI_SD_REQUEST_MASTER),
+                                         &int_bit);
+        if (status)
+                rsi_dbg(ERR_ZONE, "%s: unable to send ack\n", __func__);
+}
+
+
+
+/**
+ * rsi_sdio_read_register_multiple() - This function read multiple bytes of
+ *                                     information from the SD card.
+ * @adapter: Pointer to the adapter structure.
+ * @addr: Address of the register.
+ * @count: Number of multiple bytes to be read.
+ * @data: Pointer to the read data.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+static int rsi_sdio_read_register_multiple(struct rsi_hw *adapter,
+                                           u32 addr,
+                                           u32 count,
+                                           u8 *data)
+{
+        struct rsi_91x_sdiodev *dev =
+                (struct rsi_91x_sdiodev *)adapter->rsi_dev;
+        u32 status;
+
+        sdio_claim_host(dev->pfunction);
+
+        status =  sdio_readsb(dev->pfunction, data, addr, count);
+
+        sdio_release_host(dev->pfunction);
+
+        if (status != 0)
+                rsi_dbg(ERR_ZONE, "%s: Synch Cmd53 read failed\n", __func__);
+        return status;
+}
+
+/**
+ * rsi_sdio_write_register_multiple() - This function writes multiple bytes of
+ *                                      information to the SD card.
+ * @adapter: Pointer to the adapter structure.
+ * @addr: Address of the register.
+ * @data: Pointer to the data that has to be written.
+ * @count: Number of multiple bytes to be written.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+int rsi_sdio_write_register_multiple(struct rsi_hw *adapter,
+                                     u32 addr,
+                                     u8 *data,
+                                     u32 count)
+{
+        struct rsi_91x_sdiodev *dev =
+                (struct rsi_91x_sdiodev *)adapter->rsi_dev;
+        int status;
+
+        if (dev->write_fail > 1) {
+                rsi_dbg(ERR_ZONE, "%s: Stopping card writes\n", __func__);
+                return 0;
+        } else if (dev->write_fail == 1) {
+                /**
+                 * Assuming it is a CRC failure, we want to allow another
+                 *  card write
+                 */
+                rsi_dbg(ERR_ZONE, "%s: Continue card writes\n", __func__);
+                dev->write_fail++;
+        }
+
+        sdio_claim_host(dev->pfunction);
+
+        status = sdio_writesb(dev->pfunction, addr, data, count);
+
+        sdio_release_host(dev->pfunction);
+
+        if (status) {
+                rsi_dbg(ERR_ZONE, "%s: Synch Cmd53 write failed %d\n",
+                        __func__, status);
+                dev->write_fail = 2;
+        } else {
+                memcpy(dev->prev_desc, data, FRAME_DESC_SZ);
+        }
+        return status;
+}
+
+/**
+ * rsi_sdio_host_intf_write_pkt() - This function writes the packet to device.
+ * @adapter: Pointer to the adapter structure.
+ * @pkt: Pointer to the data to be written on to the device.
+ * @len: length of the data to be written on to the device.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+static int rsi_sdio_host_intf_write_pkt(struct rsi_hw *adapter,
+                                        u8 *pkt,
+                                        u32 len)
+{
+        struct rsi_91x_sdiodev *dev =
+                (struct rsi_91x_sdiodev *)adapter->rsi_dev;
+        u32 block_size = dev->tx_blk_size;
+        u32 num_blocks, address, length;
+        u32 queueno;
+        int status;
+
+        queueno = ((pkt[1] >> 4) & 0xf);
+
+        num_blocks = len / block_size;
+
+        if (len % block_size)
+                num_blocks++;
+
+        address = (num_blocks * block_size | (queueno << 12));
+        length  = num_blocks * block_size;
+
+        status = rsi_sdio_write_register_multiple(adapter,
+                                                  address,
+                                                  (u8 *)pkt,
+                                                  length);
+        if (status)
+                rsi_dbg(ERR_ZONE, "%s: Unable to write onto the card: %d\n",
+                        __func__, status);
+        rsi_dbg(DATA_TX_ZONE, "%s: Successfully written onto card\n", __func__);
+        return status;
+}
+
+/**
+ * rsi_sdio_host_intf_read_pkt() - This function reads the packet
+                                   from the device.
+ * @adapter: Pointer to the adapter data structure.
+ * @pkt: Pointer to the packet data to be read from the the device.
+ * @length: Length of the data to be read from the device.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+int rsi_sdio_host_intf_read_pkt(struct rsi_hw *adapter,
+                                u8 *pkt,
+                                u32 length)
+{
+        int status = -EINVAL;
+
+        if (!length) {
+                rsi_dbg(ERR_ZONE, "%s: Pkt size is zero\n", __func__);
+                return status;
+        }
+
+        status = rsi_sdio_read_register_multiple(adapter,
+                                                 length,
+                                                 length, /*num of bytes*/
+                                                 (u8 *)pkt);
+
+        if (status)
+                rsi_dbg(ERR_ZONE, "%s: Failed to read frame: %d\n", __func__,
+                        status);
+        return status;
+}
+
+/**
+ * rsi_init_sdio_interface() - This function does init specific to SDIO.
+ *
+ * @adapter: Pointer to the adapter data structure.
+ * @pkt: Pointer to the packet data to be read from the the device.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+
+static int rsi_init_sdio_interface(struct rsi_hw *adapter,
+                                   struct sdio_func *pfunction)
+{
+        struct rsi_91x_sdiodev *rsi_91x_dev;
+        int status = -ENOMEM;
+
+        rsi_91x_dev = kzalloc(sizeof(*rsi_91x_dev), GFP_KERNEL);
+        if (!rsi_91x_dev)
+                return status;
+
+        adapter->rsi_dev = rsi_91x_dev;
+
+        sdio_claim_host(pfunction);
+
+        pfunction->enable_timeout = 100;
+        status = sdio_enable_func(pfunction);
+        if (status) {
+                rsi_dbg(ERR_ZONE, "%s: Failed to enable interface\n", __func__);
+                sdio_release_host(pfunction);
+                return status;
+        }
+
+        rsi_dbg(INIT_ZONE, "%s: Enabled the interface\n", __func__);
+
+        rsi_91x_dev->pfunction = pfunction;
+        adapter->device = &pfunction->dev;
+
+        sdio_set_drvdata(pfunction, adapter);
+
+        status = rsi_setupcard(adapter);
+        if (status) {
+                rsi_dbg(ERR_ZONE, "%s: Failed to setup card\n", __func__);
+                goto fail;
+        }
+
+        rsi_dbg(INIT_ZONE, "%s: Setup card succesfully\n", __func__);
+
+        status = rsi_init_sdio_slave_regs(adapter);
+        if (status) {
+                rsi_dbg(ERR_ZONE, "%s: Failed to init slave regs\n", __func__);
+                goto fail;
+        }
+        sdio_release_host(pfunction);
+
+        adapter->host_intf_write_pkt = rsi_sdio_host_intf_write_pkt;
+        adapter->host_intf_read_pkt = rsi_sdio_host_intf_read_pkt;
+        adapter->determine_event_timeout = rsi_sdio_determine_event_timeout;
+        adapter->check_hw_queue_status = rsi_sdio_read_buffer_status_register;
+
+#ifdef CONFIG_RSI_DEBUGFS
+        adapter->num_debugfs_entries = MAX_DEBUGFS_ENTRIES;
+#endif
+        return status;
+fail:
+        sdio_disable_func(pfunction);
+        sdio_release_host(pfunction);
+        return status;
+}
+
+/**
+ * rsi_probe() - This function is called by kernel when the driver provided
+ *               Vendor and device IDs are matched. All the initialization
+ *               work is done here.
+ * @pfunction: Pointer to the sdio_func structure.
+ * @id: Pointer to sdio_device_id structure.
+ *
+ * Return: 0 on success, 1 on failure.
+ */
+static int rsi_probe(struct sdio_func *pfunction,
+                     const struct sdio_device_id *id)
+{
+        struct rsi_hw *adapter;
+
+        rsi_dbg(INIT_ZONE, "%s: Init function called\n", __func__);
+
+        adapter = rsi_91x_init();
+        if (!adapter) {
+                rsi_dbg(ERR_ZONE, "%s: Failed to init os intf ops\n",
+                        __func__);
+                return 1;
+        }
+
+        if (rsi_init_sdio_interface(adapter, pfunction)) {
+                rsi_dbg(ERR_ZONE, "%s: Failed to init sdio interface\n",
+                        __func__);
+                goto fail;
+        }
+
+        if (rsi_sdio_device_init(adapter->priv)) {
+                rsi_dbg(ERR_ZONE, "%s: Failed in device init\n", __func__);
+                sdio_claim_host(pfunction);
+                sdio_disable_func(pfunction);
+                sdio_release_host(pfunction);
+                goto fail;
+        }
+
+        sdio_claim_host(pfunction);
+        if (sdio_claim_irq(pfunction, rsi_handle_interrupt)) {
+                rsi_dbg(ERR_ZONE, "%s: Failed to request IRQ\n", __func__);
+                sdio_release_host(pfunction);
+                goto fail;
+        }
+
+        sdio_release_host(pfunction);
+        rsi_dbg(INIT_ZONE, "%s: Registered Interrupt handler\n", __func__);
+
+        return 0;
+fail:
+        rsi_91x_deinit(adapter);
+        rsi_dbg(ERR_ZONE, "%s: Failed in probe...Exiting\n", __func__);
+        return 1;
+}
+
+/**
+ * rsi_disconnect() - This function performs the reverse of the probe function.
+ * @pfunction: Pointer to the sdio_func structure.
+ *
+ * Return: void.
+ */
+static void rsi_disconnect(struct sdio_func *pfunction)
+{
+        struct rsi_hw *adapter = sdio_get_drvdata(pfunction);
+        struct rsi_91x_sdiodev *dev =
+                (struct rsi_91x_sdiodev *)adapter->rsi_dev;
+
+        if (!adapter)
+                return;
+
+        dev->write_fail = 2;
+        rsi_mac80211_detach(adapter);
+
+        sdio_claim_host(pfunction);
+        sdio_release_irq(pfunction);
+        sdio_disable_func(pfunction);
+        rsi_91x_deinit(adapter);
+        /* Resetting to take care of the case, where-in driver is re-loaded */
+        rsi_reset_card(pfunction);
+        sdio_release_host(pfunction);
+}
+
+#ifdef CONFIG_PM
+static int rsi_suspend(struct device *dev)
+{
+        /* Not yet implemented */
+        return -ENOSYS;
+}
+
+static int rsi_resume(struct device *dev)
+{
+        /* Not yet implemented */
+        return -ENOSYS;
+}
+
+static const struct dev_pm_ops rsi_pm_ops = {
+        .suspend = rsi_suspend,
+        .resume = rsi_resume,
+};
+#endif
+
+static const struct sdio_device_id rsi_dev_table[] =  {
+        { SDIO_DEVICE(0x303, 0x100) },
+        { SDIO_DEVICE(0x041B, 0x0301) },
+        { SDIO_DEVICE(0x041B, 0x0201) },
+        { SDIO_DEVICE(0x041B, 0x9330) },
+        { /* Blank */},
+};
+
+static struct sdio_driver rsi_driver = {
+        .name       = "RSI-SDIO WLAN",
+        .probe      = rsi_probe,
+        .remove     = rsi_disconnect,
+        .id_table   = rsi_dev_table,
+#ifdef CONFIG_PM
+        .drv = {
+                .pm = &rsi_pm_ops,
+        }
+#endif
+};
+
+/**
+ * rsi_module_init() - This function registers the sdio module.
+ * @void: Void.
+ *
+ * Return: 0 on success.
+ */
+static int rsi_module_init(void)
+{
+        sdio_register_driver(&rsi_driver);
+        rsi_dbg(INIT_ZONE, "%s: Registering driver\n", __func__);
+        return 0;
+}
+
+/**
+ * rsi_module_exit() - This function unregisters the sdio module.
+ * @void: Void.
+ *
+ * Return: None.
+ */
+static void rsi_module_exit(void)
+{
+        sdio_unregister_driver(&rsi_driver);
+        rsi_dbg(INFO_ZONE, "%s: Unregistering driver\n", __func__);
+}
+
+module_init(rsi_module_init);
+module_exit(rsi_module_exit);
+
+MODULE_AUTHOR("Redpine Signals Inc");
+MODULE_DESCRIPTION("Common SDIO layer for RSI drivers");
+MODULE_SUPPORTED_DEVICE("RSI-91x");
+MODULE_DEVICE_TABLE(sdio, rsi_dev_table);
+MODULE_FIRMWARE(FIRMWARE_RSI9113);
+MODULE_VERSION("0.1");
+MODULE_LICENSE("Dual BSD/GPL");
diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
new file mode 100644
index 000000000000..f1cb99cafed8
--- /dev/null
+++ b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
@@ -0,0 +1,566 @@
+/**
+ * Copyright (c) 2014 Redpine Signals Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ */
+
+#include <linux/firmware.h>
+#include "rsi_sdio.h"
+#include "rsi_common.h"
+
+/**
+ * rsi_sdio_master_access_msword() - This function sets the AHB master access
+ *                                   MS word in the SDIO slave registers.
+ * @adapter: Pointer to the adapter structure.
+ * @ms_word: ms word need to be initialized.
+ *
+ * Return: status: 0 on success, -1 on failure.
+ */
+static int rsi_sdio_master_access_msword(struct rsi_hw *adapter,
+                                         u16 ms_word)
+{
+        u8 byte;
+        u8 function = 0;
+        int status = 0;
+
+        byte = (u8)(ms_word & 0x00FF);
+
+        rsi_dbg(INIT_ZONE,
+                "%s: MASTER_ACCESS_MSBYTE:0x%x\n", __func__, byte);
+
+        status = rsi_sdio_write_register(adapter,
+                                         function,
+                                         SDIO_MASTER_ACCESS_MSBYTE,
+                                         &byte);
+        if (status) {
+                rsi_dbg(ERR_ZONE,
+                        "%s: fail to access MASTER_ACCESS_MSBYTE\n",
+                        __func__);
+                return -1;
+        }
+
+        byte = (u8)(ms_word >> 8);
+
+        rsi_dbg(INIT_ZONE, "%s:MASTER_ACCESS_LSBYTE:0x%x\n", __func__, byte);
+        status = rsi_sdio_write_register(adapter,
+                                         function,
+                                         SDIO_MASTER_ACCESS_LSBYTE,
+                                         &byte);
+        return status;
+}
+
+/**
+ * rsi_copy_to_card() - This function includes the actual funtionality of
+ *                      copying the TA firmware to the card.Basically this
+ *                      function includes opening the TA file,reading the
+ *                      TA file and writing their values in blocks of data.
+ * @common: Pointer to the driver private structure.
+ * @fw: Pointer to the firmware value to be written.
+ * @len: length of firmware file.
+ * @num_blocks: Number of blocks to be written to the card.
+ *
+ * Return: 0 on success and -1 on failure.
+ */
+static int rsi_copy_to_card(struct rsi_common *common,
+                            const u8 *fw,
+                            u32 len,
+                            u32 num_blocks)
+{
+        struct rsi_hw *adapter = common->priv;
+        struct rsi_91x_sdiodev *dev =
+                (struct rsi_91x_sdiodev *)adapter->rsi_dev;
+        u32 indx, ii;
+        u32 block_size = dev->tx_blk_size;
+        u32 lsb_address;
+        __le32 data[] = { TA_HOLD_THREAD_VALUE, TA_SOFT_RST_CLR,
+                          TA_PC_ZERO, TA_RELEASE_THREAD_VALUE };
+        u32 address[] = { TA_HOLD_THREAD_REG, TA_SOFT_RESET_REG,
+                          TA_TH0_PC_REG, TA_RELEASE_THREAD_REG };
+        u32 base_address;
+        u16 msb_address;
+
+        base_address = TA_LOAD_ADDRESS;
+        msb_address = base_address >> 16;
+
+        for (indx = 0, ii = 0; ii < num_blocks; ii++, indx += block_size) {
+                lsb_address = ((u16) base_address | RSI_SD_REQUEST_MASTER);
+                if (rsi_sdio_write_register_multiple(adapter,
+                                                     lsb_address,
+                                                     (u8 *)(fw + indx),
+                                                     block_size)) {
+                        rsi_dbg(ERR_ZONE,
+                                "%s: Unable to load %s blk\n", __func__,
+                                FIRMWARE_RSI9113);
+                        return -1;
+                }
+                rsi_dbg(INIT_ZONE, "%s: loading block: %d\n", __func__, ii);
+                base_address += block_size;
+                if ((base_address >> 16) != msb_address) {
+                        msb_address += 1;
+                        if (rsi_sdio_master_access_msword(adapter,
+                                                          msb_address)) {
+                                rsi_dbg(ERR_ZONE,
+                                        "%s: Unable to set ms word reg\n",
+                                        __func__);
+                                return -1;
+                        }
+                }
+        }
+
+        if (len % block_size) {
+                lsb_address = ((u16) base_address | RSI_SD_REQUEST_MASTER);
+                if (rsi_sdio_write_register_multiple(adapter,
+                                                     lsb_address,
+                                                     (u8 *)(fw + indx),
+                                                     len % block_size)) {
+                        rsi_dbg(ERR_ZONE,
+                                "%s: Unable to load f/w\n", __func__);
+                        return -1;
+                }
+        }
+        rsi_dbg(INIT_ZONE,
+                "%s: Succesfully loaded TA instructions\n", __func__);
+
+        if (rsi_sdio_master_access_msword(adapter, TA_BASE_ADDR)) {
+                rsi_dbg(ERR_ZONE,
+                        "%s: Unable to set ms word to common reg\n",
+                        __func__);
+                return -1;
+        }
+
+        for (ii = 0; ii < ARRAY_SIZE(data); ii++) {
+                /* Bringing TA out of reset */
+                if (rsi_sdio_write_register_multiple(adapter,
+                                                     (address[ii] |
+                                                     RSI_SD_REQUEST_MASTER),
+                                                     (u8 *)&data[ii],
+                                                     4)) {
+                        rsi_dbg(ERR_ZONE,
+                                "%s: Unable to hold TA threads\n", __func__);
+                        return -1;
+                }
+        }
+
+        rsi_dbg(INIT_ZONE, "%s: loaded firmware\n", __func__);
+        return 0;
+}
+
+/**
+ * rsi_load_ta_instructions() - This function includes the actual funtionality
+ *                              of loading the TA firmware.This function also
+ *                              includes opening the TA file,reading the TA
+ *                              file and writing their value in blocks of data.
+ * @common: Pointer to the driver private structure.
+ *
+ * Return: status: 0 on success, -1 on failure.
+ */
+static int rsi_load_ta_instructions(struct rsi_common *common)
+{
+        struct rsi_hw *adapter = common->priv;
+        struct rsi_91x_sdiodev *dev =
+                (struct rsi_91x_sdiodev *)adapter->rsi_dev;
+        u32 len;
+        u32 num_blocks;
+        const u8 *fw;
+        const struct firmware *fw_entry = NULL;
+        u32 block_size = dev->tx_blk_size;
+        int status = 0;
+        u32 base_address;
+        u16 msb_address;
+
+        if (rsi_sdio_master_access_msword(adapter, TA_BASE_ADDR)) {
+                rsi_dbg(ERR_ZONE,
+                        "%s: Unable to set ms word to common reg\n",
+                        __func__);
+                return -1;
+        }
+        base_address = TA_LOAD_ADDRESS;
+        msb_address = (base_address >> 16);
+
+        if (rsi_sdio_master_access_msword(adapter, msb_address)) {
+                rsi_dbg(ERR_ZONE,
+                        "%s: Unable to set ms word reg\n", __func__);
+                return -1;
+        }
+
+        status = request_firmware(&fw_entry, FIRMWARE_RSI9113, adapter->device);
+        if (status < 0) {
+                rsi_dbg(ERR_ZONE, "%s Firmware file %s not found\n",
+                        __func__, FIRMWARE_RSI9113);
+                return status;
+        }
+
+        fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL);
+        len = fw_entry->size;
+
+        if (len % 4)
+                len += (4 - (len % 4));
+
+        num_blocks = (len / block_size);
+
+        rsi_dbg(INIT_ZONE, "%s: Instruction size:%d\n", __func__, len);
+        rsi_dbg(INIT_ZONE, "%s: num blocks: %d\n", __func__, num_blocks);
+
+        status = rsi_copy_to_card(common, fw, len, num_blocks);
+        release_firmware(fw_entry);
+        return status;
+}
+
+/**
+ * rsi_process_pkt() - This Function reads rx_blocks register and figures out
+ *                     the size of the rx pkt.
+ * @common: Pointer to the driver private structure.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+static int rsi_process_pkt(struct rsi_common *common)
+{
+        struct rsi_hw *adapter = common->priv;
+        u8 num_blks = 0;
+        u32 rcv_pkt_len = 0;
+        int status = 0;
+
+        status = rsi_sdio_read_register(adapter,
+                                        SDIO_RX_NUM_BLOCKS_REG,
+                                        &num_blks);
+
+        if (status) {
+                rsi_dbg(ERR_ZONE,
+                        "%s: Failed to read pkt length from the card:\n",
+                        __func__);
+                return status;
+        }
+        rcv_pkt_len = (num_blks * 256);
+
+        common->rx_data_pkt = kmalloc(rcv_pkt_len, GFP_KERNEL);
+        if (!common->rx_data_pkt) {
+                rsi_dbg(ERR_ZONE, "%s: Failed in memory allocation\n",
+                        __func__);
+                return -1;
+        }
+
+        status = rsi_sdio_host_intf_read_pkt(adapter,
+                                             common->rx_data_pkt,
+                                             rcv_pkt_len);
+        if (status) {
+                rsi_dbg(ERR_ZONE, "%s: Failed to read packet from card\n",
+                        __func__);
+                goto fail;
+        }
+
+        status = rsi_read_pkt(common, rcv_pkt_len);
+        kfree(common->rx_data_pkt);
+        return status;
+
+fail:
+        kfree(common->rx_data_pkt);
+        return -1;
+}
+
+/**
+ * rsi_init_sdio_slave_regs() - This function does the actual initialization
+ *                              of SDBUS slave registers.
+ * @adapter: Pointer to the adapter structure.
+ *
+ * Return: status: 0 on success, -1 on failure.
+ */
+int rsi_init_sdio_slave_regs(struct rsi_hw *adapter)
+{
+        struct rsi_91x_sdiodev *dev =
+                (struct rsi_91x_sdiodev *)adapter->rsi_dev;
+        u8 function = 0;
+        u8 byte;
+        int status = 0;
+
+        if (dev->next_read_delay) {
+                byte = dev->next_read_delay;
+                status = rsi_sdio_write_register(adapter,
+                                                 function,
+                                                 SDIO_NXT_RD_DELAY2,
+                                                 &byte);
+                if (status) {
+                        rsi_dbg(ERR_ZONE,
+                                "%s: Failed to write SDIO_NXT_RD_DELAY2\n",
+                                __func__);
+                        return -1;
+                }
+        }
+
+        if (dev->sdio_high_speed_enable) {
+                rsi_dbg(INIT_ZONE, "%s: Enabling SDIO High speed\n", __func__);
+                byte = 0x3;
+
+                status = rsi_sdio_write_register(adapter,
+                                                 function,
+                                                 SDIO_REG_HIGH_SPEED,
+                                                 &byte);
+                if (status) {
+                        rsi_dbg(ERR_ZONE,
+                                "%s: Failed to enable SDIO high speed\n",
+                                __func__);
+                        return -1;
+                }
+        }
+
+        /* This tells SDIO FIFO when to start read to host */
+        rsi_dbg(INIT_ZONE, "%s: Initialzing SDIO read start level\n", __func__);
+        byte = 0x24;
+
+        status = rsi_sdio_write_register(adapter,
+                                         function,
+                                         SDIO_READ_START_LVL,
+                                         &byte);
+        if (status) {
+                rsi_dbg(ERR_ZONE,
+                        "%s: Failed to write SDIO_READ_START_LVL\n", __func__);
+                return -1;
+        }
+
+        rsi_dbg(INIT_ZONE, "%s: Initialzing FIFO ctrl registers\n", __func__);
+        byte = (128 - 32);
+
+        status = rsi_sdio_write_register(adapter,
+                                         function,
+                                         SDIO_READ_FIFO_CTL,
+                                         &byte);
+        if (status) {
+                rsi_dbg(ERR_ZONE,
+                        "%s: Failed to write SDIO_READ_FIFO_CTL\n", __func__);
+                return -1;
+        }
+
+        byte = 32;
+        status = rsi_sdio_write_register(adapter,
+                                         function,
+                                         SDIO_WRITE_FIFO_CTL,
+                                         &byte);
+        if (status) {
+                rsi_dbg(ERR_ZONE,
+                        "%s: Failed to write SDIO_WRITE_FIFO_CTL\n", __func__);
+                return -1;
+        }
+
+        return 0;
+}
+
+/**
+ * rsi_interrupt_handler() - This function read and process SDIO interrupts.
+ * @adapter: Pointer to the adapter structure.
+ *
+ * Return: None.
+ */
+void rsi_interrupt_handler(struct rsi_hw *adapter)
+{
+        struct rsi_common *common = adapter->priv;
+        struct rsi_91x_sdiodev *dev =
+                (struct rsi_91x_sdiodev *)adapter->rsi_dev;
+        int status;
+        enum sdio_interrupt_type isr_type;
+        u8 isr_status = 0;
+        u8 fw_status = 0;
+
+        dev->rx_info.sdio_int_counter++;
+
+        do {
+                mutex_lock(&common->tx_rxlock);
+                status = rsi_sdio_read_register(common->priv,
+                                                RSI_FN1_INT_REGISTER,
+                                                &isr_status);
+                if (status) {
+                        rsi_dbg(ERR_ZONE,
+                                "%s: Failed to Read Intr Status Register\n",
+                                __func__);
+                        mutex_unlock(&common->tx_rxlock);
+                        return;
+                }
+
+                if (isr_status == 0) {
+                        rsi_set_event(&common->tx_thread.event);
+                        dev->rx_info.sdio_intr_status_zero++;
+                        mutex_unlock(&common->tx_rxlock);
+                        return;
+                }
+
+                rsi_dbg(ISR_ZONE, "%s: Intr_status = %x %d %d\n",
+                        __func__, isr_status, (1 << MSDU_PKT_PENDING),
+                        (1 << FW_ASSERT_IND));
+
+                do {
+                        RSI_GET_SDIO_INTERRUPT_TYPE(isr_status, isr_type);
+
+                        switch (isr_type) {
+                        case BUFFER_AVAILABLE:
+                                dev->rx_info.watch_bufferfull_count = 0;
+                                dev->rx_info.buffer_full = false;
+                                dev->rx_info.mgmt_buffer_full = false;
+                                rsi_sdio_ack_intr(common->priv,
+                                                  (1 << PKT_BUFF_AVAILABLE));
+                                rsi_set_event((&common->tx_thread.event));
+                                rsi_dbg(ISR_ZONE,
+                                        "%s: ==> BUFFER_AVILABLE <==\n",
+                                        __func__);
+                                dev->rx_info.buf_avilable_counter++;
+                                break;
+
+                        case FIRMWARE_ASSERT_IND:
+                                rsi_dbg(ERR_ZONE,
+                                        "%s: ==> FIRMWARE Assert <==\n",
+                                        __func__);
+                                status = rsi_sdio_read_register(common->priv,
+                                                        SDIO_FW_STATUS_REG,
+                                                        &fw_status);
+                                if (status) {
+                                        rsi_dbg(ERR_ZONE,
+                                                "%s: Failed to read f/w reg\n",
+                                                __func__);
+                                } else {
+                                        rsi_dbg(ERR_ZONE,
+                                                "%s: Firmware Status is 0x%x\n",
+                                                __func__ , fw_status);
+                                        rsi_sdio_ack_intr(common->priv,
+                                                          (1 << FW_ASSERT_IND));
+                                }
+
+                                common->fsm_state = FSM_CARD_NOT_READY;
+                                break;
+
+                        case MSDU_PACKET_PENDING:
+                                rsi_dbg(ISR_ZONE, "Pkt pending interrupt\n");
+                                dev->rx_info.total_sdio_msdu_pending_intr++;
+
+                                status = rsi_process_pkt(common);
+                                if (status) {
+                                        rsi_dbg(ERR_ZONE,
+                                                "%s: Failed to read pkt\n",
+                                                __func__);
+                                        mutex_unlock(&common->tx_rxlock);
+                                        return;
+                                }
+                                break;
+                        default:
+                                rsi_sdio_ack_intr(common->priv, isr_status);
+                                dev->rx_info.total_sdio_unknown_intr++;
+                                isr_status = 0;
+                                rsi_dbg(ISR_ZONE,
+                                        "Unknown Interrupt %x\n",
+                                        isr_status);
+                                break;
+                        }
+                        isr_status ^= BIT(isr_type - 1);
+                } while (isr_status);
+                mutex_unlock(&common->tx_rxlock);
+        } while (1);
+}
+
+/**
+ * rsi_device_init() - This Function Initializes The HAL.
+ * @common: Pointer to the driver private structure.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+int rsi_sdio_device_init(struct rsi_common *common)
+{
+        if (rsi_load_ta_instructions(common))
+                return -1;
+
+        if (rsi_sdio_master_access_msword(common->priv, MISC_CFG_BASE_ADDR)) {
+                rsi_dbg(ERR_ZONE, "%s: Unable to set ms word reg\n",
+                        __func__);
+                return -1;
+        }
+        rsi_dbg(INIT_ZONE,
+                "%s: Setting ms word to 0x41050000\n", __func__);
+
+        return 0;
+}
+
+/**
+ * rsi_sdio_read_buffer_status_register() - This function is used to the read
+ *                                          buffer status register and set
+ *                                          relevant fields in
+ *                                          rsi_91x_sdiodev struct.
+ * @adapter: Pointer to the driver hw structure.
+ * @q_num: The Q number whose status is to be found.
+ *
+ * Return: status: -1 on failure or else queue full/stop is indicated.
+ */
+int rsi_sdio_read_buffer_status_register(struct rsi_hw *adapter, u8 q_num)
+{
+        struct rsi_common *common = adapter->priv;
+        struct rsi_91x_sdiodev *dev =
+                (struct rsi_91x_sdiodev *)adapter->rsi_dev;
+        u8 buf_status = 0;
+        int status = 0;
+
+        status = rsi_sdio_read_register(common->priv,
+                                        RSI_DEVICE_BUFFER_STATUS_REGISTER,
+                                        &buf_status);
+
+        if (status) {
+                rsi_dbg(ERR_ZONE,
+                        "%s: Failed to read status register\n", __func__);
+                return -1;
+        }
+
+        if (buf_status & (BIT(PKT_MGMT_BUFF_FULL))) {
+                if (!dev->rx_info.mgmt_buffer_full)
+                        dev->rx_info.mgmt_buf_full_counter++;
+                dev->rx_info.mgmt_buffer_full = true;
+        } else {
+                dev->rx_info.mgmt_buffer_full = false;
+        }
+
+        if (buf_status & (BIT(PKT_BUFF_FULL))) {
+                if (!dev->rx_info.buffer_full)
+                        dev->rx_info.buf_full_counter++;
+                dev->rx_info.buffer_full = true;
+        } else {
+                dev->rx_info.buffer_full = false;
+        }
+
+        if (buf_status & (BIT(PKT_BUFF_SEMI_FULL))) {
+                if (!dev->rx_info.semi_buffer_full)
+                        dev->rx_info.buf_semi_full_counter++;
+                dev->rx_info.semi_buffer_full = true;
+        } else {
+                dev->rx_info.semi_buffer_full = false;
+        }
+
+        if ((q_num == MGMT_SOFT_Q) && (dev->rx_info.mgmt_buffer_full))
+                return QUEUE_FULL;
+
+        if (dev->rx_info.buffer_full)
+                return QUEUE_FULL;
+
+        return QUEUE_NOT_FULL;
+}
+
+/**
+ * rsi_sdio_determine_event_timeout() - This Function determines the event
+ *                                      timeout duration.
+ * @adapter: Pointer to the adapter structure.
+ *
+ * Return: timeout duration is returned.
+ */
+int rsi_sdio_determine_event_timeout(struct rsi_hw *adapter)
+{
+        struct rsi_91x_sdiodev *dev =
+                (struct rsi_91x_sdiodev *)adapter->rsi_dev;
+
+        /* Once buffer full is seen, event timeout to occur every 2 msecs */
+        if (dev->rx_info.buffer_full)
+                return 2;
+
+        return EVENT_WAIT_FOREVER;
+}
diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c
new file mode 100644
index 000000000000..bb1bf96670eb
--- /dev/null
+++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
@@ -0,0 +1,575 @@
+/**
+ * Copyright (c) 2014 Redpine Signals Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ */
+
+#include <linux/module.h>
+#include "rsi_usb.h"
+
+/**
+ * rsi_usb_card_write() - This function writes to the USB Card.
+ * @adapter: Pointer to the adapter structure.
+ * @buf: Pointer to the buffer from where the data has to be taken.
+ * @len: Length to be written.
+ * @endpoint: Type of endpoint.
+ *
+ * Return: status: 0 on success, -1 on failure.
+ */
+static int rsi_usb_card_write(struct rsi_hw *adapter,
+                              void *buf,
+                              u16 len,
+                              u8 endpoint)
+{
+        struct rsi_91x_usbdev *dev = (struct rsi_91x_usbdev *)adapter->rsi_dev;
+        int status;
+        s32 transfer;
+
+        status = usb_bulk_msg(dev->usbdev,
+                              usb_sndbulkpipe(dev->usbdev,
+                              dev->bulkout_endpoint_addr[endpoint - 1]),
+                              buf,
+                              len,
+                              &transfer,
+                              HZ * 5);
+
+        if (status < 0) {
+                rsi_dbg(ERR_ZONE,
+                        "Card write failed with error code :%10d\n", status);
+                dev->write_fail = 1;
+        }
+        return status;
+}
+
+/**
+ * rsi_write_multiple() - This function writes multiple bytes of information
+ *                        to the USB card.
+ * @adapter: Pointer to the adapter structure.
+ * @addr: Address of the register.
+ * @data: Pointer to the data that has to be written.
+ * @count: Number of multiple bytes to be written.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+static int rsi_write_multiple(struct rsi_hw *adapter,
+                              u8 endpoint,
+                              u8 *data,
+                              u32 count)
+{
+        struct rsi_91x_usbdev *dev = (struct rsi_91x_usbdev *)adapter->rsi_dev;
+        u8 *seg = dev->tx_buffer;
+
+        if (dev->write_fail)
+                return 0;
+
+        if (endpoint == MGMT_EP) {
+                memset(seg, 0, RSI_USB_TX_HEAD_ROOM);
+                memcpy(seg + RSI_USB_TX_HEAD_ROOM, data, count);
+        } else {
+                seg = ((u8 *)data - RSI_USB_TX_HEAD_ROOM);
+        }
+
+        return rsi_usb_card_write(adapter,
+                                  seg,
+                                  count + RSI_USB_TX_HEAD_ROOM,
+                                  endpoint);
+}
+
+/**
+ * rsi_find_bulk_in_and_out_endpoints() - This function initializes the bulk
+ *                                        endpoints to the device.
+ * @interface: Pointer to the USB interface structure.
+ * @adapter: Pointer to the adapter structure.
+ *
+ * Return: ret_val: 0 on success, -ENOMEM on failure.
+ */
+static int rsi_find_bulk_in_and_out_endpoints(struct usb_interface *interface,
+                                              struct rsi_hw *adapter)
+{
+        struct rsi_91x_usbdev *dev = (struct rsi_91x_usbdev *)adapter->rsi_dev;
+        struct usb_host_interface *iface_desc;
+        struct usb_endpoint_descriptor *endpoint;
+        __le16 buffer_size;
+        int ii, bep_found = 0;
+
+        iface_desc = &(interface->altsetting[0]);
+
+        for (ii = 0; ii < iface_desc->desc.bNumEndpoints; ++ii) {
+                endpoint = &(iface_desc->endpoint[ii].desc);
+
+                if ((!(dev->bulkin_endpoint_addr)) &&
+                    (endpoint->bEndpointAddress & USB_DIR_IN) &&
+                    ((endpoint->bmAttributes &
+                    USB_ENDPOINT_XFERTYPE_MASK) ==
+                    USB_ENDPOINT_XFER_BULK)) {
+                        buffer_size = endpoint->wMaxPacketSize;
+                        dev->bulkin_size = buffer_size;
+                        dev->bulkin_endpoint_addr =
+                                endpoint->bEndpointAddress;
+                }
+
+                if (!dev->bulkout_endpoint_addr[bep_found] &&
+                    !(endpoint->bEndpointAddress & USB_DIR_IN) &&
+                    ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) ==
+                      USB_ENDPOINT_XFER_BULK)) {
+                        dev->bulkout_endpoint_addr[bep_found] =
+                                endpoint->bEndpointAddress;
+                        buffer_size = endpoint->wMaxPacketSize;
+                        dev->bulkout_size[bep_found] = buffer_size;
+                        bep_found++;
+                }
+
+                if (bep_found >= MAX_BULK_EP)
+                        break;
+        }
+
+        if (!(dev->bulkin_endpoint_addr) &&
+            (dev->bulkout_endpoint_addr[0]))
+                return -EINVAL;
+
+        return 0;
+}
+
+/* rsi_usb_reg_read() - This function reads data from given register address.
+ * @usbdev: Pointer to the usb_device structure.
+ * @reg: Address of the register to be read.
+ * @value: Value to be read.
+ * @len: length of data to be read.
+ *
+ * Return: status: 0 on success, -1 on failure.
+ */
+static int rsi_usb_reg_read(struct usb_device *usbdev,
+                            u32 reg,
+                            u16 *value,
+                            u16 len)
+{
+        u8 temp_buf[4];
+        int status = 0;
+
+        status = usb_control_msg(usbdev,
+                                 usb_rcvctrlpipe(usbdev, 0),
+                                 USB_VENDOR_REGISTER_READ,
+                                 USB_TYPE_VENDOR,
+                                 ((reg & 0xffff0000) >> 16), (reg & 0xffff),
+                                 (void *)temp_buf,
+                                 len,
+                                 HZ * 5);
+
+        *value = (temp_buf[0] | (temp_buf[1] << 8));
+        if (status < 0) {
+                rsi_dbg(ERR_ZONE,
+                        "%s: Reg read failed with error code :%d\n",
+                        __func__, status);
+        }
+        return status;
+}
+
+/**
+ * rsi_usb_reg_write() - This function writes the given data into the given
+ *                       register address.
+ * @usbdev: Pointer to the usb_device structure.
+ * @reg: Address of the register.
+ * @value: Value to write.
+ * @len: Length of data to be written.
+ *
+ * Return: status: 0 on success, -1 on failure.
+ */
+static int rsi_usb_reg_write(struct usb_device *usbdev,
+                             u32 reg,
+                             u16 value,
+                             u16 len)
+{
+        u8 usb_reg_buf[4];
+        int status = 0;
+
+        usb_reg_buf[0] = (value & 0x00ff);
+        usb_reg_buf[1] = (value & 0xff00) >> 8;
+        usb_reg_buf[2] = 0x0;
+        usb_reg_buf[3] = 0x0;
+
+        status = usb_control_msg(usbdev,
+                                 usb_sndctrlpipe(usbdev, 0),
+                                 USB_VENDOR_REGISTER_WRITE,
+                                 USB_TYPE_VENDOR,
+                                 ((reg & 0xffff0000) >> 16),
+                                 (reg & 0xffff),
+                                 (void *)usb_reg_buf,
+                                 len,
+                                 HZ * 5);
+        if (status < 0) {
+                rsi_dbg(ERR_ZONE,
+                        "%s: Reg write failed with error code :%d\n",
+                        __func__, status);
+        }
+        return status;
+}
+
+/**
+ * rsi_rx_done_handler() - This function is called when a packet is received
+ *                         from USB stack. This is callback to recieve done.
+ * @urb: Received URB.
+ *
+ * Return: None.
+ */
+static void rsi_rx_done_handler(struct urb *urb)
+{
+        struct rsi_hw *adapter = urb->context;
+        struct rsi_91x_usbdev *dev = (struct rsi_91x_usbdev *)adapter->rsi_dev;
+
+        if (urb->status)
+                return;
+
+        rsi_set_event(&dev->rx_thread.event);
+}
+
+/**
+ * rsi_rx_urb_submit() - This function submits the given URB to the USB stack.
+ * @adapter: Pointer to the adapter structure.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+static int rsi_rx_urb_submit(struct rsi_hw *adapter)
+{
+        struct rsi_91x_usbdev *dev = (struct rsi_91x_usbdev *)adapter->rsi_dev;
+        struct urb *urb = dev->rx_usb_urb[0];
+        int status;
+
+        usb_fill_bulk_urb(urb,
+                          dev->usbdev,
+                          usb_rcvbulkpipe(dev->usbdev,
+                                dev->bulkin_endpoint_addr),
+                          urb->transfer_buffer,
+                          3000,
+                          rsi_rx_done_handler,
+                          adapter);
+
+        status = usb_submit_urb(urb, GFP_KERNEL);
+        if (status)
+                rsi_dbg(ERR_ZONE, "%s: Failed in urb submission\n", __func__);
+
+        return status;
+}
+
+/**
+ * rsi_usb_write_register_multiple() - This function writes multiple bytes of
+ *                                     information to multiple registers.
+ * @adapter: Pointer to the adapter structure.
+ * @addr: Address of the register.
+ * @data: Pointer to the data that has to be written.
+ * @count: Number of multiple bytes to be written on to the registers.
+ *
+ * Return: status: 0 on success, -1 on failure.
+ */
+int rsi_usb_write_register_multiple(struct rsi_hw *adapter,
+                                    u32 addr,
+                                    u8 *data,
+                                    u32 count)
+{
+        struct rsi_91x_usbdev *dev = (struct rsi_91x_usbdev *)adapter->rsi_dev;
+        u8 *buf;
+        u8 transfer;
+        int status = 0;
+
+        buf = kzalloc(4096, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        while (count) {
+                transfer = min_t(int, count, 4096);
+                memcpy(buf, data, transfer);
+                status = usb_control_msg(dev->usbdev,
+                                         usb_sndctrlpipe(dev->usbdev, 0),
+                                         USB_VENDOR_REGISTER_WRITE,
+                                         USB_TYPE_VENDOR,
+                                         ((addr & 0xffff0000) >> 16),
+                                         (addr & 0xffff),
+                                         (void *)buf,
+                                         transfer,
+                                         HZ * 5);
+                if (status < 0) {
+                        rsi_dbg(ERR_ZONE,
+                                "Reg write failed with error code :%d\n",
+                                status);
+                } else {
+                        count -= transfer;
+                        data += transfer;
+                        addr += transfer;
+                }
+        }
+
+        kfree(buf);
+        return 0;
+}
+
