Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

Pull networking changes from David Miller:
 "Noteworthy changes this time around:

   1) Multicast rejoin support for team driver, from Jiri Pirko.

   2) Centralize and simplify TCP RTT measurement handling in order to
      reduce the impact of bad RTO seeding from SYN/ACKs.  Also, when
      both timestamps and local RTT measurements are available prefer
      the later because there are broken middleware devices which
      scramble the timestamp.

      From Yuchung Cheng.

   3) Add TCP_NOTSENT_LOWAT socket option to limit the amount of kernel
      memory consumed to queue up unsend user data.  From Eric Dumazet.

   4) Add a "physical port ID" abstraction for network devices, from
      Jiri Pirko.

   5) Add a "suppress" operation to influence fib_rules lookups, from
      Stefan Tomanek.

   6) Add a networking development FAQ, from Paul Gortmaker.

   7) Extend the information provided by tcp_probe and add ipv6 support,
      from Daniel Borkmann.

   8) Use RCU locking more extensively in openvswitch data paths, from
      Pravin B Shelar.

   9) Add SCTP support to openvswitch, from Joe Stringer.

  10) Add EF10 chip support to SFC driver, from Ben Hutchings.

  11) Add new SYNPROXY netfilter target, from Patrick McHardy.

  12) Compute a rate approximation for sending in TCP sockets, and use
      this to more intelligently coalesce TSO frames.  Furthermore, add
      a new packet scheduler which takes advantage of this estimate when
      available.  From Eric Dumazet.

  13) Allow AF_PACKET fanouts with random selection, from Daniel
      Borkmann.

  14) Add ipv6 support to vxlan driver, from Cong Wang"

Resolved conflicts as per discussion.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1218 commits)
  openvswitch: Fix alignment of struct sw_flow_key.
  netfilter: Fix build errors with xt_socket.c
  tcp: Add missing braces to do_tcp_setsockopt
  caif: Add missing braces to multiline if in cfctrl_linkup_request
  bnx2x: Add missing braces in bnx2x:bnx2x_link_initialize
  vxlan: Fix kernel panic on device delete.
  net: mvneta: implement ->ndo_do_ioctl() to support PHY ioctls
  net: mvneta: properly disable HW PHY polling and ensure adjust_link() works
  icplus: Use netif_running to determine device state
  ethernet/arc/arc_emac: Fix huge delays in large file copies
  tuntap: orphan frags before trying to set tx timestamp
  tuntap: purge socket error queue on detach
  qlcnic: use standard NAPI weights
  ipv6:introduce function to find route for redirect
  bnx2x: VF RSS support - VF side
  bnx2x: VF RSS support - PF side
  vxlan: Notify drivers for listening UDP port changes
  net: usbnet: update addr_assign_type if appropriate
  driver/net: enic: update enic maintainers and driver
  driver/net: enic: Exposing symbols for Cisco's low latency driver
  ...

27 files changed, 2117 insertions, 1179 deletions

diff --git a/drivers/net/wireless/iwlwifi/mvm/Makefile b/drivers/net/wireless/iwlwifi/mvm/Makefile
index ff856e543ae8..6d73817850ce 100644
--- a/drivers/net/wireless/iwlwifi/mvm/Makefile
+++ b/drivers/net/wireless/iwlwifi/mvm/Makefile
@@ -2,7 +2,7 @@ obj-$(CONFIG_IWLMVM)   += iwlmvm.o
 iwlmvm-y += fw.o mac80211.o nvm.o ops.o phy-ctxt.o mac-ctxt.o
 iwlmvm-y += utils.o rx.o tx.o binding.o quota.o sta.o
 iwlmvm-y += scan.o time-event.o rs.o
-iwlmvm-y += power.o bt-coex.o
+iwlmvm-y += power.o power_legacy.o bt-coex.o
 iwlmvm-y += led.o tt.o
 iwlmvm-$(CONFIG_IWLWIFI_DEBUGFS) += debugfs.o
 iwlmvm-$(CONFIG_PM_SLEEP) += d3.o
diff --git a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
index dbd622a3929c..0fad98b85f60 100644
--- a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
@@ -220,66 +220,87 @@ static const __le32 iwl_single_shared_ant_lookup[BT_COEX_LUT_SIZE] = {
 
 int iwl_send_bt_init_conf(struct iwl_mvm *mvm)
 {
-        struct iwl_bt_coex_cmd cmd = {
-                .max_kill = 5,
-                .bt3_time_t7_value = 1,
-                .bt3_prio_sample_time = 2,
-                .bt3_timer_t2_value = 0xc,
+        struct iwl_bt_coex_cmd *bt_cmd;
+        struct iwl_host_cmd cmd = {
+                .id = BT_CONFIG,
+                .len = { sizeof(*bt_cmd), },
+                .dataflags = { IWL_HCMD_DFL_NOCOPY, },
+                .flags = CMD_SYNC,
         };
         int ret;
 
-        cmd.flags = iwlwifi_mod_params.bt_coex_active ?
+        /* go to CALIB state in internal BT-Coex state machine */
+        ret = iwl_send_bt_env(mvm, BT_COEX_ENV_OPEN,
+                              BT_COEX_PRIO_TBL_EVT_INIT_CALIB2);
+        if (ret)
+                return ret;
+
+        ret  = iwl_send_bt_env(mvm, BT_COEX_ENV_CLOSE,
+                               BT_COEX_PRIO_TBL_EVT_INIT_CALIB2);
+        if (ret)
+                return ret;
+
+        bt_cmd = kzalloc(sizeof(*bt_cmd), GFP_KERNEL);
+        if (!bt_cmd)
+                return -ENOMEM;
+        cmd.data[0] = bt_cmd;
+
+        bt_cmd->max_kill = 5;
+        bt_cmd->bt3_time_t7_value = 1;
+        bt_cmd->bt3_prio_sample_time = 2;
+        bt_cmd->bt3_timer_t2_value = 0xc;
+
+        bt_cmd->flags = iwlwifi_mod_params.bt_coex_active ?
                         BT_COEX_NW : BT_COEX_DISABLE;
-        cmd.flags |= BT_CH_PRIMARY_EN | BT_SYNC_2_BT_DISABLE;
+        bt_cmd->flags |= BT_CH_PRIMARY_EN | BT_SYNC_2_BT_DISABLE;
 
-        cmd.valid_bit_msk = cpu_to_le16(BT_VALID_ENABLE |
-                                        BT_VALID_BT_PRIO_BOOST |
-                                        BT_VALID_MAX_KILL |
-                                        BT_VALID_3W_TMRS |
-                                        BT_VALID_KILL_ACK |
-                                        BT_VALID_KILL_CTS |
-                                        BT_VALID_REDUCED_TX_POWER |
-                                        BT_VALID_LUT);
+        bt_cmd->valid_bit_msk = cpu_to_le16(BT_VALID_ENABLE |
+                                            BT_VALID_BT_PRIO_BOOST |
+                                            BT_VALID_MAX_KILL |
+                                            BT_VALID_3W_TMRS |
+                                            BT_VALID_KILL_ACK |
+                                            BT_VALID_KILL_CTS |
+                                            BT_VALID_REDUCED_TX_POWER |
+                                            BT_VALID_LUT);
 
         if (mvm->cfg->bt_shared_single_ant)
-                memcpy(&cmd.decision_lut, iwl_single_shared_ant_lookup,
+                memcpy(&bt_cmd->decision_lut, iwl_single_shared_ant_lookup,
                        sizeof(iwl_single_shared_ant_lookup));
         else if (is_loose_coex())
-                memcpy(&cmd.decision_lut, iwl_loose_lookup,
+                memcpy(&bt_cmd->decision_lut, iwl_loose_lookup,
                        sizeof(iwl_tight_lookup));
         else
-                memcpy(&cmd.decision_lut, iwl_tight_lookup,
+                memcpy(&bt_cmd->decision_lut, iwl_tight_lookup,
                        sizeof(iwl_tight_lookup));
 
-        cmd.bt_prio_boost = cpu_to_le32(IWL_BT_DEFAULT_BOOST);
-        cmd.kill_ack_msk =
+        bt_cmd->bt_prio_boost = cpu_to_le32(IWL_BT_DEFAULT_BOOST);
+        bt_cmd->kill_ack_msk =
                 cpu_to_le32(iwl_bt_ack_kill_msk[BT_KILL_MSK_DEFAULT]);
-        cmd.kill_cts_msk =
+        bt_cmd->kill_cts_msk =
                 cpu_to_le32(iwl_bt_cts_kill_msk[BT_KILL_MSK_DEFAULT]);
 
         memset(&mvm->last_bt_notif, 0, sizeof(mvm->last_bt_notif));
 
-        /* go to CALIB state in internal BT-Coex state machine */
-        ret = iwl_send_bt_env(mvm, BT_COEX_ENV_OPEN,
-                              BT_COEX_PRIO_TBL_EVT_INIT_CALIB2);
-        if (ret)
-                return ret;
-
-        ret  = iwl_send_bt_env(mvm, BT_COEX_ENV_CLOSE,
-                               BT_COEX_PRIO_TBL_EVT_INIT_CALIB2);
-        if (ret)
-                return ret;
+        ret = iwl_mvm_send_cmd(mvm, &cmd);
 
-        return iwl_mvm_send_cmd_pdu(mvm, BT_CONFIG, CMD_SYNC,
-                                    sizeof(cmd), &cmd);
+        kfree(bt_cmd);
+        return ret;
 }
 
 static int iwl_mvm_bt_udpate_ctrl_kill_msk(struct iwl_mvm *mvm,
                                            bool reduced_tx_power)
 {
         enum iwl_bt_kill_msk bt_kill_msk;
-        struct iwl_bt_coex_cmd cmd = {};
+        struct iwl_bt_coex_cmd *bt_cmd;
         struct iwl_bt_coex_profile_notif *notif = &mvm->last_bt_notif;
+        struct iwl_host_cmd cmd = {
+                .id = BT_CONFIG,
+                .data[0] = &bt_cmd,
+                .len = { sizeof(*bt_cmd), },
+                .dataflags = { IWL_HCMD_DFL_NOCOPY, },
+                .flags = CMD_SYNC,
+        };
+        int ret = 0;
 
         lockdep_assert_held(&mvm->mutex);
 
@@ -308,24 +329,40 @@ static int iwl_mvm_bt_udpate_ctrl_kill_msk(struct iwl_mvm *mvm,
                 return 0;
 
         mvm->bt_kill_msk = bt_kill_msk;
-        cmd.kill_ack_msk = cpu_to_le32(iwl_bt_ack_kill_msk[bt_kill_msk]);
-        cmd.kill_cts_msk = cpu_to_le32(iwl_bt_cts_kill_msk[bt_kill_msk]);
-        cmd.valid_bit_msk = cpu_to_le16(BT_VALID_KILL_ACK | BT_VALID_KILL_CTS);
+
+        bt_cmd = kzalloc(sizeof(*bt_cmd), GFP_KERNEL);
+        if (!bt_cmd)
+                return -ENOMEM;
+        cmd.data[0] = bt_cmd;
+
+        bt_cmd->kill_ack_msk = cpu_to_le32(iwl_bt_ack_kill_msk[bt_kill_msk]);
+        bt_cmd->kill_cts_msk = cpu_to_le32(iwl_bt_cts_kill_msk[bt_kill_msk]);
+        bt_cmd->valid_bit_msk =
+                cpu_to_le16(BT_VALID_KILL_ACK | BT_VALID_KILL_CTS);
 
         IWL_DEBUG_COEX(mvm, "bt_kill_msk = %d\n", bt_kill_msk);
-        return iwl_mvm_send_cmd_pdu(mvm, BT_CONFIG, CMD_SYNC,
-                                    sizeof(cmd), &cmd);
+
+        ret = iwl_mvm_send_cmd(mvm, &cmd);
+
+        kfree(bt_cmd);
+        return ret;
 }
 
 static int iwl_mvm_bt_coex_reduced_txp(struct iwl_mvm *mvm, u8 sta_id,
                                        bool enable)
 {
-        struct iwl_bt_coex_cmd cmd = {
-                .valid_bit_msk = cpu_to_le16(BT_VALID_REDUCED_TX_POWER),
-                .bt_reduced_tx_power = sta_id,
+        struct iwl_bt_coex_cmd *bt_cmd;
+        /* Send ASYNC since this can be sent from an atomic context */
+        struct iwl_host_cmd cmd = {
+                .id = BT_CONFIG,
+                .len = { sizeof(*bt_cmd), },
+                .dataflags = { IWL_HCMD_DFL_DUP, },
+                .flags = CMD_ASYNC,
         };
+
         struct ieee80211_sta *sta;
         struct iwl_mvm_sta *mvmsta;
+        int ret;
 
         /* This can happen if the station has been removed right now */
         if (sta_id == IWL_MVM_STATION_COUNT)
@@ -339,17 +376,26 @@ static int iwl_mvm_bt_coex_reduced_txp(struct iwl_mvm *mvm, u8 sta_id,
         if (mvmsta->bt_reduced_txpower == enable)
                 return 0;
 
+        bt_cmd = kzalloc(sizeof(*bt_cmd), GFP_ATOMIC);
+        if (!bt_cmd)
+                return -ENOMEM;
+        cmd.data[0] = bt_cmd;
+
+        bt_cmd->valid_bit_msk = cpu_to_le16(BT_VALID_REDUCED_TX_POWER),
+        bt_cmd->bt_reduced_tx_power = sta_id;
+
         if (enable)
-                cmd.bt_reduced_tx_power |= BT_REDUCED_TX_POWER_BIT;
+                bt_cmd->bt_reduced_tx_power |= BT_REDUCED_TX_POWER_BIT;
 
         IWL_DEBUG_COEX(mvm, "%sable reduced Tx Power for sta %d\n",
                        enable ? "en" : "dis", sta_id);
 
         mvmsta->bt_reduced_txpower = enable;
 
-        /* Send ASYNC since this can be sent from an atomic context */
-        return iwl_mvm_send_cmd_pdu(mvm, BT_CONFIG, CMD_ASYNC,
-                                    sizeof(cmd), &cmd);
+        ret = iwl_mvm_send_cmd(mvm, &cmd);
+
+        kfree(bt_cmd);
+        return ret;
 }
 
 struct iwl_bt_iterator_data {
@@ -384,6 +430,10 @@ static void iwl_mvm_bt_notif_iterator(void *_data, u8 *mac,
 
         smps_mode = IEEE80211_SMPS_AUTOMATIC;
 
+        /* non associated BSSes aren't to be considered */
+        if (!vif->bss_conf.assoc)
+                return;
+
         if (band != IEEE80211_BAND_2GHZ) {
                 iwl_mvm_update_smps(mvm, vif, IWL_MVM_SMPS_REQ_BT_COEX,
                                     smps_mode);
@@ -523,6 +573,8 @@ static void iwl_mvm_bt_rssi_iterator(void *_data, u8 *mac,
                                         lockdep_is_held(&mvm->mutex));
         mvmsta = (void *)sta->drv_priv;
 
+        data->num_bss_ifaces++;
+
         /*
          * This interface doesn't support reduced Tx power (because of low
          * RSSI probably), then set bt_kill_msk to default values.
@@ -588,23 +640,5 @@ void iwl_mvm_bt_rssi_event(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 
 void iwl_mvm_bt_coex_vif_assoc(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 {
-        struct ieee80211_chanctx_conf *chanctx_conf;
-        enum ieee80211_band band;
-
-        rcu_read_lock();
-        chanctx_conf = rcu_dereference(vif->chanctx_conf);
-        if (chanctx_conf && chanctx_conf->def.chan)
-                band = chanctx_conf->def.chan->band;
-        else
-                band = -1;
-        rcu_read_unlock();
-
-        /* if we are in 2GHz we will get a notification from the fw */
-        if (band == IEEE80211_BAND_2GHZ)
-                return;
-
-        /* else, we can remove all the constraints */
-        memset(&mvm->last_bt_notif, 0, sizeof(mvm->last_bt_notif));
-
         iwl_mvm_bt_coex_notif_handle(mvm);
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/constants.h b/drivers/net/wireless/iwlwifi/mvm/constants.h
new file mode 100644
index 000000000000..2bf29f7992ee
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/mvm/constants.h
@@ -0,0 +1,80 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2013 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called COPYING.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2013 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+#ifndef __MVM_CONSTANTS_H
+#define __MVM_CONSTANTS_H
+
+#define IWL_MVM_DEFAULT_PS_TX_DATA_TIMEOUT      (100 * USEC_PER_MSEC)
+#define IWL_MVM_DEFAULT_PS_RX_DATA_TIMEOUT      (100 * USEC_PER_MSEC)
+#define IWL_MVM_WOWLAN_PS_TX_DATA_TIMEOUT       (10 * USEC_PER_MSEC)
+#define IWL_MVM_WOWLAN_PS_RX_DATA_TIMEOUT       (10 * USEC_PER_MSEC)
+#define IWL_MVM_UAPSD_RX_DATA_TIMEOUT           (50 * USEC_PER_MSEC)
+#define IWL_MVM_UAPSD_TX_DATA_TIMEOUT           (50 * USEC_PER_MSEC)
+#define IWL_MVM_PS_HEAVY_TX_THLD_PACKETS        20
+#define IWL_MVM_PS_HEAVY_RX_THLD_PACKETS        20
+#define IWL_MVM_PS_HEAVY_TX_THLD_PERCENT        50
+#define IWL_MVM_PS_HEAVY_RX_THLD_PERCENT        50
+#define IWL_MVM_PS_SNOOZE_INTERVAL              25
+#define IWL_MVM_PS_SNOOZE_WINDOW                50
+#define IWL_MVM_WOWLAN_PS_SNOOZE_WINDOW         25
+
+#endif /* __MVM_CONSTANTS_H */
diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c
index 83da884cf303..417639f77b01 100644
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -105,7 +105,7 @@ void iwl_mvm_ipv6_addr_change(struct ieee80211_hw *hw,
         list_for_each_entry(ifa, &idev->addr_list, if_list) {
                 mvmvif->target_ipv6_addrs[idx] = ifa->addr;
                 idx++;
-                if (idx >= IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS)
+                if (idx >= IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS_MAX)
                         break;
         }
         read_unlock_bh(&idev->lock);
@@ -378,36 +378,68 @@ static int iwl_mvm_send_patterns(struct iwl_mvm *mvm,
 static int iwl_mvm_send_proto_offload(struct iwl_mvm *mvm,
                                       struct ieee80211_vif *vif)
 {
-        struct iwl_proto_offload_cmd cmd = {};
+        union {
+                struct iwl_proto_offload_cmd_v1 v1;
+                struct iwl_proto_offload_cmd_v2 v2;
+        } cmd = {};
+        struct iwl_proto_offload_cmd_common *common;
+        u32 enabled = 0, size;
 #if IS_ENABLED(CONFIG_IPV6)
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         int i;
 
-        if (mvmvif->num_target_ipv6_addrs) {
-                cmd.enabled |= cpu_to_le32(IWL_D3_PROTO_OFFLOAD_NS);
-                memcpy(cmd.ndp_mac_addr, vif->addr, ETH_ALEN);
-        }
+        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_D3_6_IPV6_ADDRS) {
+                if (mvmvif->num_target_ipv6_addrs) {
+                        enabled |= IWL_D3_PROTO_OFFLOAD_NS;
+                        memcpy(cmd.v2.ndp_mac_addr, vif->addr, ETH_ALEN);
+                }
+
+                BUILD_BUG_ON(sizeof(cmd.v2.target_ipv6_addr[0]) !=
+                             sizeof(mvmvif->target_ipv6_addrs[0]));
 
-        BUILD_BUG_ON(sizeof(cmd.target_ipv6_addr[i]) !=
-                     sizeof(mvmvif->target_ipv6_addrs[i]));
+                for (i = 0; i < min(mvmvif->num_target_ipv6_addrs,
+                                    IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS_V2); i++)
+                        memcpy(cmd.v2.target_ipv6_addr[i],
+                               &mvmvif->target_ipv6_addrs[i],
+                               sizeof(cmd.v2.target_ipv6_addr[i]));
+        } else {
+                if (mvmvif->num_target_ipv6_addrs) {
+                        enabled |= IWL_D3_PROTO_OFFLOAD_NS;
+                        memcpy(cmd.v1.ndp_mac_addr, vif->addr, ETH_ALEN);
+                }
 
-        for (i = 0; i < mvmvif->num_target_ipv6_addrs; i++)
-                memcpy(cmd.target_ipv6_addr[i],
-                       &mvmvif->target_ipv6_addrs[i],
-                       sizeof(cmd.target_ipv6_addr[i]));
+                BUILD_BUG_ON(sizeof(cmd.v1.target_ipv6_addr[0]) !=
+                             sizeof(mvmvif->target_ipv6_addrs[0]));
+
+                for (i = 0; i < min(mvmvif->num_target_ipv6_addrs,
+                                    IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS_V1); i++)
+                        memcpy(cmd.v1.target_ipv6_addr[i],
+                               &mvmvif->target_ipv6_addrs[i],
+                               sizeof(cmd.v1.target_ipv6_addr[i]));
+        }
 #endif
 
+        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_D3_6_IPV6_ADDRS) {
+                common = &cmd.v2.common;
+                size = sizeof(cmd.v2);
+        } else {
+                common = &cmd.v1.common;
+                size = sizeof(cmd.v1);
+        }
+
         if (vif->bss_conf.arp_addr_cnt) {
-                cmd.enabled |= cpu_to_le32(IWL_D3_PROTO_OFFLOAD_ARP);
-                cmd.host_ipv4_addr = vif->bss_conf.arp_addr_list[0];
-                memcpy(cmd.arp_mac_addr, vif->addr, ETH_ALEN);
+                enabled |= IWL_D3_PROTO_OFFLOAD_ARP;
+                common->host_ipv4_addr = vif->bss_conf.arp_addr_list[0];
+                memcpy(common->arp_mac_addr, vif->addr, ETH_ALEN);
         }
 
-        if (!cmd.enabled)
+        if (!enabled)
                 return 0;
 
+        common->enabled = cpu_to_le32(enabled);
+
         return iwl_mvm_send_cmd_pdu(mvm, PROT_OFFLOAD_CONFIG_CMD, CMD_SYNC,
-                                    sizeof(cmd), &cmd);
+                                    size, &cmd);
 }
 
 enum iwl_mvm_tcp_packet_type {
@@ -1077,73 +1109,16 @@ int iwl_mvm_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
         return __iwl_mvm_suspend(hw, wowlan, false);
 }
 
-static void iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
-                                         struct ieee80211_vif *vif)
+static void iwl_mvm_report_wakeup_reasons(struct iwl_mvm *mvm,
+                                          struct ieee80211_vif *vif,
+                                          struct iwl_wowlan_status *status)
 {
-        u32 base = mvm->error_event_table;
-        struct error_table_start {
-                /* cf. struct iwl_error_event_table */
-                u32 valid;
-                u32 error_id;
-        } err_info;
+        struct sk_buff *pkt = NULL;
         struct cfg80211_wowlan_wakeup wakeup = {
                 .pattern_idx = -1,
         };
         struct cfg80211_wowlan_wakeup *wakeup_report = &wakeup;
-        struct iwl_host_cmd cmd = {
-                .id = WOWLAN_GET_STATUSES,
-                .flags = CMD_SYNC | CMD_WANT_SKB,
-        };
-        struct iwl_wowlan_status *status;
-        u32 reasons;
-        int ret, len;
-        struct sk_buff *pkt = NULL;
-
-        iwl_trans_read_mem_bytes(mvm->trans, base,
-                                 &err_info, sizeof(err_info));
-
-        if (err_info.valid) {
-                IWL_INFO(mvm, "error table is valid (%d)\n",
-                         err_info.valid);
-                if (err_info.error_id == RF_KILL_INDICATOR_FOR_WOWLAN) {
-                        wakeup.rfkill_release = true;
-                        ieee80211_report_wowlan_wakeup(vif, &wakeup,
-                                                       GFP_KERNEL);
-                }
-                return;
-        }
-
-        /* only for tracing for now */
-        ret = iwl_mvm_send_cmd_pdu(mvm, OFFLOADS_QUERY_CMD, CMD_SYNC, 0, NULL);
-        if (ret)
-                IWL_ERR(mvm, "failed to query offload statistics (%d)\n", ret);
-
-        ret = iwl_mvm_send_cmd(mvm, &cmd);
-        if (ret) {
-                IWL_ERR(mvm, "failed to query status (%d)\n", ret);
-                return;
-        }
-
-        /* RF-kill already asserted again... */
-        if (!cmd.resp_pkt)
-                return;
-
-        len = le32_to_cpu(cmd.resp_pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
-        if (len - sizeof(struct iwl_cmd_header) < sizeof(*status)) {
-                IWL_ERR(mvm, "Invalid WoWLAN status response!\n");
-                goto out;
-        }
-
-        status = (void *)cmd.resp_pkt->data;
-
-        if (len - sizeof(struct iwl_cmd_header) !=
-            sizeof(*status) +
-            ALIGN(le32_to_cpu(status->wake_packet_bufsize), 4)) {
-                IWL_ERR(mvm, "Invalid WoWLAN status response!\n");
-                goto out;
-        }
-
-        reasons = le32_to_cpu(status->wakeup_reasons);
+        u32 reasons = le32_to_cpu(status->wakeup_reasons);
 
         if (reasons == IWL_WOWLAN_WAKEUP_BY_NON_WIRELESS) {
                 wakeup_report = NULL;
@@ -1206,6 +1181,12 @@ static void iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
                         pktsize -= hdrlen;
 
                         if (ieee80211_has_protected(hdr->frame_control)) {
+                                /*
+                                 * This is unlocked and using gtk_i(c)vlen,
+                                 * but since everything is under RTNL still
+                                 * that's not really a problem - changing
+                                 * it would be difficult.
+                                 */
                                 if (is_multicast_ether_addr(hdr->addr1)) {
                                         ivlen = mvm->gtk_ivlen;
                                         icvlen += mvm->gtk_icvlen;
@@ -1256,9 +1237,82 @@ static void iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
  report:
         ieee80211_report_wowlan_wakeup(vif, wakeup_report, GFP_KERNEL);
         kfree_skb(pkt);
+}
 
- out:
+/* releases the MVM mutex */
+static void iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
+                                         struct ieee80211_vif *vif)
+{
+        u32 base = mvm->error_event_table;
+        struct error_table_start {
+                /* cf. struct iwl_error_event_table */
+                u32 valid;
+                u32 error_id;
+        } err_info;
+        struct iwl_host_cmd cmd = {
+                .id = WOWLAN_GET_STATUSES,
+                .flags = CMD_SYNC | CMD_WANT_SKB,
+        };
+        struct iwl_wowlan_status *status;
+        int ret, len;
+
+        iwl_trans_read_mem_bytes(mvm->trans, base,
+                                 &err_info, sizeof(err_info));
+
+        if (err_info.valid) {
+                IWL_INFO(mvm, "error table is valid (%d)\n",
+                         err_info.valid);
+                if (err_info.error_id == RF_KILL_INDICATOR_FOR_WOWLAN) {
+                        struct cfg80211_wowlan_wakeup wakeup = {
+                                .rfkill_release = true,
+                        };
+                        ieee80211_report_wowlan_wakeup(vif, &wakeup,
+                                                       GFP_KERNEL);
+                }
+                goto out_unlock;
+        }
+
+        /* only for tracing for now */
+        ret = iwl_mvm_send_cmd_pdu(mvm, OFFLOADS_QUERY_CMD, CMD_SYNC, 0, NULL);
+        if (ret)
+                IWL_ERR(mvm, "failed to query offload statistics (%d)\n", ret);
+
+        ret = iwl_mvm_send_cmd(mvm, &cmd);
+        if (ret) {
+                IWL_ERR(mvm, "failed to query status (%d)\n", ret);
+                goto out_unlock;
+        }
+
+        /* RF-kill already asserted again... */
+        if (!cmd.resp_pkt)
+                goto out_unlock;
+
+        len = le32_to_cpu(cmd.resp_pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
+        if (len - sizeof(struct iwl_cmd_header) < sizeof(*status)) {
+                IWL_ERR(mvm, "Invalid WoWLAN status response!\n");
+                goto out_free_resp;
+        }
+
+        status = (void *)cmd.resp_pkt->data;
+
+        if (len - sizeof(struct iwl_cmd_header) !=
+            sizeof(*status) +
+            ALIGN(le32_to_cpu(status->wake_packet_bufsize), 4)) {
+                IWL_ERR(mvm, "Invalid WoWLAN status response!\n");
+                goto out_free_resp;
+        }
+
+        /* now we have all the data we need, unlock to avoid mac80211 issues */
+        mutex_unlock(&mvm->mutex);
+
+        iwl_mvm_report_wakeup_reasons(mvm, vif, status);
+        iwl_free_resp(&cmd);
+        return;
+
+ out_free_resp:
         iwl_free_resp(&cmd);
+ out_unlock:
+        mutex_unlock(&mvm->mutex);
 }
 
 static void iwl_mvm_read_d3_sram(struct iwl_mvm *mvm)
@@ -1315,10 +1369,13 @@ static int __iwl_mvm_resume(struct iwl_mvm *mvm, bool test)
         iwl_mvm_read_d3_sram(mvm);
 
         iwl_mvm_query_wakeup_reasons(mvm, vif);
+        /* has unlocked the mutex, so skip that */
+        goto out;
 
  out_unlock:
         mutex_unlock(&mvm->mutex);
 
+ out:
         if (!test && vif)
                 ieee80211_resume_disconnect(vif);
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
index c24a744910ac..aac81b8984b0 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
@@ -352,6 +352,10 @@ static void iwl_dbgfs_update_pm(struct iwl_mvm *mvm,
                 IWL_DEBUG_POWER(mvm, "lprx_rssi_threshold=%d\n", val);
                 dbgfs_pm->lprx_rssi_threshold = val;
                 break;
+        case MVM_DEBUGFS_PM_SNOOZE_ENABLE:
+                IWL_DEBUG_POWER(mvm, "snooze_enable=%d\n", val);
+                dbgfs_pm->snooze_ena = val;
+                break;
         }
 }
 
@@ -405,6 +409,10 @@ static ssize_t iwl_dbgfs_pm_params_write(struct file *file,
                     POWER_LPRX_RSSI_THRESHOLD_MIN)
                         return -EINVAL;
                 param = MVM_DEBUGFS_PM_LPRX_RSSI_THRESHOLD;
+        } else if (!strncmp("snooze_enable=", buf, 14)) {
+                if (sscanf(buf + 14, "%d", &val) != 1)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_PM_SNOOZE_ENABLE;
         } else {
                 return -EINVAL;
         }
@@ -424,40 +432,11 @@ static ssize_t iwl_dbgfs_pm_params_read(struct file *file,
         struct ieee80211_vif *vif = file->private_data;
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_mvm *mvm = mvmvif->dbgfs_data;
-        struct iwl_powertable_cmd cmd = {};
-        char buf[256];
+        char buf[512];
         int bufsz = sizeof(buf);
-        int pos = 0;
+        int pos;
 
