199 files changed, 7072 insertions, 3612 deletions

diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
index e5ba6faf3281..ccba4fea7269 100644
--- a/drivers/net/wireless/ath/ath.h
+++ b/drivers/net/wireless/ath/ath.h
@@ -80,6 +80,7 @@ struct reg_dmn_pair_mapping {
 
 struct ath_regulatory {
         char alpha2[2];
+        enum nl80211_dfs_regions region;
         u16 country_code;
         u16 max_power_level;
         u16 current_rd;
@@ -134,6 +135,11 @@ struct ath_ops {
 struct ath_common;
 struct ath_bus_ops;
 
+struct ath_ps_ops {
+        void (*wakeup)(struct ath_common *common);
+        void (*restore)(struct ath_common *common);
+};
+
 struct ath_common {
         void *ah;
         void *priv;
@@ -147,7 +153,7 @@ struct ath_common {
         u16 cachelsz;
         u16 curaid;
         u8 macaddr[ETH_ALEN];
-        u8 curbssid[ETH_ALEN];
+        u8 curbssid[ETH_ALEN] __aligned(2);
         u8 bssidmask[ETH_ALEN];
 
         u32 rx_bufsize;
@@ -168,6 +174,7 @@ struct ath_common {
         struct ath_regulatory reg_world_copy;
         const struct ath_ops *ops;
         const struct ath_bus_ops *bus_ops;
+        const struct ath_ps_ops *ps_ops;
 
         bool btcoex_enabled;
         bool disable_ani;
@@ -177,6 +184,11 @@ struct ath_common {
         struct ieee80211_supported_band sbands[IEEE80211_NUM_BANDS];
 };
 
+static inline const struct ath_ps_ops *ath_ps_ops(struct ath_common *common)
+{
+        return common->ps_ops;
+}
+
 struct sk_buff *ath_rxbuf_alloc(struct ath_common *common,
                                 u32 len,
                                 gfp_t gfp_mask);
diff --git a/drivers/net/wireless/ath/ath10k/ce.c b/drivers/net/wireless/ath/ath10k/ce.c
index 101cadb6e4ba..a156e6e48708 100644
--- a/drivers/net/wireless/ath/ath10k/ce.c
+++ b/drivers/net/wireless/ath/ath10k/ce.c
@@ -443,12 +443,12 @@ int ath10k_ce_rx_post_buf(struct ath10k_ce_pipe *pipe, void *ctx, u32 paddr)
  * Guts of ath10k_ce_completed_recv_next.
  * The caller takes responsibility for any necessary locking.
  */
-static int ath10k_ce_completed_recv_next_nolock(struct ath10k_ce_pipe *ce_state,
-                                                void **per_transfer_contextp,
-                                                u32 *bufferp,
-                                                unsigned int *nbytesp,
-                                                unsigned int *transfer_idp,
-                                                unsigned int *flagsp)
+int ath10k_ce_completed_recv_next_nolock(struct ath10k_ce_pipe *ce_state,
+                                         void **per_transfer_contextp,
+                                         u32 *bufferp,
+                                         unsigned int *nbytesp,
+                                         unsigned int *transfer_idp,
+                                         unsigned int *flagsp)
 {
         struct ath10k_ce_ring *dest_ring = ce_state->dest_ring;
         unsigned int nentries_mask = dest_ring->nentries_mask;
@@ -558,6 +558,7 @@ int ath10k_ce_revoke_recv_next(struct ath10k_ce_pipe *ce_state,
 
                 /* sanity */
                 dest_ring->per_transfer_context[sw_index] = NULL;
+                desc->nbytes = 0;
 
                 /* Update sw_index */
                 sw_index = CE_RING_IDX_INCR(nentries_mask, sw_index);
@@ -576,11 +577,11 @@ int ath10k_ce_revoke_recv_next(struct ath10k_ce_pipe *ce_state,
  * Guts of ath10k_ce_completed_send_next.
  * The caller takes responsibility for any necessary locking.
  */
-static int ath10k_ce_completed_send_next_nolock(struct ath10k_ce_pipe *ce_state,
-                                                void **per_transfer_contextp,
-                                                u32 *bufferp,
-                                                unsigned int *nbytesp,
-                                                unsigned int *transfer_idp)
+int ath10k_ce_completed_send_next_nolock(struct ath10k_ce_pipe *ce_state,
+                                         void **per_transfer_contextp,
+                                         u32 *bufferp,
+                                         unsigned int *nbytesp,
+                                         unsigned int *transfer_idp)
 {
         struct ath10k_ce_ring *src_ring = ce_state->src_ring;
         u32 ctrl_addr = ce_state->ctrl_addr;
@@ -817,7 +818,10 @@ void ath10k_ce_enable_interrupts(struct ath10k *ar)
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         int ce_id;
 
-        for (ce_id = 0; ce_id < CE_COUNT; ce_id++)
+        /* Skip the last copy engine, CE7 the diagnostic window, as that
+         * uses polling and isn't initialized for interrupts.
+         */
+        for (ce_id = 0; ce_id < CE_COUNT - 1; ce_id++)
                 ath10k_ce_per_engine_handler_adjust(&ar_pci->ce_states[ce_id]);
 }
 
@@ -832,8 +836,8 @@ static int ath10k_ce_init_src_ring(struct ath10k *ar,
 
         nentries = roundup_pow_of_two(attr->src_nentries);
 
-        memset(src_ring->per_transfer_context, 0,
-               nentries * sizeof(*src_ring->per_transfer_context));
+        memset(src_ring->base_addr_owner_space, 0,
+               nentries * sizeof(struct ce_desc));
 
         src_ring->sw_index = ath10k_ce_src_ring_read_index_get(ar, ctrl_addr);
         src_ring->sw_index &= src_ring->nentries_mask;
@@ -869,8 +873,8 @@ static int ath10k_ce_init_dest_ring(struct ath10k *ar,
 
         nentries = roundup_pow_of_two(attr->dest_nentries);
 
-        memset(dest_ring->per_transfer_context, 0,
-               nentries * sizeof(*dest_ring->per_transfer_context));
+        memset(dest_ring->base_addr_owner_space, 0,
+               nentries * sizeof(struct ce_desc));
 
         dest_ring->sw_index = ath10k_ce_dest_ring_read_index_get(ar, ctrl_addr);
         dest_ring->sw_index &= dest_ring->nentries_mask;
@@ -1020,37 +1024,10 @@ ath10k_ce_alloc_dest_ring(struct ath10k *ar, unsigned int ce_id,
  * initialized by software/firmware.
  */
 int ath10k_ce_init_pipe(struct ath10k *ar, unsigned int ce_id,
-                        const struct ce_attr *attr,
-                        void (*send_cb)(struct ath10k_ce_pipe *),
-                        void (*recv_cb)(struct ath10k_ce_pipe *))
+                        const struct ce_attr *attr)
 {
-        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct ath10k_ce_pipe *ce_state = &ar_pci->ce_states[ce_id];
         int ret;
 
-        /*
-         * Make sure there's enough CE ringbuffer entries for HTT TX to avoid
-         * additional TX locking checks.
-         *
-         * For the lack of a better place do the check here.
-         */
-        BUILD_BUG_ON(2*TARGET_NUM_MSDU_DESC >
-                     (CE_HTT_H2T_MSG_SRC_NENTRIES - 1));
-        BUILD_BUG_ON(2*TARGET_10X_NUM_MSDU_DESC >
-                     (CE_HTT_H2T_MSG_SRC_NENTRIES - 1));
-
-        spin_lock_bh(&ar_pci->ce_lock);
-        ce_state->ar = ar;
-        ce_state->id = ce_id;
-        ce_state->ctrl_addr = ath10k_ce_base_address(ce_id);
-        ce_state->attr_flags = attr->flags;
-        ce_state->src_sz_max = attr->src_sz_max;
-        if (attr->src_nentries)
-                ce_state->send_cb = send_cb;
-        if (attr->dest_nentries)
-                ce_state->recv_cb = recv_cb;
-        spin_unlock_bh(&ar_pci->ce_lock);
-
         if (attr->src_nentries) {
                 ret = ath10k_ce_init_src_ring(ar, ce_id, attr);
                 if (ret) {
@@ -1098,12 +1075,37 @@ void ath10k_ce_deinit_pipe(struct ath10k *ar, unsigned int ce_id)
 }
 
 int ath10k_ce_alloc_pipe(struct ath10k *ar, int ce_id,
-                         const struct ce_attr *attr)
+                         const struct ce_attr *attr,
+                         void (*send_cb)(struct ath10k_ce_pipe *),
+                         void (*recv_cb)(struct ath10k_ce_pipe *))
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         struct ath10k_ce_pipe *ce_state = &ar_pci->ce_states[ce_id];
         int ret;
 
+        /*
+         * Make sure there's enough CE ringbuffer entries for HTT TX to avoid
+         * additional TX locking checks.
+         *
+         * For the lack of a better place do the check here.
+         */
+        BUILD_BUG_ON(2*TARGET_NUM_MSDU_DESC >
+                     (CE_HTT_H2T_MSG_SRC_NENTRIES - 1));
+        BUILD_BUG_ON(2*TARGET_10X_NUM_MSDU_DESC >
+                     (CE_HTT_H2T_MSG_SRC_NENTRIES - 1));
+
+        ce_state->ar = ar;
+        ce_state->id = ce_id;
+        ce_state->ctrl_addr = ath10k_ce_base_address(ce_id);
+        ce_state->attr_flags = attr->flags;
+        ce_state->src_sz_max = attr->src_sz_max;
+
+        if (attr->src_nentries)
+                ce_state->send_cb = send_cb;
+
+        if (attr->dest_nentries)
+                ce_state->recv_cb = recv_cb;
+
         if (attr->src_nentries) {
                 ce_state->src_ring = ath10k_ce_alloc_src_ring(ar, ce_id, attr);
                 if (IS_ERR(ce_state->src_ring)) {
diff --git a/drivers/net/wireless/ath/ath10k/ce.h b/drivers/net/wireless/ath/ath10k/ce.h
index 329b7340fa72..617a151e8ce4 100644
--- a/drivers/net/wireless/ath/ath10k/ce.h
+++ b/drivers/net/wireless/ath/ath10k/ce.h
@@ -192,15 +192,21 @@ int ath10k_ce_completed_send_next(struct ath10k_ce_pipe *ce_state,
                                   unsigned int *nbytesp,
                                   unsigned int *transfer_idp);
 
+int ath10k_ce_completed_send_next_nolock(struct ath10k_ce_pipe *ce_state,
+                                         void **per_transfer_contextp,
+                                         u32 *bufferp,
+                                         unsigned int *nbytesp,
+                                         unsigned int *transfer_idp);
+
 /*==================CE Engine Initialization=======================*/
 
 int ath10k_ce_init_pipe(struct ath10k *ar, unsigned int ce_id,
-                        const struct ce_attr *attr,
-                        void (*send_cb)(struct ath10k_ce_pipe *),
-                        void (*recv_cb)(struct ath10k_ce_pipe *));
+                        const struct ce_attr *attr);
 void ath10k_ce_deinit_pipe(struct ath10k *ar, unsigned int ce_id);
 int ath10k_ce_alloc_pipe(struct ath10k *ar, int ce_id,
-                         const struct ce_attr *attr);
+                         const struct ce_attr *attr,
+                         void (*send_cb)(struct ath10k_ce_pipe *),
+                         void (*recv_cb)(struct ath10k_ce_pipe *));
 void ath10k_ce_free_pipe(struct ath10k *ar, int ce_id);
 
 /*==================CE Engine Shutdown=======================*/
@@ -213,6 +219,13 @@ int ath10k_ce_revoke_recv_next(struct ath10k_ce_pipe *ce_state,
                                void **per_transfer_contextp,
                                u32 *bufferp);
 
+int ath10k_ce_completed_recv_next_nolock(struct ath10k_ce_pipe *ce_state,
+                                         void **per_transfer_contextp,
+                                         u32 *bufferp,
+                                         unsigned int *nbytesp,
+                                         unsigned int *transfer_idp,
+                                         unsigned int *flagsp);
+
 /*
  * Support clean shutdown by allowing the caller to cancel
  * pending sends.  Target DMA must be stopped before using
diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
index cee18c89d7f2..f660553c6c48 100644
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -31,12 +31,17 @@
 unsigned int ath10k_debug_mask;
 static bool uart_print;
 static unsigned int ath10k_p2p;
+static bool skip_otp;
+
 module_param_named(debug_mask, ath10k_debug_mask, uint, 0644);
 module_param(uart_print, bool, 0644);
 module_param_named(p2p, ath10k_p2p, uint, 0644);
+module_param(skip_otp, bool, 0644);
+
 MODULE_PARM_DESC(debug_mask, "Debugging mask");
 MODULE_PARM_DESC(uart_print, "Uart target debugging");
 MODULE_PARM_DESC(p2p, "Enable ath10k P2P support");
+MODULE_PARM_DESC(skip_otp, "Skip otp failure for calibration in testmode");
 
 static const struct ath10k_hw_params ath10k_hw_params_list[] = {
         {
@@ -138,7 +143,8 @@ static const struct firmware *ath10k_fetch_fw_file(struct ath10k *ar,
         return fw;
 }
 
-static int ath10k_push_board_ext_data(struct ath10k *ar)
+static int ath10k_push_board_ext_data(struct ath10k *ar, const void *data,
+                                      size_t data_len)
 {
         u32 board_data_size = QCA988X_BOARD_DATA_SZ;
         u32 board_ext_data_size = QCA988X_BOARD_EXT_DATA_SZ;
@@ -159,14 +165,14 @@ static int ath10k_push_board_ext_data(struct ath10k *ar)
         if (board_ext_data_addr == 0)
                 return 0;
 
-        if (ar->board_len != (board_data_size + board_ext_data_size)) {
+        if (data_len != (board_data_size + board_ext_data_size)) {
                 ath10k_err(ar, "invalid board (ext) data sizes %zu != %d+%d\n",
-                           ar->board_len, board_data_size, board_ext_data_size);
+                           data_len, board_data_size, board_ext_data_size);
                 return -EINVAL;
         }
 
         ret = ath10k_bmi_write_memory(ar, board_ext_data_addr,
-                                      ar->board_data + board_data_size,
+                                      data + board_data_size,
                                       board_ext_data_size);
         if (ret) {
                 ath10k_err(ar, "could not write board ext data (%d)\n", ret);
@@ -184,13 +190,14 @@ static int ath10k_push_board_ext_data(struct ath10k *ar)
         return 0;
 }
 
-static int ath10k_download_board_data(struct ath10k *ar)
+static int ath10k_download_board_data(struct ath10k *ar, const void *data,
+                                      size_t data_len)
 {
         u32 board_data_size = QCA988X_BOARD_DATA_SZ;
         u32 address;
         int ret;
 
-        ret = ath10k_push_board_ext_data(ar);
+        ret = ath10k_push_board_ext_data(ar, data, data_len);
         if (ret) {
                 ath10k_err(ar, "could not push board ext data (%d)\n", ret);
                 goto exit;
@@ -202,9 +209,9 @@ static int ath10k_download_board_data(struct ath10k *ar)
                 goto exit;
         }
 
-        ret = ath10k_bmi_write_memory(ar, address, ar->board_data,
+        ret = ath10k_bmi_write_memory(ar, address, data,
                                       min_t(u32, board_data_size,
-                                            ar->board_len));
+                                            data_len));
         if (ret) {
                 ath10k_err(ar, "could not write board data (%d)\n", ret);
                 goto exit;
@@ -220,11 +227,39 @@ exit:
         return ret;
 }
 
+static int ath10k_download_cal_file(struct ath10k *ar)
+{
+        int ret;
+
+        if (!ar->cal_file)
+                return -ENOENT;
+
+        if (IS_ERR(ar->cal_file))
+                return PTR_ERR(ar->cal_file);
+
+        ret = ath10k_download_board_data(ar, ar->cal_file->data,
+                                         ar->cal_file->size);
+        if (ret) {
+                ath10k_err(ar, "failed to download cal_file data: %d\n", ret);
+                return ret;
+        }
+
+        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot cal file downloaded\n");
+
+        return 0;
+}
+
 static int ath10k_download_and_run_otp(struct ath10k *ar)
 {
         u32 result, address = ar->hw_params.patch_load_addr;
         int ret;
 
+        ret = ath10k_download_board_data(ar, ar->board_data, ar->board_len);
+        if (ret) {
+                ath10k_err(ar, "failed to download board data: %d\n", ret);
+                return ret;
+        }
+
         /* OTP is optional */
 
         if (!ar->otp_data || !ar->otp_len) {
@@ -250,7 +285,7 @@ static int ath10k_download_and_run_otp(struct ath10k *ar)
 
         ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot otp execute result %d\n", result);
 
-        if (result != 0) {
+        if (!skip_otp && result != 0) {
                 ath10k_err(ar, "otp calibration failed: %d", result);
                 return -EINVAL;
         }
@@ -308,6 +343,9 @@ static void ath10k_core_free_firmware_files(struct ath10k *ar)
         if (ar->firmware && !IS_ERR(ar->firmware))
                 release_firmware(ar->firmware);
 
+        if (ar->cal_file && !IS_ERR(ar->cal_file))
+                release_firmware(ar->cal_file);
+
         ar->board = NULL;
         ar->board_data = NULL;
         ar->board_len = 0;
@@ -319,6 +357,27 @@ static void ath10k_core_free_firmware_files(struct ath10k *ar)
         ar->firmware = NULL;
         ar->firmware_data = NULL;
         ar->firmware_len = 0;
+
+        ar->cal_file = NULL;
+}
+
+static int ath10k_fetch_cal_file(struct ath10k *ar)
+{
+        char filename[100];
+
+        /* cal-<bus>-<id>.bin */
+        scnprintf(filename, sizeof(filename), "cal-%s-%s.bin",
+                  ath10k_bus_str(ar->hif.bus), dev_name(ar->dev));
+
+        ar->cal_file = ath10k_fetch_fw_file(ar, ATH10K_FW_DIR, filename);
+        if (IS_ERR(ar->cal_file))
+                /* calibration file is optional, don't print any warnings */
+                return PTR_ERR(ar->cal_file);
+
+        ath10k_dbg(ar, ATH10K_DBG_BOOT, "found calibration file %s/%s\n",
+                   ATH10K_FW_DIR, filename);
+
+        return 0;
 }
 
 static int ath10k_core_fetch_firmware_api_1(struct ath10k *ar)
@@ -562,6 +621,9 @@ static int ath10k_core_fetch_firmware_files(struct ath10k *ar)
 {
         int ret;
 
+        /* calibration file is optional, don't check for any errors */
+        ath10k_fetch_cal_file(ar);
+
         ar->fw_api = 3;
         ath10k_dbg(ar, ATH10K_DBG_BOOT, "trying fw api %d\n", ar->fw_api);
 
@@ -589,30 +651,32 @@ success:
         return 0;
 }
 
-static int ath10k_init_download_firmware(struct ath10k *ar,
-                                         enum ath10k_firmware_mode mode)
+static int ath10k_download_cal_data(struct ath10k *ar)
 {
         int ret;
 
-        ret = ath10k_download_board_data(ar);
-        if (ret) {
-                ath10k_err(ar, "failed to download board data: %d\n", ret);
-                return ret;
+        ret = ath10k_download_cal_file(ar);
+        if (ret == 0) {
+                ar->cal_mode = ATH10K_CAL_MODE_FILE;
+                goto done;
         }
 
+        ath10k_dbg(ar, ATH10K_DBG_BOOT,
+                   "boot did not find a calibration file, try OTP next: %d\n",
+                   ret);
+
         ret = ath10k_download_and_run_otp(ar);
         if (ret) {
                 ath10k_err(ar, "failed to run otp: %d\n", ret);
                 return ret;
         }
 
-        ret = ath10k_download_fw(ar, mode);
-        if (ret) {
-                ath10k_err(ar, "failed to download firmware: %d\n", ret);
-                return ret;
-        }
+        ar->cal_mode = ATH10K_CAL_MODE_OTP;
 
-        return ret;
+done:
+        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot using calibration mode %s\n",
+                   ath10k_cal_mode_str(ar->cal_mode));
+        return 0;
 }
 
 static int ath10k_init_uart(struct ath10k *ar)
@@ -685,6 +749,25 @@ static void ath10k_core_restart(struct work_struct *work)
 {
         struct ath10k *ar = container_of(work, struct ath10k, restart_work);
 
+        set_bit(ATH10K_FLAG_CRASH_FLUSH, &ar->dev_flags);
+
+        /* Place a barrier to make sure the compiler doesn't reorder
+         * CRASH_FLUSH and calling other functions.
+         */
+        barrier();
+
+        ieee80211_stop_queues(ar->hw);
+        ath10k_drain_tx(ar);
+        complete_all(&ar->scan.started);
+        complete_all(&ar->scan.completed);
+        complete_all(&ar->scan.on_channel);
+        complete_all(&ar->offchan_tx_completed);
+        complete_all(&ar->install_key_done);
+        complete_all(&ar->vdev_setup_done);
+        wake_up(&ar->htt.empty_tx_wq);
+        wake_up(&ar->wmi.tx_credits_wq);
+        wake_up(&ar->peer_mapping_wq);
+
         mutex_lock(&ar->conf_mutex);
 
         switch (ar->state) {
@@ -722,6 +805,8 @@ int ath10k_core_start(struct ath10k *ar, enum ath10k_firmware_mode mode)
 
         lockdep_assert_held(&ar->conf_mutex);
 
+        clear_bit(ATH10K_FLAG_CRASH_FLUSH, &ar->dev_flags);
+
         ath10k_bmi_start(ar);
 
         if (ath10k_init_configure_target(ar)) {
@@ -729,7 +814,11 @@ int ath10k_core_start(struct ath10k *ar, enum ath10k_firmware_mode mode)
                 goto err;
         }
 
-        status = ath10k_init_download_firmware(ar, mode);
+        status = ath10k_download_cal_data(ar);
+        if (status)
+                goto err;
+
+        status = ath10k_download_fw(ar, mode);
         if (status)
                 goto err;
 
@@ -846,9 +935,9 @@ int ath10k_core_start(struct ath10k *ar, enum ath10k_firmware_mode mode)
                 goto err_hif_stop;
 
         if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features))
-                ar->free_vdev_map = (1 << TARGET_10X_NUM_VDEVS) - 1;
+                ar->free_vdev_map = (1LL << TARGET_10X_NUM_VDEVS) - 1;
         else
-                ar->free_vdev_map = (1 << TARGET_NUM_VDEVS) - 1;
+                ar->free_vdev_map = (1LL << TARGET_NUM_VDEVS) - 1;
 
         INIT_LIST_HEAD(&ar->arvifs);
 
@@ -1084,6 +1173,7 @@ void ath10k_core_unregister(struct ath10k *ar)
 EXPORT_SYMBOL(ath10k_core_unregister);
 
 struct ath10k *ath10k_core_create(size_t priv_size, struct device *dev,
+                                  enum ath10k_bus bus,
                                   const struct ath10k_hif_ops *hif_ops)
 {
         struct ath10k *ar;
@@ -1100,6 +1190,7 @@ struct ath10k *ath10k_core_create(size_t priv_size, struct device *dev,
         ar->dev = dev;
 
         ar->hif.ops = hif_ops;
+        ar->hif.bus = bus;
 
         init_completion(&ar->scan.started);
         init_completion(&ar->scan.completed);
@@ -1120,6 +1211,8 @@ struct ath10k *ath10k_core_create(size_t priv_size, struct device *dev,
 
         INIT_LIST_HEAD(&ar->peers);
         init_waitqueue_head(&ar->peer_mapping_wq);
+        init_waitqueue_head(&ar->htt.empty_tx_wq);
+        init_waitqueue_head(&ar->wmi.tx_credits_wq);
 
         init_completion(&ar->offchan_tx_completed);
         INIT_WORK(&ar->offchan_tx_work, ath10k_offchan_tx_work);
diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h
index fe531ea6926c..8f86bd34e823 100644
--- a/drivers/net/wireless/ath/ath10k/core.h
+++ b/drivers/net/wireless/ath/ath10k/core.h
@@ -63,6 +63,20 @@
 
 struct ath10k;
 
+enum ath10k_bus {
+        ATH10K_BUS_PCI,
+};
+
+static inline const char *ath10k_bus_str(enum ath10k_bus bus)
+{
+        switch (bus) {
+        case ATH10K_BUS_PCI:
+                return "pci";
+        }
+
+        return "unknown";
+}
+
 struct ath10k_skb_cb {
         dma_addr_t paddr;
         u8 vdev_id;
@@ -96,8 +110,6 @@ struct ath10k_bmi {
         bool done_sent;
 };
 
-#define ATH10K_MAX_MEM_REQS 16
-
 struct ath10k_mem_chunk {
         void *vaddr;
         dma_addr_t paddr;
@@ -115,17 +127,21 @@ struct ath10k_wmi {
         struct wmi_pdev_param_map *pdev_param;
 
         u32 num_mem_chunks;
-        struct ath10k_mem_chunk mem_chunks[ATH10K_MAX_MEM_REQS];
+        struct ath10k_mem_chunk mem_chunks[WMI_MAX_MEM_REQS];
 };
 
-struct ath10k_peer_stat {
+struct ath10k_fw_stats_peer {
+        struct list_head list;
+
         u8 peer_macaddr[ETH_ALEN];
         u32 peer_rssi;
         u32 peer_tx_rate;
         u32 peer_rx_rate; /* 10x only */
 };
 
-struct ath10k_target_stats {
+struct ath10k_fw_stats_pdev {
+        struct list_head list;
+
         /* PDEV stats */
         s32 ch_noise_floor;
         u32 tx_frame_count;
@@ -180,15 +196,11 @@ struct ath10k_target_stats {
         s32 phy_errs;
         s32 phy_err_drop;
         s32 mpdu_errs;
+};
 
-        /* VDEV STATS */
-
-        /* PEER STATS */
-        u8 peers;
-        struct ath10k_peer_stat peer_stat[TARGET_NUM_PEERS];
-
-        /* TODO: Beacon filter stats */
-
+struct ath10k_fw_stats {
+        struct list_head pdevs;
+        struct list_head peers;
 };
 
 struct ath10k_dfs_stats {
@@ -234,6 +246,8 @@ struct ath10k_vif {
         struct sk_buff *beacon;
         /* protected by data_lock */
         bool beacon_sent;
+        void *beacon_buf;
+        dma_addr_t beacon_paddr;
 
         struct ath10k *ar;
         struct ieee80211_vif *vif;
@@ -273,6 +287,7 @@ struct ath10k_vif {
         u8 force_sgi;
         bool use_cts_prot;
         int num_legacy_stations;
+        int txpower;
 };
 
 struct ath10k_vif_iter {
@@ -292,17 +307,19 @@ struct ath10k_fw_crash_data {
 struct ath10k_debug {
         struct dentry *debugfs_phy;
 
-        struct ath10k_target_stats target_stats;
+        struct ath10k_fw_stats fw_stats;
+        struct completion fw_stats_complete;
+        bool fw_stats_done;
         DECLARE_BITMAP(wmi_service_bitmap, WMI_SERVICE_MAX);
 
-        struct completion event_stats_compl;
-
         unsigned long htt_stats_mask;
         struct delayed_work htt_stats_dwork;
         struct ath10k_dfs_stats dfs_stats;
         struct ath_dfs_pool_stats dfs_pool_stats;
 
+        /* protected by conf_mutex */
         u32 fw_dbglog_mask;
+        u32 pktlog_filter;
 
         u8 htt_max_amsdu;
         u8 htt_max_ampdu;
@@ -321,7 +338,7 @@ enum ath10k_state {
          * stopped in ath10k_core_restart() work holding conf_mutex. The state
          * RESTARTED means that the device is up and mac80211 has started hw
          * reconfiguration. Once mac80211 is done with the reconfiguration we
-         * set the state to STATE_ON in restart_complete(). */
+         * set the state to STATE_ON in reconfig_complete(). */
         ATH10K_STATE_RESTARTING,
         ATH10K_STATE_RESTARTED,
 
@@ -369,8 +386,30 @@ enum ath10k_dev_flags {
         /* Indicates that ath10k device is during CAC phase of DFS */
         ATH10K_CAC_RUNNING,
         ATH10K_FLAG_CORE_REGISTERED,
+
+        /* Device has crashed and needs to restart. This indicates any pending
+         * waiters should immediately cancel instead of waiting for a time out.
+         */
+        ATH10K_FLAG_CRASH_FLUSH,
 };
 
+enum ath10k_cal_mode {
+        ATH10K_CAL_MODE_FILE,
+        ATH10K_CAL_MODE_OTP,
+};
+
+static inline const char *ath10k_cal_mode_str(enum ath10k_cal_mode mode)
+{
+        switch (mode) {
+        case ATH10K_CAL_MODE_FILE:
+                return "file";
+        case ATH10K_CAL_MODE_OTP:
+                return "otp";
+        }
+
+        return "unknown";
+}
+
 enum ath10k_scan_state {
         ATH10K_SCAN_IDLE,
         ATH10K_SCAN_STARTING,
@@ -421,6 +460,7 @@ struct ath10k {
         bool p2p;
 
         struct {
+                enum ath10k_bus bus;
                 const struct ath10k_hif_ops *ops;
         } hif;
 
@@ -456,7 +496,10 @@ struct ath10k {
         const void *firmware_data;
         size_t firmware_len;
 
+        const struct firmware *cal_file;
+
         int fw_api;
+        enum ath10k_cal_mode cal_mode;
 
         struct {
                 struct completion started;
@@ -482,7 +525,7 @@ struct ath10k {
         /* current operating channel definition */
         struct cfg80211_chan_def chandef;
 
-        int free_vdev_map;
+        unsigned long long free_vdev_map;
         bool monitor;
         int monitor_vdev_id;
         bool monitor_started;
@@ -563,11 +606,19 @@ struct ath10k {
                 bool utf_monitor;
         } testmode;
 
+        struct {
+                /* protected by data_lock */
+                u32 fw_crash_counter;
+                u32 fw_warm_reset_counter;
+                u32 fw_cold_reset_counter;
+        } stats;
+
         /* must be last */
         u8 drv_priv[0] __aligned(sizeof(void *));
 };
 
 struct ath10k *ath10k_core_create(size_t priv_size, struct device *dev,
+                                  enum ath10k_bus bus,
                                   const struct ath10k_hif_ops *hif_ops);
 void ath10k_core_destroy(struct ath10k *ar);
 
diff --git a/drivers/net/wireless/ath/ath10k/debug.c b/drivers/net/wireless/ath/ath10k/debug.c
index 3756feba3223..a8f5a72ba259 100644
--- a/drivers/net/wireless/ath/ath10k/debug.c
+++ b/drivers/net/wireless/ath/ath10k/debug.c
@@ -23,6 +23,7 @@
 
 #include "core.h"
 #include "debug.h"
+#include "hif.h"
 
 /* ms */
 #define ATH10K_DEBUG_HTT_STATS_INTERVAL 1000
@@ -106,34 +107,36 @@ struct ath10k_dump_file_data {
         u8 data[0];
 } __packed;
 
-int ath10k_info(struct ath10k *ar, const char *fmt, ...)
+void ath10k_info(struct ath10k *ar, const char *fmt, ...)
 {
         struct va_format vaf = {
                 .fmt = fmt,
         };
         va_list args;
-        int ret;
 
         va_start(args, fmt);
         vaf.va = &args;
-        ret = dev_info(ar->dev, "%pV", &vaf);
+        dev_info(ar->dev, "%pV", &vaf);
         trace_ath10k_log_info(ar, &vaf);
         va_end(args);
-
-        return ret;
 }
 EXPORT_SYMBOL(ath10k_info);
 
 void ath10k_print_driver_info(struct ath10k *ar)
 {
-        ath10k_info(ar, "%s (0x%08x, 0x%08x) fw %s api %d htt %d.%d\n",
+        ath10k_info(ar, "%s (0x%08x, 0x%08x) fw %s api %d htt %d.%d wmi %d.%d.%d.%d cal %s\n",
                     ar->hw_params.name,
                     ar->target_version,
                     ar->chip_id,
                     ar->hw->wiphy->fw_version,
                     ar->fw_api,
                     ar->htt.target_version_major,
-                    ar->htt.target_version_minor);
+                    ar->htt.target_version_minor,
+                    ar->fw_version_major,
+                    ar->fw_version_minor,
+                    ar->fw_version_release,
+                    ar->fw_version_build,
+                    ath10k_cal_mode_str(ar->cal_mode));
         ath10k_info(ar, "debug %d debugfs %d tracing %d dfs %d testmode %d\n",
                     config_enabled(CONFIG_ATH10K_DEBUG),
                     config_enabled(CONFIG_ATH10K_DEBUGFS),
@@ -143,25 +146,22 @@ void ath10k_print_driver_info(struct ath10k *ar)
 }
 EXPORT_SYMBOL(ath10k_print_driver_info);
 
-int ath10k_err(struct ath10k *ar, const char *fmt, ...)
+void ath10k_err(struct ath10k *ar, const char *fmt, ...)
 {
         struct va_format vaf = {
                 .fmt = fmt,
         };
         va_list args;
-        int ret;
 
         va_start(args, fmt);
         vaf.va = &args;
-        ret = dev_err(ar->dev, "%pV", &vaf);
+        dev_err(ar->dev, "%pV", &vaf);
         trace_ath10k_log_err(ar, &vaf);
         va_end(args);
-
-        return ret;
 }
 EXPORT_SYMBOL(ath10k_err);
 
-int ath10k_warn(struct ath10k *ar, const char *fmt, ...)
+void ath10k_warn(struct ath10k *ar, const char *fmt, ...)
 {
         struct va_format vaf = {
                 .fmt = fmt,
@@ -174,15 +174,13 @@ int ath10k_warn(struct ath10k *ar, const char *fmt, ...)
         trace_ath10k_log_warn(ar, &vaf);
 
         va_end(args);
-
-        return 0;
 }
 EXPORT_SYMBOL(ath10k_warn);
 
 #ifdef CONFIG_ATH10K_DEBUGFS
 
 void ath10k_debug_read_service_map(struct ath10k *ar,
-                                   void *service_map,
+                                   const void *service_map,
                                    size_t map_size)
 {
         memcpy(ar->debug.wmi_service_bitmap, service_map, map_size);
@@ -242,169 +240,182 @@ static const struct file_operations fops_wmi_services = {
         .llseek = default_llseek,
 };
 
-void ath10k_debug_read_target_stats(struct ath10k *ar,
-                                    struct wmi_stats_event *ev)
+static void ath10k_debug_fw_stats_pdevs_free(struct list_head *head)
 {
-        u8 *tmp = ev->data;
-        struct ath10k_target_stats *stats;
-        int num_pdev_stats, num_vdev_stats, num_peer_stats;
-        struct wmi_pdev_stats_10x *ps;
-        int i;
+        struct ath10k_fw_stats_pdev *i, *tmp;
+
+        list_for_each_entry_safe(i, tmp, head, list) {
+                list_del(&i->list);
+                kfree(i);
+        }
+}
+
+static void ath10k_debug_fw_stats_peers_free(struct list_head *head)
+{
+        struct ath10k_fw_stats_peer *i, *tmp;
+
+        list_for_each_entry_safe(i, tmp, head, list) {
+                list_del(&i->list);
+                kfree(i);
+        }
+}
 
+static void ath10k_debug_fw_stats_reset(struct ath10k *ar)
+{
         spin_lock_bh(&ar->data_lock);
+        ar->debug.fw_stats_done = false;
+        ath10k_debug_fw_stats_pdevs_free(&ar->debug.fw_stats.pdevs);
+        ath10k_debug_fw_stats_peers_free(&ar->debug.fw_stats.peers);
+        spin_unlock_bh(&ar->data_lock);
+}
 
-        stats = &ar->debug.target_stats;
-
-        num_pdev_stats = __le32_to_cpu(ev->num_pdev_stats); /* 0 or 1 */
-        num_vdev_stats = __le32_to_cpu(ev->num_vdev_stats); /* 0 or max vdevs */
-        num_peer_stats = __le32_to_cpu(ev->num_peer_stats); /* 0 or max peers */
-
-        if (num_pdev_stats) {
-                ps = (struct wmi_pdev_stats_10x *)tmp;
-
-                stats->ch_noise_floor = __le32_to_cpu(ps->chan_nf);
-                stats->tx_frame_count = __le32_to_cpu(ps->tx_frame_count);
-                stats->rx_frame_count = __le32_to_cpu(ps->rx_frame_count);
-                stats->rx_clear_count = __le32_to_cpu(ps->rx_clear_count);
-                stats->cycle_count = __le32_to_cpu(ps->cycle_count);
-                stats->phy_err_count = __le32_to_cpu(ps->phy_err_count);
-                stats->chan_tx_power = __le32_to_cpu(ps->chan_tx_pwr);
-
-                stats->comp_queued = __le32_to_cpu(ps->wal.tx.comp_queued);
-                stats->comp_delivered =
-                        __le32_to_cpu(ps->wal.tx.comp_delivered);
-                stats->msdu_enqued = __le32_to_cpu(ps->wal.tx.msdu_enqued);
-                stats->mpdu_enqued = __le32_to_cpu(ps->wal.tx.mpdu_enqued);
-                stats->wmm_drop = __le32_to_cpu(ps->wal.tx.wmm_drop);
-                stats->local_enqued = __le32_to_cpu(ps->wal.tx.local_enqued);
-                stats->local_freed = __le32_to_cpu(ps->wal.tx.local_freed);
-                stats->hw_queued = __le32_to_cpu(ps->wal.tx.hw_queued);
-                stats->hw_reaped = __le32_to_cpu(ps->wal.tx.hw_reaped);
-                stats->underrun = __le32_to_cpu(ps->wal.tx.underrun);
-                stats->tx_abort = __le32_to_cpu(ps->wal.tx.tx_abort);
-                stats->mpdus_requed = __le32_to_cpu(ps->wal.tx.mpdus_requed);
-                stats->tx_ko = __le32_to_cpu(ps->wal.tx.tx_ko);
-                stats->data_rc = __le32_to_cpu(ps->wal.tx.data_rc);
-                stats->self_triggers = __le32_to_cpu(ps->wal.tx.self_triggers);
-                stats->sw_retry_failure =
-                        __le32_to_cpu(ps->wal.tx.sw_retry_failure);
-                stats->illgl_rate_phy_err =
-                        __le32_to_cpu(ps->wal.tx.illgl_rate_phy_err);
-                stats->pdev_cont_xretry =
-                        __le32_to_cpu(ps->wal.tx.pdev_cont_xretry);
-                stats->pdev_tx_timeout =
-                        __le32_to_cpu(ps->wal.tx.pdev_tx_timeout);
-                stats->pdev_resets = __le32_to_cpu(ps->wal.tx.pdev_resets);
-                stats->phy_underrun = __le32_to_cpu(ps->wal.tx.phy_underrun);
-                stats->txop_ovf = __le32_to_cpu(ps->wal.tx.txop_ovf);
-
-                stats->mid_ppdu_route_change =
-                        __le32_to_cpu(ps->wal.rx.mid_ppdu_route_change);
-                stats->status_rcvd = __le32_to_cpu(ps->wal.rx.status_rcvd);
-                stats->r0_frags = __le32_to_cpu(ps->wal.rx.r0_frags);
-                stats->r1_frags = __le32_to_cpu(ps->wal.rx.r1_frags);
-                stats->r2_frags = __le32_to_cpu(ps->wal.rx.r2_frags);
-                stats->r3_frags = __le32_to_cpu(ps->wal.rx.r3_frags);
-                stats->htt_msdus = __le32_to_cpu(ps->wal.rx.htt_msdus);
-                stats->htt_mpdus = __le32_to_cpu(ps->wal.rx.htt_mpdus);
-                stats->loc_msdus = __le32_to_cpu(ps->wal.rx.loc_msdus);
-                stats->loc_mpdus = __le32_to_cpu(ps->wal.rx.loc_mpdus);
-                stats->oversize_amsdu =
-                        __le32_to_cpu(ps->wal.rx.oversize_amsdu);
-                stats->phy_errs = __le32_to_cpu(ps->wal.rx.phy_errs);
-                stats->phy_err_drop = __le32_to_cpu(ps->wal.rx.phy_err_drop);
-                stats->mpdu_errs = __le32_to_cpu(ps->wal.rx.mpdu_errs);
-
-                if (test_bit(ATH10K_FW_FEATURE_WMI_10X,
-                             ar->fw_features)) {
-                        stats->ack_rx_bad = __le32_to_cpu(ps->ack_rx_bad);
-                        stats->rts_bad = __le32_to_cpu(ps->rts_bad);
-                        stats->rts_good = __le32_to_cpu(ps->rts_good);
-                        stats->fcs_bad = __le32_to_cpu(ps->fcs_bad);
-                        stats->no_beacons = __le32_to_cpu(ps->no_beacons);
-                        stats->mib_int_count = __le32_to_cpu(ps->mib_int_count);
-                        tmp += sizeof(struct wmi_pdev_stats_10x);
-                } else {
-                        tmp += sizeof(struct wmi_pdev_stats_old);
-                }
+static size_t ath10k_debug_fw_stats_num_peers(struct list_head *head)
+{
+        struct ath10k_fw_stats_peer *i;
+        size_t num = 0;
+
+        list_for_each_entry(i, head, list)
+                ++num;
+
+        return num;
+}
+
+void ath10k_debug_fw_stats_process(struct ath10k *ar, struct sk_buff *skb)
+{
+        struct ath10k_fw_stats stats = {};
+        bool is_start, is_started, is_end;
+        size_t num_peers;
+        int ret;
+
+        INIT_LIST_HEAD(&stats.pdevs);
+        INIT_LIST_HEAD(&stats.peers);
+
+        spin_lock_bh(&ar->data_lock);
+        ret = ath10k_wmi_pull_fw_stats(ar, skb, &stats);
+        if (ret) {
+                ath10k_warn(ar, "failed to pull fw stats: %d\n", ret);
+                goto unlock;
         }
 
-        /* 0 or max vdevs */
-        /* Currently firmware does not support VDEV stats */
-        if (num_vdev_stats) {
-                struct wmi_vdev_stats *vdev_stats;
+        /* Stat data may exceed htc-wmi buffer limit. In such case firmware
+         * splits the stats data and delivers it in a ping-pong fashion of
+         * request cmd-update event.
+         *
+         * However there is no explicit end-of-data. Instead start-of-data is
+         * used as an implicit one. This works as follows:
+         *  a) discard stat update events until one with pdev stats is
+         *     delivered - this skips session started at end of (b)
+         *  b) consume stat update events until another one with pdev stats is
+         *     delivered which is treated as end-of-data and is itself discarded
+         */
 
-                for (i = 0; i < num_vdev_stats; i++) {
-                        vdev_stats = (struct wmi_vdev_stats *)tmp;
-                        tmp += sizeof(struct wmi_vdev_stats);
-                }
+        if (ar->debug.fw_stats_done) {
+                ath10k_warn(ar, "received unsolicited stats update event\n");
+                goto free;
         }
 
-        if (num_peer_stats) {
-                struct wmi_peer_stats_10x *peer_stats;
-                struct ath10k_peer_stat *s;
-
-                stats->peers = num_peer_stats;
-
-                for (i = 0; i < num_peer_stats; i++) {
-                        peer_stats = (struct wmi_peer_stats_10x *)tmp;
-                        s = &stats->peer_stat[i];
-
-                        memcpy(s->peer_macaddr, &peer_stats->peer_macaddr.addr,
-                               ETH_ALEN);
-                        s->peer_rssi = __le32_to_cpu(peer_stats->peer_rssi);
-                        s->peer_tx_rate =
-                                __le32_to_cpu(peer_stats->peer_tx_rate);
-                        if (test_bit(ATH10K_FW_FEATURE_WMI_10X,
-                                     ar->fw_features)) {
-                                s->peer_rx_rate =
-                                        __le32_to_cpu(peer_stats->peer_rx_rate);
-                                tmp += sizeof(struct wmi_peer_stats_10x);
-
-                        } else {
-                                tmp += sizeof(struct wmi_peer_stats_old);
-                        }
+        num_peers = ath10k_debug_fw_stats_num_peers(&ar->debug.fw_stats.peers);
+        is_start = (list_empty(&ar->debug.fw_stats.pdevs) &&
+                    !list_empty(&stats.pdevs));
+        is_end = (!list_empty(&ar->debug.fw_stats.pdevs) &&
+                  !list_empty(&stats.pdevs));
+
+        if (is_start)
+                list_splice_tail_init(&stats.pdevs, &ar->debug.fw_stats.pdevs);
+
+        if (is_end)
+                ar->debug.fw_stats_done = true;
+
+        is_started = !list_empty(&ar->debug.fw_stats.pdevs);
+
+        if (is_started && !is_end) {
+                if (num_peers >= ATH10K_MAX_NUM_PEER_IDS) {
+                        /* Although this is unlikely impose a sane limit to
+                         * prevent firmware from DoS-ing the host.
+                         */
+                        ath10k_warn(ar, "dropping fw peer stats\n");
+                        goto free;
                 }
+
+                list_splice_tail_init(&stats.peers, &ar->debug.fw_stats.peers);
         }
 
+        complete(&ar->debug.fw_stats_complete);
+
+free:
+        /* In some cases lists have been spliced and cleared. Free up
+         * resources if that is not the case.
+         */
+        ath10k_debug_fw_stats_pdevs_free(&stats.pdevs);
+        ath10k_debug_fw_stats_peers_free(&stats.peers);
+
+unlock:
         spin_unlock_bh(&ar->data_lock);
-        complete(&ar->debug.event_stats_compl);
 }
 
-static ssize_t ath10k_read_fw_stats(struct file *file, char __user *user_buf,
-                                    size_t count, loff_t *ppos)
+static int ath10k_debug_fw_stats_request(struct ath10k *ar)
 {
-        struct ath10k *ar = file->private_data;
-        struct ath10k_target_stats *fw_stats;
-        char *buf = NULL;
-        unsigned int len = 0, buf_len = 8000;
-        ssize_t ret_cnt = 0;
-        long left;
-        int i;
+        unsigned long timeout;
         int ret;
 
-        fw_stats = &ar->debug.target_stats;
+        lockdep_assert_held(&ar->conf_mutex);
 
-        mutex_lock(&ar->conf_mutex);
+        timeout = jiffies + msecs_to_jiffies(1*HZ);
 
-        if (ar->state != ATH10K_STATE_ON)
-                goto exit;
+        ath10k_debug_fw_stats_reset(ar);
 
-        buf = kzalloc(buf_len, GFP_KERNEL);
-        if (!buf)
-                goto exit;
+        for (;;) {
+                if (time_after(jiffies, timeout))
+                        return -ETIMEDOUT;
 
-        ret = ath10k_wmi_request_stats(ar, WMI_REQUEST_PEER_STAT);
-        if (ret) {
-                ath10k_warn(ar, "could not request stats (%d)\n", ret);
-                goto exit;
+                reinit_completion(&ar->debug.fw_stats_complete);
+
+                ret = ath10k_wmi_request_stats(ar, WMI_REQUEST_PEER_STAT);
+                if (ret) {
+                        ath10k_warn(ar, "could not request stats (%d)\n", ret);
+                        return ret;
+                }
+
+                ret = wait_for_completion_timeout(&ar->debug.fw_stats_complete,
+                                                  1*HZ);
+                if (ret <= 0)
+                        return -ETIMEDOUT;
+
+                spin_lock_bh(&ar->data_lock);
+                if (ar->debug.fw_stats_done) {
+                        spin_unlock_bh(&ar->data_lock);
+                        break;
+                }
+                spin_unlock_bh(&ar->data_lock);
         }
 
-        left = wait_for_completion_timeout(&ar->debug.event_stats_compl, 1*HZ);
-        if (left <= 0)
-                goto exit;
+        return 0;
+}
+
+/* FIXME: How to calculate the buffer size sanely? */
+#define ATH10K_FW_STATS_BUF_SIZE (1024*1024)
+
+static void ath10k_fw_stats_fill(struct ath10k *ar,
+                                 struct ath10k_fw_stats *fw_stats,
+                                 char *buf)
+{
+        unsigned int len = 0;
+        unsigned int buf_len = ATH10K_FW_STATS_BUF_SIZE;
+        const struct ath10k_fw_stats_pdev *pdev;
+        const struct ath10k_fw_stats_peer *peer;
+        size_t num_peers;
 
         spin_lock_bh(&ar->data_lock);
+
+        pdev = list_first_entry_or_null(&fw_stats->pdevs,
+                                        struct ath10k_fw_stats_pdev, list);
+        if (!pdev) {
+                ath10k_warn(ar, "failed to get pdev stats\n");
+                goto unlock;
+        }
+
+        num_peers = ath10k_debug_fw_stats_num_peers(&fw_stats->peers);
+
         len += scnprintf(buf + len, buf_len - len, "\n");
         len += scnprintf(buf + len, buf_len - len, "%30s\n",
                          "ath10k PDEV stats");
@@ -412,29 +423,29 @@ static ssize_t ath10k_read_fw_stats(struct file *file, char __user *user_buf,
                                  "=================");
 
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "Channel noise floor", fw_stats->ch_noise_floor);
+                         "Channel noise floor", pdev->ch_noise_floor);
         len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
-                         "Channel TX power", fw_stats->chan_tx_power);
+                         "Channel TX power", pdev->chan_tx_power);
         len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
-                         "TX frame count", fw_stats->tx_frame_count);
+                         "TX frame count", pdev->tx_frame_count);
         len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
-                         "RX frame count", fw_stats->rx_frame_count);
+                         "RX frame count", pdev->rx_frame_count);
         len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
-                         "RX clear count", fw_stats->rx_clear_count);
+                         "RX clear count", pdev->rx_clear_count);
         len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
-                         "Cycle count", fw_stats->cycle_count);
+                         "Cycle count", pdev->cycle_count);
         len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
-                         "PHY error count", fw_stats->phy_err_count);
+                         "PHY error count", pdev->phy_err_count);
         len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
-                         "RTS bad count", fw_stats->rts_bad);
+                         "RTS bad count", pdev->rts_bad);
         len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
-                         "RTS good count", fw_stats->rts_good);
+                         "RTS good count", pdev->rts_good);
         len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
-                         "FCS bad count", fw_stats->fcs_bad);
+                         "FCS bad count", pdev->fcs_bad);
         len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
-                         "No beacon count", fw_stats->no_beacons);
+                         "No beacon count", pdev->no_beacons);
         len += scnprintf(buf + len, buf_len - len, "%30s %10u\n",
-                         "MIB int count", fw_stats->mib_int_count);
+                         "MIB int count", pdev->mib_int_count);
 
         len += scnprintf(buf + len, buf_len - len, "\n");
         len += scnprintf(buf + len, buf_len - len, "%30s\n",
@@ -443,51 +454,51 @@ static ssize_t ath10k_read_fw_stats(struct file *file, char __user *user_buf,
                                  "=================");
 
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "HTT cookies queued", fw_stats->comp_queued);
+                         "HTT cookies queued", pdev->comp_queued);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "HTT cookies disp.", fw_stats->comp_delivered);
+                         "HTT cookies disp.", pdev->comp_delivered);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "MSDU queued", fw_stats->msdu_enqued);
+                         "MSDU queued", pdev->msdu_enqued);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "MPDU queued", fw_stats->mpdu_enqued);
+                         "MPDU queued", pdev->mpdu_enqued);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "MSDUs dropped", fw_stats->wmm_drop);
+                         "MSDUs dropped", pdev->wmm_drop);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "Local enqued", fw_stats->local_enqued);
+                         "Local enqued", pdev->local_enqued);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "Local freed", fw_stats->local_freed);
+                         "Local freed", pdev->local_freed);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "HW queued", fw_stats->hw_queued);
+                         "HW queued", pdev->hw_queued);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "PPDUs reaped", fw_stats->hw_reaped);
+                         "PPDUs reaped", pdev->hw_reaped);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "Num underruns", fw_stats->underrun);
+                         "Num underruns", pdev->underrun);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "PPDUs cleaned", fw_stats->tx_abort);
+                         "PPDUs cleaned", pdev->tx_abort);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "MPDUs requed", fw_stats->mpdus_requed);
+                         "MPDUs requed", pdev->mpdus_requed);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "Excessive retries", fw_stats->tx_ko);
+                         "Excessive retries", pdev->tx_ko);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "HW rate", fw_stats->data_rc);
+                         "HW rate", pdev->data_rc);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "Sched self tiggers", fw_stats->self_triggers);
+                         "Sched self tiggers", pdev->self_triggers);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
                          "Dropped due to SW retries",
-                         fw_stats->sw_retry_failure);
+                         pdev->sw_retry_failure);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
                          "Illegal rate phy errors",
-                         fw_stats->illgl_rate_phy_err);
+                         pdev->illgl_rate_phy_err);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "Pdev continous xretry", fw_stats->pdev_cont_xretry);
+                         "Pdev continous xretry", pdev->pdev_cont_xretry);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "TX timeout", fw_stats->pdev_tx_timeout);
+                         "TX timeout", pdev->pdev_tx_timeout);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "PDEV resets", fw_stats->pdev_resets);
+                         "PDEV resets", pdev->pdev_resets);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "PHY underrun", fw_stats->phy_underrun);
+                         "PHY underrun", pdev->phy_underrun);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "MPDU is more than txop limit", fw_stats->txop_ovf);
+                         "MPDU is more than txop limit", pdev->txop_ovf);
 
         len += scnprintf(buf + len, buf_len - len, "\n");
         len += scnprintf(buf + len, buf_len - len, "%30s\n",
@@ -497,70 +508,161 @@ static ssize_t ath10k_read_fw_stats(struct file *file, char __user *user_buf,
 
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
                          "Mid PPDU route change",
-                         fw_stats->mid_ppdu_route_change);
+                         pdev->mid_ppdu_route_change);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "Tot. number of statuses", fw_stats->status_rcvd);
+                         "Tot. number of statuses", pdev->status_rcvd);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "Extra frags on rings 0", fw_stats->r0_frags);
+                         "Extra frags on rings 0", pdev->r0_frags);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "Extra frags on rings 1", fw_stats->r1_frags);
+                         "Extra frags on rings 1", pdev->r1_frags);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "Extra frags on rings 2", fw_stats->r2_frags);
+                         "Extra frags on rings 2", pdev->r2_frags);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "Extra frags on rings 3", fw_stats->r3_frags);
+                         "Extra frags on rings 3", pdev->r3_frags);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "MSDUs delivered to HTT", fw_stats->htt_msdus);
+                         "MSDUs delivered to HTT", pdev->htt_msdus);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "MPDUs delivered to HTT", fw_stats->htt_mpdus);
+                         "MPDUs delivered to HTT", pdev->htt_mpdus);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "MSDUs delivered to stack", fw_stats->loc_msdus);
+                         "MSDUs delivered to stack", pdev->loc_msdus);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "MPDUs delivered to stack", fw_stats->loc_mpdus);
+                         "MPDUs delivered to stack", pdev->loc_mpdus);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "Oversized AMSUs", fw_stats->oversize_amsdu);
+                         "Oversized AMSUs", pdev->oversize_amsdu);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "PHY errors", fw_stats->phy_errs);
+                         "PHY errors", pdev->phy_errs);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "PHY errors drops", fw_stats->phy_err_drop);
+                         "PHY errors drops", pdev->phy_err_drop);
         len += scnprintf(buf + len, buf_len - len, "%30s %10d\n",
-                         "MPDU errors (FCS, MIC, ENC)", fw_stats->mpdu_errs);
+                         "MPDU errors (FCS, MIC, ENC)", pdev->mpdu_errs);
 
         len += scnprintf(buf + len, buf_len - len, "\n");
-        len += scnprintf(buf + len, buf_len - len, "%30s (%d)\n",
-                         "ath10k PEER stats", fw_stats->peers);
+        len += scnprintf(buf + len, buf_len - len, "%30s (%zu)\n",
+                         "ath10k PEER stats", num_peers);
         len += scnprintf(buf + len, buf_len - len, "%30s\n\n",
                                  "=================");
 
-        for (i = 0; i < fw_stats->peers; i++) {
+        list_for_each_entry(peer, &fw_stats->peers, list) {
                 len += scnprintf(buf + len, buf_len - len, "%30s %pM\n",
-                                 "Peer MAC address",
-                                 fw_stats->peer_stat[i].peer_macaddr);
+                                 "Peer MAC address", peer->peer_macaddr);
                 len += scnprintf(buf + len, buf_len - len, "%30s %u\n",
-                                 "Peer RSSI", fw_stats->peer_stat[i].peer_rssi);
+                                 "Peer RSSI", peer->peer_rssi);
                 len += scnprintf(buf + len, buf_len - len, "%30s %u\n",
-                                 "Peer TX rate",
-                                 fw_stats->peer_stat[i].peer_tx_rate);
+                                 "Peer TX rate", peer->peer_tx_rate);
                 len += scnprintf(buf + len, buf_len - len, "%30s %u\n",
-                                 "Peer RX rate",
-                                 fw_stats->peer_stat[i].peer_rx_rate);
+                                 "Peer RX rate", peer->peer_rx_rate);
                 len += scnprintf(buf + len, buf_len - len, "\n");
         }
+
+unlock:
         spin_unlock_bh(&ar->data_lock);
 
-        if (len > buf_len)
-                len = buf_len;
+        if (len >= buf_len)
+                buf[len - 1] = 0;
+        else
+                buf[len] = 0;
+}
 
-        ret_cnt = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+static int ath10k_fw_stats_open(struct inode *inode, struct file *file)
+{
+        struct ath10k *ar = inode->i_private;
+        void *buf = NULL;
+        int ret;
+
+        mutex_lock(&ar->conf_mutex);
+
+        if (ar->state != ATH10K_STATE_ON) {
+                ret = -ENETDOWN;
+                goto err_unlock;
+        }
+
+        buf = vmalloc(ATH10K_FW_STATS_BUF_SIZE);
+        if (!buf) {
+                ret = -ENOMEM;
+                goto err_unlock;
+        }
+
+        ret = ath10k_debug_fw_stats_request(ar);
+        if (ret) {
+                ath10k_warn(ar, "failed to request fw stats: %d\n", ret);
+                goto err_free;
+        }
+
+        ath10k_fw_stats_fill(ar, &ar->debug.fw_stats, buf);
+        file->private_data = buf;
 
-exit:
         mutex_unlock(&ar->conf_mutex);
-        kfree(buf);
-        return ret_cnt;
+        return 0;
+
+err_free:
+        vfree(buf);
+
+err_unlock:
+        mutex_unlock(&ar->conf_mutex);
+        return ret;
+}
+
+static int ath10k_fw_stats_release(struct inode *inode, struct file *file)
+{
+        vfree(file->private_data);
+
+        return 0;
+}
+
+static ssize_t ath10k_fw_stats_read(struct file *file, char __user *user_buf,
+                                    size_t count, loff_t *ppos)
+{
+        const char *buf = file->private_data;
+        unsigned int len = strlen(buf);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
 }
 
 static const struct file_operations fops_fw_stats = {
-        .read = ath10k_read_fw_stats,
+        .open = ath10k_fw_stats_open,
+        .release = ath10k_fw_stats_release,
+        .read = ath10k_fw_stats_read,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+static ssize_t ath10k_debug_fw_reset_stats_read(struct file *file,
+                                                char __user *user_buf,
+                                                size_t count, loff_t *ppos)
+{
+        struct ath10k *ar = file->private_data;
+        int ret, len, buf_len;
+        char *buf;
+
+        buf_len = 500;
+        buf = kmalloc(buf_len, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        spin_lock_bh(&ar->data_lock);
+
+        len = 0;
+        len += scnprintf(buf + len, buf_len - len,
+                         "fw_crash_counter\t\t%d\n", ar->stats.fw_crash_counter);
+        len += scnprintf(buf + len, buf_len - len,
+                         "fw_warm_reset_counter\t\t%d\n",
+                         ar->stats.fw_warm_reset_counter);
+        len += scnprintf(buf + len, buf_len - len,
+                         "fw_cold_reset_counter\t\t%d\n",
+                         ar->stats.fw_cold_reset_counter);
+
+        spin_unlock_bh(&ar->data_lock);
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+
+        kfree(buf);
+
+        return ret;
+}
+
+static const struct file_operations fops_fw_reset_stats = {
         .open = simple_open,
+        .read = ath10k_debug_fw_reset_stats_read,
         .owner = THIS_MODULE,
         .llseek = default_llseek,
 };
@@ -593,7 +695,8 @@ static ssize_t ath10k_read_simulate_fw_crash(struct file *file,
                 "To simulate firmware crash write one of the keywords to this file:\n"
                 "`soft` - this will send WMI_FORCE_FW_HANG_ASSERT to firmware if FW supports that command.\n"
                 "`hard` - this will send to firmware command with illegal parameters causing firmware crash.\n"
-                "`assert` - this will send special illegal parameter to firmware to cause assert failure and crash.\n";
+                "`assert` - this will send special illegal parameter to firmware to cause assert failure and crash.\n"
+                "`hw-restart` - this will simply queue hw restart without fw/hw actually crashing.\n";
 
         return simple_read_from_buffer(user_buf, count, ppos, buf, strlen(buf));
 }
@@ -646,6 +749,10 @@ static ssize_t ath10k_write_simulate_fw_crash(struct file *file,
         } else if (!strcmp(buf, "assert")) {
                 ath10k_info(ar, "simulating firmware assert crash\n");
                 ret = ath10k_debug_fw_assert(ar);
+        } else if (!strcmp(buf, "hw-restart")) {
+                ath10k_info(ar, "user requested hw restart\n");
+                queue_work(ar->workqueue, &ar->restart_work);
+                ret = 0;
         } else {
                 ret = -EINVAL;
                 goto exit;
@@ -1029,6 +1136,166 @@ exit:
         return ret;
 }
 
+/* TODO:  Would be nice to always support ethtool stats, would need to
+ * move the stats storage out of ath10k_debug, or always have ath10k_debug
+ * struct available..
+ */
+
+/* This generally cooresponds to the debugfs fw_stats file */
+static const char ath10k_gstrings_stats[][ETH_GSTRING_LEN] = {
+        "tx_pkts_nic",
+        "tx_bytes_nic",
+        "rx_pkts_nic",
+        "rx_bytes_nic",
+        "d_noise_floor",
+        "d_cycle_count",
+        "d_phy_error",
+        "d_rts_bad",
+        "d_rts_good",
+        "d_tx_power", /* in .5 dbM I think */
+        "d_rx_crc_err", /* fcs_bad */
+        "d_no_beacon",
+        "d_tx_mpdus_queued",
+        "d_tx_msdu_queued",
+        "d_tx_msdu_dropped",
+        "d_local_enqued",
+        "d_local_freed",
+        "d_tx_ppdu_hw_queued",
+        "d_tx_ppdu_reaped",
+        "d_tx_fifo_underrun",
+        "d_tx_ppdu_abort",
+        "d_tx_mpdu_requed",
+        "d_tx_excessive_retries",
+        "d_tx_hw_rate",
+        "d_tx_dropped_sw_retries",
+        "d_tx_illegal_rate",
+        "d_tx_continuous_xretries",
+        "d_tx_timeout",
+        "d_tx_mpdu_txop_limit",
+        "d_pdev_resets",
+        "d_rx_mid_ppdu_route_change",
+        "d_rx_status",
+        "d_rx_extra_frags_ring0",
+        "d_rx_extra_frags_ring1",
+        "d_rx_extra_frags_ring2",
+        "d_rx_extra_frags_ring3",
+        "d_rx_msdu_htt",
+        "d_rx_mpdu_htt",
+        "d_rx_msdu_stack",
+        "d_rx_mpdu_stack",
+        "d_rx_phy_err",
+        "d_rx_phy_err_drops",
+        "d_rx_mpdu_errors", /* FCS, MIC, ENC */
+        "d_fw_crash_count",
+        "d_fw_warm_reset_count",
+        "d_fw_cold_reset_count",
+};
+
+#define ATH10K_SSTATS_LEN ARRAY_SIZE(ath10k_gstrings_stats)
+
+void ath10k_debug_get_et_strings(struct ieee80211_hw *hw,
+                                 struct ieee80211_vif *vif,
+                                 u32 sset, u8 *data)
+{
+        if (sset == ETH_SS_STATS)
+                memcpy(data, *ath10k_gstrings_stats,
+                       sizeof(ath10k_gstrings_stats));
+}
+
+int ath10k_debug_get_et_sset_count(struct ieee80211_hw *hw,
+                                   struct ieee80211_vif *vif, int sset)
+{
+        if (sset == ETH_SS_STATS)
+                return ATH10K_SSTATS_LEN;
+
+        return 0;
+}
+
+void ath10k_debug_get_et_stats(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif,
+                               struct ethtool_stats *stats, u64 *data)
+{
+        struct ath10k *ar = hw->priv;
+        static const struct ath10k_fw_stats_pdev zero_stats = {};
+        const struct ath10k_fw_stats_pdev *pdev_stats;
+        int i = 0, ret;
+
+        mutex_lock(&ar->conf_mutex);
+
+        if (ar->state == ATH10K_STATE_ON) {
+                ret = ath10k_debug_fw_stats_request(ar);
+                if (ret) {
+                        /* just print a warning and try to use older results */
+                        ath10k_warn(ar,
+                                    "failed to get fw stats for ethtool: %d\n",
+                                    ret);
+                }
+        }
+
+        pdev_stats = list_first_entry_or_null(&ar->debug.fw_stats.pdevs,
+                                              struct ath10k_fw_stats_pdev,
+                                              list);
+        if (!pdev_stats) {
+                /* no results available so just return zeroes */
+                pdev_stats = &zero_stats;
+        }
+
+        spin_lock_bh(&ar->data_lock);
+
+        data[i++] = pdev_stats->hw_reaped; /* ppdu reaped */
+        data[i++] = 0; /* tx bytes */
+        data[i++] = pdev_stats->htt_mpdus;
+        data[i++] = 0; /* rx bytes */
+        data[i++] = pdev_stats->ch_noise_floor;
+        data[i++] = pdev_stats->cycle_count;
+        data[i++] = pdev_stats->phy_err_count;
+        data[i++] = pdev_stats->rts_bad;
+        data[i++] = pdev_stats->rts_good;
+        data[i++] = pdev_stats->chan_tx_power;
+        data[i++] = pdev_stats->fcs_bad;
+        data[i++] = pdev_stats->no_beacons;
+        data[i++] = pdev_stats->mpdu_enqued;
+        data[i++] = pdev_stats->msdu_enqued;
+        data[i++] = pdev_stats->wmm_drop;
+        data[i++] = pdev_stats->local_enqued;
+        data[i++] = pdev_stats->local_freed;
+        data[i++] = pdev_stats->hw_queued;
+        data[i++] = pdev_stats->hw_reaped;
+        data[i++] = pdev_stats->underrun;
+        data[i++] = pdev_stats->tx_abort;
+        data[i++] = pdev_stats->mpdus_requed;
+        data[i++] = pdev_stats->tx_ko;
+        data[i++] = pdev_stats->data_rc;
+        data[i++] = pdev_stats->sw_retry_failure;
+        data[i++] = pdev_stats->illgl_rate_phy_err;
+        data[i++] = pdev_stats->pdev_cont_xretry;
+        data[i++] = pdev_stats->pdev_tx_timeout;
+        data[i++] = pdev_stats->txop_ovf;
+        data[i++] = pdev_stats->pdev_resets;
+        data[i++] = pdev_stats->mid_ppdu_route_change;
+        data[i++] = pdev_stats->status_rcvd;
+        data[i++] = pdev_stats->r0_frags;
+        data[i++] = pdev_stats->r1_frags;
+        data[i++] = pdev_stats->r2_frags;
+        data[i++] = pdev_stats->r3_frags;
+        data[i++] = pdev_stats->htt_msdus;
+        data[i++] = pdev_stats->htt_mpdus;
+        data[i++] = pdev_stats->loc_msdus;
+        data[i++] = pdev_stats->loc_mpdus;
+        data[i++] = pdev_stats->phy_errs;
+        data[i++] = pdev_stats->phy_err_drop;
+        data[i++] = pdev_stats->mpdu_errs;
+        data[i++] = ar->stats.fw_crash_counter;
+        data[i++] = ar->stats.fw_warm_reset_counter;
+        data[i++] = ar->stats.fw_cold_reset_counter;
+
+        spin_unlock_bh(&ar->data_lock);
+
+        mutex_unlock(&ar->conf_mutex);
+
+        WARN_ON(i != ATH10K_SSTATS_LEN);
+}
+
 static const struct file_operations fops_fw_dbglog = {
         .read = ath10k_read_fw_dbglog,
         .write = ath10k_write_fw_dbglog,
@@ -1037,6 +1304,84 @@ static const struct file_operations fops_fw_dbglog = {
         .llseek = default_llseek,
 };
 
+static int ath10k_debug_cal_data_open(struct inode *inode, struct file *file)
+{
+        struct ath10k *ar = inode->i_private;
+        void *buf;
+        u32 hi_addr;
+        __le32 addr;
+        int ret;
+
+        mutex_lock(&ar->conf_mutex);
+
+        if (ar->state != ATH10K_STATE_ON &&
+            ar->state != ATH10K_STATE_UTF) {
+                ret = -ENETDOWN;
+                goto err;
+        }
+
+        buf = vmalloc(QCA988X_CAL_DATA_LEN);
+        if (!buf) {
+                ret = -ENOMEM;
+                goto err;
+        }
+
+        hi_addr = host_interest_item_address(HI_ITEM(hi_board_data));
+
+        ret = ath10k_hif_diag_read(ar, hi_addr, &addr, sizeof(addr));
+        if (ret) {
+                ath10k_warn(ar, "failed to read hi_board_data address: %d\n", ret);
+                goto err_vfree;
+        }
+
+        ret = ath10k_hif_diag_read(ar, le32_to_cpu(addr), buf,
+                                   QCA988X_CAL_DATA_LEN);
+        if (ret) {
+                ath10k_warn(ar, "failed to read calibration data: %d\n", ret);
+                goto err_vfree;
+        }
+
+        file->private_data = buf;
+
+        mutex_unlock(&ar->conf_mutex);
+
+        return 0;
+
+err_vfree:
+        vfree(buf);
+
+err:
+        mutex_unlock(&ar->conf_mutex);
+
+        return ret;
+}
+
+static ssize_t ath10k_debug_cal_data_read(struct file *file,
+                                          char __user *user_buf,
+                                          size_t count, loff_t *ppos)
+{
+        void *buf = file->private_data;
+
+        return simple_read_from_buffer(user_buf, count, ppos,
+                                       buf, QCA988X_CAL_DATA_LEN);
+}
+
+static int ath10k_debug_cal_data_release(struct inode *inode,
+                                         struct file *file)
+{
+        vfree(file->private_data);
+
+        return 0;
+}
+
+static const struct file_operations fops_cal_data = {
+        .open = ath10k_debug_cal_data_open,
+        .read = ath10k_debug_cal_data_read,
+        .release = ath10k_debug_cal_data_release,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
 int ath10k_debug_start(struct ath10k *ar)
 {
         int ret;
@@ -1057,7 +1402,22 @@ int ath10k_debug_start(struct ath10k *ar)
                                     ret);
         }
 
-        return 0;
+        if (ar->debug.pktlog_filter) {
+                ret = ath10k_wmi_pdev_pktlog_enable(ar,
+                                                    ar->debug.pktlog_filter);
+                if (ret)
+                        /* not serious */
+                        ath10k_warn(ar,
+                                    "failed to enable pktlog filter %x: %d\n",
+                                    ar->debug.pktlog_filter, ret);
+        } else {
+                ret = ath10k_wmi_pdev_pktlog_disable(ar);
+                if (ret)
+                        /* not serious */
+                        ath10k_warn(ar, "failed to disable pktlog: %d\n", ret);
+        }
+
+        return ret;
 }
 
 void ath10k_debug_stop(struct ath10k *ar)
@@ -1072,6 +1432,8 @@ void ath10k_debug_stop(struct ath10k *ar)
 
         ar->debug.htt_max_amsdu = 0;
         ar->debug.htt_max_ampdu = 0;
+
+        ath10k_wmi_pdev_pktlog_disable(ar);
 }
 
 static ssize_t ath10k_write_simulate_radar(struct file *file,
@@ -1154,12 +1516,78 @@ static const struct file_operations fops_dfs_stats = {
         .llseek = default_llseek,
 };
 
+static ssize_t ath10k_write_pktlog_filter(struct file *file,
+                                          const char __user *ubuf,
+                                          size_t count, loff_t *ppos)
+{
+        struct ath10k *ar = file->private_data;
+        u32 filter;
+        int ret;
+
+        if (kstrtouint_from_user(ubuf, count, 0, &filter))
+                return -EINVAL;
+
+        mutex_lock(&ar->conf_mutex);
+
+        if (ar->state != ATH10K_STATE_ON) {
+                ar->debug.pktlog_filter = filter;
+                ret = count;
+                goto out;
+        }
+
+        if (filter && (filter != ar->debug.pktlog_filter)) {
+                ret = ath10k_wmi_pdev_pktlog_enable(ar, filter);
+                if (ret) {
+                        ath10k_warn(ar, "failed to enable pktlog filter %x: %d\n",
+                                    ar->debug.pktlog_filter, ret);
+                        goto out;
+                }
+        } else {
+                ret = ath10k_wmi_pdev_pktlog_disable(ar);
+                if (ret) {
+                        ath10k_warn(ar, "failed to disable pktlog: %d\n", ret);
+                        goto out;
+                }
+        }
+
+        ar->debug.pktlog_filter = filter;
+        ret = count;
+
+out:
+        mutex_unlock(&ar->conf_mutex);
+        return ret;
+}
+
+static ssize_t ath10k_read_pktlog_filter(struct file *file, char __user *ubuf,
+                                         size_t count, loff_t *ppos)
+{
+        char buf[32];
+        struct ath10k *ar = file->private_data;
+        int len = 0;
+
+        mutex_lock(&ar->conf_mutex);
+        len = scnprintf(buf, sizeof(buf) - len, "%08x\n",
+                        ar->debug.pktlog_filter);
+        mutex_unlock(&ar->conf_mutex);
+
+        return simple_read_from_buffer(ubuf, count, ppos, buf, len);
+}
+
+static const struct file_operations fops_pktlog_filter = {
+        .read = ath10k_read_pktlog_filter,
+        .write = ath10k_write_pktlog_filter,
+        .open = simple_open
+};
+
 int ath10k_debug_create(struct ath10k *ar)
 {
         ar->debug.fw_crash_data = vzalloc(sizeof(*ar->debug.fw_crash_data));
         if (!ar->debug.fw_crash_data)
                 return -ENOMEM;
 
+        INIT_LIST_HEAD(&ar->debug.fw_stats.pdevs);
+        INIT_LIST_HEAD(&ar->debug.fw_stats.peers);
+
         return 0;
 }
 
@@ -1167,6 +1595,8 @@ void ath10k_debug_destroy(struct ath10k *ar)
 {
         vfree(ar->debug.fw_crash_data);
         ar->debug.fw_crash_data = NULL;
+
+        ath10k_debug_fw_stats_reset(ar);
 }
 
 int ath10k_debug_register(struct ath10k *ar)
@@ -1183,11 +1613,14 @@ int ath10k_debug_register(struct ath10k *ar)
         INIT_DELAYED_WORK(&ar->debug.htt_stats_dwork,
                           ath10k_debug_htt_stats_dwork);
 
-        init_completion(&ar->debug.event_stats_compl);
+        init_completion(&ar->debug.fw_stats_complete);
 
         debugfs_create_file("fw_stats", S_IRUSR, ar->debug.debugfs_phy, ar,
                             &fops_fw_stats);
 
+        debugfs_create_file("fw_reset_stats", S_IRUSR, ar->debug.debugfs_phy,
+                            ar, &fops_fw_reset_stats);
+
         debugfs_create_file("wmi_services", S_IRUSR, ar->debug.debugfs_phy, ar,
                             &fops_wmi_services);
 
@@ -1210,6 +1643,9 @@ int ath10k_debug_register(struct ath10k *ar)
         debugfs_create_file("fw_dbglog", S_IRUSR, ar->debug.debugfs_phy,
                             ar, &fops_fw_dbglog);
 
+        debugfs_create_file("cal_data", S_IRUSR, ar->debug.debugfs_phy,
+                            ar, &fops_cal_data);
+
         if (config_enabled(CONFIG_ATH10K_DFS_CERTIFIED)) {
                 debugfs_create_file("dfs_simulate_radar", S_IWUSR,
                                     ar->debug.debugfs_phy, ar,
@@ -1224,6 +1660,9 @@ int ath10k_debug_register(struct ath10k *ar)
                                     &fops_dfs_stats);
         }
 
+        debugfs_create_file("pktlog_filter", S_IRUGO | S_IWUSR,
+                            ar->debug.debugfs_phy, ar, &fops_pktlog_filter);
+
         return 0;
 }
 
@@ -1260,11 +1699,26 @@ void ath10k_dbg_dump(struct ath10k *ar,
                      const char *msg, const char *prefix,
                      const void *buf, size_t len)
 {
+        char linebuf[256];
+        unsigned int linebuflen;
+        const void *ptr;
+
         if (ath10k_debug_mask & mask) {
                 if (msg)
                         ath10k_dbg(ar, mask, "%s\n", msg);
 
-                print_hex_dump_bytes(prefix, DUMP_PREFIX_OFFSET, buf, len);
+                for (ptr = buf; (ptr - buf) < len; ptr += 16) {
+                        linebuflen = 0;
+                        linebuflen += scnprintf(linebuf + linebuflen,
+                                                sizeof(linebuf) - linebuflen,
+                                                "%s%08x: ",
+                                                (prefix ? prefix : ""),
+                                                (unsigned int)(ptr - buf));
+                        hex_dump_to_buffer(ptr, len - (ptr - buf), 16, 1,
+                                           linebuf + linebuflen,
+                                           sizeof(linebuf) - linebuflen, true);
+                        dev_printk(KERN_DEBUG, ar->dev, "%s\n", linebuf);
+                }
         }
 
         /* tracing code doesn't like null strings :/ */
diff --git a/drivers/net/wireless/ath/ath10k/debug.h b/drivers/net/wireless/ath/ath10k/debug.h
index b3774f7f492c..0c934a8378db 100644
--- a/drivers/net/wireless/ath/ath10k/debug.h
+++ b/drivers/net/wireless/ath/ath10k/debug.h
@@ -38,11 +38,20 @@ enum ath10k_debug_mask {
         ATH10K_DBG_ANY          = 0xffffffff,
 };
 
+enum ath10k_pktlog_filter {
+        ATH10K_PKTLOG_RX         = 0x000000001,
+        ATH10K_PKTLOG_TX         = 0x000000002,
+        ATH10K_PKTLOG_RCFIND     = 0x000000004,
+        ATH10K_PKTLOG_RCUPDATE   = 0x000000008,
+        ATH10K_PKTLOG_DBG_PRINT  = 0x000000010,
+        ATH10K_PKTLOG_ANY        = 0x00000001f,
+};
+
 extern unsigned int ath10k_debug_mask;
 
-__printf(2, 3) int ath10k_info(struct ath10k *ar, const char *fmt, ...);
-__printf(2, 3) int ath10k_err(struct ath10k *ar, const char *fmt, ...);
-__printf(2, 3) int ath10k_warn(struct ath10k *ar, const char *fmt, ...);
+__printf(2, 3) void ath10k_info(struct ath10k *ar, const char *fmt, ...);
+__printf(2, 3) void ath10k_err(struct ath10k *ar, const char *fmt, ...);
+__printf(2, 3) void ath10k_warn(struct ath10k *ar, const char *fmt, ...);
 void ath10k_print_driver_info(struct ath10k *ar);
 
 #ifdef CONFIG_ATH10K_DEBUGFS
@@ -53,17 +62,24 @@ void ath10k_debug_destroy(struct ath10k *ar);
 int ath10k_debug_register(struct ath10k *ar);
 void ath10k_debug_unregister(struct ath10k *ar);
 void ath10k_debug_read_service_map(struct ath10k *ar,
-                                   void *service_map,
+                                   const void *service_map,
                                    size_t map_size);
-void ath10k_debug_read_target_stats(struct ath10k *ar,
-                                    struct wmi_stats_event *ev);
+void ath10k_debug_fw_stats_process(struct ath10k *ar, struct sk_buff *skb);
 struct ath10k_fw_crash_data *
 ath10k_debug_get_new_fw_crash_data(struct ath10k *ar);
 
 void ath10k_debug_dbglog_add(struct ath10k *ar, u8 *buffer, int len);
-
 #define ATH10K_DFS_STAT_INC(ar, c) (ar->debug.dfs_stats.c++)
 
+void ath10k_debug_get_et_strings(struct ieee80211_hw *hw,
+                                 struct ieee80211_vif *vif,
+                                 u32 sset, u8 *data);
+int ath10k_debug_get_et_sset_count(struct ieee80211_hw *hw,
+                                   struct ieee80211_vif *vif, int sset);
+void ath10k_debug_get_et_stats(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif,
+                               struct ethtool_stats *stats, u64 *data);
+
 #else
 static inline int ath10k_debug_start(struct ath10k *ar)
 {
@@ -93,13 +109,13 @@ static inline void ath10k_debug_unregister(struct ath10k *ar)
 }
 
 static inline void ath10k_debug_read_service_map(struct ath10k *ar,
-                                                 void *service_map,
+                                                 const void *service_map,
                                                  size_t map_size)
 {
 }
 
-static inline void ath10k_debug_read_target_stats(struct ath10k *ar,
-                                                  struct wmi_stats_event *ev)
+static inline void ath10k_debug_fw_stats_process(struct ath10k *ar,
+                                                 struct sk_buff *skb)
 {
 }
 
@@ -116,6 +132,10 @@ ath10k_debug_get_new_fw_crash_data(struct ath10k *ar)
 
 #define ATH10K_DFS_STAT_INC(ar, c) do { } while (0)
 
+#define ath10k_debug_get_et_strings NULL
+#define ath10k_debug_get_et_sset_count NULL
+#define ath10k_debug_get_et_stats NULL
+
 #endif /* CONFIG_ATH10K_DEBUGFS */
 
 #ifdef CONFIG_ATH10K_DEBUG
diff --git a/drivers/net/wireless/ath/ath10k/hif.h b/drivers/net/wireless/ath/ath10k/hif.h
index 62323fea27e1..30301f5b6051 100644
--- a/drivers/net/wireless/ath/ath10k/hif.h
+++ b/drivers/net/wireless/ath/ath10k/hif.h
@@ -43,6 +43,10 @@ struct ath10k_hif_ops {
         int (*tx_sg)(struct ath10k *ar, u8 pipe_id,
                      struct ath10k_hif_sg_item *items, int n_items);
 
+        /* read firmware memory through the diagnose interface */
+        int (*diag_read)(struct ath10k *ar, u32 address, void *buf,
+                         size_t buf_len);
+
         /*
          * API to handle HIF-specific BMI message exchanges, this API is
          * synchronous and only allowed to be called from a context that
@@ -98,6 +102,12 @@ static inline int ath10k_hif_tx_sg(struct ath10k *ar, u8 pipe_id,
         return ar->hif.ops->tx_sg(ar, pipe_id, items, n_items);
 }
 
+static inline int ath10k_hif_diag_read(struct ath10k *ar, u32 address, void *buf,
+                                       size_t buf_len)
+{
+        return ar->hif.ops->diag_read(ar, address, buf, buf_len);
+}
+
 static inline int ath10k_hif_exchange_bmi_msg(struct ath10k *ar,
                                               void *request, u32 request_len,
                                               void *response, u32 *response_len)
diff --git a/drivers/net/wireless/ath/ath10k/htt.h b/drivers/net/wireless/ath/ath10k/htt.h
index 3b44217a6c19..15c58e884b6a 100644
--- a/drivers/net/wireless/ath/ath10k/htt.h
+++ b/drivers/net/wireless/ath/ath10k/htt.h
@@ -725,7 +725,7 @@ static inline u8 *htt_rx_test_get_chars(struct htt_rx_test *rx_test)
  */
 struct htt_pktlog_msg {
         u8 pad[3];
-        __le32 payload[1 /* or more */];
+        u8 payload[0];
 } __packed;
 
 struct htt_dbg_stats_rx_reorder_stats {
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index 60d40a04508b..52c630672718 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -291,6 +291,13 @@ static inline struct sk_buff *ath10k_htt_rx_netbuf_pop(struct ath10k_htt *htt)
         htt->rx_ring.sw_rd_idx.msdu_payld = idx;
         htt->rx_ring.fill_cnt--;
 
+        dma_unmap_single(htt->ar->dev,
+                         ATH10K_SKB_CB(msdu)->paddr,
+                         msdu->len + skb_tailroom(msdu),
+                         DMA_FROM_DEVICE);
+        ath10k_dbg_dump(ar, ATH10K_DBG_HTT_DUMP, NULL, "htt rx netbuf pop: ",
+                        msdu->data, msdu->len + skb_tailroom(msdu));
+
         return msdu;
 }
 
@@ -328,14 +335,6 @@ static int ath10k_htt_rx_amsdu_pop(struct ath10k_htt *htt,
         while (msdu) {
                 int last_msdu, msdu_len_invalid, msdu_chained;
 
-                dma_unmap_single(htt->ar->dev,
-                                 ATH10K_SKB_CB(msdu)->paddr,
-                                 msdu->len + skb_tailroom(msdu),
-                                 DMA_FROM_DEVICE);
-
-                ath10k_dbg_dump(ar, ATH10K_DBG_HTT_DUMP, NULL, "htt rx pop: ",
-                                msdu->data, msdu->len + skb_tailroom(msdu));
-
                 rx_desc = (struct htt_rx_desc *)msdu->data;
 
                 /* FIXME: we must report msdu payload since this is what caller
@@ -426,14 +425,14 @@ static int ath10k_htt_rx_amsdu_pop(struct ath10k_htt *htt,
                 while (msdu_chained--) {
                         struct sk_buff *next = ath10k_htt_rx_netbuf_pop(htt);
 
-                        dma_unmap_single(htt->ar->dev,
-                                         ATH10K_SKB_CB(next)->paddr,
-                                         next->len + skb_tailroom(next),
-                                         DMA_FROM_DEVICE);
-
-                        ath10k_dbg_dump(ar, ATH10K_DBG_HTT_DUMP, NULL,
-                                        "htt rx chained: ", next->data,
-                                        next->len + skb_tailroom(next));
+                        if (!next) {
+                                ath10k_warn(ar, "failed to pop chained msdu\n");
+                                ath10k_htt_rx_free_msdu_chain(*head_msdu);
+                                *head_msdu = NULL;
+                                msdu = NULL;
+                                htt->rx_confused = true;
+                                break;
+                        }
 
                         skb_trim(next, 0);
                         skb_put(next, min(msdu_len, HTT_RX_BUF_SIZE));
@@ -447,6 +446,8 @@ static int ath10k_htt_rx_amsdu_pop(struct ath10k_htt *htt,
                 last_msdu = __le32_to_cpu(rx_desc->msdu_end.info0) &
                                 RX_MSDU_END_INFO0_LAST_MSDU;
 
+                trace_ath10k_htt_rx_desc(ar, &rx_desc->attention,
+                                         sizeof(*rx_desc) - sizeof(u32));
                 if (last_msdu) {
                         msdu->next = NULL;
                         break;
@@ -492,6 +493,8 @@ int ath10k_htt_rx_alloc(struct ath10k_htt *htt)
         size_t size;
         struct timer_list *timer = &htt->rx_ring.refill_retry_timer;
 
+        htt->rx_confused = false;
+
         htt->rx_ring.size = ath10k_htt_rx_ring_size(htt);
         if (!is_power_of_2(htt->rx_ring.size)) {
                 ath10k_warn(ar, "htt rx ring size is not power of 2\n");
@@ -581,41 +584,47 @@ static int ath10k_htt_rx_crypto_param_len(struct ath10k *ar,
                                           enum htt_rx_mpdu_encrypt_type type)
 {
         switch (type) {
+        case HTT_RX_MPDU_ENCRYPT_NONE:
+                return 0;
         case HTT_RX_MPDU_ENCRYPT_WEP40:
         case HTT_RX_MPDU_ENCRYPT_WEP104:
-                return 4;
+                return IEEE80211_WEP_IV_LEN;
         case HTT_RX_MPDU_ENCRYPT_TKIP_WITHOUT_MIC:
-        case HTT_RX_MPDU_ENCRYPT_WEP128: /* not tested */
         case HTT_RX_MPDU_ENCRYPT_TKIP_WPA:
-        case HTT_RX_MPDU_ENCRYPT_WAPI: /* not tested */
+                return IEEE80211_TKIP_IV_LEN;
         case HTT_RX_MPDU_ENCRYPT_AES_CCM_WPA2:
-                return 8;
-        case HTT_RX_MPDU_ENCRYPT_NONE:
-                return 0;
+                return IEEE80211_CCMP_HDR_LEN;
+        case HTT_RX_MPDU_ENCRYPT_WEP128:
+        case HTT_RX_MPDU_ENCRYPT_WAPI:
+                break;
         }
 
-        ath10k_warn(ar, "unknown encryption type %d\n", type);
+        ath10k_warn(ar, "unsupported encryption type %d\n", type);
         return 0;
 }
 
+#define MICHAEL_MIC_LEN 8
+
 static int ath10k_htt_rx_crypto_tail_len(struct ath10k *ar,
                                          enum htt_rx_mpdu_encrypt_type type)
 {
         switch (type) {
         case HTT_RX_MPDU_ENCRYPT_NONE:
+                return 0;
         case HTT_RX_MPDU_ENCRYPT_WEP40:
         case HTT_RX_MPDU_ENCRYPT_WEP104:
-        case HTT_RX_MPDU_ENCRYPT_WEP128:
-        case HTT_RX_MPDU_ENCRYPT_WAPI:
-                return 0;
+                return IEEE80211_WEP_ICV_LEN;
         case HTT_RX_MPDU_ENCRYPT_TKIP_WITHOUT_MIC:
         case HTT_RX_MPDU_ENCRYPT_TKIP_WPA:
-                return 4;
+                return IEEE80211_TKIP_ICV_LEN;
         case HTT_RX_MPDU_ENCRYPT_AES_CCM_WPA2:
-                return 8;
+                return IEEE80211_CCMP_MIC_LEN;
+        case HTT_RX_MPDU_ENCRYPT_WEP128:
+        case HTT_RX_MPDU_ENCRYPT_WAPI:
+                break;
         }
 
-        ath10k_warn(ar, "unknown encryption type %d\n", type);
+        ath10k_warn(ar, "unsupported encryption type %d\n", type);
         return 0;
 }
 
@@ -892,6 +901,8 @@ static void ath10k_process_rx(struct ath10k *ar,
                    !!(status->flag & RX_FLAG_AMSDU_MORE));
         ath10k_dbg_dump(ar, ATH10K_DBG_HTT_DUMP, NULL, "rx skb: ",
                         skb->data, skb->len);
+        trace_ath10k_rx_hdr(ar, skb->data, skb->len);
+        trace_ath10k_rx_payload(ar, skb->data, skb->len);
 
         ieee80211_rx(ar->hw, skb);
 }
@@ -1169,7 +1180,6 @@ static int ath10k_unchain_msdu(struct sk_buff *msdu_head)
 
 static bool ath10k_htt_rx_amsdu_allowed(struct ath10k_htt *htt,
                                         struct sk_buff *head,
-                                        enum htt_rx_mpdu_status status,
                                         bool channel_set,
                                         u32 attention)
 {
@@ -1193,22 +1203,11 @@ static bool ath10k_htt_rx_amsdu_allowed(struct ath10k_htt *htt,
         }
 
         /* Skip mgmt frames while we handle this in WMI */
-        if (status == HTT_RX_IND_MPDU_STATUS_MGMT_CTRL ||
-            attention & RX_ATTENTION_FLAGS_MGMT_TYPE) {
+        if (attention & RX_ATTENTION_FLAGS_MGMT_TYPE) {
                 ath10k_dbg(ar, ATH10K_DBG_HTT, "htt rx mgmt ctrl\n");
                 return false;
         }
 
-        if (status != HTT_RX_IND_MPDU_STATUS_OK &&
-            status != HTT_RX_IND_MPDU_STATUS_TKIP_MIC_ERR &&
-            status != HTT_RX_IND_MPDU_STATUS_ERR_INV_PEER &&
-            !htt->ar->monitor_started) {
-                ath10k_dbg(ar, ATH10K_DBG_HTT,
-                           "htt rx ignoring frame w/ status %d\n",
-                           status);
-                return false;
-        }
-
         if (test_bit(ATH10K_CAC_RUNNING, &htt->ar->dev_flags)) {
                 ath10k_dbg(ar, ATH10K_DBG_HTT,
                            "htt rx CAC running\n");
@@ -1224,8 +1223,6 @@ static void ath10k_htt_rx_handler(struct ath10k_htt *htt,
         struct ath10k *ar = htt->ar;
         struct ieee80211_rx_status *rx_status = &htt->rx_status;
         struct htt_rx_indication_mpdu_range *mpdu_ranges;
-        struct htt_rx_desc *rxd;
-        enum htt_rx_mpdu_status status;
         struct ieee80211_hdr *hdr;
         int num_mpdu_ranges;
         u32 attention;
@@ -1273,8 +1270,6 @@ static void ath10k_htt_rx_handler(struct ath10k_htt *htt,
                                 num_mpdu_ranges));
 
         for (i = 0; i < num_mpdu_ranges; i++) {
-                status = mpdu_ranges[i].mpdu_range_status;
-
                 for (j = 0; j < mpdu_ranges[i].mpdu_count; j++) {
                         struct sk_buff *msdu_head, *msdu_tail;
 
@@ -1295,12 +1290,7 @@ static void ath10k_htt_rx_handler(struct ath10k_htt *htt,
                                 continue;
                         }
 
-                        rxd = container_of((void *)msdu_head->data,
-                                           struct htt_rx_desc,
-                                           msdu_payload);
-
                         if (!ath10k_htt_rx_amsdu_allowed(htt, msdu_head,
-                                                         status,
                                                          channel_set,
                                                          attention)) {
                                 ath10k_htt_rx_free_msdu_chain(msdu_head);
@@ -1365,6 +1355,8 @@ static void ath10k_htt_rx_frag_handler(struct ath10k_htt *htt,
                                       &attention);
         spin_unlock_bh(&htt->rx_ring.lock);
 
+        tasklet_schedule(&htt->rx_replenish_task);
+
         ath10k_dbg(ar, ATH10K_DBG_HTT_DUMP, "htt rx frag ahead\n");
 
         if (ret) {
@@ -1426,7 +1418,7 @@ static void ath10k_htt_rx_frag_handler(struct ath10k_htt *htt,
         /* last fragment of TKIP frags has MIC */
         if (!ieee80211_has_morefrags(hdr->frame_control) &&
             enctype == HTT_RX_MPDU_ENCRYPT_TKIP_WPA)
-                trim += 8;
+                trim += MICHAEL_MIC_LEN;
 
         if (trim > msdu_head->len) {
                 ath10k_warn(ar, "htt rx fragment: trailer longer than the frame itself? drop\n");
@@ -1674,6 +1666,15 @@ void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb)
         case HTT_T2H_MSG_TYPE_RX_DELBA:
                 ath10k_htt_rx_delba(ar, resp);
                 break;
+        case HTT_T2H_MSG_TYPE_PKTLOG: {
+                struct ath10k_pktlog_hdr *hdr =
+                        (struct ath10k_pktlog_hdr *)resp->pktlog_msg.payload;
+
+                trace_ath10k_htt_pktlog(ar, resp->pktlog_msg.payload,
+                                        sizeof(*hdr) +
+                                        __le16_to_cpu(hdr->size));
+                break;
+        }
         case HTT_T2H_MSG_TYPE_RX_FLUSH: {
                 /* Ignore this event because mac80211 takes care of Rx
                  * aggregation reordering.
@@ -1681,8 +1682,8 @@ void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb)
                 break;
         }
         default:
-                ath10k_dbg(ar, ATH10K_DBG_HTT, "htt event (%d) not handled\n",
-                           resp->hdr.msg_type);
+                ath10k_warn(ar, "htt event (%d) not handled\n",
+                            resp->hdr.msg_type);
                 ath10k_dbg_dump(ar, ATH10K_DBG_HTT_DUMP, NULL, "htt event: ",
                                 skb->data, skb->len);
                 break;
diff --git a/drivers/net/wireless/ath/ath10k/htt_tx.c b/drivers/net/wireless/ath/ath10k/htt_tx.c
index bd87a35201d8..5b7e42f7377c 100644
--- a/drivers/net/wireless/ath/ath10k/htt_tx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_tx.c
@@ -92,7 +92,6 @@ int ath10k_htt_tx_alloc(struct ath10k_htt *htt)
         struct ath10k *ar = htt->ar;
 
         spin_lock_init(&htt->tx_lock);
-        init_waitqueue_head(&htt->empty_tx_wq);
 
         if (test_bit(ATH10K_FW_FEATURE_WMI_10X, htt->ar->fw_features))
                 htt->max_num_pending_tx = TARGET_10X_NUM_MSDU_DESC;
@@ -557,12 +556,15 @@ int ath10k_htt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
         skb_cb->htt.txbuf->cmd_tx.frags_paddr = __cpu_to_le32(frags_paddr);
         skb_cb->htt.txbuf->cmd_tx.peerid = __cpu_to_le32(HTT_INVALID_PEERID);
 
+        trace_ath10k_htt_tx(ar, msdu_id, msdu->len, vdev_id, tid);
         ath10k_dbg(ar, ATH10K_DBG_HTT,
                    "htt tx flags0 %hhu flags1 %hu len %d id %hu frags_paddr %08x, msdu_paddr %08x vdev %hhu tid %hhu\n",
                    flags0, flags1, msdu->len, msdu_id, frags_paddr,
                    (u32)skb_cb->paddr, vdev_id, tid);
         ath10k_dbg_dump(ar, ATH10K_DBG_HTT_DUMP, NULL, "htt tx msdu: ",
                         msdu->data, msdu->len);
+        trace_ath10k_tx_hdr(ar, msdu->data, msdu->len);
+        trace_ath10k_tx_payload(ar, msdu->data, msdu->len);
 
         sg_items[0].transfer_id = 0;
         sg_items[0].transfer_context = NULL;
diff --git a/drivers/net/wireless/ath/ath10k/hw.h b/drivers/net/wireless/ath/ath10k/hw.h
index 3cf5702c1e7e..392c2501d0a1 100644
--- a/drivers/net/wireless/ath/ath10k/hw.h
+++ b/drivers/net/wireless/ath/ath10k/hw.h
@@ -20,15 +20,16 @@
 
 #include "targaddrs.h"
 
+#define ATH10K_FW_DIR                   "ath10k"
+
 /* QCA988X 1.0 definitions (unsupported) */
 #define QCA988X_HW_1_0_CHIP_ID_REV      0x0
 
 /* QCA988X 2.0 definitions */
 #define QCA988X_HW_2_0_VERSION          0x4100016c
 #define QCA988X_HW_2_0_CHIP_ID_REV      0x2
-#define QCA988X_HW_2_0_FW_DIR           "ath10k/QCA988X/hw2.0"
+#define QCA988X_HW_2_0_FW_DIR           ATH10K_FW_DIR "/QCA988X/hw2.0"
 #define QCA988X_HW_2_0_FW_FILE          "firmware.bin"
-#define QCA988X_HW_2_0_FW_3_FILE        "firmware-3.bin"
 #define QCA988X_HW_2_0_OTP_FILE         "otp.bin"
 #define QCA988X_HW_2_0_BOARD_DATA_FILE  "board.bin"
 #define QCA988X_HW_2_0_PATCH_LOAD_ADDR  0x1234
@@ -43,6 +44,8 @@
 
 #define REG_DUMP_COUNT_QCA988X 60
 
+#define QCA988X_CAL_DATA_LEN            2116
+
 struct ath10k_fw_ie {
         __le32 id;
         __le32 len;
@@ -78,6 +81,15 @@ enum ath10k_mcast2ucast_mode {
         ATH10K_MCAST2UCAST_ENABLED = 1,
 };
 
+struct ath10k_pktlog_hdr {
+        __le16 flags;
+        __le16 missed_cnt;
+        __le16 log_type;
+        __le16 size;
+        __le32 timestamp;
+        u8 payload[0];
+} __packed;
+
 /* Target specific defines for MAIN firmware */
 #define TARGET_NUM_VDEVS                        8
 #define TARGET_NUM_PEER_AST                     2
@@ -279,6 +291,7 @@ enum ath10k_mcast2ucast_mode {
 #define SI_RX_DATA1_OFFSET                      0x00000014
 
 #define CORE_CTRL_CPU_INTR_MASK                 0x00002000
+#define CORE_CTRL_PCIE_REG_31_MASK              0x00000800
 #define CORE_CTRL_ADDRESS                       0x0000
 #define PCIE_INTR_ENABLE_ADDRESS                0x0008
 #define PCIE_INTR_CAUSE_ADDRESS                 0x000c
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 46709301a51e..1245ac8c5c6f 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -479,12 +479,49 @@ static void ath10k_peer_cleanup_all(struct ath10k *ar)
 /* Interface management */
 /************************/
 
+void ath10k_mac_vif_beacon_free(struct ath10k_vif *arvif)
+{
+        struct ath10k *ar = arvif->ar;
+
+        lockdep_assert_held(&ar->data_lock);
+
+        if (!arvif->beacon)
+                return;
+
+        if (!arvif->beacon_buf)
+                dma_unmap_single(ar->dev, ATH10K_SKB_CB(arvif->beacon)->paddr,
+                                 arvif->beacon->len, DMA_TO_DEVICE);
+
+        dev_kfree_skb_any(arvif->beacon);
+
+        arvif->beacon = NULL;
+        arvif->beacon_sent = false;
+}
+
+static void ath10k_mac_vif_beacon_cleanup(struct ath10k_vif *arvif)
+{
+        struct ath10k *ar = arvif->ar;
+
+        lockdep_assert_held(&ar->data_lock);
+
+        ath10k_mac_vif_beacon_free(arvif);
+
+        if (arvif->beacon_buf) {
+                dma_free_coherent(ar->dev, IEEE80211_MAX_FRAME_LEN,
+                                  arvif->beacon_buf, arvif->beacon_paddr);
+                arvif->beacon_buf = NULL;
+        }
+}
+
 static inline int ath10k_vdev_setup_sync(struct ath10k *ar)
 {
         int ret;
 
         lockdep_assert_held(&ar->conf_mutex);
 
+        if (test_bit(ATH10K_FLAG_CRASH_FLUSH, &ar->dev_flags))
+                return -ESHUTDOWN;
+
         ret = wait_for_completion_timeout(&ar->vdev_setup_done,
                                           ATH10K_VDEV_SETUP_TIMEOUT_HZ);
         if (ret == 0)
@@ -517,6 +554,8 @@ static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id)
         arg.channel.max_reg_power = channel->max_reg_power * 2;
         arg.channel.max_antenna_gain = channel->max_antenna_gain * 2;
 