+/**
+ *rsi_usb_host_intf_write_pkt() - This function writes the packet to the
+ *                                 USB card.
+ * @adapter: Pointer to the adapter structure.
+ * @pkt: Pointer to the data to be written on to the card.
+ * @len: Length of the data to be written on to the card.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+static int rsi_usb_host_intf_write_pkt(struct rsi_hw *adapter,
+                                       u8 *pkt,
+                                       u32 len)
+{
+        u32 queueno = ((pkt[1] >> 4) & 0xf);
+        u8 endpoint;
+
+        endpoint = ((queueno == RSI_WIFI_MGMT_Q) ? MGMT_EP : DATA_EP);
+
+        return rsi_write_multiple(adapter,
+                                  endpoint,
+                                  (u8 *)pkt,
+                                  len);
+}
+
+/**
+ * rsi_deinit_usb_interface() - This function deinitializes the usb interface.
+ * @adapter: Pointer to the adapter structure.
+ *
+ * Return: None.
+ */
+static void rsi_deinit_usb_interface(struct rsi_hw *adapter)
+{
+        struct rsi_91x_usbdev *dev = (struct rsi_91x_usbdev *)adapter->rsi_dev;
+
+        rsi_kill_thread(&dev->rx_thread);
+        kfree(adapter->priv->rx_data_pkt);
+        kfree(dev->tx_buffer);
+}
+
+/**
+ * rsi_init_usb_interface() - This function initializes the usb interface.
+ * @adapter: Pointer to the adapter structure.
+ * @pfunction: Pointer to USB interface structure.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+static int rsi_init_usb_interface(struct rsi_hw *adapter,
+                                  struct usb_interface *pfunction)
+{
+        struct rsi_91x_usbdev *rsi_dev;
+        struct rsi_common *common = adapter->priv;
+        int status;
+
+        rsi_dev = kzalloc(sizeof(*rsi_dev), GFP_KERNEL);
+        if (!rsi_dev)
+                return -ENOMEM;
+
+        adapter->rsi_dev = rsi_dev;
+        rsi_dev->usbdev = interface_to_usbdev(pfunction);
+
+        if (rsi_find_bulk_in_and_out_endpoints(pfunction, adapter))
+                return -EINVAL;
+
+        adapter->device = &pfunction->dev;
+        usb_set_intfdata(pfunction, adapter);
+
+        common->rx_data_pkt = kmalloc(2048, GFP_KERNEL);
+        if (!common->rx_data_pkt) {
+                rsi_dbg(ERR_ZONE, "%s: Failed to allocate memory\n",
+                        __func__);
+                return -ENOMEM;
+        }
+
+        rsi_dev->tx_buffer = kmalloc(2048, GFP_ATOMIC);
+        rsi_dev->rx_usb_urb[0] = usb_alloc_urb(0, GFP_KERNEL);
+        rsi_dev->rx_usb_urb[0]->transfer_buffer = adapter->priv->rx_data_pkt;
+        rsi_dev->tx_blk_size = 252;
+
+        /* Initializing function callbacks */
+        adapter->rx_urb_submit = rsi_rx_urb_submit;
+        adapter->host_intf_write_pkt = rsi_usb_host_intf_write_pkt;
+        adapter->check_hw_queue_status = rsi_usb_check_queue_status;
+        adapter->determine_event_timeout = rsi_usb_event_timeout;
+
+        rsi_init_event(&rsi_dev->rx_thread.event);
+        status = rsi_create_kthread(common, &rsi_dev->rx_thread,
+                                    rsi_usb_rx_thread, "RX-Thread");
+        if (status) {
+                rsi_dbg(ERR_ZONE, "%s: Unable to init rx thrd\n", __func__);
+                goto fail;
+        }
+
+#ifdef CONFIG_RSI_DEBUGFS
+        /* In USB, one less than the MAX_DEBUGFS_ENTRIES entries is required */
+        adapter->num_debugfs_entries = (MAX_DEBUGFS_ENTRIES - 1);
+#endif
+
+        rsi_dbg(INIT_ZONE, "%s: Enabled the interface\n", __func__);
+        return 0;
+
+fail:
+        kfree(rsi_dev->tx_buffer);
+        kfree(common->rx_data_pkt);
+        return status;
+}
+
+/**
+ * rsi_probe() - This function is called by kernel when the driver provided
+ *               Vendor and device IDs are matched. All the initialization
+ *               work is done here.
+ * @pfunction: Pointer to the USB interface structure.
+ * @id: Pointer to the usb_device_id structure.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+static int rsi_probe(struct usb_interface *pfunction,
+                     const struct usb_device_id *id)
+{
+        struct rsi_hw *adapter;
+        struct rsi_91x_usbdev *dev;
+        u16 fw_status;
+
+        rsi_dbg(INIT_ZONE, "%s: Init function called\n", __func__);
+
+        adapter = rsi_91x_init();
+        if (!adapter) {
+                rsi_dbg(ERR_ZONE, "%s: Failed to init os intf ops\n",
+                        __func__);
+                return 1;
+        }
+
+        if (rsi_init_usb_interface(adapter, pfunction)) {
+                rsi_dbg(ERR_ZONE, "%s: Failed to init usb interface\n",
+                        __func__);
+                goto err;
+        }
+
+        rsi_dbg(ERR_ZONE, "%s: Initialized os intf ops\n", __func__);
+
+        dev = (struct rsi_91x_usbdev *)adapter->rsi_dev;
+
+        if (rsi_usb_reg_read(dev->usbdev, FW_STATUS_REG, &fw_status, 2) < 0)
+                goto err1;
+        else
+                fw_status &= 1;
+
+        if (!fw_status) {
+                if (rsi_usb_device_init(adapter->priv)) {
+                        rsi_dbg(ERR_ZONE, "%s: Failed in device init\n",
+                                __func__);
+                        goto err1;
+                }
+
+                if (rsi_usb_reg_write(dev->usbdev,
+                                      USB_INTERNAL_REG_1,
+                                      RSI_USB_READY_MAGIC_NUM, 1) < 0)
+                        goto err1;
+                rsi_dbg(INIT_ZONE, "%s: Performed device init\n", __func__);
+        }
+
+        if (rsi_rx_urb_submit(adapter))
+                goto err1;
+
+        return 0;
+err1:
+        rsi_deinit_usb_interface(adapter);
+err:
+        rsi_91x_deinit(adapter);
+        rsi_dbg(ERR_ZONE, "%s: Failed in probe...Exiting\n", __func__);
+        return 1;
+}
+
+/**
+ * rsi_disconnect() - This function performs the reverse of the probe function,
+ *                    it deintialize the driver structure.
+ * @pfunction: Pointer to the USB interface structure.
+ *
+ * Return: None.
+ */
+static void rsi_disconnect(struct usb_interface *pfunction)
+{
+        struct rsi_hw *adapter = usb_get_intfdata(pfunction);
+
+        if (!adapter)
+                return;
+
+        rsi_mac80211_detach(adapter);
+        rsi_deinit_usb_interface(adapter);
+        rsi_91x_deinit(adapter);
+
+        rsi_dbg(INFO_ZONE, "%s: Deinitialization completed\n", __func__);
+}
+
+#ifdef CONFIG_PM
+static int rsi_suspend(struct usb_interface *intf, pm_message_t message)
+{
+        /* Not yet implemented */
+        return -ENOSYS;
+}
+
+static int rsi_resume(struct usb_interface *intf)
+{
+        /* Not yet implemented */
+        return -ENOSYS;
+}
+#endif
+
+static const struct usb_device_id rsi_dev_table[] = {
+        { USB_DEVICE(0x0303, 0x0100) },
+        { USB_DEVICE(0x041B, 0x0301) },
+        { USB_DEVICE(0x041B, 0x0201) },
+        { USB_DEVICE(0x041B, 0x9330) },
+        { /* Blank */},
+};
+
+static struct usb_driver rsi_driver = {
+        .name       = "RSI-USB WLAN",
+        .probe      = rsi_probe,
+        .disconnect = rsi_disconnect,
+        .id_table   = rsi_dev_table,
+#ifdef CONFIG_PM
+        .suspend    = rsi_suspend,
+        .resume     = rsi_resume,
+#endif
+};
+
+/**
+ * rsi_module_init() - This function registers the client driver.
+ * @void: Void.
+ *
+ * Return: 0 on success.
+ */
+static int rsi_module_init(void)
+{
+        usb_register(&rsi_driver);
+        rsi_dbg(INIT_ZONE, "%s: Registering driver\n", __func__);
+        return 0;
+}
+
+/**
+ * rsi_module_exit() - This function unregisters the client driver.
+ * @void: Void.
+ *
+ * Return: None.
+ */
+static void rsi_module_exit(void)
+{
+        usb_deregister(&rsi_driver);
+        rsi_dbg(INFO_ZONE, "%s: Unregistering driver\n", __func__);
+}
+
+module_init(rsi_module_init);
+module_exit(rsi_module_exit);
+
+MODULE_AUTHOR("Redpine Signals Inc");
+MODULE_DESCRIPTION("Common USB layer for RSI drivers");
+MODULE_SUPPORTED_DEVICE("RSI-91x");
+MODULE_DEVICE_TABLE(usb, rsi_dev_table);
+MODULE_FIRMWARE(FIRMWARE_RSI9113);
+MODULE_VERSION("0.1");
+MODULE_LICENSE("Dual BSD/GPL");
diff --git a/drivers/net/wireless/rsi/rsi_91x_usb_ops.c b/drivers/net/wireless/rsi/rsi_91x_usb_ops.c
new file mode 100644
index 000000000000..1106ce76707e
--- /dev/null
+++ b/drivers/net/wireless/rsi/rsi_91x_usb_ops.c
@@ -0,0 +1,177 @@
+/**
+ * Copyright (c) 2014 Redpine Signals Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ */
+
+#include <linux/firmware.h>
+#include "rsi_usb.h"
+
+/**
+ * rsi_copy_to_card() - This function includes the actual funtionality of
+ *                      copying the TA firmware to the card.Basically this
+ *                      function includes opening the TA file,reading the TA
+ *                      file and writing their values in blocks of data.
+ * @common: Pointer to the driver private structure.
+ * @fw: Pointer to the firmware value to be written.
+ * @len: length of firmware file.
+ * @num_blocks: Number of blocks to be written to the card.
+ *
+ * Return: 0 on success and -1 on failure.
+ */
+static int rsi_copy_to_card(struct rsi_common *common,
+                            const u8 *fw,
+                            u32 len,
+                            u32 num_blocks)
+{
+        struct rsi_hw *adapter = common->priv;
+        struct rsi_91x_usbdev *dev = (struct rsi_91x_usbdev *)adapter->rsi_dev;
+        u32 indx, ii;
+        u32 block_size = dev->tx_blk_size;
+        u32 lsb_address;
+        u32 base_address;
+
+        base_address = TA_LOAD_ADDRESS;
+
+        for (indx = 0, ii = 0; ii < num_blocks; ii++, indx += block_size) {
+                lsb_address = base_address;
+                if (rsi_usb_write_register_multiple(adapter,
+                                                    lsb_address,
+                                                    (u8 *)(fw + indx),
+                                                    block_size)) {
+                        rsi_dbg(ERR_ZONE,
+                                "%s: Unable to load %s blk\n", __func__,
+                                FIRMWARE_RSI9113);
+                        return -EIO;
+                }
+                rsi_dbg(INIT_ZONE, "%s: loading block: %d\n", __func__, ii);
+                base_address += block_size;
+        }
+
+        if (len % block_size) {
+                lsb_address = base_address;
+                if (rsi_usb_write_register_multiple(adapter,
+                                                    lsb_address,
+                                                    (u8 *)(fw + indx),
+                                                    len % block_size)) {
+                        rsi_dbg(ERR_ZONE,
+                                "%s: Unable to load %s blk\n", __func__,
+                                FIRMWARE_RSI9113);
+                        return -EIO;
+                }
+        }
+        rsi_dbg(INIT_ZONE,
+                "%s: Succesfully loaded %s instructions\n", __func__,
+                FIRMWARE_RSI9113);
+
+        rsi_dbg(INIT_ZONE, "%s: loaded firmware\n", __func__);
+        return 0;
+}
+
+/**
+ * rsi_usb_rx_thread() - This is a kernel thread to receive the packets from
+ *                       the USB device.
+ * @common: Pointer to the driver private structure.
+ *
+ * Return: None.
+ */
+void rsi_usb_rx_thread(struct rsi_common *common)
+{
+        struct rsi_hw *adapter = common->priv;
+        struct rsi_91x_usbdev *dev = (struct rsi_91x_usbdev *)adapter->rsi_dev;
+        int status;
+
+        do {
+                rsi_wait_event(&dev->rx_thread.event, EVENT_WAIT_FOREVER);
+
+                if (atomic_read(&dev->rx_thread.thread_done))
+                        goto out;
+
+                mutex_lock(&common->tx_rxlock);
+                status = rsi_read_pkt(common, 0);
+                if (status) {
+                        rsi_dbg(ERR_ZONE, "%s: Failed To read data", __func__);
+                        mutex_unlock(&common->tx_rxlock);
+                        return;
+                }
+                mutex_unlock(&common->tx_rxlock);
+                rsi_reset_event(&dev->rx_thread.event);
+                if (adapter->rx_urb_submit(adapter)) {
+                        rsi_dbg(ERR_ZONE,
+                                "%s: Failed in urb submission", __func__);
+                        return;
+                }
+        } while (1);
+
+out:
+        rsi_dbg(INFO_ZONE, "%s: Terminated thread\n", __func__);
+        complete_and_exit(&dev->rx_thread.completion, 0);
+}
+
+
+/**
+ * rsi_load_ta_instructions() - This function includes the actual funtionality
+ *                              of loading the TA firmware.This function also
+ *                              includes opening the TA file,reading the TA
+ *                              file and writing their value in blocks of data.
+ * @common: Pointer to the driver private structure.
+ *
+ * Return: status: 0 on success, -1 on failure.
+ */
+static int rsi_load_ta_instructions(struct rsi_common *common)
+{
+        struct rsi_hw *adapter = common->priv;
+        struct rsi_91x_usbdev *dev = (struct rsi_91x_usbdev *)adapter->rsi_dev;
+        const struct firmware *fw_entry = NULL;
+        u32 block_size = dev->tx_blk_size;
+        const u8 *fw;
+        u32 num_blocks, len;
+        int status = 0;
+
+        status = request_firmware(&fw_entry, FIRMWARE_RSI9113, adapter->device);
+        if (status < 0) {
+                rsi_dbg(ERR_ZONE, "%s Firmware file %s not found\n",
+                        __func__, FIRMWARE_RSI9113);
+                return status;
+        }
+
+        fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL);
+        len = fw_entry->size;
+
+        if (len % 4)
+                len += (4 - (len % 4));
+
+        num_blocks = (len / block_size);
+
+        rsi_dbg(INIT_ZONE, "%s: Instruction size:%d\n", __func__, len);
+        rsi_dbg(INIT_ZONE, "%s: num blocks: %d\n", __func__, num_blocks);
+
+        status = rsi_copy_to_card(common, fw, len, num_blocks);
+        release_firmware(fw_entry);
+        return status;
+}
+
+/**
+ * rsi_device_init() - This Function Initializes The HAL.
+ * @common: Pointer to the driver private structure.
+ *
+ * Return: 0 on success, -1 on failure.
+ */
+int rsi_usb_device_init(struct rsi_common *common)
+{
+        if (rsi_load_ta_instructions(common))
+                return -EIO;
+
+        return 0;
+                }
diff --git a/drivers/net/wireless/rsi/rsi_boot_params.h b/drivers/net/wireless/rsi/rsi_boot_params.h
new file mode 100644
index 000000000000..5e2721f7909c
--- /dev/null
+++ b/drivers/net/wireless/rsi/rsi_boot_params.h
@@ -0,0 +1,126 @@
+/**
+ * Copyright (c) 2014 Redpine Signals Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef __RSI_BOOTPARAMS_HEADER_H__
+#define __RSI_BOOTPARAMS_HEADER_H__
+
+#define CRYSTAL_GOOD_TIME                BIT(0)
+#define BOOTUP_MODE_INFO                 BIT(1)
+#define WIFI_TAPLL_CONFIGS               BIT(5)
+#define WIFI_PLL960_CONFIGS              BIT(6)
+#define WIFI_AFEPLL_CONFIGS              BIT(7)
+#define WIFI_SWITCH_CLK_CONFIGS          BIT(8)
+
+#define TA_PLL_M_VAL_20                  8
+#define TA_PLL_N_VAL_20                  1
+#define TA_PLL_P_VAL_20                  4
+
+#define PLL960_M_VAL_20                  0x14
+#define PLL960_N_VAL_20                  0
+#define PLL960_P_VAL_20                  5
+
+#define UMAC_CLK_40MHZ                   40
+
+#define TA_PLL_M_VAL_40                  46
+#define TA_PLL_N_VAL_40                  3
+#define TA_PLL_P_VAL_40                  3
+
+#define PLL960_M_VAL_40                  0x14
+#define PLL960_N_VAL_40                  0
+#define PLL960_P_VAL_40                  5
+
+#define UMAC_CLK_20BW \
+        (((TA_PLL_M_VAL_20 + 1) * 40) / \
+         ((TA_PLL_N_VAL_20 + 1) * (TA_PLL_P_VAL_20 + 1)))
+#define VALID_20 \
+        (WIFI_PLL960_CONFIGS | WIFI_AFEPLL_CONFIGS | WIFI_SWITCH_CLK_CONFIGS)
+#define UMAC_CLK_40BW   \
+        (((TA_PLL_M_VAL_40 + 1) * 40) / \
+         ((TA_PLL_N_VAL_40 + 1) * (TA_PLL_P_VAL_40 + 1)))
+#define VALID_40 \
+        (WIFI_PLL960_CONFIGS | WIFI_AFEPLL_CONFIGS | WIFI_SWITCH_CLK_CONFIGS | \
+         WIFI_TAPLL_CONFIGS | CRYSTAL_GOOD_TIME | BOOTUP_MODE_INFO)
+
+/* structure to store configs related to TAPLL programming */
+struct tapll_info {
+        __le16 pll_reg_1;
+        __le16 pll_reg_2;
+} __packed;
+
+/* structure to store configs related to PLL960 programming */
+struct pll960_info {
+        __le16 pll_reg_1;
+        __le16 pll_reg_2;
+        __le16 pll_reg_3;
+} __packed;
+
+/* structure to store configs related to AFEPLL programming */
+struct afepll_info {
+        __le16 pll_reg;
+} __packed;
+
+/* structure to store configs related to pll configs */
+struct pll_config {
+        struct tapll_info tapll_info_g;
+        struct pll960_info pll960_info_g;
+        struct afepll_info afepll_info_g;
+} __packed;
+
+/* structure to store configs related to UMAC clk programming */
+struct switch_clk {
+        __le16 switch_clk_info;
+        /* If switch_bbp_lmac_clk_reg is set then this value will be programmed
+         * into reg
+         */
+        __le16 bbp_lmac_clk_reg_val;
+        /* if switch_umac_clk is set then this value will be programmed */
+        __le16 umac_clock_reg_config;
+        /* if switch_qspi_clk is set then this value will be programmed */
+        __le16 qspi_uart_clock_reg_config;
+} __packed;
+
+struct device_clk_info {
+        struct pll_config pll_config_g;
+        struct switch_clk switch_clk_g;
+} __packed;
+
+struct bootup_params {
+        __le16 magic_number;
+        __le16 crystal_good_time;
+        __le32 valid;
+        __le32 reserved_for_valids;
+        __le16 bootup_mode_info;
+        /* configuration used for digital loop back */
+        __le16 digital_loop_back_params;
+        __le16 rtls_timestamp_en;
+        __le16 host_spi_intr_cfg;
+        struct device_clk_info device_clk_info[3];
+        /* ulp buckboost wait time  */
+        __le32 buckboost_wakeup_cnt;
+        /* pmu wakeup wait time & WDT EN info */
+        __le16 pmu_wakeup_wait;
+        u8 shutdown_wait_time;
+        /* Sleep clock source selection */
+        u8 pmu_slp_clkout_sel;
+        /* WDT programming values */
+        __le32 wdt_prog_value;
+        /* WDT soc reset delay */
+        __le32 wdt_soc_rst_delay;
+        /* dcdc modes configs */
+        __le32 dcdc_operation_mode;
+        __le32 soc_reset_wait_cnt;
+} __packed;
+#endif
diff --git a/drivers/net/wireless/rsi/rsi_common.h b/drivers/net/wireless/rsi/rsi_common.h
new file mode 100644
index 000000000000..f2f70784d4ad
--- /dev/null
+++ b/drivers/net/wireless/rsi/rsi_common.h
@@ -0,0 +1,87 @@
+/**
+ * Copyright (c) 2014 Redpine Signals Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef __RSI_COMMON_H__
+#define __RSI_COMMON_H__
+
+#include <linux/kthread.h>
+
+#define EVENT_WAIT_FOREVER              0
+#define TA_LOAD_ADDRESS                 0x00
+#define FIRMWARE_RSI9113                "rsi_91x.fw"
+#define QUEUE_NOT_FULL                  1
+#define QUEUE_FULL                      0
+
+static inline int rsi_init_event(struct rsi_event *pevent)
+{
+        atomic_set(&pevent->event_condition, 1);
+        init_waitqueue_head(&pevent->event_queue);
+        return 0;
+}
+
+static inline int rsi_wait_event(struct rsi_event *event, u32 timeout)
+{
+        int status = 0;
+
+        if (!timeout)
+                status = wait_event_interruptible(event->event_queue,
+                                (atomic_read(&event->event_condition) == 0));
+        else
+                status = wait_event_interruptible_timeout(event->event_queue,
+                                (atomic_read(&event->event_condition) == 0),
+                                timeout);
+        return status;
+}
+
+static inline void rsi_set_event(struct rsi_event *event)
+{
+        atomic_set(&event->event_condition, 0);
+        wake_up_interruptible(&event->event_queue);
+}
+
+static inline void rsi_reset_event(struct rsi_event *event)
+{
+        atomic_set(&event->event_condition, 1);
+}
+
+static inline int rsi_create_kthread(struct rsi_common *common,
+                                     struct rsi_thread *thread,
+                                     void *func_ptr,
+                                     u8 *name)
+{
+        init_completion(&thread->completion);
+        thread->task = kthread_run(func_ptr, common, name);
+        if (IS_ERR(thread->task))
+                return (int)PTR_ERR(thread->task);
+
+        return 0;
+}
+
+static inline int rsi_kill_thread(struct rsi_thread *handle)
+{
+        atomic_inc(&handle->thread_done);
+        rsi_set_event(&handle->event);
+
+        wait_for_completion(&handle->completion);
+        return kthread_stop(handle->task);
+}
+
+void rsi_mac80211_detach(struct rsi_hw *hw);
+u16 rsi_get_connected_channel(struct rsi_hw *adapter);
+struct rsi_hw *rsi_91x_init(void);
+void rsi_91x_deinit(struct rsi_hw *adapter);
+int rsi_read_pkt(struct rsi_common *common, s32 rcv_pkt_len);
+#endif
diff --git a/drivers/net/wireless/rsi/rsi_debugfs.h b/drivers/net/wireless/rsi/rsi_debugfs.h
new file mode 100644
index 000000000000..580ad3b3f710
--- /dev/null
+++ b/drivers/net/wireless/rsi/rsi_debugfs.h
@@ -0,0 +1,48 @@
+/**
+ * Copyright (c) 2014 Redpine Signals Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef __RSI_DEBUGFS_H__
+#define __RSI_DEBUGFS_H__
+
+#include "rsi_main.h"
+#include <linux/debugfs.h>
+
+#ifndef CONFIG_RSI_DEBUGFS
+static inline int rsi_init_dbgfs(struct rsi_hw *adapter)
+{
+        return 0;
+}
+
+static inline void rsi_remove_dbgfs(struct rsi_hw *adapter)
+{
+        return;
+}
+#else
+struct rsi_dbg_files {
+        const char *name;
+        umode_t perms;
+        const struct file_operations fops;
+};
+
+struct rsi_debugfs {
+        struct dentry *subdir;
+        struct rsi_dbg_ops *dfs_get_ops;
+        struct dentry *rsi_files[MAX_DEBUGFS_ENTRIES];
+};
+int rsi_init_dbgfs(struct rsi_hw *adapter);
+void rsi_remove_dbgfs(struct rsi_hw *adapter);
+#endif
+#endif
diff --git a/drivers/net/wireless/rsi/rsi_main.h b/drivers/net/wireless/rsi/rsi_main.h
new file mode 100644
index 000000000000..2cb73e7edb98
--- /dev/null
+++ b/drivers/net/wireless/rsi/rsi_main.h
@@ -0,0 +1,218 @@
+/**
+ * Copyright (c) 2014 Redpine Signals Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef __RSI_MAIN_H__
+#define __RSI_MAIN_H__
+
+#include <linux/string.h>
+#include <linux/skbuff.h>
+#include <net/mac80211.h>
+
+#define ERR_ZONE                        BIT(0)  /* For Error Msgs             */
+#define INFO_ZONE                       BIT(1)  /* For General Status Msgs    */
+#define INIT_ZONE                       BIT(2)  /* For Driver Init Seq Msgs   */
+#define MGMT_TX_ZONE                    BIT(3)  /* For TX Mgmt Path Msgs      */
+#define MGMT_RX_ZONE                    BIT(4)  /* For RX Mgmt Path Msgs      */
+#define DATA_TX_ZONE                    BIT(5)  /* For TX Data Path Msgs      */
+#define DATA_RX_ZONE                    BIT(6)  /* For RX Data Path Msgs      */
+#define FSM_ZONE                        BIT(7)  /* For State Machine Msgs     */
+#define ISR_ZONE                        BIT(8)  /* For Interrupt Msgs         */
+
+#define FSM_CARD_NOT_READY              0
+#define FSM_BOOT_PARAMS_SENT            1
+#define FSM_EEPROM_READ_MAC_ADDR        2
+#define FSM_RESET_MAC_SENT              3
+#define FSM_RADIO_CAPS_SENT             4
+#define FSM_BB_RF_PROG_SENT             5
+#define FSM_MAC_INIT_DONE               6
+
+extern u32 rsi_zone_enabled;
+extern __printf(2, 3) void rsi_dbg(u32 zone, const char *fmt, ...);
+
+#define RSI_MAX_VIFS                    1
+#define NUM_EDCA_QUEUES                 4
+#define IEEE80211_ADDR_LEN              6
+#define FRAME_DESC_SZ                   16
+#define MIN_802_11_HDR_LEN              24
+
+#define DATA_QUEUE_WATER_MARK           400
+#define MIN_DATA_QUEUE_WATER_MARK       300
+#define MULTICAST_WATER_MARK            200
+#define MAC_80211_HDR_FRAME_CONTROL     0
+#define WME_NUM_AC                      4
+#define NUM_SOFT_QUEUES                 5
+#define MAX_HW_QUEUES                   8
+#define INVALID_QUEUE                   0xff
+#define MAX_CONTINUOUS_VO_PKTS          8
+#define MAX_CONTINUOUS_VI_PKTS          4
+
+/* Queue information */
+#define RSI_WIFI_MGMT_Q                 0x4
+#define RSI_WIFI_DATA_Q                 0x5
+#define IEEE80211_MGMT_FRAME            0x00
+#define IEEE80211_CTL_FRAME             0x04
+
+#define IEEE80211_QOS_TID               0x0f
+#define IEEE80211_NONQOS_TID            16
+
+#define MAX_DEBUGFS_ENTRIES             4
+
+#define TID_TO_WME_AC(_tid) (      \
+        ((_tid) == 0 || (_tid) == 3) ? BE_Q : \
+        ((_tid) < 3) ? BK_Q : \
+        ((_tid) < 6) ? VI_Q : \
+        VO_Q)
+
+#define WME_AC(_q) (    \
+        ((_q) == BK_Q) ? IEEE80211_AC_BK : \
+        ((_q) == BE_Q) ? IEEE80211_AC_BE : \
+        ((_q) == VI_Q) ? IEEE80211_AC_VI : \
+        IEEE80211_AC_VO)
+
+struct version_info {
+        u16 major;
+        u16 minor;
+        u16 release_num;
+        u16 patch_num;
+} __packed;
+
+struct skb_info {
+        s8 rssi;
+        u32 flags;
+        u16 channel;
+        s8 tid;
+        s8 sta_id;
+};
+
+enum edca_queue {
+        BK_Q,
+        BE_Q,
+        VI_Q,
+        VO_Q,
+        MGMT_SOFT_Q
+};
+
+struct security_info {
+        bool security_enable;
+        u32 ptk_cipher;
+        u32 gtk_cipher;
+};
+
+struct wmm_qinfo {
+        s32 weight;
+        s32 wme_params;
+        s32 pkt_contended;
+};
+
+struct transmit_q_stats {
+        u32 total_tx_pkt_send[NUM_EDCA_QUEUES + 1];
+        u32 total_tx_pkt_freed[NUM_EDCA_QUEUES + 1];
+};
+
+struct vif_priv {
+        bool is_ht;
+        bool sgi;
+        u16 seq_start;
+};
+
+struct rsi_event {
+        atomic_t event_condition;
+        wait_queue_head_t event_queue;
+};
+
+struct rsi_thread {
+        void (*thread_function)(void *);
+        struct completion completion;
+        struct task_struct *task;
+        struct rsi_event event;
+        atomic_t thread_done;
+};
+
+struct rsi_hw;
+
+struct rsi_common {
+        struct rsi_hw *priv;
+        struct vif_priv vif_info[RSI_MAX_VIFS];
+
+        bool mgmt_q_block;
+        struct version_info driver_ver;
+        struct version_info fw_ver;
+
+        struct rsi_thread tx_thread;
+        struct sk_buff_head tx_queue[NUM_EDCA_QUEUES + 1];
+        /* Mutex declaration */
+        struct mutex mutex;
+        /* Mutex used between tx/rx threads */
+        struct mutex tx_rxlock;
+        u8 endpoint;
+
+        /* Channel/band related */
+        u8 band;
+        u8 channel_width;
+
+        u16 rts_threshold;
+        u16 bitrate_mask[2];
+        u32 fixedrate_mask[2];
+
+        u8 rf_reset;
+        struct transmit_q_stats tx_stats;
+        struct security_info secinfo;
+        struct wmm_qinfo tx_qinfo[NUM_EDCA_QUEUES];
+        struct ieee80211_tx_queue_params edca_params[NUM_EDCA_QUEUES];
+        u8 mac_addr[IEEE80211_ADDR_LEN];
+
+        /* state related */
+        u32 fsm_state;
+        bool init_done;
+        u8 bb_rf_prog_count;
+        bool iface_down;
+
+        /* Generic */
+        u8 channel;
+        u8 *rx_data_pkt;
+        u8 mac_id;
+        u8 radio_id;
+        u16 rate_pwr[20];
+        u16 min_rate;
+
+        /* WMM algo related */
+        u8 selected_qnum;
+        u32 pkt_cnt;
+        u8 min_weight;
+};
+
+struct rsi_hw {
+        struct rsi_common *priv;
+        struct ieee80211_hw *hw;
+        struct ieee80211_vif *vifs[RSI_MAX_VIFS];
+        struct ieee80211_tx_queue_params edca_params[NUM_EDCA_QUEUES];
+        struct ieee80211_supported_band sbands[IEEE80211_NUM_BANDS];
+
+        struct device *device;
+        u8 sc_nvifs;
+
+#ifdef CONFIG_RSI_DEBUGFS
+        struct rsi_debugfs *dfsentry;
+        u8 num_debugfs_entries;
+#endif
+        void *rsi_dev;
+        int (*host_intf_read_pkt)(struct rsi_hw *adapter, u8 *pkt, u32 len);
+        int (*host_intf_write_pkt)(struct rsi_hw *adapter, u8 *pkt, u32 len);
+        int (*check_hw_queue_status)(struct rsi_hw *adapter, u8 q_num);
+        int (*rx_urb_submit)(struct rsi_hw *adapter);
+        int (*determine_event_timeout)(struct rsi_hw *adapter);
+};
+#endif
diff --git a/drivers/net/wireless/rsi/rsi_mgmt.h b/drivers/net/wireless/rsi/rsi_mgmt.h
new file mode 100644
index 000000000000..ac67c4ad63c2
--- /dev/null
+++ b/drivers/net/wireless/rsi/rsi_mgmt.h
@@ -0,0 +1,285 @@
+/**
+ * Copyright (c) 2014 Redpine Signals Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef __RSI_MGMT_H__
+#define __RSI_MGMT_H__
+
+#include <linux/sort.h>
+#include "rsi_boot_params.h"
+#include "rsi_main.h"
+
+#define MAX_MGMT_PKT_SIZE               512
+#define RSI_NEEDED_HEADROOM             80
+#define RSI_RCV_BUFFER_LEN              2000
+
+#define RSI_11B_MODE                    0
+#define RSI_11G_MODE                    BIT(7)
+#define RETRY_COUNT                     8
+#define RETRY_LONG                      4
+#define RETRY_SHORT                     7
+#define WMM_SHORT_SLOT_TIME             9
+#define SIFS_DURATION                   16
+
+#define KEY_TYPE_CLEAR                  0
+#define RSI_PAIRWISE_KEY                1
+#define RSI_GROUP_KEY                   2
+
+/* EPPROM_READ_ADDRESS */
+#define WLAN_MAC_EEPROM_ADDR            40
+#define WLAN_MAC_MAGIC_WORD_LEN         0x01
+#define WLAN_HOST_MODE_LEN              0x04
+#define WLAN_FW_VERSION_LEN             0x08
+#define MAGIC_WORD                      0x5A
+
+/* Receive Frame Types */
+#define TA_CONFIRM_TYPE                 0x01
+#define RX_DOT11_MGMT                   0x02
+#define TX_STATUS_IND                   0x04
+#define PROBEREQ_CONFIRM                2
+#define CARD_READY_IND                  0x00
+
+#define RSI_DELETE_PEER                 0x0
+#define RSI_ADD_PEER                    0x1
+#define START_AMPDU_AGGR                0x1
+#define STOP_AMPDU_AGGR                 0x0
+#define INTERNAL_MGMT_PKT               0x99
+
+#define PUT_BBP_RESET                   0
+#define BBP_REG_WRITE                   0
+#define RF_RESET_ENABLE                 BIT(3)
+#define RATE_INFO_ENABLE                BIT(0)
+#define RSI_BROADCAST_PKT               BIT(9)
+
+#define UPPER_20_ENABLE                 (0x2 << 12)
+#define LOWER_20_ENABLE                 (0x4 << 12)
+#define FULL40M_ENABLE                  0x6
+
+#define RSI_LMAC_CLOCK_80MHZ            0x1
+#define RSI_ENABLE_40MHZ                (0x1 << 3)
+
+#define RX_BA_INDICATION                1
+#define RSI_TBL_SZ                      40
+#define MAX_RETRIES                     8
+
+#define STD_RATE_MCS7                   0x07
+#define STD_RATE_MCS6                   0x06
+#define STD_RATE_MCS5                   0x05
+#define STD_RATE_MCS4                   0x04
+#define STD_RATE_MCS3                   0x03
+#define STD_RATE_MCS2                   0x02
+#define STD_RATE_MCS1                   0x01
+#define STD_RATE_MCS0                   0x00
+#define STD_RATE_54                     0x6c
+#define STD_RATE_48                     0x60
+#define STD_RATE_36                     0x48
+#define STD_RATE_24                     0x30
+#define STD_RATE_18                     0x24
+#define STD_RATE_12                     0x18
+#define STD_RATE_11                     0x16
+#define STD_RATE_09                     0x12
+#define STD_RATE_06                     0x0C
+#define STD_RATE_5_5                    0x0B
+#define STD_RATE_02                     0x04
+#define STD_RATE_01                     0x02
+
+#define RSI_RF_TYPE                     1
+#define RSI_RATE_00                     0x00
+#define RSI_RATE_1                      0x0
+#define RSI_RATE_2                      0x2
+#define RSI_RATE_5_5                    0x4
+#define RSI_RATE_11                     0x6
+#define RSI_RATE_6                      0x8b
+#define RSI_RATE_9                      0x8f
+#define RSI_RATE_12                     0x8a
+#define RSI_RATE_18                     0x8e
+#define RSI_RATE_24                     0x89
+#define RSI_RATE_36                     0x8d
+#define RSI_RATE_48                     0x88
+#define RSI_RATE_54                     0x8c
+#define RSI_RATE_MCS0                   0x100
+#define RSI_RATE_MCS1                   0x101
+#define RSI_RATE_MCS2                   0x102
+#define RSI_RATE_MCS3                   0x103
+#define RSI_RATE_MCS4                   0x104
+#define RSI_RATE_MCS5                   0x105
+#define RSI_RATE_MCS6                   0x106
+#define RSI_RATE_MCS7                   0x107
+#define RSI_RATE_MCS7_SG                0x307
+
+#define BW_20MHZ                        0
+#define BW_40MHZ                        1
+
+#define RSI_SUPP_FILTERS        (FIF_ALLMULTI | FIF_PROBE_REQ |\
+                                 FIF_BCN_PRBRESP_PROMISC)
+enum opmode {
+        STA_OPMODE = 1,
+        AP_OPMODE = 2
+};
+
+extern struct ieee80211_rate rsi_rates[12];
+extern const u16 rsi_mcsrates[8];
+
+enum sta_notify_events {
+        STA_CONNECTED = 0,
+        STA_DISCONNECTED,
+        STA_TX_ADDBA_DONE,
+        STA_TX_DELBA,
+        STA_RX_ADDBA_DONE,
+        STA_RX_DELBA
+};
+
+/* Send Frames Types */
+enum cmd_frame_type {
+        TX_DOT11_MGMT,
+        RESET_MAC_REQ,
+        RADIO_CAPABILITIES,
+        BB_PROG_VALUES_REQUEST,
+        RF_PROG_VALUES_REQUEST,
+        WAKEUP_SLEEP_REQUEST,
+        SCAN_REQUEST,
+        TSF_UPDATE,
+        PEER_NOTIFY,
+        BLOCK_UNBLOCK,
+        SET_KEY_REQ,
+        AUTO_RATE_IND,
+        BOOTUP_PARAMS_REQUEST,
+        VAP_CAPABILITIES,
+        EEPROM_READ_TYPE ,
+        EEPROM_WRITE,
+        GPIO_PIN_CONFIG ,
+        SET_RX_FILTER,
+        AMPDU_IND,
+        STATS_REQUEST_FRAME,
+        BB_BUF_PROG_VALUES_REQ,
+        BBP_PROG_IN_TA,
+        BG_SCAN_PARAMS,
+        BG_SCAN_PROBE_REQ,
+        CW_MODE_REQ,
+        PER_CMD_PKT
+};
+
+struct rsi_mac_frame {
+        __le16 desc_word[8];
+} __packed;
+
+struct rsi_boot_params {
+        __le16 desc_word[8];
+        struct bootup_params bootup_params;
+} __packed;
+
+struct rsi_peer_notify {
+        __le16 desc_word[8];
+        u8 mac_addr[6];
+        __le16 command;
+        __le16 mpdu_density;
+        __le16 reserved;
+        __le32 sta_flags;
+} __packed;
+
+struct rsi_vap_caps {
+        __le16 desc_word[8];
+        u8 mac_addr[6];
+        __le16 keep_alive_period;
+        u8 bssid[6];
+        __le16 reserved;
+        __le32 flags;
+        __le16 frag_threshold;
+        __le16 rts_threshold;
+        __le32 default_mgmt_rate;
+        __le32 default_ctrl_rate;
+        __le32 default_data_rate;
+        __le16 beacon_interval;
+        __le16 dtim_period;
+} __packed;
+
+struct rsi_set_key {
+        __le16 desc_word[8];
+        u8 key[4][32];
+        u8 tx_mic_key[8];
+        u8 rx_mic_key[8];
+} __packed;
+
+struct rsi_auto_rate {
+        __le16 desc_word[8];
+        __le16 failure_limit;
+        __le16 initial_boundary;
+        __le16 max_threshold_limt;
+        __le16 num_supported_rates;
+        __le16 aarf_rssi;
+        __le16 moderate_rate_inx;
+        __le16 collision_tolerance;
+        __le16 supported_rates[40];
+} __packed;
+
+struct qos_params {
+        __le16 cont_win_min_q;
+        __le16 cont_win_max_q;
+        __le16 aifsn_val_q;
+        __le16 txop_q;
+} __packed;
+
+struct rsi_radio_caps {
+        __le16 desc_word[8];
+        struct qos_params qos_params[MAX_HW_QUEUES];
+        u8 num_11n_rates;
+        u8 num_11ac_rates;
+        __le16 gcpd_per_rate[20];
+} __packed;
+
+static inline u32 rsi_get_queueno(u8 *addr, u16 offset)
+{
+        return (le16_to_cpu(*(__le16 *)&addr[offset]) & 0x7000) >> 12;
+}
+
+static inline u32 rsi_get_length(u8 *addr, u16 offset)
+{
+        return (le16_to_cpu(*(__le16 *)&addr[offset])) & 0x0fff;
+}
+
+static inline u8 rsi_get_extended_desc(u8 *addr, u16 offset)
+{
+        return le16_to_cpu(*((__le16 *)&addr[offset + 4])) & 0x00ff;
+}
+
+static inline u8 rsi_get_rssi(u8 *addr)
+{
+        return *(u8 *)(addr + FRAME_DESC_SZ);
+}
+
+static inline u8 rsi_get_channel(u8 *addr)
+{
+        return *(char *)(addr + 15);
+}
+
+int rsi_mgmt_pkt_recv(struct rsi_common *common, u8 *msg);
+int rsi_set_vap_capabilities(struct rsi_common *common, enum opmode mode);
+int rsi_send_aggregation_params_frame(struct rsi_common *common, u16 tid,
+                                      u16 ssn, u8 buf_size, u8 event);
+int rsi_hal_load_key(struct rsi_common *common, u8 *data, u16 key_len,
+                     u8 key_type, u8 key_id, u32 cipher);
+int rsi_set_channel(struct rsi_common *common, u16 chno);
+void rsi_inform_bss_status(struct rsi_common *common, u8 status,
+                           const u8 *bssid, u8 qos_enable, u16 aid);
+void rsi_indicate_pkt_to_os(struct rsi_common *common, struct sk_buff *skb);
+int rsi_mac80211_attach(struct rsi_common *common);
+void rsi_indicate_tx_status(struct rsi_hw *common, struct sk_buff *skb,
+                            int status);
+bool rsi_is_cipher_wep(struct rsi_common *common);
+void rsi_core_qos_processor(struct rsi_common *common);
+void rsi_core_xmit(struct rsi_common *common, struct sk_buff *skb);
+int rsi_send_mgmt_pkt(struct rsi_common *common, struct sk_buff *skb);
+int rsi_send_data_pkt(struct rsi_common *common, struct sk_buff *skb);
+#endif
diff --git a/drivers/net/wireless/rsi/rsi_sdio.h b/drivers/net/wireless/rsi/rsi_sdio.h
new file mode 100644
index 000000000000..df4b5e20e05f
--- /dev/null
+++ b/drivers/net/wireless/rsi/rsi_sdio.h
@@ -0,0 +1,129 @@
+/**
+ * @section LICENSE
+ * Copyright (c) 2014 Redpine Signals Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ */
+
+#ifndef __RSI_SDIO_INTF__
+#define __RSI_SDIO_INTF__
+
+#include <linux/mmc/card.h>
+#include <linux/mmc/mmc.h>
+#include <linux/mmc/host.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/mmc/sdio.h>
+#include <linux/mmc/sd.h>
+#include <linux/mmc/sdio_ids.h>
+#include "rsi_main.h"
+
+enum sdio_interrupt_type {
+        BUFFER_FULL         = 0x0,
+        BUFFER_AVAILABLE    = 0x1,
+        FIRMWARE_ASSERT_IND = 0x3,
+        MSDU_PACKET_PENDING = 0x4,
+        UNKNOWN_INT         = 0XE
+};
+
+/* Buffer status register related info */
+#define PKT_BUFF_SEMI_FULL                      0
+#define PKT_BUFF_FULL                           1
+#define PKT_MGMT_BUFF_FULL                      2
+#define MSDU_PKT_PENDING                        3
+/* Interrupt Bit Related Macros */
+#define PKT_BUFF_AVAILABLE                      0
+#define FW_ASSERT_IND                           2
+
+#define RSI_DEVICE_BUFFER_STATUS_REGISTER       0xf3
+#define RSI_FN1_INT_REGISTER                    0xf9
+#define RSI_SD_REQUEST_MASTER                   0x10000
+
+/* FOR SD CARD ONLY */
+#define SDIO_RX_NUM_BLOCKS_REG                  0x000F1
+#define SDIO_FW_STATUS_REG                      0x000F2
+#define SDIO_NXT_RD_DELAY2                      0x000F5
+#define SDIO_MASTER_ACCESS_MSBYTE               0x000FA
+#define SDIO_MASTER_ACCESS_LSBYTE               0x000FB
+#define SDIO_READ_START_LVL                     0x000FC
+#define SDIO_READ_FIFO_CTL                      0x000FD
+#define SDIO_WRITE_FIFO_CTL                     0x000FE
+#define SDIO_FUN1_INTR_CLR_REG                  0x0008
+#define SDIO_REG_HIGH_SPEED                     0x0013
+
+#define RSI_GET_SDIO_INTERRUPT_TYPE(_I, TYPE)      \
+        {                                          \
+                TYPE =                             \
+                (_I & (1 << PKT_BUFF_AVAILABLE)) ? \
+                BUFFER_AVAILABLE :                 \
+                (_I & (1 << MSDU_PKT_PENDING)) ?   \
+                MSDU_PACKET_PENDING :              \
+                (_I & (1 << FW_ASSERT_IND)) ?      \
+                FIRMWARE_ASSERT_IND : UNKNOWN_INT; \
+        }
+
+/* common registers in SDIO function1 */
+#define TA_SOFT_RESET_REG            0x0004
+#define TA_TH0_PC_REG                0x0400
+#define TA_HOLD_THREAD_REG           0x0844
+#define TA_RELEASE_THREAD_REG        0x0848
+
+#define TA_SOFT_RST_CLR              0
+#define TA_SOFT_RST_SET              BIT(0)
+#define TA_PC_ZERO                   0
+#define TA_HOLD_THREAD_VALUE         cpu_to_le32(0xF)
+#define TA_RELEASE_THREAD_VALUE      cpu_to_le32(0xF)
+#define TA_BASE_ADDR                 0x2200
+#define MISC_CFG_BASE_ADDR           0x4150
+
+struct receive_info {
+        bool buffer_full;
+        bool semi_buffer_full;
+        bool mgmt_buffer_full;
+        u32 mgmt_buf_full_counter;
+        u32 buf_semi_full_counter;
+        u8 watch_bufferfull_count;
+        u32 sdio_intr_status_zero;
+        u32 sdio_int_counter;
+        u32 total_sdio_msdu_pending_intr;
+        u32 total_sdio_unknown_intr;
+        u32 buf_full_counter;
+        u32 buf_avilable_counter;
+};
+
+struct rsi_91x_sdiodev {
+        struct sdio_func *pfunction;
+        struct task_struct *in_sdio_litefi_irq;
+        struct receive_info rx_info;
+        u32 next_read_delay;
+        u32 sdio_high_speed_enable;
+        u8 sdio_clock_speed;
+        u32 cardcapability;
+        u8 prev_desc[16];
+        u32 tx_blk_size;
+        u8 write_fail;
+};
+
+void rsi_interrupt_handler(struct rsi_hw *adapter);
+int rsi_init_sdio_slave_regs(struct rsi_hw *adapter);
+int rsi_sdio_device_init(struct rsi_common *common);
+int rsi_sdio_read_register(struct rsi_hw *adapter, u32 addr, u8 *data);
+int rsi_sdio_host_intf_read_pkt(struct rsi_hw *adapter, u8 *pkt, u32 length);
+int rsi_sdio_write_register(struct rsi_hw *adapter, u8 function,
+                            u32 addr, u8 *data);
+int rsi_sdio_write_register_multiple(struct rsi_hw *adapter, u32 addr,
+                                     u8 *data, u32 count);
+void rsi_sdio_ack_intr(struct rsi_hw *adapter, u8 int_bit);
+int rsi_sdio_determine_event_timeout(struct rsi_hw *adapter);
+int rsi_sdio_read_buffer_status_register(struct rsi_hw *adapter, u8 q_num);
+#endif
diff --git a/drivers/net/wireless/rsi/rsi_usb.h b/drivers/net/wireless/rsi/rsi_usb.h
new file mode 100644
index 000000000000..ebea0c411ead
--- /dev/null
+++ b/drivers/net/wireless/rsi/rsi_usb.h
@@ -0,0 +1,68 @@
+/**
+ * @section LICENSE
+ * Copyright (c) 2014 Redpine Signals Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef __RSI_USB_INTF__
+#define __RSI_USB_INTF__
+
+#include <linux/usb.h>
+#include "rsi_main.h"
+#include "rsi_common.h"
+
+#define USB_INTERNAL_REG_1           0x25000
+#define RSI_USB_READY_MAGIC_NUM      0xab
+#define FW_STATUS_REG                0x41050012
+
+#define USB_VENDOR_REGISTER_READ     0x15
+#define USB_VENDOR_REGISTER_WRITE    0x16
+#define RSI_USB_TX_HEAD_ROOM         128
+
+#define MAX_RX_URBS                  1
+#define MAX_BULK_EP                  8
+#define MGMT_EP                      1
+#define DATA_EP                      2
+
+struct rsi_91x_usbdev {
+        struct rsi_thread rx_thread;
+        u8 endpoint;
+        struct usb_device *usbdev;
+        struct usb_interface *pfunction;
+        struct urb *rx_usb_urb[MAX_RX_URBS];
+        u8 *tx_buffer;
+        __le16 bulkin_size;
+        u8 bulkin_endpoint_addr;
+        __le16 bulkout_size[MAX_BULK_EP];
+        u8 bulkout_endpoint_addr[MAX_BULK_EP];
+        u32 tx_blk_size;
+        u8 write_fail;
+};
+
+static inline int rsi_usb_check_queue_status(struct rsi_hw *adapter, u8 q_num)
+{
+        /* In USB, there isn't any need to check the queue status */
+        return QUEUE_NOT_FULL;
+}
+
+static inline int rsi_usb_event_timeout(struct rsi_hw *adapter)
+{
+        return EVENT_WAIT_FOREVER;
+}
+
+int rsi_usb_device_init(struct rsi_common *common);
+int rsi_usb_write_register_multiple(struct rsi_hw *adapter, u32 addr,
+                                    u8 *data, u32 count);
+void rsi_usb_rx_thread(struct rsi_common *common);
+#endif
diff --git a/drivers/net/wireless/rtl818x/rtl8180/dev.c b/drivers/net/wireless/rtl818x/rtl8180/dev.c
index 959e699702e8..0b405b8c8d70 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8180/dev.c
@@ -148,7 +148,8 @@ static void rtl8180_handle_rx(struct ieee80211_hw *dev)
                         rx_status.antenna = (flags2 >> 15) & 1;
                         rx_status.rate_idx = (flags >> 20) & 0xF;
                         agc = (flags2 >> 17) & 0x7F;
-                        if (priv->r8185) {
+
+                        if (priv->chip_family == RTL818X_CHIP_FAMILY_RTL8185) {
                                 if (rx_status.rate_idx > 3)
                                         signal = 90 - clamp_t(u8, agc, 25, 90);
                                 else
@@ -288,7 +289,7 @@ static void rtl8180_tx(struct ieee80211_hw *dev,
                    (ieee80211_get_tx_rate(dev, info)->hw_value << 24) |
                    skb->len;
 
