32 files changed, 552 insertions, 151 deletions

diff --git a/drivers/net/wireless/ath/ath10k/ce.c b/drivers/net/wireless/ath/ath10k/ce.c
index d185dc0cd12b..4333107ecf37 100644
--- a/drivers/net/wireless/ath/ath10k/ce.c
+++ b/drivers/net/wireless/ath/ath10k/ce.c
@@ -603,16 +603,19 @@ static int ath10k_ce_completed_send_next_nolock(struct ath10k_ce_pipe *ce_state,
                 if (ret)
                         return ret;
 
-                src_ring->hw_index =
-                        ath10k_ce_src_ring_read_index_get(ar, ctrl_addr);
-                src_ring->hw_index &= nentries_mask;
+                read_index = ath10k_ce_src_ring_read_index_get(ar, ctrl_addr);
+                if (read_index == 0xffffffff)
+                        return -ENODEV;
+
+                read_index &= nentries_mask;
+                src_ring->hw_index = read_index;
 
                 ath10k_pci_sleep(ar);
         }
 
         read_index = src_ring->hw_index;
 
-        if ((read_index == sw_index) || (read_index == 0xffffffff))
+        if (read_index == sw_index)
                 return -EIO;
 
         sbase = src_ring->shadow_base;
diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
index e6c56c5bb0f6..93adb8c58969 100644
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -802,7 +802,7 @@ int ath10k_core_start(struct ath10k *ar)
 
         INIT_LIST_HEAD(&ar->arvifs);
 
-        if (!test_bit(ATH10K_FLAG_FIRST_BOOT_DONE, &ar->dev_flags))
+        if (!test_bit(ATH10K_FLAG_FIRST_BOOT_DONE, &ar->dev_flags)) {
                 ath10k_info("%s (0x%08x, 0x%08x) fw %s api %d htt %d.%d\n",
                             ar->hw_params.name,
                             ar->target_version,
@@ -811,6 +811,12 @@ int ath10k_core_start(struct ath10k *ar)
                             ar->fw_api,
                             ar->htt.target_version_major,
                             ar->htt.target_version_minor);
+                ath10k_info("debug %d debugfs %d tracing %d dfs %d\n",
+                            config_enabled(CONFIG_ATH10K_DEBUG),
+                            config_enabled(CONFIG_ATH10K_DEBUGFS),
+                            config_enabled(CONFIG_ATH10K_TRACING),
+                            config_enabled(CONFIG_ATH10K_DFS_CERTIFIED));
+        }
 
         __set_bit(ATH10K_FLAG_FIRST_BOOT_DONE, &ar->dev_flags);
 
@@ -988,7 +994,9 @@ err_unregister_mac:
 err_release_fw:
         ath10k_core_free_firmware_files(ar);
 err:
-        device_release_driver(ar->dev);
+        /* TODO: It's probably a good idea to release device from the driver
+         * but calling device_release_driver() here will cause a deadlock.
+         */
         return;
 }
 
diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h
index 68ceef61933d..83a5fa91531d 100644
--- a/drivers/net/wireless/ath/ath10k/core.h
+++ b/drivers/net/wireless/ath/ath10k/core.h
@@ -290,6 +290,9 @@ struct ath10k_debug {
         struct ath_dfs_pool_stats dfs_pool_stats;
 
         u32 fw_dbglog_mask;
+
+        u8 htt_max_amsdu;
+        u8 htt_max_ampdu;
 };
 
 enum ath10k_state {
diff --git a/drivers/net/wireless/ath/ath10k/debug.c b/drivers/net/wireless/ath/ath10k/debug.c
index 1b7ff4ba122c..3030158c478e 100644
--- a/drivers/net/wireless/ath/ath10k/debug.c
+++ b/drivers/net/wireless/ath/ath10k/debug.c
@@ -671,6 +671,72 @@ static const struct file_operations fops_htt_stats_mask = {
         .llseek = default_llseek,
 };
 
+static ssize_t ath10k_read_htt_max_amsdu_ampdu(struct file *file,
+                                               char __user *user_buf,
+                                               size_t count, loff_t *ppos)
+{
+        struct ath10k *ar = file->private_data;
+        char buf[64];
+        u8 amsdu = 3, ampdu = 64;
+        unsigned int len;
+
+        mutex_lock(&ar->conf_mutex);
+
+        if (ar->debug.htt_max_amsdu)
+                amsdu = ar->debug.htt_max_amsdu;
+
+        if (ar->debug.htt_max_ampdu)
+                ampdu = ar->debug.htt_max_ampdu;
+
+        mutex_unlock(&ar->conf_mutex);
+
+        len = scnprintf(buf, sizeof(buf), "%u %u\n", amsdu, ampdu);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t ath10k_write_htt_max_amsdu_ampdu(struct file *file,
+                                                const char __user *user_buf,
+                                                size_t count, loff_t *ppos)
+{
+        struct ath10k *ar = file->private_data;
+        int res;
+        char buf[64];
+        unsigned int amsdu, ampdu;
+
+        simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf, count);
+
+        /* make sure that buf is null terminated */
+        buf[sizeof(buf) - 1] = 0;
+
+        res = sscanf(buf, "%u %u", &amsdu, &ampdu);
+
+        if (res != 2)
+                return -EINVAL;
+
+        mutex_lock(&ar->conf_mutex);
+
+        res = ath10k_htt_h2t_aggr_cfg_msg(&ar->htt, ampdu, amsdu);
+        if (res)
+                goto out;
+
+        res = count;
+        ar->debug.htt_max_amsdu = amsdu;
+        ar->debug.htt_max_ampdu = ampdu;
+
+out:
+        mutex_unlock(&ar->conf_mutex);
+        return res;
+}
+
+static const struct file_operations fops_htt_max_amsdu_ampdu = {
+        .read = ath10k_read_htt_max_amsdu_ampdu,
+        .write = ath10k_write_htt_max_amsdu_ampdu,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
 static ssize_t ath10k_read_fw_dbglog(struct file *file,
                                             char __user *user_buf,
                                             size_t count, loff_t *ppos)
@@ -757,6 +823,9 @@ void ath10k_debug_stop(struct ath10k *ar)
          * warning from del_timer(). */
         if (ar->debug.htt_stats_mask != 0)
                 cancel_delayed_work(&ar->debug.htt_stats_dwork);
+
+        ar->debug.htt_max_amsdu = 0;
+        ar->debug.htt_max_ampdu = 0;
 }
 
 static ssize_t ath10k_write_simulate_radar(struct file *file,
@@ -867,6 +936,10 @@ int ath10k_debug_create(struct ath10k *ar)
         debugfs_create_file("htt_stats_mask", S_IRUSR, ar->debug.debugfs_phy,
                             ar, &fops_htt_stats_mask);
 
+        debugfs_create_file("htt_max_amsdu_ampdu", S_IRUSR | S_IWUSR,
+                            ar->debug.debugfs_phy, ar,
+                            &fops_htt_max_amsdu_ampdu);
+
         debugfs_create_file("fw_dbglog", S_IRUSR, ar->debug.debugfs_phy,
                             ar, &fops_fw_dbglog);
 
diff --git a/drivers/net/wireless/ath/ath10k/htt.h b/drivers/net/wireless/ath/ath10k/htt.h
index 9a263462c793..6c93f3885ee5 100644
--- a/drivers/net/wireless/ath/ath10k/htt.h
+++ b/drivers/net/wireless/ath/ath10k/htt.h
@@ -240,16 +240,10 @@ struct htt_oob_sync_req {
         __le16 rsvd0;
 } __packed;
 
-#define HTT_AGGR_CONF_MAX_NUM_AMSDU_SUBFRAMES_MASK 0x1F
-#define HTT_AGGR_CONF_MAX_NUM_AMSDU_SUBFRAMES_LSB  0
-
 struct htt_aggr_conf {
         u8 max_num_ampdu_subframes;
-        union {
-                /* dont use bitfields; undefined behaviour */
-                u8 flags; /* see %HTT_AGGR_CONF_MAX_NUM_AMSDU_SUBFRAMES_ */
-                u8 max_num_amsdu_subframes:5;
-        } __packed;
+        /* amsdu_subframes is limited by 0x1F mask */
+        u8 max_num_amsdu_subframes;
 } __packed;
 
 #define HTT_MGMT_FRM_HDR_DOWNLOAD_LEN 32
@@ -1343,6 +1337,9 @@ void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb);
 int ath10k_htt_h2t_ver_req_msg(struct ath10k_htt *htt);
 int ath10k_htt_h2t_stats_req(struct ath10k_htt *htt, u8 mask, u64 cookie);
 int ath10k_htt_send_rx_ring_cfg_ll(struct ath10k_htt *htt);
+int ath10k_htt_h2t_aggr_cfg_msg(struct ath10k_htt *htt,
+                                u8 max_subfrms_ampdu,
+                                u8 max_subfrms_amsdu);
 
 void __ath10k_htt_tx_dec_pending(struct ath10k_htt *htt);
 int ath10k_htt_tx_alloc_msdu_id(struct ath10k_htt *htt);
diff --git a/drivers/net/wireless/ath/ath10k/htt_tx.c b/drivers/net/wireless/ath/ath10k/htt_tx.c
index 7064354d1f4f..accb6b4f6faf 100644
--- a/drivers/net/wireless/ath/ath10k/htt_tx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_tx.c
@@ -307,6 +307,52 @@ int ath10k_htt_send_rx_ring_cfg_ll(struct ath10k_htt *htt)
         return 0;
 }
 