-        iwl_mvm_power_build_cmd(mvm, vif, &cmd);
-
-        pos += scnprintf(buf+pos, bufsz-pos, "disable_power_off = %d\n",
-                         (cmd.flags &
-                         cpu_to_le16(POWER_FLAGS_POWER_SAVE_ENA_MSK)) ?
-                         0 : 1);
-        pos += scnprintf(buf+pos, bufsz-pos, "skip_dtim_periods = %d\n",
-                         le32_to_cpu(cmd.skip_dtim_periods));
-        pos += scnprintf(buf+pos, bufsz-pos, "power_scheme = %d\n",
-                         iwlmvm_mod_params.power_scheme);
-        pos += scnprintf(buf+pos, bufsz-pos, "flags = 0x%x\n",
-                         le16_to_cpu(cmd.flags));
-        pos += scnprintf(buf+pos, bufsz-pos, "keep_alive = %d\n",
-                         cmd.keep_alive_seconds);
-
-        if (cmd.flags & cpu_to_le16(POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK)) {
-                pos += scnprintf(buf+pos, bufsz-pos, "skip_over_dtim = %d\n",
-                                 (cmd.flags &
-                                 cpu_to_le16(POWER_FLAGS_SKIP_OVER_DTIM_MSK)) ?
-                                 1 : 0);
-                pos += scnprintf(buf+pos, bufsz-pos, "rx_data_timeout = %d\n",
-                                 le32_to_cpu(cmd.rx_data_timeout));
-                pos += scnprintf(buf+pos, bufsz-pos, "tx_data_timeout = %d\n",
-                                 le32_to_cpu(cmd.tx_data_timeout));
-                if (cmd.flags & cpu_to_le16(POWER_FLAGS_LPRX_ENA_MSK))
-                        pos += scnprintf(buf+pos, bufsz-pos,
-                                         "lprx_rssi_threshold = %d\n",
-                                         le32_to_cpu(cmd.lprx_rssi_threshold));
-        }
+        pos = iwl_mvm_power_dbgfs_read(mvm, vif, buf, bufsz);
 
         return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
@@ -621,25 +600,160 @@ static ssize_t iwl_dbgfs_bt_notif_read(struct file *file, char __user *user_buf,
 }
 #undef BT_MBOX_PRINT
 
+#define PRINT_STATS_LE32(_str, _val)                                    \
+                         pos += scnprintf(buf + pos, bufsz - pos,       \
+                                          fmt_table, _str,              \
+                                          le32_to_cpu(_val))
+
+static ssize_t iwl_dbgfs_fw_rx_stats_read(struct file *file,
+                                          char __user *user_buf, size_t count,
+                                          loff_t *ppos)
+{
+        struct iwl_mvm *mvm = file->private_data;
+        static const char *fmt_table = "\t%-30s %10u\n";
+        static const char *fmt_header = "%-32s\n";
+        int pos = 0;
+        char *buf;
+        int ret;
+        int bufsz = sizeof(struct mvm_statistics_rx_phy) * 20 +
+                    sizeof(struct mvm_statistics_rx_non_phy) * 10 +
+                    sizeof(struct mvm_statistics_rx_ht_phy) * 10 + 200;
+        struct mvm_statistics_rx_phy *ofdm;
+        struct mvm_statistics_rx_phy *cck;
+        struct mvm_statistics_rx_non_phy *general;
+        struct mvm_statistics_rx_ht_phy *ht;
+
+        buf = kzalloc(bufsz, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        mutex_lock(&mvm->mutex);
+
+        ofdm = &mvm->rx_stats.ofdm;
+        cck = &mvm->rx_stats.cck;
+        general = &mvm->rx_stats.general;
+        ht = &mvm->rx_stats.ofdm_ht;
+
+        pos += scnprintf(buf + pos, bufsz - pos, fmt_header,
+                         "Statistics_Rx - OFDM");
+        PRINT_STATS_LE32("ina_cnt", ofdm->ina_cnt);
+        PRINT_STATS_LE32("fina_cnt", ofdm->fina_cnt);
+        PRINT_STATS_LE32("plcp_err", ofdm->plcp_err);
+        PRINT_STATS_LE32("crc32_err", ofdm->crc32_err);
+        PRINT_STATS_LE32("overrun_err", ofdm->overrun_err);
+        PRINT_STATS_LE32("early_overrun_err", ofdm->early_overrun_err);
+        PRINT_STATS_LE32("crc32_good", ofdm->crc32_good);
+        PRINT_STATS_LE32("false_alarm_cnt", ofdm->false_alarm_cnt);
+        PRINT_STATS_LE32("fina_sync_err_cnt", ofdm->fina_sync_err_cnt);
+        PRINT_STATS_LE32("sfd_timeout", ofdm->sfd_timeout);
+        PRINT_STATS_LE32("fina_timeout", ofdm->fina_timeout);
+        PRINT_STATS_LE32("unresponded_rts", ofdm->unresponded_rts);
+        PRINT_STATS_LE32("rxe_frame_lmt_overrun",
+                         ofdm->rxe_frame_limit_overrun);
+        PRINT_STATS_LE32("sent_ack_cnt", ofdm->sent_ack_cnt);
+        PRINT_STATS_LE32("sent_cts_cnt", ofdm->sent_cts_cnt);
+        PRINT_STATS_LE32("sent_ba_rsp_cnt", ofdm->sent_ba_rsp_cnt);
+        PRINT_STATS_LE32("dsp_self_kill", ofdm->dsp_self_kill);
+        PRINT_STATS_LE32("mh_format_err", ofdm->mh_format_err);
+        PRINT_STATS_LE32("re_acq_main_rssi_sum", ofdm->re_acq_main_rssi_sum);
+        PRINT_STATS_LE32("reserved", ofdm->reserved);
+
+        pos += scnprintf(buf + pos, bufsz - pos, fmt_header,
+                         "Statistics_Rx - CCK");
+        PRINT_STATS_LE32("ina_cnt", cck->ina_cnt);
+        PRINT_STATS_LE32("fina_cnt", cck->fina_cnt);
+        PRINT_STATS_LE32("plcp_err", cck->plcp_err);
+        PRINT_STATS_LE32("crc32_err", cck->crc32_err);
+        PRINT_STATS_LE32("overrun_err", cck->overrun_err);
+        PRINT_STATS_LE32("early_overrun_err", cck->early_overrun_err);
+        PRINT_STATS_LE32("crc32_good", cck->crc32_good);
+        PRINT_STATS_LE32("false_alarm_cnt", cck->false_alarm_cnt);
+        PRINT_STATS_LE32("fina_sync_err_cnt", cck->fina_sync_err_cnt);
+        PRINT_STATS_LE32("sfd_timeout", cck->sfd_timeout);
+        PRINT_STATS_LE32("fina_timeout", cck->fina_timeout);
+        PRINT_STATS_LE32("unresponded_rts", cck->unresponded_rts);
+        PRINT_STATS_LE32("rxe_frame_lmt_overrun",
+                         cck->rxe_frame_limit_overrun);
+        PRINT_STATS_LE32("sent_ack_cnt", cck->sent_ack_cnt);
+        PRINT_STATS_LE32("sent_cts_cnt", cck->sent_cts_cnt);
+        PRINT_STATS_LE32("sent_ba_rsp_cnt", cck->sent_ba_rsp_cnt);
+        PRINT_STATS_LE32("dsp_self_kill", cck->dsp_self_kill);
+        PRINT_STATS_LE32("mh_format_err", cck->mh_format_err);
+        PRINT_STATS_LE32("re_acq_main_rssi_sum", cck->re_acq_main_rssi_sum);
+        PRINT_STATS_LE32("reserved", cck->reserved);
+
+        pos += scnprintf(buf + pos, bufsz - pos, fmt_header,
+                         "Statistics_Rx - GENERAL");
+        PRINT_STATS_LE32("bogus_cts", general->bogus_cts);
+        PRINT_STATS_LE32("bogus_ack", general->bogus_ack);
+        PRINT_STATS_LE32("non_bssid_frames", general->non_bssid_frames);
+        PRINT_STATS_LE32("filtered_frames", general->filtered_frames);
+        PRINT_STATS_LE32("non_channel_beacons", general->non_channel_beacons);
+        PRINT_STATS_LE32("channel_beacons", general->channel_beacons);
+        PRINT_STATS_LE32("num_missed_bcon", general->num_missed_bcon);
+        PRINT_STATS_LE32("adc_rx_saturation_time",
+                         general->adc_rx_saturation_time);
+        PRINT_STATS_LE32("ina_detection_search_time",
+                         general->ina_detection_search_time);
+        PRINT_STATS_LE32("beacon_silence_rssi_a",
+                         general->beacon_silence_rssi_a);
+        PRINT_STATS_LE32("beacon_silence_rssi_b",
+                         general->beacon_silence_rssi_b);
+        PRINT_STATS_LE32("beacon_silence_rssi_c",
+                         general->beacon_silence_rssi_c);
+        PRINT_STATS_LE32("interference_data_flag",
+                         general->interference_data_flag);
+        PRINT_STATS_LE32("channel_load", general->channel_load);
+        PRINT_STATS_LE32("dsp_false_alarms", general->dsp_false_alarms);
+        PRINT_STATS_LE32("beacon_rssi_a", general->beacon_rssi_a);
+        PRINT_STATS_LE32("beacon_rssi_b", general->beacon_rssi_b);
+        PRINT_STATS_LE32("beacon_rssi_c", general->beacon_rssi_c);
+        PRINT_STATS_LE32("beacon_energy_a", general->beacon_energy_a);
+        PRINT_STATS_LE32("beacon_energy_b", general->beacon_energy_b);
+        PRINT_STATS_LE32("beacon_energy_c", general->beacon_energy_c);
+        PRINT_STATS_LE32("num_bt_kills", general->num_bt_kills);
+        PRINT_STATS_LE32("directed_data_mpdu", general->directed_data_mpdu);
+
+        pos += scnprintf(buf + pos, bufsz - pos, fmt_header,
+                         "Statistics_Rx - HT");
+        PRINT_STATS_LE32("plcp_err", ht->plcp_err);
+        PRINT_STATS_LE32("overrun_err", ht->overrun_err);
+        PRINT_STATS_LE32("early_overrun_err", ht->early_overrun_err);
+        PRINT_STATS_LE32("crc32_good", ht->crc32_good);
+        PRINT_STATS_LE32("crc32_err", ht->crc32_err);
+        PRINT_STATS_LE32("mh_format_err", ht->mh_format_err);
+        PRINT_STATS_LE32("agg_crc32_good", ht->agg_crc32_good);
+        PRINT_STATS_LE32("agg_mpdu_cnt", ht->agg_mpdu_cnt);
+        PRINT_STATS_LE32("agg_cnt", ht->agg_cnt);
+        PRINT_STATS_LE32("unsupport_mcs", ht->unsupport_mcs);
+
+        mutex_unlock(&mvm->mutex);
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        kfree(buf);
+
+        return ret;
+}
+#undef PRINT_STAT_LE32
+
 static ssize_t iwl_dbgfs_fw_restart_write(struct file *file,
                                           const char __user *user_buf,
                                           size_t count, loff_t *ppos)
 {
         struct iwl_mvm *mvm = file->private_data;
-        bool restart_fw = iwlwifi_mod_params.restart_fw;
         int ret;
 
-        iwlwifi_mod_params.restart_fw = true;
-
         mutex_lock(&mvm->mutex);
 
+        /* allow one more restart that we're provoking here */
+        if (mvm->restart_fw >= 0)
+                mvm->restart_fw++;
+
         /* take the return value to make compiler happy - it will fail anyway */
         ret = iwl_mvm_send_cmd_pdu(mvm, REPLY_ERROR, CMD_SYNC, 0, NULL);
 
         mutex_unlock(&mvm->mutex);
 
-        iwlwifi_mod_params.restart_fw = restart_fw;
-
         return count;
 }
 
@@ -661,8 +775,14 @@ static void iwl_dbgfs_update_bf(struct ieee80211_vif *vif,
         case MVM_DEBUGFS_BF_ROAMING_STATE:
                 dbgfs_bf->bf_roaming_state = value;
                 break;
-        case MVM_DEBUGFS_BF_TEMPERATURE_DELTA:
-                dbgfs_bf->bf_temperature_delta = value;
+        case MVM_DEBUGFS_BF_TEMP_THRESHOLD:
+                dbgfs_bf->bf_temp_threshold = value;
+                break;
+        case MVM_DEBUGFS_BF_TEMP_FAST_FILTER:
+                dbgfs_bf->bf_temp_fast_filter = value;
+                break;
+        case MVM_DEBUGFS_BF_TEMP_SLOW_FILTER:
+                dbgfs_bf->bf_temp_slow_filter = value;
                 break;
         case MVM_DEBUGFS_BF_ENABLE_BEACON_FILTER:
                 dbgfs_bf->bf_enable_beacon_filter = value;
@@ -721,13 +841,27 @@ static ssize_t iwl_dbgfs_bf_params_write(struct file *file,
                     value > IWL_BF_ROAMING_STATE_MAX)
                         return -EINVAL;
                 param = MVM_DEBUGFS_BF_ROAMING_STATE;
-        } else if (!strncmp("bf_temperature_delta=", buf, 21)) {
-                if (sscanf(buf+21, "%d", &value) != 1)
+        } else if (!strncmp("bf_temp_threshold=", buf, 18)) {
+                if (sscanf(buf+18, "%d", &value) != 1)
+                        return -EINVAL;
+                if (value < IWL_BF_TEMP_THRESHOLD_MIN ||
+                    value > IWL_BF_TEMP_THRESHOLD_MAX)
                         return -EINVAL;
-                if (value < IWL_BF_TEMPERATURE_DELTA_MIN ||
-                    value > IWL_BF_TEMPERATURE_DELTA_MAX)
+                param = MVM_DEBUGFS_BF_TEMP_THRESHOLD;
+        } else if (!strncmp("bf_temp_fast_filter=", buf, 20)) {
+                if (sscanf(buf+20, "%d", &value) != 1)
                         return -EINVAL;
-                param = MVM_DEBUGFS_BF_TEMPERATURE_DELTA;
+                if (value < IWL_BF_TEMP_FAST_FILTER_MIN ||
+                    value > IWL_BF_TEMP_FAST_FILTER_MAX)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_BF_TEMP_FAST_FILTER;
+        } else if (!strncmp("bf_temp_slow_filter=", buf, 20)) {
+                if (sscanf(buf+20, "%d", &value) != 1)
+                        return -EINVAL;
+                if (value < IWL_BF_TEMP_SLOW_FILTER_MIN ||
+                    value > IWL_BF_TEMP_SLOW_FILTER_MAX)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_BF_TEMP_SLOW_FILTER;
         } else if (!strncmp("bf_enable_beacon_filter=", buf, 24)) {
                 if (sscanf(buf+24, "%d", &value) != 1)
                         return -EINVAL;
@@ -769,10 +903,7 @@ static ssize_t iwl_dbgfs_bf_params_write(struct file *file,
         if (param == MVM_DEBUGFS_BF_ENABLE_BEACON_FILTER && !value) {
                 ret = iwl_mvm_disable_beacon_filter(mvm, vif);
         } else {
-                if (mvmvif->bf_enabled)
-                        ret = iwl_mvm_enable_beacon_filter(mvm, vif);
-                else
-                        ret = iwl_mvm_disable_beacon_filter(mvm, vif);
+                ret = iwl_mvm_enable_beacon_filter(mvm, vif);
         }
         mutex_unlock(&mvm->mutex);
 
@@ -789,41 +920,41 @@ static ssize_t iwl_dbgfs_bf_params_read(struct file *file,
         int pos = 0;
         const size_t bufsz = sizeof(buf);
         struct iwl_beacon_filter_cmd cmd = {
-                .bf_energy_delta = IWL_BF_ENERGY_DELTA_DEFAULT,
-                .bf_roaming_energy_delta = IWL_BF_ROAMING_ENERGY_DELTA_DEFAULT,
-                .bf_roaming_state = IWL_BF_ROAMING_STATE_DEFAULT,
-                .bf_temperature_delta = IWL_BF_TEMPERATURE_DELTA_DEFAULT,
-                .bf_enable_beacon_filter = IWL_BF_ENABLE_BEACON_FILTER_DEFAULT,
-                .bf_debug_flag = IWL_BF_DEBUG_FLAG_DEFAULT,
-                .bf_escape_timer = cpu_to_le32(IWL_BF_ESCAPE_TIMER_DEFAULT),
-                .ba_escape_timer = cpu_to_le32(IWL_BA_ESCAPE_TIMER_DEFAULT),
-                .ba_enable_beacon_abort = IWL_BA_ENABLE_BEACON_ABORT_DEFAULT,
+                IWL_BF_CMD_CONFIG_DEFAULTS,
+                .bf_enable_beacon_filter =
+                        cpu_to_le32(IWL_BF_ENABLE_BEACON_FILTER_DEFAULT),
+                .ba_enable_beacon_abort =
+                        cpu_to_le32(IWL_BA_ENABLE_BEACON_ABORT_DEFAULT),
         };
 
         iwl_mvm_beacon_filter_debugfs_parameters(vif, &cmd);
-        if (mvmvif->bf_enabled)
-                cmd.bf_enable_beacon_filter = 1;
+        if (mvmvif->bf_data.bf_enabled)
+                cmd.bf_enable_beacon_filter = cpu_to_le32(1);
         else
                 cmd.bf_enable_beacon_filter = 0;
 
         pos += scnprintf(buf+pos, bufsz-pos, "bf_energy_delta = %d\n",
-                         cmd.bf_energy_delta);
+                         le32_to_cpu(cmd.bf_energy_delta));
         pos += scnprintf(buf+pos, bufsz-pos, "bf_roaming_energy_delta = %d\n",
-                         cmd.bf_roaming_energy_delta);
+                         le32_to_cpu(cmd.bf_roaming_energy_delta));
         pos += scnprintf(buf+pos, bufsz-pos, "bf_roaming_state = %d\n",
-                         cmd.bf_roaming_state);
-        pos += scnprintf(buf+pos, bufsz-pos, "bf_temperature_delta = %d\n",
-                         cmd.bf_temperature_delta);
+                         le32_to_cpu(cmd.bf_roaming_state));
+        pos += scnprintf(buf+pos, bufsz-pos, "bf_temp_threshold = %d\n",
+                         le32_to_cpu(cmd.bf_temp_threshold));
+        pos += scnprintf(buf+pos, bufsz-pos, "bf_temp_fast_filter = %d\n",
+                         le32_to_cpu(cmd.bf_temp_fast_filter));
+        pos += scnprintf(buf+pos, bufsz-pos, "bf_temp_slow_filter = %d\n",
+                         le32_to_cpu(cmd.bf_temp_slow_filter));
         pos += scnprintf(buf+pos, bufsz-pos, "bf_enable_beacon_filter = %d\n",
-                         cmd.bf_enable_beacon_filter);
+                         le32_to_cpu(cmd.bf_enable_beacon_filter));
         pos += scnprintf(buf+pos, bufsz-pos, "bf_debug_flag = %d\n",
-                         cmd.bf_debug_flag);
+                         le32_to_cpu(cmd.bf_debug_flag));
         pos += scnprintf(buf+pos, bufsz-pos, "bf_escape_timer = %d\n",
-                         cmd.bf_escape_timer);
+                         le32_to_cpu(cmd.bf_escape_timer));
         pos += scnprintf(buf+pos, bufsz-pos, "ba_escape_timer = %d\n",
-                         cmd.ba_escape_timer);
+                         le32_to_cpu(cmd.ba_escape_timer));
         pos += scnprintf(buf+pos, bufsz-pos, "ba_enable_beacon_abort = %d\n",
-                         cmd.ba_enable_beacon_abort);
+                         le32_to_cpu(cmd.ba_enable_beacon_abort));
 
         return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
@@ -934,6 +1065,7 @@ MVM_DEBUGFS_READ_FILE_OPS(stations);
 MVM_DEBUGFS_READ_FILE_OPS(bt_notif);
 MVM_DEBUGFS_WRITE_FILE_OPS(power_down_allow);
 MVM_DEBUGFS_WRITE_FILE_OPS(power_down_d3_allow);
+MVM_DEBUGFS_READ_FILE_OPS(fw_rx_stats);
 MVM_DEBUGFS_WRITE_FILE_OPS(fw_restart);
 #ifdef CONFIG_PM_SLEEP
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(d3_sram);
@@ -957,6 +1089,7 @@ int iwl_mvm_dbgfs_register(struct iwl_mvm *mvm, struct dentry *dbgfs_dir)
         MVM_DEBUGFS_ADD_FILE(bt_notif, dbgfs_dir, S_IRUSR);
         MVM_DEBUGFS_ADD_FILE(power_down_allow, mvm->debugfs_dir, S_IWUSR);
         MVM_DEBUGFS_ADD_FILE(power_down_d3_allow, mvm->debugfs_dir, S_IWUSR);
+        MVM_DEBUGFS_ADD_FILE(fw_rx_stats, mvm->debugfs_dir, S_IRUSR);
         MVM_DEBUGFS_ADD_FILE(fw_restart, mvm->debugfs_dir, S_IWUSR);
 #ifdef CONFIG_PM_SLEEP
         MVM_DEBUGFS_ADD_FILE(d3_sram, mvm->debugfs_dir, S_IRUSR | S_IWUSR);
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h
index 6f8b2c16ae17..df72fcdf8170 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h
@@ -98,34 +98,63 @@ enum iwl_proto_offloads {
         IWL_D3_PROTO_OFFLOAD_NS = BIT(1),
 };
 
-#define IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS        2
+#define IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS_V1     2
+#define IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS_V2     6
+#define IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS_MAX    6
 
 /**
- * struct iwl_proto_offload_cmd - ARP/NS offload configuration
+ * struct iwl_proto_offload_cmd_common - ARP/NS offload common part
  * @enabled: enable flags
  * @remote_ipv4_addr: remote address to answer to (or zero if all)
  * @host_ipv4_addr: our IPv4 address to respond to queries for
  * @arp_mac_addr: our MAC address for ARP responses
- * @remote_ipv6_addr: remote address to answer to (or zero if all)
- * @solicited_node_ipv6_addr: broken -- solicited node address exists
- *      for each target address
- * @target_ipv6_addr: our target addresses
- * @ndp_mac_addr: neighbor soliciation response MAC address
+ * @reserved: unused
  */
-struct iwl_proto_offload_cmd {
+struct iwl_proto_offload_cmd_common {
         __le32 enabled;
         __be32 remote_ipv4_addr;
         __be32 host_ipv4_addr;
         u8 arp_mac_addr[ETH_ALEN];
-        __le16 reserved1;
+        __le16 reserved;
+} __packed;
 
+/**
+ * struct iwl_proto_offload_cmd_v1 - ARP/NS offload configuration
+ * @common: common/IPv4 configuration
+ * @remote_ipv6_addr: remote address to answer to (or zero if all)
+ * @solicited_node_ipv6_addr: broken -- solicited node address exists
+ *      for each target address
+ * @target_ipv6_addr: our target addresses
+ * @ndp_mac_addr: neighbor soliciation response MAC address
+ */
+struct iwl_proto_offload_cmd_v1 {
+        struct iwl_proto_offload_cmd_common common;
         u8 remote_ipv6_addr[16];
         u8 solicited_node_ipv6_addr[16];
-        u8 target_ipv6_addr[IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS][16];
+        u8 target_ipv6_addr[IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS_V1][16];
         u8 ndp_mac_addr[ETH_ALEN];
         __le16 reserved2;
 } __packed; /* PROT_OFFLOAD_CONFIG_CMD_DB_S_VER_1 */
 
+/**
+ * struct iwl_proto_offload_cmd_v2 - ARP/NS offload configuration
+ * @common: common/IPv4 configuration
+ * @remote_ipv6_addr: remote address to answer to (or zero if all)
+ * @solicited_node_ipv6_addr: broken -- solicited node address exists
+ *      for each target address
+ * @target_ipv6_addr: our target addresses
+ * @ndp_mac_addr: neighbor soliciation response MAC address
+ */
+struct iwl_proto_offload_cmd_v2 {
+        struct iwl_proto_offload_cmd_common common;
+        u8 remote_ipv6_addr[16];
+        u8 solicited_node_ipv6_addr[16];
+        u8 target_ipv6_addr[IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS_V2][16];
+        u8 ndp_mac_addr[ETH_ALEN];
+        u8 numValidIPv6Addresses;
+        u8 reserved2[3];
+} __packed; /* PROT_OFFLOAD_CONFIG_CMD_DB_S_VER_2 */
+
 
 /*
  * WOWLAN_PATTERNS
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
index a6da359a80c3..8e7ab41079ca 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
@@ -79,6 +79,10 @@
  *              '1' Driver enables PM (use rest of parameters)
  * @POWER_FLAGS_SKIP_OVER_DTIM_MSK: '0' PM have to walk up every DTIM,
  *              '1' PM could sleep over DTIM till listen Interval.
+ * @POWER_FLAGS_SNOOZE_ENA_MSK: Enable snoozing only if uAPSD is enabled and all
+ *              access categories are both delivery and trigger enabled.
+ * @POWER_FLAGS_BT_SCO_ENA: Enable BT SCO coex only if uAPSD and
+ *              PBW Snoozing enabled
  * @POWER_FLAGS_ADVANCE_PM_ENA_MSK: Advanced PM (uAPSD) enable mask
  * @POWER_FLAGS_LPRX_ENA_MSK: Low Power RX enable.
 */
@@ -86,6 +90,8 @@ enum iwl_power_flags {
         POWER_FLAGS_POWER_SAVE_ENA_MSK          = BIT(0),
         POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK    = BIT(1),
         POWER_FLAGS_SKIP_OVER_DTIM_MSK          = BIT(2),
+        POWER_FLAGS_SNOOZE_ENA_MSK              = BIT(5),
+        POWER_FLAGS_BT_SCO_ENA                  = BIT(8),
         POWER_FLAGS_ADVANCE_PM_ENA_MSK          = BIT(9),
         POWER_FLAGS_LPRX_ENA_MSK                = BIT(11),
 };
@@ -93,7 +99,8 @@ enum iwl_power_flags {
 #define IWL_POWER_VEC_SIZE 5
 
 /**
- * struct iwl_powertable_cmd - Power Table Command
+ * struct iwl_powertable_cmd - legacy power command. Beside old API support this
+ *      is used also with a new power API for device wide power settings.
  * POWER_TABLE_CMD = 0x77 (command, has simple generic response)
  *
  * @flags:              Power table command flags from POWER_FLAGS_*
@@ -125,6 +132,76 @@ struct iwl_powertable_cmd {
 } __packed;
 
 /**
+ * struct iwl_mac_power_cmd - New power command containing uAPSD support
+ * MAC_PM_POWER_TABLE = 0xA9 (command, has simple generic response)
+ * @id_and_color:       MAC contex identifier
+ * @flags:              Power table command flags from POWER_FLAGS_*
+ * @keep_alive_seconds: Keep alive period in seconds. Default - 25 sec.
+ *                      Minimum allowed:- 3 * DTIM. Keep alive period must be
+ *                      set regardless of power scheme or current power state.
+ *                      FW use this value also when PM is disabled.
+ * @rx_data_timeout:    Minimum time (usec) from last Rx packet for AM to
+ *                      PSM transition - legacy PM
+ * @tx_data_timeout:    Minimum time (usec) from last Tx packet for AM to
+ *                      PSM transition - legacy PM
+ * @sleep_interval:     not in use
+ * @skip_dtim_periods:  Number of DTIM periods to skip if Skip over DTIM flag
+ *                      is set. For example, if it is required to skip over
+ *                      one DTIM, this value need to be set to 2 (DTIM periods).
+ * @rx_data_timeout_uapsd: Minimum time (usec) from last Rx packet for AM to
+ *                      PSM transition - uAPSD
+ * @tx_data_timeout_uapsd: Minimum time (usec) from last Tx packet for AM to
+ *                      PSM transition - uAPSD
+ * @lprx_rssi_threshold: Signal strength up to which LP RX can be enabled.
+ *                      Default: 80dbm
+ * @num_skip_dtim:      Number of DTIMs to skip if Skip over DTIM flag is set
+ * @snooze_interval:    Maximum time between attempts to retrieve buffered data
+ *                      from the AP [msec]
+ * @snooze_window:      A window of time in which PBW snoozing insures that all
+ *                      packets received. It is also the minimum time from last
+ *                      received unicast RX packet, before client stops snoozing
+ *                      for data. [msec]
+ * @snooze_step:        TBD
+ * @qndp_tid:           TID client shall use for uAPSD QNDP triggers
+ * @uapsd_ac_flags:     Set trigger-enabled and delivery-enabled indication for
+ *                      each corresponding AC.
+ *                      Use IEEE80211_WMM_IE_STA_QOSINFO_AC* for correct values.
+ * @uapsd_max_sp:       Use IEEE80211_WMM_IE_STA_QOSINFO_SP_* for correct
+ *                      values.
+ * @heavy_tx_thld_packets:      TX threshold measured in number of packets
+ * @heavy_rx_thld_packets:      RX threshold measured in number of packets
+ * @heavy_tx_thld_percentage:   TX threshold measured in load's percentage
+ * @heavy_rx_thld_percentage:   RX threshold measured in load's percentage
+ * @limited_ps_threshold:
+*/
+struct iwl_mac_power_cmd {
+        /* CONTEXT_DESC_API_T_VER_1 */
+        __le32 id_and_color;
+
+        /* CLIENT_PM_POWER_TABLE_S_VER_1 */
+        __le16 flags;
+        __le16 keep_alive_seconds;
+        __le32 rx_data_timeout;
+        __le32 tx_data_timeout;
+        __le32 rx_data_timeout_uapsd;
+        __le32 tx_data_timeout_uapsd;
+        u8 lprx_rssi_threshold;
+        u8 skip_dtim_periods;
+        __le16 snooze_interval;
+        __le16 snooze_window;
+        u8 snooze_step;
+        u8 qndp_tid;
+        u8 uapsd_ac_flags;
+        u8 uapsd_max_sp;
+        u8 heavy_tx_thld_packets;
+        u8 heavy_rx_thld_packets;
+        u8 heavy_tx_thld_percentage;
+        u8 heavy_rx_thld_percentage;
+        u8 limited_ps_threshold;
+        u8 reserved;
+} __packed;
+
+/**
  * struct iwl_beacon_filter_cmd
  * REPLY_BEACON_FILTERING_CMD = 0xd2 (command)
  * @id_and_color: MAC contex identifier
@@ -143,11 +220,21 @@ struct iwl_powertable_cmd {
  *      calculated for current beacon is less than the threshold, use
  *      Roaming Energy Delta Threshold, otherwise use normal Energy Delta
  *      Threshold. Typical energy threshold is -72dBm.
- * @bf_temperature_delta: Send Beacon to driver if delta in temperature values
- *      calculated for this and the last passed beacon is greater than  this
- *      threshold. Zero value means that the temperature changeis ignored for
+ * @bf_temp_threshold: This threshold determines the type of temperature
+ *      filtering (Slow or Fast) that is selected (Units are in Celsuis):
+ *      If the current temperature is above this threshold - Fast filter
+ *      will be used, If the current temperature is below this threshold -
+ *      Slow filter will be used.
+ * @bf_temp_fast_filter: Send Beacon to driver if delta in temperature values
+ *      calculated for this and the last passed beacon is greater than this
+ *      threshold. Zero value means that the temperature change is ignored for
  *      beacon filtering; beacons will not be  forced to be sent to driver
  *      regardless of whether its temerature has been changed.
+ * @bf_temp_slow_filter: Send Beacon to driver if delta in temperature values
+ *      calculated for this and the last passed beacon is greater than this
+ *      threshold. Zero value means that the temperature change is ignored for
+ *      beacon filtering; beacons will not be forced to be sent to driver
+ *      regardless of whether its temerature has been changed.
  * @bf_enable_beacon_filter: 1, beacon filtering is enabled; 0, disabled.
  * @bf_filter_escape_timer: Send beacons to to driver if no beacons were passed
  *      for a specific period of time. Units: Beacons.
@@ -156,17 +243,17 @@ struct iwl_powertable_cmd {
  * @ba_enable_beacon_abort: 1, beacon abort is enabled; 0, disabled.
  */
 struct iwl_beacon_filter_cmd {
-        u8 bf_energy_delta;
-        u8 bf_roaming_energy_delta;
-        u8 bf_roaming_state;
-        u8 bf_temperature_delta;
-        u8 bf_enable_beacon_filter;
-        u8 bf_debug_flag;
-        __le16 reserved1;
+        __le32 bf_energy_delta;
+        __le32 bf_roaming_energy_delta;
+        __le32 bf_roaming_state;
+        __le32 bf_temp_threshold;
+        __le32 bf_temp_fast_filter;
+        __le32 bf_temp_slow_filter;
+        __le32 bf_enable_beacon_filter;
+        __le32 bf_debug_flag;
         __le32 bf_escape_timer;
         __le32 ba_escape_timer;
-        u8 ba_enable_beacon_abort;
-        u8 reserved2[3];
+        __le32 ba_enable_beacon_abort;
 } __packed;
 