+        reinit_completion(&ar->vdev_setup_done);
+
         ret = ath10k_wmi_vdev_start(ar, &arg);
         if (ret) {
                 ath10k_warn(ar, "failed to request monitor vdev %i start: %d\n",
@@ -564,6 +603,8 @@ static int ath10k_monitor_vdev_stop(struct ath10k *ar)
                 ath10k_warn(ar, "failed to put down monitor vdev %i: %d\n",
                             ar->monitor_vdev_id, ret);
 
+        reinit_completion(&ar->vdev_setup_done);
+
         ret = ath10k_wmi_vdev_stop(ar, ar->monitor_vdev_id);
         if (ret)
                 ath10k_warn(ar, "failed to to request monitor vdev %i stop: %d\n",
@@ -590,9 +631,9 @@ static int ath10k_monitor_vdev_create(struct ath10k *ar)
                 return -ENOMEM;
         }
 
-        bit = ffs(ar->free_vdev_map);
+        bit = __ffs64(ar->free_vdev_map);
 
-        ar->monitor_vdev_id = bit - 1;
+        ar->monitor_vdev_id = bit;
 
         ret = ath10k_wmi_vdev_create(ar, ar->monitor_vdev_id,
                                      WMI_VDEV_TYPE_MONITOR,
@@ -603,7 +644,7 @@ static int ath10k_monitor_vdev_create(struct ath10k *ar)
                 return ret;
         }
 
-        ar->free_vdev_map &= ~(1 << ar->monitor_vdev_id);
+        ar->free_vdev_map &= ~(1LL << ar->monitor_vdev_id);
         ath10k_dbg(ar, ATH10K_DBG_MAC, "mac monitor vdev %d created\n",
                    ar->monitor_vdev_id);
 
@@ -623,7 +664,7 @@ static int ath10k_monitor_vdev_delete(struct ath10k *ar)
                 return ret;
         }
 
-        ar->free_vdev_map |= 1 << ar->monitor_vdev_id;
+        ar->free_vdev_map |= 1LL << ar->monitor_vdev_id;
 
         ath10k_dbg(ar, ATH10K_DBG_MAC, "mac monitor vdev %d deleted\n",
                    ar->monitor_vdev_id);
@@ -909,15 +950,7 @@ static void ath10k_control_beaconing(struct ath10k_vif *arvif,
                 arvif->is_up = false;
 
                 spin_lock_bh(&arvif->ar->data_lock);
-                if (arvif->beacon) {
-                        dma_unmap_single(arvif->ar->dev,
-                                         ATH10K_SKB_CB(arvif->beacon)->paddr,
-                                         arvif->beacon->len, DMA_TO_DEVICE);
-                        dev_kfree_skb_any(arvif->beacon);
-
-                        arvif->beacon = NULL;
-                        arvif->beacon_sent = false;
-                }
+                ath10k_mac_vif_beacon_free(arvif);
                 spin_unlock_bh(&arvif->ar->data_lock);
 
                 return;
@@ -966,14 +999,6 @@ static void ath10k_control_ibss(struct ath10k_vif *arvif,
                 if (is_zero_ether_addr(arvif->bssid))
                         return;
 
-                ret = ath10k_peer_delete(arvif->ar, arvif->vdev_id,
-                                         arvif->bssid);
-                if (ret) {
-                        ath10k_warn(ar, "failed to delete IBSS BSSID peer %pM for vdev %d: %d\n",
-                                    arvif->bssid, arvif->vdev_id, ret);
-                        return;
-                }
-
                 memset(arvif->bssid, 0, ETH_ALEN);
 
                 return;
@@ -1042,51 +1067,45 @@ static int ath10k_mac_vif_setup_ps(struct ath10k_vif *arvif)
 /* Station management */
 /**********************/
 
+static u32 ath10k_peer_assoc_h_listen_intval(struct ath10k *ar,
+                                             struct ieee80211_vif *vif)
+{
+        /* Some firmware revisions have unstable STA powersave when listen
+         * interval is set too high (e.g. 5). The symptoms are firmware doesn't
+         * generate NullFunc frames properly even if buffered frames have been
+         * indicated in Beacon TIM. Firmware would seldom wake up to pull
+         * buffered frames. Often pinging the device from AP would simply fail.
+         *
+         * As a workaround set it to 1.
+         */
+        if (vif->type == NL80211_IFTYPE_STATION)
+                return 1;
+
+        return ar->hw->conf.listen_interval;
+}
+
 static void ath10k_peer_assoc_h_basic(struct ath10k *ar,
-                                      struct ath10k_vif *arvif,
+                                      struct ieee80211_vif *vif,
                                       struct ieee80211_sta *sta,
-                                      struct ieee80211_bss_conf *bss_conf,
                                       struct wmi_peer_assoc_complete_arg *arg)
 {
+        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
+
         lockdep_assert_held(&ar->conf_mutex);
 
         ether_addr_copy(arg->addr, sta->addr);
         arg->vdev_id = arvif->vdev_id;
         arg->peer_aid = sta->aid;
         arg->peer_flags |= WMI_PEER_AUTH;
-
-        if (arvif->vdev_type == WMI_VDEV_TYPE_STA)
-                /*
-                 * Seems FW have problems with Power Save in STA
-                 * mode when we setup this parameter to high (eg. 5).
-                 * Often we see that FW don't send NULL (with clean P flags)
-                 * frame even there is info about buffered frames in beacons.
-                 * Sometimes we have to wait more than 10 seconds before FW
-                 * will wakeup. Often sending one ping from AP to our device
-                 * just fail (more than 50%).
-                 *
-                 * Seems setting this FW parameter to 1 couse FW
-                 * will check every beacon and will wakup immediately
-                 * after detection buffered data.
-                 */
-                arg->peer_listen_intval = 1;
-        else
-                arg->peer_listen_intval = ar->hw->conf.listen_interval;
-
+        arg->peer_listen_intval = ath10k_peer_assoc_h_listen_intval(ar, vif);
         arg->peer_num_spatial_streams = 1;
-
-        /*
-         * The assoc capabilities are available only in managed mode.
-         */
-        if (arvif->vdev_type == WMI_VDEV_TYPE_STA && bss_conf)
-                arg->peer_caps = bss_conf->assoc_capability;
+        arg->peer_caps = vif->bss_conf.assoc_capability;
 }
 
 static void ath10k_peer_assoc_h_crypto(struct ath10k *ar,
-                                       struct ath10k_vif *arvif,
+                                       struct ieee80211_vif *vif,
                                        struct wmi_peer_assoc_complete_arg *arg)
 {
-        struct ieee80211_vif *vif = arvif->vif;
         struct ieee80211_bss_conf *info = &vif->bss_conf;
         struct cfg80211_bss *bss;
         const u8 *rsnie = NULL;
@@ -1343,11 +1362,12 @@ static void ath10k_peer_assoc_h_vht(struct ath10k *ar,
 }
 
 static void ath10k_peer_assoc_h_qos(struct ath10k *ar,
-                                    struct ath10k_vif *arvif,
+                                    struct ieee80211_vif *vif,
                                     struct ieee80211_sta *sta,
-                                    struct ieee80211_bss_conf *bss_conf,
                                     struct wmi_peer_assoc_complete_arg *arg)
 {
+        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
+
         switch (arvif->vdev_type) {
         case WMI_VDEV_TYPE_AP:
                 if (sta->wme)
@@ -1359,7 +1379,7 @@ static void ath10k_peer_assoc_h_qos(struct ath10k *ar,
                 }
                 break;
         case WMI_VDEV_TYPE_STA:
-                if (bss_conf->qos)
+                if (vif->bss_conf.qos)
                         arg->peer_flags |= WMI_PEER_QOS;
                 break;
         default:
@@ -1368,7 +1388,7 @@ static void ath10k_peer_assoc_h_qos(struct ath10k *ar,
 }
 
 static void ath10k_peer_assoc_h_phymode(struct ath10k *ar,
-                                        struct ath10k_vif *arvif,
+                                        struct ieee80211_vif *vif,
                                         struct ieee80211_sta *sta,
                                         struct wmi_peer_assoc_complete_arg *arg)
 {
@@ -1419,22 +1439,21 @@ static void ath10k_peer_assoc_h_phymode(struct ath10k *ar,
 }
 
 static int ath10k_peer_assoc_prepare(struct ath10k *ar,
-                                     struct ath10k_vif *arvif,
+                                     struct ieee80211_vif *vif,
                                      struct ieee80211_sta *sta,
-                                     struct ieee80211_bss_conf *bss_conf,
                                      struct wmi_peer_assoc_complete_arg *arg)
 {
         lockdep_assert_held(&ar->conf_mutex);
 
         memset(arg, 0, sizeof(*arg));
 
-        ath10k_peer_assoc_h_basic(ar, arvif, sta, bss_conf, arg);
-        ath10k_peer_assoc_h_crypto(ar, arvif, arg);
+        ath10k_peer_assoc_h_basic(ar, vif, sta, arg);
+        ath10k_peer_assoc_h_crypto(ar, vif, arg);
         ath10k_peer_assoc_h_rates(ar, sta, arg);
         ath10k_peer_assoc_h_ht(ar, sta, arg);
         ath10k_peer_assoc_h_vht(ar, sta, arg);
-        ath10k_peer_assoc_h_qos(ar, arvif, sta, bss_conf, arg);
-        ath10k_peer_assoc_h_phymode(ar, arvif, sta, arg);
+        ath10k_peer_assoc_h_qos(ar, vif, sta, arg);
+        ath10k_peer_assoc_h_phymode(ar, vif, sta, arg);
 
         return 0;
 }
@@ -1480,6 +1499,9 @@ static void ath10k_bss_assoc(struct ieee80211_hw *hw,
 
         lockdep_assert_held(&ar->conf_mutex);
 
+        ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %i assoc bssid %pM aid %d\n",
+                   arvif->vdev_id, arvif->bssid, arvif->aid);
+
         rcu_read_lock();
 
         ap_sta = ieee80211_find_sta(vif, bss_conf->bssid);
@@ -1494,8 +1516,7 @@ static void ath10k_bss_assoc(struct ieee80211_hw *hw,
          * before calling ath10k_setup_peer_smps() which might sleep. */
         ht_cap = ap_sta->ht_cap;
 
-        ret = ath10k_peer_assoc_prepare(ar, arvif, ap_sta,
-                                        bss_conf, &peer_arg);
+        ret = ath10k_peer_assoc_prepare(ar, vif, ap_sta, &peer_arg);
         if (ret) {
                 ath10k_warn(ar, "failed to prepare peer assoc for %pM vdev %i: %d\n",
                             bss_conf->bssid, arvif->vdev_id, ret);
@@ -1523,6 +1544,8 @@ static void ath10k_bss_assoc(struct ieee80211_hw *hw,
                    "mac vdev %d up (associated) bssid %pM aid %d\n",
                    arvif->vdev_id, bss_conf->bssid, bss_conf->aid);
 
+        WARN_ON(arvif->is_up);
+
         arvif->aid = bss_conf->aid;
         ether_addr_copy(arvif->bssid, bss_conf->bssid);
 
@@ -1536,9 +1559,6 @@ static void ath10k_bss_assoc(struct ieee80211_hw *hw,
         arvif->is_up = true;
 }
 
-/*
- * FIXME: flush TIDs
- */
 static void ath10k_bss_disassoc(struct ieee80211_hw *hw,
                                 struct ieee80211_vif *vif)
 {
@@ -1548,45 +1568,30 @@ static void ath10k_bss_disassoc(struct ieee80211_hw *hw,
 
         lockdep_assert_held(&ar->conf_mutex);
 
-        /*
-         * For some reason, calling VDEV-DOWN before VDEV-STOP
-         * makes the FW to send frames via HTT after disassociation.
-         * No idea why this happens, even though VDEV-DOWN is supposed
-         * to be analogous to link down, so just stop the VDEV.
-         */
-        ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d stop (disassociated\n",
-                   arvif->vdev_id);
-
-        /* FIXME: check return value */
-        ret = ath10k_vdev_stop(arvif);
+        ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %i disassoc bssid %pM\n",
+                   arvif->vdev_id, arvif->bssid);
 
-        /*
-         * If we don't call VDEV-DOWN after VDEV-STOP FW will remain active and
-         * report beacons from previously associated network through HTT.
-         * This in turn would spam mac80211 WARN_ON if we bring down all
-         * interfaces as it expects there is no rx when no interface is
-         * running.
-         */
-        ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d down\n", arvif->vdev_id);
-
-        /* FIXME: why don't we print error if wmi call fails? */
         ret = ath10k_wmi_vdev_down(ar, arvif->vdev_id);
+        if (ret)
+                ath10k_warn(ar, "faield to down vdev %i: %d\n",
+                            arvif->vdev_id, ret);
 
         arvif->def_wep_key_idx = 0;
-
-        arvif->is_started = false;
         arvif->is_up = false;
 }
 
-static int ath10k_station_assoc(struct ath10k *ar, struct ath10k_vif *arvif,
-                                struct ieee80211_sta *sta, bool reassoc)
+static int ath10k_station_assoc(struct ath10k *ar,
+                                struct ieee80211_vif *vif,
+                                struct ieee80211_sta *sta,
+                                bool reassoc)
 {
+        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
         struct wmi_peer_assoc_complete_arg peer_arg;
         int ret = 0;
 
         lockdep_assert_held(&ar->conf_mutex);
 
-        ret = ath10k_peer_assoc_prepare(ar, arvif, sta, NULL, &peer_arg);
+        ret = ath10k_peer_assoc_prepare(ar, vif, sta, &peer_arg);
         if (ret) {
                 ath10k_warn(ar, "failed to prepare WMI peer assoc for %pM vdev %i: %i\n",
                             sta->addr, arvif->vdev_id, ret);
@@ -1601,43 +1606,51 @@ static int ath10k_station_assoc(struct ath10k *ar, struct ath10k_vif *arvif,
                 return ret;
         }
 
-        ret = ath10k_setup_peer_smps(ar, arvif, sta->addr, &sta->ht_cap);
-        if (ret) {
-                ath10k_warn(ar, "failed to setup peer SMPS for vdev %d: %d\n",
-                            arvif->vdev_id, ret);
-                return ret;
-        }
-
-        if (!sta->wme && !reassoc) {
-                arvif->num_legacy_stations++;
-                ret  = ath10k_recalc_rtscts_prot(arvif);
+        /* Re-assoc is run only to update supported rates for given station. It
+         * doesn't make much sense to reconfigure the peer completely.
+         */
+        if (!reassoc) {
+                ret = ath10k_setup_peer_smps(ar, arvif, sta->addr,
+                                             &sta->ht_cap);
                 if (ret) {
-                        ath10k_warn(ar, "failed to recalculate rts/cts prot for vdev %d: %d\n",
+                        ath10k_warn(ar, "failed to setup peer SMPS for vdev %d: %d\n",
                                     arvif->vdev_id, ret);
                         return ret;
                 }
-        }
 
-        ret = ath10k_install_peer_wep_keys(arvif, sta->addr);
-        if (ret) {
-                ath10k_warn(ar, "failed to install peer wep keys for vdev %i: %d\n",
-                            arvif->vdev_id, ret);
-                return ret;
-        }
+                ret = ath10k_peer_assoc_qos_ap(ar, arvif, sta);
+                if (ret) {
+                        ath10k_warn(ar, "failed to set qos params for STA %pM for vdev %i: %d\n",
+                                    sta->addr, arvif->vdev_id, ret);
+                        return ret;
+                }
 
-        ret = ath10k_peer_assoc_qos_ap(ar, arvif, sta);
-        if (ret) {
-                ath10k_warn(ar, "failed to set qos params for STA %pM for vdev %i: %d\n",
-                            sta->addr, arvif->vdev_id, ret);
-                return ret;
+                if (!sta->wme) {
+                        arvif->num_legacy_stations++;
+                        ret  = ath10k_recalc_rtscts_prot(arvif);
+                        if (ret) {
+                                ath10k_warn(ar, "failed to recalculate rts/cts prot for vdev %d: %d\n",
+                                            arvif->vdev_id, ret);
+                                return ret;
+                        }
+                }
+
+                ret = ath10k_install_peer_wep_keys(arvif, sta->addr);
+                if (ret) {
+                        ath10k_warn(ar, "failed to install peer wep keys for vdev %i: %d\n",
+                                    arvif->vdev_id, ret);
+                        return ret;
+                }
         }
 
         return ret;
 }
 
-static int ath10k_station_disassoc(struct ath10k *ar, struct ath10k_vif *arvif,
+static int ath10k_station_disassoc(struct ath10k *ar,
+                                   struct ieee80211_vif *vif,
                                    struct ieee80211_sta *sta)
 {
+        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
         int ret = 0;
 
         lockdep_assert_held(&ar->conf_mutex);
@@ -1729,6 +1742,7 @@ static int ath10k_update_channel_list(struct ath10k *ar)
                         ch->passive = passive;
 
                         ch->freq = channel->center_freq;
+                        ch->band_center_freq1 = channel->center_freq;
                         ch->min_power = 0;
                         ch->max_power = channel->max_power * 2;
                         ch->max_reg_power = channel->max_reg_power * 2;
@@ -2343,7 +2357,7 @@ static void ath10k_tx(struct ieee80211_hw *hw,
 }
 
 /* Must not be called with conf_mutex held as workers can use that also. */
-static void ath10k_drain_tx(struct ath10k *ar)
+void ath10k_drain_tx(struct ath10k *ar)
 {
         /* make sure rcu-protected mac80211 tx path itself is drained */
         synchronize_net();
@@ -2376,16 +2390,8 @@ void ath10k_halt(struct ath10k *ar)
         ath10k_hif_power_down(ar);
 
         spin_lock_bh(&ar->data_lock);
-        list_for_each_entry(arvif, &ar->arvifs, list) {
-                if (!arvif->beacon)
-                        continue;
-
-                dma_unmap_single(arvif->ar->dev,
-                                 ATH10K_SKB_CB(arvif->beacon)->paddr,
-                                 arvif->beacon->len, DMA_TO_DEVICE);
-                dev_kfree_skb_any(arvif->beacon);
-                arvif->beacon = NULL;
-        }
+        list_for_each_entry(arvif, &ar->arvifs, list)
+                ath10k_mac_vif_beacon_cleanup(arvif);
         spin_unlock_bh(&ar->data_lock);
 }
 
@@ -2677,12 +2683,68 @@ static void ath10k_config_chan(struct ath10k *ar)
         ath10k_monitor_recalc(ar);
 }
 
+static int ath10k_mac_txpower_setup(struct ath10k *ar, int txpower)
+{
+        int ret;
+        u32 param;
+
+        lockdep_assert_held(&ar->conf_mutex);
+
+        ath10k_dbg(ar, ATH10K_DBG_MAC, "mac txpower %d\n", txpower);
+
+        param = ar->wmi.pdev_param->txpower_limit2g;
+        ret = ath10k_wmi_pdev_set_param(ar, param, txpower * 2);
+        if (ret) {
+                ath10k_warn(ar, "failed to set 2g txpower %d: %d\n",
+                            txpower, ret);
+                return ret;
+        }
+
+        param = ar->wmi.pdev_param->txpower_limit5g;
+        ret = ath10k_wmi_pdev_set_param(ar, param, txpower * 2);
+        if (ret) {
+                ath10k_warn(ar, "failed to set 5g txpower %d: %d\n",
+                            txpower, ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+static int ath10k_mac_txpower_recalc(struct ath10k *ar)
+{
+        struct ath10k_vif *arvif;
+        int ret, txpower = -1;
+
+        lockdep_assert_held(&ar->conf_mutex);
+
+        list_for_each_entry(arvif, &ar->arvifs, list) {
+                WARN_ON(arvif->txpower < 0);
+
+                if (txpower == -1)
+                        txpower = arvif->txpower;
+                else
+                        txpower = min(txpower, arvif->txpower);
+        }
+
+        if (WARN_ON(txpower == -1))
+                return -EINVAL;
+
+        ret = ath10k_mac_txpower_setup(ar, txpower);
+        if (ret) {
+                ath10k_warn(ar, "failed to setup tx power %d: %d\n",
+                            txpower, ret);
+                return ret;
+        }
+
+        return 0;
+}
+
 static int ath10k_config(struct ieee80211_hw *hw, u32 changed)
 {
         struct ath10k *ar = hw->priv;
         struct ieee80211_conf *conf = &hw->conf;
         int ret = 0;
-        u32 param;
 
         mutex_lock(&ar->conf_mutex);
 
@@ -2706,25 +2768,6 @@ static int ath10k_config(struct ieee80211_hw *hw, u32 changed)
                 }
         }
 
-        if (changed & IEEE80211_CONF_CHANGE_POWER) {
-                ath10k_dbg(ar, ATH10K_DBG_MAC, "mac config power %d\n",
-                           hw->conf.power_level);
-
-                param = ar->wmi.pdev_param->txpower_limit2g;
-                ret = ath10k_wmi_pdev_set_param(ar, param,
-                                                hw->conf.power_level * 2);
-                if (ret)
-                        ath10k_warn(ar, "failed to set 2g txpower %d: %d\n",
-                                    hw->conf.power_level, ret);
-
-                param = ar->wmi.pdev_param->txpower_limit5g;
-                ret = ath10k_wmi_pdev_set_param(ar, param,
-                                                hw->conf.power_level * 2);
-                if (ret)
-                        ath10k_warn(ar, "failed to set 5g txpower %d: %d\n",
-                                    hw->conf.power_level, ret);
-        }
-
         if (changed & IEEE80211_CONF_CHANGE_PS)
                 ath10k_config_ps(ar);
 
@@ -2772,9 +2815,12 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
                 ret = -EBUSY;
                 goto err;
         }
-        bit = ffs(ar->free_vdev_map);
+        bit = __ffs64(ar->free_vdev_map);
+
+        ath10k_dbg(ar, ATH10K_DBG_MAC, "mac create vdev %i map %llx\n",
+                   bit, ar->free_vdev_map);
 
-        arvif->vdev_id = bit - 1;
+        arvif->vdev_id = bit;
         arvif->vdev_subtype = WMI_VDEV_SUBTYPE_NONE;
 
         if (ar->p2p)
@@ -2804,8 +2850,39 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
                 break;
         }
 
-        ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev create %d (add interface) type %d subtype %d\n",
-                   arvif->vdev_id, arvif->vdev_type, arvif->vdev_subtype);
+        /* Some firmware revisions don't wait for beacon tx completion before
+         * sending another SWBA event. This could lead to hardware using old
+         * (freed) beacon data in some cases, e.g. tx credit starvation
+         * combined with missed TBTT. This is very very rare.
+         *
+         * On non-IOMMU-enabled hosts this could be a possible security issue
+         * because hw could beacon some random data on the air.  On
+         * IOMMU-enabled hosts DMAR faults would occur in most cases and target
+         * device would crash.
+         *
+         * Since there are no beacon tx completions (implicit nor explicit)
+         * propagated to host the only workaround for this is to allocate a
+         * DMA-coherent buffer for a lifetime of a vif and use it for all
+         * beacon tx commands. Worst case for this approach is some beacons may
+         * become corrupted, e.g. have garbled IEs or out-of-date TIM bitmap.
+         */
+        if (vif->type == NL80211_IFTYPE_ADHOC ||
+            vif->type == NL80211_IFTYPE_AP) {
+                arvif->beacon_buf = dma_zalloc_coherent(ar->dev,
+                                                        IEEE80211_MAX_FRAME_LEN,
+                                                        &arvif->beacon_paddr,
+                                                        GFP_ATOMIC);
+                if (!arvif->beacon_buf) {
+                        ret = -ENOMEM;
+                        ath10k_warn(ar, "failed to allocate beacon buffer: %d\n",
+                                    ret);
+                        goto err;
+                }
+        }
+
+        ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev create %d (add interface) type %d subtype %d bcnmode %s\n",
+                   arvif->vdev_id, arvif->vdev_type, arvif->vdev_subtype,
+                   arvif->beacon_buf ? "single-buf" : "per-skb");
 
         ret = ath10k_wmi_vdev_create(ar, arvif->vdev_id, arvif->vdev_type,
                                      arvif->vdev_subtype, vif->addr);
@@ -2815,7 +2892,7 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
                 goto err;
         }
 
-        ar->free_vdev_map &= ~(1 << arvif->vdev_id);
+        ar->free_vdev_map &= ~(1LL << arvif->vdev_id);
         list_add(&arvif->list, &ar->arvifs);
 
         vdev_param = ar->wmi.vdev_param->def_keyid;
@@ -2899,6 +2976,13 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
                 goto err_peer_delete;
         }
 
+        arvif->txpower = vif->bss_conf.txpower;
+        ret = ath10k_mac_txpower_recalc(ar);
+        if (ret) {
+                ath10k_warn(ar, "failed to recalc tx power: %d\n", ret);
+                goto err_peer_delete;
+        }
+
         mutex_unlock(&ar->conf_mutex);
         return 0;
 
@@ -2908,10 +2992,16 @@ err_peer_delete:
 
 err_vdev_delete:
         ath10k_wmi_vdev_delete(ar, arvif->vdev_id);
-        ar->free_vdev_map |= 1 << arvif->vdev_id;
+        ar->free_vdev_map |= 1LL << arvif->vdev_id;
         list_del(&arvif->list);
 
 err:
+        if (arvif->beacon_buf) {
+                dma_free_coherent(ar->dev, IEEE80211_MAX_FRAME_LEN,
+                                  arvif->beacon_buf, arvif->beacon_paddr);
+                arvif->beacon_buf = NULL;
+        }
+
         mutex_unlock(&ar->conf_mutex);
 
         return ret;
@@ -2929,14 +3019,7 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw,
         cancel_work_sync(&arvif->wep_key_work);
 
         spin_lock_bh(&ar->data_lock);
-        if (arvif->beacon) {
-                dma_unmap_single(arvif->ar->dev,
-                                 ATH10K_SKB_CB(arvif->beacon)->paddr,
-                                 arvif->beacon->len, DMA_TO_DEVICE);
-                dev_kfree_skb_any(arvif->beacon);
-                arvif->beacon = NULL;
-        }
-
+        ath10k_mac_vif_beacon_cleanup(arvif);
         spin_unlock_bh(&ar->data_lock);
 
         ret = ath10k_spectral_vif_stop(arvif);
@@ -2944,7 +3027,7 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw,
                 ath10k_warn(ar, "failed to stop spectral for vdev %i: %d\n",
                             arvif->vdev_id, ret);
 
-        ar->free_vdev_map |= 1 << arvif->vdev_id;
+        ar->free_vdev_map |= 1LL << arvif->vdev_id;
         list_del(&arvif->list);
 
         if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
@@ -3068,54 +3151,8 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                 arvif->u.ap.hidden_ssid = info->hidden_ssid;
         }
 
-        /*
-         * Firmware manages AP self-peer internally so make sure to not create
-         * it in driver. Otherwise AP self-peer deletion may timeout later.
-         */
-        if (changed & BSS_CHANGED_BSSID &&
-            vif->type != NL80211_IFTYPE_AP) {
-                if (!is_zero_ether_addr(info->bssid)) {
-                        ath10k_dbg(ar, ATH10K_DBG_MAC,
-                                   "mac vdev %d create peer %pM\n",
-                                   arvif->vdev_id, info->bssid);
-
-                        ret = ath10k_peer_create(ar, arvif->vdev_id,
-                                                 info->bssid);
-                        if (ret)
-                                ath10k_warn(ar, "failed to add peer %pM for vdev %d when changing bssid: %i\n",
-                                            info->bssid, arvif->vdev_id, ret);
-
-                        if (vif->type == NL80211_IFTYPE_STATION) {
-                                /*
-                                 * this is never erased as we it for crypto key
-                                 * clearing; this is FW requirement
-                                 */
-                                ether_addr_copy(arvif->bssid, info->bssid);
-
-                                ath10k_dbg(ar, ATH10K_DBG_MAC,
-                                           "mac vdev %d start %pM\n",
-                                           arvif->vdev_id, info->bssid);
-
-                                ret = ath10k_vdev_start(arvif);
-                                if (ret) {
-                                        ath10k_warn(ar, "failed to start vdev %i: %d\n",
-                                                    arvif->vdev_id, ret);
-                                        goto exit;
-                                }
-
-                                arvif->is_started = true;
-                        }
-
-                        /*
-                         * Mac80211 does not keep IBSS bssid when leaving IBSS,
-                         * so driver need to store it. It is needed when leaving
-                         * IBSS in order to remove BSSID peer.
-                         */
-                        if (vif->type == NL80211_IFTYPE_ADHOC)
-                                memcpy(arvif->bssid, info->bssid,
-                                       ETH_ALEN);
-                }
-        }
+        if (changed & BSS_CHANGED_BSSID && !is_zero_ether_addr(info->bssid))
+                ether_addr_copy(arvif->bssid, info->bssid);
 
         if (changed & BSS_CHANGED_BEACON_ENABLED)
                 ath10k_control_beaconing(arvif, info);
@@ -3177,10 +3214,21 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                                 ath10k_monitor_stop(ar);
                         ath10k_bss_assoc(hw, vif, info);
                         ath10k_monitor_recalc(ar);
+                } else {
+                        ath10k_bss_disassoc(hw, vif);
                 }
         }
 
-exit:
+        if (changed & BSS_CHANGED_TXPOWER) {
+                ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev_id %i txpower %d\n",
+                           arvif->vdev_id, info->txpower);
+
+                arvif->txpower = info->txpower;
+                ret = ath10k_mac_txpower_recalc(ar);
+                if (ret)
+                        ath10k_warn(ar, "failed to recalc tx power: %d\n", ret);
+        }
+
         mutex_unlock(&ar->conf_mutex);
 }
 
@@ -3266,9 +3314,10 @@ static void ath10k_cancel_hw_scan(struct ieee80211_hw *hw,
         struct ath10k *ar = hw->priv;
 
         mutex_lock(&ar->conf_mutex);
-        cancel_delayed_work_sync(&ar->scan.timeout);
         ath10k_scan_abort(ar);
         mutex_unlock(&ar->conf_mutex);
+
+        cancel_delayed_work_sync(&ar->scan.timeout);
 }
 
 static void ath10k_set_key_h_def_keyidx(struct ath10k *ar,
@@ -3453,7 +3502,7 @@ static void ath10k_sta_rc_update_wk(struct work_struct *wk)
                 ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM supp rates\n",
                            sta->addr);
 
-                err = ath10k_station_assoc(ar, arvif, sta, true);
+                err = ath10k_station_assoc(ar, arvif->vif, sta, true);
                 if (err)
                         ath10k_warn(ar, "failed to reassociate station: %pM\n",
                                     sta->addr);
@@ -3489,8 +3538,7 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
         mutex_lock(&ar->conf_mutex);
 
         if (old_state == IEEE80211_STA_NOTEXIST &&
-            new_state == IEEE80211_STA_NONE &&
-            vif->type != NL80211_IFTYPE_STATION) {
+            new_state == IEEE80211_STA_NONE) {
                 /*
                  * New station addition.
                  */
@@ -3514,6 +3562,21 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                 if (ret)
                         ath10k_warn(ar, "failed to add peer %pM for vdev %d when adding a new sta: %i\n",
                                     sta->addr, arvif->vdev_id, ret);
+
+                if (vif->type == NL80211_IFTYPE_STATION) {
+                        WARN_ON(arvif->is_started);
+
+                        ret = ath10k_vdev_start(arvif);
+                        if (ret) {
+                                ath10k_warn(ar, "failed to start vdev %i: %d\n",
+                                            arvif->vdev_id, ret);
+                                WARN_ON(ath10k_peer_delete(ar, arvif->vdev_id,
+                                                           sta->addr));
+                                goto exit;
+                        }
+
+                        arvif->is_started = true;
+                }
         } else if ((old_state == IEEE80211_STA_NONE &&
                     new_state == IEEE80211_STA_NOTEXIST)) {
                 /*
@@ -3522,13 +3585,23 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                 ath10k_dbg(ar, ATH10K_DBG_MAC,
                            "mac vdev %d peer delete %pM (sta gone)\n",
                            arvif->vdev_id, sta->addr);
+
+                if (vif->type == NL80211_IFTYPE_STATION) {
+                        WARN_ON(!arvif->is_started);
+
+                        ret = ath10k_vdev_stop(arvif);
+                        if (ret)
+                                ath10k_warn(ar, "failed to stop vdev %i: %d\n",
+                                            arvif->vdev_id, ret);
+
+                        arvif->is_started = false;
+                }
+
                 ret = ath10k_peer_delete(ar, arvif->vdev_id, sta->addr);
                 if (ret)
                         ath10k_warn(ar, "failed to delete peer %pM for vdev %d: %i\n",
                                     sta->addr, arvif->vdev_id, ret);
 
-                if (vif->type == NL80211_IFTYPE_STATION)
-                        ath10k_bss_disassoc(hw, vif);
         } else if (old_state == IEEE80211_STA_AUTH &&
                    new_state == IEEE80211_STA_ASSOC &&
                    (vif->type == NL80211_IFTYPE_AP ||
@@ -3539,7 +3612,7 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                 ath10k_dbg(ar, ATH10K_DBG_MAC, "mac sta %pM associated\n",
                            sta->addr);
 
-                ret = ath10k_station_assoc(ar, arvif, sta, false);
+                ret = ath10k_station_assoc(ar, vif, sta, false);
                 if (ret)
                         ath10k_warn(ar, "failed to associate station %pM for vdev %i: %i\n",
                                     sta->addr, arvif->vdev_id, ret);
@@ -3553,7 +3626,7 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                 ath10k_dbg(ar, ATH10K_DBG_MAC, "mac sta %pM disassociated\n",
                            sta->addr);
 
-                ret = ath10k_station_disassoc(ar, arvif, sta);
+                ret = ath10k_station_disassoc(ar, vif, sta);
                 if (ret)
                         ath10k_warn(ar, "failed to disassociate station: %pM vdev %i: %i\n",
                                     sta->addr, arvif->vdev_id, ret);
@@ -3761,10 +3834,11 @@ static int ath10k_cancel_remain_on_channel(struct ieee80211_hw *hw)
         struct ath10k *ar = hw->priv;
 
         mutex_lock(&ar->conf_mutex);
-        cancel_delayed_work_sync(&ar->scan.timeout);
         ath10k_scan_abort(ar);
         mutex_unlock(&ar->conf_mutex);
 
+        cancel_delayed_work_sync(&ar->scan.timeout);
+
         return 0;
 }
 
@@ -3807,7 +3881,7 @@ static int ath10k_set_frag_threshold(struct ieee80211_hw *hw, u32 value)
                 ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d fragmentation threshold %d\n",
                            arvif->vdev_id, value);
 
-                ret = ath10k_mac_set_rts(arvif, value);
+                ret = ath10k_mac_set_frag(arvif, value);
                 if (ret) {
                         ath10k_warn(ar, "failed to set fragmentation threshold for vdev %d: %d\n",
                                     arvif->vdev_id, ret);
@@ -3843,7 +3917,9 @@ static void ath10k_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                         empty = (ar->htt.num_pending_tx == 0);
                         spin_unlock_bh(&ar->htt.tx_lock);
 
-                        skip = (ar->state == ATH10K_STATE_WEDGED);
+                        skip = (ar->state == ATH10K_STATE_WEDGED) ||
+                               test_bit(ATH10K_FLAG_CRASH_FLUSH,
+                                        &ar->dev_flags);
 
                         (empty || skip);
                 }), ATH10K_FLUSH_TIMEOUT_HZ);
@@ -3929,10 +4005,14 @@ exit:
 }
 #endif
 
-static void ath10k_restart_complete(struct ieee80211_hw *hw)
+static void ath10k_reconfig_complete(struct ieee80211_hw *hw,
+                                     enum ieee80211_reconfig_type reconfig_type)
 {
         struct ath10k *ar = hw->priv;
 
+        if (reconfig_type != IEEE80211_RECONFIG_TYPE_RESTART)
+                return;
+
         mutex_lock(&ar->conf_mutex);
 
         /* If device failed to restart it will be in a different state, e.g.
@@ -3940,6 +4020,7 @@ static void ath10k_restart_complete(struct ieee80211_hw *hw)
         if (ar->state == ATH10K_STATE_RESTARTED) {
                 ath10k_info(ar, "device successfully recovered\n");
                 ar->state = ATH10K_STATE_ON;
+                ieee80211_wake_queues(ar->hw);
         }
 
         mutex_unlock(&ar->conf_mutex);
@@ -3975,6 +4056,9 @@ static int ath10k_get_survey(struct ieee80211_hw *hw, int idx,
 
         survey->channel = &sband->channels[idx];
 
+        if (ar->rx_channel == survey->channel)
+                survey->filled |= SURVEY_INFO_IN_USE;
+
 exit:
         mutex_unlock(&ar->conf_mutex);
         return ret;
@@ -4450,12 +4534,15 @@ static const struct ieee80211_ops ath10k_ops = {
         .tx_last_beacon                 = ath10k_tx_last_beacon,
         .set_antenna                    = ath10k_set_antenna,
         .get_antenna                    = ath10k_get_antenna,
-        .restart_complete               = ath10k_restart_complete,
+        .reconfig_complete              = ath10k_reconfig_complete,
         .get_survey                     = ath10k_get_survey,
         .set_bitrate_mask               = ath10k_set_bitrate_mask,
         .sta_rc_update                  = ath10k_sta_rc_update,
         .get_tsf                        = ath10k_get_tsf,
         .ampdu_action                   = ath10k_ampdu_action,
+        .get_et_sset_count              = ath10k_debug_get_et_sset_count,
+        .get_et_stats                   = ath10k_debug_get_et_stats,
+        .get_et_strings                 = ath10k_debug_get_et_strings,
 
         CFG80211_TESTMODE_CMD(ath10k_tm_cmd)
 
@@ -4800,15 +4887,6 @@ int ath10k_mac_register(struct ath10k *ar)
                 BIT(NL80211_IFTYPE_STATION) |
                 BIT(NL80211_IFTYPE_AP);
 
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                /* TODO:  Have to deal with 2x2 chips if/when the come out. */
-                ar->supp_tx_chainmask = TARGET_10X_TX_CHAIN_MASK;
-                ar->supp_rx_chainmask = TARGET_10X_RX_CHAIN_MASK;
-        } else {
-                ar->supp_tx_chainmask = TARGET_TX_CHAIN_MASK;
-                ar->supp_rx_chainmask = TARGET_RX_CHAIN_MASK;
-        }
-
         ar->hw->wiphy->available_antennas_rx = ar->supp_rx_chainmask;
         ar->hw->wiphy->available_antennas_tx = ar->supp_tx_chainmask;
 
@@ -4854,6 +4932,8 @@ int ath10k_mac_register(struct ath10k *ar)
         ar->hw->wiphy->max_remain_on_channel_duration = 5000;
 
         ar->hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
+        ar->hw->wiphy->features |= NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE;
+
         /*
          * on LL hardware queues are managed entirely by the FW
          * so we only advertise to mac we can do the queues thing
diff --git a/drivers/net/wireless/ath/ath10k/mac.h b/drivers/net/wireless/ath/ath10k/mac.h
index 6c80eeada3e2..4e3c989aa841 100644
--- a/drivers/net/wireless/ath/ath10k/mac.h
+++ b/drivers/net/wireless/ath/ath10k/mac.h
@@ -39,6 +39,8 @@ void ath10k_offchan_tx_work(struct work_struct *work);
 void ath10k_mgmt_over_wmi_tx_purge(struct ath10k *ar);
 void ath10k_mgmt_over_wmi_tx_work(struct work_struct *work);
 void ath10k_halt(struct ath10k *ar);
+void ath10k_mac_vif_beacon_free(struct ath10k_vif *arvif);
+void ath10k_drain_tx(struct ath10k *ar);
 
 static inline struct ath10k_vif *ath10k_vif_to_arvif(struct ieee80211_vif *vif)
 {
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index 59e0ea83be50..3a6b8a5ca96c 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -485,6 +485,8 @@ static int ath10k_pci_diag_read_mem(struct ath10k *ar, u32 address, void *data,
         void *data_buf = NULL;
         int i;
 
+        spin_lock_bh(&ar_pci->ce_lock);
+
         ce_diag = ar_pci->ce_diag;
 
         /*
@@ -511,7 +513,7 @@ static int ath10k_pci_diag_read_mem(struct ath10k *ar, u32 address, void *data,
                 nbytes = min_t(unsigned int, remaining_bytes,
                                DIAG_TRANSFER_LIMIT);
 
-                ret = ath10k_ce_rx_post_buf(ce_diag, NULL, ce_data);
+                ret = __ath10k_ce_rx_post_buf(ce_diag, NULL, ce_data);
                 if (ret != 0)
                         goto done;
 
@@ -527,15 +529,15 @@ static int ath10k_pci_diag_read_mem(struct ath10k *ar, u32 address, void *data,
                 address = TARG_CPU_SPACE_TO_CE_SPACE(ar, ar_pci->mem,
                                                      address);
 
-                ret = ath10k_ce_send(ce_diag, NULL, (u32)address, nbytes, 0,
-                                     0);
+                ret = ath10k_ce_send_nolock(ce_diag, NULL, (u32)address, nbytes, 0,
+                                            0);
                 if (ret)
                         goto done;
 
                 i = 0;
-                while (ath10k_ce_completed_send_next(ce_diag, NULL, &buf,
-                                                     &completed_nbytes,
-                                                     &id) != 0) {
+                while (ath10k_ce_completed_send_next_nolock(ce_diag, NULL, &buf,
+                                                            &completed_nbytes,
+                                                            &id) != 0) {
                         mdelay(1);
                         if (i++ > DIAG_ACCESS_CE_TIMEOUT_MS) {
                                 ret = -EBUSY;
@@ -554,9 +556,9 @@ static int ath10k_pci_diag_read_mem(struct ath10k *ar, u32 address, void *data,
                 }
 
                 i = 0;
-                while (ath10k_ce_completed_recv_next(ce_diag, NULL, &buf,
-                                                     &completed_nbytes,
-                                                     &id, &flags) != 0) {
+                while (ath10k_ce_completed_recv_next_nolock(ce_diag, NULL, &buf,
+                                                            &completed_nbytes,
+                                                            &id, &flags) != 0) {
                         mdelay(1);
 
                         if (i++ > DIAG_ACCESS_CE_TIMEOUT_MS) {
@@ -591,6 +593,8 @@ done:
                 dma_free_coherent(ar->dev, orig_nbytes, data_buf,
                                   ce_data_base);
 
+        spin_unlock_bh(&ar_pci->ce_lock);
+
         return ret;
 }
 
@@ -648,6 +652,8 @@ static int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
         dma_addr_t ce_data_base = 0;
         int i;
 
+        spin_lock_bh(&ar_pci->ce_lock);
+
         ce_diag = ar_pci->ce_diag;
 
         /*
@@ -688,7 +694,7 @@ static int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
                 nbytes = min_t(int, remaining_bytes, DIAG_TRANSFER_LIMIT);
 
                 /* Set up to receive directly into Target(!) address */
-                ret = ath10k_ce_rx_post_buf(ce_diag, NULL, address);
+                ret = __ath10k_ce_rx_post_buf(ce_diag, NULL, address);
                 if (ret != 0)
                         goto done;
 
@@ -696,15 +702,15 @@ static int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
                  * Request CE to send caller-supplied data that
                  * was copied to bounce buffer to Target(!) address.
                  */
-                ret = ath10k_ce_send(ce_diag, NULL, (u32)ce_data,
-                                     nbytes, 0, 0);
+                ret = ath10k_ce_send_nolock(ce_diag, NULL, (u32)ce_data,
+                                            nbytes, 0, 0);
                 if (ret != 0)
                         goto done;
 
                 i = 0;
-                while (ath10k_ce_completed_send_next(ce_diag, NULL, &buf,
-                                                     &completed_nbytes,
-                                                     &id) != 0) {
+                while (ath10k_ce_completed_send_next_nolock(ce_diag, NULL, &buf,
+                                                            &completed_nbytes,
+                                                            &id) != 0) {
                         mdelay(1);
 
                         if (i++ > DIAG_ACCESS_CE_TIMEOUT_MS) {
@@ -724,9 +730,9 @@ static int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
                 }
 
                 i = 0;
-                while (ath10k_ce_completed_recv_next(ce_diag, NULL, &buf,
-                                                     &completed_nbytes,
-                                                     &id, &flags) != 0) {
+                while (ath10k_ce_completed_recv_next_nolock(ce_diag, NULL, &buf,
+                                                            &completed_nbytes,
+                                                            &id, &flags) != 0) {
                         mdelay(1);
 
                         if (i++ > DIAG_ACCESS_CE_TIMEOUT_MS) {
@@ -760,6 +766,8 @@ done:
                 ath10k_warn(ar, "failed to write diag value at 0x%x: %d\n",
                             address, ret);
 
+        spin_unlock_bh(&ar_pci->ce_lock);
+
         return ret;
 }
 
@@ -861,6 +869,12 @@ static void ath10k_pci_ce_recv_data(struct ath10k_ce_pipe *ce_state)
                 }
 
                 skb_put(skb, nbytes);
+
+                ath10k_dbg(ar, ATH10K_DBG_PCI, "pci rx ce pipe %d len %d\n",
+                           ce_state->id, skb->len);
+                ath10k_dbg_dump(ar, ATH10K_DBG_PCI_DUMP, NULL, "pci rx: ",
+                                skb->data, skb->len);
+
                 cb->rx_completion(ar, skb, pipe_info->pipe_num);
         }
 
@@ -936,6 +950,12 @@ err:
         return err;
 }
 
+static int ath10k_pci_hif_diag_read(struct ath10k *ar, u32 address, void *buf,
+                                    size_t buf_len)
+{
+        return ath10k_pci_diag_read_mem(ar, address, buf, buf_len);
+}
+
 static u16 ath10k_pci_hif_get_free_queue_number(struct ath10k *ar, u8 pipe)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
@@ -986,6 +1006,8 @@ static void ath10k_pci_fw_crashed_dump(struct ath10k *ar)
 
         spin_lock_bh(&ar->data_lock);
 
+        ar->stats.fw_crash_counter++;
+
         crash_data = ath10k_debug_get_new_fw_crash_data(ar);
 
         if (crash_data)
@@ -1121,14 +1143,37 @@ static void ath10k_pci_hif_get_default_pipe(struct ath10k *ar,
                                                  &dl_is_polled);
 }
 
-static void ath10k_pci_irq_disable(struct ath10k *ar)
+static void ath10k_pci_irq_msi_fw_mask(struct ath10k *ar)
 {
-        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        int i;
+        u32 val;
+
+        val = ath10k_pci_read32(ar, SOC_CORE_BASE_ADDRESS + CORE_CTRL_ADDRESS);
+        val &= ~CORE_CTRL_PCIE_REG_31_MASK;
+
+        ath10k_pci_write32(ar, SOC_CORE_BASE_ADDRESS + CORE_CTRL_ADDRESS, val);
+}
+
+static void ath10k_pci_irq_msi_fw_unmask(struct ath10k *ar)
+{
+        u32 val;
 
+        val = ath10k_pci_read32(ar, SOC_CORE_BASE_ADDRESS + CORE_CTRL_ADDRESS);
+        val |= CORE_CTRL_PCIE_REG_31_MASK;
+
+        ath10k_pci_write32(ar, SOC_CORE_BASE_ADDRESS + CORE_CTRL_ADDRESS, val);
+}
+
+static void ath10k_pci_irq_disable(struct ath10k *ar)
+{
         ath10k_ce_disable_interrupts(ar);
         ath10k_pci_disable_and_clear_legacy_irq(ar);
-        /* FIXME: How to mask all MSI interrupts? */
+        ath10k_pci_irq_msi_fw_mask(ar);
+}
+
+static void ath10k_pci_irq_sync(struct ath10k *ar)
+{
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+        int i;
 
         for (i = 0; i < max(1, ar_pci->num_msi_intrs); i++)
                 synchronize_irq(ar_pci->pdev->irq + i);
@@ -1138,7 +1183,7 @@ static void ath10k_pci_irq_enable(struct ath10k *ar)
 {
         ath10k_ce_enable_interrupts(ar);
         ath10k_pci_enable_legacy_irq(ar);
-        /* FIXME: How to unmask all MSI interrupts? */
+        ath10k_pci_irq_msi_fw_unmask(ar);
 }
 
 static int ath10k_pci_hif_start(struct ath10k *ar)
@@ -1151,64 +1196,74 @@ static int ath10k_pci_hif_start(struct ath10k *ar)
         return 0;
 }
 
-static void ath10k_pci_rx_pipe_cleanup(struct ath10k_pci_pipe *pipe_info)
+static void ath10k_pci_rx_pipe_cleanup(struct ath10k_pci_pipe *pci_pipe)
 {
         struct ath10k *ar;
-        struct ath10k_pci *ar_pci;
-        struct ath10k_ce_pipe *ce_hdl;
-        u32 buf_sz;
-        struct sk_buff *netbuf;
-        u32 ce_data;
+        struct ath10k_ce_pipe *ce_pipe;
+        struct ath10k_ce_ring *ce_ring;
+        struct sk_buff *skb;
+        int i;
 
-        buf_sz = pipe_info->buf_sz;
+        ar = pci_pipe->hif_ce_state;
+        ce_pipe = pci_pipe->ce_hdl;
+        ce_ring = ce_pipe->dest_ring;
 
-        /* Unused Copy Engine */
-        if (buf_sz == 0)
+        if (!ce_ring)
                 return;
 
-        ar = pipe_info->hif_ce_state;
-        ar_pci = ath10k_pci_priv(ar);
-        ce_hdl = pipe_info->ce_hdl;
+        if (!pci_pipe->buf_sz)
+                return;
 
-        while (ath10k_ce_revoke_recv_next(ce_hdl, (void **)&netbuf,
-                                          &ce_data) == 0) {
-                dma_unmap_single(ar->dev, ATH10K_SKB_CB(netbuf)->paddr,
-                                 netbuf->len + skb_tailroom(netbuf),
+        for (i = 0; i < ce_ring->nentries; i++) {
+                skb = ce_ring->per_transfer_context[i];
+                if (!skb)
+                        continue;
+
+                ce_ring->per_transfer_context[i] = NULL;
+
+                dma_unmap_single(ar->dev, ATH10K_SKB_CB(skb)->paddr,
+                                 skb->len + skb_tailroom(skb),
                                  DMA_FROM_DEVICE);
-                dev_kfree_skb_any(netbuf);
+                dev_kfree_skb_any(skb);
         }
 }
 
-static void ath10k_pci_tx_pipe_cleanup(struct ath10k_pci_pipe *pipe_info)
+static void ath10k_pci_tx_pipe_cleanup(struct ath10k_pci_pipe *pci_pipe)
 {
         struct ath10k *ar;
         struct ath10k_pci *ar_pci;
-        struct ath10k_ce_pipe *ce_hdl;
-        struct sk_buff *netbuf;
-        u32 ce_data;
-        unsigned int nbytes;
+        struct ath10k_ce_pipe *ce_pipe;
+        struct ath10k_ce_ring *ce_ring;
+        struct ce_desc *ce_desc;
+        struct sk_buff *skb;
         unsigned int id;
-        u32 buf_sz;
+        int i;
 
-        buf_sz = pipe_info->buf_sz;
+        ar = pci_pipe->hif_ce_state;
+        ar_pci = ath10k_pci_priv(ar);
+        ce_pipe = pci_pipe->ce_hdl;
+        ce_ring = ce_pipe->src_ring;
 
-        /* Unused Copy Engine */
-        if (buf_sz == 0)
+        if (!ce_ring)
                 return;
 
-        ar = pipe_info->hif_ce_state;
-        ar_pci = ath10k_pci_priv(ar);
-        ce_hdl = pipe_info->ce_hdl;
+        if (!pci_pipe->buf_sz)
+                return;
 
-        while (ath10k_ce_cancel_send_next(ce_hdl, (void **)&netbuf,
-                                          &ce_data, &nbytes, &id) == 0) {
-                /* no need to call tx completion for NULL pointers */
-                if (!netbuf)
+        ce_desc = ce_ring->shadow_base;
+        if (WARN_ON(!ce_desc))
+                return;
+
+        for (i = 0; i < ce_ring->nentries; i++) {
+                skb = ce_ring->per_transfer_context[i];
+                if (!skb)
                         continue;
 
-                ar_pci->msg_callbacks_current.tx_completion(ar,
-                                                            netbuf,
-                                                            id);
+                ce_ring->per_transfer_context[i] = NULL;
+                id = MS(__le16_to_cpu(ce_desc[i].flags),
+                        CE_DESC_FLAGS_META_DATA);
+
+                ar_pci->msg_callbacks_current.tx_completion(ar, skb, id);
         }
 }
 
@@ -1266,6 +1321,7 @@ static void ath10k_pci_hif_stop(struct ath10k *ar)
         ath10k_pci_warm_reset(ar);
 
         ath10k_pci_irq_disable(ar);
+        ath10k_pci_irq_sync(ar);
         ath10k_pci_flush(ar);
 }
 
@@ -1386,6 +1442,9 @@ static void ath10k_pci_bmi_recv_data(struct ath10k_ce_pipe *ce_state)
                                           &nbytes, &transfer_id, &flags))
                 return;
 
+        if (WARN_ON_ONCE(!xfer))
+                return;
+
         if (!xfer->wait_for_resp) {
                 ath10k_warn(ar, "unexpected: BMI data received; ignoring\n");
                 return;
@@ -1569,23 +1628,40 @@ static int ath10k_pci_init_config(struct ath10k *ar)
         return 0;
 }
 
-static int ath10k_pci_alloc_ce(struct ath10k *ar)
+static int ath10k_pci_alloc_pipes(struct ath10k *ar)
 {
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+        struct ath10k_pci_pipe *pipe;
         int i, ret;
 
         for (i = 0; i < CE_COUNT; i++) {
-                ret = ath10k_ce_alloc_pipe(ar, i, &host_ce_config_wlan[i]);
+                pipe = &ar_pci->pipe_info[i];
+                pipe->ce_hdl = &ar_pci->ce_states[i];
+                pipe->pipe_num = i;
+                pipe->hif_ce_state = ar;
+
+                ret = ath10k_ce_alloc_pipe(ar, i, &host_ce_config_wlan[i],
+                                           ath10k_pci_ce_send_done,
+                                           ath10k_pci_ce_recv_data);
                 if (ret) {
                         ath10k_err(ar, "failed to allocate copy engine pipe %d: %d\n",
                                    i, ret);
                         return ret;
                 }
+
+                /* Last CE is Diagnostic Window */
+                if (i == CE_COUNT - 1) {
+                        ar_pci->ce_diag = pipe->ce_hdl;
+                        continue;
+                }
+
+                pipe->buf_sz = (size_t)(host_ce_config_wlan[i].src_sz_max);
         }
 
         return 0;
 }
 
-static void ath10k_pci_free_ce(struct ath10k *ar)
+static void ath10k_pci_free_pipes(struct ath10k *ar)
 {
         int i;
 
@@ -1593,39 +1669,17 @@ static void ath10k_pci_free_ce(struct ath10k *ar)
                 ath10k_ce_free_pipe(ar, i);
 }
 
-static int ath10k_pci_ce_init(struct ath10k *ar)
+static int ath10k_pci_init_pipes(struct ath10k *ar)
 {
-        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct ath10k_pci_pipe *pipe_info;
-        const struct ce_attr *attr;
-        int pipe_num, ret;
+        int i, ret;
 
-        for (pipe_num = 0; pipe_num < CE_COUNT; pipe_num++) {
-                pipe_info = &ar_pci->pipe_info[pipe_num];
-                pipe_info->ce_hdl = &ar_pci->ce_states[pipe_num];
-                pipe_info->pipe_num = pipe_num;
-                pipe_info->hif_ce_state = ar;
-                attr = &host_ce_config_wlan[pipe_num];
-
-                ret = ath10k_ce_init_pipe(ar, pipe_num, attr,
-                                          ath10k_pci_ce_send_done,
-                                          ath10k_pci_ce_recv_data);
+        for (i = 0; i < CE_COUNT; i++) {
+                ret = ath10k_ce_init_pipe(ar, i, &host_ce_config_wlan[i]);
                 if (ret) {
                         ath10k_err(ar, "failed to initialize copy engine pipe %d: %d\n",
-                                   pipe_num, ret);
+                                   i, ret);
                         return ret;
                 }
-
-                if (pipe_num == CE_COUNT - 1) {
-                        /*
-                         * Reserve the ultimate CE for
-                         * diagnostic Window support
-                         */
-                        ar_pci->ce_diag = pipe_info->ce_hdl;
-                        continue;
-                }
-
-                pipe_info->buf_sz = (size_t)(attr->src_sz_max);
         }
 
         return 0;
@@ -1666,93 +1720,167 @@ static void ath10k_pci_warm_reset_si0(struct ath10k *ar)
         msleep(10);
 }
 
-static int ath10k_pci_warm_reset(struct ath10k *ar)
+static void ath10k_pci_warm_reset_cpu(struct ath10k *ar)
 {
         u32 val;
 
-        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot warm reset\n");
-
-        /* debug */
-        val = ath10k_pci_read32(ar, SOC_CORE_BASE_ADDRESS +
-                                PCIE_INTR_CAUSE_ADDRESS);
-        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot host cpu intr cause: 0x%08x\n",
-                   val);
+        ath10k_pci_write32(ar, FW_INDICATOR_ADDRESS, 0);
 
-        val = ath10k_pci_read32(ar, SOC_CORE_BASE_ADDRESS +
-                                CPU_INTR_ADDRESS);
-        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot target cpu intr cause: 0x%08x\n",
-                   val);
+        val = ath10k_pci_read32(ar, RTC_SOC_BASE_ADDRESS +
+                                SOC_RESET_CONTROL_ADDRESS);
+        ath10k_pci_write32(ar, RTC_SOC_BASE_ADDRESS + SOC_RESET_CONTROL_ADDRESS,
+                           val | SOC_RESET_CONTROL_CPU_WARM_RST_MASK);
+}
 
-        /* disable pending irqs */
-        ath10k_pci_write32(ar, SOC_CORE_BASE_ADDRESS +
-                           PCIE_INTR_ENABLE_ADDRESS, 0);
+static void ath10k_pci_warm_reset_ce(struct ath10k *ar)
+{
+        u32 val;
 
-        ath10k_pci_write32(ar, SOC_CORE_BASE_ADDRESS +
-                           PCIE_INTR_CLR_ADDRESS, ~0);
+        val = ath10k_pci_read32(ar, RTC_SOC_BASE_ADDRESS +
+                                SOC_RESET_CONTROL_ADDRESS);
 
-        msleep(100);
+        ath10k_pci_write32(ar, RTC_SOC_BASE_ADDRESS + SOC_RESET_CONTROL_ADDRESS,
+                           val | SOC_RESET_CONTROL_CE_RST_MASK);
+        msleep(10);
+        ath10k_pci_write32(ar, RTC_SOC_BASE_ADDRESS + SOC_RESET_CONTROL_ADDRESS,
+                           val & ~SOC_RESET_CONTROL_CE_RST_MASK);
+}
 
-        /* clear fw indicator */
-        ath10k_pci_write32(ar, FW_INDICATOR_ADDRESS, 0);
+static void ath10k_pci_warm_reset_clear_lf(struct ath10k *ar)
+{
+        u32 val;
 
-        /* clear target LF timer interrupts */
         val = ath10k_pci_read32(ar, RTC_SOC_BASE_ADDRESS +
                                 SOC_LF_TIMER_CONTROL0_ADDRESS);
         ath10k_pci_write32(ar, RTC_SOC_BASE_ADDRESS +
                            SOC_LF_TIMER_CONTROL0_ADDRESS,
                            val & ~SOC_LF_TIMER_CONTROL0_ENABLE_MASK);
+}
 
-        /* reset CE */
-        val = ath10k_pci_read32(ar, RTC_SOC_BASE_ADDRESS +
-                                SOC_RESET_CONTROL_ADDRESS);
-        ath10k_pci_write32(ar, RTC_SOC_BASE_ADDRESS + SOC_RESET_CONTROL_ADDRESS,
-                           val | SOC_RESET_CONTROL_CE_RST_MASK);
-        val = ath10k_pci_read32(ar, RTC_SOC_BASE_ADDRESS +
-                                SOC_RESET_CONTROL_ADDRESS);
-        msleep(10);
+static int ath10k_pci_warm_reset(struct ath10k *ar)
+{
+        int ret;
 
-        /* unreset CE */
-        ath10k_pci_write32(ar, RTC_SOC_BASE_ADDRESS + SOC_RESET_CONTROL_ADDRESS,
-                           val & ~SOC_RESET_CONTROL_CE_RST_MASK);
-        val = ath10k_pci_read32(ar, RTC_SOC_BASE_ADDRESS +
-                                SOC_RESET_CONTROL_ADDRESS);
-        msleep(10);
+        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot warm reset\n");
+
+        spin_lock_bh(&ar->data_lock);
+        ar->stats.fw_warm_reset_counter++;
+        spin_unlock_bh(&ar->data_lock);
+
+        ath10k_pci_irq_disable(ar);
 
+        /* Make sure the target CPU is not doing anything dangerous, e.g. if it
+         * were to access copy engine while host performs copy engine reset
+         * then it is possible for the device to confuse pci-e controller to
+         * the point of bringing host system to a complete stop (i.e. hang).
+         */
         ath10k_pci_warm_reset_si0(ar);
+        ath10k_pci_warm_reset_cpu(ar);
+        ath10k_pci_init_pipes(ar);
+        ath10k_pci_wait_for_target_init(ar);
 
-        /* debug */
-        val = ath10k_pci_read32(ar, SOC_CORE_BASE_ADDRESS +
-                                PCIE_INTR_CAUSE_ADDRESS);
-        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot host cpu intr cause: 0x%08x\n",
-                   val);
+        ath10k_pci_warm_reset_clear_lf(ar);
+        ath10k_pci_warm_reset_ce(ar);
+        ath10k_pci_warm_reset_cpu(ar);
+        ath10k_pci_init_pipes(ar);
 
-        val = ath10k_pci_read32(ar, SOC_CORE_BASE_ADDRESS +
-                                CPU_INTR_ADDRESS);
-        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot target cpu intr cause: 0x%08x\n",
-                   val);
+        ret = ath10k_pci_wait_for_target_init(ar);
+        if (ret) {
+                ath10k_warn(ar, "failed to wait for target init: %d\n", ret);
+                return ret;
+        }
 
-        /* CPU warm reset */
-        val = ath10k_pci_read32(ar, RTC_SOC_BASE_ADDRESS +
-                                SOC_RESET_CONTROL_ADDRESS);
-        ath10k_pci_write32(ar, RTC_SOC_BASE_ADDRESS + SOC_RESET_CONTROL_ADDRESS,
-                           val | SOC_RESET_CONTROL_CPU_WARM_RST_MASK);
+        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot warm reset complete\n");
 
-        val = ath10k_pci_read32(ar, RTC_SOC_BASE_ADDRESS +
-                                SOC_RESET_CONTROL_ADDRESS);
-        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot target reset state: 0x%08x\n",
-                   val);
+        return 0;
+}
+
+static int ath10k_pci_chip_reset(struct ath10k *ar)
+{
+        int i, ret;
+        u32 val;
 
-        msleep(100);
+        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot chip reset\n");
 
-        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot warm reset complete\n");
+        /* Some hardware revisions (e.g. CUS223v2) has issues with cold reset.
+         * It is thus preferred to use warm reset which is safer but may not be
+         * able to recover the device from all possible fail scenarios.
+         *
+         * Warm reset doesn't always work on first try so attempt it a few
+         * times before giving up.
+         */
+        for (i = 0; i < ATH10K_PCI_NUM_WARM_RESET_ATTEMPTS; i++) {
+                ret = ath10k_pci_warm_reset(ar);
+                if (ret) {
+                        ath10k_warn(ar, "failed to warm reset attempt %d of %d: %d\n",
+                                    i + 1, ATH10K_PCI_NUM_WARM_RESET_ATTEMPTS,
+                                    ret);
+                        continue;
+                }
+
+                /* FIXME: Sometimes copy engine doesn't recover after warm
+                 * reset. In most cases this needs cold reset. In some of these
+                 * cases the device is in such a state that a cold reset may
+                 * lock up the host.
+                 *
+                 * Reading any host interest register via copy engine is
+                 * sufficient to verify if device is capable of booting
+                 * firmware blob.
+                 */
+                ret = ath10k_pci_init_pipes(ar);
+                if (ret) {
+                        ath10k_warn(ar, "failed to init copy engine: %d\n",
+                                    ret);
+                        continue;
+                }
+
+                ret = ath10k_pci_diag_read32(ar, QCA988X_HOST_INTEREST_ADDRESS,
+                                             &val);
+                if (ret) {
+                        ath10k_warn(ar, "failed to poke copy engine: %d\n",
+                                    ret);
+                        continue;
+                }
+
+                ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot chip reset complete (warm)\n");
+                return 0;
+        }
+
+        if (ath10k_pci_reset_mode == ATH10K_PCI_RESET_WARM_ONLY) {
+                ath10k_warn(ar, "refusing cold reset as requested\n");
+                return -EPERM;
+        }
+
+        ret = ath10k_pci_cold_reset(ar);
+        if (ret) {
+                ath10k_warn(ar, "failed to cold reset: %d\n", ret);
+                return ret;
+        }
+
+        ret = ath10k_pci_wait_for_target_init(ar);
+        if (ret) {
+                ath10k_warn(ar, "failed to wait for target after cold reset: %d\n",
+                            ret);
+                return ret;
+        }
+
+        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot chip reset complete (cold)\n");
 
         return 0;
 }
 
-static int __ath10k_pci_hif_power_up(struct ath10k *ar, bool cold_reset)
+static int ath10k_pci_hif_power_up(struct ath10k *ar)
 {
         int ret;
 
+        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot hif power up\n");
+
+        ret = ath10k_pci_wake(ar);
+        if (ret) {
+                ath10k_err(ar, "failed to wake up target: %d\n", ret);
+                return ret;
+        }
+
         /*
          * Bring the target up cleanly.
          *
@@ -1763,26 +1891,16 @@ static int __ath10k_pci_hif_power_up(struct ath10k *ar, bool cold_reset)
          * is in an unexpected state. We try to catch that here in order to
          * reset the Target and retry the probe.
          */
-        if (cold_reset)
-                ret = ath10k_pci_cold_reset(ar);
-        else
-                ret = ath10k_pci_warm_reset(ar);
-
+        ret = ath10k_pci_chip_reset(ar);
         if (ret) {
-                ath10k_err(ar, "failed to reset target: %d\n", ret);
-                goto err;
+                ath10k_err(ar, "failed to reset chip: %d\n", ret);
+                goto err_sleep;
         }
 
-        ret = ath10k_pci_ce_init(ar);
+        ret = ath10k_pci_init_pipes(ar);
         if (ret) {
                 ath10k_err(ar, "failed to initialize CE: %d\n", ret);
-                goto err;
-        }
-
-        ret = ath10k_pci_wait_for_target_init(ar);
-        if (ret) {
-                ath10k_err(ar, "failed to wait for target to init: %d\n", ret);
-                goto err_ce;
+                goto err_sleep;
         }
 
         ret = ath10k_pci_init_config(ar);
@@ -1801,73 +1919,21 @@ static int __ath10k_pci_hif_power_up(struct ath10k *ar, bool cold_reset)
 
 err_ce:
         ath10k_pci_ce_deinit(ar);
-        ath10k_pci_warm_reset(ar);
-err:
-        return ret;
-}
-
-static int ath10k_pci_hif_power_up_warm(struct ath10k *ar)
-{
-        int i, ret;
-
-        /*
-         * Sometime warm reset succeeds after retries.
-         *
-         * FIXME: It might be possible to tune ath10k_pci_warm_reset() to work
-         * at first try.
-         */
-        for (i = 0; i < ATH10K_PCI_NUM_WARM_RESET_ATTEMPTS; i++) {
-                ret = __ath10k_pci_hif_power_up(ar, false);
-                if (ret == 0)
-                        break;
-
-                ath10k_warn(ar, "failed to warm reset (attempt %d out of %d): %d\n",
-                            i + 1, ATH10K_PCI_NUM_WARM_RESET_ATTEMPTS, ret);
-        }
 
+err_sleep:
+        ath10k_pci_sleep(ar);
         return ret;
 }
 
-static int ath10k_pci_hif_power_up(struct ath10k *ar)
-{
-        int ret;
-
-        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot hif power up\n");
-
-        /*
-         * Hardware CUS232 version 2 has some issues with cold reset and the
-         * preferred (and safer) way to perform a device reset is through a
-         * warm reset.
-         *
-         * Warm reset doesn't always work though so fall back to cold reset may
-         * be necessary.
-         */
-        ret = ath10k_pci_hif_power_up_warm(ar);
-        if (ret) {
-                ath10k_warn(ar, "failed to power up target using warm reset: %d\n",
-                            ret);
-
-                if (ath10k_pci_reset_mode == ATH10K_PCI_RESET_WARM_ONLY)
-                        return ret;
-
-                ath10k_warn(ar, "trying cold reset\n");
-
-                ret = __ath10k_pci_hif_power_up(ar, true);
-                if (ret) {
-                        ath10k_err(ar, "failed to power up target using cold reset too (%d)\n",
-                                   ret);
-                        return ret;
-                }
-        }
-
-        return 0;
-}
-
 static void ath10k_pci_hif_power_down(struct ath10k *ar)
 {
         ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot hif power down\n");
 
-        ath10k_pci_warm_reset(ar);
+        /* Currently hif_power_up performs effectively a reset and hif_stop
+         * resets the chip as well so there's no point in resetting here.
+         */
+
+        ath10k_pci_sleep(ar);
 }
 
 #ifdef CONFIG_PM
@@ -1921,6 +1987,7 @@ static int ath10k_pci_hif_resume(struct ath10k *ar)
 
 static const struct ath10k_hif_ops ath10k_pci_hif_ops = {
         .tx_sg                  = ath10k_pci_hif_tx_sg,
+        .diag_read              = ath10k_pci_hif_diag_read,
         .exchange_bmi_msg       = ath10k_pci_hif_exchange_bmi_msg,
         .start                  = ath10k_pci_hif_start,
         .stop                   = ath10k_pci_hif_stop,
@@ -2250,14 +2317,14 @@ static int ath10k_pci_wait_for_target_init(struct ath10k *ar)
 
                 if (ar_pci->num_msi_intrs == 0)
                         /* Fix potential race by repeating CORE_BASE writes */
-                        ath10k_pci_write32(ar, SOC_CORE_BASE_ADDRESS +
-                                           PCIE_INTR_ENABLE_ADDRESS,
-                                           PCIE_INTR_FIRMWARE_MASK |
-                                           PCIE_INTR_CE_MASK_ALL);
+                        ath10k_pci_enable_legacy_irq(ar);
 
                 mdelay(10);
         } while (time_before(jiffies, timeout));
 
+        ath10k_pci_disable_and_clear_legacy_irq(ar);
+        ath10k_pci_irq_msi_fw_mask(ar);
+
         if (val == 0xffffffff) {
                 ath10k_err(ar, "failed to read device register, device is gone\n");
                 return -EIO;
@@ -2287,6 +2354,12 @@ static int ath10k_pci_cold_reset(struct ath10k *ar)
 
         ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot cold reset\n");
 
+        spin_lock_bh(&ar->data_lock);
+
+        ar->stats.fw_cold_reset_counter++;
+
+        spin_unlock_bh(&ar->data_lock);
+
         /* Put Target, including PCIe, into RESET. */
         val = ath10k_pci_reg_read32(ar, SOC_GLOBAL_RESET_ADDRESS);
         val |= 1;
@@ -2400,6 +2473,7 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
         u32 chip_id;
 
         ar = ath10k_core_create(sizeof(*ar_pci), &pdev->dev,
+                                ATH10K_BUS_PCI,
                                 &ath10k_pci_hif_ops);
         if (!ar) {
                 dev_err(&pdev->dev, "failed to allocate core\n");
@@ -2435,7 +2509,7 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
                 goto err_sleep;
         }
 
-        ret = ath10k_pci_alloc_ce(ar);
+        ret = ath10k_pci_alloc_pipes(ar);
         if (ret) {
                 ath10k_err(ar, "failed to allocate copy engine pipes: %d\n",
                            ret);
@@ -2443,25 +2517,12 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
         }
 
         ath10k_pci_ce_deinit(ar);
-
-        ret = ath10k_ce_disable_interrupts(ar);
-        if (ret) {
-                ath10k_err(ar, "failed to disable copy engine interrupts: %d\n",
-                           ret);
-                goto err_free_ce;
-        }
-
-        /* Workaround: There's no known way to mask all possible interrupts via
-         * device CSR. The only way to make sure device doesn't assert
-         * interrupts is to reset it. Interrupts are then disabled on host
-         * after handlers are registered.
-         */
-        ath10k_pci_warm_reset(ar);
+        ath10k_pci_irq_disable(ar);
 
         ret = ath10k_pci_init_irq(ar);
         if (ret) {
                 ath10k_err(ar, "failed to init irqs: %d\n", ret);
-                goto err_free_ce;
+                goto err_free_pipes;
         }
 
         ath10k_info(ar, "pci irq %s interrupts %d irq_mode %d reset_mode %d\n",
@@ -2474,8 +2535,7 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
                 goto err_deinit_irq;
         }
 
-        /* This shouldn't race as the device has been reset above. */
-        ath10k_pci_irq_disable(ar);
+        ath10k_pci_sleep(ar);
 
         ret = ath10k_core_register(ar, chip_id);
         if (ret) {
@@ -2492,8 +2552,8 @@ err_free_irq:
 err_deinit_irq:
         ath10k_pci_deinit_irq(ar);
 
-err_free_ce:
-        ath10k_pci_free_ce(ar);
+err_free_pipes:
+        ath10k_pci_free_pipes(ar);
 
 err_sleep:
         ath10k_pci_sleep(ar);
@@ -2527,8 +2587,7 @@ static void ath10k_pci_remove(struct pci_dev *pdev)
         ath10k_pci_kill_tasklet(ar);
         ath10k_pci_deinit_irq(ar);
         ath10k_pci_ce_deinit(ar);
-        ath10k_pci_free_ce(ar);
-        ath10k_pci_sleep(ar);
+        ath10k_pci_free_pipes(ar);
         ath10k_pci_release(ar);
         ath10k_core_destroy(ar);
 }
@@ -2565,5 +2624,7 @@ module_exit(ath10k_pci_exit);
 MODULE_AUTHOR("Qualcomm Atheros");
 MODULE_DESCRIPTION("Driver support for Atheros QCA988X PCIe devices");
 MODULE_LICENSE("Dual BSD/GPL");
-MODULE_FIRMWARE(QCA988X_HW_2_0_FW_DIR "/" QCA988X_HW_2_0_FW_3_FILE);
+MODULE_FIRMWARE(QCA988X_HW_2_0_FW_DIR "/" QCA988X_HW_2_0_FW_FILE);
+MODULE_FIRMWARE(QCA988X_HW_2_0_FW_DIR "/" ATH10K_FW_API2_FILE);
+MODULE_FIRMWARE(QCA988X_HW_2_0_FW_DIR "/" ATH10K_FW_API3_FILE);
 MODULE_FIRMWARE(QCA988X_HW_2_0_FW_DIR "/" QCA988X_HW_2_0_BOARD_DATA_FILE);
diff --git a/drivers/net/wireless/ath/ath10k/spectral.c b/drivers/net/wireless/ath/ath10k/spectral.c
index 3e1454b74e00..63ce61fcdac8 100644
--- a/drivers/net/wireless/ath/ath10k/spectral.c
+++ b/drivers/net/wireless/ath/ath10k/spectral.c
@@ -56,14 +56,14 @@ static uint8_t get_max_exp(s8 max_index, u16 max_magnitude, size_t bin_len,
 }
 
 int ath10k_spectral_process_fft(struct ath10k *ar,
-                                struct wmi_single_phyerr_rx_event *event,
-                                struct phyerr_fft_report *fftr,
+                                const struct wmi_phyerr *phyerr,
+                                const struct phyerr_fft_report *fftr,
                                 size_t bin_len, u64 tsf)
 {
         struct fft_sample_ath10k *fft_sample;
         u8 buf[sizeof(*fft_sample) + SPECTRAL_ATH10K_MAX_NUM_BINS];
         u16 freq1, freq2, total_gain_db, base_pwr_db, length, peak_mag;
-        u32 reg0, reg1, nf_list1, nf_list2;
+        u32 reg0, reg1;
         u8 chain_idx, *bins;
         int dc_pos;
 
@@ -82,7 +82,7 @@ int ath10k_spectral_process_fft(struct ath10k *ar,
         /* TODO: there might be a reason why the hardware reports 20/40/80 MHz,
          * but the results/plots suggest that its actually 22/44/88 MHz.
          */
-        switch (event->hdr.chan_width_mhz) {
+        switch (phyerr->chan_width_mhz) {
         case 20:
                 fft_sample->chan_width_mhz = 22;
                 break;
@@ -101,7 +101,7 @@ int ath10k_spectral_process_fft(struct ath10k *ar,
                 fft_sample->chan_width_mhz = 88;
                 break;
         default:
-                fft_sample->chan_width_mhz = event->hdr.chan_width_mhz;
+                fft_sample->chan_width_mhz = phyerr->chan_width_mhz;
         }
 
         fft_sample->relpwr_db = MS(reg1, SEARCH_FFT_REPORT_REG1_RELPWR_DB);
@@ -110,36 +110,22 @@ int ath10k_spectral_process_fft(struct ath10k *ar,
         peak_mag = MS(reg1, SEARCH_FFT_REPORT_REG1_PEAK_MAG);
         fft_sample->max_magnitude = __cpu_to_be16(peak_mag);
         fft_sample->max_index = MS(reg0, SEARCH_FFT_REPORT_REG0_PEAK_SIDX);
-        fft_sample->rssi = event->hdr.rssi_combined;
+        fft_sample->rssi = phyerr->rssi_combined;
 
         total_gain_db = MS(reg0, SEARCH_FFT_REPORT_REG0_TOTAL_GAIN_DB);
         base_pwr_db = MS(reg0, SEARCH_FFT_REPORT_REG0_BASE_PWR_DB);
         fft_sample->total_gain_db = __cpu_to_be16(total_gain_db);
         fft_sample->base_pwr_db = __cpu_to_be16(base_pwr_db);
 
-        freq1 = __le16_to_cpu(event->hdr.freq1);
-        freq2 = __le16_to_cpu(event->hdr.freq2);
+        freq1 = __le16_to_cpu(phyerr->freq1);
+        freq2 = __le16_to_cpu(phyerr->freq2);
         fft_sample->freq1 = __cpu_to_be16(freq1);
         fft_sample->freq2 = __cpu_to_be16(freq2);
 
-        nf_list1 = __le32_to_cpu(event->hdr.nf_list_1);
-        nf_list2 = __le32_to_cpu(event->hdr.nf_list_2);
         chain_idx = MS(reg0, SEARCH_FFT_REPORT_REG0_FFT_CHN_IDX);
 
-        switch (chain_idx) {
-        case 0:
-                fft_sample->noise = __cpu_to_be16(nf_list1 & 0xffffu);
-                break;
-        case 1:
-                fft_sample->noise = __cpu_to_be16((nf_list1 >> 16) & 0xffffu);
-                break;
-        case 2:
-                fft_sample->noise = __cpu_to_be16(nf_list2 & 0xffffu);
-                break;
-        case 3:
-                fft_sample->noise = __cpu_to_be16((nf_list2 >> 16) & 0xffffu);
-                break;
-        }
+        fft_sample->noise = __cpu_to_be16(
+                        __le16_to_cpu(phyerr->nf_chains[chain_idx]));
 
         bins = (u8 *)fftr;
         bins += sizeof(*fftr);
diff --git a/drivers/net/wireless/ath/ath10k/spectral.h b/drivers/net/wireless/ath/ath10k/spectral.h
index ddc57c557272..042f5b302c75 100644
--- a/drivers/net/wireless/ath/ath10k/spectral.h
+++ b/drivers/net/wireless/ath/ath10k/spectral.h
@@ -47,8 +47,8 @@ enum ath10k_spectral_mode {
 #ifdef CONFIG_ATH10K_DEBUGFS
 
 int ath10k_spectral_process_fft(struct ath10k *ar,
-                                struct wmi_single_phyerr_rx_event *event,
-                                struct phyerr_fft_report *fftr,
+                                const struct wmi_phyerr *phyerr,
+                                const struct phyerr_fft_report *fftr,
                                 size_t bin_len, u64 tsf);
 int ath10k_spectral_start(struct ath10k *ar);
 int ath10k_spectral_vif_stop(struct ath10k_vif *arvif);
@@ -59,8 +59,8 @@ void ath10k_spectral_destroy(struct ath10k *ar);
 
 static inline int
 ath10k_spectral_process_fft(struct ath10k *ar,
-                            struct wmi_single_phyerr_rx_event *event,
-                            struct phyerr_fft_report *fftr,
+                            const struct wmi_phyerr *phyerr,
+                            const struct phyerr_fft_report *fftr,
                             size_t bin_len, u64 tsf)
 {
         return 0;
diff --git a/drivers/net/wireless/ath/ath10k/trace.h b/drivers/net/wireless/ath/ath10k/trace.h
index 574b75ab2609..ceea5668f3f6 100644
--- a/drivers/net/wireless/ath/ath10k/trace.h
+++ b/drivers/net/wireless/ath/ath10k/trace.h
@@ -20,6 +20,13 @@
 #include <linux/tracepoint.h>
 #include "core.h"
 
+#if !defined(_TRACE_H_)
+static inline u32 ath10k_frm_hdr_len(void *buf)
+{
+        return ieee80211_hdrlen(((struct ieee80211_hdr *)buf)->frame_control);
+}
+#endif
+
 #define _TRACE_H_
 
 /* create empty functions when tracing is disabled */
@@ -254,6 +261,195 @@ TRACE_EVENT(ath10k_wmi_dbglog,
         )
 );
 
+TRACE_EVENT(ath10k_htt_pktlog,
+            TP_PROTO(struct ath10k *ar, void *buf, u16 buf_len),
+
+        TP_ARGS(ar, buf, buf_len),
+
+        TP_STRUCT__entry(
+                __string(device, dev_name(ar->dev))
+                __string(driver, dev_driver_string(ar->dev))
+                __field(u16, buf_len)
+                __dynamic_array(u8, pktlog, buf_len)
+        ),
+
+        TP_fast_assign(
+                __assign_str(device, dev_name(ar->dev));
+                __assign_str(driver, dev_driver_string(ar->dev));
+                __entry->buf_len = buf_len;
+                memcpy(__get_dynamic_array(pktlog), buf, buf_len);
+        ),
+
+        TP_printk(
+                "%s %s size %hu",
+                __get_str(driver),
+                __get_str(device),
+                __entry->buf_len
+         )
+);
+
+TRACE_EVENT(ath10k_htt_tx,
+            TP_PROTO(struct ath10k *ar, u16 msdu_id, u16 msdu_len,
+                     u8 vdev_id, u8 tid),
+
+        TP_ARGS(ar, msdu_id, msdu_len, vdev_id, tid),
+
+        TP_STRUCT__entry(
+                __string(device, dev_name(ar->dev))
+                __string(driver, dev_driver_string(ar->dev))
+                __field(u16, msdu_id)
+                __field(u16, msdu_len)
+                __field(u8, vdev_id)
+                __field(u8, tid)
+        ),
+
+        TP_fast_assign(
+                __assign_str(device, dev_name(ar->dev));
+                __assign_str(driver, dev_driver_string(ar->dev));
+                __entry->msdu_id = msdu_id;
+                __entry->msdu_len = msdu_len;
+                __entry->vdev_id = vdev_id;
+                __entry->tid = tid;
+        ),
+
+        TP_printk(
+                "%s %s msdu_id %d msdu_len %d vdev_id %d tid %d",
+                __get_str(driver),
+                __get_str(device),
+                __entry->msdu_id,
+                __entry->msdu_len,
+                __entry->vdev_id,
+                __entry->tid
+         )
+);
+
+TRACE_EVENT(ath10k_txrx_tx_unref,
+            TP_PROTO(struct ath10k *ar, u16 msdu_id),
+
+        TP_ARGS(ar, msdu_id),
+
+        TP_STRUCT__entry(
+                __string(device, dev_name(ar->dev))
+                __string(driver, dev_driver_string(ar->dev))
+                __field(u16, msdu_id)
+        ),
+
+        TP_fast_assign(
+                __assign_str(device, dev_name(ar->dev));
+                __assign_str(driver, dev_driver_string(ar->dev));
+                __entry->msdu_id = msdu_id;
+        ),
+
+        TP_printk(
+                "%s %s msdu_id %d",
+                __get_str(driver),
+                __get_str(device),
+                __entry->msdu_id
+         )
+);
+
+DECLARE_EVENT_CLASS(ath10k_hdr_event,
+                    TP_PROTO(struct ath10k *ar, void *data, size_t len),
+
+        TP_ARGS(ar, data, len),
+
+        TP_STRUCT__entry(
+                __string(device, dev_name(ar->dev))
+                __string(driver, dev_driver_string(ar->dev))
+                __field(size_t, len)
+                __dynamic_array(u8, data, ath10k_frm_hdr_len(data))
+        ),
+
+        TP_fast_assign(
+                __assign_str(device, dev_name(ar->dev));
+                __assign_str(driver, dev_driver_string(ar->dev));
+                __entry->len = ath10k_frm_hdr_len(data);
+                memcpy(__get_dynamic_array(data), data, __entry->len);
+        ),
+
+        TP_printk(
+                "%s %s len %zu\n",
+                __get_str(driver),
+                __get_str(device),
+                __entry->len
+        )
+);
+
+DECLARE_EVENT_CLASS(ath10k_payload_event,
+                    TP_PROTO(struct ath10k *ar, void *data, size_t len),
+
+        TP_ARGS(ar, data, len),
+
+        TP_STRUCT__entry(
+                __string(device, dev_name(ar->dev))
+                __string(driver, dev_driver_string(ar->dev))
+                __field(size_t, len)
+                __dynamic_array(u8, payload, (len - ath10k_frm_hdr_len(data)))
+        ),
+
+        TP_fast_assign(
+                __assign_str(device, dev_name(ar->dev));
+                __assign_str(driver, dev_driver_string(ar->dev));
+                __entry->len = len - ath10k_frm_hdr_len(data);
+                memcpy(__get_dynamic_array(payload),
+                       data + ath10k_frm_hdr_len(data), __entry->len);
+        ),
+
+        TP_printk(
+                "%s %s len %zu\n",
+                __get_str(driver),
+                __get_str(device),
+                __entry->len
+        )
+);
+
+DEFINE_EVENT(ath10k_hdr_event, ath10k_tx_hdr,
+             TP_PROTO(struct ath10k *ar, void *data, size_t len),
+             TP_ARGS(ar, data, len)
+);
+
+DEFINE_EVENT(ath10k_payload_event, ath10k_tx_payload,
+             TP_PROTO(struct ath10k *ar, void *data, size_t len),
+             TP_ARGS(ar, data, len)
+);
+
+DEFINE_EVENT(ath10k_hdr_event, ath10k_rx_hdr,
+             TP_PROTO(struct ath10k *ar, void *data, size_t len),
+             TP_ARGS(ar, data, len)
+);
+
+DEFINE_EVENT(ath10k_payload_event, ath10k_rx_payload,
+             TP_PROTO(struct ath10k *ar, void *data, size_t len),
+             TP_ARGS(ar, data, len)
+);
+
+TRACE_EVENT(ath10k_htt_rx_desc,
+            TP_PROTO(struct ath10k *ar, void *data, size_t len),
+
+        TP_ARGS(ar, data, len),
+
+        TP_STRUCT__entry(
+                __string(device, dev_name(ar->dev))
+                __string(driver, dev_driver_string(ar->dev))
+                __field(u16, len)
+                __dynamic_array(u8, rxdesc, len)
+        ),
+
+        TP_fast_assign(
+                __assign_str(device, dev_name(ar->dev));
+                __assign_str(driver, dev_driver_string(ar->dev));
+                __entry->len = len;
+                memcpy(__get_dynamic_array(rxdesc), data, len);
+        ),
+
+        TP_printk(
+                "%s %s rxdesc len %d",
+                __get_str(driver),
+                __get_str(device),
+                __entry->len
+         )
+);
+
 #endif /* _TRACE_H_ || TRACE_HEADER_MULTI_READ*/
 
 /* we don't want to use include/trace/events */
diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c
index a0cbc21d0d4b..7579de8e7a8c 100644
--- a/drivers/net/wireless/ath/ath10k/txrx.c
+++ b/drivers/net/wireless/ath/ath10k/txrx.c
@@ -78,6 +78,7 @@ void ath10k_txrx_tx_unref(struct ath10k_htt *htt,
 
         info = IEEE80211_SKB_CB(msdu);
         memset(&info->status, 0, sizeof(info->status));
+        trace_ath10k_txrx_tx_unref(ar, tx_done->msdu_id);
 
         if (tx_done->discard) {
                 ieee80211_free_txskb(htt->ar->hw, msdu);
@@ -145,7 +146,8 @@ static int ath10k_wait_for_peer_common(struct ath10k *ar, int vdev_id,
                         mapped = !!ath10k_peer_find(ar, vdev_id, addr);
                         spin_unlock_bh(&ar->data_lock);
 
-                        mapped == expect_mapped;
+                        (mapped == expect_mapped ||
+                         test_bit(ATH10K_FLAG_CRASH_FLUSH, &ar->dev_flags));
                 }), 3*HZ);
 
         if (ret <= 0)
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index 2c42bd504b79..c2bc8282f6cb 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -609,6 +609,40 @@ static struct wmi_cmd_map wmi_10_2_cmd_map = {
         .gpio_output_cmdid = WMI_10_2_GPIO_OUTPUT_CMDID,
 };
 
+static void
+ath10k_wmi_put_wmi_channel(struct wmi_channel *ch,
+                           const struct wmi_channel_arg *arg)
+{
+        u32 flags = 0;
+
+        memset(ch, 0, sizeof(*ch));
+
+        if (arg->passive)
+                flags |= WMI_CHAN_FLAG_PASSIVE;
+        if (arg->allow_ibss)
+                flags |= WMI_CHAN_FLAG_ADHOC_ALLOWED;
+        if (arg->allow_ht)
+                flags |= WMI_CHAN_FLAG_ALLOW_HT;
+        if (arg->allow_vht)
+                flags |= WMI_CHAN_FLAG_ALLOW_VHT;
+        if (arg->ht40plus)
+                flags |= WMI_CHAN_FLAG_HT40_PLUS;
+        if (arg->chan_radar)
+                flags |= WMI_CHAN_FLAG_DFS;
+
+        ch->mhz = __cpu_to_le32(arg->freq);
+        ch->band_center_freq1 = __cpu_to_le32(arg->band_center_freq1);
+        ch->band_center_freq2 = 0;
+        ch->min_power = arg->min_power;
+        ch->max_power = arg->max_power;
+        ch->reg_power = arg->max_reg_power;
+        ch->antenna_max = arg->max_antenna_gain;
+
+        /* mode & flags share storage */
+        ch->mode = arg->mode;
+        ch->flags |= __cpu_to_le32(flags);
+}
+
 int ath10k_wmi_wait_for_service_ready(struct ath10k *ar)
 {
         int ret;
@@ -745,6 +779,10 @@ int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id)
                 ath10k_wmi_tx_beacons_nowait(ar);
 
                 ret = ath10k_wmi_cmd_send_nowait(ar, skb, cmd_id);
+
+                if (ret && test_bit(ATH10K_FLAG_CRASH_FLUSH, &ar->dev_flags))
+                        ret = -ESHUTDOWN;
+
                 (ret != -EAGAIN);
         }), 3*HZ);
 
@@ -800,6 +838,8 @@ int ath10k_wmi_mgmt_tx(struct ath10k *ar, struct sk_buff *skb)
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi mgmt tx skb %p len %d ftype %02x stype %02x\n",
                    wmi_skb, wmi_skb->len, fc & IEEE80211_FCTL_FTYPE,
                    fc & IEEE80211_FCTL_STYPE);
+        trace_ath10k_tx_hdr(ar, skb->data, skb->len);
+        trace_ath10k_tx_payload(ar, skb->data, skb->len);
 
         /* Send the management frame buffer to the target */
         ret = ath10k_wmi_cmd_send(ar, wmi_skb, ar->wmi.cmd->mgmt_tx_cmdid);
@@ -1079,7 +1119,6 @@ static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
         struct wmi_mgmt_rx_event_v2 *ev_v2;
         struct wmi_mgmt_rx_hdr_v1 *ev_hdr;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
-        struct ieee80211_channel *ch;
         struct ieee80211_hdr *hdr;
         u32 rx_status;
         u32 channel;
@@ -1132,25 +1171,26 @@ static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
         if (rx_status & WMI_RX_STATUS_ERR_MIC)
                 status->flag |= RX_FLAG_MMIC_ERROR;
 
-        /* HW can Rx CCK rates on 5GHz. In that case phy_mode is set to
+        /* Hardware can Rx CCK rates on 5GHz. In that case phy_mode is set to
          * MODE_11B. This means phy_mode is not a reliable source for the band
-         * of mgmt rx. */
-
-        ch = ar->scan_channel;
-        if (!ch)
-                ch = ar->rx_channel;
-
-        if (ch) {
-                status->band = ch->band;
-
-                if (phy_mode == MODE_11B &&
-                    status->band == IEEE80211_BAND_5GHZ)
-                        ath10k_dbg(ar, ATH10K_DBG_MGMT, "wmi mgmt rx 11b (CCK) on 5GHz\n");
+         * of mgmt rx.
+         */
+        if (channel >= 1 && channel <= 14) {
+                status->band = IEEE80211_BAND_2GHZ;
+        } else if (channel >= 36 && channel <= 165) {
+                status->band = IEEE80211_BAND_5GHZ;
         } else {
-                ath10k_warn(ar, "using (unreliable) phy_mode to extract band for mgmt rx\n");
-                status->band = phy_mode_to_band(phy_mode);
+                /* Shouldn't happen unless list of advertised channels to
+                 * mac80211 has been changed.
+                 */
+                WARN_ON_ONCE(1);
+                dev_kfree_skb(skb);
+                return 0;
         }
 
+        if (phy_mode == MODE_11B && status->band == IEEE80211_BAND_5GHZ)
+                ath10k_dbg(ar, ATH10K_DBG_MGMT, "wmi mgmt rx 11b (CCK) on 5GHz\n");
+
         status->freq = ieee80211_channel_to_frequency(channel, status->band);
         status->signal = snr + ATH10K_DEFAULT_NOISE_FLOOR;
         status->rate_idx = get_rate_idx(rate, status->band);
@@ -1295,14 +1335,196 @@ static int ath10k_wmi_event_debug_mesg(struct ath10k *ar, struct sk_buff *skb)
         return 0;
 }
 
+static void ath10k_wmi_pull_pdev_stats(const struct wmi_pdev_stats *src,
+                                       struct ath10k_fw_stats_pdev *dst)
+{
+        const struct wal_dbg_tx_stats *tx = &src->wal.tx;
+        const struct wal_dbg_rx_stats *rx = &src->wal.rx;
+
+        dst->ch_noise_floor = __le32_to_cpu(src->chan_nf);
+        dst->tx_frame_count = __le32_to_cpu(src->tx_frame_count);
+        dst->rx_frame_count = __le32_to_cpu(src->rx_frame_count);
+        dst->rx_clear_count = __le32_to_cpu(src->rx_clear_count);
+        dst->cycle_count = __le32_to_cpu(src->cycle_count);
+        dst->phy_err_count = __le32_to_cpu(src->phy_err_count);
+        dst->chan_tx_power = __le32_to_cpu(src->chan_tx_pwr);
+
+        dst->comp_queued = __le32_to_cpu(tx->comp_queued);
+        dst->comp_delivered = __le32_to_cpu(tx->comp_delivered);
+        dst->msdu_enqued = __le32_to_cpu(tx->msdu_enqued);
+        dst->mpdu_enqued = __le32_to_cpu(tx->mpdu_enqued);
+        dst->wmm_drop = __le32_to_cpu(tx->wmm_drop);
+        dst->local_enqued = __le32_to_cpu(tx->local_enqued);
+        dst->local_freed = __le32_to_cpu(tx->local_freed);
+        dst->hw_queued = __le32_to_cpu(tx->hw_queued);
+        dst->hw_reaped = __le32_to_cpu(tx->hw_reaped);
+        dst->underrun = __le32_to_cpu(tx->underrun);
+        dst->tx_abort = __le32_to_cpu(tx->tx_abort);
+        dst->mpdus_requed = __le32_to_cpu(tx->mpdus_requed);
+        dst->tx_ko = __le32_to_cpu(tx->tx_ko);
+        dst->data_rc = __le32_to_cpu(tx->data_rc);
+        dst->self_triggers = __le32_to_cpu(tx->self_triggers);
+        dst->sw_retry_failure = __le32_to_cpu(tx->sw_retry_failure);
+        dst->illgl_rate_phy_err = __le32_to_cpu(tx->illgl_rate_phy_err);
+        dst->pdev_cont_xretry = __le32_to_cpu(tx->pdev_cont_xretry);
+        dst->pdev_tx_timeout = __le32_to_cpu(tx->pdev_tx_timeout);
+        dst->pdev_resets = __le32_to_cpu(tx->pdev_resets);
+        dst->phy_underrun = __le32_to_cpu(tx->phy_underrun);
+        dst->txop_ovf = __le32_to_cpu(tx->txop_ovf);
+
+        dst->mid_ppdu_route_change = __le32_to_cpu(rx->mid_ppdu_route_change);
+        dst->status_rcvd = __le32_to_cpu(rx->status_rcvd);
+        dst->r0_frags = __le32_to_cpu(rx->r0_frags);
+        dst->r1_frags = __le32_to_cpu(rx->r1_frags);
+        dst->r2_frags = __le32_to_cpu(rx->r2_frags);
+        dst->r3_frags = __le32_to_cpu(rx->r3_frags);
+        dst->htt_msdus = __le32_to_cpu(rx->htt_msdus);
+        dst->htt_mpdus = __le32_to_cpu(rx->htt_mpdus);
+        dst->loc_msdus = __le32_to_cpu(rx->loc_msdus);
+        dst->loc_mpdus = __le32_to_cpu(rx->loc_mpdus);
+        dst->oversize_amsdu = __le32_to_cpu(rx->oversize_amsdu);
+        dst->phy_errs = __le32_to_cpu(rx->phy_errs);
+        dst->phy_err_drop = __le32_to_cpu(rx->phy_err_drop);
+        dst->mpdu_errs = __le32_to_cpu(rx->mpdu_errs);
+}
+
+static void ath10k_wmi_pull_peer_stats(const struct wmi_peer_stats *src,
+                                       struct ath10k_fw_stats_peer *dst)
+{
+        ether_addr_copy(dst->peer_macaddr, src->peer_macaddr.addr);
+        dst->peer_rssi = __le32_to_cpu(src->peer_rssi);
+        dst->peer_tx_rate = __le32_to_cpu(src->peer_tx_rate);
+}
+
+static int ath10k_wmi_main_pull_fw_stats(struct ath10k *ar,
+                                         struct sk_buff *skb,
+                                         struct ath10k_fw_stats *stats)
+{
+        const struct wmi_stats_event *ev = (void *)skb->data;
+        u32 num_pdev_stats, num_vdev_stats, num_peer_stats;
+        int i;
+
+        if (!skb_pull(skb, sizeof(*ev)))
+                return -EPROTO;
+
+        num_pdev_stats = __le32_to_cpu(ev->num_pdev_stats);
+        num_vdev_stats = __le32_to_cpu(ev->num_vdev_stats);
+        num_peer_stats = __le32_to_cpu(ev->num_peer_stats);
+
+        for (i = 0; i < num_pdev_stats; i++) {
+                const struct wmi_pdev_stats *src;
+                struct ath10k_fw_stats_pdev *dst;
+
+                src = (void *)skb->data;
+                if (!skb_pull(skb, sizeof(*src)))
+                        return -EPROTO;
+
+                dst = kzalloc(sizeof(*dst), GFP_ATOMIC);
+                if (!dst)
+                        continue;
+
+                ath10k_wmi_pull_pdev_stats(src, dst);
+                list_add_tail(&dst->list, &stats->pdevs);
+        }
+
+        /* fw doesn't implement vdev stats */
+
+        for (i = 0; i < num_peer_stats; i++) {
+                const struct wmi_peer_stats *src;
+                struct ath10k_fw_stats_peer *dst;
+
+                src = (void *)skb->data;
+                if (!skb_pull(skb, sizeof(*src)))
+                        return -EPROTO;
+
+                dst = kzalloc(sizeof(*dst), GFP_ATOMIC);
+                if (!dst)
+                        continue;
+
+                ath10k_wmi_pull_peer_stats(src, dst);
+                list_add_tail(&dst->list, &stats->peers);
+        }
+
+        return 0;
+}
+
+static int ath10k_wmi_10x_pull_fw_stats(struct ath10k *ar,
+                                        struct sk_buff *skb,
+                                        struct ath10k_fw_stats *stats)
+{
+        const struct wmi_stats_event *ev = (void *)skb->data;
+        u32 num_pdev_stats, num_vdev_stats, num_peer_stats;
+        int i;
+
+        if (!skb_pull(skb, sizeof(*ev)))
+                return -EPROTO;
+
+        num_pdev_stats = __le32_to_cpu(ev->num_pdev_stats);
+        num_vdev_stats = __le32_to_cpu(ev->num_vdev_stats);
+        num_peer_stats = __le32_to_cpu(ev->num_peer_stats);
+
+        for (i = 0; i < num_pdev_stats; i++) {
+                const struct wmi_10x_pdev_stats *src;
+                struct ath10k_fw_stats_pdev *dst;
+
+                src = (void *)skb->data;
+                if (!skb_pull(skb, sizeof(*src)))
+                        return -EPROTO;
+
+                dst = kzalloc(sizeof(*dst), GFP_ATOMIC);
+                if (!dst)
+                        continue;
+
+                ath10k_wmi_pull_pdev_stats(&src->old, dst);
+
+                dst->ack_rx_bad = __le32_to_cpu(src->ack_rx_bad);
+                dst->rts_bad = __le32_to_cpu(src->rts_bad);
+                dst->rts_good = __le32_to_cpu(src->rts_good);
+                dst->fcs_bad = __le32_to_cpu(src->fcs_bad);
+                dst->no_beacons = __le32_to_cpu(src->no_beacons);
+                dst->mib_int_count = __le32_to_cpu(src->mib_int_count);
+
+                list_add_tail(&dst->list, &stats->pdevs);
+        }
+
+        /* fw doesn't implement vdev stats */
+
+        for (i = 0; i < num_peer_stats; i++) {
+                const struct wmi_10x_peer_stats *src;
+                struct ath10k_fw_stats_peer *dst;
+
+                src = (void *)skb->data;
+                if (!skb_pull(skb, sizeof(*src)))
+                        return -EPROTO;
+
+                dst = kzalloc(sizeof(*dst), GFP_ATOMIC);
+                if (!dst)
+                        continue;
+
+                ath10k_wmi_pull_peer_stats(&src->old, dst);
+
+                dst->peer_rx_rate = __le32_to_cpu(src->peer_rx_rate);
+
+                list_add_tail(&dst->list, &stats->peers);
+        }
+
+        return 0;
+}
+
+int ath10k_wmi_pull_fw_stats(struct ath10k *ar, struct sk_buff *skb,
+                             struct ath10k_fw_stats *stats)
+{
+        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features))
+                return ath10k_wmi_10x_pull_fw_stats(ar, skb, stats);
+        else
+                return ath10k_wmi_main_pull_fw_stats(ar, skb, stats);
+}
+
 static void ath10k_wmi_event_update_stats(struct ath10k *ar,
                                           struct sk_buff *skb)
 {
-        struct wmi_stats_event *ev = (struct wmi_stats_event *)skb->data;
-
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_UPDATE_STATS_EVENTID\n");
-
-        ath10k_debug_read_target_stats(ar, ev);
+        ath10k_debug_fw_stats_process(ar, skb);
 }
 
 static void ath10k_wmi_event_vdev_start_resp(struct ath10k *ar,
@@ -1579,6 +1801,7 @@ static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
         struct wmi_bcn_info *bcn_info;
         struct ath10k_vif *arvif;
         struct sk_buff *bcn;
+        dma_addr_t paddr;
         int ret, vdev_id = 0;
 
         ev = (struct wmi_host_swba_event *)skb->data;
@@ -1647,27 +1870,37 @@ static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
                                 ath10k_warn(ar, "SWBA overrun on vdev %d\n",
                                             arvif->vdev_id);
 