+int ath10k_htt_h2t_aggr_cfg_msg(struct ath10k_htt *htt,
+                                u8 max_subfrms_ampdu,
+                                u8 max_subfrms_amsdu)
+{
+        struct htt_aggr_conf *aggr_conf;
+        struct sk_buff *skb;
+        struct htt_cmd *cmd;
+        int len;
+        int ret;
+
+        /* Firmware defaults are: amsdu = 3 and ampdu = 64 */
+
+        if (max_subfrms_ampdu == 0 || max_subfrms_ampdu > 64)
+                return -EINVAL;
+
+        if (max_subfrms_amsdu == 0 || max_subfrms_amsdu > 31)
+                return -EINVAL;
+
+        len = sizeof(cmd->hdr);
+        len += sizeof(cmd->aggr_conf);
+
+        skb = ath10k_htc_alloc_skb(len);
+        if (!skb)
+                return -ENOMEM;
+
+        skb_put(skb, len);
+        cmd = (struct htt_cmd *)skb->data;
+        cmd->hdr.msg_type = HTT_H2T_MSG_TYPE_AGGR_CFG;
+
+        aggr_conf = &cmd->aggr_conf;
+        aggr_conf->max_num_ampdu_subframes = max_subfrms_ampdu;
+        aggr_conf->max_num_amsdu_subframes = max_subfrms_amsdu;
+
+        ath10k_dbg(ATH10K_DBG_HTT, "htt h2t aggr cfg msg amsdu %d ampdu %d",
+                   aggr_conf->max_num_amsdu_subframes,
+                   aggr_conf->max_num_ampdu_subframes);
+
+        ret = ath10k_htc_send(&htt->ar->htc, htt->eid, skb);
+        if (ret) {
+                dev_kfree_skb_any(skb);
+                return ret;
+        }
+
+        return 0;
+}
+
 int ath10k_htt_mgmt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
 {
         struct device *dev = htt->ar->dev;
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index d0004d59c97e..06840d101c45 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -1362,8 +1362,6 @@ static int ath10k_pci_hif_exchange_bmi_msg(struct ath10k *ar,
                 ath10k_ce_recv_buf_enqueue(ce_rx, &xfer, resp_paddr);
         }
 
-        init_completion(&xfer.done);
-
         ret = ath10k_ce_send(ce_tx, &xfer, req_paddr, req_len, -1, 0);
         if (ret)
                 goto err_resp;
@@ -1414,10 +1412,7 @@ static void ath10k_pci_bmi_send_done(struct ath10k_ce_pipe *ce_state)
                                           &nbytes, &transfer_id))
                 return;
 
-        if (xfer->wait_for_resp)
-                return;
-
-        complete(&xfer->done);
+        xfer->tx_done = true;
 }
 
 static void ath10k_pci_bmi_recv_data(struct ath10k_ce_pipe *ce_state)
@@ -1438,7 +1433,7 @@ static void ath10k_pci_bmi_recv_data(struct ath10k_ce_pipe *ce_state)
         }
 
         xfer->resp_len = nbytes;
-        complete(&xfer->done);
+        xfer->rx_done = true;
 }
 
 static int ath10k_pci_bmi_wait(struct ath10k_ce_pipe *tx_pipe,
@@ -1451,7 +1446,7 @@ static int ath10k_pci_bmi_wait(struct ath10k_ce_pipe *tx_pipe,
                 ath10k_pci_bmi_send_done(tx_pipe);
                 ath10k_pci_bmi_recv_data(rx_pipe);
 
-                if (completion_done(&xfer->done))
+                if (xfer->tx_done && (xfer->rx_done == xfer->wait_for_resp))
                         return 0;
 
                 schedule();
diff --git a/drivers/net/wireless/ath/ath10k/pci.h b/drivers/net/wireless/ath/ath10k/pci.h
index dfdebb4157aa..940129209990 100644
--- a/drivers/net/wireless/ath/ath10k/pci.h
+++ b/drivers/net/wireless/ath/ath10k/pci.h
@@ -38,7 +38,8 @@
 #define DIAG_TRANSFER_LIMIT 2048
 
 struct bmi_xfer {
-        struct completion done;
+        bool tx_done;
+        bool rx_done;
         bool wait_for_resp;
         u32 resp_len;
 };
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index 4b7782a529ac..6f83cae57655 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -2106,7 +2106,6 @@ static void ath10k_wmi_main_process_rx(struct ath10k *ar, struct sk_buff *skb)
 {
         struct wmi_cmd_hdr *cmd_hdr;
         enum wmi_event_id id;
-        u16 len;
 
         cmd_hdr = (struct wmi_cmd_hdr *)skb->data;
         id = MS(__le32_to_cpu(cmd_hdr->cmd_id), WMI_CMD_HDR_CMD_ID);
@@ -2114,8 +2113,6 @@ static void ath10k_wmi_main_process_rx(struct ath10k *ar, struct sk_buff *skb)
         if (skb_pull(skb, sizeof(struct wmi_cmd_hdr)) == NULL)
                 return;
 
-        len = skb->len;
-
         trace_ath10k_wmi_event(id, skb->data, skb->len);
 
         switch (id) {
@@ -2225,7 +2222,6 @@ static void ath10k_wmi_10x_process_rx(struct ath10k *ar, struct sk_buff *skb)
 {
         struct wmi_cmd_hdr *cmd_hdr;
         enum wmi_10x_event_id id;
-        u16 len;
 
         cmd_hdr = (struct wmi_cmd_hdr *)skb->data;
         id = MS(__le32_to_cpu(cmd_hdr->cmd_id), WMI_CMD_HDR_CMD_ID);
@@ -2233,8 +2229,6 @@ static void ath10k_wmi_10x_process_rx(struct ath10k *ar, struct sk_buff *skb)
         if (skb_pull(skb, sizeof(struct wmi_cmd_hdr)) == NULL)
                 return;
 
-        len = skb->len;
-
         trace_ath10k_wmi_event(id, skb->data, skb->len);
 
         switch (id) {
diff --git a/drivers/net/wireless/ath/ath6kl/bmi.h b/drivers/net/wireless/ath/ath6kl/bmi.h
index 18fdd69e1f71..397a52f2628b 100644
--- a/drivers/net/wireless/ath/ath6kl/bmi.h
+++ b/drivers/net/wireless/ath/ath6kl/bmi.h
@@ -242,7 +242,8 @@ struct ath6kl_bmi_target_info {
                 (void) (check_type == val);                             \
                 addr = ath6kl_get_hi_item_addr(ar, HI_ITEM(item));      \
                 ret = ath6kl_bmi_read(ar, addr, (u8 *) &tmp, 4);        \
-                *val = le32_to_cpu(tmp);                                \
+                if (!ret)                                               \
+                        *val = le32_to_cpu(tmp);                        \
                 ret;                                                    \
         })
 
diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
index 1c4ce8e3eebe..e535807c3d89 100644
--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
@@ -2899,7 +2899,8 @@ static int ath6kl_start_ap(struct wiphy *wiphy, struct net_device *dev,
         if (info->inactivity_timeout) {
                 inactivity_timeout = info->inactivity_timeout;
 
-                if (ar->hw.flags & ATH6KL_HW_AP_INACTIVITY_MINS)
+                if (test_bit(ATH6KL_FW_CAPABILITY_AP_INACTIVITY_MINS,
+                             ar->fw_capabilities))
                         inactivity_timeout = DIV_ROUND_UP(inactivity_timeout,
                                                           60);
 
@@ -3782,7 +3783,8 @@ int ath6kl_cfg80211_init(struct ath6kl *ar)
                 ath6kl_band_5ghz.ht_cap.ht_supported = false;
         }
 
-        if (ar->hw.flags & ATH6KL_HW_64BIT_RATES) {
+        if (test_bit(ATH6KL_FW_CAPABILITY_64BIT_RATES,
+                     ar->fw_capabilities)) {
                 ath6kl_band_2ghz.ht_cap.mcs.rx_mask[0] = 0xff;
                 ath6kl_band_5ghz.ht_cap.mcs.rx_mask[0] = 0xff;
                 ath6kl_band_2ghz.ht_cap.mcs.rx_mask[1] = 0xff;
diff --git a/drivers/net/wireless/ath/ath6kl/core.c b/drivers/net/wireless/ath/ath6kl/core.c
index b0b652042760..0df74b245af4 100644
--- a/drivers/net/wireless/ath/ath6kl/core.c
+++ b/drivers/net/wireless/ath/ath6kl/core.c
@@ -123,6 +123,22 @@ int ath6kl_core_init(struct ath6kl *ar, enum ath6kl_htc_type htc_type)
 