-        if (priv->r8185)
+        if (priv->chip_family != RTL818X_CHIP_FAMILY_RTL8180)
                 tx_flags |= RTL818X_TX_DESC_FLAG_DMA |
                             RTL818X_TX_DESC_FLAG_NO_ENC;
 
@@ -305,7 +306,7 @@ static void rtl8180_tx(struct ieee80211_hw *dev,
                 rts_duration = ieee80211_rts_duration(dev, priv->vif, skb->len,
                                                       info);
 
-        if (!priv->r8185) {
+        if (priv->chip_family == RTL818X_CHIP_FAMILY_RTL8180) {
                 unsigned int remainder;
 
                 plcp_len = DIV_ROUND_UP(16 * (skb->len + 4),
@@ -370,6 +371,36 @@ void rtl8180_set_anaparam(struct rtl8180_priv *priv, u32 anaparam)
         rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_NORMAL);
 }
 
+static void rtl8180_conf_basic_rates(struct ieee80211_hw *dev,
+                            u32 rates_mask)
+{
+        struct rtl8180_priv *priv = dev->priv;
+
+        u8 max, min;
+        u16 reg;
+
+        max = fls(rates_mask) - 1;
+        min = ffs(rates_mask) - 1;
+
+        switch (priv->chip_family) {
+
+        case RTL818X_CHIP_FAMILY_RTL8180:
+                /* in 8180 this is NOT a BITMAP */
+                reg = rtl818x_ioread16(priv, &priv->map->BRSR);
+                reg &= ~3;
+                reg |= max;
+                rtl818x_iowrite16(priv, &priv->map->BRSR, reg);
+
+                break;
+
+        case RTL818X_CHIP_FAMILY_RTL8185:
+                /* in 8185 this is a BITMAP */
+                rtl818x_iowrite16(priv, &priv->map->BRSR, rates_mask);
+                rtl818x_iowrite8(priv, &priv->map->RESP_RATE, (max << 4) | min);
+                break;
+        }
+}
+
 static int rtl8180_init_hw(struct ieee80211_hw *dev)
 {
         struct rtl8180_priv *priv = dev->priv;
@@ -412,7 +443,7 @@ static int rtl8180_init_hw(struct ieee80211_hw *dev)
 
         rtl818x_iowrite8(priv, &priv->map->MSR, 0);
 
-        if (!priv->r8185)
+        if (priv->chip_family == RTL818X_CHIP_FAMILY_RTL8180)
                 rtl8180_set_anaparam(priv, priv->anaparam);
 
         rtl818x_iowrite32(priv, &priv->map->RDSAR, priv->rx_ring_dma);
@@ -425,7 +456,7 @@ static int rtl8180_init_hw(struct ieee80211_hw *dev)
         rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_CONFIG);
         reg = rtl818x_ioread8(priv, &priv->map->CONFIG2);
         rtl818x_iowrite8(priv, &priv->map->CONFIG2, reg & ~(1 << 3));
-        if (priv->r8185) {
+        if (priv->chip_family == RTL818X_CHIP_FAMILY_RTL8185) {
                 reg = rtl818x_ioread8(priv, &priv->map->CONFIG2);
                 rtl818x_iowrite8(priv, &priv->map->CONFIG2, reg | (1 << 4));
         }
@@ -437,12 +468,9 @@ static int rtl8180_init_hw(struct ieee80211_hw *dev)
 
         rtl818x_iowrite32(priv, &priv->map->INT_TIMEOUT, 0);
 
-        if (priv->r8185) {
+        if (priv->chip_family != RTL818X_CHIP_FAMILY_RTL8180) {
                 rtl818x_iowrite8(priv, &priv->map->WPA_CONF, 0);
                 rtl818x_iowrite8(priv, &priv->map->RATE_FALLBACK, 0x81);
-                rtl818x_iowrite8(priv, &priv->map->RESP_RATE, (8 << 4) | 0);
-
-                rtl818x_iowrite16(priv, &priv->map->BRSR, 0x01F3);
 
                 /* TODO: set ClkRun enable? necessary? */
                 reg = rtl818x_ioread8(priv, &priv->map->GP_ENABLE);
@@ -452,7 +480,6 @@ static int rtl8180_init_hw(struct ieee80211_hw *dev)
                 rtl818x_iowrite8(priv, &priv->map->CONFIG3, reg | (1 << 2));
                 rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_NORMAL);
         } else {
-                rtl818x_iowrite16(priv, &priv->map->BRSR, 0x1);
                 rtl818x_iowrite8(priv, &priv->map->SECURITY, 0);
 
                 rtl818x_iowrite8(priv, &priv->map->PHY_DELAY, 0x6);
@@ -460,8 +487,18 @@ static int rtl8180_init_hw(struct ieee80211_hw *dev)
         }
 
         priv->rf->init(dev);
-        if (priv->r8185)
-                rtl818x_iowrite16(priv, &priv->map->BRSR, 0x01F3);
+
+        /* default basic rates are 1,2 Mbps for rtl8180. 1,2,6,9,12,18,24 Mbps
+         * otherwise. bitmask 0x3 and 0x01f3 respectively.
+         * NOTE: currenty rtl8225 RF code changes basic rates, so we need to do
+         * this after rf init.
+         * TODO: try to find out whether RF code really needs to do this..
+         */
+        if (priv->chip_family == RTL818X_CHIP_FAMILY_RTL8180)
+                rtl8180_conf_basic_rates(dev, 0x3);
+        else
+                rtl8180_conf_basic_rates(dev, 0x1f3);
+
         return 0;
 }
 
@@ -624,7 +661,7 @@ static int rtl8180_start(struct ieee80211_hw *dev)
               RTL818X_RX_CONF_BROADCAST |
               RTL818X_RX_CONF_NICMAC;
 
-        if (priv->r8185)
+        if (priv->chip_family == RTL818X_CHIP_FAMILY_RTL8185)
                 reg |= RTL818X_RX_CONF_CSDM1 | RTL818X_RX_CONF_CSDM2;
         else {
                 reg |= (priv->rfparam & RF_PARAM_CARRIERSENSE1)
@@ -636,7 +673,7 @@ static int rtl8180_start(struct ieee80211_hw *dev)
         priv->rx_conf = reg;
         rtl818x_iowrite32(priv, &priv->map->RX_CONF, reg);
 
-        if (priv->r8185) {
+        if (priv->chip_family != RTL818X_CHIP_FAMILY_RTL8180) {
                 reg = rtl818x_ioread8(priv, &priv->map->CW_CONF);
 
                 /* CW is not on per-packet basis.
@@ -668,7 +705,9 @@ static int rtl8180_start(struct ieee80211_hw *dev)
         reg |= (6 << 21 /* MAX TX DMA */) |
                RTL818X_TX_CONF_NO_ICV;
 
-        if (priv->r8185)
+
+
+        if (priv->chip_family != RTL818X_CHIP_FAMILY_RTL8180)
                 reg &= ~RTL818X_TX_CONF_PROBE_DTS;
         else
                 reg &= ~RTL818X_TX_CONF_HW_SEQNUM;
@@ -827,6 +866,72 @@ static int rtl8180_config(struct ieee80211_hw *dev, u32 changed)
         return 0;
 }
 
+static int rtl8180_conf_tx(struct ieee80211_hw *dev,
+                            struct ieee80211_vif *vif, u16 queue,
+                            const struct ieee80211_tx_queue_params *params)
+{
+        struct rtl8180_priv *priv = dev->priv;
+        u8 cw_min, cw_max;
+
+        /* nothing to do ? */
+        if (priv->chip_family == RTL818X_CHIP_FAMILY_RTL8180)
+                return 0;
+
+        cw_min = fls(params->cw_min);
+        cw_max = fls(params->cw_max);
+
+        rtl818x_iowrite8(priv, &priv->map->CW_VAL, (cw_max << 4) | cw_min);
+
+        return 0;
+}
+
+static void rtl8180_conf_erp(struct ieee80211_hw *dev,
+                            struct ieee80211_bss_conf *info)
+{
+        struct rtl8180_priv *priv = dev->priv;
+        u8 sifs, difs;
+        int eifs;
+        u8 hw_eifs;
+
+        /* TODO: should we do something ? */
+        if (priv->chip_family == RTL818X_CHIP_FAMILY_RTL8180)
+                return;
+
+        /* I _hope_ this means 10uS for the HW.
+         * In reference code it is 0x22 for
+         * both rtl8187L and rtl8187SE
+         */
+        sifs = 0x22;
+
+        if (info->use_short_slot)
+                priv->slot_time = 9;
+        else
+                priv->slot_time = 20;
+
+        /* 10 is SIFS time in uS */
+        difs = 10 + 2 * priv->slot_time;
+        eifs = 10 + difs + priv->ack_time;
+
+        /* HW should use 4uS units for EIFS (I'm sure for rtl8185)*/
+        hw_eifs = DIV_ROUND_UP(eifs, 4);
+
+
+        rtl818x_iowrite8(priv, &priv->map->SLOT, priv->slot_time);
+        rtl818x_iowrite8(priv, &priv->map->SIFS, sifs);
+        rtl818x_iowrite8(priv, &priv->map->DIFS, difs);
+
+        /* from reference code. set ack timeout reg = eifs reg */
+        rtl818x_iowrite8(priv, &priv->map->CARRIER_SENSE_COUNTER, hw_eifs);
+
+        /* rtl8187/rtl8185 HW bug. After EIFS is elapsed,
+         * the HW still wait for DIFS.
+         * HW uses 4uS units for EIFS.
+         */
+        hw_eifs = DIV_ROUND_UP(eifs - difs, 4);
+
+        rtl818x_iowrite8(priv, &priv->map->EIFS, hw_eifs);
+}
+
 static void rtl8180_bss_info_changed(struct ieee80211_hw *dev,
                                      struct ieee80211_vif *vif,
                                      struct ieee80211_bss_conf *info,
@@ -854,8 +959,23 @@ static void rtl8180_bss_info_changed(struct ieee80211_hw *dev,
                 rtl818x_iowrite8(priv, &priv->map->MSR, reg);
         }
 
-        if (changed & BSS_CHANGED_ERP_SLOT && priv->rf->conf_erp)
-                priv->rf->conf_erp(dev, info);
+        if (changed & BSS_CHANGED_BASIC_RATES)
+                rtl8180_conf_basic_rates(dev, info->basic_rates);
+
+        if (changed & (BSS_CHANGED_ERP_SLOT | BSS_CHANGED_ERP_PREAMBLE)) {
+
+                /* when preamble changes, acktime duration changes, and erp must
+                 * be recalculated. ACK time is calculated at lowest rate.
+                 * Since mac80211 include SIFS time we remove it (-10)
+                 */
+                priv->ack_time =
+                        le16_to_cpu(ieee80211_generic_frame_duration(dev,
+                                        priv->vif,
+                                        IEEE80211_BAND_2GHZ, 10,
+                                        &priv->rates[0])) - 10;
+
+                rtl8180_conf_erp(dev, info);
+        }
 
         if (changed & BSS_CHANGED_BEACON_ENABLED)
                 vif_priv->enable_beacon = info->enable_beacon;
@@ -913,6 +1033,7 @@ static const struct ieee80211_ops rtl8180_ops = {
         .remove_interface       = rtl8180_remove_interface,
         .config                 = rtl8180_config,
         .bss_info_changed       = rtl8180_bss_info_changed,
+        .conf_tx                = rtl8180_conf_tx,
         .prepare_multicast      = rtl8180_prepare_multicast,
         .configure_filter       = rtl8180_configure_filter,
         .get_tsf                = rtl8180_get_tsf,
@@ -920,8 +1041,7 @@ static const struct ieee80211_ops rtl8180_ops = {
 
 static void rtl8180_eeprom_register_read(struct eeprom_93cx6 *eeprom)
 {
-        struct ieee80211_hw *dev = eeprom->data;
-        struct rtl8180_priv *priv = dev->priv;
+        struct rtl8180_priv *priv = eeprom->data;
         u8 reg = rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
 
         eeprom->reg_data_in = reg & RTL818X_EEPROM_CMD_WRITE;
@@ -932,8 +1052,7 @@ static void rtl8180_eeprom_register_read(struct eeprom_93cx6 *eeprom)
 
 static void rtl8180_eeprom_register_write(struct eeprom_93cx6 *eeprom)
 {
-        struct ieee80211_hw *dev = eeprom->data;
-        struct rtl8180_priv *priv = dev->priv;
+        struct rtl8180_priv *priv = eeprom->data;
         u8 reg = 2 << 6;
 
         if (eeprom->reg_data_in)
@@ -950,6 +1069,67 @@ static void rtl8180_eeprom_register_write(struct eeprom_93cx6 *eeprom)
         udelay(10);
 }
 
+static void rtl8180_eeprom_read(struct rtl8180_priv *priv)
+{
+        struct eeprom_93cx6 eeprom;
+        int eeprom_cck_table_adr;
+        u16 eeprom_val;
+        int i;
+
+        eeprom.data = priv;
+        eeprom.register_read = rtl8180_eeprom_register_read;
+        eeprom.register_write = rtl8180_eeprom_register_write;
+        if (rtl818x_ioread32(priv, &priv->map->RX_CONF) & (1 << 6))
+                eeprom.width = PCI_EEPROM_WIDTH_93C66;
+        else
+                eeprom.width = PCI_EEPROM_WIDTH_93C46;
+
+        rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD,
+                        RTL818X_EEPROM_CMD_PROGRAM);
+        rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
+        udelay(10);
+
+        eeprom_93cx6_read(&eeprom, 0x06, &eeprom_val);
+        eeprom_val &= 0xFF;
+        priv->rf_type = eeprom_val;
+
+        eeprom_93cx6_read(&eeprom, 0x17, &eeprom_val);
+        priv->csthreshold = eeprom_val >> 8;
+
+        eeprom_93cx6_multiread(&eeprom, 0x7, (__le16 *)priv->mac_addr, 3);
+
+        eeprom_cck_table_adr = 0x10;
+
+        /* CCK TX power */
+        for (i = 0; i < 14; i += 2) {
+                u16 txpwr;
+                eeprom_93cx6_read(&eeprom, eeprom_cck_table_adr + (i >> 1),
+                                &txpwr);
+                priv->channels[i].hw_value = txpwr & 0xFF;
+                priv->channels[i + 1].hw_value = txpwr >> 8;
+        }
+
+        /* OFDM TX power */
+        if (priv->chip_family != RTL818X_CHIP_FAMILY_RTL8180) {
+                for (i = 0; i < 14; i += 2) {
+                        u16 txpwr;
+                        eeprom_93cx6_read(&eeprom, 0x20 + (i >> 1), &txpwr);
+                        priv->channels[i].hw_value |= (txpwr & 0xFF) << 8;
+                        priv->channels[i + 1].hw_value |= txpwr & 0xFF00;
+                }
+        }
+
+        if (priv->chip_family == RTL818X_CHIP_FAMILY_RTL8180) {
+                __le32 anaparam;
+                eeprom_93cx6_multiread(&eeprom, 0xD, (__le16 *)&anaparam, 2);
+                priv->anaparam = le32_to_cpu(anaparam);
+                eeprom_93cx6_read(&eeprom, 0x19, &priv->rfparam);
+        }
+
+        rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD,
+                        RTL818X_EEPROM_CMD_NORMAL);
+}
+
 static int rtl8180_probe(struct pci_dev *pdev,
                                    const struct pci_device_id *id)
 {
@@ -957,12 +1137,9 @@ static int rtl8180_probe(struct pci_dev *pdev,
         struct rtl8180_priv *priv;
         unsigned long mem_addr, mem_len;
         unsigned int io_addr, io_len;
-        int err, i;
-        struct eeprom_93cx6 eeprom;
+        int err;
         const char *chip_name, *rf_name = NULL;
         u32 reg;
-        u16 eeprom_val;
-        u8 mac_addr[ETH_ALEN];
 
         err = pci_enable_device(pdev);
         if (err) {
@@ -1052,15 +1229,22 @@ static int rtl8180_probe(struct pci_dev *pdev,
         switch (reg) {
         case RTL818X_TX_CONF_R8180_ABCD:
                 chip_name = "RTL8180";
+                priv->chip_family = RTL818X_CHIP_FAMILY_RTL8180;
                 break;
+
         case RTL818X_TX_CONF_R8180_F:
                 chip_name = "RTL8180vF";
+                priv->chip_family = RTL818X_CHIP_FAMILY_RTL8180;
                 break;
+
         case RTL818X_TX_CONF_R8185_ABC:
                 chip_name = "RTL8185";
+                priv->chip_family = RTL818X_CHIP_FAMILY_RTL8185;
                 break;
+
         case RTL818X_TX_CONF_R8185_D:
                 chip_name = "RTL8185vD";
+                priv->chip_family = RTL818X_CHIP_FAMILY_RTL8185;
                 break;
         default:
                 printk(KERN_ERR "%s (rtl8180): Unknown chip! (0x%x)\n",
@@ -1068,27 +1252,14 @@ static int rtl8180_probe(struct pci_dev *pdev,
                 goto err_iounmap;
         }
 
-        priv->r8185 = reg & RTL818X_TX_CONF_R8185_ABC;
-        if (priv->r8185) {
+        if (priv->chip_family != RTL818X_CHIP_FAMILY_RTL8180) {
                 priv->band.n_bitrates = ARRAY_SIZE(rtl818x_rates);
                 pci_try_set_mwi(pdev);
         }
 
-        eeprom.data = dev;
-        eeprom.register_read = rtl8180_eeprom_register_read;
-        eeprom.register_write = rtl8180_eeprom_register_write;
-        if (rtl818x_ioread32(priv, &priv->map->RX_CONF) & (1 << 6))
-                eeprom.width = PCI_EEPROM_WIDTH_93C66;
-        else
-                eeprom.width = PCI_EEPROM_WIDTH_93C46;
-
-        rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_PROGRAM);
-        rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
-        udelay(10);
+        rtl8180_eeprom_read(priv);
 
-        eeprom_93cx6_read(&eeprom, 0x06, &eeprom_val);
-        eeprom_val &= 0xFF;
-        switch (eeprom_val) {
+        switch (priv->rf_type) {
         case 1: rf_name = "Intersil";
                 break;
         case 2: rf_name = "RFMD";
@@ -1106,7 +1277,7 @@ static int rtl8180_probe(struct pci_dev *pdev,
                 break;
         default:
                 printk(KERN_ERR "%s (rtl8180): Unknown RF! (0x%x)\n",
-                       pci_name(pdev), eeprom_val);
+                       pci_name(pdev), priv->rf_type);
                 goto err_iounmap;
         }
 
@@ -1116,42 +1287,12 @@ static int rtl8180_probe(struct pci_dev *pdev,
                 goto err_iounmap;
         }
 
-        eeprom_93cx6_read(&eeprom, 0x17, &eeprom_val);
-        priv->csthreshold = eeprom_val >> 8;
-        if (!priv->r8185) {
-                __le32 anaparam;
-                eeprom_93cx6_multiread(&eeprom, 0xD, (__le16 *)&anaparam, 2);
-                priv->anaparam = le32_to_cpu(anaparam);
-                eeprom_93cx6_read(&eeprom, 0x19, &priv->rfparam);
-        }
-
-        eeprom_93cx6_multiread(&eeprom, 0x7, (__le16 *)mac_addr, 3);
-        if (!is_valid_ether_addr(mac_addr)) {
+        if (!is_valid_ether_addr(priv->mac_addr)) {
                 printk(KERN_WARNING "%s (rtl8180): Invalid hwaddr! Using"
                        " randomly generated MAC addr\n", pci_name(pdev));
-                eth_random_addr(mac_addr);
+                eth_random_addr(priv->mac_addr);
         }
-        SET_IEEE80211_PERM_ADDR(dev, mac_addr);
-
-        /* CCK TX power */
-        for (i = 0; i < 14; i += 2) {
-                u16 txpwr;
-                eeprom_93cx6_read(&eeprom, 0x10 + (i >> 1), &txpwr);
-                priv->channels[i].hw_value = txpwr & 0xFF;
-                priv->channels[i + 1].hw_value = txpwr >> 8;
-        }
-
-        /* OFDM TX power */
-        if (priv->r8185) {
-                for (i = 0; i < 14; i += 2) {
-                        u16 txpwr;
-                        eeprom_93cx6_read(&eeprom, 0x20 + (i >> 1), &txpwr);
-                        priv->channels[i].hw_value |= (txpwr & 0xFF) << 8;
-                        priv->channels[i + 1].hw_value |= txpwr & 0xFF00;
-                }
-        }
-
-        rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_NORMAL);
+        SET_IEEE80211_PERM_ADDR(dev, priv->mac_addr);
 
         spin_lock_init(&priv->lock);
 
@@ -1163,7 +1304,7 @@ static int rtl8180_probe(struct pci_dev *pdev,
         }
 
         wiphy_info(dev->wiphy, "hwaddr %pm, %s + %s\n",
-                   mac_addr, chip_name, priv->rf->name);
+                   priv->mac_addr, chip_name, priv->rf->name);
 
         return 0;
 
diff --git a/drivers/net/wireless/rtl818x/rtl8180/rtl8180.h b/drivers/net/wireless/rtl818x/rtl8180/rtl8180.h
index 30523314da43..26383d77fc3a 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/rtl8180.h
+++ b/drivers/net/wireless/rtl818x/rtl8180/rtl8180.h
@@ -81,12 +81,18 @@ struct rtl8180_priv {
         struct ieee80211_supported_band band;
         struct pci_dev *pdev;
         u32 rx_conf;
+        u8 slot_time;
+        u16 ack_time;
 
-        int r8185;
+        enum {
+                RTL818X_CHIP_FAMILY_RTL8180,
+                RTL818X_CHIP_FAMILY_RTL8185,
+        } chip_family;
         u32 anaparam;
         u16 rfparam;
         u8 csthreshold;
-
+        u8 mac_addr[ETH_ALEN];
+        u8 rf_type;
         /* sequence # */
         u16 seqno;
 };
diff --git a/drivers/net/wireless/rtl818x/rtl8180/rtl8225.c b/drivers/net/wireless/rtl818x/rtl8180/rtl8225.c
index d60a5f399022..1c0fe238d995 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/rtl8225.c
+++ b/drivers/net/wireless/rtl818x/rtl8180/rtl8225.c
@@ -730,32 +730,11 @@ static void rtl8225_rf_set_channel(struct ieee80211_hw *dev,
         msleep(10);
 }
 
-static void rtl8225_rf_conf_erp(struct ieee80211_hw *dev,
-                                struct ieee80211_bss_conf *info)
-{
-        struct rtl8180_priv *priv = dev->priv;
-
-        if (info->use_short_slot) {
-                rtl818x_iowrite8(priv, &priv->map->SLOT, 0x9);
-                rtl818x_iowrite8(priv, &priv->map->SIFS, 0x22);
-                rtl818x_iowrite8(priv, &priv->map->DIFS, 0x14);
-                rtl818x_iowrite8(priv, &priv->map->EIFS, 81);
-                rtl818x_iowrite8(priv, &priv->map->CW_VAL, 0x73);
-        } else {
-                rtl818x_iowrite8(priv, &priv->map->SLOT, 0x14);
-                rtl818x_iowrite8(priv, &priv->map->SIFS, 0x44);
-                rtl818x_iowrite8(priv, &priv->map->DIFS, 0x24);
-                rtl818x_iowrite8(priv, &priv->map->EIFS, 81);
-                rtl818x_iowrite8(priv, &priv->map->CW_VAL, 0xa5);
-        }
-}
-
 static const struct rtl818x_rf_ops rtl8225_ops = {
         .name           = "rtl8225",
         .init           = rtl8225_rf_init,
         .stop           = rtl8225_rf_stop,
         .set_chan       = rtl8225_rf_set_channel,
-        .conf_erp       = rtl8225_rf_conf_erp,
 };
 
 static const struct rtl818x_rf_ops rtl8225z2_ops = {
@@ -763,7 +742,6 @@ static const struct rtl818x_rf_ops rtl8225z2_ops = {
         .init           = rtl8225z2_rf_init,
         .stop           = rtl8225_rf_stop,
         .set_chan       = rtl8225_rf_set_channel,
-        .conf_erp       = rtl8225_rf_conf_erp,
 };
 
 const struct rtl818x_rf_ops * rtl8180_detect_rf(struct ieee80211_hw *dev)
diff --git a/drivers/net/wireless/rtl818x/rtl818x.h b/drivers/net/wireless/rtl818x/rtl818x.h
index fa7f7f61ea26..1815b15d03b1 100644
--- a/drivers/net/wireless/rtl818x/rtl818x.h
+++ b/drivers/net/wireless/rtl818x/rtl818x.h
@@ -192,7 +192,6 @@ struct rtl818x_rf_ops {
         void (*init)(struct ieee80211_hw *);
         void (*stop)(struct ieee80211_hw *);
         void (*set_chan)(struct ieee80211_hw *, struct ieee80211_conf *);
-        void (*conf_erp)(struct ieee80211_hw *, struct ieee80211_bss_conf *);
         u8 (*calc_rssi)(u8 agc, u8 sq);
 };
 
diff --git a/drivers/nfc/Kconfig b/drivers/nfc/Kconfig
index fe20e1cc0545..65d4ca19d132 100644
--- a/drivers/nfc/Kconfig
+++ b/drivers/nfc/Kconfig
@@ -26,6 +26,18 @@ config NFC_WILINK
           Say Y here to compile support for Texas Instrument's NFC WiLink driver
           into the kernel or say M to compile it as module.
 
+config NFC_TRF7970A
+        tristate "Texas Instruments TRF7970a NFC driver"
+        depends on SPI && NFC_DIGITAL
+        help
+          This option enables the NFC driver for Texas Instruments' TRF7970a
+          device. Such device supports 5 different protocols: ISO14443A,
+          ISO14443B, FeLiCa, ISO15693 and ISO18000-3.
+
+          Say Y here to compile support for TRF7970a into the kernel or
+          say M  to compile it as a module. The module will be called
+          trf7970a.ko.
+
 config NFC_MEI_PHY
         tristate "MEI bus NFC device support"
         depends on INTEL_MEI && NFC_HCI
diff --git a/drivers/nfc/Makefile b/drivers/nfc/Makefile
index 56ab822ba03d..ae42a3fa60c9 100644
--- a/drivers/nfc/Makefile
+++ b/drivers/nfc/Makefile
@@ -10,5 +10,6 @@ obj-$(CONFIG_NFC_MEI_PHY)	+= mei_phy.o
 obj-$(CONFIG_NFC_SIM)           += nfcsim.o
 obj-$(CONFIG_NFC_PORT100)       += port100.o
 obj-$(CONFIG_NFC_MRVL)          += nfcmrvl/
+obj-$(CONFIG_NFC_TRF7970A)      += trf7970a.o
 
 ccflags-$(CONFIG_NFC_DEBUG) := -DDEBUG
diff --git a/drivers/nfc/pn533.c b/drivers/nfc/pn533.c
index cf1a87bb74f8..d46a700a9637 100644
--- a/drivers/nfc/pn533.c
+++ b/drivers/nfc/pn533.c
@@ -55,26 +55,14 @@
                                    NFC_PROTO_NFC_DEP_MASK)
 
 static const struct usb_device_id pn533_table[] = {
-        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
-          .idVendor             = PN533_VENDOR_ID,
-          .idProduct            = PN533_PRODUCT_ID,
-          .driver_info          = PN533_DEVICE_STD,
-        },
-        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
-          .idVendor             = SCM_VENDOR_ID,
-          .idProduct            = SCL3711_PRODUCT_ID,
-          .driver_info          = PN533_DEVICE_STD,
-        },
-        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
-          .idVendor             = SONY_VENDOR_ID,
-          .idProduct            = PASORI_PRODUCT_ID,
-          .driver_info          = PN533_DEVICE_PASORI,
-        },
-        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
-          .idVendor             = ACS_VENDOR_ID,
-          .idProduct            = ACR122U_PRODUCT_ID,
-          .driver_info          = PN533_DEVICE_ACR122U,
-        },
+        { USB_DEVICE(PN533_VENDOR_ID, PN533_PRODUCT_ID),
+          .driver_info = PN533_DEVICE_STD },
+        { USB_DEVICE(SCM_VENDOR_ID, SCL3711_PRODUCT_ID),
+          .driver_info = PN533_DEVICE_STD },
+        { USB_DEVICE(SONY_VENDOR_ID, PASORI_PRODUCT_ID),
+          .driver_info = PN533_DEVICE_PASORI },
+        { USB_DEVICE(ACS_VENDOR_ID, ACR122U_PRODUCT_ID),
+          .driver_info = PN533_DEVICE_ACR122U },
         { }
 };
 MODULE_DEVICE_TABLE(usb, pn533_table);
diff --git a/drivers/nfc/pn544/i2c.c b/drivers/nfc/pn544/i2c.c
index d6185ff2f87b..f2acd85be86e 100644
--- a/drivers/nfc/pn544/i2c.c
+++ b/drivers/nfc/pn544/i2c.c
@@ -58,8 +58,19 @@ MODULE_DEVICE_TABLE(i2c, pn544_hci_i2c_id_table);
 
 #define PN544_HCI_I2C_DRIVER_NAME "pn544_hci_i2c"
 
+/*
+ * Exposed through the 4 most significant bytes
+ * from the HCI SW_VERSION first byte, a.k.a.
+ * SW RomLib.
+ */
+#define PN544_HW_VARIANT_C2 0xa
+#define PN544_HW_VARIANT_C3 0xb
+
+#define PN544_FW_CMD_RESET 0x01
 #define PN544_FW_CMD_WRITE 0x08
 #define PN544_FW_CMD_CHECK 0x06
+#define PN544_FW_CMD_SECURE_WRITE 0x0C
+#define PN544_FW_CMD_SECURE_CHUNK_WRITE 0x0D
 
 struct pn544_i2c_fw_frame_write {
         u8 cmd;
@@ -88,13 +99,31 @@ struct pn544_i2c_fw_blob {
         u8 data[];
 };
 
+struct pn544_i2c_fw_secure_frame {
+        u8 cmd;
+        u16 be_datalen;
+        u8 data[];
+} __packed;
+
+struct pn544_i2c_fw_secure_blob {
+        u64 header;
+        u8 data[];
+};
+
 #define PN544_FW_CMD_RESULT_TIMEOUT 0x01
 #define PN544_FW_CMD_RESULT_BAD_CRC 0x02
 #define PN544_FW_CMD_RESULT_ACCESS_DENIED 0x08
 #define PN544_FW_CMD_RESULT_PROTOCOL_ERROR 0x0B
 #define PN544_FW_CMD_RESULT_INVALID_PARAMETER 0x11
+#define PN544_FW_CMD_RESULT_UNSUPPORTED_COMMAND 0x13
 #define PN544_FW_CMD_RESULT_INVALID_LENGTH 0x18
+#define PN544_FW_CMD_RESULT_CRYPTOGRAPHIC_ERROR 0x19
+#define PN544_FW_CMD_RESULT_VERSION_CONDITIONS_ERROR 0x1D
+#define PN544_FW_CMD_RESULT_MEMORY_ERROR 0x20
+#define PN544_FW_CMD_RESULT_CHUNK_OK 0x21
 #define PN544_FW_CMD_RESULT_WRITE_FAILED 0x74
+#define PN544_FW_CMD_RESULT_COMMAND_REJECTED 0xE0
+#define PN544_FW_CMD_RESULT_CHUNK_ERROR 0xE6
 
 #define MIN(X, Y) ((X) < (Y) ? (X) : (Y))
 