 /* Beacon filtering and beacon abort */
@@ -182,9 +269,17 @@ struct iwl_beacon_filter_cmd {
 #define IWL_BF_ROAMING_STATE_MAX 255
 #define IWL_BF_ROAMING_STATE_MIN 0
 
-#define IWL_BF_TEMPERATURE_DELTA_DEFAULT 5
-#define IWL_BF_TEMPERATURE_DELTA_MAX 255
-#define IWL_BF_TEMPERATURE_DELTA_MIN 0
+#define IWL_BF_TEMP_THRESHOLD_DEFAULT 112
+#define IWL_BF_TEMP_THRESHOLD_MAX 255
+#define IWL_BF_TEMP_THRESHOLD_MIN 0
+
+#define IWL_BF_TEMP_FAST_FILTER_DEFAULT 1
+#define IWL_BF_TEMP_FAST_FILTER_MAX 255
+#define IWL_BF_TEMP_FAST_FILTER_MIN 0
+
+#define IWL_BF_TEMP_SLOW_FILTER_DEFAULT 5
+#define IWL_BF_TEMP_SLOW_FILTER_MAX 255
+#define IWL_BF_TEMP_SLOW_FILTER_MIN 0
 
 #define IWL_BF_ENABLE_BEACON_FILTER_DEFAULT 1
 
@@ -194,19 +289,23 @@ struct iwl_beacon_filter_cmd {
 #define IWL_BF_ESCAPE_TIMER_MAX 1024
 #define IWL_BF_ESCAPE_TIMER_MIN 0
 
-#define IWL_BA_ESCAPE_TIMER_DEFAULT 3
+#define IWL_BA_ESCAPE_TIMER_DEFAULT 6
+#define IWL_BA_ESCAPE_TIMER_D3 6
 #define IWL_BA_ESCAPE_TIMER_MAX 1024
 #define IWL_BA_ESCAPE_TIMER_MIN 0
 
 #define IWL_BA_ENABLE_BEACON_ABORT_DEFAULT 1
 
-#define IWL_BF_CMD_CONFIG_DEFAULTS                                      \
-        .bf_energy_delta = IWL_BF_ENERGY_DELTA_DEFAULT,                 \
-        .bf_roaming_energy_delta = IWL_BF_ROAMING_ENERGY_DELTA_DEFAULT, \
-        .bf_roaming_state = IWL_BF_ROAMING_STATE_DEFAULT,               \
-        .bf_temperature_delta = IWL_BF_TEMPERATURE_DELTA_DEFAULT,       \
-        .bf_debug_flag = IWL_BF_DEBUG_FLAG_DEFAULT,                     \
-        .bf_escape_timer = cpu_to_le32(IWL_BF_ESCAPE_TIMER_DEFAULT),    \
+#define IWL_BF_CMD_CONFIG_DEFAULTS                                           \
+        .bf_energy_delta = cpu_to_le32(IWL_BF_ENERGY_DELTA_DEFAULT),         \
+        .bf_roaming_energy_delta =                                           \
+                cpu_to_le32(IWL_BF_ROAMING_ENERGY_DELTA_DEFAULT),            \
+        .bf_roaming_state = cpu_to_le32(IWL_BF_ROAMING_STATE_DEFAULT),       \
+        .bf_temp_threshold = cpu_to_le32(IWL_BF_TEMP_THRESHOLD_DEFAULT),     \
+        .bf_temp_fast_filter = cpu_to_le32(IWL_BF_TEMP_FAST_FILTER_DEFAULT), \
+        .bf_temp_slow_filter = cpu_to_le32(IWL_BF_TEMP_SLOW_FILTER_DEFAULT), \
+        .bf_debug_flag = cpu_to_le32(IWL_BF_DEBUG_FLAG_DEFAULT),             \
+        .bf_escape_timer = cpu_to_le32(IWL_BF_ESCAPE_TIMER_DEFAULT),         \
         .ba_escape_timer = cpu_to_le32(IWL_BA_ESCAPE_TIMER_DEFAULT)
 
 #endif
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
index 365095a0c3b3..83cb9b992ea4 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
@@ -137,6 +137,8 @@ struct iwl_ssid_ie {
  *@SCAN_FLAGS_DELAYED_SCAN_LOWBAND:
  *@SCAN_FLAGS_DELAYED_SCAN_HIGHBAND:
  *@SCAN_FLAGS_FRAGMENTED_SCAN:
+ *@SCAN_FLAGS_PASSIVE2ACTIVE: use active scan on channels that was active
+ *      in the past hour, even if they are marked as passive.
  */
 enum iwl_scan_flags {
         SCAN_FLAGS_PERIODIC_SCAN                = BIT(0),
@@ -144,6 +146,7 @@ enum iwl_scan_flags {
         SCAN_FLAGS_DELAYED_SCAN_LOWBAND         = BIT(2),
         SCAN_FLAGS_DELAYED_SCAN_HIGHBAND        = BIT(3),
         SCAN_FLAGS_FRAGMENTED_SCAN              = BIT(4),
+        SCAN_FLAGS_PASSIVE2ACTIVE               = BIT(5),
 };
 
 /**
@@ -178,7 +181,7 @@ enum iwl_scan_type {
  * @quiet_time: in msecs, dwell this time for active scan on quiet channels
  * @quiet_plcp_th: quiet PLCP threshold (channel is quiet if less than
  *      this number of packets were received (typically 1)
- * @passive2active: is auto switching from passive to active allowed (0 or 1)
+ * @passive2active: is auto switching from passive to active during scan allowed
  * @rxchain_sel_flags: RXON_RX_CHAIN_*
  * @max_out_time: in usecs, max out of serving channel time
  * @suspend_time: how long to pause scan when returning to service channel:
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
index 700cce731770..d606197bde8f 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
@@ -91,7 +91,6 @@
  * @TX_CMD_FLG_RESP_TO_DRV: zero this if the response should go only to FW
  * @TX_CMD_FLG_CCMP_AGG: this frame uses CCMP for aggregation acceleration
  * @TX_CMD_FLG_TKIP_MIC_DONE: FW already performed TKIP MIC calculation
- * @TX_CMD_FLG_CTS_ONLY: send CTS only, no data after that
  * @TX_CMD_FLG_DUR: disable duration overwriting used in PS-Poll Assoc-id
  * @TX_CMD_FLG_FW_DROP: FW should mark frame to be dropped
  * @TX_CMD_FLG_EXEC_PAPD: execute PAPD
@@ -120,7 +119,6 @@ enum iwl_tx_flags {
         TX_CMD_FLG_RESP_TO_DRV          = BIT(21),
         TX_CMD_FLG_CCMP_AGG             = BIT(22),
         TX_CMD_FLG_TKIP_MIC_DONE        = BIT(23),
-        TX_CMD_FLG_CTS_ONLY             = BIT(24),
         TX_CMD_FLG_DUR                  = BIT(25),
         TX_CMD_FLG_FW_DROP              = BIT(26),
         TX_CMD_FLG_EXEC_PAPD            = BIT(27),
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api.h b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
index cbfb3beae783..66264cc5a016 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
@@ -136,7 +136,7 @@ enum {
         CALIB_RES_NOTIF_PHY_DB = 0x6b,
         /* PHY_DB_CMD = 0x6c, */
 
-        /* Power */
+        /* Power - legacy power table command */
         POWER_TABLE_CMD = 0x77,
 
         /* Thermal Throttling*/
@@ -159,6 +159,7 @@ enum {
         TX_ANT_CONFIGURATION_CMD = 0x98,
         BT_CONFIG = 0x9b,
         STATISTICS_NOTIFICATION = 0x9d,
+        REDUCE_TX_POWER_CMD = 0x9f,
 
         /* RF-KILL commands and notifications */
         CARD_STATE_CMD = 0xa0,
@@ -166,6 +167,9 @@ enum {
 
         MISSED_BEACONS_NOTIFICATION = 0xa2,
 
+        /* Power - new power table command */
+        MAC_PM_POWER_TABLE = 0xa9,
+
         REPLY_RX_PHY_CMD = 0xc0,
         REPLY_RX_MPDU_CMD = 0xc1,
         BA_NOTIF = 0xc5,
@@ -223,6 +227,19 @@ struct iwl_tx_ant_cfg_cmd {
         __le32 valid;
 } __packed;
 
+/**
+ * struct iwl_reduce_tx_power_cmd - TX power reduction command
+ * REDUCE_TX_POWER_CMD = 0x9f
+ * @flags: (reserved for future implementation)
+ * @mac_context_id: id of the mac ctx for which we are reducing TX power.
+ * @pwr_restriction: TX power restriction in dBms.
+ */
+struct iwl_reduce_tx_power_cmd {
+        u8 flags;
+        u8 mac_context_id;
+        __le16 pwr_restriction;
+} __packed; /* TX_REDUCED_POWER_API_S_VER_1 */
+
 /*
  * Calibration control struct.
  * Sent as part of the phy configuration command.
@@ -482,71 +499,199 @@ enum iwl_time_event_type {
         TE_MAX
 }; /* MAC_EVENT_TYPE_API_E_VER_1 */
 
+
+
+/* Time event - defines for command API v1 */
+
+/*
+ * @TE_V1_FRAG_NONE: fragmentation of the time event is NOT allowed.
+ * @TE_V1_FRAG_SINGLE: fragmentation of the time event is allowed, but only
+ *      the first fragment is scheduled.
+ * @TE_V1_FRAG_DUAL: fragmentation of the time event is allowed, but only
+ *      the first 2 fragments are scheduled.
+ * @TE_V1_FRAG_ENDLESS: fragmentation of the time event is allowed, and any
+ *      number of fragments are valid.
+ *
+ * Other than the constant defined above, specifying a fragmentation value 'x'
+ * means that the event can be fragmented but only the first 'x' will be
+ * scheduled.
+ */
+enum {
+        TE_V1_FRAG_NONE = 0,
+        TE_V1_FRAG_SINGLE = 1,
+        TE_V1_FRAG_DUAL = 2,
+        TE_V1_FRAG_ENDLESS = 0xffffffff
+};
+
+/* If a Time Event can be fragmented, this is the max number of fragments */
+#define TE_V1_FRAG_MAX_MSK      0x0fffffff
+/* Repeat the time event endlessly (until removed) */
+#define TE_V1_REPEAT_ENDLESS    0xffffffff
+/* If a Time Event has bounded repetitions, this is the maximal value */
+#define TE_V1_REPEAT_MAX_MSK_V1 0x0fffffff
+
 /* Time Event dependencies: none, on another TE, or in a specific time */
 enum {
-        TE_INDEPENDENT          = 0,
-        TE_DEP_OTHER            = 1,
-        TE_DEP_TSF              = 2,
-        TE_EVENT_SOCIOPATHIC    = 4,
+        TE_V1_INDEPENDENT               = 0,
+        TE_V1_DEP_OTHER                 = BIT(0),
+        TE_V1_DEP_TSF                   = BIT(1),
+        TE_V1_EVENT_SOCIOPATHIC         = BIT(2),
 }; /* MAC_EVENT_DEPENDENCY_POLICY_API_E_VER_2 */
+
 /*
+ * @TE_V1_NOTIF_NONE: no notifications
+ * @TE_V1_NOTIF_HOST_EVENT_START: request/receive notification on event start
+ * @TE_V1_NOTIF_HOST_EVENT_END:request/receive notification on event end
+ * @TE_V1_NOTIF_INTERNAL_EVENT_START: internal FW use
+ * @TE_V1_NOTIF_INTERNAL_EVENT_END: internal FW use.
+ * @TE_V1_NOTIF_HOST_FRAG_START: request/receive notification on frag start
+ * @TE_V1_NOTIF_HOST_FRAG_END:request/receive notification on frag end
+ * @TE_V1_NOTIF_INTERNAL_FRAG_START: internal FW use.
+ * @TE_V1_NOTIF_INTERNAL_FRAG_END: internal FW use.
+ *
  * Supported Time event notifications configuration.
  * A notification (both event and fragment) includes a status indicating weather
  * the FW was able to schedule the event or not. For fragment start/end
  * notification the status is always success. There is no start/end fragment
  * notification for monolithic events.
- *
- * @TE_NOTIF_NONE: no notifications
- * @TE_NOTIF_HOST_EVENT_START: request/receive notification on event start
- * @TE_NOTIF_HOST_EVENT_END:request/receive notification on event end
- * @TE_NOTIF_INTERNAL_EVENT_START: internal FW use
- * @TE_NOTIF_INTERNAL_EVENT_END: internal FW use.
- * @TE_NOTIF_HOST_FRAG_START: request/receive notification on frag start
- * @TE_NOTIF_HOST_FRAG_END:request/receive notification on frag end
- * @TE_NOTIF_INTERNAL_FRAG_START: internal FW use.
- * @TE_NOTIF_INTERNAL_FRAG_END: internal FW use.
  */
 enum {
-        TE_NOTIF_NONE = 0,
-        TE_NOTIF_HOST_EVENT_START = 0x1,
-        TE_NOTIF_HOST_EVENT_END = 0x2,
-        TE_NOTIF_INTERNAL_EVENT_START = 0x4,
-        TE_NOTIF_INTERNAL_EVENT_END = 0x8,
-        TE_NOTIF_HOST_FRAG_START = 0x10,
-        TE_NOTIF_HOST_FRAG_END = 0x20,
-        TE_NOTIF_INTERNAL_FRAG_START = 0x40,
-        TE_NOTIF_INTERNAL_FRAG_END = 0x80
+        TE_V1_NOTIF_NONE = 0,
+        TE_V1_NOTIF_HOST_EVENT_START = BIT(0),
+        TE_V1_NOTIF_HOST_EVENT_END = BIT(1),
+        TE_V1_NOTIF_INTERNAL_EVENT_START = BIT(2),
+        TE_V1_NOTIF_INTERNAL_EVENT_END = BIT(3),
+        TE_V1_NOTIF_HOST_FRAG_START = BIT(4),
+        TE_V1_NOTIF_HOST_FRAG_END = BIT(5),
+        TE_V1_NOTIF_INTERNAL_FRAG_START = BIT(6),
+        TE_V1_NOTIF_INTERNAL_FRAG_END = BIT(7),
 }; /* MAC_EVENT_ACTION_API_E_VER_2 */
 
+
+/**
+ * struct iwl_time_event_cmd_api_v1 - configuring Time Events
+ * with struct MAC_TIME_EVENT_DATA_API_S_VER_1 (see also
+ * with version 2. determined by IWL_UCODE_TLV_FLAGS)
+ * ( TIME_EVENT_CMD = 0x29 )
+ * @id_and_color: ID and color of the relevant MAC
+ * @action: action to perform, one of FW_CTXT_ACTION_*
+ * @id: this field has two meanings, depending on the action:
+ *      If the action is ADD, then it means the type of event to add.
+ *      For all other actions it is the unique event ID assigned when the
+ *      event was added by the FW.
+ * @apply_time: When to start the Time Event (in GP2)
+ * @max_delay: maximum delay to event's start (apply time), in TU
+ * @depends_on: the unique ID of the event we depend on (if any)
+ * @interval: interval between repetitions, in TU
+ * @interval_reciprocal: 2^32 / interval
+ * @duration: duration of event in TU
+ * @repeat: how many repetitions to do, can be TE_REPEAT_ENDLESS
+ * @dep_policy: one of TE_V1_INDEPENDENT, TE_V1_DEP_OTHER, TE_V1_DEP_TSF
+ *      and TE_V1_EVENT_SOCIOPATHIC
+ * @is_present: 0 or 1, are we present or absent during the Time Event
+ * @max_frags: maximal number of fragments the Time Event can be divided to
+ * @notify: notifications using TE_V1_NOTIF_* (whom to notify when)
+ */
+struct iwl_time_event_cmd_v1 {
+        /* COMMON_INDEX_HDR_API_S_VER_1 */
+        __le32 id_and_color;
+        __le32 action;
+        __le32 id;
+        /* MAC_TIME_EVENT_DATA_API_S_VER_1 */
+        __le32 apply_time;
+        __le32 max_delay;
+        __le32 dep_policy;
+        __le32 depends_on;
+        __le32 is_present;
+        __le32 max_frags;
+        __le32 interval;
+        __le32 interval_reciprocal;
+        __le32 duration;
+        __le32 repeat;
+        __le32 notify;
+} __packed; /* MAC_TIME_EVENT_CMD_API_S_VER_1 */
+
+
+/* Time event - defines for command API v2 */
+
 /*
- * @TE_FRAG_NONE: fragmentation of the time event is NOT allowed.
- * @TE_FRAG_SINGLE: fragmentation of the time event is allowed, but only
+ * @TE_V2_FRAG_NONE: fragmentation of the time event is NOT allowed.
+ * @TE_V2_FRAG_SINGLE: fragmentation of the time event is allowed, but only
  *  the first fragment is scheduled.
- * @TE_FRAG_DUAL: fragmentation of the time event is allowed, but only
+ * @TE_V2_FRAG_DUAL: fragmentation of the time event is allowed, but only
  *  the first 2 fragments are scheduled.
- * @TE_FRAG_ENDLESS: fragmentation of the time event is allowed, and any number
- *  of fragments are valid.
+ * @TE_V2_FRAG_ENDLESS: fragmentation of the time event is allowed, and any
+ *  number of fragments are valid.
  *
  * Other than the constant defined above, specifying a fragmentation value 'x'
  * means that the event can be fragmented but only the first 'x' will be
  * scheduled.
  */
 enum {
-        TE_FRAG_NONE = 0,
-        TE_FRAG_SINGLE = 1,
-        TE_FRAG_DUAL = 2,
-        TE_FRAG_ENDLESS = 0xffffffff
+        TE_V2_FRAG_NONE = 0,
+        TE_V2_FRAG_SINGLE = 1,
+        TE_V2_FRAG_DUAL = 2,
+        TE_V2_FRAG_MAX = 0xfe,
+        TE_V2_FRAG_ENDLESS = 0xff
 };
 
 /* Repeat the time event endlessly (until removed) */
-#define TE_REPEAT_ENDLESS       (0xffffffff)
+#define TE_V2_REPEAT_ENDLESS    0xff
 /* If a Time Event has bounded repetitions, this is the maximal value */
-#define TE_REPEAT_MAX_MSK       (0x0fffffff)
-/* If a Time Event can be fragmented, this is the max number of fragments */
-#define TE_FRAG_MAX_MSK         (0x0fffffff)
+#define TE_V2_REPEAT_MAX        0xfe
+
+#define TE_V2_PLACEMENT_POS     12
+#define TE_V2_ABSENCE_POS       15
+
+/* Time event policy values (for time event cmd api v2)
+ * A notification (both event and fragment) includes a status indicating weather
+ * the FW was able to schedule the event or not. For fragment start/end
+ * notification the status is always success. There is no start/end fragment
+ * notification for monolithic events.
+ *
+ * @TE_V2_DEFAULT_POLICY: independent, social, present, unoticable
+ * @TE_V2_NOTIF_HOST_EVENT_START: request/receive notification on event start
+ * @TE_V2_NOTIF_HOST_EVENT_END:request/receive notification on event end
+ * @TE_V2_NOTIF_INTERNAL_EVENT_START: internal FW use
+ * @TE_V2_NOTIF_INTERNAL_EVENT_END: internal FW use.
+ * @TE_V2_NOTIF_HOST_FRAG_START: request/receive notification on frag start
+ * @TE_V2_NOTIF_HOST_FRAG_END:request/receive notification on frag end
+ * @TE_V2_NOTIF_INTERNAL_FRAG_START: internal FW use.
+ * @TE_V2_NOTIF_INTERNAL_FRAG_END: internal FW use.
+ * @TE_V2_DEP_OTHER: depends on another time event
+ * @TE_V2_DEP_TSF: depends on a specific time
+ * @TE_V2_EVENT_SOCIOPATHIC: can't co-exist with other events of tha same MAC
+ * @TE_V2_ABSENCE: are we present or absent during the Time Event.
+ */
+enum {
+        TE_V2_DEFAULT_POLICY = 0x0,
+
+        /* notifications (event start/stop, fragment start/stop) */
+        TE_V2_NOTIF_HOST_EVENT_START = BIT(0),
+        TE_V2_NOTIF_HOST_EVENT_END = BIT(1),
+        TE_V2_NOTIF_INTERNAL_EVENT_START = BIT(2),
+        TE_V2_NOTIF_INTERNAL_EVENT_END = BIT(3),
+
+        TE_V2_NOTIF_HOST_FRAG_START = BIT(4),
+        TE_V2_NOTIF_HOST_FRAG_END = BIT(5),
+        TE_V2_NOTIF_INTERNAL_FRAG_START = BIT(6),
+        TE_V2_NOTIF_INTERNAL_FRAG_END = BIT(7),
+
+        TE_V2_NOTIF_MSK = 0xff,
+
+        /* placement characteristics */
+        TE_V2_DEP_OTHER = BIT(TE_V2_PLACEMENT_POS),
+        TE_V2_DEP_TSF = BIT(TE_V2_PLACEMENT_POS + 1),
+        TE_V2_EVENT_SOCIOPATHIC = BIT(TE_V2_PLACEMENT_POS + 2),
+
+        /* are we present or absent during the Time Event. */
+        TE_V2_ABSENCE = BIT(TE_V2_ABSENCE_POS),
+};
 
 /**
- * struct iwl_time_event_cmd - configuring Time Events
+ * struct iwl_time_event_cmd_api_v2 - configuring Time Events
+ * with struct MAC_TIME_EVENT_DATA_API_S_VER_2 (see also
+ * with version 1. determined by IWL_UCODE_TLV_FLAGS)
  * ( TIME_EVENT_CMD = 0x29 )
  * @id_and_color: ID and color of the relevant MAC
  * @action: action to perform, one of FW_CTXT_ACTION_*
@@ -558,32 +703,30 @@ enum {
  * @max_delay: maximum delay to event's start (apply time), in TU
  * @depends_on: the unique ID of the event we depend on (if any)
  * @interval: interval between repetitions, in TU
- * @interval_reciprocal: 2^32 / interval
  * @duration: duration of event in TU
  * @repeat: how many repetitions to do, can be TE_REPEAT_ENDLESS
- * @dep_policy: one of TE_INDEPENDENT, TE_DEP_OTHER, TE_DEP_TSF
- * @is_present: 0 or 1, are we present or absent during the Time Event
  * @max_frags: maximal number of fragments the Time Event can be divided to
- * @notify: notifications using TE_NOTIF_* (whom to notify when)
+ * @policy: defines whether uCode shall notify the host or other uCode modules
+ *      on event and/or fragment start and/or end
+ *      using one of TE_INDEPENDENT, TE_DEP_OTHER, TE_DEP_TSF
+ *      TE_EVENT_SOCIOPATHIC
+ *      using TE_ABSENCE and using TE_NOTIF_*
  */
-struct iwl_time_event_cmd {
+struct iwl_time_event_cmd_v2 {
         /* COMMON_INDEX_HDR_API_S_VER_1 */
         __le32 id_and_color;
         __le32 action;
         __le32 id;
-        /* MAC_TIME_EVENT_DATA_API_S_VER_1 */
+        /* MAC_TIME_EVENT_DATA_API_S_VER_2 */
         __le32 apply_time;
         __le32 max_delay;
-        __le32 dep_policy;
         __le32 depends_on;
-        __le32 is_present;
-        __le32 max_frags;
         __le32 interval;
-        __le32 interval_reciprocal;
         __le32 duration;
-        __le32 repeat;
-        __le32 notify;
-} __packed; /* MAC_TIME_EVENT_CMD_API_S_VER_1 */
+        u8 repeat;
+        u8 max_frags;
+        __le16 policy;
+} __packed; /* MAC_TIME_EVENT_CMD_API_S_VER_2 */
 
 /**
  * struct iwl_time_event_resp - response structure to iwl_time_event_cmd
@@ -765,6 +908,14 @@ struct iwl_phy_context_cmd {
 } __packed; /* PHY_CONTEXT_CMD_API_VER_1 */
 
 #define IWL_RX_INFO_PHY_CNT 8
+#define IWL_RX_INFO_ENERGY_ANT_ABC_IDX 1
+#define IWL_RX_INFO_ENERGY_ANT_A_MSK 0x000000ff
+#define IWL_RX_INFO_ENERGY_ANT_B_MSK 0x0000ff00
+#define IWL_RX_INFO_ENERGY_ANT_C_MSK 0x00ff0000
+#define IWL_RX_INFO_ENERGY_ANT_A_POS 0
+#define IWL_RX_INFO_ENERGY_ANT_B_POS 8
+#define IWL_RX_INFO_ENERGY_ANT_C_POS 16
+
 #define IWL_RX_INFO_AGC_IDX 1
 #define IWL_RX_INFO_RSSI_AB_IDX 2
 #define IWL_OFDM_AGC_A_MSK 0x0000007f
@@ -1170,7 +1321,7 @@ struct mvm_statistics_general {
         struct mvm_statistics_general_common common;
         __le32 beacon_filtered;
         __le32 missed_beacons;
-        __s8 beacon_filter_everage_energy;
+        __s8 beacon_filter_average_energy;
         __s8 beacon_filter_reason;
         __s8 beacon_filter_current_energy;
         __s8 beacon_filter_reserved;
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw.c b/drivers/net/wireless/iwlwifi/mvm/fw.c
index cd7c0032cc58..c76299a3a1e0 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/iwlwifi/mvm/fw.c
@@ -78,22 +78,6 @@
 
 #define UCODE_VALID_OK  cpu_to_le32(0x1)
 
-/* Default calibration values for WkP - set to INIT image w/o running */
-static const u8 wkp_calib_values_rx_iq_skew[] = { 0x00, 0x00, 0x01, 0x00 };
-static const u8 wkp_calib_values_tx_iq_skew[] = { 0x01, 0x00, 0x00, 0x00 };
-
-struct iwl_calib_default_data {
-        u16 size;
-        void *data;
-};
-
-#define CALIB_SIZE_N_DATA(_buf) {.size = sizeof(_buf), .data = &_buf}
-
-static const struct iwl_calib_default_data wkp_calib_default_data[12] = {
-        [9] = CALIB_SIZE_N_DATA(wkp_calib_values_tx_iq_skew),
-        [11] = CALIB_SIZE_N_DATA(wkp_calib_values_rx_iq_skew),
-};
-
 struct iwl_mvm_alive_data {
         bool valid;
         u32 scd_base_addr;
@@ -248,40 +232,6 @@ static int iwl_send_phy_cfg_cmd(struct iwl_mvm *mvm)
                                     sizeof(phy_cfg_cmd), &phy_cfg_cmd);
 }
 
-static int iwl_set_default_calibrations(struct iwl_mvm *mvm)
-{
-        u8 cmd_raw[16]; /* holds the variable size commands */
-        struct iwl_set_calib_default_cmd *cmd =
-                (struct iwl_set_calib_default_cmd *)cmd_raw;
-        int ret, i;
-
-        /* Setting default values for calibrations we don't run */
-        for (i = 0; i < ARRAY_SIZE(wkp_calib_default_data); i++) {
-                u16 cmd_len;
-
-                if (wkp_calib_default_data[i].size == 0)
-                        continue;
-
-                memset(cmd_raw, 0, sizeof(cmd_raw));
-                cmd_len = wkp_calib_default_data[i].size + sizeof(cmd);
-                cmd->calib_index = cpu_to_le16(i);
-                cmd->length = cpu_to_le16(wkp_calib_default_data[i].size);
-                if (WARN_ONCE(cmd_len > sizeof(cmd_raw),
-                              "Need to enlarge cmd_raw to %d\n", cmd_len))
-                        break;
-                memcpy(cmd->data, wkp_calib_default_data[i].data,
-                       wkp_calib_default_data[i].size);
-                ret = iwl_mvm_send_cmd_pdu(mvm, SET_CALIB_DEFAULT_CMD, 0,
-                                           sizeof(*cmd) +
-                                           wkp_calib_default_data[i].size,
-                                           cmd);
-                if (ret)
-                        return ret;
-        }
-
-        return 0;
-}
-
 int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
 {
         struct iwl_notification_wait calib_wait;
@@ -342,11 +292,6 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
         if (ret)
                 goto error;
 
-        /* need to set default values */
-        ret = iwl_set_default_calibrations(mvm);
-        if (ret)
-                goto error;
-
         /*
          * Send phy configurations command to init uCode
          * to start the 16.0 uCode init image internal calibrations.
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
index 94aae9c8562c..5fe23a5ea9b6 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
@@ -264,7 +264,8 @@ static int iwl_mvm_mac_ctxt_allocate_resources(struct iwl_mvm *mvm,
                 return 0;
 
         /* Therefore, in recovery, we can't get here */
-        WARN_ON_ONCE(test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status));
+        if (WARN_ON_ONCE(test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)))
+                return -EBUSY;
 
         mvmvif->id = find_first_bit(data.available_mac_ids,
                                     NUM_MAC_INDEX_DRIVER);
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index f19baf0dea6b..9833cdf6177c 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -153,7 +153,10 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
                     IEEE80211_HW_SUPPORTS_DYNAMIC_PS |
                     IEEE80211_HW_AMPDU_AGGREGATION |
                     IEEE80211_HW_TIMING_BEACON_ONLY |
-                    IEEE80211_HW_CONNECTION_MONITOR;
+                    IEEE80211_HW_CONNECTION_MONITOR |
+                    IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS |
+                    IEEE80211_HW_SUPPORTS_STATIC_SMPS |
+                    IEEE80211_HW_SUPPORTS_UAPSD;
 
         hw->queues = IWL_MVM_FIRST_AGG_QUEUE;
         hw->offchannel_tx_hw_queue = IWL_MVM_OFFCHANNEL_QUEUE;
@@ -188,6 +191,8 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
 
         hw->wiphy->max_remain_on_channel_duration = 10000;
         hw->max_listen_interval = IWL_CONN_MAX_LISTEN_INTERVAL;
+        hw->uapsd_queues = IWL_UAPSD_AC_INFO;
+        hw->uapsd_max_sp_len = IWL_UAPSD_MAX_SP;
 