         /* FIXME: we should free all firmwares in the error cases below */
 
+        /*
+         * Backwards compatibility support for older ar6004 firmware images
+         * which do not set these feature flags.
+         */
+        if (ar->target_type == TARGET_TYPE_AR6004 &&
+            ar->fw_api <= 4) {
+                __set_bit(ATH6KL_FW_CAPABILITY_64BIT_RATES,
+                          ar->fw_capabilities);
+                __set_bit(ATH6KL_FW_CAPABILITY_AP_INACTIVITY_MINS,
+                          ar->fw_capabilities);
+
+                if (ar->hw.id == AR6004_HW_1_3_VERSION)
+                        __set_bit(ATH6KL_FW_CAPABILITY_MAP_LP_ENDPOINT,
+                                  ar->fw_capabilities);
+        }
+
         /* Indicate that WMI is enabled (although not ready yet) */
         set_bit(WMI_ENABLED, &ar->flag);
         ar->wmi = ath6kl_wmi_init(ar);
diff --git a/drivers/net/wireless/ath/ath6kl/core.h b/drivers/net/wireless/ath/ath6kl/core.h
index 26b0f92424e1..2b78c863d030 100644
--- a/drivers/net/wireless/ath/ath6kl/core.h
+++ b/drivers/net/wireless/ath/ath6kl/core.h
@@ -136,6 +136,21 @@ enum ath6kl_fw_capability {
          */
         ATH6KL_FW_CAPABILITY_HEART_BEAT_POLL,
 
+        /* WMI_SET_TX_SELECT_RATES_CMDID uses 64 bit size rate table */
+        ATH6KL_FW_CAPABILITY_64BIT_RATES,
+
+        /* WMI_AP_CONN_INACT_CMDID uses minutes as units */
+        ATH6KL_FW_CAPABILITY_AP_INACTIVITY_MINS,
+
+        /* use low priority endpoint for all data */
+        ATH6KL_FW_CAPABILITY_MAP_LP_ENDPOINT,
+
+        /* ratetable is the 2 stream version (max MCS15) */
+        ATH6KL_FW_CAPABILITY_RATETABLE_MCS15,
+
+        /* firmare doesn't support IP checksumming */
+        ATH6KL_FW_CAPABILITY_NO_IP_CHECKSUM,
+
         /* this needs to be last */
         ATH6KL_FW_CAPABILITY_MAX,
 };
@@ -149,15 +164,13 @@ struct ath6kl_fw_ie {
 };
 
 enum ath6kl_hw_flags {
-        ATH6KL_HW_64BIT_RATES           = BIT(0),
-        ATH6KL_HW_AP_INACTIVITY_MINS    = BIT(1),
-        ATH6KL_HW_MAP_LP_ENDPOINT       = BIT(2),
         ATH6KL_HW_SDIO_CRC_ERROR_WAR    = BIT(3),
 };
 
 #define ATH6KL_FW_API2_FILE "fw-2.bin"
 #define ATH6KL_FW_API3_FILE "fw-3.bin"
 #define ATH6KL_FW_API4_FILE "fw-4.bin"
+#define ATH6KL_FW_API5_FILE "fw-5.bin"
 
 /* AR6003 1.0 definitions */
 #define AR6003_HW_1_0_VERSION                 0x300002ba
@@ -215,8 +228,21 @@ enum ath6kl_hw_flags {
 #define AR6004_HW_1_3_VERSION                   0x31c8088a
 #define AR6004_HW_1_3_FW_DIR                    "ath6k/AR6004/hw1.3"
 #define AR6004_HW_1_3_FIRMWARE_FILE             "fw.ram.bin"
-#define AR6004_HW_1_3_BOARD_DATA_FILE           "ath6k/AR6004/hw1.3/bdata.bin"
-#define AR6004_HW_1_3_DEFAULT_BOARD_DATA_FILE   "ath6k/AR6004/hw1.3/bdata.bin"
+#define AR6004_HW_1_3_TCMD_FIRMWARE_FILE        "utf.bin"
+#define AR6004_HW_1_3_UTF_FIRMWARE_FILE         "utf.bin"
+#define AR6004_HW_1_3_TESTSCRIPT_FILE           "nullTestFlow.bin"
+#define AR6004_HW_1_3_BOARD_DATA_FILE         AR6004_HW_1_3_FW_DIR "/bdata.bin"
+#define AR6004_HW_1_3_DEFAULT_BOARD_DATA_FILE AR6004_HW_1_3_FW_DIR "/bdata.bin"
+
+/* AR6004 3.0 definitions */
+#define AR6004_HW_3_0_VERSION                   0x31C809F8
+#define AR6004_HW_3_0_FW_DIR                    "ath6k/AR6004/hw3.0"
+#define AR6004_HW_3_0_FIRMWARE_FILE             "fw.ram.bin"
+#define AR6004_HW_3_0_TCMD_FIRMWARE_FILE        "utf.bin"
+#define AR6004_HW_3_0_UTF_FIRMWARE_FILE         "utf.bin"
+#define AR6004_HW_3_0_TESTSCRIPT_FILE           "nullTestFlow.bin"
+#define AR6004_HW_3_0_BOARD_DATA_FILE         AR6004_HW_3_0_FW_DIR "/bdata.bin"
+#define AR6004_HW_3_0_DEFAULT_BOARD_DATA_FILE AR6004_HW_3_0_FW_DIR "/bdata.bin"
 
 /* Per STA data, used in AP mode */
 #define STA_PS_AWAKE            BIT(0)
diff --git a/drivers/net/wireless/ath/ath6kl/htc_pipe.c b/drivers/net/wireless/ath/ath6kl/htc_pipe.c
index 756fe52a12c8..ca1a18c86c0d 100644
--- a/drivers/net/wireless/ath/ath6kl/htc_pipe.c
+++ b/drivers/net/wireless/ath/ath6kl/htc_pipe.c
@@ -1170,8 +1170,12 @@ static int htc_wait_recv_ctrl_message(struct htc_target *target)
 static void htc_rxctrl_complete(struct htc_target *context,
                                 struct htc_packet *packet)
 {
-        /* TODO, can't really receive HTC control messages yet.... */
-        ath6kl_dbg(ATH6KL_DBG_HTC, "%s: invalid call function\n", __func__);
+        struct sk_buff *skb = packet->skb;
+
+        if (packet->endpoint == ENDPOINT_0 &&
+            packet->status == -ECANCELED &&
+            skb != NULL)
+                dev_kfree_skb(skb);
 }
 
 /* htc pipe initialization */
@@ -1678,7 +1682,29 @@ static void ath6kl_htc_pipe_activity_changed(struct htc_target *target,
 
 static void ath6kl_htc_pipe_flush_rx_buf(struct htc_target *target)
 {
-        /* TODO */
+        struct htc_endpoint *endpoint;
+        struct htc_packet *packet, *tmp_pkt;
+        int i;
+
+        for (i = ENDPOINT_0; i < ENDPOINT_MAX; i++) {
+                endpoint = &target->endpoint[i];
+
+                spin_lock_bh(&target->rx_lock);
+
+                list_for_each_entry_safe(packet, tmp_pkt,
+                                         &endpoint->rx_bufq, list) {
+                        list_del(&packet->list);
+                        spin_unlock_bh(&target->rx_lock);
+                        ath6kl_dbg(ATH6KL_DBG_HTC,
+                                   "htc rx flush pkt 0x%p len %d ep %d\n",
+                                   packet, packet->buf_len,
+                                   packet->endpoint);
+                        dev_kfree_skb(packet->pkt_cntxt);
+                        spin_lock_bh(&target->rx_lock);
+                }
+
+                spin_unlock_bh(&target->rx_lock);
+        }
 }
 
 static int ath6kl_htc_pipe_credit_setup(struct htc_target *target,
diff --git a/drivers/net/wireless/ath/ath6kl/init.c b/drivers/net/wireless/ath/ath6kl/init.c
index 8ee7097f0b25..fffd52355123 100644
--- a/drivers/net/wireless/ath/ath6kl/init.c
+++ b/drivers/net/wireless/ath/ath6kl/init.c
@@ -93,8 +93,7 @@ static const struct ath6kl_hw hw_list[] = {
                 .board_addr                     = 0x433900,
                 .refclk_hz                      = 26000000,
                 .uarttx_pin                     = 11,
-                .flags                          = ATH6KL_HW_64BIT_RATES |
-                                                  ATH6KL_HW_AP_INACTIVITY_MINS,
+                .flags                          = 0,
 
                 .fw = {
                         .dir            = AR6004_HW_1_0_FW_DIR,
@@ -114,8 +113,7 @@ static const struct ath6kl_hw hw_list[] = {
                 .board_addr                     = 0x43d400,
                 .refclk_hz                      = 40000000,
                 .uarttx_pin                     = 11,
-                .flags                          = ATH6KL_HW_64BIT_RATES |
-                                                  ATH6KL_HW_AP_INACTIVITY_MINS,
+                .flags                          = 0,
                 .fw = {
                         .dir            = AR6004_HW_1_1_FW_DIR,
                         .fw             = AR6004_HW_1_1_FIRMWARE_FILE,
@@ -134,8 +132,7 @@ static const struct ath6kl_hw hw_list[] = {
                 .board_addr                     = 0x435c00,
                 .refclk_hz                      = 40000000,
                 .uarttx_pin                     = 11,
-                .flags                          = ATH6KL_HW_64BIT_RATES |
-                                                  ATH6KL_HW_AP_INACTIVITY_MINS,
+                .flags                          = 0,
 
