Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

Pull networking updates from David Miller:

 1) Seccomp BPF filters can now be JIT'd, from Alexei Starovoitov.

 2) Multiqueue support in xen-netback and xen-netfront, from Andrew J
    Benniston.

 3) Allow tweaking of aggregation settings in cdc_ncm driver, from Bjørn
    Mork.

 4) BPF now has a "random" opcode, from Chema Gonzalez.

 5) Add more BPF documentation and improve test framework, from Daniel
    Borkmann.

 6) Support TCP fastopen over ipv6, from Daniel Lee.

 7) Add software TSO helper functions and use them to support software
    TSO in mvneta and mv643xx_eth drivers.  From Ezequiel Garcia.

 8) Support software TSO in fec driver too, from Nimrod Andy.

 9) Add Broadcom SYSTEMPORT driver, from Florian Fainelli.

10) Handle broadcasts more gracefully over macvlan when there are large
    numbers of interfaces configured, from Herbert Xu.

11) Allow more control over fwmark used for non-socket based responses,
    from Lorenzo Colitti.

12) Do TCP congestion window limiting based upon measurements, from Neal
    Cardwell.

13) Support busy polling in SCTP, from Neal Horman.

14) Allow RSS key to be configured via ethtool, from Venkata Duvvuru.

15) Bridge promisc mode handling improvements from Vlad Yasevich.

16) Don't use inetpeer entries to implement ID generation any more, it
    performs poorly, from Eric Dumazet.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1522 commits)
  rtnetlink: fix userspace API breakage for iproute2 < v3.9.0
  tcp: fixing TLP's FIN recovery
  net: fec: Add software TSO support
  net: fec: Add Scatter/gather support
  net: fec: Increase buffer descriptor entry number
  net: fec: Factorize feature setting
  net: fec: Enable IP header hardware checksum
  net: fec: Factorize the .xmit transmit function
  bridge: fix compile error when compiling without IPv6 support
  bridge: fix smatch warning / potential null pointer dereference
  via-rhine: fix full-duplex with autoneg disable
  bnx2x: Enlarge the dorq threshold for VFs
  bnx2x: Check for UNDI in uncommon branch
  bnx2x: Fix 1G-baseT link
  bnx2x: Fix link for KR with swapped polarity lane
  sctp: Fix sk_ack_backlog wrap-around problem
  net/core: Add VF link state control policy
  net/fsl: xgmac_mdio is dependent on OF_MDIO
  net/fsl: Make xgmac_mdio read error message useful
  net_sched: drr: warn when qdisc is not work conserving
  ...

282 files changed, 8669 insertions, 5481 deletions

diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
index 99b3bfa717d5..d48776e4f343 100644
--- a/drivers/net/wireless/at76c50x-usb.c
+++ b/drivers/net/wireless/at76c50x-usb.c
@@ -365,15 +365,15 @@ static inline unsigned long at76_get_timeout(struct dfu_status *s)
 static int at76_usbdfu_download(struct usb_device *udev, u8 *buf, u32 size,
                                 int manifest_sync_timeout)
 {
-        u8 *block;
-        struct dfu_status dfu_stat_buf;
         int ret = 0;
         int need_dfu_state = 1;
         int is_done = 0;
-        u8 dfu_state = 0;
         u32 dfu_timeout = 0;
         int bsize = 0;
         int blockno = 0;
+        struct dfu_status *dfu_stat_buf = NULL;
+        u8 *dfu_state = NULL;
+        u8 *block = NULL;
 
         at76_dbg(DBG_DFU, "%s( %p, %u, %d)", __func__, buf, size,
                  manifest_sync_timeout);
@@ -383,13 +383,28 @@ static int at76_usbdfu_download(struct usb_device *udev, u8 *buf, u32 size,
                 return -EINVAL;
         }
 
+        dfu_stat_buf = kmalloc(sizeof(struct dfu_status), GFP_KERNEL);
+        if (!dfu_stat_buf) {
+                ret = -ENOMEM;
+                goto exit;
+        }
+
         block = kmalloc(FW_BLOCK_SIZE, GFP_KERNEL);
-        if (!block)
-                return -ENOMEM;
+        if (!block) {
+                ret = -ENOMEM;
+                goto exit;
+        }
+
+        dfu_state = kmalloc(sizeof(u8), GFP_KERNEL);
+        if (!dfu_state) {
+                ret = -ENOMEM;
+                goto exit;
+        }
+        *dfu_state = 0;
 
         do {
                 if (need_dfu_state) {
-                        ret = at76_dfu_get_state(udev, &dfu_state);
+                        ret = at76_dfu_get_state(udev, dfu_state);
                         if (ret < 0) {
                                 dev_err(&udev->dev,
                                         "cannot get DFU state: %d\n", ret);
@@ -398,13 +413,13 @@ static int at76_usbdfu_download(struct usb_device *udev, u8 *buf, u32 size,
                         need_dfu_state = 0;
                 }
 
-                switch (dfu_state) {
+                switch (*dfu_state) {
                 case STATE_DFU_DOWNLOAD_SYNC:
                         at76_dbg(DBG_DFU, "STATE_DFU_DOWNLOAD_SYNC");
-                        ret = at76_dfu_get_status(udev, &dfu_stat_buf);
+                        ret = at76_dfu_get_status(udev, dfu_stat_buf);
                         if (ret >= 0) {
-                                dfu_state = dfu_stat_buf.state;
-                                dfu_timeout = at76_get_timeout(&dfu_stat_buf);
+                                *dfu_state = dfu_stat_buf->state;
+                                dfu_timeout = at76_get_timeout(dfu_stat_buf);
                                 need_dfu_state = 0;
                         } else
                                 dev_err(&udev->dev,
@@ -447,12 +462,12 @@ static int at76_usbdfu_download(struct usb_device *udev, u8 *buf, u32 size,
                 case STATE_DFU_MANIFEST_SYNC:
                         at76_dbg(DBG_DFU, "STATE_DFU_MANIFEST_SYNC");
 
-                        ret = at76_dfu_get_status(udev, &dfu_stat_buf);
+                        ret = at76_dfu_get_status(udev, dfu_stat_buf);
                         if (ret < 0)
                                 break;
 
-                        dfu_state = dfu_stat_buf.state;
-                        dfu_timeout = at76_get_timeout(&dfu_stat_buf);
+                        *dfu_state = dfu_stat_buf->state;
+                        dfu_timeout = at76_get_timeout(dfu_stat_buf);
                         need_dfu_state = 0;
 
                         /* override the timeout from the status response,
@@ -484,14 +499,17 @@ static int at76_usbdfu_download(struct usb_device *udev, u8 *buf, u32 size,
                         break;
 
                 default:
-                        at76_dbg(DBG_DFU, "DFU UNKNOWN STATE (%d)", dfu_state);
+                        at76_dbg(DBG_DFU, "DFU UNKNOWN STATE (%d)", *dfu_state);
                         ret = -EINVAL;
                         break;
                 }
         } while (!is_done && (ret >= 0));
 
 exit:
+        kfree(dfu_state);
         kfree(block);
+        kfree(dfu_stat_buf);
+
         if (ret >= 0)
                 ret = 0;
 
@@ -1277,6 +1295,7 @@ static int at76_load_external_fw(struct usb_device *udev, struct fwentry *fwe)
                         dev_err(&udev->dev,
                                 "loading %dth firmware block failed: %d\n",
                                 blockno, ret);
+                        ret = -EIO;
                         goto exit;
                 }
                 buf += bsize;
@@ -1410,6 +1429,8 @@ static int at76_startup_device(struct at76_priv *priv)
         /* remove BSSID from previous run */
         memset(priv->bssid, 0, ETH_ALEN);
 
+        priv->scanning = false;
+
         if (at76_set_radio(priv, 1) == 1)
                 at76_wait_completion(priv, CMD_RADIO_ON);
 
@@ -1483,6 +1504,52 @@ static void at76_work_submit_rx(struct work_struct *work)
         mutex_unlock(&priv->mtx);
 }
 
+/* This is a workaround to make scan working:
+ * currently mac80211 does not process frames with no frequency
+ * information.
+ * However during scan the HW performs a sweep by itself, and we
+ * are unable to know where the radio is actually tuned.
+ * This function tries to do its best to guess this information..
+ * During scan, If the current frame is a beacon or a probe response,
+ * the channel information is extracted from it.
+ * When not scanning, for other frames, or if it happens that for
+ * whatever reason we fail to parse beacons and probe responses, this
+ * function returns the priv->channel information, that should be correct
+ * at least when we are not scanning.
+ */
+static inline int at76_guess_freq(struct at76_priv *priv)
+{
+        size_t el_off;
+        const u8 *el;
+        int channel = priv->channel;
+        int len = priv->rx_skb->len;
+        struct ieee80211_hdr *hdr = (void *)priv->rx_skb->data;
+
+        if (!priv->scanning)
+                goto exit;
+
+        if (len < 24)
+                goto exit;
+
+        if (ieee80211_is_probe_resp(hdr->frame_control)) {
+                el_off = offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
+                el = ((struct ieee80211_mgmt *)hdr)->u.probe_resp.variable;
+        } else if (ieee80211_is_beacon(hdr->frame_control)) {
+                el_off = offsetof(struct ieee80211_mgmt, u.beacon.variable);
+                el = ((struct ieee80211_mgmt *)hdr)->u.beacon.variable;
+        } else {
+                goto exit;
+        }
+        len -= el_off;
+
+        el = cfg80211_find_ie(WLAN_EID_DS_PARAMS, el, len);
+        if (el && el[1] > 0)
+                channel = el[2];
+
+exit:
+        return ieee80211_channel_to_frequency(channel, IEEE80211_BAND_2GHZ);
+}
+
 static void at76_rx_tasklet(unsigned long param)
 {
         struct urb *urb = (struct urb *)param;
@@ -1523,6 +1590,8 @@ static void at76_rx_tasklet(unsigned long param)
         rx_status.signal = buf->rssi;
         rx_status.flag |= RX_FLAG_DECRYPTED;
         rx_status.flag |= RX_FLAG_IV_STRIPPED;
+        rx_status.band = IEEE80211_BAND_2GHZ;
+        rx_status.freq = at76_guess_freq(priv);
 
         at76_dbg(DBG_MAC80211, "calling ieee80211_rx_irqsafe(): %d/%d",
                  priv->rx_skb->len, priv->rx_skb->data_len);
@@ -1875,6 +1944,8 @@ static void at76_dwork_hw_scan(struct work_struct *work)
         if (is_valid_ether_addr(priv->bssid))
                 at76_join(priv);
 
+        priv->scanning = false;
+
         mutex_unlock(&priv->mtx);
 
         ieee80211_scan_completed(priv->hw, false);
@@ -1929,6 +2000,7 @@ static int at76_hw_scan(struct ieee80211_hw *hw,
                 goto exit;
         }
 
+        priv->scanning = true;
         ieee80211_queue_delayed_work(priv->hw, &priv->dwork_hw_scan,
                                      SCAN_POLL_INTERVAL);
 
@@ -2020,6 +2092,44 @@ static void at76_configure_filter(struct ieee80211_hw *hw,
         ieee80211_queue_work(hw, &priv->work_set_promisc);
 }
 
+static int at76_set_wep(struct at76_priv *priv)
+{
+        int ret = 0;
+        struct mib_mac_wep *mib_data = &priv->mib_buf.data.wep_mib;
+
+        priv->mib_buf.type = MIB_MAC_WEP;
+        priv->mib_buf.size = sizeof(struct mib_mac_wep);
+        priv->mib_buf.index = 0;
+
+        memset(mib_data, 0, sizeof(*mib_data));
+
+        if (priv->wep_enabled) {
+                if (priv->wep_keys_len[priv->wep_key_id] > WEP_SMALL_KEY_LEN)
+                        mib_data->encryption_level = 2;
+                else
+                        mib_data->encryption_level = 1;
+
+                /* always exclude unencrypted if WEP is active */
+                mib_data->exclude_unencrypted = 1;
+        } else {
+                mib_data->exclude_unencrypted = 0;
+                mib_data->encryption_level = 0;
+        }
+
+        mib_data->privacy_invoked = priv->wep_enabled;
+        mib_data->wep_default_key_id = priv->wep_key_id;
+        memcpy(mib_data->wep_default_keyvalue, priv->wep_keys,
+               sizeof(priv->wep_keys));
+
+        ret = at76_set_mib(priv, &priv->mib_buf);
+
+        if (ret < 0)
+                wiphy_err(priv->hw->wiphy,
+                          "set_mib (wep) failed: %d\n", ret);
+
+        return ret;
+}
+
 static int at76_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                         struct ieee80211_vif *vif, struct ieee80211_sta *sta,
                         struct ieee80211_key_conf *key)
@@ -2062,7 +2172,7 @@ static int at76_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                         priv->wep_enabled = 1;
         }
 
-        at76_startup_device(priv);
+        at76_set_wep(priv);
 
         mutex_unlock(&priv->mtx);
 
@@ -2330,16 +2440,22 @@ static int at76_probe(struct usb_interface *interface,
         struct usb_device *udev;
         int op_mode;
         int need_ext_fw = 0;
-        struct mib_fw_version fwv;
+        struct mib_fw_version *fwv = NULL;
         int board_type = (int)id->driver_info;
 
         udev = usb_get_dev(interface_to_usbdev(interface));
 
+        fwv = kmalloc(sizeof(*fwv), GFP_KERNEL);
+        if (!fwv) {
+                ret = -ENOMEM;
+                goto exit;
+        }
+
         /* Load firmware into kernel memory */
         fwe = at76_load_firmware(udev, board_type);
         if (!fwe) {
                 ret = -ENOENT;
-                goto error;
+                goto exit;
         }
 
         op_mode = at76_get_op_mode(udev);
@@ -2353,7 +2469,7 @@ static int at76_probe(struct usb_interface *interface,
                 dev_err(&interface->dev,
                         "cannot handle a device in HW_CONFIG_MODE\n");
                 ret = -EBUSY;
-                goto error;
+                goto exit;
         }
 
         if (op_mode != OPMODE_NORMAL_NIC_WITH_FLASH
@@ -2366,10 +2482,10 @@ static int at76_probe(struct usb_interface *interface,
                         dev_err(&interface->dev,
                                 "error %d downloading internal firmware\n",
                                 ret);
-                        goto error;
+                        goto exit;
                 }
                 usb_put_dev(udev);
-                return ret;
+                goto exit;
         }
 
         /* Internal firmware already inside the device.  Get firmware
@@ -2382,8 +2498,8 @@ static int at76_probe(struct usb_interface *interface,
          * query the device for the fw version */
         if ((fwe->fw_version.major > 0 || fwe->fw_version.minor >= 100)
             || (op_mode == OPMODE_NORMAL_NIC_WITH_FLASH)) {
-                ret = at76_get_mib(udev, MIB_FW_VERSION, &fwv, sizeof(fwv));
-                if (ret < 0 || (fwv.major | fwv.minor) == 0)
+                ret = at76_get_mib(udev, MIB_FW_VERSION, fwv, sizeof(*fwv));
+                if (ret < 0 || (fwv->major | fwv->minor) == 0)
                         need_ext_fw = 1;
         } else
                 /* No way to check firmware version, reload to be sure */
@@ -2394,37 +2510,37 @@ static int at76_probe(struct usb_interface *interface,
                            "downloading external firmware\n");
 
                 ret = at76_load_external_fw(udev, fwe);
-                if (ret)
-                        goto error;
+                if (ret < 0)
+                        goto exit;
 
                 /* Re-check firmware version */
-                ret = at76_get_mib(udev, MIB_FW_VERSION, &fwv, sizeof(fwv));
+                ret = at76_get_mib(udev, MIB_FW_VERSION, fwv, sizeof(*fwv));
                 if (ret < 0) {
                         dev_err(&interface->dev,
                                 "error %d getting firmware version\n", ret);
-                        goto error;
+                        goto exit;
                 }
         }
 
         priv = at76_alloc_new_device(udev);
         if (!priv) {
                 ret = -ENOMEM;
-                goto error;
+                goto exit;
         }
 
         usb_set_intfdata(interface, priv);
 
-        memcpy(&priv->fw_version, &fwv, sizeof(struct mib_fw_version));
+        memcpy(&priv->fw_version, fwv, sizeof(struct mib_fw_version));
         priv->board_type = board_type;
 
         ret = at76_init_new_device(priv, interface);
         if (ret < 0)
                 at76_delete_device(priv);
 
-        return ret;
-
-error:
-        usb_put_dev(udev);
+exit:
+        kfree(fwv);
+        if (ret < 0)
+                usb_put_dev(udev);
         return ret;
 }
 
diff --git a/drivers/net/wireless/at76c50x-usb.h b/drivers/net/wireless/at76c50x-usb.h
index f14a65473fe8..55090a38ac95 100644
--- a/drivers/net/wireless/at76c50x-usb.h
+++ b/drivers/net/wireless/at76c50x-usb.h
@@ -219,18 +219,6 @@ struct at76_req_join {
         u8 reserved;
 } __packed;
 
-struct set_mib_buffer {
-        u8 type;
-        u8 size;
-        u8 index;
-        u8 reserved;
-        union {
-                u8 byte;
-                __le16 word;
-                u8 addr[ETH_ALEN];
-        } data;
-} __packed;
-
 struct mib_local {
         u16 reserved0;
         u8 beacon_enable;
@@ -334,6 +322,19 @@ struct mib_mdomain {
         u8 channel_list[14];    /* 0 for invalid channels */
 } __packed;
 
+struct set_mib_buffer {
+        u8 type;
+        u8 size;
+        u8 index;
+        u8 reserved;
+        union {
+                u8 byte;
+                __le16 word;
+                u8 addr[ETH_ALEN];
+                struct mib_mac_wep wep_mib;
+        } data;
+} __packed;
+
 struct at76_fw_header {
         __le32 crc;             /* CRC32 of the whole image */
         __le32 board_type;      /* firmware compatibility code */
@@ -417,6 +418,7 @@ struct at76_priv {
         int scan_max_time;      /* scan max channel time */
         int scan_mode;          /* SCAN_TYPE_ACTIVE, SCAN_TYPE_PASSIVE */
         int scan_need_any;      /* if set, need to scan for any ESSID */
+        bool scanning;          /* if set, the scan is running */
 
         u16 assoc_id;           /* current association ID, if associated */
 
diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c
index 507d9a9ee69a..f92050617ae6 100644
--- a/drivers/net/wireless/ath/ar5523/ar5523.c
+++ b/drivers/net/wireless/ath/ar5523/ar5523.c
@@ -1090,7 +1090,8 @@ static int ar5523_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
         return ret;
 }
 
-static void ar5523_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+static void ar5523_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                         u32 queues, bool drop)
 {
         struct ar5523 *ar = hw->priv;
 
diff --git a/drivers/net/wireless/ath/ath10k/bmi.c b/drivers/net/wireless/ath/ath10k/bmi.c
index a1f099628850..17d221abd58c 100644
--- a/drivers/net/wireless/ath/ath10k/bmi.c
+++ b/drivers/net/wireless/ath/ath10k/bmi.c
@@ -175,7 +175,7 @@ int ath10k_bmi_write_memory(struct ath10k *ar,
         return 0;
 }
 
-int ath10k_bmi_execute(struct ath10k *ar, u32 address, u32 *param)
+int ath10k_bmi_execute(struct ath10k *ar, u32 address, u32 param, u32 *result)
 {
         struct bmi_cmd cmd;
         union bmi_resp resp;
@@ -184,7 +184,7 @@ int ath10k_bmi_execute(struct ath10k *ar, u32 address, u32 *param)
         int ret;
 
         ath10k_dbg(ATH10K_DBG_BMI, "bmi execute address 0x%x param 0x%x\n",
-                   address, *param);
+                   address, param);
 
         if (ar->bmi.done_sent) {
                 ath10k_warn("command disallowed\n");
@@ -193,7 +193,7 @@ int ath10k_bmi_execute(struct ath10k *ar, u32 address, u32 *param)
 
         cmd.id            = __cpu_to_le32(BMI_EXECUTE);
         cmd.execute.addr  = __cpu_to_le32(address);
-        cmd.execute.param = __cpu_to_le32(*param);
+        cmd.execute.param = __cpu_to_le32(param);
 
         ret = ath10k_hif_exchange_bmi_msg(ar, &cmd, cmdlen, &resp, &resplen);
         if (ret) {
@@ -204,10 +204,13 @@ int ath10k_bmi_execute(struct ath10k *ar, u32 address, u32 *param)
         if (resplen < sizeof(resp.execute)) {
                 ath10k_warn("invalid execute response length (%d)\n",
                             resplen);
-                return ret;
+                return -EIO;
         }
 
-        *param = __le32_to_cpu(resp.execute.result);
+        *result = __le32_to_cpu(resp.execute.result);
+
+        ath10k_dbg(ATH10K_DBG_BMI, "bmi execute result 0x%x\n", *result);
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/ath/ath10k/bmi.h b/drivers/net/wireless/ath/ath10k/bmi.h
index 8d81ce1cec21..111ab701465c 100644
--- a/drivers/net/wireless/ath/ath10k/bmi.h
+++ b/drivers/net/wireless/ath/ath10k/bmi.h
@@ -201,7 +201,8 @@ int ath10k_bmi_write_memory(struct ath10k *ar, u32 address,
                                                                         \
                 addr = host_interest_item_address(HI_ITEM(item));       \
                 ret = ath10k_bmi_read_memory(ar, addr, (u8 *)&tmp, 4); \
-                *val = __le32_to_cpu(tmp);                              \
+                if (!ret)                                               \
+                        *val = __le32_to_cpu(tmp);                      \
                 ret;                                                    \
          })
 
@@ -217,7 +218,7 @@ int ath10k_bmi_write_memory(struct ath10k *ar, u32 address,
                 ret;                                                    \
         })
 
-int ath10k_bmi_execute(struct ath10k *ar, u32 address, u32 *param);
+int ath10k_bmi_execute(struct ath10k *ar, u32 address, u32 param, u32 *result);
 int ath10k_bmi_lz_stream_start(struct ath10k *ar, u32 address);
 int ath10k_bmi_lz_data(struct ath10k *ar, const void *buffer, u32 length);
 int ath10k_bmi_fast_download(struct ath10k *ar, u32 address,
diff --git a/drivers/net/wireless/ath/ath10k/ce.c b/drivers/net/wireless/ath/ath10k/ce.c
index a79499c82350..d185dc0cd12b 100644
--- a/drivers/net/wireless/ath/ath10k/ce.c
+++ b/drivers/net/wireless/ath/ath10k/ce.c
@@ -329,6 +329,33 @@ exit:
         return ret;
 }
 
+void __ath10k_ce_send_revert(struct ath10k_ce_pipe *pipe)
+{
+        struct ath10k *ar = pipe->ar;
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+        struct ath10k_ce_ring *src_ring = pipe->src_ring;
+        u32 ctrl_addr = pipe->ctrl_addr;
+
+        lockdep_assert_held(&ar_pci->ce_lock);
+
+        /*
+         * This function must be called only if there is an incomplete
+         * scatter-gather transfer (before index register is updated)
+         * that needs to be cleaned up.
+         */
+        if (WARN_ON_ONCE(src_ring->write_index == src_ring->sw_index))
+                return;
+
+        if (WARN_ON_ONCE(src_ring->write_index ==
+                         ath10k_ce_src_ring_write_index_get(ar, ctrl_addr)))
+                return;
+
+        src_ring->write_index--;
+        src_ring->write_index &= src_ring->nentries_mask;
+
+        src_ring->per_transfer_context[src_ring->write_index] = NULL;
+}
+
 int ath10k_ce_send(struct ath10k_ce_pipe *ce_state,
                    void *per_transfer_context,
                    u32 buffer,
@@ -840,35 +867,17 @@ void ath10k_ce_recv_cb_register(struct ath10k_ce_pipe *ce_state,
 
 static int ath10k_ce_init_src_ring(struct ath10k *ar,
                                    unsigned int ce_id,
-                                   struct ath10k_ce_pipe *ce_state,
                                    const struct ce_attr *attr)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct ath10k_ce_ring *src_ring;
-        unsigned int nentries = attr->src_nentries;
-        unsigned int ce_nbytes;
-        u32 ctrl_addr = ath10k_ce_base_address(ce_id);
-        dma_addr_t base_addr;
-        char *ptr;
-
-        nentries = roundup_pow_of_two(nentries);
-
-        if (ce_state->src_ring) {
-                WARN_ON(ce_state->src_ring->nentries != nentries);
-                return 0;
-        }
-
-        ce_nbytes = sizeof(struct ath10k_ce_ring) + (nentries * sizeof(void *));
-        ptr = kzalloc(ce_nbytes, GFP_KERNEL);
-        if (ptr == NULL)
-                return -ENOMEM;
+        struct ath10k_ce_pipe *ce_state = &ar_pci->ce_states[ce_id];
+        struct ath10k_ce_ring *src_ring = ce_state->src_ring;
+        u32 nentries, ctrl_addr = ath10k_ce_base_address(ce_id);
 
-        ce_state->src_ring = (struct ath10k_ce_ring *)ptr;
-        src_ring = ce_state->src_ring;
+        nentries = roundup_pow_of_two(attr->src_nentries);
 
-        ptr += sizeof(struct ath10k_ce_ring);
-        src_ring->nentries = nentries;
-        src_ring->nentries_mask = nentries - 1;
+        memset(src_ring->per_transfer_context, 0,
+               nentries * sizeof(*src_ring->per_transfer_context));
 
         src_ring->sw_index = ath10k_ce_src_ring_read_index_get(ar, ctrl_addr);
         src_ring->sw_index &= src_ring->nentries_mask;
@@ -878,21 +887,87 @@ static int ath10k_ce_init_src_ring(struct ath10k *ar,
                 ath10k_ce_src_ring_write_index_get(ar, ctrl_addr);
         src_ring->write_index &= src_ring->nentries_mask;
 
-        src_ring->per_transfer_context = (void **)ptr;
+        ath10k_ce_src_ring_base_addr_set(ar, ctrl_addr,
+                                         src_ring->base_addr_ce_space);
+        ath10k_ce_src_ring_size_set(ar, ctrl_addr, nentries);
+        ath10k_ce_src_ring_dmax_set(ar, ctrl_addr, attr->src_sz_max);
+        ath10k_ce_src_ring_byte_swap_set(ar, ctrl_addr, 0);
+        ath10k_ce_src_ring_lowmark_set(ar, ctrl_addr, 0);
+        ath10k_ce_src_ring_highmark_set(ar, ctrl_addr, nentries);
+
+        ath10k_dbg(ATH10K_DBG_BOOT,
+                   "boot init ce src ring id %d entries %d base_addr %p\n",
+                   ce_id, nentries, src_ring->base_addr_owner_space);
+
+        return 0;
+}
+
+static int ath10k_ce_init_dest_ring(struct ath10k *ar,
+                                    unsigned int ce_id,
+                                    const struct ce_attr *attr)
+{
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+        struct ath10k_ce_pipe *ce_state = &ar_pci->ce_states[ce_id];
+        struct ath10k_ce_ring *dest_ring = ce_state->dest_ring;
+        u32 nentries, ctrl_addr = ath10k_ce_base_address(ce_id);
+
+        nentries = roundup_pow_of_two(attr->dest_nentries);
+
+        memset(dest_ring->per_transfer_context, 0,
+               nentries * sizeof(*dest_ring->per_transfer_context));
+
+        dest_ring->sw_index = ath10k_ce_dest_ring_read_index_get(ar, ctrl_addr);
+        dest_ring->sw_index &= dest_ring->nentries_mask;
+        dest_ring->write_index =
+                ath10k_ce_dest_ring_write_index_get(ar, ctrl_addr);
+        dest_ring->write_index &= dest_ring->nentries_mask;
+
+        ath10k_ce_dest_ring_base_addr_set(ar, ctrl_addr,
+                                          dest_ring->base_addr_ce_space);
+        ath10k_ce_dest_ring_size_set(ar, ctrl_addr, nentries);
+        ath10k_ce_dest_ring_byte_swap_set(ar, ctrl_addr, 0);
+        ath10k_ce_dest_ring_lowmark_set(ar, ctrl_addr, 0);
+        ath10k_ce_dest_ring_highmark_set(ar, ctrl_addr, nentries);
+
+        ath10k_dbg(ATH10K_DBG_BOOT,
+                   "boot ce dest ring id %d entries %d base_addr %p\n",
+                   ce_id, nentries, dest_ring->base_addr_owner_space);
+
+        return 0;
+}
+
+static struct ath10k_ce_ring *
+ath10k_ce_alloc_src_ring(struct ath10k *ar, unsigned int ce_id,
+                         const struct ce_attr *attr)
+{
+        struct ath10k_ce_ring *src_ring;
+        u32 nentries = attr->src_nentries;
+        dma_addr_t base_addr;
+
+        nentries = roundup_pow_of_two(nentries);
+
+        src_ring = kzalloc(sizeof(*src_ring) +
+                           (nentries *
+                            sizeof(*src_ring->per_transfer_context)),
+                           GFP_KERNEL);
+        if (src_ring == NULL)
+                return ERR_PTR(-ENOMEM);
+
+        src_ring->nentries = nentries;
+        src_ring->nentries_mask = nentries - 1;
 
         /*
          * Legacy platforms that do not support cache
          * coherent DMA are unsupported
          */
         src_ring->base_addr_owner_space_unaligned =
-                pci_alloc_consistent(ar_pci->pdev,
-                                     (nentries * sizeof(struct ce_desc) +
-                                      CE_DESC_RING_ALIGN),
-                                     &base_addr);
+                dma_alloc_coherent(ar->dev,
+                                   (nentries * sizeof(struct ce_desc) +
+                                    CE_DESC_RING_ALIGN),
+                                   &base_addr, GFP_KERNEL);
         if (!src_ring->base_addr_owner_space_unaligned) {
-                kfree(ce_state->src_ring);
-                ce_state->src_ring = NULL;
-                return -ENOMEM;
+                kfree(src_ring);
+                return ERR_PTR(-ENOMEM);
         }
 
         src_ring->base_addr_ce_space_unaligned = base_addr;
@@ -912,88 +987,54 @@ static int ath10k_ce_init_src_ring(struct ath10k *ar,
                 kmalloc((nentries * sizeof(struct ce_desc) +
                          CE_DESC_RING_ALIGN), GFP_KERNEL);
         if (!src_ring->shadow_base_unaligned) {
-                pci_free_consistent(ar_pci->pdev,
-                                    (nentries * sizeof(struct ce_desc) +
-                                     CE_DESC_RING_ALIGN),
-                                    src_ring->base_addr_owner_space,
-                                    src_ring->base_addr_ce_space);
-                kfree(ce_state->src_ring);
-                ce_state->src_ring = NULL;
-                return -ENOMEM;
+                dma_free_coherent(ar->dev,
+                                  (nentries * sizeof(struct ce_desc) +
+                                   CE_DESC_RING_ALIGN),
+                                  src_ring->base_addr_owner_space,
+                                  src_ring->base_addr_ce_space);
+                kfree(src_ring);
+                return ERR_PTR(-ENOMEM);
         }
 
         src_ring->shadow_base = PTR_ALIGN(
                         src_ring->shadow_base_unaligned,
                         CE_DESC_RING_ALIGN);
 
-        ath10k_ce_src_ring_base_addr_set(ar, ctrl_addr,
-                                         src_ring->base_addr_ce_space);
-        ath10k_ce_src_ring_size_set(ar, ctrl_addr, nentries);
-        ath10k_ce_src_ring_dmax_set(ar, ctrl_addr, attr->src_sz_max);
-        ath10k_ce_src_ring_byte_swap_set(ar, ctrl_addr, 0);
-        ath10k_ce_src_ring_lowmark_set(ar, ctrl_addr, 0);
-        ath10k_ce_src_ring_highmark_set(ar, ctrl_addr, nentries);
-
-        ath10k_dbg(ATH10K_DBG_BOOT,
-                   "boot ce src ring id %d entries %d base_addr %p\n",
-                   ce_id, nentries, src_ring->base_addr_owner_space);
-
-        return 0;
+        return src_ring;
 }
 
-static int ath10k_ce_init_dest_ring(struct ath10k *ar,
-                                    unsigned int ce_id,
-                                    struct ath10k_ce_pipe *ce_state,
-                                    const struct ce_attr *attr)
+static struct ath10k_ce_ring *
+ath10k_ce_alloc_dest_ring(struct ath10k *ar, unsigned int ce_id,
+                          const struct ce_attr *attr)
 {
-        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         struct ath10k_ce_ring *dest_ring;
-        unsigned int nentries = attr->dest_nentries;
-        unsigned int ce_nbytes;
-        u32 ctrl_addr = ath10k_ce_base_address(ce_id);
+        u32 nentries;
         dma_addr_t base_addr;
-        char *ptr;
 
-        nentries = roundup_pow_of_two(nentries);
+        nentries = roundup_pow_of_two(attr->dest_nentries);
 
-        if (ce_state->dest_ring) {
-                WARN_ON(ce_state->dest_ring->nentries != nentries);
-                return 0;
-        }
-
-        ce_nbytes = sizeof(struct ath10k_ce_ring) + (nentries * sizeof(void *));
-        ptr = kzalloc(ce_nbytes, GFP_KERNEL);
-        if (ptr == NULL)
-                return -ENOMEM;
+        dest_ring = kzalloc(sizeof(*dest_ring) +
+                            (nentries *
+                             sizeof(*dest_ring->per_transfer_context)),
+                            GFP_KERNEL);
+        if (dest_ring == NULL)
+                return ERR_PTR(-ENOMEM);
 
-        ce_state->dest_ring = (struct ath10k_ce_ring *)ptr;
-        dest_ring = ce_state->dest_ring;
-
-        ptr += sizeof(struct ath10k_ce_ring);
         dest_ring->nentries = nentries;
         dest_ring->nentries_mask = nentries - 1;
 
-        dest_ring->sw_index = ath10k_ce_dest_ring_read_index_get(ar, ctrl_addr);
-        dest_ring->sw_index &= dest_ring->nentries_mask;
-        dest_ring->write_index =
-                ath10k_ce_dest_ring_write_index_get(ar, ctrl_addr);
-        dest_ring->write_index &= dest_ring->nentries_mask;
-
-        dest_ring->per_transfer_context = (void **)ptr;
-
         /*
          * Legacy platforms that do not support cache
          * coherent DMA are unsupported
          */
         dest_ring->base_addr_owner_space_unaligned =
-                pci_alloc_consistent(ar_pci->pdev,
-                                     (nentries * sizeof(struct ce_desc) +
-                                      CE_DESC_RING_ALIGN),
-                                     &base_addr);
+                dma_alloc_coherent(ar->dev,
+                                   (nentries * sizeof(struct ce_desc) +
+                                    CE_DESC_RING_ALIGN),
+                                   &base_addr, GFP_KERNEL);
         if (!dest_ring->base_addr_owner_space_unaligned) {
-                kfree(ce_state->dest_ring);
-                ce_state->dest_ring = NULL;
-                return -ENOMEM;
+                kfree(dest_ring);
+                return ERR_PTR(-ENOMEM);
         }
 
         dest_ring->base_addr_ce_space_unaligned = base_addr;
@@ -1012,39 +1053,7 @@ static int ath10k_ce_init_dest_ring(struct ath10k *ar,
                         dest_ring->base_addr_ce_space_unaligned,
                         CE_DESC_RING_ALIGN);
 
-        ath10k_ce_dest_ring_base_addr_set(ar, ctrl_addr,
-                                          dest_ring->base_addr_ce_space);
-        ath10k_ce_dest_ring_size_set(ar, ctrl_addr, nentries);
-        ath10k_ce_dest_ring_byte_swap_set(ar, ctrl_addr, 0);
-        ath10k_ce_dest_ring_lowmark_set(ar, ctrl_addr, 0);
-        ath10k_ce_dest_ring_highmark_set(ar, ctrl_addr, nentries);
-
-        ath10k_dbg(ATH10K_DBG_BOOT,
-                   "boot ce dest ring id %d entries %d base_addr %p\n",
-                   ce_id, nentries, dest_ring->base_addr_owner_space);
-
-        return 0;
-}
-
-static struct ath10k_ce_pipe *ath10k_ce_init_state(struct ath10k *ar,
-                                             unsigned int ce_id,
-                                             const struct ce_attr *attr)
-{
-        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct ath10k_ce_pipe *ce_state = &ar_pci->ce_states[ce_id];
-        u32 ctrl_addr = ath10k_ce_base_address(ce_id);
-
-        spin_lock_bh(&ar_pci->ce_lock);
-
-        ce_state->ar = ar;
-        ce_state->id = ce_id;
-        ce_state->ctrl_addr = ctrl_addr;
-        ce_state->attr_flags = attr->flags;
-        ce_state->src_sz_max = attr->src_sz_max;
-
-        spin_unlock_bh(&ar_pci->ce_lock);
-
-        return ce_state;
+        return dest_ring;
 }
 
 /*
@@ -1054,11 +1063,11 @@ static struct ath10k_ce_pipe *ath10k_ce_init_state(struct ath10k *ar,
  * initialization. It may be that only one side or the other is
  * initialized by software/firmware.
  */
-struct ath10k_ce_pipe *ath10k_ce_init(struct ath10k *ar,
-                                unsigned int ce_id,
-                                const struct ce_attr *attr)
+int ath10k_ce_init_pipe(struct ath10k *ar, unsigned int ce_id,
+                        const struct ce_attr *attr)
 {
-        struct ath10k_ce_pipe *ce_state;
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+        struct ath10k_ce_pipe *ce_state = &ar_pci->ce_states[ce_id];
         int ret;
 
         /*
@@ -1074,64 +1083,128 @@ struct ath10k_ce_pipe *ath10k_ce_init(struct ath10k *ar,
 
         ret = ath10k_pci_wake(ar);
         if (ret)
-                return NULL;
+                return ret;
 
-        ce_state = ath10k_ce_init_state(ar, ce_id, attr);
-        if (!ce_state) {
-                ath10k_err("Failed to initialize CE state for ID: %d\n", ce_id);
-                goto out;
-        }
+        spin_lock_bh(&ar_pci->ce_lock);
+        ce_state->ar = ar;
+        ce_state->id = ce_id;
+        ce_state->ctrl_addr = ath10k_ce_base_address(ce_id);
+        ce_state->attr_flags = attr->flags;
+        ce_state->src_sz_max = attr->src_sz_max;
+        spin_unlock_bh(&ar_pci->ce_lock);
 
         if (attr->src_nentries) {
-                ret = ath10k_ce_init_src_ring(ar, ce_id, ce_state, attr);
+                ret = ath10k_ce_init_src_ring(ar, ce_id, attr);
                 if (ret) {
                         ath10k_err("Failed to initialize CE src ring for ID: %d (%d)\n",
                                    ce_id, ret);
-                        ath10k_ce_deinit(ce_state);
-                        ce_state = NULL;
                         goto out;
                 }
         }
 
         if (attr->dest_nentries) {
-                ret = ath10k_ce_init_dest_ring(ar, ce_id, ce_state, attr);
+                ret = ath10k_ce_init_dest_ring(ar, ce_id, attr);
                 if (ret) {
                         ath10k_err("Failed to initialize CE dest ring for ID: %d (%d)\n",
                                    ce_id, ret);
-                        ath10k_ce_deinit(ce_state);
-                        ce_state = NULL;
                         goto out;
                 }
         }
 
 out:
         ath10k_pci_sleep(ar);
-        return ce_state;
+        return ret;
 }
 
-void ath10k_ce_deinit(struct ath10k_ce_pipe *ce_state)
+static void ath10k_ce_deinit_src_ring(struct ath10k *ar, unsigned int ce_id)
+{
+        u32 ctrl_addr = ath10k_ce_base_address(ce_id);
+
+        ath10k_ce_src_ring_base_addr_set(ar, ctrl_addr, 0);
+        ath10k_ce_src_ring_size_set(ar, ctrl_addr, 0);
+        ath10k_ce_src_ring_dmax_set(ar, ctrl_addr, 0);
+        ath10k_ce_src_ring_highmark_set(ar, ctrl_addr, 0);
+}
+
+static void ath10k_ce_deinit_dest_ring(struct ath10k *ar, unsigned int ce_id)
+{
+        u32 ctrl_addr = ath10k_ce_base_address(ce_id);
+
+        ath10k_ce_dest_ring_base_addr_set(ar, ctrl_addr, 0);
+        ath10k_ce_dest_ring_size_set(ar, ctrl_addr, 0);
+        ath10k_ce_dest_ring_highmark_set(ar, ctrl_addr, 0);
+}
+
+void ath10k_ce_deinit_pipe(struct ath10k *ar, unsigned int ce_id)
+{
+        int ret;
+
+        ret = ath10k_pci_wake(ar);
+        if (ret)
+                return;
+
+        ath10k_ce_deinit_src_ring(ar, ce_id);
+        ath10k_ce_deinit_dest_ring(ar, ce_id);
+
+        ath10k_pci_sleep(ar);
+}
+
+int ath10k_ce_alloc_pipe(struct ath10k *ar, int ce_id,
+                         const struct ce_attr *attr)
+{
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+        struct ath10k_ce_pipe *ce_state = &ar_pci->ce_states[ce_id];
+        int ret;
+
+        if (attr->src_nentries) {
+                ce_state->src_ring = ath10k_ce_alloc_src_ring(ar, ce_id, attr);
+                if (IS_ERR(ce_state->src_ring)) {
+                        ret = PTR_ERR(ce_state->src_ring);
+                        ath10k_err("failed to allocate copy engine source ring %d: %d\n",
+                                   ce_id, ret);
+                        ce_state->src_ring = NULL;
+                        return ret;
+                }
+        }
+
+        if (attr->dest_nentries) {
+                ce_state->dest_ring = ath10k_ce_alloc_dest_ring(ar, ce_id,
+                                                                attr);
+                if (IS_ERR(ce_state->dest_ring)) {
+                        ret = PTR_ERR(ce_state->dest_ring);
+                        ath10k_err("failed to allocate copy engine destination ring %d: %d\n",
+                                   ce_id, ret);
+                        ce_state->dest_ring = NULL;
+                        return ret;
+                }
+        }
+
+        return 0;
+}
+
+void ath10k_ce_free_pipe(struct ath10k *ar, int ce_id)
 {
-        struct ath10k *ar = ce_state->ar;
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+        struct ath10k_ce_pipe *ce_state = &ar_pci->ce_states[ce_id];
 
         if (ce_state->src_ring) {
                 kfree(ce_state->src_ring->shadow_base_unaligned);
-                pci_free_consistent(ar_pci->pdev,
-                                    (ce_state->src_ring->nentries *
-                                     sizeof(struct ce_desc) +
-                                     CE_DESC_RING_ALIGN),
-                                    ce_state->src_ring->base_addr_owner_space,
-                                    ce_state->src_ring->base_addr_ce_space);
+                dma_free_coherent(ar->dev,
+                                  (ce_state->src_ring->nentries *
+                                   sizeof(struct ce_desc) +
+                                   CE_DESC_RING_ALIGN),
+                                  ce_state->src_ring->base_addr_owner_space,
+                                  ce_state->src_ring->base_addr_ce_space);
                 kfree(ce_state->src_ring);
         }
 
         if (ce_state->dest_ring) {
-                pci_free_consistent(ar_pci->pdev,
-                                    (ce_state->dest_ring->nentries *
-                                     sizeof(struct ce_desc) +
-                                     CE_DESC_RING_ALIGN),
-                                    ce_state->dest_ring->base_addr_owner_space,
-                                    ce_state->dest_ring->base_addr_ce_space);
+                dma_free_coherent(ar->dev,
+                                  (ce_state->dest_ring->nentries *
+                                   sizeof(struct ce_desc) +
+                                   CE_DESC_RING_ALIGN),
+                                  ce_state->dest_ring->base_addr_owner_space,
+                                  ce_state->dest_ring->base_addr_ce_space);
                 kfree(ce_state->dest_ring);
         }
 
diff --git a/drivers/net/wireless/ath/ath10k/ce.h b/drivers/net/wireless/ath/ath10k/ce.h
index 8eb7f99ed992..7a5a36fc59c1 100644
--- a/drivers/net/wireless/ath/ath10k/ce.h
+++ b/drivers/net/wireless/ath/ath10k/ce.h
@@ -104,7 +104,8 @@ struct ath10k_ce_ring {
         void *shadow_base_unaligned;
         struct ce_desc *shadow_base;
 
-        void **per_transfer_context;
+        /* keep last */
+        void *per_transfer_context[0];
 };
 
 struct ath10k_ce_pipe {
@@ -159,6 +160,8 @@ int ath10k_ce_send_nolock(struct ath10k_ce_pipe *ce_state,
                           unsigned int transfer_id,
                           unsigned int flags);
 
+void __ath10k_ce_send_revert(struct ath10k_ce_pipe *pipe);
+
 void ath10k_ce_send_cb_register(struct ath10k_ce_pipe *ce_state,
                                 void (*send_cb)(struct ath10k_ce_pipe *),
                                 int disable_interrupts);
@@ -210,10 +213,12 @@ int ath10k_ce_completed_send_next(struct ath10k_ce_pipe *ce_state,
 
 /*==================CE Engine Initialization=======================*/
 
-/* Initialize an instance of a CE */
-struct ath10k_ce_pipe *ath10k_ce_init(struct ath10k *ar,
-                                unsigned int ce_id,
-                                const struct ce_attr *attr);
+int ath10k_ce_init_pipe(struct ath10k *ar, unsigned int ce_id,
+                        const struct ce_attr *attr);
+void ath10k_ce_deinit_pipe(struct ath10k *ar, unsigned int ce_id);
+int ath10k_ce_alloc_pipe(struct ath10k *ar, int ce_id,
+                          const struct ce_attr *attr);
+void ath10k_ce_free_pipe(struct ath10k *ar, int ce_id);
 
 /*==================CE Engine Shutdown=======================*/
 /*
@@ -236,8 +241,6 @@ int ath10k_ce_cancel_send_next(struct ath10k_ce_pipe *ce_state,
                                unsigned int *nbytesp,
                                unsigned int *transfer_idp);
 
-void ath10k_ce_deinit(struct ath10k_ce_pipe *ce_state);
-
 /*==================CE Interrupt Handlers====================*/
 void ath10k_ce_per_engine_service_any(struct ath10k *ar);
 void ath10k_ce_per_engine_service(struct ath10k *ar, unsigned int ce_id);
diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
index ebc5fc2ede75..82017f56e661 100644
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -58,36 +58,6 @@ static void ath10k_send_suspend_complete(struct ath10k *ar)
         complete(&ar->target_suspend);
 }
 
-static int ath10k_init_connect_htc(struct ath10k *ar)
-{
-        int status;
-
-        status = ath10k_wmi_connect_htc_service(ar);
-        if (status)
-                goto conn_fail;
-
-        /* Start HTC */
-        status = ath10k_htc_start(&ar->htc);
-        if (status)
-                goto conn_fail;
-
-        /* Wait for WMI event to be ready */
-        status = ath10k_wmi_wait_for_service_ready(ar);
-        if (status <= 0) {
-                ath10k_warn("wmi service ready event not received");
-                status = -ETIMEDOUT;
-                goto timeout;
-        }
-
-        ath10k_dbg(ATH10K_DBG_BOOT, "boot wmi ready\n");
-        return 0;
-
-timeout:
-        ath10k_htc_stop(&ar->htc);
-conn_fail:
-        return status;
-}
-
 static int ath10k_init_configure_target(struct ath10k *ar)
 {
         u32 param_host;
@@ -249,30 +219,40 @@ exit:
 
 static int ath10k_download_and_run_otp(struct ath10k *ar)
 {
-        u32 address = ar->hw_params.patch_load_addr;
-        u32 exec_param;
+        u32 result, address = ar->hw_params.patch_load_addr;
         int ret;
 
         /* OTP is optional */
 
-        if (!ar->otp_data || !ar->otp_len)
+        if (!ar->otp_data || !ar->otp_len) {
+                ath10k_warn("Not running otp, calibration will be incorrect (otp-data %p otp_len %zd)!\n",
+                            ar->otp_data, ar->otp_len);
                 return 0;
+        }
+
+        ath10k_dbg(ATH10K_DBG_BOOT, "boot upload otp to 0x%x len %zd\n",
+                   address, ar->otp_len);
 
         ret = ath10k_bmi_fast_download(ar, address, ar->otp_data, ar->otp_len);
         if (ret) {
                 ath10k_err("could not write otp (%d)\n", ret);
-                goto exit;
+                return ret;
         }
 
-        exec_param = 0;
-        ret = ath10k_bmi_execute(ar, address, &exec_param);
+        ret = ath10k_bmi_execute(ar, address, 0, &result);
         if (ret) {
                 ath10k_err("could not execute otp (%d)\n", ret);
-                goto exit;
+                return ret;
         }
 
-exit:
-        return ret;
+        ath10k_dbg(ATH10K_DBG_BOOT, "boot otp execute result %d\n", result);
+
+        if (result != 0) {
+                ath10k_err("otp calibration failed: %d", result);
+                return -EINVAL;
+        }
+
+        return 0;
 }
 
 static int ath10k_download_fw(struct ath10k *ar)
@@ -389,8 +369,8 @@ static int ath10k_core_fetch_firmware_api_n(struct ath10k *ar, const char *name)
         /* first fetch the firmware file (firmware-*.bin) */
         ar->firmware = ath10k_fetch_fw_file(ar, ar->hw_params.fw.dir, name);
         if (IS_ERR(ar->firmware)) {
-                ath10k_err("Could not fetch firmware file '%s': %ld\n",
-                           name, PTR_ERR(ar->firmware));
+                ath10k_err("could not fetch firmware file '%s/%s': %ld\n",
+                           ar->hw_params.fw.dir, name, PTR_ERR(ar->firmware));
                 return PTR_ERR(ar->firmware);
         }
 
@@ -401,14 +381,14 @@ static int ath10k_core_fetch_firmware_api_n(struct ath10k *ar, const char *name)
         magic_len = strlen(ATH10K_FIRMWARE_MAGIC) + 1;
 
         if (len < magic_len) {
-                ath10k_err("firmware image too small to contain magic: %zu\n",
-                           len);
+                ath10k_err("firmware file '%s/%s' too small to contain magic: %zu\n",
+                           ar->hw_params.fw.dir, name, len);
                 ret = -EINVAL;
                 goto err;
         }
 
         if (memcmp(data, ATH10K_FIRMWARE_MAGIC, magic_len) != 0) {
-                ath10k_err("Invalid firmware magic\n");
+                ath10k_err("invalid firmware magic\n");
                 ret = -EINVAL;
                 goto err;
         }
@@ -430,7 +410,7 @@ static int ath10k_core_fetch_firmware_api_n(struct ath10k *ar, const char *name)
                 data += sizeof(*hdr);
 
                 if (len < ie_len) {
-                        ath10k_err("Invalid length for FW IE %d (%zu < %zu)\n",
+                        ath10k_err("invalid length for FW IE %d (%zu < %zu)\n",
                                    ie_id, len, ie_len);
                         ret = -EINVAL;
                         goto err;
@@ -513,8 +493,8 @@ static int ath10k_core_fetch_firmware_api_n(struct ath10k *ar, const char *name)
         }
 
         if (!ar->firmware_data || !ar->firmware_len) {
-                ath10k_warn("No ATH10K_FW_IE_FW_IMAGE found from %s, skipping\n",
-                            name);
+                ath10k_warn("No ATH10K_FW_IE_FW_IMAGE found from '%s/%s', skipping\n",
+                            ar->hw_params.fw.dir, name);
                 ret = -ENOMEDIUM;
                 goto err;
         }
@@ -531,7 +511,9 @@ static int ath10k_core_fetch_firmware_api_n(struct ath10k *ar, const char *name)
                                          ar->hw_params.fw.board);
         if (IS_ERR(ar->board)) {
                 ret = PTR_ERR(ar->board);
-                ath10k_err("could not fetch board data (%d)\n", ret);
+                ath10k_err("could not fetch board data '%s/%s' (%d)\n",
+                           ar->hw_params.fw.dir, ar->hw_params.fw.board,
+                           ret);
                 goto err;
         }
 
@@ -549,19 +531,21 @@ static int ath10k_core_fetch_firmware_files(struct ath10k *ar)
 {
         int ret;
 
+        ar->fw_api = 2;
+        ath10k_dbg(ATH10K_DBG_BOOT, "trying fw api %d\n", ar->fw_api);
+
         ret = ath10k_core_fetch_firmware_api_n(ar, ATH10K_FW_API2_FILE);
-        if (ret == 0) {
-                ar->fw_api = 2;
-                goto out;
-        }
+        if (ret == 0)
+                goto success;
+
+        ar->fw_api = 1;
+        ath10k_dbg(ATH10K_DBG_BOOT, "trying fw api %d\n", ar->fw_api);
 
         ret = ath10k_core_fetch_firmware_api_1(ar);
         if (ret)
                 return ret;
 
-        ar->fw_api = 1;
-
-out:
+success:
         ath10k_dbg(ATH10K_DBG_BOOT, "using fw api %d\n", ar->fw_api);
 
         return 0;
@@ -572,16 +556,22 @@ static int ath10k_init_download_firmware(struct ath10k *ar)
         int ret;
 
         ret = ath10k_download_board_data(ar);
-        if (ret)
+        if (ret) {
+                ath10k_err("failed to download board data: %d\n", ret);
                 return ret;
+        }
 
         ret = ath10k_download_and_run_otp(ar);
-        if (ret)
+        if (ret) {
+                ath10k_err("failed to run otp: %d\n", ret);
                 return ret;
+        }
 
         ret = ath10k_download_fw(ar);
-        if (ret)
+        if (ret) {
+                ath10k_err("failed to download firmware: %d\n", ret);
                 return ret;
+        }
 
         return ret;
 }
@@ -660,8 +650,9 @@ static void ath10k_core_restart(struct work_struct *work)
 
         switch (ar->state) {
         case ATH10K_STATE_ON:
-                ath10k_halt(ar);
                 ar->state = ATH10K_STATE_RESTARTING;
+                del_timer_sync(&ar->scan.timeout);
+                ath10k_reset_scan((unsigned long)ar);
                 ieee80211_restart_hw(ar->hw);
                 break;
         case ATH10K_STATE_OFF:
@@ -670,6 +661,8 @@ static void ath10k_core_restart(struct work_struct *work)
                 ath10k_warn("cannot restart a device that hasn't been started\n");
                 break;
         case ATH10K_STATE_RESTARTING:
+                /* hw restart might be requested from multiple places */
+                break;
         case ATH10K_STATE_RESTARTED:
                 ar->state = ATH10K_STATE_WEDGED;
                 /* fall through */
@@ -681,70 +674,6 @@ static void ath10k_core_restart(struct work_struct *work)
         mutex_unlock(&ar->conf_mutex);
 }
 
-struct ath10k *ath10k_core_create(void *hif_priv, struct device *dev,
-                                  const struct ath10k_hif_ops *hif_ops)
-{
-        struct ath10k *ar;
-
-        ar = ath10k_mac_create();
-        if (!ar)
-                return NULL;
-
-        ar->ath_common.priv = ar;
-        ar->ath_common.hw = ar->hw;
-
-        ar->p2p = !!ath10k_p2p;
-        ar->dev = dev;
-
-        ar->hif.priv = hif_priv;
-        ar->hif.ops = hif_ops;
-
-        init_completion(&ar->scan.started);
-        init_completion(&ar->scan.completed);
-        init_completion(&ar->scan.on_channel);
-        init_completion(&ar->target_suspend);
-
-        init_completion(&ar->install_key_done);
-        init_completion(&ar->vdev_setup_done);
-
-        setup_timer(&ar->scan.timeout, ath10k_reset_scan, (unsigned long)ar);
-
-        ar->workqueue = create_singlethread_workqueue("ath10k_wq");
-        if (!ar->workqueue)
-                goto err_wq;
-
-        mutex_init(&ar->conf_mutex);
-        spin_lock_init(&ar->data_lock);
-
-        INIT_LIST_HEAD(&ar->peers);
-        init_waitqueue_head(&ar->peer_mapping_wq);
-
-        init_completion(&ar->offchan_tx_completed);
-        INIT_WORK(&ar->offchan_tx_work, ath10k_offchan_tx_work);
-        skb_queue_head_init(&ar->offchan_tx_queue);
-
-        INIT_WORK(&ar->wmi_mgmt_tx_work, ath10k_mgmt_over_wmi_tx_work);
-        skb_queue_head_init(&ar->wmi_mgmt_tx_queue);
-
-        INIT_WORK(&ar->restart_work, ath10k_core_restart);
-
-        return ar;
-
-err_wq:
-        ath10k_mac_destroy(ar);
-        return NULL;
-}
-EXPORT_SYMBOL(ath10k_core_create);
-
-void ath10k_core_destroy(struct ath10k *ar)
-{
-        flush_workqueue(ar->workqueue);
-        destroy_workqueue(ar->workqueue);
-
-        ath10k_mac_destroy(ar);
-}
-EXPORT_SYMBOL(ath10k_core_destroy);
-
 int ath10k_core_start(struct ath10k *ar)
 {
         int status;
@@ -785,10 +714,28 @@ int ath10k_core_start(struct ath10k *ar)
                 goto err;
         }
 
+        status = ath10k_htt_init(ar);
+        if (status) {
+                ath10k_err("failed to init htt: %d\n", status);
+                goto err_wmi_detach;
+        }
+
+        status = ath10k_htt_tx_alloc(&ar->htt);
+        if (status) {
+                ath10k_err("failed to alloc htt tx: %d\n", status);
+                goto err_wmi_detach;
+        }
+
+        status = ath10k_htt_rx_alloc(&ar->htt);
+        if (status) {
+                ath10k_err("failed to alloc htt rx: %d\n", status);
+                goto err_htt_tx_detach;
+        }
+
         status = ath10k_hif_start(ar);
         if (status) {
                 ath10k_err("could not start HIF: %d\n", status);
-                goto err_wmi_detach;
+                goto err_htt_rx_detach;
         }
 
         status = ath10k_htc_wait_target(&ar->htc);
@@ -797,15 +744,30 @@ int ath10k_core_start(struct ath10k *ar)
                 goto err_hif_stop;
         }
 
-        status = ath10k_htt_attach(ar);
+        status = ath10k_htt_connect(&ar->htt);
         if (status) {
-                ath10k_err("could not attach htt (%d)\n", status);
+                ath10k_err("failed to connect htt (%d)\n", status);
                 goto err_hif_stop;
         }
 
-        status = ath10k_init_connect_htc(ar);
-        if (status)
-                goto err_htt_detach;
+        status = ath10k_wmi_connect(ar);
+        if (status) {
+                ath10k_err("could not connect wmi: %d\n", status);
+                goto err_hif_stop;
+        }
+
+        status = ath10k_htc_start(&ar->htc);
+        if (status) {
+                ath10k_err("failed to start htc: %d\n", status);
+                goto err_hif_stop;
+        }
+
+        status = ath10k_wmi_wait_for_service_ready(ar);
+        if (status <= 0) {
+                ath10k_warn("wmi service ready event not received");
+                status = -ETIMEDOUT;
+                goto err_htc_stop;
+        }
 
         ath10k_dbg(ATH10K_DBG_BOOT, "firmware %s booted\n",
                    ar->hw->wiphy->fw_version);
@@ -813,31 +775,36 @@ int ath10k_core_start(struct ath10k *ar)
         status = ath10k_wmi_cmd_init(ar);
         if (status) {
                 ath10k_err("could not send WMI init command (%d)\n", status);
-                goto err_disconnect_htc;
+                goto err_htc_stop;
         }
 
         status = ath10k_wmi_wait_for_unified_ready(ar);
         if (status <= 0) {
                 ath10k_err("wmi unified ready event not received\n");
                 status = -ETIMEDOUT;
-                goto err_disconnect_htc;
+                goto err_htc_stop;
         }
 
-        status = ath10k_htt_attach_target(&ar->htt);
-        if (status)
-                goto err_disconnect_htc;
+        status = ath10k_htt_setup(&ar->htt);
+        if (status) {
+                ath10k_err("failed to setup htt: %d\n", status);
+                goto err_htc_stop;
+        }
 
         status = ath10k_debug_start(ar);
         if (status)
-                goto err_disconnect_htc;
+                goto err_htc_stop;
 
         ar->free_vdev_map = (1 << TARGET_NUM_VDEVS) - 1;
         INIT_LIST_HEAD(&ar->arvifs);
 
         if (!test_bit(ATH10K_FLAG_FIRST_BOOT_DONE, &ar->dev_flags))
-                ath10k_info("%s (0x%x) fw %s api %d htt %d.%d\n",
-                            ar->hw_params.name, ar->target_version,
-                            ar->hw->wiphy->fw_version, ar->fw_api,
+                ath10k_info("%s (0x%08x, 0x%08x) fw %s api %d htt %d.%d\n",
+                            ar->hw_params.name,
+                            ar->target_version,
+                            ar->chip_id,
+                            ar->hw->wiphy->fw_version,
+                            ar->fw_api,
                             ar->htt.target_version_major,
                             ar->htt.target_version_minor);
 
@@ -845,12 +812,14 @@ int ath10k_core_start(struct ath10k *ar)
 
         return 0;
 
-err_disconnect_htc:
+err_htc_stop:
         ath10k_htc_stop(&ar->htc);
-err_htt_detach:
-        ath10k_htt_detach(&ar->htt);
 err_hif_stop:
         ath10k_hif_stop(ar);
+err_htt_rx_detach:
+        ath10k_htt_rx_free(&ar->htt);
+err_htt_tx_detach:
+        ath10k_htt_tx_free(&ar->htt);
 err_wmi_detach:
         ath10k_wmi_detach(ar);
 err:
@@ -885,10 +854,14 @@ void ath10k_core_stop(struct ath10k *ar)
         lockdep_assert_held(&ar->conf_mutex);
 
         /* try to suspend target */
-        ath10k_wait_for_suspend(ar, WMI_PDEV_SUSPEND_AND_DISABLE_INTR);
+        if (ar->state != ATH10K_STATE_RESTARTING)
+                ath10k_wait_for_suspend(ar, WMI_PDEV_SUSPEND_AND_DISABLE_INTR);
+
         ath10k_debug_stop(ar);
         ath10k_htc_stop(&ar->htc);
-        ath10k_htt_detach(&ar->htt);
+        ath10k_hif_stop(ar);
+        ath10k_htt_tx_free(&ar->htt);
+        ath10k_htt_rx_free(&ar->htt);
         ath10k_wmi_detach(ar);
 }
 EXPORT_SYMBOL(ath10k_core_stop);
@@ -980,22 +953,15 @@ static int ath10k_core_check_chip_id(struct ath10k *ar)
         return 0;
 }
 
-int ath10k_core_register(struct ath10k *ar, u32 chip_id)
+static void ath10k_core_register_work(struct work_struct *work)
 {
+        struct ath10k *ar = container_of(work, struct ath10k, register_work);
         int status;
 
-        ar->chip_id = chip_id;
-
-        status = ath10k_core_check_chip_id(ar);
-        if (status) {
-                ath10k_err("Unsupported chip id 0x%08x\n", ar->chip_id);
-                return status;
-        }
-
         status = ath10k_core_probe_fw(ar);
         if (status) {
                 ath10k_err("could not probe fw (%d)\n", status);
-                return status;
+                goto err;
         }
 
         status = ath10k_mac_register(ar);
@@ -1010,18 +976,43 @@ int ath10k_core_register(struct ath10k *ar, u32 chip_id)
                 goto err_unregister_mac;
         }
 
-        return 0;
+        set_bit(ATH10K_FLAG_CORE_REGISTERED, &ar->dev_flags);
+        return;
 
 err_unregister_mac:
         ath10k_mac_unregister(ar);
 err_release_fw:
         ath10k_core_free_firmware_files(ar);
-        return status;
+err:
+        device_release_driver(ar->dev);
+        return;
+}
+
+int ath10k_core_register(struct ath10k *ar, u32 chip_id)
+{
+        int status;
+
+        ar->chip_id = chip_id;
+
+        status = ath10k_core_check_chip_id(ar);
+        if (status) {
+                ath10k_err("Unsupported chip id 0x%08x\n", ar->chip_id);
+                return status;
+        }
+
+        queue_work(ar->workqueue, &ar->register_work);
+
+        return 0;
 }
 EXPORT_SYMBOL(ath10k_core_register);
 
 void ath10k_core_unregister(struct ath10k *ar)
 {
+        cancel_work_sync(&ar->register_work);
+
+        if (!test_bit(ATH10K_FLAG_CORE_REGISTERED, &ar->dev_flags))
+                return;
+
         /* We must unregister from mac80211 before we stop HTC and HIF.
          * Otherwise we will fail to submit commands to FW and mac80211 will be
          * unhappy about callback failures. */
@@ -1033,6 +1024,71 @@ void ath10k_core_unregister(struct ath10k *ar)
 }
 EXPORT_SYMBOL(ath10k_core_unregister);
 
+struct ath10k *ath10k_core_create(void *hif_priv, struct device *dev,
+                                  const struct ath10k_hif_ops *hif_ops)
+{
+        struct ath10k *ar;
+
+        ar = ath10k_mac_create();
+        if (!ar)
+                return NULL;
+
+        ar->ath_common.priv = ar;
+        ar->ath_common.hw = ar->hw;
+
+        ar->p2p = !!ath10k_p2p;
+        ar->dev = dev;
+
+        ar->hif.priv = hif_priv;
+        ar->hif.ops = hif_ops;
+
+        init_completion(&ar->scan.started);
+        init_completion(&ar->scan.completed);
+        init_completion(&ar->scan.on_channel);
+        init_completion(&ar->target_suspend);
+
+        init_completion(&ar->install_key_done);
+        init_completion(&ar->vdev_setup_done);
+
+        setup_timer(&ar->scan.timeout, ath10k_reset_scan, (unsigned long)ar);
+
+        ar->workqueue = create_singlethread_workqueue("ath10k_wq");
+        if (!ar->workqueue)
+                goto err_wq;
+
+        mutex_init(&ar->conf_mutex);
+        spin_lock_init(&ar->data_lock);
+
+        INIT_LIST_HEAD(&ar->peers);
+        init_waitqueue_head(&ar->peer_mapping_wq);
+
+        init_completion(&ar->offchan_tx_completed);
+        INIT_WORK(&ar->offchan_tx_work, ath10k_offchan_tx_work);
+        skb_queue_head_init(&ar->offchan_tx_queue);
+
+        INIT_WORK(&ar->wmi_mgmt_tx_work, ath10k_mgmt_over_wmi_tx_work);
+        skb_queue_head_init(&ar->wmi_mgmt_tx_queue);
+
+        INIT_WORK(&ar->register_work, ath10k_core_register_work);
+        INIT_WORK(&ar->restart_work, ath10k_core_restart);
+
+        return ar;
+
+err_wq:
+        ath10k_mac_destroy(ar);
+        return NULL;
+}
+EXPORT_SYMBOL(ath10k_core_create);
+
+void ath10k_core_destroy(struct ath10k *ar)
+{
+        flush_workqueue(ar->workqueue);
+        destroy_workqueue(ar->workqueue);
+
+        ath10k_mac_destroy(ar);
+}
+EXPORT_SYMBOL(ath10k_core_destroy);
+
 MODULE_AUTHOR("Qualcomm Atheros");
 MODULE_DESCRIPTION("Core module for QCA988X PCIe devices.");
 MODULE_LICENSE("Dual BSD/GPL");
diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h
index 0e71979d837c..68ceef61933d 100644
--- a/drivers/net/wireless/ath/ath10k/core.h
+++ b/drivers/net/wireless/ath/ath10k/core.h
@@ -119,6 +119,7 @@ struct ath10k_peer_stat {
         u8 peer_macaddr[ETH_ALEN];
         u32 peer_rssi;
         u32 peer_tx_rate;
+        u32 peer_rx_rate; /* 10x only */
 };
 
 struct ath10k_target_stats {
@@ -130,6 +131,12 @@ struct ath10k_target_stats {
         u32 cycle_count;
         u32 phy_err_count;
         u32 chan_tx_power;
+        u32 ack_rx_bad;
+        u32 rts_bad;
+        u32 rts_good;
+        u32 fcs_bad;
+        u32 no_beacons;
+        u32 mib_int_count;
 
         /* PDEV TX stats */
         s32 comp_queued;
@@ -260,6 +267,8 @@ struct ath10k_vif {
         u8 fixed_rate;
         u8 fixed_nss;
         u8 force_sgi;
+        bool use_cts_prot;
+        int num_legacy_stations;
 };
 
 struct ath10k_vif_iter {
@@ -326,6 +335,7 @@ enum ath10k_dev_flags {
         /* Indicates that ath10k device is during CAC phase of DFS */
         ATH10K_CAC_RUNNING,
         ATH10K_FLAG_FIRST_BOOT_DONE,
+        ATH10K_FLAG_CORE_REGISTERED,
 };
 
 struct ath10k {
@@ -419,13 +429,24 @@ struct ath10k {
         struct cfg80211_chan_def chandef;
 
         int free_vdev_map;
+        bool promisc;
+        bool monitor;
         int monitor_vdev_id;
-        bool monitor_enabled;
-        bool monitor_present;
+        bool monitor_started;
         unsigned int filter_flags;
         unsigned long dev_flags;
         u32 dfs_block_radar_events;
 
+        /* protected by conf_mutex */
+        bool radar_enabled;
+        int num_started_vdevs;
+
+        /* Protected by conf-mutex */
+        u8 supp_tx_chainmask;
+        u8 supp_rx_chainmask;
+        u8 cfg_tx_chainmask;
+        u8 cfg_rx_chainmask;
+
         struct wmi_pdev_set_wmm_params_arg wmm_params;
         struct completion install_key_done;
 
@@ -456,6 +477,7 @@ struct ath10k {
 
         enum ath10k_state state;
 
+        struct work_struct register_work;
         struct work_struct restart_work;
 
         /* cycle count is reported twice for each visited channel during scan.
diff --git a/drivers/net/wireless/ath/ath10k/debug.c b/drivers/net/wireless/ath/ath10k/debug.c
index 6debd281350a..1b7ff4ba122c 100644
--- a/drivers/net/wireless/ath/ath10k/debug.c
+++ b/drivers/net/wireless/ath/ath10k/debug.c
@@ -161,7 +161,7 @@ void ath10k_debug_read_target_stats(struct ath10k *ar,
         u8 *tmp = ev->data;
         struct ath10k_target_stats *stats;
         int num_pdev_stats, num_vdev_stats, num_peer_stats;
-        struct wmi_pdev_stats *ps;
+        struct wmi_pdev_stats_10x *ps;
         int i;
 
         spin_lock_bh(&ar->data_lock);
@@ -173,7 +173,7 @@ void ath10k_debug_read_target_stats(struct ath10k *ar,
         num_peer_stats = __le32_to_cpu(ev->num_peer_stats); /* 0 or max peers */
 
         if (num_pdev_stats) {
-                ps = (struct wmi_pdev_stats *)tmp;
+                ps = (struct wmi_pdev_stats_10x *)tmp;
 
                 stats->ch_noise_floor = __le32_to_cpu(ps->chan_nf);
                 stats->tx_frame_count = __le32_to_cpu(ps->tx_frame_count);
@@ -228,7 +228,18 @@ void ath10k_debug_read_target_stats(struct ath10k *ar,
                 stats->phy_err_drop = __le32_to_cpu(ps->wal.rx.phy_err_drop);
                 stats->mpdu_errs = __le32_to_cpu(ps->wal.rx.mpdu_errs);
 
-                tmp += sizeof(struct wmi_pdev_stats);
+                if (test_bit(ATH10K_FW_FEATURE_WMI_10X,
+                             ar->fw_features)) {
+                        stats->ack_rx_bad = __le32_to_cpu(ps->ack_rx_bad);
+                        stats->rts_bad = __le32_to_cpu(ps->rts_bad);
+                        stats->rts_good = __le32_to_cpu(ps->rts_good);
+                        stats->fcs_bad = __le32_to_cpu(ps->fcs_bad);
+                        stats->no_beacons = __le32_to_cpu(ps->no_beacons);
+                        stats->mib_int_count = __le32_to_cpu(ps->mib_int_count);
+                        tmp += sizeof(struct wmi_pdev_stats_10x);
+                } else {
+                        tmp += sizeof(struct wmi_pdev_stats_old);
+                }
         }
 
         /* 0 or max vdevs */
@@ -243,22 +254,29 @@ void ath10k_debug_read_target_stats(struct ath10k *ar,
         }
 
         if (num_peer_stats) {
-                struct wmi_peer_stats *peer_stats;
+                struct wmi_peer_stats_10x *peer_stats;
                 struct ath10k_peer_stat *s;
 
                 stats->peers = num_peer_stats;
 
                 for (i = 0; i < num_peer_stats; i++) {
-                        peer_stats = (struct wmi_peer_stats *)tmp;
+                        peer_stats = (struct wmi_peer_stats_10x *)tmp;
                         s = &stats->peer_stat[i];
 
-                        WMI_MAC_ADDR_TO_CHAR_ARRAY(&peer_stats->peer_macaddr,
-                                                   s->peer_macaddr);
+                        memcpy(s->peer_macaddr, &peer_stats->peer_macaddr.addr,
+                               ETH_ALEN);
                         s->peer_rssi = __le32_to_cpu(peer_stats->peer_rssi);
                         s->peer_tx_rate =
                                 __le32_to_cpu(peer_stats->peer_tx_rate);
-
-                        tmp += sizeof(struct wmi_peer_stats);
+                        if (test_bit(ATH10K_FW_FEATURE_WMI_10X,
+                                     ar->fw_features)) {
+                                s->peer_rx_rate =
+                                        __le32_to_cpu(peer_stats->peer_rx_rate);
+                                tmp += sizeof(struct wmi_peer_stats_10x);
+
+                        } else {
+                                tmp += sizeof(struct wmi_peer_stats_old);
+                        }
                 }
         }
 
@@ -272,7 +290,7 @@ static ssize_t ath10k_read_fw_stats(struct file *file, char __user *user_buf,
         struct ath10k *ar = file->private_data;
         struct ath10k_target_stats *fw_stats;
         char *buf = NULL;
-        unsigned int len = 0, buf_len = 2500;
+        unsigned int len = 0, buf_len = 8000;
         ssize_t ret_cnt = 0;
         long left;
         int i;
@@ -320,6 +338,16 @@ static ssize_t ath10k_read_fw_stats(struct file *file, char __user *user_buf,
                          "Cycle count", fw_stats->cycle_count);
         len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
                          "PHY error count", fw_stats->phy_err_count);
+        len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
+                         "RTS bad count", fw_stats->rts_bad);
+        len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
+                         "RTS good count", fw_stats->rts_good);
+        len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
+                         "FCS bad count", fw_stats->fcs_bad);
+        len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
+                         "No beacon count", fw_stats->no_beacons);
+        len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
+                         "MIB int count", fw_stats->mib_int_count);
 
         len += scnprintf(buf + len, buf_len - len, "\n");
         len += scnprintf(buf + len, buf_len - len, "%30s\n",
@@ -411,8 +439,8 @@ static ssize_t ath10k_read_fw_stats(struct file *file, char __user *user_buf,
                          "MPDU errors (FCS, MIC, ENC)", fw_stats->mpdu_errs);
 
         len += scnprintf(buf + len, buf_len - len, "\n");
-        len += scnprintf(buf + len, buf_len - len, "%30s\n",
-                         "ath10k PEER stats");
+        len += scnprintf(buf + len, buf_len - len, "%30s (%d)\n",
+                         "ath10k PEER stats", fw_stats->peers);
         len += scnprintf(buf + len, buf_len - len, "%30s\n\n",
                                  "=================");
 
@@ -425,6 +453,9 @@ static ssize_t ath10k_read_fw_stats(struct file *file, char __user *user_buf,
                 len += scnprintf(buf + len, buf_len - len, "%30s %u\n",
                                  "Peer TX rate",
                                  fw_stats->peer_stat[i].peer_tx_rate);
+                len += scnprintf(buf + len, buf_len - len, "%30s %u\n",
+                                 "Peer RX rate",
+                                 fw_stats->peer_stat[i].peer_rx_rate);
                 len += scnprintf(buf + len, buf_len - len, "\n");
         }
         spin_unlock_bh(&ar->data_lock);
@@ -451,27 +482,37 @@ static ssize_t ath10k_read_simulate_fw_crash(struct file *file,
                                              char __user *user_buf,
                                              size_t count, loff_t *ppos)
 {
-        const char buf[] = "To simulate firmware crash write the keyword"
-                           " `crash` to this file.\nThis will force firmware"
-                           " to report a crash to the host system.\n";
+        const char buf[] = "To simulate firmware crash write one of the"
+                           " keywords to this file:\n `soft` - this will send"
+                           " WMI_FORCE_FW_HANG_ASSERT to firmware if FW"
+                           " supports that command.\n `hard` - this will send"
+                           " to firmware command with illegal parameters"
+                           " causing firmware crash.\n";
+
         return simple_read_from_buffer(user_buf, count, ppos, buf, strlen(buf));
 }
 
+/* Simulate firmware crash:
+ * 'soft': Call wmi command causing firmware hang. This firmware hang is
+ * recoverable by warm firmware reset.
+ * 'hard': Force firmware crash by setting any vdev parameter for not allowed
+ * vdev id. This is hard firmware crash because it is recoverable only by cold
+ * firmware reset.
+ */
 static ssize_t ath10k_write_simulate_fw_crash(struct file *file,
                                               const char __user *user_buf,
                                               size_t count, loff_t *ppos)
 {
         struct ath10k *ar = file->private_data;
-        char buf[32] = {};
+        char buf[32];
         int ret;
 
         mutex_lock(&ar->conf_mutex);
 
         simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf, count);
-        if (strcmp(buf, "crash") && strcmp(buf, "crash\n")) {
-                ret = -EINVAL;
-                goto exit;
-        }
+
+        /* make sure that buf is null terminated */
+        buf[sizeof(buf) - 1] = 0;
 
         if (ar->state != ATH10K_STATE_ON &&
             ar->state != ATH10K_STATE_RESTARTED) {
@@ -479,14 +520,30 @@ static ssize_t ath10k_write_simulate_fw_crash(struct file *file,
                 goto exit;
         }
 
-        ath10k_info("simulating firmware crash\n");
+        /* drop the possible '\n' from the end */
+        if (buf[count - 1] == '\n') {
+                buf[count - 1] = 0;
+                count--;
+        }
 
-        ret = ath10k_wmi_force_fw_hang(ar, WMI_FORCE_FW_HANG_ASSERT, 0);
-        if (ret)
-                ath10k_warn("failed to force fw hang (%d)\n", ret);
+        if (!strcmp(buf, "soft")) {
+                ath10k_info("simulating soft firmware crash\n");
+                ret = ath10k_wmi_force_fw_hang(ar, WMI_FORCE_FW_HANG_ASSERT, 0);
+        } else if (!strcmp(buf, "hard")) {
+                ath10k_info("simulating hard firmware crash\n");
+                ret = ath10k_wmi_vdev_set_param(ar, TARGET_NUM_VDEVS + 1,
+                                        ar->wmi.vdev_param->rts_threshold, 0);
+        } else {
+                ret = -EINVAL;
+                goto exit;
+        }
+
+        if (ret) {
+                ath10k_warn("failed to simulate firmware crash: %d\n", ret);
+                goto exit;
+        }
 
-        if (ret == 0)
-                ret = count;
+        ret = count;
 
 exit:
         mutex_unlock(&ar->conf_mutex);
diff --git a/drivers/net/wireless/ath/ath10k/htc.c b/drivers/net/wireless/ath/ath10k/htc.c
index 7f1bccd3597f..e493db4b4a41 100644
--- a/drivers/net/wireless/ath/ath10k/htc.c
+++ b/drivers/net/wireless/ath/ath10k/htc.c
@@ -157,6 +157,9 @@ int ath10k_htc_send(struct ath10k_htc *htc,
                         goto err_pull;
                 }
                 ep->tx_credits -= credits;
+                ath10k_dbg(ATH10K_DBG_HTC,
+                           "htc ep %d consumed %d credits (total %d)\n",
+                           eid, credits, ep->tx_credits);
                 spin_unlock_bh(&htc->tx_lock);
         }
 
@@ -185,6 +188,9 @@ err_credits:
         if (ep->tx_credit_flow_enabled) {
                 spin_lock_bh(&htc->tx_lock);
                 ep->tx_credits += credits;
+                ath10k_dbg(ATH10K_DBG_HTC,
+                           "htc ep %d reverted %d credits back (total %d)\n",
+                           eid, credits, ep->tx_credits);
                 spin_unlock_bh(&htc->tx_lock);
 
                 if (ep->ep_ops.ep_tx_credits)
@@ -234,12 +240,12 @@ ath10k_htc_process_credit_report(struct ath10k_htc *htc,
                 if (report->eid >= ATH10K_HTC_EP_COUNT)
                         break;
 
-                ath10k_dbg(ATH10K_DBG_HTC, "ep %d got %d credits\n",
-                           report->eid, report->credits);
-
                 ep = &htc->endpoint[report->eid];
                 ep->tx_credits += report->credits;
 
+                ath10k_dbg(ATH10K_DBG_HTC, "htc ep %d got %d credits (total %d)\n",
+                           report->eid, report->credits, ep->tx_credits);
+
                 if (ep->ep_ops.ep_tx_credits) {
                         spin_unlock_bh(&htc->tx_lock);
                         ep->ep_ops.ep_tx_credits(htc->ar);
@@ -824,17 +830,11 @@ int ath10k_htc_start(struct ath10k_htc *htc)
         return 0;
 }
 
-/*
- * stop HTC communications, i.e. stop interrupt reception, and flush all
- * queued buffers
- */
 void ath10k_htc_stop(struct ath10k_htc *htc)
 {
         spin_lock_bh(&htc->tx_lock);
         htc->stopped = true;
         spin_unlock_bh(&htc->tx_lock);
-
-        ath10k_hif_stop(htc->ar);
 }
 
 /* registered target arrival callback from the HIF layer */
diff --git a/drivers/net/wireless/ath/ath10k/htt.c b/drivers/net/wireless/ath/ath10k/htt.c
index 69697af59ce0..19c12cc8d663 100644
--- a/drivers/net/wireless/ath/ath10k/htt.c
+++ b/drivers/net/wireless/ath/ath10k/htt.c
@@ -22,7 +22,7 @@
 #include "core.h"
 #include "debug.h"
 
-static int ath10k_htt_htc_attach(struct ath10k_htt *htt)
+int ath10k_htt_connect(struct ath10k_htt *htt)
 {
         struct ath10k_htc_svc_conn_req conn_req;
         struct ath10k_htc_svc_conn_resp conn_resp;
@@ -48,39 +48,14 @@ static int ath10k_htt_htc_attach(struct ath10k_htt *htt)
         return 0;
 }
 
-int ath10k_htt_attach(struct ath10k *ar)
+int ath10k_htt_init(struct ath10k *ar)
 {
         struct ath10k_htt *htt = &ar->htt;
-        int ret;
 
         htt->ar = ar;
         htt->max_throughput_mbps = 800;
 
         /*
-         * Connect to HTC service.
-         * This has to be done before calling ath10k_htt_rx_attach,
-         * since ath10k_htt_rx_attach involves sending a rx ring configure
-         * message to the target.
-         */
-        ret = ath10k_htt_htc_attach(htt);
-        if (ret) {
-                ath10k_err("could not attach htt htc (%d)\n", ret);
-                goto err_htc_attach;
-        }
-
-        ret = ath10k_htt_tx_attach(htt);
-        if (ret) {
-                ath10k_err("could not attach htt tx (%d)\n", ret);
-                goto err_htc_attach;
-        }
-
-        ret = ath10k_htt_rx_attach(htt);
-        if (ret) {
-                ath10k_err("could not attach htt rx (%d)\n", ret);
-                goto err_rx_attach;
-        }
-
-        /*
          * Prefetch enough data to satisfy target
          * classification engine.
          * This is for LL chips. HL chips will probably
@@ -93,11 +68,6 @@ int ath10k_htt_attach(struct ath10k *ar)
                 2; /* ip4 dscp or ip6 priority */
 
         return 0;
-
-err_rx_attach:
-        ath10k_htt_tx_detach(htt);
-err_htc_attach:
-        return ret;
 }
 
 #define HTT_TARGET_VERSION_TIMEOUT_HZ (3*HZ)
@@ -117,7 +87,7 @@ static int ath10k_htt_verify_version(struct ath10k_htt *htt)
         return 0;
 }
 
-int ath10k_htt_attach_target(struct ath10k_htt *htt)
+int ath10k_htt_setup(struct ath10k_htt *htt)
 {
         int status;
 
@@ -140,9 +110,3 @@ int ath10k_htt_attach_target(struct ath10k_htt *htt)
 
         return ath10k_htt_send_rx_ring_cfg_ll(htt);
 }
-
-void ath10k_htt_detach(struct ath10k_htt *htt)
-{
-        ath10k_htt_rx_detach(htt);
-        ath10k_htt_tx_detach(htt);
-}
diff --git a/drivers/net/wireless/ath/ath10k/htt.h b/drivers/net/wireless/ath/ath10k/htt.h
index 654867fc1ae7..9a263462c793 100644
--- a/drivers/net/wireless/ath/ath10k/htt.h
+++ b/drivers/net/wireless/ath/ath10k/htt.h
@@ -21,6 +21,7 @@
 #include <linux/bug.h>
 #include <linux/interrupt.h>
 #include <linux/dmapool.h>
+#include <net/mac80211.h>
 
 #include "htc.h"
 #include "rx_desc.h"
@@ -1172,23 +1173,6 @@ struct htt_peer_unmap_event {
         u16 peer_id;
 };
 
-struct htt_rx_info {
-        struct sk_buff *skb;
-        enum htt_rx_mpdu_status status;
-        enum htt_rx_mpdu_encrypt_type encrypt_type;
-        s8 signal;
-        struct {
-                u8 info0;
-                u32 info1;
-                u32 info2;
-        } rate;
-
-        u32 tsf;
-        bool fcs_err;
-        bool amsdu_more;
-        bool mic_err;
-};
-
 struct ath10k_htt_txbuf {
         struct htt_data_tx_desc_frag frags[2];
         struct ath10k_htc_hdr htc_hdr;
@@ -1289,6 +1273,9 @@ struct ath10k_htt {
         struct tasklet_struct txrx_compl_task;
         struct sk_buff_head tx_compl_q;
         struct sk_buff_head rx_compl_q;
+
+        /* rx_status template */
+        struct ieee80211_rx_status rx_status;
 };
 
 #define RX_HTT_HDR_STATUS_LEN 64
@@ -1341,14 +1328,16 @@ struct htt_rx_desc {
 #define HTT_LOG2_MAX_CACHE_LINE_SIZE 7  /* 2^7 = 128 */
 #define HTT_MAX_CACHE_LINE_SIZE_MASK ((1 << HTT_LOG2_MAX_CACHE_LINE_SIZE) - 1)
 
-int ath10k_htt_attach(struct ath10k *ar);
-int ath10k_htt_attach_target(struct ath10k_htt *htt);
-void ath10k_htt_detach(struct ath10k_htt *htt);
+int ath10k_htt_connect(struct ath10k_htt *htt);
+int ath10k_htt_init(struct ath10k *ar);
+int ath10k_htt_setup(struct ath10k_htt *htt);
+
+int ath10k_htt_tx_alloc(struct ath10k_htt *htt);
+void ath10k_htt_tx_free(struct ath10k_htt *htt);
+
+int ath10k_htt_rx_alloc(struct ath10k_htt *htt);
+void ath10k_htt_rx_free(struct ath10k_htt *htt);
 
-int ath10k_htt_tx_attach(struct ath10k_htt *htt);
-void ath10k_htt_tx_detach(struct ath10k_htt *htt);
-int ath10k_htt_rx_attach(struct ath10k_htt *htt);
-void ath10k_htt_rx_detach(struct ath10k_htt *htt);
 void ath10k_htt_htc_tx_complete(struct ath10k *ar, struct sk_buff *skb);
 void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb);
 int ath10k_htt_h2t_ver_req_msg(struct ath10k_htt *htt);
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index cdcbe2de95f9..6c102b1312ff 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -225,10 +225,26 @@ static void ath10k_htt_rx_ring_refill_retry(unsigned long arg)
         ath10k_htt_rx_msdu_buff_replenish(htt);
 }
 
-void ath10k_htt_rx_detach(struct ath10k_htt *htt)
+static void ath10k_htt_rx_ring_clean_up(struct ath10k_htt *htt)
 {
-        int sw_rd_idx = htt->rx_ring.sw_rd_idx.msdu_payld;
+        struct sk_buff *skb;
+        int i;
+
+        for (i = 0; i < htt->rx_ring.size; i++) {
+                skb = htt->rx_ring.netbufs_ring[i];
+                if (!skb)
+                        continue;
 
+                dma_unmap_single(htt->ar->dev, ATH10K_SKB_CB(skb)->paddr,
+                                 skb->len + skb_tailroom(skb),
+                                 DMA_FROM_DEVICE);
+                dev_kfree_skb_any(skb);
+                htt->rx_ring.netbufs_ring[i] = NULL;
+        }
+}
+
+void ath10k_htt_rx_free(struct ath10k_htt *htt)
+{
         del_timer_sync(&htt->rx_ring.refill_retry_timer);
         tasklet_kill(&htt->rx_replenish_task);
         tasklet_kill(&htt->txrx_compl_task);
@@ -236,18 +252,7 @@ void ath10k_htt_rx_detach(struct ath10k_htt *htt)
         skb_queue_purge(&htt->tx_compl_q);
         skb_queue_purge(&htt->rx_compl_q);
 
-        while (sw_rd_idx != __le32_to_cpu(*(htt->rx_ring.alloc_idx.vaddr))) {
-                struct sk_buff *skb =
-                                htt->rx_ring.netbufs_ring[sw_rd_idx];
-                struct ath10k_skb_cb *cb = ATH10K_SKB_CB(skb);
-
-                dma_unmap_single(htt->ar->dev, cb->paddr,
-                                 skb->len + skb_tailroom(skb),
-                                 DMA_FROM_DEVICE);
-                dev_kfree_skb_any(htt->rx_ring.netbufs_ring[sw_rd_idx]);
-                sw_rd_idx++;
-                sw_rd_idx &= htt->rx_ring.size_mask;
-        }
+        ath10k_htt_rx_ring_clean_up(htt);
 
         dma_free_coherent(htt->ar->dev,
                           (htt->rx_ring.size *
@@ -277,6 +282,7 @@ static inline struct sk_buff *ath10k_htt_rx_netbuf_pop(struct ath10k_htt *htt)
 
         idx = htt->rx_ring.sw_rd_idx.msdu_payld;
         msdu = htt->rx_ring.netbufs_ring[idx];
+        htt->rx_ring.netbufs_ring[idx] = NULL;
 
         idx++;
         idx &= htt->rx_ring.size_mask;
@@ -297,6 +303,7 @@ static void ath10k_htt_rx_free_msdu_chain(struct sk_buff *skb)
         }
 }
 
+/* return: < 0 fatal error, 0 - non chained msdu, 1 chained msdu */
 static int ath10k_htt_rx_amsdu_pop(struct ath10k_htt *htt,
                                    u8 **fw_desc, int *fw_desc_len,
                                    struct sk_buff **head_msdu,
@@ -305,12 +312,13 @@ static int ath10k_htt_rx_amsdu_pop(struct ath10k_htt *htt,
         int msdu_len, msdu_chaining = 0;
         struct sk_buff *msdu;
         struct htt_rx_desc *rx_desc;
+        bool corrupted = false;
 
         lockdep_assert_held(&htt->rx_ring.lock);
 
         if (htt->rx_confused) {
                 ath10k_warn("htt is confused. refusing rx\n");
-                return 0;
+                return -1;
         }
 
         msdu = *head_msdu = ath10k_htt_rx_netbuf_pop(htt);
@@ -398,7 +406,6 @@ static int ath10k_htt_rx_amsdu_pop(struct ath10k_htt *htt,
                 msdu_len = MS(__le32_to_cpu(rx_desc->msdu_start.info0),
                               RX_MSDU_START_INFO0_MSDU_LENGTH);
                 msdu_chained = rx_desc->frag_info.ring2_more_count;
-                msdu_chaining = msdu_chained;
 
                 if (msdu_len_invalid)
                         msdu_len = 0;
@@ -426,11 +433,15 @@ static int ath10k_htt_rx_amsdu_pop(struct ath10k_htt *htt,
 
                         msdu->next = next;
                         msdu = next;
+                        msdu_chaining = 1;
                 }
 
                 last_msdu = __le32_to_cpu(rx_desc->msdu_end.info0) &
                                 RX_MSDU_END_INFO0_LAST_MSDU;
 
+                if (msdu_chaining && !last_msdu)
+                        corrupted = true;
+
                 if (last_msdu) {
                         msdu->next = NULL;
                         break;
@@ -442,6 +453,23 @@ static int ath10k_htt_rx_amsdu_pop(struct ath10k_htt *htt,
         }
         *tail_msdu = msdu;
 
+        if (*head_msdu == NULL)
+                msdu_chaining = -1;
+
+        /*
+         * Apparently FW sometimes reports weird chained MSDU sequences with
+         * more than one rx descriptor. This seems like a bug but needs more
+         * analyzing. For the time being fix it by dropping such sequences to
+         * avoid blowing up the host system.
+         */
+        if (corrupted) {
+                ath10k_warn("failed to pop chained msdus, dropping\n");
+                ath10k_htt_rx_free_msdu_chain(*head_msdu);
+                *head_msdu = NULL;
+                *tail_msdu = NULL;
+                msdu_chaining = -EINVAL;
+        }
+
         /*
          * Don't refill the ring yet.
          *
@@ -464,7 +492,7 @@ static void ath10k_htt_rx_replenish_task(unsigned long ptr)
         ath10k_htt_rx_msdu_buff_replenish(htt);
 }
 
-int ath10k_htt_rx_attach(struct ath10k_htt *htt)
+int ath10k_htt_rx_alloc(struct ath10k_htt *htt)
 {
         dma_addr_t paddr;
         void *vaddr;
@@ -490,7 +518,7 @@ int ath10k_htt_rx_attach(struct ath10k_htt *htt)
         htt->rx_ring.fill_level = ath10k_htt_rx_ring_fill_level(htt);
 
         htt->rx_ring.netbufs_ring =
-                kmalloc(htt->rx_ring.size * sizeof(struct sk_buff *),
+                kzalloc(htt->rx_ring.size * sizeof(struct sk_buff *),
                         GFP_KERNEL);
         if (!htt->rx_ring.netbufs_ring)
                 goto err_netbuf;
@@ -636,6 +664,203 @@ struct amsdu_subframe_hdr {
         __be16 len;
 } __packed;
 
+static const u8 rx_legacy_rate_idx[] = {
+        3,      /* 0x00  - 11Mbps  */
+        2,      /* 0x01  - 5.5Mbps */
+        1,      /* 0x02  - 2Mbps   */
+        0,      /* 0x03  - 1Mbps   */
+        3,      /* 0x04  - 11Mbps  */
+        2,      /* 0x05  - 5.5Mbps */
+        1,      /* 0x06  - 2Mbps   */
+        0,      /* 0x07  - 1Mbps   */
+        10,     /* 0x08  - 48Mbps  */
+        8,      /* 0x09  - 24Mbps  */
+        6,      /* 0x0A  - 12Mbps  */
+        4,      /* 0x0B  - 6Mbps   */
+        11,     /* 0x0C  - 54Mbps  */
+        9,      /* 0x0D  - 36Mbps  */
+        7,      /* 0x0E  - 18Mbps  */
+        5,      /* 0x0F  - 9Mbps   */
+};
+
+static void ath10k_htt_rx_h_rates(struct ath10k *ar,
+                                  enum ieee80211_band band,
+                                  u8 info0, u32 info1, u32 info2,
+                                  struct ieee80211_rx_status *status)
+{
+        u8 cck, rate, rate_idx, bw, sgi, mcs, nss;
+        u8 preamble = 0;
+
+        /* Check if valid fields */
+        if (!(info0 & HTT_RX_INDICATION_INFO0_START_VALID))
+                return;
+
+        preamble = MS(info1, HTT_RX_INDICATION_INFO1_PREAMBLE_TYPE);
+
+        switch (preamble) {
+        case HTT_RX_LEGACY:
+                cck = info0 & HTT_RX_INDICATION_INFO0_LEGACY_RATE_CCK;
+                rate = MS(info0, HTT_RX_INDICATION_INFO0_LEGACY_RATE);
+                rate_idx = 0;
+
+                if (rate < 0x08 || rate > 0x0F)
+                        break;
+
+                switch (band) {
+                case IEEE80211_BAND_2GHZ:
+                        if (cck)
+                                rate &= ~BIT(3);
+                        rate_idx = rx_legacy_rate_idx[rate];
+                        break;
+                case IEEE80211_BAND_5GHZ:
+                        rate_idx = rx_legacy_rate_idx[rate];
+                        /* We are using same rate table registering
+                           HW - ath10k_rates[]. In case of 5GHz skip
+                           CCK rates, so -4 here */
+                        rate_idx -= 4;
+                        break;
+                default:
+                        break;
+                }
+
+                status->rate_idx = rate_idx;
+                break;
+        case HTT_RX_HT:
+        case HTT_RX_HT_WITH_TXBF:
+                /* HT-SIG - Table 20-11 in info1 and info2 */
+                mcs = info1 & 0x1F;
+                nss = mcs >> 3;
+                bw = (info1 >> 7) & 1;
+                sgi = (info2 >> 7) & 1;
+
+                status->rate_idx = mcs;
+                status->flag |= RX_FLAG_HT;
+                if (sgi)
+                        status->flag |= RX_FLAG_SHORT_GI;
+                if (bw)
+                        status->flag |= RX_FLAG_40MHZ;
+                break;
+        case HTT_RX_VHT:
+        case HTT_RX_VHT_WITH_TXBF:
+                /* VHT-SIG-A1 in info 1, VHT-SIG-A2 in info2
+                   TODO check this */
+                mcs = (info2 >> 4) & 0x0F;
+                nss = ((info1 >> 10) & 0x07) + 1;
+                bw = info1 & 3;
+                sgi = info2 & 1;
+
+                status->rate_idx = mcs;
+                status->vht_nss = nss;
+
+                if (sgi)
+                        status->flag |= RX_FLAG_SHORT_GI;
+
+                switch (bw) {
+                /* 20MHZ */
+                case 0:
+                        break;
+                /* 40MHZ */
+                case 1:
+                        status->flag |= RX_FLAG_40MHZ;
+                        break;
+                /* 80MHZ */
+                case 2:
+                        status->vht_flag |= RX_VHT_FLAG_80MHZ;
+                }
+
+                status->flag |= RX_FLAG_VHT;
+                break;
+        default:
+                break;
+        }
+}
+
+static void ath10k_htt_rx_h_protected(struct ath10k_htt *htt,
+                                      struct ieee80211_rx_status *rx_status,
+                                      struct sk_buff *skb,
+                                      enum htt_rx_mpdu_encrypt_type enctype,
+                                      enum rx_msdu_decap_format fmt,
+                                      bool dot11frag)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+
+        rx_status->flag &= ~(RX_FLAG_DECRYPTED |
+                             RX_FLAG_IV_STRIPPED |
+                             RX_FLAG_MMIC_STRIPPED);
+
+        if (enctype == HTT_RX_MPDU_ENCRYPT_NONE)
+                return;
+
+        /*
+         * There's no explicit rx descriptor flag to indicate whether a given
+         * frame has been decrypted or not. We're forced to use the decap
+         * format as an implicit indication. However fragmentation rx is always
+         * raw and it probably never reports undecrypted raws.
+         *
+         * This makes sure sniffed frames are reported as-is without stripping
+         * the protected flag.
+         */
+        if (fmt == RX_MSDU_DECAP_RAW && !dot11frag)
+                return;
+
+        rx_status->flag |= RX_FLAG_DECRYPTED |
+                           RX_FLAG_IV_STRIPPED |
+                           RX_FLAG_MMIC_STRIPPED;
+        hdr->frame_control = __cpu_to_le16(__le16_to_cpu(hdr->frame_control) &
+                                           ~IEEE80211_FCTL_PROTECTED);
+}
+
+static bool ath10k_htt_rx_h_channel(struct ath10k *ar,
+                                    struct ieee80211_rx_status *status)
+{
+        struct ieee80211_channel *ch;
+
+        spin_lock_bh(&ar->data_lock);
+        ch = ar->scan_channel;
+        if (!ch)
+                ch = ar->rx_channel;
+        spin_unlock_bh(&ar->data_lock);
+
+        if (!ch)
+                return false;
+
+        status->band = ch->band;
+        status->freq = ch->center_freq;
+
+        return true;
+}
+
+static void ath10k_process_rx(struct ath10k *ar,
+                              struct ieee80211_rx_status *rx_status,
+                              struct sk_buff *skb)
+{
+        struct ieee80211_rx_status *status;
+
+        status = IEEE80211_SKB_RXCB(skb);
+        *status = *rx_status;
+
+        ath10k_dbg(ATH10K_DBG_DATA,
+                   "rx skb %p len %u %s%s%s%s%s %srate_idx %u vht_nss %u freq %u band %u flag 0x%x fcs-err %imic-err %i\n",
+                   skb,
+                   skb->len,
+                   status->flag == 0 ? "legacy" : "",
+                   status->flag & RX_FLAG_HT ? "ht" : "",
+                   status->flag & RX_FLAG_VHT ? "vht" : "",
+                   status->flag & RX_FLAG_40MHZ ? "40" : "",
+                   status->vht_flag & RX_VHT_FLAG_80MHZ ? "80" : "",
+                   status->flag & RX_FLAG_SHORT_GI ? "sgi " : "",
+                   status->rate_idx,
+                   status->vht_nss,
+                   status->freq,
+                   status->band, status->flag,
+                   !!(status->flag & RX_FLAG_FAILED_FCS_CRC),
+                   !!(status->flag & RX_FLAG_MMIC_ERROR));
+        ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "rx skb: ",
+                        skb->data, skb->len);
+
+        ieee80211_rx(ar->hw, skb);
+}
+
 static int ath10k_htt_rx_nwifi_hdrlen(struct ieee80211_hdr *hdr)
 {
         /* nwifi header is padded to 4 bytes. this fixes 4addr rx */
@@ -643,11 +868,12 @@ static int ath10k_htt_rx_nwifi_hdrlen(struct ieee80211_hdr *hdr)
 }
 
 static void ath10k_htt_rx_amsdu(struct ath10k_htt *htt,
-                                struct htt_rx_info *info)
+                                struct ieee80211_rx_status *rx_status,
+                                struct sk_buff *skb_in)
 {
         struct htt_rx_desc *rxd;
+        struct sk_buff *skb = skb_in;
         struct sk_buff *first;
-        struct sk_buff *skb = info->skb;
         enum rx_msdu_decap_format fmt;
         enum htt_rx_mpdu_encrypt_type enctype;
         struct ieee80211_hdr *hdr;
@@ -728,24 +954,28 @@ static void ath10k_htt_rx_amsdu(struct ath10k_htt *htt,
                         break;
                 }
 
-                info->skb = skb;
-                info->encrypt_type = enctype;
+                skb_in = skb;
+                ath10k_htt_rx_h_protected(htt, rx_status, skb_in, enctype, fmt,
+                                          false);
                 skb = skb->next;
-                info->skb->next = NULL;
+                skb_in->next = NULL;
 
                 if (skb)
-                        info->amsdu_more = true;
+                        rx_status->flag |= RX_FLAG_AMSDU_MORE;
+                else
+                        rx_status->flag &= ~RX_FLAG_AMSDU_MORE;
 
-                ath10k_process_rx(htt->ar, info);
+                ath10k_process_rx(htt->ar, rx_status, skb_in);
         }
 
         /* FIXME: It might be nice to re-assemble the A-MSDU when there's a
          * monitor interface active for sniffing purposes. */
 }
 
-static void ath10k_htt_rx_msdu(struct ath10k_htt *htt, struct htt_rx_info *info)
+static void ath10k_htt_rx_msdu(struct ath10k_htt *htt,
+                               struct ieee80211_rx_status *rx_status,
+                               struct sk_buff *skb)
 {
-        struct sk_buff *skb = info->skb;
         struct htt_rx_desc *rxd;
         struct ieee80211_hdr *hdr;
         enum rx_msdu_decap_format fmt;
@@ -808,66 +1038,9 @@ static void ath10k_htt_rx_msdu(struct ath10k_htt *htt, struct htt_rx_info *info)
                 break;
         }
 
-        info->skb = skb;
-        info->encrypt_type = enctype;
+        ath10k_htt_rx_h_protected(htt, rx_status, skb, enctype, fmt, false);
 
-        ath10k_process_rx(htt->ar, info);
-}
-
-static bool ath10k_htt_rx_has_decrypt_err(struct sk_buff *skb)
-{
-        struct htt_rx_desc *rxd;
-        u32 flags;
-
-        rxd = (void *)skb->data - sizeof(*rxd);
-        flags = __le32_to_cpu(rxd->attention.flags);
-
-        if (flags & RX_ATTENTION_FLAGS_DECRYPT_ERR)
-                return true;
-
-        return false;
-}
-
-static bool ath10k_htt_rx_has_fcs_err(struct sk_buff *skb)
-{
-        struct htt_rx_desc *rxd;
-        u32 flags;
-
-        rxd = (void *)skb->data - sizeof(*rxd);
-        flags = __le32_to_cpu(rxd->attention.flags);
-
-        if (flags & RX_ATTENTION_FLAGS_FCS_ERR)
-                return true;
-
-        return false;
-}
-
-static bool ath10k_htt_rx_has_mic_err(struct sk_buff *skb)
-{
-        struct htt_rx_desc *rxd;
-        u32 flags;
-
-        rxd = (void *)skb->data - sizeof(*rxd);
-        flags = __le32_to_cpu(rxd->attention.flags);
-
-        if (flags & RX_ATTENTION_FLAGS_TKIP_MIC_ERR)
-                return true;
-
-        return false;
-}
-
-static bool ath10k_htt_rx_is_mgmt(struct sk_buff *skb)
-{
-        struct htt_rx_desc *rxd;
-        u32 flags;
-
-        rxd = (void *)skb->data - sizeof(*rxd);
-        flags = __le32_to_cpu(rxd->attention.flags);
-
-        if (flags & RX_ATTENTION_FLAGS_MGMT_TYPE)
-                return true;
-
-        return false;
+        ath10k_process_rx(htt->ar, rx_status, skb);
 }
 
 static int ath10k_htt_rx_get_csum_state(struct sk_buff *skb)
@@ -952,21 +1125,73 @@ static int ath10k_unchain_msdu(struct sk_buff *msdu_head)
         return 0;
 }
 
+static bool ath10k_htt_rx_amsdu_allowed(struct ath10k_htt *htt,
+                                        struct sk_buff *head,
+                                        enum htt_rx_mpdu_status status,
+                                        bool channel_set,
+                                        u32 attention)
+{
+        if (head->len == 0) {
+                ath10k_dbg(ATH10K_DBG_HTT,
+                           "htt rx dropping due to zero-len\n");
+                return false;
+        }
+
+        if (attention & RX_ATTENTION_FLAGS_DECRYPT_ERR) {
+                ath10k_dbg(ATH10K_DBG_HTT,
+                           "htt rx dropping due to decrypt-err\n");
+                return false;
+        }
+
+        if (!channel_set) {
+                ath10k_warn("no channel configured; ignoring frame!\n");
+                return false;
+        }
+
+        /* Skip mgmt frames while we handle this in WMI */
+        if (status == HTT_RX_IND_MPDU_STATUS_MGMT_CTRL ||
+            attention & RX_ATTENTION_FLAGS_MGMT_TYPE) {
+                ath10k_dbg(ATH10K_DBG_HTT, "htt rx mgmt ctrl\n");
+                return false;
+        }
+
+        if (status != HTT_RX_IND_MPDU_STATUS_OK &&
+            status != HTT_RX_IND_MPDU_STATUS_TKIP_MIC_ERR &&
+            status != HTT_RX_IND_MPDU_STATUS_ERR_INV_PEER &&
+            !htt->ar->monitor_started) {
+                ath10k_dbg(ATH10K_DBG_HTT,
+                           "htt rx ignoring frame w/ status %d\n",
+                           status);
+                return false;
+        }
+
+        if (test_bit(ATH10K_CAC_RUNNING, &htt->ar->dev_flags)) {
+                ath10k_dbg(ATH10K_DBG_HTT,
+                           "htt rx CAC running\n");
+                return false;
+        }
+
+        return true;
+}
+
 static void ath10k_htt_rx_handler(struct ath10k_htt *htt,
                                   struct htt_rx_indication *rx)
 {
-        struct htt_rx_info info;
+        struct ieee80211_rx_status *rx_status = &htt->rx_status;
         struct htt_rx_indication_mpdu_range *mpdu_ranges;
+        struct htt_rx_desc *rxd;
+        enum htt_rx_mpdu_status status;
         struct ieee80211_hdr *hdr;
         int num_mpdu_ranges;
+        u32 attention;
         int fw_desc_len;
         u8 *fw_desc;
+        bool channel_set;
         int i, j;
+        int ret;
 
         lockdep_assert_held(&htt->rx_ring.lock);
 
-        memset(&info, 0, sizeof(info));
-
         fw_desc_len = __le16_to_cpu(rx->prefix.fw_rx_desc_bytes);
         fw_desc = (u8 *)&rx->fw_desc;
 
@@ -974,106 +1199,90 @@ static void ath10k_htt_rx_handler(struct ath10k_htt *htt,
                              HTT_RX_INDICATION_INFO1_NUM_MPDU_RANGES);
         mpdu_ranges = htt_rx_ind_get_mpdu_ranges(rx);
 
+        /* Fill this once, while this is per-ppdu */
+        if (rx->ppdu.info0 & HTT_RX_INDICATION_INFO0_START_VALID) {
+                memset(rx_status, 0, sizeof(*rx_status));
+                rx_status->signal  = ATH10K_DEFAULT_NOISE_FLOOR +
+                                     rx->ppdu.combined_rssi;
+        }
+
+        if (rx->ppdu.info0 & HTT_RX_INDICATION_INFO0_END_VALID) {
+                /* TSF available only in 32-bit */
+                rx_status->mactime = __le32_to_cpu(rx->ppdu.tsf) & 0xffffffff;
+                rx_status->flag |= RX_FLAG_MACTIME_END;
+        }
+
+        channel_set = ath10k_htt_rx_h_channel(htt->ar, rx_status);
+
+        if (channel_set) {
+                ath10k_htt_rx_h_rates(htt->ar, rx_status->band,
+                                      rx->ppdu.info0,
+                                      __le32_to_cpu(rx->ppdu.info1),
+                                      __le32_to_cpu(rx->ppdu.info2),
+                                      rx_status);
+        }
+
         ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "htt rx ind: ",
                         rx, sizeof(*rx) +
                         (sizeof(struct htt_rx_indication_mpdu_range) *
                                 num_mpdu_ranges));
 
         for (i = 0; i < num_mpdu_ranges; i++) {
-                info.status = mpdu_ranges[i].mpdu_range_status;
+                status = mpdu_ranges[i].mpdu_range_status;
 
                 for (j = 0; j < mpdu_ranges[i].mpdu_count; j++) {
                         struct sk_buff *msdu_head, *msdu_tail;
-                        enum htt_rx_mpdu_status status;
-                        int msdu_chaining;
 
                         msdu_head = NULL;
                         msdu_tail = NULL;
-                        msdu_chaining = ath10k_htt_rx_amsdu_pop(htt,
-                                                         &fw_desc,
-                                                         &fw_desc_len,
-                                                         &msdu_head,
-                                                         &msdu_tail);
-
-                        if (!msdu_head) {
-                                ath10k_warn("htt rx no data!\n");
-                                continue;
-                        }
-
-                        if (msdu_head->len == 0) {
-                                ath10k_dbg(ATH10K_DBG_HTT,
-                                           "htt rx dropping due to zero-len\n");
+                        ret = ath10k_htt_rx_amsdu_pop(htt,
+                                                      &fw_desc,
+                                                      &fw_desc_len,
+                                                      &msdu_head,
+                                                      &msdu_tail);
+
+                        if (ret < 0) {
+                                ath10k_warn("failed to pop amsdu from htt rx ring %d\n",
+                                            ret);
                                 ath10k_htt_rx_free_msdu_chain(msdu_head);
                                 continue;
                         }
 
-                        if (ath10k_htt_rx_has_decrypt_err(msdu_head)) {
-                                ath10k_dbg(ATH10K_DBG_HTT,
-                                           "htt rx dropping due to decrypt-err\n");
-                                ath10k_htt_rx_free_msdu_chain(msdu_head);
-                                continue;
-                        }
+                        rxd = container_of((void *)msdu_head->data,
+                                           struct htt_rx_desc,
+                                           msdu_payload);
+                        attention = __le32_to_cpu(rxd->attention.flags);
 
-                        status = info.status;
-
-                        /* Skip mgmt frames while we handle this in WMI */
-                        if (status == HTT_RX_IND_MPDU_STATUS_MGMT_CTRL ||
-                            ath10k_htt_rx_is_mgmt(msdu_head)) {
-                                ath10k_dbg(ATH10K_DBG_HTT, "htt rx mgmt ctrl\n");
+                        if (!ath10k_htt_rx_amsdu_allowed(htt, msdu_head,
+                                                         status,
+                                                         channel_set,
+                                                         attention)) {
                                 ath10k_htt_rx_free_msdu_chain(msdu_head);
                                 continue;
                         }
 
-                        if (status != HTT_RX_IND_MPDU_STATUS_OK &&
-                            status != HTT_RX_IND_MPDU_STATUS_TKIP_MIC_ERR &&
-                            status != HTT_RX_IND_MPDU_STATUS_ERR_INV_PEER &&
-                            !htt->ar->monitor_enabled) {
-                                ath10k_dbg(ATH10K_DBG_HTT,
-                                           "htt rx ignoring frame w/ status %d\n",
-                                           status);
+                        if (ret > 0 &&
+                            ath10k_unchain_msdu(msdu_head) < 0) {
                                 ath10k_htt_rx_free_msdu_chain(msdu_head);
                                 continue;
                         }
 
-                        if (test_bit(ATH10K_CAC_RUNNING, &htt->ar->dev_flags)) {
-                                ath10k_dbg(ATH10K_DBG_HTT,
-                                           "htt rx CAC running\n");
-                                ath10k_htt_rx_free_msdu_chain(msdu_head);
-                                continue;
-                        }
-
-                        if (msdu_chaining &&
-                            (ath10k_unchain_msdu(msdu_head) < 0)) {
-                                ath10k_htt_rx_free_msdu_chain(msdu_head);
-                                continue;
-                        }
-
-                        info.skb     = msdu_head;
-                        info.fcs_err = ath10k_htt_rx_has_fcs_err(msdu_head);
-                        info.mic_err = ath10k_htt_rx_has_mic_err(msdu_head);
-
-                        if (info.fcs_err)
-                                ath10k_dbg(ATH10K_DBG_HTT,
-                                           "htt rx has FCS err\n");
-
-                        if (info.mic_err)
-                                ath10k_dbg(ATH10K_DBG_HTT,
-                                           "htt rx has MIC err\n");
-
-                        info.signal  = ATH10K_DEFAULT_NOISE_FLOOR;
-                        info.signal += rx->ppdu.combined_rssi;
+                        if (attention & RX_ATTENTION_FLAGS_FCS_ERR)
+                                rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
+                        else
+                                rx_status->flag &= ~RX_FLAG_FAILED_FCS_CRC;
 
-                        info.rate.info0 = rx->ppdu.info0;
-                        info.rate.info1 = __le32_to_cpu(rx->ppdu.info1);
-                        info.rate.info2 = __le32_to_cpu(rx->ppdu.info2);
-                        info.tsf = __le32_to_cpu(rx->ppdu.tsf);
+                        if (attention & RX_ATTENTION_FLAGS_TKIP_MIC_ERR)
+                                rx_status->flag |= RX_FLAG_MMIC_ERROR;
+                        else
+                                rx_status->flag &= ~RX_FLAG_MMIC_ERROR;
 
                         hdr = ath10k_htt_rx_skb_get_hdr(msdu_head);
 
                         if (ath10k_htt_rx_hdr_is_amsdu(hdr))
-                                ath10k_htt_rx_amsdu(htt, &info);
+                                ath10k_htt_rx_amsdu(htt, rx_status, msdu_head);
                         else
-                                ath10k_htt_rx_msdu(htt, &info);
+                                ath10k_htt_rx_msdu(htt, rx_status, msdu_head);
                 }
         }
 
@@ -1084,11 +1293,12 @@ static void ath10k_htt_rx_frag_handler(struct ath10k_htt *htt,
                                 struct htt_rx_fragment_indication *frag)
 {
         struct sk_buff *msdu_head, *msdu_tail;
+        enum htt_rx_mpdu_encrypt_type enctype;
         struct htt_rx_desc *rxd;
         enum rx_msdu_decap_format fmt;
-        struct htt_rx_info info = {};
+        struct ieee80211_rx_status *rx_status = &htt->rx_status;
         struct ieee80211_hdr *hdr;
-        int msdu_chaining;
+        int ret;
         bool tkip_mic_err;
         bool decrypt_err;
         u8 *fw_desc;
@@ -1102,24 +1312,21 @@ static void ath10k_htt_rx_frag_handler(struct ath10k_htt *htt,
         msdu_tail = NULL;
 
         spin_lock_bh(&htt->rx_ring.lock);
-        msdu_chaining = ath10k_htt_rx_amsdu_pop(htt, &fw_desc, &fw_desc_len,
-                                                &msdu_head, &msdu_tail);
+        ret = ath10k_htt_rx_amsdu_pop(htt, &fw_desc, &fw_desc_len,
+                                      &msdu_head, &msdu_tail);
         spin_unlock_bh(&htt->rx_ring.lock);
 
         ath10k_dbg(ATH10K_DBG_HTT_DUMP, "htt rx frag ahead\n");
 
-        if (!msdu_head) {
-                ath10k_warn("htt rx frag no data\n");
-                return;
-        }
-
-        if (msdu_chaining || msdu_head != msdu_tail) {
-                ath10k_warn("aggregation with fragmentation?!\n");
+        if (ret) {
+                ath10k_warn("failed to pop amsdu from httr rx ring for fragmented rx %d\n",
+                            ret);
                 ath10k_htt_rx_free_msdu_chain(msdu_head);
                 return;
         }
 
         /* FIXME: implement signal strength */
+        rx_status->flag |= RX_FLAG_NO_SIGNAL_VAL;
 
         hdr = (struct ieee80211_hdr *)msdu_head->data;
         rxd = (void *)msdu_head->data - sizeof(*rxd);
@@ -1136,57 +1343,55 @@ static void ath10k_htt_rx_frag_handler(struct ath10k_htt *htt,
                 goto end;
         }
 
-        info.skb = msdu_head;
-        info.status = HTT_RX_IND_MPDU_STATUS_OK;
-        info.encrypt_type = MS(__le32_to_cpu(rxd->mpdu_start.info0),
-                                RX_MPDU_START_INFO0_ENCRYPT_TYPE);
-        info.skb->ip_summed = ath10k_htt_rx_get_csum_state(info.skb);
+        enctype = MS(__le32_to_cpu(rxd->mpdu_start.info0),
+                     RX_MPDU_START_INFO0_ENCRYPT_TYPE);
+        ath10k_htt_rx_h_protected(htt, rx_status, msdu_head, enctype, fmt,
+                                  true);
+        msdu_head->ip_summed = ath10k_htt_rx_get_csum_state(msdu_head);
 
-        if (tkip_mic_err) {
+        if (tkip_mic_err)
                 ath10k_warn("tkip mic error\n");
-                info.status = HTT_RX_IND_MPDU_STATUS_TKIP_MIC_ERR;
-        }
 
         if (decrypt_err) {
                 ath10k_warn("decryption err in fragmented rx\n");
-                dev_kfree_skb_any(info.skb);
+                dev_kfree_skb_any(msdu_head);
                 goto end;
         }
 
-        if (info.encrypt_type != HTT_RX_MPDU_ENCRYPT_NONE) {
+        if (enctype != HTT_RX_MPDU_ENCRYPT_NONE) {
                 hdrlen = ieee80211_hdrlen(hdr->frame_control);
-                paramlen = ath10k_htt_rx_crypto_param_len(info.encrypt_type);
+                paramlen = ath10k_htt_rx_crypto_param_len(enctype);
 
                 /* It is more efficient to move the header than the payload */
-                memmove((void *)info.skb->data + paramlen,
-                        (void *)info.skb->data,
+                memmove((void *)msdu_head->data + paramlen,
+                        (void *)msdu_head->data,
                         hdrlen);
-                skb_pull(info.skb, paramlen);
-                hdr = (struct ieee80211_hdr *)info.skb->data;
+                skb_pull(msdu_head, paramlen);
+                hdr = (struct ieee80211_hdr *)msdu_head->data;
         }
 
         /* remove trailing FCS */
         trim  = 4;
 
         /* remove crypto trailer */
-        trim += ath10k_htt_rx_crypto_tail_len(info.encrypt_type);
+        trim += ath10k_htt_rx_crypto_tail_len(enctype);
 
         /* last fragment of TKIP frags has MIC */
         if (!ieee80211_has_morefrags(hdr->frame_control) &&
-            info.encrypt_type == HTT_RX_MPDU_ENCRYPT_TKIP_WPA)
+            enctype == HTT_RX_MPDU_ENCRYPT_TKIP_WPA)
                 trim += 8;
 
-        if (trim > info.skb->len) {
+        if (trim > msdu_head->len) {
                 ath10k_warn("htt rx fragment: trailer longer than the frame itself? drop\n");
-                dev_kfree_skb_any(info.skb);
+                dev_kfree_skb_any(msdu_head);
                 goto end;
         }
 
-        skb_trim(info.skb, info.skb->len - trim);
+        skb_trim(msdu_head, msdu_head->len - trim);
 
         ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "htt rx frag mpdu: ",
-                        info.skb->data, info.skb->len);
-        ath10k_process_rx(htt->ar, &info);
+                        msdu_head->data, msdu_head->len);
+        ath10k_process_rx(htt->ar, rx_status, msdu_head);
 
 end:
         if (fw_desc_len > 0) {
diff --git a/drivers/net/wireless/ath/ath10k/htt_tx.c b/drivers/net/wireless/ath/ath10k/htt_tx.c
index 7a3e2e40dd5c..7064354d1f4f 100644
--- a/drivers/net/wireless/ath/ath10k/htt_tx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_tx.c
@@ -83,7 +83,7 @@ void ath10k_htt_tx_free_msdu_id(struct ath10k_htt *htt, u16 msdu_id)
         __clear_bit(msdu_id, htt->used_msdu_ids);
 }
 
-int ath10k_htt_tx_attach(struct ath10k_htt *htt)
+int ath10k_htt_tx_alloc(struct ath10k_htt *htt)
 {
         spin_lock_init(&htt->tx_lock);
         init_waitqueue_head(&htt->empty_tx_wq);
@@ -120,7 +120,7 @@ int ath10k_htt_tx_attach(struct ath10k_htt *htt)
         return 0;
 }
 
-static void ath10k_htt_tx_cleanup_pending(struct ath10k_htt *htt)
+static void ath10k_htt_tx_free_pending(struct ath10k_htt *htt)
 {
         struct htt_tx_done tx_done = {0};
         int msdu_id;
@@ -141,9 +141,9 @@ static void ath10k_htt_tx_cleanup_pending(struct ath10k_htt *htt)
         spin_unlock_bh(&htt->tx_lock);
 }
 
-void ath10k_htt_tx_detach(struct ath10k_htt *htt)
+void ath10k_htt_tx_free(struct ath10k_htt *htt)
 {
-        ath10k_htt_tx_cleanup_pending(htt);
+        ath10k_htt_tx_free_pending(htt);
         kfree(htt->pending_tx);
         kfree(htt->used_msdu_ids);
         dma_pool_destroy(htt->tx_pool);
diff --git a/drivers/net/wireless/ath/ath10k/hw.h b/drivers/net/wireless/ath/ath10k/hw.h
index 35fc44e281f5..007e855f4ba9 100644
--- a/drivers/net/wireless/ath/ath10k/hw.h
+++ b/drivers/net/wireless/ath/ath10k/hw.h
@@ -28,6 +28,7 @@
 #define QCA988X_HW_2_0_CHIP_ID_REV      0x2
 #define QCA988X_HW_2_0_FW_DIR           "ath10k/QCA988X/hw2.0"
 #define QCA988X_HW_2_0_FW_FILE          "firmware.bin"
+#define QCA988X_HW_2_0_FW_2_FILE        "firmware-2.bin"
 #define QCA988X_HW_2_0_OTP_FILE         "otp.bin"
 #define QCA988X_HW_2_0_BOARD_DATA_FILE  "board.bin"
 #define QCA988X_HW_2_0_PATCH_LOAD_ADDR  0x1234
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 511a2f81e7af..a21080028c54 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -54,7 +54,10 @@ static int ath10k_send_key(struct ath10k_vif *arvif,
         switch (key->cipher) {
         case WLAN_CIPHER_SUITE_CCMP:
                 arg.key_cipher = WMI_CIPHER_AES_CCM;
-                key->flags |= IEEE80211_KEY_FLAG_SW_MGMT_TX;
+                if (arvif->vdev_type == WMI_VDEV_TYPE_AP)
+                        key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV_MGMT;
+                else
+                        key->flags |= IEEE80211_KEY_FLAG_SW_MGMT_TX;
                 break;
         case WLAN_CIPHER_SUITE_TKIP:
                 arg.key_cipher = WMI_CIPHER_TKIP;
@@ -165,7 +168,7 @@ static int ath10k_clear_peer_keys(struct ath10k_vif *arvif,
                         first_errno = ret;
 
                 if (ret)
-                        ath10k_warn("could not remove peer wep key %d (%d)\n",
+                        ath10k_warn("failed to remove peer wep key %d: %d\n",
                                     i, ret);
 
                 peer->keys[i] = NULL;
@@ -213,7 +216,8 @@ static int ath10k_clear_vdev_key(struct ath10k_vif *arvif,
                         first_errno = ret;
 
                 if (ret)
-                        ath10k_warn("could not remove key for %pM\n", addr);
+                        ath10k_warn("failed to remove key for %pM: %d\n",
+                                    addr, ret);
         }
 
         return first_errno;
@@ -323,14 +327,14 @@ static int ath10k_peer_create(struct ath10k *ar, u32 vdev_id, const u8 *addr)
 
         ret = ath10k_wmi_peer_create(ar, vdev_id, addr);
         if (ret) {
-                ath10k_warn("Failed to create wmi peer %pM on vdev %i: %i\n",
+                ath10k_warn("failed to create wmi peer %pM on vdev %i: %i\n",
                             addr, vdev_id, ret);
                 return ret;
         }
 
         ret = ath10k_wait_for_peer_created(ar, vdev_id, addr);
         if (ret) {
-                ath10k_warn("Failed to wait for created wmi peer %pM on vdev %i: %i\n",
+                ath10k_warn("failed to wait for created wmi peer %pM on vdev %i: %i\n",
                             addr, vdev_id, ret);
                 return ret;
         }
@@ -351,7 +355,7 @@ static int ath10k_mac_set_kickout(struct ath10k_vif *arvif)
         ret = ath10k_wmi_pdev_set_param(ar, param,
                                         ATH10K_KICKOUT_THRESHOLD);
         if (ret) {
-                ath10k_warn("Failed to set kickout threshold on vdev %i: %d\n",
+                ath10k_warn("failed to set kickout threshold on vdev %i: %d\n",
                             arvif->vdev_id, ret);
                 return ret;
         }
@@ -360,7 +364,7 @@ static int ath10k_mac_set_kickout(struct ath10k_vif *arvif)
         ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, param,
                                         ATH10K_KEEPALIVE_MIN_IDLE);
         if (ret) {
-                ath10k_warn("Failed to set keepalive minimum idle time on vdev %i : %d\n",
+                ath10k_warn("failed to set keepalive minimum idle time on vdev %i: %d\n",
                             arvif->vdev_id, ret);
                 return ret;
         }
@@ -369,7 +373,7 @@ static int ath10k_mac_set_kickout(struct ath10k_vif *arvif)
         ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, param,
                                         ATH10K_KEEPALIVE_MAX_IDLE);
         if (ret) {
-                ath10k_warn("Failed to set keepalive maximum idle time on vdev %i: %d\n",
+                ath10k_warn("failed to set keepalive maximum idle time on vdev %i: %d\n",
                             arvif->vdev_id, ret);
                 return ret;
         }
@@ -378,7 +382,7 @@ static int ath10k_mac_set_kickout(struct ath10k_vif *arvif)
         ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, param,
                                         ATH10K_KEEPALIVE_MAX_UNRESPONSIVE);
         if (ret) {
-                ath10k_warn("Failed to set keepalive maximum unresponsive time on vdev %i: %d\n",
+                ath10k_warn("failed to set keepalive maximum unresponsive time on vdev %i: %d\n",
                             arvif->vdev_id, ret);
                 return ret;
         }
@@ -488,92 +492,20 @@ static inline int ath10k_vdev_setup_sync(struct ath10k *ar)
         return 0;
 }
 
-static int ath10k_vdev_start(struct ath10k_vif *arvif)
+static bool ath10k_monitor_is_enabled(struct ath10k *ar)
 {
-        struct ath10k *ar = arvif->ar;
-        struct cfg80211_chan_def *chandef = &ar->chandef;
-        struct wmi_vdev_start_request_arg arg = {};
-        int ret = 0;
-
         lockdep_assert_held(&ar->conf_mutex);
 
-        reinit_completion(&ar->vdev_setup_done);
-
-        arg.vdev_id = arvif->vdev_id;
-        arg.dtim_period = arvif->dtim_period;
-        arg.bcn_intval = arvif->beacon_interval;
-
-        arg.channel.freq = chandef->chan->center_freq;
-        arg.channel.band_center_freq1 = chandef->center_freq1;
-        arg.channel.mode = chan_to_phymode(chandef);
-
-        arg.channel.min_power = 0;
-        arg.channel.max_power = chandef->chan->max_power * 2;
-        arg.channel.max_reg_power = chandef->chan->max_reg_power * 2;
-        arg.channel.max_antenna_gain = chandef->chan->max_antenna_gain * 2;
-
-        if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
-                arg.ssid = arvif->u.ap.ssid;
-                arg.ssid_len = arvif->u.ap.ssid_len;
-                arg.hidden_ssid = arvif->u.ap.hidden_ssid;
-
-                /* For now allow DFS for AP mode */
-                arg.channel.chan_radar =
-                        !!(chandef->chan->flags & IEEE80211_CHAN_RADAR);
-        } else if (arvif->vdev_type == WMI_VDEV_TYPE_IBSS) {
-                arg.ssid = arvif->vif->bss_conf.ssid;
-                arg.ssid_len = arvif->vif->bss_conf.ssid_len;
-        }
-
         ath10k_dbg(ATH10K_DBG_MAC,
-                   "mac vdev %d start center_freq %d phymode %s\n",
-                   arg.vdev_id, arg.channel.freq,
-                   ath10k_wmi_phymode_str(arg.channel.mode));
+                   "mac monitor refs: promisc %d monitor %d cac %d\n",
+                   ar->promisc, ar->monitor,
+                   test_bit(ATH10K_CAC_RUNNING, &ar->dev_flags));
 
-        ret = ath10k_wmi_vdev_start(ar, &arg);
-        if (ret) {
-                ath10k_warn("WMI vdev %i start failed: ret %d\n",
-                            arg.vdev_id, ret);
-                return ret;
-        }
-
-        ret = ath10k_vdev_setup_sync(ar);
-        if (ret) {
-                ath10k_warn("vdev %i setup failed %d\n",
-                            arg.vdev_id, ret);
-                return ret;
-        }
-
-        return ret;
+        return ar->promisc || ar->monitor ||
+               test_bit(ATH10K_CAC_RUNNING, &ar->dev_flags);
 }
 
-static int ath10k_vdev_stop(struct ath10k_vif *arvif)
-{
-        struct ath10k *ar = arvif->ar;
-        int ret;
-
-        lockdep_assert_held(&ar->conf_mutex);
-
-        reinit_completion(&ar->vdev_setup_done);
-
-        ret = ath10k_wmi_vdev_stop(ar, arvif->vdev_id);
-        if (ret) {
-                ath10k_warn("WMI vdev %i stop failed: ret %d\n",
-                            arvif->vdev_id, ret);
-                return ret;
-        }
-
-        ret = ath10k_vdev_setup_sync(ar);
-        if (ret) {
-                ath10k_warn("vdev %i setup sync failed %d\n",
-                            arvif->vdev_id, ret);
-                return ret;
-        }
-
-        return ret;
-}
-
-static int ath10k_monitor_start(struct ath10k *ar, int vdev_id)
+static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id)
 {
         struct cfg80211_chan_def *chandef = &ar->chandef;
         struct ieee80211_channel *channel = chandef->chan;
@@ -582,11 +514,6 @@ static int ath10k_monitor_start(struct ath10k *ar, int vdev_id)
 
         lockdep_assert_held(&ar->conf_mutex);
 
-        if (!ar->monitor_present) {
-                ath10k_warn("mac montor stop -- monitor is not present\n");
-                return -EINVAL;
-        }
-
         arg.vdev_id = vdev_id;
         arg.channel.freq = channel->center_freq;
         arg.channel.band_center_freq1 = chandef->center_freq1;
@@ -604,88 +531,75 @@ static int ath10k_monitor_start(struct ath10k *ar, int vdev_id)
 
         ret = ath10k_wmi_vdev_start(ar, &arg);
         if (ret) {
-                ath10k_warn("Monitor vdev %i start failed: ret %d\n",
+                ath10k_warn("failed to request monitor vdev %i start: %d\n",
                             vdev_id, ret);
                 return ret;
         }
 
         ret = ath10k_vdev_setup_sync(ar);
         if (ret) {
-                ath10k_warn("Monitor vdev %i setup failed %d\n",
+                ath10k_warn("failed to synchronize setup for monitor vdev %i: %d\n",
                             vdev_id, ret);
                 return ret;
         }
 
         ret = ath10k_wmi_vdev_up(ar, vdev_id, 0, ar->mac_addr);
         if (ret) {
-                ath10k_warn("Monitor vdev %i up failed: %d\n",
+                ath10k_warn("failed to put up monitor vdev %i: %d\n",
                             vdev_id, ret);
                 goto vdev_stop;
         }
 
         ar->monitor_vdev_id = vdev_id;
-        ar->monitor_enabled = true;
 
+        ath10k_dbg(ATH10K_DBG_MAC, "mac monitor vdev %i started\n",
+                   ar->monitor_vdev_id);
         return 0;
 
 vdev_stop:
         ret = ath10k_wmi_vdev_stop(ar, ar->monitor_vdev_id);
         if (ret)
-                ath10k_warn("Monitor vdev %i stop failed: %d\n",
+                ath10k_warn("failed to stop monitor vdev %i after start failure: %d\n",
                             ar->monitor_vdev_id, ret);
 
         return ret;
 }
 
-static int ath10k_monitor_stop(struct ath10k *ar)
+static int ath10k_monitor_vdev_stop(struct ath10k *ar)
 {
         int ret = 0;
 
         lockdep_assert_held(&ar->conf_mutex);
 
-        if (!ar->monitor_present) {
-                ath10k_warn("mac montor stop -- monitor is not present\n");
-                return -EINVAL;
-        }
-
-        if (!ar->monitor_enabled) {
-                ath10k_warn("mac montor stop -- monitor is not enabled\n");
-                return -EINVAL;
-        }
-
         ret = ath10k_wmi_vdev_down(ar, ar->monitor_vdev_id);
         if (ret)
-                ath10k_warn("Monitor vdev %i down failed: %d\n",
+                ath10k_warn("failed to put down monitor vdev %i: %d\n",
                             ar->monitor_vdev_id, ret);
 
         ret = ath10k_wmi_vdev_stop(ar, ar->monitor_vdev_id);
         if (ret)
-                ath10k_warn("Monitor vdev %i stop failed: %d\n",
+                ath10k_warn("failed to to request monitor vdev %i stop: %d\n",
                             ar->monitor_vdev_id, ret);
 
         ret = ath10k_vdev_setup_sync(ar);
         if (ret)
-                ath10k_warn("Monitor_down sync failed, vdev %i: %d\n",
+                ath10k_warn("failed to synchronise monitor vdev %i: %d\n",
                             ar->monitor_vdev_id, ret);
 
-        ar->monitor_enabled = false;
+        ath10k_dbg(ATH10K_DBG_MAC, "mac monitor vdev %i stopped\n",
+                   ar->monitor_vdev_id);
         return ret;
 }
 
-static int ath10k_monitor_create(struct ath10k *ar)
+static int ath10k_monitor_vdev_create(struct ath10k *ar)
 {
         int bit, ret = 0;
 
         lockdep_assert_held(&ar->conf_mutex);
 
-        if (ar->monitor_present) {
-                ath10k_warn("Monitor mode already enabled\n");
-                return 0;
-        }
-
         bit = ffs(ar->free_vdev_map);
         if (bit == 0) {
-                ath10k_warn("No free VDEV slots\n");
+                ath10k_warn("failed to find free vdev id for monitor vdev\n");
                 return -ENOMEM;
         }
 
@@ -696,7 +610,7 @@ static int ath10k_monitor_create(struct ath10k *ar)
                                      WMI_VDEV_TYPE_MONITOR,
                                      0, ar->mac_addr);
         if (ret) {
-                ath10k_warn("WMI vdev %i monitor create failed: ret %d\n",
+                ath10k_warn("failed to request monitor vdev %i creation: %d\n",
                             ar->monitor_vdev_id, ret);
                 goto vdev_fail;
         }
@@ -704,7 +618,6 @@ static int ath10k_monitor_create(struct ath10k *ar)
         ath10k_dbg(ATH10K_DBG_MAC, "mac monitor vdev %d created\n",
                    ar->monitor_vdev_id);
 
-        ar->monitor_present = true;
         return 0;
 
 vdev_fail:
@@ -715,48 +628,123 @@ vdev_fail:
         return ret;
 }
 
-static int ath10k_monitor_destroy(struct ath10k *ar)
+static int ath10k_monitor_vdev_delete(struct ath10k *ar)
 {
         int ret = 0;
 
         lockdep_assert_held(&ar->conf_mutex);
 
-        if (!ar->monitor_present)
-                return 0;
-
         ret = ath10k_wmi_vdev_delete(ar, ar->monitor_vdev_id);
         if (ret) {
-                ath10k_warn("WMI vdev %i monitor delete failed: %d\n",
+                ath10k_warn("failed to request wmi monitor vdev %i removal: %d\n",
                             ar->monitor_vdev_id, ret);
                 return ret;
         }
 
         ar->free_vdev_map |= 1 << (ar->monitor_vdev_id);
-        ar->monitor_present = false;
 
         ath10k_dbg(ATH10K_DBG_MAC, "mac monitor vdev %d deleted\n",
                    ar->monitor_vdev_id);
         return ret;
 }
 
-static int ath10k_start_cac(struct ath10k *ar)
+static int ath10k_monitor_start(struct ath10k *ar)
 {
         int ret;
 
         lockdep_assert_held(&ar->conf_mutex);
 
-        set_bit(ATH10K_CAC_RUNNING, &ar->dev_flags);
+        if (!ath10k_monitor_is_enabled(ar)) {
+                ath10k_warn("trying to start monitor with no references\n");
+                return 0;
+        }
+
+        if (ar->monitor_started) {
+                ath10k_dbg(ATH10K_DBG_MAC, "mac monitor already started\n");
+                return 0;
+        }
 
-        ret = ath10k_monitor_create(ar);
+        ret = ath10k_monitor_vdev_create(ar);
         if (ret) {
-                clear_bit(ATH10K_CAC_RUNNING, &ar->dev_flags);
+                ath10k_warn("failed to create monitor vdev: %d\n", ret);
                 return ret;
         }
 
-        ret = ath10k_monitor_start(ar, ar->monitor_vdev_id);
+        ret = ath10k_monitor_vdev_start(ar, ar->monitor_vdev_id);
+        if (ret) {
+                ath10k_warn("failed to start monitor vdev: %d\n", ret);
+                ath10k_monitor_vdev_delete(ar);
+                return ret;
+        }
+
+        ar->monitor_started = true;
+        ath10k_dbg(ATH10K_DBG_MAC, "mac monitor started\n");
+
+        return 0;
+}
+
+static void ath10k_monitor_stop(struct ath10k *ar)
+{
+        int ret;
+
+        lockdep_assert_held(&ar->conf_mutex);
+
+        if (ath10k_monitor_is_enabled(ar)) {
+                ath10k_dbg(ATH10K_DBG_MAC,
+                           "mac monitor will be stopped later\n");
+                return;
+        }
+
+        if (!ar->monitor_started) {
+                ath10k_dbg(ATH10K_DBG_MAC,
+                           "mac monitor probably failed to start earlier\n");
+                return;
+        }
+
+        ret = ath10k_monitor_vdev_stop(ar);
+        if (ret)
+                ath10k_warn("failed to stop monitor vdev: %d\n", ret);
+
+        ret = ath10k_monitor_vdev_delete(ar);
+        if (ret)
+                ath10k_warn("failed to delete monitor vdev: %d\n", ret);
+
+        ar->monitor_started = false;
+        ath10k_dbg(ATH10K_DBG_MAC, "mac monitor stopped\n");
+}
+
+static int ath10k_recalc_rtscts_prot(struct ath10k_vif *arvif)
+{
+        struct ath10k *ar = arvif->ar;
+        u32 vdev_param, rts_cts = 0;
+
+        lockdep_assert_held(&ar->conf_mutex);
+
+        vdev_param = ar->wmi.vdev_param->enable_rtscts;
+
+        if (arvif->use_cts_prot || arvif->num_legacy_stations > 0)
+                rts_cts |= SM(WMI_RTSCTS_ENABLED, WMI_RTSCTS_SET);
+
+        if (arvif->num_legacy_stations > 0)
+                rts_cts |= SM(WMI_RTSCTS_ACROSS_SW_RETRIES,
+                              WMI_RTSCTS_PROFILE);
+
+        return ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
+                                         rts_cts);
+}
+
+static int ath10k_start_cac(struct ath10k *ar)
+{
+        int ret;
+
+        lockdep_assert_held(&ar->conf_mutex);
+
+        set_bit(ATH10K_CAC_RUNNING, &ar->dev_flags);
+
+        ret = ath10k_monitor_start(ar);
         if (ret) {
+                ath10k_warn("failed to start monitor (cac): %d\n", ret);
                 clear_bit(ATH10K_CAC_RUNNING, &ar->dev_flags);
-                ath10k_monitor_destroy(ar);
                 return ret;
         }
 
@@ -774,58 +762,26 @@ static int ath10k_stop_cac(struct ath10k *ar)
         if (!test_bit(ATH10K_CAC_RUNNING, &ar->dev_flags))
                 return 0;
 
-        ath10k_monitor_stop(ar);
-        ath10k_monitor_destroy(ar);
         clear_bit(ATH10K_CAC_RUNNING, &ar->dev_flags);
+        ath10k_monitor_stop(ar);
 
         ath10k_dbg(ATH10K_DBG_MAC, "mac cac finished\n");
 
         return 0;
 }
 
-static const char *ath10k_dfs_state(enum nl80211_dfs_state dfs_state)
+static void ath10k_recalc_radar_detection(struct ath10k *ar)
 {
-        switch (dfs_state) {
-        case NL80211_DFS_USABLE:
-                return "USABLE";
-        case NL80211_DFS_UNAVAILABLE:
-                return "UNAVAILABLE";
-        case NL80211_DFS_AVAILABLE:
-                return "AVAILABLE";
-        default:
-                WARN_ON(1);
-                return "bug";
-        }
-}
-
-static void ath10k_config_radar_detection(struct ath10k *ar)
-{
-        struct ieee80211_channel *chan = ar->hw->conf.chandef.chan;
-        bool radar = ar->hw->conf.radar_enabled;
-        bool chan_radar = !!(chan->flags & IEEE80211_CHAN_RADAR);
-        enum nl80211_dfs_state dfs_state = chan->dfs_state;
         int ret;
 
         lockdep_assert_held(&ar->conf_mutex);
 
-        ath10k_dbg(ATH10K_DBG_MAC,
-                   "mac radar config update: chan %dMHz radar %d chan radar %d chan state %s\n",
-                   chan->center_freq, radar, chan_radar,
-                   ath10k_dfs_state(dfs_state));
-
-        /*
-         * It's safe to call it even if CAC is not started.
-         * This call here guarantees changing channel, etc. will stop CAC.
-         */
         ath10k_stop_cac(ar);
 
-        if (!radar)
-                return;
-
-        if (!chan_radar)
+        if (!ar->radar_enabled)
                 return;
 
-        if (dfs_state != NL80211_DFS_USABLE)
+        if (ar->num_started_vdevs > 0)
                 return;
 
         ret = ath10k_start_cac(ar);
@@ -835,11 +791,106 @@ static void ath10k_config_radar_detection(struct ath10k *ar)
                  * radiation is not allowed, make this channel DFS_UNAVAILABLE
                  * by indicating that radar was detected.
                  */
-                ath10k_warn("failed to start CAC (%d)\n", ret);
+                ath10k_warn("failed to start CAC: %d\n", ret);
                 ieee80211_radar_detected(ar->hw);
         }
 }
 
+static int ath10k_vdev_start(struct ath10k_vif *arvif)
+{
+        struct ath10k *ar = arvif->ar;
+        struct cfg80211_chan_def *chandef = &ar->chandef;
+        struct wmi_vdev_start_request_arg arg = {};
+        int ret = 0;
+
+        lockdep_assert_held(&ar->conf_mutex);
+
+        reinit_completion(&ar->vdev_setup_done);
+
+        arg.vdev_id = arvif->vdev_id;
+        arg.dtim_period = arvif->dtim_period;
+        arg.bcn_intval = arvif->beacon_interval;
+
+        arg.channel.freq = chandef->chan->center_freq;
+        arg.channel.band_center_freq1 = chandef->center_freq1;
+        arg.channel.mode = chan_to_phymode(chandef);
+
+        arg.channel.min_power = 0;
+        arg.channel.max_power = chandef->chan->max_power * 2;
+        arg.channel.max_reg_power = chandef->chan->max_reg_power * 2;
+        arg.channel.max_antenna_gain = chandef->chan->max_antenna_gain * 2;
+
+        if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
+                arg.ssid = arvif->u.ap.ssid;
+                arg.ssid_len = arvif->u.ap.ssid_len;
+                arg.hidden_ssid = arvif->u.ap.hidden_ssid;
+
+                /* For now allow DFS for AP mode */
+                arg.channel.chan_radar =
+                        !!(chandef->chan->flags & IEEE80211_CHAN_RADAR);
+        } else if (arvif->vdev_type == WMI_VDEV_TYPE_IBSS) {
+                arg.ssid = arvif->vif->bss_conf.ssid;
+                arg.ssid_len = arvif->vif->bss_conf.ssid_len;
+        }
+
+        ath10k_dbg(ATH10K_DBG_MAC,
+                   "mac vdev %d start center_freq %d phymode %s\n",
+                   arg.vdev_id, arg.channel.freq,
+                   ath10k_wmi_phymode_str(arg.channel.mode));
+
+        ret = ath10k_wmi_vdev_start(ar, &arg);
+        if (ret) {
+                ath10k_warn("failed to start WMI vdev %i: %d\n",
+                            arg.vdev_id, ret);
+                return ret;
+        }
+
+        ret = ath10k_vdev_setup_sync(ar);
+        if (ret) {
+                ath10k_warn("failed to synchronise setup for vdev %i: %d\n",
+                            arg.vdev_id, ret);
+                return ret;
+        }
+
+        ar->num_started_vdevs++;
+        ath10k_recalc_radar_detection(ar);
+
+        return ret;
+}
+
+static int ath10k_vdev_stop(struct ath10k_vif *arvif)
+{
+        struct ath10k *ar = arvif->ar;
+        int ret;
+
+        lockdep_assert_held(&ar->conf_mutex);
+
+        reinit_completion(&ar->vdev_setup_done);
+
+        ret = ath10k_wmi_vdev_stop(ar, arvif->vdev_id);
+        if (ret) {
+                ath10k_warn("failed to stop WMI vdev %i: %d\n",
+                            arvif->vdev_id, ret);
+                return ret;
+        }
+
+        ret = ath10k_vdev_setup_sync(ar);
+        if (ret) {
+                ath10k_warn("failed to syncronise setup for vdev %i: %d\n",
+                            arvif->vdev_id, ret);
+                return ret;
+        }
+
+        WARN_ON(ar->num_started_vdevs == 0);
+
+        if (ar->num_started_vdevs != 0) {
+                ar->num_started_vdevs--;
+                ath10k_recalc_radar_detection(ar);
+        }
+
+        return ret;
+}
+
 static void ath10k_control_beaconing(struct ath10k_vif *arvif,
                                 struct ieee80211_bss_conf *info)
 {
@@ -880,7 +931,7 @@ static void ath10k_control_beaconing(struct ath10k_vif *arvif,
         ret = ath10k_wmi_vdev_up(arvif->ar, arvif->vdev_id, arvif->aid,
                                  arvif->bssid);
         if (ret) {
-                ath10k_warn("Failed to bring up vdev %d: %i\n",
+                ath10k_warn("failed to bring up vdev %d: %i\n",
                             arvif->vdev_id, ret);
                 ath10k_vdev_stop(arvif);
                 return;
@@ -904,7 +955,7 @@ static void ath10k_control_ibss(struct ath10k_vif *arvif,
         if (!info->ibss_joined) {
                 ret = ath10k_peer_delete(arvif->ar, arvif->vdev_id, self_peer);
                 if (ret)
-                        ath10k_warn("Failed to delete IBSS self peer:%pM for VDEV:%d ret:%d\n",
+                        ath10k_warn("failed to delete IBSS self peer %pM for vdev %d: %d\n",
                                     self_peer, arvif->vdev_id, ret);
 
                 if (is_zero_ether_addr(arvif->bssid))
@@ -913,7 +964,7 @@ static void ath10k_control_ibss(struct ath10k_vif *arvif,
                 ret = ath10k_peer_delete(arvif->ar, arvif->vdev_id,
                                          arvif->bssid);
                 if (ret) {
-                        ath10k_warn("Failed to delete IBSS BSSID peer:%pM for VDEV:%d ret:%d\n",
+                        ath10k_warn("failed to delete IBSS BSSID peer %pM for vdev %d: %d\n",
                                     arvif->bssid, arvif->vdev_id, ret);
                         return;
                 }
@@ -925,7 +976,7 @@ static void ath10k_control_ibss(struct ath10k_vif *arvif,
 
         ret = ath10k_peer_create(arvif->ar, arvif->vdev_id, self_peer);
         if (ret) {
-                ath10k_warn("Failed to create IBSS self peer:%pM for VDEV:%d ret:%d\n",
+                ath10k_warn("failed to create IBSS self peer %pM for vdev %d: %d\n",
                             self_peer, arvif->vdev_id, ret);
                 return;
         }
@@ -934,7 +985,7 @@ static void ath10k_control_ibss(struct ath10k_vif *arvif,
         ret = ath10k_wmi_vdev_set_param(arvif->ar, arvif->vdev_id, vdev_param,
                                         ATH10K_DEFAULT_ATIM);
         if (ret)
-                ath10k_warn("Failed to set IBSS ATIM for VDEV:%d ret:%d\n",
+                ath10k_warn("failed to set IBSS ATIM for vdev %d: %d\n",
                             arvif->vdev_id, ret);
 }
 