-                        dma_unmap_single(arvif->ar->dev,
-                                         ATH10K_SKB_CB(arvif->beacon)->paddr,
-                                         arvif->beacon->len, DMA_TO_DEVICE);
-                        dev_kfree_skb_any(arvif->beacon);
-                        arvif->beacon = NULL;
+                        ath10k_mac_vif_beacon_free(arvif);
                 }
 
-                ATH10K_SKB_CB(bcn)->paddr = dma_map_single(arvif->ar->dev,
-                                                           bcn->data, bcn->len,
-                                                           DMA_TO_DEVICE);
-                ret = dma_mapping_error(arvif->ar->dev,
-                                        ATH10K_SKB_CB(bcn)->paddr);
-                if (ret) {
-                        ath10k_warn(ar, "failed to map beacon: %d\n", ret);
-                        dev_kfree_skb_any(bcn);
-                        goto skip;
+                if (!arvif->beacon_buf) {
+                        paddr = dma_map_single(arvif->ar->dev, bcn->data,
+                                               bcn->len, DMA_TO_DEVICE);
+                        ret = dma_mapping_error(arvif->ar->dev, paddr);
+                        if (ret) {
+                                ath10k_warn(ar, "failed to map beacon: %d\n",
+                                            ret);
+                                dev_kfree_skb_any(bcn);
+                                goto skip;
+                        }
+
+                        ATH10K_SKB_CB(bcn)->paddr = paddr;
+                } else {
+                        if (bcn->len > IEEE80211_MAX_FRAME_LEN) {
+                                ath10k_warn(ar, "trimming beacon %d -> %d bytes!\n",
+                                            bcn->len, IEEE80211_MAX_FRAME_LEN);
+                                skb_trim(bcn, IEEE80211_MAX_FRAME_LEN);
+                        }
+                        memcpy(arvif->beacon_buf, bcn->data, bcn->len);
+                        ATH10K_SKB_CB(bcn)->paddr = arvif->beacon_paddr;
                 }
 
                 arvif->beacon = bcn;
                 arvif->beacon_sent = false;
 
+                trace_ath10k_tx_hdr(ar, bcn->data, bcn->len);
+                trace_ath10k_tx_payload(ar, bcn->data, bcn->len);
+
                 ath10k_wmi_tx_beacon_nowait(arvif);
 skip:
                 spin_unlock_bh(&ar->data_lock);
@@ -1681,8 +1914,8 @@ static void ath10k_wmi_event_tbttoffset_update(struct ath10k *ar,
 }
 
 static void ath10k_dfs_radar_report(struct ath10k *ar,
-                                    struct wmi_single_phyerr_rx_event *event,
-                                    struct phyerr_radar_report *rr,
+                                    const struct wmi_phyerr *phyerr,
+                                    const struct phyerr_radar_report *rr,
                                     u64 tsf)
 {
         u32 reg0, reg1, tsf32l;
@@ -1715,12 +1948,12 @@ static void ath10k_dfs_radar_report(struct ath10k *ar,
                 return;
 
         /* report event to DFS pattern detector */
-        tsf32l = __le32_to_cpu(event->hdr.tsf_timestamp);
+        tsf32l = __le32_to_cpu(phyerr->tsf_timestamp);
         tsf64 = tsf & (~0xFFFFFFFFULL);
         tsf64 |= tsf32l;
 
         width = MS(reg1, RADAR_REPORT_REG1_PULSE_DUR);
-        rssi = event->hdr.rssi_combined;
+        rssi = phyerr->rssi_combined;
 
         /* hardware store this as 8 bit signed value,
          * set to zero if negative number
@@ -1759,8 +1992,8 @@ static void ath10k_dfs_radar_report(struct ath10k *ar,
 }
 
 static int ath10k_dfs_fft_report(struct ath10k *ar,
-                                 struct wmi_single_phyerr_rx_event *event,
-                                 struct phyerr_fft_report *fftr,
+                                 const struct wmi_phyerr *phyerr,
+                                 const struct phyerr_fft_report *fftr,
                                  u64 tsf)
 {
         u32 reg0, reg1;
@@ -1768,7 +2001,7 @@ static int ath10k_dfs_fft_report(struct ath10k *ar,
 
         reg0 = __le32_to_cpu(fftr->reg0);
         reg1 = __le32_to_cpu(fftr->reg1);
-        rssi = event->hdr.rssi_combined;
+        rssi = phyerr->rssi_combined;
 
         ath10k_dbg(ar, ATH10K_DBG_REGULATORY,
                    "wmi phyerr fft report total_gain_db %d base_pwr_db %d fft_chn_idx %d peak_sidx %d\n",
@@ -1797,20 +2030,20 @@ static int ath10k_dfs_fft_report(struct ath10k *ar,
 }
 
 static void ath10k_wmi_event_dfs(struct ath10k *ar,
-                                 struct wmi_single_phyerr_rx_event *event,
+                                 const struct wmi_phyerr *phyerr,
                                  u64 tsf)
 {
         int buf_len, tlv_len, res, i = 0;
-        struct phyerr_tlv *tlv;
-        struct phyerr_radar_report *rr;
-        struct phyerr_fft_report *fftr;
-        u8 *tlv_buf;
+        const struct phyerr_tlv *tlv;
+        const struct phyerr_radar_report *rr;
+        const struct phyerr_fft_report *fftr;
+        const u8 *tlv_buf;
 
-        buf_len = __le32_to_cpu(event->hdr.buf_len);
+        buf_len = __le32_to_cpu(phyerr->buf_len);
         ath10k_dbg(ar, ATH10K_DBG_REGULATORY,
                    "wmi event dfs err_code %d rssi %d tsfl 0x%X tsf64 0x%llX len %d\n",
-                   event->hdr.phy_err_code, event->hdr.rssi_combined,
-                   __le32_to_cpu(event->hdr.tsf_timestamp), tsf, buf_len);
+                   phyerr->phy_err_code, phyerr->rssi_combined,
+                   __le32_to_cpu(phyerr->tsf_timestamp), tsf, buf_len);
 
         /* Skip event if DFS disabled */
         if (!config_enabled(CONFIG_ATH10K_DFS_CERTIFIED))
@@ -1825,9 +2058,9 @@ static void ath10k_wmi_event_dfs(struct ath10k *ar,
                         return;
                 }
 
-                tlv = (struct phyerr_tlv *)&event->bufp[i];
+                tlv = (struct phyerr_tlv *)&phyerr->buf[i];
                 tlv_len = __le16_to_cpu(tlv->len);
-                tlv_buf = &event->bufp[i + sizeof(*tlv)];
+                tlv_buf = &phyerr->buf[i + sizeof(*tlv)];
                 ath10k_dbg(ar, ATH10K_DBG_REGULATORY,
                            "wmi event dfs tlv_len %d tlv_tag 0x%02X tlv_sig 0x%02X\n",
                            tlv_len, tlv->tag, tlv->sig);
@@ -1841,7 +2074,7 @@ static void ath10k_wmi_event_dfs(struct ath10k *ar,
                         }
 
                         rr = (struct phyerr_radar_report *)tlv_buf;
-                        ath10k_dfs_radar_report(ar, event, rr, tsf);
+                        ath10k_dfs_radar_report(ar, phyerr, rr, tsf);
                         break;
                 case PHYERR_TLV_TAG_SEARCH_FFT_REPORT:
                         if (i + sizeof(*tlv) + sizeof(*fftr) > buf_len) {
@@ -1851,7 +2084,7 @@ static void ath10k_wmi_event_dfs(struct ath10k *ar,
                         }
 
                         fftr = (struct phyerr_fft_report *)tlv_buf;
-                        res = ath10k_dfs_fft_report(ar, event, fftr, tsf);
+                        res = ath10k_dfs_fft_report(ar, phyerr, fftr, tsf);
                         if (res)
                                 return;
                         break;
@@ -1863,16 +2096,16 @@ static void ath10k_wmi_event_dfs(struct ath10k *ar,
 
 static void
 ath10k_wmi_event_spectral_scan(struct ath10k *ar,
-                               struct wmi_single_phyerr_rx_event *event,
+                               const struct wmi_phyerr *phyerr,
                                u64 tsf)
 {
         int buf_len, tlv_len, res, i = 0;
         struct phyerr_tlv *tlv;
-        u8 *tlv_buf;
-        struct phyerr_fft_report *fftr;
+        const void *tlv_buf;
+        const struct phyerr_fft_report *fftr;
         size_t fftr_len;
 
-        buf_len = __le32_to_cpu(event->hdr.buf_len);
+        buf_len = __le32_to_cpu(phyerr->buf_len);
 
         while (i < buf_len) {
                 if (i + sizeof(*tlv) > buf_len) {
@@ -1881,9 +2114,9 @@ ath10k_wmi_event_spectral_scan(struct ath10k *ar,
                         return;
                 }
 
-                tlv = (struct phyerr_tlv *)&event->bufp[i];
+                tlv = (struct phyerr_tlv *)&phyerr->buf[i];
                 tlv_len = __le16_to_cpu(tlv->len);
-                tlv_buf = &event->bufp[i + sizeof(*tlv)];
+                tlv_buf = &phyerr->buf[i + sizeof(*tlv)];
 
                 if (i + sizeof(*tlv) + tlv_len > buf_len) {
                         ath10k_warn(ar, "failed to parse phyerr tlv payload at byte %d\n",
@@ -1900,8 +2133,8 @@ ath10k_wmi_event_spectral_scan(struct ath10k *ar,
                         }
 
                         fftr_len = tlv_len - sizeof(*fftr);
-                        fftr = (struct phyerr_fft_report *)tlv_buf;
-                        res = ath10k_spectral_process_fft(ar, event,
+                        fftr = tlv_buf;
+                        res = ath10k_spectral_process_fft(ar, phyerr,
                                                           fftr, fftr_len,
                                                           tsf);
                         if (res < 0) {
@@ -1918,8 +2151,8 @@ ath10k_wmi_event_spectral_scan(struct ath10k *ar,
 
 static void ath10k_wmi_event_phyerr(struct ath10k *ar, struct sk_buff *skb)
 {
-        struct wmi_comb_phyerr_rx_event *comb_event;
-        struct wmi_single_phyerr_rx_event *event;
+        const struct wmi_phyerr_event *ev;
+        const struct wmi_phyerr *phyerr;
         u32 count, i, buf_len, phy_err_code;
         u64 tsf;
         int left_len = skb->len;
@@ -1927,38 +2160,38 @@ static void ath10k_wmi_event_phyerr(struct ath10k *ar, struct sk_buff *skb)
         ATH10K_DFS_STAT_INC(ar, phy_errors);
 
         /* Check if combined event available */
-        if (left_len < sizeof(*comb_event)) {
+        if (left_len < sizeof(*ev)) {
                 ath10k_warn(ar, "wmi phyerr combined event wrong len\n");
                 return;
         }
 
-        left_len -= sizeof(*comb_event);
+        left_len -= sizeof(*ev);
 
         /* Check number of included events */
-        comb_event = (struct wmi_comb_phyerr_rx_event *)skb->data;
-        count = __le32_to_cpu(comb_event->hdr.num_phyerr_events);
+        ev = (const struct wmi_phyerr_event *)skb->data;
+        count = __le32_to_cpu(ev->num_phyerrs);
 
-        tsf = __le32_to_cpu(comb_event->hdr.tsf_u32);
+        tsf = __le32_to_cpu(ev->tsf_u32);
         tsf <<= 32;
-        tsf |= __le32_to_cpu(comb_event->hdr.tsf_l32);
+        tsf |= __le32_to_cpu(ev->tsf_l32);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi event phyerr count %d tsf64 0x%llX\n",
                    count, tsf);
 
-        event = (struct wmi_single_phyerr_rx_event *)comb_event->bufp;
+        phyerr = ev->phyerrs;
         for (i = 0; i < count; i++) {
                 /* Check if we can read event header */
-                if (left_len < sizeof(*event)) {
+                if (left_len < sizeof(*phyerr)) {
                         ath10k_warn(ar, "single event (%d) wrong head len\n",
                                     i);
                         return;
                 }
 
-                left_len -= sizeof(*event);
+                left_len -= sizeof(*phyerr);
 
-                buf_len = __le32_to_cpu(event->hdr.buf_len);
-                phy_err_code = event->hdr.phy_err_code;
+                buf_len = __le32_to_cpu(phyerr->buf_len);
+                phy_err_code = phyerr->phy_err_code;
 
                 if (left_len < buf_len) {
                         ath10k_warn(ar, "single event (%d) wrong buf len\n", i);
@@ -1969,20 +2202,20 @@ static void ath10k_wmi_event_phyerr(struct ath10k *ar, struct sk_buff *skb)
 
                 switch (phy_err_code) {
                 case PHY_ERROR_RADAR:
-                        ath10k_wmi_event_dfs(ar, event, tsf);
+                        ath10k_wmi_event_dfs(ar, phyerr, tsf);
                         break;
                 case PHY_ERROR_SPECTRAL_SCAN:
-                        ath10k_wmi_event_spectral_scan(ar, event, tsf);
+                        ath10k_wmi_event_spectral_scan(ar, phyerr, tsf);
                         break;
                 case PHY_ERROR_FALSE_RADAR_EXT:
-                        ath10k_wmi_event_dfs(ar, event, tsf);
-                        ath10k_wmi_event_spectral_scan(ar, event, tsf);
+                        ath10k_wmi_event_dfs(ar, phyerr, tsf);
+                        ath10k_wmi_event_spectral_scan(ar, phyerr, tsf);
                         break;
                 default:
                         break;
                 }
 
-                event += sizeof(*event) + buf_len;
+                phyerr = (void *)phyerr + sizeof(*phyerr) + buf_len;
         }
 }
 
@@ -2163,30 +2396,113 @@ static int ath10k_wmi_alloc_host_mem(struct ath10k *ar, u32 req_id,
         return 0;
 }
 
-static void ath10k_wmi_service_ready_event_rx(struct ath10k *ar,
-                                              struct sk_buff *skb)
+static int ath10k_wmi_main_pull_svc_rdy_ev(struct sk_buff *skb,
+                                           struct wmi_svc_rdy_ev_arg *arg)
 {
-        struct wmi_service_ready_event *ev = (void *)skb->data;
+        struct wmi_service_ready_event *ev;
+        size_t i, n;
+
+        if (skb->len < sizeof(*ev))
+                return -EPROTO;
+
+        ev = (void *)skb->data;
+        skb_pull(skb, sizeof(*ev));
+        arg->min_tx_power = ev->hw_min_tx_power;
+        arg->max_tx_power = ev->hw_max_tx_power;
+        arg->ht_cap = ev->ht_cap_info;
+        arg->vht_cap = ev->vht_cap_info;
+        arg->sw_ver0 = ev->sw_version;
+        arg->sw_ver1 = ev->sw_version_1;
+        arg->phy_capab = ev->phy_capability;
+        arg->num_rf_chains = ev->num_rf_chains;
+        arg->eeprom_rd = ev->hal_reg_capabilities.eeprom_rd;
+        arg->num_mem_reqs = ev->num_mem_reqs;
+        arg->service_map = ev->wmi_service_bitmap;
+
+        n = min_t(size_t, __le32_to_cpu(arg->num_mem_reqs),
+                  ARRAY_SIZE(arg->mem_reqs));
+        for (i = 0; i < n; i++)
+                arg->mem_reqs[i] = &ev->mem_reqs[i];
+
+        if (skb->len <
+            __le32_to_cpu(arg->num_mem_reqs) * sizeof(arg->mem_reqs[0]))
+                return -EPROTO;
+
+        return 0;
+}
+
+static int ath10k_wmi_10x_pull_svc_rdy_ev(struct sk_buff *skb,
+                                          struct wmi_svc_rdy_ev_arg *arg)
+{
+        struct wmi_10x_service_ready_event *ev;
+        int i, n;
+
+        if (skb->len < sizeof(*ev))
+                return -EPROTO;
+
+        ev = (void *)skb->data;
+        skb_pull(skb, sizeof(*ev));
+        arg->min_tx_power = ev->hw_min_tx_power;
+        arg->max_tx_power = ev->hw_max_tx_power;
+        arg->ht_cap = ev->ht_cap_info;
+        arg->vht_cap = ev->vht_cap_info;
+        arg->sw_ver0 = ev->sw_version;
+        arg->phy_capab = ev->phy_capability;
+        arg->num_rf_chains = ev->num_rf_chains;
+        arg->eeprom_rd = ev->hal_reg_capabilities.eeprom_rd;
+        arg->num_mem_reqs = ev->num_mem_reqs;
+        arg->service_map = ev->wmi_service_bitmap;
+
+        n = min_t(size_t, __le32_to_cpu(arg->num_mem_reqs),
+                  ARRAY_SIZE(arg->mem_reqs));
+        for (i = 0; i < n; i++)
+                arg->mem_reqs[i] = &ev->mem_reqs[i];
+
+        if (skb->len <
+            __le32_to_cpu(arg->num_mem_reqs) * sizeof(arg->mem_reqs[0]))
+                return -EPROTO;
+
+        return 0;
+}
+
+static void ath10k_wmi_event_service_ready(struct ath10k *ar,
+                                           struct sk_buff *skb)
+{
+        struct wmi_svc_rdy_ev_arg arg = {};
+        u32 num_units, req_id, unit_size, num_mem_reqs, num_unit_info, i;
         DECLARE_BITMAP(svc_bmap, WMI_SERVICE_MAX) = {};
+        int ret;
+
+        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
+                ret = ath10k_wmi_10x_pull_svc_rdy_ev(skb, &arg);
+                wmi_10x_svc_map(arg.service_map, svc_bmap);
+        } else {
+                ret = ath10k_wmi_main_pull_svc_rdy_ev(skb, &arg);
+                wmi_main_svc_map(arg.service_map, svc_bmap);
+        }
 
-        if (skb->len < sizeof(*ev)) {
-                ath10k_warn(ar, "Service ready event was %d B but expected %zu B. Wrong firmware version?\n",
-                            skb->len, sizeof(*ev));
+        if (ret) {
+                ath10k_warn(ar, "failed to parse service ready: %d\n", ret);
                 return;
         }
 
-        ar->hw_min_tx_power = __le32_to_cpu(ev->hw_min_tx_power);
-        ar->hw_max_tx_power = __le32_to_cpu(ev->hw_max_tx_power);
-        ar->ht_cap_info = __le32_to_cpu(ev->ht_cap_info);
-        ar->vht_cap_info = __le32_to_cpu(ev->vht_cap_info);
+        ar->hw_min_tx_power = __le32_to_cpu(arg.min_tx_power);
+        ar->hw_max_tx_power = __le32_to_cpu(arg.max_tx_power);
+        ar->ht_cap_info = __le32_to_cpu(arg.ht_cap);
+        ar->vht_cap_info = __le32_to_cpu(arg.vht_cap);
         ar->fw_version_major =
-                (__le32_to_cpu(ev->sw_version) & 0xff000000) >> 24;
-        ar->fw_version_minor = (__le32_to_cpu(ev->sw_version) & 0x00ffffff);
+                (__le32_to_cpu(arg.sw_ver0) & 0xff000000) >> 24;
+        ar->fw_version_minor = (__le32_to_cpu(arg.sw_ver0) & 0x00ffffff);
         ar->fw_version_release =
-                (__le32_to_cpu(ev->sw_version_1) & 0xffff0000) >> 16;
-        ar->fw_version_build = (__le32_to_cpu(ev->sw_version_1) & 0x0000ffff);
-        ar->phy_capability = __le32_to_cpu(ev->phy_capability);
-        ar->num_rf_chains = __le32_to_cpu(ev->num_rf_chains);
+                (__le32_to_cpu(arg.sw_ver1) & 0xffff0000) >> 16;
+        ar->fw_version_build = (__le32_to_cpu(arg.sw_ver1) & 0x0000ffff);
+        ar->phy_capability = __le32_to_cpu(arg.phy_capab);
+        ar->num_rf_chains = __le32_to_cpu(arg.num_rf_chains);
+        ar->ath_common.regulatory.current_rd = __le32_to_cpu(arg.eeprom_rd);
+
+        ath10k_debug_read_service_map(ar, svc_bmap, sizeof(svc_bmap));
+        ath10k_dbg_dump(ar, ATH10K_DBG_WMI, NULL, "wmi svc: ",
+                        arg.service_map, sizeof(arg.service_map));
 
         /* only manually set fw features when not using FW IE format */
         if (ar->fw_api == 1 && ar->fw_version_build > 636)
@@ -2198,13 +2514,8 @@ static void ath10k_wmi_service_ready_event_rx(struct ath10k *ar,
                 ar->num_rf_chains = WMI_MAX_SPATIAL_STREAM;
         }
 
-        ar->ath_common.regulatory.current_rd =
-                __le32_to_cpu(ev->hal_reg_capabilities.eeprom_rd);
-
-        wmi_main_svc_map(ev->wmi_service_bitmap, svc_bmap);
-        ath10k_debug_read_service_map(ar, svc_bmap, sizeof(svc_bmap));
-        ath10k_dbg_dump(ar, ATH10K_DBG_WMI, NULL, "wmi svc: ",
-                        ev->wmi_service_bitmap, sizeof(ev->wmi_service_bitmap));
+        ar->supp_tx_chainmask = (1 << ar->num_rf_chains) - 1;
+        ar->supp_rx_chainmask = (1 << ar->num_rf_chains) - 1;
 
         if (strlen(ar->hw->wiphy->fw_version) == 0) {
                 snprintf(ar->hw->wiphy->fw_version,
@@ -2216,93 +2527,18 @@ static void ath10k_wmi_service_ready_event_rx(struct ath10k *ar,
                          ar->fw_version_build);
         }
 
-        /* FIXME: it probably should be better to support this */
-        if (__le32_to_cpu(ev->num_mem_reqs) > 0) {
-                ath10k_warn(ar, "target requested %d memory chunks; ignoring\n",
-                            __le32_to_cpu(ev->num_mem_reqs));
-        }
-
-        ath10k_dbg(ar, ATH10K_DBG_WMI,
-                   "wmi event service ready sw_ver 0x%08x sw_ver1 0x%08x abi_ver %u phy_cap 0x%08x ht_cap 0x%08x vht_cap 0x%08x vht_supp_msc 0x%08x sys_cap_info 0x%08x mem_reqs %u num_rf_chains %u\n",
-                   __le32_to_cpu(ev->sw_version),
-                   __le32_to_cpu(ev->sw_version_1),
-                   __le32_to_cpu(ev->abi_version),
-                   __le32_to_cpu(ev->phy_capability),
-                   __le32_to_cpu(ev->ht_cap_info),
-                   __le32_to_cpu(ev->vht_cap_info),
-                   __le32_to_cpu(ev->vht_supp_mcs),
-                   __le32_to_cpu(ev->sys_cap_info),
-                   __le32_to_cpu(ev->num_mem_reqs),
-                   __le32_to_cpu(ev->num_rf_chains));
-
-        complete(&ar->wmi.service_ready);
-}
-
-static void ath10k_wmi_10x_service_ready_event_rx(struct ath10k *ar,
-                                                  struct sk_buff *skb)
-{
-        u32 num_units, req_id, unit_size, num_mem_reqs, num_unit_info, i;
-        int ret;
-        struct wmi_service_ready_event_10x *ev = (void *)skb->data;
-        DECLARE_BITMAP(svc_bmap, WMI_SERVICE_MAX) = {};
-
-        if (skb->len < sizeof(*ev)) {
-                ath10k_warn(ar, "Service ready event was %d B but expected %zu B. Wrong firmware version?\n",
-                            skb->len, sizeof(*ev));
-                return;
-        }
-
-        ar->hw_min_tx_power = __le32_to_cpu(ev->hw_min_tx_power);
-        ar->hw_max_tx_power = __le32_to_cpu(ev->hw_max_tx_power);
-        ar->ht_cap_info = __le32_to_cpu(ev->ht_cap_info);
-        ar->vht_cap_info = __le32_to_cpu(ev->vht_cap_info);
-        ar->fw_version_major =
-                (__le32_to_cpu(ev->sw_version) & 0xff000000) >> 24;
-        ar->fw_version_minor = (__le32_to_cpu(ev->sw_version) & 0x00ffffff);
-        ar->phy_capability = __le32_to_cpu(ev->phy_capability);
-        ar->num_rf_chains = __le32_to_cpu(ev->num_rf_chains);
-
-        if (ar->num_rf_chains > WMI_MAX_SPATIAL_STREAM) {
-                ath10k_warn(ar, "hardware advertises support for more spatial streams than it should (%d > %d)\n",
-                            ar->num_rf_chains, WMI_MAX_SPATIAL_STREAM);
-                ar->num_rf_chains = WMI_MAX_SPATIAL_STREAM;
-        }
-
-        ar->ath_common.regulatory.current_rd =
-                __le32_to_cpu(ev->hal_reg_capabilities.eeprom_rd);
-
-        wmi_10x_svc_map(ev->wmi_service_bitmap, svc_bmap);
-        ath10k_debug_read_service_map(ar, svc_bmap, sizeof(svc_bmap));
-        ath10k_dbg_dump(ar, ATH10K_DBG_WMI, NULL, "wmi svc: ",
-                        ev->wmi_service_bitmap, sizeof(ev->wmi_service_bitmap));
-
-        if (strlen(ar->hw->wiphy->fw_version) == 0) {
-                snprintf(ar->hw->wiphy->fw_version,
-                         sizeof(ar->hw->wiphy->fw_version),
-                         "%u.%u",
-                         ar->fw_version_major,
-                         ar->fw_version_minor);
-        }
-
-        num_mem_reqs = __le32_to_cpu(ev->num_mem_reqs);
-
-        if (num_mem_reqs > ATH10K_MAX_MEM_REQS) {
+        num_mem_reqs = __le32_to_cpu(arg.num_mem_reqs);
+        if (num_mem_reqs > WMI_MAX_MEM_REQS) {
                 ath10k_warn(ar, "requested memory chunks number (%d) exceeds the limit\n",
                             num_mem_reqs);
                 return;
         }
 
-        if (!num_mem_reqs)
-                goto exit;
-
-        ath10k_dbg(ar, ATH10K_DBG_WMI, "firmware has requested %d memory chunks\n",
-                   num_mem_reqs);
-
         for (i = 0; i < num_mem_reqs; ++i) {
-                req_id = __le32_to_cpu(ev->mem_reqs[i].req_id);
-                num_units = __le32_to_cpu(ev->mem_reqs[i].num_units);
-                unit_size = __le32_to_cpu(ev->mem_reqs[i].unit_size);
-                num_unit_info = __le32_to_cpu(ev->mem_reqs[i].num_unit_info);
+                req_id = __le32_to_cpu(arg.mem_reqs[i]->req_id);
+                num_units = __le32_to_cpu(arg.mem_reqs[i]->num_units);
+                unit_size = __le32_to_cpu(arg.mem_reqs[i]->unit_size);
+                num_unit_info = __le32_to_cpu(arg.mem_reqs[i]->num_unit_info);
 
                 if (num_unit_info & NUM_UNITS_IS_NUM_PEERS)
                         /* number of units to allocate is number of
@@ -2316,7 +2552,7 @@ static void ath10k_wmi_10x_service_ready_event_rx(struct ath10k *ar,
                 ath10k_dbg(ar, ATH10K_DBG_WMI,
                            "wmi mem_req_id %d num_units %d num_unit_info %d unit size %d actual units %d\n",
                            req_id,
-                           __le32_to_cpu(ev->mem_reqs[i].num_units),
+                           __le32_to_cpu(arg.mem_reqs[i]->num_units),
                            num_unit_info,
                            unit_size,
                            num_units);
@@ -2327,23 +2563,23 @@ static void ath10k_wmi_10x_service_ready_event_rx(struct ath10k *ar,
                         return;
         }
 
-exit:
         ath10k_dbg(ar, ATH10K_DBG_WMI,
-                   "wmi event service ready sw_ver 0x%08x abi_ver %u phy_cap 0x%08x ht_cap 0x%08x vht_cap 0x%08x vht_supp_msc 0x%08x sys_cap_info 0x%08x mem_reqs %u num_rf_chains %u\n",
-                   __le32_to_cpu(ev->sw_version),
-                   __le32_to_cpu(ev->abi_version),
-                   __le32_to_cpu(ev->phy_capability),
-                   __le32_to_cpu(ev->ht_cap_info),
-                   __le32_to_cpu(ev->vht_cap_info),
-                   __le32_to_cpu(ev->vht_supp_mcs),
-                   __le32_to_cpu(ev->sys_cap_info),
-                   __le32_to_cpu(ev->num_mem_reqs),
-                   __le32_to_cpu(ev->num_rf_chains));
+                   "wmi event service ready min_tx_power 0x%08x max_tx_power 0x%08x ht_cap 0x%08x vht_cap 0x%08x sw_ver0 0x%08x sw_ver1 0x%08x phy_capab 0x%08x num_rf_chains 0x%08x eeprom_rd 0x%08x num_mem_reqs 0x%08x\n",
+                   __le32_to_cpu(arg.min_tx_power),
+                   __le32_to_cpu(arg.max_tx_power),
+                   __le32_to_cpu(arg.ht_cap),
+                   __le32_to_cpu(arg.vht_cap),
+                   __le32_to_cpu(arg.sw_ver0),
+                   __le32_to_cpu(arg.sw_ver1),
+                   __le32_to_cpu(arg.phy_capab),
+                   __le32_to_cpu(arg.num_rf_chains),
+                   __le32_to_cpu(arg.eeprom_rd),
+                   __le32_to_cpu(arg.num_mem_reqs));
 
         complete(&ar->wmi.service_ready);
 }
 
-static int ath10k_wmi_ready_event_rx(struct ath10k *ar, struct sk_buff *skb)
+static int ath10k_wmi_event_ready(struct ath10k *ar, struct sk_buff *skb)
 {
         struct wmi_ready_event *ev = (struct wmi_ready_event *)skb->data;
 
@@ -2466,10 +2702,10 @@ static void ath10k_wmi_main_process_rx(struct ath10k *ar, struct sk_buff *skb)
                 ath10k_wmi_event_vdev_install_key_complete(ar, skb);
                 break;
         case WMI_SERVICE_READY_EVENTID:
-                ath10k_wmi_service_ready_event_rx(ar, skb);
+                ath10k_wmi_event_service_ready(ar, skb);
                 break;
         case WMI_READY_EVENTID:
-                ath10k_wmi_ready_event_rx(ar, skb);
+                ath10k_wmi_event_ready(ar, skb);
                 break;
         default:
                 ath10k_warn(ar, "Unknown eventid: %d\n", id);
@@ -2586,10 +2822,10 @@ static void ath10k_wmi_10x_process_rx(struct ath10k *ar, struct sk_buff *skb)
                 ath10k_wmi_event_vdev_resume_req(ar, skb);
                 break;
         case WMI_10X_SERVICE_READY_EVENTID:
-                ath10k_wmi_10x_service_ready_event_rx(ar, skb);
+                ath10k_wmi_event_service_ready(ar, skb);
                 break;
         case WMI_10X_READY_EVENTID:
-                ath10k_wmi_ready_event_rx(ar, skb);
+                ath10k_wmi_event_ready(ar, skb);
                 break;
         case WMI_10X_PDEV_UTF_EVENTID:
                 /* ignore utf events */
@@ -2697,10 +2933,10 @@ static void ath10k_wmi_10_2_process_rx(struct ath10k *ar, struct sk_buff *skb)
                 ath10k_wmi_event_vdev_resume_req(ar, skb);
                 break;
         case WMI_10_2_SERVICE_READY_EVENTID:
-                ath10k_wmi_10x_service_ready_event_rx(ar, skb);
+                ath10k_wmi_event_service_ready(ar, skb);
                 break;
         case WMI_10_2_READY_EVENTID:
-                ath10k_wmi_ready_event_rx(ar, skb);
+                ath10k_wmi_event_ready(ar, skb);
                 break;
         case WMI_10_2_RTT_KEEPALIVE_EVENTID:
         case WMI_10_2_GPIO_INPUT_EVENTID:
@@ -2732,45 +2968,6 @@ static void ath10k_wmi_process_rx(struct ath10k *ar, struct sk_buff *skb)
         }
 }
 
-/* WMI Initialization functions */
-int ath10k_wmi_attach(struct ath10k *ar)
-{
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                if (test_bit(ATH10K_FW_FEATURE_WMI_10_2, ar->fw_features))
-                        ar->wmi.cmd = &wmi_10_2_cmd_map;
-                else
-                        ar->wmi.cmd = &wmi_10x_cmd_map;
-
-                ar->wmi.vdev_param = &wmi_10x_vdev_param_map;
-                ar->wmi.pdev_param = &wmi_10x_pdev_param_map;
-        } else {
-                ar->wmi.cmd = &wmi_cmd_map;
-                ar->wmi.vdev_param = &wmi_vdev_param_map;
-                ar->wmi.pdev_param = &wmi_pdev_param_map;
-        }
-
-        init_completion(&ar->wmi.service_ready);
-        init_completion(&ar->wmi.unified_ready);
-        init_waitqueue_head(&ar->wmi.tx_credits_wq);
-
-        return 0;
-}
-
-void ath10k_wmi_detach(struct ath10k *ar)
-{
-        int i;
-
-        /* free the host memory chunks requested by firmware */
-        for (i = 0; i < ar->wmi.num_mem_chunks; i++) {
-                dma_free_coherent(ar->dev,
-                                  ar->wmi.mem_chunks[i].len,
-                                  ar->wmi.mem_chunks[i].vaddr,
-                                  ar->wmi.mem_chunks[i].paddr);
-        }
-
-        ar->wmi.num_mem_chunks = 0;
-}
-
 int ath10k_wmi_connect(struct ath10k *ar)
 {
         int status;
@@ -2865,42 +3062,6 @@ int ath10k_wmi_pdev_set_regdomain(struct ath10k *ar, u16 rd, u16 rd2g,
                                                          ctl2g, ctl5g);
 }
 
-int ath10k_wmi_pdev_set_channel(struct ath10k *ar,
-                                const struct wmi_channel_arg *arg)
-{
-        struct wmi_set_channel_cmd *cmd;
-        struct sk_buff *skb;
-        u32 ch_flags = 0;
-
-        if (arg->passive)
-                return -EINVAL;
-
-        skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
-        if (!skb)
-                return -ENOMEM;
-
-        if (arg->chan_radar)
-                ch_flags |= WMI_CHAN_FLAG_DFS;
-
-        cmd = (struct wmi_set_channel_cmd *)skb->data;
-        cmd->chan.mhz               = __cpu_to_le32(arg->freq);
-        cmd->chan.band_center_freq1 = __cpu_to_le32(arg->freq);
-        cmd->chan.mode              = arg->mode;
-        cmd->chan.flags            |= __cpu_to_le32(ch_flags);
-        cmd->chan.min_power         = arg->min_power;
-        cmd->chan.max_power         = arg->max_power;
-        cmd->chan.reg_power         = arg->max_reg_power;
-        cmd->chan.reg_classid       = arg->reg_class_id;
-        cmd->chan.antenna_max       = arg->max_antenna_gain;
-
-        ath10k_dbg(ar, ATH10K_DBG_WMI,
-                   "wmi set channel mode %d freq %d\n",
-                   arg->mode, arg->freq);
-
-        return ath10k_wmi_cmd_send(ar, skb,
-                                   ar->wmi.cmd->pdev_set_channel_cmdid);
-}
-
 int ath10k_wmi_pdev_suspend_target(struct ath10k *ar, u32 suspend_opt)
 {
         struct wmi_pdev_suspend_cmd *cmd;
@@ -2951,13 +3112,34 @@ int ath10k_wmi_pdev_set_param(struct ath10k *ar, u32 id, u32 value)
         return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->pdev_set_param_cmdid);
 }
 
+static void ath10k_wmi_put_host_mem_chunks(struct ath10k *ar,
+                                           struct wmi_host_mem_chunks *chunks)
+{
+        struct host_memory_chunk *chunk;
+        int i;
+
+        chunks->count = __cpu_to_le32(ar->wmi.num_mem_chunks);
+
+        for (i = 0; i < ar->wmi.num_mem_chunks; i++) {
+                chunk = &chunks->items[i];
+                chunk->ptr = __cpu_to_le32(ar->wmi.mem_chunks[i].paddr);
+                chunk->size = __cpu_to_le32(ar->wmi.mem_chunks[i].len);
+                chunk->req_id = __cpu_to_le32(ar->wmi.mem_chunks[i].req_id);
+
+                ath10k_dbg(ar, ATH10K_DBG_WMI,
+                           "wmi chunk %d len %d requested, addr 0x%llx\n",
+                           i,
+                           ar->wmi.mem_chunks[i].len,
+                           (unsigned long long)ar->wmi.mem_chunks[i].paddr);
+        }
+}
+
 static int ath10k_wmi_main_cmd_init(struct ath10k *ar)
 {
         struct wmi_init_cmd *cmd;
         struct sk_buff *buf;
         struct wmi_resource_config config = {};
         u32 len, val;
-        int i;
 
         config.num_vdevs = __cpu_to_le32(TARGET_NUM_VDEVS);
         config.num_peers = __cpu_to_le32(TARGET_NUM_PEERS + TARGET_NUM_VDEVS);
@@ -3019,32 +3201,8 @@ static int ath10k_wmi_main_cmd_init(struct ath10k *ar)
 
         cmd = (struct wmi_init_cmd *)buf->data;
 
-        if (ar->wmi.num_mem_chunks == 0) {
-                cmd->num_host_mem_chunks = 0;
-                goto out;
-        }
-
-        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi sending %d memory chunks info.\n",
-                   ar->wmi.num_mem_chunks);
-
-        cmd->num_host_mem_chunks = __cpu_to_le32(ar->wmi.num_mem_chunks);
-
-        for (i = 0; i < ar->wmi.num_mem_chunks; i++) {
-                cmd->host_mem_chunks[i].ptr =
-                        __cpu_to_le32(ar->wmi.mem_chunks[i].paddr);
-                cmd->host_mem_chunks[i].size =
-                        __cpu_to_le32(ar->wmi.mem_chunks[i].len);
-                cmd->host_mem_chunks[i].req_id =
-                        __cpu_to_le32(ar->wmi.mem_chunks[i].req_id);
-
-                ath10k_dbg(ar, ATH10K_DBG_WMI,
-                           "wmi chunk %d len %d requested, addr 0x%llx\n",
-                           i,
-                           ar->wmi.mem_chunks[i].len,
-                           (unsigned long long)ar->wmi.mem_chunks[i].paddr);
-        }
-out:
         memcpy(&cmd->resource_config, &config, sizeof(config));
+        ath10k_wmi_put_host_mem_chunks(ar, &cmd->mem_chunks);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi init\n");
         return ath10k_wmi_cmd_send(ar, buf, ar->wmi.cmd->init_cmdid);
@@ -3056,7 +3214,6 @@ static int ath10k_wmi_10x_cmd_init(struct ath10k *ar)
         struct sk_buff *buf;
         struct wmi_resource_config_10x config = {};
         u32 len, val;
-        int i;
 
         config.num_vdevs = __cpu_to_le32(TARGET_10X_NUM_VDEVS);
         config.num_peers = __cpu_to_le32(TARGET_10X_NUM_PEERS);
@@ -3110,32 +3267,8 @@ static int ath10k_wmi_10x_cmd_init(struct ath10k *ar)
 
         cmd = (struct wmi_init_cmd_10x *)buf->data;
 
-        if (ar->wmi.num_mem_chunks == 0) {
-                cmd->num_host_mem_chunks = 0;
-                goto out;
-        }
-
-        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi sending %d memory chunks info.\n",
-                   ar->wmi.num_mem_chunks);
-
-        cmd->num_host_mem_chunks = __cpu_to_le32(ar->wmi.num_mem_chunks);
-
-        for (i = 0; i < ar->wmi.num_mem_chunks; i++) {
-                cmd->host_mem_chunks[i].ptr =
-                        __cpu_to_le32(ar->wmi.mem_chunks[i].paddr);
-                cmd->host_mem_chunks[i].size =
-                        __cpu_to_le32(ar->wmi.mem_chunks[i].len);
-                cmd->host_mem_chunks[i].req_id =
-                        __cpu_to_le32(ar->wmi.mem_chunks[i].req_id);
-
-                ath10k_dbg(ar, ATH10K_DBG_WMI,
-                           "wmi chunk %d len %d requested, addr 0x%llx\n",
-                           i,
-                           ar->wmi.mem_chunks[i].len,
-                           (unsigned long long)ar->wmi.mem_chunks[i].paddr);
-        }
-out:
         memcpy(&cmd->resource_config, &config, sizeof(config));
+        ath10k_wmi_put_host_mem_chunks(ar, &cmd->mem_chunks);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi init 10x\n");
         return ath10k_wmi_cmd_send(ar, buf, ar->wmi.cmd->init_cmdid);
@@ -3147,7 +3280,6 @@ static int ath10k_wmi_10_2_cmd_init(struct ath10k *ar)
         struct sk_buff *buf;
         struct wmi_resource_config_10x config = {};
         u32 len, val;
-        int i;
 
         config.num_vdevs = __cpu_to_le32(TARGET_10X_NUM_VDEVS);
         config.num_peers = __cpu_to_le32(TARGET_10X_NUM_PEERS);
@@ -3201,32 +3333,8 @@ static int ath10k_wmi_10_2_cmd_init(struct ath10k *ar)
 
         cmd = (struct wmi_init_cmd_10_2 *)buf->data;
 
-        if (ar->wmi.num_mem_chunks == 0) {
-                cmd->num_host_mem_chunks = 0;
-                goto out;
-        }
-
-        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi sending %d memory chunks info.\n",
-                   ar->wmi.num_mem_chunks);
-
-        cmd->num_host_mem_chunks = __cpu_to_le32(ar->wmi.num_mem_chunks);
-
-        for (i = 0; i < ar->wmi.num_mem_chunks; i++) {
-                cmd->host_mem_chunks[i].ptr =
-                        __cpu_to_le32(ar->wmi.mem_chunks[i].paddr);
-                cmd->host_mem_chunks[i].size =
-                        __cpu_to_le32(ar->wmi.mem_chunks[i].len);
-                cmd->host_mem_chunks[i].req_id =
-                        __cpu_to_le32(ar->wmi.mem_chunks[i].req_id);
-
-                ath10k_dbg(ar, ATH10K_DBG_WMI,
-                           "wmi chunk %d len %d requested, addr 0x%llx\n",
-                           i,
-                           ar->wmi.mem_chunks[i].len,
-                           (unsigned long long)ar->wmi.mem_chunks[i].paddr);
-        }
-out:
         memcpy(&cmd->resource_config.common, &config, sizeof(config));
+        ath10k_wmi_put_host_mem_chunks(ar, &cmd->mem_chunks);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi init 10.2\n");
         return ath10k_wmi_cmd_send(ar, buf, ar->wmi.cmd->init_cmdid);
@@ -3248,52 +3356,50 @@ int ath10k_wmi_cmd_init(struct ath10k *ar)
         return ret;
 }
 
-static int ath10k_wmi_start_scan_calc_len(struct ath10k *ar,
-                                          const struct wmi_start_scan_arg *arg)
+static int ath10k_wmi_start_scan_verify(const struct wmi_start_scan_arg *arg)
 {
-        int len;
+        if (arg->ie_len && !arg->ie)
+                return -EINVAL;
+        if (arg->n_channels && !arg->channels)
+                return -EINVAL;
+        if (arg->n_ssids && !arg->ssids)
+                return -EINVAL;
+        if (arg->n_bssids && !arg->bssids)
+                return -EINVAL;
 
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features))
-                len = sizeof(struct wmi_start_scan_cmd_10x);
-        else
-                len = sizeof(struct wmi_start_scan_cmd);
+        if (arg->ie_len > WLAN_SCAN_PARAMS_MAX_IE_LEN)
+                return -EINVAL;
+        if (arg->n_channels > ARRAY_SIZE(arg->channels))
+                return -EINVAL;
+        if (arg->n_ssids > WLAN_SCAN_PARAMS_MAX_SSID)
+                return -EINVAL;
+        if (arg->n_bssids > WLAN_SCAN_PARAMS_MAX_BSSID)
+                return -EINVAL;
 
-        if (arg->ie_len) {
-                if (!arg->ie)
-                        return -EINVAL;
-                if (arg->ie_len > WLAN_SCAN_PARAMS_MAX_IE_LEN)
-                        return -EINVAL;
+        return 0;
+}
+
+static size_t
+ath10k_wmi_start_scan_tlvs_len(const struct wmi_start_scan_arg *arg)
+{
+        int len = 0;
 
+        if (arg->ie_len) {
                 len += sizeof(struct wmi_ie_data);
                 len += roundup(arg->ie_len, 4);
         }
 
         if (arg->n_channels) {
-                if (!arg->channels)
-                        return -EINVAL;
-                if (arg->n_channels > ARRAY_SIZE(arg->channels))
-                        return -EINVAL;
-
                 len += sizeof(struct wmi_chan_list);
                 len += sizeof(__le32) * arg->n_channels;
         }
 
         if (arg->n_ssids) {
-                if (!arg->ssids)
-                        return -EINVAL;
-                if (arg->n_ssids > WLAN_SCAN_PARAMS_MAX_SSID)
-                        return -EINVAL;
-
                 len += sizeof(struct wmi_ssid_list);
                 len += sizeof(struct wmi_ssid) * arg->n_ssids;
         }
 
         if (arg->n_bssids) {
-                if (!arg->bssids)
-                        return -EINVAL;
-                if (arg->n_bssids > WLAN_SCAN_PARAMS_MAX_BSSID)
-                        return -EINVAL;
-
                 len += sizeof(struct wmi_bssid_list);
                 len += sizeof(struct wmi_mac_addr) * arg->n_bssids;
         }
@@ -3301,28 +3407,12 @@ static int ath10k_wmi_start_scan_calc_len(struct ath10k *ar,
         return len;
 }
 
-int ath10k_wmi_start_scan(struct ath10k *ar,
-                          const struct wmi_start_scan_arg *arg)
+static void
+ath10k_wmi_put_start_scan_common(struct wmi_start_scan_common *cmn,
+                                 const struct wmi_start_scan_arg *arg)
 {
-        struct wmi_start_scan_cmd *cmd;
-        struct sk_buff *skb;
-        struct wmi_ie_data *ie;
-        struct wmi_chan_list *channels;
-        struct wmi_ssid_list *ssids;
-        struct wmi_bssid_list *bssids;
         u32 scan_id;
         u32 scan_req_id;
-        int off;
-        int len = 0;
-        int i;
-
-        len = ath10k_wmi_start_scan_calc_len(ar, arg);
-        if (len < 0)
-                return len; /* len contains error code here */
-
-        skb = ath10k_wmi_alloc_skb(ar, len);
-        if (!skb)
-                return -ENOMEM;
 
         scan_id  = WMI_HOST_SCAN_REQ_ID_PREFIX;
         scan_id |= arg->scan_id;
@@ -3330,35 +3420,36 @@ int ath10k_wmi_start_scan(struct ath10k *ar,
         scan_req_id  = WMI_HOST_SCAN_REQUESTOR_ID_PREFIX;
         scan_req_id |= arg->scan_req_id;
 
-        cmd = (struct wmi_start_scan_cmd *)skb->data;
-        cmd->scan_id            = __cpu_to_le32(scan_id);
-        cmd->scan_req_id        = __cpu_to_le32(scan_req_id);
-        cmd->vdev_id            = __cpu_to_le32(arg->vdev_id);
-        cmd->scan_priority      = __cpu_to_le32(arg->scan_priority);
-        cmd->notify_scan_events = __cpu_to_le32(arg->notify_scan_events);
-        cmd->dwell_time_active  = __cpu_to_le32(arg->dwell_time_active);
-        cmd->dwell_time_passive = __cpu_to_le32(arg->dwell_time_passive);
-        cmd->min_rest_time      = __cpu_to_le32(arg->min_rest_time);
-        cmd->max_rest_time      = __cpu_to_le32(arg->max_rest_time);
-        cmd->repeat_probe_time  = __cpu_to_le32(arg->repeat_probe_time);
-        cmd->probe_spacing_time = __cpu_to_le32(arg->probe_spacing_time);
-        cmd->idle_time          = __cpu_to_le32(arg->idle_time);
-        cmd->max_scan_time      = __cpu_to_le32(arg->max_scan_time);
-        cmd->probe_delay        = __cpu_to_le32(arg->probe_delay);
-        cmd->scan_ctrl_flags    = __cpu_to_le32(arg->scan_ctrl_flags);
-
-        /* TLV list starts after fields included in the struct */
-        /* There's just one filed that differes the two start_scan
-         * structures - burst_duration, which we are not using btw,
-           no point to make the split here, just shift the buffer to fit with
-           given FW */
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features))
-                off = sizeof(struct wmi_start_scan_cmd_10x);
-        else
-                off = sizeof(struct wmi_start_scan_cmd);
+        cmn->scan_id            = __cpu_to_le32(scan_id);
+        cmn->scan_req_id        = __cpu_to_le32(scan_req_id);
+        cmn->vdev_id            = __cpu_to_le32(arg->vdev_id);
+        cmn->scan_priority      = __cpu_to_le32(arg->scan_priority);
+        cmn->notify_scan_events = __cpu_to_le32(arg->notify_scan_events);
+        cmn->dwell_time_active  = __cpu_to_le32(arg->dwell_time_active);
+        cmn->dwell_time_passive = __cpu_to_le32(arg->dwell_time_passive);
+        cmn->min_rest_time      = __cpu_to_le32(arg->min_rest_time);
+        cmn->max_rest_time      = __cpu_to_le32(arg->max_rest_time);
+        cmn->repeat_probe_time  = __cpu_to_le32(arg->repeat_probe_time);
+        cmn->probe_spacing_time = __cpu_to_le32(arg->probe_spacing_time);
+        cmn->idle_time          = __cpu_to_le32(arg->idle_time);
+        cmn->max_scan_time      = __cpu_to_le32(arg->max_scan_time);
+        cmn->probe_delay        = __cpu_to_le32(arg->probe_delay);
+        cmn->scan_ctrl_flags    = __cpu_to_le32(arg->scan_ctrl_flags);
+}
+
+static void
+ath10k_wmi_put_start_scan_tlvs(struct wmi_start_scan_tlvs *tlvs,
+                               const struct wmi_start_scan_arg *arg)
+{
+        struct wmi_ie_data *ie;
+        struct wmi_chan_list *channels;
+        struct wmi_ssid_list *ssids;
+        struct wmi_bssid_list *bssids;
+        void *ptr = tlvs->tlvs;
+        int i;
 
         if (arg->n_channels) {
-                channels = (void *)skb->data + off;
+                channels = ptr;
                 channels->tag = __cpu_to_le32(WMI_CHAN_LIST_TAG);
                 channels->num_chan = __cpu_to_le32(arg->n_channels);
 
@@ -3366,12 +3457,12 @@ int ath10k_wmi_start_scan(struct ath10k *ar,
                         channels->channel_list[i].freq =
                                 __cpu_to_le16(arg->channels[i]);
 
-                off += sizeof(*channels);
-                off += sizeof(__le32) * arg->n_channels;
+                ptr += sizeof(*channels);
+                ptr += sizeof(__le32) * arg->n_channels;
         }
 
         if (arg->n_ssids) {
-                ssids = (void *)skb->data + off;
+                ssids = ptr;
                 ssids->tag = __cpu_to_le32(WMI_SSID_LIST_TAG);
                 ssids->num_ssids = __cpu_to_le32(arg->n_ssids);
 
@@ -3383,12 +3474,12 @@ int ath10k_wmi_start_scan(struct ath10k *ar,
                                arg->ssids[i].len);
                 }
 
-                off += sizeof(*ssids);
-                off += sizeof(struct wmi_ssid) * arg->n_ssids;
+                ptr += sizeof(*ssids);
+                ptr += sizeof(struct wmi_ssid) * arg->n_ssids;
         }
 
         if (arg->n_bssids) {
-                bssids = (void *)skb->data + off;
+                bssids = ptr;
                 bssids->tag = __cpu_to_le32(WMI_BSSID_LIST_TAG);
                 bssids->num_bssid = __cpu_to_le32(arg->n_bssids);
 
@@ -3397,23 +3488,57 @@ int ath10k_wmi_start_scan(struct ath10k *ar,
                                arg->bssids[i].bssid,
                                ETH_ALEN);
 
-                off += sizeof(*bssids);
-                off += sizeof(struct wmi_mac_addr) * arg->n_bssids;
+                ptr += sizeof(*bssids);
+                ptr += sizeof(struct wmi_mac_addr) * arg->n_bssids;
         }
 
         if (arg->ie_len) {
-                ie = (void *)skb->data + off;
+                ie = ptr;
                 ie->tag = __cpu_to_le32(WMI_IE_TAG);
                 ie->ie_len = __cpu_to_le32(arg->ie_len);
                 memcpy(ie->ie_data, arg->ie, arg->ie_len);
 
-                off += sizeof(*ie);
-                off += roundup(arg->ie_len, 4);
+                ptr += sizeof(*ie);
+                ptr += roundup(arg->ie_len, 4);
         }
+}
 
-        if (off != skb->len) {
-                dev_kfree_skb(skb);
-                return -EINVAL;
+int ath10k_wmi_start_scan(struct ath10k *ar,
+                          const struct wmi_start_scan_arg *arg)
+{
+        struct sk_buff *skb;
+        size_t len;
+        int ret;
+
+        ret = ath10k_wmi_start_scan_verify(arg);
+        if (ret)
+                return ret;
+
+        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features))
+                len = sizeof(struct wmi_10x_start_scan_cmd) +
+                      ath10k_wmi_start_scan_tlvs_len(arg);
+        else
+                len = sizeof(struct wmi_start_scan_cmd) +
+                      ath10k_wmi_start_scan_tlvs_len(arg);
+
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return -ENOMEM;
+
+        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
+                struct wmi_10x_start_scan_cmd *cmd;
+
+                cmd = (struct wmi_10x_start_scan_cmd *)skb->data;
+                ath10k_wmi_put_start_scan_common(&cmd->common, arg);
+                ath10k_wmi_put_start_scan_tlvs(&cmd->tlvs, arg);
+        } else {
+                struct wmi_start_scan_cmd *cmd;
+
+                cmd = (struct wmi_start_scan_cmd *)skb->data;
+                cmd->burst_duration_ms = __cpu_to_le32(0);
+
+                ath10k_wmi_put_start_scan_common(&cmd->common, arg);
+                ath10k_wmi_put_start_scan_tlvs(&cmd->tlvs, arg);
         }
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi start scan\n");
@@ -3532,7 +3657,6 @@ ath10k_wmi_vdev_start_restart(struct ath10k *ar,
         struct sk_buff *skb;
         const char *cmdname;
         u32 flags = 0;
-        u32 ch_flags = 0;
 
         if (cmd_id != ar->wmi.cmd->vdev_start_request_cmdid &&
             cmd_id != ar->wmi.cmd->vdev_restart_request_cmdid)
@@ -3559,8 +3683,6 @@ ath10k_wmi_vdev_start_restart(struct ath10k *ar,
                 flags |= WMI_VDEV_START_HIDDEN_SSID;
         if (arg->pmf_enabled)
                 flags |= WMI_VDEV_START_PMF_ENABLED;
-        if (arg->channel.chan_radar)
-                ch_flags |= WMI_CHAN_FLAG_DFS;
 
         cmd = (struct wmi_vdev_start_request_cmd *)skb->data;
         cmd->vdev_id         = __cpu_to_le32(arg->vdev_id);
@@ -3576,18 +3698,7 @@ ath10k_wmi_vdev_start_restart(struct ath10k *ar,
                 memcpy(cmd->ssid.ssid, arg->ssid, arg->ssid_len);
         }
 
-        cmd->chan.mhz = __cpu_to_le32(arg->channel.freq);
-
-        cmd->chan.band_center_freq1 =
-                __cpu_to_le32(arg->channel.band_center_freq1);
-
-        cmd->chan.mode = arg->channel.mode;
-        cmd->chan.flags |= __cpu_to_le32(ch_flags);
-        cmd->chan.min_power = arg->channel.min_power;
-        cmd->chan.max_power = arg->channel.max_power;
-        cmd->chan.reg_power = arg->channel.max_reg_power;
-        cmd->chan.reg_classid = arg->channel.reg_class_id;
-        cmd->chan.antenna_max = arg->channel.max_antenna_gain;
+        ath10k_wmi_put_wmi_channel(&cmd->chan, &arg->channel);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi vdev %s id 0x%x flags: 0x%0X, freq %d, mode %d, ch_flags: 0x%0X, max_power: %d\n",
@@ -3968,35 +4079,10 @@ int ath10k_wmi_scan_chan_list(struct ath10k *ar,
         cmd->num_scan_chans = __cpu_to_le32(arg->n_channels);
 
         for (i = 0; i < arg->n_channels; i++) {
-                u32 flags = 0;
-
                 ch = &arg->channels[i];
                 ci = &cmd->chan_info[i];
 
-                if (ch->passive)
-                        flags |= WMI_CHAN_FLAG_PASSIVE;
-                if (ch->allow_ibss)
-                        flags |= WMI_CHAN_FLAG_ADHOC_ALLOWED;
-                if (ch->allow_ht)
-                        flags |= WMI_CHAN_FLAG_ALLOW_HT;
-                if (ch->allow_vht)
-                        flags |= WMI_CHAN_FLAG_ALLOW_VHT;
-                if (ch->ht40plus)
-                        flags |= WMI_CHAN_FLAG_HT40_PLUS;
-                if (ch->chan_radar)
-                        flags |= WMI_CHAN_FLAG_DFS;
-
-                ci->mhz               = __cpu_to_le32(ch->freq);
-                ci->band_center_freq1 = __cpu_to_le32(ch->freq);
-                ci->band_center_freq2 = 0;
-                ci->min_power         = ch->min_power;
-                ci->max_power         = ch->max_power;
-                ci->reg_power         = ch->max_reg_power;
-                ci->antenna_max       = ch->max_antenna_gain;
-
-                /* mode & flags share storage */
-                ci->mode              = ch->mode;
-                ci->flags            |= __cpu_to_le32(flags);
+                ath10k_wmi_put_wmi_channel(ci, ch);
         }
 
         return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->scan_chan_list_cmdid);
@@ -4108,9 +4194,9 @@ int ath10k_wmi_peer_assoc(struct ath10k *ar,
 
         if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
                 if (test_bit(ATH10K_FW_FEATURE_WMI_10_2, ar->fw_features))
-                        ath10k_wmi_peer_assoc_fill_10_1(ar, skb->data, arg);
-                else
                         ath10k_wmi_peer_assoc_fill_10_2(ar, skb->data, arg);
+                else
+                        ath10k_wmi_peer_assoc_fill_10_1(ar, skb->data, arg);
         } else {
                 ath10k_wmi_peer_assoc_fill_main(ar, skb->data, arg);
         }
@@ -4267,3 +4353,73 @@ int ath10k_wmi_dbglog_cfg(struct ath10k *ar, u32 module_enable)
 
         return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->dbglog_cfg_cmdid);
 }
+
+int ath10k_wmi_pdev_pktlog_enable(struct ath10k *ar, u32 ev_bitmap)
+{
+        struct wmi_pdev_pktlog_enable_cmd *cmd;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
+        if (!skb)
+                return -ENOMEM;
+
+        ev_bitmap &= ATH10K_PKTLOG_ANY;
+        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                   "wmi enable pktlog filter:%x\n", ev_bitmap);
+
+        cmd = (struct wmi_pdev_pktlog_enable_cmd *)skb->data;
+        cmd->ev_bitmap = __cpu_to_le32(ev_bitmap);
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->pdev_pktlog_enable_cmdid);
+}
+
+int ath10k_wmi_pdev_pktlog_disable(struct ath10k *ar)
+{
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, 0);
+        if (!skb)
+                return -ENOMEM;
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi disable pktlog\n");
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->pdev_pktlog_disable_cmdid);
+}
+
+int ath10k_wmi_attach(struct ath10k *ar)
+{
+        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
+                if (test_bit(ATH10K_FW_FEATURE_WMI_10_2, ar->fw_features))
+                        ar->wmi.cmd = &wmi_10_2_cmd_map;
+                else
+                        ar->wmi.cmd = &wmi_10x_cmd_map;
+
+                ar->wmi.vdev_param = &wmi_10x_vdev_param_map;
+                ar->wmi.pdev_param = &wmi_10x_pdev_param_map;
+        } else {
+                ar->wmi.cmd = &wmi_cmd_map;
+                ar->wmi.vdev_param = &wmi_vdev_param_map;
+                ar->wmi.pdev_param = &wmi_pdev_param_map;
+        }
+
+        init_completion(&ar->wmi.service_ready);
+        init_completion(&ar->wmi.unified_ready);
+
+        return 0;
+}
+
+void ath10k_wmi_detach(struct ath10k *ar)
+{
+        int i;
+
+        /* free the host memory chunks requested by firmware */
+        for (i = 0; i < ar->wmi.num_mem_chunks; i++) {
+                dma_free_coherent(ar->dev,
+                                  ar->wmi.mem_chunks[i].len,
+                                  ar->wmi.mem_chunks[i].vaddr,
+                                  ar->wmi.mem_chunks[i].paddr);
+        }
+
+        ar->wmi.num_mem_chunks = 0;
+}
diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h
index 86f5ebccfe79..a38d788a6101 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.h
+++ b/drivers/net/wireless/ath/ath10k/wmi.h
@@ -1428,11 +1428,11 @@ struct wmi_service_ready_event {
          * where FW can access this memory directly (or) by DMA.
          */
         __le32 num_mem_reqs;
-        struct wlan_host_mem_req mem_reqs[1];
+        struct wlan_host_mem_req mem_reqs[0];
 } __packed;
 
 /* This is the definition from 10.X firmware branch */
-struct wmi_service_ready_event_10x {
+struct wmi_10x_service_ready_event {
         __le32 sw_version;
         __le32 abi_version;
 
@@ -1467,7 +1467,7 @@ struct wmi_service_ready_event_10x {
          */
         __le32 num_mem_reqs;
 
-        struct wlan_host_mem_req mem_reqs[1];
+        struct wlan_host_mem_req mem_reqs[0];
 } __packed;
 
 #define WMI_SERVICE_READY_TIMEOUT_HZ (5*HZ)
@@ -1883,38 +1883,26 @@ struct host_memory_chunk {
         __le32 size;
 } __packed;
 
+struct wmi_host_mem_chunks {
+        __le32 count;
+        /* some fw revisions require at least 1 chunk regardless of count */
+        struct host_memory_chunk items[1];
+} __packed;
+
 struct wmi_init_cmd {
         struct wmi_resource_config resource_config;
-        __le32 num_host_mem_chunks;
-
-        /*
-         * variable number of host memory chunks.
-         * This should be the last element in the structure
-         */
-        struct host_memory_chunk host_mem_chunks[1];
+        struct wmi_host_mem_chunks mem_chunks;
 } __packed;
 
 /* _10x stucture is from 10.X FW API */
 struct wmi_init_cmd_10x {
         struct wmi_resource_config_10x resource_config;
-        __le32 num_host_mem_chunks;
-
-        /*
-         * variable number of host memory chunks.
-         * This should be the last element in the structure
-         */
-        struct host_memory_chunk host_mem_chunks[1];
+        struct wmi_host_mem_chunks mem_chunks;
 } __packed;
 
 struct wmi_init_cmd_10_2 {
         struct wmi_resource_config_10_2 resource_config;
-        __le32 num_host_mem_chunks;
-
-        /*
-         * variable number of host memory chunks.
-         * This should be the last element in the structure
-         */
-        struct host_memory_chunk host_mem_chunks[1];
+        struct wmi_host_mem_chunks mem_chunks;
 } __packed;
 
 struct wmi_chan_list_entry {
@@ -1974,7 +1962,7 @@ enum wmi_scan_priority {
         WMI_SCAN_PRIORITY_COUNT   /* number of priorities supported */
 };
 
-struct wmi_start_scan_cmd {
+struct wmi_start_scan_common {
         /* Scan ID */
         __le32 scan_id;
         /* Scan requestor ID */
@@ -2032,95 +2020,25 @@ struct wmi_start_scan_cmd {
         __le32 probe_delay;
         /* Scan control flags */
         __le32 scan_ctrl_flags;
-
-        /* Burst duration time in msecs */
-        __le32 burst_duration;
-        /*
-         * TLV (tag length value )  paramerters follow the scan_cmd structure.
-         * TLV can contain channel list, bssid list, ssid list and
-         * ie. the TLV tags are defined above;
-         */
 } __packed;
 
-/* This is the definition from 10.X firmware branch */
-struct wmi_start_scan_cmd_10x {
-        /* Scan ID */
-        __le32 scan_id;
-
-        /* Scan requestor ID */
-        __le32 scan_req_id;
-
-        /* VDEV id(interface) that is requesting scan */
-        __le32 vdev_id;
-
-        /* Scan Priority, input to scan scheduler */
-        __le32 scan_priority;
-
-        /* Scan events subscription */
-        __le32 notify_scan_events;
-
-        /* dwell time in msec on active channels */
-        __le32 dwell_time_active;
-
-        /* dwell time in msec on passive channels */
-        __le32 dwell_time_passive;
-
-        /*
-         * min time in msec on the BSS channel,only valid if atleast one
-         * VDEV is active
-         */
-        __le32 min_rest_time;
-
-        /*
-         * max rest time in msec on the BSS channel,only valid if at least
-         * one VDEV is active
-         */
-        /*
-         * the scanner will rest on the bss channel at least min_rest_time
-         * after min_rest_time the scanner will start checking for tx/rx
-         * activity on all VDEVs. if there is no activity the scanner will
-         * switch to off channel. if there is activity the scanner will let
-         * the radio on the bss channel until max_rest_time expires.at
-         * max_rest_time scanner will switch to off channel irrespective of
-         * activity. activity is determined by the idle_time parameter.
-         */
-        __le32 max_rest_time;
-
-        /*
-         * time before sending next set of probe requests.
-         * The scanner keeps repeating probe requests transmission with
-         * period specified by repeat_probe_time.
-         * The number of probe requests specified depends on the ssid_list
-         * and bssid_list
-         */
-        __le32 repeat_probe_time;
-
-        /* time in msec between 2 consequetive probe requests with in a set. */
-        __le32 probe_spacing_time;
-
-        /*
-         * data inactivity time in msec on bss channel that will be used by
-         * scanner for measuring the inactivity.
-         */
-        __le32 idle_time;
-
-        /* maximum time in msec allowed for scan  */
-        __le32 max_scan_time;
-
-        /*
-         * delay in msec before sending first probe request after switching
-         * to a channel
+struct wmi_start_scan_tlvs {
+        /* TLV parameters. These includes channel list, ssid list, bssid list,
+         * extra ies.
          */
-        __le32 probe_delay;
+        u8 tlvs[0];
+} __packed;
 
-        /* Scan control flags */
-        __le32 scan_ctrl_flags;
+struct wmi_start_scan_cmd {
+        struct wmi_start_scan_common common;
+        __le32 burst_duration_ms;
+        struct wmi_start_scan_tlvs tlvs;
+} __packed;
 
-        /*
-         * TLV (tag length value )  paramerters follow the scan_cmd structure.
-         * TLV can contain channel list, bssid list, ssid list and
-         * ie. the TLV tags are defined above;
-         */
+/* This is the definition from 10.X firmware branch */
+struct wmi_10x_start_scan_cmd {
+        struct wmi_start_scan_common common;
+        struct wmi_start_scan_tlvs tlvs;
 } __packed;
 
 struct wmi_ssid_arg {
@@ -2306,94 +2224,25 @@ struct wmi_mgmt_rx_event_v2 {
 #define PHY_ERROR_FALSE_RADAR_EXT               0x24
 #define PHY_ERROR_RADAR                         0x05
 
-struct wmi_single_phyerr_rx_hdr {
-        /* TSF timestamp */
+struct wmi_phyerr {
         __le32 tsf_timestamp;
-
-        /*
-         * Current freq1, freq2
-         *
-         * [7:0]:    freq1[lo]
-         * [15:8] :   freq1[hi]
-         * [23:16]:   freq2[lo]
-         * [31:24]:   freq2[hi]
-         */
         __le16 freq1;
         __le16 freq2;
-
-        /*
-         * Combined RSSI over all chains and channel width for this PHY error
-         *
-         * [7:0]: RSSI combined
-         * [15:8]: Channel width (MHz)
-         * [23:16]: PHY error code
-         * [24:16]: reserved (future use)
-         */
         u8 rssi_combined;
         u8 chan_width_mhz;
         u8 phy_err_code;
         u8 rsvd0;
-
-        /*
-         * RSSI on chain 0 through 3
-         *
-         * This is formatted the same as the PPDU_START RX descriptor
-         * field:
-         *
-         * [7:0]:   pri20
-         * [15:8]:  sec20
-         * [23:16]: sec40
-         * [31:24]: sec80
-         */
-
-        __le32 rssi_chain0;
-        __le32 rssi_chain1;
-        __le32 rssi_chain2;
-        __le32 rssi_chain3;
-
-        /*
-         * Last calibrated NF value for chain 0 through 3
-         *
-         * nf_list_1:
-         *
-         * + [15:0] - chain 0
-         * + [31:16] - chain 1
-         *
-         * nf_list_2:
-         *
-         * + [15:0] - chain 2
-         * + [31:16] - chain 3
-         */
-        __le32 nf_list_1;
-        __le32 nf_list_2;
-
-        /* Length of the frame */
+        __le32 rssi_chains[4];
+        __le16 nf_chains[4];
         __le32 buf_len;
+        u8 buf[0];
 } __packed;
 
-struct wmi_single_phyerr_rx_event {
-        /* Phy error event header */
-        struct wmi_single_phyerr_rx_hdr hdr;
-        /* frame buffer */
-        u8 bufp[0];
-} __packed;
-
-struct wmi_comb_phyerr_rx_hdr {
-        /* Phy error phy error count */
-        __le32 num_phyerr_events;
+struct wmi_phyerr_event {
+        __le32 num_phyerrs;
         __le32 tsf_l32;
         __le32 tsf_u32;
-} __packed;
-
-struct wmi_comb_phyerr_rx_event {
-        /* Phy error phy error count */
-        struct wmi_comb_phyerr_rx_hdr hdr;
-        /*
-         * frame buffer - contains multiple payloads in the order:
-         *                    header - payload, header - payload...
-         *  (The header is of type: wmi_single_phyerr_rx_hdr)
-         */
-        u8 bufp[0];
+        struct wmi_phyerr phyerrs[0];
 } __packed;
 
 #define PHYERR_TLV_SIG                          0xBB
@@ -2908,11 +2757,6 @@ enum wmi_tp_scale {
         WMI_TP_SCALE_SIZE   = 5,        /* max num of enum     */
 };
 
-struct wmi_set_channel_cmd {
-        /* channel (only frequency and mode info are used) */
-        struct wmi_channel chan;
-} __packed;
-
 struct wmi_pdev_chanlist_update_event {
         /* number of channels */
         __le32 num_chan;
@@ -2943,6 +2787,10 @@ struct wmi_pdev_set_channel_cmd {
         struct wmi_channel chan;
 } __packed;
 
+struct wmi_pdev_pktlog_enable_cmd {
+        __le32 ev_bitmap;
+} __packed;
+
 /* Customize the DSCP (bit) to TID (0-7) mapping for QOS */
 #define WMI_DSCP_MAP_MAX    (64)
 struct wmi_pdev_set_dscp_tid_map_cmd {
@@ -3177,7 +3025,7 @@ struct wmi_stats_event {
  * PDEV statistics
  * TODO: add all PDEV stats here
  */
-struct wmi_pdev_stats_old {
+struct wmi_pdev_stats {
         __le32 chan_nf;        /* Channel noise floor */
         __le32 tx_frame_count; /* TX frame count */
         __le32 rx_frame_count; /* RX frame count */
@@ -3188,15 +3036,8 @@ struct wmi_pdev_stats_old {
         struct wal_dbg_stats wal; /* WAL dbg stats */
 } __packed;
 
-struct wmi_pdev_stats_10x {
-        __le32 chan_nf;        /* Channel noise floor */
-        __le32 tx_frame_count; /* TX frame count */
-        __le32 rx_frame_count; /* RX frame count */
-        __le32 rx_clear_count; /* rx clear count */
-        __le32 cycle_count;    /* cycle count */
-        __le32 phy_err_count;  /* Phy error count */
-        __le32 chan_tx_pwr;    /* channel tx power */
-        struct wal_dbg_stats wal; /* WAL dbg stats */
+struct wmi_10x_pdev_stats {
+        struct wmi_pdev_stats old;
         __le32 ack_rx_bad;
         __le32 rts_bad;
         __le32 rts_good;
@@ -3217,16 +3058,14 @@ struct wmi_vdev_stats {
  * peer statistics.
  * TODO: add more stats
  */
-struct wmi_peer_stats_old {
+struct wmi_peer_stats {
         struct wmi_mac_addr peer_macaddr;
         __le32 peer_rssi;
         __le32 peer_tx_rate;
 } __packed;
 
-struct wmi_peer_stats_10x {
-        struct wmi_mac_addr peer_macaddr;
-        __le32 peer_rssi;
-        __le32 peer_tx_rate;
+struct wmi_10x_peer_stats {
+        struct wmi_peer_stats old;
         __le32 peer_rx_rate;
 } __packed;
 
@@ -4719,8 +4558,26 @@ struct wmi_dbglog_cfg_cmd {
 /* By default disable power save for IBSS */
 #define ATH10K_DEFAULT_ATIM 0
 
+#define WMI_MAX_MEM_REQS 16
+
+struct wmi_svc_rdy_ev_arg {
+        __le32 min_tx_power;
+        __le32 max_tx_power;
+        __le32 ht_cap;
+        __le32 vht_cap;
+        __le32 sw_ver0;
+        __le32 sw_ver1;
+        __le32 phy_capab;
+        __le32 num_rf_chains;
+        __le32 eeprom_rd;
+        __le32 num_mem_reqs;
+        const __le32 *service_map;
+        const struct wlan_host_mem_req *mem_reqs[WMI_MAX_MEM_REQS];
+};
+
 struct ath10k;
 struct ath10k_vif;
+struct ath10k_fw_stats;
 
 int ath10k_wmi_attach(struct ath10k *ar);
 void ath10k_wmi_detach(struct ath10k *ar);
@@ -4732,8 +4589,6 @@ int ath10k_wmi_connect(struct ath10k *ar);
 struct sk_buff *ath10k_wmi_alloc_skb(struct ath10k *ar, u32 len);
 int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id);
 
-int ath10k_wmi_pdev_set_channel(struct ath10k *ar,
-                                const struct wmi_channel_arg *);
 int ath10k_wmi_pdev_suspend_target(struct ath10k *ar, u32 suspend_opt);
 int ath10k_wmi_pdev_resume_target(struct ath10k *ar);
 int ath10k_wmi_pdev_set_regdomain(struct ath10k *ar, u16 rd, u16 rd2g,
@@ -4794,5 +4649,9 @@ int ath10k_wmi_force_fw_hang(struct ath10k *ar,
                              enum wmi_force_fw_hang_type type, u32 delay_ms);
 int ath10k_wmi_mgmt_tx(struct ath10k *ar, struct sk_buff *skb);
 int ath10k_wmi_dbglog_cfg(struct ath10k *ar, u32 module_enable);
+int ath10k_wmi_pull_fw_stats(struct ath10k *ar, struct sk_buff *skb,
+                             struct ath10k_fw_stats *stats);
+int ath10k_wmi_pdev_pktlog_enable(struct ath10k *ar, u32 ev_list);
+int ath10k_wmi_pdev_pktlog_disable(struct ath10k *ar);
 
 #endif /* _WMI_H_ */
diff --git a/drivers/net/wireless/ath/ath5k/mac80211-ops.c b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
index ab2709a43768..19eab2a69ad5 100644
--- a/drivers/net/wireless/ath/ath5k/mac80211-ops.c
+++ b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
@@ -547,7 +547,9 @@ ath5k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 
 
 static void
-ath5k_sw_scan_start(struct ieee80211_hw *hw)
+ath5k_sw_scan_start(struct ieee80211_hw *hw,
+                    struct ieee80211_vif *vif,
+                    const u8 *mac_addr)
 {
         struct ath5k_hw *ah = hw->priv;
         if (!ah->assoc)
@@ -556,7 +558,7 @@ ath5k_sw_scan_start(struct ieee80211_hw *hw)
 
 
 static void
-ath5k_sw_scan_complete(struct ieee80211_hw *hw)
+ath5k_sw_scan_complete(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 {
         struct ath5k_hw *ah = hw->priv;
         ath5k_hw_set_ledstate(ah, ah->assoc ?
diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
index ba60e37213eb..7a5337877a0c 100644
--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
@@ -2976,11 +2976,11 @@ static int ath6kl_stop_ap(struct wiphy *wiphy, struct net_device *dev)
 static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
 
 static int ath6kl_del_station(struct wiphy *wiphy, struct net_device *dev,
-                              const u8 *mac)
+                              struct station_del_parameters *params)
 {
         struct ath6kl *ar = ath6kl_priv(dev);
         struct ath6kl_vif *vif = netdev_priv(dev);
-        const u8 *addr = mac ? mac : bcast_addr;
+        const u8 *addr = params->mac ? params->mac : bcast_addr;
 
         return ath6kl_wmi_ap_set_mlme(ar->wmi, vif->fw_vif_idx, WMI_AP_DEAUTH,
                                       addr, WLAN_REASON_PREV_AUTH_NOT_VALID);
diff --git a/drivers/net/wireless/ath/ath6kl/common.h b/drivers/net/wireless/ath/ath6kl/common.h
index 05debf700a84..4f82e8632d37 100644
--- a/drivers/net/wireless/ath/ath6kl/common.h
+++ b/drivers/net/wireless/ath/ath6kl/common.h
@@ -22,7 +22,7 @@
 
 #define ATH6KL_MAX_IE                   256
 
-__printf(2, 3) int ath6kl_printk(const char *level, const char *fmt, ...);
+__printf(2, 3) void ath6kl_printk(const char *level, const char *fmt, ...);
 
 /*
  * Reflects the version of binary interface exposed by ATH6KL target
diff --git a/drivers/net/wireless/ath/ath6kl/debug.c b/drivers/net/wireless/ath/ath6kl/debug.c
index 55c4064dd506..81ba48d2938b 100644
--- a/drivers/net/wireless/ath/ath6kl/debug.c
+++ b/drivers/net/wireless/ath/ath6kl/debug.c
@@ -37,76 +37,64 @@ struct ath6kl_fwlog_slot {
 
 #define ATH6KL_FWLOG_VALID_MASK 0x1ffff
 
-int ath6kl_printk(const char *level, const char *fmt, ...)
+void ath6kl_printk(const char *level, const char *fmt, ...)
 {
         struct va_format vaf;
         va_list args;
-        int rtn;
 
         va_start(args, fmt);
 
         vaf.fmt = fmt;
         vaf.va = &args;
 
-        rtn = printk("%sath6kl: %pV", level, &vaf);
+        printk("%sath6kl: %pV", level, &vaf);
 
         va_end(args);
-
-        return rtn;
 }
 EXPORT_SYMBOL(ath6kl_printk);
 
-int ath6kl_info(const char *fmt, ...)
+void ath6kl_info(const char *fmt, ...)
 {
         struct va_format vaf = {
                 .fmt = fmt,
         };
         va_list args;
-        int ret;
 
         va_start(args, fmt);
         vaf.va = &args;
-        ret = ath6kl_printk(KERN_INFO, "%pV", &vaf);
+        ath6kl_printk(KERN_INFO, "%pV", &vaf);
         trace_ath6kl_log_info(&vaf);
         va_end(args);
-
-        return ret;
 }
 EXPORT_SYMBOL(ath6kl_info);
 
-int ath6kl_err(const char *fmt, ...)
+void ath6kl_err(const char *fmt, ...)
 {
         struct va_format vaf = {
                 .fmt = fmt,
         };
         va_list args;
-        int ret;
 
         va_start(args, fmt);
         vaf.va = &args;
-        ret = ath6kl_printk(KERN_ERR, "%pV", &vaf);
+        ath6kl_printk(KERN_ERR, "%pV", &vaf);
         trace_ath6kl_log_err(&vaf);
         va_end(args);
-
-        return ret;
 }
 EXPORT_SYMBOL(ath6kl_err);
 
-int ath6kl_warn(const char *fmt, ...)
+void ath6kl_warn(const char *fmt, ...)
 {
         struct va_format vaf = {
                 .fmt = fmt,
         };
         va_list args;
-        int ret;
 
         va_start(args, fmt);
         vaf.va = &args;
-        ret = ath6kl_printk(KERN_WARNING, "%pV", &vaf);
+        ath6kl_printk(KERN_WARNING, "%pV", &vaf);
         trace_ath6kl_log_warn(&vaf);
         va_end(args);
-
-        return ret;
 }
 EXPORT_SYMBOL(ath6kl_warn);
 
diff --git a/drivers/net/wireless/ath/ath6kl/debug.h b/drivers/net/wireless/ath/ath6kl/debug.h
index e194c10d9f00..19106ed28961 100644
--- a/drivers/net/wireless/ath/ath6kl/debug.h
+++ b/drivers/net/wireless/ath/ath6kl/debug.h
@@ -50,10 +50,10 @@ enum ATH6K_DEBUG_MASK {
 };
 
 extern unsigned int debug_mask;
-__printf(2, 3) int ath6kl_printk(const char *level, const char *fmt, ...);
-__printf(1, 2) int ath6kl_info(const char *fmt, ...);
-__printf(1, 2) int ath6kl_err(const char *fmt, ...);
-__printf(1, 2) int ath6kl_warn(const char *fmt, ...);
+__printf(2, 3) void ath6kl_printk(const char *level, const char *fmt, ...);
+__printf(1, 2) void ath6kl_info(const char *fmt, ...);
+__printf(1, 2) void ath6kl_err(const char *fmt, ...);
+__printf(1, 2) void ath6kl_warn(const char *fmt, ...);
 
 enum ath6kl_war {
         ATH6KL_WAR_INVALID_RATE,
@@ -81,10 +81,9 @@ int ath6kl_debug_init_fs(struct ath6kl *ar);
 void ath6kl_debug_cleanup(struct ath6kl *ar);
 
 #else
-static inline int ath6kl_dbg(enum ATH6K_DEBUG_MASK dbg_mask,
-                             const char *fmt, ...)
+static inline void ath6kl_dbg(enum ATH6K_DEBUG_MASK dbg_mask,
+                              const char *fmt, ...)
 {
-        return 0;
 }
 
 static inline void ath6kl_dbg_dump(enum ATH6K_DEBUG_MASK mask,
diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c
index a6a5e40b3e98..9da3594fd010 100644
--- a/drivers/net/wireless/ath/ath6kl/usb.c
+++ b/drivers/net/wireless/ath/ath6kl/usb.c
@@ -1193,18 +1193,10 @@ static int ath6kl_usb_pm_resume(struct usb_interface *interface)
         return 0;
 }
 
-static int ath6kl_usb_pm_reset_resume(struct usb_interface *intf)
-{
-        if (usb_get_intfdata(intf))
-                ath6kl_usb_remove(intf);
-        return 0;
-}
-
 #else
 
 #define ath6kl_usb_pm_suspend NULL
 #define ath6kl_usb_pm_resume NULL
-#define ath6kl_usb_pm_reset_resume NULL
 
 #endif
 
@@ -1222,7 +1214,6 @@ static struct usb_driver ath6kl_usb_driver = {
         .probe = ath6kl_usb_probe,
         .suspend = ath6kl_usb_pm_suspend,
         .resume = ath6kl_usb_pm_resume,
-        .reset_resume = ath6kl_usb_pm_reset_resume,
         .disconnect = ath6kl_usb_remove,
         .id_table = ath6kl_usb_ids,
         .supports_autosuspend = true,
diff --git a/drivers/net/wireless/ath/ath9k/Kconfig b/drivers/net/wireless/ath/ath9k/Kconfig
index 896e63281b3b..fee0cadb0f5e 100644
--- a/drivers/net/wireless/ath/ath9k/Kconfig
+++ b/drivers/net/wireless/ath/ath9k/Kconfig
@@ -3,6 +3,8 @@ config ATH9K_HW
 config ATH9K_COMMON
         tristate
         select ATH_COMMON
+        select DEBUG_FS
+        select RELAY
 config ATH9K_DFS_DEBUGFS
         def_bool y
         depends on ATH9K_DEBUGFS && ATH9K_DFS_CERTIFIED
@@ -148,6 +150,11 @@ config ATH9K_CHANNEL_CONTEXT
          for multi-channel concurrency. Enable this if P2P PowerSave support
          is required.
 
+config ATH9K_PCOEM
+        bool "Atheros ath9k support for PC OEM cards" if EXPERT
+        depends on ATH9K
+        default y
+
 config ATH9K_HTC
        tristate "Atheros HTC based wireless cards support"
        depends on USB && MAC80211
diff --git a/drivers/net/wireless/ath/ath9k/Makefile b/drivers/net/wireless/ath/ath9k/Makefile
index 73704c1be736..473972288a84 100644
--- a/drivers/net/wireless/ath/ath9k/Makefile
+++ b/drivers/net/wireless/ath/ath9k/Makefile
@@ -16,8 +16,7 @@ ath9k-$(CONFIG_ATH9K_DFS_CERTIFIED) += dfs.o
 ath9k-$(CONFIG_ATH9K_TX99) += tx99.o
 ath9k-$(CONFIG_ATH9K_WOW) += wow.o
 
-ath9k-$(CONFIG_ATH9K_DEBUGFS) += debug.o \
-                                 spectral.o
+ath9k-$(CONFIG_ATH9K_DEBUGFS) += debug.o
 
 ath9k-$(CONFIG_ATH9K_STATION_STATISTICS) += debug_sta.o
 
@@ -32,7 +31,6 @@ ath9k_hw-y:=	\
                 ar5008_phy.o \
                 ar9002_calib.o \
                 ar9003_calib.o \
-                ar9003_rtt.o \
                 calib.o \
                 eeprom.o \
                 eeprom_def.o \
@@ -50,6 +48,8 @@ ath9k_hw-$(CONFIG_ATH9K_WOW) += ar9003_wow.o
 ath9k_hw-$(CONFIG_ATH9K_BTCOEX_SUPPORT) += btcoex.o \
                                            ar9003_mci.o
 
+ath9k_hw-$(CONFIG_ATH9K_PCOEM) += ar9003_rtt.o
+
 ath9k_hw-$(CONFIG_ATH9K_DYNACK) += dynack.o
 
 obj-$(CONFIG_ATH9K_HW) += ath9k_hw.o
@@ -58,7 +58,8 @@ obj-$(CONFIG_ATH9K_COMMON) += ath9k_common.o
 ath9k_common-y:=        common.o \
                         common-init.o \
                         common-beacon.o \
-                        common-debug.o
+                        common-debug.o \
+                        common-spectral.o
 
 ath9k_htc-y +=  htc_hst.o \
                 hif_usb.o \
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index b72d0be716db..5829074208fa 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -1190,7 +1190,7 @@ static void ar5008_hw_set_nf_limits(struct ath_hw *ah)
 static void ar5008_hw_set_radar_params(struct ath_hw *ah,
                                        struct ath_hw_radar_conf *conf)
 {
-        u32 radar_0 = 0, radar_1 = 0;
+        u32 radar_0 = 0, radar_1;
 
         if (!conf) {
                 REG_CLR_BIT(ah, AR_PHY_RADAR_0, AR_PHY_RADAR_0_ENA);
@@ -1204,6 +1204,9 @@ static void ar5008_hw_set_radar_params(struct ath_hw *ah,
         radar_0 |= SM(conf->pulse_rssi, AR_PHY_RADAR_0_PRSSI);
         radar_0 |= SM(conf->pulse_inband, AR_PHY_RADAR_0_INBAND);
 
+        radar_1 = REG_READ(ah, AR_PHY_RADAR_1);
+        radar_1 &= ~(AR_PHY_RADAR_1_MAXLEN | AR_PHY_RADAR_1_RELSTEP_THRESH |
+                     AR_PHY_RADAR_1_RELPWR_THRESH);
         radar_1 |= AR_PHY_RADAR_1_MAX_RRSSI;
         radar_1 |= AR_PHY_RADAR_1_BLOCK_CHECK;
         radar_1 |= SM(conf->pulse_maxlen, AR_PHY_RADAR_1_MAXLEN);
@@ -1225,7 +1228,7 @@ static void ar5008_hw_set_radar_conf(struct ath_hw *ah)
         conf->fir_power = -33;
         conf->radar_rssi = 20;
         conf->pulse_height = 10;
-        conf->pulse_rssi = 24;
+        conf->pulse_rssi = 15;
         conf->pulse_inband = 15;
         conf->pulse_maxlen = 255;
         conf->pulse_inband_step = 12;
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_calib.c b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
index cdc74005650c..42190b67c671 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
@@ -657,31 +657,29 @@ static void ar9002_hw_olc_temp_compensation(struct ath_hw *ah)
                 ar9280_hw_olc_temp_compensation(ah);
 }
 
-static bool ar9002_hw_calibrate(struct ath_hw *ah,
-                                struct ath9k_channel *chan,
-                                u8 rxchainmask,
-                                bool longcal)
+static int ar9002_hw_calibrate(struct ath_hw *ah, struct ath9k_channel *chan,
+                               u8 rxchainmask, bool longcal)
 {
-        bool iscaldone = true;
         struct ath9k_cal_list *currCal = ah->cal_list_curr;
-        bool nfcal, nfcal_pending = false;
+        bool nfcal, nfcal_pending = false, percal_pending;
+        int ret;
 
         nfcal = !!(REG_READ(ah, AR_PHY_AGC_CONTROL) & AR_PHY_AGC_CONTROL_NF);
         if (ah->caldata)
                 nfcal_pending = test_bit(NFCAL_PENDING, &ah->caldata->cal_flags);
 
-        if (currCal && !nfcal &&
-            (currCal->calState == CAL_RUNNING ||
-             currCal->calState == CAL_WAITING)) {
-                iscaldone = ar9002_hw_per_calibration(ah, chan,
-                                                      rxchainmask, currCal);
-                if (iscaldone) {
-                        ah->cal_list_curr = currCal = currCal->calNext;
-
-                        if (currCal->calState == CAL_WAITING) {
-                                iscaldone = false;
-                                ath9k_hw_reset_calibration(ah, currCal);
-                        }
+        percal_pending = (currCal &&
+                          (currCal->calState == CAL_RUNNING ||
+                           currCal->calState == CAL_WAITING));
+
+        if (percal_pending && !nfcal) {
+                if (!ar9002_hw_per_calibration(ah, chan, rxchainmask, currCal))
+                        return 0;
+
+                ah->cal_list_curr = currCal = currCal->calNext;
+                if (currCal->calState == CAL_WAITING) {
+                        ath9k_hw_reset_calibration(ah, currCal);
+                        return 0;
                 }
         }
 
@@ -698,7 +696,9 @@ static bool ar9002_hw_calibrate(struct ath_hw *ah,
                          * NF is slow time-variant, so it is OK to use a
                          * historical value.
                          */
-                        ath9k_hw_loadnf(ah, ah->curchan);
+                        ret = ath9k_hw_loadnf(ah, ah->curchan);
+                        if (ret < 0)
+                                return ret;
                 }
 
                 if (longcal) {
@@ -709,7 +709,7 @@ static bool ar9002_hw_calibrate(struct ath_hw *ah,
                 }
         }
 
-        return iscaldone;
+        return !percal_pending;
 }
 
 /* Carrier leakage Calibration fix */
@@ -856,6 +856,8 @@ static bool ar9002_hw_init_cal(struct ath_hw *ah, struct ath9k_channel *chan)
 
         /* Do PA Calibration */
         ar9002_hw_pa_cal(ah, true);
+        ath9k_hw_loadnf(ah, chan);
+        ath9k_hw_start_nfcal(ah, true);
 
         if (ah->caldata)
                 set_bit(NFCAL_PENDING, &ah->caldata->cal_flags);
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_phy.c b/drivers/net/wireless/ath/ath9k/ar9002_phy.c
index 9a2afa2c690b..fc08162b5820 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_phy.c
@@ -643,9 +643,12 @@ static void ar9002_hw_spectral_scan_config(struct ath_hw *ah,
          * and fix otherwise.
          */
         count = param->count;
-        if (param->endless)
-                count = 0x80;
-        else if (count & 0x80)
+        if (param->endless) {
+                if (AR_SREV_9271(ah))
+                        count = 0;
+                else
+                        count = 0x80;
+        } else if (count & 0x80)
                 count = 0x7f;
 
         REG_RMW_FIELD(ah, AR_PHY_SPECTRAL_SCAN,
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
index ac8301ef5242..06ab71db6e80 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
@@ -121,13 +121,12 @@ static bool ar9003_hw_per_calibration(struct ath_hw *ah,
         return iscaldone;
 }
 
-static bool ar9003_hw_calibrate(struct ath_hw *ah,
-                                struct ath9k_channel *chan,
-                                u8 rxchainmask,
-                                bool longcal)
+static int ar9003_hw_calibrate(struct ath_hw *ah, struct ath9k_channel *chan,
+                               u8 rxchainmask, bool longcal)
 {
         bool iscaldone = true;
         struct ath9k_cal_list *currCal = ah->cal_list_curr;
+        int ret;
 
         /*
          * For given calibration:
@@ -163,7 +162,9 @@ static bool ar9003_hw_calibrate(struct ath_hw *ah,
                  * NF is slow time-variant, so it is OK to use a historical
                  * value.
                  */
-                ath9k_hw_loadnf(ah, ah->curchan);
+                ret = ath9k_hw_loadnf(ah, ah->curchan);
+                if (ret < 0)
+                        return ret;
 
                 /* start NF calibration, without updating BB NF register */
                 ath9k_hw_start_nfcal(ah, false);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 80c6eacbda53..e726e405152c 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -4079,27 +4079,28 @@ static int ar9003_hw_get_thermometer(struct ath_hw *ah)
 
 static void ar9003_hw_thermometer_apply(struct ath_hw *ah)
 {
+        struct ath9k_hw_capabilities *pCap = &ah->caps;
         int thermometer = ar9003_hw_get_thermometer(ah);
         u8 therm_on = (thermometer < 0) ? 0 : 1;
 
         REG_RMW_FIELD(ah, AR_PHY_65NM_CH0_RXTX4,
                       AR_PHY_65NM_CH0_RXTX4_THERM_ON_OVR, therm_on);
-        if (ah->caps.tx_chainmask & BIT(1))
+        if (pCap->chip_chainmask & BIT(1))
                 REG_RMW_FIELD(ah, AR_PHY_65NM_CH1_RXTX4,
                               AR_PHY_65NM_CH0_RXTX4_THERM_ON_OVR, therm_on);
-        if (ah->caps.tx_chainmask & BIT(2))
+        if (pCap->chip_chainmask & BIT(2))
                 REG_RMW_FIELD(ah, AR_PHY_65NM_CH2_RXTX4,
                               AR_PHY_65NM_CH0_RXTX4_THERM_ON_OVR, therm_on);
 
         therm_on = (thermometer < 0) ? 0 : (thermometer == 0);
         REG_RMW_FIELD(ah, AR_PHY_65NM_CH0_RXTX4,
                       AR_PHY_65NM_CH0_RXTX4_THERM_ON, therm_on);
-        if (ah->caps.tx_chainmask & BIT(1)) {
+        if (pCap->chip_chainmask & BIT(1)) {
                 therm_on = (thermometer < 0) ? 0 : (thermometer == 1);
                 REG_RMW_FIELD(ah, AR_PHY_65NM_CH1_RXTX4,
                               AR_PHY_65NM_CH0_RXTX4_THERM_ON, therm_on);
         }
-        if (ah->caps.tx_chainmask & BIT(2)) {
+        if (pCap->chip_chainmask & BIT(2)) {
                 therm_on = (thermometer < 0) ? 0 : (thermometer == 2);
                 REG_RMW_FIELD(ah, AR_PHY_65NM_CH2_RXTX4,
                               AR_PHY_65NM_CH0_RXTX4_THERM_ON, therm_on);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_hw.c b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
index ddef9eedbac6..06ad2172030e 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
@@ -333,12 +333,29 @@ static void ar9003_hw_init_mode_regs(struct ath_hw *ah)
                                qca953x_1p0_soc_preamble);
                 INIT_INI_ARRAY(&ah->iniSOC[ATH_INI_POST],
                                qca953x_1p0_soc_postamble);
-                INIT_INI_ARRAY(&ah->iniModesRxGain,
-                               qca953x_1p0_common_wo_xlna_rx_gain_table);
-                INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
-                               qca953x_1p0_common_wo_xlna_rx_gain_bounds);
-                INIT_INI_ARRAY(&ah->iniModesTxGain,
-                               qca953x_1p0_modes_no_xpa_tx_gain_table);
+
+                if (AR_SREV_9531_20(ah)) {
+                        INIT_INI_ARRAY(&ah->iniModesRxGain,
+                                       qca953x_2p0_common_wo_xlna_rx_gain_table);
+                        INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
+                                       qca953x_2p0_common_wo_xlna_rx_gain_bounds);
+                } else {
+                        INIT_INI_ARRAY(&ah->iniModesRxGain,
+                                       qca953x_1p0_common_wo_xlna_rx_gain_table);
+                        INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
+                                       qca953x_1p0_common_wo_xlna_rx_gain_bounds);
+                }
+
+                if (AR_SREV_9531_20(ah))
+                        INIT_INI_ARRAY(&ah->iniModesTxGain,
+                                       qca953x_2p0_modes_no_xpa_tx_gain_table);
+                else if (AR_SREV_9531_11(ah))
+                        INIT_INI_ARRAY(&ah->iniModesTxGain,
+                                       qca953x_1p1_modes_no_xpa_tx_gain_table);
+                else
+                        INIT_INI_ARRAY(&ah->iniModesTxGain,
+                                       qca953x_1p0_modes_no_xpa_tx_gain_table);
+
                 INIT_INI_ARRAY(&ah->iniModesFastClock,
                                qca953x_1p0_modes_fast_clock);
         } else if (AR_SREV_9580(ah)) {
@@ -518,9 +535,15 @@ static void ar9003_tx_gain_table_mode0(struct ath_hw *ah)
         else if (AR_SREV_9550(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar955x_1p0_modes_xpa_tx_gain_table);
-        else if (AR_SREV_9531(ah))
+        else if (AR_SREV_9531_10(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               qca953x_1p0_modes_xpa_tx_gain_table);
+        else if (AR_SREV_9531_11(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               qca953x_1p1_modes_xpa_tx_gain_table);
+        else if (AR_SREV_9531_20(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
-                        qca953x_1p0_modes_xpa_tx_gain_table);
+                               qca953x_2p0_modes_xpa_tx_gain_table);
         else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9580_1p0_lowest_ob_db_tx_gain_table);
@@ -562,7 +585,10 @@ static void ar9003_tx_gain_table_mode1(struct ath_hw *ah)
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar955x_1p0_modes_no_xpa_tx_gain_table);
         else if (AR_SREV_9531(ah)) {
-                if (AR_SREV_9531_11(ah))
+                if (AR_SREV_9531_20(ah))
+                        INIT_INI_ARRAY(&ah->iniModesTxGain,
+                                       qca953x_2p0_modes_no_xpa_tx_gain_table);
+                else if (AR_SREV_9531_11(ah))
                         INIT_INI_ARRAY(&ah->iniModesTxGain,
                                        qca953x_1p1_modes_no_xpa_tx_gain_table);
                 else
@@ -670,9 +696,6 @@ static void ar9003_tx_gain_table_mode5(struct ath_hw *ah)
         if (AR_SREV_9485_11_OR_LATER(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9485Modes_green_ob_db_tx_gain_1_1);
-        else if (AR_SREV_9340(ah))
-                INIT_INI_ARRAY(&ah->iniModesTxGain,
-                        ar9340Modes_ub124_tx_gain_table_1p0);
         else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9580_1p0_type5_tx_gain_table);
@@ -792,11 +815,16 @@ static void ar9003_rx_gain_table_mode1(struct ath_hw *ah)
                         ar955x_1p0_common_wo_xlna_rx_gain_table);
                 INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
                         ar955x_1p0_common_wo_xlna_rx_gain_bounds);
-        } else if (AR_SREV_9531(ah)) {
+        } else if (AR_SREV_9531_10(ah) || AR_SREV_9531_11(ah)) {
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                                qca953x_1p0_common_wo_xlna_rx_gain_table);
                 INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
                                qca953x_1p0_common_wo_xlna_rx_gain_bounds);
+        } else if (AR_SREV_9531_20(ah)) {
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                               qca953x_2p0_common_wo_xlna_rx_gain_table);
+                INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
+                               qca953x_2p0_common_wo_xlna_rx_gain_bounds);
         } else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                         ar9580_1p0_wo_xlna_rx_gain_table);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index 697c4ae90af0..2df6d2ee70c2 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -664,6 +664,19 @@ static void ar9003_hw_override_ini(struct ath_hw *ah)
                 ah->enabled_cals |= TX_CL_CAL;
         else
                 ah->enabled_cals &= ~TX_CL_CAL;
+
+        if (AR_SREV_9340(ah) || AR_SREV_9531(ah) || AR_SREV_9550(ah)) {
+                if (ah->is_clk_25mhz) {
+                        REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x17c << 1);
+                        REG_WRITE(ah, AR_SLP32_MODE, 0x0010f3d7);
+                        REG_WRITE(ah, AR_SLP32_INC, 0x0001e7ae);
+                } else {
+                        REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x261 << 1);
+                        REG_WRITE(ah, AR_SLP32_MODE, 0x0010f400);
+                        REG_WRITE(ah, AR_SLP32_INC, 0x0001e800);
+                }
+                udelay(100);
+        }
 }
 
 static void ar9003_hw_prog_ini(struct ath_hw *ah,
@@ -1348,7 +1361,7 @@ static void ar9003_hw_set_radar_params(struct ath_hw *ah,
                                        struct ath_hw_radar_conf *conf)
 {
         unsigned int regWrites = 0;
-        u32 radar_0 = 0, radar_1 = 0;
+        u32 radar_0 = 0, radar_1;
 
         if (!conf) {
                 REG_CLR_BIT(ah, AR_PHY_RADAR_0, AR_PHY_RADAR_0_ENA);
@@ -1362,6 +1375,9 @@ static void ar9003_hw_set_radar_params(struct ath_hw *ah,
         radar_0 |= SM(conf->pulse_rssi, AR_PHY_RADAR_0_PRSSI);
         radar_0 |= SM(conf->pulse_inband, AR_PHY_RADAR_0_INBAND);
 