         /* Extract MAC address */
         memcpy(mvm->addresses[0].addr, mvm->nvm_data->hw_addr, ETH_ALEN);
@@ -506,7 +511,7 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
 
         mutex_lock(&mvm->mutex);
 
-        /* Allocate resources for the MAC context, and add it the the fw  */
+        /* Allocate resources for the MAC context, and add it to the fw  */
         ret = iwl_mvm_mac_ctxt_init(mvm, vif);
         if (ret)
                 goto out_unlock;
@@ -552,6 +557,7 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
                         goto out_release;
                 }
 
+                iwl_mvm_vif_dbgfs_register(mvm, vif);
                 goto out_unlock;
         }
 
@@ -566,16 +572,18 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
         iwl_mvm_power_update_mode(mvm, vif);
 
         /* beacon filtering */
+        ret = iwl_mvm_disable_beacon_filter(mvm, vif);
+        if (ret)
+                goto out_remove_mac;
+
         if (!mvm->bf_allowed_vif &&
-            vif->type == NL80211_IFTYPE_STATION && !vif->p2p){
+            vif->type == NL80211_IFTYPE_STATION && !vif->p2p &&
+            mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_BF_UPDATED){
                 mvm->bf_allowed_vif = mvmvif;
-                vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER;
+                vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER |
+                                     IEEE80211_VIF_SUPPORTS_CQM_RSSI;
         }
 
-        ret = iwl_mvm_disable_beacon_filter(mvm, vif);
-        if (ret)
-                goto out_release;
-
         /*
          * P2P_DEVICE interface does not have a channel context assigned to it,
          * so a dedicated PHY context is allocated to it and the corresponding
@@ -586,7 +594,7 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
                 mvmvif->phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
                 if (!mvmvif->phy_ctxt) {
                         ret = -ENOSPC;
-                        goto out_remove_mac;
+                        goto out_free_bf;
                 }
 
                 iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
@@ -610,6 +618,12 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
         iwl_mvm_binding_remove_vif(mvm, vif);
  out_unref_phy:
         iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
+ out_free_bf:
+        if (mvm->bf_allowed_vif == mvmvif) {
+                mvm->bf_allowed_vif = NULL;
+                vif->driver_flags &= ~(IEEE80211_VIF_BEACON_FILTER |
+                                       IEEE80211_VIF_SUPPORTS_CQM_RSSI);
+        }
  out_remove_mac:
         mvmvif->phy_ctxt = NULL;
         iwl_mvm_mac_ctxt_remove(mvm, vif);
@@ -674,7 +688,8 @@ static void iwl_mvm_mac_remove_interface(struct ieee80211_hw *hw,
 
         if (mvm->bf_allowed_vif == mvmvif) {
                 mvm->bf_allowed_vif = NULL;
-                vif->driver_flags &= ~IEEE80211_VIF_BEACON_FILTER;
+                vif->driver_flags &= ~(IEEE80211_VIF_BEACON_FILTER |
+                                       IEEE80211_VIF_SUPPORTS_CQM_RSSI);
         }
 
         iwl_mvm_vif_dbgfs_clean(mvm, vif);
@@ -719,6 +734,20 @@ out_release:
         mutex_unlock(&mvm->mutex);
 }
 
+static int iwl_mvm_set_tx_power(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                                s8 tx_power)
+{
+        /* FW is in charge of regulatory enforcement */
+        struct iwl_reduce_tx_power_cmd reduce_txpwr_cmd = {
+                .mac_context_id = iwl_mvm_vif_from_mac80211(vif)->id,
+                .pwr_restriction = cpu_to_le16(tx_power),
+        };
+
+        return iwl_mvm_send_cmd_pdu(mvm, REDUCE_TX_POWER_CMD, CMD_SYNC,
+                                    sizeof(reduce_txpwr_cmd),
+                                    &reduce_txpwr_cmd);
+}
+
 static int iwl_mvm_mac_config(struct ieee80211_hw *hw, u32 changed)
 {
         return 0;
@@ -766,7 +795,6 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
                                 IWL_ERR(mvm, "failed to update quotas\n");
                                 return;
                         }
-                        iwl_mvm_bt_coex_vif_assoc(mvm, vif);
                         iwl_mvm_configure_mcast_filter(mvm, vif);
                 } else if (mvmvif->ap_sta_id != IWL_MVM_STATION_COUNT) {
                         /* remove AP station now that the MAC is unassoc */
@@ -779,9 +807,19 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
                         if (ret)
                                 IWL_ERR(mvm, "failed to update quotas\n");
                 }
-                ret = iwl_mvm_power_update_mode(mvm, vif);
-                if (ret)
-                        IWL_ERR(mvm, "failed to update power mode\n");
+
+                /* reset rssi values */
+                mvmvif->bf_data.ave_beacon_signal = 0;
+
+                if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD)) {
+                        /* Workaround for FW bug, otherwise FW disables device
+                         * power save upon disassociation
+                         */
+                        ret = iwl_mvm_power_update_mode(mvm, vif);
+                        if (ret)
+                                IWL_ERR(mvm, "failed to update power mode\n");
+                }
+                iwl_mvm_bt_coex_vif_assoc(mvm, vif);
         } else if (changes & BSS_CHANGED_BEACON_INFO) {
                 /*
                  * We received a beacon _after_ association so
@@ -789,11 +827,25 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
                  */
                 iwl_mvm_remove_time_event(mvm, mvmvif,
                                           &mvmvif->time_event_data);
-        } else if (changes & BSS_CHANGED_PS) {
+        } else if (changes & (BSS_CHANGED_PS | BSS_CHANGED_QOS)) {
                 ret = iwl_mvm_power_update_mode(mvm, vif);
                 if (ret)
                         IWL_ERR(mvm, "failed to update power mode\n");
         }
+        if (changes & BSS_CHANGED_TXPOWER) {
+                IWL_DEBUG_CALIB(mvm, "Changing TX Power to %d\n",
+                                bss_conf->txpower);
+                iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
+        }
+
+        if (changes & BSS_CHANGED_CQM) {
+                IWL_DEBUG_MAC80211(mvm, "cqm info_changed");
+                /* reset cqm events tracking */
+                mvmvif->bf_data.last_cqm_event = 0;
+                ret = iwl_mvm_update_beacon_filter(mvm, vif);
+                if (ret)
+                        IWL_ERR(mvm, "failed to update CQM thresholds\n");
+        }
 }
 
 static int iwl_mvm_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index 420e82d379d9..b0389279cc1e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -76,6 +76,7 @@
 #include "iwl-trans.h"
 #include "sta.h"
 #include "fw-api.h"
+#include "constants.h"
 
 #define IWL_INVALID_MAC80211_QUEUE      0xff
 #define IWL_MVM_MAX_ADDRESSES           5
@@ -91,6 +92,9 @@ enum iwl_mvm_tx_fifo {
 };
 
 extern struct ieee80211_ops iwl_mvm_hw_ops;
+extern const struct iwl_mvm_power_ops pm_legacy_ops;
+extern const struct iwl_mvm_power_ops pm_mac_ops;
+
 /**
  * struct iwl_mvm_mod_params - module parameters for iwlmvm
  * @init_dbg: if true, then the NIC won't be stopped if the INIT fw asserted.
@@ -149,6 +153,22 @@ enum iwl_power_scheme {
 };
 
 #define IWL_CONN_MAX_LISTEN_INTERVAL    70
+#define IWL_UAPSD_AC_INFO               (IEEE80211_WMM_IE_STA_QOSINFO_AC_VO |\
+                                         IEEE80211_WMM_IE_STA_QOSINFO_AC_VI |\
+                                         IEEE80211_WMM_IE_STA_QOSINFO_AC_BK |\
+                                         IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
+#define IWL_UAPSD_MAX_SP                IEEE80211_WMM_IE_STA_QOSINFO_SP_2
+
+struct iwl_mvm_power_ops {
+        int (*power_update_mode)(struct iwl_mvm *mvm,
+                                 struct ieee80211_vif *vif);
+        int (*power_disable)(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        int (*power_dbgfs_read)(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                                char *buf, int bufsz);
+#endif
+};
+
 
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 enum iwl_dbgfs_pm_mask {
@@ -160,10 +180,11 @@ enum iwl_dbgfs_pm_mask {
         MVM_DEBUGFS_PM_DISABLE_POWER_OFF = BIT(5),
         MVM_DEBUGFS_PM_LPRX_ENA = BIT(6),
         MVM_DEBUGFS_PM_LPRX_RSSI_THRESHOLD = BIT(7),
+        MVM_DEBUGFS_PM_SNOOZE_ENABLE = BIT(8),
 };
 
 struct iwl_dbgfs_pm {
-        u8 keep_alive_seconds;
+        u16 keep_alive_seconds;
         u32 rx_data_timeout;
         u32 tx_data_timeout;
         bool skip_over_dtim;
@@ -171,6 +192,7 @@ struct iwl_dbgfs_pm {
         bool disable_power_off;
         bool lprx_ena;
         u32 lprx_rssi_threshold;
+        bool snooze_ena;
         int mask;
 };
 
@@ -180,24 +202,28 @@ enum iwl_dbgfs_bf_mask {
         MVM_DEBUGFS_BF_ENERGY_DELTA = BIT(0),
         MVM_DEBUGFS_BF_ROAMING_ENERGY_DELTA = BIT(1),
         MVM_DEBUGFS_BF_ROAMING_STATE = BIT(2),
-        MVM_DEBUGFS_BF_TEMPERATURE_DELTA = BIT(3),
-        MVM_DEBUGFS_BF_ENABLE_BEACON_FILTER = BIT(4),
-        MVM_DEBUGFS_BF_DEBUG_FLAG = BIT(5),
-        MVM_DEBUGFS_BF_ESCAPE_TIMER = BIT(6),
-        MVM_DEBUGFS_BA_ESCAPE_TIMER = BIT(7),
-        MVM_DEBUGFS_BA_ENABLE_BEACON_ABORT = BIT(8),
+        MVM_DEBUGFS_BF_TEMP_THRESHOLD = BIT(3),
+        MVM_DEBUGFS_BF_TEMP_FAST_FILTER = BIT(4),
+        MVM_DEBUGFS_BF_TEMP_SLOW_FILTER = BIT(5),
+        MVM_DEBUGFS_BF_ENABLE_BEACON_FILTER = BIT(6),
+        MVM_DEBUGFS_BF_DEBUG_FLAG = BIT(7),
+        MVM_DEBUGFS_BF_ESCAPE_TIMER = BIT(8),
+        MVM_DEBUGFS_BA_ESCAPE_TIMER = BIT(9),
+        MVM_DEBUGFS_BA_ENABLE_BEACON_ABORT = BIT(10),
 };
 
 struct iwl_dbgfs_bf {
-        u8 bf_energy_delta;
-        u8 bf_roaming_energy_delta;
-        u8 bf_roaming_state;
-        u8 bf_temperature_delta;
-        u8 bf_enable_beacon_filter;
-        u8 bf_debug_flag;
+        u32 bf_energy_delta;
+        u32 bf_roaming_energy_delta;
+        u32 bf_roaming_state;
+        u32 bf_temp_threshold;
+        u32 bf_temp_fast_filter;
+        u32 bf_temp_slow_filter;
+        u32 bf_enable_beacon_filter;
+        u32 bf_debug_flag;
         u32 bf_escape_timer;
         u32 ba_escape_timer;
-        u8 ba_enable_beacon_abort;
+        u32 ba_enable_beacon_abort;
         int mask;
 };
 #endif
@@ -209,6 +235,21 @@ enum iwl_mvm_smps_type_request {
 };
 
 /**
+* struct iwl_mvm_vif_bf_data - beacon filtering related data
+* @bf_enabled: indicates if beacon filtering is enabled
+* @ba_enabled: indicated if beacon abort is enabled
+* @last_beacon_signal: last beacon rssi signal in dbm
+* @ave_beacon_signal: average beacon signal
+* @last_cqm_event: rssi of the last cqm event
+*/
+struct iwl_mvm_vif_bf_data {
+        bool bf_enabled;
+        bool ba_enabled;
+        s8 ave_beacon_signal;
+        s8 last_cqm_event;
+};
+
+/**
  * struct iwl_mvm_vif - data per Virtual Interface, it is a MAC context
  * @id: between 0 and 3
  * @color: to solve races upon MAC addition and removal
@@ -233,8 +274,7 @@ struct iwl_mvm_vif {
         bool uploaded;
         bool ap_active;
         bool monitor_active;
-        /* indicate whether beacon filtering is enabled */
-        bool bf_enabled;
+        struct iwl_mvm_vif_bf_data bf_data;
 
         u32 ap_beacon_time;
 
@@ -268,7 +308,7 @@ struct iwl_mvm_vif {
 
 #if IS_ENABLED(CONFIG_IPV6)
         /* IPv6 addresses for WoWLAN */
-        struct in6_addr target_ipv6_addrs[IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS];
+        struct in6_addr target_ipv6_addrs[IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS_MAX];
         int num_target_ipv6_addrs;
 #endif
 #endif
@@ -402,6 +442,8 @@ struct iwl_mvm {
 
         struct iwl_notif_wait_data notif_wait;
 
+        struct mvm_statistics_rx rx_stats;
+
         unsigned long transport_queue_stop;
         u8 queue_to_mac80211[IWL_MAX_HW_QUEUES];
         atomic_t queue_stop_count[IWL_MAX_HW_QUEUES];
@@ -459,6 +501,9 @@ struct iwl_mvm {
          */
         u8 vif_count;
 
+        /* -1 for always, 0 for never, >0 for that many times */
+        s8 restart_fw;
+
         struct led_classdev led;
 
         struct ieee80211_vif *p2p_device_vif;
@@ -482,6 +527,8 @@ struct iwl_mvm {
         /* Thermal Throttling and CTkill */
         struct iwl_mvm_tt_mgmt thermal_throttle;
         s32 temperature;        /* Celsius */
+
+        const struct iwl_mvm_power_ops *pm_ops;
 };
 
 /* Extract MVM priv from op_mode and _hw */
@@ -525,6 +572,7 @@ int iwl_mvm_legacy_rate_to_mac80211_idx(u32 rate_n_flags,
                                         enum ieee80211_band band);
 u8 iwl_mvm_mac80211_idx_to_hwrate(int rate_idx);
 void iwl_mvm_dump_nic_error_log(struct iwl_mvm *mvm);
+void iwl_mvm_dump_sram(struct iwl_mvm *mvm);
 u8 first_antenna(u8 mask);
 u8 iwl_mvm_next_antenna(struct iwl_mvm *mvm, u8 valid, u8 last_idx);
 
@@ -660,10 +708,26 @@ int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq,
                         u8 flags, bool init);
 
 /* power managment */
-int iwl_mvm_power_update_mode(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
-int iwl_mvm_power_disable(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
-void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
-                             struct iwl_powertable_cmd *cmd);
+static inline int iwl_mvm_power_update_mode(struct iwl_mvm *mvm,
+                                            struct ieee80211_vif *vif)
+{
+        return mvm->pm_ops->power_update_mode(mvm, vif);
+}
+
+static inline int iwl_mvm_power_disable(struct iwl_mvm *mvm,
+                                        struct ieee80211_vif *vif)
+{
+        return mvm->pm_ops->power_disable(mvm, vif);
+}
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+static inline int iwl_mvm_power_dbgfs_read(struct iwl_mvm *mvm,
+                                            struct ieee80211_vif *vif,
+                                            char *buf, int bufsz)
+{
+        return mvm->pm_ops->power_dbgfs_read(mvm, vif, buf, bufsz);
+}
+#endif
 
 int iwl_mvm_leds_init(struct iwl_mvm *mvm);
 void iwl_mvm_leds_exit(struct iwl_mvm *mvm);
@@ -707,6 +771,12 @@ int iwl_mvm_enable_beacon_filter(struct iwl_mvm *mvm,
                                  struct ieee80211_vif *vif);
 int iwl_mvm_disable_beacon_filter(struct iwl_mvm *mvm,
                                   struct ieee80211_vif *vif);
+int iwl_mvm_beacon_filter_send_cmd(struct iwl_mvm *mvm,
+                                   struct iwl_beacon_filter_cmd *cmd);
+int iwl_mvm_update_beacon_abort(struct iwl_mvm *mvm,
+                                struct ieee80211_vif *vif, bool enable);
+int iwl_mvm_update_beacon_filter(struct iwl_mvm *mvm,
+                                  struct ieee80211_vif *vif);
 
 /* SMPS */
 void iwl_mvm_update_smps(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
diff --git a/drivers/net/wireless/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwlwifi/mvm/ops.c
index af79a14063a9..2fcc8ef88a68 100644
--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
@@ -275,6 +275,7 @@ static const char *iwl_mvm_cmd_strings[REPLY_MAX] = {
         CMD(BEACON_NOTIFICATION),
         CMD(BEACON_TEMPLATE_CMD),
         CMD(STATISTICS_NOTIFICATION),
+        CMD(REDUCE_TX_POWER_CMD),
         CMD(TX_ANT_CONFIGURATION_CMD),
         CMD(D3_CONFIG_CMD),
         CMD(PROT_OFFLOAD_CONFIG_CMD),
@@ -301,6 +302,7 @@ static const char *iwl_mvm_cmd_strings[REPLY_MAX] = {
         CMD(MCAST_FILTER_CMD),
         CMD(REPLY_BEACON_FILTERING_CMD),
         CMD(REPLY_THERMAL_MNG_BACKOFF),
+        CMD(MAC_PM_POWER_TABLE),
 };
 #undef CMD
 
@@ -340,6 +342,8 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         mvm->fw = fw;
         mvm->hw = hw;
 
+        mvm->restart_fw = iwlwifi_mod_params.restart_fw ? -1 : 0;
+
         mutex_init(&mvm->mutex);
         spin_lock_init(&mvm->async_handlers_lock);
         INIT_LIST_HEAD(&mvm->time_event_list);
@@ -431,6 +435,13 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         if (err)
                 goto out_unregister;
 
+        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD)
+                mvm->pm_ops = &pm_mac_ops;
+        else
+                mvm->pm_ops = &pm_legacy_ops;
+
+        memset(&mvm->rx_stats, 0, sizeof(struct mvm_statistics_rx));
+
         return op_mode;
 
  out_unregister:
@@ -638,6 +649,22 @@ static void iwl_mvm_free_skb(struct iwl_op_mode *op_mode, struct sk_buff *skb)
         ieee80211_free_txskb(mvm->hw, skb);
 }
 
+struct iwl_mvm_reprobe {
+        struct device *dev;
+        struct work_struct work;
+};
+
+static void iwl_mvm_reprobe_wk(struct work_struct *wk)
+{
+        struct iwl_mvm_reprobe *reprobe;
+
+        reprobe = container_of(wk, struct iwl_mvm_reprobe, work);
+        if (device_reprobe(reprobe->dev))
+                dev_err(reprobe->dev, "reprobe failed!\n");
+        kfree(reprobe);
+        module_put(THIS_MODULE);
+}
+
 static void iwl_mvm_nic_restart(struct iwl_mvm *mvm)
 {
         iwl_abort_notification_waits(&mvm->notif_wait);
@@ -649,9 +676,30 @@ static void iwl_mvm_nic_restart(struct iwl_mvm *mvm)
          * can't recover this since we're already half suspended.
          */
         if (test_and_set_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
-                IWL_ERR(mvm, "Firmware error during reconfiguration! Abort.\n");
-        } else if (mvm->cur_ucode == IWL_UCODE_REGULAR &&
-                   iwlwifi_mod_params.restart_fw) {
+                struct iwl_mvm_reprobe *reprobe;
+
+                IWL_ERR(mvm,
+                        "Firmware error during reconfiguration - reprobe!\n");
+
+                /*
+                 * get a module reference to avoid doing this while unloading
+                 * anyway and to avoid scheduling a work with code that's
+                 * being removed.
+                 */
+                if (!try_module_get(THIS_MODULE)) {
+                        IWL_ERR(mvm, "Module is being unloaded - abort\n");
+                        return;
+                }
+
+                reprobe = kzalloc(sizeof(*reprobe), GFP_ATOMIC);
+                if (!reprobe) {
+                        module_put(THIS_MODULE);
+                        return;
+                }
+                reprobe->dev = mvm->trans->dev;
+                INIT_WORK(&reprobe->work, iwl_mvm_reprobe_wk);
+                schedule_work(&reprobe->work);
+        } else if (mvm->cur_ucode == IWL_UCODE_REGULAR && mvm->restart_fw) {
                 /*
                  * This is a bit racy, but worst case we tell mac80211 about
                  * a stopped/aborted (sched) scan when that was already done
@@ -669,6 +717,8 @@ static void iwl_mvm_nic_restart(struct iwl_mvm *mvm)
                         break;
                 }
 
+                if (mvm->restart_fw > 0)
+                        mvm->restart_fw--;
                 ieee80211_restart_hw(mvm->hw);
         }
 }
@@ -678,6 +728,8 @@ static void iwl_mvm_nic_error(struct iwl_op_mode *op_mode)
         struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
 
         iwl_mvm_dump_nic_error_log(mvm);
+        if (!mvm->restart_fw)
+                iwl_mvm_dump_sram(mvm);
 
         iwl_mvm_nic_restart(mvm);
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/power.c b/drivers/net/wireless/iwlwifi/mvm/power.c
index e7ca965a89b8..21407a353a3b 100644
--- a/drivers/net/wireless/iwlwifi/mvm/power.c
+++ b/drivers/net/wireless/iwlwifi/mvm/power.c
@@ -75,8 +75,8 @@
 
 #define POWER_KEEP_ALIVE_PERIOD_SEC    25
 
-static int iwl_mvm_beacon_filter_send_cmd(struct iwl_mvm *mvm,
-                                          struct iwl_beacon_filter_cmd *cmd)
+int iwl_mvm_beacon_filter_send_cmd(struct iwl_mvm *mvm,
+                                   struct iwl_beacon_filter_cmd *cmd)
 {
         int ret;
 
@@ -85,69 +85,110 @@ static int iwl_mvm_beacon_filter_send_cmd(struct iwl_mvm *mvm,
 
         if (!ret) {
                 IWL_DEBUG_POWER(mvm, "ba_enable_beacon_abort is: %d\n",
-                                cmd->ba_enable_beacon_abort);
+                                le32_to_cpu(cmd->ba_enable_beacon_abort));
                 IWL_DEBUG_POWER(mvm, "ba_escape_timer is: %d\n",
-                                cmd->ba_escape_timer);
+                                le32_to_cpu(cmd->ba_escape_timer));
                 IWL_DEBUG_POWER(mvm, "bf_debug_flag is: %d\n",
-                                cmd->bf_debug_flag);
+                                le32_to_cpu(cmd->bf_debug_flag));
                 IWL_DEBUG_POWER(mvm, "bf_enable_beacon_filter is: %d\n",
-                                cmd->bf_enable_beacon_filter);
+                                le32_to_cpu(cmd->bf_enable_beacon_filter));
                 IWL_DEBUG_POWER(mvm, "bf_energy_delta is: %d\n",
-                                cmd->bf_energy_delta);
+                                le32_to_cpu(cmd->bf_energy_delta));
                 IWL_DEBUG_POWER(mvm, "bf_escape_timer is: %d\n",
-                                cmd->bf_escape_timer);
+                                le32_to_cpu(cmd->bf_escape_timer));
                 IWL_DEBUG_POWER(mvm, "bf_roaming_energy_delta is: %d\n",
-                                cmd->bf_roaming_energy_delta);
+                                le32_to_cpu(cmd->bf_roaming_energy_delta));
                 IWL_DEBUG_POWER(mvm, "bf_roaming_state is: %d\n",
-                                cmd->bf_roaming_state);
-                IWL_DEBUG_POWER(mvm, "bf_temperature_delta is: %d\n",
-                                cmd->bf_temperature_delta);
+                                le32_to_cpu(cmd->bf_roaming_state));
+                IWL_DEBUG_POWER(mvm, "bf_temp_threshold is: %d\n",
+                                le32_to_cpu(cmd->bf_temp_threshold));
+                IWL_DEBUG_POWER(mvm, "bf_temp_fast_filter is: %d\n",
+                                le32_to_cpu(cmd->bf_temp_fast_filter));
+                IWL_DEBUG_POWER(mvm, "bf_temp_slow_filter is: %d\n",
+                                le32_to_cpu(cmd->bf_temp_slow_filter));
         }
         return ret;
 }
 
-static int iwl_mvm_update_beacon_abort(struct iwl_mvm *mvm,
-                                       struct ieee80211_vif *vif, bool enable)
+static
+void iwl_mvm_beacon_filter_set_cqm_params(struct iwl_mvm *mvm,
+                                          struct ieee80211_vif *vif,
+                                          struct iwl_beacon_filter_cmd *cmd)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+
+        if (vif->bss_conf.cqm_rssi_thold) {
+                cmd->bf_energy_delta =
+                        cpu_to_le32(vif->bss_conf.cqm_rssi_hyst);
+                /* fw uses an absolute value for this */
+                cmd->bf_roaming_state =
+                        cpu_to_le32(-vif->bss_conf.cqm_rssi_thold);
+        }
+        cmd->ba_enable_beacon_abort = cpu_to_le32(mvmvif->bf_data.ba_enabled);
+}
+
+int iwl_mvm_update_beacon_abort(struct iwl_mvm *mvm,
+                                struct ieee80211_vif *vif, bool enable)
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_beacon_filter_cmd cmd = {
                 IWL_BF_CMD_CONFIG_DEFAULTS,
-                .bf_enable_beacon_filter = 1,
-                .ba_enable_beacon_abort = enable,
+                .bf_enable_beacon_filter = cpu_to_le32(1),
+                .ba_enable_beacon_abort = cpu_to_le32(enable),
         };
 
-        if (!mvmvif->bf_enabled)
+        if (!mvmvif->bf_data.bf_enabled)
                 return 0;
 
+        if (mvm->cur_ucode == IWL_UCODE_WOWLAN)
+                cmd.ba_escape_timer = cpu_to_le32(IWL_BA_ESCAPE_TIMER_D3);
+
+        mvmvif->bf_data.ba_enabled = enable;
+        iwl_mvm_beacon_filter_set_cqm_params(mvm, vif, &cmd);
         iwl_mvm_beacon_filter_debugfs_parameters(vif, &cmd);
         return iwl_mvm_beacon_filter_send_cmd(mvm, &cmd);
 }
 
 static void iwl_mvm_power_log(struct iwl_mvm *mvm,
-                              struct iwl_powertable_cmd *cmd)
+                              struct iwl_mac_power_cmd *cmd)
 {
         IWL_DEBUG_POWER(mvm,
-                        "Sending power table command for power level %d, flags = 0x%X\n",
-                        iwlmvm_mod_params.power_scheme,
+                        "Sending power table command on mac id 0x%X for power level %d, flags = 0x%X\n",
+                        cmd->id_and_color, iwlmvm_mod_params.power_scheme,
                         le16_to_cpu(cmd->flags));
-        IWL_DEBUG_POWER(mvm, "Keep alive = %u sec\n", cmd->keep_alive_seconds);
-
-        if (cmd->flags & cpu_to_le16(POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK)) {
-                IWL_DEBUG_POWER(mvm, "Rx timeout = %u usec\n",
-                                le32_to_cpu(cmd->rx_data_timeout));
-                IWL_DEBUG_POWER(mvm, "Tx timeout = %u usec\n",
-                                le32_to_cpu(cmd->tx_data_timeout));
-                if (cmd->flags & cpu_to_le16(POWER_FLAGS_SKIP_OVER_DTIM_MSK))
-                        IWL_DEBUG_POWER(mvm, "DTIM periods to skip = %u\n",
-                                        le32_to_cpu(cmd->skip_dtim_periods));
-                if (cmd->flags & cpu_to_le16(POWER_FLAGS_LPRX_ENA_MSK))
-                        IWL_DEBUG_POWER(mvm, "LP RX RSSI threshold = %u\n",
-                                        le32_to_cpu(cmd->lprx_rssi_threshold));
+        IWL_DEBUG_POWER(mvm, "Keep alive = %u sec\n",
+                        le16_to_cpu(cmd->keep_alive_seconds));
+
+        if (!(cmd->flags & cpu_to_le16(POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK))) {
+                IWL_DEBUG_POWER(mvm, "Disable power management\n");
+                return;
+        }
+
+        IWL_DEBUG_POWER(mvm, "Rx timeout = %u usec\n",
+                        le32_to_cpu(cmd->rx_data_timeout));
+        IWL_DEBUG_POWER(mvm, "Tx timeout = %u usec\n",
+                        le32_to_cpu(cmd->tx_data_timeout));
+        if (cmd->flags & cpu_to_le16(POWER_FLAGS_SKIP_OVER_DTIM_MSK))
+                IWL_DEBUG_POWER(mvm, "DTIM periods to skip = %u\n",
+                                cmd->skip_dtim_periods);
+        if (cmd->flags & cpu_to_le16(POWER_FLAGS_LPRX_ENA_MSK))
+                IWL_DEBUG_POWER(mvm, "LP RX RSSI threshold = %u\n",
+                                cmd->lprx_rssi_threshold);
+        if (cmd->flags & cpu_to_le16(POWER_FLAGS_ADVANCE_PM_ENA_MSK)) {
+                IWL_DEBUG_POWER(mvm, "uAPSD enabled\n");
+                IWL_DEBUG_POWER(mvm, "Rx timeout (uAPSD) = %u usec\n",
+                                le32_to_cpu(cmd->rx_data_timeout_uapsd));
+                IWL_DEBUG_POWER(mvm, "Tx timeout (uAPSD) = %u usec\n",
+                                le32_to_cpu(cmd->tx_data_timeout_uapsd));
+                IWL_DEBUG_POWER(mvm, "QNDP TID = %d\n", cmd->qndp_tid);
+                IWL_DEBUG_POWER(mvm, "ACs flags = 0x%x\n", cmd->uapsd_ac_flags);
+                IWL_DEBUG_POWER(mvm, "Max SP = %d\n", cmd->uapsd_max_sp);
         }
 }
 
-void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
-                             struct iwl_powertable_cmd *cmd)
+static void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm,
+                                    struct ieee80211_vif *vif,
+                                    struct iwl_mac_power_cmd *cmd)
 {
         struct ieee80211_hw *hw = mvm->hw;
         struct ieee80211_chanctx_conf *chanctx_conf;
@@ -157,20 +198,29 @@ void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         bool radar_detect = false;
         struct iwl_mvm_vif *mvmvif __maybe_unused =
                 iwl_mvm_vif_from_mac80211(vif);
+        enum ieee80211_ac_numbers ac;
+        bool tid_found = false;
+
+        cmd->id_and_color = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
+                                                            mvmvif->color));
+        dtimper = hw->conf.ps_dtim_period ?: 1;
 