@@ -961,7 +1012,7 @@ static int ath10k_mac_vif_setup_ps(struct ath10k_vif *arvif)
                 ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id, param,
                                                   conf->dynamic_ps_timeout);
                 if (ret) {
-                        ath10k_warn("Failed to set inactivity time for vdev %d: %i\n",
+                        ath10k_warn("failed to set inactivity time for vdev %d: %i\n",
                                     arvif->vdev_id, ret);
                         return ret;
                 }
@@ -974,8 +1025,8 @@ static int ath10k_mac_vif_setup_ps(struct ath10k_vif *arvif)
 
         ret = ath10k_wmi_set_psmode(ar, arvif->vdev_id, psmode);
         if (ret) {
-                ath10k_warn("Failed to set PS Mode: %d for VDEV: %d\n",
-                            psmode, arvif->vdev_id);
+                ath10k_warn("failed to set PS Mode %d for vdev %d: %d\n",
+                            psmode, arvif->vdev_id, ret);
                 return ret;
         }
 
@@ -1429,7 +1480,7 @@ static void ath10k_bss_assoc(struct ieee80211_hw *hw,
 
         ap_sta = ieee80211_find_sta(vif, bss_conf->bssid);
         if (!ap_sta) {
-                ath10k_warn("Failed to find station entry for %pM, vdev %i\n",
+                ath10k_warn("failed to find station entry for bss %pM vdev %i\n",
                             bss_conf->bssid, arvif->vdev_id);
                 rcu_read_unlock();
                 return;
@@ -1442,7 +1493,7 @@ static void ath10k_bss_assoc(struct ieee80211_hw *hw,
         ret = ath10k_peer_assoc_prepare(ar, arvif, ap_sta,
                                         bss_conf, &peer_arg);
         if (ret) {
-                ath10k_warn("Peer assoc prepare failed for %pM vdev %i\n: %d",
+                ath10k_warn("failed to prepare peer assoc for %pM vdev %i: %d\n",
                             bss_conf->bssid, arvif->vdev_id, ret);
                 rcu_read_unlock();
                 return;
@@ -1452,7 +1503,7 @@ static void ath10k_bss_assoc(struct ieee80211_hw *hw,
 
         ret = ath10k_wmi_peer_assoc(ar, &peer_arg);
         if (ret) {
-                ath10k_warn("Peer assoc failed for %pM vdev %i\n: %d",
+                ath10k_warn("failed to run peer assoc for %pM vdev %i: %d\n",
                             bss_conf->bssid, arvif->vdev_id, ret);
                 return;
         }
@@ -1473,7 +1524,7 @@ static void ath10k_bss_assoc(struct ieee80211_hw *hw,
 
         ret = ath10k_wmi_vdev_up(ar, arvif->vdev_id, arvif->aid, arvif->bssid);
         if (ret) {
-                ath10k_warn("VDEV: %d up failed: ret %d\n",
+                ath10k_warn("failed to set vdev %d up: %d\n",
                             arvif->vdev_id, ret);
                 return;
         }
@@ -1524,7 +1575,7 @@ static void ath10k_bss_disassoc(struct ieee80211_hw *hw,
 }
 
 static int ath10k_station_assoc(struct ath10k *ar, struct ath10k_vif *arvif,
-                                struct ieee80211_sta *sta)
+                                struct ieee80211_sta *sta, bool reassoc)
 {
         struct wmi_peer_assoc_complete_arg peer_arg;
         int ret = 0;
@@ -1533,34 +1584,46 @@ static int ath10k_station_assoc(struct ath10k *ar, struct ath10k_vif *arvif,
 
         ret = ath10k_peer_assoc_prepare(ar, arvif, sta, NULL, &peer_arg);
         if (ret) {
-                ath10k_warn("WMI peer assoc prepare failed for %pM vdev %i: %i\n",
+                ath10k_warn("failed to prepare WMI peer assoc for %pM vdev %i: %i\n",
                             sta->addr, arvif->vdev_id, ret);
                 return ret;
         }
 
+        peer_arg.peer_reassoc = reassoc;
         ret = ath10k_wmi_peer_assoc(ar, &peer_arg);
         if (ret) {
-                ath10k_warn("Peer assoc failed for STA %pM vdev %i: %d\n",
+                ath10k_warn("failed to run peer assoc for STA %pM vdev %i: %d\n",
                             sta->addr, arvif->vdev_id, ret);
                 return ret;
         }
 
         ret = ath10k_setup_peer_smps(ar, arvif, sta->addr, &sta->ht_cap);
         if (ret) {
-                ath10k_warn("failed to setup peer SMPS for vdev: %d\n", ret);
+                ath10k_warn("failed to setup peer SMPS for vdev %d: %d\n",
+                            arvif->vdev_id, ret);
                 return ret;
         }
 
+        if (!sta->wme) {
+                arvif->num_legacy_stations++;
+                ret  = ath10k_recalc_rtscts_prot(arvif);
+                if (ret) {
+                        ath10k_warn("failed to recalculate rts/cts prot for vdev %d: %d\n",
+                                    arvif->vdev_id, ret);
+                        return ret;
+                }
+        }
+
         ret = ath10k_install_peer_wep_keys(arvif, sta->addr);
         if (ret) {
-                ath10k_warn("could not install peer wep keys for vdev %i: %d\n",
+                ath10k_warn("failed to install peer wep keys for vdev %i: %d\n",
                             arvif->vdev_id, ret);
                 return ret;
         }
 
         ret = ath10k_peer_assoc_qos_ap(ar, arvif, sta);
         if (ret) {
-                ath10k_warn("could not set qos params for STA %pM for vdev %i: %d\n",
+                ath10k_warn("failed to set qos params for STA %pM for vdev %i: %d\n",
                             sta->addr, arvif->vdev_id, ret);
                 return ret;
         }
@@ -1575,9 +1638,19 @@ static int ath10k_station_disassoc(struct ath10k *ar, struct ath10k_vif *arvif,
 
         lockdep_assert_held(&ar->conf_mutex);
 
+        if (!sta->wme) {
+                arvif->num_legacy_stations--;
+                ret = ath10k_recalc_rtscts_prot(arvif);
+                if (ret) {
+                        ath10k_warn("failed to recalculate rts/cts prot for vdev %d: %d\n",
+                                    arvif->vdev_id, ret);
+                        return ret;
+                }
+        }
+
         ret = ath10k_clear_peer_keys(arvif, sta->addr);
         if (ret) {
-                ath10k_warn("could not clear all peer wep keys for vdev %i: %d\n",
+                ath10k_warn("failed to clear all peer wep keys for vdev %i: %d\n",
                             arvif->vdev_id, ret);
                 return ret;
         }
@@ -1685,19 +1758,44 @@ static int ath10k_update_channel_list(struct ath10k *ar)
         return ret;
 }
 
+static enum wmi_dfs_region
+ath10k_mac_get_dfs_region(enum nl80211_dfs_regions dfs_region)
+{
+        switch (dfs_region) {
+        case NL80211_DFS_UNSET:
+                return WMI_UNINIT_DFS_DOMAIN;
+        case NL80211_DFS_FCC:
+                return WMI_FCC_DFS_DOMAIN;
+        case NL80211_DFS_ETSI:
+                return WMI_ETSI_DFS_DOMAIN;
+        case NL80211_DFS_JP:
+                return WMI_MKK4_DFS_DOMAIN;
+        }
+        return WMI_UNINIT_DFS_DOMAIN;
+}
+
 static void ath10k_regd_update(struct ath10k *ar)
 {
         struct reg_dmn_pair_mapping *regpair;
         int ret;
+        enum wmi_dfs_region wmi_dfs_reg;
+        enum nl80211_dfs_regions nl_dfs_reg;
 
         lockdep_assert_held(&ar->conf_mutex);
 
         ret = ath10k_update_channel_list(ar);
         if (ret)
-                ath10k_warn("could not update channel list (%d)\n", ret);
+                ath10k_warn("failed to update channel list: %d\n", ret);
 
         regpair = ar->ath_common.regulatory.regpair;
 
+        if (config_enabled(CONFIG_ATH10K_DFS_CERTIFIED) && ar->dfs_detector) {
+                nl_dfs_reg = ar->dfs_detector->region;
+                wmi_dfs_reg = ath10k_mac_get_dfs_region(nl_dfs_reg);
+        } else {
+                wmi_dfs_reg = WMI_UNINIT_DFS_DOMAIN;
+        }
+
         /* Target allows setting up per-band regdomain but ath_common provides
          * a combined one only */
         ret = ath10k_wmi_pdev_set_regdomain(ar,
@@ -1705,9 +1803,10 @@ static void ath10k_regd_update(struct ath10k *ar)
                                             regpair->reg_domain, /* 2ghz */
                                             regpair->reg_domain, /* 5ghz */
                                             regpair->reg_2ghz_ctl,
-                                            regpair->reg_5ghz_ctl);
+                                            regpair->reg_5ghz_ctl,
+                                            wmi_dfs_reg);
         if (ret)
-                ath10k_warn("could not set pdev regdomain (%d)\n", ret);
+                ath10k_warn("failed to set pdev regdomain: %d\n", ret);
 }
 
 static void ath10k_reg_notifier(struct wiphy *wiphy,
@@ -1725,7 +1824,7 @@ static void ath10k_reg_notifier(struct wiphy *wiphy,
                 result = ar->dfs_detector->set_dfs_domain(ar->dfs_detector,
                                                           request->dfs_region);
                 if (!result)
-                        ath10k_warn("dfs region 0x%X not supported, will trigger radar for every pulse\n",
+                        ath10k_warn("DFS region 0x%X not supported, will trigger radar for every pulse\n",
                                     request->dfs_region);
         }
 
@@ -1759,10 +1858,10 @@ static u8 ath10k_tx_h_get_vdev_id(struct ath10k *ar,
         if (info->control.vif)
                 return ath10k_vif_to_arvif(info->control.vif)->vdev_id;
 
-        if (ar->monitor_enabled)
+        if (ar->monitor_started)
                 return ar->monitor_vdev_id;
 
-        ath10k_warn("could not resolve vdev id\n");
+        ath10k_warn("failed to resolve vdev id\n");
         return 0;
 }
 
@@ -1792,8 +1891,13 @@ static void ath10k_tx_wep_key_work(struct work_struct *work)
                                                 wep_key_work);
         int ret, keyidx = arvif->def_wep_key_newidx;
 
+        mutex_lock(&arvif->ar->conf_mutex);
+
+        if (arvif->ar->state != ATH10K_STATE_ON)
+                goto unlock;
+
         if (arvif->def_wep_key_idx == keyidx)
-                return;
+                goto unlock;
 
         ath10k_dbg(ATH10K_DBG_MAC, "mac vdev %d set keyidx %d\n",
                    arvif->vdev_id, keyidx);
@@ -1803,11 +1907,16 @@ static void ath10k_tx_wep_key_work(struct work_struct *work)
                                         arvif->ar->wmi.vdev_param->def_keyid,
                                         keyidx);
         if (ret) {
-                ath10k_warn("could not update wep keyidx (%d)\n", ret);
-                return;
+                ath10k_warn("failed to update wep key index for vdev %d: %d\n",
+                            arvif->vdev_id,
+                            ret);
+                goto unlock;
         }
 
         arvif->def_wep_key_idx = keyidx;
+
+unlock:
+        mutex_unlock(&arvif->ar->conf_mutex);
 }
 
 static void ath10k_tx_h_update_wep_key(struct sk_buff *skb)
@@ -1879,7 +1988,7 @@ static void ath10k_tx_htt(struct ath10k *ar, struct sk_buff *skb)
                              ar->fw_features)) {
                         if (skb_queue_len(&ar->wmi_mgmt_tx_queue) >=
                             ATH10K_MAX_NUM_MGMT_PENDING) {
-                                ath10k_warn("wmi mgmt_tx queue limit reached\n");
+                                ath10k_warn("reached WMI management tranmist queue limit\n");
                                 ret = -EBUSY;
                                 goto exit;
                         }
@@ -1903,7 +2012,7 @@ static void ath10k_tx_htt(struct ath10k *ar, struct sk_buff *skb)
 
 exit:
         if (ret) {
-                ath10k_warn("tx failed (%d). dropping packet.\n", ret);
+                ath10k_warn("failed to transmit packet, dropping: %d\n", ret);
                 ieee80211_free_txskb(ar->hw, skb);
         }
 }
@@ -1964,7 +2073,7 @@ void ath10k_offchan_tx_work(struct work_struct *work)
                 if (!peer) {
                         ret = ath10k_peer_create(ar, vdev_id, peer_addr);
                         if (ret)
-                                ath10k_warn("peer %pM on vdev %d not created (%d)\n",
+                                ath10k_warn("failed to create peer %pM on vdev %d: %d\n",
                                             peer_addr, vdev_id, ret);
                 }
 
@@ -1984,7 +2093,7 @@ void ath10k_offchan_tx_work(struct work_struct *work)
                 if (!peer) {
                         ret = ath10k_peer_delete(ar, vdev_id, peer_addr);
                         if (ret)
-                                ath10k_warn("peer %pM on vdev %d not deleted (%d)\n",
+                                ath10k_warn("failed to delete peer %pM on vdev %d: %d\n",
                                             peer_addr, vdev_id, ret);
                 }
 
@@ -2018,7 +2127,8 @@ void ath10k_mgmt_over_wmi_tx_work(struct work_struct *work)
 
                 ret = ath10k_wmi_mgmt_tx(ar, skb);
                 if (ret) {
-                        ath10k_warn("wmi mgmt_tx failed (%d)\n", ret);
+                        ath10k_warn("failed to transmit management frame via WMI: %d\n",
+                                    ret);
                         ieee80211_free_txskb(ar->hw, skb);
                 }
         }
@@ -2043,7 +2153,7 @@ void ath10k_reset_scan(unsigned long ptr)
                 return;
         }
 
-        ath10k_warn("scan timeout. resetting. fw issue?\n");
+        ath10k_warn("scan timed out, firmware problem?\n");
 
         if (ar->scan.is_roc)
                 ieee80211_remain_on_channel_expired(ar->hw);
@@ -2079,7 +2189,7 @@ static int ath10k_abort_scan(struct ath10k *ar)
 
         ret = ath10k_wmi_stop_scan(ar, &arg);
         if (ret) {
-                ath10k_warn("could not submit wmi stop scan (%d)\n", ret);
+                ath10k_warn("failed to stop wmi scan: %d\n", ret);
                 spin_lock_bh(&ar->data_lock);
                 ar->scan.in_progress = false;
                 ath10k_offchan_tx_purge(ar);
@@ -2099,7 +2209,7 @@ static int ath10k_abort_scan(struct ath10k *ar)
 
         spin_lock_bh(&ar->data_lock);
         if (ar->scan.in_progress) {
-                ath10k_warn("could not stop scan. its still in progress\n");
+                ath10k_warn("failed to stop scan, it's still in progress\n");
                 ar->scan.in_progress = false;
                 ath10k_offchan_tx_purge(ar);
                 ret = -ETIMEDOUT;
@@ -2187,72 +2297,171 @@ static void ath10k_tx(struct ieee80211_hw *hw,
         ath10k_tx_htt(ar, skb);
 }
 
-/*
- * Initialize various parameters with default vaules.
- */
+/* Must not be called with conf_mutex held as workers can use that also. */
+static void ath10k_drain_tx(struct ath10k *ar)
+{
+        /* make sure rcu-protected mac80211 tx path itself is drained */
+        synchronize_net();
+
+        ath10k_offchan_tx_purge(ar);
+        ath10k_mgmt_over_wmi_tx_purge(ar);
+
+        cancel_work_sync(&ar->offchan_tx_work);
+        cancel_work_sync(&ar->wmi_mgmt_tx_work);
+}
+
 void ath10k_halt(struct ath10k *ar)
 {
+        struct ath10k_vif *arvif;
+
         lockdep_assert_held(&ar->conf_mutex);
 
-        ath10k_stop_cac(ar);
+        if (ath10k_monitor_is_enabled(ar)) {
+                clear_bit(ATH10K_CAC_RUNNING, &ar->dev_flags);
+                ar->promisc = false;
+                ar->monitor = false;
+                ath10k_monitor_stop(ar);
+        }
+
         del_timer_sync(&ar->scan.timeout);
-        ath10k_offchan_tx_purge(ar);
-        ath10k_mgmt_over_wmi_tx_purge(ar);
+        ath10k_reset_scan((unsigned long)ar);
         ath10k_peer_cleanup_all(ar);
         ath10k_core_stop(ar);
         ath10k_hif_power_down(ar);
 
         spin_lock_bh(&ar->data_lock);
-        if (ar->scan.in_progress) {
-                del_timer(&ar->scan.timeout);
-                ar->scan.in_progress = false;
-                ieee80211_scan_completed(ar->hw, true);
+        list_for_each_entry(arvif, &ar->arvifs, list) {
+                if (!arvif->beacon)
+                        continue;
+
+                dma_unmap_single(arvif->ar->dev,
+                                 ATH10K_SKB_CB(arvif->beacon)->paddr,
+                                 arvif->beacon->len, DMA_TO_DEVICE);
+                dev_kfree_skb_any(arvif->beacon);
+                arvif->beacon = NULL;
         }
         spin_unlock_bh(&ar->data_lock);
 }
 
+static int ath10k_get_antenna(struct ieee80211_hw *hw, u32 *tx_ant, u32 *rx_ant)
+{
+        struct ath10k *ar = hw->priv;
+
+        mutex_lock(&ar->conf_mutex);
+
+        if (ar->cfg_tx_chainmask) {
+                *tx_ant = ar->cfg_tx_chainmask;
+                *rx_ant = ar->cfg_rx_chainmask;
+        } else {
+                *tx_ant = ar->supp_tx_chainmask;
+                *rx_ant = ar->supp_rx_chainmask;
+        }
+
+        mutex_unlock(&ar->conf_mutex);
+
+        return 0;
+}
+
+static int __ath10k_set_antenna(struct ath10k *ar, u32 tx_ant, u32 rx_ant)
+{
+        int ret;
+
+        lockdep_assert_held(&ar->conf_mutex);
+
+        ar->cfg_tx_chainmask = tx_ant;
+        ar->cfg_rx_chainmask = rx_ant;
+
+        if ((ar->state != ATH10K_STATE_ON) &&
+            (ar->state != ATH10K_STATE_RESTARTED))
+                return 0;
+
+        ret = ath10k_wmi_pdev_set_param(ar, ar->wmi.pdev_param->tx_chain_mask,
+                                        tx_ant);
+        if (ret) {
+                ath10k_warn("failed to set tx-chainmask: %d, req 0x%x\n",
+                            ret, tx_ant);
+                return ret;
+        }
+
+        ret = ath10k_wmi_pdev_set_param(ar, ar->wmi.pdev_param->rx_chain_mask,
+                                        rx_ant);
+        if (ret) {
+                ath10k_warn("failed to set rx-chainmask: %d, req 0x%x\n",
+                            ret, rx_ant);
+                return ret;
+        }
+
+        return 0;
+}
+
+static int ath10k_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
+{
+        struct ath10k *ar = hw->priv;
+        int ret;
+
+        mutex_lock(&ar->conf_mutex);
+        ret = __ath10k_set_antenna(ar, tx_ant, rx_ant);
+        mutex_unlock(&ar->conf_mutex);
+        return ret;
+}
+
 static int ath10k_start(struct ieee80211_hw *hw)
 {
         struct ath10k *ar = hw->priv;
         int ret = 0;
 
+        /*
+         * This makes sense only when restarting hw. It is harmless to call
+         * uncoditionally. This is necessary to make sure no HTT/WMI tx
+         * commands will be submitted while restarting.
+         */
+        ath10k_drain_tx(ar);
+
         mutex_lock(&ar->conf_mutex);
 
-        if (ar->state != ATH10K_STATE_OFF &&
-            ar->state != ATH10K_STATE_RESTARTING) {
+        switch (ar->state) {
+        case ATH10K_STATE_OFF:
+                ar->state = ATH10K_STATE_ON;
+                break;
+        case ATH10K_STATE_RESTARTING:
+                ath10k_halt(ar);
+                ar->state = ATH10K_STATE_RESTARTED;
+                break;
+        case ATH10K_STATE_ON:
+        case ATH10K_STATE_RESTARTED:
+        case ATH10K_STATE_WEDGED:
+                WARN_ON(1);
                 ret = -EINVAL;
-                goto exit;
+                goto err;
         }
 
         ret = ath10k_hif_power_up(ar);
         if (ret) {
-                ath10k_err("could not init hif (%d)\n", ret);
-                ar->state = ATH10K_STATE_OFF;
-                goto exit;
+                ath10k_err("Could not init hif: %d\n", ret);
+                goto err_off;
         }
 
         ret = ath10k_core_start(ar);
         if (ret) {
-                ath10k_err("could not init core (%d)\n", ret);
-                ath10k_hif_power_down(ar);
-                ar->state = ATH10K_STATE_OFF;
-                goto exit;
+                ath10k_err("Could not init core: %d\n", ret);
+                goto err_power_down;
         }
 
-        if (ar->state == ATH10K_STATE_OFF)
-                ar->state = ATH10K_STATE_ON;
-        else if (ar->state == ATH10K_STATE_RESTARTING)
-                ar->state = ATH10K_STATE_RESTARTED;
-
         ret = ath10k_wmi_pdev_set_param(ar, ar->wmi.pdev_param->pmf_qos, 1);
-        if (ret)
-                ath10k_warn("could not enable WMI_PDEV_PARAM_PMF_QOS (%d)\n",
-                            ret);
+        if (ret) {
+                ath10k_warn("failed to enable PMF QOS: %d\n", ret);
+                goto err_core_stop;
+        }
 
         ret = ath10k_wmi_pdev_set_param(ar, ar->wmi.pdev_param->dynamic_bw, 1);
-        if (ret)
-                ath10k_warn("could not init WMI_PDEV_PARAM_DYNAMIC_BW (%d)\n",
-                            ret);
+        if (ret) {
+                ath10k_warn("failed to enable dynamic BW: %d\n", ret);
+                goto err_core_stop;
+        }
+
+        if (ar->cfg_tx_chainmask)
+                __ath10k_set_antenna(ar, ar->cfg_tx_chainmask,
+                                     ar->cfg_rx_chainmask);
 
         /*
          * By default FW set ARP frames ac to voice (6). In that case ARP
@@ -2266,15 +2475,27 @@ static int ath10k_start(struct ieee80211_hw *hw)
         ret = ath10k_wmi_pdev_set_param(ar,
                                         ar->wmi.pdev_param->arp_ac_override, 0);
         if (ret) {
-                ath10k_warn("could not set arp ac override parameter: %d\n",
+                ath10k_warn("failed to set arp ac override parameter: %d\n",
                             ret);
-                goto exit;
+                goto err_core_stop;
         }
 
+        ar->num_started_vdevs = 0;
         ath10k_regd_update(ar);
-        ret = 0;
 
-exit:
+        mutex_unlock(&ar->conf_mutex);
+        return 0;
+
+err_core_stop:
+        ath10k_core_stop(ar);
+
+err_power_down:
+        ath10k_hif_power_down(ar);
+
+err_off:
+        ar->state = ATH10K_STATE_OFF;
+
+err:
         mutex_unlock(&ar->conf_mutex);
         return ret;
 }
@@ -2283,19 +2504,15 @@ static void ath10k_stop(struct ieee80211_hw *hw)
 {
         struct ath10k *ar = hw->priv;
 
+        ath10k_drain_tx(ar);
+
         mutex_lock(&ar->conf_mutex);
-        if (ar->state == ATH10K_STATE_ON ||
-            ar->state == ATH10K_STATE_RESTARTED ||
-            ar->state == ATH10K_STATE_WEDGED)
+        if (ar->state != ATH10K_STATE_OFF) {
                 ath10k_halt(ar);
-
-        ar->state = ATH10K_STATE_OFF;
+                ar->state = ATH10K_STATE_OFF;
+        }
         mutex_unlock(&ar->conf_mutex);
 
-        ath10k_mgmt_over_wmi_tx_purge(ar);
-
-        cancel_work_sync(&ar->offchan_tx_work);
-        cancel_work_sync(&ar->wmi_mgmt_tx_work);
         cancel_work_sync(&ar->restart_work);
 }
 
@@ -2309,7 +2526,7 @@ static int ath10k_config_ps(struct ath10k *ar)
         list_for_each_entry(arvif, &ar->arvifs, list) {
                 ret = ath10k_mac_vif_setup_ps(arvif);
                 if (ret) {
-                        ath10k_warn("could not setup powersave (%d)\n", ret);
+                        ath10k_warn("failed to setup powersave: %d\n", ret);
                         break;
                 }
         }
@@ -2343,7 +2560,6 @@ static const char *chandef_get_width(enum nl80211_chan_width width)
 static void ath10k_config_chan(struct ath10k *ar)
 {
         struct ath10k_vif *arvif;
-        bool monitor_was_enabled;
         int ret;
 
         lockdep_assert_held(&ar->conf_mutex);
@@ -2357,10 +2573,8 @@ static void ath10k_config_chan(struct ath10k *ar)
 
         /* First stop monitor interface. Some FW versions crash if there's a
          * lone monitor interface. */
-        monitor_was_enabled = ar->monitor_enabled;
-
-        if (ar->monitor_enabled)
-                ath10k_monitor_stop(ar);
+        if (ar->monitor_started)
+                ath10k_monitor_vdev_stop(ar);
 
         list_for_each_entry(arvif, &ar->arvifs, list) {
                 if (!arvif->is_started)
@@ -2371,7 +2585,7 @@ static void ath10k_config_chan(struct ath10k *ar)
 
                 ret = ath10k_vdev_stop(arvif);
                 if (ret) {
-                        ath10k_warn("could not stop vdev %d (%d)\n",
+                        ath10k_warn("failed to stop vdev %d: %d\n",
                                     arvif->vdev_id, ret);
                         continue;
                 }
@@ -2388,7 +2602,7 @@ static void ath10k_config_chan(struct ath10k *ar)
 
                 ret = ath10k_vdev_start(arvif);
                 if (ret) {
-                        ath10k_warn("could not start vdev %d (%d)\n",
+                        ath10k_warn("failed to start vdev %d: %d\n",
                                     arvif->vdev_id, ret);
                         continue;
                 }
@@ -2399,14 +2613,14 @@ static void ath10k_config_chan(struct ath10k *ar)
                 ret = ath10k_wmi_vdev_up(arvif->ar, arvif->vdev_id, arvif->aid,
                                          arvif->bssid);
                 if (ret) {
-                        ath10k_warn("could not bring vdev up %d (%d)\n",
+                        ath10k_warn("failed to bring vdev up %d: %d\n",
                                     arvif->vdev_id, ret);
                         continue;
                 }
         }
 
-        if (monitor_was_enabled)
-                ath10k_monitor_start(ar, ar->monitor_vdev_id);
+        if (ath10k_monitor_is_enabled(ar))
+                ath10k_monitor_vdev_start(ar, ar->monitor_vdev_id);
 }
 
 static int ath10k_config(struct ieee80211_hw *hw, u32 changed)
@@ -2420,15 +2634,17 @@ static int ath10k_config(struct ieee80211_hw *hw, u32 changed)
 
         if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
                 ath10k_dbg(ATH10K_DBG_MAC,
-                           "mac config channel %d mhz flags 0x%x\n",
+                           "mac config channel %dMHz flags 0x%x radar %d\n",
                            conf->chandef.chan->center_freq,
-                           conf->chandef.chan->flags);
+                           conf->chandef.chan->flags,
+                           conf->radar_enabled);
 
                 spin_lock_bh(&ar->data_lock);
                 ar->rx_channel = conf->chandef.chan;
                 spin_unlock_bh(&ar->data_lock);
 
-                ath10k_config_radar_detection(ar);
+                ar->radar_enabled = conf->radar_enabled;
+                ath10k_recalc_radar_detection(ar);
 
                 if (!cfg80211_chandef_identical(&ar->chandef, &conf->chandef)) {
                         ar->chandef = conf->chandef;
@@ -2444,14 +2660,14 @@ static int ath10k_config(struct ieee80211_hw *hw, u32 changed)
                 ret = ath10k_wmi_pdev_set_param(ar, param,
                                                 hw->conf.power_level * 2);
                 if (ret)
-                        ath10k_warn("mac failed to set 2g txpower %d (%d)\n",
+                        ath10k_warn("failed to set 2g txpower %d: %d\n",
                                     hw->conf.power_level, ret);
 
                 param = ar->wmi.pdev_param->txpower_limit5g;
                 ret = ath10k_wmi_pdev_set_param(ar, param,
                                                 hw->conf.power_level * 2);
                 if (ret)
-                        ath10k_warn("mac failed to set 5g txpower %d (%d)\n",
+                        ath10k_warn("failed to set 5g txpower %d: %d\n",
                                     hw->conf.power_level, ret);
         }
 
@@ -2459,10 +2675,19 @@ static int ath10k_config(struct ieee80211_hw *hw, u32 changed)
                 ath10k_config_ps(ar);
 
         if (changed & IEEE80211_CONF_CHANGE_MONITOR) {
-                if (conf->flags & IEEE80211_CONF_MONITOR)
-                        ret = ath10k_monitor_create(ar);
-                else
-                        ret = ath10k_monitor_destroy(ar);
+                if (conf->flags & IEEE80211_CONF_MONITOR && !ar->monitor) {
+                        ar->monitor = true;
+                        ret = ath10k_monitor_start(ar);
+                        if (ret) {
+                                ath10k_warn("failed to start monitor (config): %d\n",
+                                            ret);
+                                ar->monitor = false;
+                        }
+                } else if (!(conf->flags & IEEE80211_CONF_MONITOR) &&
+                           ar->monitor) {
+                        ar->monitor = false;
+                        ath10k_monitor_stop(ar);
+                }
         }
 
         mutex_unlock(&ar->conf_mutex);
@@ -2497,12 +2722,6 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
         INIT_WORK(&arvif->wep_key_work, ath10k_tx_wep_key_work);
         INIT_LIST_HEAD(&arvif->list);
 
-        if ((vif->type == NL80211_IFTYPE_MONITOR) && ar->monitor_present) {
-                ath10k_warn("Only one monitor interface allowed\n");
-                ret = -EBUSY;
-                goto err;
-        }
-
         bit = ffs(ar->free_vdev_map);
         if (bit == 0) {
                 ret = -EBUSY;
@@ -2545,7 +2764,7 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
         ret = ath10k_wmi_vdev_create(ar, arvif->vdev_id, arvif->vdev_type,
                                      arvif->vdev_subtype, vif->addr);
         if (ret) {
-                ath10k_warn("WMI vdev %i create failed: ret %d\n",
+                ath10k_warn("failed to create WMI vdev %i: %d\n",
                             arvif->vdev_id, ret);
                 goto err;
         }
@@ -2557,7 +2776,7 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
         ret = ath10k_wmi_vdev_set_param(ar, 0, vdev_param,
                                         arvif->def_wep_key_idx);
         if (ret) {
-                ath10k_warn("Failed to set vdev %i default keyid: %d\n",
+                ath10k_warn("failed to set vdev %i default key id: %d\n",
                             arvif->vdev_id, ret);
                 goto err_vdev_delete;
         }
@@ -2567,7 +2786,7 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
                                         ATH10K_HW_TXRX_NATIVE_WIFI);
         /* 10.X firmware does not support this VDEV parameter. Do not warn */
         if (ret && ret != -EOPNOTSUPP) {
-                ath10k_warn("Failed to set vdev %i TX encap: %d\n",
+                ath10k_warn("failed to set vdev %i TX encapsulation: %d\n",
                             arvif->vdev_id, ret);
                 goto err_vdev_delete;
         }
@@ -2575,14 +2794,14 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
         if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
                 ret = ath10k_peer_create(ar, arvif->vdev_id, vif->addr);
                 if (ret) {
-                        ath10k_warn("Failed to create vdev %i peer for AP: %d\n",
+                        ath10k_warn("failed to create vdev %i peer for AP: %d\n",
                                     arvif->vdev_id, ret);
                         goto err_vdev_delete;
                 }
 
                 ret = ath10k_mac_set_kickout(arvif);
                 if (ret) {
-                        ath10k_warn("Failed to set vdev %i kickout parameters: %d\n",
+                        ath10k_warn("failed to set vdev %i kickout parameters: %d\n",
                                     arvif->vdev_id, ret);
                         goto err_peer_delete;
                 }
@@ -2594,7 +2813,7 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
                 ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id,
                                                   param, value);
                 if (ret) {
-                        ath10k_warn("Failed to set vdev %i RX wake policy: %d\n",
+                        ath10k_warn("failed to set vdev %i RX wake policy: %d\n",
                                     arvif->vdev_id, ret);
                         goto err_peer_delete;
                 }
@@ -2604,7 +2823,7 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
                 ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id,
                                                   param, value);
                 if (ret) {
-                        ath10k_warn("Failed to set vdev %i TX wake thresh: %d\n",
+                        ath10k_warn("failed to set vdev %i TX wake thresh: %d\n",
                                     arvif->vdev_id, ret);
                         goto err_peer_delete;
                 }
@@ -2614,7 +2833,7 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
                 ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id,
                                                   param, value);
                 if (ret) {
-                        ath10k_warn("Failed to set vdev %i PSPOLL count: %d\n",
+                        ath10k_warn("failed to set vdev %i PSPOLL count: %d\n",
                                     arvif->vdev_id, ret);
                         goto err_peer_delete;
                 }
@@ -2622,21 +2841,18 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
 
         ret = ath10k_mac_set_rts(arvif, ar->hw->wiphy->rts_threshold);
         if (ret) {
-                ath10k_warn("failed to set rts threshold for vdev %d (%d)\n",
+                ath10k_warn("failed to set rts threshold for vdev %d: %d\n",
                             arvif->vdev_id, ret);
                 goto err_peer_delete;
         }
 
         ret = ath10k_mac_set_frag(arvif, ar->hw->wiphy->frag_threshold);
         if (ret) {
-                ath10k_warn("failed to set frag threshold for vdev %d (%d)\n",
+                ath10k_warn("failed to set frag threshold for vdev %d: %d\n",
                             arvif->vdev_id, ret);
                 goto err_peer_delete;
         }
 
-        if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR)
-                ar->monitor_present = true;
-
         mutex_unlock(&ar->conf_mutex);
         return 0;
 
@@ -2668,6 +2884,9 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw,
 
         spin_lock_bh(&ar->data_lock);
         if (arvif->beacon) {
+                dma_unmap_single(arvif->ar->dev,
+                                 ATH10K_SKB_CB(arvif->beacon)->paddr,
+                                 arvif->beacon->len, DMA_TO_DEVICE);
                 dev_kfree_skb_any(arvif->beacon);
                 arvif->beacon = NULL;
         }
@@ -2679,7 +2898,7 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw,
         if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
                 ret = ath10k_peer_delete(arvif->ar, arvif->vdev_id, vif->addr);
                 if (ret)
-                        ath10k_warn("Failed to remove peer for AP vdev %i: %d\n",
+                        ath10k_warn("failed to remove peer for AP vdev %i: %d\n",
                                     arvif->vdev_id, ret);
 
                 kfree(arvif->u.ap.noa_data);
@@ -2690,12 +2909,9 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw,
 
         ret = ath10k_wmi_vdev_delete(ar, arvif->vdev_id);
         if (ret)
-                ath10k_warn("WMI vdev %i delete failed: %d\n",
+                ath10k_warn("failed to delete WMI vdev %i: %d\n",
                             arvif->vdev_id, ret);
 
-        if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR)
-                ar->monitor_present = false;
-
         ath10k_peer_cleanup(ar, arvif->vdev_id);
 
         mutex_unlock(&ar->conf_mutex);
@@ -2728,28 +2944,17 @@ static void ath10k_configure_filter(struct ieee80211_hw *hw,
         *total_flags &= SUPPORTED_FILTERS;
         ar->filter_flags = *total_flags;
 
-        /* Monitor must not be started if it wasn't created first.
-         * Promiscuous mode may be started on a non-monitor interface - in
-         * such case the monitor vdev is not created so starting the
-         * monitor makes no sense. Since ath10k uses no special RX filters
-         * (only BSS filter in STA mode) there's no need for any special
-         * action here. */
-        if ((ar->filter_flags & FIF_PROMISC_IN_BSS) &&
-            !ar->monitor_enabled && ar->monitor_present) {
-                ath10k_dbg(ATH10K_DBG_MAC, "mac monitor %d start\n",
-                           ar->monitor_vdev_id);
-
-                ret = ath10k_monitor_start(ar, ar->monitor_vdev_id);
-                if (ret)
-                        ath10k_warn("Unable to start monitor mode\n");
-        } else if (!(ar->filter_flags & FIF_PROMISC_IN_BSS) &&
-                   ar->monitor_enabled && ar->monitor_present) {
-                ath10k_dbg(ATH10K_DBG_MAC, "mac monitor %d stop\n",
-                           ar->monitor_vdev_id);
-
-                ret = ath10k_monitor_stop(ar);
-                if (ret)
-                        ath10k_warn("Unable to stop monitor mode\n");
+        if (ar->filter_flags & FIF_PROMISC_IN_BSS && !ar->promisc) {
+                ar->promisc = true;
+                ret = ath10k_monitor_start(ar);
+                if (ret) {
+                        ath10k_warn("failed to start monitor (promisc): %d\n",
+                                    ret);
+                        ar->promisc = false;
+                }
+        } else if (!(ar->filter_flags & FIF_PROMISC_IN_BSS) && ar->promisc) {
+                ar->promisc = false;
+                ath10k_monitor_stop(ar);
         }
 
         mutex_unlock(&ar->conf_mutex);
@@ -2780,7 +2985,7 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                            arvif->vdev_id, arvif->beacon_interval);
 
                 if (ret)
-                        ath10k_warn("Failed to set beacon interval for vdev %d: %i\n",
+                        ath10k_warn("failed to set beacon interval for vdev %d: %i\n",
                                     arvif->vdev_id, ret);
         }
 
@@ -2793,7 +2998,7 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                 ret = ath10k_wmi_pdev_set_param(ar, pdev_param,
                                                 WMI_BEACON_STAGGERED_MODE);
                 if (ret)
-                        ath10k_warn("Failed to set beacon mode for vdev %d: %i\n",
+                        ath10k_warn("failed to set beacon mode for vdev %d: %i\n",
                                     arvif->vdev_id, ret);
         }
 
@@ -2808,7 +3013,7 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                 ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
                                                 arvif->dtim_period);
                 if (ret)
-                        ath10k_warn("Failed to set dtim period for vdev %d: %i\n",
+                        ath10k_warn("failed to set dtim period for vdev %d: %i\n",
                                     arvif->vdev_id, ret);
         }
 
@@ -2820,7 +3025,12 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                 arvif->u.ap.hidden_ssid = info->hidden_ssid;
         }
 
-        if (changed & BSS_CHANGED_BSSID) {
+        /*
+         * Firmware manages AP self-peer internally so make sure to not create
+         * it in driver. Otherwise AP self-peer deletion may timeout later.
+         */
+        if (changed & BSS_CHANGED_BSSID &&
+            vif->type != NL80211_IFTYPE_AP) {
                 if (!is_zero_ether_addr(info->bssid)) {
                         ath10k_dbg(ATH10K_DBG_MAC,
                                    "mac vdev %d create peer %pM\n",
@@ -2829,7 +3039,7 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                         ret = ath10k_peer_create(ar, arvif->vdev_id,
                                                  info->bssid);
                         if (ret)
-                                ath10k_warn("Failed to add peer %pM for vdev %d when changing bssid: %i\n",
+                                ath10k_warn("failed to add peer %pM for vdev %d when changing bssid: %i\n",
                                             info->bssid, arvif->vdev_id, ret);
 
                         if (vif->type == NL80211_IFTYPE_STATION) {
@@ -2868,20 +3078,13 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                 ath10k_control_beaconing(arvif, info);
 
         if (changed & BSS_CHANGED_ERP_CTS_PROT) {
-                u32 cts_prot;
-                if (info->use_cts_prot)
-                        cts_prot = 1;
-                else
-                        cts_prot = 0;
-
+                arvif->use_cts_prot = info->use_cts_prot;
                 ath10k_dbg(ATH10K_DBG_MAC, "mac vdev %d cts_prot %d\n",
-                           arvif->vdev_id, cts_prot);
+                           arvif->vdev_id, info->use_cts_prot);
 
-                vdev_param = ar->wmi.vdev_param->enable_rtscts;
-                ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
-                                                cts_prot);
+                ret = ath10k_recalc_rtscts_prot(arvif);
                 if (ret)
-                        ath10k_warn("Failed to set CTS prot for vdev %d: %d\n",
+                        ath10k_warn("failed to recalculate rts/cts prot for vdev %d: %d\n",
                                     arvif->vdev_id, ret);
         }
 
@@ -2900,7 +3103,7 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                 ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
                                                 slottime);
                 if (ret)
-                        ath10k_warn("Failed to set erp slot for vdev %d: %i\n",
+                        ath10k_warn("failed to set erp slot for vdev %d: %i\n",
                                     arvif->vdev_id, ret);
         }
 
@@ -2919,7 +3122,7 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                 ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
                                                 preamble);
                 if (ret)
-                        ath10k_warn("Failed to set preamble for vdev %d: %i\n",
+                        ath10k_warn("failed to set preamble for vdev %d: %i\n",
                                     arvif->vdev_id, ret);
         }
 
@@ -2990,7 +3193,7 @@ static int ath10k_hw_scan(struct ieee80211_hw *hw,
 
         ret = ath10k_start_scan(ar, &arg);
         if (ret) {
-                ath10k_warn("could not start hw scan (%d)\n", ret);
+                ath10k_warn("failed to start hw scan: %d\n", ret);
                 spin_lock_bh(&ar->data_lock);
                 ar->scan.in_progress = false;
                 spin_unlock_bh(&ar->data_lock);
@@ -3010,8 +3213,7 @@ static void ath10k_cancel_hw_scan(struct ieee80211_hw *hw,
         mutex_lock(&ar->conf_mutex);
         ret = ath10k_abort_scan(ar);
         if (ret) {
-                ath10k_warn("couldn't abort scan (%d). forcefully sending scan completion to mac80211\n",
-                            ret);
+                ath10k_warn("failed to abort scan: %d\n", ret);
                 ieee80211_scan_completed(hw, 1 /* aborted */);
         }
         mutex_unlock(&ar->conf_mutex);
@@ -3089,7 +3291,7 @@ static int ath10k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 
         if (!peer) {
                 if (cmd == SET_KEY) {
-                        ath10k_warn("cannot install key for non-existent peer %pM\n",
+                        ath10k_warn("failed to install key for non-existent peer %pM\n",
                                     peer_addr);
                         ret = -EOPNOTSUPP;
                         goto exit;
@@ -3112,7 +3314,7 @@ static int ath10k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 
         ret = ath10k_install_key(arvif, key, cmd, peer_addr);
         if (ret) {
-                ath10k_warn("key installation failed for vdev %i peer %pM: %d\n",
+                ath10k_warn("failed to install key for vdev %i peer %pM: %d\n",
                             arvif->vdev_id, peer_addr, ret);
                 goto exit;
         }
@@ -3127,7 +3329,7 @@ static int ath10k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 peer->keys[key->keyidx] = NULL;
         else if (peer == NULL)
                 /* impossible unless FW goes crazy */
-                ath10k_warn("peer %pM disappeared!\n", peer_addr);
+                ath10k_warn("Peer %pM disappeared!\n", peer_addr);
         spin_unlock_bh(&ar->data_lock);
 
 exit:
@@ -3195,6 +3397,16 @@ static void ath10k_sta_rc_update_wk(struct work_struct *wk)
                                     sta->addr, smps, err);
         }
 
+        if (changed & IEEE80211_RC_SUPP_RATES_CHANGED) {
+                ath10k_dbg(ATH10K_DBG_MAC, "mac update sta %pM supp rates\n",
+                           sta->addr);
+
+                err = ath10k_station_assoc(ar, arvif, sta, true);
+                if (err)
+                        ath10k_warn("failed to reassociate station: %pM\n",
+                                    sta->addr);
+        }
+
         mutex_unlock(&ar->conf_mutex);
 }
 
@@ -3236,7 +3448,7 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                         max_num_peers = TARGET_NUM_PEERS;
 
                 if (ar->num_peers >= max_num_peers) {
-                        ath10k_warn("Number of peers exceeded: peers number %d (max peers %d)\n",
+                        ath10k_warn("number of peers exceeded: peers number %d (max peers %d)\n",
                                     ar->num_peers, max_num_peers);
                         ret = -ENOBUFS;
                         goto exit;
@@ -3248,7 +3460,7 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
 
                 ret = ath10k_peer_create(ar, arvif->vdev_id, sta->addr);
                 if (ret)
-                        ath10k_warn("Failed to add peer %pM for vdev %d when adding a new sta: %i\n",
+                        ath10k_warn("failed to add peer %pM for vdev %d when adding a new sta: %i\n",
                                     sta->addr, arvif->vdev_id, ret);
         } else if ((old_state == IEEE80211_STA_NONE &&
                     new_state == IEEE80211_STA_NOTEXIST)) {
@@ -3260,7 +3472,7 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                            arvif->vdev_id, sta->addr);
                 ret = ath10k_peer_delete(ar, arvif->vdev_id, sta->addr);
                 if (ret)
-                        ath10k_warn("Failed to delete peer %pM for vdev %d: %i\n",
+                        ath10k_warn("failed to delete peer %pM for vdev %d: %i\n",
                                     sta->addr, arvif->vdev_id, ret);
 
                 if (vif->type == NL80211_IFTYPE_STATION)
@@ -3275,9 +3487,9 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                 ath10k_dbg(ATH10K_DBG_MAC, "mac sta %pM associated\n",
                            sta->addr);
 
-                ret = ath10k_station_assoc(ar, arvif, sta);
+                ret = ath10k_station_assoc(ar, arvif, sta, false);
                 if (ret)
-                        ath10k_warn("Failed to associate station %pM for vdev %i: %i\n",
+                        ath10k_warn("failed to associate station %pM for vdev %i: %i\n",
                                     sta->addr, arvif->vdev_id, ret);
         } else if (old_state == IEEE80211_STA_ASSOC &&
                    new_state == IEEE80211_STA_AUTH &&
@@ -3291,7 +3503,7 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
 
                 ret = ath10k_station_disassoc(ar, arvif, sta);
                 if (ret)
-                        ath10k_warn("Failed to disassociate station: %pM vdev %i ret %i\n",
+                        ath10k_warn("failed to disassociate station: %pM vdev %i: %i\n",
                                     sta->addr, arvif->vdev_id, ret);
         }
 exit:
@@ -3339,7 +3551,7 @@ static int ath10k_conf_tx_uapsd(struct ath10k *ar, struct ieee80211_vif *vif,
                                           WMI_STA_PS_PARAM_UAPSD,
                                           arvif->u.sta.uapsd);
         if (ret) {
-                ath10k_warn("could not set uapsd params %d\n", ret);
+                ath10k_warn("failed to set uapsd params: %d\n", ret);
                 goto exit;
         }
 
@@ -3352,7 +3564,7 @@ static int ath10k_conf_tx_uapsd(struct ath10k *ar, struct ieee80211_vif *vif,
                                           WMI_STA_PS_PARAM_RX_WAKE_POLICY,
                                           value);
         if (ret)
-                ath10k_warn("could not set rx wake param %d\n", ret);
+                ath10k_warn("failed to set rx wake param: %d\n", ret);
 
 exit:
         return ret;
@@ -3402,13 +3614,13 @@ static int ath10k_conf_tx(struct ieee80211_hw *hw,
         /* FIXME: FW accepts wmm params per hw, not per vif */
         ret = ath10k_wmi_pdev_set_wmm_params(ar, &ar->wmm_params);
         if (ret) {
-                ath10k_warn("could not set wmm params %d\n", ret);
+                ath10k_warn("failed to set wmm params: %d\n", ret);
                 goto exit;
         }
 
         ret = ath10k_conf_tx_uapsd(ar, vif, ac, params->uapsd);
         if (ret)
-                ath10k_warn("could not set sta uapsd %d\n", ret);
+                ath10k_warn("failed to set sta uapsd: %d\n", ret);
 
 exit:
         mutex_unlock(&ar->conf_mutex);
@@ -3461,7 +3673,7 @@ static int ath10k_remain_on_channel(struct ieee80211_hw *hw,
 
         ret = ath10k_start_scan(ar, &arg);
         if (ret) {
-                ath10k_warn("could not start roc scan (%d)\n", ret);
+                ath10k_warn("failed to start roc scan: %d\n", ret);
                 spin_lock_bh(&ar->data_lock);
                 ar->scan.in_progress = false;
                 spin_unlock_bh(&ar->data_lock);
@@ -3470,7 +3682,7 @@ static int ath10k_remain_on_channel(struct ieee80211_hw *hw,
 
         ret = wait_for_completion_timeout(&ar->scan.on_channel, 3*HZ);
         if (ret == 0) {
-                ath10k_warn("could not switch to channel for roc scan\n");
+                ath10k_warn("failed to switch to channel for roc scan\n");
                 ath10k_abort_scan(ar);
                 ret = -ETIMEDOUT;
                 goto exit;
@@ -3511,7 +3723,7 @@ static int ath10k_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
 
                 ret = ath10k_mac_set_rts(arvif, value);
                 if (ret) {
-                        ath10k_warn("could not set rts threshold for vdev %d (%d)\n",
+                        ath10k_warn("failed to set rts threshold for vdev %d: %d\n",
                                     arvif->vdev_id, ret);
                         break;
                 }
@@ -3534,7 +3746,7 @@ static int ath10k_set_frag_threshold(struct ieee80211_hw *hw, u32 value)
 
                 ret = ath10k_mac_set_rts(arvif, value);
                 if (ret) {
-                        ath10k_warn("could not set fragmentation threshold for vdev %d (%d)\n",
+                        ath10k_warn("failed to set fragmentation threshold for vdev %d: %d\n",
                                     arvif->vdev_id, ret);
                         break;
                 }
@@ -3544,7 +3756,8 @@ static int ath10k_set_frag_threshold(struct ieee80211_hw *hw, u32 value)
         return ret;
 }
 
-static void ath10k_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+static void ath10k_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                         u32 queues, bool drop)
 {
         struct ath10k *ar = hw->priv;
         bool skip;
@@ -3573,7 +3786,7 @@ static void ath10k_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
                 }), ATH10K_FLUSH_TIMEOUT_HZ);
 
         if (ret <= 0 || skip)
-                ath10k_warn("tx not flushed (skip %i ar-state %i): %i\n",
+                ath10k_warn("failed to flush transmit queue (skip %i ar-state %i): %i\n",
                             skip, ar->state, ret);
 
 skip:
@@ -3608,7 +3821,7 @@ static int ath10k_suspend(struct ieee80211_hw *hw,
 
         ret = ath10k_hif_suspend(ar);
         if (ret) {
-                ath10k_warn("could not suspend hif (%d)\n", ret);
+                ath10k_warn("failed to suspend hif: %d\n", ret);
                 goto resume;
         }
 
@@ -3617,7 +3830,7 @@ static int ath10k_suspend(struct ieee80211_hw *hw,
 resume:
         ret = ath10k_wmi_pdev_resume_target(ar);
         if (ret)
-                ath10k_warn("could not resume target (%d)\n", ret);
+                ath10k_warn("failed to resume target: %d\n", ret);
 
         ret = 1;
 exit:
@@ -3634,14 +3847,14 @@ static int ath10k_resume(struct ieee80211_hw *hw)
 
         ret = ath10k_hif_resume(ar);
         if (ret) {
-                ath10k_warn("could not resume hif (%d)\n", ret);
+                ath10k_warn("failed to resume hif: %d\n", ret);
                 ret = 1;
                 goto exit;
         }
 
         ret = ath10k_wmi_pdev_resume_target(ar);
         if (ret) {
-                ath10k_warn("could not resume target (%d)\n", ret);
+                ath10k_warn("failed to resume target: %d\n", ret);
                 ret = 1;
                 goto exit;
         }
@@ -3964,7 +4177,7 @@ static int ath10k_set_fixed_rate_param(struct ath10k_vif *arvif,
         ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id,
                                         vdev_param, fixed_rate);
         if (ret) {
-                ath10k_warn("Could not set fixed_rate param 0x%02x: %d\n",
+                ath10k_warn("failed to set fixed rate param 0x%02x: %d\n",
                             fixed_rate, ret);
                 ret = -EINVAL;
                 goto exit;
@@ -3977,7 +4190,7 @@ static int ath10k_set_fixed_rate_param(struct ath10k_vif *arvif,
                                         vdev_param, fixed_nss);
 
         if (ret) {
-                ath10k_warn("Could not set fixed_nss param %d: %d\n",
+                ath10k_warn("failed to set fixed nss param %d: %d\n",
                             fixed_nss, ret);
                 ret = -EINVAL;
                 goto exit;
@@ -3990,7 +4203,7 @@ static int ath10k_set_fixed_rate_param(struct ath10k_vif *arvif,
                                         force_sgi);
 
         if (ret) {
-                ath10k_warn("Could not set sgi param %d: %d\n",
+                ath10k_warn("failed to set sgi param %d: %d\n",
                             force_sgi, ret);
                 ret = -EINVAL;
                 goto exit;
@@ -4026,7 +4239,7 @@ static int ath10k_set_bitrate_mask(struct ieee80211_hw *hw,
         }
 
         if (fixed_rate == WMI_FIXED_RATE_NONE && force_sgi) {
-                ath10k_warn("Could not force SGI usage for default rate settings\n");
+                ath10k_warn("failed to force SGI usage for default rate settings\n");
                 return -EINVAL;
         }
 
@@ -4034,14 +4247,6 @@ static int ath10k_set_bitrate_mask(struct ieee80211_hw *hw,
                                            fixed_nss, force_sgi);
 }
 
-static void ath10k_channel_switch_beacon(struct ieee80211_hw *hw,
-                                         struct ieee80211_vif *vif,
-                                         struct cfg80211_chan_def *chandef)
-{
-        /* there's no need to do anything here. vif->csa_active is enough */
-        return;
-}
-
 static void ath10k_sta_rc_update(struct ieee80211_hw *hw,
                                  struct ieee80211_vif *vif,
                                  struct ieee80211_sta *sta,
@@ -4072,8 +4277,8 @@ static void ath10k_sta_rc_update(struct ieee80211_hw *hw,
                         bw = WMI_PEER_CHWIDTH_80MHZ;
                         break;
                 case IEEE80211_STA_RX_BW_160:
-                        ath10k_warn("mac sta rc update for %pM: invalid bw %d\n",
-                                    sta->addr, sta->bandwidth);
+                        ath10k_warn("Invalid bandwith %d in rc update for %pM\n",
+                                    sta->bandwidth, sta->addr);
                         bw = WMI_PEER_CHWIDTH_20MHZ;
                         break;
                 }
@@ -4099,8 +4304,8 @@ static void ath10k_sta_rc_update(struct ieee80211_hw *hw,
                         smps = WMI_PEER_SMPS_DYNAMIC;
                         break;
                 case IEEE80211_SMPS_NUM_MODES:
-                        ath10k_warn("mac sta rc update for %pM: invalid smps: %d\n",
-                                    sta->addr, sta->smps_mode);
+                        ath10k_warn("Invalid smps %d in sta rc update for %pM\n",
+                                    sta->smps_mode, sta->addr);
                         smps = WMI_PEER_SMPS_PS_NONE;
                         break;
                 }
@@ -4108,15 +4313,6 @@ static void ath10k_sta_rc_update(struct ieee80211_hw *hw,
                 arsta->smps = smps;
         }
 
-        if (changed & IEEE80211_RC_SUPP_RATES_CHANGED) {
-                /* FIXME: Not implemented. Probably the only way to do it would
-                 * be to re-assoc the peer. */
-                changed &= ~IEEE80211_RC_SUPP_RATES_CHANGED;
-                ath10k_dbg(ATH10K_DBG_MAC,
-                           "mac sta rc update for %pM: changing supported rates not implemented\n",
-                           sta->addr);
-        }
-
         arsta->changed |= changed;
 
         spin_unlock_bh(&ar->data_lock);
@@ -4154,10 +4350,11 @@ static const struct ieee80211_ops ath10k_ops = {
         .set_frag_threshold             = ath10k_set_frag_threshold,
         .flush                          = ath10k_flush,
         .tx_last_beacon                 = ath10k_tx_last_beacon,
+        .set_antenna                    = ath10k_set_antenna,
+        .get_antenna                    = ath10k_get_antenna,
         .restart_complete               = ath10k_restart_complete,
         .get_survey                     = ath10k_get_survey,
         .set_bitrate_mask               = ath10k_set_bitrate_mask,
-        .channel_switch_beacon          = ath10k_channel_switch_beacon,
         .sta_rc_update                  = ath10k_sta_rc_update,
         .get_tsf                        = ath10k_get_tsf,
 #ifdef CONFIG_PM
@@ -4503,6 +4700,18 @@ int ath10k_mac_register(struct ath10k *ar)
                 BIT(NL80211_IFTYPE_ADHOC) |
                 BIT(NL80211_IFTYPE_AP);
 
+        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
+                /* TODO:  Have to deal with 2x2 chips if/when the come out. */
+                ar->supp_tx_chainmask = TARGET_10X_TX_CHAIN_MASK;
+                ar->supp_rx_chainmask = TARGET_10X_RX_CHAIN_MASK;
+        } else {
+                ar->supp_tx_chainmask = TARGET_TX_CHAIN_MASK;
+                ar->supp_rx_chainmask = TARGET_RX_CHAIN_MASK;
+        }
+
+        ar->hw->wiphy->available_antennas_rx = ar->supp_rx_chainmask;
+        ar->hw->wiphy->available_antennas_tx = ar->supp_tx_chainmask;
+
         if (!test_bit(ATH10K_FW_FEATURE_NO_P2P, ar->fw_features))
                 ar->hw->wiphy->interface_modes |=
                         BIT(NL80211_IFTYPE_P2P_CLIENT) |
@@ -4516,7 +4725,6 @@ int ath10k_mac_register(struct ath10k *ar)
                         IEEE80211_HW_REPORTS_TX_ACK_STATUS |
                         IEEE80211_HW_HAS_RATE_CONTROL |
                         IEEE80211_HW_SUPPORTS_STATIC_SMPS |
-                        IEEE80211_HW_WANT_MONITOR_VIF |
                         IEEE80211_HW_AP_LINK_PS |
                         IEEE80211_HW_SPECTRUM_MGMT;
 
@@ -4570,19 +4778,19 @@ int ath10k_mac_register(struct ath10k *ar)
                                                              NL80211_DFS_UNSET);
 
                 if (!ar->dfs_detector)
-                        ath10k_warn("dfs pattern detector init failed\n");
+                        ath10k_warn("failed to initialise DFS pattern detector\n");
         }
 
         ret = ath_regd_init(&ar->ath_common.regulatory, ar->hw->wiphy,
                             ath10k_reg_notifier);
         if (ret) {
-                ath10k_err("Regulatory initialization failed: %i\n", ret);
+                ath10k_err("failed to initialise regulatory: %i\n", ret);
                 goto err_free;
         }
 
         ret = ieee80211_register_hw(ar->hw);
         if (ret) {
-                ath10k_err("ieee80211 registration failed: %d\n", ret);
+                ath10k_err("failed to register ieee80211: %d\n", ret);
                 goto err_free;
         }
 
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index 9d242d801d9d..d0004d59c97e 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -39,15 +39,28 @@ enum ath10k_pci_irq_mode {
         ATH10K_PCI_IRQ_MSI = 2,
 };
 
-static unsigned int ath10k_target_ps;
+enum ath10k_pci_reset_mode {
+        ATH10K_PCI_RESET_AUTO = 0,
+        ATH10K_PCI_RESET_WARM_ONLY = 1,
+};
+
+static unsigned int ath10k_pci_target_ps;
 static unsigned int ath10k_pci_irq_mode = ATH10K_PCI_IRQ_AUTO;
+static unsigned int ath10k_pci_reset_mode = ATH10K_PCI_RESET_AUTO;
 
-module_param(ath10k_target_ps, uint, 0644);
-MODULE_PARM_DESC(ath10k_target_ps, "Enable ath10k Target (SoC) PS option");
+module_param_named(target_ps, ath10k_pci_target_ps, uint, 0644);
+MODULE_PARM_DESC(target_ps, "Enable ath10k Target (SoC) PS option");
 
 module_param_named(irq_mode, ath10k_pci_irq_mode, uint, 0644);
 MODULE_PARM_DESC(irq_mode, "0: auto, 1: legacy, 2: msi (default: 0)");
 
+module_param_named(reset_mode, ath10k_pci_reset_mode, uint, 0644);
+MODULE_PARM_DESC(reset_mode, "0: auto, 1: warm only (default: 0)");
+
+/* how long wait to wait for target to initialise, in ms */
+#define ATH10K_PCI_TARGET_WAIT 3000
+#define ATH10K_PCI_NUM_WARM_RESET_ATTEMPTS 3
+
 #define QCA988X_2_0_DEVICE_ID   (0x003c)
 
 static DEFINE_PCI_DEVICE_TABLE(ath10k_pci_id_table) = {
@@ -346,9 +359,10 @@ static int ath10k_pci_diag_read_mem(struct ath10k *ar, u32 address, void *data,
          *   2) Buffer in DMA-able space
          */
         orig_nbytes = nbytes;
-        data_buf = (unsigned char *)pci_alloc_consistent(ar_pci->pdev,
-                                                         orig_nbytes,
-                                                         &ce_data_base);
+        data_buf = (unsigned char *)dma_alloc_coherent(ar->dev,
+                                                       orig_nbytes,
+                                                       &ce_data_base,
+                                                       GFP_ATOMIC);
 
         if (!data_buf) {
                 ret = -ENOMEM;
@@ -442,12 +456,12 @@ done:
                                 __le32_to_cpu(((__le32 *)data_buf)[i]);
                 }
         } else
-                ath10k_dbg(ATH10K_DBG_PCI, "%s failure (0x%x)\n",
-                           __func__, address);
+                ath10k_warn("failed to read diag value at 0x%x: %d\n",
+                            address, ret);
 
         if (data_buf)
-                pci_free_consistent(ar_pci->pdev, orig_nbytes,
-                                    data_buf, ce_data_base);
+                dma_free_coherent(ar->dev, orig_nbytes, data_buf,
+                                  ce_data_base);
 
         return ret;
 }
@@ -490,9 +504,10 @@ static int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
          *   2) Buffer in DMA-able space
          */
         orig_nbytes = nbytes;
-        data_buf = (unsigned char *)pci_alloc_consistent(ar_pci->pdev,
-                                                         orig_nbytes,
-                                                         &ce_data_base);
+        data_buf = (unsigned char *)dma_alloc_coherent(ar->dev,
+                                                       orig_nbytes,
+                                                       &ce_data_base,
+                                                       GFP_ATOMIC);
         if (!data_buf) {
                 ret = -ENOMEM;
                 goto done;
@@ -588,13 +603,13 @@ static int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
 
 done:
         if (data_buf) {
-                pci_free_consistent(ar_pci->pdev, orig_nbytes, data_buf,
-                                    ce_data_base);
+                dma_free_coherent(ar->dev, orig_nbytes, data_buf,
+                                  ce_data_base);
         }
 
         if (ret != 0)
-                ath10k_dbg(ATH10K_DBG_PCI, "%s failure (0x%x)\n", __func__,
-                           address);
+                ath10k_warn("failed to write diag value at 0x%x: %d\n",
+                            address, ret);
 
         return ret;
 }
@@ -747,17 +762,21 @@ static int ath10k_pci_hif_tx_sg(struct ath10k *ar, u8 pipe_id,
         struct ath10k_pci_pipe *pci_pipe = &ar_pci->pipe_info[pipe_id];
         struct ath10k_ce_pipe *ce_pipe = pci_pipe->ce_hdl;
         struct ath10k_ce_ring *src_ring = ce_pipe->src_ring;
-        unsigned int nentries_mask = src_ring->nentries_mask;
-        unsigned int sw_index = src_ring->sw_index;
-        unsigned int write_index = src_ring->write_index;
-        int err, i;
+        unsigned int nentries_mask;
+        unsigned int sw_index;
+        unsigned int write_index;
+        int err, i = 0;
 
         spin_lock_bh(&ar_pci->ce_lock);
 
+        nentries_mask = src_ring->nentries_mask;
+        sw_index = src_ring->sw_index;
+        write_index = src_ring->write_index;
+
         if (unlikely(CE_RING_DELTA(nentries_mask,
                                    write_index, sw_index - 1) < n_items)) {
                 err = -ENOBUFS;
-                goto unlock;
+                goto err;
         }
 
         for (i = 0; i < n_items - 1; i++) {
@@ -774,7 +793,7 @@ static int ath10k_pci_hif_tx_sg(struct ath10k *ar, u8 pipe_id,
                                             items[i].transfer_id,
                                             CE_SEND_FLAG_GATHER);
                 if (err)
-                        goto unlock;
+                        goto err;
         }
 
         /* `i` is equal to `n_items -1` after for() */
@@ -792,10 +811,15 @@ static int ath10k_pci_hif_tx_sg(struct ath10k *ar, u8 pipe_id,
                                     items[i].transfer_id,
                                     0);
         if (err)
-                goto unlock;
+                goto err;
+
+        spin_unlock_bh(&ar_pci->ce_lock);
+        return 0;
+
+err:
+        for (; i > 0; i--)
+                __ath10k_ce_send_revert(ce_pipe);
 
-        err = 0;
-unlock:
         spin_unlock_bh(&ar_pci->ce_lock);
         return err;
 }
@@ -803,6 +827,9 @@ unlock:
 static u16 ath10k_pci_hif_get_free_queue_number(struct ath10k *ar, u8 pipe)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+
+        ath10k_dbg(ATH10K_DBG_PCI, "pci hif get free queue number\n");
+
         return ath10k_ce_num_free_src_entries(ar_pci->pipe_info[pipe].ce_hdl);
 }
 
@@ -854,6 +881,8 @@ static void ath10k_pci_hif_dump_area(struct ath10k *ar)
 static void ath10k_pci_hif_send_complete_check(struct ath10k *ar, u8 pipe,
                                                int force)
 {
+        ath10k_dbg(ATH10K_DBG_PCI, "pci hif send complete check\n");
+
         if (!force) {
                 int resources;
                 /*
@@ -880,7 +909,7 @@ static void ath10k_pci_hif_set_callbacks(struct ath10k *ar,
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
 
-        ath10k_dbg(ATH10K_DBG_PCI, "%s\n", __func__);
+        ath10k_dbg(ATH10K_DBG_PCI, "pci hif set callbacks\n");
 
         memcpy(&ar_pci->msg_callbacks_current, callbacks,
                sizeof(ar_pci->msg_callbacks_current));
@@ -938,6 +967,8 @@ static int ath10k_pci_hif_map_service_to_pipe(struct ath10k *ar,
 {
         int ret = 0;
 
+        ath10k_dbg(ATH10K_DBG_PCI, "pci hif map service\n");
+
         /* polling for received messages not supported */
         *dl_is_polled = 0;
 
@@ -997,6 +1028,8 @@ static void ath10k_pci_hif_get_default_pipe(struct ath10k *ar,
 {
         int ul_is_polled, dl_is_polled;
 
+        ath10k_dbg(ATH10K_DBG_PCI, "pci hif get default pipe\n");
+
         (void)ath10k_pci_hif_map_service_to_pipe(ar,
                                                  ATH10K_HTC_SVC_ID_RSVD_CTRL,
                                                  ul_pipe,
@@ -1098,6 +1131,8 @@ static int ath10k_pci_hif_start(struct ath10k *ar)
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         int ret, ret_early;
 
+        ath10k_dbg(ATH10K_DBG_BOOT, "boot hif start\n");
+
         ath10k_pci_free_early_irq(ar);
         ath10k_pci_kill_tasklet(ar);
 
@@ -1233,18 +1268,10 @@ static void ath10k_pci_buffer_cleanup(struct ath10k *ar)
 
 static void ath10k_pci_ce_deinit(struct ath10k *ar)
 {
-        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct ath10k_pci_pipe *pipe_info;
-        int pipe_num;
+        int i;
 
-        for (pipe_num = 0; pipe_num < CE_COUNT; pipe_num++) {
-                pipe_info = &ar_pci->pipe_info[pipe_num];
-                if (pipe_info->ce_hdl) {
-                        ath10k_ce_deinit(pipe_info->ce_hdl);
-                        pipe_info->ce_hdl = NULL;
-                        pipe_info->buf_sz = 0;
-                }
-        }
+        for (i = 0; i < CE_COUNT; i++)
+                ath10k_ce_deinit_pipe(ar, i);
 }
 
 static void ath10k_pci_hif_stop(struct ath10k *ar)
@@ -1252,7 +1279,10 @@ static void ath10k_pci_hif_stop(struct ath10k *ar)
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         int ret;
 
-        ath10k_dbg(ATH10K_DBG_PCI, "%s\n", __func__);
+        ath10k_dbg(ATH10K_DBG_BOOT, "boot hif stop\n");
+
+        if (WARN_ON(!ar_pci->started))
+                return;
 
         ret = ath10k_ce_disable_interrupts(ar);
         if (ret)
@@ -1697,30 +1727,49 @@ static int ath10k_pci_init_config(struct ath10k *ar)
         return 0;
 }
 
+static int ath10k_pci_alloc_ce(struct ath10k *ar)
+{
+        int i, ret;
+
+        for (i = 0; i < CE_COUNT; i++) {
+                ret = ath10k_ce_alloc_pipe(ar, i, &host_ce_config_wlan[i]);
+                if (ret) {
+                        ath10k_err("failed to allocate copy engine pipe %d: %d\n",
+                                   i, ret);
+                        return ret;
+                }
+        }
 
+        return 0;
+}
+
+static void ath10k_pci_free_ce(struct ath10k *ar)
+{
+        int i;
+
+        for (i = 0; i < CE_COUNT; i++)
+                ath10k_ce_free_pipe(ar, i);
+}
 
 static int ath10k_pci_ce_init(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         struct ath10k_pci_pipe *pipe_info;
         const struct ce_attr *attr;
-        int pipe_num;
+        int pipe_num, ret;
 
         for (pipe_num = 0; pipe_num < CE_COUNT; pipe_num++) {
                 pipe_info = &ar_pci->pipe_info[pipe_num];
+                pipe_info->ce_hdl = &ar_pci->ce_states[pipe_num];
                 pipe_info->pipe_num = pipe_num;
                 pipe_info->hif_ce_state = ar;
                 attr = &host_ce_config_wlan[pipe_num];
 
-                pipe_info->ce_hdl = ath10k_ce_init(ar, pipe_num, attr);
-                if (pipe_info->ce_hdl == NULL) {
-                        ath10k_err("failed to initialize CE for pipe: %d\n",
-                                   pipe_num);
-
-                        /* It is safe to call it here. It checks if ce_hdl is
-                         * valid for each pipe */
-                        ath10k_pci_ce_deinit(ar);
-                        return -1;
+                ret = ath10k_ce_init_pipe(ar, pipe_num, attr);
+                if (ret) {
+                        ath10k_err("failed to initialize copy engine pipe %d: %d\n",
+                                   pipe_num, ret);
+                        return ret;
                 }
 
                 if (pipe_num == CE_COUNT - 1) {
@@ -1741,16 +1790,15 @@ static int ath10k_pci_ce_init(struct ath10k *ar)
 static void ath10k_pci_fw_interrupt_handler(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        u32 fw_indicator_address, fw_indicator;
+        u32 fw_indicator;
 
         ath10k_pci_wake(ar);
 
-        fw_indicator_address = ar_pci->fw_indicator_address;
-        fw_indicator = ath10k_pci_read32(ar, fw_indicator_address);
+        fw_indicator = ath10k_pci_read32(ar, FW_INDICATOR_ADDRESS);
 
         if (fw_indicator & FW_IND_EVENT_PENDING) {
                 /* ACK: clear Target-side pending event */
-                ath10k_pci_write32(ar, fw_indicator_address,
+                ath10k_pci_write32(ar, FW_INDICATOR_ADDRESS,
                                    fw_indicator & ~FW_IND_EVENT_PENDING);
 
                 if (ar_pci->started) {
@@ -1767,13 +1815,32 @@ static void ath10k_pci_fw_interrupt_handler(struct ath10k *ar)
         ath10k_pci_sleep(ar);
 }
 
+/* this function effectively clears target memory controller assert line */
+static void ath10k_pci_warm_reset_si0(struct ath10k *ar)
+{
+        u32 val;
+
+        val = ath10k_pci_soc_read32(ar, SOC_RESET_CONTROL_ADDRESS);
+        ath10k_pci_soc_write32(ar, SOC_RESET_CONTROL_ADDRESS,
+                               val | SOC_RESET_CONTROL_SI0_RST_MASK);
+        val = ath10k_pci_soc_read32(ar, SOC_RESET_CONTROL_ADDRESS);
+
+        msleep(10);
+
+        val = ath10k_pci_soc_read32(ar, SOC_RESET_CONTROL_ADDRESS);
+        ath10k_pci_soc_write32(ar, SOC_RESET_CONTROL_ADDRESS,
+                               val & ~SOC_RESET_CONTROL_SI0_RST_MASK);
+        val = ath10k_pci_soc_read32(ar, SOC_RESET_CONTROL_ADDRESS);
+
+        msleep(10);
+}
+
 static int ath10k_pci_warm_reset(struct ath10k *ar)
 {
-        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         int ret = 0;
         u32 val;
 
-        ath10k_dbg(ATH10K_DBG_BOOT, "boot performing warm chip reset\n");
+        ath10k_dbg(ATH10K_DBG_BOOT, "boot warm reset\n");
 
         ret = ath10k_do_pci_wake(ar);
         if (ret) {
@@ -1801,7 +1868,7 @@ static int ath10k_pci_warm_reset(struct ath10k *ar)
         msleep(100);
 
         /* clear fw indicator */
-        ath10k_pci_write32(ar, ar_pci->fw_indicator_address, 0);
+        ath10k_pci_write32(ar, FW_INDICATOR_ADDRESS, 0);
 
         /* clear target LF timer interrupts */
         val = ath10k_pci_read32(ar, RTC_SOC_BASE_ADDRESS +
@@ -1826,6 +1893,8 @@ static int ath10k_pci_warm_reset(struct ath10k *ar)
                                 SOC_RESET_CONTROL_ADDRESS);
         msleep(10);
 
+        ath10k_pci_warm_reset_si0(ar);
+
         /* debug */
         val = ath10k_pci_read32(ar, SOC_CORE_BASE_ADDRESS +
                                 PCIE_INTR_CAUSE_ADDRESS);
@@ -1934,7 +2003,9 @@ static int __ath10k_pci_hif_power_up(struct ath10k *ar, bool cold_reset)
                 irq_mode = "legacy";
 
         if (!test_bit(ATH10K_FLAG_FIRST_BOOT_DONE, &ar->dev_flags))
-                ath10k_info("pci irq %s\n", irq_mode);
+                ath10k_info("pci irq %s irq_mode %d reset_mode %d\n",
+                            irq_mode, ath10k_pci_irq_mode,
+                            ath10k_pci_reset_mode);
 
         return 0;
 
@@ -1952,23 +2023,52 @@ err:
         return ret;
 }
 
+static int ath10k_pci_hif_power_up_warm(struct ath10k *ar)
+{
+        int i, ret;
+
+        /*
+         * Sometime warm reset succeeds after retries.
+         *
+         * FIXME: It might be possible to tune ath10k_pci_warm_reset() to work
+         * at first try.
+         */
+        for (i = 0; i < ATH10K_PCI_NUM_WARM_RESET_ATTEMPTS; i++) {
+                ret = __ath10k_pci_hif_power_up(ar, false);
+                if (ret == 0)
+                        break;
+
+                ath10k_warn("failed to warm reset (attempt %d out of %d): %d\n",
+                            i + 1, ATH10K_PCI_NUM_WARM_RESET_ATTEMPTS, ret);
+        }
+
+        return ret;
+}
+
 static int ath10k_pci_hif_power_up(struct ath10k *ar)
 {
         int ret;
 
+        ath10k_dbg(ATH10K_DBG_BOOT, "boot hif power up\n");
+
         /*
          * Hardware CUS232 version 2 has some issues with cold reset and the
          * preferred (and safer) way to perform a device reset is through a
          * warm reset.
          *
-         * Warm reset doesn't always work though (notably after a firmware
-         * crash) so fall back to cold reset if necessary.
+         * Warm reset doesn't always work though so fall back to cold reset may
+         * be necessary.
          */
-        ret = __ath10k_pci_hif_power_up(ar, false);
+        ret = ath10k_pci_hif_power_up_warm(ar);
         if (ret) {
-                ath10k_warn("failed to power up target using warm reset (%d), trying cold reset\n",
+                ath10k_warn("failed to power up target using warm reset: %d\n",
                             ret);
 
+                if (ath10k_pci_reset_mode == ATH10K_PCI_RESET_WARM_ONLY)
+                        return ret;
+
+                ath10k_warn("trying cold reset\n");
+
                 ret = __ath10k_pci_hif_power_up(ar, true);
                 if (ret) {
                         ath10k_err("failed to power up target using cold reset too (%d)\n",
@@ -1984,12 +2084,14 @@ static void ath10k_pci_hif_power_down(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
 
+        ath10k_dbg(ATH10K_DBG_BOOT, "boot hif power down\n");
+
         ath10k_pci_free_early_irq(ar);
         ath10k_pci_kill_tasklet(ar);
         ath10k_pci_deinit_irq(ar);
+        ath10k_pci_ce_deinit(ar);
         ath10k_pci_warm_reset(ar);
 
-        ath10k_pci_ce_deinit(ar);
         if (!test_bit(ATH10K_PCI_FEATURE_SOC_POWER_SAVE, ar_pci->features))
                 ath10k_do_pci_sleep(ar);
 }
@@ -2137,7 +2239,6 @@ static irqreturn_t ath10k_pci_interrupt_handler(int irq, void *arg)
 static void ath10k_pci_early_irq_tasklet(unsigned long data)
 {
         struct ath10k *ar = (struct ath10k *)data;
-        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         u32 fw_ind;
         int ret;
 
@@ -2148,14 +2249,11 @@ static void ath10k_pci_early_irq_tasklet(unsigned long data)
                 return;
         }
 
-        fw_ind = ath10k_pci_read32(ar, ar_pci->fw_indicator_address);
+        fw_ind = ath10k_pci_read32(ar, FW_INDICATOR_ADDRESS);
         if (fw_ind & FW_IND_EVENT_PENDING) {
-                ath10k_pci_write32(ar, ar_pci->fw_indicator_address,
+                ath10k_pci_write32(ar, FW_INDICATOR_ADDRESS,
                                    fw_ind & ~FW_IND_EVENT_PENDING);
-
-                /* Some structures are unavailable during early boot or at
-                 * driver teardown so just print that the device has crashed. */
-                ath10k_warn("device crashed - no diagnostics available\n");
+                ath10k_pci_hif_dump_area(ar);
         }
 
         ath10k_pci_sleep(ar);
@@ -2385,33 +2483,69 @@ static int ath10k_pci_deinit_irq(struct ath10k *ar)
 static int ath10k_pci_wait_for_target_init(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        int wait_limit = 300; /* 3 sec */
+        unsigned long timeout;
         int ret;
+        u32 val;
+
+        ath10k_dbg(ATH10K_DBG_BOOT, "boot waiting target to initialise\n");
 
         ret = ath10k_pci_wake(ar);
         if (ret) {
-                ath10k_err("failed to wake up target: %d\n", ret);
+                ath10k_err("failed to wake up target for init: %d\n", ret);
                 return ret;
         }
 
-        while (wait_limit-- &&
-               !(ioread32(ar_pci->mem + FW_INDICATOR_ADDRESS) &
-                 FW_IND_INITIALIZED)) {
+        timeout = jiffies + msecs_to_jiffies(ATH10K_PCI_TARGET_WAIT);
+
+        do {
+                val = ath10k_pci_read32(ar, FW_INDICATOR_ADDRESS);
+
+                ath10k_dbg(ATH10K_DBG_BOOT, "boot target indicator %x\n", val);
+
+                /* target should never return this */
+                if (val == 0xffffffff)
+                        continue;
+
+                /* the device has crashed so don't bother trying anymore */
+                if (val & FW_IND_EVENT_PENDING)
+                        break;
+
+                if (val & FW_IND_INITIALIZED)
+                        break;
+
                 if (ar_pci->num_msi_intrs == 0)
                         /* Fix potential race by repeating CORE_BASE writes */
-                        iowrite32(PCIE_INTR_FIRMWARE_MASK |
-                                  PCIE_INTR_CE_MASK_ALL,
-                                  ar_pci->mem + (SOC_CORE_BASE_ADDRESS |
-                                                 PCIE_INTR_ENABLE_ADDRESS));
+                        ath10k_pci_soc_write32(ar, PCIE_INTR_ENABLE_ADDRESS,
+                                               PCIE_INTR_FIRMWARE_MASK |
+                                               PCIE_INTR_CE_MASK_ALL);
+
                 mdelay(10);
-        }
+        } while (time_before(jiffies, timeout));
 
-        if (wait_limit < 0) {
-                ath10k_err("target stalled\n");
+        if (val == 0xffffffff) {
+                ath10k_err("failed to read device register, device is gone\n");
                 ret = -EIO;
                 goto out;
         }
 
+        if (val & FW_IND_EVENT_PENDING) {
+                ath10k_warn("device has crashed during init\n");
+                ath10k_pci_write32(ar, FW_INDICATOR_ADDRESS,
+                                   val & ~FW_IND_EVENT_PENDING);
+                ath10k_pci_hif_dump_area(ar);
+                ret = -ECOMM;
+                goto out;
+        }
+
+        if (!(val & FW_IND_INITIALIZED)) {
+                ath10k_err("failed to receive initialized event from target: %08x\n",
+                           val);
+                ret = -ETIMEDOUT;
+                goto out;
+        }
+
+        ath10k_dbg(ATH10K_DBG_BOOT, "boot target initialised\n");
+
 out:
         ath10k_pci_sleep(ar);
         return ret;
@@ -2422,6 +2556,8 @@ static int ath10k_pci_cold_reset(struct ath10k *ar)
         int i, ret;
         u32 val;
 
+        ath10k_dbg(ATH10K_DBG_BOOT, "boot cold reset\n");
+
         ret = ath10k_do_pci_wake(ar);
         if (ret) {
                 ath10k_err("failed to wake up target: %d\n",
@@ -2453,6 +2589,9 @@ static int ath10k_pci_cold_reset(struct ath10k *ar)
         }
 
         ath10k_do_pci_sleep(ar);
+
+        ath10k_dbg(ATH10K_DBG_BOOT, "boot cold reset complete\n");
+
         return 0;
 }
 
@@ -2484,7 +2623,7 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
         struct ath10k_pci *ar_pci;
         u32 lcr_val, chip_id;
 
-        ath10k_dbg(ATH10K_DBG_PCI, "%s\n", __func__);
+        ath10k_dbg(ATH10K_DBG_PCI, "pci probe\n");
 
         ar_pci = kzalloc(sizeof(*ar_pci), GFP_KERNEL);
         if (ar_pci == NULL)
@@ -2503,7 +2642,7 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
                 goto err_ar_pci;
         }
 
-        if (ath10k_target_ps)
+        if (ath10k_pci_target_ps)
                 set_bit(ATH10K_PCI_FEATURE_SOC_POWER_SAVE, ar_pci->features);
 
         ath10k_pci_dump_features(ar_pci);
@@ -2516,23 +2655,10 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
         }
 
         ar_pci->ar = ar;
-        ar_pci->fw_indicator_address = FW_INDICATOR_ADDRESS;
         atomic_set(&ar_pci->keep_awake_count, 0);
 
         pci_set_drvdata(pdev, ar);
 
-        /*
-         * Without any knowledge of the Host, the Target may have been reset or
-         * power cycled and its Config Space may no longer reflect the PCI
-         * address space that was assigned earlier by the PCI infrastructure.
-         * Refresh it now.
-         */
-        ret = pci_assign_resource(pdev, BAR_NUM);
-        if (ret) {
-                ath10k_err("failed to assign PCI space: %d\n", ret);
-                goto err_ar;
-        }
-
         ret = pci_enable_device(pdev);
         if (ret) {
                 ath10k_err("failed to enable PCI device: %d\n", ret);
@@ -2594,16 +2720,24 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
 
         ath10k_do_pci_sleep(ar);
 
+        ret = ath10k_pci_alloc_ce(ar);
+        if (ret) {
+                ath10k_err("failed to allocate copy engine pipes: %d\n", ret);
+                goto err_iomap;
+        }
+
         ath10k_dbg(ATH10K_DBG_BOOT, "boot pci_mem 0x%p\n", ar_pci->mem);
 
         ret = ath10k_core_register(ar, chip_id);
         if (ret) {
                 ath10k_err("failed to register driver core: %d\n", ret);
-                goto err_iomap;
+                goto err_free_ce;
         }
 
         return 0;
 
+err_free_ce:
+        ath10k_pci_free_ce(ar);
 err_iomap:
         pci_iounmap(pdev, mem);
 err_master:
@@ -2626,7 +2760,7 @@ static void ath10k_pci_remove(struct pci_dev *pdev)
         struct ath10k *ar = pci_get_drvdata(pdev);
         struct ath10k_pci *ar_pci;
 
-        ath10k_dbg(ATH10K_DBG_PCI, "%s\n", __func__);
+        ath10k_dbg(ATH10K_DBG_PCI, "pci remove\n");
 
         if (!ar)
                 return;
@@ -2636,9 +2770,8 @@ static void ath10k_pci_remove(struct pci_dev *pdev)
         if (!ar_pci)
                 return;
 
-        tasklet_kill(&ar_pci->msi_fw_err);
-
         ath10k_core_unregister(ar);
+        ath10k_pci_free_ce(ar);
 
         pci_iounmap(pdev, ar_pci->mem);
         pci_release_region(pdev, BAR_NUM);
@@ -2680,6 +2813,5 @@ module_exit(ath10k_pci_exit);
 MODULE_AUTHOR("Qualcomm Atheros");
 MODULE_DESCRIPTION("Driver support for Atheros QCA988X PCIe devices");
 MODULE_LICENSE("Dual BSD/GPL");
-MODULE_FIRMWARE(QCA988X_HW_2_0_FW_DIR "/" QCA988X_HW_2_0_FW_FILE);
-MODULE_FIRMWARE(QCA988X_HW_2_0_FW_DIR "/" QCA988X_HW_2_0_OTP_FILE);
+MODULE_FIRMWARE(QCA988X_HW_2_0_FW_DIR "/" QCA988X_HW_2_0_FW_2_FILE);
 MODULE_FIRMWARE(QCA988X_HW_2_0_FW_DIR "/" QCA988X_HW_2_0_BOARD_DATA_FILE);
diff --git a/drivers/net/wireless/ath/ath10k/pci.h b/drivers/net/wireless/ath/ath10k/pci.h
index b43fdb4f7319..dfdebb4157aa 100644
--- a/drivers/net/wireless/ath/ath10k/pci.h
+++ b/drivers/net/wireless/ath/ath10k/pci.h
@@ -189,9 +189,6 @@ struct ath10k_pci {
 
         struct ath10k_hif_cb msg_callbacks_current;
 
-        /* Target address used to signal a pending firmware event */
-        u32 fw_indicator_address;
-
         /* Copy Engine used for Diagnostic Accesses */
         struct ath10k_ce_pipe *ce_diag;
 
diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c
index 0541dd939ce9..82669a77e553 100644
--- a/drivers/net/wireless/ath/ath10k/txrx.c
+++ b/drivers/net/wireless/ath/ath10k/txrx.c
@@ -100,189 +100,6 @@ exit:
                 wake_up(&htt->empty_tx_wq);
 }
 
-static const u8 rx_legacy_rate_idx[] = {
-        3,      /* 0x00  - 11Mbps  */
-        2,      /* 0x01  - 5.5Mbps */
-        1,      /* 0x02  - 2Mbps   */
-        0,      /* 0x03  - 1Mbps   */
-        3,      /* 0x04  - 11Mbps  */
-        2,      /* 0x05  - 5.5Mbps */
-        1,      /* 0x06  - 2Mbps   */
-        0,      /* 0x07  - 1Mbps   */
-        10,     /* 0x08  - 48Mbps  */
-        8,      /* 0x09  - 24Mbps  */
-        6,      /* 0x0A  - 12Mbps  */
-        4,      /* 0x0B  - 6Mbps   */
-        11,     /* 0x0C  - 54Mbps  */
-        9,      /* 0x0D  - 36Mbps  */
-        7,      /* 0x0E  - 18Mbps  */
-        5,      /* 0x0F  - 9Mbps   */
-};
-
-static void process_rx_rates(struct ath10k *ar, struct htt_rx_info *info,
-                             enum ieee80211_band band,
-                             struct ieee80211_rx_status *status)
-{
-        u8 cck, rate, rate_idx, bw, sgi, mcs, nss;
-        u8 info0 = info->rate.info0;
-        u32 info1 = info->rate.info1;
-        u32 info2 = info->rate.info2;
-        u8 preamble = 0;
-
-        /* Check if valid fields */
-        if (!(info0 & HTT_RX_INDICATION_INFO0_START_VALID))
-                return;
-
-        preamble = MS(info1, HTT_RX_INDICATION_INFO1_PREAMBLE_TYPE);
-
-        switch (preamble) {
-        case HTT_RX_LEGACY:
-                cck = info0 & HTT_RX_INDICATION_INFO0_LEGACY_RATE_CCK;
-                rate = MS(info0, HTT_RX_INDICATION_INFO0_LEGACY_RATE);
-                rate_idx = 0;
-
-                if (rate < 0x08 || rate > 0x0F)
-                        break;
-
-                switch (band) {
-                case IEEE80211_BAND_2GHZ:
-                        if (cck)
-                                rate &= ~BIT(3);
-                        rate_idx = rx_legacy_rate_idx[rate];
-                        break;
-                case IEEE80211_BAND_5GHZ:
-                        rate_idx = rx_legacy_rate_idx[rate];
-                        /* We are using same rate table registering
-                           HW - ath10k_rates[]. In case of 5GHz skip
-                           CCK rates, so -4 here */
-                        rate_idx -= 4;
-                        break;
-                default:
-                        break;
-                }
-
-                status->rate_idx = rate_idx;
-                break;
-        case HTT_RX_HT:
-        case HTT_RX_HT_WITH_TXBF:
-                /* HT-SIG - Table 20-11 in info1 and info2 */
-                mcs = info1 & 0x1F;
-                nss = mcs >> 3;
-                bw = (info1 >> 7) & 1;
-                sgi = (info2 >> 7) & 1;
-
-                status->rate_idx = mcs;
-                status->flag |= RX_FLAG_HT;
-                if (sgi)
-                        status->flag |= RX_FLAG_SHORT_GI;
-                if (bw)
-                        status->flag |= RX_FLAG_40MHZ;
-                break;
-        case HTT_RX_VHT:
-        case HTT_RX_VHT_WITH_TXBF:
-                /* VHT-SIG-A1 in info 1, VHT-SIG-A2 in info2
-                   TODO check this */
-                mcs = (info2 >> 4) & 0x0F;
-                nss = ((info1 >> 10) & 0x07) + 1;
-                bw = info1 & 3;
-                sgi = info2 & 1;
-
-                status->rate_idx = mcs;
-                status->vht_nss = nss;
-
-                if (sgi)
-                        status->flag |= RX_FLAG_SHORT_GI;
-
-                switch (bw) {
-                /* 20MHZ */
-                case 0:
-                        break;
-                /* 40MHZ */
-                case 1:
-                        status->flag |= RX_FLAG_40MHZ;
-                        break;
-                /* 80MHZ */
-                case 2:
-                        status->vht_flag |= RX_VHT_FLAG_80MHZ;
-                }
-
-                status->flag |= RX_FLAG_VHT;
-                break;
-        default:
-                break;
-        }
-}
-
-void ath10k_process_rx(struct ath10k *ar, struct htt_rx_info *info)
-{
-        struct ieee80211_rx_status *status;
-        struct ieee80211_channel *ch;
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)info->skb->data;
-
-        status = IEEE80211_SKB_RXCB(info->skb);
-        memset(status, 0, sizeof(*status));
-
-        if (info->encrypt_type != HTT_RX_MPDU_ENCRYPT_NONE) {
-                status->flag |= RX_FLAG_DECRYPTED | RX_FLAG_IV_STRIPPED |
-                                RX_FLAG_MMIC_STRIPPED;
-                hdr->frame_control = __cpu_to_le16(
-                                __le16_to_cpu(hdr->frame_control) &
-                                ~IEEE80211_FCTL_PROTECTED);
-        }
-
-        if (info->mic_err)
-                status->flag |= RX_FLAG_MMIC_ERROR;
-
-        if (info->fcs_err)
-                status->flag |= RX_FLAG_FAILED_FCS_CRC;
-
-        if (info->amsdu_more)
-                status->flag |= RX_FLAG_AMSDU_MORE;
-
-        status->signal = info->signal;
-
-        spin_lock_bh(&ar->data_lock);
-        ch = ar->scan_channel;
-        if (!ch)
-                ch = ar->rx_channel;
-        spin_unlock_bh(&ar->data_lock);
-
-        if (!ch) {
-                ath10k_warn("no channel configured; ignoring frame!\n");
-                dev_kfree_skb_any(info->skb);
-                return;
-        }
-
-        process_rx_rates(ar, info, ch->band, status);
-        status->band = ch->band;
-        status->freq = ch->center_freq;
-
-        if (info->rate.info0 & HTT_RX_INDICATION_INFO0_END_VALID) {
-                /* TSF available only in 32-bit */
-                status->mactime = info->tsf & 0xffffffff;
-                status->flag |= RX_FLAG_MACTIME_END;
-        }
-
-        ath10k_dbg(ATH10K_DBG_DATA,
-                   "rx skb %p len %u %s%s%s%s%s %srate_idx %u vht_nss %u freq %u band %u flag 0x%x fcs-err %i\n",
-                   info->skb,
-                   info->skb->len,
-                   status->flag == 0 ? "legacy" : "",
-                   status->flag & RX_FLAG_HT ? "ht" : "",
-                   status->flag & RX_FLAG_VHT ? "vht" : "",
-                   status->flag & RX_FLAG_40MHZ ? "40" : "",
-                   status->vht_flag & RX_VHT_FLAG_80MHZ ? "80" : "",
-                   status->flag & RX_FLAG_SHORT_GI ? "sgi " : "",
-                   status->rate_idx,
-                   status->vht_nss,
-                   status->freq,
-                   status->band, status->flag, info->fcs_err);
-        ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "rx skb: ",
-                        info->skb->data, info->skb->len);
-
-        ieee80211_rx(ar->hw, info->skb);
-}
-
 struct ath10k_peer *ath10k_peer_find(struct ath10k *ar, int vdev_id,
                                      const u8 *addr)
 {
diff --git a/drivers/net/wireless/ath/ath10k/txrx.h b/drivers/net/wireless/ath/ath10k/txrx.h
index 356dc9c04c9e..aee3e20058f8 100644
--- a/drivers/net/wireless/ath/ath10k/txrx.h
+++ b/drivers/net/wireless/ath/ath10k/txrx.h
@@ -21,7 +21,6 @@
 
 void ath10k_txrx_tx_unref(struct ath10k_htt *htt,
                           const struct htt_tx_done *tx_done);
-void ath10k_process_rx(struct ath10k *ar, struct htt_rx_info *info);
 
 struct ath10k_peer *ath10k_peer_find(struct ath10k *ar, int vdev_id,
                                      const u8 *addr);
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index cb1f7b5bcf4c..4b7782a529ac 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -639,6 +639,7 @@ int ath10k_wmi_mgmt_tx(struct ath10k *ar, struct sk_buff *skb)
         struct sk_buff *wmi_skb;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         int len;
+        u32 buf_len = skb->len;
         u16 fc;
 
         hdr = (struct ieee80211_hdr *)skb->data;
@@ -648,6 +649,15 @@ int ath10k_wmi_mgmt_tx(struct ath10k *ar, struct sk_buff *skb)
                 return -EINVAL;
 
         len = sizeof(cmd->hdr) + skb->len;
+
+        if ((ieee80211_is_action(hdr->frame_control) ||
+             ieee80211_is_deauth(hdr->frame_control) ||
+             ieee80211_is_disassoc(hdr->frame_control)) &&
+             ieee80211_has_protected(hdr->frame_control)) {
+                len += IEEE80211_CCMP_MIC_LEN;
+                buf_len += IEEE80211_CCMP_MIC_LEN;
+        }
+
         len = round_up(len, 4);
 
         wmi_skb = ath10k_wmi_alloc_skb(len);
@@ -659,7 +669,7 @@ int ath10k_wmi_mgmt_tx(struct ath10k *ar, struct sk_buff *skb)
         cmd->hdr.vdev_id = __cpu_to_le32(ATH10K_SKB_CB(skb)->vdev_id);
         cmd->hdr.tx_rate = 0;
         cmd->hdr.tx_power = 0;
-        cmd->hdr.buf_len = __cpu_to_le32((u32)(skb->len));
+        cmd->hdr.buf_len = __cpu_to_le32(buf_len);
 
         memcpy(cmd->hdr.peer_macaddr.addr, ieee80211_get_DA(hdr), ETH_ALEN);
         memcpy(cmd->buf, skb->data, skb->len);
@@ -957,10 +967,16 @@ static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
          * frames with Protected Bit set. */
         if (ieee80211_has_protected(hdr->frame_control) &&
             !ieee80211_is_auth(hdr->frame_control)) {
-                status->flag |= RX_FLAG_DECRYPTED | RX_FLAG_IV_STRIPPED |
-                                RX_FLAG_MMIC_STRIPPED;
-                hdr->frame_control = __cpu_to_le16(fc &
+                status->flag |= RX_FLAG_DECRYPTED;
+
+                if (!ieee80211_is_action(hdr->frame_control) &&
+                    !ieee80211_is_deauth(hdr->frame_control) &&
+                    !ieee80211_is_disassoc(hdr->frame_control)) {
+                        status->flag |= RX_FLAG_IV_STRIPPED |
+                                        RX_FLAG_MMIC_STRIPPED;
+                        hdr->frame_control = __cpu_to_le16(fc &
                                         ~IEEE80211_FCTL_PROTECTED);
+                }
         }
 
         ath10k_dbg(ATH10K_DBG_MGMT,
@@ -1362,13 +1378,10 @@ static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
         struct sk_buff *bcn;
         int ret, vdev_id = 0;
 
-        ath10k_dbg(ATH10K_DBG_MGMT, "WMI_HOST_SWBA_EVENTID\n");
-
         ev = (struct wmi_host_swba_event *)skb->data;
         map = __le32_to_cpu(ev->vdev_map);
 
-        ath10k_dbg(ATH10K_DBG_MGMT, "host swba:\n"
-                   "-vdev map 0x%x\n",
+        ath10k_dbg(ATH10K_DBG_MGMT, "mgmt swba vdev_map 0x%x\n",
                    ev->vdev_map);
 
         for (; map; map >>= 1, vdev_id++) {
@@ -1385,12 +1398,7 @@ static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
                 bcn_info = &ev->bcn_info[i];
 
                 ath10k_dbg(ATH10K_DBG_MGMT,
-                           "-bcn_info[%d]:\n"
-                           "--tim_len %d\n"
-                           "--tim_mcast %d\n"
-                           "--tim_changed %d\n"
-                           "--tim_num_ps_pending %d\n"
-                           "--tim_bitmap 0x%08x%08x%08x%08x\n",
+                           "mgmt event bcn_info %d tim_len %d mcast %d changed %d num_ps_pending %d bitmap 0x%08x%08x%08x%08x\n",
                            i,
                            __le32_to_cpu(bcn_info->tim_info.tim_len),
                            __le32_to_cpu(bcn_info->tim_info.tim_mcast),
@@ -1439,6 +1447,7 @@ static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
                                          ATH10K_SKB_CB(arvif->beacon)->paddr,
                                          arvif->beacon->len, DMA_TO_DEVICE);
                         dev_kfree_skb_any(arvif->beacon);
+                        arvif->beacon = NULL;
                 }
 
                 ATH10K_SKB_CB(bcn)->paddr = dma_map_single(arvif->ar->dev,
@@ -1448,6 +1457,7 @@ static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
                                         ATH10K_SKB_CB(bcn)->paddr);
                 if (ret) {
                         ath10k_warn("failed to map beacon: %d\n", ret);
+                        dev_kfree_skb_any(bcn);
                         goto skip;
                 }
 
@@ -2365,7 +2375,7 @@ void ath10k_wmi_detach(struct ath10k *ar)
         ar->wmi.num_mem_chunks = 0;
 }
 
-int ath10k_wmi_connect_htc_service(struct ath10k *ar)
+int ath10k_wmi_connect(struct ath10k *ar)
 {
         int status;
         struct ath10k_htc_svc_conn_req conn_req;
@@ -2393,8 +2403,9 @@ int ath10k_wmi_connect_htc_service(struct ath10k *ar)
         return 0;
 }
 
-int ath10k_wmi_pdev_set_regdomain(struct ath10k *ar, u16 rd, u16 rd2g,
-                                  u16 rd5g, u16 ctl2g, u16 ctl5g)
+static int ath10k_wmi_main_pdev_set_regdomain(struct ath10k *ar, u16 rd,
+                                              u16 rd2g, u16 rd5g, u16 ctl2g,
+                                              u16 ctl5g)
 {
         struct wmi_pdev_set_regdomain_cmd *cmd;
         struct sk_buff *skb;
@@ -2418,6 +2429,46 @@ int ath10k_wmi_pdev_set_regdomain(struct ath10k *ar, u16 rd, u16 rd2g,
                                    ar->wmi.cmd->pdev_set_regdomain_cmdid);
 }
 
+static int ath10k_wmi_10x_pdev_set_regdomain(struct ath10k *ar, u16 rd,
+                                             u16 rd2g, u16 rd5g,
+                                             u16 ctl2g, u16 ctl5g,
+                                             enum wmi_dfs_region dfs_reg)
+{
+        struct wmi_pdev_set_regdomain_cmd_10x *cmd;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(sizeof(*cmd));
+        if (!skb)
+                return -ENOMEM;
+
+        cmd = (struct wmi_pdev_set_regdomain_cmd_10x *)skb->data;
+        cmd->reg_domain = __cpu_to_le32(rd);
+        cmd->reg_domain_2G = __cpu_to_le32(rd2g);
+        cmd->reg_domain_5G = __cpu_to_le32(rd5g);
+        cmd->conformance_test_limit_2G = __cpu_to_le32(ctl2g);
+        cmd->conformance_test_limit_5G = __cpu_to_le32(ctl5g);
+        cmd->dfs_domain = __cpu_to_le32(dfs_reg);
+
+        ath10k_dbg(ATH10K_DBG_WMI,
+                   "wmi pdev regdomain rd %x rd2g %x rd5g %x ctl2g %x ctl5g %x dfs_region %x\n",
+                   rd, rd2g, rd5g, ctl2g, ctl5g, dfs_reg);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->pdev_set_regdomain_cmdid);
+}
+
+int ath10k_wmi_pdev_set_regdomain(struct ath10k *ar, u16 rd, u16 rd2g,
+                                  u16 rd5g, u16 ctl2g, u16 ctl5g,
+                                  enum wmi_dfs_region dfs_reg)
+{
+        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features))
+                return ath10k_wmi_10x_pdev_set_regdomain(ar, rd, rd2g, rd5g,
+                                                        ctl2g, ctl5g, dfs_reg);
+        else
+                return ath10k_wmi_main_pdev_set_regdomain(ar, rd, rd2g, rd5g,
+                                                         ctl2g, ctl5g);
+}
+
 int ath10k_wmi_pdev_set_channel(struct ath10k *ar,
                                 const struct wmi_channel_arg *arg)
 {
@@ -3456,8 +3507,9 @@ int ath10k_wmi_peer_assoc(struct ath10k *ar,
                 __cpu_to_le32(arg->peer_vht_rates.tx_mcs_set);
 
         ath10k_dbg(ATH10K_DBG_WMI,
-                   "wmi peer assoc vdev %d addr %pM\n",
-                   arg->vdev_id, arg->addr);
+                   "wmi peer assoc vdev %d addr %pM (%s)\n",
+                   arg->vdev_id, arg->addr,
+                   arg->peer_reassoc ? "reassociate" : "new");
         return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_assoc_cmdid);
 }
 
diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h
index f51d5ca0141f..e93df2c10413 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.h
+++ b/drivers/net/wireless/ath/ath10k/wmi.h
@@ -198,16 +198,6 @@ struct wmi_mac_addr {
         } __packed;
 } __packed;
 
-/* macro to convert MAC address from WMI word format to char array */
-#define WMI_MAC_ADDR_TO_CHAR_ARRAY(pwmi_mac_addr, c_macaddr) do { \
-        (c_macaddr)[0] =  ((pwmi_mac_addr)->word0) & 0xff; \
-        (c_macaddr)[1] = (((pwmi_mac_addr)->word0) >> 8) & 0xff; \
-        (c_macaddr)[2] = (((pwmi_mac_addr)->word0) >> 16) & 0xff; \
-        (c_macaddr)[3] = (((pwmi_mac_addr)->word0) >> 24) & 0xff; \
-        (c_macaddr)[4] =  ((pwmi_mac_addr)->word1) & 0xff; \
-        (c_macaddr)[5] = (((pwmi_mac_addr)->word1) >> 8) & 0xff; \
-        } while (0)
-
 struct wmi_cmd_map {
         u32 init_cmdid;
         u32 start_scan_cmdid;
@@ -2185,6 +2175,31 @@ struct wmi_pdev_set_regdomain_cmd {
         __le32 conformance_test_limit_5G;
 } __packed;
 
+enum wmi_dfs_region {
+        /* Uninitialized dfs domain */
+        WMI_UNINIT_DFS_DOMAIN = 0,
+
+        /* FCC3 dfs domain */
+        WMI_FCC_DFS_DOMAIN = 1,
+
+        /* ETSI dfs domain */
+        WMI_ETSI_DFS_DOMAIN = 2,
+
+        /*Japan dfs domain */
+        WMI_MKK4_DFS_DOMAIN = 3,
+};
+
+struct wmi_pdev_set_regdomain_cmd_10x {
+        __le32 reg_domain;
+        __le32 reg_domain_2G;
+        __le32 reg_domain_5G;
+        __le32 conformance_test_limit_2G;
+        __le32 conformance_test_limit_5G;
+
+        /* dfs domain from wmi_dfs_region */
+        __le32 dfs_domain;
+} __packed;
+
 /* Command to set/unset chip in quiet mode */
 struct wmi_pdev_set_quiet_cmd {
         /* period in TUs */
@@ -2210,6 +2225,19 @@ enum ath10k_protmode {
         ATH10K_PROT_RTSCTS   = 2,    /* RTS-CTS */
 };
 
+enum wmi_rtscts_profile {
+        WMI_RTSCTS_FOR_NO_RATESERIES = 0,
+        WMI_RTSCTS_FOR_SECOND_RATESERIES,
+        WMI_RTSCTS_ACROSS_SW_RETRIES
+};
+
+#define WMI_RTSCTS_ENABLED              1
+#define WMI_RTSCTS_SET_MASK             0x0f
+#define WMI_RTSCTS_SET_LSB              0
+
+#define WMI_RTSCTS_PROFILE_MASK         0xf0
+#define WMI_RTSCTS_PROFILE_LSB          4
+
 enum wmi_beacon_gen_mode {
         WMI_BEACON_STAGGERED_MODE = 0,
         WMI_BEACON_BURST_MODE = 1
@@ -2295,9 +2323,9 @@ struct wmi_pdev_param_map {
 #define WMI_PDEV_PARAM_UNSUPPORTED 0
 
 enum wmi_pdev_param {
-        /* TX chian mask */
+        /* TX chain mask */
         WMI_PDEV_PARAM_TX_CHAIN_MASK = 0x1,
-        /* RX chian mask */
+        /* RX chain mask */
         WMI_PDEV_PARAM_RX_CHAIN_MASK,
         /* TX power limit for 2G Radio */
         WMI_PDEV_PARAM_TXPOWER_LIMIT2G,
@@ -2682,6 +2710,9 @@ struct wal_dbg_tx_stats {
         /* wal pdev resets  */
         __le32 pdev_resets;
 
+        /* frames dropped due to non-availability of stateless TIDs */
+        __le32 stateless_tid_alloc_failure;
+
         __le32 phy_underrun;
 
         /* MPDU is more than txop limit */
@@ -2738,13 +2769,21 @@ enum wmi_stats_id {
         WMI_REQUEST_AP_STAT     = 0x02
 };
 
+struct wlan_inst_rssi_args {
+        __le16 cfg_retry_count;
+        __le16 retry_count;
+};
+
 struct wmi_request_stats_cmd {
         __le32 stats_id;
 
-        /*
-         * Space to add parameters like
-         * peer mac addr
-         */
+        __le32 vdev_id;
+
+        /* peer MAC address */
+        struct wmi_mac_addr peer_macaddr;
+
+        /* Instantaneous RSSI arguments */
+        struct wlan_inst_rssi_args inst_rssi_args;
 } __packed;
 
 /* Suspend option */
@@ -2795,7 +2834,18 @@ struct wmi_stats_event {
  * PDEV statistics
  * TODO: add all PDEV stats here
  */
-struct wmi_pdev_stats {
+struct wmi_pdev_stats_old {
+        __le32 chan_nf;        /* Channel noise floor */
+        __le32 tx_frame_count; /* TX frame count */
+        __le32 rx_frame_count; /* RX frame count */
+        __le32 rx_clear_count; /* rx clear count */
+        __le32 cycle_count;    /* cycle count */
+        __le32 phy_err_count;  /* Phy error count */
+        __le32 chan_tx_pwr;    /* channel tx power */
+        struct wal_dbg_stats wal; /* WAL dbg stats */
+} __packed;
+
+struct wmi_pdev_stats_10x {
         __le32 chan_nf;        /* Channel noise floor */
         __le32 tx_frame_count; /* TX frame count */
         __le32 rx_frame_count; /* RX frame count */
@@ -2804,6 +2854,12 @@ struct wmi_pdev_stats {
         __le32 phy_err_count;  /* Phy error count */
         __le32 chan_tx_pwr;    /* channel tx power */
         struct wal_dbg_stats wal; /* WAL dbg stats */
+        __le32 ack_rx_bad;
+        __le32 rts_bad;
+        __le32 rts_good;
+        __le32 fcs_bad;
+        __le32 no_beacons;
+        __le32 mib_int_count;
 } __packed;
 
 /*
@@ -2818,10 +2874,17 @@ struct wmi_vdev_stats {
  * peer statistics.
  * TODO: add more stats
  */
-struct wmi_peer_stats {
+struct wmi_peer_stats_old {
+        struct wmi_mac_addr peer_macaddr;
+        __le32 peer_rssi;
+        __le32 peer_tx_rate;
+} __packed;
+
+struct wmi_peer_stats_10x {
         struct wmi_mac_addr peer_macaddr;
         __le32 peer_rssi;
         __le32 peer_tx_rate;
+        __le32 peer_rx_rate;
 } __packed;
 
 struct wmi_vdev_create_cmd {
@@ -4196,13 +4259,14 @@ void ath10k_wmi_detach(struct ath10k *ar);
 int ath10k_wmi_wait_for_service_ready(struct ath10k *ar);
 int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar);
 
-int ath10k_wmi_connect_htc_service(struct ath10k *ar);
+int ath10k_wmi_connect(struct ath10k *ar);
 int ath10k_wmi_pdev_set_channel(struct ath10k *ar,
                                 const struct wmi_channel_arg *);
 int ath10k_wmi_pdev_suspend_target(struct ath10k *ar, u32 suspend_opt);
 int ath10k_wmi_pdev_resume_target(struct ath10k *ar);
 int ath10k_wmi_pdev_set_regdomain(struct ath10k *ar, u16 rd, u16 rd2g,
-                                  u16 rd5g, u16 ctl2g, u16 ctl5g);
+                                  u16 rd5g, u16 ctl2g, u16 ctl5g,
+                                  enum wmi_dfs_region dfs_reg);
 int ath10k_wmi_pdev_set_param(struct ath10k *ar, u32 id, u32 value);
 int ath10k_wmi_cmd_init(struct ath10k *ar);
 int ath10k_wmi_start_scan(struct ath10k *ar, const struct wmi_start_scan_arg *);
diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index 1a2973b7acf2..0fce1c76638e 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -3709,8 +3709,8 @@ ath5k_hw_txpower(struct ath5k_hw *ah, struct ieee80211_channel *channel,
                         AR5K_REG_MS(AR5K_TUNE_MAX_TXPOWER, AR5K_TPC_CHIRP),
                         AR5K_TPC);
         } else {
-                ath5k_hw_reg_write(ah, AR5K_PHY_TXPOWER_RATE_MAX |
-                        AR5K_TUNE_MAX_TXPOWER, AR5K_PHY_TXPOWER_RATE_MAX);
+                ath5k_hw_reg_write(ah, AR5K_TUNE_MAX_TXPOWER,
+                        AR5K_PHY_TXPOWER_RATE_MAX);
         }
 
         return 0;
diff --git a/drivers/net/wireless/ath/ath6kl/Kconfig b/drivers/net/wireless/ath/ath6kl/Kconfig
index e39e5860a2e9..9c125ff083f7 100644
--- a/drivers/net/wireless/ath/ath6kl/Kconfig
+++ b/drivers/net/wireless/ath/ath6kl/Kconfig
@@ -1,11 +1,19 @@
 config ATH6KL
         tristate "Atheros mobile chipsets support"
+        depends on CFG80211
+        ---help---
+          This module adds core support for wireless adapters based on
+          Atheros AR6003 and AR6004 chipsets. You still need separate
+          bus drivers for USB and SDIO to be able to use real devices.
+
+          If you choose to build it as a module, it will be called
+          ath6kl_core. Please note that AR6002 and AR6001 are not
+          supported by this driver.
 
 config ATH6KL_SDIO
         tristate "Atheros ath6kl SDIO support"
         depends on ATH6KL
         depends on MMC
-        depends on CFG80211
         ---help---
           This module adds support for wireless adapters based on
           Atheros AR6003 and AR6004 chipsets running over SDIO. If you
@@ -17,25 +25,31 @@ config ATH6KL_USB
         tristate "Atheros ath6kl USB support"
         depends on ATH6KL
         depends on USB
-        depends on CFG80211
         ---help---
           This module adds support for wireless adapters based on
-          Atheros AR6004 chipset running over USB. This is still under
-          implementation and it isn't functional. If you choose to
-          build it as a module, it will be called ath6kl_usb.
+          Atheros AR6004 chipset and chipsets based on it running over
+          USB. If you choose to build it as a module, it will be
+          called ath6kl_usb.
 
 config ATH6KL_DEBUG
         bool "Atheros ath6kl debugging"
         depends on ATH6KL
         ---help---
-          Enables debug support
+          Enables ath6kl debug support, including debug messages
+          enabled with debug_mask module parameter and debugfs
+          interface.
+
+          If unsure, say Y to make it easier to debug problems.
 
 config ATH6KL_TRACING
         bool "Atheros ath6kl tracing support"
         depends on ATH6KL
         depends on EVENT_TRACING
         ---help---
-          Select this to ath6kl use tracing infrastructure.
+          Select this to ath6kl use tracing infrastructure which, for
+          example, can be enabled with help of trace-cmd. All debug
+          messages and commands are delivered to using individually
+          enablable trace points.
 
           If unsure, say Y to make it easier to debug problems.
 
@@ -47,3 +61,5 @@ config ATH6KL_REGDOMAIN
           Enabling this makes it possible to change the regdomain in
           the firmware. This can be only enabled if regulatory requirements
           are taken into account.
+
+          If unsure, say N.
diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
index c2c6f4604958..0e26f4a34fda 100644
--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
@@ -724,8 +724,9 @@ ath6kl_add_bss_if_needed(struct ath6kl_vif *vif,
                         ath6kl_dbg(ATH6KL_DBG_WLAN_CFG,
                                    "added bss %pM to cfg80211\n", bssid);
                 kfree(ie);
-        } else
+        } else {
                 ath6kl_dbg(ATH6KL_DBG_WLAN_CFG, "cfg80211 already has a bss\n");
+        }
 
         return bss;
 }
@@ -970,7 +971,6 @@ static int ath6kl_set_probed_ssids(struct ath6kl *ar,
                                           ssid_list[i].flag,
                                           ssid_list[i].ssid.ssid_len,
                                           ssid_list[i].ssid.ssid);
-
         }
 
         /* Make sure no old entries are left behind */
@@ -1759,7 +1759,7 @@ static bool is_rate_ht40(s32 rate, u8 *mcs, bool *sgi)
 }
 
 static int ath6kl_get_station(struct wiphy *wiphy, struct net_device *dev,
-                              u8 *mac, struct station_info *sinfo)
+                              const u8 *mac, struct station_info *sinfo)
 {
         struct ath6kl *ar = ath6kl_priv(dev);
         struct ath6kl_vif *vif = netdev_priv(dev);
@@ -1897,7 +1897,6 @@ static int ath6kl_wow_usr(struct ath6kl *ar, struct ath6kl_vif *vif,
 
         /* Configure the patterns that we received from the user. */
         for (i = 0; i < wow->n_patterns; i++) {
-
                 /*
                  * Convert given nl80211 specific mask value to equivalent
                  * driver specific mask value and send it to the chip along
@@ -2850,8 +2849,9 @@ static int ath6kl_start_ap(struct wiphy *wiphy, struct net_device *dev,
         if (p.prwise_crypto_type == 0) {
                 p.prwise_crypto_type = NONE_CRYPT;
                 ath6kl_set_cipher(vif, 0, true);
-        } else if (info->crypto.n_ciphers_pairwise == 1)
+        } else if (info->crypto.n_ciphers_pairwise == 1) {
                 ath6kl_set_cipher(vif, info->crypto.ciphers_pairwise[0], true);
+        }
 
         switch (info->crypto.cipher_group) {
         case WLAN_CIPHER_SUITE_WEP40:
@@ -2897,7 +2897,6 @@ static int ath6kl_start_ap(struct wiphy *wiphy, struct net_device *dev,
         }
 
         if (info->inactivity_timeout) {
-
                 inactivity_timeout = info->inactivity_timeout;
 
                 if (ar->hw.flags & ATH6KL_HW_AP_INACTIVITY_MINS)
@@ -2975,7 +2974,7 @@ static int ath6kl_stop_ap(struct wiphy *wiphy, struct net_device *dev)
 static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
 
 static int ath6kl_del_station(struct wiphy *wiphy, struct net_device *dev,
-                              u8 *mac)
+                              const u8 *mac)
 {
         struct ath6kl *ar = ath6kl_priv(dev);
         struct ath6kl_vif *vif = netdev_priv(dev);
@@ -2986,7 +2985,8 @@ static int ath6kl_del_station(struct wiphy *wiphy, struct net_device *dev,
 }
 
 static int ath6kl_change_station(struct wiphy *wiphy, struct net_device *dev,
-                                 u8 *mac, struct station_parameters *params)
+                                 const u8 *mac,
+                                 struct station_parameters *params)
 {
         struct ath6kl *ar = ath6kl_priv(dev);
         struct ath6kl_vif *vif = netdev_priv(dev);
diff --git a/drivers/net/wireless/ath/ath6kl/core.c b/drivers/net/wireless/ath/ath6kl/core.c
index 4b46adbe8c92..b0b652042760 100644
--- a/drivers/net/wireless/ath/ath6kl/core.c
+++ b/drivers/net/wireless/ath/ath6kl/core.c
@@ -45,9 +45,9 @@ module_param(testmode, uint, 0644);
 module_param(recovery_enable, uint, 0644);
 module_param(heart_beat_poll, uint, 0644);
 MODULE_PARM_DESC(recovery_enable, "Enable recovery from firmware error");
-MODULE_PARM_DESC(heart_beat_poll, "Enable fw error detection periodic"   \
-                 "polling. This also specifies the polling interval in"  \
-                 "msecs. Set reocvery_enable for this to be effective");
+MODULE_PARM_DESC(heart_beat_poll,
+                 "Enable fw error detection periodic polling in msecs - Also set recovery_enable for this to be effective");
+
 
 void ath6kl_core_tx_complete(struct ath6kl *ar, struct sk_buff *skb)
 {
diff --git a/drivers/net/wireless/ath/ath6kl/debug.c b/drivers/net/wireless/ath/ath6kl/debug.c
index dbfd17d0a5fa..55c4064dd506 100644
--- a/drivers/net/wireless/ath/ath6kl/debug.c
+++ b/drivers/net/wireless/ath/ath6kl/debug.c
@@ -172,7 +172,6 @@ void ath6kl_dump_registers(struct ath6kl_device *dev,
                            struct ath6kl_irq_proc_registers *irq_proc_reg,
                            struct ath6kl_irq_enable_reg *irq_enable_reg)
 {
-
         ath6kl_dbg(ATH6KL_DBG_IRQ, ("<------- Register Table -------->\n"));
 
         if (irq_proc_reg != NULL) {
@@ -219,7 +218,6 @@ void ath6kl_dump_registers(struct ath6kl_device *dev,
                                    "GMBOX lookahead alias 1:   0x%x\n",
                                    irq_proc_reg->rx_gmbox_lkahd_alias[1]);
                 }
-
         }
 
         if (irq_enable_reg != NULL) {
@@ -1396,7 +1394,6 @@ static ssize_t ath6kl_create_qos_write(struct file *file,
                                                 const char __user *user_buf,
                                                 size_t count, loff_t *ppos)
 {
-
         struct ath6kl *ar = file->private_data;
         struct ath6kl_vif *vif;
         char buf[200];
@@ -1575,7 +1572,6 @@ static ssize_t ath6kl_delete_qos_write(struct file *file,
                                 const char __user *user_buf,
                                 size_t count, loff_t *ppos)
 {
-
         struct ath6kl *ar = file->private_data;
         struct ath6kl_vif *vif;
         char buf[100];
diff --git a/drivers/net/wireless/ath/ath6kl/debug.h b/drivers/net/wireless/ath/ath6kl/debug.h
index ca9ba005f287..e194c10d9f00 100644
--- a/drivers/net/wireless/ath/ath6kl/debug.h
+++ b/drivers/net/wireless/ath/ath6kl/debug.h
@@ -97,8 +97,8 @@ static inline void ath6kl_dump_registers(struct ath6kl_device *dev,
                 struct ath6kl_irq_proc_registers *irq_proc_reg,
                 struct ath6kl_irq_enable_reg *irq_en_reg)
 {
-
 }
+
 static inline void dump_cred_dist_stats(struct htc_target *target)
 {
 }
diff --git a/drivers/net/wireless/ath/ath6kl/hif.c b/drivers/net/wireless/ath/ath6kl/hif.c
index fea7709b5dda..18c070850a09 100644
--- a/drivers/net/wireless/ath/ath6kl/hif.c
+++ b/drivers/net/wireless/ath/ath6kl/hif.c
@@ -37,7 +37,6 @@ static int ath6kl_hif_cp_scat_dma_buf(struct hif_scatter_req *req,
         buf = req->virt_dma_buf;
 
         for (i = 0; i < req->scat_entries; i++) {
-
                 if (from_dma)
                         memcpy(req->scat_list[i].buf, buf,
                                req->scat_list[i].len);
@@ -116,7 +115,6 @@ static void ath6kl_hif_dump_fw_crash(struct ath6kl *ar)
                             le32_to_cpu(regdump_val[i + 2]),
                             le32_to_cpu(regdump_val[i + 3]));
         }
-
 }
 
 static int ath6kl_hif_proc_dbg_intr(struct ath6kl_device *dev)
@@ -701,5 +699,4 @@ int ath6kl_hif_setup(struct ath6kl_device *dev)
 
 fail_setup:
         return status;
-
 }
diff --git a/drivers/net/wireless/ath/ath6kl/hif.h b/drivers/net/wireless/ath/ath6kl/hif.h
index 61f6b21fb0ae..dc6bd8cd9b83 100644
--- a/drivers/net/wireless/ath/ath6kl/hif.h
+++ b/drivers/net/wireless/ath/ath6kl/hif.h
@@ -197,9 +197,9 @@ struct hif_scatter_req {
         /* bounce buffer for upper layers to copy to/from */
         u8 *virt_dma_buf;
 
-        struct hif_scatter_item scat_list[1];
-
         u32 scat_q_depth;
+
+        struct hif_scatter_item scat_list[0];
 };
 
 struct ath6kl_irq_proc_registers {
diff --git a/drivers/net/wireless/ath/ath6kl/htc_mbox.c b/drivers/net/wireless/ath/ath6kl/htc_mbox.c
index 65e5b719093d..e481f14b9878 100644
--- a/drivers/net/wireless/ath/ath6kl/htc_mbox.c
+++ b/drivers/net/wireless/ath/ath6kl/htc_mbox.c
@@ -112,9 +112,9 @@ static void ath6kl_credit_init(struct ath6kl_htc_credit_info *cred_info,
                 if (cur_ep_dist->endpoint == ENDPOINT_0)
                         continue;
 
-                if (cur_ep_dist->svc_id == WMI_CONTROL_SVC)
+                if (cur_ep_dist->svc_id == WMI_CONTROL_SVC) {
                         cur_ep_dist->cred_norm = cur_ep_dist->cred_per_msg;
-                else {
+                } else {
                         /*
                          * For the remaining data endpoints, we assume that
                          * each cred_per_msg are the same. We use a simple
@@ -129,7 +129,6 @@ static void ath6kl_credit_init(struct ath6kl_htc_credit_info *cred_info,
                         count = (count * 3) >> 2;
                         count = max(count, cur_ep_dist->cred_per_msg);
                         cur_ep_dist->cred_norm = count;
-
                 }
 
                 ath6kl_dbg(ATH6KL_DBG_CREDIT,
@@ -549,7 +548,6 @@ static int htc_check_credits(struct htc_target *target,
                              enum htc_endpoint_id eid, unsigned int len,
                              int *req_cred)
 {
-
         *req_cred = (len > target->tgt_cred_sz) ?
                      DIV_ROUND_UP(len, target->tgt_cred_sz) : 1;
 
@@ -608,7 +606,6 @@ static void ath6kl_htc_tx_pkts_get(struct htc_target *target,
         unsigned int len;
 
         while (true) {
-
                 flags = 0;
 
                 if (list_empty(&endpoint->txq))
@@ -889,7 +886,6 @@ static void ath6kl_htc_tx_from_queue(struct htc_target *target,
                 ac = target->dev->ar->ep2ac_map[endpoint->eid];
 
         while (true) {
-
                 if (list_empty(&endpoint->txq))
                         break;
 
@@ -1190,7 +1186,6 @@ static void ath6kl_htc_mbox_flush_txep(struct htc_target *target,
                 list_add_tail(&packet->list, &container);
                 htc_tx_complete(endpoint, &container);
         }
-
 }
 
 static void ath6kl_htc_flush_txep_all(struct htc_target *target)
@@ -1394,7 +1389,6 @@ static int ath6kl_htc_rx_setup(struct htc_target *target,
 
         ep_cb = ep->ep_cb;
         for (j = 0; j < n_msg; j++) {
-
                 /*
                  * Reset flag, any packets allocated using the
                  * rx_alloc() API cannot be recycled on
@@ -1424,9 +1418,9 @@ static int ath6kl_htc_rx_setup(struct htc_target *target,
                                 }
                         }
 
-                        if (list_empty(&ep->rx_bufq))
+                        if (list_empty(&ep->rx_bufq)) {
                                 packet = NULL;
-                        else {
+                        } else {
                                 packet = list_first_entry(&ep->rx_bufq,
                                                 struct htc_packet, list);
                                 list_del(&packet->list);
@@ -1487,7 +1481,6 @@ static int ath6kl_htc_rx_alloc(struct htc_target *target,
         spin_lock_bh(&target->rx_lock);
 
         for (i = 0; i < msg; i++) {
-
                 htc_hdr = (struct htc_frame_hdr *)&lk_ahds[i];
 
                 if (htc_hdr->eid >= ENDPOINT_MAX) {
@@ -1708,7 +1701,6 @@ static int htc_parse_trailer(struct htc_target *target,
                 lk_ahd = (struct htc_lookahead_report *) record_buf;
                 if ((lk_ahd->pre_valid == ((~lk_ahd->post_valid) & 0xFF)) &&
                     next_lk_ahds) {
-
                         ath6kl_dbg(ATH6KL_DBG_HTC,
                                    "htc rx lk_ahd found pre_valid 0x%x post_valid 0x%x\n",
                                    lk_ahd->pre_valid, lk_ahd->post_valid);
@@ -1755,7 +1747,6 @@ static int htc_parse_trailer(struct htc_target *target,
         }
 
         return 0;
-
 }
 
 static int htc_proc_trailer(struct htc_target *target,
@@ -1776,7 +1767,6 @@ static int htc_proc_trailer(struct htc_target *target,
         status = 0;
 
         while (len > 0) {
-
                 if (len < sizeof(struct htc_record_hdr)) {
                         status = -ENOMEM;
                         break;
@@ -2098,7 +2088,6 @@ static int ath6kl_htc_rx_fetch(struct htc_target *target,
                 }
 
                 if (!fetched_pkts) {
-
                         packet = list_first_entry(rx_pktq, struct htc_packet,
                                                    list);
 
@@ -2173,7 +2162,6 @@ int ath6kl_htc_rxmsg_pending_handler(struct htc_target *target,
         look_aheads[0] = msg_look_ahead;
 
         while (true) {
-
                 /*
                  * First lookahead sets the expected endpoint IDs for all
                  * packets in a bundle.
@@ -2825,8 +2813,9 @@ static int ath6kl_htc_reset(struct htc_target *target)
                         packet->buf = packet->buf_start;
                         packet->endpoint = ENDPOINT_0;
                         list_add_tail(&packet->list, &target->free_ctrl_rxbuf);
-                } else
+                } else {
                         list_add_tail(&packet->list, &target->free_ctrl_txbuf);
+                }
         }
 
         return 0;
diff --git a/drivers/net/wireless/ath/ath6kl/htc_pipe.c b/drivers/net/wireless/ath/ath6kl/htc_pipe.c
index 67aa924ed8b3..756fe52a12c8 100644
--- a/drivers/net/wireless/ath/ath6kl/htc_pipe.c
+++ b/drivers/net/wireless/ath/ath6kl/htc_pipe.c
@@ -137,7 +137,6 @@ static void get_htc_packet_credit_based(struct htc_target *target,
                         credits_required = 0;
 
                 } else {
-
                         if (ep->cred_dist.credits < credits_required)
                                 break;
 
@@ -169,7 +168,6 @@ static void get_htc_packet_credit_based(struct htc_target *target,
                 /* queue this packet into the caller's queue */
                 list_add_tail(&packet->list, queue);
         }
-
 }
 
 static void get_htc_packet(struct htc_target *target,
@@ -279,7 +277,6 @@ static int htc_issue_packets(struct htc_target *target,
                         list_add(&packet->list, pkt_queue);
                         break;
                 }
-
         }
 
         if (status != 0) {
@@ -385,7 +382,6 @@ static enum htc_send_queue_result htc_try_send(struct htc_target *target,
                          */
                         list_for_each_entry_safe(packet, tmp_pkt,
                                                  txq, list) {
-
                                 ath6kl_dbg(ATH6KL_DBG_HTC,
                                            "%s: Indicat overflowed TX pkts: %p\n",
                                            __func__, packet);
@@ -403,7 +399,6 @@ static enum htc_send_queue_result htc_try_send(struct htc_target *target,
                                         list_move_tail(&packet->list,
                                                        &send_queue);
                                 }
-
                         }
 
                         if (list_empty(&send_queue)) {
@@ -454,7 +449,6 @@ static enum htc_send_queue_result htc_try_send(struct htc_target *target,
          * enough transmit resources.
          */
         while (true) {
-
                 if (get_queue_depth(&ep->txq) == 0)
                         break;
 
@@ -495,8 +489,8 @@ static enum htc_send_queue_result htc_try_send(struct htc_target *target,
                 }
 
                 spin_lock_bh(&target->tx_lock);
-
         }
+
         /* done with this endpoint, we can clear the count */
         ep->tx_proc_cnt = 0;
         spin_unlock_bh(&target->tx_lock);
@@ -1106,7 +1100,6 @@ free_skb:
         dev_kfree_skb(skb);
 
         return status;
-
 }
 
 static void htc_flush_rx_queue(struct htc_target *target,
@@ -1258,7 +1251,6 @@ static int ath6kl_htc_pipe_conn_service(struct htc_target *target,
                 tx_alloc = 0;
 
         } else {
-
                 tx_alloc = htc_get_credit_alloc(target, conn_req->svc_id);
                 if (tx_alloc == 0) {
                         status = -ENOMEM;
diff --git a/drivers/net/wireless/ath/ath6kl/init.c b/drivers/net/wireless/ath/ath6kl/init.c
index 4f316bdcbab5..d5ef211f261c 100644
--- a/drivers/net/wireless/ath/ath6kl/init.c
+++ b/drivers/net/wireless/ath/ath6kl/init.c
@@ -1192,7 +1192,6 @@ static int ath6kl_upload_board_file(struct ath6kl *ar)
 
         if (board_ext_address &&
             ar->fw_board_len == (board_data_size + board_ext_data_size)) {
-
                 /* write extended board data */
                 ath6kl_dbg(ATH6KL_DBG_BOOT,
                            "writing extended board data to 0x%x (%d B)\n",
diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c
index 5839fc23bdc7..d56554674da4 100644
--- a/drivers/net/wireless/ath/ath6kl/main.c
+++ b/drivers/net/wireless/ath/ath6kl/main.c
@@ -571,7 +571,6 @@ void ath6kl_scan_complete_evt(struct ath6kl_vif *vif, int status)
 
 static int ath6kl_commit_ch_switch(struct ath6kl_vif *vif, u16 channel)
 {
-
         struct ath6kl *ar = vif->ar;
 
         vif->profile.ch = cpu_to_le16(channel);
@@ -600,7 +599,6 @@ static int ath6kl_commit_ch_switch(struct ath6kl_vif *vif, u16 channel)
 
 static void ath6kl_check_ch_switch(struct ath6kl *ar, u16 channel)
 {
-
         struct ath6kl_vif *vif;
         int res = 0;
 
@@ -692,9 +690,9 @@ void ath6kl_tkip_micerr_event(struct ath6kl_vif *vif, u8 keyid, bool ismcast)
                 cfg80211_michael_mic_failure(vif->ndev, sta->mac,
                                              NL80211_KEYTYPE_PAIRWISE, keyid,
                                              tsc, GFP_KERNEL);
-        } else
+        } else {
                 ath6kl_cfg80211_tkip_micerr_event(vif, keyid, ismcast);
-
+        }
 }
 
 static void ath6kl_update_target_stats(struct ath6kl_vif *vif, u8 *ptr, u32 len)
@@ -1093,8 +1091,9 @@ static int ath6kl_open(struct net_device *dev)
         if (test_bit(CONNECTED, &vif->flags)) {
                 netif_carrier_on(dev);
                 netif_wake_queue(dev);
-        } else
+        } else {
                 netif_carrier_off(dev);
+        }
 
         return 0;
 }
@@ -1146,7 +1145,6 @@ static int ath6kl_set_features(struct net_device *dev,
                         dev->features = features | NETIF_F_RXCSUM;
                         return err;
                 }
-
         }
 
         return err;
diff --git a/drivers/net/wireless/ath/ath6kl/sdio.c b/drivers/net/wireless/ath/ath6kl/sdio.c
index 7126bdd4236c..339d89f14d32 100644
--- a/drivers/net/wireless/ath/ath6kl/sdio.c
+++ b/drivers/net/wireless/ath/ath6kl/sdio.c
@@ -348,7 +348,7 @@ static int ath6kl_sdio_alloc_prep_scat_req(struct ath6kl_sdio *ar_sdio,
         int i, scat_req_sz, scat_list_sz, size;
         u8 *virt_buf;
 
-        scat_list_sz = (n_scat_entry - 1) * sizeof(struct hif_scatter_item);
+        scat_list_sz = n_scat_entry * sizeof(struct hif_scatter_item);
         scat_req_sz = sizeof(*s_req) + scat_list_sz;
 
         if (!virt_scat)
@@ -425,8 +425,9 @@ static int ath6kl_sdio_read_write_sync(struct ath6kl *ar, u32 addr, u8 *buf,
                         memcpy(tbuf, buf, len);
 
                 bounced = true;
-        } else
+        } else {
                 tbuf = buf;
+        }
 
         ret = ath6kl_sdio_io(ar_sdio->func, request, addr, tbuf, len);
         if ((request & HIF_READ) && bounced)
@@ -441,9 +442,9 @@ static int ath6kl_sdio_read_write_sync(struct ath6kl *ar, u32 addr, u8 *buf,
 static void __ath6kl_sdio_write_async(struct ath6kl_sdio *ar_sdio,
                                       struct bus_request *req)
 {
-        if (req->scat_req)
+        if (req->scat_req) {
                 ath6kl_sdio_scat_rw(ar_sdio, req);
-        else {
+        } else {
                 void *context;
                 int status;
 
@@ -656,7 +657,6 @@ static void ath6kl_sdio_scatter_req_add(struct ath6kl *ar,
         list_add_tail(&s_req->list, &ar_sdio->scat_req);
 
         spin_unlock_bh(&ar_sdio->scat_lock);
-
 }
 
 /* scatter gather read write request */
@@ -674,9 +674,9 @@ static int ath6kl_sdio_async_rw_scatter(struct ath6kl *ar,
                    "hif-scatter: total len: %d scatter entries: %d\n",
                    scat_req->len, scat_req->scat_entries);
 
-        if (request & HIF_SYNCHRONOUS)
+        if (request & HIF_SYNCHRONOUS) {
                 status = ath6kl_sdio_scat_rw(ar_sdio, scat_req->busrequest);
-        else {
+        } else {
                 spin_lock_bh(&ar_sdio->wr_async_lock);
                 list_add_tail(&scat_req->busrequest->list, &ar_sdio->wr_asyncq);
                 spin_unlock_bh(&ar_sdio->wr_async_lock);
@@ -856,7 +856,6 @@ static int ath6kl_sdio_suspend(struct ath6kl *ar, struct cfg80211_wowlan *wow)
 
         if (ar->suspend_mode == WLAN_POWER_STATE_WOW ||
             (!ar->suspend_mode && wow)) {
-
                 ret = ath6kl_set_sdio_pm_caps(ar);
                 if (ret)
                         goto cut_pwr;
@@ -878,7 +877,6 @@ static int ath6kl_sdio_suspend(struct ath6kl *ar, struct cfg80211_wowlan *wow)
 
         if (ar->suspend_mode == WLAN_POWER_STATE_DEEP_SLEEP ||
             !ar->suspend_mode || try_deepsleep) {
-
                 flags = sdio_get_host_pm_caps(func);
                 if (!(flags & MMC_PM_KEEP_POWER))
                         goto cut_pwr;
@@ -1061,7 +1059,6 @@ static int ath6kl_sdio_bmi_credits(struct ath6kl *ar)
 
         timeout = jiffies + msecs_to_jiffies(BMI_COMMUNICATION_TIMEOUT);
         while (time_before(jiffies, timeout) && !ar->bmi.cmd_credits) {
-
                 /*
                  * Hit the credit counter with a 4-byte access, the first byte
                  * read will hit the counter and cause a decrement, while the
diff --git a/drivers/net/wireless/ath/ath6kl/target.h b/drivers/net/wireless/ath/ath6kl/target.h
index a580a629a0da..d5eeeae7711b 100644
--- a/drivers/net/wireless/ath/ath6kl/target.h
+++ b/drivers/net/wireless/ath/ath6kl/target.h
@@ -289,7 +289,7 @@ struct host_interest {
         u32 hi_hp_rx_traffic_ratio;                    /* 0xd8 */
 
         /* test applications flags */
-        u32 hi_test_apps_related    ;                  /* 0xdc */
+        u32 hi_test_apps_related;                      /* 0xdc */
         /* location of test script */
         u32 hi_ota_testscript;                         /* 0xe0 */
         /* location of CAL data */
diff --git a/drivers/net/wireless/ath/ath6kl/txrx.c b/drivers/net/wireless/ath/ath6kl/txrx.c
index ebb24045a8ae..40432fe7a5d2 100644
--- a/drivers/net/wireless/ath/ath6kl/txrx.c
+++ b/drivers/net/wireless/ath/ath6kl/txrx.c
@@ -125,8 +125,9 @@ static bool ath6kl_process_uapsdq(struct ath6kl_sta *conn,
                 *flags |= WMI_DATA_HDR_FLAGS_UAPSD;
                 spin_unlock_bh(&conn->psq_lock);
                 return false;
-        } else if (!conn->apsd_info)
+        } else if (!conn->apsd_info) {
                 return false;
+        }
 
         if (test_bit(WMM_ENABLED, &vif->flags)) {
                 ether_type = be16_to_cpu(datap->h_proto);
@@ -316,8 +317,9 @@ int ath6kl_control_tx(void *devt, struct sk_buff *skb,
                 cookie = NULL;
                 ath6kl_err("wmi ctrl ep full, dropping pkt : 0x%p, len:%d\n",
                            skb, skb->len);
-        } else
+        } else {
                 cookie = ath6kl_alloc_cookie(ar);
+        }
 
         if (cookie == NULL) {
                 spin_unlock_bh(&ar->lock);
@@ -359,7 +361,7 @@ int ath6kl_data_tx(struct sk_buff *skb, struct net_device *dev)
         struct ath6kl_vif *vif = netdev_priv(dev);
         u32 map_no = 0;
         u16 htc_tag = ATH6KL_DATA_PKT_TAG;
-        u8 ac = 99 ; /* initialize to unmapped ac */
+        u8 ac = 99; /* initialize to unmapped ac */
         bool chk_adhoc_ps_mapping = false;
         int ret;
         struct wmi_tx_meta_v2 meta_v2;
@@ -449,8 +451,9 @@ int ath6kl_data_tx(struct sk_buff *skb, struct net_device *dev)
                         if (ret)
                                 goto fail_tx;
                 }
-        } else
+        } else {
                 goto fail_tx;
+        }
 
         spin_lock_bh(&ar->lock);
 
@@ -702,7 +705,6 @@ void ath6kl_tx_complete(struct htc_target *target,
 
         /* reap completed packets */
         while (!list_empty(packet_queue)) {
-
                 packet = list_first_entry(packet_queue, struct htc_packet,
                                           list);
                 list_del(&packet->list);
@@ -1089,8 +1091,9 @@ static void aggr_deque_frms(struct aggr_info_conn *agg_conn, u8 tid,
                         else
                                 skb_queue_tail(&rxtid->q, node->skb);
                         node->skb = NULL;
-                } else
+                } else {
                         stats->num_hole++;
+                }
 
                 rxtid->seq_next = ATH6KL_NEXT_SEQ_NO(rxtid->seq_next);
                 idx = AGGR_WIN_IDX(rxtid->seq_next, rxtid->hold_q_sz);
@@ -1211,7 +1214,7 @@ static bool aggr_process_recv_frm(struct aggr_info_conn *agg_conn, u8 tid,
                 return is_queued;
 
         spin_lock_bh(&rxtid->lock);
-        for (idx = 0 ; idx < rxtid->hold_q_sz; idx++) {
+        for (idx = 0; idx < rxtid->hold_q_sz; idx++) {
                 if (rxtid->hold_q[idx].skb) {
                         /*
                          * There is a frame in the queue and no
@@ -1265,7 +1268,6 @@ static void ath6kl_uapsd_trigger_frame_rx(struct ath6kl_vif *vif,
         is_apsdq_empty_at_start = is_apsdq_empty;
 
         while ((!is_apsdq_empty) && (num_frames_to_deliver)) {
-
                 spin_lock_bh(&conn->psq_lock);
                 skb = skb_dequeue(&conn->apsdq);
                 is_apsdq_empty = skb_queue_empty(&conn->apsdq);
@@ -1606,16 +1608,18 @@ void ath6kl_rx(struct htc_target *target, struct htc_packet *packet)
                         if (!conn)
                                 return;
                         aggr_conn = conn->aggr_conn;
-                } else
+                } else {
                         aggr_conn = vif->aggr_cntxt->aggr_conn;
+                }
 
                 if (aggr_process_recv_frm(aggr_conn, tid, seq_no,
                                           is_amsdu, skb)) {
                         /* aggregation code will handle the skb */
                         return;
                 }
-        } else if (!is_broadcast_ether_addr(datap->h_dest))
+        } else if (!is_broadcast_ether_addr(datap->h_dest)) {
                 vif->net_stats.multicast++;
+        }
 
         ath6kl_deliver_frames_to_nw_stack(vif->ndev, skb);
 }
@@ -1710,8 +1714,9 @@ void aggr_recv_addba_req_evt(struct ath6kl_vif *vif, u8 tid_mux, u16 seq_no,
                 sta = ath6kl_find_sta_by_aid(vif->ar, aid);
                 if (sta)
                         aggr_conn = sta->aggr_conn;
-        } else
+        } else {
                 aggr_conn = vif->aggr_cntxt->aggr_conn;
+        }
 
         if (!aggr_conn)
                 return;
@@ -1766,7 +1771,6 @@ void aggr_conn_init(struct ath6kl_vif *vif, struct aggr_info *aggr_info,
                 skb_queue_head_init(&rxtid->q);
                 spin_lock_init(&rxtid->lock);
         }
-
 }
 
 struct aggr_info *aggr_init(struct ath6kl_vif *vif)
@@ -1806,8 +1810,9 @@ void aggr_recv_delba_req_evt(struct ath6kl_vif *vif, u8 tid_mux)
                 sta = ath6kl_find_sta_by_aid(vif->ar, aid);
                 if (sta)
                         aggr_conn = sta->aggr_conn;
-        } else
+        } else {
                 aggr_conn = vif->aggr_cntxt->aggr_conn;
+        }
 
         if (!aggr_conn)
                 return;
diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c
index 56c3fd5cef65..3afc5a463d06 100644
--- a/drivers/net/wireless/ath/ath6kl/usb.c
+++ b/drivers/net/wireless/ath/ath6kl/usb.c
@@ -236,7 +236,6 @@ static void ath6kl_usb_free_pipe_resources(struct ath6kl_usb_pipe *pipe)
                         break;
                 kfree(urb_context);
         }
-
 }
 
 static void ath6kl_usb_cleanup_pipe_resources(struct ath6kl_usb *ar_usb)
@@ -245,7 +244,6 @@ static void ath6kl_usb_cleanup_pipe_resources(struct ath6kl_usb *ar_usb)
 
         for (i = 0; i < ATH6KL_USB_PIPE_MAX; i++)
                 ath6kl_usb_free_pipe_resources(&ar_usb->pipes[i]);
-
 }
 
 static u8 ath6kl_usb_get_logical_pipe_num(struct ath6kl_usb *ar_usb,
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
index 8b4ce28e3ce8..4d7f9e4712e9 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.c
+++ b/drivers/net/wireless/ath/ath6kl/wmi.c
@@ -289,8 +289,9 @@ int ath6kl_wmi_implicit_create_pstream(struct wmi *wmi, u8 if_idx,
                            ath6kl_wmi_determine_user_priority(((u8 *) llc_hdr) +
                                         sizeof(struct ath6kl_llc_snap_hdr),
                                         layer2_priority);
-                } else
+                } else {
                         usr_pri = layer2_priority & 0x7;
+                }
 
                 /*
                  * Queue the EAPOL frames in the same WMM_AC_VO queue
@@ -359,8 +360,9 @@ int ath6kl_wmi_dot11_hdr_remove(struct wmi *wmi, struct sk_buff *skb)
                 hdr_size = roundup(sizeof(struct ieee80211_qos_hdr),
                                    sizeof(u32));
                 skb_pull(skb, hdr_size);
-        } else if (sub_type == cpu_to_le16(IEEE80211_STYPE_DATA))
+        } else if (sub_type == cpu_to_le16(IEEE80211_STYPE_DATA)) {
                 skb_pull(skb, sizeof(struct ieee80211_hdr_3addr));
+        }
 
         datap = skb->data;
         llc_hdr = (struct ath6kl_llc_snap_hdr *)(datap);
@@ -936,7 +938,6 @@ ath6kl_regd_find_country_by_rd(u16 regdmn)
 
 static void ath6kl_wmi_regdomain_event(struct wmi *wmi, u8 *datap, int len)
 {
-
         struct ath6kl_wmi_regdomain *ev;
         struct country_code_to_enum_rd *country = NULL;
         struct reg_dmn_pair_mapping *regpair = NULL;
@@ -946,10 +947,9 @@ static void ath6kl_wmi_regdomain_event(struct wmi *wmi, u8 *datap, int len)
         ev = (struct ath6kl_wmi_regdomain *) datap;
         reg_code = le32_to_cpu(ev->reg_code);
 