+        radar_1 = REG_READ(ah, AR_PHY_RADAR_1);
+        radar_1 &= ~(AR_PHY_RADAR_1_MAXLEN | AR_PHY_RADAR_1_RELSTEP_THRESH |
+                     AR_PHY_RADAR_1_RELPWR_THRESH);
         radar_1 |= AR_PHY_RADAR_1_MAX_RRSSI;
         radar_1 |= AR_PHY_RADAR_1_BLOCK_CHECK;
         radar_1 |= SM(conf->pulse_maxlen, AR_PHY_RADAR_1_MAXLEN);
@@ -1388,7 +1404,7 @@ static void ar9003_hw_set_radar_conf(struct ath_hw *ah)
         conf->fir_power = -28;
         conf->radar_rssi = 0;
         conf->pulse_height = 10;
-        conf->pulse_rssi = 24;
+        conf->pulse_rssi = 15;
         conf->pulse_inband = 8;
         conf->pulse_maxlen = 255;
         conf->pulse_inband_step = 12;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_rtt.h b/drivers/net/wireless/ath/ath9k/ar9003_rtt.h
index a43b30d723a4..6290467a75a0 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_rtt.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_rtt.h
@@ -17,6 +17,7 @@
 #ifndef AR9003_RTT_H
 #define AR9003_RTT_H
 
+#ifdef CONFIG_ATH9K_PCOEM
 void ar9003_hw_rtt_enable(struct ath_hw *ah);
 void ar9003_hw_rtt_disable(struct ath_hw *ah);
 void ar9003_hw_rtt_set_mask(struct ath_hw *ah, u32 rtt_mask);
@@ -25,5 +26,40 @@ void ar9003_hw_rtt_load_hist(struct ath_hw *ah);
 void ar9003_hw_rtt_fill_hist(struct ath_hw *ah);
 void ar9003_hw_rtt_clear_hist(struct ath_hw *ah);
 bool ar9003_hw_rtt_restore(struct ath_hw *ah, struct ath9k_channel *chan);
+#else
+static inline void ar9003_hw_rtt_enable(struct ath_hw *ah)
+{
+}
+
+static inline void ar9003_hw_rtt_disable(struct ath_hw *ah)
+{
+}
+
+static inline void ar9003_hw_rtt_set_mask(struct ath_hw *ah, u32 rtt_mask)
+{
+}
+
+static inline bool ar9003_hw_rtt_force_restore(struct ath_hw *ah)
+{
+        return false;
+}
+
+static inline void ar9003_hw_rtt_load_hist(struct ath_hw *ah)
+{
+}
+
+static inline void ar9003_hw_rtt_fill_hist(struct ath_hw *ah)
+{
+}
+
+static inline void ar9003_hw_rtt_clear_hist(struct ath_hw *ah)
+{
+}
+
+static inline bool ar9003_hw_rtt_restore(struct ath_hw *ah, struct ath9k_channel *chan)
+{
+        return false;
+}
+#endif
 
 #endif
diff --git a/drivers/net/wireless/ath/ath9k/ar953x_initvals.h b/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
index 812a9d787bf3..159cc6fd2362 100644
--- a/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
@@ -20,6 +20,8 @@
 
 #define qca953x_1p0_mac_postamble ar9300_2p2_mac_postamble
 
+#define qca953x_1p0_soc_preamble ar955x_1p0_soc_preamble
+
 #define qca953x_1p0_soc_postamble ar9300_2p2_soc_postamble
 
 #define qca953x_1p0_common_rx_gain_table ar9300Common_rx_gain_table_2p2
@@ -28,6 +30,10 @@
 
 #define qca953x_1p0_modes_fast_clock ar9300Modes_fast_clock_2p2
 
+#define qca953x_1p0_common_wo_xlna_rx_gain_bounds ar955x_1p0_common_wo_xlna_rx_gain_bounds
+
+#define qca953x_1p0_common_rx_gain_bounds ar955x_1p0_common_rx_gain_bounds
+
 static const u32 qca953x_1p0_mac_core[][2] = {
         /* Addr      allmodes  */
         {0x00000008, 0x00000000},
@@ -490,35 +496,6 @@ static const u32 qca953x_1p0_radio_postamble[][5] = {
         {0x00016540, 0x10804008, 0x10804008, 0x50804000, 0x50804000},
 };
 
-static const u32 qca953x_1p0_soc_preamble[][2] = {
-        /* Addr      allmodes  */
-        {0x00007000, 0x00000000},
-        {0x00007004, 0x00000000},
-        {0x00007008, 0x00000000},
-        {0x0000700c, 0x00000000},
-        {0x0000701c, 0x00000000},
-        {0x00007020, 0x00000000},
-        {0x00007024, 0x00000000},
-        {0x00007028, 0x00000000},
-        {0x0000702c, 0x00000000},
-        {0x00007030, 0x00000000},
-        {0x00007034, 0x00000002},
-        {0x00007038, 0x000004c2},
-        {0x00007048, 0x00000000},
-};
-
-static const u32 qca953x_1p0_common_rx_gain_bounds[][5] = {
-        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x00009e44, 0xfe321e27, 0xfe321e27, 0xfe291e27, 0xfe291e27},
-        {0x00009e48, 0x5030201a, 0x5030201a, 0x50302018, 0x50302018},
-};
-
-static const u32 qca953x_1p0_common_wo_xlna_rx_gain_bounds[][5] = {
-        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x00009e44, 0xfe321e27, 0xfe321e27, 0xfe291e27, 0xfe291e27},
-        {0x00009e48, 0x5030201a, 0x5030201a, 0x50302012, 0x50302012},
-};
-
 static const u32 qca953x_1p0_modes_xpa_tx_gain_table[][2] = {
         /* Addr      allmodes  */
         {0x0000a2dc, 0xfffd5aaa},
@@ -715,8 +692,73 @@ static const u32 qca953x_1p1_modes_no_xpa_tx_gain_table[][2] = {
         {0x00016448, 0x6c927a70},
 };
 
+static const u32 qca953x_1p1_modes_xpa_tx_gain_table[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a2dc, 0xfffb52aa},
+        {0x0000a2e0, 0xfffd64cc},
+        {0x0000a2e4, 0xfffe80f0},
+        {0x0000a2e8, 0xffffff00},
+        {0x0000a410, 0x000050d5},
+        {0x0000a500, 0x00000000},
+        {0x0000a504, 0x04000002},
+        {0x0000a508, 0x08000004},
+        {0x0000a50c, 0x0c000006},
+        {0x0000a510, 0x1000000a},
+        {0x0000a514, 0x1400000c},
+        {0x0000a518, 0x1800000e},
+        {0x0000a51c, 0x1c000048},
+        {0x0000a520, 0x2000004a},
+        {0x0000a524, 0x2400004c},
+        {0x0000a528, 0x2800004e},
+        {0x0000a52c, 0x2b00024a},
+        {0x0000a530, 0x2f00024c},
+        {0x0000a534, 0x3300024e},
+        {0x0000a538, 0x36000668},
+        {0x0000a53c, 0x38000669},
+        {0x0000a540, 0x3a000868},
+        {0x0000a544, 0x3d00086a},
+        {0x0000a548, 0x4000086c},
+        {0x0000a54c, 0x4200086e},
+        {0x0000a550, 0x43000a6e},
+        {0x0000a554, 0x43000a6e},
+        {0x0000a558, 0x43000a6e},
+        {0x0000a55c, 0x43000a6e},
+        {0x0000a560, 0x43000a6e},
+        {0x0000a564, 0x43000a6e},
+        {0x0000a568, 0x43000a6e},
+        {0x0000a56c, 0x43000a6e},
+        {0x0000a570, 0x43000a6e},
+        {0x0000a574, 0x43000a6e},
+        {0x0000a578, 0x43000a6e},
+        {0x0000a57c, 0x43000a6e},
+        {0x0000a600, 0x00000000},
+        {0x0000a604, 0x00000000},
+        {0x0000a608, 0x00000000},
+        {0x0000a60c, 0x03804000},
+        {0x0000a610, 0x03804e01},
+        {0x0000a614, 0x03804e01},
+        {0x0000a618, 0x03804e01},
+        {0x0000a61c, 0x04009002},
+        {0x0000a620, 0x04009002},
+        {0x0000a624, 0x04009002},
+        {0x0000a628, 0x04009002},
+        {0x0000a62c, 0x04009002},
+        {0x0000a630, 0x04009002},
+        {0x0000a634, 0x04009002},
+        {0x0000a638, 0x04009002},
+        {0x0000a63c, 0x04009002},
+        {0x0000b2dc, 0xfffb52aa},
+        {0x0000b2e0, 0xfffd64cc},
+        {0x0000b2e4, 0xfffe80f0},
+        {0x0000b2e8, 0xffffff00},
+        {0x00016044, 0x024922db},
+        {0x00016048, 0x6c927a70},
+        {0x00016444, 0x024922db},
+        {0x00016448, 0x6c927a70},
+};
+
 static const u32 qca953x_2p0_baseband_core[][2] = {
-        /* Addr      allmodes */
+        /* Addr      allmodes  */
         {0x00009800, 0xafe68e30},
         {0x00009804, 0xfd14e000},
         {0x00009808, 0x9c0a9f6b},
@@ -914,4 +956,400 @@ static const u32 qca953x_2p0_baseband_postamble[][5] = {
         {0x0000b284, 0x00000000, 0x00000000, 0x00000010, 0x00000010},
 };
 
+static const u32 qca953x_2p0_common_wo_xlna_rx_gain_table[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a000, 0x00010000},
+        {0x0000a004, 0x00030002},
+        {0x0000a008, 0x00050004},
+        {0x0000a00c, 0x00810080},
+        {0x0000a010, 0x00830082},
+        {0x0000a014, 0x01810180},
+        {0x0000a018, 0x01830182},
+        {0x0000a01c, 0x01850184},
+        {0x0000a020, 0x01890188},
+        {0x0000a024, 0x018b018a},
+        {0x0000a028, 0x018d018c},
+        {0x0000a02c, 0x03820190},
+        {0x0000a030, 0x03840383},
+        {0x0000a034, 0x03880385},
+        {0x0000a038, 0x038a0389},
+        {0x0000a03c, 0x038c038b},
+        {0x0000a040, 0x0390038d},
+        {0x0000a044, 0x03920391},
+        {0x0000a048, 0x03940393},
+        {0x0000a04c, 0x03960395},
+        {0x0000a050, 0x00000000},
+        {0x0000a054, 0x00000000},
+        {0x0000a058, 0x00000000},
+        {0x0000a05c, 0x00000000},
+        {0x0000a060, 0x00000000},
+        {0x0000a064, 0x00000000},
+        {0x0000a068, 0x00000000},
+        {0x0000a06c, 0x00000000},
+        {0x0000a070, 0x00000000},
+        {0x0000a074, 0x00000000},
+        {0x0000a078, 0x00000000},
+        {0x0000a07c, 0x00000000},
+        {0x0000a080, 0x29292929},
+        {0x0000a084, 0x29292929},
+        {0x0000a088, 0x29292929},
+        {0x0000a08c, 0x29292929},
+        {0x0000a090, 0x22292929},
+        {0x0000a094, 0x1d1d2222},
+        {0x0000a098, 0x0c111117},
+        {0x0000a09c, 0x00030303},
+        {0x0000a0a0, 0x00000000},
+        {0x0000a0a4, 0x00000000},
+        {0x0000a0a8, 0x00000000},
+        {0x0000a0ac, 0x00000000},
+        {0x0000a0b0, 0x00000000},
+        {0x0000a0b4, 0x00000000},
+        {0x0000a0b8, 0x00000000},
+        {0x0000a0bc, 0x00000000},
+        {0x0000a0c0, 0x001f0000},
+        {0x0000a0c4, 0x01000101},
+        {0x0000a0c8, 0x011e011f},
+        {0x0000a0cc, 0x011c011d},
+        {0x0000a0d0, 0x02030204},
+        {0x0000a0d4, 0x02010202},
+        {0x0000a0d8, 0x021f0200},
+        {0x0000a0dc, 0x0302021e},
+        {0x0000a0e0, 0x03000301},
+        {0x0000a0e4, 0x031e031f},
+        {0x0000a0e8, 0x0402031d},
+        {0x0000a0ec, 0x04000401},
+        {0x0000a0f0, 0x041e041f},
+        {0x0000a0f4, 0x0502041d},
+        {0x0000a0f8, 0x05000501},
+        {0x0000a0fc, 0x051e051f},
+        {0x0000a100, 0x06010602},
+        {0x0000a104, 0x061f0600},
+        {0x0000a108, 0x061d061e},
+        {0x0000a10c, 0x07020703},
+        {0x0000a110, 0x07000701},
+        {0x0000a114, 0x00000000},
+        {0x0000a118, 0x00000000},
+        {0x0000a11c, 0x00000000},
+        {0x0000a120, 0x00000000},
+        {0x0000a124, 0x00000000},
+        {0x0000a128, 0x00000000},
+        {0x0000a12c, 0x00000000},
+        {0x0000a130, 0x00000000},
+        {0x0000a134, 0x00000000},
+        {0x0000a138, 0x00000000},
+        {0x0000a13c, 0x00000000},
+        {0x0000a140, 0x001f0000},
+        {0x0000a144, 0x01000101},
+        {0x0000a148, 0x011e011f},
+        {0x0000a14c, 0x011c011d},
+        {0x0000a150, 0x02030204},
+        {0x0000a154, 0x02010202},
+        {0x0000a158, 0x021f0200},
+        {0x0000a15c, 0x0302021e},
+        {0x0000a160, 0x03000301},
+        {0x0000a164, 0x031e031f},
+        {0x0000a168, 0x0402031d},
+        {0x0000a16c, 0x04000401},
+        {0x0000a170, 0x041e041f},
+        {0x0000a174, 0x0502041d},
+        {0x0000a178, 0x05000501},
+        {0x0000a17c, 0x051e051f},
+        {0x0000a180, 0x06010602},
+        {0x0000a184, 0x061f0600},
+        {0x0000a188, 0x061d061e},
+        {0x0000a18c, 0x07020703},
+        {0x0000a190, 0x07000701},
+        {0x0000a194, 0x00000000},
+        {0x0000a198, 0x00000000},
+        {0x0000a19c, 0x00000000},
+        {0x0000a1a0, 0x00000000},
+        {0x0000a1a4, 0x00000000},
+        {0x0000a1a8, 0x00000000},
+        {0x0000a1ac, 0x00000000},
+        {0x0000a1b0, 0x00000000},
+        {0x0000a1b4, 0x00000000},
+        {0x0000a1b8, 0x00000000},
+        {0x0000a1bc, 0x00000000},
+        {0x0000a1c0, 0x00000000},
+        {0x0000a1c4, 0x00000000},
+        {0x0000a1c8, 0x00000000},
+        {0x0000a1cc, 0x00000000},
+        {0x0000a1d0, 0x00000000},
+        {0x0000a1d4, 0x00000000},
+        {0x0000a1d8, 0x00000000},
+        {0x0000a1dc, 0x00000000},
+        {0x0000a1e0, 0x00000000},
+        {0x0000a1e4, 0x00000000},
+        {0x0000a1e8, 0x00000000},
+        {0x0000a1ec, 0x00000000},
+        {0x0000a1f0, 0x00000396},
+        {0x0000a1f4, 0x00000396},
+        {0x0000a1f8, 0x00000396},
+        {0x0000a1fc, 0x00000196},
+        {0x0000b000, 0x00010000},
+        {0x0000b004, 0x00030002},
+        {0x0000b008, 0x00050004},
+        {0x0000b00c, 0x00810080},
+        {0x0000b010, 0x00830082},
+        {0x0000b014, 0x01810180},
+        {0x0000b018, 0x01830182},
+        {0x0000b01c, 0x01850184},
+        {0x0000b020, 0x02810280},
+        {0x0000b024, 0x02830282},
+        {0x0000b028, 0x02850284},
+        {0x0000b02c, 0x02890288},
+        {0x0000b030, 0x028b028a},
+        {0x0000b034, 0x0388028c},
+        {0x0000b038, 0x038a0389},
+        {0x0000b03c, 0x038c038b},
+        {0x0000b040, 0x0390038d},
+        {0x0000b044, 0x03920391},
+        {0x0000b048, 0x03940393},
+        {0x0000b04c, 0x03960395},
+        {0x0000b050, 0x00000000},
+        {0x0000b054, 0x00000000},
+        {0x0000b058, 0x00000000},
+        {0x0000b05c, 0x00000000},
+        {0x0000b060, 0x00000000},
+        {0x0000b064, 0x00000000},
+        {0x0000b068, 0x00000000},
+        {0x0000b06c, 0x00000000},
+        {0x0000b070, 0x00000000},
+        {0x0000b074, 0x00000000},
+        {0x0000b078, 0x00000000},
+        {0x0000b07c, 0x00000000},
+        {0x0000b080, 0x32323232},
+        {0x0000b084, 0x2f2f3232},
+        {0x0000b088, 0x23282a2d},
+        {0x0000b08c, 0x1c1e2123},
+        {0x0000b090, 0x14171919},
+        {0x0000b094, 0x0e0e1214},
+        {0x0000b098, 0x03050707},
+        {0x0000b09c, 0x00030303},
+        {0x0000b0a0, 0x00000000},
+        {0x0000b0a4, 0x00000000},
+        {0x0000b0a8, 0x00000000},
+        {0x0000b0ac, 0x00000000},
+        {0x0000b0b0, 0x00000000},
+        {0x0000b0b4, 0x00000000},
+        {0x0000b0b8, 0x00000000},
+        {0x0000b0bc, 0x00000000},
+        {0x0000b0c0, 0x003f0020},
+        {0x0000b0c4, 0x00400041},
+        {0x0000b0c8, 0x0140005f},
+        {0x0000b0cc, 0x0160015f},
+        {0x0000b0d0, 0x017e017f},
+        {0x0000b0d4, 0x02410242},
+        {0x0000b0d8, 0x025f0240},
+        {0x0000b0dc, 0x027f0260},
+        {0x0000b0e0, 0x0341027e},
+        {0x0000b0e4, 0x035f0340},
+        {0x0000b0e8, 0x037f0360},
+        {0x0000b0ec, 0x04400441},
+        {0x0000b0f0, 0x0460045f},
+        {0x0000b0f4, 0x0541047f},
+        {0x0000b0f8, 0x055f0540},
+        {0x0000b0fc, 0x057f0560},
+        {0x0000b100, 0x06400641},
+        {0x0000b104, 0x0660065f},
+        {0x0000b108, 0x067e067f},
+        {0x0000b10c, 0x07410742},
+        {0x0000b110, 0x075f0740},
+        {0x0000b114, 0x077f0760},
+        {0x0000b118, 0x07800781},
+        {0x0000b11c, 0x07a0079f},
+        {0x0000b120, 0x07c107bf},
+        {0x0000b124, 0x000007c0},
+        {0x0000b128, 0x00000000},
+        {0x0000b12c, 0x00000000},
+        {0x0000b130, 0x00000000},
+        {0x0000b134, 0x00000000},
+        {0x0000b138, 0x00000000},
+        {0x0000b13c, 0x00000000},
+        {0x0000b140, 0x003f0020},
+        {0x0000b144, 0x00400041},
+        {0x0000b148, 0x0140005f},
+        {0x0000b14c, 0x0160015f},
+        {0x0000b150, 0x017e017f},
+        {0x0000b154, 0x02410242},
+        {0x0000b158, 0x025f0240},
+        {0x0000b15c, 0x027f0260},
+        {0x0000b160, 0x0341027e},
+        {0x0000b164, 0x035f0340},
+        {0x0000b168, 0x037f0360},
+        {0x0000b16c, 0x04400441},
+        {0x0000b170, 0x0460045f},
+        {0x0000b174, 0x0541047f},
+        {0x0000b178, 0x055f0540},
+        {0x0000b17c, 0x057f0560},
+        {0x0000b180, 0x06400641},
+        {0x0000b184, 0x0660065f},
+        {0x0000b188, 0x067e067f},
+        {0x0000b18c, 0x07410742},
+        {0x0000b190, 0x075f0740},
+        {0x0000b194, 0x077f0760},
+        {0x0000b198, 0x07800781},
+        {0x0000b19c, 0x07a0079f},
+        {0x0000b1a0, 0x07c107bf},
+        {0x0000b1a4, 0x000007c0},
+        {0x0000b1a8, 0x00000000},
+        {0x0000b1ac, 0x00000000},
+        {0x0000b1b0, 0x00000000},
+        {0x0000b1b4, 0x00000000},
+        {0x0000b1b8, 0x00000000},
+        {0x0000b1bc, 0x00000000},
+        {0x0000b1c0, 0x00000000},
+        {0x0000b1c4, 0x00000000},
+        {0x0000b1c8, 0x00000000},
+        {0x0000b1cc, 0x00000000},
+        {0x0000b1d0, 0x00000000},
+        {0x0000b1d4, 0x00000000},
+        {0x0000b1d8, 0x00000000},
+        {0x0000b1dc, 0x00000000},
+        {0x0000b1e0, 0x00000000},
+        {0x0000b1e4, 0x00000000},
+        {0x0000b1e8, 0x00000000},
+        {0x0000b1ec, 0x00000000},
+        {0x0000b1f0, 0x00000396},
+        {0x0000b1f4, 0x00000396},
+        {0x0000b1f8, 0x00000396},
+        {0x0000b1fc, 0x00000196},
+};
+
+static const u32 qca953x_2p0_common_wo_xlna_rx_gain_bounds[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00009e44, 0xfe321e27, 0xfe321e27, 0xfe291e27, 0xfe291e27},
+        {0x00009e48, 0x5030201a, 0x5030201a, 0x50302012, 0x50302012},
+};
+
+static const u32 qca953x_2p0_modes_xpa_tx_gain_table[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a2dc, 0xfffb52aa},
+        {0x0000a2e0, 0xfffd64cc},
+        {0x0000a2e4, 0xfffe80f0},
+        {0x0000a2e8, 0xffffff00},
+        {0x0000a410, 0x000050d5},
+        {0x0000a500, 0x00000000},
+        {0x0000a504, 0x04000002},
+        {0x0000a508, 0x08000004},
+        {0x0000a50c, 0x0c000006},
+        {0x0000a510, 0x1000000a},
+        {0x0000a514, 0x1400000c},
+        {0x0000a518, 0x1800000e},
+        {0x0000a51c, 0x1c000048},
+        {0x0000a520, 0x2000004a},
+        {0x0000a524, 0x2400004c},
+        {0x0000a528, 0x2800004e},
+        {0x0000a52c, 0x2b00024a},
+        {0x0000a530, 0x2f00024c},
+        {0x0000a534, 0x3300024e},
+        {0x0000a538, 0x36000668},
+        {0x0000a53c, 0x38000669},
+        {0x0000a540, 0x3a000868},
+        {0x0000a544, 0x3d00086a},
+        {0x0000a548, 0x4000086c},
+        {0x0000a54c, 0x4200086e},
+        {0x0000a550, 0x43000a6e},
+        {0x0000a554, 0x43000a6e},
+        {0x0000a558, 0x43000a6e},
+        {0x0000a55c, 0x43000a6e},
+        {0x0000a560, 0x43000a6e},
+        {0x0000a564, 0x43000a6e},
+        {0x0000a568, 0x43000a6e},
+        {0x0000a56c, 0x43000a6e},
+        {0x0000a570, 0x43000a6e},
+        {0x0000a574, 0x43000a6e},
+        {0x0000a578, 0x43000a6e},
+        {0x0000a57c, 0x43000a6e},
+        {0x0000a600, 0x00000000},
+        {0x0000a604, 0x00000000},
+        {0x0000a608, 0x00000000},
+        {0x0000a60c, 0x03804000},
+        {0x0000a610, 0x03804e01},
+        {0x0000a614, 0x03804e01},
+        {0x0000a618, 0x03804e01},
+        {0x0000a61c, 0x04009002},
+        {0x0000a620, 0x04009002},
+        {0x0000a624, 0x04009002},
+        {0x0000a628, 0x04009002},
+        {0x0000a62c, 0x04009002},
+        {0x0000a630, 0x04009002},
+        {0x0000a634, 0x04009002},
+        {0x0000a638, 0x04009002},
+        {0x0000a63c, 0x04009002},
+        {0x0000b2dc, 0xfffb52aa},
+        {0x0000b2e0, 0xfffd64cc},
+        {0x0000b2e4, 0xfffe80f0},
+        {0x0000b2e8, 0xffffff00},
+        {0x00016044, 0x024922db},
+        {0x00016048, 0x6c927a70},
+        {0x00016444, 0x024922db},
+        {0x00016448, 0x6c927a70},
+};
+
+static const u32 qca953x_2p0_modes_no_xpa_tx_gain_table[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a2dc, 0xffd5f552},
+        {0x0000a2e0, 0xffe60664},
+        {0x0000a2e4, 0xfff80780},
+        {0x0000a2e8, 0xfffff800},
+        {0x0000a410, 0x000050de},
+        {0x0000a500, 0x00000061},
+        {0x0000a504, 0x04000063},
+        {0x0000a508, 0x08000065},
+        {0x0000a50c, 0x0c000261},
+        {0x0000a510, 0x10000263},
+        {0x0000a514, 0x14000265},
+        {0x0000a518, 0x18000482},
+        {0x0000a51c, 0x1b000484},
+        {0x0000a520, 0x1f000486},
+        {0x0000a524, 0x240008c2},
+        {0x0000a528, 0x28000cc1},
+        {0x0000a52c, 0x2d000ce3},
+        {0x0000a530, 0x31000ce5},
+        {0x0000a534, 0x350010e5},
+        {0x0000a538, 0x360012e5},
+        {0x0000a53c, 0x380014e5},
+        {0x0000a540, 0x3b0018e5},
+        {0x0000a544, 0x3d001d04},
+        {0x0000a548, 0x3e001d05},
+        {0x0000a54c, 0x40001d07},
+        {0x0000a550, 0x42001f27},
+        {0x0000a554, 0x43001f67},
+        {0x0000a558, 0x46001fe7},
+        {0x0000a55c, 0x47001f2b},
+        {0x0000a560, 0x49001f0d},
+        {0x0000a564, 0x4b001ed2},
+        {0x0000a568, 0x4c001ed4},
+        {0x0000a56c, 0x4e001f15},
+        {0x0000a570, 0x4f001ff6},
+        {0x0000a574, 0x4f001ff6},
+        {0x0000a578, 0x4f001ff6},
+        {0x0000a57c, 0x4f001ff6},
+        {0x0000a600, 0x00000000},
+        {0x0000a604, 0x00000000},
+        {0x0000a608, 0x00000000},
+        {0x0000a60c, 0x00804201},
+        {0x0000a610, 0x01008201},
+        {0x0000a614, 0x0180c402},
+        {0x0000a618, 0x0180c603},
+        {0x0000a61c, 0x0180c603},
+        {0x0000a620, 0x01c10603},
+        {0x0000a624, 0x01c10704},
+        {0x0000a628, 0x02c18b05},
+        {0x0000a62c, 0x02c14c07},
+        {0x0000a630, 0x01008704},
+        {0x0000a634, 0x01c10402},
+        {0x0000a638, 0x0301cc07},
+        {0x0000a63c, 0x0301cc07},
+        {0x0000b2dc, 0xffd5f552},
+        {0x0000b2e0, 0xffe60664},
+        {0x0000b2e4, 0xfff80780},
+        {0x0000b2e8, 0xfffff800},
+        {0x00016044, 0x049242db},
+        {0x00016048, 0x6c927a70},
+        {0x00016444, 0x049242db},
+        {0x00016448, 0x6c927a70},
+};
+
 #endif /* INITVALS_953X_H */
diff --git a/drivers/net/wireless/ath/ath9k/ar955x_1p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar955x_1p0_initvals.h
index 74d8bc05b317..fd6a84ccd49e 100644
--- a/drivers/net/wireless/ath/ath9k/ar955x_1p0_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar955x_1p0_initvals.h
@@ -507,7 +507,7 @@ static const u32 ar955x_1p0_baseband_core[][2] = {
         {0x00009d04, 0x40206c10},
         {0x00009d08, 0x009c4060},
         {0x00009d0c, 0x9883800a},
-        {0x00009d10, 0x01834061},
+        {0x00009d10, 0x01884061},
         {0x00009d14, 0x00c0040b},
         {0x00009d18, 0x00000000},
         {0x00009e08, 0x0038230c},
@@ -545,9 +545,9 @@ static const u32 ar955x_1p0_baseband_core[][2] = {
         {0x0000a370, 0x00000000},
         {0x0000a390, 0x00000001},
         {0x0000a394, 0x00000444},
-        {0x0000a398, 0x1f020503},
-        {0x0000a39c, 0x29180c03},
-        {0x0000a3a0, 0x9a8b6844},
+        {0x0000a398, 0x001f0e0f},
+        {0x0000a39c, 0x0075393f},
+        {0x0000a3a0, 0xb79f6427},
         {0x0000a3a4, 0x00000000},
         {0x0000a3a8, 0xaaaaaaaa},
         {0x0000a3ac, 0x3c466478},
diff --git a/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
index a5ca65240af3..5d4629f96c15 100644
--- a/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
@@ -24,7 +24,149 @@
 
 #define ar9580_1p0_soc_postamble ar9300_2p2_soc_postamble
 
-#define ar9580_1p0_radio_core ar9300_2p2_radio_core
+static const u32 ar9580_1p0_radio_core[][2] = {
+        /* Addr      allmodes  */
+        {0x00016000, 0x36db2db6},
+        {0x00016004, 0x6db6db40},
+        {0x00016008, 0x73f00000},
+        {0x0001600c, 0x00000000},
+        {0x00016040, 0x7f80fff8},
+        {0x0001604c, 0x76d005b5},
+        {0x00016050, 0x556cf031},
+        {0x00016054, 0x13449440},
+        {0x00016058, 0x0c51c92c},
+        {0x0001605c, 0x3db7fffc},
+        {0x00016060, 0xfffffffc},
+        {0x00016064, 0x000f0278},
+        {0x0001606c, 0x6db60000},
+        {0x00016080, 0x00000000},
+        {0x00016084, 0x0e48048c},
+        {0x00016088, 0x54214514},
+        {0x0001608c, 0x119f481e},
+        {0x00016090, 0x24926490},
+        {0x00016098, 0xd2888888},
+        {0x000160a0, 0x0a108ffe},
+        {0x000160a4, 0x812fc370},
+        {0x000160a8, 0x423c8000},
+        {0x000160b4, 0x92480080},
+        {0x000160c0, 0x00adb6d0},
+        {0x000160c4, 0x6db6db60},
+        {0x000160c8, 0x6db6db6c},
+        {0x000160cc, 0x01e6c000},
+        {0x00016100, 0x3fffbe01},
+        {0x00016104, 0xfff80000},
+        {0x00016108, 0x00080010},
+        {0x00016144, 0x02084080},
+        {0x00016148, 0x00000000},
+        {0x00016280, 0x058a0001},
+        {0x00016284, 0x3d840208},
+        {0x00016288, 0x05a20408},
+        {0x0001628c, 0x00038c07},
+        {0x00016290, 0x00000004},
+        {0x00016294, 0x458a214f},
+        {0x00016380, 0x00000000},
+        {0x00016384, 0x00000000},
+        {0x00016388, 0x00800700},
+        {0x0001638c, 0x00800700},
+        {0x00016390, 0x00800700},
+        {0x00016394, 0x00000000},
+        {0x00016398, 0x00000000},
+        {0x0001639c, 0x00000000},
+        {0x000163a0, 0x00000001},
+        {0x000163a4, 0x00000001},
+        {0x000163a8, 0x00000000},
+        {0x000163ac, 0x00000000},
+        {0x000163b0, 0x00000000},
+        {0x000163b4, 0x00000000},
+        {0x000163b8, 0x00000000},
+        {0x000163bc, 0x00000000},
+        {0x000163c0, 0x000000a0},
+        {0x000163c4, 0x000c0000},
+        {0x000163c8, 0x14021402},
+        {0x000163cc, 0x00001402},
+        {0x000163d0, 0x00000000},
+        {0x000163d4, 0x00000000},
+        {0x00016400, 0x36db2db6},
+        {0x00016404, 0x6db6db40},
+        {0x00016408, 0x73f00000},
+        {0x0001640c, 0x00000000},
+        {0x00016440, 0x7f80fff8},
+        {0x0001644c, 0x76d005b5},
+        {0x00016450, 0x556cf031},
+        {0x00016454, 0x13449440},
+        {0x00016458, 0x0c51c92c},
+        {0x0001645c, 0x3db7fffc},
+        {0x00016460, 0xfffffffc},
+        {0x00016464, 0x000f0278},
+        {0x0001646c, 0x6db60000},
+        {0x00016500, 0x3fffbe01},
+        {0x00016504, 0xfff80000},
+        {0x00016508, 0x00080010},
+        {0x00016544, 0x02084080},
+        {0x00016548, 0x00000000},
+        {0x00016780, 0x00000000},
+        {0x00016784, 0x00000000},
+        {0x00016788, 0x00800700},
+        {0x0001678c, 0x00800700},
+        {0x00016790, 0x00800700},
+        {0x00016794, 0x00000000},
+        {0x00016798, 0x00000000},
+        {0x0001679c, 0x00000000},
+        {0x000167a0, 0x00000001},
+        {0x000167a4, 0x00000001},
+        {0x000167a8, 0x00000000},
+        {0x000167ac, 0x00000000},
+        {0x000167b0, 0x00000000},
+        {0x000167b4, 0x00000000},
+        {0x000167b8, 0x00000000},
+        {0x000167bc, 0x00000000},
+        {0x000167c0, 0x000000a0},
+        {0x000167c4, 0x000c0000},
+        {0x000167c8, 0x14021402},
+        {0x000167cc, 0x00001402},
+        {0x000167d0, 0x00000000},
+        {0x000167d4, 0x00000000},
+        {0x00016800, 0x36db2db6},
+        {0x00016804, 0x6db6db40},
+        {0x00016808, 0x73f00000},
+        {0x0001680c, 0x00000000},
+        {0x00016840, 0x7f80fff8},
+        {0x0001684c, 0x76d005b5},
+        {0x00016850, 0x556cf031},
+        {0x00016854, 0x13449440},
+        {0x00016858, 0x0c51c92c},
+        {0x0001685c, 0x3db7fffc},
+        {0x00016860, 0xfffffffc},
+        {0x00016864, 0x000f0278},
+        {0x0001686c, 0x6db60000},
+        {0x00016900, 0x3fffbe01},
+        {0x00016904, 0xfff80000},
+        {0x00016908, 0x00080010},
+        {0x00016944, 0x02084080},
+        {0x00016948, 0x00000000},
+        {0x00016b80, 0x00000000},
+        {0x00016b84, 0x00000000},
+        {0x00016b88, 0x00800700},
+        {0x00016b8c, 0x00800700},
+        {0x00016b90, 0x00800700},
+        {0x00016b94, 0x00000000},
+        {0x00016b98, 0x00000000},
+        {0x00016b9c, 0x00000000},
+        {0x00016ba0, 0x00000001},
+        {0x00016ba4, 0x00000001},
+        {0x00016ba8, 0x00000000},
+        {0x00016bac, 0x00000000},
+        {0x00016bb0, 0x00000000},
+        {0x00016bb4, 0x00000000},
+        {0x00016bb8, 0x00000000},
+        {0x00016bbc, 0x00000000},
+        {0x00016bc0, 0x000000a0},
+        {0x00016bc4, 0x000c0000},
+        {0x00016bc8, 0x14021402},
+        {0x00016bcc, 0x00001402},
+        {0x00016bd0, 0x00000000},
+        {0x00016bd4, 0x00000000},
+};
 
 #define ar9580_1p0_mac_postamble ar9300_2p2_mac_postamble
 
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index bfa0b1518da1..abe8bd6b972d 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -28,7 +28,6 @@
 #include "debug.h"
 #include "mci.h"
 #include "dfs.h"
-#include "spectral.h"
 
 struct ath_node;
 struct ath_vif;
@@ -294,7 +293,6 @@ struct ath_tx_control {
  *  (axq_qnum).
  */
 struct ath_tx {
-        u16 seq_no;
         u32 txqsetup;
         spinlock_t txbuflock;
         struct list_head txbuf;
@@ -346,7 +344,9 @@ struct ath_chanctx {
         u64 tsf_val;
         u32 last_beacon;
 
+        int flush_timeout;
         u16 txpower;
+        u16 cur_txpower;
         bool offchannel;
         bool stopped;
         bool active;
@@ -363,7 +363,7 @@ enum ath_chanctx_event {
         ATH_CHANCTX_EVENT_BEACON_SENT,
         ATH_CHANCTX_EVENT_TSF_TIMER,
         ATH_CHANCTX_EVENT_BEACON_RECEIVED,
-        ATH_CHANCTX_EVENT_ASSOC,
+        ATH_CHANCTX_EVENT_AUTHORIZED,
         ATH_CHANCTX_EVENT_SWITCH,
         ATH_CHANCTX_EVENT_ASSIGN,
         ATH_CHANCTX_EVENT_UNASSIGN,
@@ -381,10 +381,12 @@ enum ath_chanctx_state {
 
 struct ath_chanctx_sched {
         bool beacon_pending;
+        bool beacon_adjust;
         bool offchannel_pending;
         bool wait_switch;
         bool force_noa_update;
         bool extend_absence;
+        bool mgd_prepare_tx;
         enum ath_chanctx_state state;
         u8 beacon_miss;
 
@@ -469,6 +471,7 @@ void ath_chanctx_set_next(struct ath_softc *sc, bool force);
 void ath_offchannel_next(struct ath_softc *sc);
 void ath_scan_complete(struct ath_softc *sc, bool abort);
 void ath_roc_complete(struct ath_softc *sc, bool abort);
+struct ath_chanctx* ath_is_go_chanctx_present(struct ath_softc *sc);
 
 #else
 
@@ -541,7 +544,6 @@ static inline void ath_chanctx_check_active(struct ath_softc *sc,
 
 #endif /* CONFIG_ATH9K_CHANNEL_CONTEXT */
 
-int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan);
 void ath_startrecv(struct ath_softc *sc);
 bool ath_stoprecv(struct ath_softc *sc);
 u32 ath_calcrxfilter(struct ath_softc *sc);
@@ -563,6 +565,7 @@ int ath_tx_init(struct ath_softc *sc, int nbufs);
 int ath_txq_update(struct ath_softc *sc, int qnum,
                    struct ath9k_tx_queue_info *q);
 void ath_update_max_aggr_framelen(struct ath_softc *sc, int queue, int txop);
+void ath_assign_seq(struct ath_common *common, struct sk_buff *skb);
 int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
                  struct ath_tx_control *txctl);
 void ath_tx_cabq(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -592,8 +595,10 @@ void ath9k_release_buffered_frames(struct ieee80211_hw *hw,
 struct ath_vif {
         struct list_head list;
 
+        u16 seq_no;
+
         /* BSS info */
-        u8 bssid[ETH_ALEN];
+        u8 bssid[ETH_ALEN] __aligned(2);
         u16 aid;
         bool assoc;
 
@@ -616,6 +621,7 @@ struct ath_vif {
         u32 noa_start;
         u32 noa_duration;
         bool periodic_noa;
+        bool oneshot_noa;
 };
 
 struct ath9k_vif_iter_data {
@@ -713,7 +719,8 @@ int ath_update_survey_stats(struct ath_softc *sc);
 void ath_update_survey_nf(struct ath_softc *sc, int channel);
 void ath9k_queue_reset(struct ath_softc *sc, enum ath_reset_type type);
 void ath_ps_full_sleep(unsigned long data);
-void __ath9k_flush(struct ieee80211_hw *hw, u32 queues, bool drop);
+void __ath9k_flush(struct ieee80211_hw *hw, u32 queues, bool drop,
+                   bool sw_pending, bool timeout_override);
 
 /**********/
 /* BTCOEX */
@@ -925,6 +932,7 @@ void ath_ant_comb_scan(struct ath_softc *sc, struct ath_rx_status *rs);
 #define ATH9K_PCI_AR9565_2ANT     0x0100
 #define ATH9K_PCI_NO_PLL_PWRSAVE  0x0200
 #define ATH9K_PCI_KILLER          0x0400
+#define ATH9K_PCI_LED_ACT_HI      0x0800
 
 /*
  * Default cache line size, in bytes.
@@ -973,6 +981,7 @@ struct ath_softc {
         struct ath_chanctx_sched sched;
         struct ath_offchannel offchannel;
         struct ath_chanctx *next_chan;
+        struct completion go_beacon;
 #endif
 
         unsigned long driver_data;
@@ -980,7 +989,6 @@ struct ath_softc {
         u8 gtt_cnt;
         u32 intrstatus;
         u16 ps_flags; /* PS_* */
-        u16 curtxpow;
         bool ps_enabled;
         bool ps_idle;
         short nbcnvifs;
@@ -1021,10 +1029,8 @@ struct ath_softc {
         struct dfs_pattern_detector *dfs_detector;
         u64 dfs_prev_pulse_ts;
         u32 wow_enabled;
-        /* relay(fs) channel for spectral scan */
-        struct rchan *rfs_chan_spec_scan;
-        enum spectral_mode spectral_mode;
-        struct ath_spec_scan spec_config;
+
+        struct ath_spec_scan_priv spec_priv;
 
         struct ieee80211_vif *tx99_vif;
         struct sk_buff *tx99_skb;
@@ -1067,7 +1073,7 @@ void ath9k_tasklet(unsigned long data);
 int ath_cabq_update(struct ath_softc *);
 u8 ath9k_parse_mpdudensity(u8 mpdudensity);
 irqreturn_t ath_isr(int irq, void *dev);
-int ath_reset(struct ath_softc *sc);
+int ath_reset(struct ath_softc *sc, struct ath9k_channel *hchan);
 void ath_cancel_work(struct ath_softc *sc);
 void ath_restart_work(struct ath_softc *sc);
 int ath9k_init_device(u16 devid, struct ath_softc *sc,
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index a6af855ef6ed..ecb783beeec2 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -144,16 +144,8 @@ static struct ath_buf *ath9k_beacon_generate(struct ieee80211_hw *hw,
         mgmt_hdr->u.beacon.timestamp = avp->tsf_adjust;
 
         info = IEEE80211_SKB_CB(skb);
-        if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
-                /*
-                 * TODO: make sure the seq# gets assigned properly (vs. other
-                 * TX frames)
-                 */
-                struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-                sc->tx.seq_no += 0x10;
-                hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
-                hdr->seq_ctrl |= cpu_to_le16(sc->tx.seq_no);
-        }
+
+        ath_assign_seq(common, skb);
 
         if (vif->p2p)
                 ath9k_beacon_add_noa(sc, avp, skb);
diff --git a/drivers/net/wireless/ath/ath9k/calib.c b/drivers/net/wireless/ath/ath9k/calib.c
index 278365b8a895..e200a6e3aca5 100644
--- a/drivers/net/wireless/ath/ath9k/calib.c
+++ b/drivers/net/wireless/ath/ath9k/calib.c
@@ -234,7 +234,7 @@ void ath9k_hw_start_nfcal(struct ath_hw *ah, bool update)
         REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
 }
 
-void ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan)
+int ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan)
 {
         struct ath9k_nfcal_hist *h = NULL;
         unsigned i, j;
@@ -301,7 +301,7 @@ void ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan)
                 ath_dbg(common, ANY,
                         "Timeout while waiting for nf to load: AR_PHY_AGC_CONTROL=0x%x\n",
                         REG_READ(ah, AR_PHY_AGC_CONTROL));
-                return;
+                return -ETIMEDOUT;
         }
 
         /*
@@ -322,6 +322,8 @@ void ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan)
                 }
         }
         REGWRITE_BUFFER_FLUSH(ah);
+
+        return 0;
 }
 
 
diff --git a/drivers/net/wireless/ath/ath9k/calib.h b/drivers/net/wireless/ath/ath9k/calib.h
index b8ed95e9a335..87badf4bb8a4 100644
--- a/drivers/net/wireless/ath/ath9k/calib.h
+++ b/drivers/net/wireless/ath/ath9k/calib.h
@@ -109,7 +109,7 @@ struct ath9k_pacal_info{
 
 bool ath9k_hw_reset_calvalid(struct ath_hw *ah);
 void ath9k_hw_start_nfcal(struct ath_hw *ah, bool update);
-void ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan);
+int ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan);
 bool ath9k_hw_getnf(struct ath_hw *ah, struct ath9k_channel *chan);
 void ath9k_init_nfcal_hist_buffer(struct ath_hw *ah,
                                   struct ath9k_channel *chan);
diff --git a/drivers/net/wireless/ath/ath9k/channel.c b/drivers/net/wireless/ath/ath9k/channel.c
index 945c89826b14..206665059d66 100644
--- a/drivers/net/wireless/ath/ath9k/channel.c
+++ b/drivers/net/wireless/ath/ath9k/channel.c
@@ -66,7 +66,7 @@ static int ath_set_channel(struct ath_softc *sc)
         }
 
         hchan = &sc->sc_ah->channels[pos];
-        r = ath_reset_internal(sc, hchan);
+        r = ath_reset(sc, hchan);
         if (r)
                 return r;
 
@@ -92,8 +92,8 @@ static int ath_set_channel(struct ath_softc *sc)
         } else {
                 /* perform spectral scan if requested. */
                 if (test_bit(ATH_OP_SCANNING, &common->op_flags) &&
-                        sc->spectral_mode == SPECTRAL_CHANSCAN)
-                        ath9k_spectral_scan_trigger(hw);
+                        sc->spec_priv.spectral_mode == SPECTRAL_CHANSCAN)
+                        ath9k_cmn_spectral_scan_trigger(common, &sc->spec_priv);
         }
 
         return 0;
@@ -117,6 +117,7 @@ void ath_chanctx_init(struct ath_softc *sc)
                 cfg80211_chandef_create(&ctx->chandef, chan, NL80211_CHAN_HT20);
                 INIT_LIST_HEAD(&ctx->vifs);
                 ctx->txpower = ATH_TXPOWER_MAX;
+                ctx->flush_timeout = HZ / 5; /* 200ms */
                 for (j = 0; j < ARRAY_SIZE(ctx->acq); j++)
                         INIT_LIST_HEAD(&ctx->acq[j]);
         }
@@ -145,6 +146,36 @@ void ath_chanctx_set_channel(struct ath_softc *sc, struct ath_chanctx *ctx,
 
 #ifdef CONFIG_ATH9K_CHANNEL_CONTEXT
 
+/*************/
+/* Utilities */
+/*************/
+
+struct ath_chanctx* ath_is_go_chanctx_present(struct ath_softc *sc)
+{
+        struct ath_chanctx *ctx;
+        struct ath_vif *avp;
+        struct ieee80211_vif *vif;
+
+        spin_lock_bh(&sc->chan_lock);
+
+        ath_for_each_chanctx(sc, ctx) {
+                if (!ctx->active)
+                        continue;
+
+                list_for_each_entry(avp, &ctx->vifs, list) {
+                        vif = avp->vif;
+
+                        if (ieee80211_vif_type_p2p(vif) == NL80211_IFTYPE_P2P_GO) {
+                                spin_unlock_bh(&sc->chan_lock);
+                                return ctx;
+                        }
+                }
+        }
+
+        spin_unlock_bh(&sc->chan_lock);
+        return NULL;
+}
+
 /**********************************************************/
 /* Functions to handle the channel context state machine. */
 /**********************************************************/
@@ -171,7 +202,7 @@ static const char *chanctx_event_string(enum ath_chanctx_event ev)
                 case_rtn_string(ATH_CHANCTX_EVENT_BEACON_SENT);
                 case_rtn_string(ATH_CHANCTX_EVENT_TSF_TIMER);
                 case_rtn_string(ATH_CHANCTX_EVENT_BEACON_RECEIVED);
-                case_rtn_string(ATH_CHANCTX_EVENT_ASSOC);
+                case_rtn_string(ATH_CHANCTX_EVENT_AUTHORIZED);
                 case_rtn_string(ATH_CHANCTX_EVENT_SWITCH);
                 case_rtn_string(ATH_CHANCTX_EVENT_ASSIGN);
                 case_rtn_string(ATH_CHANCTX_EVENT_UNASSIGN);
@@ -198,6 +229,7 @@ static const char *chanctx_state_string(enum ath_chanctx_state state)
 void ath_chanctx_check_active(struct ath_softc *sc, struct ath_chanctx *ctx)
 {
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        struct ath_chanctx *ictx;
         struct ath_vif *avp;
         bool active = false;
         u8 n_active = 0;
@@ -205,6 +237,28 @@ void ath_chanctx_check_active(struct ath_softc *sc, struct ath_chanctx *ctx)
         if (!ctx)
                 return;
 
+        if (ctx == &sc->offchannel.chan) {
+                spin_lock_bh(&sc->chan_lock);
+
+                if (likely(sc->sched.channel_switch_time))
+                        ctx->flush_timeout =
+                                usecs_to_jiffies(sc->sched.channel_switch_time);
+                else
+                        ctx->flush_timeout =
+                                msecs_to_jiffies(10);
+
+                spin_unlock_bh(&sc->chan_lock);
+
+                /*
+                 * There is no need to iterate over the
+                 * active/assigned channel contexts if
+                 * the current context is offchannel.
+                 */
+                return;
+        }
+
+        ictx = ctx;
+
         list_for_each_entry(avp, &ctx->vifs, list) {
                 struct ieee80211_vif *vif = avp->vif;
 
@@ -227,12 +281,23 @@ void ath_chanctx_check_active(struct ath_softc *sc, struct ath_chanctx *ctx)
                 n_active++;
         }
 
+        spin_lock_bh(&sc->chan_lock);
+
         if (n_active <= 1) {
+                ictx->flush_timeout = HZ / 5;
                 clear_bit(ATH_OP_MULTI_CHANNEL, &common->op_flags);
+                spin_unlock_bh(&sc->chan_lock);
                 return;
         }
-        if (test_and_set_bit(ATH_OP_MULTI_CHANNEL, &common->op_flags))
+
+        ictx->flush_timeout = usecs_to_jiffies(sc->sched.channel_switch_time);
+
+        if (test_and_set_bit(ATH_OP_MULTI_CHANNEL, &common->op_flags)) {
+                spin_unlock_bh(&sc->chan_lock);
                 return;
+        }
+
+        spin_unlock_bh(&sc->chan_lock);
 
         if (ath9k_is_chanctx_enabled()) {
                 ath_chanctx_event(sc, NULL,
@@ -301,6 +366,111 @@ static void ath_chanctx_setup_timer(struct ath_softc *sc, u32 tsf_time)
                 "Setup chanctx timer with timeout: %d ms\n", jiffies_to_msecs(tsf_time));
 }
 
+static void ath_chanctx_handle_bmiss(struct ath_softc *sc,
+                                     struct ath_chanctx *ctx,
+                                     struct ath_vif *avp)
+{
+        /*
+         * Clear the extend_absence flag if it had been
+         * set during the previous beacon transmission,
+         * since we need to revert to the normal NoA
+         * schedule.
+         */
+        if (ctx->active && sc->sched.extend_absence) {
+                avp->noa_duration = 0;
+                sc->sched.extend_absence = false;
+        }
+
+        /* If at least two consecutive beacons were missed on the STA
+         * chanctx, stay on the STA channel for one extra beacon period,
+         * to resync the timer properly.
+         */
+        if (ctx->active && sc->sched.beacon_miss >= 2) {
+                avp->noa_duration = 0;
+                sc->sched.extend_absence = true;
+        }
+}
+
+static void ath_chanctx_offchannel_noa(struct ath_softc *sc,
+                                       struct ath_chanctx *ctx,
+                                       struct ath_vif *avp,
+                                       u32 tsf_time)
+{
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+
+        avp->noa_index++;
+        avp->offchannel_start = tsf_time;
+        avp->offchannel_duration = sc->sched.offchannel_duration;
+
+        ath_dbg(common, CHAN_CTX,
+                "offchannel noa_duration: %d, noa_start: %d, noa_index: %d\n",
+                avp->offchannel_duration,
+                avp->offchannel_start,
+                avp->noa_index);
+
+        /*
+         * When multiple contexts are active, the NoA
+         * has to be recalculated and advertised after
+         * an offchannel operation.
+         */
+        if (ctx->active && avp->noa_duration)
+                avp->noa_duration = 0;
+}
+
+static void ath_chanctx_set_periodic_noa(struct ath_softc *sc,
+                                         struct ath_vif *avp,
+                                         struct ath_beacon_config *cur_conf,
+                                         u32 tsf_time,
+                                         u32 beacon_int)
+{
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+
+        avp->noa_index++;
+        avp->noa_start = tsf_time;
+
+        if (sc->sched.extend_absence)
+                avp->noa_duration = (3 * beacon_int / 2) +
+                        sc->sched.channel_switch_time;
+        else
+                avp->noa_duration =
+                        TU_TO_USEC(cur_conf->beacon_interval) / 2 +
+                        sc->sched.channel_switch_time;
+
+        if (test_bit(ATH_OP_SCANNING, &common->op_flags) ||
+            sc->sched.extend_absence)
+                avp->periodic_noa = false;
+        else
+                avp->periodic_noa = true;
+
+        ath_dbg(common, CHAN_CTX,
+                "noa_duration: %d, noa_start: %d, noa_index: %d, periodic: %d\n",
+                avp->noa_duration,
+                avp->noa_start,
+                avp->noa_index,
+                avp->periodic_noa);
+}
+
+static void ath_chanctx_set_oneshot_noa(struct ath_softc *sc,
+                                        struct ath_vif *avp,
+                                        u32 tsf_time,
+                                        u32 duration)
+{
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+
+        avp->noa_index++;
+        avp->noa_start = tsf_time;
+        avp->periodic_noa = false;
+        avp->oneshot_noa = true;
+        avp->noa_duration = duration + sc->sched.channel_switch_time;
+
+        ath_dbg(common, CHAN_CTX,
+                "oneshot noa_duration: %d, noa_start: %d, noa_index: %d, periodic: %d\n",
+                avp->noa_duration,
+                avp->noa_start,
+                avp->noa_index,
+                avp->periodic_noa);
+}
+
 void ath_chanctx_event(struct ath_softc *sc, struct ieee80211_vif *vif,
                        enum ath_chanctx_event ev)
 {
@@ -327,6 +497,14 @@ void ath_chanctx_event(struct ath_softc *sc, struct ieee80211_vif *vif,
                 if (avp->offchannel_duration)
                         avp->offchannel_duration = 0;
 
+                if (avp->oneshot_noa) {
+                        avp->noa_duration = 0;
+                        avp->oneshot_noa = false;
+
+                        ath_dbg(common, CHAN_CTX,
+                                "Clearing oneshot NoA\n");
+                }
+
                 if (avp->chanctx != sc->cur_chan) {
                         ath_dbg(common, CHAN_CTX,
                                 "Contexts differ, not preparing beacon\n");
@@ -356,6 +534,24 @@ void ath_chanctx_event(struct ath_softc *sc, struct ieee80211_vif *vif,
                                 "Move chanctx state from WAIT_FOR_TIMER to WAIT_FOR_BEACON\n");
                 }
 
+                if (sc->sched.mgd_prepare_tx)
+                        sc->sched.state = ATH_CHANCTX_STATE_WAIT_FOR_BEACON;
+
+                /*
+                 * When a context becomes inactive, for example,
+                 * disassociation of a station context, the NoA
+                 * attribute needs to be removed from subsequent
+                 * beacons.
+                 */
+                if (!ctx->active && avp->noa_duration &&
+                    sc->sched.state != ATH_CHANCTX_STATE_WAIT_FOR_BEACON) {
+                        avp->noa_duration = 0;
+                        avp->periodic_noa = false;
+
+                        ath_dbg(common, CHAN_CTX,
+                                "Clearing NoA schedule\n");
+                }
+
                 if (sc->sched.state != ATH_CHANCTX_STATE_WAIT_FOR_BEACON)
                         break;
 
@@ -378,45 +574,22 @@ void ath_chanctx_event(struct ath_softc *sc, struct ieee80211_vif *vif,
                  * values and increment the index.
                  */
                 if (sc->next_chan == &sc->offchannel.chan) {
-                        avp->noa_index++;
-                        avp->offchannel_start = tsf_time;
-                        avp->offchannel_duration = sc->sched.offchannel_duration;
-
-                        ath_dbg(common, CHAN_CTX,
-                                "offchannel noa_duration: %d, noa_start: %d, noa_index: %d\n",
-                                avp->offchannel_duration,
-                                avp->offchannel_start,
-                                avp->noa_index);
-
-                        /*
-                         * When multiple contexts are active, the NoA
-                         * has to be recalculated and advertised after
-                         * an offchannel operation.
-                         */
-                        if (ctx->active && avp->noa_duration)
-                                avp->noa_duration = 0;
-
+                        ath_chanctx_offchannel_noa(sc, ctx, avp, tsf_time);
                         break;
                 }
 
-                /*
-                 * Clear the extend_absence flag if it had been
-                 * set during the previous beacon transmission,
-                 * since we need to revert to the normal NoA
-                 * schedule.
-                 */
-                if (ctx->active && sc->sched.extend_absence) {
-                        avp->noa_duration = 0;
-                        sc->sched.extend_absence = false;
-                }
+                ath_chanctx_handle_bmiss(sc, ctx, avp);
 
-                /* If at least two consecutive beacons were missed on the STA
-                 * chanctx, stay on the STA channel for one extra beacon period,
-                 * to resync the timer properly.
+                /*
+                 * If a mgd_prepare_tx() has been called by mac80211,
+                 * a one-shot NoA needs to be sent. This can happen
+                 * with one or more active channel contexts - in both
+                 * cases, a new NoA schedule has to be advertised.
                  */
-                if (ctx->active && sc->sched.beacon_miss >= 2) {
-                        avp->noa_duration = 0;
-                        sc->sched.extend_absence = true;
+                if (sc->sched.mgd_prepare_tx) {
+                        ath_chanctx_set_oneshot_noa(sc, avp, tsf_time,
+                                                    jiffies_to_usecs(HZ / 5));
+                        break;
                 }
 
                 /* Prevent wrap-around issues */
@@ -429,31 +602,9 @@ void ath_chanctx_event(struct ath_softc *sc, struct ieee80211_vif *vif,
                  * announcement.
                  */
                 if (ctx->active &&
-                    (!avp->noa_duration || sc->sched.force_noa_update)) {
-                        avp->noa_index++;
-                        avp->noa_start = tsf_time;
-
-                        if (sc->sched.extend_absence)
-                                avp->noa_duration = (3 * beacon_int / 2) +
-                                        sc->sched.channel_switch_time;
-                        else
-                                avp->noa_duration =
-                                        TU_TO_USEC(cur_conf->beacon_interval) / 2 +
-                                        sc->sched.channel_switch_time;
-
-                        if (test_bit(ATH_OP_SCANNING, &common->op_flags) ||
-                            sc->sched.extend_absence)
-                                avp->periodic_noa = false;
-                        else
-                                avp->periodic_noa = true;
-
-                        ath_dbg(common, CHAN_CTX,
-                                "noa_duration: %d, noa_start: %d, noa_index: %d, periodic: %d\n",
-                                avp->noa_duration,
-                                avp->noa_start,
-                                avp->noa_index,
-                                avp->periodic_noa);
-                }
+                    (!avp->noa_duration || sc->sched.force_noa_update))
+                        ath_chanctx_set_periodic_noa(sc, avp, cur_conf,
+                                                     tsf_time, beacon_int);
 
                 if (ctx->active && sc->sched.force_noa_update)
                         sc->sched.force_noa_update = false;
@@ -467,6 +618,15 @@ void ath_chanctx_event(struct ath_softc *sc, struct ieee80211_vif *vif,
                 }
 
                 sc->sched.beacon_pending = false;
+
+                if (sc->sched.mgd_prepare_tx) {
+                        sc->sched.mgd_prepare_tx = false;
+                        complete(&sc->go_beacon);
+                        ath_dbg(common, CHAN_CTX,
+                                "Beacon sent, complete go_beacon\n");
+                        break;
+                }
+
                 if (sc->sched.state != ATH_CHANCTX_STATE_WAIT_FOR_BEACON)
                         break;
 
@@ -495,10 +655,16 @@ void ath_chanctx_event(struct ath_softc *sc, struct ieee80211_vif *vif,
                     sc->cur_chan == &sc->offchannel.chan)
                         break;
 
-                ath_chanctx_adjust_tbtt_delta(sc);
                 sc->sched.beacon_pending = false;
                 sc->sched.beacon_miss = 0;
 
+                if (sc->sched.state == ATH_CHANCTX_STATE_FORCE_ACTIVE ||
+                    !sc->sched.beacon_adjust ||
+                    !sc->cur_chan->tsf_val)
+                        break;
+
+                ath_chanctx_adjust_tbtt_delta(sc);
+
                 /* TSF time might have been updated by the incoming beacon,
                  * need update the channel switch timer to reflect the change.
                  */
@@ -507,10 +673,10 @@ void ath_chanctx_event(struct ath_softc *sc, struct ieee80211_vif *vif,
                         ath9k_hw_get_tsf_offset(&sc->cur_chan->tsf_ts, NULL);
                 tsf_time += ath9k_hw_gettsf32(ah);
 
-
+                sc->sched.beacon_adjust = false;
                 ath_chanctx_setup_timer(sc, tsf_time);
                 break;
-        case ATH_CHANCTX_EVENT_ASSOC:
+        case ATH_CHANCTX_EVENT_AUTHORIZED:
                 if (sc->sched.state != ATH_CHANCTX_STATE_FORCE_ACTIVE ||
                     avp->chanctx != sc->cur_chan)
                         break;
@@ -552,6 +718,7 @@ void ath_chanctx_event(struct ath_softc *sc, struct ieee80211_vif *vif,
 
                 ath_chanctx_setup_timer(sc, tsf_time);
                 sc->sched.beacon_pending = true;
+                sc->sched.beacon_adjust = true;
                 break;
         case ATH_CHANCTX_EVENT_ENABLE_MULTICHANNEL:
                 if (sc->cur_chan == &sc->offchannel.chan ||
@@ -578,22 +745,6 @@ void ath_chanctx_event(struct ath_softc *sc, struct ieee80211_vif *vif,
                 ieee80211_queue_work(sc->hw, &sc->chanctx_work);
                 break;
         case ATH_CHANCTX_EVENT_ASSIGN:
-                /*
-                 * When adding a new channel context, check if a scan
-                 * is in progress and abort it since the addition of
-                 * a new channel context is usually followed by VIF
-                 * assignment, in which case we have to start multi-channel
-                 * operation.
-                 */
-                if (test_bit(ATH_OP_SCANNING, &common->op_flags)) {
-                        ath_dbg(common, CHAN_CTX,
-                                "Aborting HW scan to add new context\n");
-
-                        spin_unlock_bh(&sc->chan_lock);
-                        del_timer_sync(&sc->offchannel.timer);
-                        ath_scan_complete(sc, true);
-                        spin_lock_bh(&sc->chan_lock);
-                }
                 break;
         case ATH_CHANCTX_EVENT_CHANGE:
                 break;
@@ -751,6 +902,11 @@ void ath_offchannel_next(struct ath_softc *sc)
                 sc->offchannel.state = ATH_OFFCHANNEL_ROC_START;
                 ath_chanctx_offchan_switch(sc, sc->offchannel.roc_chan);
         } else {
+                spin_lock_bh(&sc->chan_lock);
+                sc->sched.offchannel_pending = false;
+                sc->sched.wait_switch = false;
+                spin_unlock_bh(&sc->chan_lock);
+
                 ath_chanctx_switch(sc, ath_chanctx_get_oper_chan(sc, false),
                                    NULL);
                 sc->offchannel.state = ATH_OFFCHANNEL_IDLE;
@@ -770,8 +926,7 @@ void ath_roc_complete(struct ath_softc *sc, bool abort)
 
         sc->offchannel.roc_vif = NULL;
         sc->offchannel.roc_chan = NULL;
-        if (!abort)
-                ieee80211_remain_on_channel_expired(sc->hw);
+        ieee80211_remain_on_channel_expired(sc->hw);
         ath_offchannel_next(sc);
         ath9k_ps_restore(sc);
 }
@@ -808,7 +963,7 @@ static void ath_scan_send_probe(struct ath_softc *sc,
         struct ieee80211_tx_info *info;
         int band = sc->offchannel.chan.chandef.chan->band;
 
-        skb = ieee80211_probereq_get(sc->hw, vif,
+        skb = ieee80211_probereq_get(sc->hw, vif->addr,
                         ssid->ssid, ssid->ssid_len, req->ie_len);
         if (!skb)
                 return;
@@ -902,9 +1057,8 @@ static void ath_offchannel_timer(unsigned long data)
                 break;
         case ATH_OFFCHANNEL_ROC_START:
         case ATH_OFFCHANNEL_ROC_WAIT:
-                ctx = ath_chanctx_get_oper_chan(sc, false);
                 sc->offchannel.state = ATH_OFFCHANNEL_ROC_DONE;
-                ath_chanctx_switch(sc, ctx, NULL);
+                ath_roc_complete(sc, false);
                 break;
         default:
                 break;
@@ -1034,7 +1188,6 @@ static void ath_offchannel_channel_change(struct ath_softc *sc)
                 ieee80211_ready_on_channel(sc->hw);
                 break;
         case ATH_OFFCHANNEL_ROC_DONE:
-                ath_roc_complete(sc, false);
                 break;
         default:
                 break;
@@ -1082,10 +1235,11 @@ void ath_chanctx_set_next(struct ath_softc *sc, bool force)
                 ath9k_chanctx_stop_queues(sc, sc->cur_chan);
                 queues_stopped = true;
 
-                __ath9k_flush(sc->hw, ~0, true);
+                __ath9k_flush(sc->hw, ~0, true, false, false);
 
                 if (ath_chanctx_send_ps_frame(sc, true))
-                        __ath9k_flush(sc->hw, BIT(IEEE80211_AC_VO), false);
+                        __ath9k_flush(sc->hw, BIT(IEEE80211_AC_VO),
+                                      false, false, false);
 
                 send_ps = true;
                 spin_lock_bh(&sc->chan_lock);
@@ -1177,6 +1331,8 @@ void ath9k_init_channel_context(struct ath_softc *sc)
                     (unsigned long)sc);
         setup_timer(&sc->sched.timer, ath_chanctx_timer,
                     (unsigned long)sc);
+
+        init_completion(&sc->go_beacon);
 }
 
 void ath9k_deinit_channel_context(struct ath_softc *sc)
diff --git a/drivers/net/wireless/ath/ath9k/spectral.c b/drivers/net/wireless/ath/ath9k/common-spectral.c
index 8f68426ca653..ec93ddf0863a 100644
--- a/drivers/net/wireless/ath/ath9k/spectral.c
+++ b/drivers/net/wireless/ath/ath9k/common-spectral.c
@@ -24,23 +24,24 @@ static s8 fix_rssi_inv_only(u8 rssi_val)
         return (s8) rssi_val;
 }
 
-static void ath_debug_send_fft_sample(struct ath_softc *sc,
+static void ath_debug_send_fft_sample(struct ath_spec_scan_priv *spec_priv,
                                       struct fft_sample_tlv *fft_sample_tlv)
 {
         int length;
-        if (!sc->rfs_chan_spec_scan)
+        if (!spec_priv->rfs_chan_spec_scan)
                 return;
 
         length = __be16_to_cpu(fft_sample_tlv->length) +
                  sizeof(*fft_sample_tlv);
-        relay_write(sc->rfs_chan_spec_scan, fft_sample_tlv, length);
+        relay_write(spec_priv->rfs_chan_spec_scan, fft_sample_tlv, length);
 }
 
 /* returns 1 if this was a spectral frame, even if not handled. */
-int ath_process_fft(struct ath_softc *sc, struct ieee80211_hdr *hdr,
+int ath_cmn_process_fft(struct ath_spec_scan_priv *spec_priv, struct ieee80211_hdr *hdr,
                     struct ath_rx_status *rs, u64 tsf)
 {
-        struct ath_hw *ah = sc->sc_ah;
+        struct ath_hw *ah = spec_priv->ah;
+        struct ath_common *common = ath9k_hw_common(spec_priv->ah);
         u8 num_bins, *bins, *vdata = (u8 *)hdr;
         struct fft_sample_ht20 fft_sample_20;
         struct fft_sample_ht20_40 fft_sample_40;
@@ -67,7 +68,7 @@ int ath_process_fft(struct ath_softc *sc, struct ieee80211_hdr *hdr,
         if (!(radar_info->pulse_bw_info & SPECTRAL_SCAN_BITMASK))
                 return 0;
 
-        chan_type = cfg80211_get_chandef_type(&sc->hw->conf.chandef);
+        chan_type = cfg80211_get_chandef_type(&common->hw->conf.chandef);
         if ((chan_type == NL80211_CHAN_HT40MINUS) ||
             (chan_type == NL80211_CHAN_HT40PLUS)) {
                 fft_len = SPECTRAL_HT20_40_TOTAL_DATA_LEN;
@@ -199,10 +200,11 @@ int ath_process_fft(struct ath_softc *sc, struct ieee80211_hdr *hdr,
                 tlv = (struct fft_sample_tlv *)&fft_sample_20;
         }
 
-        ath_debug_send_fft_sample(sc, tlv);
+        ath_debug_send_fft_sample(spec_priv, tlv);
 
         return 1;
 }
+EXPORT_SYMBOL(ath_cmn_process_fft);
 
 /*********************/
 /* spectral_scan_ctl */
@@ -211,11 +213,11 @@ int ath_process_fft(struct ath_softc *sc, struct ieee80211_hdr *hdr,
 static ssize_t read_file_spec_scan_ctl(struct file *file, char __user *user_buf,
                                        size_t count, loff_t *ppos)
 {
-        struct ath_softc *sc = file->private_data;
+        struct ath_spec_scan_priv *spec_priv = file->private_data;
         char *mode = "";
         unsigned int len;
 
-        switch (sc->spectral_mode) {
+        switch (spec_priv->spectral_mode) {
         case SPECTRAL_DISABLED:
                 mode = "disable";
                 break;
@@ -233,12 +235,84 @@ static ssize_t read_file_spec_scan_ctl(struct file *file, char __user *user_buf,
         return simple_read_from_buffer(user_buf, count, ppos, mode, len);
 }
 
+void ath9k_cmn_spectral_scan_trigger(struct ath_common *common,
+                                 struct ath_spec_scan_priv *spec_priv)
+{
+        struct ath_hw *ah = spec_priv->ah;
+        u32 rxfilter;
+
+        if (config_enabled(CONFIG_ATH9K_TX99))
+                return;
+
+        if (!ath9k_hw_ops(ah)->spectral_scan_trigger) {
+                ath_err(common, "spectrum analyzer not implemented on this hardware\n");
+                return;
+        }
+
+        ath_ps_ops(common)->wakeup(common);
+        rxfilter = ath9k_hw_getrxfilter(ah);
+        ath9k_hw_setrxfilter(ah, rxfilter |
+                                 ATH9K_RX_FILTER_PHYRADAR |
+                                 ATH9K_RX_FILTER_PHYERR);
+
+        /* TODO: usually this should not be neccesary, but for some reason
+         * (or in some mode?) the trigger must be called after the
+         * configuration, otherwise the register will have its values reset
+         * (on my ar9220 to value 0x01002310)
+         */
+        ath9k_cmn_spectral_scan_config(common, spec_priv, spec_priv->spectral_mode);
+        ath9k_hw_ops(ah)->spectral_scan_trigger(ah);
+        ath_ps_ops(common)->restore(common);
+}
+EXPORT_SYMBOL(ath9k_cmn_spectral_scan_trigger);
+
+int ath9k_cmn_spectral_scan_config(struct ath_common *common,
+                               struct ath_spec_scan_priv *spec_priv,
+                               enum spectral_mode spectral_mode)
+{
+        struct ath_hw *ah = spec_priv->ah;
+
+        if (!ath9k_hw_ops(ah)->spectral_scan_trigger) {
+                ath_err(common, "spectrum analyzer not implemented on this hardware\n");
+                return -1;
+        }
+
+        switch (spectral_mode) {
+        case SPECTRAL_DISABLED:
+                spec_priv->spec_config.enabled = 0;
+                break;
+        case SPECTRAL_BACKGROUND:
+                /* send endless samples.
+                 * TODO: is this really useful for "background"?
+                 */
+                spec_priv->spec_config.endless = 1;
+                spec_priv->spec_config.enabled = 1;
+                break;
+        case SPECTRAL_CHANSCAN:
+        case SPECTRAL_MANUAL:
+                spec_priv->spec_config.endless = 0;
+                spec_priv->spec_config.enabled = 1;
+                break;
+        default:
+                return -1;
+        }
+
+        ath_ps_ops(common)->wakeup(common);
+        ath9k_hw_ops(ah)->spectral_scan_config(ah, &spec_priv->spec_config);
+        ath_ps_ops(common)->restore(common);
+
+        spec_priv->spectral_mode = spectral_mode;
+
+        return 0;
+}
+EXPORT_SYMBOL(ath9k_cmn_spectral_scan_config);
+
 static ssize_t write_file_spec_scan_ctl(struct file *file,
                                         const char __user *user_buf,
                                         size_t count, loff_t *ppos)
 {
-        struct ath_softc *sc = file->private_data;
-        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        struct ath_spec_scan_priv *spec_priv = file->private_data;
+        struct ath_common *common = ath9k_hw_common(spec_priv->ah);
         char buf[32];
         ssize_t len;
 
@@ -252,18 +326,18 @@ static ssize_t write_file_spec_scan_ctl(struct file *file,
         buf[len] = '\0';
 
         if (strncmp("trigger", buf, 7) == 0) {
-                ath9k_spectral_scan_trigger(sc->hw);
+                ath9k_cmn_spectral_scan_trigger(common, spec_priv);
         } else if (strncmp("background", buf, 10) == 0) {
-                ath9k_spectral_scan_config(sc->hw, SPECTRAL_BACKGROUND);
+                ath9k_cmn_spectral_scan_config(common, spec_priv, SPECTRAL_BACKGROUND);
                 ath_dbg(common, CONFIG, "spectral scan: background mode enabled\n");
         } else if (strncmp("chanscan", buf, 8) == 0) {
-                ath9k_spectral_scan_config(sc->hw, SPECTRAL_CHANSCAN);
+                ath9k_cmn_spectral_scan_config(common, spec_priv, SPECTRAL_CHANSCAN);
                 ath_dbg(common, CONFIG, "spectral scan: channel scan mode enabled\n");
         } else if (strncmp("manual", buf, 6) == 0) {
-                ath9k_spectral_scan_config(sc->hw, SPECTRAL_MANUAL);
+                ath9k_cmn_spectral_scan_config(common, spec_priv, SPECTRAL_MANUAL);
                 ath_dbg(common, CONFIG, "spectral scan: manual mode enabled\n");
         } else if (strncmp("disable", buf, 7) == 0) {
-                ath9k_spectral_scan_config(sc->hw, SPECTRAL_DISABLED);
+                ath9k_cmn_spectral_scan_config(common, spec_priv, SPECTRAL_DISABLED);
                 ath_dbg(common, CONFIG, "spectral scan: disabled\n");
         } else {
                 return -EINVAL;
@@ -288,11 +362,11 @@ static ssize_t read_file_spectral_short_repeat(struct file *file,
                                                char __user *user_buf,
                                                size_t count, loff_t *ppos)
 {
-        struct ath_softc *sc = file->private_data;
+        struct ath_spec_scan_priv *spec_priv = file->private_data;
         char buf[32];
         unsigned int len;
 
-        len = sprintf(buf, "%d\n", sc->spec_config.short_repeat);
+        len = sprintf(buf, "%d\n", spec_priv->spec_config.short_repeat);
         return simple_read_from_buffer(user_buf, count, ppos, buf, len);
 }
 
@@ -300,7 +374,7 @@ static ssize_t write_file_spectral_short_repeat(struct file *file,
                                                 const char __user *user_buf,
                                                 size_t count, loff_t *ppos)
 {
-        struct ath_softc *sc = file->private_data;
+        struct ath_spec_scan_priv *spec_priv = file->private_data;
         unsigned long val;
         char buf[32];
         ssize_t len;
@@ -316,7 +390,7 @@ static ssize_t write_file_spectral_short_repeat(struct file *file,
         if (val > 1)
                 return -EINVAL;
 
-        sc->spec_config.short_repeat = val;
+        spec_priv->spec_config.short_repeat = val;
         return count;
 }
 
@@ -336,11 +410,11 @@ static ssize_t read_file_spectral_count(struct file *file,
                                         char __user *user_buf,
                                         size_t count, loff_t *ppos)
 {
-        struct ath_softc *sc = file->private_data;
+        struct ath_spec_scan_priv *spec_priv = file->private_data;
         char buf[32];
         unsigned int len;
 
-        len = sprintf(buf, "%d\n", sc->spec_config.count);
+        len = sprintf(buf, "%d\n", spec_priv->spec_config.count);
         return simple_read_from_buffer(user_buf, count, ppos, buf, len);
 }
 
@@ -348,7 +422,7 @@ static ssize_t write_file_spectral_count(struct file *file,
                                          const char __user *user_buf,
                                          size_t count, loff_t *ppos)
 {
-        struct ath_softc *sc = file->private_data;
+        struct ath_spec_scan_priv *spec_priv = file->private_data;
         unsigned long val;
         char buf[32];
         ssize_t len;
@@ -364,7 +438,7 @@ static ssize_t write_file_spectral_count(struct file *file,
         if (val > 255)
                 return -EINVAL;
 
-        sc->spec_config.count = val;
+        spec_priv->spec_config.count = val;
         return count;
 }
 
@@ -384,11 +458,11 @@ static ssize_t read_file_spectral_period(struct file *file,
                                          char __user *user_buf,
                                          size_t count, loff_t *ppos)
 {
-        struct ath_softc *sc = file->private_data;
+        struct ath_spec_scan_priv *spec_priv = file->private_data;
         char buf[32];
         unsigned int len;
 
-        len = sprintf(buf, "%d\n", sc->spec_config.period);
+        len = sprintf(buf, "%d\n", spec_priv->spec_config.period);
         return simple_read_from_buffer(user_buf, count, ppos, buf, len);
 }
 
@@ -396,7 +470,7 @@ static ssize_t write_file_spectral_period(struct file *file,
                                           const char __user *user_buf,
                                           size_t count, loff_t *ppos)
 {
-        struct ath_softc *sc = file->private_data;
+        struct ath_spec_scan_priv *spec_priv = file->private_data;
         unsigned long val;
         char buf[32];
         ssize_t len;
@@ -412,7 +486,7 @@ static ssize_t write_file_spectral_period(struct file *file,
         if (val > 255)
                 return -EINVAL;
 
-        sc->spec_config.period = val;
+        spec_priv->spec_config.period = val;
         return count;
 }
 
@@ -432,11 +506,11 @@ static ssize_t read_file_spectral_fft_period(struct file *file,
                                              char __user *user_buf,
                                              size_t count, loff_t *ppos)
 {
-        struct ath_softc *sc = file->private_data;
+        struct ath_spec_scan_priv *spec_priv = file->private_data;
         char buf[32];
         unsigned int len;
 
-        len = sprintf(buf, "%d\n", sc->spec_config.fft_period);
+        len = sprintf(buf, "%d\n", spec_priv->spec_config.fft_period);
         return simple_read_from_buffer(user_buf, count, ppos, buf, len);
 }
 
@@ -444,7 +518,7 @@ static ssize_t write_file_spectral_fft_period(struct file *file,
                                               const char __user *user_buf,
                                               size_t count, loff_t *ppos)
 {
-        struct ath_softc *sc = file->private_data;
+        struct ath_spec_scan_priv *spec_priv = file->private_data;
         unsigned long val;
         char buf[32];
         ssize_t len;
@@ -460,7 +534,7 @@ static ssize_t write_file_spectral_fft_period(struct file *file,
         if (val > 15)
                 return -EINVAL;
 
-        sc->spec_config.fft_period = val;
+        spec_priv->spec_config.fft_period = val;
         return count;
 }
 
@@ -506,38 +580,41 @@ static struct rchan_callbacks rfs_spec_scan_cb = {
 /* Debug Init/Deinit */
 /*********************/
 
-void ath9k_spectral_deinit_debug(struct ath_softc *sc)
+void ath9k_cmn_spectral_deinit_debug(struct ath_spec_scan_priv *spec_priv)
 {
-        if (config_enabled(CONFIG_ATH9K_DEBUGFS) && sc->rfs_chan_spec_scan) {
-                relay_close(sc->rfs_chan_spec_scan);
-                sc->rfs_chan_spec_scan = NULL;
+        if (config_enabled(CONFIG_ATH9K_DEBUGFS) && spec_priv->rfs_chan_spec_scan) {
+                relay_close(spec_priv->rfs_chan_spec_scan);
+                spec_priv->rfs_chan_spec_scan = NULL;
         }
 }
+EXPORT_SYMBOL(ath9k_cmn_spectral_deinit_debug);
 
-void ath9k_spectral_init_debug(struct ath_softc *sc)
+void ath9k_cmn_spectral_init_debug(struct ath_spec_scan_priv *spec_priv,
+                                   struct dentry *debugfs_phy)
 {
-        sc->rfs_chan_spec_scan = relay_open("spectral_scan",
-                                            sc->debug.debugfs_phy,
+        spec_priv->rfs_chan_spec_scan = relay_open("spectral_scan",
+                                            debugfs_phy,
                                             1024, 256, &rfs_spec_scan_cb,
                                             NULL);
         debugfs_create_file("spectral_scan_ctl",
                             S_IRUSR | S_IWUSR,
-                            sc->debug.debugfs_phy, sc,
+                            debugfs_phy, spec_priv,
                             &fops_spec_scan_ctl);
         debugfs_create_file("spectral_short_repeat",
                             S_IRUSR | S_IWUSR,
-                            sc->debug.debugfs_phy, sc,
+                            debugfs_phy, spec_priv,
                             &fops_spectral_short_repeat);
         debugfs_create_file("spectral_count",
                             S_IRUSR | S_IWUSR,
-                            sc->debug.debugfs_phy, sc,
+                            debugfs_phy, spec_priv,
                             &fops_spectral_count);
         debugfs_create_file("spectral_period",
                             S_IRUSR | S_IWUSR,
-                            sc->debug.debugfs_phy, sc,
+                            debugfs_phy, spec_priv,
                             &fops_spectral_period);
         debugfs_create_file("spectral_fft_period",
                             S_IRUSR | S_IWUSR,
-                            sc->debug.debugfs_phy, sc,
+                            debugfs_phy, spec_priv,
                             &fops_spectral_fft_period);
 }
+EXPORT_SYMBOL(ath9k_cmn_spectral_init_debug);
diff --git a/drivers/net/wireless/ath/ath9k/spectral.h b/drivers/net/wireless/ath/ath9k/common-spectral.h
index 7b410c6858b0..82d9dd29652c 100644
--- a/drivers/net/wireless/ath/ath9k/spectral.h
+++ b/drivers/net/wireless/ath/ath9k/common-spectral.h
@@ -92,6 +92,13 @@ struct ath_ht20_40_fft_packet {
         struct ath_radar_info radar_info;
 } __packed;
 
+struct ath_spec_scan_priv {
+        struct ath_hw *ah;
+        /* relay(fs) channel for spectral scan */
+        struct rchan *rfs_chan_spec_scan;
+        enum spectral_mode spectral_mode;
+        struct ath_spec_scan spec_config;
+};
 
 #define SPECTRAL_HT20_40_TOTAL_DATA_LEN (sizeof(struct ath_ht20_40_fft_packet))
 
@@ -123,23 +130,15 @@ static inline u8 spectral_bitmap_weight(u8 *bins)
         return bins[0] & 0x3f;
 }
 
-void ath9k_spectral_init_debug(struct ath_softc *sc);
-void ath9k_spectral_deinit_debug(struct ath_softc *sc);
+void ath9k_cmn_spectral_init_debug(struct ath_spec_scan_priv *spec_priv, struct dentry *debugfs_phy);
+void ath9k_cmn_spectral_deinit_debug(struct ath_spec_scan_priv *spec_priv);
 
-void ath9k_spectral_scan_trigger(struct ieee80211_hw *hw);
-int ath9k_spectral_scan_config(struct ieee80211_hw *hw,
+void ath9k_cmn_spectral_scan_trigger(struct ath_common *common,
+                                 struct ath_spec_scan_priv *spec_priv);
+int ath9k_cmn_spectral_scan_config(struct ath_common *common,
+                               struct ath_spec_scan_priv *spec_priv,
                                enum spectral_mode spectral_mode);
-
-#ifdef CONFIG_ATH9K_DEBUGFS
-int ath_process_fft(struct ath_softc *sc, struct ieee80211_hdr *hdr,
+int ath_cmn_process_fft(struct ath_spec_scan_priv *spec_priv, struct ieee80211_hdr *hdr,
                     struct ath_rx_status *rs, u64 tsf);
-#else
-static inline int ath_process_fft(struct ath_softc *sc,
-                                  struct ieee80211_hdr *hdr,
-                                  struct ath_rx_status *rs, u64 tsf)
-{
-        return 0;
-}
-#endif /* CONFIG_ATH9K_DEBUGFS */
 
 #endif /* SPECTRAL_H */
diff --git a/drivers/net/wireless/ath/ath9k/common.c b/drivers/net/wireless/ath/ath9k/common.c
index c6dd7f1fed65..e8c699446470 100644
--- a/drivers/net/wireless/ath/ath9k/common.c
+++ b/drivers/net/wireless/ath/ath9k/common.c
@@ -159,7 +159,7 @@ void ath9k_cmn_rx_skb_postprocess(struct ath_common *common,
                 if (test_bit(keyix, common->keymap))
                         rxs->flag |= RX_FLAG_DECRYPTED;
         }
-        if (ah->sw_mgmt_crypto &&
+        if (ah->sw_mgmt_crypto_rx &&
             (rxs->flag & RX_FLAG_DECRYPTED) &&
             ieee80211_is_mgmt(fc))
                 /* Use software decrypt for management frames. */
@@ -368,11 +368,11 @@ void ath9k_cmn_update_txpow(struct ath_hw *ah, u16 cur_txpow,
 {
         struct ath_regulatory *reg = ath9k_hw_regulatory(ah);
 
-        if (reg->power_limit != new_txpow) {
+        if (reg->power_limit != new_txpow)
                 ath9k_hw_set_txpowerlimit(ah, new_txpow, false);
-                /* read back in case value is clamped */
-                *txpower = reg->max_power_level;
-        }
+
+        /* read back in case value is clamped */
+        *txpower = reg->max_power_level;
 }
 EXPORT_SYMBOL(ath9k_cmn_update_txpow);
 
diff --git a/drivers/net/wireless/ath/ath9k/common.h b/drivers/net/wireless/ath/ath9k/common.h
index ffc454b18637..2b79a568e803 100644
--- a/drivers/net/wireless/ath/ath9k/common.h
+++ b/drivers/net/wireless/ath/ath9k/common.h
@@ -24,6 +24,7 @@
 #include "common-init.h"
 #include "common-beacon.h"
 #include "common-debug.h"
+#include "common-spectral.h"
 
 /* Common header for Atheros 802.11n base driver cores */
 
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 46f20a309b5f..696e3d5309c6 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -455,7 +455,7 @@ static ssize_t read_file_dma(struct file *file, char __user *user_buf,
                          "%2d          %2x      %1x     %2x           %2x\n",
                          i, (*qcuBase & (0x7 << qcuOffset)) >> qcuOffset,
                          (*qcuBase & (0x8 << qcuOffset)) >> (qcuOffset + 3),
-                         val[2] & (0x7 << (i * 3)) >> (i * 3),
+                         (val[2] & (0x7 << (i * 3))) >> (i * 3),
                          (*dcuBase & (0x1f << dcuOffset)) >> dcuOffset);
         }
 
@@ -828,13 +828,14 @@ static ssize_t read_file_misc(struct file *file, char __user *user_buf,
 
         i = 0;
         ath_for_each_chanctx(sc, ctx) {
-                if (!ctx->assigned || list_empty(&ctx->vifs))
+                if (list_empty(&ctx->vifs))
                         continue;
                 ath9k_calculate_iter_data(sc, ctx, &iter_data);
 
                 len += scnprintf(buf + len, sizeof(buf) - len,
-                        "VIF-COUNTS: CTX %i AP: %i STA: %i MESH: %i WDS: %i",
-                        i++, iter_data.naps, iter_data.nstations,
+                        "VIFS: CTX %i(%i) AP: %i STA: %i MESH: %i WDS: %i",
+                        i++, (int)(ctx->assigned), iter_data.naps,
+                        iter_data.nstations,
                         iter_data.nmeshes, iter_data.nwds);
                 len += scnprintf(buf + len, sizeof(buf) - len,
                         " ADHOC: %i TOTAL: %hi BEACON-VIF: %hi\n",
@@ -852,36 +853,31 @@ static ssize_t read_file_reset(struct file *file, char __user *user_buf,
                                size_t count, loff_t *ppos)
 {
         struct ath_softc *sc = file->private_data;
+        static const char * const reset_cause[__RESET_TYPE_MAX] = {
+                [RESET_TYPE_BB_HANG] = "Baseband Hang",
+                [RESET_TYPE_BB_WATCHDOG] = "Baseband Watchdog",
+                [RESET_TYPE_FATAL_INT] = "Fatal HW Error",
+                [RESET_TYPE_TX_ERROR] = "TX HW error",
+                [RESET_TYPE_TX_GTT] = "Transmit timeout",
+                [RESET_TYPE_TX_HANG] = "TX Path Hang",
+                [RESET_TYPE_PLL_HANG] = "PLL RX Hang",
+                [RESET_TYPE_MAC_HANG] = "MAC Hang",
+                [RESET_TYPE_BEACON_STUCK] = "Stuck Beacon",
+                [RESET_TYPE_MCI] = "MCI Reset",
+                [RESET_TYPE_CALIBRATION] = "Calibration error",
+        };
         char buf[512];
         unsigned int len = 0;
+        int i;
 
-        len += scnprintf(buf + len, sizeof(buf) - len,
-                         "%17s: %2d\n", "Baseband Hang",
-                         sc->debug.stats.reset[RESET_TYPE_BB_HANG]);
-        len += scnprintf(buf + len, sizeof(buf) - len,
-                         "%17s: %2d\n", "Baseband Watchdog",
-                         sc->debug.stats.reset[RESET_TYPE_BB_WATCHDOG]);
-        len += scnprintf(buf + len, sizeof(buf) - len,
-                         "%17s: %2d\n", "Fatal HW Error",
-                         sc->debug.stats.reset[RESET_TYPE_FATAL_INT]);
-        len += scnprintf(buf + len, sizeof(buf) - len,
-                         "%17s: %2d\n", "TX HW error",
-                         sc->debug.stats.reset[RESET_TYPE_TX_ERROR]);
-        len += scnprintf(buf + len, sizeof(buf) - len,
-                         "%17s: %2d\n", "TX Path Hang",
-                         sc->debug.stats.reset[RESET_TYPE_TX_HANG]);
-        len += scnprintf(buf + len, sizeof(buf) - len,
-                         "%17s: %2d\n", "PLL RX Hang",
-                         sc->debug.stats.reset[RESET_TYPE_PLL_HANG]);
-        len += scnprintf(buf + len, sizeof(buf) - len,
-                         "%17s: %2d\n", "MAC Hang",
-                         sc->debug.stats.reset[RESET_TYPE_MAC_HANG]);
-        len += scnprintf(buf + len, sizeof(buf) - len,
-                         "%17s: %2d\n", "Stuck Beacon",
-                         sc->debug.stats.reset[RESET_TYPE_BEACON_STUCK]);
-        len += scnprintf(buf + len, sizeof(buf) - len,
-                         "%17s: %2d\n", "MCI Reset",
-                         sc->debug.stats.reset[RESET_TYPE_MCI]);
+        for (i = 0; i < ARRAY_SIZE(reset_cause); i++) {
+                if (!reset_cause[i])
+                    continue;
+
+                len += scnprintf(buf + len, sizeof(buf) - len,
+                                 "%17s: %2d\n", reset_cause[i],
+                                 sc->debug.stats.reset[i]);
+        }
 
         if (len > sizeof(buf))
                 len = sizeof(buf);
@@ -1315,7 +1311,7 @@ void ath9k_get_et_stats(struct ieee80211_hw *hw,
 
 void ath9k_deinit_debug(struct ath_softc *sc)
 {
-        ath9k_spectral_deinit_debug(sc);
+        ath9k_cmn_spectral_deinit_debug(&sc->spec_priv);
 }
 
 int ath9k_init_debug(struct ath_hw *ah)
@@ -1335,7 +1331,7 @@ int ath9k_init_debug(struct ath_hw *ah)
 
         ath9k_dfs_init_debug(sc);
         ath9k_tx99_init_debug(sc);
-        ath9k_spectral_init_debug(sc);
+        ath9k_cmn_spectral_init_debug(&sc->spec_priv, sc->debug.debugfs_phy);
 
         debugfs_create_file("dma", S_IRUSR, sc->debug.debugfs_phy, sc,
                             &fops_dma);
diff --git a/drivers/net/wireless/ath/ath9k/debug.h b/drivers/net/wireless/ath/ath9k/debug.h
index 53ae15bd0c9d..bd75b1f716db 100644
--- a/drivers/net/wireless/ath/ath9k/debug.h
+++ b/drivers/net/wireless/ath/ath9k/debug.h
@@ -49,6 +49,7 @@ enum ath_reset_type {
         RESET_TYPE_MAC_HANG,
         RESET_TYPE_BEACON_STUCK,
         RESET_TYPE_MCI,
+        RESET_TYPE_CALIBRATION,
         __RESET_TYPE_MAX
 };
 
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_def.c b/drivers/net/wireless/ath/ath9k/eeprom_def.c
index 3218ca994746..122b846b8ec0 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_def.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c
@@ -262,7 +262,7 @@ static int ath9k_hw_def_check_eeprom(struct ath_hw *ah)
 {
         struct ar5416_eeprom_def *eep = &ah->eeprom.def;
         struct ath_common *common = ath9k_hw_common(ah);
-        u16 *eepdata, temp, magic, magic2;
+        u16 *eepdata, temp, magic;
         u32 sum = 0, el;
         bool need_swap = false;
         int i, addr, size;
@@ -272,27 +272,16 @@ static int ath9k_hw_def_check_eeprom(struct ath_hw *ah)
                 return false;
         }
 
-        if (!ath9k_hw_use_flash(ah)) {
-                ath_dbg(common, EEPROM, "Read Magic = 0x%04X\n", magic);
-
-                if (magic != AR5416_EEPROM_MAGIC) {
-                        magic2 = swab16(magic);
-
-                        if (magic2 == AR5416_EEPROM_MAGIC) {
-                                size = sizeof(struct ar5416_eeprom_def);
-                                need_swap = true;
-                                eepdata = (u16 *) (&ah->eeprom);
+        if (swab16(magic) == AR5416_EEPROM_MAGIC &&
+            !(ah->ah_flags & AH_NO_EEP_SWAP)) {
+                size = sizeof(struct ar5416_eeprom_def);
+                need_swap = true;
+                eepdata = (u16 *) (&ah->eeprom);
 
-                                for (addr = 0; addr < size / sizeof(u16); addr++) {
-                                        temp = swab16(*eepdata);
-                                        *eepdata = temp;
-                                        eepdata++;
-                                }
-                        } else {
-                                ath_err(common,
-                                        "Invalid EEPROM Magic. Endianness mismatch.\n");
-                                return -EINVAL;
-                        }
+                for (addr = 0; addr < size / sizeof(u16); addr++) {
+                        temp = swab16(*eepdata);
+                        *eepdata = temp;
+                        eepdata++;
                 }
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/gpio.c b/drivers/net/wireless/ath/ath9k/gpio.c
index b1956bf6e01e..2fef7a480fec 100644
--- a/drivers/net/wireless/ath/ath9k/gpio.c
+++ b/drivers/net/wireless/ath/ath9k/gpio.c
@@ -25,7 +25,12 @@ static void ath_led_brightness(struct led_classdev *led_cdev,
                                enum led_brightness brightness)
 {
         struct ath_softc *sc = container_of(led_cdev, struct ath_softc, led_cdev);
-        ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, (brightness == LED_OFF));
+        u32 val = (brightness == LED_OFF);
+
+        if (sc->sc_ah->config.led_active_high)
+                val = !val;
+
+        ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, val);
 }
 
 void ath_deinit_leds(struct ath_softc *sc)
@@ -82,7 +87,7 @@ void ath_fill_led_pin(struct ath_softc *sc)
         ath9k_hw_cfg_output(ah, ah->led_pin, AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
 
         /* LED off, active low */
-        ath9k_hw_set_gpio(ah, ah->led_pin, 1);
+        ath9k_hw_set_gpio(ah, ah->led_pin, (ah->config.led_active_high) ? 0 : 1);
 }
 #endif
 
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index 09a5d72f3ff5..9dde265d3f84 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -481,6 +481,7 @@ struct ath9k_htc_priv {
         unsigned long op_flags;
 
         struct ath9k_hw_cal_data caldata;
+        struct ath_spec_scan_priv spec_priv;
 
         spinlock_t beacon_lock;
         struct ath_beacon_config cur_beacon_conf;
@@ -625,8 +626,12 @@ int ath9k_htc_resume(struct htc_target *htc_handle);
 #endif
 #ifdef CONFIG_ATH9K_HTC_DEBUGFS
 int ath9k_htc_init_debug(struct ath_hw *ah);
+void ath9k_htc_deinit_debug(struct ath9k_htc_priv *priv);
 #else
 static inline int ath9k_htc_init_debug(struct ath_hw *ah) { return 0; };
+static inline void ath9k_htc_deinit_debug(struct ath9k_htc_priv *priv)
+{
+}
 #endif /* CONFIG_ATH9K_HTC_DEBUGFS */
 
 #endif /* HTC_H */
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
index 8b529e4b8ac4..8cef1edcc621 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
@@ -490,6 +490,10 @@ void ath9k_htc_get_et_stats(struct ieee80211_hw *hw,
         WARN_ON(i != ATH9K_HTC_SSTATS_LEN);
 }
 
+void ath9k_htc_deinit_debug(struct ath9k_htc_priv *priv)
+{
+        ath9k_cmn_spectral_deinit_debug(&priv->spec_priv);
+}
 
 int ath9k_htc_init_debug(struct ath_hw *ah)
 {
@@ -501,6 +505,8 @@ int ath9k_htc_init_debug(struct ath_hw *ah)
         if (!priv->debug.debugfs_phy)
                 return -ENOMEM;
 
+        ath9k_cmn_spectral_init_debug(&priv->spec_priv, priv->debug.debugfs_phy);
+
         debugfs_create_file("tgt_int_stats", S_IRUSR, priv->debug.debugfs_phy,
                             priv, &fops_tgt_int_stats);
         debugfs_create_file("tgt_tx_stats", S_IRUSR, priv->debug.debugfs_phy,
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index d779f4fa50e3..e8fa9448da24 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -53,6 +53,21 @@ static const struct ieee80211_tpt_blink ath9k_htc_tpt_blink[] = {
 };
 #endif
 
+static void ath9k_htc_op_ps_wakeup(struct ath_common *common)
+{
+        ath9k_htc_ps_wakeup((struct ath9k_htc_priv *) common->priv);
+}
+
+static void ath9k_htc_op_ps_restore(struct ath_common *common)
+{
+        ath9k_htc_ps_restore((struct ath9k_htc_priv *) common->priv);
+}
+
+static struct ath_ps_ops ath9k_htc_ps_ops = {
+        .wakeup = ath9k_htc_op_ps_wakeup,
+        .restore = ath9k_htc_op_ps_restore,
+};
+
 static int ath9k_htc_wait_for_target(struct ath9k_htc_priv *priv)
 {
         int time_left;
@@ -87,6 +102,7 @@ static void ath9k_deinit_device(struct ath9k_htc_priv *priv)
 
         wiphy_rfkill_stop_polling(hw->wiphy);
         ath9k_deinit_leds(priv);
+        ath9k_htc_deinit_debug(priv);
         ieee80211_unregister_hw(hw);
         ath9k_rx_cleanup(priv);
         ath9k_tx_cleanup(priv);
@@ -449,6 +465,14 @@ static void ath9k_init_misc(struct ath9k_htc_priv *priv)
 
         common->last_rssi = ATH_RSSI_DUMMY_MARKER;
         priv->ah->opmode = NL80211_IFTYPE_STATION;
+
+        priv->spec_priv.ah = priv->ah;
+        priv->spec_priv.spec_config.enabled = 0;
+        priv->spec_priv.spec_config.short_repeat = false;
+        priv->spec_priv.spec_config.count = 8;
+        priv->spec_priv.spec_config.endless = false;
+        priv->spec_priv.spec_config.period = 0x12;
+        priv->spec_priv.spec_config.fft_period = 0x02;
 }
 
 static int ath9k_init_priv(struct ath9k_htc_priv *priv,
@@ -464,6 +488,7 @@ static int ath9k_init_priv(struct ath9k_htc_priv *priv,
                 return -ENOMEM;
 
         ah->dev = priv->dev;
+        ah->hw = priv->hw;
         ah->hw_version.devid = devid;
         ah->hw_version.usbdev = drv_info;
         ah->ah_flags |= AH_USE_EEPROM;
@@ -477,6 +502,7 @@ static int ath9k_init_priv(struct ath9k_htc_priv *priv,
 
         common = ath9k_hw_common(ah);
         common->ops = &ah->reg_ops;
+        common->ps_ops = &ath9k_htc_ps_ops;
         common->bus_ops = &ath9k_usb_bus_ops;
         common->ah = ah;
         common->hw = priv->hw;
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index 994fff1ff519..92d5a6c5a225 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -314,6 +314,10 @@ static int ath9k_htc_set_channel(struct ath9k_htc_priv *priv,
         mod_timer(&priv->tx.cleanup_timer,
                   jiffies + msecs_to_jiffies(ATH9K_HTC_TX_CLEANUP_INTERVAL));
 