         /*
          * Regardless of power management state the driver must set
          * keep alive period. FW will use it for sending keep alive NDPs
-         * immediately after association.
+         * immediately after association. Check that keep alive period
+         * is at least 3 * DTIM
          */
-        cmd->keep_alive_seconds = POWER_KEEP_ALIVE_PERIOD_SEC;
+        dtimper_msec = dtimper * vif->bss_conf.beacon_int;
+        keep_alive = max_t(int, 3 * dtimper_msec,
+                           MSEC_PER_SEC * POWER_KEEP_ALIVE_PERIOD_SEC);
+        keep_alive = DIV_ROUND_UP(keep_alive, MSEC_PER_SEC);
+        cmd->keep_alive_seconds = cpu_to_le16(keep_alive);
 
         if (iwlmvm_mod_params.power_scheme == IWL_POWER_SCHEME_CAM)
                 return;
 
         cmd->flags |= cpu_to_le16(POWER_FLAGS_POWER_SAVE_ENA_MSK);
-        if (!vif->bss_conf.assoc)
-                cmd->flags |= cpu_to_le16(POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK);
 
 #ifdef CONFIG_IWLWIFI_DEBUGFS
         if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_DISABLE_POWER_OFF &&
@@ -186,12 +236,9 @@ void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
             (vif->bss_conf.beacon_rate->bitrate == 10 ||
              vif->bss_conf.beacon_rate->bitrate == 60)) {
                 cmd->flags |= cpu_to_le16(POWER_FLAGS_LPRX_ENA_MSK);
-                cmd->lprx_rssi_threshold =
-                        cpu_to_le32(POWER_LPRX_RSSI_THRESHOLD);
+                cmd->lprx_rssi_threshold = POWER_LPRX_RSSI_THRESHOLD;
         }
 
-        dtimper = hw->conf.ps_dtim_period ?: 1;
-
         /* Check if radar detection is required on current channel */
         rcu_read_lock();
         chanctx_conf = rcu_dereference(vif->chanctx_conf);
@@ -207,27 +254,82 @@ void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
             (iwlmvm_mod_params.power_scheme == IWL_POWER_SCHEME_LP ||
              mvm->cur_ucode == IWL_UCODE_WOWLAN)) {
                 cmd->flags |= cpu_to_le16(POWER_FLAGS_SKIP_OVER_DTIM_MSK);
-                cmd->skip_dtim_periods = cpu_to_le32(3);
+                cmd->skip_dtim_periods = 3;
         }
 
-        /* Check that keep alive period is at least 3 * DTIM */
-        dtimper_msec = dtimper * vif->bss_conf.beacon_int;
-        keep_alive = max_t(int, 3 * dtimper_msec,
-                           MSEC_PER_SEC * cmd->keep_alive_seconds);
-        keep_alive = DIV_ROUND_UP(keep_alive, MSEC_PER_SEC);
-        cmd->keep_alive_seconds = keep_alive;
-
         if (mvm->cur_ucode != IWL_UCODE_WOWLAN) {
-                cmd->rx_data_timeout = cpu_to_le32(100 * USEC_PER_MSEC);
-                cmd->tx_data_timeout = cpu_to_le32(100 * USEC_PER_MSEC);
+                cmd->rx_data_timeout =
+                        cpu_to_le32(IWL_MVM_DEFAULT_PS_RX_DATA_TIMEOUT);
+                cmd->tx_data_timeout =
+                        cpu_to_le32(IWL_MVM_DEFAULT_PS_TX_DATA_TIMEOUT);
         } else {
-                cmd->rx_data_timeout = cpu_to_le32(10 * USEC_PER_MSEC);
-                cmd->tx_data_timeout = cpu_to_le32(10 * USEC_PER_MSEC);
+                cmd->rx_data_timeout =
+                        cpu_to_le32(IWL_MVM_WOWLAN_PS_RX_DATA_TIMEOUT);
+                cmd->tx_data_timeout =
+                        cpu_to_le32(IWL_MVM_WOWLAN_PS_TX_DATA_TIMEOUT);
+        }
+
+        for (ac = IEEE80211_AC_VO; ac <= IEEE80211_AC_BK; ac++) {
+                if (!mvmvif->queue_params[ac].uapsd)
+                        continue;
+
+                cmd->flags |= cpu_to_le16(POWER_FLAGS_ADVANCE_PM_ENA_MSK);
+                cmd->uapsd_ac_flags |= BIT(ac);
+
+                /* QNDP TID - the highest TID with no admission control */
+                if (!tid_found && !mvmvif->queue_params[ac].acm) {
+                        tid_found = true;
+                        switch (ac) {
+                        case IEEE80211_AC_VO:
+                                cmd->qndp_tid = 6;
+                                break;
+                        case IEEE80211_AC_VI:
+                                cmd->qndp_tid = 5;
+                                break;
+                        case IEEE80211_AC_BE:
+                                cmd->qndp_tid = 0;
+                                break;
+                        case IEEE80211_AC_BK:
+                                cmd->qndp_tid = 1;
+                                break;
+                        }
+                }
+        }
+
+        if (cmd->flags & cpu_to_le16(POWER_FLAGS_ADVANCE_PM_ENA_MSK)) {
+                cmd->rx_data_timeout_uapsd =
+                        cpu_to_le32(IWL_MVM_UAPSD_RX_DATA_TIMEOUT);
+                cmd->tx_data_timeout_uapsd =
+                        cpu_to_le32(IWL_MVM_UAPSD_TX_DATA_TIMEOUT);
+
+                if (cmd->uapsd_ac_flags == (BIT(IEEE80211_AC_VO) |
+                                            BIT(IEEE80211_AC_VI) |
+                                            BIT(IEEE80211_AC_BE) |
+                                            BIT(IEEE80211_AC_BK))) {
+                        cmd->flags |= cpu_to_le16(POWER_FLAGS_SNOOZE_ENA_MSK);
+                        cmd->snooze_interval =
+                                cpu_to_le16(IWL_MVM_PS_SNOOZE_INTERVAL);
+                        cmd->snooze_window =
+                                (mvm->cur_ucode == IWL_UCODE_WOWLAN) ?
+                                cpu_to_le16(IWL_MVM_WOWLAN_PS_SNOOZE_WINDOW) :
+                                cpu_to_le16(IWL_MVM_PS_SNOOZE_WINDOW);
+                }
+
+                cmd->uapsd_max_sp = IWL_UAPSD_MAX_SP;
+                cmd->heavy_tx_thld_packets =
+                        IWL_MVM_PS_HEAVY_TX_THLD_PACKETS;
+                cmd->heavy_rx_thld_packets =
+                        IWL_MVM_PS_HEAVY_RX_THLD_PACKETS;
+                cmd->heavy_tx_thld_percentage =
+                        IWL_MVM_PS_HEAVY_TX_THLD_PERCENT;
+                cmd->heavy_rx_thld_percentage =
+                        IWL_MVM_PS_HEAVY_RX_THLD_PERCENT;
         }
 
 #ifdef CONFIG_IWLWIFI_DEBUGFS
         if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_KEEP_ALIVE)
-                cmd->keep_alive_seconds = mvmvif->dbgfs_pm.keep_alive_seconds;
+                cmd->keep_alive_seconds =
+                        cpu_to_le16(mvmvif->dbgfs_pm.keep_alive_seconds);
         if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_SKIP_OVER_DTIM) {
                 if (mvmvif->dbgfs_pm.skip_over_dtim)
                         cmd->flags |=
@@ -243,8 +345,7 @@ void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                 cmd->tx_data_timeout =
                         cpu_to_le32(mvmvif->dbgfs_pm.tx_data_timeout);
         if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_SKIP_DTIM_PERIODS)
-                cmd->skip_dtim_periods =
-                        cpu_to_le32(mvmvif->dbgfs_pm.skip_dtim_periods);
+                cmd->skip_dtim_periods = mvmvif->dbgfs_pm.skip_dtim_periods;
         if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_LPRX_ENA) {
                 if (mvmvif->dbgfs_pm.lprx_ena)
                         cmd->flags |= cpu_to_le16(POWER_FLAGS_LPRX_ENA_MSK);
@@ -252,16 +353,24 @@ void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                         cmd->flags &= cpu_to_le16(~POWER_FLAGS_LPRX_ENA_MSK);
         }
         if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_LPRX_RSSI_THRESHOLD)
-                cmd->lprx_rssi_threshold =
-                        cpu_to_le32(mvmvif->dbgfs_pm.lprx_rssi_threshold);
+                cmd->lprx_rssi_threshold = mvmvif->dbgfs_pm.lprx_rssi_threshold;
+        if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_SNOOZE_ENABLE) {
+                if (mvmvif->dbgfs_pm.snooze_ena)
+                        cmd->flags |=
+                                cpu_to_le16(POWER_FLAGS_SNOOZE_ENA_MSK);
+                else
+                        cmd->flags &=
+                                cpu_to_le16(~POWER_FLAGS_SNOOZE_ENA_MSK);
+        }
 #endif /* CONFIG_IWLWIFI_DEBUGFS */
 }
 
-int iwl_mvm_power_update_mode(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
+static int iwl_mvm_power_mac_update_mode(struct iwl_mvm *mvm,
+                                         struct ieee80211_vif *vif)
 {
         int ret;
         bool ba_enable;
-        struct iwl_powertable_cmd cmd = {};
+        struct iwl_mac_power_cmd cmd = {};
 
         if (vif->type != NL80211_IFTYPE_STATION || vif->p2p)
                 return 0;
@@ -280,7 +389,7 @@ int iwl_mvm_power_update_mode(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
         iwl_mvm_power_build_cmd(mvm, vif, &cmd);
         iwl_mvm_power_log(mvm, &cmd);
 
-        ret = iwl_mvm_send_cmd_pdu(mvm, POWER_TABLE_CMD, CMD_SYNC,
+        ret = iwl_mvm_send_cmd_pdu(mvm, MAC_PM_POWER_TABLE, CMD_SYNC,
                                    sizeof(cmd), &cmd);
         if (ret)
                 return ret;
@@ -291,15 +400,19 @@ int iwl_mvm_power_update_mode(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
         return iwl_mvm_update_beacon_abort(mvm, vif, ba_enable);
 }
 
-int iwl_mvm_power_disable(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
+static int iwl_mvm_power_mac_disable(struct iwl_mvm *mvm,
+                                     struct ieee80211_vif *vif)
 {
-        struct iwl_powertable_cmd cmd = {};
+        struct iwl_mac_power_cmd cmd = {};
         struct iwl_mvm_vif *mvmvif __maybe_unused =
                 iwl_mvm_vif_from_mac80211(vif);
 
         if (vif->type != NL80211_IFTYPE_STATION || vif->p2p)
                 return 0;
 
+        cmd.id_and_color = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
+                                                           mvmvif->color));
+
         if (iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM)
                 cmd.flags |= cpu_to_le16(POWER_FLAGS_POWER_SAVE_ENA_MSK);
 
@@ -310,11 +423,98 @@ int iwl_mvm_power_disable(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 #endif
         iwl_mvm_power_log(mvm, &cmd);
 
-        return iwl_mvm_send_cmd_pdu(mvm, POWER_TABLE_CMD, CMD_ASYNC,
+        return iwl_mvm_send_cmd_pdu(mvm, MAC_PM_POWER_TABLE, CMD_ASYNC,
                                     sizeof(cmd), &cmd);
 }
 
 #ifdef CONFIG_IWLWIFI_DEBUGFS
+static int iwl_mvm_power_mac_dbgfs_read(struct iwl_mvm *mvm,
+                                        struct ieee80211_vif *vif, char *buf,
+                                        int bufsz)
+{
+        struct iwl_mac_power_cmd cmd = {};
+        int pos = 0;
+
+        iwl_mvm_power_build_cmd(mvm, vif, &cmd);
+
+        pos += scnprintf(buf+pos, bufsz-pos, "disable_power_off = %d\n",
+                         (cmd.flags &
+                         cpu_to_le16(POWER_FLAGS_POWER_SAVE_ENA_MSK)) ?
+                         0 : 1);
+        pos += scnprintf(buf+pos, bufsz-pos, "power_scheme = %d\n",
+                         iwlmvm_mod_params.power_scheme);
+        pos += scnprintf(buf+pos, bufsz-pos, "flags = 0x%x\n",
+                         le16_to_cpu(cmd.flags));
+        pos += scnprintf(buf+pos, bufsz-pos, "keep_alive = %d\n",
+                         le16_to_cpu(cmd.keep_alive_seconds));
+
+        if (cmd.flags & cpu_to_le16(POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK)) {
+                pos += scnprintf(buf+pos, bufsz-pos, "skip_over_dtim = %d\n",
+                                 (cmd.flags &
+                                 cpu_to_le16(POWER_FLAGS_SKIP_OVER_DTIM_MSK)) ?
+                                 1 : 0);
+                pos += scnprintf(buf+pos, bufsz-pos, "skip_dtim_periods = %d\n",
+                                 cmd.skip_dtim_periods);
+                if (!(cmd.flags &
+                      cpu_to_le16(POWER_FLAGS_ADVANCE_PM_ENA_MSK))) {
+                        pos += scnprintf(buf+pos, bufsz-pos,
+                                         "rx_data_timeout = %d\n",
+                                         le32_to_cpu(cmd.rx_data_timeout));
+                        pos += scnprintf(buf+pos, bufsz-pos,
+                                         "tx_data_timeout = %d\n",
+                                         le32_to_cpu(cmd.tx_data_timeout));
+                }
+                if (cmd.flags & cpu_to_le16(POWER_FLAGS_LPRX_ENA_MSK))
+                        pos += scnprintf(buf+pos, bufsz-pos,
+                                         "lprx_rssi_threshold = %d\n",
+                                         cmd.lprx_rssi_threshold);
+                if (cmd.flags & cpu_to_le16(POWER_FLAGS_ADVANCE_PM_ENA_MSK)) {
+                        pos +=
+                        scnprintf(buf+pos, bufsz-pos,
+                                  "rx_data_timeout_uapsd = %d\n",
+                                  le32_to_cpu(cmd.rx_data_timeout_uapsd));
+                        pos +=
+                        scnprintf(buf+pos, bufsz-pos,
+                                  "tx_data_timeout_uapsd = %d\n",
+                                  le32_to_cpu(cmd.tx_data_timeout_uapsd));
+                        pos += scnprintf(buf+pos, bufsz-pos, "qndp_tid = %d\n",
+                                         cmd.qndp_tid);
+                        pos += scnprintf(buf+pos, bufsz-pos,
+                                         "uapsd_ac_flags = 0x%x\n",
+                                         cmd.uapsd_ac_flags);
+                        pos += scnprintf(buf+pos, bufsz-pos,
+                                         "uapsd_max_sp = %d\n",
+                                         cmd.uapsd_max_sp);
+                        pos += scnprintf(buf+pos, bufsz-pos,
+                                         "heavy_tx_thld_packets = %d\n",
+                                         cmd.heavy_tx_thld_packets);
+                        pos += scnprintf(buf+pos, bufsz-pos,
+                                         "heavy_rx_thld_packets = %d\n",
+                                         cmd.heavy_rx_thld_packets);
+                        pos += scnprintf(buf+pos, bufsz-pos,
+                                         "heavy_tx_thld_percentage = %d\n",
+                                         cmd.heavy_tx_thld_percentage);
+                        pos += scnprintf(buf+pos, bufsz-pos,
+                                         "heavy_rx_thld_percentage = %d\n",
+                                         cmd.heavy_rx_thld_percentage);
+                        pos +=
+                        scnprintf(buf+pos, bufsz-pos, "snooze_enable = %d\n",
+                                  (cmd.flags &
+                                   cpu_to_le16(POWER_FLAGS_SNOOZE_ENA_MSK)) ?
+                                  1 : 0);
+                }
+                if (cmd.flags & cpu_to_le16(POWER_FLAGS_SNOOZE_ENA_MSK)) {
+                        pos += scnprintf(buf+pos, bufsz-pos,
+                                         "snooze_interval = %d\n",
+                                         cmd.snooze_interval);
+                        pos += scnprintf(buf+pos, bufsz-pos,
+                                         "snooze_window = %d\n",
+                                         cmd.snooze_window);
+                }
+        }
+        return pos;
+}
+
 void
 iwl_mvm_beacon_filter_debugfs_parameters(struct ieee80211_vif *vif,
                                          struct iwl_beacon_filter_cmd *cmd)
@@ -323,22 +523,30 @@ iwl_mvm_beacon_filter_debugfs_parameters(struct ieee80211_vif *vif,
         struct iwl_dbgfs_bf *dbgfs_bf = &mvmvif->dbgfs_bf;
 
         if (dbgfs_bf->mask & MVM_DEBUGFS_BF_ENERGY_DELTA)
-                cmd->bf_energy_delta = dbgfs_bf->bf_energy_delta;
+                cmd->bf_energy_delta = cpu_to_le32(dbgfs_bf->bf_energy_delta);
         if (dbgfs_bf->mask & MVM_DEBUGFS_BF_ROAMING_ENERGY_DELTA)
                 cmd->bf_roaming_energy_delta =
-                                 dbgfs_bf->bf_roaming_energy_delta;
+                                cpu_to_le32(dbgfs_bf->bf_roaming_energy_delta);
         if (dbgfs_bf->mask & MVM_DEBUGFS_BF_ROAMING_STATE)
-                cmd->bf_roaming_state = dbgfs_bf->bf_roaming_state;
-        if (dbgfs_bf->mask & MVM_DEBUGFS_BF_TEMPERATURE_DELTA)
-                cmd->bf_temperature_delta = dbgfs_bf->bf_temperature_delta;
+                cmd->bf_roaming_state = cpu_to_le32(dbgfs_bf->bf_roaming_state);
+        if (dbgfs_bf->mask & MVM_DEBUGFS_BF_TEMP_THRESHOLD)
+                cmd->bf_temp_threshold =
+                                cpu_to_le32(dbgfs_bf->bf_temp_threshold);
+        if (dbgfs_bf->mask & MVM_DEBUGFS_BF_TEMP_FAST_FILTER)
+                cmd->bf_temp_fast_filter =
+                                cpu_to_le32(dbgfs_bf->bf_temp_fast_filter);
+        if (dbgfs_bf->mask & MVM_DEBUGFS_BF_TEMP_SLOW_FILTER)
+                cmd->bf_temp_slow_filter =
+                                cpu_to_le32(dbgfs_bf->bf_temp_slow_filter);
         if (dbgfs_bf->mask & MVM_DEBUGFS_BF_DEBUG_FLAG)
-                cmd->bf_debug_flag = dbgfs_bf->bf_debug_flag;
+                cmd->bf_debug_flag = cpu_to_le32(dbgfs_bf->bf_debug_flag);
         if (dbgfs_bf->mask & MVM_DEBUGFS_BF_ESCAPE_TIMER)
                 cmd->bf_escape_timer = cpu_to_le32(dbgfs_bf->bf_escape_timer);
         if (dbgfs_bf->mask & MVM_DEBUGFS_BA_ESCAPE_TIMER)
                 cmd->ba_escape_timer = cpu_to_le32(dbgfs_bf->ba_escape_timer);
         if (dbgfs_bf->mask & MVM_DEBUGFS_BA_ENABLE_BEACON_ABORT)
-                cmd->ba_enable_beacon_abort = dbgfs_bf->ba_enable_beacon_abort;
+                cmd->ba_enable_beacon_abort =
+                                cpu_to_le32(dbgfs_bf->ba_enable_beacon_abort);
 }
 #endif
 
@@ -348,7 +556,7 @@ int iwl_mvm_enable_beacon_filter(struct iwl_mvm *mvm,
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_beacon_filter_cmd cmd = {
                 IWL_BF_CMD_CONFIG_DEFAULTS,
-                .bf_enable_beacon_filter = 1,
+                .bf_enable_beacon_filter = cpu_to_le32(1),
         };
         int ret;
 
@@ -356,11 +564,12 @@ int iwl_mvm_enable_beacon_filter(struct iwl_mvm *mvm,
             vif->type != NL80211_IFTYPE_STATION || vif->p2p)
                 return 0;
 
+        iwl_mvm_beacon_filter_set_cqm_params(mvm, vif, &cmd);
         iwl_mvm_beacon_filter_debugfs_parameters(vif, &cmd);
         ret = iwl_mvm_beacon_filter_send_cmd(mvm, &cmd);
 
         if (!ret)
-                mvmvif->bf_enabled = true;
+                mvmvif->bf_data.bf_enabled = true;
 
         return ret;
 }
@@ -372,13 +581,33 @@ int iwl_mvm_disable_beacon_filter(struct iwl_mvm *mvm,
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         int ret;
 
-        if (vif->type != NL80211_IFTYPE_STATION || vif->p2p)
+        if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_BF_UPDATED) ||
+            vif->type != NL80211_IFTYPE_STATION || vif->p2p)
                 return 0;
 
         ret = iwl_mvm_beacon_filter_send_cmd(mvm, &cmd);
 
         if (!ret)
-                mvmvif->bf_enabled = false;
+                mvmvif->bf_data.bf_enabled = false;
 
         return ret;
 }
+
+int iwl_mvm_update_beacon_filter(struct iwl_mvm *mvm,
+                                 struct ieee80211_vif *vif)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+
+        if (!mvmvif->bf_data.bf_enabled)
+                return 0;
+
+        return iwl_mvm_enable_beacon_filter(mvm, vif);
+}
+
+const struct iwl_mvm_power_ops pm_mac_ops = {
+        .power_update_mode = iwl_mvm_power_mac_update_mode,
+        .power_disable = iwl_mvm_power_mac_disable,
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        .power_dbgfs_read = iwl_mvm_power_mac_dbgfs_read,
+#endif
+};
diff --git a/drivers/net/wireless/iwlwifi/mvm/power_legacy.c b/drivers/net/wireless/iwlwifi/mvm/power_legacy.c
new file mode 100644
index 000000000000..2ce79bad5845
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/mvm/power_legacy.c
@@ -0,0 +1,319 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called COPYING.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/init.h>
+
+#include <net/mac80211.h>
+
+#include "iwl-debug.h"
+#include "mvm.h"
+#include "iwl-modparams.h"
+#include "fw-api-power.h"
+
+#define POWER_KEEP_ALIVE_PERIOD_SEC    25
+
+static void iwl_mvm_power_log(struct iwl_mvm *mvm,
+                              struct iwl_powertable_cmd *cmd)
+{
+        IWL_DEBUG_POWER(mvm,
+                        "Sending power table command for power level %d, flags = 0x%X\n",
+                        iwlmvm_mod_params.power_scheme,
+                        le16_to_cpu(cmd->flags));
+        IWL_DEBUG_POWER(mvm, "Keep alive = %u sec\n", cmd->keep_alive_seconds);
+
+        if (cmd->flags & cpu_to_le16(POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK)) {
+                IWL_DEBUG_POWER(mvm, "Rx timeout = %u usec\n",
+                                le32_to_cpu(cmd->rx_data_timeout));
+                IWL_DEBUG_POWER(mvm, "Tx timeout = %u usec\n",
+                                le32_to_cpu(cmd->tx_data_timeout));
+                if (cmd->flags & cpu_to_le16(POWER_FLAGS_SKIP_OVER_DTIM_MSK))
+                        IWL_DEBUG_POWER(mvm, "DTIM periods to skip = %u\n",
+                                        le32_to_cpu(cmd->skip_dtim_periods));
+                if (cmd->flags & cpu_to_le16(POWER_FLAGS_LPRX_ENA_MSK))
+                        IWL_DEBUG_POWER(mvm, "LP RX RSSI threshold = %u\n",
+                                        le32_to_cpu(cmd->lprx_rssi_threshold));
+        }
+}
+
+static void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm,
+                                    struct ieee80211_vif *vif,
+                                    struct iwl_powertable_cmd *cmd)
+{
+        struct ieee80211_hw *hw = mvm->hw;
+        struct ieee80211_chanctx_conf *chanctx_conf;
+        struct ieee80211_channel *chan;
+        int dtimper, dtimper_msec;
+        int keep_alive;
+        bool radar_detect = false;
+        struct iwl_mvm_vif *mvmvif __maybe_unused =
+                iwl_mvm_vif_from_mac80211(vif);
+
+        /*
+         * Regardless of power management state the driver must set
+         * keep alive period. FW will use it for sending keep alive NDPs
+         * immediately after association.
+         */
+        cmd->keep_alive_seconds = POWER_KEEP_ALIVE_PERIOD_SEC;
+
+        if (iwlmvm_mod_params.power_scheme == IWL_POWER_SCHEME_CAM)
+                return;
+
+        cmd->flags |= cpu_to_le16(POWER_FLAGS_POWER_SAVE_ENA_MSK);
+        if (!vif->bss_conf.assoc)
+                cmd->flags |= cpu_to_le16(POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK);
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_DISABLE_POWER_OFF &&
+            mvmvif->dbgfs_pm.disable_power_off)
+                cmd->flags &= cpu_to_le16(~POWER_FLAGS_POWER_SAVE_ENA_MSK);
+#endif
+        if (!vif->bss_conf.ps)
+                return;
+
+        cmd->flags |= cpu_to_le16(POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK);
+
+        if (vif->bss_conf.beacon_rate &&
+            (vif->bss_conf.beacon_rate->bitrate == 10 ||
+             vif->bss_conf.beacon_rate->bitrate == 60)) {
+                cmd->flags |= cpu_to_le16(POWER_FLAGS_LPRX_ENA_MSK);
+                cmd->lprx_rssi_threshold =
+                        cpu_to_le32(POWER_LPRX_RSSI_THRESHOLD);
+        }
+
+        dtimper = hw->conf.ps_dtim_period ?: 1;
+
+        /* Check if radar detection is required on current channel */
+        rcu_read_lock();
+        chanctx_conf = rcu_dereference(vif->chanctx_conf);
+        WARN_ON(!chanctx_conf);
+        if (chanctx_conf) {
+                chan = chanctx_conf->def.chan;
+                radar_detect = chan->flags & IEEE80211_CHAN_RADAR;
+        }
+        rcu_read_unlock();
+
+        /* Check skip over DTIM conditions */
+        if (!radar_detect && (dtimper <= 10) &&
+            (iwlmvm_mod_params.power_scheme == IWL_POWER_SCHEME_LP ||
+             mvm->cur_ucode == IWL_UCODE_WOWLAN)) {
+                cmd->flags |= cpu_to_le16(POWER_FLAGS_SKIP_OVER_DTIM_MSK);
+                cmd->skip_dtim_periods = cpu_to_le32(3);
+        }
+
+        /* Check that keep alive period is at least 3 * DTIM */
+        dtimper_msec = dtimper * vif->bss_conf.beacon_int;
+        keep_alive = max_t(int, 3 * dtimper_msec,
+                           MSEC_PER_SEC * cmd->keep_alive_seconds);
+        keep_alive = DIV_ROUND_UP(keep_alive, MSEC_PER_SEC);
+        cmd->keep_alive_seconds = keep_alive;
+
+        if (mvm->cur_ucode != IWL_UCODE_WOWLAN) {
+                cmd->rx_data_timeout = cpu_to_le32(100 * USEC_PER_MSEC);
+                cmd->tx_data_timeout = cpu_to_le32(100 * USEC_PER_MSEC);
+        } else {
+                cmd->rx_data_timeout = cpu_to_le32(10 * USEC_PER_MSEC);
+                cmd->tx_data_timeout = cpu_to_le32(10 * USEC_PER_MSEC);
+        }
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_KEEP_ALIVE)
+                cmd->keep_alive_seconds = mvmvif->dbgfs_pm.keep_alive_seconds;
+        if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_SKIP_OVER_DTIM) {
+                if (mvmvif->dbgfs_pm.skip_over_dtim)
+                        cmd->flags |=
+                                cpu_to_le16(POWER_FLAGS_SKIP_OVER_DTIM_MSK);
+                else
+                        cmd->flags &=
+                                cpu_to_le16(~POWER_FLAGS_SKIP_OVER_DTIM_MSK);
+        }
+        if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_RX_DATA_TIMEOUT)
+                cmd->rx_data_timeout =
+                        cpu_to_le32(mvmvif->dbgfs_pm.rx_data_timeout);
+        if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_TX_DATA_TIMEOUT)
+                cmd->tx_data_timeout =
+                        cpu_to_le32(mvmvif->dbgfs_pm.tx_data_timeout);
+        if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_SKIP_DTIM_PERIODS)
+                cmd->skip_dtim_periods =
+                        cpu_to_le32(mvmvif->dbgfs_pm.skip_dtim_periods);
+        if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_LPRX_ENA) {
+                if (mvmvif->dbgfs_pm.lprx_ena)
+                        cmd->flags |= cpu_to_le16(POWER_FLAGS_LPRX_ENA_MSK);
+                else
+                        cmd->flags &= cpu_to_le16(~POWER_FLAGS_LPRX_ENA_MSK);
+        }
+        if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_LPRX_RSSI_THRESHOLD)
+                cmd->lprx_rssi_threshold =
+                        cpu_to_le32(mvmvif->dbgfs_pm.lprx_rssi_threshold);
+#endif /* CONFIG_IWLWIFI_DEBUGFS */
+}
+
+static int iwl_mvm_power_legacy_update_mode(struct iwl_mvm *mvm,
+                                            struct ieee80211_vif *vif)
+{
+        int ret;
+        bool ba_enable;
+        struct iwl_powertable_cmd cmd = {};
+
+        if (vif->type != NL80211_IFTYPE_STATION || vif->p2p)
+                return 0;
+
+        /*
+         * TODO: The following vif_count verification is temporary condition.
+         * Avoid power mode update if more than one interface is currently
+         * active. Remove this condition when FW will support power management
+         * on multiple MACs.
+         */
+        IWL_DEBUG_POWER(mvm, "Currently %d interfaces active\n",
+                        mvm->vif_count);
+        if (mvm->vif_count > 1)
+                return 0;
+
+        iwl_mvm_power_build_cmd(mvm, vif, &cmd);
+        iwl_mvm_power_log(mvm, &cmd);
+
+        ret = iwl_mvm_send_cmd_pdu(mvm, POWER_TABLE_CMD, CMD_SYNC,
+                                   sizeof(cmd), &cmd);
+        if (ret)
+                return ret;
+
+        ba_enable = !!(cmd.flags &
+                       cpu_to_le16(POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK));
+
+        return iwl_mvm_update_beacon_abort(mvm, vif, ba_enable);
+}
+
+static int iwl_mvm_power_legacy_disable(struct iwl_mvm *mvm,
+                                        struct ieee80211_vif *vif)
+{
+        struct iwl_powertable_cmd cmd = {};
+        struct iwl_mvm_vif *mvmvif __maybe_unused =
+                iwl_mvm_vif_from_mac80211(vif);
+
+        if (vif->type != NL80211_IFTYPE_STATION || vif->p2p)
+                return 0;
+
+        if (iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM)
+                cmd.flags |= cpu_to_le16(POWER_FLAGS_POWER_SAVE_ENA_MSK);
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_DISABLE_POWER_OFF &&
+            mvmvif->dbgfs_pm.disable_power_off)
+                cmd.flags &= cpu_to_le16(~POWER_FLAGS_POWER_SAVE_ENA_MSK);
+#endif
+        iwl_mvm_power_log(mvm, &cmd);
+
+        return iwl_mvm_send_cmd_pdu(mvm, POWER_TABLE_CMD, CMD_ASYNC,
+                                    sizeof(cmd), &cmd);
+}
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+static int iwl_mvm_power_legacy_dbgfs_read(struct iwl_mvm *mvm,
+                                           struct ieee80211_vif *vif, char *buf,
+                                           int bufsz)
+{
+        struct iwl_powertable_cmd cmd = {};
+        int pos = 0;
+
+        iwl_mvm_power_build_cmd(mvm, vif, &cmd);
+
+        pos += scnprintf(buf+pos, bufsz-pos, "disable_power_off = %d\n",
+                         (cmd.flags &
+                         cpu_to_le16(POWER_FLAGS_POWER_SAVE_ENA_MSK)) ?
+                         0 : 1);
+        pos += scnprintf(buf+pos, bufsz-pos, "skip_dtim_periods = %d\n",
+                         le32_to_cpu(cmd.skip_dtim_periods));
+        pos += scnprintf(buf+pos, bufsz-pos, "power_scheme = %d\n",
+                         iwlmvm_mod_params.power_scheme);
+        pos += scnprintf(buf+pos, bufsz-pos, "flags = 0x%x\n",
+                         le16_to_cpu(cmd.flags));
+        pos += scnprintf(buf+pos, bufsz-pos, "keep_alive = %d\n",
+                         cmd.keep_alive_seconds);
+
+        if (cmd.flags & cpu_to_le16(POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK)) {
+                pos += scnprintf(buf+pos, bufsz-pos, "skip_over_dtim = %d\n",
+                                 (cmd.flags &
+                                 cpu_to_le16(POWER_FLAGS_SKIP_OVER_DTIM_MSK)) ?
+                                 1 : 0);
+                pos += scnprintf(buf+pos, bufsz-pos, "rx_data_timeout = %d\n",
+                                 le32_to_cpu(cmd.rx_data_timeout));
+                pos += scnprintf(buf+pos, bufsz-pos, "tx_data_timeout = %d\n",
+                                 le32_to_cpu(cmd.tx_data_timeout));
+                if (cmd.flags & cpu_to_le16(POWER_FLAGS_LPRX_ENA_MSK))
+                        pos += scnprintf(buf+pos, bufsz-pos,
+                                         "lprx_rssi_threshold = %d\n",
+                                         le32_to_cpu(cmd.lprx_rssi_threshold));
+        }
+        return pos;
+}
+#endif
+
+const struct iwl_mvm_power_ops pm_legacy_ops = {
+        .power_update_mode = iwl_mvm_power_legacy_update_mode,
+        .power_disable = iwl_mvm_power_legacy_disable,
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        .power_dbgfs_read = iwl_mvm_power_legacy_dbgfs_read,
+#endif
+};
diff --git a/drivers/net/wireless/iwlwifi/mvm/quota.c b/drivers/net/wireless/iwlwifi/mvm/quota.c
index 29d49cf0fdb2..5c6ae16ec52b 100644
--- a/drivers/net/wireless/iwlwifi/mvm/quota.c
+++ b/drivers/net/wireless/iwlwifi/mvm/quota.c
@@ -131,23 +131,22 @@ static void iwl_mvm_quota_iterator(void *_data, u8 *mac,
 
 int iwl_mvm_update_quotas(struct iwl_mvm *mvm, struct ieee80211_vif *newvif)
 {
-        struct iwl_time_quota_cmd cmd;
-        int i, idx, ret, num_active_bindings, quota, quota_rem;
+        struct iwl_time_quota_cmd cmd = {};
+        int i, idx, ret, num_active_macs, quota, quota_rem;
         struct iwl_mvm_quota_iterator_data data = {
                 .n_interfaces = {},
                 .colors = { -1, -1, -1, -1 },
                 .new_vif = newvif,
         };
 