-        if ((reg_code >> ATH6KL_COUNTRY_RD_SHIFT) & COUNTRY_ERD_FLAG)
+        if ((reg_code >> ATH6KL_COUNTRY_RD_SHIFT) & COUNTRY_ERD_FLAG) {
                 country = ath6kl_regd_find_country((u16) reg_code);
-        else if (!(((u16) reg_code & WORLD_SKU_MASK) == WORLD_SKU_PREFIX)) {
-
+        } else if (!(((u16) reg_code & WORLD_SKU_MASK) == WORLD_SKU_PREFIX)) {
                 regpair = ath6kl_get_regpair((u16) reg_code);
                 country = ath6kl_regd_find_country_by_rd((u16) reg_code);
                 if (regpair)
@@ -1499,7 +1499,6 @@ static int ath6kl_wmi_cac_event_rx(struct wmi *wmi, u8 *datap, int len,
 
         if ((reply->cac_indication == CAC_INDICATION_ADMISSION_RESP) &&
             (reply->status_code != IEEE80211_TSPEC_STATUS_ADMISS_ACCEPTED)) {
-
                 ts = (struct ieee80211_tspec_ie *) &(reply->tspec_suggestion);
                 tsinfo = le16_to_cpu(ts->tsinfo);
                 tsid = (tsinfo >> IEEE80211_WMM_IE_TSPEC_TID_SHIFT) &
@@ -1530,7 +1529,6 @@ static int ath6kl_wmi_cac_event_rx(struct wmi *wmi, u8 *datap, int len,
          * for delete qos stream from AP
          */
         else if (reply->cac_indication == CAC_INDICATION_DELETE) {
-
                 ts = (struct ieee80211_tspec_ie *) &(reply->tspec_suggestion);
                 tsinfo = le16_to_cpu(ts->tsinfo);
                 ts_id = ((tsinfo >> IEEE80211_WMM_IE_TSPEC_TID_SHIFT) &
@@ -2322,7 +2320,7 @@ int ath6kl_wmi_addkey_cmd(struct wmi *wmi, u8 if_idx, u8 key_index,
         return ret;
 }
 
-int ath6kl_wmi_add_krk_cmd(struct wmi *wmi, u8 if_idx, u8 *krk)
+int ath6kl_wmi_add_krk_cmd(struct wmi *wmi, u8 if_idx, const u8 *krk)
 {
         struct sk_buff *skb;
         struct wmi_add_krk_cmd *cmd;
@@ -2479,7 +2477,6 @@ static int ath6kl_wmi_sync_point(struct wmi *wmi, u8 if_idx)
                 goto free_data_skb;
 
         for (index = 0; index < num_pri_streams; index++) {
-
                 if (WARN_ON(!data_sync_bufs[index].skb))
                         goto free_data_skb;
 
@@ -2704,7 +2701,6 @@ static void ath6kl_wmi_relinquish_implicit_pstream_credits(struct wmi *wmi)
 
         for (i = 0; i < WMM_NUM_AC; i++) {
                 if (stream_exist & (1 << i)) {
-
                         /*
                          * FIXME: Is this lock & unlock inside
                          * for loop correct? may need rework.
@@ -2870,8 +2866,9 @@ int ath6kl_wmi_set_host_sleep_mode_cmd(struct wmi *wmi, u8 if_idx,
         if (host_mode == ATH6KL_HOST_MODE_ASLEEP) {
                 ath6kl_wmi_relinquish_implicit_pstream_credits(wmi);
                 cmd->asleep = cpu_to_le32(1);
-        } else
+        } else {
                 cmd->awake = cpu_to_le32(1);
+        }
 
         ret = ath6kl_wmi_cmd_send(wmi, if_idx, skb,
                                   WMI_SET_HOST_SLEEP_MODE_CMDID,
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.h b/drivers/net/wireless/ath/ath6kl/wmi.h
index 5c702ae4d9f8..bb23fc00111d 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.h
+++ b/drivers/net/wireless/ath/ath6kl/wmi.h
@@ -898,7 +898,6 @@ struct wmi_start_scan_cmd {
  *  flags here
  */
 enum wmi_scan_ctrl_flags_bits {
-
         /* set if can scan in the connect cmd */
         CONNECT_SCAN_CTRL_FLAGS = 0x01,
 
@@ -2617,7 +2616,7 @@ int ath6kl_wmi_addkey_cmd(struct wmi *wmi, u8 if_idx, u8 key_index,
                           u8 *key_material,
                           u8 key_op_ctrl, u8 *mac_addr,
                           enum wmi_sync_flag sync_flag);
-int ath6kl_wmi_add_krk_cmd(struct wmi *wmi, u8 if_idx, u8 *krk);
+int ath6kl_wmi_add_krk_cmd(struct wmi *wmi, u8 if_idx, const u8 *krk);
 int ath6kl_wmi_deletekey_cmd(struct wmi *wmi, u8 if_idx, u8 key_index);
 int ath6kl_wmi_setpmkid_cmd(struct wmi *wmi, u8 if_idx, const u8 *bssid,
                             const u8 *pmkid, bool set);
diff --git a/drivers/net/wireless/ath/ath9k/Makefile b/drivers/net/wireless/ath/ath9k/Makefile
index 8e1c7b0fe76c..8fcd586d1c39 100644
--- a/drivers/net/wireless/ath/ath9k/Makefile
+++ b/drivers/net/wireless/ath/ath9k/Makefile
@@ -53,7 +53,8 @@ obj-$(CONFIG_ATH9K_HW) += ath9k_hw.o
 obj-$(CONFIG_ATH9K_COMMON) += ath9k_common.o
 ath9k_common-y:=        common.o \
                         common-init.o \
-                        common-beacon.o
+                        common-beacon.o \
+                        common-debug.o
 
 ath9k_htc-y +=  htc_hst.o \
                 hif_usb.o \
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
index 0a6163e9248c..c38399bc9aa9 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
@@ -410,7 +410,7 @@ static const u32 ar9300_2p2_baseband_core[][2] = {
         {0x00009e30, 0x06336f77},
         {0x00009e34, 0x6af6532f},
         {0x00009e38, 0x0cc80c00},
-        {0x00009e40, 0x0d261820},
+        {0x00009e40, 0x0d261800},
         {0x00009e4c, 0x00001004},
         {0x00009e50, 0x00ff03f1},
         {0x00009e54, 0x00000000},
diff --git a/drivers/net/wireless/ath/ath9k/ar9330_1p1_initvals.h b/drivers/net/wireless/ath/ath9k/ar9330_1p1_initvals.h
index f76139bbb74f..2c42ff05efa3 100644
--- a/drivers/net/wireless/ath/ath9k/ar9330_1p1_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9330_1p1_initvals.h
@@ -592,7 +592,7 @@ static const u32 ar9331_1p1_baseband_core[][2] = {
         {0x00009e30, 0x06336f77},
         {0x00009e34, 0x6af6532f},
         {0x00009e38, 0x0cc80c00},
-        {0x00009e40, 0x0d261820},
+        {0x00009e40, 0x0d261800},
         {0x00009e4c, 0x00001004},
         {0x00009e50, 0x00ff03f1},
         {0x00009fc0, 0x803e4788},
diff --git a/drivers/net/wireless/ath/ath9k/ar9330_1p2_initvals.h b/drivers/net/wireless/ath/ath9k/ar9330_1p2_initvals.h
index 0ac8be96097f..2154efcd3900 100644
--- a/drivers/net/wireless/ath/ath9k/ar9330_1p2_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9330_1p2_initvals.h
@@ -231,7 +231,7 @@ static const u32 ar9331_1p2_baseband_core[][2] = {
         {0x00009e30, 0x06336f77},
         {0x00009e34, 0x6af6532f},
         {0x00009e38, 0x0cc80c00},
-        {0x00009e40, 0x0d261820},
+        {0x00009e40, 0x0d261800},
         {0x00009e4c, 0x00001004},
         {0x00009e50, 0x00ff03f1},
         {0x00009fc0, 0x803e4788},
diff --git a/drivers/net/wireless/ath/ath9k/ar9340_initvals.h b/drivers/net/wireless/ath/ath9k/ar9340_initvals.h
index a01f0edb6518..b995ffe88b33 100644
--- a/drivers/net/wireless/ath/ath9k/ar9340_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9340_initvals.h
@@ -318,7 +318,7 @@ static const u32 ar9340_1p0_baseband_core[][2] = {
         {0x00009e30, 0x06336f77},
         {0x00009e34, 0x6af6532f},
         {0x00009e38, 0x0cc80c00},
-        {0x00009e40, 0x0d261820},
+        {0x00009e40, 0x0d261800},
         {0x00009e4c, 0x00001004},
         {0x00009e50, 0x00ff03f1},
         {0x00009e54, 0x00000000},
@@ -348,9 +348,9 @@ static const u32 ar9340_1p0_baseband_core[][2] = {
         {0x0000a370, 0x00000000},
         {0x0000a390, 0x00000001},
         {0x0000a394, 0x00000444},
-        {0x0000a398, 0x00000000},
-        {0x0000a39c, 0x210d0401},
-        {0x0000a3a0, 0xab9a7144},
+        {0x0000a398, 0x001f0e0f},
+        {0x0000a39c, 0x0075393f},
+        {0x0000a3a0, 0xb79f6427},
         {0x0000a3a4, 0x00000000},
         {0x0000a3a8, 0xaaaaaaaa},
         {0x0000a3ac, 0x3c466478},
diff --git a/drivers/net/wireless/ath/ath9k/ar953x_initvals.h b/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
index 3c9113d9b1bc..8e5c3b9786e3 100644
--- a/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
@@ -257,9 +257,9 @@ static const u32 qca953x_1p0_baseband_core[][2] = {
         {0x0000a370, 0x00000000},
         {0x0000a390, 0x00000001},
         {0x0000a394, 0x00000444},
-        {0x0000a398, 0x1f020503},
-        {0x0000a39c, 0x29180c03},
-        {0x0000a3a0, 0x9a8b6844},
+        {0x0000a398, 0x001f0e0f},
+        {0x0000a39c, 0x0075393f},
+        {0x0000a3a0, 0xb79f6427},
         {0x0000a3a4, 0x000000ff},
         {0x0000a3a8, 0x6a6a6a6a},
         {0x0000a3ac, 0x6a6a6a6a},
diff --git a/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
index e6aec2c0207f..a5ca65240af3 100644
--- a/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
@@ -90,7 +90,7 @@ static const u32 ar9580_1p0_baseband_core[][2] = {
         {0x00009e30, 0x06336f77},
         {0x00009e34, 0x6af6532f},
         {0x00009e38, 0x0cc80c00},
-        {0x00009e40, 0x0d261820},
+        {0x00009e40, 0x0d261800},
         {0x00009e4c, 0x00001004},
         {0x00009e50, 0x00ff03f1},
         {0x00009e54, 0x00000000},
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 3ba03dde4215..2ca8f7e06174 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -23,8 +23,8 @@
 #include <linux/leds.h>
 #include <linux/completion.h>
 
-#include "debug.h"
 #include "common.h"
+#include "debug.h"
 #include "mci.h"
 #include "dfs.h"
 #include "spectral.h"
@@ -114,6 +114,9 @@ int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd,
 #define ATH_TXFIFO_DEPTH           8
 #define ATH_TX_ERROR               0x01
 
+/* Stop tx traffic 1ms before the GO goes away */
+#define ATH_P2P_PS_STOP_TIME       1000
+
 #define IEEE80211_SEQ_SEQ_SHIFT    4
 #define IEEE80211_SEQ_MAX          4096
 #define IEEE80211_WEP_IVLEN        3
@@ -271,6 +274,7 @@ struct ath_node {
 #ifdef CONFIG_ATH9K_STATION_STATISTICS
         struct ath_rx_rate_stats rx_rate_stats;
 #endif
+        u8 key_idx[4];
 };
 
 struct ath_tx_control {
@@ -366,11 +370,15 @@ void ath9k_release_buffered_frames(struct ieee80211_hw *hw,
 /********/
 
 struct ath_vif {
+        struct ieee80211_vif *vif;
         struct ath_node mcast_node;
         int av_bslot;
         bool primary_sta_vif;
         __le64 tsf_adjust; /* TSF adjustment for staggered beacons */
         struct ath_buf *av_bcbuf;
+
+        /* P2P Client */
+        struct ieee80211_noa_data noa;
 };
 
 struct ath9k_vif_iter_data {
@@ -463,6 +471,8 @@ int ath_update_survey_stats(struct ath_softc *sc);
 void ath_update_survey_nf(struct ath_softc *sc, int channel);
 void ath9k_queue_reset(struct ath_softc *sc, enum ath_reset_type type);
 void ath_ps_full_sleep(unsigned long data);
+void ath9k_p2p_ps_timer(void *priv);
+void ath9k_update_p2p_ps(struct ath_softc *sc, struct ieee80211_vif *vif);
 
 /**********/
 /* BTCOEX */
@@ -713,6 +723,9 @@ struct ath_softc {
         struct completion paprd_complete;
         wait_queue_head_t tx_wait;
 
+        struct ath_gen_timer *p2p_ps_timer;
+        struct ath_vif *p2p_ps_vif;
+
         unsigned long driver_data;
 
         u8 gtt_cnt;
@@ -757,6 +770,7 @@ struct ath_softc {
         struct ath_ant_comb ant_comb;
         u8 ant_tx, ant_rx;
         struct dfs_pattern_detector *dfs_detector;
+        u64 dfs_prev_pulse_ts;
         u32 wow_enabled;
         /* relay(fs) channel for spectral scan */
         struct rchan *rfs_chan_spec_scan;
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index bd9e634879e6..e387f0b2954a 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -537,8 +537,6 @@ static void ath9k_cache_beacon_config(struct ath_softc *sc,
         cur_conf->dtim_period = bss_conf->dtim_period;
         cur_conf->dtim_count = 1;
         cur_conf->ibss_creator = bss_conf->ibss_creator;
-        cur_conf->bmiss_timeout =
-                ATH_DEFAULT_BMISS_LIMIT * cur_conf->beacon_interval;
 
         /*
          * It looks like mac80211 may end up using beacon interval of zero in
@@ -549,6 +547,9 @@ static void ath9k_cache_beacon_config(struct ath_softc *sc,
         if (cur_conf->beacon_interval == 0)
                 cur_conf->beacon_interval = 100;
 
+        cur_conf->bmiss_timeout =
+                ATH_DEFAULT_BMISS_LIMIT * cur_conf->beacon_interval;
+
         /*
          * We don't parse dtim period from mac80211 during the driver
          * initialization as it breaks association with hidden-ssid
diff --git a/drivers/net/wireless/ath/ath9k/common-debug.c b/drivers/net/wireless/ath/ath9k/common-debug.c
new file mode 100644
index 000000000000..3b289f933405
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/common-debug.c
@@ -0,0 +1,253 @@
+/*
+ * Copyright (c) 2008-2011 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "common.h"
+
+static ssize_t read_file_modal_eeprom(struct file *file, char __user *user_buf,
+                                      size_t count, loff_t *ppos)
+{
+        struct ath_hw *ah = file->private_data;
+        u32 len = 0, size = 6000;
+        char *buf;
+        size_t retval;
+
+        buf = kzalloc(size, GFP_KERNEL);
+        if (buf == NULL)
+                return -ENOMEM;
+
+        len = ah->eep_ops->dump_eeprom(ah, false, buf, len, size);
+
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+
+        return retval;
+}
+
+static const struct file_operations fops_modal_eeprom = {
+        .read = read_file_modal_eeprom,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+
+void ath9k_cmn_debug_modal_eeprom(struct dentry *debugfs_phy,
+                                  struct ath_hw *ah)
+{
+        debugfs_create_file("modal_eeprom", S_IRUSR, debugfs_phy, ah,
+                            &fops_modal_eeprom);
+}
+EXPORT_SYMBOL(ath9k_cmn_debug_modal_eeprom);
+
+static ssize_t read_file_base_eeprom(struct file *file, char __user *user_buf,
+                                     size_t count, loff_t *ppos)
+{
+        struct ath_hw *ah = file->private_data;
+        u32 len = 0, size = 1500;
+        ssize_t retval = 0;
+        char *buf;
+
+        buf = kzalloc(size, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        len = ah->eep_ops->dump_eeprom(ah, true, buf, len, size);
+
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+
+        return retval;
+}
+
+static const struct file_operations fops_base_eeprom = {
+        .read = read_file_base_eeprom,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+void ath9k_cmn_debug_base_eeprom(struct dentry *debugfs_phy,
+                                 struct ath_hw *ah)
+{
+        debugfs_create_file("base_eeprom", S_IRUSR, debugfs_phy, ah,
+                            &fops_base_eeprom);
+}
+EXPORT_SYMBOL(ath9k_cmn_debug_base_eeprom);
+
+void ath9k_cmn_debug_stat_rx(struct ath_rx_stats *rxstats,
+                             struct ath_rx_status *rs)
+{
+#define RX_PHY_ERR_INC(c) rxstats->phy_err_stats[c]++
+#define RX_CMN_STAT_INC(c) (rxstats->c++)
+
+        RX_CMN_STAT_INC(rx_pkts_all);
+        rxstats->rx_bytes_all += rs->rs_datalen;
+
+        if (rs->rs_status & ATH9K_RXERR_CRC)
+                RX_CMN_STAT_INC(crc_err);
+        if (rs->rs_status & ATH9K_RXERR_DECRYPT)
+                RX_CMN_STAT_INC(decrypt_crc_err);
+        if (rs->rs_status & ATH9K_RXERR_MIC)
+                RX_CMN_STAT_INC(mic_err);
+        if (rs->rs_status & ATH9K_RX_DELIM_CRC_PRE)
+                RX_CMN_STAT_INC(pre_delim_crc_err);
+        if (rs->rs_status & ATH9K_RX_DELIM_CRC_POST)
+                RX_CMN_STAT_INC(post_delim_crc_err);
+        if (rs->rs_status & ATH9K_RX_DECRYPT_BUSY)
+                RX_CMN_STAT_INC(decrypt_busy_err);
+
+        if (rs->rs_status & ATH9K_RXERR_PHY) {
+                RX_CMN_STAT_INC(phy_err);
+                if (rs->rs_phyerr < ATH9K_PHYERR_MAX)
+                        RX_PHY_ERR_INC(rs->rs_phyerr);
+        }
+
+#undef RX_CMN_STAT_INC
+#undef RX_PHY_ERR_INC
+}
+EXPORT_SYMBOL(ath9k_cmn_debug_stat_rx);
+
+static ssize_t read_file_recv(struct file *file, char __user *user_buf,
+                              size_t count, loff_t *ppos)
+{
+#define RXS_ERR(s, e)                                   \
+        do {                                            \
+                len += scnprintf(buf + len, size - len, \
+                                 "%18s : %10u\n", s,    \
+                                 rxstats->e);           \
+        } while (0)
+
+        struct ath_rx_stats *rxstats = file->private_data;
+        char *buf;
+        unsigned int len = 0, size = 1600;
+        ssize_t retval = 0;
+
+        buf = kzalloc(size, GFP_KERNEL);
+        if (buf == NULL)
+                return -ENOMEM;
+
+        RXS_ERR("PKTS-ALL", rx_pkts_all);
+        RXS_ERR("BYTES-ALL", rx_bytes_all);
+        RXS_ERR("BEACONS", rx_beacons);
+        RXS_ERR("FRAGS", rx_frags);
+        RXS_ERR("SPECTRAL", rx_spectral);
+
+        RXS_ERR("CRC ERR", crc_err);
+        RXS_ERR("DECRYPT CRC ERR", decrypt_crc_err);
+        RXS_ERR("PHY ERR", phy_err);
+        RXS_ERR("MIC ERR", mic_err);
+        RXS_ERR("PRE-DELIM CRC ERR", pre_delim_crc_err);
+        RXS_ERR("POST-DELIM CRC ERR", post_delim_crc_err);
+        RXS_ERR("DECRYPT BUSY ERR", decrypt_busy_err);
+        RXS_ERR("LENGTH-ERR", rx_len_err);
+        RXS_ERR("OOM-ERR", rx_oom_err);
+        RXS_ERR("RATE-ERR", rx_rate_err);
+        RXS_ERR("TOO-MANY-FRAGS", rx_too_many_frags_err);
+
+        if (len > size)
+                len = size;
+
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+
+        return retval;
+
+#undef RXS_ERR
+}
+
+static const struct file_operations fops_recv = {
+        .read = read_file_recv,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+void ath9k_cmn_debug_recv(struct dentry *debugfs_phy,
+                          struct ath_rx_stats *rxstats)
+{
+        debugfs_create_file("recv", S_IRUSR, debugfs_phy, rxstats,
+                            &fops_recv);
+}
+EXPORT_SYMBOL(ath9k_cmn_debug_recv);
+
+static ssize_t read_file_phy_err(struct file *file, char __user *user_buf,
+                                 size_t count, loff_t *ppos)
+{
+#define PHY_ERR(s, p) \
+        len += scnprintf(buf + len, size - len, "%22s : %10u\n", s, \
+                         rxstats->phy_err_stats[p]);
+
+        struct ath_rx_stats *rxstats = file->private_data;
+        char *buf;
+        unsigned int len = 0, size = 1600;
+        ssize_t retval = 0;
+
+        buf = kzalloc(size, GFP_KERNEL);
+        if (buf == NULL)
+                return -ENOMEM;
+
+        PHY_ERR("UNDERRUN ERR", ATH9K_PHYERR_UNDERRUN);
+        PHY_ERR("TIMING ERR", ATH9K_PHYERR_TIMING);
+        PHY_ERR("PARITY ERR", ATH9K_PHYERR_PARITY);
+        PHY_ERR("RATE ERR", ATH9K_PHYERR_RATE);
+        PHY_ERR("LENGTH ERR", ATH9K_PHYERR_LENGTH);
+        PHY_ERR("RADAR ERR", ATH9K_PHYERR_RADAR);
+        PHY_ERR("SERVICE ERR", ATH9K_PHYERR_SERVICE);
+        PHY_ERR("TOR ERR", ATH9K_PHYERR_TOR);
+        PHY_ERR("OFDM-TIMING ERR", ATH9K_PHYERR_OFDM_TIMING);
+        PHY_ERR("OFDM-SIGNAL-PARITY ERR", ATH9K_PHYERR_OFDM_SIGNAL_PARITY);
+        PHY_ERR("OFDM-RATE ERR", ATH9K_PHYERR_OFDM_RATE_ILLEGAL);
+        PHY_ERR("OFDM-LENGTH ERR", ATH9K_PHYERR_OFDM_LENGTH_ILLEGAL);
+        PHY_ERR("OFDM-POWER-DROP ERR", ATH9K_PHYERR_OFDM_POWER_DROP);
+        PHY_ERR("OFDM-SERVICE ERR", ATH9K_PHYERR_OFDM_SERVICE);
+        PHY_ERR("OFDM-RESTART ERR", ATH9K_PHYERR_OFDM_RESTART);
+        PHY_ERR("FALSE-RADAR-EXT ERR", ATH9K_PHYERR_FALSE_RADAR_EXT);
+        PHY_ERR("CCK-TIMING ERR", ATH9K_PHYERR_CCK_TIMING);
+        PHY_ERR("CCK-HEADER-CRC ERR", ATH9K_PHYERR_CCK_HEADER_CRC);
+        PHY_ERR("CCK-RATE ERR", ATH9K_PHYERR_CCK_RATE_ILLEGAL);
+        PHY_ERR("CCK-SERVICE ERR", ATH9K_PHYERR_CCK_SERVICE);
+        PHY_ERR("CCK-RESTART ERR", ATH9K_PHYERR_CCK_RESTART);
+        PHY_ERR("CCK-LENGTH ERR", ATH9K_PHYERR_CCK_LENGTH_ILLEGAL);
+        PHY_ERR("CCK-POWER-DROP ERR", ATH9K_PHYERR_CCK_POWER_DROP);
+        PHY_ERR("HT-CRC ERR", ATH9K_PHYERR_HT_CRC_ERROR);
+        PHY_ERR("HT-LENGTH ERR", ATH9K_PHYERR_HT_LENGTH_ILLEGAL);
+        PHY_ERR("HT-RATE ERR", ATH9K_PHYERR_HT_RATE_ILLEGAL);
+
+        if (len > size)
+                len = size;
+
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+
+        return retval;
+
+#undef PHY_ERR
+}
+
+static const struct file_operations fops_phy_err = {
+        .read = read_file_phy_err,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+void ath9k_cmn_debug_phy_err(struct dentry *debugfs_phy,
+                             struct ath_rx_stats *rxstats)
+{
+        debugfs_create_file("phy_err", S_IRUSR, debugfs_phy, rxstats,
+                            &fops_phy_err);
+}
+EXPORT_SYMBOL(ath9k_cmn_debug_phy_err);
diff --git a/drivers/net/wireless/ath/ath9k/common-debug.h b/drivers/net/wireless/ath/ath9k/common-debug.h
new file mode 100644
index 000000000000..7c9788490f7f
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/common-debug.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (c) 2008-2011 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+
+
+/**
+ * struct ath_rx_stats - RX Statistics
+ * @rx_pkts_all:  No. of total frames received, including ones that
+        may have had errors.
+ * @rx_bytes_all:  No. of total bytes received, including ones that
+        may have had errors.
+ * @crc_err: No. of frames with incorrect CRC value
+ * @decrypt_crc_err: No. of frames whose CRC check failed after
+        decryption process completed
+ * @phy_err: No. of frames whose reception failed because the PHY
+        encountered an error
+ * @mic_err: No. of frames with incorrect TKIP MIC verification failure
+ * @pre_delim_crc_err: Pre-Frame delimiter CRC error detections
+ * @post_delim_crc_err: Post-Frame delimiter CRC error detections
+ * @decrypt_busy_err: Decryption interruptions counter
+ * @phy_err_stats: Individual PHY error statistics
+ * @rx_len_err:  No. of frames discarded due to bad length.
+ * @rx_oom_err:  No. of frames dropped due to OOM issues.
+ * @rx_rate_err:  No. of frames dropped due to rate errors.
+ * @rx_too_many_frags_err:  Frames dropped due to too-many-frags received.
+ * @rx_beacons:  No. of beacons received.
+ * @rx_frags:  No. of rx-fragements received.
+ * @rx_spectral: No of spectral packets received.
+ */
+struct ath_rx_stats {
+        u32 rx_pkts_all;
+        u32 rx_bytes_all;
+        u32 crc_err;
+        u32 decrypt_crc_err;
+        u32 phy_err;
+        u32 mic_err;
+        u32 pre_delim_crc_err;
+        u32 post_delim_crc_err;
+        u32 decrypt_busy_err;
+        u32 phy_err_stats[ATH9K_PHYERR_MAX];
+        u32 rx_len_err;
+        u32 rx_oom_err;
+        u32 rx_rate_err;
+        u32 rx_too_many_frags_err;
+        u32 rx_beacons;
+        u32 rx_frags;
+        u32 rx_spectral;
+};
+
+void ath9k_cmn_debug_modal_eeprom(struct dentry *debugfs_phy,
+                                  struct ath_hw *ah);
+void ath9k_cmn_debug_base_eeprom(struct dentry *debugfs_phy,
+                                 struct ath_hw *ah);
+void ath9k_cmn_debug_stat_rx(struct ath_rx_stats *rxstats,
+                             struct ath_rx_status *rs);
+void ath9k_cmn_debug_recv(struct dentry *debugfs_phy,
+                          struct ath_rx_stats *rxstats);
+void ath9k_cmn_debug_phy_err(struct dentry *debugfs_phy,
+                             struct ath_rx_stats *rxstats);
diff --git a/drivers/net/wireless/ath/ath9k/common.h b/drivers/net/wireless/ath/ath9k/common.h
index ca38116838f0..ffc454b18637 100644
--- a/drivers/net/wireless/ath/ath9k/common.h
+++ b/drivers/net/wireless/ath/ath9k/common.h
@@ -23,6 +23,7 @@
 
 #include "common-init.h"
 #include "common-beacon.h"
+#include "common-debug.h"
 
 /* Common header for Atheros 802.11n base driver cores */
 
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 780ff1bee6f6..6cc42be48d4e 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -948,151 +948,11 @@ static const struct file_operations fops_reset = {
         .llseek = default_llseek,
 };
 
-static ssize_t read_file_recv(struct file *file, char __user *user_buf,
-                              size_t count, loff_t *ppos)
-{
-#define RXS_ERR(s, e)                                       \
-        do {                                                \
-                len += scnprintf(buf + len, size - len,     \
-                                 "%18s : %10u\n", s,        \
-                                 sc->debug.stats.rxstats.e);\
-        } while (0)
-
-        struct ath_softc *sc = file->private_data;
-        char *buf;
-        unsigned int len = 0, size = 1600;
-        ssize_t retval = 0;
-
-        buf = kzalloc(size, GFP_KERNEL);
-        if (buf == NULL)
-                return -ENOMEM;
-
-        RXS_ERR("PKTS-ALL", rx_pkts_all);
-        RXS_ERR("BYTES-ALL", rx_bytes_all);
-        RXS_ERR("BEACONS", rx_beacons);
-        RXS_ERR("FRAGS", rx_frags);
-        RXS_ERR("SPECTRAL", rx_spectral);
-
-        RXS_ERR("CRC ERR", crc_err);
-        RXS_ERR("DECRYPT CRC ERR", decrypt_crc_err);
-        RXS_ERR("PHY ERR", phy_err);
-        RXS_ERR("MIC ERR", mic_err);
-        RXS_ERR("PRE-DELIM CRC ERR", pre_delim_crc_err);
-        RXS_ERR("POST-DELIM CRC ERR", post_delim_crc_err);
-        RXS_ERR("DECRYPT BUSY ERR", decrypt_busy_err);
-        RXS_ERR("LENGTH-ERR", rx_len_err);
-        RXS_ERR("OOM-ERR", rx_oom_err);
-        RXS_ERR("RATE-ERR", rx_rate_err);
-        RXS_ERR("TOO-MANY-FRAGS", rx_too_many_frags_err);
-
-        if (len > size)
-                len = size;
-
-        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-        kfree(buf);
-
-        return retval;
-
-#undef RXS_ERR
-}
-
 void ath_debug_stat_rx(struct ath_softc *sc, struct ath_rx_status *rs)
 {
-#define RX_PHY_ERR_INC(c) sc->debug.stats.rxstats.phy_err_stats[c]++
-
-        RX_STAT_INC(rx_pkts_all);
-        sc->debug.stats.rxstats.rx_bytes_all += rs->rs_datalen;
-
-        if (rs->rs_status & ATH9K_RXERR_CRC)
-                RX_STAT_INC(crc_err);
-        if (rs->rs_status & ATH9K_RXERR_DECRYPT)
-                RX_STAT_INC(decrypt_crc_err);
-        if (rs->rs_status & ATH9K_RXERR_MIC)
-                RX_STAT_INC(mic_err);
-        if (rs->rs_status & ATH9K_RX_DELIM_CRC_PRE)
-                RX_STAT_INC(pre_delim_crc_err);
-        if (rs->rs_status & ATH9K_RX_DELIM_CRC_POST)
-                RX_STAT_INC(post_delim_crc_err);
-        if (rs->rs_status & ATH9K_RX_DECRYPT_BUSY)
-                RX_STAT_INC(decrypt_busy_err);
-
-        if (rs->rs_status & ATH9K_RXERR_PHY) {
-                RX_STAT_INC(phy_err);
-                if (rs->rs_phyerr < ATH9K_PHYERR_MAX)
-                        RX_PHY_ERR_INC(rs->rs_phyerr);
-        }
-
-#undef RX_PHY_ERR_INC
+        ath9k_cmn_debug_stat_rx(&sc->debug.stats.rxstats, rs);
 }
 
-static const struct file_operations fops_recv = {
-        .read = read_file_recv,
-        .open = simple_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
-static ssize_t read_file_phy_err(struct file *file, char __user *user_buf,
-                                 size_t count, loff_t *ppos)
-{
-#define PHY_ERR(s, p) \
-        len += scnprintf(buf + len, size - len, "%22s : %10u\n", s, \
-                         sc->debug.stats.rxstats.phy_err_stats[p]);
-
-        struct ath_softc *sc = file->private_data;
-        char *buf;
-        unsigned int len = 0, size = 1600;
-        ssize_t retval = 0;
-
-        buf = kzalloc(size, GFP_KERNEL);
-        if (buf == NULL)
-                return -ENOMEM;
-
-        PHY_ERR("UNDERRUN ERR", ATH9K_PHYERR_UNDERRUN);
-        PHY_ERR("TIMING ERR", ATH9K_PHYERR_TIMING);
-        PHY_ERR("PARITY ERR", ATH9K_PHYERR_PARITY);
-        PHY_ERR("RATE ERR", ATH9K_PHYERR_RATE);
-        PHY_ERR("LENGTH ERR", ATH9K_PHYERR_LENGTH);
-        PHY_ERR("RADAR ERR", ATH9K_PHYERR_RADAR);
-        PHY_ERR("SERVICE ERR", ATH9K_PHYERR_SERVICE);
-        PHY_ERR("TOR ERR", ATH9K_PHYERR_TOR);
-        PHY_ERR("OFDM-TIMING ERR", ATH9K_PHYERR_OFDM_TIMING);
-        PHY_ERR("OFDM-SIGNAL-PARITY ERR", ATH9K_PHYERR_OFDM_SIGNAL_PARITY);
-        PHY_ERR("OFDM-RATE ERR", ATH9K_PHYERR_OFDM_RATE_ILLEGAL);
-        PHY_ERR("OFDM-LENGTH ERR", ATH9K_PHYERR_OFDM_LENGTH_ILLEGAL);
-        PHY_ERR("OFDM-POWER-DROP ERR", ATH9K_PHYERR_OFDM_POWER_DROP);
-        PHY_ERR("OFDM-SERVICE ERR", ATH9K_PHYERR_OFDM_SERVICE);
-        PHY_ERR("OFDM-RESTART ERR", ATH9K_PHYERR_OFDM_RESTART);
-        PHY_ERR("FALSE-RADAR-EXT ERR", ATH9K_PHYERR_FALSE_RADAR_EXT);
-        PHY_ERR("CCK-TIMING ERR", ATH9K_PHYERR_CCK_TIMING);
-        PHY_ERR("CCK-HEADER-CRC ERR", ATH9K_PHYERR_CCK_HEADER_CRC);
-        PHY_ERR("CCK-RATE ERR", ATH9K_PHYERR_CCK_RATE_ILLEGAL);
-        PHY_ERR("CCK-SERVICE ERR", ATH9K_PHYERR_CCK_SERVICE);
-        PHY_ERR("CCK-RESTART ERR", ATH9K_PHYERR_CCK_RESTART);
-        PHY_ERR("CCK-LENGTH ERR", ATH9K_PHYERR_CCK_LENGTH_ILLEGAL);
-        PHY_ERR("CCK-POWER-DROP ERR", ATH9K_PHYERR_CCK_POWER_DROP);
-        PHY_ERR("HT-CRC ERR", ATH9K_PHYERR_HT_CRC_ERROR);
-        PHY_ERR("HT-LENGTH ERR", ATH9K_PHYERR_HT_LENGTH_ILLEGAL);
-        PHY_ERR("HT-RATE ERR", ATH9K_PHYERR_HT_RATE_ILLEGAL);
-
-        if (len > size)
-                len = size;
-
-        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-        kfree(buf);
-
-        return retval;
-
-#undef PHY_ERR
-}
-
-static const struct file_operations fops_phy_err = {
-        .read = read_file_phy_err,
-        .open = simple_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
 static ssize_t read_file_regidx(struct file *file, char __user *user_buf,
                                 size_t count, loff_t *ppos)
 {
@@ -1268,62 +1128,6 @@ static const struct file_operations fops_dump_nfcal = {
         .llseek = default_llseek,
 };
 
-static ssize_t read_file_base_eeprom(struct file *file, char __user *user_buf,
-                                     size_t count, loff_t *ppos)
-{
-        struct ath_softc *sc = file->private_data;
-        struct ath_hw *ah = sc->sc_ah;
-        u32 len = 0, size = 1500;
-        ssize_t retval = 0;
-        char *buf;
-
-        buf = kzalloc(size, GFP_KERNEL);
-        if (!buf)
-                return -ENOMEM;
-
-        len = ah->eep_ops->dump_eeprom(ah, true, buf, len, size);
-
-        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-        kfree(buf);
-
-        return retval;
-}
-
-static const struct file_operations fops_base_eeprom = {
-        .read = read_file_base_eeprom,
-        .open = simple_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
-static ssize_t read_file_modal_eeprom(struct file *file, char __user *user_buf,
-                                      size_t count, loff_t *ppos)
-{
-        struct ath_softc *sc = file->private_data;
-        struct ath_hw *ah = sc->sc_ah;
-        u32 len = 0, size = 6000;
-        char *buf;
-        size_t retval;
-
-        buf = kzalloc(size, GFP_KERNEL);
-        if (buf == NULL)
-                return -ENOMEM;
-
-        len = ah->eep_ops->dump_eeprom(ah, false, buf, len, size);
-
-        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-        kfree(buf);
-
-        return retval;
-}
-
-static const struct file_operations fops_modal_eeprom = {
-        .read = read_file_modal_eeprom,
-        .open = simple_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
 #ifdef CONFIG_ATH9K_BTCOEX_SUPPORT
 static ssize_t read_file_btcoex(struct file *file, char __user *user_buf,
                                 size_t count, loff_t *ppos)
@@ -1524,10 +1328,10 @@ int ath9k_init_debug(struct ath_hw *ah)
                             &fops_misc);
         debugfs_create_file("reset", S_IRUSR, sc->debug.debugfs_phy, sc,
                             &fops_reset);
-        debugfs_create_file("recv", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_recv);
-        debugfs_create_file("phy_err", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_phy_err);
+
+        ath9k_cmn_debug_recv(sc->debug.debugfs_phy, &sc->debug.stats.rxstats);
+        ath9k_cmn_debug_phy_err(sc->debug.debugfs_phy, &sc->debug.stats.rxstats);
+
         debugfs_create_u8("rx_chainmask", S_IRUSR, sc->debug.debugfs_phy,
                           &ah->rxchainmask);
         debugfs_create_u8("tx_chainmask", S_IRUSR, sc->debug.debugfs_phy,
@@ -1547,10 +1351,10 @@ int ath9k_init_debug(struct ath_hw *ah)
                             &fops_regdump);
         debugfs_create_file("dump_nfcal", S_IRUSR, sc->debug.debugfs_phy, sc,
                             &fops_dump_nfcal);
-        debugfs_create_file("base_eeprom", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_base_eeprom);
-        debugfs_create_file("modal_eeprom", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_modal_eeprom);
+
+        ath9k_cmn_debug_base_eeprom(sc->debug.debugfs_phy, sc->sc_ah);
+        ath9k_cmn_debug_modal_eeprom(sc->debug.debugfs_phy, sc->sc_ah);
+
         debugfs_create_u32("gpio_mask", S_IRUSR | S_IWUSR,
                            sc->debug.debugfs_phy, &sc->sc_ah->gpio_mask);
         debugfs_create_u32("gpio_val", S_IRUSR | S_IWUSR,
diff --git a/drivers/net/wireless/ath/ath9k/debug.h b/drivers/net/wireless/ath/ath9k/debug.h
index 559a68c2709c..53ae15bd0c9d 100644
--- a/drivers/net/wireless/ath/ath9k/debug.h
+++ b/drivers/net/wireless/ath/ath9k/debug.h
@@ -221,50 +221,6 @@ struct ath_rx_rate_stats {
         } cck_stats[4];
 };
 
-/**
- * struct ath_rx_stats - RX Statistics
- * @rx_pkts_all:  No. of total frames received, including ones that
-        may have had errors.
- * @rx_bytes_all:  No. of total bytes received, including ones that
-        may have had errors.
- * @crc_err: No. of frames with incorrect CRC value
- * @decrypt_crc_err: No. of frames whose CRC check failed after
-        decryption process completed
- * @phy_err: No. of frames whose reception failed because the PHY
-        encountered an error
- * @mic_err: No. of frames with incorrect TKIP MIC verification failure
- * @pre_delim_crc_err: Pre-Frame delimiter CRC error detections
- * @post_delim_crc_err: Post-Frame delimiter CRC error detections
- * @decrypt_busy_err: Decryption interruptions counter
- * @phy_err_stats: Individual PHY error statistics
- * @rx_len_err:  No. of frames discarded due to bad length.
- * @rx_oom_err:  No. of frames dropped due to OOM issues.
- * @rx_rate_err:  No. of frames dropped due to rate errors.
- * @rx_too_many_frags_err:  Frames dropped due to too-many-frags received.
- * @rx_beacons:  No. of beacons received.
- * @rx_frags:  No. of rx-fragements received.
- * @rx_spectral: No of spectral packets received.
- */
-struct ath_rx_stats {
-        u32 rx_pkts_all;
-        u32 rx_bytes_all;
-        u32 crc_err;
-        u32 decrypt_crc_err;
-        u32 phy_err;
-        u32 mic_err;
-        u32 pre_delim_crc_err;
-        u32 post_delim_crc_err;
-        u32 decrypt_busy_err;
-        u32 phy_err_stats[ATH9K_PHYERR_MAX];
-        u32 rx_len_err;
-        u32 rx_oom_err;
-        u32 rx_rate_err;
-        u32 rx_too_many_frags_err;
-        u32 rx_beacons;
-        u32 rx_frags;
-        u32 rx_spectral;
-};
-
 #define ANT_MAIN 0
 #define ANT_ALT  1
 
diff --git a/drivers/net/wireless/ath/ath9k/dfs.c b/drivers/net/wireless/ath/ath9k/dfs.c
index 857bb28b3894..726271c7c330 100644
--- a/drivers/net/wireless/ath/ath9k/dfs.c
+++ b/drivers/net/wireless/ath/ath9k/dfs.c
@@ -178,12 +178,12 @@ void ath9k_dfs_process_phyerr(struct ath_softc *sc, void *data,
         pe.ts = mactime;
         if (ath9k_postprocess_radar_event(sc, &ard, &pe)) {
                 struct dfs_pattern_detector *pd = sc->dfs_detector;
-                static u64 last_ts;
                 ath_dbg(common, DFS,
                         "ath9k_dfs_process_phyerr: channel=%d, ts=%llu, "
                         "width=%d, rssi=%d, delta_ts=%llu\n",
-                        pe.freq, pe.ts, pe.width, pe.rssi, pe.ts-last_ts);
-                last_ts = pe.ts;
+                        pe.freq, pe.ts, pe.width, pe.rssi,
+                        pe.ts - sc->dfs_prev_pulse_ts);
+                sc->dfs_prev_pulse_ts = pe.ts;
                 DFS_STAT_INC(sc, pulses_processed);
                 if (pd != NULL && pd->add_pulse(pd, &pe)) {
                         DFS_STAT_INC(sc, radar_detected);
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index dab1f0cab993..09a5d72f3ff5 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -325,14 +325,14 @@ static inline struct ath9k_htc_tx_ctl *HTC_SKB_CB(struct sk_buff *skb)
 
 #define TX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.tx_stats.c++)
 #define TX_STAT_ADD(c, a) (hif_dev->htc_handle->drv_priv->debug.tx_stats.c += a)
-#define RX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.rx_stats.c++)
-#define RX_STAT_ADD(c, a) (hif_dev->htc_handle->drv_priv->debug.rx_stats.c += a)
+#define RX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c++)
+#define RX_STAT_ADD(c, a) (hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c += a)
 #define CAB_STAT_INC   priv->debug.tx_stats.cab_queued++
 
 #define TX_QSTAT_INC(q) (priv->debug.tx_stats.queue_stats[q]++)
 
 void ath9k_htc_err_stat_rx(struct ath9k_htc_priv *priv,
-                           struct ath_htc_rx_status *rxs);
+                           struct ath_rx_status *rs);
 
 struct ath_tx_stats {
         u32 buf_queued;
@@ -345,25 +345,18 @@ struct ath_tx_stats {
         u32 queue_stats[IEEE80211_NUM_ACS];
 };
 
-struct ath_rx_stats {
+struct ath_skbrx_stats {
         u32 skb_allocated;
         u32 skb_completed;
         u32 skb_completed_bytes;
         u32 skb_dropped;
-        u32 err_crc;
-        u32 err_decrypt_crc;
-        u32 err_mic;
-        u32 err_pre_delim;
-        u32 err_post_delim;
-        u32 err_decrypt_busy;
-        u32 err_phy;
-        u32 err_phy_stats[ATH9K_PHYERR_MAX];
 };
 
 struct ath9k_debug {
         struct dentry *debugfs_phy;
         struct ath_tx_stats tx_stats;
         struct ath_rx_stats rx_stats;
+        struct ath_skbrx_stats skbrx_stats;
 };
 
 void ath9k_htc_get_et_strings(struct ieee80211_hw *hw,
@@ -385,7 +378,7 @@ void ath9k_htc_get_et_stats(struct ieee80211_hw *hw,
 #define TX_QSTAT_INC(c) do { } while (0)
 
 static inline void ath9k_htc_err_stat_rx(struct ath9k_htc_priv *priv,
-                                         struct ath_htc_rx_status *rxs)
+                                         struct ath_rx_status *rs)
 {
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
index fb071ee4fcfb..8b529e4b8ac4 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
@@ -243,39 +243,14 @@ static const struct file_operations fops_xmit = {
 };
 
 void ath9k_htc_err_stat_rx(struct ath9k_htc_priv *priv,
-                           struct ath_htc_rx_status *rxs)
+                             struct ath_rx_status *rs)
 {
-#define RX_PHY_ERR_INC(c) priv->debug.rx_stats.err_phy_stats[c]++
-
-        if (rxs->rs_status & ATH9K_RXERR_CRC)
-                priv->debug.rx_stats.err_crc++;
-        if (rxs->rs_status & ATH9K_RXERR_DECRYPT)
-                priv->debug.rx_stats.err_decrypt_crc++;
-        if (rxs->rs_status & ATH9K_RXERR_MIC)
-                priv->debug.rx_stats.err_mic++;
-        if (rxs->rs_status & ATH9K_RX_DELIM_CRC_PRE)
-                priv->debug.rx_stats.err_pre_delim++;
-        if (rxs->rs_status & ATH9K_RX_DELIM_CRC_POST)
-                priv->debug.rx_stats.err_post_delim++;
-        if (rxs->rs_status & ATH9K_RX_DECRYPT_BUSY)
-                priv->debug.rx_stats.err_decrypt_busy++;
-
-        if (rxs->rs_status & ATH9K_RXERR_PHY) {
-                priv->debug.rx_stats.err_phy++;
-                if (rxs->rs_phyerr < ATH9K_PHYERR_MAX)
-                        RX_PHY_ERR_INC(rxs->rs_phyerr);
-        }
-
-#undef RX_PHY_ERR_INC
+        ath9k_cmn_debug_stat_rx(&priv->debug.rx_stats, rs);
 }
 
-static ssize_t read_file_recv(struct file *file, char __user *user_buf,
+static ssize_t read_file_skb_rx(struct file *file, char __user *user_buf,
                               size_t count, loff_t *ppos)
 {
-#define PHY_ERR(s, p)                                                   \
-        len += scnprintf(buf + len, size - len, "%20s : %10u\n", s,     \
-                         priv->debug.rx_stats.err_phy_stats[p]);
-
         struct ath9k_htc_priv *priv = file->private_data;
         char *buf;
         unsigned int len = 0, size = 1500;
@@ -287,63 +262,13 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
 
         len += scnprintf(buf + len, size - len,
                          "%20s : %10u\n", "SKBs allocated",
-                         priv->debug.rx_stats.skb_allocated);
+                         priv->debug.skbrx_stats.skb_allocated);
         len += scnprintf(buf + len, size - len,
                          "%20s : %10u\n", "SKBs completed",
-                         priv->debug.rx_stats.skb_completed);
+                         priv->debug.skbrx_stats.skb_completed);
         len += scnprintf(buf + len, size - len,
                          "%20s : %10u\n", "SKBs Dropped",
-                         priv->debug.rx_stats.skb_dropped);
-
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10u\n", "CRC ERR",
-                         priv->debug.rx_stats.err_crc);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10u\n", "DECRYPT CRC ERR",
-                         priv->debug.rx_stats.err_decrypt_crc);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10u\n", "MIC ERR",
-                         priv->debug.rx_stats.err_mic);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10u\n", "PRE-DELIM CRC ERR",
-                         priv->debug.rx_stats.err_pre_delim);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10u\n", "POST-DELIM CRC ERR",
-                         priv->debug.rx_stats.err_post_delim);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10u\n", "DECRYPT BUSY ERR",
-                         priv->debug.rx_stats.err_decrypt_busy);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10u\n", "TOTAL PHY ERR",
-                         priv->debug.rx_stats.err_phy);
-
-
-        PHY_ERR("UNDERRUN", ATH9K_PHYERR_UNDERRUN);
-        PHY_ERR("TIMING", ATH9K_PHYERR_TIMING);
-        PHY_ERR("PARITY", ATH9K_PHYERR_PARITY);
-        PHY_ERR("RATE", ATH9K_PHYERR_RATE);
-        PHY_ERR("LENGTH", ATH9K_PHYERR_LENGTH);
-        PHY_ERR("RADAR", ATH9K_PHYERR_RADAR);
-        PHY_ERR("SERVICE", ATH9K_PHYERR_SERVICE);
-        PHY_ERR("TOR", ATH9K_PHYERR_TOR);
-        PHY_ERR("OFDM-TIMING", ATH9K_PHYERR_OFDM_TIMING);
-        PHY_ERR("OFDM-SIGNAL-PARITY", ATH9K_PHYERR_OFDM_SIGNAL_PARITY);
-        PHY_ERR("OFDM-RATE", ATH9K_PHYERR_OFDM_RATE_ILLEGAL);
-        PHY_ERR("OFDM-LENGTH", ATH9K_PHYERR_OFDM_LENGTH_ILLEGAL);
-        PHY_ERR("OFDM-POWER-DROP", ATH9K_PHYERR_OFDM_POWER_DROP);
-        PHY_ERR("OFDM-SERVICE", ATH9K_PHYERR_OFDM_SERVICE);
-        PHY_ERR("OFDM-RESTART", ATH9K_PHYERR_OFDM_RESTART);
-        PHY_ERR("FALSE-RADAR-EXT", ATH9K_PHYERR_FALSE_RADAR_EXT);
-        PHY_ERR("CCK-TIMING", ATH9K_PHYERR_CCK_TIMING);
-        PHY_ERR("CCK-HEADER-CRC", ATH9K_PHYERR_CCK_HEADER_CRC);
-        PHY_ERR("CCK-RATE", ATH9K_PHYERR_CCK_RATE_ILLEGAL);
-        PHY_ERR("CCK-SERVICE", ATH9K_PHYERR_CCK_SERVICE);
-        PHY_ERR("CCK-RESTART", ATH9K_PHYERR_CCK_RESTART);
-        PHY_ERR("CCK-LENGTH", ATH9K_PHYERR_CCK_LENGTH_ILLEGAL);
-        PHY_ERR("CCK-POWER-DROP", ATH9K_PHYERR_CCK_POWER_DROP);
-        PHY_ERR("HT-CRC", ATH9K_PHYERR_HT_CRC_ERROR);
-        PHY_ERR("HT-LENGTH", ATH9K_PHYERR_HT_LENGTH_ILLEGAL);
-        PHY_ERR("HT-RATE", ATH9K_PHYERR_HT_RATE_ILLEGAL);
+                         priv->debug.skbrx_stats.skb_dropped);
 
         if (len > size)
                 len = size;
@@ -352,12 +277,10 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
         kfree(buf);
 
         return retval;
-
-#undef PHY_ERR
 }
 
-static const struct file_operations fops_recv = {
-        .read = read_file_recv,
+static const struct file_operations fops_skb_rx = {
+        .read = read_file_skb_rx,
         .open = simple_open,
         .owner = THIS_MODULE,
         .llseek = default_llseek,
@@ -486,423 +409,6 @@ static const struct file_operations fops_debug = {
         .llseek = default_llseek,
 };
 
-static ssize_t read_file_base_eeprom(struct file *file, char __user *user_buf,
-                                     size_t count, loff_t *ppos)
-{
-        struct ath9k_htc_priv *priv = file->private_data;
-        struct ath_common *common = ath9k_hw_common(priv->ah);
-        struct base_eep_header *pBase = NULL;
-        unsigned int len = 0, size = 1500;
-        ssize_t retval = 0;
-        char *buf;
-
-        pBase = ath9k_htc_get_eeprom_base(priv);
-
-        if (pBase == NULL) {
-                ath_err(common, "Unknown EEPROM type\n");
-                return 0;
-        }
-
-        buf = kzalloc(size, GFP_KERNEL);
-        if (buf == NULL)
-                return -ENOMEM;
-
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n", "Major Version",
-                         pBase->version >> 12);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n", "Minor Version",
-                         pBase->version & 0xFFF);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n", "Checksum",
-                         pBase->checksum);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n", "Length",
-                         pBase->length);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n", "RegDomain1",
-                         pBase->regDmn[0]);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n", "RegDomain2",
-                         pBase->regDmn[1]);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "TX Mask", pBase->txMask);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "RX Mask", pBase->rxMask);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Allow 5GHz",
-                         !!(pBase->opCapFlags & AR5416_OPFLAGS_11A));
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Allow 2GHz",
-                         !!(pBase->opCapFlags & AR5416_OPFLAGS_11G));
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Disable 2GHz HT20",
-                         !!(pBase->opCapFlags & AR5416_OPFLAGS_N_2G_HT20));
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Disable 2GHz HT40",
-                         !!(pBase->opCapFlags & AR5416_OPFLAGS_N_2G_HT40));
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Disable 5Ghz HT20",
-                         !!(pBase->opCapFlags & AR5416_OPFLAGS_N_5G_HT20));
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Disable 5Ghz HT40",
-                         !!(pBase->opCapFlags & AR5416_OPFLAGS_N_5G_HT40));
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Big Endian",
-                         !!(pBase->eepMisc & 0x01));
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Cal Bin Major Ver",
-                         (pBase->binBuildNumber >> 24) & 0xFF);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Cal Bin Minor Ver",
-                         (pBase->binBuildNumber >> 16) & 0xFF);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Cal Bin Build",
-                         (pBase->binBuildNumber >> 8) & 0xFF);
-
-        /*
-         * UB91 specific data.
-         */
-        if (AR_SREV_9271(priv->ah)) {
-                struct base_eep_header_4k *pBase4k =
-                        &priv->ah->eeprom.map4k.baseEepHeader;
-
-                len += scnprintf(buf + len, size - len,
-                                 "%20s : %10d\n",
-                                 "TX Gain type",
-                                 pBase4k->txGainType);
-        }
-
-        /*
-         * UB95 specific data.
-         */
-        if (priv->ah->hw_version.usbdev == AR9287_USB) {
-                struct base_eep_ar9287_header *pBase9287 =
-                        &priv->ah->eeprom.map9287.baseEepHeader;
-
-                len += scnprintf(buf + len, size - len,
-                                 "%20s : %10ddB\n",
-                                 "Power Table Offset",
-                                 pBase9287->pwrTableOffset);
-
-                len += scnprintf(buf + len, size - len,
-                                 "%20s : %10d\n",
-                                 "OpenLoop Power Ctrl",
-                                 pBase9287->openLoopPwrCntl);
-        }
-
-        len += scnprintf(buf + len, size - len, "%20s : %pM\n", "MacAddress",
-                         pBase->macAddr);
-        if (len > size)
-                len = size;
-
-        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-        kfree(buf);
-
-        return retval;
-}
-
-static const struct file_operations fops_base_eeprom = {
-        .read = read_file_base_eeprom,
-        .open = simple_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
-static ssize_t read_4k_modal_eeprom(struct file *file,
-                                    char __user *user_buf,
-                                    size_t count, loff_t *ppos)
-{
-#define PR_EEP(_s, _val)                                                \
-        do {                                                            \
-                len += scnprintf(buf + len, size - len, "%20s : %10d\n",\
-                                 _s, (_val));                           \
-        } while (0)
-
-        struct ath9k_htc_priv *priv = file->private_data;
-        struct modal_eep_4k_header *pModal = &priv->ah->eeprom.map4k.modalHeader;
-        unsigned int len = 0, size = 2048;
-        ssize_t retval = 0;
-        char *buf;
-
-        buf = kzalloc(size, GFP_KERNEL);
-        if (buf == NULL)
-                return -ENOMEM;
-
-        PR_EEP("Chain0 Ant. Control", pModal->antCtrlChain[0]);
-        PR_EEP("Ant. Common Control", pModal->antCtrlCommon);
-        PR_EEP("Chain0 Ant. Gain", pModal->antennaGainCh[0]);
-        PR_EEP("Switch Settle", pModal->switchSettling);
-        PR_EEP("Chain0 TxRxAtten", pModal->txRxAttenCh[0]);
-        PR_EEP("Chain0 RxTxMargin", pModal->rxTxMarginCh[0]);
-        PR_EEP("ADC Desired size", pModal->adcDesiredSize);
-        PR_EEP("PGA Desired size", pModal->pgaDesiredSize);
-        PR_EEP("Chain0 xlna Gain", pModal->xlnaGainCh[0]);
-        PR_EEP("txEndToXpaOff", pModal->txEndToXpaOff);
-        PR_EEP("txEndToRxOn", pModal->txEndToRxOn);
-        PR_EEP("txFrameToXpaOn", pModal->txFrameToXpaOn);
-        PR_EEP("CCA Threshold)", pModal->thresh62);
-        PR_EEP("Chain0 NF Threshold", pModal->noiseFloorThreshCh[0]);
-        PR_EEP("xpdGain", pModal->xpdGain);
-        PR_EEP("External PD", pModal->xpd);
-        PR_EEP("Chain0 I Coefficient", pModal->iqCalICh[0]);
-        PR_EEP("Chain0 Q Coefficient", pModal->iqCalQCh[0]);
-        PR_EEP("pdGainOverlap", pModal->pdGainOverlap);
-        PR_EEP("O/D Bias Version", pModal->version);
-        PR_EEP("CCK OutputBias", pModal->ob_0);
-        PR_EEP("BPSK OutputBias", pModal->ob_1);
-        PR_EEP("QPSK OutputBias", pModal->ob_2);
-        PR_EEP("16QAM OutputBias", pModal->ob_3);
-        PR_EEP("64QAM OutputBias", pModal->ob_4);
-        PR_EEP("CCK Driver1_Bias", pModal->db1_0);
-        PR_EEP("BPSK Driver1_Bias", pModal->db1_1);
-        PR_EEP("QPSK Driver1_Bias", pModal->db1_2);
-        PR_EEP("16QAM Driver1_Bias", pModal->db1_3);
-        PR_EEP("64QAM Driver1_Bias", pModal->db1_4);
-        PR_EEP("CCK Driver2_Bias", pModal->db2_0);
-        PR_EEP("BPSK Driver2_Bias", pModal->db2_1);
-        PR_EEP("QPSK Driver2_Bias", pModal->db2_2);
-        PR_EEP("16QAM Driver2_Bias", pModal->db2_3);
-        PR_EEP("64QAM Driver2_Bias", pModal->db2_4);
-        PR_EEP("xPA Bias Level", pModal->xpaBiasLvl);
-        PR_EEP("txFrameToDataStart", pModal->txFrameToDataStart);
-        PR_EEP("txFrameToPaOn", pModal->txFrameToPaOn);
-        PR_EEP("HT40 Power Inc.", pModal->ht40PowerIncForPdadc);
-        PR_EEP("Chain0 bswAtten", pModal->bswAtten[0]);
-        PR_EEP("Chain0 bswMargin", pModal->bswMargin[0]);
-        PR_EEP("HT40 Switch Settle", pModal->swSettleHt40);
-        PR_EEP("Chain0 xatten2Db", pModal->xatten2Db[0]);
-        PR_EEP("Chain0 xatten2Margin", pModal->xatten2Margin[0]);
-        PR_EEP("Ant. Diversity ctl1", pModal->antdiv_ctl1);
-        PR_EEP("Ant. Diversity ctl2", pModal->antdiv_ctl2);
-        PR_EEP("TX Diversity", pModal->tx_diversity);
-
-        if (len > size)
-                len = size;
-
-        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-        kfree(buf);
-
-        return retval;
-
-#undef PR_EEP
-}
-
-static ssize_t read_def_modal_eeprom(struct file *file,
-                                     char __user *user_buf,
-                                     size_t count, loff_t *ppos)
-{
-#define PR_EEP(_s, _val)                                                \
-        do {                                                            \
-                if (pBase->opCapFlags & AR5416_OPFLAGS_11G) {           \
-                        pModal = &priv->ah->eeprom.def.modalHeader[1];  \
-                        len += scnprintf(buf + len, size - len, "%20s : %8d%7s", \
-                                         _s, (_val), "|");              \
-                }                                                       \
-                if (pBase->opCapFlags & AR5416_OPFLAGS_11A) {           \
-                        pModal = &priv->ah->eeprom.def.modalHeader[0];  \
-                        len += scnprintf(buf + len, size - len, "%9d\n",\
-                                        (_val));                        \
-                }                                                       \
-        } while (0)
-
-        struct ath9k_htc_priv *priv = file->private_data;
-        struct base_eep_header *pBase = &priv->ah->eeprom.def.baseEepHeader;
-        struct modal_eep_header *pModal = NULL;
-        unsigned int len = 0, size = 3500;
-        ssize_t retval = 0;
-        char *buf;
-
-        buf = kzalloc(size, GFP_KERNEL);
-        if (buf == NULL)
-                return -ENOMEM;
-
-        len += scnprintf(buf + len, size - len,
-                         "%31s %15s\n", "2G", "5G");
-        len += scnprintf(buf + len, size - len,
-                         "%32s %16s\n", "====", "====\n");
-
-        PR_EEP("Chain0 Ant. Control", pModal->antCtrlChain[0]);
-        PR_EEP("Chain1 Ant. Control", pModal->antCtrlChain[1]);
-        PR_EEP("Chain2 Ant. Control", pModal->antCtrlChain[2]);
-        PR_EEP("Ant. Common Control", pModal->antCtrlCommon);
-        PR_EEP("Chain0 Ant. Gain", pModal->antennaGainCh[0]);
-        PR_EEP("Chain1 Ant. Gain", pModal->antennaGainCh[1]);
-        PR_EEP("Chain2 Ant. Gain", pModal->antennaGainCh[2]);
-        PR_EEP("Switch Settle", pModal->switchSettling);
-        PR_EEP("Chain0 TxRxAtten", pModal->txRxAttenCh[0]);
-        PR_EEP("Chain1 TxRxAtten", pModal->txRxAttenCh[1]);
-        PR_EEP("Chain2 TxRxAtten", pModal->txRxAttenCh[2]);
-        PR_EEP("Chain0 RxTxMargin", pModal->rxTxMarginCh[0]);
-        PR_EEP("Chain1 RxTxMargin", pModal->rxTxMarginCh[1]);
-        PR_EEP("Chain2 RxTxMargin", pModal->rxTxMarginCh[2]);
-        PR_EEP("ADC Desired size", pModal->adcDesiredSize);
-        PR_EEP("PGA Desired size", pModal->pgaDesiredSize);
-        PR_EEP("Chain0 xlna Gain", pModal->xlnaGainCh[0]);
-        PR_EEP("Chain1 xlna Gain", pModal->xlnaGainCh[1]);
-        PR_EEP("Chain2 xlna Gain", pModal->xlnaGainCh[2]);
-        PR_EEP("txEndToXpaOff", pModal->txEndToXpaOff);
-        PR_EEP("txEndToRxOn", pModal->txEndToRxOn);
-        PR_EEP("txFrameToXpaOn", pModal->txFrameToXpaOn);
-        PR_EEP("CCA Threshold)", pModal->thresh62);
-        PR_EEP("Chain0 NF Threshold", pModal->noiseFloorThreshCh[0]);
-        PR_EEP("Chain1 NF Threshold", pModal->noiseFloorThreshCh[1]);
-        PR_EEP("Chain2 NF Threshold", pModal->noiseFloorThreshCh[2]);
-        PR_EEP("xpdGain", pModal->xpdGain);
-        PR_EEP("External PD", pModal->xpd);
-        PR_EEP("Chain0 I Coefficient", pModal->iqCalICh[0]);
-        PR_EEP("Chain1 I Coefficient", pModal->iqCalICh[1]);
-        PR_EEP("Chain2 I Coefficient", pModal->iqCalICh[2]);
-        PR_EEP("Chain0 Q Coefficient", pModal->iqCalQCh[0]);
-        PR_EEP("Chain1 Q Coefficient", pModal->iqCalQCh[1]);
-        PR_EEP("Chain2 Q Coefficient", pModal->iqCalQCh[2]);
-        PR_EEP("pdGainOverlap", pModal->pdGainOverlap);
-        PR_EEP("Chain0 OutputBias", pModal->ob);
-        PR_EEP("Chain0 DriverBias", pModal->db);
-        PR_EEP("xPA Bias Level", pModal->xpaBiasLvl);
-        PR_EEP("2chain pwr decrease", pModal->pwrDecreaseFor2Chain);
-        PR_EEP("3chain pwr decrease", pModal->pwrDecreaseFor3Chain);
-        PR_EEP("txFrameToDataStart", pModal->txFrameToDataStart);
-        PR_EEP("txFrameToPaOn", pModal->txFrameToPaOn);
-        PR_EEP("HT40 Power Inc.", pModal->ht40PowerIncForPdadc);
-        PR_EEP("Chain0 bswAtten", pModal->bswAtten[0]);
-        PR_EEP("Chain1 bswAtten", pModal->bswAtten[1]);
-        PR_EEP("Chain2 bswAtten", pModal->bswAtten[2]);
-        PR_EEP("Chain0 bswMargin", pModal->bswMargin[0]);
-        PR_EEP("Chain1 bswMargin", pModal->bswMargin[1]);
-        PR_EEP("Chain2 bswMargin", pModal->bswMargin[2]);
-        PR_EEP("HT40 Switch Settle", pModal->swSettleHt40);
-        PR_EEP("Chain0 xatten2Db", pModal->xatten2Db[0]);
-        PR_EEP("Chain1 xatten2Db", pModal->xatten2Db[1]);
-        PR_EEP("Chain2 xatten2Db", pModal->xatten2Db[2]);
-        PR_EEP("Chain0 xatten2Margin", pModal->xatten2Margin[0]);
-        PR_EEP("Chain1 xatten2Margin", pModal->xatten2Margin[1]);
-        PR_EEP("Chain2 xatten2Margin", pModal->xatten2Margin[2]);
-        PR_EEP("Chain1 OutputBias", pModal->ob_ch1);
-        PR_EEP("Chain1 DriverBias", pModal->db_ch1);
-        PR_EEP("LNA Control", pModal->lna_ctl);
-        PR_EEP("XPA Bias Freq0", pModal->xpaBiasLvlFreq[0]);
-        PR_EEP("XPA Bias Freq1", pModal->xpaBiasLvlFreq[1]);
-        PR_EEP("XPA Bias Freq2", pModal->xpaBiasLvlFreq[2]);
-
-        if (len > size)
-                len = size;
-
-        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-        kfree(buf);
-
-        return retval;
-
-#undef PR_EEP
-}
-
-static ssize_t read_9287_modal_eeprom(struct file *file,
-                                      char __user *user_buf,
-                                      size_t count, loff_t *ppos)
-{
-#define PR_EEP(_s, _val)                                                \
-        do {                                                            \
-                len += scnprintf(buf + len, size - len, "%20s : %10d\n",\
-                                 _s, (_val));                           \
-        } while (0)
-
-        struct ath9k_htc_priv *priv = file->private_data;
-        struct modal_eep_ar9287_header *pModal = &priv->ah->eeprom.map9287.modalHeader;
-        unsigned int len = 0, size = 3000;
-        ssize_t retval = 0;
-        char *buf;
-
-        buf = kzalloc(size, GFP_KERNEL);
-        if (buf == NULL)
-                return -ENOMEM;
-
-        PR_EEP("Chain0 Ant. Control", pModal->antCtrlChain[0]);
-        PR_EEP("Chain1 Ant. Control", pModal->antCtrlChain[1]);
-        PR_EEP("Ant. Common Control", pModal->antCtrlCommon);
-        PR_EEP("Chain0 Ant. Gain", pModal->antennaGainCh[0]);
-        PR_EEP("Chain1 Ant. Gain", pModal->antennaGainCh[1]);
-        PR_EEP("Switch Settle", pModal->switchSettling);
-        PR_EEP("Chain0 TxRxAtten", pModal->txRxAttenCh[0]);
-        PR_EEP("Chain1 TxRxAtten", pModal->txRxAttenCh[1]);
-        PR_EEP("Chain0 RxTxMargin", pModal->rxTxMarginCh[0]);
-        PR_EEP("Chain1 RxTxMargin", pModal->rxTxMarginCh[1]);
-        PR_EEP("ADC Desired size", pModal->adcDesiredSize);
-        PR_EEP("txEndToXpaOff", pModal->txEndToXpaOff);
-        PR_EEP("txEndToRxOn", pModal->txEndToRxOn);
-        PR_EEP("txFrameToXpaOn", pModal->txFrameToXpaOn);
-        PR_EEP("CCA Threshold)", pModal->thresh62);
-        PR_EEP("Chain0 NF Threshold", pModal->noiseFloorThreshCh[0]);
-        PR_EEP("Chain1 NF Threshold", pModal->noiseFloorThreshCh[1]);
-        PR_EEP("xpdGain", pModal->xpdGain);
-        PR_EEP("External PD", pModal->xpd);
-        PR_EEP("Chain0 I Coefficient", pModal->iqCalICh[0]);
-        PR_EEP("Chain1 I Coefficient", pModal->iqCalICh[1]);
-        PR_EEP("Chain0 Q Coefficient", pModal->iqCalQCh[0]);
-        PR_EEP("Chain1 Q Coefficient", pModal->iqCalQCh[1]);
-        PR_EEP("pdGainOverlap", pModal->pdGainOverlap);
-        PR_EEP("xPA Bias Level", pModal->xpaBiasLvl);
-        PR_EEP("txFrameToDataStart", pModal->txFrameToDataStart);
-        PR_EEP("txFrameToPaOn", pModal->txFrameToPaOn);
-        PR_EEP("HT40 Power Inc.", pModal->ht40PowerIncForPdadc);
-        PR_EEP("Chain0 bswAtten", pModal->bswAtten[0]);
-        PR_EEP("Chain1 bswAtten", pModal->bswAtten[1]);
-        PR_EEP("Chain0 bswMargin", pModal->bswMargin[0]);
-        PR_EEP("Chain1 bswMargin", pModal->bswMargin[1]);
-        PR_EEP("HT40 Switch Settle", pModal->swSettleHt40);
-        PR_EEP("AR92x7 Version", pModal->version);
-        PR_EEP("DriverBias1", pModal->db1);
-        PR_EEP("DriverBias2", pModal->db1);
-        PR_EEP("CCK OutputBias", pModal->ob_cck);
-        PR_EEP("PSK OutputBias", pModal->ob_psk);
-        PR_EEP("QAM OutputBias", pModal->ob_qam);
-        PR_EEP("PAL_OFF OutputBias", pModal->ob_pal_off);
-
-        if (len > size)
-                len = size;
-
-        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-        kfree(buf);
-
-        return retval;
-
-#undef PR_EEP
-}
-
-static ssize_t read_file_modal_eeprom(struct file *file, char __user *user_buf,
-                                      size_t count, loff_t *ppos)
-{
-        struct ath9k_htc_priv *priv = file->private_data;
-
-        if (AR_SREV_9271(priv->ah))
-                return read_4k_modal_eeprom(file, user_buf, count, ppos);
-        else if (priv->ah->hw_version.usbdev == AR9280_USB)
-                return read_def_modal_eeprom(file, user_buf, count, ppos);
-        else if (priv->ah->hw_version.usbdev == AR9287_USB)
-                return read_9287_modal_eeprom(file, user_buf, count, ppos);
-
-        return 0;
-}
-
-static const struct file_operations fops_modal_eeprom = {
-        .read = read_file_modal_eeprom,
-        .open = simple_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
-
 /* Ethtool support for get-stats */
 #define AMKSTR(nm) #nm "_BE", #nm "_BK", #nm "_VI", #nm "_VO"
 static const char ath9k_htc_gstrings_stats[][ETH_GSTRING_LEN] = {
@@ -947,6 +453,8 @@ int ath9k_htc_get_et_sset_count(struct ieee80211_hw *hw,
 
 #define STXBASE priv->debug.tx_stats
 #define SRXBASE priv->debug.rx_stats
+#define SKBTXBASE priv->debug.tx_stats
+#define SKBRXBASE priv->debug.skbrx_stats
 #define ASTXQ(a)                                        \
         data[i++] = STXBASE.a[IEEE80211_AC_BE];         \
         data[i++] = STXBASE.a[IEEE80211_AC_BK];         \
@@ -960,24 +468,24 @@ void ath9k_htc_get_et_stats(struct ieee80211_hw *hw,
         struct ath9k_htc_priv *priv = hw->priv;
         int i = 0;
 
-        data[i++] = STXBASE.skb_success;
-        data[i++] = STXBASE.skb_success_bytes;
-        data[i++] = SRXBASE.skb_completed;
-        data[i++] = SRXBASE.skb_completed_bytes;
+        data[i++] = SKBTXBASE.skb_success;
+        data[i++] = SKBTXBASE.skb_success_bytes;
+        data[i++] = SKBRXBASE.skb_completed;
+        data[i++] = SKBRXBASE.skb_completed_bytes;
 
         ASTXQ(queue_stats);
 
-        data[i++] = SRXBASE.err_crc;
-        data[i++] = SRXBASE.err_decrypt_crc;
-        data[i++] = SRXBASE.err_phy;
-        data[i++] = SRXBASE.err_mic;
-        data[i++] = SRXBASE.err_pre_delim;
-        data[i++] = SRXBASE.err_post_delim;
-        data[i++] = SRXBASE.err_decrypt_busy;
+        data[i++] = SRXBASE.crc_err;
+        data[i++] = SRXBASE.decrypt_crc_err;
+        data[i++] = SRXBASE.phy_err;
+        data[i++] = SRXBASE.mic_err;
+        data[i++] = SRXBASE.pre_delim_crc_err;
+        data[i++] = SRXBASE.post_delim_crc_err;
+        data[i++] = SRXBASE.decrypt_busy_err;
 
-        data[i++] = SRXBASE.err_phy_stats[ATH9K_PHYERR_RADAR];
-        data[i++] = SRXBASE.err_phy_stats[ATH9K_PHYERR_OFDM_TIMING];
-        data[i++] = SRXBASE.err_phy_stats[ATH9K_PHYERR_CCK_TIMING];
+        data[i++] = SRXBASE.phy_err_stats[ATH9K_PHYERR_RADAR];
+        data[i++] = SRXBASE.phy_err_stats[ATH9K_PHYERR_OFDM_TIMING];
+        data[i++] = SRXBASE.phy_err_stats[ATH9K_PHYERR_CCK_TIMING];
 
         WARN_ON(i != ATH9K_HTC_SSTATS_LEN);
 }
@@ -1001,18 +509,21 @@ int ath9k_htc_init_debug(struct ath_hw *ah)
                             priv, &fops_tgt_rx_stats);
         debugfs_create_file("xmit", S_IRUSR, priv->debug.debugfs_phy,
                             priv, &fops_xmit);
-        debugfs_create_file("recv", S_IRUSR, priv->debug.debugfs_phy,
-                            priv, &fops_recv);
+        debugfs_create_file("skb_rx", S_IRUSR, priv->debug.debugfs_phy,
+                            priv, &fops_skb_rx);
+
+        ath9k_cmn_debug_recv(priv->debug.debugfs_phy, &priv->debug.rx_stats);
+        ath9k_cmn_debug_phy_err(priv->debug.debugfs_phy, &priv->debug.rx_stats);
+
         debugfs_create_file("slot", S_IRUSR, priv->debug.debugfs_phy,
                             priv, &fops_slot);
         debugfs_create_file("queue", S_IRUSR, priv->debug.debugfs_phy,
                             priv, &fops_queue);
         debugfs_create_file("debug", S_IRUSR | S_IWUSR, priv->debug.debugfs_phy,
                             priv, &fops_debug);
-        debugfs_create_file("base_eeprom", S_IRUSR, priv->debug.debugfs_phy,
-                            priv, &fops_base_eeprom);
-        debugfs_create_file("modal_eeprom", S_IRUSR, priv->debug.debugfs_phy,
-                            priv, &fops_modal_eeprom);
+
+        ath9k_cmn_debug_base_eeprom(priv->debug.debugfs_phy, priv->ah);
+        ath9k_cmn_debug_modal_eeprom(priv->debug.debugfs_phy, priv->ah);
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index 289f3d8924b5..bb86eb2ffc95 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -996,8 +996,6 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
                 goto rx_next;
         }
 
-        ath9k_htc_err_stat_rx(priv, rxstatus);
-
         /* Get the RX status information */
 
         memset(rx_status, 0, sizeof(struct ieee80211_rx_status));
@@ -1005,6 +1003,7 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
         /* Copy everything from ath_htc_rx_status (HTC_RX_FRAME_HEADER).
          * After this, we can drop this part of skb. */
         rx_status_htc_to_ath(&rx_stats, rxstatus);
+        ath9k_htc_err_stat_rx(priv, &rx_stats);
         rx_status->mactime = be64_to_cpu(rxstatus->rs_tstamp);
         skb_pull(skb, HTC_RX_FRAME_HEADER_SIZE);
 
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index c8a9dfab1fee..2a8ed8375ec0 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -26,7 +26,6 @@
 #include "ar9003_mac.h"
 #include "ar9003_mci.h"
 #include "ar9003_phy.h"
-#include "debug.h"
 #include "ath9k.h"
 
 static bool ath9k_hw_set_reset_reg(struct ath_hw *ah, u32 type);
@@ -246,6 +245,8 @@ static void ath9k_hw_read_revisions(struct ath_hw *ah)
                 return;
         case AR9300_DEVID_AR953X:
                 ah->hw_version.macVersion = AR_SREV_VERSION_9531;
+                if (ah->get_mac_revision)
+                        ah->hw_version.macRev = ah->get_mac_revision();
                 return;
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 36ae6490e554..0246b990fe87 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -61,6 +61,10 @@ static int ath9k_ps_enable;
 module_param_named(ps_enable, ath9k_ps_enable, int, 0444);
 MODULE_PARM_DESC(ps_enable, "Enable WLAN PowerSave");
 
+static int ath9k_use_chanctx;
+module_param_named(use_chanctx, ath9k_use_chanctx, int, 0444);
+MODULE_PARM_DESC(use_chanctx, "Enable channel context for concurrency");
+
 bool is_ath9k_unloaded;
 
 #ifdef CONFIG_MAC80211_LEDS
@@ -508,7 +512,7 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc,
         sc->tx99_power = MAX_RATE_POWER + 1;
         init_waitqueue_head(&sc->tx_wait);
 
-        if (!pdata) {
+        if (!pdata || pdata->use_eeprom) {
                 ah->ah_flags |= AH_USE_EEPROM;
                 sc->sc_ah->led_pin = -1;
         } else {
@@ -589,6 +593,9 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc,
         if (ret)
                 goto err_btcoex;
 
+        sc->p2p_ps_timer = ath_gen_timer_alloc(sc->sc_ah, ath9k_p2p_ps_timer,
+                NULL, sc, AR_FIRST_NDP_TIMER);
+
         ath9k_cmn_init_crypto(sc->sc_ah);
         ath9k_init_misc(sc);
         ath_fill_led_pin(sc);
@@ -643,17 +650,20 @@ static void ath9k_init_txpower_limits(struct ath_softc *sc)
 }
 
 static const struct ieee80211_iface_limit if_limits[] = {
-        { .max = 2048,  .types = BIT(NL80211_IFTYPE_STATION) |
-                                 BIT(NL80211_IFTYPE_P2P_CLIENT) |
-                                 BIT(NL80211_IFTYPE_WDS) },
+        { .max = 2048,  .types = BIT(NL80211_IFTYPE_STATION) },
         { .max = 8,     .types =
 #ifdef CONFIG_MAC80211_MESH
                                  BIT(NL80211_IFTYPE_MESH_POINT) |
 #endif
-                                 BIT(NL80211_IFTYPE_AP) |
+                                 BIT(NL80211_IFTYPE_AP) },
+        { .max = 1,     .types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
                                  BIT(NL80211_IFTYPE_P2P_GO) },
 };
 
+static const struct ieee80211_iface_limit wds_limits[] = {
+        { .max = 2048,  .types = BIT(NL80211_IFTYPE_WDS) },
+};
+
 static const struct ieee80211_iface_limit if_dfs_limits[] = {
         { .max = 1,     .types = BIT(NL80211_IFTYPE_AP) |
 #ifdef CONFIG_MAC80211_MESH
@@ -670,6 +680,13 @@ static const struct ieee80211_iface_combination if_comb[] = {
                 .num_different_channels = 1,
                 .beacon_int_infra_match = true,
         },
+        {
+                .limits = wds_limits,
+                .n_limits = ARRAY_SIZE(wds_limits),
+                .max_interfaces = 2048,
+                .num_different_channels = 1,
+                .beacon_int_infra_match = true,
+        },
 #ifdef CONFIG_ATH9K_DFS_CERTIFIED
         {
                 .limits = if_dfs_limits,
@@ -711,19 +728,23 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
         if (AR_SREV_9160_10_OR_LATER(sc->sc_ah) || ath9k_modparam_nohwcrypt)
                 hw->flags |= IEEE80211_HW_MFP_CAPABLE;
 
-        hw->wiphy->features |= NL80211_FEATURE_ACTIVE_MONITOR;
+        hw->wiphy->features |= (NL80211_FEATURE_ACTIVE_MONITOR |
+                                NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE);
 
         if (!config_enabled(CONFIG_ATH9K_TX99)) {
                 hw->wiphy->interface_modes =
                         BIT(NL80211_IFTYPE_P2P_GO) |
                         BIT(NL80211_IFTYPE_P2P_CLIENT) |
                         BIT(NL80211_IFTYPE_AP) |
-                        BIT(NL80211_IFTYPE_WDS) |
                         BIT(NL80211_IFTYPE_STATION) |
                         BIT(NL80211_IFTYPE_ADHOC) |
                         BIT(NL80211_IFTYPE_MESH_POINT);
                 hw->wiphy->iface_combinations = if_comb;
-                hw->wiphy->n_iface_combinations = ARRAY_SIZE(if_comb);
+                if (!ath9k_use_chanctx) {
+                        hw->wiphy->n_iface_combinations = ARRAY_SIZE(if_comb);
+                        hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_WDS);
+                } else
+                        hw->wiphy->n_iface_combinations = 1;
         }
 
         hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
@@ -855,6 +876,9 @@ static void ath9k_deinit_softc(struct ath_softc *sc)
 {
         int i = 0;
 
+        if (sc->p2p_ps_timer)
+                ath_gen_timer_free(sc->sc_ah, sc->p2p_ps_timer);
+
         ath9k_deinit_btcoex(sc);
 
         for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++)
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 51ce36f108f9..275205ab5f15 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -958,3 +958,25 @@ void ath9k_hw_set_interrupts(struct ath_hw *ah)
         return;
 }
 EXPORT_SYMBOL(ath9k_hw_set_interrupts);
+
+#define ATH9K_HW_MAX_DCU       10
+#define ATH9K_HW_SLICE_PER_DCU 16
+#define ATH9K_HW_BIT_IN_SLICE  16
+void ath9k_hw_set_tx_filter(struct ath_hw *ah, u8 destidx, bool set)
+{
+        int dcu_idx;
+        u32 filter;
+
+        for (dcu_idx = 0; dcu_idx < 10; dcu_idx++) {
+                filter = SM(set, AR_D_TXBLK_WRITE_COMMAND);
+                filter |= SM(dcu_idx, AR_D_TXBLK_WRITE_DCU);
+                filter |= SM((destidx / ATH9K_HW_SLICE_PER_DCU),
+                             AR_D_TXBLK_WRITE_SLICE);
+                filter |= BIT(destidx % ATH9K_HW_BIT_IN_SLICE);
+                ath_dbg(ath9k_hw_common(ah), PS,
+                        "DCU%d staid %d set %d txfilter %08x\n",
+                        dcu_idx, destidx, set, filter);
+                REG_WRITE(ah, AR_D_TXBLK_BASE, filter);
+        }
+}
+EXPORT_SYMBOL(ath9k_hw_set_tx_filter);
diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h
index 89df634e81f9..da7686757535 100644
--- a/drivers/net/wireless/ath/ath9k/mac.h
+++ b/drivers/net/wireless/ath/ath9k/mac.h
@@ -729,6 +729,7 @@ void ath9k_hw_startpcureceive(struct ath_hw *ah, bool is_scanning);
 void ath9k_hw_abortpcurecv(struct ath_hw *ah);
 bool ath9k_hw_stopdmarecv(struct ath_hw *ah, bool *reset);
 int ath9k_hw_beaconq_setup(struct ath_hw *ah);
+void ath9k_hw_set_tx_filter(struct ath_hw *ah, u8 destidx, bool set);
 
 /* Interrupt Handling */
 bool ath9k_hw_intrpend(struct ath_hw *ah);
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index d69853b848ce..62ac95d6bb9d 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -261,6 +261,8 @@ static bool ath_complete_reset(struct ath_softc *sc, bool start)
         sc->gtt_cnt = 0;
         ieee80211_wake_queues(sc->hw);
 
+        ath9k_p2p_ps_timer(sc);
+
         return true;
 }
 
@@ -419,6 +421,7 @@ static void ath_node_attach(struct ath_softc *sc, struct ieee80211_sta *sta,
         an->sc = sc;
         an->sta = sta;
         an->vif = vif;
+        memset(&an->key_idx, 0, sizeof(an->key_idx));
 
         ath_tx_node_init(sc, an);
 }
@@ -1119,6 +1122,8 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
         if (ath9k_uses_beacons(vif->type))
                 ath9k_beacon_assign_slot(sc, vif);
 
+        avp->vif = vif;
+
         an->sc = sc;
         an->sta = NULL;
         an->vif = vif;
@@ -1163,6 +1168,29 @@ static int ath9k_change_interface(struct ieee80211_hw *hw,
         return 0;
 }
 
+static void
+ath9k_update_p2p_ps_timer(struct ath_softc *sc, struct ath_vif *avp)
+{
+        struct ath_hw *ah = sc->sc_ah;
+        s32 tsf, target_tsf;
+
+        if (!avp || !avp->noa.has_next_tsf)
+                return;
+
+        ath9k_hw_gen_timer_stop(ah, sc->p2p_ps_timer);
+
+        tsf = ath9k_hw_gettsf32(sc->sc_ah);
+
+        target_tsf = avp->noa.next_tsf;
+        if (!avp->noa.absent)
+                target_tsf -= ATH_P2P_PS_STOP_TIME;
+
+        if (target_tsf - tsf < ATH_P2P_PS_STOP_TIME)
+                target_tsf = tsf + ATH_P2P_PS_STOP_TIME;
+
+        ath9k_hw_gen_timer_start(ah, sc->p2p_ps_timer, (u32) target_tsf, 1000000);
+}
+
 static void ath9k_remove_interface(struct ieee80211_hw *hw,
                                    struct ieee80211_vif *vif)
 {
@@ -1174,6 +1202,13 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
 
         mutex_lock(&sc->mutex);
 
+        spin_lock_bh(&sc->sc_pcu_lock);
+        if (avp == sc->p2p_ps_vif) {
+                sc->p2p_ps_vif = NULL;
+                ath9k_update_p2p_ps_timer(sc, NULL);
+        }
+        spin_unlock_bh(&sc->sc_pcu_lock);
+
         sc->nvifs--;
         sc->tx99_vif = NULL;
 
@@ -1427,8 +1462,10 @@ static int ath9k_sta_add(struct ieee80211_hw *hw,
                 return 0;
 
         key = ath_key_config(common, vif, sta, &ps_key);
-        if (key > 0)
+        if (key > 0) {
                 an->ps_key = key;
+                an->key_idx[0] = key;
+        }
 
         return 0;
 }
@@ -1446,6 +1483,7 @@ static void ath9k_del_ps_key(struct ath_softc *sc,
 
         ath_key_delete(common, &ps_key);
         an->ps_key = 0;
+        an->key_idx[0] = 0;
 }
 
 static int ath9k_sta_remove(struct ieee80211_hw *hw,
@@ -1460,6 +1498,19 @@ static int ath9k_sta_remove(struct ieee80211_hw *hw,
         return 0;
 }
 
+static void ath9k_sta_set_tx_filter(struct ath_hw *ah,
+                                    struct ath_node *an,
+                                    bool set)
+{
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(an->key_idx); i++) {
+                if (!an->key_idx[i])
+                        continue;
+                ath9k_hw_set_tx_filter(ah, an->key_idx[i], set);
+        }
+}
+
 static void ath9k_sta_notify(struct ieee80211_hw *hw,
                          struct ieee80211_vif *vif,
                          enum sta_notify_cmd cmd,
@@ -1472,8 +1523,10 @@ static void ath9k_sta_notify(struct ieee80211_hw *hw,
         case STA_NOTIFY_SLEEP:
                 an->sleeping = true;
                 ath_tx_aggr_sleep(sta, sc, an);
+                ath9k_sta_set_tx_filter(sc->sc_ah, an, true);
                 break;
         case STA_NOTIFY_AWAKE:
+                ath9k_sta_set_tx_filter(sc->sc_ah, an, false);
                 an->sleeping = false;
                 ath_tx_aggr_wakeup(sc, an);
                 break;
@@ -1529,7 +1582,8 @@ static int ath9k_set_key(struct ieee80211_hw *hw,
 {
         struct ath_softc *sc = hw->priv;
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        int ret = 0;
+        struct ath_node *an = NULL;
+        int ret = 0, i;
 
         if (ath9k_modparam_nohwcrypt)
                 return -ENOSPC;
@@ -1551,13 +1605,16 @@ static int ath9k_set_key(struct ieee80211_hw *hw,
 
         mutex_lock(&sc->mutex);
         ath9k_ps_wakeup(sc);
-        ath_dbg(common, CONFIG, "Set HW Key\n");
+        ath_dbg(common, CONFIG, "Set HW Key %d\n", cmd);
+        if (sta)
+                an = (struct ath_node *)sta->drv_priv;
 
         switch (cmd) {
         case SET_KEY:
                 if (sta)
                         ath9k_del_ps_key(sc, vif, sta);
 
+                key->hw_key_idx = 0;
                 ret = ath_key_config(common, vif, sta, key);
                 if (ret >= 0) {
                         key->hw_key_idx = ret;
@@ -1570,9 +1627,27 @@ static int ath9k_set_key(struct ieee80211_hw *hw,
                                 key->flags |= IEEE80211_KEY_FLAG_SW_MGMT_TX;
                         ret = 0;
                 }
+                if (an && key->hw_key_idx) {
+                        for (i = 0; i < ARRAY_SIZE(an->key_idx); i++) {
+                                if (an->key_idx[i])
+                                        continue;
+                                an->key_idx[i] = key->hw_key_idx;
+                                break;
+                        }
+                        WARN_ON(i == ARRAY_SIZE(an->key_idx));
+                }
                 break;
         case DISABLE_KEY:
                 ath_key_delete(common, key);
+                if (an) {
+                        for (i = 0; i < ARRAY_SIZE(an->key_idx); i++) {
+                                if (an->key_idx[i] != key->hw_key_idx)
+                                        continue;
+                                an->key_idx[i] = 0;
+                                break;
+                        }
+                }
+                key->hw_key_idx = 0;
                 break;
         default:
                 ret = -EINVAL;
@@ -1636,6 +1711,66 @@ static void ath9k_bss_assoc_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
                 ath9k_set_assoc_state(sc, vif);
 }
 
+void ath9k_p2p_ps_timer(void *priv)
+{
+        struct ath_softc *sc = priv;
+        struct ath_vif *avp = sc->p2p_ps_vif;
+        struct ieee80211_vif *vif;
+        struct ieee80211_sta *sta;
+        struct ath_node *an;
+        u32 tsf;
+
+        if (!avp)
+                return;
+
+        tsf = ath9k_hw_gettsf32(sc->sc_ah);
+        if (!avp->noa.absent)
+                tsf += ATH_P2P_PS_STOP_TIME;
+
+        if (!avp->noa.has_next_tsf ||
+            avp->noa.next_tsf - tsf > BIT(31))
+                ieee80211_update_p2p_noa(&avp->noa, tsf);
+
+        ath9k_update_p2p_ps_timer(sc, avp);
+
+        rcu_read_lock();
+
+        vif = avp->vif;
+        sta = ieee80211_find_sta(vif, vif->bss_conf.bssid);
+        if (!sta)
+                goto out;
+
+        an = (void *) sta->drv_priv;
+        if (an->sleeping == !!avp->noa.absent)
+                goto out;
+
+        an->sleeping = avp->noa.absent;
+        if (an->sleeping)
+                ath_tx_aggr_sleep(sta, sc, an);
+        else
+                ath_tx_aggr_wakeup(sc, an);
+
+out:
+        rcu_read_unlock();
+}
+
+void ath9k_update_p2p_ps(struct ath_softc *sc, struct ieee80211_vif *vif)
+{
+        struct ath_vif *avp = (void *)vif->drv_priv;
+        u32 tsf;
+
+        if (!sc->p2p_ps_timer)
+                return;
+
+        if (vif->type != NL80211_IFTYPE_STATION || !vif->p2p)
+                return;
+
+        sc->p2p_ps_vif = avp;
+        tsf = ath9k_hw_gettsf32(sc->sc_ah);
+        ieee80211_parse_p2p_noa(&vif->bss_conf.p2p_noa_attr, &avp->noa, tsf);
+        ath9k_update_p2p_ps_timer(sc, avp);
+}
+
 static void ath9k_bss_info_changed(struct ieee80211_hw *hw,
                                    struct ieee80211_vif *vif,
                                    struct ieee80211_bss_conf *bss_conf,
@@ -1650,6 +1785,7 @@ static void ath9k_bss_info_changed(struct ieee80211_hw *hw,
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
         struct ath_vif *avp = (void *)vif->drv_priv;
+        unsigned long flags;
         int slottime;
 
         ath9k_ps_wakeup(sc);
@@ -1710,6 +1846,15 @@ static void ath9k_bss_info_changed(struct ieee80211_hw *hw,
                 }
         }
 
+        if (changed & BSS_CHANGED_P2P_PS) {
+                spin_lock_bh(&sc->sc_pcu_lock);
+                spin_lock_irqsave(&sc->sc_pm_lock, flags);
+                if (!(sc->ps_flags & PS_BEACON_SYNC))
+                        ath9k_update_p2p_ps(sc, vif);
+                spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
+                spin_unlock_bh(&sc->sc_pcu_lock);
+        }
+
         if (changed & CHECK_ANI)
                 ath_check_ani(sc);
 
@@ -1883,7 +2028,8 @@ static bool ath9k_has_tx_pending(struct ath_softc *sc)
         return !!npend;
 }
 
-static void ath9k_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+static void ath9k_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                        u32 queues, bool drop)
 {
         struct ath_softc *sc = hw->priv;
         struct ath_hw *ah = sc->sc_ah;
@@ -2084,14 +2230,6 @@ static void ath9k_sw_scan_complete(struct ieee80211_hw *hw)
         clear_bit(ATH_OP_SCANNING, &common->op_flags);
 }
 
-static void ath9k_channel_switch_beacon(struct ieee80211_hw *hw,
-                                        struct ieee80211_vif *vif,
-                                        struct cfg80211_chan_def *chandef)
-{
-        /* depend on vif->csa_active only */
-        return;
-}
-
 struct ieee80211_ops ath9k_ops = {
         .tx                 = ath9k_tx,
         .start              = ath9k_start,
@@ -2139,5 +2277,4 @@ struct ieee80211_ops ath9k_ops = {
 #endif
         .sw_scan_start      = ath9k_sw_scan_start,
         .sw_scan_complete   = ath9k_sw_scan_complete,
-        .channel_switch_beacon     = ath9k_channel_switch_beacon,
 };
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index 914dbc6b1720..4dec09e565ed 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -686,7 +686,7 @@ static bool ath_pci_eeprom_read(struct ath_common *common, u32 off, u16 *data)
         struct ath_softc *sc = (struct ath_softc *) common->priv;
         struct ath9k_platform_data *pdata = sc->dev->platform_data;
 
-        if (pdata) {
+        if (pdata && !pdata->use_eeprom) {
                 if (off >= (ARRAY_SIZE(pdata->eeprom_data))) {
                         ath_err(common,
                                 "%s: eeprom read failed, offset %08x is out of range\n",
@@ -914,6 +914,7 @@ static int ath_pci_suspend(struct device *device)
          */
         ath9k_stop_btcoex(sc);
         ath9k_hw_disable(sc->sc_ah);
+        del_timer_sync(&sc->sleep_timer);
         ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_FULL_SLEEP);
 
         return 0;
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 19df969ec909..9105a92364f7 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -34,7 +34,8 @@ static inline bool ath9k_check_auto_sleep(struct ath_softc *sc)
  * buffer (or rx fifo). This can incorrectly acknowledge packets
  * to a sender if last desc is self-linked.
  */
-static void ath_rx_buf_link(struct ath_softc *sc, struct ath_rxbuf *bf)
+static void ath_rx_buf_link(struct ath_softc *sc, struct ath_rxbuf *bf,
+                            bool flush)
 {
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
@@ -59,18 +60,19 @@ static void ath_rx_buf_link(struct ath_softc *sc, struct ath_rxbuf *bf)
                              common->rx_bufsize,
                              0);
 
-        if (sc->rx.rxlink == NULL)
-                ath9k_hw_putrxbuf(ah, bf->bf_daddr);
-        else
+        if (sc->rx.rxlink)
                 *sc->rx.rxlink = bf->bf_daddr;
+        else if (!flush)
+                ath9k_hw_putrxbuf(ah, bf->bf_daddr);
 
         sc->rx.rxlink = &ds->ds_link;
 }
 
-static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_rxbuf *bf)
+static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_rxbuf *bf,
+                              bool flush)
 {
         if (sc->rx.buf_hold)
-                ath_rx_buf_link(sc, sc->rx.buf_hold);
+                ath_rx_buf_link(sc, sc->rx.buf_hold, flush);
 
         sc->rx.buf_hold = bf;
 }
@@ -442,7 +444,7 @@ int ath_startrecv(struct ath_softc *sc)
         sc->rx.buf_hold = NULL;
         sc->rx.rxlink = NULL;
         list_for_each_entry_safe(bf, tbf, &sc->rx.rxbuf, list) {
-                ath_rx_buf_link(sc, bf);
+                ath_rx_buf_link(sc, bf, false);
         }
 
         /* We could have deleted elements so the list may be empty now */
@@ -538,7 +540,10 @@ static void ath_rx_ps_beacon(struct ath_softc *sc, struct sk_buff *skb)
                 sc->ps_flags &= ~PS_BEACON_SYNC;
                 ath_dbg(common, PS,
                         "Reconfigure beacon timers based on synchronized timestamp\n");
-                ath9k_set_beacon(sc);
+                if (!(WARN_ON_ONCE(sc->cur_beacon_conf.beacon_interval == 0)))
+                        ath9k_set_beacon(sc);
+                if (sc->p2p_ps_vif)
+                        ath9k_update_p2p_ps(sc, sc->p2p_ps_vif->vif);
         }
 
         if (ath_beacon_dtim_pending_cab(skb)) {
@@ -1115,12 +1120,12 @@ requeue_drop_frag:
 requeue:
                 list_add_tail(&bf->list, &sc->rx.rxbuf);
 
-                if (edma) {
-                        ath_rx_edma_buf_link(sc, qtype);
-                } else {
-                        ath_rx_buf_relink(sc, bf);
+                if (!edma) {
+                        ath_rx_buf_relink(sc, bf, flush);
                         if (!flush)
                                 ath9k_hw_rxena(ah);
+                } else if (!flush) {
+                        ath_rx_edma_buf_link(sc, qtype);
                 }
 
                 if (!budget--)
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index b1fd3fa84983..f1bbce3f7774 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -505,9 +505,6 @@
 #define AR_D_QCUMASK         0x000003FF
 #define AR_D_QCUMASK_RESV0   0xFFFFFC00
 
-#define AR_D_TXBLK_CMD  0x1038
-#define AR_D_TXBLK_DATA(i) (AR_D_TXBLK_CMD+(i))
-
 #define AR_D0_LCL_IFS     0x1040
 #define AR_D1_LCL_IFS     0x1044
 #define AR_D2_LCL_IFS     0x1048
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index 4c8cdb097b65..f8ded84b7be8 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -1707,7 +1707,9 @@ found:
         return 0;
 }
 
-static void carl9170_op_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+static void carl9170_op_flush(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif,
+                              u32 queues, bool drop)
 {
         struct ar9170 *ar = hw->priv;
         unsigned int vid;
diff --git a/drivers/net/wireless/ath/carl9170/usb.c b/drivers/net/wireless/ath/carl9170/usb.c
index ca115f33746f..f35c7f30f9a6 100644
--- a/drivers/net/wireless/ath/carl9170/usb.c
+++ b/drivers/net/wireless/ath/carl9170/usb.c
@@ -1076,8 +1076,14 @@ static int carl9170_usb_probe(struct usb_interface *intf,
 
         carl9170_set_state(ar, CARL9170_STOPPED);
 
-        return request_firmware_nowait(THIS_MODULE, 1, CARL9170FW_NAME,
+        err = request_firmware_nowait(THIS_MODULE, 1, CARL9170FW_NAME,
                 &ar->udev->dev, GFP_KERNEL, ar, carl9170_usb_firmware_step2);
+        if (err) {
+                usb_put_dev(udev);
+                usb_put_dev(udev);
+                carl9170_free(ar);
+        }
+        return err;
 }
 
 static void carl9170_usb_disconnect(struct usb_interface *intf)
diff --git a/drivers/net/wireless/ath/dfs_pattern_detector.c b/drivers/net/wireless/ath/dfs_pattern_detector.c
index a1a69c5db409..650be79c7ac9 100644
--- a/drivers/net/wireless/ath/dfs_pattern_detector.c
+++ b/drivers/net/wireless/ath/dfs_pattern_detector.c
@@ -73,9 +73,52 @@ static const struct radar_types etsi_radar_types_v15 = {
         .radar_types            = etsi_radar_ref_types_v15,
 };
 
-/* for now, we support ETSI radar types, FCC and JP are TODO */
+#define FCC_PATTERN(ID, WMIN, WMAX, PMIN, PMAX, PRF, PPB)       \
+{                                                               \
+        ID, WIDTH_LOWER(WMIN), WIDTH_UPPER(WMAX),               \
+        PMIN - PRI_TOLERANCE,                                   \
+        PMAX * PRF + PRI_TOLERANCE, PRF, PPB * PRF,             \
+        PPB_THRESH(PPB), PRI_TOLERANCE,                         \
+}
+
+static const struct radar_detector_specs fcc_radar_ref_types[] = {
+        FCC_PATTERN(0, 0, 1, 1428, 1428, 1, 18),
+        FCC_PATTERN(1, 0, 5, 150, 230, 1, 23),
+        FCC_PATTERN(2, 6, 10, 200, 500, 1, 16),
+        FCC_PATTERN(3, 11, 20, 200, 500, 1, 12),
+        FCC_PATTERN(4, 50, 100, 1000, 2000, 20, 1),
+        FCC_PATTERN(5, 0, 1, 333, 333, 1, 9),
+};
+
+static const struct radar_types fcc_radar_types = {
+        .region                 = NL80211_DFS_FCC,
+        .num_radar_types        = ARRAY_SIZE(fcc_radar_ref_types),
+        .radar_types            = fcc_radar_ref_types,
+};
+
+#define JP_PATTERN FCC_PATTERN
+static const struct radar_detector_specs jp_radar_ref_types[] = {
+        JP_PATTERN(0, 0, 1, 1428, 1428, 1, 18),
+        JP_PATTERN(1, 2, 3, 3846, 3846, 1, 18),
+        JP_PATTERN(2, 0, 1, 1388, 1388, 1, 18),
+        JP_PATTERN(3, 1, 2, 4000, 4000, 1, 18),
+        JP_PATTERN(4, 0, 5, 150, 230, 1, 23),
+        JP_PATTERN(5, 6, 10, 200, 500, 1, 16),
+        JP_PATTERN(6, 11, 20, 200, 500, 1, 12),
+        JP_PATTERN(7, 50, 100, 1000, 2000, 20, 1),
+        JP_PATTERN(5, 0, 1, 333, 333, 1, 9),
+};
+
+static const struct radar_types jp_radar_types = {
+        .region                 = NL80211_DFS_JP,
+        .num_radar_types        = ARRAY_SIZE(jp_radar_ref_types),
+        .radar_types            = jp_radar_ref_types,
+};
+
 static const struct radar_types *dfs_domains[] = {
         &etsi_radar_types_v15,
+        &fcc_radar_types,
+        &jp_radar_types,
 };
 
 /**
diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
index 7bf0ef8a1f56..63986931829e 100644
--- a/drivers/net/wireless/ath/wcn36xx/smd.c
+++ b/drivers/net/wireless/ath/wcn36xx/smd.c
@@ -2068,7 +2068,7 @@ static void wcn36xx_smd_rsp_process(struct wcn36xx *wcn, void *buf, size_t len)
                 if (!msg_ind)
                         goto nomem;
                 msg_ind->msg_len = len;
-                msg_ind->msg = kmalloc(len, GFP_KERNEL);
+                msg_ind->msg = kmemdup(buf, len, GFP_KERNEL);
                 if (!msg_ind->msg) {
                         kfree(msg_ind);
 nomem:
@@ -2080,7 +2080,6 @@ nomem:
                                     msg_header->msg_type);
                         break;
                 }
-                memcpy(msg_ind->msg, buf, len);
                 mutex_lock(&wcn->hal_ind_mutex);
                 list_add_tail(&msg_ind->list, &wcn->hal_ind_queue);
                 queue_work(wcn->hal_ind_wq, &wcn->hal_ind_work);
diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c
index 4806a49cb61b..820d4ebd9322 100644
--- a/drivers/net/wireless/ath/wil6210/cfg80211.c
+++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
@@ -172,7 +172,7 @@ static int wil_cid_fill_sinfo(struct wil6210_priv *wil, int cid,
 
 static int wil_cfg80211_get_station(struct wiphy *wiphy,
                                     struct net_device *ndev,
-                                    u8 *mac, struct station_info *sinfo)
+                                    const u8 *mac, struct station_info *sinfo)
 {
         struct wil6210_priv *wil = wiphy_to_wil(wiphy);
         int rc;
@@ -288,6 +288,7 @@ static int wil_cfg80211_scan(struct wiphy *wiphy,
         }
 
         wil->scan_request = request;
+        mod_timer(&wil->scan_timer, jiffies + WIL6210_SCAN_TO);
 
         memset(&cmd, 0, sizeof(cmd));
         cmd.cmd.num_channels = 0;
@@ -671,7 +672,7 @@ static int wil_cfg80211_stop_ap(struct wiphy *wiphy,
 }
 
 static int wil_cfg80211_del_station(struct wiphy *wiphy,
-                                    struct net_device *dev, u8 *mac)
+                                    struct net_device *dev, const u8 *mac)
 {
         struct wil6210_priv *wil = wiphy_to_wil(wiphy);
 
diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
index ecdabe4adec3..8d4bc4bfb664 100644
--- a/drivers/net/wireless/ath/wil6210/debugfs.c
+++ b/drivers/net/wireless/ath/wil6210/debugfs.c
@@ -35,7 +35,7 @@ static void wil_print_vring(struct seq_file *s, struct wil6210_priv *wil,
         void __iomem *x = wmi_addr(wil, vring->hwtail);
 
         seq_printf(s, "VRING %s = {\n", name);
-        seq_printf(s, "  pa     = 0x%016llx\n", (unsigned long long)vring->pa);
+        seq_printf(s, "  pa     = %pad\n", &vring->pa);
         seq_printf(s, "  va     = 0x%p\n", vring->va);
         seq_printf(s, "  size   = %d\n", vring->size);
         seq_printf(s, "  swtail = %d\n", vring->swtail);
@@ -473,7 +473,7 @@ static int wil_txdesc_debugfs_show(struct seq_file *s, void *data)
                            u[0], u[1], u[2], u[3]);
                 seq_printf(s, "  DMA = 0x%08x 0x%08x 0x%08x 0x%08x\n",
                            u[4], u[5], u[6], u[7]);
-                seq_printf(s, "  SKB = %p\n", skb);
+                seq_printf(s, "  SKB = 0x%p\n", skb);
 
                 if (skb) {
                         skb_get(skb);
diff --git a/drivers/net/wireless/ath/wil6210/interrupt.c b/drivers/net/wireless/ath/wil6210/interrupt.c
index 5824cd41e4ba..73593aa3cd98 100644
--- a/drivers/net/wireless/ath/wil6210/interrupt.c
+++ b/drivers/net/wireless/ath/wil6210/interrupt.c
@@ -338,7 +338,7 @@ static irqreturn_t wil6210_irq_misc_thread(int irq, void *cookie)
         }
 
         if (isr)
-                wil_err(wil, "un-handled MISC ISR bits 0x%08x\n", isr);
+                wil_dbg_irq(wil, "un-handled MISC ISR bits 0x%08x\n", isr);
 
         wil->isr_misc = 0;
 
diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c
index 95f4efe9ef37..11e6d9d22eae 100644
--- a/drivers/net/wireless/ath/wil6210/main.c
+++ b/drivers/net/wireless/ath/wil6210/main.c
@@ -81,7 +81,7 @@ static void wil_disconnect_cid(struct wil6210_priv *wil, int cid)
         memset(&sta->stats, 0, sizeof(sta->stats));
 }
 
-static void _wil6210_disconnect(struct wil6210_priv *wil, void *bssid)
+static void _wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid)
 {
         int cid = -ENOENT;
         struct net_device *ndev = wil_to_ndev(wil);
@@ -150,6 +150,15 @@ static void wil_connect_timer_fn(ulong x)
         schedule_work(&wil->disconnect_worker);
 }
 
+static void wil_scan_timer_fn(ulong x)
+{
+        struct wil6210_priv *wil = (void *)x;
+
+        clear_bit(wil_status_fwready, &wil->status);
+        wil_err(wil, "Scan timeout detected, start fw error recovery\n");
+        schedule_work(&wil->fw_error_worker);
+}
+
 static void wil_fw_error_worker(struct work_struct *work)
 {
         struct wil6210_priv *wil = container_of(work,
@@ -161,12 +170,30 @@ static void wil_fw_error_worker(struct work_struct *work)
         if (no_fw_recovery)
                 return;
 
+        /* increment @recovery_count if less then WIL6210_FW_RECOVERY_TO
+         * passed since last recovery attempt
+         */
+        if (time_is_after_jiffies(wil->last_fw_recovery +
+                                  WIL6210_FW_RECOVERY_TO))
+                wil->recovery_count++;
+        else
+                wil->recovery_count = 1; /* fw was alive for a long time */
+
+        if (wil->recovery_count > WIL6210_FW_RECOVERY_RETRIES) {
+                wil_err(wil, "too many recovery attempts (%d), giving up\n",
+                        wil->recovery_count);
+                return;
+        }
+
+        wil->last_fw_recovery = jiffies;
+
         mutex_lock(&wil->mutex);
         switch (wdev->iftype) {
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_P2P_CLIENT:
         case NL80211_IFTYPE_MONITOR:
-                wil_info(wil, "fw error recovery started...\n");
+                wil_info(wil, "fw error recovery started (try %d)...\n",
+                         wil->recovery_count);
                 wil_reset(wil);
 
                 /* need to re-allocate Rx ring after reset */
@@ -230,6 +257,7 @@ int wil_priv_init(struct wil6210_priv *wil)
 
         wil->pending_connect_cid = -1;
         setup_timer(&wil->connect_timer, wil_connect_timer_fn, (ulong)wil);
+        setup_timer(&wil->scan_timer, wil_scan_timer_fn, (ulong)wil);
 
         INIT_WORK(&wil->connect_worker, wil_connect_worker);
         INIT_WORK(&wil->disconnect_worker, wil_disconnect_worker);
@@ -249,10 +277,12 @@ int wil_priv_init(struct wil6210_priv *wil)
                 return -EAGAIN;
         }
 
+        wil->last_fw_recovery = jiffies;
+
         return 0;
 }
 
-void wil6210_disconnect(struct wil6210_priv *wil, void *bssid)
+void wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid)
 {
         del_timer_sync(&wil->connect_timer);
         _wil6210_disconnect(wil, bssid);
@@ -260,6 +290,7 @@ void wil6210_disconnect(struct wil6210_priv *wil, void *bssid)
 
 void wil_priv_deinit(struct wil6210_priv *wil)
 {
+        del_timer_sync(&wil->scan_timer);
         cancel_work_sync(&wil->disconnect_worker);
         cancel_work_sync(&wil->fw_error_worker);
         mutex_lock(&wil->mutex);
@@ -363,8 +394,8 @@ static int wil_wait_for_fw_ready(struct wil6210_priv *wil)
                 wil_err(wil, "Firmware not ready\n");
                 return -ETIME;
         } else {
-                wil_dbg_misc(wil, "FW ready after %d ms\n",
-                             jiffies_to_msecs(to-left));
+                wil_info(wil, "FW ready after %d ms. HW version 0x%08x\n",
+                         jiffies_to_msecs(to-left), wil->hw_version);
         }
         return 0;
 }
@@ -391,6 +422,7 @@ int wil_reset(struct wil6210_priv *wil)
         if (wil->scan_request) {
                 wil_dbg_misc(wil, "Abort scan_request 0x%p\n",
                              wil->scan_request);
+                del_timer_sync(&wil->scan_timer);
                 cfg80211_scan_done(wil->scan_request, true);
                 wil->scan_request = NULL;
         }
@@ -520,6 +552,7 @@ static int __wil_down(struct wil6210_priv *wil)
         napi_disable(&wil->napi_tx);
 
         if (wil->scan_request) {
+                del_timer_sync(&wil->scan_timer);
                 cfg80211_scan_done(wil->scan_request, true);
                 wil->scan_request = NULL;
         }
diff --git a/drivers/net/wireless/ath/wil6210/netdev.c b/drivers/net/wireless/ath/wil6210/netdev.c
index fdcaeb820e75..106b6dcb773a 100644
--- a/drivers/net/wireless/ath/wil6210/netdev.c
+++ b/drivers/net/wireless/ath/wil6210/netdev.c
@@ -32,12 +32,26 @@ static int wil_stop(struct net_device *ndev)
         return wil_down(wil);
 }
 
+static int wil_change_mtu(struct net_device *ndev, int new_mtu)
+{
+        struct wil6210_priv *wil = ndev_to_wil(ndev);
+
+        if (new_mtu < 68 || new_mtu > IEEE80211_MAX_DATA_LEN_DMG)
+                return -EINVAL;
+
+        wil_dbg_misc(wil, "change MTU %d -> %d\n", ndev->mtu, new_mtu);
+        ndev->mtu = new_mtu;
+
+        return 0;
+}
+
 static const struct net_device_ops wil_netdev_ops = {
         .ndo_open               = wil_open,
         .ndo_stop               = wil_stop,
         .ndo_start_xmit         = wil_start_xmit,
         .ndo_set_mac_address    = eth_mac_addr,
         .ndo_validate_addr      = eth_validate_addr,
+        .ndo_change_mtu         = wil_change_mtu,
 };
 
 static int wil6210_netdev_poll_rx(struct napi_struct *napi, int budget)
diff --git a/drivers/net/wireless/ath/wil6210/pcie_bus.c b/drivers/net/wireless/ath/wil6210/pcie_bus.c
index f1e1bb338d68..1e2e07b9d13d 100644
--- a/drivers/net/wireless/ath/wil6210/pcie_bus.c
+++ b/drivers/net/wireless/ath/wil6210/pcie_bus.c
@@ -74,8 +74,6 @@ static int wil_if_pcie_enable(struct wil6210_priv *wil)
         if (rc)
                 goto release_irq;
 
-        wil_info(wil, "HW version: 0x%08x\n", wil->hw_version);
-
         return 0;
 
  release_irq:
@@ -140,7 +138,7 @@ static int wil_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
                 goto err_release_reg;
         }
         /* rollback to err_iounmap */
-        dev_info(&pdev->dev, "CSR at %pR -> %p\n", &pdev->resource[0], csr);
+        dev_info(&pdev->dev, "CSR at %pR -> 0x%p\n", &pdev->resource[0], csr);
 
         wil = wil_if_alloc(dev, csr);
         if (IS_ERR(wil)) {
diff --git a/drivers/net/wireless/ath/wil6210/rx_reorder.c b/drivers/net/wireless/ath/wil6210/rx_reorder.c
index d04629fe053f..747ae1275877 100644
--- a/drivers/net/wireless/ath/wil6210/rx_reorder.c
+++ b/drivers/net/wireless/ath/wil6210/rx_reorder.c
@@ -49,10 +49,17 @@ static void wil_release_reorder_frames(struct wil6210_priv *wil,
 {
         int index;
 
-        while (seq_less(r->head_seq_num, hseq)) {
+        /* note: this function is never called with
+         * hseq preceding r->head_seq_num, i.e it is always true
+         * !seq_less(hseq, r->head_seq_num)
+         * and thus on loop exit it should be
+         * r->head_seq_num == hseq
+         */
+        while (seq_less(r->head_seq_num, hseq) && r->stored_mpdu_num) {
                 index = reorder_index(r, r->head_seq_num);
                 wil_release_reorder_frame(wil, r, index);
         }
+        r->head_seq_num = hseq;
 }
 
 static void wil_reorder_release(struct wil6210_priv *wil,
@@ -91,6 +98,22 @@ void wil_rx_reorder(struct wil6210_priv *wil, struct sk_buff *skb)
 
         spin_lock(&r->reorder_lock);
 
+        /** Due to the race between WMI events, where BACK establishment
+         * reported, and data Rx, few packets may be pass up before reorder
+         * buffer get allocated. Catch up by pretending SSN is what we
+         * see in the 1-st Rx packet
+         */
+        if (r->first_time) {
+                r->first_time = false;
+                if (seq != r->head_seq_num) {
+                        wil_err(wil, "Error: 1-st frame with wrong sequence"
+                                " %d, should be %d. Fixing...\n", seq,
+                                r->head_seq_num);
+                        r->head_seq_num = seq;
+                        r->ssn = seq;
+                }
+        }
+
         /* frame with out of date sequence number */
         if (seq_less(seq, r->head_seq_num)) {
                 dev_kfree_skb(skb);
@@ -162,6 +185,7 @@ struct wil_tid_ampdu_rx *wil_tid_ampdu_rx_alloc(struct wil6210_priv *wil,
         r->head_seq_num = ssn;
         r->buf_size = size;
         r->stored_mpdu_num = 0;
+        r->first_time = true;
         return r;
 }
 
diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
index c8c547457eb4..0784ef3d4ce2 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.c
+++ b/drivers/net/wireless/ath/wil6210/txrx.c
@@ -64,6 +64,22 @@ static inline int wil_vring_avail_tx(struct vring *vring)
         return vring->size - used - 1;
 }
 
+/**
+ * wil_vring_wmark_low - low watermark for available descriptor space
+ */
+static inline int wil_vring_wmark_low(struct vring *vring)
+{
+        return vring->size/8;
+}
+
+/**
+ * wil_vring_wmark_high - high watermark for available descriptor space
+ */
+static inline int wil_vring_wmark_high(struct vring *vring)
+{
+        return vring->size/4;
+}
+
 static int wil_vring_alloc(struct wil6210_priv *wil, struct vring *vring)
 {
         struct device *dev = wil_to_dev(wil);
@@ -98,8 +114,8 @@ static int wil_vring_alloc(struct wil6210_priv *wil, struct vring *vring)
                 _d->dma.status = TX_DMA_STATUS_DU;
         }
 
-        wil_dbg_misc(wil, "vring[%d] 0x%p:0x%016llx 0x%p\n", vring->size,
-                     vring->va, (unsigned long long)vring->pa, vring->ctx);
+        wil_dbg_misc(wil, "vring[%d] 0x%p:%pad 0x%p\n", vring->size,
+                     vring->va, &vring->pa, vring->ctx);
 
         return 0;
 }
@@ -880,8 +896,8 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
         pa = dma_map_single(dev, skb->data,
                         skb_headlen(skb), DMA_TO_DEVICE);
 
-        wil_dbg_txrx(wil, "Tx skb %d bytes %p -> %#08llx\n", skb_headlen(skb),
-                     skb->data, (unsigned long long)pa);
+        wil_dbg_txrx(wil, "Tx skb %d bytes 0x%p -> %pad\n", skb_headlen(skb),
+                     skb->data, &pa);
         wil_hex_dump_txrx("Tx ", DUMP_PREFIX_OFFSET, 16, 1,
                           skb->data, skb_headlen(skb), false);
 
@@ -1007,7 +1023,7 @@ netdev_tx_t wil_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         rc = wil_tx_vring(wil, vring, skb);
 
         /* do we still have enough room in the vring? */
-        if (wil_vring_avail_tx(vring) < vring->size/8)
+        if (wil_vring_avail_tx(vring) < wil_vring_wmark_low(vring))
                 netif_tx_stop_all_queues(wil_to_ndev(wil));
 
         switch (rc) {
@@ -1116,7 +1132,7 @@ int wil_tx_complete(struct wil6210_priv *wil, int ringid)
                         done++;
                 }
         }
-        if (wil_vring_avail_tx(vring) > vring->size/4)
+        if (wil_vring_avail_tx(vring) > wil_vring_wmark_high(vring))
                 netif_tx_wake_all_queues(wil_to_ndev(wil));
 
         return done;
diff --git a/drivers/net/wireless/ath/wil6210/wil6210.h b/drivers/net/wireless/ath/wil6210/wil6210.h
index 2a2dec75f026..e25edc52398f 100644
--- a/drivers/net/wireless/ath/wil6210/wil6210.h
+++ b/drivers/net/wireless/ath/wil6210/wil6210.h
@@ -35,11 +35,14 @@ static inline u32 WIL_GET_BITS(u32 x, int b0, int b1)
 #define WIL6210_MEM_SIZE (2*1024*1024UL)
 
 #define WIL6210_RX_RING_SIZE    (128)
-#define WIL6210_TX_RING_SIZE    (128)
+#define WIL6210_TX_RING_SIZE    (512)
 #define WIL6210_MAX_TX_RINGS    (24) /* HW limit */
 #define WIL6210_MAX_CID         (8) /* HW limit */
 #define WIL6210_NAPI_BUDGET     (16) /* arbitrary */
 #define WIL6210_ITR_TRSH        (10000) /* arbitrary - about 15 IRQs/msec */
+#define WIL6210_FW_RECOVERY_RETRIES     (5) /* try to recover this many times */
+#define WIL6210_FW_RECOVERY_TO  msecs_to_jiffies(5000)
+#define WIL6210_SCAN_TO         msecs_to_jiffies(10000)
 
 /* Hardware definitions begin */
 
@@ -301,6 +304,7 @@ struct wil_tid_ampdu_rx {
         u16 buf_size;
         u16 timeout;
         u8 dialog_token;
+        bool first_time; /* is it 1-st time this buffer used? */
 };
 
 struct wil6210_stats {
@@ -360,6 +364,8 @@ struct wil6210_priv {
         u32 fw_version;
         u32 hw_version;
         u8 n_mids; /* number of additional MIDs as reported by FW */
+        int recovery_count; /* num of FW recovery attempts in a short time */
+        unsigned long last_fw_recovery; /* jiffies of last fw recovery */
         /* profile */
         u32 monitor_flags;
         u32 secure_pcp; /* create secure PCP? */
@@ -381,6 +387,7 @@ struct wil6210_priv {
         struct work_struct disconnect_worker;
         struct work_struct fw_error_worker;     /* for FW error recovery */
         struct timer_list connect_timer;
+        struct timer_list scan_timer; /* detect scan timeout */
         int pending_connect_cid;
         struct list_head pending_wmi_ev;
         /*
@@ -507,7 +514,7 @@ void wil_wdev_free(struct wil6210_priv *wil);
 int wmi_set_mac_address(struct wil6210_priv *wil, void *addr);
 int wmi_pcp_start(struct wil6210_priv *wil, int bi, u8 wmi_nettype, u8 chan);
 int wmi_pcp_stop(struct wil6210_priv *wil);
-void wil6210_disconnect(struct wil6210_priv *wil, void *bssid);
+void wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid);
 
 int wil_rx_init(struct wil6210_priv *wil);
 void wil_rx_fini(struct wil6210_priv *wil);
diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
index 2ba56eef0c45..6cc0e182cc70 100644
--- a/drivers/net/wireless/ath/wil6210/wmi.c
+++ b/drivers/net/wireless/ath/wil6210/wmi.c
@@ -192,7 +192,7 @@ static int __wmi_send(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len)
         might_sleep();
 
         if (!test_bit(wil_status_fwready, &wil->status)) {
-                wil_err(wil, "FW not ready\n");
+                wil_err(wil, "WMI: cannot send command while FW not ready\n");
                 return -EAGAIN;
         }
 
@@ -276,8 +276,8 @@ static void wmi_evt_ready(struct wil6210_priv *wil, int id, void *d, int len)
         wil->fw_version = le32_to_cpu(evt->sw_version);
         wil->n_mids = evt->numof_additional_mids;
 
-        wil_dbg_wmi(wil, "FW ver. %d; MAC %pM; %d MID's\n", wil->fw_version,
-                    evt->mac, wil->n_mids);
+        wil_info(wil, "FW ver. %d; MAC %pM; %d MID's\n", wil->fw_version,
+                 evt->mac, wil->n_mids);
 
         if (!is_valid_ether_addr(ndev->dev_addr)) {
                 memcpy(ndev->dev_addr, evt->mac, ETH_ALEN);
@@ -290,7 +290,7 @@ static void wmi_evt_ready(struct wil6210_priv *wil, int id, void *d, int len)
 static void wmi_evt_fw_ready(struct wil6210_priv *wil, int id, void *d,
                              int len)
 {
-        wil_dbg_wmi(wil, "WMI: FW ready\n");
+        wil_dbg_wmi(wil, "WMI: got FW ready event\n");
 
         set_bit(wil_status_fwready, &wil->status);
         /* reuse wmi_ready for the firmware ready indication */
@@ -348,9 +348,10 @@ static void wmi_evt_scan_complete(struct wil6210_priv *wil, int id,
 {
         if (wil->scan_request) {
                 struct wmi_scan_complete_event *data = d;
-                bool aborted = (data->status != 0);
+                bool aborted = (data->status != WMI_SCAN_SUCCESS);
 
                 wil_dbg_wmi(wil, "SCAN_COMPLETE(0x%08x)\n", data->status);
+                del_timer_sync(&wil->scan_timer);
                 cfg80211_scan_done(wil->scan_request, aborted);
                 wil->scan_request = NULL;
         } else {
@@ -658,21 +659,27 @@ void wmi_recv_cmd(struct wil6210_priv *wil)
         u8 *cmd;
         void __iomem *src;
         ulong flags;
+        unsigned n;
 
         if (!test_bit(wil_status_reset_done, &wil->status)) {
                 wil_err(wil, "Reset not completed\n");
                 return;
         }
 
-        for (;;) {
+        for (n = 0;; n++) {
                 u16 len;
 
                 r->head = ioread32(wil->csr + HOST_MBOX +
                                    offsetof(struct wil6210_mbox_ctl, rx.head));
-                if (r->tail == r->head)
+                if (r->tail == r->head) {
+                        if (n == 0)
+                                wil_dbg_wmi(wil, "No events?\n");
                         return;
+                }
 
-                /* read cmd from tail */
+                wil_dbg_wmi(wil, "Mbox head %08x tail %08x\n",
+                            r->head, r->tail);
+                /* read cmd descriptor from tail */
                 wil_memcpy_fromio_32(&d_tail, wil->csr + HOSTADDR(r->tail),
                                      sizeof(struct wil6210_mbox_ring_desc));
                 if (d_tail.sync == 0) {
@@ -680,13 +687,18 @@ void wmi_recv_cmd(struct wil6210_priv *wil)
                         return;
                 }
 
+                /* read cmd header from descriptor */
                 if (0 != wmi_read_hdr(wil, d_tail.addr, &hdr)) {
                         wil_err(wil, "Mbox evt at 0x%08x?\n",
                                 le32_to_cpu(d_tail.addr));
                         return;
                 }
-
                 len = le16_to_cpu(hdr.len);
+                wil_dbg_wmi(wil, "Mbox evt %04x %04x %04x %02x\n",
+                            le16_to_cpu(hdr.seq), len, le16_to_cpu(hdr.type),
+                            hdr.flags);
+
+                /* read cmd buffer from descriptor */
                 src = wmi_buffer(wil, d_tail.addr) +
                       sizeof(struct wil6210_mbox_hdr);
                 evt = kmalloc(ALIGN(offsetof(struct pending_wmi_event,
@@ -702,9 +714,6 @@ void wmi_recv_cmd(struct wil6210_priv *wil)
                 iowrite32(0, wil->csr + HOSTADDR(r->tail) +
                           offsetof(struct wil6210_mbox_ring_desc, sync));
                 /* indicate */
-                wil_dbg_wmi(wil, "Mbox evt %04x %04x %04x %02x\n",
-                            le16_to_cpu(hdr.seq), len, le16_to_cpu(hdr.type),
-                            hdr.flags);
                 if ((hdr.type == WIL_MBOX_HDR_TYPE_WMI) &&
                     (len >= sizeof(struct wil6210_mbox_hdr_wmi))) {
                         struct wil6210_mbox_hdr_wmi *wmi = &evt->event.wmi;
@@ -734,6 +743,8 @@ void wmi_recv_cmd(struct wil6210_priv *wil)
                         wil_dbg_wmi(wil, "queue_work -> %d\n", q);
                 }
         }
+        if (n > 1)
+                wil_dbg_wmi(wil, "%s -> %d events processed\n", __func__, n);
 }
 
 int wmi_call(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len,
@@ -802,6 +813,7 @@ int wmi_pcp_start(struct wil6210_priv *wil, int bi, u8 wmi_nettype, u8 chan)
                 .network_type = wmi_nettype,
                 .disable_sec_offload = 1,
                 .channel = chan - 1,
+                .pcp_max_assoc_sta = WIL6210_MAX_CID,
         };
         struct {
                 struct wil6210_mbox_hdr_wmi wmi;
diff --git a/drivers/net/wireless/ath/wil6210/wmi.h b/drivers/net/wireless/ath/wil6210/wmi.h
index 50b8528394f4..17334c852866 100644
--- a/drivers/net/wireless/ath/wil6210/wmi.h
+++ b/drivers/net/wireless/ath/wil6210/wmi.h
@@ -28,7 +28,7 @@
 #define __WILOCITY_WMI_H__
 
 /* General */
-
+#define WILOCITY_MAX_ASSOC_STA (8)
 #define WMI_MAC_LEN             (6)
 #define WMI_PROX_RANGE_NUM      (3)
 
@@ -219,15 +219,6 @@ struct wmi_disconnect_sta_cmd {
         __le16 disconnect_reason;
 } __packed;
 
-/*
- * WMI_RECONNECT_CMDID
- */
-struct wmi_reconnect_cmd {
-        u8 channel;                     /* hint */
-        u8 reserved;
-        u8 bssid[WMI_MAC_LEN];          /* mandatory if set */
-} __packed;
-
 
 /*
  * WMI_SET_PMK_CMDID
@@ -296,11 +287,13 @@ enum wmi_scan_type {
         WMI_LONG_SCAN           = 0,
         WMI_SHORT_SCAN          = 1,
         WMI_PBC_SCAN            = 2,
+        WMI_ACTIVE_SCAN         = 3,
+        WMI_DIRECT_SCAN         = 4,
 };
 
 struct wmi_start_scan_cmd {
-        u8 reserved[8];
-
+        u8 direct_scan_mac_addr[6];
+        u8 reserved[2];
         __le32 home_dwell_time; /* Max duration in the home channel(ms) */
         __le32 force_scan_interval;     /* Time interval between scans (ms)*/
         u8 scan_type;           /* wmi_scan_type */
@@ -332,6 +325,7 @@ struct wmi_probed_ssid_cmd {
         u8 ssid[WMI_MAX_SSID_LEN];
 } __packed;
 
+
 /*
  * WMI_SET_APPIE_CMDID
  * Add Application specified IE to a management frame
@@ -427,7 +421,7 @@ struct wmi_bcon_ctrl_cmd {
         __le16 frag_num;
         __le64 ss_mask;
         u8 network_type;
-        u8 reserved;
+        u8 pcp_max_assoc_sta;
         u8 disable_sec_offload;
         u8 disable_sec;
 } __packed;
@@ -450,7 +444,7 @@ enum wmi_port_role {
 struct wmi_port_allocate_cmd {
         u8 mac[WMI_MAC_LEN];
         u8 port_role;
-        u8 midid;
+        u8 mid;
 } __packed;
 
 /*
@@ -467,6 +461,7 @@ struct wmi_delete_port_cmd {
 enum wmi_discovery_mode {
         WMI_DISCOVERY_MODE_NON_OFFLOAD  = 0,
         WMI_DISCOVERY_MODE_OFFLOAD      = 1,
+        WMI_DISCOVERY_MODE_PEER2PEER    = 2,
 };
 
 struct wmi_p2p_cfg_cmd {
@@ -493,7 +488,8 @@ struct wmi_power_mgmt_cfg_cmd {
  */
 struct wmi_pcp_start_cmd {
         __le16 bcon_interval;
-        u8 reserved0[10];
+        u8 pcp_max_assoc_sta;
+        u8 reserved0[9];
         u8 network_type;
         u8 channel;
         u8 disable_sec_offload;
@@ -857,6 +853,7 @@ enum wmi_event_id {
         WMI_RF_MGMT_STATUS_EVENTID              = 0x1853,
         WMI_BF_SM_MGMT_DONE_EVENTID             = 0x1838,
         WMI_RX_MGMT_PACKET_EVENTID              = 0x1840,
+        WMI_TX_MGMT_PACKET_EVENTID              = 0x1841,
 
         /* Performance monitoring events */
         WMI_DATA_PORT_OPEN_EVENTID              = 0x1860,
@@ -1040,16 +1037,23 @@ enum wmi_disconnect_reason {
 struct wmi_disconnect_event {
         __le16 protocol_reason_status;  /* reason code, see 802.11 spec. */
         u8 bssid[WMI_MAC_LEN];          /* set if known */
-        u8 disconnect_reason;           /* see wmi_disconnect_reason_e */
-        u8 assoc_resp_len;
-        u8 assoc_info[0];
+        u8 disconnect_reason;           /* see wmi_disconnect_reason */
+        u8 assoc_resp_len;              /* not in use */
+        u8 assoc_info[0];               /* not in use */
 } __packed;
 
 /*
  * WMI_SCAN_COMPLETE_EVENTID
  */
+enum scan_status {
+        WMI_SCAN_SUCCESS        = 0,
+        WMI_SCAN_FAILED         = 1,
+        WMI_SCAN_ABORTED        = 2,
+        WMI_SCAN_REJECTED       = 3,
+};
+
 struct wmi_scan_complete_event {
-        __le32 status;
+        __le32 status;  /* scan_status */
 } __packed;
 
 /*
@@ -1256,6 +1260,14 @@ struct wmi_rx_mgmt_info {
         u8 channel;     /* From Radio MNGR */
 } __packed;
 
+
+/*
+ * WMI_TX_MGMT_PACKET_EVENTID
+ */
+struct wmi_tx_mgmt_packet_event {
+        u8 payload[0];
+} __packed;
+
 struct wmi_rx_mgmt_packet_event {
         struct wmi_rx_mgmt_info info;
         u8 payload[0];
diff --git a/drivers/net/wireless/b43/Kconfig b/drivers/net/wireless/b43/Kconfig
index 088d544ec63f..e3f67b8d3f80 100644
--- a/drivers/net/wireless/b43/Kconfig
+++ b/drivers/net/wireless/b43/Kconfig
@@ -1,7 +1,8 @@
 config B43
         tristate "Broadcom 43xx wireless support (mac80211 stack)"
-        depends on SSB_POSSIBLE && MAC80211 && HAS_DMA
-        select SSB
+        depends on (BCMA_POSSIBLE || SSB_POSSIBLE) && MAC80211 && HAS_DMA
+        select BCMA if B43_BCMA
+        select SSB if B43_SSB
         select FW_LOADER
         ---help---
           b43 is a driver for the Broadcom 43xx series wireless devices.
@@ -27,14 +28,33 @@ config B43
           If unsure, say M.
 
 config B43_BCMA
-        bool "Support for BCMA bus"
-        depends on B43 && (BCMA = y || BCMA = B43)
-        default y
+        bool
 
 config B43_SSB
         bool
-        depends on B43 && (SSB = y || SSB = B43)
-        default y
+
+choice
+        prompt "Supported bus types"
+        depends on B43
+        default B43_BCMA_AND_SSB
+
+config B43_BUSES_BCMA_AND_SSB
+        bool "BCMA and SSB"
+        depends on BCMA_POSSIBLE && SSB_POSSIBLE
+        select B43_BCMA
+        select B43_SSB
+
+config B43_BUSES_BCMA
+        bool "BCMA only"
+        depends on BCMA_POSSIBLE
+        select B43_BCMA
+
+config B43_BUSES_SSB
+        bool "SSB only"
+        depends on SSB_POSSIBLE
+        select B43_SSB
+
+endchoice
 
 # Auto-select SSB PCI-HOST support, if possible
 config B43_PCI_AUTOSELECT
@@ -53,7 +73,7 @@ config B43_PCICORE_AUTOSELECT
 
 config B43_PCMCIA
         bool "Broadcom 43xx PCMCIA device support"
-        depends on B43 && SSB_PCMCIAHOST_POSSIBLE
+        depends on B43 && B43_SSB && SSB_PCMCIAHOST_POSSIBLE
         select SSB_PCMCIAHOST
         ---help---
           Broadcom 43xx PCMCIA device support.
@@ -73,7 +93,7 @@ config B43_PCMCIA
 
 config B43_SDIO
         bool "Broadcom 43xx SDIO device support"
-        depends on B43 && SSB_SDIOHOST_POSSIBLE
+        depends on B43 && B43_SSB && SSB_SDIOHOST_POSSIBLE
         select SSB_SDIOHOST
         ---help---
           Broadcom 43xx device support for Soft-MAC SDIO devices.
@@ -98,7 +118,7 @@ config B43_BCMA_PIO
 
 config B43_PIO
         bool
-        depends on B43
+        depends on B43 && B43_SSB
         select SSB_BLOCKIO
         default y
 
@@ -116,7 +136,7 @@ config B43_PHY_N
 
 config B43_PHY_LP
         bool "Support for low-power (LP-PHY) devices"
-        depends on B43
+        depends on B43 && B43_SSB
         default y
         ---help---
           Support for the LP-PHY.
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index 54376fddfaf9..4113b6934764 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -915,10 +915,6 @@ struct b43_wl {
         char rng_name[30 + 1];
 #endif /* CONFIG_B43_HWRNG */
 
-        /* List of all wireless devices on this chip */
-        struct list_head devlist;
-        u8 nr_devs;
-
         bool radiotap_enabled;
         bool radio_enabled;
 
diff --git a/drivers/net/wireless/b43/bus.h b/drivers/net/wireless/b43/bus.h
index 184c95659279..f3205c6988bc 100644
--- a/drivers/net/wireless/b43/bus.h
+++ b/drivers/net/wireless/b43/bus.h
@@ -5,7 +5,9 @@ enum b43_bus_type {
 #ifdef CONFIG_B43_BCMA
         B43_BUS_BCMA,
 #endif
+#ifdef CONFIG_B43_SSB
         B43_BUS_SSB,
+#endif
 };
 
 struct b43_bus_dev {
@@ -52,13 +54,21 @@ struct b43_bus_dev {
 
 static inline bool b43_bus_host_is_pcmcia(struct b43_bus_dev *dev)
 {
+#ifdef CONFIG_B43_SSB
         return (dev->bus_type == B43_BUS_SSB &&
                 dev->sdev->bus->bustype == SSB_BUSTYPE_PCMCIA);
+#else
+        return false;
+#endif
 }
 static inline bool b43_bus_host_is_sdio(struct b43_bus_dev *dev)
 {
+#ifdef CONFIG_B43_SSB
         return (dev->bus_type == B43_BUS_SSB &&
                 dev->sdev->bus->bustype == SSB_BUSTYPE_SDIO);
+#else
+        return false;
+#endif
 }
 
 struct b43_bus_dev *b43_bus_dev_bcma_init(struct bcma_device *core);
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 69fc3d65531a..32538ac5f7e4 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -182,7 +182,7 @@ static struct ieee80211_rate __b43_ratetable[] = {
 #define b43_g_ratetable         (__b43_ratetable + 0)
 #define b43_g_ratetable_size    12
 
-#define CHAN4G(_channel, _freq, _flags) {                       \
+#define CHAN2G(_channel, _freq, _flags) {                       \
         .band                   = IEEE80211_BAND_2GHZ,          \
         .center_freq            = (_freq),                      \
         .hw_value               = (_channel),                   \
@@ -191,23 +191,31 @@ static struct ieee80211_rate __b43_ratetable[] = {
         .max_power              = 30,                           \
 }
 static struct ieee80211_channel b43_2ghz_chantable[] = {
-        CHAN4G(1, 2412, 0),
-        CHAN4G(2, 2417, 0),
-        CHAN4G(3, 2422, 0),
-        CHAN4G(4, 2427, 0),
-        CHAN4G(5, 2432, 0),
-        CHAN4G(6, 2437, 0),
-        CHAN4G(7, 2442, 0),
-        CHAN4G(8, 2447, 0),
-        CHAN4G(9, 2452, 0),
-        CHAN4G(10, 2457, 0),
-        CHAN4G(11, 2462, 0),
-        CHAN4G(12, 2467, 0),
-        CHAN4G(13, 2472, 0),
-        CHAN4G(14, 2484, 0),
+        CHAN2G(1, 2412, 0),
+        CHAN2G(2, 2417, 0),
+        CHAN2G(3, 2422, 0),
+        CHAN2G(4, 2427, 0),
+        CHAN2G(5, 2432, 0),
+        CHAN2G(6, 2437, 0),
+        CHAN2G(7, 2442, 0),
+        CHAN2G(8, 2447, 0),
+        CHAN2G(9, 2452, 0),
+        CHAN2G(10, 2457, 0),
+        CHAN2G(11, 2462, 0),
+        CHAN2G(12, 2467, 0),
+        CHAN2G(13, 2472, 0),
+        CHAN2G(14, 2484, 0),
 };
-#undef CHAN4G
+#undef CHAN2G
 
+#define CHAN4G(_channel, _flags) {                              \
+        .band                   = IEEE80211_BAND_5GHZ,          \
+        .center_freq            = 4000 + (5 * (_channel)),      \
+        .hw_value               = (_channel),                   \
+        .flags                  = (_flags),                     \
+        .max_antenna_gain       = 0,                            \
+        .max_power              = 30,                           \
+}
 #define CHAN5G(_channel, _flags) {                              \
         .band                   = IEEE80211_BAND_5GHZ,          \
         .center_freq            = 5000 + (5 * (_channel)),      \
@@ -217,6 +225,18 @@ static struct ieee80211_channel b43_2ghz_chantable[] = {
         .max_power              = 30,                           \
 }
 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
+        CHAN4G(184, 0),         CHAN4G(186, 0),
+        CHAN4G(188, 0),         CHAN4G(190, 0),
+        CHAN4G(192, 0),         CHAN4G(194, 0),
+        CHAN4G(196, 0),         CHAN4G(198, 0),
+        CHAN4G(200, 0),         CHAN4G(202, 0),
+        CHAN4G(204, 0),         CHAN4G(206, 0),
+        CHAN4G(208, 0),         CHAN4G(210, 0),
+        CHAN4G(212, 0),         CHAN4G(214, 0),
+        CHAN4G(216, 0),         CHAN4G(218, 0),
+        CHAN4G(220, 0),         CHAN4G(222, 0),
+        CHAN4G(224, 0),         CHAN4G(226, 0),
+        CHAN4G(228, 0),
         CHAN5G(32, 0),          CHAN5G(34, 0),
         CHAN5G(36, 0),          CHAN5G(38, 0),
         CHAN5G(40, 0),          CHAN5G(42, 0),
@@ -260,18 +280,7 @@ static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
         CHAN5G(170, 0),         CHAN5G(172, 0),
         CHAN5G(174, 0),         CHAN5G(176, 0),
         CHAN5G(178, 0),         CHAN5G(180, 0),
-        CHAN5G(182, 0),         CHAN5G(184, 0),
-        CHAN5G(186, 0),         CHAN5G(188, 0),
-        CHAN5G(190, 0),         CHAN5G(192, 0),
-        CHAN5G(194, 0),         CHAN5G(196, 0),
-        CHAN5G(198, 0),         CHAN5G(200, 0),
-        CHAN5G(202, 0),         CHAN5G(204, 0),
-        CHAN5G(206, 0),         CHAN5G(208, 0),
-        CHAN5G(210, 0),         CHAN5G(212, 0),
-        CHAN5G(214, 0),         CHAN5G(216, 0),
-        CHAN5G(218, 0),         CHAN5G(220, 0),
-        CHAN5G(222, 0),         CHAN5G(224, 0),
-        CHAN5G(226, 0),         CHAN5G(228, 0),
+        CHAN5G(182, 0),
 };
 
 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
@@ -295,6 +304,7 @@ static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
         CHAN5G(208, 0),         CHAN5G(212, 0),
         CHAN5G(216, 0),
 };
+#undef CHAN4G
 #undef CHAN5G
 
 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
@@ -1175,18 +1185,7 @@ static void b43_bcma_phy_reset(struct b43_wldev *dev)
         bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, flags);
         udelay(2);
 
-        /* Take PHY out of reset */
-        flags = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
-        flags &= ~B43_BCMA_IOCTL_PHY_RESET;
-        flags |= BCMA_IOCTL_FGC;
-        bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, flags);
-        udelay(1);
-
-        /* Do not force clock anymore */
-        flags = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
-        flags &= ~BCMA_IOCTL_FGC;
-        bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, flags);
-        udelay(1);
+        b43_phy_take_out_of_reset(dev);
 }
 
 static void b43_bcma_wireless_core_reset(struct b43_wldev *dev, bool gmode)
@@ -1195,18 +1194,22 @@ static void b43_bcma_wireless_core_reset(struct b43_wldev *dev, bool gmode)
                   B43_BCMA_CLKCTLST_PHY_PLL_REQ;
         u32 status = B43_BCMA_CLKCTLST_80211_PLL_ST |
                      B43_BCMA_CLKCTLST_PHY_PLL_ST;
+        u32 flags;
+
+        flags = B43_BCMA_IOCTL_PHY_CLKEN;
+        if (gmode)
+                flags |= B43_BCMA_IOCTL_GMODE;
+        b43_device_enable(dev, flags);
 
-        b43_device_enable(dev, B43_BCMA_IOCTL_PHY_CLKEN);
         bcma_core_set_clockmode(dev->dev->bdev, BCMA_CLKMODE_FAST);
         b43_bcma_phy_reset(dev);
         bcma_core_pll_ctl(dev->dev->bdev, req, status, true);
 }
 #endif
 
+#ifdef CONFIG_B43_SSB
 static void b43_ssb_wireless_core_reset(struct b43_wldev *dev, bool gmode)
 {
-        struct ssb_device *sdev = dev->dev->sdev;
-        u32 tmslow;
         u32 flags = 0;
 
         if (gmode)
@@ -1218,18 +1221,9 @@ static void b43_ssb_wireless_core_reset(struct b43_wldev *dev, bool gmode)
         b43_device_enable(dev, flags);
         msleep(2);              /* Wait for the PLL to turn on. */
 
-        /* Now take the PHY out of Reset again */
-        tmslow = ssb_read32(sdev, SSB_TMSLOW);
-        tmslow |= SSB_TMSLOW_FGC;
-        tmslow &= ~B43_TMSLOW_PHYRESET;
-        ssb_write32(sdev, SSB_TMSLOW, tmslow);
-        ssb_read32(sdev, SSB_TMSLOW);   /* flush */
-        msleep(1);
-        tmslow &= ~SSB_TMSLOW_FGC;
-        ssb_write32(sdev, SSB_TMSLOW, tmslow);
-        ssb_read32(sdev, SSB_TMSLOW);   /* flush */
-        msleep(1);
+        b43_phy_take_out_of_reset(dev);
 }
+#endif
 
 void b43_wireless_core_reset(struct b43_wldev *dev, bool gmode)
 {
@@ -2704,32 +2698,37 @@ static int b43_upload_initvals(struct b43_wldev *dev)
         struct b43_firmware *fw = &dev->fw;
         const struct b43_iv *ivals;
         size_t count;
-        int err;
 
         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
         count = be32_to_cpu(hdr->size);
-        err = b43_write_initvals(dev, ivals, count,
+        return b43_write_initvals(dev, ivals, count,
                                  fw->initvals.data->size - hdr_len);
-        if (err)
-                goto out;
-        if (fw->initvals_band.data) {
-                hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
-                ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
-                count = be32_to_cpu(hdr->size);
-                err = b43_write_initvals(dev, ivals, count,
-                                         fw->initvals_band.data->size - hdr_len);
-                if (err)
-                        goto out;
-        }
-out:
+}
 
-        return err;
+static int b43_upload_initvals_band(struct b43_wldev *dev)
+{
+        const size_t hdr_len = sizeof(struct b43_fw_header);
+        const struct b43_fw_header *hdr;
+        struct b43_firmware *fw = &dev->fw;
+        const struct b43_iv *ivals;
+        size_t count;
+
+        if (!fw->initvals_band.data)
+                return 0;
+
+        hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
+        ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
+        count = be32_to_cpu(hdr->size);
+        return b43_write_initvals(dev, ivals, count,
+                                  fw->initvals_band.data->size - hdr_len);
 }
 
 /* Initialize the GPIOs
  * http://bcm-specs.sipsolutions.net/GPIO
  */
+
+#ifdef CONFIG_B43_SSB
 static struct ssb_device *b43_ssb_gpio_dev(struct b43_wldev *dev)
 {
         struct ssb_bus *bus = dev->dev->sdev->bus;
@@ -2740,10 +2739,13 @@ static struct ssb_device *b43_ssb_gpio_dev(struct b43_wldev *dev)
         return bus->chipco.dev;
 #endif
 }
+#endif
 
 static int b43_gpio_init(struct b43_wldev *dev)
 {
+#ifdef CONFIG_B43_SSB
         struct ssb_device *gpiodev;
+#endif
         u32 mask, set;
 
         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_GPOUTSMSK, 0);
@@ -2802,7 +2804,9 @@ static int b43_gpio_init(struct b43_wldev *dev)
 /* Turn off all GPIO stuff. Call this on module unload, for example. */
 static void b43_gpio_cleanup(struct b43_wldev *dev)
 {
+#ifdef CONFIG_B43_SSB
         struct ssb_device *gpiodev;
+#endif
 
         switch (dev->dev->bus_type) {
 #ifdef CONFIG_B43_BCMA
@@ -3086,6 +3090,10 @@ static int b43_chip_init(struct b43_wldev *dev)
         if (err)
                 goto err_gpio_clean;
 