+        /* perform spectral scan if requested. */
+        if (test_bit(ATH_OP_SCANNING, &common->op_flags) &&
+                     priv->spec_priv.spectral_mode == SPECTRAL_CHANSCAN)
+                ath9k_cmn_spectral_scan_trigger(common, &priv->spec_priv);
 err:
         ath9k_htc_ps_restore(priv);
         return ret;
@@ -1443,7 +1447,7 @@ static int ath9k_htc_set_key(struct ieee80211_hw *hw,
                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
                         if (key->cipher == WLAN_CIPHER_SUITE_TKIP)
                                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
-                        if (priv->ah->sw_mgmt_crypto &&
+                        if (priv->ah->sw_mgmt_crypto_tx &&
                             key->cipher == WLAN_CIPHER_SUITE_CCMP)
                                 key->flags |= IEEE80211_KEY_FLAG_SW_MGMT_TX;
                         ret = 0;
@@ -1687,7 +1691,9 @@ static int ath9k_htc_ampdu_action(struct ieee80211_hw *hw,
         return ret;
 }
 
-static void ath9k_htc_sw_scan_start(struct ieee80211_hw *hw)
+static void ath9k_htc_sw_scan_start(struct ieee80211_hw *hw,
+                                    struct ieee80211_vif *vif,
+                                    const u8 *mac_addr)
 {
         struct ath9k_htc_priv *priv = hw->priv;
         struct ath_common *common = ath9k_hw_common(priv->ah);
@@ -1701,7 +1707,8 @@ static void ath9k_htc_sw_scan_start(struct ieee80211_hw *hw)
         mutex_unlock(&priv->mutex);
 }
 
-static void ath9k_htc_sw_scan_complete(struct ieee80211_hw *hw)
+static void ath9k_htc_sw_scan_complete(struct ieee80211_hw *hw,
+                                       struct ieee80211_vif *vif)
 {
         struct ath9k_htc_priv *priv = hw->priv;
         struct ath_common *common = ath9k_hw_common(priv->ah);
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index f0484b1b617e..a0f58e2aa553 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -946,7 +946,7 @@ static inline void convert_htc_flag(struct ath_rx_status *rx_stats,
 static void rx_status_htc_to_ath(struct ath_rx_status *rx_stats,
                                  struct ath_htc_rx_status *rxstatus)
 {
-        rx_stats->rs_datalen    = rxstatus->rs_datalen;
+        rx_stats->rs_datalen    = be16_to_cpu(rxstatus->rs_datalen);
         rx_stats->rs_status     = rxstatus->rs_status;
         rx_stats->rs_phyerr     = rxstatus->rs_phyerr;
         rx_stats->rs_rssi       = rxstatus->rs_rssi;
@@ -1012,6 +1012,20 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
          * separately to avoid doing two lookups for a rate for each frame.
          */
         hdr = (struct ieee80211_hdr *)skb->data;
+
+        /*
+         * Process PHY errors and return so that the packet
+         * can be dropped.
+         */
+        if (rx_stats.rs_status & ATH9K_RXERR_PHY) {
+                /* TODO: Not using DFS processing now. */
+                if (ath_cmn_process_fft(&priv->spec_priv, hdr,
+                                    &rx_stats, rx_status->mactime)) {
+                        /* TODO: Code to collect spectral scan statistics */
+                }
+                goto rx_next;
+        }
+
         if (!ath9k_cmn_rx_accept(common, hdr, rx_status, &rx_stats,
                         &decrypt_error, priv->rxfilter))
                 goto rx_next;
diff --git a/drivers/net/wireless/ath/ath9k/hw-ops.h b/drivers/net/wireless/ath/ath9k/hw-ops.h
index 8e85efeaeffc..88769b64b20b 100644
--- a/drivers/net/wireless/ath/ath9k/hw-ops.h
+++ b/drivers/net/wireless/ath/ath9k/hw-ops.h
@@ -41,10 +41,9 @@ static inline void ath9k_hw_set_desc_link(struct ath_hw *ah, void *ds,
         ath9k_hw_ops(ah)->set_desc_link(ds, link);
 }
 
-static inline bool ath9k_hw_calibrate(struct ath_hw *ah,
-                                      struct ath9k_channel *chan,
-                                      u8 rxchainmask,
-                                      bool longcal)
+static inline int ath9k_hw_calibrate(struct ath_hw *ah,
+                                     struct ath9k_channel *chan,
+                                     u8 rxchainmask, bool longcal)
 {
         return ath9k_hw_ops(ah)->calibrate(ah, chan, rxchainmask, longcal);
 }
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 8be4b1453394..6d4b273469b1 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -19,6 +19,7 @@
 #include <linux/module.h>
 #include <linux/time.h>
 #include <linux/bitops.h>
+#include <linux/etherdevice.h>
 #include <asm/unaligned.h>
 
 #include "hw.h"
@@ -446,8 +447,16 @@ static int ath9k_hw_init_macaddr(struct ath_hw *ah)
                 common->macaddr[2 * i] = eeval >> 8;
                 common->macaddr[2 * i + 1] = eeval & 0xff;
         }
-        if (sum == 0 || sum == 0xffff * 3)
-                return -EADDRNOTAVAIL;
+        if (!is_valid_ether_addr(common->macaddr)) {
+                ath_err(common,
+                        "eeprom contains invalid mac address: %pM\n",
+                        common->macaddr);
+
+                random_ether_addr(common->macaddr);
+                ath_err(common,
+                        "random mac address will be used: %pM\n",
+                        common->macaddr);
+        }
 
         return 0;
 }
@@ -861,19 +870,6 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
         udelay(RTC_PLL_SETTLE_DELAY);
 
         REG_WRITE(ah, AR_RTC_SLEEP_CLK, AR_RTC_FORCE_DERIVED_CLK);
-
-        if (AR_SREV_9340(ah) || AR_SREV_9550(ah)) {
-                if (ah->is_clk_25mhz) {
-                        REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x17c << 1);
-                        REG_WRITE(ah, AR_SLP32_MODE, 0x0010f3d7);
-                        REG_WRITE(ah,  AR_SLP32_INC, 0x0001e7ae);
-                } else {
-                        REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x261 << 1);
-                        REG_WRITE(ah, AR_SLP32_MODE, 0x0010f400);
-                        REG_WRITE(ah,  AR_SLP32_INC, 0x0001e800);
-                }
-                udelay(100);
-        }
 }
 
 static void ath9k_hw_init_interrupt_masks(struct ath_hw *ah,
@@ -1589,16 +1585,22 @@ static void ath9k_hw_init_mfp(struct ath_hw *ah)
                  * frames when constructing CCMP AAD. */
                 REG_RMW_FIELD(ah, AR_AES_MUTE_MASK1, AR_AES_MUTE_MASK1_FC_MGMT,
                               0xc7ff);
-                ah->sw_mgmt_crypto = false;
+                if (AR_SREV_9271(ah) || AR_DEVID_7010(ah))
+                        ah->sw_mgmt_crypto_tx = true;
+                else
+                        ah->sw_mgmt_crypto_tx = false;
+                ah->sw_mgmt_crypto_rx = false;
         } else if (AR_SREV_9160_10_OR_LATER(ah)) {
                 /* Disable hardware crypto for management frames */
                 REG_CLR_BIT(ah, AR_PCU_MISC_MODE2,
                             AR_PCU_MISC_MODE2_MGMT_CRYPTO_ENABLE);
                 REG_SET_BIT(ah, AR_PCU_MISC_MODE2,
                             AR_PCU_MISC_MODE2_NO_CRYPTO_FOR_NON_DATA_PKT);
-                ah->sw_mgmt_crypto = true;
+                ah->sw_mgmt_crypto_tx = true;
+                ah->sw_mgmt_crypto_rx = true;
         } else {
-                ah->sw_mgmt_crypto = true;
+                ah->sw_mgmt_crypto_tx = true;
+                ah->sw_mgmt_crypto_rx = true;
         }
 }
 
@@ -1945,6 +1947,8 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
 
         REGWRITE_BUFFER_FLUSH(ah);
 
+        ath9k_hw_gen_timer_start_tsf2(ah);
+
         ath9k_hw_init_desc(ah);
 
         if (ath9k_hw_btcoex_is_enabled(ah))
@@ -1953,8 +1957,10 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         if (ath9k_hw_mci_is_enabled(ah))
                 ar9003_mci_check_bt(ah);
 
-        ath9k_hw_loadnf(ah, chan);
-        ath9k_hw_start_nfcal(ah, true);
+        if (AR_SREV_9300_20_OR_LATER(ah)) {
+                ath9k_hw_loadnf(ah, chan);
+                ath9k_hw_start_nfcal(ah, true);
+        }
 
         if (AR_SREV_9300_20_OR_LATER(ah))
                 ar9003_hw_bb_watchdog_config(ah);
@@ -2322,7 +2328,6 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
         struct ath9k_hw_capabilities *pCap = &ah->caps;
         struct ath_regulatory *regulatory = ath9k_hw_regulatory(ah);
         struct ath_common *common = ath9k_hw_common(ah);
-        unsigned int chip_chainmask;
 
         u16 eeval;
         u8 ant_div_ctl1, tx_chainmask, rx_chainmask;
@@ -2342,31 +2347,40 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
         }
 
         eeval = ah->eep_ops->get_eeprom(ah, EEP_OP_MODE);
-        if ((eeval & (AR5416_OPFLAGS_11G | AR5416_OPFLAGS_11A)) == 0) {
-                ath_err(common,
-                        "no band has been marked as supported in EEPROM\n");
-                return -EINVAL;
+
+        if (eeval & AR5416_OPFLAGS_11A) {
+                if (ah->disable_5ghz)
+                        ath_warn(common, "disabling 5GHz band\n");
+                else
+                        pCap->hw_caps |= ATH9K_HW_CAP_5GHZ;
         }
 
-        if (eeval & AR5416_OPFLAGS_11A)
-                pCap->hw_caps |= ATH9K_HW_CAP_5GHZ;
+        if (eeval & AR5416_OPFLAGS_11G) {
+                if (ah->disable_2ghz)
+                        ath_warn(common, "disabling 2GHz band\n");
+                else
+                        pCap->hw_caps |= ATH9K_HW_CAP_2GHZ;
+        }
 
-        if (eeval & AR5416_OPFLAGS_11G)
-                pCap->hw_caps |= ATH9K_HW_CAP_2GHZ;
+        if ((pCap->hw_caps & (ATH9K_HW_CAP_2GHZ | ATH9K_HW_CAP_5GHZ)) == 0) {
+                ath_err(common, "both bands are disabled\n");
+                return -EINVAL;
+        }
 
         if (AR_SREV_9485(ah) ||
             AR_SREV_9285(ah) ||
             AR_SREV_9330(ah) ||
             AR_SREV_9565(ah))
-                chip_chainmask = 1;
-        else if (AR_SREV_9462(ah))
-                chip_chainmask = 3;
+                pCap->chip_chainmask = 1;
         else if (!AR_SREV_9280_20_OR_LATER(ah))
-                chip_chainmask = 7;
-        else if (!AR_SREV_9300_20_OR_LATER(ah) || AR_SREV_9340(ah))
-                chip_chainmask = 3;
+                pCap->chip_chainmask = 7;
+        else if (!AR_SREV_9300_20_OR_LATER(ah) ||
+                 AR_SREV_9340(ah) ||
+                 AR_SREV_9462(ah) ||
+                 AR_SREV_9531(ah))
+                pCap->chip_chainmask = 3;
         else
-                chip_chainmask = 7;
+                pCap->chip_chainmask = 7;
 
         pCap->tx_chainmask = ah->eep_ops->get_eeprom(ah, EEP_TX_MASK);
         /*
@@ -2384,8 +2398,8 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
                 /* Use rx_chainmask from EEPROM. */
                 pCap->rx_chainmask = ah->eep_ops->get_eeprom(ah, EEP_RX_MASK);
 
-        pCap->tx_chainmask = fixup_chainmask(chip_chainmask, pCap->tx_chainmask);
-        pCap->rx_chainmask = fixup_chainmask(chip_chainmask, pCap->rx_chainmask);
+        pCap->tx_chainmask = fixup_chainmask(pCap->chip_chainmask, pCap->tx_chainmask);
+        pCap->rx_chainmask = fixup_chainmask(pCap->chip_chainmask, pCap->rx_chainmask);
         ah->txchainmask = pCap->tx_chainmask;
         ah->rxchainmask = pCap->rx_chainmask;
 
@@ -2899,6 +2913,16 @@ u32 ath9k_hw_gettsf32(struct ath_hw *ah)
 }
 EXPORT_SYMBOL(ath9k_hw_gettsf32);
 
+void ath9k_hw_gen_timer_start_tsf2(struct ath_hw *ah)
+{
+        struct ath_gen_timer_table *timer_table = &ah->hw_gen_timers;
+
+        if (timer_table->tsf2_enabled) {
+                REG_SET_BIT(ah, AR_DIRECT_CONNECT, AR_DC_AP_STA_EN);
+                REG_SET_BIT(ah, AR_RESET_TSF, AR_RESET_TSF2_ONCE);
+        }
+}
+
 struct ath_gen_timer *ath_gen_timer_alloc(struct ath_hw *ah,
                                           void (*trigger)(void *),
                                           void (*overflow)(void *),
@@ -2909,7 +2933,11 @@ struct ath_gen_timer *ath_gen_timer_alloc(struct ath_hw *ah,
         struct ath_gen_timer *timer;
 
         if ((timer_index < AR_FIRST_NDP_TIMER) ||
-                (timer_index >= ATH_MAX_GEN_TIMER))
+            (timer_index >= ATH_MAX_GEN_TIMER))
+                return NULL;
+
+        if ((timer_index > AR_FIRST_NDP_TIMER) &&
+            !AR_SREV_9300_20_OR_LATER(ah))
                 return NULL;
 
         timer = kzalloc(sizeof(struct ath_gen_timer), GFP_KERNEL);
@@ -2923,6 +2951,11 @@ struct ath_gen_timer *ath_gen_timer_alloc(struct ath_hw *ah,
         timer->overflow = overflow;
         timer->arg = arg;
 
+        if ((timer_index > AR_FIRST_NDP_TIMER) && !timer_table->tsf2_enabled) {
+                timer_table->tsf2_enabled = true;
+                ath9k_hw_gen_timer_start_tsf2(ah);
+        }
+
         return timer;
 }
 EXPORT_SYMBOL(ath_gen_timer_alloc);
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 975074fc11bc..4cf9e0ac0743 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -244,13 +244,20 @@ enum ath9k_hw_caps {
         ATH9K_HW_CAP_2GHZ                       = BIT(11),
         ATH9K_HW_CAP_5GHZ                       = BIT(12),
         ATH9K_HW_CAP_APM                        = BIT(13),
+#ifdef CONFIG_ATH9K_PCOEM
         ATH9K_HW_CAP_RTT                        = BIT(14),
         ATH9K_HW_CAP_MCI                        = BIT(15),
-        ATH9K_HW_CAP_DFS                        = BIT(16),
-        ATH9K_HW_WOW_DEVICE_CAPABLE             = BIT(17),
-        ATH9K_HW_CAP_PAPRD                      = BIT(18),
-        ATH9K_HW_CAP_FCC_BAND_SWITCH            = BIT(19),
-        ATH9K_HW_CAP_BT_ANT_DIV                 = BIT(20),
+        ATH9K_HW_WOW_DEVICE_CAPABLE             = BIT(16),
+        ATH9K_HW_CAP_BT_ANT_DIV                 = BIT(17),
+#else
+        ATH9K_HW_CAP_RTT                        = 0,
+        ATH9K_HW_CAP_MCI                        = 0,
+        ATH9K_HW_WOW_DEVICE_CAPABLE             = 0,
+        ATH9K_HW_CAP_BT_ANT_DIV                 = 0,
+#endif
+        ATH9K_HW_CAP_DFS                        = BIT(18),
+        ATH9K_HW_CAP_PAPRD                      = BIT(19),
+        ATH9K_HW_CAP_FCC_BAND_SWITCH            = BIT(20),
 };
 
 /*
@@ -269,6 +276,7 @@ struct ath9k_hw_capabilities {
         u16 rts_aggr_limit;
         u8 tx_chainmask;
         u8 rx_chainmask;
+        u8 chip_chainmask;
         u8 max_txchains;
         u8 max_rxchains;
         u8 num_gpio_pins;
@@ -322,6 +330,7 @@ struct ath9k_ops_config {
         bool alt_mingainidx;
         bool no_pll_pwrsave;
         bool tx_gain_buffalo;
+        bool led_active_high;
 };
 
 enum ath9k_int {
@@ -517,6 +526,7 @@ struct ath_gen_timer {
 struct ath_gen_timer_table {
         struct ath_gen_timer *timers[ATH_MAX_GEN_TIMER];
         u16 timer_mask;
+        bool tsf2_enabled;
 };
 
 struct ath_hw_antcomb_conf {
@@ -681,10 +691,8 @@ struct ath_hw_ops {
                                      bool power_off);
         void (*rx_enable)(struct ath_hw *ah);
         void (*set_desc_link)(void *ds, u32 link);
-        bool (*calibrate)(struct ath_hw *ah,
-                          struct ath9k_channel *chan,
-                          u8 rxchainmask,
-                          bool longcal);
+        int (*calibrate)(struct ath_hw *ah, struct ath9k_channel *chan,
+                         u8 rxchainmask, bool longcal);
         bool (*get_isr)(struct ath_hw *ah, enum ath9k_int *masked,
                         u32 *sync_cause_p);
         void (*set_txdesc)(struct ath_hw *ah, void *ds,
@@ -726,6 +734,7 @@ enum ath_cal_list {
 #define AH_USE_EEPROM   0x1
 #define AH_UNPLUGGED    0x2 /* The card has been physically removed. */
 #define AH_FASTCC       0x4
+#define AH_NO_EEP_SWAP  0x8 /* Do not swap EEPROM data */
 
 struct ath_hw {
         struct ath_ops reg_ops;
@@ -747,7 +756,8 @@ struct ath_hw {
         } eeprom;
         const struct eeprom_ops *eep_ops;
 
-        bool sw_mgmt_crypto;
+        bool sw_mgmt_crypto_tx;
+        bool sw_mgmt_crypto_rx;
         bool is_pciexpress;
         bool aspm_enabled;
         bool is_monitoring;
@@ -924,6 +934,8 @@ struct ath_hw {
         bool is_clk_25mhz;
         int (*get_mac_revision)(void);
         int (*external_reset)(void);
+        bool disable_2ghz;
+        bool disable_5ghz;
 
         const struct firmware *eeprom_blob;
 
@@ -1027,6 +1039,7 @@ void ath9k_hw_gen_timer_start(struct ath_hw *ah,
                               struct ath_gen_timer *timer,
                               u32 timer_next,
                               u32 timer_period);
+void ath9k_hw_gen_timer_start_tsf2(struct ath_hw *ah);
 void ath9k_hw_gen_timer_stop(struct ath_hw *ah, struct ath_gen_timer *timer);
 
 void ath_gen_timer_free(struct ath_hw *ah, struct ath_gen_timer *timer);
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 156a944134dc..59d679cebc89 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -88,6 +88,21 @@ static const struct ieee80211_tpt_blink ath9k_tpt_blink[] = {
 
 static void ath9k_deinit_softc(struct ath_softc *sc);
 
+static void ath9k_op_ps_wakeup(struct ath_common *common)
+{
+        ath9k_ps_wakeup((struct ath_softc *) common->priv);
+}
+
+static void ath9k_op_ps_restore(struct ath_common *common)
+{
+        ath9k_ps_restore((struct ath_softc *) common->priv);
+}
+
+static struct ath_ps_ops ath9k_ps_ops = {
+        .wakeup = ath9k_op_ps_wakeup,
+        .restore = ath9k_op_ps_restore,
+};
+
 /*
  * Read and write, they both share the same lock. We do this to serialize
  * reads and writes on Atheros 802.11n PCI devices only. This is required
@@ -172,17 +187,20 @@ static void ath9k_reg_notifier(struct wiphy *wiphy,
         ath_reg_notifier_apply(wiphy, request, reg);
 
         /* Set tx power */
-        if (ah->curchan) {
-                sc->cur_chan->txpower = 2 * ah->curchan->chan->max_power;
-                ath9k_ps_wakeup(sc);
-                ath9k_hw_set_txpowerlimit(ah, sc->cur_chan->txpower, false);
-                sc->curtxpow = ath9k_hw_regulatory(ah)->power_limit;
-                /* synchronize DFS detector if regulatory domain changed */
-                if (sc->dfs_detector != NULL)
-                        sc->dfs_detector->set_dfs_domain(sc->dfs_detector,
-                                                         request->dfs_region);
-                ath9k_ps_restore(sc);
-        }
+        if (!ah->curchan)
+                return;
+
+        sc->cur_chan->txpower = 2 * ah->curchan->chan->max_power;
+        ath9k_ps_wakeup(sc);
+        ath9k_hw_set_txpowerlimit(ah, sc->cur_chan->txpower, false);
+        ath9k_cmn_update_txpow(ah, sc->cur_chan->cur_txpower,
+                               sc->cur_chan->txpower,
+                               &sc->cur_chan->cur_txpower);
+        /* synchronize DFS detector if regulatory domain changed */
+        if (sc->dfs_detector != NULL)
+                sc->dfs_detector->set_dfs_domain(sc->dfs_detector,
+                                                 request->dfs_region);
+        ath9k_ps_restore(sc);
 }
 
 /*
@@ -348,12 +366,13 @@ static void ath9k_init_misc(struct ath_softc *sc)
         if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_ANT_DIV_COMB)
                 sc->ant_comb.count = ATH_ANT_DIV_COMB_INIT_COUNT;
 
-        sc->spec_config.enabled = 0;
-        sc->spec_config.short_repeat = true;
-        sc->spec_config.count = 8;
-        sc->spec_config.endless = false;
-        sc->spec_config.period = 0xFF;
-        sc->spec_config.fft_period = 0xF;
+        sc->spec_priv.ah = sc->sc_ah;
+        sc->spec_priv.spec_config.enabled = 0;
+        sc->spec_priv.spec_config.short_repeat = true;
+        sc->spec_priv.spec_config.count = 8;
+        sc->spec_priv.spec_config.endless = false;
+        sc->spec_priv.spec_config.period = 0xFF;
+        sc->spec_priv.spec_config.fft_period = 0xF;
 }
 
 static void ath9k_init_pcoem_platform(struct ath_softc *sc)
@@ -362,6 +381,9 @@ static void ath9k_init_pcoem_platform(struct ath_softc *sc)
         struct ath9k_hw_capabilities *pCap = &ah->caps;
         struct ath_common *common = ath9k_hw_common(ah);
 
+        if (!IS_ENABLED(CONFIG_ATH9K_PCOEM))
+                return;
+
         if (common->bus_ops->ath_bus_type != ATH_PCI)
                 return;
 
@@ -419,6 +441,9 @@ static void ath9k_init_pcoem_platform(struct ath_softc *sc)
                 ah->config.no_pll_pwrsave = true;
                 ath_info(common, "Disable PLL PowerSave\n");
         }
+
+        if (sc->driver_data & ATH9K_PCI_LED_ACT_HI)
+                ah->config.led_active_high = true;
 }
 
 static void ath9k_eeprom_request_cb(const struct firmware *eeprom_blob,
@@ -528,10 +553,15 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc,
                 ah->is_clk_25mhz = pdata->is_clk_25mhz;
                 ah->get_mac_revision = pdata->get_mac_revision;
                 ah->external_reset = pdata->external_reset;
+                ah->disable_2ghz = pdata->disable_2ghz;
+                ah->disable_5ghz = pdata->disable_5ghz;
+                if (!pdata->endian_check)
+                        ah->ah_flags |= AH_NO_EEP_SWAP;
         }
 
         common->ops = &ah->reg_ops;
         common->bus_ops = bus_ops;
+        common->ps_ops = &ath9k_ps_ops;
         common->ah = ah;
         common->hw = sc->hw;
         common->priv = sc;
@@ -734,6 +764,32 @@ static const struct ieee80211_iface_combination if_comb[] = {
 #endif
 };
 
+#ifdef CONFIG_ATH9K_CHANNEL_CONTEXT
+static void ath9k_set_mcc_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
+{
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        if (!ath9k_is_chanctx_enabled())
+                return;
+
+        hw->flags |= IEEE80211_HW_QUEUE_CONTROL;
+        hw->queues = ATH9K_NUM_TX_QUEUES;
+        hw->offchannel_tx_hw_queue = hw->queues - 1;
+        hw->wiphy->interface_modes &= ~ BIT(NL80211_IFTYPE_WDS);
+        hw->wiphy->iface_combinations = if_comb_multi;
+        hw->wiphy->n_iface_combinations = ARRAY_SIZE(if_comb_multi);
+        hw->wiphy->max_scan_ssids = 255;
+        hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
+        hw->wiphy->max_remain_on_channel_duration = 10000;
+        hw->chanctx_data_size = sizeof(void *);
+        hw->extra_beacon_tailroom =
+                sizeof(struct ieee80211_p2p_noa_attr) + 9;
+
+        ath_dbg(common, CHAN_CTX, "Use channel contexts\n");
+}
+#endif /* CONFIG_ATH9K_CHANNEL_CONTEXT */
+
 static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
 {
         struct ath_hw *ah = sc->sc_ah;
@@ -746,7 +802,6 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
                 IEEE80211_HW_SPECTRUM_MGMT |
                 IEEE80211_HW_REPORTS_TX_ACK_STATUS |
                 IEEE80211_HW_SUPPORTS_RC_TABLE |
-                IEEE80211_HW_QUEUE_CONTROL |
                 IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
 
         if (ath9k_ps_enable)
@@ -781,24 +836,6 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
                         hw->wiphy->n_iface_combinations = ARRAY_SIZE(if_comb);
         }
 
-#ifdef CONFIG_ATH9K_CHANNEL_CONTEXT
-
-        if (ath9k_is_chanctx_enabled()) {
-                hw->wiphy->interface_modes &= ~ BIT(NL80211_IFTYPE_WDS);
-                hw->wiphy->iface_combinations = if_comb_multi;
-                hw->wiphy->n_iface_combinations = ARRAY_SIZE(if_comb_multi);
-                hw->wiphy->max_scan_ssids = 255;
-                hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
-                hw->wiphy->max_remain_on_channel_duration = 10000;
-                hw->chanctx_data_size = sizeof(void *);
-                hw->extra_beacon_tailroom =
-                        sizeof(struct ieee80211_p2p_noa_attr) + 9;
-
-                ath_dbg(common, CHAN_CTX, "Use channel contexts\n");
-        }
-
-#endif /* CONFIG_ATH9K_CHANNEL_CONTEXT */
-
         hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
 
         hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
@@ -808,12 +845,7 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
         hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
         hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
 
-        /* allow 4 queues per channel context +
-         * 1 cab queue + 1 offchannel tx queue
-         */
-        hw->queues = ATH9K_NUM_TX_QUEUES;
-        /* last queue for offchannel */
-        hw->offchannel_tx_hw_queue = hw->queues - 1;
+        hw->queues = 4;
         hw->max_rates = 4;
         hw->max_listen_interval = 10;
         hw->max_rate_tries = 10;
@@ -837,6 +869,9 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
                 hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
                         &common->sbands[IEEE80211_BAND_5GHZ];
 
+#ifdef CONFIG_ATH9K_CHANNEL_CONTEXT
+        ath9k_set_mcc_capab(sc, hw);
+#endif
         ath9k_init_wow(hw);
         ath9k_cmn_reload_chainmask(ah);
 
diff --git a/drivers/net/wireless/ath/ath9k/link.c b/drivers/net/wireless/ath/ath9k/link.c
index 2343f56e6498..b829263e3d0a 100644
--- a/drivers/net/wireless/ath/ath9k/link.c
+++ b/drivers/net/wireless/ath/ath9k/link.c
@@ -371,9 +371,15 @@ void ath_ani_calibrate(unsigned long data)
 
         /* Perform calibration if necessary */
         if (longcal || shortcal) {
-                common->ani.caldone =
-                        ath9k_hw_calibrate(ah, ah->curchan,
-                                           ah->rxchainmask, longcal);
+                int ret = ath9k_hw_calibrate(ah, ah->curchan, ah->rxchainmask,
+                                             longcal);
+                if (ret < 0) {
+                        common->ani.caldone = 0;
+                        ath9k_queue_reset(sc, RESET_TYPE_CALIBRATION);
+                        return;
+                }
+
+                common->ani.caldone = ret;
         }
 
         ath_dbg(common, ANI,
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 205162449b72..7c63976b5b0c 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -54,7 +54,8 @@ u8 ath9k_parse_mpdudensity(u8 mpdudensity)
         }
 }
 
-static bool ath9k_has_pending_frames(struct ath_softc *sc, struct ath_txq *txq)
+static bool ath9k_has_pending_frames(struct ath_softc *sc, struct ath_txq *txq,
+                                     bool sw_pending)
 {
         bool pending = false;
 
@@ -65,6 +66,9 @@ static bool ath9k_has_pending_frames(struct ath_softc *sc, struct ath_txq *txq)
                 goto out;
         }
 
+        if (!sw_pending)
+                goto out;
+
         if (txq->mac80211_qnum >= 0) {
                 struct list_head *list;
 
@@ -229,8 +233,9 @@ static bool ath_complete_reset(struct ath_softc *sc, bool start)
 
         ath9k_calculate_summary_state(sc, sc->cur_chan);
         ath_startrecv(sc);
-        ath9k_cmn_update_txpow(ah, sc->curtxpow,
-                               sc->cur_chan->txpower, &sc->curtxpow);
+        ath9k_cmn_update_txpow(ah, sc->cur_chan->cur_txpower,
+                               sc->cur_chan->txpower,
+                               &sc->cur_chan->cur_txpower);
         clear_bit(ATH_OP_HW_RESET, &common->op_flags);
 
         if (!sc->cur_chan->offchannel && start) {
@@ -270,7 +275,7 @@ static bool ath_complete_reset(struct ath_softc *sc, bool start)
         return true;
 }
 
-int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan)
+static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan)
 {
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
@@ -281,6 +286,7 @@ int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan)
         __ath_cancel_work(sc);
 
         tasklet_disable(&sc->intr_tq);
+        tasklet_disable(&sc->bcon_tasklet);
         spin_lock_bh(&sc->sc_pcu_lock);
 
         if (!sc->cur_chan->offchannel) {
@@ -326,6 +332,7 @@ int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan)
 
 out:
         spin_unlock_bh(&sc->sc_pcu_lock);
+        tasklet_enable(&sc->bcon_tasklet);
         tasklet_enable(&sc->intr_tq);
 
         return r;
@@ -539,11 +546,10 @@ irqreturn_t ath_isr(int irq, void *dev)
                 sched = true;
 
         /*
-         * If a FATAL or RXORN interrupt is received, we have to reset the
-         * chip immediately.
+         * If a FATAL interrupt is received, we have to reset the chip
+         * immediately.
          */
-        if ((status & ATH9K_INT_FATAL) || ((status & ATH9K_INT_RXORN) &&
-            !(ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)))
+        if (status & ATH9K_INT_FATAL)
                 goto chip_reset;
 
         if ((ah->config.hw_hang_checks & HW_BB_WATCHDOG) &&
@@ -598,17 +604,29 @@ chip_reset:
 #undef SCHED_INTR
 }
 
-int ath_reset(struct ath_softc *sc)
+/*
+ * This function is called when a HW reset cannot be deferred
+ * and has to be immediate.
+ */
+int ath_reset(struct ath_softc *sc, struct ath9k_channel *hchan)
 {
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         int r;
 
+        set_bit(ATH_OP_HW_RESET, &common->op_flags);
+
         ath9k_ps_wakeup(sc);
-        r = ath_reset_internal(sc, NULL);
+        r = ath_reset_internal(sc, hchan);
         ath9k_ps_restore(sc);
 
         return r;
 }
 
+/*
+ * When a HW reset can be deferred, it is added to the
+ * hw_reset_work workqueue, but we set ATH_OP_HW_RESET before
+ * queueing.
+ */
 void ath9k_queue_reset(struct ath_softc *sc, enum ath_reset_type type)
 {
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
@@ -623,7 +641,9 @@ void ath_reset_work(struct work_struct *work)
 {
         struct ath_softc *sc = container_of(work, struct ath_softc, hw_reset_work);
 
-        ath_reset(sc);
+        ath9k_ps_wakeup(sc);
+        ath_reset_internal(sc, NULL);
+        ath9k_ps_restore(sc);
 }
 
 /**********************/
@@ -707,7 +727,8 @@ static int ath9k_start(struct ieee80211_hw *hw)
         if (ah->led_pin >= 0) {
                 ath9k_hw_cfg_output(ah, ah->led_pin,
                                     AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
-                ath9k_hw_set_gpio(ah, ah->led_pin, 0);
+                ath9k_hw_set_gpio(ah, ah->led_pin,
+                                  (ah->config.led_active_high) ? 1 : 0);
         }
 
         /*
@@ -849,7 +870,8 @@ static void ath9k_stop(struct ieee80211_hw *hw)
         spin_lock_bh(&sc->sc_pcu_lock);
 
         if (ah->led_pin >= 0) {
-                ath9k_hw_set_gpio(ah, ah->led_pin, 1);
+                ath9k_hw_set_gpio(ah, ah->led_pin,
+                                  (ah->config.led_active_high) ? 0 : 1);
                 ath9k_hw_cfg_gpio_input(ah, ah->led_pin);
         }
 
@@ -1037,7 +1059,7 @@ static void ath9k_set_offchannel_state(struct ath_softc *sc)
 
         eth_zero_addr(common->curbssid);
         eth_broadcast_addr(common->bssidmask);
-        ether_addr_copy(common->macaddr, vif->addr);
+        memcpy(common->macaddr, vif->addr, ETH_ALEN);
         common->curaid = 0;
         ah->opmode = vif->type;
         ah->imask &= ~ATH9K_INT_SWBA;
@@ -1078,7 +1100,7 @@ void ath9k_calculate_summary_state(struct ath_softc *sc,
         ath9k_calculate_iter_data(sc, ctx, &iter_data);
 
         if (iter_data.has_hw_macaddr)
-                ether_addr_copy(common->macaddr, iter_data.hw_macaddr);
+                memcpy(common->macaddr, iter_data.hw_macaddr, ETH_ALEN);
 
         memcpy(common->bssidmask, iter_data.mask, ETH_ALEN);
         ath_hw_setbssidmask(common);
@@ -1162,10 +1184,14 @@ static void ath9k_assign_hw_queues(struct ieee80211_hw *hw,
 {
         int i;
 
+        if (!ath9k_is_chanctx_enabled())
+                return;
+
         for (i = 0; i < IEEE80211_NUM_ACS; i++)
                 vif->hw_queue[i] = i;
 
-        if (vif->type == NL80211_IFTYPE_AP)
+        if (vif->type == NL80211_IFTYPE_AP ||
+            vif->type == NL80211_IFTYPE_MESH_POINT)
                 vif->cab_queue = hw->queues - 2;
         else
                 vif->cab_queue = IEEE80211_INVAL_HW_QUEUE;
@@ -1317,78 +1343,6 @@ static void ath9k_disable_ps(struct ath_softc *sc)
         ath_dbg(common, PS, "PowerSave disabled\n");
 }
 
-void ath9k_spectral_scan_trigger(struct ieee80211_hw *hw)
-{
-        struct ath_softc *sc = hw->priv;
-        struct ath_hw *ah = sc->sc_ah;
-        struct ath_common *common = ath9k_hw_common(ah);
-        u32 rxfilter;
-
-        if (config_enabled(CONFIG_ATH9K_TX99))
-                return;
-
-        if (!ath9k_hw_ops(ah)->spectral_scan_trigger) {
-                ath_err(common, "spectrum analyzer not implemented on this hardware\n");
-                return;
-        }
-
-        ath9k_ps_wakeup(sc);
-        rxfilter = ath9k_hw_getrxfilter(ah);
-        ath9k_hw_setrxfilter(ah, rxfilter |
-                                 ATH9K_RX_FILTER_PHYRADAR |
-                                 ATH9K_RX_FILTER_PHYERR);
-
-        /* TODO: usually this should not be neccesary, but for some reason
-         * (or in some mode?) the trigger must be called after the
-         * configuration, otherwise the register will have its values reset
-         * (on my ar9220 to value 0x01002310)
-         */
-        ath9k_spectral_scan_config(hw, sc->spectral_mode);
-        ath9k_hw_ops(ah)->spectral_scan_trigger(ah);
-        ath9k_ps_restore(sc);
-}
-
-int ath9k_spectral_scan_config(struct ieee80211_hw *hw,
-                               enum spectral_mode spectral_mode)
-{
-        struct ath_softc *sc = hw->priv;
-        struct ath_hw *ah = sc->sc_ah;
-        struct ath_common *common = ath9k_hw_common(ah);
-
-        if (!ath9k_hw_ops(ah)->spectral_scan_trigger) {
-                ath_err(common, "spectrum analyzer not implemented on this hardware\n");
-                return -1;
-        }
-
-        switch (spectral_mode) {
-        case SPECTRAL_DISABLED:
-                sc->spec_config.enabled = 0;
-                break;
-        case SPECTRAL_BACKGROUND:
-                /* send endless samples.
-                 * TODO: is this really useful for "background"?
-                 */
-                sc->spec_config.endless = 1;
-                sc->spec_config.enabled = 1;
-                break;
-        case SPECTRAL_CHANSCAN:
-        case SPECTRAL_MANUAL:
-                sc->spec_config.endless = 0;
-                sc->spec_config.enabled = 1;
-                break;
-        default:
-                return -1;
-        }
-
-        ath9k_ps_wakeup(sc);
-        ath9k_hw_ops(ah)->spectral_scan_config(ah, &sc->spec_config);
-        ath9k_ps_restore(sc);
-
-        sc->spectral_mode = spectral_mode;
-
-        return 0;
-}
-
 static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
 {
         struct ath_softc *sc = hw->priv;
@@ -1449,8 +1403,9 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
         if (changed & IEEE80211_CONF_CHANGE_POWER) {
                 ath_dbg(common, CONFIG, "Set power: %d\n", conf->power_level);
                 sc->cur_chan->txpower = 2 * conf->power_level;
-                ath9k_cmn_update_txpow(ah, sc->curtxpow,
-                                       sc->cur_chan->txpower, &sc->curtxpow);
+                ath9k_cmn_update_txpow(ah, sc->cur_chan->cur_txpower,
+                                       sc->cur_chan->txpower,
+                                       &sc->cur_chan->cur_txpower);
         }
 
         mutex_unlock(&sc->mutex);
@@ -1547,6 +1502,40 @@ static int ath9k_sta_remove(struct ieee80211_hw *hw,
         return 0;
 }
 
+static int ath9k_sta_state(struct ieee80211_hw *hw,
+                           struct ieee80211_vif *vif,
+                           struct ieee80211_sta *sta,
+                           enum ieee80211_sta_state old_state,
+                           enum ieee80211_sta_state new_state)
+{
+        struct ath_softc *sc = hw->priv;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        int ret = 0;
+
+        if (old_state == IEEE80211_STA_AUTH &&
+            new_state == IEEE80211_STA_ASSOC) {
+                ret = ath9k_sta_add(hw, vif, sta);
+                ath_dbg(common, CONFIG,
+                        "Add station: %pM\n", sta->addr);
+        } else if (old_state == IEEE80211_STA_ASSOC &&
+                   new_state == IEEE80211_STA_AUTH) {
+                ret = ath9k_sta_remove(hw, vif, sta);
+                ath_dbg(common, CONFIG,
+                        "Remove station: %pM\n", sta->addr);
+        }
+
+        if (ath9k_is_chanctx_enabled()) {
+                if (vif->type == NL80211_IFTYPE_STATION) {
+                        if (old_state == IEEE80211_STA_ASSOC &&
+                            new_state == IEEE80211_STA_AUTHORIZED)
+                                ath_chanctx_event(sc, vif,
+                                                  ATH_CHANCTX_EVENT_AUTHORIZED);
+                }
+        }
+
+        return ret;
+}
+
 static void ath9k_sta_set_tx_filter(struct ath_hw *ah,
                                     struct ath_node *an,
                                     bool set)
@@ -1671,7 +1660,7 @@ static int ath9k_set_key(struct ieee80211_hw *hw,
                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
                         if (key->cipher == WLAN_CIPHER_SUITE_TKIP)
                                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
-                        if (sc->sc_ah->sw_mgmt_crypto &&
+                        if (sc->sc_ah->sw_mgmt_crypto_tx &&
                             key->cipher == WLAN_CIPHER_SUITE_CCMP)
                                 key->flags |= IEEE80211_KEY_FLAG_SW_MGMT_TX;
                         ret = 0;
@@ -1731,17 +1720,11 @@ static void ath9k_bss_info_changed(struct ieee80211_hw *hw,
                 ath_dbg(common, CONFIG, "BSSID %pM Changed ASSOC %d\n",
                         bss_conf->bssid, bss_conf->assoc);
 
-                ether_addr_copy(avp->bssid, bss_conf->bssid);
+                memcpy(avp->bssid, bss_conf->bssid, ETH_ALEN);
                 avp->aid = bss_conf->aid;
                 avp->assoc = bss_conf->assoc;
 
                 ath9k_calculate_summary_state(sc, avp->chanctx);
-
-                if (ath9k_is_chanctx_enabled()) {
-                        if (bss_conf->assoc)
-                                ath_chanctx_event(sc, vif,
-                                                  ATH_CHANCTX_EVENT_ASSOC);
-                }
         }
 
         if (changed & BSS_CHANGED_IBSS) {
@@ -1837,6 +1820,7 @@ static int ath9k_ampdu_action(struct ieee80211_hw *hw,
                               u16 tid, u16 *ssn, u8 buf_size)
 {
         struct ath_softc *sc = hw->priv;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         bool flush = false;
         int ret = 0;
 
@@ -1848,6 +1832,12 @@ static int ath9k_ampdu_action(struct ieee80211_hw *hw,
         case IEEE80211_AMPDU_RX_STOP:
                 break;
         case IEEE80211_AMPDU_TX_START:
+                if (ath9k_is_chanctx_enabled()) {
+                        if (test_bit(ATH_OP_SCANNING, &common->op_flags)) {
+                                ret = -EBUSY;
+                                break;
+                        }
+                }
                 ath9k_ps_wakeup(sc);
                 ret = ath_tx_aggr_start(sc, sta, tid, ssn);
                 if (!ret)
@@ -1961,7 +1951,8 @@ static void ath9k_set_coverage_class(struct ieee80211_hw *hw,
         mutex_unlock(&sc->mutex);
 }
 
-static bool ath9k_has_tx_pending(struct ath_softc *sc)
+static bool ath9k_has_tx_pending(struct ath_softc *sc,
+                                 bool sw_pending)
 {
         int i, npend = 0;
 
@@ -1969,7 +1960,8 @@ static bool ath9k_has_tx_pending(struct ath_softc *sc)
                 if (!ATH_TXQ_SETUP(sc, i))
                         continue;
 
-                npend = ath9k_has_pending_frames(sc, &sc->tx.txq[i]);
+                npend = ath9k_has_pending_frames(sc, &sc->tx.txq[i],
+                                                 sw_pending);
                 if (npend)
                         break;
         }
@@ -1981,18 +1973,38 @@ static void ath9k_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                         u32 queues, bool drop)
 {
         struct ath_softc *sc = hw->priv;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
 
+        if (ath9k_is_chanctx_enabled()) {
+                if (!test_bit(ATH_OP_MULTI_CHANNEL, &common->op_flags))
+                        goto flush;
+
+                /*
+                 * If MCC is active, extend the flush timeout
+                 * and wait for the HW/SW queues to become
+                 * empty. This needs to be done outside the
+                 * sc->mutex lock to allow the channel scheduler
+                 * to switch channel contexts.
+                 *
+                 * The vif queues have been stopped in mac80211,
+                 * so there won't be any incoming frames.
+                 */
+                __ath9k_flush(hw, queues, drop, true, true);
+                return;
+        }
+flush:
         mutex_lock(&sc->mutex);
-        __ath9k_flush(hw, queues, drop);
+        __ath9k_flush(hw, queues, drop, true, false);
         mutex_unlock(&sc->mutex);
 }
 
-void __ath9k_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+void __ath9k_flush(struct ieee80211_hw *hw, u32 queues, bool drop,
+                   bool sw_pending, bool timeout_override)
 {
         struct ath_softc *sc = hw->priv;
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
-        int timeout = HZ / 5; /* 200 ms */
+        int timeout;
         bool drain_txq;
 
         cancel_delayed_work_sync(&sc->tx_complete_work);
@@ -2007,7 +2019,17 @@ void __ath9k_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
                 return;
         }
 
-        if (wait_event_timeout(sc->tx_wait, !ath9k_has_tx_pending(sc),
+        spin_lock_bh(&sc->chan_lock);
+        if (timeout_override)
+                timeout = HZ / 5;
+        else
+                timeout = sc->cur_chan->flush_timeout;
+        spin_unlock_bh(&sc->chan_lock);
+
+        ath_dbg(common, CHAN_CTX,
+                "Flush timeout: %d\n", jiffies_to_msecs(timeout));
+
+        if (wait_event_timeout(sc->tx_wait, !ath9k_has_tx_pending(sc, sw_pending),
                                timeout) > 0)
                 drop = false;
 
@@ -2018,7 +2040,7 @@ void __ath9k_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
                 spin_unlock_bh(&sc->sc_pcu_lock);
 
                 if (!drain_txq)
-                        ath_reset(sc);
+                        ath_reset(sc, NULL);
 
                 ath9k_ps_restore(sc);
         }
@@ -2030,7 +2052,7 @@ static bool ath9k_tx_frames_pending(struct ieee80211_hw *hw)
 {
         struct ath_softc *sc = hw->priv;
 
-        return ath9k_has_tx_pending(sc);
+        return ath9k_has_tx_pending(sc, true);
 }
 
 static int ath9k_tx_last_beacon(struct ieee80211_hw *hw)
@@ -2161,14 +2183,17 @@ static int ath9k_get_antenna(struct ieee80211_hw *hw, u32 *tx_ant, u32 *rx_ant)
         return 0;
 }
 
-static void ath9k_sw_scan_start(struct ieee80211_hw *hw)
+static void ath9k_sw_scan_start(struct ieee80211_hw *hw,
+                                struct ieee80211_vif *vif,
+                                const u8 *mac_addr)
 {
         struct ath_softc *sc = hw->priv;
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         set_bit(ATH_OP_SCANNING, &common->op_flags);
 }
 
-static void ath9k_sw_scan_complete(struct ieee80211_hw *hw)
+static void ath9k_sw_scan_complete(struct ieee80211_hw *hw,
+                                   struct ieee80211_vif *vif)
 {
         struct ath_softc *sc = hw->priv;
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
@@ -2177,6 +2202,28 @@ static void ath9k_sw_scan_complete(struct ieee80211_hw *hw)
 
 #ifdef CONFIG_ATH9K_CHANNEL_CONTEXT
 
+static void ath9k_cancel_pending_offchannel(struct ath_softc *sc)
+{
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+
+        if (sc->offchannel.roc_vif) {
+                ath_dbg(common, CHAN_CTX,
+                        "%s: Aborting RoC\n", __func__);
+
+                del_timer_sync(&sc->offchannel.timer);
+                if (sc->offchannel.state >= ATH_OFFCHANNEL_ROC_START)
+                        ath_roc_complete(sc, true);
+        }
+
+        if (test_bit(ATH_OP_SCANNING, &common->op_flags)) {
+                ath_dbg(common, CHAN_CTX,
+                        "%s: Aborting HW scan\n", __func__);
+
+                del_timer_sync(&sc->offchannel.timer);
+                ath_scan_complete(sc, true);
+        }
+}
+
 static int ath9k_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                          struct ieee80211_scan_request *hw_req)
 {
@@ -2307,7 +2354,6 @@ static int ath9k_add_chanctx(struct ieee80211_hw *hw,
                         conf->def.chan->center_freq);
 
                 ath_chanctx_set_channel(sc, ctx, &conf->def);
-                ath_chanctx_event(sc, NULL, ATH_CHANCTX_EVENT_ASSIGN);
 
                 mutex_unlock(&sc->mutex);
                 return 0;
@@ -2332,7 +2378,7 @@ static void ath9k_remove_chanctx(struct ieee80211_hw *hw,
                 conf->def.chan->center_freq);
 
         ctx->assigned = false;
-        ctx->hw_queue_base = -1;
+        ctx->hw_queue_base = 0;
         ath_chanctx_event(sc, NULL, ATH_CHANCTX_EVENT_UNASSIGN);
 
         mutex_unlock(&sc->mutex);
@@ -2364,6 +2410,8 @@ static int ath9k_assign_vif_chanctx(struct ieee80211_hw *hw,
         struct ath_chanctx *ctx = ath_chanctx_get(conf);
         int i;
 
+        ath9k_cancel_pending_offchannel(sc);
+
         mutex_lock(&sc->mutex);
 
         ath_dbg(common, CHAN_CTX,
@@ -2393,6 +2441,8 @@ static void ath9k_unassign_vif_chanctx(struct ieee80211_hw *hw,
         struct ath_chanctx *ctx = ath_chanctx_get(conf);
         int ac;
 
+        ath9k_cancel_pending_offchannel(sc);
+
         mutex_lock(&sc->mutex);
 
         ath_dbg(common, CHAN_CTX,
@@ -2416,7 +2466,11 @@ static void ath9k_mgd_prepare_tx(struct ieee80211_hw *hw,
         struct ath_softc *sc = hw->priv;
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath_vif *avp = (struct ath_vif *) vif->drv_priv;
+        struct ath_beacon_config *cur_conf;
+        struct ath_chanctx *go_ctx;
+        unsigned long timeout;
         bool changed = false;
+        u32 beacon_int;
 
         if (!test_bit(ATH_OP_MULTI_CHANNEL, &common->op_flags))
                 return;
@@ -2427,19 +2481,57 @@ static void ath9k_mgd_prepare_tx(struct ieee80211_hw *hw,
         mutex_lock(&sc->mutex);
 
         spin_lock_bh(&sc->chan_lock);
-        if (sc->next_chan || (sc->cur_chan != avp->chanctx)) {
-                sc->next_chan = avp->chanctx;
+        if (sc->next_chan || (sc->cur_chan != avp->chanctx))
                 changed = true;
+        spin_unlock_bh(&sc->chan_lock);
+
+        if (!changed)
+                goto out;
+
+        ath9k_cancel_pending_offchannel(sc);
+
+        go_ctx = ath_is_go_chanctx_present(sc);
+
+        if (go_ctx) {
+                /*
+                 * Wait till the GO interface gets a chance
+                 * to send out an NoA.
+                 */
+                spin_lock_bh(&sc->chan_lock);
+                sc->sched.mgd_prepare_tx = true;
+                cur_conf = &go_ctx->beacon;
+                beacon_int = TU_TO_USEC(cur_conf->beacon_interval);
+                spin_unlock_bh(&sc->chan_lock);
+
+                timeout = usecs_to_jiffies(beacon_int * 2);
+                init_completion(&sc->go_beacon);
+
+                mutex_unlock(&sc->mutex);
+
+                if (wait_for_completion_timeout(&sc->go_beacon,
+                                                timeout) == 0) {
+                        ath_dbg(common, CHAN_CTX,
+                                "Failed to send new NoA\n");
+
+                        spin_lock_bh(&sc->chan_lock);
+                        sc->sched.mgd_prepare_tx = false;
+                        spin_unlock_bh(&sc->chan_lock);
+                }
+
+                mutex_lock(&sc->mutex);
         }
+
         ath_dbg(common, CHAN_CTX,
-                "%s: Set chanctx state to FORCE_ACTIVE, changed: %d\n",
-                __func__, changed);
+                "%s: Set chanctx state to FORCE_ACTIVE for vif: %pM\n",
+                __func__, vif->addr);
+
+        spin_lock_bh(&sc->chan_lock);
+        sc->next_chan = avp->chanctx;
         sc->sched.state = ATH_CHANCTX_STATE_FORCE_ACTIVE;
         spin_unlock_bh(&sc->chan_lock);
 
-        if (changed)
-                ath_chanctx_set_next(sc, true);
-
+        ath_chanctx_set_next(sc, true);
+out:
         mutex_unlock(&sc->mutex);
 }
 
@@ -2462,6 +2554,24 @@ void ath9k_fill_chanctx_ops(void)
 
 #endif
 
+static int ath9k_get_txpower(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                             int *dbm)
+{
+        struct ath_softc *sc = hw->priv;
+        struct ath_vif *avp = (void *)vif->drv_priv;
+
+        mutex_lock(&sc->mutex);
+        if (avp->chanctx)
+                *dbm = avp->chanctx->cur_txpower;
+        else
+                *dbm = sc->cur_chan->cur_txpower;
+        mutex_unlock(&sc->mutex);
+
+        *dbm /= 2;
+
+        return 0;
+}
+
 struct ieee80211_ops ath9k_ops = {
         .tx                 = ath9k_tx,
         .start              = ath9k_start,
@@ -2471,8 +2581,7 @@ struct ieee80211_ops ath9k_ops = {
         .remove_interface   = ath9k_remove_interface,
         .config             = ath9k_config,
         .configure_filter   = ath9k_configure_filter,
-        .sta_add            = ath9k_sta_add,
-        .sta_remove         = ath9k_sta_remove,
+        .sta_state          = ath9k_sta_state,
         .sta_notify         = ath9k_sta_notify,
         .conf_tx            = ath9k_conf_tx,
         .bss_info_changed   = ath9k_bss_info_changed,
@@ -2509,4 +2618,5 @@ struct ieee80211_ops ath9k_ops = {
 #endif
         .sw_scan_start      = ath9k_sw_scan_start,
         .sw_scan_complete   = ath9k_sw_scan_complete,
+        .get_txpower        = ath9k_get_txpower,
 };
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index c018dea0b2e8..f009b5b57e5e 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -30,6 +30,7 @@ static const struct pci_device_id ath_pci_id_table[] = {
         { PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI   */
         { PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */
 
+#ifdef CONFIG_ATH9K_PCOEM
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x002A,
                          PCI_VENDOR_ID_AZWAVE,
@@ -82,6 +83,7 @@ static const struct pci_device_id ath_pci_id_table[] = {
                          PCI_VENDOR_ID_AZWAVE,
                          0x2C37),
           .driver_data = ATH9K_PCI_BT_ANT_DIV },
+#endif
 
         { PCI_VDEVICE(ATHEROS, 0x002B) }, /* PCI-E */
         { PCI_VDEVICE(ATHEROS, 0x002C) }, /* PCI-E 802.11n bonded out */
@@ -102,6 +104,7 @@ static const struct pci_device_id ath_pci_id_table[] = {
 
         { PCI_VDEVICE(ATHEROS, 0x0030) }, /* PCI-E  AR9300 */
 
+#ifdef CONFIG_ATH9K_PCOEM
         /* PCI-E CUS198 */
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0032,
@@ -294,10 +297,12 @@ static const struct pci_device_id ath_pci_id_table[] = {
                          PCI_VENDOR_ID_ASUSTEK,
                          0x850D),
           .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+#endif
 
         { PCI_VDEVICE(ATHEROS, 0x0032) }, /* PCI-E  AR9485 */
         { PCI_VDEVICE(ATHEROS, 0x0033) }, /* PCI-E  AR9580 */
 
+#ifdef CONFIG_ATH9K_PCOEM
         /* PCI-E CUS217 */
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0034,
@@ -652,11 +657,14 @@ static const struct pci_device_id ath_pci_id_table[] = {
                          0x0036,
                          PCI_VENDOR_ID_DELL,
                          0x020E),
-          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+          .driver_data = ATH9K_PCI_AR9565_2ANT |
+                         ATH9K_PCI_BT_ANT_DIV |
+                         ATH9K_PCI_LED_ACT_HI},
 
         /* PCI-E AR9565 (WB335) */
         { PCI_VDEVICE(ATHEROS, 0x0036),
           .driver_data = ATH9K_PCI_BT_ANT_DIV },
+#endif
 
         { 0 }
 };
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 6914e21816e4..7395afbc5124 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -870,7 +870,7 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
          */
         if (rx_stats->rs_status & ATH9K_RXERR_PHY) {
                 ath9k_dfs_process_phyerr(sc, hdr, rx_stats, rx_status->mactime);
-                if (ath_process_fft(sc, hdr, rx_stats, rx_status->mactime))
+                if (ath_cmn_process_fft(&sc->spec_priv, hdr, rx_stats, rx_status->mactime))
                         RX_STAT_INC(rx_spectral);
 
                 return -EINVAL;
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index 2a938f4feac5..ced36b475acc 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -892,10 +892,21 @@
         (AR_SREV_9330((_ah)) && \
          ((_ah)->hw_version.macRev == AR_SREV_REVISION_9330_12))
 
+#ifdef CONFIG_ATH9K_PCOEM
+#define AR_SREV_9462(_ah) \
+        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9462))
 #define AR_SREV_9485(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9485))
+#define AR_SREV_9565(_ah) \
+        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9565))
+#else
+#define AR_SREV_9462(_ah) 0
+#define AR_SREV_9485(_ah) 0
+#define AR_SREV_9565(_ah) 0
+#endif
+
 #define AR_SREV_9485_11_OR_LATER(_ah) \
-        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9485) && \
+        (AR_SREV_9485(_ah) && \
          ((_ah)->hw_version.macRev >= AR_SREV_REVISION_9485_11))
 #define AR_SREV_9485_OR_LATER(_ah) \
         (((_ah)->hw_version.macVersion >= AR_SREV_VERSION_9485))
@@ -915,34 +926,30 @@
     (AR_SREV_9285_12_OR_LATER(_ah) && \
      ((REG_READ(_ah, AR_AN_SYNTH9) & 0x7) == 0x1))
 
-#define AR_SREV_9462(_ah) \
-        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9462))
 #define AR_SREV_9462_20(_ah) \
-        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9462) && \
+        (AR_SREV_9462(_ah) && \
          ((_ah)->hw_version.macRev == AR_SREV_REVISION_9462_20))
 #define AR_SREV_9462_21(_ah) \
-        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9462) && \
+        (AR_SREV_9462(_ah) && \
          ((_ah)->hw_version.macRev == AR_SREV_REVISION_9462_21))
 #define AR_SREV_9462_20_OR_LATER(_ah) \
-        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9462) && \
+        (AR_SREV_9462(_ah) && \
          ((_ah)->hw_version.macRev >= AR_SREV_REVISION_9462_20))
 #define AR_SREV_9462_21_OR_LATER(_ah) \
-        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9462) && \
+        (AR_SREV_9462(_ah) && \
          ((_ah)->hw_version.macRev >= AR_SREV_REVISION_9462_21))
 
-#define AR_SREV_9565(_ah) \
-        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9565))
 #define AR_SREV_9565_10(_ah) \
-        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9565) && \
+        (AR_SREV_9565(_ah) && \
          ((_ah)->hw_version.macRev == AR_SREV_REVISION_9565_10))
 #define AR_SREV_9565_101(_ah) \
-        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9565) && \
+        (AR_SREV_9565(_ah) && \
          ((_ah)->hw_version.macRev == AR_SREV_REVISION_9565_101))
 #define AR_SREV_9565_11(_ah) \
-        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9565) && \
+        (AR_SREV_9565(_ah) && \
          ((_ah)->hw_version.macRev == AR_SREV_REVISION_9565_11))
 #define AR_SREV_9565_11_OR_LATER(_ah) \
-        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9565) && \
+        (AR_SREV_9565(_ah) && \
          ((_ah)->hw_version.macRev >= AR_SREV_REVISION_9565_11))
 
 #define AR_SREV_9550(_ah) \
@@ -1598,6 +1605,7 @@ enum {
 
 #define AR_RESET_TSF        0x8020
 #define AR_RESET_TSF_ONCE   0x01000000
+#define AR_RESET_TSF2_ONCE  0x02000000
 
 #define AR_MAX_CFP_DUR      0x8038
 #define AR_CFP_VAL          0x0000FFFF
@@ -1959,6 +1967,8 @@ enum {
 #define AR_MAC_PCU_ASYNC_FIFO_REG3_SOFT_RESET           0x80000000
 #define AR_MAC_PCU_GEN_TIMER_TSF_SEL                    0x83d8
 
+#define AR_DIRECT_CONNECT                              0x83a0
+#define AR_DC_AP_STA_EN                                0x00000001
 
 #define AR_AES_MUTE_MASK0       0x805c
 #define AR_AES_MUTE_MASK0_FC    0x0000FFFF
diff --git a/drivers/net/wireless/ath/ath9k/tx99.c b/drivers/net/wireless/ath/ath9k/tx99.c
index 8a69d08ec55c..ac4781f37e78 100644
--- a/drivers/net/wireless/ath/ath9k/tx99.c
+++ b/drivers/net/wireless/ath/ath9k/tx99.c
@@ -54,6 +54,12 @@ static struct sk_buff *ath9k_build_tx99_skb(struct ath_softc *sc)
         struct ieee80211_hdr *hdr;
         struct ieee80211_tx_info *tx_info;
         struct sk_buff *skb;
+        struct ath_vif *avp;
+
+        if (!sc->tx99_vif)
+                return NULL;
+
+        avp = (struct ath_vif *)sc->tx99_vif->drv_priv;
 
         skb = alloc_skb(len, GFP_KERNEL);
         if (!skb)
@@ -71,7 +77,7 @@ static struct sk_buff *ath9k_build_tx99_skb(struct ath_softc *sc)
         memcpy(hdr->addr2, hw->wiphy->perm_addr, ETH_ALEN);
         memcpy(hdr->addr3, hw->wiphy->perm_addr, ETH_ALEN);
 
-        hdr->seq_ctrl |= cpu_to_le16(sc->tx.seq_no);
+        hdr->seq_ctrl |= cpu_to_le16(avp->seq_no);
 
         tx_info = IEEE80211_SKB_CB(skb);
         memset(tx_info, 0, sizeof(*tx_info));
@@ -93,7 +99,7 @@ static struct sk_buff *ath9k_build_tx99_skb(struct ath_softc *sc)
 
 static void ath9k_tx99_deinit(struct ath_softc *sc)
 {
-        ath_reset(sc);
+        ath_reset(sc, NULL);
 
         ath9k_ps_wakeup(sc);
         ath9k_tx99_stop(sc);
@@ -121,7 +127,7 @@ static int ath9k_tx99_init(struct ath_softc *sc)
         memset(&txctl, 0, sizeof(txctl));
         txctl.txq = sc->tx.txq_map[IEEE80211_AC_VO];
 
-        ath_reset(sc);
+        ath_reset(sc, NULL);
 
         ath9k_ps_wakeup(sc);
 
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 151ae49fa57e..d6e54a3c88f6 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -169,7 +169,10 @@ static void ath_txq_skb_done(struct ath_softc *sc, struct ath_txq *txq,
 
         if (txq->stopped &&
             txq->pending_frames < sc->tx.txq_max_pending[q]) {
-                ieee80211_wake_queue(sc->hw, info->hw_queue);
+                if (ath9k_is_chanctx_enabled())
+                        ieee80211_wake_queue(sc->hw, info->hw_queue);
+                else
+                        ieee80211_wake_queue(sc->hw, q);
                 txq->stopped = false;
         }
 }
@@ -2139,6 +2142,28 @@ static struct ath_buf *ath_tx_setup_buffer(struct ath_softc *sc,
         return bf;
 }
 
+void ath_assign_seq(struct ath_common *common, struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_vif *vif = info->control.vif;
+        struct ath_vif *avp;
+
+        if (!(info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ))
+                return;
+
+        if (!vif)
+                return;
+
+        avp = (struct ath_vif *)vif->drv_priv;
+
+        if (info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)
+                avp->seq_no += 0x10;
+
+        hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
+        hdr->seq_ctrl |= cpu_to_le16(avp->seq_no);
+}
+
 static int ath_tx_prepare(struct ieee80211_hw *hw, struct sk_buff *skb,
                           struct ath_tx_control *txctl)
 {
@@ -2162,17 +2187,7 @@ static int ath_tx_prepare(struct ieee80211_hw *hw, struct sk_buff *skb,
         if (info->control.hw_key)
                 frmlen += info->control.hw_key->icv_len;
 
-        /*
-         * As a temporary workaround, assign seq# here; this will likely need
-         * to be cleaned up to work better with Beacon transmission and virtual
-         * BSSes.
-         */
-        if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
-                if (info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)
-                        sc->tx.seq_no += 0x10;
-                hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
-                hdr->seq_ctrl |= cpu_to_le16(sc->tx.seq_no);
-        }
+        ath_assign_seq(ath9k_hw_common(sc->sc_ah), skb);
 
         if ((vif && vif->type != NL80211_IFTYPE_AP &&
                     vif->type != NL80211_IFTYPE_AP_VLAN) ||
@@ -2235,7 +2250,10 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
                 fi->txq = q;
                 if (++txq->pending_frames > sc->tx.txq_max_pending[q] &&
                     !txq->stopped) {
-                        ieee80211_stop_queue(sc->hw, info->hw_queue);
+                        if (ath9k_is_chanctx_enabled())
+                                ieee80211_stop_queue(sc->hw, info->hw_queue);
+                        else
+                                ieee80211_stop_queue(sc->hw, q);
                         txq->stopped = true;
                 }
         }
diff --git a/drivers/net/wireless/ath/carl9170/phy.c b/drivers/net/wireless/ath/carl9170/phy.c
index b80b2138ce3c..dca6df13fd5b 100644
--- a/drivers/net/wireless/ath/carl9170/phy.c
+++ b/drivers/net/wireless/ath/carl9170/phy.c
@@ -994,7 +994,7 @@ static int carl9170_init_rf_bank4_pwr(struct ar9170 *ar, bool band5ghz,
                         refsel0 = 0;
                         refsel1 = 1;
                 }
-                chansel = byte_rev_table[chansel];
+                chansel = bitrev8(chansel);
         } else {
                 if (freq == 2484) {
                         chansel = 10 + (freq - 2274) / 5;
@@ -1002,7 +1002,7 @@ static int carl9170_init_rf_bank4_pwr(struct ar9170 *ar, bool band5ghz,
                 } else
                         chansel = 16 + (freq - 2272) / 5;
                 chansel *= 4;
-                chansel = byte_rev_table[chansel];
+                chansel = bitrev8(chansel);
         }
 
         d1 =    chansel;
diff --git a/drivers/net/wireless/ath/main.c b/drivers/net/wireless/ath/main.c
index 83f47af19280..338d72337604 100644
--- a/drivers/net/wireless/ath/main.c
+++ b/drivers/net/wireless/ath/main.c
@@ -79,13 +79,13 @@ void ath_printk(const char *level, const struct ath_common* common,
         vaf.fmt = fmt;
         vaf.va = &args;
 
-        if (common && common->hw && common->hw->wiphy)
+        if (common && common->hw && common->hw->wiphy) {
                 printk("%sath: %s: %pV",
                        level, wiphy_name(common->hw->wiphy), &vaf);
-        else
+                trace_ath_log(common->hw->wiphy, &vaf);
+        } else {
                 printk("%sath: %pV", level, &vaf);
-
-        trace_ath_log(common->hw->wiphy, &vaf);
+        }
 
         va_end(args);
 }
diff --git a/drivers/net/wireless/ath/regd.c b/drivers/net/wireless/ath/regd.c
index 415393dfb6fc..06ea6cc9e30a 100644
--- a/drivers/net/wireless/ath/regd.c
+++ b/drivers/net/wireless/ath/regd.c
@@ -515,6 +515,7 @@ void ath_reg_notifier_apply(struct wiphy *wiphy,
         if (!request)
                 return;
 
+        reg->region = request->dfs_region;
         switch (request->initiator) {
         case NL80211_REGDOM_SET_BY_CORE:
                 /*
@@ -779,6 +780,19 @@ u32 ath_regd_get_band_ctl(struct ath_regulatory *reg,
                 return SD_NO_CTL;
         }
 
+        if (ath_regd_get_eepromRD(reg) == CTRY_DEFAULT) {
+                switch (reg->region) {
+                case NL80211_DFS_FCC:
+                        return CTL_FCC;
+                case NL80211_DFS_ETSI:
+                        return CTL_ETSI;
+                case NL80211_DFS_JP:
+                        return CTL_MKK;
+                default:
+                        break;
+                }
+        }
+
         switch (band) {
         case IEEE80211_BAND_2GHZ:
                 return reg->regpair->reg_2ghz_ctl;
diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
index b71d2b33532d..267c35d1f699 100644
--- a/drivers/net/wireless/ath/wcn36xx/main.c
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -494,7 +494,9 @@ out:
         return ret;
 }
 
-static void wcn36xx_sw_scan_start(struct ieee80211_hw *hw)
+static void wcn36xx_sw_scan_start(struct ieee80211_hw *hw,
+                                  struct ieee80211_vif *vif,
+                                  const u8 *mac_addr)
 {
         struct wcn36xx *wcn = hw->priv;
 
@@ -502,7 +504,8 @@ static void wcn36xx_sw_scan_start(struct ieee80211_hw *hw)
         wcn36xx_smd_start_scan(wcn);
 }
 
-static void wcn36xx_sw_scan_complete(struct ieee80211_hw *hw)
+static void wcn36xx_sw_scan_complete(struct ieee80211_hw *hw,
+                                     struct ieee80211_vif *vif)
 {
         struct wcn36xx *wcn = hw->priv;
 
diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c
index d9f4b30dd343..0fc0b9f8e605 100644
--- a/drivers/net/wireless/ath/wil6210/cfg80211.c
+++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
@@ -792,12 +792,13 @@ static int wil_cfg80211_stop_ap(struct wiphy *wiphy,
 }
 
 static int wil_cfg80211_del_station(struct wiphy *wiphy,
-                                    struct net_device *dev, const u8 *mac)
+                                    struct net_device *dev,
+                                    struct station_del_parameters *params)
 {
         struct wil6210_priv *wil = wiphy_to_wil(wiphy);
 
         mutex_lock(&wil->mutex);
-        wil6210_disconnect(wil, mac);
+        wil6210_disconnect(wil, params->mac, false);
         mutex_unlock(&wil->mutex);
 
         return 0;
diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c
index 6500caf8d609..6212983fede2 100644
--- a/drivers/net/wireless/ath/wil6210/main.c
+++ b/drivers/net/wireless/ath/wil6210/main.c
@@ -38,6 +38,35 @@ static unsigned int itr_trsh = WIL6210_ITR_TRSH_DEFAULT;
 module_param(itr_trsh, uint, S_IRUGO);
 MODULE_PARM_DESC(itr_trsh, " Interrupt moderation threshold, usecs.");
 
+/* We allow allocation of more than 1 page buffers to support large packets.
+ * It is suboptimal behavior performance wise in case MTU above page size.
+ */
+unsigned int mtu_max = TXRX_BUF_LEN_DEFAULT - ETH_HLEN;
+static int mtu_max_set(const char *val, const struct kernel_param *kp)
+{
+        int ret;
+
+        /* sets mtu_max directly. no need to restore it in case of
+         * illegal value since we assume this will fail insmod
+         */
+        ret = param_set_uint(val, kp);
+        if (ret)
+                return ret;
+
+        if (mtu_max < 68 || mtu_max > IEEE80211_MAX_DATA_LEN_DMG)
+                ret = -EINVAL;
+
+        return ret;
+}
+
+static struct kernel_param_ops mtu_max_ops = {
+        .set = mtu_max_set,
+        .get = param_get_uint,
+};
+
+module_param_cb(mtu_max, &mtu_max_ops, &mtu_max, S_IRUGO);
+MODULE_PARM_DESC(mtu_max, " Max MTU value.");
+
 #define RST_DELAY (20) /* msec, for loop in @wil_target_reset */
 #define RST_COUNT (1 + 1000/RST_DELAY) /* round up to be above 1 sec total */
 
@@ -74,7 +103,8 @@ void wil_memcpy_toio_32(volatile void __iomem *dst, const void *src,
                 __raw_writel(*s++, d++);
 }
 
-static void wil_disconnect_cid(struct wil6210_priv *wil, int cid)
+static void wil_disconnect_cid(struct wil6210_priv *wil, int cid,
+                               bool from_event)
 {
         uint i;
         struct net_device *ndev = wil_to_ndev(wil);
@@ -86,7 +116,10 @@ static void wil_disconnect_cid(struct wil6210_priv *wil, int cid)
 
         sta->data_port_open = false;
         if (sta->status != wil_sta_unused) {
-                wmi_disconnect_sta(wil, sta->addr, WLAN_REASON_DEAUTH_LEAVING);
+                if (!from_event)
+                        wmi_disconnect_sta(wil, sta->addr,
+                                           WLAN_REASON_DEAUTH_LEAVING);
+
                 switch (wdev->iftype) {
                 case NL80211_IFTYPE_AP:
                 case NL80211_IFTYPE_P2P_GO:
@@ -118,7 +151,8 @@ static void wil_disconnect_cid(struct wil6210_priv *wil, int cid)
         memset(&sta->stats, 0, sizeof(sta->stats));
 }
 
-static void _wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid)
+static void _wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid,
+                                bool from_event)
 {
         int cid = -ENOENT;
         struct net_device *ndev = wil_to_ndev(wil);
@@ -133,10 +167,10 @@ static void _wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid)
         }
 
         if (cid >= 0) /* disconnect 1 peer */
-                wil_disconnect_cid(wil, cid);
+                wil_disconnect_cid(wil, cid, from_event);
         else /* disconnect all */
                 for (cid = 0; cid < WIL6210_MAX_CID; cid++)
-                        wil_disconnect_cid(wil, cid);
+                        wil_disconnect_cid(wil, cid, from_event);
 
         /* link state */
         switch (wdev->iftype) {
@@ -166,7 +200,7 @@ static void wil_disconnect_worker(struct work_struct *work)
                         struct wil6210_priv, disconnect_worker);
 
         mutex_lock(&wil->mutex);
-        _wil6210_disconnect(wil, NULL);
+        _wil6210_disconnect(wil, NULL, false);
         mutex_unlock(&wil->mutex);
 }
 
@@ -223,6 +257,11 @@ static void wil_fw_error_worker(struct work_struct *work)
 
         wil_dbg_misc(wil, "fw error worker\n");
 
+        if (!netif_running(wil_to_ndev(wil))) {
+                wil_info(wil, "No recovery - interface is down\n");
+                return;
+        }
+
         /* increment @recovery_count if less then WIL6210_FW_RECOVERY_TO
          * passed since last recovery attempt
          */
@@ -257,9 +296,12 @@ static void wil_fw_error_worker(struct work_struct *work)
                 break;
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_P2P_GO:
+                wil_info(wil, "No recovery for AP-like interface\n");
                 /* recovery in these modes is done by upper layers */
                 break;
         default:
+                wil_err(wil, "No recovery - unknown interface type %d\n",
+                        wdev->iftype);
                 break;
         }
         mutex_unlock(&wil->mutex);
@@ -346,12 +388,22 @@ int wil_priv_init(struct wil6210_priv *wil)
         return 0;
 }
 
-void wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid)
+/**
+ * wil6210_disconnect - disconnect one connection
+ * @wil: driver context
+ * @bssid: peer to disconnect, NULL to disconnect all
+ * @from_event: whether is invoked from FW event handler
+ *
+ * Disconnect and release associated resources. If invoked not from the
+ * FW event handler, issue WMI command(s) to trigger MAC disconnect.
+ */
+void wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid,
+                        bool from_event)
 {
         wil_dbg_misc(wil, "%s()\n", __func__);
 
         del_timer_sync(&wil->connect_timer);
-        _wil6210_disconnect(wil, bssid);
+        _wil6210_disconnect(wil, bssid, from_event);
 }
 
 void wil_priv_deinit(struct wil6210_priv *wil)
@@ -363,7 +415,7 @@ void wil_priv_deinit(struct wil6210_priv *wil)
         cancel_work_sync(&wil->disconnect_worker);
         cancel_work_sync(&wil->fw_error_worker);
         mutex_lock(&wil->mutex);
-        wil6210_disconnect(wil, NULL);
+        wil6210_disconnect(wil, NULL, false);
         mutex_unlock(&wil->mutex);
         wmi_event_flush(wil);
         destroy_workqueue(wil->wmi_wq_conn);
@@ -395,7 +447,7 @@ static inline void wil_release_cpu(struct wil6210_priv *wil)
 static int wil_target_reset(struct wil6210_priv *wil)
 {
         int delay = 0;
-        u32 hw_state;
+        u32 x;
         u32 rev_id;
         bool is_sparrow = (wil->board->board == WIL_BOARD_SPARROW);
 
@@ -410,9 +462,22 @@ static int wil_target_reset(struct wil6210_priv *wil)
         S(RGF_USER_CLKS_CTL_SW_RST_MASK_0, BIT_CAR_PERST_RST);
 
         wil_halt_cpu(wil);
-        C(RGF_USER_CLKS_CTL_0, BIT_USER_CLKS_CAR_AHB_SW_SEL); /* 40 MHz */
 
         if (is_sparrow) {
+                S(RGF_CAF_OSC_CONTROL, BIT_CAF_OSC_XTAL_EN);
+                /* XTAL stabilization should take about 3ms */
+                usleep_range(5000, 7000);
+                x = R(RGF_CAF_PLL_LOCK_STATUS);
+                if (!(x & BIT_CAF_OSC_DIG_XTAL_STABLE)) {
+                        wil_err(wil, "Xtal stabilization timeout\n"
+                                "RGF_CAF_PLL_LOCK_STATUS = 0x%08x\n", x);
+                        return -ETIME;
+                }
+                /* switch 10k to XTAL*/
+                C(RGF_USER_SPARROW_M_4, BIT_SPARROW_M_4_SEL_SLEEP_OR_REF);
+                /* 40 MHz */
+                C(RGF_USER_CLKS_CTL_0, BIT_USER_CLKS_CAR_AHB_SW_SEL);
+
                 W(RGF_USER_CLKS_CTL_EXT_SW_RST_VEC_0, 0x3ff81f);
                 W(RGF_USER_CLKS_CTL_EXT_SW_RST_VEC_1, 0xf);
         }
@@ -453,13 +518,13 @@ static int wil_target_reset(struct wil6210_priv *wil)
         /* wait until device ready. typical time is 200..250 msec */
         do {
                 msleep(RST_DELAY);
-                hw_state = R(RGF_USER_HW_MACHINE_STATE);
+                x = R(RGF_USER_HW_MACHINE_STATE);
                 if (delay++ > RST_COUNT) {
                         wil_err(wil, "Reset not completed, hw_state 0x%08x\n",
-                                hw_state);
+                                x);
                         return -ETIME;
                 }
-        } while (hw_state != HW_MACHINE_BOOT_DONE);
+        } while (x != HW_MACHINE_BOOT_DONE);
 
         /* TODO: Erez check rev_id != 1 */
         if (!is_sparrow && (rev_id != 1))
@@ -535,7 +600,7 @@ int wil_reset(struct wil6210_priv *wil)
         WARN_ON(test_bit(wil_status_napi_en, &wil->status));
 
         cancel_work_sync(&wil->disconnect_worker);
-        wil6210_disconnect(wil, NULL);
+        wil6210_disconnect(wil, NULL, false);
 
         wil->status = 0; /* prevent NAPI from being scheduled */
 
diff --git a/drivers/net/wireless/ath/wil6210/netdev.c b/drivers/net/wireless/ath/wil6210/netdev.c
index 239965106c05..e81703ca7701 100644
--- a/drivers/net/wireless/ath/wil6210/netdev.c
+++ b/drivers/net/wireless/ath/wil6210/netdev.c
@@ -41,7 +41,7 @@ static int wil_change_mtu(struct net_device *ndev, int new_mtu)
 {
         struct wil6210_priv *wil = ndev_to_wil(ndev);
 
-        if (new_mtu < 68 || new_mtu > (TX_BUF_LEN - ETH_HLEN)) {
+        if (new_mtu < 68 || new_mtu > mtu_max) {
                 wil_err(wil, "invalid MTU %d\n", new_mtu);
                 return -EINVAL;
         }
diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
index 2936ef0c18cb..c680906bc0dc 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.c
+++ b/drivers/net/wireless/ath/wil6210/txrx.c
@@ -206,7 +206,7 @@ static int wil_vring_alloc_skb(struct wil6210_priv *wil, struct vring *vring,
                                u32 i, int headroom)
 {
         struct device *dev = wil_to_dev(wil);
-        unsigned int sz = RX_BUF_LEN;
+        unsigned int sz = mtu_max + ETH_HLEN;
         struct vring_rx_desc dd, *d = &dd;
         volatile struct vring_rx_desc *_d = &vring->va[i].rx;
         dma_addr_t pa;
@@ -385,7 +385,7 @@ static struct sk_buff *wil_vring_reap_rx(struct wil6210_priv *wil,
         struct vring_rx_desc *d;
         struct sk_buff *skb;
         dma_addr_t pa;
-        unsigned int sz = RX_BUF_LEN;
+        unsigned int sz = mtu_max + ETH_HLEN;
         u16 dmalen;
         u8 ftype;
         u8 ds_bits;
@@ -646,7 +646,8 @@ int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
                 .action = cpu_to_le32(WMI_VRING_CMD_ADD),
                 .vring_cfg = {
                         .tx_sw_ring = {
-                                .max_mpdu_size = cpu_to_le16(TX_BUF_LEN),
+                                .max_mpdu_size =
+                                        cpu_to_le16(mtu_max + ETH_HLEN),
                                 .ring_size = cpu_to_le16(size),
                         },
                         .ringid = id,
diff --git a/drivers/net/wireless/ath/wil6210/txrx.h b/drivers/net/wireless/ath/wil6210/txrx.h
index de046716d2b7..630aeb5fa7f4 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.h
+++ b/drivers/net/wireless/ath/wil6210/txrx.h
@@ -21,8 +21,8 @@
 #define BUF_HW_OWNED    (0)
 
 /* size of max. Tx/Rx buffers, as supported by FW */
-#define RX_BUF_LEN      (2242)
-#define TX_BUF_LEN      (2242)
+#define TXRX_BUF_LEN_DEFAULT (2242)
+
 /* how many bytes to reserve for rtap header? */
 #define WIL6210_RTAP_SIZE (128)
 
diff --git a/drivers/net/wireless/ath/wil6210/wil6210.h b/drivers/net/wireless/ath/wil6210/wil6210.h
index ce6488e42091..95d3a062d35c 100644
--- a/drivers/net/wireless/ath/wil6210/wil6210.h
+++ b/drivers/net/wireless/ath/wil6210/wil6210.h
@@ -24,6 +24,7 @@
 #include "wil_platform.h"
 
 extern bool no_fw_recovery;
+extern unsigned int mtu_max;
 
 #define WIL_NAME "wil6210"
 #define WIL_FW_NAME "wil6210.fw"
@@ -117,6 +118,8 @@ struct RGF_ICR {
         #define BIT_USER_USER_ICR_SW_INT_2      BIT(18)
 #define RGF_USER_CLKS_CTL_EXT_SW_RST_VEC_0      (0x880c18)
 #define RGF_USER_CLKS_CTL_EXT_SW_RST_VEC_1      (0x880c2c)
+#define RGF_USER_SPARROW_M_4                    (0x880c50) /* Sparrow */
+        #define BIT_SPARROW_M_4_SEL_SLEEP_OR_REF        BIT(2)
 
 #define RGF_DMA_EP_TX_ICR               (0x881bb4) /* struct RGF_ICR */
         #define BIT_DMA_EP_TX_ICR_TX_DONE       BIT(0)
@@ -152,6 +155,10 @@ struct RGF_ICR {
 #define RGF_MAC_MTRL_COUNTER_0          (0x886aa8)
 
 #define RGF_CAF_ICR                     (0x88946c) /* struct RGF_ICR */
+#define RGF_CAF_OSC_CONTROL             (0x88afa4)
+        #define BIT_CAF_OSC_XTAL_EN             BIT(0)
+#define RGF_CAF_PLL_LOCK_STATUS         (0x88afec)
+        #define BIT_CAF_OSC_DIG_XTAL_STABLE     BIT(0)
 
 /* popular locations */
 #define HOST_MBOX   HOSTADDR(RGF_USER_USER_SCRATCH_PAD)
@@ -463,8 +470,11 @@ struct wil6210_priv {
 #define ndev_to_wil(n) (wdev_to_wil(n->ieee80211_ptr))
 #define wil_to_pcie_dev(i) (&i->pdev->dev)
 
+__printf(2, 3)
 void wil_dbg_trace(struct wil6210_priv *wil, const char *fmt, ...);
+__printf(2, 3)
 void wil_err(struct wil6210_priv *wil, const char *fmt, ...);
+__printf(2, 3)
 void wil_info(struct wil6210_priv *wil, const char *fmt, ...);
 #define wil_dbg(wil, fmt, arg...) do { \
         netdev_dbg(wil_to_ndev(wil), fmt, ##arg); \
@@ -575,7 +585,8 @@ void wil_wdev_free(struct wil6210_priv *wil);
 int wmi_set_mac_address(struct wil6210_priv *wil, void *addr);
 int wmi_pcp_start(struct wil6210_priv *wil, int bi, u8 wmi_nettype, u8 chan);
 int wmi_pcp_stop(struct wil6210_priv *wil);
-void wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid);
+void wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid,
+                        bool from_event);
 
 int wil_rx_init(struct wil6210_priv *wil);
 void wil_rx_fini(struct wil6210_priv *wil);
diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
index 4311df982c60..bb1e066f756a 100644
--- a/drivers/net/wireless/ath/wil6210/wmi.c
+++ b/drivers/net/wireless/ath/wil6210/wmi.c
@@ -486,7 +486,7 @@ static void wmi_evt_disconnect(struct wil6210_priv *wil, int id,
         wil->sinfo_gen++;
 
         mutex_lock(&wil->mutex);
-        wil6210_disconnect(wil, evt->bssid);
+        wil6210_disconnect(wil, evt->bssid, true);
         mutex_unlock(&wil->mutex);
 }
 
@@ -1025,7 +1025,7 @@ int wmi_rx_chain_add(struct wil6210_priv *wil, struct vring *vring)
         struct wmi_cfg_rx_chain_cmd cmd = {
                 .action = WMI_RX_CHAIN_ADD,
                 .rx_sw_ring = {
-                        .max_mpdu_size = cpu_to_le16(RX_BUF_LEN),
+                        .max_mpdu_size = cpu_to_le16(mtu_max + ETH_HLEN),
                         .ring_mem_base = cpu_to_le64(vring->pa),
                         .ring_size = cpu_to_le16(vring->size),
                 },
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 5d4173ee55bc..47731cb0d815 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -5110,7 +5110,9 @@ static void b43_op_sta_notify(struct ieee80211_hw *hw,
         B43_WARN_ON(!vif || wl->vif != vif);
 }
 
-static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw)
+static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw,
+                                          struct ieee80211_vif *vif,
+                                          const u8 *mac_addr)
 {
         struct b43_wl *wl = hw_to_b43_wl(hw);
         struct b43_wldev *dev;
@@ -5124,7 +5126,8 @@ static void b43_op_sw_scan_start_notifier(struct ieee80211_hw *hw)
         mutex_unlock(&wl->mutex);
 }
 
-static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw)
+static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw,
+                                             struct ieee80211_vif *vif)
 {
         struct b43_wl *wl = hw_to_b43_wl(hw);
         struct b43_wldev *dev;
diff --git a/drivers/net/wireless/b43/phy_common.c b/drivers/net/wireless/b43/phy_common.c
index 1dfc682a8055..ee27b06074e1 100644
--- a/drivers/net/wireless/b43/phy_common.c
+++ b/drivers/net/wireless/b43/phy_common.c
@@ -300,9 +300,7 @@ void b43_phy_write(struct b43_wldev *dev, u16 reg, u16 value)
 
 void b43_phy_copy(struct b43_wldev *dev, u16 destreg, u16 srcreg)
 {
-        assert_mac_suspended(dev);
-        dev->phy.ops->phy_write(dev, destreg,
-                dev->phy.ops->phy_read(dev, srcreg));
+        b43_phy_write(dev, destreg, b43_phy_read(dev, srcreg));
 }
 
 void b43_phy_mask(struct b43_wldev *dev, u16 offset, u16 mask)
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/Makefile b/drivers/net/wireless/brcm80211/brcmfmac/Makefile
index 90a977fe9a64..dc4c75083085 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/Makefile
+++ b/drivers/net/wireless/brcm80211/brcmfmac/Makefile
@@ -23,15 +23,15 @@ ccflags-y += -D__CHECK_ENDIAN__
 
 obj-$(CONFIG_BRCMFMAC) += brcmfmac.o
 brcmfmac-objs += \
-                wl_cfg80211.o \
+                cfg80211.o \
                 chip.o \
                 fwil.o \
                 fweh.o \
                 fwsignal.o \
                 p2p.o \
                 proto.o \
-                dhd_common.o \
-                dhd_linux.o \
+                common.o \
+                core.o \
                 firmware.o \
                 feature.o \
                 btcoex.o \
@@ -43,14 +43,14 @@ brcmfmac-$(CONFIG_BRCMFMAC_PROTO_MSGBUF) += \
                 flowring.o \
                 msgbuf.o
 brcmfmac-$(CONFIG_BRCMFMAC_SDIO) += \
-                dhd_sdio.o \
+                sdio.o \
                 bcmsdh.o
 brcmfmac-$(CONFIG_BRCMFMAC_USB) += \
                 usb.o
 brcmfmac-$(CONFIG_BRCMFMAC_PCIE) += \
                 pcie.o
 brcmfmac-$(CONFIG_BRCMDBG) += \
-                dhd_dbg.o
+                debug.o
 brcmfmac-$(CONFIG_BRCM_TRACING) += \
                 tracepoint.o
 brcmfmac-$(CONFIG_OF) += \
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c b/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c
index a159ff3427de..8e0e91c4a0b1 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c
@@ -25,10 +25,10 @@
 #include <brcmu_utils.h>
 #include <brcmu_wifi.h>
 
-#include "dhd.h"
-#include "dhd_bus.h"
+#include "core.h"
+#include "bus.h"
 #include "fwsignal.h"
-#include "dhd_dbg.h"
+#include "debug.h"
 #include "tracepoint.h"
 #include "proto.h"
 #include "bcdc.h"
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
index 8dbd5dbb78fd..f754ffcd0308 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
@@ -41,9 +41,9 @@
 #include <chipcommon.h>
 #include <soc.h>
 #include "chip.h"
-#include "dhd_bus.h"
-#include "dhd_dbg.h"
-#include "sdio_host.h"
+#include "bus.h"
+#include "debug.h"
+#include "sdio.h"
 #include "of.h"
 
 #define SDIOH_API_ACCESS_RETRY_LIMIT    2
@@ -1064,6 +1064,16 @@ static int brcmf_ops_sdio_probe(struct sdio_func *func,
         if (!sdiodev->pdata)
                 brcmf_of_probe(sdiodev);
 
+#ifdef CONFIG_PM_SLEEP
+        /* wowl can be supported when KEEP_POWER is true and (WAKE_SDIO_IRQ
+         * is true or when platform data OOB irq is true).
+         */
+        if ((sdio_get_host_pm_caps(sdiodev->func[1]) & MMC_PM_KEEP_POWER) &&
+            ((sdio_get_host_pm_caps(sdiodev->func[1]) & MMC_PM_WAKE_SDIO_IRQ) ||
+             (sdiodev->pdata->oob_irq_supported)))
+                bus_if->wowl_supported = true;
+#endif
+
         atomic_set(&sdiodev->suspend, false);
         init_waitqueue_head(&sdiodev->request_word_wait);
         init_waitqueue_head(&sdiodev->request_buffer_wait);
@@ -1116,34 +1126,39 @@ static void brcmf_ops_sdio_remove(struct sdio_func *func)
         brcmf_dbg(SDIO, "Exit\n");
 }
 
+void brcmf_sdio_wowl_config(struct device *dev, bool enabled)
+{
+        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+        struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
+
+        brcmf_dbg(SDIO, "Configuring WOWL, enabled=%d\n", enabled);
+        sdiodev->wowl_enabled = enabled;
+}
+
 #ifdef CONFIG_PM_SLEEP
 static int brcmf_ops_sdio_suspend(struct device *dev)
 {
-        mmc_pm_flag_t sdio_flags;
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
-        int ret = 0;
+        mmc_pm_flag_t sdio_flags;
 
         brcmf_dbg(SDIO, "Enter\n");
 
-        sdio_flags = sdio_get_host_pm_caps(sdiodev->func[1]);
-        if (!(sdio_flags & MMC_PM_KEEP_POWER)) {
-                brcmf_err("Host can't keep power while suspended\n");
-                return -EINVAL;
-        }
-
         atomic_set(&sdiodev->suspend, true);
 
-        ret = sdio_set_host_pm_flags(sdiodev->func[1], MMC_PM_KEEP_POWER);
-        if (ret) {
-                brcmf_err("Failed to set pm_flags\n");
-                atomic_set(&sdiodev->suspend, false);
-                return ret;
+        if (sdiodev->wowl_enabled) {
+                sdio_flags = MMC_PM_KEEP_POWER;
+                if (sdiodev->pdata->oob_irq_supported)
+                        enable_irq_wake(sdiodev->pdata->oob_irq_nr);
+                else
+                        sdio_flags = MMC_PM_WAKE_SDIO_IRQ;
+                if (sdio_set_host_pm_flags(sdiodev->func[1], sdio_flags))
+                        brcmf_err("Failed to set pm_flags %x\n", sdio_flags);
         }
 
         brcmf_sdio_wd_timer(sdiodev->bus, 0);
 
-        return ret;
+        return 0;
 }
 
 static int brcmf_ops_sdio_resume(struct device *dev)
@@ -1152,6 +1167,8 @@ static int brcmf_ops_sdio_resume(struct device *dev)
         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
 
         brcmf_dbg(SDIO, "Enter\n");
+        if (sdiodev->pdata->oob_irq_supported)
+                disable_irq_wake(sdiodev->pdata->oob_irq_nr);
         brcmf_sdio_wd_timer(sdiodev->bus, BRCMF_WD_POLL_MS);
         atomic_set(&sdiodev->suspend, false);
         return 0;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/btcoex.c b/drivers/net/wireless/brcm80211/brcmfmac/btcoex.c
index a29ac4977b3a..0445163991b7 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/btcoex.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/btcoex.c
@@ -20,13 +20,13 @@
 #include <brcmu_wifi.h>
 #include <brcmu_utils.h>
 #include <defs.h>
-#include <dhd.h>
-#include <dhd_dbg.h>
+#include "core.h"
+#include "debug.h"
 #include "fwil.h"
 #include "fwil_types.h"
 #include "btcoex.h"
 #include "p2p.h"
-#include "wl_cfg80211.h"
+#include "cfg80211.h"
 
 /* T1 start SCO/eSCO priority suppression */
 #define BRCMF_BTCOEX_OPPR_WIN_TIME   2000
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h b/drivers/net/wireless/brcm80211/brcmfmac/bus.h
index 80e73a1262be..ef344e47218a 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bus.h
@@ -14,10 +14,10 @@
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#ifndef _BRCMF_BUS_H_
-#define _BRCMF_BUS_H_
+#ifndef BRCMFMAC_BUS_H
+#define BRCMFMAC_BUS_H
 
-#include "dhd_dbg.h"
+#include "debug.h"
 
 /* IDs of the 6 default common rings of msgbuf protocol */
 #define BRCMF_H2D_MSGRING_CONTROL_SUBMIT        0
@@ -227,8 +227,7 @@ void brcmf_txflowblock(struct device *dev, bool state);
 void brcmf_txcomplete(struct device *dev, struct sk_buff *txp, bool success);
 
 int brcmf_bus_start(struct device *dev);
-s32 brcmf_iovar_data_set(struct device *dev, char *name, void *data,
-                                u32 len);
+s32 brcmf_iovar_data_set(struct device *dev, char *name, void *data, u32 len);
 void brcmf_bus_add_txhdrlen(struct device *dev, uint len);
 
 #ifdef CONFIG_BRCMFMAC_SDIO
@@ -241,4 +240,4 @@ void brcmf_usb_exit(void);
 void brcmf_usb_register(void);
 #endif
 
-#endif                          /* _BRCMF_BUS_H_ */
+#endif /* BRCMFMAC_BUS_H */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
index 28fa25b509db..f8a9dfa657ba 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
@@ -26,18 +26,18 @@
 #include <brcmu_utils.h>
 #include <defs.h>
 #include <brcmu_wifi.h>
-#include "dhd.h"
-#include "dhd_dbg.h"
+#include "core.h"
+#include "debug.h"
 #include "tracepoint.h"
 #include "fwil_types.h"
 #include "p2p.h"
 #include "btcoex.h"
-#include "wl_cfg80211.h"
+#include "cfg80211.h"
 #include "feature.h"
 #include "fwil.h"
 #include "proto.h"
 #include "vendor.h"
-#include "dhd_bus.h"
+#include "bus.h"
 
 #define BRCMF_SCAN_IE_LEN_MAX           2048
 #define BRCMF_PNO_VERSION               2
@@ -299,6 +299,7 @@ static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
         primary_offset = ch->center_freq1 - ch->chan->center_freq;
         switch (ch->width) {
         case NL80211_CHAN_WIDTH_20:
+        case NL80211_CHAN_WIDTH_20_NOHT:
                 ch_inf.bw = BRCMU_CHAN_BW_20;
                 WARN_ON(primary_offset != 0);
                 break;
@@ -323,6 +324,10 @@ static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
                                 ch_inf.sb = BRCMU_CHAN_SB_LU;
                 }
                 break;
+        case NL80211_CHAN_WIDTH_80P80:
+        case NL80211_CHAN_WIDTH_160:
+        case NL80211_CHAN_WIDTH_5:
+        case NL80211_CHAN_WIDTH_10:
         default:
                 WARN_ON_ONCE(1);
         }
@@ -333,6 +338,7 @@ static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
         case IEEE80211_BAND_5GHZ:
                 ch_inf.band = BRCMU_CHAN_BAND_5G;
                 break;
+        case IEEE80211_BAND_60GHZ:
         default:
                 WARN_ON_ONCE(1);
         }
@@ -2779,6 +2785,44 @@ static __always_inline void brcmf_delay(u32 ms)
         }
 }
 
+static s32 brcmf_config_wowl_pattern(struct brcmf_if *ifp, u8 cmd[4],
+                                     u8 *pattern, u32 patternsize, u8 *mask,
+                                     u32 packet_offset)
+{
+        struct brcmf_fil_wowl_pattern_le *filter;
+        u32 masksize;
+        u32 patternoffset;
+        u8 *buf;
+        u32 bufsize;
+        s32 ret;
+
+        masksize = (patternsize + 7) / 8;
+        patternoffset = sizeof(*filter) - sizeof(filter->cmd) + masksize;
+
+        bufsize = sizeof(*filter) + patternsize + masksize;
+        buf = kzalloc(bufsize, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+        filter = (struct brcmf_fil_wowl_pattern_le *)buf;
+
+        memcpy(filter->cmd, cmd, 4);
+        filter->masksize = cpu_to_le32(masksize);
+        filter->offset = cpu_to_le32(packet_offset);
+        filter->patternoffset = cpu_to_le32(patternoffset);
+        filter->patternsize = cpu_to_le32(patternsize);
+        filter->type = cpu_to_le32(BRCMF_WOWL_PATTERN_TYPE_BITMAP);
+
+        if ((mask) && (masksize))
+                memcpy(buf + sizeof(*filter), mask, masksize);
+        if ((pattern) && (patternsize))
+                memcpy(buf + sizeof(*filter) + masksize, pattern, patternsize);
+
+        ret = brcmf_fil_iovar_data_set(ifp, "wowl_pattern", buf, bufsize);
+
+        kfree(buf);
+        return ret;
+}
+
 static s32 brcmf_cfg80211_resume(struct wiphy *wiphy)
 {
         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
@@ -2788,10 +2832,11 @@ static s32 brcmf_cfg80211_resume(struct wiphy *wiphy)
         brcmf_dbg(TRACE, "Enter\n");
 
         if (cfg->wowl_enabled) {
+                brcmf_configure_arp_offload(ifp, true);
                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM,
                                       cfg->pre_wowl_pmmode);
-                brcmf_fil_iovar_data_set(ifp, "wowl_pattern", "clr", 4);
                 brcmf_fil_iovar_int_set(ifp, "wowl_clear", 0);
+                brcmf_config_wowl_pattern(ifp, "clr", NULL, 0, NULL, 0);
                 cfg->wowl_enabled = false;
         }
         return 0;
@@ -2802,21 +2847,29 @@ static void brcmf_configure_wowl(struct brcmf_cfg80211_info *cfg,
                                  struct cfg80211_wowlan *wowl)
 {
         u32 wowl_config;
+        u32 i;
 
         brcmf_dbg(TRACE, "Suspend, wowl config.\n");
 
+        brcmf_configure_arp_offload(ifp, false);
         brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PM, &cfg->pre_wowl_pmmode);
         brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, PM_MAX);
 
         wowl_config = 0;
         if (wowl->disconnect)
-                wowl_config |= WL_WOWL_DIS | WL_WOWL_BCN | WL_WOWL_RETR;
-                /* Note: if "wowl" target and not "wowlpf" then wowl_bcn_loss
-                 * should be configured. This paramater is not supported by
-                 * wowlpf.
-                 */
+                wowl_config = BRCMF_WOWL_DIS | BRCMF_WOWL_BCN | BRCMF_WOWL_RETR;
         if (wowl->magic_pkt)
-                wowl_config |= WL_WOWL_MAGIC;
+                wowl_config |= BRCMF_WOWL_MAGIC;
+        if ((wowl->patterns) && (wowl->n_patterns)) {
+                wowl_config |= BRCMF_WOWL_NET;
+                for (i = 0; i < wowl->n_patterns; i++) {
+                        brcmf_config_wowl_pattern(ifp, "add",
+                                (u8 *)wowl->patterns[i].pattern,
+                                wowl->patterns[i].pattern_len,
+                                (u8 *)wowl->patterns[i].mask,
+                                wowl->patterns[i].pkt_offset);
+                }
+        }
         brcmf_fil_iovar_int_set(ifp, "wowl", wowl_config);
         brcmf_fil_iovar_int_set(ifp, "wowl_activate", 1);
         brcmf_bus_wowl_config(cfg->pub->bus_if, true);
@@ -3998,24 +4051,24 @@ brcmf_cfg80211_change_beacon(struct wiphy *wiphy, struct net_device *ndev,
 
 static int
 brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
-                           const u8 *mac)
+                           struct station_del_parameters *params)
 {
         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
         struct brcmf_scb_val_le scbval;
         struct brcmf_if *ifp = netdev_priv(ndev);
         s32 err;
 
-        if (!mac)
+        if (!params->mac)
                 return -EFAULT;
 
-        brcmf_dbg(TRACE, "Enter %pM\n", mac);
+        brcmf_dbg(TRACE, "Enter %pM\n", params->mac);
 
         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
                 ifp = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
         if (!check_vif_up(ifp->vif))
                 return -EIO;
 
-        memcpy(&scbval.ea, mac, ETH_ALEN);
+        memcpy(&scbval.ea, params->mac, ETH_ALEN);
         scbval.val = cpu_to_le32(WLAN_REASON_DEAUTH_LEAVING);
         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON,
                                      &scbval, sizeof(scbval));
@@ -5440,10 +5493,13 @@ static void brcmf_wiphy_pno_params(struct wiphy *wiphy)
         wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
 }
 