+        lockdep_assert_held(&mvm->mutex);
+
         /* update all upon completion */
         if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
                 return 0;
 
-        BUILD_BUG_ON(data.colors[MAX_BINDINGS - 1] != -1);
-
-        lockdep_assert_held(&mvm->mutex);
-
-        memset(&cmd, 0, sizeof(cmd));
+        /* iterator data above must match */
+        BUILD_BUG_ON(MAX_BINDINGS != 4);
 
         ieee80211_iterate_active_interfaces_atomic(
                 mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
@@ -162,18 +161,17 @@ int iwl_mvm_update_quotas(struct iwl_mvm *mvm, struct ieee80211_vif *newvif)
          * IWL_MVM_MAX_QUOTA fragments. Divide these fragments
          * equally between all the bindings that require quota
          */
-        num_active_bindings = 0;
+        num_active_macs = 0;
         for (i = 0; i < MAX_BINDINGS; i++) {
                 cmd.quotas[i].id_and_color = cpu_to_le32(FW_CTXT_INVALID);
-                if (data.n_interfaces[i] > 0)
-                        num_active_bindings++;
+                num_active_macs += data.n_interfaces[i];
         }
 
         quota = 0;
         quota_rem = 0;
-        if (num_active_bindings) {
-                quota = IWL_MVM_MAX_QUOTA / num_active_bindings;
-                quota_rem = IWL_MVM_MAX_QUOTA % num_active_bindings;
+        if (num_active_macs) {
+                quota = IWL_MVM_MAX_QUOTA / num_active_macs;
+                quota_rem = IWL_MVM_MAX_QUOTA % num_active_macs;
         }
 
         for (idx = 0, i = 0; i < MAX_BINDINGS; i++) {
@@ -187,7 +185,8 @@ int iwl_mvm_update_quotas(struct iwl_mvm *mvm, struct ieee80211_vif *newvif)
                         cmd.quotas[idx].quota = cpu_to_le32(0);
                         cmd.quotas[idx].max_duration = cpu_to_le32(0);
                 } else {
-                        cmd.quotas[idx].quota = cpu_to_le32(quota);
+                        cmd.quotas[idx].quota =
+                                cpu_to_le32(quota * data.n_interfaces[i]);
                         cmd.quotas[idx].max_duration =
                                 cpu_to_le32(IWL_MVM_MAX_QUOTA);
                 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c
index b328a988c130..4ffaa3fa153f 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
@@ -56,61 +56,61 @@
 #define IWL_RATE_SCALE_FLUSH_INTVL   (3*HZ)
 
 static u8 rs_ht_to_legacy[] = {
-        IWL_RATE_6M_INDEX, IWL_RATE_6M_INDEX,
-        IWL_RATE_6M_INDEX, IWL_RATE_6M_INDEX,
-        IWL_RATE_6M_INDEX,
-        IWL_RATE_6M_INDEX, IWL_RATE_9M_INDEX,
-        IWL_RATE_12M_INDEX, IWL_RATE_18M_INDEX,
-        IWL_RATE_24M_INDEX, IWL_RATE_36M_INDEX,
-        IWL_RATE_48M_INDEX, IWL_RATE_54M_INDEX
+        [IWL_RATE_1M_INDEX] = IWL_RATE_6M_INDEX,
+        [IWL_RATE_2M_INDEX] = IWL_RATE_6M_INDEX,
+        [IWL_RATE_5M_INDEX] = IWL_RATE_6M_INDEX,
+        [IWL_RATE_11M_INDEX] = IWL_RATE_6M_INDEX,
+        [IWL_RATE_6M_INDEX] = IWL_RATE_6M_INDEX,
+        [IWL_RATE_9M_INDEX] = IWL_RATE_6M_INDEX,
+        [IWL_RATE_12M_INDEX] = IWL_RATE_9M_INDEX,
+        [IWL_RATE_18M_INDEX] = IWL_RATE_12M_INDEX,
+        [IWL_RATE_24M_INDEX] = IWL_RATE_18M_INDEX,
+        [IWL_RATE_36M_INDEX] = IWL_RATE_24M_INDEX,
+        [IWL_RATE_48M_INDEX] = IWL_RATE_36M_INDEX,
+        [IWL_RATE_54M_INDEX] = IWL_RATE_48M_INDEX,
+        [IWL_RATE_60M_INDEX] = IWL_RATE_54M_INDEX,
 };
 
 static const u8 ant_toggle_lookup[] = {
-        /*ANT_NONE -> */ ANT_NONE,
-        /*ANT_A    -> */ ANT_B,
-        /*ANT_B    -> */ ANT_C,
-        /*ANT_AB   -> */ ANT_BC,
-        /*ANT_C    -> */ ANT_A,
-        /*ANT_AC   -> */ ANT_AB,
-        /*ANT_BC   -> */ ANT_AC,
-        /*ANT_ABC  -> */ ANT_ABC,
+        [ANT_NONE] = ANT_NONE,
+        [ANT_A] = ANT_B,
+        [ANT_B] = ANT_C,
+        [ANT_AB] = ANT_BC,
+        [ANT_C] = ANT_A,
+        [ANT_AC] = ANT_AB,
+        [ANT_BC] = ANT_AC,
+        [ANT_ABC] = ANT_ABC,
 };
 
-#define IWL_DECLARE_RATE_INFO(r, s, ip, in, rp, rn, pp, np)    \
+#define IWL_DECLARE_RATE_INFO(r, s, rp, rn)                    \
         [IWL_RATE_##r##M_INDEX] = { IWL_RATE_##r##M_PLCP,      \
                                     IWL_RATE_SISO_##s##M_PLCP, \
                                     IWL_RATE_MIMO2_##s##M_PLCP,\
-                                    IWL_RATE_MIMO3_##s##M_PLCP,\
-                                    IWL_RATE_##r##M_IEEE,      \
-                                    IWL_RATE_##ip##M_INDEX,    \
-                                    IWL_RATE_##in##M_INDEX,    \
                                     IWL_RATE_##rp##M_INDEX,    \
-                                    IWL_RATE_##rn##M_INDEX,    \
-                                    IWL_RATE_##pp##M_INDEX,    \
-                                    IWL_RATE_##np##M_INDEX }
+                                    IWL_RATE_##rn##M_INDEX }
 
 /*
  * Parameter order:
- *   rate, ht rate, prev rate, next rate, prev tgg rate, next tgg rate
+ *   rate, ht rate, prev rate, next rate
  *
  * If there isn't a valid next or previous rate then INV is used which
  * maps to IWL_RATE_INVALID
  *
  */
 static const struct iwl_rs_rate_info iwl_rates[IWL_RATE_COUNT] = {
-        IWL_DECLARE_RATE_INFO(1, INV, INV, 2, INV, 2, INV, 2),    /*  1mbps */
-        IWL_DECLARE_RATE_INFO(2, INV, 1, 5, 1, 5, 1, 5),          /*  2mbps */
-        IWL_DECLARE_RATE_INFO(5, INV, 2, 6, 2, 11, 2, 11),        /*5.5mbps */
-        IWL_DECLARE_RATE_INFO(11, INV, 9, 12, 9, 12, 5, 18),      /* 11mbps */
-        IWL_DECLARE_RATE_INFO(6, 6, 5, 9, 5, 11, 5, 11),        /*  6mbps */
-        IWL_DECLARE_RATE_INFO(9, 6, 6, 11, 6, 11, 5, 11),       /*  9mbps */
-        IWL_DECLARE_RATE_INFO(12, 12, 11, 18, 11, 18, 11, 18),   /* 12mbps */
-        IWL_DECLARE_RATE_INFO(18, 18, 12, 24, 12, 24, 11, 24),   /* 18mbps */
-        IWL_DECLARE_RATE_INFO(24, 24, 18, 36, 18, 36, 18, 36),   /* 24mbps */
-        IWL_DECLARE_RATE_INFO(36, 36, 24, 48, 24, 48, 24, 48),   /* 36mbps */
-        IWL_DECLARE_RATE_INFO(48, 48, 36, 54, 36, 54, 36, 54),   /* 48mbps */
-        IWL_DECLARE_RATE_INFO(54, 54, 48, INV, 48, INV, 48, INV),/* 54mbps */
-        IWL_DECLARE_RATE_INFO(60, 60, 48, INV, 48, INV, 48, INV),/* 60mbps */
+        IWL_DECLARE_RATE_INFO(1, INV, INV, 2),   /*  1mbps */
+        IWL_DECLARE_RATE_INFO(2, INV, 1, 5),     /*  2mbps */
+        IWL_DECLARE_RATE_INFO(5, INV, 2, 11),    /*5.5mbps */
+        IWL_DECLARE_RATE_INFO(11, INV, 9, 12),   /* 11mbps */
+        IWL_DECLARE_RATE_INFO(6, 6, 5, 11),      /*  6mbps */
+        IWL_DECLARE_RATE_INFO(9, 6, 6, 11),      /*  9mbps */
+        IWL_DECLARE_RATE_INFO(12, 12, 11, 18),   /* 12mbps */
+        IWL_DECLARE_RATE_INFO(18, 18, 12, 24),   /* 18mbps */
+        IWL_DECLARE_RATE_INFO(24, 24, 18, 36),   /* 24mbps */
+        IWL_DECLARE_RATE_INFO(36, 36, 24, 48),   /* 36mbps */
+        IWL_DECLARE_RATE_INFO(48, 48, 36, 54),   /* 48mbps */
+        IWL_DECLARE_RATE_INFO(54, 54, 48, INV),  /* 54mbps */
+        IWL_DECLARE_RATE_INFO(60, 60, 48, INV),  /* 60mbps */
         /* FIXME:RS:          ^^    should be INV (legacy) */
 };
 
@@ -128,9 +128,8 @@ static int iwl_hwrate_to_plcp_idx(u32 rate_n_flags)
         if (rate_n_flags & RATE_MCS_HT_MSK) {
                 idx = rs_extract_rate(rate_n_flags);
 
-                if (idx >= IWL_RATE_MIMO3_6M_PLCP)
-                        idx = idx - IWL_RATE_MIMO3_6M_PLCP;
-                else if (idx >= IWL_RATE_MIMO2_6M_PLCP)
+                WARN_ON_ONCE(idx >= IWL_RATE_MIMO3_6M_PLCP);
+                if (idx >= IWL_RATE_MIMO2_6M_PLCP)
                         idx = idx - IWL_RATE_MIMO2_6M_PLCP;
 
                 idx += IWL_FIRST_OFDM_RATE;
@@ -162,10 +161,10 @@ static void rs_stay_in_table(struct iwl_lq_sta *lq_sta, bool force_search);
 
 #ifdef CONFIG_MAC80211_DEBUGFS
 static void rs_dbgfs_set_mcs(struct iwl_lq_sta *lq_sta,
-                             u32 *rate_n_flags, int index);
+                             u32 *rate_n_flags);
 #else
 static void rs_dbgfs_set_mcs(struct iwl_lq_sta *lq_sta,
-                             u32 *rate_n_flags, int index)
+                             u32 *rate_n_flags)
 {}
 #endif
 
@@ -212,20 +211,6 @@ static s32 expected_tpt_mimo2_40MHz[4][IWL_RATE_COUNT] = {
         {0, 0, 0, 0, 186, 0, 329, 439, 527, 667, 764, 803, 838}, /* AGG+SGI */
 };
 
-static s32 expected_tpt_mimo3_20MHz[4][IWL_RATE_COUNT] = {
-        {0, 0, 0, 0,  99, 0, 153, 186, 208, 239, 256, 263, 268}, /* Norm */
-        {0, 0, 0, 0, 106, 0, 162, 194, 215, 246, 262, 268, 273}, /* SGI */
-        {0, 0, 0, 0, 134, 0, 249, 346, 431, 574, 685, 732, 775}, /* AGG */
-        {0, 0, 0, 0, 148, 0, 272, 376, 465, 614, 727, 775, 818}, /* AGG+SGI */
-};
-
-static s32 expected_tpt_mimo3_40MHz[4][IWL_RATE_COUNT] = {
-        {0, 0, 0, 0, 152, 0, 211, 239, 255, 279,  290,  294,  297}, /* Norm */
-        {0, 0, 0, 0, 160, 0, 219, 245, 261, 284,  294,  297,  300}, /* SGI */
-        {0, 0, 0, 0, 254, 0, 443, 584, 695, 868,  984, 1030, 1070}, /* AGG */
-        {0, 0, 0, 0, 277, 0, 478, 624, 737, 911, 1026, 1070, 1109}, /* AGG+SGI */
-};
-
 /* mbps, mcs */
 static const struct iwl_rate_mcs_info iwl_rate_mcs[IWL_RATE_COUNT] = {
         {  "1", "BPSK DSSS"},
@@ -260,82 +245,6 @@ static inline u8 rs_is_valid_ant(u8 valid_antenna, u8 ant_type)
         return (ant_type & valid_antenna) == ant_type;
 }
 
-/*
- *      removes the old data from the statistics. All data that is older than
- *      TID_MAX_TIME_DIFF, will be deleted.
- */
-static void rs_tl_rm_old_stats(struct iwl_traffic_load *tl, u32 curr_time)
-{
-        /* The oldest age we want to keep */
-        u32 oldest_time = curr_time - TID_MAX_TIME_DIFF;
-
-        while (tl->queue_count &&
-               (tl->time_stamp < oldest_time)) {
-                tl->total -= tl->packet_count[tl->head];
-                tl->packet_count[tl->head] = 0;
-                tl->time_stamp += TID_QUEUE_CELL_SPACING;
-                tl->queue_count--;
-                tl->head++;
-                if (tl->head >= TID_QUEUE_MAX_SIZE)
-                        tl->head = 0;
-        }
-}
-
-/*
- *      increment traffic load value for tid and also remove
- *      any old values if passed the certain time period
- */
-static u8 rs_tl_add_packet(struct iwl_lq_sta *lq_data,
-                           struct ieee80211_hdr *hdr)
-{
-        u32 curr_time = jiffies_to_msecs(jiffies);
-        u32 time_diff;
-        s32 index;
-        struct iwl_traffic_load *tl = NULL;
-        u8 tid;
-
-        if (ieee80211_is_data_qos(hdr->frame_control)) {
-                u8 *qc = ieee80211_get_qos_ctl(hdr);
-                tid = qc[0] & 0xf;
-        } else {
-                return IWL_MAX_TID_COUNT;
-        }
-
-        if (unlikely(tid >= IWL_MAX_TID_COUNT))
-                return IWL_MAX_TID_COUNT;
-
-        tl = &lq_data->load[tid];
-
-        curr_time -= curr_time % TID_ROUND_VALUE;
-
-        /* Happens only for the first packet. Initialize the data */
-        if (!(tl->queue_count)) {
-                tl->total = 1;
-                tl->time_stamp = curr_time;
-                tl->queue_count = 1;
-                tl->head = 0;
-                tl->packet_count[0] = 1;
-                return IWL_MAX_TID_COUNT;
-        }
-
-        time_diff = TIME_WRAP_AROUND(tl->time_stamp, curr_time);
-        index = time_diff / TID_QUEUE_CELL_SPACING;
-
-        /* The history is too long: remove data that is older than */
-        /* TID_MAX_TIME_DIFF */
-        if (index >= TID_QUEUE_MAX_SIZE)
-                rs_tl_rm_old_stats(tl, curr_time);
-
-        index = (tl->head + index) % TID_QUEUE_MAX_SIZE;
-        tl->packet_count[index] = tl->packet_count[index] + 1;
-        tl->total = tl->total + 1;
-
-        if ((index + 1) > tl->queue_count)
-                tl->queue_count = index + 1;
-
-        return tid;
-}
-
 #ifdef CONFIG_MAC80211_DEBUGFS
 /**
  * Program the device to use fixed rate for frame transmit
@@ -349,7 +258,6 @@ static void rs_program_fix_rate(struct iwl_mvm *mvm,
         lq_sta->active_legacy_rate = 0x0FFF;    /* 1 - 54 MBits, includes CCK */
         lq_sta->active_siso_rate   = 0x1FD0;    /* 6 - 60 MBits, no 9, no CCK */
         lq_sta->active_mimo2_rate  = 0x1FD0;    /* 6 - 60 MBits, no 9, no CCK */
-        lq_sta->active_mimo3_rate  = 0x1FD0;    /* 6 - 60 MBits, no 9, no CCK */
 
         IWL_DEBUG_RATE(mvm, "sta_id %d rate 0x%X\n",
                        lq_sta->lq.sta_id, lq_sta->dbg_fixed_rate);
@@ -361,45 +269,11 @@ static void rs_program_fix_rate(struct iwl_mvm *mvm,
 }
 #endif
 
-/*
-        get the traffic load value for tid
-*/
-static u32 rs_tl_get_load(struct iwl_lq_sta *lq_data, u8 tid)
-{
-        u32 curr_time = jiffies_to_msecs(jiffies);
-        u32 time_diff;
-        s32 index;
-        struct iwl_traffic_load *tl = NULL;
-
-        if (tid >= IWL_MAX_TID_COUNT)
-                return 0;
-
-        tl = &(lq_data->load[tid]);
-
-        curr_time -= curr_time % TID_ROUND_VALUE;
-
-        if (!(tl->queue_count))
-                return 0;
-
-        time_diff = TIME_WRAP_AROUND(tl->time_stamp, curr_time);
-        index = time_diff / TID_QUEUE_CELL_SPACING;
-
-        /* The history is too long: remove data that is older than */
-        /* TID_MAX_TIME_DIFF */
-        if (index >= TID_QUEUE_MAX_SIZE)
-                rs_tl_rm_old_stats(tl, curr_time);
-
-        return tl->total;
-}
-
 static int rs_tl_turn_on_agg_for_tid(struct iwl_mvm *mvm,
                                       struct iwl_lq_sta *lq_data, u8 tid,
                                       struct ieee80211_sta *sta)
 {
         int ret = -EAGAIN;
-        u32 load;
-
-        load = rs_tl_get_load(lq_data, tid);
 
         /*
          * Don't create TX aggregation sessions when in high
@@ -563,7 +437,7 @@ static u32 rate_n_flags_from_tbl(struct iwl_mvm *mvm,
                 else if (is_mimo2(tbl->lq_type))
                         rate_n_flags |= iwl_rates[index].plcp_mimo2;
                 else
-                        rate_n_flags |= iwl_rates[index].plcp_mimo3;
+                        WARN_ON_ONCE(1);
         } else {
                 IWL_ERR(mvm, "Invalid tbl->lq_type %d\n", tbl->lq_type);
         }
@@ -601,7 +475,7 @@ static int rs_get_tbl_info_from_mcs(const u32 rate_n_flags,
         u8 num_of_ant = get_num_of_ant_from_rate(rate_n_flags);
         u8 mcs;
 
-        memset(tbl, 0, sizeof(struct iwl_scale_tbl_info));
+        memset(tbl, 0, offsetof(struct iwl_scale_tbl_info, win));
         *rate_idx = iwl_hwrate_to_plcp_idx(rate_n_flags);
 
         if (*rate_idx  == IWL_RATE_INVALID) {
@@ -640,12 +514,8 @@ static int rs_get_tbl_info_from_mcs(const u32 rate_n_flags,
                 } else if (mcs <= IWL_RATE_MIMO2_60M_PLCP) {
                         if (num_of_ant == 2)
                                 tbl->lq_type = LQ_MIMO2;
-                /* MIMO3 */
                 } else {
-                        if (num_of_ant == 3) {
-                                tbl->max_search = IWL_MAX_11N_MIMO3_SEARCH;
-                                tbl->lq_type = LQ_MIMO3;
-                        }
+                        WARN_ON_ONCE(num_of_ant == 3);
                 }
         }
         return 0;
@@ -711,10 +581,10 @@ static u16 rs_get_supported_rates(struct iwl_lq_sta *lq_sta,
         } else {
                 if (is_siso(rate_type))
                         return lq_sta->active_siso_rate;
-                else if (is_mimo2(rate_type))
+                else {
+                        WARN_ON_ONCE(!is_mimo2(rate_type));
                         return lq_sta->active_mimo2_rate;
-                else
-                        return lq_sta->active_mimo3_rate;
+                }
         }
 }
 
@@ -1089,7 +959,7 @@ static void rs_set_expected_tpt_table(struct iwl_lq_sta *lq_sta,
         }
 
         /* Choose among many HT tables depending on number of streams
-         * (SISO/MIMO2/MIMO3), channel width (20/40), SGI, and aggregation
+         * (SISO/MIMO2), channel width (20/40), SGI, and aggregation
          * status */
         if (is_siso(tbl->lq_type) && !tbl->is_ht40)
                 ht_tbl_pointer = expected_tpt_siso20MHz;
@@ -1097,12 +967,10 @@ static void rs_set_expected_tpt_table(struct iwl_lq_sta *lq_sta,
                 ht_tbl_pointer = expected_tpt_siso40MHz;
         else if (is_mimo2(tbl->lq_type) && !tbl->is_ht40)
                 ht_tbl_pointer = expected_tpt_mimo2_20MHz;
-        else if (is_mimo2(tbl->lq_type))
+        else {
+                WARN_ON_ONCE(!is_mimo2(tbl->lq_type));
                 ht_tbl_pointer = expected_tpt_mimo2_40MHz;
-        else if (is_mimo3(tbl->lq_type) && !tbl->is_ht40)
-                ht_tbl_pointer = expected_tpt_mimo3_20MHz;
-        else /* if (is_mimo3(tbl->lq_type)) <-- must be true */
-                ht_tbl_pointer = expected_tpt_mimo3_40MHz;
+        }
 
         if (!tbl->is_SGI && !lq_sta->is_agg)            /* Normal */
                 tbl->expected_tpt = ht_tbl_pointer[0];
@@ -1274,58 +1142,6 @@ static int rs_switch_to_mimo2(struct iwl_mvm *mvm,
 }
 
 /*
- * Set up search table for MIMO3
- */
-static int rs_switch_to_mimo3(struct iwl_mvm *mvm,
-                             struct iwl_lq_sta *lq_sta,
-                             struct ieee80211_sta *sta,
-                             struct iwl_scale_tbl_info *tbl, int index)
-{
-        u16 rate_mask;
-        s32 rate;
-        s8 is_green = lq_sta->is_green;
-
-        if (!sta->ht_cap.ht_supported)
-                return -1;
-
-        if (sta->smps_mode == IEEE80211_SMPS_STATIC)
-                return -1;
-
-        /* Need both Tx chains/antennas to support MIMO */
-        if (num_of_ant(iwl_fw_valid_tx_ant(mvm->fw)) < 3)
-                return -1;
-
-        IWL_DEBUG_RATE(mvm, "LQ: try to switch to MIMO3\n");
-
-        tbl->lq_type = LQ_MIMO3;
-        tbl->action = 0;
-        tbl->max_search = IWL_MAX_11N_MIMO3_SEARCH;
-        rate_mask = lq_sta->active_mimo3_rate;
-
-        if (iwl_is_ht40_tx_allowed(sta))
-                tbl->is_ht40 = 1;
-        else
-                tbl->is_ht40 = 0;
-
-        rs_set_expected_tpt_table(lq_sta, tbl);
-
-        rate = rs_get_best_rate(mvm, lq_sta, tbl, rate_mask, index);
-
-        IWL_DEBUG_RATE(mvm, "LQ: MIMO3 best rate %d mask %X\n",
-                       rate, rate_mask);
-        if ((rate == IWL_RATE_INVALID) || !((1 << rate) & rate_mask)) {
-                IWL_DEBUG_RATE(mvm, "Can't switch with index %d rate mask %x\n",
-                               rate, rate_mask);
-                return -1;
-        }
-        tbl->current_rate = rate_n_flags_from_tbl(mvm, tbl, rate, is_green);
-
-        IWL_DEBUG_RATE(mvm, "LQ: Switch to new mcs %X index is green %X\n",
-                       tbl->current_rate, is_green);
-        return 0;
-}
-
-/*
  * Set up search table for SISO
  */
 static int rs_switch_to_siso(struct iwl_mvm *mvm,
@@ -1434,21 +1250,14 @@ static int rs_move_legacy_other(struct iwl_mvm *mvm,
                         }
 
                         break;
-                case IWL_LEGACY_SWITCH_MIMO2_AB:
-                case IWL_LEGACY_SWITCH_MIMO2_AC:
-                case IWL_LEGACY_SWITCH_MIMO2_BC:
+                case IWL_LEGACY_SWITCH_MIMO2:
                         IWL_DEBUG_RATE(mvm, "LQ: Legacy switch to MIMO2\n");
 
                         /* Set up search table to try MIMO */
                         memcpy(search_tbl, tbl, sz);
                         search_tbl->is_SGI = 0;
 
-                        if (tbl->action == IWL_LEGACY_SWITCH_MIMO2_AB)
-                                search_tbl->ant_type = ANT_AB;
-                        else if (tbl->action == IWL_LEGACY_SWITCH_MIMO2_AC)
-                                search_tbl->ant_type = ANT_AC;
-                        else
-                                search_tbl->ant_type = ANT_BC;
+                        search_tbl->ant_type = ANT_AB;
 
                         if (!rs_is_valid_ant(valid_tx_ant,
                                              search_tbl->ant_type))
@@ -1461,30 +1270,11 @@ static int rs_move_legacy_other(struct iwl_mvm *mvm,
                                 goto out;
                         }
                         break;
-
-                case IWL_LEGACY_SWITCH_MIMO3_ABC:
-                        IWL_DEBUG_RATE(mvm, "LQ: Legacy switch to MIMO3\n");
-
-                        /* Set up search table to try MIMO3 */
-                        memcpy(search_tbl, tbl, sz);
-                        search_tbl->is_SGI = 0;
-
-                        search_tbl->ant_type = ANT_ABC;
-
-                        if (!rs_is_valid_ant(valid_tx_ant,
-                                             search_tbl->ant_type))
-                                break;
-
-                        ret = rs_switch_to_mimo3(mvm, lq_sta, sta,
-                                                 search_tbl, index);
-                        if (!ret) {
-                                lq_sta->action_counter = 0;
-                                goto out;
-                        }
-                        break;
+                default:
+                        WARN_ON_ONCE(1);
                 }
                 tbl->action++;
-                if (tbl->action > IWL_LEGACY_SWITCH_MIMO3_ABC)
+                if (tbl->action > IWL_LEGACY_SWITCH_MIMO2)
                         tbl->action = IWL_LEGACY_SWITCH_ANTENNA1;
 
                 if (tbl->action == start_action)
@@ -1496,7 +1286,7 @@ static int rs_move_legacy_other(struct iwl_mvm *mvm,
 out:
         lq_sta->search_better_tbl = 1;
         tbl->action++;
-        if (tbl->action > IWL_LEGACY_SWITCH_MIMO3_ABC)
+        if (tbl->action > IWL_LEGACY_SWITCH_MIMO2)
                 tbl->action = IWL_LEGACY_SWITCH_ANTENNA1;
         if (update_search_tbl_counter)
                 search_tbl->action = tbl->action;
@@ -1531,7 +1321,7 @@ static int rs_move_siso_to_other(struct iwl_mvm *mvm,
         case IWL_BT_COEX_TRAFFIC_LOAD_LOW:
                 /* avoid antenna B unless MIMO */
                 if (tbl->action == IWL_SISO_SWITCH_ANTENNA2)
-                        tbl->action = IWL_SISO_SWITCH_MIMO2_AB;
+                        tbl->action = IWL_SISO_SWITCH_MIMO2;
                 break;
         case IWL_BT_COEX_TRAFFIC_LOAD_HIGH:
         case IWL_BT_COEX_TRAFFIC_LOAD_CONTINUOUS:
@@ -1573,19 +1363,12 @@ static int rs_move_siso_to_other(struct iwl_mvm *mvm,
                                 goto out;
                         }
                         break;
-                case IWL_SISO_SWITCH_MIMO2_AB:
-                case IWL_SISO_SWITCH_MIMO2_AC:
-                case IWL_SISO_SWITCH_MIMO2_BC:
+                case IWL_SISO_SWITCH_MIMO2:
                         IWL_DEBUG_RATE(mvm, "LQ: SISO switch to MIMO2\n");
                         memcpy(search_tbl, tbl, sz);
                         search_tbl->is_SGI = 0;
 