@@ -104,11 +133,17 @@ struct pn544_i2c_fw_blob {
 #define PN544_FW_I2C_WRITE_DATA_MAX_LEN MIN((PN544_FW_I2C_MAX_PAYLOAD -\
                                          PN544_FW_I2C_WRITE_FRAME_HEADER_LEN),\
                                          PN544_FW_WRITE_BUFFER_MAX_LEN)
+#define PN544_FW_SECURE_CHUNK_WRITE_HEADER_LEN 3
+#define PN544_FW_SECURE_CHUNK_WRITE_DATA_MAX_LEN (PN544_FW_I2C_MAX_PAYLOAD -\
+                        PN544_FW_SECURE_CHUNK_WRITE_HEADER_LEN)
+#define PN544_FW_SECURE_FRAME_HEADER_LEN 3
+#define PN544_FW_SECURE_BLOB_HEADER_LEN 8
 
 #define FW_WORK_STATE_IDLE 1
 #define FW_WORK_STATE_START 2
 #define FW_WORK_STATE_WAIT_WRITE_ANSWER 3
 #define FW_WORK_STATE_WAIT_CHECK_ANSWER 4
+#define FW_WORK_STATE_WAIT_SECURE_WRITE_ANSWER 5
 
 struct pn544_i2c_phy {
         struct i2c_client *i2c_dev;
@@ -119,6 +154,8 @@ struct pn544_i2c_phy {
         unsigned int gpio_fw;
         unsigned int en_polarity;
 
+        u8 hw_variant;
+
         struct work_struct fw_work;
         int fw_work_state;
         char firmware_name[NFC_FIRMWARE_NAME_MAXSIZE + 1];
@@ -127,6 +164,8 @@ struct pn544_i2c_phy {
         size_t fw_blob_size;
         const u8 *fw_blob_data;
         size_t fw_written;
+        size_t fw_size;
+
         int fw_cmd_result;
 
         int powered;
@@ -390,6 +429,8 @@ static int pn544_hci_i2c_fw_read_status(struct pn544_i2c_phy *phy)
         switch (response.status) {
         case 0:
                 return 0;
+        case PN544_FW_CMD_RESULT_CHUNK_OK:
+                return response.status;
         case PN544_FW_CMD_RESULT_TIMEOUT:
                 return -ETIMEDOUT;
         case PN544_FW_CMD_RESULT_BAD_CRC:
@@ -400,9 +441,20 @@ static int pn544_hci_i2c_fw_read_status(struct pn544_i2c_phy *phy)
                 return -EPROTO;
         case PN544_FW_CMD_RESULT_INVALID_PARAMETER:
                 return -EINVAL;
+        case PN544_FW_CMD_RESULT_UNSUPPORTED_COMMAND:
+                return -ENOTSUPP;
         case PN544_FW_CMD_RESULT_INVALID_LENGTH:
                 return -EBADMSG;
+        case PN544_FW_CMD_RESULT_CRYPTOGRAPHIC_ERROR:
+                return -ENOKEY;
+        case PN544_FW_CMD_RESULT_VERSION_CONDITIONS_ERROR:
+                return -EINVAL;
+        case PN544_FW_CMD_RESULT_MEMORY_ERROR:
+                return -ENOMEM;
+        case PN544_FW_CMD_RESULT_COMMAND_REJECTED:
+                return -EACCES;
         case PN544_FW_CMD_RESULT_WRITE_FAILED:
+        case PN544_FW_CMD_RESULT_CHUNK_ERROR:
                 return -EIO;
         default:
                 return -EIO;
@@ -469,7 +521,8 @@ static struct nfc_phy_ops i2c_phy_ops = {
         .disable = pn544_hci_i2c_disable,
 };
 
-static int pn544_hci_i2c_fw_download(void *phy_id, const char *firmware_name)
+static int pn544_hci_i2c_fw_download(void *phy_id, const char *firmware_name,
+                                        u8 hw_variant)
 {
         struct pn544_i2c_phy *phy = phy_id;
 
@@ -477,6 +530,7 @@ static int pn544_hci_i2c_fw_download(void *phy_id, const char *firmware_name)
 
         strcpy(phy->firmware_name, firmware_name);
 
+        phy->hw_variant = hw_variant;
         phy->fw_work_state = FW_WORK_STATE_START;
 
         schedule_work(&phy->fw_work);
@@ -598,12 +652,93 @@ static int pn544_hci_i2c_fw_write_chunk(struct pn544_i2c_phy *phy)
         return 0;
 }
 
+static int pn544_hci_i2c_fw_secure_write_frame_cmd(struct pn544_i2c_phy *phy,
+                                        const u8 *data, u16 datalen)
+{
+        u8 buf[PN544_FW_I2C_MAX_PAYLOAD];
+        struct pn544_i2c_fw_secure_frame *chunk;
+        int chunklen;
+        int r;
+
+        if (datalen > PN544_FW_SECURE_CHUNK_WRITE_DATA_MAX_LEN)
+                datalen = PN544_FW_SECURE_CHUNK_WRITE_DATA_MAX_LEN;
+
+        chunk = (struct pn544_i2c_fw_secure_frame *) buf;
+
+        chunk->cmd = PN544_FW_CMD_SECURE_CHUNK_WRITE;
+
+        put_unaligned_be16(datalen, &chunk->be_datalen);
+
+        memcpy(chunk->data, data, datalen);
+
+        chunklen = sizeof(chunk->cmd) + sizeof(chunk->be_datalen) + datalen;
+
+        r = i2c_master_send(phy->i2c_dev, buf, chunklen);
+
+        if (r == chunklen)
+                return datalen;
+        else if (r < 0)
+                return r;
+        else
+                return -EIO;
+
+}
+
+static int pn544_hci_i2c_fw_secure_write_frame(struct pn544_i2c_phy *phy)
+{
+        struct pn544_i2c_fw_secure_frame *framep;
+        int r;
+
+        framep = (struct pn544_i2c_fw_secure_frame *) phy->fw_blob_data;
+        if (phy->fw_written == 0)
+                phy->fw_blob_size = get_unaligned_be16(&framep->be_datalen)
+                                + PN544_FW_SECURE_FRAME_HEADER_LEN;
+
+        /* Only secure write command can be chunked*/
+        if (phy->fw_blob_size > PN544_FW_I2C_MAX_PAYLOAD &&
+                        framep->cmd != PN544_FW_CMD_SECURE_WRITE)
+                return -EINVAL;
+
+        /* The firmware also have other commands, we just send them directly */
+        if (phy->fw_blob_size < PN544_FW_I2C_MAX_PAYLOAD) {
+                r = i2c_master_send(phy->i2c_dev,
+                        (const char *) phy->fw_blob_data, phy->fw_blob_size);
+
+                if (r == phy->fw_blob_size)
+                        goto exit;
+                else if (r < 0)
+                        return r;
+                else
+                        return -EIO;
+        }
+
+        r = pn544_hci_i2c_fw_secure_write_frame_cmd(phy,
+                                       phy->fw_blob_data + phy->fw_written,
+                                       phy->fw_blob_size - phy->fw_written);
+        if (r < 0)
+                return r;
+
+exit:
+        phy->fw_written += r;
+        phy->fw_work_state = FW_WORK_STATE_WAIT_SECURE_WRITE_ANSWER;
+
+        /* SW reset command will not trig any response from PN544 */
+        if (framep->cmd == PN544_FW_CMD_RESET) {
+                pn544_hci_i2c_enable_mode(phy, PN544_FW_MODE);
+                phy->fw_cmd_result = 0;
+                schedule_work(&phy->fw_work);
+        }
+
+        return 0;
+}
+
 static void pn544_hci_i2c_fw_work(struct work_struct *work)
 {
         struct pn544_i2c_phy *phy = container_of(work, struct pn544_i2c_phy,
                                                 fw_work);
         int r;
         struct pn544_i2c_fw_blob *blob;
+        struct pn544_i2c_fw_secure_blob *secure_blob;
 
         switch (phy->fw_work_state) {
         case FW_WORK_STATE_START:
@@ -614,13 +749,29 @@ static void pn544_hci_i2c_fw_work(struct work_struct *work)
                 if (r < 0)
                         goto exit_state_start;
 
-                blob = (struct pn544_i2c_fw_blob *) phy->fw->data;
-                phy->fw_blob_size = get_unaligned_be32(&blob->be_size);
-                phy->fw_blob_dest_addr = get_unaligned_be32(&blob->be_destaddr);
-                phy->fw_blob_data = blob->data;
-
                 phy->fw_written = 0;
-                r = pn544_hci_i2c_fw_write_chunk(phy);
+
+                switch (phy->hw_variant) {
+                case PN544_HW_VARIANT_C2:
+                        blob = (struct pn544_i2c_fw_blob *) phy->fw->data;
+                        phy->fw_blob_size = get_unaligned_be32(&blob->be_size);
+                        phy->fw_blob_dest_addr = get_unaligned_be32(
+                                                        &blob->be_destaddr);
+                        phy->fw_blob_data = blob->data;
+
+                        r = pn544_hci_i2c_fw_write_chunk(phy);
+                        break;
+                case PN544_HW_VARIANT_C3:
+                        secure_blob = (struct pn544_i2c_fw_secure_blob *)
+                                                                phy->fw->data;
+                        phy->fw_blob_data = secure_blob->data;
+                        phy->fw_size = phy->fw->size;
+                        r = pn544_hci_i2c_fw_secure_write_frame(phy);
+                        break;
+                default:
+                        r = -ENOTSUPP;
+                        break;
+                }
 
 exit_state_start:
                 if (r < 0)
@@ -672,6 +823,35 @@ exit_state_wait_check_answer:
                         pn544_hci_i2c_fw_work_complete(phy, r);
                 break;
 
+        case FW_WORK_STATE_WAIT_SECURE_WRITE_ANSWER:
+                r = phy->fw_cmd_result;
+                if (r < 0)
+                        goto exit_state_wait_secure_write_answer;
+
+                if (r == PN544_FW_CMD_RESULT_CHUNK_OK) {
+                        r = pn544_hci_i2c_fw_secure_write_frame(phy);
+                        goto exit_state_wait_secure_write_answer;
+                }
+
+                if (phy->fw_written == phy->fw_blob_size) {
+                        secure_blob = (struct pn544_i2c_fw_secure_blob *)
+                                (phy->fw_blob_data + phy->fw_blob_size);
+                        phy->fw_size -= phy->fw_blob_size +
+                                PN544_FW_SECURE_BLOB_HEADER_LEN;
+                        if (phy->fw_size >= PN544_FW_SECURE_BLOB_HEADER_LEN
+                                        + PN544_FW_SECURE_FRAME_HEADER_LEN) {
+                                phy->fw_blob_data = secure_blob->data;
+
+                                phy->fw_written = 0;
+                                r = pn544_hci_i2c_fw_secure_write_frame(phy);
+                        }
+                }
+
+exit_state_wait_secure_write_answer:
+                if (r < 0 || phy->fw_size == 0)
+                        pn544_hci_i2c_fw_work_complete(phy, r);
+                break;
+
         default:
                 break;
         }
diff --git a/drivers/nfc/pn544/pn544.c b/drivers/nfc/pn544/pn544.c
index 3df4a109cfad..9c8051d20cea 100644
--- a/drivers/nfc/pn544/pn544.c
+++ b/drivers/nfc/pn544/pn544.c
@@ -786,7 +786,7 @@ static int pn544_hci_fw_download(struct nfc_hci_dev *hdev,
         if (info->fw_download == NULL)
                 return -ENOTSUPP;
 
-        return info->fw_download(info->phy_id, firmware_name);
+        return info->fw_download(info->phy_id, firmware_name, hdev->sw_romlib);
 }
 
 static int pn544_hci_discover_se(struct nfc_hci_dev *hdev)
diff --git a/drivers/nfc/pn544/pn544.h b/drivers/nfc/pn544/pn544.h
index 491bf45da358..2aa9233e8086 100644
--- a/drivers/nfc/pn544/pn544.h
+++ b/drivers/nfc/pn544/pn544.h
@@ -25,7 +25,8 @@
 #define PN544_HCI_MODE 0
 #define PN544_FW_MODE 1
 
-typedef int (*fw_download_t)(void *context, const char *firmware_name);
+typedef int (*fw_download_t)(void *context, const char *firmware_name,
+                                u8 hw_variant);
 
 int pn544_hci_probe(void *phy_id, struct nfc_phy_ops *phy_ops, char *llc_name,
                     int phy_headroom, int phy_tailroom, int phy_payload,
diff --git a/drivers/nfc/port100.c b/drivers/nfc/port100.c
index a8555f81cbba..b7a372af5eb7 100644
--- a/drivers/nfc/port100.c
+++ b/drivers/nfc/port100.c
@@ -27,7 +27,8 @@
 #define PORT100_PROTOCOLS (NFC_PROTO_JEWEL_MASK    | \
                            NFC_PROTO_MIFARE_MASK   | \
                            NFC_PROTO_FELICA_MASK   | \
-                           NFC_PROTO_NFC_DEP_MASK)
+                           NFC_PROTO_NFC_DEP_MASK  | \
+                           NFC_PROTO_ISO14443_MASK)
 
 #define PORT100_CAPABILITIES (NFC_DIGITAL_DRV_CAPS_IN_CRC | \
                               NFC_DIGITAL_DRV_CAPS_TG_CRC)
@@ -139,6 +140,8 @@ static const struct port100_in_rf_setting in_rf_settings[] = {
                 .in_recv_set_number = 15,
                 .in_recv_comm_type  = PORT100_COMM_TYPE_IN_106A,
         },
+        /* Ensures the array has NFC_DIGITAL_RF_TECH_LAST elements */
+        [NFC_DIGITAL_RF_TECH_LAST] = { 0 },
 };
 
 /**
@@ -174,6 +177,9 @@ static const struct port100_tg_rf_setting tg_rf_settings[] = {
                 .tg_set_number = 8,
                 .tg_comm_type = PORT100_COMM_TYPE_TG_424F,
         },
+        /* Ensures the array has NFC_DIGITAL_RF_TECH_LAST elements */
+        [NFC_DIGITAL_RF_TECH_LAST] = { 0 },
+
 };
 
 #define PORT100_IN_PROT_INITIAL_GUARD_TIME      0x00
@@ -293,6 +299,10 @@ in_protocols[][PORT100_IN_MAX_NUM_PROTOCOLS + 1] = {
                 { PORT100_IN_PROT_CHECK_CRC, 0 },
                 { PORT100_IN_PROT_END,       0 },
         },
+        [NFC_DIGITAL_FRAMING_NFCA_T4T] = {
+                /* nfc_digital_framing_nfca_standard_with_crc_a */
+                { PORT100_IN_PROT_END,       0 },
+        },
         [NFC_DIGITAL_FRAMING_NFCA_NFC_DEP] = {
                 /* nfc_digital_framing_nfca_standard */
                 { PORT100_IN_PROT_END, 0 },
@@ -330,6 +340,10 @@ in_protocols[][PORT100_IN_MAX_NUM_PROTOCOLS + 1] = {
         [NFC_DIGITAL_FRAMING_NFC_DEP_ACTIVATED] = {
                 { PORT100_IN_PROT_END, 0 },
         },
+        /* Ensures the array has NFC_DIGITAL_FRAMING_LAST elements */
+        [NFC_DIGITAL_FRAMING_LAST] = {
+                { PORT100_IN_PROT_END, 0 },
+        },
 };
 
 static struct port100_protocol
@@ -371,6 +385,10 @@ tg_protocols[][PORT100_TG_MAX_NUM_PROTOCOLS + 1] = {
                 { PORT100_TG_PROT_RF_OFF, 1 },
                 { PORT100_TG_PROT_END,    0 },
         },
+        /* Ensures the array has NFC_DIGITAL_FRAMING_LAST elements */
+        [NFC_DIGITAL_FRAMING_LAST] = {
+                { PORT100_TG_PROT_END,    0 },
+        },
 };
 
 struct port100 {
@@ -1356,10 +1374,7 @@ static struct nfc_digital_ops port100_digital_ops = {
 };
 
 static const struct usb_device_id port100_table[] = {
-        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE,
-          .idVendor             = SONY_VENDOR_ID,
-          .idProduct            = RCS380_PRODUCT_ID,
-        },
+        { USB_DEVICE(SONY_VENDOR_ID, RCS380_PRODUCT_ID), },
         { }
 };
 MODULE_DEVICE_TABLE(usb, port100_table);
diff --git a/drivers/nfc/trf7970a.c b/drivers/nfc/trf7970a.c
new file mode 100644
index 000000000000..d9babe986473
--- /dev/null
+++ b/drivers/nfc/trf7970a.c
@@ -0,0 +1,1370 @@
+/*
+ * TI TRF7970a RFID/NFC Transceiver Driver
+ *
+ * Copyright (C) 2013 Texas Instruments Incorporated - http://www.ti.com
+ *
+ * Author: Erick Macias <emacias@ti.com>
+ * Author: Felipe Balbi <balbi@ti.com>
+ * Author: Mark A. Greer <mgreer@animalcreek.com>
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2  of
+ * the License as published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/device.h>
+#include <linux/netdevice.h>
+#include <linux/interrupt.h>
+#include <linux/nfc.h>
+#include <linux/skbuff.h>
+#include <linux/delay.h>
+#include <linux/gpio.h>
+#include <linux/of.h>
+#include <linux/of_gpio.h>
+#include <linux/spi/spi.h>
+#include <linux/regulator/consumer.h>
+
+#include <net/nfc/nfc.h>
+#include <net/nfc/digital.h>
+
+/* There are 3 ways the host can communicate with the trf7970a:
+ * parallel mode, SPI with Slave Select (SS) mode, and SPI without
+ * SS mode.  The driver only supports the two SPI modes.
+ *
+ * The trf7970a is very timing sensitive and the VIN, EN2, and EN
+ * pins must asserted in that order and with specific delays in between.
+ * The delays used in the driver were provided by TI and have been
+ * confirmed to work with this driver.
+ *
+ * Timeouts are implemented using the delayed workqueue kernel facility.
+ * Timeouts are required so things don't hang when there is no response
+ * from the trf7970a (or tag).  Using this mechanism creates a race with
+ * interrupts, however.  That is, an interrupt and a timeout could occur
+ * closely enough together that one is blocked by the mutex while the other
+ * executes.  When the timeout handler executes first and blocks the
+ * interrupt handler, it will eventually set the state to IDLE so the
+ * interrupt handler will check the state and exit with no harm done.
+ * When the interrupt handler executes first and blocks the timeout handler,
+ * the cancel_delayed_work() call will know that it didn't cancel the
+ * work item (i.e., timeout) and will return zero.  That return code is
+ * used by the timer handler to indicate that it should ignore the timeout
+ * once its unblocked.
+ *
+ * Aborting an active command isn't as simple as it seems because the only
+ * way to abort a command that's already been sent to the tag is so turn
+ * off power to the tag.  If we do that, though, we'd have to go through
+ * the entire anticollision procedure again but the digital layer doesn't
+ * support that.  So, if an abort is received before trf7970a_in_send_cmd()
+ * has sent the command to the tag, it simply returns -ECANCELED.  If the
+ * command has already been sent to the tag, then the driver continues
+ * normally and recieves the response data (or error) but just before
+ * sending the data upstream, it frees the rx_skb and sends -ECANCELED
+ * upstream instead.  If the command failed, that error will be sent
+ * upstream.
+ *
+ * When recieving data from a tag and the interrupt status register has
+ * only the SRX bit set, it means that all of the data has been received
+ * (once what's in the fifo has been read).  However, depending on timing
+ * an interrupt status with only the SRX bit set may not be recived.  In
+ * those cases, the timeout mechanism is used to wait 5 ms in case more
+ * data arrives.  After 5 ms, it is assumed that all of the data has been
+ * received and the accumulated rx data is sent upstream.  The
+ * 'TRF7970A_ST_WAIT_FOR_RX_DATA_CONT' state is used for this purpose
+ * (i.e., it indicates that some data has been received but we're not sure
+ * if there is more coming so a timeout in this state means all data has
+ * been received and there isn't an error).  The delay is 5 ms since delays
+ * over 2 ms have been observed during testing (a little extra just in case).
+ *
+ * Type 2 write and sector select commands respond with a 4-bit ACK or NACK.
+ * Having only 4 bits in the FIFO won't normally generate an interrupt so
+ * driver enables the '4_bit_RX' bit of the Special Functions register 1
+ * to cause an interrupt in that case.  Leaving that bit for a read command
+ * messes up the data returned so it is only enabled when the framing is
+ * 'NFC_DIGITAL_FRAMING_NFCA_T2T' and the command is not a read command.
+ * Unfortunately, that means that the driver has to peek into tx frames
+ * when the framing is 'NFC_DIGITAL_FRAMING_NFCA_T2T'.  This is done by
+ * the trf7970a_per_cmd_config() routine.
+ *
+ * ISO/IEC 15693 frames specify whether to use single or double sub-carrier
+ * frequencies and whether to use low or high data rates in the flags byte
+ * of the frame.  This means that the driver has to peek at all 15693 frames
+ * to determine what speed to set the communication to.  In addition, write
+ * and lock commands use the OPTION flag to indicate that an EOF must be
+ * sent to the tag before it will send its response.  So the driver has to
+ * examine all frames for that reason too.
+ *
+ * It is unclear how long to wait before sending the EOF.  According to the
+ * Note under Table 1-1 in section 1.6 of
+ * http://www.ti.com/lit/ug/scbu011/scbu011.pdf, that wait should be at least
+ * 10 ms for TI Tag-it HF-I tags; however testing has shown that is not long
+ * enough.  For this reason, the driver waits 20 ms which seems to work
+ * reliably.
+ */
+
+#define TRF7970A_SUPPORTED_PROTOCOLS \
+                (NFC_PROTO_MIFARE_MASK | NFC_PROTO_ISO14443_MASK |      \
+                 NFC_PROTO_ISO15693_MASK)
+
+/* TX data must be prefixed with a FIFO reset cmd, a cmd that depends
+ * on what the current framing is, the address of the TX length byte 1
+ * register (0x1d), and the 2 byte length of the data to be transmitted.
+ * That totals 5 bytes.
+ */
+#define TRF7970A_TX_SKB_HEADROOM                5
+
+#define TRF7970A_RX_SKB_ALLOC_SIZE              256
+
+#define TRF7970A_FIFO_SIZE                      128
+
+/* TX length is 3 nibbles long ==> 4KB - 1 bytes max */
+#define TRF7970A_TX_MAX                         (4096 - 1)
+
+#define TRF7970A_WAIT_FOR_RX_DATA_TIMEOUT       5
+#define TRF7970A_WAIT_FOR_FIFO_DRAIN_TIMEOUT    3
+#define TRF7970A_WAIT_TO_ISSUE_ISO15693_EOF     20
+
+/* Quirks */
+/* Erratum: When reading IRQ Status register on trf7970a, we must issue a
+ * read continuous command for IRQ Status and Collision Position registers.
+ */
+#define TRF7970A_QUIRK_IRQ_STATUS_READ_ERRATA   BIT(0)
+
+/* Direct commands */
+#define TRF7970A_CMD_IDLE                       0x00
+#define TRF7970A_CMD_SOFT_INIT                  0x03
+#define TRF7970A_CMD_RF_COLLISION               0x04
+#define TRF7970A_CMD_RF_COLLISION_RESPONSE_N    0x05
+#define TRF7970A_CMD_RF_COLLISION_RESPONSE_0    0x06
+#define TRF7970A_CMD_FIFO_RESET                 0x0f
+#define TRF7970A_CMD_TRANSMIT_NO_CRC            0x10
+#define TRF7970A_CMD_TRANSMIT                   0x11
+#define TRF7970A_CMD_DELAY_TRANSMIT_NO_CRC      0x12
+#define TRF7970A_CMD_DELAY_TRANSMIT             0x13
+#define TRF7970A_CMD_EOF                        0x14
+#define TRF7970A_CMD_CLOSE_SLOT                 0x15
+#define TRF7970A_CMD_BLOCK_RX                   0x16
+#define TRF7970A_CMD_ENABLE_RX                  0x17
+#define TRF7970A_CMD_TEST_EXT_RF                0x18
+#define TRF7970A_CMD_TEST_INT_RF                0x19
+#define TRF7970A_CMD_RX_GAIN_ADJUST             0x1a
+
+/* Bits determining whether its a direct command or register R/W,
+ * whether to use a continuous SPI transaction or not, and the actual
+ * direct cmd opcode or regster address.
+ */
+#define TRF7970A_CMD_BIT_CTRL                   BIT(7)
+#define TRF7970A_CMD_BIT_RW                     BIT(6)
+#define TRF7970A_CMD_BIT_CONTINUOUS             BIT(5)
+#define TRF7970A_CMD_BIT_OPCODE(opcode)         ((opcode) & 0x1f)
+
+/* Registers addresses */
+#define TRF7970A_CHIP_STATUS_CTRL               0x00
+#define TRF7970A_ISO_CTRL                       0x01
+#define TRF7970A_ISO14443B_TX_OPTIONS           0x02
+#define TRF7970A_ISO14443A_HIGH_BITRATE_OPTIONS 0x03
+#define TRF7970A_TX_TIMER_SETTING_H_BYTE        0x04
+#define TRF7970A_TX_TIMER_SETTING_L_BYTE        0x05
+#define TRF7970A_TX_PULSE_LENGTH_CTRL           0x06
+#define TRF7970A_RX_NO_RESPONSE_WAIT            0x07
+#define TRF7970A_RX_WAIT_TIME                   0x08
+#define TRF7970A_MODULATOR_SYS_CLK_CTRL         0x09
+#define TRF7970A_RX_SPECIAL_SETTINGS            0x0a
+#define TRF7970A_REG_IO_CTRL                    0x0b
+#define TRF7970A_IRQ_STATUS                     0x0c
+#define TRF7970A_COLLISION_IRQ_MASK             0x0d
+#define TRF7970A_COLLISION_POSITION             0x0e
+#define TRF7970A_RSSI_OSC_STATUS                0x0f
+#define TRF7970A_SPECIAL_FCN_REG1               0x10
+#define TRF7970A_SPECIAL_FCN_REG2               0x11
+#define TRF7970A_RAM1                           0x12
+#define TRF7970A_RAM2                           0x13
+#define TRF7970A_ADJUTABLE_FIFO_IRQ_LEVELS      0x14
+#define TRF7970A_NFC_LOW_FIELD_LEVEL            0x16
+#define TRF7970A_NFCID1                         0x17
+#define TRF7970A_NFC_TARGET_LEVEL               0x18
+#define TRF79070A_NFC_TARGET_PROTOCOL           0x19
+#define TRF7970A_TEST_REGISTER1                 0x1a
+#define TRF7970A_TEST_REGISTER2                 0x1b
+#define TRF7970A_FIFO_STATUS                    0x1c
+#define TRF7970A_TX_LENGTH_BYTE1                0x1d
+#define TRF7970A_TX_LENGTH_BYTE2                0x1e
+#define TRF7970A_FIFO_IO_REGISTER               0x1f
+
+/* Chip Status Control Register Bits */
+#define TRF7970A_CHIP_STATUS_VRS5_3             BIT(0)
+#define TRF7970A_CHIP_STATUS_REC_ON             BIT(1)
+#define TRF7970A_CHIP_STATUS_AGC_ON             BIT(2)
+#define TRF7970A_CHIP_STATUS_PM_ON              BIT(3)
+#define TRF7970A_CHIP_STATUS_RF_PWR             BIT(4)
+#define TRF7970A_CHIP_STATUS_RF_ON              BIT(5)
+#define TRF7970A_CHIP_STATUS_DIRECT             BIT(6)
+#define TRF7970A_CHIP_STATUS_STBY               BIT(7)
+
+/* ISO Control Register Bits */
+#define TRF7970A_ISO_CTRL_15693_SGL_1OF4_662    0x00
+#define TRF7970A_ISO_CTRL_15693_SGL_1OF256_662  0x01
+#define TRF7970A_ISO_CTRL_15693_SGL_1OF4_2648   0x02
+#define TRF7970A_ISO_CTRL_15693_SGL_1OF256_2648 0x03
+#define TRF7970A_ISO_CTRL_15693_DBL_1OF4_667a   0x04
+#define TRF7970A_ISO_CTRL_15693_DBL_1OF256_667  0x05
+#define TRF7970A_ISO_CTRL_15693_DBL_1OF4_2669   0x06
+#define TRF7970A_ISO_CTRL_15693_DBL_1OF256_2669 0x07
+#define TRF7970A_ISO_CTRL_14443A_106            0x08
+#define TRF7970A_ISO_CTRL_14443A_212            0x09
+#define TRF7970A_ISO_CTRL_14443A_424            0x0a
+#define TRF7970A_ISO_CTRL_14443A_848            0x0b
+#define TRF7970A_ISO_CTRL_14443B_106            0x0c
+#define TRF7970A_ISO_CTRL_14443B_212            0x0d
+#define TRF7970A_ISO_CTRL_14443B_424            0x0e
+#define TRF7970A_ISO_CTRL_14443B_848            0x0f
+#define TRF7970A_ISO_CTRL_FELICA_212            0x1a
+#define TRF7970A_ISO_CTRL_FELICA_424            0x1b
+#define TRF7970A_ISO_CTRL_RFID                  BIT(5)
+#define TRF7970A_ISO_CTRL_DIR_MODE              BIT(6)
+#define TRF7970A_ISO_CTRL_RX_CRC_N              BIT(7)  /* true == No CRC */
+
+#define TRF7970A_ISO_CTRL_RFID_SPEED_MASK       0x1f
+
+/* Modulator and SYS_CLK Control Register Bits */
+#define TRF7970A_MODULATOR_DEPTH(n)             ((n) & 0x7)
+#define TRF7970A_MODULATOR_DEPTH_ASK10          (TRF7970A_MODULATOR_DEPTH(0))
+#define TRF7970A_MODULATOR_DEPTH_OOK            (TRF7970A_MODULATOR_DEPTH(1))
+#define TRF7970A_MODULATOR_DEPTH_ASK7           (TRF7970A_MODULATOR_DEPTH(2))
+#define TRF7970A_MODULATOR_DEPTH_ASK8_5         (TRF7970A_MODULATOR_DEPTH(3))
+#define TRF7970A_MODULATOR_DEPTH_ASK13          (TRF7970A_MODULATOR_DEPTH(4))
+#define TRF7970A_MODULATOR_DEPTH_ASK16          (TRF7970A_MODULATOR_DEPTH(5))
+#define TRF7970A_MODULATOR_DEPTH_ASK22          (TRF7970A_MODULATOR_DEPTH(6))
+#define TRF7970A_MODULATOR_DEPTH_ASK30          (TRF7970A_MODULATOR_DEPTH(7))
+#define TRF7970A_MODULATOR_EN_ANA               BIT(3)
+#define TRF7970A_MODULATOR_CLK(n)               (((n) & 0x3) << 4)
+#define TRF7970A_MODULATOR_CLK_DISABLED         (TRF7970A_MODULATOR_CLK(0))
+#define TRF7970A_MODULATOR_CLK_3_6              (TRF7970A_MODULATOR_CLK(1))
+#define TRF7970A_MODULATOR_CLK_6_13             (TRF7970A_MODULATOR_CLK(2))
+#define TRF7970A_MODULATOR_CLK_13_27            (TRF7970A_MODULATOR_CLK(3))
+#define TRF7970A_MODULATOR_EN_OOK               BIT(6)
+#define TRF7970A_MODULATOR_27MHZ                BIT(7)
+
+/* IRQ Status Register Bits */
+#define TRF7970A_IRQ_STATUS_NORESP              BIT(0) /* ISO15693 only */
+#define TRF7970A_IRQ_STATUS_COL                 BIT(1)
+#define TRF7970A_IRQ_STATUS_FRAMING_EOF_ERROR   BIT(2)
+#define TRF7970A_IRQ_STATUS_PARITY_ERROR        BIT(3)
+#define TRF7970A_IRQ_STATUS_CRC_ERROR           BIT(4)
+#define TRF7970A_IRQ_STATUS_FIFO                BIT(5)
+#define TRF7970A_IRQ_STATUS_SRX                 BIT(6)
+#define TRF7970A_IRQ_STATUS_TX                  BIT(7)
+
+#define TRF7970A_IRQ_STATUS_ERROR                               \
+                (TRF7970A_IRQ_STATUS_COL |                      \
+                 TRF7970A_IRQ_STATUS_FRAMING_EOF_ERROR |        \
+                 TRF7970A_IRQ_STATUS_PARITY_ERROR |             \
+                 TRF7970A_IRQ_STATUS_CRC_ERROR)
+
+#define TRF7970A_SPECIAL_FCN_REG1_COL_7_6               BIT(0)
+#define TRF7970A_SPECIAL_FCN_REG1_14_ANTICOLL           BIT(1)
+#define TRF7970A_SPECIAL_FCN_REG1_4_BIT_RX              BIT(2)
+#define TRF7970A_SPECIAL_FCN_REG1_SP_DIR_MODE           BIT(3)
+#define TRF7970A_SPECIAL_FCN_REG1_NEXT_SLOT_37US        BIT(4)
+#define TRF7970A_SPECIAL_FCN_REG1_PAR43                 BIT(5)
+
+#define TRF7970A_ADJUTABLE_FIFO_IRQ_LEVELS_WLH_124      (0x0 << 2)
+#define TRF7970A_ADJUTABLE_FIFO_IRQ_LEVELS_WLH_120      (0x1 << 2)
+#define TRF7970A_ADJUTABLE_FIFO_IRQ_LEVELS_WLH_112      (0x2 << 2)
+#define TRF7970A_ADJUTABLE_FIFO_IRQ_LEVELS_WLH_96       (0x3 << 2)
+#define TRF7970A_ADJUTABLE_FIFO_IRQ_LEVELS_WLL_4        0x0
+#define TRF7970A_ADJUTABLE_FIFO_IRQ_LEVELS_WLL_8        0x1
+#define TRF7970A_ADJUTABLE_FIFO_IRQ_LEVELS_WLL_16       0x2
+#define TRF7970A_ADJUTABLE_FIFO_IRQ_LEVELS_WLL_32       0x3
+
+#define TRF7970A_FIFO_STATUS_OVERFLOW           BIT(7)
+
+/* NFC (ISO/IEC 14443A) Type 2 Tag commands */
+#define NFC_T2T_CMD_READ                        0x30
+
+/* ISO 15693 commands codes */
+#define ISO15693_CMD_INVENTORY                  0x01
+#define ISO15693_CMD_READ_SINGLE_BLOCK          0x20
+#define ISO15693_CMD_WRITE_SINGLE_BLOCK         0x21
+#define ISO15693_CMD_LOCK_BLOCK                 0x22
+#define ISO15693_CMD_READ_MULTIPLE_BLOCK        0x23
+#define ISO15693_CMD_WRITE_MULTIPLE_BLOCK       0x24
+#define ISO15693_CMD_SELECT                     0x25
+#define ISO15693_CMD_RESET_TO_READY             0x26
+#define ISO15693_CMD_WRITE_AFI                  0x27
+#define ISO15693_CMD_LOCK_AFI                   0x28
+#define ISO15693_CMD_WRITE_DSFID                0x29
+#define ISO15693_CMD_LOCK_DSFID                 0x2a
+#define ISO15693_CMD_GET_SYSTEM_INFO            0x2b
+#define ISO15693_CMD_GET_MULTIPLE_BLOCK_SECURITY_STATUS 0x2c
+
+/* ISO 15693 request and response flags */
+#define ISO15693_REQ_FLAG_SUB_CARRIER           BIT(0)
+#define ISO15693_REQ_FLAG_DATA_RATE             BIT(1)
+#define ISO15693_REQ_FLAG_INVENTORY             BIT(2)
+#define ISO15693_REQ_FLAG_PROTOCOL_EXT          BIT(3)
+#define ISO15693_REQ_FLAG_SELECT                BIT(4)
+#define ISO15693_REQ_FLAG_AFI                   BIT(4)
+#define ISO15693_REQ_FLAG_ADDRESS               BIT(5)
+#define ISO15693_REQ_FLAG_NB_SLOTS              BIT(5)
+#define ISO15693_REQ_FLAG_OPTION                BIT(6)
+
+#define ISO15693_REQ_FLAG_SPEED_MASK \
+                (ISO15693_REQ_FLAG_SUB_CARRIER | ISO15693_REQ_FLAG_DATA_RATE)
+
+enum trf7970a_state {
+        TRF7970A_ST_OFF,
+        TRF7970A_ST_IDLE,
+        TRF7970A_ST_IDLE_RX_BLOCKED,
+        TRF7970A_ST_WAIT_FOR_TX_FIFO,
+        TRF7970A_ST_WAIT_FOR_RX_DATA,
+        TRF7970A_ST_WAIT_FOR_RX_DATA_CONT,
+        TRF7970A_ST_WAIT_TO_ISSUE_EOF,
+        TRF7970A_ST_MAX
+};
+
+struct trf7970a {
+        enum trf7970a_state             state;
+        struct device                   *dev;
+        struct spi_device               *spi;
+        struct regulator                *regulator;
+        struct nfc_digital_dev          *ddev;
+        u32                             quirks;
+        bool                            powering_up;
+        bool                            aborting;
+        struct sk_buff                  *tx_skb;
+        struct sk_buff                  *rx_skb;
+        nfc_digital_cmd_complete_t      cb;
+        void                            *cb_arg;
+        u8                              iso_ctrl;
+        u8                              special_fcn_reg1;
+        int                             technology;
+        int                             framing;
+        u8                              tx_cmd;
+        bool                            issue_eof;
+        int                             en2_gpio;
+        int                             en_gpio;
+        struct mutex                    lock;
+        unsigned int                    timeout;
+        bool                            ignore_timeout;
+        struct delayed_work             timeout_work;
+};
+
+
+static int trf7970a_cmd(struct trf7970a *trf, u8 opcode)
+{
+        u8 cmd = TRF7970A_CMD_BIT_CTRL | TRF7970A_CMD_BIT_OPCODE(opcode);
+        int ret;
+
+        dev_dbg(trf->dev, "cmd: 0x%x\n", cmd);
+
+        ret = spi_write(trf->spi, &cmd, 1);
+        if (ret)
+                dev_err(trf->dev, "%s - cmd: 0x%x, ret: %d\n", __func__, cmd,
+                                ret);
+        return ret;
+}
+
+static int trf7970a_read(struct trf7970a *trf, u8 reg, u8 *val)
+{
+        u8 addr = TRF7970A_CMD_BIT_RW | reg;
+        int ret;
+
+        ret = spi_write_then_read(trf->spi, &addr, 1, val, 1);
+        if (ret)
+                dev_err(trf->dev, "%s - addr: 0x%x, ret: %d\n", __func__, addr,
+                                ret);
+
+        dev_dbg(trf->dev, "read(0x%x): 0x%x\n", addr, *val);
+
+        return ret;
+}
+
+static int trf7970a_read_cont(struct trf7970a *trf, u8 reg,
+                u8 *buf, size_t len)
+{
+        u8 addr = reg | TRF7970A_CMD_BIT_RW | TRF7970A_CMD_BIT_CONTINUOUS;
+        int ret;
+
+        dev_dbg(trf->dev, "read_cont(0x%x, %zd)\n", addr, len);
+
+        ret = spi_write_then_read(trf->spi, &addr, 1, buf, len);
+        if (ret)
+                dev_err(trf->dev, "%s - addr: 0x%x, ret: %d\n", __func__, addr,
+                                ret);
+        return ret;
+}
+
+static int trf7970a_write(struct trf7970a *trf, u8 reg, u8 val)
+{
+        u8 buf[2] = { reg, val };
+        int ret;
+
+        dev_dbg(trf->dev, "write(0x%x): 0x%x\n", reg, val);
+
+        ret = spi_write(trf->spi, buf, 2);
+        if (ret)
+                dev_err(trf->dev, "%s - write: 0x%x 0x%x, ret: %d\n", __func__,
+                                buf[0], buf[1], ret);
+
+        return ret;
+}
+
+static int trf7970a_read_irqstatus(struct trf7970a *trf, u8 *status)
+{
+        int ret;
+        u8 buf[2];
+        u8 addr;
+
+        addr = TRF7970A_IRQ_STATUS | TRF7970A_CMD_BIT_RW;
+
+        if (trf->quirks & TRF7970A_QUIRK_IRQ_STATUS_READ_ERRATA) {
+                addr |= TRF7970A_CMD_BIT_CONTINUOUS;
+                ret = spi_write_then_read(trf->spi, &addr, 1, buf, 2);
+        } else {
+                ret = spi_write_then_read(trf->spi, &addr, 1, buf, 1);
+        }
+
+        if (ret)
+                dev_err(trf->dev, "%s - irqstatus: Status read failed: %d\n",
+                                __func__, ret);
+        else
+                *status = buf[0];
+
+        return ret;
+}
+
+static void trf7970a_send_upstream(struct trf7970a *trf)
+{
+        u8 rssi;
+
+        dev_kfree_skb_any(trf->tx_skb);
+        trf->tx_skb = NULL;
+
+        if (trf->rx_skb && !IS_ERR(trf->rx_skb) && !trf->aborting)
+                print_hex_dump_debug("trf7970a rx data: ", DUMP_PREFIX_NONE,
+                                16, 1, trf->rx_skb->data, trf->rx_skb->len,
+                                false);
+
+        /* According to the manual it is "good form" to reset the fifo and
+         * read the RSSI levels & oscillator status register here.  It doesn't
+         * explain why.
+         */
+        trf7970a_cmd(trf, TRF7970A_CMD_FIFO_RESET);
+        trf7970a_read(trf, TRF7970A_RSSI_OSC_STATUS, &rssi);
+
+        trf->state = TRF7970A_ST_IDLE;
+
+        if (trf->aborting) {
+                dev_dbg(trf->dev, "Abort process complete\n");
+
+                if (!IS_ERR(trf->rx_skb)) {
+                        kfree_skb(trf->rx_skb);
+                        trf->rx_skb = ERR_PTR(-ECANCELED);
+                }
+
+                trf->aborting = false;
+        }
+
+        trf->cb(trf->ddev, trf->cb_arg, trf->rx_skb);
+
+        trf->rx_skb = NULL;
+}
+
+static void trf7970a_send_err_upstream(struct trf7970a *trf, int errno)
+{
+        dev_dbg(trf->dev, "Error - state: %d, errno: %d\n", trf->state, errno);
+
+        kfree_skb(trf->rx_skb);
+        trf->rx_skb = ERR_PTR(errno);
+
+        trf7970a_send_upstream(trf);
+}
+
+static int trf7970a_transmit(struct trf7970a *trf, struct sk_buff *skb,
+                unsigned int len)
+{
+        unsigned int timeout;
+        int ret;
+
+        print_hex_dump_debug("trf7970a tx data: ", DUMP_PREFIX_NONE,
+                        16, 1, skb->data, len, false);
+
+        ret = spi_write(trf->spi, skb->data, len);
+        if (ret) {
+                dev_err(trf->dev, "%s - Can't send tx data: %d\n", __func__,
+                                ret);
+                return ret;
+        }
+
+        skb_pull(skb, len);
+
+        if (skb->len > 0) {
+                trf->state = TRF7970A_ST_WAIT_FOR_TX_FIFO;
+                timeout = TRF7970A_WAIT_FOR_FIFO_DRAIN_TIMEOUT;
+        } else {
+                if (trf->issue_eof) {
+                        trf->state = TRF7970A_ST_WAIT_TO_ISSUE_EOF;
+                        timeout = TRF7970A_WAIT_TO_ISSUE_ISO15693_EOF;
+                } else {
+                        trf->state = TRF7970A_ST_WAIT_FOR_RX_DATA;
+                        timeout = trf->timeout;
+                }
+        }
+
+        dev_dbg(trf->dev, "Setting timeout for %d ms, state: %d\n", timeout,
+                        trf->state);
+
+        schedule_delayed_work(&trf->timeout_work, msecs_to_jiffies(timeout));
+
+        return 0;
+}
+
+static void trf7970a_fill_fifo(struct trf7970a *trf)
+{
+        struct sk_buff *skb = trf->tx_skb;
+        unsigned int len;
+        int ret;
+        u8 fifo_bytes;
+
+        ret = trf7970a_read(trf, TRF7970A_FIFO_STATUS, &fifo_bytes);
+        if (ret) {
+                trf7970a_send_err_upstream(trf, ret);
+                return;
+        }
+
+        dev_dbg(trf->dev, "Filling FIFO - fifo_bytes: 0x%x\n", fifo_bytes);
+
+        if (fifo_bytes & TRF7970A_FIFO_STATUS_OVERFLOW) {
+                dev_err(trf->dev, "%s - fifo overflow: 0x%x\n", __func__,
+                                fifo_bytes);
+                trf7970a_send_err_upstream(trf, -EIO);
+                return;
+        }
+
+        /* Calculate how much more data can be written to the fifo */
+        len = TRF7970A_FIFO_SIZE - fifo_bytes;
+        len = min(skb->len, len);
+
+        ret = trf7970a_transmit(trf, skb, len);
+        if (ret)
+                trf7970a_send_err_upstream(trf, ret);
+}
+
+static void trf7970a_drain_fifo(struct trf7970a *trf, u8 status)
+{
+        struct sk_buff *skb = trf->rx_skb;
+        int ret;
+        u8 fifo_bytes;
+
+        if (status & TRF7970A_IRQ_STATUS_ERROR) {
+                trf7970a_send_err_upstream(trf, -EIO);
+                return;
+        }
+
+        ret = trf7970a_read(trf, TRF7970A_FIFO_STATUS, &fifo_bytes);
+        if (ret) {
+                trf7970a_send_err_upstream(trf, ret);
+                return;
+        }
+
+        dev_dbg(trf->dev, "Draining FIFO - fifo_bytes: 0x%x\n", fifo_bytes);
+
+        if (!fifo_bytes)
+                goto no_rx_data;
+
+        if (fifo_bytes & TRF7970A_FIFO_STATUS_OVERFLOW) {
+                dev_err(trf->dev, "%s - fifo overflow: 0x%x\n", __func__,
+                                fifo_bytes);
+                trf7970a_send_err_upstream(trf, -EIO);
+                return;
+        }
+
+        if (fifo_bytes > skb_tailroom(skb)) {
+                skb = skb_copy_expand(skb, skb_headroom(skb),
+                                max_t(int, fifo_bytes,
+                                        TRF7970A_RX_SKB_ALLOC_SIZE),
+                                GFP_KERNEL);
+                if (!skb) {
+                        trf7970a_send_err_upstream(trf, -ENOMEM);
+                        return;
+                }
+
+                kfree_skb(trf->rx_skb);
+                trf->rx_skb = skb;
+        }
+
+        ret = trf7970a_read_cont(trf, TRF7970A_FIFO_IO_REGISTER,
+                        skb_put(skb, fifo_bytes), fifo_bytes);
+        if (ret) {
+                trf7970a_send_err_upstream(trf, ret);
+                return;
+        }
+
+        /* If received Type 2 ACK/NACK, shift right 4 bits and pass up */
+        if ((trf->framing == NFC_DIGITAL_FRAMING_NFCA_T2T) && (skb->len == 1) &&
+                        (trf->special_fcn_reg1 ==
+                                 TRF7970A_SPECIAL_FCN_REG1_4_BIT_RX)) {
+                skb->data[0] >>= 4;
+                status = TRF7970A_IRQ_STATUS_SRX;
+        } else {
+                trf->state = TRF7970A_ST_WAIT_FOR_RX_DATA_CONT;
+        }
+
+no_rx_data:
+        if (status == TRF7970A_IRQ_STATUS_SRX) { /* Receive complete */
+                trf7970a_send_upstream(trf);
+                return;
+        }
+
+        dev_dbg(trf->dev, "Setting timeout for %d ms\n",
+                        TRF7970A_WAIT_FOR_RX_DATA_TIMEOUT);
+
+        schedule_delayed_work(&trf->timeout_work,
+                        msecs_to_jiffies(TRF7970A_WAIT_FOR_RX_DATA_TIMEOUT));
+}
+
+static irqreturn_t trf7970a_irq(int irq, void *dev_id)
+{
+        struct trf7970a *trf = dev_id;
+        int ret;
+        u8 status;
+
+        mutex_lock(&trf->lock);
+
+        if (trf->state == TRF7970A_ST_OFF) {
+                mutex_unlock(&trf->lock);
+                return IRQ_NONE;
+        }
+
+        ret = trf7970a_read_irqstatus(trf, &status);
+        if (ret) {
+                mutex_unlock(&trf->lock);
+                return IRQ_NONE;
+        }
+
+        dev_dbg(trf->dev, "IRQ - state: %d, status: 0x%x\n", trf->state,
+                        status);
+
+        if (!status) {
+                mutex_unlock(&trf->lock);
+                return IRQ_NONE;
+        }
+
+        switch (trf->state) {
+        case TRF7970A_ST_IDLE:
+        case TRF7970A_ST_IDLE_RX_BLOCKED:
+                /* If getting interrupts caused by RF noise, turn off the
+                 * receiver to avoid unnecessary interrupts.  It will be
+                 * turned back on in trf7970a_in_send_cmd() when the next
+                 * command is issued.
+                 */
+                if (status & TRF7970A_IRQ_STATUS_ERROR) {
+                        trf7970a_cmd(trf, TRF7970A_CMD_BLOCK_RX);
+                        trf->state = TRF7970A_ST_IDLE_RX_BLOCKED;
+                }
+
+                trf7970a_cmd(trf, TRF7970A_CMD_FIFO_RESET);
+                break;
+        case TRF7970A_ST_WAIT_FOR_TX_FIFO:
+                if (status & TRF7970A_IRQ_STATUS_TX) {
+                        trf->ignore_timeout =
+                                !cancel_delayed_work(&trf->timeout_work);
+                        trf7970a_fill_fifo(trf);
+                } else {
+                        trf7970a_send_err_upstream(trf, -EIO);
+                }
+                break;
+        case TRF7970A_ST_WAIT_FOR_RX_DATA:
+        case TRF7970A_ST_WAIT_FOR_RX_DATA_CONT:
+                if (status & TRF7970A_IRQ_STATUS_SRX) {
+                        trf->ignore_timeout =
+                                !cancel_delayed_work(&trf->timeout_work);
+                        trf7970a_drain_fifo(trf, status);
+                } else if (!(status & TRF7970A_IRQ_STATUS_TX)) {
+                        trf7970a_send_err_upstream(trf, -EIO);
+                }
+                break;
+        case TRF7970A_ST_WAIT_TO_ISSUE_EOF:
+                if (status != TRF7970A_IRQ_STATUS_TX)
+                        trf7970a_send_err_upstream(trf, -EIO);
+                break;
+        default:
+                dev_err(trf->dev, "%s - Driver in invalid state: %d\n",
+                                __func__, trf->state);
+        }
+
+        mutex_unlock(&trf->lock);
+        return IRQ_HANDLED;
+}
+
+static void trf7970a_issue_eof(struct trf7970a *trf)
+{
+        int ret;
+
+        dev_dbg(trf->dev, "Issuing EOF\n");
+
+        ret = trf7970a_cmd(trf, TRF7970A_CMD_FIFO_RESET);
+        if (ret)
+                trf7970a_send_err_upstream(trf, ret);
+
+        ret = trf7970a_cmd(trf, TRF7970A_CMD_EOF);
+        if (ret)
+                trf7970a_send_err_upstream(trf, ret);
+
+        trf->state = TRF7970A_ST_WAIT_FOR_RX_DATA;
+
+        dev_dbg(trf->dev, "Setting timeout for %d ms, state: %d\n",
+                        trf->timeout, trf->state);
+
+        schedule_delayed_work(&trf->timeout_work,
+                        msecs_to_jiffies(trf->timeout));
+}
+
+static void trf7970a_timeout_work_handler(struct work_struct *work)
+{
+        struct trf7970a *trf = container_of(work, struct trf7970a,
+                        timeout_work.work);
+
+        dev_dbg(trf->dev, "Timeout - state: %d, ignore_timeout: %d\n",
+                        trf->state, trf->ignore_timeout);
+
+        mutex_lock(&trf->lock);
+
+        if (trf->ignore_timeout)
+                trf->ignore_timeout = false;
+        else if (trf->state == TRF7970A_ST_WAIT_FOR_RX_DATA_CONT)
+                trf7970a_send_upstream(trf); /* No more rx data so send up */
+        else if (trf->state == TRF7970A_ST_WAIT_TO_ISSUE_EOF)
+                trf7970a_issue_eof(trf);
+        else
+                trf7970a_send_err_upstream(trf, -ETIMEDOUT);
+
+        mutex_unlock(&trf->lock);
+}
+
+static int trf7970a_init(struct trf7970a *trf)
+{
+        int ret;
+
+        dev_dbg(trf->dev, "Initializing device - state: %d\n", trf->state);
+
+        ret = trf7970a_cmd(trf, TRF7970A_CMD_SOFT_INIT);
+        if (ret)
+                goto err_out;
+
+        ret = trf7970a_cmd(trf, TRF7970A_CMD_IDLE);
+        if (ret)
+                goto err_out;
+
+        ret = trf7970a_write(trf, TRF7970A_MODULATOR_SYS_CLK_CTRL,
+                        TRF7970A_MODULATOR_DEPTH_OOK);
+        if (ret)
+                goto err_out;
+
+        ret = trf7970a_write(trf, TRF7970A_ADJUTABLE_FIFO_IRQ_LEVELS,
+                        TRF7970A_ADJUTABLE_FIFO_IRQ_LEVELS_WLH_96 |
+                        TRF7970A_ADJUTABLE_FIFO_IRQ_LEVELS_WLL_32);
+        if (ret)
+                goto err_out;
+
+        ret = trf7970a_write(trf, TRF7970A_SPECIAL_FCN_REG1, 0);
+        if (ret)
+                goto err_out;
+
+        trf->special_fcn_reg1 = 0;
+
+        ret = trf7970a_write(trf, TRF7970A_CHIP_STATUS_CTRL,
+                        TRF7970A_CHIP_STATUS_RF_ON |
+                                TRF7970A_CHIP_STATUS_VRS5_3);
+        if (ret)
+                goto err_out;
+
+        return 0;
+
+err_out:
+        dev_dbg(trf->dev, "Couldn't init device: %d\n", ret);
+        return ret;
+}
+
+static void trf7970a_switch_rf_off(struct trf7970a *trf)
+{
+        dev_dbg(trf->dev, "Switching rf off\n");
+
+        gpio_set_value(trf->en_gpio, 0);
+        gpio_set_value(trf->en2_gpio, 0);
+
+        trf->aborting = false;
+        trf->state = TRF7970A_ST_OFF;
+}
+
+static int trf7970a_switch_rf_on(struct trf7970a *trf)
+{
+        unsigned long delay;
+        int ret;
+
+        dev_dbg(trf->dev, "Switching rf on\n");
+
+        if (trf->powering_up)
+                usleep_range(5000, 6000);
+
+        gpio_set_value(trf->en2_gpio, 1);
+        usleep_range(1000, 2000);
+        gpio_set_value(trf->en_gpio, 1);
+
+        /* The delay between enabling the trf7970a and issuing the first
+         * command is significantly longer the very first time after powering
+         * up.  Make sure the longer delay is only done the first time.
+         */
+        if (trf->powering_up) {
+                delay = 20000;
+                trf->powering_up = false;
+        } else {
+                delay = 5000;
+        }
+
+        usleep_range(delay, delay + 1000);
+
+        ret = trf7970a_init(trf);
+        if (ret)
+                trf7970a_switch_rf_off(trf);
+        else
+                trf->state = TRF7970A_ST_IDLE;
+
+        return ret;
+}
+
+static int trf7970a_switch_rf(struct nfc_digital_dev *ddev, bool on)
+{
+        struct trf7970a *trf = nfc_digital_get_drvdata(ddev);
+        int ret = 0;
+
+        dev_dbg(trf->dev, "Switching RF - state: %d, on: %d\n", trf->state, on);
+
+        mutex_lock(&trf->lock);
+
+        if (on) {
+                switch (trf->state) {
+                case TRF7970A_ST_OFF:
+                        ret = trf7970a_switch_rf_on(trf);
+                        break;
+                case TRF7970A_ST_IDLE:
+                case TRF7970A_ST_IDLE_RX_BLOCKED:
+                        break;
+                default:
+                        dev_err(trf->dev, "%s - Invalid request: %d %d\n",
+                                        __func__, trf->state, on);
+                        trf7970a_switch_rf_off(trf);
+                }
+        } else {
+                switch (trf->state) {
+                case TRF7970A_ST_OFF:
+                        break;
+                default:
+                        dev_err(trf->dev, "%s - Invalid request: %d %d\n",
+                                        __func__, trf->state, on);
+                        /* FALLTHROUGH */
+                case TRF7970A_ST_IDLE:
+                case TRF7970A_ST_IDLE_RX_BLOCKED:
+                        trf7970a_switch_rf_off(trf);
+                }
+        }
+
+        mutex_unlock(&trf->lock);
+        return ret;
+}
+
+static int trf7970a_config_rf_tech(struct trf7970a *trf, int tech)
+{
+        int ret = 0;
+
+        dev_dbg(trf->dev, "rf technology: %d\n", tech);
+
+        switch (tech) {
+        case NFC_DIGITAL_RF_TECH_106A:
+                trf->iso_ctrl = TRF7970A_ISO_CTRL_14443A_106;
+                break;
+        case NFC_DIGITAL_RF_TECH_ISO15693:
+                trf->iso_ctrl = TRF7970A_ISO_CTRL_15693_SGL_1OF4_2648;
+                break;
+        default:
+                dev_dbg(trf->dev, "Unsupported rf technology: %d\n", tech);
+                return -EINVAL;
+        }
+
+        trf->technology = tech;
+
+        return ret;
+}
+
+static int trf7970a_config_framing(struct trf7970a *trf, int framing)
+{
+        dev_dbg(trf->dev, "framing: %d\n", framing);
+
+        switch (framing) {
+        case NFC_DIGITAL_FRAMING_NFCA_SHORT:
+        case NFC_DIGITAL_FRAMING_NFCA_STANDARD:
+                trf->tx_cmd = TRF7970A_CMD_TRANSMIT_NO_CRC;
+                trf->iso_ctrl |= TRF7970A_ISO_CTRL_RX_CRC_N;
+                break;
+        case NFC_DIGITAL_FRAMING_NFCA_STANDARD_WITH_CRC_A:
+        case NFC_DIGITAL_FRAMING_NFCA_T4T:
+        case NFC_DIGITAL_FRAMING_ISO15693_INVENTORY:
+        case NFC_DIGITAL_FRAMING_ISO15693_T5T:
+                trf->tx_cmd = TRF7970A_CMD_TRANSMIT;
+                trf->iso_ctrl &= ~TRF7970A_ISO_CTRL_RX_CRC_N;
+                break;
+        case NFC_DIGITAL_FRAMING_NFCA_T2T:
+                trf->tx_cmd = TRF7970A_CMD_TRANSMIT;
+                trf->iso_ctrl |= TRF7970A_ISO_CTRL_RX_CRC_N;
+                break;
+        default:
+                dev_dbg(trf->dev, "Unsupported Framing: %d\n", framing);
+                return -EINVAL;
+        }
+
+        trf->framing = framing;
+
+        return trf7970a_write(trf, TRF7970A_ISO_CTRL, trf->iso_ctrl);
+}
+
+static int trf7970a_in_configure_hw(struct nfc_digital_dev *ddev, int type,
+                int param)
+{
+        struct trf7970a *trf = nfc_digital_get_drvdata(ddev);
+        int ret = 0;
+
+        dev_dbg(trf->dev, "Configure hw - type: %d, param: %d\n", type, param);
+
+        mutex_lock(&trf->lock);
+
+        if (trf->state == TRF7970A_ST_OFF) {
+                ret = trf7970a_switch_rf_on(trf);
+                if (ret)
+                        goto err_out;
+        }
+
+        switch (type) {
+        case NFC_DIGITAL_CONFIG_RF_TECH:
+                ret = trf7970a_config_rf_tech(trf, param);
+                break;
+        case NFC_DIGITAL_CONFIG_FRAMING:
+                ret = trf7970a_config_framing(trf, param);
+                break;
+        default:
+                dev_dbg(trf->dev, "Unknown type: %d\n", type);
+                ret = -EINVAL;
+        }
+
+err_out:
+        mutex_unlock(&trf->lock);
+        return ret;
+}
+
+static int trf7970a_is_iso15693_write_or_lock(u8 cmd)
+{
+        switch (cmd) {
+        case ISO15693_CMD_WRITE_SINGLE_BLOCK:
+        case ISO15693_CMD_LOCK_BLOCK:
+        case ISO15693_CMD_WRITE_MULTIPLE_BLOCK:
+        case ISO15693_CMD_WRITE_AFI:
+        case ISO15693_CMD_LOCK_AFI:
+        case ISO15693_CMD_WRITE_DSFID:
+        case ISO15693_CMD_LOCK_DSFID:
+                return 1;
+                break;
+        default:
+                return 0;
+        }
+}
+
+static int trf7970a_per_cmd_config(struct trf7970a *trf, struct sk_buff *skb)
+{
+        u8 *req = skb->data;
+        u8 special_fcn_reg1, iso_ctrl;
+        int ret;
+
+        trf->issue_eof = false;
+
+        /* When issuing Type 2 read command, make sure the '4_bit_RX' bit in
+         * special functions register 1 is cleared; otherwise, its a write or
+         * sector select command and '4_bit_RX' must be set.
+         *
+         * When issuing an ISO 15693 command, inspect the flags byte to see
+         * what speed to use.  Also, remember if the OPTION flag is set on
+         * a Type 5 write or lock command so the driver will know that it
+         * has to send an EOF in order to get a response.
+         */
+        if ((trf->technology == NFC_DIGITAL_RF_TECH_106A) &&
+                        (trf->framing == NFC_DIGITAL_FRAMING_NFCA_T2T)) {
+                if (req[0] == NFC_T2T_CMD_READ)
+                        special_fcn_reg1 = 0;
+                else
+                        special_fcn_reg1 = TRF7970A_SPECIAL_FCN_REG1_4_BIT_RX;
+
+                if (special_fcn_reg1 != trf->special_fcn_reg1) {
+                        ret = trf7970a_write(trf, TRF7970A_SPECIAL_FCN_REG1,
+                                        special_fcn_reg1);
+                        if (ret)
+                                return ret;
+
+                        trf->special_fcn_reg1 = special_fcn_reg1;
+                }
+        } else if (trf->technology == NFC_DIGITAL_RF_TECH_ISO15693) {
+                iso_ctrl = trf->iso_ctrl & ~TRF7970A_ISO_CTRL_RFID_SPEED_MASK;
+
+                switch (req[0] & ISO15693_REQ_FLAG_SPEED_MASK) {
+                case 0x00:
+                        iso_ctrl |= TRF7970A_ISO_CTRL_15693_SGL_1OF4_662;
+                        break;
+                case ISO15693_REQ_FLAG_SUB_CARRIER:
+                        iso_ctrl |= TRF7970A_ISO_CTRL_15693_DBL_1OF4_667a;
+                        break;
+                case ISO15693_REQ_FLAG_DATA_RATE:
+                        iso_ctrl |= TRF7970A_ISO_CTRL_15693_SGL_1OF4_2648;
+                        break;
+                case (ISO15693_REQ_FLAG_SUB_CARRIER |
+                                ISO15693_REQ_FLAG_DATA_RATE):
+                        iso_ctrl |= TRF7970A_ISO_CTRL_15693_DBL_1OF4_2669;
+                        break;
+                }
+
+                if (iso_ctrl != trf->iso_ctrl) {
+                        ret = trf7970a_write(trf, TRF7970A_ISO_CTRL, iso_ctrl);
+                        if (ret)
+                                return ret;
+
+                        trf->iso_ctrl = iso_ctrl;
+                }
+
+                if ((trf->framing == NFC_DIGITAL_FRAMING_ISO15693_T5T) &&
+                                trf7970a_is_iso15693_write_or_lock(req[1]) &&
+                                (req[0] & ISO15693_REQ_FLAG_OPTION))
+                        trf->issue_eof = true;
+        }
+
+        return 0;
+}
+
+static int trf7970a_in_send_cmd(struct nfc_digital_dev *ddev,
+                struct sk_buff *skb, u16 timeout,
+                nfc_digital_cmd_complete_t cb, void *arg)
+{
+        struct trf7970a *trf = nfc_digital_get_drvdata(ddev);
+        char *prefix;
+        unsigned int len;
+        int ret;
+
+        dev_dbg(trf->dev, "New request - state: %d, timeout: %d ms, len: %d\n",
+                        trf->state, timeout, skb->len);
+
+        if (skb->len > TRF7970A_TX_MAX)
+                return -EINVAL;
+
+        mutex_lock(&trf->lock);
+
+        if ((trf->state != TRF7970A_ST_IDLE) &&
+                        (trf->state != TRF7970A_ST_IDLE_RX_BLOCKED)) {
+                dev_err(trf->dev, "%s - Bogus state: %d\n", __func__,
+                                trf->state);
+                ret = -EIO;
+                goto out_err;
+        }
+
+        if (trf->aborting) {
+                dev_dbg(trf->dev, "Abort process complete\n");
+                trf->aborting = false;
+                ret = -ECANCELED;
+                goto out_err;
+        }
+
+        trf->rx_skb = nfc_alloc_recv_skb(TRF7970A_RX_SKB_ALLOC_SIZE,
+                        GFP_KERNEL);
+        if (!trf->rx_skb) {
+                dev_dbg(trf->dev, "Can't alloc rx_skb\n");
+                ret = -ENOMEM;
+                goto out_err;
+        }
+
+        if (trf->state == TRF7970A_ST_IDLE_RX_BLOCKED) {
+                ret = trf7970a_cmd(trf, TRF7970A_CMD_ENABLE_RX);
+                if (ret)
+                        goto out_err;
+
+                trf->state = TRF7970A_ST_IDLE;
+        }
+
+        ret = trf7970a_per_cmd_config(trf, skb);
+        if (ret)
+                goto out_err;
+
+        trf->ddev = ddev;
+        trf->tx_skb = skb;
+        trf->cb = cb;
+        trf->cb_arg = arg;
+        trf->timeout = timeout;
+        trf->ignore_timeout = false;
+
+        len = skb->len;
+        prefix = skb_push(skb, TRF7970A_TX_SKB_HEADROOM);
+
+        /* TX data must be prefixed with a FIFO reset cmd, a cmd that depends
+         * on what the current framing is, the address of the TX length byte 1
+         * register (0x1d), and the 2 byte length of the data to be transmitted.
+         */
+        prefix[0] = TRF7970A_CMD_BIT_CTRL |
+                        TRF7970A_CMD_BIT_OPCODE(TRF7970A_CMD_FIFO_RESET);
+        prefix[1] = TRF7970A_CMD_BIT_CTRL |
+                        TRF7970A_CMD_BIT_OPCODE(trf->tx_cmd);
+        prefix[2] = TRF7970A_CMD_BIT_CONTINUOUS | TRF7970A_TX_LENGTH_BYTE1;
+
+        if (trf->framing == NFC_DIGITAL_FRAMING_NFCA_SHORT) {
+                prefix[3] = 0x00;
+                prefix[4] = 0x0f; /* 7 bits */
+        } else {
+                prefix[3] = (len & 0xf00) >> 4;
+                prefix[3] |= ((len & 0xf0) >> 4);
+                prefix[4] = ((len & 0x0f) << 4);
+        }
+
+        len = min_t(int, skb->len, TRF7970A_FIFO_SIZE);
+
+        usleep_range(1000, 2000);
+
+        ret = trf7970a_transmit(trf, skb, len);
+        if (ret) {
+                kfree_skb(trf->rx_skb);
+                trf->rx_skb = NULL;
+        }
+
+out_err:
+        mutex_unlock(&trf->lock);
+        return ret;
+}
+
+static int trf7970a_tg_configure_hw(struct nfc_digital_dev *ddev,
+                int type, int param)
+{
+        struct trf7970a *trf = nfc_digital_get_drvdata(ddev);
+
+        dev_dbg(trf->dev, "Unsupported interface\n");
+
+        return -EINVAL;
+}
+
+static int trf7970a_tg_send_cmd(struct nfc_digital_dev *ddev,
+                struct sk_buff *skb, u16 timeout,
+                nfc_digital_cmd_complete_t cb, void *arg)
+{
+        struct trf7970a *trf = nfc_digital_get_drvdata(ddev);
+
+        dev_dbg(trf->dev, "Unsupported interface\n");
+
+        return -EINVAL;
+}
+
+static int trf7970a_tg_listen(struct nfc_digital_dev *ddev,
+                u16 timeout, nfc_digital_cmd_complete_t cb, void *arg)
+{
+        struct trf7970a *trf = nfc_digital_get_drvdata(ddev);
+
+        dev_dbg(trf->dev, "Unsupported interface\n");
+
+        return -EINVAL;
+}
+
+static int trf7970a_tg_listen_mdaa(struct nfc_digital_dev *ddev,
+                struct digital_tg_mdaa_params *mdaa_params,
+                u16 timeout, nfc_digital_cmd_complete_t cb, void *arg)
+{
+        struct trf7970a *trf = nfc_digital_get_drvdata(ddev);
+
+        dev_dbg(trf->dev, "Unsupported interface\n");
+
+        return -EINVAL;
+}
+
+static void trf7970a_abort_cmd(struct nfc_digital_dev *ddev)
+{
+        struct trf7970a *trf = nfc_digital_get_drvdata(ddev);
+
+        dev_dbg(trf->dev, "Abort process initiated\n");
+
+        mutex_lock(&trf->lock);
+        trf->aborting = true;
+        mutex_unlock(&trf->lock);
+}
+
+static struct nfc_digital_ops trf7970a_nfc_ops = {
+        .in_configure_hw        = trf7970a_in_configure_hw,
+        .in_send_cmd            = trf7970a_in_send_cmd,
+        .tg_configure_hw        = trf7970a_tg_configure_hw,
+        .tg_send_cmd            = trf7970a_tg_send_cmd,
+        .tg_listen              = trf7970a_tg_listen,
+        .tg_listen_mdaa         = trf7970a_tg_listen_mdaa,
+        .switch_rf              = trf7970a_switch_rf,
+        .abort_cmd              = trf7970a_abort_cmd,
+};
+
+static int trf7970a_probe(struct spi_device *spi)
+{
+        struct device_node *np = spi->dev.of_node;
+        const struct spi_device_id *id = spi_get_device_id(spi);
+        struct trf7970a *trf;
+        int ret;
+
+        if (!np) {
+                dev_err(&spi->dev, "No Device Tree entry\n");
+                return -EINVAL;
+        }
+
+        trf = devm_kzalloc(&spi->dev, sizeof(*trf), GFP_KERNEL);
+        if (!trf)
+                return -ENOMEM;
+
+        trf->state = TRF7970A_ST_OFF;
+        trf->dev = &spi->dev;
+        trf->spi = spi;
+        trf->quirks = id->driver_data;
+
+        spi->mode = SPI_MODE_1;
+        spi->bits_per_word = 8;
+
+        /* There are two enable pins - both must be present */
+        trf->en_gpio = of_get_named_gpio(np, "ti,enable-gpios", 0);
+        if (!gpio_is_valid(trf->en_gpio)) {
+                dev_err(trf->dev, "No EN GPIO property\n");
+                return trf->en_gpio;
+        }
+
+        ret = devm_gpio_request_one(trf->dev, trf->en_gpio,
+                        GPIOF_DIR_OUT | GPIOF_INIT_LOW, "EN");
+        if (ret) {
+                dev_err(trf->dev, "Can't request EN GPIO: %d\n", ret);
+                return ret;
+        }
+
+        trf->en2_gpio = of_get_named_gpio(np, "ti,enable-gpios", 1);
+        if (!gpio_is_valid(trf->en2_gpio)) {
+                dev_err(trf->dev, "No EN2 GPIO property\n");
+                return trf->en2_gpio;
+        }
+
+        ret = devm_gpio_request_one(trf->dev, trf->en2_gpio,
+                        GPIOF_DIR_OUT | GPIOF_INIT_LOW, "EN2");
+        if (ret) {
+                dev_err(trf->dev, "Can't request EN2 GPIO: %d\n", ret);
+                return ret;
+        }
+
+        ret = devm_request_threaded_irq(trf->dev, spi->irq, NULL,
+                        trf7970a_irq, IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+                        "trf7970a", trf);
+        if (ret) {
+                dev_err(trf->dev, "Can't request IRQ#%d: %d\n", spi->irq, ret);
+                return ret;
+        }
+
+        mutex_init(&trf->lock);
+        INIT_DELAYED_WORK(&trf->timeout_work, trf7970a_timeout_work_handler);
+
+        trf->regulator = devm_regulator_get(&spi->dev, "vin");
+        if (IS_ERR(trf->regulator)) {
+                ret = PTR_ERR(trf->regulator);
+                dev_err(trf->dev, "Can't get VIN regulator: %d\n", ret);
+                goto err_destroy_lock;
+        }
+
+        ret = regulator_enable(trf->regulator);
+        if (ret) {
+                dev_err(trf->dev, "Can't enable VIN: %d\n", ret);
+                goto err_destroy_lock;
+        }
+
+        trf->powering_up = true;
+
+        trf->ddev = nfc_digital_allocate_device(&trf7970a_nfc_ops,
+                        TRF7970A_SUPPORTED_PROTOCOLS,
+                        NFC_DIGITAL_DRV_CAPS_IN_CRC, TRF7970A_TX_SKB_HEADROOM,
+                        0);
+        if (!trf->ddev) {
+                dev_err(trf->dev, "Can't allocate NFC digital device\n");
+                ret = -ENOMEM;
+                goto err_disable_regulator;
+        }
+
+        nfc_digital_set_parent_dev(trf->ddev, trf->dev);
+        nfc_digital_set_drvdata(trf->ddev, trf);
+        spi_set_drvdata(spi, trf);
+
+        ret = nfc_digital_register_device(trf->ddev);
+        if (ret) {
+                dev_err(trf->dev, "Can't register NFC digital device: %d\n",
+                                ret);
+                goto err_free_ddev;
+        }
+
+        return 0;
+
+err_free_ddev:
+        nfc_digital_free_device(trf->ddev);
+err_disable_regulator:
+        regulator_disable(trf->regulator);
+err_destroy_lock:
+        mutex_destroy(&trf->lock);
+        return ret;
+}
+
+static int trf7970a_remove(struct spi_device *spi)
+{
+        struct trf7970a *trf = spi_get_drvdata(spi);
+
+        mutex_lock(&trf->lock);
+
+        trf7970a_switch_rf_off(trf);
+        trf7970a_init(trf);
+
+        switch (trf->state) {
+        case TRF7970A_ST_WAIT_FOR_TX_FIFO:
+        case TRF7970A_ST_WAIT_FOR_RX_DATA:
+        case TRF7970A_ST_WAIT_FOR_RX_DATA_CONT:
+        case TRF7970A_ST_WAIT_TO_ISSUE_EOF:
+                trf7970a_send_err_upstream(trf, -ECANCELED);
+                break;
+        default:
+                break;
+        }
+
+        mutex_unlock(&trf->lock);
+
+        nfc_digital_unregister_device(trf->ddev);
+        nfc_digital_free_device(trf->ddev);
+
+        regulator_disable(trf->regulator);
+
+        mutex_destroy(&trf->lock);
+
+        return 0;
+}
+
+static const struct spi_device_id trf7970a_id_table[] = {
+        { "trf7970a", TRF7970A_QUIRK_IRQ_STATUS_READ_ERRATA },
+        { }
+};
+MODULE_DEVICE_TABLE(spi, trf7970a_id_table);
+
+static struct spi_driver trf7970a_spi_driver = {
+        .probe          = trf7970a_probe,
+        .remove         = trf7970a_remove,
+        .id_table       = trf7970a_id_table,
+        .driver         = {
+                .name   = "trf7970a",
+                .owner  = THIS_MODULE,
+        },
+};
+
+module_spi_driver(trf7970a_spi_driver);
+
+MODULE_AUTHOR("Mark A. Greer <mgreer@animalcreek.com>");
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION("TI trf7970a RFID/NFC Transceiver Driver");
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 06299048c4f4..f194ccb8539c 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -154,6 +154,10 @@ static inline u16 ieee80211_sn_sub(u16 sn1, u16 sn2)
    802.11e clarifies the figure in section 7.1.2. The frame body is
    up to 2304 octets long (maximum MSDU size) plus any crypt overhead. */
 #define IEEE80211_MAX_DATA_LEN          2304
+/* 802.11ad extends maximum MSDU size for DMG (freq > 40Ghz) networks
+ * to 7920 bytes, see 8.2.3 General frame format
+ */
+#define IEEE80211_MAX_DATA_LEN_DMG      7920
 /* 30 byte 4 addr hdr, 2 byte QoS, 2304 byte MSDU, 12 byte crypt, 4 byte FCS */
 #define IEEE80211_MAX_FRAME_LEN         2352
 
diff --git a/include/linux/mmc/sdio_ids.h b/include/linux/mmc/sdio_ids.h
index d8836623f36a..0f01fe065424 100644
--- a/include/linux/mmc/sdio_ids.h
+++ b/include/linux/mmc/sdio_ids.h
@@ -31,6 +31,7 @@
 #define SDIO_DEVICE_ID_BROADCOM_4334            0x4334
 #define SDIO_DEVICE_ID_BROADCOM_4335_4339       0x4335
 #define SDIO_DEVICE_ID_BROADCOM_43362           43362
+#define SDIO_DEVICE_ID_BROADCOM_4354            0x4354
 
 #define SDIO_VENDOR_ID_INTEL                    0x0089
 #define SDIO_DEVICE_ID_INTEL_IWMC3200WIMAX      0x1402
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index dbb788e4f265..b8cc39a4a9a5 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -91,6 +91,13 @@ struct bt_uuid {
         u8 svc_hint;
 };
 
+struct smp_csrk {
+        bdaddr_t bdaddr;
+        u8 bdaddr_type;
+        u8 master;
+        u8 val[16];
+};
+
 struct smp_ltk {
         struct list_head list;
         bdaddr_t bdaddr;
@@ -1263,8 +1270,10 @@ void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
 void mgmt_discovering(struct hci_dev *hdev, u8 discovering);
 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
-void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key);
+void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent);
 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk);
+void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
+                   bool persistent);
 void mgmt_reenable_advertising(struct hci_dev *hdev);
 void mgmt_smp_complete(struct hci_conn *conn, bool complete);
 
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index 0326648fd799..d4b571c2f9fd 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -551,3 +551,15 @@ struct mgmt_ev_new_irk {
         bdaddr_t rpa;
         struct mgmt_irk_info irk;
 } __packed;
+
+struct mgmt_csrk_info {
+        struct mgmt_addr_info addr;
+        __u8 master;
+        __u8 val[16];
+} __packed;
+
+#define MGMT_EV_NEW_CSRK                0x0019
+struct mgmt_ev_new_csrk {
+        __u8 store_hint;
+        struct mgmt_csrk_info key;
+} __packed;
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 8c9ba44fb7cf..f3539a15c411 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -151,6 +151,7 @@ enum ieee80211_channel_flags {
  * @dfs_state: current state of this channel. Only relevant if radar is required
  *      on this channel.
  * @dfs_state_entered: timestamp (jiffies) when the dfs state was entered.
+ * @dfs_cac_ms: DFS CAC time in milliseconds, this is valid for DFS channels.
  */
 struct ieee80211_channel {
         enum ieee80211_band band;
@@ -165,6 +166,7 @@ struct ieee80211_channel {
         int orig_mag, orig_mpwr;
         enum nl80211_dfs_state dfs_state;
         unsigned long dfs_state_entered;
+        unsigned int dfs_cac_ms;
 };
 
 /**
@@ -2503,7 +2505,8 @@ struct cfg80211_ops {
 
         int     (*start_radar_detection)(struct wiphy *wiphy,
                                          struct net_device *dev,
-                                         struct cfg80211_chan_def *chandef);
+                                         struct cfg80211_chan_def *chandef,
+                                         u32 cac_time_ms);
         int     (*update_ft_ies)(struct wiphy *wiphy, struct net_device *dev,
                                  struct cfg80211_update_ft_ies_params *ftie);
         int     (*crit_proto_start)(struct wiphy *wiphy,
@@ -3180,6 +3183,7 @@ struct cfg80211_cached_keys;
  * @p2p_started: true if this is a P2P Device that has been started
  * @cac_started: true if DFS channel availability check has been started
  * @cac_start_time: timestamp (jiffies) when the dfs state was entered.
+ * @cac_time_ms: CAC time in ms
  * @ps: powersave mode is enabled
  * @ps_timeout: dynamic powersave timeout
  * @ap_unexpected_nlportid: (private) netlink port ID of application
@@ -3235,6 +3239,7 @@ struct wireless_dev {
 
         bool cac_started;
         unsigned long cac_start_time;
+        unsigned int cac_time_ms;
 
 #ifdef CONFIG_CFG80211_WEXT
         /* wext data */
@@ -3667,7 +3672,7 @@ void cfg80211_sched_scan_stopped(struct wiphy *wiphy);
  * cfg80211_inform_bss_width_frame - inform cfg80211 of a received BSS frame
  *
  * @wiphy: the wiphy reporting the BSS
- * @channel: The channel the frame was received on
+ * @rx_channel: The channel the frame was received on
  * @scan_width: width of the control channel
  * @mgmt: the management frame (probe response or beacon)
  * @len: length of the management frame
@@ -3682,18 +3687,18 @@ void cfg80211_sched_scan_stopped(struct wiphy *wiphy);
  */
 struct cfg80211_bss * __must_check
 cfg80211_inform_bss_width_frame(struct wiphy *wiphy,
-                                struct ieee80211_channel *channel,
+                                struct ieee80211_channel *rx_channel,
                                 enum nl80211_bss_scan_width scan_width,
                                 struct ieee80211_mgmt *mgmt, size_t len,
                                 s32 signal, gfp_t gfp);
 
 static inline struct cfg80211_bss * __must_check
 cfg80211_inform_bss_frame(struct wiphy *wiphy,
-                          struct ieee80211_channel *channel,
+                          struct ieee80211_channel *rx_channel,
                           struct ieee80211_mgmt *mgmt, size_t len,
                           s32 signal, gfp_t gfp)
 {
-        return cfg80211_inform_bss_width_frame(wiphy, channel,
+        return cfg80211_inform_bss_width_frame(wiphy, rx_channel,
                                                NL80211_BSS_CHAN_WIDTH_20,
                                                mgmt, len, signal, gfp);
 }
@@ -3702,7 +3707,7 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
  * cfg80211_inform_bss - inform cfg80211 of a new BSS
  *
  * @wiphy: the wiphy reporting the BSS
- * @channel: The channel the frame was received on
+ * @rx_channel: The channel the frame was received on
  * @scan_width: width of the control channel
  * @bssid: the BSSID of the BSS
  * @tsf: the TSF sent by the peer in the beacon/probe response (or 0)
@@ -3721,7 +3726,7 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
  */
 struct cfg80211_bss * __must_check
 cfg80211_inform_bss_width(struct wiphy *wiphy,
-                          struct ieee80211_channel *channel,
+                          struct ieee80211_channel *rx_channel,
                           enum nl80211_bss_scan_width scan_width,
                           const u8 *bssid, u64 tsf, u16 capability,
                           u16 beacon_interval, const u8 *ie, size_t ielen,
@@ -3729,12 +3734,12 @@ cfg80211_inform_bss_width(struct wiphy *wiphy,
 
 static inline struct cfg80211_bss * __must_check
 cfg80211_inform_bss(struct wiphy *wiphy,
-                    struct ieee80211_channel *channel,
+                    struct ieee80211_channel *rx_channel,
                     const u8 *bssid, u64 tsf, u16 capability,
                     u16 beacon_interval, const u8 *ie, size_t ielen,
                     s32 signal, gfp_t gfp)
 {
-        return cfg80211_inform_bss_width(wiphy, channel,
+        return cfg80211_inform_bss_width(wiphy, rx_channel,
                                          NL80211_BSS_CHAN_WIDTH_20,
                                          bssid, tsf, capability,
                                          beacon_interval, ie, ielen, signal,
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 86faa413b37d..2de7ff42ff3a 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -697,11 +697,11 @@ struct ieee80211_tx_info {
                 } control;
                 struct {
                         struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES];
-                        int ack_signal;
+                        s32 ack_signal;
                         u8 ampdu_ack_len;
                         u8 ampdu_len;
                         u8 antenna;
-                        /* 21 bytes free */
+                        void *status_driver_data[21 / sizeof(void *)];
                 } status;
                 struct {
                         struct ieee80211_tx_rate driver_rates[
@@ -877,11 +877,13 @@ enum mac80211_rx_flags {
  * @RX_VHT_FLAG_80MHZ: 80 MHz was used
  * @RX_VHT_FLAG_80P80MHZ: 80+80 MHz was used
  * @RX_VHT_FLAG_160MHZ: 160 MHz was used
+ * @RX_VHT_FLAG_BF: packet was beamformed
  */
 enum mac80211_rx_vht_flags {
         RX_VHT_FLAG_80MHZ               = BIT(0),
         RX_VHT_FLAG_80P80MHZ            = BIT(1),
         RX_VHT_FLAG_160MHZ              = BIT(2),
+        RX_VHT_FLAG_BF                  = BIT(3),
 };
 