+        err = b43_upload_initvals_band(dev);
+        if (err)
+                goto err_gpio_clean;
+
         /* Turn the Analog on and initialize the PHY. */
         phy->ops->switch_analog(dev, 1);
         err = b43_phy_init(dev);
@@ -3685,37 +3693,6 @@ static void b43_op_set_tsf(struct ieee80211_hw *hw,
         mutex_unlock(&wl->mutex);
 }
 
-static void b43_put_phy_into_reset(struct b43_wldev *dev)
-{
-        u32 tmp;
-
-        switch (dev->dev->bus_type) {
-#ifdef CONFIG_B43_BCMA
-        case B43_BUS_BCMA:
-                b43err(dev->wl,
-                       "Putting PHY into reset not supported on BCMA\n");
-                break;
-#endif
-#ifdef CONFIG_B43_SSB
-        case B43_BUS_SSB:
-                tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
-                tmp &= ~B43_TMSLOW_GMODE;
-                tmp |= B43_TMSLOW_PHYRESET;
-                tmp |= SSB_TMSLOW_FGC;
-                ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
-                msleep(1);
-
-                tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
-                tmp &= ~SSB_TMSLOW_FGC;
-                tmp |= B43_TMSLOW_PHYRESET;
-                ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
-                msleep(1);
-
-                break;
-#endif
-        }
-}
-
 static const char *band_to_string(enum ieee80211_band band)
 {
         switch (band) {
@@ -3731,94 +3708,75 @@ static const char *band_to_string(enum ieee80211_band band)
 }
 
 /* Expects wl->mutex locked */
-static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
+static int b43_switch_band(struct b43_wldev *dev,
+                           struct ieee80211_channel *chan)
 {
-        struct b43_wldev *up_dev = NULL;
-        struct b43_wldev *down_dev;
-        struct b43_wldev *d;
-        int err;
-        bool uninitialized_var(gmode);
-        int prev_status;
+        struct b43_phy *phy = &dev->phy;
+        bool gmode;
+        u32 tmp;
 
-        /* Find a device and PHY which supports the band. */
-        list_for_each_entry(d, &wl->devlist, list) {
-                switch (chan->band) {
-                case IEEE80211_BAND_5GHZ:
-                        if (d->phy.supports_5ghz) {
-                                up_dev = d;
-                                gmode = false;
-                        }
-                        break;
-                case IEEE80211_BAND_2GHZ:
-                        if (d->phy.supports_2ghz) {
-                                up_dev = d;
-                                gmode = true;
-                        }
-                        break;
-                default:
-                        B43_WARN_ON(1);
-                        return -EINVAL;
-                }
-                if (up_dev)
-                        break;
+        switch (chan->band) {
+        case IEEE80211_BAND_5GHZ:
+                gmode = false;
+                break;
+        case IEEE80211_BAND_2GHZ:
+                gmode = true;
+                break;
+        default:
+                B43_WARN_ON(1);
+                return -EINVAL;
         }
-        if (!up_dev) {
-                b43err(wl, "Could not find a device for %s-GHz band operation\n",
+
+        if (!((gmode && phy->supports_2ghz) ||
+              (!gmode && phy->supports_5ghz))) {
+                b43err(dev->wl, "This device doesn't support %s-GHz band\n",
                        band_to_string(chan->band));
                 return -ENODEV;
         }
-        if ((up_dev == wl->current_dev) &&
-            (!!wl->current_dev->phy.gmode == !!gmode)) {
+
+        if (!!phy->gmode == !!gmode) {
                 /* This device is already running. */
                 return 0;
         }
-        b43dbg(wl, "Switching to %s-GHz band\n",
+
+        b43dbg(dev->wl, "Switching to %s GHz band\n",
                band_to_string(chan->band));
-        down_dev = wl->current_dev;
 
-        prev_status = b43_status(down_dev);
-        /* Shutdown the currently running core. */
-        if (prev_status >= B43_STAT_STARTED)
-                down_dev = b43_wireless_core_stop(down_dev);
-        if (prev_status >= B43_STAT_INITIALIZED)
-                b43_wireless_core_exit(down_dev);
+        /* Some new devices don't need disabling radio for band switching */
+        if (!(phy->type == B43_PHYTYPE_N && phy->rev >= 3))
+                b43_software_rfkill(dev, true);
 
-        if (down_dev != up_dev) {
-                /* We switch to a different core, so we put PHY into
-                 * RESET on the old core. */
-                b43_put_phy_into_reset(down_dev);
+        phy->gmode = gmode;
+        b43_phy_put_into_reset(dev);
+        switch (dev->dev->bus_type) {
+#ifdef CONFIG_B43_BCMA
+        case B43_BUS_BCMA:
+                tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
+                if (gmode)
+                        tmp |= B43_BCMA_IOCTL_GMODE;
+                else
+                        tmp &= ~B43_BCMA_IOCTL_GMODE;
+                bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
+                break;
+#endif
+#ifdef CONFIG_B43_SSB
+        case B43_BUS_SSB:
+                tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
+                if (gmode)
+                        tmp |= B43_TMSLOW_GMODE;
+                else
+                        tmp &= ~B43_TMSLOW_GMODE;
+                ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
+                break;
+#endif
         }
+        b43_phy_take_out_of_reset(dev);
 
-        /* Now start the new core. */
-        up_dev->phy.gmode = gmode;
-        if (prev_status >= B43_STAT_INITIALIZED) {
-                err = b43_wireless_core_init(up_dev);
-                if (err) {
-                        b43err(wl, "Fatal: Could not initialize device for "
-                               "selected %s-GHz band\n",
-                               band_to_string(chan->band));
-                        goto init_failure;
-                }
-        }
-        if (prev_status >= B43_STAT_STARTED) {
-                err = b43_wireless_core_start(up_dev);
-                if (err) {
-                        b43err(wl, "Fatal: Could not start device for "
-                               "selected %s-GHz band\n",
-                               band_to_string(chan->band));
-                        b43_wireless_core_exit(up_dev);
-                        goto init_failure;
-                }
-        }
-        B43_WARN_ON(b43_status(up_dev) != prev_status);
+        b43_upload_initvals_band(dev);
 
-        wl->current_dev = up_dev;
+        b43_phy_init(dev);
 
         return 0;
-init_failure:
-        /* Whoops, failed to init the new core. No core is operating now. */
-        wl->current_dev = NULL;
-        return err;
 }
 
 /* Write the short and long frame retry limit values. */
@@ -3851,8 +3809,10 @@ static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
 
         dev = wl->current_dev;
 
+        b43_mac_suspend(dev);
+
         /* Switch the band (if necessary). This might change the active core. */
-        err = b43_switch_band(wl, conf->chandef.chan);
+        err = b43_switch_band(dev, conf->chandef.chan);
         if (err)
                 goto out_unlock_mutex;
 
@@ -3871,8 +3831,6 @@ static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
         else
                 phy->is_40mhz = false;
 
-        b43_mac_suspend(dev);
-
         if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
                 b43_set_retry_limits(dev, conf->short_frame_max_tx_count,
                                           conf->long_frame_max_tx_count);
@@ -4582,8 +4540,12 @@ static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
         struct ssb_bus *bus;
         u32 tmp;
 
+#ifdef CONFIG_B43_SSB
         if (dev->dev->bus_type != B43_BUS_SSB)
                 return;
+#else
+        return;
+#endif
 
         bus = dev->dev->sdev->bus;
 
@@ -4738,7 +4700,7 @@ static int b43_wireless_core_init(struct b43_wldev *dev)
         }
         if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
                 hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
-#ifdef CONFIG_SSB_DRIVER_PCICORE
+#if defined(CONFIG_B43_SSB) && defined(CONFIG_SSB_DRIVER_PCICORE)
         if (dev->dev->bus_type == B43_BUS_SSB &&
             dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI &&
             dev->dev->sdev->bus->pcicore.dev->id.revision <= 10)
@@ -5129,10 +5091,82 @@ static void b43_wireless_core_detach(struct b43_wldev *dev)
         b43_phy_free(dev);
 }
 
+static void b43_supported_bands(struct b43_wldev *dev, bool *have_2ghz_phy,
+                                bool *have_5ghz_phy)
+{
+        u16 dev_id = 0;
+
+#ifdef CONFIG_B43_BCMA
+        if (dev->dev->bus_type == B43_BUS_BCMA &&
+            dev->dev->bdev->bus->hosttype == BCMA_HOSTTYPE_PCI)
+                dev_id = dev->dev->bdev->bus->host_pci->device;
+#endif
+#ifdef CONFIG_B43_SSB
+        if (dev->dev->bus_type == B43_BUS_SSB &&
+            dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI)
+                dev_id = dev->dev->sdev->bus->host_pci->device;
+#endif
+        /* Override with SPROM value if available */
+        if (dev->dev->bus_sprom->dev_id)
+                dev_id = dev->dev->bus_sprom->dev_id;
+
+        /* Note: below IDs can be "virtual" (not maching e.g. real PCI ID) */
+        switch (dev_id) {
+        case 0x4324: /* BCM4306 */
+        case 0x4312: /* BCM4311 */
+        case 0x4319: /* BCM4318 */
+        case 0x4328: /* BCM4321 */
+        case 0x432b: /* BCM4322 */
+        case 0x4350: /* BCM43222 */
+        case 0x4353: /* BCM43224 */
+        case 0x0576: /* BCM43224 */
+        case 0x435f: /* BCM6362 */
+        case 0x4331: /* BCM4331 */
+        case 0x4359: /* BCM43228 */
+        case 0x43a0: /* BCM4360 */
+        case 0x43b1: /* BCM4352 */
+                /* Dual band devices */
+                *have_2ghz_phy = true;
+                *have_5ghz_phy = true;
+                return;
+        case 0x4321: /* BCM4306 */
+        case 0x4313: /* BCM4311 */
+        case 0x431a: /* BCM4318 */
+        case 0x432a: /* BCM4321 */
+        case 0x432d: /* BCM4322 */
+        case 0x4352: /* BCM43222 */
+        case 0x4333: /* BCM4331 */
+        case 0x43a2: /* BCM4360 */
+        case 0x43b3: /* BCM4352 */
+                /* 5 GHz only devices */
+                *have_2ghz_phy = false;
+                *have_5ghz_phy = true;
+                return;
+        }
+
+        /* As a fallback, try to guess using PHY type */
+        switch (dev->phy.type) {
+        case B43_PHYTYPE_A:
+                *have_2ghz_phy = false;
+                *have_5ghz_phy = true;
+                return;
+        case B43_PHYTYPE_G:
+        case B43_PHYTYPE_N:
+        case B43_PHYTYPE_LP:
+        case B43_PHYTYPE_HT:
+        case B43_PHYTYPE_LCN:
+                *have_2ghz_phy = true;
+                *have_5ghz_phy = false;
+                return;
+        }
+
+        B43_WARN_ON(1);
+}
+
 static int b43_wireless_core_attach(struct b43_wldev *dev)
 {
         struct b43_wl *wl = dev->wl;
-        struct pci_dev *pdev = NULL;
+        struct b43_phy *phy = &dev->phy;
         int err;
         u32 tmp;
         bool have_2ghz_phy = false, have_5ghz_phy = false;
@@ -5144,19 +5178,15 @@ static int b43_wireless_core_attach(struct b43_wldev *dev)
          * that in core_init(), too.
          */
 
-#ifdef CONFIG_B43_SSB
-        if (dev->dev->bus_type == B43_BUS_SSB &&
-            dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI)
-                pdev = dev->dev->sdev->bus->host_pci;
-#endif
-
         err = b43_bus_powerup(dev, 0);
         if (err) {
                 b43err(wl, "Bus powerup failed\n");
                 goto out;
         }
 
-        /* Get the PHY type. */
+        phy->do_full_init = true;
+
+        /* Try to guess supported bands for the first init needs */
         switch (dev->dev->bus_type) {
 #ifdef CONFIG_B43_BCMA
         case B43_BUS_BCMA:
@@ -5178,51 +5208,31 @@ static int b43_wireless_core_attach(struct b43_wldev *dev)
         }
 
         dev->phy.gmode = have_2ghz_phy;
-        dev->phy.radio_on = true;
         b43_wireless_core_reset(dev, dev->phy.gmode);
 
+        /* Get the PHY type. */
         err = b43_phy_versioning(dev);
         if (err)
                 goto err_powerdown;
-        /* Check if this device supports multiband. */
-        if (!pdev ||
-            (pdev->device != 0x4312 &&
-             pdev->device != 0x4319 && pdev->device != 0x4324)) {
-                /* No multiband support. */
-                have_2ghz_phy = false;
+
+        /* Get real info about supported bands */
+        b43_supported_bands(dev, &have_2ghz_phy, &have_5ghz_phy);
+
+        /* We don't support 5 GHz on some PHYs yet */
+        switch (dev->phy.type) {
+        case B43_PHYTYPE_A:
+        case B43_PHYTYPE_N:
+        case B43_PHYTYPE_LP:
+        case B43_PHYTYPE_HT:
+                b43warn(wl, "5 GHz band is unsupported on this PHY\n");
                 have_5ghz_phy = false;
-                switch (dev->phy.type) {
-                case B43_PHYTYPE_A:
-                        have_5ghz_phy = true;
-                        break;
-                case B43_PHYTYPE_LP: //FIXME not always!
-#if 0 //FIXME enabling 5GHz causes a NULL pointer dereference
-                        have_5ghz_phy = 1;
-#endif
-                case B43_PHYTYPE_G:
-                case B43_PHYTYPE_N:
-                case B43_PHYTYPE_HT:
-                case B43_PHYTYPE_LCN:
-                        have_2ghz_phy = true;
-                        break;
-                default:
-                        B43_WARN_ON(1);
-                }
         }
-        if (dev->phy.type == B43_PHYTYPE_A) {
-                /* FIXME */
-                b43err(wl, "IEEE 802.11a devices are unsupported\n");
+
+        if (!have_2ghz_phy && !have_5ghz_phy) {
+                b43err(wl, "b43 can't support any band on this device\n");
                 err = -EOPNOTSUPP;
                 goto err_powerdown;
         }
-        if (1 /* disable A-PHY */) {
-                /* FIXME: For now we disable the A-PHY on multi-PHY devices. */
-                if (dev->phy.type != B43_PHYTYPE_N &&
-                    dev->phy.type != B43_PHYTYPE_LP) {
-                        have_2ghz_phy = true;
-                        have_5ghz_phy = false;
-                }
-        }
 
         err = b43_phy_allocate(dev);
         if (err)
@@ -5270,7 +5280,6 @@ static void b43_one_core_detach(struct b43_bus_dev *dev)
         b43_debugfs_remove_device(wldev);
         b43_wireless_core_detach(wldev);
         list_del(&wldev->list);
-        wl->nr_devs--;
         b43_bus_set_wldev(dev, NULL);
         kfree(wldev);
 }
@@ -5295,8 +5304,6 @@ static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl)
         if (err)
                 goto err_kfree_wldev;
 
-        list_add(&wldev->list, &wl->devlist);
-        wl->nr_devs++;
         b43_bus_set_wldev(dev, wldev);
         b43_debugfs_add_device(wldev);
 
@@ -5314,6 +5321,7 @@ static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl)
         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
         (pdev->subsystem_device == _subdevice)                          )
 
+#ifdef CONFIG_B43_SSB
 static void b43_sprom_fixup(struct ssb_bus *bus)
 {
         struct pci_dev *pdev;
@@ -5345,6 +5353,7 @@ static void b43_wireless_exit(struct b43_bus_dev *dev, struct b43_wl *wl)
         ssb_set_devtypedata(dev->sdev, NULL);
         ieee80211_free_hw(hw);
 }
+#endif
 
 static struct b43_wl *b43_wireless_init(struct b43_bus_dev *dev)
 {
@@ -5386,7 +5395,6 @@ static struct b43_wl *b43_wireless_init(struct b43_bus_dev *dev)
         wl->hw = hw;
         mutex_init(&wl->mutex);
         spin_lock_init(&wl->hardirq_lock);
-        INIT_LIST_HEAD(&wl->devlist);
         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
         INIT_WORK(&wl->tx_work, b43_tx_work);
@@ -5486,39 +5494,42 @@ int b43_ssb_probe(struct ssb_device *sdev, const struct ssb_device_id *id)
         struct b43_bus_dev *dev;
         struct b43_wl *wl;
         int err;
-        int first = 0;
 
         dev = b43_bus_dev_ssb_init(sdev);
         if (!dev)
                 return -ENOMEM;
 
         wl = ssb_get_devtypedata(sdev);
-        if (!wl) {
-                /* Probing the first core. Must setup common struct b43_wl */
-                first = 1;
-                b43_sprom_fixup(sdev->bus);
-                wl = b43_wireless_init(dev);
-                if (IS_ERR(wl)) {
-                        err = PTR_ERR(wl);
-                        goto out;
-                }
-                ssb_set_devtypedata(sdev, wl);
-                B43_WARN_ON(ssb_get_devtypedata(sdev) != wl);
+        if (wl) {
+                b43err(NULL, "Dual-core devices are not supported\n");
+                err = -ENOTSUPP;
+                goto err_ssb_kfree_dev;
+        }
+
+        b43_sprom_fixup(sdev->bus);
+
+        wl = b43_wireless_init(dev);
+        if (IS_ERR(wl)) {
+                err = PTR_ERR(wl);
+                goto err_ssb_kfree_dev;
         }
+        ssb_set_devtypedata(sdev, wl);
+        B43_WARN_ON(ssb_get_devtypedata(sdev) != wl);
+
         err = b43_one_core_attach(dev, wl);
         if (err)
-                goto err_wireless_exit;
+                goto err_ssb_wireless_exit;
 
         /* setup and start work to load firmware */
         INIT_WORK(&wl->firmware_load, b43_request_firmware);
         schedule_work(&wl->firmware_load);
 
-      out:
         return err;
 
-      err_wireless_exit:
-        if (first)
-                b43_wireless_exit(dev, wl);
+err_ssb_wireless_exit:
+        b43_wireless_exit(dev, wl);
+err_ssb_kfree_dev:
+        kfree(dev);
         return err;
 }
 
@@ -5546,13 +5557,8 @@ static void b43_ssb_remove(struct ssb_device *sdev)
         /* Unregister HW RNG driver */
         b43_rng_exit(wl);
 
-        if (list_empty(&wl->devlist)) {
-                b43_leds_unregister(wl);
-                /* Last core on the chip unregistered.
-                 * We can destroy common struct b43_wl.
-                 */
-                b43_wireless_exit(dev, wl);
-        }
+        b43_leds_unregister(wl);
+        b43_wireless_exit(dev, wl);
 }
 
 static struct ssb_driver b43_ssb_driver = {
diff --git a/drivers/net/wireless/b43/phy_common.c b/drivers/net/wireless/b43/phy_common.c
index dbaa51890198..08244b3b327e 100644
--- a/drivers/net/wireless/b43/phy_common.c
+++ b/drivers/net/wireless/b43/phy_common.c
@@ -96,12 +96,16 @@ int b43_phy_init(struct b43_wldev *dev)
 
         phy->channel = ops->get_default_chan(dev);
 
-        ops->software_rfkill(dev, false);
+        phy->ops->switch_analog(dev, true);
+        b43_software_rfkill(dev, false);
+
         err = ops->init(dev);
         if (err) {
                 b43err(dev->wl, "PHY init failed\n");
                 goto err_block_rf;
         }
+        phy->do_full_init = false;
+
         /* Make sure to switch hardware and firmware (SHM) to
          * the default channel. */
         err = b43_switch_channel(dev, ops->get_default_chan(dev));
@@ -113,10 +117,11 @@ int b43_phy_init(struct b43_wldev *dev)
         return 0;
 
 err_phy_exit:
+        phy->do_full_init = true;
         if (ops->exit)
                 ops->exit(dev);
 err_block_rf:
-        ops->software_rfkill(dev, true);
+        b43_software_rfkill(dev, true);
 
         return err;
 }
@@ -125,7 +130,8 @@ void b43_phy_exit(struct b43_wldev *dev)
 {
         const struct b43_phy_operations *ops = dev->phy.ops;
 
-        ops->software_rfkill(dev, true);
+        b43_software_rfkill(dev, true);
+        dev->phy.do_full_init = true;
         if (ops->exit)
                 ops->exit(dev);
 }
@@ -312,6 +318,90 @@ void b43_phy_maskset(struct b43_wldev *dev, u16 offset, u16 mask, u16 set)
         }
 }
 
+void b43_phy_put_into_reset(struct b43_wldev *dev)
+{
+        u32 tmp;
+
+        switch (dev->dev->bus_type) {
+#ifdef CONFIG_B43_BCMA
+        case B43_BUS_BCMA:
+                tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
+                tmp &= ~B43_BCMA_IOCTL_GMODE;
+                tmp |= B43_BCMA_IOCTL_PHY_RESET;
+                tmp |= BCMA_IOCTL_FGC;
+                bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
+                udelay(1);
+
+                tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
+                tmp &= ~BCMA_IOCTL_FGC;
+                bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
+                udelay(1);
+                break;
+#endif
+#ifdef CONFIG_B43_SSB
+        case B43_BUS_SSB:
+                tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
+                tmp &= ~B43_TMSLOW_GMODE;
+                tmp |= B43_TMSLOW_PHYRESET;
+                tmp |= SSB_TMSLOW_FGC;
+                ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
+                usleep_range(1000, 2000);
+
+                tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
+                tmp &= ~SSB_TMSLOW_FGC;
+                ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
+                usleep_range(1000, 2000);
+
+                break;
+#endif
+        }
+}
+
+void b43_phy_take_out_of_reset(struct b43_wldev *dev)
+{
+        u32 tmp;
+
+        switch (dev->dev->bus_type) {
+#ifdef CONFIG_B43_BCMA
+        case B43_BUS_BCMA:
+                /* Unset reset bit (with forcing clock) */
+                tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
+                tmp &= ~B43_BCMA_IOCTL_PHY_RESET;
+                tmp &= ~B43_BCMA_IOCTL_PHY_CLKEN;
+                tmp |= BCMA_IOCTL_FGC;
+                bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
+                udelay(1);
+
+                /* Do not force clock anymore */
+                tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
+                tmp &= ~BCMA_IOCTL_FGC;
+                tmp |= B43_BCMA_IOCTL_PHY_CLKEN;
+                bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
+                udelay(1);
+                break;
+#endif
+#ifdef CONFIG_B43_SSB
+        case B43_BUS_SSB:
+                /* Unset reset bit (with forcing clock) */
+                tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
+                tmp &= ~B43_TMSLOW_PHYRESET;
+                tmp &= ~B43_TMSLOW_PHYCLKEN;
+                tmp |= SSB_TMSLOW_FGC;
+                ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
+                ssb_read32(dev->dev->sdev, SSB_TMSLOW); /* flush */
+                usleep_range(1000, 2000);
+
+                tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
+                tmp &= ~SSB_TMSLOW_FGC;
+                tmp |= B43_TMSLOW_PHYCLKEN;
+                ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
+                ssb_read32(dev->dev->sdev, SSB_TMSLOW); /* flush */
+                usleep_range(1000, 2000);
+                break;
+#endif
+        }
+}
+
 int b43_switch_channel(struct b43_wldev *dev, unsigned int new_channel)
 {
         struct b43_phy *phy = &(dev->phy);
diff --git a/drivers/net/wireless/b43/phy_common.h b/drivers/net/wireless/b43/phy_common.h
index f1b999349876..4ad6240d9ff4 100644
--- a/drivers/net/wireless/b43/phy_common.h
+++ b/drivers/net/wireless/b43/phy_common.h
@@ -231,9 +231,12 @@ struct b43_phy {
         /* HT info */
         bool is_40mhz;
 
-        /* GMODE bit enabled? */
+        /* Is GMODE (2 GHz mode) bit enabled? */
         bool gmode;
 
+        /* After power reset full init has to be performed */
+        bool do_full_init;
+
         /* Analog Type */
         u8 analog;
         /* B43_PHYTYPE_ */
@@ -390,6 +393,9 @@ void b43_phy_lock(struct b43_wldev *dev);
  */
 void b43_phy_unlock(struct b43_wldev *dev);
 
+void b43_phy_put_into_reset(struct b43_wldev *dev);
+void b43_phy_take_out_of_reset(struct b43_wldev *dev);
+
 /**
  * b43_switch_channel - Switch to another channel
  */
diff --git a/drivers/net/wireless/b43/phy_g.c b/drivers/net/wireless/b43/phy_g.c
index 12f467b8d564..8f5c14bc10e6 100644
--- a/drivers/net/wireless/b43/phy_g.c
+++ b/drivers/net/wireless/b43/phy_g.c
@@ -1587,6 +1587,7 @@ static void b43_phy_initb5(struct b43_wldev *dev)
         b43_write16(dev, 0x03E4, (b43_read16(dev, 0x03E4) & 0xFFC0) | 0x0004);
 }
 
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/Init/B6 */
 static void b43_phy_initb6(struct b43_wldev *dev)
 {
         struct b43_phy *phy = &dev->phy;
@@ -1670,7 +1671,7 @@ static void b43_phy_initb6(struct b43_wldev *dev)
                 b43_radio_write16(dev, 0x50, 0x20);
         }
         if (phy->radio_rev <= 2) {
-                b43_radio_write16(dev, 0x7C, 0x20);
+                b43_radio_write16(dev, 0x50, 0x20);
                 b43_radio_write16(dev, 0x5A, 0x70);
                 b43_radio_write16(dev, 0x5B, 0x7B);
                 b43_radio_write16(dev, 0x5C, 0xB0);
@@ -1686,9 +1687,8 @@ static void b43_phy_initb6(struct b43_wldev *dev)
                 b43_phy_write(dev, 0x2A, 0x8AC0);
         b43_phy_write(dev, 0x0038, 0x0668);
         b43_set_txpower_g(dev, &gphy->bbatt, &gphy->rfatt, gphy->tx_control);
-        if (phy->radio_rev <= 5) {
+        if (phy->radio_rev == 4 || phy->radio_rev == 5)
                 b43_phy_maskset(dev, 0x5D, 0xFF80, 0x0003);
-        }
         if (phy->radio_rev <= 2)
                 b43_radio_write16(dev, 0x005D, 0x000D);
 
diff --git a/drivers/net/wireless/b43/phy_n.c b/drivers/net/wireless/b43/phy_n.c
index 24ccbe96e0c8..86569f6a8705 100644
--- a/drivers/net/wireless/b43/phy_n.c
+++ b/drivers/net/wireless/b43/phy_n.c
@@ -257,6 +257,72 @@ static void b43_nphy_rf_ctl_override(struct b43_wldev *dev, u16 field,
         }
 }
 
+static void b43_nphy_rf_ctl_intc_override_rev7(struct b43_wldev *dev,
+                                               enum n_intc_override intc_override,
+                                               u16 value, u8 core_sel)
+{
+        u16 reg, tmp, tmp2, val;
+        int core;
+
+        for (core = 0; core < 2; core++) {
+                if ((core_sel == 1 && core != 0) ||
+                    (core_sel == 2 && core != 1))
+                        continue;
+
+                reg = (core == 0) ? B43_NPHY_RFCTL_INTC1 : B43_NPHY_RFCTL_INTC2;
+
+                switch (intc_override) {
+                case N_INTC_OVERRIDE_OFF:
+                        b43_phy_write(dev, reg, 0);
+                        b43_nphy_force_rf_sequence(dev, B43_RFSEQ_RESET2RX);
+                        break;
+                case N_INTC_OVERRIDE_TRSW:
+                        b43_phy_maskset(dev, reg, ~0xC0, value << 6);
+                        b43_phy_set(dev, reg, 0x400);
+
+                        b43_phy_mask(dev, 0x2ff, ~0xC000 & 0xFFFF);
+                        b43_phy_set(dev, 0x2ff, 0x2000);
+                        b43_phy_set(dev, 0x2ff, 0x0001);
+                        break;
+                case N_INTC_OVERRIDE_PA:
+                        tmp = 0x0030;
+                        if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
+                                val = value << 5;
+                        else
+                                val = value << 4;
+                        b43_phy_maskset(dev, reg, ~tmp, val);
+                        b43_phy_set(dev, reg, 0x1000);
+                        break;
+                case N_INTC_OVERRIDE_EXT_LNA_PU:
+                        if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ) {
+                                tmp = 0x0001;
+                                tmp2 = 0x0004;
+                                val = value;
+                        } else {
+                                tmp = 0x0004;
+                                tmp2 = 0x0001;
+                                val = value << 2;
+                        }
+                        b43_phy_maskset(dev, reg, ~tmp, val);
+                        b43_phy_mask(dev, reg, ~tmp2);
+                        break;
+                case N_INTC_OVERRIDE_EXT_LNA_GAIN:
+                        if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ) {
+                                tmp = 0x0002;
+                                tmp2 = 0x0008;
+                                val = value << 1;
+                        } else {
+                                tmp = 0x0008;
+                                tmp2 = 0x0002;
+                                val = value << 3;
+                        }
+                        b43_phy_maskset(dev, reg, ~tmp, val);
+                        b43_phy_mask(dev, reg, ~tmp2);
+                        break;
+                }
+        }
+}
+
 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/RFCtrlIntcOverride */
 static void b43_nphy_rf_ctl_intc_override(struct b43_wldev *dev,
                                           enum n_intc_override intc_override,
@@ -265,6 +331,12 @@ static void b43_nphy_rf_ctl_intc_override(struct b43_wldev *dev,
         u8 i, j;
         u16 reg, tmp, val;
 
+        if (dev->phy.rev >= 7) {
+                b43_nphy_rf_ctl_intc_override_rev7(dev, intc_override, value,
+                                                   core);
+                return;
+        }
+
         B43_WARN_ON(dev->phy.rev < 3);
 
         for (i = 0; i < 2; i++) {
@@ -419,7 +491,8 @@ static void b43_nphy_stay_in_carrier_search(struct b43_wldev *dev, bool enable)
                 static const u16 clip[] = { 0xFFFF, 0xFFFF };
                 if (nphy->deaf_count++ == 0) {
                         nphy->classifier_state = b43_nphy_classifier(dev, 0, 0);
-                        b43_nphy_classifier(dev, 0x7, 0);
+                        b43_nphy_classifier(dev, 0x7,
+                                            B43_NPHY_CLASSCTL_WAITEDEN);
                         b43_nphy_read_clip_detection(dev, nphy->clip_state);
                         b43_nphy_write_clip_detection(dev, clip);
                 }
@@ -627,13 +700,11 @@ static void b43_radio_2057_init_post(struct b43_wldev *dev)
         b43_radio_mask(dev, R2057_RFPLL_MISC_CAL_RESETN, ~0x78);
         b43_radio_mask(dev, R2057_XTAL_CONFIG2, ~0x80);
 
-        if (dev->phy.n->init_por) {
+        if (dev->phy.do_full_init) {
                 b43_radio_2057_rcal(dev);
                 b43_radio_2057_rccal(dev);
         }
         b43_radio_mask(dev, R2057_RFPLL_MASTER, ~0x8);
-
-        dev->phy.n->init_por = false;
 }
 
 /* http://bcm-v4.sipsolutions.net/802.11/Radio/2057/Init */
@@ -734,9 +805,16 @@ static void b43_radio_2056_setup(struct b43_wldev *dev,
         u16 bias, cbias;
         u16 pag_boost, padg_boost, pgag_boost, mixg_boost;
         u16 paa_boost, pada_boost, pgaa_boost, mixa_boost;
+        bool is_pkg_fab_smic;
 
         B43_WARN_ON(dev->phy.rev < 3);
 
+        is_pkg_fab_smic =
+                ((dev->dev->chip_id == BCMA_CHIP_ID_BCM43224 ||
+                  dev->dev->chip_id == BCMA_CHIP_ID_BCM43225 ||
+                  dev->dev->chip_id == BCMA_CHIP_ID_BCM43421) &&
+                 dev->dev->chip_pkg == BCMA_PKG_ID_BCM43224_FAB_SMIC);
+
         b43_chantab_radio_2056_upload(dev, e);
         b2056_upload_syn_pll_cp2(dev, band == IEEE80211_BAND_5GHZ);
 
@@ -744,7 +822,8 @@ static void b43_radio_2056_setup(struct b43_wldev *dev,
             b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
                 b43_radio_write(dev, B2056_SYN_PLL_LOOPFILTER1, 0x1F);
                 b43_radio_write(dev, B2056_SYN_PLL_LOOPFILTER2, 0x1F);
-                if (dev->dev->chip_id == 0x4716) {
+                if (dev->dev->chip_id == BCMA_CHIP_ID_BCM4716 ||
+                    dev->dev->chip_id == BCMA_CHIP_ID_BCM47162) {
                         b43_radio_write(dev, B2056_SYN_PLL_LOOPFILTER4, 0x14);
                         b43_radio_write(dev, B2056_SYN_PLL_CP2, 0);
                 } else {
@@ -752,6 +831,13 @@ static void b43_radio_2056_setup(struct b43_wldev *dev,
                         b43_radio_write(dev, B2056_SYN_PLL_CP2, 0x14);
                 }
         }
+        if (sprom->boardflags2_hi & B43_BFH2_GPLL_WAR2 &&
+            b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
+                b43_radio_write(dev, B2056_SYN_PLL_LOOPFILTER1, 0x1f);
+                b43_radio_write(dev, B2056_SYN_PLL_LOOPFILTER2, 0x1f);
+                b43_radio_write(dev, B2056_SYN_PLL_LOOPFILTER4, 0x0b);
+                b43_radio_write(dev, B2056_SYN_PLL_CP2, 0x20);
+        }
         if (sprom->boardflags2_lo & B43_BFL2_APLL_WAR &&
             b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ) {
                 b43_radio_write(dev, B2056_SYN_PLL_LOOPFILTER1, 0x1F);
@@ -767,7 +853,8 @@ static void b43_radio_2056_setup(struct b43_wldev *dev,
                                 b43_radio_write(dev,
                                         offset | B2056_TX_PADG_IDAC, 0xcc);
 
-                                if (dev->dev->chip_id == 0x4716) {
+                                if (dev->dev->chip_id == BCMA_CHIP_ID_BCM4716 ||
+                                    dev->dev->chip_id == BCMA_CHIP_ID_BCM47162) {
                                         bias = 0x40;
                                         cbias = 0x45;
                                         pag_boost = 0x5;
@@ -776,6 +863,10 @@ static void b43_radio_2056_setup(struct b43_wldev *dev,
                                 } else {
                                         bias = 0x25;
                                         cbias = 0x20;
+                                        if (is_pkg_fab_smic) {
+                                                bias = 0x2a;
+                                                cbias = 0x38;
+                                        }
                                         pag_boost = 0x4;
                                         pgag_boost = 0x03;
                                         mixg_boost = 0x65;
@@ -844,6 +935,8 @@ static void b43_radio_2056_setup(struct b43_wldev *dev,
                         mixa_boost = 0xF;
                 }
 
+                cbias = is_pkg_fab_smic ? 0x35 : 0x30;
+
                 for (i = 0; i < 2; i++) {
                         offset = i ? B2056_TX1 : B2056_TX0;
 
@@ -862,11 +955,11 @@ static void b43_radio_2056_setup(struct b43_wldev *dev,
                         b43_radio_write(dev,
                                 offset | B2056_TX_PADA_CASCBIAS, 0x03);
                         b43_radio_write(dev,
-                                offset | B2056_TX_INTPAA_IAUX_STAT, 0x50);
+                                offset | B2056_TX_INTPAA_IAUX_STAT, 0x30);
                         b43_radio_write(dev,
-                                offset | B2056_TX_INTPAA_IMAIN_STAT, 0x50);
+                                offset | B2056_TX_INTPAA_IMAIN_STAT, 0x30);
                         b43_radio_write(dev,
-                                offset | B2056_TX_INTPAA_CASCBIAS, 0x30);
+                                offset | B2056_TX_INTPAA_CASCBIAS, cbias);
                 }
         }
 
@@ -933,7 +1026,7 @@ static void b43_radio_init2056_post(struct b43_wldev *dev)
         b43_radio_mask(dev, B2056_SYN_COM_RESET, ~0x2);
         b43_radio_mask(dev, B2056_SYN_PLL_MAST2, ~0xFC);
         b43_radio_mask(dev, B2056_SYN_RCCAL_CTRL0, ~0x1);
-        if (dev->phy.n->init_por)
+        if (dev->phy.do_full_init)
                 b43_radio_2056_rcal(dev);
 }
 
@@ -946,8 +1039,6 @@ static void b43_radio_init2056(struct b43_wldev *dev)
         b43_radio_init2056_pre(dev);
         b2056_upload_inittabs(dev, 0, 0);
         b43_radio_init2056_post(dev);
-
-        dev->phy.n->init_por = false;
 }
 
 /**************************************************
@@ -1164,23 +1255,20 @@ static void b43_nphy_run_samples(struct b43_wldev *dev, u16 samps, u16 loops,
         u16 seq_mode;
         u32 tmp;
 
-        if (nphy->hang_avoid)
-                b43_nphy_stay_in_carrier_search(dev, true);
+        b43_nphy_stay_in_carrier_search(dev, true);
 
         if ((nphy->bb_mult_save & 0x80000000) == 0) {
                 tmp = b43_ntab_read(dev, B43_NTAB16(15, 87));
                 nphy->bb_mult_save = (tmp & 0xFFFF) | 0x80000000;
         }
 
+        /* TODO: add modify_bbmult argument */
         if (!dev->phy.is_40mhz)
                 tmp = 0x6464;
         else
                 tmp = 0x4747;
         b43_ntab_write(dev, B43_NTAB16(15, 87), tmp);
 
-        if (nphy->hang_avoid)
-                b43_nphy_stay_in_carrier_search(dev, false);
-
         b43_phy_write(dev, B43_NPHY_SAMP_DEPCNT, (samps - 1));
 
         if (loops != 0xFFFF)
@@ -1213,6 +1301,8 @@ static void b43_nphy_run_samples(struct b43_wldev *dev, u16 samps, u16 loops,
                 b43err(dev->wl, "run samples timeout\n");
 
         b43_phy_write(dev, B43_NPHY_RFSEQMODE, seq_mode);
+
+        b43_nphy_stay_in_carrier_search(dev, false);
 }
 
 /**************************************************
@@ -1588,8 +1678,8 @@ static void b43_nphy_rev3_rssi_cal(struct b43_wldev *dev)
         struct b43_phy_n *nphy = dev->phy.n;
 
         u16 saved_regs_phy_rfctl[2];
-        u16 saved_regs_phy[13];
-        u16 regs_to_store[] = {
+        u16 saved_regs_phy[22];
+        u16 regs_to_store_rev3[] = {
                 B43_NPHY_AFECTL_OVER1, B43_NPHY_AFECTL_OVER,
                 B43_NPHY_AFECTL_C1, B43_NPHY_AFECTL_C2,
                 B43_NPHY_TXF_40CO_B1S1, B43_NPHY_RFCTL_OVER,
@@ -1598,6 +1688,20 @@ static void b43_nphy_rev3_rssi_cal(struct b43_wldev *dev)
                 B43_NPHY_RFCTL_LUT_TRSW_UP1, B43_NPHY_RFCTL_LUT_TRSW_UP2,
                 B43_NPHY_RFCTL_RSSIO1, B43_NPHY_RFCTL_RSSIO2
         };
+        u16 regs_to_store_rev7[] = {
+                B43_NPHY_AFECTL_OVER1, B43_NPHY_AFECTL_OVER,
+                B43_NPHY_AFECTL_C1, B43_NPHY_AFECTL_C2,
+                B43_NPHY_TXF_40CO_B1S1, B43_NPHY_RFCTL_OVER,
+                0x342, 0x343, 0x346, 0x347,
+                0x2ff,
+                B43_NPHY_TXF_40CO_B1S0, B43_NPHY_TXF_40CO_B32S1,
+                B43_NPHY_RFCTL_CMD,
+                B43_NPHY_RFCTL_LUT_TRSW_UP1, B43_NPHY_RFCTL_LUT_TRSW_UP2,
+                0x340, 0x341, 0x344, 0x345,
+                B43_NPHY_RFCTL_RSSIO1, B43_NPHY_RFCTL_RSSIO2
+        };
+        u16 *regs_to_store;
+        int regs_amount;
 
         u16 class;
 
@@ -1617,6 +1721,15 @@ static void b43_nphy_rev3_rssi_cal(struct b43_wldev *dev)
         u8 rx_core_state;
         int core, i, j, vcm;
 
+        if (dev->phy.rev >= 7) {
+                regs_to_store = regs_to_store_rev7;
+                regs_amount = ARRAY_SIZE(regs_to_store_rev7);
+        } else {
+                regs_to_store = regs_to_store_rev3;
+                regs_amount = ARRAY_SIZE(regs_to_store_rev3);
+        }
+        BUG_ON(regs_amount > ARRAY_SIZE(saved_regs_phy));
+
         class = b43_nphy_classifier(dev, 0, 0);
         b43_nphy_classifier(dev, 7, 4);
         b43_nphy_read_clip_detection(dev, clip_state);
@@ -1624,22 +1737,29 @@ static void b43_nphy_rev3_rssi_cal(struct b43_wldev *dev)
 
         saved_regs_phy_rfctl[0] = b43_phy_read(dev, B43_NPHY_RFCTL_INTC1);
         saved_regs_phy_rfctl[1] = b43_phy_read(dev, B43_NPHY_RFCTL_INTC2);
-        for (i = 0; i < ARRAY_SIZE(regs_to_store); i++)
+        for (i = 0; i < regs_amount; i++)
                 saved_regs_phy[i] = b43_phy_read(dev, regs_to_store[i]);
 
         b43_nphy_rf_ctl_intc_override(dev, N_INTC_OVERRIDE_OFF, 0, 7);
         b43_nphy_rf_ctl_intc_override(dev, N_INTC_OVERRIDE_TRSW, 1, 7);
-        b43_nphy_rf_ctl_override(dev, 0x1, 0, 0, false);
-        b43_nphy_rf_ctl_override(dev, 0x2, 1, 0, false);
-        b43_nphy_rf_ctl_override(dev, 0x80, 1, 0, false);
-        b43_nphy_rf_ctl_override(dev, 0x40, 1, 0, false);
-
-        if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ) {
-                b43_nphy_rf_ctl_override(dev, 0x20, 0, 0, false);
-                b43_nphy_rf_ctl_override(dev, 0x10, 1, 0, false);
+
+        if (dev->phy.rev >= 7) {
+                /* TODO */
+                if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ) {
+                } else {
+                }
         } else {
-                b43_nphy_rf_ctl_override(dev, 0x10, 0, 0, false);
-                b43_nphy_rf_ctl_override(dev, 0x20, 1, 0, false);
+                b43_nphy_rf_ctl_override(dev, 0x1, 0, 0, false);
+                b43_nphy_rf_ctl_override(dev, 0x2, 1, 0, false);
+                b43_nphy_rf_ctl_override(dev, 0x80, 1, 0, false);
+                b43_nphy_rf_ctl_override(dev, 0x40, 1, 0, false);
+                if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ) {
+                        b43_nphy_rf_ctl_override(dev, 0x20, 0, 0, false);
+                        b43_nphy_rf_ctl_override(dev, 0x10, 1, 0, false);
+                } else {
+                        b43_nphy_rf_ctl_override(dev, 0x10, 0, 0, false);
+                        b43_nphy_rf_ctl_override(dev, 0x20, 1, 0, false);
+                }
         }
 
         rx_core_state = b43_nphy_get_rx_core_state(dev);
@@ -1654,8 +1774,11 @@ static void b43_nphy_rev3_rssi_cal(struct b43_wldev *dev)
 
                 /* Grab RSSI results for every possible VCM */
                 for (vcm = 0; vcm < 8; vcm++) {
-                        b43_radio_maskset(dev, r | B2056_RX_RSSI_MISC, 0xE3,
-                                        vcm << 2);
+                        if (dev->phy.rev >= 7)
+                                ;
+                        else
+                                b43_radio_maskset(dev, r | B2056_RX_RSSI_MISC,
+                                                  0xE3, vcm << 2);
                         b43_nphy_poll_rssi(dev, N_RSSI_NB, results[vcm], 8);
                 }
 
@@ -1682,8 +1805,11 @@ static void b43_nphy_rev3_rssi_cal(struct b43_wldev *dev)
                 }
 
                 /* Select the best VCM */
-                b43_radio_maskset(dev, r | B2056_RX_RSSI_MISC, 0xE3,
-                                  vcm_final << 2);
+                if (dev->phy.rev >= 7)
+                        ;
+                else
+                        b43_radio_maskset(dev, r | B2056_RX_RSSI_MISC,
+                                          0xE3, vcm_final << 2);
 
                 for (i = 0; i < 4; i++) {
                         if (core != i / 2)
@@ -1736,9 +1862,9 @@ static void b43_nphy_rev3_rssi_cal(struct b43_wldev *dev)
 
         b43_phy_set(dev, B43_NPHY_RFCTL_OVER, 0x1);
         b43_phy_set(dev, B43_NPHY_RFCTL_CMD, B43_NPHY_RFCTL_CMD_RXTX);
-        b43_phy_mask(dev, B43_NPHY_TXF_40CO_B1S1, ~0x1);
+        b43_phy_mask(dev, B43_NPHY_RFCTL_OVER, ~0x1);
 
-        for (i = 0; i < ARRAY_SIZE(regs_to_store); i++)
+        for (i = 0; i < regs_amount; i++)
                 b43_phy_write(dev, regs_to_store[i], saved_regs_phy[i]);
 
         /* Store for future configuration */
@@ -2494,8 +2620,8 @@ static void b43_nphy_workarounds_rev3plus(struct b43_wldev *dev)
         struct ssb_sprom *sprom = dev->dev->bus_sprom;
 
         /* TX to RX */
-        u8 tx2rx_events[8] = { 0x4, 0x3, 0x6, 0x5, 0x2, 0x1, 0x8, 0x1F };
-        u8 tx2rx_delays[8] = { 8, 4, 2, 2, 4, 4, 6, 1 };
+        u8 tx2rx_events[7] = { 0x4, 0x3, 0x5, 0x2, 0x1, 0x8, 0x1F };
+        u8 tx2rx_delays[7] = { 8, 4, 4, 4, 4, 6, 1 };
         /* RX to TX */
         u8 rx2tx_events_ipa[9] = { 0x0, 0x1, 0x2, 0x8, 0x5, 0x6, 0xF, 0x3,
                                         0x1F };
@@ -2503,6 +2629,23 @@ static void b43_nphy_workarounds_rev3plus(struct b43_wldev *dev)
         u8 rx2tx_events[9] = { 0x0, 0x1, 0x2, 0x8, 0x5, 0x6, 0x3, 0x4, 0x1F };
         u8 rx2tx_delays[9] = { 8, 6, 6, 4, 4, 18, 42, 1, 1 };
 
+        u16 vmids[5][4] = {
+                { 0xa2, 0xb4, 0xb4, 0x89, }, /* 0 */
+                { 0xb4, 0xb4, 0xb4, 0x24, }, /* 1 */
+                { 0xa2, 0xb4, 0xb4, 0x74, }, /* 2 */
+                { 0xa2, 0xb4, 0xb4, 0x270, }, /* 3 */
+                { 0xa2, 0xb4, 0xb4, 0x00, }, /* 4 and 5 */
+        };
+        u16 gains[5][4] = {
+                { 0x02, 0x02, 0x02, 0x00, }, /* 0 */
+                { 0x02, 0x02, 0x02, 0x02, }, /* 1 */
+                { 0x02, 0x02, 0x02, 0x04, }, /* 2 */
+                { 0x02, 0x02, 0x02, 0x00, }, /* 3 */
+                { 0x02, 0x02, 0x02, 0x00, }, /* 4 and 5 */
+        };
+        u16 *vmid, *gain;
+
+        u8 pdet_range;
         u16 tmp16;
         u32 tmp32;
 
@@ -2561,7 +2704,71 @@ static void b43_nphy_workarounds_rev3plus(struct b43_wldev *dev)
         b43_ntab_write(dev, B43_NTAB16(8, 0), 2);
         b43_ntab_write(dev, B43_NTAB16(8, 16), 2);
 
-        /* TODO */
+        if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ)
+                pdet_range = sprom->fem.ghz2.pdet_range;
+        else
+                pdet_range = sprom->fem.ghz5.pdet_range;
+        vmid = vmids[min_t(u16, pdet_range, 4)];
+        gain = gains[min_t(u16, pdet_range, 4)];
+        switch (pdet_range) {
+        case 3:
+                if (!(dev->phy.rev >= 4 &&
+                      b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ))
+                        break;
+                /* FALL THROUGH */
+        case 0:
+        case 1:
+                b43_ntab_write_bulk(dev, B43_NTAB16(8, 0x08), 4, vmid);
+                b43_ntab_write_bulk(dev, B43_NTAB16(8, 0x18), 4, vmid);
+                b43_ntab_write_bulk(dev, B43_NTAB16(8, 0x0c), 4, gain);
+                b43_ntab_write_bulk(dev, B43_NTAB16(8, 0x1c), 4, gain);
+                break;
+        case 2:
+                if (dev->phy.rev >= 6) {
+                        if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ)
+                                vmid[3] = 0x94;
+                        else
+                                vmid[3] = 0x8e;
+                        gain[3] = 3;
+                } else if (dev->phy.rev == 5) {
+                        vmid[3] = 0x84;
+                        gain[3] = 2;
+                }
+                b43_ntab_write_bulk(dev, B43_NTAB16(8, 0x08), 4, vmid);
+                b43_ntab_write_bulk(dev, B43_NTAB16(8, 0x18), 4, vmid);
+                b43_ntab_write_bulk(dev, B43_NTAB16(8, 0x0c), 4, gain);
+                b43_ntab_write_bulk(dev, B43_NTAB16(8, 0x1c), 4, gain);
+                break;
+        case 4:
+        case 5:
+                if (b43_current_band(dev->wl) != IEEE80211_BAND_2GHZ) {
+                        if (pdet_range == 4) {
+                                vmid[3] = 0x8e;
+                                tmp16 = 0x96;
+                                gain[3] = 0x2;
+                        } else {
+                                vmid[3] = 0x89;
+                                tmp16 = 0x89;
+                                gain[3] = 0;
+                        }
+                } else {
+                        if (pdet_range == 4) {
+                                vmid[3] = 0x89;
+                                tmp16 = 0x8b;
+                                gain[3] = 0x2;
+                        } else {
+                                vmid[3] = 0x74;
+                                tmp16 = 0x70;
+                                gain[3] = 0;
+                        }
+                }
+                b43_ntab_write_bulk(dev, B43_NTAB16(8, 0x08), 4, vmid);
+                b43_ntab_write_bulk(dev, B43_NTAB16(8, 0x0c), 4, gain);
+                vmid[3] = tmp16;
+                b43_ntab_write_bulk(dev, B43_NTAB16(8, 0x18), 4, vmid);
+                b43_ntab_write_bulk(dev, B43_NTAB16(8, 0x1c), 4, gain);
+                break;
+        }
 
         b43_radio_write(dev, B2056_RX0 | B2056_RX_MIXA_MAST_BIAS, 0x00);
         b43_radio_write(dev, B2056_RX1 | B2056_RX_MIXA_MAST_BIAS, 0x00);
@@ -2600,7 +2807,7 @@ static void b43_nphy_workarounds_rev3plus(struct b43_wldev *dev)
         /* Dropped probably-always-true condition */
         b43_phy_write(dev, B43_NPHY_ED_CRS40ASSERTTHRESH0, 0x03eb);
         b43_phy_write(dev, B43_NPHY_ED_CRS40ASSERTTHRESH1, 0x03eb);
-        b43_phy_write(dev, B43_NPHY_ED_CRS40DEASSERTTHRESH1, 0x0341);
+        b43_phy_write(dev, B43_NPHY_ED_CRS40DEASSERTTHRESH0, 0x0341);
         b43_phy_write(dev, B43_NPHY_ED_CRS40DEASSERTTHRESH1, 0x0341);
         b43_phy_write(dev, B43_NPHY_ED_CRS20LASSERTTHRESH0, 0x042b);
         b43_phy_write(dev, B43_NPHY_ED_CRS20LASSERTTHRESH1, 0x042b);
@@ -3211,6 +3418,20 @@ static void b43_nphy_tx_prepare_adjusted_power_table(struct b43_wldev *dev)
         u8 idx, delta;
         u8 i, stf_mode;
 
+        /* Array adj_pwr_tbl corresponds to the hardware table. It consists of
+         * 21 groups, each containing 4 entries.
+         *
+         * First group has entries for CCK modulation.
+         * The rest of groups has 1 entry per modulation (SISO, CDD, STBC, SDM).
+         *
+         * Group 0 is for CCK
+         * Groups 1..4 use BPSK (group per coding rate)
+         * Groups 5..8 use QPSK (group per coding rate)
+         * Groups 9..12 use 16-QAM (group per coding rate)
+         * Groups 13..16 use 64-QAM (group per coding rate)
+         * Groups 17..20 are unknown
+         */
+
         for (i = 0; i < 4; i++)
                 nphy->adj_pwr_tbl[i] = nphy->tx_power_offset[i];
 
@@ -3409,10 +3630,8 @@ static void b43_nphy_tx_power_ctl_setup(struct b43_wldev *dev)
         }
 
         b43_nphy_tx_prepare_adjusted_power_table(dev);
-        /*
         b43_ntab_write_bulk(dev, B43_NTAB16(26, 64), 84, nphy->adj_pwr_tbl);
         b43_ntab_write_bulk(dev, B43_NTAB16(27, 64), 84, nphy->adj_pwr_tbl);
-        */
 
         if (nphy->hang_avoid)
                 b43_nphy_stay_in_carrier_search(dev, false);
@@ -5124,7 +5343,7 @@ static int b43_phy_initn(struct b43_wldev *dev)
         b43_phy_write(dev, B43_NPHY_TXMACIF_HOLDOFF, 0x0015);
         b43_phy_write(dev, B43_NPHY_TXMACDELAY, 0x0320);
         if (phy->rev >= 3 && phy->rev <= 6)
-                b43_phy_write(dev, B43_NPHY_PLOAD_CSENSE_EXTLEN, 0x0014);
+                b43_phy_write(dev, B43_NPHY_PLOAD_CSENSE_EXTLEN, 0x0032);
         b43_nphy_tx_lp_fbw(dev);
         if (phy->rev >= 3)
                 b43_nphy_spur_workaround(dev);
@@ -5338,7 +5557,6 @@ static void b43_nphy_op_prepare_structs(struct b43_wldev *dev)
         nphy->hang_avoid = (phy->rev == 3 || phy->rev == 4);
         nphy->spur_avoid = (phy->rev >= 3) ?
                                 B43_SPUR_AVOID_AUTO : B43_SPUR_AVOID_DISABLE;
-        nphy->init_por = true;
         nphy->gain_boost = true; /* this way we follow wl, assume it is true */
         nphy->txrx_chain = 2; /* sth different than 0 and 1 for now */
         nphy->phyrxchain = 3; /* to avoid b43_nphy_set_rx_core_state like wl */
@@ -5379,8 +5597,6 @@ static void b43_nphy_op_prepare_structs(struct b43_wldev *dev)
                 nphy->ipa2g_on = sprom->fem.ghz2.extpa_gain == 2;
                 nphy->ipa5g_on = sprom->fem.ghz5.extpa_gain == 2;
         }
-
-        nphy->init_por = true;
 }
 
 static void b43_nphy_op_free(struct b43_wldev *dev)
@@ -5441,8 +5657,11 @@ static u16 b43_nphy_op_radio_read(struct b43_wldev *dev, u16 reg)
 {
         /* Register 1 is a 32-bit register. */
         B43_WARN_ON(reg == 1);
-        /* N-PHY needs 0x100 for read access */
-        reg |= 0x100;
+
+        if (dev->phy.rev >= 7)
+                reg |= 0x200; /* Radio 0x2057 */
+        else
+                reg |= 0x100;
 
         b43_write16(dev, B43_MMIO_RADIO_CONTROL, reg);
         return b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
@@ -5488,10 +5707,12 @@ static void b43_nphy_op_software_rfkill(struct b43_wldev *dev,
                 }
         } else {
                 if (dev->phy.rev >= 7) {
-                        b43_radio_2057_init(dev);
+                        if (!dev->phy.radio_on)
+                                b43_radio_2057_init(dev);
                         b43_switch_channel(dev, dev->phy.channel);
                 } else if (dev->phy.rev >= 3) {
-                        b43_radio_init2056(dev);
+                        if (!dev->phy.radio_on)
+                                b43_radio_init2056(dev);
                         b43_switch_channel(dev, dev->phy.channel);
                 } else {
                         b43_radio_init2055(dev);
diff --git a/drivers/net/wireless/b43/phy_n.h b/drivers/net/wireless/b43/phy_n.h
index 9a5b6bc27d24..ecfbf66dbc3b 100644
--- a/drivers/net/wireless/b43/phy_n.h
+++ b/drivers/net/wireless/b43/phy_n.h
@@ -931,7 +931,6 @@ struct b43_phy_n {
         u16 papd_epsilon_offset[2];
         s32 preamble_override;
         u32 bb_mult_save;
-        bool init_por;
 
         bool gain_boost;
         bool elna_gain_config;
diff --git a/drivers/net/wireless/b43/radio_2056.c b/drivers/net/wireless/b43/radio_2056.c
index b4fd9345d673..2ce25607c60d 100644
--- a/drivers/net/wireless/b43/radio_2056.c
+++ b/drivers/net/wireless/b43/radio_2056.c
@@ -48,7 +48,7 @@ struct b2056_inittabs_pts {
         unsigned int rx_length;
 };
 
-static const struct b2056_inittab_entry b2056_inittab_rev3_syn[] = {
+static const struct b2056_inittab_entry b2056_inittab_phy_rev3_syn[] = {
         [B2056_SYN_RESERVED_ADDR2]      = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_SYN_RESERVED_ADDR3]      = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_SYN_RESERVED_ADDR4]      = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
@@ -232,7 +232,7 @@ static const struct b2056_inittab_entry b2056_inittab_rev3_syn[] = {
         [B2056_SYN_LOGEN_TX_CMOS_VALID] = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
 };
 
-static const struct b2056_inittab_entry b2056_inittab_rev3_tx[] = {
+static const struct b2056_inittab_entry b2056_inittab_phy_rev3_tx[] = {
         [B2056_TX_RESERVED_ADDR2]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_TX_RESERVED_ADDR3]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_TX_RESERVED_ADDR4]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
@@ -380,7 +380,7 @@ static const struct b2056_inittab_entry b2056_inittab_rev3_tx[] = {
         [B2056_TX_STATUS_TXLPF_RC]      = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
 };
 
-static const struct b2056_inittab_entry b2056_inittab_rev3_rx[] = {
+static const struct b2056_inittab_entry b2056_inittab_phy_rev3_rx[] = {
         [B2056_RX_RESERVED_ADDR2]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_RX_RESERVED_ADDR3]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_RX_RESERVED_ADDR4]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
@@ -530,7 +530,7 @@ static const struct b2056_inittab_entry b2056_inittab_rev3_rx[] = {
         [B2056_RX_STATUS_HPC_RC]        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
 };
 
-static const struct b2056_inittab_entry b2056_inittab_rev4_syn[] = {
+static const struct b2056_inittab_entry b2056_inittab_phy_rev4_syn[] = {
         [B2056_SYN_RESERVED_ADDR2]      = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_SYN_RESERVED_ADDR3]      = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_SYN_RESERVED_ADDR4]      = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
@@ -714,7 +714,7 @@ static const struct b2056_inittab_entry b2056_inittab_rev4_syn[] = {
         [B2056_SYN_LOGEN_TX_CMOS_VALID] = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
 };
 
-static const struct b2056_inittab_entry b2056_inittab_rev4_tx[] = {
+static const struct b2056_inittab_entry b2056_inittab_phy_rev4_tx[] = {
         [B2056_TX_RESERVED_ADDR2]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_TX_RESERVED_ADDR3]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_TX_RESERVED_ADDR4]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
@@ -862,7 +862,7 @@ static const struct b2056_inittab_entry b2056_inittab_rev4_tx[] = {
         [B2056_TX_STATUS_TXLPF_RC]      = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
 };
 
-static const struct b2056_inittab_entry b2056_inittab_rev4_rx[] = {
+static const struct b2056_inittab_entry b2056_inittab_phy_rev4_rx[] = {
         [B2056_RX_RESERVED_ADDR2]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_RX_RESERVED_ADDR3]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_RX_RESERVED_ADDR4]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
@@ -1012,7 +1012,7 @@ static const struct b2056_inittab_entry b2056_inittab_rev4_rx[] = {
         [B2056_RX_STATUS_HPC_RC]        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
 };
 
-static const struct b2056_inittab_entry b2056_inittab_rev5_syn[] = {
+static const struct b2056_inittab_entry b2056_inittab_radio_rev5_syn[] = {
         [B2056_SYN_RESERVED_ADDR2]      = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_SYN_RESERVED_ADDR3]      = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_SYN_RESERVED_ADDR4]      = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
@@ -1196,7 +1196,7 @@ static const struct b2056_inittab_entry b2056_inittab_rev5_syn[] = {
         [B2056_SYN_LOGEN_TX_CMOS_VALID] = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
 };
 
-static const struct b2056_inittab_entry b2056_inittab_rev5_tx[] = {
+static const struct b2056_inittab_entry b2056_inittab_radio_rev5_tx[] = {
         [B2056_TX_RESERVED_ADDR2]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_TX_RESERVED_ADDR3]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_TX_RESERVED_ADDR4]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
@@ -1352,7 +1352,7 @@ static const struct b2056_inittab_entry b2056_inittab_rev5_tx[] = {
         [B2056_TX_GMBB_IDAC7]           = { .ghz5 = 0x0075, .ghz2 = 0x0075, UPLOAD, },
 };
 
-static const struct b2056_inittab_entry b2056_inittab_rev5_rx[] = {
+static const struct b2056_inittab_entry b2056_inittab_radio_rev5_rx[] = {
         [B2056_RX_RESERVED_ADDR2]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_RX_RESERVED_ADDR3]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_RX_RESERVED_ADDR4]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
@@ -1502,7 +1502,7 @@ static const struct b2056_inittab_entry b2056_inittab_rev5_rx[] = {
         [B2056_RX_STATUS_HPC_RC]        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
 };
 
-static const struct b2056_inittab_entry b2056_inittab_rev6_syn[] = {
+static const struct b2056_inittab_entry b2056_inittab_radio_rev6_syn[] = {
         [B2056_SYN_RESERVED_ADDR2]      = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_SYN_RESERVED_ADDR3]      = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_SYN_RESERVED_ADDR4]      = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
@@ -1686,7 +1686,7 @@ static const struct b2056_inittab_entry b2056_inittab_rev6_syn[] = {
         [B2056_SYN_LOGEN_TX_CMOS_VALID] = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
 };
 
-static const struct b2056_inittab_entry b2056_inittab_rev6_tx[] = {
+static const struct b2056_inittab_entry b2056_inittab_radio_rev6_tx[] = {
         [B2056_TX_RESERVED_ADDR2]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_TX_RESERVED_ADDR3]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_TX_RESERVED_ADDR4]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
@@ -1842,7 +1842,7 @@ static const struct b2056_inittab_entry b2056_inittab_rev6_tx[] = {
         [B2056_TX_GMBB_IDAC7]           = { .ghz5 = 0x0070, .ghz2 = 0x0070, NOUPLOAD, },
 };
 
-static const struct b2056_inittab_entry b2056_inittab_rev6_rx[] = {
+static const struct b2056_inittab_entry b2056_inittab_radio_rev6_rx[] = {
         [B2056_RX_RESERVED_ADDR2]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_RX_RESERVED_ADDR3]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_RX_RESERVED_ADDR4]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
@@ -1992,7 +1992,7 @@ static const struct b2056_inittab_entry b2056_inittab_rev6_rx[] = {
         [B2056_RX_STATUS_HPC_RC]        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
 };
 
-static const struct b2056_inittab_entry b2056_inittab_rev7_syn[] = {
+static const struct b2056_inittab_entry b2056_inittab_radio_rev7_9_syn[] = {
         [B2056_SYN_RESERVED_ADDR2]      = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_SYN_RESERVED_ADDR3]      = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_SYN_RESERVED_ADDR4]      = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
@@ -2176,7 +2176,7 @@ static const struct b2056_inittab_entry b2056_inittab_rev7_syn[] = {
         [B2056_SYN_LOGEN_TX_CMOS_VALID] = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
 };
 
-static const struct b2056_inittab_entry b2056_inittab_rev7_tx[] = {
+static const struct b2056_inittab_entry b2056_inittab_radio_rev7_9_tx[] = {
         [B2056_TX_RESERVED_ADDR2]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_TX_RESERVED_ADDR3]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_TX_RESERVED_ADDR4]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
@@ -2332,7 +2332,7 @@ static const struct b2056_inittab_entry b2056_inittab_rev7_tx[] = {
         [B2056_TX_GMBB_IDAC7]           = { .ghz5 = 0x0075, .ghz2 = 0x0075, UPLOAD, },
 };
 
-static const struct b2056_inittab_entry b2056_inittab_rev7_rx[] = {
+static const struct b2056_inittab_entry b2056_inittab_radio_rev7_9_rx[] = {
         [B2056_RX_RESERVED_ADDR2]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_RX_RESERVED_ADDR3]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_RX_RESERVED_ADDR4]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
@@ -2482,7 +2482,7 @@ static const struct b2056_inittab_entry b2056_inittab_rev7_rx[] = {
         [B2056_RX_STATUS_HPC_RC]        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
 };
 
-static const struct b2056_inittab_entry b2056_inittab_rev8_syn[] = {
+static const struct b2056_inittab_entry b2056_inittab_radio_rev8_syn[] = {
         [B2056_SYN_RESERVED_ADDR2]      = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_SYN_RESERVED_ADDR3]      = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_SYN_RESERVED_ADDR4]      = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
@@ -2666,7 +2666,7 @@ static const struct b2056_inittab_entry b2056_inittab_rev8_syn[] = {
         [B2056_SYN_LOGEN_TX_CMOS_VALID] = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
 };
 
-static const struct b2056_inittab_entry b2056_inittab_rev8_tx[] = {
+static const struct b2056_inittab_entry b2056_inittab_radio_rev8_tx[] = {
         [B2056_TX_RESERVED_ADDR2]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_TX_RESERVED_ADDR3]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_TX_RESERVED_ADDR4]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
@@ -2822,7 +2822,7 @@ static const struct b2056_inittab_entry b2056_inittab_rev8_tx[] = {
         [B2056_TX_GMBB_IDAC7]           = { .ghz5 = 0x0070, .ghz2 = 0x0070, NOUPLOAD, },
 };
 
-static const struct b2056_inittab_entry b2056_inittab_rev8_rx[] = {
+static const struct b2056_inittab_entry b2056_inittab_radio_rev8_rx[] = {
         [B2056_RX_RESERVED_ADDR2]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_RX_RESERVED_ADDR3]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
         [B2056_RX_RESERVED_ADDR4]       = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
@@ -2972,24 +2972,69 @@ static const struct b2056_inittab_entry b2056_inittab_rev8_rx[] = {
         [B2056_RX_STATUS_HPC_RC]        = { .ghz5 = 0x0000, .ghz2 = 0x0000, NOUPLOAD, },
 };
 
-#define INITTABSPTS(prefix) \
-        .syn            = prefix##_syn,                 \
-        .syn_length     = ARRAY_SIZE(prefix##_syn),     \
-        .tx             = prefix##_tx,                  \
-        .tx_length      = ARRAY_SIZE(prefix##_tx),      \
-        .rx             = prefix##_rx,                  \
-        .rx_length      = ARRAY_SIZE(prefix##_rx)
+static const struct b2056_inittab_entry b2056_inittab_radio_rev11_syn[] = {
+        [B2056_SYN_PLL_PFD]             = { .ghz5 = 0x0006, .ghz2 = 0x0006, UPLOAD, },
+        [B2056_SYN_PLL_CP2]             = { .ghz5 = 0x003f, .ghz2 = 0x003f, UPLOAD, },
+        [B2056_SYN_PLL_LOOPFILTER1]     = { .ghz5 = 0x0006, .ghz2 = 0x0006, UPLOAD, },
+        [B2056_SYN_PLL_LOOPFILTER2]     = { .ghz5 = 0x0006, .ghz2 = 0x0006, UPLOAD, },
+        [B2056_SYN_PLL_LOOPFILTER4]     = { .ghz5 = 0x002b, .ghz2 = 0x002b, UPLOAD, },
+        [B2056_SYN_PLL_VCO2]            = { .ghz5 = 0x00f7, .ghz2 = 0x00f7, UPLOAD, },
+        [B2056_SYN_PLL_VCOCAL12]        = { .ghz5 = 0x0007, .ghz2 = 0x0007, UPLOAD, },
+        [B2056_SYN_LOGENBUF2]           = { .ghz5 = 0x008f, .ghz2 = 0x008f, UPLOAD, },
+};
 
-static const struct b2056_inittabs_pts b2056_inittabs[] = {
-        [3] = { INITTABSPTS(b2056_inittab_rev3) },
-        [4] = { INITTABSPTS(b2056_inittab_rev4) },
-        [5] = { INITTABSPTS(b2056_inittab_rev5) },
-        [6] = { INITTABSPTS(b2056_inittab_rev6) },
-        [7] = { INITTABSPTS(b2056_inittab_rev7) },
-        [8] = { INITTABSPTS(b2056_inittab_rev8) },
-        [9] = { INITTABSPTS(b2056_inittab_rev7) },
+static const struct b2056_inittab_entry b2056_inittab_radio_rev11_tx[] = {
+        [B2056_TX_PA_SPARE2]            = { .ghz5 = 0x00ee, .ghz2 = 0x00ee, UPLOAD, },
+        [B2056_TX_INTPAA_IAUX_STAT]     = { .ghz5 = 0x0050, .ghz2 = 0x0050, UPLOAD, },
+        [B2056_TX_INTPAA_IMAIN_STAT]    = { .ghz5 = 0x0050, .ghz2 = 0x0050, UPLOAD, },
+        [B2056_TX_INTPAA_PASLOPE]       = { .ghz5 = 0x00f0, .ghz2 = 0x00f0, UPLOAD, },
+        [B2056_TX_INTPAG_PASLOPE]       = { .ghz5 = 0x00f0, .ghz2 = 0x00f0, UPLOAD, },
+        [B2056_TX_PADA_IDAC]            = { .ghz5 = 0x00ff, .ghz2 = 0x00ff, UPLOAD, },
+        [B2056_TX_PADA_SLOPE]           = { .ghz5 = 0x0070, .ghz2 = 0x0070, UPLOAD, },
+        [B2056_TX_PADG_SLOPE]           = { .ghz5 = 0x0070, .ghz2 = 0x0070, UPLOAD, },
+        [B2056_TX_PGAA_IDAC]            = { .ghz5 = 0x00ff, .ghz2 = 0x00ff, UPLOAD, },
+        [B2056_TX_PGAA_SLOPE]           = { .ghz5 = 0x0077, .ghz2 = 0x0077, UPLOAD, },
+        [B2056_TX_PGAG_SLOPE]           = { .ghz5 = 0x0077, .ghz2 = 0x0077, UPLOAD, },
+        [B2056_TX_GMBB_IDAC]            = { .ghz5 = 0x0000, .ghz2 = 0x0000, UPLOAD, },
+        [B2056_TX_TXSPARE1]             = { .ghz5 = 0x0030, .ghz2 = 0x0030, UPLOAD, },
+};
+
+static const struct b2056_inittab_entry b2056_inittab_radio_rev11_rx[] = {
+        [B2056_RX_BIASPOLE_LNAA1_IDAC]  = { .ghz5 = 0x0017, .ghz2 = 0x0017, UPLOAD, },
+        [B2056_RX_LNAA2_IDAC]           = { .ghz5 = 0x00ff, .ghz2 = 0x00ff, UPLOAD, },
+        [B2056_RX_BIASPOLE_LNAG1_IDAC]  = { .ghz5 = 0x0017, .ghz2 = 0x0017, UPLOAD, },
+        [B2056_RX_LNAG2_IDAC]           = { .ghz5 = 0x00f0, .ghz2 = 0x00f0, UPLOAD, },
+        [B2056_RX_MIXA_VCM]             = { .ghz5 = 0x0055, .ghz2 = 0x0055, UPLOAD, },
+        [B2056_RX_MIXA_LOB_BIAS]        = { .ghz5 = 0x0088, .ghz2 = 0x0088, UPLOAD, },
+        [B2056_RX_MIXA_BIAS_AUX]        = { .ghz5 = 0x0007, .ghz2 = 0x0007, UPLOAD, },
+        [B2056_RX_MIXG_VCM]             = { .ghz5 = 0x0055, .ghz2 = 0x0055, UPLOAD, },
+        [B2056_RX_TIA_IOPAMP]           = { .ghz5 = 0x0026, .ghz2 = 0x0026, UPLOAD, },
+        [B2056_RX_TIA_QOPAMP]           = { .ghz5 = 0x0026, .ghz2 = 0x0026, UPLOAD, },
+        [B2056_RX_TIA_IMISC]            = { .ghz5 = 0x000f, .ghz2 = 0x000f, UPLOAD, },
+        [B2056_RX_TIA_QMISC]            = { .ghz5 = 0x000f, .ghz2 = 0x000f, UPLOAD, },
+        [B2056_RX_RXLPF_OUTVCM]         = { .ghz5 = 0x0004, .ghz2 = 0x0004, UPLOAD, },
+        [B2056_RX_VGA_BIAS_DCCANCEL]    = { .ghz5 = 0x0000, .ghz2 = 0x0000, UPLOAD, },
+        [B2056_RX_RXSPARE3]             = { .ghz5 = 0x0005, .ghz2 = 0x0005, UPLOAD, },
 };
 
+#define INITTABSPTS(prefix) \
+        static const struct b2056_inittabs_pts prefix = {       \
+                .syn            = prefix##_syn,                 \
+                .syn_length     = ARRAY_SIZE(prefix##_syn),     \
+                .tx             = prefix##_tx,                  \
+                .tx_length      = ARRAY_SIZE(prefix##_tx),      \
+                .rx             = prefix##_rx,                  \
+                .rx_length      = ARRAY_SIZE(prefix##_rx),      \
+        }
+
+INITTABSPTS(b2056_inittab_phy_rev3);
+INITTABSPTS(b2056_inittab_phy_rev4);
+INITTABSPTS(b2056_inittab_radio_rev5);
+INITTABSPTS(b2056_inittab_radio_rev6);
+INITTABSPTS(b2056_inittab_radio_rev7_9);
+INITTABSPTS(b2056_inittab_radio_rev8);
+INITTABSPTS(b2056_inittab_radio_rev11);
+
 #define RADIOREGS3(r00, r01, r02, r03, r04, r05, r06, r07, r08, r09, \
                    r10, r11, r12, r13, r14, r15, r16, r17, r18, r19, \
                    r20, r21, r22, r23, r24, r25, r26, r27, r28, r29, \
@@ -3041,7 +3086,7 @@ static const struct b2056_inittabs_pts b2056_inittabs[] = {
         .phy_regs.phy_bw6       = r5
 
 /* http://bcm-v4.sipsolutions.net/802.11/Radio/2056/ChannelTable */
-static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_rev3[] = {
+static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_phy_rev3[] = {
   {     .freq                   = 4920,
         RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xec, 0x05, 0x05, 0x04,
                    0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
@@ -4036,7 +4081,7 @@ static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_rev3[] =
   },
 };
 
-static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_rev4[] = {
+static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_phy_rev4[] = {
   {     .freq                   = 4920,
         RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xec, 0x05, 0x05, 0x04,
                    0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
@@ -5031,7 +5076,7 @@ static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_rev4[] =
   },
 };
 
-static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_rev5[] = {
+static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_radio_rev5[] = {
   {     .freq                   = 4920,
         RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xec, 0x05, 0x05, 0x04,
                    0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
@@ -6026,7 +6071,7 @@ static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_rev5[] =
   },
 };
 
-static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_rev6[] = {
+static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_radio_rev6[] = {
   {     .freq                   = 4920,
         RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xec, 0x05, 0x05, 0x04,
                    0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
@@ -7021,7 +7066,7 @@ static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_rev6[] =
   },
 };
 
-static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_rev7_9[] = {
+static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_radio_rev7_9[] = {
   {     .freq                   = 4920,
         RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xec, 0x05, 0x05, 0x04,
                    0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
@@ -8016,7 +8061,7 @@ static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_rev7_9[]
   },
 };
 
-static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_rev8[] = {
+static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_radio_rev8[] = {
   {     .freq                   = 4920,
         RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xec, 0x05, 0x05, 0x04,
                    0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
@@ -9011,6 +9056,1154 @@ static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_rev8[] =
   },
 };
 
+static const struct b43_nphy_channeltab_entry_rev3 b43_nphy_channeltab_radio_rev11[] = {
+        {
+                .freq                   = 4920,
+                RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xec, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07b4, 0x07b0, 0x07ac, 0x0214, 0x0215, 0x0216),
+        },
+        {
+                .freq                   = 4930,
+                RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xed, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07b8, 0x07b4, 0x07b0, 0x0213, 0x0214, 0x0215),
+        },
+        {
+                .freq                   = 4940,
+                RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xee, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07bc, 0x07b8, 0x07b4, 0x0212, 0x0213, 0x0214),
+        },
+        {
+                .freq                   = 4950,
+                RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xef, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x00, 0x00, 0x00, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07c0, 0x07bc, 0x07b8, 0x0211, 0x0212, 0x0213),
+        },
+        {
+                .freq                   = 4960,
+                RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf0, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07c4, 0x07c0, 0x07bc, 0x020f, 0x0211, 0x0212),
+        },
+        {
+                .freq                   = 4970,
+                RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf1, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07c8, 0x07c4, 0x07c0, 0x020e, 0x020f, 0x0211),
+        },
+        {
+                .freq                   = 4980,
+                RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf2, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07cc, 0x07c8, 0x07c4, 0x020d, 0x020e, 0x020f),
+        },
+        {
+                .freq                   = 4990,
+                RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf3, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07d0, 0x07cc, 0x07c8, 0x020c, 0x020d, 0x020e),
+        },
+        {
+                .freq                   = 5000,
+                RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf4, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07d4, 0x07d0, 0x07cc, 0x020b, 0x020c, 0x020d),
+        },
+        {
+                .freq                   = 5010,
+                RADIOREGS3(0xff, 0x01, 0x01, 0x01, 0xf5, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07d8, 0x07d4, 0x07d0, 0x020a, 0x020b, 0x020c),
+        },
+        {
+                .freq                   = 5020,
+                RADIOREGS3(0xf7, 0x01, 0x01, 0x01, 0xf6, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07dc, 0x07d8, 0x07d4, 0x0209, 0x020a, 0x020b),
+        },
+        {
+                .freq                   = 5030,
+                RADIOREGS3(0xf7, 0x01, 0x01, 0x01, 0xf7, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07e0, 0x07dc, 0x07d8, 0x0208, 0x0209, 0x020a),
+        },
+        {
+                .freq                   = 5040,
+                RADIOREGS3(0xef, 0x01, 0x01, 0x01, 0xf8, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07e4, 0x07e0, 0x07dc, 0x0207, 0x0208, 0x0209),
+        },
+        {
+                .freq                   = 5050,
+                RADIOREGS3(0xef, 0x01, 0x01, 0x01, 0xf9, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07e8, 0x07e4, 0x07e0, 0x0206, 0x0207, 0x0208),
+        },
+        {
+                .freq                   = 5060,
+                RADIOREGS3(0xe6, 0x01, 0x01, 0x01, 0xfa, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfe, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfe, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07ec, 0x07e8, 0x07e4, 0x0205, 0x0206, 0x0207),
+        },
+        {
+                .freq                   = 5070,
+                RADIOREGS3(0xe6, 0x01, 0x01, 0x01, 0xfb, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfd, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfd, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07f0, 0x07ec, 0x07e8, 0x0204, 0x0205, 0x0206),
+        },
+        {
+                .freq                   = 5080,
+                RADIOREGS3(0xde, 0x01, 0x01, 0x01, 0xfc, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfd, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfd, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07f4, 0x07f0, 0x07ec, 0x0203, 0x0204, 0x0205),
+        },
+        {
+                .freq                   = 5090,
+                RADIOREGS3(0xde, 0x01, 0x01, 0x01, 0xfd, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x01, 0x01, 0x01, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfd, 0x00, 0x09, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfd, 0x00, 0x09, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07f8, 0x07f4, 0x07f0, 0x0202, 0x0203, 0x0204),
+        },
+        {
+                .freq                   = 5100,
+                RADIOREGS3(0xd6, 0x01, 0x01, 0x01, 0xfe, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfd, 0x00, 0x08, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfd, 0x00, 0x08, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x07fc, 0x07f8, 0x07f4, 0x0201, 0x0202, 0x0203),
+        },
+        {
+                .freq                   = 5110,
+                RADIOREGS3(0xd6, 0x01, 0x01, 0x01, 0xff, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfc, 0x00, 0x08, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfc, 0x00, 0x08, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0800, 0x07fc, 0x07f8, 0x0200, 0x0201, 0x0202),
+        },
+        {
+                .freq                   = 5120,
+                RADIOREGS3(0xce, 0x01, 0x01, 0x02, 0x00, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfc, 0x00, 0x08, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfc, 0x00, 0x08, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0804, 0x0800, 0x07fc, 0x01ff, 0x0200, 0x0201),
+        },
+        {
+                .freq                   = 5130,
+                RADIOREGS3(0xce, 0x01, 0x01, 0x02, 0x01, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfc, 0x00, 0x08, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfc, 0x00, 0x08, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0808, 0x0804, 0x0800, 0x01fe, 0x01ff, 0x0200),
+        },
+        {
+                .freq                   = 5140,
+                RADIOREGS3(0xc6, 0x01, 0x01, 0x02, 0x02, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfb, 0x00, 0x08, 0x00, 0x77, 0x00, 0x0f,
+                           0x00, 0x6f, 0x00, 0xfb, 0x00, 0x08, 0x00, 0x77,
+                           0x00, 0x0f, 0x00, 0x6f, 0x00),
+                PHYREGS(0x080c, 0x0808, 0x0804, 0x01fd, 0x01fe, 0x01ff),
+        },
+        {
+                .freq                   = 5160,
+                RADIOREGS3(0xbe, 0x01, 0x01, 0x02, 0x04, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfa, 0x00, 0x07, 0x00, 0x77, 0x00, 0x0e,
+                           0x00, 0x6f, 0x00, 0xfa, 0x00, 0x07, 0x00, 0x77,
+                           0x00, 0x0e, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0814, 0x0810, 0x080c, 0x01fb, 0x01fc, 0x01fd),
+        },
+        {
+                .freq                   = 5170,
+                RADIOREGS3(0xbe, 0x01, 0x01, 0x02, 0x05, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                           0xff, 0xfa, 0x00, 0x07, 0x00, 0x77, 0x00, 0x0e,
+                           0x00, 0x6f, 0x00, 0xfa, 0x00, 0x07, 0x00, 0x77,
+                           0x00, 0x0e, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0818, 0x0814, 0x0810, 0x01fa, 0x01fb, 0x01fc),
+        },
+        {
+                .freq                   = 5180,
+                RADIOREGS3(0xb6, 0x01, 0x01, 0x02, 0x06, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                           0xff, 0xf9, 0x00, 0x06, 0x00, 0x77, 0x00, 0x0e,
+                           0x00, 0x6f, 0x00, 0xf9, 0x00, 0x06, 0x00, 0x77,
+                           0x00, 0x0e, 0x00, 0x6f, 0x00),
+                PHYREGS(0x081c, 0x0818, 0x0814, 0x01f9, 0x01fa, 0x01fb),
+        },
+        {
+                .freq                   = 5190,
+                RADIOREGS3(0xb6, 0x01, 0x01, 0x02, 0x07, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                           0xff, 0xf9, 0x00, 0x06, 0x00, 0x77, 0x00, 0x0d,
+                           0x00, 0x6f, 0x00, 0xf9, 0x00, 0x06, 0x00, 0x77,
+                           0x00, 0x0d, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0820, 0x081c, 0x0818, 0x01f8, 0x01f9, 0x01fa),
+        },
+        {
+                .freq                   = 5200,
+                RADIOREGS3(0xaf, 0x01, 0x01, 0x02, 0x08, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                           0xff, 0xf9, 0x00, 0x05, 0x00, 0x77, 0x00, 0x0d,
+                           0x00, 0x6f, 0x00, 0xf9, 0x00, 0x05, 0x00, 0x77,
+                           0x00, 0x0d, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0824, 0x0820, 0x081c, 0x01f7, 0x01f8, 0x01f9),
+        },
+        {
+                .freq                   = 5210,
+                RADIOREGS3(0xaf, 0x01, 0x01, 0x02, 0x09, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x02, 0x02, 0x02, 0x8f, 0x0f, 0x00,
+                           0xff, 0xf9, 0x00, 0x05, 0x00, 0x77, 0x00, 0x0d,
+                           0x00, 0x6f, 0x00, 0xf9, 0x00, 0x05, 0x00, 0x77,
+                           0x00, 0x0d, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0828, 0x0824, 0x0820, 0x01f6, 0x01f7, 0x01f8),
+        },
+        {
+                .freq                   = 5220,
+                RADIOREGS3(0xa7, 0x01, 0x01, 0x02, 0x0a, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x02, 0x02, 0x02, 0x8e, 0x0f, 0x00,
+                           0xfe, 0xd8, 0x00, 0x05, 0x00, 0x77, 0x00, 0x0d,
+                           0x00, 0x6f, 0x00, 0xd8, 0x00, 0x05, 0x00, 0x77,
+                           0x00, 0x0d, 0x00, 0x6f, 0x00),
+                PHYREGS(0x082c, 0x0828, 0x0824, 0x01f5, 0x01f6, 0x01f7),
+        },
+        {
+                .freq                   = 5230,
+                RADIOREGS3(0xa7, 0x01, 0x01, 0x02, 0x0b, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x02, 0x02, 0x02, 0x8e, 0x0f, 0x00,
+                           0xee, 0xd8, 0x00, 0x05, 0x00, 0x77, 0x00, 0x0d,
+                           0x00, 0x6f, 0x00, 0xd8, 0x00, 0x05, 0x00, 0x77,
+                           0x00, 0x0d, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0830, 0x082c, 0x0828, 0x01f4, 0x01f5, 0x01f6),
+        },
+        {
+                .freq                   = 5240,
+                RADIOREGS3(0xa0, 0x01, 0x01, 0x02, 0x0c, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x02, 0x02, 0x02, 0x8e, 0x0f, 0x00,
+                           0xee, 0xc8, 0x00, 0x05, 0x00, 0x77, 0x00, 0x0d,
+                           0x00, 0x6f, 0x00, 0xc8, 0x00, 0x05, 0x00, 0x77,
+                           0x00, 0x0d, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0834, 0x0830, 0x082c, 0x01f3, 0x01f4, 0x01f5),
+        },
+        {
+                .freq                   = 5250,
+                RADIOREGS3(0xa0, 0x01, 0x01, 0x02, 0x0d, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x02, 0x02, 0x02, 0x8e, 0x0f, 0x00,
+                           0xed, 0xc7, 0x00, 0x05, 0x00, 0x77, 0x00, 0x0d,
+                           0x00, 0x6f, 0x00, 0xc7, 0x00, 0x05, 0x00, 0x77,
+                           0x00, 0x0d, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0838, 0x0834, 0x0830, 0x01f2, 0x01f3, 0x01f4),
+        },
+        {
+                .freq                   = 5260,
+                RADIOREGS3(0x98, 0x01, 0x01, 0x02, 0x0e, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x02, 0x02, 0x02, 0x8e, 0x0e, 0x00,
+                           0xed, 0xc7, 0x00, 0x04, 0x00, 0x77, 0x00, 0x0d,
+                           0x00, 0x6f, 0x00, 0xc7, 0x00, 0x04, 0x00, 0x77,
+                           0x00, 0x0d, 0x00, 0x6f, 0x00),
+                PHYREGS(0x083c, 0x0838, 0x0834, 0x01f1, 0x01f2, 0x01f3),
+        },
+        {
+                .freq                   = 5270,
+                RADIOREGS3(0x98, 0x01, 0x01, 0x02, 0x0f, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8e, 0x0e, 0x00,
+                           0xed, 0xc7, 0x00, 0x04, 0x00, 0x77, 0x00, 0x0c,
+                           0x00, 0x6f, 0x00, 0xc7, 0x00, 0x04, 0x00, 0x77,
+                           0x00, 0x0c, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0840, 0x083c, 0x0838, 0x01f0, 0x01f1, 0x01f2),
+        },
+        {
+                .freq                   = 5280,
+                RADIOREGS3(0x91, 0x01, 0x01, 0x02, 0x10, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0e, 0x00,
+                           0xdc, 0xb7, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0c,
+                           0x00, 0x6f, 0x00, 0xb7, 0x00, 0x03, 0x00, 0x77,
+                           0x00, 0x0c, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0844, 0x0840, 0x083c, 0x01f0, 0x01f0, 0x01f1),
+        },
+        {
+                .freq                   = 5290,
+                RADIOREGS3(0x91, 0x01, 0x01, 0x02, 0x11, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0e, 0x00,
+                           0xdc, 0xb7, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0c,
+                           0x00, 0x6f, 0x00, 0xb7, 0x00, 0x03, 0x00, 0x77,
+                           0x00, 0x0c, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0848, 0x0844, 0x0840, 0x01ef, 0x01f0, 0x01f0),
+        },
+        {
+                .freq                   = 5300,
+                RADIOREGS3(0x8a, 0x01, 0x01, 0x02, 0x12, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0e, 0x00,
+                           0xdc, 0xb7, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0c,
+                           0x00, 0x6f, 0x00, 0xb7, 0x00, 0x03, 0x00, 0x77,
+                           0x00, 0x0c, 0x00, 0x6f, 0x00),
+                PHYREGS(0x084c, 0x0848, 0x0844, 0x01ee, 0x01ef, 0x01f0),
+        },
+        {
+                .freq                   = 5310,
+                RADIOREGS3(0x8a, 0x01, 0x01, 0x02, 0x13, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0e, 0x00,
+                           0xdc, 0xb7, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0c,
+                           0x00, 0x6f, 0x00, 0xb7, 0x00, 0x03, 0x00, 0x77,
+                           0x00, 0x0c, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0850, 0x084c, 0x0848, 0x01ed, 0x01ee, 0x01ef),
+        },
+        {
+                .freq                   = 5320,
+                RADIOREGS3(0x83, 0x01, 0x01, 0x02, 0x14, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0e, 0x00,
+                           0xdb, 0xb7, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0c,
+                           0x00, 0x6f, 0x00, 0xb7, 0x00, 0x03, 0x00, 0x77,
+                           0x00, 0x0c, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0854, 0x0850, 0x084c, 0x01ec, 0x01ed, 0x01ee),
+        },
+        {
+                .freq                   = 5330,
+                RADIOREGS3(0x83, 0x01, 0x01, 0x02, 0x15, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0d, 0x00,
+                           0xcb, 0xa6, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0b,
+                           0x00, 0x6f, 0x00, 0xa6, 0x00, 0x03, 0x00, 0x77,
+                           0x00, 0x0b, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0858, 0x0854, 0x0850, 0x01eb, 0x01ec, 0x01ed),
+        },
+        {
+                .freq                   = 5340,
+                RADIOREGS3(0x7c, 0x01, 0x01, 0x02, 0x16, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8d, 0x0d, 0x00,
+                           0xca, 0xa6, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0b,
+                           0x00, 0x6f, 0x00, 0xa6, 0x00, 0x03, 0x00, 0x77,
+                           0x00, 0x0b, 0x00, 0x6f, 0x00),
+                PHYREGS(0x085c, 0x0858, 0x0854, 0x01ea, 0x01eb, 0x01ec),
+        },
+        {
+                .freq                   = 5350,
+                RADIOREGS3(0x7c, 0x01, 0x01, 0x02, 0x17, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0d, 0x00,
+                           0xca, 0xa6, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0b,
+                           0x00, 0x6f, 0x00, 0xa6, 0x00, 0x03, 0x00, 0x77,
+                           0x00, 0x0b, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0860, 0x085c, 0x0858, 0x01e9, 0x01ea, 0x01eb),
+        },
+        {
+                .freq                   = 5360,
+                RADIOREGS3(0x75, 0x01, 0x01, 0x02, 0x18, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0d, 0x00,
+                           0xc9, 0x95, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0a,
+                           0x00, 0x6f, 0x00, 0x95, 0x00, 0x03, 0x00, 0x77,
+                           0x00, 0x0a, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0864, 0x0860, 0x085c, 0x01e8, 0x01e9, 0x01ea),
+        },
+        {
+                .freq                   = 5370,
+                RADIOREGS3(0x75, 0x01, 0x01, 0x02, 0x19, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0d, 0x00,
+                           0xc9, 0x95, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0a,
+                           0x00, 0x6f, 0x00, 0x95, 0x00, 0x03, 0x00, 0x77,
+                           0x00, 0x0a, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0868, 0x0864, 0x0860, 0x01e7, 0x01e8, 0x01e9),
+        },
+        {
+                .freq                   = 5380,
+                RADIOREGS3(0x6e, 0x01, 0x01, 0x02, 0x1a, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0c, 0x00,
+                           0xb8, 0x95, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0a,
+                           0x00, 0x6f, 0x00, 0x95, 0x00, 0x03, 0x00, 0x77,
+                           0x00, 0x0a, 0x00, 0x6f, 0x00),
+                PHYREGS(0x086c, 0x0868, 0x0864, 0x01e6, 0x01e7, 0x01e8),
+        },
+        {
+                .freq                   = 5390,
+                RADIOREGS3(0x6e, 0x01, 0x01, 0x02, 0x1b, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0c, 0x00,
+                           0xb8, 0x84, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0a,
+                           0x00, 0x6f, 0x00, 0x84, 0x00, 0x03, 0x00, 0x77,
+                           0x00, 0x0a, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0870, 0x086c, 0x0868, 0x01e5, 0x01e6, 0x01e7),
+        },
+        {
+                .freq                   = 5400,
+                RADIOREGS3(0x67, 0x01, 0x01, 0x02, 0x1c, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0c, 0x00,
+                           0xb8, 0x84, 0x00, 0x03, 0x00, 0x77, 0x00, 0x0a,
+                           0x00, 0x6f, 0x00, 0x84, 0x00, 0x03, 0x00, 0x77,
+                           0x00, 0x0a, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0874, 0x0870, 0x086c, 0x01e5, 0x01e5, 0x01e6),
+        },
+        {
+                .freq                   = 5410,
+                RADIOREGS3(0x67, 0x01, 0x01, 0x02, 0x1d, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0c, 0x00,
+                           0xb7, 0x84, 0x00, 0x02, 0x00, 0x77, 0x00, 0x0a,
+                           0x00, 0x6f, 0x00, 0x84, 0x00, 0x02, 0x00, 0x77,
+                           0x00, 0x0a, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0878, 0x0874, 0x0870, 0x01e4, 0x01e5, 0x01e5),
+        },
+        {
+                .freq                   = 5420,
+                RADIOREGS3(0x61, 0x01, 0x01, 0x02, 0x1e, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0c, 0x00,
+                           0xa7, 0x84, 0x00, 0x02, 0x00, 0x77, 0x00, 0x0a,
+                           0x00, 0x6f, 0x00, 0x84, 0x00, 0x02, 0x00, 0x77,
+                           0x00, 0x0a, 0x00, 0x6f, 0x00),
+                PHYREGS(0x087c, 0x0878, 0x0874, 0x01e3, 0x01e4, 0x01e5),
+        },
+        {
+                .freq                   = 5430,
+                RADIOREGS3(0x61, 0x01, 0x01, 0x02, 0x1f, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x03, 0x03, 0x03, 0x8c, 0x0b, 0x00,
+                           0xa6, 0x84, 0x00, 0x02, 0x00, 0x77, 0x00, 0x0a,
+                           0x00, 0x6f, 0x00, 0x84, 0x00, 0x02, 0x00, 0x77,
+                           0x00, 0x0a, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0880, 0x087c, 0x0878, 0x01e2, 0x01e3, 0x01e4),
+        },
+        {
+                .freq                   = 5440,
+                RADIOREGS3(0x5a, 0x01, 0x01, 0x02, 0x20, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x8b, 0x0b, 0x00,
+                           0xa6, 0x84, 0x00, 0x02, 0x00, 0x77, 0x00, 0x09,
+                           0x00, 0x6f, 0x00, 0x84, 0x00, 0x02, 0x00, 0x77,
+                           0x00, 0x09, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0884, 0x0880, 0x087c, 0x01e1, 0x01e2, 0x01e3),
+        },
+        {
+                .freq                   = 5450,
+                RADIOREGS3(0x5a, 0x01, 0x01, 0x02, 0x21, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x8b, 0x0b, 0x00,
+                           0x95, 0x84, 0x00, 0x01, 0x00, 0x77, 0x00, 0x09,
+                           0x00, 0x6f, 0x00, 0x84, 0x00, 0x01, 0x00, 0x77,
+                           0x00, 0x09, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0888, 0x0884, 0x0880, 0x01e0, 0x01e1, 0x01e2),
+        },
+        {
+                .freq                   = 5460,
+                RADIOREGS3(0x53, 0x01, 0x01, 0x02, 0x22, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x8b, 0x0b, 0x00,
+                           0x95, 0x84, 0x00, 0x01, 0x00, 0x77, 0x00, 0x09,
+                           0x00, 0x6f, 0x00, 0x84, 0x00, 0x01, 0x00, 0x77,
+                           0x00, 0x09, 0x00, 0x6f, 0x00),
+                PHYREGS(0x088c, 0x0888, 0x0884, 0x01df, 0x01e0, 0x01e1),
+        },
+        {
+                .freq                   = 5470,
+                RADIOREGS3(0x53, 0x01, 0x01, 0x02, 0x23, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x8b, 0x0b, 0x00,
+                           0x94, 0x73, 0x00, 0x01, 0x00, 0x77, 0x00, 0x09,
+                           0x00, 0x6f, 0x00, 0x73, 0x00, 0x01, 0x00, 0x77,
+                           0x00, 0x09, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0890, 0x088c, 0x0888, 0x01de, 0x01df, 0x01e0),
+        },
+        {
+                .freq                   = 5480,
+                RADIOREGS3(0x4d, 0x01, 0x01, 0x02, 0x24, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x0a, 0x00,
+                           0x84, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                           0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x09, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0894, 0x0890, 0x088c, 0x01dd, 0x01de, 0x01df),
+        },
+        {
+                .freq                   = 5490,
+                RADIOREGS3(0x4d, 0x01, 0x01, 0x02, 0x25, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x0a, 0x00,
+                           0x83, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                           0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x09, 0x00, 0x6f, 0x00),
+                PHYREGS(0x0898, 0x0894, 0x0890, 0x01dd, 0x01dd, 0x01de),
+        },
+        {
+                .freq                   = 5500,
+                RADIOREGS3(0x47, 0x01, 0x01, 0x02, 0x26, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x0a, 0x00,
+                           0x82, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                           0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x09, 0x00, 0x6f, 0x00),
+                PHYREGS(0x089c, 0x0898, 0x0894, 0x01dc, 0x01dd, 0x01dd),
+        },
+        {
+                .freq                   = 5510,
+                RADIOREGS3(0x47, 0x01, 0x01, 0x02, 0x27, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x0a, 0x00,
+                           0x82, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                           0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x09, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08a0, 0x089c, 0x0898, 0x01db, 0x01dc, 0x01dd),
+        },
+        {
+                .freq                   = 5520,
+                RADIOREGS3(0x40, 0x01, 0x01, 0x02, 0x28, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x0a, 0x00,
+                           0x72, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                           0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x09, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08a4, 0x08a0, 0x089c, 0x01da, 0x01db, 0x01dc),
+        },
+        {
+                .freq                   = 5530,
+                RADIOREGS3(0x40, 0x01, 0x01, 0x02, 0x29, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x09, 0x00,
+                           0x72, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                           0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x09, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08a8, 0x08a4, 0x08a0, 0x01d9, 0x01da, 0x01db),
+        },
+        {
+                .freq                   = 5540,
+                RADIOREGS3(0x3a, 0x01, 0x01, 0x02, 0x2a, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x8a, 0x09, 0x00,
+                           0x71, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                           0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x09, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08ac, 0x08a8, 0x08a4, 0x01d8, 0x01d9, 0x01da),
+        },
+        {
+                .freq                   = 5550,
+                RADIOREGS3(0x3a, 0x01, 0x01, 0x02, 0x2b, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x89, 0x09, 0x00,
+                           0x61, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                           0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x09, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08b0, 0x08ac, 0x08a8, 0x01d7, 0x01d8, 0x01d9),
+        },
+        {
+                .freq                   = 5560,
+                RADIOREGS3(0x34, 0x01, 0x01, 0x02, 0x2c, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x89, 0x09, 0x00,
+                           0x61, 0x73, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                           0x00, 0x6f, 0x00, 0x73, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x09, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08b4, 0x08b0, 0x08ac, 0x01d7, 0x01d7, 0x01d8),
+        },
+        {
+                .freq                   = 5570,
+                RADIOREGS3(0x34, 0x01, 0x01, 0x02, 0x2d, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x89, 0x09, 0x00,
+                           0x61, 0x62, 0x00, 0x00, 0x00, 0x77, 0x00, 0x09,
+                           0x00, 0x6f, 0x00, 0x62, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x09, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08b8, 0x08b4, 0x08b0, 0x01d6, 0x01d7, 0x01d7),
+        },
+        {
+                .freq                   = 5580,
+                RADIOREGS3(0x2e, 0x01, 0x01, 0x02, 0x2e, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x89, 0x08, 0x00,
+                           0x60, 0x62, 0x00, 0x00, 0x00, 0x77, 0x00, 0x08,
+                           0x00, 0x6f, 0x00, 0x62, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x08, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08bc, 0x08b8, 0x08b4, 0x01d5, 0x01d6, 0x01d7),
+        },
+        {
+                .freq                   = 5590,
+                RADIOREGS3(0x2e, 0x01, 0x01, 0x02, 0x2f, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x04, 0x04, 0x04, 0x89, 0x08, 0x00,
+                           0x50, 0x61, 0x00, 0x00, 0x00, 0x77, 0x00, 0x08,
+                           0x00, 0x6f, 0x00, 0x61, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x08, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08c0, 0x08bc, 0x08b8, 0x01d4, 0x01d5, 0x01d6),
+        },
+        {
+                .freq                   = 5600,
+                RADIOREGS3(0x28, 0x01, 0x01, 0x02, 0x30, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x89, 0x08, 0x00,
+                           0x50, 0x51, 0x00, 0x00, 0x00, 0x77, 0x00, 0x08,
+                           0x00, 0x6f, 0x00, 0x51, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x08, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08c4, 0x08c0, 0x08bc, 0x01d3, 0x01d4, 0x01d5),
+        },
+        {
+                .freq                   = 5610,
+                RADIOREGS3(0x28, 0x01, 0x01, 0x02, 0x31, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x89, 0x08, 0x00,
+                           0x50, 0x51, 0x00, 0x00, 0x00, 0x77, 0x00, 0x08,
+                           0x00, 0x6f, 0x00, 0x51, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x08, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08c8, 0x08c4, 0x08c0, 0x01d2, 0x01d3, 0x01d4),
+        },
+        {
+                .freq                   = 5620,
+                RADIOREGS3(0x21, 0x01, 0x01, 0x02, 0x32, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x89, 0x08, 0x00,
+                           0x50, 0x50, 0x00, 0x00, 0x00, 0x77, 0x00, 0x07,
+                           0x00, 0x6f, 0x00, 0x50, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x07, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08cc, 0x08c8, 0x08c4, 0x01d2, 0x01d2, 0x01d3),
+        },
+        {
+                .freq                   = 5630,
+                RADIOREGS3(0x21, 0x01, 0x01, 0x02, 0x33, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x88, 0x07, 0x00,
+                           0x50, 0x50, 0x00, 0x00, 0x00, 0x77, 0x00, 0x07,
+                           0x00, 0x6f, 0x00, 0x50, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x07, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08d0, 0x08cc, 0x08c8, 0x01d1, 0x01d2, 0x01d2),
+        },
+        {
+                .freq                   = 5640,
+                RADIOREGS3(0x1c, 0x01, 0x01, 0x02, 0x34, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x88, 0x07, 0x00,
+                           0x40, 0x50, 0x00, 0x00, 0x00, 0x77, 0x00, 0x07,
+                           0x00, 0x6f, 0x00, 0x50, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x07, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08d4, 0x08d0, 0x08cc, 0x01d0, 0x01d1, 0x01d2),
+        },
+        {
+                .freq                   = 5650,
+                RADIOREGS3(0x1c, 0x01, 0x01, 0x02, 0x35, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x88, 0x07, 0x00,
+                           0x40, 0x40, 0x00, 0x00, 0x00, 0x77, 0x00, 0x07,
+                           0x00, 0x6f, 0x00, 0x40, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x07, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08d8, 0x08d4, 0x08d0, 0x01cf, 0x01d0, 0x01d1),
+        },
+        {
+                .freq                   = 5660,
+                RADIOREGS3(0x16, 0x01, 0x01, 0x02, 0x36, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x88, 0x07, 0x00,
+                           0x40, 0x40, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                           0x00, 0x6f, 0x00, 0x40, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x06, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08dc, 0x08d8, 0x08d4, 0x01ce, 0x01cf, 0x01d0),
+        },
+        {
+                .freq                   = 5670,
+                RADIOREGS3(0x16, 0x01, 0x01, 0x02, 0x37, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x88, 0x07, 0x00,
+                           0x40, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                           0x00, 0x6f, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x06, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08e0, 0x08dc, 0x08d8, 0x01ce, 0x01ce, 0x01cf),
+        },
+        {
+                .freq                   = 5680,
+                RADIOREGS3(0x10, 0x01, 0x01, 0x02, 0x38, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                           0x30, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                           0x00, 0x6f, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x06, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08e4, 0x08e0, 0x08dc, 0x01cd, 0x01ce, 0x01ce),
+        },
+        {
+                .freq                   = 5690,
+                RADIOREGS3(0x10, 0x01, 0x01, 0x02, 0x39, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                           0x30, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                           0x00, 0x6f, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x06, 0x00, 0x6f, 0x00),
+                PHYREGS(0x08e8, 0x08e4, 0x08e0, 0x01cc, 0x01cd, 0x01ce),
+        },
+        {
+                .freq                   = 5700,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3a, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                           0x30, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                           0x00, 0x6e, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x06, 0x00, 0x6e, 0x00),
+                PHYREGS(0x08ec, 0x08e8, 0x08e4, 0x01cb, 0x01cc, 0x01cd),
+        },
+        {
+                .freq                   = 5710,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3b, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                           0x30, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                           0x00, 0x6e, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x06, 0x00, 0x6e, 0x00),
+                PHYREGS(0x08f0, 0x08ec, 0x08e8, 0x01ca, 0x01cb, 0x01cc),
+        },
+        {
+                .freq                   = 5720,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3c, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                           0x30, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                           0x00, 0x6e, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x06, 0x00, 0x6e, 0x00),
+                PHYREGS(0x08f4, 0x08f0, 0x08ec, 0x01c9, 0x01ca, 0x01cb),
+        },
+        {
+                .freq                   = 5725,
+                RADIOREGS3(0x03, 0x01, 0x02, 0x04, 0x79, 0x05, 0x05, 0x02,
+                           0x15, 0x01, 0x05, 0x05, 0x05, 0x87, 0x06, 0x00,
+                           0x30, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                           0x00, 0x6e, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x06, 0x00, 0x6e, 0x00),
+                PHYREGS(0x08f6, 0x08f2, 0x08ee, 0x01c9, 0x01ca, 0x01cb),
+        },
+        {
+                .freq                   = 5730,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3d, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
+                           0x20, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                           0x00, 0x6e, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x06, 0x00, 0x6e, 0x00),
+                PHYREGS(0x08f8, 0x08f4, 0x08f0, 0x01c9, 0x01c9, 0x01ca),
+        },
+        {
+                .freq                   = 5735,
+                RADIOREGS3(0x03, 0x01, 0x02, 0x04, 0x7b, 0x05, 0x05, 0x02,
+                           0x15, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
+                           0x20, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                           0x00, 0x6d, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x06, 0x00, 0x6d, 0x00),
+                PHYREGS(0x08fa, 0x08f6, 0x08f2, 0x01c8, 0x01c9, 0x01ca),
+        },
+        {
+                .freq                   = 5740,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3e, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
+                           0x20, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                           0x00, 0x6d, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x06, 0x00, 0x6d, 0x00),
+                PHYREGS(0x08fc, 0x08f8, 0x08f4, 0x01c8, 0x01c9, 0x01c9),
+        },
+        {
+                .freq                   = 5745,
+                RADIOREGS3(0xfe, 0x00, 0x02, 0x04, 0x7d, 0x05, 0x05, 0x02,
+                           0x15, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
+                           0x20, 0x30, 0x00, 0x00, 0x00, 0x77, 0x00, 0x06,
+                           0x00, 0x6d, 0x00, 0x30, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x06, 0x00, 0x6d, 0x00),
+                PHYREGS(0x08fe, 0x08fa, 0x08f6, 0x01c8, 0x01c8, 0x01c9),
+        },
+        {
+                .freq                   = 5750,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x3f, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
+                           0x20, 0x20, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x6d, 0x00, 0x20, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x6d, 0x00),
+                PHYREGS(0x0900, 0x08fc, 0x08f8, 0x01c7, 0x01c8, 0x01c9),
+        },
+        {
+                .freq                   = 5755,
+                RADIOREGS3(0xfe, 0x00, 0x02, 0x04, 0x7f, 0x05, 0x05, 0x02,
+                           0x15, 0x01, 0x05, 0x05, 0x05, 0x87, 0x05, 0x00,
+                           0x10, 0x20, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x6c, 0x00, 0x20, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x6c, 0x00),
+                PHYREGS(0x0902, 0x08fe, 0x08fa, 0x01c7, 0x01c8, 0x01c8),
+        },
+        {
+                .freq                   = 5760,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x40, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x86, 0x05, 0x00,
+                           0x10, 0x20, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x6c, 0x00, 0x20, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x6c, 0x00),
+                PHYREGS(0x0904, 0x0900, 0x08fc, 0x01c6, 0x01c7, 0x01c8),
+        },
+        {
+                .freq                   = 5765,
+                RADIOREGS3(0xf8, 0x00, 0x02, 0x04, 0x81, 0x05, 0x05, 0x02,
+                           0x15, 0x01, 0x05, 0x05, 0x05, 0x86, 0x05, 0x00,
+                           0x10, 0x10, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x6c, 0x00, 0x10, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x6c, 0x00),
+                PHYREGS(0x0906, 0x0902, 0x08fe, 0x01c6, 0x01c7, 0x01c8),
+        },
+        {
+                .freq                   = 5770,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x41, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x86, 0x04, 0x00,
+                           0x10, 0x10, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x6b, 0x00, 0x10, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x6b, 0x00),
+                PHYREGS(0x0908, 0x0904, 0x0900, 0x01c6, 0x01c6, 0x01c7),
+        },
+        {
+                .freq                   = 5775,
+                RADIOREGS3(0xf8, 0x00, 0x02, 0x04, 0x83, 0x05, 0x05, 0x02,
+                           0x15, 0x01, 0x05, 0x05, 0x05, 0x86, 0x04, 0x00,
+                           0x10, 0x10, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x6b, 0x00, 0x10, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x6b, 0x00),
+                PHYREGS(0x090a, 0x0906, 0x0902, 0x01c5, 0x01c6, 0x01c7),
+        },
+        {
+                .freq                   = 5780,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x42, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x05, 0x05, 0x05, 0x86, 0x04, 0x00,
+                           0x10, 0x10, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x6b, 0x00, 0x10, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x6b, 0x00),
+                PHYREGS(0x090c, 0x0908, 0x0904, 0x01c5, 0x01c6, 0x01c6),
+        },
+        {
+                .freq                   = 5785,
+                RADIOREGS3(0xf2, 0x00, 0x02, 0x04, 0x85, 0x05, 0x05, 0x02,
+                           0x15, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                           0x00, 0x10, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x6b, 0x00, 0x10, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x6b, 0x00),
+                PHYREGS(0x090e, 0x090a, 0x0906, 0x01c4, 0x01c5, 0x01c6),
+        },
+        {
+                .freq                   = 5790,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x43, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                           0x00, 0x10, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x6b, 0x00, 0x10, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x6b, 0x00),
+                PHYREGS(0x0910, 0x090c, 0x0908, 0x01c4, 0x01c5, 0x01c6),
+        },
+        {
+                .freq                   = 5795,
+                RADIOREGS3(0xf2, 0x00, 0x02, 0x04, 0x87, 0x05, 0x05, 0x02,
+                           0x15, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x6b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x6b, 0x00),
+                PHYREGS(0x0912, 0x090e, 0x090a, 0x01c4, 0x01c4, 0x01c5),
+        },
+        {
+                .freq                   = 5800,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x44, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x6b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x6b, 0x00),
+                PHYREGS(0x0914, 0x0910, 0x090c, 0x01c3, 0x01c4, 0x01c5),
+        },
+        {
+                .freq                   = 5805,
+                RADIOREGS3(0xed, 0x00, 0x02, 0x04, 0x89, 0x05, 0x05, 0x02,
+                           0x15, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x6a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x6a, 0x00),
+                PHYREGS(0x0916, 0x0912, 0x090e, 0x01c3, 0x01c4, 0x01c4),
+        },
+        {
+                .freq                   = 5810,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x45, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x6a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x6a, 0x00),
+                PHYREGS(0x0918, 0x0914, 0x0910, 0x01c2, 0x01c3, 0x01c4),
+        },
+        {
+                .freq                   = 5815,
+                RADIOREGS3(0xed, 0x00, 0x02, 0x04, 0x8b, 0x05, 0x05, 0x02,
+                           0x15, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x6a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x6a, 0x00),
+                PHYREGS(0x091a, 0x0916, 0x0912, 0x01c2, 0x01c3, 0x01c4),
+        },
+        {
+                .freq                   = 5820,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x46, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x6a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x6a, 0x00),
+                PHYREGS(0x091c, 0x0918, 0x0914, 0x01c2, 0x01c2, 0x01c3),
+        },
+        {
+                .freq                   = 5825,
+                RADIOREGS3(0xed, 0x00, 0x02, 0x04, 0x8d, 0x05, 0x05, 0x02,
+                           0x15, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x69, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x69, 0x00),
+                PHYREGS(0x091e, 0x091a, 0x0916, 0x01c1, 0x01c2, 0x01c3),
+        },
+        {
+                .freq                   = 5830,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x47, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x05,
+                           0x00, 0x69, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x05, 0x00, 0x69, 0x00),
+                PHYREGS(0x0920, 0x091c, 0x0918, 0x01c1, 0x01c2, 0x01c2),
+        },
+        {
+                .freq                   = 5840,
+                RADIOREGS3(0x0a, 0x01, 0x01, 0x02, 0x48, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x06, 0x06, 0x06, 0x86, 0x04, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                           0x00, 0x69, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x04, 0x00, 0x69, 0x00),
+                PHYREGS(0x0924, 0x0920, 0x091c, 0x01c0, 0x01c1, 0x01c2),
+        },
+        {
+                .freq                   = 5850,
+                RADIOREGS3(0xe0, 0x00, 0x01, 0x02, 0x49, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                           0x00, 0x69, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x04, 0x00, 0x69, 0x00),
+                PHYREGS(0x0928, 0x0924, 0x0920, 0x01bf, 0x01c0, 0x01c1),
+        },
+        {
+                .freq                   = 5860,
+                RADIOREGS3(0xde, 0x00, 0x01, 0x02, 0x4a, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                           0x00, 0x69, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x04, 0x00, 0x69, 0x00),
+                PHYREGS(0x092c, 0x0928, 0x0924, 0x01bf, 0x01bf, 0x01c0),
+        },
+        {
+                .freq                   = 5870,
+                RADIOREGS3(0xdb, 0x00, 0x01, 0x02, 0x4b, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                           0x00, 0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x04, 0x00, 0x68, 0x00),
+                PHYREGS(0x0930, 0x092c, 0x0928, 0x01be, 0x01bf, 0x01bf),
+        },
+        {
+                .freq                   = 5880,
+                RADIOREGS3(0xd8, 0x00, 0x01, 0x02, 0x4c, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                           0x00, 0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x04, 0x00, 0x68, 0x00),
+                PHYREGS(0x0934, 0x0930, 0x092c, 0x01bd, 0x01be, 0x01bf),
+        },
+        {
+                .freq                   = 5890,
+                RADIOREGS3(0xd6, 0x00, 0x01, 0x02, 0x4d, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                           0x00, 0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x04, 0x00, 0x68, 0x00),
+                PHYREGS(0x0938, 0x0934, 0x0930, 0x01bc, 0x01bd, 0x01be),
+        },
+        {
+                .freq                   = 5900,
+                RADIOREGS3(0xd3, 0x00, 0x01, 0x02, 0x4e, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                           0x00, 0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x04, 0x00, 0x68, 0x00),
+                PHYREGS(0x093c, 0x0938, 0x0934, 0x01bc, 0x01bc, 0x01bd),
+        },
+        {
+                .freq                   = 5910,
+                RADIOREGS3(0xd6, 0x00, 0x01, 0x02, 0x4f, 0x05, 0x05, 0x02,
+                           0x0c, 0x01, 0x06, 0x06, 0x06, 0x85, 0x03, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x00, 0x77, 0x00, 0x04,
+                           0x00, 0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x77,
+                           0x00, 0x04, 0x00, 0x68, 0x00),
+                PHYREGS(0x0940, 0x093c, 0x0938, 0x01bb, 0x01bc, 0x01bc),
+        },
+        {
+                .freq                   = 2412,
+                RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x6c, 0x06, 0x06, 0x04,
+                           0x2b, 0x01, 0x04, 0x04, 0x04, 0x8f, 0x30, 0x00,
+                           0x00, 0x00, 0x78, 0x00, 0x03, 0x00, 0x70, 0x00,
+                           0x0b, 0x00, 0x0a, 0x00, 0x89, 0x00, 0x03, 0x00,
+                           0x70, 0x00, 0x0b, 0x00, 0x0a),
+                PHYREGS(0x03c9, 0x03c5, 0x03c1, 0x043a, 0x043f, 0x0443),
+        },
+        {
+                .freq                   = 2417,
+                RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x71, 0x06, 0x06, 0x04,
+                           0x2b, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                           0x00, 0x00, 0x78, 0x00, 0x03, 0x00, 0x70, 0x00,
+                           0x0b, 0x00, 0x0a, 0x00, 0x89, 0x00, 0x03, 0x00,
+                           0x70, 0x00, 0x0b, 0x00, 0x0a),
+                PHYREGS(0x03cb, 0x03c7, 0x03c3, 0x0438, 0x043d, 0x0441),
+        },
+        {
+                .freq                   = 2422,
+                RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x76, 0x06, 0x06, 0x04,
+                           0x2b, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                           0x00, 0x00, 0x67, 0x00, 0x03, 0x00, 0x70, 0x00,
+                           0x0b, 0x00, 0x0a, 0x00, 0x89, 0x00, 0x03, 0x00,
+                           0x70, 0x00, 0x0b, 0x00, 0x0a),
+                PHYREGS(0x03cd, 0x03c9, 0x03c5, 0x0436, 0x043a, 0x043f),
+        },
+        {
+                .freq                   = 2427,
+                RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x7b, 0x06, 0x06, 0x04,
+                           0x2b, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                           0x00, 0x00, 0x57, 0x00, 0x03, 0x00, 0x70, 0x00,
+                           0x0a, 0x00, 0x0a, 0x00, 0x78, 0x00, 0x03, 0x00,
+                           0x70, 0x00, 0x0a, 0x00, 0x0a),
+                PHYREGS(0x03cf, 0x03cb, 0x03c7, 0x0434, 0x0438, 0x043d),
+        },
+        {
+                .freq                   = 2432,
+                RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x80, 0x06, 0x06, 0x04,
+                           0x2b, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                           0x00, 0x00, 0x56, 0x00, 0x03, 0x00, 0x70, 0x00,
+                           0x0a, 0x00, 0x0a, 0x00, 0x77, 0x00, 0x03, 0x00,
+                           0x70, 0x00, 0x0a, 0x00, 0x0a),
+                PHYREGS(0x03d1, 0x03cd, 0x03c9, 0x0431, 0x0436, 0x043a),
+        },
+        {
+                .freq                   = 2437,
+                RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x85, 0x06, 0x06, 0x04,
+                           0x2b, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                           0x00, 0x00, 0x46, 0x00, 0x03, 0x00, 0x70, 0x00,
+                           0x0a, 0x00, 0x0a, 0x00, 0x76, 0x00, 0x03, 0x00,
+                           0x70, 0x00, 0x0a, 0x00, 0x0a),
+                PHYREGS(0x03d3, 0x03cf, 0x03cb, 0x042f, 0x0434, 0x0438),
+        },
+        {
+                .freq                   = 2442,
+                RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x8a, 0x06, 0x06, 0x04,
+                           0x2b, 0x01, 0x05, 0x05, 0x05, 0x8f, 0x30, 0x00,
+                           0x00, 0x00, 0x45, 0x00, 0x02, 0x00, 0x70, 0x00,
+                           0x0a, 0x00, 0x0a, 0x00, 0x66, 0x00, 0x02, 0x00,
+                           0x70, 0x00, 0x0a, 0x00, 0x0a),
+                PHYREGS(0x03d5, 0x03d1, 0x03cd, 0x042d, 0x0431, 0x0436),
+        },
+        {
+                .freq                   = 2447,
+                RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x8f, 0x06, 0x06, 0x04,
+                           0x2b, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                           0x00, 0x00, 0x34, 0x00, 0x02, 0x00, 0x70, 0x00,
+                           0x0a, 0x00, 0x09, 0x00, 0x55, 0x00, 0x02, 0x00,
+                           0x70, 0x00, 0x0a, 0x00, 0x09),
+                PHYREGS(0x03d7, 0x03d3, 0x03cf, 0x042b, 0x042f, 0x0434),
+        },
+        {
+                .freq                   = 2452,
+                RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x94, 0x06, 0x06, 0x04,
+                           0x2b, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                           0x00, 0x00, 0x23, 0x00, 0x02, 0x00, 0x70, 0x00,
+                           0x0a, 0x00, 0x09, 0x00, 0x45, 0x00, 0x02, 0x00,
+                           0x70, 0x00, 0x0a, 0x00, 0x09),
+                PHYREGS(0x03d9, 0x03d5, 0x03d1, 0x0429, 0x042d, 0x0431),
+        },
+        {
+                .freq                   = 2457,
+                RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x99, 0x06, 0x06, 0x04,
+                           0x2b, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                           0x00, 0x00, 0x12, 0x00, 0x02, 0x00, 0x70, 0x00,
+                           0x0a, 0x00, 0x09, 0x00, 0x34, 0x00, 0x02, 0x00,
+                           0x70, 0x00, 0x0a, 0x00, 0x09),
+                PHYREGS(0x03db, 0x03d7, 0x03d3, 0x0427, 0x042b, 0x042f),
+        },
+        {
+                .freq                   = 2462,
+                RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0x9e, 0x06, 0x06, 0x04,
+                           0x2b, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                           0x00, 0x00, 0x02, 0x00, 0x02, 0x00, 0x70, 0x00,
+                           0x09, 0x00, 0x09, 0x00, 0x33, 0x00, 0x02, 0x00,
+                           0x70, 0x00, 0x09, 0x00, 0x09),
+                PHYREGS(0x03dd, 0x03d9, 0x03d5, 0x0424, 0x0429, 0x042d),
+        },
+        {
+                .freq                   = 2467,
+                RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0xa3, 0x06, 0x06, 0x04,
+                           0x2b, 0x01, 0x06, 0x06, 0x06, 0x8f, 0x30, 0x00,
+                           0x00, 0x00, 0x01, 0x00, 0x02, 0x00, 0x70, 0x00,
+                           0x09, 0x00, 0x09, 0x00, 0x22, 0x00, 0x02, 0x00,
+                           0x70, 0x00, 0x09, 0x00, 0x09),
+                PHYREGS(0x03df, 0x03db, 0x03d7, 0x0422, 0x0427, 0x042b),
+        },
+        {
+                .freq                   = 2472,
+                RADIOREGS3(0x00, 0x01, 0x03, 0x09, 0xa8, 0x06, 0x06, 0x04,
+                           0x2b, 0x01, 0x07, 0x07, 0x07, 0x8f, 0x30, 0x00,
+                           0x00, 0x00, 0x01, 0x00, 0x02, 0x00, 0x70, 0x00,
+                           0x09, 0x00, 0x09, 0x00, 0x11, 0x00, 0x02, 0x00,
+                           0x70, 0x00, 0x09, 0x00, 0x09),
+                PHYREGS(0x03e1, 0x03dd, 0x03d9, 0x0420, 0x0424, 0x0429),
+        },
+        {
+                .freq                   = 2484,
+                RADIOREGS3(0xff, 0x01, 0x03, 0x09, 0xb4, 0x06, 0x06, 0x04,
+                           0x2b, 0x01, 0x07, 0x07, 0x07, 0x8f, 0x20, 0x00,
+                           0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x70, 0x00,
+                           0x09, 0x00, 0x09, 0x00, 0x00, 0x00, 0x02, 0x00,
+                           0x70, 0x00, 0x09, 0x00, 0x09),
+                PHYREGS(0x03e6, 0x03e2, 0x03de, 0x041b, 0x041f, 0x0424),
+        },
+};
+
+static const struct b2056_inittabs_pts
+*b43_nphy_get_inittabs_rev3(struct b43_wldev *dev)
+{
+        struct b43_phy *phy = &dev->phy;
+
+        switch (dev->phy.rev) {
+        case 3:
+                return &b2056_inittab_phy_rev3;
+        case 4:
+                return &b2056_inittab_phy_rev4;
+        default:
+                switch (phy->radio_rev) {
+                case 5:
+                        return &b2056_inittab_radio_rev5;
+                case 6:
+                        return &b2056_inittab_radio_rev6;
+                case 7:
+                case 9:
+                        return &b2056_inittab_radio_rev7_9;
+                case 8:
+                        return &b2056_inittab_radio_rev8;
+                case 11:
+                        return &b2056_inittab_radio_rev11;
+                }
+        }
+
+        return NULL;
+}
+
 static void b2056_upload_inittab(struct b43_wldev *dev, bool ghz5,
                                  bool ignore_uploadflag, u16 routing,
                                  const struct b2056_inittab_entry *e,
@@ -9037,11 +10230,11 @@ void b2056_upload_inittabs(struct b43_wldev *dev,
 {
         const struct b2056_inittabs_pts *pts;
 
-        if (dev->phy.rev >= ARRAY_SIZE(b2056_inittabs)) {
+        pts = b43_nphy_get_inittabs_rev3(dev);
+        if (!pts) {
                 B43_WARN_ON(1);
                 return;
         }
-        pts = &b2056_inittabs[dev->phy.rev];
 
         b2056_upload_inittab(dev, ghz5, ignore_uploadflag,
                                 B2056_SYN, pts->syn, pts->syn_length);
@@ -9060,11 +10253,12 @@ void b2056_upload_syn_pll_cp2(struct b43_wldev *dev, bool ghz5)
         const struct b2056_inittabs_pts *pts;
         const struct b2056_inittab_entry *e;
 
-        if (dev->phy.rev >= ARRAY_SIZE(b2056_inittabs)) {
+        pts = b43_nphy_get_inittabs_rev3(dev);
+        if (!pts) {
                 B43_WARN_ON(1);
                 return;
         }
-        pts = &b2056_inittabs[dev->phy.rev];
+
         e = &pts->syn[B2056_SYN_PLL_CP2];
 
         b43_radio_write(dev, B2056_SYN_PLL_CP2, ghz5 ? e->ghz5 : e->ghz2);
@@ -9073,38 +10267,46 @@ void b2056_upload_syn_pll_cp2(struct b43_wldev *dev, bool ghz5)
 const struct b43_nphy_channeltab_entry_rev3 *
 b43_nphy_get_chantabent_rev3(struct b43_wldev *dev, u16 freq)
 {
+        struct b43_phy *phy = &dev->phy;
         const struct b43_nphy_channeltab_entry_rev3 *e;
         unsigned int length, i;
 
-        switch (dev->phy.rev) {
+        switch (phy->rev) {
         case 3:
-                e = b43_nphy_channeltab_rev3;
-                length = ARRAY_SIZE(b43_nphy_channeltab_rev3);
+                e = b43_nphy_channeltab_phy_rev3;
+                length = ARRAY_SIZE(b43_nphy_channeltab_phy_rev3);
                 break;
         case 4:
-                e = b43_nphy_channeltab_rev4;
-                length = ARRAY_SIZE(b43_nphy_channeltab_rev4);
-                break;
-        case 5:
-                e = b43_nphy_channeltab_rev5;
-                length = ARRAY_SIZE(b43_nphy_channeltab_rev5);
-                break;
-        case 6:
-                e = b43_nphy_channeltab_rev6;
-                length = ARRAY_SIZE(b43_nphy_channeltab_rev6);
-                break;
-        case 7:
-        case 9:
-                e = b43_nphy_channeltab_rev7_9;
-                length = ARRAY_SIZE(b43_nphy_channeltab_rev7_9);
-                break;
-        case 8:
-                e = b43_nphy_channeltab_rev8;
-                length = ARRAY_SIZE(b43_nphy_channeltab_rev8);
+                e = b43_nphy_channeltab_phy_rev4;
+                length = ARRAY_SIZE(b43_nphy_channeltab_phy_rev4);
                 break;
         default:
-                B43_WARN_ON(1);
-                return NULL;
+                switch (phy->radio_rev) {
+                case 5:
+                        e = b43_nphy_channeltab_radio_rev5;
+                        length = ARRAY_SIZE(b43_nphy_channeltab_radio_rev5);
+                        break;
+                case 6:
+                        e = b43_nphy_channeltab_radio_rev6;
+                        length = ARRAY_SIZE(b43_nphy_channeltab_radio_rev6);
+                        break;
+                case 7:
+                case 9:
+                        e = b43_nphy_channeltab_radio_rev7_9;
+                        length = ARRAY_SIZE(b43_nphy_channeltab_radio_rev7_9);
+                        break;
+                case 8:
+                        e = b43_nphy_channeltab_radio_rev8;
+                        length = ARRAY_SIZE(b43_nphy_channeltab_radio_rev8);
+                        break;
+                case 11:
+                        e = b43_nphy_channeltab_radio_rev11;
+                        length = ARRAY_SIZE(b43_nphy_channeltab_radio_rev11);
+                        break;
+                default:
+                        B43_WARN_ON(1);
+                        return NULL;
+                }
         }
 
         for (i = 0; i < length; i++, e++) {
diff --git a/drivers/net/wireless/b43/tables_nphy.c b/drivers/net/wireless/b43/tables_nphy.c
index 94c755fdda14..4047c05e3807 100644
--- a/drivers/net/wireless/b43/tables_nphy.c
+++ b/drivers/net/wireless/b43/tables_nphy.c
@@ -1627,74 +1627,7 @@ static const u32 b43_ntab_tdtrn_r3[] = {
         0xfa58fc00, 0x0b64fc7e, 0x0800f7b6, 0x00f006be,
 };
 
-static const u32 b43_ntab_noisevar0_r3[] = {
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-        0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
-};
-
-static const u32 b43_ntab_noisevar1_r3[] = {
+static const u32 b43_ntab_noisevar_r3[] = {
         0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
         0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
         0x02110211, 0x0000014d, 0x02110211, 0x0000014d,
@@ -3109,31 +3042,32 @@ static void b43_nphy_tables_init_rev3(struct b43_wldev *dev)
                 antswlut = sprom->fem.ghz2.antswlut;
 
         /* Static tables */
-        ntab_upload(dev, B43_NTAB_FRAMESTRUCT_R3, b43_ntab_framestruct_r3);
-        ntab_upload(dev, B43_NTAB_PILOT_R3, b43_ntab_pilot_r3);
-        ntab_upload(dev, B43_NTAB_TMAP_R3, b43_ntab_tmap_r3);
-        ntab_upload(dev, B43_NTAB_INTLEVEL_R3, b43_ntab_intlevel_r3);
-        ntab_upload(dev, B43_NTAB_TDTRN_R3, b43_ntab_tdtrn_r3);
-        ntab_upload(dev, B43_NTAB_NOISEVAR0_R3, b43_ntab_noisevar0_r3);
-        ntab_upload(dev, B43_NTAB_NOISEVAR1_R3, b43_ntab_noisevar1_r3);
-        ntab_upload(dev, B43_NTAB_MCS_R3, b43_ntab_mcs_r3);
-        ntab_upload(dev, B43_NTAB_TDI20A0_R3, b43_ntab_tdi20a0_r3);
-        ntab_upload(dev, B43_NTAB_TDI20A1_R3, b43_ntab_tdi20a1_r3);
-        ntab_upload(dev, B43_NTAB_TDI40A0_R3, b43_ntab_tdi40a0_r3);
-        ntab_upload(dev, B43_NTAB_TDI40A1_R3, b43_ntab_tdi40a1_r3);
-        ntab_upload(dev, B43_NTAB_PILOTLT_R3, b43_ntab_pilotlt_r3);
-        ntab_upload(dev, B43_NTAB_CHANEST_R3, b43_ntab_channelest_r3);
-        ntab_upload(dev, B43_NTAB_FRAMELT_R3, b43_ntab_framelookup_r3);
-        ntab_upload(dev, B43_NTAB_C0_ESTPLT_R3, b43_ntab_estimatepowerlt0_r3);
-        ntab_upload(dev, B43_NTAB_C1_ESTPLT_R3, b43_ntab_estimatepowerlt1_r3);
-        ntab_upload(dev, B43_NTAB_C0_ADJPLT_R3, b43_ntab_adjustpower0_r3);
-        ntab_upload(dev, B43_NTAB_C1_ADJPLT_R3, b43_ntab_adjustpower1_r3);
-        ntab_upload(dev, B43_NTAB_C0_GAINCTL_R3, b43_ntab_gainctl0_r3);
-        ntab_upload(dev, B43_NTAB_C1_GAINCTL_R3, b43_ntab_gainctl1_r3);
-        ntab_upload(dev, B43_NTAB_C0_IQLT_R3, b43_ntab_iqlt0_r3);
-        ntab_upload(dev, B43_NTAB_C1_IQLT_R3, b43_ntab_iqlt1_r3);
-        ntab_upload(dev, B43_NTAB_C0_LOFEEDTH_R3, b43_ntab_loftlt0_r3);
-        ntab_upload(dev, B43_NTAB_C1_LOFEEDTH_R3, b43_ntab_loftlt1_r3);
+        if (dev->phy.do_full_init) {
+                ntab_upload(dev, B43_NTAB_FRAMESTRUCT_R3, b43_ntab_framestruct_r3);
+                ntab_upload(dev, B43_NTAB_PILOT_R3, b43_ntab_pilot_r3);
+                ntab_upload(dev, B43_NTAB_TMAP_R3, b43_ntab_tmap_r3);
+                ntab_upload(dev, B43_NTAB_INTLEVEL_R3, b43_ntab_intlevel_r3);
+                ntab_upload(dev, B43_NTAB_TDTRN_R3, b43_ntab_tdtrn_r3);
+                ntab_upload(dev, B43_NTAB_NOISEVAR_R3, b43_ntab_noisevar_r3);
+                ntab_upload(dev, B43_NTAB_MCS_R3, b43_ntab_mcs_r3);
+                ntab_upload(dev, B43_NTAB_TDI20A0_R3, b43_ntab_tdi20a0_r3);
+                ntab_upload(dev, B43_NTAB_TDI20A1_R3, b43_ntab_tdi20a1_r3);
+                ntab_upload(dev, B43_NTAB_TDI40A0_R3, b43_ntab_tdi40a0_r3);
+                ntab_upload(dev, B43_NTAB_TDI40A1_R3, b43_ntab_tdi40a1_r3);
+                ntab_upload(dev, B43_NTAB_PILOTLT_R3, b43_ntab_pilotlt_r3);
+                ntab_upload(dev, B43_NTAB_CHANEST_R3, b43_ntab_channelest_r3);
+                ntab_upload(dev, B43_NTAB_FRAMELT_R3, b43_ntab_framelookup_r3);
+                ntab_upload(dev, B43_NTAB_C0_ESTPLT_R3, b43_ntab_estimatepowerlt0_r3);
+                ntab_upload(dev, B43_NTAB_C1_ESTPLT_R3, b43_ntab_estimatepowerlt1_r3);
+                ntab_upload(dev, B43_NTAB_C0_ADJPLT_R3, b43_ntab_adjustpower0_r3);
+                ntab_upload(dev, B43_NTAB_C1_ADJPLT_R3, b43_ntab_adjustpower1_r3);
+                ntab_upload(dev, B43_NTAB_C0_GAINCTL_R3, b43_ntab_gainctl0_r3);
+                ntab_upload(dev, B43_NTAB_C1_GAINCTL_R3, b43_ntab_gainctl1_r3);
+                ntab_upload(dev, B43_NTAB_C0_IQLT_R3, b43_ntab_iqlt0_r3);
+                ntab_upload(dev, B43_NTAB_C1_IQLT_R3, b43_ntab_iqlt1_r3);
+                ntab_upload(dev, B43_NTAB_C0_LOFEEDTH_R3, b43_ntab_loftlt0_r3);
+                ntab_upload(dev, B43_NTAB_C1_LOFEEDTH_R3, b43_ntab_loftlt1_r3);
+        }
 
         /* Volatile tables */
         if (antswlut < ARRAY_SIZE(b43_ntab_antswctl_r3))
@@ -3146,20 +3080,22 @@ static void b43_nphy_tables_init_rev3(struct b43_wldev *dev)
 static void b43_nphy_tables_init_rev0(struct b43_wldev *dev)
 {
         /* Static tables */
-        ntab_upload(dev, B43_NTAB_FRAMESTRUCT, b43_ntab_framestruct);
-        ntab_upload(dev, B43_NTAB_FRAMELT, b43_ntab_framelookup);
-        ntab_upload(dev, B43_NTAB_TMAP, b43_ntab_tmap);
-        ntab_upload(dev, B43_NTAB_TDTRN, b43_ntab_tdtrn);
-        ntab_upload(dev, B43_NTAB_INTLEVEL, b43_ntab_intlevel);
-        ntab_upload(dev, B43_NTAB_PILOT, b43_ntab_pilot);
-        ntab_upload(dev, B43_NTAB_TDI20A0, b43_ntab_tdi20a0);
-        ntab_upload(dev, B43_NTAB_TDI20A1, b43_ntab_tdi20a1);
-        ntab_upload(dev, B43_NTAB_TDI40A0, b43_ntab_tdi40a0);
-        ntab_upload(dev, B43_NTAB_TDI40A1, b43_ntab_tdi40a1);
-        ntab_upload(dev, B43_NTAB_CHANEST, b43_ntab_channelest);
-        ntab_upload(dev, B43_NTAB_MCS, b43_ntab_mcs);
-        ntab_upload(dev, B43_NTAB_NOISEVAR10, b43_ntab_noisevar10);
-        ntab_upload(dev, B43_NTAB_NOISEVAR11, b43_ntab_noisevar11);
+        if (dev->phy.do_full_init) {
+                ntab_upload(dev, B43_NTAB_FRAMESTRUCT, b43_ntab_framestruct);
+                ntab_upload(dev, B43_NTAB_FRAMELT, b43_ntab_framelookup);
+                ntab_upload(dev, B43_NTAB_TMAP, b43_ntab_tmap);
+                ntab_upload(dev, B43_NTAB_TDTRN, b43_ntab_tdtrn);
+                ntab_upload(dev, B43_NTAB_INTLEVEL, b43_ntab_intlevel);
+                ntab_upload(dev, B43_NTAB_PILOT, b43_ntab_pilot);
+                ntab_upload(dev, B43_NTAB_TDI20A0, b43_ntab_tdi20a0);
+                ntab_upload(dev, B43_NTAB_TDI20A1, b43_ntab_tdi20a1);
+                ntab_upload(dev, B43_NTAB_TDI40A0, b43_ntab_tdi40a0);
+                ntab_upload(dev, B43_NTAB_TDI40A1, b43_ntab_tdi40a1);
+                ntab_upload(dev, B43_NTAB_CHANEST, b43_ntab_channelest);
+                ntab_upload(dev, B43_NTAB_MCS, b43_ntab_mcs);
+                ntab_upload(dev, B43_NTAB_NOISEVAR10, b43_ntab_noisevar10);
+                ntab_upload(dev, B43_NTAB_NOISEVAR11, b43_ntab_noisevar11);
+        }
 
         /* Volatile tables */
         ntab_upload(dev, B43_NTAB_BDI, b43_ntab_bdi);
diff --git a/drivers/net/wireless/b43/tables_nphy.h b/drivers/net/wireless/b43/tables_nphy.h
index 9ff33adcff89..3a58aee4c4cf 100644
--- a/drivers/net/wireless/b43/tables_nphy.h
+++ b/drivers/net/wireless/b43/tables_nphy.h
@@ -143,8 +143,7 @@ struct nphy_gain_ctl_workaround_entry *b43_nphy_get_gain_ctl_workaround_ent(
 #define B43_NTAB_TMAP_R3                B43_NTAB32(12,   0) /* TM AP  */
 #define B43_NTAB_INTLEVEL_R3            B43_NTAB32(13,   0) /* INT LV  */
 #define B43_NTAB_TDTRN_R3               B43_NTAB32(14,   0) /* TD TRN  */
-#define B43_NTAB_NOISEVAR0_R3           B43_NTAB32(16,   0) /* noise variance 0  */
-#define B43_NTAB_NOISEVAR1_R3           B43_NTAB32(16, 128) /* noise variance 1  */
+#define B43_NTAB_NOISEVAR_R3            B43_NTAB32(16,   0) /* noise variance */
 #define B43_NTAB_MCS_R3                 B43_NTAB16(18,   0) /* MCS  */
 #define B43_NTAB_TDI20A0_R3             B43_NTAB32(19, 128) /* TDI 20/0  */
 #define B43_NTAB_TDI20A1_R3             B43_NTAB32(19, 256) /* TDI 20/1  */
diff --git a/drivers/net/wireless/b43/wa.c b/drivers/net/wireless/b43/wa.c
index 9b1a038be08b..c218c08fb2f5 100644
--- a/drivers/net/wireless/b43/wa.c
+++ b/drivers/net/wireless/b43/wa.c
@@ -441,7 +441,7 @@ static void b43_wa_altagc(struct b43_wldev *dev)
 
 static void b43_wa_tr_ltov(struct b43_wldev *dev) /* TR Lookup Table Original Values */
 {
-        b43_gtab_write(dev, B43_GTAB_ORIGTR, 0, 0xC480);
+        b43_gtab_write(dev, B43_GTAB_ORIGTR, 0, 0x7654);
 }
 
 static void b43_wa_cpll_nonpilot(struct b43_wldev *dev)
diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
index 31adb8cf0291..4f38f19b8e3d 100644
--- a/drivers/net/wireless/b43/xmit.c
+++ b/drivers/net/wireless/b43/xmit.c
@@ -408,7 +408,7 @@ int b43_generate_txhdr(struct b43_wldev *dev,
                 mac_ctl |= B43_TXH_MAC_HWSEQ;
         if (info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)
                 mac_ctl |= B43_TXH_MAC_STMSDU;
-        if (phy->type == B43_PHYTYPE_A)
+        if (!phy->gmode)
                 mac_ctl |= B43_TXH_MAC_5GHZ;
 
         /* Overwrite rates[0].count to make the retry calculation
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/Makefile b/drivers/net/wireless/brcm80211/brcmfmac/Makefile
index 1d2ceac3a221..98e67c18f276 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/Makefile
+++ b/drivers/net/wireless/brcm80211/brcmfmac/Makefile
@@ -33,7 +33,7 @@ brcmfmac-objs += \
                 bcdc.o \
                 dhd_common.o \
                 dhd_linux.o \
-                nvram.o \
+                firmware.o \
                 btcoex.o
 brcmfmac-$(CONFIG_BRCMFMAC_SDIO) += \
                 dhd_sdio.o \
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
index 939d6b132922..16f9ab2568a8 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
@@ -186,7 +186,7 @@ void brcmf_del_if(struct brcmf_pub *drvr, s32 bssidx);
 void brcmf_txflowblock_if(struct brcmf_if *ifp,
                           enum brcmf_netif_stop_reason reason, bool state);
 u32 brcmf_get_chip_info(struct brcmf_if *ifp);
-void brcmf_txfinalize(struct brcmf_pub *drvr, struct sk_buff *txp,
+void brcmf_txfinalize(struct brcmf_pub *drvr, struct sk_buff *txp, u8 ifidx,
                       bool success);
 
 /* Sets dongle media info (drv_version, mac address). */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
index c4535616064e..7735328fff21 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
@@ -63,7 +63,6 @@ struct brcmf_bus_dcmd {
  */
 struct brcmf_bus_ops {
         int (*preinit)(struct device *dev);
-        int (*init)(struct device *dev);
         void (*stop)(struct device *dev);
         int (*txdata)(struct device *dev, struct sk_buff *skb);
         int (*txctl)(struct device *dev, unsigned char *msg, uint len);
@@ -99,6 +98,7 @@ struct brcmf_bus {
         unsigned long tx_realloc;
         u32 chip;
         u32 chiprev;
+        bool always_use_fws_queue;
 
         struct brcmf_bus_ops *ops;
 };
@@ -113,11 +113,6 @@ static inline int brcmf_bus_preinit(struct brcmf_bus *bus)
         return bus->ops->preinit(bus->dev);
 }
 
-static inline int brcmf_bus_init(struct brcmf_bus *bus)
-{
-        return bus->ops->init(bus->dev);
-}
-
 static inline void brcmf_bus_stop(struct brcmf_bus *bus)
 {
         bus->ops->stop(bus->dev);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
index 6a8983a1fb9c..ed3e32ce8c23 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
@@ -32,6 +32,9 @@
 #define BRCMF_DEFAULT_SCAN_UNASSOC_TIME 40
 #define BRCMF_DEFAULT_PACKET_FILTER     "100 0 0 0 0x01 0x00"
 
+/* boost value for RSSI_DELTA in preferred join selection */
+#define BRCMF_JOIN_PREF_RSSI_BOOST      8
+
 
 bool brcmf_c_prec_enq(struct device *dev, struct pktq *q,
                       struct sk_buff *pkt, int prec)
@@ -246,6 +249,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
 {
         s8 eventmask[BRCMF_EVENTING_MASK_LEN];
         u8 buf[BRCMF_DCMD_SMLEN];
+        struct brcmf_join_pref_params join_pref_params[2];
         char *ptr;
         s32 err;
 
@@ -298,6 +302,20 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
                 goto done;
         }
 
+        /* Setup join_pref to select target by RSSI(with boost on 5GHz) */
+        join_pref_params[0].type = BRCMF_JOIN_PREF_RSSI_DELTA;
+        join_pref_params[0].len = 2;
+        join_pref_params[0].rssi_gain = BRCMF_JOIN_PREF_RSSI_BOOST;
+        join_pref_params[0].band = WLC_BAND_5G;
+        join_pref_params[1].type = BRCMF_JOIN_PREF_RSSI;
+        join_pref_params[1].len = 2;
+        join_pref_params[1].rssi_gain = 0;
+        join_pref_params[1].band = 0;
+        err = brcmf_fil_iovar_data_set(ifp, "join_pref", join_pref_params,
+                                       sizeof(join_pref_params));
+        if (err)
+                brcmf_err("Set join_pref error (%d)\n", err);
+
         /* Setup event_msgs, enable E_IF */
         err = brcmf_fil_iovar_data_get(ifp, "event_msgs", eventmask,
                                        BRCMF_EVENTING_MASK_LEN);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
index 7d28cd385092..09dd8c13d844 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
@@ -190,7 +190,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
         int ret;
         struct brcmf_if *ifp = netdev_priv(ndev);
         struct brcmf_pub *drvr = ifp->drvr;
-        struct ethhdr *eh;
+        struct ethhdr *eh = (struct ethhdr *)(skb->data);
 
         brcmf_dbg(DATA, "Enter, idx=%d\n", ifp->bssidx);
 
@@ -236,6 +236,9 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
                 goto done;
         }
 
+        if (eh->h_proto == htons(ETH_P_PAE))
+                atomic_inc(&ifp->pend_8021x_cnt);
+
         ret = brcmf_fws_process_skb(ifp, skb);
 
 done:
@@ -538,31 +541,26 @@ void brcmf_rx_frame(struct device *dev, struct sk_buff *skb)
                 brcmf_netif_rx(ifp, skb);
 }
 
-void brcmf_txfinalize(struct brcmf_pub *drvr, struct sk_buff *txp,
+void brcmf_txfinalize(struct brcmf_pub *drvr, struct sk_buff *txp, u8 ifidx,
                       bool success)
 {
         struct brcmf_if *ifp;
         struct ethhdr *eh;
-        u8 ifidx;
         u16 type;
-        int res;
-
-        res = brcmf_proto_hdrpull(drvr, false, &ifidx, txp);
 
         ifp = drvr->iflist[ifidx];
         if (!ifp)
                 goto done;
 
-        if (res == 0) {
-                eh = (struct ethhdr *)(txp->data);
-                type = ntohs(eh->h_proto);
+        eh = (struct ethhdr *)(txp->data);
+        type = ntohs(eh->h_proto);
 
-                if (type == ETH_P_PAE) {
-                        atomic_dec(&ifp->pend_8021x_cnt);
-                        if (waitqueue_active(&ifp->pend_8021x_wait))
-                                wake_up(&ifp->pend_8021x_wait);
-                }
+        if (type == ETH_P_PAE) {
+                atomic_dec(&ifp->pend_8021x_cnt);
+                if (waitqueue_active(&ifp->pend_8021x_wait))
+                        wake_up(&ifp->pend_8021x_wait);
         }
+
         if (!success)
                 ifp->stats.tx_errors++;
 done:
@@ -573,13 +571,17 @@ void brcmf_txcomplete(struct device *dev, struct sk_buff *txp, bool success)
 {
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
         struct brcmf_pub *drvr = bus_if->drvr;
+        u8 ifidx;
 