-                        if (tbl->action == IWL_SISO_SWITCH_MIMO2_AB)
-                                search_tbl->ant_type = ANT_AB;
-                        else if (tbl->action == IWL_SISO_SWITCH_MIMO2_AC)
-                                search_tbl->ant_type = ANT_AC;
-                        else
-                                search_tbl->ant_type = ANT_BC;
+                        search_tbl->ant_type = ANT_AB;
 
                         if (!rs_is_valid_ant(valid_tx_ant,
                                              search_tbl->ant_type))
@@ -1626,24 +1409,11 @@ static int rs_move_siso_to_other(struct iwl_mvm *mvm,
                                                       index, is_green);
                         update_search_tbl_counter = 1;
                         goto out;
-                case IWL_SISO_SWITCH_MIMO3_ABC:
-                        IWL_DEBUG_RATE(mvm, "LQ: SISO switch to MIMO3\n");
-                        memcpy(search_tbl, tbl, sz);
-                        search_tbl->is_SGI = 0;
-                        search_tbl->ant_type = ANT_ABC;
-
-                        if (!rs_is_valid_ant(valid_tx_ant,
-                                             search_tbl->ant_type))
-                                break;
-
-                        ret = rs_switch_to_mimo3(mvm, lq_sta, sta,
-                                                 search_tbl, index);
-                        if (!ret)
-                                goto out;
-                        break;
+                default:
+                        WARN_ON_ONCE(1);
                 }
                 tbl->action++;
-                if (tbl->action > IWL_LEGACY_SWITCH_MIMO3_ABC)
+                if (tbl->action > IWL_SISO_SWITCH_GI)
                         tbl->action = IWL_SISO_SWITCH_ANTENNA1;
 
                 if (tbl->action == start_action)
@@ -1655,7 +1425,7 @@ static int rs_move_siso_to_other(struct iwl_mvm *mvm,
  out:
         lq_sta->search_better_tbl = 1;
         tbl->action++;
-        if (tbl->action > IWL_SISO_SWITCH_MIMO3_ABC)
+        if (tbl->action > IWL_SISO_SWITCH_GI)
                 tbl->action = IWL_SISO_SWITCH_ANTENNA1;
         if (update_search_tbl_counter)
                 search_tbl->action = tbl->action;
@@ -1696,8 +1466,7 @@ static int rs_move_mimo2_to_other(struct iwl_mvm *mvm,
                 break;
         case IWL_BT_COEX_TRAFFIC_LOAD_LOW:
                 /* avoid antenna B unless MIMO */
-                if (tbl->action == IWL_MIMO2_SWITCH_SISO_B ||
-                    tbl->action == IWL_MIMO2_SWITCH_SISO_C)
+                if (tbl->action == IWL_MIMO2_SWITCH_SISO_B)
                         tbl->action = IWL_MIMO2_SWITCH_SISO_A;
                 break;
         default:
@@ -1730,7 +1499,6 @@ static int rs_move_mimo2_to_other(struct iwl_mvm *mvm,
                         break;
                 case IWL_MIMO2_SWITCH_SISO_A:
                 case IWL_MIMO2_SWITCH_SISO_B:
-                case IWL_MIMO2_SWITCH_SISO_C:
                         IWL_DEBUG_RATE(mvm, "LQ: MIMO2 switch to SISO\n");
 
                         /* Set up new search table for SISO */
@@ -1738,10 +1506,8 @@ static int rs_move_mimo2_to_other(struct iwl_mvm *mvm,
 
                         if (tbl->action == IWL_MIMO2_SWITCH_SISO_A)
                                 search_tbl->ant_type = ANT_A;
-                        else if (tbl->action == IWL_MIMO2_SWITCH_SISO_B)
+                        else /* tbl->action == IWL_MIMO2_SWITCH_SISO_B */
                                 search_tbl->ant_type = ANT_B;
-                        else
-                                search_tbl->ant_type = ANT_C;
 
                         if (!rs_is_valid_ant(valid_tx_ant,
                                              search_tbl->ant_type))
@@ -1784,26 +1550,11 @@ static int rs_move_mimo2_to_other(struct iwl_mvm *mvm,
                                                       index, is_green);
                         update_search_tbl_counter = 1;
                         goto out;
-
-                case IWL_MIMO2_SWITCH_MIMO3_ABC:
-                        IWL_DEBUG_RATE(mvm, "LQ: MIMO2 switch to MIMO3\n");
-                        memcpy(search_tbl, tbl, sz);
-                        search_tbl->is_SGI = 0;
-                        search_tbl->ant_type = ANT_ABC;
-
-                        if (!rs_is_valid_ant(valid_tx_ant,
-                                             search_tbl->ant_type))
-                                break;
-
-                        ret = rs_switch_to_mimo3(mvm, lq_sta, sta,
-                                                 search_tbl, index);
-                        if (!ret)
-                                goto out;
-
-                        break;
+                default:
+                        WARN_ON_ONCE(1);
                 }
                 tbl->action++;
-                if (tbl->action > IWL_MIMO2_SWITCH_MIMO3_ABC)
+                if (tbl->action > IWL_MIMO2_SWITCH_GI)
                         tbl->action = IWL_MIMO2_SWITCH_ANTENNA1;
 
                 if (tbl->action == start_action)
@@ -1814,7 +1565,7 @@ static int rs_move_mimo2_to_other(struct iwl_mvm *mvm,
  out:
         lq_sta->search_better_tbl = 1;
         tbl->action++;
-        if (tbl->action > IWL_MIMO2_SWITCH_MIMO3_ABC)
+        if (tbl->action > IWL_MIMO2_SWITCH_GI)
                 tbl->action = IWL_MIMO2_SWITCH_ANTENNA1;
         if (update_search_tbl_counter)
                 search_tbl->action = tbl->action;
@@ -1823,171 +1574,6 @@ static int rs_move_mimo2_to_other(struct iwl_mvm *mvm,
 }
 
 /*
- * Try to switch to new modulation mode from MIMO3
- */
-static int rs_move_mimo3_to_other(struct iwl_mvm *mvm,
-                                 struct iwl_lq_sta *lq_sta,
-                                 struct ieee80211_sta *sta, int index)
-{
-        s8 is_green = lq_sta->is_green;
-        struct iwl_scale_tbl_info *tbl = &(lq_sta->lq_info[lq_sta->active_tbl]);
-        struct iwl_scale_tbl_info *search_tbl =
-                                &(lq_sta->lq_info[(1 - lq_sta->active_tbl)]);
-        struct iwl_rate_scale_data *window = &(tbl->win[index]);
-        struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
-        u32 sz = (sizeof(struct iwl_scale_tbl_info) -
-                  (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT));
-        u8 start_action;
-        u8 valid_tx_ant = iwl_fw_valid_tx_ant(mvm->fw);
-        u8 tx_chains_num = num_of_ant(valid_tx_ant);
-        int ret;
-        u8 update_search_tbl_counter = 0;
-
-        switch (BT_MBOX_MSG(&mvm->last_bt_notif, 3, TRAFFIC_LOAD)) {
-        case IWL_BT_COEX_TRAFFIC_LOAD_NONE:
-                /* nothing */
-                break;
-        case IWL_BT_COEX_TRAFFIC_LOAD_HIGH:
-        case IWL_BT_COEX_TRAFFIC_LOAD_CONTINUOUS:
-                /* avoid antenna B and MIMO */
-                if (tbl->action != IWL_MIMO3_SWITCH_SISO_A)
-                        tbl->action = IWL_MIMO3_SWITCH_SISO_A;
-                break;
-        case IWL_BT_COEX_TRAFFIC_LOAD_LOW:
-                /* avoid antenna B unless MIMO */
-                if (tbl->action == IWL_MIMO3_SWITCH_SISO_B ||
-                    tbl->action == IWL_MIMO3_SWITCH_SISO_C)
-                        tbl->action = IWL_MIMO3_SWITCH_SISO_A;
-                break;
-        default:
-                IWL_ERR(mvm, "Invalid BT load %d",
-                        BT_MBOX_MSG(&mvm->last_bt_notif, 3, TRAFFIC_LOAD));
-                break;
-        }
-
-        start_action = tbl->action;
-        while (1) {
-                lq_sta->action_counter++;
-                switch (tbl->action) {
-                case IWL_MIMO3_SWITCH_ANTENNA1:
-                case IWL_MIMO3_SWITCH_ANTENNA2:
-                        IWL_DEBUG_RATE(mvm, "LQ: MIMO3 toggle Antennas\n");
-
-                        if (tx_chains_num <= 3)
-                                break;
-
-                        if (window->success_ratio >= IWL_RS_GOOD_RATIO)
-                                break;
-
-                        memcpy(search_tbl, tbl, sz);
-                        if (rs_toggle_antenna(valid_tx_ant,
-                                              &search_tbl->current_rate,
-                                              search_tbl))
-                                goto out;
-                        break;
-                case IWL_MIMO3_SWITCH_SISO_A:
-                case IWL_MIMO3_SWITCH_SISO_B:
-                case IWL_MIMO3_SWITCH_SISO_C:
-                        IWL_DEBUG_RATE(mvm, "LQ: MIMO3 switch to SISO\n");
-
-                        /* Set up new search table for SISO */
-                        memcpy(search_tbl, tbl, sz);
-
-                        if (tbl->action == IWL_MIMO3_SWITCH_SISO_A)
-                                search_tbl->ant_type = ANT_A;
-                        else if (tbl->action == IWL_MIMO3_SWITCH_SISO_B)
-                                search_tbl->ant_type = ANT_B;
-                        else
-                                search_tbl->ant_type = ANT_C;
-
-                        if (!rs_is_valid_ant(valid_tx_ant,
-                                             search_tbl->ant_type))
-                                break;
-
-                        ret = rs_switch_to_siso(mvm, lq_sta, sta,
-                                                search_tbl, index);
-                        if (!ret)
-                                goto out;
-
-                        break;
-
-                case IWL_MIMO3_SWITCH_MIMO2_AB:
-                case IWL_MIMO3_SWITCH_MIMO2_AC:
-                case IWL_MIMO3_SWITCH_MIMO2_BC:
-                        IWL_DEBUG_RATE(mvm, "LQ: MIMO3 switch to MIMO2\n");
-
-                        memcpy(search_tbl, tbl, sz);
-                        search_tbl->is_SGI = 0;
-                        if (tbl->action == IWL_MIMO3_SWITCH_MIMO2_AB)
-                                search_tbl->ant_type = ANT_AB;
-                        else if (tbl->action == IWL_MIMO3_SWITCH_MIMO2_AC)
-                                search_tbl->ant_type = ANT_AC;
-                        else
-                                search_tbl->ant_type = ANT_BC;
-
-                        if (!rs_is_valid_ant(valid_tx_ant,
-                                             search_tbl->ant_type))
-                                break;
-
-                        ret = rs_switch_to_mimo2(mvm, lq_sta, sta,
-                                                 search_tbl, index);
-                        if (!ret)
-                                goto out;
-
-                        break;
-
-                case IWL_MIMO3_SWITCH_GI:
-                        if (!tbl->is_ht40 && !(ht_cap->cap &
-                                                IEEE80211_HT_CAP_SGI_20))
-                                break;
-                        if (tbl->is_ht40 && !(ht_cap->cap &
-                                                IEEE80211_HT_CAP_SGI_40))
-                                break;
-
-                        IWL_DEBUG_RATE(mvm, "LQ: MIMO3 toggle SGI/NGI\n");
-
-                        /* Set up new search table for MIMO */
-                        memcpy(search_tbl, tbl, sz);
-                        search_tbl->is_SGI = !tbl->is_SGI;
-                        rs_set_expected_tpt_table(lq_sta, search_tbl);
-                        /*
-                         * If active table already uses the fastest possible
-                         * modulation (dual stream with short guard interval),
-                         * and it's working well, there's no need to look
-                         * for a better type of modulation!
-                         */
-                        if (tbl->is_SGI) {
-                                s32 tpt = lq_sta->last_tpt / 100;
-                                if (tpt >= search_tbl->expected_tpt[index])
-                                        break;
-                        }
-                        search_tbl->current_rate =
-                                rate_n_flags_from_tbl(mvm, search_tbl,
-                                                      index, is_green);
-                        update_search_tbl_counter = 1;
-                        goto out;
-                }
-                tbl->action++;
-                if (tbl->action > IWL_MIMO3_SWITCH_GI)
-                        tbl->action = IWL_MIMO3_SWITCH_ANTENNA1;
-
-                if (tbl->action == start_action)
-                        break;
-        }
-        search_tbl->lq_type = LQ_NONE;
-        return 0;
- out:
-        lq_sta->search_better_tbl = 1;
-        tbl->action++;
-        if (tbl->action > IWL_MIMO3_SWITCH_GI)
-                tbl->action = IWL_MIMO3_SWITCH_ANTENNA1;
-        if (update_search_tbl_counter)
-                search_tbl->action = tbl->action;
-
-        return 0;
-}
-
-/*
  * Check whether we should continue using same modulation mode, or
  * begin search for a new mode, based on:
  * 1) # tx successes or failures while using this mode
@@ -2086,6 +1672,22 @@ static void rs_update_rate_tbl(struct iwl_mvm *mvm,
         iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq, CMD_ASYNC, false);
 }
 
+static u8 rs_get_tid(struct iwl_lq_sta *lq_data,
+                     struct ieee80211_hdr *hdr)
+{
+        u8 tid = IWL_MAX_TID_COUNT;
+
+        if (ieee80211_is_data_qos(hdr->frame_control)) {
+                u8 *qc = ieee80211_get_qos_ctl(hdr);
+                tid = qc[0] & 0xf;
+        }
+
+        if (unlikely(tid > IWL_MAX_TID_COUNT))
+                tid = IWL_MAX_TID_COUNT;
+
+        return tid;
+}
+
 /*
  * Do rate scaling and search for new modulation mode.
  */
@@ -2129,7 +1731,7 @@ static void rs_rate_scale_perform(struct iwl_mvm *mvm,
 
         lq_sta->supp_rates = sta->supp_rates[lq_sta->band];
 
-        tid = rs_tl_add_packet(lq_sta, hdr);
+        tid = rs_get_tid(lq_sta, hdr);
         if ((tid != IWL_MAX_TID_COUNT) &&
             (lq_sta->tx_agg_tid_en & (1 << tid))) {
                 tid_data = &sta_priv->tid_data[tid];
@@ -2377,8 +1979,7 @@ static void rs_rate_scale_perform(struct iwl_mvm *mvm,
                 scale_action = 0;
 
         if ((BT_MBOX_MSG(&mvm->last_bt_notif, 3, TRAFFIC_LOAD) >=
-             IWL_BT_COEX_TRAFFIC_LOAD_HIGH) &&
-             (is_mimo2(tbl->lq_type) || is_mimo3(tbl->lq_type))) {
+             IWL_BT_COEX_TRAFFIC_LOAD_HIGH) && (is_mimo(tbl->lq_type))) {
                 if (lq_sta->last_bt_traffic >
                     BT_MBOX_MSG(&mvm->last_bt_notif, 3, TRAFFIC_LOAD)) {
                         /*
@@ -2395,8 +1996,7 @@ static void rs_rate_scale_perform(struct iwl_mvm *mvm,
                 BT_MBOX_MSG(&mvm->last_bt_notif, 3, TRAFFIC_LOAD);
 
         if ((BT_MBOX_MSG(&mvm->last_bt_notif, 3, TRAFFIC_LOAD) >=
-             IWL_BT_COEX_TRAFFIC_LOAD_HIGH) &&
-             (is_mimo2(tbl->lq_type) || is_mimo3(tbl->lq_type))) {
+             IWL_BT_COEX_TRAFFIC_LOAD_HIGH) && is_mimo(tbl->lq_type)) {
                 /* search for a new modulation */
                 rs_stay_in_table(lq_sta, true);
                 goto lq_update;
@@ -2456,7 +2056,7 @@ lq_update:
                 else if (is_mimo2(tbl->lq_type))
                         rs_move_mimo2_to_other(mvm, lq_sta, sta, index);
                 else
-                        rs_move_mimo3_to_other(mvm, lq_sta, sta, index);
+                        WARN_ON_ONCE(1);
 
                 /* If new "search" mode was selected, set up in uCode table */
                 if (lq_sta->search_better_tbl) {
@@ -2621,11 +2221,10 @@ static void rs_get_rate(void *mvm_r, struct ieee80211_sta *sta, void *mvm_sta,
                 rate_idx -= IWL_FIRST_OFDM_RATE;
                 /* 6M and 9M shared same MCS index */
                 rate_idx = (rate_idx > 0) ? (rate_idx - 1) : 0;
+                WARN_ON_ONCE(rs_extract_rate(lq_sta->last_rate_n_flags) >=
+                             IWL_RATE_MIMO3_6M_PLCP);
                 if (rs_extract_rate(lq_sta->last_rate_n_flags) >=
-                    IWL_RATE_MIMO3_6M_PLCP)
-                        rate_idx = rate_idx + (2 * MCS_INDEX_PER_STREAM);
-                else if (rs_extract_rate(lq_sta->last_rate_n_flags) >=
-                         IWL_RATE_MIMO2_6M_PLCP)
+                    IWL_RATE_MIMO2_6M_PLCP)
                         rate_idx = rate_idx + MCS_INDEX_PER_STREAM;
                 info->control.rates[0].flags = IEEE80211_TX_RC_MCS;
                 if (lq_sta->last_rate_n_flags & RATE_MCS_SGI_MSK)
@@ -2688,9 +2287,6 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 
         lq_sta->flush_timer = 0;
         lq_sta->supp_rates = sta->supp_rates[sband->band];
-        for (j = 0; j < LQ_SIZE; j++)
-                for (i = 0; i < IWL_RATE_COUNT; i++)
-                        rs_rate_scale_clear_window(&lq_sta->lq_info[j].win[i]);
 
         IWL_DEBUG_RATE(mvm,
                        "LQ: *** rate scale station global init for station %d ***\n",
@@ -2727,16 +2323,10 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         lq_sta->active_mimo2_rate &= ~((u16)0x2);
         lq_sta->active_mimo2_rate <<= IWL_FIRST_OFDM_RATE;
 
-        lq_sta->active_mimo3_rate = ht_cap->mcs.rx_mask[2] << 1;
-        lq_sta->active_mimo3_rate |= ht_cap->mcs.rx_mask[2] & 0x1;
-        lq_sta->active_mimo3_rate &= ~((u16)0x2);
-        lq_sta->active_mimo3_rate <<= IWL_FIRST_OFDM_RATE;
-
         IWL_DEBUG_RATE(mvm,
-                       "SISO-RATE=%X MIMO2-RATE=%X MIMO3-RATE=%X\n",
+                       "SISO-RATE=%X MIMO2-RATE=%X\n",
                        lq_sta->active_siso_rate,
-                       lq_sta->active_mimo2_rate,
-                       lq_sta->active_mimo3_rate);
+                       lq_sta->active_mimo2_rate);
 
         /* These values will be overridden later */
         lq_sta->lq.single_stream_ant_msk =
@@ -2780,7 +2370,7 @@ static void rs_fill_link_cmd(struct iwl_mvm *mvm,
         struct iwl_lq_cmd *lq_cmd = &lq_sta->lq;
 
         /* Override starting rate (index 0) if needed for debug purposes */
-        rs_dbgfs_set_mcs(lq_sta, &new_rate, index);
+        rs_dbgfs_set_mcs(lq_sta, &new_rate);
 
         /* Interpret new_rate (rate_n_flags) */
         rs_get_tbl_info_from_mcs(new_rate, lq_sta->band,
@@ -2827,7 +2417,7 @@ static void rs_fill_link_cmd(struct iwl_mvm *mvm,
                         }
 
                         /* Override next rate if needed for debug purposes */
-                        rs_dbgfs_set_mcs(lq_sta, &new_rate, index);
+                        rs_dbgfs_set_mcs(lq_sta, &new_rate);
 
                         /* Fill next table entry */
                         lq_cmd->rs_table[index] =
@@ -2869,7 +2459,7 @@ static void rs_fill_link_cmd(struct iwl_mvm *mvm,
                 use_ht_possible = 0;
 
                 /* Override next rate if needed for debug purposes */
-                rs_dbgfs_set_mcs(lq_sta, &new_rate, index);
+                rs_dbgfs_set_mcs(lq_sta, &new_rate);
 
                 /* Fill next table entry */
                 lq_cmd->rs_table[index] = cpu_to_le32(new_rate);
@@ -2914,7 +2504,7 @@ static void rs_free_sta(void *mvm_r, struct ieee80211_sta *sta,
 
 #ifdef CONFIG_MAC80211_DEBUGFS
 static void rs_dbgfs_set_mcs(struct iwl_lq_sta *lq_sta,
-                             u32 *rate_n_flags, int index)
+                             u32 *rate_n_flags)
 {
         struct iwl_mvm *mvm;
         u8 valid_tx_ant;
@@ -2999,8 +2589,7 @@ static ssize_t rs_sta_dbgfs_scale_table_read(struct file *file,
            (is_legacy(tbl->lq_type)) ? "legacy" : "HT");
         if (is_Ht(tbl->lq_type)) {
                 desc += sprintf(buff+desc, " %s",
-                   (is_siso(tbl->lq_type)) ? "SISO" :
-                   ((is_mimo2(tbl->lq_type)) ? "MIMO2" : "MIMO3"));
+                   (is_siso(tbl->lq_type)) ? "SISO" : "MIMO2");
                    desc += sprintf(buff+desc, " %s",
                    (tbl->is_ht40) ? "40MHz" : "20MHz");
                    desc += sprintf(buff+desc, " %s %s %s\n",
@@ -3100,32 +2689,6 @@ static const struct file_operations rs_sta_dbgfs_stats_table_ops = {
         .llseek = default_llseek,
 };
 
-static ssize_t rs_sta_dbgfs_rate_scale_data_read(struct file *file,
-                        char __user *user_buf, size_t count, loff_t *ppos)
-{
-        struct iwl_lq_sta *lq_sta = file->private_data;
-        struct iwl_scale_tbl_info *tbl = &lq_sta->lq_info[lq_sta->active_tbl];
-        char buff[120];
-        int desc = 0;
-
-        if (is_Ht(tbl->lq_type))
-                desc += sprintf(buff+desc,
-                                "Bit Rate= %d Mb/s\n",
-                                tbl->expected_tpt[lq_sta->last_txrate_idx]);
-        else
-                desc += sprintf(buff+desc,
-                                "Bit Rate= %d Mb/s\n",
-                                iwl_rates[lq_sta->last_txrate_idx].ieee >> 1);
-
-        return simple_read_from_buffer(user_buf, count, ppos, buff, desc);
-}
-
-static const struct file_operations rs_sta_dbgfs_rate_scale_data_ops = {
-        .read = rs_sta_dbgfs_rate_scale_data_read,
-        .open = simple_open,
-        .llseek = default_llseek,
-};
-
 static void rs_add_debugfs(void *mvm, void *mvm_sta, struct dentry *dir)
 {
         struct iwl_lq_sta *lq_sta = mvm_sta;
@@ -3135,9 +2698,6 @@ static void rs_add_debugfs(void *mvm, void *mvm_sta, struct dentry *dir)
         lq_sta->rs_sta_dbgfs_stats_table_file =
                 debugfs_create_file("rate_stats_table", S_IRUSR, dir,
                                     lq_sta, &rs_sta_dbgfs_stats_table_ops);
-        lq_sta->rs_sta_dbgfs_rate_scale_data_file =
-                debugfs_create_file("rate_scale_data", S_IRUSR, dir,
-                                    lq_sta, &rs_sta_dbgfs_rate_scale_data_ops);
         lq_sta->rs_sta_dbgfs_tx_agg_tid_en_file =
                 debugfs_create_u8("tx_agg_tid_enable", S_IRUSR | S_IWUSR, dir,
                                   &lq_sta->tx_agg_tid_en);
@@ -3148,7 +2708,6 @@ static void rs_remove_debugfs(void *mvm, void *mvm_sta)
         struct iwl_lq_sta *lq_sta = mvm_sta;
         debugfs_remove(lq_sta->rs_sta_dbgfs_scale_table_file);
         debugfs_remove(lq_sta->rs_sta_dbgfs_stats_table_file);
-        debugfs_remove(lq_sta->rs_sta_dbgfs_rate_scale_data_file);
         debugfs_remove(lq_sta->rs_sta_dbgfs_tx_agg_tid_en_file);
 }
 #endif
@@ -3159,8 +2718,9 @@ static void rs_remove_debugfs(void *mvm, void *mvm_sta)
  * station is added we ignore it.
  */
 static void rs_rate_init_stub(void *mvm_r,
-                                 struct ieee80211_supported_band *sband,
-                                 struct ieee80211_sta *sta, void *mvm_sta)
+                              struct ieee80211_supported_band *sband,
+                              struct cfg80211_chan_def *chandef,
+                              struct ieee80211_sta *sta, void *mvm_sta)
 {
 }
 static struct rate_control_ops rs_mvm_ops = {
@@ -3193,13 +2753,14 @@ void iwl_mvm_rate_control_unregister(void)
  * iwl_mvm_tx_protection - Gets LQ command, change it to enable/disable
  * Tx protection, according to this rquest and previous requests,
  * and send the LQ command.
- * @lq: The LQ command
  * @mvmsta: The station
  * @enable: Enable Tx protection?
  */
-int iwl_mvm_tx_protection(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq,
-                          struct iwl_mvm_sta *mvmsta, bool enable)
+int iwl_mvm_tx_protection(struct iwl_mvm *mvm, struct iwl_mvm_sta *mvmsta,
+                          bool enable)
 {
+        struct iwl_lq_cmd *lq = &mvmsta->lq_sta.lq;
+
         lockdep_assert_held(&mvm->mutex);
 
         if (enable) {
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.h b/drivers/net/wireless/iwlwifi/mvm/rs.h
index cff4f6da7733..335cf1682902 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.h
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.h
@@ -38,14 +38,8 @@ struct iwl_rs_rate_info {
         u8 plcp;        /* uCode API:  IWL_RATE_6M_PLCP, etc. */
         u8 plcp_siso;   /* uCode API:  IWL_RATE_SISO_6M_PLCP, etc. */
         u8 plcp_mimo2;  /* uCode API:  IWL_RATE_MIMO2_6M_PLCP, etc. */
-        u8 plcp_mimo3;  /* uCode API:  IWL_RATE_MIMO3_6M_PLCP, etc. */
-        u8 ieee;        /* MAC header:  IWL_RATE_6M_IEEE, etc. */
-        u8 prev_ieee;    /* previous rate in IEEE speeds */
-        u8 next_ieee;    /* next rate in IEEE speeds */
         u8 prev_rs;      /* previous rate used in rs algo */
         u8 next_rs;      /* next rate used in rs algo */
-        u8 prev_rs_tgg;  /* previous rate used in TGG rs algo */
-        u8 next_rs_tgg;  /* next rate used in TGG rs algo */
 };
 
 #define IWL_RATE_60M_PLCP 3
@@ -120,23 +114,6 @@ enum {
         IWL_RATE_MIMO3_INVM_PLCP = IWL_RATE_SISO_INVM_PLCP,
 };
 
-/* MAC header values for bit rates */
-enum {
-        IWL_RATE_6M_IEEE  = 12,
-        IWL_RATE_9M_IEEE  = 18,
-        IWL_RATE_12M_IEEE = 24,
-        IWL_RATE_18M_IEEE = 36,
-        IWL_RATE_24M_IEEE = 48,
-        IWL_RATE_36M_IEEE = 72,
-        IWL_RATE_48M_IEEE = 96,
-        IWL_RATE_54M_IEEE = 108,
-        IWL_RATE_60M_IEEE = 120,
-        IWL_RATE_1M_IEEE  = 2,
-        IWL_RATE_2M_IEEE  = 4,
-        IWL_RATE_5M_IEEE  = 11,
-        IWL_RATE_11M_IEEE = 22,
-};
-
 #define IWL_RATES_MASK ((1 << IWL_RATE_COUNT) - 1)
 
 #define IWL_INVALID_VALUE    -1
@@ -165,47 +142,22 @@ enum {
 #define IWL_LEGACY_SWITCH_ANTENNA1      0
 #define IWL_LEGACY_SWITCH_ANTENNA2      1
 #define IWL_LEGACY_SWITCH_SISO          2
-#define IWL_LEGACY_SWITCH_MIMO2_AB      3
-#define IWL_LEGACY_SWITCH_MIMO2_AC      4
-#define IWL_LEGACY_SWITCH_MIMO2_BC      5
-#define IWL_LEGACY_SWITCH_MIMO3_ABC     6
+#define IWL_LEGACY_SWITCH_MIMO2         3
 
 /* possible actions when in siso mode */
 #define IWL_SISO_SWITCH_ANTENNA1        0
 #define IWL_SISO_SWITCH_ANTENNA2        1
-#define IWL_SISO_SWITCH_MIMO2_AB        2
-#define IWL_SISO_SWITCH_MIMO2_AC        3
-#define IWL_SISO_SWITCH_MIMO2_BC        4
-#define IWL_SISO_SWITCH_GI              5
-#define IWL_SISO_SWITCH_MIMO3_ABC       6
-
+#define IWL_SISO_SWITCH_MIMO2           2
+#define IWL_SISO_SWITCH_GI              3
 
 /* possible actions when in mimo mode */
 #define IWL_MIMO2_SWITCH_ANTENNA1       0
 #define IWL_MIMO2_SWITCH_ANTENNA2       1
 #define IWL_MIMO2_SWITCH_SISO_A         2
 #define IWL_MIMO2_SWITCH_SISO_B         3
-#define IWL_MIMO2_SWITCH_SISO_C         4
-#define IWL_MIMO2_SWITCH_GI             5
-#define IWL_MIMO2_SWITCH_MIMO3_ABC      6
-
+#define IWL_MIMO2_SWITCH_GI             4
 
-/* possible actions when in mimo3 mode */
-#define IWL_MIMO3_SWITCH_ANTENNA1       0
-#define IWL_MIMO3_SWITCH_ANTENNA2       1
-#define IWL_MIMO3_SWITCH_SISO_A         2
-#define IWL_MIMO3_SWITCH_SISO_B         3
-#define IWL_MIMO3_SWITCH_SISO_C         4
-#define IWL_MIMO3_SWITCH_MIMO2_AB       5
-#define IWL_MIMO3_SWITCH_MIMO2_AC       6
-#define IWL_MIMO3_SWITCH_MIMO2_BC       7
-#define IWL_MIMO3_SWITCH_GI             8
-
-
-#define IWL_MAX_11N_MIMO3_SEARCH IWL_MIMO3_SWITCH_GI
-#define IWL_MAX_SEARCH IWL_MIMO2_SWITCH_MIMO3_ABC
-
-/*FIXME:RS:add possible actions for MIMO3*/
+#define IWL_MAX_SEARCH IWL_MIMO2_SWITCH_GI
 