                 .fw = {
                         .dir            = AR6004_HW_1_2_FW_DIR,
@@ -152,20 +149,43 @@ static const struct ath6kl_hw hw_list[] = {
                 .board_ext_data_addr            = 0x437000,
                 .reserved_ram_size              = 7168,
                 .board_addr                     = 0x436400,
-                .refclk_hz                      = 40000000,
+                .refclk_hz                      = 0,
                 .uarttx_pin                     = 11,
-                .flags                          = ATH6KL_HW_64BIT_RATES |
-                                                  ATH6KL_HW_AP_INACTIVITY_MINS |
-                                                  ATH6KL_HW_MAP_LP_ENDPOINT,
+                .flags                          = 0,
 
                 .fw = {
                         .dir            = AR6004_HW_1_3_FW_DIR,
                         .fw             = AR6004_HW_1_3_FIRMWARE_FILE,
+                        .tcmd           = AR6004_HW_1_3_TCMD_FIRMWARE_FILE,
+                        .utf            = AR6004_HW_1_3_UTF_FIRMWARE_FILE,
+                        .testscript     = AR6004_HW_1_3_TESTSCRIPT_FILE,
                 },
 
                 .fw_board               = AR6004_HW_1_3_BOARD_DATA_FILE,
                 .fw_default_board       = AR6004_HW_1_3_DEFAULT_BOARD_DATA_FILE,
         },
+        {
+                .id                             = AR6004_HW_3_0_VERSION,
+                .name                           = "ar6004 hw 3.0",
+                .dataset_patch_addr             = 0,
+                .app_load_addr                  = 0x1234,
+                .board_ext_data_addr            = 0,
+                .reserved_ram_size              = 7168,
+                .board_addr                     = 0x436400,
+                .testscript_addr                = 0,
+                .flags                          = 0,
+
+                .fw = {
+                        .dir            = AR6004_HW_3_0_FW_DIR,
+                        .fw             = AR6004_HW_3_0_FIRMWARE_FILE,
+                        .tcmd           = AR6004_HW_3_0_TCMD_FIRMWARE_FILE,
+                        .utf            = AR6004_HW_3_0_UTF_FIRMWARE_FILE,
+                        .testscript     = AR6004_HW_3_0_TESTSCRIPT_FILE,
+                },
+
+                .fw_board               = AR6004_HW_3_0_BOARD_DATA_FILE,
+                .fw_default_board       = AR6004_HW_3_0_DEFAULT_BOARD_DATA_FILE,
+        },
 };
 
 /*
@@ -601,7 +621,9 @@ int ath6kl_configure_target(struct ath6kl *ar)
          * but possible in theory.
          */
 
-        if (ar->target_type == TARGET_TYPE_AR6003) {
+        if ((ar->target_type == TARGET_TYPE_AR6003) ||
+            (ar->version.target_ver == AR6004_HW_1_3_VERSION) ||
+            (ar->version.target_ver == AR6004_HW_3_0_VERSION)) {
                 param = ar->hw.board_ext_data_addr;
                 ram_reserved_size = ar->hw.reserved_ram_size;
 
@@ -629,9 +651,12 @@ int ath6kl_configure_target(struct ath6kl *ar)
                 return status;
 
         /* Configure target refclk_hz */
-        status = ath6kl_bmi_write_hi32(ar, hi_refclk_hz, ar->hw.refclk_hz);
-        if (status)
-                return status;
+        if (ar->hw.refclk_hz != 0) {
+                status = ath6kl_bmi_write_hi32(ar, hi_refclk_hz,
+                                               ar->hw.refclk_hz);
+                if (status)
+                        return status;
+        }
 
         return 0;
 }
@@ -1112,6 +1137,12 @@ int ath6kl_init_fetch_firmwares(struct ath6kl *ar)
         if (ret)
                 return ret;
 
+        ret = ath6kl_fetch_fw_apin(ar, ATH6KL_FW_API5_FILE);
+        if (ret == 0) {
+                ar->fw_api = 5;
+                goto out;
+        }
+
         ret = ath6kl_fetch_fw_apin(ar, ATH6KL_FW_API4_FILE);
         if (ret == 0) {
                 ar->fw_api = 4;
@@ -1161,11 +1192,19 @@ static int ath6kl_upload_board_file(struct ath6kl *ar)
                 ath6kl_bmi_write_hi32(ar, hi_board_data,
                                       board_address);
         } else {
-                ath6kl_bmi_read_hi32(ar, hi_board_data, &board_address);
+                ret = ath6kl_bmi_read_hi32(ar, hi_board_data, &board_address);
+                if (ret) {
+                        ath6kl_err("Failed to get board file target address.\n");
+                        return ret;
+                }
         }
 
         /* determine where in target ram to write extended board data */
-        ath6kl_bmi_read_hi32(ar, hi_board_ext_data, &board_ext_address);
+        ret = ath6kl_bmi_read_hi32(ar, hi_board_ext_data, &board_ext_address);
+        if (ret) {
+                ath6kl_err("Failed to get extended board file target address.\n");
+                return ret;
+        }
 
         if (ar->target_type == TARGET_TYPE_AR6003 &&
             board_ext_address == 0) {
@@ -1229,7 +1268,13 @@ static int ath6kl_upload_board_file(struct ath6kl *ar)
         }
 
         /* record the fact that Board Data IS initialized */
-        ath6kl_bmi_write_hi32(ar, hi_board_data_initialized, 1);
+        if ((ar->version.target_ver == AR6004_HW_1_3_VERSION) ||
+            (ar->version.target_ver == AR6004_HW_3_0_VERSION))
+                param = board_data_size;
+        else
+                param = 1;
+
+        ath6kl_bmi_write_hi32(ar, hi_board_data_initialized, param);
 
         return ret;
 }
@@ -1360,7 +1405,11 @@ static int ath6kl_upload_testscript(struct ath6kl *ar)
         }
 
         ath6kl_bmi_write_hi32(ar, hi_ota_testscript, address);
-        ath6kl_bmi_write_hi32(ar, hi_end_ram_reserve_sz, 4096);
+
+        if ((ar->version.target_ver != AR6004_HW_1_3_VERSION) &&
+            (ar->version.target_ver != AR6004_HW_3_0_VERSION))
+                ath6kl_bmi_write_hi32(ar, hi_end_ram_reserve_sz, 4096);
+
         ath6kl_bmi_write_hi32(ar, hi_test_apps_related, 1);
 
         return 0;
@@ -1566,6 +1615,11 @@ static const struct fw_capa_str_map {
         { ATH6KL_FW_CAPABILITY_REGDOMAIN, "regdomain" },
         { ATH6KL_FW_CAPABILITY_SCHED_SCAN_V2, "sched-scan-v2" },
         { ATH6KL_FW_CAPABILITY_HEART_BEAT_POLL, "hb-poll" },
+        { ATH6KL_FW_CAPABILITY_64BIT_RATES, "64bit-rates" },
+        { ATH6KL_FW_CAPABILITY_AP_INACTIVITY_MINS, "ap-inactivity-mins" },
+        { ATH6KL_FW_CAPABILITY_MAP_LP_ENDPOINT, "map-lp-endpoint" },
+        { ATH6KL_FW_CAPABILITY_RATETABLE_MCS15, "ratetable-mcs15" },
+        { ATH6KL_FW_CAPABILITY_NO_IP_CHECKSUM, "no-ip-checksum" },
 };
 
 static const char *ath6kl_init_get_fw_capa_name(unsigned int id)
diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c
index d56554674da4..21516bc65785 100644
--- a/drivers/net/wireless/ath/ath6kl/main.c
+++ b/drivers/net/wireless/ath/ath6kl/main.c
@@ -702,6 +702,7 @@ static void ath6kl_update_target_stats(struct ath6kl_vif *vif, u8 *ptr, u32 len)
         struct ath6kl *ar = vif->ar;
         struct target_stats *stats = &vif->target_stats;
         struct tkip_ccmp_stats *ccmp_stats;
+        s32 rate;
         u8 ac;
 
         if (len < sizeof(*tgt_stats))
@@ -731,8 +732,9 @@ static void ath6kl_update_target_stats(struct ath6kl_vif *vif, u8 *ptr, u32 len)
                 le32_to_cpu(tgt_stats->stats.tx.mult_retry_cnt);
         stats->tx_rts_fail_cnt +=
                 le32_to_cpu(tgt_stats->stats.tx.rts_fail_cnt);
-        stats->tx_ucast_rate =
-            ath6kl_wmi_get_rate(a_sle32_to_cpu(tgt_stats->stats.tx.ucast_rate));
+
+        rate = a_sle32_to_cpu(tgt_stats->stats.tx.ucast_rate);
+        stats->tx_ucast_rate = ath6kl_wmi_get_rate(ar->wmi, rate);
 
         stats->rx_pkt += le32_to_cpu(tgt_stats->stats.rx.pkt);
         stats->rx_byte += le32_to_cpu(tgt_stats->stats.rx.byte);
@@ -749,8 +751,9 @@ static void ath6kl_update_target_stats(struct ath6kl_vif *vif, u8 *ptr, u32 len)
                 le32_to_cpu(tgt_stats->stats.rx.key_cache_miss);
         stats->rx_decrypt_err += le32_to_cpu(tgt_stats->stats.rx.decrypt_err);
         stats->rx_dupl_frame += le32_to_cpu(tgt_stats->stats.rx.dupl_frame);
-        stats->rx_ucast_rate =
-            ath6kl_wmi_get_rate(a_sle32_to_cpu(tgt_stats->stats.rx.ucast_rate));
+
+        rate = a_sle32_to_cpu(tgt_stats->stats.rx.ucast_rate);
+        stats->rx_ucast_rate = ath6kl_wmi_get_rate(ar->wmi, rate);
 
         ccmp_stats = &tgt_stats->stats.tkip_ccmp_stats;
 
@@ -1290,6 +1293,8 @@ static const struct net_device_ops ath6kl_netdev_ops = {
 
 void init_netdev(struct net_device *dev)
 {
+        struct ath6kl *ar = ath6kl_priv(dev);
+
         dev->netdev_ops = &ath6kl_netdev_ops;
         dev->destructor = free_netdev;
         dev->watchdog_timeo = ATH6KL_TX_TIMEOUT;
@@ -1301,7 +1306,9 @@ void init_netdev(struct net_device *dev)
                                         WMI_MAX_TX_META_SZ +
                                         ATH6KL_HTC_ALIGN_BYTES, 4);
 
-        dev->hw_features |= NETIF_F_IP_CSUM | NETIF_F_RXCSUM;
+        if (!test_bit(ATH6KL_FW_CAPABILITY_NO_IP_CHECKSUM,
+                      ar->fw_capabilities))
+                dev->hw_features |= NETIF_F_IP_CSUM | NETIF_F_RXCSUM;
 
         return;
 }
diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c
index 3afc5a463d06..c44325856b81 100644
--- a/drivers/net/wireless/ath/ath6kl/usb.c
+++ b/drivers/net/wireless/ath/ath6kl/usb.c
@@ -802,7 +802,8 @@ static int ath6kl_usb_map_service_pipe(struct ath6kl *ar, u16 svc_id,
                 break;
         case WMI_DATA_VI_SVC:
 
-                if (ar->hw.flags & ATH6KL_HW_MAP_LP_ENDPOINT)
+                if (test_bit(ATH6KL_FW_CAPABILITY_MAP_LP_ENDPOINT,
+                             ar->fw_capabilities))
                         *ul_pipe = ATH6KL_USB_PIPE_TX_DATA_LP;
                 else
                         *ul_pipe = ATH6KL_USB_PIPE_TX_DATA_MP;
@@ -814,7 +815,8 @@ static int ath6kl_usb_map_service_pipe(struct ath6kl *ar, u16 svc_id,
                 break;
         case WMI_DATA_VO_SVC:
 
-                if (ar->hw.flags & ATH6KL_HW_MAP_LP_ENDPOINT)
+                if (test_bit(ATH6KL_FW_CAPABILITY_MAP_LP_ENDPOINT,
+                             ar->fw_capabilities))
                         *ul_pipe = ATH6KL_USB_PIPE_TX_DATA_LP;
                 else
                         *ul_pipe = ATH6KL_USB_PIPE_TX_DATA_MP;
@@ -1208,6 +1210,7 @@ static int ath6kl_usb_pm_reset_resume(struct usb_interface *intf)
 
 /* table of devices that work with this driver */
 static struct usb_device_id ath6kl_usb_ids[] = {
+        {USB_DEVICE(0x0cf3, 0x9375)},
         {USB_DEVICE(0x0cf3, 0x9374)},
         { /* Terminating entry */ },
 };
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
index 4d7f9e4712e9..94df345d08c2 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.c
+++ b/drivers/net/wireless/ath/ath6kl/wmi.c
@@ -59,6 +59,55 @@ static const s32 wmi_rate_tbl[][2] = {
         {0, 0}
 };
 
+static const s32 wmi_rate_tbl_mcs15[][2] = {
+        /* {W/O SGI, with SGI} */
+        {1000, 1000},
+        {2000, 2000},
+        {5500, 5500},
+        {11000, 11000},
+        {6000, 6000},
+        {9000, 9000},
+        {12000, 12000},
+        {18000, 18000},
+        {24000, 24000},
+        {36000, 36000},
+        {48000, 48000},
+        {54000, 54000},
+        {6500, 7200},     /* HT 20, MCS 0 */
+        {13000, 14400},
+        {19500, 21700},
+        {26000, 28900},
+        {39000, 43300},
+        {52000, 57800},
+        {58500, 65000},
+        {65000, 72200},
+        {13000, 14400},   /* HT 20, MCS 8 */
+        {26000, 28900},
+        {39000, 43300},
+        {52000, 57800},
+        {78000, 86700},
+        {104000, 115600},
+        {117000, 130000},
+        {130000, 144400}, /* HT 20, MCS 15 */
+        {13500, 15000},   /*HT 40, MCS 0 */
+        {27000, 30000},
+        {40500, 45000},
+        {54000, 60000},
+        {81000, 90000},
+        {108000, 120000},
+        {121500, 135000},
+        {135000, 150000},
+        {27000, 30000},   /*HT 40, MCS 8 */
+        {54000, 60000},
+        {81000, 90000},
+        {108000, 120000},
+        {162000, 180000},
+        {216000, 240000},
+        {243000, 270000},
+        {270000, 300000}, /*HT 40, MCS 15 */
+        {0, 0}
+};
+
 /* 802.1d to AC mapping. Refer pg 57 of WMM-test-plan-v1.2 */
 static const u8 up_to_ac[] = {
         WMM_AC_BE,
@@ -2838,7 +2887,8 @@ int ath6kl_wmi_set_bitrate_mask(struct wmi *wmi, u8 if_idx,
 {
         struct ath6kl *ar = wmi->parent_dev;
 
-        if (ar->hw.flags & ATH6KL_HW_64BIT_RATES)
+        if (test_bit(ATH6KL_FW_CAPABILITY_64BIT_RATES,
+                     ar->fw_capabilities))
                 return ath6kl_set_bitrate_mask64(wmi, if_idx, mask);
         else
                 return ath6kl_set_bitrate_mask32(wmi, if_idx, mask);
@@ -3279,9 +3329,11 @@ int ath6kl_wmi_set_regdomain_cmd(struct wmi *wmi, const char *alpha2)
                                    NO_SYNC_WMIFLAG);
 }
 
-s32 ath6kl_wmi_get_rate(s8 rate_index)
+s32 ath6kl_wmi_get_rate(struct wmi *wmi, s8 rate_index)
 {
+        struct ath6kl *ar = wmi->parent_dev;
         u8 sgi = 0;
+        s32 ret;
 
         if (rate_index == RATE_AUTO)
                 return 0;
@@ -3292,10 +3344,20 @@ s32 ath6kl_wmi_get_rate(s8 rate_index)
                 sgi = 1;
         }
 
-        if (WARN_ON(rate_index > RATE_MCS_7_40))
-                rate_index = RATE_MCS_7_40;
+        if (test_bit(ATH6KL_FW_CAPABILITY_RATETABLE_MCS15,
+                     ar->fw_capabilities)) {
+                if (WARN_ON(rate_index >= ARRAY_SIZE(wmi_rate_tbl_mcs15)))
+                        return 0;
+
+                ret = wmi_rate_tbl_mcs15[(u32) rate_index][sgi];
+        } else {
+                if (WARN_ON(rate_index >= ARRAY_SIZE(wmi_rate_tbl)))
+                        return 0;
 
-        return wmi_rate_tbl[(u32) rate_index][sgi];
+                ret = wmi_rate_tbl[(u32) rate_index][sgi];
+        }
+
+        return ret;
 }
 
 static int ath6kl_wmi_get_pmkid_list_event_rx(struct wmi *wmi, u8 *datap,
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.h b/drivers/net/wireless/ath/ath6kl/wmi.h
index bb23fc00111d..19f88b4a24fb 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.h
+++ b/drivers/net/wireless/ath/ath6kl/wmi.h
@@ -2632,7 +2632,7 @@ int ath6kl_wmi_set_htcap_cmd(struct wmi *wmi, u8 if_idx,
                              struct ath6kl_htcap *htcap);
 int ath6kl_wmi_test_cmd(struct wmi *wmi, void *buf, size_t len);
 
-s32 ath6kl_wmi_get_rate(s8 rate_index);
+s32 ath6kl_wmi_get_rate(struct wmi *wmi, s8 rate_index);
 
 int ath6kl_wmi_set_ip_cmd(struct wmi *wmi, u8 if_idx,
                           __be32 ips0, __be32 ips1);
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_mac.c b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
index 741b38ddcb37..59af9f9712da 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_mac.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
@@ -281,7 +281,7 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
 
         ACCESS_ONCE(ads->ds_ctl0) = (i->pkt_len & AR_FrameLen)
                 | (i->flags & ATH9K_TXDESC_VMF ? AR_VirtMoreFrag : 0)
-                | SM(i->txpower, AR_XmitPower)
+                | SM(i->txpower, AR_XmitPower0)
                 | (i->flags & ATH9K_TXDESC_VEOL ? AR_VEOL : 0)
                 | (i->flags & ATH9K_TXDESC_INTREQ ? AR_TxIntrReq : 0)
                 | (i->keyix != ATH9K_TXKEYIX_INVALID ? AR_DestIdxValid : 0)
@@ -306,6 +306,10 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
                 | set11nRateFlags(i->rates, 2)
                 | set11nRateFlags(i->rates, 3)
                 | SM(i->rtscts_rate, AR_RTSCTSRate);
+
+        ACCESS_ONCE(ads->ds_ctl9) = SM(i->txpower, AR_XmitPower1);
+        ACCESS_ONCE(ads->ds_ctl10) = SM(i->txpower, AR_XmitPower2);
+        ACCESS_ONCE(ads->ds_ctl11) = SM(i->txpower, AR_XmitPower3);
 }
 
 static int ar9002_hw_proc_txdesc(struct ath_hw *ah, void *ds,
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mac.c b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
index 729ffbf07343..71e38e85aa99 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
@@ -101,7 +101,7 @@ ar9003_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
 
         ACCESS_ONCE(ads->ctl11) = (i->pkt_len & AR_FrameLen)
                 | (i->flags & ATH9K_TXDESC_VMF ? AR_VirtMoreFrag : 0)
-                | SM(i->txpower, AR_XmitPower)
+                | SM(i->txpower, AR_XmitPower0)
                 | (i->flags & ATH9K_TXDESC_VEOL ? AR_VEOL : 0)
                 | (i->keyix != ATH9K_TXKEYIX_INVALID ? AR_DestIdxValid : 0)
                 | (i->flags & ATH9K_TXDESC_LOWRXCHAIN ? AR_LowRxChain : 0)
@@ -151,6 +151,10 @@ ar9003_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
                 | SM(i->rtscts_rate, AR_RTSCTSRate);
 
         ACCESS_ONCE(ads->ctl19) = AR_Not_Sounding;
+
+        ACCESS_ONCE(ads->ctl20) = SM(i->txpower, AR_XmitPower1);
+        ACCESS_ONCE(ads->ctl21) = SM(i->txpower, AR_XmitPower2);
+        ACCESS_ONCE(ads->ctl22) = SM(i->txpower, AR_XmitPower3);
 }
 
 static u16 ar9003_calc_ptr_chksum(struct ar9003_txc *ads)
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 11b5e4dd6294..7fc13a8da675 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -182,7 +182,8 @@ struct ath_atx_ac {
 
 struct ath_frame_info {
         struct ath_buf *bf;
-        int framelen;
+        u16 framelen;
+        s8 txq;
         enum ath9k_key_type keytype;
         u8 keyix;
         u8 rtscts_rate;
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index ce073e995dfe..d2279365be6f 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -202,7 +202,7 @@ static ssize_t write_file_ani(struct file *file,
         if (kstrtoul(buf, 0, &ani))
                 return -EINVAL;
 
-        if (ani < 0 || ani > 1)
+        if (ani > 1)
                 return -EINVAL;
 
         common->disable_ani = !ani;
diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h
index da7686757535..6c56cafa5ca4 100644
--- a/drivers/net/wireless/ath/ath9k/mac.h
+++ b/drivers/net/wireless/ath/ath9k/mac.h
@@ -346,8 +346,14 @@ struct ar5416_desc {
 #define AR_FrameLen         0x00000fff
 #define AR_VirtMoreFrag     0x00001000
 #define AR_TxCtlRsvd00      0x0000e000
-#define AR_XmitPower        0x003f0000
-#define AR_XmitPower_S      16
+#define AR_XmitPower0       0x003f0000
+#define AR_XmitPower0_S     16
+#define AR_XmitPower1       0x3f000000
+#define AR_XmitPower1_S     24
+#define AR_XmitPower2       0x3f000000
+#define AR_XmitPower2_S     24
+#define AR_XmitPower3       0x3f000000
+#define AR_XmitPower3_S     24
 #define AR_RTSEnable        0x00400000
 #define AR_VEOL             0x00800000
 #define AR_ClrDestMask      0x01000000
diff --git a/drivers/net/wireless/ath/ath9k/spectral.c b/drivers/net/wireless/ath/ath9k/spectral.c
index 99f4de95c264..5fe29b9f8fa2 100644
--- a/drivers/net/wireless/ath/ath9k/spectral.c
+++ b/drivers/net/wireless/ath/ath9k/spectral.c
@@ -313,7 +313,7 @@ static ssize_t write_file_spectral_short_repeat(struct file *file,
         if (kstrtoul(buf, 0, &val))
                 return -EINVAL;
 
-        if (val < 0 || val > 1)
+        if (val > 1)
                 return -EINVAL;
 
         sc->spec_config.short_repeat = val;
@@ -361,7 +361,7 @@ static ssize_t write_file_spectral_count(struct file *file,
         if (kstrtoul(buf, 0, &val))
                 return -EINVAL;
 
-        if (val < 0 || val > 255)
+        if (val > 255)
                 return -EINVAL;
 
         sc->spec_config.count = val;
@@ -409,7 +409,7 @@ static ssize_t write_file_spectral_period(struct file *file,
         if (kstrtoul(buf, 0, &val))
                 return -EINVAL;
 
-        if (val < 0 || val > 255)
+        if (val > 255)
                 return -EINVAL;
 
         sc->spec_config.period = val;
@@ -457,7 +457,7 @@ static ssize_t write_file_spectral_fft_period(struct file *file,
         if (kstrtoul(buf, 0, &val))
                 return -EINVAL;
 
-        if (val < 0 || val > 15)
+        if (val > 15)
                 return -EINVAL;
 
         sc->spec_config.fft_period = val;
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index d4927c9a6bae..704fcbcbe20b 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -157,15 +157,14 @@ static void ath_txq_skb_done(struct ath_softc *sc, struct ath_txq *txq,
                              struct sk_buff *skb)
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        int q, hw_queue;
-
-        q = skb_get_queue_mapping(skb);
-        if (txq == sc->tx.uapsdq)
-                txq = sc->tx.txq_map[q];
+        struct ath_frame_info *fi = get_frame_info(skb);
+        int hw_queue;
+        int q = fi->txq;
 
-        if (txq != sc->tx.txq_map[q])
+        if (q < 0)
                 return;
 
+        txq = sc->tx.txq_map[q];
         if (WARN_ON(--txq->pending_frames < 0))
                 txq->pending_frames = 0;
 
@@ -898,6 +897,15 @@ ath_tx_get_tid_subframe(struct ath_softc *sc, struct ath_txq *txq,
 
                 tx_info = IEEE80211_SKB_CB(skb);
                 tx_info->flags &= ~IEEE80211_TX_CTL_CLEAR_PS_FILT;
+
+                /*
+                 * No aggregation session is running, but there may be frames
+                 * from a previous session or a failed attempt in the queue.
+                 * Send them out as normal data frames
+                 */
+                if (!tid->active)
+                        tx_info->flags &= ~IEEE80211_TX_CTL_AMPDU;
+
                 if (!(tx_info->flags & IEEE80211_TX_CTL_AMPDU)) {
                         bf->bf_state.bf_type = 0;
                         return bf;
@@ -2036,6 +2044,7 @@ static void setup_frame_info(struct ieee80211_hw *hw,
                 an = (struct ath_node *) sta->drv_priv;
 
         memset(fi, 0, sizeof(*fi));
+        fi->txq = -1;
         if (hw_key)
                 fi->keyix = hw_key->hw_key_idx;
         else if (an && ieee80211_is_data(hdr->frame_control) && an->ps_key > 0)
@@ -2187,6 +2196,7 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_sta *sta = txctl->sta;
         struct ieee80211_vif *vif = info->control.vif;
+        struct ath_frame_info *fi = get_frame_info(skb);
         struct ath_vif *avp = NULL;
         struct ath_softc *sc = hw->priv;
         struct ath_txq *txq = txctl->txq;
@@ -2216,11 +2226,13 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
         hw_queue = (info->hw_queue >= sc->hw->queues - 2) ? q : info->hw_queue;
 
         ath_txq_lock(sc, txq);
-        if (txq == sc->tx.txq_map[q] &&
-            ++txq->pending_frames > sc->tx.txq_max_pending[q] &&
-            !txq->stopped) {
-                ieee80211_stop_queue(sc->hw, hw_queue);
-                txq->stopped = true;
+        if (txq == sc->tx.txq_map[q]) {
+                fi->txq = q;
+                if (++txq->pending_frames > sc->tx.txq_max_pending[q] &&
+                    !txq->stopped) {
+                        ieee80211_stop_queue(sc->hw, hw_queue);
+                        txq->stopped = true;
+                }
         }
 
         queue = ieee80211_is_data_present(hdr->frame_control);
diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
index a868c5eebe37..8f66186adb8c 100644
--- a/drivers/net/wireless/ath/wil6210/debugfs.c
+++ b/drivers/net/wireless/ath/wil6210/debugfs.c
@@ -448,8 +448,10 @@ static ssize_t wil_write_file_rxon(struct file *file, const char __user *buf,
         char *kbuf = kmalloc(len + 1, GFP_KERNEL);
         if (!kbuf)
                 return -ENOMEM;
-        if (copy_from_user(kbuf, buf, len))
+        if (copy_from_user(kbuf, buf, len)) {
+                kfree(kbuf);
                 return -EIO;
+        }
 
         kbuf[len] = '\0';
         rc = kstrtol(kbuf, 0, &channel);
@@ -963,6 +965,26 @@ static const struct file_operations fops_sta = {
 };
 