 /**
diff --git a/include/net/nfc/digital.h b/include/net/nfc/digital.h
index 81af21e9bcd4..7655cfe27c34 100644
--- a/include/net/nfc/digital.h
+++ b/include/net/nfc/digital.h
@@ -35,6 +35,7 @@ enum {
         NFC_DIGITAL_RF_TECH_106A = 0,
         NFC_DIGITAL_RF_TECH_212F,
         NFC_DIGITAL_RF_TECH_424F,
+        NFC_DIGITAL_RF_TECH_ISO15693,
 
         NFC_DIGITAL_RF_TECH_LAST,
 };
@@ -50,6 +51,7 @@ enum {
 
         NFC_DIGITAL_FRAMING_NFCA_T1T,
         NFC_DIGITAL_FRAMING_NFCA_T2T,
+        NFC_DIGITAL_FRAMING_NFCA_T4T,
         NFC_DIGITAL_FRAMING_NFCA_NFC_DEP,
 
         NFC_DIGITAL_FRAMING_NFCF,
@@ -57,6 +59,9 @@ enum {
         NFC_DIGITAL_FRAMING_NFCF_NFC_DEP,
         NFC_DIGITAL_FRAMING_NFC_DEP_ACTIVATED,
 
+        NFC_DIGITAL_FRAMING_ISO15693_INVENTORY,
+        NFC_DIGITAL_FRAMING_ISO15693_T5T,
+
         NFC_DIGITAL_FRAMING_LAST,
 };
 
@@ -204,6 +209,8 @@ struct nfc_digital_dev {
         u8 curr_rf_tech;
         u8 curr_nfc_dep_pni;
 
+        u16 target_fsc;
+
         int (*skb_check_crc)(struct sk_buff *skb);
         void (*skb_add_crc)(struct sk_buff *skb);
 };
diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
index e80894bca1d0..2e8b40c16274 100644
--- a/include/net/nfc/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -111,6 +111,9 @@ struct nfc_target {
         u8 sensf_res[NFC_SENSF_RES_MAXSIZE];
         u8 hci_reader_gate;
         u8 logical_idx;
+        u8 is_iso15693;
+        u8 iso15693_dsfid;
+        u8 iso15693_uid[NFC_ISO15693_UID_MAXSIZE];
 };
 
 /**
diff --git a/include/net/regulatory.h b/include/net/regulatory.h
index b07cdc9fa454..75fc1f5a948d 100644
--- a/include/net/regulatory.h
+++ b/include/net/regulatory.h
@@ -155,6 +155,7 @@ struct ieee80211_reg_rule {
         struct ieee80211_freq_range freq_range;
         struct ieee80211_power_rule power_rule;
         u32 flags;
+        u32 dfs_cac_ms;
 };
 
 struct ieee80211_regdomain {
@@ -172,14 +173,18 @@ struct ieee80211_regdomain {
 #define DBM_TO_MBM(gain) ((gain) * 100)
 #define MBM_TO_DBM(gain) ((gain) / 100)
 
-#define REG_RULE(start, end, bw, gain, eirp, reg_flags) \
-{                                                       \
-        .freq_range.start_freq_khz = MHZ_TO_KHZ(start), \
-        .freq_range.end_freq_khz = MHZ_TO_KHZ(end),     \
-        .freq_range.max_bandwidth_khz = MHZ_TO_KHZ(bw), \
-        .power_rule.max_antenna_gain = DBI_TO_MBI(gain),\
-        .power_rule.max_eirp = DBM_TO_MBM(eirp),        \
-        .flags = reg_flags,                             \
+#define REG_RULE_EXT(start, end, bw, gain, eirp, dfs_cac, reg_flags)    \
+{                                                                       \
+        .freq_range.start_freq_khz = MHZ_TO_KHZ(start),                 \
+        .freq_range.end_freq_khz = MHZ_TO_KHZ(end),                     \
+        .freq_range.max_bandwidth_khz = MHZ_TO_KHZ(bw),                 \
+        .power_rule.max_antenna_gain = DBI_TO_MBI(gain),                \
+        .power_rule.max_eirp = DBM_TO_MBM(eirp),                        \
+        .flags = reg_flags,                                             \
+        .dfs_cac_ms = dfs_cac,                                          \
 }
 
+#define REG_RULE(start, end, bw, gain, eirp, reg_flags) \
+        REG_RULE_EXT(start, end, bw, gain, eirp, 0, reg_flags)
+
 #endif
diff --git a/include/uapi/linux/nfc.h b/include/uapi/linux/nfc.h
index 6ad6cc03ccd3..9789dc95b6a8 100644
--- a/include/uapi/linux/nfc.h
+++ b/include/uapi/linux/nfc.h
@@ -150,6 +150,8 @@ enum nfc_commands {
  * @NFC_ATTR_SE_TYPE: Secure element type (UICC or EMBEDDED)
  * @NFC_ATTR_FIRMWARE_DOWNLOAD_STATUS: Firmware download operation status
  * @NFC_ATTR_APDU: Secure element APDU
+ * @NFC_ATTR_TARGET_ISO15693_DSFID: ISO 15693 Data Storage Format Identifier
+ * @NFC_ATTR_TARGET_ISO15693_UID: ISO 15693 Unique Identifier
  */
 enum nfc_attrs {
         NFC_ATTR_UNSPEC,
@@ -178,6 +180,8 @@ enum nfc_attrs {
         NFC_ATTR_SE_AID,
         NFC_ATTR_FIRMWARE_DOWNLOAD_STATUS,
         NFC_ATTR_SE_APDU,
+        NFC_ATTR_TARGET_ISO15693_DSFID,
+        NFC_ATTR_TARGET_ISO15693_UID,
 /* private: internal use only */
         __NFC_ATTR_AFTER_LAST
 };
@@ -200,6 +204,7 @@ enum nfc_sdp_attr {
 #define NFC_SENSF_RES_MAXSIZE 18
 #define NFC_GB_MAXSIZE        48
 #define NFC_FIRMWARE_NAME_MAXSIZE 32
+#define NFC_ISO15693_UID_MAXSIZE 8
 
 /* NFC protocols */
 #define NFC_PROTO_JEWEL         1
@@ -208,8 +213,9 @@ enum nfc_sdp_attr {
 #define NFC_PROTO_ISO14443      4
 #define NFC_PROTO_NFC_DEP       5
 #define NFC_PROTO_ISO14443_B    6
+#define NFC_PROTO_ISO15693      7
 
-#define NFC_PROTO_MAX           7
+#define NFC_PROTO_MAX           8
 
 /* NFC communication modes */
 #define NFC_COMM_ACTIVE  0
@@ -227,6 +233,7 @@ enum nfc_sdp_attr {
 #define NFC_PROTO_ISO14443_MASK   (1 << NFC_PROTO_ISO14443)
 #define NFC_PROTO_NFC_DEP_MASK    (1 << NFC_PROTO_NFC_DEP)
 #define NFC_PROTO_ISO14443_B_MASK (1 << NFC_PROTO_ISO14443_B)
+#define NFC_PROTO_ISO15693_MASK   (1 << NFC_PROTO_ISO15693)
 
 /* NFC Secure Elements */
 #define NFC_SE_UICC     0x1
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index ff72cab3cd3a..1ba9d626aa83 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -2335,6 +2335,7 @@ enum nl80211_band_attr {
  * @NL80211_FREQUENCY_ATTR_NO_160MHZ: any 160 MHz (but not 80+80) channel
  *      using this channel as the primary or any of the secondary channels
  *      isn't possible
+ * @NL80211_FREQUENCY_ATTR_DFS_CAC_TIME: DFS CAC time in milliseconds.
  * @NL80211_FREQUENCY_ATTR_MAX: highest frequency attribute number
  *      currently defined
  * @__NL80211_FREQUENCY_ATTR_AFTER_LAST: internal use
@@ -2353,6 +2354,7 @@ enum nl80211_frequency_attr {
         NL80211_FREQUENCY_ATTR_NO_HT40_PLUS,
         NL80211_FREQUENCY_ATTR_NO_80MHZ,
         NL80211_FREQUENCY_ATTR_NO_160MHZ,
+        NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 
         /* keep last */
         __NL80211_FREQUENCY_ATTR_AFTER_LAST,
@@ -2449,6 +2451,8 @@ enum nl80211_reg_type {
  *      If you don't have one then don't send this.
  * @NL80211_ATTR_POWER_RULE_MAX_EIRP: the maximum allowed EIRP for
  *      a given frequency range. The value is in mBm (100 * dBm).
+ * @NL80211_ATTR_DFS_CAC_TIME: DFS CAC time in milliseconds.
+ *      If not present or 0 default CAC time will be used.
  * @NL80211_REG_RULE_ATTR_MAX: highest regulatory rule attribute number
  *      currently defined
  * @__NL80211_REG_RULE_ATTR_AFTER_LAST: internal use
@@ -2464,6 +2468,8 @@ enum nl80211_reg_rule_attr {
         NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
         NL80211_ATTR_POWER_RULE_MAX_EIRP,
 
+        NL80211_ATTR_DFS_CAC_TIME,
+
         /* keep last */
         __NL80211_REG_RULE_ATTR_AFTER_LAST,
         NL80211_REG_RULE_ATTR_MAX = __NL80211_REG_RULE_ATTR_AFTER_LAST - 1
diff --git a/net/bluetooth/6lowpan.h b/net/bluetooth/6lowpan.h
index 680eac808d74..5d281f1eaf55 100644
--- a/net/bluetooth/6lowpan.h
+++ b/net/bluetooth/6lowpan.h
@@ -14,13 +14,34 @@
 #ifndef __6LOWPAN_H
 #define __6LOWPAN_H
 
+#include <linux/errno.h>
 #include <linux/skbuff.h>
 #include <net/bluetooth/l2cap.h>
 
+#if IS_ENABLED(CONFIG_BT_6LOWPAN)
 int bt_6lowpan_recv(struct l2cap_conn *conn, struct sk_buff *skb);
 int bt_6lowpan_add_conn(struct l2cap_conn *conn);
 int bt_6lowpan_del_conn(struct l2cap_conn *conn);
 int bt_6lowpan_init(void);
 void bt_6lowpan_cleanup(void);
+#else
+static int bt_6lowpan_recv(struct l2cap_conn *conn, struct sk_buff *skb)
+{
+        return -EOPNOTSUPP;
+}
+static int bt_6lowpan_add_conn(struct l2cap_conn *conn)
+{
+        return -EOPNOTSUPP;
+}
+int bt_6lowpan_del_conn(struct l2cap_conn *conn)
+{
+        return -EOPNOTSUPP;
+}
+static int bt_6lowpan_init(void)
+{
+        return -EOPNOTSUPP;
+}
+static void bt_6lowpan_cleanup(void) { }
+#endif
 
 #endif /* __6LOWPAN_H */
diff --git a/net/bluetooth/Kconfig b/net/bluetooth/Kconfig
index 985b56070d26..06ec14499ca1 100644
--- a/net/bluetooth/Kconfig
+++ b/net/bluetooth/Kconfig
@@ -6,13 +6,13 @@ menuconfig BT
         tristate "Bluetooth subsystem support"
         depends on NET && !S390
         depends on RFKILL || !RFKILL
+        select 6LOWPAN_IPHC if BT_6LOWPAN
         select CRC16
         select CRYPTO
         select CRYPTO_BLKCIPHER
         select CRYPTO_AES
         select CRYPTO_ECB
         select CRYPTO_SHA256
-        select 6LOWPAN_IPHC
         help
           Bluetooth is low-cost, low-power, short-range wireless technology.
           It was designed as a replacement for cables and other short-range
@@ -40,6 +40,12 @@ menuconfig BT
           to Bluetooth kernel modules are provided in the BlueZ packages.  For
           more information, see <http://www.bluez.org/>.
 
+config BT_6LOWPAN
+        bool "Bluetooth 6LoWPAN support"
+        depends on BT && IPV6
+        help
+          IPv6 compression over Bluetooth.
+
 source "net/bluetooth/rfcomm/Kconfig"
 
 source "net/bluetooth/bnep/Kconfig"
diff --git a/net/bluetooth/Makefile b/net/bluetooth/Makefile
index 80cb215826e8..ca51246b1016 100644
--- a/net/bluetooth/Makefile
+++ b/net/bluetooth/Makefile
@@ -10,6 +10,7 @@ obj-$(CONFIG_BT_HIDP)	+= hidp/
 
 bluetooth-y := af_bluetooth.o hci_core.o hci_conn.o hci_event.o mgmt.o \
         hci_sock.o hci_sysfs.o l2cap_core.o l2cap_sock.o smp.o sco.o lib.o \
-        a2mp.o amp.o 6lowpan.o
+        a2mp.o amp.o
+bluetooth-$(CONFIG_BT_6LOWPAN) += 6lowpan.o
 
 subdir-ccflags-y += -D__CHECK_ENDIAN__
diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
index f986b9968bdb..9514cc9e850c 100644
--- a/net/bluetooth/a2mp.c
+++ b/net/bluetooth/a2mp.c
@@ -162,7 +162,7 @@ static int a2mp_discover_req(struct amp_mgr *mgr, struct sk_buff *skb,
                 return -ENOMEM;
         }
 
-        rsp->mtu = __constant_cpu_to_le16(L2CAP_A2MP_DEFAULT_MTU);
+        rsp->mtu = cpu_to_le16(L2CAP_A2MP_DEFAULT_MTU);
         rsp->ext_feat = 0;
 
         __a2mp_add_cl(mgr, rsp->cl);
@@ -649,7 +649,7 @@ static int a2mp_chan_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
         if (err) {
                 struct a2mp_cmd_rej rej;
 
-                rej.reason = __constant_cpu_to_le16(0);
+                rej.reason = cpu_to_le16(0);
                 hdr = (void *) skb->data;
 
                 BT_DBG("Send A2MP Rej: cmd 0x%2.2x err %d", hdr->code, err);
@@ -695,7 +695,13 @@ static void a2mp_chan_state_change_cb(struct l2cap_chan *chan, int state,
 static struct sk_buff *a2mp_chan_alloc_skb_cb(struct l2cap_chan *chan,
                                               unsigned long len, int nb)
 {
-        return bt_skb_alloc(len, GFP_KERNEL);
+        struct sk_buff *skb;
+
+        skb = bt_skb_alloc(len, GFP_KERNEL);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        return skb;
 }
 
 static struct l2cap_ops a2mp_chan_ops = {
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 7c713c4675ba..d958e2dca52f 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -82,7 +82,7 @@ static void hci_acl_create_connection(struct hci_conn *conn)
                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
                         cp.pscan_mode     = ie->data.pscan_mode;
                         cp.clock_offset   = ie->data.clock_offset |
-                                            __constant_cpu_to_le16(0x8000);
+                                            cpu_to_le16(0x8000);
                 }
 
                 memcpy(conn->dev_class, ie->data.dev_class, 3);
@@ -182,8 +182,8 @@ bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
 
         cp.handle   = cpu_to_le16(handle);
 
-        cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
-        cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
+        cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
+        cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
         cp.voice_setting  = cpu_to_le16(conn->setting);
 
         switch (conn->setting & SCO_AIRMODE_MASK) {
@@ -225,8 +225,8 @@ void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
         cp.conn_interval_max    = cpu_to_le16(max);
         cp.conn_latency         = cpu_to_le16(latency);
         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
-        cp.min_ce_len           = __constant_cpu_to_le16(0x0000);
-        cp.max_ce_len           = __constant_cpu_to_le16(0x0000);
+        cp.min_ce_len           = cpu_to_le16(0x0000);
+        cp.max_ce_len           = cpu_to_le16(0x0000);
 
         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 }
@@ -337,9 +337,9 @@ static void hci_conn_idle(struct work_struct *work)
         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
                 struct hci_cp_sniff_subrate cp;
                 cp.handle             = cpu_to_le16(conn->handle);
-                cp.max_latency        = __constant_cpu_to_le16(0);
-                cp.min_remote_timeout = __constant_cpu_to_le16(0);
-                cp.min_local_timeout  = __constant_cpu_to_le16(0);
+                cp.max_latency        = cpu_to_le16(0);
+                cp.min_remote_timeout = cpu_to_le16(0);
+                cp.min_local_timeout  = cpu_to_le16(0);
                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
         }
 
@@ -348,8 +348,8 @@ static void hci_conn_idle(struct work_struct *work)
                 cp.handle       = cpu_to_le16(conn->handle);
                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
-                cp.attempt      = __constant_cpu_to_le16(4);
-                cp.timeout      = __constant_cpu_to_le16(1);
+                cp.attempt      = cpu_to_le16(4);
+                cp.timeout      = cpu_to_le16(1);
                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
         }
 }
@@ -596,9 +596,9 @@ static void hci_req_add_le_create_conn(struct hci_request *req,
         cp.own_address_type = own_addr_type;
         cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
         cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
-        cp.supervision_timeout = __constant_cpu_to_le16(0x002a);
-        cp.min_ce_len = __constant_cpu_to_le16(0x0000);
-        cp.max_ce_len = __constant_cpu_to_le16(0x0000);
+        cp.supervision_timeout = cpu_to_le16(0x002a);
+        cp.min_ce_len = cpu_to_le16(0x0000);
+        cp.max_ce_len = cpu_to_le16(0x0000);
 
         hci_req_add(req, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
 
@@ -781,6 +781,17 @@ int hci_conn_check_link_mode(struct hci_conn *conn)
 {
         BT_DBG("hcon %p", conn);
 
+        /* In Secure Connections Only mode, it is required that Secure
+         * Connections is used and the link is encrypted with AES-CCM
+         * using a P-256 authenticated combination key.
+         */
+        if (test_bit(HCI_SC_ONLY, &conn->hdev->flags)) {
+                if (!hci_conn_sc_enabled(conn) ||
+                    !test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
+                    conn->key_type != HCI_LK_AUTH_COMBINATION_P256)
+                        return 0;
+        }
+
         if (hci_conn_ssp_enabled(conn) && !(conn->link_mode & HCI_LM_ENCRYPT))
                 return 0;
 
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 8bbfdea9cbec..1c6ffaa8902f 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1349,7 +1349,7 @@ static void bredr_setup(struct hci_request *req)
         hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
 
         /* Connection accept timeout ~20 secs */
-        param = __constant_cpu_to_le16(0x7d00);
+        param = cpu_to_le16(0x7d00);
         hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
 
         /* AVM Berlin (31), aka "BlueFRITZ!", reports version 1.2,
@@ -5270,7 +5270,7 @@ void hci_req_add_le_passive_scan(struct hci_request *req)
 
         memset(&enable_cp, 0, sizeof(enable_cp));
         enable_cp.enable = LE_SCAN_ENABLE;
-        enable_cp.filter_dup = LE_SCAN_FILTER_DUP_DISABLE;
+        enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
         hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
                     &enable_cp);
 }
@@ -5313,10 +5313,6 @@ void hci_update_background_scan(struct hci_dev *hdev)
                  * keep the background scan running.
                  */
 
-                /* If controller is already scanning we are done. */
-                if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
-                        return;
-
                 /* If controller is connecting, we should not start scanning
                  * since some controllers are not able to scan and connect at
                  * the same time.
@@ -5325,6 +5321,12 @@ void hci_update_background_scan(struct hci_dev *hdev)
                 if (conn)
                         return;
 
+                /* If controller is currently scanning, we stop it to ensure we
+                 * don't miss any advertising (due to duplicates filter).
+                 */
+                if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
+                        hci_req_add_le_scan_disable(&req);
+
                 hci_req_add_le_passive_scan(&req);
 
                 BT_DBG("%s starting background scanning", hdev->name);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index c3b0a08f5ab4..a6a3d32553c5 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1924,9 +1924,9 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
                         bacpy(&cp.bdaddr, &ev->bdaddr);
                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 
-                        cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
-                        cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
-                        cp.max_latency    = __constant_cpu_to_le16(0xffff);
+                        cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
+                        cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
+                        cp.max_latency    = cpu_to_le16(0xffff);
                         cp.content_format = cpu_to_le16(hdev->voice_setting);
                         cp.retrans_effort = 0xff;
 
@@ -2183,6 +2183,18 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 if (!ev->status)
                         conn->state = BT_CONNECTED;
 
+                /* In Secure Connections Only mode, do not allow any
+                 * connections that are not encrypted with AES-CCM
+                 * using a P-256 authenticated combination key.
+                 */
+                if (test_bit(HCI_SC_ONLY, &hdev->dev_flags) &&
+                    (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
+                     conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
+                        hci_proto_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
+                        hci_conn_drop(conn);
+                        goto unlock;
+                }
+
                 hci_proto_connect_cfm(conn, ev->status);
                 hci_conn_drop(conn);
         } else
@@ -3157,6 +3169,7 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
         case 0x1c:      /* SCO interval rejected */
         case 0x1a:      /* Unsupported Remote Feature */
         case 0x1f:      /* Unspecified error */
+        case 0x20:      /* Unsupported LMP Parameter value */
                 if (conn->out) {
                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
                                         (hdev->esco_type & EDR_ESCO_MASK);
@@ -3961,7 +3974,13 @@ static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 
         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
 
-        if (ltk->type & HCI_SMP_STK) {
+        /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
+         * temporary key used to encrypt a connection following
+         * pairing. It is used during the Encrypted Session Setup to
+         * distribute the keys. Later, security can be re-established
+         * using a distributed LTK.
+         */
+        if (ltk->type == HCI_SMP_STK_SLAVE) {
                 list_del(&ltk->list);
                 kfree(ltk);
         }
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 68e51a84e72d..b9a418e578e0 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -211,22 +211,22 @@ void hci_send_to_monitor(struct hci_dev *hdev, struct sk_buff *skb)
 
         switch (bt_cb(skb)->pkt_type) {
         case HCI_COMMAND_PKT:
-                opcode = __constant_cpu_to_le16(HCI_MON_COMMAND_PKT);
+                opcode = cpu_to_le16(HCI_MON_COMMAND_PKT);
                 break;
         case HCI_EVENT_PKT:
-                opcode = __constant_cpu_to_le16(HCI_MON_EVENT_PKT);
+                opcode = cpu_to_le16(HCI_MON_EVENT_PKT);
                 break;
         case HCI_ACLDATA_PKT:
                 if (bt_cb(skb)->incoming)
-                        opcode = __constant_cpu_to_le16(HCI_MON_ACL_RX_PKT);
+                        opcode = cpu_to_le16(HCI_MON_ACL_RX_PKT);
                 else
-                        opcode = __constant_cpu_to_le16(HCI_MON_ACL_TX_PKT);
+                        opcode = cpu_to_le16(HCI_MON_ACL_TX_PKT);
                 break;
         case HCI_SCODATA_PKT:
                 if (bt_cb(skb)->incoming)
-                        opcode = __constant_cpu_to_le16(HCI_MON_SCO_RX_PKT);
+                        opcode = cpu_to_le16(HCI_MON_SCO_RX_PKT);
                 else
-                        opcode = __constant_cpu_to_le16(HCI_MON_SCO_TX_PKT);
+                        opcode = cpu_to_le16(HCI_MON_SCO_TX_PKT);
                 break;
         default:
                 return;
@@ -319,7 +319,7 @@ static struct sk_buff *create_monitor_event(struct hci_dev *hdev, int event)
                 bacpy(&ni->bdaddr, &hdev->bdaddr);
                 memcpy(ni->name, hdev->name, 8);
 
-                opcode = __constant_cpu_to_le16(HCI_MON_NEW_INDEX);
+                opcode = cpu_to_le16(HCI_MON_NEW_INDEX);
                 break;
 
         case HCI_DEV_UNREG:
@@ -327,7 +327,7 @@ static struct sk_buff *create_monitor_event(struct hci_dev *hdev, int event)
                 if (!skb)
                         return NULL;
 
-                opcode = __constant_cpu_to_le16(HCI_MON_DEL_INDEX);
+                opcode = cpu_to_le16(HCI_MON_DEL_INDEX);
                 break;
 
         default:
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 9ed2168fa59f..a1e5bb7d06e8 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -665,7 +665,7 @@ static void l2cap_chan_connect_reject(struct l2cap_chan *chan)
         rsp.scid   = cpu_to_le16(chan->dcid);
         rsp.dcid   = cpu_to_le16(chan->scid);
         rsp.result = cpu_to_le16(result);
-        rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
+        rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
 
         l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
 }
@@ -727,7 +727,7 @@ static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
                 }
                 break;
         case L2CAP_CHAN_CONN_LESS:
-                if (chan->psm == __constant_cpu_to_le16(L2CAP_PSM_3DSP)) {
+                if (chan->psm == cpu_to_le16(L2CAP_PSM_3DSP)) {
                         if (chan->sec_level == BT_SECURITY_LOW)
                                 chan->sec_level = BT_SECURITY_SDP;
                 }
@@ -738,7 +738,7 @@ static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
                         return HCI_AT_NO_BONDING;
                 break;
         case L2CAP_CHAN_CONN_ORIENTED:
-                if (chan->psm == __constant_cpu_to_le16(L2CAP_PSM_SDP)) {
+                if (chan->psm == cpu_to_le16(L2CAP_PSM_SDP)) {
                         if (chan->sec_level == BT_SECURITY_LOW)
                                 chan->sec_level = BT_SECURITY_SDP;
 
@@ -1273,7 +1273,7 @@ static void l2cap_do_start(struct l2cap_chan *chan)
                 }
         } else {
                 struct l2cap_info_req req;
-                req.type = __constant_cpu_to_le16(L2CAP_IT_FEAT_MASK);
+                req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
 
                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
                 conn->info_ident = l2cap_get_ident(conn);
@@ -1370,18 +1370,18 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
 
                         if (l2cap_chan_check_security(chan)) {
                                 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
-                                        rsp.result = __constant_cpu_to_le16(L2CAP_CR_PEND);
-                                        rsp.status = __constant_cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
+                                        rsp.result = cpu_to_le16(L2CAP_CR_PEND);
+                                        rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
                                         chan->ops->defer(chan);
 
                                 } else {
                                         l2cap_state_change(chan, BT_CONFIG);
-                                        rsp.result = __constant_cpu_to_le16(L2CAP_CR_SUCCESS);
-                                        rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
+                                        rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
+                                        rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
                                 }
                         } else {
-                                rsp.result = __constant_cpu_to_le16(L2CAP_CR_PEND);
-                                rsp.status = __constant_cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
+                                rsp.result = cpu_to_le16(L2CAP_CR_PEND);
+                                rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
                         }
 
                         l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
@@ -2895,9 +2895,9 @@ static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code,
         lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
 
         if (conn->hcon->type == LE_LINK)
-                lh->cid = __constant_cpu_to_le16(L2CAP_CID_LE_SIGNALING);
+                lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING);
         else
-                lh->cid = __constant_cpu_to_le16(L2CAP_CID_SIGNALING);
+                lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
 
         cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
         cmd->code  = code;
@@ -3010,8 +3010,8 @@ static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan)
                 efs.stype       = chan->local_stype;
                 efs.msdu        = cpu_to_le16(chan->local_msdu);
                 efs.sdu_itime   = cpu_to_le32(chan->local_sdu_itime);
-                efs.acc_lat     = __constant_cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
-                efs.flush_to    = __constant_cpu_to_le32(L2CAP_EFS_DEFAULT_FLUSH_TO);
+                efs.acc_lat     = cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
+                efs.flush_to    = cpu_to_le32(L2CAP_EFS_DEFAULT_FLUSH_TO);
                 break;
 
         case L2CAP_MODE_STREAMING:
@@ -3152,8 +3152,8 @@ static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,
                 rfc->retrans_timeout = cpu_to_le16((u16) ertm_to);
                 rfc->monitor_timeout = rfc->retrans_timeout;
         } else {
-                rfc->retrans_timeout = __constant_cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
-                rfc->monitor_timeout = __constant_cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
+                rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
+                rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
         }
 }
 
@@ -3285,7 +3285,7 @@ done:
         }
 
         req->dcid  = cpu_to_le16(chan->dcid);
-        req->flags = __constant_cpu_to_le16(0);
+        req->flags = cpu_to_le16(0);
 
         return ptr - data;
 }
@@ -3499,7 +3499,7 @@ done:
         }
         rsp->scid   = cpu_to_le16(chan->dcid);
         rsp->result = cpu_to_le16(result);
-        rsp->flags  = __constant_cpu_to_le16(0);
+        rsp->flags  = cpu_to_le16(0);
 
         return ptr - data;
 }
@@ -3608,7 +3608,7 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
         }
 
         req->dcid   = cpu_to_le16(chan->dcid);
-        req->flags  = __constant_cpu_to_le16(0);
+        req->flags  = cpu_to_le16(0);
 
         return ptr - data;
 }
@@ -3639,7 +3639,7 @@ void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan)
         rsp.mtu     = cpu_to_le16(chan->imtu);
         rsp.mps     = cpu_to_le16(chan->mps);
         rsp.credits = cpu_to_le16(chan->rx_credits);
-        rsp.result  = __constant_cpu_to_le16(L2CAP_CR_SUCCESS);
+        rsp.result  = cpu_to_le16(L2CAP_CR_SUCCESS);
 
         l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
                        &rsp);
@@ -3654,8 +3654,8 @@ void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
 
         rsp.scid   = cpu_to_le16(chan->dcid);
         rsp.dcid   = cpu_to_le16(chan->scid);
-        rsp.result = __constant_cpu_to_le16(L2CAP_CR_SUCCESS);
-        rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
+        rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
+        rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
 
         if (chan->hs_hcon)
                 rsp_code = L2CAP_CREATE_CHAN_RSP;
@@ -3684,8 +3684,8 @@ static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
         u16 txwin_ext = chan->ack_win;
         struct l2cap_conf_rfc rfc = {
                 .mode = chan->mode,
-                .retrans_timeout = __constant_cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO),
-                .monitor_timeout = __constant_cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO),
+                .retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO),
+                .monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO),
                 .max_pdu_size = cpu_to_le16(chan->imtu),
                 .txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW),
         };
@@ -3776,7 +3776,7 @@ static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
         l2cap_chan_lock(pchan);
 
         /* Check if the ACL is secure enough (if not SDP) */
-        if (psm != __constant_cpu_to_le16(L2CAP_PSM_SDP) &&
+        if (psm != cpu_to_le16(L2CAP_PSM_SDP) &&
             !hci_conn_check_link_mode(conn->hcon)) {
                 conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
                 result = L2CAP_CR_SEC_BLOCK;
@@ -3861,7 +3861,7 @@ sendresp:
 
         if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
                 struct l2cap_info_req info;
-                info.type = __constant_cpu_to_le16(L2CAP_IT_FEAT_MASK);
+                info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
 
                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
                 conn->info_ident = l2cap_get_ident(conn);
@@ -4010,7 +4010,7 @@ static void cmd_reject_invalid_cid(struct l2cap_conn *conn, u8 ident,
 {
         struct l2cap_cmd_rej_cid rej;
 
-        rej.reason = __constant_cpu_to_le16(L2CAP_REJ_INVALID_CID);
+        rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID);
         rej.scid = __cpu_to_le16(scid);
         rej.dcid = __cpu_to_le16(dcid);
 
@@ -4342,8 +4342,8 @@ static inline int l2cap_information_req(struct l2cap_conn *conn,
                 u8 buf[8];
                 u32 feat_mask = l2cap_feat_mask;
                 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
-                rsp->type   = __constant_cpu_to_le16(L2CAP_IT_FEAT_MASK);
-                rsp->result = __constant_cpu_to_le16(L2CAP_IR_SUCCESS);
+                rsp->type   = cpu_to_le16(L2CAP_IT_FEAT_MASK);
+                rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
                 if (!disable_ertm)
                         feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
                                 | L2CAP_FEAT_FCS;
@@ -4363,15 +4363,15 @@ static inline int l2cap_information_req(struct l2cap_conn *conn,
                 else
                         l2cap_fixed_chan[0] &= ~L2CAP_FC_A2MP;
 
-                rsp->type   = __constant_cpu_to_le16(L2CAP_IT_FIXED_CHAN);
-                rsp->result = __constant_cpu_to_le16(L2CAP_IR_SUCCESS);
+                rsp->type   = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
+                rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
                 memcpy(rsp->data, l2cap_fixed_chan, sizeof(l2cap_fixed_chan));
                 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
                                buf);
         } else {
                 struct l2cap_info_rsp rsp;
                 rsp.type   = cpu_to_le16(type);
-                rsp.result = __constant_cpu_to_le16(L2CAP_IR_NOTSUPP);
+                rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
                 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp),
                                &rsp);
         }
@@ -4416,7 +4416,7 @@ static inline int l2cap_information_rsp(struct l2cap_conn *conn,
 
                 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
                         struct l2cap_info_req req;
-                        req.type = __constant_cpu_to_le16(L2CAP_IT_FIXED_CHAN);
+                        req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
 
                         conn->info_ident = l2cap_get_ident(conn);
 
@@ -4510,8 +4510,8 @@ static int l2cap_create_channel_req(struct l2cap_conn *conn,
 error:
         rsp.dcid = 0;
         rsp.scid = cpu_to_le16(scid);
-        rsp.result = __constant_cpu_to_le16(L2CAP_CR_BAD_AMP);
-        rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
+        rsp.result = cpu_to_le16(L2CAP_CR_BAD_AMP);
+        rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
 
         l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP,
                        sizeof(rsp), &rsp);
@@ -4575,7 +4575,7 @@ static void l2cap_send_move_chan_cfm_icid(struct l2cap_conn *conn, u16 icid)
         BT_DBG("conn %p, icid 0x%4.4x", conn, icid);
 
         cfm.icid = cpu_to_le16(icid);
-        cfm.result = __constant_cpu_to_le16(L2CAP_MC_UNCONFIRMED);
+        cfm.result = cpu_to_le16(L2CAP_MC_UNCONFIRMED);
 
         l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_MOVE_CHAN_CFM,
                        sizeof(cfm), &cfm);
@@ -4758,12 +4758,12 @@ static void l2cap_do_create(struct l2cap_chan *chan, int result,
 
                 if (result == L2CAP_CR_SUCCESS) {
                         /* Send successful response */
-                        rsp.result = __constant_cpu_to_le16(L2CAP_CR_SUCCESS);
-                        rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
+                        rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
+                        rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
                 } else {
                         /* Send negative response */
-                        rsp.result = __constant_cpu_to_le16(L2CAP_CR_NO_MEM);
-                        rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
+                        rsp.result = cpu_to_le16(L2CAP_CR_NO_MEM);
+                        rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
                 }
 
                 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_RSP,
@@ -4891,7 +4891,7 @@ static inline int l2cap_move_channel_req(struct l2cap_conn *conn,
         chan = l2cap_get_chan_by_dcid(conn, icid);
         if (!chan) {
                 rsp.icid = cpu_to_le16(icid);
-                rsp.result = __constant_cpu_to_le16(L2CAP_MR_NOT_ALLOWED);
+                rsp.result = cpu_to_le16(L2CAP_MR_NOT_ALLOWED);
                 l2cap_send_cmd(conn, cmd->ident, L2CAP_MOVE_CHAN_RSP,
                                sizeof(rsp), &rsp);
                 return 0;
@@ -5235,9 +5235,9 @@ static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
 
         err = l2cap_check_conn_param(min, max, latency, to_multiplier);
         if (err)
-                rsp.result = __constant_cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
+                rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
         else
-                rsp.result = __constant_cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
+                rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
 
         l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
                        sizeof(rsp), &rsp);
@@ -5650,7 +5650,7 @@ static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
 
                 BT_ERR("Wrong link type (%d)", err);
 
-                rej.reason = __constant_cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
+                rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
                 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
                                sizeof(rej), &rej);
         }
@@ -5695,7 +5695,7 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn,
 
                         BT_ERR("Wrong link type (%d)", err);
 
-                        rej.reason = __constant_cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
+                        rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
                         l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ,
                                        sizeof(rej), &rej);
                 }
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index b247f9d27fed..33cd5615ff1e 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -111,7 +111,7 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
         if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
                 /* We only allow ATT user space socket */
                 if (la.l2_cid &&
-                    la.l2_cid != __constant_cpu_to_le16(L2CAP_CID_ATT))
+                    la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
                         return -EINVAL;
         }
 
@@ -209,7 +209,7 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
                  * ATT. Anything else is an invalid combination.
                  */
                 if (chan->scid != L2CAP_CID_ATT ||
-                    la.l2_cid != __constant_cpu_to_le16(L2CAP_CID_ATT))
+                    la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
                         return -EINVAL;
 
                 /* We don't have the hdev available here to make a
@@ -227,7 +227,7 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
         if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
                 /* We only allow ATT user space socket */
                 if (la.l2_cid &&
-                    la.l2_cid != __constant_cpu_to_le16(L2CAP_CID_ATT))
+                    la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
                         return -EINVAL;
         }
 
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 98e9df3556e7..96670f581bb0 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -108,6 +108,7 @@ static const u16 mgmt_events[] = {
         MGMT_EV_DEVICE_UNPAIRED,
         MGMT_EV_PASSKEY_NOTIFY,
         MGMT_EV_NEW_IRK,
+        MGMT_EV_NEW_CSRK,
 };
 
 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
@@ -212,7 +213,7 @@ static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 
         hdr = (void *) skb_put(skb, sizeof(*hdr));
 
-        hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
+        hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
         hdr->index = cpu_to_le16(index);
         hdr->len = cpu_to_le16(sizeof(*ev));
 
@@ -243,7 +244,7 @@ static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 
         hdr = (void *) skb_put(skb, sizeof(*hdr));
 
-        hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
+        hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
         hdr->index = cpu_to_le16(index);
         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 
@@ -269,7 +270,7 @@ static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
         BT_DBG("sock %p", sk);
 
         rp.version = MGMT_VERSION;
-        rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
+        rp.revision = cpu_to_le16(MGMT_REVISION);
 
         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
                             sizeof(rp));
@@ -293,8 +294,8 @@ static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
         if (!rp)
                 return -ENOMEM;
 
-        rp->num_commands = __constant_cpu_to_le16(num_commands);
-        rp->num_events = __constant_cpu_to_le16(num_events);
+        rp->num_commands = cpu_to_le16(num_commands);
+        rp->num_events = cpu_to_le16(num_events);
 
         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
                 put_unaligned_le16(mgmt_commands[i], opcode);
@@ -857,8 +858,8 @@ static void enable_advertising(struct hci_request *req)
                 return;
 
         memset(&cp, 0, sizeof(cp));
-        cp.min_interval = __constant_cpu_to_le16(0x0800);
-        cp.max_interval = __constant_cpu_to_le16(0x0800);
+        cp.min_interval = cpu_to_le16(0x0800);
+        cp.max_interval = cpu_to_le16(0x0800);
         cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
         cp.own_address_type = own_addr_type;
         cp.channel_map = hdev->le_adv_channel_map;
@@ -1180,7 +1181,7 @@ static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
         if (hdev)
                 hdr->index = cpu_to_le16(hdev->id);
         else
-                hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
+                hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
         hdr->len = cpu_to_le16(data_len);
 
         if (data)
@@ -1492,15 +1493,15 @@ static void write_fast_connectable(struct hci_request *req, bool enable)
                 type = PAGE_SCAN_TYPE_INTERLACED;
 
                 /* 160 msec page scan interval */
-                acp.interval = __constant_cpu_to_le16(0x0100);
+                acp.interval = cpu_to_le16(0x0100);
         } else {
                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
 
                 /* default 1.28 sec page scan */
-                acp.interval = __constant_cpu_to_le16(0x0800);
+                acp.interval = cpu_to_le16(0x0800);
         }
 
-        acp.window = __constant_cpu_to_le16(0x0012);
+        acp.window = cpu_to_le16(0x0012);
 
         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
             __cpu_to_le16(hdev->page_scan_window) != acp.window)
@@ -2351,7 +2352,7 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
                                         sizeof(struct mgmt_link_key_info);
         if (expected_len != len) {
                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
-                       len, expected_len);
+                       expected_len, len);
                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
                                   MGMT_STATUS_INVALID_PARAMS);
         }
@@ -2761,11 +2762,23 @@ static struct pending_cmd *find_pairing(struct hci_conn *conn)
 
 static void pairing_complete(struct pending_cmd *cmd, u8 status)
 {
+        const struct mgmt_cp_pair_device *cp = cmd->param;
         struct mgmt_rp_pair_device rp;
         struct hci_conn *conn = cmd->user_data;
 
-        bacpy(&rp.addr.bdaddr, &conn->dst);
-        rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
+        /* If we had a pairing failure we might have already received
+         * the remote Identity Address Information and updated the
+         * hci_conn variables with it, however we would not yet have
+         * notified user space of the resolved identity. Therefore, use
+         * the address given in the Pair Device command in case the
+         * pairing failed.
+         */
+        if (status) {
+                memcpy(&rp.addr, &cp->addr, sizeof(rp.addr));
+        } else {
+                bacpy(&rp.addr.bdaddr, &conn->dst);
+                rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
+        }
 
         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
                      &rp, sizeof(rp));
@@ -4427,7 +4440,7 @@ static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
         if (expected_len != len) {
                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
-                       len, expected_len);
+                       expected_len, len);
                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
                                   MGMT_STATUS_INVALID_PARAMS);
         }
@@ -4507,7 +4520,7 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
                                         sizeof(struct mgmt_ltk_info);
         if (expected_len != len) {
                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
-                       len, expected_len);
+                       expected_len, len);
                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
                                   MGMT_STATUS_INVALID_PARAMS);
         }
@@ -5004,7 +5017,7 @@ void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
 }
 
-void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key)
+void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
 {
         struct mgmt_ev_new_long_term_key ev;
 
@@ -5025,7 +5038,7 @@ void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key)
             (key->bdaddr.b[5] & 0xc0) != 0xc0)
                 ev.store_hint = 0x00;
         else
-                ev.store_hint = 0x01;
+                ev.store_hint = persistent;
 
         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
@@ -5072,6 +5085,36 @@ void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
 }
 
+void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
+                   bool persistent)
+{
+        struct mgmt_ev_new_csrk ev;
+
+        memset(&ev, 0, sizeof(ev));
+
+        /* Devices using resolvable or non-resolvable random addresses
+         * without providing an indentity resolving key don't require
+         * to store signature resolving keys. Their addresses will change
+         * the next time around.
+         *
+         * Only when a remote device provides an identity address
+         * make sure the signature resolving key is stored. So allow
+         * static random and public addresses here.
+         */
+        if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
+            (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
+                ev.store_hint = 0x00;
+        else
+                ev.store_hint = persistent;
+
+        bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
+        ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
+        ev.key.master = csrk->master;
+        memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
+
+        mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
+}
+
 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
                                   u8 data_len)
 {
@@ -5665,9 +5708,9 @@ void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
 
         ev->rssi = rssi;
         if (cfm_name)
-                ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
+                ev->flags |= cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
         if (!ssp)
-                ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
+                ev->flags |= cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
 
         if (eir_len > 0)
                 memcpy(ev->eir, eir, eir_len);
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 21e15318937c..633cceeb943e 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -768,7 +768,7 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
 
         bacpy(&addr.l2_bdaddr, dst);
         addr.l2_family = AF_BLUETOOTH;
-        addr.l2_psm    = __constant_cpu_to_le16(RFCOMM_PSM);
+        addr.l2_psm    = cpu_to_le16(RFCOMM_PSM);
         addr.l2_cid    = 0;
         addr.l2_bdaddr_type = BDADDR_BREDR;
         *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
@@ -2032,7 +2032,7 @@ static int rfcomm_add_listener(bdaddr_t *ba)
         /* Bind socket */
         bacpy(&addr.l2_bdaddr, ba);
         addr.l2_family = AF_BLUETOOTH;
-        addr.l2_psm    = __constant_cpu_to_le16(RFCOMM_PSM);
+        addr.l2_psm    = cpu_to_le16(RFCOMM_PSM);
         addr.l2_cid    = 0;
         addr.l2_bdaddr_type = BDADDR_BREDR;
         err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 24fa3964b3c8..ab1e6fcca4c5 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -676,20 +676,20 @@ static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting)
                 bacpy(&cp.bdaddr, &conn->dst);
                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
 
-                cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
-                cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
+                cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
+                cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
                 cp.content_format = cpu_to_le16(setting);
 
                 switch (setting & SCO_AIRMODE_MASK) {
                 case SCO_AIRMODE_TRANSP:
                         if (conn->pkt_type & ESCO_2EV3)
-                                cp.max_latency = __constant_cpu_to_le16(0x0008);
+                                cp.max_latency = cpu_to_le16(0x0008);
                         else
-                                cp.max_latency = __constant_cpu_to_le16(0x000D);
+                                cp.max_latency = cpu_to_le16(0x000D);
                         cp.retrans_effort = 0x02;
                         break;
                 case SCO_AIRMODE_CVSD:
-                        cp.max_latency = __constant_cpu_to_le16(0xffff);
+                        cp.max_latency = cpu_to_le16(0xffff);
                         cp.retrans_effort = 0xff;
                         break;
                 }
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index f886bcae1b7e..2a7ee7f6cd8b 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -35,14 +35,14 @@
 
 #define AUTH_REQ_MASK   0x07
 
-static inline void swap128(u8 src[16], u8 dst[16])
+static inline void swap128(const u8 src[16], u8 dst[16])
 {
         int i;
         for (i = 0; i < 16; i++)
                 dst[15 - i] = src[i];
 }
 
-static inline void swap56(u8 src[7], u8 dst[7])
+static inline void swap56(const u8 src[7], u8 dst[7])
 {
         int i;
         for (i = 0; i < 7; i++)
@@ -53,6 +53,7 @@ static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
 {
         struct blkcipher_desc desc;
         struct scatterlist sg;
+        uint8_t tmp[16], data[16];
         int err;
 
         if (tfm == NULL) {
@@ -63,34 +64,40 @@ static int smp_e(struct crypto_blkcipher *tfm, const u8 *k, u8 *r)
         desc.tfm = tfm;
         desc.flags = 0;
 
-        err = crypto_blkcipher_setkey(tfm, k, 16);
+        /* The most significant octet of key corresponds to k[0] */
+        swap128(k, tmp);
+
+        err = crypto_blkcipher_setkey(tfm, tmp, 16);
         if (err) {
                 BT_ERR("cipher setkey failed: %d", err);
                 return err;
         }
 
-        sg_init_one(&sg, r, 16);
+        /* Most significant octet of plaintextData corresponds to data[0] */
+        swap128(r, data);
+
+        sg_init_one(&sg, data, 16);
 
         err = crypto_blkcipher_encrypt(&desc, &sg, &sg, 16);
         if (err)
                 BT_ERR("Encrypt data error %d", err);
 
+        /* Most significant octet of encryptedData corresponds to data[0] */
+        swap128(data, r);
+
         return err;
 }
 
 static int smp_ah(struct crypto_blkcipher *tfm, u8 irk[16], u8 r[3], u8 res[3])
 {
-        u8 _res[16], k[16];
+        u8 _res[16];
         int err;
 
         /* r' = padding || r */
-        memset(_res, 0, 13);
-        _res[13] = r[2];
-        _res[14] = r[1];
-        _res[15] = r[0];
+        memcpy(_res, r, 3);
+        memset(_res + 3, 0, 13);
 
-        swap128(irk, k);
-        err = smp_e(tfm, k, _res);
+        err = smp_e(tfm, irk, _res);
         if (err) {
                 BT_ERR("Encrypt error");
                 return err;
@@ -102,9 +109,7 @@ static int smp_ah(struct crypto_blkcipher *tfm, u8 irk[16], u8 r[3], u8 res[3])
          * by taking the least significant 24 bits of the output of e as the
          * result of ah.
          */
-        res[0] = _res[15];
-        res[1] = _res[14];
-        res[2] = _res[13];
+        memcpy(res, _res, 3);
 
         return 0;
 }
@@ -152,16 +157,15 @@ static int smp_c1(struct crypto_blkcipher *tfm, u8 k[16], u8 r[16],
         memset(p1, 0, 16);
 
         /* p1 = pres || preq || _rat || _iat */
-        swap56(pres, p1);
-        swap56(preq, p1 + 7);
-        p1[14] = _rat;
-        p1[15] = _iat;
-
-        memset(p2, 0, 16);
+        p1[0] = _iat;
+        p1[1] = _rat;
+        memcpy(p1 + 2, preq, 7);
+        memcpy(p1 + 9, pres, 7);
 
         /* p2 = padding || ia || ra */
-        baswap((bdaddr_t *) (p2 + 4), ia);
-        baswap((bdaddr_t *) (p2 + 10), ra);
+        memcpy(p2, ra, 6);
+        memcpy(p2 + 6, ia, 6);
+        memset(p2 + 12, 0, 4);
 
         /* res = r XOR p1 */
         u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
@@ -190,8 +194,8 @@ static int smp_s1(struct crypto_blkcipher *tfm, u8 k[16], u8 r1[16],
         int err;
 
         /* Just least significant octets from r1 and r2 are considered */
-        memcpy(_r, r1 + 8, 8);
-        memcpy(_r + 8, r2 + 8, 8);
+        memcpy(_r, r2, 8);
+        memcpy(_r + 8, r1, 8);
 
         err = smp_e(tfm, k, _r);
         if (err)
@@ -218,7 +222,7 @@ static struct sk_buff *smp_build_cmd(struct l2cap_conn *conn, u8 code,
 
         lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
         lh->len = cpu_to_le16(sizeof(code) + dlen);
-        lh->cid = __constant_cpu_to_le16(L2CAP_CID_SMP);
+        lh->cid = cpu_to_le16(L2CAP_CID_SMP);
 
         memcpy(skb_put(skb, sizeof(code)), &code, sizeof(code));
 
@@ -273,8 +277,8 @@ static void build_pairing_cmd(struct l2cap_conn *conn,
         u8 local_dist = 0, remote_dist = 0;
 
         if (test_bit(HCI_PAIRABLE, &conn->hcon->hdev->dev_flags)) {
-                local_dist = SMP_DIST_ENC_KEY;
-                remote_dist = SMP_DIST_ENC_KEY;
+                local_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
+                remote_dist = SMP_DIST_ENC_KEY | SMP_DIST_SIGN;
                 authreq |= SMP_AUTH_BONDING;
         } else {
                 authreq &= ~SMP_AUTH_BONDING;
@@ -403,16 +407,14 @@ static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
                         method = REQ_PASSKEY;
         }
 
-        /* Generate random passkey. Not valid until confirmed. */
+        /* Generate random passkey. */
         if (method == CFM_PASSKEY) {
-                u8 key[16];
-
-                memset(key, 0, sizeof(key));
+                memset(smp->tk, 0, sizeof(smp->tk));
                 get_random_bytes(&passkey, sizeof(passkey));
                 passkey %= 1000000;
-                put_unaligned_le32(passkey, key);
-                swap128(key, smp->tk);
+                put_unaligned_le32(passkey, smp->tk);
                 BT_DBG("PassKey: %d", passkey);
+                set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
         }
 
         hci_dev_lock(hcon->hdev);
@@ -421,7 +423,7 @@ static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
                 ret = mgmt_user_passkey_request(hcon->hdev, &hcon->dst,
                                                 hcon->type, hcon->dst_type);
         else
-                ret = mgmt_user_confirm_request(hcon->hdev, &hcon->dst,
+                ret = mgmt_user_passkey_notify(hcon->hdev, &hcon->dst,
                                                 hcon->type, hcon->dst_type,
                                                 cpu_to_le32(passkey), 0);
 
@@ -438,7 +440,7 @@ static void confirm_work(struct work_struct *work)
         struct crypto_blkcipher *tfm = hdev->tfm_aes;
         struct smp_cmd_pairing_confirm cp;
         int ret;
-        u8 res[16], reason;
+        u8 reason;
 
         BT_DBG("conn %p", conn);
 
@@ -447,7 +449,8 @@ static void confirm_work(struct work_struct *work)
 
         ret = smp_c1(tfm, smp->tk, smp->prnd, smp->preq, smp->prsp,
                      conn->hcon->init_addr_type, &conn->hcon->init_addr,
-                     conn->hcon->resp_addr_type, &conn->hcon->resp_addr, res);
+                     conn->hcon->resp_addr_type, &conn->hcon->resp_addr,
+                     cp.confirm_val);
 
         hci_dev_unlock(hdev);
 
@@ -458,7 +461,6 @@ static void confirm_work(struct work_struct *work)
 
         clear_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
 
-        swap128(res, cp.confirm_val);
         smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
 
         return;
@@ -474,7 +476,7 @@ static void random_work(struct work_struct *work)
         struct hci_conn *hcon = conn->hcon;
         struct hci_dev *hdev = hcon->hdev;
         struct crypto_blkcipher *tfm = hdev->tfm_aes;
-        u8 reason, confirm[16], res[16], key[16];
+        u8 reason, confirm[16];
         int ret;
 
         if (IS_ERR_OR_NULL(tfm)) {
@@ -489,7 +491,7 @@ static void random_work(struct work_struct *work)
 
         ret = smp_c1(tfm, smp->tk, smp->rrnd, smp->preq, smp->prsp,
                      hcon->init_addr_type, &hcon->init_addr,
-                     hcon->resp_addr_type, &hcon->resp_addr, res);
+                     hcon->resp_addr_type, &hcon->resp_addr, confirm);
 
         hci_dev_unlock(hdev);
 
@@ -498,8 +500,6 @@ static void random_work(struct work_struct *work)
                 goto error;
         }
 
-        swap128(res, confirm);
-
         if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
                 BT_ERR("Pairing failed (confirmation values mismatch)");
                 reason = SMP_CONFIRM_FAILED;
@@ -511,8 +511,7 @@ static void random_work(struct work_struct *work)
                 __le64 rand = 0;
                 __le16 ediv = 0;
 
-                smp_s1(tfm, smp->tk, smp->rrnd, smp->prnd, key);
-                swap128(key, stk);
+                smp_s1(tfm, smp->tk, smp->rrnd, smp->prnd, stk);
 
                 memset(stk + smp->enc_key_size, 0,
                        SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
@@ -525,15 +524,14 @@ static void random_work(struct work_struct *work)
                 hci_le_start_enc(hcon, ediv, rand, stk);
                 hcon->enc_key_size = smp->enc_key_size;
         } else {
-                u8 stk[16], r[16];
+                u8 stk[16];
                 __le64 rand = 0;
                 __le16 ediv = 0;
 
-                swap128(smp->prnd, r);
-                smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(r), r);
+                smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
+                             smp->prnd);
 
-                smp_s1(tfm, smp->tk, smp->prnd, smp->rrnd, key);
-                swap128(key, stk);
+                smp_s1(tfm, smp->tk, smp->prnd, smp->rrnd, stk);
 
                 memset(stk + smp->enc_key_size, 0,
                        SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
@@ -596,6 +594,9 @@ void smp_chan_destroy(struct l2cap_conn *conn)
         complete = test_bit(SMP_FLAG_COMPLETE, &smp->smp_flags);
         mgmt_smp_complete(conn->hcon, complete);
 
+        kfree(smp->csrk);
+        kfree(smp->slave_csrk);
+
         /* If pairing failed clean up any keys we might have */
         if (!complete) {
                 if (smp->ltk) {
@@ -625,7 +626,6 @@ int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
         struct l2cap_conn *conn = hcon->smp_conn;
         struct smp_chan *smp;
         u32 value;
-        u8 key[16];
 
         BT_DBG("");
 
@@ -637,10 +637,9 @@ int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
         switch (mgmt_op) {
         case MGMT_OP_USER_PASSKEY_REPLY:
                 value = le32_to_cpu(passkey);
-                memset(key, 0, sizeof(key));
+                memset(smp->tk, 0, sizeof(smp->tk));
                 BT_DBG("PassKey: %d", value);
-                put_unaligned_le32(value, key);
-                swap128(key, smp->tk);
+                put_unaligned_le32(value, smp->tk);
                 /* Fall Through */
         case MGMT_OP_USER_CONFIRM_REPLY:
                 set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
@@ -745,6 +744,11 @@ static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
         smp->prsp[0] = SMP_CMD_PAIRING_RSP;
         memcpy(&smp->prsp[1], rsp, sizeof(*rsp));
 
+        /* Update remote key distribution in case the remote cleared
+         * some bits that we had enabled in our request.
+         */
+        smp->remote_key_dist &= rsp->resp_key_dist;
+
         if ((req->auth_req & SMP_AUTH_BONDING) &&
             (rsp->auth_req & SMP_AUTH_BONDING))
                 auth = SMP_AUTH_BONDING;
@@ -758,10 +762,8 @@ static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
         set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
 
         /* Can't compose response until we have been confirmed */
-        if (!test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags))
-                return 0;
-
-        queue_work(hdev->workqueue, &smp->confirm);
+        if (test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags))
+                queue_work(hdev->workqueue, &smp->confirm);
 
         return 0;
 }
@@ -779,17 +781,13 @@ static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
         memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
         skb_pull(skb, sizeof(smp->pcnf));
 
-        if (conn->hcon->out) {
-                u8 random[16];
-
-                swap128(smp->prnd, random);
-                smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(random),
-                             random);
-        } else if (test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags)) {
+        if (conn->hcon->out)
+                smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
+                             smp->prnd);
+        else if (test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags))
                 queue_work(hdev->workqueue, &smp->confirm);
-        } else {
+        else
                 set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
-        }
 
         return 0;
 }
@@ -804,7 +802,7 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
         if (skb->len < sizeof(smp->rrnd))
                 return SMP_UNSPECIFIED;
 
-        swap128(skb->data, smp->rrnd);
+        memcpy(smp->rrnd, skb->data, sizeof(smp->rrnd));
         skb_pull(skb, sizeof(smp->rrnd));
 
         queue_work(hdev->workqueue, &smp->random);
@@ -910,6 +908,12 @@ int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
 
         authreq = seclevel_to_authreq(sec_level);
 
+        /* hcon->auth_type is set by pair_device in mgmt.c. If the MITM
+         * flag is set we should also set it for the SMP request.
+         */
+        if ((hcon->auth_type & 0x01))
+                authreq |= SMP_AUTH_MITM;
+
         if (hcon->link_mode & HCI_LM_MASTER) {
                 struct smp_cmd_pairing cp;
 
@@ -1065,6 +1069,41 @@ static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
         return 0;
 }
 
+static int smp_cmd_sign_info(struct l2cap_conn *conn, struct sk_buff *skb)
+{
+        struct smp_cmd_sign_info *rp = (void *) skb->data;
+        struct smp_chan *smp = conn->smp_chan;
+        struct hci_dev *hdev = conn->hcon->hdev;
+        struct smp_csrk *csrk;
+
+        BT_DBG("conn %p", conn);
+
+        if (skb->len < sizeof(*rp))
+                return SMP_UNSPECIFIED;
+
+        /* Ignore this PDU if it wasn't requested */
+        if (!(smp->remote_key_dist & SMP_DIST_SIGN))
+                return 0;
+
+        /* Mark the information as received */
+        smp->remote_key_dist &= ~SMP_DIST_SIGN;
+
+        skb_pull(skb, sizeof(*rp));
+
+        hci_dev_lock(hdev);
+        csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
+        if (csrk) {
+                csrk->master = 0x01;
+                memcpy(csrk->val, rp->csrk, sizeof(csrk->val));
+        }
+        smp->csrk = csrk;
+        if (!(smp->remote_key_dist & SMP_DIST_SIGN))
+                smp_distribute_keys(conn);
+        hci_dev_unlock(hdev);
+
+        return 0;
+}
+
 int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
 {
         struct hci_conn *hcon = conn->hcon;
@@ -1147,8 +1186,7 @@ int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
                 break;
 
         case SMP_CMD_SIGN_INFO:
-                /* Just ignored */
-                reason = 0;
+                reason = smp_cmd_sign_info(conn, skb);
                 break;
 
         default:
@@ -1172,20 +1210,40 @@ static void smp_notify_keys(struct l2cap_conn *conn)
         struct smp_chan *smp = conn->smp_chan;
         struct hci_conn *hcon = conn->hcon;
         struct hci_dev *hdev = hcon->hdev;
+        struct smp_cmd_pairing *req = (void *) &smp->preq[1];
+        struct smp_cmd_pairing *rsp = (void *) &smp->prsp[1];
+        bool persistent;
 
         if (smp->remote_irk)
                 mgmt_new_irk(hdev, smp->remote_irk);
 
+        /* The LTKs and CSRKs should be persistent only if both sides
+         * had the bonding bit set in their authentication requests.
+         */
+        persistent = !!((req->auth_req & rsp->auth_req) & SMP_AUTH_BONDING);
+
+        if (smp->csrk) {
+                smp->csrk->bdaddr_type = hcon->dst_type;
+                bacpy(&smp->csrk->bdaddr, &hcon->dst);
+                mgmt_new_csrk(hdev, smp->csrk, persistent);
+        }
+
+        if (smp->slave_csrk) {
+                smp->slave_csrk->bdaddr_type = hcon->dst_type;
+                bacpy(&smp->slave_csrk->bdaddr, &hcon->dst);
+                mgmt_new_csrk(hdev, smp->slave_csrk, persistent);
+        }
+
         if (smp->ltk) {
                 smp->ltk->bdaddr_type = hcon->dst_type;
                 bacpy(&smp->ltk->bdaddr, &hcon->dst);
-                mgmt_new_ltk(hdev, smp->ltk);
+                mgmt_new_ltk(hdev, smp->ltk, persistent);
         }
 
         if (smp->slave_ltk) {
                 smp->slave_ltk->bdaddr_type = hcon->dst_type;
                 bacpy(&smp->slave_ltk->bdaddr, &hcon->dst);
-                mgmt_new_ltk(hdev, smp->slave_ltk);
+                mgmt_new_ltk(hdev, smp->slave_ltk, persistent);
         }
 }
 
@@ -1274,10 +1332,18 @@ int smp_distribute_keys(struct l2cap_conn *conn)
 
         if (*keydist & SMP_DIST_SIGN) {
                 struct smp_cmd_sign_info sign;
+                struct smp_csrk *csrk;
 
-                /* Send a dummy key */
+                /* Generate a new random key */
                 get_random_bytes(sign.csrk, sizeof(sign.csrk));
 
+                csrk = kzalloc(sizeof(*csrk), GFP_KERNEL);
+                if (csrk) {
+                        csrk->master = 0x00;
+                        memcpy(csrk->val, sign.csrk, sizeof(csrk->val));
+                }
+                smp->slave_csrk = csrk;
+
                 smp_send_cmd(conn, SMP_CMD_SIGN_INFO, sizeof(sign), &sign);
 
                 *keydist &= ~SMP_DIST_SIGN;
diff --git a/net/bluetooth/smp.h b/net/bluetooth/smp.h
index f55d83617218..b6913471815a 100644
--- a/net/bluetooth/smp.h
+++ b/net/bluetooth/smp.h
@@ -121,7 +121,7 @@ struct smp_cmd_security_req {
 #define SMP_FLAG_LTK_ENCRYPT    4
 #define SMP_FLAG_COMPLETE       5
 
-#define SMP_REENCRYPT_TIMEOUT   msecs_to_jiffies(250)
+#define SMP_REENCRYPT_TIMEOUT   msecs_to_jiffies(500)
 
 struct smp_chan {
         struct l2cap_conn *conn;
@@ -136,6 +136,8 @@ struct smp_chan {
         bdaddr_t        id_addr;
         u8              id_addr_type;
         u8              irk[16];
+        struct smp_csrk *csrk;
+        struct smp_csrk *slave_csrk;
         struct smp_ltk  *ltk;
         struct smp_ltk  *slave_ltk;
         struct smp_irk  *remote_irk;
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 1acb29109b45..aaa59d719592 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2914,11 +2914,11 @@ static int ieee80211_cancel_remain_on_channel(struct wiphy *wiphy,
 
 static int ieee80211_start_radar_detection(struct wiphy *wiphy,
                                            struct net_device *dev,
-                                           struct cfg80211_chan_def *chandef)
+                                           struct cfg80211_chan_def *chandef,
+                                           u32 cac_time_ms)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
-        unsigned long timeout;
         int err;
 
         mutex_lock(&local->mtx);
@@ -2937,9 +2937,9 @@ static int ieee80211_start_radar_detection(struct wiphy *wiphy,
         if (err)
                 goto out_unlock;
 
-        timeout = msecs_to_jiffies(IEEE80211_DFS_MIN_CAC_TIME_MS);
         ieee80211_queue_delayed_work(&sdata->local->hw,
-                                     &sdata->dfs_cac_timer_work, timeout);
+                                     &sdata->dfs_cac_timer_work,
+                                     msecs_to_jiffies(cac_time_ms));
 
  out_unlock:
         mutex_unlock(&local->mtx);
@@ -3089,52 +3089,11 @@ unlock:
         sdata_unlock(sdata);
 }
 
-int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
-                             struct cfg80211_csa_settings *params)
+static int ieee80211_set_csa_beacon(struct ieee80211_sub_if_data *sdata,
+                                    struct cfg80211_csa_settings *params,
+                                    u32 *changed)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_chanctx_conf *chanctx_conf;
-        struct ieee80211_chanctx *chanctx;
-        struct ieee80211_if_mesh __maybe_unused *ifmsh;
-        int err, num_chanctx, changed = 0;
-
-        sdata_assert_lock(sdata);
-
-        if (!list_empty(&local->roc_list) || local->scanning)
-                return -EBUSY;
-
-        if (sdata->wdev.cac_started)
-                return -EBUSY;
-
-        if (cfg80211_chandef_identical(&params->chandef,
-                                       &sdata->vif.bss_conf.chandef))
-                return -EINVAL;
-
-        rcu_read_lock();
-        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
-        if (!chanctx_conf) {
-                rcu_read_unlock();
-                return -EBUSY;
-        }
-
-        /* don't handle for multi-VIF cases */
-        chanctx = container_of(chanctx_conf, struct ieee80211_chanctx, conf);
-        if (chanctx->refcount > 1) {
-                rcu_read_unlock();
-                return -EBUSY;
-        }
-        num_chanctx = 0;
-        list_for_each_entry_rcu(chanctx, &local->chanctx_list, list)
-                num_chanctx++;
-        rcu_read_unlock();
-
-        if (num_chanctx > 1)
-                return -EBUSY;
-
-        /* don't allow another channel switch if one is already active. */
-        if (sdata->vif.csa_active)
-                return -EBUSY;
+        int err;
 
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_AP:
@@ -3170,7 +3129,7 @@ int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
                         kfree(sdata->u.ap.next_beacon);
                         return err;
                 }
-                changed |= err;
+                *changed |= err;
 
                 break;
         case NL80211_IFTYPE_ADHOC:
@@ -3204,15 +3163,15 @@ int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
                         err = ieee80211_ibss_csa_beacon(sdata, params);
                         if (err < 0)
                                 return err;
-                        changed |= err;
+                        *changed |= err;
                 }
 
                 ieee80211_send_action_csa(sdata, params);
 
                 break;
 #ifdef CONFIG_MAC80211_MESH
-        case NL80211_IFTYPE_MESH_POINT:
-                ifmsh = &sdata->u.mesh;
+        case NL80211_IFTYPE_MESH_POINT: {
+                struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
 
                 if (params->chandef.width != sdata->vif.bss_conf.chandef.width)
                         return -EINVAL;
@@ -3237,18 +3196,72 @@ int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
                                 ifmsh->csa_role = IEEE80211_MESH_CSA_ROLE_NONE;
                                 return err;
                         }
-                        changed |= err;
+                        *changed |= err;
                 }
 
                 if (ifmsh->csa_role == IEEE80211_MESH_CSA_ROLE_INIT)
                         ieee80211_send_action_csa(sdata, params);
 
                 break;
+                }
 #endif
         default:
                 return -EOPNOTSUPP;
         }
 
+        return 0;
+}
+
+int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
+                             struct cfg80211_csa_settings *params)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_chanctx_conf *chanctx_conf;
+        struct ieee80211_chanctx *chanctx;
+        int err, num_chanctx, changed = 0;
+
+        sdata_assert_lock(sdata);
+
+        if (!list_empty(&local->roc_list) || local->scanning)
+                return -EBUSY;
+
+        if (sdata->wdev.cac_started)
+                return -EBUSY;
+
+        if (cfg80211_chandef_identical(&params->chandef,
+                                       &sdata->vif.bss_conf.chandef))
+                return -EINVAL;
+
+        rcu_read_lock();
+        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
+        if (!chanctx_conf) {
+                rcu_read_unlock();
+                return -EBUSY;
+        }
+
+        /* don't handle for multi-VIF cases */
+        chanctx = container_of(chanctx_conf, struct ieee80211_chanctx, conf);
+        if (chanctx->refcount > 1) {
+                rcu_read_unlock();
+                return -EBUSY;
+        }
+        num_chanctx = 0;
+        list_for_each_entry_rcu(chanctx, &local->chanctx_list, list)
+                num_chanctx++;
+        rcu_read_unlock();
+
+        if (num_chanctx > 1)
+                return -EBUSY;
+
+        /* don't allow another channel switch if one is already active. */
+        if (sdata->vif.csa_active)
+                return -EBUSY;
+
+        err = ieee80211_set_csa_beacon(sdata, params, &changed);
+        if (err)
+                return err;
+
         sdata->csa_radar_required = params->radar_required;
 
         if (params->block_tx)
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index e458ca0dffec..06d28787945b 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -991,7 +991,6 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                                   struct ieee802_11_elems *elems)
 {
         struct ieee80211_local *local = sdata->local;
-        int freq;
         struct cfg80211_bss *cbss;
         struct ieee80211_bss *bss;
         struct sta_info *sta;
@@ -1003,15 +1002,8 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_supported_band *sband = local->hw.wiphy->bands[band];
         bool rates_updated = false;
 
-        if (elems->ds_params)
-                freq = ieee80211_channel_to_frequency(elems->ds_params[0],
-                                                      band);
-        else
-                freq = rx_status->freq;
-
-        channel = ieee80211_get_channel(local->hw.wiphy, freq);
-
-        if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
+        channel = ieee80211_get_channel(local->hw.wiphy, rx_status->freq);
+        if (!channel)
                 return;
 
         if (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 0d1a0f801b94..222c28b75315 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1391,6 +1391,7 @@ void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata);
 void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata);
 void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
                                   __le16 fc, bool acked);
+void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata);
 void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata);
 
 /* IBSS code */
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 94f0af29b742..dee50aefd6e8 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2783,28 +2783,20 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                                   struct ieee802_11_elems *elems)
 {
         struct ieee80211_local *local = sdata->local;
-        int freq;
         struct ieee80211_bss *bss;
         struct ieee80211_channel *channel;
 
         sdata_assert_lock(sdata);
 
-        if (elems->ds_params)
-                freq = ieee80211_channel_to_frequency(elems->ds_params[0],
-                                                      rx_status->band);
-        else
-                freq = rx_status->freq;
-
-        channel = ieee80211_get_channel(local->hw.wiphy, freq);
-
-        if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
+        channel = ieee80211_get_channel(local->hw.wiphy, rx_status->freq);
+        if (!channel)
                 return;
 
         bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
                                         channel);
         if (bss) {
-                ieee80211_rx_bss_put(local, bss);
                 sdata->vif.bss_conf.beacon_rate = bss->beacon_rate;
+                ieee80211_rx_bss_put(local, bss);
         }
 }
 
@@ -3599,6 +3591,32 @@ static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
 }
 
 #ifdef CONFIG_PM
+void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
+
+        sdata_lock(sdata);
+
+        if (ifmgd->auth_data) {
+                /*
+                 * If we are trying to authenticate while suspending, cfg80211
+                 * won't know and won't actually abort those attempts, thus we
+                 * need to do that ourselves.
+                 */
+                ieee80211_send_deauth_disassoc(sdata,
+                                               ifmgd->auth_data->bss->bssid,
+                                               IEEE80211_STYPE_DEAUTH,
+                                               WLAN_REASON_DEAUTH_LEAVING,
+                                               false, frame_buf);
+                ieee80211_destroy_auth_data(sdata, false);
+                cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
+                                      IEEE80211_DEAUTH_FRAME_LEN);
+        }
+
+        sdata_unlock(sdata);
+}
+
 void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
@@ -4417,37 +4435,41 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
         bool tx = !req->local_state_change;
-        bool report_frame = false;
 
-        sdata_info(sdata,
-                   "deauthenticating from %pM by local choice (Reason: %u=%s)\n",
-                   req->bssid, req->reason_code, ieee80211_get_reason_code_string(req->reason_code));
+        if (ifmgd->auth_data &&
+            ether_addr_equal(ifmgd->auth_data->bss->bssid, req->bssid)) {
+                sdata_info(sdata,
+                           "aborting authentication with %pM by local choice (Reason: %u=%s)\n",
+                           req->bssid, req->reason_code,
+                           ieee80211_get_reason_code_string(req->reason_code));
 
-        if (ifmgd->auth_data) {
                 drv_mgd_prepare_tx(sdata->local, sdata);
                 ieee80211_send_deauth_disassoc(sdata, req->bssid,
                                                IEEE80211_STYPE_DEAUTH,
                                                req->reason_code, tx,
                                                frame_buf);
                 ieee80211_destroy_auth_data(sdata, false);
+                cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
+                                      IEEE80211_DEAUTH_FRAME_LEN);
 
-                report_frame = true;
-                goto out;
+                return 0;
         }
 
         if (ifmgd->associated &&
             ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
+                sdata_info(sdata,
+                           "deauthenticating from %pM by local choice (Reason: %u=%s)\n",
+                           req->bssid, req->reason_code,
+                           ieee80211_get_reason_code_string(req->reason_code));
+
                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
                                        req->reason_code, tx, frame_buf);
-                report_frame = true;
-        }
-
- out:
-        if (report_frame)
                 cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
                                       IEEE80211_DEAUTH_FRAME_LEN);
+                return 0;
+        }
 
-        return 0;
+        return -ENOTCONN;
 }
 
 int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index af64fb8e8add..d478b880a0af 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -100,10 +100,18 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
 
         /* remove all interfaces that were created in the driver */
         list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!ieee80211_sdata_running(sdata) ||
-                    sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
-                    sdata->vif.type == NL80211_IFTYPE_MONITOR)
+                if (!ieee80211_sdata_running(sdata))
                         continue;
+                switch (sdata->vif.type) {
+                case NL80211_IFTYPE_AP_VLAN:
+                case NL80211_IFTYPE_MONITOR:
+                        continue;
+                case NL80211_IFTYPE_STATION:
+                        ieee80211_mgd_quiesce(sdata);
+                        break;
+                default:
+                        break;
+                }
 
                 drv_remove_interface(local, sdata);
         }
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 5b617660b0ba..216c45b949e5 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -333,6 +333,8 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
                 /* in VHT, STBC is binary */
                 if (status->flag & RX_FLAG_STBC_MASK)
                         *pos |= IEEE80211_RADIOTAP_VHT_FLAG_STBC;
+                if (status->vht_flag & RX_VHT_FLAG_BF)
+                        *pos |= IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED;
                 pos++;
                 /* bandwidth */
                 if (status->vht_flag & RX_VHT_FLAG_80MHZ)
@@ -1245,6 +1247,7 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
                 if (ieee80211_is_data(hdr->frame_control)) {
                         sta->last_rx_rate_idx = status->rate_idx;
                         sta->last_rx_rate_flag = status->flag;
+                        sta->last_rx_rate_vht_flag = status->vht_flag;
                         sta->last_rx_rate_vht_nss = status->vht_nss;
                 }
         }
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 836f500dfbf3..3ce7f2c8539a 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -1055,9 +1055,11 @@ int ieee80211_request_sched_scan_stop(struct ieee80211_sub_if_data *sdata)
         /* We don't want to restart sched scan anymore. */
         local->sched_scan_req = NULL;
 
-        if (rcu_access_pointer(local->sched_scan_sdata))
+        if (rcu_access_pointer(local->sched_scan_sdata)) {
                 ret = drv_sched_scan_stop(local, sdata);
-
+                if (!ret)
+                        rcu_assign_pointer(local->sched_scan_sdata, NULL);
+        }
 out:
         mutex_unlock(&local->mtx);
 
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index cd9f80498c48..19d36d4117e0 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2900,7 +2900,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
                                 cpu_to_le16(IEEE80211_FCTL_MOREDATA);
                 }
 
-                if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                if (sdata->vif.type == NL80211_IFTYPE_AP)
                         sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
                 if (!ieee80211_tx_prepare(sdata, &tx, skb))
                         break;
diff --git a/net/nfc/core.c b/net/nfc/core.c
index ca1e65f4b133..819b87702b70 100644
--- a/net/nfc/core.c
+++ b/net/nfc/core.c
@@ -280,9 +280,6 @@ static struct nfc_target *nfc_find_target(struct nfc_dev *dev, u32 target_idx)
 {
         int i;
 
-        if (dev->n_targets == 0)
-                return NULL;
-
         for (i = 0; i < dev->n_targets; i++) {
                 if (dev->targets[i].idx == target_idx)
                         return &dev->targets[i];
@@ -546,9 +543,9 @@ error:
 
 struct nfc_se *nfc_find_se(struct nfc_dev *dev, u32 se_idx)
 {
-        struct nfc_se *se, *n;
+        struct nfc_se *se;
 
-        list_for_each_entry_safe(se, n, &dev->secure_elements, list)
+        list_for_each_entry(se, &dev->secure_elements, list)
                 if (se->idx == se_idx)
                         return se;
 
@@ -655,9 +652,6 @@ int nfc_set_remote_general_bytes(struct nfc_dev *dev, u8 *gb, u8 gb_len)
 {
         pr_debug("dev_name=%s gb_len=%d\n", dev_name(&dev->dev), gb_len);
 
-        if (gb_len > NFC_MAX_GT_LEN)
-                return -EINVAL;
-
         return nfc_llcp_set_remote_gb(dev, gb, gb_len);
 }
 EXPORT_SYMBOL(nfc_set_remote_general_bytes);
diff --git a/net/nfc/digital.h b/net/nfc/digital.h
index 08b29b55ea63..3759add68b1b 100644
--- a/net/nfc/digital.h
+++ b/net/nfc/digital.h
@@ -72,6 +72,12 @@ void digital_poll_next_tech(struct nfc_digital_dev *ddev);
 
 int digital_in_send_sens_req(struct nfc_digital_dev *ddev, u8 rf_tech);
 int digital_in_send_sensf_req(struct nfc_digital_dev *ddev, u8 rf_tech);
+int digital_in_send_iso15693_inv_req(struct nfc_digital_dev *ddev, u8 rf_tech);
+
+int digital_in_iso_dep_pull_sod(struct nfc_digital_dev *ddev,
+                                struct sk_buff *skb);
+int digital_in_iso_dep_push_sod(struct nfc_digital_dev *ddev,
+                                struct sk_buff *skb);
 
 int digital_target_found(struct nfc_digital_dev *ddev,
                          struct nfc_target *target, u8 protocol);
diff --git a/net/nfc/digital_core.c b/net/nfc/digital_core.c
index c129d1571ca6..e01e15dbf1ab 100644
--- a/net/nfc/digital_core.c
+++ b/net/nfc/digital_core.c
@@ -25,6 +25,8 @@
 #define DIGITAL_PROTO_NFCF_RF_TECH \
         (NFC_PROTO_FELICA_MASK | NFC_PROTO_NFC_DEP_MASK)
 
+#define DIGITAL_PROTO_ISO15693_RF_TECH  NFC_PROTO_ISO15693_MASK
+
 struct digital_cmd {
         struct list_head queue;
 
@@ -331,6 +333,18 @@ int digital_target_found(struct nfc_digital_dev *ddev,
                 }
                 break;
 
+        case NFC_PROTO_ISO15693:
+                framing = NFC_DIGITAL_FRAMING_ISO15693_T5T;
+                check_crc = digital_skb_check_crc_b;
+                add_crc = digital_skb_add_crc_b;
+                break;
+
+        case NFC_PROTO_ISO14443:
+                framing = NFC_DIGITAL_FRAMING_NFCA_T4T;
+                check_crc = digital_skb_check_crc_a;
+                add_crc = digital_skb_add_crc_a;
+                break;
+
         default:
                 pr_err("Invalid protocol %d\n", protocol);
                 return -EINVAL;
@@ -461,7 +475,7 @@ static int digital_start_poll(struct nfc_dev *nfc_dev, __u32 im_protocols,
                 digital_add_poll_tech(ddev, NFC_DIGITAL_RF_TECH_106A,
                                       digital_in_send_sens_req);
 
-        if (im_protocols & DIGITAL_PROTO_NFCF_RF_TECH) {
+        if (matching_im_protocols & DIGITAL_PROTO_NFCF_RF_TECH) {
                 digital_add_poll_tech(ddev, NFC_DIGITAL_RF_TECH_212F,
                                       digital_in_send_sensf_req);
 
@@ -469,7 +483,11 @@ static int digital_start_poll(struct nfc_dev *nfc_dev, __u32 im_protocols,
                                       digital_in_send_sensf_req);
         }
 
-        if (tm_protocols & NFC_PROTO_NFC_DEP_MASK) {
+        if (matching_im_protocols & DIGITAL_PROTO_ISO15693_RF_TECH)
+                digital_add_poll_tech(ddev, NFC_DIGITAL_RF_TECH_ISO15693,
+                                      digital_in_send_iso15693_inv_req);
+
+        if (matching_tm_protocols & NFC_PROTO_NFC_DEP_MASK) {
                 if (ddev->ops->tg_listen_mdaa) {
                         digital_add_poll_tech(ddev, 0,
                                               digital_tg_listen_mdaa);
@@ -607,20 +625,30 @@ static void digital_in_send_complete(struct nfc_digital_dev *ddev, void *arg,
 
         if (IS_ERR(resp)) {
                 rc = PTR_ERR(resp);
+                resp = NULL;
                 goto done;
         }
 
-        if (ddev->curr_protocol == NFC_PROTO_MIFARE)
+        if (ddev->curr_protocol == NFC_PROTO_MIFARE) {
                 rc = digital_in_recv_mifare_res(resp);
-        else
-                rc = ddev->skb_check_crc(resp);
+                /* crc check is done in digital_in_recv_mifare_res() */
+                goto done;
+        }
 
+        if (ddev->curr_protocol == NFC_PROTO_ISO14443) {
+                rc = digital_in_iso_dep_pull_sod(ddev, resp);
+                if (rc)
+                        goto done;
+        }
+
+        rc = ddev->skb_check_crc(resp);
+
+done:
         if (rc) {
                 kfree_skb(resp);
                 resp = NULL;
         }
 
-done:
         data_exch->cb(data_exch->cb_context, resp, rc);
 
         kfree(data_exch);
@@ -632,6 +660,7 @@ static int digital_in_send(struct nfc_dev *nfc_dev, struct nfc_target *target,
 {
         struct nfc_digital_dev *ddev = nfc_get_drvdata(nfc_dev);
         struct digital_data_exch *data_exch;
+        int rc;
 
         data_exch = kzalloc(sizeof(struct digital_data_exch), GFP_KERNEL);
         if (!data_exch) {
@@ -642,13 +671,27 @@ static int digital_in_send(struct nfc_dev *nfc_dev, struct nfc_target *target,
         data_exch->cb = cb;
         data_exch->cb_context = cb_context;
 
-        if (ddev->curr_protocol == NFC_PROTO_NFC_DEP)
-                return digital_in_send_dep_req(ddev, target, skb, data_exch);
+        if (ddev->curr_protocol == NFC_PROTO_NFC_DEP) {
+                rc = digital_in_send_dep_req(ddev, target, skb, data_exch);
+                goto exit;
+        }
+
+        if (ddev->curr_protocol == NFC_PROTO_ISO14443) {
+                rc = digital_in_iso_dep_push_sod(ddev, skb);
+                if (rc)
+                        goto exit;
+        }
 
         ddev->skb_add_crc(skb);
 
-        return digital_in_send_cmd(ddev, skb, 500, digital_in_send_complete,
-                                   data_exch);
+        rc = digital_in_send_cmd(ddev, skb, 500, digital_in_send_complete,
+                                 data_exch);
+
+exit:
+        if (rc)
+                kfree(data_exch);
+
+        return rc;
 }
 
 static struct nfc_ops digital_nfc_ops = {
@@ -700,6 +743,10 @@ struct nfc_digital_dev *nfc_digital_allocate_device(struct nfc_digital_ops *ops,
                 ddev->protocols |= NFC_PROTO_FELICA_MASK;
         if (supported_protocols & NFC_PROTO_NFC_DEP_MASK)
                 ddev->protocols |= NFC_PROTO_NFC_DEP_MASK;
+        if (supported_protocols & NFC_PROTO_ISO15693_MASK)
+                ddev->protocols |= NFC_PROTO_ISO15693_MASK;
+        if (supported_protocols & NFC_PROTO_ISO14443_MASK)
+                ddev->protocols |= NFC_PROTO_ISO14443_MASK;
 
         ddev->tx_headroom = tx_headroom + DIGITAL_MAX_HEADER_LEN;
         ddev->tx_tailroom = tx_tailroom + DIGITAL_CRC_LEN;
diff --git a/net/nfc/digital_technology.c b/net/nfc/digital_technology.c
index 251c8c753ebe..278c3fed27e0 100644
--- a/net/nfc/digital_technology.c
+++ b/net/nfc/digital_technology.c
@@ -30,6 +30,7 @@
 
 #define DIGITAL_SEL_RES_NFCID1_COMPLETE(sel_res) (!((sel_res) & 0x04))
 #define DIGITAL_SEL_RES_IS_T2T(sel_res) (!((sel_res) & 0x60))
+#define DIGITAL_SEL_RES_IS_T4T(sel_res) ((sel_res) & 0x20)
 #define DIGITAL_SEL_RES_IS_NFC_DEP(sel_res) ((sel_res) & 0x40)
 
 #define DIGITAL_SENS_RES_IS_T1T(sens_res) (((sens_res) & 0x0C00) == 0x0C00)
@@ -51,6 +52,34 @@
 #define DIGITAL_SENSF_REQ_RC_SC   1
 #define DIGITAL_SENSF_REQ_RC_AP   2
 
+#define DIGITAL_CMD_ISO15693_INVENTORY_REQ      0x01
+
+#define DIGITAL_ISO15693_REQ_FLAG_DATA_RATE     BIT(1)
+#define DIGITAL_ISO15693_REQ_FLAG_INVENTORY     BIT(2)
+#define DIGITAL_ISO15693_REQ_FLAG_NB_SLOTS      BIT(5)
+#define DIGITAL_ISO15693_RES_FLAG_ERROR         BIT(0)
+#define DIGITAL_ISO15693_RES_IS_VALID(flags) \
+        (!((flags) & DIGITAL_ISO15693_RES_FLAG_ERROR))
+
+#define DIGITAL_ISO_DEP_I_PCB    0x02
+#define DIGITAL_ISO_DEP_PNI(pni) ((pni) & 0x01)
+
+#define DIGITAL_ISO_DEP_PCB_TYPE(pcb) ((pcb) & 0xC0)
+
+#define DIGITAL_ISO_DEP_I_BLOCK 0x00
+
+#define DIGITAL_ISO_DEP_BLOCK_HAS_DID(pcb) ((pcb) & 0x08)
+
+static const u8 digital_ats_fsc[] = {
+         16,  24,  32,  40,  48,  64,  96, 128,
+};
+
+#define DIGITAL_ATS_FSCI(t0) ((t0) & 0x0F)
+#define DIGITAL_ATS_MAX_FSC  256
+
+#define DIGITAL_RATS_BYTE1 0xE0
+#define DIGITAL_RATS_PARAM 0x80
+
 struct digital_sdd_res {
         u8 nfcid1[4];
         u8 bcc;
@@ -82,9 +111,127 @@ struct digital_sensf_res {
         u8 rd[2];
 } __packed;
 
+struct digital_iso15693_inv_req {
+        u8 flags;
+        u8 cmd;
+        u8 mask_len;
+        u64 mask;
+} __packed;
+
+struct digital_iso15693_inv_res {
+        u8 flags;
+        u8 dsfid;
+        u64 uid;
+} __packed;
+
 static int digital_in_send_sdd_req(struct nfc_digital_dev *ddev,
                                    struct nfc_target *target);
 
+int digital_in_iso_dep_pull_sod(struct nfc_digital_dev *ddev,
+                                struct sk_buff *skb)
+{
+        u8 pcb;
+        u8 block_type;
+
+        if (skb->len < 1)
+                return -EIO;
+
+        pcb = *skb->data;
+        block_type = DIGITAL_ISO_DEP_PCB_TYPE(pcb);
+
+        /* No support fo R-block nor S-block */
+        if (block_type != DIGITAL_ISO_DEP_I_BLOCK) {
+                pr_err("ISO_DEP R-block and S-block not supported\n");
+                return -EIO;
+        }
+
+        if (DIGITAL_ISO_DEP_BLOCK_HAS_DID(pcb)) {
+                pr_err("DID field in ISO_DEP PCB not supported\n");
+                return -EIO;
+        }
+
+        skb_pull(skb, 1);
+
+        return 0;
+}
+
+int digital_in_iso_dep_push_sod(struct nfc_digital_dev *ddev,
+                                struct sk_buff *skb)
+{
+        /*
+         * Chaining not supported so skb->len + 1 PCB byte + 2 CRC bytes must
+         * not be greater than remote FSC
+         */
+        if (skb->len + 3 > ddev->target_fsc)
+                return -EIO;
+
+        skb_push(skb, 1);
+
+        *skb->data = DIGITAL_ISO_DEP_I_PCB | ddev->curr_nfc_dep_pni;
+
+        ddev->curr_nfc_dep_pni =
+                DIGITAL_ISO_DEP_PNI(ddev->curr_nfc_dep_pni + 1);
+
+        return 0;
+}
+
+static void digital_in_recv_ats(struct nfc_digital_dev *ddev, void *arg,
+                                struct sk_buff *resp)
+{
+        struct nfc_target *target = arg;
+        u8 fsdi;
+        int rc;
+
+        if (IS_ERR(resp)) {
+                rc = PTR_ERR(resp);
+                resp = NULL;
+                goto exit;
+        }
+
+        if (resp->len < 2) {
+                rc = -EIO;
+                goto exit;
+        }
+
+        fsdi = DIGITAL_ATS_FSCI(resp->data[1]);
+        if (fsdi >= 8)
+                ddev->target_fsc = DIGITAL_ATS_MAX_FSC;
+        else
+                ddev->target_fsc = digital_ats_fsc[fsdi];
+
+        ddev->curr_nfc_dep_pni = 0;
+
+        rc = digital_target_found(ddev, target, NFC_PROTO_ISO14443);
+
+exit:
+        dev_kfree_skb(resp);
+        kfree(target);
+
+        if (rc)
+                digital_poll_next_tech(ddev);
+}
+
+static int digital_in_send_rats(struct nfc_digital_dev *ddev,
+                                struct nfc_target *target)
+{
+        int rc;
+        struct sk_buff *skb;
+
+        skb = digital_skb_alloc(ddev, 2);
+        if (!skb)
+                return -ENOMEM;
+
+        *skb_put(skb, 1) = DIGITAL_RATS_BYTE1;
+        *skb_put(skb, 1) = DIGITAL_RATS_PARAM;
+
+        rc = digital_in_send_cmd(ddev, skb, 30, digital_in_recv_ats,
+                                 target);
+        if (rc)
+                kfree_skb(skb);
+
+        return rc;
+}
+
 static void digital_in_recv_sel_res(struct nfc_digital_dev *ddev, void *arg,
                                     struct sk_buff *resp)
 {
@@ -122,8 +269,19 @@ static void digital_in_recv_sel_res(struct nfc_digital_dev *ddev, void *arg,
                 goto exit_free_skb;
         }
 
+        target->sel_res = sel_res;
+
         if (DIGITAL_SEL_RES_IS_T2T(sel_res)) {
                 nfc_proto = NFC_PROTO_MIFARE;
+        } else if (DIGITAL_SEL_RES_IS_T4T(sel_res)) {
+                rc = digital_in_send_rats(ddev, target);
+                if (rc)
+                        goto exit;
+                /*
+                 * Skip target_found and don't free it for now. This will be
+                 * done when receiving the ATS
+                 */
+                goto exit_free_skb;
         } else if (DIGITAL_SEL_RES_IS_NFC_DEP(sel_res)) {
                 nfc_proto = NFC_PROTO_NFC_DEP;
         } else {
@@ -131,8 +289,6 @@ static void digital_in_recv_sel_res(struct nfc_digital_dev *ddev, void *arg,
                 goto exit;
         }
 
-        target->sel_res = sel_res;
-
         rc = digital_target_found(ddev, target, nfc_proto);
 
 exit:
@@ -473,6 +629,93 @@ int digital_in_send_sensf_req(struct nfc_digital_dev *ddev, u8 rf_tech)
         return rc;
 }
 
+static void digital_in_recv_iso15693_inv_res(struct nfc_digital_dev *ddev,
+                void *arg, struct sk_buff *resp)
+{
+        struct digital_iso15693_inv_res *res;
+        struct nfc_target *target = NULL;
+        int rc;
+
+        if (IS_ERR(resp)) {
+                rc = PTR_ERR(resp);
+                resp = NULL;
+                goto out_free_skb;
+        }
+
+        if (resp->len != sizeof(*res)) {
+                rc = -EIO;
+                goto out_free_skb;
+        }
+
+        res = (struct digital_iso15693_inv_res *)resp->data;
+
+        if (!DIGITAL_ISO15693_RES_IS_VALID(res->flags)) {
+                PROTOCOL_ERR("ISO15693 - 10.3.1");
+                rc = -EINVAL;
+                goto out_free_skb;
+        }
+
+        target = kzalloc(sizeof(*target), GFP_KERNEL);
+        if (!target) {
+                rc = -ENOMEM;
+                goto out_free_skb;
+        }
+
+        target->is_iso15693 = 1;
+        target->iso15693_dsfid = res->dsfid;
+        memcpy(target->iso15693_uid, &res->uid, sizeof(target->iso15693_uid));
+
+        rc = digital_target_found(ddev, target, NFC_PROTO_ISO15693);
+
+        kfree(target);
+
+out_free_skb:
+        dev_kfree_skb(resp);
+
+        if (rc)
+                digital_poll_next_tech(ddev);
+}
+
+int digital_in_send_iso15693_inv_req(struct nfc_digital_dev *ddev, u8 rf_tech)
+{
+        struct digital_iso15693_inv_req *req;
+        struct sk_buff *skb;
+        int rc;
+
+        rc = digital_in_configure_hw(ddev, NFC_DIGITAL_CONFIG_RF_TECH,
+                                     NFC_DIGITAL_RF_TECH_ISO15693);
+        if (rc)
+                return rc;
+
+        rc = digital_in_configure_hw(ddev, NFC_DIGITAL_CONFIG_FRAMING,
+                                     NFC_DIGITAL_FRAMING_ISO15693_INVENTORY);
+        if (rc)
+                return rc;
+
+        skb = digital_skb_alloc(ddev, sizeof(*req));
+        if (!skb)
+                return -ENOMEM;
+
+        skb_put(skb, sizeof(*req) - sizeof(req->mask)); /* No mask */
+        req = (struct digital_iso15693_inv_req *)skb->data;
+
+        /* Single sub-carrier, high data rate, no AFI, single slot
+         * Inventory command
+         */
+        req->flags = DIGITAL_ISO15693_REQ_FLAG_DATA_RATE |
+                     DIGITAL_ISO15693_REQ_FLAG_INVENTORY |
+                     DIGITAL_ISO15693_REQ_FLAG_NB_SLOTS;
+        req->cmd = DIGITAL_CMD_ISO15693_INVENTORY_REQ;
+        req->mask_len = 0;
+
+        rc = digital_in_send_cmd(ddev, skb, 30,
+                                 digital_in_recv_iso15693_inv_res, NULL);
+        if (rc)
+                kfree_skb(skb);
+
+        return rc;
+}
+
 static int digital_tg_send_sel_res(struct nfc_digital_dev *ddev)
 {
         struct sk_buff *skb;
diff --git a/net/nfc/hci/llc.c b/net/nfc/hci/llc.c
index a07d2b818487..1b90c0531852 100644
--- a/net/nfc/hci/llc.c
+++ b/net/nfc/hci/llc.c
@@ -20,14 +20,12 @@
 
 #include "llc.h"
 
-static struct list_head llc_engines;
+static LIST_HEAD(llc_engines);
 
 int nfc_llc_init(void)
 {
         int r;
 
-        INIT_LIST_HEAD(&llc_engines);
-
         r = nfc_llc_nop_register();
         if (r)
                 goto exit;
diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
index 6184bd1fba3a..b486f12ae243 100644
--- a/net/nfc/llcp_core.c
+++ b/net/nfc/llcp_core.c
@@ -27,7 +27,7 @@
 
 static u8 llcp_magic[3] = {0x46, 0x66, 0x6d};
 
-static struct list_head llcp_devices;
+static LIST_HEAD(llcp_devices);
 
 static void nfc_llcp_rx_skb(struct nfc_llcp_local *local, struct sk_buff *skb);
 
@@ -293,9 +293,9 @@ static void nfc_llcp_sdreq_timer(unsigned long data)
 
 struct nfc_llcp_local *nfc_llcp_find_local(struct nfc_dev *dev)
 {
-        struct nfc_llcp_local *local, *n;
+        struct nfc_llcp_local *local;
 
-        list_for_each_entry_safe(local, n, &llcp_devices, list)
+        list_for_each_entry(local, &llcp_devices, list)
                 if (local->dev == dev)
                         return local;
 
@@ -609,14 +609,16 @@ u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len)
 
 int nfc_llcp_set_remote_gb(struct nfc_dev *dev, u8 *gb, u8 gb_len)
 {
-        struct nfc_llcp_local *local = nfc_llcp_find_local(dev);
+        struct nfc_llcp_local *local;
+
+        if (gb_len < 3 || gb_len > NFC_MAX_GT_LEN)
+                return -EINVAL;
 
+        local = nfc_llcp_find_local(dev);
         if (local == NULL) {
                 pr_err("No LLCP device\n");
                 return -ENODEV;
         }
-        if (gb_len < 3)
-                return -EINVAL;
 
         memset(local->remote_gb, 0, NFC_MAX_GT_LEN);
         memcpy(local->remote_gb, gb, gb_len);
@@ -1622,8 +1624,6 @@ void nfc_llcp_unregister_device(struct nfc_dev *dev)
 
 int __init nfc_llcp_init(void)
 {
-        INIT_LIST_HEAD(&llcp_devices);
-
         return nfc_llcp_sock_init();
 }
 
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index 56db888b1cd5..6c34ac978501 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -74,7 +74,7 @@ static int __nci_request(struct nci_dev *ndev,
 
         ndev->req_status = NCI_REQ_PEND;
 
-        init_completion(&ndev->req_completion);
+        reinit_completion(&ndev->req_completion);
         req(ndev, opt);
         completion_rc =
                 wait_for_completion_interruptible_timeout(&ndev->req_completion,
@@ -709,6 +709,7 @@ struct nci_dev *nci_allocate_device(struct nci_ops *ops,
         ndev->ops = ops;
         ndev->tx_headroom = tx_headroom;
         ndev->tx_tailroom = tx_tailroom;
+        init_completion(&ndev->req_completion);
 
         ndev->nfc_dev = nfc_allocate_device(&nci_nfc_ops,
                                             supported_protocols,
diff --git a/net/nfc/nci/spi.c b/net/nfc/nci/spi.c
index f1d426f10cce..ec250e77763a 100644
--- a/net/nfc/nci/spi.c
+++ b/net/nfc/nci/spi.c
@@ -105,7 +105,7 @@ int nci_spi_send(struct nci_spi *nspi,
         if (ret != 0 || nspi->acknowledge_mode == NCI_SPI_CRC_DISABLED)
                 goto done;
 
-        init_completion(&nspi->req_completion);
+        reinit_completion(&nspi->req_completion);
         completion_rc = wait_for_completion_interruptible_timeout(
                                                         &nspi->req_completion,
                                                         NCI_SPI_SEND_TIMEOUT);
@@ -145,6 +145,7 @@ struct nci_spi *nci_spi_allocate_spi(struct spi_device *spi,
 
         nspi->spi = spi;
         nspi->ndev = ndev;
+        init_completion(&nspi->req_completion);
 
         return nspi;
 }
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index ebbf6fb88b35..43cb1c17e267 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -94,6 +94,14 @@ static int nfc_genl_send_target(struct sk_buff *msg, struct nfc_target *target,
                     target->sensf_res))
                 goto nla_put_failure;
 
+        if (target->is_iso15693) {
+                if (nla_put_u8(msg, NFC_ATTR_TARGET_ISO15693_DSFID,
+                               target->iso15693_dsfid) ||
+                    nla_put(msg, NFC_ATTR_TARGET_ISO15693_UID,
+                            sizeof(target->iso15693_uid), target->iso15693_uid))
+                        goto nla_put_failure;
+        }
+
         return genlmsg_end(msg, hdr);
 
 nla_put_failure:
diff --git a/net/wireless/ap.c b/net/wireless/ap.c
index 68602be07cc1..3e02ade508d8 100644
--- a/net/wireless/ap.c
+++ b/net/wireless/ap.c
@@ -7,7 +7,7 @@
 
 
 static int __cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
-                              struct net_device *dev)
+                              struct net_device *dev, bool notify)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         int err;
@@ -30,20 +30,21 @@ static int __cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
                 memset(&wdev->chandef, 0, sizeof(wdev->chandef));
                 wdev->ssid_len = 0;
                 rdev_set_qos_map(rdev, dev, NULL);
-                nl80211_send_ap_stopped(wdev);
+                if (notify)
+                        nl80211_send_ap_stopped(wdev);
         }
 
         return err;
 }
 
 int cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
-                     struct net_device *dev)
+                     struct net_device *dev, bool notify)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         int err;
 
         wdev_lock(wdev);
-        err = __cfg80211_stop_ap(rdev, dev);
+        err = __cfg80211_stop_ap(rdev, dev, notify);
         wdev_unlock(wdev);
 
         return err;
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index cd10c1985074..9c9501a35fb5 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -490,6 +490,62 @@ static bool cfg80211_chandef_dfs_available(struct wiphy *wiphy,
         return r;
 }
 
+static unsigned int cfg80211_get_chans_dfs_cac_time(struct wiphy *wiphy,
+                                                    u32 center_freq,
+                                                    u32 bandwidth)
+{
+        struct ieee80211_channel *c;
+        u32 start_freq, end_freq, freq;
+        unsigned int dfs_cac_ms = 0;
+
+        start_freq = cfg80211_get_start_freq(center_freq, bandwidth);
+        end_freq = cfg80211_get_end_freq(center_freq, bandwidth);
+
+        for (freq = start_freq; freq <= end_freq; freq += 20) {
+                c = ieee80211_get_channel(wiphy, freq);
+                if (!c)
+                        return 0;
+
+                if (c->flags & IEEE80211_CHAN_DISABLED)
+                        return 0;
+
+                if (!(c->flags & IEEE80211_CHAN_RADAR))
+                        continue;
+
+                if (c->dfs_cac_ms > dfs_cac_ms)
+                        dfs_cac_ms = c->dfs_cac_ms;
+        }
+
+        return dfs_cac_ms;
+}
+
+unsigned int
+cfg80211_chandef_dfs_cac_time(struct wiphy *wiphy,
+                              const struct cfg80211_chan_def *chandef)
+{
+        int width;
+        unsigned int t1 = 0, t2 = 0;
+
+        if (WARN_ON(!cfg80211_chandef_valid(chandef)))
+                return 0;
+
+        width = cfg80211_chandef_get_width(chandef);
+        if (width < 0)
+                return 0;
+
+        t1 = cfg80211_get_chans_dfs_cac_time(wiphy,
+                                             chandef->center_freq1,
+                                             width);
+
+        if (!chandef->center_freq2)
+                return t1;
+
+        t2 = cfg80211_get_chans_dfs_cac_time(wiphy,
+                                             chandef->center_freq2,
+                                             width);
+
+        return max(t1, t2);
+}
 
 static bool cfg80211_secondary_chans_ok(struct wiphy *wiphy,
                                         u32 center_freq, u32 bandwidth,
diff --git a/net/wireless/core.c b/net/wireless/core.c
index eb7f40821c09..086cddd03ba6 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -783,7 +783,7 @@ void cfg80211_leave(struct cfg80211_registered_device *rdev,
                 break;
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_P2P_GO:
-                cfg80211_stop_ap(rdev, dev);
+                cfg80211_stop_ap(rdev, dev, true);
                 break;
         default:
                 break;
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 40683004d523..5b1fdcadd469 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -166,7 +166,6 @@ static inline void wdev_unlock(struct wireless_dev *wdev)
         mutex_unlock(&wdev->mtx);
 }
 
-#define ASSERT_RDEV_LOCK(rdev) ASSERT_RTNL()
 #define ASSERT_WDEV_LOCK(wdev) lockdep_assert_held(&(wdev)->mtx)
 
 static inline bool cfg80211_has_monitors_only(struct cfg80211_registered_device *rdev)
@@ -246,10 +245,6 @@ void cfg80211_bss_age(struct cfg80211_registered_device *dev,
                       unsigned long age_secs);
 
 /* IBSS */
-int __cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
-                         struct net_device *dev,
-                         struct cfg80211_ibss_params *params,
-                         struct cfg80211_cached_keys *connkeys);
 int cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
                        struct net_device *dev,
                        struct cfg80211_ibss_params *params,
@@ -283,7 +278,7 @@ int cfg80211_set_mesh_channel(struct cfg80211_registered_device *rdev,
 
 /* AP */
 int cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
-                     struct net_device *dev);
+                     struct net_device *dev, bool notify);
 
 /* MLME */
 int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
@@ -402,6 +397,9 @@ void cfg80211_set_dfs_state(struct wiphy *wiphy,
 
 void cfg80211_dfs_channels_update_work(struct work_struct *work);
 
+unsigned int
+cfg80211_chandef_dfs_cac_time(struct wiphy *wiphy,
+                              const struct cfg80211_chan_def *chandef);
 
 static inline int
 cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
diff --git a/net/wireless/genregdb.awk b/net/wireless/genregdb.awk
index fdfd3f063a9b..b35da8dc85de 100644
--- a/net/wireless/genregdb.awk
+++ b/net/wireless/genregdb.awk
@@ -66,6 +66,7 @@ function parse_reg_rule()
         units = $8
         sub(/\)/, "", units)
         sub(/,/, "", units)
+        dfs_cac = $9
         if (units == "mW") {
                 if (power == 100) {
                         power = 20
@@ -78,7 +79,12 @@ function parse_reg_rule()
                 } else {
                         print "Unknown power value in database!"
                 }
+        } else {
+                dfs_cac = $8
         }
+        sub(/,/, "", dfs_cac)
+        sub(/\(/, "", dfs_cac)
+        sub(/\)/, "", dfs_cac)
         flagstr = ""
         for (i=8; i<=NF; i++)
                 flagstr = flagstr $i
@@ -111,7 +117,7 @@ function parse_reg_rule()
 
         }
         flags = flags "0"
-        printf "\t\tREG_RULE(%d, %d, %d, %d, %d, %s),\n", start, end, bw, gain, power, flags
+        printf "\t\tREG_RULE_EXT(%d, %d, %d, %d, %d, %d, %s),\n", start, end, bw, gain, power, dfs_cac, flags
         rules++
 }
 
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index 349db9ddc0d1..a6b5bdad039c 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -82,10 +82,10 @@ void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid,
 }
 EXPORT_SYMBOL(cfg80211_ibss_joined);
 
-int __cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
-                         struct net_device *dev,
-                         struct cfg80211_ibss_params *params,
-                         struct cfg80211_cached_keys *connkeys)
+static int __cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
+                                struct net_device *dev,
+                                struct cfg80211_ibss_params *params,
+                                struct cfg80211_cached_keys *connkeys)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct ieee80211_channel *check_chan;
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index d47c9d127b1e..c52ff59a3e96 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -778,7 +778,7 @@ void cfg80211_cac_event(struct net_device *netdev,
         switch (event) {
         case NL80211_RADAR_CAC_FINISHED:
                 timeout = wdev->cac_start_time +
-                          msecs_to_jiffies(IEEE80211_DFS_MIN_CAC_TIME_MS);
+                          msecs_to_jiffies(wdev->cac_time_ms);
                 WARN_ON(!time_after_eq(jiffies, timeout));
                 cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE);
                 break;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 2c38b28a85b9..052c1bf8ffac 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -593,6 +593,10 @@ static int nl80211_msg_put_channel(struct sk_buff *msg,
                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
                                         time))
                                 goto nla_put_failure;
+                        if (nla_put_u32(msg,
+                                        NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
+                                        chan->dfs_cac_ms))
+                                goto nla_put_failure;
                 }
         }
 
@@ -3328,7 +3332,7 @@ static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
         struct net_device *dev = info->user_ptr[1];
 
-        return cfg80211_stop_ap(rdev, dev);
+        return cfg80211_stop_ap(rdev, dev, false);
 }
 
 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
@@ -4614,6 +4618,7 @@ static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] =
         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
+        [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
 };
 
 static int parse_reg_rule(struct nlattr *tb[],
@@ -4649,6 +4654,10 @@ static int parse_reg_rule(struct nlattr *tb[],
                 power_rule->max_antenna_gain =
                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
 
+        if (tb[NL80211_ATTR_DFS_CAC_TIME])
+                reg_rule->dfs_cac_ms =
+                        nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
+
         return 0;
 }
 
@@ -5136,7 +5145,9 @@ static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
                                 power_rule->max_antenna_gain) ||
                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
-                                power_rule->max_eirp))
+                                power_rule->max_eirp) ||
+                    nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
+                                reg_rule->dfs_cac_ms))
                         goto nla_put_failure_rcu;
 
                 nla_nest_end(msg, nl_reg_rule);
@@ -5768,6 +5779,7 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_chan_def chandef;
         enum nl80211_dfs_regions dfs_region;
+        unsigned int cac_time_ms;
         int err;
 
         dfs_region = reg_get_dfs_region(wdev->wiphy);
@@ -5803,11 +5815,17 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,
         if (err)
                 return err;
 
-        err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef);
+        cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
+        if (WARN_ON(!cac_time_ms))
+                cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
+
+        err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef,
+                                               cac_time_ms);
         if (!err) {
                 wdev->chandef = chandef;
                 wdev->cac_started = true;
                 wdev->cac_start_time = jiffies;
+                wdev->cac_time_ms = cac_time_ms;
         }
         return err;
 }
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 90b82e08ae69..f59aaac586f8 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -91,10 +91,6 @@ static struct regulatory_request __rcu *last_request =
 /* To trigger userspace events */
 static struct platform_device *reg_pdev;
 
-static const struct device_type reg_device_type = {
-        .uevent = reg_device_uevent,
-};
-
 /*
  * Central wireless core regulatory domains, we only need two,
  * the current one and a world regulatory domain in case we have no
@@ -244,19 +240,21 @@ static char user_alpha2[2];
 module_param(ieee80211_regdom, charp, 0444);
 MODULE_PARM_DESC(ieee80211_regdom, "IEEE 802.11 regulatory domain code");
 
-static void reg_kfree_last_request(void)
+static void reg_free_request(struct regulatory_request *lr)
 {
-        struct regulatory_request *lr;
-
-        lr = get_last_request();
-
         if (lr != &core_request_world && lr)
                 kfree_rcu(lr, rcu_head);
 }
 
 static void reg_update_last_request(struct regulatory_request *request)
 {
-        reg_kfree_last_request();
+        struct regulatory_request *lr;
+
+        lr = get_last_request();
+        if (lr == request)
+                return;
+
+        reg_free_request(lr);
         rcu_assign_pointer(last_request, request);
 }
 
@@ -487,11 +485,16 @@ static inline void reg_regdb_query(const char *alpha2) {}
 
 /*
  * This lets us keep regulatory code which is updated on a regulatory
- * basis in userspace. Country information is filled in by
- * reg_device_uevent
+ * basis in userspace.
  */
 static int call_crda(const char *alpha2)
 {
+        char country[12];
+        char *env[] = { country, NULL };
+
+        snprintf(country, sizeof(country), "COUNTRY=%c%c",
+                 alpha2[0], alpha2[1]);
+
         if (!is_world_regdom((char *) alpha2))
                 pr_info("Calling CRDA for country: %c%c\n",
                         alpha2[0], alpha2[1]);
@@ -501,7 +504,7 @@ static int call_crda(const char *alpha2)
         /* query internal regulatory database (if it exists) */
         reg_regdb_query(alpha2);
 
-        return kobject_uevent(&reg_pdev->dev.kobj, KOBJ_CHANGE);
+        return kobject_uevent_env(&reg_pdev->dev.kobj, KOBJ_CHANGE, env);
 }
 
 static enum reg_request_treatment
@@ -755,6 +758,9 @@ static int reg_rules_intersect(const struct ieee80211_regdomain *rd1,
         power_rule->max_antenna_gain = min(power_rule1->max_antenna_gain,
                 power_rule2->max_antenna_gain);
 
+        intersected_rule->dfs_cac_ms = max(rule1->dfs_cac_ms,
+                                           rule2->dfs_cac_ms);
+
         if (!is_valid_reg_rule(intersected_rule))
                 return -EINVAL;
 
@@ -1077,6 +1083,14 @@ static void handle_channel(struct wiphy *wiphy,
                 min_t(int, chan->orig_mag,
                       MBI_TO_DBI(power_rule->max_antenna_gain));
         chan->max_reg_power = (int) MBM_TO_DBM(power_rule->max_eirp);
+
+        if (chan->flags & IEEE80211_CHAN_RADAR) {
+                if (reg_rule->dfs_cac_ms)
+                        chan->dfs_cac_ms = reg_rule->dfs_cac_ms;
+                else
+                        chan->dfs_cac_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
+        }
+
         if (chan->orig_mpwr) {
                 /*
                  * Devices that use REGULATORY_COUNTRY_IE_FOLLOW_POWER
@@ -2255,9 +2269,9 @@ static void print_rd_rules(const struct ieee80211_regdomain *rd)
         const struct ieee80211_reg_rule *reg_rule = NULL;
         const struct ieee80211_freq_range *freq_range = NULL;
         const struct ieee80211_power_rule *power_rule = NULL;
-        char bw[32];
+        char bw[32], cac_time[32];
 
-        pr_info("  (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)\n");
+        pr_info("  (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)\n");
 
         for (i = 0; i < rd->n_reg_rules; i++) {
                 reg_rule = &rd->reg_rules[i];
@@ -2272,23 +2286,32 @@ static void print_rd_rules(const struct ieee80211_regdomain *rd)
                         snprintf(bw, sizeof(bw), "%d KHz",
                                  freq_range->max_bandwidth_khz);
 
+                if (reg_rule->flags & NL80211_RRF_DFS)
+                        scnprintf(cac_time, sizeof(cac_time), "%u s",
+                                  reg_rule->dfs_cac_ms/1000);
+                else
+                        scnprintf(cac_time, sizeof(cac_time), "N/A");
+
+
                 /*
                  * There may not be documentation for max antenna gain
                  * in certain regions
                  */
                 if (power_rule->max_antenna_gain)
-                        pr_info("  (%d KHz - %d KHz @ %s), (%d mBi, %d mBm)\n",
+                        pr_info("  (%d KHz - %d KHz @ %s), (%d mBi, %d mBm), (%s)\n",
                                 freq_range->start_freq_khz,
                                 freq_range->end_freq_khz,
                                 bw,
                                 power_rule->max_antenna_gain,
-                                power_rule->max_eirp);
+                                power_rule->max_eirp,
+                                cac_time);
                 else
-                        pr_info("  (%d KHz - %d KHz @ %s), (N/A, %d mBm)\n",
+                        pr_info("  (%d KHz - %d KHz @ %s), (N/A, %d mBm), (%s)\n",
                                 freq_range->start_freq_khz,
                                 freq_range->end_freq_khz,
                                 bw,
-                                power_rule->max_eirp);
+                                power_rule->max_eirp,
+                                cac_time);
         }
 }
 
@@ -2361,9 +2384,6 @@ static int reg_set_rd_user(const struct ieee80211_regdomain *rd,
 {
         const struct ieee80211_regdomain *intersected_rd = NULL;
 
-        if (is_world_regdom(rd->alpha2))
-                return -EINVAL;
-
         if (!regdom_changes(rd->alpha2))
                 return -EALREADY;
 
@@ -2552,26 +2572,6 @@ int set_regdom(const struct ieee80211_regdomain *rd)
         return 0;
 }
 
-int reg_device_uevent(struct device *dev, struct kobj_uevent_env *env)
-{
-        struct regulatory_request *lr;
-        u8 alpha2[2];
-        bool add = false;
-
-        rcu_read_lock();
-        lr = get_last_request();
-        if (lr && !lr->processed) {
-                memcpy(alpha2, lr->alpha2, 2);
-                add = true;
-        }
-        rcu_read_unlock();
-
-        if (add)
-                return add_uevent_var(env, "COUNTRY=%c%c",
-                                      alpha2[0], alpha2[1]);
-        return 0;
-}
-
 void wiphy_regulatory_register(struct wiphy *wiphy)
 {
         struct regulatory_request *lr;
@@ -2622,8 +2622,6 @@ int __init regulatory_init(void)
         if (IS_ERR(reg_pdev))
                 return PTR_ERR(reg_pdev);
 
-        reg_pdev->dev.type = &reg_device_type;
-
         spin_lock_init(&reg_requests_lock);
         spin_lock_init(&reg_pending_beacons_lock);
 
diff --git a/net/wireless/reg.h b/net/wireless/reg.h
index 18524617ab62..37c180df34b7 100644
--- a/net/wireless/reg.h
+++ b/net/wireless/reg.h
@@ -26,7 +26,6 @@ enum nl80211_dfs_regions reg_get_dfs_region(struct wiphy *wiphy);
 int regulatory_hint_user(const char *alpha2,
                          enum nl80211_user_reg_hint_type user_reg_hint_type);
 
-int reg_device_uevent(struct device *dev, struct kobj_uevent_env *env);
 void wiphy_regulatory_register(struct wiphy *wiphy);
 void wiphy_regulatory_deregister(struct wiphy *wiphy);
 
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index d1ed4aebbbb7..7d09a712cb1f 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -659,9 +659,6 @@ static bool cfg80211_combine_bsses(struct cfg80211_registered_device *dev,
                         continue;
                 if (ssidlen && ie[1] != ssidlen)
                         continue;
-                /* that would be odd ... */
-                if (bss->pub.beacon_ies)
-                        continue;
                 if (WARN_ON_ONCE(bss->pub.hidden_beacon_bss))
                         continue;
                 if (WARN_ON_ONCE(!list_empty(&bss->hidden_list)))
@@ -680,7 +677,8 @@ static bool cfg80211_combine_bsses(struct cfg80211_registered_device *dev,
 /* Returned bss is reference counted and must be cleaned up appropriately. */
 static struct cfg80211_internal_bss *
 cfg80211_bss_update(struct cfg80211_registered_device *dev,
-                    struct cfg80211_internal_bss *tmp)
+                    struct cfg80211_internal_bss *tmp,
+                    bool signal_valid)
 {
         struct cfg80211_internal_bss *found = NULL;
 
@@ -765,7 +763,12 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                 }
 
                 found->pub.beacon_interval = tmp->pub.beacon_interval;
-                found->pub.signal = tmp->pub.signal;
+                /*
+                 * don't update the signal if beacon was heard on
+                 * adjacent channel.
+                 */
+                if (signal_valid)
+                        found->pub.signal = tmp->pub.signal;
                 found->pub.capability = tmp->pub.capability;
                 found->ts = tmp->ts;
         } else {
@@ -869,13 +872,14 @@ cfg80211_get_bss_channel(struct wiphy *wiphy, const u8 *ie, size_t ielen,
 /* Returned bss is reference counted and must be cleaned up appropriately. */
 struct cfg80211_bss*
 cfg80211_inform_bss_width(struct wiphy *wiphy,
-                          struct ieee80211_channel *channel,
+                          struct ieee80211_channel *rx_channel,
                           enum nl80211_bss_scan_width scan_width,
                           const u8 *bssid, u64 tsf, u16 capability,
                           u16 beacon_interval, const u8 *ie, size_t ielen,
                           s32 signal, gfp_t gfp)
 {
         struct cfg80211_bss_ies *ies;
+        struct ieee80211_channel *channel;
         struct cfg80211_internal_bss tmp = {}, *res;
 
         if (WARN_ON(!wiphy))
@@ -885,7 +889,7 @@ cfg80211_inform_bss_width(struct wiphy *wiphy,
                         (signal < 0 || signal > 100)))
                 return NULL;
 
-        channel = cfg80211_get_bss_channel(wiphy, ie, ielen, channel);
+        channel = cfg80211_get_bss_channel(wiphy, ie, ielen, rx_channel);
         if (!channel)
                 return NULL;
 
@@ -913,7 +917,8 @@ cfg80211_inform_bss_width(struct wiphy *wiphy,
         rcu_assign_pointer(tmp.pub.beacon_ies, ies);
         rcu_assign_pointer(tmp.pub.ies, ies);
 
-        res = cfg80211_bss_update(wiphy_to_dev(wiphy), &tmp);
+        res = cfg80211_bss_update(wiphy_to_dev(wiphy), &tmp,
+                                  rx_channel == channel);
         if (!res)
                 return NULL;
 
@@ -929,20 +934,21 @@ EXPORT_SYMBOL(cfg80211_inform_bss_width);
 /* Returned bss is reference counted and must be cleaned up appropriately. */
 struct cfg80211_bss *
 cfg80211_inform_bss_width_frame(struct wiphy *wiphy,
-                                struct ieee80211_channel *channel,
+                                struct ieee80211_channel *rx_channel,
                                 enum nl80211_bss_scan_width scan_width,
                                 struct ieee80211_mgmt *mgmt, size_t len,
                                 s32 signal, gfp_t gfp)
 {
         struct cfg80211_internal_bss tmp = {}, *res;
         struct cfg80211_bss_ies *ies;
+        struct ieee80211_channel *channel;
         size_t ielen = len - offsetof(struct ieee80211_mgmt,
                                       u.probe_resp.variable);
 
         BUILD_BUG_ON(offsetof(struct ieee80211_mgmt, u.probe_resp.variable) !=
                         offsetof(struct ieee80211_mgmt, u.beacon.variable));
 
-        trace_cfg80211_inform_bss_width_frame(wiphy, channel, scan_width, mgmt,
+        trace_cfg80211_inform_bss_width_frame(wiphy, rx_channel, scan_width, mgmt,
                                               len, signal);
 
         if (WARN_ON(!mgmt))
@@ -959,7 +965,7 @@ cfg80211_inform_bss_width_frame(struct wiphy *wiphy,
                 return NULL;
 
         channel = cfg80211_get_bss_channel(wiphy, mgmt->u.beacon.variable,
-                                           ielen, channel);
+                                           ielen, rx_channel);
         if (!channel)
                 return NULL;
 
@@ -983,7 +989,8 @@ cfg80211_inform_bss_width_frame(struct wiphy *wiphy,
         tmp.pub.beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
         tmp.pub.capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
 
-        res = cfg80211_bss_update(wiphy_to_dev(wiphy), &tmp);
+        res = cfg80211_bss_update(wiphy_to_dev(wiphy), &tmp,
+                                  rx_channel == channel);
         if (!res)
                 return NULL;
 
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index f04d4c32e96e..acdcb4a81817 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -64,7 +64,6 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev)
         int n_channels, err;
 
         ASSERT_RTNL();
-        ASSERT_RDEV_LOCK(rdev);
         ASSERT_WDEV_LOCK(wdev);
 
         if (rdev->scan_req || rdev->scan_msg)
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 2bb685f3e8fc..e5872ff2c27c 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -854,7 +854,6 @@ void cfg80211_process_rdev_events(struct cfg80211_registered_device *rdev)
         struct wireless_dev *wdev;
 
         ASSERT_RTNL();
-        ASSERT_RDEV_LOCK(rdev);
 
         list_for_each_entry(wdev, &rdev->wdev_list, list)
                 cfg80211_process_wdev_events(wdev);
@@ -867,7 +866,7 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
         int err;
         enum nl80211_iftype otype = dev->ieee80211_ptr->iftype;
 
-        ASSERT_RDEV_LOCK(rdev);
+        ASSERT_RTNL();
 
         /* don't support changing VLANs, you just re-create them */
         if (otype == NL80211_IFTYPE_AP_VLAN)
@@ -902,7 +901,7 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
 
                 switch (otype) {
                 case NL80211_IFTYPE_AP:
-                        cfg80211_stop_ap(rdev, dev);
+                        cfg80211_stop_ap(rdev, dev, true);
                         break;
                 case NL80211_IFTYPE_ADHOC:
                         cfg80211_leave_ibss(rdev, dev, false);
diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
index 14c9a2583ba0..86c331a65664 100644
--- a/net/wireless/wext-sme.c
+++ b/net/wireless/wext-sme.c
@@ -21,7 +21,7 @@ int cfg80211_mgd_wext_connect(struct cfg80211_registered_device *rdev,
         const u8 *prev_bssid = NULL;
         int err, i;
 
-        ASSERT_RDEV_LOCK(rdev);
+        ASSERT_RTNL();
         ASSERT_WDEV_LOCK(wdev);
 
         if (!netif_running(wdev->netdev))