-
 #ifdef CONFIG_PM
 static const struct wiphy_wowlan_support brcmf_wowlan_support = {
         .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
+        .n_patterns = BRCMF_WOWL_MAXPATTERNS,
+        .pattern_max_len = BRCMF_WOWL_MAXPATTERNSIZE,
+        .pattern_min_len = 1,
+        .max_pkt_offset = 1500,
 };
 #endif
 
@@ -5607,7 +5663,8 @@ enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp)
         return wdev->iftype;
 }
 
-bool brcmf_get_vif_state_any(struct brcmf_cfg80211_info *cfg, unsigned long state)
+bool brcmf_get_vif_state_any(struct brcmf_cfg80211_info *cfg,
+                             unsigned long state)
 {
         struct brcmf_cfg80211_vif *vif;
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.h
index 6abf94e41d3d..2a5b22cb3fef 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.h
@@ -14,8 +14,8 @@
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#ifndef _wl_cfg80211_h_
-#define _wl_cfg80211_h_
+#ifndef BRCMFMAC_CFG80211_H
+#define BRCMFMAC_CFG80211_H
 
 /* for brcmu_d11inf */
 #include <brcmu_d11.h>
@@ -480,7 +480,8 @@ const struct brcmf_tlv *
 brcmf_parse_tlvs(const void *buf, int buflen, uint key);
 u16 channel_to_chanspec(struct brcmu_d11inf *d11inf,
                         struct ieee80211_channel *ch);
-bool brcmf_get_vif_state_any(struct brcmf_cfg80211_info *cfg, unsigned long state);
+bool brcmf_get_vif_state_any(struct brcmf_cfg80211_info *cfg,
+                             unsigned long state);
 void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
                                   struct brcmf_cfg80211_vif *vif);
 bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg);
@@ -493,4 +494,4 @@ void brcmf_set_mpc(struct brcmf_if *ndev, int mpc);
 void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg);
 void brcmf_cfg80211_free_netdev(struct net_device *ndev);
 
-#endif                          /* _wl_cfg80211_h_ */
+#endif /* BRCMFMAC_CFG80211_H */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/chip.c b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
index 95efde868db8..ddae0b5e56ec 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/chip.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
@@ -25,7 +25,7 @@
 #include <brcm_hw_ids.h>
 #include <brcmu_utils.h>
 #include <chipcommon.h>
-#include "dhd_dbg.h"
+#include "debug.h"
 #include "chip.h"
 
 /* SOC Interconnect types (aka chip types) */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/common.c b/drivers/net/wireless/brcm80211/brcmfmac/common.c
new file mode 100644
index 000000000000..1861a13e8d03
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/brcmfmac/common.c
@@ -0,0 +1,168 @@
+/*
+ * Copyright (c) 2010 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/netdevice.h>
+#include <brcmu_wifi.h>
+#include <brcmu_utils.h>
+#include "core.h"
+#include "bus.h"
+#include "debug.h"
+#include "fwil.h"
+#include "fwil_types.h"
+#include "tracepoint.h"
+
+#define BRCMF_DEFAULT_BCN_TIMEOUT       3
+#define BRCMF_DEFAULT_SCAN_CHANNEL_TIME 40
+#define BRCMF_DEFAULT_SCAN_UNASSOC_TIME 40
+
+/* boost value for RSSI_DELTA in preferred join selection */
+#define BRCMF_JOIN_PREF_RSSI_BOOST      8
+
+int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
+{
+        s8 eventmask[BRCMF_EVENTING_MASK_LEN];
+        u8 buf[BRCMF_DCMD_SMLEN];
+        struct brcmf_join_pref_params join_pref_params[2];
+        char *ptr;
+        s32 err;
+
+        /* retreive mac address */
+        err = brcmf_fil_iovar_data_get(ifp, "cur_etheraddr", ifp->mac_addr,
+                                       sizeof(ifp->mac_addr));
+        if (err < 0) {
+                brcmf_err("Retreiving cur_etheraddr failed, %d\n",
+                          err);
+                goto done;
+        }
+        memcpy(ifp->drvr->mac, ifp->mac_addr, sizeof(ifp->drvr->mac));
+
+        /* query for 'ver' to get version info from firmware */
+        memset(buf, 0, sizeof(buf));
+        strcpy(buf, "ver");
+        err = brcmf_fil_iovar_data_get(ifp, "ver", buf, sizeof(buf));
+        if (err < 0) {
+                brcmf_err("Retreiving version information failed, %d\n",
+                          err);
+                goto done;
+        }
+        ptr = (char *)buf;
+        strsep(&ptr, "\n");
+
+        /* Print fw version info */
+        brcmf_err("Firmware version = %s\n", buf);
+
+        /* locate firmware version number for ethtool */
+        ptr = strrchr(buf, ' ') + 1;
+        strlcpy(ifp->drvr->fwver, ptr, sizeof(ifp->drvr->fwver));
+
+        /* set mpc */
+        err = brcmf_fil_iovar_int_set(ifp, "mpc", 1);
+        if (err) {
+                brcmf_err("failed setting mpc\n");
+                goto done;
+        }
+
+        /*
+         * Setup timeout if Beacons are lost and roam is off to report
+         * link down
+         */
+        err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout",
+                                      BRCMF_DEFAULT_BCN_TIMEOUT);
+        if (err) {
+                brcmf_err("bcn_timeout error (%d)\n", err);
+                goto done;
+        }
+
+        /* Enable/Disable build-in roaming to allowed ext supplicant to take
+         * of romaing
+         */
+        err = brcmf_fil_iovar_int_set(ifp, "roam_off", 1);
+        if (err) {
+                brcmf_err("roam_off error (%d)\n", err);
+                goto done;
+        }
+
+        /* Setup join_pref to select target by RSSI(with boost on 5GHz) */
+        join_pref_params[0].type = BRCMF_JOIN_PREF_RSSI_DELTA;
+        join_pref_params[0].len = 2;
+        join_pref_params[0].rssi_gain = BRCMF_JOIN_PREF_RSSI_BOOST;
+        join_pref_params[0].band = WLC_BAND_5G;
+        join_pref_params[1].type = BRCMF_JOIN_PREF_RSSI;
+        join_pref_params[1].len = 2;
+        join_pref_params[1].rssi_gain = 0;
+        join_pref_params[1].band = 0;
+        err = brcmf_fil_iovar_data_set(ifp, "join_pref", join_pref_params,
+                                       sizeof(join_pref_params));
+        if (err)
+                brcmf_err("Set join_pref error (%d)\n", err);
+
+        /* Setup event_msgs, enable E_IF */
+        err = brcmf_fil_iovar_data_get(ifp, "event_msgs", eventmask,
+                                       BRCMF_EVENTING_MASK_LEN);
+        if (err) {
+                brcmf_err("Get event_msgs error (%d)\n", err);
+                goto done;
+        }
+        setbit(eventmask, BRCMF_E_IF);
+        err = brcmf_fil_iovar_data_set(ifp, "event_msgs", eventmask,
+                                       BRCMF_EVENTING_MASK_LEN);
+        if (err) {
+                brcmf_err("Set event_msgs error (%d)\n", err);
+                goto done;
+        }
+
+        /* Setup default scan channel time */
+        err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
+                                    BRCMF_DEFAULT_SCAN_CHANNEL_TIME);
+        if (err) {
+                brcmf_err("BRCMF_C_SET_SCAN_CHANNEL_TIME error (%d)\n",
+                          err);
+                goto done;
+        }
+
+        /* Setup default scan unassoc time */
+        err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_UNASSOC_TIME,
+                                    BRCMF_DEFAULT_SCAN_UNASSOC_TIME);
+        if (err) {
+                brcmf_err("BRCMF_C_SET_SCAN_UNASSOC_TIME error (%d)\n",
+                          err);
+                goto done;
+        }
+
+        /* do bus specific preinit here */
+        err = brcmf_bus_preinit(ifp->drvr->bus_if);
+done:
+        return err;
+}
+
+#if defined(CONFIG_BRCM_TRACING) || defined(CONFIG_BRCMDBG)
+void __brcmf_dbg(u32 level, const char *func, const char *fmt, ...)
+{
+        struct va_format vaf = {
+                .fmt = fmt,
+        };
+        va_list args;
+
+        va_start(args, fmt);
+        vaf.va = &args;
+        if (brcmf_msg_level & level)
+                pr_debug("%s %pV", func, &vaf);
+        trace_brcmf_dbg(level, func, &vaf);
+        va_end(args);
+}
+#endif
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/commonring.c b/drivers/net/wireless/brcm80211/brcmfmac/commonring.c
index c6d65b8e1e15..77656c711bed 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/commonring.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/commonring.c
@@ -19,7 +19,7 @@
 #include <brcmu_utils.h>
 #include <brcmu_wifi.h>
 
-#include "dhd.h"
+#include "core.h"
 #include "commonring.h"
 
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/core.c
index fb1043908a23..f407665cb1ea 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
@@ -22,12 +22,12 @@
 #include <brcmu_utils.h>
 #include <brcmu_wifi.h>
 
-#include "dhd.h"
-#include "dhd_bus.h"
-#include "dhd_dbg.h"
+#include "core.h"
+#include "bus.h"
+#include "debug.h"
 #include "fwil_types.h"
 #include "p2p.h"
-#include "wl_cfg80211.h"
+#include "cfg80211.h"
 #include "fwil.h"
 #include "fwsignal.h"
 #include "feature.h"
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h b/drivers/net/wireless/brcm80211/brcmfmac/core.h
index 5e4317dbc2b0..98228e922d3a 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.h
@@ -18,8 +18,8 @@
  * Common types *
  */
 
-#ifndef _BRCMF_H_
-#define _BRCMF_H_
+#ifndef BRCMFMAC_CORE_H
+#define BRCMFMAC_CORE_H
 
 #include "fweh.h"
 
@@ -83,7 +83,6 @@ struct brcmf_pub {
         /* Internal brcmf items */
         uint hdrlen;            /* Total BRCMF header length (proto + bus) */
         uint rxsz;              /* Rx buffer size bus module should use */
-        u8 wme_dp;              /* wme discard priority */
 
         /* Dongle media info */
         char fwver[BRCMF_DRIVER_FIRMWARE_VERSION_LEN];
@@ -186,4 +185,4 @@ void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb);
 /* Sets dongle media info (drv_version, mac address). */
 int brcmf_c_preinit_dcmds(struct brcmf_if *ifp);
 
-#endif                          /* _BRCMF_H_ */
+#endif /* BRCMFMAC_CORE_H */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.c b/drivers/net/wireless/brcm80211/brcmfmac/debug.c
index be9f4f829192..9b473d50b005 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/debug.c
@@ -19,9 +19,9 @@
 
 #include <brcmu_wifi.h>
 #include <brcmu_utils.h>
-#include "dhd.h"
-#include "dhd_bus.h"
-#include "dhd_dbg.h"
+#include "core.h"
+#include "bus.h"
+#include "debug.h"
 
 static struct dentry *root_folder;
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h b/drivers/net/wireless/brcm80211/brcmfmac/debug.h
index dec40d316c82..eb0b8c47479d 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/debug.h
@@ -14,8 +14,8 @@
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#ifndef _BRCMF_DBG_H_
-#define _BRCMF_DBG_H_
+#ifndef BRCMFMAC_DEBUG_H
+#define BRCMFMAC_DEBUG_H
 
 /* message levels */
 #define BRCMF_TRACE_VAL         0x00000002
@@ -133,4 +133,4 @@ int brcmf_debugfs_add_entry(struct brcmf_pub *drvr, const char *fn,
 }
 #endif
 
-#endif                          /* _BRCMF_DBG_H_ */
+#endif /* BRCMFMAC_DEBUG_H */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
deleted file mode 100644
index d991f8e3d9ec..000000000000
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
+++ /dev/null
@@ -1,400 +0,0 @@
-/*
- * Copyright (c) 2010 Broadcom Corporation
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#include <linux/kernel.h>
-#include <linux/string.h>
-#include <linux/netdevice.h>
-#include <brcmu_wifi.h>
-#include <brcmu_utils.h>
-#include "dhd.h"
-#include "dhd_bus.h"
-#include "dhd_dbg.h"
-#include "fwil.h"
-#include "fwil_types.h"
-#include "tracepoint.h"
-
-#define PKTFILTER_BUF_SIZE              128
-#define BRCMF_DEFAULT_BCN_TIMEOUT       3
-#define BRCMF_DEFAULT_SCAN_CHANNEL_TIME 40
-#define BRCMF_DEFAULT_SCAN_UNASSOC_TIME 40
-#define BRCMF_DEFAULT_PACKET_FILTER     "100 0 0 0 0x01 0x00"
-
-/* boost value for RSSI_DELTA in preferred join selection */
-#define BRCMF_JOIN_PREF_RSSI_BOOST      8
-
-
-bool brcmf_c_prec_enq(struct device *dev, struct pktq *q,
-                      struct sk_buff *pkt, int prec)
-{
-        struct sk_buff *p;
-        int eprec = -1;         /* precedence to evict from */
-        bool discard_oldest;
-        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
-        struct brcmf_pub *drvr = bus_if->drvr;
-
-        /* Fast case, precedence queue is not full and we are also not
-         * exceeding total queue length
-         */
-        if (!pktq_pfull(q, prec) && !pktq_full(q)) {
-                brcmu_pktq_penq(q, prec, pkt);
-                return true;
-        }
-
-        /* Determine precedence from which to evict packet, if any */
-        if (pktq_pfull(q, prec))
-                eprec = prec;
-        else if (pktq_full(q)) {
-                p = brcmu_pktq_peek_tail(q, &eprec);
-                if (eprec > prec)
-                        return false;
-        }
-
-        /* Evict if needed */
-        if (eprec >= 0) {
-                /* Detect queueing to unconfigured precedence */
-                discard_oldest = ac_bitmap_tst(drvr->wme_dp, eprec);
-                if (eprec == prec && !discard_oldest)
-                        return false;   /* refuse newer (incoming) packet */
-                /* Evict packet according to discard policy */
-                p = discard_oldest ? brcmu_pktq_pdeq(q, eprec) :
-                        brcmu_pktq_pdeq_tail(q, eprec);
-                if (p == NULL)
-                        brcmf_err("brcmu_pktq_penq() failed, oldest %d\n",
-                                  discard_oldest);
-
-                brcmu_pkt_buf_free_skb(p);
-        }
-
-        /* Enqueue */
-        p = brcmu_pktq_penq(q, prec, pkt);
-        if (p == NULL)
-                brcmf_err("brcmu_pktq_penq() failed\n");
-
-        return p != NULL;
-}
-
-/* Convert user's input in hex pattern to byte-size mask */
-static int brcmf_c_pattern_atoh(char *src, char *dst)
-{
-        int i;
-        if (strncmp(src, "0x", 2) != 0 && strncmp(src, "0X", 2) != 0) {
-                brcmf_err("Mask invalid format. Needs to start with 0x\n");
-                return -EINVAL;
-        }
-        src = src + 2;          /* Skip past 0x */
-        if (strlen(src) % 2 != 0) {
-                brcmf_err("Mask invalid format. Length must be even.\n");
-                return -EINVAL;
-        }
-        for (i = 0; *src != '\0'; i++) {
-                unsigned long res;
-                char num[3];
-                strncpy(num, src, 2);
-                num[2] = '\0';
-                if (kstrtoul(num, 16, &res))
-                        return -EINVAL;
-                dst[i] = (u8)res;
-                src += 2;
-        }
-        return i;
-}
-
-static void
-brcmf_c_pktfilter_offload_enable(struct brcmf_if *ifp, char *arg, int enable,
-                                 int master_mode)
-{
-        unsigned long res;
-        char *argv;
-        char *arg_save = NULL, *arg_org = NULL;
-        s32 err;
-        struct brcmf_pkt_filter_enable_le enable_parm;
-
-        arg_save = kstrdup(arg, GFP_ATOMIC);
-        if (!arg_save)
-                goto fail;
-
-        arg_org = arg_save;
-
-        argv = strsep(&arg_save, " ");
-
-        if (argv == NULL) {
-                brcmf_err("No args provided\n");
-                goto fail;
-        }
-
-        /* Parse packet filter id. */
-        enable_parm.id = 0;
-        if (!kstrtoul(argv, 0, &res))
-                enable_parm.id = cpu_to_le32((u32)res);
-
-        /* Enable/disable the specified filter. */
-        enable_parm.enable = cpu_to_le32(enable);
-
-        err = brcmf_fil_iovar_data_set(ifp, "pkt_filter_enable", &enable_parm,
-                                       sizeof(enable_parm));
-        if (err)
-                brcmf_err("Set pkt_filter_enable error (%d)\n", err);
-
-        /* Control the master mode */
-        err = brcmf_fil_iovar_int_set(ifp, "pkt_filter_mode", master_mode);
-        if (err)
-                brcmf_err("Set pkt_filter_mode error (%d)\n", err);
-
-fail:
-        kfree(arg_org);
-}
-
-static void brcmf_c_pktfilter_offload_set(struct brcmf_if *ifp, char *arg)
-{
-        struct brcmf_pkt_filter_le *pkt_filter;
-        unsigned long res;
-        int buf_len;
-        s32 err;
-        u32 mask_size;
-        u32 pattern_size;
-        char *argv[8], *buf = NULL;
-        int i = 0;
-        char *arg_save = NULL, *arg_org = NULL;
-
-        arg_save = kstrdup(arg, GFP_ATOMIC);
-        if (!arg_save)
-                goto fail;
-
-        arg_org = arg_save;
-
-        buf = kmalloc(PKTFILTER_BUF_SIZE, GFP_ATOMIC);
-        if (!buf)
-                goto fail;
-
-        argv[i] = strsep(&arg_save, " ");
-        while (argv[i]) {
-                i++;
-                if (i >= 8) {
-                        brcmf_err("Too many parameters\n");
-                        goto fail;
-                }
-                argv[i] = strsep(&arg_save, " ");
-        }
-
-        if (i != 6) {
-                brcmf_err("Not enough args provided %d\n", i);
-                goto fail;
-        }
-
-        pkt_filter = (struct brcmf_pkt_filter_le *)buf;
-
-        /* Parse packet filter id. */
-        pkt_filter->id = 0;
-        if (!kstrtoul(argv[0], 0, &res))
-                pkt_filter->id = cpu_to_le32((u32)res);
-
-        /* Parse filter polarity. */
-        pkt_filter->negate_match = 0;
-        if (!kstrtoul(argv[1], 0, &res))
-                pkt_filter->negate_match = cpu_to_le32((u32)res);
-
-        /* Parse filter type. */
-        pkt_filter->type = 0;
-        if (!kstrtoul(argv[2], 0, &res))
-                pkt_filter->type = cpu_to_le32((u32)res);
-
-        /* Parse pattern filter offset. */
-        pkt_filter->u.pattern.offset = 0;
-        if (!kstrtoul(argv[3], 0, &res))
-                pkt_filter->u.pattern.offset = cpu_to_le32((u32)res);
-
-        /* Parse pattern filter mask. */
-        mask_size = brcmf_c_pattern_atoh(argv[4],
-                        (char *)pkt_filter->u.pattern.mask_and_pattern);
-
-        /* Parse pattern filter pattern. */
-        pattern_size = brcmf_c_pattern_atoh(argv[5],
-                (char *)&pkt_filter->u.pattern.mask_and_pattern[mask_size]);
-
-        if (mask_size != pattern_size) {
-                brcmf_err("Mask and pattern not the same size\n");
-                goto fail;
-        }
-
-        pkt_filter->u.pattern.size_bytes = cpu_to_le32(mask_size);
-        buf_len = offsetof(struct brcmf_pkt_filter_le,
-                           u.pattern.mask_and_pattern);
-        buf_len += mask_size + pattern_size;
-
-        err = brcmf_fil_iovar_data_set(ifp, "pkt_filter_add", pkt_filter,
-                                       buf_len);
-        if (err)
-                brcmf_err("Set pkt_filter_add error (%d)\n", err);
-
-fail:
-        kfree(arg_org);
-
-        kfree(buf);
-}
-
-int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
-{
-        s8 eventmask[BRCMF_EVENTING_MASK_LEN];
-        u8 buf[BRCMF_DCMD_SMLEN];
-        struct brcmf_join_pref_params join_pref_params[2];
-        char *ptr;
-        s32 err;
-
-        /* retreive mac address */
-        err = brcmf_fil_iovar_data_get(ifp, "cur_etheraddr", ifp->mac_addr,
-                                       sizeof(ifp->mac_addr));
-        if (err < 0) {
-                brcmf_err("Retreiving cur_etheraddr failed, %d\n",
-                          err);
-                goto done;
-        }
-        memcpy(ifp->drvr->mac, ifp->mac_addr, sizeof(ifp->drvr->mac));
-
-        /* query for 'ver' to get version info from firmware */
-        memset(buf, 0, sizeof(buf));
-        strcpy(buf, "ver");
-        err = brcmf_fil_iovar_data_get(ifp, "ver", buf, sizeof(buf));
-        if (err < 0) {
-                brcmf_err("Retreiving version information failed, %d\n",
-                          err);
-                goto done;
-        }
-        ptr = (char *)buf;
-        strsep(&ptr, "\n");
-
-        /* Print fw version info */
-        brcmf_err("Firmware version = %s\n", buf);
-
-        /* locate firmware version number for ethtool */
-        ptr = strrchr(buf, ' ') + 1;
-        strlcpy(ifp->drvr->fwver, ptr, sizeof(ifp->drvr->fwver));
-
-        /* set mpc */
-        err = brcmf_fil_iovar_int_set(ifp, "mpc", 1);
-        if (err) {
-                brcmf_err("failed setting mpc\n");
-                goto done;
-        }
-
-        /*
-         * Setup timeout if Beacons are lost and roam is off to report
-         * link down
-         */
-        err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout",
-                                      BRCMF_DEFAULT_BCN_TIMEOUT);
-        if (err) {
-                brcmf_err("bcn_timeout error (%d)\n", err);
-                goto done;
-        }
-
-        /* Enable/Disable build-in roaming to allowed ext supplicant to take
-         * of romaing
-         */
-        err = brcmf_fil_iovar_int_set(ifp, "roam_off", 1);
-        if (err) {
-                brcmf_err("roam_off error (%d)\n", err);
-                goto done;
-        }
-
-        /* Setup join_pref to select target by RSSI(with boost on 5GHz) */
-        join_pref_params[0].type = BRCMF_JOIN_PREF_RSSI_DELTA;
-        join_pref_params[0].len = 2;
-        join_pref_params[0].rssi_gain = BRCMF_JOIN_PREF_RSSI_BOOST;
-        join_pref_params[0].band = WLC_BAND_5G;
-        join_pref_params[1].type = BRCMF_JOIN_PREF_RSSI;
-        join_pref_params[1].len = 2;
-        join_pref_params[1].rssi_gain = 0;
-        join_pref_params[1].band = 0;
-        err = brcmf_fil_iovar_data_set(ifp, "join_pref", join_pref_params,
-                                       sizeof(join_pref_params));
-        if (err)
-                brcmf_err("Set join_pref error (%d)\n", err);
-
-        /* Setup event_msgs, enable E_IF */
-        err = brcmf_fil_iovar_data_get(ifp, "event_msgs", eventmask,
-                                       BRCMF_EVENTING_MASK_LEN);
-        if (err) {
-                brcmf_err("Get event_msgs error (%d)\n", err);
-                goto done;
-        }
-        setbit(eventmask, BRCMF_E_IF);
-        err = brcmf_fil_iovar_data_set(ifp, "event_msgs", eventmask,
-                                       BRCMF_EVENTING_MASK_LEN);
-        if (err) {
-                brcmf_err("Set event_msgs error (%d)\n", err);
-                goto done;
-        }
-
-        /* Setup default scan channel time */
-        err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
-                                    BRCMF_DEFAULT_SCAN_CHANNEL_TIME);
-        if (err) {
-                brcmf_err("BRCMF_C_SET_SCAN_CHANNEL_TIME error (%d)\n",
-                          err);
-                goto done;
-        }
-
-        /* Setup default scan unassoc time */
-        err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_UNASSOC_TIME,
-                                    BRCMF_DEFAULT_SCAN_UNASSOC_TIME);
-        if (err) {
-                brcmf_err("BRCMF_C_SET_SCAN_UNASSOC_TIME error (%d)\n",
-                          err);
-                goto done;
-        }
-
-        /* Setup packet filter */
-        brcmf_c_pktfilter_offload_set(ifp, BRCMF_DEFAULT_PACKET_FILTER);
-        brcmf_c_pktfilter_offload_enable(ifp, BRCMF_DEFAULT_PACKET_FILTER,
-                                         0, true);
-
-        /* do bus specific preinit here */
-        err = brcmf_bus_preinit(ifp->drvr->bus_if);
-done:
-        return err;
-}
-
-#ifdef CONFIG_BRCM_TRACING
-void __brcmf_err(const char *func, const char *fmt, ...)
-{
-        struct va_format vaf = {
-                .fmt = fmt,
-        };
-        va_list args;
-
-        va_start(args, fmt);
-        vaf.va = &args;
-        pr_err("%s: %pV", func, &vaf);
-        trace_brcmf_err(func, &vaf);
-        va_end(args);
-}
-#endif
-#if defined(CONFIG_BRCM_TRACING) || defined(CONFIG_BRCMDBG)
-void __brcmf_dbg(u32 level, const char *func, const char *fmt, ...)
-{
-        struct va_format vaf = {
-                .fmt = fmt,
-        };
-        va_list args;
-
-        va_start(args, fmt);
-        vaf.va = &args;
-        if (brcmf_msg_level & level)
-                pr_debug("%s %pV", func, &vaf);
-        trace_brcmf_dbg(level, func, &vaf);
-        va_end(args);
-}
-#endif
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/feature.c b/drivers/net/wireless/brcm80211/brcmfmac/feature.c
index aed53acef456..931f68aefaa4 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/feature.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/feature.c
@@ -17,18 +17,13 @@
 #include <linux/netdevice.h>
 
 #include <brcm_hw_ids.h>
-#include "dhd.h"
-#include "dhd_bus.h"
-#include "dhd_dbg.h"
+#include "core.h"
+#include "bus.h"
+#include "debug.h"
 #include "fwil.h"
 #include "feature.h"
 
 /*
- * firmware error code received if iovar is unsupported.
- */
-#define EBRCMF_FEAT_UNSUPPORTED         23
-
-/*
  * expand feature list to array of feature strings.
  */
 #define BRCMF_FEAT_DEF(_f) \
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/firmware.c b/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
index 8ea9f283d2b8..1ff787d1a36b 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
@@ -20,7 +20,7 @@
 #include <linux/firmware.h>
 #include <linux/module.h>
 
-#include "dhd_dbg.h"
+#include "debug.h"
 #include "firmware.h"
 
 char brcmf_firmware_path[BRCMF_FW_PATH_LEN];
@@ -262,8 +262,7 @@ static void brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
 
 fail:
         brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev));
-        if (fwctx->code)
-                release_firmware(fwctx->code);
+        release_firmware(fwctx->code);
         device_release_driver(fwctx->dev);
         kfree(fwctx);
 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/flowring.c b/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
index 1faa929f5fff..44f3a84d1999 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
@@ -19,9 +19,9 @@
 #include <linux/etherdevice.h>
 #include <brcmu_utils.h>
 
-#include "dhd.h"
-#include "dhd_dbg.h"
-#include "dhd_bus.h"
+#include "core.h"
+#include "debug.h"
+#include "bus.h"
 #include "proto.h"
 #include "flowring.h"
 #include "msgbuf.h"
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fweh.c b/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
index 44fc85f68f7a..7338b335e153 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
@@ -18,8 +18,8 @@
 #include "brcmu_wifi.h"
 #include "brcmu_utils.h"
 
-#include "dhd.h"
-#include "dhd_dbg.h"
+#include "core.h"
+#include "debug.h"
 #include "tracepoint.h"
 #include "fwsignal.h"
 #include "fweh.h"
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwil.c b/drivers/net/wireless/brcm80211/brcmfmac/fwil.c
index ded328f80cd1..51f88c11e642 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwil.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil.c
@@ -22,9 +22,9 @@
 #include <linux/netdevice.h>
 #include <brcmu_utils.h>
 #include <brcmu_wifi.h>
-#include "dhd.h"
-#include "dhd_bus.h"
-#include "dhd_dbg.h"
+#include "core.h"
+#include "bus.h"
+#include "debug.h"
 #include "tracepoint.h"
 #include "fwil.h"
 #include "proto.h"
@@ -32,6 +32,76 @@
 
 #define MAX_HEX_DUMP_LEN        64
 
+#ifdef DEBUG
+static const char * const brcmf_fil_errstr[] = {
+        "BCME_OK",
+        "BCME_ERROR",
+        "BCME_BADARG",
+        "BCME_BADOPTION",
+        "BCME_NOTUP",
+        "BCME_NOTDOWN",
+        "BCME_NOTAP",
+        "BCME_NOTSTA",
+        "BCME_BADKEYIDX",
+        "BCME_RADIOOFF",
+        "BCME_NOTBANDLOCKED",
+        "BCME_NOCLK",
+        "BCME_BADRATESET",
+        "BCME_BADBAND",
+        "BCME_BUFTOOSHORT",
+        "BCME_BUFTOOLONG",
+        "BCME_BUSY",
+        "BCME_NOTASSOCIATED",
+        "BCME_BADSSIDLEN",
+        "BCME_OUTOFRANGECHAN",
+        "BCME_BADCHAN",
+        "BCME_BADADDR",
+        "BCME_NORESOURCE",
+        "BCME_UNSUPPORTED",
+        "BCME_BADLEN",
+        "BCME_NOTREADY",
+        "BCME_EPERM",
+        "BCME_NOMEM",
+        "BCME_ASSOCIATED",
+        "BCME_RANGE",
+        "BCME_NOTFOUND",
+        "BCME_WME_NOT_ENABLED",
+        "BCME_TSPEC_NOTFOUND",
+        "BCME_ACM_NOTSUPPORTED",
+        "BCME_NOT_WME_ASSOCIATION",
+        "BCME_SDIO_ERROR",
+        "BCME_DONGLE_DOWN",
+        "BCME_VERSION",
+        "BCME_TXFAIL",
+        "BCME_RXFAIL",
+        "BCME_NODEVICE",
+        "BCME_NMODE_DISABLED",
+        "BCME_NONRESIDENT",
+        "BCME_SCANREJECT",
+        "BCME_USAGE_ERROR",
+        "BCME_IOCTL_ERROR",
+        "BCME_SERIAL_PORT_ERR",
+        "BCME_DISABLED",
+        "BCME_DECERR",
+        "BCME_ENCERR",
+        "BCME_MICERR",
+        "BCME_REPLAY",
+        "BCME_IE_NOTFOUND",
+};
+
+static const char *brcmf_fil_get_errstr(u32 err)
+{
+        if (err >= ARRAY_SIZE(brcmf_fil_errstr))
+                return "(unknown)";
+
+        return brcmf_fil_errstr[err];
+}
+#else
+static const char *brcmf_fil_get_errstr(u32 err)
+{
+        return "";
+}
+#endif /* DEBUG */
 
 static s32
 brcmf_fil_cmd_data(struct brcmf_if *ifp, u32 cmd, void *data, u32 len, bool set)
@@ -52,11 +122,11 @@ brcmf_fil_cmd_data(struct brcmf_if *ifp, u32 cmd, void *data, u32 len, bool set)
                 err = brcmf_proto_query_dcmd(drvr, ifp->ifidx, cmd, data, len);
 
         if (err >= 0)
-                err = 0;
-        else
-                brcmf_dbg(FIL, "Failed err=%d\n", err);
+                return 0;
 
-        return err;
+        brcmf_dbg(FIL, "Failed: %s (%d)\n",
+                  brcmf_fil_get_errstr((u32)(-err)), err);
+        return -EBADE;
 }
 
 s32
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
index 5ff5cd0bb032..ba64b292f7a5 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
@@ -55,59 +55,63 @@
 
 /* WOWL bits */
 /* Wakeup on Magic packet: */
-#define WL_WOWL_MAGIC                   (1 << 0)
+#define BRCMF_WOWL_MAGIC                (1 << 0)
 /* Wakeup on Netpattern */
-#define WL_WOWL_NET                     (1 << 1)
+#define BRCMF_WOWL_NET                  (1 << 1)
 /* Wakeup on loss-of-link due to Disassoc/Deauth: */
-#define WL_WOWL_DIS                     (1 << 2)
+#define BRCMF_WOWL_DIS                  (1 << 2)
 /* Wakeup on retrograde TSF: */
-#define WL_WOWL_RETR                    (1 << 3)
+#define BRCMF_WOWL_RETR                 (1 << 3)
 /* Wakeup on loss of beacon: */
-#define WL_WOWL_BCN                     (1 << 4)
+#define BRCMF_WOWL_BCN                  (1 << 4)
 /* Wakeup after test: */
-#define WL_WOWL_TST                     (1 << 5)
+#define BRCMF_WOWL_TST                  (1 << 5)
 /* Wakeup after PTK refresh: */
-#define WL_WOWL_M1                      (1 << 6)
+#define BRCMF_WOWL_M1                   (1 << 6)
 /* Wakeup after receipt of EAP-Identity Req: */
-#define WL_WOWL_EAPID                   (1 << 7)
+#define BRCMF_WOWL_EAPID                (1 << 7)
 /* Wakeind via PME(0) or GPIO(1): */
-#define WL_WOWL_PME_GPIO                (1 << 8)
+#define BRCMF_WOWL_PME_GPIO             (1 << 8)
 /* need tkip phase 1 key to be updated by the driver: */
-#define WL_WOWL_NEEDTKIP1               (1 << 9)
+#define BRCMF_WOWL_NEEDTKIP1            (1 << 9)
 /* enable wakeup if GTK fails: */
-#define WL_WOWL_GTK_FAILURE             (1 << 10)
+#define BRCMF_WOWL_GTK_FAILURE          (1 << 10)
 /* support extended magic packets: */
-#define WL_WOWL_EXTMAGPAT               (1 << 11)
+#define BRCMF_WOWL_EXTMAGPAT            (1 << 11)
 /* support ARP/NS/keepalive offloading: */
-#define WL_WOWL_ARPOFFLOAD              (1 << 12)
+#define BRCMF_WOWL_ARPOFFLOAD           (1 << 12)
 /* read protocol version for EAPOL frames: */
-#define WL_WOWL_WPA2                    (1 << 13)
+#define BRCMF_WOWL_WPA2                 (1 << 13)
 /* If the bit is set, use key rotaton: */
-#define WL_WOWL_KEYROT                  (1 << 14)
+#define BRCMF_WOWL_KEYROT               (1 << 14)
 /* If the bit is set, frm received was bcast frame: */
-#define WL_WOWL_BCAST                   (1 << 15)
+#define BRCMF_WOWL_BCAST                (1 << 15)
 /* If the bit is set, scan offload is enabled: */
-#define WL_WOWL_SCANOL                  (1 << 16)
+#define BRCMF_WOWL_SCANOL               (1 << 16)
 /* Wakeup on tcpkeep alive timeout: */
-#define WL_WOWL_TCPKEEP_TIME            (1 << 17)
+#define BRCMF_WOWL_TCPKEEP_TIME         (1 << 17)
 /* Wakeup on mDNS Conflict Resolution: */
-#define WL_WOWL_MDNS_CONFLICT           (1 << 18)
+#define BRCMF_WOWL_MDNS_CONFLICT        (1 << 18)
 /* Wakeup on mDNS Service Connect: */
-#define WL_WOWL_MDNS_SERVICE            (1 << 19)
+#define BRCMF_WOWL_MDNS_SERVICE         (1 << 19)
 /* tcp keepalive got data: */
-#define WL_WOWL_TCPKEEP_DATA            (1 << 20)
+#define BRCMF_WOWL_TCPKEEP_DATA         (1 << 20)
 /* Firmware died in wowl mode: */
-#define WL_WOWL_FW_HALT                 (1 << 21)
+#define BRCMF_WOWL_FW_HALT              (1 << 21)
 /* Enable detection of radio button changes: */
-#define WL_WOWL_ENAB_HWRADIO            (1 << 22)
+#define BRCMF_WOWL_ENAB_HWRADIO         (1 << 22)
 /* Offloads detected MIC failure(s): */
-#define WL_WOWL_MIC_FAIL                (1 << 23)
+#define BRCMF_WOWL_MIC_FAIL             (1 << 23)
 /* Wakeup in Unassociated state (Net/Magic Pattern): */
-#define WL_WOWL_UNASSOC                 (1 << 24)
+#define BRCMF_WOWL_UNASSOC              (1 << 24)
 /* Wakeup if received matched secured pattern: */
-#define WL_WOWL_SECURE                  (1 << 25)
+#define BRCMF_WOWL_SECURE               (1 << 25)
 /* Link Down indication in WoWL mode: */
-#define WL_WOWL_LINKDOWN                (1 << 31)
+#define BRCMF_WOWL_LINKDOWN             (1 << 31)
+
+#define BRCMF_WOWL_MAXPATTERNS          8
+#define BRCMF_WOWL_MAXPATTERNSIZE       128
+
 
 /* join preference types for join_pref iovar */
 enum brcmf_join_pref_types {
@@ -124,6 +128,12 @@ enum brcmf_fil_p2p_if_types {
         BRCMF_FIL_P2P_IF_DEV,
 };
 
+enum brcmf_wowl_pattern_type {
+        BRCMF_WOWL_PATTERN_TYPE_BITMAP = 0,
+        BRCMF_WOWL_PATTERN_TYPE_ARP,
+        BRCMF_WOWL_PATTERN_TYPE_NA
+};
+
 struct brcmf_fil_p2p_if_le {
         u8 addr[ETH_ALEN];
         __le16 type;
@@ -484,4 +494,29 @@ struct brcmf_rx_mgmt_data {
         __be32  rate;
 };
 
+/**
+ * struct brcmf_fil_wowl_pattern_le - wowl pattern configuration struct.
+ *
+ * @cmd: "add", "del" or "clr".
+ * @masksize: Size of the mask in #of bytes
+ * @offset: Pattern byte offset in packet
+ * @patternoffset: Offset of start of pattern. Starting from field masksize.
+ * @patternsize: Size of the pattern itself in #of bytes
+ * @id: id
+ * @reasonsize: Size of the wakeup reason code
+ * @type: Type of pattern (enum brcmf_wowl_pattern_type)
+ */
+struct brcmf_fil_wowl_pattern_le {
+        u8      cmd[4];
+        __le32  masksize;
+        __le32  offset;
+        __le32  patternoffset;
+        __le32  patternsize;
+        __le32  id;
+        __le32  reasonsize;
+        __le32  type;
+        /* u8 mask[] - Mask follows the structure above */
+        /* u8 pattern[] - Pattern follows the mask is at 'patternoffset' */
+};
+
 #endif /* FWIL_TYPES_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
index 183f08d7fc8c..f0dda0ecd23b 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
@@ -26,15 +26,15 @@
 
 #include <brcmu_utils.h>
 #include <brcmu_wifi.h>
-#include "dhd.h"
-#include "dhd_dbg.h"
-#include "dhd_bus.h"
+#include "core.h"
+#include "debug.h"
+#include "bus.h"
 #include "fwil.h"
 #include "fwil_types.h"
 #include "fweh.h"
 #include "fwsignal.h"
 #include "p2p.h"
-#include "wl_cfg80211.h"
+#include "cfg80211.h"
 #include "proto.h"
 
 /**
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
index 11cc051f97cd..9f783db34ae5 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
@@ -24,13 +24,13 @@
 #include <brcmu_utils.h>
 #include <brcmu_wifi.h>
 
-#include "dhd.h"
-#include "dhd_dbg.h"
+#include "core.h"
+#include "debug.h"
 #include "proto.h"
 #include "msgbuf.h"
 #include "commonring.h"
 #include "flowring.h"
-#include "dhd_bus.h"
+#include "bus.h"
 #include "tracepoint.h"
 
 
@@ -518,8 +518,7 @@ static int brcmf_msgbuf_query_dcmd(struct brcmf_pub *drvr, int ifidx,
                 memcpy(buf, skb->data, (len < msgbuf->ioctl_resp_ret_len) ?
                                        len : msgbuf->ioctl_resp_ret_len);
         }
-        if (skb)
-                brcmu_pkt_buf_free_skb(skb);
+        brcmu_pkt_buf_free_skb(skb);
 
         return msgbuf->ioctl_resp_status;
 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/of.c b/drivers/net/wireless/brcm80211/brcmfmac/of.c
index f05f5270fec1..eb3fce82a223 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/of.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/of.c
@@ -21,8 +21,8 @@
 #include <linux/mmc/sdio_func.h>
 
 #include <defs.h>
-#include "dhd_dbg.h"
-#include "sdio_host.h"
+#include "debug.h"
+#include "sdio.h"
 
 void brcmf_of_probe(struct brcmf_sdio_dev *sdiodev)
 {
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
index d54c58a32faa..effb48ebd864 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
@@ -21,12 +21,12 @@
 #include <brcmu_wifi.h>
 #include <brcmu_utils.h>
 #include <defs.h>
-#include <dhd.h>
-#include <dhd_dbg.h>
+#include "core.h"
+#include "debug.h"
 #include "fwil.h"
 #include "fwil_types.h"
 #include "p2p.h"
-#include "wl_cfg80211.h"
+#include "cfg80211.h"
 
 /* parameters used for p2p escan */
 #define P2PAPI_SCAN_NPROBES 1
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
index 8c0632ec9f7a..b0ae7993e2e8 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
@@ -30,8 +30,8 @@
 #include <brcmu_wifi.h>
 #include <brcm_hw_ids.h>
 
-#include "dhd_dbg.h"
-#include "dhd_bus.h"
+#include "debug.h"
+#include "bus.h"
 #include "commonring.h"
 #include "msgbuf.h"
 #include "pcie.h"
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/proto.c b/drivers/net/wireless/brcm80211/brcmfmac/proto.c
index 62b940723339..26b68c367f57 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/proto.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/proto.c
@@ -20,9 +20,9 @@
 #include <linux/netdevice.h>
 
 #include <brcmu_wifi.h>
-#include "dhd.h"
-#include "dhd_bus.h"
-#include "dhd_dbg.h"
+#include "core.h"
+#include "bus.h"
+#include "debug.h"
 #include "proto.h"
 #include "bcdc.h"
 #include "msgbuf.h"
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
index f55f625fd06b..0b0d51a61060 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
@@ -40,7 +40,7 @@
 #include <brcmu_utils.h>
 #include <brcm_hw_ids.h>
 #include <soc.h>
-#include "sdio_host.h"
+#include "sdio.h"
 #include "chip.h"
 #include "firmware.h"
 
@@ -96,8 +96,8 @@ struct rte_console {
 #endif                          /* DEBUG */
 #include <chipcommon.h>
 
-#include "dhd_bus.h"
-#include "dhd_dbg.h"
+#include "bus.h"
+#include "debug.h"
 #include "tracepoint.h"
 
 #define TXQLEN          2048    /* bulk tx queue length */
@@ -670,7 +670,6 @@ static int brcmf_sdio_get_fwnames(struct brcmf_chip *ci,
                                   struct brcmf_sdio_dev *sdiodev)
 {
         int i;
-        uint fw_len, nv_len;
         char end;
 
         for (i = 0; i < ARRAY_SIZE(brcmf_fwname_data); i++) {
@@ -684,25 +683,25 @@ static int brcmf_sdio_get_fwnames(struct brcmf_chip *ci,
                 return -ENODEV;
         }
 
-        fw_len = sizeof(sdiodev->fw_name) - 1;
-        nv_len = sizeof(sdiodev->nvram_name) - 1;
         /* check if firmware path is provided by module parameter */
         if (brcmf_firmware_path[0] != '\0') {
-                strncpy(sdiodev->fw_name, brcmf_firmware_path, fw_len);
-                strncpy(sdiodev->nvram_name, brcmf_firmware_path, nv_len);
-                fw_len -= strlen(sdiodev->fw_name);
-                nv_len -= strlen(sdiodev->nvram_name);
+                strlcpy(sdiodev->fw_name, brcmf_firmware_path,
+                        sizeof(sdiodev->fw_name));
+                strlcpy(sdiodev->nvram_name, brcmf_firmware_path,
+                        sizeof(sdiodev->nvram_name));
 
                 end = brcmf_firmware_path[strlen(brcmf_firmware_path) - 1];
                 if (end != '/') {
-                        strncat(sdiodev->fw_name, "/", fw_len);
-                        strncat(sdiodev->nvram_name, "/", nv_len);
-                        fw_len--;
-                        nv_len--;
+                        strlcat(sdiodev->fw_name, "/",
+                                sizeof(sdiodev->fw_name));
+                        strlcat(sdiodev->nvram_name, "/",
+                                sizeof(sdiodev->nvram_name));
                 }
         }
-        strncat(sdiodev->fw_name, brcmf_fwname_data[i].bin, fw_len);
-        strncat(sdiodev->nvram_name, brcmf_fwname_data[i].nv, nv_len);
+        strlcat(sdiodev->fw_name, brcmf_fwname_data[i].bin,
+                sizeof(sdiodev->fw_name));
+        strlcat(sdiodev->nvram_name, brcmf_fwname_data[i].nv,
+                sizeof(sdiodev->nvram_name));
 
         return 0;
 }
@@ -2763,6 +2762,48 @@ static struct pktq *brcmf_sdio_bus_gettxq(struct device *dev)
         return &bus->txq;
 }
 
+static bool brcmf_sdio_prec_enq(struct pktq *q, struct sk_buff *pkt, int prec)
+{
+        struct sk_buff *p;
+        int eprec = -1;         /* precedence to evict from */
+
+        /* Fast case, precedence queue is not full and we are also not
+         * exceeding total queue length
+         */
+        if (!pktq_pfull(q, prec) && !pktq_full(q)) {
+                brcmu_pktq_penq(q, prec, pkt);
+                return true;
+        }
+
+        /* Determine precedence from which to evict packet, if any */
+        if (pktq_pfull(q, prec)) {
+                eprec = prec;
+        } else if (pktq_full(q)) {
+                p = brcmu_pktq_peek_tail(q, &eprec);
+                if (eprec > prec)
+                        return false;
+        }
+
+        /* Evict if needed */
+        if (eprec >= 0) {
+                /* Detect queueing to unconfigured precedence */
+                if (eprec == prec)
+                        return false;   /* refuse newer (incoming) packet */
+                /* Evict packet according to discard policy */
+                p = brcmu_pktq_pdeq_tail(q, eprec);
+                if (p == NULL)
+                        brcmf_err("brcmu_pktq_pdeq_tail() failed\n");
+                brcmu_pkt_buf_free_skb(p);
+        }
+
+        /* Enqueue */
+        p = brcmu_pktq_penq(q, prec, pkt);
+        if (p == NULL)
+                brcmf_err("brcmu_pktq_penq() failed\n");
+
+        return p != NULL;
+}
+
 static int brcmf_sdio_bus_txdata(struct device *dev, struct sk_buff *pkt)
 {
         int ret = -EBADE;
@@ -2788,7 +2829,7 @@ static int brcmf_sdio_bus_txdata(struct device *dev, struct sk_buff *pkt)
         spin_lock_bh(&bus->txq_lock);
         /* reset bus_flags in packet cb */
         *(u16 *)(pkt->cb) = 0;
-        if (!brcmf_c_prec_enq(bus->sdiodev->dev, &bus->txq, pkt, prec)) {
+        if (!brcmf_sdio_prec_enq(&bus->txq, pkt, prec)) {
                 skb_pull(pkt, bus->tx_hdrlen);
                 brcmf_err("out of bus->txq !!!\n");
                 ret = -ENOSR;
@@ -2798,7 +2839,7 @@ static int brcmf_sdio_bus_txdata(struct device *dev, struct sk_buff *pkt)
 
         if (pktq_len(&bus->txq) >= TXHI) {
                 bus->txoff = true;
-                brcmf_txflowblock(bus->sdiodev->dev, true);
+                brcmf_txflowblock(dev, true);
         }
         spin_unlock_bh(&bus->txq_lock);
 
@@ -3949,6 +3990,7 @@ static struct brcmf_bus_ops brcmf_sdio_bus_ops = {
         .txctl = brcmf_sdio_bus_txctl,
         .rxctl = brcmf_sdio_bus_rxctl,
         .gettxq = brcmf_sdio_bus_gettxq,
+        .wowl_config = brcmf_sdio_wowl_config
 };
 
 static void brcmf_sdio_firmware_callback(struct device *dev,
@@ -4075,7 +4117,7 @@ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
 
         /* platform specific configuration:
          *   alignments must be at least 4 bytes for ADMA
-         */
+         */
         bus->head_align = ALIGNMENT;
         bus->sgentry_align = ALIGNMENT;
         if (sdiodev->pdata) {
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h b/drivers/net/wireless/brcm80211/brcmfmac/sdio.h
index f2d06cae366a..8eb42620129c 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.h
@@ -14,8 +14,8 @@
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#ifndef _BRCM_SDH_H_
-#define _BRCM_SDH_H_
+#ifndef BRCMFMAC_SDIO_H
+#define BRCMFMAC_SDIO_H
 
 #include <linux/skbuff.h>
 #include <linux/firmware.h>
@@ -186,6 +186,7 @@ struct brcmf_sdio_dev {
         struct sg_table sgtable;
         char fw_name[BRCMF_FW_PATH_LEN + BRCMF_FW_NAME_LEN];
         char nvram_name[BRCMF_FW_PATH_LEN + BRCMF_FW_NAME_LEN];
+        bool wowl_enabled;
 };
 
 /* sdio core registers */
@@ -334,5 +335,6 @@ void brcmf_sdio_remove(struct brcmf_sdio *bus);
 void brcmf_sdio_isr(struct brcmf_sdio *bus);
 
 void brcmf_sdio_wd_timer(struct brcmf_sdio *bus, uint wdtick);
+void brcmf_sdio_wowl_config(struct device *dev, bool enabled);
 
-#endif                          /* _BRCM_SDH_H_ */
+#endif /* BRCMFMAC_SDIO_H */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/tracepoint.c b/drivers/net/wireless/brcm80211/brcmfmac/tracepoint.c
index b505db48c60d..a10f35c5eb3d 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/tracepoint.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/tracepoint.c
@@ -19,4 +19,19 @@
 #ifndef __CHECKER__
 #define CREATE_TRACE_POINTS
 #include "tracepoint.h"
+
+void __brcmf_err(const char *func, const char *fmt, ...)
+{
+        struct va_format vaf = {
+                .fmt = fmt,
+        };
+        va_list args;
+
+        va_start(args, fmt);
+        vaf.va = &args;
+        pr_err("%s: %pV", func, &vaf);
+        trace_brcmf_err(func, &vaf);
+        va_end(args);
+}
+
 #endif
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index dc135915470d..5265aa70b094 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -23,13 +23,12 @@
 #include <brcmu_utils.h>
 #include <brcm_hw_ids.h>
 #include <brcmu_wifi.h>
-#include <dhd_bus.h>
-#include <dhd_dbg.h>
-
+#include "bus.h"
+#include "debug.h"
 #include "firmware.h"
-#include "usb_rdl.h"
 #include "usb.h"
 
+
 #define IOCTL_RESP_TIMEOUT              2000
 
 #define BRCMF_USB_RESET_GETVER_SPINWAIT 100     /* in unit of ms */
@@ -49,6 +48,71 @@
 #define BRCMF_USB_43242_FW_NAME         "brcm/brcmfmac43242a.bin"
 #define BRCMF_USB_43569_FW_NAME         "brcm/brcmfmac43569.bin"
 
+#define TRX_MAGIC               0x30524448      /* "HDR0" */
+#define TRX_MAX_OFFSET          3               /* Max number of file offsets */
+#define TRX_UNCOMP_IMAGE        0x20            /* Trx holds uncompressed img */
+#define TRX_RDL_CHUNK           1500            /* size of each dl transfer */
+#define TRX_OFFSETS_DLFWLEN_IDX 0
+
+/* Control messages: bRequest values */
+#define DL_GETSTATE     0       /* returns the rdl_state_t struct */
+#define DL_CHECK_CRC    1       /* currently unused */
+#define DL_GO           2       /* execute downloaded image */
+#define DL_START        3       /* initialize dl state */
+#define DL_REBOOT       4       /* reboot the device in 2 seconds */
+#define DL_GETVER       5       /* returns the bootrom_id_t struct */
+#define DL_GO_PROTECTED 6       /* execute the downloaded code and set reset
+                                 * event to occur in 2 seconds.  It is the
+                                 * responsibility of the downloaded code to
+                                 * clear this event
+                                 */
+#define DL_EXEC         7       /* jump to a supplied address */
+#define DL_RESETCFG     8       /* To support single enum on dongle
+                                 * - Not used by bootloader
+                                 */
+#define DL_DEFER_RESP_OK 9      /* Potentially defer the response to setup
+                                 * if resp unavailable
+                                 */
+
+/* states */
+#define DL_WAITING      0       /* waiting to rx first pkt */
+#define DL_READY        1       /* hdr was good, waiting for more of the
+                                 * compressed image
+                                 */
+#define DL_BAD_HDR      2       /* hdr was corrupted */
+#define DL_BAD_CRC      3       /* compressed image was corrupted */
+#define DL_RUNNABLE     4       /* download was successful,waiting for go cmd */
+#define DL_START_FAIL   5       /* failed to initialize correctly */
+#define DL_NVRAM_TOOBIG 6       /* host specified nvram data exceeds DL_NVRAM
+                                 * value
+                                 */
+#define DL_IMAGE_TOOBIG 7       /* firmware image too big */
+
+
+struct trx_header_le {
+        __le32 magic;           /* "HDR0" */
+        __le32 len;             /* Length of file including header */
+        __le32 crc32;           /* CRC from flag_version to end of file */
+        __le32 flag_version;    /* 0:15 flags, 16:31 version */
+        __le32 offsets[TRX_MAX_OFFSET]; /* Offsets of partitions from start of
+                                         * header
+                                         */
+};
+
+struct rdl_state_le {
+        __le32 state;
+        __le32 bytes;
+};
+
+struct bootrom_id_le {
+        __le32 chip;            /* Chip id */
+        __le32 chiprev;         /* Chip rev */
+        __le32 ramsize;         /* Size of  RAM */
+        __le32 remapbase;       /* Current remap base address */
+        __le32 boardtype;       /* Type of board */
+        __le32 boardrev;        /* Board revision */
+};
+
 struct brcmf_usb_image {
         struct list_head list;
         s8 *fwname;
@@ -93,6 +157,8 @@ struct brcmf_usbdev_info {
         u8 ifnum;
 
         struct urb *bulk_urb; /* used for FW download */
+
+        bool wowl_enabled;
 };
 
 static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
@@ -600,6 +666,16 @@ static int brcmf_usb_up(struct device *dev)
         return 0;
 }
 
+static void brcmf_cancel_all_urbs(struct brcmf_usbdev_info *devinfo)
+{
+        if (devinfo->ctl_urb)
+                usb_kill_urb(devinfo->ctl_urb);
+        if (devinfo->bulk_urb)
+                usb_kill_urb(devinfo->bulk_urb);
+        brcmf_usb_free_q(&devinfo->tx_postq, true);
+        brcmf_usb_free_q(&devinfo->rx_postq, true);
+}
+
 static void brcmf_usb_down(struct device *dev)
 {
         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
@@ -613,14 +689,7 @@ static void brcmf_usb_down(struct device *dev)
 
         brcmf_usb_state_change(devinfo, BRCMFMAC_USB_STATE_DOWN);
 
-        if (devinfo->ctl_urb)
-                usb_kill_urb(devinfo->ctl_urb);
-
-        if (devinfo->bulk_urb)
-                usb_kill_urb(devinfo->bulk_urb);
-        brcmf_usb_free_q(&devinfo->tx_postq, true);
-
-        brcmf_usb_free_q(&devinfo->rx_postq, true);
+        brcmf_cancel_all_urbs(devinfo);
 }
 
 static void
@@ -783,7 +852,7 @@ brcmf_usb_dl_writeimage(struct brcmf_usbdev_info *devinfo, u8 *fw, int fwlen)
 
         brcmf_dbg(USB, "Enter, fw %p, len %d\n", fw, fwlen);
 
-        bulkchunk = kmalloc(RDL_CHUNK, GFP_ATOMIC);
+        bulkchunk = kmalloc(TRX_RDL_CHUNK, GFP_ATOMIC);
         if (bulkchunk == NULL) {
                 err = -ENOMEM;
                 goto fail;
@@ -810,10 +879,10 @@ brcmf_usb_dl_writeimage(struct brcmf_usbdev_info *devinfo, u8 *fw, int fwlen)
                 /* Wait until the usb device reports it received all
                  * the bytes we sent */
                 if ((rdlbytes == sent) && (rdlbytes != dllen)) {
-                        if ((dllen-sent) < RDL_CHUNK)
+                        if ((dllen-sent) < TRX_RDL_CHUNK)
                                 sendlen = dllen-sent;
                         else
-                                sendlen = RDL_CHUNK;
+                                sendlen = TRX_RDL_CHUNK;
 
                         /* simply avoid having to send a ZLP by ensuring we
                          * never have an even
@@ -978,21 +1047,6 @@ static void brcmf_usb_detach(struct brcmf_usbdev_info *devinfo)
         kfree(devinfo->rx_reqs);
 }
 
-#define TRX_MAGIC       0x30524448      /* "HDR0" */
-#define TRX_VERSION     1               /* Version 1 */
-#define TRX_MAX_LEN     0x3B0000        /* Max length */
-#define TRX_NO_HEADER   1               /* Do not write TRX header */
-#define TRX_MAX_OFFSET  3               /* Max number of individual files */
-#define TRX_UNCOMP_IMAGE        0x20    /* Trx contains uncompressed image */
-
-struct trx_header_le {
-        __le32 magic;           /* "HDR0" */
-        __le32 len;             /* Length of file including header */
-        __le32 crc32;           /* CRC from flag_version to end of file */
-        __le32 flag_version;    /* 0:15 flags, 16:31 version */
-        __le32 offsets[TRX_MAX_OFFSET]; /* Offsets of partitions from start of
-                                         * header */
-};
 
 static int check_file(const u8 *headers)
 {
@@ -1094,11 +1148,24 @@ error:
         return NULL;
 }
 
+static void brcmf_usb_wowl_config(struct device *dev, bool enabled)
+{
+        struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
+
+        brcmf_dbg(USB, "Configuring WOWL, enabled=%d\n", enabled);
+        devinfo->wowl_enabled = enabled;
+        if (enabled)
+                device_set_wakeup_enable(devinfo->dev, true);
+        else
+                device_set_wakeup_enable(devinfo->dev, false);
+}
+
 static struct brcmf_bus_ops brcmf_usb_bus_ops = {
         .txdata = brcmf_usb_tx,
         .stop = brcmf_usb_down,
         .txctl = brcmf_usb_tx_ctlpkt,
         .rxctl = brcmf_usb_rx_ctlpkt,
+        .wowl_config = brcmf_usb_wowl_config,
 };
 
 static int brcmf_usb_bus_setup(struct brcmf_usbdev_info *devinfo)
@@ -1186,6 +1253,9 @@ static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo)
         bus->ops = &brcmf_usb_bus_ops;
         bus->proto_type = BRCMF_PROTO_BCDC;
         bus->always_use_fws_queue = true;
+#ifdef CONFIG_PM
+        bus->wowl_supported = true;
+#endif
 
         if (!brcmf_usb_dlneeded(devinfo)) {
                 ret = brcmf_usb_bus_setup(devinfo);
@@ -1339,7 +1409,10 @@ static int brcmf_usb_suspend(struct usb_interface *intf, pm_message_t state)
 
         brcmf_dbg(USB, "Enter\n");
         devinfo->bus_pub.state = BRCMFMAC_USB_STATE_SLEEP;
-        brcmf_detach(&usb->dev);
+        if (devinfo->wowl_enabled)
+                brcmf_cancel_all_urbs(devinfo);
+        else
+                brcmf_detach(&usb->dev);
         return 0;
 }
 
@@ -1352,7 +1425,12 @@ static int brcmf_usb_resume(struct usb_interface *intf)
         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
 
         brcmf_dbg(USB, "Enter\n");
-        return brcmf_usb_bus_setup(devinfo);
+        if (!devinfo->wowl_enabled)
+                return brcmf_usb_bus_setup(devinfo);
+
+        devinfo->bus_pub.state = BRCMFMAC_USB_STATE_UP;
+        brcmf_usb_rx_fill_all(devinfo);
+        return 0;
 }
 
 static int brcmf_usb_reset_resume(struct usb_interface *intf)
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb_rdl.h b/drivers/net/wireless/brcm80211/brcmfmac/usb_rdl.h
deleted file mode 100644
index 0a35c51c3da2..000000000000
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb_rdl.h
+++ /dev/null
@@ -1,75 +0,0 @@
-/*
- * Copyright (c) 2011 Broadcom Corporation
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#ifndef _USB_RDL_H
-#define _USB_RDL_H
-
-/* Control messages: bRequest values */
-#define DL_GETSTATE     0       /* returns the rdl_state_t struct */
-#define DL_CHECK_CRC    1       /* currently unused */
-#define DL_GO           2       /* execute downloaded image */
-#define DL_START        3       /* initialize dl state */
-#define DL_REBOOT       4       /* reboot the device in 2 seconds */
-#define DL_GETVER       5       /* returns the bootrom_id_t struct */
-#define DL_GO_PROTECTED 6       /* execute the downloaded code and set reset
-                                 * event to occur in 2 seconds.  It is the
-                                 * responsibility of the downloaded code to
-                                 * clear this event
-                                 */
-#define DL_EXEC         7       /* jump to a supplied address */
-#define DL_RESETCFG     8       /* To support single enum on dongle
-                                 * - Not used by bootloader
-                                 */
-#define DL_DEFER_RESP_OK 9      /* Potentially defer the response to setup
-                                 * if resp unavailable
-                                 */
-
-/* states */
-#define DL_WAITING      0       /* waiting to rx first pkt */
-#define DL_READY        1       /* hdr was good, waiting for more of the
-                                 * compressed image */
-#define DL_BAD_HDR      2       /* hdr was corrupted */
-#define DL_BAD_CRC      3       /* compressed image was corrupted */
-#define DL_RUNNABLE     4       /* download was successful,waiting for go cmd */
-#define DL_START_FAIL   5       /* failed to initialize correctly */
-#define DL_NVRAM_TOOBIG 6       /* host specified nvram data exceeds DL_NVRAM
-                                 * value */
-#define DL_IMAGE_TOOBIG 7       /* download image too big (exceeds DATA_START
-                                 *  for rdl) */
-
-struct rdl_state_le {
-        __le32 state;
-        __le32 bytes;
-};
-
-struct bootrom_id_le {
-        __le32 chip;    /* Chip id */
-        __le32 chiprev; /* Chip rev */
-        __le32 ramsize; /* Size of  RAM */
-        __le32 remapbase;       /* Current remap base address */
-        __le32 boardtype;       /* Type of board */
-        __le32 boardrev;        /* Board revision */
-};
-
-#define RDL_CHUNK       1500  /* size of each dl transfer */
-
-#define TRX_OFFSETS_DLFWLEN_IDX 0
-#define TRX_OFFSETS_JUMPTO_IDX  1
-#define TRX_OFFSETS_NVM_LEN_IDX 2
-
-#define TRX_OFFSETS_DLBASE_IDX  0
-
-#endif  /* _USB_RDL_H */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
index 5960d827508c..222f26a39642 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
@@ -20,10 +20,10 @@
 
 #include <brcmu_wifi.h>
 #include "fwil_types.h"
-#include "dhd.h"
+#include "core.h"
 #include "p2p.h"
-#include "dhd_dbg.h"
-#include "wl_cfg80211.h"
+#include "debug.h"
+#include "cfg80211.h"
 #include "vendor.h"
 #include "fwil.h"
 
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/debug.c b/drivers/net/wireless/brcm80211/brcmsmac/debug.c
index a5d4add26f41..19740c1b1566 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/debug.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/debug.c
@@ -71,48 +71,148 @@ struct dentry *brcms_debugfs_get_devdir(struct brcms_pub *drvr)
 }
 
 static
-ssize_t brcms_debugfs_hardware_read(struct file *f, char __user *data,
-                                        size_t count, loff_t *ppos)
+int brcms_debugfs_hardware_read(struct seq_file *s, void *data)
 {
-        char buf[128];
-        int res;
-        struct brcms_pub *drvr = f->private_data;
-
-        /* only allow read from start */
-        if (*ppos > 0)
-                return 0;
-
-        res = scnprintf(buf, sizeof(buf),
-                "board vendor: %x\n"
-                "board type: %x\n"
-                "board revision: %x\n"
-                "board flags: %x\n"
-                "board flags2: %x\n"
-                "firmware revision: %x\n",
-                drvr->wlc->hw->d11core->bus->boardinfo.vendor,
-                drvr->wlc->hw->d11core->bus->boardinfo.type,
-                drvr->wlc->hw->boardrev,
-                drvr->wlc->hw->boardflags,
-                drvr->wlc->hw->boardflags2,
-                drvr->wlc->ucode_rev
-                );
-
-        return simple_read_from_buffer(data, count, ppos, buf, res);
+        struct brcms_pub *drvr = s->private;
+
+        seq_printf(s, "board vendor: %x\n"
+                   "board type: %x\n"
+                   "board revision: %x\n"
+                   "board flags: %x\n"
+                   "board flags2: %x\n"
+                   "firmware revision: %x\n",
+                   drvr->wlc->hw->d11core->bus->boardinfo.vendor,
+                   drvr->wlc->hw->d11core->bus->boardinfo.type,
+                   drvr->wlc->hw->boardrev,
+                   drvr->wlc->hw->boardflags,
+                   drvr->wlc->hw->boardflags2,
+                   drvr->wlc->ucode_rev);
+
+        return 0;
+}
+
+static int brcms_debugfs_macstat_read(struct seq_file *s, void *data)
+{
+        struct brcms_pub *drvr = s->private;
+        struct brcms_info *wl = drvr->ieee_hw->priv;
+        struct macstat stats;
+        int i;
+
+        spin_lock_bh(&wl->lock);
+        stats = *(drvr->wlc->core->macstat_snapshot);
+        spin_unlock_bh(&wl->lock);
+
+        seq_printf(s, "txallfrm: %d\n", stats.txallfrm);
+        seq_printf(s, "txrtsfrm: %d\n", stats.txrtsfrm);
+        seq_printf(s, "txctsfrm: %d\n", stats.txctsfrm);
+        seq_printf(s, "txackfrm: %d\n", stats.txackfrm);
+        seq_printf(s, "txdnlfrm: %d\n", stats.txdnlfrm);
+        seq_printf(s, "txbcnfrm: %d\n", stats.txbcnfrm);
+        seq_printf(s, "txfunfl[8]:");
+        for (i = 0; i < ARRAY_SIZE(stats.txfunfl); i++)
+                seq_printf(s, " %d", stats.txfunfl[i]);
+        seq_printf(s, "\ntxtplunfl: %d\n", stats.txtplunfl);
+        seq_printf(s, "txphyerr: %d\n", stats.txphyerr);
+        seq_printf(s, "pktengrxducast: %d\n", stats.pktengrxducast);
+        seq_printf(s, "pktengrxdmcast: %d\n", stats.pktengrxdmcast);
+        seq_printf(s, "rxfrmtoolong: %d\n", stats.rxfrmtoolong);
+        seq_printf(s, "rxfrmtooshrt: %d\n", stats.rxfrmtooshrt);
+        seq_printf(s, "rxinvmachdr: %d\n", stats.rxinvmachdr);
+        seq_printf(s, "rxbadfcs: %d\n", stats.rxbadfcs);
+        seq_printf(s, "rxbadplcp: %d\n", stats.rxbadplcp);
+        seq_printf(s, "rxcrsglitch: %d\n", stats.rxcrsglitch);
+        seq_printf(s, "rxstrt: %d\n", stats.rxstrt);
+        seq_printf(s, "rxdfrmucastmbss: %d\n", stats.rxdfrmucastmbss);
+        seq_printf(s, "rxmfrmucastmbss: %d\n", stats.rxmfrmucastmbss);
+        seq_printf(s, "rxcfrmucast: %d\n", stats.rxcfrmucast);
+        seq_printf(s, "rxrtsucast: %d\n", stats.rxrtsucast);
+        seq_printf(s, "rxctsucast: %d\n", stats.rxctsucast);
+        seq_printf(s, "rxackucast: %d\n", stats.rxackucast);
+        seq_printf(s, "rxdfrmocast: %d\n", stats.rxdfrmocast);
+        seq_printf(s, "rxmfrmocast: %d\n", stats.rxmfrmocast);
+        seq_printf(s, "rxcfrmocast: %d\n", stats.rxcfrmocast);
+        seq_printf(s, "rxrtsocast: %d\n", stats.rxrtsocast);
+        seq_printf(s, "rxctsocast: %d\n", stats.rxctsocast);
+        seq_printf(s, "rxdfrmmcast: %d\n", stats.rxdfrmmcast);
+        seq_printf(s, "rxmfrmmcast: %d\n", stats.rxmfrmmcast);
+        seq_printf(s, "rxcfrmmcast: %d\n", stats.rxcfrmmcast);
+        seq_printf(s, "rxbeaconmbss: %d\n", stats.rxbeaconmbss);
+        seq_printf(s, "rxdfrmucastobss: %d\n", stats.rxdfrmucastobss);
+        seq_printf(s, "rxbeaconobss: %d\n", stats.rxbeaconobss);
+        seq_printf(s, "rxrsptmout: %d\n", stats.rxrsptmout);
+        seq_printf(s, "bcntxcancl: %d\n", stats.bcntxcancl);
+        seq_printf(s, "rxf0ovfl: %d\n", stats.rxf0ovfl);
+        seq_printf(s, "rxf1ovfl: %d\n", stats.rxf1ovfl);
+        seq_printf(s, "rxf2ovfl: %d\n", stats.rxf2ovfl);
+        seq_printf(s, "txsfovfl: %d\n", stats.txsfovfl);
+        seq_printf(s, "pmqovfl: %d\n", stats.pmqovfl);
+        seq_printf(s, "rxcgprqfrm: %d\n", stats.rxcgprqfrm);
+        seq_printf(s, "rxcgprsqovfl: %d\n", stats.rxcgprsqovfl);
+        seq_printf(s, "txcgprsfail: %d\n", stats.txcgprsfail);
+        seq_printf(s, "txcgprssuc: %d\n", stats.txcgprssuc);
+        seq_printf(s, "prs_timeout: %d\n", stats.prs_timeout);
+        seq_printf(s, "rxnack: %d\n", stats.rxnack);
+        seq_printf(s, "frmscons: %d\n", stats.frmscons);
+        seq_printf(s, "txnack: %d\n", stats.txnack);
+        seq_printf(s, "txglitch_nack: %d\n", stats.txglitch_nack);
+        seq_printf(s, "txburst: %d\n", stats.txburst);
+        seq_printf(s, "bphy_rxcrsglitch: %d\n", stats.bphy_rxcrsglitch);
+        seq_printf(s, "phywatchdog: %d\n", stats.phywatchdog);
+        seq_printf(s, "bphy_badplcp: %d\n", stats.bphy_badplcp);
+        return 0;
+}
+
+struct brcms_debugfs_entry {
+        int (*read)(struct seq_file *seq, void *data);
+        struct brcms_pub *drvr;
+};
+
+static int brcms_debugfs_entry_open(struct inode *inode, struct file *f)
+{
+        struct brcms_debugfs_entry *entry = inode->i_private;
+
+        return single_open(f, entry->read, entry->drvr);
 }
 
-static const struct file_operations brcms_debugfs_hardware_ops = {
+static const struct file_operations brcms_debugfs_def_ops = {
         .owner = THIS_MODULE,
-        .open = simple_open,
-        .read = brcms_debugfs_hardware_read
+        .open = brcms_debugfs_entry_open,
+        .release = single_release,
+        .read = seq_read,
+        .llseek = seq_lseek
 };
 
+static int
+brcms_debugfs_add_entry(struct brcms_pub *drvr, const char *fn,
+                        int (*read_fn)(struct seq_file *seq, void *data))
+{
+        struct device *dev = &drvr->wlc->hw->d11core->dev;
+        struct dentry *dentry =  drvr->dbgfs_dir;
+        struct brcms_debugfs_entry *entry;
+
+        if (IS_ERR_OR_NULL(dentry))
+                return -ENOENT;
+
+        entry = devm_kzalloc(dev, sizeof(*entry), GFP_KERNEL);
+        if (!entry)
+                return -ENOMEM;
+
+        entry->read = read_fn;
+        entry->drvr = drvr;
+
+        dentry = debugfs_create_file(fn, S_IRUGO, dentry, entry,
+                                     &brcms_debugfs_def_ops);
+
+        return PTR_ERR_OR_ZERO(dentry);
+}
+
 void brcms_debugfs_create_files(struct brcms_pub *drvr)
 {
-        struct dentry *dentry = drvr->dbgfs_dir;
+        if (IS_ERR_OR_NULL(drvr->dbgfs_dir))
+                return;
 
-        if (!IS_ERR_OR_NULL(dentry))
-                debugfs_create_file("hardware", S_IRUGO, dentry,
-                                    drvr, &brcms_debugfs_hardware_ops);
+        brcms_debugfs_add_entry(drvr, "hardware", brcms_debugfs_hardware_read);
+        brcms_debugfs_add_entry(drvr, "macstat", brcms_debugfs_macstat_read);
 }
 
 #define __brcms_fn(fn)                                          \
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index 43c71bfaa474..f95b52442281 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -764,7 +764,9 @@ brcms_ops_configure_filter(struct ieee80211_hw *hw,
         return;
 }
 
-static void brcms_ops_sw_scan_start(struct ieee80211_hw *hw)
+static void brcms_ops_sw_scan_start(struct ieee80211_hw *hw,
+                                    struct ieee80211_vif *vif,
+                                    const u8 *mac_addr)
 {
         struct brcms_info *wl = hw->priv;
         spin_lock_bh(&wl->lock);
@@ -773,7 +775,8 @@ static void brcms_ops_sw_scan_start(struct ieee80211_hw *hw)
         return;
 }
 
-static void brcms_ops_sw_scan_complete(struct ieee80211_hw *hw)
+static void brcms_ops_sw_scan_complete(struct ieee80211_hw *hw,
+                                       struct ieee80211_vif *vif)
 {
         struct brcms_info *wl = hw->priv;
         spin_lock_bh(&wl->lock);
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index 1b474828d5b8..738cfaca1e0f 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -1009,8 +1009,7 @@ brcms_c_dotxstatus(struct brcms_c_info *wlc, struct tx_status *txs)
                 if (txh)
                         trace_brcms_txdesc(&wlc->hw->d11core->dev, txh,
                                            sizeof(*txh));
-                if (p)
-                        brcmu_pkt_buf_free_skb(p);
+                brcmu_pkt_buf_free_skb(p);
         }
 
         if (dma && queue < NFIFO) {
@@ -3081,7 +3080,7 @@ static bool brcms_c_ps_allowed(struct brcms_c_info *wlc)
 static void brcms_c_statsupd(struct brcms_c_info *wlc)
 {
         int i;
-        struct macstat macstats;
+        struct macstat *macstats;
 #ifdef DEBUG
         u16 delta;
         u16 rxf0ovfl;
@@ -3092,31 +3091,31 @@ static void brcms_c_statsupd(struct brcms_c_info *wlc)
         if (!wlc->pub->up)
                 return;
 
+        macstats = wlc->core->macstat_snapshot;
+
 #ifdef DEBUG
         /* save last rx fifo 0 overflow count */
-        rxf0ovfl = wlc->core->macstat_snapshot->rxf0ovfl;
+        rxf0ovfl = macstats->rxf0ovfl;
 
         /* save last tx fifo  underflow count */
         for (i = 0; i < NFIFO; i++)
-                txfunfl[i] = wlc->core->macstat_snapshot->txfunfl[i];
+                txfunfl[i] = macstats->txfunfl[i];
 #endif                          /* DEBUG */
 
         /* Read mac stats from contiguous shared memory */
-        brcms_b_copyfrom_objmem(wlc->hw, M_UCODE_MACSTAT, &macstats,
-                                sizeof(struct macstat), OBJADDR_SHM_SEL);
+        brcms_b_copyfrom_objmem(wlc->hw, M_UCODE_MACSTAT, macstats,
+                                sizeof(*macstats), OBJADDR_SHM_SEL);
 
 #ifdef DEBUG
         /* check for rx fifo 0 overflow */
-        delta = (u16) (wlc->core->macstat_snapshot->rxf0ovfl - rxf0ovfl);
+        delta = (u16)(macstats->rxf0ovfl - rxf0ovfl);
         if (delta)
                 brcms_err(wlc->hw->d11core, "wl%d: %u rx fifo 0 overflows!\n",
                           wlc->pub->unit, delta);
 
         /* check for tx fifo underflows */
         for (i = 0; i < NFIFO; i++) {
-                delta =
-                    (u16) (wlc->core->macstat_snapshot->txfunfl[i] -
-                              txfunfl[i]);
+                delta = macstats->txfunfl[i] - txfunfl[i];
                 if (delta)
                         brcms_err(wlc->hw->d11core,
                                   "wl%d: %u tx fifo %d underflows!\n",
diff --git a/drivers/net/wireless/cw1200/scan.c b/drivers/net/wireless/cw1200/scan.c
index b2fb6c632092..f2e276faca70 100644
--- a/drivers/net/wireless/cw1200/scan.c
+++ b/drivers/net/wireless/cw1200/scan.c
@@ -78,7 +78,7 @@ int cw1200_hw_scan(struct ieee80211_hw *hw,
         if (req->n_ssids > WSM_SCAN_MAX_NUM_OF_SSIDS)
                 return -EINVAL;
 
-        frame.skb = ieee80211_probereq_get(hw, priv->vif, NULL, 0,
+        frame.skb = ieee80211_probereq_get(hw, priv->vif->addr, NULL, 0,
                 req->ie_len);
         if (!frame.skb)
                 return -ENOMEM;
diff --git a/drivers/net/wireless/hostap/hostap_proc.c b/drivers/net/wireless/hostap/hostap_proc.c
index 8efd17c52f65..dd84557cf957 100644
--- a/drivers/net/wireless/hostap/hostap_proc.c
+++ b/drivers/net/wireless/hostap/hostap_proc.c
@@ -168,7 +168,6 @@ static int prism2_bss_list_proc_show(struct seq_file *m, void *v)
         local_info_t *local = m->private;
         struct list_head *ptr = v;
         struct hostap_bss_info *bss;
-        int i;
 
         if (ptr == &local->bss_list) {
                 seq_printf(m, "#BSSID\tlast_update\tcount\tcapab_info\tSSID(txt)\t"
@@ -181,9 +180,7 @@ static int prism2_bss_list_proc_show(struct seq_file *m, void *v)
                    bss->bssid, bss->last_update,
                    bss->count, bss->capab_info);
 
-        for (i = 0; i < bss->ssid_len; i++)
-                seq_putc(m,bss->ssid[i] >= 32 && bss->ssid[i] < 127 ?
-                           bss->ssid[i] : '_');
+        seq_printf(m, "%*pE", (int)bss->ssid_len, bss->ssid);
 
         seq_putc(m, '\t');
         seq_printf(m, "%*phN", (int)bss->ssid_len, bss->ssid);
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index c3d726f334e3..6fabea0309dd 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -2005,7 +2005,6 @@ static void isr_indicate_associated(struct ipw2100_priv *priv, u32 status)
         u32 chan;
         char *txratename;
         u8 bssid[ETH_ALEN];
-        DECLARE_SSID_BUF(ssid);
 
         /*
          * TBD: BSSID is usually 00:00:00:00:00:00 here and not
@@ -2067,8 +2066,8 @@ static void isr_indicate_associated(struct ipw2100_priv *priv, u32 status)
                 break;
         }
 
-        IPW_DEBUG_INFO("%s: Associated with '%s' at %s, channel %d (BSSID=%pM)\n",
-                       priv->net_dev->name, print_ssid(ssid, essid, essid_len),
+        IPW_DEBUG_INFO("%s: Associated with '%*pE' at %s, channel %d (BSSID=%pM)\n",
+                       priv->net_dev->name, essid_len, essid,
                        txratename, chan, bssid);
 
         /* now we copy read ssid into dev */
@@ -2095,9 +2094,8 @@ static int ipw2100_set_essid(struct ipw2100_priv *priv, char *essid,
                 .host_command_length = ssid_len
         };
         int err;
-        DECLARE_SSID_BUF(ssid);
 
-        IPW_DEBUG_HC("SSID: '%s'\n", print_ssid(ssid, essid, ssid_len));
+        IPW_DEBUG_HC("SSID: '%*pE'\n", ssid_len, essid);
 
         if (ssid_len)
                 memcpy(cmd.host_command_parameters, essid, ssid_len);
@@ -2138,11 +2136,8 @@ static int ipw2100_set_essid(struct ipw2100_priv *priv, char *essid,
 
 static void isr_indicate_association_lost(struct ipw2100_priv *priv, u32 status)
 {
-        DECLARE_SSID_BUF(ssid);
-
         IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE | IPW_DL_ASSOC,
-                  "disassociated: '%s' %pM\n",
-                  print_ssid(ssid, priv->essid, priv->essid_len),
+                  "disassociated: '%*pE' %pM\n", priv->essid_len, priv->essid,
                   priv->bssid);
 
         priv->status &= ~(STATUS_ASSOCIATED | STATUS_ASSOCIATING);
@@ -6975,7 +6970,6 @@ static int ipw2100_wx_set_essid(struct net_device *dev,
         char *essid = "";       /* ANY */
         int length = 0;
         int err = 0;
-        DECLARE_SSID_BUF(ssid);
 
         mutex_lock(&priv->action_mutex);
         if (!(priv->status & STATUS_INITIALIZED)) {
@@ -7005,8 +6999,7 @@ static int ipw2100_wx_set_essid(struct net_device *dev,
                 goto done;
         }
 
-        IPW_DEBUG_WX("Setting ESSID: '%s' (%d)\n",
-                     print_ssid(ssid, essid, length), length);
+        IPW_DEBUG_WX("Setting ESSID: '%*pE' (%d)\n", length, essid, length);
 
         priv->essid_len = length;
         memcpy(priv->essid, essid, priv->essid_len);
@@ -7027,13 +7020,12 @@ static int ipw2100_wx_get_essid(struct net_device *dev,
          */
 
         struct ipw2100_priv *priv = libipw_priv(dev);
-        DECLARE_SSID_BUF(ssid);
 
         /* If we are associated, trying to associate, or have a statically
          * configured ESSID then return that; otherwise return ANY */
         if (priv->config & CFG_STATIC_ESSID || priv->status & STATUS_ASSOCIATED) {
-                IPW_DEBUG_WX("Getting essid: '%s'\n",
-                             print_ssid(ssid, priv->essid, priv->essid_len));
+                IPW_DEBUG_WX("Getting essid: '%*pE'\n",
+                             priv->essid_len, priv->essid);
                 memcpy(extra, priv->essid, priv->essid_len);
                 wrqu->essid.length = priv->essid_len;
                 wrqu->essid.flags = 1;  /* active */
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index f0c3c77a48d3..67cad9b05ad8 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -1363,7 +1363,7 @@ static ssize_t show_cmd_log(struct device *d,
         if (!priv->cmdlog)
                 return 0;
         for (i = (priv->cmdlog_pos + 1) % priv->cmdlog_len;
-             (i != priv->cmdlog_pos) && (PAGE_SIZE - len);
+             (i != priv->cmdlog_pos) && (len < PAGE_SIZE);
              i = (i + 1) % priv->cmdlog_len) {
                 len +=
                     snprintf(buf + len, PAGE_SIZE - len,
@@ -4496,7 +4496,6 @@ static void handle_scan_event(struct ipw_priv *priv)
 static void ipw_rx_notification(struct ipw_priv *priv,
                                        struct ipw_rx_notification *notif)
 {
-        DECLARE_SSID_BUF(ssid);
         u16 size = le16_to_cpu(notif->size);
 
         IPW_DEBUG_NOTIF("type = %i (%d bytes)\n", notif->subtype, size);
@@ -4509,9 +4508,8 @@ static void ipw_rx_notification(struct ipw_priv *priv,
                         case CMAS_ASSOCIATED:{
                                         IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
                                                   IPW_DL_ASSOC,
-                                                  "associated: '%s' %pM\n",
-                                                  print_ssid(ssid, priv->essid,
-                                                             priv->essid_len),
+                                                  "associated: '%*pE' %pM\n",
+                                                  priv->essid_len, priv->essid,
                                                   priv->bssid);
 
                                         switch (priv->ieee->iw_mode) {
@@ -4585,14 +4583,9 @@ static void ipw_rx_notification(struct ipw_priv *priv,
                                                 IPW_DEBUG(IPW_DL_NOTIF |
                                                           IPW_DL_STATE |
                                                           IPW_DL_ASSOC,
-                                                          "deauthenticated: '%s' "
-                                                          "%pM"
-                                                          ": (0x%04X) - %s\n",
-                                                          print_ssid(ssid,
-                                                                     priv->
-                                                                     essid,
-                                                                     priv->
-                                                                     essid_len),
+                                                          "deauthenticated: '%*pE' %pM: (0x%04X) - %s\n",
+                                                          priv->essid_len,
+                                                          priv->essid,
                                                           priv->bssid,
                                                           le16_to_cpu(auth->status),
                                                           ipw_get_status_code
@@ -4610,9 +4603,8 @@ static void ipw_rx_notification(struct ipw_priv *priv,
 
                                         IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
                                                   IPW_DL_ASSOC,
-                                                  "authenticated: '%s' %pM\n",
-                                                  print_ssid(ssid, priv->essid,
-                                                             priv->essid_len),
+                                                  "authenticated: '%*pE' %pM\n",
+                                                  priv->essid_len, priv->essid,
                                                   priv->bssid);
                                         break;
                                 }
@@ -4638,9 +4630,8 @@ static void ipw_rx_notification(struct ipw_priv *priv,
 
                                         IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
                                                   IPW_DL_ASSOC,
-                                                  "disassociated: '%s' %pM\n",
-                                                  print_ssid(ssid, priv->essid,
-                                                             priv->essid_len),
+                                                  "disassociated: '%*pE' %pM\n",
+                                                  priv->essid_len, priv->essid,
                                                   priv->bssid);
 
                                         priv->status &=
@@ -4676,9 +4667,8 @@ static void ipw_rx_notification(struct ipw_priv *priv,
                         switch (auth->state) {
                         case CMAS_AUTHENTICATED:
                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE,
-                                          "authenticated: '%s' %pM\n",
-                                          print_ssid(ssid, priv->essid,
-                                                     priv->essid_len),
+                                          "authenticated: '%*pE' %pM\n",
+                                          priv->essid_len, priv->essid,
                                           priv->bssid);
                                 priv->status |= STATUS_AUTH;
                                 break;
@@ -4695,9 +4685,8 @@ static void ipw_rx_notification(struct ipw_priv *priv,
                                 }
                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
                                           IPW_DL_ASSOC,
-                                          "deauthenticated: '%s' %pM\n",
-                                          print_ssid(ssid, priv->essid,
-                                                     priv->essid_len),
+                                          "deauthenticated: '%*pE' %pM\n",
+                                          priv->essid_len, priv->essid,
                                           priv->bssid);
 
                                 priv->status &= ~(STATUS_ASSOCIATING |
@@ -5516,16 +5505,13 @@ static int ipw_find_adhoc_network(struct ipw_priv *priv,
                                   int roaming)
 {
         struct ipw_supported_rates rates;
-        DECLARE_SSID_BUF(ssid);
 
         /* Verify that this network's capability is compatible with the
          * current mode (AdHoc or Infrastructure) */
         if ((priv->ieee->iw_mode == IW_MODE_ADHOC &&
              !(network->capability & WLAN_CAPABILITY_IBSS))) {
-                IPW_DEBUG_MERGE("Network '%s (%pM)' excluded due to "
-                                "capability mismatch.\n",
-                                print_ssid(ssid, network->ssid,
-                                           network->ssid_len),
+                IPW_DEBUG_MERGE("Network '%*pE (%pM)' excluded due to capability mismatch.\n",
+                                network->ssid_len, network->ssid,
                                 network->bssid);
                 return 0;
         }
@@ -5536,10 +5522,8 @@ static int ipw_find_adhoc_network(struct ipw_priv *priv,
                 if ((network->ssid_len != match->network->ssid_len) ||
                     memcmp(network->ssid, match->network->ssid,
                            network->ssid_len)) {
-                        IPW_DEBUG_MERGE("Network '%s (%pM)' excluded "
-                                        "because of non-network ESSID.\n",
-                                        print_ssid(ssid, network->ssid,
-                                                   network->ssid_len),
+                        IPW_DEBUG_MERGE("Network '%*pE (%pM)' excluded because of non-network ESSID.\n",
+                                        network->ssid_len, network->ssid,
                                         network->bssid);
                         return 0;
                 }
@@ -5550,17 +5534,10 @@ static int ipw_find_adhoc_network(struct ipw_priv *priv,
                     ((network->ssid_len != priv->essid_len) ||
                      memcmp(network->ssid, priv->essid,
                             min(network->ssid_len, priv->essid_len)))) {
-                        char escaped[IW_ESSID_MAX_SIZE * 2 + 1];
-
-                        strlcpy(escaped,
-                                print_ssid(ssid, network->ssid,
-                                           network->ssid_len),
-                                sizeof(escaped));
-                        IPW_DEBUG_MERGE("Network '%s (%pM)' excluded "
-                                        "because of ESSID mismatch: '%s'.\n",
-                                        escaped, network->bssid,
-                                        print_ssid(ssid, priv->essid,
-                                                   priv->essid_len));
+                        IPW_DEBUG_MERGE("Network '%*pE (%pM)' excluded because of ESSID mismatch: '%*pE'.\n",
+                                        network->ssid_len, network->ssid,
+                                        network->bssid, priv->essid_len,
+                                        priv->essid);
                         return 0;
                 }
         }
@@ -5569,26 +5546,20 @@ static int ipw_find_adhoc_network(struct ipw_priv *priv,
          * testing everything else. */
 
         if (network->time_stamp[0] < match->network->time_stamp[0]) {
-                IPW_DEBUG_MERGE("Network '%s excluded because newer than "
-                                "current network.\n",
-                                print_ssid(ssid, match->network->ssid,
-                                           match->network->ssid_len));
+                IPW_DEBUG_MERGE("Network '%*pE excluded because newer than current network.\n",
+                                match->network->ssid_len, match->network->ssid);
                 return 0;
         } else if (network->time_stamp[1] < match->network->time_stamp[1]) {
-                IPW_DEBUG_MERGE("Network '%s excluded because newer than "
-                                "current network.\n",
-                                print_ssid(ssid, match->network->ssid,
-                                           match->network->ssid_len));
+                IPW_DEBUG_MERGE("Network '%*pE excluded because newer than current network.\n",
+                                match->network->ssid_len, match->network->ssid);
                 return 0;
         }
 
         /* Now go through and see if the requested network is valid... */
         if (priv->ieee->scan_age != 0 &&
             time_after(jiffies, network->last_scanned + priv->ieee->scan_age)) {
-                IPW_DEBUG_MERGE("Network '%s (%pM)' excluded "
-                                "because of age: %ums.\n",
-                                print_ssid(ssid, network->ssid,
-                                           network->ssid_len),
+                IPW_DEBUG_MERGE("Network '%*pE (%pM)' excluded because of age: %ums.\n",
+                                network->ssid_len, network->ssid,
                                 network->bssid,
                                 jiffies_to_msecs(jiffies -
                                                  network->last_scanned));
@@ -5597,10 +5568,8 @@ static int ipw_find_adhoc_network(struct ipw_priv *priv,
 
         if ((priv->config & CFG_STATIC_CHANNEL) &&
             (network->channel != priv->channel)) {
-                IPW_DEBUG_MERGE("Network '%s (%pM)' excluded "
-                                "because of channel mismatch: %d != %d.\n",
-                                print_ssid(ssid, network->ssid,
-                                           network->ssid_len),
+                IPW_DEBUG_MERGE("Network '%*pE (%pM)' excluded because of channel mismatch: %d != %d.\n",
+                                network->ssid_len, network->ssid,
                                 network->bssid,
                                 network->channel, priv->channel);
                 return 0;
@@ -5609,10 +5578,8 @@ static int ipw_find_adhoc_network(struct ipw_priv *priv,
         /* Verify privacy compatibility */
         if (((priv->capability & CAP_PRIVACY_ON) ? 1 : 0) !=
             ((network->capability & WLAN_CAPABILITY_PRIVACY) ? 1 : 0)) {
-                IPW_DEBUG_MERGE("Network '%s (%pM)' excluded "
-                                "because of privacy mismatch: %s != %s.\n",
-                                print_ssid(ssid, network->ssid,
-                                           network->ssid_len),
+                IPW_DEBUG_MERGE("Network '%*pE (%pM)' excluded because of privacy mismatch: %s != %s.\n",
+                                network->ssid_len, network->ssid,
                                 network->bssid,
                                 priv->
                                 capability & CAP_PRIVACY_ON ? "on" : "off",
@@ -5623,22 +5590,16 @@ static int ipw_find_adhoc_network(struct ipw_priv *priv,
         }
 
         if (ether_addr_equal(network->bssid, priv->bssid)) {
-                IPW_DEBUG_MERGE("Network '%s (%pM)' excluded "
-                                "because of the same BSSID match: %pM"
-                                ".\n", print_ssid(ssid, network->ssid,
-                                                  network->ssid_len),
-                                network->bssid,
-                                priv->bssid);
+                IPW_DEBUG_MERGE("Network '%*pE (%pM)' excluded because of the same BSSID match: %pM.\n",
+                                network->ssid_len, network->ssid,
+                                network->bssid, priv->bssid);
                 return 0;
         }
 
         /* Filter out any incompatible freq / mode combinations */
         if (!libipw_is_valid_mode(priv->ieee, network->mode)) {
-                IPW_DEBUG_MERGE("Network '%s (%pM)' excluded "
-                                "because of invalid frequency/mode "
-                                "combination.\n",
-                                print_ssid(ssid, network->ssid,
-                                           network->ssid_len),
+                IPW_DEBUG_MERGE("Network '%*pE (%pM)' excluded because of invalid frequency/mode combination.\n",
+                                network->ssid_len, network->ssid,
                                 network->bssid);
                 return 0;
         }
@@ -5646,20 +5607,15 @@ static int ipw_find_adhoc_network(struct ipw_priv *priv,
         /* Ensure that the rates supported by the driver are compatible with
          * this AP, including verification of basic rates (mandatory) */
         if (!ipw_compatible_rates(priv, network, &rates)) {
-                IPW_DEBUG_MERGE("Network '%s (%pM)' excluded "
-                                "because configured rate mask excludes "
-                                "AP mandatory rate.\n",
-                                print_ssid(ssid, network->ssid,
-                                           network->ssid_len),
+                IPW_DEBUG_MERGE("Network '%*pE (%pM)' excluded because configured rate mask excludes AP mandatory rate.\n",
+                                network->ssid_len, network->ssid,
                                 network->bssid);
                 return 0;
         }
 
         if (rates.num_rates == 0) {
-                IPW_DEBUG_MERGE("Network '%s (%pM)' excluded "
-                                "because of no compatible rates.\n",
-                                print_ssid(ssid, network->ssid,
-                                           network->ssid_len),
+                IPW_DEBUG_MERGE("Network '%*pE (%pM)' excluded because of no compatible rates.\n",
+                                network->ssid_len, network->ssid,
                                 network->bssid);
                 return 0;
         }
@@ -5671,16 +5627,14 @@ static int ipw_find_adhoc_network(struct ipw_priv *priv,
         /* Set up 'new' AP to this network */
         ipw_copy_rates(&match->rates, &rates);
         match->network = network;
-        IPW_DEBUG_MERGE("Network '%s (%pM)' is a viable match.\n",
-                        print_ssid(ssid, network->ssid, network->ssid_len),
-                        network->bssid);
+        IPW_DEBUG_MERGE("Network '%*pE (%pM)' is a viable match.\n",
+                        network->ssid_len, network->ssid, network->bssid);
 
         return 1;
 }
 
 static void ipw_merge_adhoc_network(struct work_struct *work)
 {
-        DECLARE_SSID_BUF(ssid);
         struct ipw_priv *priv =
                 container_of(work, struct ipw_priv, merge_networks);
         struct libipw_network *network = NULL;
@@ -5710,9 +5664,8 @@ static void ipw_merge_adhoc_network(struct work_struct *work)
 
                 mutex_lock(&priv->mutex);
                 if ((priv->ieee->iw_mode == IW_MODE_ADHOC)) {
-                        IPW_DEBUG_MERGE("remove network %s\n",
-                                        print_ssid(ssid, priv->essid,
-                                                   priv->essid_len));
+                        IPW_DEBUG_MERGE("remove network %*pE\n",
+                                        priv->essid_len, priv->essid);
                         ipw_remove_current_network(priv);
                 }
 
@@ -5728,7 +5681,6 @@ static int ipw_best_network(struct ipw_priv *priv,
                             struct libipw_network *network, int roaming)
 {
         struct ipw_supported_rates rates;
-        DECLARE_SSID_BUF(ssid);
 
         /* Verify that this network's capability is compatible with the
          * current mode (AdHoc or Infrastructure) */
@@ -5736,10 +5688,8 @@ static int ipw_best_network(struct ipw_priv *priv,
              !(network->capability & WLAN_CAPABILITY_ESS)) ||
             (priv->ieee->iw_mode == IW_MODE_ADHOC &&
              !(network->capability & WLAN_CAPABILITY_IBSS))) {
-                IPW_DEBUG_ASSOC("Network '%s (%pM)' excluded due to "
-                                "capability mismatch.\n",
-                                print_ssid(ssid, network->ssid,
-                                           network->ssid_len),
+                IPW_DEBUG_ASSOC("Network '%*pE (%pM)' excluded due to capability mismatch.\n",
+                                network->ssid_len, network->ssid,
                                 network->bssid);
                 return 0;
         }
@@ -5750,10 +5700,8 @@ static int ipw_best_network(struct ipw_priv *priv,
                 if ((network->ssid_len != match->network->ssid_len) ||
                     memcmp(network->ssid, match->network->ssid,
                            network->ssid_len)) {
-                        IPW_DEBUG_ASSOC("Network '%s (%pM)' excluded "
-                                        "because of non-network ESSID.\n",
-                                        print_ssid(ssid, network->ssid,
-                                                   network->ssid_len),
+                        IPW_DEBUG_ASSOC("Network '%*pE (%pM)' excluded because of non-network ESSID.\n",
+                                        network->ssid_len, network->ssid,
                                         network->bssid);
                         return 0;
                 }
@@ -5764,16 +5712,10 @@ static int ipw_best_network(struct ipw_priv *priv,
                     ((network->ssid_len != priv->essid_len) ||
                      memcmp(network->ssid, priv->essid,
                             min(network->ssid_len, priv->essid_len)))) {
-                        char escaped[IW_ESSID_MAX_SIZE * 2 + 1];
-                        strlcpy(escaped,
-                                print_ssid(ssid, network->ssid,
-                                           network->ssid_len),
-                                sizeof(escaped));
-                        IPW_DEBUG_ASSOC("Network '%s (%pM)' excluded "
-                                        "because of ESSID mismatch: '%s'.\n",
-                                        escaped, network->bssid,
-                                        print_ssid(ssid, priv->essid,
-                                                   priv->essid_len));
+                        IPW_DEBUG_ASSOC("Network '%*pE (%pM)' excluded because of ESSID mismatch: '%*pE'.\n",
+                                        network->ssid_len, network->ssid,
+                                        network->bssid, priv->essid_len,
+                                        priv->essid);
                         return 0;
                 }
         }
@@ -5781,16 +5723,10 @@ static int ipw_best_network(struct ipw_priv *priv,
         /* If the old network rate is better than this one, don't bother
          * testing everything else. */
         if (match->network && match->network->stats.rssi > network->stats.rssi) {
-                char escaped[IW_ESSID_MAX_SIZE * 2 + 1];
-                strlcpy(escaped,
-                        print_ssid(ssid, network->ssid, network->ssid_len),
-                        sizeof(escaped));
-                IPW_DEBUG_ASSOC("Network '%s (%pM)' excluded because "
-                                "'%s (%pM)' has a stronger signal.\n",
-                                escaped, network->bssid,
-                                print_ssid(ssid, match->network->ssid,
-                                           match->network->ssid_len),
-                                match->network->bssid);
+                IPW_DEBUG_ASSOC("Network '%*pE (%pM)' excluded because '%*pE (%pM)' has a stronger signal.\n",
+                                network->ssid_len, network->ssid,
+                                network->bssid, match->network->ssid_len,
+                                match->network->ssid, match->network->bssid);
                 return 0;
         }
 
@@ -5798,11 +5734,8 @@ static int ipw_best_network(struct ipw_priv *priv,
          * last 3 seconds, do not try and associate again... */
         if (network->last_associate &&
             time_after(network->last_associate + (HZ * 3UL), jiffies)) {
-                IPW_DEBUG_ASSOC("Network '%s (%pM)' excluded "
-                                "because of storming (%ums since last "
-                                "assoc attempt).\n",
-                                print_ssid(ssid, network->ssid,
-                                           network->ssid_len),
+                IPW_DEBUG_ASSOC("Network '%*pE (%pM)' excluded because of storming (%ums since last assoc attempt).\n",
+                                network->ssid_len, network->ssid,
                                 network->bssid,
                                 jiffies_to_msecs(jiffies -
                                                  network->last_associate));
@@ -5812,10 +5745,8 @@ static int ipw_best_network(struct ipw_priv *priv,
         /* Now go through and see if the requested network is valid... */
         if (priv->ieee->scan_age != 0 &&
             time_after(jiffies, network->last_scanned + priv->ieee->scan_age)) {
-                IPW_DEBUG_ASSOC("Network '%s (%pM)' excluded "
-                                "because of age: %ums.\n",
-                                print_ssid(ssid, network->ssid,
-                                           network->ssid_len),
+                IPW_DEBUG_ASSOC("Network '%*pE (%pM)' excluded because of age: %ums.\n",
+                                network->ssid_len, network->ssid,
                                 network->bssid,
                                 jiffies_to_msecs(jiffies -
                                                  network->last_scanned));
@@ -5824,10 +5755,8 @@ static int ipw_best_network(struct ipw_priv *priv,
 
         if ((priv->config & CFG_STATIC_CHANNEL) &&
             (network->channel != priv->channel)) {
-                IPW_DEBUG_ASSOC("Network '%s (%pM)' excluded "
-                                "because of channel mismatch: %d != %d.\n",
-                                print_ssid(ssid, network->ssid,
-                                           network->ssid_len),
+                IPW_DEBUG_ASSOC("Network '%*pE (%pM)' excluded because of channel mismatch: %d != %d.\n",
+                                network->ssid_len, network->ssid,
                                 network->bssid,
                                 network->channel, priv->channel);
                 return 0;
@@ -5836,10 +5765,8 @@ static int ipw_best_network(struct ipw_priv *priv,
         /* Verify privacy compatibility */
         if (((priv->capability & CAP_PRIVACY_ON) ? 1 : 0) !=
             ((network->capability & WLAN_CAPABILITY_PRIVACY) ? 1 : 0)) {
-                IPW_DEBUG_ASSOC("Network '%s (%pM)' excluded "
-                                "because of privacy mismatch: %s != %s.\n",
-                                print_ssid(ssid, network->ssid,
-                                           network->ssid_len),
+                IPW_DEBUG_ASSOC("Network '%*pE (%pM)' excluded because of privacy mismatch: %s != %s.\n",
+                                network->ssid_len, network->ssid,
                                 network->bssid,
                                 priv->capability & CAP_PRIVACY_ON ? "on" :
                                 "off",
@@ -5850,31 +5777,24 @@ static int ipw_best_network(struct ipw_priv *priv,
 
         if ((priv->config & CFG_STATIC_BSSID) &&
             !ether_addr_equal(network->bssid, priv->bssid)) {
-                IPW_DEBUG_ASSOC("Network '%s (%pM)' excluded "
-                                "because of BSSID mismatch: %pM.\n",
-                                print_ssid(ssid, network->ssid,
-                                           network->ssid_len),
+                IPW_DEBUG_ASSOC("Network '%*pE (%pM)' excluded because of BSSID mismatch: %pM.\n",
+                                network->ssid_len, network->ssid,
                                 network->bssid, priv->bssid);
                 return 0;
         }
 