 /*----------------*/
+static void wil6210_debugfs_init_blobs(struct wil6210_priv *wil,
+                                       struct dentry *dbg)
+{
+        int i;
+        char name[32];
+
+        for (i = 0; i < ARRAY_SIZE(fw_mapping); i++) {
+                struct debugfs_blob_wrapper *blob = &wil->blobs[i];
+                const struct fw_map *map = &fw_mapping[i];
+
+                if (!map->name)
+                        continue;
+
+                blob->data = (void * __force)wil->csr + HOSTADDR(map->host);
+                blob->size = map->to - map->from;
+                snprintf(name, sizeof(name), "blob_%s", map->name);
+                wil_debugfs_create_ioblob(name, S_IRUGO, dbg, blob);
+        }
+}
+
 int wil6210_debugfs_init(struct wil6210_priv *wil)
 {
         struct dentry *dbg = wil->debug = debugfs_create_dir(WIL_NAME,
@@ -986,6 +1008,8 @@ int wil6210_debugfs_init(struct wil6210_priv *wil)
                            &wil->secure_pcp);
         wil_debugfs_create_ulong("status", S_IRUGO | S_IWUSR, dbg,
                                  &wil->status);
+        debugfs_create_u32("fw_version", S_IRUGO, dbg, &wil->fw_version);
+        debugfs_create_x32("hw_version", S_IRUGO, dbg, &wil->hw_version);
 
         wil6210_debugfs_create_ISR(wil, "USER_ICR", dbg,
                                    HOSTADDR(RGF_USER_USER_ICR));
@@ -998,6 +1022,9 @@ int wil6210_debugfs_init(struct wil6210_priv *wil)
         wil6210_debugfs_create_pseudo_ISR(wil, dbg);
         wil6210_debugfs_create_ITR_CNT(wil, dbg);
 
+        wil_debugfs_create_iomem_x32("RGF_USER_USAGE_1", S_IRUGO, dbg,
+                                     wil->csr +
+                                     HOSTADDR(RGF_USER_USAGE_1));
         debugfs_create_u32("mem_addr", S_IRUGO | S_IWUSR, dbg, &mem_addr);
         debugfs_create_file("mem_val", S_IRUGO, dbg, wil, &fops_memread);
 
@@ -1010,34 +1037,7 @@ int wil6210_debugfs_init(struct wil6210_priv *wil)
         debugfs_create_file("link", S_IRUGO, dbg, wil, &fops_link);
         debugfs_create_file("info", S_IRUGO, dbg, wil, &fops_info);
 
-        wil->rgf_blob.data = (void * __force)wil->csr + 0;
-        wil->rgf_blob.size = 0xa000;
-        wil_debugfs_create_ioblob("blob_rgf", S_IRUGO, dbg, &wil->rgf_blob);
-
-        wil->fw_code_blob.data = (void * __force)wil->csr + 0x40000;
-        wil->fw_code_blob.size = 0x40000;
-        wil_debugfs_create_ioblob("blob_fw_code", S_IRUGO, dbg,
-                                  &wil->fw_code_blob);
-
-        wil->fw_data_blob.data = (void * __force)wil->csr + 0x80000;
-        wil->fw_data_blob.size = 0x8000;
-        wil_debugfs_create_ioblob("blob_fw_data", S_IRUGO, dbg,
-                                  &wil->fw_data_blob);
-
-        wil->fw_peri_blob.data = (void * __force)wil->csr + 0x88000;
-        wil->fw_peri_blob.size = 0x18000;
-        wil_debugfs_create_ioblob("blob_fw_peri", S_IRUGO, dbg,
-                                  &wil->fw_peri_blob);
-
-        wil->uc_code_blob.data = (void * __force)wil->csr + 0xa0000;
-        wil->uc_code_blob.size = 0x10000;
-        wil_debugfs_create_ioblob("blob_uc_code", S_IRUGO, dbg,
-                                  &wil->uc_code_blob);
-
-        wil->uc_data_blob.data = (void * __force)wil->csr + 0xb0000;
-        wil->uc_data_blob.size = 0x4000;
-        wil_debugfs_create_ioblob("blob_uc_data", S_IRUGO, dbg,
-                                  &wil->uc_data_blob);
+        wil6210_debugfs_init_blobs(wil, dbg);
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c
index 53a689ed7c7d..3704d2a434f3 100644
--- a/drivers/net/wireless/ath/wil6210/main.c
+++ b/drivers/net/wireless/ath/wil6210/main.c
@@ -314,8 +314,9 @@ static void wil_target_reset(struct wil6210_priv *wil)
         int delay = 0;
         u32 hw_state;
         u32 rev_id;
+        bool is_sparrow = (wil->board->board == WIL_BOARD_SPARROW);
 
-        wil_dbg_misc(wil, "Resetting...\n");
+        wil_dbg_misc(wil, "Resetting \"%s\"...\n", wil->board->name);
 
         /* register read */
 #define R(a) ioread32(wil->csr + HOSTADDR(a))
@@ -328,35 +329,59 @@ static void wil_target_reset(struct wil6210_priv *wil)
 
         wil->hw_version = R(RGF_USER_FW_REV_ID);
         rev_id = wil->hw_version & 0xff;
+
+        /* Clear MAC link up */
+        S(RGF_HP_CTRL, BIT(15));
         /* hpal_perst_from_pad_src_n_mask */
         S(RGF_USER_CLKS_CTL_SW_RST_MASK_0, BIT(6));
         /* car_perst_rst_src_n_mask */
         S(RGF_USER_CLKS_CTL_SW_RST_MASK_0, BIT(7));
         wmb(); /* order is important here */
 
+        if (is_sparrow) {
+                W(RGF_USER_CLKS_CTL_EXT_SW_RST_VEC_0, 0x3ff81f);
+                wmb(); /* order is important here */
+        }
+
         W(RGF_USER_MAC_CPU_0,  BIT(1)); /* mac_cpu_man_rst */
         W(RGF_USER_USER_CPU_0, BIT(1)); /* user_cpu_man_rst */
         wmb(); /* order is important here */
 
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0xFE000000);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_1, 0x0000003F);
-        W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0x00000170);
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, is_sparrow ? 0x000000B0 : 0x00000170);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_0, 0xFFE7FC00);
         wmb(); /* order is important here */
 
+        if (is_sparrow) {
+                W(RGF_USER_CLKS_CTL_EXT_SW_RST_VEC_0, 0x0);
+                wmb(); /* order is important here */
+        }
+
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_1, 0);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_0, 0);
         wmb(); /* order is important here */
 
-        W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0x00000001);
-        if (rev_id == 1) {
-                W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0x00000080);
-        } else {
-                W(RGF_PCIE_LOS_COUNTER_CTL, BIT(6) | BIT(8));
+        if (is_sparrow) {
+                W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0x00000003);
+                /* reset A2 PCIE AHB */
                 W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0x00008000);
+
+        } else {
+                W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0x00000001);
+                if (rev_id == 1) {
+                        /* reset A1 BOTH PCIE AHB & PCIE RGF */
+                        W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0x00000080);
+                } else {
+                        W(RGF_PCIE_LOS_COUNTER_CTL, BIT(6) | BIT(8));
+                        W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0x00008000);
+                }
+
         }
+
+        /* TODO: check order here!!! Erez code is different */
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_0, 0);
         wmb(); /* order is important here */
 
@@ -371,7 +396,8 @@ static void wil_target_reset(struct wil6210_priv *wil)
                 }
         } while (hw_state != HW_MACHINE_BOOT_DONE);
 
-        if (rev_id == 2)
+        /* TODO: Erez check rev_id != 1 */
+        if (!is_sparrow && (rev_id != 1))
                 W(RGF_PCIE_LOS_COUNTER_CTL, BIT(8));
 
         C(RGF_USER_CLKS_CTL_0, BIT_USER_CLKS_RST_PWGD);
diff --git a/drivers/net/wireless/ath/wil6210/pcie_bus.c b/drivers/net/wireless/ath/wil6210/pcie_bus.c
index 77b6272d93fb..d3fbfa28db62 100644
--- a/drivers/net/wireless/ath/wil6210/pcie_bus.c
+++ b/drivers/net/wireless/ath/wil6210/pcie_bus.c
@@ -122,10 +122,12 @@ static int wil_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         struct wil6210_priv *wil;
         struct device *dev = &pdev->dev;
         void __iomem *csr;
+        struct wil_board *board = (struct wil_board *)id->driver_data;
         int rc;
 
         /* check HW */
-        dev_info(&pdev->dev, WIL_NAME " device found [%04x:%04x] (rev %x)\n",
+        dev_info(&pdev->dev, WIL_NAME
+                 " \"%s\" device found [%04x:%04x] (rev %x)\n", board->name,
                  (int)pdev->vendor, (int)pdev->device, (int)pdev->revision);
 
         if (pci_resource_len(pdev, 0) != WIL6210_MEM_SIZE) {
@@ -175,6 +177,7 @@ static int wil_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 
         pci_set_drvdata(pdev, wil);
         wil->pdev = pdev;
+        wil->board = board;
 
         wil6210_clear_irq(wil);
         /* FW should raise IRQ when ready */
@@ -225,8 +228,21 @@ static void wil_pcie_remove(struct pci_dev *pdev)
         pci_disable_device(pdev);
 }
 
-static DEFINE_PCI_DEVICE_TABLE(wil6210_pcie_ids) = {
-        { PCI_DEVICE(0x1ae9, 0x0301) },
+static const struct wil_board wil_board_marlon = {
+        .board = WIL_BOARD_MARLON,
+        .name = "marlon",
+};
+
+static const struct wil_board wil_board_sparrow = {
+        .board = WIL_BOARD_SPARROW,
+        .name = "sparrow",
+};
+
+static const struct pci_device_id wil6210_pcie_ids[] = {
+        { PCI_DEVICE(0x1ae9, 0x0301),
+          .driver_data = (kernel_ulong_t)&wil_board_marlon },
+        { PCI_DEVICE(0x1ae9, 0x0310),
+          .driver_data = (kernel_ulong_t)&wil_board_sparrow },
         { /* end: all zeroes */ },
 };
 MODULE_DEVICE_TABLE(pci, wil6210_pcie_ids);
diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
index af4b93e4beb5..d3467943d39d 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.c
+++ b/drivers/net/wireless/ath/wil6210/txrx.c
@@ -1108,8 +1108,10 @@ int wil_tx_complete(struct wil6210_priv *wil, int ringid)
                 while (vring->swtail != new_swtail) {
                         struct vring_tx_desc dd, *d = &dd;
                         u16 dmalen;
-                        struct wil_ctx *ctx = &vring->ctx[vring->swtail];
-                        struct sk_buff *skb = ctx->skb;
+                        struct sk_buff *skb;
+
+                        ctx = &vring->ctx[vring->swtail];
+                        skb = ctx->skb;
                         _d = &vring->va[vring->swtail].tx;
 
                         *d = *_d;
diff --git a/drivers/net/wireless/ath/wil6210/wil6210.h b/drivers/net/wireless/ath/wil6210/wil6210.h
index 424906635f05..67e9624f7111 100644
--- a/drivers/net/wireless/ath/wil6210/wil6210.h
+++ b/drivers/net/wireless/ath/wil6210/wil6210.h
@@ -24,6 +24,13 @@
 
 #define WIL_NAME "wil6210"
 
+struct wil_board {
+        int board;
+#define WIL_BOARD_MARLON        (1)
+#define WIL_BOARD_SPARROW       (2)
+        const char * const name;
+};
+
 /**
  * extract bits [@b0:@b1] (inclusive) from the value @x
  * it should be @b0 <= @b1, or result is incorrect
@@ -78,6 +85,7 @@ struct RGF_ICR {
 } __packed;
 
 /* registers - FW addresses */
+#define RGF_USER_USAGE_1                (0x880004)
 #define RGF_USER_HW_MACHINE_STATE       (0x8801dc)
         #define HW_MACHINE_BOOT_DONE    (0x3fffffd)
 #define RGF_USER_USER_CPU_0             (0x8801e0)
@@ -93,6 +101,7 @@ struct RGF_ICR {
 #define RGF_USER_CLKS_CTL_SW_RST_MASK_0 (0x880b14)
 #define RGF_USER_USER_ICR               (0x880b4c) /* struct RGF_ICR */
         #define BIT_USER_USER_ICR_SW_INT_2      BIT(18)
+#define RGF_USER_CLKS_CTL_EXT_SW_RST_VEC_0      (0x880c18)
 
 #define RGF_DMA_EP_TX_ICR               (0x881bb4) /* struct RGF_ICR */
         #define BIT_DMA_EP_TX_ICR_TX_DONE       BIT(0)
@@ -121,6 +130,7 @@ struct RGF_ICR {
         #define BIT_DMA_PSEUDO_CAUSE_TX         BIT(1)
         #define BIT_DMA_PSEUDO_CAUSE_MISC       BIT(2)
 
+#define RGF_HP_CTRL                     (0x88265c)
 #define RGF_PCIE_LOS_COUNTER_CTL        (0x882dc4)
 
 /* popular locations */
@@ -135,6 +145,14 @@ struct RGF_ICR {
 #define ISR_MISC_FW_ERROR       BIT_DMA_EP_MISC_ICR_FW_INT(3)
 
 /* Hardware definitions end */
+struct fw_map {
+        u32 from; /* linker address - from, inclusive */
+        u32 to;   /* linker address - to, exclusive */
+        u32 host; /* PCI/Host address - BAR0 + 0x880000 */
+        const char *name; /* for debugfs */
+};
+/* array size should be in sync with actual definition in the wmi.c */
+extern const struct fw_map fw_mapping[7];
 
 /**
  * mk_cidxtid - construct @cidxtid field
@@ -365,6 +383,7 @@ struct wil6210_priv {
         ulong status;
         u32 fw_version;
         u32 hw_version;
+        struct wil_board *board;
         u8 n_mids; /* number of additional MIDs as reported by FW */
         int recovery_count; /* num of FW recovery attempts in a short time */
         unsigned long last_fw_recovery; /* jiffies of last fw recovery */
@@ -415,12 +434,7 @@ struct wil6210_priv {
         atomic_t isr_count_rx, isr_count_tx;
         /* debugfs */
         struct dentry *debug;
-        struct debugfs_blob_wrapper fw_code_blob;
-        struct debugfs_blob_wrapper fw_data_blob;
-        struct debugfs_blob_wrapper fw_peri_blob;
-        struct debugfs_blob_wrapper uc_code_blob;
-        struct debugfs_blob_wrapper uc_data_blob;
-        struct debugfs_blob_wrapper rgf_blob;
+        struct debugfs_blob_wrapper blobs[ARRAY_SIZE(fw_mapping)];
 };
 
 #define wil_to_wiphy(i) (i->wdev->wiphy)
diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
index a136dab560e2..1d1d0afdd2e1 100644
--- a/drivers/net/wireless/ath/wil6210/wmi.c
+++ b/drivers/net/wireless/ath/wil6210/wmi.c
@@ -65,18 +65,17 @@
 
 /**
  * @fw_mapping provides memory remapping table
+ *
+ * array size should be in sync with the declaration in the wil6210.h
  */
-static const struct {
-        u32 from; /* linker address - from, inclusive */
-        u32 to;   /* linker address - to, exclusive */
-        u32 host; /* PCI/Host address - BAR0 + 0x880000 */
-} fw_mapping[] = {
-        {0x000000, 0x040000, 0x8c0000}, /* FW code RAM 256k */
-        {0x800000, 0x808000, 0x900000}, /* FW data RAM 32k */
-        {0x840000, 0x860000, 0x908000}, /* peripheral data RAM 128k/96k used */
-        {0x880000, 0x88a000, 0x880000}, /* various RGF */
-        {0x88b000, 0x88c000, 0x88b000}, /* Pcie_ext_rgf */
-        {0x8c0000, 0x949000, 0x8c0000}, /* trivial mapping for upper area */
+const struct fw_map fw_mapping[] = {
+        {0x000000, 0x040000, 0x8c0000, "fw_code"}, /* FW code RAM      256k */
+        {0x800000, 0x808000, 0x900000, "fw_data"}, /* FW data RAM       32k */
+        {0x840000, 0x860000, 0x908000, "fw_peri"}, /* periph. data RAM 128k */
+        {0x880000, 0x88a000, 0x880000, "rgf"},     /* various RGF       40k */
+        {0x88a000, 0x88b000, 0x88a000, "AGC_tbl"}, /* AGC table          4k */
+        {0x88b000, 0x88c000, 0x88b000, "rgf_ext"}, /* Pcie_ext_rgf       4k */
+        {0x8c0000, 0x949000, 0x8c0000, "upper"},   /* upper area       548k */
         /*
          * 920000..930000 ucode code RAM
          * 930000..932000 ucode data RAM