         /* await txstatus signal for firmware if active */
         if (brcmf_fws_fc_active(drvr->fws)) {
                 if (!success)
                         brcmf_fws_bustxfail(drvr->fws, txp);
         } else {
-                brcmf_txfinalize(drvr, txp, success);
+                if (brcmf_proto_hdrpull(drvr, false, &ifidx, txp))
+                        brcmu_pkt_buf_free_skb(txp);
+                else
+                        brcmf_txfinalize(drvr, txp, ifidx, success);
         }
 }
 
@@ -914,13 +916,6 @@ int brcmf_bus_start(struct device *dev)
 
         brcmf_dbg(TRACE, "\n");
 
-        /* Bring up the bus */
-        ret = brcmf_bus_init(bus_if);
-        if (ret != 0) {
-                brcmf_err("brcmf_sdbrcm_bus_init failed %d\n", ret);
-                return ret;
-        }
-
         /* add primary networking interface */
         ifp = brcmf_add_if(drvr, 0, 0, "wlan%d", NULL);
         if (IS_ERR(ifp))
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index 13c89a0c4ba7..8fa0dbbbda72 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -42,7 +42,7 @@
 #include <soc.h>
 #include "sdio_host.h"
 #include "chip.h"
-#include "nvram.h"
+#include "firmware.h"
 
 #define DCMD_RESP_TIMEOUT  2000 /* In milli second */
 
@@ -632,43 +632,28 @@ static const struct brcmf_firmware_names brcmf_fwname_data[] = {
         { BCM4354_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4354) }
 };
 
-
-static const struct firmware *brcmf_sdio_get_fw(struct brcmf_sdio *bus,
-                                                  enum brcmf_firmware_type type)
+static const char *brcmf_sdio_get_fwname(struct brcmf_chip *ci,
+                                         enum brcmf_firmware_type type)
 {
-        const struct firmware *fw;
-        const char *name;
-        int err, i;
+        int i;
 
         for (i = 0; i < ARRAY_SIZE(brcmf_fwname_data); i++) {
-                if (brcmf_fwname_data[i].chipid == bus->ci->chip &&
-                    brcmf_fwname_data[i].revmsk & BIT(bus->ci->chiprev)) {
+                if (brcmf_fwname_data[i].chipid == ci->chip &&
+                    brcmf_fwname_data[i].revmsk & BIT(ci->chiprev)) {
                         switch (type) {
                         case BRCMF_FIRMWARE_BIN:
-                                name = brcmf_fwname_data[i].bin;
-                                break;
+                                return brcmf_fwname_data[i].bin;
                         case BRCMF_FIRMWARE_NVRAM:
-                                name = brcmf_fwname_data[i].nv;
-                                break;
+                                return brcmf_fwname_data[i].nv;
                         default:
                                 brcmf_err("invalid firmware type (%d)\n", type);
                                 return NULL;
                         }
-                        goto found;
                 }
         }
         brcmf_err("Unknown chipid %d [%d]\n",
-                  bus->ci->chip, bus->ci->chiprev);
+                  ci->chip, ci->chiprev);
         return NULL;
-
-found:
-        err = request_firmware(&fw, name, &bus->sdiodev->func[2]->dev);
-        if ((err) || (!fw)) {
-                brcmf_err("fail to request firmware %s (%d)\n", name, err);
-                return NULL;
-        }
-
-        return fw;
 }
 
 static void pkt_align(struct sk_buff *p, int len, int align)
@@ -3278,20 +3263,13 @@ static int brcmf_sdio_download_code_file(struct brcmf_sdio *bus,
 }
 
 static int brcmf_sdio_download_nvram(struct brcmf_sdio *bus,
-                                     const struct firmware *nv)
+                                     void *vars, u32 varsz)
 {
-        void *vars;
-        u32 varsz;
         int address;
         int err;
 
         brcmf_dbg(TRACE, "Enter\n");
 
-        vars = brcmf_nvram_strip(nv, &varsz);
-
-        if (vars == NULL)
-                return -EINVAL;
-
         address = bus->ci->ramsize - varsz + bus->ci->rambase;
         err = brcmf_sdiod_ramrw(bus->sdiodev, true, address, vars, varsz);
         if (err)
@@ -3300,15 +3278,14 @@ static int brcmf_sdio_download_nvram(struct brcmf_sdio *bus,
         else if (!brcmf_sdio_verifymemory(bus->sdiodev, address, vars, varsz))
                 err = -EIO;
 
-        brcmf_nvram_free(vars);
-
         return err;
 }
 
-static int brcmf_sdio_download_firmware(struct brcmf_sdio *bus)
+static int brcmf_sdio_download_firmware(struct brcmf_sdio *bus,
+                                        const struct firmware *fw,
+                                        void *nvram, u32 nvlen)
 {
         int bcmerror = -EFAULT;
-        const struct firmware *fw;
         u32 rstvec;
 
         sdio_claim_host(bus->sdiodev->func[1]);
@@ -3317,12 +3294,6 @@ static int brcmf_sdio_download_firmware(struct brcmf_sdio *bus)
         /* Keep arm in reset */
         brcmf_chip_enter_download(bus->ci);
 
-        fw = brcmf_sdio_get_fw(bus, BRCMF_FIRMWARE_BIN);
-        if (fw == NULL) {
-                bcmerror = -ENOENT;
-                goto err;
-        }
-
         rstvec = get_unaligned_le32(fw->data);
         brcmf_dbg(SDIO, "firmware rstvec: %x\n", rstvec);
 
@@ -3330,17 +3301,12 @@ static int brcmf_sdio_download_firmware(struct brcmf_sdio *bus)
         release_firmware(fw);
         if (bcmerror) {
                 brcmf_err("dongle image file download failed\n");
+                brcmf_fw_nvram_free(nvram);
                 goto err;
         }
 
-        fw = brcmf_sdio_get_fw(bus, BRCMF_FIRMWARE_NVRAM);
-        if (fw == NULL) {
-                bcmerror = -ENOENT;
-                goto err;
-        }
-
-        bcmerror = brcmf_sdio_download_nvram(bus, fw);
-        release_firmware(fw);
+        bcmerror = brcmf_sdio_download_nvram(bus, nvram, nvlen);
+        brcmf_fw_nvram_free(nvram);
         if (bcmerror) {
                 brcmf_err("dongle nvram file download failed\n");
                 goto err;
@@ -3490,97 +3456,6 @@ done:
         return err;
 }
 
-static int brcmf_sdio_bus_init(struct device *dev)
-{
-        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
-        struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
-        struct brcmf_sdio *bus = sdiodev->bus;
-        int err, ret = 0;
-        u8 saveclk;
-
-        brcmf_dbg(TRACE, "Enter\n");
-
-        /* try to download image and nvram to the dongle */
-        if (bus_if->state == BRCMF_BUS_DOWN) {
-                bus->alp_only = true;
-                err = brcmf_sdio_download_firmware(bus);
-                if (err)
-                        return err;
-                bus->alp_only = false;
-        }
-
-        if (!bus->sdiodev->bus_if->drvr)
-                return 0;
-
-        /* Start the watchdog timer */
-        bus->sdcnt.tickcnt = 0;
-        brcmf_sdio_wd_timer(bus, BRCMF_WD_POLL_MS);
-
-        sdio_claim_host(bus->sdiodev->func[1]);
-
-        /* Make sure backplane clock is on, needed to generate F2 interrupt */
-        brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
-        if (bus->clkstate != CLK_AVAIL)
-                goto exit;
-
-        /* Force clocks on backplane to be sure F2 interrupt propagates */
-        saveclk = brcmf_sdiod_regrb(bus->sdiodev,
-                                    SBSDIO_FUNC1_CHIPCLKCSR, &err);
-        if (!err) {
-                brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-                                  (saveclk | SBSDIO_FORCE_HT), &err);
-        }
-        if (err) {
-                brcmf_err("Failed to force clock for F2: err %d\n", err);
-                goto exit;
-        }
-
-        /* Enable function 2 (frame transfers) */
-        w_sdreg32(bus, SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT,
-                  offsetof(struct sdpcmd_regs, tosbmailboxdata));
-        err = sdio_enable_func(bus->sdiodev->func[SDIO_FUNC_2]);
-
-
-        brcmf_dbg(INFO, "enable F2: err=%d\n", err);
-
-        /* If F2 successfully enabled, set core and enable interrupts */
-        if (!err) {
-                /* Set up the interrupt mask and enable interrupts */
-                bus->hostintmask = HOSTINTMASK;
-                w_sdreg32(bus, bus->hostintmask,
-                          offsetof(struct sdpcmd_regs, hostintmask));
-
-                brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_WATERMARK, 8, &err);
-        } else {
-                /* Disable F2 again */
-                sdio_disable_func(bus->sdiodev->func[SDIO_FUNC_2]);
-                ret = -ENODEV;
-        }
-
-        if (brcmf_chip_sr_capable(bus->ci)) {
-                brcmf_sdio_sr_init(bus);
-        } else {
-                /* Restore previous clock setting */
-                brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-                                  saveclk, &err);
-        }
-
-        if (ret == 0) {
-                ret = brcmf_sdiod_intr_register(bus->sdiodev);
-                if (ret != 0)
-                        brcmf_err("intr register failed:%d\n", ret);
-        }
-
-        /* If we didn't come up, turn off backplane clock */
-        if (ret != 0)
-                brcmf_sdio_clkctl(bus, CLK_NONE, false);
-
-exit:
-        sdio_release_host(bus->sdiodev->func[1]);
-
-        return ret;
-}
-
 void brcmf_sdio_isr(struct brcmf_sdio *bus)
 {
         brcmf_dbg(TRACE, "Enter\n");
@@ -4020,13 +3895,114 @@ brcmf_sdio_watchdog(unsigned long data)
 static struct brcmf_bus_ops brcmf_sdio_bus_ops = {
         .stop = brcmf_sdio_bus_stop,
         .preinit = brcmf_sdio_bus_preinit,
-        .init = brcmf_sdio_bus_init,
         .txdata = brcmf_sdio_bus_txdata,
         .txctl = brcmf_sdio_bus_txctl,
         .rxctl = brcmf_sdio_bus_rxctl,
         .gettxq = brcmf_sdio_bus_gettxq,
 };
 
+static void brcmf_sdio_firmware_callback(struct device *dev,
+                                         const struct firmware *code,
+                                         void *nvram, u32 nvram_len)
+{
+        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+        struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
+        struct brcmf_sdio *bus = sdiodev->bus;
+        int err = 0;
+        u8 saveclk;
+
+        brcmf_dbg(TRACE, "Enter: dev=%s\n", dev_name(dev));
+
+        /* try to download image and nvram to the dongle */
+        if (bus_if->state == BRCMF_BUS_DOWN) {
+                bus->alp_only = true;
+                err = brcmf_sdio_download_firmware(bus, code, nvram, nvram_len);
+                if (err)
+                        goto fail;
+                bus->alp_only = false;
+        }
+
+        if (!bus_if->drvr)
+                return;
+
+        /* Start the watchdog timer */
+        bus->sdcnt.tickcnt = 0;
+        brcmf_sdio_wd_timer(bus, BRCMF_WD_POLL_MS);
+
+        sdio_claim_host(sdiodev->func[1]);
+
+        /* Make sure backplane clock is on, needed to generate F2 interrupt */
+        brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
+        if (bus->clkstate != CLK_AVAIL)
+                goto release;
+
+        /* Force clocks on backplane to be sure F2 interrupt propagates */
+        saveclk = brcmf_sdiod_regrb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, &err);
+        if (!err) {
+                brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+                                  (saveclk | SBSDIO_FORCE_HT), &err);
+        }
+        if (err) {
+                brcmf_err("Failed to force clock for F2: err %d\n", err);
+                goto release;
+        }
+
+        /* Enable function 2 (frame transfers) */
+        w_sdreg32(bus, SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT,
+                  offsetof(struct sdpcmd_regs, tosbmailboxdata));
+        err = sdio_enable_func(sdiodev->func[SDIO_FUNC_2]);
+
+
+        brcmf_dbg(INFO, "enable F2: err=%d\n", err);
+
+        /* If F2 successfully enabled, set core and enable interrupts */
+        if (!err) {
+                /* Set up the interrupt mask and enable interrupts */
+                bus->hostintmask = HOSTINTMASK;
+                w_sdreg32(bus, bus->hostintmask,
+                          offsetof(struct sdpcmd_regs, hostintmask));
+
+                brcmf_sdiod_regwb(sdiodev, SBSDIO_WATERMARK, 8, &err);
+        } else {
+                /* Disable F2 again */
+                sdio_disable_func(sdiodev->func[SDIO_FUNC_2]);
+                goto release;
+        }
+
+        if (brcmf_chip_sr_capable(bus->ci)) {
+                brcmf_sdio_sr_init(bus);
+        } else {
+                /* Restore previous clock setting */
+                brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+                                  saveclk, &err);
+        }
+
+        if (err == 0) {
+                err = brcmf_sdiod_intr_register(sdiodev);
+                if (err != 0)
+                        brcmf_err("intr register failed:%d\n", err);
+        }
+
+        /* If we didn't come up, turn off backplane clock */
+        if (err != 0)
+                brcmf_sdio_clkctl(bus, CLK_NONE, false);
+
+        sdio_release_host(sdiodev->func[1]);
+
+        err = brcmf_bus_start(dev);
+        if (err != 0) {
+                brcmf_err("dongle is not responding\n");
+                goto fail;
+        }
+        return;
+
+release:
+        sdio_release_host(sdiodev->func[1]);
+fail:
+        brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), err);
+        device_release_driver(dev);
+}
+
 struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
 {
         int ret;
@@ -4110,8 +4086,13 @@ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
                 goto fail;
         }
 
+        /* Query the F2 block size, set roundup accordingly */
+        bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
+        bus->roundup = min(max_roundup, bus->blocksize);
+
         /* Allocate buffers */
         if (bus->sdiodev->bus_if->maxctl) {
+                bus->sdiodev->bus_if->maxctl += bus->roundup;
                 bus->rxblen =
                     roundup((bus->sdiodev->bus_if->maxctl + SDPCM_HDRLEN),
                             ALIGNMENT) + bus->head_align;
@@ -4139,10 +4120,6 @@ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
         bus->idletime = BRCMF_IDLE_INTERVAL;
         bus->idleclock = BRCMF_IDLE_ACTIVE;
 
-        /* Query the F2 block size, set roundup accordingly */
-        bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
-        bus->roundup = min(max_roundup, bus->blocksize);
-
         /* SR state */
         bus->sleeping = false;
         bus->sr_enabled = false;
@@ -4150,10 +4127,14 @@ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
         brcmf_sdio_debugfs_create(bus);
         brcmf_dbg(INFO, "completed!!\n");
 
-        /* if firmware path present try to download and bring up bus */
-        ret = brcmf_bus_start(bus->sdiodev->dev);
+        ret = brcmf_fw_get_firmwares(sdiodev->dev, BRCMF_FW_REQUEST_NVRAM,
+                                     brcmf_sdio_get_fwname(bus->ci,
+                                                           BRCMF_FIRMWARE_BIN),
+                                     brcmf_sdio_get_fwname(bus->ci,
+                                                           BRCMF_FIRMWARE_NVRAM),
+                                     brcmf_sdio_firmware_callback);
         if (ret != 0) {
-                brcmf_err("dongle is not responding\n");
+                brcmf_err("async firmware request failed: %d\n", ret);
                 goto fail;
         }
 
@@ -4173,9 +4154,7 @@ void brcmf_sdio_remove(struct brcmf_sdio *bus)
                 /* De-register interrupt handler */
                 brcmf_sdiod_intr_unregister(bus->sdiodev);
 
-                if (bus->sdiodev->bus_if->drvr) {
-                        brcmf_detach(bus->sdiodev->dev);
-                }
+                brcmf_detach(bus->sdiodev->dev);
 
                 cancel_work_sync(&bus->datawork);
                 if (bus->brcmf_wq)
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/firmware.c b/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
new file mode 100644
index 000000000000..7b7d237c1ddb
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
@@ -0,0 +1,332 @@
+/*
+ * Copyright (c) 2013 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/device.h>
+#include <linux/firmware.h>
+
+#include "dhd_dbg.h"
+#include "firmware.h"
+
+enum nvram_parser_state {
+        IDLE,
+        KEY,
+        VALUE,
+        COMMENT,
+        END
+};
+
+/**
+ * struct nvram_parser - internal info for parser.
+ *
+ * @state: current parser state.
+ * @fwnv: input buffer being parsed.
+ * @nvram: output buffer with parse result.
+ * @nvram_len: lenght of parse result.
+ * @line: current line.
+ * @column: current column in line.
+ * @pos: byte offset in input buffer.
+ * @entry: start position of key,value entry.
+ */
+struct nvram_parser {
+        enum nvram_parser_state state;
+        const struct firmware *fwnv;
+        u8 *nvram;
+        u32 nvram_len;
+        u32 line;
+        u32 column;
+        u32 pos;
+        u32 entry;
+};
+
+static bool is_nvram_char(char c)
+{
+        /* comment marker excluded */
+        if (c == '#')
+                return false;
+
+        /* key and value may have any other readable character */
+        return (c > 0x20 && c < 0x7f);
+}
+
+static bool is_whitespace(char c)
+{
+        return (c == ' ' || c == '\r' || c == '\n' || c == '\t');
+}
+
+static enum nvram_parser_state brcmf_nvram_handle_idle(struct nvram_parser *nvp)
+{
+        char c;
+
+        c = nvp->fwnv->data[nvp->pos];
+        if (c == '\n')
+                return COMMENT;
+        if (is_whitespace(c))
+                goto proceed;
+        if (c == '#')
+                return COMMENT;
+        if (is_nvram_char(c)) {
+                nvp->entry = nvp->pos;
+                return KEY;
+        }
+        brcmf_dbg(INFO, "warning: ln=%d:col=%d: ignoring invalid character\n",
+                  nvp->line, nvp->column);
+proceed:
+        nvp->column++;
+        nvp->pos++;
+        return IDLE;
+}
+
+static enum nvram_parser_state brcmf_nvram_handle_key(struct nvram_parser *nvp)
+{
+        enum nvram_parser_state st = nvp->state;
+        char c;
+
+        c = nvp->fwnv->data[nvp->pos];
+        if (c == '=') {
+                st = VALUE;
+        } else if (!is_nvram_char(c)) {
+                brcmf_dbg(INFO, "warning: ln=%d:col=%d: '=' expected, skip invalid key entry\n",
+                          nvp->line, nvp->column);
+                return COMMENT;
+        }
+
+        nvp->column++;
+        nvp->pos++;
+        return st;
+}
+
+static enum nvram_parser_state
+brcmf_nvram_handle_value(struct nvram_parser *nvp)
+{
+        char c;
+        char *skv;
+        char *ekv;
+        u32 cplen;
+
+        c = nvp->fwnv->data[nvp->pos];
+        if (!is_nvram_char(c)) {
+                /* key,value pair complete */
+                ekv = (u8 *)&nvp->fwnv->data[nvp->pos];
+                skv = (u8 *)&nvp->fwnv->data[nvp->entry];
+                cplen = ekv - skv;
+                /* copy to output buffer */
+                memcpy(&nvp->nvram[nvp->nvram_len], skv, cplen);
+                nvp->nvram_len += cplen;
+                nvp->nvram[nvp->nvram_len] = '\0';
+                nvp->nvram_len++;
+                return IDLE;
+        }
+        nvp->pos++;
+        nvp->column++;
+        return VALUE;
+}
+
+static enum nvram_parser_state
+brcmf_nvram_handle_comment(struct nvram_parser *nvp)
+{
+        char *eol, *sol;
+
+        sol = (char *)&nvp->fwnv->data[nvp->pos];
+        eol = strchr(sol, '\n');
+        if (eol == NULL)
+                return END;
+
+        /* eat all moving to next line */
+        nvp->line++;
+        nvp->column = 1;
+        nvp->pos += (eol - sol) + 1;
+        return IDLE;
+}
+
+static enum nvram_parser_state brcmf_nvram_handle_end(struct nvram_parser *nvp)
+{
+        /* final state */
+        return END;
+}
+
+static enum nvram_parser_state
+(*nv_parser_states[])(struct nvram_parser *nvp) = {
+        brcmf_nvram_handle_idle,
+        brcmf_nvram_handle_key,
+        brcmf_nvram_handle_value,
+        brcmf_nvram_handle_comment,
+        brcmf_nvram_handle_end
+};
+
+static int brcmf_init_nvram_parser(struct nvram_parser *nvp,
+                                   const struct firmware *nv)
+{
+        memset(nvp, 0, sizeof(*nvp));
+        nvp->fwnv = nv;
+        /* Alloc for extra 0 byte + roundup by 4 + length field */
+        nvp->nvram = kzalloc(nv->size + 1 + 3 + sizeof(u32), GFP_KERNEL);
+        if (!nvp->nvram)
+                return -ENOMEM;
+
+        nvp->line = 1;
+        nvp->column = 1;
+        return 0;
+}
+
+/* brcmf_nvram_strip :Takes a buffer of "<var>=<value>\n" lines read from a fil
+ * and ending in a NUL. Removes carriage returns, empty lines, comment lines,
+ * and converts newlines to NULs. Shortens buffer as needed and pads with NULs.
+ * End of buffer is completed with token identifying length of buffer.
+ */
+static void *brcmf_fw_nvram_strip(const struct firmware *nv, u32 *new_length)
+{
+        struct nvram_parser nvp;
+        u32 pad;
+        u32 token;
+        __le32 token_le;
+
+        if (brcmf_init_nvram_parser(&nvp, nv) < 0)
+                return NULL;
+
+        while (nvp.pos < nv->size) {
+                nvp.state = nv_parser_states[nvp.state](&nvp);
+                if (nvp.state == END)
+                        break;
+        }
+        pad = nvp.nvram_len;
+        *new_length = roundup(nvp.nvram_len + 1, 4);
+        while (pad != *new_length) {
+                nvp.nvram[pad] = 0;
+                pad++;
+        }
+
+        token = *new_length / 4;
+        token = (~token << 16) | (token & 0x0000FFFF);
+        token_le = cpu_to_le32(token);
+
+        memcpy(&nvp.nvram[*new_length], &token_le, sizeof(token_le));
+        *new_length += sizeof(token_le);
+
+        return nvp.nvram;
+}
+
+void brcmf_fw_nvram_free(void *nvram)
+{
+        kfree(nvram);
+}
+
+struct brcmf_fw {
+        struct device *dev;
+        u16 flags;
+        const struct firmware *code;
+        const char *nvram_name;
+        void (*done)(struct device *dev, const struct firmware *fw,
+                     void *nvram_image, u32 nvram_len);
+};
+
+static void brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
+{
+        struct brcmf_fw *fwctx = ctx;
+        u32 nvram_length = 0;
+        void *nvram = NULL;
+
+        brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(fwctx->dev));
+        if (!fw && !(fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL))
+                goto fail;
+
+        if (fw) {
+                nvram = brcmf_fw_nvram_strip(fw, &nvram_length);
+                release_firmware(fw);
+                if (!nvram && !(fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL))
+                        goto fail;
+        }
+
+        fwctx->done(fwctx->dev, fwctx->code, nvram, nvram_length);
+        kfree(fwctx);
+        return;
+
+fail:
+        brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev));
+        if (fwctx->code)
+                release_firmware(fwctx->code);
+        device_release_driver(fwctx->dev);
+        kfree(fwctx);
+}
+
+static void brcmf_fw_request_code_done(const struct firmware *fw, void *ctx)
+{
+        struct brcmf_fw *fwctx = ctx;
+        int ret;
+
+        brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(fwctx->dev));
+        if (!fw)
+                goto fail;
+
+        /* only requested code so done here */
+        if (!(fwctx->flags & BRCMF_FW_REQUEST_NVRAM)) {
+                fwctx->done(fwctx->dev, fw, NULL, 0);
+                kfree(fwctx);
+                return;
+        }
+        fwctx->code = fw;
+        ret = request_firmware_nowait(THIS_MODULE, true, fwctx->nvram_name,
+                                      fwctx->dev, GFP_KERNEL, fwctx,
+                                      brcmf_fw_request_nvram_done);
+
+        if (!ret)
+                return;
+
+        /* when nvram is optional call .done() callback here */
+        if (fwctx->flags & BRCMF_FW_REQ_NV_OPTIONAL) {
+                fwctx->done(fwctx->dev, fw, NULL, 0);
+                kfree(fwctx);
+                return;
+        }
+
+        /* failed nvram request */
+        release_firmware(fw);
+fail:
+        brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev));
+        device_release_driver(fwctx->dev);
+        kfree(fwctx);
+}
+
+int brcmf_fw_get_firmwares(struct device *dev, u16 flags,
+                           const char *code, const char *nvram,
+                           void (*fw_cb)(struct device *dev,
+                                         const struct firmware *fw,
+                                         void *nvram_image, u32 nvram_len))
+{
+        struct brcmf_fw *fwctx;
+
+        brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(dev));
+        if (!fw_cb || !code)
+                return -EINVAL;
+
+        if ((flags & BRCMF_FW_REQUEST_NVRAM) && !nvram)
+                return -EINVAL;
+
+        fwctx = kzalloc(sizeof(*fwctx), GFP_KERNEL);
+        if (!fwctx)
+                return -ENOMEM;
+
+        fwctx->dev = dev;
+        fwctx->flags = flags;
+        fwctx->done = fw_cb;
+        if (flags & BRCMF_FW_REQUEST_NVRAM)
+                fwctx->nvram_name = nvram;
+
+        return request_firmware_nowait(THIS_MODULE, true, code, dev,
+                                       GFP_KERNEL, fwctx,
+                                       brcmf_fw_request_code_done);
+}
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/nvram.h b/drivers/net/wireless/brcm80211/brcmfmac/firmware.h
index d454580928c9..6431bfd7afff 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/nvram.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/firmware.h
@@ -13,12 +13,24 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
-#ifndef BRCMFMAC_NVRAM_H
-#define BRCMFMAC_NVRAM_H
+#ifndef BRCMFMAC_FIRMWARE_H
+#define BRCMFMAC_FIRMWARE_H
 
+#define BRCMF_FW_REQUEST                0x000F
+#define  BRCMF_FW_REQUEST_NVRAM         0x0001
+#define BRCMF_FW_REQ_FLAGS              0x00F0
+#define  BRCMF_FW_REQ_NV_OPTIONAL       0x0010
 
-void *brcmf_nvram_strip(const struct firmware *nv, u32 *new_length);
-void brcmf_nvram_free(void *nvram);
-
+void brcmf_fw_nvram_free(void *nvram);
+/*
+ * Request firmware(s) asynchronously. When the asynchronous request
+ * fails it will not use the callback, but call device_release_driver()
+ * instead which will call the driver .remove() callback.
+ */
+int brcmf_fw_get_firmwares(struct device *dev, u16 flags,
+                           const char *code, const char *nvram,
+                           void (*fw_cb)(struct device *dev,
+                                         const struct firmware *fw,
+                                         void *nvram_image, u32 nvram_len));
 
-#endif /* BRCMFMAC_NVRAM_H */
+#endif /* BRCMFMAC_FIRMWARE_H */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
index 614e4888504f..2bc68a2137fc 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
@@ -53,6 +53,14 @@
 #define BRCMF_OBSS_COEX_OFF             0
 #define BRCMF_OBSS_COEX_ON              1
 
+/* join preference types for join_pref iovar */
+enum brcmf_join_pref_types {
+        BRCMF_JOIN_PREF_RSSI = 1,
+        BRCMF_JOIN_PREF_WPA,
+        BRCMF_JOIN_PREF_BAND,
+        BRCMF_JOIN_PREF_RSSI_DELTA,
+};
+
 enum brcmf_fil_p2p_if_types {
         BRCMF_FIL_P2P_IF_CLIENT,
         BRCMF_FIL_P2P_IF_GO,
@@ -282,6 +290,22 @@ struct brcmf_assoc_params_le {
         __le16 chanspec_list[1];
 };
 
+/**
+ * struct join_pref params - parameters for preferred join selection.
+ *
+ * @type: preference type (see enum brcmf_join_pref_types).
+ * @len: length of bytes following (currently always 2).
+ * @rssi_gain: signal gain for selection (only when @type is RSSI_DELTA).
+ * @band: band to which selection preference applies.
+ *      This is used if @type is BAND or RSSI_DELTA.
+ */
+struct brcmf_join_pref_params {
+        u8 type;
+        u8 len;
+        u8 rssi_gain;
+        u8 band;
+};
+
 /* used for join with or without a specific bssid and channel list */
 struct brcmf_join_params {
         struct brcmf_ssid_le ssid_le;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
index c3e7d76dbf35..699908de314a 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
@@ -476,6 +476,7 @@ struct brcmf_fws_info {
         bool bus_flow_blocked;
         bool creditmap_received;
         u8 mode;
+        bool avoid_queueing;
 };
 
 /*
@@ -1369,13 +1370,12 @@ done:
 }
 
 static int brcmf_fws_txstatus_suppressed(struct brcmf_fws_info *fws, int fifo,
-                                         struct sk_buff *skb, u32 genbit,
-                                         u16 seq)
+                                         struct sk_buff *skb, u8 ifidx,
+                                         u32 genbit, u16 seq)
 {
         struct brcmf_fws_mac_descriptor *entry = brcmf_skbcb(skb)->mac;
         u32 hslot;
         int ret;
-        u8 ifidx;
 
         hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
 
@@ -1389,29 +1389,21 @@ static int brcmf_fws_txstatus_suppressed(struct brcmf_fws_info *fws, int fifo,
 
         entry->generation = genbit;
 
-        ret = brcmf_proto_hdrpull(fws->drvr, false, &ifidx, skb);
-        if (ret == 0) {
-                brcmf_skb_htod_tag_set_field(skb, GENERATION, genbit);
-                brcmf_skbcb(skb)->htod_seq = seq;
-                if (brcmf_skb_htod_seq_get_field(skb, FROMFW)) {
-                        brcmf_skb_htod_seq_set_field(skb, FROMDRV, 1);
-                        brcmf_skb_htod_seq_set_field(skb, FROMFW, 0);
-                } else {
-                        brcmf_skb_htod_seq_set_field(skb, FROMDRV, 0);
-                }
-                ret = brcmf_fws_enq(fws, BRCMF_FWS_SKBSTATE_SUPPRESSED, fifo,
-                                    skb);
+        brcmf_skb_htod_tag_set_field(skb, GENERATION, genbit);
+        brcmf_skbcb(skb)->htod_seq = seq;
+        if (brcmf_skb_htod_seq_get_field(skb, FROMFW)) {
+                brcmf_skb_htod_seq_set_field(skb, FROMDRV, 1);
+                brcmf_skb_htod_seq_set_field(skb, FROMFW, 0);
+        } else {
+                brcmf_skb_htod_seq_set_field(skb, FROMDRV, 0);
         }
+        ret = brcmf_fws_enq(fws, BRCMF_FWS_SKBSTATE_SUPPRESSED, fifo, skb);
 
         if (ret != 0) {
-                /* suppress q is full or hdrpull failed, drop this packet */
-                brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb,
-                                        true);
+                /* suppress q is full drop this packet */
+                brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb, true);
         } else {
-                /*
-                 * Mark suppressed to avoid a double free during
-                 * wlfc cleanup
-                 */
+                /* Mark suppressed to avoid a double free during wlfc cleanup */
                 brcmf_fws_hanger_mark_suppressed(&fws->hanger, hslot);
         }
 
@@ -1428,6 +1420,7 @@ brcmf_fws_txs_process(struct brcmf_fws_info *fws, u8 flags, u32 hslot,
         struct sk_buff *skb;
         struct brcmf_skbuff_cb *skcb;
         struct brcmf_fws_mac_descriptor *entry = NULL;
+        u8 ifidx;
 
         brcmf_dbg(DATA, "flags %d\n", flags);
 
@@ -1476,12 +1469,15 @@ brcmf_fws_txs_process(struct brcmf_fws_info *fws, u8 flags, u32 hslot,
         }
         brcmf_fws_macdesc_return_req_credit(skb);
 
+        if (brcmf_proto_hdrpull(fws->drvr, false, &ifidx, skb)) {
+                brcmu_pkt_buf_free_skb(skb);
+                return -EINVAL;
+        }
         if (!remove_from_hanger)
-                ret = brcmf_fws_txstatus_suppressed(fws, fifo, skb, genbit,
-                                                    seq);
-
+                ret = brcmf_fws_txstatus_suppressed(fws, fifo, skb, ifidx,
+                                                    genbit, seq);
         if (remove_from_hanger || ret)
-                brcmf_txfinalize(fws->drvr, skb, true);
+                brcmf_txfinalize(fws->drvr, skb, ifidx, true);
 
         return 0;
 }
@@ -1868,7 +1864,7 @@ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
         struct ethhdr *eh = (struct ethhdr *)(skb->data);
         int fifo = BRCMF_FWS_FIFO_BCMC;
         bool multicast = is_multicast_ether_addr(eh->h_dest);
-        bool pae = eh->h_proto == htons(ETH_P_PAE);
+        int rc = 0;
 
         brcmf_dbg(DATA, "tx proto=0x%X\n", ntohs(eh->h_proto));
         /* determine the priority */
@@ -1876,8 +1872,13 @@ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
                 skb->priority = cfg80211_classify8021d(skb, NULL);
 
         drvr->tx_multicast += !!multicast;
-        if (pae)
-                atomic_inc(&ifp->pend_8021x_cnt);
+
+        if (fws->avoid_queueing) {
+                rc = brcmf_proto_txdata(drvr, ifp->ifidx, 0, skb);
+                if (rc < 0)
+                        brcmf_txfinalize(drvr, skb, ifp->ifidx, false);
+                return rc;
+        }
 
         /* set control buffer information */
         skcb->if_flags = 0;
@@ -1899,15 +1900,12 @@ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
                 brcmf_fws_schedule_deq(fws);
         } else {
                 brcmf_err("drop skb: no hanger slot\n");
-                if (pae) {
-                        atomic_dec(&ifp->pend_8021x_cnt);
-                        if (waitqueue_active(&ifp->pend_8021x_wait))
-                                wake_up(&ifp->pend_8021x_wait);
-                }
-                brcmu_pkt_buf_free_skb(skb);
+                brcmf_txfinalize(drvr, skb, ifp->ifidx, false);
+                rc = -ENOMEM;
         }
         brcmf_fws_unlock(fws);
-        return 0;
+
+        return rc;
 }
 
 void brcmf_fws_reset_interface(struct brcmf_if *ifp)
@@ -1982,7 +1980,8 @@ static void brcmf_fws_dequeue_worker(struct work_struct *worker)
                                 ret = brcmf_proto_txdata(drvr, ifidx, 0, skb);
                                 brcmf_fws_lock(fws);
                                 if (ret < 0)
-                                        brcmf_txfinalize(drvr, skb, false);
+                                        brcmf_txfinalize(drvr, skb, ifidx,
+                                                         false);
                                 if (fws->bus_flow_blocked)
                                         break;
                         }
@@ -2039,6 +2038,13 @@ int brcmf_fws_init(struct brcmf_pub *drvr)
         fws->drvr = drvr;
         fws->fcmode = fcmode;
 
+        if ((drvr->bus_if->always_use_fws_queue == false) &&
+            (fcmode == BRCMF_FWS_FCMODE_NONE)) {
+                fws->avoid_queueing = true;
+                brcmf_dbg(INFO, "FWS queueing will be avoided\n");
+                return 0;
+        }
+
         fws->fws_wq = create_singlethread_workqueue("brcmf_fws_wq");
         if (fws->fws_wq == NULL) {
                 brcmf_err("workqueue creation failed\n");
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/nvram.c b/drivers/net/wireless/brcm80211/brcmfmac/nvram.c
deleted file mode 100644
index d5ef86db631b..000000000000
--- a/drivers/net/wireless/brcm80211/brcmfmac/nvram.c
+++ /dev/null
@@ -1,94 +0,0 @@
-/*
- * Copyright (c) 2013 Broadcom Corporation
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#include <linux/kernel.h>
-#include <linux/slab.h>
-#include <linux/firmware.h>
-
-#include "nvram.h"
-
-/* brcmf_nvram_strip :Takes a buffer of "<var>=<value>\n" lines read from a file
- * and ending in a NUL. Removes carriage returns, empty lines, comment lines,
- * and converts newlines to NULs. Shortens buffer as needed and pads with NULs.
- * End of buffer is completed with token identifying length of buffer.
- */
-void *brcmf_nvram_strip(const struct firmware *nv, u32 *new_length)
-{
-        u8 *nvram;
-        u32 i;
-        u32 len;
-        u32 column;
-        u8 val;
-        bool comment;
-        u32 token;
-        __le32 token_le;
-
-        /* Alloc for extra 0 byte + roundup by 4 + length field */
-        nvram = kmalloc(nv->size + 1 + 3 + sizeof(token_le), GFP_KERNEL);
-        if (!nvram)
-                return NULL;
-
-        len = 0;
-        column = 0;
-        comment = false;
-        for (i = 0; i < nv->size; i++) {
-                val = nv->data[i];
-                if (val == 0)
-                        break;
-                if (val == '\r')
-                        continue;
-                if (comment && (val != '\n'))
-                        continue;
-                comment = false;
-                if (val == '#') {
-                        comment = true;
-                        continue;
-                }
-                if (val == '\n') {
-                        if (column == 0)
-                                continue;
-                        nvram[len] = 0;
-                        len++;
-                        column = 0;
-                        continue;
-                }
-                nvram[len] = val;
-                len++;
-                column++;
-        }
-        column = len;
-        *new_length = roundup(len + 1, 4);
-        while (column != *new_length) {
-                nvram[column] = 0;
-                column++;
-        }
-
-        token = *new_length / 4;
-        token = (~token << 16) | (token & 0x0000FFFF);
-        token_le = cpu_to_le32(token);
-
-        memcpy(&nvram[*new_length], &token_le, sizeof(token_le));
-        *new_length += sizeof(token_le);
-
-        return nvram;
-}
-
-void brcmf_nvram_free(void *nvram)
-{
-        kfree(nvram);
-}
-
-
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index 24f65cd53859..6db51a666f61 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -25,6 +25,7 @@
 #include <dhd_bus.h>
 #include <dhd_dbg.h>
 
+#include "firmware.h"
 #include "usb_rdl.h"
 #include "usb.h"
 
@@ -61,12 +62,6 @@ struct brcmf_usb_image {
         u8 *image;
         int image_len;
 };
-static struct list_head fw_image_list;
-
-struct intr_transfer_buf {
-        u32 notification;
-        u32 reserved;
-};
 
 struct brcmf_usbdev_info {
         struct brcmf_usbdev bus_pub; /* MUST BE FIRST */
@@ -75,7 +70,7 @@ struct brcmf_usbdev_info {
         struct list_head rx_postq;
         struct list_head tx_freeq;
         struct list_head tx_postq;
-        uint rx_pipe, tx_pipe, intr_pipe, rx_pipe2;
+        uint rx_pipe, tx_pipe, rx_pipe2;
 
         int rx_low_watermark;
         int tx_low_watermark;
@@ -87,7 +82,7 @@ struct brcmf_usbdev_info {
         struct brcmf_usbreq *tx_reqs;
         struct brcmf_usbreq *rx_reqs;
 
-        u8 *image;      /* buffer for combine fw and nvram */
+        const u8 *image;        /* buffer for combine fw and nvram */
         int image_len;
 
         struct usb_device *usbdev;
@@ -104,10 +99,6 @@ struct brcmf_usbdev_info {
         ulong ctl_op;
 
         struct urb *bulk_urb; /* used for FW download */
-        struct urb *intr_urb; /* URB for interrupt endpoint */
-        int intr_size;          /* Size of interrupt message */
-        int interval;           /* Interrupt polling interval */
-        struct intr_transfer_buf intr; /* Data buffer for interrupt endpoint */
 };
 
 static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
@@ -531,39 +522,6 @@ brcmf_usb_state_change(struct brcmf_usbdev_info *devinfo, int state)
         }
 }
 
-static void
-brcmf_usb_intr_complete(struct urb *urb)
-{
-        struct brcmf_usbdev_info *devinfo =
-                        (struct brcmf_usbdev_info *)urb->context;
-        int err;
-
-        brcmf_dbg(USB, "Enter, urb->status=%d\n", urb->status);
-
-        if (devinfo == NULL)
-                return;
-
-        if (unlikely(urb->status)) {
-                if (urb->status == -ENOENT ||
-                    urb->status == -ESHUTDOWN ||
-                    urb->status == -ENODEV) {
-                        brcmf_usb_state_change(devinfo,
-                                               BRCMFMAC_USB_STATE_DOWN);
-                }
-        }
-
-        if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_DOWN) {
-                brcmf_err("intr cb when DBUS down, ignoring\n");
-                return;
-        }
-
-        if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP) {
-                err = usb_submit_urb(devinfo->intr_urb, GFP_ATOMIC);
-                if (err)
-                        brcmf_err("usb_submit_urb, err=%d\n", err);
-        }
-}
-
 static int brcmf_usb_tx(struct device *dev, struct sk_buff *skb)
 {
         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
@@ -619,7 +577,6 @@ static int brcmf_usb_up(struct device *dev)
 {
         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
         u16 ifnum;
-        int ret;
 
         brcmf_dbg(USB, "Enter\n");
         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP)
@@ -628,23 +585,6 @@ static int brcmf_usb_up(struct device *dev)
         /* Success, indicate devinfo is fully up */
         brcmf_usb_state_change(devinfo, BRCMFMAC_USB_STATE_UP);
 
-        if (devinfo->intr_urb) {
-                usb_fill_int_urb(devinfo->intr_urb, devinfo->usbdev,
-                        devinfo->intr_pipe,
-                        &devinfo->intr,
-                        devinfo->intr_size,
-                        (usb_complete_t)brcmf_usb_intr_complete,
-                        devinfo,
-                        devinfo->interval);
-
-                ret = usb_submit_urb(devinfo->intr_urb, GFP_ATOMIC);
-                if (ret) {
-                        brcmf_err("USB_SUBMIT_URB failed with status %d\n",
-                                  ret);
-                        return -EINVAL;
-                }
-        }
-
         if (devinfo->ctl_urb) {
                 devinfo->ctl_in_pipe = usb_rcvctrlpipe(devinfo->usbdev, 0);
                 devinfo->ctl_out_pipe = usb_sndctrlpipe(devinfo->usbdev, 0);
@@ -681,8 +621,6 @@ static void brcmf_usb_down(struct device *dev)
                 return;
 
         brcmf_usb_state_change(devinfo, BRCMFMAC_USB_STATE_DOWN);
-        if (devinfo->intr_urb)
-                usb_kill_urb(devinfo->intr_urb);
 
         if (devinfo->ctl_urb)
                 usb_kill_urb(devinfo->ctl_urb);
@@ -1021,7 +959,7 @@ brcmf_usb_fw_download(struct brcmf_usbdev_info *devinfo)
         }
 
         err = brcmf_usb_dlstart(devinfo,
-                devinfo->image, devinfo->image_len);
+                (u8 *)devinfo->image, devinfo->image_len);
         if (err == 0)
                 err = brcmf_usb_dlrun(devinfo);
         return err;
@@ -1036,7 +974,6 @@ static void brcmf_usb_detach(struct brcmf_usbdev_info *devinfo)
         brcmf_usb_free_q(&devinfo->rx_freeq, false);
         brcmf_usb_free_q(&devinfo->tx_freeq, false);
 
-        usb_free_urb(devinfo->intr_urb);
         usb_free_urb(devinfo->ctl_urb);
         usb_free_urb(devinfo->bulk_urb);
 
@@ -1080,68 +1017,20 @@ static int check_file(const u8 *headers)
         return -1;
 }
 
-static int brcmf_usb_get_fw(struct brcmf_usbdev_info *devinfo)
+static const char *brcmf_usb_get_fwname(struct brcmf_usbdev_info *devinfo)
 {
-        s8 *fwname;
-        const struct firmware *fw;
-        struct brcmf_usb_image *fw_image;
-        int err;
-
-        brcmf_dbg(USB, "Enter\n");
         switch (devinfo->bus_pub.devid) {
         case 43143:
-                fwname = BRCMF_USB_43143_FW_NAME;
-                break;
+                return BRCMF_USB_43143_FW_NAME;
         case 43235:
         case 43236:
         case 43238:
-                fwname = BRCMF_USB_43236_FW_NAME;
-                break;
+                return BRCMF_USB_43236_FW_NAME;
         case 43242:
-                fwname = BRCMF_USB_43242_FW_NAME;
-                break;
+                return BRCMF_USB_43242_FW_NAME;
         default:
-                return -EINVAL;
-                break;
-        }
-        brcmf_dbg(USB, "Loading FW %s\n", fwname);
-        list_for_each_entry(fw_image, &fw_image_list, list) {
-                if (fw_image->fwname == fwname) {
-                        devinfo->image = fw_image->image;
-                        devinfo->image_len = fw_image->image_len;
-                        return 0;
-                }
-        }
-        /* fw image not yet loaded. Load it now and add to list */
-        err = request_firmware(&fw, fwname, devinfo->dev);
-        if (!fw) {
-                brcmf_err("fail to request firmware %s\n", fwname);
-                return err;
-        }
-        if (check_file(fw->data) < 0) {
-                brcmf_err("invalid firmware %s\n", fwname);
-                return -EINVAL;
+                return NULL;
         }
-
-        fw_image = kzalloc(sizeof(*fw_image), GFP_ATOMIC);
-        if (!fw_image)
-                return -ENOMEM;
-        INIT_LIST_HEAD(&fw_image->list);
-        list_add_tail(&fw_image->list, &fw_image_list);
-        fw_image->fwname = fwname;
-        fw_image->image = vmalloc(fw->size);
-        if (!fw_image->image)
-                return -ENOMEM;
-
-        memcpy(fw_image->image, fw->data, fw->size);
-        fw_image->image_len = fw->size;
-
-        release_firmware(fw);
-
-        devinfo->image = fw_image->image;
-        devinfo->image_len = fw_image->image_len;
-
-        return 0;
 }
 
 
@@ -1186,11 +1075,6 @@ struct brcmf_usbdev *brcmf_usb_attach(struct brcmf_usbdev_info *devinfo,
                 goto error;
         devinfo->tx_freecount = ntxq;
 
-        devinfo->intr_urb = usb_alloc_urb(0, GFP_ATOMIC);
-        if (!devinfo->intr_urb) {
-                brcmf_err("usb_alloc_urb (intr) failed\n");
-                goto error;
-        }
         devinfo->ctl_urb = usb_alloc_urb(0, GFP_ATOMIC);
         if (!devinfo->ctl_urb) {
                 brcmf_err("usb_alloc_urb (ctl) failed\n");
@@ -1202,16 +1086,6 @@ struct brcmf_usbdev *brcmf_usb_attach(struct brcmf_usbdev_info *devinfo,
                 goto error;
         }
 
-        if (!brcmf_usb_dlneeded(devinfo))
-                return &devinfo->bus_pub;
-
-        brcmf_dbg(USB, "Start fw downloading\n");
-        if (brcmf_usb_get_fw(devinfo))
-                goto error;
-
-        if (brcmf_usb_fw_download(devinfo))
-                goto error;
-
         return &devinfo->bus_pub;
 
 error:
@@ -1222,18 +1096,77 @@ error:
 
 static struct brcmf_bus_ops brcmf_usb_bus_ops = {
         .txdata = brcmf_usb_tx,
-        .init = brcmf_usb_up,
         .stop = brcmf_usb_down,
         .txctl = brcmf_usb_tx_ctlpkt,
         .rxctl = brcmf_usb_rx_ctlpkt,
 };
 
+static int brcmf_usb_bus_setup(struct brcmf_usbdev_info *devinfo)
+{
+        int ret;
+
+        /* Attach to the common driver interface */
+        ret = brcmf_attach(devinfo->dev);
+        if (ret) {
+                brcmf_err("brcmf_attach failed\n");
+                return ret;
+        }
+
+        ret = brcmf_usb_up(devinfo->dev);
+        if (ret)
+                goto fail;
+
+        ret = brcmf_bus_start(devinfo->dev);
+        if (ret)
+                goto fail;
+
+        return 0;
+fail:
+        brcmf_detach(devinfo->dev);
+        return ret;
+}
+
+static void brcmf_usb_probe_phase2(struct device *dev,
+                                   const struct firmware *fw,
+                                   void *nvram, u32 nvlen)
+{
+        struct brcmf_bus *bus = dev_get_drvdata(dev);
+        struct brcmf_usbdev_info *devinfo;
+        int ret;
+
+        brcmf_dbg(USB, "Start fw downloading\n");
+        ret = check_file(fw->data);
+        if (ret < 0) {
+                brcmf_err("invalid firmware\n");
+                release_firmware(fw);
+                goto error;
+        }
+
+        devinfo = bus->bus_priv.usb->devinfo;
+        devinfo->image = fw->data;
+        devinfo->image_len = fw->size;
+
+        ret = brcmf_usb_fw_download(devinfo);
+        release_firmware(fw);
+        if (ret)
+                goto error;
+
+        ret = brcmf_usb_bus_setup(devinfo);
+        if (ret)
+                goto error;
+
+        return;
+error:
+        brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), ret);
+        device_release_driver(dev);
+}
+
 static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo)
 {
         struct brcmf_bus *bus = NULL;
         struct brcmf_usbdev *bus_pub = NULL;
-        int ret;
         struct device *dev = devinfo->dev;
+        int ret;
 
         brcmf_dbg(USB, "Enter\n");
         bus_pub = brcmf_usb_attach(devinfo, BRCMF_USB_NRXQ, BRCMF_USB_NTXQ);
@@ -1254,22 +1187,18 @@ static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo)
         bus->chip = bus_pub->devid;
         bus->chiprev = bus_pub->chiprev;
         bus->proto_type = BRCMF_PROTO_BCDC;
+        bus->always_use_fws_queue = true;
 
-        /* Attach to the common driver interface */
-        ret = brcmf_attach(dev);
-        if (ret) {
-                brcmf_err("brcmf_attach failed\n");
-                goto fail;
-        }
-
-        ret = brcmf_bus_start(dev);
-        if (ret) {
-                brcmf_err("dongle is not responding\n");
-                brcmf_detach(dev);
-                goto fail;
+        if (!brcmf_usb_dlneeded(devinfo)) {
+                ret = brcmf_usb_bus_setup(devinfo);
+                if (ret)
+                        goto fail;
         }
-
+        /* request firmware here */
+        brcmf_fw_get_firmwares(dev, 0, brcmf_usb_get_fwname(devinfo), NULL,
+                               brcmf_usb_probe_phase2);
         return 0;
+
 fail:
         /* Release resources in reverse order */
         kfree(bus);
@@ -1357,9 +1286,6 @@ brcmf_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
                 goto fail;
         }
 
-        endpoint_num = endpoint->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
-        devinfo->intr_pipe = usb_rcvintpipe(usb, endpoint_num);
-
         devinfo->rx_pipe = 0;
         devinfo->rx_pipe2 = 0;
         devinfo->tx_pipe = 0;
@@ -1391,16 +1317,9 @@ brcmf_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
                 }
         }
 
-        /* Allocate interrupt URB and data buffer */
-        /* RNDIS says 8-byte intr, our old drivers used 4-byte */
-        if (IFEPDESC(usb, CONTROL_IF, 0).wMaxPacketSize == cpu_to_le16(16))
-                devinfo->intr_size = 8;
-        else
-                devinfo->intr_size = 4;
-
-        devinfo->interval = IFEPDESC(usb, CONTROL_IF, 0).bInterval;
-
-        if (usb->speed == USB_SPEED_HIGH)
+        if (usb->speed == USB_SPEED_SUPER)
+                brcmf_dbg(USB, "Broadcom super speed USB wireless device detected\n");
+        else if (usb->speed == USB_SPEED_HIGH)
                 brcmf_dbg(USB, "Broadcom high speed USB wireless device detected\n");
         else
                 brcmf_dbg(USB, "Broadcom full speed USB wireless device detected\n");
@@ -1455,23 +1374,18 @@ static int brcmf_usb_resume(struct usb_interface *intf)
         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
 
         brcmf_dbg(USB, "Enter\n");
-        if (!brcmf_attach(devinfo->dev))
-                return brcmf_bus_start(&usb->dev);
-
-        return 0;
+        return brcmf_usb_bus_setup(devinfo);
 }
 
 static int brcmf_usb_reset_resume(struct usb_interface *intf)
 {
         struct usb_device *usb = interface_to_usbdev(intf);
         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
-
         brcmf_dbg(USB, "Enter\n");
 
-        if (!brcmf_usb_fw_download(devinfo))
-                return brcmf_usb_resume(intf);
-
-        return -EIO;
+        return brcmf_fw_get_firmwares(&usb->dev, 0,
+                                      brcmf_usb_get_fwname(devinfo), NULL,
+                                      brcmf_usb_probe_phase2);
 }
 
 #define BRCMF_USB_VENDOR_ID_BROADCOM    0x0a5c
@@ -1506,16 +1420,6 @@ static struct usb_driver brcmf_usbdrvr = {
         .disable_hub_initiated_lpm = 1,
 };
 
-static void brcmf_release_fw(struct list_head *q)
-{
-        struct brcmf_usb_image *fw_image, *next;
-
-        list_for_each_entry_safe(fw_image, next, q, list) {
-                vfree(fw_image->image);
-                list_del_init(&fw_image->list);
-        }
-}
-
 static int brcmf_usb_reset_device(struct device *dev, void *notused)
 {
         /* device past is the usb interface so we
@@ -1534,12 +1438,10 @@ void brcmf_usb_exit(void)
         ret = driver_for_each_device(drv, NULL, NULL,
                                      brcmf_usb_reset_device);
         usb_deregister(&brcmf_usbdrvr);
-        brcmf_release_fw(&fw_image_list);
 }
 
 void brcmf_usb_register(void)
 {
         brcmf_dbg(USB, "Enter\n");
-        INIT_LIST_HEAD(&fw_image_list);
         usb_register(&brcmf_usbdrvr);
 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index be1985296bdc..d8fa276e368b 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -221,9 +221,9 @@ static const struct ieee80211_regdomain brcmf_regdom = {
                  */
                 REG_RULE(2484-10, 2484+10, 20, 6, 20, 0),
                 /* IEEE 802.11a, channel 36..64 */
-                REG_RULE(5150-10, 5350+10, 40, 6, 20, 0),
+                REG_RULE(5150-10, 5350+10, 80, 6, 20, 0),
                 /* IEEE 802.11a, channel 100..165 */
-                REG_RULE(5470-10, 5850+10, 40, 6, 20, 0), }
+                REG_RULE(5470-10, 5850+10, 80, 6, 20, 0), }
 };
 
 static const u32 __wl_cipher_suites[] = {
@@ -341,6 +341,60 @@ static u8 brcmf_mw_to_qdbm(u16 mw)
         return qdbm;
 }
 
+static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
+                               struct cfg80211_chan_def *ch)
+{
+        struct brcmu_chan ch_inf;
+        s32 primary_offset;
+
+        brcmf_dbg(TRACE, "chandef: control %d center %d width %d\n",
+                  ch->chan->center_freq, ch->center_freq1, ch->width);
+        ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq1);
+        primary_offset = ch->center_freq1 - ch->chan->center_freq;
+        switch (ch->width) {
+        case NL80211_CHAN_WIDTH_20:
+                ch_inf.bw = BRCMU_CHAN_BW_20;
+                WARN_ON(primary_offset != 0);
+                break;
+        case NL80211_CHAN_WIDTH_40:
+                ch_inf.bw = BRCMU_CHAN_BW_40;
+                if (primary_offset < 0)
+                        ch_inf.sb = BRCMU_CHAN_SB_U;
+                else
+                        ch_inf.sb = BRCMU_CHAN_SB_L;
+                break;
+        case NL80211_CHAN_WIDTH_80:
+                ch_inf.bw = BRCMU_CHAN_BW_80;
+                if (primary_offset < 0) {
+                        if (primary_offset < -CH_10MHZ_APART)
+                                ch_inf.sb = BRCMU_CHAN_SB_UU;
+                        else
+                                ch_inf.sb = BRCMU_CHAN_SB_UL;
+                } else {
+                        if (primary_offset > CH_10MHZ_APART)
+                                ch_inf.sb = BRCMU_CHAN_SB_LL;
+                        else
+                                ch_inf.sb = BRCMU_CHAN_SB_LU;
+                }
+                break;
+        default:
+                WARN_ON_ONCE(1);
+        }
+        switch (ch->chan->band) {
+        case IEEE80211_BAND_2GHZ:
+                ch_inf.band = BRCMU_CHAN_BAND_2G;
+                break;
+        case IEEE80211_BAND_5GHZ:
+                ch_inf.band = BRCMU_CHAN_BAND_5G;
+                break;
+        default:
+                WARN_ON_ONCE(1);
+        }
+        d11inf->encchspec(&ch_inf);
+
+        return ch_inf.chspec;
+}
+
 u16 channel_to_chanspec(struct brcmu_d11inf *d11inf,
                         struct ieee80211_channel *ch)
 {
@@ -586,6 +640,9 @@ s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
                 if (err)
                         brcmf_err("Scan abort  failed\n");
         }
+
+        brcmf_set_mpc(ifp, 1);
+
         /*
          * e-scan can be initiated by scheduled scan
          * which takes precedence.
@@ -595,12 +652,10 @@ s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
                 cfg->sched_escan = false;
                 if (!aborted)
                         cfg80211_sched_scan_results(cfg_to_wiphy(cfg));
-                brcmf_set_mpc(ifp, 1);
         } else if (scan_request) {
                 brcmf_dbg(SCAN, "ESCAN Completed scan: %s\n",
                           aborted ? "Aborted" : "Done");
                 cfg80211_scan_done(scan_request, aborted);
-                brcmf_set_mpc(ifp, 1);
         }
         if (!test_and_clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
                 brcmf_dbg(SCAN, "Scan complete, probably P2P scan\n");
@@ -1236,8 +1291,8 @@ brcmf_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *ndev,
                                 params->chandef.chan->center_freq);
                 if (params->channel_fixed) {
                         /* adding chanspec */
-                        chanspec = channel_to_chanspec(&cfg->d11inf,
-                                                       params->chandef.chan);
+                        chanspec = chandef_to_chanspec(&cfg->d11inf,
+                                                       &params->chandef);
                         join_params.params_le.chanspec_list[0] =
                                 cpu_to_le16(chanspec);
                         join_params.params_le.chanspec_num = cpu_to_le32(1);
@@ -2182,7 +2237,7 @@ brcmf_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
 
 static s32
 brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
-                           u8 *mac, struct station_info *sinfo)
+                           const u8 *mac, struct station_info *sinfo)
 {
         struct brcmf_if *ifp = netdev_priv(ndev);
         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
@@ -3124,7 +3179,7 @@ brcmf_cfg80211_sched_scan_start(struct wiphy *wiphy,
         }
 
         if (!request->n_ssids || !request->n_match_sets) {
-                brcmf_err("Invalid sched scan req!! n_ssids:%d\n",
+                brcmf_dbg(SCAN, "Invalid sched scan req!! n_ssids:%d\n",
                           request->n_ssids);
                 return -EINVAL;
         }
@@ -3734,23 +3789,6 @@ brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
 }
 
 static s32
-brcmf_cfg80211_set_channel(struct brcmf_cfg80211_info *cfg,
-                           struct brcmf_if *ifp,
-                           struct ieee80211_channel *channel)
-{
-        u16 chanspec;
-        s32 err;
-
-        brcmf_dbg(TRACE, "band=%d, center_freq=%d\n", channel->band,
-                  channel->center_freq);
-
-        chanspec = channel_to_chanspec(&cfg->d11inf, channel);
-        err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
-
-        return err;
-}
-
-static s32
 brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
                         struct cfg80211_ap_settings *settings)
 {
@@ -3765,11 +3803,12 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
         struct brcmf_join_params join_params;
         enum nl80211_iftype dev_role;
         struct brcmf_fil_bss_enable_le bss_enable;
+        u16 chanspec;
 
-        brcmf_dbg(TRACE, "channel_type=%d, beacon_interval=%d, dtim_period=%d,\n",
-                  cfg80211_get_chandef_type(&settings->chandef),
-                  settings->beacon_interval,
-                  settings->dtim_period);
+        brcmf_dbg(TRACE, "ctrlchn=%d, center=%d, bw=%d, beacon_interval=%d, dtim_period=%d,\n",
+                  settings->chandef.chan->hw_value,
+                  settings->chandef.center_freq1, settings->chandef.width,
+                  settings->beacon_interval, settings->dtim_period);
         brcmf_dbg(TRACE, "ssid=%s(%zu), auth_type=%d, inactivity_timeout=%d\n",
                   settings->ssid, settings->ssid_len, settings->auth_type,
                   settings->inactivity_timeout);
@@ -3826,9 +3865,10 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
 
         brcmf_config_ap_mgmt_ie(ifp->vif, &settings->beacon);
 
-        err = brcmf_cfg80211_set_channel(cfg, ifp, settings->chandef.chan);
+        chanspec = chandef_to_chanspec(&cfg->d11inf, &settings->chandef);
+        err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
         if (err < 0) {
-                brcmf_err("Set Channel failed, %d\n", err);
+                brcmf_err("Set Channel failed: chspec=%d, %d\n", chanspec, err);
                 goto exit;
         }
 
@@ -3975,7 +4015,7 @@ brcmf_cfg80211_change_beacon(struct wiphy *wiphy, struct net_device *ndev,
 
 static int
 brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
-                           u8 *mac)
+                           const u8 *mac)
 {
         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
         struct brcmf_scb_val_le scbval;
@@ -4203,7 +4243,7 @@ static int brcmf_convert_nl80211_tdls_oper(enum nl80211_tdls_operation oper)
 }
 
 static int brcmf_cfg80211_tdls_oper(struct wiphy *wiphy,
-                                    struct net_device *ndev, u8 *peer,
+                                    struct net_device *ndev, const u8 *peer,
                                     enum nl80211_tdls_operation oper)
 {
         struct brcmf_if *ifp;
@@ -4364,6 +4404,8 @@ static struct wiphy *brcmf_setup_wiphy(struct device *phydev)
                         WIPHY_FLAG_OFFCHAN_TX |
                         WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
                         WIPHY_FLAG_SUPPORTS_TDLS;
+        if (!brcmf_roamoff)
+                wiphy->flags |= WIPHY_FLAG_SUPPORTS_FW_ROAM;
         wiphy->mgmt_stypes = brcmf_txrx_stypes;
         wiphy->max_remain_on_channel_duration = 5000;
         brcmf_wiphy_pno_params(wiphy);
@@ -4685,7 +4727,6 @@ brcmf_notify_connect_status(struct brcmf_if *ifp,
         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
         struct ieee80211_channel *chan;
         s32 err = 0;
-        u16 reason;
 
         if (brcmf_is_apmode(ifp->vif)) {
                 err = brcmf_notify_connect_status_ap(cfg, ndev, e, data);
@@ -4706,16 +4747,6 @@ brcmf_notify_connect_status(struct brcmf_if *ifp,
                 brcmf_dbg(CONN, "Linkdown\n");
                 if (!brcmf_is_ibssmode(ifp->vif)) {
                         brcmf_bss_connect_done(cfg, ndev, e, false);
-                        if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTED,
-                                               &ifp->vif->sme_state)) {
-                                reason = 0;
-                                if (((e->event_code == BRCMF_E_DEAUTH_IND) ||
-                                     (e->event_code == BRCMF_E_DISASSOC_IND)) &&
-                                    (e->reason != WLAN_REASON_UNSPECIFIED))
-                                        reason = e->reason;
-                                cfg80211_disconnected(ndev, reason, NULL, 0,
-                                                      GFP_KERNEL);
-                        }
                 }
                 brcmf_link_down(ifp->vif);
                 brcmf_init_prof(ndev_to_prof(ndev));
@@ -5215,6 +5246,9 @@ static s32 brcmf_construct_reginfo(struct brcmf_cfg80211_info *cfg,
                 if (!(bw_cap[band] & WLC_BW_40MHZ_BIT) &&
                     ch.bw == BRCMU_CHAN_BW_40)
                         continue;
+                if (!(bw_cap[band] & WLC_BW_80MHZ_BIT) &&
+                    ch.bw == BRCMU_CHAN_BW_80)
+                        continue;
                 update = false;
                 for (j = 0; (j < *n_cnt && (*n_cnt < array_size)); j++) {
                         if (band_chan_arr[j].hw_value == ch.chnum) {
@@ -5231,10 +5265,13 @@ static s32 brcmf_construct_reginfo(struct brcmf_cfg80211_info *cfg,
                                 ieee80211_channel_to_frequency(ch.chnum, band);
                         band_chan_arr[index].hw_value = ch.chnum;
 
-                        if (ch.bw == BRCMU_CHAN_BW_40) {
-                                /* assuming the order is HT20, HT40 Upper,
-                                 * HT40 lower from chanspecs
-                                 */
+                        /* assuming the chanspecs order is HT20,
+                         * HT40 upper, HT40 lower, and VHT80.
+                         */
+                        if (ch.bw == BRCMU_CHAN_BW_80) {
+                                band_chan_arr[index].flags &=
+                                        ~IEEE80211_CHAN_NO_80MHZ;
+                        } else if (ch.bw == BRCMU_CHAN_BW_40) {
                                 ht40_flag = band_chan_arr[index].flags &
                                             IEEE80211_CHAN_NO_HT40;
                                 if (ch.sb == BRCMU_CHAN_SB_U) {
@@ -5255,8 +5292,13 @@ static s32 brcmf_construct_reginfo(struct brcmf_cfg80211_info *cfg,
                                                     IEEE80211_CHAN_NO_HT40MINUS;
                                 }
                         } else {
+                                /* disable other bandwidths for now as mentioned
+                                 * order assure they are enabled for subsequent
+                                 * chanspecs.
+                                 */
                                 band_chan_arr[index].flags =
-                                                        IEEE80211_CHAN_NO_HT40;
+                                                IEEE80211_CHAN_NO_HT40 |
+                                                IEEE80211_CHAN_NO_80MHZ;
                                 ch.bw = BRCMU_CHAN_BW_20;
                                 cfg->d11inf.encchspec(&ch);
                                 channel = ch.chspec;
@@ -5323,13 +5365,63 @@ static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
         }
 }
 
+static void brcmf_update_ht_cap(struct ieee80211_supported_band *band,
+                                u32 bw_cap[2], u32 nchain)
+{
+        band->ht_cap.ht_supported = true;
+        if (bw_cap[band->band] & WLC_BW_40MHZ_BIT) {
+                band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
+                band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+        }
+        band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
+        band->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
+        band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
+        band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
+        memset(band->ht_cap.mcs.rx_mask, 0xff, nchain);
+        band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
+}
+
+static __le16 brcmf_get_mcs_map(u32 nchain, enum ieee80211_vht_mcs_support supp)
+{
+        u16 mcs_map;
+        int i;
+
+        for (i = 0, mcs_map = 0xFFFF; i < nchain; i++)
+                mcs_map = (mcs_map << 2) | supp;
+
+        return cpu_to_le16(mcs_map);
+}
+
+static void brcmf_update_vht_cap(struct ieee80211_supported_band *band,
+                                 u32 bw_cap[2], u32 nchain)
+{
+        __le16 mcs_map;
+
+        /* not allowed in 2.4G band */
+        if (band->band == IEEE80211_BAND_2GHZ)
+                return;
+
+        band->vht_cap.vht_supported = true;
+        /* 80MHz is mandatory */
+        band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_80;
+        if (bw_cap[band->band] & WLC_BW_160MHZ_BIT) {
+                band->vht_cap.cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
+                band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_160;
+        }
+        /* all support 256-QAM */
+        mcs_map = brcmf_get_mcs_map(nchain, IEEE80211_VHT_MCS_SUPPORT_0_9);
+        band->vht_cap.vht_mcs.rx_mcs_map = mcs_map;
+        band->vht_cap.vht_mcs.tx_mcs_map = mcs_map;
+}
+
 static s32 brcmf_update_wiphybands(struct brcmf_cfg80211_info *cfg)
 {
         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
         struct wiphy *wiphy;
         s32 phy_list;
         u32 band_list[3];
-        u32 nmode;
+        u32 nmode = 0;
+        u32 vhtmode = 0;
         u32 bw_cap[2] = { 0, 0 };
         u32 rxchain;
         u32 nchain;
@@ -5360,14 +5452,16 @@ static s32 brcmf_update_wiphybands(struct brcmf_cfg80211_info *cfg)
         brcmf_dbg(INFO, "BRCMF_C_GET_BANDLIST reported: 0x%08x 0x%08x 0x%08x phy\n",
                   band_list[0], band_list[1], band_list[2]);
 
+        (void)brcmf_fil_iovar_int_get(ifp, "vhtmode", &vhtmode);
         err = brcmf_fil_iovar_int_get(ifp, "nmode", &nmode);
         if (err) {
                 brcmf_err("nmode error (%d)\n", err);
         } else {
                 brcmf_get_bwcap(ifp, bw_cap);
         }
-        brcmf_dbg(INFO, "nmode=%d, bw_cap=(%d, %d)\n", nmode,
-                  bw_cap[IEEE80211_BAND_2GHZ], bw_cap[IEEE80211_BAND_5GHZ]);
+        brcmf_dbg(INFO, "nmode=%d, vhtmode=%d, bw_cap=(%d, %d)\n",
+                  nmode, vhtmode, bw_cap[IEEE80211_BAND_2GHZ],
+                  bw_cap[IEEE80211_BAND_5GHZ]);
 
         err = brcmf_fil_iovar_int_get(ifp, "rxchain", &rxchain);
         if (err) {
@@ -5398,17 +5492,10 @@ static s32 brcmf_update_wiphybands(struct brcmf_cfg80211_info *cfg)
                 else
                         continue;
 
-                if (bw_cap[band->band] & WLC_BW_40MHZ_BIT) {
-                        band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
-                        band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
-                }
-                band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
-                band->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
-                band->ht_cap.ht_supported = true;
-                band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
-                band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
-                memset(band->ht_cap.mcs.rx_mask, 0xff, nchain);
-                band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
+                if (nmode)
+                        brcmf_update_ht_cap(band, bw_cap, nchain);
+                if (vhtmode)
+                        brcmf_update_vht_cap(band, bw_cap, nchain);
                 bands[band->band] = band;
         }
 
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index 8c5fa4e58139..43c71bfaa474 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -897,7 +897,8 @@ static bool brcms_tx_flush_completed(struct brcms_info *wl)
         return result;
 }
 
-static void brcms_ops_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+static void brcms_ops_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                            u32 queues, bool drop)
 {
         struct brcms_info *wl = hw->priv;
         int ret;
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index 9417cb5a2553..af8ba64ace39 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -4870,14 +4870,11 @@ static void brcms_c_detach_module(struct brcms_c_info *wlc)
 /*
  * low level detach
  */
-static int brcms_b_detach(struct brcms_c_info *wlc)
+static void brcms_b_detach(struct brcms_c_info *wlc)
 {
         uint i;
         struct brcms_hw_band *band;
         struct brcms_hardware *wlc_hw = wlc->hw;
-        int callbacks;
-
-        callbacks = 0;
 
         brcms_b_detach_dmapio(wlc_hw);
 
@@ -4900,9 +4897,6 @@ static int brcms_b_detach(struct brcms_c_info *wlc)
                 ai_detach(wlc_hw->sih);
                 wlc_hw->sih = NULL;
         }
-
-        return callbacks;
-
 }
 
 /*
@@ -4917,14 +4911,15 @@ static int brcms_b_detach(struct brcms_c_info *wlc)
  */
 uint brcms_c_detach(struct brcms_c_info *wlc)
 {
-        uint callbacks = 0;
+        uint callbacks;
 
         if (wlc == NULL)
                 return 0;
 
-        callbacks += brcms_b_detach(wlc);
+        brcms_b_detach(wlc);
 
         /* delete software timers */
+        callbacks = 0;
         if (!brcms_c_radio_monitor_stop(wlc))
                 callbacks++;
 
diff --git a/drivers/net/wireless/brcm80211/brcmutil/d11.c b/drivers/net/wireless/brcm80211/brcmutil/d11.c
index 30e54e2c6c9b..2b2522bdd8eb 100644
--- a/drivers/net/wireless/brcm80211/brcmutil/d11.c
+++ b/drivers/net/wireless/brcm80211/brcmutil/d11.c
@@ -21,19 +21,46 @@
 #include <brcmu_wifi.h>
 #include <brcmu_d11.h>
 
-static void brcmu_d11n_encchspec(struct brcmu_chan *ch)
+static u16 d11n_sb(enum brcmu_chan_sb sb)
 {
-        ch->chspec = ch->chnum & BRCMU_CHSPEC_CH_MASK;
+        switch (sb) {
+        case BRCMU_CHAN_SB_NONE:
+                return BRCMU_CHSPEC_D11N_SB_N;
+        case BRCMU_CHAN_SB_L:
+                return BRCMU_CHSPEC_D11N_SB_L;
+        case BRCMU_CHAN_SB_U:
+                return BRCMU_CHSPEC_D11N_SB_U;
+        default:
+                WARN_ON(1);
+        }
+        return 0;
+}
 
-        switch (ch->bw) {
+static u16 d11n_bw(enum brcmu_chan_bw bw)
+{
+        switch (bw) {
         case BRCMU_CHAN_BW_20:
-                ch->chspec |= BRCMU_CHSPEC_D11N_BW_20 | BRCMU_CHSPEC_D11N_SB_N;
-                break;
+                return BRCMU_CHSPEC_D11N_BW_20;
         case BRCMU_CHAN_BW_40:
+                return BRCMU_CHSPEC_D11N_BW_40;
         default:
-                WARN_ON_ONCE(1);
-                break;
+                WARN_ON(1);
         }
+        return 0;
+}
+
+static void brcmu_d11n_encchspec(struct brcmu_chan *ch)
+{
+        if (ch->bw == BRCMU_CHAN_BW_20)
+                ch->sb = BRCMU_CHAN_SB_NONE;
+
+        ch->chspec = 0;
+        brcmu_maskset16(&ch->chspec, BRCMU_CHSPEC_CH_MASK,
+                        BRCMU_CHSPEC_CH_SHIFT, ch->chnum);
+        brcmu_maskset16(&ch->chspec, BRCMU_CHSPEC_D11N_SB_MASK,
+                        0, d11n_sb(ch->sb));
+        brcmu_maskset16(&ch->chspec, BRCMU_CHSPEC_D11N_BW_MASK,
+                        0, d11n_bw(ch->bw));
 
         if (ch->chnum <= CH_MAX_2G_CHANNEL)
                 ch->chspec |= BRCMU_CHSPEC_D11N_BND_2G;
@@ -41,23 +68,34 @@ static void brcmu_d11n_encchspec(struct brcmu_chan *ch)
                 ch->chspec |= BRCMU_CHSPEC_D11N_BND_5G;
 }
 
-static void brcmu_d11ac_encchspec(struct brcmu_chan *ch)
+static u16 d11ac_bw(enum brcmu_chan_bw bw)
 {
-        ch->chspec = ch->chnum & BRCMU_CHSPEC_CH_MASK;
-
-        switch (ch->bw) {
+        switch (bw) {
         case BRCMU_CHAN_BW_20:
-                ch->chspec |= BRCMU_CHSPEC_D11AC_BW_20;
-                break;
+                return BRCMU_CHSPEC_D11AC_BW_20;
         case BRCMU_CHAN_BW_40:
+                return BRCMU_CHSPEC_D11AC_BW_40;
         case BRCMU_CHAN_BW_80:
-        case BRCMU_CHAN_BW_80P80:
-        case BRCMU_CHAN_BW_160:
+                return BRCMU_CHSPEC_D11AC_BW_80;
         default:
-                WARN_ON_ONCE(1);
-                break;
+                WARN_ON(1);
         }
+        return 0;
+}
 
+static void brcmu_d11ac_encchspec(struct brcmu_chan *ch)
+{
+        if (ch->bw == BRCMU_CHAN_BW_20 || ch->sb == BRCMU_CHAN_SB_NONE)
+                ch->sb = BRCMU_CHAN_SB_L;
+
+        brcmu_maskset16(&ch->chspec, BRCMU_CHSPEC_CH_MASK,
+                        BRCMU_CHSPEC_CH_SHIFT, ch->chnum);
+        brcmu_maskset16(&ch->chspec, BRCMU_CHSPEC_D11AC_SB_MASK,
+                        BRCMU_CHSPEC_D11AC_SB_SHIFT, ch->sb);
+        brcmu_maskset16(&ch->chspec, BRCMU_CHSPEC_D11AC_BW_MASK,
+                        0, d11ac_bw(ch->bw));
+
+        ch->chspec &= ~BRCMU_CHSPEC_D11AC_BND_MASK;
         if (ch->chnum <= CH_MAX_2G_CHANNEL)
                 ch->chspec |= BRCMU_CHSPEC_D11AC_BND_2G;
         else
@@ -73,6 +111,7 @@ static void brcmu_d11n_decchspec(struct brcmu_chan *ch)
         switch (ch->chspec & BRCMU_CHSPEC_D11N_BW_MASK) {
         case BRCMU_CHSPEC_D11N_BW_20:
                 ch->bw = BRCMU_CHAN_BW_20;
+                ch->sb = BRCMU_CHAN_SB_NONE;
                 break;
         case BRCMU_CHSPEC_D11N_BW_40:
                 ch->bw = BRCMU_CHAN_BW_40;
@@ -112,6 +151,7 @@ static void brcmu_d11ac_decchspec(struct brcmu_chan *ch)
         switch (ch->chspec & BRCMU_CHSPEC_D11AC_BW_MASK) {
         case BRCMU_CHSPEC_D11AC_BW_20:
                 ch->bw = BRCMU_CHAN_BW_20;
+                ch->sb = BRCMU_CHAN_SB_NONE;
                 break;
         case BRCMU_CHSPEC_D11AC_BW_40:
                 ch->bw = BRCMU_CHAN_BW_40;
@@ -128,6 +168,25 @@ static void brcmu_d11ac_decchspec(struct brcmu_chan *ch)
                 break;
         case BRCMU_CHSPEC_D11AC_BW_80:
                 ch->bw = BRCMU_CHAN_BW_80;
+                ch->sb = brcmu_maskget16(ch->chspec, BRCMU_CHSPEC_D11AC_SB_MASK,
+                                         BRCMU_CHSPEC_D11AC_SB_SHIFT);
+                switch (ch->sb) {
+                case BRCMU_CHAN_SB_LL:
+                        ch->chnum -= CH_30MHZ_APART;
+                        break;
+                case BRCMU_CHAN_SB_LU:
+                        ch->chnum -= CH_10MHZ_APART;
+                        break;
+                case BRCMU_CHAN_SB_UL:
+                        ch->chnum += CH_10MHZ_APART;
+                        break;
+                case BRCMU_CHAN_SB_UU:
+                        ch->chnum += CH_30MHZ_APART;
+                        break;
+                default:
+                        WARN_ON_ONCE(1);
+                        break;
+                }
                 break;
         case BRCMU_CHSPEC_D11AC_BW_8080:
         case BRCMU_CHSPEC_D11AC_BW_160:
diff --git a/drivers/net/wireless/brcm80211/include/brcmu_d11.h b/drivers/net/wireless/brcm80211/include/brcmu_d11.h
index 8660a2cba098..f9745ea8b3e0 100644
--- a/drivers/net/wireless/brcm80211/include/brcmu_d11.h
+++ b/drivers/net/wireless/brcm80211/include/brcmu_d11.h
@@ -108,13 +108,7 @@ enum brcmu_chan_bw {
 };
 
 enum brcmu_chan_sb {
-        BRCMU_CHAN_SB_NONE = 0,
-        BRCMU_CHAN_SB_L,
-        BRCMU_CHAN_SB_U,
-        BRCMU_CHAN_SB_LL,
-        BRCMU_CHAN_SB_LU,
-        BRCMU_CHAN_SB_UL,
-        BRCMU_CHAN_SB_UU,
+        BRCMU_CHAN_SB_NONE = -1,
         BRCMU_CHAN_SB_LLL,
         BRCMU_CHAN_SB_LLU,
         BRCMU_CHAN_SB_LUL,
@@ -123,6 +117,12 @@ enum brcmu_chan_sb {
         BRCMU_CHAN_SB_ULU,
         BRCMU_CHAN_SB_UUL,
         BRCMU_CHAN_SB_UUU,
+        BRCMU_CHAN_SB_L = BRCMU_CHAN_SB_LLL,
+        BRCMU_CHAN_SB_U = BRCMU_CHAN_SB_LLU,
+        BRCMU_CHAN_SB_LL = BRCMU_CHAN_SB_LLL,
+        BRCMU_CHAN_SB_LU = BRCMU_CHAN_SB_LLU,
+        BRCMU_CHAN_SB_UL = BRCMU_CHAN_SB_LUL,
+        BRCMU_CHAN_SB_UU = BRCMU_CHAN_SB_LUU,
 };
 
 struct brcmu_chan {
diff --git a/drivers/net/wireless/brcm80211/include/brcmu_wifi.h b/drivers/net/wireless/brcm80211/include/brcmu_wifi.h
index 74419d4bd123..76b5d3a86294 100644
--- a/drivers/net/wireless/brcm80211/include/brcmu_wifi.h
+++ b/drivers/net/wireless/brcm80211/include/brcmu_wifi.h
@@ -29,6 +29,7 @@
 #define CH_UPPER_SB                     0x01
 #define CH_LOWER_SB                     0x02
 #define CH_EWA_VALID                    0x04
+#define CH_30MHZ_APART                  6
 #define CH_20MHZ_APART                  4
 #define CH_10MHZ_APART                  2
 #define CH_5MHZ_APART                   1 /* 2G band channels are 5 Mhz apart */
diff --git a/drivers/net/wireless/cw1200/sta.c b/drivers/net/wireless/cw1200/sta.c
index 103f7bce8932..cd0cad7f7759 100644
--- a/drivers/net/wireless/cw1200/sta.c
+++ b/drivers/net/wireless/cw1200/sta.c
@@ -936,7 +936,8 @@ static int __cw1200_flush(struct cw1200_common *priv, bool drop)
         return ret;
 }
 
-void cw1200_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+void cw1200_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                  u32 queues, bool drop)
 {
         struct cw1200_common *priv = hw->priv;
 
diff --git a/drivers/net/wireless/cw1200/sta.h b/drivers/net/wireless/cw1200/sta.h
index 35babb62cc6a..b7e386b7662b 100644
--- a/drivers/net/wireless/cw1200/sta.h
+++ b/drivers/net/wireless/cw1200/sta.h
@@ -40,7 +40,8 @@ int cw1200_set_key(struct ieee80211_hw *dev, enum set_key_cmd cmd,
 
 int cw1200_set_rts_threshold(struct ieee80211_hw *hw, u32 value);
 
-void cw1200_flush(struct ieee80211_hw *hw, u32 queues, bool drop);
+void cw1200_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                  u32 queues, bool drop);
 
 u64 cw1200_prepare_multicast(struct ieee80211_hw *hw,
                              struct netdev_hw_addr_list *mc_list);
diff --git a/drivers/net/wireless/hostap/hostap_main.c b/drivers/net/wireless/hostap/hostap_main.c
index 67db34e56d7e..52919ad42726 100644
--- a/drivers/net/wireless/hostap/hostap_main.c
+++ b/drivers/net/wireless/hostap/hostap_main.c
@@ -882,7 +882,7 @@ void hostap_setup_dev(struct net_device *dev, local_info_t *local,
         dev->mtu = local->mtu;
 
 
-        SET_ETHTOOL_OPS(dev, &prism2_ethtool_ops);
+        dev->ethtool_ops = &prism2_ethtool_ops;
 
 }
 
diff --git a/drivers/net/wireless/iwlegacy/3945.c b/drivers/net/wireless/iwlegacy/3945.c
index d37a6fd90d40..b598e2803500 100644
--- a/drivers/net/wireless/iwlegacy/3945.c
+++ b/drivers/net/wireless/iwlegacy/3945.c
@@ -573,7 +573,7 @@ il3945_hdl_rx(struct il_priv *il, struct il_rx_buf *rxb)
                 rx_status.flag |= RX_FLAG_SHORTPRE;
 
         if ((unlikely(rx_stats->phy_count > 20))) {
-                D_DROP("dsp size out of range [0,20]: %d/n",
+                D_DROP("dsp size out of range [0,20]: %d\n",
                        rx_stats->phy_count);
                 return;
         }
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
index 888ad5c74639..c159c05db6ef 100644
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
@@ -670,7 +670,7 @@ il4965_hdl_rx(struct il_priv *il, struct il_rx_buf *rxb)
         }
 
         if ((unlikely(phy_res->cfg_phy_cnt > 20))) {
-                D_DROP("dsp size out of range [0,20]: %d/n",
+                D_DROP("dsp size out of range [0,20]: %d\n",
                        phy_res->cfg_phy_cnt);
                 return;
         }
diff --git a/drivers/net/wireless/iwlegacy/common.c b/drivers/net/wireless/iwlegacy/common.c
index 4f42174d9994..ecc674627e6e 100644
--- a/drivers/net/wireless/iwlegacy/common.c
+++ b/drivers/net/wireless/iwlegacy/common.c
@@ -4755,7 +4755,8 @@ out:
 }
 EXPORT_SYMBOL(il_mac_change_interface);
 
-void il_mac_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+void il_mac_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                  u32 queues, bool drop)
 {
         struct il_priv *il = hw->priv;
         unsigned long timeout = jiffies + msecs_to_jiffies(500);
diff --git a/drivers/net/wireless/iwlegacy/common.h b/drivers/net/wireless/iwlegacy/common.h
index dfb13c70efe8..ea5c0f863c4e 100644
--- a/drivers/net/wireless/iwlegacy/common.h
+++ b/drivers/net/wireless/iwlegacy/common.h
@@ -1723,7 +1723,8 @@ void il_mac_remove_interface(struct ieee80211_hw *hw,
                              struct ieee80211_vif *vif);
 int il_mac_change_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                             enum nl80211_iftype newtype, bool newp2p);
-void il_mac_flush(struct ieee80211_hw *hw, u32 queues, bool drop);
+void il_mac_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                  u32 queues, bool drop);
 int il_alloc_txq_mem(struct il_priv *il);
 void il_free_txq_mem(struct il_priv *il);
 
diff --git a/drivers/net/wireless/iwlwifi/Kconfig b/drivers/net/wireless/iwlwifi/Kconfig
index 74b3b4de7bb7..7fd50428b934 100644
--- a/drivers/net/wireless/iwlwifi/Kconfig
+++ b/drivers/net/wireless/iwlwifi/Kconfig
@@ -2,10 +2,6 @@ config IWLWIFI
         tristate "Intel Wireless WiFi Next Gen AGN - Wireless-N/Advanced-N/Ultimate-N (iwlwifi) "
         depends on PCI && MAC80211 && HAS_IOMEM
         select FW_LOADER
-        select NEW_LEDS
-        select LEDS_CLASS
-        select LEDS_TRIGGERS
-        select MAC80211_LEDS
         ---help---
           Select to build the driver supporting the:
 
@@ -43,6 +39,14 @@ config IWLWIFI
           say M here and read <file:Documentation/kbuild/modules.txt>.  The
           module will be called iwlwifi.
 
+config IWLWIFI_LEDS
+        bool
+        depends on IWLWIFI
+        depends on LEDS_CLASS=y || LEDS_CLASS=IWLWIFI
+        select LEDS_TRIGGERS
+        select MAC80211_LEDS
+        default y
+
 config IWLDVM
         tristate "Intel Wireless WiFi DVM Firmware support"
         depends on IWLWIFI
@@ -124,7 +128,6 @@ config IWLWIFI_DEBUG_EXPERIMENTAL_UCODE
           Enable use of experimental ucode for testing and debugging.
 
 config IWLWIFI_DEVICE_TRACING
-
         bool "iwlwifi device access tracing"
         depends on IWLWIFI
         depends on EVENT_TRACING
diff --git a/drivers/net/wireless/iwlwifi/dvm/Makefile b/drivers/net/wireless/iwlwifi/dvm/Makefile
index dce7ab2e0c4b..4d19685f31c3 100644
--- a/drivers/net/wireless/iwlwifi/dvm/Makefile
+++ b/drivers/net/wireless/iwlwifi/dvm/Makefile
@@ -4,9 +4,10 @@ iwldvm-objs		+= main.o rs.o mac80211.o ucode.o tx.o
 iwldvm-objs             += lib.o calib.o tt.o sta.o rx.o
 
 iwldvm-objs             += power.o
-iwldvm-objs             += scan.o led.o
+iwldvm-objs             += scan.o
 iwldvm-objs             += rxon.o devices.o
 
+iwldvm-$(CONFIG_IWLWIFI_LEDS) += led.o
 iwldvm-$(CONFIG_IWLWIFI_DEBUGFS) += debugfs.o
 
 ccflags-y += -D__CHECK_ENDIAN__ -I$(src)/../
diff --git a/drivers/net/wireless/iwlwifi/dvm/calib.c b/drivers/net/wireless/iwlwifi/dvm/calib.c
index be1086c87157..20e6aa910700 100644
--- a/drivers/net/wireless/iwlwifi/dvm/calib.c
+++ b/drivers/net/wireless/iwlwifi/dvm/calib.c
@@ -94,7 +94,6 @@ int iwl_send_calib_results(struct iwl_priv *priv)
 {
         struct iwl_host_cmd hcmd = {
                 .id = REPLY_PHY_CALIBRATION_CMD,
-                .flags = CMD_SYNC,
         };
         struct iwl_calib_result *res;
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/debugfs.c b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
index d2fe2596d54e..0ffb6ff1a255 100644
--- a/drivers/net/wireless/iwlwifi/dvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
@@ -1481,7 +1481,7 @@ static ssize_t iwl_dbgfs_ucode_bt_stats_read(struct file *file,
 
         /* make request to uCode to retrieve statistics information */
         mutex_lock(&priv->mutex);
-        ret = iwl_send_statistics_request(priv, CMD_SYNC, false);
+        ret = iwl_send_statistics_request(priv, 0, false);
         mutex_unlock(&priv->mutex);
 
         if (ret)
@@ -1868,7 +1868,7 @@ static ssize_t iwl_dbgfs_clear_ucode_statistics_write(struct file *file,
 
         /* make request to uCode to retrieve statistics information */
         mutex_lock(&priv->mutex);
-        iwl_send_statistics_request(priv, CMD_SYNC, true);
+        iwl_send_statistics_request(priv, 0, true);
         mutex_unlock(&priv->mutex);
 
         return count;
@@ -2188,7 +2188,6 @@ static int iwl_cmd_echo_test(struct iwl_priv *priv)
         struct iwl_host_cmd cmd = {
                 .id = REPLY_ECHO,
                 .len = { 0 },
-                .flags = CMD_SYNC,
         };
 
         ret = iwl_dvm_send_cmd(priv, &cmd);
@@ -2320,7 +2319,7 @@ static ssize_t iwl_dbgfs_fw_restart_write(struct file *file,
         mutex_lock(&priv->mutex);
 
         /* take the return value to make compiler happy - it will fail anyway */
-        ret = iwl_dvm_send_cmd_pdu(priv, REPLY_ERROR, CMD_SYNC, 0, NULL);
+        ret = iwl_dvm_send_cmd_pdu(priv, REPLY_ERROR, 0, 0, NULL);
 
         mutex_unlock(&priv->mutex);
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/dev.h b/drivers/net/wireless/iwlwifi/dvm/dev.h
index 3441f70d0ff9..a6f22c32a279 100644
--- a/drivers/net/wireless/iwlwifi/dvm/dev.h
+++ b/drivers/net/wireless/iwlwifi/dvm/dev.h
@@ -888,9 +888,11 @@ struct iwl_priv {
 
         struct iwl_event_log event_log;
 
+#ifdef CONFIG_IWLWIFI_LEDS
         struct led_classdev led;
         unsigned long blink_on, blink_off;
         bool led_registered;
+#endif
 
         /* WoWLAN GTK rekey data */
         u8 kck[NL80211_KCK_LEN], kek[NL80211_KEK_LEN];
diff --git a/drivers/net/wireless/iwlwifi/dvm/devices.c b/drivers/net/wireless/iwlwifi/dvm/devices.c
index 758c54eeb206..34b41e5f7cfc 100644
--- a/drivers/net/wireless/iwlwifi/dvm/devices.c
+++ b/drivers/net/wireless/iwlwifi/dvm/devices.c
@@ -417,7 +417,6 @@ static int iwl5000_hw_channel_switch(struct iwl_priv *priv,
         struct iwl_host_cmd hcmd = {
                 .id = REPLY_CHANNEL_SWITCH,
                 .len = { sizeof(cmd), },
-                .flags = CMD_SYNC,
                 .data = { &cmd, },
         };
 
@@ -579,7 +578,6 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv,
         struct iwl_host_cmd hcmd = {
                 .id = REPLY_CHANNEL_SWITCH,
                 .len = { sizeof(*cmd), },
-                .flags = CMD_SYNC,
                 .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
         };
         int err;
diff --git a/drivers/net/wireless/iwlwifi/dvm/led.h b/drivers/net/wireless/iwlwifi/dvm/led.h
index 6a0817d9c4fa..1c6b2252d0f2 100644
--- a/drivers/net/wireless/iwlwifi/dvm/led.h
+++ b/drivers/net/wireless/iwlwifi/dvm/led.h
@@ -36,8 +36,20 @@ struct iwl_priv;
 #define IWL_LED_ACTIVITY       (0<<1)
 #define IWL_LED_LINK           (1<<1)
 
+#ifdef CONFIG_IWLWIFI_LEDS
 void iwlagn_led_enable(struct iwl_priv *priv);
 void iwl_leds_init(struct iwl_priv *priv);
 void iwl_leds_exit(struct iwl_priv *priv);
+#else
+static inline void iwlagn_led_enable(struct iwl_priv *priv)
+{
+}
+static inline void iwl_leds_init(struct iwl_priv *priv)
+{
+}
+static inline void iwl_leds_exit(struct iwl_priv *priv)
+{
+}
+#endif
 
 #endif /* __iwl_leds_h__ */
diff --git a/drivers/net/wireless/iwlwifi/dvm/lib.c b/drivers/net/wireless/iwlwifi/dvm/lib.c
index 576f7ee38ca5..2191621d69c1 100644
--- a/drivers/net/wireless/iwlwifi/dvm/lib.c
+++ b/drivers/net/wireless/iwlwifi/dvm/lib.c
@@ -81,7 +81,7 @@ int iwlagn_send_tx_power(struct iwl_priv *priv)
         else
                 tx_ant_cfg_cmd = REPLY_TX_POWER_DBM_CMD;
 
-        return iwl_dvm_send_cmd_pdu(priv, tx_ant_cfg_cmd, CMD_SYNC,
+        return iwl_dvm_send_cmd_pdu(priv, tx_ant_cfg_cmd, 0,
                         sizeof(tx_power_cmd), &tx_power_cmd);
 }
 
@@ -141,7 +141,6 @@ int iwlagn_txfifo_flush(struct iwl_priv *priv, u32 scd_q_msk)
         struct iwl_host_cmd cmd = {
                 .id = REPLY_TXFIFO_FLUSH,
                 .len = { sizeof(struct iwl_txfifo_flush_cmd), },
-                .flags = CMD_SYNC,
                 .data = { &flush_cmd, },
         };
 
@@ -180,7 +179,7 @@ void iwlagn_dev_txfifo_flush(struct iwl_priv *priv)
                 goto done;
         }
         IWL_DEBUG_INFO(priv, "wait transmit/flush all frames\n");
-        iwl_trans_wait_tx_queue_empty(priv->trans);
+        iwl_trans_wait_tx_queue_empty(priv->trans, 0xffffffff);
 done:
         ieee80211_wake_queues(priv->hw);
         mutex_unlock(&priv->mutex);
@@ -333,12 +332,12 @@ void iwlagn_send_advance_bt_config(struct iwl_priv *priv)
                 memcpy(&bt_cmd_v2.basic, &basic,
                         sizeof(basic));
                 ret = iwl_dvm_send_cmd_pdu(priv, REPLY_BT_CONFIG,
-                        CMD_SYNC, sizeof(bt_cmd_v2), &bt_cmd_v2);
+                        0, sizeof(bt_cmd_v2), &bt_cmd_v2);
         } else {
                 memcpy(&bt_cmd_v1.basic, &basic,
                         sizeof(basic));
                 ret = iwl_dvm_send_cmd_pdu(priv, REPLY_BT_CONFIG,
-                        CMD_SYNC, sizeof(bt_cmd_v1), &bt_cmd_v1);
+                        0, sizeof(bt_cmd_v1), &bt_cmd_v1);
         }
         if (ret)
                 IWL_ERR(priv, "failed to send BT Coex Config\n");
@@ -1044,7 +1043,6 @@ int iwlagn_send_patterns(struct iwl_priv *priv,
         struct iwl_host_cmd cmd = {
                 .id = REPLY_WOWLAN_PATTERNS,
                 .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
-                .flags = CMD_SYNC,
         };
         int i, err;
 
@@ -1201,7 +1199,6 @@ int iwlagn_suspend(struct iwl_priv *priv, struct cfg80211_wowlan *wowlan)
                 if (key_data.use_rsc_tsc) {
                         struct iwl_host_cmd rsc_tsc_cmd = {
                                 .id = REPLY_WOWLAN_TSC_RSC_PARAMS,
-                                .flags = CMD_SYNC,
                                 .data[0] = key_data.rsc_tsc,
                                 .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
                                 .len[0] = sizeof(*key_data.rsc_tsc),
@@ -1215,7 +1212,7 @@ int iwlagn_suspend(struct iwl_priv *priv, struct cfg80211_wowlan *wowlan)
                 if (key_data.use_tkip) {
                         ret = iwl_dvm_send_cmd_pdu(priv,
                                                  REPLY_WOWLAN_TKIP_PARAMS,
-                                                 CMD_SYNC, sizeof(tkip_cmd),
+                                                 0, sizeof(tkip_cmd),
                                                  &tkip_cmd);
                         if (ret)
                                 goto out;
@@ -1231,20 +1228,20 @@ int iwlagn_suspend(struct iwl_priv *priv, struct cfg80211_wowlan *wowlan)
 
                         ret = iwl_dvm_send_cmd_pdu(priv,
                                                  REPLY_WOWLAN_KEK_KCK_MATERIAL,
-                                                 CMD_SYNC, sizeof(kek_kck_cmd),
+                                                 0, sizeof(kek_kck_cmd),
                                                  &kek_kck_cmd);
                         if (ret)
                                 goto out;
                 }
         }
 
-        ret = iwl_dvm_send_cmd_pdu(priv, REPLY_D3_CONFIG, CMD_SYNC,
+        ret = iwl_dvm_send_cmd_pdu(priv, REPLY_D3_CONFIG, 0,
                                      sizeof(d3_cfg_cmd), &d3_cfg_cmd);
         if (ret)
                 goto out;
 
         ret = iwl_dvm_send_cmd_pdu(priv, REPLY_WOWLAN_WAKEUP_FILTER,
-                                 CMD_SYNC, sizeof(wakeup_filter_cmd),
+                                 0, sizeof(wakeup_filter_cmd),
                                  &wakeup_filter_cmd);
         if (ret)
                 goto out;
diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index dd55c9cf7ba8..29af7b51e370 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -1091,7 +1091,8 @@ static void iwlagn_configure_filter(struct ieee80211_hw *hw,
                         FIF_BCN_PRBRESP_PROMISC | FIF_CONTROL;
 }
 
-static void iwlagn_mac_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+static void iwlagn_mac_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                             u32 queues, bool drop)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
 
@@ -1119,7 +1120,7 @@ static void iwlagn_mac_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
                 }
         }
         IWL_DEBUG_MAC80211(priv, "wait transmit/flush all frames\n");
-        iwl_trans_wait_tx_queue_empty(priv->trans);
+        iwl_trans_wait_tx_queue_empty(priv->trans, 0xffffffff);
 done:
         mutex_unlock(&priv->mutex);
         IWL_DEBUG_MAC80211(priv, "leave\n");
diff --git a/drivers/net/wireless/iwlwifi/dvm/main.c b/drivers/net/wireless/iwlwifi/dvm/main.c
index 6a6df71af1d7..0b7f46f0b079 100644
--- a/drivers/net/wireless/iwlwifi/dvm/main.c
+++ b/drivers/net/wireless/iwlwifi/dvm/main.c
@@ -128,7 +128,6 @@ int iwlagn_send_beacon_cmd(struct iwl_priv *priv)
         struct iwl_tx_beacon_cmd *tx_beacon_cmd;
         struct iwl_host_cmd cmd = {
                 .id = REPLY_TX_BEACON,
-                .flags = CMD_SYNC,
         };
         struct ieee80211_tx_info *info;
         u32 frame_size;
@@ -311,8 +310,7 @@ int iwl_send_statistics_request(struct iwl_priv *priv, u8 flags, bool clear)
                                         sizeof(struct iwl_statistics_cmd),
                                         &statistics_cmd);
         else
-                return iwl_dvm_send_cmd_pdu(priv, REPLY_STATISTICS_CMD,
-                                        CMD_SYNC,
+                return iwl_dvm_send_cmd_pdu(priv, REPLY_STATISTICS_CMD, 0,
                                         sizeof(struct iwl_statistics_cmd),
                                         &statistics_cmd);
 }
@@ -622,7 +620,7 @@ static void iwl_rf_kill_ct_config(struct iwl_priv *priv)
 
                 ret = iwl_dvm_send_cmd_pdu(priv,
                                        REPLY_CT_KILL_CONFIG_CMD,
-                                       CMD_SYNC, sizeof(adv_cmd), &adv_cmd);
+                                       0, sizeof(adv_cmd), &adv_cmd);
                 if (ret)
                         IWL_ERR(priv, "REPLY_CT_KILL_CONFIG_CMD failed\n");
                 else
@@ -637,7 +635,7 @@ static void iwl_rf_kill_ct_config(struct iwl_priv *priv)
 
                 ret = iwl_dvm_send_cmd_pdu(priv,
                                        REPLY_CT_KILL_CONFIG_CMD,
-                                       CMD_SYNC, sizeof(cmd), &cmd);
+                                       0, sizeof(cmd), &cmd);
                 if (ret)
                         IWL_ERR(priv, "REPLY_CT_KILL_CONFIG_CMD failed\n");
                 else
@@ -673,9 +671,7 @@ static int iwlagn_send_tx_ant_config(struct iwl_priv *priv, u8 valid_tx_ant)
 
         if (IWL_UCODE_API(priv->fw->ucode_ver) > 1) {
                 IWL_DEBUG_HC(priv, "select valid tx ant: %u\n", valid_tx_ant);
-                return iwl_dvm_send_cmd_pdu(priv,
-                                        TX_ANT_CONFIGURATION_CMD,
-                                        CMD_SYNC,
+                return iwl_dvm_send_cmd_pdu(priv, TX_ANT_CONFIGURATION_CMD, 0,
                                         sizeof(struct iwl_tx_ant_config_cmd),
                                         &tx_ant_cmd);
         } else {
@@ -703,7 +699,7 @@ static void iwl_send_bt_config(struct iwl_priv *priv)
                 (bt_cmd.flags == BT_COEX_DISABLE) ? "disable" : "active");
 
         if (iwl_dvm_send_cmd_pdu(priv, REPLY_BT_CONFIG,
-                             CMD_SYNC, sizeof(struct iwl_bt_cmd), &bt_cmd))
+                             0, sizeof(struct iwl_bt_cmd), &bt_cmd))
                 IWL_ERR(priv, "failed to send BT Coex Config\n");
 }
 
@@ -987,7 +983,7 @@ static void iwl_bg_restart(struct work_struct *data)
                         ieee80211_restart_hw(priv->hw);
                 else
                         IWL_ERR(priv,
-                                "Cannot request restart before registrating with mac80211");
+                                "Cannot request restart before registrating with mac80211\n");
         } else {
                 WARN_ON(1);
         }
@@ -1127,7 +1123,6 @@ static void iwl_option_config(struct iwl_priv *priv)
 static int iwl_eeprom_init_hw_params(struct iwl_priv *priv)
 {
         struct iwl_nvm_data *data = priv->nvm_data;
-        char *debug_msg;
 
         if (data->sku_cap_11n_enable &&
             !priv->cfg->ht_params) {
@@ -1141,8 +1136,8 @@ static int iwl_eeprom_init_hw_params(struct iwl_priv *priv)
                 return -EINVAL;
         }
 
-        debug_msg = "Device SKU: 24GHz %s %s, 52GHz %s %s, 11.n %s %s\n";
-        IWL_DEBUG_INFO(priv, debug_msg,
+        IWL_DEBUG_INFO(priv,
+                       "Device SKU: 24GHz %s %s, 52GHz %s %s, 11.n %s %s\n",
                        data->sku_cap_band_24GHz_enable ? "" : "NOT", "enabled",
                        data->sku_cap_band_52GHz_enable ? "" : "NOT", "enabled",
                        data->sku_cap_11n_enable ? "" : "NOT", "enabled");
@@ -1350,7 +1345,7 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
         iwl_set_hw_params(priv);
 
         if (!(priv->nvm_data->sku_cap_ipan_enable)) {
-                IWL_DEBUG_INFO(priv, "Your EEPROM disabled PAN");
+                IWL_DEBUG_INFO(priv, "Your EEPROM disabled PAN\n");
                 ucode_flags &= ~IWL_UCODE_TLV_FLAGS_PAN;
                 /*
                  * if not PAN, then don't support P2P -- might be a uCode
@@ -2019,10 +2014,10 @@ void iwlagn_lift_passive_no_rx(struct iwl_priv *priv)
 
         for (mq = 0; mq < IWLAGN_FIRST_AMPDU_QUEUE; mq++) {
                 if (!test_bit(mq, &priv->transport_queue_stop)) {
-                        IWL_DEBUG_TX_QUEUES(priv, "Wake queue %d", mq);
+                        IWL_DEBUG_TX_QUEUES(priv, "Wake queue %d\n", mq);
                         ieee80211_wake_queue(priv->hw, mq);
                 } else {
-                        IWL_DEBUG_TX_QUEUES(priv, "Don't wake queue %d", mq);
+                        IWL_DEBUG_TX_QUEUES(priv, "Don't wake queue %d\n", mq);
                 }
         }
 
@@ -2053,6 +2048,17 @@ static bool iwl_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
         return false;
 }
 
+static void iwl_napi_add(struct iwl_op_mode *op_mode,
+                         struct napi_struct *napi,
+                         struct net_device *napi_dev,
+                         int (*poll)(struct napi_struct *, int),
+                         int weight)
+{
+        struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);
+
+        ieee80211_napi_add(priv->hw, napi, napi_dev, poll, weight);
+}
+
 static const struct iwl_op_mode_ops iwl_dvm_ops = {
         .start = iwl_op_mode_dvm_start,
         .stop = iwl_op_mode_dvm_stop,
@@ -2065,6 +2071,7 @@ static const struct iwl_op_mode_ops iwl_dvm_ops = {
         .cmd_queue_full = iwl_cmd_queue_full,
         .nic_config = iwl_nic_config,
         .wimax_active = iwl_wimax_active,
+        .napi_add = iwl_napi_add,
 };
 
 /*****************************************************************************
diff --git a/drivers/net/wireless/iwlwifi/dvm/power.c b/drivers/net/wireless/iwlwifi/dvm/power.c
index b4e61417013a..f2c1439566b5 100644
--- a/drivers/net/wireless/iwlwifi/dvm/power.c
+++ b/drivers/net/wireless/iwlwifi/dvm/power.c
@@ -278,7 +278,7 @@ static int iwl_set_power(struct iwl_priv *priv, struct iwl_powertable_cmd *cmd)
                         le32_to_cpu(cmd->sleep_interval[3]),
                         le32_to_cpu(cmd->sleep_interval[4]));
 
-        return iwl_dvm_send_cmd_pdu(priv, POWER_TABLE_CMD, CMD_SYNC,
+        return iwl_dvm_send_cmd_pdu(priv, POWER_TABLE_CMD, 0,
                                 sizeof(struct iwl_powertable_cmd), cmd);
 }
 
@@ -361,7 +361,7 @@ int iwl_power_set_mode(struct iwl_priv *priv, struct iwl_powertable_cmd *cmd,
 
                 memcpy(&priv->power_data.sleep_cmd, cmd, sizeof(*cmd));
         } else
-                IWL_ERR(priv, "set power fail, ret = %d", ret);
+                IWL_ERR(priv, "set power fail, ret = %d\n", ret);
 
         return ret;
 }
diff --git a/drivers/net/wireless/iwlwifi/dvm/rs.c b/drivers/net/wireless/iwlwifi/dvm/rs.c
index aa773a2da4ab..32b78a66536d 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rs.c
@@ -1453,7 +1453,7 @@ static int rs_move_legacy_other(struct iwl_priv *priv,
                         tbl->action = IWL_LEGACY_SWITCH_SISO;
                 break;
         default:
-                IWL_ERR(priv, "Invalid BT load %d", priv->bt_traffic_load);
+                IWL_ERR(priv, "Invalid BT load %d\n", priv->bt_traffic_load);
                 break;
         }
 
@@ -1628,7 +1628,7 @@ static int rs_move_siso_to_other(struct iwl_priv *priv,
                         tbl->action = IWL_SISO_SWITCH_ANTENNA1;
                 break;
         default:
-                IWL_ERR(priv, "Invalid BT load %d", priv->bt_traffic_load);
+                IWL_ERR(priv, "Invalid BT load %d\n", priv->bt_traffic_load);
                 break;
         }
 
@@ -1799,7 +1799,7 @@ static int rs_move_mimo2_to_other(struct iwl_priv *priv,
                         tbl->action = IWL_MIMO2_SWITCH_SISO_A;
                 break;
         default:
-                IWL_ERR(priv, "Invalid BT load %d", priv->bt_traffic_load);
+                IWL_ERR(priv, "Invalid BT load %d\n", priv->bt_traffic_load);
                 break;
         }
 
@@ -1969,7 +1969,7 @@ static int rs_move_mimo3_to_other(struct iwl_priv *priv,
                         tbl->action = IWL_MIMO3_SWITCH_SISO_A;
                 break;
         default:
-                IWL_ERR(priv, "Invalid BT load %d", priv->bt_traffic_load);
+                IWL_ERR(priv, "Invalid BT load %d\n", priv->bt_traffic_load);
                 break;
         }
 
@@ -2709,7 +2709,7 @@ static void rs_initialize_lq(struct iwl_priv *priv,
         rs_set_expected_tpt_table(lq_sta, tbl);
         rs_fill_link_cmd(NULL, lq_sta, rate);
         priv->stations[lq_sta->lq.sta_id].lq = &lq_sta->lq;
-        iwl_send_lq_cmd(priv, ctx, &lq_sta->lq, CMD_SYNC, true);
+        iwl_send_lq_cmd(priv, ctx, &lq_sta->lq, 0, true);
 }
 
 static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta, void *priv_sta,
diff --git a/drivers/net/wireless/iwlwifi/dvm/rx.c b/drivers/net/wireless/iwlwifi/dvm/rx.c
index cd8377346aff..debec963c610 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rx.c
@@ -786,7 +786,7 @@ static void iwlagn_pass_packet_to_mac80211(struct iwl_priv *priv,
 
         memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));
 
-        ieee80211_rx_ni(priv->hw, skb);
+        ieee80211_rx(priv->hw, skb);
 }
 
 static u32 iwlagn_translate_rx_status(struct iwl_priv *priv, u32 decrypt_in)
diff --git a/drivers/net/wireless/iwlwifi/dvm/rxon.c b/drivers/net/wireless/iwlwifi/dvm/rxon.c
index 503a81e58185..ed50de6362ed 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rxon.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rxon.c
@@ -104,7 +104,7 @@ static int iwlagn_disable_bss(struct iwl_priv *priv,
 
         send->filter_flags &= ~RXON_FILTER_ASSOC_MSK;
         ret = iwl_dvm_send_cmd_pdu(priv, ctx->rxon_cmd,
-                                CMD_SYNC, sizeof(*send), send);
+                                0, sizeof(*send), send);
 
         send->filter_flags = old_filter;
 
@@ -134,7 +134,7 @@ static int iwlagn_disable_pan(struct iwl_priv *priv,
         send->filter_flags &= ~RXON_FILTER_ASSOC_MSK;
         send->dev_type = RXON_DEV_TYPE_P2P;
         ret = iwl_dvm_send_cmd_pdu(priv, ctx->rxon_cmd,
-                                CMD_SYNC, sizeof(*send), send);
+                                0, sizeof(*send), send);
 
         send->filter_flags = old_filter;
         send->dev_type = old_dev_type;
@@ -160,7 +160,7 @@ static int iwlagn_disconn_pan(struct iwl_priv *priv,
         int ret;
 
         send->filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-        ret = iwl_dvm_send_cmd_pdu(priv, ctx->rxon_cmd, CMD_SYNC,
+        ret = iwl_dvm_send_cmd_pdu(priv, ctx->rxon_cmd, 0,
                                 sizeof(*send), send);
 
         send->filter_flags = old_filter;
@@ -189,7 +189,7 @@ static void iwlagn_update_qos(struct iwl_priv *priv,
                       ctx->qos_data.qos_active,
                       ctx->qos_data.def_qos_parm.qos_flags);
 
-        ret = iwl_dvm_send_cmd_pdu(priv, ctx->qos_cmd, CMD_SYNC,
+        ret = iwl_dvm_send_cmd_pdu(priv, ctx->qos_cmd, 0,
                                sizeof(struct iwl_qosparam_cmd),
                                &ctx->qos_data.def_qos_parm);
         if (ret)
@@ -353,7 +353,7 @@ static int iwl_send_rxon_timing(struct iwl_priv *priv,
                         le16_to_cpu(ctx->timing.atim_window));
 
         return iwl_dvm_send_cmd_pdu(priv, ctx->rxon_timing_cmd,
-                                CMD_SYNC, sizeof(ctx->timing), &ctx->timing);
+                                0, sizeof(ctx->timing), &ctx->timing);
 }
 
 static int iwlagn_rxon_disconn(struct iwl_priv *priv,
@@ -495,7 +495,7 @@ static int iwlagn_rxon_connect(struct iwl_priv *priv,
          * Associated RXON doesn't clear the station table in uCode,
          * so we don't need to restore stations etc. after this.
          */
-        ret = iwl_dvm_send_cmd_pdu(priv, ctx->rxon_cmd, CMD_SYNC,
+        ret = iwl_dvm_send_cmd_pdu(priv, ctx->rxon_cmd, 0,
                       sizeof(struct iwl_rxon_cmd), &ctx->staging);
         if (ret) {
                 IWL_ERR(priv, "Error setting new RXON (%d)\n", ret);
@@ -610,7 +610,7 @@ int iwlagn_set_pan_params(struct iwl_priv *priv)
         cmd.slots[0].width = cpu_to_le16(slot0);
         cmd.slots[1].width = cpu_to_le16(slot1);
 
-        ret = iwl_dvm_send_cmd_pdu(priv, REPLY_WIPAN_PARAMS, CMD_SYNC,
+        ret = iwl_dvm_send_cmd_pdu(priv, REPLY_WIPAN_PARAMS, 0,
                         sizeof(cmd), &cmd);
         if (ret)
                 IWL_ERR(priv, "Error setting PAN parameters (%d)\n", ret);
@@ -823,7 +823,7 @@ static int iwl_check_rxon_cmd(struct iwl_priv *priv,
 
         if ((rxon->flags & (RXON_FLG_CCK_MSK | RXON_FLG_AUTO_DETECT_MSK))
                         == (RXON_FLG_CCK_MSK | RXON_FLG_AUTO_DETECT_MSK)) {
-                IWL_WARN(priv, "CCK and auto detect");
+                IWL_WARN(priv, "CCK and auto detect\n");
                 errors |= BIT(8);
         }
 
@@ -1395,7 +1395,7 @@ static void iwlagn_chain_noise_reset(struct iwl_priv *priv)
                         priv->phy_calib_chain_noise_reset_cmd);
                 ret = iwl_dvm_send_cmd_pdu(priv,
                                         REPLY_PHY_CALIBRATION_CMD,
-                                        CMD_SYNC, sizeof(cmd), &cmd);
+                                        0, sizeof(cmd), &cmd);
                 if (ret)
                         IWL_ERR(priv,
                                 "Could not send REPLY_PHY_CALIBRATION_CMD\n");
diff --git a/drivers/net/wireless/iwlwifi/dvm/scan.c b/drivers/net/wireless/iwlwifi/dvm/scan.c
index be98b913ed58..43bef901e8f9 100644
--- a/drivers/net/wireless/iwlwifi/dvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/dvm/scan.c
@@ -59,7 +59,7 @@ static int iwl_send_scan_abort(struct iwl_priv *priv)
         int ret;
         struct iwl_host_cmd cmd = {
                 .id = REPLY_SCAN_ABORT_CMD,
-                .flags = CMD_SYNC | CMD_WANT_SKB,
+                .flags = CMD_WANT_SKB,
         };
         __le32 *status;
 
@@ -639,7 +639,6 @@ static int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
         struct iwl_host_cmd cmd = {
                 .id = REPLY_SCAN_CMD,
                 .len = { sizeof(struct iwl_scan_cmd), },
-                .flags = CMD_SYNC,
         };
         struct iwl_scan_cmd *scan;
         struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
diff --git a/drivers/net/wireless/iwlwifi/dvm/sta.c b/drivers/net/wireless/iwlwifi/dvm/sta.c
index 9cdd91cdf661..6ec86adbe4a1 100644
--- a/drivers/net/wireless/iwlwifi/dvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/dvm/sta.c
@@ -39,7 +39,7 @@ static int iwl_sta_ucode_activate(struct iwl_priv *priv, u8 sta_id)
         lockdep_assert_held(&priv->sta_lock);
 
         if (sta_id >= IWLAGN_STATION_COUNT) {
-                IWL_ERR(priv, "invalid sta_id %u", sta_id);
+                IWL_ERR(priv, "invalid sta_id %u\n", sta_id);
                 return -EINVAL;
         }
         if (!(priv->stations[sta_id].used & IWL_STA_DRIVER_ACTIVE))
@@ -165,7 +165,7 @@ int iwl_send_add_sta(struct iwl_priv *priv,
         iwl_free_resp(&cmd);
 
         if (cmd.handler_status)
-                IWL_ERR(priv, "%s - error in the CMD response %d", __func__,
+                IWL_ERR(priv, "%s - error in the CMD response %d\n", __func__,
                         cmd.handler_status);
 
         return cmd.handler_status;
@@ -261,7 +261,7 @@ int iwl_sta_update_ht(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
         cmd.station_flags = flags;
         cmd.sta.sta_id = sta_id;
 
-        return iwl_send_add_sta(priv, &cmd, CMD_SYNC);
+        return iwl_send_add_sta(priv, &cmd, 0);
 }
 
 static void iwl_set_ht_add_station(struct iwl_priv *priv, u8 index,
@@ -413,7 +413,7 @@ int iwl_add_station_common(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
         spin_unlock_bh(&priv->sta_lock);
 
         /* Add station to device's station table */
-        ret = iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
+        ret = iwl_send_add_sta(priv, &sta_cmd, 0);
         if (ret) {
                 spin_lock_bh(&priv->sta_lock);
                 IWL_ERR(priv, "Adding station %pM failed.\n",
@@ -456,7 +456,6 @@ static int iwl_send_remove_station(struct iwl_priv *priv,
         struct iwl_host_cmd cmd = {
                 .id = REPLY_REMOVE_STA,
                 .len = { sizeof(struct iwl_rem_sta_cmd), },
-                .flags = CMD_SYNC,
                 .data = { &rm_sta_cmd, },
         };
 
@@ -740,7 +739,7 @@ void iwl_restore_stations(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
                                         send_lq = true;
                         }
                         spin_unlock_bh(&priv->sta_lock);
-                        ret = iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
+                        ret = iwl_send_add_sta(priv, &sta_cmd, 0);
                         if (ret) {
                                 spin_lock_bh(&priv->sta_lock);
                                 IWL_ERR(priv, "Adding station %pM failed.\n",
@@ -756,8 +755,7 @@ void iwl_restore_stations(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
                          * current LQ command
                          */
                         if (send_lq)
-                                iwl_send_lq_cmd(priv, ctx, &lq,
-                                                CMD_SYNC, true);
+                                iwl_send_lq_cmd(priv, ctx, &lq, 0, true);
                         spin_lock_bh(&priv->sta_lock);
                         priv->stations[i].used &= ~IWL_STA_UCODE_INPROGRESS;
                 }
@@ -968,7 +966,7 @@ int iwlagn_add_bssid_station(struct iwl_priv *priv,
                 return -ENOMEM;
         }
 
-        ret = iwl_send_lq_cmd(priv, ctx, link_cmd, CMD_SYNC, true);
+        ret = iwl_send_lq_cmd(priv, ctx, link_cmd, 0, true);
         if (ret)
                 IWL_ERR(priv, "Link quality command failed (%d)\n", ret);
 
@@ -999,7 +997,6 @@ static int iwl_send_static_wepkey_cmd(struct iwl_priv *priv,
         struct iwl_host_cmd cmd = {
                 .id = ctx->wep_key_cmd,
                 .data = { wep_cmd, },
-                .flags = CMD_SYNC,
         };
 
         might_sleep();
@@ -1248,7 +1245,7 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
         sta_cmd.sta.modify_mask = STA_MODIFY_KEY_MASK;
         sta_cmd.mode = STA_CONTROL_MODIFY_MSK;
 
-        return iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
+        return iwl_send_add_sta(priv, &sta_cmd, 0);
 }
 
 int iwl_set_dynamic_key(struct iwl_priv *priv,
@@ -1284,13 +1281,13 @@ int iwl_set_dynamic_key(struct iwl_priv *priv,
                 ieee80211_get_key_rx_seq(keyconf, 0, &seq);
                 ieee80211_get_tkip_rx_p1k(keyconf, addr, seq.tkip.iv32, p1k);
                 ret = iwlagn_send_sta_key(priv, keyconf, sta_id,
-                                          seq.tkip.iv32, p1k, CMD_SYNC);
+                                          seq.tkip.iv32, p1k, 0);
                 break;
         case WLAN_CIPHER_SUITE_CCMP:
         case WLAN_CIPHER_SUITE_WEP40:
         case WLAN_CIPHER_SUITE_WEP104:
                 ret = iwlagn_send_sta_key(priv, keyconf, sta_id,
-                                          0, NULL, CMD_SYNC);
+                                          0, NULL, 0);
                 break;
         default:
                 IWL_ERR(priv, "Unknown cipher %x\n", keyconf->cipher);
@@ -1409,7 +1406,7 @@ int iwl_sta_tx_modify_enable_tid(struct iwl_priv *priv, int sta_id, int tid)
         memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
         spin_unlock_bh(&priv->sta_lock);
 
-        return iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
+        return iwl_send_add_sta(priv, &sta_cmd, 0);
 }
 
 int iwl_sta_rx_agg_start(struct iwl_priv *priv, struct ieee80211_sta *sta,
@@ -1433,7 +1430,7 @@ int iwl_sta_rx_agg_start(struct iwl_priv *priv, struct ieee80211_sta *sta,
         memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
         spin_unlock_bh(&priv->sta_lock);
 
-        return iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
+        return iwl_send_add_sta(priv, &sta_cmd, 0);
 }
 
 int iwl_sta_rx_agg_stop(struct iwl_priv *priv, struct ieee80211_sta *sta,
@@ -1458,7 +1455,7 @@ int iwl_sta_rx_agg_stop(struct iwl_priv *priv, struct ieee80211_sta *sta,
         memcpy(&sta_cmd, &priv->stations[sta_id].sta, sizeof(struct iwl_addsta_cmd));
         spin_unlock_bh(&priv->sta_lock);
 
-        return iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
+        return iwl_send_add_sta(priv, &sta_cmd, 0);
 }
 
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/tt.c b/drivers/net/wireless/iwlwifi/dvm/tt.c
index 058c5892c427..acb981a0a0aa 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tt.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tt.c
@@ -236,7 +236,7 @@ static void iwl_prepare_ct_kill_task(struct iwl_priv *priv)
 {
         IWL_DEBUG_TEMP(priv, "Prepare to enter IWL_TI_CT_KILL\n");
         /* make request to retrieve statistics information */
-        iwl_send_statistics_request(priv, CMD_SYNC, false);
+        iwl_send_statistics_request(priv, 0, false);
         /* Reschedule the ct_kill wait timer */
         mod_timer(&priv->thermal_throttle.ct_kill_waiting_tm,
                  jiffies + msecs_to_jiffies(CT_KILL_WAITING_DURATION));
diff --git a/drivers/net/wireless/iwlwifi/dvm/tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c
index 398dd096674c..3255a1723d17 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
@@ -402,10 +402,10 @@ int iwlagn_tx_skb(struct iwl_priv *priv,
                 /* aggregation is on for this <sta,tid> */
                 if (info->flags & IEEE80211_TX_CTL_AMPDU &&
                     tid_data->agg.state != IWL_AGG_ON) {
-                        IWL_ERR(priv, "TX_CTL_AMPDU while not in AGG:"
-                                " Tx flags = 0x%08x, agg.state = %d",
+                        IWL_ERR(priv,
+                                "TX_CTL_AMPDU while not in AGG: Tx flags = 0x%08x, agg.state = %d\n",
                                 info->flags, tid_data->agg.state);
-                        IWL_ERR(priv, "sta_id = %d, tid = %d seq_num = %d",
+                        IWL_ERR(priv, "sta_id = %d, tid = %d seq_num = %d\n",
                                 sta_id, tid,
                                 IEEE80211_SEQ_TO_SN(tid_data->seq_number));
                         goto drop_unlock_sta;
@@ -416,7 +416,7 @@ int iwlagn_tx_skb(struct iwl_priv *priv,
                  */
                 if (WARN_ONCE(tid_data->agg.state != IWL_AGG_ON &&
                               tid_data->agg.state != IWL_AGG_OFF,
-                    "Tx while agg.state = %d", tid_data->agg.state))
+                              "Tx while agg.state = %d\n", tid_data->agg.state))
                         goto drop_unlock_sta;
 
                 seq_number = tid_data->seq_number;
@@ -778,8 +778,8 @@ static void iwlagn_check_ratid_empty(struct iwl_priv *priv, int sta_id, u8 tid)
                 /* There are no packets for this RA / TID in the HW any more */
                 if (tid_data->agg.ssn == tid_data->next_reclaimed) {
                         IWL_DEBUG_TX_QUEUES(priv,
-                                "Can continue DELBA flow ssn = next_recl ="
-                                " %d", tid_data->next_reclaimed);
+                                "Can continue DELBA flow ssn = next_recl = %d\n",
+                                tid_data->next_reclaimed);
                         iwl_trans_txq_disable(priv->trans,
                                               tid_data->agg.txq_id);
                         iwlagn_dealloc_agg_txq(priv, tid_data->agg.txq_id);
@@ -791,8 +791,8 @@ static void iwlagn_check_ratid_empty(struct iwl_priv *priv, int sta_id, u8 tid)
                 /* There are no packets for this RA / TID in the HW any more */
                 if (tid_data->agg.ssn == tid_data->next_reclaimed) {
                         IWL_DEBUG_TX_QUEUES(priv,
-                                "Can continue ADDBA flow ssn = next_recl ="
-                                " %d", tid_data->next_reclaimed);
+                                "Can continue ADDBA flow ssn = next_recl = %d\n",
+                                tid_data->next_reclaimed);
                         tid_data->agg.state = IWL_AGG_STARTING;
                         ieee80211_start_tx_ba_cb_irqsafe(vif, addr, tid);
                 }
@@ -1216,8 +1216,8 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
                             ctx->vif->type == NL80211_IFTYPE_STATION) {
                                 /* block and stop all queues */
                                 priv->passive_no_rx = true;
-                                IWL_DEBUG_TX_QUEUES(priv, "stop all queues: "
-                                                    "passive channel");
+                                IWL_DEBUG_TX_QUEUES(priv,
+                                        "stop all queues: passive channel\n");
                                 ieee80211_stop_queues(priv->hw);
 
                                 IWL_DEBUG_TX_REPLY(priv,
@@ -1271,7 +1271,7 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
 
         while (!skb_queue_empty(&skbs)) {
                 skb = __skb_dequeue(&skbs);
-                ieee80211_tx_status_ni(priv->hw, skb);
+                ieee80211_tx_status(priv->hw, skb);
         }
 
         return 0;
@@ -1411,7 +1411,7 @@ int iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
 
         while (!skb_queue_empty(&reclaimed_skbs)) {
                 skb = __skb_dequeue(&reclaimed_skbs);
-                ieee80211_tx_status_ni(priv->hw, skb);
+                ieee80211_tx_status(priv->hw, skb);
         }
 
         return 0;
diff --git a/drivers/net/wireless/iwlwifi/dvm/ucode.c b/drivers/net/wireless/iwlwifi/dvm/ucode.c
index cf03ef5619d9..d5cee1530597 100644
--- a/drivers/net/wireless/iwlwifi/dvm/ucode.c
+++ b/drivers/net/wireless/iwlwifi/dvm/ucode.c
@@ -172,7 +172,7 @@ static int iwl_send_wimax_coex(struct iwl_priv *priv)
         memset(&coex_cmd, 0, sizeof(coex_cmd));
 
         return iwl_dvm_send_cmd_pdu(priv,
-                                COEX_PRIORITY_TABLE_CMD, CMD_SYNC,
+                                COEX_PRIORITY_TABLE_CMD, 0,
                                 sizeof(coex_cmd), &coex_cmd);
 }
 
@@ -205,7 +205,7 @@ void iwl_send_prio_tbl(struct iwl_priv *priv)
         memcpy(prio_tbl_cmd.prio_tbl, iwl_bt_prio_tbl,
                 sizeof(iwl_bt_prio_tbl));
         if (iwl_dvm_send_cmd_pdu(priv,
-                                REPLY_BT_COEX_PRIO_TABLE, CMD_SYNC,
+                                REPLY_BT_COEX_PRIO_TABLE, 0,
                                 sizeof(prio_tbl_cmd), &prio_tbl_cmd))
                 IWL_ERR(priv, "failed to send BT prio tbl command\n");
 }
@@ -218,7 +218,7 @@ int iwl_send_bt_env(struct iwl_priv *priv, u8 action, u8 type)
         env_cmd.action = action;
         env_cmd.type = type;
         ret = iwl_dvm_send_cmd_pdu(priv,
-                               REPLY_BT_COEX_PROT_ENV, CMD_SYNC,
+                               REPLY_BT_COEX_PROT_ENV, 0,
                                sizeof(env_cmd), &env_cmd);
         if (ret)
                 IWL_ERR(priv, "failed to send BT env command\n");
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index 854ba84ccb73..c3817fae16c0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -62,6 +62,7 @@ static const struct iwl_base_params iwl1000_base_params = {
         .led_compensation = 51,
         .wd_timeout = IWL_WATCHDOG_DISABLED,
         .max_event_log_size = 128,
+        .scd_chain_ext_wa = true,
 };
 
 static const struct iwl_ht_params iwl1000_ht_params = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-2000.c b/drivers/net/wireless/iwlwifi/iwl-2000.c
index 3e63323637f3..21e5d0843a62 100644
--- a/drivers/net/wireless/iwlwifi/iwl-2000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-2000.c
@@ -75,6 +75,7 @@ static const struct iwl_base_params iwl2000_base_params = {
         .wd_timeout = IWL_DEF_WD_TIMEOUT,
         .max_event_log_size = 512,
         .shadow_reg_enable = false, /* TODO: fix bugs using this feature */
+        .scd_chain_ext_wa = true,
 };
 
 
@@ -88,6 +89,7 @@ static const struct iwl_base_params iwl2030_base_params = {
         .wd_timeout = IWL_LONG_WD_TIMEOUT,
         .max_event_log_size = 512,
         .shadow_reg_enable = false, /* TODO: fix bugs using this feature */
+        .scd_chain_ext_wa = true,
 };
 
 static const struct iwl_ht_params iwl2000_ht_params = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index 6674f2c4541c..332bbede39e5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -61,6 +61,7 @@ static const struct iwl_base_params iwl5000_base_params = {
         .led_compensation = 51,
         .wd_timeout = IWL_WATCHDOG_DISABLED,
         .max_event_log_size = 512,
+        .scd_chain_ext_wa = true,
 };
 
 static const struct iwl_ht_params iwl5000_ht_params = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index 8048de90233f..8f2c3c8c6b84 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -85,6 +85,7 @@ static const struct iwl_base_params iwl6000_base_params = {
         .wd_timeout = IWL_DEF_WD_TIMEOUT,
         .max_event_log_size = 512,
         .shadow_reg_enable = false, /* TODO: fix bugs using this feature */
+        .scd_chain_ext_wa = true,
 };
 
 static const struct iwl_base_params iwl6050_base_params = {
@@ -97,6 +98,7 @@ static const struct iwl_base_params iwl6050_base_params = {
         .wd_timeout = IWL_DEF_WD_TIMEOUT,
         .max_event_log_size = 1024,
         .shadow_reg_enable = false, /* TODO: fix bugs using this feature */
+        .scd_chain_ext_wa = true,
 };
 
 static const struct iwl_base_params iwl6000_g2_base_params = {
@@ -109,6 +111,7 @@ static const struct iwl_base_params iwl6000_g2_base_params = {
         .wd_timeout = IWL_LONG_WD_TIMEOUT,
         .max_event_log_size = 512,
         .shadow_reg_enable = false, /* TODO: fix bugs using this feature */
+        .scd_chain_ext_wa = true,
 };
 
 static const struct iwl_ht_params iwl6000_ht_params = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c
index 4c2d4ef28b22..48730064da73 100644
--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
@@ -71,12 +71,12 @@
 #define IWL3160_UCODE_API_MAX   9
 
 /* Oldest version we won't warn about */
-#define IWL7260_UCODE_API_OK    8
-#define IWL3160_UCODE_API_OK    8
+#define IWL7260_UCODE_API_OK    9
+#define IWL3160_UCODE_API_OK    9
 
 /* Lowest firmware API version supported */
-#define IWL7260_UCODE_API_MIN   7
-#define IWL3160_UCODE_API_MIN   7
+#define IWL7260_UCODE_API_MIN   8
+#define IWL3160_UCODE_API_MIN   8
 
 /* NVM versions */
 #define IWL7260_NVM_VERSION             0x0a1d
@@ -98,7 +98,7 @@
 #define NVM_HW_SECTION_NUM_FAMILY_7000          0
 
 static const struct iwl_base_params iwl7000_base_params = {
-        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .eeprom_size = OTP_LOW_IMAGE_SIZE_FAMILY_7000,
         .num_of_queues = IWLAGN_NUM_QUEUES,
         .pll_cfg_val = 0,
         .shadow_ram_support = true,
@@ -107,6 +107,7 @@ static const struct iwl_base_params iwl7000_base_params = {
         .max_event_log_size = 512,
         .shadow_reg_enable = true,
         .pcie_l1_allowed = true,
+        .apmg_wake_up_wa = true,
 };
 
 static const struct iwl_ht_params iwl7000_ht_params = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-8000.c b/drivers/net/wireless/iwlwifi/iwl-8000.c
index f5bd82b88592..51c41531d81d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-8000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-8000.c
@@ -83,9 +83,10 @@
 #define IWL8000_MODULE_FIRMWARE(api) IWL8000_FW_PRE __stringify(api) ".ucode"
 
 #define NVM_HW_SECTION_NUM_FAMILY_8000          10
+#define DEFAULT_NVM_FILE_FAMILY_8000            "iwl_nvm_8000.bin"
 
 static const struct iwl_base_params iwl8000_base_params = {
-        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .eeprom_size = OTP_LOW_IMAGE_SIZE_FAMILY_8000,
         .num_of_queues = IWLAGN_NUM_QUEUES,
         .pll_cfg_val = 0,
         .shadow_ram_support = true,
@@ -118,6 +119,7 @@ const struct iwl_cfg iwl8260_2ac_cfg = {
         .ht_params = &iwl8000_ht_params,
         .nvm_ver = IWL8000_NVM_VERSION,
         .nvm_calib_ver = IWL8000_TX_POWER_VERSION,
+        .default_nvm_file = DEFAULT_NVM_FILE_FAMILY_8000,
 };
 
 const struct iwl_cfg iwl8260_n_cfg = {
@@ -127,6 +129,7 @@ const struct iwl_cfg iwl8260_n_cfg = {
         .ht_params = &iwl8000_ht_params,
         .nvm_ver = IWL8000_NVM_VERSION,
         .nvm_calib_ver = IWL8000_TX_POWER_VERSION,
+        .default_nvm_file = DEFAULT_NVM_FILE_FAMILY_8000,
 };
 
 MODULE_FIRMWARE(IWL8000_MODULE_FIRMWARE(IWL8000_UCODE_API_OK));
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-hw.h b/drivers/net/wireless/iwlwifi/iwl-agn-hw.h
index 7f37fb86837b..04a483d38659 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-hw.h
@@ -102,9 +102,7 @@
 
 /* EEPROM */
 #define IWLAGN_EEPROM_IMG_SIZE          2048
-/* OTP */
-/* lower blocks contain EEPROM image and calibration data */
-#define OTP_LOW_IMAGE_SIZE              (2 * 512 * sizeof(u16)) /* 2 KB */
+
 /* high blocks contain PAPD data */
 #define OTP_HIGH_IMAGE_SIZE_6x00        (6 * 512 * sizeof(u16)) /* 6 KB */
 #define OTP_HIGH_IMAGE_SIZE_1000        (0x200 * sizeof(u16)) /* 1024 bytes */
diff --git a/drivers/net/wireless/iwlwifi/iwl-config.h b/drivers/net/wireless/iwlwifi/iwl-config.h
index 3f17dc3f2c8a..b7047905f41a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/iwlwifi/iwl-config.h
@@ -146,6 +146,9 @@ static inline u8 num_of_ant(u8 mask)
  * @wd_timeout: TX queues watchdog timeout
  * @max_event_log_size: size of event log buffer size for ucode event logging
  * @shadow_reg_enable: HW shadow register support
+ * @apmg_wake_up_wa: should the MAC access REQ be asserted when a command
+ *      is in flight. This is due to a HW bug in 7260, 3160 and 7265.
+ * @scd_chain_ext_wa: should the chain extension feature in SCD be disabled.
  */
 struct iwl_base_params {
         int eeprom_size;
@@ -160,6 +163,8 @@ struct iwl_base_params {
         u32 max_event_log_size;
         const bool shadow_reg_enable;
         const bool pcie_l1_allowed;
+        const bool apmg_wake_up_wa;
+        const bool scd_chain_ext_wa;
 };
 
 /*
@@ -188,6 +193,11 @@ struct iwl_ht_params {
 #define EEPROM_6000_REG_BAND_24_HT40_CHANNELS   0x80
 #define EEPROM_REGULATORY_BAND_NO_HT40          0
 
+/* lower blocks contain EEPROM image and calibration data */
+#define OTP_LOW_IMAGE_SIZE              (2 * 512 * sizeof(u16)) /* 2 KB */
+#define OTP_LOW_IMAGE_SIZE_FAMILY_7000  (16 * 512 * sizeof(u16)) /* 16 KB */
+#define OTP_LOW_IMAGE_SIZE_FAMILY_8000  (32 * 512 * sizeof(u16)) /* 32 KB */
+
 struct iwl_eeprom_params {
         const u8 regulatory_bands[7];
         bool enhanced_txpower;
@@ -264,6 +274,8 @@ struct iwl_cfg {
         u8   nvm_hw_section_num;
         bool lp_xtal_workaround;
         const struct iwl_pwr_tx_backoff *pwr_tx_backoffs;
+        bool no_power_up_nic_in_init;
+        const char *default_nvm_file;
 };
 
 /*
diff --git a/drivers/net/wireless/iwlwifi/iwl-debug.c b/drivers/net/wireless/iwlwifi/iwl-debug.c
index 8a44f594528d..09feff4fa226 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debug.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debug.c
@@ -61,8 +61,6 @@
  *
  *****************************************************************************/
 
-#define DEBUG
-
 #include <linux/device.h>
 #include <linux/interrupt.h>
 #include <linux/export.h>
@@ -128,8 +126,8 @@ void __iwl_dbg(struct device *dev,
 #ifdef CONFIG_IWLWIFI_DEBUG
         if (iwl_have_debug_level(level) &&
             (!limit || net_ratelimit()))
-                dev_dbg(dev, "%c %s %pV", in_interrupt() ? 'I' : 'U',
-                        function, &vaf);
+                dev_printk(KERN_DEBUG, dev, "%c %s %pV",
+                           in_interrupt() ? 'I' : 'U', function, &vaf);
 #endif
         trace_iwlwifi_dbg(level, in_interrupt(), function, &vaf);
         va_end(args);
diff --git a/drivers/net/wireless/iwlwifi/iwl-debug.h b/drivers/net/wireless/iwlwifi/iwl-debug.h
index c8cbdbe15924..295083510e72 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debug.h
+++ b/drivers/net/wireless/iwlwifi/iwl-debug.h
@@ -47,12 +47,32 @@ void __iwl_warn(struct device *dev, const char *fmt, ...) __printf(2, 3);
 void __iwl_info(struct device *dev, const char *fmt, ...) __printf(2, 3);
 void __iwl_crit(struct device *dev, const char *fmt, ...) __printf(2, 3);
 
+/* not all compilers can evaluate strlen() at compile time, so use sizeof() */
+#define CHECK_FOR_NEWLINE(f) BUILD_BUG_ON(f[sizeof(f) - 2] != '\n')
+
 /* No matter what is m (priv, bus, trans), this will work */
-#define IWL_ERR(m, f, a...) __iwl_err((m)->dev, false, false, f, ## a)
-#define IWL_ERR_DEV(d, f, a...) __iwl_err((d), false, false, f, ## a)
-#define IWL_WARN(m, f, a...) __iwl_warn((m)->dev, f, ## a)
-#define IWL_INFO(m, f, a...) __iwl_info((m)->dev, f, ## a)
-#define IWL_CRIT(m, f, a...) __iwl_crit((m)->dev, f, ## a)
+#define IWL_ERR_DEV(d, f, a...)                                         \
+        do {                                                            \
+                CHECK_FOR_NEWLINE(f);                                   \
+                __iwl_err((d), false, false, f, ## a);                  \
+        } while (0)
+#define IWL_ERR(m, f, a...)                                             \
+        IWL_ERR_DEV((m)->dev, f, ## a)
+#define IWL_WARN(m, f, a...)                                            \
+        do {                                                            \
+                CHECK_FOR_NEWLINE(f);                                   \
+                __iwl_warn((m)->dev, f, ## a);                          \
+        } while (0)
+#define IWL_INFO(m, f, a...)                                            \
+        do {                                                            \
+                CHECK_FOR_NEWLINE(f);                                   \
+                __iwl_info((m)->dev, f, ## a);                          \
+        } while (0)
+#define IWL_CRIT(m, f, a...)                                            \
+        do {                                                            \
+                CHECK_FOR_NEWLINE(f);                                   \
+                __iwl_crit((m)->dev, f, ## a);                          \
+        } while (0)
 
 #if defined(CONFIG_IWLWIFI_DEBUG) || defined(CONFIG_IWLWIFI_DEVICE_TRACING)
 void __iwl_dbg(struct device *dev,
@@ -72,12 +92,17 @@ do {									\
                        DUMP_PREFIX_OFFSET, 16, 1, p, len, 1);           \
 } while (0)
 
+#define __IWL_DEBUG_DEV(dev, level, limit, fmt, args...)                \
+        do {                                                            \
+                CHECK_FOR_NEWLINE(fmt);                                 \
+                __iwl_dbg(dev, level, limit, __func__, fmt, ##args);    \
+        } while (0)
 #define IWL_DEBUG(m, level, fmt, args...)                               \
-        __iwl_dbg((m)->dev, level, false, __func__, fmt, ##args)
+        __IWL_DEBUG_DEV((m)->dev, level, false, fmt, ##args)
 #define IWL_DEBUG_DEV(dev, level, fmt, args...)                         \
-        __iwl_dbg((dev), level, false, __func__, fmt, ##args)
+        __IWL_DEBUG_DEV(dev, level, false, fmt, ##args)
 #define IWL_DEBUG_LIMIT(m, level, fmt, args...)                         \
-        __iwl_dbg((m)->dev, level, true, __func__, fmt, ##args)
+        __IWL_DEBUG_DEV((m)->dev, level, true, fmt, ##args)
 
 #ifdef CONFIG_IWLWIFI_DEBUG
 #define iwl_print_hex_dump(m, level, p, len)                            \
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.c b/drivers/net/wireless/iwlwifi/iwl-drv.c
index 0a3e841b44a9..f2a5c12269a3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.c
@@ -1243,6 +1243,7 @@ struct iwl_mod_params iwlwifi_mod_params = {
         .bt_coex_active = true,
         .power_level = IWL_POWER_INDEX_1,
         .wd_disable = true,
+        .uapsd_disable = false,
         /* the rest are 0 by default */
 };
 IWL_EXPORT_SYMBOL(iwlwifi_mod_params);
@@ -1356,6 +1357,10 @@ MODULE_PARM_DESC(wd_disable,
 module_param_named(nvm_file, iwlwifi_mod_params.nvm_file, charp, S_IRUGO);
 MODULE_PARM_DESC(nvm_file, "NVM file name");
 
+module_param_named(uapsd_disable, iwlwifi_mod_params.uapsd_disable,
+                   bool, S_IRUGO);
+MODULE_PARM_DESC(uapsd_disable, "disable U-APSD functionality (default: N)");
+
 /*
  * set bt_coex_active to true, uCode will do kill/defer
  * every time the priority line is asserted (BT is sending signals on the
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-error-dump.h b/drivers/net/wireless/iwlwifi/iwl-fw-error-dump.h
index 58c8941c0d95..2953ffceda38 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-error-dump.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw-error-dump.h
@@ -71,10 +71,15 @@
  * enum iwl_fw_error_dump_type - types of data in the dump file
  * @IWL_FW_ERROR_DUMP_SRAM:
  * @IWL_FW_ERROR_DUMP_REG:
+ * @IWL_FW_ERROR_DUMP_RXF:
+ * @IWL_FW_ERROR_DUMP_TXCMD: last TX command data, structured as
+ *      &struct iwl_fw_error_dump_txcmd packets
  */
 enum iwl_fw_error_dump_type {
         IWL_FW_ERROR_DUMP_SRAM = 0,
         IWL_FW_ERROR_DUMP_REG = 1,
+        IWL_FW_ERROR_DUMP_RXF = 2,
+        IWL_FW_ERROR_DUMP_TXCMD = 3,
 
         IWL_FW_ERROR_DUMP_MAX,
 };
@@ -89,7 +94,7 @@ struct iwl_fw_error_dump_data {
         __le32 type;
         __le32 len;
         __u8 data[];
-} __packed __aligned(4);
+} __packed;
 
 /**
  * struct iwl_fw_error_dump_file - the layout of the header of the file
@@ -101,6 +106,29 @@ struct iwl_fw_error_dump_file {
         __le32 barker;
         __le32 file_len;
         u8 data[0];
-} __packed __aligned(4);
+} __packed;
+
+/**
+ * struct iwl_fw_error_dump_txcmd - TX command data
+ * @cmdlen: original length of command
+ * @caplen: captured length of command (may be less)
+ * @data: captured command data, @caplen bytes
+ */
+struct iwl_fw_error_dump_txcmd {
+        __le32 cmdlen;
+        __le32 caplen;
+        u8 data[];
+} __packed;
+
+/**
+ * iwl_mvm_fw_error_next_data - advance fw error dump data pointer
+ * @data: previous data block
+ * Returns: next data block
+ */
+static inline struct iwl_fw_error_dump_data *
+iwl_mvm_fw_error_next_data(struct iwl_fw_error_dump_data *data)
+{
+        return (void *)(data->data + le32_to_cpu(data->len));
+}
 
 #endif /* __fw_error_dump_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw.h b/drivers/net/wireless/iwlwifi/iwl-fw.h
index d14f19339d61..0aa7c0085c9f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw.h
@@ -74,29 +74,24 @@
  * @IWL_UCODE_TLV_FLAGS_MFP: This uCode image supports MFP (802.11w).
  * @IWL_UCODE_TLV_FLAGS_P2P: This uCode image supports P2P.
  * @IWL_UCODE_TLV_FLAGS_DW_BC_TABLE: The SCD byte count table is in DWORDS
- * @IWL_UCODE_TLV_FLAGS_UAPSD: This uCode image supports uAPSD
+ * @IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT: This uCode image supports uAPSD
  * @IWL_UCODE_TLV_FLAGS_SHORT_BL: 16 entries of black list instead of 64 in scan
  *      offload profile config command.
- * @IWL_UCODE_TLV_FLAGS_RX_ENERGY_API: supports rx signal strength api
- * @IWL_UCODE_TLV_FLAGS_TIME_EVENT_API_V2: using the new time event API.
  * @IWL_UCODE_TLV_FLAGS_D3_6_IPV6_ADDRS: D3 image supports up to six
  *      (rather than two) IPv6 addresses
- * @IWL_UCODE_TLV_FLAGS_BF_UPDATED: new beacon filtering API
  * @IWL_UCODE_TLV_FLAGS_NO_BASIC_SSID: not sending a probe with the SSID element
  *      from the probe request template.
- * @IWL_UCODE_TLV_FLAGS_D3_CONTINUITY_API: modified D3 API to allow keeping
- *      connection when going back to D0
  * @IWL_UCODE_TLV_FLAGS_NEW_NSOFFL_SMALL: new NS offload (small version)
  * @IWL_UCODE_TLV_FLAGS_NEW_NSOFFL_LARGE: new NS offload (large version)
- * @IWL_UCODE_TLV_FLAGS_SCHED_SCAN: this uCode image supports scheduled scan.
- * @IWL_UCODE_TLV_FLAGS_STA_KEY_CMD: new ADD_STA and ADD_STA_KEY command API
- * @IWL_UCODE_TLV_FLAGS_DEVICE_PS_CMD: support device wide power command
- *      containing CAM (Continuous Active Mode) indication.
+ * @IWL_UCODE_TLV_FLAGS_P2P_PM: P2P client supports PM as a stand alone MAC
  * @IWL_UCODE_TLV_FLAGS_P2P_BSS_PS_DCM: support power save on BSS station and
  *      P2P client interfaces simultaneously if they are in different bindings.
+ * @IWL_UCODE_TLV_FLAGS_P2P_BSS_PS_SCM: support power save on BSS station and
+ *      P2P client interfaces simultaneously if they are in same bindings.
  * @IWL_UCODE_TLV_FLAGS_P2P_PS_UAPSD: P2P client supports uAPSD power save
  * @IWL_UCODE_TLV_FLAGS_BCAST_FILTERING: uCode supports broadcast filtering.
  * @IWL_UCODE_TLV_FLAGS_GO_UAPSD: AP/GO interfaces support uAPSD clients
+ * @IWL_UCODE_TLV_FLAGS_EBS_SUPPORT: this uCode image supports EBS.
  */
 enum iwl_ucode_tlv_flag {
         IWL_UCODE_TLV_FLAGS_PAN                 = BIT(0),
@@ -104,22 +99,16 @@ enum iwl_ucode_tlv_flag {
         IWL_UCODE_TLV_FLAGS_MFP                 = BIT(2),
         IWL_UCODE_TLV_FLAGS_P2P                 = BIT(3),
         IWL_UCODE_TLV_FLAGS_DW_BC_TABLE         = BIT(4),
-        IWL_UCODE_TLV_FLAGS_NEWBT_COEX          = BIT(5),
-        IWL_UCODE_TLV_FLAGS_PM_CMD_SUPPORT      = BIT(6),
         IWL_UCODE_TLV_FLAGS_SHORT_BL            = BIT(7),
-        IWL_UCODE_TLV_FLAGS_RX_ENERGY_API       = BIT(8),
-        IWL_UCODE_TLV_FLAGS_TIME_EVENT_API_V2   = BIT(9),
         IWL_UCODE_TLV_FLAGS_D3_6_IPV6_ADDRS     = BIT(10),
-        IWL_UCODE_TLV_FLAGS_BF_UPDATED          = BIT(11),
         IWL_UCODE_TLV_FLAGS_NO_BASIC_SSID       = BIT(12),
-        IWL_UCODE_TLV_FLAGS_D3_CONTINUITY_API   = BIT(14),
         IWL_UCODE_TLV_FLAGS_NEW_NSOFFL_SMALL    = BIT(15),
         IWL_UCODE_TLV_FLAGS_NEW_NSOFFL_LARGE    = BIT(16),
-        IWL_UCODE_TLV_FLAGS_SCHED_SCAN          = BIT(17),
-        IWL_UCODE_TLV_FLAGS_STA_KEY_CMD         = BIT(19),
-        IWL_UCODE_TLV_FLAGS_DEVICE_PS_CMD       = BIT(20),
+        IWL_UCODE_TLV_FLAGS_P2P_PM              = BIT(21),
         IWL_UCODE_TLV_FLAGS_BSS_P2P_PS_DCM      = BIT(22),
+        IWL_UCODE_TLV_FLAGS_BSS_P2P_PS_SCM      = BIT(23),
         IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT       = BIT(24),
+        IWL_UCODE_TLV_FLAGS_EBS_SUPPORT         = BIT(25),
         IWL_UCODE_TLV_FLAGS_P2P_PS_UAPSD        = BIT(26),
         IWL_UCODE_TLV_FLAGS_BCAST_FILTERING     = BIT(29),
         IWL_UCODE_TLV_FLAGS_GO_UAPSD            = BIT(30),
@@ -128,9 +117,11 @@ enum iwl_ucode_tlv_flag {
 /**
  * enum iwl_ucode_tlv_api - ucode api
  * @IWL_UCODE_TLV_API_WOWLAN_CONFIG_TID: wowlan config includes tid field.
+ * @IWL_UCODE_TLV_API_CSA_FLOW: ucode can do unbind-bind flow for CSA.
  */
 enum iwl_ucode_tlv_api {
         IWL_UCODE_TLV_API_WOWLAN_CONFIG_TID     = BIT(0),
+        IWL_UCODE_TLV_API_CSA_FLOW              = BIT(4),
 };
 
 /**
@@ -183,6 +174,7 @@ enum iwl_ucode_sec {
 #define IWL_UCODE_SECTION_MAX 12
 #define IWL_API_ARRAY_SIZE      1
 #define IWL_CAPABILITIES_ARRAY_SIZE     1
+#define CPU1_CPU2_SEPARATOR_SECTION     0xFFFFCCCC
 
 struct iwl_ucode_capabilities {
         u32 max_probe_length;
@@ -205,6 +197,11 @@ struct fw_img {
         bool is_dual_cpus;
 };
 
+struct iwl_sf_region {
+        u32 addr;
+        u32 size;
+};
+
 /* uCode version contains 4 values: Major/Minor/API/Serial */
 #define IWL_UCODE_MAJOR(ver)    (((ver) & 0xFF000000) >> 24)
 #define IWL_UCODE_MINOR(ver)    (((ver) & 0x00FF0000) >> 16)
diff --git a/drivers/net/wireless/iwlwifi/iwl-io.c b/drivers/net/wireless/iwlwifi/iwl-io.c
index 44cc3cf45762..5eef4ae7333b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-io.c
+++ b/drivers/net/wireless/iwlwifi/iwl-io.c
@@ -33,6 +33,7 @@
 #include "iwl-io.h"
 #include "iwl-csr.h"
 #include "iwl-debug.h"
+#include "iwl-prph.h"
 #include "iwl-fh.h"
 
 #define IWL_POLL_INTERVAL 10    /* microseconds */
@@ -183,6 +184,23 @@ void iwl_clear_bits_prph(struct iwl_trans *trans, u32 ofs, u32 mask)
 }
 IWL_EXPORT_SYMBOL(iwl_clear_bits_prph);
 
+void iwl_force_nmi(struct iwl_trans *trans)
+{
+        /*
+         * In HW previous to the 8000 HW family, and in the 8000 HW family
+         * itself when the revision step==0, the DEVICE_SET_NMI_REG is used
+         * to force an NMI. Otherwise, a different register -
+         * DEVICE_SET_NMI_8000B_REG - is used.
+         */
+        if ((trans->cfg->device_family != IWL_DEVICE_FAMILY_8000) ||
+            ((trans->hw_rev & 0xc) == 0x0))
+                iwl_write_prph(trans, DEVICE_SET_NMI_REG, DEVICE_SET_NMI_VAL);
+        else
+                iwl_write_prph(trans, DEVICE_SET_NMI_8000B_REG,
+                               DEVICE_SET_NMI_8000B_VAL);
+}
+IWL_EXPORT_SYMBOL(iwl_force_nmi);
+
 static const char *get_fh_string(int cmd)
 {
 #define IWL_CMD(x) case x: return #x
diff --git a/drivers/net/wireless/iwlwifi/iwl-io.h b/drivers/net/wireless/iwlwifi/iwl-io.h
index 665ddd9dbbc4..705d12c079e8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-io.h
+++ b/drivers/net/wireless/iwlwifi/iwl-io.h
@@ -80,6 +80,7 @@ void iwl_set_bits_prph(struct iwl_trans *trans, u32 ofs, u32 mask);
 void iwl_set_bits_mask_prph(struct iwl_trans *trans, u32 ofs,
                             u32 bits, u32 mask);
 void iwl_clear_bits_prph(struct iwl_trans *trans, u32 ofs, u32 mask);
+void iwl_force_nmi(struct iwl_trans *trans);
 
 /* Error handling */
 int iwl_dump_fh(struct iwl_trans *trans, char **buf);
diff --git a/drivers/net/wireless/iwlwifi/iwl-modparams.h b/drivers/net/wireless/iwlwifi/iwl-modparams.h
index d994317db85b..d051857729ab 100644
--- a/drivers/net/wireless/iwlwifi/iwl-modparams.h
+++ b/drivers/net/wireless/iwlwifi/iwl-modparams.h
@@ -119,6 +119,7 @@ struct iwl_mod_params {
 #endif
         int ant_coupling;
         char *nvm_file;
+        bool uapsd_disable;
 };
 
 #endif /* #__iwl_modparams_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
index 6be30c698506..85eee79c495c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
@@ -62,6 +62,7 @@
 #include <linux/types.h>
 #include <linux/slab.h>
 #include <linux/export.h>
+#include <linux/etherdevice.h>
 #include "iwl-drv.h"
 #include "iwl-modparams.h"
 #include "iwl-nvm-parse.h"
@@ -127,19 +128,20 @@ static const u8 iwl_nvm_channels[] = {
 
 static const u8 iwl_nvm_channels_family_8000[] = {
         /* 2.4 GHz */
-        1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13,
+        1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
         /* 5 GHz */
         36, 40, 44, 48, 52, 56, 60, 64, 68, 72, 76, 80, 84, 88, 92,
         96, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
         149, 153, 157, 161, 165, 169, 173, 177, 181
 };
 
-#define IWL_NUM_CHANNELS        ARRAY_SIZE(iwl_nvm_channels)
+#define IWL_NUM_CHANNELS                ARRAY_SIZE(iwl_nvm_channels)
 #define IWL_NUM_CHANNELS_FAMILY_8000    ARRAY_SIZE(iwl_nvm_channels_family_8000)
-#define NUM_2GHZ_CHANNELS       14
-#define FIRST_2GHZ_HT_MINUS     5
-#define LAST_2GHZ_HT_PLUS       9
-#define LAST_5GHZ_HT            161
+#define NUM_2GHZ_CHANNELS               14
+#define NUM_2GHZ_CHANNELS_FAMILY_8000   14
+#define FIRST_2GHZ_HT_MINUS             5
+#define LAST_2GHZ_HT_PLUS               9
+#define LAST_5GHZ_HT                    161
 
 #define DEFAULT_MAX_TX_POWER 16
 
@@ -202,21 +204,23 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg,
         struct ieee80211_channel *channel;
         u16 ch_flags;
         bool is_5ghz;
-        int num_of_ch;
+        int num_of_ch, num_2ghz_channels;
         const u8 *nvm_chan;
 
         if (cfg->device_family != IWL_DEVICE_FAMILY_8000) {
                 num_of_ch = IWL_NUM_CHANNELS;
                 nvm_chan = &iwl_nvm_channels[0];
+                num_2ghz_channels = NUM_2GHZ_CHANNELS;
         } else {
                 num_of_ch = IWL_NUM_CHANNELS_FAMILY_8000;
                 nvm_chan = &iwl_nvm_channels_family_8000[0];
+                num_2ghz_channels = NUM_2GHZ_CHANNELS_FAMILY_8000;
         }
 
         for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) {
                 ch_flags = __le16_to_cpup(nvm_ch_flags + ch_idx);
 
-                if (ch_idx >= NUM_2GHZ_CHANNELS &&
+                if (ch_idx >= num_2ghz_channels &&
                     !data->sku_cap_band_52GHz_enable)
                         ch_flags &= ~NVM_CHANNEL_VALID;
 
@@ -225,7 +229,7 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg,
                                          "Ch. %d Flags %x [%sGHz] - No traffic\n",
                                          nvm_chan[ch_idx],
                                          ch_flags,
-                                         (ch_idx >= NUM_2GHZ_CHANNELS) ?
+                                         (ch_idx >= num_2ghz_channels) ?
                                          "5.2" : "2.4");
                         continue;
                 }
@@ -234,7 +238,7 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg,
                 n_channels++;
 
                 channel->hw_value = nvm_chan[ch_idx];
-                channel->band = (ch_idx < NUM_2GHZ_CHANNELS) ?
+                channel->band = (ch_idx < num_2ghz_channels) ?
                                 IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ;
                 channel->center_freq =
                         ieee80211_channel_to_frequency(
@@ -242,7 +246,7 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg,
 
                 /* TODO: Need to be dependent to the NVM */
                 channel->flags = IEEE80211_CHAN_NO_HT40;
-                if (ch_idx < NUM_2GHZ_CHANNELS &&
+                if (ch_idx < num_2ghz_channels &&
                     (ch_flags & NVM_CHANNEL_40MHZ)) {
                         if (nvm_chan[ch_idx] <= LAST_2GHZ_HT_PLUS)
                                 channel->flags &= ~IEEE80211_CHAN_NO_HT40PLUS;
@@ -250,7 +254,7 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg,
                                 channel->flags &= ~IEEE80211_CHAN_NO_HT40MINUS;
                 } else if (nvm_chan[ch_idx] <= LAST_5GHZ_HT &&
                            (ch_flags & NVM_CHANNEL_40MHZ)) {
-                        if ((ch_idx - NUM_2GHZ_CHANNELS) % 2 == 0)
+                        if ((ch_idx - num_2ghz_channels) % 2 == 0)
                                 channel->flags &= ~IEEE80211_CHAN_NO_HT40PLUS;
                         else
                                 channel->flags &= ~IEEE80211_CHAN_NO_HT40MINUS;
@@ -447,13 +451,7 @@ static void iwl_set_hw_address(const struct iwl_cfg *cfg,
                                struct iwl_nvm_data *data,
                                const __le16 *nvm_sec)
 {
-        u8 hw_addr[ETH_ALEN];
-
-        if (cfg->device_family != IWL_DEVICE_FAMILY_8000)
-                memcpy(hw_addr, nvm_sec + HW_ADDR, ETH_ALEN);
-        else
-                memcpy(hw_addr, nvm_sec + MAC_ADDRESS_OVERRIDE_FAMILY_8000,
-                       ETH_ALEN);
+        const u8 *hw_addr = (const u8 *)(nvm_sec + HW_ADDR);
 
         /* The byte order is little endian 16 bit, meaning 214365 */
         data->hw_addr[0] = hw_addr[1];
@@ -464,6 +462,41 @@ static void iwl_set_hw_address(const struct iwl_cfg *cfg,
         data->hw_addr[5] = hw_addr[4];
 }
 
+static void iwl_set_hw_address_family_8000(const struct iwl_cfg *cfg,
+                                           struct iwl_nvm_data *data,
+                                           const __le16 *mac_override,
+                                           const __le16 *nvm_hw)
+{
+        const u8 *hw_addr;
+
+        if (mac_override) {
+                hw_addr = (const u8 *)(mac_override +
+                                 MAC_ADDRESS_OVERRIDE_FAMILY_8000);
+
+                /* The byte order is little endian 16 bit, meaning 214365 */
+                data->hw_addr[0] = hw_addr[1];
+                data->hw_addr[1] = hw_addr[0];
+                data->hw_addr[2] = hw_addr[3];
+                data->hw_addr[3] = hw_addr[2];
+                data->hw_addr[4] = hw_addr[5];
+                data->hw_addr[5] = hw_addr[4];
+
+                if (is_valid_ether_addr(hw_addr))
+                        return;
+        }
+
+        /* take the MAC address from the OTP */
+        hw_addr = (const u8 *)(nvm_hw + HW_ADDR0_FAMILY_8000);
+        data->hw_addr[0] = hw_addr[3];
+        data->hw_addr[1] = hw_addr[2];
+        data->hw_addr[2] = hw_addr[1];
+        data->hw_addr[3] = hw_addr[0];
+
+        hw_addr = (const u8 *)(nvm_hw + HW_ADDR1_FAMILY_8000);
+        data->hw_addr[4] = hw_addr[1];
+        data->hw_addr[5] = hw_addr[0];
+}
+
 struct iwl_nvm_data *
 iwl_parse_nvm_data(struct device *dev, const struct iwl_cfg *cfg,
                    const __le16 *nvm_hw, const __le16 *nvm_sw,
@@ -523,7 +556,7 @@ iwl_parse_nvm_data(struct device *dev, const struct iwl_cfg *cfg,
                                 rx_chains);
         } else {
                 /* MAC address in family 8000 */
-                iwl_set_hw_address(cfg, data, mac_override);
+                iwl_set_hw_address_family_8000(cfg, data, mac_override, nvm_hw);
 
                 iwl_init_sbands(dev, cfg, data, regulatory,
                                 sku & NVM_SKU_CAP_11AC_ENABLE, tx_chains,
diff --git a/drivers/net/wireless/iwlwifi/iwl-op-mode.h b/drivers/net/wireless/iwlwifi/iwl-op-mode.h
index ea29504ac617..99785c892f96 100644
--- a/drivers/net/wireless/iwlwifi/iwl-op-mode.h
+++ b/drivers/net/wireless/iwlwifi/iwl-op-mode.h
@@ -63,6 +63,7 @@
 #ifndef __iwl_op_mode_h__
 #define __iwl_op_mode_h__
 
+#include <linux/netdevice.h>
 #include <linux/debugfs.h>
 
 struct iwl_op_mode;
@@ -112,8 +113,11 @@ struct iwl_cfg;
  * @stop: stop the op_mode. Must free all the memory allocated.
  *      May sleep
  * @rx: Rx notification to the op_mode. rxb is the Rx buffer itself. Cmd is the
- *      HCMD this Rx responds to.
- *      This callback may sleep, it is called from a threaded IRQ handler.
+ *      HCMD this Rx responds to. Can't sleep.
+ * @napi_add: NAPI initialisation. The transport is fully responsible for NAPI,
+ *      but the higher layers need to know about it (in particular mac80211 to
+ *      to able to call the right NAPI RX functions); this function is needed
+ *      to eventually call netif_napi_add() with higher layer involvement.
  * @queue_full: notifies that a HW queue is full.
  *      Must be atomic and called with BH disabled.
  * @queue_not_full: notifies that a HW queue is not full any more.
@@ -143,6 +147,11 @@ struct iwl_op_mode_ops {
         void (*stop)(struct iwl_op_mode *op_mode);
         int (*rx)(struct iwl_op_mode *op_mode, struct iwl_rx_cmd_buffer *rxb,
                   struct iwl_device_cmd *cmd);
+        void (*napi_add)(struct iwl_op_mode *op_mode,
+                         struct napi_struct *napi,
+                         struct net_device *napi_dev,
+                         int (*poll)(struct napi_struct *, int),
+                         int weight);
         void (*queue_full)(struct iwl_op_mode *op_mode, int queue);
         void (*queue_not_full)(struct iwl_op_mode *op_mode, int queue);
         bool (*hw_rf_kill)(struct iwl_op_mode *op_mode, bool state);
@@ -180,7 +189,6 @@ static inline int iwl_op_mode_rx(struct iwl_op_mode *op_mode,
                                   struct iwl_rx_cmd_buffer *rxb,
                                   struct iwl_device_cmd *cmd)
 {
-        might_sleep();
         return op_mode->ops->rx(op_mode, rxb, cmd);
 }
 
@@ -249,4 +257,15 @@ static inline int iwl_op_mode_exit_d0i3(struct iwl_op_mode *op_mode)
         return op_mode->ops->exit_d0i3(op_mode);
 }
 
+static inline void iwl_op_mode_napi_add(struct iwl_op_mode *op_mode,
+                                        struct napi_struct *napi,
+                                        struct net_device *napi_dev,
+                                        int (*poll)(struct napi_struct *, int),
+                                        int weight)
+{
+        if (!op_mode->ops->napi_add)
+                return;
+        op_mode->ops->napi_add(op_mode, napi, napi_dev, poll, weight);
+}
+
 #endif /* __iwl_op_mode_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-phy-db.c b/drivers/net/wireless/iwlwifi/iwl-phy-db.c
index b761ac4822a3..d4fb5cad07ea 100644
--- a/drivers/net/wireless/iwlwifi/iwl-phy-db.c
+++ b/drivers/net/wireless/iwlwifi/iwl-phy-db.c
@@ -345,7 +345,6 @@ static int iwl_send_phy_db_cmd(struct iwl_phy_db *phy_db, u16 type,
         struct iwl_phy_db_cmd phy_db_cmd;
         struct iwl_host_cmd cmd = {
                 .id = PHY_DB_CMD,
-                .flags = CMD_SYNC,
         };
 
         IWL_DEBUG_INFO(phy_db->trans,
@@ -393,13 +392,13 @@ static int iwl_phy_db_send_all_channel_groups(
                                           entry->data);
                 if (err) {
                         IWL_ERR(phy_db->trans,
-                                "Can't SEND phy_db section %d (%d), err %d",
+                                "Can't SEND phy_db section %d (%d), err %d\n",
                                 type, i, err);
                         return err;
                 }
 
                 IWL_DEBUG_INFO(phy_db->trans,
-                               "Sent PHY_DB HCMD, type = %d num = %d",
+                               "Sent PHY_DB HCMD, type = %d num = %d\n",
                                type, i);
         }
 
@@ -451,7 +450,7 @@ int iwl_send_phy_db_data(struct iwl_phy_db *phy_db)
                                                  IWL_NUM_PAPD_CH_GROUPS);
         if (err) {
                 IWL_ERR(phy_db->trans,
-                        "Cannot send channel specific PAPD groups");
+                        "Cannot send channel specific PAPD groups\n");
                 return err;
         }
 
@@ -461,7 +460,7 @@ int iwl_send_phy_db_data(struct iwl_phy_db *phy_db)
                                                  IWL_NUM_TXP_CH_GROUPS);
         if (err) {
                 IWL_ERR(phy_db->trans,
-                        "Cannot send channel specific TX power groups");
+                        "Cannot send channel specific TX power groups\n");
                 return err;
         }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
index 5f657c501406..4997e27672b3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
@@ -105,6 +105,9 @@
 
 /* Device NMI register */
 #define DEVICE_SET_NMI_REG 0x00a01c30
+#define DEVICE_SET_NMI_VAL 0x1
+#define DEVICE_SET_NMI_8000B_REG 0x00a01c24
+#define DEVICE_SET_NMI_8000B_VAL 0x1000000
 
 /* Shared registers (0x0..0x3ff, via target indirect or periphery */
 #define SHR_BASE        0x00a10000
@@ -348,4 +351,12 @@ enum secure_load_status_reg {
 
 #define LMPM_SECURE_TIME_OUT    (100)
 
+/* Rx FIFO */
+#define RXF_SIZE_ADDR                   (0xa00c88)
+#define RXF_SIZE_BYTE_CND_POS           (7)
+#define RXF_SIZE_BYTE_CNT_MSK           (0x3ff << RXF_SIZE_BYTE_CND_POS)
+
+#define RXF_LD_FENCE_OFFSET_ADDR        (0xa00c10)
+#define RXF_FIFO_RD_FENCE_ADDR          (0xa00c0c)
+
 #endif                          /* __iwl_prph_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.h b/drivers/net/wireless/iwlwifi/iwl-trans.h
index 8cdb0dd618a6..34d49e171fb4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans.h
@@ -189,10 +189,9 @@ static inline u32 iwl_rx_packet_payload_len(const struct iwl_rx_packet *pkt)
 /**
  * enum CMD_MODE - how to send the host commands ?
  *
- * @CMD_SYNC: The caller will be stalled until the fw responds to the command
  * @CMD_ASYNC: Return right away and don't wait for the response
- * @CMD_WANT_SKB: valid only with CMD_SYNC. The caller needs the buffer of the
- *      response. The caller needs to call iwl_free_resp when done.
+ * @CMD_WANT_SKB: Not valid with CMD_ASYNC. The caller needs the buffer of
+ *      the response. The caller needs to call iwl_free_resp when done.
  * @CMD_HIGH_PRIO: The command is high priority - it goes to the front of the
  *      command queue, but after other high priority commands. valid only
  *      with CMD_ASYNC.
@@ -202,7 +201,6 @@ static inline u32 iwl_rx_packet_payload_len(const struct iwl_rx_packet *pkt)
  *      (i.e. mark it as non-idle).
  */
 enum CMD_MODE {
-        CMD_SYNC                = 0,
         CMD_ASYNC               = BIT(0),
         CMD_WANT_SKB            = BIT(1),
         CMD_SEND_IN_RFKILL      = BIT(2),
@@ -427,7 +425,7 @@ struct iwl_trans;
  * @send_cmd:send a host command. Must return -ERFKILL if RFkill is asserted.
  *      If RFkill is asserted in the middle of a SYNC host command, it must
  *      return -ERFKILL straight away.
- *      May sleep only if CMD_SYNC is set
+ *      May sleep only if CMD_ASYNC is not set
  * @tx: send an skb
  *      Must be atomic
  * @reclaim: free packet until ssn. Returns a list of freed packets.
@@ -437,8 +435,7 @@ struct iwl_trans;
  *      this one. The op_mode must not configure the HCMD queue. May sleep.
  * @txq_disable: de-configure a Tx queue to send AMPDUs
  *      Must be atomic
- * @wait_tx_queue_empty: wait until all tx queues are empty
- *      May sleep
+ * @wait_tx_queue_empty: wait until tx queues are empty. May sleep.
  * @dbgfs_register: add the dbgfs files under this directory. Files will be
  *      automatically deleted.
  * @write8: write a u8 to a register at offset ofs from the BAR
@@ -464,6 +461,11 @@ struct iwl_trans;
  * @unref: release a reference previously taken with @ref. Note that
  *      initially the reference count is 1, making an initial @unref
  *      necessary to allow low power states.
+ * @dump_data: fill a data dump with debug data, maybe containing last
+ *      TX'ed commands and similar. When called with a NULL buffer and
+ *      zero buffer length, provide only the (estimated) required buffer
+ *      length. Return the used buffer length.
+ *      Note that the transport must fill in the proper file headers.
  */
 struct iwl_trans_ops {
 
@@ -471,6 +473,8 @@ struct iwl_trans_ops {
         void (*op_mode_leave)(struct iwl_trans *iwl_trans);
         int (*start_fw)(struct iwl_trans *trans, const struct fw_img *fw,
                         bool run_in_rfkill);
+        int (*update_sf)(struct iwl_trans *trans,
+                         struct iwl_sf_region *st_fwrd_space);
         void (*fw_alive)(struct iwl_trans *trans, u32 scd_addr);
         void (*stop_device)(struct iwl_trans *trans);
 
@@ -490,7 +494,7 @@ struct iwl_trans_ops {
         void (*txq_disable)(struct iwl_trans *trans, int queue);
 
         int (*dbgfs_register)(struct iwl_trans *trans, struct dentry* dir);
-        int (*wait_tx_queue_empty)(struct iwl_trans *trans);
+        int (*wait_tx_queue_empty)(struct iwl_trans *trans, u32 txq_bm);
 
         void (*write8)(struct iwl_trans *trans, u32 ofs, u8 val);
         void (*write32)(struct iwl_trans *trans, u32 ofs, u32 val);
@@ -512,6 +516,10 @@ struct iwl_trans_ops {
                               u32 value);
         void (*ref)(struct iwl_trans *trans);
         void (*unref)(struct iwl_trans *trans);
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        u32 (*dump_data)(struct iwl_trans *trans, void *buf, u32 buflen);
+#endif
 };
 
 /**
@@ -630,6 +638,17 @@ static inline int iwl_trans_start_fw(struct iwl_trans *trans,
         return trans->ops->start_fw(trans, fw, run_in_rfkill);
 }
 
+static inline int iwl_trans_update_sf(struct iwl_trans *trans,
+                                      struct iwl_sf_region *st_fwrd_space)
+{
+        might_sleep();
+
+        if (trans->ops->update_sf)
+                return trans->ops->update_sf(trans, st_fwrd_space);
+
+        return 0;
+}
+
 static inline void iwl_trans_stop_device(struct iwl_trans *trans)
 {
         might_sleep();
@@ -665,6 +684,16 @@ static inline void iwl_trans_unref(struct iwl_trans *trans)
                 trans->ops->unref(trans);
 }
 
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+static inline u32 iwl_trans_dump_data(struct iwl_trans *trans,
+                                      void *buf, u32 buflen)
+{
+        if (!trans->ops->dump_data)
+                return 0;
+        return trans->ops->dump_data(trans, buf, buflen);
+}
+#endif
+
 static inline int iwl_trans_send_cmd(struct iwl_trans *trans,
                                      struct iwl_host_cmd *cmd)
 {
@@ -678,7 +707,7 @@ static inline int iwl_trans_send_cmd(struct iwl_trans *trans,
                 return -EIO;
 
         if (unlikely(trans->state != IWL_TRANS_FW_ALIVE)) {
-                IWL_ERR(trans, "%s bad state = %d", __func__, trans->state);
+                IWL_ERR(trans, "%s bad state = %d\n", __func__, trans->state);
                 return -EIO;
         }
 
@@ -720,7 +749,7 @@ static inline int iwl_trans_tx(struct iwl_trans *trans, struct sk_buff *skb,
                 return -EIO;
 
         if (unlikely(trans->state != IWL_TRANS_FW_ALIVE))
-                IWL_ERR(trans, "%s bad state = %d", __func__, trans->state);
+                IWL_ERR(trans, "%s bad state = %d\n", __func__, trans->state);
 
         return trans->ops->tx(trans, skb, dev_cmd, queue);
 }
@@ -729,7 +758,7 @@ static inline void iwl_trans_reclaim(struct iwl_trans *trans, int queue,
                                      int ssn, struct sk_buff_head *skbs)
 {
         if (unlikely(trans->state != IWL_TRANS_FW_ALIVE))
-                IWL_ERR(trans, "%s bad state = %d", __func__, trans->state);
+                IWL_ERR(trans, "%s bad state = %d\n", __func__, trans->state);
 
         trans->ops->reclaim(trans, queue, ssn, skbs);
 }
@@ -746,7 +775,7 @@ static inline void iwl_trans_txq_enable(struct iwl_trans *trans, int queue,
         might_sleep();
 
         if (unlikely((trans->state != IWL_TRANS_FW_ALIVE)))
-                IWL_ERR(trans, "%s bad state = %d", __func__, trans->state);
+                IWL_ERR(trans, "%s bad state = %d\n", __func__, trans->state);
 
         trans->ops->txq_enable(trans, queue, fifo, sta_id, tid,
                                  frame_limit, ssn);
@@ -759,12 +788,13 @@ static inline void iwl_trans_ac_txq_enable(struct iwl_trans *trans, int queue,
                              IWL_MAX_TID_COUNT, IWL_FRAME_LIMIT, 0);
 }
 
-static inline int iwl_trans_wait_tx_queue_empty(struct iwl_trans *trans)
+static inline int iwl_trans_wait_tx_queue_empty(struct iwl_trans *trans,
+                                                u32 txq_bm)
 {
         if (unlikely(trans->state != IWL_TRANS_FW_ALIVE))
-                IWL_ERR(trans, "%s bad state = %d", __func__, trans->state);
+                IWL_ERR(trans, "%s bad state = %d\n", __func__, trans->state);
 
-        return trans->ops->wait_tx_queue_empty(trans);
+        return trans->ops->wait_tx_queue_empty(trans, txq_bm);
 }
 
 static inline int iwl_trans_dbgfs_register(struct iwl_trans *trans,
diff --git a/drivers/net/wireless/iwlwifi/mvm/Makefile b/drivers/net/wireless/iwlwifi/mvm/Makefile
index ccdd3b7c4cce..c30d7f64ec1e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/Makefile
+++ b/drivers/net/wireless/iwlwifi/mvm/Makefile
@@ -3,8 +3,9 @@ iwlmvm-y += fw.o mac80211.o nvm.o ops.o phy-ctxt.o mac-ctxt.o
 iwlmvm-y += utils.o rx.o tx.o binding.o quota.o sta.o sf.o
 iwlmvm-y += scan.o time-event.o rs.o
 iwlmvm-y += power.o coex.o
-iwlmvm-y += led.o tt.o offloading.o
+iwlmvm-y += tt.o offloading.o
 iwlmvm-$(CONFIG_IWLWIFI_DEBUGFS) += debugfs.o debugfs-vif.o
+iwlmvm-$(CONFIG_IWLWIFI_LEDS) += led.o
 iwlmvm-$(CONFIG_PM_SLEEP) += d3.o
 
 ccflags-y += -D__CHECK_ENDIAN__ -I$(src)/../
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex.c b/drivers/net/wireless/iwlwifi/mvm/coex.c
index 0489314425cb..c8c3b38228f0 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex.c
@@ -104,12 +104,9 @@ static const u8 iwl_bt_prio_tbl[BT_COEX_PRIO_TBL_EVT_MAX] = {
 #define BT_DISABLE_REDUCED_TXPOWER_THRESHOLD    (-65)
 #define BT_ANTENNA_COUPLING_THRESHOLD           (30)
 
-int iwl_send_bt_prio_tbl(struct iwl_mvm *mvm)
+static int iwl_send_bt_prio_tbl(struct iwl_mvm *mvm)
 {
-        if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_NEWBT_COEX))
-                return 0;
-
-        return iwl_mvm_send_cmd_pdu(mvm, BT_COEX_PRIO_TABLE, CMD_SYNC,
+        return iwl_mvm_send_cmd_pdu(mvm, BT_COEX_PRIO_TABLE, 0,
                                     sizeof(struct iwl_bt_coex_prio_tbl_cmd),
                                     &iwl_bt_prio_tbl);
 }
@@ -127,10 +124,10 @@ const u32 iwl_bt_cts_kill_msk[BT_KILL_MSK_MAX] = {
 };
 
 static const __le32 iwl_bt_prio_boost[BT_COEX_BOOST_SIZE] = {
-        cpu_to_le32(0xf0f0f0f0),
-        cpu_to_le32(0xc0c0c0c0),
-        cpu_to_le32(0xfcfcfcfc),
-        cpu_to_le32(0xff00ff00),
+        cpu_to_le32(0xf0f0f0f0), /* 50% */
+        cpu_to_le32(0xc0c0c0c0), /* 25% */
+        cpu_to_le32(0xfcfcfcfc), /* 75% */
+        cpu_to_le32(0xfefefefe), /* 87.5% */
 };
 
 static const __le32 iwl_single_shared_ant[BT_COEX_MAX_LUT][BT_COEX_LUT_SIZE] = {
@@ -303,8 +300,8 @@ static const __le64 iwl_ci_mask[][3] = {
 };
 
 static const __le32 iwl_bt_mprio_lut[BT_COEX_MULTI_PRIO_LUT_SIZE] = {
-        cpu_to_le32(0x22002200),
-        cpu_to_le32(0x33113311),
+        cpu_to_le32(0x28412201),
+        cpu_to_le32(0x11118451),
 };
 
 struct corunning_block_luts {
@@ -568,13 +565,13 @@ int iwl_send_bt_init_conf(struct iwl_mvm *mvm)
                 .id = BT_CONFIG,
                 .len = { sizeof(*bt_cmd), },
                 .dataflags = { IWL_HCMD_DFL_NOCOPY, },
-                .flags = CMD_SYNC,
         };
         int ret;
         u32 flags;
 
-        if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_NEWBT_COEX))
-                return 0;
+        ret = iwl_send_bt_prio_tbl(mvm);
+        if (ret)
+                return ret;
 
         bt_cmd = kzalloc(sizeof(*bt_cmd), GFP_KERNEL);
         if (!bt_cmd)
@@ -582,10 +579,12 @@ int iwl_send_bt_init_conf(struct iwl_mvm *mvm)
         cmd.data[0] = bt_cmd;
 
         bt_cmd->max_kill = 5;
-        bt_cmd->bt4_antenna_isolation_thr = BT_ANTENNA_COUPLING_THRESHOLD,
-        bt_cmd->bt4_antenna_isolation = iwlwifi_mod_params.ant_coupling,
-        bt_cmd->bt4_tx_tx_delta_freq_thr = 15,
-        bt_cmd->bt4_tx_rx_max_freq0 = 15,
+        bt_cmd->bt4_antenna_isolation_thr = BT_ANTENNA_COUPLING_THRESHOLD;
+        bt_cmd->bt4_antenna_isolation = iwlwifi_mod_params.ant_coupling;
+        bt_cmd->bt4_tx_tx_delta_freq_thr = 15;
+        bt_cmd->bt4_tx_rx_max_freq0 = 15;
+        bt_cmd->override_primary_lut = BT_COEX_INVALID_LUT;
+        bt_cmd->override_secondary_lut = BT_COEX_INVALID_LUT;
 
         flags = iwlwifi_mod_params.bt_coex_active ?
                         BT_COEX_NW : BT_COEX_DISABLE;
@@ -663,7 +662,6 @@ static int iwl_mvm_bt_udpate_ctrl_kill_msk(struct iwl_mvm *mvm,
                 .data[0] = &bt_cmd,
                 .len = { sizeof(*bt_cmd), },
                 .dataflags = { IWL_HCMD_DFL_NOCOPY, },
-                .flags = CMD_SYNC,
         };
         int ret = 0;
 
@@ -717,7 +715,8 @@ static int iwl_mvm_bt_udpate_ctrl_kill_msk(struct iwl_mvm *mvm,
         return ret;
 }
 
-int iwl_mvm_bt_coex_reduced_txp(struct iwl_mvm *mvm, u8 sta_id, bool enable)
+static int iwl_mvm_bt_coex_reduced_txp(struct iwl_mvm *mvm, u8 sta_id,
+                                       bool enable)
 {
         struct iwl_bt_coex_cmd *bt_cmd;
         /* Send ASYNC since this can be sent from an atomic context */
@@ -735,8 +734,7 @@ int iwl_mvm_bt_coex_reduced_txp(struct iwl_mvm *mvm, u8 sta_id, bool enable)
                 return 0;
 
         /* nothing to do */
-        if (mvmsta->bt_reduced_txpower_dbg ||
-            mvmsta->bt_reduced_txpower == enable)
+        if (mvmsta->bt_reduced_txpower == enable)
                 return 0;
 
         bt_cmd = kzalloc(sizeof(*bt_cmd), GFP_ATOMIC);
@@ -803,23 +801,10 @@ static void iwl_mvm_bt_notif_iterator(void *_data, u8 *mac,
 
         switch (vif->type) {
         case NL80211_IFTYPE_STATION:
+                /* Count BSSes vifs */
+                data->num_bss_ifaces++;
                 /* default smps_mode for BSS / P2P client is AUTOMATIC */
                 smps_mode = IEEE80211_SMPS_AUTOMATIC;
-                data->num_bss_ifaces++;
-
-                /*
-                 * Count unassoc BSSes, relax SMSP constraints
-                 * and disable reduced Tx Power
-                 */
-                if (!vif->bss_conf.assoc) {
-                        iwl_mvm_update_smps(mvm, vif, IWL_MVM_SMPS_REQ_BT_COEX,
-                                            smps_mode);
-                        if (iwl_mvm_bt_coex_reduced_txp(mvm,
-                                                        mvmvif->ap_sta_id,
-                                                        false))
-                                IWL_ERR(mvm, "Couldn't send BT_CONFIG cmd\n");
-                        return;
-                }
                 break;
         case NL80211_IFTYPE_AP:
                 /* default smps_mode for AP / GO is OFF */
@@ -845,8 +830,12 @@ static void iwl_mvm_bt_notif_iterator(void *_data, u8 *mac,
                 /* ... relax constraints and disable rssi events */
                 iwl_mvm_update_smps(mvm, vif, IWL_MVM_SMPS_REQ_BT_COEX,
                                     smps_mode);
-                if (vif->type == NL80211_IFTYPE_STATION)
+                data->reduced_tx_power = false;
+                if (vif->type == NL80211_IFTYPE_STATION) {
+                        iwl_mvm_bt_coex_reduced_txp(mvm, mvmvif->ap_sta_id,
+                                                    false);
                         iwl_mvm_bt_coex_enable_rssi_event(mvm, vif, false, 0);
+                }
                 return;
         }
 
@@ -857,6 +846,11 @@ static void iwl_mvm_bt_notif_iterator(void *_data, u8 *mac,
                 smps_mode = vif->type == NL80211_IFTYPE_AP ?
                                 IEEE80211_SMPS_OFF :
                                 IEEE80211_SMPS_DYNAMIC;
+
+        /* relax SMPS contraints for next association */
+        if (!vif->bss_conf.assoc)
+                smps_mode = IEEE80211_SMPS_AUTOMATIC;
+
         IWL_DEBUG_COEX(data->mvm,
                        "mac %d: bt_status %d bt_activity_grading %d smps_req %d\n",
                        mvmvif->id, data->notif->bt_status, bt_activity_grading,
@@ -903,22 +897,18 @@ static void iwl_mvm_bt_notif_iterator(void *_data, u8 *mac,
                 /* if secondary is not NULL, it might be a GO */
                 data->secondary = chanctx_conf;
 
-        /* don't reduce the Tx power if in loose scheme */
+        /*
+         * don't reduce the Tx power if one of these is true:
+         *  we are in LOOSE
+         *  single share antenna product
+         *  BT is active
+         *  we are associated
+         */
         if (iwl_get_coex_type(mvm, vif) == BT_COEX_LOOSE_LUT ||
-            mvm->cfg->bt_shared_single_ant) {
-                data->reduced_tx_power = false;
-                iwl_mvm_bt_coex_enable_rssi_event(mvm, vif, false, 0);
-                return;
-        }
-
-        /* reduced Txpower only if BT is on, so ...*/
-        if (!data->notif->bt_status) {
-                /* ... cancel reduced Tx power ... */
-                if (iwl_mvm_bt_coex_reduced_txp(mvm, mvmvif->ap_sta_id, false))
-                        IWL_ERR(mvm, "Couldn't send BT_CONFIG cmd\n");
+            mvm->cfg->bt_shared_single_ant || !vif->bss_conf.assoc ||
+            !data->notif->bt_status) {
                 data->reduced_tx_power = false;
-
-                /* ... and there is no need to get reports on RSSI any more. */
+                iwl_mvm_bt_coex_reduced_txp(mvm, mvmvif->ap_sta_id, false);
                 iwl_mvm_bt_coex_enable_rssi_event(mvm, vif, false, 0);
                 return;
         }
@@ -1022,9 +1012,9 @@ static void iwl_mvm_bt_coex_notif_handle(struct iwl_mvm *mvm)
 
         /* Don't spam the fw with the same command over and over */
         if (memcmp(&cmd, &mvm->last_bt_ci_cmd, sizeof(cmd))) {
-                if (iwl_mvm_send_cmd_pdu(mvm, BT_COEX_CI, CMD_SYNC,
+                if (iwl_mvm_send_cmd_pdu(mvm, BT_COEX_CI, 0,
                                          sizeof(cmd), &cmd))
-                        IWL_ERR(mvm, "Failed to send BT_CI cmd");
+                        IWL_ERR(mvm, "Failed to send BT_CI cmd\n");
                 memcpy(&mvm->last_bt_ci_cmd, &cmd, sizeof(cmd));
         }
 
@@ -1039,7 +1029,6 @@ static void iwl_mvm_bt_coex_notif_handle(struct iwl_mvm *mvm)
                 IWL_ERR(mvm, "Failed to update the ctrl_kill_msk\n");
 }
 
-/* upon association, the fw will send in BT Coex notification */
 int iwl_mvm_rx_bt_coex_notif(struct iwl_mvm *mvm,
                              struct iwl_rx_cmd_buffer *rxb,
                              struct iwl_device_cmd *dev_cmd)
@@ -1215,6 +1204,17 @@ bool iwl_mvm_bt_coex_is_mimo_allowed(struct iwl_mvm *mvm,
         return iwl_get_coex_type(mvm, mvmsta->vif) == BT_COEX_TIGHT_LUT;
 }
 
+bool iwl_mvm_bt_coex_is_tpc_allowed(struct iwl_mvm *mvm,
+                                    enum ieee80211_band band)
+{
+        u32 bt_activity = le32_to_cpu(mvm->last_bt_notif.bt_activity_grading);
+
+        if (band != IEEE80211_BAND_2GHZ)
+                return false;
+
+        return bt_activity >= BT_LOW_TRAFFIC;
+}
+
 u8 iwl_mvm_bt_coex_tx_prio(struct iwl_mvm *mvm, struct ieee80211_hdr *hdr,
                            struct ieee80211_tx_info *info, u8 ac)
 {
@@ -1249,9 +1249,6 @@ u8 iwl_mvm_bt_coex_tx_prio(struct iwl_mvm *mvm, struct ieee80211_hdr *hdr,
 
 void iwl_mvm_bt_coex_vif_change(struct iwl_mvm *mvm)
 {
-        if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_NEWBT_COEX))
-                return;
-
         iwl_mvm_bt_coex_notif_handle(mvm);
 }
 
@@ -1270,7 +1267,6 @@ int iwl_mvm_rx_ant_coupling_notif(struct iwl_mvm *mvm,
                 .id = BT_CONFIG,
                 .len = { sizeof(*bt_cmd), },
                 .dataflags = { IWL_HCMD_DFL_NOCOPY, },
-                .flags = CMD_SYNC,
         };
 
         if (!IWL_MVM_BT_COEX_CORUNNING)
diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c
index e56f5a0edf85..645b3cfc29a5 100644
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -193,8 +193,7 @@ static void iwl_mvm_wowlan_program_keys(struct ieee80211_hw *hw,
                         wkc.wep_key.key_offset = data->wep_key_idx;
                 }
 
-                ret = iwl_mvm_send_cmd_pdu(mvm, WEP_KEY, CMD_SYNC,
-                                           sizeof(wkc), &wkc);
+                ret = iwl_mvm_send_cmd_pdu(mvm, WEP_KEY, 0, sizeof(wkc), &wkc);
                 data->error = ret != 0;
 
                 mvm->ptk_ivlen = key->iv_len;
@@ -341,7 +340,6 @@ static int iwl_mvm_send_patterns(struct iwl_mvm *mvm,
         struct iwl_host_cmd cmd = {
                 .id = WOWLAN_PATTERNS,
                 .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
-                .flags = CMD_SYNC,
         };
         int i, err;
 
@@ -518,7 +516,6 @@ static int iwl_mvm_send_remote_wake_cfg(struct iwl_mvm *mvm,
                 .id = REMOTE_WAKE_CONFIG_CMD,
                 .len = { sizeof(*cfg), },
                 .dataflags = { IWL_HCMD_DFL_NOCOPY, },
-                .flags = CMD_SYNC,
         };
         int ret;
 
@@ -666,10 +663,8 @@ static int iwl_mvm_d3_reprogram(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 
         if (WARN_ON(!vif->bss_conf.assoc))
                 return -EINVAL;
-        /* hack */
-        vif->bss_conf.assoc = false;
+
         ret = iwl_mvm_mac_ctxt_add(mvm, vif);
-        vif->bss_conf.assoc = true;
         if (ret)
                 return ret;
 
@@ -705,7 +700,7 @@ static int iwl_mvm_d3_reprogram(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                 return ret;
         rcu_assign_pointer(mvm->fw_id_to_mac_id[mvmvif->ap_sta_id], ap_sta);
 
-        ret = iwl_mvm_mac_ctxt_changed(mvm, vif);
+        ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false);
         if (ret)
                 return ret;
 
@@ -719,7 +714,7 @@ static int iwl_mvm_d3_reprogram(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         for (i = 1; i < MAX_BINDINGS; i++)
                 quota_cmd.quotas[i].id_and_color = cpu_to_le32(FW_CTXT_INVALID);
 
-        ret = iwl_mvm_send_cmd_pdu(mvm, TIME_QUOTA_CMD, CMD_SYNC,
+        ret = iwl_mvm_send_cmd_pdu(mvm, TIME_QUOTA_CMD, 0,
                                    sizeof(quota_cmd), &quota_cmd);
         if (ret)
                 IWL_ERR(mvm, "Failed to send quota: %d\n", ret);
@@ -739,15 +734,13 @@ static int iwl_mvm_get_last_nonqos_seq(struct iwl_mvm *mvm,
         };
         struct iwl_host_cmd cmd = {
                 .id = NON_QOS_TX_COUNTER_CMD,
-                .flags = CMD_SYNC | CMD_WANT_SKB,
+                .flags = CMD_WANT_SKB,
         };
         int err;
         u32 size;
 
-        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_D3_CONTINUITY_API) {
-                cmd.data[0] = &query_cmd;
-                cmd.len[0] = sizeof(query_cmd);
-        }
+        cmd.data[0] = &query_cmd;
+        cmd.len[0] = sizeof(query_cmd);
 
         err = iwl_mvm_send_cmd(mvm, &cmd);
         if (err)
@@ -758,10 +751,8 @@ static int iwl_mvm_get_last_nonqos_seq(struct iwl_mvm *mvm,
                 err = -EINVAL;
         } else {
                 err = le16_to_cpup((__le16 *)cmd.resp_pkt->data);
-                /* new API returns next, not last-used seqno */
-                if (mvm->fw->ucode_capa.flags &
-                                IWL_UCODE_TLV_FLAGS_D3_CONTINUITY_API)
-                        err = (u16) (err - 0x10);
+                /* firmware returns next, not last-used seqno */
+                err = (u16) (err - 0x10);
         }
 
         iwl_free_resp(&cmd);
@@ -785,11 +776,7 @@ void iwl_mvm_set_last_nonqos_seq(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 
         mvmvif->seqno_valid = false;
 
-        if (!(mvm->fw->ucode_capa.flags &
-                        IWL_UCODE_TLV_FLAGS_D3_CONTINUITY_API))
-                return;
-
-        if (iwl_mvm_send_cmd_pdu(mvm, NON_QOS_TX_COUNTER_CMD, CMD_SYNC,
+        if (iwl_mvm_send_cmd_pdu(mvm, NON_QOS_TX_COUNTER_CMD, 0,
                                  sizeof(query_cmd), &query_cmd))
                 IWL_ERR(mvm, "failed to set non-QoS seqno\n");
 }
@@ -804,7 +791,7 @@ iwl_mvm_send_wowlan_config_cmd(struct iwl_mvm *mvm,
         if (mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_WOWLAN_CONFIG_TID)
                 cmd_len = sizeof(*cmd);
 
-        return iwl_mvm_send_cmd_pdu(mvm, WOWLAN_CONFIGURATION, CMD_SYNC,
+        return iwl_mvm_send_cmd_pdu(mvm, WOWLAN_CONFIGURATION, 0,
                                     cmd_len, cmd);
 }
 
@@ -833,7 +820,7 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
         };
         struct iwl_host_cmd d3_cfg_cmd = {
                 .id = D3_CONFIG_CMD,
-                .flags = CMD_SYNC | CMD_WANT_SKB,
+                .flags = CMD_WANT_SKB,
                 .data[0] = &d3_cfg_cmd_data,
                 .len[0] = sizeof(d3_cfg_cmd_data),
         };
@@ -983,7 +970,6 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
                 if (key_data.use_rsc_tsc) {
                         struct iwl_host_cmd rsc_tsc_cmd = {
                                 .id = WOWLAN_TSC_RSC_PARAM,
-                                .flags = CMD_SYNC,
                                 .data[0] = key_data.rsc_tsc,
                                 .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
                                 .len[0] = sizeof(*key_data.rsc_tsc),
@@ -997,7 +983,7 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
                 if (key_data.use_tkip) {
                         ret = iwl_mvm_send_cmd_pdu(mvm,
                                                    WOWLAN_TKIP_PARAM,
-                                                   CMD_SYNC, sizeof(tkip_cmd),
+                                                   0, sizeof(tkip_cmd),
                                                    &tkip_cmd);
                         if (ret)
                                 goto out;
@@ -1014,8 +1000,7 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
                         kek_kck_cmd.replay_ctr = mvmvif->rekey_data.replay_ctr;
 
                         ret = iwl_mvm_send_cmd_pdu(mvm,
-                                                   WOWLAN_KEK_KCK_MATERIAL,
-                                                   CMD_SYNC,
+                                                   WOWLAN_KEK_KCK_MATERIAL, 0,
                                                    sizeof(kek_kck_cmd),
                                                    &kek_kck_cmd);
                         if (ret)
@@ -1031,7 +1016,7 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
         if (ret)
                 goto out;
 
-        ret = iwl_mvm_send_proto_offload(mvm, vif, false, CMD_SYNC);
+        ret = iwl_mvm_send_proto_offload(mvm, vif, false, 0);
         if (ret)
                 goto out;
 
@@ -1043,7 +1028,7 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
         if (ret)
                 goto out;
 
-        ret = iwl_mvm_power_update_mac(mvm, vif);
+        ret = iwl_mvm_power_update_mac(mvm);
         if (ret)
                 goto out;
 
@@ -1082,6 +1067,15 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
 
 int iwl_mvm_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
 {
+        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+
+        if (iwl_mvm_is_d0i3_supported(mvm)) {
+                mutex_lock(&mvm->d0i3_suspend_mutex);
+                __set_bit(D0I3_DEFER_WAKEUP, &mvm->d0i3_suspend_flags);
+                mutex_unlock(&mvm->d0i3_suspend_mutex);
+                return 0;
+        }
+
         return __iwl_mvm_suspend(hw, wowlan, false);
 }
 
@@ -1277,7 +1271,7 @@ static void iwl_mvm_set_tkip_rx_seq(struct tkip_sc *scs,
 }
 
 static void iwl_mvm_set_key_rx_seq(struct ieee80211_key_conf *key,
-                                   struct iwl_wowlan_status_v6 *status)
+                                   struct iwl_wowlan_status *status)
 {
         union iwl_all_tsc_rsc *rsc = &status->gtk.rsc.all_tsc_rsc;
 
@@ -1294,7 +1288,7 @@ static void iwl_mvm_set_key_rx_seq(struct ieee80211_key_conf *key,
 }
 
 struct iwl_mvm_d3_gtk_iter_data {
-        struct iwl_wowlan_status_v6 *status;
+        struct iwl_wowlan_status *status;
         void *last_gtk;
         u32 cipher;
         bool find_phase, unhandled_cipher;
@@ -1370,7 +1364,7 @@ static void iwl_mvm_d3_update_gtks(struct ieee80211_hw *hw,
 
 static bool iwl_mvm_setup_connection_keep(struct iwl_mvm *mvm,
                                           struct ieee80211_vif *vif,
-                                          struct iwl_wowlan_status_v6 *status)
+                                          struct iwl_wowlan_status *status)
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_mvm_d3_gtk_iter_data gtkdata = {
@@ -1465,10 +1459,10 @@ static bool iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
         } err_info;
         struct iwl_host_cmd cmd = {
                 .id = WOWLAN_GET_STATUSES,
-                .flags = CMD_SYNC | CMD_WANT_SKB,
+                .flags = CMD_WANT_SKB,
         };
         struct iwl_wowlan_status_data status;
-        struct iwl_wowlan_status_v6 *status_v6;
+        struct iwl_wowlan_status *fw_status;
         int ret, len, status_size, i;
         bool keep;
         struct ieee80211_sta *ap_sta;
@@ -1491,7 +1485,7 @@ static bool iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
         }
 
         /* only for tracing for now */
-        ret = iwl_mvm_send_cmd_pdu(mvm, OFFLOADS_QUERY_CMD, CMD_SYNC, 0, NULL);
+        ret = iwl_mvm_send_cmd_pdu(mvm, OFFLOADS_QUERY_CMD, 0, 0, NULL);
         if (ret)
                 IWL_ERR(mvm, "failed to query offload statistics (%d)\n", ret);
 
@@ -1505,10 +1499,7 @@ static bool iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
         if (!cmd.resp_pkt)
                 goto out_unlock;
 
-        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_D3_CONTINUITY_API)
-                status_size = sizeof(struct iwl_wowlan_status_v6);
-        else
-                status_size = sizeof(struct iwl_wowlan_status_v4);
+        status_size = sizeof(*fw_status);
 
         len = iwl_rx_packet_payload_len(cmd.resp_pkt);
         if (len < status_size) {
@@ -1516,35 +1507,18 @@ static bool iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
                 goto out_free_resp;
         }
 
-        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_D3_CONTINUITY_API) {
-                status_v6 = (void *)cmd.resp_pkt->data;
-
-                status.pattern_number = le16_to_cpu(status_v6->pattern_number);
-                for (i = 0; i < 8; i++)
-                        status.qos_seq_ctr[i] =
-                                le16_to_cpu(status_v6->qos_seq_ctr[i]);
-                status.wakeup_reasons = le32_to_cpu(status_v6->wakeup_reasons);
-                status.wake_packet_length =
-                        le32_to_cpu(status_v6->wake_packet_length);
-                status.wake_packet_bufsize =
-                        le32_to_cpu(status_v6->wake_packet_bufsize);
-                status.wake_packet = status_v6->wake_packet;
-        } else {
-                struct iwl_wowlan_status_v4 *status_v4;
-                status_v6 = NULL;
-                status_v4 = (void *)cmd.resp_pkt->data;
-
-                status.pattern_number = le16_to_cpu(status_v4->pattern_number);
-                for (i = 0; i < 8; i++)
-                        status.qos_seq_ctr[i] =
-                                le16_to_cpu(status_v4->qos_seq_ctr[i]);
-                status.wakeup_reasons = le32_to_cpu(status_v4->wakeup_reasons);
-                status.wake_packet_length =
-                        le32_to_cpu(status_v4->wake_packet_length);
-                status.wake_packet_bufsize =
-                        le32_to_cpu(status_v4->wake_packet_bufsize);
-                status.wake_packet = status_v4->wake_packet;
-        }
+        fw_status = (void *)cmd.resp_pkt->data;
+
+        status.pattern_number = le16_to_cpu(fw_status->pattern_number);
+        for (i = 0; i < 8; i++)
+                status.qos_seq_ctr[i] =
+                        le16_to_cpu(fw_status->qos_seq_ctr[i]);
+        status.wakeup_reasons = le32_to_cpu(fw_status->wakeup_reasons);
+        status.wake_packet_length =
+                le32_to_cpu(fw_status->wake_packet_length);
+        status.wake_packet_bufsize =
+                le32_to_cpu(fw_status->wake_packet_bufsize);
+        status.wake_packet = fw_status->wake_packet;
 
         if (len != status_size + ALIGN(status.wake_packet_bufsize, 4)) {
                 IWL_ERR(mvm, "Invalid WoWLAN status response!\n");
@@ -1571,7 +1545,7 @@ static bool iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
 
         iwl_mvm_report_wakeup_reasons(mvm, vif, &status);
 
-        keep = iwl_mvm_setup_connection_keep(mvm, vif, status_v6);
+        keep = iwl_mvm_setup_connection_keep(mvm, vif, fw_status);
 
         iwl_free_resp(&cmd);
         return keep;
@@ -1674,6 +1648,19 @@ int iwl_mvm_resume(struct ieee80211_hw *hw)
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 
+        if (iwl_mvm_is_d0i3_supported(mvm)) {
+                bool exit_now;
+
+                mutex_lock(&mvm->d0i3_suspend_mutex);
+                __clear_bit(D0I3_DEFER_WAKEUP, &mvm->d0i3_suspend_flags);
+                exit_now = __test_and_clear_bit(D0I3_PENDING_WAKEUP,
+                                                &mvm->d0i3_suspend_flags);
+                mutex_unlock(&mvm->d0i3_suspend_mutex);
+                if (exit_now)
+                        _iwl_mvm_exit_d0i3(mvm);
+                return 0;
+        }
+
         return __iwl_mvm_resume(mvm, false);
 }
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c b/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c
index 9b59e1d7ae71..2e90ff795c13 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c
@@ -103,10 +103,6 @@ static void iwl_dbgfs_update_pm(struct iwl_mvm *mvm,
                 IWL_DEBUG_POWER(mvm, "tx_data_timeout=%d\n", val);
                 dbgfs_pm->tx_data_timeout = val;
                 break;
-        case MVM_DEBUGFS_PM_DISABLE_POWER_OFF:
-                IWL_DEBUG_POWER(mvm, "disable_power_off=%d\n", val);
-                dbgfs_pm->disable_power_off = val;
-                break;
         case MVM_DEBUGFS_PM_LPRX_ENA:
                 IWL_DEBUG_POWER(mvm, "lprx %s\n", val ? "enabled" : "disabled");
                 dbgfs_pm->lprx_ena = val;
@@ -154,12 +150,6 @@ static ssize_t iwl_dbgfs_pm_params_write(struct ieee80211_vif *vif, char *buf,
                 if (sscanf(buf + 16, "%d", &val) != 1)
                         return -EINVAL;
                 param = MVM_DEBUGFS_PM_TX_DATA_TIMEOUT;
-        } else if (!strncmp("disable_power_off=", buf, 18) &&
-                   !(mvm->fw->ucode_capa.flags &
-                     IWL_UCODE_TLV_FLAGS_DEVICE_PS_CMD)) {
-                if (sscanf(buf + 18, "%d", &val) != 1)
-                        return -EINVAL;
-                param = MVM_DEBUGFS_PM_DISABLE_POWER_OFF;
         } else if (!strncmp("lprx=", buf, 5)) {
                 if (sscanf(buf + 5, "%d", &val) != 1)
                         return -EINVAL;
@@ -185,7 +175,7 @@ static ssize_t iwl_dbgfs_pm_params_write(struct ieee80211_vif *vif, char *buf,
 
         mutex_lock(&mvm->mutex);
         iwl_dbgfs_update_pm(mvm, vif, param, val);
-        ret = iwl_mvm_power_update_mac(mvm, vif);
+        ret = iwl_mvm_power_update_mac(mvm);
         mutex_unlock(&mvm->mutex);
 
         return ret ?: count;
@@ -272,10 +262,9 @@ static ssize_t iwl_dbgfs_mac_params_read(struct file *file,
                         struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
 
                         pos += scnprintf(buf+pos, bufsz-pos,
-                                         "ap_sta_id %d - reduced Tx power %d force %d\n",
+                                         "ap_sta_id %d - reduced Tx power %d\n",
                                          ap_sta_id,
-                                         mvm_sta->bt_reduced_txpower,
-                                         mvm_sta->bt_reduced_txpower_dbg);
+                                         mvm_sta->bt_reduced_txpower);
                 }
         }
 
@@ -293,41 +282,6 @@ static ssize_t iwl_dbgfs_mac_params_read(struct file *file,
         return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
 
-static ssize_t iwl_dbgfs_reduced_txp_write(struct ieee80211_vif *vif,
-                                           char *buf, size_t count,
-                                           loff_t *ppos)
-{
-        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        struct iwl_mvm *mvm = mvmvif->mvm;
-        struct iwl_mvm_sta *mvmsta;
-        bool reduced_tx_power;
-        int ret;
-
-        if (mvmvif->ap_sta_id >= ARRAY_SIZE(mvm->fw_id_to_mac_id))
-                return -ENOTCONN;
-
-        if (strtobool(buf, &reduced_tx_power) != 0)
-                return -EINVAL;
-
-        mutex_lock(&mvm->mutex);
-
-        mvmsta = iwl_mvm_sta_from_staid_protected(mvm, mvmvif->ap_sta_id);
-        if (IS_ERR_OR_NULL(mvmsta)) {
-                mutex_unlock(&mvm->mutex);
-                return -ENOTCONN;
-        }
-
-        mvmsta->bt_reduced_txpower_dbg = false;
-        ret = iwl_mvm_bt_coex_reduced_txp(mvm, mvmvif->ap_sta_id,
-                                          reduced_tx_power);
-        if (!ret)
-                mvmsta->bt_reduced_txpower_dbg = true;
-
-        mutex_unlock(&mvm->mutex);
-
-        return ret ? : count;
-}
-
 static void iwl_dbgfs_update_bf(struct ieee80211_vif *vif,
                                 enum iwl_dbgfs_bf_mask param, int value)
 {
@@ -462,9 +416,9 @@ static ssize_t iwl_dbgfs_bf_params_write(struct ieee80211_vif *vif, char *buf,
         mutex_lock(&mvm->mutex);
         iwl_dbgfs_update_bf(vif, param, value);
         if (param == MVM_DEBUGFS_BF_ENABLE_BEACON_FILTER && !value)
-                ret = iwl_mvm_disable_beacon_filter(mvm, vif, CMD_SYNC);
+                ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
         else
-                ret = iwl_mvm_enable_beacon_filter(mvm, vif, CMD_SYNC);
+                ret = iwl_mvm_enable_beacon_filter(mvm, vif, 0);
         mutex_unlock(&mvm->mutex);
 
         return ret ?: count;
@@ -568,7 +522,6 @@ MVM_DEBUGFS_READ_FILE_OPS(mac_params);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(pm_params, 32);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(bf_params, 256);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(low_latency, 10);
-MVM_DEBUGFS_WRITE_FILE_OPS(reduced_txp, 10);
 
 void iwl_mvm_vif_dbgfs_register(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 {
@@ -592,8 +545,7 @@ void iwl_mvm_vif_dbgfs_register(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                 return;
         }
 
-        if ((mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_PM_CMD_SUPPORT) &&
-            iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM &&
+        if (iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM &&
             ((vif->type == NL80211_IFTYPE_STATION && !vif->p2p) ||
              (vif->type == NL80211_IFTYPE_STATION && vif->p2p &&
               mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_BSS_P2P_PS_DCM)))
@@ -601,7 +553,6 @@ void iwl_mvm_vif_dbgfs_register(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                                          S_IRUSR);
 
         MVM_DEBUGFS_ADD_FILE_VIF(mac_params, mvmvif->dbgfs_dir, S_IRUSR);
-        MVM_DEBUGFS_ADD_FILE_VIF(reduced_txp, mvmvif->dbgfs_dir, S_IWUSR);
         MVM_DEBUGFS_ADD_FILE_VIF(low_latency, mvmvif->dbgfs_dir,
                                  S_IRUSR | S_IWUSR);
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
index 1b52deea6081..29ca72695eaa 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
@@ -65,9 +65,8 @@
 #include "mvm.h"
 #include "sta.h"
 #include "iwl-io.h"
-#include "iwl-prph.h"
 #include "debugfs.h"
-#include "fw-error-dump.h"
+#include "iwl-fw-error-dump.h"
 
 static ssize_t iwl_dbgfs_tx_flush_write(struct iwl_mvm *mvm, char *buf,
                                         size_t count, loff_t *ppos)
@@ -136,9 +135,6 @@ static int iwl_dbgfs_fw_error_dump_open(struct inode *inode, struct file *file)
 
         file->private_data = mvm->fw_error_dump;
         mvm->fw_error_dump = NULL;
-        kfree(mvm->fw_error_sram);
-        mvm->fw_error_sram = NULL;
-        mvm->fw_error_sram_len = 0;
         ret = 0;
 
 out:
@@ -684,7 +680,7 @@ static ssize_t iwl_dbgfs_fw_restart_write(struct iwl_mvm *mvm, char *buf,
                 mvm->restart_fw++;
 
         /* take the return value to make compiler happy - it will fail anyway */
-        ret = iwl_mvm_send_cmd_pdu(mvm, REPLY_ERROR, CMD_SYNC, 0, NULL);
+        ret = iwl_mvm_send_cmd_pdu(mvm, REPLY_ERROR, 0, 0, NULL);
 
         mutex_unlock(&mvm->mutex);
 
@@ -694,7 +690,7 @@ static ssize_t iwl_dbgfs_fw_restart_write(struct iwl_mvm *mvm, char *buf,
 static ssize_t iwl_dbgfs_fw_nmi_write(struct iwl_mvm *mvm, char *buf,
                                       size_t count, loff_t *ppos)
 {
-        iwl_write_prph(mvm->trans, DEVICE_SET_NMI_REG, 1);
+        iwl_force_nmi(mvm->trans);
 
         return count;
 }
@@ -841,7 +837,7 @@ static ssize_t iwl_dbgfs_bcast_filters_write(struct iwl_mvm *mvm, char *buf,
         /* send updated bcast filtering configuration */
         if (mvm->dbgfs_bcast_filtering.override &&
             iwl_mvm_bcast_filter_build_cmd(mvm, &cmd))
-                err = iwl_mvm_send_cmd_pdu(mvm, BCAST_FILTER_CMD, CMD_SYNC,
+                err = iwl_mvm_send_cmd_pdu(mvm, BCAST_FILTER_CMD, 0,
                                            sizeof(cmd), &cmd);
         mutex_unlock(&mvm->mutex);
 
@@ -913,7 +909,7 @@ static ssize_t iwl_dbgfs_bcast_filters_macs_write(struct iwl_mvm *mvm,
         /* send updated bcast filtering configuration */
         if (mvm->dbgfs_bcast_filtering.override &&
             iwl_mvm_bcast_filter_build_cmd(mvm, &cmd))
-                err = iwl_mvm_send_cmd_pdu(mvm, BCAST_FILTER_CMD, CMD_SYNC,
+                err = iwl_mvm_send_cmd_pdu(mvm, BCAST_FILTER_CMD, 0,
                                            sizeof(cmd), &cmd);
         mutex_unlock(&mvm->mutex);
 
@@ -1004,6 +1000,7 @@ static ssize_t iwl_dbgfs_d0i3_refs_read(struct file *file,
         PRINT_MVM_REF(IWL_MVM_REF_P2P_CLIENT);
         PRINT_MVM_REF(IWL_MVM_REF_AP_IBSS);
         PRINT_MVM_REF(IWL_MVM_REF_USER);
+        PRINT_MVM_REF(IWL_MVM_REF_EXIT_WORK);
 
         return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
@@ -1108,9 +1105,9 @@ MVM_DEBUGFS_READ_WRITE_FILE_OPS(scan_ant_rxchain, 8);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(d0i3_refs, 8);
 
 static const struct file_operations iwl_dbgfs_fw_error_dump_ops = {
-        .open = iwl_dbgfs_fw_error_dump_open,
-        .read = iwl_dbgfs_fw_error_dump_read,
-        .release = iwl_dbgfs_fw_error_dump_release,
+        .open = iwl_dbgfs_fw_error_dump_open,
+        .read = iwl_dbgfs_fw_error_dump_read,
+        .release = iwl_dbgfs_fw_error_dump_release,
 };
 
 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
@@ -1138,9 +1135,8 @@ int iwl_mvm_dbgfs_register(struct iwl_mvm *mvm, struct dentry *dbgfs_dir)
         MVM_DEBUGFS_ADD_FILE(fw_error_dump, dbgfs_dir, S_IRUSR);
         MVM_DEBUGFS_ADD_FILE(bt_notif, dbgfs_dir, S_IRUSR);
         MVM_DEBUGFS_ADD_FILE(bt_cmd, dbgfs_dir, S_IRUSR);
-        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_DEVICE_PS_CMD)
-                MVM_DEBUGFS_ADD_FILE(disable_power_off, mvm->debugfs_dir,
-                                     S_IRUSR | S_IWUSR);
+        MVM_DEBUGFS_ADD_FILE(disable_power_off, mvm->debugfs_dir,
+                             S_IRUSR | S_IWUSR);
         MVM_DEBUGFS_ADD_FILE(fw_rx_stats, mvm->debugfs_dir, S_IRUSR);
         MVM_DEBUGFS_ADD_FILE(drv_rx_stats, mvm->debugfs_dir, S_IRUSR);
         MVM_DEBUGFS_ADD_FILE(fw_restart, mvm->debugfs_dir, S_IWUSR);
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-coex.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-coex.h
index 21877e5966a8..5fe82c29c8ad 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-coex.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-coex.h
@@ -141,7 +141,8 @@ enum iwl_bt_coex_lut_type {
         BT_COEX_TX_DIS_LUT,
 
         BT_COEX_MAX_LUT,
-};
+        BT_COEX_INVALID_LUT = 0xff,
+}; /* BT_COEX_DECISION_LUT_INDEX_API_E_VER_1 */
 
 #define BT_COEX_LUT_SIZE (12)
 #define BT_COEX_CORUN_LUT_SIZE (32)
@@ -154,19 +155,23 @@ enum iwl_bt_coex_lut_type {
  * @flags:&enum iwl_bt_coex_flags
  * @max_kill:
  * @bt_reduced_tx_power: enum %iwl_bt_reduced_tx_power
- * @bt4_antenna_isolation:
- * @bt4_antenna_isolation_thr:
- * @bt4_tx_tx_delta_freq_thr:
- * @bt4_tx_rx_max_freq0:
- * @bt_prio_boost:
+ * @override_primary_lut: enum %iwl_bt_coex_lut_type: BT_COEX_INVALID_LUT
+ *      should be set by default
+ * @override_secondary_lut: enum %iwl_bt_coex_lut_type: BT_COEX_INVALID_LUT
+ *      should be set by default
+ * @bt4_antenna_isolation: antenna isolation
+ * @bt4_antenna_isolation_thr: antenna threshold value
+ * @bt4_tx_tx_delta_freq_thr: TxTx delta frequency
+ * @bt4_tx_rx_max_freq0: TxRx max frequency
+ * @bt_prio_boost: BT priority boost registers
  * @wifi_tx_prio_boost: SW boost of wifi tx priority
  * @wifi_rx_prio_boost: SW boost of wifi rx priority
- * @kill_ack_msk:
- * @kill_cts_msk:
- * @decision_lut:
- * @bt4_multiprio_lut:
- * @bt4_corun_lut20:
- * @bt4_corun_lut40:
+ * @kill_ack_msk: kill ACK mask. 1 - Tx ACK, 0 - kill Tx of ACK.
+ * @kill_cts_msk: kill CTS mask. 1 - Tx CTS, 0 - kill Tx of CTS.
+ * @decision_lut: PTA decision LUT, per Prio-Ch
+ * @bt4_multiprio_lut: multi priority LUT configuration
+ * @bt4_corun_lut20: co-running 20 MHz LUT configuration
+ * @bt4_corun_lut40: co-running 40 MHz LUT configuration
  * @valid_bit_msk: enum %iwl_bt_coex_valid_bit_msk
  *
  * The structure is used for the BT_COEX command.
@@ -175,7 +180,8 @@ struct iwl_bt_coex_cmd {
         __le32 flags;
         u8 max_kill;
         u8 bt_reduced_tx_power;
-        u8 reserved[2];
+        u8 override_primary_lut;
+        u8 override_secondary_lut;
 
         u8 bt4_antenna_isolation;
         u8 bt4_antenna_isolation_thr;
@@ -194,7 +200,7 @@ struct iwl_bt_coex_cmd {
         __le32 bt4_corun_lut40[BT_COEX_CORUN_LUT_SIZE];
 
         __le32 valid_bit_msk;
-} __packed; /* BT_COEX_CMD_API_S_VER_3 */
+} __packed; /* BT_COEX_CMD_API_S_VER_5 */
 
 /**
  * struct iwl_bt_coex_ci_cmd - bt coex channel inhibition command
@@ -282,7 +288,7 @@ enum iwl_bt_activity_grading {
         BT_ON_NO_CONNECTION     = 1,
         BT_LOW_TRAFFIC          = 2,
         BT_HIGH_TRAFFIC         = 3,
-};
+}; /* BT_COEX_BT_ACTIVITY_GRADING_API_E_VER_1 */
 
 /**
  * struct iwl_bt_coex_profile_notif - notification about BT coex
@@ -310,7 +316,7 @@ struct iwl_bt_coex_profile_notif {
         __le32 primary_ch_lut;
         __le32 secondary_ch_lut;
         __le32 bt_activity_grading;
-} __packed; /* BT_COEX_PROFILE_NTFY_API_S_VER_2 */
+} __packed; /* BT_COEX_PROFILE_NTFY_API_S_VER_3 */
 
 enum iwl_bt_coex_prio_table_event {
         BT_COEX_PRIO_TBL_EVT_INIT_CALIB1                = 0,
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h
index 10fcc1a79ebd..13696fe419b7 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h
@@ -345,21 +345,6 @@ enum iwl_wowlan_wakeup_reason {
         IWL_WOWLAN_WAKEUP_BY_REM_WAKE_WAKEUP_PACKET             = BIT(12),
 }; /* WOWLAN_WAKE_UP_REASON_API_E_VER_2 */
 
-struct iwl_wowlan_status_v4 {
-        __le64 replay_ctr;
-        __le16 pattern_number;
-        __le16 non_qos_seq_ctr;
-        __le16 qos_seq_ctr[8];
-        __le32 wakeup_reasons;
-        __le32 rekey_status;
-        __le32 num_of_gtk_rekeys;
-        __le32 transmitted_ndps;
-        __le32 received_beacons;
-        __le32 wake_packet_length;
-        __le32 wake_packet_bufsize;
-        u8 wake_packet[]; /* can be truncated from _length to _bufsize */
-} __packed; /* WOWLAN_STATUSES_API_S_VER_4 */
-
 struct iwl_wowlan_gtk_status {
         u8 key_index;
         u8 reserved[3];
@@ -368,7 +353,7 @@ struct iwl_wowlan_gtk_status {
         struct iwl_wowlan_rsc_tsc_params_cmd rsc;
 } __packed;
 
-struct iwl_wowlan_status_v6 {
+struct iwl_wowlan_status {
         struct iwl_wowlan_gtk_status gtk;
         __le64 replay_ctr;
         __le16 pattern_number;
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-rs.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-rs.h
index 39148b5bb332..8bb5b94bf963 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-rs.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-rs.h
@@ -334,7 +334,7 @@ enum {
  */
 struct iwl_lq_cmd {
         u8 sta_id;
-        u8 reserved1;
+        u8 reduced_tpc;
         u16 control;
         /* LINK_QUAL_GENERAL_PARAMS_API_S_VER_1 */
         u8 flags;
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
index d73a89ecd78a..6959fda3fe09 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
@@ -169,8 +169,12 @@ enum iwl_scan_type {
         SCAN_TYPE_DISCOVERY_FORCED      = 6,
 }; /* SCAN_ACTIVITY_TYPE_E_VER_1 */
 
-/* Maximal number of channels to scan */
-#define MAX_NUM_SCAN_CHANNELS 0x24
+/**
+ * Maximal number of channels to scan
+ * it should be equal to:
+ * max(IWL_NUM_CHANNELS, IWL_NUM_CHANNELS_FAMILY_8000)
+ */
+#define MAX_NUM_SCAN_CHANNELS 50
 
 /**
  * struct iwl_scan_cmd - scan request command
@@ -534,13 +538,16 @@ struct iwl_scan_offload_schedule {
  *
  * IWL_SCAN_OFFLOAD_FLAG_PASS_ALL: pass all results - no filtering.
  * IWL_SCAN_OFFLOAD_FLAG_CACHED_CHANNEL: add cached channels to partial scan.
- * IWL_SCAN_OFFLOAD_FLAG_ENERGY_SCAN: use energy based scan before partial scan
- *      on A band.
+ * IWL_SCAN_OFFLOAD_FLAG_EBS_QUICK_MODE: EBS duration is 100mSec - typical
+ *      beacon period. Finding channel activity in this mode is not guaranteed.
+ * IWL_SCAN_OFFLOAD_FLAG_EBS_ACCURATE_MODE: EBS duration is 200mSec.
+ *      Assuming beacon period is 100ms finding channel activity is guaranteed.
  */
 enum iwl_scan_offload_flags {
         IWL_SCAN_OFFLOAD_FLAG_PASS_ALL          = BIT(0),
         IWL_SCAN_OFFLOAD_FLAG_CACHED_CHANNEL    = BIT(2),
-        IWL_SCAN_OFFLOAD_FLAG_ENERGY_SCAN       = BIT(3),
+        IWL_SCAN_OFFLOAD_FLAG_EBS_QUICK_MODE    = BIT(5),
+        IWL_SCAN_OFFLOAD_FLAG_EBS_ACCURATE_MODE = BIT(6),
 };
 
 /**
@@ -563,17 +570,24 @@ enum iwl_scan_offload_compleate_status {
         IWL_SCAN_OFFLOAD_ABORTED        = 2,
 };
 
+enum iwl_scan_ebs_status {
+        IWL_SCAN_EBS_SUCCESS,
+        IWL_SCAN_EBS_FAILED,
+        IWL_SCAN_EBS_CHAN_NOT_FOUND,
+};
+
 /**
  * iwl_scan_offload_complete - SCAN_OFFLOAD_COMPLETE_NTF_API_S_VER_1
  * @last_schedule_line:         last schedule line executed (fast or regular)
  * @last_schedule_iteration:    last scan iteration executed before scan abort
  * @status:                     enum iwl_scan_offload_compleate_status
+ * @ebs_status: last EBS status, see IWL_SCAN_EBS_*
  */
 struct iwl_scan_offload_complete {
         u8 last_schedule_line;
         u8 last_schedule_iteration;
         u8 status;
-        u8 reserved;
+        u8 ebs_status;
 } __packed;
 
 /**
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-sta.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-sta.h
index d63647867262..39cebee8016f 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-sta.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-sta.h
@@ -255,22 +255,19 @@ struct iwl_mvm_keyinfo {
 } __packed;
 
 /**
- * struct iwl_mvm_add_sta_cmd_v5 - Add/modify a station in the fw's sta table.
+ * struct iwl_mvm_add_sta_cmd - Add/modify a station in the fw's sta table.
  * ( REPLY_ADD_STA = 0x18 )
  * @add_modify: 1: modify existing, 0: add new station
- * @unicast_tx_key_id: unicast tx key id. Relevant only when unicast key sent
- * @multicast_tx_key_id: multicast tx key id. Relevant only when multicast key
- *      sent
+ * @awake_acs:
+ * @tid_disable_tx: is tid BIT(tid) enabled for Tx. Clear BIT(x) to enable
+ *      AMPDU for tid x. Set %STA_MODIFY_TID_DISABLE_TX to change this field.
  * @mac_id_n_color: the Mac context this station belongs to
  * @addr[ETH_ALEN]: station's MAC address
  * @sta_id: index of station in uCode's station table
  * @modify_mask: STA_MODIFY_*, selects which parameters to modify vs. leave
  *      alone. 1 - modify, 0 - don't change.
- * @key: look at %iwl_mvm_keyinfo
  * @station_flags: look at %iwl_sta_flags
  * @station_flags_msk: what of %station_flags have changed
- * @tid_disable_tx: is tid BIT(tid) enabled for Tx. Clear BIT(x) to enable
- *      AMPDU for tid x. Set %STA_MODIFY_TID_DISABLE_TX to change this field.
  * @add_immediate_ba_tid: tid for which to add block-ack support (Rx)
  *      Set %STA_MODIFY_ADD_BA_TID to use this field, and also set
  *      add_immediate_ba_ssn.
@@ -294,40 +291,7 @@ struct iwl_mvm_keyinfo {
  * ADD_STA sets up the table entry for one station, either creating a new
  * entry, or modifying a pre-existing one.
  */
-struct iwl_mvm_add_sta_cmd_v5 {
-        u8 add_modify;
-        u8 unicast_tx_key_id;
-        u8 multicast_tx_key_id;
-        u8 reserved1;
-        __le32 mac_id_n_color;
-        u8 addr[ETH_ALEN];
-        __le16 reserved2;
-        u8 sta_id;
-        u8 modify_mask;
-        __le16 reserved3;
-        struct iwl_mvm_keyinfo key;
-        __le32 station_flags;
-        __le32 station_flags_msk;
-        __le16 tid_disable_tx;
-        __le16 reserved4;
-        u8 add_immediate_ba_tid;
-        u8 remove_immediate_ba_tid;
-        __le16 add_immediate_ba_ssn;
-        __le16 sleep_tx_count;
-        __le16 sleep_state_flags;
-        __le16 assoc_id;
-        __le16 beamform_flags;
-        __le32 tfd_queue_msk;
-} __packed; /* ADD_STA_CMD_API_S_VER_5 */
-
-/**
- * struct iwl_mvm_add_sta_cmd_v7 - Add / modify a station
- * VER_7 of this command is quite similar to VER_5 except
- * exclusion of all fields related to the security key installation.
- * It only differs from VER_6 by the "awake_acs" field that is
- * reserved and ignored in VER_6.
- */
-struct iwl_mvm_add_sta_cmd_v7 {
+struct iwl_mvm_add_sta_cmd {
         u8 add_modify;
         u8 awake_acs;
         __le16 tid_disable_tx;
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
index 8e122f3a7a74..6cc5f52b807f 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
@@ -482,7 +482,8 @@ struct iwl_mvm_tx_resp {
         u8 pa_integ_res_b[3];
         u8 pa_integ_res_c[3];
         __le16 measurement_req_id;
-        __le16 reserved;
+        u8 reduced_tpc;
+        u8 reserved;
 
         __le32 tfd_info;
         __le16 seq_ctl;
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api.h b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
index 6e75b52588de..309a9b9a94fe 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
@@ -71,6 +71,7 @@
 #include "fw-api-power.h"
 #include "fw-api-d3.h"
 #include "fw-api-coex.h"
+#include "fw-api-scan.h"
 
 /* maximal number of Tx queues in any platform */
 #define IWL_MVM_MAX_QUEUES      20
@@ -604,52 +605,7 @@ enum {
         TE_V1_NOTIF_INTERNAL_FRAG_END = BIT(7),
 }; /* MAC_EVENT_ACTION_API_E_VER_2 */
 
-
-/**
- * struct iwl_time_event_cmd_api_v1 - configuring Time Events
- * with struct MAC_TIME_EVENT_DATA_API_S_VER_1 (see also
- * with version 2. determined by IWL_UCODE_TLV_FLAGS)
- * ( TIME_EVENT_CMD = 0x29 )
- * @id_and_color: ID and color of the relevant MAC
- * @action: action to perform, one of FW_CTXT_ACTION_*
- * @id: this field has two meanings, depending on the action:
- *      If the action is ADD, then it means the type of event to add.
- *      For all other actions it is the unique event ID assigned when the
- *      event was added by the FW.
- * @apply_time: When to start the Time Event (in GP2)
- * @max_delay: maximum delay to event's start (apply time), in TU
- * @depends_on: the unique ID of the event we depend on (if any)
- * @interval: interval between repetitions, in TU
- * @interval_reciprocal: 2^32 / interval
- * @duration: duration of event in TU
- * @repeat: how many repetitions to do, can be TE_REPEAT_ENDLESS
- * @dep_policy: one of TE_V1_INDEPENDENT, TE_V1_DEP_OTHER, TE_V1_DEP_TSF
- *      and TE_V1_EVENT_SOCIOPATHIC
- * @is_present: 0 or 1, are we present or absent during the Time Event
- * @max_frags: maximal number of fragments the Time Event can be divided to
- * @notify: notifications using TE_V1_NOTIF_* (whom to notify when)
- */
-struct iwl_time_event_cmd_v1 {
-        /* COMMON_INDEX_HDR_API_S_VER_1 */
-        __le32 id_and_color;
-        __le32 action;
-        __le32 id;
-        /* MAC_TIME_EVENT_DATA_API_S_VER_1 */
-        __le32 apply_time;
-        __le32 max_delay;
-        __le32 dep_policy;
-        __le32 depends_on;
-        __le32 is_present;
-        __le32 max_frags;
-        __le32 interval;
-        __le32 interval_reciprocal;
-        __le32 duration;
-        __le32 repeat;
-        __le32 notify;
-} __packed; /* MAC_TIME_EVENT_CMD_API_S_VER_1 */
-
-
-/* Time event - defines for command API v2 */
+/* Time event - defines for command API */
 
 /*
  * @TE_V2_FRAG_NONE: fragmentation of the time event is NOT allowed.
@@ -680,7 +636,7 @@ enum {
 #define TE_V2_PLACEMENT_POS     12
 #define TE_V2_ABSENCE_POS       15
 
-/* Time event policy values (for time event cmd api v2)
+/* Time event policy values
  * A notification (both event and fragment) includes a status indicating weather
  * the FW was able to schedule the event or not. For fragment start/end
  * notification the status is always success. There is no start/end fragment
@@ -727,7 +683,7 @@ enum {
 };
 
 /**
- * struct iwl_time_event_cmd_api_v2 - configuring Time Events
+ * struct iwl_time_event_cmd_api - configuring Time Events
  * with struct MAC_TIME_EVENT_DATA_API_S_VER_2 (see also
  * with version 1. determined by IWL_UCODE_TLV_FLAGS)
  * ( TIME_EVENT_CMD = 0x29 )
@@ -750,7 +706,7 @@ enum {
  *      TE_EVENT_SOCIOPATHIC
  *      using TE_ABSENCE and using TE_NOTIF_*
  */
-struct iwl_time_event_cmd_v2 {
+struct iwl_time_event_cmd {
         /* COMMON_INDEX_HDR_API_S_VER_1 */
         __le32 id_and_color;
         __le32 action;
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw.c b/drivers/net/wireless/iwlwifi/mvm/fw.c
index 7ce20062f32d..883e702152d5 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/iwlwifi/mvm/fw.c
@@ -99,7 +99,7 @@ static int iwl_send_tx_ant_cfg(struct iwl_mvm *mvm, u8 valid_tx_ant)
         };
 
         IWL_DEBUG_FW(mvm, "select valid tx ant: %u\n", valid_tx_ant);
-        return iwl_mvm_send_cmd_pdu(mvm, TX_ANT_CONFIGURATION_CMD, CMD_SYNC,
+        return iwl_mvm_send_cmd_pdu(mvm, TX_ANT_CONFIGURATION_CMD, 0,
                                     sizeof(tx_ant_cmd), &tx_ant_cmd);
 }
 
@@ -137,6 +137,8 @@ static bool iwl_alive_fn(struct iwl_notif_wait_data *notif_wait,
                 alive_data->scd_base_addr = le32_to_cpu(palive2->scd_base_ptr);
                 mvm->umac_error_event_table =
                         le32_to_cpu(palive2->error_info_addr);
+                mvm->sf_space.addr = le32_to_cpu(palive2->st_fwrd_addr);
+                mvm->sf_space.size = le32_to_cpu(palive2->st_fwrd_size);
 
                 alive_data->valid = le16_to_cpu(palive2->status) ==
                                     IWL_ALIVE_STATUS_OK;
@@ -180,6 +182,7 @@ static int iwl_mvm_load_ucode_wait_alive(struct iwl_mvm *mvm,
         int ret, i;
         enum iwl_ucode_type old_type = mvm->cur_ucode;
         static const u8 alive_cmd[] = { MVM_ALIVE };
+        struct iwl_sf_region st_fwrd_space;
 
         fw = iwl_get_ucode_image(mvm, ucode_type);
         if (WARN_ON(!fw))
@@ -215,6 +218,14 @@ static int iwl_mvm_load_ucode_wait_alive(struct iwl_mvm *mvm,
                 return -EIO;
         }
 
+        /*
+         * update the sdio allocation according to the pointer we get in the
+         * alive notification.
+         */
+        st_fwrd_space.addr = mvm->sf_space.addr;
+        st_fwrd_space.size = mvm->sf_space.size;
+        ret = iwl_trans_update_sf(mvm->trans, &st_fwrd_space);
+
         iwl_trans_fw_alive(mvm->trans, alive_data.scd_base_addr);
 
         /*
@@ -256,7 +267,7 @@ static int iwl_send_phy_cfg_cmd(struct iwl_mvm *mvm)
         IWL_DEBUG_INFO(mvm, "Sending Phy CFG command: 0x%x\n",
                        phy_cfg_cmd.phy_cfg);
 
-        return iwl_mvm_send_cmd_pdu(mvm, PHY_CONFIGURATION_CMD, CMD_SYNC,
+        return iwl_mvm_send_cmd_pdu(mvm, PHY_CONFIGURATION_CMD, 0,
                                     sizeof(phy_cfg_cmd), &phy_cfg_cmd);
 }
 
@@ -288,14 +299,14 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
                 goto error;
         }
 
-        ret = iwl_send_bt_prio_tbl(mvm);
+        ret = iwl_send_bt_init_conf(mvm);
         if (ret)
                 goto error;
 
         /* Read the NVM only at driver load time, no need to do this twice */
         if (read_nvm) {
                 /* Read nvm */
-                ret = iwl_nvm_init(mvm);
+                ret = iwl_nvm_init(mvm, true);
                 if (ret) {
                         IWL_ERR(mvm, "Failed to read NVM: %d\n", ret);
                         goto error;
@@ -303,7 +314,7 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
         }
 
         /* In case we read the NVM from external file, load it to the NIC */
-        if (iwlwifi_mod_params.nvm_file)
+        if (mvm->nvm_file_name)
                 iwl_mvm_load_nvm_to_nic(mvm);
 
         ret = iwl_nvm_check_version(mvm->nvm_data, mvm->trans);
@@ -424,10 +435,6 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
         if (ret)
                 goto error;
 
-        ret = iwl_send_bt_prio_tbl(mvm);
-        if (ret)
-                goto error;
-
         ret = iwl_send_bt_init_conf(mvm);
         if (ret)
                 goto error;
@@ -468,12 +475,6 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
         /* Initialize tx backoffs to the minimal possible */
         iwl_mvm_tt_tx_backoff(mvm, 0);
 
-        if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_PM_CMD_SUPPORT)) {
-                ret = iwl_power_legacy_set_cam_mode(mvm);
-                if (ret)
-                        goto error;
-        }
-
         ret = iwl_mvm_power_update_device(mvm);
         if (ret)
                 goto error;
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
index 9ccec10bba16..8b5302777632 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
@@ -667,12 +667,9 @@ static void iwl_mvm_mac_ctxt_cmd_common(struct iwl_mvm *mvm,
         if (vif->bss_conf.qos)
                 cmd->qos_flags |= cpu_to_le32(MAC_QOS_FLG_UPDATE_EDCA);
 
-        /* Don't use cts to self as the fw doesn't support it currently. */
         if (vif->bss_conf.use_cts_prot) {
                 cmd->protection_flags |= cpu_to_le32(MAC_PROT_FLG_TGG_PROTECT);
-                if (IWL_UCODE_API(mvm->fw->ucode_ver) >= 8)
-                        cmd->protection_flags |=
-                                cpu_to_le32(MAC_PROT_FLG_SELF_CTS_EN);
+                cmd->protection_flags |= cpu_to_le32(MAC_PROT_FLG_SELF_CTS_EN);
         }
         IWL_DEBUG_RATE(mvm, "use_cts_prot %d, ht_operation_mode %d\n",
                        vif->bss_conf.use_cts_prot,
@@ -688,7 +685,7 @@ static void iwl_mvm_mac_ctxt_cmd_common(struct iwl_mvm *mvm,
 static int iwl_mvm_mac_ctxt_send_cmd(struct iwl_mvm *mvm,
                                      struct iwl_mac_ctx_cmd *cmd)
 {
-        int ret = iwl_mvm_send_cmd_pdu(mvm, MAC_CONTEXT_CMD, CMD_SYNC,
+        int ret = iwl_mvm_send_cmd_pdu(mvm, MAC_CONTEXT_CMD, 0,
                                        sizeof(*cmd), cmd);
         if (ret)
                 IWL_ERR(mvm, "Failed to send MAC context (action:%d): %d\n",
@@ -696,19 +693,39 @@ static int iwl_mvm_mac_ctxt_send_cmd(struct iwl_mvm *mvm,
         return ret;
 }
 
-/*
- * Fill the specific data for mac context of type station or p2p client
- */
-static void iwl_mvm_mac_ctxt_cmd_fill_sta(struct iwl_mvm *mvm,
-                                          struct ieee80211_vif *vif,
-                                          struct iwl_mac_data_sta *ctxt_sta,
-                                          bool force_assoc_off)
+static int iwl_mvm_mac_ctxt_cmd_sta(struct iwl_mvm *mvm,
+                                    struct ieee80211_vif *vif,
+                                    u32 action, bool force_assoc_off)
 {
+        struct iwl_mac_ctx_cmd cmd = {};
+        struct iwl_mac_data_sta *ctxt_sta;
+
+        WARN_ON(vif->type != NL80211_IFTYPE_STATION);
+
+        /* Fill the common data for all mac context types */
+        iwl_mvm_mac_ctxt_cmd_common(mvm, vif, &cmd, action);
+
+        if (vif->p2p) {
+                struct ieee80211_p2p_noa_attr *noa =
+                        &vif->bss_conf.p2p_noa_attr;
+
+                cmd.p2p_sta.ctwin = cpu_to_le32(noa->oppps_ctwindow &
+                                        IEEE80211_P2P_OPPPS_CTWINDOW_MASK);
+                ctxt_sta = &cmd.p2p_sta.sta;
+        } else {
+                ctxt_sta = &cmd.sta;
+        }
+
         /* We need the dtim_period to set the MAC as associated */
         if (vif->bss_conf.assoc && vif->bss_conf.dtim_period &&
             !force_assoc_off) {
                 u32 dtim_offs;
 
+                /* Allow beacons to pass through as long as we are not
+                 * associated, or we do not have dtim period information.
+                 */
+                cmd.filter_flags |= cpu_to_le32(MAC_FILTER_IN_BEACON);
+
                 /*
                  * The DTIM count counts down, so when it is N that means N
                  * more beacon intervals happen until the DTIM TBTT. Therefore
@@ -755,51 +772,6 @@ static void iwl_mvm_mac_ctxt_cmd_fill_sta(struct iwl_mvm *mvm,
 
         ctxt_sta->listen_interval = cpu_to_le32(mvm->hw->conf.listen_interval);
         ctxt_sta->assoc_id = cpu_to_le32(vif->bss_conf.aid);
-}
-
-static int iwl_mvm_mac_ctxt_cmd_station(struct iwl_mvm *mvm,
-                                        struct ieee80211_vif *vif,
-                                        u32 action)
-{
-        struct iwl_mac_ctx_cmd cmd = {};
-
-        WARN_ON(vif->type != NL80211_IFTYPE_STATION || vif->p2p);
-
-        /* Fill the common data for all mac context types */
-        iwl_mvm_mac_ctxt_cmd_common(mvm, vif, &cmd, action);
-
-        /* Allow beacons to pass through as long as we are not associated,or we
-         * do not have dtim period information */
-        if (!vif->bss_conf.assoc || !vif->bss_conf.dtim_period)
-                cmd.filter_flags |= cpu_to_le32(MAC_FILTER_IN_BEACON);
-        else
-                cmd.filter_flags &= ~cpu_to_le32(MAC_FILTER_IN_BEACON);
-
-        /* Fill the data specific for station mode */
-        iwl_mvm_mac_ctxt_cmd_fill_sta(mvm, vif, &cmd.sta,
-                                      action == FW_CTXT_ACTION_ADD);
-
-        return iwl_mvm_mac_ctxt_send_cmd(mvm, &cmd);
-}
-
-static int iwl_mvm_mac_ctxt_cmd_p2p_client(struct iwl_mvm *mvm,
-                                           struct ieee80211_vif *vif,
-                                           u32 action)
-{
-        struct iwl_mac_ctx_cmd cmd = {};
-        struct ieee80211_p2p_noa_attr *noa = &vif->bss_conf.p2p_noa_attr;
-
-        WARN_ON(vif->type != NL80211_IFTYPE_STATION || !vif->p2p);
-
-        /* Fill the common data for all mac context types */
-        iwl_mvm_mac_ctxt_cmd_common(mvm, vif, &cmd, action);
-
-        /* Fill the data specific for station mode */
-        iwl_mvm_mac_ctxt_cmd_fill_sta(mvm, vif, &cmd.p2p_sta.sta,
-                                      action == FW_CTXT_ACTION_ADD);
-
-        cmd.p2p_sta.ctwin = cpu_to_le32(noa->oppps_ctwindow &
-                                        IEEE80211_P2P_OPPPS_CTWINDOW_MASK);
 
         return iwl_mvm_mac_ctxt_send_cmd(mvm, &cmd);
 }
@@ -1137,16 +1109,12 @@ static int iwl_mvm_mac_ctxt_cmd_go(struct iwl_mvm *mvm,
 }
 
 static int iwl_mvm_mac_ctx_send(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
-                                u32 action)
+                                u32 action, bool force_assoc_off)
 {
         switch (vif->type) {
         case NL80211_IFTYPE_STATION:
-                if (!vif->p2p)
-                        return iwl_mvm_mac_ctxt_cmd_station(mvm, vif,
-                                                            action);
-                else
-                        return iwl_mvm_mac_ctxt_cmd_p2p_client(mvm, vif,
-                                                               action);
+                return iwl_mvm_mac_ctxt_cmd_sta(mvm, vif, action,
+                                                force_assoc_off);
                 break;
         case NL80211_IFTYPE_AP:
                 if (!vif->p2p)
@@ -1176,7 +1144,8 @@ int iwl_mvm_mac_ctxt_add(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                       vif->addr, ieee80211_vif_type_p2p(vif)))
                 return -EIO;
 
-        ret = iwl_mvm_mac_ctx_send(mvm, vif, FW_CTXT_ACTION_ADD);
+        ret = iwl_mvm_mac_ctx_send(mvm, vif, FW_CTXT_ACTION_ADD,
+                                   true);
         if (ret)
                 return ret;
 
@@ -1187,7 +1156,8 @@ int iwl_mvm_mac_ctxt_add(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
         return 0;
 }
 
-int iwl_mvm_mac_ctxt_changed(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
+int iwl_mvm_mac_ctxt_changed(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                             bool force_assoc_off)
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 
@@ -1195,7 +1165,8 @@ int iwl_mvm_mac_ctxt_changed(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                       vif->addr, ieee80211_vif_type_p2p(vif)))
                 return -EIO;
 
-        return iwl_mvm_mac_ctx_send(mvm, vif, FW_CTXT_ACTION_MODIFY);
+        return iwl_mvm_mac_ctx_send(mvm, vif, FW_CTXT_ACTION_MODIFY,
+                                    force_assoc_off);
 }
 
 int iwl_mvm_mac_ctxt_remove(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
@@ -1214,7 +1185,7 @@ int iwl_mvm_mac_ctxt_remove(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                                                            mvmvif->color));
         cmd.action = cpu_to_le32(FW_CTXT_ACTION_REMOVE);
 
-        ret = iwl_mvm_send_cmd_pdu(mvm, MAC_CONTEXT_CMD, CMD_SYNC,
+        ret = iwl_mvm_send_cmd_pdu(mvm, MAC_CONTEXT_CMD, 0,
                                    sizeof(cmd), &cmd);
         if (ret) {
                 IWL_ERR(mvm, "Failed to remove MAC context: %d\n", ret);
@@ -1240,11 +1211,23 @@ int iwl_mvm_rx_beacon_notif(struct iwl_mvm *mvm,
         u32 rate __maybe_unused =
                 le32_to_cpu(beacon->beacon_notify_hdr.initial_rate);
 
+        lockdep_assert_held(&mvm->mutex);
+
         IWL_DEBUG_RX(mvm, "beacon status %#x retries:%d tsf:0x%16llX rate:%d\n",
                      status & TX_STATUS_MSK,
                      beacon->beacon_notify_hdr.failure_frame,
                      le64_to_cpu(beacon->tsf),
                      rate);
+
+        if (unlikely(mvm->csa_vif && mvm->csa_vif->csa_active)) {
+                if (!ieee80211_csa_is_complete(mvm->csa_vif)) {
+                        iwl_mvm_mac_ctxt_beacon_changed(mvm, mvm->csa_vif);
+                } else {
+                        ieee80211_csa_finish(mvm->csa_vif);
+                        mvm->csa_vif = NULL;
+                }
+        }
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 8735ef1f44ae..7215f5980186 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -295,7 +295,9 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
             !iwlwifi_mod_params.sw_crypto)
                 hw->flags |= IEEE80211_HW_MFP_CAPABLE;
 
-        if (0 && mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT) {
+        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT &&
+            IWL_UCODE_API(mvm->fw->ucode_ver) >= 9 &&
+            !iwlwifi_mod_params.uapsd_disable) {
                 hw->flags |= IEEE80211_HW_SUPPORTS_UAPSD;
                 hw->uapsd_queues = IWL_UAPSD_AC_INFO;
                 hw->uapsd_max_sp_len = IWL_UAPSD_MAX_SP;
@@ -309,11 +311,8 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
                 BIT(NL80211_IFTYPE_P2P_CLIENT) |
                 BIT(NL80211_IFTYPE_AP) |
                 BIT(NL80211_IFTYPE_P2P_GO) |
-                BIT(NL80211_IFTYPE_P2P_DEVICE);
-
-        /* IBSS has bugs in older versions */
-        if (IWL_UCODE_API(mvm->fw->ucode_ver) >= 8)
-                hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC);
+                BIT(NL80211_IFTYPE_P2P_DEVICE) |
+                BIT(NL80211_IFTYPE_ADHOC);
 
         hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
         hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG |
@@ -322,6 +321,9 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
         if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_GO_UAPSD)
                 hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
 
+        if (mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_CSA_FLOW)
+                hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
+
         hw->wiphy->iface_combinations = iwl_mvm_iface_combinations;
         hw->wiphy->n_iface_combinations =
                 ARRAY_SIZE(iwl_mvm_iface_combinations);
@@ -365,14 +367,11 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
         else
                 hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
 
-        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_SCHED_SCAN) {
-                hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
-                hw->wiphy->max_sched_scan_ssids = PROBE_OPTION_MAX;
-                hw->wiphy->max_match_sets = IWL_SCAN_MAX_PROFILES;
-                /* we create the 802.11 header and zero length SSID IE. */
-                hw->wiphy->max_sched_scan_ie_len =
-                                        SCAN_OFFLOAD_PROBE_REQ_SIZE - 24 - 2;
-        }
+        hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
+        hw->wiphy->max_sched_scan_ssids = PROBE_OPTION_MAX;
+        hw->wiphy->max_match_sets = IWL_SCAN_MAX_PROFILES;
+        /* we create the 802.11 header and zero length SSID IE. */
+        hw->wiphy->max_sched_scan_ie_len = SCAN_OFFLOAD_PROBE_REQ_SIZE - 24 - 2;
 
         hw->wiphy->features |= NL80211_FEATURE_P2P_GO_CTWIN |
                                NL80211_FEATURE_P2P_GO_OPPPS;
@@ -386,7 +385,11 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
         }
 
 #ifdef CONFIG_PM_SLEEP
-        if (mvm->fw->img[IWL_UCODE_WOWLAN].sec[0].len &&
+        if (iwl_mvm_is_d0i3_supported(mvm) &&
+            device_can_wakeup(mvm->trans->dev)) {
+                mvm->wowlan.flags = WIPHY_WOWLAN_ANY;
+                hw->wiphy->wowlan = &mvm->wowlan;
+        } else if (mvm->fw->img[IWL_UCODE_WOWLAN].sec[0].len &&
             mvm->trans->ops->d3_suspend &&
             mvm->trans->ops->d3_resume &&
             device_can_wakeup(mvm->trans->dev)) {
@@ -540,13 +543,22 @@ static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
                 return -EACCES;
 
         /* return from D0i3 before starting a new Tx aggregation */
-        if (action == IEEE80211_AMPDU_TX_START) {
+        switch (action) {
+        case IEEE80211_AMPDU_TX_START:
+        case IEEE80211_AMPDU_TX_STOP_CONT:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
+        case IEEE80211_AMPDU_TX_OPERATIONAL:
                 iwl_mvm_ref(mvm, IWL_MVM_REF_TX_AGG);
                 tx_agg_ref = true;
 
                 /*
-                 * wait synchronously until D0i3 exit to get the correct
-                 * sequence number for the tid
+                 * for tx start, wait synchronously until D0i3 exit to
+                 * get the correct sequence number for the tid.
+                 * additionally, some other ampdu actions use direct
+                 * target access, which is not handled automatically
+                 * by the trans layer (unlike commands), so wait for
+                 * d0i3 exit in these cases as well.
                  */
                 if (!wait_event_timeout(mvm->d0i3_exit_waitq,
                           !test_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status), HZ)) {
@@ -554,6 +566,9 @@ static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
                         iwl_mvm_unref(mvm, IWL_MVM_REF_TX_AGG);
                         return -EIO;
                 }
+                break;
+        default:
+                break;
         }
 
         mutex_lock(&mvm->mutex);
@@ -758,7 +773,7 @@ static int iwl_mvm_set_tx_power(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                 .pwr_restriction = cpu_to_le16(tx_power),
         };
 
-        return iwl_mvm_send_cmd_pdu(mvm, REDUCE_TX_POWER_CMD, CMD_SYNC,
+        return iwl_mvm_send_cmd_pdu(mvm, REDUCE_TX_POWER_CMD, 0,
                                     sizeof(reduce_txpwr_cmd),
                                     &reduce_txpwr_cmd);
 }
@@ -817,18 +832,17 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
         if (ret)
                 goto out_release;
 
-        ret = iwl_mvm_power_update_mac(mvm, vif);
+        ret = iwl_mvm_power_update_mac(mvm);
         if (ret)
                 goto out_release;
 
         /* beacon filtering */
-        ret = iwl_mvm_disable_beacon_filter(mvm, vif, CMD_SYNC);
+        ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
         if (ret)
                 goto out_remove_mac;
 
-        if (!mvm->bf_allowed_vif && false &&
-            vif->type == NL80211_IFTYPE_STATION && !vif->p2p &&
-            mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_BF_UPDATED){
+        if (!mvm->bf_allowed_vif &&
+            vif->type == NL80211_IFTYPE_STATION && !vif->p2p) {
                 mvm->bf_allowed_vif = mvmvif;
                 vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER |
                                      IEEE80211_VIF_SUPPORTS_CQM_RSSI;
@@ -969,7 +983,7 @@ static void iwl_mvm_mac_remove_interface(struct ieee80211_hw *hw,
         if (mvm->vif_count && vif->type != NL80211_IFTYPE_P2P_DEVICE)
                 mvm->vif_count--;
 
-        iwl_mvm_power_update_mac(mvm, vif);
+        iwl_mvm_power_update_mac(mvm);
         iwl_mvm_mac_ctxt_remove(mvm, vif);
 
 out_release:
@@ -1223,10 +1237,14 @@ static int iwl_mvm_configure_bcast_filter(struct iwl_mvm *mvm,
         if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_BCAST_FILTERING))
                 return 0;
 
+        /* bcast filtering isn't supported for P2P client */
+        if (vif->p2p)
+                return 0;
+
         if (!iwl_mvm_bcast_filter_build_cmd(mvm, &cmd))
                 return 0;
 
-        return iwl_mvm_send_cmd_pdu(mvm, BCAST_FILTER_CMD, CMD_SYNC,
+        return iwl_mvm_send_cmd_pdu(mvm, BCAST_FILTER_CMD, 0,
                                     sizeof(cmd), &cmd);
 }
 #else
@@ -1253,7 +1271,7 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
         if (changes & BSS_CHANGED_ASSOC && bss_conf->assoc)
                 iwl_mvm_mac_ctxt_recalc_tsf_id(mvm, vif);
 
-        ret = iwl_mvm_mac_ctxt_changed(mvm, vif);
+        ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false);
         if (ret)
                 IWL_ERR(mvm, "failed to update MAC %pM\n", vif->addr);
 
@@ -1333,10 +1351,10 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
                 iwl_mvm_remove_time_event(mvm, mvmvif,
                                           &mvmvif->time_event_data);
                 iwl_mvm_sf_update(mvm, vif, false);
-                WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, CMD_SYNC));
+                WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
         } else if (changes & (BSS_CHANGED_PS | BSS_CHANGED_P2P_PS |
                               BSS_CHANGED_QOS)) {
-                ret = iwl_mvm_power_update_mac(mvm, vif);
+                ret = iwl_mvm_power_update_mac(mvm);
                 if (ret)
                         IWL_ERR(mvm, "failed to update power mode\n");
         }
@@ -1347,16 +1365,19 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
         }
 
         if (changes & BSS_CHANGED_CQM) {
-                IWL_DEBUG_MAC80211(mvm, "cqm info_changed");
+                IWL_DEBUG_MAC80211(mvm, "cqm info_changed\n");
                 /* reset cqm events tracking */
                 mvmvif->bf_data.last_cqm_event = 0;
-                ret = iwl_mvm_update_beacon_filter(mvm, vif, false, CMD_SYNC);
-                if (ret)
-                        IWL_ERR(mvm, "failed to update CQM thresholds\n");
+                if (mvmvif->bf_data.bf_enabled) {
+                        ret = iwl_mvm_enable_beacon_filter(mvm, vif, 0);
+                        if (ret)
+                                IWL_ERR(mvm,
+                                        "failed to update CQM thresholds\n");
+                }
         }
 
         if (changes & BSS_CHANGED_ARP_FILTER) {
-                IWL_DEBUG_MAC80211(mvm, "arp filter changed");
+                IWL_DEBUG_MAC80211(mvm, "arp filter changed\n");
                 iwl_mvm_configure_bcast_filter(mvm, vif);
         }
 }
@@ -1402,7 +1423,7 @@ static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
         mvmvif->ap_ibss_active = true;
 
         /* power updated needs to be done before quotas */
-        iwl_mvm_power_update_mac(mvm, vif);
+        iwl_mvm_power_update_mac(mvm);
 
         ret = iwl_mvm_update_quotas(mvm, vif);
         if (ret)
@@ -1410,7 +1431,7 @@ static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
 
         /* Need to update the P2P Device MAC (only GO, IBSS is single vif) */
         if (vif->p2p && mvm->p2p_device_vif)
-                iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif);
+                iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif, false);
 
         iwl_mvm_ref(mvm, IWL_MVM_REF_AP_IBSS);
 
@@ -1420,7 +1441,7 @@ static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
         return 0;
 
 out_quota_failed:
-        iwl_mvm_power_update_mac(mvm, vif);
+        iwl_mvm_power_update_mac(mvm);
         mvmvif->ap_ibss_active = false;
         iwl_mvm_send_rm_bcast_sta(mvm, &mvmvif->bcast_sta);
 out_unbind:
@@ -1450,13 +1471,13 @@ static void iwl_mvm_stop_ap_ibss(struct ieee80211_hw *hw,
 
         /* Need to update the P2P Device MAC (only GO, IBSS is single vif) */
         if (vif->p2p && mvm->p2p_device_vif)
-                iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif);
+                iwl_mvm_mac_ctxt_changed(mvm, mvm->p2p_device_vif, false);
 
         iwl_mvm_update_quotas(mvm, NULL);
         iwl_mvm_send_rm_bcast_sta(mvm, &mvmvif->bcast_sta);
         iwl_mvm_binding_remove_vif(mvm, vif);
 
-        iwl_mvm_power_update_mac(mvm, vif);
+        iwl_mvm_power_update_mac(mvm);
 
         iwl_mvm_mac_ctxt_remove(mvm, vif);
 
@@ -1477,7 +1498,7 @@ iwl_mvm_bss_info_changed_ap_ibss(struct iwl_mvm *mvm,
 
         if (changes & (BSS_CHANGED_ERP_CTS_PROT | BSS_CHANGED_HT |
                        BSS_CHANGED_BANDWIDTH) &&
-            iwl_mvm_mac_ctxt_changed(mvm, vif))
+            iwl_mvm_mac_ctxt_changed(mvm, vif, false))
                 IWL_ERR(mvm, "failed to update MAC %pM\n", vif->addr);
 
         /* Need to send a new beacon template to the FW */
@@ -1495,6 +1516,9 @@ static void iwl_mvm_bss_info_changed(struct ieee80211_hw *hw,
 
         mutex_lock(&mvm->mutex);
 
+        if (changes & BSS_CHANGED_IDLE && !bss_conf->idle)
+                iwl_mvm_sched_scan_stop(mvm, true);
+
         switch (vif->type) {
         case NL80211_IFTYPE_STATION:
                 iwl_mvm_bss_info_changed_station(mvm, vif, bss_conf, changes);
@@ -1525,7 +1549,7 @@ static int iwl_mvm_mac_hw_scan(struct ieee80211_hw *hw,
 
         switch (mvm->scan_status) {
         case IWL_MVM_SCAN_SCHED:
-                ret = iwl_mvm_sched_scan_stop(mvm);
+                ret = iwl_mvm_sched_scan_stop(mvm, true);
                 if (ret) {
                         ret = -EBUSY;
                         goto out;
@@ -1697,6 +1721,11 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
                 ret = iwl_mvm_add_sta(mvm, vif, sta);
         } else if (old_state == IEEE80211_STA_NONE &&
                    new_state == IEEE80211_STA_AUTH) {
+                /*
+                 * EBS may be disabled due to previous failures reported by FW.
+                 * Reset EBS status here assuming environment has been changed.
+                 */
+                mvm->last_ebs_successful = true;
                 ret = 0;
         } else if (old_state == IEEE80211_STA_AUTH &&
                    new_state == IEEE80211_STA_ASSOC) {
@@ -1708,14 +1737,12 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
         } else if (old_state == IEEE80211_STA_ASSOC &&
                    new_state == IEEE80211_STA_AUTHORIZED) {
                 /* enable beacon filtering */
-                if (vif->bss_conf.dtim_period)
-                        WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif,
-                                                             CMD_SYNC));
+                WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
                 ret = 0;
         } else if (old_state == IEEE80211_STA_AUTHORIZED &&
                    new_state == IEEE80211_STA_ASSOC) {
                 /* disable beacon filtering */
-                WARN_ON(iwl_mvm_disable_beacon_filter(mvm, vif, CMD_SYNC));
+                WARN_ON(iwl_mvm_disable_beacon_filter(mvm, vif, 0));
                 ret = 0;
         } else if (old_state == IEEE80211_STA_ASSOC &&
                    new_state == IEEE80211_STA_AUTH) {
@@ -1772,7 +1799,7 @@ static int iwl_mvm_mac_conf_tx(struct ieee80211_hw *hw,
                 int ret;
 
                 mutex_lock(&mvm->mutex);
-                ret = iwl_mvm_mac_ctxt_changed(mvm, vif);
+                ret = iwl_mvm_mac_ctxt_changed(mvm, vif, false);
                 mutex_unlock(&mvm->mutex);
                 return ret;
         }
@@ -1865,7 +1892,7 @@ static int iwl_mvm_mac_sched_scan_stop(struct ieee80211_hw *hw,
         int ret;
 
         mutex_lock(&mvm->mutex);
-        ret = iwl_mvm_sched_scan_stop(mvm);
+        ret = iwl_mvm_sched_scan_stop(mvm, false);
         mutex_unlock(&mvm->mutex);
         iwl_mvm_wait_for_async_handlers(mvm);
 
@@ -2161,10 +2188,10 @@ static void iwl_mvm_change_chanctx(struct ieee80211_hw *hw,
                 return;
 
         mutex_lock(&mvm->mutex);
+        iwl_mvm_bt_coex_vif_change(mvm);
         iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &ctx->min_def,
                                  ctx->rx_chains_static,
                                  ctx->rx_chains_dynamic);
-        iwl_mvm_bt_coex_vif_change(mvm);
         mutex_unlock(&mvm->mutex);
 }
 
@@ -2184,6 +2211,11 @@ static int iwl_mvm_assign_vif_chanctx(struct ieee80211_hw *hw,
 
         switch (vif->type) {
         case NL80211_IFTYPE_AP:
+                /* Unless it's a CSA flow we have nothing to do here */
+                if (vif->csa_active) {
+                        mvmvif->ap_ibss_active = true;
+                        break;
+                }
         case NL80211_IFTYPE_ADHOC:
                 /*
                  * The AP binding flow is handled as part of the start_ap flow
@@ -2207,7 +2239,7 @@ static int iwl_mvm_assign_vif_chanctx(struct ieee80211_hw *hw,
          * Power state must be updated before quotas,
          * otherwise fw will complain.
          */
-        iwl_mvm_power_update_mac(mvm, vif);
+        iwl_mvm_power_update_mac(mvm);
 
         /* Setting the quota at this stage is only required for monitor
          * interfaces. For the other types, the bss_info changed flow
@@ -2220,11 +2252,17 @@ static int iwl_mvm_assign_vif_chanctx(struct ieee80211_hw *hw,
                         goto out_remove_binding;
         }
 
+        /* Handle binding during CSA */
+        if (vif->type == NL80211_IFTYPE_AP) {
+                iwl_mvm_update_quotas(mvm, vif);
+                iwl_mvm_mac_ctxt_changed(mvm, vif, false);
+        }
+
         goto out_unlock;
 
  out_remove_binding:
         iwl_mvm_binding_remove_vif(mvm, vif);
-        iwl_mvm_power_update_mac(mvm, vif);
+        iwl_mvm_power_update_mac(mvm);
  out_unlock:
         mutex_unlock(&mvm->mutex);
         if (ret)
@@ -2244,22 +2282,29 @@ static void iwl_mvm_unassign_vif_chanctx(struct ieee80211_hw *hw,
         iwl_mvm_remove_time_event(mvm, mvmvif, &mvmvif->time_event_data);
 
         switch (vif->type) {
-        case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_ADHOC:
                 goto out_unlock;
         case NL80211_IFTYPE_MONITOR:
                 mvmvif->monitor_active = false;
                 iwl_mvm_update_quotas(mvm, NULL);
                 break;
+        case NL80211_IFTYPE_AP:
+                /* This part is triggered only during CSA */
+                if (!vif->csa_active || !mvmvif->ap_ibss_active)
+                        goto out_unlock;
+
+                mvmvif->ap_ibss_active = false;
+                iwl_mvm_update_quotas(mvm, NULL);
+                /*TODO: bt_coex notification here? */
         default:
                 break;
         }
 
         iwl_mvm_binding_remove_vif(mvm, vif);
-        iwl_mvm_power_update_mac(mvm, vif);
 
 out_unlock:
         mvmvif->phy_ctxt = NULL;
+        iwl_mvm_power_update_mac(mvm);
         mutex_unlock(&mvm->mutex);
 }
 
@@ -2323,9 +2368,8 @@ static int __iwl_mvm_mac_testmode_cmd(struct iwl_mvm *mvm,
                         return -EINVAL;
 
                 if (nla_get_u32(tb[IWL_MVM_TM_ATTR_BEACON_FILTER_STATE]))
-                        return iwl_mvm_enable_beacon_filter(mvm, vif,
-                                                            CMD_SYNC);
-                return iwl_mvm_disable_beacon_filter(mvm, vif, CMD_SYNC);
+                        return iwl_mvm_enable_beacon_filter(mvm, vif, 0);
+                return iwl_mvm_disable_beacon_filter(mvm, vif, 0);
         }
 
         return -EOPNOTSUPP;
@@ -2346,6 +2390,53 @@ static int iwl_mvm_mac_testmode_cmd(struct ieee80211_hw *hw,
 }
 #endif
 
+static void iwl_mvm_channel_switch_beacon(struct ieee80211_hw *hw,
+                                          struct ieee80211_vif *vif,
+                                          struct cfg80211_chan_def *chandef)
+{
+        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+
+        mutex_lock(&mvm->mutex);
+        if (WARN(mvm->csa_vif && mvm->csa_vif->csa_active,
+                 "Another CSA is already in progress"))
+                goto out_unlock;
+
+        IWL_DEBUG_MAC80211(mvm, "CSA started to freq %d\n",
+                           chandef->center_freq1);
+        mvm->csa_vif = vif;
+
+out_unlock:
+        mutex_unlock(&mvm->mutex);
+}
+
+static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif, u32 queues, bool drop)
+{
+        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+        struct iwl_mvm_vif *mvmvif;
+        struct iwl_mvm_sta *mvmsta;
+
+        if (!vif || vif->type != NL80211_IFTYPE_STATION)
+                return;
+
+        mutex_lock(&mvm->mutex);
+        mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        mvmsta = iwl_mvm_sta_from_staid_protected(mvm, mvmvif->ap_sta_id);
+
+        if (WARN_ON_ONCE(!mvmsta))
+                goto done;
+
+        if (drop) {
+                if (iwl_mvm_flush_tx_path(mvm, mvmsta->tfd_queue_msk, true))
+                        IWL_ERR(mvm, "flush request fail\n");
+        } else {
+                iwl_trans_wait_tx_queue_empty(mvm->trans,
+                                              mvmsta->tfd_queue_msk);
+        }
+done:
+        mutex_unlock(&mvm->mutex);
+}
+
 const struct ieee80211_ops iwl_mvm_hw_ops = {
         .tx = iwl_mvm_mac_tx,
         .ampdu_action = iwl_mvm_mac_ampdu_action,
@@ -2369,6 +2460,7 @@ const struct ieee80211_ops iwl_mvm_hw_ops = {
         .sta_rc_update = iwl_mvm_sta_rc_update,
         .conf_tx = iwl_mvm_mac_conf_tx,
         .mgd_prepare_tx = iwl_mvm_mac_mgd_prepare_tx,
+        .flush = iwl_mvm_mac_flush,
         .sched_scan_start = iwl_mvm_mac_sched_scan_start,
         .sched_scan_stop = iwl_mvm_mac_sched_scan_stop,
         .set_key = iwl_mvm_mac_set_key,
@@ -2388,6 +2480,8 @@ const struct ieee80211_ops iwl_mvm_hw_ops = {
 
         .set_tim = iwl_mvm_set_tim,
 
+        .channel_switch_beacon = iwl_mvm_channel_switch_beacon,
+
         CFG80211_TESTMODE_CMD(iwl_mvm_mac_testmode_cmd)
 
 #ifdef CONFIG_PM_SLEEP
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index f1ec0986c3c9..fcc6c29482d0 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -164,7 +164,6 @@ enum iwl_dbgfs_pm_mask {
         MVM_DEBUGFS_PM_SKIP_DTIM_PERIODS = BIT(2),
         MVM_DEBUGFS_PM_RX_DATA_TIMEOUT = BIT(3),
         MVM_DEBUGFS_PM_TX_DATA_TIMEOUT = BIT(4),
-        MVM_DEBUGFS_PM_DISABLE_POWER_OFF = BIT(5),
         MVM_DEBUGFS_PM_LPRX_ENA = BIT(6),
         MVM_DEBUGFS_PM_LPRX_RSSI_THRESHOLD = BIT(7),
         MVM_DEBUGFS_PM_SNOOZE_ENABLE = BIT(8),
@@ -177,7 +176,6 @@ struct iwl_dbgfs_pm {
         u32 tx_data_timeout;
         bool skip_over_dtim;
         u8 skip_dtim_periods;
-        bool disable_power_off;
         bool lprx_ena;
         u32 lprx_rssi_threshold;
         bool snooze_ena;
@@ -232,6 +230,7 @@ enum iwl_mvm_ref_type {
         IWL_MVM_REF_USER,
         IWL_MVM_REF_TX,
         IWL_MVM_REF_TX_AGG,
+        IWL_MVM_REF_EXIT_WORK,
 
         IWL_MVM_REF_COUNT,
 };
@@ -265,6 +264,7 @@ struct iwl_mvm_vif_bf_data {
  * @uploaded: indicates the MAC context has been added to the device
  * @ap_ibss_active: indicates that AP/IBSS is configured and that the interface
  *      should get quota etc.
+ * @pm_enabled - Indicate if MAC power management is allowed
  * @monitor_active: indicates that monitor context is configured, and that the
  *      interface should get quota etc.
  * @low_latency: indicates that this interface is in low-latency mode
@@ -283,6 +283,7 @@ struct iwl_mvm_vif {
 
         bool uploaded;
         bool ap_ibss_active;
+        bool pm_enabled;
         bool monitor_active;
         bool low_latency;
         struct iwl_mvm_vif_bf_data bf_data;
@@ -451,6 +452,11 @@ struct iwl_mvm_frame_stats {
         int last_frame_idx;
 };
 
+enum {
+        D0I3_DEFER_WAKEUP,
+        D0I3_PENDING_WAKEUP,
+};
+
 struct iwl_mvm {
         /* for logger access */
         struct device *dev;
@@ -484,6 +490,7 @@ struct iwl_mvm {
         u32 log_event_table;
         u32 umac_error_event_table;
         bool support_umac_log;
+        struct iwl_sf_region sf_space;
 
         u32 ampdu_ref;
 
@@ -495,6 +502,7 @@ struct iwl_mvm {
         u8 queue_to_mac80211[IWL_MAX_HW_QUEUES];
         atomic_t queue_stop_count[IWL_MAX_HW_QUEUES];
 
+        const char *nvm_file_name;
         struct iwl_nvm_data *nvm_data;
         /* NVM sections */
         struct iwl_nvm_section nvm_sections[NVM_MAX_NUM_SECTIONS];
@@ -535,6 +543,8 @@ struct iwl_mvm {
         /* Internal station */
         struct iwl_mvm_int_sta aux_sta;
 
+        bool last_ebs_successful;
+
         u8 scan_last_antenna_idx; /* to toggle TX between antennas */
         u8 mgmt_last_antenna_idx;
 
@@ -578,8 +588,12 @@ struct iwl_mvm {
         void *fw_error_dump;
         void *fw_error_sram;
         u32 fw_error_sram_len;
+        u32 *fw_error_rxf;
+        u32 fw_error_rxf_len;
 
+#ifdef CONFIG_IWLWIFI_LEDS
         struct led_classdev led;
+#endif
 
         struct ieee80211_vif *p2p_device_vif;
 
@@ -601,6 +615,9 @@ struct iwl_mvm {
         bool d0i3_offloading;
         struct work_struct d0i3_exit_work;
         struct sk_buff_head d0i3_tx;
+        /* protect d0i3_suspend_flags */
+        struct mutex d0i3_suspend_mutex;
+        unsigned long d0i3_suspend_flags;
         /* sync d0i3_tx queue and IWL_MVM_STATUS_IN_D0I3 status flag */
         spinlock_t d0i3_tx_lock;
         wait_queue_head_t d0i3_exit_waitq;
@@ -629,8 +646,8 @@ struct iwl_mvm {
 
         /* Indicate if device power save is allowed */
         bool ps_disabled;
-        /* Indicate if device power management is allowed */
-        bool pm_disabled;
+
+        struct ieee80211_vif *csa_vif;
 };
 
 /* Extract MVM priv from op_mode and _hw */
@@ -705,6 +722,7 @@ void iwl_mvm_dump_nic_error_log(struct iwl_mvm *mvm);
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm);
 void iwl_mvm_fw_error_sram_dump(struct iwl_mvm *mvm);
+void iwl_mvm_fw_error_rxf_dump(struct iwl_mvm *mvm);
 #endif
 u8 first_antenna(u8 mask);
 u8 iwl_mvm_next_antenna(struct iwl_mvm *mvm, u8 valid, u8 last_idx);
@@ -745,7 +763,7 @@ int iwl_mvm_rx_statistics(struct iwl_mvm *mvm,
                           struct iwl_device_cmd *cmd);
 
 /* NVM */
-int iwl_nvm_init(struct iwl_mvm *mvm);
+int iwl_nvm_init(struct iwl_mvm *mvm, bool read_nvm_from_nic);
 int iwl_mvm_load_nvm_to_nic(struct iwl_mvm *mvm);
 
 int iwl_mvm_up(struct iwl_mvm *mvm);
@@ -796,7 +814,8 @@ void iwl_mvm_phy_ctxt_unref(struct iwl_mvm *mvm,
 int iwl_mvm_mac_ctxt_init(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
 void iwl_mvm_mac_ctxt_release(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
 int iwl_mvm_mac_ctxt_add(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
-int iwl_mvm_mac_ctxt_changed(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
+int iwl_mvm_mac_ctxt_changed(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                             bool force_assoc_off);
 int iwl_mvm_mac_ctxt_remove(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
 u32 iwl_mvm_mac_get_queues_mask(struct iwl_mvm *mvm,
                                 struct ieee80211_vif *vif);
@@ -840,7 +859,7 @@ int iwl_mvm_config_sched_scan_profiles(struct iwl_mvm *mvm,
                                        struct cfg80211_sched_scan_request *req);
 int iwl_mvm_sched_scan_start(struct iwl_mvm *mvm,
                              struct cfg80211_sched_scan_request *req);
-int iwl_mvm_sched_scan_stop(struct iwl_mvm *mvm);
+int iwl_mvm_sched_scan_stop(struct iwl_mvm *mvm, bool notify);
 int iwl_mvm_rx_sched_scan_results(struct iwl_mvm *mvm,
                                   struct iwl_rx_cmd_buffer *rxb,
                                   struct iwl_device_cmd *cmd);
@@ -874,10 +893,8 @@ void iwl_mvm_update_frame_stats(struct iwl_mvm *mvm,
 int rs_pretty_print_rate(char *buf, const u32 rate);
 
 /* power management */
-int iwl_power_legacy_set_cam_mode(struct iwl_mvm *mvm);
-
 int iwl_mvm_power_update_device(struct iwl_mvm *mvm);
-int iwl_mvm_power_update_mac(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
+int iwl_mvm_power_update_mac(struct iwl_mvm *mvm);
 int iwl_mvm_power_mac_dbgfs_read(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                                  char *buf, int bufsz);
 
@@ -886,8 +903,18 @@ int iwl_mvm_power_uapsd_misbehaving_ap_notif(struct iwl_mvm *mvm,
                                              struct iwl_rx_cmd_buffer *rxb,
                                              struct iwl_device_cmd *cmd);
 
+#ifdef CONFIG_IWLWIFI_LEDS
 int iwl_mvm_leds_init(struct iwl_mvm *mvm);
 void iwl_mvm_leds_exit(struct iwl_mvm *mvm);
+#else
+static inline int iwl_mvm_leds_init(struct iwl_mvm *mvm)
+{
+        return 0;
+}
+static inline void iwl_mvm_leds_exit(struct iwl_mvm *mvm)
+{
+}
+#endif
 
 /* D3 (WoWLAN, NetDetect) */
 int iwl_mvm_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan);
@@ -922,9 +949,9 @@ int iwl_mvm_send_proto_offload(struct iwl_mvm *mvm,
 void iwl_mvm_ref(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type);
 void iwl_mvm_unref(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type);
 void iwl_mvm_d0i3_enable_tx(struct iwl_mvm *mvm, __le16 *qos_seq);
+int _iwl_mvm_exit_d0i3(struct iwl_mvm *mvm);
 
 /* BT Coex */
-int iwl_send_bt_prio_tbl(struct iwl_mvm *mvm);
 int iwl_send_bt_init_conf(struct iwl_mvm *mvm);
 int iwl_mvm_rx_bt_coex_notif(struct iwl_mvm *mvm,
                              struct iwl_rx_cmd_buffer *rxb,
@@ -936,9 +963,10 @@ u16 iwl_mvm_coex_agg_time_limit(struct iwl_mvm *mvm,
                                 struct ieee80211_sta *sta);
 bool iwl_mvm_bt_coex_is_mimo_allowed(struct iwl_mvm *mvm,
                                      struct ieee80211_sta *sta);
+bool iwl_mvm_bt_coex_is_tpc_allowed(struct iwl_mvm *mvm,
+                                    enum ieee80211_band band);
 u8 iwl_mvm_bt_coex_tx_prio(struct iwl_mvm *mvm, struct ieee80211_hdr *hdr,
                            struct ieee80211_tx_info *info, u8 ac);
-int iwl_mvm_bt_coex_reduced_txp(struct iwl_mvm *mvm, u8 sta_id, bool enable);
 
 enum iwl_bt_kill_msk {
         BT_KILL_MSK_DEFAULT,
@@ -969,17 +997,11 @@ int iwl_mvm_enable_beacon_filter(struct iwl_mvm *mvm,
 int iwl_mvm_disable_beacon_filter(struct iwl_mvm *mvm,
                                   struct ieee80211_vif *vif,
                                   u32 flags);
-int iwl_mvm_update_beacon_abort(struct iwl_mvm *mvm,
-                                struct ieee80211_vif *vif, bool enable);
-int iwl_mvm_update_beacon_filter(struct iwl_mvm *mvm,
-                                 struct ieee80211_vif *vif,
-                                 bool force,
-                                 u32 flags);
-
 /* SMPS */
 void iwl_mvm_update_smps(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                                 enum iwl_mvm_smps_type_request req_type,
                                 enum ieee80211_smps_mode smps_request);
+bool iwl_mvm_rx_diversity_allowed(struct iwl_mvm *mvm);
 
 /* Low latency */
 int iwl_mvm_update_low_latency(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
diff --git a/drivers/net/wireless/iwlwifi/mvm/nvm.c b/drivers/net/wireless/iwlwifi/mvm/nvm.c
index cf2d09f53782..808f78f6fbf9 100644
--- a/drivers/net/wireless/iwlwifi/mvm/nvm.c
+++ b/drivers/net/wireless/iwlwifi/mvm/nvm.c
@@ -74,6 +74,12 @@
 #define NVM_WRITE_OPCODE 1
 #define NVM_READ_OPCODE 0
 
+/* load nvm chunk response */
+enum {
+        READ_NVM_CHUNK_SUCCEED = 0,
+        READ_NVM_CHUNK_NOT_VALID_ADDRESS = 1
+};
+
 /*
  * prepare the NVM host command w/ the pointers to the nvm buffer
  * and send it to fw
@@ -90,7 +96,7 @@ static int iwl_nvm_write_chunk(struct iwl_mvm *mvm, u16 section,
         struct iwl_host_cmd cmd = {
                 .id = NVM_ACCESS_CMD,
                 .len = { sizeof(struct iwl_nvm_access_cmd), length },
-                .flags = CMD_SYNC | CMD_SEND_IN_RFKILL,
+                .flags = CMD_SEND_IN_RFKILL,
                 .data = { &nvm_access_cmd, data },
                 /* data may come from vmalloc, so use _DUP */
                 .dataflags = { 0, IWL_HCMD_DFL_DUP },
@@ -112,7 +118,7 @@ static int iwl_nvm_read_chunk(struct iwl_mvm *mvm, u16 section,
         struct iwl_rx_packet *pkt;
         struct iwl_host_cmd cmd = {
                 .id = NVM_ACCESS_CMD,
-                .flags = CMD_SYNC | CMD_WANT_SKB | CMD_SEND_IN_RFKILL,
+                .flags = CMD_WANT_SKB | CMD_SEND_IN_RFKILL,
                 .data = { &nvm_access_cmd, },
         };
         int ret, bytes_read, offset_read;
@@ -139,10 +145,26 @@ static int iwl_nvm_read_chunk(struct iwl_mvm *mvm, u16 section,
         offset_read = le16_to_cpu(nvm_resp->offset);
         resp_data = nvm_resp->data;
         if (ret) {
-                IWL_ERR(mvm,
-                        "NVM access command failed with status %d (device: %s)\n",
-                        ret, mvm->cfg->name);
-                ret = -EINVAL;
+                if ((offset != 0) &&
+                    (ret == READ_NVM_CHUNK_NOT_VALID_ADDRESS)) {
+                        /*
+                         * meaning of NOT_VALID_ADDRESS:
+                         * driver try to read chunk from address that is
+                         * multiple of 2K and got an error since addr is empty.
+                         * meaning of (offset != 0): driver already
+                         * read valid data from another chunk so this case
+                         * is not an error.
+                         */
+                        IWL_DEBUG_EEPROM(mvm->trans->dev,
+                                         "NVM access command failed on offset 0x%x since that section size is multiple 2K\n",
+                                         offset);
+                        ret = 0;
+                } else {
+                        IWL_DEBUG_EEPROM(mvm->trans->dev,
+                                         "NVM access command failed with status %d (device: %s)\n",
+                                         ret, mvm->cfg->name);
+                        ret = -EIO;
+                }
                 goto exit;
         }
 
@@ -211,9 +233,9 @@ static int iwl_nvm_read_section(struct iwl_mvm *mvm, u16 section,
         while (ret == length) {
                 ret = iwl_nvm_read_chunk(mvm, section, offset, length, data);
                 if (ret < 0) {
-                        IWL_ERR(mvm,
-                                "Cannot read NVM from section %d offset %d, length %d\n",
-                                section, offset, length);
+                        IWL_DEBUG_EEPROM(mvm->trans->dev,
+                                         "Cannot read NVM from section %d offset %d, length %d\n",
+                                         section, offset, length);
                         return ret;
                 }
                 offset += ret;
@@ -238,13 +260,20 @@ iwl_parse_nvm_sections(struct iwl_mvm *mvm)
                         return NULL;
                 }
         } else {
+                /* SW and REGULATORY sections are mandatory */
                 if (!mvm->nvm_sections[NVM_SECTION_TYPE_SW].data ||
-                    !mvm->nvm_sections[NVM_SECTION_TYPE_MAC_OVERRIDE].data ||
                     !mvm->nvm_sections[NVM_SECTION_TYPE_REGULATORY].data) {
                         IWL_ERR(mvm,
                                 "Can't parse empty family 8000 NVM sections\n");
                         return NULL;
                 }
+                /* MAC_OVERRIDE or at least HW section must exist */
+                if (!mvm->nvm_sections[mvm->cfg->nvm_hw_section_num].data &&
+                    !mvm->nvm_sections[NVM_SECTION_TYPE_MAC_OVERRIDE].data) {
+                        IWL_ERR(mvm,
+                                "Can't parse mac_address, empty sections\n");
+                        return NULL;
+                }
         }
 
         if (WARN_ON(!mvm->cfg))
@@ -311,16 +340,16 @@ static int iwl_mvm_read_external_nvm(struct iwl_mvm *mvm)
          * get here after that we assume the NVM request can be satisfied
          * synchronously.
          */
-        ret = request_firmware(&fw_entry, iwlwifi_mod_params.nvm_file,
+        ret = request_firmware(&fw_entry, mvm->nvm_file_name,
                                mvm->trans->dev);
         if (ret) {
                 IWL_ERR(mvm, "ERROR: %s isn't available %d\n",
-                        iwlwifi_mod_params.nvm_file, ret);
+                        mvm->nvm_file_name, ret);
                 return ret;
         }
 
         IWL_INFO(mvm, "Loaded NVM file %s (%zu bytes)\n",
-                 iwlwifi_mod_params.nvm_file, fw_entry->size);
+                 mvm->nvm_file_name, fw_entry->size);
 
         if (fw_entry->size < sizeof(*file_sec)) {
                 IWL_ERR(mvm, "NVM file too small\n");
@@ -427,53 +456,28 @@ int iwl_mvm_load_nvm_to_nic(struct iwl_mvm *mvm)
         return ret;
 }
 
-int iwl_nvm_init(struct iwl_mvm *mvm)
+int iwl_nvm_init(struct iwl_mvm *mvm, bool read_nvm_from_nic)
 {
-        int ret, i, section;
+        int ret, section;
         u8 *nvm_buffer, *temp;
-        int nvm_to_read[NVM_MAX_NUM_SECTIONS];
-        int num_of_sections_to_read;
 
         if (WARN_ON_ONCE(mvm->cfg->nvm_hw_section_num >= NVM_MAX_NUM_SECTIONS))
                 return -EINVAL;
 
-        /* load external NVM if configured */
-        if (iwlwifi_mod_params.nvm_file) {
-                /* move to External NVM flow */
-                ret = iwl_mvm_read_external_nvm(mvm);
-                if (ret)
-                        return ret;
-        } else {
-                /* list of NVM sections we are allowed/need to read */
-                if (mvm->trans->cfg->device_family != IWL_DEVICE_FAMILY_8000) {
-                        nvm_to_read[0] = mvm->cfg->nvm_hw_section_num;
-                        nvm_to_read[1] = NVM_SECTION_TYPE_SW;
-                        nvm_to_read[2] = NVM_SECTION_TYPE_CALIBRATION;
-                        nvm_to_read[3] = NVM_SECTION_TYPE_PRODUCTION;
-                        num_of_sections_to_read = 4;
-                } else {
-                        nvm_to_read[0] = NVM_SECTION_TYPE_SW;
-                        nvm_to_read[1] = NVM_SECTION_TYPE_CALIBRATION;
-                        nvm_to_read[2] = NVM_SECTION_TYPE_PRODUCTION;
-                        nvm_to_read[3] = NVM_SECTION_TYPE_REGULATORY;
-                        nvm_to_read[4] = NVM_SECTION_TYPE_MAC_OVERRIDE;
-                        num_of_sections_to_read = 5;
-                }
-
+        /* load NVM values from nic */
+        if (read_nvm_from_nic) {
                 /* Read From FW NVM */
                 IWL_DEBUG_EEPROM(mvm->trans->dev, "Read from NVM\n");
 
-                /* TODO: find correct NVM max size for a section */
                 nvm_buffer = kmalloc(mvm->cfg->base_params->eeprom_size,
                                      GFP_KERNEL);
                 if (!nvm_buffer)
                         return -ENOMEM;
-                for (i = 0; i < num_of_sections_to_read; i++) {
-                        section = nvm_to_read[i];
+                for (section = 0; section < NVM_MAX_NUM_SECTIONS; section++) {
                         /* we override the constness for initial read */
                         ret = iwl_nvm_read_section(mvm, section, nvm_buffer);
                         if (ret < 0)
-                                break;
+                                continue;
                         temp = kmemdup(nvm_buffer, ret, GFP_KERNEL);
                         if (!temp) {
                                 ret = -ENOMEM;
@@ -502,15 +506,21 @@ int iwl_nvm_init(struct iwl_mvm *mvm)
                                         mvm->nvm_hw_blob.size = ret;
                                         break;
                                 }
-                                WARN(1, "section: %d", section);
                         }
 #endif
                 }
                 kfree(nvm_buffer);
-                if (ret < 0)
+        }
+
+        /* load external NVM if configured */
+        if (mvm->nvm_file_name) {
+                /* move to External NVM flow */
+                ret = iwl_mvm_read_external_nvm(mvm);
+                if (ret)
                         return ret;
         }
 
+        /* parse the relevant nvm sections */
         mvm->nvm_data = iwl_parse_nvm_sections(mvm);
         if (!mvm->nvm_data)
                 return -ENODATA;
diff --git a/drivers/net/wireless/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwlwifi/mvm/ops.c
index 9545d7fdd4bf..cc2f7de396de 100644
--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
@@ -79,8 +79,8 @@
 #include "iwl-prph.h"
 #include "rs.h"
 #include "fw-api-scan.h"
-#include "fw-error-dump.h"
 #include "time-event.h"
+#include "iwl-fw-error-dump.h"
 
 /*
  * module name, copyright, version, etc.
@@ -220,7 +220,7 @@ static const struct iwl_rx_handlers iwl_mvm_rx_handlers[] = {
         RX_HANDLER(BA_NOTIF, iwl_mvm_rx_ba_notif, false),
 
         RX_HANDLER(BT_PROFILE_NOTIFICATION, iwl_mvm_rx_bt_coex_notif, true),
-        RX_HANDLER(BEACON_NOTIFICATION, iwl_mvm_rx_beacon_notif, false),
+        RX_HANDLER(BEACON_NOTIFICATION, iwl_mvm_rx_beacon_notif, true),
         RX_HANDLER(STATISTICS_NOTIFICATION, iwl_mvm_rx_statistics, true),
         RX_HANDLER(ANTENNA_COUPLING_NOTIFICATION,
                    iwl_mvm_rx_ant_coupling_notif, true),
@@ -402,6 +402,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         mvm->sf_state = SF_UNINIT;
 
         mutex_init(&mvm->mutex);
+        mutex_init(&mvm->d0i3_suspend_mutex);
         spin_lock_init(&mvm->async_handlers_lock);
         INIT_LIST_HEAD(&mvm->time_event_list);
         INIT_LIST_HEAD(&mvm->async_handlers_list);
@@ -465,13 +466,24 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
 
         min_backoff = calc_min_backoff(trans, cfg);
         iwl_mvm_tt_initialize(mvm, min_backoff);
+        /* set the nvm_file_name according to priority */
+        if (iwlwifi_mod_params.nvm_file)
+                mvm->nvm_file_name = iwlwifi_mod_params.nvm_file;
+        else
+                mvm->nvm_file_name = mvm->cfg->default_nvm_file;
+
+        if (WARN(cfg->no_power_up_nic_in_init && !mvm->nvm_file_name,
+                 "not allowing power-up and not having nvm_file\n"))
+                goto out_free;
 
         /*
-         * If the NVM exists in an external file,
-         * there is no need to unnecessarily power up the NIC at driver load
+         * Even if nvm exists in the nvm_file driver should read agin the nvm
+         * from the nic because there might be entries that exist in the OTP
+         * and not in the file.
+         * for nics with no_power_up_nic_in_init: rely completley on nvm_file
          */
-        if (iwlwifi_mod_params.nvm_file) {
-                err = iwl_nvm_init(mvm);
+        if (cfg->no_power_up_nic_in_init && mvm->nvm_file_name) {
+                err = iwl_nvm_init(mvm, false);
                 if (err)
                         goto out_free;
         } else {
@@ -518,7 +530,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
  out_free:
         iwl_phy_db_free(mvm->phy_db);
         kfree(mvm->scan_cmd);
-        if (!iwlwifi_mod_params.nvm_file)
+        if (!cfg->no_power_up_nic_in_init || !mvm->nvm_file_name)
                 iwl_trans_op_mode_leave(trans);
         ieee80211_free_hw(mvm->hw);
         return NULL;
@@ -538,6 +550,7 @@ static void iwl_op_mode_mvm_stop(struct iwl_op_mode *op_mode)
         kfree(mvm->scan_cmd);
         vfree(mvm->fw_error_dump);
         kfree(mvm->fw_error_sram);
+        kfree(mvm->fw_error_rxf);
         kfree(mvm->mcast_filter_cmd);
         mvm->mcast_filter_cmd = NULL;
 
@@ -814,6 +827,7 @@ void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm)
         struct iwl_fw_error_dump_file *dump_file;
         struct iwl_fw_error_dump_data *dump_data;
         u32 file_len;
+        u32 trans_len;
 
         lockdep_assert_held(&mvm->mutex);
 
@@ -821,8 +835,13 @@ void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm)
                 return;
 
         file_len = mvm->fw_error_sram_len +
+                   mvm->fw_error_rxf_len +
                    sizeof(*dump_file) +
-                   sizeof(*dump_data);
+                   sizeof(*dump_data) * 2;
+
+        trans_len = iwl_trans_dump_data(mvm->trans, NULL, 0);
+        if (trans_len)
+                file_len += trans_len;
 
         dump_file = vmalloc(file_len);
         if (!dump_file)
@@ -833,7 +852,12 @@ void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm)
         dump_file->barker = cpu_to_le32(IWL_FW_ERROR_DUMP_BARKER);
         dump_file->file_len = cpu_to_le32(file_len);
         dump_data = (void *)dump_file->data;
-        dump_data->type = IWL_FW_ERROR_DUMP_SRAM;
+        dump_data->type = cpu_to_le32(IWL_FW_ERROR_DUMP_RXF);
+        dump_data->len = cpu_to_le32(mvm->fw_error_rxf_len);
+        memcpy(dump_data->data, mvm->fw_error_rxf, mvm->fw_error_rxf_len);
+
+        dump_data = iwl_mvm_fw_error_next_data(dump_data);
+        dump_data->type = cpu_to_le32(IWL_FW_ERROR_DUMP_SRAM);
         dump_data->len = cpu_to_le32(mvm->fw_error_sram_len);
 
         /*
@@ -842,6 +866,23 @@ void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm)
          * mvm->fw_error_sram right now.
          */
         memcpy(dump_data->data, mvm->fw_error_sram, mvm->fw_error_sram_len);
+
+        kfree(mvm->fw_error_rxf);
+        mvm->fw_error_rxf = NULL;
+        mvm->fw_error_rxf_len = 0;
+
+        kfree(mvm->fw_error_sram);
+        mvm->fw_error_sram = NULL;
+        mvm->fw_error_sram_len = 0;
+
+        if (trans_len) {
+                void *buf = iwl_mvm_fw_error_next_data(dump_data);
+                u32 real_trans_len = iwl_trans_dump_data(mvm->trans, buf,
+                                                         trans_len);
+                dump_data = (void *)((u8 *)buf + real_trans_len);
+                dump_file->file_len =
+                        cpu_to_le32(file_len - trans_len + real_trans_len);
+        }
 }
 #endif
 
@@ -853,6 +894,7 @@ static void iwl_mvm_nic_error(struct iwl_op_mode *op_mode)
 
 #ifdef CONFIG_IWLWIFI_DEBUGFS
         iwl_mvm_fw_error_sram_dump(mvm);
+        iwl_mvm_fw_error_rxf_dump(mvm);
 #endif
 
         iwl_mvm_nic_restart(mvm);
@@ -1126,9 +1168,9 @@ static void iwl_mvm_d0i3_exit_work(struct work_struct *wk)
         struct iwl_mvm *mvm = container_of(wk, struct iwl_mvm, d0i3_exit_work);
         struct iwl_host_cmd get_status_cmd = {
                 .id = WOWLAN_GET_STATUSES,
-                .flags = CMD_SYNC | CMD_HIGH_PRIO | CMD_WANT_SKB,
+                .flags = CMD_HIGH_PRIO | CMD_WANT_SKB,
         };
-        struct iwl_wowlan_status_v6 *status;
+        struct iwl_wowlan_status *status;
         int ret;
         u32 disconnection_reasons, wakeup_reasons;
         __le16 *qos_seq = NULL;
@@ -1158,18 +1200,27 @@ static void iwl_mvm_d0i3_exit_work(struct work_struct *wk)
         iwl_free_resp(&get_status_cmd);
 out:
         iwl_mvm_d0i3_enable_tx(mvm, qos_seq);
+        iwl_mvm_unref(mvm, IWL_MVM_REF_EXIT_WORK);
         mutex_unlock(&mvm->mutex);
 }
 
-static int iwl_mvm_exit_d0i3(struct iwl_op_mode *op_mode)
+int _iwl_mvm_exit_d0i3(struct iwl_mvm *mvm)
 {
-        struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
         u32 flags = CMD_ASYNC | CMD_HIGH_PRIO | CMD_SEND_IN_IDLE |
                     CMD_WAKE_UP_TRANS;
         int ret;
 
         IWL_DEBUG_RPM(mvm, "MVM exiting D0i3\n");
 
+        mutex_lock(&mvm->d0i3_suspend_mutex);
+        if (test_bit(D0I3_DEFER_WAKEUP, &mvm->d0i3_suspend_flags)) {
+                IWL_DEBUG_RPM(mvm, "Deferring d0i3 exit until resume\n");
+                __set_bit(D0I3_PENDING_WAKEUP, &mvm->d0i3_suspend_flags);
+                mutex_unlock(&mvm->d0i3_suspend_mutex);
+                return 0;
+        }
+        mutex_unlock(&mvm->d0i3_suspend_mutex);
+
         ret = iwl_mvm_send_cmd_pdu(mvm, D0I3_END_CMD, flags, 0, NULL);
         if (ret)
                 goto out;
@@ -1183,6 +1234,25 @@ out:
         return ret;
 }
 
+static int iwl_mvm_exit_d0i3(struct iwl_op_mode *op_mode)
+{
+        struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
+
+        iwl_mvm_ref(mvm, IWL_MVM_REF_EXIT_WORK);
+        return _iwl_mvm_exit_d0i3(mvm);
+}
+
+static void iwl_mvm_napi_add(struct iwl_op_mode *op_mode,
+                             struct napi_struct *napi,
+                             struct net_device *napi_dev,
+                             int (*poll)(struct napi_struct *, int),
+                             int weight)
+{
+        struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
+
+        ieee80211_napi_add(mvm->hw, napi, napi_dev, poll, weight);
+}
+
 static const struct iwl_op_mode_ops iwl_mvm_ops = {
         .start = iwl_op_mode_mvm_start,
         .stop = iwl_op_mode_mvm_stop,
@@ -1196,4 +1266,5 @@ static const struct iwl_op_mode_ops iwl_mvm_ops = {
         .nic_config = iwl_mvm_nic_config,
         .enter_d0i3 = iwl_mvm_enter_d0i3,
         .exit_d0i3 = iwl_mvm_exit_d0i3,
+        .napi_add = iwl_mvm_napi_add,
 };
diff --git a/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c b/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
index 237efe0ac1c4..539f3a942d43 100644
--- a/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
@@ -156,6 +156,18 @@ static void iwl_mvm_phy_ctxt_cmd_data(struct iwl_mvm *mvm,
         idle_cnt = chains_static;
         active_cnt = chains_dynamic;
 
+        /* In scenarios where we only ever use a single-stream rates,
+         * i.e. legacy 11b/g/a associations, single-stream APs or even
+         * static SMPS, enable both chains to get diversity, improving
+         * the case where we're far enough from the AP that attenuation
+         * between the two antennas is sufficiently different to impact
+         * performance.
+         */
+        if (active_cnt == 1 && iwl_mvm_rx_diversity_allowed(mvm)) {
+                idle_cnt = 2;
+                active_cnt = 2;
+        }
+
         cmd->rxchain_info = cpu_to_le32(mvm->fw->valid_rx_ant <<
                                         PHY_RX_CHAIN_VALID_POS);
         cmd->rxchain_info |= cpu_to_le32(idle_cnt << PHY_RX_CHAIN_CNT_POS);
@@ -187,7 +199,7 @@ static int iwl_mvm_phy_ctxt_apply(struct iwl_mvm *mvm,
         iwl_mvm_phy_ctxt_cmd_data(mvm, &cmd, chandef,
                                   chains_static, chains_dynamic);
 
-        ret = iwl_mvm_send_cmd_pdu(mvm, PHY_CONTEXT_CMD, CMD_SYNC,
+        ret = iwl_mvm_send_cmd_pdu(mvm, PHY_CONTEXT_CMD, 0,
                                    sizeof(struct iwl_phy_context_cmd),
                                    &cmd);
         if (ret)
@@ -202,18 +214,15 @@ int iwl_mvm_phy_ctxt_add(struct iwl_mvm *mvm, struct iwl_mvm_phy_ctxt *ctxt,
                          struct cfg80211_chan_def *chandef,
                          u8 chains_static, u8 chains_dynamic)
 {
-        int ret;
-
         WARN_ON(!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
                 ctxt->ref);
         lockdep_assert_held(&mvm->mutex);
 
         ctxt->channel = chandef->chan;
-        ret = iwl_mvm_phy_ctxt_apply(mvm, ctxt, chandef,
-                                     chains_static, chains_dynamic,
-                                     FW_CTXT_ACTION_ADD, 0);
 
-        return ret;
+        return iwl_mvm_phy_ctxt_apply(mvm, ctxt, chandef,
+                                      chains_static, chains_dynamic,
+                                      FW_CTXT_ACTION_ADD, 0);
 }
 
 /*
diff --git a/drivers/net/wireless/iwlwifi/mvm/power.c b/drivers/net/wireless/iwlwifi/mvm/power.c
index 6b636eab3339..c182a8baf685 100644
--- a/drivers/net/wireless/iwlwifi/mvm/power.c
+++ b/drivers/net/wireless/iwlwifi/mvm/power.c
@@ -123,28 +123,6 @@ void iwl_mvm_beacon_filter_set_cqm_params(struct iwl_mvm *mvm,
         cmd->ba_enable_beacon_abort = cpu_to_le32(mvmvif->bf_data.ba_enabled);
 }
 
-int iwl_mvm_update_beacon_abort(struct iwl_mvm *mvm,
-                                struct ieee80211_vif *vif, bool enable)
-{
-        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        struct iwl_beacon_filter_cmd cmd = {
-                IWL_BF_CMD_CONFIG_DEFAULTS,
-                .bf_enable_beacon_filter = cpu_to_le32(1),
-                .ba_enable_beacon_abort = cpu_to_le32(enable),
-        };
-
-        if (!mvmvif->bf_data.bf_enabled)
-                return 0;
-
-        if (mvm->cur_ucode == IWL_UCODE_WOWLAN)
-                cmd.ba_escape_timer = cpu_to_le32(IWL_BA_ESCAPE_TIMER_D3);
-
-        mvmvif->bf_data.ba_enabled = enable;
-        iwl_mvm_beacon_filter_set_cqm_params(mvm, vif, &cmd);
-        iwl_mvm_beacon_filter_debugfs_parameters(vif, &cmd);
-        return iwl_mvm_beacon_filter_send_cmd(mvm, &cmd, CMD_SYNC);
-}
-
 static void iwl_mvm_power_log(struct iwl_mvm *mvm,
                               struct iwl_mac_power_cmd *cmd)
 {
@@ -268,6 +246,57 @@ static void iwl_mvm_power_configure_uapsd(struct iwl_mvm *mvm,
                 IWL_MVM_PS_HEAVY_RX_THLD_PERCENT;
 }
 
+static void iwl_mvm_binding_iterator(void *_data, u8 *mac,
+                                      struct ieee80211_vif *vif)
+{
+        unsigned long *data = _data;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+
+        if (!mvmvif->phy_ctxt)
+                return;
+
+        if (vif->type == NL80211_IFTYPE_STATION ||
+            vif->type == NL80211_IFTYPE_AP)
+                __set_bit(mvmvif->phy_ctxt->id, data);
+}
+
+static bool iwl_mvm_power_allow_uapsd(struct iwl_mvm *mvm,
+                                       struct ieee80211_vif *vif)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        unsigned long phy_ctxt_counter = 0;
+
+        ieee80211_iterate_active_interfaces_atomic(mvm->hw,
+                                                   IEEE80211_IFACE_ITER_NORMAL,
+                                                   iwl_mvm_binding_iterator,
+                                                   &phy_ctxt_counter);
+
+        if (!memcmp(mvmvif->uapsd_misbehaving_bssid, vif->bss_conf.bssid,
+                    ETH_ALEN))
+                return false;
+
+        if (vif->p2p &&
+            !(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_P2P_PS_UAPSD))
+                return false;
+        /*
+         * Avoid using uAPSD if P2P client is associated to GO that uses
+         * opportunistic power save. This is due to current FW limitation.
+         */
+        if (vif->p2p &&
+            (vif->bss_conf.p2p_noa_attr.oppps_ctwindow &
+            IEEE80211_P2P_OPPPS_ENABLE_BIT))
+                return false;
+
+        /*
+         * Avoid using uAPSD if client is in DCM -
+         * low latency issue in Miracast
+         */
+        if (hweight8(phy_ctxt_counter) >= 2)
+                return false;
+
+        return true;
+}
+
 static void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm,
                                     struct ieee80211_vif *vif,
                                     struct iwl_mac_power_cmd *cmd)
@@ -280,7 +309,6 @@ static void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm,
         bool radar_detect = false;
         struct iwl_mvm_vif *mvmvif __maybe_unused =
                 iwl_mvm_vif_from_mac80211(vif);
-        bool allow_uapsd = true;
 
         cmd->id_and_color = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
                                                             mvmvif->color));
@@ -303,13 +331,8 @@ static void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm,
 
         cmd->flags |= cpu_to_le16(POWER_FLAGS_POWER_SAVE_ENA_MSK);
 
-#ifdef CONFIG_IWLWIFI_DEBUGFS
-        if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_DISABLE_POWER_OFF &&
-            mvmvif->dbgfs_pm.disable_power_off)
-                cmd->flags &= cpu_to_le16(~POWER_FLAGS_POWER_SAVE_ENA_MSK);
-#endif
         if (!vif->bss_conf.ps || iwl_mvm_vif_low_latency(mvmvif) ||
-            mvm->pm_disabled)
+            !mvmvif->pm_enabled)
                 return;
 
         cmd->flags |= cpu_to_le16(POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK);
@@ -351,23 +374,7 @@ static void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm,
                         cpu_to_le32(IWL_MVM_WOWLAN_PS_TX_DATA_TIMEOUT);
         }
 
-        if (!memcmp(mvmvif->uapsd_misbehaving_bssid, vif->bss_conf.bssid,
-                    ETH_ALEN))
-                allow_uapsd = false;
-
-        if (vif->p2p &&
-            !(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_P2P_PS_UAPSD))
-                allow_uapsd = false;
-        /*
-         * Avoid using uAPSD if P2P client is associated to GO that uses
-         * opportunistic power save. This is due to current FW limitation.
-         */
-        if (vif->p2p &&
-            vif->bss_conf.p2p_noa_attr.oppps_ctwindow &
-            IEEE80211_P2P_OPPPS_ENABLE_BIT)
-                allow_uapsd = false;
-
-        if (allow_uapsd)
+        if (iwl_mvm_power_allow_uapsd(mvm, vif))
                 iwl_mvm_power_configure_uapsd(mvm, vif, cmd);
 
 #ifdef CONFIG_IWLWIFI_DEBUGFS
@@ -421,20 +428,13 @@ static int iwl_mvm_power_send_cmd(struct iwl_mvm *mvm,
 {
         struct iwl_mac_power_cmd cmd = {};
 
-        if (vif->type != NL80211_IFTYPE_STATION)
-                return 0;
-
-        if (vif->p2p &&
-            !(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_BSS_P2P_PS_DCM))
-                return 0;
-
         iwl_mvm_power_build_cmd(mvm, vif, &cmd);
         iwl_mvm_power_log(mvm, &cmd);
 #ifdef CONFIG_IWLWIFI_DEBUGFS
         memcpy(&iwl_mvm_vif_from_mac80211(vif)->mac_pwr_cmd, &cmd, sizeof(cmd));
 #endif
 
-        return iwl_mvm_send_cmd_pdu(mvm, MAC_PM_POWER_TABLE, CMD_SYNC,
+        return iwl_mvm_send_cmd_pdu(mvm, MAC_PM_POWER_TABLE, 0,
                                     sizeof(cmd), &cmd);
 }
 
@@ -444,12 +444,6 @@ int iwl_mvm_power_update_device(struct iwl_mvm *mvm)
                 .flags = cpu_to_le16(DEVICE_POWER_FLAGS_POWER_SAVE_ENA_MSK),
         };
 
-        if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_PM_CMD_SUPPORT))
-                return 0;
-
-        if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_DEVICE_PS_CMD))
-                return 0;
-
         if (iwlmvm_mod_params.power_scheme == IWL_POWER_SCHEME_CAM)
                 mvm->ps_disabled = true;
 
@@ -466,7 +460,7 @@ int iwl_mvm_power_update_device(struct iwl_mvm *mvm)
                         "Sending device power command with flags = 0x%X\n",
                         cmd.flags);
 
-        return iwl_mvm_send_cmd_pdu(mvm, POWER_TABLE_CMD, CMD_SYNC, sizeof(cmd),
+        return iwl_mvm_send_cmd_pdu(mvm, POWER_TABLE_CMD, 0, sizeof(cmd),
                                     &cmd);
 }
 
@@ -508,86 +502,69 @@ int iwl_mvm_power_uapsd_misbehaving_ap_notif(struct iwl_mvm *mvm,
         return 0;
 }
 
-struct iwl_power_constraint {
+struct iwl_power_vifs {
         struct ieee80211_vif *bf_vif;
         struct ieee80211_vif *bss_vif;
         struct ieee80211_vif *p2p_vif;
-        u16 bss_phyctx_id;
-        u16 p2p_phyctx_id;
-        bool pm_disabled;
-        bool ps_disabled;
-        struct iwl_mvm *mvm;
+        struct ieee80211_vif *ap_vif;
+        struct ieee80211_vif *monitor_vif;
+        bool p2p_active;
+        bool bss_active;
+        bool ap_active;
+        bool monitor_active;
 };
 
 static void iwl_mvm_power_iterator(void *_data, u8 *mac,
                                    struct ieee80211_vif *vif)
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        struct iwl_power_constraint *power_iterator = _data;
-        struct iwl_mvm *mvm = power_iterator->mvm;
+        struct iwl_power_vifs *power_iterator = _data;
 
+        mvmvif->pm_enabled = false;
         switch (ieee80211_vif_type_p2p(vif)) {
         case NL80211_IFTYPE_P2P_DEVICE:
                 break;
 
         case NL80211_IFTYPE_P2P_GO:
         case NL80211_IFTYPE_AP:
-                /* no BSS power mgmt if we have an active AP */
-                if (mvmvif->ap_ibss_active)
-                        power_iterator->pm_disabled = true;
+                /* only a single MAC of the same type */
+                WARN_ON(power_iterator->ap_vif);
+                power_iterator->ap_vif = vif;
+                if (mvmvif->phy_ctxt)
+                        if (mvmvif->phy_ctxt->id < MAX_PHYS)
+                                power_iterator->ap_active = true;
                 break;
 
         case NL80211_IFTYPE_MONITOR:
-                /* no BSS power mgmt and no device power save */
-                power_iterator->pm_disabled = true;
-                power_iterator->ps_disabled = true;
+                /* only a single MAC of the same type */
+                WARN_ON(power_iterator->monitor_vif);
+                power_iterator->monitor_vif = vif;
+                if (mvmvif->phy_ctxt)
+                        if (mvmvif->phy_ctxt->id < MAX_PHYS)
+                                power_iterator->monitor_active = true;
                 break;
 
         case NL80211_IFTYPE_P2P_CLIENT:
-                if (mvmvif->phy_ctxt)
-                        power_iterator->p2p_phyctx_id = mvmvif->phy_ctxt->id;
-
-                /* we should have only one P2P vif */
+                /* only a single MAC of the same type */
                 WARN_ON(power_iterator->p2p_vif);
                 power_iterator->p2p_vif = vif;
-
-                IWL_DEBUG_POWER(mvm, "p2p: p2p_id=%d, bss_id=%d\n",
-                                power_iterator->p2p_phyctx_id,
-                                power_iterator->bss_phyctx_id);
-                if (!(mvm->fw->ucode_capa.flags &
-                      IWL_UCODE_TLV_FLAGS_BSS_P2P_PS_DCM)) {
-                        /* no BSS power mgmt if we have a P2P client*/
-                        power_iterator->pm_disabled = true;
-                } else if (power_iterator->p2p_phyctx_id < MAX_PHYS &&
-                           power_iterator->bss_phyctx_id < MAX_PHYS &&
-                           power_iterator->p2p_phyctx_id ==
-                           power_iterator->bss_phyctx_id) {
-                        power_iterator->pm_disabled = true;
-                }
+                if (mvmvif->phy_ctxt)
+                        if (mvmvif->phy_ctxt->id < MAX_PHYS)
+                                power_iterator->p2p_active = true;
                 break;
 
         case NL80211_IFTYPE_STATION:
-                if (mvmvif->phy_ctxt)
-                        power_iterator->bss_phyctx_id = mvmvif->phy_ctxt->id;
-
-                /* we should have only one BSS vif */
+                /* only a single MAC of the same type */
                 WARN_ON(power_iterator->bss_vif);
                 power_iterator->bss_vif = vif;
+                if (mvmvif->phy_ctxt)
+                        if (mvmvif->phy_ctxt->id < MAX_PHYS)
+                                power_iterator->bss_active = true;
 
                 if (mvmvif->bf_data.bf_enabled &&
                     !WARN_ON(power_iterator->bf_vif))
                         power_iterator->bf_vif = vif;
 
-                IWL_DEBUG_POWER(mvm, "bss: p2p_id=%d, bss_id=%d\n",
-                                power_iterator->p2p_phyctx_id,
-                                power_iterator->bss_phyctx_id);
-                if (mvm->fw->ucode_capa.flags &
-                    IWL_UCODE_TLV_FLAGS_BSS_P2P_PS_DCM &&
-                        (power_iterator->p2p_phyctx_id < MAX_PHYS &&
-                         power_iterator->bss_phyctx_id < MAX_PHYS &&
-                         power_iterator->p2p_phyctx_id ==
-                         power_iterator->bss_phyctx_id))
-                        power_iterator->pm_disabled = true;
                 break;
 
         default:
@@ -596,70 +573,73 @@ static void iwl_mvm_power_iterator(void *_data, u8 *mac,
 }
 
 static void
-iwl_mvm_power_get_global_constraint(struct iwl_mvm *mvm,
-                                    struct iwl_power_constraint *constraint)
+iwl_mvm_power_set_pm(struct iwl_mvm *mvm,
+                                    struct iwl_power_vifs *vifs)
 {
-        lockdep_assert_held(&mvm->mutex);
+        struct iwl_mvm_vif *bss_mvmvif = NULL;
+        struct iwl_mvm_vif *p2p_mvmvif = NULL;
+        struct iwl_mvm_vif *ap_mvmvif = NULL;
+        bool client_same_channel = false;
+        bool ap_same_channel = false;
 
-        if (iwlmvm_mod_params.power_scheme == IWL_POWER_SCHEME_CAM) {
-                constraint->pm_disabled = true;
-                constraint->ps_disabled = true;
-        }
+        lockdep_assert_held(&mvm->mutex);
 
+        /* get vifs info + set pm_enable to false */
         ieee80211_iterate_active_interfaces_atomic(mvm->hw,
                                             IEEE80211_IFACE_ITER_NORMAL,
-                                            iwl_mvm_power_iterator, constraint);
-}
-
-int iwl_mvm_power_update_mac(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
-{
-        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        struct iwl_power_constraint constraint = {
-                    .p2p_phyctx_id = MAX_PHYS,
-                    .bss_phyctx_id = MAX_PHYS,
-                    .mvm = mvm,
-        };
-        bool ba_enable;
-        int ret;
+                                            iwl_mvm_power_iterator, vifs);
 
-        lockdep_assert_held(&mvm->mutex);
+        if (vifs->bss_vif)
+                bss_mvmvif = iwl_mvm_vif_from_mac80211(vifs->bss_vif);
 
-        if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_PM_CMD_SUPPORT))
-                return 0;
+        if (vifs->p2p_vif)
+                p2p_mvmvif = iwl_mvm_vif_from_mac80211(vifs->p2p_vif);
 
-        iwl_mvm_power_get_global_constraint(mvm, &constraint);
-        mvm->ps_disabled = constraint.ps_disabled;
-        mvm->pm_disabled = constraint.pm_disabled;
+        if (vifs->ap_vif)
+                ap_mvmvif = iwl_mvm_vif_from_mac80211(vifs->ap_vif);
 
-        /* don't update device power state unless we add / remove monitor */
-        if (vif->type == NL80211_IFTYPE_MONITOR) {
-                ret = iwl_mvm_power_update_device(mvm);
-                if (ret)
-                        return ret;
+        /* enable PM on bss if bss stand alone */
+        if (vifs->bss_active && !vifs->p2p_active && !vifs->ap_active) {
+                bss_mvmvif->pm_enabled = true;
+                return;
         }
 
-        if (constraint.bss_vif) {
-                ret = iwl_mvm_power_send_cmd(mvm, constraint.bss_vif);
-                if (ret)
-                        return ret;
+        /* enable PM on p2p if p2p stand alone */
+        if (vifs->p2p_active && !vifs->bss_active && !vifs->ap_active) {
+                if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_P2P_PM)
+                        p2p_mvmvif->pm_enabled = true;
+                return;
         }
 
-        if (constraint.p2p_vif) {
-                ret = iwl_mvm_power_send_cmd(mvm, constraint.p2p_vif);
-                if (ret)
-                        return ret;
+        if (vifs->bss_active && vifs->p2p_active)
+                client_same_channel = (bss_mvmvif->phy_ctxt->id ==
+                                       p2p_mvmvif->phy_ctxt->id);
+        if (vifs->bss_active && vifs->ap_active)
+                ap_same_channel = (bss_mvmvif->phy_ctxt->id ==
+                                   ap_mvmvif->phy_ctxt->id);
+
+        /* clients are not stand alone: enable PM if DCM */
+        if (!(client_same_channel || ap_same_channel) &&
+            (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_BSS_P2P_PS_DCM)) {
+                if (vifs->bss_active)
+                        bss_mvmvif->pm_enabled = true;
+                if (vifs->p2p_active &&
+                    (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_P2P_PM))
+                        p2p_mvmvif->pm_enabled = true;
+                return;
         }
 
-        if (!constraint.bf_vif)
-                return 0;
-
-        vif = constraint.bf_vif;
-        mvmvif = iwl_mvm_vif_from_mac80211(vif);
-
-        ba_enable = !(constraint.pm_disabled || constraint.ps_disabled ||
-                      !vif->bss_conf.ps || iwl_mvm_vif_low_latency(mvmvif));
-
-        return iwl_mvm_update_beacon_abort(mvm, constraint.bf_vif, ba_enable);
+        /*
+         * There is only one channel in the system and there are only
+         * bss and p2p clients that share it
+         */
+        if (client_same_channel && !vifs->ap_active &&
+            (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_BSS_P2P_PS_SCM)) {
+                /* share same channel*/
+                bss_mvmvif->pm_enabled = true;
+                if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_P2P_PM)
+                        p2p_mvmvif->pm_enabled = true;
+        }
 }
 
 #ifdef CONFIG_IWLWIFI_DEBUGFS
@@ -671,19 +651,10 @@ int iwl_mvm_power_mac_dbgfs_read(struct iwl_mvm *mvm,
         struct iwl_mac_power_cmd cmd = {};
         int pos = 0;
 
-        if (WARN_ON(!(mvm->fw->ucode_capa.flags &
-                      IWL_UCODE_TLV_FLAGS_PM_CMD_SUPPORT)))
-                return 0;
-
         mutex_lock(&mvm->mutex);
         memcpy(&cmd, &mvmvif->mac_pwr_cmd, sizeof(cmd));
         mutex_unlock(&mvm->mutex);
 
-        if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_DEVICE_PS_CMD))
-                pos += scnprintf(buf+pos, bufsz-pos, "disable_power_off = %d\n",
-                                 (cmd.flags &
-                                 cpu_to_le16(POWER_FLAGS_POWER_SAVE_ENA_MSK)) ?
-                                 0 : 1);
         pos += scnprintf(buf+pos, bufsz-pos, "power_scheme = %d\n",
                          iwlmvm_mod_params.power_scheme);
         pos += scnprintf(buf+pos, bufsz-pos, "flags = 0x%x\n",
@@ -790,7 +761,7 @@ static int _iwl_mvm_enable_beacon_filter(struct iwl_mvm *mvm,
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         int ret;
 
-        if (mvmvif != mvm->bf_allowed_vif ||
+        if (mvmvif != mvm->bf_allowed_vif || !vif->bss_conf.dtim_period ||
             vif->type != NL80211_IFTYPE_STATION || vif->p2p)
                 return 0;
 
@@ -818,6 +789,26 @@ int iwl_mvm_enable_beacon_filter(struct iwl_mvm *mvm,
         return _iwl_mvm_enable_beacon_filter(mvm, vif, &cmd, flags, false);
 }
 
+static int iwl_mvm_update_beacon_abort(struct iwl_mvm *mvm,
+                                       struct ieee80211_vif *vif,
+                                       bool enable)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct iwl_beacon_filter_cmd cmd = {
+                IWL_BF_CMD_CONFIG_DEFAULTS,
+                .bf_enable_beacon_filter = cpu_to_le32(1),
+        };
+
+        if (!mvmvif->bf_data.bf_enabled)
+                return 0;
+
+        if (mvm->cur_ucode == IWL_UCODE_WOWLAN)
+                cmd.ba_escape_timer = cpu_to_le32(IWL_BA_ESCAPE_TIMER_D3);
+
+        mvmvif->bf_data.ba_enabled = enable;
+        return _iwl_mvm_enable_beacon_filter(mvm, vif, &cmd, 0, false);
+}
+
 int iwl_mvm_disable_beacon_filter(struct iwl_mvm *mvm,
                                   struct ieee80211_vif *vif,
                                   u32 flags)
@@ -826,8 +817,7 @@ int iwl_mvm_disable_beacon_filter(struct iwl_mvm *mvm,
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         int ret;
 
-        if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_BF_UPDATED) ||
-            vif->type != NL80211_IFTYPE_STATION || vif->p2p)
+        if (vif->type != NL80211_IFTYPE_STATION || vif->p2p)
                 return 0;
 
         ret = iwl_mvm_beacon_filter_send_cmd(mvm, &cmd, flags);
@@ -838,6 +828,55 @@ int iwl_mvm_disable_beacon_filter(struct iwl_mvm *mvm,
         return ret;
 }
 
+int iwl_mvm_power_update_mac(struct iwl_mvm *mvm)
+{
+        struct iwl_mvm_vif *mvmvif;
+        struct iwl_power_vifs vifs = {};
+        bool ba_enable;
+        int ret;
+
+        lockdep_assert_held(&mvm->mutex);
+
+        iwl_mvm_power_set_pm(mvm, &vifs);
+
+        /* disable PS if CAM */
+        if (iwlmvm_mod_params.power_scheme == IWL_POWER_SCHEME_CAM) {
+                mvm->ps_disabled = true;
+        } else {
+        /* don't update device power state unless we add / remove monitor */
+                if (vifs.monitor_vif) {
+                        if (vifs.monitor_active)
+                                mvm->ps_disabled = true;
+                        ret = iwl_mvm_power_update_device(mvm);
+                        if (ret)
+                                return ret;
+                }
+        }
+
+        if (vifs.bss_vif) {
+                ret = iwl_mvm_power_send_cmd(mvm, vifs.bss_vif);
+                if (ret)
+                        return ret;
+        }
+
+        if (vifs.p2p_vif) {
+                ret = iwl_mvm_power_send_cmd(mvm, vifs.p2p_vif);
+                if (ret)
+                        return ret;
+        }
+
+        if (!vifs.bf_vif)
+                return 0;
+
+        mvmvif = iwl_mvm_vif_from_mac80211(vifs.bf_vif);
+
+        ba_enable = !(!mvmvif->pm_enabled || mvm->ps_disabled ||
+                      !vifs.bf_vif->bss_conf.ps ||
+                      iwl_mvm_vif_low_latency(mvmvif));
+
+        return iwl_mvm_update_beacon_abort(mvm, vifs.bf_vif, ba_enable);
+}
+
 int iwl_mvm_update_d0i3_power_mode(struct iwl_mvm *mvm,
                                    struct ieee80211_vif *vif,
                                    bool enable, u32 flags)
@@ -861,9 +900,10 @@ int iwl_mvm_update_d0i3_power_mode(struct iwl_mvm *mvm,
                 if (WARN_ON(!dtimper_msec))
                         return 0;
 
-                cmd.flags |=
-                        cpu_to_le16(POWER_FLAGS_SKIP_OVER_DTIM_MSK);
                 cmd.skip_dtim_periods = 300 / dtimper_msec;
+                if (cmd.skip_dtim_periods)
+                        cmd.flags |=
+                                cpu_to_le16(POWER_FLAGS_SKIP_OVER_DTIM_MSK);
         }
         iwl_mvm_power_log(mvm, &cmd);
 #ifdef CONFIG_IWLWIFI_DEBUGFS
@@ -894,33 +934,3 @@ int iwl_mvm_update_d0i3_power_mode(struct iwl_mvm *mvm,
 
         return ret;
 }
-
-int iwl_mvm_update_beacon_filter(struct iwl_mvm *mvm,
-                                 struct ieee80211_vif *vif,
-                                 bool force,
-                                 u32 flags)
-{
-        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-
-        if (mvmvif != mvm->bf_allowed_vif)
-                return 0;
-
-        if (!mvmvif->bf_data.bf_enabled) {
-                /* disable beacon filtering explicitly if force is true */
-                if (force)
-                        return iwl_mvm_disable_beacon_filter(mvm, vif, flags);
-                return 0;
-        }
-
-        return iwl_mvm_enable_beacon_filter(mvm, vif, flags);
-}
-
-int iwl_power_legacy_set_cam_mode(struct iwl_mvm *mvm)
-{
-        struct iwl_powertable_cmd cmd = {
-                .keep_alive_seconds = POWER_KEEP_ALIVE_PERIOD_SEC,
-        };
-
-        return iwl_mvm_send_cmd_pdu(mvm, POWER_TABLE_CMD, CMD_SYNC,
-                                    sizeof(cmd), &cmd);
-}
diff --git a/drivers/net/wireless/iwlwifi/mvm/quota.c b/drivers/net/wireless/iwlwifi/mvm/quota.c
index 35e86e06dffd..ba68d7b84505 100644
--- a/drivers/net/wireless/iwlwifi/mvm/quota.c
+++ b/drivers/net/wireless/iwlwifi/mvm/quota.c
@@ -285,7 +285,7 @@ int iwl_mvm_update_quotas(struct iwl_mvm *mvm, struct ieee80211_vif *newvif)
 
         iwl_mvm_adjust_quota_for_noa(mvm, &cmd);
 
-        ret = iwl_mvm_send_cmd_pdu(mvm, TIME_QUOTA_CMD, CMD_SYNC,
+        ret = iwl_mvm_send_cmd_pdu(mvm, TIME_QUOTA_CMD, 0,
                                    sizeof(cmd), &cmd);
         if (ret)
                 IWL_ERR(mvm, "Failed to send quota: %d\n", ret);
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c
index e1c838899363..306a6caa4868 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
@@ -211,7 +211,7 @@ static const struct rs_tx_column rs_tx_columns[] = {
                 .next_columns = {
                         RS_COLUMN_LEGACY_ANT_B,
                         RS_COLUMN_SISO_ANT_A,
-                        RS_COLUMN_SISO_ANT_B,
+                        RS_COLUMN_MIMO2,
                         RS_COLUMN_INVALID,
                         RS_COLUMN_INVALID,
                         RS_COLUMN_INVALID,
@@ -223,8 +223,8 @@ static const struct rs_tx_column rs_tx_columns[] = {
                 .ant = ANT_B,
                 .next_columns = {
                         RS_COLUMN_LEGACY_ANT_A,
-                        RS_COLUMN_SISO_ANT_A,
                         RS_COLUMN_SISO_ANT_B,
+                        RS_COLUMN_MIMO2,
                         RS_COLUMN_INVALID,
                         RS_COLUMN_INVALID,
                         RS_COLUMN_INVALID,
@@ -238,10 +238,10 @@ static const struct rs_tx_column rs_tx_columns[] = {
                         RS_COLUMN_SISO_ANT_B,
                         RS_COLUMN_MIMO2,
                         RS_COLUMN_SISO_ANT_A_SGI,
-                        RS_COLUMN_SISO_ANT_B_SGI,
                         RS_COLUMN_LEGACY_ANT_A,
                         RS_COLUMN_LEGACY_ANT_B,
                         RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
                 },
                 .checks = {
                         rs_siso_allow,
@@ -254,10 +254,10 @@ static const struct rs_tx_column rs_tx_columns[] = {
                         RS_COLUMN_SISO_ANT_A,
                         RS_COLUMN_MIMO2,
                         RS_COLUMN_SISO_ANT_B_SGI,
-                        RS_COLUMN_SISO_ANT_A_SGI,
                         RS_COLUMN_LEGACY_ANT_A,
                         RS_COLUMN_LEGACY_ANT_B,
                         RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
                 },
                 .checks = {
                         rs_siso_allow,
@@ -271,10 +271,10 @@ static const struct rs_tx_column rs_tx_columns[] = {
                         RS_COLUMN_SISO_ANT_B_SGI,
                         RS_COLUMN_MIMO2_SGI,
                         RS_COLUMN_SISO_ANT_A,
-                        RS_COLUMN_SISO_ANT_B,
-                        RS_COLUMN_MIMO2,
                         RS_COLUMN_LEGACY_ANT_A,
                         RS_COLUMN_LEGACY_ANT_B,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
                 },
                 .checks = {
                         rs_siso_allow,
@@ -289,10 +289,10 @@ static const struct rs_tx_column rs_tx_columns[] = {
                         RS_COLUMN_SISO_ANT_A_SGI,
                         RS_COLUMN_MIMO2_SGI,
                         RS_COLUMN_SISO_ANT_B,
-                        RS_COLUMN_SISO_ANT_A,
-                        RS_COLUMN_MIMO2,
                         RS_COLUMN_LEGACY_ANT_A,
                         RS_COLUMN_LEGACY_ANT_B,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
                 },
                 .checks = {
                         rs_siso_allow,
@@ -304,12 +304,12 @@ static const struct rs_tx_column rs_tx_columns[] = {
                 .ant = ANT_AB,
                 .next_columns = {
                         RS_COLUMN_SISO_ANT_A,
-                        RS_COLUMN_SISO_ANT_B,
-                        RS_COLUMN_SISO_ANT_A_SGI,
-                        RS_COLUMN_SISO_ANT_B_SGI,
                         RS_COLUMN_MIMO2_SGI,
                         RS_COLUMN_LEGACY_ANT_A,
                         RS_COLUMN_LEGACY_ANT_B,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
                 },
                 .checks = {
                         rs_mimo_allow,
@@ -321,12 +321,12 @@ static const struct rs_tx_column rs_tx_columns[] = {
                 .sgi = true,
                 .next_columns = {
                         RS_COLUMN_SISO_ANT_A_SGI,
-                        RS_COLUMN_SISO_ANT_B_SGI,
-                        RS_COLUMN_SISO_ANT_A,
-                        RS_COLUMN_SISO_ANT_B,
                         RS_COLUMN_MIMO2,
                         RS_COLUMN_LEGACY_ANT_A,
                         RS_COLUMN_LEGACY_ANT_B,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
                 },
                 .checks = {
                         rs_mimo_allow,
@@ -527,6 +527,9 @@ static void rs_rate_scale_clear_tbl_windows(struct iwl_mvm *mvm,
         IWL_DEBUG_RATE(mvm, "Clearing up window stats\n");
         for (i = 0; i < IWL_RATE_COUNT; i++)
                 rs_rate_scale_clear_window(&tbl->win[i]);
+
+        for (i = 0; i < ARRAY_SIZE(tbl->tpc_win); i++)
+                rs_rate_scale_clear_window(&tbl->tpc_win[i]);
 }
 
 static inline u8 rs_is_valid_ant(u8 valid_antenna, u8 ant_type)
@@ -656,17 +659,34 @@ static int _rs_collect_tx_data(struct iwl_scale_tbl_info *tbl,
         return 0;
 }
 
-static int rs_collect_tx_data(struct iwl_scale_tbl_info *tbl,
-                              int scale_index, int attempts, int successes)
+static int rs_collect_tx_data(struct iwl_lq_sta *lq_sta,
+                              struct iwl_scale_tbl_info *tbl,
+                              int scale_index, int attempts, int successes,
+                              u8 reduced_txp)
 {
         struct iwl_rate_scale_data *window = NULL;
+        int ret;
 
         if (scale_index < 0 || scale_index >= IWL_RATE_COUNT)
                 return -EINVAL;
 
+        if (tbl->column != RS_COLUMN_INVALID) {
+                lq_sta->tx_stats[tbl->column][scale_index].total += attempts;
+                lq_sta->tx_stats[tbl->column][scale_index].success += successes;
+        }
+
         /* Select window for current tx bit rate */
         window = &(tbl->win[scale_index]);
 
+        ret = _rs_collect_tx_data(tbl, scale_index, attempts, successes,
+                                  window);
+        if (ret)
+                return ret;
+
+        if (WARN_ON_ONCE(reduced_txp > TPC_MAX_REDUCTION))
+                return -EINVAL;
+
+        window = &tbl->tpc_win[reduced_txp];
         return _rs_collect_tx_data(tbl, scale_index, attempts, successes,
                                    window);
 }
@@ -1000,6 +1020,7 @@ static void rs_tx_status(void *mvm_r, struct ieee80211_supported_band *sband,
         u32 ucode_rate;
         struct rs_rate rate;
         struct iwl_scale_tbl_info *curr_tbl, *other_tbl, *tmp_tbl;
+        u8 reduced_txp = (uintptr_t)info->status.status_driver_data[0];
 
         /* Treat uninitialized rate scaling data same as non-existing. */
         if (!lq_sta) {
@@ -1141,9 +1162,10 @@ static void rs_tx_status(void *mvm_r, struct ieee80211_supported_band *sband,
         if (info->flags & IEEE80211_TX_STAT_AMPDU) {
                 ucode_rate = le32_to_cpu(table->rs_table[0]);
                 rs_rate_from_ucode_rate(ucode_rate, info->band, &rate);
-                rs_collect_tx_data(curr_tbl, rate.index,
+                rs_collect_tx_data(lq_sta, curr_tbl, rate.index,
                                    info->status.ampdu_len,
-                                   info->status.ampdu_ack_len);
+                                   info->status.ampdu_ack_len,
+                                   reduced_txp);
 
                 /* Update success/fail counts if not searching for new mode */
                 if (lq_sta->rs_state == RS_STATE_STAY_IN_COLUMN) {
@@ -1176,8 +1198,9 @@ static void rs_tx_status(void *mvm_r, struct ieee80211_supported_band *sband,
                         else
                                 continue;
 
-                        rs_collect_tx_data(tmp_tbl, rate.index, 1,
-                                           i < retries ? 0 : legacy_success);
+                        rs_collect_tx_data(lq_sta, tmp_tbl, rate.index, 1,
+                                           i < retries ? 0 : legacy_success,
+                                           reduced_txp);
                 }
 
                 /* Update success/fail counts if not searching for new mode */
@@ -1188,6 +1211,7 @@ static void rs_tx_status(void *mvm_r, struct ieee80211_supported_band *sband,
         }
         /* The last TX rate is cached in lq_sta; it's set in if/else above */
         lq_sta->last_rate_n_flags = ucode_rate;
+        IWL_DEBUG_RATE(mvm, "reduced txpower: %d\n", reduced_txp);
 done:
         /* See if there's a better rate or modulation mode to try. */
         if (sta && sta->supp_rates[sband->band])
@@ -1311,105 +1335,50 @@ static void rs_set_expected_tpt_table(struct iwl_lq_sta *lq_sta,
         tbl->expected_tpt = rs_get_expected_tpt_table(lq_sta, column, rate->bw);
 }
 
-/*
- * Find starting rate for new "search" high-throughput mode of modulation.
- * Goal is to find lowest expected rate (under perfect conditions) that is
- * above the current measured throughput of "active" mode, to give new mode
- * a fair chance to prove itself without too many challenges.
- *
- * This gets called when transitioning to more aggressive modulation
- * (i.e. legacy to SISO or MIMO, or SISO to MIMO), as well as less aggressive
- * (i.e. MIMO to SISO).  When moving to MIMO, bit rate will typically need
- * to decrease to match "active" throughput.  When moving from MIMO to SISO,
- * bit rate will typically need to increase, but not if performance was bad.
- */
 static s32 rs_get_best_rate(struct iwl_mvm *mvm,
                             struct iwl_lq_sta *lq_sta,
                             struct iwl_scale_tbl_info *tbl,     /* "search" */
-                            u16 rate_mask, s8 index)
+                            unsigned long rate_mask, s8 index)
 {
-        /* "active" values */
         struct iwl_scale_tbl_info *active_tbl =
             &(lq_sta->lq_info[lq_sta->active_tbl]);
-        s32 active_sr = active_tbl->win[index].success_ratio;
-        s32 active_tpt = active_tbl->expected_tpt[index];
-        /* expected "search" throughput */
+        s32 success_ratio = active_tbl->win[index].success_ratio;
+        u16 expected_current_tpt = active_tbl->expected_tpt[index];
         const u16 *tpt_tbl = tbl->expected_tpt;
-
-        s32 new_rate, high, low, start_hi;
         u16 high_low;
-        s8 rate = index;
-
-        new_rate = high = low = start_hi = IWL_RATE_INVALID;
-
-        while (1) {
-                high_low = rs_get_adjacent_rate(mvm, rate, rate_mask,
-                                                tbl->rate.type);
-
-                low = high_low & 0xff;
-                high = (high_low >> 8) & 0xff;
+        u32 target_tpt;
+        int rate_idx;
 
-                /*
-                 * Lower the "search" bit rate, to give new "search" mode
-                 * approximately the same throughput as "active" if:
-                 *
-                 * 1) "Active" mode has been working modestly well (but not
-                 *    great), and expected "search" throughput (under perfect
-                 *    conditions) at candidate rate is above the actual
-                 *    measured "active" throughput (but less than expected
-                 *    "active" throughput under perfect conditions).
-                 * OR
-                 * 2) "Active" mode has been working perfectly or very well
-                 *    and expected "search" throughput (under perfect
-                 *    conditions) at candidate rate is above expected
-                 *    "active" throughput (under perfect conditions).
-                 */
-                if ((((100 * tpt_tbl[rate]) > lq_sta->last_tpt) &&
-                     ((active_sr > RS_SR_FORCE_DECREASE) &&
-                      (active_sr <= IWL_RATE_HIGH_TH) &&
-                      (tpt_tbl[rate] <= active_tpt))) ||
-                    ((active_sr >= IWL_RATE_SCALE_SWITCH) &&
-                     (tpt_tbl[rate] > active_tpt))) {
-                        /* (2nd or later pass)
-                         * If we've already tried to raise the rate, and are
-                         * now trying to lower it, use the higher rate. */
-                        if (start_hi != IWL_RATE_INVALID) {
-                                new_rate = start_hi;
-                                break;
-                        }
-
-                        new_rate = rate;
+        if (success_ratio > RS_SR_NO_DECREASE) {
+                target_tpt = 100 * expected_current_tpt;
+                IWL_DEBUG_RATE(mvm,
+                               "SR %d high. Find rate exceeding EXPECTED_CURRENT %d\n",
+                               success_ratio, target_tpt);
+        } else {
+                target_tpt = lq_sta->last_tpt;
+                IWL_DEBUG_RATE(mvm,
+                               "SR %d not thag good. Find rate exceeding ACTUAL_TPT %d\n",
+                               success_ratio, target_tpt);
+        }
 
-                        /* Loop again with lower rate */
-                        if (low != IWL_RATE_INVALID)
-                                rate = low;
+        rate_idx = find_first_bit(&rate_mask, BITS_PER_LONG);
 
-                        /* Lower rate not available, use the original */
-                        else
-                                break;
-
-                /* Else try to raise the "search" rate to match "active" */
-                } else {
-                        /* (2nd or later pass)
-                         * If we've already tried to lower the rate, and are
-                         * now trying to raise it, use the lower rate. */
-                        if (new_rate != IWL_RATE_INVALID)
-                                break;
+        while (rate_idx != IWL_RATE_INVALID) {
+                if (target_tpt < (100 * tpt_tbl[rate_idx]))
+                        break;
 
-                        /* Loop again with higher rate */
-                        else if (high != IWL_RATE_INVALID) {
-                                start_hi = high;
-                                rate = high;
+                high_low = rs_get_adjacent_rate(mvm, rate_idx, rate_mask,
+                                                tbl->rate.type);
 
-                        /* Higher rate not available, use the original */
-                        } else {
-                                new_rate = rate;
-                                break;
-                        }
-                }
+                rate_idx = (high_low >> 8) & 0xff;
         }
 
-        return new_rate;
+        IWL_DEBUG_RATE(mvm, "Best rate found %d target_tp %d expected_new %d\n",
+                       rate_idx, target_tpt,
+                       rate_idx != IWL_RATE_INVALID ?
+                       100 * tpt_tbl[rate_idx] : IWL_INVALID_VALUE);
+
+        return rate_idx;
 }
 
 static u32 rs_bw_from_sta_bw(struct ieee80211_sta *sta)
@@ -1584,7 +1553,7 @@ static enum rs_column rs_get_next_column(struct iwl_mvm *mvm,
 
                 tpt = lq_sta->last_tpt / 100;
                 expected_tpt_tbl = rs_get_expected_tpt_table(lq_sta, next_col,
-                                                             tbl->rate.bw);
+                                                     rs_bw_from_sta_bw(sta));
                 if (WARN_ON_ONCE(!expected_tpt_tbl))
                         continue;
 
@@ -1625,7 +1594,7 @@ static int rs_switch_to_column(struct iwl_mvm *mvm,
         const struct rs_tx_column *curr_column = &rs_tx_columns[tbl->column];
         u32 sz = (sizeof(struct iwl_scale_tbl_info) -
                   (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT));
-        u16 rate_mask = 0;
+        unsigned long rate_mask = 0;
         u32 rate_idx = 0;
 
         memcpy(search_tbl, tbl, sz);
@@ -1667,7 +1636,7 @@ static int rs_switch_to_column(struct iwl_mvm *mvm,
                     !(BIT(rate_idx) & rate_mask)) {
                         IWL_DEBUG_RATE(mvm,
                                        "can not switch with index %d"
-                                       " rate mask %x\n",
+                                       " rate mask %lx\n",
                                        rate_idx, rate_mask);
 
                         goto err;
@@ -1769,6 +1738,203 @@ out:
         return action;
 }
 
+static void rs_get_adjacent_txp(struct iwl_mvm *mvm, int index,
+                                int *weaker, int *stronger)
+{
+        *weaker = index + TPC_TX_POWER_STEP;
+        if (*weaker > TPC_MAX_REDUCTION)
+                *weaker = TPC_INVALID;
+
+        *stronger = index - TPC_TX_POWER_STEP;
+        if (*stronger < 0)
+                *stronger = TPC_INVALID;
+}
+
+static bool rs_tpc_allowed(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                           struct rs_rate *rate, enum ieee80211_band band)
+{
+        int index = rate->index;
+        bool cam = (iwlmvm_mod_params.power_scheme == IWL_POWER_SCHEME_CAM);
+        bool sta_ps_disabled = (vif->type == NL80211_IFTYPE_STATION &&
+                                !vif->bss_conf.ps);
+
+        IWL_DEBUG_RATE(mvm, "cam: %d sta_ps_disabled %d\n",
+                       cam, sta_ps_disabled);
+        /*
+         * allow tpc only if power management is enabled, or bt coex
+         * activity grade allows it and we are on 2.4Ghz.
+         */
+        if ((cam || sta_ps_disabled) &&
+            !iwl_mvm_bt_coex_is_tpc_allowed(mvm, band))
+                return false;
+
+        IWL_DEBUG_RATE(mvm, "check rate, table type: %d\n", rate->type);
+        if (is_legacy(rate))
+                return index == IWL_RATE_54M_INDEX;
+        if (is_ht(rate))
+                return index == IWL_RATE_MCS_7_INDEX;
+        if (is_vht(rate))
+                return index == IWL_RATE_MCS_7_INDEX ||
+                       index == IWL_RATE_MCS_8_INDEX ||
+                       index == IWL_RATE_MCS_9_INDEX;
+
+        WARN_ON_ONCE(1);
+        return false;
+}
+
+enum tpc_action {
+        TPC_ACTION_STAY,
+        TPC_ACTION_DECREASE,
+        TPC_ACTION_INCREASE,
+        TPC_ACTION_NO_RESTIRCTION,
+};
+
+static enum tpc_action rs_get_tpc_action(struct iwl_mvm *mvm,
+                                         s32 sr, int weak, int strong,
+                                         int current_tpt,
+                                         int weak_tpt, int strong_tpt)
+{
+        /* stay until we have valid tpt */
+        if (current_tpt == IWL_INVALID_VALUE) {
+                IWL_DEBUG_RATE(mvm, "no current tpt. stay.\n");
+                return TPC_ACTION_STAY;
+        }
+
+        /* Too many failures, increase txp */
+        if (sr <= TPC_SR_FORCE_INCREASE || current_tpt == 0) {
+                IWL_DEBUG_RATE(mvm, "increase txp because of weak SR\n");
+                return TPC_ACTION_NO_RESTIRCTION;
+        }
+
+        /* try decreasing first if applicable */
+        if (weak != TPC_INVALID) {
+                if (weak_tpt == IWL_INVALID_VALUE &&
+                    (strong_tpt == IWL_INVALID_VALUE ||
+                     current_tpt >= strong_tpt)) {
+                        IWL_DEBUG_RATE(mvm,
+                                       "no weak txp measurement. decrease txp\n");
+                        return TPC_ACTION_DECREASE;
+                }
+
+                if (weak_tpt > current_tpt) {
+                        IWL_DEBUG_RATE(mvm,
+                                       "lower txp has better tpt. decrease txp\n");
+                        return TPC_ACTION_DECREASE;
+                }
+        }
+
+        /* next, increase if needed */
+        if (sr < TPC_SR_NO_INCREASE && strong != TPC_INVALID) {
+                if (weak_tpt == IWL_INVALID_VALUE &&
+                    strong_tpt != IWL_INVALID_VALUE &&
+                    current_tpt < strong_tpt) {
+                        IWL_DEBUG_RATE(mvm,
+                                       "higher txp has better tpt. increase txp\n");
+                        return TPC_ACTION_INCREASE;
+                }
+
+                if (weak_tpt < current_tpt &&
+                    (strong_tpt == IWL_INVALID_VALUE ||
+                     strong_tpt > current_tpt)) {
+                        IWL_DEBUG_RATE(mvm,
+                                       "lower txp has worse tpt. increase txp\n");
+                        return TPC_ACTION_INCREASE;
+                }
+        }
+
+        IWL_DEBUG_RATE(mvm, "no need to increase or decrease txp - stay\n");
+        return TPC_ACTION_STAY;
+}
+
+static bool rs_tpc_perform(struct iwl_mvm *mvm,
+                           struct ieee80211_sta *sta,
+                           struct iwl_lq_sta *lq_sta,
+                           struct iwl_scale_tbl_info *tbl)
+{
+        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+        struct ieee80211_vif *vif = mvm_sta->vif;
+        struct ieee80211_chanctx_conf *chanctx_conf;
+        enum ieee80211_band band;
+        struct iwl_rate_scale_data *window;
+        struct rs_rate *rate = &tbl->rate;
+        enum tpc_action action;
+        s32 sr;
+        u8 cur = lq_sta->lq.reduced_tpc;
+        int current_tpt;
+        int weak, strong;
+        int weak_tpt = IWL_INVALID_VALUE, strong_tpt = IWL_INVALID_VALUE;
+
+#ifdef CONFIG_MAC80211_DEBUGFS
+        if (lq_sta->dbg_fixed_txp_reduction <= TPC_MAX_REDUCTION) {
+                IWL_DEBUG_RATE(mvm, "fixed tpc: %d\n",
+                               lq_sta->dbg_fixed_txp_reduction);
+                lq_sta->lq.reduced_tpc = lq_sta->dbg_fixed_txp_reduction;
+                return cur != lq_sta->dbg_fixed_txp_reduction;
+        }
+#endif
+
+        rcu_read_lock();
+        chanctx_conf = rcu_dereference(vif->chanctx_conf);
+        if (WARN_ON(!chanctx_conf))
+                band = IEEE80211_NUM_BANDS;
+        else
+                band = chanctx_conf->def.chan->band;
+        rcu_read_unlock();
+
+        if (!rs_tpc_allowed(mvm, vif, rate, band)) {
+                IWL_DEBUG_RATE(mvm,
+                               "tpc is not allowed. remove txp restrictions\n");
+                lq_sta->lq.reduced_tpc = TPC_NO_REDUCTION;
+                return cur != TPC_NO_REDUCTION;
+        }
+
+        rs_get_adjacent_txp(mvm, cur, &weak, &strong);
+
+        /* Collect measured throughputs for current and adjacent rates */
+        window = tbl->tpc_win;
+        sr = window[cur].success_ratio;
+        current_tpt = window[cur].average_tpt;
+        if (weak != TPC_INVALID)
+                weak_tpt = window[weak].average_tpt;
+        if (strong != TPC_INVALID)
+                strong_tpt = window[strong].average_tpt;
+
+        IWL_DEBUG_RATE(mvm,
+                       "(TPC: %d): cur_tpt %d SR %d weak %d strong %d weak_tpt %d strong_tpt %d\n",
+                       cur, current_tpt, sr, weak, strong,
+                       weak_tpt, strong_tpt);
+
+        action = rs_get_tpc_action(mvm, sr, weak, strong,
+                                   current_tpt, weak_tpt, strong_tpt);
+
+        /* override actions if we are on the edge */
+        if (weak == TPC_INVALID && action == TPC_ACTION_DECREASE) {
+                IWL_DEBUG_RATE(mvm, "already in lowest txp, stay\n");
+                action = TPC_ACTION_STAY;
+        } else if (strong == TPC_INVALID &&
+                   (action == TPC_ACTION_INCREASE ||
+                    action == TPC_ACTION_NO_RESTIRCTION)) {
+                IWL_DEBUG_RATE(mvm, "already in highest txp, stay\n");
+                action = TPC_ACTION_STAY;
+        }
+
+        switch (action) {
+        case TPC_ACTION_DECREASE:
+                lq_sta->lq.reduced_tpc = weak;
+                return true;
+        case TPC_ACTION_INCREASE:
+                lq_sta->lq.reduced_tpc = strong;
+                return true;
+        case TPC_ACTION_NO_RESTIRCTION:
+                lq_sta->lq.reduced_tpc = TPC_NO_REDUCTION;
+                return true;
+        case TPC_ACTION_STAY:
+                /* do nothing */
+                break;
+        }
+        return false;
+}
+
 /*
  * Do rate scaling and search for new modulation mode.
  */
@@ -2019,6 +2185,9 @@ static void rs_rate_scale_perform(struct iwl_mvm *mvm,
                 break;
         case RS_ACTION_STAY:
                 /* No change */
+                if (lq_sta->rs_state == RS_STATE_STAY_IN_COLUMN)
+                        update_lq = rs_tpc_perform(mvm, sta, lq_sta, tbl);
+                break;
         default:
                 break;
         }
@@ -2271,10 +2440,6 @@ static void rs_vht_set_enabled_rates(struct ieee80211_sta *sta,
                         if (i == IWL_RATE_9M_INDEX)
                                 continue;
 
-                        /* Disable MCS9 as a workaround */
-                        if (i == IWL_RATE_MCS_9_INDEX)
-                                continue;
-
                         /* VHT MCS9 isn't valid for 20Mhz for NSS=1,2 */
                         if (i == IWL_RATE_MCS_9_INDEX &&
                             sta->bandwidth == IEEE80211_STA_RX_BW_20)
@@ -2293,10 +2458,6 @@ static void rs_vht_set_enabled_rates(struct ieee80211_sta *sta,
                         if (i == IWL_RATE_9M_INDEX)
                                 continue;
 
-                        /* Disable MCS9 as a workaround */
-                        if (i == IWL_RATE_MCS_9_INDEX)
-                                continue;
-
                         /* VHT MCS9 isn't valid for 20Mhz for NSS=1,2 */
                         if (i == IWL_RATE_MCS_9_INDEX &&
                             sta->bandwidth == IEEE80211_STA_RX_BW_20)
@@ -2478,6 +2639,7 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         lq_sta->is_agg = 0;
 #ifdef CONFIG_MAC80211_DEBUGFS
         lq_sta->dbg_fixed_rate = 0;
+        lq_sta->dbg_fixed_txp_reduction = TPC_INVALID;
 #endif
 #ifdef CONFIG_IWLWIFI_DEBUGFS
         iwl_mvm_reset_frame_stats(mvm, &mvm->drv_rx_stats);
@@ -2653,6 +2815,7 @@ static void rs_fill_lq_cmd(struct iwl_mvm *mvm,
                 rs_build_rates_table_from_fixed(mvm, lq_cmd,
                                                 lq_sta->band,
                                                 lq_sta->dbg_fixed_rate);
+                lq_cmd->reduced_tpc = 0;
                 ant = (lq_sta->dbg_fixed_rate & RATE_MCS_ANT_ABC_MSK) >>
                         RATE_MCS_ANT_POS;
         } else
@@ -2783,7 +2946,6 @@ static ssize_t rs_sta_dbgfs_scale_table_write(struct file *file,
         size_t buf_size;
         u32 parsed_rate;
 
-
         mvm = lq_sta->drv;
         memset(buf, 0, sizeof(buf));
         buf_size = min(count, sizeof(buf) -  1);
@@ -2856,6 +3018,7 @@ static ssize_t rs_sta_dbgfs_scale_table_read(struct file *file,
                         lq_sta->lq.agg_disable_start_th,
                         lq_sta->lq.agg_frame_cnt_limit);
 
+        desc += sprintf(buff+desc, "reduced tpc=%d\n", lq_sta->lq.reduced_tpc);
         desc += sprintf(buff+desc,
                         "Start idx [0]=0x%x [1]=0x%x [2]=0x%x [3]=0x%x\n",
                         lq_sta->lq.initial_rate_index[0],
@@ -2928,6 +3091,94 @@ static const struct file_operations rs_sta_dbgfs_stats_table_ops = {
         .llseek = default_llseek,
 };
 
+static ssize_t rs_sta_dbgfs_drv_tx_stats_read(struct file *file,
+                                              char __user *user_buf,
+                                              size_t count, loff_t *ppos)
+{
+        static const char * const column_name[] = {
+                [RS_COLUMN_LEGACY_ANT_A] = "LEGACY_ANT_A",
+                [RS_COLUMN_LEGACY_ANT_B] = "LEGACY_ANT_B",
+                [RS_COLUMN_SISO_ANT_A] = "SISO_ANT_A",
+                [RS_COLUMN_SISO_ANT_B] = "SISO_ANT_B",
+                [RS_COLUMN_SISO_ANT_A_SGI] = "SISO_ANT_A_SGI",
+                [RS_COLUMN_SISO_ANT_B_SGI] = "SISO_ANT_B_SGI",
+                [RS_COLUMN_MIMO2] = "MIMO2",
+                [RS_COLUMN_MIMO2_SGI] = "MIMO2_SGI",
+        };
+
+        static const char * const rate_name[] = {
+                [IWL_RATE_1M_INDEX] = "1M",
+                [IWL_RATE_2M_INDEX] = "2M",
+                [IWL_RATE_5M_INDEX] = "5.5M",
+                [IWL_RATE_11M_INDEX] = "11M",
+                [IWL_RATE_6M_INDEX] = "6M|MCS0",
+                [IWL_RATE_9M_INDEX] = "9M",
+                [IWL_RATE_12M_INDEX] = "12M|MCS1",
+                [IWL_RATE_18M_INDEX] = "18M|MCS2",
+                [IWL_RATE_24M_INDEX] = "24M|MCS3",
+                [IWL_RATE_36M_INDEX] = "36M|MCS4",
+                [IWL_RATE_48M_INDEX] = "48M|MCS5",
+                [IWL_RATE_54M_INDEX] = "54M|MCS6",
+                [IWL_RATE_MCS_7_INDEX] = "MCS7",
+                [IWL_RATE_MCS_8_INDEX] = "MCS8",
+                [IWL_RATE_MCS_9_INDEX] = "MCS9",
+        };
+
+        char *buff, *pos, *endpos;
+        int col, rate;
+        ssize_t ret;
+        struct iwl_lq_sta *lq_sta = file->private_data;
+        struct rs_rate_stats *stats;
+        static const size_t bufsz = 1024;
+
+        buff = kmalloc(bufsz, GFP_KERNEL);
+        if (!buff)
+                return -ENOMEM;
+
+        pos = buff;
+        endpos = pos + bufsz;
+
+        pos += scnprintf(pos, endpos - pos, "COLUMN,");
+        for (rate = 0; rate < IWL_RATE_COUNT; rate++)
+                pos += scnprintf(pos, endpos - pos, "%s,", rate_name[rate]);
+        pos += scnprintf(pos, endpos - pos, "\n");
+
+        for (col = 0; col < RS_COLUMN_COUNT; col++) {
+                pos += scnprintf(pos, endpos - pos,
+                                 "%s,", column_name[col]);
+
+                for (rate = 0; rate < IWL_RATE_COUNT; rate++) {
+                        stats = &(lq_sta->tx_stats[col][rate]);
+                        pos += scnprintf(pos, endpos - pos,
+                                         "%llu/%llu,",
+                                         stats->success,
+                                         stats->total);
+                }
+                pos += scnprintf(pos, endpos - pos, "\n");
+        }
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, buff, pos - buff);
+        kfree(buff);
+        return ret;
+}
+
+static ssize_t rs_sta_dbgfs_drv_tx_stats_write(struct file *file,
+                                               const char __user *user_buf,
+                                               size_t count, loff_t *ppos)
+{
+        struct iwl_lq_sta *lq_sta = file->private_data;
+        memset(lq_sta->tx_stats, 0, sizeof(lq_sta->tx_stats));
+
+        return count;
+}
+
+static const struct file_operations rs_sta_dbgfs_drv_tx_stats_ops = {
+        .read = rs_sta_dbgfs_drv_tx_stats_read,
+        .write = rs_sta_dbgfs_drv_tx_stats_write,
+        .open = simple_open,
+        .llseek = default_llseek,
+};
+
 static void rs_add_debugfs(void *mvm, void *mvm_sta, struct dentry *dir)
 {
         struct iwl_lq_sta *lq_sta = mvm_sta;
@@ -2937,9 +3188,15 @@ static void rs_add_debugfs(void *mvm, void *mvm_sta, struct dentry *dir)
         lq_sta->rs_sta_dbgfs_stats_table_file =
                 debugfs_create_file("rate_stats_table", S_IRUSR, dir,
                                     lq_sta, &rs_sta_dbgfs_stats_table_ops);
+        lq_sta->rs_sta_dbgfs_drv_tx_stats_file =
+                debugfs_create_file("drv_tx_stats", S_IRUSR | S_IWUSR, dir,
+                                    lq_sta, &rs_sta_dbgfs_drv_tx_stats_ops);
         lq_sta->rs_sta_dbgfs_tx_agg_tid_en_file =
                 debugfs_create_u8("tx_agg_tid_enable", S_IRUSR | S_IWUSR, dir,
                                   &lq_sta->tx_agg_tid_en);
+        lq_sta->rs_sta_dbgfs_reduced_txp_file =
+                debugfs_create_u8("reduced_tpc", S_IRUSR | S_IWUSR, dir,
+                                  &lq_sta->dbg_fixed_txp_reduction);
 }
 
 static void rs_remove_debugfs(void *mvm, void *mvm_sta)
@@ -2947,7 +3204,9 @@ static void rs_remove_debugfs(void *mvm, void *mvm_sta)
         struct iwl_lq_sta *lq_sta = mvm_sta;
         debugfs_remove(lq_sta->rs_sta_dbgfs_scale_table_file);
         debugfs_remove(lq_sta->rs_sta_dbgfs_stats_table_file);
+        debugfs_remove(lq_sta->rs_sta_dbgfs_drv_tx_stats_file);
         debugfs_remove(lq_sta->rs_sta_dbgfs_tx_agg_tid_en_file);
+        debugfs_remove(lq_sta->rs_sta_dbgfs_reduced_txp_file);
 }
 #endif
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.h b/drivers/net/wireless/iwlwifi/mvm/rs.h
index 0acfac96a56c..374a83d7db25 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.h
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.h
@@ -158,6 +158,13 @@ enum {
 #define RS_SR_FORCE_DECREASE            1920    /*  15% */
 #define RS_SR_NO_DECREASE               10880   /*  85% */
 
+#define TPC_SR_FORCE_INCREASE           9600    /* 75% */
+#define TPC_SR_NO_INCREASE              10880   /* 85% */
+#define TPC_TX_POWER_STEP               3
+#define TPC_MAX_REDUCTION               15
+#define TPC_NO_REDUCTION                0
+#define TPC_INVALID                     0xff
+
 #define LINK_QUAL_AGG_TIME_LIMIT_DEF    (4000) /* 4 milliseconds */
 #define LINK_QUAL_AGG_TIME_LIMIT_MAX    (8000)
 #define LINK_QUAL_AGG_TIME_LIMIT_MIN    (100)
@@ -266,9 +273,16 @@ enum rs_column {
         RS_COLUMN_MIMO2_SGI,
 
         RS_COLUMN_LAST = RS_COLUMN_MIMO2_SGI,
+        RS_COLUMN_COUNT = RS_COLUMN_LAST + 1,
         RS_COLUMN_INVALID,
 };
 
+/* Packet stats per rate */
+struct rs_rate_stats {
+        u64 success;
+        u64 total;
+};
+
 /**
  * struct iwl_scale_tbl_info -- tx params and success history for all rates
  *
@@ -280,6 +294,8 @@ struct iwl_scale_tbl_info {
         enum rs_column column;
         const u16 *expected_tpt;        /* throughput metrics; expected_tpt_G, etc. */
         struct iwl_rate_scale_data win[IWL_RATE_COUNT]; /* rate histories */
+        /* per txpower-reduction history */
+        struct iwl_rate_scale_data tpc_win[TPC_MAX_REDUCTION + 1];
 };
 
 enum {
@@ -315,6 +331,8 @@ struct iwl_lq_sta {
         bool is_vht;
         enum ieee80211_band band;
 
+        struct rs_rate_stats tx_stats[RS_COLUMN_COUNT][IWL_RATE_COUNT];
+
         /* The following are bitmaps of rates; IWL_RATE_6M_MASK, etc. */
         unsigned long active_legacy_rate;
         unsigned long active_siso_rate;
@@ -334,8 +352,11 @@ struct iwl_lq_sta {
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct dentry *rs_sta_dbgfs_scale_table_file;
         struct dentry *rs_sta_dbgfs_stats_table_file;
+        struct dentry *rs_sta_dbgfs_drv_tx_stats_file;
         struct dentry *rs_sta_dbgfs_tx_agg_tid_en_file;
+        struct dentry *rs_sta_dbgfs_reduced_txp_file;
         u32 dbg_fixed_rate;
+        u8 dbg_fixed_txp_reduction;
 #endif
         struct iwl_mvm *drv;
 
@@ -345,6 +366,9 @@ struct iwl_lq_sta {
         u32 last_rate_n_flags;
         /* packets destined for this STA are aggregated */
         u8 is_agg;
+
+        /* tx power reduce for this sta */
+        int tpc_reduce;
 };
 
 /* Initialize station's rate scaling information after adding station */
diff --git a/drivers/net/wireless/iwlwifi/mvm/rx.c b/drivers/net/wireless/iwlwifi/mvm/rx.c
index 6061553a5e44..cf7276967acd 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rx.c
@@ -60,7 +60,6 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *****************************************************************************/
 #include "iwl-trans.h"
-
 #include "mvm.h"
 #include "fw-api.h"
 
@@ -130,42 +129,7 @@ static void iwl_mvm_pass_packet_to_mac80211(struct iwl_mvm *mvm,
 
         memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));
 
-        ieee80211_rx_ni(mvm->hw, skb);
-}
-
-static void iwl_mvm_calc_rssi(struct iwl_mvm *mvm,
-                              struct iwl_rx_phy_info *phy_info,
-                              struct ieee80211_rx_status *rx_status)
-{
-        int rssi_a, rssi_b, rssi_a_dbm, rssi_b_dbm, max_rssi_dbm;
-        u32 agc_a, agc_b;
-        u32 val;
-
-        val = le32_to_cpu(phy_info->non_cfg_phy[IWL_RX_INFO_AGC_IDX]);
-        agc_a = (val & IWL_OFDM_AGC_A_MSK) >> IWL_OFDM_AGC_A_POS;
-        agc_b = (val & IWL_OFDM_AGC_B_MSK) >> IWL_OFDM_AGC_B_POS;
-
-        val = le32_to_cpu(phy_info->non_cfg_phy[IWL_RX_INFO_RSSI_AB_IDX]);
-        rssi_a = (val & IWL_OFDM_RSSI_INBAND_A_MSK) >> IWL_OFDM_RSSI_A_POS;
-        rssi_b = (val & IWL_OFDM_RSSI_INBAND_B_MSK) >> IWL_OFDM_RSSI_B_POS;
-
-        /*
-         * dBm = rssi dB - agc dB - constant.
-         * Higher AGC (higher radio gain) means lower signal.
-         */
-        rssi_a_dbm = rssi_a - IWL_RSSI_OFFSET - agc_a;
-        rssi_b_dbm = rssi_b - IWL_RSSI_OFFSET - agc_b;
-        max_rssi_dbm = max_t(int, rssi_a_dbm, rssi_b_dbm);
-
-        IWL_DEBUG_STATS(mvm, "Rssi In A %d B %d Max %d AGCA %d AGCB %d\n",
-                        rssi_a_dbm, rssi_b_dbm, max_rssi_dbm, agc_a, agc_b);
-
-        rx_status->signal = max_rssi_dbm;
-        rx_status->chains = (le16_to_cpu(phy_info->phy_flags) &
-                                RX_RES_PHY_FLAGS_ANTENNA)
-                                        >> RX_RES_PHY_FLAGS_ANTENNA_POS;
-        rx_status->chain_signal[0] = rssi_a_dbm;
-        rx_status->chain_signal[1] = rssi_b_dbm;
+        ieee80211_rx(mvm->hw, skb);
 }
 
 /*
@@ -337,10 +301,7 @@ int iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
          */
         /*rx_status.flag |= RX_FLAG_MACTIME_MPDU;*/
 
-        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_RX_ENERGY_API)
-                iwl_mvm_get_signal_strength(mvm, phy_info, &rx_status);
-        else
-                iwl_mvm_calc_rssi(mvm, phy_info, &rx_status);
+        iwl_mvm_get_signal_strength(mvm, phy_info, &rx_status);
 
         IWL_DEBUG_STATS_LIMIT(mvm, "Rssi %d, TSF %llu\n", rx_status.signal,
                               (unsigned long long)rx_status.mactime);
@@ -394,6 +355,8 @@ int iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
                 rx_status.rate_idx = rate_n_flags & RATE_VHT_MCS_RATE_CODE_MSK;
                 rx_status.flag |= RX_FLAG_VHT;
                 rx_status.flag |= stbc << RX_FLAG_STBC_SHIFT;
+                if (rate_n_flags & RATE_MCS_BF_MSK)
+                        rx_status.vht_flag |= RX_VHT_FLAG_BF;
         } else {
                 rx_status.rate_idx =
                         iwl_mvm_legacy_rate_to_mac80211_idx(rate_n_flags,
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index c28de54c75d4..4b6c7d4bd199 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -306,7 +306,6 @@ int iwl_mvm_scan_request(struct iwl_mvm *mvm,
                 .id = SCAN_REQUEST_CMD,
                 .len = { 0, },
                 .data = { mvm->scan_cmd, },
-                .flags = CMD_SYNC,
                 .dataflags = { IWL_HCMD_DFL_NOCOPY, },
         };
         struct iwl_scan_cmd *cmd = mvm->scan_cmd;
@@ -319,7 +318,10 @@ int iwl_mvm_scan_request(struct iwl_mvm *mvm,
         struct iwl_mvm_scan_params params = {};
 
         lockdep_assert_held(&mvm->mutex);
-        BUG_ON(mvm->scan_cmd == NULL);
+
+        /* we should have failed registration if scan_cmd was NULL */
+        if (WARN_ON(mvm->scan_cmd == NULL))
+                return -ENOMEM;
 
         IWL_DEBUG_SCAN(mvm, "Handling mac80211 scan request\n");
         mvm->scan_status = IWL_MVM_SCAN_OS;
@@ -514,7 +516,7 @@ int iwl_mvm_cancel_scan(struct iwl_mvm *mvm)
                                    ARRAY_SIZE(scan_abort_notif),
                                    iwl_mvm_scan_abort_notif, NULL);
 
-        ret = iwl_mvm_send_cmd_pdu(mvm, SCAN_ABORT_CMD, CMD_SYNC, 0, NULL);
+        ret = iwl_mvm_send_cmd_pdu(mvm, SCAN_ABORT_CMD, 0, 0, NULL);
         if (ret) {
                 IWL_ERR(mvm, "Couldn't send SCAN_ABORT_CMD: %d\n", ret);
                 /* mac80211's state will be cleaned in the nic_restart flow */
@@ -538,9 +540,13 @@ int iwl_mvm_rx_scan_offload_complete_notif(struct iwl_mvm *mvm,
         /* scan status must be locked for proper checking */
         lockdep_assert_held(&mvm->mutex);
 
-        IWL_DEBUG_SCAN(mvm, "Scheduled scan completed, status %s\n",
+        IWL_DEBUG_SCAN(mvm,
+                       "Scheduled scan completed, status %s EBS status %s:%d\n",
                        scan_notif->status == IWL_SCAN_OFFLOAD_COMPLETED ?
-                       "completed" : "aborted");
+                       "completed" : "aborted", scan_notif->ebs_status ==
+                       IWL_SCAN_EBS_SUCCESS ? "success" : "failed",
+                       scan_notif->ebs_status);
+
 
         /* only call mac80211 completion if the stop was initiated by FW */
         if (mvm->scan_status == IWL_MVM_SCAN_SCHED) {
@@ -548,6 +554,8 @@ int iwl_mvm_rx_scan_offload_complete_notif(struct iwl_mvm *mvm,
                 ieee80211_sched_scan_stopped(mvm->hw);
         }
 
+        mvm->last_ebs_successful = !scan_notif->ebs_status;
+
         return 0;
 }
 
@@ -740,7 +748,6 @@ int iwl_mvm_config_sched_scan(struct iwl_mvm *mvm,
         struct iwl_scan_offload_cfg *scan_cfg;
         struct iwl_host_cmd cmd = {
                 .id = SCAN_OFFLOAD_CONFIG_CMD,
-                .flags = CMD_SYNC,
         };
         struct iwl_mvm_scan_params params = {};
 
@@ -798,7 +805,6 @@ int iwl_mvm_config_sched_scan_profiles(struct iwl_mvm *mvm,
         struct iwl_scan_offload_blacklist *blacklist;
         struct iwl_host_cmd cmd = {
                 .id = SCAN_OFFLOAD_UPDATE_PROFILES_CMD,
-                .flags = CMD_SYNC,
                 .len[1] = sizeof(*profile_cfg),
                 .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
                 .dataflags[1] = IWL_HCMD_DFL_NOCOPY,
@@ -884,7 +890,12 @@ int iwl_mvm_sched_scan_start(struct iwl_mvm *mvm,
                 scan_req.flags |= cpu_to_le16(IWL_SCAN_OFFLOAD_FLAG_PASS_ALL);
         }
 
-        return iwl_mvm_send_cmd_pdu(mvm, SCAN_OFFLOAD_REQUEST_CMD, CMD_SYNC,
+        if (mvm->last_ebs_successful &&
+            mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_EBS_SUPPORT)
+                scan_req.flags |=
+                        cpu_to_le16(IWL_SCAN_OFFLOAD_FLAG_EBS_ACCURATE_MODE);
+
+        return iwl_mvm_send_cmd_pdu(mvm, SCAN_OFFLOAD_REQUEST_CMD, 0,
                                     sizeof(scan_req), &scan_req);
 }
 
@@ -893,7 +904,6 @@ static int iwl_mvm_send_sched_scan_abort(struct iwl_mvm *mvm)
         int ret;
         struct iwl_host_cmd cmd = {
                 .id = SCAN_OFFLOAD_ABORT_CMD,
-                .flags = CMD_SYNC,
         };
         u32 status;
 
@@ -922,7 +932,7 @@ static int iwl_mvm_send_sched_scan_abort(struct iwl_mvm *mvm)
         return ret;
 }
 
-int iwl_mvm_sched_scan_stop(struct iwl_mvm *mvm)
+int iwl_mvm_sched_scan_stop(struct iwl_mvm *mvm, bool notify)
 {
         int ret;
         struct iwl_notification_wait wait_scan_done;
@@ -960,5 +970,8 @@ int iwl_mvm_sched_scan_stop(struct iwl_mvm *mvm)
          */
         mvm->scan_status = IWL_MVM_SCAN_NONE;
 
+        if (notify)
+                ieee80211_sched_scan_stopped(mvm->hw);
+
         return 0;
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/sf.c b/drivers/net/wireless/iwlwifi/mvm/sf.c
index 88809b2d1654..7edfd15efc9d 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sf.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sf.c
@@ -237,9 +237,6 @@ int iwl_mvm_sf_update(struct iwl_mvm *mvm, struct ieee80211_vif *changed_vif,
                 .sta_vif_ap_sta_id = IWL_MVM_STATION_COUNT,
         };
 
-        if (IWL_UCODE_API(mvm->fw->ucode_ver) < 8)
-                return 0;
-
         /*
          * Ignore the call if we are in HW Restart flow, or if the handled
          * vif is a p2p device.
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
index f339ef884250..1fb01ea2e704 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
@@ -66,115 +66,6 @@
 #include "sta.h"
 #include "rs.h"
 
-static void iwl_mvm_add_sta_cmd_v7_to_v5(struct iwl_mvm_add_sta_cmd_v7 *cmd_v7,
-                                         struct iwl_mvm_add_sta_cmd_v5 *cmd_v5)
-{
-        memset(cmd_v5, 0, sizeof(*cmd_v5));
-
-        cmd_v5->add_modify = cmd_v7->add_modify;
-        cmd_v5->tid_disable_tx = cmd_v7->tid_disable_tx;
-        cmd_v5->mac_id_n_color = cmd_v7->mac_id_n_color;
-        memcpy(cmd_v5->addr, cmd_v7->addr, ETH_ALEN);
-        cmd_v5->sta_id = cmd_v7->sta_id;
-        cmd_v5->modify_mask = cmd_v7->modify_mask;
-        cmd_v5->station_flags = cmd_v7->station_flags;
-        cmd_v5->station_flags_msk = cmd_v7->station_flags_msk;
-        cmd_v5->add_immediate_ba_tid = cmd_v7->add_immediate_ba_tid;
-        cmd_v5->remove_immediate_ba_tid = cmd_v7->remove_immediate_ba_tid;
-        cmd_v5->add_immediate_ba_ssn = cmd_v7->add_immediate_ba_ssn;
-        cmd_v5->sleep_tx_count = cmd_v7->sleep_tx_count;
-        cmd_v5->sleep_state_flags = cmd_v7->sleep_state_flags;
-        cmd_v5->assoc_id = cmd_v7->assoc_id;
-        cmd_v5->beamform_flags = cmd_v7->beamform_flags;
-        cmd_v5->tfd_queue_msk = cmd_v7->tfd_queue_msk;
-}
-
-static void
-iwl_mvm_add_sta_key_to_add_sta_cmd_v5(struct iwl_mvm_add_sta_key_cmd *key_cmd,
-                                      struct iwl_mvm_add_sta_cmd_v5 *sta_cmd,
-                                      u32 mac_id_n_color)
-{
-        memset(sta_cmd, 0, sizeof(*sta_cmd));
-
-        sta_cmd->sta_id = key_cmd->sta_id;
-        sta_cmd->add_modify = STA_MODE_MODIFY;
-        sta_cmd->modify_mask = STA_MODIFY_KEY;
-        sta_cmd->mac_id_n_color = cpu_to_le32(mac_id_n_color);
-
-        sta_cmd->key.key_offset = key_cmd->key_offset;
-        sta_cmd->key.key_flags = key_cmd->key_flags;
-        memcpy(sta_cmd->key.key, key_cmd->key, sizeof(sta_cmd->key.key));
-        sta_cmd->key.tkip_rx_tsc_byte2 = key_cmd->tkip_rx_tsc_byte2;
-        memcpy(sta_cmd->key.tkip_rx_ttak, key_cmd->tkip_rx_ttak,
-               sizeof(sta_cmd->key.tkip_rx_ttak));
-}
-
-static int iwl_mvm_send_add_sta_cmd_status(struct iwl_mvm *mvm,
-                                           struct iwl_mvm_add_sta_cmd_v7 *cmd,
-                                           int *status)
-{
-        struct iwl_mvm_add_sta_cmd_v5 cmd_v5;
-
-        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_STA_KEY_CMD)
-                return iwl_mvm_send_cmd_pdu_status(mvm, ADD_STA, sizeof(*cmd),
-                                                   cmd, status);
-
-        iwl_mvm_add_sta_cmd_v7_to_v5(cmd, &cmd_v5);
-
-        return iwl_mvm_send_cmd_pdu_status(mvm, ADD_STA, sizeof(cmd_v5),
-                                           &cmd_v5, status);
-}
-
-static int iwl_mvm_send_add_sta_cmd(struct iwl_mvm *mvm, u32 flags,
-                                    struct iwl_mvm_add_sta_cmd_v7 *cmd)
-{
-        struct iwl_mvm_add_sta_cmd_v5 cmd_v5;
-
-        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_STA_KEY_CMD)
-                return iwl_mvm_send_cmd_pdu(mvm, ADD_STA, flags,
-                                            sizeof(*cmd), cmd);
-
-        iwl_mvm_add_sta_cmd_v7_to_v5(cmd, &cmd_v5);
-
-        return iwl_mvm_send_cmd_pdu(mvm, ADD_STA, flags, sizeof(cmd_v5),
-                                    &cmd_v5);
-}
-
-static int
-iwl_mvm_send_add_sta_key_cmd_status(struct iwl_mvm *mvm,
-                                    struct iwl_mvm_add_sta_key_cmd *cmd,
-                                    u32 mac_id_n_color,
-                                    int *status)
-{
-        struct iwl_mvm_add_sta_cmd_v5 sta_cmd;
-
-        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_STA_KEY_CMD)
-                return iwl_mvm_send_cmd_pdu_status(mvm, ADD_STA_KEY,
-                                                   sizeof(*cmd), cmd, status);
-
-        iwl_mvm_add_sta_key_to_add_sta_cmd_v5(cmd, &sta_cmd, mac_id_n_color);
-
-        return iwl_mvm_send_cmd_pdu_status(mvm, ADD_STA, sizeof(sta_cmd),
-                                           &sta_cmd, status);
-}
-
-static int iwl_mvm_send_add_sta_key_cmd(struct iwl_mvm *mvm,
-                                        u32 flags,
-                                        struct iwl_mvm_add_sta_key_cmd *cmd,
-                                        u32 mac_id_n_color)
-{
-        struct iwl_mvm_add_sta_cmd_v5 sta_cmd;
-
-        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_STA_KEY_CMD)
-                return iwl_mvm_send_cmd_pdu(mvm, ADD_STA_KEY, flags,
-                                            sizeof(*cmd), cmd);
-
-        iwl_mvm_add_sta_key_to_add_sta_cmd_v5(cmd, &sta_cmd, mac_id_n_color);
-
-        return iwl_mvm_send_cmd_pdu(mvm, ADD_STA, flags, sizeof(sta_cmd),
-                                    &sta_cmd);
-}
-
 static int iwl_mvm_find_free_sta_id(struct iwl_mvm *mvm,
                                     enum nl80211_iftype iftype)
 {
@@ -207,7 +98,7 @@ int iwl_mvm_sta_send_to_fw(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                            bool update)
 {
         struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
-        struct iwl_mvm_add_sta_cmd_v7 add_sta_cmd;
+        struct iwl_mvm_add_sta_cmd add_sta_cmd;
         int ret;
         u32 status;
         u32 agg_size = 0, mpdu_dens = 0;
@@ -295,7 +186,8 @@ int iwl_mvm_sta_send_to_fw(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                 cpu_to_le32(mpdu_dens << STA_FLG_AGG_MPDU_DENS_SHIFT);
 
         status = ADD_STA_SUCCESS;
-        ret = iwl_mvm_send_add_sta_cmd_status(mvm, &add_sta_cmd, &status);
+        ret = iwl_mvm_send_cmd_pdu_status(mvm, ADD_STA, sizeof(add_sta_cmd),
+                                          &add_sta_cmd, &status);
         if (ret)
                 return ret;
 
@@ -380,7 +272,7 @@ int iwl_mvm_update_sta(struct iwl_mvm *mvm,
 int iwl_mvm_drain_sta(struct iwl_mvm *mvm, struct iwl_mvm_sta *mvmsta,
                       bool drain)
 {
-        struct iwl_mvm_add_sta_cmd_v7 cmd = {};
+        struct iwl_mvm_add_sta_cmd cmd = {};
         int ret;
         u32 status;
 
@@ -393,7 +285,8 @@ int iwl_mvm_drain_sta(struct iwl_mvm *mvm, struct iwl_mvm_sta *mvmsta,
         cmd.station_flags_msk = cpu_to_le32(STA_FLG_DRAIN_FLOW);
 
         status = ADD_STA_SUCCESS;
-        ret = iwl_mvm_send_add_sta_cmd_status(mvm, &cmd, &status);
+        ret = iwl_mvm_send_cmd_pdu_status(mvm, ADD_STA, sizeof(cmd),
+                                          &cmd, &status);
         if (ret)
                 return ret;
 
@@ -434,7 +327,7 @@ static int iwl_mvm_rm_sta_common(struct iwl_mvm *mvm, u8 sta_id)
                 return -EINVAL;
         }
 
-        ret = iwl_mvm_send_cmd_pdu(mvm, REMOVE_STA, CMD_SYNC,
+        ret = iwl_mvm_send_cmd_pdu(mvm, REMOVE_STA, 0,
                                    sizeof(rm_sta_cmd), &rm_sta_cmd);
         if (ret) {
                 IWL_ERR(mvm, "Failed to remove station. Id=%d\n", sta_id);
@@ -498,7 +391,7 @@ void iwl_mvm_sta_drained_wk(struct work_struct *wk)
                                 sta_id);
                         continue;
                 }
-                rcu_assign_pointer(mvm->fw_id_to_mac_id[sta_id], NULL);
+                RCU_INIT_POINTER(mvm->fw_id_to_mac_id[sta_id], NULL);
                 clear_bit(sta_id, mvm->sta_drained);
         }
 
@@ -520,14 +413,6 @@ int iwl_mvm_rm_sta(struct iwl_mvm *mvm,
                 /* flush its queues here since we are freeing mvm_sta */
                 ret = iwl_mvm_flush_tx_path(mvm, mvm_sta->tfd_queue_msk, true);
 
-                /*
-                 * Put a non-NULL since the fw station isn't removed.
-                 * It will be removed after the MAC will be set as
-                 * unassoc.
-                 */
-                rcu_assign_pointer(mvm->fw_id_to_mac_id[mvm_sta->sta_id],
-                                   ERR_PTR(-EINVAL));
-
                 /* if we are associated - we can't remove the AP STA now */
                 if (vif->bss_conf.assoc)
                         return ret;
@@ -557,7 +442,7 @@ int iwl_mvm_rm_sta(struct iwl_mvm *mvm,
         } else {
                 spin_unlock_bh(&mvm_sta->lock);
                 ret = iwl_mvm_rm_sta_common(mvm, mvm_sta->sta_id);
-                rcu_assign_pointer(mvm->fw_id_to_mac_id[mvm_sta->sta_id], NULL);
+                RCU_INIT_POINTER(mvm->fw_id_to_mac_id[mvm_sta->sta_id], NULL);
         }
 
         return ret;
@@ -571,7 +456,7 @@ int iwl_mvm_rm_sta_id(struct iwl_mvm *mvm,
 
         lockdep_assert_held(&mvm->mutex);
 
-        rcu_assign_pointer(mvm->fw_id_to_mac_id[sta_id], NULL);
+        RCU_INIT_POINTER(mvm->fw_id_to_mac_id[sta_id], NULL);
         return ret;
 }
 
@@ -593,7 +478,7 @@ int iwl_mvm_allocate_int_sta(struct iwl_mvm *mvm, struct iwl_mvm_int_sta *sta,
 
 void iwl_mvm_dealloc_int_sta(struct iwl_mvm *mvm, struct iwl_mvm_int_sta *sta)
 {
-        rcu_assign_pointer(mvm->fw_id_to_mac_id[sta->sta_id], NULL);
+        RCU_INIT_POINTER(mvm->fw_id_to_mac_id[sta->sta_id], NULL);
         memset(sta, 0, sizeof(struct iwl_mvm_int_sta));
         sta->sta_id = IWL_MVM_STATION_COUNT;
 }
@@ -603,13 +488,13 @@ static int iwl_mvm_add_int_sta_common(struct iwl_mvm *mvm,
                                       const u8 *addr,
                                       u16 mac_id, u16 color)
 {
-        struct iwl_mvm_add_sta_cmd_v7 cmd;
+        struct iwl_mvm_add_sta_cmd cmd;
         int ret;
         u32 status;
 
         lockdep_assert_held(&mvm->mutex);
 
-        memset(&cmd, 0, sizeof(struct iwl_mvm_add_sta_cmd_v7));
+        memset(&cmd, 0, sizeof(cmd));
         cmd.sta_id = sta->sta_id;
         cmd.mac_id_n_color = cpu_to_le32(FW_CMD_ID_AND_COLOR(mac_id,
                                                              color));
@@ -619,7 +504,8 @@ static int iwl_mvm_add_int_sta_common(struct iwl_mvm *mvm,
         if (addr)
                 memcpy(cmd.addr, addr, ETH_ALEN);
 
-        ret = iwl_mvm_send_add_sta_cmd_status(mvm, &cmd, &status);
+        ret = iwl_mvm_send_cmd_pdu_status(mvm, ADD_STA, sizeof(cmd),
+                                          &cmd, &status);
         if (ret)
                 return ret;
 
@@ -753,7 +639,7 @@ int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                        int tid, u16 ssn, bool start)
 {
         struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
-        struct iwl_mvm_add_sta_cmd_v7 cmd = {};
+        struct iwl_mvm_add_sta_cmd cmd = {};
         int ret;
         u32 status;
 
@@ -777,7 +663,8 @@ int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                                   STA_MODIFY_REMOVE_BA_TID;
 
         status = ADD_STA_SUCCESS;
-        ret = iwl_mvm_send_add_sta_cmd_status(mvm, &cmd, &status);
+        ret = iwl_mvm_send_cmd_pdu_status(mvm, ADD_STA, sizeof(cmd),
+                                          &cmd, &status);
         if (ret)
                 return ret;
 
@@ -812,7 +699,7 @@ static int iwl_mvm_sta_tx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                               int tid, u8 queue, bool start)
 {
         struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
-        struct iwl_mvm_add_sta_cmd_v7 cmd = {};
+        struct iwl_mvm_add_sta_cmd cmd = {};
         int ret;
         u32 status;
 
@@ -834,7 +721,8 @@ static int iwl_mvm_sta_tx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         cmd.tid_disable_tx = cpu_to_le16(mvm_sta->tid_disable_agg);
 
         status = ADD_STA_SUCCESS;
-        ret = iwl_mvm_send_add_sta_cmd_status(mvm, &cmd, &status);
+        ret = iwl_mvm_send_cmd_pdu_status(mvm, ADD_STA, sizeof(cmd),
+                                          &cmd, &status);
         if (ret)
                 return ret;
 
@@ -1129,12 +1017,11 @@ static int iwl_mvm_send_sta_key(struct iwl_mvm *mvm,
                                 u8 sta_id, u32 tkip_iv32, u16 *tkip_p1k,
                                 u32 cmd_flags)
 {
-        __le16 key_flags;
         struct iwl_mvm_add_sta_key_cmd cmd = {};
+        __le16 key_flags;
         int ret, status;
         u16 keyidx;
         int i;
-        u32 mac_id_n_color = mvm_sta->mac_id_n_color;
 
         keyidx = (keyconf->keyidx << STA_KEY_FLG_KEYID_POS) &
                  STA_KEY_FLG_KEYID_MSK;
@@ -1166,13 +1053,12 @@ static int iwl_mvm_send_sta_key(struct iwl_mvm *mvm,
         cmd.sta_id = sta_id;
 
         status = ADD_STA_SUCCESS;
-        if (cmd_flags == CMD_SYNC)
-                ret = iwl_mvm_send_add_sta_key_cmd_status(mvm, &cmd,
-                                                          mac_id_n_color,
-                                                          &status);
+        if (cmd_flags & CMD_ASYNC)
+                ret =  iwl_mvm_send_cmd_pdu(mvm, ADD_STA_KEY, CMD_ASYNC,
+                                            sizeof(cmd), &cmd);
         else
-                ret = iwl_mvm_send_add_sta_key_cmd(mvm, CMD_ASYNC, &cmd,
-                                                   mac_id_n_color);
+                ret = iwl_mvm_send_cmd_pdu_status(mvm, ADD_STA_KEY, sizeof(cmd),
+                                                  &cmd, &status);
 
         switch (status) {
         case ADD_STA_SUCCESS:
@@ -1225,7 +1111,7 @@ static int iwl_mvm_send_sta_igtk(struct iwl_mvm *mvm,
                        remove_key ? "removing" : "installing",
                        igtk_cmd.sta_id);
 
-        return iwl_mvm_send_cmd_pdu(mvm, MGMT_MCAST_KEY, CMD_SYNC,
+        return iwl_mvm_send_cmd_pdu(mvm, MGMT_MCAST_KEY, 0,
                                     sizeof(igtk_cmd), &igtk_cmd);
 }
 
@@ -1312,15 +1198,15 @@ int iwl_mvm_set_sta_key(struct iwl_mvm *mvm,
                 ieee80211_get_key_rx_seq(keyconf, 0, &seq);
                 ieee80211_get_tkip_rx_p1k(keyconf, addr, seq.tkip.iv32, p1k);
                 ret = iwl_mvm_send_sta_key(mvm, mvm_sta, keyconf, sta_id,
-                                           seq.tkip.iv32, p1k, CMD_SYNC);
+                                           seq.tkip.iv32, p1k, 0);
                 break;
         case WLAN_CIPHER_SUITE_CCMP:
                 ret = iwl_mvm_send_sta_key(mvm, mvm_sta, keyconf, sta_id,
-                                           0, NULL, CMD_SYNC);
+                                           0, NULL, 0);
                 break;
         default:
                 ret = iwl_mvm_send_sta_key(mvm, mvm_sta, keyconf,
-                                           sta_id, 0, NULL, CMD_SYNC);
+                                           sta_id, 0, NULL, 0);
         }
 
         if (ret)
@@ -1399,9 +1285,8 @@ int iwl_mvm_remove_sta_key(struct iwl_mvm *mvm,
         cmd.sta_id = sta_id;
 
         status = ADD_STA_SUCCESS;
-        ret = iwl_mvm_send_add_sta_key_cmd_status(mvm, &cmd,
-                                                  mvm_sta->mac_id_n_color,
-                                                  &status);
+        ret = iwl_mvm_send_cmd_pdu_status(mvm, ADD_STA_KEY, sizeof(cmd),
+                                          &cmd, &status);
 
         switch (status) {
         case ADD_STA_SUCCESS:
@@ -1448,7 +1333,7 @@ void iwl_mvm_sta_modify_ps_wake(struct iwl_mvm *mvm,
                                 struct ieee80211_sta *sta)
 {
         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
-        struct iwl_mvm_add_sta_cmd_v7 cmd = {
+        struct iwl_mvm_add_sta_cmd cmd = {
                 .add_modify = STA_MODE_MODIFY,
                 .sta_id = mvmsta->sta_id,
                 .station_flags_msk = cpu_to_le32(STA_FLG_PS),
@@ -1456,7 +1341,7 @@ void iwl_mvm_sta_modify_ps_wake(struct iwl_mvm *mvm,
         };
         int ret;
 
-        ret = iwl_mvm_send_add_sta_cmd(mvm, CMD_ASYNC, &cmd);
+        ret = iwl_mvm_send_cmd_pdu(mvm, ADD_STA, CMD_ASYNC, sizeof(cmd), &cmd);
         if (ret)
                 IWL_ERR(mvm, "Failed to send ADD_STA command (%d)\n", ret);
 }
@@ -1468,7 +1353,7 @@ void iwl_mvm_sta_modify_sleep_tx_count(struct iwl_mvm *mvm,
                                        bool agg)
 {
         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
-        struct iwl_mvm_add_sta_cmd_v7 cmd = {
+        struct iwl_mvm_add_sta_cmd cmd = {
                 .add_modify = STA_MODE_MODIFY,
                 .sta_id = mvmsta->sta_id,
                 .modify_mask = STA_MODIFY_SLEEPING_STA_TX_COUNT,
@@ -1538,7 +1423,7 @@ void iwl_mvm_sta_modify_sleep_tx_count(struct iwl_mvm *mvm,
                 cmd.sleep_state_flags |= cpu_to_le16(STA_SLEEP_STATE_UAPSD);
         }
 
-        ret = iwl_mvm_send_add_sta_cmd(mvm, CMD_ASYNC, &cmd);
+        ret = iwl_mvm_send_cmd_pdu(mvm, ADD_STA, CMD_ASYNC, sizeof(cmd), &cmd);
         if (ret)
                 IWL_ERR(mvm, "Failed to send ADD_STA command (%d)\n", ret);
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.h b/drivers/net/wireless/iwlwifi/mvm/sta.h
index 2ed84c421481..d98e8a2142b8 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.h
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.h
@@ -253,6 +253,8 @@ enum iwl_mvm_agg_state {
  *      This is basically (last acked packet++).
  * @rate_n_flags: Rate at which Tx was attempted. Holds the data between the
  *      Tx response (TX_CMD), and the block ack notification (COMPRESSED_BA).
+ * @reduced_tpc: Reduced tx power. Holds the data between the
+ *      Tx response (TX_CMD), and the block ack notification (COMPRESSED_BA).
  * @state: state of the BA agreement establishment / tear down.
  * @txq_id: Tx queue used by the BA session
  * @ssn: the first packet to be sent in AGG HW queue in Tx AGG start flow, or
@@ -265,6 +267,7 @@ struct iwl_mvm_tid_data {
         u16 next_reclaimed;
         /* The rest is Tx AGG related */
         u32 rate_n_flags;
+        u8 reduced_tpc;
         enum iwl_mvm_agg_state state;
         u16 txq_id;
         u16 ssn;
@@ -284,8 +287,6 @@ static inline u16 iwl_mvm_tid_queued(struct iwl_mvm_tid_data *tid_data)
  * @tid_disable_agg: bitmap: if bit(tid) is set, the fw won't send ampdus for
  *      tid.
  * @max_agg_bufsize: the maximal size of the AGG buffer for this station
- * @bt_reduced_txpower_dbg: debug mode in which %bt_reduced_txpower is forced
- *      by debugfs.
  * @bt_reduced_txpower: is reduced tx power enabled for this station
  * @next_status_eosp: the next reclaimed packet is a PS-Poll response and
  *      we need to signal the EOSP
@@ -306,7 +307,6 @@ struct iwl_mvm_sta {
         u32 mac_id_n_color;
         u16 tid_disable_agg;
         u8 max_agg_bufsize;
-        bool bt_reduced_txpower_dbg;
         bool bt_reduced_txpower;
         bool next_status_eosp;
         spinlock_t lock;
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
index 61331245ad93..80100f6cc12a 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
@@ -273,67 +273,10 @@ static bool iwl_mvm_time_event_response(struct iwl_notif_wait_data *notif_wait,
         return true;
 }
 
-/* used to convert from time event API v2 to v1 */
-#define TE_V2_DEP_POLICY_MSK (TE_V2_DEP_OTHER | TE_V2_DEP_TSF |\
-                             TE_V2_EVENT_SOCIOPATHIC)
-static inline u16 te_v2_get_notify(__le16 policy)
-{
-        return le16_to_cpu(policy) & TE_V2_NOTIF_MSK;
-}
-
-static inline u16 te_v2_get_dep_policy(__le16 policy)
-{
-        return (le16_to_cpu(policy) & TE_V2_DEP_POLICY_MSK) >>
-                TE_V2_PLACEMENT_POS;
-}
-
-static inline u16 te_v2_get_absence(__le16 policy)
-{
-        return (le16_to_cpu(policy) & TE_V2_ABSENCE) >> TE_V2_ABSENCE_POS;
-}
-
-static void iwl_mvm_te_v2_to_v1(const struct iwl_time_event_cmd_v2 *cmd_v2,
-                                struct iwl_time_event_cmd_v1 *cmd_v1)
-{
-        cmd_v1->id_and_color = cmd_v2->id_and_color;
-        cmd_v1->action = cmd_v2->action;
-        cmd_v1->id = cmd_v2->id;
-        cmd_v1->apply_time = cmd_v2->apply_time;
-        cmd_v1->max_delay = cmd_v2->max_delay;
-        cmd_v1->depends_on = cmd_v2->depends_on;
-        cmd_v1->interval = cmd_v2->interval;
-        cmd_v1->duration = cmd_v2->duration;
-        if (cmd_v2->repeat == TE_V2_REPEAT_ENDLESS)
-                cmd_v1->repeat = cpu_to_le32(TE_V1_REPEAT_ENDLESS);
-        else
-                cmd_v1->repeat = cpu_to_le32(cmd_v2->repeat);
-        cmd_v1->max_frags = cpu_to_le32(cmd_v2->max_frags);
-        cmd_v1->interval_reciprocal = 0; /* unused */
-
-        cmd_v1->dep_policy = cpu_to_le32(te_v2_get_dep_policy(cmd_v2->policy));
-        cmd_v1->is_present = cpu_to_le32(!te_v2_get_absence(cmd_v2->policy));
-        cmd_v1->notify = cpu_to_le32(te_v2_get_notify(cmd_v2->policy));
-}
-
-static int iwl_mvm_send_time_event_cmd(struct iwl_mvm *mvm,
-                                       const struct iwl_time_event_cmd_v2 *cmd)
-{
-        struct iwl_time_event_cmd_v1 cmd_v1;
-
-        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_TIME_EVENT_API_V2)
-                return iwl_mvm_send_cmd_pdu(mvm, TIME_EVENT_CMD, CMD_SYNC,
-                                            sizeof(*cmd), cmd);
-
-        iwl_mvm_te_v2_to_v1(cmd, &cmd_v1);
-        return iwl_mvm_send_cmd_pdu(mvm, TIME_EVENT_CMD, CMD_SYNC,
-                                    sizeof(cmd_v1), &cmd_v1);
-}
-
-
 static int iwl_mvm_time_event_send_add(struct iwl_mvm *mvm,
                                        struct ieee80211_vif *vif,
                                        struct iwl_mvm_time_event_data *te_data,
-                                       struct iwl_time_event_cmd_v2 *te_cmd)
+                                       struct iwl_time_event_cmd *te_cmd)
 {
         static const u8 time_event_response[] = { TIME_EVENT_CMD };
         struct iwl_notification_wait wait_time_event;
@@ -369,7 +312,8 @@ static int iwl_mvm_time_event_send_add(struct iwl_mvm *mvm,
                                    ARRAY_SIZE(time_event_response),
                                    iwl_mvm_time_event_response, te_data);
 
-        ret = iwl_mvm_send_time_event_cmd(mvm, te_cmd);
+        ret = iwl_mvm_send_cmd_pdu(mvm, TIME_EVENT_CMD, 0,
+                                            sizeof(*te_cmd), te_cmd);
         if (ret) {
                 IWL_ERR(mvm, "Couldn't send TIME_EVENT_CMD: %d\n", ret);
                 iwl_remove_notification(&mvm->notif_wait, &wait_time_event);
@@ -397,7 +341,7 @@ void iwl_mvm_protect_session(struct iwl_mvm *mvm,
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_mvm_time_event_data *te_data = &mvmvif->time_event_data;
-        struct iwl_time_event_cmd_v2 time_cmd = {};
+        struct iwl_time_event_cmd time_cmd = {};
 
         lockdep_assert_held(&mvm->mutex);
 
@@ -453,7 +397,7 @@ void iwl_mvm_remove_time_event(struct iwl_mvm *mvm,
                                struct iwl_mvm_vif *mvmvif,
                                struct iwl_mvm_time_event_data *te_data)
 {
-        struct iwl_time_event_cmd_v2 time_cmd = {};
+        struct iwl_time_event_cmd time_cmd = {};
         u32 id, uid;
         int ret;
 
@@ -490,7 +434,8 @@ void iwl_mvm_remove_time_event(struct iwl_mvm *mvm,
                 cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id, mvmvif->color));
 
         IWL_DEBUG_TE(mvm, "Removing TE 0x%x\n", le32_to_cpu(time_cmd.id));
-        ret = iwl_mvm_send_time_event_cmd(mvm, &time_cmd);
+        ret = iwl_mvm_send_cmd_pdu(mvm, TIME_EVENT_CMD, 0,
+                                   sizeof(time_cmd), &time_cmd);
         if (WARN_ON(ret))
                 return;
 }
@@ -510,7 +455,7 @@ int iwl_mvm_start_p2p_roc(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_mvm_time_event_data *te_data = &mvmvif->time_event_data;
-        struct iwl_time_event_cmd_v2 time_cmd = {};
+        struct iwl_time_event_cmd time_cmd = {};
 
         lockdep_assert_held(&mvm->mutex);
         if (te_data->running) {
diff --git a/drivers/net/wireless/iwlwifi/mvm/tt.c b/drivers/net/wireless/iwlwifi/mvm/tt.c
index 7a99fa361954..868561512783 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tt.c
@@ -409,7 +409,6 @@ void iwl_mvm_tt_tx_backoff(struct iwl_mvm *mvm, u32 backoff)
                 .id = REPLY_THERMAL_MNG_BACKOFF,
                 .len = { sizeof(u32), },
                 .data = { &backoff, },
-                .flags = CMD_SYNC,
         };
 
         backoff = max(backoff, mvm->thermal_throttle.min_backoff);
@@ -468,13 +467,14 @@ void iwl_mvm_tt_handler(struct iwl_mvm *mvm)
         }
 
         if (params->support_tx_backoff) {
-                tx_backoff = 0;
+                tx_backoff = tt->min_backoff;
                 for (i = 0; i < TT_TX_BACKOFF_SIZE; i++) {
                         if (temperature < params->tx_backoff[i].temperature)
                                 break;
-                        tx_backoff = params->tx_backoff[i].backoff;
+                        tx_backoff = max(tt->min_backoff,
+                                         params->tx_backoff[i].backoff);
                 }
-                if (tx_backoff != 0)
+                if (tx_backoff != tt->min_backoff)
                         throttle_enable = true;
                 if (tt->tx_backoff != tx_backoff)
                         iwl_mvm_tt_tx_backoff(mvm, tx_backoff);
@@ -484,7 +484,8 @@ void iwl_mvm_tt_handler(struct iwl_mvm *mvm)
                 IWL_WARN(mvm,
                          "Due to high temperature thermal throttling initiated\n");
                 tt->throttle = true;
-        } else if (tt->throttle && !tt->dynamic_smps && tt->tx_backoff == 0 &&
+        } else if (tt->throttle && !tt->dynamic_smps &&
+                   tt->tx_backoff == tt->min_backoff &&
                    temperature <= params->tx_protection_exit) {
                 IWL_WARN(mvm,
                          "Temperature is back to normal thermal throttling stopped\n");
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index 879aeac46cc1..3846a6c41eb1 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -636,7 +636,11 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
                         seq_ctl = le16_to_cpu(hdr->seq_ctrl);
                 }
 
-                ieee80211_tx_status_ni(mvm->hw, skb);
+                BUILD_BUG_ON(ARRAY_SIZE(info->status.status_driver_data) < 1);
+                info->status.status_driver_data[0] =
+                                (void *)(uintptr_t)tx_resp->reduced_tpc;
+
+                ieee80211_tx_status(mvm->hw, skb);
         }
 
         if (txq_id >= mvm->first_agg_queue) {
@@ -815,6 +819,7 @@ static void iwl_mvm_rx_tx_cmd_agg(struct iwl_mvm *mvm,
                 struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
                 mvmsta->tid_data[tid].rate_n_flags =
                         le32_to_cpu(tx_resp->initial_rate);
+                mvmsta->tid_data[tid].reduced_tpc = tx_resp->reduced_tpc;
         }
 
         rcu_read_unlock();
@@ -928,6 +933,8 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
                         info->status.ampdu_len = ba_notif->txed;
                         iwl_mvm_hwrate_to_tx_status(tid_data->rate_n_flags,
                                                     info);
+                        info->status.status_driver_data[0] =
+                                (void *)(uintptr_t)tid_data->reduced_tpc;
                 }
         }
 
@@ -937,7 +944,7 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
 
         while (!skb_queue_empty(&reclaimed_skbs)) {
                 skb = __skb_dequeue(&reclaimed_skbs);
-                ieee80211_tx_status_ni(mvm->hw, skb);
+                ieee80211_tx_status(mvm->hw, skb);
         }
 
         return 0;
@@ -951,7 +958,7 @@ int iwl_mvm_flush_tx_path(struct iwl_mvm *mvm, u32 tfd_msk, bool sync)
                 .flush_ctl = cpu_to_le16(DUMP_TX_FIFO_FLUSH),
         };
 
-        u32 flags = sync ? CMD_SYNC : CMD_ASYNC;
+        u32 flags = sync ? 0 : CMD_ASYNC;
 
         ret = iwl_mvm_send_cmd_pdu(mvm, TXPATH_FLUSH, flags,
                                    sizeof(flush_cmd), &flush_cmd);
diff --git a/drivers/net/wireless/iwlwifi/mvm/utils.c b/drivers/net/wireless/iwlwifi/mvm/utils.c
index 2180902266ae..aa9fc77e8413 100644
--- a/drivers/net/wireless/iwlwifi/mvm/utils.c
+++ b/drivers/net/wireless/iwlwifi/mvm/utils.c
@@ -64,6 +64,7 @@
 
 #include "iwl-debug.h"
 #include "iwl-io.h"
+#include "iwl-prph.h"
 
 #include "mvm.h"
 #include "fw-api-rs.h"
@@ -143,7 +144,7 @@ int iwl_mvm_send_cmd_status(struct iwl_mvm *mvm, struct iwl_host_cmd *cmd,
                       "cmd flags %x", cmd->flags))
                 return -EINVAL;
 
-        cmd->flags |= CMD_SYNC | CMD_WANT_SKB;
+        cmd->flags |= CMD_WANT_SKB;
 
         ret = iwl_trans_send_cmd(mvm->trans, cmd);
         if (ret == -ERFKILL) {
@@ -469,6 +470,8 @@ void iwl_mvm_dump_nic_error_log(struct iwl_mvm *mvm)
                         mvm->status, table.valid);
         }
 
+        /* Do not change this output - scripts rely on it */
+
         IWL_ERR(mvm, "Loaded firmware version: %s\n", mvm->fw->fw_version);
 
         trace_iwlwifi_dev_ucode_error(trans->dev, table.error_id, table.tsf_low,
@@ -516,13 +519,14 @@ void iwl_mvm_dump_nic_error_log(struct iwl_mvm *mvm)
                 iwl_mvm_dump_umac_error_log(mvm);
 }
 
+#ifdef CONFIG_IWLWIFI_DEBUGFS
 void iwl_mvm_fw_error_sram_dump(struct iwl_mvm *mvm)
 {
         const struct fw_img *img;
         u32 ofs, sram_len;
         void *sram;
 
-        if (!mvm->ucode_loaded || mvm->fw_error_sram)
+        if (!mvm->ucode_loaded || mvm->fw_error_sram || mvm->fw_error_dump)
                 return;
 
         img = &mvm->fw->img[mvm->cur_ucode];
@@ -538,6 +542,48 @@ void iwl_mvm_fw_error_sram_dump(struct iwl_mvm *mvm)
         mvm->fw_error_sram_len = sram_len;
 }
 
+void iwl_mvm_fw_error_rxf_dump(struct iwl_mvm *mvm)
+{
+        int i, reg_val;
+        unsigned long flags;
+
+        if (!mvm->ucode_loaded || mvm->fw_error_rxf || mvm->fw_error_dump)
+                return;
+
+        /* reading buffer size */
+        reg_val = iwl_trans_read_prph(mvm->trans, RXF_SIZE_ADDR);
+        mvm->fw_error_rxf_len =
+                (reg_val & RXF_SIZE_BYTE_CNT_MSK) >> RXF_SIZE_BYTE_CND_POS;
+
+        /* the register holds the value divided by 128 */
+        mvm->fw_error_rxf_len = mvm->fw_error_rxf_len << 7;
+
+        if (!mvm->fw_error_rxf_len)
+                return;
+
+        mvm->fw_error_rxf =  kzalloc(mvm->fw_error_rxf_len, GFP_ATOMIC);
+        if (!mvm->fw_error_rxf) {
+                mvm->fw_error_rxf_len = 0;
+                return;
+        }
+
+        if (!iwl_trans_grab_nic_access(mvm->trans, false, &flags)) {
+                kfree(mvm->fw_error_rxf);
+                mvm->fw_error_rxf = NULL;
+                mvm->fw_error_rxf_len = 0;
+                return;
+        }
+
+        for (i = 0; i < (mvm->fw_error_rxf_len / sizeof(u32)); i++) {
+                iwl_trans_write_prph(mvm->trans, RXF_LD_FENCE_OFFSET_ADDR,
+                                     i * sizeof(u32));
+                mvm->fw_error_rxf[i] =
+                        iwl_trans_read_prph(mvm->trans, RXF_FIFO_RD_FENCE_ADDR);
+        }
+        iwl_trans_release_nic_access(mvm->trans, &flags);
+}
+#endif
+
 /**
  * iwl_mvm_send_lq_cmd() - Send link quality command
  * @init: This command is sent as part of station initialization right
@@ -553,7 +599,7 @@ int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq, bool init)
         struct iwl_host_cmd cmd = {
                 .id = LQ_CMD,
                 .len = { sizeof(struct iwl_lq_cmd), },
-                .flags = init ? CMD_SYNC : CMD_ASYNC,
+                .flags = init ? 0 : CMD_ASYNC,
                 .data = { lq, },
         };
 
@@ -604,6 +650,39 @@ void iwl_mvm_update_smps(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         ieee80211_request_smps(vif, smps_mode);
 }
 
+static void iwl_mvm_diversity_iter(void *_data, u8 *mac,
+                                   struct ieee80211_vif *vif)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        bool *result = _data;
+        int i;
+
+        for (i = 0; i < NUM_IWL_MVM_SMPS_REQ; i++) {
+                if (mvmvif->smps_requests[i] == IEEE80211_SMPS_STATIC ||
+                    mvmvif->smps_requests[i] == IEEE80211_SMPS_DYNAMIC)
+                        *result = false;
+        }
+}
+
+bool iwl_mvm_rx_diversity_allowed(struct iwl_mvm *mvm)
+{
+        bool result = true;
+
+        lockdep_assert_held(&mvm->mutex);
+
+        if (num_of_ant(mvm->fw->valid_rx_ant) == 1)
+                return false;
+
+        if (!mvm->cfg->rx_with_siso_diversity)
+                return false;
+
+        ieee80211_iterate_active_interfaces_atomic(
+                        mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
+                        iwl_mvm_diversity_iter, &result);
+
+        return result;
+}
+
 int iwl_mvm_update_low_latency(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                                bool value)
 {
@@ -623,7 +702,7 @@ int iwl_mvm_update_low_latency(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 
         iwl_mvm_bt_coex_vif_change(mvm);
 
-        return iwl_mvm_power_update_mac(mvm, vif);
+        return iwl_mvm_power_update_mac(mvm);
 }
 
 static void iwl_mvm_ll_iter(void *_data, u8 *mac, struct ieee80211_vif *vif)
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index 3d1d57f9f5bc..7091a18d5a72 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -417,7 +417,7 @@ static u64 splx_get_pwr_limit(struct iwl_trans *trans, union acpi_object *splx)
             splx->package.count != 2 ||
             splx->package.elements[0].type != ACPI_TYPE_INTEGER ||
             splx->package.elements[0].integer.value != 0) {
-                IWL_ERR(trans, "Unsupported splx structure");
+                IWL_ERR(trans, "Unsupported splx structure\n");
                 return 0;
         }
 
@@ -426,14 +426,14 @@ static u64 splx_get_pwr_limit(struct iwl_trans *trans, union acpi_object *splx)
             limits->package.count < 2 ||
             limits->package.elements[0].type != ACPI_TYPE_INTEGER ||
             limits->package.elements[1].type != ACPI_TYPE_INTEGER) {
-                IWL_ERR(trans, "Invalid limits element");
+                IWL_ERR(trans, "Invalid limits element\n");
                 return 0;
         }
 
         domain_type = &limits->package.elements[0];
         power_limit = &limits->package.elements[1];
         if (!(domain_type->integer.value & SPL_DOMAINTYPE_WIFI)) {
-                IWL_DEBUG_INFO(trans, "WiFi power is not limited");
+                IWL_DEBUG_INFO(trans, "WiFi power is not limited\n");
                 return 0;
         }
 
@@ -450,26 +450,26 @@ static void set_dflt_pwr_limit(struct iwl_trans *trans, struct pci_dev *pdev)
         pxsx_handle = ACPI_HANDLE(&pdev->dev);
         if (!pxsx_handle) {
                 IWL_DEBUG_INFO(trans,
-                               "Could not retrieve root port ACPI handle");
+                               "Could not retrieve root port ACPI handle\n");
                 return;
         }
 
         /* Get the method's handle */
         status = acpi_get_handle(pxsx_handle, (acpi_string)SPL_METHOD, &handle);
         if (ACPI_FAILURE(status)) {
-                IWL_DEBUG_INFO(trans, "SPL method not found");
+                IWL_DEBUG_INFO(trans, "SPL method not found\n");
                 return;
         }
 
         /* Call SPLC with no arguments */
         status = acpi_evaluate_object(handle, NULL, NULL, &splx);
         if (ACPI_FAILURE(status)) {
-                IWL_ERR(trans, "SPLC invocation failed (0x%x)", status);
+                IWL_ERR(trans, "SPLC invocation failed (0x%x)\n", status);
                 return;
         }
 
         trans->dflt_pwr_limit = splx_get_pwr_limit(trans, splx.pointer);
-        IWL_DEBUG_INFO(trans, "Default power limit set to %lld",
+        IWL_DEBUG_INFO(trans, "Default power limit set to %lld\n",
                        trans->dflt_pwr_limit);
         kfree(splx.pointer);
 }
diff --git a/drivers/net/wireless/iwlwifi/pcie/internal.h b/drivers/net/wireless/iwlwifi/pcie/internal.h
index 9091513ea738..6c22b23a2845 100644
--- a/drivers/net/wireless/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/iwlwifi/pcie/internal.h
@@ -102,7 +102,7 @@ struct iwl_rxq {
         u32 write_actual;
         struct list_head rx_free;
         struct list_head rx_used;
-        int need_update;
+        bool need_update;
         struct iwl_rb_status *rb_stts;
         dma_addr_t rb_stts_dma;
         spinlock_t lock;
@@ -117,21 +117,19 @@ struct iwl_dma_ptr {
 /**
  * iwl_queue_inc_wrap - increment queue index, wrap back to beginning
  * @index -- current index
- * @n_bd -- total number of entries in queue (must be power of 2)
  */
-static inline int iwl_queue_inc_wrap(int index, int n_bd)
+static inline int iwl_queue_inc_wrap(int index)
 {
-        return ++index & (n_bd - 1);
+        return ++index & (TFD_QUEUE_SIZE_MAX - 1);
 }
 
 /**
  * iwl_queue_dec_wrap - decrement queue index, wrap back to end
  * @index -- current index
- * @n_bd -- total number of entries in queue (must be power of 2)
  */
-static inline int iwl_queue_dec_wrap(int index, int n_bd)
+static inline int iwl_queue_dec_wrap(int index)
 {
-        return --index & (n_bd - 1);
+        return --index & (TFD_QUEUE_SIZE_MAX - 1);
 }
 
 struct iwl_cmd_meta {
@@ -145,13 +143,13 @@ struct iwl_cmd_meta {
  *
  * Contains common data for Rx and Tx queues.
  *
- * Note the difference between n_bd and n_window: the hardware
- * always assumes 256 descriptors, so n_bd is always 256 (unless
+ * Note the difference between TFD_QUEUE_SIZE_MAX and n_window: the hardware
+ * always assumes 256 descriptors, so TFD_QUEUE_SIZE_MAX is always 256 (unless
  * there might be HW changes in the future). For the normal TX
  * queues, n_window, which is the size of the software queue data
  * is also 256; however, for the command queue, n_window is only
  * 32 since we don't need so many commands pending. Since the HW
- * still uses 256 BDs for DMA though, n_bd stays 256. As a result,
+ * still uses 256 BDs for DMA though, TFD_QUEUE_SIZE_MAX stays 256. As a result,
  * the software buffers (in the variables @meta, @txb in struct
  * iwl_txq) only have 32 entries, while the HW buffers (@tfds in
  * the same struct) have 256.
@@ -162,7 +160,6 @@ struct iwl_cmd_meta {
  * data is a window overlayed over the HW queue.
  */
 struct iwl_queue {
-        int n_bd;              /* number of BDs in this queue */
         int write_ptr;       /* 1-st empty entry (index) host_w*/
         int read_ptr;         /* last used entry (index) host_r*/
         /* use for monitoring and recovering the stuck queue */
@@ -231,7 +228,7 @@ struct iwl_txq {
         spinlock_t lock;
         struct timer_list stuck_timer;
         struct iwl_trans_pcie *trans_pcie;
-        u8 need_update;
+        bool need_update;
         u8 active;
         bool ampdu;
 };
@@ -270,6 +267,9 @@ struct iwl_trans_pcie {
         struct iwl_trans *trans;
         struct iwl_drv *drv;
 
+        struct net_device napi_dev;
+        struct napi_struct napi;
+
         /* INT ICT Table */
         __le32 *ict_tbl;
         dma_addr_t ict_tbl_dma;
@@ -362,7 +362,7 @@ void iwl_trans_pcie_txq_enable(struct iwl_trans *trans, int txq_id, int fifo,
 void iwl_trans_pcie_txq_disable(struct iwl_trans *trans, int queue);
 int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
                       struct iwl_device_cmd *dev_cmd, int txq_id);
-void iwl_pcie_txq_inc_wr_ptr(struct iwl_trans *trans, struct iwl_txq *txq);
+void iwl_pcie_txq_check_wrptrs(struct iwl_trans *trans);
 int iwl_trans_pcie_send_hcmd(struct iwl_trans *trans, struct iwl_host_cmd *cmd);
 void iwl_pcie_hcmd_complete(struct iwl_trans *trans,
                             struct iwl_rx_cmd_buffer *rxb, int handler_status);
@@ -370,6 +370,13 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
                             struct sk_buff_head *skbs);
 void iwl_trans_pcie_tx_reset(struct iwl_trans *trans);
 
+static inline u16 iwl_pcie_tfd_tb_get_len(struct iwl_tfd *tfd, u8 idx)
+{
+        struct iwl_tfd_tb *tb = &tfd->tbs[idx];
+
+        return le16_to_cpu(tb->hi_n_len) >> 4;
+}
+
 /*****************************************************
 * Error handling
 ******************************************************/
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index fdfa3969cac9..a2698e5e062c 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -145,15 +145,13 @@ int iwl_pcie_rx_stop(struct iwl_trans *trans)
 /*
  * iwl_pcie_rxq_inc_wr_ptr - Update the write pointer for the RX queue
  */
-static void iwl_pcie_rxq_inc_wr_ptr(struct iwl_trans *trans,
-                                    struct iwl_rxq *rxq)
+static void iwl_pcie_rxq_inc_wr_ptr(struct iwl_trans *trans)
 {
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        struct iwl_rxq *rxq = &trans_pcie->rxq;
         u32 reg;
 
-        spin_lock(&rxq->lock);
-
-        if (rxq->need_update == 0)
-                goto exit_unlock;
+        lockdep_assert_held(&rxq->lock);
 
         /*
          * explicitly wake up the NIC if:
@@ -169,13 +167,27 @@ static void iwl_pcie_rxq_inc_wr_ptr(struct iwl_trans *trans,
                                        reg);
                         iwl_set_bit(trans, CSR_GP_CNTRL,
                                     CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
-                        goto exit_unlock;
+                        rxq->need_update = true;
+                        return;
                 }
         }
 
         rxq->write_actual = round_down(rxq->write, 8);
         iwl_write32(trans, FH_RSCSR_CHNL0_WPTR, rxq->write_actual);
-        rxq->need_update = 0;
+}
+
+static void iwl_pcie_rxq_check_wrptr(struct iwl_trans *trans)
+{
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        struct iwl_rxq *rxq = &trans_pcie->rxq;
+
+        spin_lock(&rxq->lock);
+
+        if (!rxq->need_update)
+                goto exit_unlock;
+
+        iwl_pcie_rxq_inc_wr_ptr(trans);
+        rxq->need_update = false;
 
  exit_unlock:
         spin_unlock(&rxq->lock);
@@ -236,9 +248,8 @@ static void iwl_pcie_rxq_restock(struct iwl_trans *trans)
          * Increment device's write pointer in multiples of 8. */
         if (rxq->write_actual != (rxq->write & ~0x7)) {
                 spin_lock(&rxq->lock);
-                rxq->need_update = 1;
+                iwl_pcie_rxq_inc_wr_ptr(trans);
                 spin_unlock(&rxq->lock);
-                iwl_pcie_rxq_inc_wr_ptr(trans, rxq);
         }
 }
 
@@ -362,20 +373,9 @@ static void iwl_pcie_rxq_free_rbs(struct iwl_trans *trans)
  * Also restock the Rx queue via iwl_pcie_rxq_restock.
  * This is called as a scheduled work item (except for during initialization)
  */
-static void iwl_pcie_rx_replenish(struct iwl_trans *trans)
-{
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-
-        iwl_pcie_rxq_alloc_rbs(trans, GFP_KERNEL);
-
-        spin_lock(&trans_pcie->irq_lock);
-        iwl_pcie_rxq_restock(trans);
-        spin_unlock(&trans_pcie->irq_lock);
-}
-
-static void iwl_pcie_rx_replenish_now(struct iwl_trans *trans)
+static void iwl_pcie_rx_replenish(struct iwl_trans *trans, gfp_t gfp)
 {
-        iwl_pcie_rxq_alloc_rbs(trans, GFP_ATOMIC);
+        iwl_pcie_rxq_alloc_rbs(trans, gfp);
 
         iwl_pcie_rxq_restock(trans);
 }
@@ -385,7 +385,7 @@ static void iwl_pcie_rx_replenish_work(struct work_struct *data)
         struct iwl_trans_pcie *trans_pcie =
             container_of(data, struct iwl_trans_pcie, rx_replenish);
 
-        iwl_pcie_rx_replenish(trans_pcie->trans);
+        iwl_pcie_rx_replenish(trans_pcie->trans, GFP_KERNEL);
 }
 
 static int iwl_pcie_rx_alloc(struct iwl_trans *trans)
@@ -521,14 +521,13 @@ int iwl_pcie_rx_init(struct iwl_trans *trans)
         memset(rxq->rb_stts, 0, sizeof(*rxq->rb_stts));
         spin_unlock(&rxq->lock);
 
-        iwl_pcie_rx_replenish(trans);
+        iwl_pcie_rx_replenish(trans, GFP_KERNEL);
 
         iwl_pcie_rx_hw_init(trans, rxq);
 
-        spin_lock(&trans_pcie->irq_lock);
-        rxq->need_update = 1;
-        iwl_pcie_rxq_inc_wr_ptr(trans, rxq);
-        spin_unlock(&trans_pcie->irq_lock);
+        spin_lock(&rxq->lock);
+        iwl_pcie_rxq_inc_wr_ptr(trans);
+        spin_unlock(&rxq->lock);
 
         return 0;
 }
@@ -673,7 +672,6 @@ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans,
         /* Reuse the page if possible. For notification packets and
          * SKBs that fail to Rx correctly, add them back into the
          * rx_free list for reuse later. */
-        spin_lock(&rxq->lock);
         if (rxb->page != NULL) {
                 rxb->page_dma =
                         dma_map_page(trans->dev, rxb->page, 0,
@@ -694,7 +692,6 @@ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans,
                 }
         } else
                 list_add_tail(&rxb->list, &rxq->rx_used);
-        spin_unlock(&rxq->lock);
 }
 
 /*
@@ -709,6 +706,8 @@ static void iwl_pcie_rx_handle(struct iwl_trans *trans)
         u32 count = 8;
         int total_empty;
 
+restart:
+        spin_lock(&rxq->lock);
         /* uCode's read index (stored in shared DRAM) indicates the last Rx
          * buffer that the driver may process (last buffer filled by ucode). */
         r = le16_to_cpu(ACCESS_ONCE(rxq->rb_stts->closed_rb_num)) & 0x0FFF;
@@ -743,18 +742,25 @@ static void iwl_pcie_rx_handle(struct iwl_trans *trans)
                         count++;
                         if (count >= 8) {
                                 rxq->read = i;
-                                iwl_pcie_rx_replenish_now(trans);
+                                spin_unlock(&rxq->lock);
+                                iwl_pcie_rx_replenish(trans, GFP_ATOMIC);
                                 count = 0;
+                                goto restart;
                         }
                 }
         }
 
         /* Backtrack one entry */
         rxq->read = i;
+        spin_unlock(&rxq->lock);
+
         if (fill_rx)
-                iwl_pcie_rx_replenish_now(trans);
+                iwl_pcie_rx_replenish(trans, GFP_ATOMIC);
         else
                 iwl_pcie_rxq_restock(trans);
+
+        if (trans_pcie->napi.poll)
+                napi_gro_flush(&trans_pcie->napi, false);
 }
 
 /*
@@ -844,7 +850,7 @@ static u32 iwl_pcie_int_cause_ict(struct iwl_trans *trans)
                                 trans_pcie->ict_index, read);
                 trans_pcie->ict_tbl[trans_pcie->ict_index] = 0;
                 trans_pcie->ict_index =
-                        iwl_queue_inc_wrap(trans_pcie->ict_index, ICT_COUNT);
+                        ((trans_pcie->ict_index + 1) & (ICT_COUNT - 1));
 
                 read = le32_to_cpu(trans_pcie->ict_tbl[trans_pcie->ict_index]);
                 trace_iwlwifi_dev_ict_read(trans->dev, trans_pcie->ict_index,
@@ -876,7 +882,6 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
         struct isr_statistics *isr_stats = &trans_pcie->isr_stats;
         u32 inta = 0;
         u32 handled = 0;
-        u32 i;
 
         lock_map_acquire(&trans->sync_cmd_lockdep_map);
 
@@ -1028,9 +1033,8 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
         /* uCode wakes up after power-down sleep */
         if (inta & CSR_INT_BIT_WAKEUP) {
                 IWL_DEBUG_ISR(trans, "Wakeup interrupt\n");
-                iwl_pcie_rxq_inc_wr_ptr(trans, &trans_pcie->rxq);
-                for (i = 0; i < trans->cfg->base_params->num_of_queues; i++)
-                        iwl_pcie_txq_inc_wr_ptr(trans, &trans_pcie->txq[i]);
+                iwl_pcie_rxq_check_wrptr(trans);
+                iwl_pcie_txq_check_wrptrs(trans);
 
                 isr_stats->wakeup++;
 
@@ -1068,8 +1072,6 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
                 iwl_write8(trans, CSR_INT_PERIODIC_REG,
                             CSR_INT_PERIODIC_DIS);
 
-                iwl_pcie_rx_handle(trans);
-
                 /*
                  * Enable periodic interrupt in 8 msec only if we received
                  * real RX interrupt (instead of just periodic int), to catch
@@ -1082,6 +1084,10 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
                                    CSR_INT_PERIODIC_ENA);
 
                 isr_stats->rx++;
+
+                local_bh_disable();
+                iwl_pcie_rx_handle(trans);
+                local_bh_enable();
         }
 
         /* This "Tx" DMA channel is used only for loading uCode */
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 2365553f1ef7..788085bc65d7 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -73,6 +73,7 @@
 #include "iwl-csr.h"
 #include "iwl-prph.h"
 #include "iwl-agn-hw.h"
+#include "iwl-fw-error-dump.h"
 #include "internal.h"
 
 static u32 iwl_trans_pcie_read_shr(struct iwl_trans *trans, u32 reg)
@@ -103,7 +104,6 @@ static void iwl_pcie_set_pwr(struct iwl_trans *trans, bool vaux)
 
 /* PCI registers */
 #define PCI_CFG_RETRY_TIMEOUT   0x041
-#define CPU1_CPU2_SEPARATOR_SECTION     0xFFFFCCCC
 
 static void iwl_pcie_apm_config(struct iwl_trans *trans)
 {
@@ -454,6 +454,7 @@ static int iwl_pcie_prepare_card_hw(struct iwl_trans *trans)
 {
         int ret;
         int t = 0;
+        int iter;
 
         IWL_DEBUG_INFO(trans, "iwl_trans_prepare_card_hw enter\n");
 
@@ -462,18 +463,23 @@ static int iwl_pcie_prepare_card_hw(struct iwl_trans *trans)
         if (ret >= 0)
                 return 0;
 
-        /* If HW is not ready, prepare the conditions to check again */
-        iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
-                    CSR_HW_IF_CONFIG_REG_PREPARE);
+        for (iter = 0; iter < 10; iter++) {
+                /* If HW is not ready, prepare the conditions to check again */
+                iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
+                            CSR_HW_IF_CONFIG_REG_PREPARE);
+
+                do {
+                        ret = iwl_pcie_set_hw_ready(trans);
+                        if (ret >= 0)
+                                return 0;
 
-        do {
-                ret = iwl_pcie_set_hw_ready(trans);
-                if (ret >= 0)
-                        return 0;
+                        usleep_range(200, 1000);
+                        t += 200;
+                } while (t < 150000);
+                msleep(25);
+        }
 
-                usleep_range(200, 1000);
-                t += 200;
-        } while (t < 150000);
+        IWL_DEBUG_INFO(trans, "got NIC after %d iterations\n", iter);
 
         return ret;
 }
@@ -1053,6 +1059,12 @@ static void iwl_trans_pcie_write_prph(struct iwl_trans *trans, u32 addr,
         iwl_trans_pcie_write32(trans, HBUS_TARG_PRPH_WDAT, val);
 }
 
+static int iwl_pcie_dummy_napi_poll(struct napi_struct *napi, int budget)
+{
+        WARN_ON(1);
+        return 0;
+}
+
 static void iwl_trans_pcie_configure(struct iwl_trans *trans,
                                      const struct iwl_trans_config *trans_cfg)
 {
@@ -1079,6 +1091,18 @@ static void iwl_trans_pcie_configure(struct iwl_trans *trans,
 
         trans_pcie->command_names = trans_cfg->command_names;
         trans_pcie->bc_table_dword = trans_cfg->bc_table_dword;
+
+        /* Initialize NAPI here - it should be before registering to mac80211
+         * in the opmode but after the HW struct is allocated.
+         * As this function may be called again in some corner cases don't
+         * do anything if NAPI was already initialized.
+         */
+        if (!trans_pcie->napi.poll && trans->op_mode->ops->napi_add) {
+                init_dummy_netdev(&trans_pcie->napi_dev);
+                iwl_op_mode_napi_add(trans->op_mode, &trans_pcie->napi,
+                                     &trans_pcie->napi_dev,
+                                     iwl_pcie_dummy_napi_poll, 64);
+        }
 }
 
 void iwl_trans_pcie_free(struct iwl_trans *trans)
@@ -1099,6 +1123,9 @@ void iwl_trans_pcie_free(struct iwl_trans *trans)
         pci_disable_device(trans_pcie->pci_dev);
         kmem_cache_destroy(trans->dev_cmd_pool);
 
+        if (trans_pcie->napi.poll)
+                netif_napi_del(&trans_pcie->napi);
+
         kfree(trans);
 }
 
@@ -1237,7 +1264,7 @@ static int iwl_trans_pcie_write_mem(struct iwl_trans *trans, u32 addr,
 
 #define IWL_FLUSH_WAIT_MS       2000
 
-static int iwl_trans_pcie_wait_txq_empty(struct iwl_trans *trans)
+static int iwl_trans_pcie_wait_txq_empty(struct iwl_trans *trans, u32 txq_bm)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_txq *txq;
@@ -1250,13 +1277,31 @@ static int iwl_trans_pcie_wait_txq_empty(struct iwl_trans *trans)
 
         /* waiting for all the tx frames complete might take a while */
         for (cnt = 0; cnt < trans->cfg->base_params->num_of_queues; cnt++) {
+                u8 wr_ptr;
+
                 if (cnt == trans_pcie->cmd_queue)
                         continue;
+                if (!test_bit(cnt, trans_pcie->queue_used))
+                        continue;
+                if (!(BIT(cnt) & txq_bm))
+                        continue;
+
+                IWL_DEBUG_TX_QUEUES(trans, "Emptying queue %d...\n", cnt);
                 txq = &trans_pcie->txq[cnt];
                 q = &txq->q;
-                while (q->read_ptr != q->write_ptr && !time_after(jiffies,
-                       now + msecs_to_jiffies(IWL_FLUSH_WAIT_MS)))
+                wr_ptr = ACCESS_ONCE(q->write_ptr);
+
+                while (q->read_ptr != ACCESS_ONCE(q->write_ptr) &&
+                       !time_after(jiffies,
+                                   now + msecs_to_jiffies(IWL_FLUSH_WAIT_MS))) {
+                        u8 write_ptr = ACCESS_ONCE(q->write_ptr);
+
+                        if (WARN_ONCE(wr_ptr != write_ptr,
+                                      "WR pointer moved while flushing %d -> %d\n",
+                                      wr_ptr, write_ptr))
+                                return -ETIMEDOUT;
                         msleep(1);
+                }
 
                 if (q->read_ptr != q->write_ptr) {
                         IWL_ERR(trans,
@@ -1264,6 +1309,7 @@ static int iwl_trans_pcie_wait_txq_empty(struct iwl_trans *trans)
                         ret = -ETIMEDOUT;
                         break;
                 }
+                IWL_DEBUG_TX_QUEUES(trans, "Queue %d is now empty.\n", cnt);
         }
 
         if (!ret)
@@ -1298,8 +1344,8 @@ static int iwl_trans_pcie_wait_txq_empty(struct iwl_trans *trans)
                 IWL_ERR(trans,
                         "Q %d is %sactive and mapped to fifo %d ra_tid 0x%04x [%d,%d]\n",
                         cnt, active ? "" : "in", fifo, tbl_dw,
-                        iwl_read_prph(trans,
-                                      SCD_QUEUE_RDPTR(cnt)) & (txq->q.n_bd - 1),
+                        iwl_read_prph(trans, SCD_QUEUE_RDPTR(cnt)) &
+                                (TFD_QUEUE_SIZE_MAX - 1),
                         iwl_read_prph(trans, SCD_QUEUE_WRPTR(cnt)));
         }
 
@@ -1630,6 +1676,61 @@ err:
         IWL_ERR(trans, "failed to create the trans debugfs entry\n");
         return -ENOMEM;
 }
+
+static u32 iwl_trans_pcie_get_cmdlen(struct iwl_tfd *tfd)
+{
+        u32 cmdlen = 0;
+        int i;
+
+        for (i = 0; i < IWL_NUM_OF_TBS; i++)
+                cmdlen += iwl_pcie_tfd_tb_get_len(tfd, i);
+
+        return cmdlen;
+}
+
+static u32 iwl_trans_pcie_dump_data(struct iwl_trans *trans,
+                                    void *buf, u32 buflen)
+{
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        struct iwl_fw_error_dump_data *data;
+        struct iwl_txq *cmdq = &trans_pcie->txq[trans_pcie->cmd_queue];
+        struct iwl_fw_error_dump_txcmd *txcmd;
+        u32 len;
+        int i, ptr;
+
+        if (!buf)
+                return sizeof(*data) +
+                       cmdq->q.n_window * (sizeof(*txcmd) +
+                                           TFD_MAX_PAYLOAD_SIZE);
+
+        len = 0;
+        data = buf;
+        data->type = cpu_to_le32(IWL_FW_ERROR_DUMP_TXCMD);
+        txcmd = (void *)data->data;
+        spin_lock_bh(&cmdq->lock);
+        ptr = cmdq->q.write_ptr;
+        for (i = 0; i < cmdq->q.n_window; i++) {
+                u8 idx = get_cmd_index(&cmdq->q, ptr);
+                u32 caplen, cmdlen;
+
+                cmdlen = iwl_trans_pcie_get_cmdlen(&cmdq->tfds[ptr]);
+                caplen = min_t(u32, TFD_MAX_PAYLOAD_SIZE, cmdlen);
+
+                if (cmdlen) {
+                        len += sizeof(*txcmd) + caplen;
+                        txcmd->cmdlen = cpu_to_le32(cmdlen);
+                        txcmd->caplen = cpu_to_le32(caplen);
+                        memcpy(txcmd->data, cmdq->entries[idx].cmd, caplen);
+                        txcmd = (void *)((u8 *)txcmd->data + caplen);
+                }
+
+                ptr = iwl_queue_dec_wrap(ptr);
+        }
+        spin_unlock_bh(&cmdq->lock);
+
+        data->len = cpu_to_le32(len);
+        return sizeof(*data) + len;
+}
 #else
 static int iwl_trans_pcie_dbgfs_register(struct iwl_trans *trans,
                                          struct dentry *dir)
@@ -1672,6 +1773,10 @@ static const struct iwl_trans_ops trans_ops_pcie = {
         .grab_nic_access = iwl_trans_pcie_grab_nic_access,
         .release_nic_access = iwl_trans_pcie_release_nic_access,
         .set_bits_mask = iwl_trans_pcie_set_bits_mask,
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        .dump_data = iwl_trans_pcie_dump_data,
+#endif
 };
 
 struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index 3b0c72c10054..038940afbdc5 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -70,20 +70,20 @@ static int iwl_queue_space(const struct iwl_queue *q)
 
         /*
          * To avoid ambiguity between empty and completely full queues, there
-         * should always be less than q->n_bd elements in the queue.
-         * If q->n_window is smaller than q->n_bd, there is no need to reserve
-         * any queue entries for this purpose.
+         * should always be less than TFD_QUEUE_SIZE_MAX elements in the queue.
+         * If q->n_window is smaller than TFD_QUEUE_SIZE_MAX, there is no need
+         * to reserve any queue entries for this purpose.
          */
-        if (q->n_window < q->n_bd)
+        if (q->n_window < TFD_QUEUE_SIZE_MAX)
                 max = q->n_window;
         else
-                max = q->n_bd - 1;
+                max = TFD_QUEUE_SIZE_MAX - 1;
 
         /*
-         * q->n_bd is a power of 2, so the following is equivalent to modulo by
-         * q->n_bd and is well defined for negative dividends.
+         * TFD_QUEUE_SIZE_MAX is a power of 2, so the following is equivalent to
+         * modulo by TFD_QUEUE_SIZE_MAX and is well defined.
          */
-        used = (q->write_ptr - q->read_ptr) & (q->n_bd - 1);
+        used = (q->write_ptr - q->read_ptr) & (TFD_QUEUE_SIZE_MAX - 1);
 
         if (WARN_ON(used > max))
                 return 0;
@@ -94,17 +94,11 @@ static int iwl_queue_space(const struct iwl_queue *q)
 /*
  * iwl_queue_init - Initialize queue's high/low-water and read/write indexes
  */
-static int iwl_queue_init(struct iwl_queue *q, int count, int slots_num, u32 id)
+static int iwl_queue_init(struct iwl_queue *q, int slots_num, u32 id)
 {
-        q->n_bd = count;
         q->n_window = slots_num;
         q->id = id;
 
-        /* count must be power-of-two size, otherwise iwl_queue_inc_wrap
-         * and iwl_queue_dec_wrap are broken. */
-        if (WARN_ON(!is_power_of_2(count)))
-                return -EINVAL;
-
         /* slots_num must be power-of-two size, otherwise
          * get_cmd_index is broken. */
         if (WARN_ON(!is_power_of_2(slots_num)))
@@ -197,17 +191,17 @@ static void iwl_pcie_txq_stuck_timer(unsigned long data)
                 IWL_ERR(trans,
                         "Q %d is %sactive and mapped to fifo %d ra_tid 0x%04x [%d,%d]\n",
                         i, active ? "" : "in", fifo, tbl_dw,
-                        iwl_read_prph(trans,
-                                      SCD_QUEUE_RDPTR(i)) & (txq->q.n_bd - 1),
+                        iwl_read_prph(trans, SCD_QUEUE_RDPTR(i)) &
+                                (TFD_QUEUE_SIZE_MAX - 1),
                         iwl_read_prph(trans, SCD_QUEUE_WRPTR(i)));
         }
 
         for (i = q->read_ptr; i != q->write_ptr;
-             i = iwl_queue_inc_wrap(i, q->n_bd))
+             i = iwl_queue_inc_wrap(i))
                 IWL_ERR(trans, "scratch %d = 0x%08x\n", i,
                         le32_to_cpu(txq->scratchbufs[i].scratch));
 
-        iwl_write_prph(trans, DEVICE_SET_NMI_REG, 1);
+        iwl_force_nmi(trans);
 }
 
 /*
@@ -287,14 +281,14 @@ static void iwl_pcie_txq_inval_byte_cnt_tbl(struct iwl_trans *trans,
 /*
  * iwl_pcie_txq_inc_wr_ptr - Send new write index to hardware
  */
-void iwl_pcie_txq_inc_wr_ptr(struct iwl_trans *trans, struct iwl_txq *txq)
+static void iwl_pcie_txq_inc_wr_ptr(struct iwl_trans *trans,
+                                    struct iwl_txq *txq)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         u32 reg = 0;
         int txq_id = txq->q.id;
 
-        if (txq->need_update == 0)
-                return;
+        lockdep_assert_held(&txq->lock);
 
         /*
          * explicitly wake up the NIC if:
@@ -317,6 +311,7 @@ void iwl_pcie_txq_inc_wr_ptr(struct iwl_trans *trans, struct iwl_txq *txq)
                                        txq_id, reg);
                         iwl_set_bit(trans, CSR_GP_CNTRL,
                                     CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
+                        txq->need_update = true;
                         return;
                 }
         }
@@ -327,8 +322,23 @@ void iwl_pcie_txq_inc_wr_ptr(struct iwl_trans *trans, struct iwl_txq *txq)
          */
         IWL_DEBUG_TX(trans, "Q:%d WR: 0x%x\n", txq_id, txq->q.write_ptr);
         iwl_write32(trans, HBUS_TARG_WRPTR, txq->q.write_ptr | (txq_id << 8));
+}
+
+void iwl_pcie_txq_check_wrptrs(struct iwl_trans *trans)
+{
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        int i;
+
+        for (i = 0; i < trans->cfg->base_params->num_of_queues; i++) {
+                struct iwl_txq *txq = &trans_pcie->txq[i];
 
-        txq->need_update = 0;
+                spin_lock_bh(&txq->lock);
+                if (trans_pcie->txq[i].need_update) {
+                        iwl_pcie_txq_inc_wr_ptr(trans, txq);
+                        trans_pcie->txq[i].need_update = false;
+                }
+                spin_unlock_bh(&txq->lock);
+        }
 }
 
 static inline dma_addr_t iwl_pcie_tfd_tb_get_addr(struct iwl_tfd *tfd, u8 idx)
@@ -343,13 +353,6 @@ static inline dma_addr_t iwl_pcie_tfd_tb_get_addr(struct iwl_tfd *tfd, u8 idx)
         return addr;
 }
 
-static inline u16 iwl_pcie_tfd_tb_get_len(struct iwl_tfd *tfd, u8 idx)
-{
-        struct iwl_tfd_tb *tb = &tfd->tbs[idx];
-
-        return le16_to_cpu(tb->hi_n_len) >> 4;
-}
-
 static inline void iwl_pcie_tfd_set_tb(struct iwl_tfd *tfd, u8 idx,
                                        dma_addr_t addr, u16 len)
 {
@@ -409,13 +412,17 @@ static void iwl_pcie_txq_free_tfd(struct iwl_trans *trans, struct iwl_txq *txq)
 {
         struct iwl_tfd *tfd_tmp = txq->tfds;
 
-        /* rd_ptr is bounded by n_bd and idx is bounded by n_window */
+        /* rd_ptr is bounded by TFD_QUEUE_SIZE_MAX and
+         * idx is bounded by n_window
+         */
         int rd_ptr = txq->q.read_ptr;
         int idx = get_cmd_index(&txq->q, rd_ptr);
 
         lockdep_assert_held(&txq->lock);
 
-        /* We have only q->n_window txq->entries, but we use q->n_bd tfds */
+        /* We have only q->n_window txq->entries, but we use
+         * TFD_QUEUE_SIZE_MAX tfds
+         */
         iwl_pcie_tfd_unmap(trans, &txq->entries[idx].meta, &tfd_tmp[rd_ptr]);
 