         /* Filter out any incompatible freq / mode combinations */
         if (!libipw_is_valid_mode(priv->ieee, network->mode)) {
-                IPW_DEBUG_ASSOC("Network '%s (%pM)' excluded "
-                                "because of invalid frequency/mode "
-                                "combination.\n",
-                                print_ssid(ssid, network->ssid,
-                                           network->ssid_len),
+                IPW_DEBUG_ASSOC("Network '%*pE (%pM)' excluded because of invalid frequency/mode combination.\n",
+                                network->ssid_len, network->ssid,
                                 network->bssid);
                 return 0;
         }
 
         /* Filter out invalid channel in current GEO */
         if (!libipw_is_valid_channel(priv->ieee, network->channel)) {
-                IPW_DEBUG_ASSOC("Network '%s (%pM)' excluded "
-                                "because of invalid channel in current GEO\n",
-                                print_ssid(ssid, network->ssid,
-                                           network->ssid_len),
+                IPW_DEBUG_ASSOC("Network '%*pE (%pM)' excluded because of invalid channel in current GEO\n",
+                                network->ssid_len, network->ssid,
                                 network->bssid);
                 return 0;
         }
@@ -5882,20 +5802,15 @@ static int ipw_best_network(struct ipw_priv *priv,
         /* Ensure that the rates supported by the driver are compatible with
          * this AP, including verification of basic rates (mandatory) */
         if (!ipw_compatible_rates(priv, network, &rates)) {
-                IPW_DEBUG_ASSOC("Network '%s (%pM)' excluded "
-                                "because configured rate mask excludes "
-                                "AP mandatory rate.\n",
-                                print_ssid(ssid, network->ssid,
-                                           network->ssid_len),
+                IPW_DEBUG_ASSOC("Network '%*pE (%pM)' excluded because configured rate mask excludes AP mandatory rate.\n",
+                                network->ssid_len, network->ssid,
                                 network->bssid);
                 return 0;
         }
 
         if (rates.num_rates == 0) {
-                IPW_DEBUG_ASSOC("Network '%s (%pM)' excluded "
-                                "because of no compatible rates.\n",
-                                print_ssid(ssid, network->ssid,
-                                           network->ssid_len),
+                IPW_DEBUG_ASSOC("Network '%*pE (%pM)' excluded because of no compatible rates.\n",
+                                network->ssid_len, network->ssid,
                                 network->bssid);
                 return 0;
         }
@@ -5908,9 +5823,8 @@ static int ipw_best_network(struct ipw_priv *priv,
         ipw_copy_rates(&match->rates, &rates);
         match->network = network;
 
-        IPW_DEBUG_ASSOC("Network '%s (%pM)' is a viable match.\n",
-                        print_ssid(ssid, network->ssid, network->ssid_len),
-                        network->bssid);
+        IPW_DEBUG_ASSOC("Network '%*pE (%pM)' is a viable match.\n",
+                        network->ssid_len, network->ssid, network->bssid);
 
         return 1;
 }
@@ -6152,7 +6066,6 @@ static void ipw_bg_adhoc_check(struct work_struct *work)
 
 static void ipw_debug_config(struct ipw_priv *priv)
 {
-        DECLARE_SSID_BUF(ssid);
         IPW_DEBUG_INFO("Scan completed, no valid APs matched "
                        "[CFG 0x%08X]\n", priv->config);
         if (priv->config & CFG_STATIC_CHANNEL)
@@ -6160,8 +6073,8 @@ static void ipw_debug_config(struct ipw_priv *priv)
         else
                 IPW_DEBUG_INFO("Channel unlocked.\n");
         if (priv->config & CFG_STATIC_ESSID)
-                IPW_DEBUG_INFO("ESSID locked to '%s'\n",
-                               print_ssid(ssid, priv->essid, priv->essid_len));
+                IPW_DEBUG_INFO("ESSID locked to '%*pE'\n",
+                               priv->essid_len, priv->essid);
         else
                 IPW_DEBUG_INFO("ESSID unlocked.\n");
         if (priv->config & CFG_STATIC_BSSID)
@@ -7385,7 +7298,6 @@ static int ipw_associate_network(struct ipw_priv *priv,
                                  struct ipw_supported_rates *rates, int roaming)
 {
         int err;
-        DECLARE_SSID_BUF(ssid);
 
         if (priv->config & CFG_FIXED_RATE)
                 ipw_set_fixed_rate(priv, network->mode);
@@ -7451,10 +7363,9 @@ static int ipw_associate_network(struct ipw_priv *priv,
                 priv->assoc_request.capability &=
                     ~cpu_to_le16(WLAN_CAPABILITY_SHORT_SLOT_TIME);
 
-        IPW_DEBUG_ASSOC("%ssociation attempt: '%s', channel %d, "
-                        "802.11%c [%d], %s[:%s], enc=%s%s%s%c%c\n",
+        IPW_DEBUG_ASSOC("%ssociation attempt: '%*pE', channel %d, 802.11%c [%d], %s[:%s], enc=%s%s%s%c%c\n",
                         roaming ? "Rea" : "A",
-                        print_ssid(ssid, priv->essid, priv->essid_len),
+                        priv->essid_len, priv->essid,
                         network->channel,
                         ipw_modes[priv->assoc_request.ieee_mode],
                         rates->num_rates,
@@ -7553,9 +7464,8 @@ static int ipw_associate_network(struct ipw_priv *priv,
                 return err;
         }
 
-        IPW_DEBUG(IPW_DL_STATE, "associating: '%s' %pM\n",
-                  print_ssid(ssid, priv->essid, priv->essid_len),
-                  priv->bssid);
+        IPW_DEBUG(IPW_DL_STATE, "associating: '%*pE' %pM\n",
+                  priv->essid_len, priv->essid, priv->bssid);
 
         return 0;
 }
@@ -7645,7 +7555,6 @@ static int ipw_associate(void *data)
         struct ipw_supported_rates *rates;
         struct list_head *element;
         unsigned long flags;
-        DECLARE_SSID_BUF(ssid);
 
         if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
                 IPW_DEBUG_ASSOC("Not attempting association (monitor mode)\n");
@@ -7704,10 +7613,8 @@ static int ipw_associate(void *data)
                         /* If there are no more slots, expire the oldest */
                         list_del(&oldest->list);
                         target = oldest;
-                        IPW_DEBUG_ASSOC("Expired '%s' (%pM) from "
-                                        "network list.\n",
-                                        print_ssid(ssid, target->ssid,
-                                                   target->ssid_len),
+                        IPW_DEBUG_ASSOC("Expired '%*pE' (%pM) from network list.\n",
+                                        target->ssid_len, target->ssid,
                                         target->bssid);
                         list_add_tail(&target->list,
                                       &priv->ieee->network_free_list);
@@ -9093,7 +9000,6 @@ static int ipw_wx_set_essid(struct net_device *dev,
 {
         struct ipw_priv *priv = libipw_priv(dev);
         int length;
-        DECLARE_SSID_BUF(ssid);
 
         mutex_lock(&priv->mutex);
 
@@ -9118,8 +9024,7 @@ static int ipw_wx_set_essid(struct net_device *dev,
                 return 0;
         }
 
-        IPW_DEBUG_WX("Setting ESSID: '%s' (%d)\n",
-                     print_ssid(ssid, extra, length), length);
+        IPW_DEBUG_WX("Setting ESSID: '%*pE' (%d)\n", length, extra, length);
 
         priv->essid_len = length;
         memcpy(priv->essid, extra, priv->essid_len);
@@ -9138,15 +9043,14 @@ static int ipw_wx_get_essid(struct net_device *dev,
                             union iwreq_data *wrqu, char *extra)
 {
         struct ipw_priv *priv = libipw_priv(dev);
-        DECLARE_SSID_BUF(ssid);
 
         /* If we are associated, trying to associate, or have a statically
          * configured ESSID then return that; otherwise return ANY */
         mutex_lock(&priv->mutex);
         if (priv->config & CFG_STATIC_ESSID ||
             priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)) {
-                IPW_DEBUG_WX("Getting essid: '%s'\n",
-                             print_ssid(ssid, priv->essid, priv->essid_len));
+                IPW_DEBUG_WX("Getting essid: '%*pE'\n",
+                             priv->essid_len, priv->essid);
                 memcpy(extra, priv->essid, priv->essid_len);
                 wrqu->essid.length = priv->essid_len;
                 wrqu->essid.flags = 1;  /* active */
diff --git a/drivers/net/wireless/ipw2x00/libipw.h b/drivers/net/wireless/ipw2x00/libipw.h
index 5ce2f59d3378..b0571618c2ed 100644
--- a/drivers/net/wireless/ipw2x00/libipw.h
+++ b/drivers/net/wireless/ipw2x00/libipw.h
@@ -654,10 +654,6 @@ struct libipw_network {
         /* TPC Report - mandatory if spctrm mgmt required */
         struct libipw_tpc_report tpc_report;
 
-        /* IBSS DFS - mandatory if spctrm mgmt required and IBSS
-         * NOTE: This is variable length and so must be allocated dynamically */
-        struct libipw_ibss_dfs *ibss_dfs;
-
         /* Channel Switch Announcement - optional if spctrm mgmt required */
         struct libipw_csa csa;
 
@@ -970,7 +966,6 @@ int libipw_rx(struct libipw_device *ieee, struct sk_buff *skb,
 /* make sure to set stats->len */
 void libipw_rx_mgt(struct libipw_device *ieee, struct libipw_hdr_4addr *header,
                    struct libipw_rx_stats *stats);
-void libipw_network_reset(struct libipw_network *network);
 
 /* libipw_geo.c */
 const struct libipw_geo *libipw_get_geo(struct libipw_device *ieee);
diff --git a/drivers/net/wireless/ipw2x00/libipw_module.c b/drivers/net/wireless/ipw2x00/libipw_module.c
index 5f31b72a4921..60f28740f6af 100644
--- a/drivers/net/wireless/ipw2x00/libipw_module.c
+++ b/drivers/net/wireless/ipw2x00/libipw_module.c
@@ -84,25 +84,12 @@ static int libipw_networks_allocate(struct libipw_device *ieee)
         return 0;
 }
 
-void libipw_network_reset(struct libipw_network *network)
-{
-        if (!network)
-                return;
-
-        if (network->ibss_dfs) {
-                kfree(network->ibss_dfs);
-                network->ibss_dfs = NULL;
-        }
-}
-
 static inline void libipw_networks_free(struct libipw_device *ieee)
 {
         int i;
 
-        for (i = 0; i < MAX_NETWORK_COUNT; i++) {
-                kfree(ieee->networks[i]->ibss_dfs);
+        for (i = 0; i < MAX_NETWORK_COUNT; i++)
                 kfree(ieee->networks[i]);
-        }
 }
 
 void libipw_networks_age(struct libipw_device *ieee,
diff --git a/drivers/net/wireless/ipw2x00/libipw_rx.c b/drivers/net/wireless/ipw2x00/libipw_rx.c
index a586a85bfcfe..a6877dd6ba73 100644
--- a/drivers/net/wireless/ipw2x00/libipw_rx.c
+++ b/drivers/net/wireless/ipw2x00/libipw_rx.c
@@ -1120,7 +1120,6 @@ static int libipw_parse_info_param(struct libipw_info_element
                                       *info_element, u16 length,
                                       struct libipw_network *network)
 {
-        DECLARE_SSID_BUF(ssid);
         u8 i;
 #ifdef CONFIG_LIBIPW_DEBUG
         char rates_str[64];
@@ -1151,10 +1150,9 @@ static int libipw_parse_info_param(struct libipw_info_element
                                 memset(network->ssid + network->ssid_len, 0,
                                        IW_ESSID_MAX_SIZE - network->ssid_len);
 
-                        LIBIPW_DEBUG_MGMT("WLAN_EID_SSID: '%s' len=%d.\n",
-                                             print_ssid(ssid, network->ssid,
-                                                        network->ssid_len),
-                                             network->ssid_len);
+                        LIBIPW_DEBUG_MGMT("WLAN_EID_SSID: '%*pE' len=%d.\n",
+                                          network->ssid_len, network->ssid,
+                                          network->ssid_len);
                         break;
 
                 case WLAN_EID_SUPP_RATES:
@@ -1300,13 +1298,6 @@ static int libipw_parse_info_param(struct libipw_info_element
                         break;
 
                 case WLAN_EID_IBSS_DFS:
-                        if (network->ibss_dfs)
-                                break;
-                        network->ibss_dfs = kmemdup(info_element->data,
-                                                    info_element->len,
-                                                    GFP_ATOMIC);
-                        if (!network->ibss_dfs)
-                                return 1;
                         network->flags |= NETWORK_HAS_IBSS_DFS;
                         break;
 
@@ -1337,9 +1328,7 @@ static int libipw_parse_info_param(struct libipw_info_element
 static int libipw_handle_assoc_resp(struct libipw_device *ieee, struct libipw_assoc_response
                                        *frame, struct libipw_rx_stats *stats)
 {
-        struct libipw_network network_resp = {
-                .ibss_dfs = NULL,
-        };
+        struct libipw_network network_resp = { };
         struct libipw_network *network = &network_resp;
         struct net_device *dev = ieee->dev;
 
@@ -1399,8 +1388,6 @@ static int libipw_network_init(struct libipw_device *ieee, struct libipw_probe_r
                                          struct libipw_network *network,
                                          struct libipw_rx_stats *stats)
 {
-        DECLARE_SSID_BUF(ssid);
-
         network->qos_data.active = 0;
         network->qos_data.supported = 0;
         network->qos_data.param_count = 0;
@@ -1447,11 +1434,9 @@ static int libipw_network_init(struct libipw_device *ieee, struct libipw_probe_r
         }
 
         if (network->mode == 0) {
-                LIBIPW_DEBUG_SCAN("Filtered out '%s (%pM)' "
-                                     "network.\n",
-                                     print_ssid(ssid, network->ssid,
-                                                 network->ssid_len),
-                                     network->bssid);
+                LIBIPW_DEBUG_SCAN("Filtered out '%*pE (%pM)' network.\n",
+                                  network->ssid_len, network->ssid,
+                                  network->bssid);
                 return 1;
         }
 
@@ -1478,9 +1463,6 @@ static void update_network(struct libipw_network *dst,
         int qos_active;
         u8 old_param;
 
-        libipw_network_reset(dst);
-        dst->ibss_dfs = src->ibss_dfs;
-
         /* We only update the statistics if they were created by receiving
          * the network information on the actual channel the network is on.
          *
@@ -1554,20 +1536,16 @@ static void libipw_process_probe_response(struct libipw_device
                                                     *stats)
 {
         struct net_device *dev = ieee->dev;
-        struct libipw_network network = {
-                .ibss_dfs = NULL,
-        };
+        struct libipw_network network = { };
         struct libipw_network *target;
         struct libipw_network *oldest = NULL;
 #ifdef CONFIG_LIBIPW_DEBUG
         struct libipw_info_element *info_element = beacon->info_element;
 #endif
         unsigned long flags;
-        DECLARE_SSID_BUF(ssid);
 
-        LIBIPW_DEBUG_SCAN("'%s' (%pM"
-                     "): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
-                     print_ssid(ssid, info_element->data, info_element->len),
+        LIBIPW_DEBUG_SCAN("'%*pE' (%pM): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
+                     info_element->len, info_element->data,
                      beacon->header.addr3,
                      (beacon->capability & cpu_to_le16(1 << 0xf)) ? '1' : '0',
                      (beacon->capability & cpu_to_le16(1 << 0xe)) ? '1' : '0',
@@ -1587,12 +1565,11 @@ static void libipw_process_probe_response(struct libipw_device
                      (beacon->capability & cpu_to_le16(1 << 0x0)) ? '1' : '0');
 
         if (libipw_network_init(ieee, beacon, &network, stats)) {
-                LIBIPW_DEBUG_SCAN("Dropped '%s' (%pM) via %s.\n",
-                                     print_ssid(ssid, info_element->data,
-                                                 info_element->len),
-                                     beacon->header.addr3,
-                                     is_beacon(beacon->header.frame_ctl) ?
-                                     "BEACON" : "PROBE RESPONSE");
+                LIBIPW_DEBUG_SCAN("Dropped '%*pE' (%pM) via %s.\n",
+                                  info_element->len, info_element->data,
+                                  beacon->header.addr3,
+                                  is_beacon(beacon->header.frame_ctl) ?
+                                  "BEACON" : "PROBE RESPONSE");
                 return;
         }
 
@@ -1624,12 +1601,9 @@ static void libipw_process_probe_response(struct libipw_device
                         /* If there are no more slots, expire the oldest */
                         list_del(&oldest->list);
                         target = oldest;
-                        LIBIPW_DEBUG_SCAN("Expired '%s' (%pM) from "
-                                             "network list.\n",
-                                             print_ssid(ssid, target->ssid,
-                                                         target->ssid_len),
-                                             target->bssid);
-                        libipw_network_reset(target);
+                        LIBIPW_DEBUG_SCAN("Expired '%*pE' (%pM) from network list.\n",
+                                          target->ssid_len, target->ssid,
+                                          target->bssid);
                 } else {
                         /* Otherwise just pull from the free list */
                         target = list_entry(ieee->network_free_list.next,
@@ -1638,25 +1612,21 @@ static void libipw_process_probe_response(struct libipw_device
                 }
 
 #ifdef CONFIG_LIBIPW_DEBUG
-                LIBIPW_DEBUG_SCAN("Adding '%s' (%pM) via %s.\n",
-                                     print_ssid(ssid, network.ssid,
-                                                 network.ssid_len),
-                                     network.bssid,
-                                     is_beacon(beacon->header.frame_ctl) ?
-                                     "BEACON" : "PROBE RESPONSE");
+                LIBIPW_DEBUG_SCAN("Adding '%*pE' (%pM) via %s.\n",
+                                  network.ssid_len, network.ssid,
+                                  network.bssid,
+                                  is_beacon(beacon->header.frame_ctl) ?
+                                  "BEACON" : "PROBE RESPONSE");
 #endif
                 memcpy(target, &network, sizeof(*target));
-                network.ibss_dfs = NULL;
                 list_add_tail(&target->list, &ieee->network_list);
         } else {
-                LIBIPW_DEBUG_SCAN("Updating '%s' (%pM) via %s.\n",
-                                     print_ssid(ssid, target->ssid,
-                                                 target->ssid_len),
-                                     target->bssid,
-                                     is_beacon(beacon->header.frame_ctl) ?
-                                     "BEACON" : "PROBE RESPONSE");
+                LIBIPW_DEBUG_SCAN("Updating '%*pE' (%pM) via %s.\n",
+                                  target->ssid_len, target->ssid,
+                                  target->bssid,
+                                  is_beacon(beacon->header.frame_ctl) ?
+                                  "BEACON" : "PROBE RESPONSE");
                 update_network(target, &network);
-                network.ibss_dfs = NULL;
         }
 
         spin_unlock_irqrestore(&ieee->lock, flags);
diff --git a/drivers/net/wireless/ipw2x00/libipw_wx.c b/drivers/net/wireless/ipw2x00/libipw_wx.c
index 54aba4744438..dd29f46d086b 100644
--- a/drivers/net/wireless/ipw2x00/libipw_wx.c
+++ b/drivers/net/wireless/ipw2x00/libipw_wx.c
@@ -272,7 +272,6 @@ int libipw_wx_get_scan(struct libipw_device *ieee,
         char *ev = extra;
         char *stop = ev + wrqu->data.length;
         int i = 0;
-        DECLARE_SSID_BUF(ssid);
 
         LIBIPW_DEBUG_WX("Getting scan\n");
 
@@ -290,12 +289,10 @@ int libipw_wx_get_scan(struct libipw_device *ieee,
                         ev = libipw_translate_scan(ieee, ev, stop, network,
                                                       info);
                 else {
-                        LIBIPW_DEBUG_SCAN("Not showing network '%s ("
-                                             "%pM)' due to age (%ums).\n",
-                                             print_ssid(ssid, network->ssid,
-                                                         network->ssid_len),
-                                             network->bssid,
-                                             elapsed_jiffies_msecs(
+                        LIBIPW_DEBUG_SCAN("Not showing network '%*pE (%pM)' due to age (%ums).\n",
+                                          network->ssid_len, network->ssid,
+                                          network->bssid,
+                                          elapsed_jiffies_msecs(
                                                        network->last_scanned));
                 }
         }
@@ -322,7 +319,6 @@ int libipw_wx_set_encode(struct libipw_device *ieee,
         int i, key, key_provided, len;
         struct lib80211_crypt_data **crypt;
         int host_crypto = ieee->host_encrypt || ieee->host_decrypt;
-        DECLARE_SSID_BUF(ssid);
 
         LIBIPW_DEBUG_WX("SET_ENCODE\n");
 
@@ -417,8 +413,8 @@ int libipw_wx_set_encode(struct libipw_device *ieee,
                 if (len > erq->length)
                         memset(sec.keys[key] + erq->length, 0,
                                len - erq->length);
-                LIBIPW_DEBUG_WX("Setting key %d to '%s' (%d:%d bytes)\n",
-                                   key, print_ssid(ssid, sec.keys[key], len),
+                LIBIPW_DEBUG_WX("Setting key %d to '%*pE' (%d:%d bytes)\n",
+                                   key, len, sec.keys[key],
                                    erq->length, len);
                 sec.key_sizes[key] = len;
                 if (*crypt)
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
index 26fec54dcd03..2748fde4b90c 100644
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
@@ -6063,7 +6063,7 @@ il4965_mac_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 }
 
 void
-il4965_mac_channel_switch(struct ieee80211_hw *hw,
+il4965_mac_channel_switch(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                           struct ieee80211_channel_switch *ch_switch)
 {
         struct il_priv *il = hw->priv;
diff --git a/drivers/net/wireless/iwlegacy/4965.h b/drivers/net/wireless/iwlegacy/4965.h
index 337dfcf3bbde..3a57f71b8ed5 100644
--- a/drivers/net/wireless/iwlegacy/4965.h
+++ b/drivers/net/wireless/iwlegacy/4965.h
@@ -187,8 +187,9 @@ int il4965_mac_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                             u8 buf_size);
 int il4965_mac_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                        struct ieee80211_sta *sta);
-void il4965_mac_channel_switch(struct ieee80211_hw *hw,
-                               struct ieee80211_channel_switch *ch_switch);
+void
+il4965_mac_channel_switch(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                          struct ieee80211_channel_switch *ch_switch);
 
 void il4965_led_enable(struct il_priv *il);
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index cae692ff1013..47e64e8b9517 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -941,6 +941,7 @@ static int iwlagn_mac_sta_state(struct ieee80211_hw *hw,
 }
 
 static void iwlagn_mac_channel_switch(struct ieee80211_hw *hw,
+                                      struct ieee80211_vif *vif,
                                       struct ieee80211_channel_switch *ch_switch)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw.c b/drivers/net/wireless/iwlwifi/mvm/fw.c
index 8c96e5af75f7..f12b43d65f66 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/iwlwifi/mvm/fw.c
@@ -288,7 +288,7 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
 
         lockdep_assert_held(&mvm->mutex);
 
-        if (WARN_ON_ONCE(mvm->init_ucode_complete))
+        if (WARN_ON_ONCE(mvm->init_ucode_complete || mvm->calibrating))
                 return 0;
 
         iwl_init_notification_wait(&mvm->notif_wait,
@@ -338,6 +338,8 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
                 goto out;
         }
 
+        mvm->calibrating = true;
+
         /* Send TX valid antennas before triggering calibrations */
         ret = iwl_send_tx_ant_cfg(mvm, mvm->fw->valid_tx_ant);
         if (ret)
@@ -362,11 +364,17 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
                         MVM_UCODE_CALIB_TIMEOUT);
         if (!ret)
                 mvm->init_ucode_complete = true;
+
+        if (ret && iwl_mvm_is_radio_killed(mvm)) {
+                IWL_DEBUG_RF_KILL(mvm, "RFKILL while calibrating.\n");
+                ret = 1;
+        }
         goto out;
 
 error:
         iwl_remove_notification(&mvm->notif_wait, &calib_wait);
 out:
+        mvm->calibrating = false;
         if (iwlmvm_mod_params.init_dbg && !mvm->nvm_data) {
                 /* we want to debug INIT and we have no NVM - fake */
                 mvm->nvm_data = kzalloc(sizeof(struct iwl_nvm_data) +
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index ed2c219cf543..92e1810864b1 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -850,6 +850,7 @@ static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
 
         mvm->scan_status = IWL_MVM_SCAN_NONE;
         mvm->ps_disabled = false;
+        mvm->calibrating = false;
 
         /* just in case one was running */
         ieee80211_remain_on_channel_expired(mvm->hw);
@@ -920,9 +921,8 @@ static int iwl_mvm_mac_start(struct ieee80211_hw *hw)
         return ret;
 }
 
-static void iwl_mvm_mac_restart_complete(struct ieee80211_hw *hw)
+static void iwl_mvm_restart_complete(struct iwl_mvm *mvm)
 {
-        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
         int ret;
 
         mutex_lock(&mvm->mutex);
@@ -940,6 +940,21 @@ static void iwl_mvm_mac_restart_complete(struct ieee80211_hw *hw)
         mutex_unlock(&mvm->mutex);
 }
 
+static void
+iwl_mvm_mac_reconfig_complete(struct ieee80211_hw *hw,
+                              enum ieee80211_reconfig_type reconfig_type)
+{
+        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+
+        switch (reconfig_type) {
+        case IEEE80211_RECONFIG_TYPE_RESTART:
+                iwl_mvm_restart_complete(mvm);
+                break;
+        case IEEE80211_RECONFIG_TYPE_SUSPEND:
+                break;
+        }
+}
+
 void __iwl_mvm_mac_stop(struct iwl_mvm *mvm)
 {
         lockdep_assert_held(&mvm->mutex);
@@ -3083,7 +3098,7 @@ const struct ieee80211_ops iwl_mvm_hw_ops = {
         .tx = iwl_mvm_mac_tx,
         .ampdu_action = iwl_mvm_mac_ampdu_action,
         .start = iwl_mvm_mac_start,
-        .restart_complete = iwl_mvm_mac_restart_complete,
+        .reconfig_complete = iwl_mvm_mac_reconfig_complete,
         .stop = iwl_mvm_mac_stop,
         .add_interface = iwl_mvm_mac_add_interface,
         .remove_interface = iwl_mvm_mac_remove_interface,
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index 7d2c5289464b..09b49b407a5b 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -548,6 +548,7 @@ struct iwl_mvm {
         enum iwl_ucode_type cur_ucode;
         bool ucode_loaded;
         bool init_ucode_complete;
+        bool calibrating;
         u32 error_event_table;
         u32 log_event_table;
         u32 umac_error_event_table;
diff --git a/drivers/net/wireless/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwlwifi/mvm/ops.c
index 8664f617f6e7..53a5a29897b4 100644
--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
@@ -429,6 +429,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         }
         mvm->sf_state = SF_UNINIT;
         mvm->low_latency_agg_frame_limit = 6;
+        mvm->cur_ucode = IWL_UCODE_INIT;
 
         mutex_init(&mvm->mutex);
         mutex_init(&mvm->d0i3_suspend_mutex);
@@ -760,6 +761,7 @@ void iwl_mvm_set_hw_ctkill_state(struct iwl_mvm *mvm, bool state)
 static bool iwl_mvm_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
 {
         struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
+        bool calibrating = ACCESS_ONCE(mvm->calibrating);
 
         if (state)
                 set_bit(IWL_MVM_STATUS_HW_RFKILL, &mvm->status);
@@ -768,7 +770,15 @@ static bool iwl_mvm_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
 
         wiphy_rfkill_set_hw_state(mvm->hw->wiphy, iwl_mvm_is_radio_killed(mvm));
 
-        return state && mvm->cur_ucode != IWL_UCODE_INIT;
+        /* iwl_run_init_mvm_ucode is waiting for results, abort it */
+        if (calibrating)
+                iwl_abort_notification_waits(&mvm->notif_wait);
+
+        /*
+         * Stop the device if we run OPERATIONAL firmware or if we are in the
+         * middle of the calibrations.
+         */
+        return state && (mvm->cur_ucode != IWL_UCODE_INIT || calibrating);
 }
 
 static void iwl_mvm_free_skb(struct iwl_op_mode *op_mode, struct sk_buff *skb)
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index 5cd59a43e1da..fb2a8628b8fc 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -603,16 +603,6 @@ static int iwl_mvm_cancel_regular_scan(struct iwl_mvm *mvm)
                                                SCAN_COMPLETE_NOTIFICATION };
         int ret;
 
-        if (mvm->scan_status == IWL_MVM_SCAN_NONE)
-                return 0;
-
-        if (iwl_mvm_is_radio_killed(mvm)) {
-                ieee80211_scan_completed(mvm->hw, true);
-                iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
-                mvm->scan_status = IWL_MVM_SCAN_NONE;
-                return 0;
-        }
-
         iwl_init_notification_wait(&mvm->notif_wait, &wait_scan_abort,
                                    scan_abort_notif,
                                    ARRAY_SIZE(scan_abort_notif),
@@ -1431,6 +1421,16 @@ int iwl_mvm_unified_sched_scan_lmac(struct iwl_mvm *mvm,
 
 int iwl_mvm_cancel_scan(struct iwl_mvm *mvm)
 {
+        if (mvm->scan_status == IWL_MVM_SCAN_NONE)
+                return 0;
+
+        if (iwl_mvm_is_radio_killed(mvm)) {
+                ieee80211_scan_completed(mvm->hw, true);
+                iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
+                mvm->scan_status = IWL_MVM_SCAN_NONE;
+                return 0;
+        }
+
         if (mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_LMAC_SCAN)
                 return iwl_mvm_scan_offload_stop(mvm, true);
         return iwl_mvm_cancel_regular_scan(mvm);
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 12cb427b742a..ee2ec516e30c 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -916,7 +916,8 @@ static void iwl_trans_pcie_stop_device(struct iwl_trans *trans)
          * restart. So don't process again if the device is
          * already dead.
          */
-        if (test_bit(STATUS_DEVICE_ENABLED, &trans->status)) {
+        if (test_and_clear_bit(STATUS_DEVICE_ENABLED, &trans->status)) {
+                IWL_DEBUG_INFO(trans, "DEVICE_ENABLED bit was set and is now cleared\n");
                 iwl_pcie_tx_stop(trans);
                 iwl_pcie_rx_stop(trans);
 
@@ -946,7 +947,6 @@ static void iwl_trans_pcie_stop_device(struct iwl_trans *trans)
         /* clear all status bits */
         clear_bit(STATUS_SYNC_HCMD_ACTIVE, &trans->status);
         clear_bit(STATUS_INT_ENABLED, &trans->status);
-        clear_bit(STATUS_DEVICE_ENABLED, &trans->status);
         clear_bit(STATUS_TPOWER_PMI, &trans->status);
         clear_bit(STATUS_RFKILL, &trans->status);
 
@@ -1906,8 +1906,7 @@ static u32 iwl_trans_pcie_dump_prph(struct iwl_trans *trans,
                 int reg;
                 __le32 *val;
 
-                prph_len += sizeof(*data) + sizeof(*prph) +
-                        num_bytes_in_chunk;
+                prph_len += sizeof(**data) + sizeof(*prph) + num_bytes_in_chunk;
 
                 (*data)->type = cpu_to_le32(IWL_FW_ERROR_DUMP_PRPH);
                 (*data)->len = cpu_to_le32(sizeof(*prph) +
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index 818b1edaaa9a..34f09ef90bb3 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -590,7 +590,6 @@ static int lbs_ret_scan(struct lbs_private *priv, unsigned long dummy,
                 int chan_no = -1;
                 const u8 *ssid = NULL;
                 u8 ssid_len = 0;
-                DECLARE_SSID_BUF(ssid_buf);
 
                 int len = get_unaligned_le16(pos);
                 pos += 2;
@@ -644,10 +643,8 @@ static int lbs_ret_scan(struct lbs_private *priv, unsigned long dummy,
                         struct ieee80211_channel *channel =
                                 ieee80211_get_channel(wiphy, freq);
 
-                        lbs_deb_scan("scan: %pM, capa %04x, chan %2d, %s, "
-                                     "%d dBm\n",
-                                     bssid, capa, chan_no,
-                                     print_ssid(ssid_buf, ssid, ssid_len),
+                        lbs_deb_scan("scan: %pM, capa %04x, chan %2d, %*pE, %d dBm\n",
+                                     bssid, capa, chan_no, ssid_len, ssid,
                                      LBS_SCAN_RSSI_TO_MBM(rssi)/100);
 
                         if (channel &&
@@ -1984,7 +1981,6 @@ static int lbs_join_ibss(struct wiphy *wiphy, struct net_device *dev,
         struct lbs_private *priv = wiphy_priv(wiphy);
         int ret = 0;
         struct cfg80211_bss *bss;
-        DECLARE_SSID_BUF(ssid_buf);
 
         if (dev == priv->mesh_dev)
                 return -EOPNOTSUPP;
diff --git a/drivers/net/wireless/libertas/mesh.c b/drivers/net/wireless/libertas/mesh.c
index 01a67f62696f..d0c881dd5846 100644
--- a/drivers/net/wireless/libertas/mesh.c
+++ b/drivers/net/wireless/libertas/mesh.c
@@ -93,7 +93,6 @@ static int lbs_mesh_config(struct lbs_private *priv, uint16_t action,
 {
         struct cmd_ds_mesh_config cmd;
         struct mrvl_meshie *ie;
-        DECLARE_SSID_BUF(ssid);
 
         memset(&cmd, 0, sizeof(cmd));
         cmd.channel = cpu_to_le16(chan);
@@ -122,9 +121,9 @@ static int lbs_mesh_config(struct lbs_private *priv, uint16_t action,
         default:
                 return -1;
         }
-        lbs_deb_cmd("mesh config action %d type %x channel %d SSID %s\n",
-                    action, priv->mesh_tlv, chan,
-                    print_ssid(ssid, priv->mesh_ssid, priv->mesh_ssid_len));
+        lbs_deb_cmd("mesh config action %d type %x channel %d SSID %*pE\n",
+                    action, priv->mesh_tlv, chan, priv->mesh_ssid_len,
+                    priv->mesh_ssid);
 
         return __lbs_mesh_config_send(priv, &cmd, action, priv->mesh_tlv);
 }
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index babbdc1ce741..2371d11e4190 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -412,6 +412,11 @@ struct mac80211_hwsim_data {
         struct mac_address addresses[2];
         int channels, idx;
         bool use_chanctx;
+        bool destroy_on_close;
+        struct work_struct destroy_work;
+        u32 portid;
+        char alpha2[2];
+        const struct ieee80211_regdomain *regd;
 
         struct ieee80211_channel *tmp_chan;
         struct delayed_work roc_done;
@@ -419,6 +424,7 @@ struct mac80211_hwsim_data {
         struct cfg80211_scan_request *hw_scan_request;
         struct ieee80211_vif *hw_scan_vif;
         int scan_chan_idx;
+        u8 scan_addr[ETH_ALEN];
 
         struct ieee80211_channel *channel;
         u64 beacon_int  /* beacon interval in us */;
@@ -436,7 +442,7 @@ struct mac80211_hwsim_data {
         /*
          * Only radios in the same group can communicate together (the
          * channel has to match too). Each bit represents a group. A
-         * radio can be in more then one group.
+         * radio can be in more than one group.
          */
         u64 group;
 
@@ -447,6 +453,14 @@ struct mac80211_hwsim_data {
         s64 bcn_delta;
         /* absolute beacon transmission time. Used to cover up "tx" delay. */
         u64 abs_bcn_ts;
+
+        /* Stats */
+        u64 tx_pkts;
+        u64 rx_pkts;
+        u64 tx_bytes;
+        u64 rx_bytes;
+        u64 tx_dropped;
+        u64 tx_failed;
 };
 
 
@@ -476,6 +490,14 @@ static struct genl_family hwsim_genl_family = {
         .maxattr = HWSIM_ATTR_MAX,
 };
 
+enum hwsim_multicast_groups {
+        HWSIM_MCGRP_CONFIG,
+};
+
+static const struct genl_multicast_group hwsim_mcgrps[] = {
+        [HWSIM_MCGRP_CONFIG] = { .name = "config", },
+};
+
 /* MAC80211_HWSIM netlink policy */
 
 static const struct nla_policy hwsim_genl_policy[HWSIM_ATTR_MAX + 1] = {
@@ -496,6 +518,10 @@ static const struct nla_policy hwsim_genl_policy[HWSIM_ATTR_MAX + 1] = {
         [HWSIM_ATTR_REG_CUSTOM_REG] = { .type = NLA_U32 },
         [HWSIM_ATTR_REG_STRICT_REG] = { .type = NLA_FLAG },
         [HWSIM_ATTR_SUPPORT_P2P_DEVICE] = { .type = NLA_FLAG },
+        [HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE] = { .type = NLA_FLAG },
+        [HWSIM_ATTR_RADIO_NAME] = { .type = NLA_STRING },
+        [HWSIM_ATTR_NO_VIF] = { .type = NLA_FLAG },
+        [HWSIM_ATTR_FREQ] = { .type = NLA_U32 },
 };
 
 static void mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
@@ -807,6 +833,9 @@ static bool mac80211_hwsim_addr_match(struct mac80211_hwsim_data *data,
                 .ret = false,
         };
 
+        if (data->scanning && memcmp(addr, data->scan_addr, ETH_ALEN) == 0)
+                return true;
+
         memcpy(md.addr, addr, ETH_ALEN);
 
         ieee80211_iterate_active_interfaces_atomic(data->hw,
@@ -861,8 +890,10 @@ static void mac80211_hwsim_tx_frame_nl(struct ieee80211_hw *hw,
         /* If the queue contains MAX_QUEUE skb's drop some */
         if (skb_queue_len(&data->pending) >= MAX_QUEUE) {
                 /* Droping until WARN_QUEUE level */
-                while (skb_queue_len(&data->pending) >= WARN_QUEUE)
-                        skb_dequeue(&data->pending);
+                while (skb_queue_len(&data->pending) >= WARN_QUEUE) {
+                        ieee80211_free_txskb(hw, skb_dequeue(&data->pending));
+                        data->tx_dropped++;
+                }
         }
 
         skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_ATOMIC);
@@ -896,6 +927,9 @@ static void mac80211_hwsim_tx_frame_nl(struct ieee80211_hw *hw,
         if (nla_put_u32(skb, HWSIM_ATTR_FLAGS, hwsim_flags))
                 goto nla_put_failure;
 
+        if (nla_put_u32(skb, HWSIM_ATTR_FREQ, data->channel->center_freq))
+                goto nla_put_failure;
+
         /* We get the tx control (rate and retries) info*/
 
         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
@@ -917,10 +951,14 @@ static void mac80211_hwsim_tx_frame_nl(struct ieee80211_hw *hw,
 
         /* Enqueue the packet */
         skb_queue_tail(&data->pending, my_skb);
+        data->tx_pkts++;
+        data->tx_bytes += my_skb->len;
         return;
 
 nla_put_failure:
         printk(KERN_DEBUG "mac80211_hwsim: error occurred in %s\n", __func__);
+        ieee80211_free_txskb(hw, my_skb);
+        data->tx_failed++;
 }
 
 static bool hwsim_chans_compat(struct ieee80211_channel *c1,
@@ -952,6 +990,53 @@ static void mac80211_hwsim_tx_iter(void *_data, u8 *addr,
         data->receive = true;
 }
 
+static void mac80211_hwsim_add_vendor_rtap(struct sk_buff *skb)
+{
+        /*
+         * To enable this code, #define the HWSIM_RADIOTAP_OUI,
+         * e.g. like this:
+         * #define HWSIM_RADIOTAP_OUI "\x02\x00\x00"
+         * (but you should use a valid OUI, not that)
+         *
+         * If anyone wants to 'donate' a radiotap OUI/subns code
+         * please send a patch removing this #ifdef and changing
+         * the values accordingly.
+         */
+#ifdef HWSIM_RADIOTAP_OUI
+        struct ieee80211_vendor_radiotap *rtap;
+
+        /*
+         * Note that this code requires the headroom in the SKB
+         * that was allocated earlier.
+         */
+        rtap = (void *)skb_push(skb, sizeof(*rtap) + 8 + 4);
+        rtap->oui[0] = HWSIM_RADIOTAP_OUI[0];
+        rtap->oui[1] = HWSIM_RADIOTAP_OUI[1];
+        rtap->oui[2] = HWSIM_RADIOTAP_OUI[2];
+        rtap->subns = 127;
+
+        /*
+         * Radiotap vendor namespaces can (and should) also be
+         * split into fields by using the standard radiotap
+         * presence bitmap mechanism. Use just BIT(0) here for
+         * the presence bitmap.
+         */
+        rtap->present = BIT(0);
+        /* We have 8 bytes of (dummy) data */
+        rtap->len = 8;
+        /* For testing, also require it to be aligned */
+        rtap->align = 8;
+        /* And also test that padding works, 4 bytes */
+        rtap->pad = 4;
+        /* push the data */
+        memcpy(rtap->data, "ABCDEFGH", 8);
+        /* make sure to clear padding, mac80211 doesn't */
+        memset(rtap->data + 8, 0, 4);
+
+        IEEE80211_SKB_RXCB(skb)->flag |= RX_FLAG_RADIOTAP_VENDOR_DATA;
+#endif
+}
+
 static bool mac80211_hwsim_tx_frame_no_nl(struct ieee80211_hw *hw,
                                           struct sk_buff *skb,
                                           struct ieee80211_channel *chan)
@@ -1066,6 +1151,11 @@ static bool mac80211_hwsim_tx_frame_no_nl(struct ieee80211_hw *hw,
                 rx_status.mactime = now + data2->tsf_offset;
 
                 memcpy(IEEE80211_SKB_RXCB(nskb), &rx_status, sizeof(rx_status));
+
+                mac80211_hwsim_add_vendor_rtap(nskb);
+
+                data2->rx_pkts++;
+                data2->rx_bytes += nskb->len;
                 ieee80211_rx_irqsafe(data2->hw, nskb);
         }
         spin_unlock(&hwsim_radio_lock);
@@ -1133,6 +1223,8 @@ static void mac80211_hwsim_tx(struct ieee80211_hw *hw,
                 return mac80211_hwsim_tx_frame_nl(hw, skb, _portid);
 
         /* NO wmediumd detected, perfect medium simulation */
+        data->tx_pkts++;
+        data->tx_bytes += skb->len;
         ack = mac80211_hwsim_tx_frame_no_nl(hw, skb, channel);
 
         if (ack && skb->len >= 16) {
@@ -1716,7 +1808,7 @@ static void hw_scan_work(struct work_struct *work)
                         struct sk_buff *probe;
 
                         probe = ieee80211_probereq_get(hwsim->hw,
-                                                       hwsim->hw_scan_vif,
+                                                       hwsim->scan_addr,
                                                        req->ssids[i].ssid,
                                                        req->ssids[i].ssid_len,
                                                        req->ie_len);
@@ -1754,6 +1846,12 @@ static int mac80211_hwsim_hw_scan(struct ieee80211_hw *hw,
         hwsim->hw_scan_request = req;
         hwsim->hw_scan_vif = vif;
         hwsim->scan_chan_idx = 0;
+        if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
+                get_random_mask_addr(hwsim->scan_addr,
+                                     hw_req->req.mac_addr,
+                                     hw_req->req.mac_addr_mask);
+        else
+                memcpy(hwsim->scan_addr, vif->addr, ETH_ALEN);
         mutex_unlock(&hwsim->mutex);
 
         wiphy_debug(hw->wiphy, "hwsim hw_scan request\n");
@@ -1780,7 +1878,9 @@ static void mac80211_hwsim_cancel_hw_scan(struct ieee80211_hw *hw,
         mutex_unlock(&hwsim->mutex);
 }
 
-static void mac80211_hwsim_sw_scan(struct ieee80211_hw *hw)
+static void mac80211_hwsim_sw_scan(struct ieee80211_hw *hw,
+                                   struct ieee80211_vif *vif,
+                                   const u8 *mac_addr)
 {
         struct mac80211_hwsim_data *hwsim = hw->priv;
 
@@ -1792,13 +1892,16 @@ static void mac80211_hwsim_sw_scan(struct ieee80211_hw *hw)
         }
 
         printk(KERN_DEBUG "hwsim sw_scan request, prepping stuff\n");
+
+        memcpy(hwsim->scan_addr, mac_addr, ETH_ALEN);
         hwsim->scanning = true;
 
 out:
         mutex_unlock(&hwsim->mutex);
 }
 
-static void mac80211_hwsim_sw_scan_complete(struct ieee80211_hw *hw)
+static void mac80211_hwsim_sw_scan_complete(struct ieee80211_hw *hw,
+                                            struct ieee80211_vif *vif)
 {
         struct mac80211_hwsim_data *hwsim = hw->priv;
 
@@ -1806,6 +1909,7 @@ static void mac80211_hwsim_sw_scan_complete(struct ieee80211_hw *hw)
 
         printk(KERN_DEBUG "hwsim sw_scan_complete\n");
         hwsim->scanning = false;
+        memset(hwsim->scan_addr, 0, ETH_ALEN);
 
         mutex_unlock(&hwsim->mutex);
 }
@@ -1916,6 +2020,57 @@ static void mac80211_hwsim_unassign_vif_chanctx(struct ieee80211_hw *hw,
         hwsim_check_chanctx_magic(ctx);
 }
 
+static const char mac80211_hwsim_gstrings_stats[][ETH_GSTRING_LEN] = {
+        "tx_pkts_nic",
+        "tx_bytes_nic",
+        "rx_pkts_nic",
+        "rx_bytes_nic",
+        "d_tx_dropped",
+        "d_tx_failed",
+        "d_ps_mode",
+        "d_group",
+        "d_tx_power",
+};
+
+#define MAC80211_HWSIM_SSTATS_LEN ARRAY_SIZE(mac80211_hwsim_gstrings_stats)
+
+static void mac80211_hwsim_get_et_strings(struct ieee80211_hw *hw,
+                                          struct ieee80211_vif *vif,
+                                          u32 sset, u8 *data)
+{
+        if (sset == ETH_SS_STATS)
+                memcpy(data, *mac80211_hwsim_gstrings_stats,
+                       sizeof(mac80211_hwsim_gstrings_stats));
+}
+
+static int mac80211_hwsim_get_et_sset_count(struct ieee80211_hw *hw,
+                                            struct ieee80211_vif *vif, int sset)
+{
+        if (sset == ETH_SS_STATS)
+                return MAC80211_HWSIM_SSTATS_LEN;
+        return 0;
+}
+
+static void mac80211_hwsim_get_et_stats(struct ieee80211_hw *hw,
+                                        struct ieee80211_vif *vif,
+                                        struct ethtool_stats *stats, u64 *data)
+{
+        struct mac80211_hwsim_data *ar = hw->priv;
+        int i = 0;
+
+        data[i++] = ar->tx_pkts;
+        data[i++] = ar->tx_bytes;
+        data[i++] = ar->rx_pkts;
+        data[i++] = ar->rx_bytes;
+        data[i++] = ar->tx_dropped;
+        data[i++] = ar->tx_failed;
+        data[i++] = ar->ps;
+        data[i++] = ar->group;
+        data[i++] = ar->power_level;
+
+        WARN_ON(i != MAC80211_HWSIM_SSTATS_LEN);
+}
+
 static const struct ieee80211_ops mac80211_hwsim_ops = {
         .tx = mac80211_hwsim_tx,
         .start = mac80211_hwsim_start,
@@ -1939,14 +2094,131 @@ static const struct ieee80211_ops mac80211_hwsim_ops = {
         .flush = mac80211_hwsim_flush,
         .get_tsf = mac80211_hwsim_get_tsf,
         .set_tsf = mac80211_hwsim_set_tsf,
+        .get_et_sset_count = mac80211_hwsim_get_et_sset_count,
+        .get_et_stats = mac80211_hwsim_get_et_stats,
+        .get_et_strings = mac80211_hwsim_get_et_strings,
 };
 
 static struct ieee80211_ops mac80211_hwsim_mchan_ops;
 
-static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
-                                       const struct ieee80211_regdomain *regd,
-                                       bool reg_strict, bool p2p_device,
-                                       bool use_chanctx)
+struct hwsim_new_radio_params {
+        unsigned int channels;
+        const char *reg_alpha2;
+        const struct ieee80211_regdomain *regd;
+        bool reg_strict;
+        bool p2p_device;
+        bool use_chanctx;
+        bool destroy_on_close;
+        const char *hwname;
+        bool no_vif;
+};
+
+static void hwsim_mcast_config_msg(struct sk_buff *mcast_skb,
+                                   struct genl_info *info)
+{
+        if (info)
+                genl_notify(&hwsim_genl_family, mcast_skb,
+                            genl_info_net(info), info->snd_portid,
+                            HWSIM_MCGRP_CONFIG, info->nlhdr, GFP_KERNEL);
+        else
+                genlmsg_multicast(&hwsim_genl_family, mcast_skb, 0,
+                                  HWSIM_MCGRP_CONFIG, GFP_KERNEL);
+}
+
+static int append_radio_msg(struct sk_buff *skb, int id,
+                            struct hwsim_new_radio_params *param)
+{
+        int ret;
+
+        ret = nla_put_u32(skb, HWSIM_ATTR_RADIO_ID, id);
+        if (ret < 0)
+                return ret;
+
+        if (param->channels) {
+                ret = nla_put_u32(skb, HWSIM_ATTR_CHANNELS, param->channels);
+                if (ret < 0)
+                        return ret;
+        }
+
+        if (param->reg_alpha2) {
+                ret = nla_put(skb, HWSIM_ATTR_REG_HINT_ALPHA2, 2,
+                              param->reg_alpha2);
+                if (ret < 0)
+                        return ret;
+        }
+
+        if (param->regd) {
+                int i;
+
+                for (i = 0; hwsim_world_regdom_custom[i] != param->regd &&
+                     i < ARRAY_SIZE(hwsim_world_regdom_custom); i++)
+                        ;
+
+                if (i < ARRAY_SIZE(hwsim_world_regdom_custom)) {
+                        ret = nla_put_u32(skb, HWSIM_ATTR_REG_CUSTOM_REG, i);
+                        if (ret < 0)
+                                return ret;
+                }
+        }
+
+        if (param->reg_strict) {
+                ret = nla_put_flag(skb, HWSIM_ATTR_REG_STRICT_REG);
+                if (ret < 0)
+                        return ret;
+        }
+
+        if (param->p2p_device) {
+                ret = nla_put_flag(skb, HWSIM_ATTR_SUPPORT_P2P_DEVICE);
+                if (ret < 0)
+                        return ret;
+        }
+
+        if (param->use_chanctx) {
+                ret = nla_put_flag(skb, HWSIM_ATTR_USE_CHANCTX);
+                if (ret < 0)
+                        return ret;
+        }
+
+        if (param->hwname) {
+                ret = nla_put(skb, HWSIM_ATTR_RADIO_NAME,
+                              strlen(param->hwname), param->hwname);
+                if (ret < 0)
+                        return ret;
+        }
+
+        return 0;
+}
+
+static void hwsim_mcast_new_radio(int id, struct genl_info *info,
+                                  struct hwsim_new_radio_params *param)
+{
+        struct sk_buff *mcast_skb;
+        void *data;
+
+        mcast_skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!mcast_skb)
+                return;
+
+        data = genlmsg_put(mcast_skb, 0, 0, &hwsim_genl_family, 0,
+                           HWSIM_CMD_NEW_RADIO);
+        if (!data)
+                goto out_err;
+
+        if (append_radio_msg(mcast_skb, id, param) < 0)
+                goto out_err;
+
+        genlmsg_end(mcast_skb, data);
+
+        hwsim_mcast_config_msg(mcast_skb, info);
+        return;
+
+out_err:
+        genlmsg_cancel(mcast_skb, data);
+        nlmsg_free(mcast_skb);
+}
+
+static int mac80211_hwsim_new_radio(struct genl_info *info,
+                                    struct hwsim_new_radio_params *param)
 {
         int err;
         u8 addr[ETH_ALEN];
@@ -1956,16 +2228,16 @@ static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
         const struct ieee80211_ops *ops = &mac80211_hwsim_ops;
         int idx;
 
-        if (WARN_ON(channels > 1 && !use_chanctx))
+        if (WARN_ON(param->channels > 1 && !param->use_chanctx))
                 return -EINVAL;
 
         spin_lock_bh(&hwsim_radio_lock);
         idx = hwsim_radio_idx++;
         spin_unlock_bh(&hwsim_radio_lock);
 
-        if (use_chanctx)
+        if (param->use_chanctx)
                 ops = &mac80211_hwsim_mchan_ops;
-        hw = ieee80211_alloc_hw(sizeof(*data), ops);
+        hw = ieee80211_alloc_hw_nm(sizeof(*data), ops, param->hwname);
         if (!hw) {
                 printk(KERN_DEBUG "mac80211_hwsim: ieee80211_alloc_hw failed\n");
                 err = -ENOMEM;
@@ -1987,7 +2259,7 @@ static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
         if (err != 0) {
                 printk(KERN_DEBUG "mac80211_hwsim: device_bind_driver failed (%d)\n",
                        err);
-                goto failed_hw;
+                goto failed_bind;
         }
 
         skb_queue_head_init(&data->pending);
@@ -2003,9 +2275,12 @@ static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
         hw->wiphy->n_addresses = 2;
         hw->wiphy->addresses = data->addresses;
 
-        data->channels = channels;
-        data->use_chanctx = use_chanctx;
+        data->channels = param->channels;
+        data->use_chanctx = param->use_chanctx;
         data->idx = idx;
+        data->destroy_on_close = param->destroy_on_close;
+        if (info)
+                data->portid = info->snd_portid;
 
         if (data->use_chanctx) {
                 hw->wiphy->max_scan_ssids = 255;
@@ -2014,12 +2289,12 @@ static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
                 /* For channels > 1 DFS is not allowed */
                 hw->wiphy->n_iface_combinations = 1;
                 hw->wiphy->iface_combinations = &data->if_combination;
-                if (p2p_device)
+                if (param->p2p_device)
                         data->if_combination = hwsim_if_comb_p2p_dev[0];
                 else
                         data->if_combination = hwsim_if_comb[0];
                 data->if_combination.num_different_channels = data->channels;
-        } else if (p2p_device) {
+        } else if (param->p2p_device) {
                 hw->wiphy->iface_combinations = hwsim_if_comb_p2p_dev;
                 hw->wiphy->n_iface_combinations =
                         ARRAY_SIZE(hwsim_if_comb_p2p_dev);
@@ -2040,7 +2315,7 @@ static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
                                      BIT(NL80211_IFTYPE_ADHOC) |
                                      BIT(NL80211_IFTYPE_MESH_POINT);
 
-        if (p2p_device)
+        if (param->p2p_device)
                 hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_DEVICE);
 
         hw->flags = IEEE80211_HW_MFP_CAPABLE |
@@ -2060,7 +2335,8 @@ static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
         hw->wiphy->features |= NL80211_FEATURE_ACTIVE_MONITOR |
                                NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |
                                NL80211_FEATURE_STATIC_SMPS |
-                               NL80211_FEATURE_DYNAMIC_SMPS;
+                               NL80211_FEATURE_DYNAMIC_SMPS |
+                               NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
 
         /* ask mac80211 to reserve space for magic */
         hw->vif_data_size = sizeof(struct hwsim_vif_priv);
@@ -2095,6 +2371,7 @@ static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
                 sband->ht_cap.ht_supported = true;
                 sband->ht_cap.cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
                                     IEEE80211_HT_CAP_GRN_FLD |
+                                    IEEE80211_HT_CAP_SGI_20 |
                                     IEEE80211_HT_CAP_SGI_40 |
                                     IEEE80211_HT_CAP_DSSSCCK40;
                 sband->ht_cap.ampdu_factor = 0x3;
@@ -2142,15 +2419,19 @@ static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
         hw->max_rates = 4;
         hw->max_rate_tries = 11;
 
-        if (reg_strict)
+        if (param->reg_strict)
                 hw->wiphy->regulatory_flags |= REGULATORY_STRICT_REG;
-        if (regd) {
+        if (param->regd) {
+                data->regd = param->regd;
                 hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
-                wiphy_apply_custom_regulatory(hw->wiphy, regd);
+                wiphy_apply_custom_regulatory(hw->wiphy, param->regd);
                 /* give the regulatory workqueue a chance to run */
                 schedule_timeout_interruptible(1);
         }
 
+        if (param->no_vif)
+                hw->flags |= IEEE80211_HW_NO_AUTO_VIF;
+
         err = ieee80211_register_hw(hw);
         if (err < 0) {
                 printk(KERN_DEBUG "mac80211_hwsim: ieee80211_register_hw failed (%d)\n",
@@ -2160,8 +2441,11 @@ static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
 
         wiphy_debug(hw->wiphy, "hwaddr %pM registered\n", hw->wiphy->perm_addr);
 
-        if (reg_alpha2)
-                regulatory_hint(hw->wiphy, reg_alpha2);
+        if (param->reg_alpha2) {
+                data->alpha2[0] = param->reg_alpha2[0];
+                data->alpha2[1] = param->reg_alpha2[1];
+                regulatory_hint(hw->wiphy, param->reg_alpha2);
+        }
 
         data->debugfs = debugfs_create_dir("hwsim", hw->wiphy->debugfsdir);
         debugfs_create_file("ps", 0666, data->debugfs, data, &hwsim_fops_ps);
@@ -2180,9 +2464,14 @@ static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
         list_add_tail(&data->list, &hwsim_radios);
         spin_unlock_bh(&hwsim_radio_lock);
 
+        if (idx > 0)
+                hwsim_mcast_new_radio(idx, info, param);
+
         return idx;
 
 failed_hw:
+        device_release_driver(data->dev);
+failed_bind:
         device_unregister(data->dev);
 failed_drvdata:
         ieee80211_free_hw(hw);
@@ -2190,8 +2479,46 @@ failed:
         return err;
 }
 
-static void mac80211_hwsim_destroy_radio(struct mac80211_hwsim_data *data)
+static void hwsim_mcast_del_radio(int id, const char *hwname,
+                                  struct genl_info *info)
+{
+        struct sk_buff *skb;
+        void *data;
+        int ret;
+
+        skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!skb)
+                return;
+
+        data = genlmsg_put(skb, 0, 0, &hwsim_genl_family, 0,
+                           HWSIM_CMD_DEL_RADIO);
+        if (!data)
+                goto error;
+
+        ret = nla_put_u32(skb, HWSIM_ATTR_RADIO_ID, id);
+        if (ret < 0)
+                goto error;
+
+        ret = nla_put(skb, HWSIM_ATTR_RADIO_NAME, strlen(hwname),
+                      hwname);
+        if (ret < 0)
+                goto error;
+
+        genlmsg_end(skb, data);
+
+        hwsim_mcast_config_msg(skb, info);
+
+        return;
+
+error:
+        nlmsg_free(skb);
+}
+
+static void mac80211_hwsim_del_radio(struct mac80211_hwsim_data *data,
+                                     const char *hwname,
+                                     struct genl_info *info)
 {
+        hwsim_mcast_del_radio(data->idx, hwname, info);
         debugfs_remove_recursive(data->debugfs);
         ieee80211_unregister_hw(data->hw);
         device_release_driver(data->dev);
@@ -2199,6 +2526,44 @@ static void mac80211_hwsim_destroy_radio(struct mac80211_hwsim_data *data)
         ieee80211_free_hw(data->hw);
 }
 
+static int mac80211_hwsim_get_radio(struct sk_buff *skb,
+                                    struct mac80211_hwsim_data *data,
+                                    u32 portid, u32 seq,
+                                    struct netlink_callback *cb, int flags)
+{
+        void *hdr;
+        struct hwsim_new_radio_params param = { };
+        int res = -EMSGSIZE;
+
+        hdr = genlmsg_put(skb, portid, seq, &hwsim_genl_family, flags,
+                          HWSIM_CMD_GET_RADIO);
+        if (!hdr)
+                return -EMSGSIZE;
+
+        if (cb)
+                genl_dump_check_consistent(cb, hdr, &hwsim_genl_family);
+
+        param.reg_alpha2 = data->alpha2;
+        param.reg_strict = !!(data->hw->wiphy->regulatory_flags &
+                                        REGULATORY_STRICT_REG);
+        param.p2p_device = !!(data->hw->wiphy->interface_modes &
+                                        BIT(NL80211_IFTYPE_P2P_DEVICE));
+        param.use_chanctx = data->use_chanctx;
+        param.regd = data->regd;
+        param.channels = data->channels;
+        param.hwname = wiphy_name(data->hw->wiphy);
+
+        res = append_radio_msg(skb, data->idx, &param);
+        if (res < 0)
+                goto out_err;
+
+        return genlmsg_end(skb, hdr);
+
+out_err:
+        genlmsg_cancel(skb, hdr);
+        return res;
+}
+
 static void mac80211_hwsim_free(void)
 {
         struct mac80211_hwsim_data *data;
@@ -2209,7 +2574,8 @@ static void mac80211_hwsim_free(void)
                                                 list))) {
                 list_del(&data->list);
                 spin_unlock_bh(&hwsim_radio_lock);
-                mac80211_hwsim_destroy_radio(data);
+                mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy),
+                                         NULL);
                 spin_lock_bh(&hwsim_radio_lock);
         }
         spin_unlock_bh(&hwsim_radio_lock);
@@ -2337,7 +2703,6 @@ out:
 static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
                                           struct genl_info *info)
 {
-
         struct mac80211_hwsim_data *data2;
         struct ieee80211_rx_status rx_status;
         const u8 *dst;
@@ -2380,18 +2745,22 @@ static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
 
         /* A frame is received from user space */
         memset(&rx_status, 0, sizeof(rx_status));
+        /* TODO: Check ATTR_FREQ if it exists, and maybe throw away off-channel
+         * packets?
+         */
         rx_status.freq = data2->channel->center_freq;
         rx_status.band = data2->channel->band;
         rx_status.rate_idx = nla_get_u32(info->attrs[HWSIM_ATTR_RX_RATE]);
         rx_status.signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
 
         memcpy(IEEE80211_SKB_RXCB(skb), &rx_status, sizeof(rx_status));
+        data2->rx_pkts++;
+        data2->rx_bytes += skb->len;
         ieee80211_rx_irqsafe(data2->hw, skb);
 
         return 0;
 err:
         printk(KERN_DEBUG "mac80211_hwsim: error occurred in %s\n", __func__);
-        goto out;
 out:
         dev_kfree_skb(skb);
         return -EINVAL;
@@ -2427,54 +2796,72 @@ static int hwsim_register_received_nl(struct sk_buff *skb_2,
         return 0;
 }
 
-static int hwsim_create_radio_nl(struct sk_buff *msg, struct genl_info *info)
+static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
 {
-        unsigned int chans = channels;
-        const char *alpha2 = NULL;
-        const struct ieee80211_regdomain *regd = NULL;
-        bool reg_strict = info->attrs[HWSIM_ATTR_REG_STRICT_REG];
-        bool p2p_device = info->attrs[HWSIM_ATTR_SUPPORT_P2P_DEVICE];
-        bool use_chanctx;
+        struct hwsim_new_radio_params param = { 0 };
+
+        param.reg_strict = info->attrs[HWSIM_ATTR_REG_STRICT_REG];
+        param.p2p_device = info->attrs[HWSIM_ATTR_SUPPORT_P2P_DEVICE];
+        param.channels = channels;
+        param.destroy_on_close =
+                info->attrs[HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE];
 
         if (info->attrs[HWSIM_ATTR_CHANNELS])
-                chans = nla_get_u32(info->attrs[HWSIM_ATTR_CHANNELS]);
+                param.channels = nla_get_u32(info->attrs[HWSIM_ATTR_CHANNELS]);
+
+        if (info->attrs[HWSIM_ATTR_NO_VIF])
+                param.no_vif = true;
+
+        if (info->attrs[HWSIM_ATTR_RADIO_NAME])
+                param.hwname = nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]);
 
         if (info->attrs[HWSIM_ATTR_USE_CHANCTX])
-                use_chanctx = true;
+                param.use_chanctx = true;
         else
-                use_chanctx = (chans > 1);
+                param.use_chanctx = (param.channels > 1);
 
         if (info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2])
-                alpha2 = nla_data(info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2]);
+                param.reg_alpha2 =
+                        nla_data(info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2]);
 
         if (info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]) {
                 u32 idx = nla_get_u32(info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]);
 
                 if (idx >= ARRAY_SIZE(hwsim_world_regdom_custom))
                         return -EINVAL;
-                regd = hwsim_world_regdom_custom[idx];
+                param.regd = hwsim_world_regdom_custom[idx];
         }
 
-        return mac80211_hwsim_create_radio(chans, alpha2, regd, reg_strict,
-                                           p2p_device, use_chanctx);
+        return mac80211_hwsim_new_radio(info, &param);
 }
 
-static int hwsim_destroy_radio_nl(struct sk_buff *msg, struct genl_info *info)
+static int hwsim_del_radio_nl(struct sk_buff *msg, struct genl_info *info)
 {
         struct mac80211_hwsim_data *data;
-        int idx;
+        s64 idx = -1;
+        const char *hwname = NULL;
 
-        if (!info->attrs[HWSIM_ATTR_RADIO_ID])
+        if (info->attrs[HWSIM_ATTR_RADIO_ID])
+                idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
+        else if (info->attrs[HWSIM_ATTR_RADIO_NAME])
+                hwname = (void *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]);
+        else
                 return -EINVAL;
-        idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
 
         spin_lock_bh(&hwsim_radio_lock);
         list_for_each_entry(data, &hwsim_radios, list) {
-                if (data->idx != idx)
-                        continue;
+                if (idx >= 0) {
+                        if (data->idx != idx)
+                                continue;
+                } else {
+                        if (strcmp(hwname, wiphy_name(data->hw->wiphy)))
+                                continue;
+                }
+
                 list_del(&data->list);
                 spin_unlock_bh(&hwsim_radio_lock);
-                mac80211_hwsim_destroy_radio(data);
+                mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy),
+                                         info);
                 return 0;
         }
         spin_unlock_bh(&hwsim_radio_lock);
@@ -2482,6 +2869,77 @@ static int hwsim_destroy_radio_nl(struct sk_buff *msg, struct genl_info *info)
         return -ENODEV;
 }
 
+static int hwsim_get_radio_nl(struct sk_buff *msg, struct genl_info *info)
+{
+        struct mac80211_hwsim_data *data;
+        struct sk_buff *skb;
+        int idx, res = -ENODEV;
+
+        if (!info->attrs[HWSIM_ATTR_RADIO_ID])
+                return -EINVAL;
+        idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
+
+        spin_lock_bh(&hwsim_radio_lock);
+        list_for_each_entry(data, &hwsim_radios, list) {
+                if (data->idx != idx)
+                        continue;
+
+                skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+                if (!skb) {
+                        res = -ENOMEM;
+                        goto out_err;
+                }
+
+                res = mac80211_hwsim_get_radio(skb, data, info->snd_portid,
+                                               info->snd_seq, NULL, 0);
+                if (res < 0) {
+                        nlmsg_free(skb);
+                        goto out_err;
+                }
+
+                genlmsg_reply(skb, info);
+                break;
+        }
+
+out_err:
+        spin_unlock_bh(&hwsim_radio_lock);
+
+        return res;
+}
+
+static int hwsim_dump_radio_nl(struct sk_buff *skb,
+                               struct netlink_callback *cb)
+{
+        int idx = cb->args[0];
+        struct mac80211_hwsim_data *data = NULL;
+        int res;
+
+        spin_lock_bh(&hwsim_radio_lock);
+
+        if (idx == hwsim_radio_idx)
+                goto done;
+
+        list_for_each_entry(data, &hwsim_radios, list) {
+                if (data->idx < idx)
+                        continue;
+
+                res = mac80211_hwsim_get_radio(skb, data,
+                                               NETLINK_CB(cb->skb).portid,
+                                               cb->nlh->nlmsg_seq, cb,
+                                               NLM_F_MULTI);
+                if (res < 0)
+                        break;
+
+                idx = data->idx + 1;
+        }
+
+        cb->args[0] = idx;
+
+done:
+        spin_unlock_bh(&hwsim_radio_lock);
+        return skb->len;
+}
+
 /* Generic Netlink operations array */
 static const struct genl_ops hwsim_ops[] = {
         {
@@ -2501,19 +2959,48 @@ static const struct genl_ops hwsim_ops[] = {
                 .doit = hwsim_tx_info_frame_received_nl,
         },
         {
-                .cmd = HWSIM_CMD_CREATE_RADIO,
+                .cmd = HWSIM_CMD_NEW_RADIO,
                 .policy = hwsim_genl_policy,
-                .doit = hwsim_create_radio_nl,
+                .doit = hwsim_new_radio_nl,
                 .flags = GENL_ADMIN_PERM,
         },
         {
-                .cmd = HWSIM_CMD_DESTROY_RADIO,
+                .cmd = HWSIM_CMD_DEL_RADIO,
                 .policy = hwsim_genl_policy,
-                .doit = hwsim_destroy_radio_nl,
+                .doit = hwsim_del_radio_nl,
                 .flags = GENL_ADMIN_PERM,
         },
+        {
+                .cmd = HWSIM_CMD_GET_RADIO,
+                .policy = hwsim_genl_policy,
+                .doit = hwsim_get_radio_nl,
+                .dumpit = hwsim_dump_radio_nl,
+        },
 };
 
+static void destroy_radio(struct work_struct *work)
+{
+        struct mac80211_hwsim_data *data =
+                container_of(work, struct mac80211_hwsim_data, destroy_work);
+
+        mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy), NULL);
+}
+
+static void remove_user_radios(u32 portid)
+{
+        struct mac80211_hwsim_data *entry, *tmp;
+
+        spin_lock_bh(&hwsim_radio_lock);
+        list_for_each_entry_safe(entry, tmp, &hwsim_radios, list) {
+                if (entry->destroy_on_close && entry->portid == portid) {
+                        list_del(&entry->list);
+                        INIT_WORK(&entry->destroy_work, destroy_radio);
+                        schedule_work(&entry->destroy_work);
+                }
+        }
+        spin_unlock_bh(&hwsim_radio_lock);
+}
+
 static int mac80211_hwsim_netlink_notify(struct notifier_block *nb,
                                          unsigned long state,
                                          void *_notify)
@@ -2523,6 +3010,8 @@ static int mac80211_hwsim_netlink_notify(struct notifier_block *nb,
         if (state != NETLINK_URELEASE)
                 return NOTIFY_DONE;
 
+        remove_user_radios(notify->portid);
+
         if (notify->portid == wmediumd_portid) {
                 printk(KERN_INFO "mac80211_hwsim: wmediumd released netlink"
                        " socket, switching to perfect channel medium\n");
@@ -2542,7 +3031,9 @@ static int hwsim_init_netlink(void)
 
         printk(KERN_INFO "mac80211_hwsim: initializing netlink\n");
 
-        rc = genl_register_family_with_ops(&hwsim_genl_family, hwsim_ops);
+        rc = genl_register_family_with_ops_groups(&hwsim_genl_family,
+                                                  hwsim_ops,
+                                                  hwsim_mcgrps);
         if (rc)
                 goto failure;
 
@@ -2603,69 +3094,73 @@ static int __init init_mac80211_hwsim(void)
                 goto out_unregister_driver;
         }
 
+        err = hwsim_init_netlink();
+        if (err < 0)
+                goto out_unregister_driver;
+
         for (i = 0; i < radios; i++) {
-                const char *reg_alpha2 = NULL;
-                const struct ieee80211_regdomain *regd = NULL;
-                bool reg_strict = false;
+                struct hwsim_new_radio_params param = { 0 };
+
+                param.channels = channels;
 
                 switch (regtest) {
                 case HWSIM_REGTEST_DIFF_COUNTRY:
                         if (i < ARRAY_SIZE(hwsim_alpha2s))
-                                reg_alpha2 = hwsim_alpha2s[i];
+                                param.reg_alpha2 = hwsim_alpha2s[i];
                         break;
                 case HWSIM_REGTEST_DRIVER_REG_FOLLOW:
                         if (!i)
-                                reg_alpha2 = hwsim_alpha2s[0];
+                                param.reg_alpha2 = hwsim_alpha2s[0];
                         break;
                 case HWSIM_REGTEST_STRICT_ALL:
-                        reg_strict = true;
+                        param.reg_strict = true;
                 case HWSIM_REGTEST_DRIVER_REG_ALL:
-                        reg_alpha2 = hwsim_alpha2s[0];
+                        param.reg_alpha2 = hwsim_alpha2s[0];
                         break;
                 case HWSIM_REGTEST_WORLD_ROAM:
                         if (i == 0)
-                                regd = &hwsim_world_regdom_custom_01;
+                                param.regd = &hwsim_world_regdom_custom_01;
                         break;
                 case HWSIM_REGTEST_CUSTOM_WORLD:
-                        regd = &hwsim_world_regdom_custom_01;
+                        param.regd = &hwsim_world_regdom_custom_01;
                         break;
                 case HWSIM_REGTEST_CUSTOM_WORLD_2:
                         if (i == 0)
-                                regd = &hwsim_world_regdom_custom_01;
+                                param.regd = &hwsim_world_regdom_custom_01;
                         else if (i == 1)
-                                regd = &hwsim_world_regdom_custom_02;
+                                param.regd = &hwsim_world_regdom_custom_02;
                         break;
                 case HWSIM_REGTEST_STRICT_FOLLOW:
                         if (i == 0) {
-                                reg_strict = true;
-                                reg_alpha2 = hwsim_alpha2s[0];
+                                param.reg_strict = true;
+                                param.reg_alpha2 = hwsim_alpha2s[0];
                         }
                         break;
                 case HWSIM_REGTEST_STRICT_AND_DRIVER_REG:
                         if (i == 0) {
-                                reg_strict = true;
-                                reg_alpha2 = hwsim_alpha2s[0];
+                                param.reg_strict = true;
+                                param.reg_alpha2 = hwsim_alpha2s[0];
                         } else if (i == 1) {
-                                reg_alpha2 = hwsim_alpha2s[1];
+                                param.reg_alpha2 = hwsim_alpha2s[1];
                         }
                         break;
                 case HWSIM_REGTEST_ALL:
                         switch (i) {
                         case 0:
-                                regd = &hwsim_world_regdom_custom_01;
+                                param.regd = &hwsim_world_regdom_custom_01;
                                 break;
                         case 1:
-                                regd = &hwsim_world_regdom_custom_02;
+                                param.regd = &hwsim_world_regdom_custom_02;
                                 break;
                         case 2:
-                                reg_alpha2 = hwsim_alpha2s[0];
+                                param.reg_alpha2 = hwsim_alpha2s[0];
                                 break;
                         case 3:
-                                reg_alpha2 = hwsim_alpha2s[1];
+                                param.reg_alpha2 = hwsim_alpha2s[1];
                                 break;
                         case 4:
-                                reg_strict = true;
-                                reg_alpha2 = hwsim_alpha2s[2];
+                                param.reg_strict = true;
+                                param.reg_alpha2 = hwsim_alpha2s[2];
                                 break;
                         }
                         break;
@@ -2673,10 +3168,10 @@ static int __init init_mac80211_hwsim(void)
                         break;
                 }
 
-                err = mac80211_hwsim_create_radio(channels, reg_alpha2,
-                                                  regd, reg_strict,
-                                                  support_p2p_device,
-                                                  channels > 1);
+                param.p2p_device = support_p2p_device;
+                param.use_chanctx = channels > 1;
+
+                err = mac80211_hwsim_new_radio(NULL, &param);
                 if (err < 0)
                         goto out_free_radios;
         }
@@ -2702,10 +3197,6 @@ static int __init init_mac80211_hwsim(void)
         }
         rtnl_unlock();
 
-        err = hwsim_init_netlink();
-        if (err < 0)
-                goto out_free_mon;
-
         return 0;
 
 out_free_mon:
diff --git a/drivers/net/wireless/mac80211_hwsim.h b/drivers/net/wireless/mac80211_hwsim.h
index c9d0315575ba..66e1c73bd507 100644
--- a/drivers/net/wireless/mac80211_hwsim.h
+++ b/drivers/net/wireless/mac80211_hwsim.h
@@ -60,14 +60,17 @@ enum hwsim_tx_control_flags {
  * space, uses:
  *      %HWSIM_ATTR_ADDR_TRANSMITTER, %HWSIM_ATTR_ADDR_RECEIVER,
  *      %HWSIM_ATTR_FRAME, %HWSIM_ATTR_FLAGS, %HWSIM_ATTR_RX_RATE,
- *      %HWSIM_ATTR_SIGNAL, %HWSIM_ATTR_COOKIE
+ *      %HWSIM_ATTR_SIGNAL, %HWSIM_ATTR_COOKIE, %HWSIM_ATTR_FREQ (optional)
  * @HWSIM_CMD_TX_INFO_FRAME: Transmission info report from user space to
  * kernel, uses:
  *      %HWSIM_ATTR_ADDR_TRANSMITTER, %HWSIM_ATTR_FLAGS,
  *      %HWSIM_ATTR_TX_INFO, %HWSIM_ATTR_SIGNAL, %HWSIM_ATTR_COOKIE
- * @HWSIM_CMD_CREATE_RADIO: create a new radio with the given parameters,
- *      returns the radio ID (>= 0) or negative on errors
- * @HWSIM_CMD_DESTROY_RADIO: destroy a radio
+ * @HWSIM_CMD_NEW_RADIO: create a new radio with the given parameters,
+ *      returns the radio ID (>= 0) or negative on errors, if successful
+ *      then multicast the result
+ * @HWSIM_CMD_DEL_RADIO: destroy a radio, reply is multicasted
+ * @HWSIM_CMD_GET_RADIO: fetch information about existing radios, uses:
+ *      %HWSIM_ATTR_RADIO_ID
  * @__HWSIM_CMD_MAX: enum limit
  */
 enum {
@@ -75,12 +78,16 @@ enum {
         HWSIM_CMD_REGISTER,
         HWSIM_CMD_FRAME,
         HWSIM_CMD_TX_INFO_FRAME,
-        HWSIM_CMD_CREATE_RADIO,
-        HWSIM_CMD_DESTROY_RADIO,
+        HWSIM_CMD_NEW_RADIO,
+        HWSIM_CMD_DEL_RADIO,
+        HWSIM_CMD_GET_RADIO,
         __HWSIM_CMD_MAX,
 };
 #define HWSIM_CMD_MAX (_HWSIM_CMD_MAX - 1)
 
+#define HWSIM_CMD_CREATE_RADIO   HWSIM_CMD_NEW_RADIO
+#define HWSIM_CMD_DESTROY_RADIO  HWSIM_CMD_DEL_RADIO
+
 /**
  * enum hwsim_attrs - hwsim netlink attributes
  *
@@ -111,6 +118,11 @@ enum {
  * @HWSIM_ATTR_USE_CHANCTX: used with the %HWSIM_CMD_CREATE_RADIO
  *      command to force use of channel contexts even when only a
  *      single channel is supported
+ * @HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE: used with the %HWSIM_CMD_CREATE_RADIO
+ *      command to force radio removal when process that created the radio dies
+ * @HWSIM_ATTR_RADIO_NAME: Name of radio, e.g. phy666
+ * @HWSIM_ATTR_NO_VIF:  Do not create vif (wlanX) when creating radio.
+ * @HWSIM_ATTR_FREQ: Frequency at which packet is transmitted or received.
  * @__HWSIM_ATTR_MAX: enum limit
  */
 
@@ -132,6 +144,10 @@ enum {
         HWSIM_ATTR_REG_STRICT_REG,
         HWSIM_ATTR_SUPPORT_P2P_DEVICE,
         HWSIM_ATTR_USE_CHANCTX,
+        HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE,
+        HWSIM_ATTR_RADIO_NAME,
+        HWSIM_ATTR_NO_VIF,
+        HWSIM_ATTR_FREQ,
         __HWSIM_ATTR_MAX,
 };
 #define HWSIM_ATTR_MAX (__HWSIM_ATTR_MAX - 1)
diff --git a/drivers/net/wireless/mwifiex/11n.h b/drivers/net/wireless/mwifiex/11n.h
index 2ee268b632be..f275675cdbd3 100644
--- a/drivers/net/wireless/mwifiex/11n.h
+++ b/drivers/net/wireless/mwifiex/11n.h
@@ -84,6 +84,8 @@ mwifiex_is_amsdu_in_ampdu_allowed(struct mwifiex_private *priv,
 {
         struct mwifiex_tx_ba_stream_tbl *tx_tbl;
 
+        if (is_broadcast_ether_addr(ptr->ra))
+                return false;
         tx_tbl = mwifiex_get_ba_tbl(priv, tid, ptr->ra);
         if (tx_tbl)
                 return tx_tbl->amsdu;
@@ -96,6 +98,8 @@ static inline u8
 mwifiex_is_ampdu_allowed(struct mwifiex_private *priv,
                          struct mwifiex_ra_list_tbl *ptr, int tid)
 {
+        if (is_broadcast_ether_addr(ptr->ra))
+                return false;
         if (GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_UAP) {
                 return mwifiex_is_station_ampdu_allowed(priv, ptr, tid);
         } else {
diff --git a/drivers/net/wireless/mwifiex/11n_rxreorder.c b/drivers/net/wireless/mwifiex/11n_rxreorder.c
index 40057079ffb9..5ef5a0eeba50 100644
--- a/drivers/net/wireless/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless/mwifiex/11n_rxreorder.c
@@ -196,6 +196,7 @@ mwifiex_del_rx_reorder_entry(struct mwifiex_private *priv,
         mwifiex_11n_dispatch_pkt_until_start_win(priv, tbl, start_win);
 
         del_timer_sync(&tbl->timer_context.timer);
+        tbl->timer_context.timer_is_set = false;
 
         spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
         list_del(&tbl->list);
@@ -297,6 +298,7 @@ mwifiex_flush_data(unsigned long context)
                 (struct reorder_tmr_cnxt *) context;
         int start_win, seq_num;
 
+        ctx->timer_is_set = false;
         seq_num = mwifiex_11n_find_last_seq_num(ctx);
 
         if (seq_num < 0)
@@ -385,6 +387,7 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
 
         new_node->timer_context.ptr = new_node;
         new_node->timer_context.priv = priv;
+        new_node->timer_context.timer_is_set = false;
 
         init_timer(&new_node->timer_context.timer);
         new_node->timer_context.timer.function = mwifiex_flush_data;
@@ -399,6 +402,22 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
         spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
 }
 
+static void
+mwifiex_11n_rxreorder_timer_restart(struct mwifiex_rx_reorder_tbl *tbl)
+{
+        u32 min_flush_time;
+
+        if (tbl->win_size >= MWIFIEX_BA_WIN_SIZE_32)
+                min_flush_time = MIN_FLUSH_TIMER_15_MS;
+        else
+                min_flush_time = MIN_FLUSH_TIMER_MS;
+
+        mod_timer(&tbl->timer_context.timer,
+                  jiffies + msecs_to_jiffies(min_flush_time * tbl->win_size));
+
+        tbl->timer_context.timer_is_set = true;
+}
+
 /*
  * This function prepares command for adding a BA request.
  *
@@ -523,31 +542,31 @@ int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *priv,
                                 u8 *ta, u8 pkt_type, void *payload)
 {
         struct mwifiex_rx_reorder_tbl *tbl;
-        int start_win, end_win, win_size;
+        int prev_start_win, start_win, end_win, win_size;
         u16 pkt_index;
         bool init_window_shift = false;
+        int ret = 0;
 
         tbl = mwifiex_11n_get_rx_reorder_tbl(priv, tid, ta);
         if (!tbl) {
                 if (pkt_type != PKT_TYPE_BAR)
                         mwifiex_11n_dispatch_pkt(priv, payload);
-                return 0;
+                return ret;
         }
 
         if ((pkt_type == PKT_TYPE_AMSDU) && !tbl->amsdu) {
                 mwifiex_11n_dispatch_pkt(priv, payload);
-                return 0;
+                return ret;
         }
 
         start_win = tbl->start_win;
+        prev_start_win = start_win;
         win_size = tbl->win_size;
         end_win = ((start_win + win_size) - 1) & (MAX_TID_VALUE - 1);
         if (tbl->flags & RXREOR_INIT_WINDOW_SHIFT) {
                 init_window_shift = true;
                 tbl->flags &= ~RXREOR_INIT_WINDOW_SHIFT;
         }
-        mod_timer(&tbl->timer_context.timer,
-                  jiffies + msecs_to_jiffies(MIN_FLUSH_TIMER_MS * win_size));
 
         if (tbl->flags & RXREOR_FORCE_NO_DROP) {
                 dev_dbg(priv->adapter->dev,
@@ -568,11 +587,14 @@ int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *priv,
                 if ((start_win + TWOPOW11) > (MAX_TID_VALUE - 1)) {
                         if (seq_num >= ((start_win + TWOPOW11) &
                                         (MAX_TID_VALUE - 1)) &&
-                            seq_num < start_win)
-                                return -1;
+                            seq_num < start_win) {
+                                ret = -1;
+                                goto done;
+                        }
                 } else if ((seq_num < start_win) ||
-                           (seq_num > (start_win + TWOPOW11))) {
-                        return -1;
+                           (seq_num >= (start_win + TWOPOW11))) {
+                        ret = -1;
+                        goto done;
                 }
         }
 
@@ -601,8 +623,10 @@ int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *priv,
                 else
                         pkt_index = (seq_num+MAX_TID_VALUE) - start_win;
 
-                if (tbl->rx_reorder_ptr[pkt_index])
-                        return -1;
+                if (tbl->rx_reorder_ptr[pkt_index]) {
+                        ret = -1;
+                        goto done;
+                }
 
                 tbl->rx_reorder_ptr[pkt_index] = payload;
         }
@@ -613,7 +637,11 @@ int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *priv,
          */
         mwifiex_11n_scan_and_dispatch(priv, tbl);
 
-        return 0;
+done:
+        if (!tbl->timer_context.timer_is_set ||
+            prev_start_win != tbl->start_win)
+                mwifiex_11n_rxreorder_timer_restart(tbl);
+        return ret;
 }
 
 /*
diff --git a/drivers/net/wireless/mwifiex/11n_rxreorder.h b/drivers/net/wireless/mwifiex/11n_rxreorder.h
index 3a87bb0e3a62..63ecea89b4ab 100644
--- a/drivers/net/wireless/mwifiex/11n_rxreorder.h
+++ b/drivers/net/wireless/mwifiex/11n_rxreorder.h
@@ -21,6 +21,8 @@
 #define _MWIFIEX_11N_RXREORDER_H_
 
 #define MIN_FLUSH_TIMER_MS              50
+#define MIN_FLUSH_TIMER_15_MS           15
+#define MWIFIEX_BA_WIN_SIZE_32          32
 
 #define PKT_TYPE_BAR 0xE7
 #define MAX_TID_VALUE                   (2 << 11)
diff --git a/drivers/net/wireless/mwifiex/Kconfig b/drivers/net/wireless/mwifiex/Kconfig
index e70d0df9b0da..aa01c9bc77f9 100644
--- a/drivers/net/wireless/mwifiex/Kconfig
+++ b/drivers/net/wireless/mwifiex/Kconfig
@@ -31,7 +31,7 @@ config MWIFIEX_PCIE
           mwifiex_pcie.
 
 config MWIFIEX_USB
-        tristate "Marvell WiFi-Ex Driver for USB8797/8897"
+        tristate "Marvell WiFi-Ex Driver for USB8766/8797/8897"
         depends on MWIFIEX && USB
         select FW_LOADER
         ---help---
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index 0dd672954ad1..17f0ee02d6e7 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -992,6 +992,52 @@ mwifiex_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *dev,
         return mwifiex_dump_station_info(priv, sinfo);
 }
 
+static int
+mwifiex_cfg80211_dump_survey(struct wiphy *wiphy, struct net_device *dev,
+                             int idx, struct survey_info *survey)
+{
+        struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
+        struct mwifiex_chan_stats *pchan_stats = priv->adapter->chan_stats;
+        enum ieee80211_band band;
+
+        dev_dbg(priv->adapter->dev, "dump_survey idx=%d\n", idx);
+
+        memset(survey, 0, sizeof(struct survey_info));
+
+        if ((GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_STA) &&
+            priv->media_connected && idx == 0) {
+                        u8 curr_bss_band = priv->curr_bss_params.band;
+                        u32 chan = priv->curr_bss_params.bss_descriptor.channel;
+
+                        band = mwifiex_band_to_radio_type(curr_bss_band);
+                        survey->channel = ieee80211_get_channel(wiphy,
+                                ieee80211_channel_to_frequency(chan, band));
+
+                        if (priv->bcn_nf_last) {
+                                survey->filled = SURVEY_INFO_NOISE_DBM;
+                                survey->noise = priv->bcn_nf_last;
+                        }
+                        return 0;
+        }
+
+        if (idx >= priv->adapter->num_in_chan_stats)
+                return -ENOENT;
+
+        if (!pchan_stats[idx].cca_scan_dur)
+                return 0;
+
+        band = pchan_stats[idx].bandcfg;
+        survey->channel = ieee80211_get_channel(wiphy,
+            ieee80211_channel_to_frequency(pchan_stats[idx].chan_num, band));
+        survey->filled = SURVEY_INFO_NOISE_DBM |
+                SURVEY_INFO_CHANNEL_TIME | SURVEY_INFO_CHANNEL_TIME_BUSY;
+        survey->noise = pchan_stats[idx].noise;
+        survey->channel_time = pchan_stats[idx].cca_scan_dur;
+        survey->channel_time_busy = pchan_stats[idx].cca_busy_dur;
+
+        return 0;
+}
+
 /* Supported rates to be advertised to the cfg80211 */
 static struct ieee80211_rate mwifiex_rates[] = {
         {.bitrate = 10, .hw_value = 2, },
@@ -1239,7 +1285,7 @@ static int mwifiex_cfg80211_change_beacon(struct wiphy *wiphy,
  */
 static int
 mwifiex_cfg80211_del_station(struct wiphy *wiphy, struct net_device *dev,
-                             const u8 *mac)
+                             struct station_del_parameters *params)
 {
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
         struct mwifiex_sta_node *sta_node;
@@ -1248,7 +1294,7 @@ mwifiex_cfg80211_del_station(struct wiphy *wiphy, struct net_device *dev,
         if (list_empty(&priv->sta_list) || !priv->bss_started)
                 return 0;
 
-        if (!mac || is_broadcast_ether_addr(mac)) {
+        if (!params->mac || is_broadcast_ether_addr(params->mac)) {
                 wiphy_dbg(wiphy, "%s: NULL/broadcast mac address\n", __func__);
                 list_for_each_entry(sta_node, &priv->sta_list, list) {
                         if (mwifiex_send_cmd(priv, HostCmd_CMD_UAP_STA_DEAUTH,
@@ -1258,9 +1304,10 @@ mwifiex_cfg80211_del_station(struct wiphy *wiphy, struct net_device *dev,
                         mwifiex_uap_del_sta_data(priv, sta_node);
                 }
         } else {
-                wiphy_dbg(wiphy, "%s: mac address %pM\n", __func__, mac);
+                wiphy_dbg(wiphy, "%s: mac address %pM\n", __func__,
+                          params->mac);
                 spin_lock_irqsave(&priv->sta_list_spinlock, flags);
-                sta_node = mwifiex_get_sta_entry(priv, mac);
+                sta_node = mwifiex_get_sta_entry(priv, params->mac);
                 spin_unlock_irqrestore(&priv->sta_list_spinlock, flags);
                 if (sta_node) {
                         if (mwifiex_send_cmd(priv, HostCmd_CMD_UAP_STA_DEAUTH,
@@ -1759,6 +1806,10 @@ mwifiex_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
                 dev_dbg(priv->adapter->dev,
                         "info: associated to bssid %pM successfully\n",
                         priv->cfg_bssid);
+                if (ISSUPP_TDLS_ENABLED(priv->adapter->fw_cap_info) &&
+                    priv->adapter->auto_tdls &&
+                    priv->bss_type == MWIFIEX_BSS_TYPE_STA)
+                        mwifiex_setup_auto_tdls_timer(priv);
         } else {
                 dev_dbg(priv->adapter->dev,
                         "info: association to bssid %pM failed\n",
@@ -2630,11 +2681,13 @@ mwifiex_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
                 dev_dbg(priv->adapter->dev,
                         "Send TDLS Setup Request to %pM status_code=%d\n", peer,
                          status_code);
+                mwifiex_add_auto_tdls_peer(priv, peer);
                 ret = mwifiex_send_tdls_data_frame(priv, peer, action_code,
                                                    dialog_token, status_code,
                                                    extra_ies, extra_ies_len);
                 break;
         case WLAN_TDLS_SETUP_RESPONSE:
+                mwifiex_add_auto_tdls_peer(priv, peer);
                 dev_dbg(priv->adapter->dev,
                         "Send TDLS Setup Response to %pM status_code=%d\n",
                         peer, status_code);
@@ -2779,6 +2832,7 @@ static struct cfg80211_ops mwifiex_cfg80211_ops = {
         .disconnect = mwifiex_cfg80211_disconnect,
         .get_station = mwifiex_cfg80211_get_station,
         .dump_station = mwifiex_cfg80211_dump_station,
+        .dump_survey = mwifiex_cfg80211_dump_survey,
         .set_wiphy_params = mwifiex_cfg80211_set_wiphy_params,
         .join_ibss = mwifiex_cfg80211_join_ibss,
         .leave_ibss = mwifiex_cfg80211_leave_ibss,
@@ -2840,6 +2894,25 @@ static const struct wiphy_coalesce_support mwifiex_coalesce_support = {
         .max_pkt_offset = MWIFIEX_MAX_OFFSET_LEN,
 };
 
+int mwifiex_init_channel_scan_gap(struct mwifiex_adapter *adapter)
+{
+        u32 n_channels_bg, n_channels_a = 0;
+
+        n_channels_bg = mwifiex_band_2ghz.n_channels;
+
+        if (adapter->config_bands & BAND_A)
+                n_channels_a = mwifiex_band_5ghz.n_channels;
+
+        adapter->num_in_chan_stats = max_t(u32, n_channels_bg, n_channels_a);
+        adapter->chan_stats = vmalloc(sizeof(*adapter->chan_stats) *
+                                      adapter->num_in_chan_stats);
+
+        if (!adapter->chan_stats)
+                return -ENOMEM;
+
+        return 0;
+}
+
 /*
  * This function registers the device with CFG802.11 subsystem.
  *
diff --git a/drivers/net/wireless/mwifiex/decl.h b/drivers/net/wireless/mwifiex/decl.h
index e0d00a7f0ec3..fc0b1ed80a6a 100644
--- a/drivers/net/wireless/mwifiex/decl.h
+++ b/drivers/net/wireless/mwifiex/decl.h
@@ -85,6 +85,11 @@
 #define MWIFIEX_TDLS_CREATE_LINK              0x02
 #define MWIFIEX_TDLS_CONFIG_LINK              0x03
 
+#define MWIFIEX_TDLS_RSSI_HIGH          50
+#define MWIFIEX_TDLS_RSSI_LOW           55
+#define MWIFIEX_TDLS_MAX_FAIL_COUNT      4
+#define MWIFIEX_AUTO_TDLS_IDLE_TIME     10
+
 enum mwifiex_bss_type {
         MWIFIEX_BSS_TYPE_STA = 0,
         MWIFIEX_BSS_TYPE_UAP = 1,
@@ -185,4 +190,14 @@ struct mwifiex_arp_eth_header {
         u8 ar_tha[ETH_ALEN];
         u8 ar_tip[4];
 } __packed;
+
+struct mwifiex_chan_stats {
+        u8 chan_num;
+        u8 bandcfg;
+        u8 flags;
+        s8 noise;
+        u16 total_bss;
+        u16 cca_scan_dur;
+        u16 cca_busy_dur;
+} __packed;
 #endif /* !_MWIFIEX_DECL_H_ */
diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
index 1eb61739071f..e095f371545a 100644
--- a/drivers/net/wireless/mwifiex/fw.h
+++ b/drivers/net/wireless/mwifiex/fw.h
@@ -172,6 +172,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 #define TLV_TYPE_TDLS_IDLE_TIMEOUT  (PROPRIETARY_TLV_BASE_ID + 194)
 #define TLV_TYPE_SCAN_CHANNEL_GAP   (PROPRIETARY_TLV_BASE_ID + 197)
 #define TLV_TYPE_API_REV            (PROPRIETARY_TLV_BASE_ID + 199)
+#define TLV_TYPE_CHANNEL_STATS      (PROPRIETARY_TLV_BASE_ID + 198)
 
 #define MWIFIEX_TX_DATA_BUF_SIZE_2K        2048
 
@@ -583,6 +584,7 @@ struct rxpd {
          * [Bit 7] Reserved
          */
         u8 ht_info;
+        u8 reserved[3];
         u8 flags;
 } __packed;
 
@@ -611,6 +613,16 @@ struct uap_rxpd {
         u8 reserved1;
 };
 
+struct mwifiex_fw_chan_stats {
+        u8 chan_num;
+        u8 bandcfg;
+        u8 flags;
+        s8 noise;
+        __le16 total_bss;
+        __le16 cca_scan_dur;
+        __le16 cca_busy_dur;
+} __packed;
+
 enum mwifiex_chan_scan_mode_bitmasks {
         MWIFIEX_PASSIVE_SCAN = BIT(0),
         MWIFIEX_DISABLE_CHAN_FILT = BIT(1),
@@ -660,6 +672,11 @@ struct mwifiex_ie_types_scan_chan_gap {
         __le16 chan_gap;
 } __packed;
 
+struct mwifiex_ietypes_chanstats {
+        struct mwifiex_ie_types_header header;
+        struct mwifiex_fw_chan_stats chanstats[0];
+} __packed;
+
 struct mwifiex_ie_types_wildcard_ssid_params {
         struct mwifiex_ie_types_header header;
         u8 max_ssid_length;
diff --git a/drivers/net/wireless/mwifiex/init.c b/drivers/net/wireless/mwifiex/init.c
index 580aa45ec4bc..cc15ab81aa66 100644
--- a/drivers/net/wireless/mwifiex/init.c
+++ b/drivers/net/wireless/mwifiex/init.c
@@ -137,6 +137,7 @@ int mwifiex_init_priv(struct mwifiex_private *priv)
         priv->csa_expire_time = 0;
         priv->del_list_idx = 0;
         priv->hs2_enabled = false;
+        priv->check_tdls_tx = false;
         memcpy(priv->tos_to_tid_inv, tos_to_tid_inv, MAX_NUM_TID);
 
         return mwifiex_add_bss_prio_tbl(priv);
@@ -366,6 +367,7 @@ static void mwifiex_free_lock_list(struct mwifiex_adapter *adapter)
                         list_del(&priv->tx_ba_stream_tbl_ptr);
                         list_del(&priv->rx_reorder_tbl_ptr);
                         list_del(&priv->sta_list);
+                        list_del(&priv->auto_tdls_list);
                 }
         }
 }
@@ -434,6 +436,7 @@ int mwifiex_init_lock_list(struct mwifiex_adapter *adapter)
                         spin_lock_init(&priv->wmm.ra_list_spinlock);
                         spin_lock_init(&priv->curr_bcn_buf_lock);
                         spin_lock_init(&priv->sta_list_spinlock);
+                        spin_lock_init(&priv->auto_tdls_lock);
                 }
         }
 
@@ -449,7 +452,6 @@ int mwifiex_init_lock_list(struct mwifiex_adapter *adapter)
         spin_lock_init(&adapter->scan_pending_q_lock);
         spin_lock_init(&adapter->rx_proc_lock);
 
-        skb_queue_head_init(&adapter->usb_rx_data_q);
         skb_queue_head_init(&adapter->rx_data_q);
 
         for (i = 0; i < adapter->priv_num; ++i) {
@@ -466,6 +468,7 @@ int mwifiex_init_lock_list(struct mwifiex_adapter *adapter)
                 INIT_LIST_HEAD(&priv->tx_ba_stream_tbl_ptr);
                 INIT_LIST_HEAD(&priv->rx_reorder_tbl_ptr);
                 INIT_LIST_HEAD(&priv->sta_list);
+                INIT_LIST_HEAD(&priv->auto_tdls_list);
                 skb_queue_head_init(&priv->tdls_txq);
 
                 spin_lock_init(&priv->tx_ba_stream_tbl_lock);
@@ -646,6 +649,7 @@ mwifiex_shutdown_drv(struct mwifiex_adapter *adapter)
                 if (adapter->priv[i]) {
                         priv = adapter->priv[i];
 
+                        mwifiex_clean_auto_tdls(priv);
                         mwifiex_clean_txrx(priv);
                         mwifiex_delete_bss_prio_tbl(priv);
                 }
@@ -668,19 +672,6 @@ mwifiex_shutdown_drv(struct mwifiex_adapter *adapter)
 
         spin_lock(&adapter->mwifiex_lock);
 
-        if (adapter->if_ops.data_complete) {
-                while ((skb = skb_dequeue(&adapter->usb_rx_data_q))) {
-                        struct mwifiex_rxinfo *rx_info = MWIFIEX_SKB_RXCB(skb);
-
-                        priv = adapter->priv[rx_info->bss_num];
-                        if (priv)
-                                priv->stats.rx_dropped++;
-
-                        dev_kfree_skb_any(skb);
-                        adapter->if_ops.data_complete(adapter);
-                }
-        }
-
         mwifiex_adapter_cleanup(adapter);
 
         spin_unlock(&adapter->mwifiex_lock);
diff --git a/drivers/net/wireless/mwifiex/join.c b/drivers/net/wireless/mwifiex/join.c
index 8d6c25908b6d..411a6c2f4aca 100644
--- a/drivers/net/wireless/mwifiex/join.c
+++ b/drivers/net/wireless/mwifiex/join.c
@@ -880,9 +880,7 @@ mwifiex_cmd_802_11_ad_hoc_start(struct mwifiex_private *priv,
 