 #define IWL_ACTION_LIMIT                3       /* # possible actions */
 
@@ -240,15 +192,13 @@ enum iwl_table_type {
         LQ_A,
         LQ_SISO,        /* high-throughput types */
         LQ_MIMO2,
-        LQ_MIMO3,
         LQ_MAX,
 };
 
 #define is_legacy(tbl) (((tbl) == LQ_G) || ((tbl) == LQ_A))
 #define is_siso(tbl) ((tbl) == LQ_SISO)
 #define is_mimo2(tbl) ((tbl) == LQ_MIMO2)
-#define is_mimo3(tbl) ((tbl) == LQ_MIMO3)
-#define is_mimo(tbl) (is_mimo2(tbl) || is_mimo3(tbl))
+#define is_mimo(tbl) is_mimo2(tbl)
 #define is_Ht(tbl) (is_siso(tbl) || is_mimo(tbl))
 #define is_a_band(tbl) ((tbl) == LQ_A)
 #define is_g_and(tbl) ((tbl) == LQ_G)
@@ -290,17 +240,6 @@ struct iwl_scale_tbl_info {
         struct iwl_rate_scale_data win[IWL_RATE_COUNT]; /* rate histories */
 };
 
-struct iwl_traffic_load {
-        unsigned long time_stamp;       /* age of the oldest statistics */
-        u32 packet_count[TID_QUEUE_MAX_SIZE];   /* packet count in this time
-                                                 * slice */
-        u32 total;                      /* total num of packets during the
-                                         * last TID_MAX_TIME_DIFF */
-        u8 queue_count;                 /* number of queues that has
-                                         * been used since the last cleanup */
-        u8 head;                        /* start of the circular buffer */
-};
-
 /**
  * struct iwl_lq_sta -- driver's rate scaling private structure
  *
@@ -331,18 +270,15 @@ struct iwl_lq_sta {
         u16 active_legacy_rate;
         u16 active_siso_rate;
         u16 active_mimo2_rate;
-        u16 active_mimo3_rate;
         s8 max_rate_idx;     /* Max rate set by user */
         u8 missed_rate_counter;
 
         struct iwl_lq_cmd lq;
         struct iwl_scale_tbl_info lq_info[LQ_SIZE]; /* "active", "search" */
-        struct iwl_traffic_load load[IWL_MAX_TID_COUNT];
         u8 tx_agg_tid_en;
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct dentry *rs_sta_dbgfs_scale_table_file;
         struct dentry *rs_sta_dbgfs_stats_table_file;
-        struct dentry *rs_sta_dbgfs_rate_scale_data_file;
         struct dentry *rs_sta_dbgfs_tx_agg_tid_en_file;
         u32 dbg_fixed_rate;
 #endif
@@ -404,7 +340,7 @@ extern void iwl_mvm_rate_control_unregister(void);
 
 struct iwl_mvm_sta;
 
-int iwl_mvm_tx_protection(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq,
-                          struct iwl_mvm_sta *mvmsta, bool enable);
+int iwl_mvm_tx_protection(struct iwl_mvm *mvm, struct iwl_mvm_sta *mvmsta,
+                          bool enable);
 
 #endif /* __rs__ */
diff --git a/drivers/net/wireless/iwlwifi/mvm/rx.c b/drivers/net/wireless/iwlwifi/mvm/rx.c
index e4930d5027d2..2a8cb5a60535 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rx.c
@@ -124,24 +124,15 @@ static void iwl_mvm_pass_packet_to_mac80211(struct iwl_mvm *mvm,
         ieee80211_rx_ni(mvm->hw, skb);
 }
 
-/*
- * iwl_mvm_calc_rssi - calculate the rssi in dBm
- * @phy_info: the phy information for the coming packet
- */
-static int iwl_mvm_calc_rssi(struct iwl_mvm *mvm,
-                             struct iwl_rx_phy_info *phy_info)
+static void iwl_mvm_calc_rssi(struct iwl_mvm *mvm,
+                              struct iwl_rx_phy_info *phy_info,
+                              struct ieee80211_rx_status *rx_status)
 {
         int rssi_a, rssi_b, rssi_a_dbm, rssi_b_dbm, max_rssi_dbm;
         int rssi_all_band_a, rssi_all_band_b;
         u32 agc_a, agc_b, max_agc;
         u32 val;
 
-        /* Find max rssi among 2 possible receivers.
-         * These values are measured by the Digital Signal Processor (DSP).
-         * They should stay fairly constant even as the signal strength varies,
-         * if the radio's Automatic Gain Control (AGC) is working right.
-         * AGC value (see below) will provide the "interesting" info.
-         */
         val = le32_to_cpu(phy_info->non_cfg_phy[IWL_RX_INFO_AGC_IDX]);
         agc_a = (val & IWL_OFDM_AGC_A_MSK) >> IWL_OFDM_AGC_A_POS;
         agc_b = (val & IWL_OFDM_AGC_B_MSK) >> IWL_OFDM_AGC_B_POS;
@@ -166,7 +157,51 @@ static int iwl_mvm_calc_rssi(struct iwl_mvm *mvm,
         IWL_DEBUG_STATS(mvm, "Rssi In A %d B %d Max %d AGCA %d AGCB %d\n",
                         rssi_a_dbm, rssi_b_dbm, max_rssi_dbm, agc_a, agc_b);
 
-        return max_rssi_dbm;
+        rx_status->signal = max_rssi_dbm;
+        rx_status->chains = (le16_to_cpu(phy_info->phy_flags) &
+                                RX_RES_PHY_FLAGS_ANTENNA)
+                                        >> RX_RES_PHY_FLAGS_ANTENNA_POS;
+        rx_status->chain_signal[0] = rssi_a_dbm;
+        rx_status->chain_signal[1] = rssi_b_dbm;
+}
+
+/*
+ * iwl_mvm_get_signal_strength - use new rx PHY INFO API
+ * values are reported by the fw as positive values - need to negate
+ * to obtain their dBM.  Account for missing antennas by replacing 0
+ * values by -256dBm: practically 0 power and a non-feasible 8 bit value.
+ */
+static void iwl_mvm_get_signal_strength(struct iwl_mvm *mvm,
+                                        struct iwl_rx_phy_info *phy_info,
+                                        struct ieee80211_rx_status *rx_status)
+{
+        int energy_a, energy_b, energy_c, max_energy;
+        u32 val;
+
+        val =
+            le32_to_cpu(phy_info->non_cfg_phy[IWL_RX_INFO_ENERGY_ANT_ABC_IDX]);
+        energy_a = (val & IWL_RX_INFO_ENERGY_ANT_A_MSK) >>
+                                                IWL_RX_INFO_ENERGY_ANT_A_POS;
+        energy_a = energy_a ? -energy_a : -256;
+        energy_b = (val & IWL_RX_INFO_ENERGY_ANT_B_MSK) >>
+                                                IWL_RX_INFO_ENERGY_ANT_B_POS;
+        energy_b = energy_b ? -energy_b : -256;
+        energy_c = (val & IWL_RX_INFO_ENERGY_ANT_C_MSK) >>
+                                                IWL_RX_INFO_ENERGY_ANT_C_POS;
+        energy_c = energy_c ? -energy_c : -256;
+        max_energy = max(energy_a, energy_b);
+        max_energy = max(max_energy, energy_c);
+
+        IWL_DEBUG_STATS(mvm, "energy In A %d B %d C %d , and max %d\n",
+                        energy_a, energy_b, energy_c, max_energy);
+
+        rx_status->signal = max_energy;
+        rx_status->chains = (le16_to_cpu(phy_info->phy_flags) &
+                                RX_RES_PHY_FLAGS_ANTENNA)
+                                        >> RX_RES_PHY_FLAGS_ANTENNA_POS;
+        rx_status->chain_signal[0] = energy_a;
+        rx_status->chain_signal[1] = energy_b;
+        rx_status->chain_signal[2] = energy_c;
 }
 
 /*
@@ -289,29 +324,14 @@ int iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
          */
         /*rx_status.flag |= RX_FLAG_MACTIME_MPDU;*/
 
-        /* Find max signal strength (dBm) among 3 antenna/receiver chains */
-        rx_status.signal = iwl_mvm_calc_rssi(mvm, phy_info);
+        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_RX_ENERGY_API)
+                iwl_mvm_get_signal_strength(mvm, phy_info, &rx_status);
+        else
+                iwl_mvm_calc_rssi(mvm, phy_info, &rx_status);
 
         IWL_DEBUG_STATS_LIMIT(mvm, "Rssi %d, TSF %llu\n", rx_status.signal,
                               (unsigned long long)rx_status.mactime);
 
-        /*
-         * "antenna number"
-         *
-         * It seems that the antenna field in the phy flags value
-         * is actually a bit field. This is undefined by radiotap,
-         * it wants an actual antenna number but I always get "7"
-         * for most legacy frames I receive indicating that the
-         * same frame was received on all three RX chains.
-         *
-         * I think this field should be removed in favor of a
-         * new 802.11n radiotap field "RX chains" that is defined
-         * as a bitmask.
-         */
-        rx_status.antenna = (le16_to_cpu(phy_info->phy_flags) &
-                                RX_RES_PHY_FLAGS_ANTENNA)
-                                >> RX_RES_PHY_FLAGS_ANTENNA_POS;
-
         /* set the preamble flag if appropriate */
         if (phy_info->phy_flags & cpu_to_le16(RX_RES_PHY_FLAGS_SHORT_PREAMBLE))
                 rx_status.flag |= RX_FLAG_SHORTPRE;
@@ -364,11 +384,74 @@ int iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
         return 0;
 }
 
+static void iwl_mvm_update_rx_statistics(struct iwl_mvm *mvm,
+                                         struct iwl_notif_statistics *stats)
+{
+        /*
+         * NOTE FW aggregates the statistics - BUT the statistics are cleared
+         * when the driver issues REPLY_STATISTICS_CMD 0x9c with CLEAR_STATS
+         * bit set.
+         */
+        lockdep_assert_held(&mvm->mutex);
+        memcpy(&mvm->rx_stats, &stats->rx, sizeof(struct mvm_statistics_rx));
+}
+
+struct iwl_mvm_stat_data {
+        struct iwl_notif_statistics *stats;
+        struct iwl_mvm *mvm;
+};
+
+static void iwl_mvm_stat_iterator(void *_data, u8 *mac,
+                                  struct ieee80211_vif *vif)
+{
+        struct iwl_mvm_stat_data *data = _data;
+        struct iwl_notif_statistics *stats = data->stats;
+        struct iwl_mvm *mvm = data->mvm;
+        int sig = -stats->general.beacon_filter_average_energy;
+        int last_event;
+        int thold = vif->bss_conf.cqm_rssi_thold;
+        int hyst = vif->bss_conf.cqm_rssi_hyst;
+        u16 id = le32_to_cpu(stats->rx.general.mac_id);
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+
+        if (mvmvif->id != id)
+                return;
+
+        if (vif->type != NL80211_IFTYPE_STATION)
+                return;
+
+        mvmvif->bf_data.ave_beacon_signal = sig;
+
+        if (!(vif->driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI))
+                return;
+
+        /* CQM Notification */
+        last_event = mvmvif->bf_data.last_cqm_event;
+        if (thold && sig < thold && (last_event == 0 ||
+                                     sig < last_event - hyst)) {
+                mvmvif->bf_data.last_cqm_event = sig;
+                IWL_DEBUG_RX(mvm, "cqm_iterator cqm low %d\n",
+                             sig);
+                ieee80211_cqm_rssi_notify(
+                        vif,
+                        NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
+                        GFP_KERNEL);
+        } else if (sig > thold &&
+                   (last_event == 0 || sig > last_event + hyst)) {
+                mvmvif->bf_data.last_cqm_event = sig;
+                IWL_DEBUG_RX(mvm, "cqm_iterator cqm high %d\n",
+                             sig);
+                ieee80211_cqm_rssi_notify(
+                        vif,
+                        NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
+                        GFP_KERNEL);
+        }
+}
+
 /*
  * iwl_mvm_rx_statistics - STATISTICS_NOTIFICATION handler
  *
  * TODO: This handler is implemented partially.
- * It only gets the NIC's temperature.
  */
 int iwl_mvm_rx_statistics(struct iwl_mvm *mvm,
                           struct iwl_rx_cmd_buffer *rxb,
@@ -377,11 +460,20 @@ int iwl_mvm_rx_statistics(struct iwl_mvm *mvm,
         struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_notif_statistics *stats = (void *)&pkt->data;
         struct mvm_statistics_general_common *common = &stats->general.common;
+        struct iwl_mvm_stat_data data = {
+                .stats = stats,
+                .mvm = mvm,
+        };
 
         if (mvm->temperature != le32_to_cpu(common->temperature)) {
                 mvm->temperature = le32_to_cpu(common->temperature);
                 iwl_mvm_tt_handler(mvm);
         }
+        iwl_mvm_update_rx_statistics(mvm, stats);
 
+        ieee80211_iterate_active_interfaces(mvm->hw,
+                                            IEEE80211_IFACE_ITER_NORMAL,
+                                            iwl_mvm_stat_iterator,
+                                            &data);
         return 0;
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index acdff6b67e04..9a7ab8495300 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -301,10 +301,12 @@ int iwl_mvm_scan_request(struct iwl_mvm *mvm,
          */
         if (req->n_ssids > 0) {
                 cmd->passive2active = cpu_to_le16(1);
+                cmd->scan_flags |= SCAN_FLAGS_PASSIVE2ACTIVE;
                 ssid = req->ssids[0].ssid;
                 ssid_len = req->ssids[0].ssid_len;
         } else {
                 cmd->passive2active = 0;
+                cmd->scan_flags &= ~SCAN_FLAGS_PASSIVE2ACTIVE;
         }
 
         iwl_mvm_scan_fill_ssids(cmd, req);
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
index 563f559b902d..44add291531b 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
@@ -826,8 +826,7 @@ int iwl_mvm_sta_tx_agg_oper(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                  * method for HT traffic
                  * this function also sends the LQ command
                  */
-                return iwl_mvm_tx_protection(mvm, &mvmsta->lq_sta.lq,
-                                             mvmsta, true);
+                return iwl_mvm_tx_protection(mvm, mvmsta, true);
                 /*
                  * TODO: remove the TLC_RTS flag when we tear down the last
                  * AGG session (agg_tids_count in DVM)
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
index 7fd6fbfbc1b3..c17b74c31398 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
@@ -73,7 +73,6 @@
 #include "iwl-prph.h"
 
 /* A TimeUnit is 1024 microsecond */
-#define TU_TO_JIFFIES(_tu)      (usecs_to_jiffies((_tu) * 1024))
 #define MSEC_TO_TU(_msec)       (_msec*1000/1024)
 
 /*
@@ -185,7 +184,7 @@ static void iwl_mvm_te_handle_notif(struct iwl_mvm *mvm,
                 }
         }
 
-        if (le32_to_cpu(notif->action) & TE_NOTIF_HOST_EVENT_END) {
+        if (le32_to_cpu(notif->action) & TE_V2_NOTIF_HOST_EVENT_END) {
                 IWL_DEBUG_TE(mvm,
                              "TE ended - current time %lu, estimated end %lu\n",
                              jiffies, te_data->end_jiffies);
@@ -202,10 +201,9 @@ static void iwl_mvm_te_handle_notif(struct iwl_mvm *mvm,
                 iwl_mvm_te_check_disconnect(mvm, te_data->vif,
                         "No assocation and the time event is over already...");
                 iwl_mvm_te_clear_data(mvm, te_data);
-        } else if (le32_to_cpu(notif->action) & TE_NOTIF_HOST_EVENT_START) {
+        } else if (le32_to_cpu(notif->action) & TE_V2_NOTIF_HOST_EVENT_START) {
                 te_data->running = true;
-                te_data->end_jiffies = jiffies +
-                        TU_TO_JIFFIES(te_data->duration);
+                te_data->end_jiffies = TU_TO_EXP_TIME(te_data->duration);
 
                 if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE) {
                         set_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status);
@@ -270,10 +268,67 @@ static bool iwl_mvm_time_event_response(struct iwl_notif_wait_data *notif_wait,
         return true;
 }
 
+/* used to convert from time event API v2 to v1 */
+#define TE_V2_DEP_POLICY_MSK (TE_V2_DEP_OTHER | TE_V2_DEP_TSF |\
+                             TE_V2_EVENT_SOCIOPATHIC)
+static inline u16 te_v2_get_notify(__le16 policy)
+{
+        return le16_to_cpu(policy) & TE_V2_NOTIF_MSK;
+}
+
+static inline u16 te_v2_get_dep_policy(__le16 policy)
+{
+        return (le16_to_cpu(policy) & TE_V2_DEP_POLICY_MSK) >>
+                TE_V2_PLACEMENT_POS;
+}
+
+static inline u16 te_v2_get_absence(__le16 policy)
+{
+        return (le16_to_cpu(policy) & TE_V2_ABSENCE) >> TE_V2_ABSENCE_POS;
+}
+
+static void iwl_mvm_te_v2_to_v1(const struct iwl_time_event_cmd_v2 *cmd_v2,
+                                struct iwl_time_event_cmd_v1 *cmd_v1)
+{
+        cmd_v1->id_and_color = cmd_v2->id_and_color;
+        cmd_v1->action = cmd_v2->action;
+        cmd_v1->id = cmd_v2->id;
+        cmd_v1->apply_time = cmd_v2->apply_time;
+        cmd_v1->max_delay = cmd_v2->max_delay;
+        cmd_v1->depends_on = cmd_v2->depends_on;
+        cmd_v1->interval = cmd_v2->interval;
+        cmd_v1->duration = cmd_v2->duration;
+        if (cmd_v2->repeat == TE_V2_REPEAT_ENDLESS)
+                cmd_v1->repeat = cpu_to_le32(TE_V1_REPEAT_ENDLESS);
+        else
+                cmd_v1->repeat = cpu_to_le32(cmd_v2->repeat);
+        cmd_v1->max_frags = cpu_to_le32(cmd_v2->max_frags);
+        cmd_v1->interval_reciprocal = 0; /* unused */
+
+        cmd_v1->dep_policy = cpu_to_le32(te_v2_get_dep_policy(cmd_v2->policy));
+        cmd_v1->is_present = cpu_to_le32(!te_v2_get_absence(cmd_v2->policy));
+        cmd_v1->notify = cpu_to_le32(te_v2_get_notify(cmd_v2->policy));
+}
+
+static int iwl_mvm_send_time_event_cmd(struct iwl_mvm *mvm,
+                                       const struct iwl_time_event_cmd_v2 *cmd)
+{
+        struct iwl_time_event_cmd_v1 cmd_v1;
+
+        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_TIME_EVENT_API_V2)
+                return iwl_mvm_send_cmd_pdu(mvm, TIME_EVENT_CMD, CMD_SYNC,
+                                            sizeof(*cmd), cmd);
+
+        iwl_mvm_te_v2_to_v1(cmd, &cmd_v1);
+        return iwl_mvm_send_cmd_pdu(mvm, TIME_EVENT_CMD, CMD_SYNC,
+                                    sizeof(cmd_v1), &cmd_v1);
+}
+
+
 static int iwl_mvm_time_event_send_add(struct iwl_mvm *mvm,
                                        struct ieee80211_vif *vif,
                                        struct iwl_mvm_time_event_data *te_data,
-                                       struct iwl_time_event_cmd *te_cmd)
+                                       struct iwl_time_event_cmd_v2 *te_cmd)
 {
         static const u8 time_event_response[] = { TIME_EVENT_CMD };
         struct iwl_notification_wait wait_time_event;
@@ -309,8 +364,7 @@ static int iwl_mvm_time_event_send_add(struct iwl_mvm *mvm,
                                    ARRAY_SIZE(time_event_response),
                                    iwl_mvm_time_event_response, te_data);
 
-        ret = iwl_mvm_send_cmd_pdu(mvm, TIME_EVENT_CMD, CMD_SYNC,
-                                   sizeof(*te_cmd), te_cmd);
+        ret = iwl_mvm_send_time_event_cmd(mvm, te_cmd);
         if (ret) {
                 IWL_ERR(mvm, "Couldn't send TIME_EVENT_CMD: %d\n", ret);
                 iwl_remove_notification(&mvm->notif_wait, &wait_time_event);
@@ -337,13 +391,12 @@ void iwl_mvm_protect_session(struct iwl_mvm *mvm,
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_mvm_time_event_data *te_data = &mvmvif->time_event_data;
-        struct iwl_time_event_cmd time_cmd = {};
+        struct iwl_time_event_cmd_v2 time_cmd = {};
 
         lockdep_assert_held(&mvm->mutex);
 
         if (te_data->running &&
-            time_after(te_data->end_jiffies,
-                       jiffies + TU_TO_JIFFIES(min_duration))) {
+            time_after(te_data->end_jiffies, TU_TO_EXP_TIME(min_duration))) {
                 IWL_DEBUG_TE(mvm, "We have enough time in the current TE: %u\n",
                              jiffies_to_msecs(te_data->end_jiffies - jiffies));
                 return;
@@ -372,17 +425,14 @@ void iwl_mvm_protect_session(struct iwl_mvm *mvm,
         time_cmd.apply_time =
                 cpu_to_le32(iwl_read_prph(mvm->trans, DEVICE_SYSTEM_TIME_REG));
 
-        time_cmd.dep_policy = TE_INDEPENDENT;
-        time_cmd.is_present = cpu_to_le32(1);
-        time_cmd.max_frags = cpu_to_le32(TE_FRAG_NONE);
+        time_cmd.max_frags = TE_V2_FRAG_NONE;
         time_cmd.max_delay = cpu_to_le32(500);
         /* TODO: why do we need to interval = bi if it is not periodic? */
         time_cmd.interval = cpu_to_le32(1);
-        time_cmd.interval_reciprocal = cpu_to_le32(iwl_mvm_reciprocal(1));
         time_cmd.duration = cpu_to_le32(duration);
-        time_cmd.repeat = cpu_to_le32(1);
-        time_cmd.notify = cpu_to_le32(TE_NOTIF_HOST_EVENT_START |
-                                      TE_NOTIF_HOST_EVENT_END);
+        time_cmd.repeat = 1;
+        time_cmd.policy = cpu_to_le16(TE_V2_NOTIF_HOST_EVENT_START |
+                                      TE_V2_NOTIF_HOST_EVENT_END);
 
         iwl_mvm_time_event_send_add(mvm, vif, te_data, &time_cmd);
 }
@@ -396,7 +446,7 @@ void iwl_mvm_remove_time_event(struct iwl_mvm *mvm,
                                struct iwl_mvm_vif *mvmvif,
                                struct iwl_mvm_time_event_data *te_data)
 {
-        struct iwl_time_event_cmd time_cmd = {};
+        struct iwl_time_event_cmd_v2 time_cmd = {};
         u32 id, uid;
         int ret;
 
@@ -433,8 +483,7 @@ void iwl_mvm_remove_time_event(struct iwl_mvm *mvm,
                 cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id, mvmvif->color));
 
         IWL_DEBUG_TE(mvm, "Removing TE 0x%x\n", le32_to_cpu(time_cmd.id));
-        ret = iwl_mvm_send_cmd_pdu(mvm, TIME_EVENT_CMD, CMD_SYNC,
-                                   sizeof(time_cmd), &time_cmd);
+        ret = iwl_mvm_send_time_event_cmd(mvm, &time_cmd);
         if (WARN_ON(ret))
                 return;
 }
@@ -454,7 +503,7 @@ int iwl_mvm_start_p2p_roc(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_mvm_time_event_data *te_data = &mvmvif->time_event_data;
-        struct iwl_time_event_cmd time_cmd = {};
+        struct iwl_time_event_cmd_v2 time_cmd = {};
 
         lockdep_assert_held(&mvm->mutex);
         if (te_data->running) {
@@ -485,8 +534,6 @@ int iwl_mvm_start_p2p_roc(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         }
 
         time_cmd.apply_time = cpu_to_le32(0);
-        time_cmd.dep_policy = cpu_to_le32(TE_INDEPENDENT);
-        time_cmd.is_present = cpu_to_le32(1);
         time_cmd.interval = cpu_to_le32(1);
 
         /*
@@ -495,12 +542,12 @@ int iwl_mvm_start_p2p_roc(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
          * scheduled. To improve the chances of it being scheduled, allow them
          * to be fragmented, and in addition allow them to be delayed.
          */
-        time_cmd.max_frags = cpu_to_le32(MSEC_TO_TU(duration)/20);
+        time_cmd.max_frags = min(MSEC_TO_TU(duration)/50, TE_V2_FRAG_ENDLESS);
         time_cmd.max_delay = cpu_to_le32(MSEC_TO_TU(duration/2));
         time_cmd.duration = cpu_to_le32(MSEC_TO_TU(duration));
-        time_cmd.repeat = cpu_to_le32(1);
-        time_cmd.notify = cpu_to_le32(TE_NOTIF_HOST_EVENT_START |
-                                      TE_NOTIF_HOST_EVENT_END);
+        time_cmd.repeat = 1;
+        time_cmd.policy = cpu_to_le16(TE_V2_NOTIF_HOST_EVENT_START |
+                                      TE_V2_NOTIF_HOST_EVENT_END);
 
         return iwl_mvm_time_event_send_add(mvm, vif, te_data, &time_cmd);
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/tt.c b/drivers/net/wireless/iwlwifi/mvm/tt.c
index d6ae7f16ac11..1f3282dff513 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tt.c
@@ -391,8 +391,7 @@ static void iwl_mvm_tt_tx_protection(struct iwl_mvm *mvm, bool enable)
                 mvmsta = (void *)sta->drv_priv;
                 if (enable == mvmsta->tt_tx_protection)
                         continue;
-                err = iwl_mvm_tx_protection(mvm, &mvmsta->lq_sta.lq,
-                                            mvmsta, enable);
+                err = iwl_mvm_tx_protection(mvm, mvmsta, enable);
                 if (err) {
                         IWL_ERR(mvm, "Failed to %s Tx protection\n",
                                 enable ? "enable" : "disable");
@@ -513,12 +512,39 @@ static const struct iwl_tt_params iwl7000_tt_params = {
         .support_tx_backoff = true,
 };
 
+static const struct iwl_tt_params iwl7000_high_temp_tt_params = {
+        .ct_kill_entry = 118,
+        .ct_kill_exit = 96,
+        .ct_kill_duration = 5,
+        .dynamic_smps_entry = 114,
+        .dynamic_smps_exit = 110,
+        .tx_protection_entry = 114,
+        .tx_protection_exit = 108,
+        .tx_backoff = {
+                {.temperature = 112, .backoff = 300},
+                {.temperature = 113, .backoff = 800},
+                {.temperature = 114, .backoff = 1500},
+                {.temperature = 115, .backoff = 3000},
+                {.temperature = 116, .backoff = 5000},
+                {.temperature = 117, .backoff = 10000},
+        },
+        .support_ct_kill = true,
+        .support_dynamic_smps = true,
+        .support_tx_protection = true,
+        .support_tx_backoff = true,
+};
+
 void iwl_mvm_tt_initialize(struct iwl_mvm *mvm)
 {
         struct iwl_mvm_tt_mgmt *tt = &mvm->thermal_throttle;
 
         IWL_DEBUG_TEMP(mvm, "Initialize Thermal Throttling\n");
-        tt->params = &iwl7000_tt_params;
+
+        if (mvm->cfg->high_temp)
+                tt->params = &iwl7000_high_temp_tt_params;
+        else
+                tt->params = &iwl7000_tt_params;
+
         tt->throttle = false;
         INIT_DELAYED_WORK(&tt->ct_kill_exit, check_exit_ctkill);
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index f0e96a927407..e05440d90319 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -91,11 +91,10 @@ static void iwl_mvm_set_tx_cmd(struct iwl_mvm *mvm, struct sk_buff *skb,
                 tx_flags |= TX_CMD_FLG_ACK | TX_CMD_FLG_BAR;
 
         /* High prio packet (wrt. BT coex) if it is EAPOL, MCAST or MGMT */
-        if (info->band == IEEE80211_BAND_2GHZ        &&
-            (skb->protocol == cpu_to_be16(ETH_P_PAE)  ||
-             is_multicast_ether_addr(hdr->addr1)      ||
-             ieee80211_is_back_req(fc)                ||
-             ieee80211_is_mgmt(fc)))
+        if (info->band == IEEE80211_BAND_2GHZ &&
+            (info->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO ||
+             is_multicast_ether_addr(hdr->addr1) ||
+             ieee80211_is_back_req(fc) || ieee80211_is_mgmt(fc)))
                 tx_flags |= TX_CMD_FLG_BT_DIS;
 
         if (ieee80211_has_morefrags(fc))
@@ -123,6 +122,8 @@ static void iwl_mvm_set_tx_cmd(struct iwl_mvm *mvm, struct sk_buff *skb,
                  * it
                  */
                 WARN_ON_ONCE(info->flags & IEEE80211_TX_CTL_AMPDU);
+        } else if (skb->protocol == cpu_to_be16(ETH_P_PAE)) {
+                tx_cmd->pm_frame_timeout = cpu_to_le16(2);
         } else {
                 tx_cmd->pm_frame_timeout = 0;
         }
@@ -171,7 +172,7 @@ static void iwl_mvm_set_tx_cmd_rate(struct iwl_mvm *mvm,
         }
 
         /*
-         * for data packets, rate info comes from the table inside he fw. This
+         * for data packets, rate info comes from the table inside the fw. This
          * table is controlled by LINK_QUALITY commands
          */
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/utils.c b/drivers/net/wireless/iwlwifi/mvm/utils.c
index 1e1332839e4a..a9c357491434 100644
--- a/drivers/net/wireless/iwlwifi/mvm/utils.c
+++ b/drivers/net/wireless/iwlwifi/mvm/utils.c
@@ -453,6 +453,29 @@ void iwl_mvm_dump_nic_error_log(struct iwl_mvm *mvm)
         IWL_ERR(mvm, "0x%08X | flow_handler\n", table.flow_handler);
 }
 
+void iwl_mvm_dump_sram(struct iwl_mvm *mvm)
+{
+        const struct fw_img *img;
+        int ofs, len = 0;
+        u8 *buf;
+
+        if (!mvm->ucode_loaded)
+                return;
+
+        img = &mvm->fw->img[mvm->cur_ucode];
+        ofs = img->sec[IWL_UCODE_SECTION_DATA].offset;
+        len = img->sec[IWL_UCODE_SECTION_DATA].len;
+
+        buf = kzalloc(len, GFP_KERNEL);
+        if (!buf)
+                return;
+
+        iwl_trans_read_mem_bytes(mvm->trans, ofs, buf, len);
+        iwl_print_hex_error(mvm->trans, buf, len);
+
+        kfree(buf);
+}
+
 /**
  * iwl_mvm_send_lq_cmd() - Send link quality command
  * @init: This command is sent as part of station initialization right