         /* free SKB */
@@ -436,7 +443,7 @@ static void iwl_pcie_txq_free_tfd(struct iwl_trans *trans, struct iwl_txq *txq)
 }
 
 static int iwl_pcie_txq_build_tfd(struct iwl_trans *trans, struct iwl_txq *txq,
-                                  dma_addr_t addr, u16 len, u8 reset)
+                                  dma_addr_t addr, u16 len, bool reset)
 {
         struct iwl_queue *q;
         struct iwl_tfd *tfd, *tfd_tmp;
@@ -542,15 +549,14 @@ static int iwl_pcie_txq_init(struct iwl_trans *trans, struct iwl_txq *txq,
 {
         int ret;
 
-        txq->need_update = 0;
+        txq->need_update = false;
 
         /* TFD_QUEUE_SIZE_MAX must be power-of-two size, otherwise
          * iwl_queue_inc_wrap and iwl_queue_dec_wrap are broken. */
         BUILD_BUG_ON(TFD_QUEUE_SIZE_MAX & (TFD_QUEUE_SIZE_MAX - 1));
 
         /* Initialize queue's high/low-water marks, and head/tail indexes */
-        ret = iwl_queue_init(&txq->q, TFD_QUEUE_SIZE_MAX, slots_num,
-                        txq_id);
+        ret = iwl_queue_init(&txq->q, slots_num, txq_id);
         if (ret)
                 return ret;
 
@@ -575,15 +581,12 @@ static void iwl_pcie_txq_unmap(struct iwl_trans *trans, int txq_id)
         struct iwl_txq *txq = &trans_pcie->txq[txq_id];
         struct iwl_queue *q = &txq->q;
 
-        if (!q->n_bd)
-                return;
-
         spin_lock_bh(&txq->lock);
         while (q->write_ptr != q->read_ptr) {
                 IWL_DEBUG_TX_REPLY(trans, "Q %d Free %d\n",
                                    txq_id, q->read_ptr);
                 iwl_pcie_txq_free_tfd(trans, txq);
-                q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd);
+                q->read_ptr = iwl_queue_inc_wrap(q->read_ptr);
         }
         txq->active = false;
         spin_unlock_bh(&txq->lock);
@@ -620,10 +623,12 @@ static void iwl_pcie_txq_free(struct iwl_trans *trans, int txq_id)
                 }
 
         /* De-alloc circular buffer of TFDs */
-        if (txq->q.n_bd) {
-                dma_free_coherent(dev, sizeof(struct iwl_tfd) *
-                                  txq->q.n_bd, txq->tfds, txq->q.dma_addr);
+        if (txq->tfds) {
+                dma_free_coherent(dev,
+                                  sizeof(struct iwl_tfd) * TFD_QUEUE_SIZE_MAX,
+                                  txq->tfds, txq->q.dma_addr);
                 txq->q.dma_addr = 0;
+                txq->tfds = NULL;
 
                 dma_free_coherent(dev,
                                   sizeof(*txq->scratchbufs) * txq->q.n_window,
@@ -680,7 +685,8 @@ void iwl_pcie_tx_start(struct iwl_trans *trans, u32 scd_base_addr)
         /* The chain extension of the SCD doesn't work well. This feature is
          * enabled by default by the HW, so we need to disable it manually.
          */
-        iwl_write_prph(trans, SCD_CHAINEXT_EN, 0);
+        if (trans->cfg->base_params->scd_chain_ext_wa)
+                iwl_write_prph(trans, SCD_CHAINEXT_EN, 0);
 
         iwl_trans_ac_txq_enable(trans, trans_pcie->cmd_queue,
                                 trans_pcie->cmd_fifo);
@@ -931,8 +937,7 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_txq *txq = &trans_pcie->txq[txq_id];
-        /* n_bd is usually 256 => n_bd - 1 = 0xff */
-        int tfd_num = ssn & (txq->q.n_bd - 1);
+        int tfd_num = ssn & (TFD_QUEUE_SIZE_MAX - 1);
         struct iwl_queue *q = &txq->q;
         int last_to_free;
 
@@ -956,12 +961,12 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
 
         /*Since we free until index _not_ inclusive, the one before index is
          * the last we will free. This one must be used */
-        last_to_free = iwl_queue_dec_wrap(tfd_num, q->n_bd);
+        last_to_free = iwl_queue_dec_wrap(tfd_num);
 
         if (!iwl_queue_used(q, last_to_free)) {
                 IWL_ERR(trans,
                         "%s: Read index for DMA queue txq id (%d), last_to_free %d is out of range [0-%d] %d %d.\n",
-                        __func__, txq_id, last_to_free, q->n_bd,
+                        __func__, txq_id, last_to_free, TFD_QUEUE_SIZE_MAX,
                         q->write_ptr, q->read_ptr);
                 goto out;
         }
@@ -971,7 +976,7 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
 
         for (;
              q->read_ptr != tfd_num;
-             q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
+             q->read_ptr = iwl_queue_inc_wrap(q->read_ptr)) {
 
                 if (WARN_ON_ONCE(txq->entries[txq->q.read_ptr].skb == NULL))
                         continue;
@@ -1010,25 +1015,26 @@ static void iwl_pcie_cmdq_reclaim(struct iwl_trans *trans, int txq_id, int idx)
 
         lockdep_assert_held(&txq->lock);
 
-        if ((idx >= q->n_bd) || (!iwl_queue_used(q, idx))) {
+        if ((idx >= TFD_QUEUE_SIZE_MAX) || (!iwl_queue_used(q, idx))) {
                 IWL_ERR(trans,
                         "%s: Read index for DMA queue txq id (%d), index %d is out of range [0-%d] %d %d.\n",
-                        __func__, txq_id, idx, q->n_bd,
+                        __func__, txq_id, idx, TFD_QUEUE_SIZE_MAX,
                         q->write_ptr, q->read_ptr);
                 return;
         }
 
-        for (idx = iwl_queue_inc_wrap(idx, q->n_bd); q->read_ptr != idx;
-             q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
+        for (idx = iwl_queue_inc_wrap(idx); q->read_ptr != idx;
+             q->read_ptr = iwl_queue_inc_wrap(q->read_ptr)) {
 
                 if (nfreed++ > 0) {
                         IWL_ERR(trans, "HCMD skipped: index (%d) %d %d\n",
                                 idx, q->write_ptr, q->read_ptr);
-                        iwl_write_prph(trans, DEVICE_SET_NMI_REG, 1);
+                        iwl_force_nmi(trans);
                 }
         }
 
-        if (q->read_ptr == q->write_ptr) {
+        if (trans->cfg->base_params->apmg_wake_up_wa &&
+            q->read_ptr == q->write_ptr) {
                 spin_lock_irqsave(&trans_pcie->reg_lock, flags);
                 WARN_ON(!trans_pcie->cmd_in_flight);
                 trans_pcie->cmd_in_flight = false;
@@ -1309,28 +1315,39 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
         cmd_pos = offsetof(struct iwl_device_cmd, payload);
         copy_size = sizeof(out_cmd->hdr);
         for (i = 0; i < IWL_MAX_CMD_TBS_PER_TFD; i++) {
-                int copy = 0;
+                int copy;
 
                 if (!cmd->len[i])
                         continue;
 
-                /* need at least IWL_HCMD_SCRATCHBUF_SIZE copied */
-                if (copy_size < IWL_HCMD_SCRATCHBUF_SIZE) {
-                        copy = IWL_HCMD_SCRATCHBUF_SIZE - copy_size;
-
-                        if (copy > cmd->len[i])
-                                copy = cmd->len[i];
-                }
-
                 /* copy everything if not nocopy/dup */
                 if (!(cmd->dataflags[i] & (IWL_HCMD_DFL_NOCOPY |
-                                           IWL_HCMD_DFL_DUP)))
+                                           IWL_HCMD_DFL_DUP))) {
                         copy = cmd->len[i];
 
-                if (copy) {
                         memcpy((u8 *)out_cmd + cmd_pos, cmd->data[i], copy);
                         cmd_pos += copy;
                         copy_size += copy;
+                        continue;
+                }
+
+                /*
+                 * Otherwise we need at least IWL_HCMD_SCRATCHBUF_SIZE copied
+                 * in total (for the scratchbuf handling), but copy up to what
+                 * we can fit into the payload for debug dump purposes.
+                 */
+                copy = min_t(int, TFD_MAX_PAYLOAD_SIZE - cmd_pos, cmd->len[i]);
+
+                memcpy((u8 *)out_cmd + cmd_pos, cmd->data[i], copy);
+                cmd_pos += copy;
+
+                /* However, treat copy_size the proper way, we need it below */
+                if (copy_size < IWL_HCMD_SCRATCHBUF_SIZE) {
+                        copy = IWL_HCMD_SCRATCHBUF_SIZE - copy_size;
+
+                        if (copy > cmd->len[i])
+                                copy = cmd->len[i];
+                        copy_size += copy;
                 }
         }
 
@@ -1345,7 +1362,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
         memcpy(&txq->scratchbufs[q->write_ptr], &out_cmd->hdr, scratch_size);
         iwl_pcie_txq_build_tfd(trans, txq,
                                iwl_pcie_get_scratchbuf_dma(txq, q->write_ptr),
-                               scratch_size, 1);
+                               scratch_size, true);
 
         /* map first command fragment, if any remains */
         if (copy_size > scratch_size) {
@@ -1361,7 +1378,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
                 }
 
                 iwl_pcie_txq_build_tfd(trans, txq, phys_addr,
-                                       copy_size - scratch_size, 0);
+                                       copy_size - scratch_size, false);
         }
 
         /* map the remaining (adjusted) nocopy/dup fragments */
@@ -1384,7 +1401,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
                         goto out;
                 }
 
-                iwl_pcie_txq_build_tfd(trans, txq, phys_addr, cmdlen[i], 0);
+                iwl_pcie_txq_build_tfd(trans, txq, phys_addr, cmdlen[i], false);
         }
 
         out_meta->flags = cmd->flags;
@@ -1392,8 +1409,6 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
                 kfree(txq->entries[idx].free_buf);
         txq->entries[idx].free_buf = dup_buf;
 
-        txq->need_update = 1;
-
         trace_iwlwifi_dev_hcmd(trans->dev, cmd, cmd_size, &out_cmd->hdr);
 
         /* start timer if queue currently empty */
@@ -1405,9 +1420,11 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
         /*
          * wake up the NIC to make sure that the firmware will see the host
          * command - we will let the NIC sleep once all the host commands
-         * returned.
+         * returned. This needs to be done only on NICs that have
+         * apmg_wake_up_wa set.
          */
-        if (!trans_pcie->cmd_in_flight) {
+        if (trans->cfg->base_params->apmg_wake_up_wa &&
+            !trans_pcie->cmd_in_flight) {
                 trans_pcie->cmd_in_flight = true;
                 __iwl_trans_pcie_set_bit(trans, CSR_GP_CNTRL,
                                          CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
@@ -1427,7 +1444,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
         }
 
         /* Increment and update queue's write index */
-        q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
+        q->write_ptr = iwl_queue_inc_wrap(q->write_ptr);
         iwl_pcie_txq_inc_wr_ptr(trans, txq);
 
         spin_unlock_irqrestore(&trans_pcie->reg_lock, flags);
@@ -1583,7 +1600,7 @@ static int iwl_pcie_send_hcmd_sync(struct iwl_trans *trans,
                                get_cmd_string(trans_pcie, cmd->id));
                 ret = -ETIMEDOUT;
 
-                iwl_write_prph(trans, DEVICE_SET_NMI_REG, 1);
+                iwl_force_nmi(trans);
                 iwl_trans_fw_error(trans);
 
                 goto cancel;
@@ -1661,7 +1678,7 @@ int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
         dma_addr_t tb0_phys, tb1_phys, scratch_phys;
         void *tb1_addr;
         u16 len, tb1_len, tb2_len;
-        u8 wait_write_ptr = 0;
+        bool wait_write_ptr;
         __le16 fc = hdr->frame_control;
         u8 hdr_len = ieee80211_hdrlen(fc);
         u16 wifi_seq;
@@ -1722,7 +1739,7 @@ int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
         memcpy(&txq->scratchbufs[q->write_ptr], &dev_cmd->hdr,
                IWL_HCMD_SCRATCHBUF_SIZE);
         iwl_pcie_txq_build_tfd(trans, txq, tb0_phys,
-                               IWL_HCMD_SCRATCHBUF_SIZE, 1);
+                               IWL_HCMD_SCRATCHBUF_SIZE, true);
 
         /* there must be data left over for TB1 or this code must be changed */
         BUILD_BUG_ON(sizeof(struct iwl_tx_cmd) < IWL_HCMD_SCRATCHBUF_SIZE);
@@ -1732,7 +1749,7 @@ int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
         tb1_phys = dma_map_single(trans->dev, tb1_addr, tb1_len, DMA_TO_DEVICE);
         if (unlikely(dma_mapping_error(trans->dev, tb1_phys)))
                 goto out_err;
-        iwl_pcie_txq_build_tfd(trans, txq, tb1_phys, tb1_len, 0);
+        iwl_pcie_txq_build_tfd(trans, txq, tb1_phys, tb1_len, false);
 
         /*
          * Set up TFD's third entry to point directly to remainder
@@ -1748,7 +1765,7 @@ int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
                                            &txq->tfds[q->write_ptr]);
                         goto out_err;
                 }
-                iwl_pcie_txq_build_tfd(trans, txq, tb2_phys, tb2_len, 0);
+                iwl_pcie_txq_build_tfd(trans, txq, tb2_phys, tb2_len, false);
         }
 
         /* Set up entry for this TFD in Tx byte-count array */
@@ -1762,12 +1779,7 @@ int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
         trace_iwlwifi_dev_tx_data(trans->dev, skb,
                                   skb->data + hdr_len, tb2_len);
 
-        if (!ieee80211_has_morefrags(fc)) {
-                txq->need_update = 1;
-        } else {
-                wait_write_ptr = 1;
-                txq->need_update = 0;
-        }
+        wait_write_ptr = ieee80211_has_morefrags(fc);
 
         /* start timer if queue currently empty */
         if (txq->need_update && q->read_ptr == q->write_ptr &&
@@ -1775,22 +1787,19 @@ int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
                 mod_timer(&txq->stuck_timer, jiffies + trans_pcie->wd_timeout);
 
         /* Tell device the write index *just past* this latest filled TFD */
-        q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
-        iwl_pcie_txq_inc_wr_ptr(trans, txq);
+        q->write_ptr = iwl_queue_inc_wrap(q->write_ptr);
+        if (!wait_write_ptr)
+                iwl_pcie_txq_inc_wr_ptr(trans, txq);
 
         /*
          * At this point the frame is "transmitted" successfully
-         * and we will get a TX status notification eventually,
-         * regardless of the value of ret. "ret" only indicates
-         * whether or not we should update the write pointer.
+         * and we will get a TX status notification eventually.
          */
         if (iwl_queue_space(q) < q->high_mark) {
-                if (wait_write_ptr) {
-                        txq->need_update = 1;
+                if (wait_write_ptr)
                         iwl_pcie_txq_inc_wr_ptr(trans, txq);
-                } else {
+                else
                         iwl_stop_queue(trans, txq);
-                }
         }
         spin_unlock(&txq->lock);
         return 0;
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index 54e344aed6e0..47a998d8f99e 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -1006,9 +1006,8 @@ struct cmd_key_material {
 } __packed;
 
 static int lbs_set_key_material(struct lbs_private *priv,
-                                int key_type,
-                                int key_info,
-                                u8 *key, u16 key_len)
+                                int key_type, int key_info,
+                                const u8 *key, u16 key_len)
 {
         struct cmd_key_material cmd;
         int ret;
@@ -1610,7 +1609,7 @@ static int lbs_cfg_del_key(struct wiphy *wiphy, struct net_device *netdev,
  */
 
 static int lbs_cfg_get_station(struct wiphy *wiphy, struct net_device *dev,
-                              u8 *mac, struct station_info *sinfo)
+                               const u8 *mac, struct station_info *sinfo)
 {
         struct lbs_private *priv = wiphy_priv(wiphy);
         s8 signal, noise;
diff --git a/drivers/net/wireless/libertas/defs.h b/drivers/net/wireless/libertas/defs.h
index ab966f08024a..407784aca627 100644
--- a/drivers/net/wireless/libertas/defs.h
+++ b/drivers/net/wireless/libertas/defs.h
@@ -90,7 +90,8 @@ do { if ((lbs_debug & (grp)) == (grp)) \
 #define lbs_deb_cfg80211(fmt, args...)  LBS_DEB_LL(LBS_DEB_CFG80211, " cfg80211", fmt, ##args)
 
 #ifdef DEBUG
-static inline void lbs_deb_hex(unsigned int grp, const char *prompt, u8 *buf, int len)
+static inline void lbs_deb_hex(unsigned int grp, const char *prompt,
+                               const u8 *buf, int len)
 {
         int i = 0;
 
diff --git a/drivers/net/wireless/libertas/rx.c b/drivers/net/wireless/libertas/rx.c
index c7366b07b568..e446fed7b345 100644
--- a/drivers/net/wireless/libertas/rx.c
+++ b/drivers/net/wireless/libertas/rx.c
@@ -71,8 +71,10 @@ int lbs_process_rxed_packet(struct lbs_private *priv, struct sk_buff *skb)
 
         skb->ip_summed = CHECKSUM_NONE;
 
-        if (priv->wdev->iftype == NL80211_IFTYPE_MONITOR)
-                return process_rxed_802_11_packet(priv, skb);
+        if (priv->wdev->iftype == NL80211_IFTYPE_MONITOR) {
+                ret = process_rxed_802_11_packet(priv, skb);
+                goto done;
+        }
 
         p_rx_pd = (struct rxpd *) skb->data;
         p_rx_pkt = (struct rxpackethdr *) ((u8 *)p_rx_pd +
@@ -86,7 +88,7 @@ int lbs_process_rxed_packet(struct lbs_private *priv, struct sk_buff *skb)
         if (skb->len < (ETH_HLEN + 8 + sizeof(struct rxpd))) {
                 lbs_deb_rx("rx err: frame received with bad length\n");
                 dev->stats.rx_length_errors++;
-                ret = 0;
+                ret = -EINVAL;
                 dev_kfree_skb(skb);
                 goto done;
         }
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 9d7a52f5a410..a312c653d116 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -1676,7 +1676,9 @@ static int mac80211_hwsim_ampdu_action(struct ieee80211_hw *hw,
         return 0;
 }
 
-static void mac80211_hwsim_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+static void mac80211_hwsim_flush(struct ieee80211_hw *hw,
+                                 struct ieee80211_vif *vif,
+                                 u32 queues, bool drop)
 {
         /* Not implemented, queues only on kernel side */
 }
@@ -2056,6 +2058,7 @@ static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
                             WIPHY_FLAG_AP_UAPSD |
                             WIPHY_FLAG_HAS_CHANNEL_SWITCH;
         hw->wiphy->features |= NL80211_FEATURE_ACTIVE_MONITOR;
+        hw->wiphy->features |= NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE;
 
         /* ask mac80211 to reserve space for magic */
         hw->vif_data_size = sizeof(struct hwsim_vif_priv);
diff --git a/drivers/net/wireless/mwifiex/11ac.c b/drivers/net/wireless/mwifiex/11ac.c
index c92f27aa71ed..706831df1fa2 100644
--- a/drivers/net/wireless/mwifiex/11ac.c
+++ b/drivers/net/wireless/mwifiex/11ac.c
@@ -212,8 +212,7 @@ int mwifiex_cmd_append_11ac_tlv(struct mwifiex_private *priv,
                                       sizeof(struct mwifiex_ie_types_header));
                         memcpy((u8 *)vht_op +
                                 sizeof(struct mwifiex_ie_types_header),
-                               (u8 *)bss_desc->bcn_vht_oper +
-                               sizeof(struct ieee_types_header),
+                               (u8 *)bss_desc->bcn_vht_oper,
                                le16_to_cpu(vht_op->header.len));
 
                         /* negotiate the channel width and central freq
diff --git a/drivers/net/wireless/mwifiex/11n.c b/drivers/net/wireless/mwifiex/11n.c
index d14ead8beca8..e1c2f67ae85e 100644
--- a/drivers/net/wireless/mwifiex/11n.c
+++ b/drivers/net/wireless/mwifiex/11n.c
@@ -345,8 +345,7 @@ mwifiex_cmd_append_11n_tlv(struct mwifiex_private *priv,
 
                         memcpy((u8 *) ht_info +
                                sizeof(struct mwifiex_ie_types_header),
-                               (u8 *) bss_desc->bcn_ht_oper +
-                               sizeof(struct ieee_types_header),
+                               (u8 *)bss_desc->bcn_ht_oper,
                                le16_to_cpu(ht_info->header.len));
 
                         if (!(sband->ht_cap.cap &
@@ -750,3 +749,45 @@ void mwifiex_set_ba_params(struct mwifiex_private *priv)
 
         return;
 }
+
+u8 mwifiex_get_sec_chan_offset(int chan)
+{
+        u8 sec_offset;
+
+        switch (chan) {
+        case 36:
+        case 44:
+        case 52:
+        case 60:
+        case 100:
+        case 108:
+        case 116:
+        case 124:
+        case 132:
+        case 140:
+        case 149:
+        case 157:
+                sec_offset = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
+                break;
+        case 40:
+        case 48:
+        case 56:
+        case 64:
+        case 104:
+        case 112:
+        case 120:
+        case 128:
+        case 136:
+        case 144:
+        case 153:
+        case 161:
+                sec_offset = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
+                break;
+        case 165:
+        default:
+                sec_offset = IEEE80211_HT_PARAM_CHA_SEC_NONE;
+                break;
+        }
+
+        return sec_offset;
+}
diff --git a/drivers/net/wireless/mwifiex/11n.h b/drivers/net/wireless/mwifiex/11n.h
index 40b007a00f4b..0b73fa08f5d4 100644
--- a/drivers/net/wireless/mwifiex/11n.h
+++ b/drivers/net/wireless/mwifiex/11n.h
@@ -63,6 +63,7 @@ int mwifiex_cmd_amsdu_aggr_ctrl(struct host_cmd_ds_command *cmd,
                                 int cmd_action,
                                 struct mwifiex_ds_11n_amsdu_aggr_ctrl *aa_ctrl);
 void mwifiex_del_tx_ba_stream_tbl_by_ra(struct mwifiex_private *priv, u8 *ra);
+u8 mwifiex_get_sec_chan_offset(int chan);
 
 static inline u8
 mwifiex_is_station_ampdu_allowed(struct mwifiex_private *priv,
@@ -199,7 +200,7 @@ static inline int mwifiex_is_sta_11n_enabled(struct mwifiex_private *priv,
 }
 
 static inline u8
-mwifiex_tdls_peer_11n_enabled(struct mwifiex_private *priv, u8 *ra)
+mwifiex_tdls_peer_11n_enabled(struct mwifiex_private *priv, const u8 *ra)
 {
         struct mwifiex_sta_node *node = mwifiex_get_sta_entry(priv, ra);
         if (node)
diff --git a/drivers/net/wireless/mwifiex/11n_aggr.c b/drivers/net/wireless/mwifiex/11n_aggr.c
index 63211707f939..5b32106182f8 100644
--- a/drivers/net/wireless/mwifiex/11n_aggr.c
+++ b/drivers/net/wireless/mwifiex/11n_aggr.c
@@ -100,6 +100,7 @@ mwifiex_11n_form_amsdu_txpd(struct mwifiex_private *priv,
                             struct sk_buff *skb)
 {
         struct txpd *local_tx_pd;
+        struct mwifiex_txinfo *tx_info = MWIFIEX_SKB_TXCB(skb);
 
         skb_push(skb, sizeof(*local_tx_pd));
 
@@ -118,6 +119,9 @@ mwifiex_11n_form_amsdu_txpd(struct mwifiex_private *priv,
         local_tx_pd->tx_pkt_length = cpu_to_le16(skb->len -
                                                  sizeof(*local_tx_pd));
 
+        if (tx_info->flags & MWIFIEX_BUF_FLAG_TDLS_PKT)
+                local_tx_pd->flags |= MWIFIEX_TXPD_FLAGS_TDLS_PACKET;
+
         if (local_tx_pd->tx_control == 0)
                 /* TxCtrl set by user or default */
                 local_tx_pd->tx_control = cpu_to_le32(priv->pkt_tx_ctrl);
@@ -160,6 +164,7 @@ mwifiex_11n_aggregate_pkt(struct mwifiex_private *priv,
         int pad = 0, ret;
         struct mwifiex_tx_param tx_param;
         struct txpd *ptx_pd = NULL;
+        struct timeval tv;
         int headroom = adapter->iface_type == MWIFIEX_USB ? 0 : INTF_HEADER_LEN;
 
         skb_src = skb_peek(&pra_list->skb_head);
@@ -182,8 +187,14 @@ mwifiex_11n_aggregate_pkt(struct mwifiex_private *priv,
 
         tx_info_aggr->bss_type = tx_info_src->bss_type;
         tx_info_aggr->bss_num = tx_info_src->bss_num;
+
+        if (tx_info_src->flags & MWIFIEX_BUF_FLAG_TDLS_PKT)
+                tx_info_aggr->flags |= MWIFIEX_BUF_FLAG_TDLS_PKT;
         skb_aggr->priority = skb_src->priority;
 
+        do_gettimeofday(&tv);
+        skb_aggr->tstamp = timeval_to_ktime(tv);
+
         do {
                 /* Check if AMSDU can accommodate this MSDU */
                 if (skb_tailroom(skb_aggr) < (skb_src->len + LLC_SNAP_LEN))
@@ -236,18 +247,11 @@ mwifiex_11n_aggregate_pkt(struct mwifiex_private *priv,
                 ret = adapter->if_ops.host_to_card(adapter, MWIFIEX_USB_EP_DATA,
                                                    skb_aggr, NULL);
         } else {
-                /*
-                 * Padding per MSDU will affect the length of next
-                 * packet and hence the exact length of next packet
-                 * is uncertain here.
-                 *
-                 * Also, aggregation of transmission buffer, while
-                 * downloading the data to the card, wont gain much
-                 * on the AMSDU packets as the AMSDU packets utilizes
-                 * the transmission buffer space to the maximum
-                 * (adapter->tx_buf_size).
-                 */
-                tx_param.next_pkt_len = 0;
+                if (skb_src)
+                        tx_param.next_pkt_len =
+                                        skb_src->len + sizeof(struct txpd);
+                else
+                        tx_param.next_pkt_len = 0;
 
                 ret = adapter->if_ops.host_to_card(adapter, MWIFIEX_TYPE_DATA,
                                                    skb_aggr, &tx_param);
diff --git a/drivers/net/wireless/mwifiex/README b/drivers/net/wireless/mwifiex/README
index b9242c3dca43..3b55ce5690a5 100644
--- a/drivers/net/wireless/mwifiex/README
+++ b/drivers/net/wireless/mwifiex/README
@@ -200,4 +200,11 @@ getlog
 
         cat getlog
 
+fw_dump
+        This command is used to dump firmware memory into files.
+        Separate file will be created for each memory segment.
+        Usage:
+
+        cat fw_dump
+
 ===============================================================================
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index 21ee27ab7b74..e95dec91a561 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -994,7 +994,7 @@ mwifiex_dump_station_info(struct mwifiex_private *priv,
  */
 static int
 mwifiex_cfg80211_get_station(struct wiphy *wiphy, struct net_device *dev,
-                             u8 *mac, struct station_info *sinfo)
+                             const u8 *mac, struct station_info *sinfo)
 {
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
 
@@ -1270,7 +1270,7 @@ static int mwifiex_cfg80211_change_beacon(struct wiphy *wiphy,
  */
 static int
 mwifiex_cfg80211_del_station(struct wiphy *wiphy, struct net_device *dev,
-                             u8 *mac)
+                             const u8 *mac)
 {
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
         struct mwifiex_sta_node *sta_node;
@@ -2629,7 +2629,7 @@ static int mwifiex_cfg80211_set_coalesce(struct wiphy *wiphy,
  */
 static int
 mwifiex_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
-                           u8 *peer, u8 action_code, u8 dialog_token,
+                           const u8 *peer, u8 action_code, u8 dialog_token,
                            u16 status_code, u32 peer_capability,
                            const u8 *extra_ies, size_t extra_ies_len)
 {
@@ -2701,7 +2701,7 @@ mwifiex_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
 
 static int
 mwifiex_cfg80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
-                           u8 *peer, enum nl80211_tdls_operation action)
+                           const u8 *peer, enum nl80211_tdls_operation action)
 {
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
 
@@ -2748,9 +2748,8 @@ mwifiex_cfg80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
 }
 
 static int
-mwifiex_cfg80211_add_station(struct wiphy *wiphy,
-                             struct net_device *dev,
-                             u8 *mac, struct station_parameters *params)
+mwifiex_cfg80211_add_station(struct wiphy *wiphy, struct net_device *dev,
+                             const u8 *mac, struct station_parameters *params)
 {
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
 
@@ -2765,9 +2764,9 @@ mwifiex_cfg80211_add_station(struct wiphy *wiphy,
 }
 
 static int
-mwifiex_cfg80211_change_station(struct wiphy *wiphy,
-                                struct net_device *dev,
-                                u8 *mac, struct station_parameters *params)
+mwifiex_cfg80211_change_station(struct wiphy *wiphy, struct net_device *dev,
+                                const u8 *mac,
+                                struct station_parameters *params)
 {
         int ret;
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index 1062c918a7bf..8dee6c86f4f1 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -955,8 +955,6 @@ mwifiex_cmd_timeout_func(unsigned long function_context)
                         adapter->cmd_wait_q.status = -ETIMEDOUT;
                         wake_up_interruptible(&adapter->cmd_wait_q.wait);
                         mwifiex_cancel_pending_ioctl(adapter);
-                        /* reset cmd_sent flag to unblock new commands */
-                        adapter->cmd_sent = false;
                 }
         }
         if (adapter->hw_status == MWIFIEX_HW_STATUS_INITIALIZING)
diff --git a/drivers/net/wireless/mwifiex/debugfs.c b/drivers/net/wireless/mwifiex/debugfs.c
index b8a49aad12fd..7b419bbcd544 100644
--- a/drivers/net/wireless/mwifiex/debugfs.c
+++ b/drivers/net/wireless/mwifiex/debugfs.c
@@ -257,6 +257,29 @@ free_and_exit:
 }
 
 /*
+ * Proc firmware dump read handler.
+ *
+ * This function is called when the 'fw_dump' file is opened for
+ * reading.
+ * This function dumps firmware memory in different files
+ * (ex. DTCM, ITCM, SQRAM etc.) based on the the segments for
+ * debugging.
+ */
+static ssize_t
+mwifiex_fw_dump_read(struct file *file, char __user *ubuf,
+                     size_t count, loff_t *ppos)
+{
+        struct mwifiex_private *priv = file->private_data;
+
+        if (!priv->adapter->if_ops.fw_dump)
+                return -EIO;
+
+        priv->adapter->if_ops.fw_dump(priv->adapter);
+
+        return 0;
+}
+
+/*
  * Proc getlog file read handler.
  *
  * This function is called when the 'getlog' file is opened for reading
@@ -699,6 +722,7 @@ static const struct file_operations mwifiex_dfs_##name##_fops = {       \
 MWIFIEX_DFS_FILE_READ_OPS(info);
 MWIFIEX_DFS_FILE_READ_OPS(debug);
 MWIFIEX_DFS_FILE_READ_OPS(getlog);
+MWIFIEX_DFS_FILE_READ_OPS(fw_dump);
 MWIFIEX_DFS_FILE_OPS(regrdwr);
 MWIFIEX_DFS_FILE_OPS(rdeeprom);
 
@@ -722,6 +746,7 @@ mwifiex_dev_debugfs_init(struct mwifiex_private *priv)
         MWIFIEX_DFS_ADD_FILE(getlog);
         MWIFIEX_DFS_ADD_FILE(regrdwr);
         MWIFIEX_DFS_ADD_FILE(rdeeprom);
+        MWIFIEX_DFS_ADD_FILE(fw_dump);
 }
 
 /*
diff --git a/drivers/net/wireless/mwifiex/decl.h b/drivers/net/wireless/mwifiex/decl.h
index e7b3e16e5d34..38da6ff6f416 100644
--- a/drivers/net/wireless/mwifiex/decl.h
+++ b/drivers/net/wireless/mwifiex/decl.h
@@ -42,12 +42,12 @@
 #define MWIFIEX_MAX_TX_BASTREAM_SUPPORTED       2
 #define MWIFIEX_MAX_RX_BASTREAM_SUPPORTED       16
 
-#define MWIFIEX_STA_AMPDU_DEF_TXWINSIZE        16
-#define MWIFIEX_STA_AMPDU_DEF_RXWINSIZE        32
+#define MWIFIEX_STA_AMPDU_DEF_TXWINSIZE        64
+#define MWIFIEX_STA_AMPDU_DEF_RXWINSIZE        64
 #define MWIFIEX_UAP_AMPDU_DEF_TXWINSIZE        32
 #define MWIFIEX_UAP_AMPDU_DEF_RXWINSIZE        16
-#define MWIFIEX_11AC_STA_AMPDU_DEF_TXWINSIZE   32
-#define MWIFIEX_11AC_STA_AMPDU_DEF_RXWINSIZE   48
+#define MWIFIEX_11AC_STA_AMPDU_DEF_TXWINSIZE   64
+#define MWIFIEX_11AC_STA_AMPDU_DEF_RXWINSIZE   64
 #define MWIFIEX_11AC_UAP_AMPDU_DEF_TXWINSIZE   48
 #define MWIFIEX_11AC_UAP_AMPDU_DEF_RXWINSIZE   32
 
diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
index b485dc1ae5eb..3175dd04834b 100644
--- a/drivers/net/wireless/mwifiex/fw.h
+++ b/drivers/net/wireless/mwifiex/fw.h
@@ -169,6 +169,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 #define TLV_TYPE_GWK_CIPHER         (PROPRIETARY_TLV_BASE_ID + 146)
 #define TLV_TYPE_COALESCE_RULE      (PROPRIETARY_TLV_BASE_ID + 154)
 #define TLV_TYPE_KEY_PARAM_V2       (PROPRIETARY_TLV_BASE_ID + 156)
+#define TLV_TYPE_TDLS_IDLE_TIMEOUT  (PROPRIETARY_TLV_BASE_ID + 194)
 #define TLV_TYPE_FW_API_REV         (PROPRIETARY_TLV_BASE_ID + 199)
 
 #define MWIFIEX_TX_DATA_BUF_SIZE_2K        2048
@@ -229,6 +230,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 #define ISENABLED_40MHZ_INTOLERANT(Dot11nDevCap) (Dot11nDevCap & BIT(8))
 #define ISSUPP_RXLDPC(Dot11nDevCap) (Dot11nDevCap & BIT(22))
 #define ISSUPP_BEAMFORMING(Dot11nDevCap) (Dot11nDevCap & BIT(30))
+#define ISALLOWED_CHANWIDTH40(ht_param) (ht_param & BIT(2))
 
 /* httxcfg bitmap
  * 0            reserved
@@ -403,7 +405,7 @@ enum P2P_MODES {
 #define HS_CFG_CANCEL                   0xffffffff
 #define HS_CFG_COND_DEF                 0x00000000
 #define HS_CFG_GPIO_DEF                 0xff
-#define HS_CFG_GAP_DEF                  0
+#define HS_CFG_GAP_DEF                  0xff
 #define HS_CFG_COND_BROADCAST_DATA      0x00000001
 #define HS_CFG_COND_UNICAST_DATA        0x00000002
 #define HS_CFG_COND_MAC_EVENT           0x00000004
@@ -487,6 +489,7 @@ enum P2P_MODES {
 #define EVENT_UAP_MIC_COUNTERMEASURES   0x0000004c
 #define EVENT_HOSTWAKE_STAIE            0x0000004d
 #define EVENT_CHANNEL_SWITCH_ANN        0x00000050
+#define EVENT_TDLS_GENERIC_EVENT        0x00000052
 #define EVENT_EXT_SCAN_REPORT           0x00000058
 #define EVENT_REMAIN_ON_CHAN_EXPIRED    0x0000005f
 
@@ -519,6 +522,7 @@ enum P2P_MODES {
 #define ACT_TDLS_DELETE            0x00
 #define ACT_TDLS_CREATE            0x01
 #define ACT_TDLS_CONFIG            0x02
+#define TDLS_EVENT_LINK_TEAR_DOWN  3
 
 #define MWIFIEX_FW_V15             15
 
@@ -535,6 +539,7 @@ struct mwifiex_ie_types_data {
 #define MWIFIEX_TxPD_POWER_MGMT_NULL_PACKET 0x01
 #define MWIFIEX_TxPD_POWER_MGMT_LAST_PACKET 0x08
 #define MWIFIEX_TXPD_FLAGS_TDLS_PACKET      0x10
+#define MWIFIEX_RXPD_FLAGS_TDLS_PACKET      0x01
 
 struct txpd {
         u8 bss_type;
@@ -577,7 +582,7 @@ struct rxpd {
          * [Bit 7] Reserved
          */
         u8 ht_info;
-        u8 reserved;
+        u8 flags;
 } __packed;
 
 struct uap_txpd {
@@ -708,6 +713,13 @@ struct mwifiex_ie_types_vendor_param_set {
         u8 ie[MWIFIEX_MAX_VSIE_LEN];
 };
 
+#define MWIFIEX_TDLS_IDLE_TIMEOUT       60
+
+struct mwifiex_ie_types_tdls_idle_timeout {
+        struct mwifiex_ie_types_header header;
+        __le16 value;
+} __packed;
+
 struct mwifiex_ie_types_rsn_param_set {
         struct mwifiex_ie_types_header header;
         u8 rsn_ie[1];
@@ -1745,6 +1757,15 @@ struct host_cmd_ds_802_11_subsc_evt {
         __le16 events;
 } __packed;
 
+struct mwifiex_tdls_generic_event {
+        __le16 type;
+        u8 peer_mac[ETH_ALEN];
+        union {
+                __le16 reason_code;
+                __le16 reserved;
+        } u;
+} __packed;
+
 struct mwifiex_ie {
         __le16 ie_index;
         __le16 mgmt_subtype_mask;
diff --git a/drivers/net/wireless/mwifiex/ioctl.h b/drivers/net/wireless/mwifiex/ioctl.h
index ee494db54060..1b576722671d 100644
--- a/drivers/net/wireless/mwifiex/ioctl.h
+++ b/drivers/net/wireless/mwifiex/ioctl.h
@@ -303,7 +303,7 @@ struct mwifiex_ds_ant_cfg {
         u32 rx_ant;
 };
 
-#define MWIFIEX_NUM_OF_CMD_BUFFER       20
+#define MWIFIEX_NUM_OF_CMD_BUFFER       50
 #define MWIFIEX_SIZE_OF_CMD_BUFFER      2048
 
 enum {
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index 9c771b3e9918..cbabc12fbda3 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -521,7 +521,6 @@ done:
                 release_firmware(adapter->firmware);
                 adapter->firmware = NULL;
         }
-        complete(&adapter->fw_load);
         if (init_failed)
                 mwifiex_free_adapter(adapter);
         up(sem);
@@ -535,7 +534,6 @@ static int mwifiex_init_hw_fw(struct mwifiex_adapter *adapter)
 {
         int ret;
 
-        init_completion(&adapter->fw_load);
         ret = request_firmware_nowait(THIS_MODULE, 1, adapter->fw_name,
                                       adapter->dev, GFP_KERNEL, adapter,
                                       mwifiex_fw_dpc);
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index d53e1e8c9467..1398afa84064 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -672,6 +672,7 @@ struct mwifiex_if_ops {
         int (*init_fw_port) (struct mwifiex_adapter *);
         int (*dnld_fw) (struct mwifiex_adapter *, struct mwifiex_fw_image *);
         void (*card_reset) (struct mwifiex_adapter *);
+        void (*fw_dump)(struct mwifiex_adapter *);
         int (*clean_pcie_ring) (struct mwifiex_adapter *adapter);
 };
 
@@ -787,7 +788,6 @@ struct mwifiex_adapter {
         struct mwifiex_wait_queue cmd_wait_q;
         u8 scan_wait_q_woken;
         spinlock_t queue_lock;          /* lock for tx queues */
-        struct completion fw_load;
         u8 country_code[IEEE80211_COUNTRY_STRING_LEN];
         u16 max_mgmt_ie_index;
         u8 scan_delay_cnt;
@@ -910,8 +910,6 @@ int mwifiex_handle_uap_rx_forward(struct mwifiex_private *priv,
                                   struct sk_buff *skb);
 int mwifiex_process_sta_event(struct mwifiex_private *);
 int mwifiex_process_uap_event(struct mwifiex_private *);
-struct mwifiex_sta_node *
-mwifiex_get_sta_entry(struct mwifiex_private *priv, u8 *mac);
 void mwifiex_delete_all_station_list(struct mwifiex_private *priv);
 void *mwifiex_process_sta_txpd(struct mwifiex_private *, struct sk_buff *skb);
 void *mwifiex_process_uap_txpd(struct mwifiex_private *, struct sk_buff *skb);
@@ -1101,7 +1099,7 @@ mwifiex_11h_get_csa_closed_channel(struct mwifiex_private *priv)
                 return 0;
 
         /* Clear csa channel, if DFS channel move time has passed */
-        if (jiffies > priv->csa_expire_time) {
+        if (time_after(jiffies, priv->csa_expire_time)) {
                 priv->csa_chan = 0;
                 priv->csa_expire_time = 0;
         }
@@ -1220,26 +1218,26 @@ void mwifiex_dnld_txpwr_table(struct mwifiex_private *priv);
 extern const struct ethtool_ops mwifiex_ethtool_ops;
 
 void mwifiex_del_all_sta_list(struct mwifiex_private *priv);
-void mwifiex_del_sta_entry(struct mwifiex_private *priv, u8 *mac);
+void mwifiex_del_sta_entry(struct mwifiex_private *priv, const u8 *mac);
 void
 mwifiex_set_sta_ht_cap(struct mwifiex_private *priv, const u8 *ies,
                        int ies_len, struct mwifiex_sta_node *node);
 struct mwifiex_sta_node *
-mwifiex_add_sta_entry(struct mwifiex_private *priv, u8 *mac);
+mwifiex_add_sta_entry(struct mwifiex_private *priv, const u8 *mac);
 struct mwifiex_sta_node *
-mwifiex_get_sta_entry(struct mwifiex_private *priv, u8 *mac);
-int mwifiex_send_tdls_data_frame(struct mwifiex_private *priv, u8 *peer,
+mwifiex_get_sta_entry(struct mwifiex_private *priv, const u8 *mac);
+int mwifiex_send_tdls_data_frame(struct mwifiex_private *priv, const u8 *peer,
                                  u8 action_code, u8 dialog_token,
                                  u16 status_code, const u8 *extra_ies,
                                  size_t extra_ies_len);
-int mwifiex_send_tdls_action_frame(struct mwifiex_private *priv,
-                                 u8 *peer, u8 action_code, u8 dialog_token,
-                                 u16 status_code, const u8 *extra_ies,
-                                 size_t extra_ies_len);
+int mwifiex_send_tdls_action_frame(struct mwifiex_private *priv, const u8 *peer,
+                                   u8 action_code, u8 dialog_token,
+                                   u16 status_code, const u8 *extra_ies,
+                                   size_t extra_ies_len);
 void mwifiex_process_tdls_action_frame(struct mwifiex_private *priv,
                                        u8 *buf, int len);
-int mwifiex_tdls_oper(struct mwifiex_private *priv, u8 *peer, u8 action);
-int mwifiex_get_tdls_link_status(struct mwifiex_private *priv, u8 *mac);
+int mwifiex_tdls_oper(struct mwifiex_private *priv, const u8 *peer, u8 action);
+int mwifiex_get_tdls_link_status(struct mwifiex_private *priv, const u8 *mac);
 void mwifiex_disable_all_tdls_links(struct mwifiex_private *priv);
 bool mwifiex_is_bss_in_11ac_mode(struct mwifiex_private *priv);
 u8 mwifiex_get_center_freq_index(struct mwifiex_private *priv, u8 band,
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index a7e8b96b2d90..574d4b597468 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -221,9 +221,6 @@ static void mwifiex_pcie_remove(struct pci_dev *pdev)
         if (!adapter || !adapter->priv_num)
                 return;
 
-        /* In case driver is removed when asynchronous FW load is in progress */
-        wait_for_completion(&adapter->fw_load);
-
         if (user_rmmod) {
 #ifdef CONFIG_PM_SLEEP
                 if (adapter->is_suspended)
@@ -1074,6 +1071,7 @@ static int mwifiex_pcie_send_data_complete(struct mwifiex_adapter *adapter)
  * is mapped to PCI device memory. Tx ring pointers are advanced accordingly.
  * Download ready interrupt to FW is deffered if Tx ring is not full and
  * additional payload can be accomodated.
+ * Caller must ensure tx_param parameter to this function is not NULL.
  */
 static int
 mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb,
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index 7b3af3d29ded..45c5b3450cf5 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -29,9 +29,6 @@
 #define MWIFIEX_MAX_CHANNELS_PER_SPECIFIC_SCAN   14
 
 #define MWIFIEX_DEF_CHANNELS_PER_SCAN_CMD       4
-#define MWIFIEX_LIMIT_1_CHANNEL_PER_SCAN_CMD    15
-#define MWIFIEX_LIMIT_2_CHANNELS_PER_SCAN_CMD   27
-#define MWIFIEX_LIMIT_3_CHANNELS_PER_SCAN_CMD   35
 
 /* Memory needed to store a max sized Channel List TLV for a firmware scan */
 #define CHAN_TLV_MAX_SIZE  (sizeof(struct mwifiex_ie_types_header)         \
@@ -1055,20 +1052,10 @@ mwifiex_config_scan(struct mwifiex_private *priv,
 
         /*
          * In associated state we will reduce the number of channels scanned per
-         * scan command to avoid any traffic delay/loss. This number is decided
-         * based on total number of channels to be scanned due to constraints
-         * of command buffers.
+         * scan command to 1 to avoid any traffic delay/loss.
          */
-        if (priv->media_connected) {
-                if (chan_num < MWIFIEX_LIMIT_1_CHANNEL_PER_SCAN_CMD)
+        if (priv->media_connected)
                         *max_chan_per_scan = 1;
-                else if (chan_num < MWIFIEX_LIMIT_2_CHANNELS_PER_SCAN_CMD)
-                        *max_chan_per_scan = 2;
-                else if (chan_num < MWIFIEX_LIMIT_3_CHANNELS_PER_SCAN_CMD)
-                        *max_chan_per_scan = 3;
-                else
-                        *max_chan_per_scan = 4;
-        }
 }
 
 /*
@@ -1353,23 +1340,17 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
                                               bss_entry->beacon_buf);
                         break;
                 case WLAN_EID_BSS_COEX_2040:
-                        bss_entry->bcn_bss_co_2040 = current_ptr +
-                                sizeof(struct ieee_types_header);
-                        bss_entry->bss_co_2040_offset = (u16) (current_ptr +
-                                        sizeof(struct ieee_types_header) -
-                                                bss_entry->beacon_buf);
+                        bss_entry->bcn_bss_co_2040 = current_ptr;
+                        bss_entry->bss_co_2040_offset =
+                                (u16) (current_ptr - bss_entry->beacon_buf);
                         break;
                 case WLAN_EID_EXT_CAPABILITY:
-                        bss_entry->bcn_ext_cap = current_ptr +
-                                sizeof(struct ieee_types_header);
-                        bss_entry->ext_cap_offset = (u16) (current_ptr +
-                                        sizeof(struct ieee_types_header) -
-                                        bss_entry->beacon_buf);
+                        bss_entry->bcn_ext_cap = current_ptr;
+                        bss_entry->ext_cap_offset =
+                                (u16) (current_ptr - bss_entry->beacon_buf);
                         break;
                 case WLAN_EID_OPMODE_NOTIF:
-                        bss_entry->oper_mode =
-                                (void *)(current_ptr +
-                                         sizeof(struct ieee_types_header));
+                        bss_entry->oper_mode = (void *)current_ptr;
                         bss_entry->oper_mode_offset =
                                         (u16)((u8 *)bss_entry->oper_mode -
                                               bss_entry->beacon_buf);
@@ -1757,6 +1738,19 @@ mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info,
         return 0;
 }
 
+static void mwifiex_complete_scan(struct mwifiex_private *priv)
+{
+        struct mwifiex_adapter *adapter = priv->adapter;
+
+        if (adapter->curr_cmd->wait_q_enabled) {
+                adapter->cmd_wait_q.status = 0;
+                if (!priv->scan_request) {
+                        dev_dbg(adapter->dev, "complete internal scan\n");
+                        mwifiex_complete_cmd(adapter, adapter->curr_cmd);
+                }
+        }
+}
+
 static void mwifiex_check_next_scan_command(struct mwifiex_private *priv)
 {
         struct mwifiex_adapter *adapter = priv->adapter;
@@ -1770,16 +1764,9 @@ static void mwifiex_check_next_scan_command(struct mwifiex_private *priv)
                 adapter->scan_processing = false;
                 spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, flags);
 
-                /* Need to indicate IOCTL complete */
-                if (adapter->curr_cmd->wait_q_enabled) {
-                        adapter->cmd_wait_q.status = 0;
-                        if (!priv->scan_request) {
-                                dev_dbg(adapter->dev,
-                                        "complete internal scan\n");
-                                mwifiex_complete_cmd(adapter,
-                                                     adapter->curr_cmd);
-                        }
-                }
+                if (!adapter->ext_scan)
+                        mwifiex_complete_scan(priv);
+
                 if (priv->report_scan_result)
                         priv->report_scan_result = false;
 
@@ -1984,6 +1971,9 @@ int mwifiex_cmd_802_11_scan_ext(struct mwifiex_private *priv,
 int mwifiex_ret_802_11_scan_ext(struct mwifiex_private *priv)
 {
         dev_dbg(priv->adapter->dev, "info: EXT scan returns successfully\n");
+
+        mwifiex_complete_scan(priv);
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
index d206f04d4994..4ce3d7b33991 100644
--- a/drivers/net/wireless/mwifiex/sdio.c
+++ b/drivers/net/wireless/mwifiex/sdio.c
@@ -85,6 +85,8 @@ mwifiex_sdio_probe(struct sdio_func *func, const struct sdio_device_id *id)
                 card->supports_sdio_new_mode = data->supports_sdio_new_mode;
                 card->has_control_mask = data->has_control_mask;
                 card->tx_buf_size = data->tx_buf_size;
+                card->mp_tx_agg_buf_size = data->mp_tx_agg_buf_size;
+                card->mp_rx_agg_buf_size = data->mp_rx_agg_buf_size;
         }
 
         sdio_claim_host(func);
@@ -177,9 +179,6 @@ mwifiex_sdio_remove(struct sdio_func *func)
         if (!adapter || !adapter->priv_num)
                 return;
 
-        /* In case driver is removed when asynchronous FW load is in progress */
-        wait_for_completion(&adapter->fw_load);
-
         if (user_rmmod) {
                 if (adapter->is_suspended)
                         mwifiex_sdio_resume(adapter->dev);
@@ -1679,8 +1678,12 @@ static int mwifiex_sdio_host_to_card(struct mwifiex_adapter *adapter,
         if (ret) {
                 if (type == MWIFIEX_TYPE_CMD)
                         adapter->cmd_sent = false;
-                if (type == MWIFIEX_TYPE_DATA)
+                if (type == MWIFIEX_TYPE_DATA) {
                         adapter->data_sent = false;
+                        /* restore curr_wr_port in error cases */
+                        card->curr_wr_port = port;
+                        card->mp_wr_bitmap |= (u32)(1 << card->curr_wr_port);
+                }
         } else {
                 if (type == MWIFIEX_TYPE_DATA) {
                         if (!(card->mp_wr_bitmap & (1 << card->curr_wr_port)))
@@ -1842,8 +1845,8 @@ static int mwifiex_init_sdio(struct mwifiex_adapter *adapter)
         card->mpa_rx.len_arr = kzalloc(sizeof(*card->mpa_rx.len_arr) *
                                        card->mp_agg_pkt_limit, GFP_KERNEL);
         ret = mwifiex_alloc_sdio_mpa_buffers(adapter,
-                                             SDIO_MP_TX_AGGR_DEF_BUF_SIZE,
-                                             SDIO_MP_RX_AGGR_DEF_BUF_SIZE);
+                                             card->mp_tx_agg_buf_size,
+                                             card->mp_rx_agg_buf_size);
         if (ret) {
                 dev_err(adapter->dev, "failed to alloc sdio mp-a buffers\n");
                 kfree(card->mp_regs);
diff --git a/drivers/net/wireless/mwifiex/sdio.h b/drivers/net/wireless/mwifiex/sdio.h
index c71201b2e2a3..6eea30b43ed7 100644
--- a/drivers/net/wireless/mwifiex/sdio.h
+++ b/drivers/net/wireless/mwifiex/sdio.h
@@ -64,10 +64,8 @@
 #define UP_LD_CMD_PORT_HOST_INT_STATUS  (0x40U)
 #define DN_LD_CMD_PORT_HOST_INT_STATUS  (0x80U)
 
-#define SDIO_MP_TX_AGGR_DEF_BUF_SIZE        (8192)      /* 8K */
-
-/* Multi port RX aggregation buffer size */
-#define SDIO_MP_RX_AGGR_DEF_BUF_SIZE        (16384)     /* 16K */
+#define MWIFIEX_MP_AGGR_BUF_SIZE_16K    (16384)
+#define MWIFIEX_MP_AGGR_BUF_SIZE_32K    (32768)
 
 /* Misc. Config Register : Auto Re-enable interrupts */
 #define AUTO_RE_ENABLE_INT              BIT(4)
@@ -234,6 +232,8 @@ struct sdio_mmc_card {
         bool supports_sdio_new_mode;
         bool has_control_mask;
         u16 tx_buf_size;
+        u32 mp_tx_agg_buf_size;
+        u32 mp_rx_agg_buf_size;
 
         u32 mp_rd_bitmap;
         u32 mp_wr_bitmap;
@@ -258,6 +258,8 @@ struct mwifiex_sdio_device {
         bool supports_sdio_new_mode;
         bool has_control_mask;
         u16 tx_buf_size;
+        u32 mp_tx_agg_buf_size;
+        u32 mp_rx_agg_buf_size;
 };
 
 static const struct mwifiex_sdio_card_reg mwifiex_reg_sd87xx = {
@@ -315,6 +317,8 @@ static const struct mwifiex_sdio_device mwifiex_sdio_sd8786 = {
         .supports_sdio_new_mode = false,
         .has_control_mask = true,
         .tx_buf_size = MWIFIEX_TX_DATA_BUF_SIZE_2K,
+        .mp_tx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_16K,
+        .mp_rx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_16K,
 };
 
 static const struct mwifiex_sdio_device mwifiex_sdio_sd8787 = {
@@ -325,6 +329,8 @@ static const struct mwifiex_sdio_device mwifiex_sdio_sd8787 = {
         .supports_sdio_new_mode = false,
         .has_control_mask = true,
         .tx_buf_size = MWIFIEX_TX_DATA_BUF_SIZE_2K,
+        .mp_tx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_16K,
+        .mp_rx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_16K,
 };
 
 static const struct mwifiex_sdio_device mwifiex_sdio_sd8797 = {
@@ -335,6 +341,8 @@ static const struct mwifiex_sdio_device mwifiex_sdio_sd8797 = {
         .supports_sdio_new_mode = false,
         .has_control_mask = true,
         .tx_buf_size = MWIFIEX_TX_DATA_BUF_SIZE_2K,
+        .mp_tx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_16K,
+        .mp_rx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_16K,
 };
 
 static const struct mwifiex_sdio_device mwifiex_sdio_sd8897 = {
@@ -345,6 +353,8 @@ static const struct mwifiex_sdio_device mwifiex_sdio_sd8897 = {
         .supports_sdio_new_mode = true,
         .has_control_mask = false,
         .tx_buf_size = MWIFIEX_TX_DATA_BUF_SIZE_4K,
+        .mp_tx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_32K,
+        .mp_rx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_32K,
 };
 
 /*
diff --git a/drivers/net/wireless/mwifiex/sta_cmd.c b/drivers/net/wireless/mwifiex/sta_cmd.c
index e3cac1495cc7..88202ce0c139 100644
--- a/drivers/net/wireless/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/mwifiex/sta_cmd.c
@@ -1546,6 +1546,7 @@ mwifiex_cmd_tdls_oper(struct mwifiex_private *priv,
         struct mwifiex_ie_types_extcap *extcap;
         struct mwifiex_ie_types_vhtcap *vht_capab;
         struct mwifiex_ie_types_aid *aid;
+        struct mwifiex_ie_types_tdls_idle_timeout *timeout;
         u8 *pos, qos_info;
         u16 config_len = 0;
         struct station_parameters *params = priv->sta_params;
@@ -1643,6 +1644,12 @@ mwifiex_cmd_tdls_oper(struct mwifiex_private *priv,
                         config_len += sizeof(struct mwifiex_ie_types_aid);
                 }
 
+                timeout = (void *)(pos + config_len);
+                timeout->header.type = cpu_to_le16(TLV_TYPE_TDLS_IDLE_TIMEOUT);
+                timeout->header.len = cpu_to_le16(sizeof(timeout->value));
+                timeout->value = cpu_to_le16(MWIFIEX_TDLS_IDLE_TIMEOUT);
+                config_len += sizeof(struct mwifiex_ie_types_tdls_idle_timeout);
+
                 break;
         default:
                 dev_err(priv->adapter->dev, "Unknown TDLS operation\n");
diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c
index bfebb0144df5..577f2979ed8f 100644
--- a/drivers/net/wireless/mwifiex/sta_cmdresp.c
+++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c
@@ -865,14 +865,20 @@ static int mwifiex_ret_tdls_oper(struct mwifiex_private *priv,
 
         switch (action) {
         case ACT_TDLS_DELETE:
-                if (reason)
-                        dev_err(priv->adapter->dev,
-                                "TDLS link delete for %pM failed: reason %d\n",
-                                cmd_tdls_oper->peer_mac, reason);
-                else
+                if (reason) {
+                        if (!node || reason == TDLS_ERR_LINK_NONEXISTENT)
+                                dev_dbg(priv->adapter->dev,
+                                        "TDLS link delete for %pM failed: reason %d\n",
+                                        cmd_tdls_oper->peer_mac, reason);
+                        else
+                                dev_err(priv->adapter->dev,
+                                        "TDLS link delete for %pM failed: reason %d\n",
+                                        cmd_tdls_oper->peer_mac, reason);
+                } else {
                         dev_dbg(priv->adapter->dev,
-                                "TDLS link config for %pM successful\n",
+                                "TDLS link delete for %pM successful\n",
                                 cmd_tdls_oper->peer_mac);
+                }
                 break;
         case ACT_TDLS_CREATE:
                 if (reason) {
diff --git a/drivers/net/wireless/mwifiex/sta_event.c b/drivers/net/wireless/mwifiex/sta_event.c
index 368450cc56c7..f6395ef11a72 100644
--- a/drivers/net/wireless/mwifiex/sta_event.c
+++ b/drivers/net/wireless/mwifiex/sta_event.c
@@ -134,6 +134,46 @@ mwifiex_reset_connect_state(struct mwifiex_private *priv, u16 reason_code)
                 netif_carrier_off(priv->netdev);
 }
 
+static int mwifiex_parse_tdls_event(struct mwifiex_private *priv,
+                                    struct sk_buff *event_skb)
+{
+        int ret = 0;
+        struct mwifiex_adapter *adapter = priv->adapter;
+        struct mwifiex_sta_node *sta_ptr;
+        struct mwifiex_tdls_generic_event *tdls_evt =
+                        (void *)event_skb->data + sizeof(adapter->event_cause);
+
+        /* reserved 2 bytes are not mandatory in tdls event */
+        if (event_skb->len < (sizeof(struct mwifiex_tdls_generic_event) -
+                              sizeof(u16) - sizeof(adapter->event_cause))) {
+                dev_err(adapter->dev, "Invalid event length!\n");
+                return -1;
+        }
+
+        sta_ptr = mwifiex_get_sta_entry(priv, tdls_evt->peer_mac);
+        if (!sta_ptr) {
+                dev_err(adapter->dev, "cannot get sta entry!\n");
+                return -1;
+        }
+
+        switch (le16_to_cpu(tdls_evt->type)) {
+        case TDLS_EVENT_LINK_TEAR_DOWN:
+                cfg80211_tdls_oper_request(priv->netdev,
+                                           tdls_evt->peer_mac,
+                                           NL80211_TDLS_TEARDOWN,
+                                           le16_to_cpu(tdls_evt->u.reason_code),
+                                           GFP_KERNEL);
+                ret = mwifiex_tdls_oper(priv, tdls_evt->peer_mac,
+                                        MWIFIEX_TDLS_DISABLE_LINK);
+                queue_work(adapter->workqueue, &adapter->main_work);
+                break;
+        default:
+                break;
+        }
+
+        return ret;
+}
+
 /*
  * This function handles events generated by firmware.
  *
@@ -459,6 +499,10 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
                         false);
                 break;
 
+        case EVENT_TDLS_GENERIC_EVENT:
+                ret = mwifiex_parse_tdls_event(priv, adapter->event_skb);
+                break;
+
         default:
                 dev_dbg(adapter->dev, "event: unknown event id: %#x\n",
                         eventcause);
diff --git a/drivers/net/wireless/mwifiex/sta_rx.c b/drivers/net/wireless/mwifiex/sta_rx.c
index ed26387eccf5..8b639d7fe6df 100644
--- a/drivers/net/wireless/mwifiex/sta_rx.c
+++ b/drivers/net/wireless/mwifiex/sta_rx.c
@@ -183,6 +183,7 @@ int mwifiex_process_sta_rx_packet(struct mwifiex_private *priv,
         struct rx_packet_hdr *rx_pkt_hdr;
         u8 ta[ETH_ALEN];
         u16 rx_pkt_type, rx_pkt_offset, rx_pkt_length, seq_num;
+        struct mwifiex_sta_node *sta_ptr;
 
         local_rx_pd = (struct rxpd *) (skb->data);
         rx_pkt_type = le16_to_cpu(local_rx_pd->rx_pkt_type);
@@ -213,14 +214,25 @@ int mwifiex_process_sta_rx_packet(struct mwifiex_private *priv,
          * If the packet is not an unicast packet then send the packet
          * directly to os. Don't pass thru rx reordering
          */
-        if (!IS_11N_ENABLED(priv) ||
+        if ((!IS_11N_ENABLED(priv) &&
+             !(ISSUPP_TDLS_ENABLED(priv->adapter->fw_cap_info) &&
+               !(local_rx_pd->flags & MWIFIEX_RXPD_FLAGS_TDLS_PACKET))) ||
             !ether_addr_equal_unaligned(priv->curr_addr, rx_pkt_hdr->eth803_hdr.h_dest)) {
                 mwifiex_process_rx_packet(priv, skb);
                 return ret;
         }
 
-        if (mwifiex_queuing_ra_based(priv)) {
+        if (mwifiex_queuing_ra_based(priv) ||
+            (ISSUPP_TDLS_ENABLED(priv->adapter->fw_cap_info) &&
+             local_rx_pd->flags & MWIFIEX_RXPD_FLAGS_TDLS_PACKET)) {
                 memcpy(ta, rx_pkt_hdr->eth803_hdr.h_source, ETH_ALEN);
+                if (local_rx_pd->flags & MWIFIEX_RXPD_FLAGS_TDLS_PACKET &&
+                    local_rx_pd->priority < MAX_NUM_TID) {
+                        sta_ptr = mwifiex_get_sta_entry(priv, ta);
+                        if (sta_ptr)
+                                sta_ptr->rx_seq[local_rx_pd->priority] =
+                                              le16_to_cpu(local_rx_pd->seq_num);
+                }
         } else {
                 if (rx_pkt_type != PKT_TYPE_BAR)
                         priv->rx_seq[local_rx_pd->priority] = seq_num;
diff --git a/drivers/net/wireless/mwifiex/sta_tx.c b/drivers/net/wireless/mwifiex/sta_tx.c
index 1236a5de7bca..5fce7e78a36e 100644
--- a/drivers/net/wireless/mwifiex/sta_tx.c
+++ b/drivers/net/wireless/mwifiex/sta_tx.c
@@ -128,6 +128,7 @@ int mwifiex_send_null_packet(struct mwifiex_private *priv, u8 flags)
 {
         struct mwifiex_adapter *adapter = priv->adapter;
         struct txpd *local_tx_pd;
+        struct mwifiex_tx_param tx_param;
 /* sizeof(struct txpd) + Interface specific header */
 #define NULL_PACKET_HDR 64
         u32 data_len = NULL_PACKET_HDR;
@@ -168,8 +169,9 @@ int mwifiex_send_null_packet(struct mwifiex_private *priv, u8 flags)
                                                    skb, NULL);
         } else {
                 skb_push(skb, INTF_HEADER_LEN);
+                tx_param.next_pkt_len = 0;
                 ret = adapter->if_ops.host_to_card(adapter, MWIFIEX_TYPE_DATA,
-                                                   skb, NULL);
+                                                   skb, &tx_param);
         }
         switch (ret) {
         case -EBUSY:
diff --git a/drivers/net/wireless/mwifiex/tdls.c b/drivers/net/wireless/mwifiex/tdls.c
index 97662a1ba58c..e73034fbbde9 100644
--- a/drivers/net/wireless/mwifiex/tdls.c
+++ b/drivers/net/wireless/mwifiex/tdls.c
@@ -25,8 +25,8 @@
 #define TDLS_RESP_FIX_LEN     8
 #define TDLS_CONFIRM_FIX_LEN  6
 
-static void
-mwifiex_restore_tdls_packets(struct mwifiex_private *priv, u8 *mac, u8 status)
+static void mwifiex_restore_tdls_packets(struct mwifiex_private *priv,
+                                         const u8 *mac, u8 status)
 {
         struct mwifiex_ra_list_tbl *ra_list;
         struct list_head *tid_list;
@@ -84,7 +84,8 @@ mwifiex_restore_tdls_packets(struct mwifiex_private *priv, u8 *mac, u8 status)
         return;
 }
 
-static void mwifiex_hold_tdls_packets(struct mwifiex_private *priv, u8 *mac)
+static void mwifiex_hold_tdls_packets(struct mwifiex_private *priv,
+                                      const u8 *mac)
 {
         struct mwifiex_ra_list_tbl *ra_list;
         struct list_head *ra_list_head;
@@ -185,8 +186,50 @@ static int mwifiex_tdls_add_vht_capab(struct mwifiex_private *priv,
         return 0;
 }
 
+static int
+mwifiex_tdls_add_ht_oper(struct mwifiex_private *priv, const u8 *mac,
+                         u8 vht_enabled, struct sk_buff *skb)
+{
+        struct ieee80211_ht_operation *ht_oper;
+        struct mwifiex_sta_node *sta_ptr;
+        struct mwifiex_bssdescriptor *bss_desc =
+                                        &priv->curr_bss_params.bss_descriptor;
+        u8 *pos;
+
+        sta_ptr = mwifiex_get_sta_entry(priv, mac);
+        if (unlikely(!sta_ptr)) {
+                dev_warn(priv->adapter->dev,
+                         "TDLS peer station not found in list\n");
+                return -1;
+        }
+
+        pos = (void *)skb_put(skb, sizeof(struct ieee80211_ht_operation) + 2);
+        *pos++ = WLAN_EID_HT_OPERATION;
+        *pos++ = sizeof(struct ieee80211_ht_operation);
+        ht_oper = (void *)pos;
+
+        ht_oper->primary_chan = bss_desc->channel;
+
+        /* follow AP's channel bandwidth */
+        if (ISSUPP_CHANWIDTH40(priv->adapter->hw_dot_11n_dev_cap) &&
+            bss_desc->bcn_ht_cap &&
+            ISALLOWED_CHANWIDTH40(bss_desc->bcn_ht_oper->ht_param))
+                ht_oper->ht_param = bss_desc->bcn_ht_oper->ht_param;
+
+        if (vht_enabled) {
+                ht_oper->ht_param =
+                          mwifiex_get_sec_chan_offset(bss_desc->channel);
+                ht_oper->ht_param |= BIT(2);
+        }
+
+        memcpy(&sta_ptr->tdls_cap.ht_oper, ht_oper,
+               sizeof(struct ieee80211_ht_operation));
+
+        return 0;
+}
+
 static int mwifiex_tdls_add_vht_oper(struct mwifiex_private *priv,
-                                     u8 *mac, struct sk_buff *skb)
+                                     const u8 *mac, struct sk_buff *skb)
 {
         struct mwifiex_bssdescriptor *bss_desc;
         struct ieee80211_vht_operation *vht_oper;
@@ -325,8 +368,9 @@ static void mwifiex_tdls_add_qos_capab(struct sk_buff *skb)
 }
 
 static int mwifiex_prep_tdls_encap_data(struct mwifiex_private *priv,
-                             u8 *peer, u8 action_code, u8 dialog_token,
-                             u16 status_code, struct sk_buff *skb)
+                                        const u8 *peer, u8 action_code,
+                                        u8 dialog_token,
+                                        u16 status_code, struct sk_buff *skb)
 {
         struct ieee80211_tdls_data *tf;
         int ret;
@@ -428,6 +472,17 @@ static int mwifiex_prep_tdls_encap_data(struct mwifiex_private *priv,
                                 dev_kfree_skb_any(skb);
                                 return ret;
                         }
+                        ret = mwifiex_tdls_add_ht_oper(priv, peer, 1, skb);
+                        if (ret) {
+                                dev_kfree_skb_any(skb);
+                                return ret;
+                        }
+                } else {
+                        ret = mwifiex_tdls_add_ht_oper(priv, peer, 0, skb);
+                        if (ret) {
+                                dev_kfree_skb_any(skb);
+                                return ret;
+                        }
                 }
                 break;
 
@@ -453,7 +508,8 @@ static int mwifiex_prep_tdls_encap_data(struct mwifiex_private *priv,
 }
 
 static void
-mwifiex_tdls_add_link_ie(struct sk_buff *skb, u8 *src_addr, u8 *peer, u8 *bssid)
+mwifiex_tdls_add_link_ie(struct sk_buff *skb, const u8 *src_addr,
+                         const u8 *peer, const u8 *bssid)
 {
         struct ieee80211_tdls_lnkie *lnkid;
 
@@ -467,8 +523,8 @@ mwifiex_tdls_add_link_ie(struct sk_buff *skb, u8 *src_addr, u8 *peer, u8 *bssid)
         memcpy(lnkid->resp_sta, peer, ETH_ALEN);
 }
 
-int mwifiex_send_tdls_data_frame(struct mwifiex_private *priv,
-                                 u8 *peer, u8 action_code, u8 dialog_token,
+int mwifiex_send_tdls_data_frame(struct mwifiex_private *priv, const u8 *peer,
+                                 u8 action_code, u8 dialog_token,
                                  u16 status_code, const u8 *extra_ies,
                                  size_t extra_ies_len)
 {
@@ -560,7 +616,8 @@ int mwifiex_send_tdls_data_frame(struct mwifiex_private *priv,
 }
 
 static int
-mwifiex_construct_tdls_action_frame(struct mwifiex_private *priv, u8 *peer,
+mwifiex_construct_tdls_action_frame(struct mwifiex_private *priv,
+                                    const u8 *peer,
                                     u8 action_code, u8 dialog_token,
                                     u16 status_code, struct sk_buff *skb)
 {
@@ -638,10 +695,10 @@ mwifiex_construct_tdls_action_frame(struct mwifiex_private *priv, u8 *peer,
         return 0;
 }
 
-int mwifiex_send_tdls_action_frame(struct mwifiex_private *priv,
-                                 u8 *peer, u8 action_code, u8 dialog_token,
-                                 u16 status_code, const u8 *extra_ies,
-                                 size_t extra_ies_len)
+int mwifiex_send_tdls_action_frame(struct mwifiex_private *priv, const u8 *peer,
+                                   u8 action_code, u8 dialog_token,
+                                   u16 status_code, const u8 *extra_ies,
+                                   size_t extra_ies_len)
 {
         struct sk_buff *skb;
         struct mwifiex_txinfo *tx_info;
@@ -848,7 +905,7 @@ void mwifiex_process_tdls_action_frame(struct mwifiex_private *priv,
 }
 
 static int
-mwifiex_tdls_process_config_link(struct mwifiex_private *priv, u8 *peer)
+mwifiex_tdls_process_config_link(struct mwifiex_private *priv, const u8 *peer)
 {
         struct mwifiex_sta_node *sta_ptr;
         struct mwifiex_ds_tdls_oper tdls_oper;
@@ -869,7 +926,7 @@ mwifiex_tdls_process_config_link(struct mwifiex_private *priv, u8 *peer)
 }
 
 static int
-mwifiex_tdls_process_create_link(struct mwifiex_private *priv, u8 *peer)
+mwifiex_tdls_process_create_link(struct mwifiex_private *priv, const u8 *peer)
 {
         struct mwifiex_sta_node *sta_ptr;
         struct mwifiex_ds_tdls_oper tdls_oper;
@@ -896,7 +953,7 @@ mwifiex_tdls_process_create_link(struct mwifiex_private *priv, u8 *peer)
 }
 
 static int
-mwifiex_tdls_process_disable_link(struct mwifiex_private *priv, u8 *peer)
+mwifiex_tdls_process_disable_link(struct mwifiex_private *priv, const u8 *peer)
 {
         struct mwifiex_sta_node *sta_ptr;
         struct mwifiex_ds_tdls_oper tdls_oper;
@@ -925,7 +982,7 @@ mwifiex_tdls_process_disable_link(struct mwifiex_private *priv, u8 *peer)
 }
 
 static int
-mwifiex_tdls_process_enable_link(struct mwifiex_private *priv, u8 *peer)
+mwifiex_tdls_process_enable_link(struct mwifiex_private *priv, const u8 *peer)
 {
         struct mwifiex_sta_node *sta_ptr;
         struct ieee80211_mcs_info mcs;
@@ -982,7 +1039,7 @@ mwifiex_tdls_process_enable_link(struct mwifiex_private *priv, u8 *peer)
         return 0;
 }
 
-int mwifiex_tdls_oper(struct mwifiex_private *priv, u8 *peer, u8 action)
+int mwifiex_tdls_oper(struct mwifiex_private *priv, const u8 *peer, u8 action)
 {
         switch (action) {
         case MWIFIEX_TDLS_ENABLE_LINK:
@@ -997,7 +1054,7 @@ int mwifiex_tdls_oper(struct mwifiex_private *priv, u8 *peer, u8 action)
         return 0;
 }
 
-int mwifiex_get_tdls_link_status(struct mwifiex_private *priv, u8 *mac)
+int mwifiex_get_tdls_link_status(struct mwifiex_private *priv, const u8 *mac)
 {
         struct mwifiex_sta_node *sta_ptr;
 
diff --git a/drivers/net/wireless/mwifiex/uap_cmd.c b/drivers/net/wireless/mwifiex/uap_cmd.c
index 9be6544bdded..32643555dd2a 100644
--- a/drivers/net/wireless/mwifiex/uap_cmd.c
+++ b/drivers/net/wireless/mwifiex/uap_cmd.c
@@ -175,17 +175,19 @@ mwifiex_set_ht_params(struct mwifiex_private *priv,
                 switch (GET_RXSTBC(cap_info)) {
                 case MWIFIEX_RX_STBC1:
                         /* HT_CAP 1X1 mode */
-                        memset(&bss_cfg->ht_cap.mcs, 0xff, 1);
+                        bss_cfg->ht_cap.mcs.rx_mask[0] = 0xff;
                         break;
                 case MWIFIEX_RX_STBC12: /* fall through */
                 case MWIFIEX_RX_STBC123:
                         /* HT_CAP 2X2 mode */
-                        memset(&bss_cfg->ht_cap.mcs, 0xff, 2);
+                        bss_cfg->ht_cap.mcs.rx_mask[0] = 0xff;
+                        bss_cfg->ht_cap.mcs.rx_mask[1] = 0xff;
                         break;
                 default:
                         dev_warn(priv->adapter->dev,
                                  "Unsupported RX-STBC, default to 2x2\n");
-                        memset(&bss_cfg->ht_cap.mcs, 0xff, 2);
+                        bss_cfg->ht_cap.mcs.rx_mask[0] = 0xff;
+                        bss_cfg->ht_cap.mcs.rx_mask[1] = 0xff;
                         break;
                 }
                 priv->ap_11n_enabled = 1;
diff --git a/drivers/net/wireless/mwifiex/usb.c b/drivers/net/wireless/mwifiex/usb.c
index edbe4aff00d8..a8ce8130cfae 100644
--- a/drivers/net/wireless/mwifiex/usb.c
+++ b/drivers/net/wireless/mwifiex/usb.c
@@ -22,9 +22,9 @@
 
 #define USB_VERSION     "1.0"
 
+static u8 user_rmmod;
 static struct mwifiex_if_ops usb_ops;
 static struct semaphore add_remove_card_sem;
-static struct usb_card_rec *usb_card;
 
 static struct usb_device_id mwifiex_usb_table[] = {
         /* 8797 */
@@ -532,28 +532,38 @@ static int mwifiex_usb_resume(struct usb_interface *intf)
 static void mwifiex_usb_disconnect(struct usb_interface *intf)
 {
         struct usb_card_rec *card = usb_get_intfdata(intf);
+        struct mwifiex_adapter *adapter;
 
-        if (!card) {
-                pr_err("%s: card is NULL\n", __func__);
+        if (!card || !card->adapter) {
+                pr_err("%s: card or card->adapter is NULL\n", __func__);
                 return;
         }
 
-        mwifiex_usb_free(card);
+        adapter = card->adapter;
+        if (!adapter->priv_num)
+                return;
 
-        if (card->adapter) {
-                struct mwifiex_adapter *adapter = card->adapter;
+        if (user_rmmod) {
+#ifdef CONFIG_PM
+                if (adapter->is_suspended)
+                        mwifiex_usb_resume(intf);
+#endif
 
-                if (!adapter->priv_num)
-                        return;
+                mwifiex_deauthenticate_all(adapter);
 
-                dev_dbg(adapter->dev, "%s: removing card\n", __func__);
-                mwifiex_remove_card(adapter, &add_remove_card_sem);
+                mwifiex_init_shutdown_fw(mwifiex_get_priv(adapter,
+                                                          MWIFIEX_BSS_ROLE_ANY),
+                                         MWIFIEX_FUNC_SHUTDOWN);
         }
 
+        mwifiex_usb_free(card);
+
+        dev_dbg(adapter->dev, "%s: removing card\n", __func__);
+        mwifiex_remove_card(adapter, &add_remove_card_sem);
+
         usb_set_intfdata(intf, NULL);
         usb_put_dev(interface_to_usbdev(intf));
         kfree(card);
-        usb_card = NULL;
 
         return;
 }
@@ -565,6 +575,7 @@ static struct usb_driver mwifiex_usb_driver = {
         .id_table = mwifiex_usb_table,
         .suspend = mwifiex_usb_suspend,
         .resume = mwifiex_usb_resume,
+        .soft_unbind = 1,
 };
 
 static int mwifiex_usb_tx_init(struct mwifiex_adapter *adapter)
@@ -762,7 +773,6 @@ static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
 
         card->adapter = adapter;
         adapter->dev = &card->udev->dev;
-        usb_card = card;
 
         switch (le16_to_cpu(card->udev->descriptor.idProduct)) {
         case USB8897_PID_1:
@@ -1025,25 +1035,8 @@ static void mwifiex_usb_cleanup_module(void)
         if (!down_interruptible(&add_remove_card_sem))
                 up(&add_remove_card_sem);
 
-        if (usb_card && usb_card->adapter) {
-                struct mwifiex_adapter *adapter = usb_card->adapter;
-
-                /* In case driver is removed when asynchronous FW downloading is
-                 * in progress
-                 */
-                wait_for_completion(&adapter->fw_load);
-
-#ifdef CONFIG_PM
-                if (adapter->is_suspended)
-                        mwifiex_usb_resume(usb_card->intf);
-#endif
-
-                mwifiex_deauthenticate_all(adapter);
-
-                mwifiex_init_shutdown_fw(mwifiex_get_priv(adapter,
-                                                          MWIFIEX_BSS_ROLE_ANY),
-                                         MWIFIEX_FUNC_SHUTDOWN);
-        }
+        /* set the flag as user is removing this module */
+        user_rmmod = 1;
 
         usb_deregister(&mwifiex_usb_driver);
 }
diff --git a/drivers/net/wireless/mwifiex/util.c b/drivers/net/wireless/mwifiex/util.c
index c3824e37f3f2..6da5abf52e61 100644
--- a/drivers/net/wireless/mwifiex/util.c
+++ b/drivers/net/wireless/mwifiex/util.c
@@ -259,7 +259,7 @@ int mwifiex_complete_cmd(struct mwifiex_adapter *adapter,
  * NULL is returned if station entry is not found in associated STA list.
  */
 struct mwifiex_sta_node *
-mwifiex_get_sta_entry(struct mwifiex_private *priv, u8 *mac)
+mwifiex_get_sta_entry(struct mwifiex_private *priv, const u8 *mac)
 {
         struct mwifiex_sta_node *node;
 
@@ -280,7 +280,7 @@ mwifiex_get_sta_entry(struct mwifiex_private *priv, u8 *mac)
  * If received mac address is NULL, NULL is returned.
  */
 struct mwifiex_sta_node *
-mwifiex_add_sta_entry(struct mwifiex_private *priv, u8 *mac)
+mwifiex_add_sta_entry(struct mwifiex_private *priv, const u8 *mac)
 {
         struct mwifiex_sta_node *node;
         unsigned long flags;
@@ -332,7 +332,7 @@ mwifiex_set_sta_ht_cap(struct mwifiex_private *priv, const u8 *ies,
 }
 
 /* This function will delete a station entry from station list */
-void mwifiex_del_sta_entry(struct mwifiex_private *priv, u8 *mac)
+void mwifiex_del_sta_entry(struct mwifiex_private *priv, const u8 *mac)
 {
         struct mwifiex_sta_node *node;
         unsigned long flags;
diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c
index 0a7cc742aed7..d3671d009f6c 100644
--- a/drivers/net/wireless/mwifiex/wmm.c
+++ b/drivers/net/wireless/mwifiex/wmm.c
@@ -92,7 +92,7 @@ mwifiex_wmm_ac_debug_print(const struct ieee_types_wmm_ac_parameters *ac_param)
  * The function also initializes the list with the provided RA.
  */
 static struct mwifiex_ra_list_tbl *
-mwifiex_wmm_allocate_ralist_node(struct mwifiex_adapter *adapter, u8 *ra)
+mwifiex_wmm_allocate_ralist_node(struct mwifiex_adapter *adapter, const u8 *ra)
 {
         struct mwifiex_ra_list_tbl *ra_list;
 
@@ -139,8 +139,7 @@ static u8 mwifiex_get_random_ba_threshold(void)
  * This function allocates and adds a RA list for all TIDs
  * with the given RA.
  */
-void
-mwifiex_ralist_add(struct mwifiex_private *priv, u8 *ra)
+void mwifiex_ralist_add(struct mwifiex_private *priv, const u8 *ra)
 {
         int i;
         struct mwifiex_ra_list_tbl *ra_list;
@@ -164,6 +163,7 @@ mwifiex_ralist_add(struct mwifiex_private *priv, u8 *ra)
                 if (!mwifiex_queuing_ra_based(priv)) {
                         if (mwifiex_get_tdls_link_status(priv, ra) ==
                             TDLS_SETUP_COMPLETE) {
+                                ra_list->tdls_link = true;
                                 ra_list->is_11n_enabled =
                                         mwifiex_tdls_peer_11n_enabled(priv, ra);
                         } else {
@@ -426,15 +426,6 @@ mwifiex_wmm_init(struct mwifiex_adapter *adapter)
                                                         priv->tos_to_tid_inv[i];
                 }
 
-                priv->aggr_prio_tbl[6].amsdu
-                                        = priv->aggr_prio_tbl[6].ampdu_ap
-                                        = priv->aggr_prio_tbl[6].ampdu_user
-                                        = BA_STREAM_NOT_ALLOWED;
-
-                priv->aggr_prio_tbl[7].amsdu = priv->aggr_prio_tbl[7].ampdu_ap
-                                        = priv->aggr_prio_tbl[7].ampdu_user
-                                        = BA_STREAM_NOT_ALLOWED;
-
                 mwifiex_set_ba_params(priv);
                 mwifiex_reset_11n_rx_seq_num(priv);
 
@@ -575,7 +566,7 @@ mwifiex_clean_txrx(struct mwifiex_private *priv)
  */
 static struct mwifiex_ra_list_tbl *
 mwifiex_wmm_get_ralist_node(struct mwifiex_private *priv, u8 tid,
-                            u8 *ra_addr)
+                            const u8 *ra_addr)
 {
         struct mwifiex_ra_list_tbl *ra_list;
 
@@ -596,7 +587,8 @@ mwifiex_wmm_get_ralist_node(struct mwifiex_private *priv, u8 tid,
  * retrieved.
  */
 struct mwifiex_ra_list_tbl *
-mwifiex_wmm_get_queue_raptr(struct mwifiex_private *priv, u8 tid, u8 *ra_addr)
+mwifiex_wmm_get_queue_raptr(struct mwifiex_private *priv, u8 tid,
+                            const u8 *ra_addr)
 {
         struct mwifiex_ra_list_tbl *ra_list;
 
@@ -657,7 +649,7 @@ mwifiex_wmm_add_buf_txqueue(struct mwifiex_private *priv,
                 if (ntohs(eth_hdr->h_proto) == ETH_P_TDLS)
                         dev_dbg(adapter->dev,
                                 "TDLS setup packet for %pM. Don't block\n", ra);
-                else
+                else if (memcmp(priv->cfg_bssid, ra, ETH_ALEN))
                         tdls_status = mwifiex_get_tdls_link_status(priv, ra);
         }
 
diff --git a/drivers/net/wireless/mwifiex/wmm.h b/drivers/net/wireless/mwifiex/wmm.h
index 83e42083ebff..eca56e371a57 100644
--- a/drivers/net/wireless/mwifiex/wmm.h
+++ b/drivers/net/wireless/mwifiex/wmm.h
@@ -99,7 +99,7 @@ mwifiex_wmm_is_ra_list_empty(struct list_head *ra_list_hhead)
 
 void mwifiex_wmm_add_buf_txqueue(struct mwifiex_private *priv,
                                  struct sk_buff *skb);
-void mwifiex_ralist_add(struct mwifiex_private *priv, u8 *ra);
+void mwifiex_ralist_add(struct mwifiex_private *priv, const u8 *ra);
 void mwifiex_rotate_priolists(struct mwifiex_private *priv,
                               struct mwifiex_ra_list_tbl *ra, int tid);
 
@@ -123,7 +123,8 @@ void mwifiex_wmm_setup_ac_downgrade(struct mwifiex_private *priv);
 int mwifiex_ret_wmm_get_status(struct mwifiex_private *priv,
                                const struct host_cmd_ds_command *resp);
 struct mwifiex_ra_list_tbl *
-mwifiex_wmm_get_queue_raptr(struct mwifiex_private *priv, u8 tid, u8 *ra_addr);
+mwifiex_wmm_get_queue_raptr(struct mwifiex_private *priv, u8 tid,
+                            const u8 *ra_addr);
 u8 mwifiex_wmm_downgrade_tid(struct mwifiex_private *priv, u32 tid);
 
 #endif /* !_MWIFIEX_WMM_H_ */
diff --git a/drivers/net/wireless/orinoco/hw.c b/drivers/net/wireless/orinoco/hw.c
index 49300d04efdf..e27e32851f1e 100644
--- a/drivers/net/wireless/orinoco/hw.c
+++ b/drivers/net/wireless/orinoco/hw.c
@@ -988,8 +988,8 @@ int __orinoco_hw_setup_enc(struct orinoco_private *priv)
  * tsc must be NULL or up to 8 bytes
  */
 int __orinoco_hw_set_tkip_key(struct orinoco_private *priv, int key_idx,
-                              int set_tx, u8 *key, u8 *rsc, size_t rsc_len,
-                              u8 *tsc, size_t tsc_len)
+                              int set_tx, const u8 *key, const u8 *rsc,
+                              size_t rsc_len, const u8 *tsc, size_t tsc_len)
 {
         struct {
                 __le16 idx;
diff --git a/drivers/net/wireless/orinoco/hw.h b/drivers/net/wireless/orinoco/hw.h
index 8f6831f4e328..466d1ede76f1 100644
--- a/drivers/net/wireless/orinoco/hw.h
+++ b/drivers/net/wireless/orinoco/hw.h
@@ -38,8 +38,8 @@ int __orinoco_hw_set_wap(struct orinoco_private *priv);
 int __orinoco_hw_setup_wepkeys(struct orinoco_private *priv);
 int __orinoco_hw_setup_enc(struct orinoco_private *priv);
 int __orinoco_hw_set_tkip_key(struct orinoco_private *priv, int key_idx,
-                              int set_tx, u8 *key, u8 *rsc, size_t rsc_len,
-                              u8 *tsc, size_t tsc_len);
+                              int set_tx, const u8 *key, const u8 *rsc,
+                              size_t rsc_len, const u8 *tsc, size_t tsc_len);
 int orinoco_clear_tkip_key(struct orinoco_private *priv, int key_idx);
 int __orinoco_hw_set_multicast_list(struct orinoco_private *priv,
                                     struct net_device *dev,
diff --git a/drivers/net/wireless/orinoco/orinoco_usb.c b/drivers/net/wireless/orinoco/orinoco_usb.c
index 3ac71339d040..c90939ced0e4 100644
--- a/drivers/net/wireless/orinoco/orinoco_usb.c
+++ b/drivers/net/wireless/orinoco/orinoco_usb.c
@@ -1673,7 +1673,7 @@ static int ezusb_probe(struct usb_interface *interface,
                 firmware.code = fw_entry->data;
         }
         if (firmware.size && firmware.code) {
-                if (ezusb_firmware_download(upriv, &firmware))
+                if (ezusb_firmware_download(upriv, &firmware) < 0)
                         goto error;
         } else {
                 err("No firmware to download");
diff --git a/drivers/net/wireless/orinoco/wext.c b/drivers/net/wireless/orinoco/wext.c
index b7a867b50b94..6abdaf0aa052 100644
--- a/drivers/net/wireless/orinoco/wext.c
+++ b/drivers/net/wireless/orinoco/wext.c
@@ -52,9 +52,9 @@ static int orinoco_set_key(struct orinoco_private *priv, int index,
         priv->keys[index].seq_len = seq_len;
 
         if (key_len)
-                memcpy(priv->keys[index].key, key, key_len);
+                memcpy((void *)priv->keys[index].key, key, key_len);
         if (seq_len)
-                memcpy(priv->keys[index].seq, seq, seq_len);
+                memcpy((void *)priv->keys[index].seq, seq, seq_len);
 
         switch (alg) {
         case ORINOCO_ALG_TKIP:
diff --git a/drivers/net/wireless/p54/main.c b/drivers/net/wireless/p54/main.c
index eede90b63f84..7be3a4839640 100644
--- a/drivers/net/wireless/p54/main.c
+++ b/drivers/net/wireless/p54/main.c
@@ -669,7 +669,8 @@ static unsigned int p54_flush_count(struct p54_common *priv)
         return total;
 }
 
-static void p54_flush(struct ieee80211_hw *dev, u32 queues, bool drop)
+static void p54_flush(struct ieee80211_hw *dev, struct ieee80211_vif *vif,
+                      u32 queues, bool drop)
 {
         struct p54_common *priv = dev->priv;
         unsigned int total, i;
diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
index cbf0a589d32a..8330fa33e50b 100644
--- a/drivers/net/wireless/ray_cs.c
+++ b/drivers/net/wireless/ray_cs.c
@@ -343,7 +343,7 @@ static void ray_detach(struct pcmcia_device *link)
         ray_release(link);
 
         local = netdev_priv(dev);
-        del_timer(&local->timer);
+        del_timer_sync(&local->timer);
 
         if (link->priv) {
                 unregister_netdev(dev);
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 39d22a154341..d2a9a08210be 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -517,7 +517,7 @@ static int rndis_set_default_key(struct wiphy *wiphy, struct net_device *netdev,
                                  u8 key_index, bool unicast, bool multicast);
 
 static int rndis_get_station(struct wiphy *wiphy, struct net_device *dev,
-                                        u8 *mac, struct station_info *sinfo);
+                             const u8 *mac, struct station_info *sinfo);
 
 static int rndis_dump_station(struct wiphy *wiphy, struct net_device *dev,
                                int idx, u8 *mac, struct station_info *sinfo);
@@ -2490,7 +2490,7 @@ static void rndis_fill_station_info(struct usbnet *usbdev,
 }
 
 static int rndis_get_station(struct wiphy *wiphy, struct net_device *dev,
-                                        u8 *mac, struct station_info *sinfo)
+                             const u8 *mac, struct station_info *sinfo)
 {
         struct rndis_wlan_private *priv = wiphy_priv(wiphy);
         struct usbnet *usbdev = priv->usbdev;
diff --git a/drivers/net/wireless/rsi/rsi_91x_mac80211.c b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
index 84164747ace0..54aaeb09debf 100644
--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
@@ -656,6 +656,7 @@ static int rsi_mac80211_ampdu_action(struct ieee80211_hw *hw,
         case IEEE80211_AMPDU_TX_START:
                 common->vif_info[ii].seq_start = seq_no;
                 ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                status = 0;
                 break;
 
         case IEEE80211_AMPDU_TX_STOP_CONT:
diff --git a/drivers/net/wireless/rsi/rsi_91x_mgmt.c b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
index 1b28cda6ca88..2eefbf159bc0 100644
--- a/drivers/net/wireless/rsi/rsi_91x_mgmt.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
@@ -1083,7 +1083,7 @@ void rsi_inform_bss_status(struct rsi_common *common,
 {
         if (status) {
                 rsi_hal_send_sta_notify_frame(common,
-                                              NL80211_IFTYPE_STATION,
+                                              RSI_IFTYPE_STATION,
                                               STA_CONNECTED,
                                               bssid,
                                               qos_enable,
@@ -1092,7 +1092,7 @@ void rsi_inform_bss_status(struct rsi_common *common,
                         rsi_send_auto_rate_request(common);
         } else {
                 rsi_hal_send_sta_notify_frame(common,
-                                              NL80211_IFTYPE_STATION,
+                                              RSI_IFTYPE_STATION,
                                               STA_DISCONNECTED,
                                               bssid,
                                               qos_enable,
diff --git a/drivers/net/wireless/rsi/rsi_common.h b/drivers/net/wireless/rsi/rsi_common.h
index f2f70784d4ad..d3fbe33d2324 100644
--- a/drivers/net/wireless/rsi/rsi_common.h
+++ b/drivers/net/wireless/rsi/rsi_common.h
@@ -63,7 +63,7 @@ static inline int rsi_create_kthread(struct rsi_common *common,
                                      u8 *name)
 {
         init_completion(&thread->completion);
-        thread->task = kthread_run(func_ptr, common, name);
+        thread->task = kthread_run(func_ptr, common, "%s", name);
         if (IS_ERR(thread->task))
                 return (int)PTR_ERR(thread->task);
 
diff --git a/drivers/net/wireless/rsi/rsi_mgmt.h b/drivers/net/wireless/rsi/rsi_mgmt.h
index ac67c4ad63c2..225215a3b8bb 100644
--- a/drivers/net/wireless/rsi/rsi_mgmt.h
+++ b/drivers/net/wireless/rsi/rsi_mgmt.h
@@ -73,6 +73,7 @@
 #define RX_BA_INDICATION                1
 #define RSI_TBL_SZ                      40
 #define MAX_RETRIES                     8
+#define RSI_IFTYPE_STATION               0
 
 #define STD_RATE_MCS7                   0x07
 #define STD_RATE_MCS6                   0x06
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 41d4a8167dc3..c17fcf272728 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -1005,10 +1005,9 @@ void rt2800_write_beacon(struct queue_entry *entry, struct txentry_desc *txdesc)
                                    entry->skb->len + padding_len);
 
         /*
-         * Enable beaconing again.
+         * Restore beaconing state.
          */
-        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_GEN, 1);
-        rt2800_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+        rt2800_register_write(rt2x00dev, BCN_TIME_CFG, orig_reg);
 
         /*
          * Clean up beacon skb.
@@ -1039,13 +1038,14 @@ static inline void rt2800_clear_beacon_register(struct rt2x00_dev *rt2x00dev,
 void rt2800_clear_beacon(struct queue_entry *entry)
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
-        u32 reg;
+        u32 orig_reg, reg;
 
         /*
          * Disable beaconing while we are reloading the beacon data,
          * otherwise we might be sending out invalid data.
          */
-        rt2800_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
+        rt2800_register_read(rt2x00dev, BCN_TIME_CFG, &orig_reg);
+        reg = orig_reg;
         rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_GEN, 0);
         rt2800_register_write(rt2x00dev, BCN_TIME_CFG, reg);
 
@@ -1055,10 +1055,9 @@ void rt2800_clear_beacon(struct queue_entry *entry)
         rt2800_clear_beacon_register(rt2x00dev, entry->entry_idx);
 
         /*
-         * Enabled beaconing again.
+         * Restore beaconing state.
          */
-        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_GEN, 1);
-        rt2800_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+        rt2800_register_write(rt2x00dev, BCN_TIME_CFG, orig_reg);
 }
 EXPORT_SYMBOL_GPL(rt2800_clear_beacon);
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index e3b885d8f7db..010b76505243 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -1448,7 +1448,8 @@ int rt2x00mac_conf_tx(struct ieee80211_hw *hw,
                       struct ieee80211_vif *vif, u16 queue,
                       const struct ieee80211_tx_queue_params *params);
 void rt2x00mac_rfkill_poll(struct ieee80211_hw *hw);
-void rt2x00mac_flush(struct ieee80211_hw *hw, u32 queues, bool drop);
+void rt2x00mac_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                     u32 queues, bool drop);
 int rt2x00mac_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant);
 int rt2x00mac_get_antenna(struct ieee80211_hw *hw, u32 *tx_ant, u32 *rx_ant);
 void rt2x00mac_get_ringparam(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index a87ee9b6585a..212ac4842c16 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -749,7 +749,8 @@ void rt2x00mac_rfkill_poll(struct ieee80211_hw *hw)
 }
 EXPORT_SYMBOL_GPL(rt2x00mac_rfkill_poll);
 
-void rt2x00mac_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+void rt2x00mac_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                     u32 queues, bool drop)
 {
         struct rt2x00_dev *rt2x00dev = hw->priv;
         struct data_queue *queue;
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index 10572452cc21..86c43d112a4b 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -68,6 +68,12 @@ int rt2x00usb_vendor_request(struct rt2x00_dev *rt2x00dev,
                 }
         }
 
+        /* If the port is powered down, we get a -EPROTO error, and this
+         * leads to a endless loop. So just say that the device is gone.
+         */
+        if (status == -EPROTO)
+                clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
+
         rt2x00_err(rt2x00dev,
                    "Vendor Request 0x%02x failed for offset 0x%04x with error %d\n",
                    request, offset, status);
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index 24402984ee57..9048a9cbe52c 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -2031,13 +2031,14 @@ static void rt61pci_write_beacon(struct queue_entry *entry,
 static void rt61pci_clear_beacon(struct queue_entry *entry)
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
-        u32 reg;
+        u32 orig_reg, reg;
 
         /*
          * Disable beaconing while we are reloading the beacon data,
          * otherwise we might be sending out invalid data.
          */
-        rt2x00mmio_register_read(rt2x00dev, TXRX_CSR9, &reg);
+        rt2x00mmio_register_read(rt2x00dev, TXRX_CSR9, &orig_reg);
+        reg = orig_reg;
         rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_GEN, 0);
         rt2x00mmio_register_write(rt2x00dev, TXRX_CSR9, reg);
 
@@ -2048,10 +2049,9 @@ static void rt61pci_clear_beacon(struct queue_entry *entry)
                                   HW_BEACON_OFFSET(entry->entry_idx), 0);
 
         /*
-         * Enable beaconing again.
+         * Restore global beaconing state.
          */
-        rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_GEN, 1);
-        rt2x00mmio_register_write(rt2x00dev, TXRX_CSR9, reg);
+        rt2x00mmio_register_write(rt2x00dev, TXRX_CSR9, orig_reg);
 }
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index a140170b1eb3..95724ff9c726 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -1597,13 +1597,14 @@ static void rt73usb_clear_beacon(struct queue_entry *entry)
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         unsigned int beacon_base;
-        u32 reg;
+        u32 orig_reg, reg;
 
         /*
          * Disable beaconing while we are reloading the beacon data,
          * otherwise we might be sending out invalid data.
          */
-        rt2x00usb_register_read(rt2x00dev, TXRX_CSR9, &reg);
+        rt2x00usb_register_read(rt2x00dev, TXRX_CSR9, &orig_reg);
+        reg = orig_reg;
         rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_GEN, 0);
         rt2x00usb_register_write(rt2x00dev, TXRX_CSR9, reg);
 
@@ -1614,10 +1615,9 @@ static void rt73usb_clear_beacon(struct queue_entry *entry)
         rt2x00usb_register_write(rt2x00dev, beacon_base, 0);
 
         /*
-         * Enable beaconing again.
+         * Restore beaconing state.
          */
-        rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_GEN, 1);
-        rt2x00usb_register_write(rt2x00dev, TXRX_CSR9, reg);
+        rt2x00usb_register_write(rt2x00dev, TXRX_CSR9, orig_reg);
 }
 
 static int rt73usb_get_tx_data_len(struct queue_entry *entry)
diff --git a/drivers/net/wireless/rtl818x/rtl8180/Makefile b/drivers/net/wireless/rtl818x/rtl8180/Makefile
index 08b056db4a3b..21005bd8b43c 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/Makefile
+++ b/drivers/net/wireless/rtl818x/rtl8180/Makefile
@@ -1,5 +1,5 @@
-rtl8180-objs            := dev.o rtl8225.o sa2400.o max2820.o grf5101.o rtl8225se.o
+rtl818x_pci-objs        := dev.o rtl8225.o sa2400.o max2820.o grf5101.o rtl8225se.o
 
-obj-$(CONFIG_RTL8180)   += rtl8180.o
+obj-$(CONFIG_RTL8180)   += rtl818x_pci.o
 
 ccflags-y += -Idrivers/net/wireless/rtl818x
diff --git a/drivers/net/wireless/rtl818x/rtl8180/dev.c b/drivers/net/wireless/rtl818x/rtl8180/dev.c
index 98d8256f0377..2c1c02bafa10 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8180/dev.c
@@ -284,6 +284,8 @@ static void rtl8180_handle_rx(struct ieee80211_hw *dev)
                         rx_status.band = dev->conf.chandef.chan->band;
                         rx_status.mactime = tsft;
                         rx_status.flag |= RX_FLAG_MACTIME_START;
+                        if (flags & RTL818X_RX_DESC_FLAG_SPLCP)
+                                rx_status.flag |= RX_FLAG_SHORTPRE;
                         if (flags & RTL818X_RX_DESC_FLAG_CRC32_ERR)
                                 rx_status.flag |= RX_FLAG_FAILED_FCS_CRC;
 
@@ -461,18 +463,23 @@ static void rtl8180_tx(struct ieee80211_hw *dev,
                             RTL818X_TX_DESC_FLAG_NO_ENC;
 
         rc_flags = info->control.rates[0].flags;
+
+        /* HW will perform RTS-CTS when only RTS flags is set.
+         * HW will perform CTS-to-self when both RTS and CTS flags are set.
+         * RTS rate and RTS duration will be used also for CTS-to-self.
+         */
         if (rc_flags & IEEE80211_TX_RC_USE_RTS_CTS) {
                 tx_flags |= RTL818X_TX_DESC_FLAG_RTS;
                 tx_flags |= ieee80211_get_rts_cts_rate(dev, info)->hw_value << 19;
+                rts_duration = ieee80211_rts_duration(dev, priv->vif,
+                                                skb->len, info);
         } else if (rc_flags & IEEE80211_TX_RC_USE_CTS_PROTECT) {
-                tx_flags |= RTL818X_TX_DESC_FLAG_CTS;
+                tx_flags |= RTL818X_TX_DESC_FLAG_RTS | RTL818X_TX_DESC_FLAG_CTS;
                 tx_flags |= ieee80211_get_rts_cts_rate(dev, info)->hw_value << 19;
+                rts_duration = ieee80211_ctstoself_duration(dev, priv->vif,
+                                                skb->len, info);
         }
 
-        if (rc_flags & IEEE80211_TX_RC_USE_RTS_CTS)
-                rts_duration = ieee80211_rts_duration(dev, priv->vif, skb->len,
-                                                      info);
-
         if (priv->chip_family == RTL818X_CHIP_FAMILY_RTL8180) {
                 unsigned int remainder;
 
@@ -683,9 +690,8 @@ static void rtl8180_int_enable(struct ieee80211_hw *dev)
         struct rtl8180_priv *priv = dev->priv;
 
         if (priv->chip_family == RTL818X_CHIP_FAMILY_RTL8187SE) {
-                rtl818x_iowrite32(priv, &priv->map->IMR, IMR_TMGDOK |
-                          IMR_TBDER | IMR_THPDER |
-                          IMR_THPDER | IMR_THPDOK |
+                rtl818x_iowrite32(priv, &priv->map->IMR,
+                          IMR_TBDER | IMR_TBDOK |
                           IMR_TVODER | IMR_TVODOK |
                           IMR_TVIDER | IMR_TVIDOK |
                           IMR_TBEDER | IMR_TBEDOK |
@@ -911,7 +917,10 @@ static int rtl8180_init_hw(struct ieee80211_hw *dev)
                 reg32 &= 0x00ffff00;
                 reg32 |= 0xb8000054;
                 rtl818x_iowrite32(priv, &priv->map->RF_PARA, reg32);
-        }
+        } else
+                /* stop unused queus (no dma alloc) */
+                rtl818x_iowrite8(priv, &priv->map->TX_DMA_POLLING,
+                            (1<<1) | (1<<2));
 
         priv->rf->init(dev);
 
diff --git a/drivers/net/wireless/rtl818x/rtl8187/dev.c b/drivers/net/wireless/rtl818x/rtl8187/dev.c
index 0ca17cda48fa..629ad8cfa17b 100644
--- a/drivers/net/wireless/rtl818x/rtl8187/dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187/dev.c
@@ -253,14 +253,21 @@ static void rtl8187_tx(struct ieee80211_hw *dev,
         flags |= ieee80211_get_tx_rate(dev, info)->hw_value << 24;
         if (ieee80211_has_morefrags(tx_hdr->frame_control))
                 flags |= RTL818X_TX_DESC_FLAG_MOREFRAG;
+
+        /* HW will perform RTS-CTS when only RTS flags is set.
+         * HW will perform CTS-to-self when both RTS and CTS flags are set.
+         * RTS rate and RTS duration will be used also for CTS-to-self.
+         */
         if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) {
                 flags |= RTL818X_TX_DESC_FLAG_RTS;
                 flags |= ieee80211_get_rts_cts_rate(dev, info)->hw_value << 19;
                 rts_dur = ieee80211_rts_duration(dev, priv->vif,
                                                  skb->len, info);
         } else if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT) {
-                flags |= RTL818X_TX_DESC_FLAG_CTS;
+                flags |= RTL818X_TX_DESC_FLAG_RTS | RTL818X_TX_DESC_FLAG_CTS;
                 flags |= ieee80211_get_rts_cts_rate(dev, info)->hw_value << 19;
+                rts_dur = ieee80211_ctstoself_duration(dev, priv->vif,
+                                                 skb->len, info);
         }
 
         if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
@@ -381,6 +388,8 @@ static void rtl8187_rx_cb(struct urb *urb)
         rx_status.freq = dev->conf.chandef.chan->center_freq;
         rx_status.band = dev->conf.chandef.chan->band;
         rx_status.flag |= RX_FLAG_MACTIME_START;
+        if (flags & RTL818X_RX_DESC_FLAG_SPLCP)
+                rx_status.flag |= RX_FLAG_SHORTPRE;
         if (flags & RTL818X_RX_DESC_FLAG_CRC32_ERR)
                 rx_status.flag |= RX_FLAG_FAILED_FCS_CRC;
         memcpy(IEEE80211_SKB_RXCB(skb), &rx_status, sizeof(rx_status));
diff --git a/drivers/net/wireless/rtl818x/rtl818x.h b/drivers/net/wireless/rtl818x/rtl818x.h
index 45ea4e1c4abe..7abef95d278b 100644
--- a/drivers/net/wireless/rtl818x/rtl818x.h
+++ b/drivers/net/wireless/rtl818x/rtl818x.h
@@ -334,9 +334,9 @@ struct rtl818x_csr {
  * I don't like to introduce a ton of "reserved"..
  * They are for RTL8187SE
  */
-#define REG_ADDR1(addr) ((u8 __iomem *)priv->map + addr)
-#define REG_ADDR2(addr) ((__le16 __iomem *)priv->map + (addr >> 1))
-#define REG_ADDR4(addr) ((__le32 __iomem *)priv->map + (addr >> 2))
+#define REG_ADDR1(addr) ((u8 __iomem *)priv->map + (addr))
+#define REG_ADDR2(addr) ((__le16 __iomem *)priv->map + ((addr) >> 1))
+#define REG_ADDR4(addr) ((__le32 __iomem *)priv->map + ((addr) >> 2))
 
 #define FEMR_SE         REG_ADDR2(0x1D4)
 #define ARFR            REG_ADDR2(0x1E0)
diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c
index 4ec424f26672..b1ed6d0796f6 100644
--- a/drivers/net/wireless/rtlwifi/core.c
+++ b/drivers/net/wireless/rtlwifi/core.c
@@ -1387,7 +1387,8 @@ static void rtl_op_rfkill_poll(struct ieee80211_hw *hw)
  * before switch channel or power save, or tx buffer packet
  * maybe send after offchannel or rf sleep, this may cause
  * dis-association by AP */
-static void rtl_op_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+static void rtl_op_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                         u32 queues, bool drop)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
index 94cd9df98381..b14cf5a10f44 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
@@ -2515,23 +2515,3 @@ void rtl88ee_suspend(struct ieee80211_hw *hw)
 void rtl88ee_resume(struct ieee80211_hw *hw)
 {
 }
-
-/* Turn on AAP (RCR:bit 0) for promicuous mode. */
-void rtl88ee_allow_all_destaddr(struct ieee80211_hw *hw,
-                                bool allow_all_da, bool write_into_reg)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
-
-        if (allow_all_da) /* Set BIT0 */
-                rtlpci->receive_config |= RCR_AAP;
-         else /* Clear BIT0 */
-                rtlpci->receive_config &= ~RCR_AAP;
-
-        if (write_into_reg)
-                rtl_write_dword(rtlpriv, REG_RCR, rtlpci->receive_config);
-
-        RT_TRACE(rtlpriv, COMP_TURBO | COMP_INIT, DBG_LOUD,
-                 "receive_config = 0x%08X, write_into_reg =%d\n",
-                 rtlpci->receive_config, write_into_reg);
-}
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.h b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.h
index b4460a41bd01..1850fde881b5 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.h
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.h
@@ -61,8 +61,6 @@ void rtl8188ee_bt_reg_init(struct ieee80211_hw *hw);
 void rtl8188ee_bt_hw_init(struct ieee80211_hw *hw);
 void rtl88ee_suspend(struct ieee80211_hw *hw);
 void rtl88ee_resume(struct ieee80211_hw *hw);
-void rtl88ee_allow_all_destaddr(struct ieee80211_hw *hw,
-                                bool allow_all_da, bool write_into_reg);
 void rtl88ee_fw_clk_off_timer_callback(unsigned long data);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c b/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c
index 1b4101bf9974..842d69349a37 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c
@@ -93,7 +93,7 @@ int rtl88e_init_sw_vars(struct ieee80211_hw *hw)
         u8 tid;
 
         rtl8188ee_bt_reg_init(hw);
-        rtlpci->msi_support = true;
+        rtlpci->msi_support = rtlpriv->cfg->mod_params->msi_support;
 
         rtlpriv->dm.dm_initialgain_enable = 1;
         rtlpriv->dm.dm_flag = 0;
@@ -255,7 +255,6 @@ static struct rtl_hal_ops rtl8188ee_hal_ops = {
         .enable_hw_sec = rtl88ee_enable_hw_security_config,
         .set_key = rtl88ee_set_key,
         .init_sw_leds = rtl88ee_init_sw_leds,
-        .allow_all_destaddr = rtl88ee_allow_all_destaddr,
         .get_bbreg = rtl88e_phy_query_bb_reg,
         .set_bbreg = rtl88e_phy_set_bb_reg,
         .get_rfreg = rtl88e_phy_query_rf_reg,
@@ -267,6 +266,7 @@ static struct rtl_mod_params rtl88ee_mod_params = {
         .inactiveps = true,
         .swctrl_lps = false,
         .fwctrl_lps = true,
+        .msi_support = false,
         .debug = DBG_EMERG,
 };
 
@@ -383,10 +383,12 @@ module_param_named(debug, rtl88ee_mod_params.debug, int, 0444);
 module_param_named(ips, rtl88ee_mod_params.inactiveps, bool, 0444);
 module_param_named(swlps, rtl88ee_mod_params.swctrl_lps, bool, 0444);
 module_param_named(fwlps, rtl88ee_mod_params.fwctrl_lps, bool, 0444);
+module_param_named(msi, rtl88ee_mod_params.msi_support, bool, 0444);
 MODULE_PARM_DESC(swenc, "Set to 1 for software crypto (default 0)\n");
 MODULE_PARM_DESC(ips, "Set to 0 to not use link power save (default 1)\n");
 MODULE_PARM_DESC(swlps, "Set to 1 to use SW control power save (default 0)\n");
 MODULE_PARM_DESC(fwlps, "Set to 1 to use FW control power save (default 1)\n");
+MODULE_PARM_DESC(msi, "Set to 1 to use MSI interrupts mode (default 0)\n");
 MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)");
 
 static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
index 55adf043aef7..cdecb0fd4d8e 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
@@ -2423,24 +2423,3 @@ void rtl92ce_suspend(struct ieee80211_hw *hw)
 void rtl92ce_resume(struct ieee80211_hw *hw)
 {
 }
-
-/* Turn on AAP (RCR:bit 0) for promicuous mode. */
-void rtl92ce_allow_all_destaddr(struct ieee80211_hw *hw,
-        bool allow_all_da, bool write_into_reg)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
-
-        if (allow_all_da) {/* Set BIT0 */
-                rtlpci->receive_config |= RCR_AAP;
-        } else {/* Clear BIT0 */
-                rtlpci->receive_config &= ~RCR_AAP;
-        }
-
-        if (write_into_reg)
-                rtl_write_dword(rtlpriv, REG_RCR, rtlpci->receive_config);
-
-        RT_TRACE(rtlpriv, COMP_TURBO | COMP_INIT, DBG_LOUD,
-                 "receive_config=0x%08X, write_into_reg=%d\n",
-                 rtlpci->receive_config, write_into_reg);
-}
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.h b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.h
index 2d063b0c7760..5533070f266c 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.h
@@ -76,7 +76,5 @@ void rtl8192ce_bt_reg_init(struct ieee80211_hw *hw);
 void rtl8192ce_bt_hw_init(struct ieee80211_hw *hw);
 void rtl92ce_suspend(struct ieee80211_hw *hw);
 void rtl92ce_resume(struct ieee80211_hw *hw);
-void rtl92ce_allow_all_destaddr(struct ieee80211_hw *hw,
-                                bool allow_all_da, bool write_into_reg);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
index b790320d2030..12f21f4073e8 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
@@ -229,7 +229,6 @@ static struct rtl_hal_ops rtl8192ce_hal_ops = {
         .enable_hw_sec = rtl92ce_enable_hw_security_config,
         .set_key = rtl92ce_set_key,
         .init_sw_leds = rtl92ce_init_sw_leds,
-        .allow_all_destaddr = rtl92ce_allow_all_destaddr,
         .get_bbreg = rtl92c_phy_query_bb_reg,
         .set_bbreg = rtl92c_phy_set_bb_reg,
         .set_rfreg = rtl92ce_phy_set_rf_reg,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
index 07cb06da6729..a903c2671b4d 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
@@ -511,7 +511,7 @@ static int _rtl92cu_init_power_on(struct ieee80211_hw *hw)
                         pr_info("MAC auto ON okay!\n");
                         break;
                 }
-                if (pollingCount++ > 100) {
+                if (pollingCount++ > 1000) {
                         RT_TRACE(rtlpriv, COMP_INIT, DBG_EMERG,
                                  "Failed to polling REG_APS_FSMCO[APFM_ONMAC] done!\n");
                         return -ENODEV;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
index c61311084d7e..361435f8608a 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -395,9 +395,6 @@ static struct usb_driver rtl8192cu_driver = {
         /* .resume = rtl_usb_resume, */
         /* .reset_resume = rtl8192c_resume, */
 #endif /* CONFIG_PM */
-#ifdef CONFIG_AUTOSUSPEND
-        .supports_autosuspend = 1,
-#endif
         .disable_hub_initiated_lpm = 1,
 };
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/hw.c b/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
index 9098558d916d..1c7101bcd790 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
@@ -2544,23 +2544,3 @@ void rtl92se_resume(struct ieee80211_hw *hw)
                 pci_write_config_dword(rtlpci->pdev, 0x40,
                         val & 0xffff00ff);
 }
-
-/* Turn on AAP (RCR:bit 0) for promicuous mode. */
-void rtl92se_allow_all_destaddr(struct ieee80211_hw *hw,
-                                bool allow_all_da, bool write_into_reg)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
-
-        if (allow_all_da) /* Set BIT0 */
-                rtlpci->receive_config |= RCR_AAP;
-        else /* Clear BIT0 */
-                rtlpci->receive_config &= ~RCR_AAP;
-
-        if (write_into_reg)
-                rtl_write_dword(rtlpriv, RCR, rtlpci->receive_config);
-
-        RT_TRACE(rtlpriv, COMP_TURBO | COMP_INIT, DBG_LOUD,
-                 "receive_config=0x%08X, write_into_reg=%d\n",
-                 rtlpci->receive_config, write_into_reg);
-}
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/hw.h b/drivers/net/wireless/rtlwifi/rtl8192se/hw.h
index da48aa8cbe6f..4cacee10f31e 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/hw.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/hw.h
@@ -74,7 +74,5 @@ void rtl92se_set_key(struct ieee80211_hw *hw,
                      u8 enc_algo, bool is_wepkey, bool clear_all);
 void rtl92se_suspend(struct ieee80211_hw *hw);
 void rtl92se_resume(struct ieee80211_hw *hw);
-void rtl92se_allow_all_destaddr(struct ieee80211_hw *hw,
-                                bool allow_all_da, bool write_into_reg);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
index 2e8e6f8d2d51..1bff2a0f7600 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
@@ -290,7 +290,6 @@ static struct rtl_hal_ops rtl8192se_hal_ops = {
         .enable_hw_sec = rtl92se_enable_hw_security_config,
         .set_key = rtl92se_set_key,
         .init_sw_leds = rtl92se_init_sw_leds,
-        .allow_all_destaddr = rtl92se_allow_all_destaddr,
         .get_bbreg = rtl92s_phy_query_bb_reg,
         .set_bbreg = rtl92s_phy_set_bb_reg,
         .get_rfreg = rtl92s_phy_query_rf_reg,
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/hal_bt_coexist.c b/drivers/net/wireless/rtlwifi/rtl8723ae/hal_bt_coexist.c
index 48fee1be78c2..5b4a714f3c8c 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/hal_bt_coexist.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/hal_bt_coexist.c
@@ -32,7 +32,6 @@
 #include "dm.h"
 #include "fw.h"
 #include "../rtl8723com/fw_common.h"
-#include "../rtl8723com/fw_common.h"
 #include "phy.h"
 #include "reg.h"
 #include "hal_btc.h"
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c b/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
index 65c9e80e1f78..87f69166a7ed 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
@@ -2383,24 +2383,3 @@ void rtl8723ae_suspend(struct ieee80211_hw *hw)
 void rtl8723ae_resume(struct ieee80211_hw *hw)
 {
 }
-
-/* Turn on AAP (RCR:bit 0) for promicuous mode. */
-void rtl8723ae_allow_all_destaddr(struct ieee80211_hw *hw,
-        bool allow_all_da, bool write_into_reg)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
-
-        if (allow_all_da) /* Set BIT0 */
-                rtlpci->receive_config |= RCR_AAP;
-        else /* Clear BIT0 */
-                rtlpci->receive_config &= ~RCR_AAP;
-
-        if (write_into_reg)
-                rtl_write_dword(rtlpriv, REG_RCR, rtlpci->receive_config);
-
-
-        RT_TRACE(rtlpriv, COMP_TURBO | COMP_INIT, DBG_LOUD,
-                 "receive_config=0x%08X, write_into_reg=%d\n",
-                 rtlpci->receive_config, write_into_reg);
-}
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/hw.h b/drivers/net/wireless/rtlwifi/rtl8723ae/hw.h
index 6fa24f79b1d7..d3bc39fb27a5 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/hw.h
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/hw.h
@@ -67,7 +67,5 @@ void rtl8723ae_bt_reg_init(struct ieee80211_hw *hw);
 void rtl8723ae_bt_hw_init(struct ieee80211_hw *hw);
 void rtl8723ae_suspend(struct ieee80211_hw *hw);
 void rtl8723ae_resume(struct ieee80211_hw *hw);
-void rtl8723ae_allow_all_destaddr(struct ieee80211_hw *hw,
-                                  bool allow_all_da, bool write_into_reg);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c b/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c
index 1087a3bd07fa..73cba1eec8cf 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c
@@ -238,7 +238,6 @@ static struct rtl_hal_ops rtl8723ae_hal_ops = {
         .enable_hw_sec = rtl8723ae_enable_hw_security_config,
         .set_key = rtl8723ae_set_key,
         .init_sw_leds = rtl8723ae_init_sw_leds,
-        .allow_all_destaddr = rtl8723ae_allow_all_destaddr,
         .get_bbreg = rtl8723_phy_query_bb_reg,
         .set_bbreg = rtl8723_phy_set_bb_reg,
         .get_rfreg = rtl8723ae_phy_query_rf_reg,
diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/rtlwifi/rtl8723be/hw.c
index 0fdf0909321f..3d555495b453 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723be/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723be/hw.c
@@ -2501,23 +2501,3 @@ void rtl8723be_suspend(struct ieee80211_hw *hw)
 void rtl8723be_resume(struct ieee80211_hw *hw)
 {
 }
-
-/* Turn on AAP (RCR:bit 0) for promicuous mode. */
-void rtl8723be_allow_all_destaddr(struct ieee80211_hw *hw, bool allow_all_da,
-                                  bool write_into_reg)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
-
-        if (allow_all_da) /* Set BIT0 */
-                rtlpci->receive_config |= RCR_AAP;
-        else /* Clear BIT0 */
-                rtlpci->receive_config &= ~RCR_AAP;
-
-        if (write_into_reg)
-                rtl_write_dword(rtlpriv, REG_RCR, rtlpci->receive_config);
-
-        RT_TRACE(rtlpriv, COMP_TURBO | COMP_INIT, DBG_LOUD,
-                 "receive_config = 0x%08X, write_into_reg =%d\n",
-                 rtlpci->receive_config, write_into_reg);
-}
diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/hw.h b/drivers/net/wireless/rtlwifi/rtl8723be/hw.h
index b7449a9b57e4..64c7551af6b7 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723be/hw.h
+++ b/drivers/net/wireless/rtlwifi/rtl8723be/hw.h
@@ -59,6 +59,4 @@ void rtl8723be_bt_reg_init(struct ieee80211_hw *hw);
 void rtl8723be_bt_hw_init(struct ieee80211_hw *hw);
 void rtl8723be_suspend(struct ieee80211_hw *hw);
 void rtl8723be_resume(struct ieee80211_hw *hw);
-void rtl8723be_allow_all_destaddr(struct ieee80211_hw *hw, bool allow_all_da,
-                                  bool write_into_reg);
 #endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/sw.c b/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
index b4577ebc4bb0..ff12bf41644b 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
@@ -92,7 +92,7 @@ int rtl8723be_init_sw_vars(struct ieee80211_hw *hw)
         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
 
         rtl8723be_bt_reg_init(hw);
-        rtlpci->msi_support = true;
+        rtlpci->msi_support = rtlpriv->cfg->mod_params->msi_support;
         rtlpriv->btcoexist.btc_ops = rtl_btc_get_ops_pointer();
 
         rtlpriv->dm.dm_initialgain_enable = 1;
@@ -253,6 +253,7 @@ static struct rtl_mod_params rtl8723be_mod_params = {
         .inactiveps = true,
         .swctrl_lps = false,
         .fwctrl_lps = true,
+        .msi_support = false,
         .debug = DBG_EMERG,
 };
 
@@ -365,9 +366,11 @@ module_param_named(debug, rtl8723be_mod_params.debug, int, 0444);
 module_param_named(ips, rtl8723be_mod_params.inactiveps, bool, 0444);
 module_param_named(swlps, rtl8723be_mod_params.swctrl_lps, bool, 0444);
 module_param_named(fwlps, rtl8723be_mod_params.fwctrl_lps, bool, 0444);
+module_param_named(msi, rtl8723be_mod_params.msi_support, bool, 0444);
 MODULE_PARM_DESC(swenc, "using hardware crypto (default 0 [hardware])\n");
 MODULE_PARM_DESC(ips, "using no link power save (default 1 is open)\n");
 MODULE_PARM_DESC(fwlps, "using linked fw control power save (default 1 is open)\n");
+MODULE_PARM_DESC(msi, "Set to 1 to use MSI interrupts mode (default 0)\n");
 MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)");
 
 static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume);
diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/trx.c b/drivers/net/wireless/rtlwifi/rtl8723be/trx.c
index e0a0d8c8fed5..969eaea5eddd 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723be/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723be/trx.c
@@ -33,7 +33,6 @@
 #include "trx.h"
 #include "led.h"
 #include "dm.h"
-#include "phy.h"
 
 static u8 _rtl8723be_map_hwqueue_to_fwqueue(struct sk_buff *skb, u8 hw_queue)
 {
diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
index 6965afdf572a..407a7936d364 100644
--- a/drivers/net/wireless/rtlwifi/wifi.h
+++ b/drivers/net/wireless/rtlwifi/wifi.h
@@ -1960,8 +1960,6 @@ struct rtl_hal_ops {
                           u32 regaddr, u32 bitmask);
         void (*set_rfreg) (struct ieee80211_hw *hw, enum radio_path rfpath,
                            u32 regaddr, u32 bitmask, u32 data);
-        void (*allow_all_destaddr)(struct ieee80211_hw *hw,
-                bool allow_all_da, bool write_into_reg);
         void (*linked_set_reg) (struct ieee80211_hw *hw);
         void (*chk_switch_dmdp) (struct ieee80211_hw *hw);
         void (*dualmac_easy_concurrent) (struct ieee80211_hw *hw);
@@ -2030,6 +2028,10 @@ struct rtl_mod_params {
 
         /* default: 1 = using linked fw power save */
         bool fwctrl_lps;
+
+        /* default: 0 = not using MSI interrupts mode */
+        /* submodules should set their own defalut value */
+        bool msi_support;
 };
 
 struct rtl_hal_usbint_cfg {
diff --git a/drivers/net/wireless/ti/wl1251/acx.c b/drivers/net/wireless/ti/wl1251/acx.c
index 5a4ec56c83d0..5695628757ee 100644
--- a/drivers/net/wireless/ti/wl1251/acx.c
+++ b/drivers/net/wireless/ti/wl1251/acx.c
@@ -2,7 +2,6 @@
 
 #include <linux/module.h>
 #include <linux/slab.h>
-#include <linux/crc7.h>
 
 #include "wl1251.h"
 #include "reg.h"
diff --git a/drivers/net/wireless/ti/wl1251/cmd.c b/drivers/net/wireless/ti/wl1251/cmd.c
index bf1fa18b9786..ede31f048ef9 100644
--- a/drivers/net/wireless/ti/wl1251/cmd.c
+++ b/drivers/net/wireless/ti/wl1251/cmd.c
@@ -2,7 +2,6 @@
 
 #include <linux/module.h>
 #include <linux/slab.h>
-#include <linux/crc7.h>
 #include <linux/etherdevice.h>
 
 #include "wl1251.h"
diff --git a/drivers/net/wireless/ti/wl1251/event.c b/drivers/net/wireless/ti/wl1251/event.c
index db0105313745..c98630394a1a 100644
--- a/drivers/net/wireless/ti/wl1251/event.c
+++ b/drivers/net/wireless/ti/wl1251/event.c
@@ -124,11 +124,12 @@ static int wl1251_event_process(struct wl1251 *wl, struct event_mailbox *mbox)
                         return ret;
         }
 
-        if (wl->vif && vector & SYNCHRONIZATION_TIMEOUT_EVENT_ID) {
+        if (vector & SYNCHRONIZATION_TIMEOUT_EVENT_ID) {
                 wl1251_debug(DEBUG_EVENT, "SYNCHRONIZATION_TIMEOUT_EVENT");
 
                 /* indicate to the stack, that beacons have been lost */
-                ieee80211_beacon_loss(wl->vif);
+                if (wl->vif && wl->vif->type == NL80211_IFTYPE_STATION)
+                        ieee80211_beacon_loss(wl->vif);
         }
 
         if (vector & REGAINED_BSS_EVENT_ID) {
diff --git a/drivers/net/wireless/ti/wl1251/main.c b/drivers/net/wireless/ti/wl1251/main.c
index 757e25784a8a..4e782f18ae34 100644
--- a/drivers/net/wireless/ti/wl1251/main.c
+++ b/drivers/net/wireless/ti/wl1251/main.c
@@ -550,6 +550,34 @@ static void wl1251_op_remove_interface(struct ieee80211_hw *hw,
         mutex_unlock(&wl->mutex);
 }
 
+static int wl1251_build_null_data(struct wl1251 *wl)
+{
+        struct sk_buff *skb = NULL;
+        int size;
+        void *ptr;
+        int ret = -ENOMEM;
+
+        if (wl->bss_type == BSS_TYPE_IBSS) {
+                size = sizeof(struct wl12xx_null_data_template);
+                ptr = NULL;
+        } else {
+                skb = ieee80211_nullfunc_get(wl->hw, wl->vif);
+                if (!skb)
+                        goto out;
+                size = skb->len;
+                ptr = skb->data;
+        }
+
+        ret = wl1251_cmd_template_set(wl, CMD_NULL_DATA, ptr, size);
+
+out:
+        dev_kfree_skb(skb);
+        if (ret)
+                wl1251_warning("cmd buld null data failed: %d", ret);
+
+        return ret;
+}
+
 static int wl1251_build_qos_null_data(struct wl1251 *wl)
 {
         struct ieee80211_qos_hdr template;
@@ -687,16 +715,6 @@ static int wl1251_op_config(struct ieee80211_hw *hw, u32 changed)
                 wl->power_level = conf->power_level;
         }
 
-        /*
-         * Tell stack that connection is lost because hw encryption isn't
-         * supported in monitor mode.
-         * This requires temporary enabling of the hw connection monitor flag
-         */
-        if ((changed & IEEE80211_CONF_CHANGE_MONITOR) && wl->vif) {
-                wl->hw->flags |= IEEE80211_HW_CONNECTION_MONITOR;
-                ieee80211_connection_loss(wl->vif);
-        }
-
 out_sleep:
         wl1251_ps_elp_sleep(wl);
 
@@ -1103,24 +1121,19 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
                 wl->rssi_thold = bss_conf->cqm_rssi_thold;
         }
 
-        if (changed & BSS_CHANGED_BSSID) {
+        if ((changed & BSS_CHANGED_BSSID) &&
+            memcmp(wl->bssid, bss_conf->bssid, ETH_ALEN)) {
                 memcpy(wl->bssid, bss_conf->bssid, ETH_ALEN);
 
-                skb = ieee80211_nullfunc_get(wl->hw, wl->vif);
-                if (!skb)
-                        goto out_sleep;
-
-                ret = wl1251_cmd_template_set(wl, CMD_NULL_DATA,
-                                              skb->data, skb->len);
-                dev_kfree_skb(skb);
-                if (ret < 0)
-                        goto out_sleep;
+                if (!is_zero_ether_addr(wl->bssid)) {
+                        ret = wl1251_build_null_data(wl);
+                        if (ret < 0)
+                                goto out_sleep;
 
-                ret = wl1251_build_qos_null_data(wl);
-                if (ret < 0)
-                        goto out;
+                        ret = wl1251_build_qos_null_data(wl);
+                        if (ret < 0)
+                                goto out_sleep;
 
-                if (wl->bss_type != BSS_TYPE_IBSS) {
                         ret = wl1251_join(wl, wl->bss_type, wl->channel,
                                           wl->beacon_int, wl->dtim_period);
                         if (ret < 0)
@@ -1129,9 +1142,6 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
         }
 
         if (changed & BSS_CHANGED_ASSOC) {
-                /* Disable temporary enabled hw connection monitor flag */
-                wl->hw->flags &= ~IEEE80211_HW_CONNECTION_MONITOR;
-
                 if (bss_conf->assoc) {
                         wl->beacon_int = bss_conf->beacon_int;
 
@@ -1216,8 +1226,8 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
                 if (ret < 0)
                         goto out_sleep;
 
-                ret = wl1251_join(wl, wl->bss_type, wl->beacon_int,
-                                  wl->channel, wl->dtim_period);
+                ret = wl1251_join(wl, wl->bss_type, wl->channel,
+                                  wl->beacon_int, wl->dtim_period);
 
                 if (ret < 0)
                         goto out_sleep;
diff --git a/drivers/net/wireless/ti/wl1251/spi.c b/drivers/net/wireless/ti/wl1251/spi.c
index b06d36d99362..a0aa8fa72392 100644
--- a/drivers/net/wireless/ti/wl1251/spi.c
+++ b/drivers/net/wireless/ti/wl1251/spi.c
@@ -23,6 +23,7 @@
 #include <linux/irq.h>
 #include <linux/module.h>
 #include <linux/slab.h>
+#include <linux/swab.h>
 #include <linux/crc7.h>
 #include <linux/spi/spi.h>
 #include <linux/wl12xx.h>
@@ -83,47 +84,44 @@ static void wl1251_spi_reset(struct wl1251 *wl)
 
 static void wl1251_spi_wake(struct wl1251 *wl)
 {
-        u8 crc[WSPI_INIT_CMD_CRC_LEN], *cmd;
         struct spi_transfer t;
         struct spi_message m;
+        u8 *cmd = kzalloc(WSPI_INIT_CMD_LEN, GFP_KERNEL);
 
-        cmd = kzalloc(WSPI_INIT_CMD_LEN, GFP_KERNEL);
         if (!cmd) {
                 wl1251_error("could not allocate cmd for spi init");
                 return;
         }
 
-        memset(crc, 0, sizeof(crc));
         memset(&t, 0, sizeof(t));
         spi_message_init(&m);
 
         /* Set WSPI_INIT_COMMAND
          * the data is being send from the MSB to LSB
          */
-        cmd[2] = 0xff;
-        cmd[3] = 0xff;
-        cmd[1] = WSPI_INIT_CMD_START | WSPI_INIT_CMD_TX;
-        cmd[0] = 0;
-        cmd[7] = 0;
-        cmd[6] |= HW_ACCESS_WSPI_INIT_CMD_MASK << 3;
-        cmd[6] |= HW_ACCESS_WSPI_FIXED_BUSY_LEN & WSPI_INIT_CMD_FIXEDBUSY_LEN;
+        cmd[0] = 0xff;
+        cmd[1] = 0xff;
+        cmd[2] = WSPI_INIT_CMD_START | WSPI_INIT_CMD_TX;
+        cmd[3] = 0;
+        cmd[4] = 0;
+        cmd[5] = HW_ACCESS_WSPI_INIT_CMD_MASK << 3;
+        cmd[5] |= HW_ACCESS_WSPI_FIXED_BUSY_LEN & WSPI_INIT_CMD_FIXEDBUSY_LEN;
+
+        cmd[6] = WSPI_INIT_CMD_IOD | WSPI_INIT_CMD_IP | WSPI_INIT_CMD_CS
+                | WSPI_INIT_CMD_WSPI | WSPI_INIT_CMD_WS;
 
         if (HW_ACCESS_WSPI_FIXED_BUSY_LEN == 0)
-                cmd[5] |=  WSPI_INIT_CMD_DIS_FIXEDBUSY;
+                cmd[6] |= WSPI_INIT_CMD_DIS_FIXEDBUSY;
         else
-                cmd[5] |= WSPI_INIT_CMD_EN_FIXEDBUSY;
-
-        cmd[5] |= WSPI_INIT_CMD_IOD | WSPI_INIT_CMD_IP | WSPI_INIT_CMD_CS
-                | WSPI_INIT_CMD_WSPI | WSPI_INIT_CMD_WS;
-
-        crc[0] = cmd[1];
-        crc[1] = cmd[0];
-        crc[2] = cmd[7];
-        crc[3] = cmd[6];
-        crc[4] = cmd[5];
+                cmd[6] |= WSPI_INIT_CMD_EN_FIXEDBUSY;
 
-        cmd[4] |= crc7(0, crc, WSPI_INIT_CMD_CRC_LEN) << 1;
-        cmd[4] |= WSPI_INIT_CMD_END;
+        cmd[7] = crc7_be(0, cmd+2, WSPI_INIT_CMD_CRC_LEN) | WSPI_INIT_CMD_END;
+        /*
+         * The above is the logical order; it must actually be stored
+         * in the buffer byte-swapped.
+         */
+        __swab32s((u32 *)cmd);
+        __swab32s((u32 *)cmd+1);
 
         t.tx_buf = cmd;
         t.len = WSPI_INIT_CMD_LEN;
diff --git a/drivers/net/wireless/ti/wlcore/debugfs.h b/drivers/net/wireless/ti/wlcore/debugfs.h
index f7381dd69009..0f2cfb0d2a9e 100644
--- a/drivers/net/wireless/ti/wlcore/debugfs.h
+++ b/drivers/net/wireless/ti/wlcore/debugfs.h
@@ -57,7 +57,7 @@ static const struct file_operations name## _ops = {			\
                                             wl, &name## _ops);          \
                 if (!entry || IS_ERR(entry))                            \
                         goto err;                                       \
-        } while (0);
+        } while (0)
 
 
 #define DEBUGFS_ADD_PREFIX(prefix, name, parent)                        \
@@ -66,7 +66,7 @@ static const struct file_operations name## _ops = {			\
                                     wl, &prefix## _## name## _ops);     \
                 if (!entry || IS_ERR(entry))                            \
                         goto err;                                       \
-        } while (0);
+        } while (0)
 
 #define DEBUGFS_FWSTATS_FILE(sub, name, fmt, struct_type)               \
 static ssize_t sub## _ ##name## _read(struct file *file,                \
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index e71eae353368..3d6028e62750 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -1416,7 +1416,7 @@ void wl1271_rx_filter_free(struct wl12xx_rx_filter *filter)
 
 int wl1271_rx_filter_alloc_field(struct wl12xx_rx_filter *filter,
                                  u16 offset, u8 flags,
-                                 u8 *pattern, u8 len)
+                                 const u8 *pattern, u8 len)
 {
         struct wl12xx_rx_filter_field *field;
 
@@ -5184,7 +5184,8 @@ out:
         mutex_unlock(&wl->mutex);
 }
 
-static void wlcore_op_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+static void wlcore_op_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                            u32 queues, bool drop)
 {
         struct wl1271 *wl = hw->priv;
 
diff --git a/drivers/net/wireless/ti/wlcore/sdio.c b/drivers/net/wireless/ti/wlcore/sdio.c
index 29ef2492951f..d3dd7bfdf3f1 100644
--- a/drivers/net/wireless/ti/wlcore/sdio.c
+++ b/drivers/net/wireless/ti/wlcore/sdio.c
@@ -217,7 +217,7 @@ static struct wl1271_if_operations sdio_ops = {
 static int wl1271_probe(struct sdio_func *func,
                                   const struct sdio_device_id *id)
 {
-        struct wlcore_platdev_data *pdev_data;
+        struct wlcore_platdev_data pdev_data;
         struct wl12xx_sdio_glue *glue;
         struct resource res[1];
         mmc_pm_flag_t mmcflags;
@@ -228,16 +228,13 @@ static int wl1271_probe(struct sdio_func *func,
         if (func->num != 0x02)
                 return -ENODEV;
 
-        pdev_data = kzalloc(sizeof(*pdev_data), GFP_KERNEL);
-        if (!pdev_data)
-                goto out;
-
-        pdev_data->if_ops = &sdio_ops;
+        memset(&pdev_data, 0x00, sizeof(pdev_data));
+        pdev_data.if_ops = &sdio_ops;
 
         glue = kzalloc(sizeof(*glue), GFP_KERNEL);
         if (!glue) {
                 dev_err(&func->dev, "can't allocate glue\n");
-                goto out_free_pdev_data;
+                goto out;
         }
 
         glue->dev = &func->dev;
@@ -248,9 +245,9 @@ static int wl1271_probe(struct sdio_func *func,
         /* Use block mode for transferring over one block size of data */
         func->card->quirks |= MMC_QUIRK_BLKSZ_FOR_BYTE_MODE;
 
-        pdev_data->pdata = wl12xx_get_platform_data();
-        if (IS_ERR(pdev_data->pdata)) {
-                ret = PTR_ERR(pdev_data->pdata);
+        pdev_data.pdata = wl12xx_get_platform_data();
+        if (IS_ERR(pdev_data.pdata)) {
+                ret = PTR_ERR(pdev_data.pdata);
                 dev_err(glue->dev, "missing wlan platform data: %d\n", ret);
                 goto out_free_glue;
         }
@@ -260,7 +257,7 @@ static int wl1271_probe(struct sdio_func *func,
         dev_dbg(glue->dev, "sdio PM caps = 0x%x\n", mmcflags);
 
         if (mmcflags & MMC_PM_KEEP_POWER)
-                pdev_data->pdata->pwr_in_suspend = true;
+                pdev_data.pdata->pwr_in_suspend = true;
 
         sdio_set_drvdata(func, glue);
 
@@ -289,7 +286,7 @@ static int wl1271_probe(struct sdio_func *func,
 
         memset(res, 0x00, sizeof(res));
 
-        res[0].start = pdev_data->pdata->irq;
+        res[0].start = pdev_data.pdata->irq;
         res[0].flags = IORESOURCE_IRQ;
         res[0].name = "irq";
 
@@ -299,8 +296,8 @@ static int wl1271_probe(struct sdio_func *func,
                 goto out_dev_put;
         }
 
-        ret = platform_device_add_data(glue->core, pdev_data,
-                                       sizeof(*pdev_data));
+        ret = platform_device_add_data(glue->core, &pdev_data,
+                                       sizeof(pdev_data));
         if (ret) {
                 dev_err(glue->dev, "can't add platform data\n");
                 goto out_dev_put;
@@ -319,9 +316,6 @@ out_dev_put:
 out_free_glue:
         kfree(glue);
 
-out_free_pdev_data:
-        kfree(pdev_data);
-
 out:
         return ret;
 }
diff --git a/drivers/net/wireless/ti/wlcore/spi.c b/drivers/net/wireless/ti/wlcore/spi.c
index dbe826dd7c23..392c882b28f0 100644
--- a/drivers/net/wireless/ti/wlcore/spi.c
+++ b/drivers/net/wireless/ti/wlcore/spi.c
@@ -24,11 +24,12 @@
 #include <linux/interrupt.h>
 #include <linux/irq.h>
 #include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/swab.h>
 #include <linux/crc7.h>
 #include <linux/spi/spi.h>
 #include <linux/wl12xx.h>
 #include <linux/platform_device.h>
-#include <linux/slab.h>
 
 #include "wlcore.h"
 #include "wl12xx_80211.h"
@@ -110,18 +111,16 @@ static void wl12xx_spi_reset(struct device *child)
 static void wl12xx_spi_init(struct device *child)
 {
         struct wl12xx_spi_glue *glue = dev_get_drvdata(child->parent);
-        u8 crc[WSPI_INIT_CMD_CRC_LEN], *cmd;
         struct spi_transfer t;
         struct spi_message m;
+        u8 *cmd = kzalloc(WSPI_INIT_CMD_LEN, GFP_KERNEL);
 
-        cmd = kzalloc(WSPI_INIT_CMD_LEN, GFP_KERNEL);
         if (!cmd) {
                 dev_err(child->parent,
                         "could not allocate cmd for spi init\n");
                 return;
         }
 
-        memset(crc, 0, sizeof(crc));
         memset(&t, 0, sizeof(t));
         spi_message_init(&m);
 
@@ -129,30 +128,29 @@ static void wl12xx_spi_init(struct device *child)
          * Set WSPI_INIT_COMMAND
          * the data is being send from the MSB to LSB
          */
-        cmd[2] = 0xff;
-        cmd[3] = 0xff;
-        cmd[1] = WSPI_INIT_CMD_START | WSPI_INIT_CMD_TX;
-        cmd[0] = 0;
-        cmd[7] = 0;
-        cmd[6] |= HW_ACCESS_WSPI_INIT_CMD_MASK << 3;
-        cmd[6] |= HW_ACCESS_WSPI_FIXED_BUSY_LEN & WSPI_INIT_CMD_FIXEDBUSY_LEN;
+        cmd[0] = 0xff;
+        cmd[1] = 0xff;
+        cmd[2] = WSPI_INIT_CMD_START | WSPI_INIT_CMD_TX;
+        cmd[3] = 0;
+        cmd[4] = 0;
+        cmd[5] = HW_ACCESS_WSPI_INIT_CMD_MASK << 3;
+        cmd[5] |= HW_ACCESS_WSPI_FIXED_BUSY_LEN & WSPI_INIT_CMD_FIXEDBUSY_LEN;
+
+        cmd[6] = WSPI_INIT_CMD_IOD | WSPI_INIT_CMD_IP | WSPI_INIT_CMD_CS
+                | WSPI_INIT_CMD_WSPI | WSPI_INIT_CMD_WS;
 
         if (HW_ACCESS_WSPI_FIXED_BUSY_LEN == 0)
-                cmd[5] |=  WSPI_INIT_CMD_DIS_FIXEDBUSY;
+                cmd[6] |= WSPI_INIT_CMD_DIS_FIXEDBUSY;
         else
-                cmd[5] |= WSPI_INIT_CMD_EN_FIXEDBUSY;
-
-        cmd[5] |= WSPI_INIT_CMD_IOD | WSPI_INIT_CMD_IP | WSPI_INIT_CMD_CS
-                | WSPI_INIT_CMD_WSPI | WSPI_INIT_CMD_WS;
-
-        crc[0] = cmd[1];
-        crc[1] = cmd[0];
-        crc[2] = cmd[7];
-        crc[3] = cmd[6];
-        crc[4] = cmd[5];
+                cmd[6] |= WSPI_INIT_CMD_EN_FIXEDBUSY;
 
-        cmd[4] |= crc7(0, crc, WSPI_INIT_CMD_CRC_LEN) << 1;
-        cmd[4] |= WSPI_INIT_CMD_END;
+        cmd[7] = crc7_be(0, cmd+2, WSPI_INIT_CMD_CRC_LEN) | WSPI_INIT_CMD_END;
+        /*
+         * The above is the logical order; it must actually be stored
+         * in the buffer byte-swapped.
+         */
+        __swab32s((u32 *)cmd);
+        __swab32s((u32 *)cmd+1);
 
         t.tx_buf = cmd;
         t.len = WSPI_INIT_CMD_LEN;
@@ -327,27 +325,25 @@ static struct wl1271_if_operations spi_ops = {
 static int wl1271_probe(struct spi_device *spi)
 {
         struct wl12xx_spi_glue *glue;
-        struct wlcore_platdev_data *pdev_data;
+        struct wlcore_platdev_data pdev_data;
         struct resource res[1];
         int ret = -ENOMEM;
 
-        pdev_data = kzalloc(sizeof(*pdev_data), GFP_KERNEL);
-        if (!pdev_data)
-                goto out;
+        memset(&pdev_data, 0x00, sizeof(pdev_data));
 
-        pdev_data->pdata = dev_get_platdata(&spi->dev);
-        if (!pdev_data->pdata) {
+        pdev_data.pdata = dev_get_platdata(&spi->dev);
+        if (!pdev_data.pdata) {
                 dev_err(&spi->dev, "no platform data\n");
                 ret = -ENODEV;
-                goto out_free_pdev_data;
+                goto out;
         }
 
-        pdev_data->if_ops = &spi_ops;
+        pdev_data.if_ops = &spi_ops;
 
         glue = kzalloc(sizeof(*glue), GFP_KERNEL);
         if (!glue) {
                 dev_err(&spi->dev, "can't allocate glue\n");
-                goto out_free_pdev_data;
+                goto out;
         }
 
         glue->dev = &spi->dev;
@@ -385,8 +381,8 @@ static int wl1271_probe(struct spi_device *spi)
                 goto out_dev_put;
         }
 
-        ret = platform_device_add_data(glue->core, pdev_data,
-                                       sizeof(*pdev_data));
+        ret = platform_device_add_data(glue->core, &pdev_data,
+                                       sizeof(pdev_data));
         if (ret) {
                 dev_err(glue->dev, "can't add platform data\n");
                 goto out_dev_put;
@@ -406,9 +402,6 @@ out_dev_put:
 out_free_glue:
         kfree(glue);
 
-out_free_pdev_data:
-        kfree(pdev_data);
-
 out:
         return ret;
 }
diff --git a/drivers/net/wireless/ti/wlcore/wlcore_i.h b/drivers/net/wireless/ti/wlcore/wlcore_i.h
index 756e890bc5ee..c2c34a84ff3d 100644
--- a/drivers/net/wireless/ti/wlcore/wlcore_i.h
+++ b/drivers/net/wireless/ti/wlcore/wlcore_i.h
@@ -512,8 +512,8 @@ int wl1271_recalc_rx_streaming(struct wl1271 *wl, struct wl12xx_vif *wlvif);
 void wl12xx_queue_recovery_work(struct wl1271 *wl);
 size_t wl12xx_copy_fwlog(struct wl1271 *wl, u8 *memblock, size_t maxlen);
 int wl1271_rx_filter_alloc_field(struct wl12xx_rx_filter *filter,
-                                        u16 offset, u8 flags,
-                                        u8 *pattern, u8 len);
+                                 u16 offset, u8 flags,
+                                 const u8 *pattern, u8 len);
 void wl1271_rx_filter_free(struct wl12xx_rx_filter *filter);
 struct wl12xx_rx_filter *wl1271_rx_filter_alloc(void);
 int wl1271_rx_filter_get_fields_size(struct wl12xx_rx_filter *filter);