         /* Set Capability info */
         bss_desc->cap_info_bitmap |= WLAN_CAPABILITY_IBSS;
-        tmp_cap = le16_to_cpu(adhoc_start->cap_info_bitmap);
-        tmp_cap &= ~WLAN_CAPABILITY_ESS;
-        tmp_cap |= WLAN_CAPABILITY_IBSS;
+        tmp_cap = WLAN_CAPABILITY_IBSS;
 
         /* Set up privacy in bss_desc */
         if (priv->sec_info.encryption_mode) {
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index d5070c444fe1..0e50120eb807 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -28,6 +28,11 @@ const char driver_version[] = "mwifiex " VERSION " (%s) ";
 static char *cal_data_cfg;
 module_param(cal_data_cfg, charp, 0);
 
+static unsigned short driver_mode;
+module_param(driver_mode, ushort, 0);
+MODULE_PARM_DESC(driver_mode,
+                 "station=0x1(default), ap-sta=0x3, station-p2p=0x5, ap-sta-p2p=0x7");
+
 /*
  * This function registers the device and performs all the necessary
  * initializations.
@@ -122,6 +127,7 @@ static int mwifiex_unregister(struct mwifiex_adapter *adapter)
                 }
         }
 
+        vfree(adapter->chan_stats);
         kfree(adapter);
         return 0;
 }
@@ -145,6 +151,8 @@ static int mwifiex_process_rx(struct mwifiex_adapter *adapter)
                 atomic_dec(&adapter->rx_pending);
                 if (adapter->delay_main_work &&
                     (atomic_read(&adapter->rx_pending) < LOW_RX_PENDING)) {
+                        if (adapter->if_ops.submit_rem_rx_urbs)
+                                adapter->if_ops.submit_rem_rx_urbs(adapter);
                         adapter->delay_main_work = false;
                         queue_work(adapter->workqueue, &adapter->main_work);
                 }
@@ -177,7 +185,6 @@ int mwifiex_main_process(struct mwifiex_adapter *adapter)
 {
         int ret = 0;
         unsigned long flags;
-        struct sk_buff *skb;
 
         spin_lock_irqsave(&adapter->main_proc_lock, flags);
 
@@ -252,11 +259,6 @@ process_start:
                         }
                 }
 
-                /* Check Rx data for USB */
-                if (adapter->iface_type == MWIFIEX_USB)
-                        while ((skb = skb_dequeue(&adapter->usb_rx_data_q)))
-                                mwifiex_handle_rx_packet(adapter, skb);
-
                 /* Check for event */
                 if (adapter->event_received) {
                         adapter->event_received = false;
@@ -447,6 +449,16 @@ static void mwifiex_fw_dpc(const struct firmware *firmware, void *context)
                 goto err_init_fw;
         }
 
+        if (mwifiex_init_channel_scan_gap(adapter)) {
+                dev_err(adapter->dev, "could not init channel stats table\n");
+                goto err_init_fw;
+        }
+
+        if (driver_mode) {
+                driver_mode &= MWIFIEX_DRIVER_MODE_BITMASK;
+                driver_mode |= MWIFIEX_DRIVER_MODE_STA;
+        }
+
         rtnl_lock();
         /* Create station interface by default */
         wdev = mwifiex_add_virtual_intf(adapter->wiphy, "mlan%d",
@@ -456,6 +468,28 @@ static void mwifiex_fw_dpc(const struct firmware *firmware, void *context)
                 rtnl_unlock();
                 goto err_add_intf;
         }
+
+        if (driver_mode & MWIFIEX_DRIVER_MODE_UAP) {
+                wdev = mwifiex_add_virtual_intf(adapter->wiphy, "uap%d",
+                                                NL80211_IFTYPE_AP, NULL, NULL);
+                if (IS_ERR(wdev)) {
+                        dev_err(adapter->dev, "cannot create AP interface\n");
+                        rtnl_unlock();
+                        goto err_add_intf;
+                }
+        }
+
+        if (driver_mode & MWIFIEX_DRIVER_MODE_P2P) {
+                wdev = mwifiex_add_virtual_intf(adapter->wiphy, "p2p%d",
+                                                NL80211_IFTYPE_P2P_CLIENT, NULL,
+                                                NULL);
+                if (IS_ERR(wdev)) {
+                        dev_err(adapter->dev,
+                                "cannot create p2p client interface\n");
+                        rtnl_unlock();
+                        goto err_add_intf;
+                }
+        }
         rtnl_unlock();
 
         mwifiex_drv_get_driver_version(adapter, fmt, sizeof(fmt) - 1);
@@ -628,6 +662,13 @@ mwifiex_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
          */
         __net_timestamp(skb);
 
+        if (ISSUPP_TDLS_ENABLED(priv->adapter->fw_cap_info) &&
+            priv->bss_type == MWIFIEX_BSS_TYPE_STA &&
+            !ether_addr_equal_unaligned(priv->cfg_bssid, skb->data)) {
+                if (priv->adapter->auto_tdls && priv->check_tdls_tx)
+                        mwifiex_tdls_check_tx(priv, skb);
+        }
+
         mwifiex_queue_tx_pkt(priv, skb);
 
         return 0;
@@ -858,7 +899,7 @@ mwifiex_add_card(void *card, struct semaphore *sem,
         adapter->cmd_wait_q.status = 0;
         adapter->scan_wait_q_woken = false;
 
-        if (num_possible_cpus() > 1) {
+        if ((num_possible_cpus() > 1) || adapter->iface_type == MWIFIEX_USB) {
                 adapter->rx_work_enabled = true;
                 pr_notice("rx work enabled, cpus %d\n", num_possible_cpus());
         }
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index e2635747d966..5a690d5210f0 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -48,6 +48,11 @@ enum {
         MWIFIEX_SYNC_CMD
 };
 
+#define MWIFIEX_DRIVER_MODE_STA                 BIT(0)
+#define MWIFIEX_DRIVER_MODE_UAP                 BIT(1)
+#define MWIFIEX_DRIVER_MODE_P2P                 BIT(2)
+#define MWIFIEX_DRIVER_MODE_BITMASK             (BIT(0) | BIT(1) | BIT(2))
+
 #define MWIFIEX_MAX_AP                          64
 
 #define MWIFIEX_DEFAULT_WATCHDOG_TIMEOUT        (5 * HZ)
@@ -106,10 +111,7 @@ enum {
  */
 #define IS_CARD_RX_RCVD(adapter) (adapter->cmd_resp_received || \
                                 adapter->event_received || \
-                                ((adapter->iface_type != MWIFIEX_USB) && \
-                                adapter->data_received) || \
-                                ((adapter->iface_type == MWIFIEX_USB) && \
-                                !skb_queue_empty(&adapter->usb_rx_data_q)))
+                                adapter->data_received)
 
 #define MWIFIEX_TYPE_CMD                                1
 #define MWIFIEX_TYPE_DATA                               0
@@ -504,8 +506,11 @@ struct mwifiex_private {
         struct mwifiex_wmm_desc wmm;
         atomic_t wmm_tx_pending[IEEE80211_NUM_ACS];
         struct list_head sta_list;
-        /* spin lock for associated station list */
+        /* spin lock for associated station/TDLS peers list */
         spinlock_t sta_list_spinlock;
+        struct list_head auto_tdls_list;
+        /* spin lock for auto TDLS peer list */
+        spinlock_t auto_tdls_lock;
         struct list_head tx_ba_stream_tbl_ptr;
         /* spin lock for tx_ba_stream_tbl_ptr queue */
         spinlock_t tx_ba_stream_tbl_lock;
@@ -570,6 +575,9 @@ struct mwifiex_private {
         bool hs2_enabled;
         struct station_parameters *sta_params;
         struct sk_buff_head tdls_txq;
+        u8 check_tdls_tx;
+        struct timer_list auto_tdls_timer;
+        bool auto_tdls_timer_active;
 };
 
 enum mwifiex_ba_status {
@@ -592,6 +600,7 @@ struct reorder_tmr_cnxt {
         struct timer_list timer;
         struct mwifiex_rx_reorder_tbl *ptr;
         struct mwifiex_private *priv;
+        u8 timer_is_set;
 };
 
 struct mwifiex_rx_reorder_tbl {
@@ -669,6 +678,17 @@ struct mwifiex_sta_node {
         struct mwifiex_tdls_capab tdls_cap;
 };
 
+struct mwifiex_auto_tdls_peer {
+        struct list_head list;
+        u8 mac_addr[ETH_ALEN];
+        u8 tdls_status;
+        int rssi;
+        long rssi_jiffies;
+        u8 failure_count;
+        u8 do_discover;
+        u8 do_setup;
+};
+
 struct mwifiex_if_ops {
         int (*init_if) (struct mwifiex_adapter *);
         void (*cleanup_if) (struct mwifiex_adapter *);
@@ -689,13 +709,13 @@ struct mwifiex_if_ops {
         void (*cleanup_mpa_buf) (struct mwifiex_adapter *);
         int (*cmdrsp_complete) (struct mwifiex_adapter *, struct sk_buff *);
         int (*event_complete) (struct mwifiex_adapter *, struct sk_buff *);
-        int (*data_complete) (struct mwifiex_adapter *);
         int (*init_fw_port) (struct mwifiex_adapter *);
         int (*dnld_fw) (struct mwifiex_adapter *, struct mwifiex_fw_image *);
         void (*card_reset) (struct mwifiex_adapter *);
         void (*fw_dump)(struct mwifiex_adapter *);
         int (*clean_pcie_ring) (struct mwifiex_adapter *adapter);
         void (*iface_work)(struct work_struct *work);
+        void (*submit_rem_rx_urbs)(struct mwifiex_adapter *adapter);
 };
 
 struct mwifiex_adapter {
@@ -766,7 +786,6 @@ struct mwifiex_adapter {
         spinlock_t scan_pending_q_lock;
         /* spin lock for RX processing routine */
         spinlock_t rx_proc_lock;
-        struct sk_buff_head usb_rx_data_q;
         u32 scan_processing;
         u16 region_code;
         struct mwifiex_802_11d_domain_reg domain_reg;
@@ -844,6 +863,10 @@ struct mwifiex_adapter {
         u8 curr_mem_idx;
         bool scan_chan_gap_enabled;
         struct sk_buff_head rx_data_q;
+        struct mwifiex_chan_stats *chan_stats;
+        u32 num_in_chan_stats;
+        int survey_idx;
+        bool auto_tdls;
 };
 
 int mwifiex_init_lock_list(struct mwifiex_adapter *adapter);
@@ -1030,7 +1053,8 @@ void mwifiex_set_11ac_ba_params(struct mwifiex_private *priv);
 int mwifiex_cmd_802_11_scan_ext(struct mwifiex_private *priv,
                                 struct host_cmd_ds_command *cmd,
                                 void *data_buf);
-int mwifiex_ret_802_11_scan_ext(struct mwifiex_private *priv);
+int mwifiex_ret_802_11_scan_ext(struct mwifiex_private *priv,
+                                struct host_cmd_ds_command *resp);
 int mwifiex_handle_event_ext_scan_report(struct mwifiex_private *priv,
                                          void *buf);
 
@@ -1300,6 +1324,17 @@ u8 mwifiex_get_center_freq_index(struct mwifiex_private *priv, u8 band,
                                  u32 pri_chan, u8 chan_bw);
 int mwifiex_init_channel_scan_gap(struct mwifiex_adapter *adapter);
 
+int mwifiex_tdls_check_tx(struct mwifiex_private *priv, struct sk_buff *skb);
+void mwifiex_flush_auto_tdls_list(struct mwifiex_private *priv);
+void mwifiex_auto_tdls_update_peer_status(struct mwifiex_private *priv,
+                                          const u8 *mac, u8 link_status);
+void mwifiex_auto_tdls_update_peer_signal(struct mwifiex_private *priv,
+                                          u8 *mac, s8 snr, s8 nflr);
+void mwifiex_check_auto_tdls(unsigned long context);
+void mwifiex_add_auto_tdls_peer(struct mwifiex_private *priv, const u8 *mac);
+void mwifiex_setup_auto_tdls_timer(struct mwifiex_private *priv);
+void mwifiex_clean_auto_tdls(struct mwifiex_private *priv);
+
 #ifdef CONFIG_DEBUG_FS
 void mwifiex_debugfs_init(void);
 void mwifiex_debugfs_remove(void);
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index ca64d4c94112..3a17821157d7 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -1755,6 +1755,7 @@ static void mwifiex_complete_scan(struct mwifiex_private *priv)
 {
         struct mwifiex_adapter *adapter = priv->adapter;
 
+        adapter->survey_idx = 0;
         if (adapter->curr_cmd->wait_q_enabled) {
                 adapter->cmd_wait_q.status = 0;
                 if (!priv->scan_request) {
@@ -1976,10 +1977,53 @@ int mwifiex_cmd_802_11_scan_ext(struct mwifiex_private *priv,
         return 0;
 }
 
+static void
+mwifiex_update_chan_statistics(struct mwifiex_private *priv,
+                               struct mwifiex_ietypes_chanstats *tlv_stat)
+{
+        struct mwifiex_adapter *adapter = priv->adapter;
+        u8 i, num_chan;
+        struct mwifiex_fw_chan_stats *fw_chan_stats;
+        struct mwifiex_chan_stats chan_stats;
+
+        fw_chan_stats = (void *)((u8 *)tlv_stat +
+                              sizeof(struct mwifiex_ie_types_header));
+        num_chan = le16_to_cpu(tlv_stat->header.len) /
+                                              sizeof(struct mwifiex_chan_stats);
+
+        for (i = 0 ; i < num_chan; i++) {
+                chan_stats.chan_num = fw_chan_stats->chan_num;
+                chan_stats.bandcfg = fw_chan_stats->bandcfg;
+                chan_stats.flags = fw_chan_stats->flags;
+                chan_stats.noise = fw_chan_stats->noise;
+                chan_stats.total_bss = le16_to_cpu(fw_chan_stats->total_bss);
+                chan_stats.cca_scan_dur =
+                                       le16_to_cpu(fw_chan_stats->cca_scan_dur);
+                chan_stats.cca_busy_dur =
+                                       le16_to_cpu(fw_chan_stats->cca_busy_dur);
+                dev_dbg(adapter->dev,
+                        "chan=%d, noise=%d, total_network=%d scan_duration=%d, busy_duration=%d\n",
+                        chan_stats.chan_num,
+                        chan_stats.noise,
+                        chan_stats.total_bss,
+                        chan_stats.cca_scan_dur,
+                        chan_stats.cca_busy_dur);
+                memcpy(&adapter->chan_stats[adapter->survey_idx++], &chan_stats,
+                       sizeof(struct mwifiex_chan_stats));
+                fw_chan_stats++;
+        }
+}
+
 /* This function handles the command response of extended scan */
-int mwifiex_ret_802_11_scan_ext(struct mwifiex_private *priv)
+int mwifiex_ret_802_11_scan_ext(struct mwifiex_private *priv,
+                                struct host_cmd_ds_command *resp)
 {
         struct mwifiex_adapter *adapter = priv->adapter;
+        struct host_cmd_ds_802_11_scan_ext *ext_scan_resp;
+        struct mwifiex_ie_types_header *tlv;
+        struct mwifiex_ietypes_chanstats *tlv_stat;
+        u16 buf_left, type, len;
+
         struct host_cmd_ds_command *cmd_ptr;
         struct cmd_ctrl_node *cmd_node;
         unsigned long cmd_flags, scan_flags;
@@ -1987,6 +2031,36 @@ int mwifiex_ret_802_11_scan_ext(struct mwifiex_private *priv)
 
         dev_dbg(priv->adapter->dev, "info: EXT scan returns successfully\n");
 
+        ext_scan_resp = &resp->params.ext_scan;
+
+        tlv = (void *)ext_scan_resp->tlv_buffer;
+        buf_left = le16_to_cpu(resp->size) - (sizeof(*ext_scan_resp) + S_DS_GEN
+                                              - 1);
+
+        while (buf_left >= sizeof(struct mwifiex_ie_types_header)) {
+                type = le16_to_cpu(tlv->type);
+                len = le16_to_cpu(tlv->len);
+
+                if (buf_left < (sizeof(struct mwifiex_ie_types_header) + len)) {
+                        dev_err(adapter->dev,
+                                "error processing scan response TLVs");
+                        break;
+                }
+
+                switch (type) {
+                case TLV_TYPE_CHANNEL_STATS:
+                        tlv_stat = (void *)tlv;
+                        mwifiex_update_chan_statistics(priv, tlv_stat);
+                        break;
+                default:
+                        break;
+                }
+
+                buf_left -= len + sizeof(struct mwifiex_ie_types_header);
+                tlv = (void *)((u8 *)tlv + len +
+                               sizeof(struct mwifiex_ie_types_header));
+        }
+
         spin_lock_irqsave(&adapter->cmd_pending_q_lock, cmd_flags);
         spin_lock_irqsave(&adapter->scan_pending_q_lock, scan_flags);
         if (list_empty(&adapter->scan_pending_q)) {
diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
index b25766b43b9f..933dae137850 100644
--- a/drivers/net/wireless/mwifiex/sdio.c
+++ b/drivers/net/wireless/mwifiex/sdio.c
@@ -106,6 +106,7 @@ mwifiex_sdio_probe(struct sdio_func *func, const struct sdio_device_id *id)
                 card->mp_tx_agg_buf_size = data->mp_tx_agg_buf_size;
                 card->mp_rx_agg_buf_size = data->mp_rx_agg_buf_size;
                 card->supports_fw_dump = data->supports_fw_dump;
+                card->auto_tdls = data->auto_tdls;
         }
 
         sdio_claim_host(func);
@@ -1880,6 +1881,7 @@ static int mwifiex_init_sdio(struct mwifiex_adapter *adapter)
                 return -1;
         }
 
+        adapter->auto_tdls = card->auto_tdls;
         return ret;
 }
 
diff --git a/drivers/net/wireless/mwifiex/sdio.h b/drivers/net/wireless/mwifiex/sdio.h
index 20cd9adc98d3..54c07156dd78 100644
--- a/drivers/net/wireless/mwifiex/sdio.h
+++ b/drivers/net/wireless/mwifiex/sdio.h
@@ -246,6 +246,7 @@ struct sdio_mmc_card {
         u8 curr_wr_port;
 
         u8 *mp_regs;
+        u8 auto_tdls;
 
         struct mwifiex_sdio_mpa_tx mpa_tx;
         struct mwifiex_sdio_mpa_rx mpa_rx;
@@ -262,6 +263,7 @@ struct mwifiex_sdio_device {
         u16 tx_buf_size;
         u32 mp_tx_agg_buf_size;
         u32 mp_rx_agg_buf_size;
+        u8 auto_tdls;
 };
 
 static const struct mwifiex_sdio_card_reg mwifiex_reg_sd87xx = {
@@ -387,6 +389,7 @@ static const struct mwifiex_sdio_device mwifiex_sdio_sd8786 = {
         .mp_tx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_16K,
         .mp_rx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_16K,
         .supports_fw_dump = false,
+        .auto_tdls = false,
 };
 
 static const struct mwifiex_sdio_device mwifiex_sdio_sd8787 = {
@@ -400,6 +403,7 @@ static const struct mwifiex_sdio_device mwifiex_sdio_sd8787 = {
         .mp_tx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_16K,
         .mp_rx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_16K,
         .supports_fw_dump = false,
+        .auto_tdls = false,
 };
 
 static const struct mwifiex_sdio_device mwifiex_sdio_sd8797 = {
@@ -413,6 +417,7 @@ static const struct mwifiex_sdio_device mwifiex_sdio_sd8797 = {
         .mp_tx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_16K,
         .mp_rx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_16K,
         .supports_fw_dump = false,
+        .auto_tdls = false,
 };
 
 static const struct mwifiex_sdio_device mwifiex_sdio_sd8897 = {
@@ -426,6 +431,7 @@ static const struct mwifiex_sdio_device mwifiex_sdio_sd8897 = {
         .mp_tx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_32K,
         .mp_rx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_32K,
         .supports_fw_dump = true,
+        .auto_tdls = false,
 };
 
 static const struct mwifiex_sdio_device mwifiex_sdio_sd8887 = {
@@ -439,6 +445,7 @@ static const struct mwifiex_sdio_device mwifiex_sdio_sd8887 = {
         .mp_tx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_32K,
         .mp_rx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_32K,
         .supports_fw_dump = false,
+        .auto_tdls = true,
 };
 
 /*
diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c
index 4aad44685f8d..b65e1014b0fc 100644
--- a/drivers/net/wireless/mwifiex/sta_cmdresp.c
+++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c
@@ -983,7 +983,7 @@ int mwifiex_process_sta_cmdresp(struct mwifiex_private *priv, u16 cmdresp_no,
                 adapter->curr_cmd->wait_q_enabled = false;
                 break;
         case HostCmd_CMD_802_11_SCAN_EXT:
-                ret = mwifiex_ret_802_11_scan_ext(priv);
+                ret = mwifiex_ret_802_11_scan_ext(priv, resp);
                 adapter->curr_cmd->wait_q_enabled = false;
                 break;
         case HostCmd_CMD_802_11_BG_SCAN_QUERY:
diff --git a/drivers/net/wireless/mwifiex/sta_event.c b/drivers/net/wireless/mwifiex/sta_event.c
index f1c240eca0cd..204ecc8faa5b 100644
--- a/drivers/net/wireless/mwifiex/sta_event.c
+++ b/drivers/net/wireless/mwifiex/sta_event.c
@@ -55,9 +55,13 @@ mwifiex_reset_connect_state(struct mwifiex_private *priv, u16 reason_code)
         priv->scan_block = false;
 
         if ((GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_STA) &&
-            ISSUPP_TDLS_ENABLED(priv->adapter->fw_cap_info))
+            ISSUPP_TDLS_ENABLED(priv->adapter->fw_cap_info)) {
                 mwifiex_disable_all_tdls_links(priv);
 
+                if (priv->adapter->auto_tdls)
+                        mwifiex_clean_auto_tdls(priv);
+        }
+
         /* Free Tx and Rx packets, report disconnect to upper layer */
         mwifiex_clean_txrx(priv);
 
@@ -163,9 +167,6 @@ static int mwifiex_parse_tdls_event(struct mwifiex_private *priv,
                                            NL80211_TDLS_TEARDOWN,
                                            le16_to_cpu(tdls_evt->u.reason_code),
                                            GFP_KERNEL);
-                ret = mwifiex_tdls_oper(priv, tdls_evt->peer_mac,
-                                        MWIFIEX_TDLS_DISABLE_LINK);
-                queue_work(adapter->workqueue, &adapter->main_work);
                 break;
         default:
                 break;
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index 92f3eb839866..1626868a4b5c 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -1026,12 +1026,12 @@ mwifiex_drv_get_driver_version(struct mwifiex_adapter *adapter, char *version,
                                int max_len)
 {
         union {
-                u32 l;
+                __le32 l;
                 u8 c[4];
         } ver;
         char fw_ver[32];
 
-        ver.l = adapter->fw_release_number;
+        ver.l = cpu_to_le32(adapter->fw_release_number);
         sprintf(fw_ver, "%u.%u.%u.p%u", ver.c[2], ver.c[1], ver.c[0], ver.c[3]);
 
         snprintf(version, max_len, driver_version, fw_ver);
diff --git a/drivers/net/wireless/mwifiex/sta_rx.c b/drivers/net/wireless/mwifiex/sta_rx.c
index 9ceb1dbe34c5..c2ad3b63ae70 100644
--- a/drivers/net/wireless/mwifiex/sta_rx.c
+++ b/drivers/net/wireless/mwifiex/sta_rx.c
@@ -232,6 +232,9 @@ int mwifiex_process_sta_rx_packet(struct mwifiex_private *priv,
                         if (sta_ptr)
                                 sta_ptr->rx_seq[local_rx_pd->priority] =
                                               le16_to_cpu(local_rx_pd->seq_num);
+                        mwifiex_auto_tdls_update_peer_signal(priv, ta,
+                                                             local_rx_pd->snr,
+                                                             local_rx_pd->nf);
                 }
         } else {
                 if (rx_pkt_type != PKT_TYPE_BAR)
diff --git a/drivers/net/wireless/mwifiex/tdls.c b/drivers/net/wireless/mwifiex/tdls.c
index e2949077f5b5..22884b429be7 100644
--- a/drivers/net/wireless/mwifiex/tdls.c
+++ b/drivers/net/wireless/mwifiex/tdls.c
@@ -24,6 +24,7 @@
 #define TDLS_REQ_FIX_LEN      6
 #define TDLS_RESP_FIX_LEN     8
 #define TDLS_CONFIRM_FIX_LEN  6
+#define MWIFIEX_TDLS_WMM_INFO_SIZE 7
 
 static void mwifiex_restore_tdls_packets(struct mwifiex_private *priv,
                                          const u8 *mac, u8 status)
@@ -367,6 +368,55 @@ static void mwifiex_tdls_add_qos_capab(struct sk_buff *skb)
         *pos++ = MWIFIEX_TDLS_DEF_QOS_CAPAB;
 }
 
+static void
+mwifiex_tdls_add_wmm_param_ie(struct mwifiex_private *priv, struct sk_buff *skb)
+{
+        struct ieee80211_wmm_param_ie *wmm;
+        u8 ac_vi[] = {0x42, 0x43, 0x5e, 0x00};
+        u8 ac_vo[] = {0x62, 0x32, 0x2f, 0x00};
+        u8 ac_be[] = {0x03, 0xa4, 0x00, 0x00};
+        u8 ac_bk[] = {0x27, 0xa4, 0x00, 0x00};
+
+        wmm = (void *)skb_put(skb, sizeof(*wmm));
+        memset(wmm, 0, sizeof(*wmm));
+
+        wmm->element_id = WLAN_EID_VENDOR_SPECIFIC;
+        wmm->len = sizeof(*wmm) - 2;
+        wmm->oui[0] = 0x00; /* Microsoft OUI 00:50:F2 */
+        wmm->oui[1] = 0x50;
+        wmm->oui[2] = 0xf2;
+        wmm->oui_type = 2; /* WME */
+        wmm->oui_subtype = 1; /* WME param */
+        wmm->version = 1; /* WME ver */
+        wmm->qos_info = 0; /* U-APSD not in use */
+
+        /* use default WMM AC parameters for TDLS link*/
+        memcpy(&wmm->ac[0], ac_be, sizeof(ac_be));
+        memcpy(&wmm->ac[1], ac_bk, sizeof(ac_bk));
+        memcpy(&wmm->ac[2], ac_vi, sizeof(ac_vi));
+        memcpy(&wmm->ac[3], ac_vo, sizeof(ac_vo));
+}
+
+static void
+mwifiex_add_wmm_info_ie(struct mwifiex_private *priv, struct sk_buff *skb,
+                        u8 qosinfo)
+{
+        u8 *buf;
+
+        buf = (void *)skb_put(skb, MWIFIEX_TDLS_WMM_INFO_SIZE +
+                              sizeof(struct ieee_types_header));
+
+        *buf++ = WLAN_EID_VENDOR_SPECIFIC;
+        *buf++ = 7; /* len */
+        *buf++ = 0x00; /* Microsoft OUI 00:50:F2 */
+        *buf++ = 0x50;
+        *buf++ = 0xf2;
+        *buf++ = 2; /* WME */
+        *buf++ = 0; /* WME info */
+        *buf++ = 1; /* WME ver */
+        *buf++ = qosinfo; /* U-APSD no in use */
+}
+
 static int mwifiex_prep_tdls_encap_data(struct mwifiex_private *priv,
                                         const u8 *peer, u8 action_code,
                                         u8 dialog_token,
@@ -421,6 +471,7 @@ static int mwifiex_prep_tdls_encap_data(struct mwifiex_private *priv,
 
                 mwifiex_tdls_add_ext_capab(priv, skb);
                 mwifiex_tdls_add_qos_capab(skb);
+                mwifiex_add_wmm_info_ie(priv, skb, 0);
                 break;
 
         case WLAN_TDLS_SETUP_RESPONSE:
@@ -458,6 +509,7 @@ static int mwifiex_prep_tdls_encap_data(struct mwifiex_private *priv,
 
                 mwifiex_tdls_add_ext_capab(priv, skb);
                 mwifiex_tdls_add_qos_capab(skb);
+                mwifiex_add_wmm_info_ie(priv, skb, 0);
                 break;
 
         case WLAN_TDLS_SETUP_CONFIRM:
@@ -466,6 +518,8 @@ static int mwifiex_prep_tdls_encap_data(struct mwifiex_private *priv,
                 skb_put(skb, sizeof(tf->u.setup_cfm));
                 tf->u.setup_cfm.status_code = cpu_to_le16(status_code);
                 tf->u.setup_cfm.dialog_token = dialog_token;
+
+                mwifiex_tdls_add_wmm_param_ie(priv, skb);
                 if (priv->adapter->is_hw_11ac_capable) {
                         ret = mwifiex_tdls_add_vht_oper(priv, peer, skb);
                         if (ret) {
@@ -544,6 +598,7 @@ int mwifiex_send_tdls_data_frame(struct mwifiex_private *priv, const u8 *peer,
                   sizeof(struct ieee_types_bss_co_2040) +
                   sizeof(struct ieee80211_ht_operation) +
                   sizeof(struct ieee80211_tdls_lnkie) +
+                  sizeof(struct ieee80211_wmm_param_ie) +
                   extra_ies_len;
 
         if (priv->adapter->is_hw_11ac_capable)
@@ -973,6 +1028,7 @@ mwifiex_tdls_process_disable_link(struct mwifiex_private *priv, const u8 *peer)
         }
 
         mwifiex_restore_tdls_packets(priv, peer, TDLS_LINK_TEARDOWN);
+        mwifiex_auto_tdls_update_peer_status(priv, peer, TDLS_NOT_SETUP);
         memcpy(&tdls_oper.peer_mac, peer, ETH_ALEN);
         tdls_oper.tdls_action = MWIFIEX_TDLS_DISABLE_LINK;
         return mwifiex_send_cmd(priv, HostCmd_CMD_TDLS_OPER,
@@ -1017,6 +1073,8 @@ mwifiex_tdls_process_enable_link(struct mwifiex_private *priv, const u8 *peer)
 
                 memset(sta_ptr->rx_seq, 0xff, sizeof(sta_ptr->rx_seq));
                 mwifiex_restore_tdls_packets(priv, peer, TDLS_SETUP_COMPLETE);
+                mwifiex_auto_tdls_update_peer_status(priv, peer,
+                                                     TDLS_SETUP_COMPLETE);
         } else {
                 dev_dbg(priv->adapter->dev,
                         "tdls: enable link %pM failed\n", peer);
@@ -1030,6 +1088,8 @@ mwifiex_tdls_process_enable_link(struct mwifiex_private *priv, const u8 *peer)
                         mwifiex_del_sta_entry(priv, peer);
                 }
                 mwifiex_restore_tdls_packets(priv, peer, TDLS_LINK_TEARDOWN);
+                mwifiex_auto_tdls_update_peer_status(priv, peer,
+                                                     TDLS_NOT_SETUP);
 
                 return -1;
         }
@@ -1097,3 +1157,231 @@ void mwifiex_disable_all_tdls_links(struct mwifiex_private *priv)
 
         mwifiex_del_all_sta_list(priv);
 }
+
+int mwifiex_tdls_check_tx(struct mwifiex_private *priv, struct sk_buff *skb)
+{
+        struct mwifiex_auto_tdls_peer *peer;
+        unsigned long flags;
+        u8 mac[ETH_ALEN];
+
+        ether_addr_copy(mac, skb->data);
+
+        spin_lock_irqsave(&priv->auto_tdls_lock, flags);
+        list_for_each_entry(peer, &priv->auto_tdls_list, list) {
+                if (!memcmp(mac, peer->mac_addr, ETH_ALEN)) {
+                        if (peer->rssi <= MWIFIEX_TDLS_RSSI_HIGH &&
+                            peer->tdls_status == TDLS_NOT_SETUP &&
+                            (peer->failure_count <
+                             MWIFIEX_TDLS_MAX_FAIL_COUNT)) {
+                                peer->tdls_status = TDLS_SETUP_INPROGRESS;
+                                dev_dbg(priv->adapter->dev,
+                                        "setup TDLS link, peer=%pM rssi=%d\n",
+                                        peer->mac_addr, peer->rssi);
+
+                                cfg80211_tdls_oper_request(priv->netdev,
+                                                           peer->mac_addr,
+                                                           NL80211_TDLS_SETUP,
+                                                           0, GFP_ATOMIC);
+                                peer->do_setup = false;
+                                priv->check_tdls_tx = false;
+                        } else if (peer->failure_count <
+                                   MWIFIEX_TDLS_MAX_FAIL_COUNT &&
+                                   peer->do_discover) {
+                                mwifiex_send_tdls_data_frame(priv,
+                                                             peer->mac_addr,
+                                                    WLAN_TDLS_DISCOVERY_REQUEST,
+                                                             1, 0, NULL, 0);
+                                peer->do_discover = false;
+                        }
+                }
+        }
+        spin_unlock_irqrestore(&priv->auto_tdls_lock, flags);
+
+        return 0;
+}
+
+void mwifiex_flush_auto_tdls_list(struct mwifiex_private *priv)
+{
+        struct mwifiex_auto_tdls_peer *peer, *tmp_node;
+        unsigned long flags;
+
+        spin_lock_irqsave(&priv->auto_tdls_lock, flags);
+        list_for_each_entry_safe(peer, tmp_node, &priv->auto_tdls_list, list) {
+                list_del(&peer->list);
+                kfree(peer);
+        }
+
+        INIT_LIST_HEAD(&priv->auto_tdls_list);
+        spin_unlock_irqrestore(&priv->auto_tdls_lock, flags);
+        priv->check_tdls_tx = false;
+}
+
+void mwifiex_add_auto_tdls_peer(struct mwifiex_private *priv, const u8 *mac)
+{
+        struct mwifiex_auto_tdls_peer *tdls_peer;
+        unsigned long flags;
+
+        if (!priv->adapter->auto_tdls)
+                return;
+
+        spin_lock_irqsave(&priv->auto_tdls_lock, flags);
+        list_for_each_entry(tdls_peer, &priv->auto_tdls_list, list) {
+                if (!memcmp(tdls_peer->mac_addr, mac, ETH_ALEN)) {
+                        tdls_peer->tdls_status = TDLS_SETUP_INPROGRESS;
+                        tdls_peer->rssi_jiffies = jiffies;
+                        spin_unlock_irqrestore(&priv->auto_tdls_lock, flags);
+                        return;
+                }
+        }
+
+        /* create new TDLS peer */
+        tdls_peer = kzalloc(sizeof(*tdls_peer), GFP_ATOMIC);
+        if (tdls_peer) {
+                ether_addr_copy(tdls_peer->mac_addr, mac);
+                tdls_peer->tdls_status = TDLS_SETUP_INPROGRESS;
+                tdls_peer->rssi_jiffies = jiffies;
+                INIT_LIST_HEAD(&tdls_peer->list);
+                list_add_tail(&tdls_peer->list, &priv->auto_tdls_list);
+                dev_dbg(priv->adapter->dev, "Add auto TDLS peer= %pM to list\n",
+                        mac);
+        }
+
+        spin_unlock_irqrestore(&priv->auto_tdls_lock, flags);
+}
+
+void mwifiex_auto_tdls_update_peer_status(struct mwifiex_private *priv,
+                                          const u8 *mac, u8 link_status)
+{
+        struct mwifiex_auto_tdls_peer *peer;
+        unsigned long flags;
+
+        if (!priv->adapter->auto_tdls)
+                return;
+
+        spin_lock_irqsave(&priv->auto_tdls_lock, flags);
+        list_for_each_entry(peer, &priv->auto_tdls_list, list) {
+                if (!memcmp(peer->mac_addr, mac, ETH_ALEN)) {
+                        if ((link_status == TDLS_NOT_SETUP) &&
+                            (peer->tdls_status == TDLS_SETUP_INPROGRESS))
+                                peer->failure_count++;
+                        else if (link_status == TDLS_SETUP_COMPLETE)
+                                peer->failure_count = 0;
+
+                        peer->tdls_status = link_status;
+                        break;
+                }
+        }
+        spin_unlock_irqrestore(&priv->auto_tdls_lock, flags);
+}
+
+void mwifiex_auto_tdls_update_peer_signal(struct mwifiex_private *priv,
+                                          u8 *mac, s8 snr, s8 nflr)
+{
+        struct mwifiex_auto_tdls_peer *peer;
+        unsigned long flags;
+
+        if (!priv->adapter->auto_tdls)
+                return;
+
+        spin_lock_irqsave(&priv->auto_tdls_lock, flags);
+        list_for_each_entry(peer, &priv->auto_tdls_list, list) {
+                if (!memcmp(peer->mac_addr, mac, ETH_ALEN)) {
+                        peer->rssi = nflr - snr;
+                        peer->rssi_jiffies = jiffies;
+                        break;
+                }
+        }
+        spin_unlock_irqrestore(&priv->auto_tdls_lock, flags);
+}
+
+void mwifiex_check_auto_tdls(unsigned long context)
+{
+        struct mwifiex_private *priv = (struct mwifiex_private *)context;
+        struct mwifiex_auto_tdls_peer *tdls_peer;
+        unsigned long flags;
+        u16 reason = WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED;
+
+        if (WARN_ON_ONCE(!priv || !priv->adapter)) {
+                pr_err("mwifiex: %s: adapter or private structure is NULL\n",
+                       __func__);
+                return;
+        }
+
+        if (unlikely(!priv->adapter->auto_tdls))
+                return;
+
+        if (!priv->auto_tdls_timer_active) {
+                dev_dbg(priv->adapter->dev,
+                        "auto TDLS timer inactive; return");
+                return;
+        }
+
+        priv->check_tdls_tx = false;
+
+        if (list_empty(&priv->auto_tdls_list)) {
+                mod_timer(&priv->auto_tdls_timer,
+                          jiffies +
+                          msecs_to_jiffies(MWIFIEX_TIMER_10S));
+                return;
+        }
+
+        spin_lock_irqsave(&priv->auto_tdls_lock, flags);
+        list_for_each_entry(tdls_peer, &priv->auto_tdls_list, list) {
+                if ((jiffies - tdls_peer->rssi_jiffies) >
+                    (MWIFIEX_AUTO_TDLS_IDLE_TIME * HZ)) {
+                        tdls_peer->rssi = 0;
+                        tdls_peer->do_discover = true;
+                        priv->check_tdls_tx = true;
+                }
+
+                if (((tdls_peer->rssi >= MWIFIEX_TDLS_RSSI_LOW) ||
+                     !tdls_peer->rssi) &&
+                    tdls_peer->tdls_status == TDLS_SETUP_COMPLETE) {
+                        tdls_peer->tdls_status = TDLS_LINK_TEARDOWN;
+                        dev_dbg(priv->adapter->dev,
+                                "teardown TDLS link,peer=%pM rssi=%d\n",
+                                tdls_peer->mac_addr, -tdls_peer->rssi);
+                        tdls_peer->do_discover = true;
+                        priv->check_tdls_tx = true;
+                        cfg80211_tdls_oper_request(priv->netdev,
+                                                   tdls_peer->mac_addr,
+                                                   NL80211_TDLS_TEARDOWN,
+                                                   reason, GFP_ATOMIC);
+                } else if (tdls_peer->rssi &&
+                           tdls_peer->rssi <= MWIFIEX_TDLS_RSSI_HIGH &&
+                           tdls_peer->tdls_status == TDLS_NOT_SETUP &&
+                           tdls_peer->failure_count <
+                           MWIFIEX_TDLS_MAX_FAIL_COUNT) {
+                                priv->check_tdls_tx = true;
+                                tdls_peer->do_setup = true;
+                                dev_dbg(priv->adapter->dev,
+                                        "check TDLS with peer=%pM rssi=%d\n",
+                                        tdls_peer->mac_addr, -tdls_peer->rssi);
+                }
+        }
+        spin_unlock_irqrestore(&priv->auto_tdls_lock, flags);
+
+        mod_timer(&priv->auto_tdls_timer,
+                  jiffies + msecs_to_jiffies(MWIFIEX_TIMER_10S));
+}
+
+void mwifiex_setup_auto_tdls_timer(struct mwifiex_private *priv)
+{
+        init_timer(&priv->auto_tdls_timer);
+        priv->auto_tdls_timer.function = mwifiex_check_auto_tdls;
+        priv->auto_tdls_timer.data = (unsigned long)priv;
+        priv->auto_tdls_timer_active = true;
+        mod_timer(&priv->auto_tdls_timer,
+                  jiffies + msecs_to_jiffies(MWIFIEX_TIMER_10S));
+}
+
+void mwifiex_clean_auto_tdls(struct mwifiex_private *priv)
+{
+        if (ISSUPP_TDLS_ENABLED(priv->adapter->fw_cap_info) &&
+            priv->adapter->auto_tdls &&
+            priv->bss_type == MWIFIEX_BSS_TYPE_STA) {
+                priv->auto_tdls_timer_active = false;
+                del_timer(&priv->auto_tdls_timer);
+                mwifiex_flush_auto_tdls_list(priv);
+        }
+}
diff --git a/drivers/net/wireless/mwifiex/txrx.c b/drivers/net/wireless/mwifiex/txrx.c
index 96a2126cc44b..a5983fc4e83a 100644
--- a/drivers/net/wireless/mwifiex/txrx.c
+++ b/drivers/net/wireless/mwifiex/txrx.c
@@ -64,10 +64,6 @@ int mwifiex_handle_rx_packet(struct mwifiex_adapter *adapter,
         else
                 ret = mwifiex_process_sta_rx_packet(priv, skb);
 
-        /* Decrement RX pending counter for each packet */
-        if (adapter->if_ops.data_complete)
-                adapter->if_ops.data_complete(adapter);
-
         return ret;
 }
 EXPORT_SYMBOL_GPL(mwifiex_handle_rx_packet);
diff --git a/drivers/net/wireless/mwifiex/uap_cmd.c b/drivers/net/wireless/mwifiex/uap_cmd.c
index 300bab438011..0f347fdefa0a 100644
--- a/drivers/net/wireless/mwifiex/uap_cmd.c
+++ b/drivers/net/wireless/mwifiex/uap_cmd.c
@@ -167,7 +167,7 @@ mwifiex_set_ht_params(struct mwifiex_private *priv,
         ht_ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, params->beacon.tail,
                                  params->beacon.tail_len);
         if (ht_ie) {
-                memcpy(&bss_cfg->ht_cap, ht_ie + 2,
+                memcpy(&bss_cfg->ht_cap, ht_ie,
                        sizeof(struct ieee80211_ht_cap));
                 cap_info = le16_to_cpu(bss_cfg->ht_cap.cap_info);
                 memset(&bss_cfg->ht_cap.mcs, 0,
diff --git a/drivers/net/wireless/mwifiex/usb.c b/drivers/net/wireless/mwifiex/usb.c
index 4371e12b36f3..1b56495ec872 100644
--- a/drivers/net/wireless/mwifiex/usb.c
+++ b/drivers/net/wireless/mwifiex/usb.c
@@ -27,6 +27,11 @@ static struct mwifiex_if_ops usb_ops;
 static struct semaphore add_remove_card_sem;
 
 static struct usb_device_id mwifiex_usb_table[] = {
+        /* 8766 */
+        {USB_DEVICE(USB8XXX_VID, USB8766_PID_1)},
+        {USB_DEVICE_AND_INTERFACE_INFO(USB8XXX_VID, USB8766_PID_2,
+                                       USB_CLASS_VENDOR_SPEC,
+                                       USB_SUBCLASS_VENDOR_SPEC, 0xff)},
         /* 8797 */
         {USB_DEVICE(USB8XXX_VID, USB8797_PID_1)},
         {USB_DEVICE_AND_INTERFACE_INFO(USB8XXX_VID, USB8797_PID_2,
@@ -125,8 +130,10 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter,
                         dev_err(dev, "DATA: skb->len too large\n");
                         return -1;
                 }
-                skb_queue_tail(&adapter->usb_rx_data_q, skb);
+
+                skb_queue_tail(&adapter->rx_data_q, skb);
                 adapter->data_received = true;
+                atomic_inc(&adapter->rx_pending);
                 break;
         default:
                 dev_err(dev, "%s: unknown endport %#x\n", __func__, ep);
@@ -176,7 +183,6 @@ static void mwifiex_usb_rx_complete(struct urb *urb)
                 else
                         skb_put(skb, recv_length - skb->len);
 
-                atomic_inc(&adapter->rx_pending);
                 status = mwifiex_usb_recv(adapter, skb, context->ep);
 
                 dev_dbg(adapter->dev, "info: recv_length=%d, status=%d\n",
@@ -191,7 +197,6 @@ static void mwifiex_usb_rx_complete(struct urb *urb)
                         if (card->rx_cmd_ep == context->ep)
                                 return;
                 } else {
-                        atomic_dec(&adapter->rx_pending);
                         if (status == -1)
                                 dev_err(adapter->dev,
                                         "received data processing failed!\n");
@@ -222,7 +227,13 @@ setup_for_next:
         else
                 size = MWIFIEX_RX_DATA_BUF_SIZE;
 
-        mwifiex_usb_submit_rx_urb(context, size);
+        if (card->rx_cmd_ep == context->ep) {
+                mwifiex_usb_submit_rx_urb(context, size);
+        } else {
+                context->skb = NULL;
+                if (atomic_read(&adapter->rx_pending) <= HIGH_RX_PENDING)
+                        mwifiex_usb_submit_rx_urb(context, size);
+        }
 
         return;
 }
@@ -348,10 +359,12 @@ static int mwifiex_usb_probe(struct usb_interface *intf,
 
         /* PID_1 is used for firmware downloading only */
         switch (id_product) {
+        case USB8766_PID_1:
         case USB8797_PID_1:
         case USB8897_PID_1:
                 card->usb_boot_state = USB8XXX_FW_DNLD;
                 break;
+        case USB8766_PID_2:
         case USB8797_PID_2:
         case USB8897_PID_2:
                 card->usb_boot_state = USB8XXX_FW_READY;
@@ -780,6 +793,11 @@ static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
                 adapter->tx_buf_size = MWIFIEX_TX_DATA_BUF_SIZE_4K;
                 strcpy(adapter->fw_name, USB8897_DEFAULT_FW_NAME);
                 break;
+        case USB8766_PID_1:
+        case USB8766_PID_2:
+                adapter->tx_buf_size = MWIFIEX_TX_DATA_BUF_SIZE_2K;
+                strcpy(adapter->fw_name, USB8766_DEFAULT_FW_NAME);
+                break;
         case USB8797_PID_1:
         case USB8797_PID_2:
         default:
@@ -962,19 +980,11 @@ static void mwifiex_submit_rx_urb(struct mwifiex_adapter *adapter, u8 ep)
 static int mwifiex_usb_cmd_event_complete(struct mwifiex_adapter *adapter,
                                        struct sk_buff *skb)
 {
-        atomic_dec(&adapter->rx_pending);
         mwifiex_submit_rx_urb(adapter, MWIFIEX_USB_EP_CMD_EVENT);
 
         return 0;
 }
 
-static int mwifiex_usb_data_complete(struct mwifiex_adapter *adapter)
-{
-        atomic_dec(&adapter->rx_pending);
-
-        return 0;
-}
-
 /* This function wakes up the card. */
 static int mwifiex_pm_wakeup_card(struct mwifiex_adapter *adapter)
 {
@@ -986,6 +996,20 @@ static int mwifiex_pm_wakeup_card(struct mwifiex_adapter *adapter)
         return 0;
 }
 
+static void mwifiex_usb_submit_rem_rx_urbs(struct mwifiex_adapter *adapter)
+{
+        struct usb_card_rec *card = (struct usb_card_rec *)adapter->card;
+        int i;
+        struct urb_context *ctx;
+
+        for (i = 0; i < MWIFIEX_RX_DATA_URB; i++) {
+                if (card->rx_data_list[i].skb)
+                        continue;
+                ctx = &card->rx_data_list[i];
+                mwifiex_usb_submit_rx_urb(ctx, MWIFIEX_RX_DATA_BUF_SIZE);
+        }
+}
+
 static struct mwifiex_if_ops usb_ops = {
         .register_dev =         mwifiex_register_dev,
         .unregister_dev =       mwifiex_unregister_dev,
@@ -996,8 +1020,8 @@ static struct mwifiex_if_ops usb_ops = {
         .dnld_fw =              mwifiex_usb_dnld_fw,
         .cmdrsp_complete =      mwifiex_usb_cmd_event_complete,
         .event_complete =       mwifiex_usb_cmd_event_complete,
-        .data_complete =        mwifiex_usb_data_complete,
         .host_to_card =         mwifiex_usb_host_to_card,
+        .submit_rem_rx_urbs =   mwifiex_usb_submit_rem_rx_urbs,
 };
 
 /* This function initializes the USB driver module.
@@ -1048,5 +1072,6 @@ MODULE_AUTHOR("Marvell International Ltd.");
 MODULE_DESCRIPTION("Marvell WiFi-Ex USB Driver version" USB_VERSION);
 MODULE_VERSION(USB_VERSION);
 MODULE_LICENSE("GPL v2");
+MODULE_FIRMWARE(USB8766_DEFAULT_FW_NAME);
 MODULE_FIRMWARE(USB8797_DEFAULT_FW_NAME);
 MODULE_FIRMWARE(USB8897_DEFAULT_FW_NAME);
diff --git a/drivers/net/wireless/mwifiex/usb.h b/drivers/net/wireless/mwifiex/usb.h
index 4c41c2a193c5..a7cbba1355af 100644
--- a/drivers/net/wireless/mwifiex/usb.h
+++ b/drivers/net/wireless/mwifiex/usb.h
@@ -24,6 +24,8 @@
 
 #define USB8XXX_VID             0x1286
 
+#define USB8766_PID_1           0x2041
+#define USB8766_PID_2           0x2042
 #define USB8797_PID_1           0x2043
 #define USB8797_PID_2           0x2044
 #define USB8897_PID_1           0x2045
@@ -37,6 +39,7 @@
 #define MWIFIEX_RX_DATA_URB     6
 #define MWIFIEX_USB_TIMEOUT     100
 
+#define USB8766_DEFAULT_FW_NAME "mrvl/usb8766_uapsta.bin"
 #define USB8797_DEFAULT_FW_NAME "mrvl/usb8797_uapsta.bin"
 #define USB8897_DEFAULT_FW_NAME "mrvl/usb8897_uapsta.bin"
 
diff --git a/drivers/net/wireless/mwifiex/util.c b/drivers/net/wireless/mwifiex/util.c
index ec79c49de097..a113ef8f0b8b 100644
--- a/drivers/net/wireless/mwifiex/util.c
+++ b/drivers/net/wireless/mwifiex/util.c
@@ -141,6 +141,38 @@ int mwifiex_get_debug_info(struct mwifiex_private *priv,
         return 0;
 }
 
+static int
+mwifiex_parse_mgmt_packet(struct mwifiex_private *priv, u8 *payload, u16 len,
+                          struct rxpd *rx_pd)
+{
+        u16 stype;
+        u8 category, action_code;
+        struct ieee80211_hdr *ieee_hdr = (void *)payload;
+
+        stype =  (cpu_to_le16(ieee_hdr->frame_control) & IEEE80211_FCTL_STYPE);
+
+        switch (stype) {
+        case IEEE80211_STYPE_ACTION:
+                category = *(payload + sizeof(struct ieee80211_hdr));
+                action_code = *(payload + sizeof(struct ieee80211_hdr) + 1);
+                if (category == WLAN_CATEGORY_PUBLIC &&
+                    action_code == WLAN_PUB_ACTION_TDLS_DISCOVER_RES) {
+                        dev_dbg(priv->adapter->dev,
+                                "TDLS discovery response %pM nf=%d, snr=%d\n",
+                                ieee_hdr->addr2, rx_pd->nf, rx_pd->snr);
+                        mwifiex_auto_tdls_update_peer_signal(priv,
+                                                             ieee_hdr->addr2,
+                                                             rx_pd->snr,
+                                                             rx_pd->nf);
+                }
+                break;
+        default:
+                dev_dbg(priv->adapter->dev,
+                        "unknown mgmt frame subytpe %#x\n", stype);
+        }
+
+        return 0;
+}
 /*
  * This function processes the received management packet and send it
  * to the kernel.
@@ -151,6 +183,7 @@ mwifiex_process_mgmt_packet(struct mwifiex_private *priv,
 {
         struct rxpd *rx_pd;
         u16 pkt_len;
+        struct ieee80211_hdr *ieee_hdr;
 
         if (!skb)
                 return -1;
@@ -162,6 +195,11 @@ mwifiex_process_mgmt_packet(struct mwifiex_private *priv,
 
         pkt_len = le16_to_cpu(rx_pd->rx_pkt_length);
 
+        ieee_hdr = (void *)skb->data;
+        if (ieee80211_is_mgmt(ieee_hdr->frame_control)) {
+                mwifiex_parse_mgmt_packet(priv, (u8 *)ieee_hdr,
+                                          pkt_len, rx_pd);
+        }
         /* Remove address4 */
         memmove(skb->data + sizeof(struct ieee80211_hdr_3addr),
                 skb->data + sizeof(struct ieee80211_hdr),
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index ef1104476bd8..b8d1e04aa9b9 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -5548,7 +5548,9 @@ mwl8k_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
         return rc;
 }
 
-static void mwl8k_sw_scan_start(struct ieee80211_hw *hw)
+static void mwl8k_sw_scan_start(struct ieee80211_hw *hw,
+                                struct ieee80211_vif *vif,
+                                const u8 *mac_addr)
 {
         struct mwl8k_priv *priv = hw->priv;
         u8 tmp;
@@ -5565,7 +5567,8 @@ static void mwl8k_sw_scan_start(struct ieee80211_hw *hw)
         priv->sw_scan_start = true;
 }
 
-static void mwl8k_sw_scan_complete(struct ieee80211_hw *hw)
+static void mwl8k_sw_scan_complete(struct ieee80211_hw *hw,
+                                   struct ieee80211_vif *vif)
 {
         struct mwl8k_priv *priv = hw->priv;
         u8 tmp;
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index d849d590de25..c878e3f3993c 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -62,7 +62,7 @@ static inline void rt2500usb_register_read(struct rt2x00_dev *rt2x00dev,
         __le16 reg;
         rt2x00usb_vendor_request_buff(rt2x00dev, USB_MULTI_READ,
                                       USB_VENDOR_REQUEST_IN, offset,
-                                      &reg, sizeof(reg), REGISTER_TIMEOUT);
+                                      &reg, sizeof(reg));
         *value = le16_to_cpu(reg);
 }
 
@@ -83,8 +83,7 @@ static inline void rt2500usb_register_multiread(struct rt2x00_dev *rt2x00dev,
 {
         rt2x00usb_vendor_request_buff(rt2x00dev, USB_MULTI_READ,
                                       USB_VENDOR_REQUEST_IN, offset,
-                                      value, length,
-                                      REGISTER_TIMEOUT16(length));
+                                      value, length);
 }
 
 static inline void rt2500usb_register_write(struct rt2x00_dev *rt2x00dev,
@@ -94,7 +93,7 @@ static inline void rt2500usb_register_write(struct rt2x00_dev *rt2x00dev,
         __le16 reg = cpu_to_le16(value);
         rt2x00usb_vendor_request_buff(rt2x00dev, USB_MULTI_WRITE,
                                       USB_VENDOR_REQUEST_OUT, offset,
-                                      &reg, sizeof(reg), REGISTER_TIMEOUT);
+                                      &reg, sizeof(reg));
 }
 
 static inline void rt2500usb_register_write_lock(struct rt2x00_dev *rt2x00dev,
@@ -113,8 +112,7 @@ static inline void rt2500usb_register_multiwrite(struct rt2x00_dev *rt2x00dev,
 {
         rt2x00usb_vendor_request_buff(rt2x00dev, USB_MULTI_WRITE,
                                       USB_VENDOR_REQUEST_OUT, offset,
-                                      value, length,
-                                      REGISTER_TIMEOUT16(length));
+                                      value, length);
 }
 
 static int rt2500usb_regbusy_read(struct rt2x00_dev *rt2x00dev,
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 573897b8e878..8444313eabe2 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -1111,6 +1111,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
         /* Ovislink */
         { USB_DEVICE(0x1b75, 0x3071) },
         { USB_DEVICE(0x1b75, 0x3072) },
+        { USB_DEVICE(0x1b75, 0xa200) },
         /* Para */
         { USB_DEVICE(0x20b8, 0x8888) },
         /* Pegatron */
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index d13f25cd70d5..1ff81afb672c 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -1437,8 +1437,11 @@ int rt2x00mac_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                       struct ieee80211_sta *sta);
 int rt2x00mac_sta_remove(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                          struct ieee80211_sta *sta);
-void rt2x00mac_sw_scan_start(struct ieee80211_hw *hw);
-void rt2x00mac_sw_scan_complete(struct ieee80211_hw *hw);
+void rt2x00mac_sw_scan_start(struct ieee80211_hw *hw,
+                             struct ieee80211_vif *vif,
+                             const u8 *mac_addr);
+void rt2x00mac_sw_scan_complete(struct ieee80211_hw *hw,
+                                struct ieee80211_vif *vif);
 int rt2x00mac_get_stats(struct ieee80211_hw *hw,
                         struct ieee80211_low_level_stats *stats);
 void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index ad6e5a8d1e10..cb40245a0695 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -568,7 +568,9 @@ int rt2x00mac_sta_remove(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 }
 EXPORT_SYMBOL_GPL(rt2x00mac_sta_remove);
 
-void rt2x00mac_sw_scan_start(struct ieee80211_hw *hw)
+void rt2x00mac_sw_scan_start(struct ieee80211_hw *hw,
+                             struct ieee80211_vif *vif,
+                             const u8 *mac_addr)
 {
         struct rt2x00_dev *rt2x00dev = hw->priv;
         set_bit(DEVICE_STATE_SCANNING, &rt2x00dev->flags);
@@ -576,7 +578,8 @@ void rt2x00mac_sw_scan_start(struct ieee80211_hw *hw)
 }
 EXPORT_SYMBOL_GPL(rt2x00mac_sw_scan_start);
 
-void rt2x00mac_sw_scan_complete(struct ieee80211_hw *hw)
+void rt2x00mac_sw_scan_complete(struct ieee80211_hw *hw,
+                                struct ieee80211_vif *vif)
 {
         struct rt2x00_dev *rt2x00dev = hw->priv;
         clear_bit(DEVICE_STATE_SCANNING, &rt2x00dev->flags);
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 8e68f87ab13c..66ff36447b94 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -158,55 +158,29 @@ void rt2x00queue_align_frame(struct sk_buff *skb)
         skb_trim(skb, frame_length);
 }
 
-void rt2x00queue_insert_l2pad(struct sk_buff *skb, unsigned int header_length)
+/*
+ * H/W needs L2 padding between the header and the paylod if header size
+ * is not 4 bytes aligned.
+ */
+void rt2x00queue_insert_l2pad(struct sk_buff *skb, unsigned int hdr_len)
 {
-        unsigned int payload_length = skb->len - header_length;
-        unsigned int header_align = ALIGN_SIZE(skb, 0);
-        unsigned int payload_align = ALIGN_SIZE(skb, header_length);
-        unsigned int l2pad = payload_length ? L2PAD_SIZE(header_length) : 0;
+        unsigned int l2pad = (skb->len > hdr_len) ? L2PAD_SIZE(hdr_len) : 0;
 
-        /*
-         * Adjust the header alignment if the payload needs to be moved more
-         * than the header.
-         */
-        if (payload_align > header_align)
-                header_align += 4;
-
-        /* There is nothing to do if no alignment is needed */
-        if (!header_align)
+        if (!l2pad)
                 return;
 
-        /* Reserve the amount of space needed in front of the frame */
-        skb_push(skb, header_align);
-
-        /*
-         * Move the header.
-         */
-        memmove(skb->data, skb->data + header_align, header_length);
-
-        /* Move the payload, if present and if required */
-        if (payload_length && payload_align)
-                memmove(skb->data + header_length + l2pad,
-                        skb->data + header_length + l2pad + payload_align,
-                        payload_length);
-
-        /* Trim the skb to the correct size */
-        skb_trim(skb, header_length + l2pad + payload_length);
+        skb_push(skb, l2pad);
+        memmove(skb->data, skb->data + l2pad, hdr_len);
 }
 
-void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int header_length)
+void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int hdr_len)
 {
-        /*
-         * L2 padding is only present if the skb contains more than just the
-         * IEEE 802.11 header.
-         */
-        unsigned int l2pad = (skb->len > header_length) ?
-                                L2PAD_SIZE(header_length) : 0;
+        unsigned int l2pad = (skb->len > hdr_len) ? L2PAD_SIZE(hdr_len) : 0;
 
         if (!l2pad)
                 return;
 
-        memmove(skb->data + l2pad, skb->data, header_length);
+        memmove(skb->data + l2pad, skb->data, hdr_len);
         skb_pull(skb, l2pad);
 }
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index 86c43d112a4b..dc85d3e0ffe5 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -116,7 +116,7 @@ EXPORT_SYMBOL_GPL(rt2x00usb_vendor_req_buff_lock);
 int rt2x00usb_vendor_request_buff(struct rt2x00_dev *rt2x00dev,
                                   const u8 request, const u8 requesttype,
                                   const u16 offset, void *buffer,
-                                  const u16 buffer_length, const int timeout)
+                                  const u16 buffer_length)
 {
         int status = 0;
         unsigned char *tb;
@@ -131,7 +131,7 @@ int rt2x00usb_vendor_request_buff(struct rt2x00_dev *rt2x00dev,
                 bsize = min_t(u16, CSR_CACHE_SIZE, len);
                 status = rt2x00usb_vendor_req_buff_lock(rt2x00dev, request,
                                                         requesttype, off, tb,
-                                                        bsize, timeout);
+                                                        bsize, REGISTER_TIMEOUT);
 
                 tb  += bsize;
                 len -= bsize;
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.h b/drivers/net/wireless/rt2x00/rt2x00usb.h
index 831b65f93feb..819690e978c0 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.h
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.h
@@ -33,27 +33,14 @@
 })
 
 /*
- * For USB vendor requests we need to pass a timeout
- * time in ms, for this we use the REGISTER_TIMEOUT,
- * however when loading firmware a higher value is
- * required. In that case we use the REGISTER_TIMEOUT_FIRMWARE.
+ * For USB vendor requests we need to pass a timeout time in ms, for this we
+ * use the REGISTER_TIMEOUT, however when loading firmware or read EEPROM
+ * a higher value is required. In that case we use the REGISTER_TIMEOUT_FIRMWARE
+ * and EEPROM_TIMEOUT.
  */
 #define REGISTER_TIMEOUT                500
 #define REGISTER_TIMEOUT_FIRMWARE       1000
-
-/**
- * REGISTER_TIMEOUT16 - Determine the timeout for 16bit register access
- * @__datalen: Data length
- */
-#define REGISTER_TIMEOUT16(__datalen)   \
-        ( REGISTER_TIMEOUT * ((__datalen) / sizeof(u16)) )
-
-/**
- * REGISTER_TIMEOUT32 - Determine the timeout for 32bit register access
- * @__datalen: Data length
- */
-#define REGISTER_TIMEOUT32(__datalen)   \
-        ( REGISTER_TIMEOUT * ((__datalen) / sizeof(u32)) )
+#define EEPROM_TIMEOUT                  2000
 
 /*
  * Cache size
@@ -126,7 +113,6 @@ int rt2x00usb_vendor_request(struct rt2x00_dev *rt2x00dev,
  * @offset: Register offset to perform action on
  * @buffer: Buffer where information will be read/written to by device
  * @buffer_length: Size of &buffer
- * @timeout: Operation timeout
  *
  * This function will use a previously with kmalloc allocated cache
  * to communicate with the device. The contents of the buffer pointer
@@ -139,7 +125,7 @@ int rt2x00usb_vendor_request(struct rt2x00_dev *rt2x00dev,
 int rt2x00usb_vendor_request_buff(struct rt2x00_dev *rt2x00dev,
                                   const u8 request, const u8 requesttype,
                                   const u16 offset, void *buffer,
-                                  const u16 buffer_length, const int timeout);
+                                  const u16 buffer_length);
 
 /**
  * rt2x00usb_vendor_request_buff - Send register command to device (buffered)
@@ -197,8 +183,7 @@ static inline int rt2x00usb_eeprom_read(struct rt2x00_dev *rt2x00dev,
 {
         return rt2x00usb_vendor_request(rt2x00dev, USB_EEPROM_READ,
                                         USB_VENDOR_REQUEST_IN, 0, 0,
-                                        eeprom, length,
-                                        REGISTER_TIMEOUT16(length));
+                                        eeprom, length, EEPROM_TIMEOUT);
 }
 
 /**
@@ -217,7 +202,7 @@ static inline void rt2x00usb_register_read(struct rt2x00_dev *rt2x00dev,
         __le32 reg;
         rt2x00usb_vendor_request_buff(rt2x00dev, USB_MULTI_READ,
                                       USB_VENDOR_REQUEST_IN, offset,
-                                      &reg, sizeof(reg), REGISTER_TIMEOUT);
+                                      &reg, sizeof(reg));
         *value = le32_to_cpu(reg);
 }
 
@@ -257,8 +242,7 @@ static inline void rt2x00usb_register_multiread(struct rt2x00_dev *rt2x00dev,
 {
         rt2x00usb_vendor_request_buff(rt2x00dev, USB_MULTI_READ,
                                       USB_VENDOR_REQUEST_IN, offset,
-                                      value, length,
-                                      REGISTER_TIMEOUT32(length));
+                                      value, length);
 }
 
 /**
@@ -277,7 +261,7 @@ static inline void rt2x00usb_register_write(struct rt2x00_dev *rt2x00dev,
         __le32 reg = cpu_to_le32(value);
         rt2x00usb_vendor_request_buff(rt2x00dev, USB_MULTI_WRITE,
                                       USB_VENDOR_REQUEST_OUT, offset,
-                                      &reg, sizeof(reg), REGISTER_TIMEOUT);
+                                      &reg, sizeof(reg));
 }
 
 /**
@@ -316,8 +300,7 @@ static inline void rt2x00usb_register_multiwrite(struct rt2x00_dev *rt2x00dev,
 {
         rt2x00usb_vendor_request_buff(rt2x00dev, USB_MULTI_WRITE,
                                       USB_VENDOR_REQUEST_OUT, offset,
-                                      (void *)value, length,
-                                      REGISTER_TIMEOUT32(length));
+                                      (void *)value, length);
 }
 
 /**
diff --git a/drivers/net/wireless/rtl818x/rtl8180/dev.c b/drivers/net/wireless/rtl818x/rtl8180/dev.c
index ded967aa6ecb..706b844bce00 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8180/dev.c
@@ -742,35 +742,49 @@ static void rtl8180_int_disable(struct ieee80211_hw *dev)
 }
 
 static void rtl8180_conf_basic_rates(struct ieee80211_hw *dev,
-                            u32 rates_mask)
+                            u32 basic_mask)
 {
         struct rtl8180_priv *priv = dev->priv;
-
-        u8 max, min;
         u16 reg;
-
-        max = fls(rates_mask) - 1;
-        min = ffs(rates_mask) - 1;
+        u32 resp_mask;
+        u8 basic_max;
+        u8 resp_max, resp_min;
+
+        resp_mask = basic_mask;
+        /* IEEE80211 says the response rate should be equal to the highest basic
+         * rate that is not faster than received frame. But it says also that if
+         * the basic rate set does not contains any rate for the current
+         * modulation class then mandatory rate set must be used for that
+         * modulation class. Eventually add OFDM mandatory rates..
+         */
+        if ((resp_mask & 0xf) == resp_mask)
+                resp_mask |= 0x150; /* 6, 12, 24Mbps */
 
         switch (priv->chip_family) {
 
         case RTL818X_CHIP_FAMILY_RTL8180:
                 /* in 8180 this is NOT a BITMAP */
+                basic_max = fls(basic_mask) - 1;
                 reg = rtl818x_ioread16(priv, &priv->map->BRSR);
                 reg &= ~3;
-                reg |= max;
+                reg |= basic_max;
                 rtl818x_iowrite16(priv, &priv->map->BRSR, reg);
                 break;
 
         case RTL818X_CHIP_FAMILY_RTL8185:
+                resp_max = fls(resp_mask) - 1;
+                resp_min = ffs(resp_mask) - 1;
                 /* in 8185 this is a BITMAP */
-                rtl818x_iowrite16(priv, &priv->map->BRSR, rates_mask);
-                rtl818x_iowrite8(priv, &priv->map->RESP_RATE, (max << 4) | min);
+                rtl818x_iowrite16(priv, &priv->map->BRSR, basic_mask);
+                rtl818x_iowrite8(priv, &priv->map->RESP_RATE, (resp_max << 4) |
+                                resp_min);
                 break;
 
         case RTL818X_CHIP_FAMILY_RTL8187SE:
-                /* in 8187se this is a BITMAP */
-                rtl818x_iowrite16(priv, &priv->map->BRSR_8187SE, rates_mask);
+                /* in 8187se this is a BITMAP. BRSR reg actually sets
+                 * response rates.
+                 */
+                rtl818x_iowrite16(priv, &priv->map->BRSR_8187SE, resp_mask);
                 break;
         }
 }
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 58ba71830886..40b6d1d006d7 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -467,7 +467,7 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw)
                     rtl_easy_concurrent_retrytimer_callback, (unsigned long)hw);
         /* <2> work queue */
         rtlpriv->works.hw = hw;
-        rtlpriv->works.rtl_wq = alloc_workqueue(rtlpriv->cfg->name, 0, 0);
+        rtlpriv->works.rtl_wq = alloc_workqueue("%s", 0, 0, rtlpriv->cfg->name);
         INIT_DELAYED_WORK(&rtlpriv->works.watchdog_wq,
                           (void *)rtl_watchdog_wq_callback);
         INIT_DELAYED_WORK(&rtlpriv->works.ips_nic_off_wq,
diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c
index f6179bc06086..af52f0bdb71e 100644
--- a/drivers/net/wireless/rtlwifi/core.c
+++ b/drivers/net/wireless/rtlwifi/core.c
@@ -1361,7 +1361,9 @@ static int rtl_op_ampdu_action(struct ieee80211_hw *hw,
         return 0;
 }
 
-static void rtl_op_sw_scan_start(struct ieee80211_hw *hw)
+static void rtl_op_sw_scan_start(struct ieee80211_hw *hw,
+                                 struct ieee80211_vif *vif,
+                                 const u8 *mac_addr)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
@@ -1396,7 +1398,8 @@ static void rtl_op_sw_scan_start(struct ieee80211_hw *hw)
         rtlpriv->cfg->ops->scan_operation_backup(hw, SCAN_OPT_BACKUP_BAND0);
 }
 
-static void rtl_op_sw_scan_complete(struct ieee80211_hw *hw)
+static void rtl_op_sw_scan_complete(struct ieee80211_hw *hw,
+                                    struct ieee80211_vif *vif)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
@@ -1828,3 +1831,9 @@ const struct ieee80211_ops rtl_ops = {
         .flush = rtl_op_flush,
 };
 EXPORT_SYMBOL_GPL(rtl_ops);
+
+bool rtl_btc_status_false(void)
+{
+        return false;
+}
+EXPORT_SYMBOL_GPL(rtl_btc_status_false);
diff --git a/drivers/net/wireless/rtlwifi/core.h b/drivers/net/wireless/rtlwifi/core.h
index 59cd3b9dca25..624e1dc16d31 100644
--- a/drivers/net/wireless/rtlwifi/core.h
+++ b/drivers/net/wireless/rtlwifi/core.h
@@ -42,5 +42,6 @@ void rtl_rfreg_delay(struct ieee80211_hw *hw, enum radio_path rfpath, u32 addr,
                      u32 mask, u32 data);
 void rtl_bb_delay(struct ieee80211_hw *hw, u32 addr, u32 data);
 bool rtl_cmd_send_packet(struct ieee80211_hw *hw, struct sk_buff *skb);
+bool rtl_btc_status_false(void);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index 667aba81246c..61f5d36eca6a 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -842,7 +842,8 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                         break;
                 }
                 /* handle command packet here */
-                if (rtlpriv->cfg->ops->rx_command_packet(hw, stats, skb)) {
+                if (rtlpriv->cfg->ops->rx_command_packet &&
+                    rtlpriv->cfg->ops->rx_command_packet(hw, stats, skb)) {
                                 dev_kfree_skb_any(skb);
                                 goto end;
                 }
@@ -1127,9 +1128,14 @@ static void _rtl_pci_prepare_bcn_tasklet(struct ieee80211_hw *hw)
 
         __skb_queue_tail(&ring->queue, pskb);
 
-        rtlpriv->cfg->ops->set_desc(hw, (u8 *)pdesc, true, HW_DESC_OWN,
-                                    &temp_one);
-
+        if (rtlpriv->use_new_trx_flow) {
+                temp_one = 4;
+                rtlpriv->cfg->ops->set_desc(hw, (u8 *)pbuffer_desc, true,
+                                            HW_DESC_OWN, (u8 *)&temp_one);
+        } else {
+                rtlpriv->cfg->ops->set_desc(hw, (u8 *)pdesc, true, HW_DESC_OWN,
+                                            &temp_one);
+        }
         return;
 }
 
@@ -1370,9 +1376,9 @@ static void _rtl_pci_free_tx_ring(struct ieee80211_hw *hw,
         ring->desc = NULL;
         if (rtlpriv->use_new_trx_flow) {
                 pci_free_consistent(rtlpci->pdev,
-                                    sizeof(*ring->desc) * ring->entries,
+                                    sizeof(*ring->buffer_desc) * ring->entries,
                                     ring->buffer_desc, ring->buffer_desc_dma);
-                ring->desc = NULL;
+                ring->buffer_desc = NULL;
         }
 }
 
@@ -1543,7 +1549,6 @@ int rtl_pci_reset_trx_ring(struct ieee80211_hw *hw)
                                                          true,
                                                          HW_DESC_TXBUFF_ADDR),
                                                  skb->len, PCI_DMA_TODEVICE);
-                                ring->idx = (ring->idx + 1) % ring->entries;
                                 kfree_skb(skb);
                                 ring->idx = (ring->idx + 1) % ring->entries;
                         }
@@ -1796,7 +1801,8 @@ static int rtl_pci_start(struct ieee80211_hw *hw)
         rtl_pci_reset_trx_ring(hw);
 
         rtlpci->driver_is_goingto_unload = false;
-        if (rtlpriv->cfg->ops->get_btc_status()) {
+        if (rtlpriv->cfg->ops->get_btc_status &&
+            rtlpriv->cfg->ops->get_btc_status()) {
                 rtlpriv->btcoexist.btc_ops->btc_init_variables(rtlpriv);
                 rtlpriv->btcoexist.btc_ops->btc_init_hal_vars(rtlpriv);
         }
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
index a00861b26ece..29983bc96a89 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
@@ -656,7 +656,8 @@ static u8 reserved_page_packet[TOTAL_RESERVED_PKT_LEN] = {
         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 };
 
-void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
+void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw,
+         bool (*cmd_send_packet)(struct ieee80211_hw *, struct sk_buff *))
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
@@ -722,7 +723,10 @@ void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
         memcpy((u8 *)skb_put(skb, totalpacketlen),
                &reserved_page_packet, totalpacketlen);
 
-        rtstatus = rtl_cmd_send_packet(hw, skb);
+        if (cmd_send_packet)
+                rtstatus = cmd_send_packet(hw, skb);
+        else
+                rtstatus = rtl_cmd_send_packet(hw, skb);
 
         if (rtstatus)
                 b_dlok = true;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h
index a815bd6273da..b64ae45dc674 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h
@@ -109,7 +109,9 @@ void rtl92c_fill_h2c_cmd(struct ieee80211_hw *hw, u8 element_id,
                          u32 cmd_len, u8 *p_cmdbuffer);
 void rtl92c_firmware_selfreset(struct ieee80211_hw *hw);
 void rtl92c_set_fw_pwrmode_cmd(struct ieee80211_hw *hw, u8 mode);
-void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished);
+void rtl92c_set_fw_rsvdpagepkt
+        (struct ieee80211_hw *hw,
+         bool (*cmd_send_packet)(struct ieee80211_hw *, struct sk_buff *));
 void rtl92c_set_fw_joinbss_report_cmd(struct ieee80211_hw *hw, u8 mstatus);
 void usb_writeN_async(struct rtl_priv *rtlpriv, u32 addr, void *data, u16 len);
 void rtl92c_set_p2p_ps_offload_cmd(struct ieee80211_hw *hw, u8 p2p_ps_state);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/def.h b/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
index 831df101d7b7..9b660df6fd71 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
@@ -114,6 +114,8 @@
         LE_BITS_TO_4BYTE(((__pcmdfbhdr) + 4), 16, 4)
 #define GET_C2H_CMD_FEEDBACK_CCX_SEQ(__pcmdfbhdr)       \
         LE_BITS_TO_4BYTE(((__pcmdfbhdr) + 4), 20, 12)
+#define GET_RX_STATUS_DESC_BUFF_ADDR(__pdesc)                   \
+        SHIFT_AND_MASK_LE(__pdesc + 24, 0, 32)
 
 #define CHIP_VER_B                      BIT(4)
 #define CHIP_BONDING_IDENTIFIER(_value) (((_value) >> 22) & 0x3)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
index 8ec0f031f48a..55357d69397a 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
@@ -459,7 +459,7 @@ void rtl92ce_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
                                 rtl_write_byte(rtlpriv, REG_FWHW_TXQ_CTRL + 2,
                                                tmp_reg422 & (~BIT(6)));
 
-                                rtl92c_set_fw_rsvdpagepkt(hw, 0);
+                                rtl92c_set_fw_rsvdpagepkt(hw, NULL);
 
                                 _rtl92ce_set_bcn_ctrl_reg(hw, BIT(3), 0);
                                 _rtl92ce_set_bcn_ctrl_reg(hw, 0, BIT(4));
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
index d86b5b566444..46ea07605eb4 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
@@ -244,6 +244,7 @@ static struct rtl_hal_ops rtl8192ce_hal_ops = {
         .phy_lc_calibrate = _rtl92ce_phy_lc_calibrate,
         .phy_set_bw_mode_callback = rtl92ce_phy_set_bw_mode_callback,
         .dm_dynamic_txpower = rtl92ce_dm_dynamic_txpower,
+        .get_btc_status = rtl_btc_status_false,
 };
 
 static struct rtl_mod_params rtl92ce_mod_params = {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
index 2fb9c7acb76a..dc3d20b17a26 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
@@ -728,6 +728,9 @@ u32 rtl92ce_get_desc(u8 *p_desc, bool istx, u8 desc_name)
                 case HW_DESC_RXPKT_LEN:
                         ret = GET_RX_DESC_PKT_LEN(pdesc);
                         break;
+                case HW_DESC_RXBUFF_ADDR:
+                        ret = GET_RX_STATUS_DESC_BUFF_ADDR(pdesc);
+                        break;
                 default:
                         RT_ASSERT(false, "ERR rxdesc :%d not process\n",
                                   desc_name);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
index 04aa0b5f5b3d..873363acbacf 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
@@ -1592,6 +1592,20 @@ void rtl92cu_get_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
         }
 }
 
+bool usb_cmd_send_packet(struct ieee80211_hw *hw, struct sk_buff *skb)
+{
+  /* Currently nothing happens here.
+   * Traffic stops after some seconds in WPA2 802.11n mode.
+   * Maybe because rtl8192cu chip should be set from here?
+   * If I understand correctly, the realtek vendor driver sends some urbs
+   * if its "here".
+   *
+   * This is maybe necessary:
+   * rtlpriv->cfg->ops->fill_tx_cmddesc(hw, buffer, 1, 1, skb);
+   */
+        return true;
+}
+
 void rtl92cu_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -1939,7 +1953,8 @@ void rtl92cu_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
                                         recover = true;
                                 rtl_write_byte(rtlpriv, REG_FWHW_TXQ_CTRL + 2,
                                                tmp_reg422 & (~BIT(6)));
-                                rtl92c_set_fw_rsvdpagepkt(hw, 0);
+                                rtl92c_set_fw_rsvdpagepkt(hw,
+                                                          &usb_cmd_send_packet);
                                 _rtl92cu_set_bcn_ctrl_reg(hw, BIT(3), 0);
                                 _rtl92cu_set_bcn_ctrl_reg(hw, 0, BIT(4));
                                 if (recover)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.h b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.h
index 0f7812e0c8aa..c1e33b0228c0 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.h
@@ -104,7 +104,6 @@ bool rtl92cu_gpio_radio_on_off_checking(struct ieee80211_hw *hw, u8 * valid);
 void rtl92cu_set_check_bssid(struct ieee80211_hw *hw, bool check_bssid);
 int rtl92c_download_fw(struct ieee80211_hw *hw);
 void rtl92c_set_fw_pwrmode_cmd(struct ieee80211_hw *hw, u8 mode);
-void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool dl_finished);
 void rtl92c_set_fw_joinbss_report_cmd(struct ieee80211_hw *hw, u8 mstatus);
 void rtl92c_fill_h2c_cmd(struct ieee80211_hw *hw,
                          u8 element_id, u32 cmd_len, u8 *p_cmdbuffer);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
index 7c5fbaf5fee0..e06bafee37f9 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -101,6 +101,12 @@ static void rtl92cu_deinit_sw_vars(struct ieee80211_hw *hw)
         }
 }
 
+/* get bt coexist status */
+static bool rtl92cu_get_btc_status(void)
+{
+        return false;
+}
+
 static struct rtl_hal_ops rtl8192cu_hal_ops = {
         .init_sw_vars = rtl92cu_init_sw_vars,
         .deinit_sw_vars = rtl92cu_deinit_sw_vars,
@@ -148,6 +154,7 @@ static struct rtl_hal_ops rtl8192cu_hal_ops = {
         .phy_set_bw_mode_callback = rtl92cu_phy_set_bw_mode_callback,
         .dm_dynamic_txpower = rtl92cu_dm_dynamic_txpower,
         .fill_h2c_cmd = rtl92c_fill_h2c_cmd,
+        .get_btc_status = rtl92cu_get_btc_status,
 };
 
 static struct rtl_mod_params rtl92cu_mod_params = {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/sw.c b/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
index edab5a5351b5..a0aba088259a 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
@@ -251,6 +251,7 @@ static struct rtl_hal_ops rtl8192de_hal_ops = {
         .get_rfreg = rtl92d_phy_query_rf_reg,
         .set_rfreg = rtl92d_phy_set_rf_reg,
         .linked_set_reg = rtl92d_linked_set_reg,
+        .get_btc_status = rtl_btc_status_false,
 };
 
 static struct rtl_mod_params rtl92de_mod_params = {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
index dfdc9b20e4ad..1a87edca2c3f 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
@@ -362,7 +362,7 @@ void rtl92ee_get_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
                 }
                 break;
         default:
-                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
                          "switch case not process %x\n", variable);
                 break;
         }
@@ -591,7 +591,7 @@ void rtl92ee_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
                                 acm_ctrl &= (~ACMHW_BEQEN);
                                 break;
                         default:
-                                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                                RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
                                          "switch case not process\n");
                                 break;
                         }
@@ -710,7 +710,7 @@ void rtl92ee_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
                 }
                 break;
         default:
-                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
                          "switch case not process %x\n", variable);
                 break;
         }
@@ -2424,7 +2424,7 @@ void rtl92ee_set_key(struct ieee80211_hw *hw, u32 key_index,
                         enc_algo = CAM_AES;
                         break;
                 default:
-                        RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                        RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
                                  "switch case not process\n");
                         enc_algo = CAM_TKIP;
                         break;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/def.h b/drivers/net/wireless/rtlwifi/rtl8192se/def.h
index 83c98674bfd3..6e7a70b43949 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/def.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/def.h
@@ -446,6 +446,8 @@
 /* DWORD 6 */
 #define SET_RX_STATUS__DESC_BUFF_ADDR(__pdesc, __val)   \
         SET_BITS_OFFSET_LE(__pdesc + 24, 0, 32, __val)
+#define GET_RX_STATUS_DESC_BUFF_ADDR(__pdesc)                   \
+        SHIFT_AND_MASK_LE(__pdesc + 24, 0, 32)
 
 #define SE_RX_HAL_IS_CCK_RATE(_pdesc)\
         (GET_RX_STATUS_DESC_RX_MCS(_pdesc) == DESC92_RATE1M ||  \
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/hw.c b/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
index 00e067044c08..5761d5b49e39 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
@@ -1201,6 +1201,9 @@ static int _rtl92se_set_media_status(struct ieee80211_hw *hw,
 
         }
 
+        if (type != NL80211_IFTYPE_AP &&
+            rtlpriv->mac80211.link_state < MAC80211_LINKED)
+                bt_msr = rtl_read_byte(rtlpriv, MSR) & ~MSR_LINK_MASK;
         rtl_write_byte(rtlpriv, (MSR), bt_msr);
 
         temp = rtl_read_dword(rtlpriv, TCR);
@@ -1262,6 +1265,7 @@ void rtl92se_enable_interrupt(struct ieee80211_hw *hw)
         rtl_write_dword(rtlpriv, INTA_MASK, rtlpci->irq_mask[0]);
         /* Support Bit 32-37(Assign as Bit 0-5) interrupt setting now */
         rtl_write_dword(rtlpriv, INTA_MASK + 4, rtlpci->irq_mask[1] & 0x3F);
+        rtlpci->irq_enabled = true;
 }
 
 void rtl92se_disable_interrupt(struct ieee80211_hw *hw)
@@ -1276,8 +1280,7 @@ void rtl92se_disable_interrupt(struct ieee80211_hw *hw)
         rtlpci = rtl_pcidev(rtl_pcipriv(hw));
         rtl_write_dword(rtlpriv, INTA_MASK, 0);
         rtl_write_dword(rtlpriv, INTA_MASK + 4, 0);
-
-        synchronize_irq(rtlpci->pdev->irq);
+        rtlpci->irq_enabled = false;
 }
 
 static u8 _rtl92s_set_sysclk(struct ieee80211_hw *hw, u8 data)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/phy.c b/drivers/net/wireless/rtlwifi/rtl8192se/phy.c
index 77c5b5f35244..4b4612fe2fdb 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/phy.c
@@ -399,6 +399,8 @@ static bool _rtl92s_phy_sw_chnl_step_by_step(struct ieee80211_hw *hw,
                 case 2:
                         currentcmd = &postcommoncmd[*step];
                         break;
+                default:
+                        return true;
                 }
 
                 if (currentcmd->cmdid == CMDID_END) {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
index 1bff2a0f7600..fb003868bdef 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
@@ -87,11 +87,8 @@ static void rtl92s_init_aspm_vars(struct ieee80211_hw *hw)
 static void rtl92se_fw_cb(const struct firmware *firmware, void *context)
 {
         struct ieee80211_hw *hw = context;
-        struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw);
         struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_pci *rtlpci = rtl_pcidev(pcipriv);
         struct rt_firmware *pfirmware = NULL;
-        int err;
 
         RT_TRACE(rtlpriv, COMP_ERR, DBG_LOUD,
                          "Firmware callback routine entered!\n");
@@ -112,20 +109,6 @@ static void rtl92se_fw_cb(const struct firmware *firmware, void *context)
         memcpy(pfirmware->sz_fw_tmpbuffer, firmware->data, firmware->size);
         pfirmware->sz_fw_tmpbufferlen = firmware->size;
         release_firmware(firmware);
-
-        err = ieee80211_register_hw(hw);
-        if (err) {
-                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
-                         "Can't register mac80211 hw\n");
-                return;
-        } else {
-                rtlpriv->mac80211.mac80211_registered = 1;
-        }
-        rtlpci->irq_alloc = 1;
-        set_bit(RTL_STATUS_INTERFACE_START, &rtlpriv->status);
-
-        /*init rfkill */
-        rtl_init_rfkill(hw);
 }
 
 static int rtl92s_init_sw_vars(struct ieee80211_hw *hw)
@@ -226,8 +209,8 @@ static int rtl92s_init_sw_vars(struct ieee80211_hw *hw)
         if (!rtlpriv->rtlhal.pfirmware)
                 return 1;
 
-        rtlpriv->max_fw_size = RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE;
-
+        rtlpriv->max_fw_size = RTL8190_MAX_FIRMWARE_CODE_SIZE*2 +
+                               sizeof(struct fw_hdr);
         pr_info("Driver for Realtek RTL8192SE/RTL8191SE\n"
                 "Loading firmware %s\n", rtlpriv->cfg->fw_name);
         /* request fw */
@@ -253,6 +236,19 @@ static void rtl92s_deinit_sw_vars(struct ieee80211_hw *hw)
         }
 }
 
+static bool rtl92se_is_tx_desc_closed(struct ieee80211_hw *hw, u8 hw_queue,
+                                      u16 index)
+{
+        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+        struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[hw_queue];
+        u8 *entry = (u8 *)(&ring->desc[ring->idx]);
+        u8 own = (u8)rtl92se_get_desc(entry, true, HW_DESC_OWN);
+
+        if (own)
+                return false;
+        return true;
+}
+
 static struct rtl_hal_ops rtl8192se_hal_ops = {
         .init_sw_vars = rtl92s_init_sw_vars,
         .deinit_sw_vars = rtl92s_deinit_sw_vars,
@@ -286,6 +282,7 @@ static struct rtl_hal_ops rtl8192se_hal_ops = {
         .led_control = rtl92se_led_control,
         .set_desc = rtl92se_set_desc,
         .get_desc = rtl92se_get_desc,
+        .is_tx_desc_closed = rtl92se_is_tx_desc_closed,
         .tx_polling = rtl92se_tx_polling,
         .enable_hw_sec = rtl92se_enable_hw_security_config,
         .set_key = rtl92se_set_key,
@@ -294,6 +291,7 @@ static struct rtl_hal_ops rtl8192se_hal_ops = {
         .set_bbreg = rtl92s_phy_set_bb_reg,
         .get_rfreg = rtl92s_phy_query_rf_reg,
         .set_rfreg = rtl92s_phy_set_rf_reg,
+        .get_btc_status = rtl_btc_status_false,
 };
 
 static struct rtl_mod_params rtl92se_mod_params = {
@@ -322,6 +320,8 @@ static struct rtl_hal_cfg rtl92se_hal_cfg = {
         .maps[MAC_RCR_ACRC32] = RCR_ACRC32,
         .maps[MAC_RCR_ACF] = RCR_ACF,
         .maps[MAC_RCR_AAP] = RCR_AAP,
+        .maps[MAC_HIMR] = INTA_MASK,
+        .maps[MAC_HIMRE] = INTA_MASK + 4,
 
         .maps[EFUSE_TEST] = REG_EFUSE_TEST,
         .maps[EFUSE_CTRL] = REG_EFUSE_CTRL,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
index b358ebce8942..672fd3b02835 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
@@ -640,6 +640,9 @@ u32 rtl92se_get_desc(u8 *desc, bool istx, u8 desc_name)
                 case HW_DESC_RXPKT_LEN:
                         ret = GET_RX_STATUS_DESC_PKT_LEN(desc);
                         break;
+                case HW_DESC_RXBUFF_ADDR:
+                        ret = GET_RX_STATUS_DESC_BUFF_ADDR(desc);
+                        break;
                 default:
                         RT_ASSERT(false, "ERR rxdesc :%d not process\n",
                                   desc_name);
diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/phy.c b/drivers/net/wireless/rtlwifi/rtl8821ae/phy.c
index 9786313dc62f..9b4d8a637915 100644
--- a/drivers/net/wireless/rtlwifi/rtl8821ae/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/phy.c
@@ -800,7 +800,7 @@ static void _rtl8821ae_phy_set_txpower_by_rate_base(struct ieee80211_hw *hw,
                                  "Invalid RateSection %d in Band 2.4G,Rf Path %d, %dTx in PHY_SetTxPowerByRateBase()\n",
                                  rate_section, path, txnum);
                         break;
-                };
+                }
         } else if (band == BAND_ON_5G) {
                 switch (rate_section) {
                 case OFDM:
@@ -823,7 +823,7 @@ static void _rtl8821ae_phy_set_txpower_by_rate_base(struct ieee80211_hw *hw,
                                 "Invalid RateSection %d in Band 5G, Rf Path %d, %dTx in PHY_SetTxPowerByRateBase()\n",
                                 rate_section, path, txnum);
                         break;
-                };
+                }
         } else {
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
                         "Invalid Band %d in PHY_SetTxPowerByRateBase()\n", band);
@@ -870,7 +870,7 @@ static u8 _rtl8821ae_phy_get_txpower_by_rate_base(struct ieee80211_hw *hw,
                                  "Invalid RateSection %d in Band 2.4G, Rf Path %d, %dTx in PHY_GetTxPowerByRateBase()\n",
                                  rate_section, path, txnum);
                         break;
-                };
+                }
         } else if (band == BAND_ON_5G) {
                 switch (rate_section) {
                 case OFDM:
@@ -893,7 +893,7 @@ static u8 _rtl8821ae_phy_get_txpower_by_rate_base(struct ieee80211_hw *hw,
                                  "Invalid RateSection %d in Band 5G, Rf Path %d, %dTx in PHY_GetTxPowerByRateBase()\n",
                                  rate_section, path, txnum);
                         break;
-                };
+                }
         } else {
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
                          "Invalid Band %d in PHY_GetTxPowerByRateBase()\n", band);
@@ -1889,15 +1889,18 @@ static void _rtl8821ae_store_tx_power_by_rate(struct ieee80211_hw *hw,
         struct rtl_phy *rtlphy = &rtlpriv->phy;
         u8 rate_section = _rtl8821ae_get_rate_section_index(regaddr);
 
-        if (band != BAND_ON_2_4G && band != BAND_ON_5G)
+        if (band != BAND_ON_2_4G && band != BAND_ON_5G) {
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_WARNING, "Invalid Band %d\n", band);
-
-        if (rfpath >= MAX_RF_PATH)
+                band = BAND_ON_2_4G;
+        }
+        if (rfpath >= MAX_RF_PATH) {
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_WARNING, "Invalid RfPath %d\n", rfpath);
-
-        if (txnum >= MAX_RF_PATH)
+                rfpath = MAX_RF_PATH - 1;
+        }
+        if (txnum >= MAX_RF_PATH) {
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_WARNING, "Invalid TxNum %d\n", txnum);
-
+                txnum = MAX_RF_PATH - 1;
+        }
         rtlphy->tx_power_by_rate_offset[band][rfpath][txnum][rate_section] = data;
         RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
                  "TxPwrByRateOffset[Band %d][RfPath %d][TxNum %d][RateSection %d] = 0x%x\n",
@@ -3743,7 +3746,7 @@ static void _rtl8821ae_iqk_tx_fill_iqc(struct ieee80211_hw *hw,
                 break;
         default:
                 break;
-        };
+        }
 }
 
 static void _rtl8821ae_iqk_rx_fill_iqc(struct ieee80211_hw *hw,
@@ -3764,7 +3767,7 @@ static void _rtl8821ae_iqk_rx_fill_iqc(struct ieee80211_hw *hw,
                 break;
         default:
                 break;
-        };
+        }
 }
 
 #define cal_num 10
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index 10cf69c4bc42..46ee956d0235 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -1117,7 +1117,18 @@ int rtl_usb_probe(struct usb_interface *intf,
         }
         rtlpriv->cfg->ops->init_sw_leds(hw);
 
+        err = ieee80211_register_hw(hw);
+        if (err) {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                         "Can't register mac80211 hw.\n");
+                err = -ENODEV;
+                goto error_out;
+        }
+        rtlpriv->mac80211.mac80211_registered = 1;
+
+        set_bit(RTL_STATUS_INTERFACE_START, &rtlpriv->status);
         return 0;
+
 error_out:
         rtl_deinit_core(hw);
         _rtl_usb_io_handler_release(hw);
diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
index 976667ae8549..6866dcf24340 100644
--- a/drivers/net/wireless/rtlwifi/wifi.h
+++ b/drivers/net/wireless/rtlwifi/wifi.h
@@ -1370,7 +1370,7 @@ struct rtl_mac {
         bool rdg_en;
 
         /*AP*/
-        u8 bssid[6];
+        u8 bssid[ETH_ALEN] __aligned(2);
         u32 vendor;
         u8 mcs[16];     /* 16 bytes mcs for HT rates. */
         u32 basic_rates; /* b/g rates */
diff --git a/drivers/net/wireless/ti/wl1251/main.c b/drivers/net/wireless/ti/wl1251/main.c
index 38234851457e..0b30a7b4d663 100644
--- a/drivers/net/wireless/ti/wl1251/main.c
+++ b/drivers/net/wireless/ti/wl1251/main.c
@@ -1029,7 +1029,7 @@ static int wl1251_op_hw_scan(struct ieee80211_hw *hw,
                         goto out_sleep;
         }
 
-        skb = ieee80211_probereq_get(wl->hw, wl->vif, ssid, ssid_len,
+        skb = ieee80211_probereq_get(wl->hw, wl->vif->addr, ssid, ssid_len,
                                      req->ie_len);
         if (!skb) {
                 ret = -ENOMEM;
diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c
index 05604ee31224..b82661962d33 100644
--- a/drivers/net/wireless/ti/wlcore/cmd.c
+++ b/drivers/net/wireless/ti/wlcore/cmd.c
@@ -64,6 +64,9 @@ static int __wlcore_cmd_send(struct wl1271 *wl, u16 id, void *buf,
                      id != CMD_STOP_FWLOGGER))
                 return -EIO;
 
+        if (WARN_ON_ONCE(len < sizeof(*cmd)))
+                return -EIO;
+
         cmd = buf;
         cmd->id = cpu_to_le16(id);
         cmd->status = 0;
@@ -128,8 +131,9 @@ static int __wlcore_cmd_send(struct wl1271 *wl, u16 id, void *buf,
  * send command to fw and return cmd status on success
  * valid_rets contains a bitmap of allowed error codes
  */
-int wlcore_cmd_send_failsafe(struct wl1271 *wl, u16 id, void *buf, size_t len,
-                             size_t res_len, unsigned long valid_rets)
+static int wlcore_cmd_send_failsafe(struct wl1271 *wl, u16 id, void *buf,
+                                    size_t len, size_t res_len,
+                                    unsigned long valid_rets)
 {
         int ret = __wlcore_cmd_send(wl, id, buf, len, res_len);
 
@@ -150,7 +154,6 @@ fail:
         wl12xx_queue_recovery_work(wl);
         return ret;
 }
-EXPORT_SYMBOL_GPL(wl1271_cmd_send);
 
 /*
  * wrapper for wlcore_cmd_send that accept only CMD_STATUS_SUCCESS
@@ -165,6 +168,7 @@ int wl1271_cmd_send(struct wl1271 *wl, u16 id, void *buf, size_t len,
                 return ret;
         return 0;
 }
+EXPORT_SYMBOL_GPL(wl1271_cmd_send);
 
 /*
  * Poll the mailbox event field until any of the bits in the mask is set or a
@@ -891,6 +895,9 @@ int wlcore_cmd_configure_failsafe(struct wl1271 *wl, u16 id, void *buf,
 
         wl1271_debug(DEBUG_CMD, "cmd configure (%d)", id);
 
+        if (WARN_ON_ONCE(len < sizeof(*acx)))
+                return -EIO;
+
         acx->id = cpu_to_le16(id);
 
         /* payload length, does not include any headers */
@@ -1138,7 +1145,7 @@ int wl12xx_cmd_build_probe_req(struct wl1271 *wl, struct wl12xx_vif *wlvif,
 
         wl1271_debug(DEBUG_SCAN, "build probe request band %d", band);
 
-        skb = ieee80211_probereq_get(wl->hw, vif, ssid, ssid_len,
+        skb = ieee80211_probereq_get(wl->hw, vif->addr, ssid, ssid_len,
                                      ie0_len + ie1_len);
         if (!skb) {
                 ret = -ENOMEM;
diff --git a/drivers/net/wireless/ti/wlcore/cmd.h b/drivers/net/wireless/ti/wlcore/cmd.h
index ca6a28b03f8f..453684a71d30 100644
--- a/drivers/net/wireless/ti/wlcore/cmd.h
+++ b/drivers/net/wireless/ti/wlcore/cmd.h
@@ -31,8 +31,6 @@ struct acx_header;
 
 int wl1271_cmd_send(struct wl1271 *wl, u16 id, void *buf, size_t len,
                     size_t res_len);
-int wlcore_cmd_send_failsafe(struct wl1271 *wl, u16 id, void *buf, size_t len,
-                             size_t res_len, unsigned long valid_rets);
 int wl12xx_cmd_role_enable(struct wl1271 *wl, u8 *addr, u8 role_type,
                            u8 *role_id);
 int wl12xx_cmd_role_disable(struct wl1271 *wl, u8 *role_id);
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index 575c8f6d4009..6ad3fcedab9b 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -5177,10 +5177,11 @@ out:
 }
 
 static void wl12xx_op_channel_switch(struct ieee80211_hw *hw,
+                                     struct ieee80211_vif *vif,
                                      struct ieee80211_channel_switch *ch_switch)
 {
         struct wl1271 *wl = hw->priv;
-        struct wl12xx_vif *wlvif;
+        struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
         int ret;
 
         wl1271_debug(DEBUG_MAC80211, "mac80211 channel switch");
@@ -5190,14 +5191,8 @@ static void wl12xx_op_channel_switch(struct ieee80211_hw *hw,
         mutex_lock(&wl->mutex);
 
         if (unlikely(wl->state == WLCORE_STATE_OFF)) {
-                wl12xx_for_each_wlvif_sta(wl, wlvif) {
-                        struct ieee80211_vif *vif = wl12xx_wlvif_to_vif(wlvif);
-
-                        if (!test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags))
-                                continue;
-
+                if (test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags))
                         ieee80211_chswitch_done(vif, false);
-                }
                 goto out;
         } else if (unlikely(wl->state != WLCORE_STATE_ON)) {
                 goto out;
@@ -5208,11 +5203,9 @@ static void wl12xx_op_channel_switch(struct ieee80211_hw *hw,
                 goto out;
 
         /* TODO: change mac80211 to pass vif as param */
-        wl12xx_for_each_wlvif_sta(wl, wlvif) {
-                unsigned long delay_usec;
 
-                if (!test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags))
-                        continue;
+        if (test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags)) {
+                unsigned long delay_usec;
 
                 ret = wl->ops->channel_switch(wl, wlvif, ch_switch);
                 if (ret)
@@ -5222,10 +5215,10 @@ static void wl12xx_op_channel_switch(struct ieee80211_hw *hw,
 
                 /* indicate failure 5 seconds after channel switch time */
                 delay_usec = ieee80211_tu_to_usec(wlvif->beacon_int) *
-                             ch_switch->count;
+                        ch_switch->count;
                 ieee80211_queue_delayed_work(hw, &wlvif->channel_switch_work,
-                                usecs_to_jiffies(delay_usec) +
-                                msecs_to_jiffies(5000));
+                                             usecs_to_jiffies(delay_usec) +
+                                             msecs_to_jiffies(5000));
         }
 
 out_sleep: